function build()
{
$sock = new sockets();
$unix = new unix();
$ini = new Bs_IniHandler();
$squid = new squidbee();
$IPADDRSSL = array();
$IPADDRSSL2 = array();
$ArticaSquidParameters = $sock->GET_INFO('ArticaSquidParameters');
$SquidAsMasterPeer = intval($sock->GET_INFO("SquidAsMasterPeer"));
$SquidAsMasterPeerPort = intval($sock->GET_INFO("SquidAsMasterPeerPort"));
$SquidAsMasterPeerPortSSL = intval($sock->GET_INFO("SquidAsMasterPeerPortSSL"));
$SquidAsMasterPeerIPAddr = $sock->GET_INFO("SquidAsMasterPeerIPAddr");
$visible_hostname = $ini->_params["NETWORK"]["visible_hostname"];
if ($visible_hostname == null) {
$visible_hostname = $unix->hostname_g();
}
$SquidBinIpaddr = $sock->GET_INFO("SquidBinIpaddr");
$AllowAllNetworksInSquid = $sock->GET_INFO("AllowAllNetworksInSquid");
if (!is_numeric($AllowAllNetworksInSquid)) {
$AllowAllNetworksInSquid = 1;
}
$ini->loadString($ArticaSquidParameters);
$ZipProxyListenIpAdress = $sock->GET_INFO("ZipProxyListenIpAdress");
$zipproxy_port = intval($sock->GET_INFO("zipproxy_port"));
if ($zipproxy_port == 0) {
$zipproxy_port = 5561;
}
$zipproxy_MaxSize = intval($sock->GET_INFO("zipproxy_MaxSize"));
if ($zipproxy_MaxSize == 0) {
$zipproxy_MaxSize = 1048576;
}
$ZipProxyUnrestricted = intval($sock->GET_INFO("ZipProxyUnrestricted"));
$ConvertToGrayscale = intval($sock->GET_INFO("ConvertToGrayscale"));
$zipproxy_ProcessHTML = intval($sock->GET_INFO("zipproxy_ProcessHTML"));
$zipproxy_ProcessCSS = intval($sock->GET_INFO("zipproxy_ProcessCSS"));
$zipproxy_ProcessJS = intval($sock->GET_INFO("zipproxy_ProcessJS"));
NETWORK_ALL_INTERFACES();
if ($ZipProxyListenIpAdress != null) {
if (!isset($GLOBALS["NETWORK_ALL_INTERFACES"][$ZipProxyListenIpAdress])) {
$f[] = "# {$ZipProxyListenIpAdress} Interface Hardware error";
}
}
$dns_nameservers = $squid->dns_nameservers(true);
$hostname = $unix->hostname_g();
if ($SquidAsMasterPeerIPAddr == "0.0.0.0") {
$SquidAsMasterPeerIPAddr = null;
}
if ($SquidAsMasterPeerIPAddr == null) {
$SquidAsMasterPeerIPAddr = "127.0.0.1";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Listen......: {$ZipProxyListenIpAdress}:{$zipproxy_port}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Unrestricted: {$ZipProxyUnrestricted}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Master......: {$SquidAsMasterPeerIPAddr}:{$SquidAsMasterPeerPort}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Convert to g: {$ConvertToGrayscale}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Process JS..: {$zipproxy_ProcessJS}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Process CSS.: {$zipproxy_ProcessCSS}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Process HTML: {$zipproxy_ProcessHTML}\n";
}
$f[] = "############################";
$f[] = "# daemon mode-only options #";
$f[] = "############################";
$f[] = "";
$f[] = "## Port to listen for proxy connections";
$f[] = "## default: 8080";
$f[] = "Port = {$zipproxy_port}";
$f[] = "";
$f[] = "## Local address to listen for proxy connections";
$f[] = "## If you have more than one network interface,";
$f[] = "## it's useful for restricting to which interface you want to bind to.";
$f[] = "## By default Ziproxy binds to all interfaces.";
if ($ZipProxyListenIpAdress != null) {
$f[] = "Address = \"{$ZipProxyListenIpAdress}\"";
}
$f[] = "";
$f[] = "## Accepts conections only from that address.";
$f[] = "## WARNING: Remember to restrict the access to Ziproxy";
$f[] = "## if your machine is directly connected to the Internet.";
if ($ZipProxyUnrestricted == 0) {
$backends = $squid->backends_list();
$f[] = "OnlyFrom = \"" . @implode(" ", $backends) . "\"";
}
$f[] = "";
$f[] = "## Limits the number of simultaneous active user connections.";
$f[] = "## This does not affect the connection queue (see: SOMAXCONN).";
$f[] = "##";
$f[] = "## This also (indirectly) limits the number of processes Ziproxy will run";
$f[] = "## at once. Formula for the worst-case scenario:";
$f[] = "## MaxZiproxyProcesses = 1 + MaxActiveUserConnections";
$f[] = "## OR if PreemptNameRes is enabled (worst-case scenario):";
$f[] = "## MaxZiproxyProcesses = 1 + MaxActiveUserConnections * (1 + PreemptNameResMax)";
$f[] = "##";
$f[] = "## Valid values: 0 (no limit), >0 (max ative connections).";
$f[] = "##";
$f[] = "## default: 0 (no limit -- relies on OS limit instead)";
$f[] = "# MaxActiveUserConnections = 20";
$f[] = "PIDFile = \"/var/run/squid/ziproxy.pid\"";
$f[] = "RunAsUser = \"squid\"";
$f[] = "RunAsGroup = \"squid\"";
$f[] = "";
$f[] = "";
$f[] = "";
$f[] = "##################################";
$f[] = "# TOS marking (daemon mode-only) #";
$f[] = "##################################";
$f[] = "";
$f[] = "## TOS marking";
$f[] = "## Enable this if you want to specify the (IP-level) TOS certain types";
$f[] = "## of traffic from ziproxy -> user.";
$f[] = "##";
$f[] = "## This feature is useful if one wants to do application-level QoS.";
$f[] = "## Setting TOS does not provide QoS alone. You must be either using";
$f[] = "## a network with routers priorizing traffic according to their TOS,";
$f[] = "## or set your own QoS/traffic-shaper system and treat the packets";
$f[] = "## with certain TOS accordingly.";
$f[] = "##";
$f[] = "## Ziproxy is RFC-agnostic regarding TOS bit meanings,";
$f[] = "## though there may be limitations imposed by the host OS.";
$f[] = "## See: RFC 791, RFC 1122, RFC 1349, RFC 2474 and RFC 3168.";
$f[] = "##";
$f[] = "## If disabled, all other TOS options won't have effect.";
$f[] = "## Disabled by default.";
$f[] = "# TOSMarking = false";
$f[] = "";
$f[] = "## TOS to set by default";
$f[] = "## This is a decimal value between 0-255.";
$f[] = "##";
$f[] = "## If unset, will use the OS default (which usually is 0).";
$f[] = "## If you want to make sure it is set to 0, then set";
$f[] = "## this option accordingly.";
$f[] = "##";
$f[] = "## Your OS may put restrictions on which bits you may set";
$f[] = "## (so certain bits will remain unchanged regardless).";
$f[] = "## Your OS may also restrict which bits and/or value ranges";
$f[] = "## you may set if you're not running as root.";
$f[] = "## Other (non-unixish) OSes may be unable to set TOS at all.";
$f[] = "##";
$f[] = "## Default: unset.";
$f[] = "# TOSFlagsDefault = 0";
$f[] = "";
$f[] = "## TOS to set when the traffic is considered \"differentiated\",";
$f[] = "## according to TOSMarkAsDiffURL, TOSMarkAsDiffCT or TOSMarkAsDiffSizeBT.";
$f[] = "## This is a decimal value between 0-255.";
$f[] = "##";
$f[] = "## If unset, there will be no differentiated traffic at all.";
$f[] = "##";
$f[] = "## Your OS may put restrictions on which bits you may set";
$f[] = "## (so certain bits will remain unchanged regardless).";
$f[] = "## Your OS may also restrict which bits and/or value ranges";
$f[] = "## you may set if you're not running as root.";
$f[] = "## Other (non-unixish) OSes may be unable to set TOS at all.";
$f[] = "##";
$f[] = "## Default: unset.";
$f[] = "# TOSFlagsDiff = 16";
$f[] = "";
$f[] = "## This is the file containing a list of URLs which should";
$f[] = "## have their traffic \"differentiated\"";
$f[] = "## (that is, to have their TOS changed to TOSFlagsDiff).";
$f[] = "##";
$f[] = "## Inside the file, the URLs may also contain pattern-matching asterisks.";
$f[] = "## Comments may be present if prefixed by '#' (shell-alike).";
$f[] = "## In order to match a whole site: \"http://www.examplehost.xyz/*\"";
$f[] = "##";
$f[] = "## Default: none";
$f[] = "# TOSMarkAsDiffURL = \"/etc/ziproxy/change_tos.list\"";
$f[] = "";
$f[] = "## This is the content-type list of data that should";
$f[] = "## have their traffic \"differentiated\"";
$f[] = "## (that is, to have their TOS changed to TOSFlagsDiff).";
$f[] = "## This is the content-type as received by the remote HTTP server,";
$f[] = "## if it is changed by Ziproxy later, it will not be taken into account.";
$f[] = "##";
$f[] = "## \"\" (empty string) will match empty content-types AND data which have";
$f[] = "## no content-type specified.";
$f[] = "##";
$f[] = "## If no subtype is specified, all subtypes will match:";
$f[] = "## \"aaaa\" will match \"aaaa\", \"aaaa/bbbb\", \"aaaa/cccc\" etc";
$f[] = "##";
$f[] = "## See also: TOSMarkAsDiffCTAlsoXST";
$f[] = "## Default: none";
$f[] = "# TOSMarkAsDiffCT = {\"video/flv\", \"video/x-msvideo\", \"audio/*\",";
$f[] = "# \"application/x-shockwave-flash\", \"application/x-rpm\",";
$f[] = "# \"application/x-msi\", \"application/x-tar\"}";
$f[] = "";
$f[] = "## When using TOSMarkAsDiffCT, this defines whether to also automatically add";
$f[] = "## content-type entries with 'x-' prefix appended to subtypes";
$f[] = "## (aaaa/bbbb also adding aaaa/x-bbbb).";
$f[] = "## Usually it's convenient to do this way, that avoids worrying about";
$f[] = "## having to create duplicated entries, or whether which variant is valid.";
$f[] = "##";
$f[] = "## You may want to disable this is you wish to have a precise control";
$f[] = "## of what types of content-type you wish to include.";
$f[] = "##";
$f[] = "## See also: TOSMarkAsDiffCT";
$f[] = "## Default: true";
$f[] = "# TOSMarkAsDiffCTAlsoXST = true";
$f[] = "";
$f[] = "## This is the stream size threshold (in bytes) which, if reached,";
$f[] = "## will make such traffic \"differentiated\"";
$f[] = "## (that is, to have their TOS changed to TOSFlagsDiff).";
$f[] = "## The stream size is the ziproxy -> user one (which may be";
$f[] = "## bigger or smaller than the original one, sent by the HTTP server).";
$f[] = "##";
$f[] = "## There are two possible behaviors with this parameter:";
$f[] = "## - The total stream size is known beforehand, so the data";
$f[] = "## will be marked as differentiated from the beginning.";
$f[] = "## - The total stream size is unknown, so the data will";
$f[] = "## be marked as differentiated once it reaches that";
$f[] = "## size.";
$f[] = "##";
$f[] = "## Current limitations (this may change in the future):";
$f[] = "## - The maximum value to be specified here is signed int";
$f[] = "## usually 32bit -> (2^31 - 1).";
$f[] = "## - HTTP range requests are not taken into account so, if their effective";
$f[] = "## streams do not reach this threshold, such data will not be";
$f[] = "## marked as \"differentiated\", even if the HTTP range goes beyond that.";
$f[] = "## - Usually the HTTP headers will not be taken into account (only the body";
$f[] = "## size itself), except in cases such as CONNECT method";
$f[] = "## and URLNoProcessing (cases when the data from server is treated like";
$f[] = "## a \"black box\").";
$f[] = "##";
$f[] = "## Default: none";
$f[] = "# TOSMarkAsDiffSizeBT = 4000000";
$f[] = "";
$f[] = "";
$f[] = "";
$f[] = "###################";
$f[] = "# general options #";
$f[] = "###################";
$f[] = "";
$f[] = "# DebugLog = \"/var/log/squid/zipproxy-debug.log\"";
$f[] = "";
$f[] = "## Error-like messages logging.";
$f[] = "## This relates to error messages, warnings and such messages, including";
$f[] = "## configuration errors and other.";
$f[] = "## If undefined, defaults to stderr. In this case the (normally rare) errors";
$f[] = "## occuring after the program successfully started will not be displayed,";
$f[] = "## that to avoid the possibility of flooding the screen with error messages.";
