<div dir="ltr"><div><div dir="ltr"><br></div>Hi Eliezer, I am running on amazon linux 2 ami which I suppose is based on centos. <br>I ran the uname -a command and this is what I get;;<br>Linux ip-172-24-9-143.us-east-2.compute.internal 4.14.256-197.484.amzn2.x86_64 #1 SMP Tue Nov 30 00:17:50 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux<br><br>[ec2-user@ip-172-24-9-143 ~]$ openssl version<br>OpenSSL 1.0.2k-fips 26 Jan 2017<br><br></div><div>thanks so much and let me know the script and I can run on this machine. <br></div><div>Usama</div><div><br><div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Feb 25, 2022 at 5:34 AM <<a href="mailto:squid-users-request@lists.squid-cache.org">squid-users-request@lists.squid-cache.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send squid-users mailing list submissions to<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:squid-users-request@lists.squid-cache.org" target="_blank">squid-users-request@lists.squid-cache.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:squid-users-owner@lists.squid-cache.org" target="_blank">squid-users-owner@lists.squid-cache.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of squid-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Getting SSL Connection Errors (Eliezer Croitoru)<br>
2. Random trouble with image downloads (Dave Blanchard)<br>
3. slow down response to broken clients ? (Dieter Bloms)<br>
4. Re: getsockopt failures, although direct access to intercept<br>
ports is blocked (Amos Jeffries)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 25 Feb 2022 07:01:12 +0200<br>
From: "Eliezer Croitoru" <<a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a>><br>
To: "'Usama Mehboob'" <<a href="mailto:musamamehboob@gmail.com" target="_blank">musamamehboob@gmail.com</a>>,<br>
<<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>><br>
Subject: Re: [squid-users] Getting SSL Connection Errors<br>
Message-ID: <006f01d82a04$b678b770$236a2650$@<a href="http://gmail.com" rel="noreferrer" target="_blank">gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hey Usama,<br>
<br>
<br>
<br>
There are more missing details on the system.<br>
<br>
If you provide the OS and squid details I might be able to provide a script that will pull most of the relevant details on the system.<br>
<br>
I don?t know about this specific issue yet and it seems like there is a SSL related issue and it might not be even related to Squid.<br>
<br>
(@Alex Or @Chrisots might know better then me)<br>
<br>
<br>
<br>
All The Bests,<br>
<br>
<br>
<br>
----<br>
<br>
Eliezer Croitoru<br>
<br>
NgTech, Tech Support<br>
<br>
Mobile: +972-5-28704261<br>
<br>
Email: <a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a> <mailto:<a href="mailto:ngtech1ltd@gmail.com" target="_blank">ngtech1ltd@gmail.com</a>> <br>
<br>
<br>
<br>
From: squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>> On Behalf Of Usama Mehboob<br>
Sent: Thursday, February 24, 2022 23:45<br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: [squid-users] Getting SSL Connection Errors<br>
<br>
<br>
<br>
Hi I have a squid running on a linux box ( about 16GB ram and 4 cpu ) -- it runs fine for the most part but when I am launching multiple jobs that are connecting with salesforce BulkAPI, sometimes connections are dropped. its not predictable and happens only when there is so much load on squid. Can anyone shed some light on this? what can I do? is it a file descriptor issue?<br>
<br>
I see only these error messages from the cache logs<br>
```<br>
PeerConnector.cc(639) handleNegotiateError: Error (error:04091068:rsa routines:INT_RSA_VERIFY:bad signature) but, hold write on SSL connection on FD 109<br>
```<br>
<br>
----------------Config file ----------------<br>
visible_hostname squid <br>
<br>
#<br>
# Recommended minimum configuration:<br>
#<br>
<br>
