diff --git a/README.md b/README.md index e9400dc47..573998584 100644 --- a/README.md +++ b/README.md @@ -113,7 +113,6 @@ www/c-icap -- c-icap connects the web proxy with a virus scanner www/cache -- Webserver cache www/nginx -- Nginx HTTP server and reverse proxy www/web-proxy-sso -- Kerberos authentication module -www/web-proxy-useracl -- Group and user ACL for the web proxy (pending removal) ``` A brief description of how to use the plugins repository diff --git a/www/web-proxy-useracl/+POST_DEINSTALL.post b/www/web-proxy-useracl/+POST_DEINSTALL.post deleted file mode 100644 index f1d28cf1e..000000000 --- a/www/web-proxy-useracl/+POST_DEINSTALL.post +++ /dev/null @@ -1,6 +0,0 @@ -rm -f /usr/local/etc/squid/pre-auth/ProxyUserACL.conf -rm -f /usr/local/etc/squid/groupACL_*.txt -rm -f /usr/local/etc/squid/userACL_*.txt -if [ -f /var/run/squid/squid.pid ]; then - service squid reload -fi diff --git a/www/web-proxy-useracl/+POST_INSTALL.post b/www/web-proxy-useracl/+POST_INSTALL.post deleted file mode 100644 index 06c3c6c22..000000000 --- a/www/web-proxy-useracl/+POST_INSTALL.post +++ /dev/null @@ -1,4 +0,0 @@ -/usr/local/opnsense/scripts/OPNsense/ProxyUserACL/reload.php -if [ -f /var/run/squid/squid.pid ]; then - service squid reload -fi diff --git a/www/web-proxy-useracl/Makefile b/www/web-proxy-useracl/Makefile deleted file mode 100644 index fd340b0d1..000000000 --- a/www/web-proxy-useracl/Makefile +++ /dev/null @@ -1,9 +0,0 @@ -PLUGIN_NAME= web-proxy-useracl -PLUGIN_VERSION= 1.1 -PLUGIN_REVISION= 2 -PLUGIN_COMMENT= Group and user ACL for the web proxy -PLUGIN_OBSOLETE= No changes since 2018 -PLUGIN_MAINTAINER= kekek2@ya.ru -PLUGIN_WWW= https://smart-soft.ru - -.include "../../Mk/plugins.mk" diff --git a/www/web-proxy-useracl/pkg-descr b/www/web-proxy-useracl/pkg-descr deleted file mode 100644 index 11c11d793..000000000 --- a/www/web-proxy-useracl/pkg-descr +++ /dev/null @@ -1 +0,0 @@ -Allow users and group-based policies in the web proxy. diff --git a/www/web-proxy-useracl/src/etc/inc/plugins.inc.d/proxy_useracl.inc b/www/web-proxy-useracl/src/etc/inc/plugins.inc.d/proxy_useracl.inc deleted file mode 100644 index e8ef1faf9..000000000 --- a/www/web-proxy-useracl/src/etc/inc/plugins.inc.d/proxy_useracl.inc +++ /dev/null @@ -1,61 +0,0 @@ - ['proxy_useracl_squid_hook:2'], - ]; -} - -function proxy_useracl_squid_hook($verbose, $action) -{ - if (!in_array($action, ['restart', 'reload', 'start', 'stop'])) { - exit; - } - - $res = configd_run('template reload OPNsense/ProxyUserACL'); - if ($verbose) { - printf("template reload OPNsense/ProxyUserACL: %s\n", trim($res)); - } - $res = configd_run('proxyuseracl reload'); - if ($verbose) { - printf("proxyuseracl reload: %s\n", trim($res)); - } -} - -function proxy_useracl_xmlrpc_sync() -{ - $result = array(); - $result['id'] = 'proxyuseracl'; - $result['section'] = 'OPNsense.ProxyUserACL'; - $result['description'] = gettext('Group & User Squid ACL'); - return array($result); -} diff --git a/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/Api/SettingsController.php b/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/Api/SettingsController.php deleted file mode 100644 index c788e8dca..000000000 --- a/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/Api/SettingsController.php +++ /dev/null @@ -1,363 +0,0 @@ -sessionClose(); - $mdlProxyUserACL = $this->getModel(); - $grid = new UIModelGrid($mdlProxyUserACL->general->ACLs->ACL); - return $grid->fetchBindRequest( - $this->request, - array('Group', 'Name', 'Domains', 'Black', 'Priority', 'uuid'), - 'Priority' - ); - } - - /** - * - * add ACL - * @return array - */ - public function addACLAction() - { - $result = array("result" => "failed"); - if ($this->request->isPost() && $this->request->hasPost("ACL")) { - $result = array("result" => "failed", "validations" => array()); - $mdlProxyUserACL = $this->getModel(); - $post = $this->request->getPost("ACL"); - $post["Hex"] = $this->strToHex($post["Name"]); - - $count = count($mdlProxyUserACL->general->ACLs->ACL->getNodes()); - if ($post["Priority"] > $count) { - $post["Priority"] = $count; - } - foreach ($mdlProxyUserACL->general->ACLs->ACL->sortedBy("Priority", true) as $acl) { - $key = $acl->getAttributes()["uuid"]; - $priority = (string)$mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority; - if ($priority < $post["Priority"]) { - break; - } - $mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority = (string)($priority + 1); - } - $node = $mdlProxyUserACL->general->ACLs->ACL->Add(); - $node->setNodes($post); - $find = $this->checkName($post["Name"], $post["Group"]); - if ($find !