$f[] = "## If defined, all error-like messages will be dumped into the specified";
$f[] = "## file. The exception are the errors occurring at the very early stages";
$f[] = "## of Ziproxy initialization.";
$f[] = "## WARNING: If you define a error log file and ziproxy initialization fails,";
$f[] = "## ziproxy will fail and no error will be displayed on the console.";
$f[] = "##";
$f[] = "## Default: undefined (dumps to stderr).";
$f[] = "ErrorLog = \"/var/log/squid/zipproxy-error.log\"";
$f[] = "";
$f[] = "## File to be used as access log.";
$f[] = "## If undefined, there will be no access logging at all.";
$f[] = "## Log format:";
$f[] = "##\tTIME (unix time as seconds.msecs)";
$f[] = "##\tPROCESS_TIME (ms)";
$f[] = "##\t[USER@]ADDRESS (address with daemon mode only)";
$f[] = "##\tFLAGS";
$f[] = "##\tORIGINAL_SIZE";
$f[] = "##\tSIZE_AFTER_(RE)COMPRESSION";
$f[] = "##\tMETHOD";
$f[] = "##\tURL";
$f[] = "## where FLAGS may be:";
$f[] = "## \tP (a request as proxy)";
$f[] = "##\tT (a request as transparent proxy)";
$f[] = "##\tS (CONNECT method, usually HTTPS data)";
$f[] = "##\tZ (transfer timeoutted - see ConnTimeout)";
$f[] = "##\tB (interrupted transfer - either by user or by remote http host)";
$f[] = "##\tW (content type was supposed to load into memory, but it had no content-size and, in the end, it was bigger than MaxSize. so it was streamed instead)";
$f[] = "##\tN (URL not processed. See: URLNoProcessing config option)";
$f[] = "##\tR (data was replaced)";
$f[] = "##\tQ (TOS was changed). See: URLReplaceData config option)";
$f[] = "##\tK (image too expansive. See: MaxUncompressedImageRatio config option)";
$f[] = "##\tG (stream gunzip too expansive. See: MinUncompressedGzipStreamEval, MaxUncompressedGzipRatio)";
$f[] = "##\t1 (SIGSEGV received)";
$f[] = "##\t2 (SIGFPE received)";
$f[] = "##\t3 (SIGILL received)";
$f[] = "##\t4 (SIGBUS received)";
$f[] = "##\t5 (SIGSYS received)";
$f[] = "##\tX (SIGTERM received - also happens when interrupting the daemon while transferring)";
$f[] = "## Disabled by default.";
$f[] = "AccessLog = \"/var/log/squid/access-ziproxy.log\"";
$f[] = "";
$f[] = "## When enabled, Ziproxy will intercept signals indicative of";
$f[] = "## software crash, flag the offending request in access log";
$f[] = "## accordingly, then stop the offending process.";
$f[] = "## This is useful for debugging purposes and it's not recommended";
$f[] = "## to leave it enabled in normal use due to the risk of garbage";
$f[] = "## being written to access log (due to a more severe crash).";
$f[] = "## Once enabled, the intercepted signals are:";
$f[] = "## SIGSEGV (segmentation fault)";
$f[] = "## SIGFPE (FPU exception)";
$f[] = "## SIGILL (illegal instruction)";
$f[] = "## SIGBUS (bus error, alignment issues)";
$f[] = "## SIGSYS (bad system call)";
$f[] = "## Disabled by default (those signals not intercepted by Ziproxy)";
$f[] = "# InterceptCrashes = false";
$f[] = "";
$f[] = "## Authentication mode to be used for proxy access:";
$f[] = "## 0: none (no authentication required)";
$f[] = "## 1: plain text file";
$f[] = "## 2: SASL (auxprop, see /etc/ziproxy/sasl/ziproxy.conf)";
$f[] = "##";
$f[] = "## Notes:";
$f[] = "## a) SASL support is optional (enabled during compilation time).";
$f[] = "## b) SASL authentication does not require external SASL daemon";
$f[] = "## configuration/invocation, just Ziproxy's SASL configuration.";
$f[] = "##";
$f[] = "## Default: 0 (no authentication required)";
$f[] = "## See also: AuthPasswdFile, AuthSASLConfPath";
$f[] = "AuthMode = 0";
$f[] = "";
$f[] = "## Plain text file containing authentication data.";
$f[] = "## Should contain user:pass pairs, lines no longer than 128 chars.";
$f[] = "## Password is unencrypted.";
$f[] = "## Used only when AuthMode=1";
$f[] = "##";
$f[] = "## Default: (undefined)";
$f[] = "## See also: AuthMode";
$f[] = "# AuthPasswdFile = \"/etc/ziproxy/http.passwd\"";
$f[] = "";
$f[] = "## Path to Ziproxy's SASL configuration file, where";
$f[] = "## a file named \"ziproxy.conf\" (not related to this one)";
$f[] = "## must be present and properly configured.";
$f[] = "## Used only when AuthMode=2";
$f[] = "##";
$f[] = "## Default: (default SASL setting, OS-dependent, may be /etc/sasl2/)";
$f[] = "## See also: AuthMode";
$f[] = "# AuthSASLConfPath = \"/etc/ziproxy/sasl/\"";
$f[] = "";
$f[] = "## Forward everything to another proxy server.";
$f[] = "## Modifications/compression is still applied.";
$f[] = "## Default: none (disabled)";
if ($SquidAsMasterPeerIPAddr != null) {
$f[] = "NextProxy=\"{$SquidAsMasterPeerIPAddr}\"";
$f[] = "NextPort={$SquidAsMasterPeerPort}";
}
$f[] = "";
$f[] = "## Use these DNS name servers to resolve hostnames";
$f[] = "## instead of the ones configured in /etc/resolv.conf";
if (count($dns_nameservers) > 0) {
$dnscompiled = trim(@implode(",", $FDNS));
if ($dnscompiled != null) {
while (list($num, $dns) = each($dns_nameservers)) {
$FDNS[] = "\"{$dns}\"";
}
$f[] = "Nameservers = { " . @implode(",", $FDNS) . "}";
}
}
$f[] = "";
$f[] = "## Bind outgoing connections (to remote HTTP server) to the following (local) IPs";
$f[] = "## It applies to the _outgoing_ connections, it has _no_ relation to the listener socket.";
$f[] = "## When 2 or more IPs are specified, Ziproxy will rotate to each of those at each";
$f[] = "## outgoing connection. All IPs have the same priority.";
$f[] = "## You may use this option for either of the following reasons:";
$f[] = "## 1. - To use only a specific IP when connecting to remote HTTP servers.";
$f[] = "## 2. - Use 2 or more IPs for load balancing (a rather primitive one, since it's";
$f[] = "## connection-based and does not take into account the bytes transferred).";
$f[] = "## 3. - You have a huge intranet and certain sites (google.com, for example)";
$f[] = "## are blocking your requests because there are so many coming from the same IP.";
$f[] = "## So you may use 2 or more IPs here and make it appear that your requests";
$f[] = "## come from several different machines.";
$f[] = "## This option does _not_ spoof packets, it merely uses the host's local IPs.";
$f[] = "## Note: While in (x)inetd mode, output may be bind-ed only to one IP.";
$f[] = "## Disabled by default (binds to the default IP, the OS decides which one).";
$f[] = "## See also: BindOutgoingExList";
$f[] = "# BindOutgoing = { \"234.22.33.44\", \"4.3.2.1\", \"44.200.34.11\" }";
$f[] = "";
$f[] = "## Specifies a file containing a list of hosts which should not suffer";
$f[] = "## IP rotation as specified by the option \"BindOutgoing\".";
$f[] = "## The reason for this option is that certain services do not like";
$f[] = "## the client IP changing in the same session.";
$f[] = "## Certain webmail services fail or return authentication failure in this case.";
$f[] = "## Example: www.bol.com.br";
$f[] = "## This option has no effect if BindOutgoing is not used.";
$f[] = "## Default: empty, no hosts are exempted.";
$f[] = "## See also: BindOutgoingExAddr";
$f[] = "# BindOutgoingExList=\"/etc/ziproxy/bo_exception.list\"";
$f[] = "";
$f[] = "## Defines a specific IP to be bound to for hosts specified in BindOutgoingExList.";
$f[] = "## As with BindOutgoing, this IP must be a local IP from the server running Ziproxy.";
$f[] = "## This IP may be one of those specified in BindOutgoing, but that's _not_";
$f[] = "## a requirement and may be a different IP.";
$f[] = "## This option has no effect if BindOutgoingExList is not being used.";
$f[] = "## Default: empty, uses the first IP specified in BindOutgoing.";
$f[] = "# BindOutgoingExAddr=\"98.7.65.43\"";
$f[] = "";
$f[] = "## Allow processing of requests as transparent proxy";
$f[] = "## (will still accept normal proxy requests)";
$f[] = "## In order to use Ziproxy as transparent proxy it's also needed";
$f[] = "## to reroute the connections from x.x.x.x:80 to ziproxy.host:PROXY_PORT";
$f[] = "## Disabled by default.";
$f[] = "## See also: RestrictOutPortHTTP";
$f[] = "# TransparentProxy = false";
$f[] = "";
$f[] = "## Whether to process normal proxy requests or not";
$f[] = "## Only makes sense when TransparentProxy is enabled.";
$f[] = "## If transparent proxy is enabled, it's usually a good idea to disable";
$f[] = "## conventional proxying since, depending on the layout of your network,";
$f[] = "## it can be abused by ill-meant users to circumvent restrictions";
$f[] = "## presented by another proxy placed between Ziproxy and the users.";
$f[] = "## Enabled by default.";
$f[] = "ConventionalProxy = true";
$f[] = "";
$f[] = "## Whether to allow the CONNECT method.";
$f[] = "## This method is used by HTTPS, but may be used for other";
$f[] = "## types of service (like instant messenging) which allow tunneling through http proxy.";
$f[] = "## If you plan on serving only HTTP requests (no HTTPS nor anything else)";
$f[] = "## you may want to disable this, in order to prevent potential";
$f[] = "## abuse of the service.";
$f[] = "## Enabled by default.";
$f[] = "## See also: RestrictOutPortCONNECT";
$f[] = "AllowMethodCONNECT = true";
$f[] = "";
$f[] = "## If defined, restricts the outgoing connections (except CONNECT methods - used by HTTPS)";
$f[] = "## to the listed destination ports.";
$f[] = "## If TransparentProxy is used, for security reasons it's recommended to restrict";
$f[] = "## to the ports (typically port 80) which are being intercepted.";
$f[] = "## Default: all ports are allowed.";
$f[] = "## See also: RestrictOutPortCONNECT";
$f[] = "# RestrictOutPortHTTP = {80, 8080}";
$f[] = "";
$f[] = "## If defined, restricts the outgoing connections using the CONNECT method (used by HTTPS)";
$f[] = "## to the listed destination ports.";
$f[] = "## If AllowMethodCONNECT=false, then no ports are allowed at all regardless this list.";
$f[] = "## Default: all ports are allowed.";
$f[] = "## See also: AllowMethodCONNECT, RestrictOutPortHTTP";
$f[] = "# RestrictOutPortCONNECT = {443}";
$f[] = "";
$f[] = "## Whether to override the Accept-Encoding more to Ziproxy's liking.";
$f[] = "## If disabled, Ziproxy will just forward Accept-Encoding received from the client";
$f[] = "## (thus the data may or not come gzipped, depending on what the HTTP client says).";
$f[] = "##";
$f[] = "## Currently, this option is used to always advertise Gzip capability to";
$f[] = "## the remote HTTP server.";
$f[] = "## Enabling this does not neccessarily mean that the data will come compressed";
$f[] = "## from the server. This option just advertises the capability at Ziproxy's side,";
$f[] = "## the remote server must support that capability aswell.";
$f[] = "##";
$f[] = "## This has _no_ relation to the Gzip support between Ziproxy and the client, thus";
$f[] = "## you may leave this enabled even if you have clients that do not support Gzip.";
$f[] = "## Ziproxy will compress/decompress the data according to the client.";
$f[] = "##";
$f[] = "## Enabled by default.";
$f[] = "OverrideAcceptEncoding = true";
$f[] = "DecompressIncomingGzipData = true";
$f[] = "";
$f[] = "## Replaces the User-Agent data sent by the client with a custom string,";
$f[] = "## OR defines User-Agent with that string if that entry was not defined.";
$f[] = "## If disabled, Ziproxy will just forward the User-Agent sent by the client.";
