Squid 6.6 DEV 24 Issues

[JonathanLee]

@michmoor
| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.

I am going to fix this in git hub if I can find the variable name this is a simple fix.

[JonathanLee]

Found it I am going to submit a commit to the package to fix this error it was listed in the older version also however the logs were disabled for it and it would only show up when you ran

squid -k parse

[JonathanLee]

@JonathanLee said in Squid 6.6 DEV 24 Issues:

| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.

[JonathanLee]

Nope that didn't fix it

[JonathanLee]

I found the error for the tis-cafile that fixed some of the errors. I am going to resubmit the changes

[JonathanLee]

@JonathanLee said in Squid 6.6 DEV 24 Issues:

2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.

This fixed the

2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.

One error gone 1

[JonathanLee]

If anyone wants to let me know what part of the cipher should be removed please let me know so I can fix the RC4 issue.

https://github.com/pfsense/FreeBSD-ports/pull/1365

Working on this also Per Squid support Amos Jeffries

"Also there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4."

Are we to disable RC4 because of the security issues? Or are we leaving it it has both listed.

if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) {
					// Modern cipher suites
					$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS";
					$sslproxy_options .= ",NO_TLSv1";
				} else {
					$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";
				}

[JonathanLee]

FIX ME
line of code 1261 in /usr/local/pkg/squid.inc
FIX ME
line of code 1235-1241 in usr/local/pkg/squid.inc

[JonathanLee]

@JonathanLee

https://github.com/pfsense/FreeBSD-ports/pull/1366

Fix for non support

2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE

[JonathanLee]

HAPPY DANCE!! I FINALLY SOMETHING WITH SQUID'S CODE ALL MY COLLEGE AND UNIVERSITY WORK AND I FINALLY GOT TO FIX SOMETHING!!!!

[JonathanLee]

I have to go back to my Everything Bagel Version because my wife is home, but I changed the code on 5.8 and it fixed the errors also

[JonathanLee]

@stephenw10

A lot of my images for posts got deleted as of today is something else going on with the website?

[DefenderLLC]

@JonathanLee I noticed this yesterday too. All of the images on my recent posts/replies are all gone. If I click on the links, it says "file not found." or something like that.

[JonathanLee]

Anyone else attempt this challenge?? Non google lobbyists…

Or google lobbyist also???

[DefenderLLC]

@JonathanLee said in Squid 6.6 DEV 24 Issues:

@stephenw10

A lot of my images for posts got deleted as of today is something else going on with the website?

The images are back now...