X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fproxy.cgi;h=25e935bf05778a0eb5d283395622304158e71407;hp=1a4453a777c1dc12670dfe2be838c8aa238f14d7;hb=8dc177053fc97d89afb99bb2ab4849656d550833;hpb=4894d8701710c2d70639f7e5b797992e67e3a50f

diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
index 1a4453a77..25e935bf0 100644
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2008  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -19,11 +19,11 @@
 #                                                                             #
 ###############################################################################
 #
-# (c) 2004-2008 marco.s - http://www.advproxy.net
+# (c) 2004-2009 marco.s - http://www.advproxy.net
 #
 # This code is distributed under the terms of the GPL
 #
-# $Id: advproxy.cgi,v 3.0.0 2008/08/18 00:00:00 marco.s Exp $
+# $Id: advproxy.cgi,v 3.0.2 2009/02/04 00:00:00 marco.s Exp $
 #
 
 use strict;
@@ -55,10 +55,10 @@ my %mainsettings=();
 my %checked=();
 my %selected=();
 
-my @throttle_limits=(64,128,256,384,512,1024,2048,3072,5120);
-my $throttle_binary="bin|cab|exe|gz|rar|sea|tar|tgz|zip";
-my $throttle_dskimg="b5t|bin|bwt|ccd|cdi|cue|gho|img|iso|mds|nrg|pqi";
-my $throttle_mmedia="aiff?|asf|avi|divx|mov|mp3|mpe?g|qt|ra?m";
+my @throttle_limits=(64,128,256,384,512,768,1024,1280,1536,1792,2048,2560,3072,3584,4096,5120,6144,7168,8192,10240,12288,16384,20480);
+my $throttle_binary="7z|arj|bin|bz2|cab|exe|gz|lzh|rar|sea|tar|tgz|xz|zip";
+my $throttle_dskimg="b5t|bin|bwt|ccd|cdi|cue|gho|img|iso|mds|nrg|pqi|vmdk";
+my $throttle_mmedia="aiff?|asf|avi|divx|mov|mp3|mpe?g|ogg|qt|ra?m|ts|vob";
 
 my $def_ports_safe="80 # http\n21 # ftp\n443 # https\n563 # snews\n70 # gopher\n210 # wais\n1025-65535 # unregistered ports\n280 # http-mgmt\n488 # gss-http\n591 # filemaker\n777 # multiling http\n800 # Squids port (for icons)\n";
 my $def_ports_ssl="443 # https\n563 # snews\n";
@@ -82,7 +82,6 @@ my @templist=();
 my $cachemem=0;
 my $proxy1='';
 my $proxy2='';
-my $replybodymaxsize=0;
 my $browser_regexp='';
 my $needhup = 0;
 my $errormessage='';
@@ -180,6 +179,12 @@ close(FILE);
 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 
+my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}");
+my $blue_cidr = "# Blue not defined";
+if ($netsettings{'BLUE_DEV'}) {
+	$blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}");
+}
+
 &Header::showhttpheaders();
 
 $proxysettings{'ACTION'} = '';
@@ -190,8 +195,10 @@ $proxysettings{'ENABLE_BLUE'} = 'off';
 $proxysettings{'TRANSPARENT'} = 'off';
 $proxysettings{'TRANSPARENT_BLUE'} = 'off';
 $proxysettings{'PROXY_PORT'} = '800';
+$proxysettings{'TRANSPARENT_PORT'} = '3128';
 $proxysettings{'VISIBLE_HOSTNAME'} = '';
 $proxysettings{'ADMIN_MAIL_ADDRESS'} = '';
+$proxysettings{'ADMIN_PASSWORD'} = '';
 $proxysettings{'ERR_LANGUAGE'} = 'German';
 $proxysettings{'ERR_DESIGN'} = 'ipfire';
 $proxysettings{'SUPPRESS_VERSION'} = 'off';
@@ -203,8 +210,10 @@ $proxysettings{'UPSTREAM_PROXY'} = '';
 $proxysettings{'UPSTREAM_USER'} = '';
 $proxysettings{'UPSTREAM_PASSWORD'} = '';
 $proxysettings{'LOGGING'} = 'off';
+$proxysettings{'CACHEMGR'} = 'off';
 $proxysettings{'LOGQUERY'} = 'off';
 $proxysettings{'LOGUSERAGENT'} = 'off';
+$proxysettings{'FILEDESCRIPTORS'} = '16384';
 $proxysettings{'CACHE_MEM'} = '2';
 $proxysettings{'CACHE_SIZE'} = '50';
 $proxysettings{'MAX_SIZE'} = '4096';
@@ -213,6 +222,7 @@ $proxysettings{'MEM_POLICY'} = 'LRU';
 $proxysettings{'CACHE_POLICY'} = 'LRU';
 $proxysettings{'L1_DIRS'} = '16';
 $proxysettings{'OFFLINE_MODE'} = 'off';
+$proxysettings{'CACHE_DIGESTS'} = 'off';
 $proxysettings{'CLASSROOM_EXT'} = 'off';
 $proxysettings{'SUPERVISOR_PASSWORD'} = '';
 $proxysettings{'NO_PROXY_LOCAL'} = 'off';
@@ -331,7 +341,7 @@ if ($proxysettings{'ACTION'} eq $Lang::tr{'edit'})
 	$proxysettings{'NCSA_PASS_CONFIRM'} = $proxysettings{'NCSA_PASS'};
 }
 
