]> git.ipfire.org Git - people/teissler/ipfire-2.x.git/blobdiff - html/cgi-bin/proxy.cgi
proxy.pac: Don't use proxy for direct domain access.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / proxy.cgi
index 901ed7250466d84a2aa6a0c043a3b3745d5e6098..2a9d49394276a83233b4928b5737b1facb5141e9 100644 (file)
@@ -180,8 +180,8 @@ close(FILE);
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 
 my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}");
-my $blue_cidr = "# Blue not defined";
-if ($netsettings{'BLUE_DEV'}) {
+my $blue_cidr = "";
+if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
        $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}");
 }
 
@@ -195,6 +195,7 @@ $proxysettings{'ENABLE_BLUE'} = 'off';
 $proxysettings{'TRANSPARENT'} = 'off';
 $proxysettings{'TRANSPARENT_BLUE'} = 'off';
 $proxysettings{'PROXY_PORT'} = '800';
+$proxysettings{'TRANSPARENT_PORT'} = '3128';
 $proxysettings{'VISIBLE_HOSTNAME'} = '';
 $proxysettings{'ADMIN_MAIL_ADDRESS'} = '';
 $proxysettings{'ADMIN_PASSWORD'} = '';
@@ -212,7 +213,7 @@ $proxysettings{'LOGGING'} = 'off';
 $proxysettings{'CACHEMGR'} = 'off';
 $proxysettings{'LOGQUERY'} = 'off';
 $proxysettings{'LOGUSERAGENT'} = 'off';
-$proxysettings{'FILEDESCRIPTORS'} = '4096';
+$proxysettings{'FILEDESCRIPTORS'} = '16384';
 $proxysettings{'CACHE_MEM'} = '2';
 $proxysettings{'CACHE_SIZE'} = '50';
 $proxysettings{'MAX_SIZE'} = '4096';
@@ -359,6 +360,15 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
                $errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
                goto ERROR;
        }
+       if (!(&General::validport($proxysettings{'TRANSPARENT_PORT'})))
+       {
+               $errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
+               goto ERROR;
+       }
+       if ($proxysettings{'PROXY_PORT'} eq $proxysettings{'TRANSPARENT_PORT'}) {
+               $errormessage = $Lang::tr{'advproxy errmsg proxy ports equal'};
+               goto ERROR;
+       }
        if (!($proxysettings{'UPSTREAM_PROXY'} eq ''))
        {
                my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
@@ -381,7 +391,7 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
                }
        }
        if (!($proxysettings{'FILEDESCRIPTORS'} =~ /^\d+/) ||
-               ($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 16384))
+               ($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 1048576))
        {
                $errormessage = $Lang::tr{'proxy errmsg filedescriptors'};
                goto ERROR;
@@ -699,6 +709,16 @@ if (!$errormessage)
        &read_acls;
 }
 