$f[] = "## Normally you will want to leave this option DISABLED (commented).";
$f[] = "##";
$f[] = "## It's useful if you, for some reason, want to identify all the clients as";
$f[] = "## some specific browser/version/OS.";
$f[] = "## Certain websites may appear broken if the client uses a different browser than";
$f[] = "## the one specified here.";
$f[] = "## Certain webservers may break completely when an unrecognized User-Agent is provided";
$f[] = "## (for example: www.rzeczpospolita.pl).";
$f[] = "##";
$f[] = "## Undefined by default (leave User-Agent as defined by the client).";
$f[] = "# RedefineUserAgent = \"Mozilla/5.0 (compatible; UltraBrowser/8.1; CP/M; console40x24; z80)\"";
$f[] = "";
$f[] = "## When Ziproxy receives Gzip data it will try to decompress in order to do";
$f[] = "## further processing (HTMLopt, PreemptDNS etc).";
$f[] = "## This makes Ziproxy vulnerable to 'gzip-bombs' (eg. like 10 GB of zeroes, compressed)";
$f[] = "## which could be used to slow down or even crash the server.";
$f[] = "## In order to avoid/minimise such problems, you can limit the max";
$f[] = "## decompression proportion, related to the original file.";
$f[] = "## If a Gzipped file exceedes that proportion while decompressing, its";
$f[] = "## decompression is aborted.";
$f[] = "## The user will receive an error page instead or (if already transferring)";
$f[] = "## transfer will simply be aborted.";
$f[] = "##";
$f[] = "## You may disable this feature defining its value to '0'.";
$f[] = "## default: 2000 (that's 2000% == 20 times the compressed size)";
$f[] = "MaxUncompressedGzipRatio = 2000";
$f[] = "";
$f[] = "## When limiting decompression rate with MaxUncompressedGzipRatio";
$f[] = "## _and_ gunzipping while streaming it's not possible to know the";
$f[] = "## file size until the transfer is finished. So Ziproxy verifies this while";
$f[] = "## decompressing.";
$f[] = "## The problem by doing this is the possible false positives:";
$f[] = "## certain files compress a lot at their beginning, but then not-so";
$f[] = "## shortly after.";
$f[] = "## In order to prevent/minimize such problems, we define the minimum";
$f[] = "## output (the decompressed data) generated before starting to";
$f[] = "## check the decompression rate.";
$f[] = "## If defined as '0', it will check the rate immediately.";
$f[] = "## A too large value will increase the rate-limit precision, at the cost of less";
$f[] = "## protection.";
$f[] = "## Streams with output less that this value won't have decompression";
$f[] = "## rate checking at all.";
$f[] = "## This feature is only active if MaxUncompressedGzipRatio is defined.";
$f[] = "## This does not affect data wholly loaded to memory (for further processing).";
$f[] = "## default: 10000000 (bytes)";
$f[] = "## Note: The previous default (until version 2.7.9_BETA) was 250000";
$f[] = "## See also: MaxUncompressedGzipRatio";
$f[] = "MinUncompressedGzipStreamEval = 10000000";
$f[] = "";
$f[] = "## This is the maximum compression rate allowable for an incoming";
$f[] = "## (before recompression) image file.";
$f[] = "## If an image has a higher compression rate than this, it will not";
$f[] = "## be unpacked and it will be forwarded to the client as is.";
$f[] = "## This feature protects against (or mitigates) the problem with";
$f[] = "## \"image bombs\" (gif bombs, etc) done with huge bitmaps with the same";
$f[] = "## pixel color (thus very small once compressed).";
$f[] = "## Since Ziproxy may try to recompress the image, if several of this";
$f[] = "## kind are requested, the server may run out of memory, so this";
$f[] = "## may be used as a DoS attack against Ziproxy.";
$f[] = "## This feature will not protect the client, since it will receive";
$f[] = "## the unmodified picture.";
$f[] = "## There are rare legitimate cases matching such high compression rate,";
$f[] = "## including poor website design. But in such cases is not really worth";
$f[] = "## recompressing anyway (the processing costs are not worth the savings).";
$f[] = "## Usually \"image bomb\" pictures have a >1000:1 compression ratio.";
$f[] = "## Setting this to less than 100 risks not processing legitimate pictures.";
$f[] = "## Setting 0 disables this feature.";
$f[] = "## Default: 500 (500:1 ratio)";
$f[] = "MaxUncompressedImageRatio = 0";
$f[] = "";
$f[] = "## If specified, ziproxy will send and check Via: header";
$f[] = "## with given string as host identification.";
$f[] = "## It is sometimes useful to avoid request loops. Default: not specified";
$f[] = "ViaServer = \"zipproxy-{$hostname}\"";
$f[] = "";
$f[] = "## If processing of request exceeds specified time in seconds,";
$f[] = "## or connection is idle beyond that time (stalled) it will abort.";
$f[] = "## This avoids processes staying forever (or for a very long time)";
$f[] = "## in case of a stalled connection or software bug.";
$f[] = "## This will NOT necessarily abort the streaming of very big files,";
$f[] = "## it will ONLY if the connection stalls or there's a software bug.";
$f[] = "## If \"0\", no timeout.";
$f[] = "## Default: 90 (seconds)";
$f[] = "ConnTimeout = 90";
$f[] = "";
$f[] = "## Max file size to try to (re)compress, in bytes;";
$f[] = "## If \"0\", means that this limitation won't apply.";
$f[] = "## This regards to the file size as received from the remote HTTP server";
$f[] = "## (which may arrive gzipped or not -- it doesn't matter).";
$f[] = "## If a file is bigger than this limit, Ziproxy will simply stream it unmodified,";
$f[] = "## unless the user also requested gzip compression (see below).";
$f[] = "## Attention: If setting a very big size, the request answer latency will";
$f[] = "## increase since Ziproxy needs to fetch the whole file before";
$f[] = "## attempting to (re)compress it.";
$f[] = "## A too low value will prevent data bigger that that to de processed";
$f[] = "## (jpg/png/gif recompression, htmlopt, preemptdns..).";
$f[] = "## Note that if:";
$f[] = "## - Only gzipping is to be applied *OR*";
$f[] = "## - Gzipping and other is to be applied, but data is > MaxSize";
$f[] = "## Gzip compression (and only that) will be applied while streaming.";
$f[] = "## Default: 1048576 (bytes)";
$f[] = "## (default used to be \"0\" in ziproxy 2.3.0 and earlier)";
$f[] = "MaxSize = {$zipproxy_MaxSize}";
$f[] = "UseContentLength = false";
$f[] = "";
$f[] = "## Whether to try to apply lossless compression with gzip.";
$f[] = "## This option concerns traffic between Ziproxy and the client only.";
$f[] = "## This optimization is not limited by MaxSize.";
$f[] = "##";
$f[] = "## Gzip compression applies only to content-types specified with";
$f[] = "## the parameter LosslessCompressCT.";
$f[] = "##";
$f[] = "## See also: LosslessCompressCT";
$f[] = "## Default: true";
$f[] = "Gzip = true";
$f[] = "";
$f[] = "## This parameter specifies what kind of content-type is to be";
$f[] = "## considered lossless compressible (that is, data worth applying gzip).";
$f[] = "##";
$f[] = "## Images, movies etc, normally are NOT compressible such way and those";
$f[] = "## content-types should not be added (such data would turn slightly bigger";
$f[] = "## and CPU would be wasted).";
$f[] = "##";
$f[] = "## See also: LosslessCompressCTAlsoXST, Gzip";
$f[] = "## Default: an internal list of the most common compressible content-types.";
$f[] = "LosslessCompressCT = {";
$f[] = "\t\"text/*\", ";
$f[] = "\t\"application/asp\", ";
$f[] = "\t\"application/awk\", ";
$f[] = "\t\"application/cgi\", ";
$f[] = "\t\"application/class\", ";
$f[] = "\t\"application/css\", ";
$f[] = "\t\"application/dvi\", ";
$f[] = "\t\"application/executable\", ";
$f[] = "\t\"application/font\", ";
$f[] = "\t\"application/futuresplash\", ";
$f[] = "\t\"application/iso9660-image\", ";
$f[] = "\t\"application/java\", ";
$f[] = "\t\"application/javascript\", ";
$f[] = "\t\"application/json\", ";
$f[] = "\t\"application/msexcel\", ";
$f[] = "\t\"application/mspowerpoint\", ";
$f[] = "\t\"application/msword\", ";
$f[] = "\t\"application/pdf\", ";
$f[] = "\t\"application/perl\", ";
$f[] = "\t\"application/php\", ";
$f[] = "\t\"application/postscript\", ";
$f[] = "\t\"application/python\", ";
$f[] = "\t\"application/rtf\", ";
$f[] = "\t\"application/shellscript\", ";
$f[] = "\t\"application/shockwave\", ";
$f[] = "\t\"application/staroffice\", ";
$f[] = "\t\"application/tar\", ";
$f[] = "\t\"application/truetype-font\", ";
$f[] = "\t\"application/vnd.*\", ";
$f[] = "\t\"application/*+xml\", ";
$f[] = "\t\"application/xml\", ";
$f[] = "\t\"application/xml-dtd\", ";
$f[] = "\t\"image/svg+xml\"";
$f[] = " }";
$f[] = "";
$f[] = "## When using LosslessCompressCT, this defines whether to also automatically add";
$f[] = "## content-type entries with 'x-' prefix appended to subtypes";
$f[] = "## (aaaa/bbbb also adding aaaa/x-bbbb).";
$f[] = "## Usually it's convenient to do this way, that avoids worrying about";
$f[] = "## having to create duplicated entries, or whether which variant is valid.";
$f[] = "##";
$f[] = "## Note: If LosslessCompressCT is undefined (thus the internal defaults";
$f[] = "## are being used) this option has no effect.";
$f[] = "##";
$f[] = "## You may want to disable this is you wish to have a precise control";
$f[] = "## of what types of content-type you wish to include.";
$f[] = "##";
$f[] = "## See also: LosslessCompressCT";
$f[] = "## Default: true";
$f[] = "LosslessCompressCTAlsoXST = true";
$f[] = "";
$f[] = "## Whether to try to (re)compress incoming data originally in";
$f[] = "## the following formats (true) or not (false)";
$f[] = "## default: true";
$f[] = "ProcessJPG = true";
$f[] = "ProcessPNG = true";
$f[] = "ProcessGIF = true";
$f[] = "";
$f[] = "## Whether to try to optimize HTML, CSS and Javascript, thus reducing their size";
$f[] = "## ProcessHTML: text/html";
$f[] = "## ProcessCSS: text/css";
$f[] = "## ProcessJS: application/[x-]javascript)";
$f[] = "## Although such data may be Gzipped too, optimizing prior to Gzipping normally";
$f[] = "## reduces the data size even further.";
$f[] = "## The final size depends much on how unoptimal is the coding of such data;";
$f[] = "## some sites already present HTML pre-optimized so, in such cases, there won't";
$f[] = "## be much gain.";
$f[] = "## Note: Due to the higher complexity of such optimization, there's some risk of a page";
$f[] = "## being corrupted.";
$f[] = "## ****** THESE OPTIONS ARE EXPERIMENTAL ******";
$f[] = "##";
if ($zipproxy_ProcessHTML == 1) {
$zipproxy_ProcessHTML = "true";
} else {
$zipproxy_ProcessHTML = "false";
}
if ($zipproxy_ProcessCSS == 1) {
$zipproxy_ProcessCSS = "true";
} else {
$zipproxy_ProcessCSS = "false";
}
if ($zipproxy_ProcessJS == 1) {
$zipproxy_ProcessJS = "true";
} else {
$zipproxy_ProcessJS = "false";
}
$f[] = "ProcessHTML = {$zipproxy_ProcessHTML}";
$f[] = "ProcessCSS = {$zipproxy_ProcessCSS}";
$f[] = "ProcessJS = {$zipproxy_ProcessJS}";
$f[] = "";
$f[] = "## Options for fine-tuning text/html optimization.";
$f[] = "## Only used when ProcessHTML=true";
$f[] = "## Certain optimizations may be disabled as quick 'fix' when a text data";
$f[] = "## gets currupted after being optimized.";
$f[] = "## Note: CSS and JS switches apply _only_ to such data when embedded into HTML data,";
$f[] = "## for JS, CSS-only data, see ProcessJS and ProcessCSS options.";
