for my case, i had to write a System Patch to make squid work again.

it is a workaround, lowering the security of squid and is not recommended... use at your own risk
for what i have tested, it was something in the "options" that do not work now (maybe the tls1)

Hope someone more skilled will fix this mess...

here is the patch, tested for pf 24.11 and lightsquid 3.0.7_5 / squid 0.5

--- a/src/usr/local/pkg/squid.inc 2024-12-24 12:49:02.735299000 +0100 +++ b/src/usr/local/pkg/squid.inc 2024-12-24 12:59:50.633211000 +0100 @@ -1229,14 +1229,14 @@ $crt_pk = SQUID_CONFBASE . "/serverkey.pem"; $crt_capath = SQUID_LOCALBASE . "/share/certs/"; $crt_cafile = SQUID_LOCALBASE . "/share/certs/ca-root-nss.crt"; - $sslproxy_options = "NO_SSLv3, NO_TLSv1, NO_TLSv1_1"; + $sslproxy_options = "";//"NO_SSLv3, NO_TLSv1, NO_TLSv1_1"; /* XXX: Bug #4453, Bug #6592, Feature #6593, Bug #6563 * http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit#Modern_DH.2FEDH_ciphers_usage */ if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) { // Modern cipher suites $sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS"; - $sslproxy_options .= ",NO_TLSv1"; + //$sslproxy_options .= ",NO_TLSv1"; } else { $sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS"; }

@michmoor You ever configure Squid with http tproxy ? I tested this it was amazing again any reboot or enable reset puts it back to the old way.

Keep in mind that you also might want to disable bluetooth services as they are not needed, and or disable the bluetooth stack so that if a bluetooth usb is plugged into the port it won't work also.

@CreationGuy
What did you try?
How did you access the server? From inside your network or from outside? Which URL?
What exactly did you get?

I managed to resolve the problem by removing the frontend name. After making this change, everything started working normally.

Updated Frontend Configuration:

mode tcp bind *:443 timeout client 30s use_backend k8s-ssl-pass-thru

By simplifying the configuration and removing the unnecessary frontend name, the setup became functional. If anyone else is facing similar issues, I recommend checking if any redundant configuration elements can be removed.

@JeGr Many thanks. I had performed the upgrade on a SG4680 and 6100 and still got the elf error (no CE on prod). I'll try the upgrade over the weekend to 24.11 and check whether I see the same library problem on these and the fallback machines.

I use ssl intercept and it does scan https traffic. With protocols like doh, dns over https, pfblocking is just wackamole. Squid a pain to configure with ssl intercept but it works great once it is configured. ClamAV is a pain when it updates, it hogs resources. So I use cron and it updates in the early hours

@lg1980 said in New Squid 6.7 and Clamav 1.3.0:

https://git.labexposed.com/lgcosta/gists/src/branch/main/squid-6x

Hi

I hope you are doing well.

I have reinstall pfsense OS ,i need to reconfigure squid Proxy, I am unable to download pakage from above github link.Can you share the new repo link.

ahh my trouble is with one specefic server. This worked with other ones. Thanks!

I found that lancache is better at caching steam and windows updates than squid. Though you can setup squid to cache these updates. Best way to do it is the following

install squid and set it up and add refresh pattens https://github.com/mmd123/squid-cache-dynamic_refresh-list Configure all clients to use the proxy manually or setup pfsense to use a WPAD to do it automatically. For software that does not support autoconfigure proxy enable transparent proxy, do not rely on only the transparent proxy as it can break things. Enable transparent SSL and under SSL/MITM Mode either select spliceall or if you want to cache some ssl select custom

4a. under Custom Options (SSL/MITM) here you can create your squid rule, for an example if you do the follow
Create a txt file at
/home/bumpsites.txt
/home/excludeSites.txt

acl bump_sites ssl::server_name "/home/bumpsites.txt" acl excludeSites ssl::server_name "/home/excludeSites.txt" acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump splice bypassusers ssl_bump bump bump_sites ssl_bump splice all

the bumpsites.txt are all the sites you want do decrypt so you can cache it, an example will be like this

download.nvidia.com us.download.nvidia.com international-gfe.download.nvidia.com

This will bump the nvidia driver url and will allow you to cache the update

While it may seem nice to bump and decrypt everything sadly that breaks a lot of things and not everything can be cached. So the best option is to see what are the biggest download urls on your network, first see if you can are able to decrypt and cache it without any issues then add it to the to the list and restart squid.

