From 3e16d6dd3b05af835504c54b19c0494cb0ac6dde Mon Sep 17 00:00:00 2001 From: Joerg Deckert Date: Tue, 28 Jan 2025 18:29:39 +0100 Subject: [PATCH] add net-proxy/c-icap/c-icap, net-proxy/c-icap-modules and net-proxy/squid-opnsense-fetchacls --- net-proxy/c-icap-modules/Manifest | 3 + .../c-icap-modules-0.5.7.ebuild | 58 +++++++++ net-proxy/c-icap-modules/metadata.xml | 16 +++ net-proxy/c-icap/Manifest | 6 + net-proxy/c-icap/c-icap-0.6.3.ebuild | 113 +++++++++++++++++ net-proxy/c-icap/files/c-icap.conf | 11 ++ net-proxy/c-icap/files/c-icap.init.3 | 26 ++++ net-proxy/c-icap/files/c-icap.logrotate | 13 ++ net-proxy/c-icap/metadata.xml | 15 +++ net-proxy/squid-opnsense-fetchacls/Manifest | 8 ++ .../files/externalACLs.conf | 4 + .../files/fetchACLs.service | 8 ++ .../files/fetchACLs.timer | 12 ++ .../files/squid.conf.NoBumping | 106 ++++++++++++++++ .../files/squid.conf.SSLBump | 119 ++++++++++++++++++ .../files/squid.conf.Transparent | 102 +++++++++++++++ .../squid-opnsense-fetchacls-24.7.12.ebuild | 47 +++++++ 17 files changed, 667 insertions(+) create mode 100644 net-proxy/c-icap-modules/Manifest create mode 100644 net-proxy/c-icap-modules/c-icap-modules-0.5.7.ebuild create mode 100644 net-proxy/c-icap-modules/metadata.xml create mode 100644 net-proxy/c-icap/Manifest create mode 100644 net-proxy/c-icap/c-icap-0.6.3.ebuild create mode 100644 net-proxy/c-icap/files/c-icap.conf create mode 100644 net-proxy/c-icap/files/c-icap.init.3 create mode 100644 net-proxy/c-icap/files/c-icap.logrotate create mode 100644 net-proxy/c-icap/metadata.xml create mode 100644 net-proxy/squid-opnsense-fetchacls/Manifest create mode 100644 net-proxy/squid-opnsense-fetchacls/files/externalACLs.conf create mode 100644 net-proxy/squid-opnsense-fetchacls/files/fetchACLs.service create mode 100644 net-proxy/squid-opnsense-fetchacls/files/fetchACLs.timer create mode 100644 net-proxy/squid-opnsense-fetchacls/files/squid.conf.NoBumping create mode 100644 net-proxy/squid-opnsense-fetchacls/files/squid.conf.SSLBump create mode 100644 net-proxy/squid-opnsense-fetchacls/files/squid.conf.Transparent create mode 100644 net-proxy/squid-opnsense-fetchacls/squid-opnsense-fetchacls-24.7.12.ebuild diff --git a/net-proxy/c-icap-modules/Manifest b/net-proxy/c-icap-modules/Manifest new file mode 100644 index 0000000..f770ac6 --- /dev/null +++ b/net-proxy/c-icap-modules/Manifest @@ -0,0 +1,3 @@ +DIST C_ICAP_MODULES_0.5.7.tar.gz 94721 BLAKE2B bbb0a9af159ea49148fa42fc116420dea937ddf7945ad3c2d1a2623f9bbf255525e8b09ee91f16114a25a3481eace693e54119a6d5e77ee8ecb0a866b37bc8de SHA512 873c96b07b20b221a0a21d27829443aadfae8ab265602731f34bef24f4cf4ec4f5e821900ac2d5cd6ef1791bcf7a2ba1dc052500d4eff8ea50d860ce36ac16db +EBUILD c-icap-modules-0.5.7.ebuild 1174 BLAKE2B 724877071c317997d5d6402e31fc1938d8ce961d70e1563155682045611c5eb7dddd2b6d77b45346937d6c1f675c90731075f17d88e1d04d38795db48e531e86 SHA512 b5ce10ce803ef78e73f55f8a1565d46e7035fb041b3dadfdeda02ba5cb74e3b0fb9b3f0da794d406f02af1c793e530b19f954209448d2b6c5298eea9e1cb9766 +MISC metadata.xml 553 BLAKE2B 594174429a36b8962e62b58e5671d96180c44cac534f1ffbd20ef4b030cebb01aa77271000a313a4516bdf44ce41b2cf606d5020ad86056f4f3dfdfa8ad72001 SHA512 8112a90215c9ad8a958b9f35a14db55a4a3c2e673625580b1adf57bae728b6415b7a9118eea446639b24d603393adbfef69229a56c1856e7c895c20d203df3d4 diff --git a/net-proxy/c-icap-modules/c-icap-modules-0.5.7.ebuild b/net-proxy/c-icap-modules/c-icap-modules-0.5.7.ebuild new file mode 100644 index 0000000..de54032 --- /dev/null +++ b/net-proxy/c-icap-modules/c-icap-modules-0.5.7.ebuild @@ -0,0 +1,58 @@ +# Copyright 1999-2013 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit autotools flag-o-matic + +MY_PN=C_ICAP_MODULES +MY_P=${MY_PN}_${PV} + +DESCRIPTION="URL blocklist and virus scanner for the C-ICAP