Ngemva kweminyaka emithathu yokuthuthukiswa, inguqulo entsha eqinile yeseva yommeleli we-Squid, 5.1, ikhishwe futhi isilungele ukusetshenziswa ezinhlelweni zokukhiqiza (izinguqulo 5.0.x zaziyi-beta).
Ngemva kokuba igatsha le-5.x lifinyelele esimweni esizinzile, kusukela manje kuqhubeke kuzolungiswa kuphela izinkinga zobuthakathaka kanye nokuzinza , kanye nokulungiswa okuncane. Ukuthuthukiswa kwezici ezintsha kuzokwenzeka egatsheni elisha lokuhlola le-6.0. Abasebenzisi begatsha le-4.x elizinzile langaphambilini bakhuthazwa ukuthi bahlele ukuthuthela egatsheni le-5.x.
I-squid 5.1 Izici Ezintsha Ezintsha
Kule nguqulo entsha, ukuhambisana nefomethi yeBerkeley DB kuyekiswa ngenxa yezinkinga zelayisensi . Igatsha leBerkeley DB 5.x alizange ligcinwe iminyaka eminingana futhi lisalokhu linobuthakathaka obungashintshiwe, futhi ukuthuthukela ezinguqulweni ezintsha akuvumeli ukushintsha ilayisensi ye-AGPLv3, enezidingo ezisebenza nasezinhlelweni ezisebenzisa iBerkeley DB njengelabhulali. I-Squid ikhishwa ngaphansi kwelayisensi ye-GPLv2, futhi i-AGPL ayihambisani ne-GPLv2.
Esikhundleni seBerkeley DB, iphrojekthi ishintshele ekusebenziseni i-TrivialDB DBMS, okuyinto, ngokungafani neBerkeley DB, eyenzelwe ukufinyelela ngasikhathi sinye kusizindalwazi. Ukusekelwa kweBerkeley DB kusagcinwa okwamanje, kodwa manje kunconywa ukusebenzisa uhlobo lwesitoreji "libtdb" esikhundleni se-"libdb" kubaphathi be-"ext_session_acl" kanye ne-"ext_time_quota_acl".
Ngaphezu kwalokho, ukungezwa kufakwa kunhlokweni ye-HTTP CDN-Loop, echazwe ku-RFC 8586, evumela ukutholwa kwamaluphu lapho usebenzisa amanethiwekhi wokulethwa kokuqukethwe (unhlokweni unikeza ukuvikeleka ezimeni lapho isicelo, ngesikhathi sokuqondiswa kabusha phakathi kwama-CDN ngasizathu simbe, kubuya ku-CDN yoqobo, kwakheka i-loop engapheli).
Ngaphezu kwalokho, indlela ye-SSL-Bump, evumela ukuvimba okuqukethwe kwezikhathi ze-HTTPS ezibethelwe, ingeze ukwesekwa kokuqondisa kabusha izicelo ze-HTTPS eziqanjiwe ngamanye amaseva e-proxy achazwe ku-cache_peer kusetshenziswa umhubhe ojwayelekile osekelwe endleleni ye-HTTP CONNECT (ukudluliselwa nge-HTTPS akusekelwe, njengoba i-Squid ingeke ikwazi ukudlulisa i-TLS ngaphakathi kwe-TLS).
I-SSL-Bump, lapho ithola isicelo sokuqala se-HTTPS esithintekile, isungula uxhumano lwe-TLS neseva eqondiwe bese ithola isitifiketi sayo. I-Squid bese isebenzisa igama lomethuleli lesitifiketi sangempela esitholwe kuseva ukudala isitifiketi mbumbulu, esisisebenzisa ukuzenza iseva eceliwe lapho ixhumana neklayenti , ngenkathi iqhubeka nokusebenzisa uxhumano lwe-TLS olusunguliwe neseva eqondiwe ukuthola idatha.
Kubalulekile futhi ukuqaphela ukuthi ukusetshenziswa kwe- ICAP (i-Internet Content Adaptation Protocol), esetshenziselwa ukuhlanganiswa nezinhlelo zokuqinisekisa okuqukethwe kwangaphandle, kuye kwanezela ukwesekwa kwendlela yokunamathisela idatha evumela ukuthi izihloko ezengeziwe ze-metadata zinamathiselwe empendulweni, zibekwe ngemuva komzimba womlayezo.
Esikhundleni sokubheka i- "dns_v4_first»Ukunquma ukuhleleka kokusetshenziswa komndeni wamakheli we-IPv4 noma we-IPv6, manje ukulandelwa kwempendulo ku-DNS kuyabhekwa- Uma impendulo ye-AAAA evela ku-DNS ivela kuqala ngenkathi ilinde ikheli le-IP ukuxazulula, kuzosetshenziswa ikheli le-IPv6 eliphumela. Ngakho-ke, isilungiselelo somndeni sekheli esithandwa manje sesenziwe ku-firewall, i-DNS, noma ekuqaleni ngenketho ye- "–disable-ipv6".
Ushintsho oluhlongozwayo luzosheshisa isikhathi sokulungiselela ukuxhumana kwe-TCP futhi lwehlise umthelela wokusebenza kokubambezeleka kokulungiswa kwe-DNS.
Uma kuthunyelwa kabusha izicelo, kusetshenziswa i-algorithm ethi "Happy Eyeballs", esebenzisa ikheli le-IP elitholiwe ngokushesha, ngaphandle kokulinda ukuthi wonke amakheli e-IPv4 kanye ne-IPv6 atholakale ukuze axazululwe.
Ukusetshenziswa esiqondisweni se- "external_acl", umshayeli we- "ext_kerberos_sid_group_acl" wengezelwe ukufakazelwa ubuqiniso ngamaqembu wokuqinisekisa ku-Active Directory esebenzisa i-Kerberos. Insiza ye-ldapsearch enikezwe iphakethe le-OpenLDAP isetshenziselwa ukubuza igama leqembu.
Kungezwe imiyalo ye-mark_client_connection ne-mark_client_pack yokubopha amathegi we-Netfilter (CONNMARK) kumaphakethe ngamanye noma ekuxhumaneni kweklayenti le-TCP
Ekugcineni, kushiwo ukuthi, ngokulandela izinyathelo zezinguqulo ezishicilelwe ze-Squid 5.2 kanye ne-Squid 4.17, ubuthakathaka obulandelayo bulungisiwe:
- I-CVE-2021-28116 - Ulwazi luvuza lapho kucutshungulwa imilayezo eyenziwe ngobuciko ye-WCCPv2. Ukuba sengozini kuvumela umhlaseli ukuthi onakalise uhlu lwama-routers e-WCCP aziwayo futhi aqondise kabusha ithrafikhi kusuka kuklayenti elibamba iye kumgcini walo. Inkinga iziveza kuphela ekucushweni nge-WCCPv2 ukwesekwa okunikwe amandla nalapho kungenzeka khona ukonakalisa ikheli le-IP lomzila.
- I-CVE-2021-41611: iphutha lokuqinisekisa izitifiketi ze-TLS ezivumela ukufinyelela kusetshenziswa izitifiketi ezingathembekile.
Okokugcina, uma ufuna ukwazi okwengeziwe ngakho, ungabheka imininingwane kusixhumanisi esilandelayo.