Squid 6.6 DEV 24 Issues

JonathanLee

Hello fellow Netgate community dev team,

Squid 6.6 has some errors

Screenshot 2024-04-04 092823.png

yes that issue along with it I can no longer access

https://192.168.1.1:7445/cachemgr.cgi too

Screenshot 2024-04-04 092543.png

I get my login for it however I get access blocked

Screenshot 2024-04-04 092613.png

Also error logs issue again

Screenshot 2024-04-04 092710.png

But it is working cacheing and blocking URLS correctly just access the logging something is off for me.

/status_services.php: The command '/usr/local/etc/rc.d/squid.sh stop' returned exit code '1', the output was '2024/04/04 09:45:59| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0) 2024/04/04 09:45:59| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:45:59| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| Starting Authentication on port 127.0.0.1:3128 2024/04/04 09:45:59| Disabling Authentication on port 127.0.0.1:3128 (interception enabled) 2024/04/04 09:45:59| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:45:59| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| Starting Authentication on port 127.0.0.1:3129 2024/04/04 09:45:59| Disabling Authentication on port 127.0.0.1:3129 (interception enabled) 2024/04/04 09:45:59| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead. 2024/04/04 09:45:59| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| ERROR: Directive 'dns_v4_first' is obsolete. 2024/04/04 09:45:59| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records. 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| SECURITY WARNING: Peer certificates are not verified for validity! 2024/04/04 09:45:59| WARNING: UPGRADE: The DONT_VERIFY_PEER flag is deprecated. Remove the clientca= option to disable client certificates. 2024/04/04 09:46:04| Current Directory is /usr/local/www 2024/04/04 09:46:09| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0) 2024/04/04 09:46:09| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:46:09| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| Starting Authentication on port 127.0.0.1:3128 2024/04/04 09:46:09| Disabling Authentication on port 127.0.0.1:3128 (interception enabled) 2024/04/04 09:46:09| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:46:09| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| Starting Authentication on port 127.0.0.1:3129 2024/04/04 09:46:09| Disabling Authentication on port 127.0.0.1:3129 (interception enabled) 2024/04/04 09:46:09| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead. 2024/04/04 09:46:09| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| ERROR: Directive 'dns_v4_first' is obsolete. 2024/04/04 09:46:09| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records. 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| SECURITY WARNING: Peer certificates are not verified for validity! 2024/04/04 09:46:09| WARNING: UPGRADE: The DONT_VERIFY_PEER flag is deprecated. Remove the clientca= option to disable client certificates. 2024/04/04 09:46:12| Current Directory is /usr/local/www ipcrm: msqid(196609): : Invalid argument'

config used:

# This file is automatically generated by pfSense
# Do not edit manually !

http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE

icp_port 0
digest_generation off
dns_v4_first on
pid_filename /var/run/squid/squid.pid
cache_effective_user squid
cache_effective_group proxy
error_default_language en
icon_directory /usr/local/etc/squid/icons
visible_hostname Lee_Family.home.arpa
cache_mgr jonathanlee571@gmail.com
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable on
pinger_program /usr/local/libexec/squid/pinger
sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
tls_outgoing_options capath=/usr/local/share/certs/
tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
tls_outgoing_options flags=DONT_VERIFY_PEER
sslcrtd_children 10

logfile_rotate 0
debug_options rotate=0
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  192.168.1.0/27
forwarded_for transparent
httpd_suppress_version_string on
uri_whitespace strip

acl getmethod method GET

acl windowsupdate dstdomain windowsupdate.microsoft.com
acl windowsupdate dstdomain .update.microsoft.com
acl windowsupdate dstdomain download.windowsupdate.com
acl windowsupdate dstdomain redir.metaservices.microsoft.com
acl windowsupdate dstdomain images.metaservices.microsoft.com
acl windowsupdate dstdomain c.microsoft.com
acl windowsupdate dstdomain www.download.windowsupdate.com
acl windowsupdate dstdomain wustat.windows.com
acl windowsupdate dstdomain crl.microsoft.com
acl windowsupdate dstdomain sls.microsoft.com
acl windowsupdate dstdomain productactivation.one.microsoft.com
acl windowsupdate dstdomain ntservicepack.microsoft.com
acl windowsupdate dstdomain dc1-st.ksn.kaspersky-labs.com
acl windowsupdate dstdomain dc1-file.ksn.kaspersky-labs.com
acl windowsupdate dstdomain dc1.ksn.kaspersky-labs.com

