html/cgi-bin/proxy.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Apache::Htpasswd;
  24
  25 # enable only the following on debugging purpose
  26 #use warnings;
  27 #use CGI::Carp 'fatalsToBrowser';
  28
  29 require '/var/ipfire/general-functions.pl';
  30 require "${General::swroot}/lang.pl";
  31 require "${General::swroot}/header.pl";
  32
  33 require "${General::swroot}/ids-functions.pl";
  34
  35 my @squidversion = &General::system_output("/usr/sbin/squid", "-v");
  36 my $http_port='81';
  37 my $https_port='444';
  38
  39 my %color = ();
  40 my %mainsettings = ();
  41 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  42 &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
  43
  44 my %proxysettings=();
  45 my %netsettings=();
  46 my %filtersettings=();
  47 my %xlratorsettings=();
  48 my %stdproxysettings=();
  49 my %mainsettings=();
  50
  51 my %checked=();
  52 my %selected=();
  53
  54 my @throttle_limits=(64,128,256,512,1024,1536,2048,3072,4096,5120,6144,7168,8192,10240,16384,20480,51200,102400);
  55
  56 my $def_ports_safe="80 # http\n21 # ftp\n443 # https\n563 # snews\n70 # gopher\n210 # wais\n1025-65535 # unregistered ports\n280 # http-mgmt\n488 # gss-http\n591 # filemaker\n777 # multiling http\n800 # Squids port (for icons)\n";
  57 my $def_ports_ssl="443 # https\n563 # snews\n";
  58
  59 my $hintcolour='#FFFFCC';
  60 my $ncsa_buttontext='';
  61 my $language='';
  62 my $i=0;
  63 my $n=0;
  64 my $id=0;
  65 my $line='';
  66 my $user='';
  67 my @userlist=();
  68 my @grouplist=();
  69 my @temp=();
  70 my @templist=();
  71
  72 my $cachemem=0;
  73 my $proxy1='';
  74 my $proxy2='';
  75 my $browser_regexp='';
  76 my $needhup = 0;
  77 my $errormessage='';
  78
  79 my $acldir   = "${General::swroot}/proxy/advanced/acls";
  80 my $ncsadir  = "${General::swroot}/proxy/advanced/ncsa";
  81 my $raddir   = "${General::swroot}/proxy/advanced/radius";
  82 my $identdir = "${General::swroot}/proxy/advanced/ident";
  83 my $credir   = "${General::swroot}/proxy/advanced/cre";
  84
  85 my $userdb = "$ncsadir/passwd";
  86 my $stdgrp = "$ncsadir/standard.grp";
  87 my $extgrp = "$ncsadir/extended.grp";
  88 my $disgrp = "$ncsadir/disabled.grp";
  89
  90 my $mimetypes = "${General::swroot}/proxy/advanced/mimetypes";
  91 my $throttled_urls = "${General::swroot}/proxy/advanced/throttle";
  92
  93 my $cre_enabled = "${General::swroot}/proxy/advanced/cre/enable";
  94 my $cre_groups  = "${General::swroot}/proxy/advanced/cre/classrooms";
  95 my $cre_svhosts = "${General::swroot}/proxy/advanced/cre/supervisors";
  96
  97 my $identhosts = "$identdir/hosts";
  98
  99 my $authdir  = "/usr/lib/squid";
 100 my $errordir = "/usr/lib/squid/errors";
 101
 102 my $acl_src_subnets = "$acldir/src_subnets.acl";
 103 my $acl_src_banned_ip  = "$acldir/src_banned_ip.acl";
 104 my $acl_src_banned_mac = "$acldir/src_banned_mac.acl";
 105 my $acl_src_unrestricted_ip  = "$acldir/src_unrestricted_ip.acl";
 106 my $acl_src_unrestricted_mac = "$acldir/src_unrestricted_mac.acl";
 107 my $acl_src_noaccess_ip  = "$acldir/src_noaccess_ip.acl";
 108 my $acl_src_noaccess_mac = "$acldir/src_noaccess_mac.acl";
 109 my $acl_dst_noauth   = "$acldir/dst_noauth.acl";
 110 my $acl_dst_noauth_dom = "$acldir/dst_noauth_dom.acl";
 111 my $acl_dst_noauth_net = "$acldir/dst_noauth_net.acl";
 112 my $acl_dst_noauth_url = "$acldir/dst_noauth_url.acl";
 113 my $acl_dst_nocache  = "$acldir/dst_nocache.acl";
 114 my $acl_dst_nocache_dom = "$acldir/dst_nocache_dom.acl";
 115 my $acl_dst_nocache_net = "$acldir/dst_nocache_net.acl";
 116 my $acl_dst_nocache_url = "$acldir/dst_nocache_url.acl";
 117 my $acl_dst_throttle = "$acldir/dst_throttle.acl";
 118 my $acl_ports_safe = "$acldir/ports_safe.acl";
 119 my $acl_ports_ssl  = "$acldir/ports_ssl.acl";
 120 my $acl_include = "$acldir/include.acl";
 121
 122 my $acl_dst_noproxy_url = "$acldir/dst_noproxy_url.acl";
 123 my $acl_dst_noproxy_ip = "$acldir/dst_noproxy_ip.acl";
 124
 125 my $updaccelversion  = 'n/a';
 126 my $urlfilterversion = 'n/a';
 127
 128 unless (-d "$acldir")   { mkdir("$acldir"); }
 129 unless (-d "$ncsadir")  { mkdir("$ncsadir"); }
 130 unless (-d "$raddir")   { mkdir("$raddir"); }
 131 unless (-d "$identdir") { mkdir("$identdir"); }
 132 unless (-d "$credir")   { mkdir("$credir"); }
 133
 134 unless (-e $cre_groups)  { &General::system("touch", "$cre_groups"); }
 135 unless (-e $cre_svhosts) { &General::system("touch $cre_svhosts"); }
 136
 137 unless (-e $userdb) { &General::system("touch", "$userdb"); }
 138 unless (-e $stdgrp) { &General::system("touch", "$stdgrp"); }
 139 unless (-e $extgrp) { &General::system("touch", "$extgrp"); }
 140 unless (-e $disgrp) { &General::system("touch", "$disgrp"); }
 141
 142 unless (-e $acl_src_subnets)    { &General::system("touch", "$acl_src_subnets"); }
 143 unless (-e $acl_src_banned_ip)  { &General::system("touch", "$acl_src_banned_ip"); }
 144 unless (-e $acl_src_banned_mac) { &General::system("touch", "$acl_src_banned_mac"); }
 145 unless (-e $acl_src_unrestricted_ip)  { &General::system("touch", "$acl_src_unrestricted_ip"); }
 146 unless (-e $acl_src_unrestricted_mac) { &General::system("touch", "$acl_src_unrestricted_mac"); }
 147 unless (-e $acl_src_noaccess_ip)  { &General::system("touch", "$acl_src_noaccess_ip"); }
 148 unless (-e $acl_src_noaccess_mac) { &General::system("touch", "$acl_src_noaccess_mac"); }
 149 unless (-e $acl_dst_noauth)     { &General::system("touch", "$acl_dst_noauth"); }
 150 unless (-e $acl_dst_noauth_dom) { &General::system("touch", "$acl_dst_noauth_dom"); }
 151 unless (-e $acl_dst_noauth_net) { &General::system("touch", "$acl_dst_noauth_net"); }
 152 unless (-e $acl_dst_noauth_url) { &General::system("touch", "$acl_dst_noauth_url"); }
 153 unless (-e $acl_dst_nocache)     { &General::system("touch", "$acl_dst_nocache"); }
 154 unless (-e $acl_dst_nocache_dom) { &General::system("touch", "$acl_dst_nocache_dom"); }
 155 unless (-e $acl_dst_nocache_net) { &General::system("touch", "$acl_dst_nocache_net"); }
 156 unless (-e $acl_dst_nocache_url) { &General::system("touch", "$acl_dst_nocache_url"); }
 157 unless (-e $acl_dst_throttle)  { &General::system("touch", "$acl_dst_throttle"); }
 158 unless (-e $acl_ports_safe) { &General::system("touch", "$acl_ports_safe"); }
 159 unless (-e $acl_ports_ssl)  { &General::system("touch", "$acl_ports_ssl"); }
 160 unless (-e $acl_include) { &General::system("touch", "$acl_include"); }
 161
 162 unless (-e $mimetypes) { &General::system("touch", "$mimetypes"); }
 163
 164 my $HAVE_NTLM_AUTH = (-e "/usr/bin/ntlm_auth");
 165
 166 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
 167 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 168
 169 my $green_cidr = "";
 170 if (&Header::green_used() && $netsettings{'GREEN_DEV'}) {
 171         $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}");
 172 }
 173
 174 my $blue_cidr = "";
 175 if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
 176         $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}");
 177 }
 178
 179 &Header::showhttpheaders();
 180
 181 $proxysettings{'ACTION'} = '';
 182 $proxysettings{'VALID'} = '';
 183
 184 $proxysettings{'ENABLE'} = 'off';
 185 $proxysettings{'ENABLE_BLUE'} = 'off';
 186 $proxysettings{'TRANSPARENT'} = 'off';
 187 $proxysettings{'TRANSPARENT_BLUE'} = 'off';
 188 $proxysettings{'PROXY_PORT'} = '800';
 189 $proxysettings{'TRANSPARENT_PORT'} = '3128';
 190 $proxysettings{'VISIBLE_HOSTNAME'} = '';
 191 $proxysettings{'ADMIN_MAIL_ADDRESS'} = '';
 192 $proxysettings{'ADMIN_PASSWORD'} = '';
 193 $proxysettings{'ERR_LANGUAGE'} = 'en';
 194 $proxysettings{'ERR_DESIGN'} = 'ipfire';
 195 $proxysettings{'SUPPRESS_VERSION'} = 'on';
 196 $proxysettings{'FORWARD_VIA'} = 'off';
 197 $proxysettings{'FORWARD_IPADDRESS'} = 'off';
 198 $proxysettings{'FORWARD_USERNAME'} = 'off';
 199 $proxysettings{'NO_CONNECTION_AUTH'} = 'off';
 200 $proxysettings{'UPSTREAM_PROXY'} = '';
 201 $proxysettings{'UPSTREAM_USER'} = '';
 202 $proxysettings{'UPSTREAM_PASSWORD'} = '';
 203 $proxysettings{'LOGGING'} = 'off';
 204 $proxysettings{'CACHEMGR'} = 'off';
 205 $proxysettings{'LOGQUERY'} = 'off';
 206 $proxysettings{'LOGUSERAGENT'} = 'off';
 207 $proxysettings{'FILEDESCRIPTORS'} = '16384';
 208 $proxysettings{'CACHE_MEM'} = '128';
 209 $proxysettings{'CACHE_SIZE'} = '0';
 210 $proxysettings{'MAX_SIZE'} = '4096';
 211 $proxysettings{'MIN_SIZE'} = '0';
 212 $proxysettings{'MEM_POLICY'} = 'LRU';
 213 $proxysettings{'CACHE_POLICY'} = 'LRU';
 214 $proxysettings{'L1_DIRS'} = '16';
 215 $proxysettings{'OFFLINE_MODE'} = 'off';
 216 $proxysettings{'CACHE_DIGESTS'} = 'off';
 217 $proxysettings{'CLASSROOM_EXT'} = 'off';
 218 $proxysettings{'SUPERVISOR_PASSWORD'} = '';
 219 $proxysettings{'NO_PROXY_LOCAL'} = 'off';
 220 $proxysettings{'NO_PROXY_LOCAL_BLUE'} = 'off';
 221 $proxysettings{'TIME_ACCESS_MODE'} = 'allow';
 222 $proxysettings{'TIME_FROM_HOUR'} = '00';
 223 $proxysettings{'TIME_FROM_MINUTE'} = '00';
 224 $proxysettings{'TIME_TO_HOUR'} = '24';
 225 $proxysettings{'TIME_TO_MINUTE'} = '00';
 226 $proxysettings{'MAX_OUTGOING_SIZE'} = '0';
 227 $proxysettings{'MAX_INCOMING_SIZE'} = '0';
 228 $proxysettings{'THROTTLING_GREEN_TOTAL'} = 'unlimited';
 229 $proxysettings{'THROTTLING_GREEN_HOST'} = 'unlimited';
 230 $proxysettings{'THROTTLING_BLUE_TOTAL'} = 'unlimited';
 231 $proxysettings{'THROTTLING_BLUE_HOST'} = 'unlimited';
 232 $proxysettings{'ENABLE_MIME_FILTER'} = 'off';
 233 $proxysettings{'AUTH_METHOD'} = 'none';
 234 $proxysettings{'AUTH_REALM'} = '';
 235 $proxysettings{'AUTH_MAX_USERIP'} = '';
 236 $proxysettings{'AUTH_CACHE_TTL'} = '60';
 237 $proxysettings{'AUTH_IPCACHE_TTL'} = '0';
 238 $proxysettings{'AUTH_CHILDREN'} = '5';
 239 $proxysettings{'NCSA_MIN_PASS_LEN'} = '6';
 240 $proxysettings{'NCSA_BYPASS_REDIR'} = 'off';
 241 $proxysettings{'NCSA_USERNAME'} = '';
 242 $proxysettings{'NCSA_GROUP'} = '';
 243 $proxysettings{'NCSA_PASS'} = '';
 244 $proxysettings{'NCSA_PASS_CONFIRM'} = '';
 245 $proxysettings{'LDAP_BASEDN'} = '';
 246 $proxysettings{'LDAP_TYPE'} = 'ADS';
 247 $proxysettings{'LDAP_SERVER'} = '';
 248 $proxysettings{'LDAP_PORT'} = '389';
 249 $proxysettings{'LDAP_BINDDN_USER'} = '';
 250 $proxysettings{'LDAP_BINDDN_PASS'} = '';
 251 $proxysettings{'LDAP_GROUP'} = '';
 252 $proxysettings{'NTLM_AUTH_GROUP'} = '';
 253 $proxysettings{'NTLM_AUTH_BASIC'} = 'off';
 254 $proxysettings{'NTLM_DOMAIN'} = '';
 255 $proxysettings{'NTLM_PDC'} = '';
 256 $proxysettings{'NTLM_BDC'} = '';
 257 $proxysettings{'NTLM_ENABLE_ACL'} = 'off';
 258 $proxysettings{'NTLM_USER_ACL'} = 'positive';
 259 $proxysettings{'RADIUS_SERVER'} = '';
 260 $proxysettings{'RADIUS_PORT'} = '1812';
 261 $proxysettings{'RADIUS_IDENTIFIER'} = '';
 262 $proxysettings{'RADIUS_SECRET'} = '';
 263 $proxysettings{'RADIUS_ENABLE_ACL'} = 'off';
 264 $proxysettings{'RADIUS_USER_ACL'} = 'positive';
 265 $proxysettings{'IDENT_REQUIRED'} = 'off';
 266 $proxysettings{'IDENT_TIMEOUT'} = '10';
 267 $proxysettings{'IDENT_ENABLE_ACL'} = 'off';
 268 $proxysettings{'IDENT_USER_ACL'} = 'positive';
 269 $proxysettings{'ENABLE_FILTER'} = 'off';
 270 $proxysettings{'ENABLE_UPDXLRATOR'} = 'off';
 271 $proxysettings{'ENABLE_CLAMAV'} = 'off';
 272
 273 $ncsa_buttontext = $Lang::tr{'advproxy NCSA create user'};
 274
 275 &Header::getcgihash(\%proxysettings);
 276
 277 if ($proxysettings{'THROTTLING_GREEN_TOTAL'} eq 0) {$proxysettings{'THROTTLING_GREEN_TOTAL'} = 'unlimited';}
 278 if ($proxysettings{'THROTTLING_GREEN_HOST'}  eq 0) {$proxysettings{'THROTTLING_GREEN_HOST'}  = 'unlimited';}
 279 if ($proxysettings{'THROTTLING_BLUE_TOTAL'}  eq 0) {$proxysettings{'THROTTLING_BLUE_TOTAL'}  = 'unlimited';}
 280 if ($proxysettings{'THROTTLING_BLUE_HOST'}   eq 0) {$proxysettings{'THROTTLING_BLUE_HOST'}   = 'unlimited';}
 281
 282 if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy NCSA user management'})
 283 {
 284         $proxysettings{'NCSA_EDIT_MODE'} = 'yes';
 285 }
 286
 287 if ($proxysettings{'ACTION'} eq $Lang::tr{'add'})
 288 {
 289         $proxysettings{'NCSA_EDIT_MODE'} = 'yes';
 290         if (length($proxysettings{'NCSA_PASS'}) < $proxysettings{'NCSA_MIN_PASS_LEN'}) {
 291                 $errormessage = $Lang::tr{'advproxy errmsg password length 1'}.$proxysettings{'NCSA_MIN_PASS_LEN'}.$Lang::tr{'advproxy errmsg password length 2'};
 292         }
 293         if (!($proxysettings{'NCSA_PASS'} eq $proxysettings{'NCSA_PASS_CONFIRM'})) {
 294                 $errormessage = $Lang::tr{'advproxy errmsg passwords different'};
 295         }
 296         if ($proxysettings{'NCSA_USERNAME'} eq '') {
 297                 $errormessage = $Lang::tr{'advproxy errmsg no username'};
 298         }
 299         if (!$errormessage) {
 300                 $proxysettings{'NCSA_USERNAME'} =~ tr/A-Z/a-z/;
 301                 &adduser($proxysettings{'NCSA_USERNAME'}, $proxysettings{'NCSA_PASS'}, $proxysettings{'NCSA_GROUP'});
 302         }
 303         $proxysettings{'NCSA_USERNAME'} = '';
 304         $proxysettings{'NCSA_GROUP'} = '';
 305         $proxysettings{'NCSA_PASS'} = '';
 306         $proxysettings{'NCSA_PASS_CONFIRM'} = '';
 307 }
 308
 309 if ($proxysettings{'ACTION'} eq $Lang::tr{'remove'})
 310 {
 311         $proxysettings{'NCSA_EDIT_MODE'} = 'yes';
 312         &deluser($proxysettings{'ID'});
 313 }
 314
 315 $checked{'ENABLE_UPDXLRATOR'}{'off'} = '';
 316 $checked{'ENABLE_UPDXLRATOR'}{'on'} = '';
 317 $checked{'ENABLE_UPDXLRATOR'}{$proxysettings{'ENABLE_UPDXLRATOR'}} = "checked='checked'";
 318
 319 if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'})
 320 {
 321         $proxysettings{'NCSA_EDIT_MODE'} = 'yes';
 322         $ncsa_buttontext = $Lang::tr{'advproxy NCSA update user'};
 323         @temp = split(/:/,$proxysettings{'ID'});
 324         $proxysettings{'NCSA_USERNAME'} = $temp[0];
 325         $proxysettings{'NCSA_GROUP'} = $temp[1];
 326         $proxysettings{'NCSA_PASS'} = "lEaVeAlOnE";
 327         $proxysettings{'NCSA_PASS_CONFIRM'} = $proxysettings{'NCSA_PASS'};
 328 }
 329
 330 if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) || ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}))
 331 {
 332         if ($proxysettings{'ENABLE'} !~ /^(on|off)$/ ||
 333             $proxysettings{'TRANSPARENT'} !~ /^(on|off)$/ ||
 334             $proxysettings{'ENABLE_BLUE'} !~ /^(on|off)$/ ||
 335             $proxysettings{'TRANSPARENT_BLUE'} !~ /^(on|off)$/ ) {
 336                 $errormessage = $Lang::tr{'invalid input'};
 337                 goto ERROR;
 338         }
 339         if($proxysettings{'CACHE_MEM'} > $proxysettings{'CACHE_SIZE'} && $proxysettings{'CACHE_SIZE'} > 0){
 340                 $errormessage = $Lang::tr{'advproxy errmsg cache'}." ".$proxysettings{'CACHE_MEM'}." > ".$proxysettings{'CACHE_SIZE'};
 341                 goto ERROR;
 342         }
 343
 344         if (!(&General::validport($proxysettings{'PROXY_PORT'})))
 345         {
 346                 $errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
 347                 goto ERROR;
 348         }
 349         if (!(&General::validport($proxysettings{'TRANSPARENT_PORT'})))
 350         {
 351                 $errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
 352                 goto ERROR;
 353         }
 354         if ($proxysettings{'PROXY_PORT'} eq $proxysettings{'TRANSPARENT_PORT'}) {
 355                 $errormessage = $Lang::tr{'advproxy errmsg proxy ports equal'};
 356                 goto ERROR;
 357         }
 358         if (!($proxysettings{'UPSTREAM_PROXY'} eq ''))
 359         {
 360                 my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
 361                 if (!(&General::validip($temp[0])))
 362                 {
 363                         if (!(&General::validdomainname($temp[0])))
 364                         {
 365                                 $errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
 366                                 goto ERROR;
 367                         }
 368                 }
 369         }
 370         if (!($proxysettings{'CACHE_SIZE'} =~ /^\d+/) ||
 371                 ($proxysettings{'CACHE_SIZE'} < 10))
 372         {
 373                 if (!($proxysettings{'CACHE_SIZE'} eq '0'))
 374                 {
 375                         $errormessage = $Lang::tr{'advproxy errmsg hdd cache size'};
 376                         goto ERROR;
 377                 }
 378         }
 379         if (!($proxysettings{'FILEDESCRIPTORS'} =~ /^\d+/) ||
 380                 ($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 1048576))
 381         {
 382                 $errormessage = $Lang::tr{'proxy errmsg filedescriptors'};
 383                 goto ERROR;
 384         }
 385         if (!($proxysettings{'CACHE_MEM'} =~ /^\d+/))
 386         {
 387                 $errormessage = $Lang::tr{'advproxy errmsg mem cache size'};
 388                 goto ERROR;
 389         }
 390         my @free = &General::system_output("/usr/bin/free");
 391         $free[1] =~ m/(\d+)/;
 392         $cachemem = int $1 / 2048;
 393         if ($proxysettings{'CACHE_MEM'} > $cachemem) {
 394                 $proxysettings{'CACHE_MEM'} = $cachemem;
 395         }
 396         if (!($proxysettings{'MAX_SIZE'} =~ /^\d+/))
 397         {
 398                 $errormessage = $Lang::tr{'invalid maximum object size'};
 399                 goto ERROR;
 400         }
 401         if (!($proxysettings{'MIN_SIZE'} =~ /^\d+/))
 402         {
 403                 $errormessage = $Lang::tr{'invalid minimum object size'};
 404                 goto ERROR;
 405         }
 406         if (!($proxysettings{'MAX_OUTGOING_SIZE'} =~ /^\d+/))
 407         {
 408                 $errormessage = $Lang::tr{'invalid maximum outgoing size'};
 409                 goto ERROR;
 410         }
 411         if (!($proxysettings{'TIME_TO_HOUR'}.$proxysettings{'TIME_TO_MINUTE'} gt $proxysettings{'TIME_FROM_HOUR'}.$proxysettings{'TIME_FROM_MINUTE'}))
 412         {
 413                 $errormessage = $Lang::tr{'advproxy errmsg time restriction'};
 414                 goto ERROR;
 415         }
 416         if (!($proxysettings{'MAX_INCOMING_SIZE'} =~ /^\d+/))
 417         {
 418                 $errormessage = $Lang::tr{'invalid maximum incoming size'};
 419                 goto ERROR;
 420         }
 421         if (!($proxysettings{'AUTH_METHOD'} eq 'none'))
 422         {
 423                 unless (($proxysettings{'AUTH_METHOD'} eq 'ident') &&
 424                         ($proxysettings{'IDENT_REQUIRED'} eq 'off') &&
 425                         ($proxysettings{'IDENT_ENABLE_ACL'} eq 'off'))
 426                 {
 427                         if ($netsettings{'BLUE_DEV'})
 428                         {
 429                                 if ((($proxysettings{'ENABLE'} eq 'off') || ($proxysettings{'TRANSPARENT'} eq 'on')) &&
 430                                         (($proxysettings{'ENABLE_BLUE'} eq 'off') || ($proxysettings{'TRANSPARENT_BLUE'} eq 'on')))
 431                                 {
 432                                         $errormessage = $Lang::tr{'advproxy errmsg non-transparent proxy required'};
 433                                         goto ERROR;
 434                                 }
 435                         } else {
 436                                 if (($proxysettings{'ENABLE'} eq 'off') || ($proxysettings{'TRANSPARENT'} eq 'on'))
 437                                 {
 438                                         $errormessage = $Lang::tr{'advproxy errmsg non-transparent proxy required'};
 439                                         goto ERROR;
 440                                 }
 441                         }
 442                 }
 443                 if ((!($proxysettings{'AUTH_MAX_USERIP'} eq '')) &&
 444                         ((!($proxysettings{'AUTH_MAX_USERIP'} =~ /^\d+/)) || ($proxysettings{'AUTH_MAX_USERIP'} < 1) || ($proxysettings{'AUTH_MAX_USERIP'} > 255)))
 445                 {
 446                         $errormessage = $Lang::tr{'advproxy errmsg max userip'};
 447                         goto ERROR;
 448                 }
 449                 if (!($proxysettings{'AUTH_CACHE_TTL'} =~ /^\d+/))
 450                 {
 451                         $errormessage = $Lang::tr{'advproxy errmsg auth cache ttl'};
 452                         goto ERROR;
 453                 }
 454                 if (!($proxysettings{'AUTH_IPCACHE_TTL'} =~ /^\d+/))
 455                 {
 456                         $errormessage = $Lang::tr{'advproxy errmsg auth ipcache ttl'};
 457                         goto ERROR;
 458                 }
 459                 if ((!($proxysettings{'AUTH_MAX_USERIP'} eq '')) && ($proxysettings{'AUTH_IPCACHE_TTL'} eq '0'))
 460                 {
 461                         $errormessage = $Lang::tr{'advproxy errmsg auth ipcache may not be null'};
 462                         goto ERROR;
 463                 }
 464                 if ((!($proxysettings{'AUTH_CHILDREN'} =~ /^\d+/)) || ($proxysettings{'AUTH_CHILDREN'} < 1) || ($proxysettings{'AUTH_CHILDREN'} > 255))
 465                 {
 466                         $errormessage = $Lang::tr{'advproxy errmsg auth children'};
 467                         goto ERROR;
 468                 }
 469         }
 470         if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
 471         {
 472                 if ((!($proxysettings{'NCSA_MIN_PASS_LEN'} =~ /^\d+/)) || ($proxysettings{'NCSA_MIN_PASS_LEN'} < 1) || ($proxysettings{'NCSA_MIN_PASS_LEN'} > 255))
 473                 {
 474                         $errormessage = $Lang::tr{'advproxy errmsg password length'};
 475                         goto ERROR;
 476                 }
 477         }
 478         if ($proxysettings{'AUTH_METHOD'} eq 'ident')
 479         {
 480                 if ((!($proxysettings{'IDENT_TIMEOUT'} =~ /^\d+/)) || ($proxysettings{'IDENT_TIMEOUT'} < 1))
 481                 {
 482                         $errormessage = $Lang::tr{'advproxy errmsg ident timeout'};
 483                         goto ERROR;
 484                 }
 485         }
 486         if ($proxysettings{'AUTH_METHOD'} eq 'ldap')
 487         {
 488                 if ($proxysettings{'LDAP_BASEDN'} eq '')
 489                 {
 490                         $errormessage = $Lang::tr{'advproxy errmsg ldap base dn'};
 491                         goto ERROR;
 492                 }
 493                 if (!&General::validip($proxysettings{'LDAP_SERVER'}))
 494                 {
 495                         if (!&General::validdomainname($proxysettings{'LDAP_SERVER'}))
 496                         {
 497                                 $errormessage = $Lang::tr{'advproxy errmsg ldap server'};
 498                                 goto ERROR;
 499                         }
 500                 }
 501                 if (!&General::validport($proxysettings{'LDAP_PORT'}))
 502                 {
 503                         $errormessage = $Lang::tr{'advproxy errmsg ldap port'};
 504                         goto ERROR;
 505                 }
 506                 if (($proxysettings{'LDAP_TYPE'} eq 'ADS') || ($proxysettings{'LDAP_TYPE'} eq 'NDS'))
 507                 {
 508                         if (($proxysettings{'LDAP_BINDDN_USER'} eq '') || ($proxysettings{'LDAP_BINDDN_PASS'} eq ''))
 509                         {
 510                                 $errormessage = $Lang::tr{'advproxy errmsg ldap bind dn'};
 511                                 goto ERROR;
 512                         }
 513                 }
 514         }
 515         if ($proxysettings{'AUTH_METHOD'} eq 'radius')
 516         {
 517                 if (!&General::validip($proxysettings{'RADIUS_SERVER'}))
 518                 {
 519                         $errormessage = $Lang::tr{'advproxy errmsg radius server'};
 520                         goto ERROR;
 521                 }
 522                 if (!&General::validport($proxysettings{'RADIUS_PORT'}))
 523                 {
 524                         $errormessage = $Lang::tr{'advproxy errmsg radius port'};
 525                         goto ERROR;
 526                 }
 527                 if ($proxysettings{'RADIUS_SECRET'} eq '')
 528                 {
 529                         $errormessage = $Lang::tr{'advproxy errmsg radius secret'};
 530                         goto ERROR;
 531                 }
 532         }
 533
 534         # Quick parent proxy error checking of username and password info. If username password don't both exist give an error.
