Bug #15381
closedUpdate deprecated options
Added by Jonathan Lee 9 months ago. Updated 3 months ago.
0%
Description
Squid runs however lists the following errors in 24.03.b.20240322.1708 ShowHide
/status_services.php: The command '/usr/local/etc/rc.d/squid.sh stop' returned exit code '1', the output was '2024/04/04 09:45:59| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0) 2024/04/04 09:45:59| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:45:59| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| Starting Authentication on port 127.0.0.1:3128 2024/04/04 09:45:59| Disabling Authentication on port 127.0.0.1:3128 (interception enabled) 2024/04/04 09:45:59| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:45:59| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| Starting Authentication on port 127.0.0.1:3129 2024/04/04 09:45:59| Disabling Authentication on port 127.0.0.1:3129 (interception enabled) 2024/04/04 09:45:59| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead. 2024/04/04 09:45:59| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| ERROR: Directive 'dns_v4_first' is obsolete. 2024/04/04 09:45:59| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records. 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:45:59| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:45:59| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP 2024/04/04 09:45:59| SECURITY WARNING: Peer certificates are not verified for validity! 2024/04/04 09:45:59| WARNING: UPGRADE: The DONT_VERIFY_PEER flag is deprecated. Remove the clientca= option to disable client certificates. 2024/04/04 09:46:04| Current Directory is /usr/local/www 2024/04/04 09:46:09| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0) 2024/04/04 09:46:09| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:46:09| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| Starting Authentication on port 127.0.0.1:3128 2024/04/04 09:46:09| Disabling Authentication on port 127.0.0.1:3128 (interception enabled) 2024/04/04 09:46:09| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/04 09:46:09| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| Starting Authentication on port 127.0.0.1:3129 2024/04/04 09:46:09| Disabling Authentication on port 127.0.0.1:3129 (interception enabled) 2024/04/04 09:46:09| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead. 2024/04/04 09:46:09| WARNING: Failed to decode EC parameters '/etc/dh-parameters.2048' OpenSSL-saved error #1: 0x1e08010c 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| ERROR: Directive 'dns_v4_first' is obsolete. 2024/04/04 09:46:09| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records. 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/04 09:46:09| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/04 09:46:09| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP 2024/04/04 09:46:09| SECURITY WARNING: Peer certificates are not verified for validity! 2024/04/04 09:46:09| WARNING: UPGRADE: The DONT_VERIFY_PEER flag is deprecated. Remove the clientca= option to disable client certificates. 2024/04/04 09:46:12| Current Directory is /usr/local/www ipcrm: msqid(196609): : Invalid argument'
# This file is automatically generated by pfSense # Do not edit manually ! http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE icp_port 0 digest_generation off dns_v4_first on pid_filename /var/run/squid/squid.pid cache_effective_user squid cache_effective_group proxy error_default_language en icon_directory /usr/local/etc/squid/icons visible_hostname Lee_Family.home.arpa cache_mgr jonathanlee571@gmail.com access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log none netdb_filename /var/squid/logs/netdb.state pinger_enable on pinger_program /usr/local/libexec/squid/pinger sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048 tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt tls_outgoing_options capath=/usr/local/share/certs/ tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls_outgoing_options flags=DONT_VERIFY_PEER sslcrtd_children 10 logfile_rotate 0 debug_options rotate=0 shutdown_lifetime 3 seconds # Allow local network(s) on interface(s) acl localnet src 192.168.1.0/27 forwarded_for transparent httpd_suppress_version_string on uri_whitespace strip acl getmethod method GET acl windowsupdate dstdomain windowsupdate.microsoft.com acl windowsupdate dstdomain .update.microsoft.com acl windowsupdate dstdomain download.windowsupdate.com acl windowsupdate dstdomain redir.metaservices.microsoft.com acl windowsupdate dstdomain images.metaservices.microsoft.com acl windowsupdate dstdomain c.microsoft.com acl windowsupdate dstdomain www.download.windowsupdate.com acl windowsupdate dstdomain wustat.windows.com acl windowsupdate dstdomain crl.microsoft.com acl windowsupdate dstdomain sls.microsoft.com acl windowsupdate dstdomain productactivation.one.microsoft.com acl windowsupdate dstdomain ntservicepack.microsoft.com acl windowsupdate dstdomain