+# ------------------------------------------------------------------
+
+# Hook to regenerate the configuration files, if cgi got called from command line.
+if ($ENV{"REMOTE_ADDR"} eq "") {
+        writeconfig();
+        exit(0);
+}
+
+# -------------------------------------------------------------------
+
 $checked{'ENABLE'}{'off'} = '';
 $checked{'ENABLE'}{'on'} = '';
 $checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
@@ -946,8 +966,8 @@ print <<END
 <tr>
        <td class='base'>$Lang::tr{'advproxy transparent on'} <font color="$Header::colourgreen">Green</font>:</td>
        <td><input type='checkbox' name='TRANSPARENT' $checked{'TRANSPARENT'}{'on'} /></td>
-       <td class='base'>$Lang::tr{'advproxy visible hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
-       <td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
+       <td width='25%' class='base'>$Lang::tr{'advproxy proxy port transparent'}:</td>
+       <td width='30%'><input type='text' name='TRANSPARENT_PORT' value='$proxysettings{'TRANSPARENT_PORT'}' size='5' /></td>
 </tr>
 <tr>
 END
@@ -959,7 +979,8 @@ if ($netsettings{'BLUE_DEV'}) {
        print "<td colspan='2'>&nbsp;</td>";
 }
 print <<END
-       <td colspan='2'>&nbsp;</td>
+       <td class='base'>$Lang::tr{'advproxy visible hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+       <td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
 </tr>
 <tr>
 END
@@ -1185,7 +1206,7 @@ print <<END
        <td colspan='4'><b>$Lang::tr{'advproxy destination ports'}</b></td>
 </tr>
 <tr>
-       <td width='25%' align=center></td> <td width='20%' align=center></td><td width='25%' align=center></td><td width='30%' align=center></td>
+       <td width='25%' align='center'></td> <td width='20%' align='center'></td><td width='25%' align='center'></td><td width='30%' align='center'></td>
 </tr>
 <tr>
        <td colspan='2' class='base'>$Lang::tr{'advproxy standard ports'}:</td>
@@ -1657,8 +1678,8 @@ print <<END
        <td class='base'>$Lang::tr{'advproxy fake referer'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
 </tr>
 <tr>
-       <td><input type='text' name='FAKE_USERAGENT' value='$proxysettings{'FAKE_USERAGENT'}' size='56' /></td>
-       <td><input type='text' name='FAKE_REFERER' value='$proxysettings{'FAKE_REFERER'}' size='56' /></td>
+       <td><input type='text' name='FAKE_USERAGENT' value='$proxysettings{'FAKE_USERAGENT'}' size='40%' /></td>
+       <td><input type='text' name='FAKE_REFERER' value='$proxysettings{'FAKE_REFERER'}' size='40%' /></td>
 </tr>
 </table>
 <hr size='1'>
@@ -2215,7 +2236,7 @@ print <<END
        <td width='25%'><input type='text' name='NCSA_USERNAME' value='$proxysettings{'NCSA_USERNAME'}' size='12'
 END
 ;
-       if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'}) { print " readonly "; }
+       if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'}) { print " readonly='readonly' "; }
        print <<END
         /></td>
        <td width='25%' class='base'>$Lang::tr{'advproxy NCSA group'}:</td>
@@ -2951,11 +2972,23 @@ sub writepacfile
                print FILE <<END
 if (
      (isPlainHostName(host)) ||
-     (dnsDomainIs(host, ".$mainsettings{'DOMAINNAME'}")) ||
      (isInNet(host, "127.0.0.1", "255.0.0.0")) ||
-     (isInNet(host, "10.0.0.0", "255.0.0.0")) ||
-     (isInNet(host, "172.16.0.0", "255.240.0.0")) ||
-     (isInNet(host, "192.168.0.0", "255.255.0.0")) ||
+END
+;
+
+       if ($netsettings{'GREEN_DEV'}) {
+               print FILE "     (isInNet(host, \"$netsettings{'GREEN_NETADDRESS'}\", \"$netsettings{'GREEN_NETMASK'}\")) ||\n";
+       }
+
+       if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
+               print FILE "     (isInNet(host, \"$netsettings{'BLUE_NETADDRESS'}\", \"$netsettings{'BLUE_NETMASK'}\")) ||\n";
+       }
+
+       if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
+               print FILE "     (isInNet(host, \"$netsettings{'ORANGE_NETADDRESS'}\", \"$netsettings{'ORANGE_NETMASK'}\")) ||\n";
+       }
+
+       print FILE <<END
      (isInNet(host, "169.254.0.0", "255.255.0.0"))
    )
      return "DIRECT";
@@ -3061,16 +3094,32 @@ icp_port 0
 
 END
        ;
+
+       # Include file with user defined settings.
+       if (-e "/etc/squid/squid.conf.pre.local") {
+               print FILE "include /etc/squid/squid.conf.pre.local\n\n";
+       }
+
        print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
-       if ($proxysettings{'TRANSPARENT'} eq 'on') { print FILE " transparent" }
        if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
        print FILE "\n";
 