 535         $proxy1 = 'YES';
 536         $proxy2 = 'YES';
 537         if (($proxysettings{'UPSTREAM_USER'} eq '')) {$proxy1 = '';}
 538         if (($proxysettings{'UPSTREAM_PASSWORD'} eq '')) {$proxy2 = '';}
 539         if ($proxysettings{'UPSTREAM_USER'} eq 'PASS')  {$proxy1=$proxy2='PASS'; $proxysettings{'UPSTREAM_PASSWORD'} = '';}
 540         if (($proxy1 ne $proxy2))
 541         {
 542                 $errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy username or password setting'};
 543                 goto ERROR;
 544         }
 545
 546 ERROR:
 547         &check_acls;
 548
 549         if ($errormessage) {
 550                 $proxysettings{'VALID'} = 'no'; }
 551         else {
 552                 $proxysettings{'VALID'} = 'yes'; }
 553
 554         if ($proxysettings{'VALID'} eq 'yes')
 555         {
 556                 # Determine if suricata may needs to be restarted.
 557                 my $suricata_proxy_ports_changed;
 558
 559                 # Check if the IDS is running
 560                 if(&IDS::ids_is_running()) {
 561                         my %oldproxysettings;
 562
 563                         # Read-in current proxy settings and store them as oldsettings hash.
 564                         &General::readhash("${General::swroot}/proxy/advanced/settings", \%oldproxysettings);
 565
 566                         # Check if the proxy port has been changed.
 567                         unless ($proxysettings{'PROXY_PORT'} eq $oldproxysettings{'PROXY_PORT'}) {
 568                                 # Port has changed, suricata needs to be adjusted.
 569                                 $suricata_proxy_ports_changed = 1;
 570                         }
 571
 572                         # Check if the transparent port has been changed.
 573                         unless ($proxysettings{'TRANSPARENT_PORT'} eq $oldproxysettings{'TRANSPARENT_PORT'}) {
 574                                 # Transparent port has changed, suricata needs to be adjusted.
 575                                 $suricata_proxy_ports_changed = 1;
 576                         }
 577                 }
 578
 579                 &write_acls;
 580
 581                 delete $proxysettings{'SRC_SUBNETS'};
 582                 delete $proxysettings{'SRC_BANNED_IP'};
 583                 delete $proxysettings{'SRC_BANNED_MAC'};
 584                 delete $proxysettings{'SRC_UNRESTRICTED_IP'};
 585                 delete $proxysettings{'SRC_UNRESTRICTED_MAC'};
 586                 delete $proxysettings{'DST_NOCACHE'};
 587                 delete $proxysettings{'DST_NOAUTH'};
 588                 delete $proxysettings{'DST_NOPROXY_IP'};
 589                 delete $proxysettings{'DST_NOPROXY_URL'};
 590                 delete $proxysettings{'PORTS_SAFE'};
 591                 delete $proxysettings{'PORTS_SSL'};
 592                 delete $proxysettings{'MIME_TYPES'};
 593                 delete $proxysettings{'NTLM_ALLOW_USERS'};
 594                 delete $proxysettings{'NTLM_DENY_USERS'};
 595                 delete $proxysettings{'RADIUS_ALLOW_USERS'};
 596                 delete $proxysettings{'RADIUS_DENY_USERS'};
 597                 delete $proxysettings{'IDENT_HOSTS'};
 598                 delete $proxysettings{'IDENT_ALLOW_USERS'};
 599                 delete $proxysettings{'IDENT_DENY_USERS'};
 600
 601                 delete $proxysettings{'CRE_GROUPS'};
 602                 delete $proxysettings{'CRE_SVHOSTS'};
 603
 604                 delete $proxysettings{'NCSA_USERNAME'};
 605                 delete $proxysettings{'NCSA_GROUP'};
 606                 delete $proxysettings{'NCSA_PASS'};
 607                 delete $proxysettings{'NCSA_PASS_CONFIRM'};
 608
 609                 $proxysettings{'TIME_MON'} = 'off' unless exists $proxysettings{'TIME_MON'};
 610                 $proxysettings{'TIME_TUE'} = 'off' unless exists $proxysettings{'TIME_TUE'};
 611                 $proxysettings{'TIME_WED'} = 'off' unless exists $proxysettings{'TIME_WED'};
 612                 $proxysettings{'TIME_THU'} = 'off' unless exists $proxysettings{'TIME_THU'};
 613                 $proxysettings{'TIME_FRI'} = 'off' unless exists $proxysettings{'TIME_FRI'};
 614                 $proxysettings{'TIME_SAT'} = 'off' unless exists $proxysettings{'TIME_SAT'};
 615                 $proxysettings{'TIME_SUN'} = 'off' unless exists $proxysettings{'TIME_SUN'};
 616
 617                 $proxysettings{'AUTH_ALWAYS_REQUIRED'} = 'off' unless exists $proxysettings{'AUTH_ALWAYS_REQUIRED'};
 618                 $proxysettings{'NTLM_ENABLE_INT_AUTH'} = 'off' unless exists $proxysettings{'NTLM_ENABLE_INT_AUTH'};
 619
 620                 &General::writehash("${General::swroot}/proxy/advanced/settings", \%proxysettings);
 621
 622                 if (-e "${General::swroot}/proxy/settings") { &General::readhash("${General::swroot}/proxy/settings", \%stdproxysettings); }
 623                 $stdproxysettings{'PROXY_PORT'} = $proxysettings{'PROXY_PORT'};
 624                 $stdproxysettings{'UPSTREAM_PROXY'}    = $proxysettings{'UPSTREAM_PROXY'};
 625                 $stdproxysettings{'UPSTREAM_USER'}     = $proxysettings{'UPSTREAM_USER'};
 626                 $stdproxysettings{'UPSTREAM_PASSWORD'} = $proxysettings{'UPSTREAM_PASSWORD'};
 627                 $stdproxysettings{'ENABLE_FILTER'} = $proxysettings{'ENABLE_FILTER'};
 628                 $stdproxysettings{'ENABLE_UPDXLRATOR'} = $proxysettings{'ENABLE_UPDXLRATOR'};
 629                 $stdproxysettings{'ENABLE_CLAMAV'} = $proxysettings{'ENABLE_CLAMAV'};
 630                 &General::writehash("${General::swroot}/proxy/settings", \%stdproxysettings);
 631
 632                 &writeconfig;
 633                 &writepacfile;
 634
 635                 if ($proxysettings{'CACHEMGR'} eq 'on'){&writecachemgr;}
 636
 637                 &General::system ('/usr/local/bin/squidctrl', 'disable');
 638                 unlink "${General::swroot}/proxy/enable";
 639                 unlink "${General::swroot}/proxy/transparent";
 640                 unlink "${General::swroot}/proxy/enable_blue";
 641                 unlink "${General::swroot}/proxy/transparent_blue";
 642
 643                 if ($proxysettings{'ENABLE'} eq 'on') {
 644                         &General::system('/usr/bin/touch', "${General::swroot}/proxy/enable");
 645                         &General::system('/usr/local/bin/squidctrl', 'enable'); }
 646                 if ($proxysettings{'TRANSPARENT'} eq 'on' && $proxysettings{'ENABLE'} eq 'on') {
 647                         &General::system('/usr/bin/touch', "${General::swroot}/proxy/transparent"); }
 648                 if ($proxysettings{'ENABLE_BLUE'} eq 'on') {
 649                         &General::system('/usr/bin/touch', "${General::swroot}/proxy/enable_blue");
 650                         &General::system('/usr/local/bin/squidctrl', 'enable'); }
 651                 if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on' && $proxysettings{'ENABLE_BLUE'} eq 'on') {
 652                         &General::system('/usr/bin/touch', "${General::swroot}/proxy/transparent_blue"); }
 653
 654                 if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) { &General::system('/usr/local/bin/squidctrl', 'restart'); }
 655                 if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { &General::system('/usr/local/bin/squidctrl', 'reconfigure'); }
 656
 657                 # Check if the suricata_proxy_ports_changed flag has been set.
 658                 if ($suricata_proxy_ports_changed) {
 659                         # Re-generate HTTP ports file.
 660                         &IDS::generate_http_ports_file();
 661
 662                         # Restart suricata.
 663                         &IDS::call_suricatactrl("restart");
 664                 }
 665   }
 666 }
 667
 668 if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy clear cache'})
 669 {
 670         &General::system('/usr/local/bin/squidctrl', 'flush');
 671 }
 672
 673 if (!$errormessage)
 674 {
 675         if (-e "${General::swroot}/proxy/advanced/settings") {
 676                 &General::readhash("${General::swroot}/proxy/advanced/settings", \%proxysettings);
 677         } elsif (-e "${General::swroot}/proxy/settings") {
 678                 &General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
 679         }
 680         &read_acls;
 681 }
 682
 683 # ------------------------------------------------------------------
 684
 685 # Hook to regenerate the configuration files, if cgi got called from command line.
 686 if ($ENV{"REMOTE_ADDR"} eq "") {
 687         writeconfig();
 688         exit(0);
 689 }
 690
 691 # -------------------------------------------------------------------
 692
 693 $checked{'ENABLE'}{'off'} = '';
 694 $checked{'ENABLE'}{'on'} = '';
 695 $checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
 696
 697 $checked{'TRANSPARENT'}{'off'} = '';
 698 $checked{'TRANSPARENT'}{'on'} = '';
 699 $checked{'TRANSPARENT'}{$proxysettings{'TRANSPARENT'}} = "checked='checked'";
 700
 701 $checked{'ENABLE_BLUE'}{'off'} = '';
 702 $checked{'ENABLE_BLUE'}{'on'} = '';
 703 $checked{'ENABLE_BLUE'}{$proxysettings{'ENABLE_BLUE'}} = "checked='checked'";
 704
 705 $checked{'TRANSPARENT_BLUE'}{'off'} = '';
 706 $checked{'TRANSPARENT_BLUE'}{'on'} = '';
 707 $checked{'TRANSPARENT_BLUE'}{$proxysettings{'TRANSPARENT_BLUE'}} = "checked='checked'";
 708
 709 $checked{'SUPPRESS_VERSION'}{'off'} = '';
 710 $checked{'SUPPRESS_VERSION'}{'on'} = '';
 711 $checked{'SUPPRESS_VERSION'}{$proxysettings{'SUPPRESS_VERSION'}} = "checked='checked'";
 712
 713 $checked{'FORWARD_IPADDRESS'}{'off'} = '';
 714 $checked{'FORWARD_IPADDRESS'}{'on'} = '';
 715 $checked{'FORWARD_IPADDRESS'}{$proxysettings{'FORWARD_IPADDRESS'}} = "checked='checked'";
 716 $checked{'FORWARD_USERNAME'}{'off'} = '';
 717 $checked{'FORWARD_USERNAME'}{'on'} = '';
 718 $checked{'FORWARD_USERNAME'}{$proxysettings{'FORWARD_USERNAME'}} = "checked='checked'";
 719 $checked{'FORWARD_VIA'}{'off'} = '';
 720 $checked{'FORWARD_VIA'}{'on'} = '';
 721 $checked{'FORWARD_VIA'}{$proxysettings{'FORWARD_VIA'}} = "checked='checked'";
 722 $checked{'NO_CONNECTION_AUTH'}{'off'} = '';
 723 $checked{'NO_CONNECTION_AUTH'}{'on'} = '';
 724 $checked{'NO_CONNECTION_AUTH'}{$proxysettings{'NO_CONNECTION_AUTH'}} = "checked='checked'";
 725
 726 $selected{'MEM_POLICY'}{$proxysettings{'MEM_POLICY'}} = "selected='selected'";
 727 $selected{'CACHE_POLICY'}{$proxysettings{'CACHE_POLICY'}} = "selected='selected'";
 728 $selected{'L1_DIRS'}{$proxysettings{'L1_DIRS'}} = "selected='selected'";
 729 $checked{'OFFLINE_MODE'}{'off'} = '';
 730 $checked{'OFFLINE_MODE'}{'on'} = '';
 731 $checked{'OFFLINE_MODE'}{$proxysettings{'OFFLINE_MODE'}} = "checked='checked'";
 732 $checked{'CACHE_DIGESTS'}{'off'} = '';
 733 $checked{'CACHE_DIGESTS'}{'on'} = '';
 734 $checked{'CACHE_DIGESTS'}{$proxysettings{'CACHE_DIGESTS'}} = "checked='checked'";
 735
 736 $checked{'LOGGING'}{'off'} = '';
 737 $checked{'LOGGING'}{'on'} = '';
 738 $checked{'LOGGING'}{$proxysettings{'LOGGING'}} = "checked='checked'";
 739 $checked{'CACHEMGR'}{'off'} = '';
 740 $checked{'CACHEMGR'}{'on'} = '';
 741 $checked{'CACHEMGR'}{$proxysettings{'CACHEMGR'}} = "checked='checked'";
 742 $checked{'LOGQUERY'}{'off'} = '';
 743 $checked{'LOGQUERY'}{'on'} = '';
 744 $checked{'LOGQUERY'}{$proxysettings{'LOGQUERY'}} = "checked='checked'";
 745 $checked{'LOGUSERAGENT'}{'off'} = '';
 746 $checked{'LOGUSERAGENT'}{'on'} = '';
 747 $checked{'LOGUSERAGENT'}{$proxysettings{'LOGUSERAGENT'}} = "checked='checked'";
 748
 749 $selected{'ERR_LANGUAGE'}{$proxysettings{'ERR_LANGUAGE'}} = "selected='selected'";
 750 $selected{'ERR_DESIGN'}{$proxysettings{'ERR_DESIGN'}} = "selected='selected'";
 751
 752 $checked{'NO_PROXY_LOCAL'}{'off'} = '';
 753 $checked{'NO_PROXY_LOCAL'}{'on'} = '';
 754 $checked{'NO_PROXY_LOCAL'}{$proxysettings{'NO_PROXY_LOCAL'}} = "checked='checked'";
 755 $checked{'NO_PROXY_LOCAL_BLUE'}{'off'} = '';
 756 $checked{'NO_PROXY_LOCAL_BLUE'}{'on'} = '';
 757 $checked{'NO_PROXY_LOCAL_BLUE'}{$proxysettings{'NO_PROXY_LOCAL_BLUE'}} = "checked='checked'";
 758
 759 $checked{'CLASSROOM_EXT'}{'off'} = '';
 760 $checked{'CLASSROOM_EXT'}{'on'} = '';
 761 $checked{'CLASSROOM_EXT'}{$proxysettings{'CLASSROOM_EXT'}} = "checked='checked'";
 762
 763 $selected{'TIME_ACCESS_MODE'}{$proxysettings{'TIME_ACCESS_MODE'}} = "selected='selected'";
 764 $selected{'TIME_FROM_HOUR'}{$proxysettings{'TIME_FROM_HOUR'}} = "selected='selected'";
 765 $selected{'TIME_FROM_MINUTE'}{$proxysettings{'TIME_FROM_MINUTE'}} = "selected='selected'";
 766 $selected{'TIME_TO_HOUR'}{$proxysettings{'TIME_TO_HOUR'}} = "selected='selected'";
 767 $selected{'TIME_TO_MINUTE'}{$proxysettings{'TIME_TO_MINUTE'}} = "selected='selected'";
 768
 769 $proxysettings{'TIME_MON'} = 'on' unless exists $proxysettings{'TIME_MON'};
 770 $proxysettings{'TIME_TUE'} = 'on' unless exists $proxysettings{'TIME_TUE'};
 771 $proxysettings{'TIME_WED'} = 'on' unless exists $proxysettings{'TIME_WED'};
 772 $proxysettings{'TIME_THU'} = 'on' unless exists $proxysettings{'TIME_THU'};
 773 $proxysettings{'TIME_FRI'} = 'on' unless exists $proxysettings{'TIME_FRI'};
 774 $proxysettings{'TIME_SAT'} = 'on' unless exists $proxysettings{'TIME_SAT'};
 775 $proxysettings{'TIME_SUN'} = 'on' unless exists $proxysettings{'TIME_SUN'};
 776
 777 $checked{'TIME_MON'}{'off'} = '';
 778 $checked{'TIME_MON'}{'on'} = '';
 779 $checked{'TIME_MON'}{$proxysettings{'TIME_MON'}} = "checked='checked'";
 780 $checked{'TIME_TUE'}{'off'} = '';
 781 $checked{'TIME_TUE'}{'on'} = '';
 782 $checked{'TIME_TUE'}{$proxysettings{'TIME_TUE'}} = "checked='checked'";
 783 $checked{'TIME_WED'}{'off'} = '';
 784 $checked{'TIME_WED'}{'on'} = '';
 785 $checked{'TIME_WED'}{$proxysettings{'TIME_WED'}} = "checked='checked'";
 786 $checked{'TIME_THU'}{'off'} = '';
 787 $checked{'TIME_THU'}{'on'} = '';
 788 $checked{'TIME_THU'}{$proxysettings{'TIME_THU'}} = "checked='checked'";
 789 $checked{'TIME_FRI'}{'off'} = '';
 790 $checked{'TIME_FRI'}{'on'} = '';
 791 $checked{'TIME_FRI'}{$proxysettings{'TIME_FRI'}} = "checked='checked'";
 792 $checked{'TIME_SAT'}{'off'} = '';
 793 $checked{'TIME_SAT'}{'on'} = '';
 794 $checked{'TIME_SAT'}{$proxysettings{'TIME_SAT'}} = "checked='checked'";
 795 $checked{'TIME_SUN'}{'off'} = '';
 796 $checked{'TIME_SUN'}{'on'} = '';
 797 $checked{'TIME_SUN'}{$proxysettings{'TIME_SUN'}} = "checked='checked'";
 798
 799 $selected{'THROTTLING_GREEN_TOTAL'}{$proxysettings{'THROTTLING_GREEN_TOTAL'}} = "selected='selected'";
 800 $selected{'THROTTLING_GREEN_HOST'}{$proxysettings{'THROTTLING_GREEN_HOST'}} = "selected='selected'";
 801 $selected{'THROTTLING_BLUE_TOTAL'}{$proxysettings{'THROTTLING_BLUE_TOTAL'}} = "selected='selected'";
 802 $selected{'THROTTLING_BLUE_HOST'}{$proxysettings{'THROTTLING_BLUE_HOST'}} = "selected='selected'";
 803
 804 $checked{'ENABLE_MIME_FILTER'}{'off'} = '';
 805 $checked{'ENABLE_MIME_FILTER'}{'on'} = '';
 806 $checked{'ENABLE_MIME_FILTER'}{$proxysettings{'ENABLE_MIME_FILTER'}} = "checked='checked'";
 807
 808 $checked{'AUTH_METHOD'}{'none'} = '';
 809 $checked{'AUTH_METHOD'}{'ncsa'} = '';
 810 $checked{'AUTH_METHOD'}{'ident'} = '';
 811 $checked{'AUTH_METHOD'}{'ldap'} = '';
 812 $checked{'AUTH_METHOD'}{'ntlm-auth'} = '';
 813 $checked{'AUTH_METHOD'}{'radius'} = '';
 814 $checked{'AUTH_METHOD'}{$proxysettings{'AUTH_METHOD'}} = "checked='checked'";
 815
 816 $proxysettings{'AUTH_ALWAYS_REQUIRED'} = 'on' unless exists $proxysettings{'AUTH_ALWAYS_REQUIRED'};
 817
 818 $checked{'AUTH_ALWAYS_REQUIRED'}{'off'} = '';
 819 $checked{'AUTH_ALWAYS_REQUIRED'}{'on'} = '';
 820 $checked{'AUTH_ALWAYS_REQUIRED'}{$proxysettings{'AUTH_ALWAYS_REQUIRED'}} = "checked='checked'";
 821
 822 $checked{'NCSA_BYPASS_REDIR'}{'off'} = '';
 823 $checked{'NCSA_BYPASS_REDIR'}{'on'} = '';
 824 $checked{'NCSA_BYPASS_REDIR'}{$proxysettings{'NCSA_BYPASS_REDIR'}} = "checked='checked'";
 825
 826 $selected{'NCSA_GROUP'}{$proxysettings{'NCSA_GROUP'}} = "selected='selected'";
 827
 828 $selected{'LDAP_TYPE'}{$proxysettings{'LDAP_TYPE'}} = "selected='selected'";
 829
 830 $proxysettings{'NTLM_ENABLE_INT_AUTH'} = 'on' unless exists $proxysettings{'NTLM_ENABLE_INT_AUTH'};
 831
 832 $checked{'NTLM_ENABLE_INT_AUTH'}{'off'} = '';
 833 $checked{'NTLM_ENABLE_INT_AUTH'}{'on'} = '';
 834 $checked{'NTLM_ENABLE_INT_AUTH'}{$proxysettings{'NTLM_ENABLE_INT_AUTH'}} = "checked='checked'";
 835
 836 $checked{'NTLM_ENABLE_ACL'}{'off'} = '';
 837 $checked{'NTLM_ENABLE_ACL'}{'on'} = '';
 838 $checked{'NTLM_ENABLE_ACL'}{$proxysettings{'NTLM_ENABLE_ACL'}} = "checked='checked'";
 839
 840 $checked{'NTLM_USER_ACL'}{'positive'} = '';
 841 $checked{'NTLM_USER_ACL'}{'negative'} = '';
 842 $checked{'NTLM_USER_ACL'}{$proxysettings{'NTLM_USER_ACL'}} = "checked='checked'";
 843
 844 $checked{'NTLM_AUTH_BASIC'}{'on'} = '';
 845 $checked{'NTLM_AUTH_BASIC'}{'off'} = '';
 846 $checked{'NTLM_AUTH_BASIC'}{$proxysettings{'NTLM_AUTH_BASIC'}} = "checked='checked'";
 847
 848 $checked{'RADIUS_ENABLE_ACL'}{'off'} = '';
 849 $checked{'RADIUS_ENABLE_ACL'}{'on'} = '';
 850 $checked{'RADIUS_ENABLE_ACL'}{$proxysettings{'RADIUS_ENABLE_ACL'}} = "checked='checked'";
 851
 852 $checked{'RADIUS_USER_ACL'}{'positive'} = '';
 853 $checked{'RADIUS_USER_ACL'}{'negative'} = '';
 854 $checked{'RADIUS_USER_ACL'}{$proxysettings{'RADIUS_USER_ACL'}} = "checked='checked'";
 855
 856 $checked{'IDENT_REQUIRED'}{'off'} = '';
 857 $checked{'IDENT_REQUIRED'}{'on'} = '';
 858 $checked{'IDENT_REQUIRED'}{$proxysettings{'IDENT_REQUIRED'}} = "checked='checked'";
 859
 860 $checked{'IDENT_ENABLE_ACL'}{'off'} = '';
 861 $checked{'IDENT_ENABLE_ACL'}{'on'} = '';
 862 $checked{'IDENT_ENABLE_ACL'}{$proxysettings{'IDENT_ENABLE_ACL'}} = "checked='checked'";
 863
 864 $checked{'IDENT_USER_ACL'}{'positive'} = '';
 865 $checked{'IDENT_USER_ACL'}{'negative'} = '';
 866 $checked{'IDENT_USER_ACL'}{$proxysettings{'IDENT_USER_ACL'}} = "checked='checked'";
 867
 868 $checked{'ENABLE_FILTER'}{'off'} = '';
 869 $checked{'ENABLE_FILTER'}{'on'} = '';
 870 $checked{'ENABLE_FILTER'}{$proxysettings{'ENABLE_FILTER'}} = "checked='checked'";
 871
 872 $checked{'ENABLE_UPDXLRATOR'}{'off'} = '';
 873 $checked{'ENABLE_UPDXLRATOR'}{'on'} = '';
 874 $checked{'ENABLE_UPDXLRATOR'}{$proxysettings{'ENABLE_UPDXLRATOR'}} = "checked='checked'";
 875
 876 $checked{'ENABLE_CLAMAV'}{'off'} = '';
 877 $checked{'ENABLE_CLAMAV'}{'on'} = '';
 878 $checked{'ENABLE_CLAMAV'}{$proxysettings{'ENABLE_CLAMAV'}} = "checked='checked'";
 879
 880 &Header::openpage($Lang::tr{'advproxy advanced web proxy configuration'}, 1, '');
 881
 882 &Header::openbigbox('100%', 'left', '', $errormessage);
 883
 884 if ($errormessage) {
 885         &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 886         print "<font class='base'>$errormessage&nbsp;</font>\n";
 887         &Header::closebox();
 888 }
 889
 890 if ($squidversion[0] =~ /^Squid\sCache:\sVersion\s/i)
 891 {
 892         $squidversion[0] =~ s/^Squid\sCache:\sVersion//i;
 893         $squidversion[0] =~ s/^\s+//g;
 894         $squidversion[0] =~ s/\s+$//g;
 895 } else {
 896         $squidversion[0] = $Lang::tr{'advproxy unknown'};
 897 }
 898
 899 # ===================================================================
 900 #  Main settings
 901 # ===================================================================
 902
 903 unless ($proxysettings{'NCSA_EDIT_MODE'} eq 'yes') {
 904
 905 print "<form method='post' action='$ENV{'SCRIPT_NAME'}'>\n";
 906
 907 &Header::openbox('100%', 'left', "$Lang::tr{'advproxy advanced web proxy'}");
 908
 909 print <<END
 910 <table width='100%'>
 911 <tr>
 912         <td colspan='4' class='base'><b>$Lang::tr{'advproxy common settings'}</b></td>
 913 </tr>
 914 <tr>
 915         <td width='25%' class='base'>$Lang::tr{'advproxy enabled on'} <font color="$Header::colourgreen">Green</font>:</td>
 916         <td width='20%'><input type='checkbox' name='ENABLE' $checked{'ENABLE'}{'on'} /></td>
 917         <td width='25%' class='base'>$Lang::tr{'advproxy proxy port'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
 918         <td width='30%'><input type='text' name='PROXY_PORT' value='$proxysettings{'PROXY_PORT'}' size='5' /></td>
 919 </tr>
 920 <tr>
 921         <td class='base'>$Lang::tr{'advproxy transparent on'} <font color="$Header::colourgreen">Green</font>:</td>
 922         <td><input type='checkbox' name='TRANSPARENT' $checked{'TRANSPARENT'}{'on'} /></td>
 923         <td width='25%' class='base'>$Lang::tr{'advproxy proxy port transparent'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
 924         <td width='30%'><input type='text' name='TRANSPARENT_PORT' value='$proxysettings{'TRANSPARENT_PORT'}' size='5' /></td>
 925 </tr>
 926 <tr>
 927 END
 928 ;
 929 if ($netsettings{'BLUE_DEV'}) {
 930         print "<td class='base'>$Lang::tr{'advproxy enabled on'} <font color='$Header::colourblue'>Blue</font>:</td>";
 931         print "<td><input type='checkbox' name='ENABLE_BLUE' $checked{'ENABLE_BLUE'}{'on'} /></td>";
 932 } else {
 933         print "<td colspan='2'>&nbsp;</td>";
 934 }
 935 print <<END
 936         <td class='base'>$Lang::tr{'advproxy visible hostname'}:</td>
 937         <td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
 938 </tr>
 939 <tr>
 940 END
 941 ;
 942 if ($netsettings{'BLUE_DEV'}) {
 943         print "<td class='base'>$Lang::tr{'advproxy transparent on'} <font color='$Header::colourblue'>Blue</font>:</td>";
 944         print "<td><input type='checkbox' name='TRANSPARENT_BLUE' $checked{'TRANSPARENT_BLUE'}{'on'} /></td>";
 945 } else {
 946         print "<td colspan='2'>&nbsp;</td>";
 947 }
 948 print <<END
 949         <td class='base'>$Lang::tr{'advproxy error language'}:</td>
 950         <td class='base'>
 951         <select name='ERR_LANGUAGE'>
 952 END
 953 ;
 954         foreach (<$errordir/*>) {
 955                 if (-d) {
 956                         $language = substr($_,rindex($_,"/")+1);
 957                         print "<option value='$language' $selected{'ERR_LANGUAGE'}{$language}>$language</option>\n";
 958                 }
