X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fproxy.cgi;h=9476b743243dc1a2ec0c6b87ee622191bf23f4df;hp=015502a4e5fda106006447a12eb60591479487da;hb=603248db53e41290600a25a140e7f033bbe09abd;hpb=b431bfce486adcccac747c21882a6f735583104e

diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
old mode 100755
new mode 100644
index 015502a4e5..9476b74324
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2012  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -172,6 +172,8 @@ unless (-e $acl_include) { system("touch $acl_include"); }
 unless (-e $browserdb) { system("touch $browserdb"); }
 unless (-e $mimetypes) { system("touch $mimetypes"); }
 
+my $HAVE_NTLM_AUTH = (-e "/usr/bin/ntlm_auth");
+
 open FILE, $browserdb;
 @useragentlist = sort { reverse(substr(reverse(substr($a,index($a,',')+1)),index(reverse(substr($a,index($a,','))),',')+1)) cmp reverse(substr(reverse(substr($b,index($b,',')+1)),index(reverse(substr($b,index($b,','))),',')+1))} grep !/(^$)|(^\s*#)/,<FILE>;
 close(FILE);
@@ -180,8 +182,8 @@ close(FILE);
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 
 my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}");
-my $blue_cidr = "# Blue not defined";
-if ($netsettings{'BLUE_DEV'}) {
+my $blue_cidr = "";
+if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
 	$blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}");
 }
 
@@ -195,6 +197,7 @@ $proxysettings{'ENABLE_BLUE'} = 'off';
 $proxysettings{'TRANSPARENT'} = 'off';
 $proxysettings{'TRANSPARENT_BLUE'} = 'off';
 $proxysettings{'PROXY_PORT'} = '800';
+$proxysettings{'TRANSPARENT_PORT'} = '3128';
 $proxysettings{'VISIBLE_HOSTNAME'} = '';
 $proxysettings{'ADMIN_MAIL_ADDRESS'} = '';
 $proxysettings{'ADMIN_PASSWORD'} = '';
@@ -212,7 +215,7 @@ $proxysettings{'LOGGING'} = 'off';
 $proxysettings{'CACHEMGR'} = 'off';
 $proxysettings{'LOGQUERY'} = 'off';
 $proxysettings{'LOGUSERAGENT'} = 'off';
-$proxysettings{'FILEDESCRIPTORS'} = '4096';
+$proxysettings{'FILEDESCRIPTORS'} = '16384';
 $proxysettings{'CACHE_MEM'} = '2';
 $proxysettings{'CACHE_SIZE'} = '50';
 $proxysettings{'MAX_SIZE'} = '4096';
@@ -221,6 +224,7 @@ $proxysettings{'MEM_POLICY'} = 'LRU';
 $proxysettings{'CACHE_POLICY'} = 'LRU';
 $proxysettings{'L1_DIRS'} = '16';
 $proxysettings{'OFFLINE_MODE'} = 'off';
+$proxysettings{'CACHE_DIGESTS'} = 'off';
 $proxysettings{'CLASSROOM_EXT'} = 'off';
 $proxysettings{'SUPERVISOR_PASSWORD'} = '';
 $proxysettings{'NO_PROXY_LOCAL'} = 'off';
@@ -348,17 +352,36 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		$errormessage = $Lang::tr{'invalid input'};
 		goto ERROR;
 	}
+	if($proxysettings{'CACHE_MEM'} > $proxysettings{'CACHE_SIZE'} && $proxysettings{'CACHE_SIZE'} > 0){
+		$errormessage = $Lang::tr{'advproxy errmsg cache'}." ".$proxysettings{'CACHE_MEM'}." > ".$proxysettings{'CACHE_SIZE'};
+		goto ERROR;
+	}
+	
 	if (!(&General::validport($proxysettings{'PROXY_PORT'})))
 	{
 		$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
 		goto ERROR;
 	}
-	if (!($proxysettings{'UPSTREAM_PROXY'} eq '')) {
-	  my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
-	  if (!(&General::validip($temp[0]))) {
-	    $errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
-	    goto ERROR;
-          }
+	if (!(&General::validport($proxysettings{'TRANSPARENT_PORT'})))
+	{
+		$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
+		goto ERROR;
+	}
+	if ($proxysettings{'PROXY_PORT'} eq $proxysettings{'TRANSPARENT_PORT'}) {
+		$errormessage = $Lang::tr{'advproxy errmsg proxy ports equal'};
+		goto ERROR;
+	}
+	if (!($proxysettings{'UPSTREAM_PROXY'} eq ''))
+	{
+		my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
+		if (!(&General::validip($temp[0])))
+		{
+			if (!(&General::validdomainname($temp[0])))
+			{
+				$errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
+				goto ERROR;
+			}
+		}
         }
 	if (!($proxysettings{'CACHE_SIZE'} =~ /^\d+/) ||
 		($proxysettings{'CACHE_SIZE'} < 10))
@@ -370,7 +393,7 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		}
 	}
 	if (!($proxysettings{'FILEDESCRIPTORS'} =~ /^\d+/) ||
-		($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 16384))
+		($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 1048576))
 	{
 		$errormessage = $Lang::tr{'proxy errmsg filedescriptors'};
 		goto ERROR;
@@ -507,8 +530,11 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		}
 		if (!&General::validip($proxysettings{'LDAP_SERVER'}))
 		{
-			$errormessage = $Lang::tr{'advproxy errmsg ldap server'};
-			goto ERROR;
+			if (!&General::validdomainname($proxysettings{'LDAP_SERVER'}))
+			{
+				$errormessage = $Lang::tr{'advproxy errmsg ldap server'};
+				goto ERROR;
+			}
 		}
 		if (!&General::validport($proxysettings{'LDAP_PORT'}))
 		{
@@ -685,6 +711,16 @@ if (!$errormessage)
 	&read_acls;
 }
 