== true) { - $result["validations"]["ACL.Name"] = $find; - } - $valMsgs = $mdlProxyUserACL->performValidation(); - - foreach ($valMsgs as $field => $msg) { - $fieldnm = str_replace($node->__reference, "ACL", $msg->getField()); - $result["validations"][$fieldnm] = $msg->getMessage(); - } - - if (count($result['validations']) <= 0) { - // save config if validated correctly - $mdlProxyUserACL->serializeToConfig(); - Config::getInstance()->save(); - return array("result" => "saved"); - } - return $result; - } - return $result; - } - - /** - * - * get ACL - * @return array - */ - public function getACLAction($uuid = null) - { - $mdlProxyUserACL = $this->getModel(); - if ($uuid == null) { - // generate new node, but don't save to disc - $node = $mdlProxyUserACL->general->ACLs->ACL->add(); - return array("ACL" => $node->getNodes()); - } - - $node = $mdlProxyUserACL->getNodeByReference('general.ACLs.ACL.' . $uuid); - if ($node != null) { - return array("ACL" => $node->getNodes()); - } - - return array(); - } - - /** - * - * set ACL - * @return array - */ - public function setACLAction($uuid) - { - $result = array("result" => "failed"); - if ($this->request->isPost() && $this->request->hasPost("ACL")) { - $mdlProxyUserACL = $this->getModel(); - if ($uuid != null) { - $node = $mdlProxyUserACL->getNodeByReference('general.ACLs.ACL.' . $uuid); - if ($node != null) { - $result = array("result" => "failed", "validations" => array()); - $ACLInfo = $this->request->getPost("ACL"); - $ACLInfo["Hex"] = $this->strToHex($ACLInfo["Name"]); - $old_priority = (string)$node->Priority; - $new_priority = $ACLInfo["Priority"]; - - if ($new_priority < $old_priority) { - if ($new_priority < 0) { - $new_priority = 0; - } - - foreach ($mdlProxyUserACL->general->ACLs->ACL->sortedBy("Priority", true) as $acl) { - $key = $acl->getAttributes()["uuid"]; - $priority = (string)$mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority; - if ($priority < $new_priority) { - break; - } - if ($priority >= $old_priority) { - continue; - } - $mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority = (string)($priority + 1); - } - } elseif (($new_priority > $old_priority)) { - $count = count($mdlProxyUserACL->general->ACLs->ACL->getNodes()); - if ($new_priority >= $count) { - $new_priority = $count - 1; - $ACLInfo["Priority"] = $new_priority; - } - foreach ($mdlProxyUserACL->general->ACLs->ACL->sortedBy("Priority") as $acl) { - $key = $acl->getAttributes()["uuid"]; - $priority = (string)$mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority; - if ($priority > $new_priority) { - break; - } - if ($priority <= $old_priority) { - continue; - } - $mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority = (string)($priority - 1); - } - } - $node->setNodes($ACLInfo); - $find = $this->checkName($ACLInfo["Name"], $ACLInfo["Group"]); - if ($find !== true) { - $result["validations"]["ACL.Name"] = $find; - } - $valMsgs = $mdlProxyUserACL->performValidation(); - foreach ($valMsgs as $field => $msg) { - $fieldnm = str_replace($node->__reference, "ACL", $msg->getField()); - $result["validations"][$fieldnm] = $msg->getMessage(); - } - - if (count($result['validations']) > 0) { - return $result; - } - - // save config if validated correctly - $mdlProxyUserACL->serializeToConfig(); - Config::getInstance()->save(); - return array("result" => "saved"); - } - } - } - return $result; - } - - /** - * - * del ACL - * @return array - */ - public function delACLAction($uuid) - { - $result = array("result" => "failed"); - if ($this->request->isPost() && $uuid != null) { - $mdlProxyUserACL = $this->getModel(); - if ($mdlProxyUserACL->general->ACLs->ACL->del($uuid)) { - // if item is removed, serialize to config and save - $this->repackPriority(); - $mdlProxyUserACL->serializeToConfig(); - Config::getInstance()->save(); - $result['result'] = 'deleted'; - } else { - $result['result'] = 'not found'; - } - } - - return $result; - } - - /** - * - * Change ACL priority - * @param $uuid item unique id - * @return