dc1-st.ksn.kaspersky-labs.com acl windowsupdate dstdomain dc1-file.ksn.kaspersky-labs.com acl windowsupdate dstdomain dc1.ksn.kaspersky-labs.com acl rewritedoms dstdomain .facebook.com .akamaihd.net .fbcdn.net .google.com .static.com .apple.com .oracle.com .sun.com .java.com .adobe.com .steamstatic.com .steampowered.com .steamcontent.com .google.com store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt store_id_children 10 startup=5 idle=1 concurrency=0 always_direct allow !getmethod store_id_access deny connect store_id_access deny !getmethod store_id_access allow rewritedoms #reload_into_ims on max_stale 20 years minimum_expiry_time 0 refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth #APPLE STUFF refresh_pattern -i apple.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims #apple update refresh_pattern -i (download|adcdownload).apple.com/.*.(pkg|dmg) 4320 100% 43200 refresh_pattern -i appldnld.apple.com 129600 100% 129600 refresh_pattern -i phobos.apple.com 129600 100% 129600 refresh_pattern -i iosapps.itunes.apple.com 129600 100% 129600 # Updates: Windows refresh_pattern -i microsoft.com/..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims refresh_pattern -i windows.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims refresh_pattern -i microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 refresh_pattern -i windowsupdate.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 refresh_pattern -i windows.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 refresh_pattern -i .*windowsupdate.com/.*.(cab|exe) 259200 100% 259200 refresh_pattern -i .*update.microsoft.com/.*.(cab|exe|dll|msi|psf) 259200 100% 259200 refresh_pattern windowsupdate.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 refresh_pattern download.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 refresh_pattern www.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 refresh_pattern au.download.windowsupdate.com/.*.(cab|exe|dll|msi|psf) 4320 100% 43200 refresh_pattern bg.v4.pr.dl.ws.microsoft.com/.*.(cab|exe|dll|msi|psf) 4320 100% 43200 #windows update NEW UPDATE 0.04 refresh_pattern update.microsoft.com/.*.(cab|exe) 43200 100% 129600 refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/.*.(cab|exe|msi|msp|psf) 4320 100% 43200 refresh_pattern update.microsoft.com/.*.(cab|exe|dll|msi|psf) 10080 100% 43200 refresh_pattern -i .update.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 refresh_pattern -i .windowsupdate.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 refresh_pattern -i .download.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 refresh_pattern -i .ws.microsoft.com/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern ([^.]+.)?.akamai.steamstatic.com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i ([^.]+.)?.adobe.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i ([^.]+.)?.java.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i ([^.]+.)?.sun.com/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i ([^.]+.)?.oracle.com/.*.(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i appldnld.apple.com 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i ([^.]+.)?apple.com/.*.(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod refresh_pattern -i ([^.]+.)?.google.com/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private refresh_pattern -i ([^.]+.)?g.static.com/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private #FACEBOOK refresh_pattern ^http?://*.facebook.com/* 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private #FACEBOOK IMAGES refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private refresh_pattern -i (facebook.com).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private refresh_pattern ^https?://profile.ak.fbcdn.net*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private #FACEBOOK VIDEO refresh_pattern -i .video.ak.fbcdn.net.*.(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private range_offset_limit 512 MB windowsupdate maximum_object_size 512 MB windowsupdate range_offset_limit 0 quick_abort_min -1 KB cache_mem 64 MB maximum_object_size_in_memory 256 KB memory_replacement_policy heap LFUDA cache_replacement_policy heap LFUDA minimum_object_size 0 KB maximum_object_size 4 MB cache_dir diskd /var/squid/cache 64000 256 256 offline_mode off cache_swap_low 90 cache_swap_high 95 acl donotcache dstdomain '/var/squid/acl/donotcache.acl' cache deny donotcache cache allow all # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|?) 0 0% 0 refresh_pattern . 