pfSense » pfSense Packages

Looks like Clamav is the issue, once I disable this services, the error is gone.

This is my config file:

cat /usr/local/etc/squid/squid.conf

1. This file is automatically generated by pfSense
2. Do not edit manually !

http_port 192.168.9.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE

icp_port 0
digest_generation off
dns_v4_first off
pid_filename /var/run/squid/squid.pid
cache_effective_user squid
cache_effective_group proxy
error_default_language en
icon_directory /usr/local/etc/squid/icons
visible_hostname fwbos.bajaopensolutions.com
cache_mgr webmaster@bajaopensolutions.com
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable off
pinger_program /usr/local/libexec/squid/pinger
sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
tls_outgoing_options capath=/usr/local/share/certs/
tls_outgoing_options options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS
tls_outgoing_options flags=DONT_VERIFY_PEER
sslcrtd_children 5
sslproxy_cert_error allow all
sslproxy_cert_adapt setValidAfter all
sslproxy_cert_adapt setValidBefore all
sslproxy_cert_adapt setCommonName all

logfile_rotate 10
debug_options rotate=10
shutdown_lifetime 3 seconds

1. Allow local network(s) on interface(s)
   acl localnet src 192.168.9.0/24
   forwarded_for on
   httpd_suppress_version_string on
   uri_whitespace strip

cache_mem 1024 MB
maximum_object_size_in_memory 256 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
maximum_object_size 4 MB
cache_dir aufs /var/squid/cache 4096 16 256
offline_mode off
cache_swap_low 96
cache_swap_high 98
cache allow all

1. Add any of your own refresh_pattern entries above these.
   refresh_pattern ^ftp: 1440 20% 10080
   refresh_pattern ^gopher: 1440 0% 1440
   refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
   refresh_pattern . 0 20% 4320

#Remote proxies

1. Setup some default acls
2. ACLs all, manager, localhost, and to_localhost are predefined.
   acl allsrc src all
   acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 3129 1025-65535
   acl sslports port 443 563

acl purge method PURGE
acl connect method CONNECT

1. Define protocols used for redirects
   acl HTTP proto HTTP
   acl HTTPS proto HTTPS

1. SslBump Peek and Splice
2. http://wiki.squid-cache.org/Features/SslPeekAndSplice
3. http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
4. Match against the current step during ssl_bump evaluation [fast]
5. Never matches and should not be used outside the ssl_bump context. #
6. At each SslBump step, Squid evaluates ssl_bump directives to find
7. the next bumping action (e.g., peek or splice). Valid SslBump step
8. values and the corresponding ssl_bump evaluation moments are:
9. SslBump1: After getting TCP-level and HTTP CONNECT info.
10. SslBump2: After getting TLS Client Hello info.
11. SslBump3: After getting TLS Server Hello info.
12. These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
13. they can be used there for custom configuration.
    acl step1 at_step SslBump1
    acl step2 at_step SslBump2
    acl step3 at_step SslBump3
    http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

1. Always allow localhost connections
   http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

1. Reverse Proxy settings

1. Package Integration
   url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
   url_rewrite_bypass off
   url_rewrite_children 16 startup=8 idle=4 concurrency=0

1. Custom options before auth

acl sglog url_regex -i sgr=ACCESSDENIED
http_access deny sglog
ssl_bump peek step1
ssl_bump splice all

1. Setup allowed ACLs
2. Allow local network(s) on interface(s)
   http_access allow localnet
3. Default block all to be sure
   http_access deny allsrc

icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_encode off
icap_client_username_header X-Authenticated-User
icap_preview_enable on
icap_preview_size 1024

icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squid_clamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squid_clamav bypass=on
adaptation_access service_avi_resp allow all

Duplicate of https://redmine.pfsense.org/issues/13984

Missing Squid Reverse config values.