function script_startfile()
{
$unix = new unix();
$sock = new sockets();
$GLOBALS["echobin"] = $unix->find_program("echo");
$php = $unix->LOCATE_PHP5_BIN();
$sh = array();
$SquidWCCPEnabled = $sock->GET_INFO("SquidWCCPEnabled");
$hasProxyTransparent = $sock->GET_INFO("hasProxyTransparent");
$EnableArticaHotSpot = $sock->GET_INFO("EnableArticaHotSpot");
if (!is_numeric($SquidWCCPEnabled)) {
$SquidWCCPEnabled = 0;
}
if (!is_numeric($hasProxyTransparent)) {
$hasProxyTransparent = 0;
}
if (!is_numeric($EnableArticaHotSpot)) {
$EnableArticaHotSpot = 0;
}
$sh[] = "#!/bin/sh -e";
$sh[] = "### BEGIN INIT INFO";
$sh[] = "# Builded on " . date("Y-m-d H:i:s");
$sh[] = "# Provides: tproxy";
$sh[] = "# Required-Start: \$local_fs";
$sh[] = "# Required-Stop: \$local_fs";
$sh[] = "# Should-Start:\t\t";
$sh[] = "# Should-Stop:\t\t";
$sh[] = "# Default-Start: S";
$sh[] = "# Default-Stop: 0 6";
$sh[] = "# Short-Description: start and stop the tproxy";
$sh[] = "# Description: Artica tproxy service Raise transparent proxy";
$sh[] = "### END INIT INFO";
$sh[] = "case \"\$1\" in";
$sh[] = "start)";
$sh[] = "{$GLOBALS["echobin"]} \"TProxy: Removing Iptables rules\"";
$sh[] = $php . " " . dirname(__FILE__) . "/exec.squid.transparent.delete.php >/dev/null || true";
$sh[] = "{$GLOBALS["echobin"]} \"TProxy: hasProxyTransparent key ({$hasProxyTransparent})...\"";
$sh[] = "{$GLOBALS["echobin"]} \"TProxy: SquidWCCPEnabled key ({$SquidWCCPEnabled})...\"";
$sh[] = "{$GLOBALS["echobin"]} \"TProxy: EnableArticaHotSpot key ({$EnableArticaHotSpot})...\"";
$sh[] = script_tproxy();
$sh[] = script_endfile();
@file_put_contents("/etc/init.d/tproxy", @implode("\n", $sh));
@chmod("/etc/init.d/tproxy", 0755);
build_progress("Installing default script...", 40);
script_install();
build_progress("Default script...{done}", 50);
}
function buildScript()
{
$unix = new unix();
$sock = new sockets();
$GLOBALS["echobin"] = $unix->find_program("echo");
$php = $unix->LOCATE_PHP5_BIN();
$sh = array();
$parse_rules = parse_rules();
if ($parse_rules == null) {
script_uninstall();
return;
}
$sh[] = "#!/bin/sh -e";
$sh[] = "### BEGIN INIT INFO";
$sh[] = "# Builded on " . date("Y-m-d H:i:s");
$sh[] = "# Provides: fw-stats";
$sh[] = "# Required-Start: \$local_fs";
$sh[] = "# Required-Stop: \$local_fs";
$sh[] = "# Should-Start:\t\t";
$sh[] = "# Should-Stop:\t\t";
$sh[] = "# Default-Start: S";
$sh[] = "# Default-Stop: 0 6";
$sh[] = "# Short-Description: start and stop the Firewall-stats";
$sh[] = "# Description: Artica Firewall Statistics Appliance";
$sh[] = "### END INIT INFO";
$sh[] = "case \"\$1\" in";
$sh[] = "start)";
$sh[] = "if [ ! -f /etc/rsyslog.d/stats-appliance.conf ]; then";
$sh[] = "{$GLOBALS["echobin"]} \"Building syslog configuration\"";
$sh[] = "\t{$php} /usr/share/artica-postfix/exec.syslog-engine.php --build-server || true";
$sh[] = "\t/etc/init.d/rsyslog restart || true";
$sh[] = "fi";
$sh[] = "if [ -f /etc/rsyslog.d/stats-appliance.conf ]; then";
$sh[] = "{$GLOBALS["echobin"]} \"Syslog configuration [OK]\"";
