smeserver/smeserver-proxy
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

initial commit of file from CVS for e-smith-proxy on Wed 12 Jul 09:06:18 BST 2023

Browse Source
This commit is contained in:
Brian Read
2023-07-12 09:06:18 +01:00
parent 1041715762
commit a376640216
68 changed files with 1794 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
root/etc/e-smith/db/configuration/defaults/squid/EnforceSafePorts Normal file
View File

@@ -0,0 +1 @@
no

1
root/etc/e-smith/db/configuration/defaults/squid/SafePorts Normal file
View File

@@ -0,0 +1 @@
21,70,80,81,119,210,443,563,980,1024-65535

1
root/etc/e-smith/db/configuration/defaults/squid/TCPPort Normal file
View File

@@ -0,0 +1 @@
3128

1
root/etc/e-smith/db/configuration/defaults/squid/TCPProxyPort Normal file
View File

@@ -0,0 +1 @@
80:3128

1
root/etc/e-smith/db/configuration/defaults/squid/TransparentPort Normal file
View File

@@ -0,0 +1 @@
3128

1
root/etc/e-smith/db/configuration/defaults/squid/access Normal file
View File

@@ -0,0 +1 @@
private

1
root/etc/e-smith/db/configuration/defaults/squid/status Normal file
View File

@@ -0,0 +1 @@
enabled

1
root/etc/e-smith/db/configuration/defaults/squid/type Normal file
View File

@@ -0,0 +1 @@
service

0
root/etc/e-smith/events/bootstrap-console-save/.gitignore vendored Normal file
View File

76
root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/proxy Normal file
View File

@@ -0,0 +1,76 @@
<!-- vim: ft=xml ts=4 sw=4 et ai:
-->
<lexicon lang="en-us">
<entry>
<base>Proxy settings</base>
<trans>Proxy settings</trans>
</entry>
<entry>
<base>FIRST_PAGE_DESCRIPTION</base>
<trans>
This page allows configuration of the server's
proxy settings.
The server includes a transparent proxy and cache for
HTTP traffic. This is enabled by default, but not enforced
if the server is in &quot;serveronly&quot; mode.
If this server is acting as an e-mail server, connections
from local network clients to external SMTP servers
will default to being redirected to the local e-mail server.
</trans>
</entry>
<entry>
<base>HTTP_PROXY_STATUS_DESCRIPTION</base>
<trans>
The server's HTTP proxy works to reduce overall uplink usage by
caching recently-visited pages. It is transparent to web browsers
using this server as their gateway. Enable or disable this proxy
with the following toggle.
</trans>
</entry>
<entry>
<base>HTTP_PROXY_STATUS_LABEL</base>
<trans>HTTP proxy status</trans>
</entry>
<entry>
<base>SMTP_PROXY_STATUS_DESCRIPTION</base>
<trans>
The server's transparent SMTP proxy works to reduce virus traffic
from infected client hosts by forcing all outgoing SMTP traffic
through this server if set to "enabled".
If you wish to use an alternate SMTP server, and this server is
your gateway to it, set this proxy to "disabled". Setting the
proxy to "blocked" prevents all SMTP traffic to other servers,
this is the default. The proxy only intercepts/blocks normal smtp
(port 25) traffic.
</trans>
</entry>
<entry>
<base>SMTP_PROXY_STATUS_LABEL</base>
<trans>SMTP proxy status</trans>
</entry>
<entry>
<base>ERR_PROXY_UPDATE_FAILED</base>
<trans>
ERROR: The proxy-update event returned an error.
</trans>
</entry>
<entry>
<base>ERR_NO_SQUID_REC</base>
<trans>
ERROR: There is no squid record in the configuration database.
</trans>
</entry>
<entry>
<base>SUCCESS</base>
<trans>
The new proxy settings were applied successfully.
</trans>
</entry>
<entry>
<base>BLOCKED</base>
<trans>Blocked</trans>
</entry>
</lexicon>

3
root/etc/e-smith/templates.metadata/etc/squid/squid.conf Normal file
View File

@@ -0,0 +1,3 @@
PERMS=0640
UID="root"
GID="squid"