server" +HOMEPAGE="http://c-icap.sourceforge.net/" +SRC_URI="https://github.com/c-icap/c-icap-modules/archive/refs/tags/${MY_P}.tar.gz" + +LICENSE="LGPL-2.1" +SLOT="0" +KEYWORDS="amd64 arm x86" +IUSE="berkdb clamav" + +DEPEND="berkdb? ( sys-libs/db:5.3 ) + clamav? ( app-antivirus/clamav ) + net-proxy/c-icap + sys-libs/glibc + sys-libs/zlib" +RDEPEND="${DEPEND}" + +S="${WORKDIR}/c-icap-modules-${MY_P}" + +src_prepare() { + eapply_user + eautoreconf +} + +src_configure() { + # some void *** pointers get casted around and can be troublesome to + # fix properly. + append-flags -fno-strict-aliasing + + econf --sysconfdir=/etc/c-icap \ + --disable-dependency-tracking \ + --disable-maintainer-mode \ + --disable-static \ + $(use_with berkdb bdb) \ + $(use_with clamav) +} + +src_compile() { + emake LOGDIR="/var/log" +} + +src_install() { + dodir /etc/c-icap + + emake LOGDIR="/var/log" \ + DESTDIR="${D}" install + + find "${ED}" -name '*.la' -delete || die +} diff --git a/net-proxy/c-icap-modules/metadata.xml b/net-proxy/c-icap-modules/metadata.xml new file mode 100644 index 0000000..e611558 --- /dev/null +++ b/net-proxy/c-icap-modules/metadata.xml @@ -0,0 +1,16 @@ + + + + + c@roessner.co + Christian Rößner + + + proxy-maint@gentoo.org + Proxy Maintainers + + URL blocklist and virus scanner for the C-ICAP server + + c-icap + + diff --git a/net-proxy/c-icap/Manifest b/net-proxy/c-icap/Manifest new file mode 100644 index 0000000..73b3509 --- /dev/null +++ b/net-proxy/c-icap/Manifest @@ -0,0 +1,6 @@ +AUX c-icap.conf 359 BLAKE2B 028a2b8c7fb81005580085a7f3554e460c3f05950ca2696af234e035e9873aef12353450cd5a21fb2e8efeede43a0bced272e4515f4a5313f0088458b11bd4ec SHA512 2ccab04f6ddb1b76b41d9b26dfdcf3e43aa4acdaeeddc215f38e0f7f8b537687733c643d5cc2b0e06b95710a3cd76c8a67e33e8c8240b375d939fea649e86ba3 +AUX c-icap.init.3 693 BLAKE2B 09beb3ffad19455c0de6cd400f9078b147020477b468409273e5163b9ef1aaba75a0291536642053a6e1755f6bdf27266f6eeb2cd1bffa020e0f9bf594b9158d SHA512 9518ebdc57e69716717160fa11d2ade4648212ac4bbc65caeec0d0c7d2427cd0a8a70e1de36b6c81113c821ed9a11808f7d81595f8c1fc185013a1cd4ac93bdb +AUX c-icap.logrotate 188 BLAKE2B abfc255d4b82a58ac7f94e76c1dcaa40fce2415ec5a0d760eba18f5843a1ffd0bdcfd3c238759032020249107a3a73b836db32052af44923ef855a69e46eaa51 SHA512 edc8dbbbaa06cf062b307e37ffee1dee9d566cc4b8a6947422125a22d956bcc639c483712ff6b6f6e9eb30852b4b0d5c293f1279463af89e8fc199828792a9e7 +DIST C_ICAP_0.6.3.tar.gz 372982 BLAKE2B 91227aaddef1f8773f814e306b2fb34de708f20f58c9a016d3e5a4a60b35268f39141c3120d9438d86253d2a1393d34f9e6f15a71c5329e01735f0945e056638 SHA512 e146ec083794731504c97d52e6a53ac34a78aa4f9f867de0eb2e4d17db404b49a5c4a33a3e81d3198fad557d9653b69195108573185ce0e3a5ce444a27baa894 +EBUILD c-icap-0.6.3.ebuild 2859 BLAKE2B c4c1a80a06a34f676a81891f28ad5ca5e4691b9dd724d400d95efb63ea221a7f34fb7f1cc9d7a689582609d163c2067e959ed26008f6cf082a6bd9c71983517b SHA512 e580a421d61be4616c4f1c8f0b86485f23fce8bcde9a3b466a6e37b61f3c20f50e4b2406b7697db5973e625de4b01586a3bdd3c079d91930686644080237893a +MISC metadata.xml 456 BLAKE2B e79e4bf28d909f591b3aba186533e7c8598f0d65c5ffe7afb1bb3acf07ca22546ee34a1468758b2ee61d3c936899396db286a17fe68ad80e6118147f31f0035e SHA512 acbaab7eac55e821c7e97b16dcd9fc30acdbef887cce7df84ca07c52e34347a746e341384eaf1cddfa96a68cb66197cad837fdfcc81e9405ee29b13aafe5c519 diff --git a/net-proxy/c-icap/c-icap-0.6.3.ebuild b/net-proxy/c-icap/c-icap-0.6.3.ebuild new file mode 100644 index 0000000..522322e --- /dev/null +++ b/net-proxy/c-icap/c-icap-0.6.3.ebuild @@ -0,0 +1,113 @@ +# Copyright 1999-2013 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI="8" + +inherit autotools flag-o-matic + +MY_PN=C_ICAP +MY_P="${MY_PN}_${PV}" + +DESCRIPTION="C Implementation of an ICAP