+       if ($proxysettings{'TRANSPARENT'} eq 'on') {
+               print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
+               if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
+               print FILE "\n";
+       }
+
        if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
                print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
-               if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') { print FILE " transparent" }
                if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
                print FILE "\n";
+
+               if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') {
+                       print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
+                       if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
+                       print FILE "\n";
+               }
        }
 
        if ($proxysettings{'CACHE_SIZE'} > 0)
@@ -3128,12 +3177,12 @@ END
        if ($proxysettings{'LOGGING'} eq 'on')
        {
                print FILE <<END
-access_log /var/log/squid/access.log
+access_log stdio:/var/log/squid/access.log
 cache_log /var/log/squid/cache.log
 cache_store_log none
 END
        ;
-               if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "useragent_log \/var\/log\/squid\/user_agent.log\n"; }
+               if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "access_log stdio:\/var\/log\/squid\/user_agent.log useragent\n"; }
                if ($proxysettings{'LOGQUERY'} eq 'on') { print FILE "\nstrip_query_terms off\n"; }
        } else {
                print FILE <<END
@@ -3166,7 +3215,7 @@ END
        {
                if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
                {
-                       print FILE "auth_param basic program $authdir/ncsa_auth $userdb\n";
+                       print FILE "auth_param basic program $authdir/basic_ncsa_auth $userdb\n";
                        print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
                        print FILE "auth_param basic realm $authrealm\n";
                        print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
@@ -3176,7 +3225,7 @@ END
                if ($proxysettings{'AUTH_METHOD'} eq 'ldap')
                {
                        print FILE "auth_param basic utf8 on\n";
-                       print FILE "auth_param basic program $authdir/squid_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
+                       print FILE "auth_param basic program $authdir/basic_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
                        if (!($proxysettings{'LDAP_BINDDN_USER'} eq '')) { print FILE " -D \"$proxysettings{'LDAP_BINDDN_USER'}\""; }
                        if (!($proxysettings{'LDAP_BINDDN_PASS'} eq '')) { print FILE " -w $proxysettings{'LDAP_BINDDN_PASS'}"; }
                        if ($proxysettings{'LDAP_TYPE'} eq 'ADS')
@@ -3227,7 +3276,7 @@ END
                                print FILE "auth_param ntlm children $proxysettings{'AUTH_CHILDREN'}\n";
                                if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
                        } else {
-                               print FILE "auth_param basic program $authdir/msnt_auth\n";
+                               print FILE "auth_param basic program $authdir/basic_msnt_auth\n";
                                print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
                                print FILE "auth_param basic realm $authrealm\n";
                                print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
@@ -3253,7 +3302,7 @@ END
 
                if ($proxysettings{'AUTH_METHOD'} eq 'radius')
                {
-                       print FILE "auth_param basic program $authdir/squid_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
+                       print FILE "auth_param basic program $authdir/basic_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
                        if (!($proxysettings{'RADIUS_IDENTIFIER'} eq '')) { print FILE "-i $proxysettings{'RADIUS_IDENTIFIER'} "; }
                        print FILE "-w $proxysettings{'RADIUS_SECRET'}\n";
                        print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
@@ -3346,11 +3395,6 @@ END
                print FILE "acl blocked_mimetypes rep_mime_type \"$mimetypes\"\n\n";
        }
 
-       print FILE <<END
-#acl all src all
-acl localhost src 127.0.0.1/32
-END
-;
 open (PORTS,"$acl_ports_ssl");
 @temp = <PORTS>;
 close PORTS;
@@ -3442,6 +3486,18 @@ END
                close (ACL);
        }
        if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
+
+       # Check if squidclamav is enabled.
+       if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+               print FILE "\n#Settings for squidclamav:\n";
+               print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'}\n";
+               print FILE "acl purge method PURGE\n";
+               print FILE "http_access deny to_localhost\n";
+               print FILE "http_access allow localhost\n";
+               print FILE "http_access allow purge localhost\n";
+               print FILE "http_access deny purge\n";
+               print FILE "url_rewrite_access deny localhost\n";
+       }
        print FILE <<END
 
 #Access to squid:
@@ -3957,6 +4013,18 @@ END
                print FILE "include /etc/squid/squid.conf.local\n";
        }
        close FILE;
+
+       # Proxy settings for squidclamav - if installed.
+       #
+       # Check if squidclamav is enabled.
+       if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+
+               my $configfile='/etc/squidclamav.conf';
+
+               my $data = &General::read_file_utf8($configfile);
+               $data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
+               &General::write_file_utf8($configfile, $data);
+       }
 }
 
 # -------------------------------------------------------------------