0 20% 4320 #Remote proxies # Setup some default acls # ACLs all, manager, localhost, and to_localhost are predefined. acl allsrc src all acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535 acl sslports port 443 563 8080 5223 2197 acl purge method PURGE acl connect method CONNECT # Define protocols used for redirects acl HTTP proto HTTP acl HTTPS proto HTTPS # SslBump Peek and Splice # http://wiki.squid-cache.org/Features/SslPeekAndSplice # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit # Match against the current step during ssl_bump evaluation [fast] # Never matches and should not be used outside the ssl_bump context. # # At each SslBump step, Squid evaluates ssl_bump directives to find # the next bumping action (e.g., peek or splice). Valid SslBump step # values and the corresponding ssl_bump evaluation moments are: # SslBump1: After getting TCP-level and HTTP CONNECT info. # SslBump2: After getting TLS Client Hello info. # SslBump3: After getting TLS Server Hello info. # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that # they can be used there for custom configuration. acl step1 at_step SslBump1 acl step2 at_step SslBump2 acl step3 at_step SslBump3 acl banned_hosts src '/var/squid/acl/banned_hosts.acl' acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl' acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl' http_access allow manager localhost # Allow external cache managers acl ext_manager src 192.168.1.1 acl ext_manager src 127.0.0.1 http_access allow manager ext_manager http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports # Always allow localhost connections http_access allow localhost quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 95 request_body_max_size 0 KB delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 -1/-1 delay_initial_bucket_level 100 delay_access 1 allow allsrc # Reverse Proxy settings deny_info TCP_RESET allsrc # Package Integration url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf url_rewrite_bypass off url_rewrite_children 32 startup=8 idle=4 concurrency=0 # Custom options before auth #host_verify_strict on # These hosts are banned http_access deny banned_hosts # Always allow access to whitelist domains http_access allow whitelist # Block access to blacklist domains http_access deny blacklist # List of domains allowed to logging in to Google services request_header_access X-GoogApps-Allowed-Domains deny all request_header_add X-GoogApps-Allowed-Domains consumer_accounts # Set YouTube safesearch restriction acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com request_header_access YouTube-Restrict deny all request_header_add YouTube-Restrict none youtubedst acl sglog url_regex -i sgr=ACCESSDENIED http_access deny sglog # Custom SSL/MITM options before auth acl localhost src 192.168.1.1/32 #cachemgr_passwd disable offline_toggle reconfigure shutdown #cachemgr_passwd classified all acl https_login url_regex -i ^https.*(login|Login).* acl no_miss url_regex -i gateway.facebook.com/ws/realtime? acl no_miss url_regex -i web-chat-e2ee.facebook.com/ws/chat acl CONNECT method CONNECT acl wuCONNECT dstdomain www.update.microsoft.com acl wuCONNECT dstdomain sls.microsoft.com http_access allow CONNECT wuCONNECT localnet http_access allow CONNECT wuCONNECT localhost http_access allow windowsupdate localnet http_access allow windowsupdate localhost acl BrokenButTrustedServers dstdomain '/usr/local/pkg/dstdom.broken' acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch sslproxy_cert_error deny all acl splice_only src 192.168.1.8 #Tasha iPhone acl splice_only src 192.168.1.10 #Jon iPhone acl splice_only src 192.168.1.11 #Amazon Fire acl splice_only src 192.168.1.15 #Tasha HP acl splice_only src 192.168.1.16 #iPad acl NoSSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.nobump' acl markBumped annotate_client bumped=true acl bump_only src 192.168.1.3 #webtv acl bump_only src 192.168.1.4 #toshiba acl bump_only src 192.168.1.5 #imac acl bump_only src 192.168.1.9 #macbook acl bump_only src 192.168.1.13 #dell #cache deny https_login ssl_bump peek step1 miss_access deny no_miss ssl_bump splice https_login ssl_bump splice splice_only ssl_bump splice NoSSLIntercept ssl_bump bump bump_only markBumped ssl_bump stare all acl markedBumped note bumped true url_rewrite_access deny markedBumped #read_ahead_gap 32 KB negative_ttl 1 second connect_timeout 30 seconds request_timeout 60 seconds half_closed_clients off shutdown_lifetime 10 seconds negative_dns_ttl 1 seconds ignore_unknown_nameservers on pipeline_prefetch 100 #acl SSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.bump' #ssl_bump bump SSLIntercept # Setup allowed ACLs # Allow local network(s) on interface(s) http_access allow localnet # Default block all to be sure http_access deny allsrc
Files
Updated by Jonathan Lee 9 months ago
Cachemgr.cgi ref:
https://forum.netgate.com/topic/187107/how-to-guide-for-accessing-squid-s-cachemgr-cgi-over-https
StoreID use Research:
https://forum.netgate.com/topic/186805/squid-storeid-and-facebook-plus-caching-windows-updates
EDIT:
Facebook Goals for me with the cache are related to
Ref:
https://research.facebook.com/blog/2016/4/the-evolution-of-advanced-caching-in-the-facebook-cdn/
EDIT:
The errors show a request for cafile= to be tls-cafile, so Squid is looking for tls certificates over the SSL we used before. Is there anyway to generate a TLS certificate authority?