server" +HOMEPAGE="http://c-icap.sourceforge.net/" +SRC_URI="https://github.com/c-icap/c-icap-server/archive/refs/tags/${MY_P}.tar.gz" + +LICENSE="LGPL-2.1" +SLOT="0" +KEYWORDS="amd64 arm x86" +IUSE="berkdb ipv6 ldap" + +RDEPEND="berkdb? ( sys-libs/db:5.3 ) + ldap? ( net-nds/openldap ) + sys-libs/zlib" + +DEPEND="${RDEPEND}" +RDEPEND="${RDEPEND}" + +S="${WORKDIR}/c-icap-server-${MY_P}" + +src_prepare() { + eapply_user + eautoreconf +} + +src_configure() { + # some void *** pointers get casted around and can be troublesome to + # fix properly. + append-flags -fno-strict-aliasing + + econf \ + --sysconfdir=/etc/${PN} \ + --disable-dependency-tracking \ + --disable-maintainer-mode \ + --disable-static \ + --enable-large-files \ + $(use_enable ipv6) \ + $(use_with berkdb bdb) \ + $(use_with ldap) +} + +src_compile() { + emake LOGDIR="/var/log" +} + +src_install() { + emake \ + LOGDIR="/var/log" \ + DESTDIR="${D}" install + + find "${D}" -name '*.la' -delete || die + + # Move the daemon out of the way + dodir /usr/libexec + mv "${D}"/usr/bin/c-icap "${D}"/usr/libexec || die + + # Remove the default configuration files since we have etc-update to + # take care of it for us. + rm "${D}"/etc/${PN}/c-icap.*.default || die + + # Fix the configuration file; for some reason it's a bit messy + # around. + sed -i \ + -e 's:/usr/var/:/var/:g' \ + -e 's:/var/log/:/var/log/c-icap/:g' \ + -e 's:/usr/etc/:/etc/c-icap/:g' \ + -e 's:/usr/local/c-icap/etc/:/etc/c-icap/:g' \ + -e 's:/usr/lib/:/usr/'$(get_libdir)'/:g' \ + "${D}"/etc/${PN}/c-icap.conf \ + || die + + dodoc AUTHORS README TODO ChangeLog + + newinitd "${FILESDIR}/${PN}.init.3" ${PN} + newconfd "${FILESDIR}/${PN}.conf" ${PN} + keepdir /var/log/c-icap + + insopts -m0644 + insinto /etc/logrotate.d + newins "${FILESDIR}"/${PN}.logrotate ${PN} + + # avoid triggering portage's symlink protection; this is handled by + # the init script anyway. + rm -rf "${D}"/var/run +} + +pkg_postinst() { + elog "To enable Squid to call the ICAP modules from a local server you should set" + elog "the following in your squid.conf:" + elog "" + elog " icap_enable on" + elog "" + elog " # not strictly needed, but some modules might make use of these" + elog " icap_send_client_ip on" + elog " icap_send_client_username on" + elog "" + elog " icap_service service_req reqmod_precache bypass=1 icap://localhost:1344/service" + elog " adaptation_access service_req allow all" + elog "" + elog " icap_service service_resp respmod_precache bypass=0 icap://localhost:1344/service" + elog " adaptation_access service_resp allow all" + elog "" + elog "You obviously will have to replace \"service\" with the actual ICAP service to" + elog "use." +} diff --git a/net-proxy/c-icap/files/c-icap.conf b/net-proxy/c-icap/files/c-icap.conf new file mode 100644 index 0000000..d3f2420 --- /dev/null +++ b/net-proxy/c-icap/files/c-icap.conf @@ -0,0 +1,11 @@ +# Use this to change the configuration file to use for c-icap. +configfile=/etc/c-icap/c-icap.conf + +# Use this to set any extra option for the daemon. Do not use the -f +# option here. +EXTRA_OPTS="" + +# If you enabled LDAP support, and you'd like to access tables stored +# in the local LDAP instance, you want to uncomment the following +# line. +#rc_need="slapd" diff --git a/net-proxy/c-icap/files/c-icap.init.3 b/net-proxy/c-icap/files/c-icap.init.3 new file mode 100644 index 0000000..c11ae50 --- /dev/null +++ b/net-proxy/c-icap/files/c-icap.init.3 @@ -0,0 +1,26 @@ +#!