$sh[] = "fi";
$sh[] = "{$GLOBALS["echobin"]} \"Removing Iptables rules\"";
$sh[] = $php . " " . __FILE__ . " --delete >/dev/null || true";
$sh[] = $parse_rules;
$sh[] = "{$GLOBALS["echobin"]} \"Iptables rules done.\"";
$sh[] = ";;";
$sh[] = " stop)";
$sh[] = $php . " " . __FILE__ . " --delete >/dev/null || true";
$sh[] = ";;";
$sh[] = " reconfigure)";
$sh[] = "{$GLOBALS["echobin"]} \"Removing Iptables rules\"";
$sh[] = $php . " " . __FILE__ . " --delete >/dev/null || true";
$sh[] = $php . " " . __FILE__ . " >/dev/null || true";
$sh[] = "{$GLOBALS["echobin"]} \"Iptables rules done.\"";
$sh[] = "{$GLOBALS["echobin"]} \"Running builded script\"";
$sh[] = "/etc/init.d/iptables-statsapp start";
$sh[] = ";;";
$sh[] = " restart)";
$sh[] = "{$GLOBALS["echobin"]} \"Removing Iptables rules\"";
$sh[] = $php . " " . __FILE__ . " --delete >/dev/null || true";
$sh[] = $php . " " . __FILE__ . " >/dev/null || true";
$sh[] = "{$GLOBALS["echobin"]} \"Iptables rules done.\"";
$sh[] = "{$GLOBALS["echobin"]} \"Running builded script\"";
$sh[] = "/etc/init.d/iptables-statsapp start";
$sh[] = ";;";
$sh[] = "*)";
$sh[] = " echo \"Usage: \$0 {start ,restart,configure or stop only}\"";
$sh[] = "exit 1";
$sh[] = ";;";
$sh[] = "esac";
$sh[] = "exit 0\n";
@file_put_contents("/etc/init.d/iptables-statsapp", @implode("\n", $sh));
script_install();
}
function iptables_rules()
{
$squid = new squidbee();
$unix = new unix();
$sock = new sockets();
$SquidBinIpaddr = trim($sock->GET_INFO("SquidBinIpaddr"));
if ($SquidBinIpaddr == null) {
$SquidBinIpaddr = "0.0.0.0";
}
$UseTProxyMode = intval($sock->GET_INFO("UseTProxyMode"));
$EnableArticaHotSpot = $sock->GET_INFO("EnableArticaHotSpot");
$ssl_port = $squid->get_ssl_port();
if (!is_numeric($squid->listen_port)) {
$squid->listen_port = 3128;
}
$listen_ssl_port = $squid->listen_port + 1;
$SSL_BUMP = $squid->SSL_BUMP;
$iptables = $unix->find_program("iptables");
$GLOBALS["IPTABLESBIN"] = $iptables;
$sysctl = $unix->find_program("sysctl");
$ips = $unix->ifconfig_interfaces_list();
$KernelSendRedirects = $sock->GET_INFO("KernelSendRedirects");
if (!is_numeric($KernelSendRedirects)) {
$KernelSendRedirects = 1;
}
if (!is_numeric($EnableArticaHotSpot)) {
$EnableArticaHotSpot = 0;
}
$EnableNatProxy = intval($sock->GET_INFO("EnableNatProxy"));
$NatProxyServer = $sock->GET_INFO("NatProxyServer");
$NatProxyPort = intval($sock->GET_INFO("NatProxyPort"));
echo "Starting......: " . date("H:i:s") . " Squid iptables Rules: UseTProxyMode.....:{$UseTProxyMode}\n";
if ($UseTProxyMode == 1) {
disable_transparent();
iptables_wccp_delete_all();
$php = $unix->LOCATE_PHP5_BIN();
echo "Starting......: " . date("H:i:s") . " Squid running Tproxy Mode\n";
system("{$php} /usr/share/artica-postfix/exec.squid.tproxy.php");
echo "Starting......: " . date("H:i:s") . " Squid running TProxy script...\n";
shell_exec("/etc/init.d/tproxy start");
return;
}
$php = $unix->LOCATE_PHP5_BIN();
$GLOBALS["echobin"] = $unix->find_program("echo");