+# ------------------------------------------------------------------
+
+# Hook to regenerate the configuration files, if cgi got called from command line.
+if ($ENV{"REMOTE_ADDR"} eq "") {
+        writeconfig();
+        exit(0);
+}
+
+# -------------------------------------------------------------------
+
 $checked{'ENABLE'}{'off'} = '';
 $checked{'ENABLE'}{'on'} = '';
 $checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
@@ -724,6 +760,9 @@ $selected{'L1_DIRS'}{$proxysettings{'L1_DIRS'}} = "selected='selected'";
 $checked{'OFFLINE_MODE'}{'off'} = '';
 $checked{'OFFLINE_MODE'}{'on'} = '';
 $checked{'OFFLINE_MODE'}{$proxysettings{'OFFLINE_MODE'}} = "checked='checked'";
+$checked{'CACHE_DIGESTS'}{'off'} = '';
+$checked{'CACHE_DIGESTS'}{'on'} = '';
+$checked{'CACHE_DIGESTS'}{$proxysettings{'CACHE_DIGESTS'}} = "checked='checked'";
 
 $checked{'LOGGING'}{'off'} = '';
 $checked{'LOGGING'}{'on'} = '';
@@ -823,6 +862,7 @@ $checked{'AUTH_METHOD'}{'ncsa'} = '';
 $checked{'AUTH_METHOD'}{'ident'} = '';
 $checked{'AUTH_METHOD'}{'ldap'} = '';
 $checked{'AUTH_METHOD'}{'ntlm'} = '';
+$checked{'AUTH_METHOD'}{'ntlm-auth'} = '';
 $checked{'AUTH_METHOD'}{'radius'} = '';
 $checked{'AUTH_METHOD'}{$proxysettings{'AUTH_METHOD'}} = "checked='checked'";
 