$f[] = "##";
if ($zipproxy_ProcessHTML == 1) {
$f[] = "ProcessHTML_CSS = true";
$f[] = "ProcessHTML_JS = true";
$f[] = "ProcessHTML_tags = true";
$f[] = "ProcessHTML_text = true";
$f[] = "ProcessHTML_PRE = true";
$f[] = "ProcessHTML_NoComments = true";
$f[] = "ProcessHTML_TEXTAREA = true";
}
$f[] = "";
$f[] = "## If enabled, will discard PNG/GIF/JP2K transparency and de-animate";
$f[] = "## GIF images if necessary for recompression, at the cost of some image";
$f[] = "## distortion.";
$f[] = "## Note: Images with useless transparency/alpha data (all pixels";
$f[] = "## being opaque) do not require this option. In such cases Ziproxy";
$f[] = "## will detect that and remove the useless data automatically.";
$f[] = "## Disabled by default.";
$f[] = "AllowLookChange = true";
$f[] = "";
$f[] = "## If enabled, convert images to grayscale before recompressing.";
$f[] = "## This provides extra compression, at the cost of losing color data.";
$f[] = "## Note: Not all images sent will be in grayscale, only the ones";
$f[] = "## considered worth recompression that way.";
$f[] = "## Disabled by default.";
if ($ConvertToGrayscale == 1) {
$f[] = "ConvertToGrayscale = true";
}
$f[] = "## Preemptive Name Resolution";
$f[] = "## If enabled, tries to resolve hostnames present in the processed HTML files";
$f[] = "## for speeding up things (no delay for name resolution).";
$f[] = "## One extra process + (max)PreemptNameResMax threads will run for each HTML request.";
$f[] = "## PreemptNameResMax is the max hostnames it will try to resolve per HTML file.";
$f[] = "## PreemptNameResBC \"bogus check\", ignore names whose domains are not .nnnn, .nnn or .nn";
$f[] = "##";
$f[] = "## WARNING: This option makes sense _only_ if you have a caching DNS or";
$f[] = "## a name cache of some sort (like: PDNSD).";
$f[] = "## == THIS OPTION WILL INCREASE BY MANY TIMES THE REQUESTS TO THE DNS ==";
$f[] = "##";
$f[] = "# PreemptNameRes = false";
$f[] = "# PreemptNameResMax = 50";
$f[] = "# PreemptNameResBC = true";
$f[] = "";
$f[] = "## Image quality for JPG (JPEG) compression.";
$f[] = "## Image quality is specified in integers between 100 (best) and 0 (worst).";
$f[] = "ImageQuality = {30,25,25,20}";
$f[] = "";
$f[] = "## Alpha channel (image transparency data) removal threshold";
$f[] = "## Removes alpha channel from images with a minimum opacity";
$f[] = "## of AlphaRemovalMinAvgOpacity";
$f[] = "## (1000000: completely opaque, 0: completely transparent).";
$f[] = "##";
$f[] = "## This reduces data by removing unnecessary alpha channel from";
$f[] = "## fully-opaque images; and from (subjectively) not-so-relevant transparency";
$f[] = "## information.";
$f[] = "## This also allows recompression to JPEG for PNG/JP2k images originally";
$f[] = "## with alpha channel (which is not supported by JPEG image format).";
$f[] = "## Note: Debug log reports the average alpha opacity for each";
$f[] = "## image with alpha channel.";
$f[] = "## Default: 1000000 (remove alpha only from fully-opaque images)";
$f[] = "##";
$f[] = "# AlphaRemovalMinAvgOpacity = 1000000";
$f[] = "";
$f[] = "## Workaround for MSIE's pseudo-feature \"Show friendly HTTP error messages.\"";
$f[] = "## If User-Agent=MSIE, don't change/compress the body of error messages in any way.";
$f[] = "## If compressed it could go down below to 256 or 512 bytes and be replaced with";
$f[] = "## a local error message instead.";
$f[] = "## In certain cases the body has crucial data, like HTML redirection or so, and";
$f[] = "## that would be broken if a \"friendly error\" replaces it.";
$f[] = "##";
$f[] = "## If you are sure there are no users using MSIE's with \"friendly error messages\"";
$f[] = "## enabled, or you don't support/have users with such configuration, you may";
$f[] = "## disable this and have error data compressed for MSIE users.";
$f[] = "## This workaround does not affect other clients at all, and error messages";
$f[] = "## will be sent compressed if the client supports it.";
$f[] = "##";
$f[] = "## Enabled by default.";
$f[] = "# WA_MSIE_FriendlyErrMsgs = true";
$f[] = "";
$f[] = "## This option specifies a file containing a list of URLs that should be tunneled";
$f[] = "## by Ziproxy with no kind of processing whatsoever.";
$f[] = "## The list contain fully-formatted URLS (http://xxx/xxx), one URL per line.";
$f[] = "## The URLs may also contain pattern-matching asterisks.";
$f[] = "## Comments may be present if prefixed by '#' (shell-alike).";
$f[] = "## In order to exempt a whole site from processing: \"http://www.exemptedhost.xyz/*\"";
$f[] = "##";
$f[] = "## This option exists when a page is known to stop working under Ziproxy processing";
$f[] = "## and there's no specific workaround/bugfix still available.";
$f[] = "## Thus, this is a temporary solution when you depend on the page to work in a";
$f[] = "## production environment.";
$f[] = "##";
$f[] = "## ****** REMEMBER TO REPORT BUGS/INCOMPATIBILITIES SO THEY MAY BE FIXED *******";
$f[] = "## *** THIS IS NOT SUPPOSED TO BE A DEFINITIVE SOLUTION TO INCOMPATIBILITIES ***";
$f[] = "##";
$sql = "SELECT pattern,PatternType FROM webfilters_blkwhlts WHERE blockType=4 AND enabled=1";
$q = new mysql_squid_builder();
$acl = array();
$results = $q->QUERY_SQL($sql);
while ($ligne = @mysql_fetch_array($results, MYSQL_ASSOC)) {
$www = trim($ligne["pattern"]);
if ($www == null) {
continue;
}
if ($ligne["PatternType"] == 2) {
$sq = new squid_acls();
$sqgroups = $sq->GetItems($www, "dstdomain");
while (list($indexed, $www) = each($sqgroups)) {
$www = $this->BaseNameWebSite($www);
if ($www == null) {
continue;
}
if (isset($already[$www])) {
continue;
}
$already[$www] = true;
$acl[] = "http://{$www}/*";
$acl[] = "http://www.{$www}/*";
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Ban processing {$www}\n";
}
continue;
}
continue;
}
if ($ligne["PatternType"] != 0) {
continue;
}
$www = $this->BaseNameWebSite($www);
if ($www == null) {
continue;
}
if (isset($already[$www])) {
continue;
}
$already[$www] = true;
$acl[] = "http://{$www}/*";
$acl[] = "http://www.{$www}/*";
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Ban processing {$www}\n";
}
}
if (count($acl) > 0) {
@file_put_contents("/etc/ziproxy/noprocess.list", @implode("\n", $acl));
$f[] = "URLNoProcessing = \"/etc/ziproxy/noprocess.list\"";
}
$f[] = "";
$f[] = "## This option specifies a file containing a list of URLs which its";
$f[] = "## data should be intercepted and replaced by another.";
$f[] = "## Header data such as cookies is maintained.";
$f[] = "## Currently the only replacing data available is an empty image";
$f[] = "## (1x1 transparent pixel GIF).";
$f[] = "##";
$f[] = "## The list contain fully-formatted URLS (http://xxx/xxx), one URL per line.";
$f[] = "## The URLs may also contain pattern-matching asterisks.";
$f[] = "## Comments may be present if prefixed by '#' (shell-alike).";
$f[] = "## In order to exempt a whole site from processing: \"http://ad.somehost.xyz/*\"";
$f[] = "##";
$f[] = "## The way it is, this option may be used as an AD-BLOCKER which is";
$f[] = "## transparent to the remote host (data is downloaded from the remove server";
$f[] = "## and cookies are transported) -- a stealthy ad-blocker, if you like.";
$f[] = "##";
$f[] = "## Default: empty (no file specified, inactive)";
$f[] = "## See also: URLReplaceDataCT";
$f[] = "# URLReplaceData = \"/etc/ziproxy/replace.list\"";
$f[] = "";
$f[] = "## Same as URLReplaceData, except it will only replace the data";
$f[] = "## from matching URLs if the content-type matches";
$f[] = "## the list in URLReplaceDataCTList (mandatory parameter) aswell.";
$f[] = "##";
$f[] = "## URLReplaceDataCT may be useful as a more compatible AD-BLOCKER";
$f[] = "## if only visual files are replaced. Certain websites rely on";
$f[] = "## external javascript from advertisement hosts and break when";
$f[] = "## that data is missing, this is a way to block advertisements";
$f[] = "## in such cases.";
$f[] = "##";
$f[] = "## Default: empty (no file specified, inactive)";
$f[] = "## See also: URLReplaceDataCTList, URLReplaceData";
$f[] = "# URLReplaceDataCT = \"/etc/ziproxy/replace_ct.list\"";
$f[] = "";
$f[] = "## List of content-types to use with the URLReplaceDataCT option.";
$f[] = "## This option is required by URLReplaceDataCT.";
$f[] = "## Default: empty (no content-type specified, inactive)";
$f[] = "## See also: URLReplaceDataCTListAlsoXST, URLReplaceDataCT";
$f[] = "# URLReplaceDataCTList = {\"image/jpeg\", \"image/gif\", \"image/png\", \"application/x-shockwave-flash\"}";
$f[] = "";
$f[] = "## When using URLReplaceDataCTList, this defines whether to also automatically add";
$f[] = "## content-type entries with 'x-' prefix appended to subtypes";
$f[] = "## (aaaa/bbbb also adding aaaa/x-bbbb).";
$f[] = "## Usually it's convenient to do this way, that avoids worrying about";
$f[] = "## having to create duplicated entries, or whether which variant is valid.";
$f[] = "##";
$f[] = "## You may want to disable this is you wish to have a precise control";
$f[] = "## of what types of content-type you wish to include.";
$f[] = "##";
$f[] = "## See also: URLReplaceDataCTList";
$f[] = "## Default: true";
$f[] = "# URLReplaceDataCTListAlsoXST = true";
$f[] = "";
$f[] = "## This option specifies a file containing a list of URLs which";
$f[] = "## should be blocked.";
$f[] = "## A \"access denied\" 403 error will be returned when trying to access";
$f[] = "## one of those URLs.";
$f[] = "## Default: empty (no file specified, inactive)";
$f[] = "# URLDeny = \"/etc/ziproxy/deny.list\"";
$f[] = "";
$f[] = "## Custom HTTP Error Messages";
$f[] = "## Define here the full path to the HTML file which should be";
$f[] = "## sent, instead of the internal default page.";
$f[] = "## Note: The internal defaults give more precise error messages.";
$f[] = "##";
$tpls = unserialize(base64_decode(zipproxy_templates()));
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: " . count($tpls) . " Template(s)\n";
}
while (list($code, $template_data) = each($tpls)) {
if ($GLOBALS["OUTPUT"]) {
echo "Configuring...: " . date("H:i:s") . " [INIT]: Template {$code}\n";
}
$template_data = str_replace("%SERV%", $unix->hostname_g(), $template_data);
@file_put_contents("/usr/share/squid-langpack/ZIPROXY_{$code}.html", $template_data);
$f[] = "CustomError{$code}=\"/usr/share/squid-langpack/ZIPROXY_{$code}.html\"";
}
$f[] = "";
$f[] = "";
$f[] = "";
$f[] = "##############################################################################";
$f[] = "# JPEG 2000-specific options (require Ziproxy to be compiled with libjasper) #";
$f[] = "##############################################################################";
$f[] = "";
$f[] = "## Whether to try to (re)compress incoming data originally in";
$f[] = "## the JP2 format (true) or not (false)";
$f[] = "## Note: This option is not required to be enabled in order to convert";
$f[] = "## _to_ JP2 format.";
$f[] = "## default: false";
$f[] = "# ProcessJP2 = false";
$f[] = "";
$f[] = "## Whether to try to compress a image to JP2K (JPEG 2000)";
$f[] = "## Even when enabled, other formats may sill be tried.";
$f[] = "## Web browsers' support vary and an external plugin may be required";
