Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid V6.10

    Scheduled Pinned Locked Moved
    Cache/Proxy
    squid squid-proxy squid update
    9
    32
    1.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ
      JonathanLee @FoolCoconut
      last edited by

      @FoolCoconut No. I have an Advanced ARM processor. You remember Cirix processors?

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • JonathanLeeJ
        JonathanLee @Nafryti
        last edited by

        Dang, the updated one fixed all the security issues but the GUI has some small issues

        Make sure to upvote

        1 Reply Last reply Reply Quote 0
        • N
          Nafryti
          last edited by

          Well, I have a lot to do and sort out sometime soon, and I've been procrastinating for far too long. I still have not been able to get a new Skunkworks loaded yet, I've got to reorganize components, and then I'll be able to finally start testing again.

          My wish for 6.10 to finally be reevaluated by NG hasn't changed, I haven't looked, but I know from experience how stubborn some devs can be over things.

          There was and imho still is a demand for such a caching service, not everyone has a completely separate machine to cache downloads to, but when you DIY a router, with a 1TB HDD and run the OS on the RAM, then you honestly have the freedom to setup something like that, but only if there isn't any complacency.

          1 Reply Last reply Reply Quote 0
          • I
            ICS_DOS
            last edited by

            Now that the Vulnerabilities are fixed Upstream, I see no reason why this Package is still deprecated. I would love to deploy it for my Customers but can't reasonably do so :(

            M 1 Reply Last reply Reply Quote 2
            • M
              michmoor LAYER 8 Rebel Alliance @ICS_DOS
              last edited by

              @ICS_DOS Outside of the vulns found and/or fixed there is still the fact that there is no maintainer for Squid for pfsense. There is a lot wrong with the package and unless someone steps up and volunteers their time to fix all the glaring problems i see no reason why netgate would still have this package in the repo.

              Firewall: NetGate,Palo Alto-VM,Juniper SRX
              Routing: Juniper, Arista, Cisco
              Switching: Juniper, Arista, Cisco
              Wireless: Unifi, Aruba IAP
              JNCIP,CCNP Enterprise

              N 2 Replies Last reply Reply Quote 0
              • N
                Nafryti @michmoor
                last edited by

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • N
                  Nafryti @michmoor
                  last edited by Nafryti

                  @michmoor said in Squid V6.10:

                  "still the fact that there is no maintainer for Squid for pfsense."

                  That's not true at all, there is someone from NG (at least that's my understanding of the name: "marcos-ng") updating the repo.

                  e478b5e8-932c-49fd-b5b3-92dca206b38b-image.png

                  @michmoor what problems, if you don't mind my asking?

                  M 1 Reply Last reply Reply Quote 0
                  • JonathanLeeJ
                    JonathanLee
                    last edited by

                    I do not think that he still uses this package anymore for a while. I would search out others for help.

                    Make sure to upvote

                    1 Reply Last reply Reply Quote 0
                    • M
                      michmoor LAYER 8 Rebel Alliance @Nafryti
                      last edited by

                      @Nafryti Yes there were commits done but that does not mean there are maintainers. I repeat there are no volunteers maintaining this package on pfsense.
                      Read the redmine notes regarding those Git commits. Its clearly stated by the engineer who pushed the PR that Squid is going away.

                      One of the biggest issues is that transparent mode is useless and broken. That alone makes the package unusable for most.
                      https://redmine.pfsense.org/issues/14390

                      There are those in the forum who still use the package daily like @JonathanLee who is very active with it and probably is a good resource for all things Squid on pfsense.

                      Firewall: NetGate,Palo Alto-VM,Juniper SRX
                      Routing: Juniper, Arista, Cisco
                      Switching: Juniper, Arista, Cisco
                      Wireless: Unifi, Aruba IAP
                      JNCIP,CCNP Enterprise

                      1 Reply Last reply Reply Quote 0
                      • JonathanLeeJ
                        JonathanLee
                        last edited by

                        Squid itself has been updated with many of the fixes per this email.

                        Just got an update on Squid working on bug fixes. Looks like 7 is the version that mitigates most of all of them.

                        "The Squid Project apologizes for being late in responding to the
                        publication of 55 vulnerabilities disclosed by Joshua Rogers of Opera Software
                        at https://megamansec.github.io/Squid-Security-Audit/

                        We thank Joshua for discovering these bugs and sharing their details with us.
                        The surprise publication caught us off guard, but Squid
                        developers had worked on addressing some of the disclosed vulnerabilities
                        since before that publication. This message summarizes Squid's status on
                        October 9th, 2024.

                        As of Squid v6.8, the vast majority of high-impact vulnerabilities have been
                        addressed. The following disclosed vulnerabilities are still present:

                        Vulnerability “strlen(NULL) Crash Using Digest Authentication”
                        This vulnerability is still present in Squid v6.11. A fix is expected in Squid
                        v6.12, due any day now.
                        Digest authentication is disabled by default; the current workaround is
                        to avoid Digest authentication.