 959         }
 960 print <<END
 961         </select>
 962         </td>
 963 </tr>
 964 <tr>
 965         <td class='base'>$Lang::tr{'advproxy suppress version'}:</td>
 966         <td><input type='checkbox' name='SUPPRESS_VERSION' $checked{'SUPPRESS_VERSION'}{'on'} /></td>
 967         <td class='base'>$Lang::tr{'advproxy error design'}:</td>
 968         <td class='base'><select name='ERR_DESIGN'>
 969                 <option value='ipfire' $selected{'ERR_DESIGN'}{'ipfire'}>IPFire</option>
 970                 <option value='squid' $selected{'ERR_DESIGN'}{'squid'}>$Lang::tr{'advproxy standard'}</option>
 971         </select></td>
 972 </tr>
 973 <tr>
 974         <td class='base'>$Lang::tr{'advproxy squid version'}:</td>
 975         <td class='base'>&nbsp;[<font color='$Header::colourred'> $squidversion[0] </font>]</td>
 976         <td>&nbsp;</td>
 977         <td>&nbsp;</td>
 978 </tr>
 979 </table>
 980 <hr size='1'>
 981 <table width='100%'>
 982 END
 983 ;
 984 if ( -e "/usr/bin/squidclamav" ) {
 985         print "<td class='base'><b>".$Lang::tr{'advproxy squidclamav'}."</b><br />";
 986         if ( ! -e "/var/run/clamav/clamd.pid" ){
 987                 print "<font color='red'>clamav not running</font><br /><br />";
 988                 $proxysettings{'ENABLE_CLAMAV'} = 'off';
 989                 }
 990         else {
 991                 print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_CLAMAV' ".$checked{'ENABLE_CLAMAV'}{'on'}." /><br />";
 992 }
 993         print "</td>";
 994 } else {
 995         print "<td></td>";
 996 }
 997 print "<td class='base'><a href='/cgi-bin/urlfilter.cgi'><b>".$Lang::tr{'advproxy url filter'}."</a></b><br />";
 998 print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_FILTER' ".$checked{'ENABLE_FILTER'}{'on'}." /><br />";
 999 print "</td>";
1000 print "<td class='base'><a href='/cgi-bin/updatexlrator.cgi'><b>".$Lang::tr{'advproxy update accelerator'}."</a></b><br />";
1001 print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_UPDXLRATOR' ".$checked{'ENABLE_UPDXLRATOR'}{'on'}." /><br />";
1002 print "</td></tr>";
1003 print <<END
1004 </table>
1005 <hr size='1'>
1006 <table width='100%'>
1007 <tr>
1008         <td colspan='4' class='base'><b>$Lang::tr{'advproxy upstream proxy'}</b></td>
1009 </tr>
1010 <tr>
1011         <td width='25%' class='base'>$Lang::tr{'advproxy via forwarding'}:</td>
1012         <td width='20%'><input type='checkbox' name='FORWARD_VIA' $checked{'FORWARD_VIA'}{'on'} /></td>
1013         <td width='25%' class='base'>$Lang::tr{'advproxy upstream proxy host:port'}:</td>
1014         <td width='30%'><input type='text' name='UPSTREAM_PROXY' value='$proxysettings{'UPSTREAM_PROXY'}' /></td>
1015 </tr>
1016 <tr>
1017         <td class='base'>$Lang::tr{'advproxy client IP forwarding'}:</td>
1018         <td><input type='checkbox' name='FORWARD_IPADDRESS' $checked{'FORWARD_IPADDRESS'}{'on'} /></td>
1019         <td class='base'>$Lang::tr{'advproxy upstream username'}:</td>
1020         <td><input type='text' name='UPSTREAM_USER' value='$proxysettings{'UPSTREAM_USER'}' /></td>
1021 </tr>
1022 <tr>
1023         <td class='base'>$Lang::tr{'advproxy username forwarding'}:</td>
1024         <td><input type='checkbox' name='FORWARD_USERNAME' $checked{'FORWARD_USERNAME'}{'on'} /></td>
1025         <td class='base'>$Lang::tr{'advproxy upstream password'}:</td>
1026         <td><input type='password' name='UPSTREAM_PASSWORD' value='$proxysettings{'UPSTREAM_PASSWORD'}' /></td>
1027 </tr>
1028 <tr>
1029         <td class='base'>$Lang::tr{'advproxy no connection auth'}:</td>
1030         <td><input type='checkbox' name='NO_CONNECTION_AUTH' $checked{'NO_CONNECTION_AUTH'}{'on'} /></td>
1031         <td>&nbsp;</td>
1032         <td>&nbsp;</td>
1033 </tr>
1034 </table>
1035 <hr size='1'>
1036 <table width='100%'>
1037 <tr>
1038         <td colspan='4' class='base'><b>$Lang::tr{'advproxy log settings'}</b></td>
1039 </tr>
1040 <tr>
1041         <td width='25%' class='base'>$Lang::tr{'advproxy log enabled'}:</td>
1042         <td width='20%'><input type='checkbox' name='LOGGING' $checked{'LOGGING'}{'on'} /></td>
1043         <td width='25%'class='base'>$Lang::tr{'advproxy log query'}:</td>
1044         <td width='30%'><input type='checkbox' name='LOGQUERY' $checked{'LOGQUERY'}{'on'} /></td>
1045 </tr>
1046 <tr>
1047         <td>&nbsp;</td>
1048         <td>&nbsp;</td>
1049         <td class='base'>$Lang::tr{'advproxy log useragent'}:</td>
1050         <td><input type='checkbox' name='LOGUSERAGENT' $checked{'LOGUSERAGENT'}{'on'} /></td>
1051 </tr>
1052 </table>
1053 <hr size='1'>
1054 <table width='100%'>
1055 <tr>
1056         <td colspan='4'><b>$Lang::tr{'advproxy cache management'}</b></td>
1057 </tr>
1058 <tr>
1059         <td class='base'><a href='/cgi-bin/cachemgr.cgi' target='_blank'>$Lang::tr{'proxy cachemgr'}:</td>
1060         <td><input type='checkbox' name='CACHEMGR' $checked{'CACHEMGR'}{'on'} /></td>
1061         <td class='base'>$Lang::tr{'advproxy admin mail'}:</td>
1062         <td><input type='text' name='ADMIN_MAIL_ADDRESS' value='$proxysettings{'ADMIN_MAIL_ADDRESS'}' /></td>
1063 </tr>
1064 <tr>
1065         <td class='base'>$Lang::tr{'proxy filedescriptors'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1066         <td><input type='text' name='FILEDESCRIPTORS' value='$proxysettings{'FILEDESCRIPTORS'}' size='5' /></td>
1067         <td class='base'>$Lang::tr{'proxy admin password'}:</td>
1068         <td><input type='text' name='ADMIN_PASSWORD' value='$proxysettings{'ADMIN_PASSWORD'}' /></td>
1069 </tr>
1070 <tr>
1071         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1072 </tr>
1073 <tr>
1074         <td class='base'>$Lang::tr{'advproxy ram cache size'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1075         <td><input type='text' name='CACHE_MEM' value='$proxysettings{'CACHE_MEM'}' size='5' /></td>
1076         <td class='base'>$Lang::tr{'advproxy hdd cache size'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1077         <td><input type='text' name='CACHE_SIZE' value='$proxysettings{'CACHE_SIZE'}' size='5' /></td>
1078 </tr>
1079 <tr>
1080         <td class='base'>$Lang::tr{'advproxy min size'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1081         <td><input type='text' name='MIN_SIZE' value='$proxysettings{'MIN_SIZE'}' size='5' /></td>
1082         <td class='base'>$Lang::tr{'advproxy max size'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1083         <td><input type='text' name='MAX_SIZE' value='$proxysettings{'MAX_SIZE'}' size='5' /></td>
1084 </tr>
1085 <tr>
1086         <td class='base'>$Lang::tr{'advproxy number of L1 dirs'}:</td>
1087         <td class='base'><select name='L1_DIRS'>
1088                 <option value='16'  $selected{'L1_DIRS'}{'16'}>16</option>
1089                 <option value='32'  $selected{'L1_DIRS'}{'32'}>32</option>
1090                 <option value='64'  $selected{'L1_DIRS'}{'64'}>64</option>
1091                 <option value='128' $selected{'L1_DIRS'}{'128'}>128</option>
1092                 <option value='256' $selected{'L1_DIRS'}{'256'}>256</option>
1093         </select></td>
1094         <td colspan='2' rowspan= '5' valign='top' class='base'>
1095                 <table cellspacing='0' cellpadding='0'>
1096                         <tr>
1097                                 <!-- intentionally left empty -->
1098                         </tr>
1099                         <tr>
1100                         <td>$Lang::tr{'advproxy no cache sites'}:</td>
1101                         </tr>
1102                         <tr>
1103                                 <!-- intentionally left empty -->
1104                         </tr>
1105                         <tr>
1106                                 <!-- intentionally left empty -->
1107                         </tr>
1108                         <tr>
1109                         <td><textarea name='DST_NOCACHE' cols='32' rows='6' wrap='off'>
1110 END
1111 ;
1112
1113 print $proxysettings{'DST_NOCACHE'};
1114
1115 print <<END
1116 </textarea></td>
1117                 </tr>
1118                 </table>
1119         </td>
1120 </tr>
1121 <tr>
1122         <td class='base'>$Lang::tr{'advproxy memory replacement policy'}:</td>
1123         <td class='base'><select name='MEM_POLICY'>
1124                 <option value='LRU' $selected{'MEM_POLICY'}{'LRU'}>LRU</option>
1125                 <option value='heap LFUDA' $selected{'MEM_POLICY'}{'heap LFUDA'}>heap LFUDA</option>
1126                 <option value='heap GDSF' $selected{'MEM_POLICY'}{'heap GDSF'}>heap GDSF</option>
1127                 <option value='heap LRU' $selected{'MEM_POLICY'}{'heap LRU'}>heap LRU</option>
1128         </select></td>
1129 </tr>
1130 <tr>
1131         <td class='base'>$Lang::tr{'advproxy cache replacement policy'}:</td>
1132         <td class='base'><select name='CACHE_POLICY'>
1133                 <option value='LRU' $selected{'CACHE_POLICY'}{'LRU'}>LRU</option>
1134                 <option value='heap LFUDA' $selected{'CACHE_POLICY'}{'heap LFUDA'}>heap LFUDA</option>
1135                 <option value='heap GDSF' $selected{'CACHE_POLICY'}{'heap GDSF'}>heap GDSF</option>
1136                 <option value='heap LRU' $selected{'CACHE_POLICY'}{'heap LRU'}>heap LRU</option>
1137         </select></td>
1138 </tr>
1139 <tr>
1140         <td colspan='2'>&nbsp;</td>
1141 </tr>
1142 <tr>
1143         <td class='base'>$Lang::tr{'advproxy offline mode'}:</td>
1144         <td><input type='checkbox' name='OFFLINE_MODE' $checked{'OFFLINE_MODE'}{'on'} /></td>
1145 </tr>
1146 <tr>
1147         <td class='base'>$Lang::tr{'advproxy cache-digest'}:</td>
1148         <td><input type='checkbox' name='CACHE_DIGESTS' $checked{'CACHE_DIGESTS'}{'on'} /></td>
1149 </tr>
1150 </table>
1151 <hr size='1'>
1152 <table width='100%'>
1153 <tr>
1154         <td colspan='4'><b>$Lang::tr{'advproxy destination ports'}</b></td>
1155 </tr>
1156 <tr>
1157         <td width='25%' align='center'></td> <td width='20%' align='center'></td><td width='25%' align='center'></td><td width='30%' align='center'></td>
1158 </tr>
1159 <tr>
1160         <td colspan='2' class='base'>$Lang::tr{'advproxy standard ports'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1161         <td colspan='2' class='base'>$Lang::tr{'advproxy ssl ports'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1162 </tr>
1163 <tr>
1164         <td colspan='2'><textarea name='PORTS_SAFE' cols='32' rows='6' wrap='off'>
1165 END
1166 ;
1167         if (!$proxysettings{'PORTS_SAFE'}) { print $def_ports_safe; } else { print $proxysettings{'PORTS_SAFE'}; }
1168
1169 print <<END
1170 </textarea></td>
1171         <td colspan='2'><textarea name='PORTS_SSL' cols='32' rows='6' wrap='off'>
1172 END
1173 ;
1174         if (!$proxysettings{'PORTS_SSL'}) { print $def_ports_ssl; } else { print $proxysettings{'PORTS_SSL'}; }
1175
1176 print <<END
1177 </textarea></td>
1178 </tr>
1179 </table>
1180 <hr size='1'>
1181 <table width='100%'>
1182 <tr>
1183         <td colspan='4'><b>$Lang::tr{'advproxy network based access'}</b></td>
1184 </tr>
1185 <tr>
1186         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1187 </tr>
1188 <tr>
1189         <td colspan='4' class='base'>$Lang::tr{'advproxy allowed subnets'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1190 </tr>
1191 <tr>
1192         <td colspan='2' rowspan='4'><textarea name='SRC_SUBNETS' cols='32' rows='3' wrap='off'>
1193 END
1194 ;
1195
1196 if (!$proxysettings{'SRC_SUBNETS'})
1197 {
1198         if (&Header::green_used()) {
1199                 print "$green_cidr\n";
1200         }
1201
1202         if (&Header::blue_used()) {
1203                 print "$blue_cidr\n";
1204         }
1205 } else { print $proxysettings{'SRC_SUBNETS'}; }
1206
1207 print <<END
1208 </textarea></td>
1209 END
1210 ;
1211
1212 $line = $Lang::tr{'advproxy no internal proxy on green'};
1213 $line =~ s/Green/<font color="$Header::colourgreen">Green<\/font>/i;
1214 print "<td class='base'>$line:</td>\n";
1215 print <<END
1216         <td><input type='checkbox' name='NO_PROXY_LOCAL' $checked{'NO_PROXY_LOCAL'}{'on'} /></td>
1217 </tr>
1218 END
1219 ;
1220 if ($netsettings{'BLUE_DEV'}) {
1221         $line = $Lang::tr{'advproxy no internal proxy on blue'};
1222         $line =~ s/Blue/<font color="$Header::colourblue">Blue<\/font>/i;
1223         print "<tr>\n";
1224         print "<td class='base'>$line:</td>\n";
1225         print <<END
1226         <td><input type='checkbox' name='NO_PROXY_LOCAL_BLUE' $checked{'NO_PROXY_LOCAL_BLUE'}{'on'} /></td>
1227 </tr>
1228 END
1229 ;
1230 }
1231 print <<END
1232 <tr>
1233         <td colspan='2'>&nbsp;</td>
1234 </tr>
1235 <tr>
1236         <td colspan='2'>&nbsp;</td>
1237 </tr>
1238 </table>
1239 <table width='100%'>
1240 <tr>
1241         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1242 </tr>
1243 <tr>
1244         <td colspan='2' class='base'>$Lang::tr{'advproxy unrestricted ip clients'}:</td>
1245         <td colspan='2' class='base'>$Lang::tr{'advproxy unrestricted mac clients'}:</td>
1246 </tr>
1247 <tr>
1248         <td colspan='2'><textarea name='SRC_UNRESTRICTED_IP' cols='32' rows='3' wrap='off'>
1249 END
1250 ;
1251
1252         print $proxysettings{'SRC_UNRESTRICTED_IP'};
1253
1254 print <<END
1255 </textarea></td>
1256         <td colspan='2'><textarea name='SRC_UNRESTRICTED_MAC' cols='32' rows='3' wrap='off'>
1257 END
1258 ;
1259
1260 print $proxysettings{'SRC_UNRESTRICTED_MAC'};
1261
1262 print <<END
1263 </textarea></td>
1264 </tr>
1265 </table>
1266 <table width='100%'>
1267 <tr>
1268         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1269 </tr>
1270 <tr>
1271         <td colspan='2' class='base'>$Lang::tr{'advproxy banned ip clients'}:</td>
1272         <td colspan='2' class='base'>$Lang::tr{'advproxy banned mac clients'}:</td>
1273 </tr>
1274 <tr>
1275         <td colspan='2'><textarea name='SRC_BANNED_IP' cols='32' rows='3' wrap='off'>
1276 END
1277 ;
1278
1279         print $proxysettings{'SRC_BANNED_IP'};
1280
1281 print <<END
1282 </textarea></td>
1283         <td colspan='2'><textarea name='SRC_BANNED_MAC' cols='32' rows='3' wrap='off'>
1284 END
1285 ;
1286
1287 print $proxysettings{'SRC_BANNED_MAC'};
1288
1289 print <<END
1290 </textarea></td>
1291 </tr>
1292 </table>
1293
1294 <hr size='1'>
1295
1296 END
1297 ;
1298 # -------------------------------------------------------------------
1299 #  CRE GUI - optional
1300 # -------------------------------------------------------------------
1301
1302 if (-e $cre_enabled) { print <<END
1303 <table width='100%'>
1304
1305 <tr>
1306         <td colspan='4'><b>$Lang::tr{'advproxy classroom extensions'}</b> $Lang::tr{'advproxy enabled'}:<input type='checkbox' name='CLASSROOM_EXT' $checked{'CLASSROOM_EXT'}{'on'} /></td>
1307 </tr>
1308 <tr>
1309         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1310 </tr>
1311 <tr>
1312
1313 END
1314 ;
1315 if ($proxysettings{'CLASSROOM_EXT'} eq 'on'){
1316 print <<END
1317         <td class='base'>$Lang::tr{'advproxy supervisor password'}:</td>
1318         <td><input type='password' name='SUPERVISOR_PASSWORD' value='$proxysettings{'SUPERVISOR_PASSWORD'}' size='12' /></td>
1319 </tr>
1320 <tr>
1321         <td colspan='2' class='base'>$Lang::tr{'advproxy cre group definitions'}:</td>
1322         <td colspan='2' class='base'>$Lang::tr{'advproxy cre supervisors'}:</td>
1323 END
1324 ;
1325 }
1326 print "</tr>";
1327 if ($proxysettings{'CLASSROOM_EXT'} eq 'on'){
1328 print <<END
1329 <tr>
1330         <td colspan='2'><textarea name='CRE_GROUPS' cols='32' rows='6' wrap='off'>
1331 END
1332 ;
1333
1334         print $proxysettings{'CRE_GROUPS'};
1335
1336 print <<END
1337 </textarea></td>
1338         <td colspan='2'><textarea name='CRE_SVHOSTS' cols='32' rows='6' wrap='off'>
1339 END
1340 ;
1341         print $proxysettings{'CRE_SVHOSTS'};
1342
1343 print <<END
1344 </textarea></td>
1345 </tr>
1346 END
1347 ;
1348 }
1349 print "</table><hr size='1'>";
1350
1351 } else {
1352         print <<END
1353         <input type='hidden' name='SUPERVISOR_PASSWORD' value='$proxysettings{'SUPERVISOR_PASSWORD'}' />
1354         <input type='hidden' name='CRE_GROUPS'          value='$proxysettings{'CRE_GROUPS'}' />
1355         <input type='hidden' name='CRE_SVHOSTS'         value='$proxysettings{'CRE_SVHOSTS'}' />
1356 END
1357 ;
1358 }
1359
1360 # ===================================================================
1361 #  WPAD settings
1362 # ===================================================================
1363
1364 print <<END
1365 <table width='100%'>
1366 <tr>
1367         <td colspan='4'><b>$Lang::tr{'advproxy wpad title'}</b></td>
1368 </tr>
1369 <tr>
1370         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1371 </tr>
1372 <tr>
1373         <td colspan='2' class='base'>$Lang::tr{'advproxy wpad label dst_noproxy_ip'}:</td>
1374         <td colspan='2' class='base'>$Lang::tr{'advproxy wpad label dst_noproxy_url'}:</td>
1375 </tr>
1376 <tr>
1377         <td colspan='2'><textarea name='DST_NOPROXY_IP' cols='32' rows='3' wrap='off'>
1378 END
1379 ;
1380
1381         print $proxysettings{'DST_NOPROXY_IP'};
1382
1383 print <<END
1384 </textarea></td>
1385
1386         <td colspan='2'><textarea name='DST_NOPROXY_URL' cols='32' rows='3' wrap='off'>
1387 END
1388 ;
1389
1390         print $proxysettings{'DST_NOPROXY_URL'};
1391
1392 print <<END
1393 </textarea></td>
1394 </tr>
1395 <tr>
1396         <td colspan='2' class='base'>$Lang::tr{'advproxy wpad example dst_noproxy_ip'}</td>
1397         <td colspan='2' class='base'>$Lang::tr{'advproxy wpad example dst_noproxy_url'}</td>
1398 </tr>
1399 <tr>
1400         <td colspan="4">&nbsp;</td>
1401 </tr>
1402 <tr>
1403         <td colspan="4">$Lang::tr{'advproxy wpad view pac'}: <a href="http://$ENV{SERVER_ADDR}:81/wpad.dat" target="_blank">http://$ENV{SERVER_ADDR}:81/wpad.dat</a></td>
1404 </tr>
1405 <tr>
1406         <td colspan="4">&nbsp;</td>
1407 </tr>
1408 <tr>
1409         <td colspan="4">$Lang::tr{'advproxy wpad notice'}</td>
1410 </tr>
1411 </table>
1412
1413 <hr size='1'>
1414
1415 END
1416 ;
1417
1418 # -------------------------------------------------------------------
1419
1420 print <<END
1421
1422 <table width='100%'>
1423 <tr>
1424         <td colspan='4'><b>$Lang::tr{'advproxy time restrictions'}</b></td>
1425 </tr>
1426 <table width='100%'>
1427 <tr>
1428         <td width='2%'>$Lang::tr{'advproxy access'}</td>
1429         <td width='1%'>&nbsp;</td>
1430         <td width='2%' align='center'>$Lang::tr{'advproxy monday'}</td>
1431         <td width='2%' align='center'>$Lang::tr{'advproxy tuesday'}</td>
1432         <td width='2%' align='center'>$Lang::tr{'advproxy wednesday'}</td>
1433         <td width='2%' align='center'>$Lang::tr{'advproxy thursday'}</td>
1434         <td width='2%' align='center'>$Lang::tr{'advproxy friday'}</td>
1435         <td width='2%' align='center'>$Lang::tr{'advproxy saturday'}</td>
1436         <td width='2%' align='center'>$Lang::tr{'advproxy sunday'}</td>
1437         <td width='1%'>&nbsp;&nbsp;</td>
1438         <td width='7%' colspan=3>$Lang::tr{'advproxy from'}</td>
1439         <td width='1%'>&nbsp;</td>
1440         <td width='7%' colspan=3>$Lang::tr{'advproxy to'}</td>
1441         <td>&nbsp;</td>
1442 </tr>
1443 <tr>
1444         <td class='base'>
1445         <select name='TIME_ACCESS_MODE'>
1446         <option value='allow' $selected{'TIME_ACCESS_MODE'}{'allow'}>$Lang::tr{'advproxy mode allow'}</option>
1447         <option value='deny'  $selected{'TIME_ACCESS_MODE'}{'deny'}>$Lang::tr{'advproxy mode deny'}</option>
1448         </select>
1449         </td>
1450         <td>&nbsp;</td>
1451         <td class='base'><input type='checkbox' name='TIME_MON' $checked{'TIME_MON'}{'on'} /></td>
1452         <td class='base'><input type='checkbox' name='TIME_TUE' $checked{'TIME_TUE'}{'on'} /></td>
1453         <td class='base'><input type='checkbox' name='TIME_WED' $checked{'TIME_WED'}{'on'} /></td>
1454         <td class='base'><input type='checkbox' name='TIME_THU' $checked{'TIME_THU'}{'on'} /></td>
1455         <td class='base'><input type='checkbox' name='TIME_FRI' $checked{'TIME_FRI'}{'on'} /></td>
1456         <td class='base'><input type='checkbox' name='TIME_SAT' $checked{'TIME_SAT'}{'on'} /></td>
1457         <td class='base'><input type='checkbox' name='TIME_SUN' $checked{'TIME_SUN'}{'on'} /></td>
1458         <td>&nbsp;</td>
1459         <td class='base'>
1460         <select name='TIME_FROM_HOUR'>
1461 END
1462 ;
1463 for ($i=0;$i<=24;$i++) {
1464         $_ = sprintf("%02s",$i);
1465         print "<option $selected{'TIME_FROM_HOUR'}{$_}>$_</option>\n";
1466 }
1467 print <<END
1468         </select>
1469         </td>
1470         <td>:</td>
1471         <td class='base'>
1472         <select name='TIME_FROM_MINUTE'>
1473 END
1474 ;
1475 for ($i=0;$i<=45;$i+=15) {
1476         $_ = sprintf("%02s",$i);
1477         print "<option $selected{'TIME_FROM_MINUTE'}{$_}>$_</option>\n";
1478 }
1479 print <<END
1480         </select>
1481         <td> - </td>
1482         </td>
1483         <td class='base'>
1484         <select name='TIME_TO_HOUR'>
1485 END
1486 ;
1487 for ($i=0;$i<=24;$i++) {
1488         $_ = sprintf("%02s",$i);
1489         print "<option $selected{'TIME_TO_HOUR'}{$_}>$_</option>\n";
1490 }
1491 print <<END
1492         </select>
1493         </td>
1494         <td>:</td>
1495         <td class='base'>
1496         <select name='TIME_TO_MINUTE'>
1497 END
1498 ;
1499 for ($i=0;$i<=45;$i+=15) {
1500         $_ = sprintf("%02s",$i);
1501         print "<option $selected{'TIME_TO_MINUTE'}{$_}>$_</option>\n";
1502 }
1503 print <<END
1504         </select>
1505         </td>
1506 </tr>
1507 </table>
1508 <hr size='1'>
1509 <table width='100%'>
1510 <tr>
1511         <td colspan='4'><b>$Lang::tr{'advproxy transfer limits'}</b></td>
1512 </tr>
1513 <tr>
1514         <td width='25%' class='base'>$Lang::tr{'advproxy max download size'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1515         <td width='20%'><input type='text' name='MAX_INCOMING_SIZE' value='$proxysettings{'MAX_INCOMING_SIZE'}' size='5' /></td>