$f[] = "## in order to display JP2K pictures.";
$f[] = "## If \"ForceOutputNoJP2 = true\", this option will be overrided";
$f[] = "## and stay disabled.";
$f[] = "## default: false";
$f[] = "# ProcessToJP2 = false";
$f[] = "";
$f[] = "## When enabled, this option forces the conversion of all incoming";
$f[] = "## JP2K images to another format (usually JPEG).";
$f[] = "## JP2K images with unsupported internal data will be forwarded unmodified.";
$f[] = "## One may use this option to create \"JP2K-compressed tunnels\" between";
$f[] = "## two Ziproxies with narrow bandwidth in between and serve clients";
$f[] = "## which otherwise do not support JP2K while still taking advantage of that";
$f[] = "## format. In such scenario, if the clients and their Ziproxy share a LAN,";
$f[] = "## for best image quality it is recommended to set a very low (highest quality)";
$f[] = "## _local_ output compression.";
$f[] = "## This option requires \"ProcessJP2 = true\" in order to work.";
$f[] = "## default: false";
$f[] = "# ForceOutputNoJP2 = false";
$f[] = "";
$f[] = "## When enabled, every request as a client will include an extra header \"X-Ziproxy-Flags\"";
$f[] = "## announcing it as a Ziproxy with JP2 support enabled.";
$f[] = "## This option makes sense when chaining to another Ziproxy.";
$f[] = "## Note: when the request is intercepted by another Ziproxy,";
$f[] = "## the extra header won't be sent further.";
$f[] = "## See also: JP2OutRequiresExpCap";
$f[] = "## default: false";
$f[] = "# AnnounceJP2Capability = false";
$f[] = "";
$f[] = "## \"JP2 Output Requires Explicit Capability\"";
$f[] = "## When enabled (and when JP2 output is enabled) will only compress to JP2 to";
$f[] = "## clients which explicity support for that -- that means Ziproxy with";
$f[] = "## AnnounceJP2Capability = true.";
$f[] = "## This option is useful when you want to compress to JP2 only for clients";
$f[] = "## behind a local Ziproxy with ForceOutputNoJP2 = true, but at the same time";
$f[] = "## you have clients connecting directly and those do not support JP2.";
$f[] = "## default: false (does not make such discrimination for JP2 output)";
$f[] = "# JP2OutRequiresExpCap = false";
$f[] = "";
$f[] = "## Image quality for JP2 (JPEG 2000) compression.";
$f[] = "## Image quality is specified in integers between 100 (best) and 0 (worst).";
$f[] = "## This option is similar to \"ImageQuality\" except it applies to JP2K files, instead.";
$f[] = "## JP2K, internally, works differently and has a \"rate\" setting instead of \"quality\".";
$f[] = "## Within Ziproxy's context we want to use a fixed quality, not a fixed bitrate.";
$f[] = "## Thus, prior to compression, the image is analysed in order to know which rate";
$f[] = "## (loosely) reflects the quality had this picture be compressed using jpeg.";
$f[] = "## This option obsoletes \"JP2Rate\".";
$f[] = "# JP2ImageQuality = {20,15,15,15}";
$f[] = "";
$f[] = "## Color model to be used while compressing images to JP2K.";
$f[] = "## Accepted values:";
$f[] = "## 0 - RGB";
$f[] = "## 1 - YUV";
$f[] = "## If different than RGB, it adds extra processing due to conversion.";
$f[] = "## By itself doesn't change much the output data size, and the";
$f[] = "## conversion is not 100.0% lossless.";
$f[] = "## If you plan using JP2CSampling* or JP2BitRes* options, a non-RGB";
$f[] = "## color model is highly prefereable.";
$f[] = "## Default: 0 (YUV)";
$f[] = "## Note: certain jp2-aware software do NOT support a color model";
$f[] = "## other than RGB and will either fail or display a distorted image.";
$f[] = "# JP2Colorspace = 1";
$f[] = "";
$f[] = "## Upsampler to be used while resampling each component of a JP2K picture.";
$f[] = "## This is used ONLY when decompressing JP2K pictures, it does not affect";
$f[] = "## JP2K compression at all (that uses a downsampler, which is linear-only).";
$f[] = "## Accepted values:";
$f[] = "## 0 - Linear";
$f[] = "## 1 - Lanczos (Lanczos3)";
$f[] = "## For modest scaling such as 2:1, linear is usually better,";
$f[] = "## resulting in a overall clear component.";
$f[] = "## Lanczos may be interesting when scaling 4:1 or more, though";
$f[] = "## it tends to sharpen the JP2K artifacts and add harmonic";
$f[] = "## interference to the component.";
$f[] = "## Default: 0 (Linear)";
$f[] = "# JP2Upsampler = 0";
$f[] = "";
$f[] = "## This applies to B&W pictures compressed to JP2K.";
$f[] = "## Defines the channel resolution for each component:";
$f[] = "## Y (luma) and A (alpha, if present)";
$f[] = "## in number of bit (min: 1, max: 8)";
$f[] = "## Defines for each file size (see JP2ImageQuality).";
$f[] = "## Smallest image is the first components in array.";
$f[] = "## Sequence is YAYAYAYA.";
$f[] = "##";
$f[] = "## Default: all to eight bits";
$f[] = "#JP2BitResYA = {6,4,";
$f[] = "# 7,5,";
$f[] = "# 8,6,";
$f[] = "# 8,6}";
$f[] = "";
$f[] = "## This applies to color pictures compressed to JP2K";
$f[] = "## using the RGB model (see JP2Colorspace).";
$f[] = "## Defines the channel resolution for each component:";
$f[] = "## R (red), G (green), B (blue) and A (alpha, if present)";
$f[] = "## in number of bit (min: 1, max: 8)";
$f[] = "## Defines for each file size (see JP2ImageQuality).";
$f[] = "## Smallest image is the first components in array.";
$f[] = "## Sequence is RGBARGBARGBARGBA.";
$f[] = "##";
$f[] = "## Default: all to eight bits";
$f[] = "# JP2BitResRGBA = {6,5,5,4,";
$f[] = "# 7,6,6,5,";
$f[] = "# 6,7,7,6,";
$f[] = "# 8,8,8,6}";
$f[] = "";
$f[] = "## This applies to color pictures compressed to JP2K";
$f[] = "## using the YUV color model (see JP2Colorspace).";
$f[] = "## Defines the channel resolution for each component:";
$f[] = "## Y (luma), U (chroma, Cb), V (chroma, Cr), and A (alpha, if present)";
$f[] = "## in number of bit (min: 1, max: 8)";
$f[] = "## Defines for each file size (see JP2ImageQuality).";
$f[] = "## Smallest image is the first components in array.";
$f[] = "## Sequence is YUVAYUVAYUVAYUVA.";
$f[] = "##";
$f[] = "## Default: sensible values for best quality/compression";
$f[] = "#JP2BitResYUVA = {6,5,5,4,";
$f[] = "# 7,6,6,5,";
$f[] = "# 8,7,7,6,";
$f[] = "# 8,8,8,6}";
$f[] = "";
$f[] = "## This applies to B&W pictures compressed to JP2K.";
$f[] = "## Here you may define the sampling rate for each component,";
$f[] = "## for each picture size.";
$f[] = "## The sequence is:";
$f[] = "## Y_xpos, Y_ypos, Y_xstep, Y_ystep, A_xpos, A_ypos, A_xstep, A_ystep, (smallest picture)";
$f[] = "## ... ... ... (medium-sized picture)";
$f[] = "## etc.";
$f[] = "## Default: all x/ypos=0 x/ystep=1 (no components suffer subsampling)";
$f[] = "## Note: certain jp2-aware software do NOT support component subsampling and will fail.";
$f[] = "#JP2CSamplingYA = {0,0,1,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,2,2,";
$f[] = "# 0,0,1,1, 0,0,2,2}";
$f[] = "";
$f[] = "## This applies to color pictures compressed to JP2K";
$f[] = "## using the RGB model (see JP2Colorspace).";
$f[] = "## Here you may define the sampling rate for each component,";
$f[] = "## for each picture size.";
$f[] = "## The sequence is:";
$f[] = "## R_xpos, R_ypos, R_xstep, R_ystep, G_xpos, G_ypos, G_xstep, G_ystep, B... A... (smallest picture)";
$f[] = "## ... ... ... (medium-sized picture)";
$f[] = "## etc.";
$f[] = "## Default: all x/ypos=0 x/ystep=1 (no components suffer subsampling)";
$f[] = "## Note: certain jp2-aware software do NOT support component subsampling and will fail.";
$f[] = "#JP2CSamplingRGBA = {0,0,1,1, 0,0,1,1, 0,0,1,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,1,1, 0,0,1,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,1,1, 0,0,1,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,1,1, 0,0,1,1, 0,0,1,1}";
$f[] = "";
$f[] = "## This applies to color pictures compressed to JP2K";
$f[] = "## using the YUV color model (see JP2Colorspace).";
$f[] = "## Here you may define the sampling rate for each component,";
$f[] = "## for each picture size.";
$f[] = "## The sequence is:";
$f[] = "## Y_xpos, Y_ypos, Y_xstep, Y_ystep, U_xpos, U_ypos, U_xstep, U_ystep, V... A... (smallest picture)";
$f[] = "## ... ... ... (medium-sized picture)";
$f[] = "## etc.";
$f[] = "## Default: sensible values for a good image quality.";
$f[] = "## Note: certain jp2-aware software do NOT support component subsampling and will fail.";
$f[] = "#JP2CSamplingYUVA = {0,0,1,1, 0,0,1,1, 0,0,1,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,1,2, 0,0,2,1, 0,0,1,1,";
$f[] = "# 0,0,1,1, 0,0,2,2, 0,0,2,1, 0,0,2,2,";
$f[] = "# 0,0,1,1, 0,0,2,2, 0,0,2,2, 0,0,2,2}";
$f[] = "";
CheckFilesAndSecurity();
@file_put_contents("/etc/squid3/ziproxy.conf", @implode("\n", $f));
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} /etc/squid3/ziproxy.conf done\n";
}
}
function build()
{
$sock = new sockets();
$unix = new unix();
$ini = new Bs_IniHandler();
$IPADDRSSL = array();
$IPADDRSSL2 = array();
$ArticaSquidParameters = $sock->GET_INFO('ArticaSquidParameters');
$visible_hostname = $ini->_params["NETWORK"]["visible_hostname"];
if ($visible_hostname == null) {
$visible_hostname = $unix->hostname_g();
}
$SquidBinIpaddr = $sock->GET_INFO("SquidBinIpaddr");
$AllowAllNetworksInSquid = $sock->GET_INFO("AllowAllNetworksInSquid");
if (!is_numeric($AllowAllNetworksInSquid)) {
$AllowAllNetworksInSquid = 1;
}
$ini->loadString($ArticaSquidParameters);
NETWORK_ALL_INTERFACES();
$LISTEN_PORT = intval($ini->_params["NETWORK"]["LISTEN_PORT"]);
$ICP_PORT = intval(trim($ini->_params["NETWORK"]["ICP_PORT"]));
$certificate_center = $ini->_params["NETWORK"]["certificate_center"];
$SSL_BUMP = intval($ini->_params["NETWORK"]["SSL_BUMP"]);
$LogsWarninStop = intval($sock->GET_INFO("LogsWarninStop"));
$ssl = false;
if ($ICP_PORT == 0) {
$ICP_PORT = 3130;
}
if ($LISTEN_PORT == 0) {
$LISTEN_PORT = 3128;
}
$squid = new squidbee();
$q = new mysql_squid_builder();
$IPADDRS = array();
if ($SquidBinIpaddr != null) {
if (!isset($GLOBALS["NETWORK_ALL_INTERFACES"][$SquidBinIpaddr])) {
$SquidBinIpaddr = null;
} else {
$IPADDRS[$SquidBinIpaddr] = $LISTEN_PORT;
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Listens {$SquidBinIpaddr}\n";
}
}
}
if ($SSL_BUMP == 1) {
$ssl = true;
$ssl_port = $squid->get_ssl_port();
}
if ($SquidBinIpaddr == null) {
reset($GLOBALS["NETWORK_ALL_INTERFACES"]);
while (list($ipaddr, $val) = each($GLOBALS["NETWORK_ALL_INTERFACES"])) {
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Listens {$ipaddr}:{$LISTEN_PORT}\n";
}
$IPADDRS[$ipaddr] = $LISTEN_PORT;
$IPADDRSSL[$ipaddr] = $ssl_port;
}
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} visible hostname........: {$visible_hostname}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} AllowAllNetworksInSquid.: {$AllowAllNetworksInSquid}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} ICP Port................: {$ICP_PORT}\n";
}
if ($ssl) {
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} SSL Intercept...........: Yes - {$ssl_port}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Certificate.............: {$certificate_center}\n";
}
$MAINSSL = $squid->SaveCertificate($certificate_center, false, false, false, true);
$f[] = $MAINSSL[0];
$certificate = $MAINSSL[1]["certificate"];
$key = $MAINSSL[1]["key"];
