Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid V6.10

    Scheduled Pinned Locked Moved Cache/Proxy
    squidsquid-proxysquid update
    32 Posts 9 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      ICS_DOS
      last edited by

      Now that the Vulnerabilities are fixed Upstream, I see no reason why this Package is still deprecated. I would love to deploy it for my Customers but can't reasonably do so :(

      M 1 Reply Last reply Reply Quote 2
      • M
        michmoor LAYER 8 Rebel Alliance @ICS_DOS
        last edited by

        @ICS_DOS Outside of the vulns found and/or fixed there is still the fact that there is no maintainer for Squid for pfsense. There is a lot wrong with the package and unless someone steps up and volunteers their time to fix all the glaring problems i see no reason why netgate would still have this package in the repo.

        Firewall: NetGate,Palo Alto-VM,Juniper SRX
        Routing: Juniper, Arista, Cisco
        Switching: Juniper, Arista, Cisco
        Wireless: Unifi, Aruba IAP
        JNCIP,CCNP Enterprise

        N 2 Replies Last reply Reply Quote 0
        • N
          Nafryti @michmoor
          last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • N
            Nafryti @michmoor
            last edited by Nafryti

            @michmoor said in Squid V6.10:

            "still the fact that there is no maintainer for Squid for pfsense."

            That's not true at all, there is someone from NG (at least that's my understanding of the name: "marcos-ng") updating the repo.

            e478b5e8-932c-49fd-b5b3-92dca206b38b-image.png

            @michmoor what problems, if you don't mind my asking?

            M 1 Reply Last reply Reply Quote 0
            • JonathanLeeJ
              JonathanLee
              last edited by

              I do not think that he still uses this package anymore for a while. I would search out others for help.

              Make sure to upvote

              1 Reply Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @Nafryti
                last edited by

                @Nafryti Yes there were commits done but that does not mean there are maintainers. I repeat there are no volunteers maintaining this package on pfsense.
                Read the redmine notes regarding those Git commits. Its clearly stated by the engineer who pushed the PR that Squid is going away.

                One of the biggest issues is that transparent mode is useless and broken. That alone makes the package unusable for most.
                https://redmine.pfsense.org/issues/14390

                There are those in the forum who still use the package daily like @JonathanLee who is very active with it and probably is a good resource for all things Squid on pfsense.

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                1 Reply Last reply Reply Quote 0
                • JonathanLeeJ
                  JonathanLee
                  last edited by

                  Squid itself has been updated with many of the fixes per this email.

                  Just got an update on Squid working on bug fixes. Looks like 7 is the version that mitigates most of all of them.

                  "The Squid Project apologizes for being late in responding to the
                  publication of 55 vulnerabilities disclosed by Joshua Rogers of Opera Software
                  at https://megamansec.github.io/Squid-Security-Audit/

                  We thank Joshua for discovering these bugs and sharing their details with us.
                  The surprise publication caught us off guard, but Squid
                  developers had worked on addressing some of the disclosed vulnerabilities
                  since before that publication. This message summarizes Squid's status on
                  October 9th, 2024.

                  As of Squid v6.8, the vast majority of high-impact vulnerabilities have been
                  addressed. The following disclosed vulnerabilities are still present:

                  Vulnerability “strlen(NULL) Crash Using Digest Authentication”
                  This vulnerability is still present in Squid v6.11. A fix is expected in Squid
                  v6.12, due any day now.
                  Digest authentication is disabled by default; the current workaround is
                  to avoid Digest authentication.

                  To verify whether your Squid configuration is vulnerable, check whether it
                  contains "auth_param” directive. Configurations with auth_param directives
                  mentioning "digest" scheme may be vulnerable.

                  pipeline_prefetch (HTTP pipelining of client-to-Squid requests)
                  All reported pipelining-related vulnerabilities may still be present in Squid
                  v6. Pipelining code will probably be removed in master branch and become
                  unavailable in Squid v7. Pipelining is disabled by default.

                  If you do not need pipelining (or do not know for sure that you need it), do
                  not enable that performance optimization.

                  To verify whether your Squid configuration is vulnerable, check whether it
                  contains a pipeline_prefetch directive. Configurations containing a
                  pipeline_prefetch directive set to a positive value may be vulnerable.