1516         <td width='25%' class='base'>$Lang::tr{'advproxy max upload size'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1517         <td width='30%'><input type='text' name='MAX_OUTGOING_SIZE' value='$proxysettings{'MAX_OUTGOING_SIZE'}' size='5' /></td>
1518 </tr>
1519 </table>
1520 <hr size='1'>
1521 <table width='100%'>
1522 <tr>
1523         <td colspan='4'><b>$Lang::tr{'advproxy download throttling'}</b></td>
1524 </tr>
1525 <tr>
1526         <td width='25%' class='base'>$Lang::tr{'advproxy throttling total on'} <font color="$Header::colourgreen">Green</font>:</td>
1527         <td width='20%' class='base'>
1528         <select name='THROTTLING_GREEN_TOTAL'>
1529 END
1530 ;
1531
1532 foreach (@throttle_limits) {
1533         my $val = $_;
1534         my $unit = "kbit/s";
1535
1536         if ($val >= 1024) {
1537                 $unit = "Mbit/s";
1538                 $val /= 1024;
1539         }
1540
1541         print "\t<option value='$_' $selected{'THROTTLING_GREEN_TOTAL'}{$_}>$val $unit</option>\n";
1542 }
1543
1544 print <<END
1545         <option value='0' $selected{'THROTTLING_GREEN_TOTAL'}{'unlimited'}>$Lang::tr{'advproxy throttling unlimited'}</option>\n";
1546         </select>
1547         </td>
1548         <td width='25%' class='base'>$Lang::tr{'advproxy throttling per host on'} <font color="$Header::colourgreen">Green</font>:</td>
1549         <td width='30%' class='base'>
1550         <select name='THROTTLING_GREEN_HOST'>
1551 END
1552 ;
1553
1554 foreach (@throttle_limits) {
1555         print "\t<option value='$_' $selected{'THROTTLING_GREEN_HOST'}{$_}>$_ kbit/s</option>\n";
1556 }
1557
1558 print <<END
1559         <option value='0' $selected{'THROTTLING_GREEN_HOST'}{'unlimited'}>$Lang::tr{'advproxy throttling unlimited'}</option>\n";
1560         </select>
1561         </td>
1562 </tr>
1563 END
1564 ;
1565
1566 if ($netsettings{'BLUE_DEV'}) {
1567         print <<END
1568 <tr>
1569         <td class='base'>$Lang::tr{'advproxy throttling total on'} <font color="$Header::colourblue">Blue</font>:</td>
1570         <td class='base'>
1571         <select name='THROTTLING_BLUE_TOTAL'>
1572 END
1573 ;
1574
1575 foreach (@throttle_limits) {
1576         print "\t<option value='$_' $selected{'THROTTLING_BLUE_TOTAL'}{$_}>$_ kbit/s</option>\n";
1577 }
1578
1579 print <<END
1580         <option value='0' $selected{'THROTTLING_BLUE_TOTAL'}{'unlimited'}>$Lang::tr{'advproxy throttling unlimited'}</option>\n";
1581         </select>
1582         </td>
1583         <td class='base'>$Lang::tr{'advproxy throttling per host on'} <font color="$Header::colourblue">Blue</font>:</td>
1584         <td class='base'>
1585         <select name='THROTTLING_BLUE_HOST'>
1586 END
1587 ;
1588
1589 foreach (@throttle_limits) {
1590         print "\t<option value='$_' $selected{'THROTTLING_BLUE_HOST'}{$_}>$_ kbit/s</option>\n";
1591 }
1592
1593 print <<END
1594         <option value='0' $selected{'THROTTLING_BLUE_HOST'}{'unlimited'}>$Lang::tr{'advproxy throttling unlimited'}</option>\n";
1595         </select>
1596         </td>
1597 </tr>
1598 END
1599 ;
1600 }
1601
1602 print <<END
1603 </table>
1604 <hr size='1'>
1605 <table width='100%'>
1606 <tr>
1607         <td colspan='4'><b>$Lang::tr{'advproxy MIME filter'}</b> $Lang::tr{'advproxy enabled'}:<input type='checkbox' name='ENABLE_MIME_FILTER' $checked{'ENABLE_MIME_FILTER'}{'on'} /></td>
1608 </tr>
1609 END
1610 ;
1611 if ( $proxysettings{'ENABLE_MIME_FILTER'} eq 'on' ){
1612 print <<END
1613 <tr>
1614         <td  colspan='2' class='base'>$Lang::tr{'advproxy MIME block types'}:</td>
1615         <td>&nbsp;</td>
1616         <td>&nbsp;</td>
1617 </tr>
1618 <tr>
1619         <td colspan='2'><textarea name='MIME_TYPES' cols='32' rows='6' wrap='off'>
1620 END
1621 ;
1622
1623 print $proxysettings{'MIME_TYPES'};
1624
1625 print <<END
1626 </textarea></td>
1627         <td>&nbsp;</td>
1628         <td>&nbsp;</td>
1629 </tr>
1630 END
1631 ;
1632 }
1633 print <<END
1634 </table>
1635
1636 <hr size='1'>
1637 END
1638 ;
1639
1640 my $auth_columns = 5;
1641 if ($HAVE_NTLM_AUTH) {
1642         $auth_columns++;
1643 }
1644 my $auth_column_width = 100 / $auth_columns;
1645
1646 print <<END;
1647 <table width='100%'>
1648 <tr>
1649         <td colspan='$auth_columns'><b>$Lang::tr{'advproxy AUTH method'}</b></td>
1650 </tr>
1651 <tr>
1652         <td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='none' $checked{'AUTH_METHOD'}{'none'} />$Lang::tr{'advproxy AUTH method none'}</td>
1653         <td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ncsa' $checked{'AUTH_METHOD'}{'ncsa'} />$Lang::tr{'advproxy AUTH method ncsa'}</td>
1654         <td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ident' $checked{'AUTH_METHOD'}{'ident'} />$Lang::tr{'advproxy AUTH method ident'}</td>
1655         <td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ldap' $checked{'AUTH_METHOD'}{'ldap'} />$Lang::tr{'advproxy AUTH method ldap'}</td>
1656 END
1657
1658 if ($HAVE_NTLM_AUTH) {
1659         print <<END;
1660         <td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ntlm-auth' $checked{'AUTH_METHOD'}{'ntlm-auth'} />$Lang::tr{'advproxy AUTH method ntlm auth'}</td>
1661 END
1662 }
1663
1664 print <<END
1665         <td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='radius' $checked{'AUTH_METHOD'}{'radius'} />$Lang::tr{'advproxy AUTH method radius'}</td>
1666 </tr>
1667 </table>
1668 END
1669 ;
1670
1671 if (!($proxysettings{'AUTH_METHOD'} eq 'none')) { if (!($proxysettings{'AUTH_METHOD'} eq 'ident')) { print <<END
1672 <hr size='1'>
1673 <table width='100%'>
1674 <tr>
1675         <td colspan='4'><b>$Lang::tr{'advproxy AUTH global settings'}</b></td>
1676 </tr>
1677 <tr>
1678         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1679 </tr>
1680 <tr>
1681         <td class='base'>$Lang::tr{'advproxy AUTH number of auth processes'}:</td>
1682         <td><input type='text' name='AUTH_CHILDREN' value='$proxysettings{'AUTH_CHILDREN'}' size='5' /></td>
1683         <td colspan='2' rowspan= '6' valign='top' class='base'>
1684                 <table cellpadding='0' cellspacing='0'>
1685                         <tr>
1686                         <td class='base'>$Lang::tr{'advproxy AUTH realm'}:</td>
1687                         </tr>
1688                         <tr>
1689                                 <!-- intentionally left empty -->
1690                         </tr>
1691                         <tr>
1692                                 <!-- intentionally left empty -->
1693                         </tr>
1694                         <tr>
1695                         <td><input type='text' name='AUTH_REALM' value='$proxysettings{'AUTH_REALM'}' size='40' /></td>
1696                         </tr>
1697                         <tr>
1698                                 <!-- intentionally left empty -->
1699                         </tr>
1700                         <tr>
1701                                 <!-- intentionally left empty -->
1702                         </tr>
1703                         <tr>
1704                         <td>$Lang::tr{'advproxy AUTH no auth'}:</td>
1705                         </tr>
1706                         <tr>
1707                                 <!-- intentionally left empty -->
1708                         </tr>
1709                         <tr>
1710                                 <!-- intentionally left empty -->
1711                         </tr>
1712                         <tr>
1713                         <td><textarea name='DST_NOAUTH' cols='32' rows='6' wrap='off'>
1714 END
1715 ;
1716
1717 print $proxysettings{'DST_NOAUTH'};
1718
1719 print <<END
1720 </textarea></td>
1721                 </tr>
1722                 </table>
1723         </td>
1724 </tr>
1725 <tr>
1726         <td class='base'>$Lang::tr{'advproxy AUTH auth cache TTL'}:</td>
1727         <td><input type='text' name='AUTH_CACHE_TTL' value='$proxysettings{'AUTH_CACHE_TTL'}' size='5' /></td>
1728 </tr>
1729 <tr>
1730         <td class='base'>$Lang::tr{'advproxy AUTH limit of IP addresses'}:</td>
1731         <td><input type='text' name='AUTH_MAX_USERIP' value='$proxysettings{'AUTH_MAX_USERIP'}' size='5' /></td>
1732 </tr>
1733 <tr>
1734         <td class='base'>$Lang::tr{'advproxy AUTH user IP cache TTL'}:</td>
1735         <td><input type='text' name='AUTH_IPCACHE_TTL' value='$proxysettings{'AUTH_IPCACHE_TTL'}' size='5' /></td>
1736 </tr>
1737 <tr>
1738         <td class='base'>$Lang::tr{'advproxy AUTH always required'}:</td>
1739         <td><input type='checkbox' name='AUTH_ALWAYS_REQUIRED' $checked{'AUTH_ALWAYS_REQUIRED'}{'on'} /></td>
1740 </tr>
1741 <tr>
1742         <td colspan='2'>&nbsp;</td>
1743 </tr>
1744 </table>
1745 END
1746 ;
1747 }
1748
1749 # ===================================================================
1750 #  NCSA auth settings
1751 # ===================================================================
1752
1753 if ($proxysettings{'AUTH_METHOD'} eq 'ncsa') {
1754 print <<END
1755 <hr size='1'>
1756 <table width='100%'>
1757 <tr>
1758         <td colspan='4'><b>$Lang::tr{'advproxy NCSA auth'}</b></td>
1759 </tr>
1760 <tr>
1761         <td width='25%' class='base'>$Lang::tr{'advproxy NCSA min password length'}:</td>
1762         <td width='20%'><input type='text' name='NCSA_MIN_PASS_LEN' value='$proxysettings{'NCSA_MIN_PASS_LEN'}' size='5' /></td>
1763         <td width='25%' class='base'>$Lang::tr{'advproxy NCSA redirector bypass'} \'$Lang::tr{'advproxy NCSA grp extended'}\':</td>
1764         <td width='20%'><input type='checkbox' name='NCSA_BYPASS_REDIR' $checked{'NCSA_BYPASS_REDIR'}{'on'} /></td>
1765 </tr>
1766 <tr>
1767         <td colspan='2'><br>&nbsp;<input type='submit' name='ACTION' value='$Lang::tr{'advproxy NCSA user management'}'></td>
1768         <td>&nbsp;</td>
1769         <td>&nbsp;</td>
1770 </tr>
1771 </table>
1772 END
1773 ; }
1774
1775 # ===================================================================
1776 #  IDENTD auth settings
1777 # ===================================================================
1778
1779 if ($proxysettings{'AUTH_METHOD'} eq 'ident') {
1780 print <<END
1781 <hr size ='1'>
1782 <table width='100%'>
1783 <tr>
1784         <td colspan='4'><b>$Lang::tr{'advproxy IDENT identd settings'}</b></td>
1785 </tr>
1786 <tr>
1787         <td width='25%' class='base'>$Lang::tr{'advproxy IDENT required'}:</td>
1788         <td width='20%'><input type='checkbox' name='IDENT_REQUIRED' $checked{'IDENT_REQUIRED'}{'on'} /></td>
1789         <td width='25%' class='base'>$Lang::tr{'advproxy AUTH always required'}:</td>
1790         <td width='30%'><input type='checkbox' name='AUTH_ALWAYS_REQUIRED' $checked{'AUTH_ALWAYS_REQUIRED'}{'on'} /></td>
1791 </tr>
1792 <tr>
1793         <td class='base'>$Lang::tr{'advproxy IDENT timeout'}:</td>
1794         <td><input type='text' name='IDENT_TIMEOUT' value='$proxysettings{'IDENT_TIMEOUT'}' size='5' /></td>
1795         <td>&nbsp;</td>
1796         <td>&nbsp;</td>
1797 </tr>
1798 <tr>
1799         <td colspan='2' class='base'>$Lang::tr{'advproxy IDENT aware hosts'}:</td>
1800         <td colspan='2' class='base'>$Lang::tr{'advproxy AUTH no auth'}:</td>
1801 </tr>
1802 <tr>
1803         <td colspan='2'><textarea name='IDENT_HOSTS' cols='32' rows='6' wrap='off'>
1804 END
1805 ;
1806 if (!$proxysettings{'IDENT_HOSTS'}) {
1807         if (&Header::green_used()) {
1808                 print "$green_cidr\n";
1809         }
1810
1811         if (&Header::blue_used()) {
1812                 print "$blue_cidr\n";
1813         }
1814 } else {
1815         print $proxysettings{'IDENT_HOSTS'};
1816 }
1817
1818 print <<END
1819 </textarea></td>
1820                         <td colspan='2'><textarea name='DST_NOAUTH' cols='32' rows='6' wrap='off'>
1821 END
1822 ;
1823
1824 print $proxysettings{'DST_NOAUTH'};
1825
1826 print <<END
1827 </textarea></td>
1828 </tr>
1829 </table>
1830 <hr size ='1'>
1831 <table width='100%'>
1832 <tr>
1833         <td colspan='4'><b>$Lang::tr{'advproxy IDENT user based access restrictions'}</b></td>
1834 </tr>
1835 <tr>
1836         <td width='25%' class='base'>$Lang::tr{'advproxy enabled'}:</td>
1837         <td width='20%'><input type='checkbox' name='IDENT_ENABLE_ACL' $checked{'IDENT_ENABLE_ACL'}{'on'} /></td>
1838         <td width='25%'>&nbsp;</td>
1839         <td width='30%'>&nbsp;</td>
1840 </tr>
1841 <tr>
1842         <td colspan='2'><input type='radio' name='IDENT_USER_ACL' value='positive' $checked{'IDENT_USER_ACL'}{'positive'} />
1843         $Lang::tr{'advproxy IDENT use positive access list'}:</td>
1844         <td colspan='2'><input type='radio' name='IDENT_USER_ACL' value='negative' $checked{'IDENT_USER_ACL'}{'negative'} />
1845         $Lang::tr{'advproxy IDENT use negative access list'}:</td>
1846 </tr>
1847 <tr>
1848         <td colspan='2'>$Lang::tr{'advproxy IDENT authorized users'}</td>
1849         <td colspan='2'>$Lang::tr{'advproxy IDENT unauthorized users'}</td>
1850 </tr>
1851 <tr>
1852         <td colspan='2'><textarea name='IDENT_ALLOW_USERS' cols='32' rows='6' wrap='off'>
1853 END
1854 ; }
1855
1856 if ($proxysettings{'AUTH_METHOD'} eq 'ident') { print $proxysettings{'IDENT_ALLOW_USERS'}; }
1857
1858 if ($proxysettings{'AUTH_METHOD'} eq 'ident') { print <<END
1859 </textarea></td>
1860         <td colspan='2'><textarea name='IDENT_DENY_USERS' cols='32' rows='6' wrap='off'>
1861 END
1862 ; }
1863
1864 if ($proxysettings{'AUTH_METHOD'} eq 'ident') { print $proxysettings{'IDENT_DENY_USERS'}; }
1865
1866 if ($proxysettings{'AUTH_METHOD'} eq 'ident') { print <<END
1867 </textarea></td>
1868 </tr>
1869 </table>
1870 END
1871 ; }
1872
1873 # ===================================================================
1874 #  NTLM-AUTH settings
1875 # ===================================================================
1876
1877 if ($proxysettings{'AUTH_METHOD'} eq 'ntlm-auth') {
1878         print <<END;
1879                 <hr size ='1'>
1880                 <table width='100%'>
1881                         <td width='20%' class='base'>$Lang::tr{'advproxy basic authentication'}:</td>
1882                         <td width='40%'><input type='checkbox' name='NTLM_AUTH_BASIC' $checked{'NTLM_AUTH_BASIC'}{'on'} /></td>
1883                         <td colspan='2'>&nbsp;</td>
1884                 </table>
1885
1886                 <hr size='1' />
1887
1888                 <table width='100%'>
1889                         <tr>
1890                                 <td colspan='4'><b>$Lang::tr{'advproxy group access control'}</b></td>
1891                         </tr>
1892                         <tr>
1893                                 <td width='20%' class='base'>$Lang::tr{'advproxy group required'}:</td>
1894                                 <td width='40%'><input type='text' name='NTLM_AUTH_GROUP' value='$proxysettings{'NTLM_AUTH_GROUP'}' size='37' /></td>
1895                                 <td>&nbsp;</td>
1896                                 <td>&nbsp;</td>
1897                         </tr>
1898         </table>
1899 END
1900 }
1901
1902 # ===================================================================
1903 #  LDAP auth settings
1904 # ===================================================================
1905
1906 if ($proxysettings{'AUTH_METHOD'} eq 'ldap') {
1907 print <<END
1908 <hr size='1'>
1909 <table width='100%'>
1910 <tr>
1911         <td colspan='4'><b>$Lang::tr{'advproxy LDAP common settings'}</b></td>
1912 </tr>
1913 <tr>
1914         <td class='base'>$Lang::tr{'advproxy LDAP basedn'}:</td>
1915         <td><input type='text' name='LDAP_BASEDN' value='$proxysettings{'LDAP_BASEDN'}' size='37' /></td>
1916         <td class='base'>$Lang::tr{'advproxy LDAP type'}:</td>
1917         <td class='base'><select name='LDAP_TYPE'>
1918                 <option value='ADS' $selected{'LDAP_TYPE'}{'ADS'}>$Lang::tr{'advproxy LDAP ADS'}</option>
1919                 <option value='NDS' $selected{'LDAP_TYPE'}{'NDS'}>$Lang::tr{'advproxy LDAP NDS'}</option>
1920                 <option value='V2' $selected{'LDAP_TYPE'}{'V2'}>$Lang::tr{'advproxy LDAP V2'}</option>
1921                 <option value='V3' $selected{'LDAP_TYPE'}{'V3'}>$Lang::tr{'advproxy LDAP V3'}</option>
1922         </select></td>
1923 </tr>
1924 <tr>
1925         <td width='20%' class='base'>$Lang::tr{'advproxy LDAP server'}:</td>
1926         <td width='40%'><input type='text' name='LDAP_SERVER' value='$proxysettings{'LDAP_SERVER'}' size='14' /></td>
1927         <td width='20%' class='base'>$Lang::tr{'advproxy LDAP port'}:</td>
1928         <td><input type='text' name='LDAP_PORT' value='$proxysettings{'LDAP_PORT'}' size='3' /></td>
1929 </tr>
1930 </table>
1931 <hr size ='1'>
1932 <table width='100%'>
1933 <tr>
1934         <td colspan='4'><b>$Lang::tr{'advproxy LDAP binddn settings'}</b></td>
1935 </tr>
1936 <tr>
1937         <td width='20%' class='base'>$Lang::tr{'advproxy LDAP binddn username'}:</td>
1938         <td width='40%'><input type='text' name='LDAP_BINDDN_USER' value='$proxysettings{'LDAP_BINDDN_USER'}' size='37' /></td>
1939         <td width='20%' class='base'>$Lang::tr{'advproxy LDAP binddn password'}:</td>
1940         <td><input type='password' name='LDAP_BINDDN_PASS' value='$proxysettings{'LDAP_BINDDN_PASS'}' size='14' /></td>
1941 </tr>
1942 </table>
1943 <hr size ='1'>
1944 <table width='100%'>
1945 <tr>
1946         <td colspan='4'><b>$Lang::tr{'advproxy LDAP group access control'}</b></td>
1947 </tr>
1948 <tr>
1949         <td width='20%' class='base'>$Lang::tr{'advproxy LDAP group required'}:</td>
1950         <td width='40%'><input type='text' name='LDAP_GROUP' value='$proxysettings{'LDAP_GROUP'}' size='37' /></td>
1951         <td>&nbsp;</td>
1952         <td>&nbsp;</td>
1953 </tr>
1954 </table>
1955 END
1956 ; }
1957
1958 # ===================================================================
1959 #  RADIUS auth settings
1960 # ===================================================================
1961
1962 if ($proxysettings{'AUTH_METHOD'} eq 'radius') {
1963 print <<END
1964 <hr size='1'>
1965 <table width='100%'>
1966 <tr>
1967         <td colspan='4'><b>$Lang::tr{'advproxy RADIUS radius settings'}</b></td>
1968 </tr>
1969 <tr>
1970         <td width='25%' class='base'>$Lang::tr{'advproxy RADIUS server'}:</td>
1971         <td width='20%'><input type='text' name='RADIUS_SERVER' value='$proxysettings{'RADIUS_SERVER'}' size='14' /></td>
1972         <td width='25%' class='base'>$Lang::tr{'advproxy RADIUS port'}:</td>
1973         <td width='30%'><input type='text' name='RADIUS_PORT' value='$proxysettings{'RADIUS_PORT'}' size='3' /></td>
1974 </tr>
1975 <tr>
1976         <td class='base'>$Lang::tr{'advproxy RADIUS identifier'}:</td>
1977         <td><input type='text' name='RADIUS_IDENTIFIER' value='$proxysettings{'RADIUS_IDENTIFIER'}' size='14' /></td>
1978         <td class='base'>$Lang::tr{'advproxy RADIUS secret'}:</td>
1979         <td><input type='password' name='RADIUS_SECRET' value='$proxysettings{'RADIUS_SECRET'}' size='14' /></td>
1980 </tr>
1981 </table>
1982 <hr size ='1'>
1983 <table width='100%'>
1984 <tr>
1985         <td colspan='4'><b>$Lang::tr{'advproxy RADIUS user based access restrictions'}</b></td>
1986 </tr>
1987 <tr>
1988         <td width='25%' class='base'>$Lang::tr{'advproxy enabled'}:</td>
1989         <td width='20%'><input type='checkbox' name='RADIUS_ENABLE_ACL' $checked{'RADIUS_ENABLE_ACL'}{'on'} /></td>
1990         <td width='25%'>&nbsp;</td>
1991         <td width='30%'>&nbsp;</td>
1992 </tr>
1993 <tr>
1994         <td colspan='2'><input type='radio' name='RADIUS_USER_ACL' value='positive' $checked{'RADIUS_USER_ACL'}{'positive'} />
1995         $Lang::tr{'advproxy RADIUS use positive access list'}:</td>
1996         <td colspan='2'><input type='radio' name='RADIUS_USER_ACL' value='negative' $checked{'RADIUS_USER_ACL'}{'negative'} />
1997         $Lang::tr{'advproxy RADIUS use negative access list'}:</td>
1998 </tr>
1999 <tr>
2000         <td colspan='2'>$Lang::tr{'advproxy RADIUS authorized users'}</td>
2001         <td colspan='2'>$Lang::tr{'advproxy RADIUS unauthorized users'}</td>
2002 </tr>
2003 <tr>
2004         <td colspan='2'><textarea name='RADIUS_ALLOW_USERS' cols='32' rows='6' wrap='off'>
2005 END
2006 ; }
2007
2008 if ($proxysettings{'AUTH_METHOD'} eq 'radius') { print $proxysettings{'RADIUS_ALLOW_USERS'}; }
2009
2010 if ($proxysettings{'AUTH_METHOD'} eq 'radius') { print <<END
2011 </textarea></td>
2012         <td colspan='2'><textarea name='RADIUS_DENY_USERS' cols='32' rows='6' wrap='off'>
2013 END
2014 ; }
2015
2016 if ($proxysettings{'AUTH_METHOD'} eq 'radius') { print $proxysettings{'RADIUS_DENY_USERS'}; }
2017
2018 if ($proxysettings{'AUTH_METHOD'} eq 'radius') { print <<END
2019 </textarea></td>
2020 </tr>
2021 </table>
2022 END
2023 ; }
2024
2025 # ===================================================================
2026
2027 }
2028
2029 print "<table>\n";
2030
2031 if ($proxysettings{'AUTH_METHOD'} eq 'none') {
2032 print <<END
2033 <td><input type='hidden' name='AUTH_CHILDREN'        value='$proxysettings{'AUTH_CHILDREN'}'></td>
2034 <td><input type='hidden' name='AUTH_CACHE_TTL'       value='$proxysettings{'AUTH_CACHE_TTL'}' size='5' /></td>
2035 <td><input type='hidden' name='AUTH_MAX_USERIP'      value='$proxysettings{'AUTH_MAX_USERIP'}' size='5' /></td>
2036 <td><input type='hidden' name='AUTH_IPCACHE_TTL'     value='$proxysettings{'AUTH_IPCACHE_TTL'}' size='5' /></td>
2037 <td><input type='hidden' name='AUTH_ALWAYS_REQUIRED' value='$proxysettings{'AUTH_ALWAYS_REQUIRED'}'></td>
2038 <td><input type='hidden' name='AUTH_REALM'           value='$proxysettings{'AUTH_REALM'}'></td>
2039 <td><input type='hidden' name='DST_NOAUTH'           value='$proxysettings{'DST_NOAUTH'}'></td>
2040 END
2041 ; }
2042
2043 if ($proxysettings{'AUTH_METHOD'} eq 'ident') {
2044 print <<END
2045 <td><input type='hidden' name='AUTH_CHILDREN'        value='$proxysettings{'AUTH_CHILDREN'}'></td>
