<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
- From my experience, it may occur as a result of forming the fake
certificate zero length (in the case of the SQUID can not complete
its formation for any reason).<br>
<br>
In turn, the formation of such a certificate occurs in particular
due to any error in the code of the SQUID characteristics or if
server certificate. In particular, one of these servers is iTunes.<br>
<br>
09.04.15 19:00, Vdoctor пишет:<br>
<span style="white-space: pre;">> Yury,<br>
><br>
> I checked the source code (3.4/3.5) ssl_crtd, the default
size is 2048.<br>
> -b fs_block_size File system block size in bytes.
Need for processing<br>
> natural size of certificate on disk.
Default value is<br>
> 2048 bytes."<br>
><br>
> /**<br>
> \ingroup ssl_crtd<br>
> * This is the external ssl_crtd process.<br>
> */<br>
> int main(int argc, char *argv[])<br>
> {<br>
> try {<br>
> size_t max_db_size = 0;<br>
> size_t fs_block_size = 2048;<br>
><br>
><br>
> But the crazy thing is the index.txt (last line) is wrong,
not complete. It seems the tool writes/saves wrong data that's why
it becomes corrupted and crash the Squid.<br>
><br>
> We have tried with a single ssl_crtd in the squid.conf, then
one per worker, the same corruption.<br>
><br>
> Bye Fred<br>
><br>
> -----Message d'origine-----<br>
> De : squid-users
[<a class="moz-txt-link-freetext" href="mailto:squid-users-bounces@lists.squid-cache.org">mailto:squid-users-bounces@lists.squid-cache.org</a>] De la part de
Yuri Voinov<br>
> Envoyé : jeudi 9 avril 2015 14:52<br>
> À : <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> Objet : ***SPAM*** Re: [squid-users] Random SSL bump DB
corruption<br>
><br>
><br>
> Don't think this is critical. What is native fs block size?<br>
><br>
> 09.04.15 13:29, Stakres пишет:<br>
> > Hi Yuri,<br>
><br>
> > We have checked the sslproxy_capath, all certifs
updated.<br>
> > OpenSSL is: OpenSSL 1.0.1e 11 Feb 2013 (Debian 7.8)<br>
><br>
> > Additional point, the auto-signed certif is a 1024,
could it be the<br>
> problem<br>
> > ?<br>
> > Maybe we need to use the ssl_crtd with the option "-b
1024"<br>
> > what do you think ?<br>
><br>
> > example of corrupted db:<br>
> > *V 250402155004Z
7307E4A4E7FC6483C2B1D533821A7D2356DF1B88 <br>
> unknown<br>
> >
/CN=r2---sn-q4f7sn7z.googlevideo.com+Sign=signTrusted+SignHash=SHA256<br>
> > V 250402155004Z
2D1FC87E26AC4D8AB1E6F3B45E2C69EB36C7F8D3 <br>
> unknown<br>
> > /CN=seal.verisign.com+Sign=signTrusted+SignHash=SHA256<br>
> > 6<br>
> > *<br>
><br>
> > the squid crash when the index.txt becomes wrong...
weird...<br>
><br>
> > Bye Fred<br>
><br>
><br>
><br>
> > --<br>
> > View this message in context:<br>
>
<a class="moz-txt-link-freetext" href="http://squid-web-proxy-cache.1019090.n4.nabble.com/Random-SSL-bump-DB-corruption-tp4670289p4670656.html">http://squid-web-proxy-cache.1019090.n4.nabble.com/Random-SSL-bump-DB-corruption-tp4670289p4670656.html</a><br>
> > Sent from the Squid - Users mailing list archive at
Nabble.com.<br>
> > _______________________________________________<br>
> > squid-users mailing list<br>
> > <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> > <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJVJni5AAoJENNXIZxhPexGTAkIAIx0ar6l6z84snTTem8XXZtD
<br>
oO/MnUvMb5FB+2IRp74dq7cO5KzlcZUeOvbbmsMsXR2CAraPqiLyTb3m3/eKqLS1
<br>
QdDRZZIuvV2GKyNizEzwwCV1W7QRjApbELc36rZC8fXVv5WArisDg3kk/Ycu3OeF
<br>
p0TBHhMNBvFKd+8Ve8xUqKQn3J6fYAYB8FHBzpssmfGaaGK7PeDmZ3LofeYHlqDP
<br>
eY7WKCzBQ7wOkezWJopBqkZH72OorLYHxOSanrNlbZ+5n2iO5wbuocm03F/QMJBc
<br>
uTN71irqNwHiqGd95ThQjSlhOXHvUSHEKssALUgmfHWEtIUy1PhLQvCksLm2510=
<br>
=ai9y
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>