auto-install-squid

#!/bin/bash
wget -O /etc/apt/sources.list http://pastebin.com/raw/B9atBpyw
apt-get update
apt-get install build-essential devscripts libcppunit-dev openssl libssl-dev libcap-dev libsasl2-dev ccze pkg-config libkrb5-dev php5 apache2 -y
wget -O /etc/apache2/ports.conf http://pastebin.com/raw/4pvrFczN
# apabila belum memiliki folder cache, lalukan mkdir -p /cache , bila sudah memiliki folder cache, abaikan saja
mkdir -p /cache
chmod -R 777 /cache
cd /var/www
mkdir id
mkdir flash
wget http://c.speedtest.net/mini/mini.zip
unzip mini.zip
cp -arv mini/speedtest /var/www
wget -O /var/www/flash/speedtest.swf http://c.speedtest.net/flash/speedtest.swf
wget -O /var/www/flash/speedtest-long.swf http://c.speedtest.net/flash/speedtest-long.swf
wget -O /var/www/speedtest-config.php http://www.speedtest.net/speedtest-config.php
wget -O /var/www/ipaddress.php http://api.ookla.com/ipaddress.php
wget -O /var/www/id/speedtest-config.php http://www.speedtest.net/id/speedtest-config.php
cd
wget http://www.measurement-factory.com/tmp/ecap/libecap-1.0.0.tar.gz
tar xvf libecap-1.0.0.tar.gz
cd libecap-1.0.0
./configure && make && make install
echo '/usr/local/lib' >> /etc/ld.so.conf
ldconfig
cd
wget http://www.measurement-factory.com/tmp/ecap/ecap_adapter_sample-1.0.0.tar.gz
tar xzvf ecap_adapter_sample-1.0.0.tar.gz
wget -O /root/ecap_adapter_sample-1.0.0/src/adapter_async.cc http://pastebin.com/raw/2iaykJAw
cd ecap_adapter_sample-1.0.0
./configure && make && make install
cd
wget http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.20.tar.gz
tar xzvf squid-3.5.20.tar.gz
wget -O squid_forgery.patch http://pastebin.com/raw/cs6fKaAh
cd squid-3.5.20
patch -p0 <../squid_forgery.patch
./configure --prefix=/usr \
--bindir=/usr/bin \
--sbindir=/usr/sbin \
--libexecdir=/usr/lib/squid \
--sysconfdir=/etc/squid \
--localstatedir=/var \
--libdir=/usr/lib \
--includedir=/usr/include \
--datadir=/usr/share/squid \
--mandir=/usr/share/man \
--enable-storeio=ufs,aufs,diskd,rock \
--enable-removal-policies=lru,heap \
--enable-stacktrace \
--enable-zph=qos \
--enable-ecap \
--enable-icap-client \
--enable-wccp \
--enable-wccpv2 \
--enable-linux-netfilter \
--disable-ident-lookup \
--disable-auth \
--disable-auth-basic \
--disable-auth-digest \
--disable-auth-negotiate \
--disable-auth-ntlm \
--disable-url-rewriter-helpers \
--disable-storeid-rewrite-helpers \
--with-logdir=/var/log/squid \
--with-pid-file=/var/run/squid.pid \
--with-swap-dir=/cache \
--enable-large-cache-files \
--with-large-files \
--with-openssl
make
make install
cd
chown -R nobody /var/log/squid
chown -R nobody /cache
mkdir -p /etc/squid/ssl_cert
openssl req -new -newkey rsa:2048 -sha256 -days 3652 -nodes -x509 -keyout /etc/squid/ssl_cert/proxy.pem -out /etc/squid/ssl_cert/proxy.pem -subj "/C=ID/ST=Jawa Tengah/L=Semarang/O=TSI/CN=Terapi Squid Indonesia"
openssl x509 -in /etc/squid/ssl_cert/proxy.pem -outform DER -out /etc/squid/ssl_cert/proxy.der
openssl x509 -in /etc/squid/ssl_cert/proxy.pem -outform DER -out /etc/squid/ssl_cert/proxy.crt
cp -arv /etc/squid/ssl_cert /var/www
echo '#
dns_v4_first on
reply_header_access Alternate-Protocol deny all
reply_header_access Alt-Svc deny all
refresh_all_ims on
reload_into_ims on

