#695004 squid3: Restart after success external_acl (squid_ldap_group)

Package:
squid3
Source:
squid
Submitter:
Evgeny Yugov
Date:
2025-07-28 19:45:02 UTC
Severity:
normal
Tags:
#695004#5
Date:
2012-12-03 09:26:33 UTC
From:
To:
Dear Maintainer,

In authorization process

/var/log/squid3/cache.log:
....
2012/12/03 15:56:04.032| The request GET http://www.qnx.com/ is DENIED, because it matched 'AUTH'
2012/12/03 15:56:04.063| ZPH: Preserving TOS on miss, TOS=0
2012/12/03 15:56:04.064| The reply for GET http://www.qnx.com/ is ALLOWED, because it matched 'AUTH'
2012/12/03 15:56:04.064| ConnStateData::swanSong: FD 10
--------
2012/12/03 15:56:29.270| authenticateAuthUserAddIp: user 'john' has been seen at a new IP address (192.168.66.32:48789)
2012/12/03 15:56:29.270| aclMatchExternal: check_ad_group("john inet") = lookup needed
2012/12/03 15:56:29.270| aclMatchExternal: "john inet": entry=@0, age=0
2012/12/03 15:56:29.271| aclMatchExternal: "john inet": queueing a call.
2012/12/03 15:56:29.271| aclMatchExternal: "john inet": return -1.
2012/12/03 15:56:29.271| externalAclLookup: lookup in 'check_ad_group' for 'john inet'
Connected OK
group filter '(&(objectclass=user)(sAMAccountName=john)(memberof=cn=inet,ou=usergroups,dc=nsk,dc=lanta,dc=ru))', searchbase 'dc=nsk,dc=lanta,dc=ru'
2012/12/03 15:56:29.275| externalAclHandleReply: reply="OK"
2012/12/03 15:56:29.276| external_acl_cache_add: Adding 'john inet' = 1
2012/12/03 15:56:29.276| aclMatchExternal: check_ad_group = 1
2012/12/03 15:56:29.276| The request GET http://www.qnx.com/ is ALLOWED, because it matched 'localnet'
2012/12/03 15:56:29.276| client_side_request.cc(556) clientAccessCheck2: No adapted_http_access configuration.
2012/12/03 15:56:29.277| The request GET http://www.qnx.com/ is ALLOWED, because it matched 'localnet'
2012/12/03 15:56:29.744| ctx: enter level  0: 'http://www.qnx.com/'
2012/12/03 15:56:29.745| hdr cc: unknown cache-directive: near 'post-check=0, pre-check=0' in '0xbfea9114'
2012/12/03 15:56:29.745| hdr cc: unknown cache-directive: near 'pre-check=0' in '0xbfea9114'
2012/12/03 15:56:29.745| ctx: exit level  0
2012/12/03 15:56:29.745| ZPH: Preserving TOS on miss, TOS=0
2012/12/03 15:56:29.746| hdr cc: unknown cache-directive: near 'post-check=0, pre-check=0' in '0xbfea8e44'
2012/12/03 15:56:29.746| hdr cc: unknown cache-directive: near 'pre-check=0' in '0xbfea8e44'
2012/12/03 15:56:32| Starting Squid Cache version 3.1.20 for i486-pc-linux-gnu...

/var/log/syslog:
....
Dec  3 15:56:29 squid kernel: [11044.464660] squid3[9204]: segfault at c ip b76ad6c6 sp bfea8c20 error 4 in squid3[b74cd000+300000]
Dec  3 15:56:29 squid squid[8726]: Squid Parent: child process 9204 exited due to signal 11 with status 0
Dec  3 15:56:32 squid squid[8726]: Squid Parent: child process 9233 started
....

#695004#10
Date:
2013-03-26 12:50:51 UTC
From:
To:
Hi,

Our squid3 is also segfaulting with a external authenticator on the 1st
request that hits the proxy.

We are using Debian wheezy as of 26-03-2013, Our squid version is below.
We are using the ntlm_auth and winbind authenticators.