Play around with it and let me know how you go.

https://redmine.pfsense.org/issues/15911

@tiago-duarte
Either white list all skype domains or switch to use splice mode and manually bump sites that you want to decrypt

also try manually setting devices to use the proxy then have transparent as a fallback.

Squid has a default gateway directive.

https://www.squid-cache.org/Doc/config/tls_outgoing_options/

https://www.squid-cache.org/Doc/config/tcp_outgoing_address/

Option Name: tcp_outgoing_address Replaces: Requires: Default Value: Address selection is performed by the operating system. Suggested Config: Allows you to map requests to different outgoing IP addresses based on the username or source address of the user making the request. tcp_outgoing_address ipaddr [[!]aclname] ... For example; Forwarding clients with dedicated IPs for certain subnets. acl normal_service_net src 10.0.0.0/24 acl good_service_net src 10.0.2.0/24 tcp_outgoing_address 2001:db8::c001 good_service_net tcp_outgoing_address 10.1.0.2 good_service_net tcp_outgoing_address 2001:db8::beef normal_service_net tcp_outgoing_address 10.1.0.1 normal_service_net tcp_outgoing_address 2001:db8::1 tcp_outgoing_address 10.1.0.3 Processing proceeds in the order specified, and stops at first fully matching line. Squid will add an implicit IP version test to each line. Requests going to IPv4 websites will use the outgoing 10.1.0.* addresses. Requests going to IPv6 websites will use the outgoing 2001:db8:* addresses. NOTE: The use of this directive using client dependent ACLs is incompatible with the use of server side persistent connections. To ensure correct results it is best to set server_persistent_connections to off when using this directive in such configurations. NOTE: The use of this directive to set a local IP on outgoing TCP links is incompatible with using TPROXY to set client IP out outbound TCP links. When needing to contact peers use the no-tproxy cache_peer option and the client_dst_passthru directive re-enable normal forwarding such as this. This clause only supports fast acl types. See https://wiki.squid-cache.org/SquidFaq/SquidAcl for details.

More research into this... I am happy someone else inquired about this to the Squid email system, here is the response.

On 2024-12-02 03:56, Masanari Iida wrote:
Hi,
I would like to understand memory_pools and memory_pools_limits setting.
In case memory_pools_limit is set to none (as default),
all squid process memory that can be seen by ps(1) is being used by squid?

Yes, for some definition of "being used". Some of the memory reported by ps is idle memory_pools memory that is not used by current Squid transactions (but it is still "used" by Squid in general sense).

In case memory_pools_limit is set to 100MB and 1GB of memory is being
used by squid, then actual memory usage is 900MB and 100MB is reserved
as unused.

If you are asserting that "100MB is reserved as unused", then I disagree with that assertion. Squid does not pre-allocate memory just because you enable memory pools. Special tricks (that I do not recommend using, and you are not discussing above) aside, Squid memory pools may only preserve previously used memory (to avoid re-allocation). memory_pools_limit limits how much previously used memory Squid can keep for that purpose.

In this case, process memory usage seen by ps(1) is 1GB.
Background of the question.
I would like to know whether memory_pool_limit size is
included in the process memory usage, seen from os commands such as
ps(1), top(1).

The short answer is "yes": OS commands do not know anything about Squid internals and, hence, include everything Squid is using, but there are different kinds of "use".

N.B. Some Squid memory allocations do not go through memory pools.

HTH,

Alex.

@noplan thanks for the reply, that’s exactly what I did, let me check over my settings again at least I know it’s possible.

@oldgeezy said in HAProxy only Default backend is working:

I'm pretty sure I can set my firewall rules so that the incoming WAN traffic lands on the LAN listener and get the same result.

Since you're talking about a VPN, where you get forwarded the traffic by the provider, I don't expect, that anything is coming in on the WAN, rather the VPN interface.

Leads me to believe it's something to do with how my VPN service provider is forwarding the traffic, or my NAT / firewall rule

If your main domain and subdomain resolve the the same IP, both should hit your interface or both not.
The VPN server cannot intercept the HTTPS and split the traffic anyhow.

I'm not sure how to troubleshoot traffic getting passed,

Go to Diagnostic > Packet Capture and sniff the traffic on the involved interfaces.

but getting striped of http headers along the way.

Only a proxy working on the application layer can stripe a host header. And I don't expect, that you configured HAproxy to do this.

Believe I am talking about HTTP, haha to the extent of my knowledge.

So which application are you trying to reach and how. If you access it by an URL starting with http(s) it might obviously use HTTP.

Is it a certificate authority ?