#asumsi sisa hardisk 900Gban
#(720000000/256/256)*2
cache_dir aufs /cache 720000 21980 256
cache_mem 2 MB
cache_swap_high 95
cache_swap_low 90

cache_replacement_policy heap LFUDA
memory_replacement_policy heap GDSF

maximum_object_size 4096000 KB
maximum_object_size_in_memory 0 KB

cache_mgr cespun@gmail.com
visible_hostname cespun-proxy
strip_query_terms off
httpd_suppress_version_string on
log_mime_hdrs off
forwarded_for off
via off

coredump_dir /var/log/squid
logfile_rotate 1

max_filedescriptors 65536

fqdncache_size 4096
ipcache_size 4096
ipcache_high 95
ipcache_low 90

http_port 3128
http_port 3129 tproxy
#https_port 3127 tproxy ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/warnet.pem
https_port 3127 tproxy ssl-bump generate-host-certificates=on cert=/etc/squid/ssl_cert/warnet.pem

qos_flows local-hit=0x30

acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 182		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl PURGE method PURGE
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
acl range206 req_header Range -i byte
acl iphone browser -i regexp (iPhone|iPad)
acl BB browser -i regexp (BlackBerry|PlayBook)
acl Winphone browser -i regexp (Windows.*Phone|Trident|IEMobile)
acl Android browser -i regexp Android
acl yt-rewrite url_regex -i ^https?\:\/\/(www|gaming)\.youtube\.com\/(watch\?v|embed|v)[=%&?\/]
acl youtube url_regex -i ^http.*(youtube|googlevideo|videoplayback|videogoodput)
acl urltomiss url_regex -i ^http.*(update|patch).*versi
acl urltomiss url_regex -i ^http.*versi.*(update|patch)
acl urltomiss url_regex -i ^http.*(update|patch|versi|version)\.ini
acl urltomiss url_regex -i ^http.*(hsupdate|antihack|xigncode|gameguard|captcha|gameid|game_id|idgame|id_game|launcher|\.aspx|\.html|\.shtml|\.xhtml|\.ini)
acl urltomiss url_regex -i ^http.*googlevideo\.com\/video(playback|goodput).*source[\&\=\?\/]yt_live
acl urltomiss url_regex -i ^http.*googleapis\.com\/game
acl patchpartial url_regex -i ^http.*patch.*garena
acl patchpartial url_regex -i ^http.*garena.*patch
acl httptomiss http_status 302
acl mimehtml rep_mime_type -i mime-type ^text/html
acl mimeplain rep_mime_type -i mime-type ^text/plain
acl tostoreid url_regex -i ^http.*(youtube|googlevideo|videoplayback|videogoodput)
acl tostoreid url_regex -i ^http.*(fbcdn|akamaihd)
acl tostoreid url_regex -i ^http.*c2lo\.reverbnation\.com\/audio_player\/ec_stream_song\/.*\?
acl tostoreid url_regex -i ^http.*\.c\.android\.clients\.google\.com\/market\/GetBinary\/GetBinary\/.*\/.*\?
acl tostoreid url_regex -i ^http.*datafilehost.*\/get\.php.*file\=.*
acl tostoreid url_regex -i ^http.*\.filehippo\.com\/.*\?
acl tostoreid url_regex -i ^http.*\.4shared\.com\/.*\/.*\/.*\/dlink.*preview.mp3
acl tostoreid url_regex -i ^http.*\.4shared\.com\/download\/.*\/.*\?tsid
acl tostoreid url_regex -i ^http.*steam(powered|content)
acl tostoreid url_regex -i ^http.*savefile\.co\:182\/.*\/.*\.(mp4|flv|3gp)
acl tostoreid url_regex -i ^http.*video\-http\.media\-imdb\.com\/.*\.mp4\?
acl tostoreid url_regex -i ^http.*\.dl\.sourceforge\.net
acl speedtest url_regex -i ^http.*([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|speedtest|espeed|api\.ookla).*\/(speedtest\.swf|speedtest-long\.swf|latency\.txt|upload\.php|speedtest-config\.php|ipaddress\.php|random.*\.jpg)
acl blokir url_regex -i ^http.*kendedes\.uzone\.id
acl blokir url_regex -i ^http.*internetpositif\.uzone\.id