array - */ - public function updownACLAction($uuid) - { - $result = array("result" => "failed"); - if ($this->request->isPost() && $uuid != null && $this->request->hasPost("command")) { - $mdlProxyUserACL = $this->getModel(); - $count = $this->repackPriority(); - $nodes = $mdlProxyUserACL->general->ACLs->ACL->getNodes(); - $acl = $nodes[$uuid]; - $priority = $acl["Priority"]; - switch ($this->request->getPost("command")) { - case "up": - $new_priority = $priority - 1; - if ($new_priority < 0) { - return array("result" => "success"); - } - break; - - case "down": - $new_priority = $priority + 1; - if ($new_priority >= $count) { - return array("result" => "success"); - } - break; - - default: - return array("result" => "failed"); - } - foreach ($nodes as $key => $node) { - if ($node["Priority"] == $new_priority) { - $mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority = (string)$priority; - $mdlProxyUserACL->general->ACLs->ACL->{$uuid}->Priority = (string)$new_priority; - $mdlProxyUserACL->serializeToConfig(); - Config::getInstance()->save(); - return array('result' => 'success'); - } - } - } - return $result; - } - - private function checkName($user, $search) - { - $authFactory = new AuthenticationFactory(); - $servers = $authFactory->listServers(); - - foreach (explode(',', (new Proxy())->forward->authentication->method) as $method) { - if ($method == "") { - return gettext("No authentication method selected"); - } - $server = $servers[$method]; - switch ($server["type"]) { - case "ldap": - if (!isset($server["ldap_binddn"])) { - return gettext("LDAP user name is not specified"); - } - - if (!isset($server["ldap_bindpw"])) { - return gettext("LDAP user password is not specified"); - } - - $ldapBindURL = strstr($server['ldap_urltype'], "Standard") ? "ldap://" : "ldaps://"; - $ldapBindURL .= strpos($server['host'], "::") !== false ? "[{$server['host']}]" : $server['host']; - $ldapBindURL .= !empty($server['ldap_port']) ? ":{$server['ldap_port']}" : ""; - $ldap_auth_server = $authFactory->get($server["name"]); - if ( - $ldap_auth_server->connect( - $ldapBindURL, - $server["ldap_binddn"], - $server["ldap_bindpw"] - ) == false - ) { - return gettext("Error connecting to LDAP server"); - } - - try { - $users = $ldap_auth_server->searchUsers($user, $server["ldap_attr_user"]); - } catch (\Exception $e) { - break; - } - if ($users !== false && count($users) > 0) { - return true; - } - break; - - case "local": - foreach (Config::getInstance()->object()->system->{"$search"} as $item) { - if ($user == (string)$item->name) { - return true; - } - } - break; - - default: - break; - } - } - return sprintf(gettext('The %s %s does not exist'), $search, $user); - } - - private function repackPriority() - { - $mdlProxyUserACL = $this->getModel(); - $count = 0; - foreach ($mdlProxyUserACL->general->ACLs->ACL->sortedBy("Priority") as $node) { - $key = $node->getAttributes()["uuid"]; - $mdlProxyUserACL->general->ACLs->ACL->{$key}->Priority = (string)$count++; - } - return $count; - } - - private function strToHex($string) - { - $hex = ''; - for ($i = 0; $i < strlen($string); $i++) { - $hex .= dechex(ord($string[$i])); - } - return $hex; - } -} diff --git a/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/IndexController.php b/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/IndexController.php deleted file mode 100644 index 46d1e0005..000000000 --- a/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/IndexController.php +++ /dev/null @@ -1,41 +0,0 @@ -view->pick('OPNsense/ProxyUserACL/index'); - $this->view->formDialogACL = $this->getForm("dialogACL"); - } -} diff --git a/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/forms/dialogACL.xml b/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/forms/dialogACL.xml deleted file mode 100644 index ac8aca7af..000000000 --- a/www/web-proxy-useracl/src/opnsense/mvc/app/controllers/OPNsense/ProxyUserACL/forms/dialogACL.xml +++ /dev/null @@ -1,44 +0,0 @@ -
- - ACL.Name - - text - Enter a name of user/group. Group name is case sensitive. - - - ACL.Priority - - text - Rule priority - - - ACL.Group - - dropdown - Group or User ACL - - - ACL.Black - - dropdown - Black or White list - - - ACL.Domains - - select_multiple - - true - - You may use a regular expression, use a comma or press Enter for new item.