/sbin/openrc-run +# Copyright 1999-2012 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +: ${configfile:=/etc/c-icap/c-icap.conf} + +get_config() { + local value=$(awk '$1 == "'$1'" { print $2 }' ${configfile}) + echo ${value:-$2} +} + +command="/usr/libexec/c-icap" +command_arguments="${EXTRA_OPTS} -f ${configfile}" +pidfile=$(get_config PidFile /var/run/c-icap/c-icap.pid) + +depend() { + need localmount + config ${configfile} + [ "$(get_config Logger file_logger)" = "sys_logger" ] && use logger +} + +start_pre() { + local cmdsocket=$(get_config CommandsSocket /var/run/c-icap/c-icap.ctl) + + checkpath -d "$(dirname "${cmdsocket}")" "$(dirname "${pidfile}")" +} diff --git a/net-proxy/c-icap/files/c-icap.logrotate b/net-proxy/c-icap/files/c-icap.logrotate new file mode 100644 index 0000000..c4c0a5d --- /dev/null +++ b/net-proxy/c-icap/files/c-icap.logrotate @@ -0,0 +1,13 @@ +/var/log/c-icap/access.log { + missingok + postrotate + /etc/init.d/c-icap restart + endscript +} + +/var/log/cicap-server.log { + missingok + postrotate + /etc/init.d/c-icap restart + endscript +} diff --git a/net-proxy/c-icap/metadata.xml b/net-proxy/c-icap/metadata.xml new file mode 100644 index 0000000..cd0b5f5 --- /dev/null +++ b/net-proxy/c-icap/metadata.xml @@ -0,0 +1,15 @@ + + + + + c@roessner.co + Christian Rößner + + + proxy-maint@gentoo.org + Proxy Maintainers + + + c-icap + + diff --git a/net-proxy/squid-opnsense-fetchacls/Manifest b/net-proxy/squid-opnsense-fetchacls/Manifest new file mode 100644 index 0000000..98f0e9c --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/Manifest @@ -0,0 +1,8 @@ +AUX externalACLs.conf 167 BLAKE2B 53e5447dc37ab8b37b24e5089dbb39193ccb68334ac24835066c26279120ff9c56db135024c44e5460cd35f1e81db7c0862415b8c36e61398e2ce379fe278480 SHA512 8ee725709e497ff4f6651718e5d955268a50f98b992f04db2021f48029d41946503e7d1adc4e7e4cb543405105490523f6ab3bcffd9c700ffe3a96025a7af7dd +AUX fetchACLs.service 153 BLAKE2B cff1dff12195aa0ae2b9681278c5a71f851654395cfef46ca5830a719a0417ce0dda52479a08b6a151c6aa51bbfc0edd580cbcdc649ca0e6ad167b4585747df4 SHA512 95e5762e65af8c057e1927808e79f22edd7e1608509fd50201468a38cbd0efd676e30d2089321d7615f5a590aae0cd3c15f4fb1165122061c4d538176e3072dd +AUX fetchACLs.timer 210 BLAKE2B a1906ec839d41d858d64b17ef05c52581d3bf8e4d1c7b228b3c902bd52b669da6c3d28afdfbcd073cc379b83dcb9b279e787ddc99e070c2743804bb9b37dadf6 SHA512 7ea76d32892c85dffcb156f2ba04a83b9f2c7683729ba9884badbeec9d7b977f9eb759cbf6835768b23826ae09602d24b2d43443ad461c85c8f5d5b804e284c0 +AUX squid.conf.NoBumping 3864 BLAKE2B f4579d23289288b29381597fae87eacd0879bb8ef9ac2e856ff5a2e0128da15d4839195b6533a1f36fffb8da1c528fddcc6ce5896cf1597fbb1edeb6917fd921 SHA512 7bb25ab02652ce9ba19ba99d2d7b2c39e54e92a044dd24fb7f1d1bdce806005d57fc5e6fe5efa8669bf7f0ce1007514c88af5ee51bc5ce4282cddaf4ca037e8c +AUX squid.conf.SSLBump 4261 BLAKE2B 4e75f2d997f49d2e67ad1b6d0c9de12087bcba01b1a7504f63ed8862b3774855a060a01ef23e87bb0581c092e09e3d4f6a58cbd14b4b60092d94dad19676a341 SHA512 6d0aacc392dc581addd35052d16daa215ededb2421b4873695aad1f291fa44b8397b899dd478e5e374b1c20fdd3998ee313c65c1797eaa60a4d9b4ab5f20415c +AUX squid.conf.Transparent 3645 BLAKE2B 3485c37e8cd4ff4b3cc55a8d188877cafea5ed178f7a5e7cb488d98849ec67f9b58b49100a13eae2294136dddc219f93e32d3a69209abeeb0292149d2df46c80 SHA512 e60b502b6e1e49ae77d9ef9d1c5b979cc7c708d6517261be984acbf9c4a63465346b813b3cb87224f9764c1d478b5433e900dbbdf1323241710e2de5b28f0865 +DIST squid-opnsense-fetchacls-24.7.12.py 16231 BLAKE2B 391fa8a5808b2fd3100a8ba52d1a70105819329ee6bc7ee31dcc9717934d7ac0fea64bed73b0288931fc26697dd3b5c95275ea83e21863c898a090a824129d15 SHA512 104ee310add5f61e58afe5324db7677d113e25e6d20b6d1a5c0f185c1b358ce6a805346a6f8080c028ae2671a83a4e35a0f9f2dcd00bfb4c3b9ea0813489544e +EBUILD squid-opnsense-fetchacls-24.7.12.ebuild 1131 BLAKE2B 6816347d7936e51dece3a019efd785d6fd2c07dd681216e7f5899ef0d898b9f8677895e54ae1df095a1b8548392b7e11cb5159f6545b1ea4c8174b1b29531581 SHA512 30873af4e5f345ab606722e6e8959f2862770f8a59e84aac3055a4f0ea4e729421f535754d1c4285e6b8eaf30aa2c7c6638b7ec4349c372e6b16a279ffb6d1ce diff --git a/net-proxy/squid-opnsense-fetchacls/files/externalACLs.conf b/net-proxy/squid-opnsense-fetchacls/files/externalACLs.conf