-if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}))
+if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) || ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}))
 {
 	if ($proxysettings{'ENABLE'} !~ /^(on|off)$/ ||
 	    $proxysettings{'TRANSPARENT'} !~ /^(on|off)$/ ||
@@ -340,11 +350,37 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		$errormessage = $Lang::tr{'invalid input'};
 		goto ERROR;
 	}
+	if($proxysettings{'CACHE_MEM'} > $proxysettings{'CACHE_SIZE'} && $proxysettings{'CACHE_SIZE'} > 0){
+		$errormessage = $Lang::tr{'advproxy errmsg cache'}." ".$proxysettings{'CACHE_MEM'}." > ".$proxysettings{'CACHE_SIZE'};
+		goto ERROR;
+	}
+	
 	if (!(&General::validport($proxysettings{'PROXY_PORT'})))
 	{
 		$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
 		goto ERROR;
 	}
+	if (!(&General::validport($proxysettings{'TRANSPARENT_PORT'})))
+	{
+		$errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'};
+		goto ERROR;
+	}
+	if ($proxysettings{'PROXY_PORT'} eq $proxysettings{'TRANSPARENT_PORT'}) {
+		$errormessage = $Lang::tr{'advproxy errmsg proxy ports equal'};
+		goto ERROR;
+	}
+	if (!($proxysettings{'UPSTREAM_PROXY'} eq ''))
+	{
+		my @temp = split(/:/,$proxysettings{'UPSTREAM_PROXY'});
+		if (!(&General::validip($temp[0])))
+		{
+			if (!(&General::validdomainname($temp[0])))
+			{
+				$errormessage = $Lang::tr{'advproxy errmsg invalid upstream proxy'};
+				goto ERROR;
+			}
+		}
+        }
 	if (!($proxysettings{'CACHE_SIZE'} =~ /^\d+/) ||
 		($proxysettings{'CACHE_SIZE'} < 10))
 	{
@@ -354,6 +390,12 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 			goto ERROR;
 		}
 	}
+	if (!($proxysettings{'FILEDESCRIPTORS'} =~ /^\d+/) ||
+		($proxysettings{'FILEDESCRIPTORS'} < 1) || ($proxysettings{'FILEDESCRIPTORS'} > 65536))
+	{
+		$errormessage = $Lang::tr{'proxy errmsg filedescriptors'};
+		goto ERROR;
+	}
 	if (!($proxysettings{'CACHE_MEM'} =~ /^\d+/) ||
 		($proxysettings{'CACHE_MEM'} < 1))
 	{
@@ -486,8 +528,11 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'}
 		}
 		if (!&General::validip($proxysettings{'LDAP_SERVER'}))
 		{
-			$errormessage = $Lang::tr{'advproxy errmsg ldap server'};
-			goto ERROR;
+			if (!&General::validdomainname($proxysettings{'LDAP_SERVER'}))
+			{
+				$errormessage = $Lang::tr{'advproxy errmsg ldap server'};
+				goto ERROR;
+			}
 		}
 		if (!&General::validport($proxysettings{'LDAP_PORT'}))
 		{
@@ -625,6 +670,8 @@ ERROR:
 		&writeconfig;
 		&writepacfile;
 
+		if ($proxysettings{'CACHEMGR'} eq 'on'){&writecachemgr;}
+
 		system ('/usr/local/bin/squidctrl', 'disable');
 		unlink "${General::swroot}/proxy/enable";
 		unlink "${General::swroot}/proxy/transparent";
@@ -643,7 +690,8 @@ ERROR:
 			system ('/usr/bin/touch', "${General::swroot}/proxy/transparent_blue"); }
 
 		if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) { system('/usr/local/bin/squidctrl restart >/dev/null 2>&1'); }
-	}
+		if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { system('/usr/local/bin/squidctrl reconfigure >/dev/null 2>&1'); }	
+  }
 }
 
 if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy clear cache'})
@@ -661,6 +709,16 @@ if (!$errormessage)
 	&read_acls;
 }
 