-
- Examples:
- mydomain.com -> matches on *.mydomain.com
- ^https?:\/\/([a-zA-Z]+)\.mydomain\. -> matches on http(s)://textONLY.mydomain.*
- \.gif$ -> matches on \*.gif but not on \*.gif\test
- \[0-9]+\.gif$ -> matches on \123.gif but not on \test.gif
-
-
TIP: You can also paste a comma separated list into this field.
]]> - Regular expressions are allowed. - -
diff --git a/www/web-proxy-useracl/src/opnsense/mvc/app/models/OPNsense/ProxyUserACL/Menu/Menu.xml b/www/web-proxy-useracl/src/opnsense/mvc/app/models/OPNsense/ProxyUserACL/Menu/Menu.xml deleted file mode 100644 index 395d8c503..000000000 --- a/www/web-proxy-useracl/src/opnsense/mvc/app/models/OPNsense/ProxyUserACL/Menu/Menu.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - - - diff --git a/www/web-proxy-useracl/src/opnsense/mvc/app/models/OPNsense/ProxyUserACL/ProxyUserACL.php b/www/web-proxy-useracl/src/opnsense/mvc/app/models/OPNsense/ProxyUserACL/ProxyUserACL.php deleted file mode 100644 index 9474512a8..000000000 --- a/www/web-proxy-useracl/src/opnsense/mvc/app/models/OPNsense/ProxyUserACL/ProxyUserACL.php +++ /dev/null @@ -1,37 +0,0 @@ - - //OPNsense/ProxyUserACL - 1.0.0 - - Group and User ACL settings - - - - - - - Y - - - Y - - - N - - - Y - Black - - Black - White - - - - 0 - Y - - - Y - group - - Group - User - - - - - - - diff --git a/www/web-proxy-useracl/src/opnsense/mvc/app/views/OPNsense/ProxyUserACL/index.volt b/www/web-proxy-useracl/src/opnsense/mvc/app/views/OPNsense/ProxyUserACL/index.volt deleted file mode 100644 index e8cd10d71..000000000 --- a/www/web-proxy-useracl/src/opnsense/mvc/app/views/OPNsense/ProxyUserACL/index.volt +++ /dev/null @@ -1,155 +0,0 @@ -{# -Copyright (C) 2017 Smart-Soft - -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, -INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE -AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, -OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF -SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS -INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN -CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE -POSSIBILITY OF SUCH DAMAGE. - -#} - - - -
- - - - -
- - - - - - - - - - - - - - - - - - - - -
{{ lang._('Number') }}{{ lang._('Group') }}{{ lang._('Black') }}{{ lang._('Name') }}{{ lang._('Domains') }}{{ lang._('Priority') }}{{ lang._('Commands') }}
- - -
-
-
- - -{{ partial("layout_partials/base_dialog",['fields':formDialogACL,'id':'DialogACL','label':lang._('Edit user/group white and black lists')]) }} diff --git a/www/web-proxy-useracl/src/opnsense/scripts/OPNsense/ProxyUserACL/reload.php b/www/web-proxy-useracl/src/opnsense/scripts/OPNsense/ProxyUserACL/reload.php deleted file mode 100755 index 753ed937d..000000000 --- a/www/web-proxy-useracl/src/opnsense/scripts/OPNsense/ProxyUserACL/reload.php +++ /dev/null @@ -1,45 +0,0 @@ -#!