acl rewritedoms dstdomain .facebook.com .akamaihd.net .fbcdn.net .google.com .static.com .apple.com .oracle.com .sun.com .java.com .adobe.com .steamstatic.com .steampowered.com .steamcontent.com .google.com

store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt
store_id_children 10 startup=5 idle=1 concurrency=0
always_direct allow !getmethod
store_id_access deny connect
store_id_access deny !getmethod
store_id_access allow rewritedoms
#reload_into_ims on
max_stale 20 years
minimum_expiry_time 0


refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth

#APPLE STUFF
refresh_pattern -i apple.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200  refresh-ims

#apple update
refresh_pattern -i (download|adcdownload).apple.com/.*.(pkg|dmg) 4320 100% 43200 
refresh_pattern -i appldnld.apple.com 129600 100% 129600     
refresh_pattern -i phobos.apple.com 129600 100% 129600     
refresh_pattern -i iosapps.itunes.apple.com 129600 100% 129600     

# Updates: Windows
refresh_pattern -i microsoft.com/..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200  refresh-ims
refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200  refresh-ims
refresh_pattern -i windows.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200  refresh-ims
refresh_pattern -i microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 
refresh_pattern -i windowsupdate.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 
refresh_pattern -i windows.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 
refresh_pattern -i .*windowsupdate.com/.*.(cab|exe) 259200 100% 259200   
refresh_pattern -i .*update.microsoft.com/.*.(cab|exe|dll|msi|psf) 259200 100% 259200   
refresh_pattern windowsupdate.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 
refresh_pattern download.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 
refresh_pattern www.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 
refresh_pattern au.download.windowsupdate.com/.*.(cab|exe|dll|msi|psf) 4320 100% 43200 
refresh_pattern bg.v4.pr.dl.ws.microsoft.com/.*.(cab|exe|dll|msi|psf) 4320 100% 43200
#windows update NEW UPDATE 0.04
refresh_pattern update.microsoft.com/.*.(cab|exe) 43200 100% 129600    
refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/.*.(cab|exe|msi|msp|psf) 4320 100% 43200  
refresh_pattern update.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 
refresh_pattern -i .update.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600       
refresh_pattern -i .windowsupdate.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600       
refresh_pattern -i .download.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600       
refresh_pattern -i .ws.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600       

refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
refresh_pattern ([^.]+.)?.akamai.steamstatic.com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod

refresh_pattern -i ([^.]+.)?.adobe.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
refresh_pattern -i ([^.]+.)?.java.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
refresh_pattern -i ([^.]+.)?.sun.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
refresh_pattern -i ([^.]+.)?.oracle.com/.*.(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod

refresh_pattern -i appldnld.apple.com 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
refresh_pattern -i ([^.]+.)?apple.com/.*.(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
 
refresh_pattern -i ([^.]+.)?.google.com/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
refresh_pattern -i ([^.]+.)?g.static.com/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private

#FACEBOOK
refresh_pattern ^http?://*.facebook.com/*  10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private

#FACEBOOK IMAGES  
refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js)  10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private   
refresh_pattern -i (facebook.com).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 
refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
refresh_pattern ^https?://profile.ak.fbcdn.net*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private

#FACEBOOK VIDEO
refresh_pattern -i .video.ak.fbcdn.net.*.(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private   
refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private


range_offset_limit 512 MB windowsupdate
maximum_object_size 512 MB windowsupdate
range_offset_limit 0
quick_abort_min -1 KB

cache_mem 64 MB
maximum_object_size_in_memory 256 KB
memory_replacement_policy heap LFUDA
cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
maximum_object_size 4 MB
cache_dir diskd /var/squid/cache 64000 256 256
offline_mode off
cache_swap_low 90
cache_swap_high 95
acl donotcache dstdomain '/var/squid/acl/donotcache.acl'
cache deny donotcache
cache allow all
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:    1440  20%  10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|?) 0  0%  0
refresh_pattern .    0  20%  4320


