Release CacheGuard-UF-2.6.1-X64 · cacheguard/CacheGuard-OS

Highlights

Fixed an arbitrary command injection vulnerability that could be exploited by an administrator during configuration loading.
The guard and transparent modes have been jointly enhanced to transparently filter unwanted domain names based on the SNI field of HTTPS traffic.
The Administration and Auditing Web GUIs have been enhanced to comply with Content Security Policy (CSP) requirements, with JavaScript interactions modernised using HTML5 data attributes.
The embedded BeVyPN application has been enhanced to comply with Content Security Policy (CSP) requirements, with JavaScript interactions modernised using HTML5 data attributes.

The admin ssh key ... usage form of the admin command has been improved to allow an SSH public key to be set inline.
The firewall command has been fixed to display the destination port specification when no NAT specifications are present.
The access command now supports the access fweb ... usage form to restrict access to the explicit web proxy based on the X-Forwarded-For header.
The access web ... usage form now defines only the networks allowed to access the explicit web proxy directly.
The network specifications for explicit web clients, transparent web clients, and previous peers are now independent. Refer to the access, transparent, and peer command documentation for further information.
The implementation of next and previous peer configuration has been revised to use httppeer ports (see the port command).
- If you are using chained peers, your configuration should be reviewed.
The appearance and usability of the Web GUI have been reviewed and improved.
The entire documentation, including the User's Guide and Command Line Interface documentation, has been reviewed.
The CacheGuard-OS License Agreement has been upgraded to version 2.9.

The DHCP server has been enhanced to assign dynamic IP addresses to devices connected to the auxiliary interface.
The dhcp command syntax has therefore been modified to specify the network interface when defining dynamic IP ranges and fixed IP addresses.
Routed traffic can now be shaped for distinct functional interfaces associated with 802.1Q pseudo-interfaces.
The syntax of the qos shape router command usage form has been changed.
- The internal interface can no longer be used.
- When the OS is upgraded using a patch, all QoS router rules associated with the internal interface are automatically translated to the web interface.
QoS has been fixed to properly shape routed traffic through the external logical interface when SNAT mode is activated.

The qos shape router ... usage form of the qos command has been improved to allow port range specifications.
QoS has been fixed to classify next-peer traffic as web traffic via the external interface.
The peer command has been enhanced to allow a QoS percentage value to be specified for each next peer.

The syntax of the authenticate command for LDAP servers has been modified.
- It is no longer necessary to specify an IP address for an LDAP server in addition to its hostname.
The Kerberos initialization bug has been fixed.
The OS now supports both MIT and AD™ (Active Directory) style Kerberos authentication.
The syntax of the authenticate ad command usage form has been modified.
The authenticate hapassword command usage form has been removed.
The authenticate kerberos encrypt command usage form has been removed.
- The OS and the Kerberos server can now negotiate the highest available encryption type.

The forwarding proxy configuration has been enhanced to allow antivirus and compression modes to be enabled simultaneously.
The URL list loading policy has been improved.
- An attempt to update a URL list that is more than 30 days out of date now automatically triggers a full reload in create mode.
Squid is no longer used as a reverse proxy, even in non-WAF and non-sticky connection load-balancing modes.
The reverse proxy now supports HTTP/2.
The Auditing Web GUI has been fixed to properly display guarding logs.

The listening ports for ISAKMP and NAT-T services used by the IPsec VPN server can now be set to low-numbered ports (less than or equal to 1024).

The pull and push gateway configuration on the Manager has been fixed to properly handle the client certificate control file.
Template creation based on a gateway configuration now correctly excludes client certificates from the certificate control file.
On the Manager, configuring a gateway or template based on another gateway or template configuration (configuration inheritance) now also includes client certificates.
The OS has been fixed to prevent the removal of unused temporary working directories after a certain period on the Manager, which could make it impossible to manage configurations.

The memory usage estimation during OS installation and tuning has been revised.
The boot issue occurring after installation of the 32-bit OS on machines with 3 GB of RAM or less has been fixed.
Minor bug fixes have been applied.

The entire documentation has been reviewed and updated, including:
- User's Guide
- Command Line Interface documentation

If you are upgrading from an earlier version, please pay particular attention to the following configuration changes:

The qos shape router syntax has changed.
The internal interface can no longer be used with QoS router rules.
Existing QoS router rules associated with internal are automatically translated to web when upgrading via a patch.
The dhcp command syntax has changed to include the network interface when defining dynamic IP ranges and fixed IP addresses.
The authenticate ad command syntax has changed.
The authenticate hapassword command has been removed.
The authenticate kerberos encrypt command has been removed.
If you are using chained peers, review your configuration because next/previous peer configuration now uses httppeer ports.
The access command has been extended with access fweb ..., while access web ... now applies only to networks accessing the explicit web proxy directly.