@2024/04/05 07:58:24| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0) 2024/04/05 07:58:24| Processing: http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE 2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096' OpenSSL-saved error #1: 0x1e08010c 2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/05 07:58:24| Processing: http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE 2024/04/05 07:58:24| Starting Authentication on port 127.0.0.1:3128 2024/04/05 07:58:24| Disabling Authentication on port 127.0.0.1:3128 (interception enabled) 2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead. 2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096' OpenSSL-saved error #1: 0x1e08010c 2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/05 07:58:24| Processing: https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE 2024/04/05 07:58:24| Starting Authentication on port 127.0.0.1:3129 2024/04/05 07:58:24| Disabling Authentication on port 127.0.0.1:3129 (interception enabled) 2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead. 2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096' OpenSSL-saved error #1: 0x1e08010c 2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/05 07:58:24| Processing: icp_port 0 2024/04/05 07:58:25| Processing: digest_generation off 2024/04/05 07:58:25| Processing: dns_v4_first on 2024/04/05 07:58:25| ERROR: Directive 'dns_v4_first' is obsolete. 2024/04/05 07:58:25| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records. 2024/04/05 07:58:25| Processing: pid_filename /var/run/squid/squid.pid 2024/04/05 07:58:25| Processing: cache_effective_user squid 2024/04/05 07:58:25| Processing: cache_effective_group proxy 2024/04/05 07:58:25| Processing: error_default_language en 2024/04/05 07:58:25| Processing: icon_directory /usr/local/etc/squid/icons 2024/04/05 07:58:25| Processing: visible_hostname Lee_Family.home.arpa 2024/04/05 07:58:25| Processing: cache_mgr jonathanlee571@gmail.com 2024/04/05 07:58:25| Processing: access_log /var/squid/logs/access.log 2024/04/05 07:58:25| Processing: cache_log /var/squid/logs/cache.log 2024/04/05 07:58:25| Processing: cache_store_log none 2024/04/05 07:58:25| Processing: netdb_filename /var/squid/logs/netdb.state 2024/04/05 07:58:25| Processing: pinger_enable on 2024/04/05 07:58:25| Processing: pinger_program /usr/local/libexec/squid/pinger 2024/04/05 07:58:25| Processing: sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048 2024/04/05 07:58:25| Processing: tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt 2024/04/05 07:58:25| Processing: tls_outgoing_options capath=/usr/local/share/certs/ 2024/04/05 07:58:25| Processing: tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE 2024/04/05 07:58:25| ERROR: Unsupported TLS option SINGLE_DH_USE 2024/04/05 07:58:25| ERROR: Unsupported TLS option SINGLE_ECDH_USE 2024/04/05 07:58:25| Processing: tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS 2024/04/05 07:58:25| Processing: sslcrtd_children 10 2024/04/05 07:58:25| Processing: logfile_rotate 0 2024/04/05 07:58:25| Processing: debug_options rotate=0 2024/04/05 07:58:25| Processing: shutdown_lifetime 3 seconds 2024/04/05 07:58:25| Processing: acl localnet src 192.168.1.0/27 2024/04/05 07:58:25| Processing: forwarded_for transparent 2024/04/05 07:58:25| Processing: httpd_suppress_version_string on 2024/04/05 07:58:25| Processing: uri_whitespace strip 2024/04/05 07:58:25| Processing: acl getmethod method GET 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain windowsupdate.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain .update.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain download.windowsupdate.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain redir.metaservices.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain images.metaservices.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain c.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain www.download.windowsupdate.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain wustat.windows.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain crl.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain sls.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain productactivation.one.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain ntservicepack.microsoft.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1-st.ksn.kaspersky-labs.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1-file.ksn.kaspersky-labs.com 2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1.ksn.kaspersky-labs.com 2024/04/05 07:58:25| Processing: acl rewritedoms dstdomain .facebook.com .akamaihd.net .fbcdn.net .google.com .static.com .apple.com .oracle.com .sun.com .java.com .adobe.com .steamstatic.com .steampowered.com .steamcontent.com .google.com 2024/04/05 07:58:25| Processing: store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt 2024/04/05 07:58:25| Processing: store_id_children 10 startup=5 idle=1 concurrency=0 2024/04/05 07:58:25| Processing: always_direct allow !getmethod 2024/04/05 07:58:25| Processing: store_id_access deny connect 2024/04/05 07:58:25| Processing: store_id_access deny !getmethod 2024/04/05 07:58:25| Processing: store_id_access allow rewritedoms 2024/04/05 07:58:25| Processing: reload_into_ims on 2024/04/05 07:58:25| Processing: max_stale 20 years 2024/04/05 07:58:25| Processing: minimum_expiry_time 0 2024/04/05 07:58:25| Processing: refresh_pattern -i squid\.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-must-revalidate' is obsolete. Remove it. 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-auth' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern -i apple.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims 2024/04/05 07:58:25| Processing: refresh_pattern -i (download|adcdownload).apple.com/.*\.(pkg|dmg) 4320 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern -i appldnld\.apple\.com 129600 100% 129600 2024/04/05 07:58:25| Processing: refresh_pattern -i phobos\.apple\.com 129600 100% 129600 2024/04/05 07:58:25| Processing: refresh_pattern -i iosapps\.itunes\.apple\.com 129600 100% 129600 2024/04/05 07:58:25| Processing: refresh_pattern -i microsoft.com/..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims 2024/04/05 07:58:25| Processing: refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims 2024/04/05 07:58:25| Processing: refresh_pattern -i windows.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims 2024/04/05 07:58:25| Processing: refresh_pattern -i microsoft.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 2024/04/05 07:58:25| Processing: refresh_pattern -i windowsupdate.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 2024/04/05 07:58:25| Processing: refresh_pattern -i windows.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200 2024/04/05 07:58:25| Processing: refresh_pattern -i .*windowsupdate.com/.*\.(cab|exe) 259200 100% 259200 2024/04/05 07:58:25| Processing: refresh_pattern -i .*update.microsoft.com/.*\.(cab|exe|dll|msi|psf) 259200 100% 259200 2024/04/05 07:58:25| Processing: refresh_pattern windowsupdate.com/.*\.(cab|exe|dll|msi|psf) 10080 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern download.microsoft.com/.*\.(cab|exe|dll|msi|psf) 10080 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern www.microsoft.com/.*\.(cab|exe|dll|msi|psf) 10080 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll|msi|psf) 4320 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern bg.v4.pr.dl.ws.microsoft.com/.*\.(cab|exe|dll|msi|psf) 4320 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern update.microsoft.com/.*\.(cab|exe) 43200 100% 129600 2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+\.)?(download|(windows)?update)\.(microsoft\.)?com/.*\.(cab|exe|msi|msp|psf) 4320 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern update.microsoft.com/.*\.(cab|exe|dll|msi|psf) 10080 100% 43200 2024/04/05 07:58:25| Processing: refresh_pattern -i \.update.microsoft.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 2024/04/05 07:58:25| Processing: refresh_pattern -i \.windowsupdate.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 2024/04/05 07:58:25| Processing: refresh_pattern -i \.download.microsoft.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 2024/04/05 07:58:25| Processing: refresh_pattern -i \.ws.microsoft.com/.*\.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600 2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+\.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.*\.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+\.)?.akamai.steamstatic.com/.*\.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?.adobe.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?.java.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?.sun.com/.*\.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?.oracle.com/.*\.(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i appldnld\.apple\.com 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?apple.com/.*\.(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?.google.com/.*\.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+\.)?g.static.com/.*\.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern ^http?://*.facebook.com/* 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern -i (facebook.com).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern ^https?://profile.ak.fbcdn.net*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern -i .video.ak.fbcdn.net.*.(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private 2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it. 2024/04/05 07:58:25| Processing: acl https_login url_regex -i ^https.*(login|Login).* 2024/04/05 07:58:25| Processing: cache deny https_login 2024/04/05 07:58:25| Processing: range_offset_limit 512 MB windowsupdate 2024/04/05 07:58:25| Processing: range_offset_limit 0 2024/04/05 07:58:25| Processing: quick_abort_min -1 KB 2024/04/05 07:58:25| Processing: cache_mem 64 MB 2024/04/05 07:58:25| Processing: maximum_object_size_in_memory 256 KB 2024/04/05 07:58:25| Processing: memory_replacement_policy heap LFUDA 2024/04/05 07:58:25| Processing: cache_replacement_policy heap LFUDA 2024/04/05 07:58:25| Processing: minimum_object_size 0 KB 2024/04/05 07:58:25| Processing: maximum_object_size 512 MB 2024/04/05 07:58:25| Processing: cache_dir diskd /var/squid/cache 64000 256 256 2024/04/05 07:58:25| Processing: offline_mode off 2024/04/05 07:58:25| Processing: cache_swap_low 90 2024/04/05 07:58:25| Processing: cache_swap_high 95 2024/04/05 07:58:25| Processing: acl donotcache dstdomain "/var/squid/acl/donotcache.acl" 2024/04/05 07:58:25| Processing: cache deny donotcache 2024/04/05 07:58:25| Processing: cache allow all 2024/04/05 07:58:25| Processing: refresh_pattern ^ftp: 1440 20% 10080 2024/04/05 07:58:25| Processing: refresh_pattern ^gopher: 1440 0% 1440 2024/04/05 07:58:25| Processing: refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 2024/04/05 07:58:25| Processing: refresh_pattern . 0 20% 4320 2024/04/05 07:58:25| Processing: acl allsrc src all 2024/04/05 07:58:25| Processing: acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535 2024/04/05 07:58:25| Processing: acl sslports port 443 563 8080 5223 2197 2024/04/05 07:58:25| Processing: acl purge method PURGE 2024/04/05 07:58:25| Processing: acl connect method CONNECT 2024/04/05 07:58:25| Processing: acl HTTP proto HTTP 2024/04/05 07:58:25| Processing: acl HTTPS proto HTTPS 2024/04/05 07:58:25| Processing: acl step1 at_step SslBump1 2024/04/05 07:58:25| Processing: acl step2 at_step SslBump2 2024/04/05 07:58:25| Processing: acl step3 at_step SslBump3 2024/04/05 07:58:25| Processing: acl banned_hosts src "/var/squid/acl/banned_hosts.acl" 2024/04/05 07:58:25| Processing: acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl" 2024/04/05 07:58:25| Processing: acl blacklist dstdom_regex -i "/var/squid/acl/blacklist.acl" 2024/04/05 07:58:25| Processing: http_access allow manager localhost 2024/04/05 07:58:25| Processing: acl ext_manager src 192.168.1.1 2024/04/05 07:58:25| Processing: acl ext_manager src 127.0.0.1 2024/04/05 07:58:25| Processing: http_access allow manager ext_manager 2024/04/05 07:58:25| Processing: http_access deny manager 2024/04/05 07:58:25| Processing: http_access allow purge localhost 2024/04/05 07:58:25| Processing: http_access deny purge 2024/04/05 07:58:25| Processing: http_access deny !safeports 2024/04/05 07:58:25| Processing: http_access deny CONNECT !sslports 2024/04/05 07:58:25| Processing: http_access allow localhost 2024/04/05 07:58:25| Processing: quick_abort_min 0 KB 2024/04/05 07:58:25| Processing: quick_abort_max 0 KB 2024/04/05 07:58:25| Processing: quick_abort_pct 95 2024/04/05 07:58:25| Processing: request_body_max_size 0 KB 2024/04/05 07:58:25| Processing: delay_pools 1 2024/04/05 07:58:25| Processing: delay_class 1 2 2024/04/05 07:58:25| Processing: delay_parameters 1 -1/-1 -1/-1 2024/04/05 07:58:25| Processing: delay_initial_bucket_level 100 2024/04/05 07:58:25| Processing: delay_access 1 allow allsrc 2024/04/05 07:58:25| Processing: deny_info TCP_RESET allsrc 2024/04/05 07:58:25| Processing: url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf 2024/04/05 07:58:25| Processing: url_rewrite_bypass off 2024/04/05 07:58:25| Processing: url_rewrite_children 32 startup=8 idle=4 concurrency=0 2024/04/05 07:58:25| Processing: http_access deny banned_hosts 2024/04/05 07:58:25| Processing: http_access allow whitelist 2024/04/05 07:58:25| Processing: http_access deny blacklist 2024/04/05 07:58:25| Processing: request_header_access X-GoogApps-Allowed-Domains deny all 2024/04/05 07:58:25| Processing: request_header_add X-GoogApps-Allowed-Domains consumer_accounts 2024/04/05 07:58:25| Processing: acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com 2024/04/05 07:58:25| Processing: request_header_access YouTube-Restrict deny all 2024/04/05 07:58:25| Processing: request_header_add YouTube-Restrict none youtubedst 2024/04/05 07:58:25| Processing: acl sglog url_regex -i sgr=ACCESSDENIED 2024/04/05 07:58:25| Processing: http_access deny sglog 2024/04/05 07:58:25| Processing: acl localhost src 192.168.1.1/32 2024/04/05 07:58:25| Processing: acl no_miss url_regex -i gateway\.facebook\.com\/ws\/realtime\? 2024/04/05 07:58:25| Processing: acl no_miss url_regex -i web-chat-e2ee\.facebook\.com\/ws\/chat 2024/04/05 07:58:25| Processing: acl CONNECT method CONNECT 2024/04/05 07:58:25| Processing: acl wuCONNECT dstdomain www.update.microsoft.com 2024/04/05 07:58:25| Processing: acl wuCONNECT dstdomain sls.microsoft.com 2024/04/05 07:58:25| Processing: http_access allow CONNECT wuCONNECT localnet 2024/04/05 07:58:25| Processing: http_access allow CONNECT wuCONNECT localhost 2024/04/05 07:58:25| Processing: http_access allow windowsupdate localnet 2024/04/05 07:58:25| Processing: http_access allow windowsupdate localhost 2024/04/05 07:58:25| Processing: http_access deny manager 2024/04/05 07:58:25| Processing: acl BrokenButTrustedServers dstdomain "/usr/local/pkg/dstdom.broken" 2024/04/05 07:58:25| Processing: acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH 2024/04/05 07:58:25| Processing: sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch 2024/04/05 07:58:25| Processing: sslproxy_cert_error deny all 2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.8 #Tasha iPhone 2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.10 #Jon iPhone 2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.11 #Amazon Fire 2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.15 #Tasha HP 2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.16 #iPad 2024/04/05 07:58:25| Processing: acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/url.nobump" 2024/04/05 07:58:25| /usr/local/etc/squid/squid.conf line 276: acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/url.nobump" 2024/04/05 07:58:25| WARNING: there are more than 100 regular expressions. Consider using less REs or use rules without expressions like 'dstdomain'. 2024/04/05 07:58:25| Processing: acl markBumped annotate_client bumped=true 2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.3 #webtv 2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.4 #toshiba 2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.5 #imac 2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.9 #macbook 2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.13 #dell 2024/04/05 07:58:25| Processing: ssl_bump peek step1 2024/04/05 07:58:25| Processing: miss_access deny no_miss 2024/04/05 07:58:25| Processing: ssl_bump splice https_login 2024/04/05 07:58:25| Processing: ssl_bump splice splice_only 2024/04/05 07:58:25| Processing: ssl_bump splice NoSSLIntercept 2024/04/05 07:58:25| Processing: ssl_bump bump bump_only markBumped 2024/04/05 07:58:25| Processing: ssl_bump stare all 2024/04/05 07:58:25| Processing: acl markedBumped note bumped true 2024/04/05 07:58:25| Processing: url_rewrite_access deny markedBumped 2024/04/05 07:58:25| Processing: http_access deny all 2024/04/05 07:58:25| Processing: read_ahead_gap 64 KB 2024/04/05 07:58:25| Processing: negative_ttl 1 second 2024/04/05 07:58:25| Processing: connect_timeout 30 seconds 2024/04/05 07:58:25| Processing: request_timeout 60 seconds 2024/04/05 07:58:25| Processing: half_closed_clients off 2024/04/05 07:58:25| Processing: shutdown_lifetime 10 seconds 2024/04/05 07:58:25| Processing: negative_dns_ttl 1 seconds 2024/04/05 07:58:25| Processing: ignore_unknown_nameservers on 2024/04/05 07:58:25| Processing: pipeline_prefetch 100 2024/04/05 07:58:25| Processing: http_access allow localnet 2024/04/05 07:58:25| Processing: http_access deny allsrc 2024/04/05 07:58:25| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP 2024/04/05 07:58:25| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP 2024/04/05 07:58:25| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP 2024/04/05 07:58:25| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP 2024/04/05 07:58:25| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP 2024/04/05 07:58:25| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP 2024/04/05 07:58:25| Requiring client certificates. 2024/04/05 07:58:25| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse 2024/04/05 07:58:26| Not requiring any client certificates 2024/04/05 07:58:26| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse 2024/04/05 07:58:26| Not requiring any client certificates 2024/04/05 07:58:26| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse 2024/04/05 07:58:27| Not requiring any client certificates@
EDIT:
2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
is fixed with the following
https://github.com/pfsense/FreeBSD-ports/commit/de0386f85a97b6424a0b5e371e98cfaea467972e
EDIT:
https://github.com/pfsense/FreeBSD-ports/pull/1365
this fixed the issue inside my SG-2100
Working on this also Per Squid support Amos Jeffries
"Also there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4."
Working this issue now.
EDIT:
if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) { // Modern cipher suites $sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS"; $sslproxy_options .= ",NO_TLSv1"; } else { $sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS"; }
Should the RC4 be removed or allowed? I can also fix this what does everyone think with this?
EDIT:
Notes:
FIX ME
line of code 1261 in /usr/local/pkg/squid.inc
FIX ME
line of code 1235-1241 in usr/local/pkg/squid.inc
EDIT:
https://github.com/pfsense/FreeBSD-ports/pull/1366
Fix for
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
Updated by Jonathan Lee 9 months ago
Updated by Marcos M 3 months ago
- Subject changed from Squid 6.6 Errors Attached for Review TLS requested in errors to Update deprecated options
- Description updated (diff)
- Status changed from New to Closed
- Plus Target Version set to 24.11
- Affected Architecture deleted (
SG-2100)
I've merged the above comments into one to help with readability.
The proposed changes from the posted PRs are simple/easy enough so I'll put them in, but please keep in mind that the Squid packages are deprecated and may be removed.
Updated by Jonathan Lee 3 months ago
Thanks for looking at this, and the YouTube issue.
Updated by Maharsh Patel 3 months ago
Can you also close this issue as well this is now no longer valid: https://redmine.pfsense.org/issues/15381