#Remote proxies


# Setup some default acls
# ACLs all, manager, localhost, and to_localhost are predefined.
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535 
acl sslports port 443 563 8080 5223 2197

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS

# SslBump Peek and Splice
# http://wiki.squid-cache.org/Features/SslPeekAndSplice
# http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
# Match against the current step during ssl_bump evaluation [fast]
# Never matches and should not be used outside the ssl_bump context.
#
# At each SslBump step, Squid evaluates ssl_bump directives to find
# the next bumping action (e.g., peek or splice). Valid SslBump step
# values and the corresponding ssl_bump evaluation moments are:
#   SslBump1: After getting TCP-level and HTTP CONNECT info.
#   SslBump2: After getting TLS Client Hello info.
#   SslBump3: After getting TLS Server Hello info.
# These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
# they can be used there for custom configuration.
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
acl banned_hosts src '/var/squid/acl/banned_hosts.acl'
acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl'
acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl'
http_access allow manager localhost

# Allow external cache managers
acl ext_manager src 192.168.1.1
acl ext_manager src 127.0.0.1
http_access allow manager ext_manager

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 95
request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings

deny_info TCP_RESET allsrc

# Package Integration
url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
url_rewrite_bypass off
url_rewrite_children 32 startup=8 idle=4 concurrency=0

# Custom options before auth
#host_verify_strict on

# These hosts are banned
http_access deny banned_hosts
# Always allow access to whitelist domains
http_access allow whitelist
# Block access to blacklist domains
http_access deny blacklist
# List of domains allowed to logging in to Google services
request_header_access X-GoogApps-Allowed-Domains deny all
request_header_add X-GoogApps-Allowed-Domains consumer_accounts
# Set YouTube safesearch restriction
acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com
request_header_access YouTube-Restrict deny all
request_header_add YouTube-Restrict none youtubedst
acl sglog url_regex -i sgr=ACCESSDENIED
http_access deny sglog
# Custom SSL/MITM options before auth
acl localhost src 192.168.1.1/32
#cachemgr_passwd disable offline_toggle reconfigure shutdown
#cachemgr_passwd classified all
acl https_login url_regex -i ^https.*(login|Login).*
acl no_miss url_regex -i gateway.facebook.com/ws/realtime?
acl no_miss url_regex -i web-chat-e2ee.facebook.com/ws/chat	
acl CONNECT method CONNECT
acl wuCONNECT dstdomain www.update.microsoft.com
acl wuCONNECT dstdomain sls.microsoft.com
http_access allow CONNECT wuCONNECT localnet
http_access allow CONNECT wuCONNECT localhost
http_access allow windowsupdate localnet
http_access allow windowsupdate localhost

acl BrokenButTrustedServers dstdomain '/usr/local/pkg/dstdom.broken'
acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH
sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch
sslproxy_cert_error deny all

acl splice_only src 192.168.1.8 #Tasha iPhone
acl splice_only src 192.168.1.10 #Jon iPhone
acl splice_only src 192.168.1.11 #Amazon Fire
acl splice_only src 192.168.1.15 #Tasha HP
acl splice_only src 192.168.1.16 #iPad

acl NoSSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.nobump'

acl markBumped annotate_client bumped=true
acl bump_only src 192.168.1.3 #webtv
acl bump_only src 192.168.1.4 #toshiba
acl bump_only src 192.168.1.5 #imac
acl bump_only src 192.168.1.9 #macbook
acl bump_only src 192.168.1.13 #dell

#cache deny https_login

ssl_bump peek step1
miss_access deny no_miss 
ssl_bump splice https_login
ssl_bump splice splice_only
ssl_bump splice NoSSLIntercept
ssl_bump bump bump_only markBumped
ssl_bump stare all

acl markedBumped note bumped true
url_rewrite_access deny markedBumped

#read_ahead_gap 32 KB
negative_ttl 1 second
connect_timeout 30 seconds
request_timeout 60 seconds
half_closed_clients off
shutdown_lifetime 10 seconds
negative_dns_ttl 1 seconds
ignore_unknown_nameservers on
pipeline_prefetch 100

#acl SSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.bump'
#ssl_bump bump SSLIntercept

# Setup allowed ACLs
# Allow local network(s) on interface(s)
http_access allow localnet
# Default block all to be sure
http_access deny allsrc

JonathanLee

Squid 6.6 installed and running and blocking and caching

Screenshot 2024-04-04 090152.png

I am seeing some random errors in squid 6. something new called KICK again I am using a custom config here is a copy of it for dev team if needed or looking for stuff to check out. It looks to be password locked for the status page something I did I am sure.