+# ------------------------------------------------------------------
+
+# Hook to regenerate the configuration files, if cgi got called from command line.
+if ($ENV{"REMOTE_ADDR"} eq "") {
+        writeconfig();
+        exit(0);
+}
+
+# -------------------------------------------------------------------
+
 $checked{'ENABLE'}{'off'} = '';
 $checked{'ENABLE'}{'on'} = '';
 $checked{'ENABLE'}{$proxysettings{'ENABLE'}} = "checked='checked'";
@@ -700,10 +758,16 @@ $selected{'L1_DIRS'}{$proxysettings{'L1_DIRS'}} = "selected='selected'";
 $checked{'OFFLINE_MODE'}{'off'} = '';
 $checked{'OFFLINE_MODE'}{'on'} = '';
 $checked{'OFFLINE_MODE'}{$proxysettings{'OFFLINE_MODE'}} = "checked='checked'";
+$checked{'CACHE_DIGESTS'}{'off'} = '';
+$checked{'CACHE_DIGESTS'}{'on'} = '';
+$checked{'CACHE_DIGESTS'}{$proxysettings{'CACHE_DIGESTS'}} = "checked='checked'";
 
 $checked{'LOGGING'}{'off'} = '';
 $checked{'LOGGING'}{'on'} = '';
 $checked{'LOGGING'}{$proxysettings{'LOGGING'}} = "checked='checked'";
+$checked{'CACHEMGR'}{'off'} = '';
+$checked{'CACHEMGR'}{'on'} = '';
+$checked{'CACHEMGR'}{$proxysettings{'CACHEMGR'}} = "checked='checked'";
 $checked{'LOGQUERY'}{'off'} = '';
 $checked{'LOGQUERY'}{'on'} = '';
 $checked{'LOGQUERY'}{$proxysettings{'LOGQUERY'}} = "checked='checked'";
@@ -902,8 +966,8 @@ print <<END
 <tr>
 	<td class='base'>$Lang::tr{'advproxy transparent on'} <font color="$Header::colourgreen">Green</font>:</td>
 	<td><input type='checkbox' name='TRANSPARENT' $checked{'TRANSPARENT'}{'on'} /></td>
-	<td class='base'>$Lang::tr{'advproxy visible hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
-	<td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
+	<td width='25%' class='base'>$Lang::tr{'advproxy proxy port transparent'}:</td>
+	<td width='30%'><input type='text' name='TRANSPARENT_PORT' value='$proxysettings{'TRANSPARENT_PORT'}' size='5' /></td>
 </tr>
 <tr>
 END
@@ -915,8 +979,8 @@ if ($netsettings{'BLUE_DEV'}) {
 	print "<td colspan='2'>&nbsp;</td>";
 }
 print <<END
-	<td class='base'>$Lang::tr{'advproxy admin mail'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
-	<td><input type='text' name='ADMIN_MAIL_ADDRESS' value='$proxysettings{'ADMIN_MAIL_ADDRESS'}' /></td>
+	<td class='base'>$Lang::tr{'advproxy visible hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+	<td><input type='text' name='VISIBLE_HOSTNAME' value='$proxysettings{'VISIBLE_HOSTNAME'}' /></td>
 </tr>
 <tr>
 END
@@ -965,12 +1029,17 @@ print <<END
 <tr><td class='base' >$Lang::tr{'processes'}<input type='text' name='CHILDREN' value='$proxysettings{'CHILDREN'}' size='5' /></td>
 END
 ;
-my $count = `arp -a | wc -l`;
+my $count = `ip n| wc -l`;
 if ( $count < 1 ){$count = 1;}
 if ( -e "/usr/bin/squidclamav" ) {
 	print "<td class='base'><b>".$Lang::tr{'advproxy squidclamav'}."</b><br />";
-	print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_CLAMAV' ".$checked{'ENABLE_CLAMAV'}{'on'}." /><br />";
-	print "+ ".int(( $count**(1/3)) * 8);
+	if ( ! -e "/var/run/clamav/clamd.pid" ){
+		print "<font color='red'>clamav not running</font><br /><br />";
+		$proxysettings{'ENABLE_CLAMAV'} = 'off';
+		}
+	else {
+		print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_CLAMAV' ".$checked{'ENABLE_CLAMAV'}{'on'}." /><br />";
+		print "+ ".int(( $count**(1/3)) * 8);}
 	print "</td>";
 } else {
 	print "<td></td>";
@@ -1038,6 +1107,18 @@ print <<END
 <tr>
 	<td colspan='4'><b>$Lang::tr{'advproxy cache management'}</b></td>
 </tr>
+<tr>
+	<td class='base'>$Lang::tr{'proxy cachemgr'}:</td>
+	<td><input type='checkbox' name='CACHEMGR' $checked{'CACHEMGR'}{'on'} /></td>
+	<td class='base'>$Lang::tr{'advproxy admin mail'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+	<td><input type='text' name='ADMIN_MAIL_ADDRESS' value='$proxysettings{'ADMIN_MAIL_ADDRESS'}' /></td>
+</tr>
+<tr>
+	<td class='base'>$Lang::tr{'proxy filedescriptors'}:</td>
+	<td><input type='text' name='FILEDESCRIPTORS' value='$proxysettings{'FILEDESCRIPTORS'}' size='5' /></td>
+	<td class='base'>$Lang::tr{'proxy admin password'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+	<td><input type='text' name='ADMIN_PASSWORD' value='$proxysettings{'ADMIN_PASSWORD'}' /></td>
+</tr>
 <tr>
 	<td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
 </tr>
@@ -1114,6 +1195,10 @@ print <<END
 	<td class='base'>$Lang::tr{'advproxy offline mode'}:</td>
 	<td><input type='checkbox' name='OFFLINE_MODE' $checked{'OFFLINE_MODE'}{'on'} /></td>
 </tr>
+<tr>
+	<td class='base'>$Lang::tr{'advproxy cache-digest'}:</td>
+        <td><input type='checkbox' name='CACHE_DIGESTS' $checked{'CACHE_DIGESTS'}{'on'} /></td>
+</tr>
 </table>
 <hr size='1'>
 <table width='100%'>
@@ -1162,10 +1247,10 @@ END
 