new file mode 100644 index 0000000..8b943c2 --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/files/externalACLs.conf @@ -0,0 +1,4 @@ +[URL] +enabled = 1 +url = ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz +filter = adult,dangerous_material,doh,malware,shortener,gambling \ No newline at end of file diff --git a/net-proxy/squid-opnsense-fetchacls/files/fetchACLs.service b/net-proxy/squid-opnsense-fetchacls/files/fetchACLs.service new file mode 100644 index 0000000..eb8f97f --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/files/fetchACLs.service @@ -0,0 +1,8 @@ +[Unit] +Description=fetch url list and build squid acl +RefuseManualStart=no +RefuseManualStop=yes + +[Service] +Type=oneshot +ExecStart=/usr/bin/fetchACLs.py diff --git a/net-proxy/squid-opnsense-fetchacls/files/fetchACLs.timer b/net-proxy/squid-opnsense-fetchacls/files/fetchACLs.timer new file mode 100644 index 0000000..58ea329 --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/files/fetchACLs.timer @@ -0,0 +1,12 @@ +[Unit] +Description=fetch url list and build squid acl +RefuseManualStart=no +RefuseManualStop=no + +[Timer] +Persistent=false +OnCalendar=Sun *-*-* 03:19:00 +Unit=fetchACLs.service + +[Install] +WantedBy=timers.target diff --git a/net-proxy/squid-opnsense-fetchacls/files/squid.conf.NoBumping b/net-proxy/squid-opnsense-fetchacls/files/squid.conf.NoBumping new file mode 100644 index 0000000..e08937e --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/files/squid.conf.NoBumping @@ -0,0 +1,106 @@ +# Example expliciet proxy with url filter, without ssl bump + +# Setup regular listeners configuration +http_port 3128 cert=/etc/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on + +sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/squid/ssl_crtd -M 10MB +sslcrtd_children 5 + +tls_outgoing_options options=NO_TLSv1 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS + +sslproxy_cert_error deny all + +# Example rule allowing access from your local networks. +# Adapt to list your (internal) IP networks from where browsing +# should be allowed +acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) +acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) +acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) +acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines +acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) +acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) +acl localnet src fc00::/7 # RFC 4193 local private network range +acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines + +# ACL - Allow localhost for PURGE cache if enabled +acl PURGE method PURGE +http_access allow localhost PURGE +http_access deny PURGE + +# ACL lists +# ACL - Remote fetched Blacklist (remoteblacklist) +acl remoteblacklist_ut1 dstdomain "/var/lib/squid/acl/URL" + +# ACL - SSL ports, default are configured in config.xml +acl SSL_ports port 443 # https +acl SSL_ports port 8443 # special https + +# Default Safe ports are now defined in config.xml +# ACL - Safe_ports +acl Safe_ports port 80 # http +acl Safe_ports port 21 # ftp +acl Safe_ports port 443 # https +acl Safe_ports port 70 # gopher +acl Safe_ports port 210 # wais +acl Safe_ports port 1025-65535 # unregistered ports +acl Safe_ports port 280 # http-mgmt +acl Safe_ports port 488 # gss-http +acl Safe_ports port 591 # filemaker +acl Safe_ports port 777 # multiling http +acl CONNECT method CONNECT + +# ACL list (Deny) remoteblacklist_ut1 +adaptation_access response_mod deny remoteblacklist_ut1 +adaptation_access request_mod deny remoteblacklist_ut1 +http_access deny remoteblacklist_ut1 + +# Deny requests to certain unsafe ports +adaptation_access response_mod deny !Safe_ports +adaptation_access request_mod deny !Safe_ports +http_access