Screenshot 2024-04-04 091113.png

JonathanLee

Do users need new ssl certs?

JonathanLee

I changed the cafile to tls-cafile and it acts like it needs a new tls certificate and not the ssl version. Again it is working, I can not access the status page it has not been configured to allow access it looks locked out. The error states http_access manager is built in and to delete that line. It works great just looks like it needs some small config changes to work with the new version. Again it wants tls-cafile= now and not cafile

JonathanLee

The new 6.6 squid wants TLS certificates, can pfSense generate a TLS cert as a CA?

JonathanLee

Per squid support Jeffries Amos,

“…there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4.” …

“Squidguard is very outdated. You should upgrade to its successor ufdbguard if possible.”

JonathanLee

2024/04/05 07:58:24| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0)
2024/04/05 07:58:24| Processing: http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096'
OpenSSL-saved error #1: 0x1e08010c
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
2024/04/05 07:58:24| Processing: http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
2024/04/05 07:58:24| Starting Authentication on port 127.0.0.1:3128
2024/04/05 07:58:24| Disabling Authentication on port 127.0.0.1:3128 (interception enabled)
2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096'
OpenSSL-saved error #1: 0x1e08010c
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
2024/04/05 07:58:24| Processing: https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
2024/04/05 07:58:24| Starting Authentication on port 127.0.0.1:3129
2024/04/05 07:58:24| Disabling Authentication on port 127.0.0.1:3129 (interception enabled)
2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.
2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096'
OpenSSL-saved error #1: 0x1e08010c
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
2024/04/05 07:58:24| Processing: icp_port 0
2024/04/05 07:58:25| Processing: digest_generation off
2024/04/05 07:58:25| Processing: dns_v4_first on
2024/04/05 07:58:25| ERROR: Directive 'dns_v4_first' is obsolete.
2024/04/05 07:58:25| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records.
2024/04/05 07:58:25| Processing: pid_filename /var/run/squid/squid.pid
2024/04/05 07:58:25| Processing: cache_effective_user squid
2024/04/05 07:58:25| Processing: cache_effective_group proxy
2024/04/05 07:58:25| Processing: error_default_language en
2024/04/05 07:58:25| Processing: icon_directory /usr/local/etc/squid/icons
2024/04/05 07:58:25| Processing: visible_hostname Lee_Family.home.arpa
2024/04/05 07:58:25| Processing: cache_mgr jonathanlee571@gmail.com
2024/04/05 07:58:25| Processing: access_log /var/squid/logs/access.log
2024/04/05 07:58:25| Processing: cache_log /var/squid/logs/cache.log
2024/04/05 07:58:25| Processing: cache_store_log none
2024/04/05 07:58:25| Processing: netdb_filename /var/squid/logs/netdb.state
2024/04/05 07:58:25| Processing: pinger_enable on
2024/04/05 07:58:25| Processing: pinger_program /usr/local/libexec/squid/pinger
2024/04/05 07:58:25| Processing: sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
2024/04/05 07:58:25| Processing: tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
2024/04/05 07:58:25| Processing: tls_outgoing_options capath=/usr/local/share/certs/
2024/04/05 07:58:25| Processing: tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
2024/04/05 07:58:25| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:25| ERROR: Unsupported TLS option SINGLE_ECDH_USE
2024/04/05 07:58:25| Processing: tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
2024/04/05 07:58:25| Processing: sslcrtd_children 10
2024/04/05 07:58:25| Processing: logfile_rotate 0
2024/04/05 07:58:25| Processing: debug_options rotate=0
2024/04/05 07:58:25| Processing: shutdown_lifetime 3 seconds
2024/04/05 07:58:25| Processing: acl localnet src 192.168.1.0/27
2024/04/05 07:58:25| Processing: forwarded_for transparent
2024/04/05 07:58:25| Processing: httpd_suppress_version_string on
2024/04/05 07:58:25| Processing: uri_whitespace strip
2024/04/05 07:58:25| Processing: acl getmethod method GET
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain windowsupdate.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain .update.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain download.windowsupdate.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain redir.metaservices.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain images.metaservices.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain c.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain www.download.windowsupdate.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain wustat.windows.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain crl.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain sls.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain productactivation.one.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain ntservicepack.microsoft.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1-st.ksn.kaspersky-labs.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1-file.ksn.kaspersky-labs.com