2046 <td><input type='hidden' name='AUTH_CACHE_TTL'       value='$proxysettings{'AUTH_CACHE_TTL'}' size='5' /></td>
2047 <td><input type='hidden' name='AUTH_MAX_USERIP'      value='$proxysettings{'AUTH_MAX_USERIP'}' size='5' /></td>
2048 <td><input type='hidden' name='AUTH_IPCACHE_TTL'     value='$proxysettings{'AUTH_IPCACHE_TTL'}' size='5' /></td>
2049 <td><input type='hidden' name='AUTH_REALM'           value='$proxysettings{'AUTH_REALM'}'></td>
2050 END
2051 ; }
2052
2053 if (!($proxysettings{'AUTH_METHOD'} eq 'ncsa')) {
2054 print <<END
2055 <td><input type='hidden' name='NCSA_MIN_PASS_LEN' value='$proxysettings{'NCSA_MIN_PASS_LEN'}'></td>
2056 <td><input type='hidden' name='NCSA_BYPASS_REDIR' value='$proxysettings{'NCSA_BYPASS_REDIR'}'></td>
2057 END
2058 ; }
2059
2060 if (!($proxysettings{'AUTH_METHOD'} eq 'ident')) {
2061 print <<END
2062 <td><input type='hidden' name='IDENT_REQUIRED'    value='$proxysettings{'IDENT_REQUIRED'}'></td>
2063 <td><input type='hidden' name='IDENT_TIMEOUT'     value='$proxysettings{'IDENT_TIMEOUT'}'></td>
2064 <td><input type='hidden' name='IDENT_HOSTS'       value='$proxysettings{'IDENT_HOSTS'}'></td>
2065 <td><input type='hidden' name='IDENT_ENABLE_ACL'  value='$proxysettings{'IDENT_ENABLE_ACL'}'></td>
2066 <td><input type='hidden' name='IDENT_USER_ACL'    value='$proxysettings{'IDENT_USER_ACL'}'></td>
2067 <td><input type='hidden' name='IDENT_ALLOW_USERS' value='$proxysettings{'IDENT_ALLOW_USERS'}'></td>
2068 <td><input type='hidden' name='IDENT_DENY_USERS'  value='$proxysettings{'IDENT_DENY_USERS'}'></td>
2069 END
2070 ; }
2071
2072 if (!($proxysettings{'AUTH_METHOD'} eq 'ldap')) {
2073 print <<END
2074 <td><input type='hidden' name='LDAP_BASEDN'      value='$proxysettings{'LDAP_BASEDN'}'></td>
2075 <td><input type='hidden' name='LDAP_TYPE'        value='$proxysettings{'LDAP_TYPE'}'></td>
2076 <td><input type='hidden' name='LDAP_SERVER'      value='$proxysettings{'LDAP_SERVER'}'></td>
2077 <td><input type='hidden' name='LDAP_PORT'        value='$proxysettings{'LDAP_PORT'}'></td>
2078 <td><input type='hidden' name='LDAP_BINDDN_USER' value='$proxysettings{'LDAP_BINDDN_USER'}'></td>
2079 <td><input type='hidden' name='LDAP_BINDDN_PASS' value='$proxysettings{'LDAP_BINDDN_PASS'}'></td>
2080 <td><input type='hidden' name='LDAP_GROUP'       value='$proxysettings{'LDAP_GROUP'}'></td>
2081 END
2082 ; }
2083
2084 if (!($proxysettings{'AUTH_METHOD'} eq 'radius')) {
2085 print <<END
2086 <td><input type='hidden' name='RADIUS_SERVER'      value='$proxysettings{'RADIUS_SERVER'}'></td>
2087 <td><input type='hidden' name='RADIUS_PORT'        value='$proxysettings{'RADIUS_PORT'}'></td>
2088 <td><input type='hidden' name='RADIUS_IDENTIFIER'  value='$proxysettings{'RADIUS_IDENTIFIER'}'></td>
2089 <td><input type='hidden' name='RADIUS_SECRET'      value='$proxysettings{'RADIUS_SECRET'}'></td>
2090 <td><input type='hidden' name='RADIUS_ENABLE_ACL'  value='$proxysettings{'RADIUS_ENABLE_ACL'}'></td>
2091 <td><input type='hidden' name='RADIUS_USER_ACL'    value='$proxysettings{'RADIUS_USER_ACL'}'></td>
2092 <td><input type='hidden' name='RADIUS_ALLOW_USERS' value='$proxysettings{'RADIUS_ALLOW_USERS'}'></td>
2093 <td><input type='hidden' name='RADIUS_DENY_USERS'  value='$proxysettings{'RADIUS_DENY_USERS'}'></td>
2094 END
2095 ; }
2096
2097 print "</table>\n";
2098
2099 print <<END
2100 <hr size='1'>
2101 END
2102 ;
2103
2104 print <<END
2105 <table width='100%'>
2106 <tr>
2107         <td>&nbsp;</td>
2108         <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
2109         <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'proxy reconfigure'}' /></td>
2110         <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'advproxy save and restart'}' /></td>
2111         <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'advproxy clear cache'}' /></td>
2112         <td>&nbsp;</td>
2113 </tr>
2114
2115 </table>
2116 <br />
2117 <table width='100%'>
2118 <tr>
2119         <td><img src='/blob.gif' align='top' alt='*' />&nbsp;<font class='base'>$Lang::tr{'required field'}</font></td>
2120         <td align='right'>&nbsp;</td>
2121 </tr>
2122 </table>
2123 </form>
2124 END
2125 ;
2126
2127 &Header::closebox();
2128
2129 } else {
2130
2131 # ===================================================================
2132 #  NCSA user management
2133 # ===================================================================
2134
2135 &Header::openbox('100%', 'left', "$Lang::tr{'advproxy NCSA auth'}");
2136 print <<END
2137 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2138 <table width='100%'>
2139 <tr>
2140         <td colspan='4'><b>$Lang::tr{'advproxy NCSA user management'}</b></td>
2141 </tr>
2142 <tr>
2143         <td width='25%' class='base'>$Lang::tr{'advproxy NCSA username'}:</td>
2144         <td width='25%'><input type='text' name='NCSA_USERNAME' value='$proxysettings{'NCSA_USERNAME'}' size='12'
2145 END
2146 ;
2147         if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'}) { print " readonly='readonly' "; }
2148         print <<END
2149          /></td>
2150         <td width='25%' class='base'>$Lang::tr{'advproxy NCSA group'}:</td>
2151         <td class='base'>
2152                 <select name='NCSA_GROUP'>
2153                 <option value='standard' $selected{'NCSA_GROUP'}{'standard'}>$Lang::tr{'advproxy NCSA grp standard'}</option>
2154                 <option value='extended' $selected{'NCSA_GROUP'}{'extended'}>$Lang::tr{'advproxy NCSA grp extended'}</option>
2155                 <option value='disabled' $selected{'NCSA_GROUP'}{'disabled'}>$Lang::tr{'advproxy NCSA grp disabled'}</option>
2156                 </select>
2157         </td>
2158
2159 </tr>
2160 <tr>
2161         <td class='base'>$Lang::tr{'advproxy NCSA password'}:</td>
2162         <td><input type='password' name='NCSA_PASS' value='$proxysettings{'NCSA_PASS'}' size='14' /></td>
2163         <td class='base'>$Lang::tr{'advproxy NCSA password confirm'}:</td>
2164         <td><input type='password' name='NCSA_PASS_CONFIRM' value='$proxysettings{'NCSA_PASS_CONFIRM'}' size='14' /></td>
2165 </tr>
2166 </table>
2167 <br>
2168 <table>
2169 <tr>
2170         <td>&nbsp;</td>
2171         <td><input type='submit' name='SUBMIT' value='$ncsa_buttontext' /></td>
2172         <td><input type='hidden' name='ACTION' value='$Lang::tr{'add'}' /></td>
2173         <td><input type='hidden' name='NCSA_MIN_PASS_LEN' value='$proxysettings{'NCSA_MIN_PASS_LEN'}'></td>
2174 END
2175 ;
2176         if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'}) {
2177                 print "<td><input type='reset' name='ACTION' value='$Lang::tr{'advproxy reset'}' /></td>\n";
2178         }
2179
2180 print <<END
2181         <td>&nbsp;</td>
2182         <td>&nbsp;</td>
2183         <td><input type='button' name='return2main' value='$Lang::tr{'advproxy back to main page'}' onClick='self.location.href="$ENV{'SCRIPT_NAME'}"'></td>
2184 </tr>
2185 </table>
2186 </form>
2187 <hr size='1'>
2188 <table width='100%'>
2189 <tr>
2190         <td><b>$Lang::tr{'advproxy NCSA user accounts'}:</b></td>
2191 </tr>
2192 </table>
2193 <table width='100%' align='center'>
2194 END
2195 ;
2196
2197 if (-e $extgrp)
2198 {
2199         open(FILE, $extgrp); @grouplist = <FILE>; close(FILE);
2200         foreach $user (@grouplist) { chomp($user); push(@userlist,$user.":extended"); }
2201 }
2202 if (-e $stdgrp)
2203 {
2204         open(FILE, $stdgrp); @grouplist = <FILE>; close(FILE);
2205         foreach $user (@grouplist) { chomp($user); push(@userlist,$user.":standard"); }
2206 }
2207 if (-e $disgrp)
2208 {
2209         open(FILE, $disgrp); @grouplist = <FILE>; close(FILE);
2210         foreach $user (@grouplist) { chomp($user); push(@userlist,$user.":disabled"); }
2211 }
2212
2213 @userlist = sort(@userlist);
2214
2215 # If the password file contains entries, print entries and action icons
2216
2217 if ( ! -z "$userdb" ) {
2218         print <<END
2219         <tr>
2220                 <td width='30%' class='boldbase' align='center'><b><i>$Lang::tr{'advproxy NCSA username'}</i></b></td>
2221                 <td width='30%' class='boldbase' align='center'><b><i>$Lang::tr{'advproxy NCSA group membership'}</i></b></td>
2222                 <td class='boldbase' colspan='2' align='center'>&nbsp;</td>
2223         </tr>
2224 END
2225 ;
2226         $id = 0;
2227         foreach $line (@userlist)
2228         {
2229                 $id++;
2230                 chomp($line);
2231                 @temp = split(/:/,$line);
2232                 if($proxysettings{'ACTION'} eq $Lang::tr{'edit'} && $proxysettings{'ID'} eq $line) {
2233                         print "<tr bgcolor='$Header::colouryellow'>\n"; }
2234                 elsif ($id % 2) {
2235                         print "<tr bgcolor='$color{'color20'}'>\n"; }
2236                 else {
2237                         print "<tr bgcolor='$color{'color22'}'>\n"; }
2238
2239                 print <<END
2240                 <td align='center'>$temp[0]</td>
2241                 <td align='center'>
2242 END
2243 ;
2244                 if ($temp[1] eq 'standard') {
2245                         print $Lang::tr{'advproxy NCSA grp standard'};
2246                 } elsif ($temp[1] eq 'extended') {
2247                         print $Lang::tr{'advproxy NCSA grp extended'};
2248                 } elsif ($temp[1] eq 'disabled') {
2249                         print $Lang::tr{'advproxy NCSA grp disabled'}; }
2250                 print <<END
2251                 </td>
2252                 <td width='8%' align='center'>
2253                 <form method='post' name='frma$id' action='$ENV{'SCRIPT_NAME'}'>
2254                 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' title='$Lang::tr{'edit'}' alt='$Lang::tr{'edit'}' />
2255                 <input type='hidden' name='ID' value='$line' />
2256                 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
2257                 </form>
2258                 </td>
2259
2260                 <td width='8%' align='center'>
2261                 <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
2262                 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}' />
2263                 <input type='hidden' name='ID' value='$temp[0]' />
2264                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
2265                 </form>
2266                 </td>
2267         </tr>
2268 END
2269 ;
2270         }
2271
2272 print <<END
2273 </table>
2274 <br>
2275 <table>
2276 <tr>
2277         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
2278         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
2279         <td class='base'>$Lang::tr{'edit'}</td>
2280         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
2281         <td class='base'>$Lang::tr{'remove'}</td>
2282 </tr>
2283 END
2284 ;
2285 } else {
2286         print <<END
2287         <tr>
2288                 <td><i>$Lang::tr{'advproxy NCSA no accounts'}</i></td>
2289         </tr>
2290 END
2291 ;
2292 }
2293
2294 print <<END
2295 </table>
2296 END
2297 ;
2298
2299 &Header::closebox();
2300
2301 }
2302
2303 # ===================================================================
2304
2305 &Header::closebigbox();
2306
2307 &Header::closepage();
2308
2309 # -------------------------------------------------------------------
2310
2311 sub read_acls
2312 {
2313         if (-e "$acl_src_subnets") {
2314                 open(FILE,"$acl_src_subnets");
2315                 delete $proxysettings{'SRC_SUBNETS'};
2316                 while (<FILE>) { $proxysettings{'SRC_SUBNETS'} .= $_ };
2317                 close(FILE);
2318         }
2319         if (-e "$acl_src_banned_ip") {
2320                 open(FILE,"$acl_src_banned_ip");
2321                 delete $proxysettings{'SRC_BANNED_IP'};
2322                 while (<FILE>) { $proxysettings{'SRC_BANNED_IP'} .= $_ };
2323                 close(FILE);
2324         }
2325         if (-e "$acl_src_banned_mac") {
2326                 open(FILE,"$acl_src_banned_mac");
2327                 delete $proxysettings{'SRC_BANNED_MAC'};
2328                 while (<FILE>) { $proxysettings{'SRC_BANNED_MAC'} .= $_ };
2329                 close(FILE);
2330         }
2331         if (-e "$acl_src_unrestricted_ip") {
2332                 open(FILE,"$acl_src_unrestricted_ip");
2333                 delete $proxysettings{'SRC_UNRESTRICTED_IP'};
2334                 while (<FILE>) { $proxysettings{'SRC_UNRESTRICTED_IP'} .= $_ };
2335                 close(FILE);
2336         }
2337         if (-e "$acl_src_unrestricted_mac") {
2338                 open(FILE,"$acl_src_unrestricted_mac");
2339                 delete $proxysettings{'SRC_UNRESTRICTED_MAC'};
2340                 while (<FILE>) { $proxysettings{'SRC_UNRESTRICTED_MAC'} .= $_ };
2341                 close(FILE);
2342         }
2343         if (-e "$acl_dst_nocache") {
2344                 open(FILE,"$acl_dst_nocache");
2345                 delete $proxysettings{'DST_NOCACHE'};
2346                 while (<FILE>) { $proxysettings{'DST_NOCACHE'} .= $_ };
2347                 close(FILE);
2348         }
2349         if (-e "$acl_dst_noauth") {
2350                 open(FILE,"$acl_dst_noauth");
2351                 delete $proxysettings{'DST_NOAUTH'};
2352                 while (<FILE>) { $proxysettings{'DST_NOAUTH'} .= $_ };
2353                 close(FILE);
2354         }
2355         if (-e "$acl_dst_noproxy_ip") {
2356                 open(FILE,"$acl_dst_noproxy_ip");
2357                 delete $proxysettings{'DST_NOPROXY_IP'};
2358                 while (<FILE>) { $proxysettings{'DST_NOPROXY_IP'} .= $_ };
2359                 close(FILE);
2360         }
2361         if (-e "$acl_dst_noproxy_url") {
2362                 open(FILE,"$acl_dst_noproxy_url");
2363                 delete $proxysettings{'DST_NOPROXY_URL'};
2364                 while (<FILE>) { $proxysettings{'DST_NOPROXY_URL'} .= $_ };
2365                 close(FILE);
2366         }
2367         if (-e "$acl_ports_safe") {
2368                 open(FILE,"$acl_ports_safe");
2369                 delete $proxysettings{'PORTS_SAFE'};
2370                 while (<FILE>) { $proxysettings{'PORTS_SAFE'} .= $_ };
2371                 close(FILE);
2372         }
2373         if (-e "$acl_ports_ssl") {
2374                 open(FILE,"$acl_ports_ssl");
2375                 delete $proxysettings{'PORTS_SSL'};
2376                 while (<FILE>) { $proxysettings{'PORTS_SSL'} .= $_ };
2377                 close(FILE);
2378         }
2379         if (-e "$mimetypes") {
2380                 open(FILE,"$mimetypes");
2381                 delete $proxysettings{'MIME_TYPES'};
2382                 while (<FILE>) { $proxysettings{'MIME_TYPES'} .= $_ };
2383                 close(FILE);
2384         }
2385         if (-e "$raddir/radauth.allowusers") {
2386                 open(FILE,"$raddir/radauth.allowusers");
2387                 delete $proxysettings{'RADIUS_ALLOW_USERS'};
2388                 while (<FILE>) { $proxysettings{'RADIUS_ALLOW_USERS'} .= $_ };
2389                 close(FILE);
2390         }
2391         if (-e "$raddir/radauth.denyusers") {
2392                 open(FILE,"$raddir/radauth.denyusers");
2393                 delete $proxysettings{'RADIUS_DENY_USERS'};
2394                 while (<FILE>) { $proxysettings{'RADIUS_DENY_USERS'} .= $_ };
2395                 close(FILE);
2396         }
2397         if (-e "$identdir/identauth.allowusers") {
2398                 open(FILE,"$identdir/identauth.allowusers");
2399                 delete $proxysettings{'IDENT_ALLOW_USERS'};
2400                 while (<FILE>) { $proxysettings{'IDENT_ALLOW_USERS'} .= $_ };
2401                 close(FILE);
2402         }
2403         if (-e "$identdir/identauth.denyusers") {
2404                 open(FILE,"$identdir/identauth.denyusers");
2405                 delete $proxysettings{'IDENT_DENY_USERS'};
2406                 while (<FILE>) { $proxysettings{'IDENT_DENY_USERS'} .= $_ };
2407                 close(FILE);
2408         }
2409         if (-e "$identhosts") {
2410                 open(FILE,"$identhosts");
2411                 delete $proxysettings{'IDENT_HOSTS'};
2412                 while (<FILE>) { $proxysettings{'IDENT_HOSTS'} .= $_ };
2413                 close(FILE);
2414         }
2415         if (-e "$cre_groups") {
2416                 open(FILE,"$cre_groups");
2417                 delete $proxysettings{'CRE_GROUPS'};
2418                 while (<FILE>) { $proxysettings{'CRE_GROUPS'} .= $_ };
2419                 close(FILE);
2420         }
2421         if (-e "$cre_svhosts") {
2422                 open(FILE,"$cre_svhosts");
2423                 delete $proxysettings{'CRE_SVHOSTS'};
2424                 while (<FILE>) { $proxysettings{'CRE_SVHOSTS'} .= $_ };
2425                 close(FILE);
2426         }
2427 }
2428
2429 # -------------------------------------------------------------------
2430
2431 sub check_acls
2432 {
2433         @temp = split(/\n/,$proxysettings{'PORTS_SAFE'});
2434         undef $proxysettings{'PORTS_SAFE'};
2435         foreach (@temp)
2436         {
2437                 s/^\s+//g; s/\s+$//g;
2438                 if ($_)
2439                 {
2440                         $line = $_;
2441                         if (/^[^#]+\s+#\sSquids\sport/) { s/(^[^#]+)(\s+#\sSquids\sport)/$proxysettings{'PROXY_PORT'}\2/; $line=$_; }
2442                         s/#.*//g; s/\s+//g;
2443                         if (/.*-.*-.*/) { $errormessage = $Lang::tr{'advproxy errmsg invalid destination port'}; }
2444                         @templist = split(/-/);
2445                         foreach (@templist) { unless (&General::validport($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid destination port'}; } }
2446                         $proxysettings{'PORTS_SAFE'} .= $line."\n";
2447                 }
2448         }
2449
2450         @temp = split(/\n/,$proxysettings{'PORTS_SSL'});
2451         undef $proxysettings{'PORTS_SSL'};
2452         foreach (@temp)
2453         {
2454                 s/^\s+//g; s/\s+$//g;
2455                 if ($_)
2456                 {
2457                         $line = $_;
2458                         s/#.*//g; s/\s+//g;
2459                         if (/.*-.*-.*/) { $errormessage = $Lang::tr{'advproxy errmsg invalid destination port'}; }
2460                         @templist = split(/-/);
2461                         foreach (@templist) { unless (&General::validport($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid destination port'}; } }
2462                         $proxysettings{'PORTS_SSL'} .= $line."\n";
2463                 }
2464         }
2465
2466         @temp = split(/\n/,$proxysettings{'DST_NOCACHE'});
2467         undef $proxysettings{'DST_NOCACHE'};
2468         foreach (@temp)
2469         {
2470                 s/^\s+//g;
2471                 unless (/^#/) { s/\s+//g; }
2472                 if ($_)
2473                 {
2474                         if (/^\./) { $_ = '*'.$_; }
2475                         $proxysettings{'DST_NOCACHE'} .= $_."\n";
2476                 }
2477         }
2478
2479         @temp = split(/\n/,$proxysettings{'SRC_SUBNETS'});
2480         undef $proxysettings{'SRC_SUBNETS'};
2481         foreach (@temp)
2482         {
2483                 s/^\s+//g; s/\s+$//g;
2484                 if ($_)
2485                 {
2486                         unless (&Network::check_subnet($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid ip or mask'} . ": $_"; }
2487                         $proxysettings{'SRC_SUBNETS'} .= $_."\n";
2488                 }
2489         }
2490
2491         @temp = split(/\n/,$proxysettings{'SRC_BANNED_IP'});
2492         undef $proxysettings{'SRC_BANNED_IP'};
2493         foreach (@temp)
2494         {
2495                 s/^\s+//g; s/\s+$//g;
2496                 if ($_)
2497                 {
2498                         unless (&General::validipormask($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid ip or mask'}; }
2499                         $proxysettings{'SRC_BANNED_IP'} .= $_."\n";
2500                 }
2501         }
2502
2503         @temp = split(/\n/,$proxysettings{'SRC_BANNED_MAC'});
2504         undef $proxysettings{'SRC_BANNED_MAC'};
2505         foreach (@temp)
2506         {
2507                 s/^\s+//g; s/\s+$//g; s/-/:/g;
2508                 if ($_)
2509                 {
2510                         unless (&General::validmac($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid mac'}; }
2511                         $proxysettings{'SRC_BANNED_MAC'} .= $_."\n";
2512                 }
2513         }
2514
2515         @temp = split(/\n/,$proxysettings{'SRC_UNRESTRICTED_IP'});
2516         undef $proxysettings{'SRC_UNRESTRICTED_IP'};
2517         foreach (@temp)
2518         {
2519                 s/^\s+//g; s/\s+$//g;
2520                 if ($_)
2521                 {
2522                         unless (&General::validipormask($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid ip or mask'}; }
2523                         $proxysettings{'SRC_UNRESTRICTED_IP'} .= $_."\n";
2524                 }
2525         }
2526
2527         @temp = split(/\n/,$proxysettings{'SRC_UNRESTRICTED_MAC'});
2528         undef $proxysettings{'SRC_UNRESTRICTED_MAC'};
2529         foreach (@temp)
2530         {
2531                 s/^\s+//g; s/\s+$//g; s/-/:/g;
2532                 if ($_)
2533                 {
2534                         unless (&General::validmac($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid mac'}; }
2535                         $proxysettings{'SRC_UNRESTRICTED_MAC'} .= $_."\n";
2536                 }
2537         }
2538
2539         @temp = split(/\n/,$proxysettings{'DST_NOAUTH'});
2540         undef $proxysettings{'DST_NOAUTH'};
2541         foreach (@temp)
2542         {
2543                 s/^\s+//g;
2544                 unless (/^#/) { s/\s+//g; }
2545                 if ($_)
2546                 {
2547                         if (/^\./) { $_ = '*'.$_; }
2548                         $proxysettings{'DST_NOAUTH'} .= $_."\n";
2549                 }
2550         }