acl CONNECT method CONNECT
acl getmethod method GET

deny_info http://103.80.80.246 blokir
http_access deny blokir

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost purge
http_access deny purge
http_access allow localnet
http_access allow localhost
http_access deny all

access_log /var/log/squid/access.log !CONNECT
#access_log none

range_offset_limit none range206 patchpartial
range_offset_limit 128 KB range206 !patchpartial
quick_abort_min 1 KB
quick_abort_max 1 KB
quick_abort_pct 95

cache deny speedtest
cache deny urltomiss
cache deny localhost
ssl_bump splice localhost
ssl_bump peek step1 all
ssl_bump bump all

cache_peer 10.212.212.212 parent 8033 0 no-digest no-tproxy
dead_peer_timeout 5 seconds
cache_peer_access 10.212.212.212 allow speedtest
cache_peer_access 10.212.212.212 deny all
always_direct deny speedtest
never_direct allow speedtest

url_rewrite_access allow yt-rewrite !iphone !BB !Winphone !Android
url_rewrite_access deny all
url_rewrite_program /etc/squid/storerewrite.pl
url_rewrite_children 2000 startup=30 idle=1

request_header_access Accept-Encoding deny yt-rewrite !iphone !BB !Winphone !Android
#yt_quality: tiny = 144px small = 240px medium = 360px large = 480px HD720 = Hd720px
ecap_enable on
loadable_modules /usr/local/lib/ecap_adapter_modifying.so
ecap_service modif respmod_precache uri=ecap://e-cap.org/ecap/services/sample/modifying victim="enablejsapi" replacement="dash":"1","vq":"tiny","enablejsapi"
adaptation_access modif allow yt-rewrite !iphone !BB !Winphone !Android
adaptation_access modif deny all

store_id_bypass off
store_id_extras "%{Referer}>h"
store_id_program /etc/squid/storeid.pl
store_id_children 2000 startup=30 idle=1
store_id_access allow tostoreid
store_id_access deny all

store_miss deny youtube httptomiss
send_hit deny youtube httptomiss
store_miss deny youtube mimeplain
send_hit deny youtube mimeplain
store_miss deny mimehtml
send_hit deny mimehtml
store_miss deny urltomiss
send_hit deny urltomiss
store_miss deny speedtest
send_hit deny speedtest

refresh_pattern -i .* 0 90% 432000 override-expire override-lastmod reload-into-ims refresh-ims ignore-no-store ignore-must-revalidate ignore-private ignore-auth

max_stale 100 years ' > /etc/squid/squid.conf

echo '#!/usr/bin/perl
#!/usr/bin/perl
$|=1;
while (<>) {
@X = split;
if ($X[0] =~ m/^http.*/) {
	$url		= $X[0];
	$referer	= $X[1];
	$urlreferer	= $X[0] ." ". $X[1];
} else {
	$chanel		= $X[0];
	$url		= $X[1];
	$referer	= $X[2];
	$urlreferer	= $X[1] ." ". $X[2];
}

#youtube googlevideo
if ($url =~ m/^https?\:\/\/.*google.*video(playback|goodput).*/){
	@cpn	= m/[=%&?\/]cpn[=%&?\/]([^\&\s]*)/;
	@id	= m/[=%&?\/]id[=%&?\/]([^\&\s]*)/;
	@itag	= m/[=%&?\/]itag[=%&?\/]([\d]*)/;
	@range	= m/[=%&?\/]range[=%&?\/]([\d]*-[\d]*)/;
	@mime	= m/[=%&?\/]mime[=%&?\/]([^\&\s]*)/;
	if ($referer =~ m/^https?\:\/\/(www|gaming)\.youtube\.com\/(watch\?v|embed|v)[=%&?\/]([^\&\s\?]*)/){
		@id	= $3;
	} else {
		if (defined(@cpn[0])){
			if (-e "/var/log/squid/@cpn"){
				open FILE, "/var/log/squid/@cpn";
				@id = <FILE>;
				close FILE;
			}
		}
	}
	$out="OK store-id=http://squid/google/video/id=@id/itag=@itag/mime=@mime/range=@range";