$MARKLOG = "-m comment --comment \"ArticaSquidTransparent\"";
$sh = array();
$sh[] = script_startfile();
build_progress("Creating rules...", 35);
$sh[] = "{$GLOBALS["echobin"]} \"Patching kernel\"";
$sh[] = "{$sysctl} -w net.ipv4.ip_forward=1 2>&1";
$sh[] = "{$sysctl} -w net.ipv4.conf.default.send_redirects={$KernelSendRedirects} 2>&1";
$sh[] = "{$sysctl} -w net.ipv4.conf.all.send_redirects={$KernelSendRedirects} 2>&1";
if (is_file("/proc/sys/net/ipv4/conf/eth0/send_redirects")) {
$sh[] = "{$sysctl} -w net.ipv4.conf.eth0.send_redirects={$KernelSendRedirects} 2>&1";
}
$sh[] = "{$php} /usr/share/artica-postfix/exec.squid.transparent.delete.php || true";
$sh[] = ebtables_rules();
$sh[] = "{$GLOBALS["echobin"]} \"Enable rules\"";
$sh[] = "{$iptables} -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT {$MARKLOG} || true";
if (!$GLOBALS["EBTABLES"]) {
$sh[] = "{$GLOBALS["echobin"]} \"Add internetT dictionary\"";
$sh[] = "{$iptables} -t mangle -N internetT {$MARKLOG} || true";
$sh[] = "{$GLOBALS["echobin"]} \"Add internsslT dictionary\"";
$sh[] = "{$iptables} -t mangle -N internsslT {$MARKLOG} || true";
$sh[] = "{$GLOBALS["echobin"]} \"Add mangle MARK 97 for internsslT\"";
$sh[] = "{$iptables} -t mangle -A internsslT -j MARK --set-mark 97 {$MARKLOG} || true";
$sh[] = "{$GLOBALS["echobin"]} \"Add mangle MARK 96 for internetT\"";
$sh[] = "{$iptables} -t mangle -A internetT -j MARK --set-mark 96 {$MARKLOG} || true";
}
$sh[] = "{$iptables} -t nat -A OUTPUT --match owner --uid-owner squid -p tcp -j ACCEPT {$MARKLOG}";
$sh[] = "{$iptables} -t nat -A OUTPUT --match owner --uid-owner squid -p tcp -j ACCEPT {$MARKLOG}";
$sh[] = "{$iptables} -t nat -I POSTROUTING -p tcp --dport 80 -j MASQUERADE {$MARKLOG}";
$sh[] = "{$iptables} -t nat -I POSTROUTING -p tcp --dport 443 -j MASQUERADE {$MARKLOG}";
$sql = "SELECT * FROM transparent_networks WHERE `enabled`=1 ORDER BY zOrder";
$q = new mysql_squid_builder();
$results = $q->QUERY_SQL($sql);
while ($ligne = mysql_fetch_assoc($results)) {
$transparent = $ligne["transparent"];
$block = $ligne["block"];
if ($ligne["destination_port"] == 0) {
$ligne["destination_port"] = 80;
if ($ligne["ssl"] == 1) {
$ligne["destination_port"] == 443;
}
}
if ($ligne["destination_port"] == 443) {
$ligne["ssl"] = 1;
}
if ($ligne["destination_port"] == 80) {
$ligne["ssl"] = 0;
}
if ($block == 1) {
$sh[] = pattern_to_www($ligne);
continue;
}
if ($transparent == 0) {
$sh[] = pattern_to_direct($ligne);
continue;
}
$sh[] = pattern_to_proxy($ligne, $squid->listen_port, $ssl_port);
}
if ($EnableNatProxy == 1) {
$sh[] = "{$iptables} -t nat -I PREROUTING -s {$NatProxyServer}/32 -p tcp -m tcp --dport 80 {$MARKLOG} -j RETURN";
$sh[] = "{$iptables} -t nat -I PREROUTING -s {$NatProxyServer}/32 -p tcp -m tcp --dport 443 {$MARKLOG} -j RETURN";
}
$sh[] = ChildsProxys();
$sh[] = script_endfile();
build_progress("Writing script...", 45);
@file_put_contents("/etc/init.d/tproxy", @implode("\n", $sh));
build_progress("Installing script...", 48);
script_install();
}