@@ -929,8 +969,8 @@ print <<END
 <tr>
 	<td class='base'>$Lang::tr{'advproxy transparent on'} <font color="$Header::colourgreen">Green</font>:</td>
 	<td><input type='checkbox' name='TRANSPARENT' $checked{'TRANSPARENT'}{'on'} /></td>
-	<td class='base'>$Lang::tr{'advproxy visible hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
-	<td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
+	<td width='25%' class='base'>$Lang::tr{'advproxy proxy port transparent'}:</td>
+	<td width='30%'><input type='text' name='TRANSPARENT_PORT' value='$proxysettings{'TRANSPARENT_PORT'}' size='5' /></td>
 </tr>
 <tr>
 END
@@ -942,7 +982,8 @@ if ($netsettings{'BLUE_DEV'}) {
 	print "<td colspan='2'>&nbsp;</td>";
 }
 print <<END
-	<td colspan='2'>&nbsp;</td>
+	<td class='base'>$Lang::tr{'advproxy visible hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+	<td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
 </tr>
 <tr>
 END
@@ -1157,6 +1198,10 @@ print <<END
 	<td class='base'>$Lang::tr{'advproxy offline mode'}:</td>
 	<td><input type='checkbox' name='OFFLINE_MODE' $checked{'OFFLINE_MODE'}{'on'} /></td>
 </tr>
+<tr>
+	<td class='base'>$Lang::tr{'advproxy cache-digest'}:</td>
+        <td><input type='checkbox' name='CACHE_DIGESTS' $checked{'CACHE_DIGESTS'}{'on'} /></td>
+</tr>
 </table>
 <hr size='1'>
 <table width='100%'>
@@ -1164,7 +1209,7 @@ print <<END
 	<td colspan='4'><b>$Lang::tr{'advproxy destination ports'}</b></td>
 </tr>
 <tr>
-	<td width='25%' align=center></td> <td width='20%' align=center></td><td width='25%' align=center></td><td width='30%' align=center></td>
+	<td width='25%' align='center'></td> <td width='20%' align='center'></td><td width='25%' align='center'></td><td width='30%' align='center'></td>
 </tr>
 <tr>
 	<td colspan='2' class='base'>$Lang::tr{'advproxy standard ports'}:</td>
@@ -1636,26 +1681,41 @@ print <<END
 	<td class='base'>$Lang::tr{'advproxy fake referer'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
 </tr>
 <tr>
-	<td><input type='text' name='FAKE_USERAGENT' value='$proxysettings{'FAKE_USERAGENT'}' size='56' /></td>
-	<td><input type='text' name='FAKE_REFERER' value='$proxysettings{'FAKE_REFERER'}' size='56' /></td>
+	<td><input type='text' name='FAKE_USERAGENT' value='$proxysettings{'FAKE_USERAGENT'}' size='40%' /></td>
+	<td><input type='text' name='FAKE_REFERER' value='$proxysettings{'FAKE_REFERER'}' size='40%' /></td>
 </tr>
 </table>
 <hr size='1'>
 END
 ;
 
