<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On 14 April 2016 at 03:56, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class=""><div class="h5">On 14/04/2016 6:02 a.m., Odhiambo Washington wrote:<br>
> Hi Amos,<br>
><br>
> I bit the bullet and upgraded my FreeBSD-8.4 -> 9.3.<br>
><br>
> I am struggling to compile squid-3.5.16. I just have to find a way to make<br>
> it compile and run, by all means.<br>
><br>
> So now here is what happens:<br>
><br>
><br>
> #!/bin/sh<br>
> ./configure --prefix=/opt/squid-3.5 \<br>
> --enable-removal-policies="lru heap" \<br>
> --disable-epoll \<br>
> --with-pthreads \<br>
> --enable-storeio="ufs diskd rock aufs" \<br>
> --enable-delay-pools \<br>
> --enable-snmp \<br>
> --with-openssl=/usr \<br>
> --enable-forw-via-db \<br>
> --enable-cache-digests \<br>
> --enable-wccpv2 \<br>
> --enable-follow-x-forwarded-for \<br>
> --with-large-files \<br>
> --enable-esi \<br>
> --enable-kqueue \<br>
> --enable-icap-client \<br>
> --enable-kill-parent-hack \<br>
> --enable-ssl \<br>
> --enable-ssl-crtd \<br>
> --enable-url-rewrite-helpers \<br>
> --enable-xmalloc-statistics \<br>
> --enable-stacktraces \<br>
> --enable-zph-qos \<br>
> --enable-eui \<br>
> --with-nat-devpf \<br>
> --enable-pf-transparent \<br>
> --enable-ipf-transparent \<br>
> --enable-auth \<br>
><br>
</div></div>> My config.log output is here: *<a href="http://goo.gl/LcV1yN" rel="noreferrer" target="_blank">http://goo.gl/LcV1yN</a> <<a href="http://goo.gl/LcV1yN" rel="noreferrer" target="_blank">http://goo.gl/LcV1yN</a>>*<br>
<span class="">><br>
> And this is how the compile fails:Making all in negotiate_auth<br>
> Making all in kerberos<br>
> depbase=`echo negotiate_kerberos_auth.o | sed<br>
> 's|[^/]*$|.deps/&|;s|\.o$||'`; g++ -DHAVE_CONFIG_H -I../../..<br>
> -I../../../include -I../../../lib -I../../../src -I../../../include<br>
> -I/usr/include -I/usr/include -I../../../libltdl -I. -I/usr/include<br>
> -I/usr/local/include/libxml2 -I/usr/local/include/libxml2 -Wall<br>
> -Wpointer-arith -Wwrite-strings -Wcomments -Wshadow -Woverloaded-virtual<br>
> -Werror -pipe -D_REENTRANT -I/usr/local/include -g -O2 -march=native<br>
> -I/usr/local/include -MT negotiate_kerberos_auth.o -MD -MP -MF $depbase.Tpo<br>
> -c -o negotiate_kerberos_auth.o negotiate_kerberos_auth.cc && mv -f<br>
> $depbase.Tpo $depbase.Po<br>
> negotiate_kerberos_auth.cc: In function 'int main(int, char* const*)':<br>
> negotiate_kerberos_auth.cc:754: error:<br>
> 'gsskrb5_extract_authz_data_from_sec_context' was not declared in this scope<br>
> *** [negotiate_kerberos_auth.o] Error code 1<br>
><br>
<br>
</span>Strange. Check the Kerberos / krb5 libraries available are up to date.<br>
Or for now you may need to use one or more of these:<br>
--without-mit-kerberos \<br>
--without-heimdal-kerbers \<br>
--without-gssapi-kerberos<br>
<span class=""><br></span></blockquote><div><br></div><div>With luck, I have managed to get squid to compile successfully (after upgrading a few components here and there). I used:</div><div><br></div><div><div>#!