 if (!$proxysettings{'SRC_SUBNETS'})
 {
-	print "$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}\n";
+	print "$green_cidr\n";
 	if ($netsettings{'BLUE_DEV'})
 	{
-		print "$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}\n";
+		print "$blue_cidr\n";
 	}
 } else { print $proxysettings{'SRC_SUBNETS'}; }
 
@@ -1754,9 +1839,9 @@ print <<END
 END
 ;
 if (!$proxysettings{'IDENT_HOSTS'}) {
-	print "$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}\n";
+	print "$green_cidr\n";
 	if ($netsettings{'BLUE_DEV'}) {
-		print "$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}\n";
+		print "$blue_cidr\n";
 	}
 } else {
 	print $proxysettings{'IDENT_HOSTS'};
@@ -2111,6 +2196,7 @@ print <<END
 <tr>
 	<td>&nbsp;</td>
 	<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
+	<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'proxy reconfigure'}' /></td>
 	<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'advproxy save and restart'}' /></td>
 	<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'advproxy clear cache'}' /></td>
 	<td>&nbsp;</td>
@@ -2543,6 +2629,7 @@ sub check_acls
 	}
 
 	@temp = split(/\n/,$proxysettings{'DST_NOAUTH'});
+	undef $proxysettings{'DST_NOAUTH'};
 	foreach (@temp)
 	{
 		s/^\s+//g;
@@ -2659,10 +2746,10 @@ sub write_acls
 	flock(FILE, 2);
 	if (!$proxysettings{'SRC_SUBNETS'})
 	{
-		print FILE "$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}\n";
+		print FILE "$green_cidr\n";
 		if ($netsettings{'BLUE_DEV'})
 		{
-			print FILE "$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}\n";
+			print FILE "$blue_cidr\n";
 		}
 	} else { print FILE $proxysettings{'SRC_SUBNETS'}; }
 	close(FILE);
@@ -2886,6 +2973,7 @@ sub writepacfile
 if (
      (isPlainHostName(host)) ||
      (dnsDomainIs(host, ".$mainsettings{'DOMAINNAME'}")) ||
+     (isInNet(host, "127.0.0.1", "255.0.0.0")) ||
      (isInNet(host, "10.0.0.0", "255.0.0.0")) ||
      (isInNet(host, "172.16.0.0", "255.240.0.0")) ||
      (isInNet(host, "192.168.0.0", "255.255.0.0")) ||
@@ -2974,7 +3062,7 @@ sub writeconfig
 	}
 