-print <<END
+my $auth_columns = 5;
+if ($HAVE_NTLM_AUTH) {
+	$auth_columns++;
+}
+my $auth_column_width = 100 / $auth_columns;
+
+print <<END;
 <table width='100%'>
 <tr>
-	<td colspan='5'><b>$Lang::tr{'advproxy AUTH method'}</b></td>
+	<td colspan='$auth_columns'><b>$Lang::tr{'advproxy AUTH method'}</b></td>
 </tr>
 <tr>
-	<td width='16%' class='base'><input type='radio' name='AUTH_METHOD' value='none' $checked{'AUTH_METHOD'}{'none'} />$Lang::tr{'advproxy AUTH method none'}</td>
-	<td width='16%' class='base'><input type='radio' name='AUTH_METHOD' value='ncsa' $checked{'AUTH_METHOD'}{'ncsa'} />$Lang::tr{'advproxy AUTH method ncsa'}</td>
-	<td width='16%' class='base'><input type='radio' name='AUTH_METHOD' value='ident' $checked{'AUTH_METHOD'}{'ident'} />$Lang::tr{'advproxy AUTH method ident'}</td>
-	<td width='16%' class='base'><input type='radio' name='AUTH_METHOD' value='ldap' $checked{'AUTH_METHOD'}{'ldap'} />$Lang::tr{'advproxy AUTH method ldap'}</td>
-	<td width='16%' class='base'><input type='radio' name='AUTH_METHOD' value='ntlm' $checked{'AUTH_METHOD'}{'ntlm'} />$Lang::tr{'advproxy AUTH method ntlm'}</td>
-	<td width='16%' class='base'><input type='radio' name='AUTH_METHOD' value='radius' $checked{'AUTH_METHOD'}{'radius'} />$Lang::tr{'advproxy AUTH method radius'}</td>
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='none' $checked{'AUTH_METHOD'}{'none'} />$Lang::tr{'advproxy AUTH method none'}</td>
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ncsa' $checked{'AUTH_METHOD'}{'ncsa'} />$Lang::tr{'advproxy AUTH method ncsa'}</td>
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ident' $checked{'AUTH_METHOD'}{'ident'} />$Lang::tr{'advproxy AUTH method ident'}</td>
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ldap' $checked{'AUTH_METHOD'}{'ldap'} />$Lang::tr{'advproxy AUTH method ldap'}</td>
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ntlm' $checked{'AUTH_METHOD'}{'ntlm'} />$Lang::tr{'advproxy AUTH method ntlm'}</td>
+END
+
+if ($HAVE_NTLM_AUTH) {
+	print <<END;
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='ntlm-auth' $checked{'AUTH_METHOD'}{'ntlm-auth'} />$Lang::tr{'advproxy AUTH method ntlm auth'}</td>
+END
+}
+
+print <<END
+	<td width='$auth_column_width%' class='base'><input type='radio' name='AUTH_METHOD' value='radius' $checked{'AUTH_METHOD'}{'radius'} />$Lang::tr{'advproxy AUTH method radius'}</td>
 </tr>
 </table>
 END
@@ -2194,7 +2254,7 @@ print <<END
 	<td width='25%'><input type='text' name='NCSA_USERNAME' value='$proxysettings{'NCSA_USERNAME'}' size='12'
 END
 ;
-	if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'}) { print " readonly "; }
+	if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'}) { print " readonly='readonly' "; }
 	print <<END
 	 /></td>
 	<td width='25%' class='base'>$Lang::tr{'advproxy NCSA group'}:</td>
@@ -2930,11 +2990,23 @@ sub writepacfile
 		print FILE <<END
 if (
      (isPlainHostName(host)) ||
-     (dnsDomainIs(host, ".$mainsettings{'DOMAINNAME'}")) ||
      (isInNet(host, "127.0.0.1", "255.0.0.0")) ||
-     (isInNet(host, "10.0.0.0", "255.0.0.0")) ||
-     (isInNet(host, "172.16.0.0", "255.240.0.0")) ||
-     (isInNet(host, "192.168.0.0", "255.255.0.0")) ||
+END
+;
+
+	if ($netsettings{'GREEN_DEV'}) {
+		print FILE "     (isInNet(host, \"$netsettings{'GREEN_NETADDRESS'}\", \"$netsettings{'GREEN_NETMASK'}\")) ||\n";
+	}
+
+	if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
+		print FILE "     (isInNet(host, \"$netsettings{'BLUE_NETADDRESS'}\", \"$netsettings{'BLUE_NETMASK'}\")) ||\n";
+	}
+
+	if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
+		print FILE "     (isInNet(host, \"$netsettings{'ORANGE_NETADDRESS'}\", \"$netsettings{'ORANGE_NETMASK'}\")) ||\n";
+	}
+
+	print FILE <<END
      (isInNet(host, "169.254.0.0", "255.255.0.0"))
    )
      return "DIRECT";
@@ -3040,16 +3112,32 @@ icp_port 0
 