deny !Safe_ports +# Deny CONNECT to other than secure SSL ports +adaptation_access response_mod deny CONNECT !SSL_ports +adaptation_access request_mod deny CONNECT !SSL_ports +http_access deny CONNECT !SSL_ports + +# Only allow cachemgr access from localhost +http_access allow localhost manager +http_access deny manager + +# We strongly recommend the following be uncommented to protect innocent +# web applications running on the proxy server who think the only +# one who can access services on "localhost" is a local user +adaptation_access response_mod deny to_localhost +adaptation_access request_mod deny to_localhost +http_access deny to_localhost + +# +# ACL - localnet - default these include ranges from selected interfaces (Allow local subnets) +adaptation_access response_mod allow localnet +adaptation_access request_mod allow localnet +http_access allow localnet + +# ACL - localhost +adaptation_access response_mod allow localhost +adaptation_access request_mod allow localhost +http_access allow localhost + +# Deny all other access to this proxy +adaptation_access response_mod deny all +adaptation_access request_mod deny all +http_access deny all + +# Caching settings +cache_mem 512 MB +cache_dir ufs /var/cache/squid 100 16 256 + +# Leave coredumps in the first cache dir +coredump_dir /var/cache/squid + +# +# Add any of your own refresh_pattern entries above these. +# +refresh_pattern ^ftp: 1440 20% 10080 +refresh_pattern ^gopher: 1440 0% 1440 +refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 +refresh_pattern . 0 20% 4320 diff --git a/net-proxy/squid-opnsense-fetchacls/files/squid.conf.SSLBump b/net-proxy/squid-opnsense-fetchacls/files/squid.conf.SSLBump new file mode 100644 index 0000000..23fdda6 --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/files/squid.conf.SSLBump @@ -0,0 +1,119 @@ +# Example expliciet proxy with url filter, with ssl bump + +# Setup regular listeners configuration +http_port 3128 ssl-bump cert=/etc/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on + +# setup ssl re-cert +sslcrtd_program /usr/libexec/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 10MB +sslcrtd_children 5 + +tls_outgoing_options options=NO_TLSv1 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS + +# setup ssl bump acl's +acl bump_step1 at_step SslBump1 +acl bump_step2 at_step SslBump2 +acl bump_step3 at_step SslBump3 +acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl" + +# configure bump +ssl_bump peek bump_step1 all +ssl_bump peek bump_step2 bump_nobumpsites +ssl_bump splice bump_step3 bump_nobumpsites +ssl_bump stare bump_step2 +ssl_bump bump bump_step3 + +sslproxy_cert_error deny all + +# Example rule allowing access from your local networks. +# Adapt to list your (internal) IP networks from where browsing +# should be allowed +acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) +acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) +acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) +acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines +acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) +acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) +acl localnet src fc00::/7 # RFC 4193 local private network range +acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines + +# ACL - Allow localhost for PURGE cache if enabled +acl PURGE method PURGE +http_access allow localhost PURGE +http_access deny PURGE + +# ACL - Remote fetched Blacklist (remoteblacklist) +acl remoteblacklist_ut1 dstdomain "/var/lib/squid/acl/URL" + +# ACL - SSL ports, default are configured in config.xml +acl SSL_ports port 443 # https +acl SSL_ports port 8443 # special https + +# Default Safe ports are now defined in config.xml +# ACL - Safe_ports +acl Safe_ports port 80 # http +acl