Dear Maintainer,
In authorization process
/var/log/squid3/cache.log:
....
2012/12/03 15:56:04.032| The request GET http://www.qnx.com/ is DENIED, because it matched 'AUTH'
2012/12/03 15:56:04.063| ZPH: Preserving TOS on miss, TOS=0
2012/12/03 15:56:04.064| The reply for GET http://www.qnx.com/ is ALLOWED, because it matched 'AUTH'
2012/12/03 15:56:04.064| ConnStateData::swanSong: FD 10
--------
2012/12/03 15:56:29.270| authenticateAuthUserAddIp: user 'john' has been seen at a new IP address (192.168.66.32:48789)
2012/12/03 15:56:29.270| aclMatchExternal: check_ad_group("john inet") = lookup needed
2012/12/03 15:56:29.270| aclMatchExternal: "john inet": entry=@0, age=0
2012/12/03 15:56:29.271| aclMatchExternal: "john inet": queueing a call.
2012/12/03 15:56:29.271| aclMatchExternal: "john inet": return -1.
2012/12/03 15:56:29.271| externalAclLookup: lookup in 'check_ad_group' for 'john inet'
Connected OK
group filter '(&(objectclass=user)(sAMAccountName=john)(memberof=cn=inet,ou=usergroups,dc=nsk,dc=lanta,dc=ru))', searchbase 'dc=nsk,dc=lanta,dc=ru'
2012/12/03 15:56:29.275| externalAclHandleReply: reply="OK"
2012/12/03 15:56:29.276| external_acl_cache_add: Adding 'john inet' = 1
2012/12/03 15:56:29.276| aclMatchExternal: check_ad_group = 1
2012/12/03 15:56:29.276| The request GET http://www.qnx.com/ is ALLOWED, because it matched 'localnet'
2012/12/03 15:56:29.276| client_side_request.cc(556) clientAccessCheck2: No adapted_http_access configuration.
2012/12/03 15:56:29.277| The request GET http://www.qnx.com/ is ALLOWED, because it matched 'localnet'
2012/12/03 15:56:29.744| ctx: enter level 0: 'http://www.qnx.com/'
2012/12/03 15:56:29.745| hdr cc: unknown cache-directive: near 'post-check=0, pre-check=0' in '0xbfea9114'
2012/12/03 15:56:29.745| hdr cc: unknown cache-directive: near 'pre-check=0' in '0xbfea9114'
2012/12/03 15:56:29.745| ctx: exit level 0
2012/12/03 15:56:29.745| ZPH: Preserving TOS on miss, TOS=0
2012/12/03 15:56:29.746| hdr cc: unknown cache-directive: near 'post-check=0, pre-check=0' in '0xbfea8e44'
2012/12/03 15:56:29.746| hdr cc: unknown cache-directive: near 'pre-check=0' in '0xbfea8e44'
2012/12/03 15:56:32| Starting Squid Cache version 3.1.20 for i486-pc-linux-gnu...
/var/log/syslog:
....
Dec 3 15:56:29 squid kernel: [11044.464660] squid3[9204]: segfault at c ip b76ad6c6 sp bfea8c20 error 4 in squid3[b74cd000+300000]
Dec 3 15:56:29 squid squid[8726]: Squid Parent: child process 9204 exited due to signal 11 with status 0
Dec 3 15:56:32 squid squid[8726]: Squid Parent: child process 9233 started
....
Hi,
Our squid3 is also segfaulting with a external authenticator on the 1st
request that hits the proxy.
We are using Debian wheezy as of 26-03-2013, Our squid version is below.
We are using the ntlm_auth and winbind authenticators.