/usr/bin/env php -object()->system->domain); - -array_map('unlink', glob("/usr/local/etc/squid/ACL_useracl_*.txt")); -foreach ($mdlProxyUserACL->getNodeByReference('general.ACLs.ACL')->getNodes() as $acl) { - file_put_contents("/usr/local/etc/squid/ACL_useracl_" . - $acl["Priority"] . ".txt", $acl["Name"] . "\n" . - ($acl["Group"]["user"]["selected"] == "1" ? $acl["Name"] . "@" . $domain . "\n" : "")); -} diff --git a/www/web-proxy-useracl/src/opnsense/service/conf/actions.d/actions_proxyuseracl.conf b/www/web-proxy-useracl/src/opnsense/service/conf/actions.d/actions_proxyuseracl.conf deleted file mode 100644 index 2cddc83b8..000000000 --- a/www/web-proxy-useracl/src/opnsense/service/conf/actions.d/actions_proxyuseracl.conf +++ /dev/null @@ -1,5 +0,0 @@ -[reload] -command:/usr/local/opnsense/scripts/OPNsense/ProxyUserACL/reload.php -parameters: -type:script -message:reload web proxy user acl diff --git a/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/+TARGETS b/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/+TARGETS deleted file mode 100644 index 65d5f705d..000000000 --- a/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/+TARGETS +++ /dev/null @@ -1 +0,0 @@ -ProxyUserACL.conf:/usr/local/etc/squid/auth/ProxyUserACL.conf diff --git a/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/ProxyUserACL.conf b/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/ProxyUserACL.conf deleted file mode 100644 index a5c48fe0a..000000000 --- a/www/web-proxy-useracl/src/opnsense/service/templates/OPNsense/ProxyUserACL/ProxyUserACL.conf +++ /dev/null @@ -1,92 +0,0 @@ -{% set ldap = [] %} -{% set local = [] %} -{% if helpers.exists('OPNsense.proxy.forward.authentication.method') and OPNsense.proxy.forward.authentication.method != '' %} -{% for method in OPNsense.proxy.forward.authentication.method.split(",") %} -{% if method == "Local Database" %} -{% if local.append("1") %} -{% endif %} -{% else %} -{% for server in helpers.toList('system.authserver') %} -{% if server.type == 'ldap' and server.name == method %} -{% if ldap.append(server) %} -{% endif %} -{% endif %} -{% endfor %} -{% endif %} -{% endfor %} -{% endif %} - -{% if helpers.exists('OPNsense.ProxyUserACL.general.ACLs.ACL') %} -{% for ACL in helpers.toList('OPNsense.ProxyUserACL.general.ACLs.ACL') %} -{% if ACL.Group == "group" %} -{% if ldap|length == 1 %} -{% if helpers.exists('OPNsense.ProxySSO.EnableSSO') and OPNsense.ProxySSO.EnableSSO == '1' %} -external_acl_type ext_group_ldap_{{ ACL.Priority}} ttl=300 negative_ttl=60 %LOGIN /usr/local/libexec/squid/ext_kerberos_ldap_group_acl -a -t {{ ACL.Hex }} -D {{ system.domain|upper }} -acl group_ldap_{{ACL.Priority}} external ext_group_ldap_{{ ACL.Priority }} -{% else %} -{% for authcn in ldap[0].ldap_authcn.split(";") %} -{% if ldap[0].ldap_attr_user == 'cn' %} -external_acl_type ext_ldap_{{ ACL.Priority }}_{{ loop.index }} ttl=300 negative_ttl=60 %LOGIN /usr/local/libexec/squid/ext_ldap_group_acl -R -b "{{ldap[0].ldap_basedn}}" -f "(&(cn=%a)(memberUid=%u))" -D "{{ldap[0].ldap_binddn}}" -w "{{ldap[0].ldap_bindpw}}" -p "{{ldap[0].ldap_port}}" "{{ldap[0].host}}" -{% else %} -external_acl_type ext_ldap_{{ ACL.Priority }}_{{ loop.index }} ttl=300 negative_ttl=60 %LOGIN /usr/local/libexec/squid/ext_ldap_group_acl -R -b "{{ldap[0].ldap_basedn}}" -f "(&({{ldap[0].ldap_attr_user}}=%u)(memberOf=cn=%a,{{authcn}}))" -D "{{ldap[0].ldap_binddn}}" -w "{{ldap[0].ldap_bindpw}}" -p "{{ldap[0].ldap_port}}" "{{ldap[0].host}}" -{% endif %} -acl group_ldap_{{ACL.Priority}}_{{ loop.index }} external ext_ldap_{{ ACL.Priority }}_{{ loop.index }} "/usr/local/etc/squid/ACL_useracl_{{ ACL.Priority }}.txt" -{% endfor %} -{% endif %} -{% endif %} -{% if local|length == 1 %} -external_acl_type ext_group_local_{{ ACL.Priority }} ttl=300 negative_ttl=60 %LOGIN /usr/local/libexec/squid/ext_unix_group_acl -p -acl group_local_{{ACL.Priority}} external ext_group_local_{{ ACL.Priority }} "/usr/local/etc/squid/ACL_useracl_{{ ACL.Priority }}.txt" -{% endif %} -{% else %} -acl user_{{ACL.Priority}} proxy_auth "/usr/local/etc/squid/ACL_useracl_{{ ACL.Priority }}.txt" -{% endif %} -{% if ldap|length == 1 or local|length == 1 %} -{% for element in ACL.Domains.split(",") %} -{% if '^' in element or '\\' in element or '$' in element or '[' in element %} -acl domains_{{ACL.Priority}} url_regex {{element|encode_idna}} -{% else %} -acl domains_{{ACL.Priority}} url_regex {{element|encode_idna|replace(".","\.")}} -{% endif %} -{% endfor %} -{% endif %} -{% endfor %} -{% endif %} - -{% if helpers.exists('OPNsense.ProxyUserACL.general.ACLs.ACL') and (ldap|length == 1 or local|length == 1) %} -{% for priority in range(0,helpers.toList('OPNsense.ProxyUserACL.general.ACLs.ACL')|length) %} -{% for ACL in helpers.toList('OPNsense.ProxyUserACL.general.ACLs.ACL') %} -{% if ACL.Priority == priority|string %} -{% if ACL.Group == "group" %} -{% if ldap|length == 1 %} -{% if helpers.exists('OPNsense.proxy.forward.icap.enable') and OPNsense.proxy.forward.icap.enable == '1' %} -adaptation_access response_mod {{ACL.Black}} group_ldap_{{ACL.Priority}} domains_{{ACL.Priority}} -adaptation_access request_mod {{ACL.Black}} group_ldap_{{ACL.Priority}} domains_{{ACL.Priority}} -{% endif %} -{% if helpers.exists('OPNsense.ProxySSO.EnableSSO') and OPNsense.ProxySSO.EnableSSO == '1' %} -http_access {{ACL.Black}} group_ldap_{{ACL.Priority}} domains_{{ACL.Priority}} -{% else %} -{% for authcn in ldap[0].ldap_authcn.split(";") %} -http_access {{ACL.Black}} group_ldap_{{ACL.Priority}}_{{ loop.index }} domains_{{ACL.Priority}} -{% endfor %} -{% endif %} -{% endif %} -{% if local|length == 1 %} -{% if helpers.exists('OPNsense.proxy.forward.icap.enable') and OPNsense.proxy.forward.icap.enable == '1' %} -adaptation_access response_mod {{ACL.Black}} group_local_{{ACL.Priority}} domains_{{ACL.Priority}} -adaptation_access request_mod {{ACL.Black}} group_local_{{ACL.Priority}} domains_{{ACL.Priority}} -{% endif %} -http_access {{ACL.Black}} group_local_{{ACL.Priority}} domains_{{ACL.Priority}} -{% endif %} -{% else %} -{% if helpers.exists('OPNsense.proxy.forward.icap.enable') and OPNsense.proxy.forward.icap.enable == '1' %} -adaptation_access response_mod {{ACL.Black}} user_{{ACL.Priority}} domains_{{ACL.Priority}} -adaptation_access request_mod {{ACL.Black}} user_{{ACL.Priority}} domains_{{ACL.Priority}} -{% endif %} -http_access {{ACL.Black}} user_{{ACL.Priority}} domains_{{ACL.Priority}} -{% endif %} -{% break %} -{% endif %} -{% endfor %} -{% endfor %} -{% endif %}