2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1.ksn.kaspersky-labs.com
2024/04/05 07:58:25| Processing: acl rewritedoms dstdomain .facebook.com .akamaihd.net .fbcdn.net .google.com .static.com .apple.com .oracle.com .sun.com .java.com .adobe.com .steamstatic.com .steampowered.com .steamcontent.com .google.com
2024/04/05 07:58:25| Processing: store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt
2024/04/05 07:58:25| Processing: store_id_children 10 startup=5 idle=1 concurrency=0
2024/04/05 07:58:25| Processing: always_direct allow !getmethod
2024/04/05 07:58:25| Processing: store_id_access deny connect
2024/04/05 07:58:25| Processing: store_id_access deny !getmethod
2024/04/05 07:58:25| Processing: store_id_access allow rewritedoms
2024/04/05 07:58:25| Processing: reload_into_ims on
2024/04/05 07:58:25| Processing: max_stale 20 years
2024/04/05 07:58:25| Processing: minimum_expiry_time 0
2024/04/05 07:58:25| Processing: refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-must-revalidate' is obsolete. Remove it.
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-auth' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern -i apple.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims
2024/04/05 07:58:25| Processing: refresh_pattern -i (download|adcdownload).apple.com/..(pkg|dmg) 4320 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern -i appldnld.apple.com 129600 100% 129600
2024/04/05 07:58:25| Processing: refresh_pattern -i phobos.apple.com 129600 100% 129600
2024/04/05 07:58:25| Processing: refresh_pattern -i iosapps.itunes.apple.com 129600 100% 129600
2024/04/05 07:58:25| Processing: refresh_pattern -i microsoft.com/..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims
2024/04/05 07:58:25| Processing: refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims
2024/04/05 07:58:25| Processing: refresh_pattern -i windows.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims
2024/04/05 07:58:25| Processing: refresh_pattern -i microsoft.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
2024/04/05 07:58:25| Processing: refresh_pattern -i windowsupdate.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
2024/04/05 07:58:25| Processing: refresh_pattern -i windows.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
2024/04/05 07:58:25| Processing: refresh_pattern -i .windowsupdate.com/..(cab|exe) 259200 100% 259200
2024/04/05 07:58:25| Processing: refresh_pattern -i .update.microsoft.com/..(cab|exe|dll|msi|psf) 259200 100% 259200
2024/04/05 07:58:25| Processing: refresh_pattern windowsupdate.com/..(cab|exe|dll|msi|psf) 10080 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern download.microsoft.com/..(cab|exe|dll|msi|psf) 10080 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern www.microsoft.com/..(cab|exe|dll|msi|psf) 10080 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern au.download.windowsupdate.com/..(cab|exe|dll|msi|psf) 4320 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern bg.v4.pr.dl.ws.microsoft.com/..(cab|exe|dll|msi|psf) 4320 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern update.microsoft.com/..(cab|exe) 43200 100% 129600
2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/..(cab|exe|msi|msp|psf) 4320 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern update.microsoft.com/..(cab|exe|dll|msi|psf) 10080 100% 43200
2024/04/05 07:58:25| Processing: refresh_pattern -i .update.microsoft.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
2024/04/05 07:58:25| Processing: refresh_pattern -i .windowsupdate.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
2024/04/05 07:58:25| Processing: refresh_pattern -i .download.microsoft.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