Kind regards,

Seth

root@lsproxy2:/etc/samba# aptitude show squid3
Pakket: squid3
Staat: geïnstalleerd
Automatisch geïnstalleerd: nee
Versie: 3.1.20-2.2
Prioriteit: optioneel
Sectie: web
Beheerder: Luigi Gangitano <luigi@debian.org>
Architectuur: amd64
Ongecomprimeerde grootte: 4205 k
Hangt af van: libc6 (>= 2.7), libcap2 (>= 2.10), libcomerr2 (>= 1.01),
libdb5.1, libexpat1 (>= 2.0.1), libgcc1 (>= 1:4.1.1), libgssapi-krb5-2
(>= 1.10+dfsg~), libk5crypto3 (>= 1.6.dfsg.2), libkrb5-3 (>= 1.6.dfsg.2),
              libldap-2.4-2 (>= 2.4.7), libltdl7 (>= 2.4.2), libpam0g
(>= 0.99.7.1), libsasl2-2 (>= 2.1.24), libstdc++6 (>= 4.4.0), libxml2
(>= 2.7.4), netbase, adduser, logrotate (>= 3.5.4-1), squid3-common (=
              3.1.20-2.2), lsb-base
Suggereert: squidclient, squid-cgi, resolvconf (>= 0.40), smbclient, ufw
Beschrijving: Full featured Web Proxy cache (HTTP proxy)
 Squid is a high-performance proxy caching server for web clients,
supporting FTP, gopher, and HTTP data objects.

 Squid version 3 is a major rewrite of Squid in C++ and introduces a
number of new features including ICAP and ESI support.
Homepage: http://www.squid-cache.org

#695004#15
Date:
2013-05-28 14:24:25 UTC
From:
To:
external_acl_type user_memberof_acl %LOGIN /usr/lib/squid3/squid_ldap_group -R -K -S \
        -b "ou=Ukraine,DC=domain,DC=com" \
        -D "webproxy.svc@gfk.com" \
        -W "/etc/squid3/ldap.passwd" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,OU=Role,OU=Groups,OU=Ukraine,DC=domain,DC=com))" \
        -h dc01.domain.com

With
         http_access allow Proxy_Access_group_acl
         http_access allow authenticated
everything works fine;

With
         http_access allow authenticated Proxy_Access_group_acl
I get squid3 segfault and then squid restart automatically.

#695004#20
Date:
2013-07-23 13:25:30 UTC
From:
To:
Squid segfault as soon as the request hit external_acl.  Squid works fine, if I remove the external_acl statements from my acl's. I use /usr/lib/squid3/squid_ldap_group

Example external acl:
external_acl_type LDAP_Auth_MOHR ttl=1800 negative_ttl=300 children=15 %LOGIN /usr/lib/squid3/squid_ldap_group -R -b "dc=org,dc=example,dc=com" -D "cn=binduser,ou=Proxy,dc=org,dc=example,dc=com" -w "password" -f "(&(objectclass=person)(sAMAccountName=%u)(memberof=cn=%g,ou=Proxy,dc=org,dc=example,dc=com))" -h A.B.C.D -p 3268 -v 3


/var/log/kernel
Jul 23 15:08:51 gate09-neu kernel: [ 1299.373335] squid3[3676]: segfault at 18 ip 00007f87e9250f9e sp 00007fff964453f0 error 4 in squid3[7f87e905e000+301000]
Jul 23 15:08:55 gate09-neu kernel: [ 1303.055208] squid3[3767]: segfault at 18 ip 00007f31c4a13f9e sp 00007fffc5224d10 error 4 in squid3[7f31c4821000+301000]
Jul 23 15:08:59 gate09-neu kernel: [ 1306.917126] squid3[3801]: segfault at 18 ip 00007f7f9ce90f9e sp 00007fff08fc1910 error 4 in squid3[7f7f9cc9e000+301000]
Jul 23 15:09:03 gate09-neu kernel: [ 1310.512300] squid3[3835]: segfault at 18 ip 00007f050671bf9e sp 00007fff7273d050 error 4 in squid3[7f0506529000+301000]
Jul 23 15:09:06 gate09-neu kernel: [ 1314.195142] squid3[3869]: segfault at 18 ip 00007fd0d5ec1f9e sp 00007fff409a5f50 error 4 in squid3[7fd0d5ccf000+301000]
Jul 23 15:09:10 gate09-neu kernel: [ 1318.062694] squid3[3903]: segfault at 40 ip 00007f7567481817 sp 00007fff435cc0a0 error 4 in squid3[7f756728f000+301000]

#695004#25
Date:
2013-08-09 08:55:33 UTC
From:
To:
Dear Maintainer,

do you think, that there is a little chance for you to find some time to fix this bug? If you need more information to reproduce this error, ill try to give you the needed informations.