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Certificate.............: {$certificate}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Key.....................: {$key}\n";
}
}
$sql = "SELECT * FROM proxy_ports WHERE enabled=1 and transparent=1";
$results = $q->QUERY_SQL($sql);
$f[] = "# --------- proxy_ports enabled=1 and transparent=1 -> " . mysql_num_rows($results) . " ports";
while ($ligne = mysql_fetch_assoc($results)) {
$ipaddr = $ligne["ipaddr"];
$xport = $ligne["port"];
$transparent_text = null;
if (!isset($GLOBALS["NETWORK_ALL_INTERFACES"][$ipaddr])) {
$f[] = "# --------- table proxy_ports {$ipaddr}:{$xport} -> Hardware Error [" . __LINE__ . "]\n";
$f[] = "# --------- http {$ipaddr} -> Hardware Error [" . __LINE__ . "]\n";
continue;
}
if ($ssl) {
$IPADDRSSL[$ipaddr] = $ssl_port;
}
$IPADDRS[$ipaddr] = $xport;
}
$transparent = " transparent";
while (list($ipaddr, $xport) = each($IPADDRSSL)) {
$IPADDRSSL2["{$ipaddr}:{$xport}"] = true;
}
while (list($ipaddr, $xport) = each($IPADDRS)) {
$IPADDRS2["{$ipaddr}:{$xport}"] = true;
}
while (list($ipaddr, $none) = each($IPADDRS2)) {
$f[] = "http_port {$ipaddr}{$transparent}";
}
if ($ssl) {
$f[] = "# --------- https -> " . count($IPADDRSSL2) . " addresses";
while (list($ipaddr, $none) = each($IPADDRSSL2)) {
$f[] = "https_port {$ipaddr} transparent cert={$certificate} key={$key}";
}
}
if ($AllowAllNetworksInSquid == 1) {
$f[] = "acl localnet src all";
}
if ($AllowAllNetworksInSquid == 0) {
$k = array();
$NetworkScannerMasks = $sock->GET_INFO('NetworkScannerMasks');
$tbl = explode("\n", $NetworkScannerMasks);
if (is_array($tbl)) {
while (list($num, $cidr) = each($tbl)) {
if (trim($cidr) == null) {
continue;
}
$k[$cidr] = $cidr;
}
}
if (count($this->network_array) > 0) {
while (list($num, $val) = each($this->network_array)) {
if ($val == null) {
continue;
}
$k[$val] = $val;
}
}
if (count($k == 0)) {
$f[] = "acl localnet src all";
}
if (count($k > 0)) {
while (list($m, $l) = each($k)) {
$s[] = $l;
}
$f[] = "acl localnet src " . implode(" ", $s);
}
}
if ($ssl) {
}
$f[] = "acl all src all";
$f[] = "acl manager proto cache_object";
$f[] = "acl localhost src 127.0.0.1/32";
$f[] = "acl to_localhost dst 127.0.0.0/8 0.0.0.0/32";
$f[] = "acl SSL_ports port \"/etc/squid3/acls/SSLPorts\"";
$f[] = "acl Safe_ports port 80\t\t# http";
$f[] = "acl Safe_ports port 21\t\t# ftp";
$f[] = "acl Safe_ports port 443\t\t# https";
$f[] = "acl Safe_ports port 70\t\t# gopher";
$f[] = "acl Safe_ports port 210\t\t# wais";
$f[] = "acl Safe_ports port 1025-65535\t# unregistered ports";
$f[] = "acl Safe_ports port 280\t\t# http-mgmt";
$f[] = "acl Safe_ports port 488\t\t# gss-http";
$f[] = "acl Safe_ports port 591\t\t# filemaker";
$f[] = "acl Safe_ports port 777\t\t# multiling http";
$f[] = "acl CONNECT method CONNECT";
$f[] = "";
$f[] = "";
if ($sock->EnableUfdbGuard() == 1) {
$f[] = ufdbguard27();
$EnableUfdbGuardArtica = $sock->EnableUfdbGuardArtica();
if (!is_file("/etc/squid3/acls/office365-nets.acl")) {
@touch("/etc/squid3/acls/office365-nets.acl");
}
if (!is_file("/etc/squid3/acls/office365-domains.acl")) {
@touch("/etc/squid3/acls/office365-domains.acl");
}
if (!is_file("/etc/squid3/acls/skype-nets.acl")) {
@touch("/etc/squid3/acls/skype-nets.acl");
}
if (!is_file("/etc/squid3/acls/dropbox-nets.acl")) {
@touch("/etc/squid3/acls/dropbox-nets.acl");
}
$f[] = "acl squidclient proto cache_object";
$f[] = "acl MgRDest dst 127.0.0.1";
$f[] = "acl MgRPort dst 127.0.0.1";
$f[] = "acl MyTestPort src 127.0.0.1";
$f[] = "acl MyLocalIpsDest dst 127.0.0.1";
$f[] = "acl ToArticaWWW dstdomain .artica.fr .articatech.net .articatech.com";
if ($EnableUfdbGuardArtica == 0) {
$f[] = "acl UrlRewriteDenyList dstdomain \"/etc/squid3/url_rewrite_program.deny.db\"";
}
$f[] = "acl ArticaMetaWhiteDoms dstdomain \"/etc/squid3/artica-meta/whitelist-domains.db\"";
$f[] = "acl ArticaMetaWhiteIPs dst \"/etc/squid3/artica-meta/whitelist-nets.db\"";
$f[] = "acl BrowsersNoWebF browser -i \"/etc/squid3/acls/Browsers-nofilter.acl\"";
$f[] = "acl whitelisted_mac_computers arp \"/etc/squid3/whitelisted-computers-by-mac.acl\"";
$f[] = "acl office365_ips dst \"/etc/squid3/acls/office365-nets.acl\"";
$f[] = "acl office365_www dstdomain \"/etc/squid3/acls/office365-domains.acl\"";
$f[] = "acl skype_www dstdomain .live.com .skypeassets.com";
$f[] = "acl skype_ips dst \"/etc/squid3/acls/skype-nets.acl\"";
$f[] = "acl dropbox_ips dst \"/etc/squid3/acls/dropbox-nets.acl\"";
$f[] = "acl dropbox_www dstdomain .dropbox.com";
$f[] = @file_get_contents("/etc/squid3/url_rewrite_access.conf");
}
$f[] = "http_access allow manager localhost";
$f[] = "http_access deny manager";
$f[] = "http_access deny !Safe_ports";
$f[] = "http_access deny CONNECT !SSL_ports";
$f[] = "http_access allow localnet";
$f[] = "http_access deny all";
$f[] = "icp_access allow localnet";
$f[] = "icp_access deny all";
$f[] = "cache_peer 127.0.0.1\tparent\t{$LISTEN_PORT}\t3130\tdefault";
$f[] = "never_direct allow all";
$f[] = "cache_mem 64 MB";
$f[] = "maximum_object_size_in_memory 256 KB";
$f[] = "memory_replacement_policy lru";
$LOGFORMAT[] = "%>a";
$LOGFORMAT[] = "%[ui";
$LOGFORMAT[] = "%[un";
$LOGFORMAT[] = "[%tl]";
$LOGFORMAT[] = "\"%rm %ru HTTP/%rv\"";
$LOGFORMAT[] = "%Hs";
$LOGFORMAT[] = "%<st";
$LOGFORMAT[] = "%Ss:";
$LOGFORMAT[] = "%Sh";
$LOGFORMAT[] = "UserAgent:\"%{User-Agent}>h\"";
$LOGFORMAT[] = "Forwarded:\"%{X-Forwarded-For}>h\"";
$f[] = "logformat common MAC:00:00:00:00:00:00 " . @implode(" ", $LOGFORMAT);
$f[] = "access_log none";
$f[] = "cache_store_log none";
if ($LogsWarninStop == 0) {
$f[] = "logfile_rotate 10";
}
if ($LogsWarninStop == 1) {
$f[] = "logfile_rotate 0";
}
$f[] = "# emulate_httpd_log off";
$f[] = "log_ip_on_direct on";
$f[] = "mime_table /etc/squid27/mime.conf";
$f[] = "# log_mime_hdrs off";
$f[] = "pid_filename /var/run/squid/squid-nat.pid";
$f[] = "debug_options ALL,1";
$f[] = "log_fqdn on";
$f[] = "client_netmask 255.255.255.255";
$f[] = "strip_query_terms off";
$f[] = "buffered_logs on";
$f[] = "netdb_filename /var/log/squid/netdb_nat.state";
if ($LogsWarninStop == 0) {
$f[] = "cache_log /var/log/squid/cache-nat.log";
}
if ($LogsWarninStop == 1) {
$f[] = "cache_log /dev/null";
}
$f[] = "#url_rewrite_program";
$f[] = "# url_rewrite_children 5";
$f[] = "# url_rewrite_concurrency 0";
$f[] = "# url_rewrite_host_header on";
$f[] = "refresh_pattern .\t\t0\t20%\t4320";
$f[] = "cache_effective_user squid";
$f[] = "cache_effective_group squid";
$f[] = "httpd_suppress_version_string on";
$f[] = "visible_hostname {$visible_hostname}";
$f[] = "cache_dir null /tmp";
$f[] = "# icon_directory /usr/share/squid27/icons";
$f[] = "# error_directory /usr/share/squid27/errors/English";
$f[] = "forwarded_for on";
$f[] = "client_db on";
$f[] = "";
CheckFilesAndSecurity();
@file_put_contents("/etc/squid27/squid.conf", @implode("\n", $f));
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} /etc/squid27/squid.conf done\n";
}
}
function build()
{
$sock = new sockets();
$emailprefix = null;
$unix = new unix();
$ini = new Bs_IniHandler();
$IPADDRSSL = array();
$IPADDRSSL2 = array();
$users = new usersMenus();
$uuid = $unix->GetUniqueID();
if ($uuid == null) {
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} no UUID !!, return\n";
}
return;
}
$ArticaSquidParameters = $sock->GET_INFO('ArticaSquidParameters');
$visible_hostname = $ini->_params["NETWORK"]["visible_hostname"];
if ($visible_hostname == null) {
$visible_hostname = $unix->hostname_g();
}
$SquidBinIpaddr = $sock->GET_INFO("SquidBinIpaddr");
$AllowAllNetworksInSquid = $sock->GET_INFO("AllowAllNetworksInSquid");
if (!is_numeric($AllowAllNetworksInSquid)) {
$AllowAllNetworksInSquid = 1;
}
$ini->loadString($ArticaSquidParameters);
NETWORK_ALL_INTERFACES();
$LISTEN_PORT = intval($ini->_params["NETWORK"]["LISTEN_PORT"]);
$ICP_PORT = intval(trim($ini->_params["NETWORK"]["ICP_PORT"]));
$certificate_center = $ini->_params["NETWORK"]["certificate_center"];
$SSL_BUMP = intval($ini->_params["NETWORK"]["SSL_BUMP"]);
$ssl = false;
if ($ICP_PORT == 0) {
$ICP_PORT = 3130;
}
if ($LISTEN_PORT == 0) {
$LISTEN_PORT = 3128;
}
$squid = new squidbee();
$q = new mysql_squid_builder();
$LogsWarninStop = intval($sock->GET_INFO("LogsWarninStop"));
$chown = $unix->find_program("chown");
$python = $unix->find_program("python");
$StreamCachePort = intval($sock->GET_INFO("StreamCachePort"));
$StreamCacheSize = intval($sock->GET_INFO("StreamCacheSize"));
$StreamCacheSSLPort = intval($sock->GET_INFO("StreamCacheSSLPort"));
$StreamCacheICPPort = intval($sock->GET_INFO("StreamCacheICPPort"));
$StreamCacheLocalPort = intval($sock->GET_INFO("StreamCacheLocalPort"));
$StreamCacheUrlRewiteNumber = intval($sock->GET_INFO("StreamCacheUrlRewiteNumber"));
if ($StreamCacheSize == 0) {
$StreamCacheSize = 1500;
}
if ($StreamCachePort == 0) {
$StreamCachePort = 5559;
}
if ($StreamCacheLocalPort == 0) {
$StreamCacheLocalPort = 5563;
}
if ($StreamCacheSSLPort == 0) {
$StreamCacheSSLPort = 5560;
}
if ($StreamCacheICPPort == 0) {
$StreamCacheICPPort = 5562;
}
if ($StreamCacheUrlRewiteNumber == 0) {
$StreamCacheUrlRewiteNumber = 15;
}
$StreamCacheBindProxy = $squid->VerifStreamProxyBindIP();
$StreamCacheOutProxy = $sock->GET_INFO("StreamCacheOutProxy");
if (!isset($GLOBALS["NETWORK_ALL_INTERFACES"][$StreamCacheOutProxy])) {
$StreamCacheOutProxy = null;
}
$f[] = "";
$f[] = "# ************** REDIRECTOR ********************";
$f[] = "url_rewrite_program {$python} /usr/share/videocache/videocache.py";
$f[] = "url_rewrite_children {$StreamCacheUrlRewiteNumber}";
$f[] = "url_rewrite_concurrency {$StreamCacheUrlRewiteNumber}";
$f[] = "";
$f[] = "# ***********************************************";
$f[] = "";
$f[] = "acl vc_deny_myport myport {$StreamCacheLocalPort}";
$f[] = "";
$f[] = "acl vc_deny_url url_regex -i \\.blip\\.tv\\/(.*)filename \\.hardsextube\\.com\\/videothumbs \\.xtube\\.com\\/(.*)(Thumb|videowall) www\\.youtube\\.com\\/";
$f[] = "acl vc_deny_url url_regex -i \\.(youtube|googlevideo)\\.com\\/.*\\/manifest";
$f[] = "acl vc_deny_url url_regex -i \\.(youtube|googlevideo)\\.com\\/videoplayback?.*playerretry=[0-9]";
$f[] = "acl vc_deny_dom dstdomain .manifest.youtube.com .manifest.googlevideo.com";
$f[] = "acl vc_deny_dom dstdomain .redirector.googlevideo.com .redirector.youtube.com";
$f[] = "";
$f[] = "acl vc_url url_regex -i \\/youku\\/[0-9A-Z]+\\/[0-9A-Z\\-]+\\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg)";
$f[] = "acl vc_url url_regex -i \\/(.*)key=[a-z0-9]+(.*)\\.flv";
$f[] = "acl vc_url url_regex -i \\-xh\\.clients\\.cdn[0-9a-zA-Z]?[0-9a-zA-Z]?[0-9a-zA-Z]?\\.com\\/data\\/(.*)\\.flv";
$f[] = "acl vc_url url_regex -i \\.(youtube|youtube-nocookie|googlevideo)\\.com\\/feeds\\/api\\/videos\\/[0-9a-zA-Z_-]{11}\\/";
$f[] = "acl vc_url url_regex -i \\.(youtube|youtube-nocookie|googlevideo)\\.com\\/(videoplayback|get_video|watch_popup|user_watch|stream_204|get_ad_tags|get_video_info|player_204|ptracking|set_awesome)\\?";
$f[] = "acl vc_url url_regex -i \\.(youtube|youtube-nocookie|googlevideo)\\.com\\/(v|e|embed)\\/[0-9a-zA-Z_-]{11}";
$f[] = "acl vc_url url_regex -i \\.youtube\\.com\\/s\\? \\.youtube\\.com\\/api\\/stats\\/(atr|delayplay|playback|watchtime)\\?";
$f[] = "acl vc_url url_regex -i \\.(youtube|youtube-nocookie|googlevideo)\\.com\\/videoplayback\\/id\\/[0-9a-zA-Z_-]+\\/";