Safe_ports port 21 # ftp +acl Safe_ports port 443 # https +acl Safe_ports port 70 # gopher +acl Safe_ports port 210 # wais +acl Safe_ports port 1025-65535 # unregistered ports +acl Safe_ports port 280 # http-mgmt +acl Safe_ports port 488 # gss-http +acl Safe_ports port 591 # filemaker +acl Safe_ports port 777 # multiling http +acl CONNECT method CONNECT + +# ACL list (Deny) remoteblacklist_ut1 +adaptation_access response_mod deny remoteblacklist_ut1 +adaptation_access request_mod deny remoteblacklist_ut1 +http_access deny remoteblacklist_ut1 + +# Deny requests to certain unsafe ports +adaptation_access response_mod deny !Safe_ports +adaptation_access request_mod deny !Safe_ports +http_access deny !Safe_ports +# Deny CONNECT to other than secure SSL ports +adaptation_access response_mod deny CONNECT !SSL_ports +adaptation_access request_mod deny CONNECT !SSL_ports +http_access deny CONNECT !SSL_ports + +# Only allow cachemgr access from localhost +http_access allow localhost manager +http_access deny manager + +# We strongly recommend the following be uncommented to protect innocent +# web applications running on the proxy server who think the only +# one who can access services on "localhost" is a local user +adaptation_access response_mod deny to_localhost +adaptation_access request_mod deny to_localhost +http_access deny to_localhost + +# +# ACL - localnet - default these include ranges from selected interfaces (Allow local subnets) +adaptation_access response_mod allow localnet +adaptation_access request_mod allow localnet +http_access allow localnet + +# ACL - localhost +adaptation_access response_mod allow localhost +adaptation_access request_mod allow localhost +http_access allow localhost + +# Deny all other access to this proxy +adaptation_access response_mod deny all +adaptation_access request_mod deny all +http_access deny all + +# Caching settings +cache_mem 512 MB +cache_dir ufs /var/cache/squid 100 16 256 + +# Leave coredumps in the first cache dir +coredump_dir /var/cache/squid + +# +# Add any of your own refresh_pattern entries above these. +# +refresh_pattern ^ftp: 1440 20% 10080 +refresh_pattern ^gopher: 1440 0% 1440 +refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 +refresh_pattern . 0 20% 4320 diff --git a/net-proxy/squid-opnsense-fetchacls/files/squid.conf.Transparent b/net-proxy/squid-opnsense-fetchacls/files/squid.conf.Transparent new file mode 100644 index 0000000..87ccf7e --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/files/squid.conf.Transparent @@ -0,0 +1,102 @@ +# Example transparent proxy with url filter + +# Setup transparent mode listeners on loopback interfaces +http_port 127.0.0.1:3128 intercept +http_port [::1]:3128 intercept + +# Setup regular listeners configuration +##http_port :3128 + +# Example rule allowing access from your local networks. +# Adapt to list your (internal) IP networks from where browsing +# should be allowed +acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) +acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) +acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) +acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines +acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) +acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) +acl localnet src fc00::/7 # RFC 4193 local private network range +acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines + +# ACL - Allow localhost for PURGE cache if enabled +acl PURGE method PURGE +http_access allow localhost PURGE +http_access deny PURGE + +# ACL - Remote fetched Blacklist (remoteblacklist) +acl remoteblacklist_ut1 dstdomain "/usr/local/etc/squid/acl/URL" + +# ACL - SSL ports, default are configured in config.xml +acl SSL_ports port 443 # https +acl SSL_ports port 8443 # special https + +# Default Safe ports are now defined in config.xml +# ACL - Safe_ports +acl Safe_ports port 80 # http +acl Safe_ports port 21 # ftp +acl Safe_ports port 443 # https +acl Safe_ports port 70 # gopher +acl Safe_ports port 210 # wais +acl Safe_ports port 1025-65535 # unregistered ports +acl Safe_ports port 280 # http-mgmt +acl Safe_ports port 488 # gss-http +acl Safe_ports port 591 # filemaker +acl Safe_ports port 777 # multiling http +acl CONNECT method CONNECT + +# ACL list (Deny) remoteblacklist_ut1 +adaptation_access response_mod deny remoteblacklist_ut1 +adaptation_access request_mod deny remoteblacklist_ut1 +http_access deny remoteblacklist_ut1 + +# Deny requests to certain unsafe ports +adaptation_access response_mod deny !Safe_ports +adaptation_access request_mod deny !Safe_ports +http_access deny !Safe_ports +# Deny CONNECT to other than secure SSL ports +adaptation_access response_mod deny CONNECT !SSL_ports +adaptation_access request_mod deny CONNECT !SSL_ports +http_access deny CONNECT !SSL_ports + +# Only allow cachemgr access from localhost +http_access allow localhost manager +http_access deny manager + +# We strongly recommend the following be uncommented to protect innocent +# web applications running on the proxy server who think the only +# one who can access services on "localhost" is a local user +adaptation_access response_mod deny to_localhost +adaptation_access request_mod deny to_localhost +http_access deny to_localhost + +# +# ACL - localnet - default these include ranges from selected interfaces (Allow local subnets) +adaptation_access response_mod allow localnet +adaptation_access request_mod allow localnet +http_access allow localnet + +# ACL - localhost +adaptation_access response_mod allow localhost +adaptation_access request_mod allow localhost +http_access allow localhost + +# Deny all other access to this proxy +adaptation_access response_mod deny all +adaptation_access request_mod deny all +http_access deny all + +# Caching settings +cache_mem 512 MB +cache_dir ufs /var/cache/squid 100 16 256 + +# Leave coredumps in the first cache dir +coredump_dir /var/cache/squid + +# +# Add any of your own refresh_pattern entries above these. +# +refresh_pattern ^ftp: 1440 20% 10080 +refresh_pattern ^gopher: 1440 0% 1440 +refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 +refresh_pattern . 0 20% 4320 diff --git a/net-proxy/squid-opnsense-fetchacls/squid-opnsense-fetchacls-24.7.12.ebuild b/net-proxy/squid-opnsense-fetchacls/squid-opnsense-fetchacls-24.7.12.ebuild new file mode 100644 index 0000000..10f30bc --- /dev/null +++ b/net-proxy/squid-opnsense-fetchacls/squid-opnsense-fetchacls-24.7.12.ebuild @@ -0,0 +1,47 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{9..12} ) + +inherit python-r1 systemd + +DESCRIPTION="fetch url list and build squid acl" +HOMEPAGE="https://opnsense.org/" +SRC_URI="https://raw.githubusercontent.com/opnsense/plugins/refs/tags/${PV}/www/squid/src/opnsense/scripts/proxy/fetchACLs.py -> ${P}.py" +S=${WORKDIR} + +LICENSE="BSD-2" +SLOT="0" +KEYWORDS="amd64" + +REQUIRED_USE="${PYTHON_REQUIRED_USE}" + +RDEPEND="net-proxy/squid + ${PYTHON_DEPS} + dev-python/requests[${PYTHON_USEDEP}] + dev-python/urllib3[${PYTHON_USEDEP}]" + +src_unpack() { + cp ${DISTDIR}/${P}.py ${WORKDIR}/ +} + +src_prepare() { + sed -i \ + -e 's|/usr/local/etc/squid/externalACLs.conf|/etc/squid/externalACLs.conf|' \ + -e 's|/usr/local/etc/squid/acl|/var/lib/squid/acl|' \ + ${P}.py || die + + eapply_user +} + + +src_install() { + newbin ${P}.py fetchACLs.py + python_replicate_script "${D}"/usr/bin/fetchACLs.py + systemd_dounit "${FILESDIR}"/fetchACLs.{service,timer} + insinto /etc/squid + doins "${FILESDIR}"/externalACLs.conf "${FILESDIR}"/squid.conf.* + keepdir /var/lib/squid/acl +}