20
root/etc/e-smith/templates/etc/crontab/squid Normal file
View File

@@ -0,0 +1,20 @@
{
return "# squid is disabled\n" unless $squid{status} eq 'enabled';
my $freq = $squid{Rotate} || 'daily';
my $min = int(rand(60));
my $hour = int(rand(5));
my $dow = substr(localtime,0,3);
if ($freq eq 'hourly') {
return "$min * * * * root squid -k rotate\n";
} elsif ($freq eq 'weekly') {
return "$min $hour * * $dow root squid -k rotate\n";
} elsif ($freq eq 'monthly') {
return "$min $hour 15 * * root squid -k rotate\n";
} elsif ($freq eq 'disabled') {
return "# squid rotate disabled\n";
} else {
return "$min $hour * * * root squid -k rotate\n"
}
}

2
root/etc/e-smith/templates/etc/dhcpd.conf/11wpad Normal file
View File

@@ -0,0 +1,2 @@
option wpad-url code 252 = text;

15
root/etc/e-smith/templates/etc/dhcpd.conf/26wpad Normal file
View File

@@ -0,0 +1,15 @@
{
my $transproxy = $squid{Transparent} || "yes";
my $status = $squid{status} || "disabled";
if ($transproxy eq "yes" && $status eq "enabled")
{
$OUT .= " option wpad-url \"http://wpad.$DomainName/wpad.dat\";";
}
else
{
$OUT .= '# wpad-url disabled';
}
}

9
root/etc/e-smith/templates/etc/httpd/conf/httpd.conf/96ProxyConf Normal file
View File

@@ -0,0 +1,9 @@
{
foreach my $file (qw(wpad.dat proxy.pac))
{
$OUT .= "Alias /$file /etc/httpd/conf/proxy/proxy.pac\n";
$OUT .= "<Location /$file>\n";
$OUT .= " Require ip $localAccess\n";
$OUT .= "</Location>\n";
}
}

2
root/etc/e-smith/templates/etc/httpd/conf/proxy/proxy.pac/05directLocalhostname Normal file
View File

@@ -0,0 +1,2 @@
if (isPlainHostName(host))
return "DIRECT";

2
root/etc/e-smith/templates/etc/httpd/conf/proxy/proxy.pac/10directLocalNetwork Normal file
View File

@@ -0,0 +1,2 @@
if (isInNet(host, "{ $LocalIP }", "{ $LocalNetmask }"))
return "DIRECT";

2
root/etc/e-smith/templates/etc/httpd/conf/proxy/proxy.pac/10directLocalhost Normal file
View File

@@ -0,0 +1,2 @@
if (isInNet(host, "127.0.0.1", "255.255.255.255"))
return "DIRECT";

9
root/etc/e-smith/templates/etc/httpd/conf/proxy/proxy.pac/90proxyDefault Normal file
View File

@@ -0,0 +1,9 @@
{
my $enabled = $squid{status} || 'disabled';
my $port = $squid{TransparentPort} || 3128;
my $target = ($enabled eq 'enabled') ?
"PROXY proxy.$DomainName:$port" :
"DIRECT";
$OUT = ' return "' . $target . '";';
}

1
root/etc/e-smith/templates/etc/httpd/conf/proxy/proxy.pac/99endFunction Normal file
View File

@@ -0,0 +1 @@
\}

2
root/etc/e-smith/templates/etc/httpd/conf/proxy/proxy.pac/template-begin Normal file
View File

@@ -0,0 +1,2 @@
function FindProxyForURL(url, host)
\{

38
root/etc/e-smith/templates/etc/rc.d/init.d/masq/35transproxy Normal file
View File

@@ -0,0 +1,38 @@
{
$OUT = '';
# Create new chain to manage TransProxy stuff
# Note: We send all traffic destined to port 80, regardless of
# where it's from, since the filter table will worry about source.
$OUT .= " /sbin/iptables --table nat --new-chain TransProxy\n";
$OUT .= " /sbin/iptables --table nat --append PREROUTING\\\n";
$OUT .= "\t-p tcp --dport 80 -j TransProxy\n";
# Accept any accesses to the local IPs directly
$OUT .= " /sbin/iptables --table nat --append TransProxy \\\n";
$OUT .= "\t--destination 127.0.0.1 --jump ACCEPT\n";
$OUT .= " /sbin/iptables --table nat --append TransProxy \\\n";
$OUT .= "\t--destination $LocalIP --jump ACCEPT\n";
if (defined $ExternalIP) {
# Accept any accesses to the ExternalIP directly
$OUT .= " /sbin/iptables --table nat --append TransProxy \\\n";
$OUT .= "\t--destination \$OUTERNET --jump ACCEPT\n";
}
my $transproxy = $squid{Transparent} || "yes";
my $status = $squid{status} || "disabled";
if ($transproxy eq "yes" && $status eq "enabled") {
##my $proxyport = $squid{TransparentPort} || "3128";
my $proxyport = $squid{InterceptPort} || "8080";
# Otherwise, divert port 80 traffic through our proxy
$OUT .= " /sbin/iptables --table nat --append TransProxy\\\n";
$OUT .= "\t-p TCP -j DNAT --to $LocalIP:$proxyport\n";
} else {
# Or just let it go unhindered
$OUT .= " /sbin/iptables --table nat --append TransProxy\\\n";
$OUT .= "\t--jump ACCEPT\n";
}
}

