Merge remote-tracking branch 'stevee/proxy-squidclamav' into next

Conflicts:
	config/cfgroot/general-functions.pl

diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl
index 3cdb36fbd4709229edd93b2f39893a145a17425f..41643d8d7451c25aebda2475600b0f9c170845a4 100644 (file)
--- a/config/cfgroot/general-functions.pl
+++ b/config/cfgroot/general-functions.pl
@@ -1030,4 +1030,27 @@ sub RedIsWireless() {
        return 0;
 }
 
+# Function to read a file with UTF-8 charset.
+sub read_file_utf8 ($) {
+       my ($file) = @_;
+
+       open my $in, '<:encoding(UTF-8)', $file or die "Could not open '$file' for reading $!";
+       local $/ = undef;
+       my $all = <$in>;
+       close $in;
+
+       return $all;
+}
+
+# Function to write a file with UTF-8 charset.
+sub write_file_utf8 ($) {
+       my ($file, $content) = @_;
+
+       open my $out, '>:encoding(UTF-8)', $file or die "Could not open '$file' for writing $!";;           
+       print $out $content;
+       close $out;
+
+       return; 
+}
+
 1;

diff --git a/config/squidclamav/squidclamav.conf b/config/squidclamav/squidclamav.conf
index 19bffa0606d338fff91cecdcd106e5a7b8589879..2b8f5dc02eb95a8d2b138656b9bb32a3cc228734 100644 (file)
--- a/config/squidclamav/squidclamav.conf
+++ b/config/squidclamav/squidclamav.conf
@@ -1,6 +1,5 @@
-#squid_ip 127.0.0.1
-#squid_port 3128
-proxy none
+squid_ip 127.0.0.1
+squid_port 800
 #
 logfile /var/log/squid/squidclamav.log
 redirect http://127.0.0.1:81/clwarn.cgi
@@ -15,7 +14,7 @@ clamd_local /var/run/clamav/clamd
 maxsize 5000000
 maxredir 30
 timeout 60
-#trust_cache 1
+trust_cache 1
 #
 # Do not scan standard HTTP images
 abort ^.*\.(ico|gif|png|jpg)$
@@ -37,4 +36,4 @@ abortcontent ^video\/x-flv$
 abortcontent ^.*application\/x-mms-framed.*$
 #
 # White list some sites
-whitelist .*\.clamav.net
\ No newline at end of file
+whitelist .*\.clamav.net

diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
index fb313ac7c122104c0376a0845f98fa32495d8617..c42d35a95e5ba0160199eb610b2e3e28b7ec3d14 100644 (file)
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -699,6 +699,16 @@ if (!$errormessage)
        &read_acls;
 }
 
+# ------------------------------------------------------------------
+
+# Hook to regenerate the configuration files, if cgi got called from command line.
+if ($ENV{"REMOTE_ADDR"} eq "") {
+        writeconfig();
+        exit(0);
+}
+
+# -------------------------------------------------------------------
+
 $checked{'ENABLE'}{'off'} = '';
 $checked{'ENABLE'}{'on'} = '';
 $checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
@@ -3061,12 +3071,6 @@ icp_port 0
 
 END
        ;
-
-       # Include file with user defined settings.
-       if (-e "/etc/squid/squid.conf.pre.local") {
-               print FILE "include /etc/squid/squid.conf.pre.local\n\n";
-       }
-
        print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
        if ($proxysettings{'TRANSPARENT'} eq 'on') { print FILE " transparent" }
        if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
@@ -3448,6 +3452,19 @@ END
                close (ACL);
        }
        if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
+
+       # Check if squidclamav is enabled.
+       if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+               print FILE "\n#Settings for squidclamav:\n";
+               print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'} transparent\n";
+               print FILE "acl to_localhost dst 127.0.0.0/8\n";
+               print FILE "acl purge method PURGE\n";
+               print FILE "http_access deny to_localhost\n";
+               print FILE "http_access allow localhost\n";
+               print FILE "http_access allow purge localhost\n";
+               print FILE "http_access deny purge\n";
+               print FILE "url_rewrite_access deny localhost\n";
+       }
        print FILE <<END
 