2024/04/05 07:58:25| Processing: refresh_pattern -i .ws.microsoft.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.. 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+.)?.akamai.steamstatic.com/.. 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.adobe.com/..(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.java.com/..(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.sun.com/..(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.oracle.com/..(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i appldnld.apple.com 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?apple.com/..(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.google.com/..(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?g.static.com/..(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern ^http?://.facebook.com/* 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern -i (facebook.com).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern ^https?://profile.ak.fbcdn.net*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern -i .video.ak.fbcdn.net..(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
2024/04/05 07:58:25| Processing: acl https_login url_regex -i ^https.(login|Login).*
2024/04/05 07:58:25| Processing: cache deny https_login
2024/04/05 07:58:25| Processing: range_offset_limit 512 MB windowsupdate
2024/04/05 07:58:25| Processing: range_offset_limit 0
2024/04/05 07:58:25| Processing: quick_abort_min -1 KB
2024/04/05 07:58:25| Processing: cache_mem 64 MB
2024/04/05 07:58:25| Processing: maximum_object_size_in_memory 256 KB
2024/04/05 07:58:25| Processing: memory_replacement_policy heap LFUDA
2024/04/05 07:58:25| Processing: cache_replacement_policy heap LFUDA
2024/04/05 07:58:25| Processing: minimum_object_size 0 KB
2024/04/05 07:58:25| Processing: maximum_object_size 512 MB
2024/04/05 07:58:25| Processing: cache_dir diskd /var/squid/cache 64000 256 256
2024/04/05 07:58:25| Processing: offline_mode off
2024/04/05 07:58:25| Processing: cache_swap_low 90
2024/04/05 07:58:25| Processing: cache_swap_high 95
2024/04/05 07:58:25| Processing: acl donotcache dstdomain "/var/squid/acl/donotcache.acl"
2024/04/05 07:58:25| Processing: cache deny donotcache
2024/04/05 07:58:25| Processing: cache allow all
2024/04/05 07:58:25| Processing: refresh_pattern ^ftp: 1440 20% 10080
2024/04/05 07:58:25| Processing: refresh_pattern ^gopher: 1440 0% 1440
2024/04/05 07:58:25| Processing: refresh_pattern -i (/cgi-bin/|?) 0 0% 0
2024/04/05 07:58:25| Processing: refresh_pattern . 0 20% 4320
2024/04/05 07:58:25| Processing: acl allsrc src all
2024/04/05 07:58:25| Processing: acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535
2024/04/05 07:58:25| Processing: acl sslports port 443 563 8080 5223 2197
2024/04/05 07:58:25| Processing: acl purge method PURGE
2024/04/05 07:58:25| Processing: acl connect method CONNECT
2024/04/05 07:58:25| Processing: acl HTTP proto HTTP
2024/04/05 07:58:25| Processing: acl HTTPS proto HTTPS
2024/04/05 07:58:25| Processing: acl step1 at_step SslBump1
2024/04/05 07:58:25| Processing: acl step2 at_step SslBump2
2024/04/05 07:58:25| Processing: acl step3 at_step SslBump3
2024/04/05 07:58:25| Processing: acl banned_hosts src "/var/squid/acl/banned_hosts.acl"
2024/04/05 07:58:25| Processing: acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
2024/04/05 07:58:25| Processing: acl blacklist dstdom_regex -i "/var/squid/acl/blacklist.acl"
2024/04/05 07:58:25| Processing: http_access allow manager localhost
2024/04/05 07:58:25| Processing: acl ext_manager src 192.168.1.1
2024/04/05 07:58:25| Processing: acl ext_manager src 127.0.0.1
2024/04/05 07:58:25| Processing: http_access allow manager ext_manager
2024/04/05 07:58:25| Processing: http_access deny manager
2024/04/05 07:58:25| Processing: http_access allow purge localhost
2024/04/05 07:58:25| Processing: http_access deny purge
2024/04/05 07:58:25| Processing: http_access deny !safeports
2024/04/05 07:58:25| Processing: http_access deny CONNECT !sslports
2024/04/05 07:58:25| Processing: http_access allow localhost
2024/04/05 07:58:25| Processing: quick_abort_min 0 KB
2024/04/05 07:58:25| Processing: quick_abort_max 0 KB
2024/04/05 07:58:25| Processing: quick_abort_pct 95
2024/04/05 07:58:25| Processing: request_body_max_size 0 KB
2024/04/05 07:58:25| Processing: delay_pools 1
2024/04/05 07:58:25| Processing: delay_class 1 2
2024/04/05 07:58:25| Processing: delay_parameters 1 -1/-1 -1/-1
2024/04/05 07:58:25| Processing: delay_initial_bucket_level 100
2024/04/05 07:58:25| Processing: delay_access 1 allow allsrc
2024/04/05 07:58:25| Processing: deny_info TCP_RESET allsrc
2024/04/05 07:58:25| Processing: url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
2024/04/05 07:58:25| Processing: url_rewrite_bypass off
2024/04/05 07:58:25| Processing: url_rewrite_children 32 startup=8 idle=4 concurrency=0
2024/04/05 07:58:25| Processing: http_access deny banned_hosts
2024/04/05 07:58:25| Processing: http_access allow whitelist
2024/04/05 07:58:25| Processing: http_access deny blacklist
2024/04/05 07:58:25| Processing: request_header_access X-GoogApps-Allowed-Domains deny all
2024/04/05 07:58:25| Processing: request_header_add X-GoogApps-Allowed-Domains consumer_accounts
2024/04/05 07:58:25| Processing: acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com