 	$_ = $proxysettings{'UPSTREAM_PROXY'};
-	my ($remotehost, $remoteport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
+        my ($remotehost, $remoteport) = split(/:/,$_);
 
 	if ($remoteport eq '') { $remoteport = 80; }
 
@@ -2994,16 +3082,32 @@ icp_port 0
 
 END
 	;
+
+	# Include file with user defined settings.
+	if (-e "/etc/squid/squid.conf.pre.local") {
+		print FILE "include /etc/squid/squid.conf.pre.local\n\n";
+	}
+
 	print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
-	if ($proxysettings{'TRANSPARENT'} eq 'on') { print FILE " transparent" }
 	if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
 	print FILE "\n";
 
+	if ($proxysettings{'TRANSPARENT'} eq 'on') {
+		print FILE "http_port $netsettings{'GREEN_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
+		if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
+		print FILE "\n";
+	}
+
 	if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
 		print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'PROXY_PORT'}";
-		if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') { print FILE " transparent" }
 		if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
 		print FILE "\n";
+
+		if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on') {
+			print FILE "http_port $netsettings{'BLUE_ADDRESS'}:$proxysettings{'TRANSPARENT_PORT'} intercept";
+			if ($proxysettings{'NO_CONNECTION_AUTH'} eq 'on') { print FILE " no-connection-auth" }
+			print FILE "\n";
+		}
 	}
 
 	if ($proxysettings{'CACHE_SIZE'} > 0)
@@ -3015,7 +3119,7 @@ END
 			print FILE "cache deny no_cache_domains\n";
 		}
 		if (!-z $acl_dst_nocache_net) {
-			print FILE "acl no_cache_domains dst \"$acl_dst_nocache_net\"\n";
+			print FILE "acl no_cache_ipaddr dst \"$acl_dst_nocache_net\"\n";
 			print FILE "cache deny no_cache_ipaddr\n";
 		}
 		if (!-z $acl_dst_nocache_url) {
@@ -3031,28 +3135,15 @@ cache_effective_group squid
 umask 022
 
 pid_filename /var/run/squid.pid
-max_filedescriptors 4096
 
 cache_mem $proxysettings{'CACHE_MEM'} MB
 END
 	;
-
-	if ($proxysettings{'CACHE_SIZE'} eq '0')
-	{
-		print FILE "cache_dir null /var/tmp\n\n";
-	} else {
-		print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
-	}
-
-	if (($proxysettings{'ERR_DESIGN'} eq 'ipfire' ))
-	{
-		print FILE "error_directory $errordir.ipfire/$proxysettings{'ERR_LANGUAGE'}\n\n";
-	} else {
-		print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
-	}
+	print FILE "error_directory $errordir/$proxysettings{'ERR_LANGUAGE'}\n\n";
 
 	if ($proxysettings{'OFFLINE_MODE'} eq 'on') {  print FILE "offline_mode on\n\n"; }
-
+	if ($proxysettings{'CACHE_DIGESTS'} eq 'on') {  print FILE "digest_generation on\n\n"; } else {  print FILE "digest_generation off\n\n"; }
+	
 	if ((!($proxysettings{'MEM_POLICY'} eq 'LRU')) || (!($proxysettings{'CACHE_POLICY'} eq 'LRU')))
 	{
 		if (!($proxysettings{'MEM_POLICY'} eq 'LRU'))
@@ -3066,15 +3157,20 @@ END
 		print FILE "\n";
 	}
 
+	if ($proxysettings{'CACHE_SIZE'} ne '0')
+	{
+		print FILE "cache_dir aufs /var/log/cache $proxysettings{'CACHE_SIZE'} $proxysettings{'L1_DIRS'} 256\n\n";
+	}
+
 	if ($proxysettings{'LOGGING'} eq 'on')
 	{
 		print FILE <<END
-access_log /var/log/squid/access.log
+access_log stdio:/var/log/squid/access.log
 cache_log /var/log/squid/cache.log
 cache_store_log none
 END
 	;
-		if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "useragent_log \/var\/log\/squid\/user_agent.log\n"; }
+		if ($proxysettings{'LOGUSERAGENT'} eq 'on') { print FILE "access_log stdio:\/var\/log\/squid\/user_agent.log useragent\n"; }
 		if ($proxysettings{'LOGQUERY'} eq 'on') { print FILE "\nstrip_query_terms off\n"; }
 	} else {
 		print FILE <<END
@@ -3107,7 +3203,7 @@ END
 	{
 		if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
 		{
-			print FILE "auth_param basic program $authdir/ncsa_auth $userdb\n";
+			print FILE "auth_param basic program $authdir/basic_ncsa_auth $userdb\n";
 			print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
 			print FILE "auth_param basic realm $authrealm\n";
 			print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
@@ -3116,7 +3212,8 @@ END
 