Kind regards,
Seth
root@lsproxy2:/etc/samba# aptitude show squid3
Pakket: squid3
Staat: geïnstalleerd
Automatisch geïnstalleerd: nee
Versie: 3.1.20-2.2
Prioriteit: optioneel
Sectie: web
Beheerder: Luigi Gangitano <luigi@debian.org>
Architectuur: amd64
Ongecomprimeerde grootte: 4205 k
Hangt af van: libc6 (>= 2.7), libcap2 (>= 2.10), libcomerr2 (>= 1.01),
libdb5.1, libexpat1 (>= 2.0.1), libgcc1 (>= 1:4.1.1), libgssapi-krb5-2
(>= 1.10+dfsg~), libk5crypto3 (>= 1.6.dfsg.2), libkrb5-3 (>= 1.6.dfsg.2),
libldap-2.4-2 (>= 2.4.7), libltdl7 (>= 2.4.2), libpam0g
(>= 0.99.7.1), libsasl2-2 (>= 2.1.24), libstdc++6 (>= 4.4.0), libxml2
(>= 2.7.4), netbase, adduser, logrotate (>= 3.5.4-1), squid3-common (=
3.1.20-2.2), lsb-base
Suggereert: squidclient, squid-cgi, resolvconf (>= 0.40), smbclient, ufw
Beschrijving: Full featured Web Proxy cache (HTTP proxy)
Squid is a high-performance proxy caching server for web clients,
supporting FTP, gopher, and HTTP data objects.
Squid version 3 is a major rewrite of Squid in C++ and introduces a
number of new features including ICAP and ESI support.
Homepage: http://www.squid-cache.org
external_acl_type user_memberof_acl %LOGIN /usr/lib/squid3/squid_ldap_group -R -K -S \
-b "ou=Ukraine,DC=domain,DC=com" \
-D "webproxy.svc@gfk.com" \
-W "/etc/squid3/ldap.passwd" \
-f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,OU=Role,OU=Groups,OU=Ukraine,DC=domain,DC=com))" \
-h dc01.domain.com
With
http_access allow Proxy_Access_group_acl
http_access allow authenticated
everything works fine;
With
http_access allow authenticated Proxy_Access_group_acl
I get squid3 segfault and then squid restart automatically.
Squid segfault as soon as the request hit external_acl. Squid works fine, if I remove the external_acl statements from my acl's. I use /usr/lib/squid3/squid_ldap_group Example external acl: external_acl_type LDAP_Auth_MOHR ttl=1800 negative_ttl=300 children=15 %LOGIN /usr/lib/squid3/squid_ldap_group -R -b "dc=org,dc=example,dc=com" -D "cn=binduser,ou=Proxy,dc=org,dc=example,dc=com" -w "password" -f "(&(objectclass=person)(sAMAccountName=%u)(memberof=cn=%g,ou=Proxy,dc=org,dc=example,dc=com))" -h A.B.C.D -p 3268 -v 3 /var/log/kernel Jul 23 15:08:51 gate09-neu kernel: [ 1299.373335] squid3[3676]: segfault at 18 ip 00007f87e9250f9e sp 00007fff964453f0 error 4 in squid3[7f87e905e000+301000] Jul 23 15:08:55 gate09-neu kernel: [ 1303.055208] squid3[3767]: segfault at 18 ip 00007f31c4a13f9e sp 00007fffc5224d10 error 4 in squid3[7f31c4821000+301000] Jul 23 15:08:59 gate09-neu kernel: [ 1306.917126] squid3[3801]: segfault at 18 ip 00007f7f9ce90f9e sp 00007fff08fc1910 error 4 in squid3[7f7f9cc9e000+301000] Jul 23 15:09:03 gate09-neu kernel: [ 1310.512300] squid3[3835]: segfault at 18 ip 00007f050671bf9e sp 00007fff7273d050 error 4 in squid3[7f0506529000+301000] Jul 23 15:09:06 gate09-neu kernel: [ 1314.195142] squid3[3869]: segfault at 18 ip 00007fd0d5ec1f9e sp 00007fff409a5f50 error 4 in squid3[7fd0d5ccf000+301000] Jul 23 15:09:10 gate09-neu kernel: [ 1318.062694] squid3[3903]: segfault at 40 ip 00007f7567481817 sp 00007fff435cc0a0 error 4 in squid3[7f756728f000+301000]
Dear Maintainer, do you think, that there is a little chance for you to find some time to fix this bug? If you need more information to reproduce this error, ill try to give you the needed informations. Regards Jörg
tags 695004 +moreinfo thanks Let’s tag it moreinfo and see if it’s reproducible. Regards, L
Caro Luigi,
I've had previously commented bug #486211, and i don't know if they are the
same, but surely the trouble came from 'external_acl'.