 #Access to squid:
@@ -3963,6 +3980,18 @@ END
                print FILE "include /etc/squid/squid.conf.local\n";
        }
        close FILE;
+
+       # Proxy settings for squidclamav - if installed.
+       #
+       # Check if squidclamav is enabled.
+       if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+
+               my $configfile='/etc/squidclamav.conf';
+
+               my $data = &General::read_file_utf8($configfile);
+               $data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
+               &General::write_file_utf8($configfile, $data);
+       }
 }
 
 # -------------------------------------------------------------------

diff --git a/lfs/squidclamav b/lfs/squidclamav
index 86255f837b0b982b56a862c5c2eace11251dc5a0..79bf5d010ddb1ed2c7f1cf117d651b1035d94432 100644 (file)
--- a/lfs/squidclamav
+++ b/lfs/squidclamav
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = squidclamav
-PAK_VER    = 15
+PAK_VER    = 17
 
 DEPS       = "clamav"
 
@@ -77,6 +77,7 @@ $(subst %,%_MD5,$(objects)) :
 $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        @$(PREBUILD)
        @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+       cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squidclamav-5.11-dont_use_ipv6.patch
        cd $(DIR_APP) && ./configure --prefix=/usr
        cd $(DIR_APP) && make install
        install -v -m 755  $(DIR_CONF)/squidclamav/squidclamav.conf /etc/squidclamav.conf

diff --git a/src/paks/squidclamav/update.sh b/src/paks/squidclamav/update.sh
index 95516021498f344f18c4a9abe187d50a7f238672..4b542164e87f8260a45804d6a19b185f26a7ceae 100644 (file)
--- a/src/paks/squidclamav/update.sh
+++ b/src/paks/squidclamav/update.sh
@@ -35,4 +35,14 @@ if [ "$VERSION" -lt "11" ]; then
  sed -e "s|logfile.*|logfile /var/log/squid/squidclamav.log|g" /etc/squidclamav.conf
 fi
 
+if [ "$VERSION" -lt "16" ]; then
+ sed -e "s/proxy none//g" -i /etc/squidclamav.conf
+ sed -e "s/^#squid_ip 127\.0\.0\.1/squid_ip 127\.0\.0\.1/g" \
+     -e "s/^#squid_port 3128/squid_port 800/g" \
+     -e "s/^#trust_cache 1/trust_cache 1/g" -i /etc/squidclamav.conf
+
+ # Regenerate configuration files.
+ perl /srv/web/ipfire/cgi-bin/proxy.cgi
+fi
+ 
 /etc/init.d/squid restart

diff --git a/src/patches/squidclamav-5.11-dont_use_ipv6.patch b/src/patches/squidclamav-5.11-dont_use_ipv6.patch
new file mode 100644 (file)
index 0000000..4588962
--- /dev/null
+++ b/src/patches/squidclamav-5.11-dont_use_ipv6.patch
@@ -0,0 +1,13 @@
+diff -Nur a/src/squidclamav.c b/src/squidclamav.c
+--- a/src/squidclamav.c        2012-10-29 09:46:06.000000000 +0100
++++ b/src/squidclamav.c        2013-07-06 19:10:56.375292374 +0200
+@@ -413,6 +413,9 @@
+         /* Suppress error: SSL certificate problem, verify that the CA cert is OK */
+         curl_easy_setopt (eh, CURLOPT_SSL_VERIFYHOST, 0);
+         curl_easy_setopt (eh, CURLOPT_SSL_VERIFYPEER, 0);
++
++        /* Prevent squidclamav from using IPv6 - fix by Nico Prenzel */
++        curl_easy_setopt (eh, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
+       }
+    }
+   /* create a squidguard child process and setup pipes */