$f[] = "acl vc_url url_regex -i \\.android\\.clients\\.google\\.com\\/market\\/GetBinary\\/";
$f[] = "acl vc_url url_regex -i cs(.*)\\.vk\\.me\\/(.*)/([a-zA-Z0-9.]+)\\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg)";
$f[] = "acl vc_url url_regex -i video(.*)\\.rutube\\.ru\\/(.*)/([a-zA-Z0-9.]+)\\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg)Seg[0-9]+-Frag[0-9]+";
$f[] = "";
$f[] = "acl vc_dom_r dstdom_regex -i msn\\..*\\.(com|net)";
$f[] = "acl vc_dom_r dstdom_regex -i msnbc\\..*\\.(com|net)";
$f[] = "acl vc_dom_r dstdom_regex -i video\\..*\\.fbcdn\\.net";
$f[] = "acl vc_dom_r dstdom_regex -i myspacecdn\\..*\\.footprint\\.net";
$f[] = "";
$f[] = "acl vc_dom dstdomain .stream.aol.com .5min.com .msn.com .blip.tv .dmcdn.net .break.com .vimeo.com .vimeocdn.com video.thestaticvube.com";
$f[] = "acl vc_dom dstdomain .dailymotion.com .c.wrzuta.pl .v.imwx.com .mccont.com .myspacecdn.com video-http.media-imdb.com fcache.veoh.com";
$f[] = "acl vc_dom dstdomain .hardsextube.com .public.extremetube.phncdn.com .redtubefiles.com .video.pornhub.phncdn.com .videos.videobash.com";
$f[] = "acl vc_dom dstdomain .public.keezmovies.com .public.keezmovies.phncdn.com .slutload-media.com .public.spankwire.com .xtube.com";
$f[] = "acl vc_dom dstdomain .public.youporn.phncdn.com .xvideos.com .tube8.com .public.spankwire.phncdn.com .pornhub.com";
$f[] = "";
$f[] = "";
$f[] = "acl vc_deny_url url_regex -i crossdomain.xml";
$f[] = "acl vc_method method GET";
$f[] = "acl vc_header req_header X-Requested-With -i videocache";
$f[] = "url_rewrite_access deny vc_deny_myport";
$f[] = "url_rewrite_access deny !vc_method";
$f[] = "url_rewrite_access deny vc_header";
$f[] = "url_rewrite_access deny vc_deny_dom";
$f[] = "url_rewrite_access deny vc_deny_url";
$f[] = "url_rewrite_access allow vc_dom";
$f[] = "url_rewrite_access allow vc_url";
$f[] = "url_rewrite_access allow vc_dom_r";
CheckFilesAndSecurity();
$f = array();
$f[] = "[main]";
$StreamCacheBindHTTP = VerifHTTPIP();
$FreeWebListenPort = $sock->GET_INFO("FreeWebListenPort");
$FreeWebListenSSLPort = $sock->GET_INFO("FreeWebListenSSLPort");
if (!is_numeric($FreeWebListenSSLPort)) {
$FreeWebListenSSLPort = 443;
}
if (!is_numeric($FreeWebListenPort)) {
$FreeWebListenPort = 80;
}
if ($FreeWebListenPort != 80) {
$StreamCacheBindHTTP = "{$StreamCacheBindHTTP}:{$FreeWebListenPort}";
}
$SquidMgrListenPort = intval($sock->GET_INFO("SquidMgrListenPort"));
$SquidDebugPortInterface = intval($sock->GET_INFO("SquidDebugPortInterface"));
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Apache IP...............: {$StreamCacheBindHTTP}:{$FreeWebListenPort}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Proxy Port..............: {$SquidMgrListenPort}\n";
}
if (!$users->CORP_LICENSE) {
$emailprefix = "trial_";
}
$f[] = "client_email = {$emailprefix}{$uuid}@articatech.com";
$f[] = "scheduler_pidfile = /var/run/squid/videocache.pid";
$f[] = "cache_host = {$StreamCacheBindHTTP}";
$f[] = "source_ip = 127.0.0.1";
$f[] = "videocache_user = squid";
$f[] = "";
$f[] = "# # # Proxy specifications # # #";
$f[] = "squid_access_log=/var/log/squid/access.log";
$f[] = "enable_access_log_monitoring = 1";
$f[] = "squid_access_log_format_combined = 0";
$f[] = "";
$f[] = "base_dir = /home/squid/videocache/";
$f[] = "logdir = /var/log/squid/";
$f[] = "pidfile = pidfile.txt";
$f[] = "this_proxy=127.0.0.1:{$SquidMgrListenPort}";
$f[] = "cache_swap_low = 90";
$f[] = "cache_swap_high = 93";
$f[] = "disk_cleanup_strategy = 1";
$f[] = "enable_videocache = 1";
$f[] = "offline_mode = 0";
$f[] = "base_dir_selection = 2";
$f[] = "# # # MySQL setup # # #";
$f[] = "db_hostname = /var/run/mysqld/squid-db.sock";
$f[] = "db_username = root";
$f[] = "db_password ="******"db_database = videocache";
$f[] = "max_cache_processes = 4";
$f[] = "max_cache_speed = 0";
$f[] = "";
$f[] = "# # # Remote Proxy # # #";
$f[] = "proxy =127.0.0.1:{$SquidMgrListenPort}";
$f[] = "max_video_size = 0";
$f[] = "min_video_size = 0";
$f[] = "force_video_size = 1";
$f[] = "logformat = %tl %p %s %i %w %c %v %m %d";
$f[] = "scheduler_logformat = %tl %p %s %i %w %c %v %m %d";
$f[] = "cleaner_logformat = %tl %p %s %w %c %v %m %d";
$f[] = "db_query_logformat = %tl %m";
$f[] = "timeformat = %d/%b/%Y:%H:%M:%S";
$f[] = "enable_videocache_log = 1";
$f[] = "enable_scheduler_log = 1";
$f[] = "enable_cleaner_log = 1";
$f[] = "enable_trace_log = 1";
$f[] = "enable_db_query_log = 0";
$f[] = "logfile = videocache.log";
$f[] = "scheduler_logfile = videocache-scheduler.log";
$f[] = "cleaner_logfile = videocache-cleaner.log";
$f[] = "tracefile = videocache-trace.log";
$f[] = "db_query_logfile = videocache-database.log";
$f[] = "max_logfile_size = 90";
$f[] = "max_scheduler_logfile_size = 90";
$f[] = "max_cleaner_logfile_size = 5";
$f[] = "max_tracefile_size = 5";
$f[] = "max_db_query_logfile_size = 5";
$f[] = "#------------------------------------------------------------------------------";
$f[] = "# Website Specific Options |";
$f[] = "#------------------------------------------------------------------------------";
$f[] = "";
$f[] = "# This option enables the caching of Android apps across various devices.";
$f[] = "# This option's value can be either 0 or 1.";
$f[] = "enable_android_cache = 1";
$f[] = "";
$f[] = "# These options set minimum and maximum size (in KB) for android apps. An app with";
$f[] = "# size smaller than min_android_app_size or larger than max_android_app_size will";
$f[] = "# not be cached. Set to zero (0) to disable.";
$f[] = "# Default:";
$f[] = "# min_android_app_size = 1024";
$f[] = "# max_android_app_size = 0";
$f[] = "min_android_app_size = 1024";
$f[] = "max_android_app_size = 0";
$f[] = "";
$f[] = "# This option enables the caching of youtube videos.";
$f[] = "# This option's value can be either 0 or 1.";
$f[] = "#----------------------------------------------------------------------------";
$f[] = "# | IMPORTANT : Each supported website have an option to enable or disable |";
$f[] = "# | caching of its videos in the form enable_website_cache. You can opt to |";
$f[] = "# | cache the websites you want by disabling the caching for other websites |";
$f[] = "#----------------------------------------------------------------------------";
$f[] = "# Default : 1";
$f[] = "enable_youtube_cache = 1";
$f[] = "";
$f[] = "# This options determines if Videocache will cache different YouTube video";
$f[] = "# formats separately. Please select an appropriate algorithm from the listed below.";
$f[] = "# Available strategies:";
$f[] = "# 1 : (disabled) Don't check for YouTube video formats. Cache one of the formats";
$f[] = "# and serve it for requests for all kinds of formats.";
$f[] = "# 2 : (strict) Strictly check for YouTube formats and cache all formats separately.";
$f[] = "# Consumes maximum bandwidth.";
$f[] = "# 3 : (approximate) Check YouTube formats but with approximation. For example,";
$f[] = "# if a client asked for a video in 480p format and we already have 360p";
$f[] = "# format of the same video in cache, then serve 360p format and vice-versa.";
$f[] = "# Default : 3";
$f[] = "enable_youtube_format_support = 3";
$f[] = "";
$f[] = "# This option enables the caching of HTML5 videos from YouTube.";
$f[] = "# This option's value can be 0 or 1.";
$f[] = "# Default : 1";
$f[] = "enable_youtube_html5_videos = 1";
$f[] = "";
$f[] = "# This option enables the caching of 3D videos from YouTube.";
$f[] = "# This option's value can either be 0 or 1.";
$f[] = "# Default : 1";
$f[] = "enable_youtube_3d_videos = 1";
$f[] = "";
$f[] = "# This option enables the caching of several video segments used by YouTube";
$f[] = "# to serve a single video. This option works only when enable_store_log_monitoring";
$f[] = "# option is enabled. This option's value can either be 0 or 1.";
$f[] = "# Default : 1";
$f[] = "enable_youtube_partial_caching = 1";
$f[] = "";
$f[] = "# This option enforces the maximum video quality from Youtube. If a user browses";
$f[] = "# a video in higher quality format, Videocache will still cache and serve the video";
$f[] = "# in the format specified below or a lower quality format depending on the availability.";
$f[] = "# Valid values : 480p, 720p, 1080p, 2304p (Please don't append p)";
$f[] = "# Default : 720";
$f[] = "max_youtube_video_quality = 720";
$f[] = "";
$f[] = "# This option will help in enhancing the performance of Videocache.";
$f[] = "# If min_youtube_views is set to 1000, then Videocache will cache a video only";
$f[] = "# if it has received at least 1000 views on Youtube. Otherwise, video will not";
$f[] = "# be cached. Set this to 0 to disable this option.";
$f[] = "# Default : 100";
$f[] = "min_youtube_views = 100";
$f[] = "";
$f[] = "# www.aol.com";
$f[] = "enable_aol_cache = 1";
$f[] = "";
$f[] = "# www.bing.com";
$f[] = "enable_bing_cache = 1";
$f[] = "";
$f[] = "# www.blip.tv";
$f[] = "enable_bliptv_cache = 1";
$f[] = "";
$f[] = "# www.break.com";
$f[] = "enable_breakcom_cache = 1";
$f[] = "";
$f[] = "# www.dailymotion.com";
$f[] = "enable_dailymotion_cache = 1";
$f[] = "";
$f[] = "# www.facebook.com";
$f[] = "enable_facebook_cache = 1";
$f[] = "";
$f[] = "# www.imdb.com";
$f[] = "enable_imdb_cache = 1";
$f[] = "";
$f[] = "# www.metacafe.com";
$f[] = "enable_metacafe_cache = 1";
$f[] = "";
$f[] = "# www.myspace.com";
$f[] = "enable_myspace_cache = 1";
$f[] = "";
$f[] = "# www.veoh.com";
$f[] = "enable_veoh_cache = 1";
$f[] = "";
$f[] = "# www.videobash.com";
$f[] = "enable_videobash_cache = 1";
$f[] = "";
$f[] = "# www.vimeo.com";
$f[] = "enable_vimeo_cache = 1";
$f[] = "";
$f[] = "# www.vube.com";
$f[] = "enable_vube_cache = 1";
$f[] = "";
$f[] = "# www.weather.com";
$f[] = "enable_weather_cache = 1";
$f[] = "";
$f[] = "# www.wrzuta.pl";
$f[] = "enable_wrzuta_cache = 1";
$f[] = "";
$f[] = "# www.youku.com";
$f[] = "enable_youku_cache = 1";
$f[] = "";
$f[] = "# Pr0n sites";
$f[] = "# www.extremetube.com";
$f[] = "enable_extremetube_cache = 1";
$f[] = "";
$f[] = "# www.hardsextube.com";
$f[] = "enable_hardsextube_cache = 1";
$f[] = "";
$f[] = "# www.keezmovies.com";
$f[] = "enable_keezmovies_cache = 1";
$f[] = "";
$f[] = "# www.pornhub.com";
$f[] = "enable_pornhub_cache = 1";
$f[] = "";
$f[] = "# www.redute.com";
$f[] = "enable_redtube_cache = 1";
$f[] = "";
$f[] = "# www.slutload.com";
$f[] = "enable_slutload_cache = 1";
$f[] = "";
$f[] = "# www.spankwire.com";
$f[] = "enable_spankwire_cache = 1";
$f[] = "";
$f[] = "# www.tube8.com";
$f[] = "enable_tube8_cache = 1";
$f[] = "";
$f[] = "# www.xhamster.com";
$f[] = "enable_xhamster_cache = 1";
$f[] = "";
$f[] = "# www.xtube.com";
$f[] = "enable_xtube_cache = 1";
$f[] = "";
$f[] = "# www.xvideos.com";
$f[] = "enable_xvideos_cache = 1";
$f[] = "";
$f[] = "# www.youporn.com";
$f[] = "enable_youporn_cache = 1";
$f[] = "";
$f[] = "";
$f[] = "#------------------------------------------------------------------------------";
$f[] = "# Apache Configuration Options |";
$f[] = "#------------------------------------------------------------------------------";
$f[] = "";
$f[] = "# Use this option if you don't want Videocache to generate Apache specific";
$f[] = "# configuration on your system. This can be used when you are using other";
$f[] = "# web server than Apache. Like lighttpd etc.";
$f[] = "# Default : 0";
$f[] = "skip_apache_conf = 0";