 		if ($proxysettings{'AUTH_METHOD'} eq 'ldap')
 		{
-			print FILE "auth_param basic program $authdir/squid_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
+			print FILE "auth_param basic utf8 on\n";
+			print FILE "auth_param basic program $authdir/basic_ldap_auth -b \"$proxysettings{'LDAP_BASEDN'}\"";
 			if (!($proxysettings{'LDAP_BINDDN_USER'} eq '')) { print FILE " -D \"$proxysettings{'LDAP_BINDDN_USER'}\""; }
 			if (!($proxysettings{'LDAP_BINDDN_PASS'} eq '')) { print FILE " -w $proxysettings{'LDAP_BINDDN_PASS'}"; }
 			if ($proxysettings{'LDAP_TYPE'} eq 'ADS')
@@ -3162,12 +3259,12 @@ END
 		{
 			if ($proxysettings{'NTLM_ENABLE_INT_AUTH'} eq 'on')
 			{
-				print FILE "auth_param ntlm program $authdir/ntlm_auth $proxysettings{'NTLM_DOMAIN'}/$proxysettings{'NTLM_PDC'}";
+				print FILE "auth_param ntlm program $authdir/ntlm_smb_lm_auth $proxysettings{'NTLM_DOMAIN'}/$proxysettings{'NTLM_PDC'}";
 				if ($proxysettings{'NTLM_BDC'} eq '') { print FILE "\n"; } else { print FILE " $proxysettings{'NTLM_DOMAIN'}/$proxysettings{'NTLM_BDC'}\n"; }
 				print FILE "auth_param ntlm children $proxysettings{'AUTH_CHILDREN'}\n";
 				if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; }
 			} else {
-				print FILE "auth_param basic program $authdir/msnt_auth\n";
+				print FILE "auth_param basic program $authdir/basic_msnt_auth\n";
 				print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
 				print FILE "auth_param basic realm $authrealm\n";
 				print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n";
@@ -3193,7 +3290,7 @@ END
 
 		if ($proxysettings{'AUTH_METHOD'} eq 'radius')
 		{
-			print FILE "auth_param basic program $authdir/squid_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
+			print FILE "auth_param basic program $authdir/basic_radius_auth -h $proxysettings{'RADIUS_SERVER'} -p $proxysettings{'RADIUS_PORT'} ";
 			if (!($proxysettings{'RADIUS_IDENTIFIER'} eq '')) { print FILE "-i $proxysettings{'RADIUS_IDENTIFIER'} "; }
 			print FILE "-w $proxysettings{'RADIUS_SECRET'}\n";
 			print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n";
@@ -3286,11 +3383,6 @@ END
 		print FILE "acl blocked_mimetypes rep_mime_type \"$mimetypes\"\n\n";
 	}
 