/bin/sh</div><div>env LDFLAGS=-L/usr/local/lib CPPFLAGS=-I/usr/local/include CC=clang CXX=clang++ CPP=clang-cpp ./configure --prefix=/opt/squid-3.5 \</div><div> --enable-removal-policies="lru heap" \</div><div> --disable-epoll \</div><div> --with-pthreads \</div><div> --enable-storeio="ufs diskd rock aufs" \</div><div> --enable-delay-pools \</div><div> --enable-snmp \</div><div> --with-openssl=/usr \</div><div> --enable-forw-via-db \</div><div> --enable-cache-digests \</div><div> --enable-wccpv2 \</div><div> --enable-follow-x-forwarded-for \</div><div> --with-large-files \</div><div> --enable-esi \</div><div> --enable-kqueue \</div><div> --enable-icap-client \</div><div> --enable-kill-parent-hack \</div><div> --enable-ssl \</div><div> --enable-ssl-crtd \</div><div> --enable-url-rewrite-helpers \</div><div> --enable-xmalloc-statistics \</div><div> --enable-stacktraces \</div><div> --enable-zph-qos \</div><div> --enable-eui \</div><div> --with-nat-devpf \</div><div> --enable-pf-transparent \</div><div> --enable-ipf-transparent \</div><div> --with-nat-devpf \</div><div> --without-mit-kerberos \</div><div> --without-heimdal-kerbers \</div><div> --without-gssapi-kerberos \</div><div> --enable-auth</div></div><div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">
<br>
><br>
> I am getting closer I think.<br>
><br>
> The initial compile that I had before the upgrade from 8.4 to 9.3 cannot<br>
> run. Gives a different error:<br>
><br>
> 2016/04/13 14:12:13| Accepting NAT intercepted SSL bumped HTTPS Socket<br>
> connections at local=<a href="http://192.168.55.254:13129" rel="noreferrer" target="_blank">192.168.55.254:13129</a> remote=[::] FD 36 flags=41<br>
> 2016/04/13 14:12:13| Accepting ICP messages on [::]:3130<br>
> 2016/04/13 14:12:13| Sending ICP messages from [::]:3130<br>
> 2016/04/13 14:12:13| ERROR: NAT/TPROXY lookup failed to locate original IPs<br>
> on local=<a href="http://192.168.55.254:13128" rel="noreferrer" target="_blank">192.168.55.254:13128</a> remote=<a href="http://192.168.55.83:50648" rel="noreferrer" target="_blank">192.168.55.83:50648</a> FD 14 flags=33<br>
<br>
<br>
</span><<a href="http://www.squid-cache.org/Versions/v3/3.4/RELEASENOTES.html#ss2.4" rel="noreferrer" target="_blank">http://www.squid-cache.org/Versions/v3/3.4/RELEASENOTES.html#ss2.4</a>><br>
<br>
I dont think IPFilter (--enable-ipf-transparent) works on FreeBSD.<br>
<br>
paketFilte (PF, --enable-pf-transparent --with-nat-devpf) and IFPW<br>
(--enable-ipfw-transparent) should do.<br>
<br>
Be careful of the 'f' and 'w' characters there, it can be a bit<br>
confusing with them all those different names.<br>
<br>
<br>
NP: the same error message can occur if you have simply configured DNAT<br>
/ REDIRECT external to the Squid machine.<br></blockquote><div><br></div><div><br></div><div>I have it running now (redirecting using IPFilter/IPNAT), but once in a while I see this error about NAT:</div><div><br></div><div><br></div><div>2016/04/15 16:15:52| Starting Squid Cache version 3.5.16 for i386-unknown-freebsd9.3...</div><div>2016/04/15 16:15:52| Service Name: squid</div><div>2016/04/15 16:15:52| Process ID 21761</div><div>2016/04/15 16:15:52| Process Roles: master worker</div><div>2016/04/15 16:15:52| With 32768 file descriptors available</div><div>2016/04/15 16:15:52| Initializing IP Cache...</div><div>2016/04/15 16:15:52| DNS Socket created at [::], FD 9</div><div>2016/04/15 16:15:52| DNS Socket created at 0.0.0.0, FD 10</div><div>2016/04/15 16:15:52| Adding domain <a href="http://crownkenya.com">crownkenya.com</a> from /etc/resolv.conf</div><div>2016/04/15 16:15:52| Adding nameserver 192.168.55.254 from /etc/resolv.conf</div><div>2016/04/15 16:15:52| Adding nameserver 208.67.222.222 from /etc/resolv.conf</div><div>2016/04/15 16:15:52| Adding nameserver 208.67.220.220 from /etc/resolv.conf</div><div>2016/04/15 16:15:52| Adding nameserver 196.201.225.19 from /etc/resolv.conf</div><div>2016/04/15 16:15:52| Adding nameserver 41.222.10.26 from /etc/resolv.conf</div><div>2016/04/15 16:15:52| helperOpenServers: Starting 5/15 