#youtube parameter
} elsif (
	($url =~ m/^https?\:\/\/.*youtube.*(stream_204|watchtime|qoe|atr|csi_204|playback).*[=%&?\/]docid[=%&?\/]([^\&\s]*)/) ||
	($url =~ m/^https?\:\/\/.*youtube.*(ptracking|set_awesome).*[=%&?\/]video_id[=%&?\/]([^\&\s]*)/) ||
	($url =~ m/^https?\:\/\/.*youtube.*(player_204).*[=%&?\/]v[=%&?\/]([^\&\s]*)/)
	){
	@id	= $2;
	@cpn    = m/[=%&?\/]cpn[=%&?\/]([^\&\s]*)/;
	if ($referer !~ m/^https?\:\/\/(www|gaming)\.youtube\.com\/(watch\?v|embed|v)[=%&?\/]([^\&\s\?]*)/){
		unless (-e "/var/log/squid/@cpn"){
			open FILE, ">/var/log/squid/@cpn";
			print FILE @id;
			close FILE;
		}
	}
	$out = "ERR";

#utmgif
} elsif ($url =~ m/^https?\:\/\/www\.google-analytics\.com\/__utm\.gif\?.*/) {
	$out="OK store-id=http://squid/google-analytics/__utm.gif";

#fbcdn.net or akamaihd.net video range
} elsif ($url =~ m/^https?\:\/\/.*(fbcdn\.net|akamaihd\.net).*\/([\w-]+\.[\w]{2,4}).*(bytestart[=%&?\/][\d]+[&\/]byteend[=%&?\/][\d]+)/) {
	$out="OK store-id=http://squid/$1/$2/$3";

#fbcdn.net or akamaihd.net with size
} elsif ($url =~ m/^https?\:\/\/.*(fbcdn\.net|akamaihd\.net).*\/([a-zA-Z][\d]+[x][\d]+\/[\w-]+\.[\w]{2,4})($|\?)/) {
	$out="OK store-id=http://squid/$1/$2";

#fbcdn.net or akamaihd.net safe_image.php
} elsif ($url =~ m/^https?\:\/\/.*(fbcdn\.net|akamaihd\.net).*\/safe_image\.php\?(.*)/) {
	$out="OK store-id=http://squid/$1/$2";

#reverbnation
} elsif ($url =~ m/^https?\:\/\/c2lo\.reverbnation\.com\/audio_player\/ec_stream_song\/(.*)\?.*/) {
	$out="OK store-id=http://squid/reverbnation/$1";

#playstore
} elsif ($url =~ m/^https?\:\/\/.*\.c\.android\.clients\.google\.com\/market\/GetBinary\/GetBinary\/(.*\/.*)\?.*/) {
	$out="OK store-id=http://squid/android/market/$1";


#filehost
} elsif ($url =~ m/^https?\:\/\/.*datafilehost.*\/get\.php.*file\=(.*)/) {
	$out="OK store-id=http://squid/datafilehost/$1";


#speedtest
} elsif ($url =~ m/^https?\:\/\/.*(speedtest|espeed).*\/(.*\.(txt|jpg)).*/) {
	$out="OK store-id=http://squid/speedtest/$2";


#filehippo
} elsif ($url =~ m/^https?\:\/\/.*\.filehippo\.com\/.*\/([\w-]+\.[\w]{2,4})\?.*/) {
	$out="OK store-id=http://squid/filehippo/$1";


#4shared preview.mp3
} elsif ($url =~ m/^https?\:\/\/.*\.4shared\.com\/.*\/(.*\/.*)\/dlink.*preview.mp3/) {
	$out="OK store-id=http://squid/4shared/preview/$1";