-	print FILE <<END
-acl all src 0.0.0.0/0.0.0.0
-acl localhost src 127.0.0.1/255.255.255.255
-END
-;
 open (PORTS,"$acl_ports_ssl");
 @temp = <PORTS>;
 close PORTS;
@@ -3312,12 +3404,12 @@ acl IPFire_https port $https_port
 acl IPFire_ips              dst $netsettings{'GREEN_ADDRESS'}
 acl IPFire_networks         src "$acl_src_subnets"
 acl IPFire_servers          dst "$acl_src_subnets"
-acl IPFire_green_network    src $netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}
-acl IPFire_green_servers    dst $netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}
+acl IPFire_green_network    src $green_cidr
+acl IPFire_green_servers    dst $green_cidr
 END
 	;
-	if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_network     src $netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}\n"; }
-	if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_servers     dst $netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}\n"; }
+	if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_network     src $blue_cidr\n"; }
+	if ($netsettings{'BLUE_DEV'}) { print FILE "acl IPFire_blue_servers     dst $blue_cidr\n"; }
 	if (!-z $acl_src_banned_ip) { print FILE "acl IPFire_banned_ips       src \"$acl_src_banned_ip\"\n"; }
 	if (!-z $acl_src_banned_mac) { print FILE "acl IPFire_banned_mac       arp \"$acl_src_banned_mac\"\n"; }
 	if (!-z $acl_src_unrestricted_ip) { print FILE "acl IPFire_unrestricted_ips src \"$acl_src_unrestricted_ip\"\n"; }
@@ -3336,8 +3428,7 @@ acl IPFire_no_access_mac arp "$acl_src_noaccess_mac"
 END
 		;
 		print FILE "deny_info ";
-		if ((($proxysettings{'ERR_DESIGN'} eq 'ipfire') && (-e "$errordir.ipfire/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")) ||
-		    (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")))
+		if (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED"))
 		{
 			print FILE "ERR_ACCESS_DISABLED";
 		} else {
@@ -3345,8 +3436,7 @@ END
 		}
 		print FILE " IPFire_no_access_ips\n";
 		print FILE "deny_info ";
-		if ((($proxysettings{'ERR_DESIGN'} eq 'ipfire') && (-e "$errordir.ipfire/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")) ||
-		    (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED")))
+		if (($proxysettings{'ERR_DESIGN'} eq 'squid') && (-e "$errordir/$proxysettings{'ERR_LANGUAGE'}/ERR_ACCESS_DISABLED"))
 		{
 			print FILE "ERR_ACCESS_DISABLED";
 		} else {
@@ -3365,7 +3455,7 @@ END
 	my $blue_net = ''; #BLUE empty by default
 	my $blue_ip = '';
 	if ($netsettings{'BLUE_DEV'} && $proxysettings{'ENABLE_BLUE'} eq 'on') {
-		$blue_net = "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
+		$blue_net = "$blue_cidr";
 		$blue_ip  = "$netsettings{'BLUE_ADDRESS'}";
 	}
 	if (!-z $acl_include)
@@ -3374,7 +3464,7 @@ END
 		print FILE "\n#Start of custom includes\n\n";
 		while (<ACL>) {
 			$_ =~ s/__GREEN_IP__/$netsettings{'GREEN_ADDRESS'}/;
-			$_ =~ s/__GREEN_NET__/$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}/;
+			$_ =~ s/__GREEN_NET__/$green_cidr/;
 			$_ =~ s/__BLUE_IP__/$blue_ip/;
 			$_ =~ s/__BLUE_NET__/$blue_net/;
 			$_ =~ s/__PROXY_PORT__/$proxysettings{'PROXY_PORT'}/;
@@ -3384,6 +3474,18 @@ END
 		close (ACL);
 	}
 	if ((!-z $extgrp) && ($proxysettings{'AUTH_METHOD'} eq 'ncsa') && ($proxysettings{'NCSA_BYPASS_REDIR'} eq 'on')) { print FILE "\nredirector_access deny for_extended_users\n"; }
+
+	# Check if squidclamav is enabled.
+	if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+		print FILE "\n#Settings for squidclamav:\n";
+		print FILE "http_port 127.0.0.1:$proxysettings{'PROXY_PORT'}\n";
+		print FILE "acl purge method PURGE\n";
+		print FILE "http_access deny to_localhost\n";
+		print FILE "http_access allow localhost\n";
+		print FILE "http_access allow purge localhost\n";
+		print FILE "http_access deny purge\n";
+		print FILE "url_rewrite_access deny localhost\n";
+	}
 	print FILE <<END
 
 #Access to squid:
@@ -3507,15 +3609,15 @@ if ($delaypools) {
 
 if ($proxysettings{'NO_PROXY_LOCAL'} eq 'on')
 {
-	print FILE "#Prevent internal proxy access to Green\n";
-	print FILE "http_access deny IPFire_green_servers !IPFire_green_network\n\n";
+	print FILE "#Prevent internal proxy access to Green except IPFire itself\n";
+	print FILE "http_access deny IPFire_green_servers !IPFire_ips !IPFire_green_network\n\n";
 }
 
 if ($proxysettings{'NO_PROXY_LOCAL_BLUE'} eq 'on')
 {
-	print FILE "#Prevent internal proxy access from Blue\n";
+	print FILE "#Prevent internal proxy access from Blue except IPFire itself\n";
 	print FILE "http_access allow IPFire_blue_network IPFire_blue_servers\n";
-	print FILE "http_access deny  IPFire_blue_network IPFire_servers\n\n";
+	print FILE "http_access deny  IPFire_blue_network !IPFire_ips IPFire_servers\n\n";
 }
 
 	print FILE <<END
@@ -3779,19 +3881,23 @@ END
 
 		if ($proxysettings{'FORWARD_IPADDRESS'} eq 'off')
 		{
-			print FILE "header_access X-Forwarded-For deny all\n";
+			print FILE "request_header_access X-Forwarded-For deny all\n";
+			print FILE "reply_header_access X-Forwarded-For deny all\n";
 		}
 		if ($proxysettings{'FORWARD_VIA'} eq 'off')
 		{
-			print FILE "header_access Via deny all\n";
+			print FILE "request_header_access Via deny all\n";
+			print FILE "reply_header_access Via deny all\n";
 		}
 		if (!($proxysettings{'FAKE_USERAGENT'} eq ''))
 		{
-			print FILE "header_access User-Agent deny all\n";
+			print FILE "request_header_access User-Agent deny all\n";
+			print FILE "reply_header_access User-Agent deny all\n";
 		}
 		if (!($proxysettings{'FAKE_REFERER'} eq ''))
 		{
-			print FILE "header_access Referer deny all\n";
+			print FILE "request_header_access Referer deny all\n";
+			print FILE "reply_header_access Referer deny all\n";
 		}
 