 END
 	;
+
+	# Include file with user defined settings.
+	if (-e "/etc/squid/squid.conf.pre.local") {
+		print FILE "include /etc/squid/squid.conf.pre.local\n\n";
+	}
+
 	print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
-	if ($proxysettings{'TRANSPARENT'} eq 'on') { print FILE " transparent" }
 	if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
 	print FILE "\n";
 
+	if ($proxysettings{'TRANSPARENT'} eq 'on') {
+		print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
+		if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
+		print FILE "\n";
+	}
+
 	if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
 		print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
-		if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') { print FILE " transparent" }
 		if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
 		print FILE "\n";
+
+		if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') {
+			print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
+			if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
+			print FILE "\n";
+		}
 	}
 
 	if ($proxysettings{'CACHE_SIZE'} > 0)
@@ -3073,7 +3161,6 @@ END
 	print FILE <<END
 
 cache_effective_user squid
-cache_effective_group squid
 umask 022
 
 pid_filename /var/run/squid.pid
@@ -3081,16 +3168,11 @@ pid_filename /var/run/squid.pid
 cache_mem $proxysettings{'CACHE_MEM'} MB
 END
 	;
-
-	if ($proxysettings{'CACHE_SIZE'} ne '0')
-	{
-		print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
-	}
-
 	print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
 
 	if ($proxysettings{'OFFLINE_MODE'} eq 'on') {  print FILE "offline_mode on\n\n"; }
-
+	if ($proxysettings{'CACHE_DIGESTS'} eq 'on') {  print FILE "digest_generation on\n\n"; } else {  print FILE "digest_generation off\n\n"; }
+	
 	if ((!($proxysettings{'MEM_POLICY'} eq 'LRU')) || (!($proxysettings{'CACHE_POLICY'} eq 'LRU')))
 	{
 		if (!($proxysettings{'MEM_POLICY'} eq 'LRU'))
@@ -3104,15 +3186,20 @@ END
 		print FILE "\n";
 	}
 
+	if ($proxysettings{'CACHE_SIZE'} ne '0')
+	{
+		print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
+	}
+
 	if ($proxysettings{'LOGGING'} eq 'on')
 	{
 		print FILE <<END
-access_log /var/log/squid/access.log
+access_log stdio:/var/log/squid/access.log
 cache_log /var/log/squid/cache.log
 cache_store_log none
 END
 	;
-		if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "useragent_log \/var\/log\/squid\/user_agent.log\n"; }
+		if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "access_log stdio:\/var\/log\/squid\/user_agent.log useragent\n"; }
 		if ($proxysettings{'LOGQUERY'} eq 'on') { print FILE "\nstrip_query_terms off\n"; }
 	} else {
 		print FILE <<END
@@ -3145,7 +3232,7 @@ END
 	{
 		if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
 		{
-			print FILE "auth_param basic program $authdir/ncsa_auth $userdb\n";
+			print FILE "auth_param basic program $authdir/basic_ncsa_auth $userdb\n";
 			print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
 			print FILE "auth_param basic realm $authrealm\n";
 			print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
@@ -3155,7 +3242,7 @@ END
 		if ($proxysettings{'AUTH_METHOD'} eq 'ldap')
 		{
 			print FILE "auth_param basic utf8 on\n";
-			print FILE "auth_param basic program $authdir/squid_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
+			print FILE "auth_param basic program $authdir/basic_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
 			if (!($proxysettings{'LDAP_BINDDN_USER'} eq '')) { print FILE " -D \"$proxysettings{'LDAP_BINDDN_USER'}\""; }
 			if (!($proxysettings{'LDAP_BINDDN_PASS'} eq '')) { print FILE " -w $proxysettings{'LDAP_BINDDN_PASS'}"; }
 			if ($proxysettings{'LDAP_TYPE'} eq 'ADS')
@@ -3206,7 +3293,7 @@ END
 				print FILE "auth_param ntlm children $proxysettings{'AUTH_CHILDREN'}\n";
 				if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
 			} else {
-				print FILE "auth_param basic program $authdir/msnt_auth\n";
+				print FILE "auth_param basic program $authdir/basic_msnt_auth\n";
 				print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
 				print FILE "auth_param basic realm $authrealm\n";
 				print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
@@ -3230,9 +3317,15 @@ END
 			}
 		}
 