$f[] = "";
$f[] = "# This option specifies the absolute path to your Apache's conf.d or extra";
$f[] = "# directory. Videocache will generate and save Videocache spcecific ";
$f[] = "# configuration for Apache in this directory.";
$f[] = "# Example : /etc/httpd/conf.d/ or /etc/apache2/conf.d/ or /etc/httpd/extra/";
$f[] = "# Default : NOT SET";
$httpdconf = $unix->LOCATE_APACHE_CONF_PATH();
$python = $unix->find_program("python");
$DAEMON_PATH = $unix->getmodpathfromconf($httpdconf);
$sock->SET_INFO("EnableFreeWeb", 1);
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Apache..................: {$DAEMON_PATH}\n";
}
$f[] = "apache_conf_dir = {$DAEMON_PATH}";
$f[] = "";
$f[] = "# This option can be used to hide cache directories from your clients. Your";
$f[] = "# clients will not be able to browse the contents cache directories via HTTP";
$f[] = "# if this option is enabled. Browsing videos will not be affected.";
$f[] = "# Default : 1";
$f[] = "hide_cache_dirs = 1";
$f[] = "";
@file_put_contents("/etc/videocache.conf", @implode("\n", $f));
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} /etc/videocache.conf done\n";
}
shell_exec("{$python} /usr/share/videocache/vc-update >/dev/null 2>&1");
$f[] = array();
$StreamCacheCache = $sock->GET_INFO("StreamCacheCache");
$StreamCacheMainCache = $sock->GET_INFO("StreamCacheMainCache");
if ($StreamCacheCache == null) {
$StreamCacheCache = "/home/squid/videocache";
}
if ($StreamCacheMainCache == null) {
$StreamCacheMainCache = "/home/squid/streamcache";
}
$f[] = "##############################################################################";
$f[] = "# #";
$f[] = "# file : {$DAEMON_PATH}/videocache.conf #";
$f[] = "# #";
$f[] = "# Videocache is a squid url rewriter to cache videos from various websites. #";
$f[] = "# Check http://cachevideos.com/ for more details. #";
$f[] = "# #";
$f[] = "# ----------------------------- Note This ---------------------------------- #";
$f[] = "# Don't change this file under any circumstances. #";
$f[] = "# Use /etc/videocache.conf to configure Videocache. #";
$f[] = "# #";
$f[] = "##############################################################################";
$f[] = "";
$f[] = "";
$f[] = "Alias /crossdomain.xml /home/squid/videocache/youtube_crossdomain.xml";
$f[] = "Alias /videocache {$StreamCacheCache}/";
$f[] = "<Directory {$StreamCacheCache}/>";
$f[] = " Options -Indexes";
$f[] = " Order Allow,Deny";
$f[] = " Allow from all";
$f[] = " <IfModule mod_headers.c>";
$f[] = " Header add Videocache \"2.0.0\"";
$f[] = " Header add X-Cache \"HIT from 192.168.1.210\"";
$f[] = " </IfModule>";
$f[] = " <IfModule mod_mime.c>";
$f[] = " AddType video/webm .webm";
$f[] = " AddType application/vnd.android.package-archive .android";
$f[] = " </IfModule>";
$f[] = "</Directory>";
$f[] = "";
if (!is_file("{$DAEMON_PATH}/videocache.conf")) {
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} {$DAEMON_PATH}/videocache.conf done\n";
}
@file_put_contents("{$DAEMON_PATH}/videocache.conf", @implode("\n", $f));
}
$f = array();
$LOCATE_APACHE_CONF_PATH = $unix->LOCATE_APACHE_CONF_PATH();
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Apache config: {$LOCATE_APACHE_CONF_PATH}\n";
}
$APACHECONF = FALSE;
$exp = explode("\n", @file_get_contents($LOCATE_APACHE_CONF_PATH));
while (list($index, $line) = each($exp)) {
if (!preg_match("#Include.*?videocache\\.conf#", $line)) {
continue;
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Apache {$line} Done\n";
}
$APACHECONF = true;
}
$php = $unix->LOCATE_PHP5_BIN();
if (!$APACHECONF) {
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Reconfigure Apache\n";
}
shell_exec("{$php} /usr/share/artica-postfix/exec.freeweb.php --httpd");
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} Configuration done..\n";
}
}
function build()
{
$sock = new sockets();
$unix = new unix();
$ini = new Bs_IniHandler();
$IPADDRSSL = array();
$IPADDRSSL2 = array();
$ArticaSquidParameters = $sock->GET_INFO('ArticaSquidParameters');
$visible_hostname = $ini->_params["NETWORK"]["visible_hostname"];
if ($visible_hostname == null) {
$visible_hostname = $unix->hostname_g();
}
if (strpos($visible_hostname, ".") > 0) {
$visible_hostnameTR = explode(".", $visible_hostname);
$visible_hostnameTR[0] = $visible_hostnameTR[0] . "-nat";
$visible_hostname = @implode(".", $visible_hostnameTR);
} else {
$visible_hostname = "nat-{$visible_hostname}";
}
$SquidBinIpaddr = $sock->GET_INFO("SquidBinIpaddr");
$AllowAllNetworksInSquid = $sock->GET_INFO("AllowAllNetworksInSquid");
if (!is_numeric($AllowAllNetworksInSquid)) {
$AllowAllNetworksInSquid = 1;
}
$ini->loadString($ArticaSquidParameters);
NETWORK_ALL_INTERFACES();
$LISTEN_PORT = intval($ini->_params["NETWORK"]["LISTEN_PORT"]);
$ICP_PORT = intval(trim($ini->_params["NETWORK"]["ICP_PORT"]));
$certificate_center = $ini->_params["NETWORK"]["certificate_center"];
$SSL_BUMP = intval($ini->_params["NETWORK"]["SSL_BUMP"]);
$LogsWarninStop = intval($sock->GET_INFO("LogsWarninStop"));
$ssl = false;
if ($ICP_PORT == 0) {
$ICP_PORT = 3130;
}
if ($LISTEN_PORT == 0) {
$LISTEN_PORT = 3128;
}
$squid = new squidbee();
$q = new mysql_squid_builder();
$IPADDRS = array();
$ParentSquid27Port = intval($sock->GET_INFO("ParentSquid27Port"));
if ($ParentSquid27Port == 0) {
$ParentSquid27Port = 13298;
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [CONF]: {$GLOBALS["SERVICE_NAME"]} visible hostname........: {$visible_hostname}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [CONF]: {$GLOBALS["SERVICE_NAME"]} AllowAllNetworksInSquid.: {$AllowAllNetworksInSquid}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [CONF]: {$GLOBALS["SERVICE_NAME"]} ICP Port................: {$ICP_PORT}\n";
}
$sql = "SELECT * FROM proxy_ports WHERE enabled=1 and is_nat=1";
$results = $q->QUERY_SQL($sql);
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [CONF]: {$GLOBALS["SERVICE_NAME"]} " . mysql_num_rows($results) . " ports\n";
}
$f[] = "# --------- proxy_ports enabled=1 and is_nat=1 -> " . mysql_num_rows($results) . " ports";
$MAINSSL = array();
while ($ligne = mysql_fetch_assoc($results)) {
$ipaddr = $ligne["ipaddr"];
$xport = $ligne["port"];
$ssl = intval($ligne["UseSSL"]);
$eth = $ligne["nic"];
$transparent_text = null;
$ipaddr = "0.0.0.0";
$transparent = " transparent";
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} {$eth} {$ipaddr}:{$xport}\n";
}
if ($eth != null) {
$ipaddr = $GLOBALS["NETWORK_ALL_NICS"][$eth]["IPADDR"];
if ($ipaddr == null) {
$conf[] = "# --------- table proxy_ports {$eth} {$ipaddr}:{$xport} -> Hardware Error [" . __LINE__ . "]\n";
$conf[] = "# --------- http {$ipaddr} -> Hardware Error -> 0.0.0.0 [" . __LINE__ . "]\n";
$ipaddr = "0.0.0.0";
}
}
$f[] = "# --------- Port {$xport} listen on {$eth} ({$ipaddr}) UseSSL={$ssl}";
if ($ssl == 1) {
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} {$ipaddr}:{$xport}: SSL Intercept...........: Yes - {$ssl_port}\n";
}
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} {$ipaddr}:{$xport}: Certificate.............: {$ligne["sslcertificate"]}\n";
}
$MAINSSL = $squid->SaveCertificate($ligne["sslcertificate"], false, false, false, true);
$f[] = $MAINSSL[0];
$key = $MAINSSL[1]["key"];
$certificate = $MAINSSL[1]["certificate"];
$f[] = "https_port {$ipaddr}:{$xport} transparent cert={$certificate} key={$key}";
continue;
}
$f[] = "http_port {$ipaddr}:{$xport}{$transparent}";
}
if ($AllowAllNetworksInSquid == 1) {
$f[] = "acl localnet src all";
}
if ($AllowAllNetworksInSquid == 0) {
$k = array();
$NetworkScannerMasks = $sock->GET_INFO('NetworkScannerMasks');
$tbl = explode("\n", $NetworkScannerMasks);
if (is_array($tbl)) {
while (list($num, $cidr) = each($tbl)) {
if (trim($cidr) == null) {
continue;
}
$k[$cidr] = $cidr;
}
}
if (count($this->network_array) > 0) {
while (list($num, $val) = each($this->network_array)) {
if ($val == null) {
continue;
}
$k[$val] = $val;
}
}
if (count($k == 0)) {
$f[] = "acl localnet src all";
}
if (count($k > 0)) {
while (list($m, $l) = each($k)) {
$s[] = $l;
}
$f[] = "acl localnet src " . implode(" ", $s);
}
}
$f[] = "acl all src all";
$f[] = "acl manager proto cache_object";
$f[] = "acl localhost src 127.0.0.1/32";
$f[] = "acl to_localhost dst 127.0.0.0/8 0.0.0.0/32";
$f[] = "acl SSL_ports port \"/etc/squid3/acls/SSLPorts\"";
$f[] = "acl Safe_ports port 80\t\t# http";
$f[] = "acl Safe_ports port 21\t\t# ftp";
$f[] = "acl Safe_ports port 443\t\t# https";
$f[] = "acl Safe_ports port 70\t\t# gopher";
$f[] = "acl Safe_ports port 210\t\t# wais";
$f[] = "acl Safe_ports port 1025-65535\t# unregistered ports";
$f[] = "acl Safe_ports port 280\t\t# http-mgmt";
$f[] = "acl Safe_ports port 488\t\t# gss-http";
$f[] = "acl Safe_ports port 591\t\t# filemaker";
$f[] = "acl Safe_ports port 777\t\t# multiling http";
$f[] = "acl CONNECT method CONNECT";
$f[] = "";
$f[] = "";
$f[] = "http_access allow manager localhost";
$f[] = "http_access deny manager";
$f[] = "http_access deny !Safe_ports";
$f[] = "http_access deny CONNECT !SSL_ports";
$f[] = "http_access allow localnet";
$f[] = "http_access deny all";
$f[] = "icp_access allow localnet";
$f[] = "icp_access deny all";
$f[] = "cache_peer 127.0.0.1\tparent\t{$ParentSquid27Port}\t3130\tdefault";
$f[] = "never_direct allow all";
$f[] = "cache_mem 64 MB";
$f[] = "maximum_object_size_in_memory 64 KB";
$f[] = "memory_replacement_policy lru";
$LOGFORMAT[] = "%>a";
$LOGFORMAT[] = "%[ui";
$LOGFORMAT[] = "%[un";
$LOGFORMAT[] = "[%tl]";
$LOGFORMAT[] = "\"%rm %ru HTTP/%rv\"";
$LOGFORMAT[] = "%Hs";
$LOGFORMAT[] = "%<st";
$LOGFORMAT[] = "%Ss:";
$LOGFORMAT[] = "%Sh";
$LOGFORMAT[] = "UserAgent:\"%{User-Agent}>h\"";
$LOGFORMAT[] = "Forwarded:\"%{X-Forwarded-For}>h\"";
$f[] = "logformat common MAC:00:00:00:00:00:00 " . @implode(" ", $LOGFORMAT);
$f[] = "access_log none";
$f[] = "cache_store_log none";
if ($LogsWarninStop == 0) {
$f[] = "logfile_rotate 10";
}
if ($LogsWarninStop == 1) {
$f[] = "logfile_rotate 0";
}
$f[] = "# emulate_httpd_log off";
$f[] = "log_ip_on_direct on";
$f[] = "mime_table /etc/squid27/mime.conf";
$f[] = "# log_mime_hdrs off";
$f[] = "pid_filename /var/run/squid/squid-nat.pid";
$f[] = "debug_options ALL,1";
$f[] = "log_fqdn on";
$f[] = "client_netmask 255.255.255.255";
$f[] = "strip_query_terms off";
$f[] = "buffered_logs on";
$f[] = "netdb_filename /var/log/squid/netdb_nat.state";
if ($LogsWarninStop == 0) {
$f[] = "cache_log /var/log/squid/cache-nat.log";
}
if ($LogsWarninStop == 1) {
$f[] = "cache_log /dev/null";
}
$f[] = "#url_rewrite_program";
$f[] = "# url_rewrite_children 5";
$f[] = "# url_rewrite_concurrency 0";
$f[] = "# url_rewrite_host_header on";
$f[] = "refresh_pattern .\t\t0\t20%\t4320";
$f[] = "cache_effective_user squid";
$f[] = "cache_effective_group squid";
$f[] = "httpd_suppress_version_string on";
$f[] = "visible_hostname {$visible_hostname}";
$f[] = "cache_dir null /tmp";
$f[] = "# icon_directory /usr/share/squid27/icons";
$f[] = "# error_directory /usr/share/squid27/errors/English";
$f[] = "forwarded_for on";
$f[] = "client_db on";
$f[] = "";
CheckFilesAndSecurity();
@file_put_contents("/etc/squid27/squid.conf", @implode("\n", $f));
if ($GLOBALS["OUTPUT"]) {
echo "Starting......: " . date("H:i:s") . " [INIT]: {$GLOBALS["SERVICE_NAME"]} /etc/squid27/squid.conf done\n";
}
}