32
root/etc/e-smith/templates/etc/rc.d/init.d/masq/90adjustTransProxy Normal file
View File

@@ -0,0 +1,32 @@
{
# Update any rules which may have changed, meaning
# - $ExternalIP
# - enabled/disabled
# - Transproxy port (unlikely)
my $rule = 3;
if (defined $ExternalIP)
{
# Accept any accesses to the ExternalIP directly
$OUT .= " /sbin/iptables --table nat \\\n";
$OUT .= "\t--replace TransProxy $rule\\\n";
$OUT .= "\t--destination \$OUTERNET --jump ACCEPT\n";
$rule++;
}
my $transproxy = $squid{Transparent} || "yes";
my $status = $squid{status} || "disabled";
if ($transproxy eq "yes" && $status eq "enabled")
{
##my $proxyport = $squid{TransparentPort} || "3128";
my $proxyport = $squid{InterceptPort} || "8080";
# Otherwise, divert port 80 traffic through our proxy
$OUT .= " /sbin/iptables --table nat --replace TransProxy $rule\\\n";
$OUT .= "\t-p TCP -j DNAT --to $LocalIP:$proxyport\n";
}
else
{
# Or just let it go unhindered
$OUT .= " /sbin/iptables --table nat --replace TransProxy $rule\\\n";
$OUT .= "\t--jump ACCEPT\n";
}
}

2
root/etc/e-smith/templates/etc/rsyslog.conf/46squid Normal file
View File

@@ -0,0 +1,2 @@
if $programname == 'squid' then /var/log/squid/squid.log
& stop

13
root/etc/e-smith/templates/etc/squid/squid.conf/10HTTPPort Normal file
View File

@@ -0,0 +1,13 @@
{
my $transproxy = $squid{Transparent} || "yes";
if ($transproxy eq 'yes') {
$OUT .= "http_port $LocalIP:" . ($squid{TCPPort} || '3128') . "\n";
$OUT .= "http_port 127.0.0.1:" . ($squid{TCPPort} || '3128') . "\n";
$OUT .= "http_port $LocalIP:" . ($squid{InterceptPort} || '8080') . " intercept\n";
$OUT .= "http_port 127.0.0.1:" . ($squid{InterceptPort} || '8080') . " intercept\n";
} else {
$OUT .= "http_port $LocalIP:" . ($squid{TCPPort} || '3128') . "\n";
$OUT .= "http_port 127.0.0.1:" . ($squid{TCPPort} || '3128') . "\n";
}
}

4
root/etc/e-smith/templates/etc/squid/squid.conf/10ICPAddresses Normal file
View File

@@ -0,0 +1,4 @@
{
$OUT .= "udp_incoming_address $LocalIP\n";
$OUT .= "udp_outgoing_address 0.0.0.0";
}

10
root/etc/e-smith/templates/etc/squid/squid.conf/10ParentCache Normal file
View File

@@ -0,0 +1,10 @@
{
$OUT = "";
if (defined $SquidParent && $SquidParent)
{
$OUT .= "cache_peer $SquidParent parent ";
$OUT .= $SquidParentPort || "3128";
$OUT .= " 7 no-query default";
}
}

24
root/etc/e-smith/templates/etc/squid/squid.conf/20ACL10localhost Normal file
View File