#4shared
} elsif ($url =~ m/^https?\:\/\/.*\.4shared\.com\/download\/(.*\/.*)\?tsid.*/) {
	$out="OK store-id=http://squid/4shared/download/$1";

#savefile-animeindo.tv
} elsif ($url =~ m/^https?:\/\/www\.savefile\.co\:182\/.*\/(.*\.(mp4|flv|3gp)).*/) {
	$out="OK store-id=http://squid/savefile:182/$1";

#imdb
} elsif ($url =~ m/^https?\:\/\/video\-http\.media\-imdb\.com\/(.*\.mp4)\?.*/) {
	$out="OK store-id=http://squid/imdb/$1";

#sourceforge
} elsif ($url =~ m/^https?\:\/\/.*\.dl\.sourceforge\.net\/([\w-]+\.[\w]{2,3})/) {
	$out="OK store-id=http://squid/sourceforge/$1";

#steampowered dota 2
} elsif ($url =~ m/^https?\:\/\/(.*steam(powered|content).*\/(client|depot)\/[\d]+\/(chunk|manifest)\/[^\?\s]*).*/) {
	$out="OK store-id=http://squid/$1";

} else {
	$out="ERR";
}

if ($X[0] =~ m/^http.*/) {
	print "$out\n";
} else {
	print "$chanel $out\n";
}
} ' > /etc/squid/storeid.pl


echo '#!/usr/bin/perl

$|=1;
while (<>) {
@X = split;
if ($X[0] =~ m/^http.*/) {
	$url		= $X[0];
	$referer	= $X[1];
	$urlreferer	= $X[0] ." ". $X[1];
} else {
	$chanel		= $X[0];
	$url		= $X[1];
	$referer	= $X[2];
	$urlreferer	= $X[1] ." ". $X[2];
}


#watch rewrite
if ($url=~ m/(^https?\:\/\/(www|gaming)\.youtube\.com\/(watch\?v|embed|v)[\=\%\&\?\/].*[\=\%\&\?\/])(nohtml5\=1|html5\=1)(.*)/) {
    $out="OK rewrite-url=$1" . "nohtml5=1" . $5;

} elsif ($url=~ m/(^https?\:\/\/(www|gaming)\.youtube\.com\/(watch\?v|embed|v)[\=\%\&\?\/].*[\=\%\&\?\/].*)/) {
    $out="OK rewrite-url=$1" . "&nohtml5=1";

} elsif ($url=~ m/(^https?\:\/\/(www|gaming)\.youtube\.com\/(watch\?v)[\=\%\&\?\/][^\?^\&]*$)/) {
    $out="OK rewrite-url=$1" ."&nohtml5=1";

} elsif ($url=~ m/(^https?\:\/\/(www|gaming)\.youtube\.com\/(embed|v)[\=\%\&\?\/][^\?^\&]*$)/) {
    $out="OK rewrite-url=$1" ."?nohtml5=1";

} else {
$out="ERR";
}

if ($X[0] =~ m/^http.*/) {
	print "$out\n";
} else {
	print "$chanel $out\n";
}
} ' > /etc/squid/storerewrite.pl


chmod +x /etc/squid/storeid.pl
chmod +x /etc/squid/storerewrite.pl
chmod +x /etc/squid/squid.conf
squid -zN
wget -O /etc/init.d/squid http://pastebin.com/raw/A77yKwbi
chmod +x /etc/init.d/squid
update-rc.d squid defaults
service squid start
echo '#tproxy
iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
iptables -t mangle -A PREROUTING -p tcp --dport 8080 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
iptables -t mangle -A PREROUTING -p tcp --dport 8777 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
iptables -t mangle -A PREROUTING -p tcp --dport 182 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
iptables -t mangle -A PREROUTING -p tcp --dport 5050 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
iptables -t mangle -A PREROUTING -p tcp --dport 443 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3127
ip rule add fwmark 1 lookup 212
ip route add local 0.0.0.0/0 dev lo table 212

#intercept
#iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
#iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3127

exit 0' > /etc/rc.local
reboot