                  ESI (Edge Side Includes)
                  Most reported ESI-related vulnerabilities are still present in Squid v6. ESI
                  code has been removed in the master branch and will not be available
                  in Squid v7.
                  ESI is disabled in the default build starting with Squid v6.10. In earlier
                  versions, ESI code is enabled by default, but the risk is moderate because
                  exploiting this family of vulnerabilities requires Squid to be
                  configured as a reverse proxy for a malicious origin server.

                  If you do not need ESI (or do not know whether you need it), disable it with
                  --disable-esi (default for Squid v6.10 and later).

                  To verify whether your Squid build is vulnerable, run squid -v. Squid v6.9
                  and earlier versions may be vulnerable unless the output contains
                  --disable-esi. Squid v6.10 and later versions may be vulnerable if the
                  output contains --enable-esi.

                  Squid v5
                  Some fixes were backported to Squid v5, but we lack the resources necessary to
                  support that old version. Folks running Squid v5 and earlier versions should
                  either upgrade to the latest v6 release or rely on their
                  integrator/distributor for support.

                  --
                  Francesco Chemolli
                  Squid Software Foundation

                  squid-users mailing list
                  squid-users@lists.squid-cache.org
                  https://lists.squid-cache.org/listinfo/squid-users"

                  Version 7 is where most almost all of the issues are resolved with. Again some changes were made that would require a Netgate php-software used to configure Squid to Squid software convergence test and tune up. I love Squid it is like a swiss army knife.

                  Make sure to upvote

                  N 1 Reply Last reply Reply Quote 2
                  • N
                    Nafryti @JonathanLee
                    last edited by

                    @JonathanLee I see all these updates, all this work going on for Squid, and everyone saying it's either "useless" or "still full of vulnerabilities" what is going on here?

                    Is there some kind of secret here? What's up, I get that months ago it was exposed for vulnerabilities and then what happened? did these people just pull the wool over their eyes and say "oh well, it'll never be fixed." and no matter what Squid Devs do it's all in vain due to the lack of vision?

                    If not with Squid, then what can I use to Download Cache Steam downloads?

                    JonathanLeeJ A 2 Replies Last reply Reply Quote 0
                    • JonathanLeeJ
                      JonathanLee @Nafryti
                      last edited by JonathanLee

                      @Nafryti we can hope they fix it. I do know Opensense has updated Squid and continues to support it last time I checked. So I do hope pfSense continues to support it. We know the vulnerabilities are fixed now so that should not be an issue anymore. I know it was still listed on the snapshots last time I checked. The php code does need some software convergence with the status pages etc now that vulnerabilities are mitigated.

                      Yes I hope it is updated soon. I am thankful it is still listed

                      Make sure to upvote

                      M 1 Reply Last reply Reply Quote 1
                      • M
                        michmoor LAYER 8 Rebel Alliance @JonathanLee
                        last edited by

                        @JonathanLee Curious. Does OPNsense Squid have the same problem with transparent proxy as pfsense or have the devs over there fixed it?

                        Firewall: NetGate,Palo Alto-VM,Juniper SRX
                        Routing: Juniper, Arista, Cisco
                        Switching: Juniper, Arista, Cisco
                        Wireless: Unifi, Aruba IAP
                        JNCIP,CCNP Enterprise

                        JonathanLeeJ P B 3 Replies Last reply Reply Quote 0
                        • JonathanLeeJ
                          JonathanLee @michmoor
                          last edited by

                          @michmoor you know me PFS only

                          Make sure to upvote

                          1 Reply Last reply Reply Quote 1
                          • A
                            aGeekhere @Nafryti
                            last edited by aGeekhere

                            @Nafryti said in Squid V6.10:

                            then what can I use to Download Cache Steam downloads

                            You can use lancache
                            https://lancache.net/

                            Never Fear, A Geek is Here!

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfsjap @michmoor
                              last edited by

                              @michmoor Have considered, but not tried Squid in pfSense, what's the problem you referred to?

                              1 Reply Last reply Reply Quote 0
                              • B
                                bon-go @michmoor
                                last edited by

                                @michmoor
                                Yes, it works for them, unfortunately only there :(

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.