In that comment i say that in two similar system depicted the trouble, the
other no: clearly, only on the troubling one i've defined my 'skype' ACL...
I've in use an ACL to prevent skype use, apart some hosts (with fixed IP) or
by some users (some group membership).
My configuration is:
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain=SANVITO --require-membership-of="SANVITO\\domusers"
auth_param ntlm children 5
external_acl_type check_ntgroup %LOGIN /usr/lib/squid3/wbinfo_group.pl
acl auth_required proxy_auth REQUIRED
acl CONNECT method CONNECT
acl block_skype url_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
acl users_skype external check_ntgroup ispac ced dirammre
acl skype src "/etc/squid3/lists/skype.list"
acl apertura time MTWHF 08:00-18:00
http_access allow CONNECT block_skype apertura skype
http_access allow CONNECT block_skype apertura auth_required users_skype
http_access deny CONNECT block_skype apertura
With this setup, everytime i try to access Skype (or, indeed, an https site
using ip literal) squid require me auth, seems to accept it but refuse to
connect.
After testing all pieces of tools (eg, /usr/bin/ntlm_auth and
/usr/lib/squid3/wbinfo_group.pl) and found it working, i've finally
correlated the missing access with the sigsev, founding it fully
reproducible.
So, i've tried substituting ACL:
http_access allow CONNECT block_skype apertura auth_required users_skype
with:
http_access allow CONNECT block_skype apertura auth_required
and now skype works, ans squid does not sigsev.
Setting debug to 9 for external ACL i can see in cache.log:
2015/01/21 16:41:07.920| aclMatchExternal: acl="check_ntgroup"
2015/01/21 16:41:07.920| aclMatchExternal: check_ntgroup("gaio ispac ced dirammre") = lookup needed
2015/01/21 16:41:07.920| aclMatchExternal: "gaio ispac ced dirammre": entry=@0, age=0
2015/01/21 16:41:07.920| aclMatchExternal: "gaio ispac ced dirammre": queueing a call.
2015/01/21 16:41:07.920| aclMatchExternal: "gaio ispac ced dirammre": return -1.
2015/01/21 16:41:07.920| externalAclLookup: lookup in 'check_ntgroup' for 'gaio ispac ced dirammre'
2015/01/21 16:41:07.920| externalAclLookup: looking up for 'gaio ispac ced dirammre' in 'check_ntgroup'.
2015/01/21 16:41:07.920| externalAclLookup: will wait for the result of 'gaio ispac ced dirammre' in 'check_ntgroup' (ch=0x7fc85b0128c8).
2015/01/21 16:41:07.997| externalAclHandleReply: reply="OK"
2015/01/21 16:41:07.997| external_acl_cache_add: Adding 'gaio ispac ced dirammre' = 1
2015/01/21 16:41:07.997| aclMatchExternal: acl="check_ntgroup"
2015/01/21 16:41:07.997| aclMatchExternal: check_ntgroup = 1
2015/01/21 16:41:11| Starting Squid Cache version 3.1.20 for x86_64-pc-linux-gnu...
so, squid run correctly the external ACL script and only AFTER that hang.