# Example rule allowing access from your local networks.<br>
# Adapt to list your (internal) IP networks from where browsing<br>
# should be allowed<br>
acl localnet src <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a> <<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a>> # RFC1918 possible internal network<br>
acl localnet src <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a> <<a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a>> # RFC1918 possible internal network<br>
acl localnet src <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> <<a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a>> # RFC1918 possible internal network<br>
acl localnet src fc00::/7 # RFC 4193 local private network range<br>
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<br>
<br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 # http<br>
###acl Safe_ports port 21 # ftp testing after blocking itp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 70 # gopher<br>
acl Safe_ports port 210 # wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>
acl Safe_ports port 591 # filemaker<br>
acl Safe_ports port 777 # multiling http<br>
acl CONNECT method CONNECT<br>
<br>
#<br>
# Recommended minimum Access Permission configuration:<br>
#<br>
# Deny requests to certain unsafe ports<br>
http_access deny !Safe_ports<br>
<br>
# Deny CONNECT to other than secure SSL ports<br>
http_access deny CONNECT !SSL_ports<br>
#http_access allow CONNECT SSL_ports<br>
<br>
# Only allow cachemgr access from localhost<br>
http_access allow localhost manager<br>
http_access deny manager<br>
<br>
# We strongly recommend the following be uncommented to protect innocent<br>
# web applications running on the proxy server who think the only<br>
# one who can access services on "localhost" is a local user<br>
#http_access deny to_localhost<br>
<br>
#<br>
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS<br>
#<br>
<br>
# Example rule allowing access from your local networks.<br>
# Adapt localnet in the ACL section to list your (internal) IP networks<br>
# from where browsing should be allowed<br>
<br>
# And finally deny all other access to this proxy<br>
<br>
# Squid normally listens to port 3128<br>
#http_port 3128<br>
http_port 3129 intercept<br>
https_port 3130 cert=/etc/squid/ssl/squid.pem ssl-bump intercept <br>
http_access allow SSL_ports #-- this allows every https website<br>
acl step1 at_step SslBump1 <br>
acl step2 at_step SslBump2 <br>
acl step3 at_step SslBump3 <br>
ssl_bump peek step1 all <br>
<br>
# Deny requests to proxy instance metadata <br>
acl instance_metadata dst 169.254.169.254 <br>
http_access deny instance_metadata <br>
<br>
# Filter HTTP Only requests based on the whitelist <br>
#acl allowed_http_only dstdomain .<a href="http://veevasourcedev.com" rel="noreferrer" target="_blank">veevasourcedev.com</a> <<a href="http://veevasourcedev.com" rel="noreferrer" target="_blank">http://veevasourcedev.com</a>> .<a href="http://google.com" rel="noreferrer" target="_blank">google.com</a> <<a href="http://google.com" rel="noreferrer" target="_blank">http://google.com</a>> .<a href="http://pypi.org" rel="noreferrer" target="_blank">pypi.org</a> <<a href="http://pypi.org" rel="noreferrer" target="_blank">http://pypi.org</a>> .<a href="http://youtube.com" rel="noreferrer" target="_blank">youtube.com</a> <<a href="http://youtube.com" rel="noreferrer" target="_blank">http://youtube.com</a>> <br>
#acl allowed_http_only dstdomain .<a href="http://amazonaws.com" rel="noreferrer" target="_blank">amazonaws.com</a> <<a href="http://amazonaws.com" rel="noreferrer" target="_blank">http://amazonaws.com</a>> <br>
