Re: [squid-users] SQUID transparent, HTTP/1.0, HTTP/1.1

On 01/02/11 16:29, Pandu Poluan wrote:
> Hello,
>
> I want to configure SQUID as a transparent proxy, but on a separate
> box from the Linux gateway (both boxes using Ubuntu Server 10.04)
>
> I found this howto: http://www.faqs.org/docs/Linux-mini/TransparentProxy.html
>
> Now, my questions are:
>
> 1. Is the howto (esp. sections 6.2 and 6.3) still applicable with the
> latest SQUID version?

The whole of section 6.1 is a major security vulnerability "don't do
it!" situation. Read CVE-2009-0801 for an explanation of what malware
can do to trivially spread themselves across your whole client base.

The currently available Squid do permit it with loud failure warnings in
cache.log. We are planning on fully disabling the security hole in the
near future.

Section 6.2 and 6.3 are the recommended way if you have to do NAT
interception.

The real transparent proxy (TPROXY) in the more recent Squid does not
work reliably on Ubuntu 10.04.

>
> 1a. If yes, which strategy should I be using?
>
> 2. Slightly tangential: Does SQUID fully support HTTP/1.1?

squid-3.2 does.
squid-3.1 and squid-2.7 almost do.
other versions do not.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.10
   Beta testers wanted for 3.2.0.4