@@ -0,0 +1,24 @@
{
use esmith::NetworksDB;
use Net::IPv4Addr;
my $ndb = esmith::NetworksDB->open_ro();
my $localAccess = '';
foreach ($ndb->local_access_spec()){
# If there's a / in the network string
# then convert to CIDR notation
if (m!/!) {
my ($ip,$bits) = Net::IPv4Addr::ipv4_parse($_);
$localAccess .= "$ip/$bits ";
}
else {
$localAccess .= "$_ ";
}
}
$OUT .= "acl localsrc src $localAccess\n";
$OUT .= "acl localdst dst $localAccess\n";
$OUT .= "acl selfdst dst 127.0.0.1 $LocalIP\n";
$OUT .= "acl selfport port " . ($squid{TCPPort} || '3128');
}

6
root/etc/e-smith/templates/etc/squid/squid.conf/20ACL15SSL_ports Normal file
View File

@@ -0,0 +1,6 @@
{
my @ports = split(",", ($squid{SSLPorts} || "") );
return "acl SSL_ports port 443 563 @ports";
}

5
root/etc/e-smith/templates/etc/squid/squid.conf/20ACL15Safe_ports Normal file
View File

@@ -0,0 +1,5 @@
{
my @ports = split(",", ($squid{SafePorts} || "80") );
return "acl Safe_ports port @ports";
}

1
root/etc/e-smith/templates/etc/squid/squid.conf/20ACL20CONNECT Normal file
View File

@@ -0,0 +1 @@
acl CONNECT method CONNECT

1
root/etc/e-smith/templates/etc/squid/squid.conf/20ACL30webdav Normal file
View File

@@ -0,0 +1 @@
acl webdav method PROPFIND TRACE PURGE PROPPATCH MKCOL COPY MOVE LOCK UNLOCK

3
root/etc/e-smith/templates/etc/squid/squid.conf/20PidFilename Normal file
View File

@@ -0,0 +1,3 @@
{
$OUT = "pid_filename /run/squid/squid.pid";
}

1
root/etc/e-smith/templates/etc/squid/squid.conf/24Logfile Normal file
View File

@@ -0,0 +1 @@
access_log /var/log/squid/access.log squid

1
root/etc/e-smith/templates/etc/squid/squid.conf/25LogfileRotate Normal file
View File

@@ -0,0 +1 @@
logfile_rotate 0

3
root/etc/e-smith/templates/etc/squid/squid.conf/30append_domain Normal file
View File

@@ -0,0 +1,3 @@
append_domain {
$OUT = ".$DomainName";
}

1
root/etc/e-smith/templates/etc/squid/squid.conf/30cache_mgr Normal file
View File

@@ -0,0 +1 @@
cache_mgr { "admin\@$DomainName" }

1
root/etc/e-smith/templates/etc/squid/squid.conf/30ftp_user Normal file
View File

@@ -0,0 +1 @@
ftp_user { "nobody\@$DomainName" }

2
root/etc/e-smith/templates/etc/squid/squid.conf/40http_access00manager Normal file
View File

@@ -0,0 +1,2 @@
http_access allow manager localsrc
http_access deny manager

5
root/etc/e-smith/templates/etc/squid/squid.conf/40http_access10notSafe_ports Normal file
View File

@@ -0,0 +1,5 @@
{
return "" unless ( ($squid{EnforceSafePorts} || "no") eq "yes");
return "http_access deny !Safe_ports";
}

1
root/etc/e-smith/templates/etc/squid/squid.conf/40http_access20denyCONNECTunlessSSL Normal file
View File

@@ -0,0 +1 @@
http_access deny CONNECT !SSL_ports

1
root/etc/e-smith/templates/etc/squid/squid.conf/40http_access40denySelf Normal file
View File

@@ -0,0 +1 @@
http_access deny selfdst selfport

1
root/etc/e-smith/templates/etc/squid/squid.conf/40http_access75AllowLocal Normal file
View File

@@ -0,0 +1 @@
http_access allow localsrc

1
root/etc/e-smith/templates/etc/squid/squid.conf/40http_access99denyall Normal file
View File

@@ -0,0 +1 @@
http_access deny all

1
root/etc/e-smith/templates/etc/squid/squid.conf/50icp_access50AllowAll Normal file
View File

@@ -0,0 +1 @@
icp_access allow all

1
root/etc/e-smith/templates/etc/squid/squid.conf/60miss_access50AllowAll Normal file
View File

@@ -0,0 +1 @@
miss_access allow all

11
root/etc/e-smith/templates/etc/squid/squid.conf/70StoreAvgObjectSize Normal file
View File