'ssl_crtd' processes</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| helperOpenServers: Starting 5/10 'perl' processes</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:52| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:53| WARNING: no_suid: setuid(0): (1) Operation not permitted</div><div>2016/04/15 16:15:53| Logfile: opening log stdio:/usr/local/squid/logs/access.log</div><div>2016/04/15 16:15:53| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec</div><div>2016/04/15 16:15:53| Store logging disabled</div><div>2016/04/15 16:15:53| Swap maxSize 20971520 + 131072 KB, estimated 1623276 objects</div><div>2016/04/15 16:15:53| Target number of buckets: 81163</div><div>2016/04/15 16:15:53| Using 131072 Store buckets</div><div>2016/04/15 16:15:53| Max Mem size: 131072 KB</div><div>2016/04/15 16:15:53| Max Swap size: 20971520 KB</div><div>2016/04/15 16:15:53| Rejecting swap file v1 to avoid cache index corruption. Forcing a full cache index rebuild. See Squid bug #3441.</div><div>2016/04/15 16:15:53| Rebuilding storage in /usr/local/squid/cache (clean log)</div><div>2016/04/15 16:15:53| Using Least Load store dir selection</div><div>2016/04/15 16:15:53| Set Current Directory to /usr/local/squid/logs</div><div>2016/04/15 16:15:53| Finished loading MIME types and icons.</div><div>2016/04/15 16:15:53| HTCP Disabled.</div><div>2016/04/15 16:15:53| Squid plugin modules loaded: 0</div><div>2016/04/15 16:15:53| Adaptation support is off.</div><div>2016/04/15 16:15:53| Accepting NAT intercepted HTTP Socket connections at local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=[::] FD 34 flags=41</div><div>2016/04/15 16:15:53| Accepting HTTP Socket connections at local=[::]:13130 remote=[::] FD 35 flags=9</div><div>2016/04/15 16:15:53| Accepting NAT intercepted SSL bumped HTTPS Socket connections at local=<a href="http://192.168.55.254:13129">192.168.55.254:13129</a> remote=[::] FD 36 flags=41</div><div>2016/04/15 16:15:53| Accepting ICP messages on [::]:3130</div><div>2016/04/15 16:15:53| Sending ICP messages from [::]:3130</div><div><div>2016/04/15 16:17:23| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=<a href="http://192.168.55.62:57724">192.168.55.62:57724</a> FD 29 flags=33</div><div>2016/04/15 16:18:53| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=<a href="http://192.168.55.62:57726">192.168.55.62:57726</a> FD 357 flags=33</div><div>2016/04/15 16:21:57| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=<a href="http://192.168.55.62:57742">192.168.55.62:57742</a> FD 29 flags=33</div><div>2016/04/15 16:23:21| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=<a href="http://192.168.55.62:57757">192.168.55.62:57757</a> FD 60 flags=33</div><div>2016/04/15 16:24:17| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=<a href="http://192.168.55.60:49166">192.168.55.60:49166</a> FD 79 flags=33</div><div>2016/04/15 16:24:17| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.55.254:13128">192.168.55.254:13128</a> remote=<a href="http://192.168.55.60:49168">192.168.55.60:49168</a> FD 79 flags=33</div></div><div><br></div><div><br></div><div>In any case, I am planning to rewrite the IPNAT rules into PF and use PF.</div><div>It's the inception stage so I haven't delved deep into ssl-bump configurations...</div><div><br></div><div><br></div></div>-- <br><div class="gmail_signature"><div dir="ltr"><div>Best regards,<br>Odhiambo WASHINGTON,<br>Nairobi,KE<br>+254 7 3200 0004/+254 7 2274 3223<br>"<span style="font-size:12.8px">Oh, the cruft.</span><span style="font-size:12.8px">"</span></div></div></div>
</div></div>