2024/04/05 07:58:25| Processing: request_header_access YouTube-Restrict deny all
2024/04/05 07:58:25| Processing: request_header_add YouTube-Restrict none youtubedst
2024/04/05 07:58:25| Processing: acl sglog url_regex -i sgr=ACCESSDENIED
2024/04/05 07:58:25| Processing: http_access deny sglog
2024/04/05 07:58:25| Processing: acl localhost src 192.168.1.1/32
2024/04/05 07:58:25| Processing: acl no_miss url_regex -i gateway.facebook.com/ws/realtime?
2024/04/05 07:58:25| Processing: acl no_miss url_regex -i web-chat-e2ee.facebook.com/ws/chat
2024/04/05 07:58:25| Processing: acl CONNECT method CONNECT
2024/04/05 07:58:25| Processing: acl wuCONNECT dstdomain www.update.microsoft.com
2024/04/05 07:58:25| Processing: acl wuCONNECT dstdomain sls.microsoft.com
2024/04/05 07:58:25| Processing: http_access allow CONNECT wuCONNECT localnet
2024/04/05 07:58:25| Processing: http_access allow CONNECT wuCONNECT localhost
2024/04/05 07:58:25| Processing: http_access allow windowsupdate localnet
2024/04/05 07:58:25| Processing: http_access allow windowsupdate localhost
2024/04/05 07:58:25| Processing: http_access deny manager
2024/04/05 07:58:25| Processing: acl BrokenButTrustedServers dstdomain "/usr/local/pkg/dstdom.broken"
2024/04/05 07:58:25| Processing: acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH
2024/04/05 07:58:25| Processing: sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch
2024/04/05 07:58:25| Processing: sslproxy_cert_error deny all
2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.8 #Tasha iPhone
2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.10 #Jon iPhone
2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.11 #Amazon Fire
2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.15 #Tasha HP
2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.16 #iPad
2024/04/05 07:58:25| Processing: acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/url.nobump"
2024/04/05 07:58:25| /usr/local/etc/squid/squid.conf line 276: acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/url.nobump"
2024/04/05 07:58:25| WARNING: there are more than 100 regular expressions. Consider using less REs or use rules without expressions like 'dstdomain'.
2024/04/05 07:58:25| Processing: acl markBumped annotate_client bumped=true
2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.3 #webtv
2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.4 #toshiba
2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.5 #imac
2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.9 #macbook
2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.13 #dell
2024/04/05 07:58:25| Processing: ssl_bump peek step1
2024/04/05 07:58:25| Processing: miss_access deny no_miss
2024/04/05 07:58:25| Processing: ssl_bump splice https_login
2024/04/05 07:58:25| Processing: ssl_bump splice splice_only
2024/04/05 07:58:25| Processing: ssl_bump splice NoSSLIntercept
2024/04/05 07:58:25| Processing: ssl_bump bump bump_only markBumped
2024/04/05 07:58:25| Processing: ssl_bump stare all
2024/04/05 07:58:25| Processing: acl markedBumped note bumped true
2024/04/05 07:58:25| Processing: url_rewrite_access deny markedBumped
2024/04/05 07:58:25| Processing: http_access deny all
2024/04/05 07:58:25| Processing: read_ahead_gap 64 KB
2024/04/05 07:58:25| Processing: negative_ttl 1 second
2024/04/05 07:58:25| Processing: connect_timeout 30 seconds
2024/04/05 07:58:25| Processing: request_timeout 60 seconds
2024/04/05 07:58:25| Processing: half_closed_clients off
2024/04/05 07:58:25| Processing: shutdown_lifetime 10 seconds
2024/04/05 07:58:25| Processing: negative_dns_ttl 1 seconds
2024/04/05 07:58:25| Processing: ignore_unknown_nameservers on
2024/04/05 07:58:25| Processing: pipeline_prefetch 100
2024/04/05 07:58:25| Processing: http_access allow localnet
2024/04/05 07:58:25| Processing: http_access deny allsrc
2024/04/05 07:58:25| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP
2024/04/05 07:58:25| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP
2024/04/05 07:58:25| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP
2024/04/05 07:58:25| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP
2024/04/05 07:58:25| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP
2024/04/05 07:58:25| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP
2024/04/05 07:58:25| Requiring client certificates.
2024/04/05 07:58:25| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse
2024/04/05 07:58:26| Not requiring any client certificates
2024/04/05 07:58:26| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse
2024/04/05 07:58:26| Not requiring any client certificates
2024/04/05 07:58:26| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse
2024/04/05 07:58:27| Not requiring any client certificates