                        To verify whether your Squid configuration is vulnerable, check whether it
                        contains "auth_param” directive. Configurations with auth_param directives
                        mentioning "digest" scheme may be vulnerable.

                        pipeline_prefetch (HTTP pipelining of client-to-Squid requests)
                        All reported pipelining-related vulnerabilities may still be present in Squid
                        v6. Pipelining code will probably be removed in master branch and become
                        unavailable in Squid v7. Pipelining is disabled by default.

                        If you do not need pipelining (or do not know for sure that you need it), do
                        not enable that performance optimization.

                        To verify whether your Squid configuration is vulnerable, check whether it
                        contains a pipeline_prefetch directive. Configurations containing a
                        pipeline_prefetch directive set to a positive value may be vulnerable.

                        ESI (Edge Side Includes)
                        Most reported ESI-related vulnerabilities are still present in Squid v6. ESI
                        code has been removed in the master branch and will not be available
                        in Squid v7.
                        ESI is disabled in the default build starting with Squid v6.10. In earlier
                        versions, ESI code is enabled by default, but the risk is moderate because
                        exploiting this family of vulnerabilities requires Squid to be
                        configured as a reverse proxy for a malicious origin server.

                        If you do not need ESI (or do not know whether you need it), disable it with
                        --disable-esi (default for Squid v6.10 and later).

                        To verify whether your Squid build is vulnerable, run squid -v. Squid v6.9
                        and earlier versions may be vulnerable unless the output contains
                        --disable-esi. Squid v6.10 and later versions may be vulnerable if the
                        output contains --enable-esi.

                        Squid v5
                        Some fixes were backported to Squid v5, but we lack the resources necessary to
                        support that old version. Folks running Squid v5 and earlier versions should
                        either upgrade to the latest v6 release or rely on their
                        integrator/distributor for support.

                        --
                        Francesco Chemolli
                        Squid Software Foundation

                        squid-users mailing list
                        squid-users@lists.squid-cache.org
                        https://lists.squid-cache.org/listinfo/squid-users"

                        Version 7 is where most almost all of the issues are resolved with. Again some changes were made that would require a Netgate php-software used to configure Squid to Squid software convergence test and tune up. I love Squid it is like a swiss army knife.

                        Make sure to upvote

                        N 1 Reply Last reply Reply Quote 2
                        • N
                          Nafryti @JonathanLee
                          last edited by

                          @JonathanLee I see all these updates, all this work going on for Squid, and everyone saying it's either "useless" or "still full of vulnerabilities" what is going on here?

                          Is there some kind of secret here? What's up, I get that months ago it was exposed for vulnerabilities and then what happened? did these people just pull the wool over their eyes and say "oh well, it'll never be fixed." and no matter what Squid Devs do it's all in vain due to the lack of vision?

                          If not with Squid, then what can I use to Download Cache Steam downloads?

                          JonathanLeeJ A 2 Replies Last reply Reply Quote 0
                          • JonathanLeeJ
                            JonathanLee @Nafryti
                            last edited by JonathanLee

                            @Nafryti we can hope they fix it. I do know Opensense has updated Squid and continues to support it last time I checked. So I do hope pfSense continues to support it. We know the vulnerabilities are fixed now so that should not be an issue anymore. I know it was still listed on the snapshots last time I checked. The php code does need some software convergence with the status pages etc now that vulnerabilities are mitigated.

                            Yes I hope it is updated soon. I am thankful it is still listed

                            Make sure to upvote

                            M 1 Reply Last reply Reply Quote 1
                            • M
                              michmoor LAYER 8 Rebel Alliance @JonathanLee
                              last edited by

                              @JonathanLee Curious. Does OPNsense Squid have the same problem with transparent proxy as pfsense or have the devs over there fixed it?

                              Firewall: NetGate,Palo Alto-VM,Juniper SRX
                              Routing: Juniper, Arista, Cisco
                              Switching: Juniper, Arista, Cisco
                              Wireless: Unifi, Aruba IAP
                              JNCIP,CCNP Enterprise

                              JonathanLeeJ P B 3 Replies Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee @michmoor
                                last edited by

                                @michmoor you know me PFS only

                                Make sure to upvote

                                1 Reply Last reply Reply Quote 1
                                • A
                                  aGeekhere @Nafryti
                                  last edited by aGeekhere

                                  @Nafryti said in Squid V6.10:

                                  then what can I use to Download Cache Steam downloads

                                  You can use lancache
                                  https://lancache.net/

                                  Never Fear, A Geek is Here!

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pfsjap @michmoor
                                    last edited by

                                    @michmoor Have considered, but not tried Squid in pfSense, what's the problem you referred to?

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bon-go @michmoor
                                      last edited by

                                      @michmoor
                                      Yes, it works for them, unfortunately only there :(

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post