2551
2552         @temp = split(/\n/,$proxysettings{'DST_NOPROXY_IP'});
2553         undef $proxysettings{'DST_NOPROXY_IP'};
2554         foreach (@temp)
2555         {
2556                         s/^\s+//g; s/\s+$//g;
2557                         if ($_)
2558                         {
2559                                         unless (&General::validipormask($_)) { $errormessage = $Lang::tr{'advproxy errmsg wpad invalid ip or mask'}; }
2560                                         $proxysettings{'DST_NOPROXY_IP'} .= $_."\n";
2561                         }
2562         }
2563
2564         @temp = split(/\n/,$proxysettings{'DST_NOPROXY_URL'});
2565         undef $proxysettings{'DST_NOPROXY_URL'};
2566         foreach (@temp)
2567         {
2568                         s/^\s+//g;
2569                         unless (/^#/) { s/\s+//g; }
2570                         if ($_)
2571                         {
2572                                         if (/^\./) { $_ = '*'.$_; }
2573                                         $proxysettings{'DST_NOPROXY_URL'} .= $_."\n";
2574                         }
2575         }
2576
2577         if (($proxysettings{'NTLM_ENABLE_ACL'} eq 'on') && ($proxysettings{'NTLM_USER_ACL'} eq 'positive'))
2578         {
2579                 @temp = split(/\n/,$proxysettings{'NTLM_ALLOW_USERS'});
2580                 undef $proxysettings{'NTLM_ALLOW_USERS'};
2581                 foreach (@temp)
2582                 {
2583                         s/^\s+//g; s/\s+$//g;
2584                         if ($_) { $proxysettings{'NTLM_ALLOW_USERS'} .= $_."\n"; }
2585                 }
2586                 if ($proxysettings{'NTLM_ALLOW_USERS'} eq '') { $errormessage = $Lang::tr{'advproxy errmsg acl cannot be empty'}; }
2587         }
2588
2589         if (($proxysettings{'NTLM_ENABLE_ACL'} eq 'on') && ($proxysettings{'NTLM_USER_ACL'} eq 'negative'))
2590         {
2591                 @temp = split(/\n/,$proxysettings{'NTLM_DENY_USERS'});
2592                 undef $proxysettings{'NTLM_DENY_USERS'};
2593                 foreach (@temp)
2594                 {
2595                         s/^\s+//g; s/\s+$//g;
2596                         if ($_) { $proxysettings{'NTLM_DENY_USERS'} .= $_."\n"; }
2597                 }
2598                 if ($proxysettings{'NTLM_DENY_USERS'} eq '') { $errormessage = $Lang::tr{'advproxy errmsg acl cannot be empty'}; }
2599         }
2600
2601         if (($proxysettings{'IDENT_ENABLE_ACL'} eq 'on') && ($proxysettings{'IDENT_USER_ACL'} eq 'positive'))
2602         {
2603                 @temp = split(/\n/,$proxysettings{'IDENT_ALLOW_USERS'});
2604                 undef $proxysettings{'IDENT_ALLOW_USERS'};
2605                 foreach (@temp)
2606                 {
2607                         s/^\s+//g; s/\s+$//g;
2608                         if ($_) { $proxysettings{'IDENT_ALLOW_USERS'} .= $_."\n"; }
2609                 }
2610                 if ($proxysettings{'IDENT_ALLOW_USERS'} eq '') { $errormessage = $Lang::tr{'advproxy errmsg acl cannot be empty'}; }
2611         }
2612
2613         if (($proxysettings{'IDENT_ENABLE_ACL'} eq 'on') && ($proxysettings{'IDENT_USER_ACL'} eq 'negative'))
2614         {
2615                 @temp = split(/\n/,$proxysettings{'IDENT_DENY_USERS'});
2616                 undef $proxysettings{'IDENT_DENY_USERS'};
2617                 foreach (@temp)
2618                 {
2619                         s/^\s+//g; s/\s+$//g;
2620                         if ($_) { $proxysettings{'IDENT_DENY_USERS'} .= $_."\n"; }
2621                 }
2622                 if ($proxysettings{'IDENT_DENY_USERS'} eq '') { $errormessage = $Lang::tr{'advproxy errmsg acl cannot be empty'}; }
2623         }
2624
2625         if (($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on') && ($proxysettings{'RADIUS_USER_ACL'} eq 'positive'))
2626         {
2627                 @temp = split(/\n/,$proxysettings{'RADIUS_ALLOW_USERS'});
2628                 undef $proxysettings{'RADIUS_ALLOW_USERS'};
2629                 foreach (@temp)
2630                 {
2631                         s/^\s+//g; s/\s+$//g;
2632                         if ($_) { $proxysettings{'RADIUS_ALLOW_USERS'} .= $_."\n"; }
2633                 }
2634                 if ($proxysettings{'RADIUS_ALLOW_USERS'} eq '') { $errormessage = $Lang::tr{'advproxy errmsg acl cannot be empty'}; }
2635         }
2636
2637         if (($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on') && ($proxysettings{'RADIUS_USER_ACL'} eq 'negative'))
2638         {
2639                 @temp = split(/\n/,$proxysettings{'RADIUS_DENY_USERS'});
2640                 undef $proxysettings{'RADIUS_DENY_USERS'};
2641                 foreach (@temp)
2642                 {
2643                         s/^\s+//g; s/\s+$//g;
2644                         if ($_) { $proxysettings{'RADIUS_DENY_USERS'} .= $_."\n"; }
2645                 }
2646                 if ($proxysettings{'RADIUS_DENY_USERS'} eq '') { $errormessage = $Lang::tr{'advproxy errmsg acl cannot be empty'}; }
2647         }
2648
2649         @temp = split(/\n/,$proxysettings{'IDENT_HOSTS'});
2650         undef $proxysettings{'IDENT_HOSTS'};
2651         foreach (@temp)
2652         {
2653                 s/^\s+//g; s/\s+$//g;
2654                 if ($_)
2655                 {
2656                         unless (&General::validipormask($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid ip or mask'}; }
2657                         $proxysettings{'IDENT_HOSTS'} .= $_."\n";
2658                 }
2659         }
2660
2661         @temp = split(/\n/,$proxysettings{'CRE_SVHOSTS'});
2662         undef $proxysettings{'CRE_SVHOSTS'};
2663         foreach (@temp)
2664         {
2665                 s/^\s+//g; s/\s+$//g;
2666                 if ($_)
2667                 {
2668                         unless (&General::validipormask($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid ip or mask'}; }
2669                         $proxysettings{'CRE_SVHOSTS'} .= $_."\n";
2670                 }
2671         }
2672 }
2673
2674 # -------------------------------------------------------------------
2675
2676 sub write_acls
2677 {
2678         open(FILE, ">$acl_src_subnets");
2679         flock(FILE, 2);
2680         if (!$proxysettings{'SRC_SUBNETS'})
2681         {
2682                 if (&Header::green_used()) {
2683                         print FILE "$green_cidr\n";
2684                 }
2685
2686                 if (&Header::blue_used()) {
2687                         print FILE "$blue_cidr\n";
2688                 }
2689         } else { print FILE $proxysettings{'SRC_SUBNETS'}; }
2690         close(FILE);
2691
2692         open(FILE, ">$acl_src_banned_ip");
2693         flock(FILE, 2);
2694         print FILE $proxysettings{'SRC_BANNED_IP'};
2695         close(FILE);
2696
2697         open(FILE, ">$acl_src_banned_mac");
2698         flock(FILE, 2);
2699         print FILE $proxysettings{'SRC_BANNED_MAC'};
2700         close(FILE);
2701
2702         open(FILE, ">$acl_src_unrestricted_ip");
2703         flock(FILE, 2);
2704         print FILE $proxysettings{'SRC_UNRESTRICTED_IP'};
2705         close(FILE);
2706
2707         open(FILE, ">$acl_src_unrestricted_mac");
2708         flock(FILE, 2);
2709         print FILE $proxysettings{'SRC_UNRESTRICTED_MAC'};
2710         close(FILE);
2711
2712         open(FILE, ">$acl_dst_noauth");
2713         flock(FILE, 2);
2714         print FILE $proxysettings{'DST_NOAUTH'};
2715         close(FILE);
2716
2717         open(FILE, ">$acl_dst_noproxy_ip");
2718         flock(FILE, 2);
2719         print FILE $proxysettings{'DST_NOPROXY_IP'};
2720         close(FILE);
2721
2722         open(FILE, ">$acl_dst_noproxy_url");
2723         flock(FILE, 2);
2724         print FILE $proxysettings{'DST_NOPROXY_URL'};
2725         close(FILE);
2726
2727         open(FILE, ">$acl_dst_noauth_net");
2728         close(FILE);
2729         open(FILE, ">$acl_dst_noauth_dom");
2730         close(FILE);
2731         open(FILE, ">$acl_dst_noauth_url");
2732         close(FILE);
2733
2734         @temp = split(/\n/,$proxysettings{'DST_NOAUTH'});
2735         foreach(@temp)
2736         {
2737                 unless (/^#/)
2738                 {
2739                         if (/^\*\.\w/)
2740                         {
2741                                 s/^\*//;
2742                                 open(FILE, ">>$acl_dst_noauth_dom");
2743                                 flock(FILE, 2);
2744                                 print FILE "$_\n";
2745                                 close(FILE);
2746                         }
2747                         elsif (&General::validipormask($_))
2748                         {
2749                                 open(FILE, ">>$acl_dst_noauth_net");
2750                                 flock(FILE, 2);
2751                                 print FILE "$_\n";
2752                                 close(FILE);
2753                         }
2754                         elsif (/\d\d?\d?\.\d\d?\d?\.\d\d?\d?\.\d\d?\d?-\d\d?\d?\.\d\d?\d?\.\d\d?\d?\.\d\d?\d?/)
2755                         {
2756                                 open(FILE, ">>$acl_dst_noauth_net");
2757                                 flock(FILE, 2);
2758                                 print FILE "$_\n";
2759                                 close(FILE);
2760                         }
2761                         else
2762                         {
2763                                 open(FILE, ">>$acl_dst_noauth_url");
2764                                 flock(FILE, 2);
2765                                 if (/^[fh]tt?ps?:\/\//) { print FILE "$_\n"; } else { print FILE "^[fh]tt?ps?://$_\n"; }
2766                                 close(FILE);
2767                         }
2768                 }
2769         }
2770
2771         open(FILE, ">$acl_dst_nocache");
2772         flock(FILE, 2);
2773         print FILE $proxysettings{'DST_NOCACHE'};
2774         close(FILE);
2775
2776         open(FILE, ">$acl_dst_nocache_net");
2777         close(FILE);
2778         open(FILE, ">$acl_dst_nocache_dom");
2779         close(FILE);
2780         open(FILE, ">$acl_dst_nocache_url");
2781         close(FILE);
2782
2783         @temp = split(/\n/,$proxysettings{'DST_NOCACHE'});
2784         foreach(@temp)
2785         {
2786                 unless (/^#/)
2787                 {
2788                         if (/^\*\.\w/)
2789                         {
2790                                 s/^\*//;
2791                                 open(FILE, ">>$acl_dst_nocache_dom");
2792                                 flock(FILE, 2);
2793                                 print FILE "$_\n";
2794                                 close(FILE);
2795                         }
2796                         elsif (&General::validipormask($_))
2797                         {
2798                                 open(FILE, ">>$acl_dst_nocache_net");
2799                                 flock(FILE, 2);
2800                                 print FILE "$_\n";
2801                                 close(FILE);
2802                         }
2803                         elsif (/\d\d?\d?\.\d\d?\d?\.\d\d?\d?\.\d\d?\d?-\d\d?\d?\.\d\d?\d?\.\d\d?\d?\.\d\d?\d?/)
2804                         {
2805                                 open(FILE, ">>$acl_dst_nocache_net");
2806                                 flock(FILE, 2);
2807                                 print FILE "$_\n";
2808                                 close(FILE);
2809                         }
2810                         else
2811                         {
2812                                 open(FILE, ">>$acl_dst_nocache_url");
2813                                 flock(FILE, 2);
2814                                 if (/^[fh]tt?ps?:\/\//) { print FILE "$_\n"; } else { print FILE "^[fh]tt?ps?://$_\n"; }
2815                                 close(FILE);
2816                         }
2817                 }
2818         }
2819
2820         open(FILE, ">$acl_ports_safe");
2821         flock(FILE, 2);
2822         if (!$proxysettings{'PORTS_SAFE'}) { print FILE $def_ports_safe; } else { print FILE $proxysettings{'PORTS_SAFE'}; }
2823         close(FILE);
2824
2825         open(FILE, ">$acl_ports_ssl");
2826         flock(FILE, 2);
2827         if (!$proxysettings{'PORTS_SSL'}) { print FILE $def_ports_ssl; } else { print FILE $proxysettings{'PORTS_SSL'}; }
2828         close(FILE);
2829
2830         if (-s $throttled_urls)
2831         {
2832                 open(URLFILE, $throttled_urls);
2833                 @temp = <URLFILE>;
2834                 close(URLFILE);
2835                 foreach (@temp) { print FILE; }
2836         }
2837         close(FILE);
2838
2839         open(FILE, ">$mimetypes");
2840         flock(FILE, 2);
2841         print FILE $proxysettings{'MIME_TYPES'};
2842         close(FILE);
2843
2844         open(FILE, ">$raddir/radauth.allowusers");
2845         flock(FILE, 2);
2846         print FILE $proxysettings{'RADIUS_ALLOW_USERS'};
2847         close(FILE);
2848
2849         open(FILE, ">$raddir/radauth.denyusers");
2850         flock(FILE, 2);
2851         print FILE $proxysettings{'RADIUS_DENY_USERS'};
2852         close(FILE);
2853
2854         open(FILE, ">$identdir/identauth.allowusers");
2855         flock(FILE, 2);
2856         print FILE $proxysettings{'IDENT_ALLOW_USERS'};
2857         close(FILE);
2858
2859         open(FILE, ">$identdir/identauth.denyusers");
2860         flock(FILE, 2);
2861         print FILE $proxysettings{'IDENT_DENY_USERS'};
2862         close(FILE);
2863
2864         open(FILE, ">$identhosts");
2865         flock(FILE, 2);
2866         print FILE $proxysettings{'IDENT_HOSTS'};
2867         close(FILE);
2868
2869         open(FILE, ">$cre_groups");
2870         flock(FILE, 2);
2871         print FILE $proxysettings{'CRE_GROUPS'};
2872         close(FILE);
2873
2874         open(FILE, ">$cre_svhosts");
2875         flock(FILE, 2);
2876         print FILE $proxysettings{'CRE_SVHOSTS'};
2877         close(FILE);
2878 }
2879
2880 # -------------------------------------------------------------------
2881
2882 sub writepacfile
2883 {
2884         my %vpnconfig=();
2885         my %ovpnconfig=();
2886         &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
2887         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ovpnconfig);
2888         open(FILE, ">/srv/web/ipfire/html/proxy.pac");
2889         flock(FILE, 2);
2890         print FILE "function FindProxyForURL(url, host)\n";
2891         print FILE "{\n";
2892         if (($proxysettings{'ENABLE'} eq 'on') || ($proxysettings{'ENABLE_BLUE'} eq 'on'))
2893         {
2894                 print FILE <<END
2895 if (
2896      (isPlainHostName(host)) ||
2897      (isInNet(host, "127.0.0.1", "255.0.0.0")) ||
2898 END
2899 ;
2900
2901         if ($netsettings{'GREEN_DEV'}) {
2902                 print FILE "     (isInNet(host, \"$netsettings{'GREEN_NETADDRESS'}\", \"$netsettings{'GREEN_NETMASK'}\")) ||\n";
2903         }
2904
2905         if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
2906                 print FILE "     (isInNet(host, \"$netsettings{'BLUE_NETADDRESS'}\", \"$netsettings{'BLUE_NETMASK'}\")) ||\n";
2907         }
2908
2909         if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
2910                 print FILE "     (isInNet(host, \"$netsettings{'ORANGE_NETADDRESS'}\", \"$netsettings{'ORANGE_NETMASK'}\")) ||\n";
2911         }
2912
2913         # Additional exceptions for URLs
2914         # The file has to be created by the user and should contain one entry per line
2915         # Line-Format: <URL incl. wildcards>
2916         # e.g. *.ipfire.org*
2917         if (-s "$acl_dst_noproxy_url") {
2918                 undef @templist;
2919
2920                 open(NOPROXY,"$acl_dst_noproxy_url");
2921                 @templist = <NOPROXY>;
2922                 close(NOPROXY);
2923                 chomp (@templist);
2924
2925                 foreach (@templist)
2926                 {
2927                         print FILE "     (shExpMatch(url, \"$_\")) ||\n";
2928                 }
2929         }
2930
2931         # Additional exceptions for Subnets
2932         # The file has to be created by the user and should contain one entry per line
2933         # Line-Format: <IP>/<SUBNET MASK>
2934         # e.g. 192.168.0.0/255.255.255.0
2935         if (-s "$acl_dst_noproxy_ip") {
2936                 undef @templist;
2937
2938                 open(NOPROXY,"$acl_dst_noproxy_ip");
2939                 @templist = <NOPROXY>;
2940                 close(NOPROXY);
2941                 chomp (@templist);
2942
2943                 foreach (@templist)
2944                 {
2945                         @temp = split(/\//);
2946                         print FILE "     (isInNet(host, \"$temp[0]\", \"$temp[1]\")) ||\n";
2947                 }
2948         }
2949
2950         foreach my $key (sort { uc($vpnconfig{$a}[1]) cmp uc($vpnconfig{$b}[1]) } keys %vpnconfig) {
2951                 if ($vpnconfig{$key}[0] eq 'on' && $vpnconfig{$key}[3] ne 'host') {
2952                         my @networks = split(/\|/, $vpnconfig{$key}[11]);
2953                         foreach my $network (@networks) {
2954                                 my ($vpnip, $vpnsub) = split("/", $network);
2955                                 $vpnsub = &Network::convert_prefix2netmask($vpnsub) || $vpnsub;
2956                                 print FILE "     (isInNet(host, \"$vpnip\", \"$vpnsub\")) ||\n";
2957                         }
2958                 }
2959         }
2960
2961         foreach my $key (sort { uc($ovpnconfig{$a}[1]) cmp uc($ovpnconfig{$b}[1]) } keys %ovpnconfig) {
2962                 if ($ovpnconfig{$key}[0] eq 'on' && $ovpnconfig{$key}[3] ne 'host') {
2963                         my @networks = split(/\|/, $ovpnconfig{$key}[11]);
2964                         foreach my $network (@networks) {
2965                                 my ($vpnip, $vpnsub) = split("/", $network);
2966                                 print FILE "     (isInNet(host, \"$vpnip\", \"$vpnsub\")) ||\n";
2967                         }
2968                 }
2969         }
2970
2971         print FILE <<END
2972      (isInNet(host, "169.254.0.0", "255.255.0.0"))
2973    )
2974      return "DIRECT";
2975
2976  else
2977
2978 END
2979 ;
2980                 if ($proxysettings{'ENABLE'} eq 'on')
2981                 {
2982                         print FILE "if (\n";
2983                         print FILE "     (isInNet(myIpAddress(), \"$netsettings{'GREEN_NETADDRESS'}\", \"$netsettings{'GREEN_NETMASK'}\"))";
2984
2985                         undef @templist;
2986                         if (-e "$acl_src_subnets") {
2987                                 open(SUBNETS,"$acl_src_subnets");
2988                                 @templist = <SUBNETS>;
2989                                 close(SUBNETS);
2990                         }
2991
2992                         foreach (@templist)
2993                         {
2994                                 @temp = split(/\//);
2995                                 if (
2996                                         ($temp[0] ne $netsettings{'GREEN_NETADDRESS'}) && ($temp[1] ne $netsettings{'GREEN_NETMASK'}) &&
2997                                         ($temp[0] ne $netsettings{'BLUE_NETADDRESS'}) && ($temp[1] ne $netsettings{'BLUE_NETMASK'})
2998                                         )
2999                                 {
3000                                         chomp $temp[1];
3001                                         my $tempmask = &Network::convert_prefix2netmask($temp[1]);
3002                                         print FILE " ||\n     (isInNet(myIpAddress(), \"$temp[0]\", \"$tempmask\"))";
3003                                 }
3004                         }
3005
3006                         print FILE "\n";
3007
3008                         print FILE <<END
3009    )
3010      return "PROXY $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
3011 END
3012 ;
3013                 }
3014                 if (($proxysettings{'ENABLE'} eq 'on') && ($proxysettings{'ENABLE_BLUE'} eq 'on') && ($netsettings{'BLUE_DEV'}))
3015                 {
3016                         print FILE "\n else\n\n";
3017                 }
3018                 if (($netsettings{'BLUE_DEV'}) && ($proxysettings{'ENABLE_BLUE'} eq 'on'))
3019                 {
3020                         print FILE <<END
3021 if (
3022      (isInNet(myIpAddress(), "$netsettings{'BLUE_NETADDRESS'}", "$netsettings{'BLUE_NETMASK'}"))
3023    )
3024      return "PROXY $netsettings{'BLUE_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
3025 END
3026 ;
3027                 }
3028         }
3029         print FILE "}\n";
3030         close(FILE);
3031 }
3032
3033 # -------------------------------------------------------------------
3034
3035 sub writeconfig
3036 {
3037         my $authrealm;
3038         my $delaypools;
3039
3040         if ($proxysettings{'THROTTLING_GREEN_TOTAL'} +
3041             $proxysettings{'THROTTLING_GREEN_HOST'}  +
3042             $proxysettings{'THROTTLING_BLUE_TOTAL'}  +
3043             $proxysettings{'THROTTLING_BLUE_HOST'} gt 0)
3044         {
3045                 $delaypools = 1; } else { $delaypools = 0;
3046         }
3047
3048         if ($proxysettings{'AUTH_REALM'} eq '')
3049         {
3050                 $authrealm = "IPFire Advanced Proxy Server";
3051         } else {
3052                 $authrealm = $proxysettings{'AUTH_REALM'};
3053         }
3054
3055         $_ = $proxysettings{'UPSTREAM_PROXY'};
3056         my ($remotehost, $remoteport) = split(/:/,$_);
3057
3058         if ($remoteport eq '') { $remoteport = 80; }
3059
3060         open(FILE, ">${General::swroot}/proxy/squid.conf");
3061         flock(FILE, 2);
3062         print FILE <<END
3063 # Do not modify '${General::swroot}/proxy/squid.conf' directly since any changes
3064 # you make will be overwritten whenever you resave proxy settings using the
3065 # web interface!