michmoor

@JonathanLee said in Squid 6.6 DEV 24 Issues:

“Squidguard is very outdated. You should upgrade to its successor ufdbguard if possible.”

Am i reading that correctly? Squidguard maintainer is saying to use a different project?
If so....umm...I think this closes out your issue then.
Also i have confirmed that there are no SG maintainers on the NetGate side.
So my friend that leaves you without package support from Netgate and without support from a maintainer.

JonathanLee

@michmoor I am sure google likes that unaccountability. This project has been around from the 90s and still is going, someone maintained it as it is now at 6.6. Marcus fixed squidguard a couple months ago too. I don’t understand the animosity towards it, it works better then DNS based systems, again google can hide lots with the dns versions.

JonathanLee

@michmoor what’s ufdbguard?

michmoor

@JonathanLee said in Squid 6.6 DEV 24 Issues:

ufdbguard

https://www.urlfilterdb.com/products/ufdbguard.html

JonathanLee

@michmoor
| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.

I am going to fix this in git hub if I can find the variable name this is a simple fix.

JonathanLee

Screenshot 2024-04-05 at 15.05.45.png

Found it I am going to submit a commit to the package to fix this error it was listed in the older version also however the logs were disabled for it and it would only show up when you ran

squid -k parse

JonathanLee

@JonathanLee said in Squid 6.6 DEV 24 Issues:

| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.

Screenshot 2024-04-05 at 15.10.29.png

JonathanLee

Nope that didn't fix it Screenshot 2024-04-05 at 15.14.47.png

JonathanLee

Screenshot 2024-04-05 at 15.19.35.png

I found the error for the tis-cafile that fixed some of the errors. I am going to resubmit the changes

JonathanLee

@JonathanLee said in Squid 6.6 DEV 24 Issues:

2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.

Screenshot 2024-04-05 at 15.22.53.png

This fixed the

2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.

One error gone 1
Screenshot 2024-04-05 at 16.00.22.png

JonathanLee

If anyone wants to let me know what part of the cipher should be removed please let me know so I can fix the RC4 issue.

https://github.com/pfsense/FreeBSD-ports/pull/1365

Working on this also Per Squid support Amos Jeffries

"Also there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4."

Are we to disable RC4 because of the security issues? Or are we leaving it it has both listed.

if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) {
					// Modern cipher suites
					$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS";
					$sslproxy_options .= ",NO_TLSv1";
				} else {
					$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";
				}

JonathanLee

FIX ME
line of code 1261 in /usr/local/pkg/squid.inc
FIX ME
line of code 1235-1241 in usr/local/pkg/squid.inc

JonathanLee

@JonathanLee

https://github.com/pfsense/FreeBSD-ports/pull/1366

Fix for non support

2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE