After three years of development, the stable release of the Squid 5.1 proxy server has been presented, ready for use in production systems (versions 5.0.x were in beta status). Now that the 5.x branch has been designated as stable, it will only receive fixes for vulnerabilities and stability issues, and minor optimizations are allowed. Development of new features will take place in the new experimental branch 6.0. Users of the previous stable branch 4.x are advised to plan their transition to the 5.x branch.
Key Innovations in Squid 5:
- Support for a trailer data attachment mechanism has been added to the implementation of the ICAP (Internet Content Adaptation Protocol), used for integration with external content verification systems, allowing for additional metadata headers to be attached to the response after the message body (for example, checksums and details about detected issues can be communicated).
- The ‘Happy Eyeballs’ algorithm has been implemented for redirecting requests, which immediately uses the obtained IP address without waiting for resolution of all potentially available IPv4 and IPv6 target addresses. Instead of considering the 'dns_v4_first' setting to determine the order of using the IPv4 or IPv6 address families, the order of responses in DNS is now taken into account: if the DNS AAAA response arrives first, the obtained IPv6 address will be used. an IP address Thus, the preference for address family is now set at the firewall level, DNS or launched with the ‘--disable-ipv6’ option. This proposed change allows for faster TCP connection setup times and reduces the impact of resolution delays in DNS on performance.
- An ‘ext_kerberos_sid_group_acl’ handler has been added for authentication with group checks in Active Directory using Kerberos for use in the ‘external_acl’ directive. The ldapsearch utility provided by the OpenLDAP package is used to request the group name.
- Support for the Berkeley DB database format has been deprecated due to licensing issues. The Berkeley DB 5.x branch has not been maintained for several years and remains with unaddressed vulnerabilities, while transitioning to newer releases is hindered by the licensing change to AGPLv3, whose requirements extend to applications using BerkeleyDB as a library—Squid is distributed under GPLv2, and AGPL is incompatible with GPLv2. Instead of Berkeley DB, the project has switched to using the TrivialDB database management system, which, unlike Berkeley DB, is optimized for simultaneous parallel access to the database. Support for Berkeley DB is currently maintained, but in the handlers 'ext_session_acl' and 'ext_time_quota_acl', it is now recommended to use the 'libtdb' storage type instead of 'libdb'.
- Support for the HTTP header CDN-Loop has been added, as defined in RFC 8586, which allows for detecting loops when using content delivery networks (the header provides protection against situations where a request, during redirection between CDNs, for some reason returns back to the original CDN, creating an infinite loop).
- The SSL-Bump mechanism, which allows for intercepting content from encrypted HTTPS sessions, now supports redirecting modified (re-encrypted) HTTPS requests through other proxy servers specified in cache_peer, using a standard tunnel based on the HTTP CONNECT method (transmission over HTTPS is not supported, as Squid currently cannot transmit TLS within TLS). SSL-Bump allows for establishing a TLS connection with the target server upon receiving the first intercepted HTTPS request and obtaining its certificate. After that, Squid uses the hostname from the actual certificate received from the server and creates a fake certificate, which it uses to simulate the requested server when interacting with the client, while still utilizing the TLS connection established with the target server for data retrieval (to avoid warnings in client browsers due to the spoofing, it is necessary to add your certificate, which was used to generate fake certificates, to the root certificate store).
- The directives mark_client_connection and mark_client_pack have been added to bind Netfilter (CONNMARK) marks to client TCP connections or individual packets.
Following closely, the releases of Squid 5.2 and Squid 4.17 have been published, addressing vulnerabilities:
- CVE-2021-28116 — information leakage when processing specially crafted WCCPv2 messages. This vulnerability allows an attacker to corrupt the known routers list for WCCP and redirect proxy server client traffic to their host. The issue occurs only in configurations with WCCPv2 support enabled and the possibility of IP address spoofing for the router.
- CVE-2021-41611 — an error in validation for TLS certificates, allowing access using untrusted certificates.
Source: opennet.ru