3066 #
3067 # Instead, modify the file '$acl_include' and
3068 # then restart the proxy service using the web interface. Changes made to the
3069 # 'include.acl' file will propagate to the 'squid.conf' file at that time.
3070
3071 shutdown_lifetime 5 seconds
3072 icp_port 0
3073
3074 END
3075         ;
3076
3077         # Include file with user defined settings.
3078         if (-e "/etc/squid/squid.conf.pre.local") {
3079                 print FILE "include /etc/squid/squid.conf.pre.local\n\n";
3080         }
3081
3082         if (&Header::green_used()) {
3083                 print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
3084         } else {
3085                 print FILE "http_port 0.0.0.0:$proxysettings{'PROXY_PORT'}";
3086         }
3087         if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
3088         print FILE "\n";
3089
3090         if (&Header::green_used() && $proxysettings{'TRANSPARENT'} eq 'on') {
3091                 print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
3092                 if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
3093                 print FILE "\n";
3094         }
3095
3096         if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
3097                 print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
3098                 if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
3099                 print FILE "\n";
3100
3101                 if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') {
3102                         print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
3103                         if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
3104                         print FILE "\n";
3105                 }
3106         }
3107
3108         if (($proxysettings{'CACHE_SIZE'} > 0) || ($proxysettings{'CACHE_MEM'} > 0))
3109         {
3110                 print FILE "\n";
3111
3112                 if (!-z $acl_dst_nocache_dom) {
3113                         print FILE "acl no_cache_domains dstdomain \"$acl_dst_nocache_dom\"\n";
3114                         print FILE "cache deny no_cache_domains\n";
3115                 }
3116                 if (!-z $acl_dst_nocache_net) {
3117                         print FILE "acl no_cache_ipaddr dst \"$acl_dst_nocache_net\"\n";
3118                         print FILE "cache deny no_cache_ipaddr\n";
3119                 }
3120                 if (!-z $acl_dst_nocache_url) {
3121                         print FILE "acl no_cache_hosts url_regex -i \"$acl_dst_nocache_url\"\n";
3122                         print FILE "cache deny no_cache_hosts\n";
3123                 }
3124         }
3125
3126         print FILE <<END
3127
3128 cache_effective_user squid
3129 umask 022
3130
3131 pid_filename /var/run/squid.pid
3132
3133 cache_mem $proxysettings{'CACHE_MEM'} MB
3134 END
3135         ;
3136         print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
3137
3138         if ($proxysettings{'OFFLINE_MODE'} eq 'on') {  print FILE "offline_mode on\n\n"; }
3139         if ($proxysettings{'CACHE_DIGESTS'} eq 'on') {  print FILE "digest_generation on\n\n"; } else {  print FILE "digest_generation off\n\n"; }
3140
3141         if ((!($proxysettings{'MEM_POLICY'} eq 'LRU')) || (!($proxysettings{'CACHE_POLICY'} eq 'LRU')))
3142         {
3143                 if (!($proxysettings{'MEM_POLICY'} eq 'LRU'))
3144                 {
3145                         print FILE "memory_replacement_policy $proxysettings{'MEM_POLICY'}\n";
3146                 }
3147                 if (!($proxysettings{'CACHE_POLICY'} eq 'LRU'))
3148                 {
3149                         print FILE "cache_replacement_policy $proxysettings{'CACHE_POLICY'}\n";
3150                 }
3151                 print FILE "\n";
3152         }
3153
3154         open (PORTS,"$acl_ports_ssl");
3155         my @ssl_ports = <PORTS>;
3156         close PORTS;
3157
3158         if (@ssl_ports) {
3159                 foreach (@ssl_ports) {
3160                         print FILE "acl SSL_ports port $_";
3161                 }
3162         }
3163
3164         open (PORTS,"$acl_ports_safe");
3165         my @safe_ports = <PORTS>;
3166         close PORTS;
3167
3168         if (@safe_ports) {
3169                 foreach (@safe_ports) {
3170                         print FILE "acl Safe_ports port $_";
3171                 }
3172         }
3173
3174         print FILE <<END;
3175 acl IPFire_ips dst 127.0.0.1
3176 acl IPFire_http  port $http_port
3177 acl IPFire_https port $https_port
3178 acl IPFire_networks         src "$acl_src_subnets"
3179 acl IPFire_servers          dst "$acl_src_subnets"
3180 END
3181         if (&Header::green_used()) {
3182                 print FILE <<END;
3183 acl IPFire_ips              dst $netsettings{'GREEN_ADDRESS'}
3184 acl IPFire_green_network    src $green_cidr
3185 acl IPFire_green_servers    dst $green_cidr
3186 END
3187         }
3188         if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_network     src $blue_cidr\n"; }
3189         if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_servers     dst $blue_cidr\n"; }
3190         if (!-z $acl_src_banned_ip) { print FILE "acl IPFire_banned_ips       src \"$acl_src_banned_ip\"\n"; }
3191         if (!-z $acl_src_banned_mac) { print FILE "acl IPFire_banned_mac       arp \"$acl_src_banned_mac\"\n"; }
3192         if (!-z $acl_src_unrestricted_ip) { print FILE "acl IPFire_unrestricted_ips src \"$acl_src_unrestricted_ip\"\n"; }
3193         if (!-z $acl_src_unrestricted_mac) { print FILE "acl IPFire_unrestricted_mac arp \"$acl_src_unrestricted_mac\"\n"; }
3194         print FILE <<END
3195 acl CONNECT method CONNECT
3196 END
3197         ;
3198
3199         if ($proxysettings{'CACHE_SIZE'} > 0) {
3200                 print FILE <<END
3201 maximum_object_size $proxysettings{'MAX_SIZE'} KB
3202 minimum_object_size $proxysettings{'MIN_SIZE'} KB
3203
3204 cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256
3205 END
3206                 ;
3207         } else {
3208                 if ($proxysettings{'CACHE_MEM'} > 0) {
3209                         # always 2% of CACHE_MEM defined as max object size
3210                         print FILE "maximum_object_size_in_memory " . int($proxysettings{'CACHE_MEM'} * 1024 * 0.02) . " KB\n\n";
3211                 } else {
3212                         print FILE "cache deny all\n\n";
3213             }
3214         }
3215
3216         print FILE <<END
3217 request_body_max_size $proxysettings{'MAX_OUTGOING_SIZE'} KB
3218 END
3219         ;
3220
3221         if ($proxysettings{'MAX_INCOMING_SIZE'} > 0) {
3222                 if (!-z $acl_src_unrestricted_ip) { print FILE "reply_body_max_size none IPFire_unrestricted_ips\n"; }
3223                 if (!-z $acl_src_unrestricted_mac) { print FILE "reply_body_max_size none IPFire_unrestricted_mac\n"; }
3224                 if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3225                 {
3226                         if (!-z $extgrp) { print FILE "reply_body_max_size none for_extended_users\n"; }
3227                 }
3228         }
3229
3230         if ( $proxysettings{'MAX_INCOMING_SIZE'} != '0' )
3231         {
3232                 print FILE "reply_body_max_size $proxysettings{'MAX_INCOMING_SIZE'} KB all\n\n";
3233         }
3234
3235         if ($proxysettings{'LOGGING'} eq 'on')
3236         {
3237                 print FILE <<END
3238 access_log stdio:/var/log/squid/access.log
3239 cache_log /var/log/squid/cache.log
3240 cache_store_log none
3241 END
3242         ;
3243                 if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "access_log stdio:\/var\/log\/squid\/user_agent.log useragent\n"; }
3244                 if ($proxysettings{'LOGQUERY'} eq 'on') { print FILE "\nstrip_query_terms off\n"; }
3245         } else {
3246                 print FILE <<END
3247 access_log /dev/null
3248 cache_log /dev/null
3249 cache_store_log none
3250 END
3251         ;}
3252         print FILE <<END
3253
3254 log_mime_hdrs off
3255 END
3256         ;
3257
3258         if ($proxysettings{'FORWARD_IPADDRESS'} eq 'on')
3259         {
3260                 print FILE "forwarded_for on\n";
3261         } else {
3262                 print FILE "forwarded_for off\n";
3263         }
3264         if ($proxysettings{'FORWARD_VIA'} eq 'on')
3265         {
3266                 print FILE "via on\n";
3267         } else {
3268                 print FILE "via off\n";
3269         }
3270         print FILE "\n";
3271
3272         if ((!($proxysettings{'AUTH_METHOD'} eq 'none')) && (!($proxysettings{'AUTH_METHOD'} eq 'ident')))
3273         {
3274                 if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3275                 {
3276                         print FILE "auth_param basic program $authdir/basic_ncsa_auth $userdb\n";
3277                         print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
3278                         print FILE "auth_param basic realm $authrealm\n";
3279                         print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
3280                         if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
3281                 }
3282
3283                 if ($proxysettings{'AUTH_METHOD'} eq 'ldap')
3284                 {
3285                         print FILE "auth_param basic utf8 on\n";
3286                         print FILE "auth_param basic program $authdir/basic_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
3287                         if (!($proxysettings{'LDAP_BINDDN_USER'} eq '')) { print FILE " -D \"$proxysettings{'LDAP_BINDDN_USER'}\""; }
3288                         if (!($proxysettings{'LDAP_BINDDN_PASS'} eq '')) { print FILE " -w $proxysettings{'LDAP_BINDDN_PASS'}"; }
3289                         if ($proxysettings{'LDAP_TYPE'} eq 'ADS')
3290                         {
3291                                 if ($proxysettings{'LDAP_GROUP'} eq '')
3292                                 {
3293                                         print FILE " -f \"(\&(objectClass=person)(sAMAccountName=\%s))\"";
3294                                 } else {
3295                                         print FILE " -f \"(\&(\&(objectClass=person)(sAMAccountName=\%s))(memberOf=$proxysettings{'LDAP_GROUP'}))\"";
3296                                 }
3297                                 print FILE " -u sAMAccountName -P";
3298                         }
3299                         if ($proxysettings{'LDAP_TYPE'} eq 'NDS')
3300                         {
3301                                 if ($proxysettings{'LDAP_GROUP'} eq '')
3302                                 {
3303                                         print FILE " -f \"(\&(objectClass=person)(cn=\%s))\"";
3304                                 } else {
3305                                         print FILE " -f \"(\&(\&(objectClass=person)(cn=\%s))(groupMembership=$proxysettings{'LDAP_GROUP'}))\"";
3306                                 }
3307                                 print FILE " -u cn -P";
3308                         }
3309                         if (($proxysettings{'LDAP_TYPE'} eq 'V2') || ($proxysettings{'LDAP_TYPE'} eq 'V3'))
3310                         {
3311                                 if ($proxysettings{'LDAP_GROUP'} eq '')
3312                                 {
3313                                         print FILE " -f \"(\&(objectClass=person)(uid=\%s))\"";
3314                                 } else {
3315                                         print FILE " -f \"(\&(\&(objectClass=person)(uid=\%s))(memberOf=$proxysettings{'LDAP_GROUP'}))\"";
3316                                 }
3317                                 if ($proxysettings{'LDAP_TYPE'} eq 'V2') { print FILE " -v 2"; }
3318                                 if ($proxysettings{'LDAP_TYPE'} eq 'V3') { print FILE " -v 3"; }
3319                                 print FILE " -u uid -P";
3320                         }
3321                         print FILE " $proxysettings{'LDAP_SERVER'}:$proxysettings{'LDAP_PORT'}\n";
3322                         print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
3323                         print FILE "auth_param basic realm $authrealm\n";
3324                         print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
3325                         if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
3326                 }
3327
3328                 if ($proxysettings{'AUTH_METHOD'} eq 'ntlm-auth')
3329                 {
3330                         print FILE "auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp";
3331                         if ($proxysettings{'NTLM_AUTH_GROUP'}) {
3332                                 my $ntlm_auth_group = $proxysettings{'NTLM_AUTH_GROUP'};
3333                                 $ntlm_auth_group =~ s/\\/\+/;
3334
3335                                 print FILE " --require-membership-of=$ntlm_auth_group";
3336                         }
3337                         print FILE "\n";
3338
3339                         print FILE "auth_param ntlm children $proxysettings{'AUTH_CHILDREN'}\n\n";
3340                         print FILE "auth_param ntlm credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n\n";
3341
3342                         # BASIC authentication
3343                         if ($proxysettings{'NTLM_AUTH_BASIC'} eq "on") {
3344                                 print FILE "auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic";
3345                                 if ($proxysettings{'NTLM_AUTH_GROUP'}) {
3346                                         my $ntlm_auth_group = $proxysettings{'NTLM_AUTH_GROUP'};
3347                                         $ntlm_auth_group =~ s/\\/\+/;
3348
3349                                         print FILE " --require-membership-of=$ntlm_auth_group";
3350                                 }
3351                                 print FILE "\n";
3352                                 print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
3353                                 print FILE "auth_param basic realm $authrealm\n";
3354                                 print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n\n";
3355                         }
3356                 }
3357
3358                 if ($proxysettings{'AUTH_METHOD'} eq 'radius')
3359                 {
3360                         print FILE "auth_param basic program $authdir/basic_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
3361                         if (!($proxysettings{'RADIUS_IDENTIFIER'} eq '')) { print FILE "-i $proxysettings{'RADIUS_IDENTIFIER'} "; }
3362                         print FILE "-w $proxysettings{'RADIUS_SECRET'}\n";
3363                         print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
3364                         print FILE "auth_param basic realm $authrealm\n";
3365                         print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
3366                         if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
3367                 }
3368
3369                 print FILE "\n";
3370                 print FILE "acl for_inetusers proxy_auth REQUIRED\n";
3371                 if (($proxysettings{'AUTH_METHOD'} eq 'radius') && ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on'))
3372                 {
3373                         if ((!-z "$raddir/radauth.allowusers") && ($proxysettings{'RADIUS_USER_ACL'} eq 'positive'))
3374                         {
3375                                 print FILE "acl for_acl_users proxy_auth \"$raddir/radauth.allowusers\"\n";
3376                         }
3377                         if ((!-z "$raddir/radauth.denyusers") && ($proxysettings{'RADIUS_USER_ACL'} eq 'negative'))
3378                         {
3379                                 print FILE "acl for_acl_users proxy_auth \"$raddir/radauth.denyusers\"\n";
3380                         }
3381                 }
3382                 if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3383                 {
3384                         print FILE "\n";
3385                         if (!-z $extgrp) { print FILE "acl for_extended_users proxy_auth \"$extgrp\"\n"; }
3386                         if (!-z $disgrp) { print FILE "acl for_disabled_users proxy_auth \"$disgrp\"\n"; }
3387                 }
3388                 if (!($proxysettings{'AUTH_MAX_USERIP'} eq '')) { print FILE "\nacl concurrent max_user_ip -s $proxysettings{'AUTH_MAX_USERIP'}\n"; }
3389                 print FILE "\n";
3390
3391                 if (!-z $acl_dst_noauth_net) { print FILE "acl to_ipaddr_without_auth dst \"$acl_dst_noauth_net\"\n"; }
3392                 if (!-z $acl_dst_noauth_dom) { print FILE "acl to_domains_without_auth dstdomain \"$acl_dst_noauth_dom\"\n"; }
3393                 if (!-z $acl_dst_noauth_url) { print FILE "acl to_hosts_without_auth url_regex -i \"$acl_dst_noauth_url\"\n"; }
3394                 print FILE "\n";
3395
3396         }
3397
3398         if ($proxysettings{'AUTH_METHOD'} eq 'ident')
3399         {
3400                 if ($proxysettings{'IDENT_REQUIRED'} eq 'on')
3401                 {
3402                         print FILE "acl for_inetusers ident REQUIRED\n";
3403                 }
3404                 if ($proxysettings{'IDENT_ENABLE_ACL'} eq 'on')
3405                 {
3406                         if ((!-z "$identdir/identauth.allowusers") && ($proxysettings{'IDENT_USER_ACL'} eq 'positive'))
3407                         {
3408                                 print FILE "acl for_acl_users ident_regex -i \"$identdir/identauth.allowusers\"\n\n";
3409                         }
3410                         if ((!-z "$identdir/identauth.denyusers") && ($proxysettings{'IDENT_USER_ACL'} eq 'negative'))
3411                         {
3412                                 print FILE "acl for_acl_users ident_regex -i \"$identdir/identauth.denyusers\"\n\n";
3413                         }
3414                 }
3415                 if (!-z $acl_dst_noauth_net) { print FILE "acl to_ipaddr_without_auth dst \"$acl_dst_noauth_net\"\n"; }
3416                 if (!-z $acl_dst_noauth_dom) { print FILE "acl to_domains_without_auth dstdomain \"$acl_dst_noauth_dom\"\n"; }
3417                 if (!-z $acl_dst_noauth_url) { print FILE "acl to_hosts_without_auth url_regex -i \"$acl_dst_noauth_url\"\n"; }
3418                 print FILE "\n";
3419         }
3420
3421         if (($delaypools) && (!-z $acl_dst_throttle)) { print FILE "acl for_throttled_urls url_regex -i \"$acl_dst_throttle\"\n\n"; }
3422
3423         print FILE "acl within_timeframe time ";
3424         if ($proxysettings{'TIME_MON'} eq 'on') { print FILE "M"; }
3425         if ($proxysettings{'TIME_TUE'} eq 'on') { print FILE "T"; }
3426         if ($proxysettings{'TIME_WED'} eq 'on') { print FILE "W"; }
3427         if ($proxysettings{'TIME_THU'} eq 'on') { print FILE "H"; }
3428         if ($proxysettings{'TIME_FRI'} eq 'on') { print FILE "F"; }
3429         if ($proxysettings{'TIME_SAT'} eq 'on') { print FILE "A"; }
3430         if ($proxysettings{'TIME_SUN'} eq 'on') { print FILE "S"; }
3431         print FILE " $proxysettings{'TIME_FROM_HOUR'}:";
3432         print FILE "$proxysettings{'TIME_FROM_MINUTE'}-";
3433         print FILE "$proxysettings{'TIME_TO_HOUR'}:";
3434         print FILE "$proxysettings{'TIME_TO_MINUTE'}\n\n";
3435
3436         if ((!-z $mimetypes) && ($proxysettings{'ENABLE_MIME_FILTER'} eq 'on')) {
3437                 print FILE "acl blocked_mimetypes rep_mime_type \"$mimetypes\"\n\n";
3438         }
3439
3440         if ($proxysettings{'CLASSROOM_EXT'} eq 'on') {
3441                 print FILE <<END
3442
3443 #Classroom extensions
3444 acl IPFire_no_access_ips src "$acl_src_noaccess_ip"
3445 acl IPFire_no_access_mac arp "$acl_src_noaccess_mac"
3446 END
3447                 ;
3448                 print FILE "deny_info ";
3449                 if (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED"))
3450                 {
3451                         print FILE "ERR_ACCESS_DISABLED";
3452                 } else {
3453                         print FILE "ERR_ACCESS_DENIED";
3454                 }
3455                 print FILE " IPFire_no_access_ips\n";
3456                 print FILE "deny_info ";
3457                 if (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED"))
3458                 {
3459                         print FILE "ERR_ACCESS_DISABLED";
3460                 } else {
3461                         print FILE "ERR_ACCESS_DENIED";
3462                 }
3463                 print FILE " IPFire_no_access_mac\n";
3464
3465                 print FILE <<END
3466 http_access deny IPFire_no_access_ips
3467 http_access deny IPFire_no_access_mac
3468 END
3469         ;
3470         }
3471
3472         #Insert acl file and replace __VAR__ with correct values
3473         my $blue_net = ''; #BLUE empty by default
3474         my $blue_ip = '';
3475         if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
3476                 $blue_net = "$blue_cidr";
3477                 $blue_ip  = "$netsettings{'BLUE_ADDRESS'}";
3478         }
3479         if (!-z $acl_include)
3480         {
3481                 open (ACL, "$acl_include");
3482                 print FILE "\n#Start of custom includes\n\n";
3483                 while (<ACL>) {
3484                         $_ =~ s/__GREEN_IP__/$netsettings{'GREEN_ADDRESS'}/;
3485                         $_ =~ s/__GREEN_NET__/$green_cidr/;
3486                         $_ =~ s/__BLUE_IP__/$blue_ip/;
3487                         $_ =~ s/__BLUE_NET__/$blue_net/;
3488                         $_ =~ s/__PROXY_PORT__/$proxysettings{'PROXY_PORT'}/;
3489                         print FILE $_;
3490                 }
3491                 print FILE "\n#End of custom includes\n";
3492                 close (ACL);
3493         }
3494         if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
3495
3496         # Check if squidclamav is enabled.