@@ -0,0 +1,11 @@
{
# TAG: store_avg_object_size (kbytes)
# Average object size, used to estimate number of objects your
# cache can hold. See doc/Release-Notes-1.1.txt. The default is
# 13 KB.
#
# Note: At e-smith, some of our customers have had average object sizes
# as low as 3.5 KB, so we set the limit to 3 KB to be safe.
# - JMorrison, January 5, 2000
# }
store_avg_object_size 3 KB

1
root/etc/e-smith/templates/etc/squid/squid.conf/80always_direct50webdav Normal file
View File

@@ -0,0 +1 @@
always_direct allow webdav

13
root/etc/e-smith/templates/etc/squid/squid.conf/80always_direct80default Normal file
View File

@@ -0,0 +1,13 @@
{
if (defined $SquidParent && $SquidParent)
{
$OUT .= "always_direct allow localdst\n";
$OUT .= "always_direct deny all\n";
$OUT .= "never_direct deny localdst\n";
$OUT .= "never_direct allow all";
}
else
{
$OUT .= "always_direct allow all";
}
}

1
root/etc/e-smith/templates/etc/squid/squid.conf/96filedescriptor Normal file
View File

@@ -0,0 +1 @@
max_filedesc { ($squid{'MaxFileDesc'} || '4096') }

10
root/etc/e-smith/templates/etc/sysconfig/squid/10ALL_ORIG Normal file
View File

@@ -0,0 +1,10 @@
# default squid options
SQUID_OPTS=""
# Time to wait for Squid to shut down when asked. Should not be necessary
# most of the time.
SQUID_SHUTDOWN_TIMEOUT=100
# default squid conf file
SQUID_CONF="/etc/squid/squid.conf"

4
root/etc/e-smith/templates/etc/sysconfig/squid/20OPTS Normal file
View File

@@ -0,0 +1,4 @@
# specific squid options
SQUID_OPTS="-s"

4
root/etc/e-smith/templates/usr/lib/systemd/system/squid.service.d/50koozali.conf/20unit Normal file
View File

@@ -0,0 +1,4 @@
[Unit]
After=network-online.target

12
root/etc/e-smith/templates/usr/lib/systemd/system/squid.service.d/50koozali.conf/40service Normal file
View File

@@ -0,0 +1,12 @@
[Service]
{
# Is there a Files limit in the configuration database
$OUT .= "LimitNOFILE=";
$OUT .= $squid{MaxFileDesc} || 4096;
$OUT .= "\n";
}
PIDFile=/run/squid/squid.pid
# squid option -s ---->> $SQUID_OPTS
ExecStartPre=/sbin/e-smith/service-status squid
User=root
Group=root

2
root/etc/e-smith/templates/usr/lib/systemd/system/squid.service.d/50koozali.conf/80install Normal file
View File

@@ -0,0 +1,2 @@
[Install]
WantedBy=sme-server.target

62
root/etc/e-smith/web/functions/proxy Normal file
View File

@@ -0,0 +1,62 @@
#!/usr/bin/perl -wT
# vim: ts=4 sw=4 et ft=xml ai:
#----------------------------------------------------------------------
# heading : Security
# description : Proxy settings
# navigation : 5000 5500
#----------------------------------------------------------------------
#----------------------------------------------------------------------
# copyright (C) 1999-2003 Mitel Networks Corporation
#----------------------------------------------------------------------
use strict;
use CGI;
use esmith::FormMagick::Panel::proxy;
eval {
my $q = CGI->new();
my $f = esmith::FormMagick::Panel::proxy->new();
$f->display();
};
if ($@)
{
print<<EOF;
<html>
<head><title>Fatal error caught</title></head>
<body bgcolor=\"#ffffff\">
<h3>Fatal error caught</h3>
<pre>
$@
</pre>
</body>
</html>
EOF
}
__DATA__
<form title="Proxy settings" header="/etc/e-smith/web/common/head.tmpl"
footer="/etc/e-smith/web/common/foot.tmpl">
<page
name="First"
post-event="change_settings()"
pre-event="print_status_message()">
<description>FIRST_PAGE_DESCRIPTION</description>
<field
id="http_proxy_status"
value="get_http_proxy_status()"
type="select"
options="'enabled' => 'ENABLED','disabled' => 'DISABLED'">
<description>HTTP_PROXY_STATUS_DESCRIPTION</description>
<label>HTTP_PROXY_STATUS_LABEL</label>
</field>
<subroutine src="show_smtp_proxy_status()" />
<subroutine src="print_button('SAVE')" />
</page>
</form>