#acl allowed_http_only dstdomain .<a href="http://veevanetwork.com" rel="noreferrer" target="_blank">veevanetwork.com</a> <<a href="http://veevanetwork.com" rel="noreferrer" target="_blank">http://veevanetwork.com</a>> .<a href="http://veevacrm.com" rel="noreferrer" target="_blank">veevacrm.com</a> <<a href="http://veevacrm.com" rel="noreferrer" target="_blank">http://veevacrm.com</a>> .<a href="http://veevacrmdi.com" rel="noreferrer" target="_blank">veevacrmdi.com</a> <<a href="http://veevacrmdi.com" rel="noreferrer" target="_blank">http://veevacrmdi.com</a>> .<a href="http://veeva.com" rel="noreferrer" target="_blank">veeva.com</a> <<a href="http://veeva.com" rel="noreferrer" target="_blank">http://veeva.com</a>> .<a href="http://veevavault.com" rel="noreferrer" target="_blank">veevavault.com</a> <<a href="http://veevavault.com" rel="noreferrer" target="_blank">http://veevavault.com</a>> .<a href="http://vaultdev.com" rel="noreferrer" target="_blank">vaultdev.com</a> <<a href="http://vaultdev.com" rel="noreferrer" target="_blank">http://vaultdev.com</a>> .<a href="http://veevacrmqa.com" rel="noreferrer" target="_blank">veevacrmqa.com</a> <<a href="http://veevacrmqa.com" rel="noreferrer" target="_blank">http://veevacrmqa.com</a>> <br>
#acl allowed_http_only dstdomain .<a href="http://documentforce.com" rel="noreferrer" target="_blank">documentforce.com</a> <<a href="http://documentforce.com" rel="noreferrer" target="_blank">http://documentforce.com</a>> .<a href="http://sforce.com" rel="noreferrer" target="_blank">sforce.com</a> <<a href="http://sforce.com" rel="noreferrer" target="_blank">http://sforce.com</a>> .<a href="http://force.com" rel="noreferrer" target="_blank">force.com</a> <<a href="http://force.com" rel="noreferrer" target="_blank">http://force.com</a>> .<a href="http://forceusercontent.com" rel="noreferrer" target="_blank">forceusercontent.com</a> <<a href="http://forceusercontent.com" rel="noreferrer" target="_blank">http://forceusercontent.com</a>> .<a href="http://force-user-content.com" rel="noreferrer" target="_blank">force-user-content.com</a> <<a href="http://force-user-content.com" rel="noreferrer" target="_blank">http://force-user-content.com</a>> .<a href="http://lightning.com" rel="noreferrer" target="_blank">lightning.com</a> <<a href="http://lightning.com" rel="noreferrer" target="_blank">http://lightning.com</a>> .<a href="http://salesforce.com" rel="noreferrer" target="_blank">salesforce.com</a> <<a href="http://salesforce.com" rel="noreferrer" target="_blank">http://salesforce.com</a>> .<a href="http://salesforceliveagent.com" rel="noreferrer" target="_blank">salesforceliveagent.com</a> <<a href="http://salesforceliveagent.com" rel="noreferrer" target="_blank">http://salesforceliveagent.com</a>> .<a href="http://salesforce-communities.com" rel="noreferrer" target="_blank">salesforce-communities.com</a> <<a href="http://salesforce-communities.com" rel="noreferrer" target="_blank">http://salesforce-communities.com</a>> .<a href="http://salesforce-experience.com" rel="noreferrer" target="_blank">salesforce-experience.com</a> <<a href="http://salesforce-experience.com" rel="noreferrer" target="_blank">http://salesforce-experience.com</a>> .<a href="http://salesforce-hub.com" rel="noreferrer" target="_blank">salesforce-hub.com</a> <<a href="http://salesforce-hub.com" rel="noreferrer" target="_blank">http://salesforce-hub.com</a>> .<a href="http://salesforce-scrt.com" rel="noreferrer" target="_blank">salesforce-scrt.com</a> <<a href="http://salesforce-scrt.com" rel="noreferrer" target="_blank">http://salesforce-scrt.com</a>> .<a href="http://salesforce-sites.com" rel="noreferrer" target="_blank">salesforce-sites.com</a> <<a href="http://salesforce-sites.com" rel="noreferrer" target="_blank">http://salesforce-sites.com</a>> .<a href="http://site.com" rel="noreferrer" target="_blank">site.com</a> <<a href="http://site.com" rel="noreferrer" target="_blank">http://site.com</a>> .<a href="http://sfdcopens.com" rel="noreferrer" target="_blank">sfdcopens.com</a> <<a href="http://sfdcopens.com" rel="noreferrer" target="_blank">http://sfdcopens.com</a>> .sfdc.sh .<a href="http://trailblazer.me" rel="noreferrer" target="_blank">trailblazer.me</a> <<a href="http://trailblazer.me" rel="noreferrer" target="_blank">http://trailblazer.me</a>> .<a href="http://trailhead.com" rel="noreferrer" target="_blank">trailhead.com</a> <<a href="http://trailhead.com" rel="noreferrer" target="_blank">http://trailhead.com</a>> .<a href="http://visualforce.com" rel="noreferrer" target="_blank">visualforce.com</a> <<a href="http://visualforce.com" rel="noreferrer" target="_blank">http://visualforce.com</a>> <br>
<br>
<br>
# Filter HTTPS requests based on the whitelist <br>
acl allowed_https_sites ssl::server_name .<a href="http://pypi.org" rel="noreferrer" target="_blank">pypi.org</a> <<a href="http://pypi.org" rel="noreferrer" target="_blank">http://pypi.org</a>> .<a href="http://pythonhosted.org" rel="noreferrer" target="_blank">pythonhosted.org</a> <<a href="http://pythonhosted.org" rel="noreferrer" target="_blank">http://pythonhosted.org</a>> .<a href="http://tfhub.dev" rel="noreferrer" target="_blank">tfhub.dev</a> <<a href="http://tfhub.dev" rel="noreferrer" target="_blank">http://tfhub.dev</a>> .<a href="http://gstatic.com" rel="noreferrer" target="_blank">gstatic.com</a> <<a href="http://gstatic.com" rel="noreferrer" target="_blank">http://gstatic.com</a>> .<a href="http://googleapis.com" rel="noreferrer" target="_blank">googleapis.com</a> <<a href="http://googleapis.com" rel="noreferrer" target="_blank">http://googleapis.com</a>> <br>
acl allowed_https_sites ssl::server_name .<a href="http://amazonaws.com" rel="noreferrer" target="_blank">amazonaws.com</a> <<a href="http://amazonaws.com" rel="noreferrer" target="_blank">http://amazonaws.com</a>> <br>
acl allowed_https_sites ssl::server_name .<a href="http://documentforce.com" rel="noreferrer" target="_blank">documentforce.com</a> <<a href="http://documentforce.com" rel="noreferrer" target="_blank">http://documentforce.com</a>> .<a href="http://sforce.com" rel="noreferrer" target="_blank">sforce.com</a> <<a href="http://sforce.com" rel="noreferrer" target="_blank">http://sforce.com</a>> .<a href="http://force.com" rel="noreferrer" target="_blank">force.com</a> <<a href="http://force.com" rel="noreferrer" target="_blank">http://force.com</a>> .<a href="http://forceusercontent.com" rel="noreferrer" target="_blank">forceusercontent.com</a> <<a href="http://forceusercontent.com" rel="noreferrer" target="_blank">http://forceusercontent.com</a>> .<a href="http://force-user-content.com" rel="noreferrer" target="_blank">force-user-content.com</a> <<a href="http://force-user-content.com" rel="noreferrer" target="_blank">http://force-user-content.com</a>> .<a href="http://lightning.com" rel="noreferrer" target="_blank">lightning.com</a> <<a href="http://lightning.com" rel="noreferrer" target="_blank">http://lightning.com</a>> .<a href="http://salesforce.com" rel="noreferrer" target="_blank">salesforce.com</a> <<a href="http://salesforce.com" rel="noreferrer" target="_blank">http://salesforce.com</a>> .<a href="http://salesforceliveagent.com" rel="noreferrer" target="_blank">salesforceliveagent.com</a> <<a href="http://salesforceliveagent.com" rel="noreferrer" target="_blank">http://salesforceliveagent.com</a>> .<a href="http://salesforce-communities.com" rel="noreferrer" target="_blank">salesforce-communities.com</a> <<a href="http://salesforce-communities.com" rel="noreferrer" target="_blank">http://salesforce-communities.com</a>> .<a href="http://salesforce-experience.com" rel="noreferrer" target="_blank">salesforce-experience.com</a> <<a href="http://salesforce-experience.com" rel="noreferrer" target="_blank">http://salesforce-experience.com</a>> .<a href="http://salesforce-hub.com" rel="noreferrer" target="_blank">salesforce-hub.com</a> <<a href="http://salesforce-hub.com" rel="noreferrer" target="_blank">http://salesforce-hub.com</a>> .