[squid-users] squid "internal?" loop - with no firewall nat going on..?
Klavs Klavsen
kl at vsen.dk
Tue Mar 10 12:29:15 UTC 2015
Hi,
I just setup a squid trying to get it to work in intercept mode..
I seem to hit some squid internal loop where it goes haywire internally
somehow?
When I access it via port 3129 (tried from both localhost and from
another host - same problem) - using
curl -H "Host: www.bt.dk" http://ip-of-squid-box/
the request just hangs..
I enabled debug logging and can see squid logging this:
----------
2015/03/10 13:07:47.028 kid1| client_side.cc(2407) parseHttpRequest:
HTTP Client local=127.0.0.1:3129 remote=127.0.0.1:45060 FD 17 flags=33
2015/03/10 13:07:47.028 kid1| client_side.cc(2408) parseHttpRequest:
HTTP Client REQUEST:
---------
GET / HTTP/1.1
User-Agent: curl/7.29.0
Accept: */*
Host: www.bt.dk
X-Forwarded-For: 127.0.0.1
Cache-Control: max-age=259200
Connection: keep-alive
----------
2015/03/10 13:07:47.028 kid1| client_side_request.cc(759)
clientAccessCheckDone: The request GET http://www.bt.dk/ is ALLOWED;
last ACL checked: localhost
2015/03/10 13:07:47.028 kid1| client_side_request.cc(734)
clientAccessCheck2: No adapted_http_access configuration. default: ALLOW
2015/03/10 13:07:47.028 kid1| client_side_request.cc(759)
clientAccessCheckDone: The request GET http://www.bt.dk/ is ALLOWED;
last ACL checked: localhost
2015/03/10 13:07:47.028 kid1| FwdState.cc(124) FwdState: Forwarding
client request local=127.0.0.1:3129 remote=127.0.0.1:45060 FD 17
flags=33, url=http://www.bt.dk/
2015/03/10 13:07:47.028 kid1| peer_select.cc(286) peerSelectDnsPaths:
Found sources for 'http://www.bt.dk/'
2015/03/10 13:07:47.028 kid1| peer_select.cc(287) peerSelectDnsPaths:
always_direct = ALLOWED
2015/03/10 13:07:47.028 kid1| peer_select.cc(288) peerSelectDnsPaths:
never_direct = DENIED
2015/03/10 13:07:47.028 kid1| peer_select.cc(294) peerSelectDnsPaths:
ORIGINAL_DST = local=0.0.0.0 remote=127.0.0.1:3129 flags=1
2015/03/10 13:07:47.028 kid1| peer_select.cc(301) peerSelectDnsPaths:
timedout = 0
2015/03/10 13:07:47.028 kid1| TcpAcceptor.cc(220) doAccept: New
connection on FD 14
2015/03/10 13:07:47.028 kid1| TcpAcceptor.cc(295) acceptNext: connection
on local=[::]:3129 remote=[::] FD 14 flags=41
2015/03/10 13:07:47.029 kid1| http.cc(2219) sendRequest: HTTP Server
local=127.0.0.1:45061 remote=127.0.0.1:3129 FD 18 flags=1
2015/03/10 13:07:47.029 kid1| http.cc(2220) sendRequest: HTTP Server
REQUEST:
---------
GET / HTTP/1.1
User-Agent: curl/7.29.0
Accept: */*
Host: www.bt.dk
X-Forwarded-For: 127.0.0.1, 127.0.0.1
Cache-Control: max-age=259200
Connection: keep-alive
When I then ctrl-c the client request..
it ends with
X-Forwarded-For: error, 127.0.0.1, 127.0.0.1, (and 100+ of , 127.0.0.1)
##########################################
end log output snippet
##########################################
and the logs keep going with X-Forwarded-For getting , 127.0.0.1 added
ad infinitum..
I tcpdump'ed and saw no output from squid - so it seems to be an
internal loop in squid.
My config is:
# predefined ACLs
#acl localhost src 127.0.0.1 ::1
#acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged)
machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# predefined http_accesses
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# user-defined ACLs
# user-defined http_accesses
http_access allow localnet
http_access allow localhost
http_access deny all
# user-defined icp_access
# user-defined http_port
http_port 3128
# user-defined tcp_outgoing_addresses
# user-defined cache-dirs
# general settings
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid
maximum_object_size_in_memory 512 KB
maximum_object_size 4096 KB
#ignore_expect_100 off
cache_mgr root
client_persistent_connections on
server_persistent_connections on
#forwarded_for on
via off
access_log /var/log/squid/access.log squid
cache_mem 256 MB
cache_store_log /var/log/squid/store.log
cache_log /var/log/squid/cache.log
cache deny all
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# user-defined configuration settings from config_hash
sslcrtd_program /usr/lib64/squid/ssl_crtd -s
/etc/ssl/certs/cache/ -M 4MB
sslcrtd_children 8 startup=1 idle=1
https_port 3130 intercept ssl-bump
generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
key=/etc/squid/ca.private cert=/etc/squid/ca.cert
sslproxy_flags DONT_VERIFY_PEER
always_direct allow all
http_port 3129 intercept
shutdown_lifetime 3
sslproxy_cert_error allow all
ssl_bump server-first all
p.s. it's a self-compiled squid-3.4.9 on centos 7.
--
Regards,
Klavs Klavsen, GSEC - kl at vsen.dk - http://www.vsen.dk - Tlf. 61281200
"Those who do not understand Unix are condemned to reinvent it, poorly."
--Henry Spencer
More information about the squid-users
mailing list