Regards

Jörg

#695004#32
Date:
2014-10-30 09:29:59 UTC
From:
To:
tags 695004 +moreinfo
thanks

Let’s tag it moreinfo and see if it’s reproducible.

Regards,

L

#695004#37
Date:
2015-01-21 16:34:45 UTC
From:
To:
Caro Luigi,

I've had previously commented bug #486211, and i don't know if they are the
same, but surely the trouble came from 'external_acl'.
In that comment i say that in two similar system depicted the trouble, the
other no: clearly, only on the troubling one i've defined my 'skype' ACL...


I've in use an ACL to prevent skype use, apart some hosts (with fixed IP) or
by some users (some group membership).

My configuration is:

  auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain=SANVITO --require-membership-of="SANVITO\\domusers"
  auth_param ntlm children 5

  external_acl_type check_ntgroup %LOGIN /usr/lib/squid3/wbinfo_group.pl
  acl auth_required proxy_auth REQUIRED
  acl CONNECT method CONNECT
  acl block_skype url_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
  acl users_skype external check_ntgroup ispac ced dirammre
  acl skype src "/etc/squid3/lists/skype.list"
  acl apertura time MTWHF 08:00-18:00

  http_access allow CONNECT block_skype apertura skype
  http_access allow CONNECT block_skype apertura auth_required users_skype
  http_access deny CONNECT block_skype apertura

With this setup, everytime i try to access Skype (or, indeed, an https site
using ip literal) squid require me auth, seems to accept it but refuse to
connect.

After testing all pieces of tools (eg, /usr/bin/ntlm_auth and
/usr/lib/squid3/wbinfo_group.pl) and found it working, i've finally
correlated the missing access with the sigsev, founding it fully
reproducible.

So, i've tried substituting ACL:
  http_access allow CONNECT block_skype apertura auth_required users_skype
with:
  http_access allow CONNECT block_skype apertura auth_required

and now skype works, ans squid does not sigsev.


Setting debug to 9 for external ACL i can see in cache.log:

 2015/01/21 16:41:07.920| aclMatchExternal: acl="check_ntgroup"
 2015/01/21 16:41:07.920| aclMatchExternal: check_ntgroup("gaio ispac ced dirammre") = lookup needed
 2015/01/21 16:41:07.920| aclMatchExternal: "gaio ispac ced dirammre": entry=@0, age=0
 2015/01/21 16:41:07.920| aclMatchExternal: "gaio ispac ced dirammre": queueing a call.
 2015/01/21 16:41:07.920| aclMatchExternal: "gaio ispac ced dirammre": return -1.
 2015/01/21 16:41:07.920| externalAclLookup: lookup in 'check_ntgroup' for 'gaio ispac ced dirammre'
 2015/01/21 16:41:07.920| externalAclLookup: looking up for 'gaio ispac ced dirammre' in 'check_ntgroup'.
 2015/01/21 16:41:07.920| externalAclLookup: will wait for the result of 'gaio ispac ced dirammre' in 'check_ntgroup' (ch=0x7fc85b0128c8).
 2015/01/21 16:41:07.997| externalAclHandleReply: reply="OK"
 2015/01/21 16:41:07.997| external_acl_cache_add: Adding 'gaio ispac ced dirammre' = 1
 2015/01/21 16:41:07.997| aclMatchExternal: acl="check_ntgroup"
 2015/01/21 16:41:07.997| aclMatchExternal: check_ntgroup = 1
 2015/01/21 16:41:11| Starting Squid Cache version 3.1.20 for x86_64-pc-linux-gnu...

so, squid run correctly the external ACL script and only AFTER that hang.