+		if ($proxysettings{'AUTH_METHOD'} eq 'ntlm-auth')
+		{
+			print FILE "auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp\n";
+			print FILE "auth_param ntlm children $proxysettings{'AUTH_CHILDREN'}\n";
+		}
+
 		if ($proxysettings{'AUTH_METHOD'} eq 'radius')
 		{
-			print FILE "auth_param basic program $authdir/squid_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
+			print FILE "auth_param basic program $authdir/basic_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
 			if (!($proxysettings{'RADIUS_IDENTIFIER'} eq '')) { print FILE "-i $proxysettings{'RADIUS_IDENTIFIER'} "; }
 			print FILE "-w $proxysettings{'RADIUS_SECRET'}\n";
 			print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
@@ -3325,11 +3418,6 @@ END
 		print FILE "acl blocked_mimetypes rep_mime_type \"$mimetypes\"\n\n";
 	}
 
-	print FILE <<END
-#acl all src all
-acl localhost src 127.0.0.1/32
-END
-;
 open (PORTS,"$acl_ports_ssl");
 @temp = <PORTS>;
 close PORTS;
@@ -3421,6 +3509,18 @@ END
 		close (ACL);
 	}
 	if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
+
+	# Check if squidclamav is enabled.
+	if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+		print FILE "\n#Settings for squidclamav:\n";
+		print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'}\n";
+		print FILE "acl purge method PURGE\n";
+		print FILE "http_access deny to_localhost\n";
+		print FILE "http_access allow localhost\n";
+		print FILE "http_access allow purge localhost\n";
+		print FILE "http_access deny purge\n";
+		print FILE "url_rewrite_access deny localhost\n";
+	}
 	print FILE <<END
 
 #Access to squid:
@@ -3544,15 +3644,15 @@ if ($delaypools) {
 
 if ($proxysettings{'NO_PROXY_LOCAL'} eq 'on')
 {
-	print FILE "#Prevent internal proxy access to Green\n";
-	print FILE "http_access deny IPFire_green_servers !IPFire_green_network\n\n";
+	print FILE "#Prevent internal proxy access to Green except IPFire itself\n";
+	print FILE "http_access deny IPFire_green_servers !IPFire_ips !IPFire_green_network\n\n";
 }
 
 if ($proxysettings{'NO_PROXY_LOCAL_BLUE'} eq 'on')
 {
-	print FILE "#Prevent internal proxy access from Blue\n";
+	print FILE "#Prevent internal proxy access from Blue except IPFire itself\n";
 	print FILE "http_access allow IPFire_blue_network IPFire_blue_servers\n";
-	print FILE "http_access deny  IPFire_blue_network IPFire_servers\n\n";
+	print FILE "http_access deny  IPFire_blue_network !IPFire_ips IPFire_servers\n\n";
 }
 
 	print FILE <<END
@@ -3936,6 +4036,18 @@ END
 		print FILE "include /etc/squid/squid.conf.local\n";
 	}
 	close FILE;
+
+	# Proxy settings for squidclamav - if installed.
+	#
+	# Check if squidclamav is enabled.
+	if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+
+		my $configfile='/etc/squidclamav.conf';
+
+		my $data = &General::read_file_utf8($configfile);
+		$data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
+		&General::write_file_utf8($configfile, $data);
+	}
 }
 
 # -------------------------------------------------------------------