 		print FILE "\n";
@@ -3837,16 +3943,19 @@ END
 request_body_max_size $proxysettings{'MAX_OUTGOING_SIZE'} KB
 END
 	;
-	$replybodymaxsize = 1024 * $proxysettings{'MAX_INCOMING_SIZE'};
 	if ($proxysettings{'MAX_INCOMING_SIZE'} > 0) {
-		if (!-z $acl_src_unrestricted_ip) { print FILE "reply_body_max_size 0 allow IPFire_unrestricted_ips\n"; }
-		if (!-z $acl_src_unrestricted_mac) { print FILE "reply_body_max_size 0 allow IPFire_unrestricted_mac\n"; }
+		if (!-z $acl_src_unrestricted_ip) { print FILE "reply_body_max_size none IPFire_unrestricted_ips\n"; }
+		if (!-z $acl_src_unrestricted_mac) { print FILE "reply_body_max_size none IPFire_unrestricted_mac\n"; }
 		if ($proxysettings{'AUTH_METHOD'} eq 'ncsa')
 		{
-			if (!-z $extgrp) { print FILE "reply_body_max_size 0 allow for_extended_users\n"; }
+			if (!-z $extgrp) { print FILE "reply_body_max_size none for_extended_users\n"; }
 		}
 	}
-	print FILE "reply_body_max_size $replybodymaxsize allow all\n\n";
+	
+	if ( $proxysettings{'MAX_INCOMING_SIZE'} != '0' )
+	{
+		print FILE "reply_body_max_size $proxysettings{'MAX_INCOMING_SIZE'} KB all\n\n";
+	}
 
 	print FILE "visible_hostname";
 	if ($proxysettings{'VISIBLE_HOSTNAME'} eq '')
@@ -3856,7 +3965,11 @@ END
 		print FILE " $proxysettings{'VISIBLE_HOSTNAME'}\n\n";
 	}
 
-	if (!($proxysettings{'ADMIN_MAIL_ADDRESS'} eq '')) { print FILE "cache_mgr $proxysettings{'ADMIN_MAIL_ADDRESS'}\n\n"; }
+	if (!($proxysettings{'ADMIN_MAIL_ADDRESS'} eq '')) { print FILE "cache_mgr $proxysettings{'ADMIN_MAIL_ADDRESS'}\n"; }
+	if (!($proxysettings{'ADMIN_PASSWORD'} eq '')) { print FILE "cachemgr_passwd $proxysettings{'ADMIN_PASSWORD'} all\n"; }
+	print FILE "\n";
+
+	print FILE "max_filedescriptors $proxysettings{'FILEDESCRIPTORS'}\n\n";
 
 	# Write the parent proxy info, if needed.
 	if ($remotehost ne '')
@@ -3882,7 +3995,24 @@ END
 		print FILE "url_rewrite_program /usr/sbin/redirect_wrapper\n";
 		print FILE "url_rewrite_children $proxysettings{'CHILDREN'}\n\n";
 	}
+
+	# Include file with user defined settings.
+	if (-e "/etc/squid/squid.conf.local") {
+		print FILE "include /etc/squid/squid.conf.local\n";
+	}
 	close FILE;
+
+	# Proxy settings for squidclamav - if installed.
+	#
+	# Check if squidclamav is enabled.
+	if ($proxysettings{'ENABLE_CLAMAV'} eq 'on') {
+
+		my $configfile='/etc/squidclamav.conf';
+
+		my $data = &General::read_file_utf8($configfile);
+		$data =~ s/squid_port [0-9]+/squid_port $proxysettings{'PROXY_PORT'}/g;
+		&General::write_file_utf8($configfile, $data);
+	}
 }
 
 # -------------------------------------------------------------------
@@ -3954,3 +4084,15 @@ sub deluser
 }
 
 # -------------------------------------------------------------------
+
+sub writecachemgr
+{
+	open(FILE, ">${General::swroot}/proxy/cachemgr.conf");
+	flock(FILE, 2);
+	print FILE "$netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}\n";
+	print FILE "localhost";
+	close(FILE);
+  return;
+}
+
+# -------------------------------------------------------------------