3497         if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
3498                 print FILE "\n#Settings for squidclamav:\n";
3499                 print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'}\n";
3500                 print FILE "acl purge method PURGE\n";
3501                 print FILE "http_access deny to_localhost\n";
3502                 print FILE "http_access allow localhost\n";
3503                 print FILE "http_access allow purge localhost\n";
3504                 print FILE "http_access deny purge\n";
3505                 print FILE "url_rewrite_access deny localhost\n";
3506         }
3507         print FILE <<END;
3508
3509 #Access to squid:
3510 #local machine, no restriction
3511 http_access allow         localhost
3512
3513 #GUI admin if local machine connects
3514 http_access allow         IPFire_ips IPFire_networks IPFire_http
3515 http_access allow CONNECT IPFire_ips IPFire_networks IPFire_https
3516
3517 #Deny not web services
3518 END
3519
3520 if (@safe_ports) {
3521         print FILE "http_access deny          !Safe_ports\n";
3522 }
3523
3524 if (@ssl_ports) {
3525         print FILE "http_access deny  CONNECT !SSL_ports\n";
3526 }
3527
3528 if ($proxysettings{'AUTH_METHOD'} eq 'ident')
3529 {
3530 print FILE "#Set ident ACLs\n";
3531 if (!-z $identhosts)
3532         {
3533                 print FILE "acl on_ident_aware_hosts src \"$identhosts\"\n";
3534                 print FILE "ident_lookup_access allow on_ident_aware_hosts\n";
3535                 print FILE "ident_lookup_access deny all\n";
3536         } else {
3537                 print FILE "ident_lookup_access allow all\n";
3538         }
3539         print FILE "ident_timeout $proxysettings{'IDENT_TIMEOUT'} seconds\n\n";
3540 }
3541
3542 if ($delaypools) {
3543         print FILE "#Set download throttling\n";
3544
3545         if ($netsettings{'BLUE_DEV'})
3546         {
3547                 print FILE "delay_pools 2\n";
3548         } else {
3549                 print FILE "delay_pools 1\n";
3550         }
3551
3552         print FILE "delay_class 1 3\n";
3553         if ($netsettings{'BLUE_DEV'}) { print FILE "delay_class 2 3\n"; }
3554
3555         print FILE "delay_parameters 1 ";
3556         if ($proxysettings{'THROTTLING_GREEN_TOTAL'} eq 'unlimited')
3557         {
3558                 print FILE "-1/-1";
3559         } else {
3560                 print FILE $proxysettings{'THROTTLING_GREEN_TOTAL'} * 125;
3561                 print FILE "/";
3562                 print FILE $proxysettings{'THROTTLING_GREEN_TOTAL'} * 250;
3563         }
3564
3565         print FILE " -1/-1 ";
3566         if ($proxysettings{'THROTTLING_GREEN_HOST'} eq 'unlimited')
3567         {
3568                 print FILE "-1/-1";
3569         } else {
3570                 print FILE $proxysettings{'THROTTLING_GREEN_HOST'} * 125;
3571                 print FILE "/";
3572                 print FILE $proxysettings{'THROTTLING_GREEN_HOST'} * 250;
3573         }
3574         print FILE "\n";
3575
3576         if ($netsettings{'BLUE_DEV'})
3577         {
3578                 print FILE "delay_parameters 2 ";
3579                 if ($proxysettings{'THROTTLING_BLUE_TOTAL'} eq 'unlimited')
3580                 {
3581                         print FILE "-1/-1";
3582                 } else {
3583                         print FILE $proxysettings{'THROTTLING_BLUE_TOTAL'} * 125;
3584                         print FILE "/";
3585                         print FILE $proxysettings{'THROTTLING_BLUE_TOTAL'} * 250;
3586                 }
3587                 print FILE " -1/-1 ";
3588                 if ($proxysettings{'THROTTLING_BLUE_HOST'} eq 'unlimited')
3589                 {
3590                         print FILE "-1/-1";
3591                 } else {
3592                         print FILE $proxysettings{'THROTTLING_BLUE_HOST'} * 125;
3593                         print FILE "/";
3594                         print FILE $proxysettings{'THROTTLING_BLUE_HOST'} * 250;
3595                 }
3596                 print FILE "\n";
3597         }
3598
3599         print FILE "delay_access 1 deny  IPFire_ips\n";
3600         if (!-z $acl_src_unrestricted_ip)  { print FILE "delay_access 1 deny  IPFire_unrestricted_ips\n"; }
3601         if (!-z $acl_src_unrestricted_mac) { print FILE "delay_access 1 deny  IPFire_unrestricted_mac\n"; }
3602         if (($proxysettings{'AUTH_METHOD'} eq 'ncsa') && (!-z $extgrp)) { print FILE "delay_access 1 deny  for_extended_users\n"; }
3603
3604         if ($netsettings{'BLUE_DEV'})
3605         {
3606                 if (&Header::green_used()) {
3607                         print FILE "delay_access 1 allow IPFire_green_network";
3608                         if (!-z $acl_dst_throttle) { print FILE " for_throttled_urls"; }
3609                         print FILE "\n";
3610                 }
3611                 print FILE "delay_access 1 deny  all\n";
3612         } else {
3613                 print FILE "delay_access 1 allow all";
3614                 if (!-z $acl_dst_throttle) { print FILE " for_throttled_urls"; }
3615                 print FILE "\n";
3616         }
3617
3618         if ($netsettings{'BLUE_DEV'})
3619         {
3620                 print FILE "delay_access 2 deny  IPFire_ips\n";
3621                 if (!-z $acl_src_unrestricted_ip)  { print FILE "delay_access 2 deny  IPFire_unrestricted_ips\n"; }
3622                 if (!-z $acl_src_unrestricted_mac) { print FILE "delay_access 2 deny  IPFire_unrestricted_mac\n"; }
3623                 if (($proxysettings{'AUTH_METHOD'} eq 'ncsa') && (!-z $extgrp)) { print FILE "delay_access 2 deny  for_extended_users\n"; }
3624                 print FILE "delay_access 2 allow IPFire_blue_network";
3625                 if (!-z $acl_dst_throttle) { print FILE " for_throttled_urls"; }
3626                 print FILE "\n";
3627                 print FILE "delay_access 2 deny  all\n";
3628         }
3629
3630         print FILE "delay_initial_bucket_level 100\n";
3631         print FILE "\n";
3632 }
3633
3634 if (&Header::green_used() && $proxysettings{'NO_PROXY_LOCAL'} eq 'on')
3635 {
3636         print FILE "#Prevent internal proxy access to Green except IPFire itself\n";
3637         print FILE "http_access deny IPFire_green_servers !IPFire_ips !IPFire_green_network\n\n";
3638 }
3639
3640 if ($proxysettings{'NO_PROXY_LOCAL_BLUE'} eq 'on')
3641 {
3642         print FILE "#Prevent internal proxy access from Blue except IPFire itself\n";
3643         print FILE "http_access allow IPFire_blue_network IPFire_blue_servers\n";
3644         print FILE "http_access deny  IPFire_blue_network !IPFire_ips IPFire_servers\n\n";
3645 }
3646
3647         print FILE <<END
3648 #Set custom configured ACLs
3649 END
3650         ;
3651         if (!-z $acl_src_banned_ip) { print FILE "http_access deny  IPFire_banned_ips\n"; }
3652         if (!-z $acl_src_banned_mac) { print FILE "http_access deny  IPFire_banned_mac\n"; }
3653
3654         if ((!-z $acl_dst_noauth) && (!($proxysettings{'AUTH_METHOD'} eq 'none')))
3655         {
3656                 if (!-z $acl_src_unrestricted_ip)
3657                 {
3658                         if (!-z $acl_dst_noauth_net) { print FILE "http_access allow IPFire_unrestricted_ips to_ipaddr_without_auth\n"; }
3659                         if (!-z $acl_dst_noauth_dom) { print FILE "http_access allow IPFire_unrestricted_ips to_domains_without_auth\n"; }
3660                         if (!-z $acl_dst_noauth_url) { print FILE "http_access allow IPFire_unrestricted_ips to_hosts_without_auth\n"; }
3661                 }
3662                 if (!-z $acl_src_unrestricted_mac)
3663                 {
3664                         if (!-z $acl_dst_noauth_net) { print FILE "http_access allow IPFire_unrestricted_mac to_ipaddr_without_auth\n"; }
3665                         if (!-z $acl_dst_noauth_dom) { print FILE "http_access allow IPFire_unrestricted_mac to_domains_without_auth\n"; }
3666                         if (!-z $acl_dst_noauth_url) { print FILE "http_access allow IPFire_unrestricted_mac to_hosts_without_auth\n"; }
3667                 }
3668                 if (!-z $acl_dst_noauth_net)
3669                 {
3670                         print FILE "http_access allow IPFire_networks";
3671                         if ($proxysettings{'TIME_ACCESS_MODE'} eq 'deny') {
3672                                 print FILE " !within_timeframe";
3673                         } else {
3674                                 print FILE " within_timeframe"; }
3675                         print FILE " to_ipaddr_without_auth\n";
3676                 }
3677                 if (!-z $acl_dst_noauth_dom)
3678                 {
3679                         print FILE "http_access allow IPFire_networks";
3680                         if ($proxysettings{'TIME_ACCESS_MODE'} eq 'deny') {
3681                                 print FILE " !within_timeframe";
3682                         } else {
3683                                 print FILE " within_timeframe"; }
3684                         print FILE " to_domains_without_auth\n";
3685                 }
3686                 if (!-z $acl_dst_noauth_url)
3687                 {
3688                         print FILE "http_access allow IPFire_networks";
3689                         if ($proxysettings{'TIME_ACCESS_MODE'} eq 'deny') {
3690                                 print FILE " !within_timeframe";
3691                         } else {
3692                                 print FILE " within_timeframe"; }
3693                         print FILE " to_hosts_without_auth\n";
3694                 }
3695         }
3696
3697         if (($proxysettings{'AUTH_METHOD'} eq 'ident') && ($proxysettings{'IDENT_REQUIRED'} eq 'on') && ($proxysettings{'AUTH_ALWAYS_REQUIRED'} eq 'on'))
3698         {
3699                 print FILE "http_access deny  !for_inetusers";
3700                 if (!-z $identhosts) { print FILE " on_ident_aware_hosts"; }
3701                 print FILE "\n";
3702         }
3703
3704         if (
3705              ($proxysettings{'AUTH_METHOD'} eq 'ident') &&
3706              ($proxysettings{'AUTH_ALWAYS_REQUIRED'} eq 'on') &&
3707              ($proxysettings{'IDENT_ENABLE_ACL'} eq 'on') &&
3708              ($proxysettings{'IDENT_USER_ACL'} eq 'negative') &&
3709              (!-z "$identdir/identauth.denyusers")
3710            )
3711         {
3712                 print FILE "http_access deny  for_acl_users";
3713                 if (($proxysettings{'AUTH_METHOD'} eq 'ident') && (!-z "$identdir/hosts")) { print FILE " on_ident_aware_hosts"; }
3714                 print FILE "\n";
3715         }
3716
3717         if (!-z $acl_src_unrestricted_ip)
3718         {
3719                 print FILE "http_access allow IPFire_unrestricted_ips";
3720                 if ($proxysettings{'AUTH_ALWAYS_REQUIRED'} eq 'on')
3721                 {
3722                         if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3723                         {
3724                                 if (!-z $disgrp) { print FILE " !for_disabled_users"; } else { print FILE " for_inetusers"; }
3725                         }
3726                         if (($proxysettings{'AUTH_METHOD'} eq 'ldap') || ($proxysettings{'AUTH_METHOD'} eq 'radius'))
3727                         {
3728                                 print FILE " for_inetusers";
3729                         }
3730                         if (($proxysettings{'AUTH_METHOD'} eq 'radius') && ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on'))
3731                         {
3732                                 if ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on')
3733                                 {
3734                                         if (($proxysettings{'RADIUS_USER_ACL'} eq 'positive') && (!-z "$raddir/radauth.allowusers"))
3735                                         {
3736                                                 print FILE " for_acl_users";
3737                                         }
3738                                         if (($proxysettings{'RADIUS_USER_ACL'} eq 'negative') && (!-z "$raddir/radauth.denyusers"))
3739                                         {
3740                                                 print FILE " !for_acl_users";
3741                                         }
3742                                 } else { print FILE " for_inetusers"; }
3743                         }
3744                 }
3745                 print FILE "\n";
3746         }
3747
3748         if (!-z $acl_src_unrestricted_mac)
3749         {
3750                 print FILE "http_access allow IPFire_unrestricted_mac";
3751                 if ($proxysettings{'AUTH_ALWAYS_REQUIRED'} eq 'on')
3752                 {
3753                         if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3754                         {
3755                                 if (!-z $disgrp) { print FILE " !for_disabled_users"; } else { print FILE " for_inetusers"; }
3756                         }
3757                         if (($proxysettings{'AUTH_METHOD'} eq 'ldap') || ($proxysettings{'AUTH_METHOD'} eq 'radius'))
3758                         {
3759                                 print FILE " for_inetusers";
3760                         }
3761                         if (($proxysettings{'AUTH_METHOD'} eq 'radius') && ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on'))
3762                         {
3763                                 if ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on')
3764                                 {
3765                                         if (($proxysettings{'RADIUS_USER_ACL'} eq 'positive') && (!-z "$raddir/radauth.allowusers"))
3766                                         {
3767                                                 print FILE " for_acl_users";
3768                                         }
3769                                         if (($proxysettings{'RADIUS_USER_ACL'} eq 'negative') && (!-z "$raddir/radauth.denyusers"))
3770                                         {
3771                                                 print FILE " !for_acl_users";
3772                                         }
3773                                 } else { print FILE " for_inetusers"; }
3774                         }
3775                 }
3776                 print FILE "\n";
3777         }
3778
3779         if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3780         {
3781                 if (!-z $disgrp) { print FILE "http_access deny  for_disabled_users\n"; }
3782                 if (!-z $extgrp) { print FILE "http_access allow IPFire_networks for_extended_users\n"; }
3783         }
3784
3785         if (
3786             (
3787              ($proxysettings{'AUTH_METHOD'} eq 'radius') &&
3788              ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on') &&
3789              ($proxysettings{'RADIUS_USER_ACL'} eq 'negative') &&
3790              (!-z "$raddir/radauth.denyusers")
3791             )
3792                 ||
3793             (
3794              ($proxysettings{'AUTH_METHOD'} eq 'ident') &&
3795              ($proxysettings{'AUTH_ALWAYS_REQUIRED'} eq 'off') &&
3796              ($proxysettings{'IDENT_ENABLE_ACL'} eq 'on') &&
3797              ($proxysettings{'IDENT_USER_ACL'} eq 'negative') &&
3798              (!-z "$identdir/identauth.denyusers")
3799             )
3800            )
3801         {
3802                 print FILE "http_access deny  for_acl_users";
3803                 if (($proxysettings{'AUTH_METHOD'} eq 'ident') && (!-z "$identdir/hosts")) { print FILE " on_ident_aware_hosts"; }
3804                 print FILE "\n";
3805         }
3806
3807         if (($proxysettings{'AUTH_METHOD'} eq 'ident') && ($proxysettings{'IDENT_REQUIRED'} eq 'on') && (!-z "$identhosts"))
3808         {
3809                 print FILE "http_access allow";
3810                 if ($proxysettings{'TIME_ACCESS_MODE'} eq 'deny') {
3811                         print FILE " !within_timeframe";
3812                 } else {
3813                         print FILE " within_timeframe"; }
3814                 print FILE " !on_ident_aware_hosts\n";
3815         }
3816
3817         print FILE "http_access allow IPFire_networks";
3818         if (
3819             (
3820              ($proxysettings{'AUTH_METHOD'} eq 'radius') &&
3821              ($proxysettings{'RADIUS_ENABLE_ACL'} eq 'on') &&
3822              ($proxysettings{'RADIUS_USER_ACL'} eq 'positive') &&
3823              (!-z "$raddir/radauth.allowusers")
3824             )
3825                 ||
3826             (
3827              ($proxysettings{'AUTH_METHOD'} eq 'ident') &&
3828              ($proxysettings{'IDENT_REQUIRED'} eq 'on') &&
3829              ($proxysettings{'IDENT_ENABLE_ACL'} eq 'on') &&
3830              ($proxysettings{'IDENT_USER_ACL'} eq 'positive') &&
3831              (!-z "$identdir/identauth.allowusers")
3832             )
3833            )
3834         {
3835                 print FILE " for_acl_users";
3836         } elsif (((!($proxysettings{'AUTH_METHOD'} eq 'none')) && (!($proxysettings{'AUTH_METHOD'} eq 'ident'))) ||
3837                 (($proxysettings{'AUTH_METHOD'} eq 'ident') && ($proxysettings{'IDENT_REQUIRED'} eq 'on'))) {
3838                 print FILE " for_inetusers";
3839         }
3840         if ((!($proxysettings{'AUTH_MAX_USERIP'} eq '')) && (!($proxysettings{'AUTH_METHOD'} eq 'none')) && (!($proxysettings{'AUTH_METHOD'} eq 'ident')))
3841         {
3842                 print FILE " !concurrent";
3843         }
3844         if ($proxysettings{'TIME_ACCESS_MODE'} eq 'deny') {
3845                 print FILE " !within_timeframe";
3846         } else {
3847                 print FILE " within_timeframe"; }
3848         print FILE "\n";
3849
3850         print FILE "http_access deny  all\n\n";
3851
3852         if (($proxysettings{'FORWARD_IPADDRESS'} eq 'off') || ($proxysettings{'FORWARD_VIA'} eq 'off'))
3853         {
3854                 print FILE "#Strip HTTP Header\n";
3855
3856                 if ($proxysettings{'FORWARD_IPADDRESS'} eq 'off')
3857                 {
3858                         print FILE "request_header_access X-Forwarded-For deny all\n";
3859                         print FILE "reply_header_access X-Forwarded-For deny all\n";
3860                 }
3861                 if ($proxysettings{'FORWARD_VIA'} eq 'off')
3862                 {
3863                         print FILE "request_header_access Via deny all\n";
3864                         print FILE "reply_header_access Via deny all\n";
3865                 }
3866
3867                 print FILE "\n";
3868
3869         }
3870
3871         if ($proxysettings{'SUPPRESS_VERSION'} eq 'on') { print FILE "httpd_suppress_version_string on\n\n" }
3872
3873         if ((!-z $mimetypes) && ($proxysettings{'ENABLE_MIME_FILTER'} eq 'on')) {
3874                 if (!-z $acl_src_unrestricted_ip)  { print FILE "http_reply_access allow IPFire_unrestricted_ips\n"; }
3875                 if (!-z $acl_src_unrestricted_mac) { print FILE "http_reply_access allow IPFire_unrestricted_mac\n"; }
3876                 if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
3877                 {
3878                         if (!-z $extgrp) { print FILE "http_reply_access allow for_extended_users\n"; }
3879                 }
3880                 print FILE "http_reply_access deny  blocked_mimetypes\n";
3881                 print FILE "http_reply_access allow all\n\n";
3882         }
3883
3884         print FILE "visible_hostname";
3885         if ($proxysettings{'VISIBLE_HOSTNAME'} eq '')
3886         {
3887                 print FILE " $mainsettings{'HOSTNAME'}.$mainsettings{'DOMAINNAME'}\n\n";
3888         } else {
3889                 print FILE " $proxysettings{'VISIBLE_HOSTNAME'}\n\n";
3890         }
3891
3892         if (!($proxysettings{'ADMIN_MAIL_ADDRESS'} eq '')) { print FILE "cache_mgr $proxysettings{'ADMIN_MAIL_ADDRESS'}\n"; }
3893         if (!($proxysettings{'ADMIN_PASSWORD'} eq '')) { print FILE "cachemgr_passwd $proxysettings{'ADMIN_PASSWORD'} all\n"; }
3894         print FILE "\n";
3895
3896         print FILE "max_filedescriptors $proxysettings{'FILEDESCRIPTORS'}\n\n";
3897
3898         # Write the parent proxy info, if needed.
3899         if ($remotehost ne '')
3900         {
3901                 print FILE "cache_peer $remotehost parent $remoteport 3130 default no-query";
3902
3903                 # Enter authentication for the parent cache. Option format is
3904                 # login=user:password   ($proxy1='YES')
3905                 # login=PASS            ($proxy1='PASS')
3906                 # login=*:password      ($proxysettings{'FORWARD_USERNAME'} eq 'on')
3907                 if (($proxy1 eq 'YES') || ($proxy1 eq 'PASS'))
3908                 {
3909                         print FILE " login=$proxysettings{'UPSTREAM_USER'}";
3910                         if ($proxy1 eq 'YES') { print FILE ":$proxysettings{'UPSTREAM_PASSWORD'}"; }
3911                 }
3912                 elsif ($proxysettings{'FORWARD_USERNAME'} eq 'on') { print FILE " login=*:password"; }
3913
3914                 print FILE "\nalways_direct allow IPFire_ips\n";
3915                 print FILE "never_direct  allow all\n\n";
3916         }
3917         if (($proxysettings{'ENABLE_FILTER'} eq 'on') || ($proxysettings{'ENABLE_UPDXLRATOR'} eq 'on') || ($proxysettings{'ENABLE_CLAMAV'} eq 'on'))
3918         {
3919                 print FILE "url_rewrite_program /usr/sbin/redirect_wrapper\n";
3920                 print FILE "url_rewrite_children ", &General::number_cpu_cores();
3921                 print FILE " startup=", &General::number_cpu_cores();
3922                 print FILE " idle=", &General::number_cpu_cores();
3923                 print FILE " queue-size=", &General::number_cpu_cores() * 32, "\n\n";
3924         }
3925
3926         # Include file with user defined settings.
3927         if (-e "/etc/squid/squid.conf.local") {
3928                 print FILE "include /etc/squid/squid.conf.local\n";
3929         }
3930         close FILE;
3931
3932         # Proxy settings for squidclamav - if installed.
3933         #
3934         # Check if squidclamav is enabled.
3935         if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
3936
3937                 my $configfile='/etc/squidclamav.conf';
3938
3939                 my $data = &General::read_file_utf8($configfile);
3940                 $data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
3941                 &General::write_file_utf8($configfile, $data);
3942         }
3943 }
3944
3945 # -------------------------------------------------------------------
3946
3947 sub adduser
3948 {
3949         my ($str_user, $str_pass, $str_group) = @_;
3950         my @groupmembers=();
3951
3952         if ($str_pass eq 'lEaVeAlOnE')
3953         {
3954                 open(FILE, "$userdb");
3955                 @groupmembers = <FILE>;
3956                 close(FILE);
3957                 foreach $line (@groupmembers) { if ($line =~ /^$str_user:/i) { $str_pass = substr($line,index($line,":")); } }
3958                 &deluser($str_user);
3959                 open(FILE, ">>$userdb");
3960                 flock FILE,2;
3961                 print FILE "$str_user$str_pass";
3962                 close(FILE);
3963         } else {
3964                 &deluser($str_user);
3965
3966                 my %htpasswd_options = (
3967                         passwdFile => "$userdb",
3968                         UseMD5 => 1,
3969                 );
3970
3971                 my $htpasswd = new Apache::Htpasswd(\%htpasswd_options);
3972
3973                 $htpasswd->htpasswd($str_user, $str_pass);
3974         }
3975
3976         if ($str_group eq 'standard') { open(FILE, ">>$stdgrp");
3977         } elsif ($str_group eq 'extended') { open(FILE, ">>$extgrp");
3978         } elsif ($str_group eq 'disabled') { open(FILE, ">>$disgrp"); }
3979         flock FILE, 2;
3980         print FILE "$str_user\n";
3981         close(FILE);
3982
3983         return;
3984 }
3985
3986 # -------------------------------------------------------------------
3987
3988 sub deluser
3989 {
3990         my ($str_user) = @_;
3991         my $groupfile='';
3992         my @groupmembers=();
3993         my @templist=();
3994
3995         foreach $groupfile ($stdgrp, $extgrp, $disgrp)
3996         {
3997                 undef @templist;
3998                 open(FILE, "$groupfile");
3999                 @groupmembers = <FILE>;
4000                 close(FILE);
4001                 foreach $line (@groupmembers) { if (!($line =~ /^$str_user$/i)) { push(@templist, $line); } }
4002                 open(FILE, ">$groupfile");
4003                 flock FILE, 2;
4004                 print FILE @templist;
4005                 close(FILE);
4006         }
4007
4008         undef @templist;
4009         open(FILE, "$userdb");
4010         @groupmembers = <FILE>;
4011         close(FILE);
4012         foreach $line (@groupmembers) { if (!($line =~ /^$str_user:/i)) { push(@templist, $line); } }
4013         open(FILE, ">$userdb");
4014         flock FILE, 2;
4015         print FILE @templist;
4016         close(FILE);
4017
4018         return;
4019 }
4020
4021 # -------------------------------------------------------------------
4022
4023 sub writecachemgr
4024 {
4025         open(FILE, ">${General::swroot}/proxy/cachemgr.conf");
4026         flock(FILE, 2);
4027         if (&Header::green_used()) {
4028                 print FILE "$netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}\n";
4029         }
4030         print FILE "localhost";
4031         close(FILE);
4032   return;
4033 }
4034
4035 # -------------------------------------------------------------------