Trying to put all ACL in debug mode, i've hit:
2015/01/21 17:24:05.849| ACL::FindByName 'users_skype'
2015/01/21 17:24:05.849| ACLChecklist::asyncInProgress: 0x7f330a6df098 async set to 1
2015/01/21 17:24:05.849| aclmatchAclList: async=1 nodeMatched=0 async_in_progress=1 lastACLResult() = 0 finished() = 0
2015/01/21 17:24:05.926| ACLChecklist::asyncInProgress: 0x7f330a6df098 async set to 0
2015/01/21 17:24:05.926| ACLChecklist::preCheck: 0x7f330a6df098 checking 'http_access allow CONNECT block_skype apertura auth_required users_skype'
2015/01/21 17:24:05.926| ACLList::matches: checking CONNECT
2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'CONNECT'
2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'CONNECT' is 1
2015/01/21 17:24:05.926| ACLList::matches: result is true
2015/01/21 17:24:05.926| ACLList::matches: checking block_skype
2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'block_skype'
2015/01/21 17:24:05.926| aclRegexData::match: checking '151.49.25.89:443'
2015/01/21 17:24:05.926| aclRegexData::match: looking for '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'
2015/01/21 17:24:05.926| aclRegexData::match: match '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' found in '151.49.25.89:443'
2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'block_skype' is 1
2015/01/21 17:24:05.926| ACLList::matches: result is true
2015/01/21 17:24:05.926| ACLList::matches: checking apertura
2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'apertura'
2015/01/21 17:24:05.926| aclMatchTime: checking 1044 in 0-0, weekbits=0
2015/01/21 17:24:05.926| aclMatchTime: checking 1044 in 480-1080, weekbits=3e
2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'apertura' is 1
2015/01/21 17:24:05.926| ACLList::matches: result is true
2015/01/21 17:24:05.926| ACLList::matches: checking auth_required
2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'auth_required'
2015/01/21 17:24:05.926| ACL::cacheMatchAcl: cache hit on acl 'auth_required' (0x7f32fb25b090)
2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'auth_required' is 1
2015/01/21 17:24:05.926| ACLList::matches: result is true
2015/01/21 17:24:05.926| ACLList::matches: checking users_skype
2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'users_skype'
2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'users_skype' is 1
2015/01/21 17:24:05.926| ACLList::matches: result is true
2015/01/21 17:24:05.926| aclmatchAclList: 0x7f330a6df098 returning true (AND list satisfied)
2015/01/21 17:24:05.926| ACLChecklist::markFinished: 0x7f330a6df098 checklist processing finished
2015/01/21 17:24:05.926| ACLChecklist::check: 0x7f330a6df098 match found, calling back with 1
2015/01/21 17:24:05.926| ACLFilledChecklist::checkCallback: 0x7f330a6df098 answer=1
2015/01/21 17:24:05.926| ACLChecklist::checkCallback: 0x7f330a6df098 answer=1
2015/01/21 17:24:05.926| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7f330a6df098
2015/01/21 17:24:05.926| ACLChecklist::~ACLChecklist: destroyed 0x7f330a6df098
2015/01/21 17:24:05.927| ACLChecklist::preCheck: 0x7f330a6df098 checking 'adaptation_access class_av_req deny CONNECT'
2015/01/21 17:24:05.927| ACLList::matches: checking CONNECT
2015/01/21 17:24:05.927| ACL::checklistMatches: checking 'CONNECT'
2015/01/21 17:24:05.927| ACL::ChecklistMatches: result for 'CONNECT' is 1
2015/01/21 17:24:05.927| ACLList::matches: result is true
2015/01/21 17:24:05.927| aclmatchAclList: 0x7f330a6df098 returning true (AND list satisfied)
2015/01/21 17:24:05.927| ACLChecklist::markFinished: 0x7f330a6df098 checklist processing finished
2015/01/21 17:24:05.927| ACLChecklist::check: 0x7f330a6df098 match found, calling back with 0
2015/01/21 17:24:05.927| ACLFilledChecklist::checkCallback: 0x7f330a6df098 answer=0
2015/01/21 17:24:05.927| ACLChecklist::checkCallback: 0x7f330a6df098 answer=0
2015/01/21 17:24:05.927| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7f330a6df098
2015/01/21 17:24:05.927| ACLChecklist::~ACLChecklist: destroyed 0x7f330a6df098
2015/01/21 17:24:08| Starting Squid Cache version 3.1.20 for x86_64-pc-linux-gnu...
I hope that this info will be useful. And i'm seeking your feedback...
NOTE that this setup, practically with no change, worked in squeeze
(squid 3.1.6-1.2+squeeze4).