Trying to put all ACL in debug mode, i've hit:

 2015/01/21 17:24:05.849| ACL::FindByName 'users_skype'
 2015/01/21 17:24:05.849| ACLChecklist::asyncInProgress: 0x7f330a6df098 async set to 1
 2015/01/21 17:24:05.849| aclmatchAclList: async=1 nodeMatched=0 async_in_progress=1 lastACLResult() = 0 finished() = 0
 2015/01/21 17:24:05.926| ACLChecklist::asyncInProgress: 0x7f330a6df098 async set to 0
 2015/01/21 17:24:05.926| ACLChecklist::preCheck: 0x7f330a6df098 checking 'http_access allow CONNECT block_skype apertura auth_required users_skype'
 2015/01/21 17:24:05.926| ACLList::matches: checking CONNECT
 2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'CONNECT'
 2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'CONNECT' is 1
 2015/01/21 17:24:05.926| ACLList::matches: result is true
 2015/01/21 17:24:05.926| ACLList::matches: checking block_skype
 2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'block_skype'
 2015/01/21 17:24:05.926| aclRegexData::match: checking '151.49.25.89:443'
 2015/01/21 17:24:05.926| aclRegexData::match: looking for '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'
 2015/01/21 17:24:05.926| aclRegexData::match: match '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' found in '151.49.25.89:443'
 2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'block_skype' is 1
 2015/01/21 17:24:05.926| ACLList::matches: result is true
 2015/01/21 17:24:05.926| ACLList::matches: checking apertura
 2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'apertura'
 2015/01/21 17:24:05.926| aclMatchTime: checking 1044 in 0-0, weekbits=0
 2015/01/21 17:24:05.926| aclMatchTime: checking 1044 in 480-1080, weekbits=3e
 2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'apertura' is 1
 2015/01/21 17:24:05.926| ACLList::matches: result is true
 2015/01/21 17:24:05.926| ACLList::matches: checking auth_required
 2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'auth_required'
 2015/01/21 17:24:05.926| ACL::cacheMatchAcl: cache hit on acl 'auth_required' (0x7f32fb25b090)
 2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'auth_required' is 1
 2015/01/21 17:24:05.926| ACLList::matches: result is true
 2015/01/21 17:24:05.926| ACLList::matches: checking users_skype
 2015/01/21 17:24:05.926| ACL::checklistMatches: checking 'users_skype'
 2015/01/21 17:24:05.926| ACL::ChecklistMatches: result for 'users_skype' is 1
 2015/01/21 17:24:05.926| ACLList::matches: result is true
 2015/01/21 17:24:05.926| aclmatchAclList: 0x7f330a6df098 returning true (AND list satisfied)
 2015/01/21 17:24:05.926| ACLChecklist::markFinished: 0x7f330a6df098 checklist processing finished
 2015/01/21 17:24:05.926| ACLChecklist::check: 0x7f330a6df098 match found, calling back with 1
 2015/01/21 17:24:05.926| ACLFilledChecklist::checkCallback: 0x7f330a6df098 answer=1
 2015/01/21 17:24:05.926| ACLChecklist::checkCallback: 0x7f330a6df098 answer=1
 2015/01/21 17:24:05.926| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7f330a6df098
 2015/01/21 17:24:05.926| ACLChecklist::~ACLChecklist: destroyed 0x7f330a6df098
 2015/01/21 17:24:05.927| ACLChecklist::preCheck: 0x7f330a6df098 checking 'adaptation_access     class_av_req deny CONNECT'
 2015/01/21 17:24:05.927| ACLList::matches: checking CONNECT
 2015/01/21 17:24:05.927| ACL::checklistMatches: checking 'CONNECT'
 2015/01/21 17:24:05.927| ACL::ChecklistMatches: result for 'CONNECT' is 1
 2015/01/21 17:24:05.927| ACLList::matches: result is true
 2015/01/21 17:24:05.927| aclmatchAclList: 0x7f330a6df098 returning true (AND list satisfied)
 2015/01/21 17:24:05.927| ACLChecklist::markFinished: 0x7f330a6df098 checklist processing finished
 2015/01/21 17:24:05.927| ACLChecklist::check: 0x7f330a6df098 match found, calling back with 0
 2015/01/21 17:24:05.927| ACLFilledChecklist::checkCallback: 0x7f330a6df098 answer=0
 2015/01/21 17:24:05.927| ACLChecklist::checkCallback: 0x7f330a6df098 answer=0
 2015/01/21 17:24:05.927| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7f330a6df098
 2015/01/21 17:24:05.927| ACLChecklist::~ACLChecklist: destroyed 0x7f330a6df098
 2015/01/21 17:24:08| Starting Squid Cache version 3.1.20 for x86_64-pc-linux-gnu...


I hope that this info will be useful. And i'm seeking your feedback...


NOTE that this setup, practically with no change, worked in squeeze
(squid 3.1.6-1.2+squeeze4).