<a href="http://salesforce-scrt.com" rel="noreferrer" target="_blank">salesforce-scrt.com</a> <<a href="http://salesforce-scrt.com" rel="noreferrer" target="_blank">http://salesforce-scrt.com</a>> .<a href="http://salesforce-sites.com" rel="noreferrer" target="_blank">salesforce-sites.com</a> <<a href="http://salesforce-sites.com" rel="noreferrer" target="_blank">http://salesforce-sites.com</a>> .<a href="http://site.com" rel="noreferrer" target="_blank">site.com</a> <<a href="http://site.com" rel="noreferrer" target="_blank">http://site.com</a>> .<a href="http://sfdcopens.com" rel="noreferrer" target="_blank">sfdcopens.com</a> <<a href="http://sfdcopens.com" rel="noreferrer" target="_blank">http://sfdcopens.com</a>> .sfdc.sh .<a href="http://trailblazer.me" rel="noreferrer" target="_blank">trailblazer.me</a> <<a href="http://trailblazer.me" rel="noreferrer" target="_blank">http://trailblazer.me</a>> .<a href="http://trailhead.com" rel="noreferrer" target="_blank">trailhead.com</a> <<a href="http://trailhead.com" rel="noreferrer" target="_blank">http://trailhead.com</a>> .<a href="http://visualforce.com" rel="noreferrer" target="_blank">visualforce.com</a> <<a href="http://visualforce.com" rel="noreferrer" target="_blank">http://visualforce.com</a>> <br>
ssl_bump peek step2 allowed_https_sites <br>
ssl_bump splice step3 allowed_https_sites <br>
ssl_bump terminate step2 all<br>
<br>
<br>
connect_timeout 60 minute<br>
read_timeout 60 minute<br>
write_timeout 60 minute<br>
request_timeout 60 minute<br>
<br>
## http filtering ###<br>
#http_access allow localnet allowed_http_only<br>
#http_access allow localhost allowed_http_only<br>
http_access allow localnet allowed_https_sites<br>
http_access allow localhost allowed_https_sites<br>
# And finally deny all other access to this proxy<br>
http_access deny all<br>
<br>
# Uncomment and adjust the following to add a disk cache directory.<br>
#cache_dir ufs /var/spool/squid 100 16 256<br>
<br>
# Leave coredumps in the first cache dir<br>
coredump_dir /var/spool/squid<br>
<br>
#<br>
# Add any of your own refresh_pattern entries above these.<br>
#<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
<br>
<br>
<br>
thanks<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.squid-cache.org/pipermail/squid-users/attachments/20220225/9f94f144/attachment-0001.htm" rel="noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-users/attachments/20220225/9f94f144/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 24 Feb 2022 23:14:30 -0600<br>
From: Dave Blanchard <<a href="mailto:dave@killthe.net" target="_blank">dave@killthe.net</a>><br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: [squid-users] Random trouble with image downloads<br>
Message-ID: <<a href="mailto:20220224231430.f046b84f7c376ed796c5f203@killthe.net" target="_blank">20220224231430.f046b84f7c376ed796c5f203@killthe.net</a>><br>
Content-Type: text/plain; charset=US-ASCII<br>
<br>
OK, I've got Squid mostly working fine, but have noticed a problem with certain image downloads, which in at least one case are coming from <a href="http://storage.googleapis.com" rel="noreferrer" target="_blank">storage.googleapis.com</a>. (Profile images for a forum.) It's as if Squid sometimes randomly fails to download and correctly cache a given image, and instead caches a broken or zero'd file. If I try to open that image in a new browser tab, sometimes it will just be blank, and other times the browser reports ERR_EMPTY_RESPONSE "The server didn't send any data." In the former case the image access shows up in the Squid access log as TCP_REFRESH_UNMODIFIED, and in the latter case it doesn't show up at all. If I download it manually using wget with no proxy, it downloads fine. What could possibly be happening here?<br>
<br>
-- <br>
Dave Blanchard <<a href="mailto:dave@killthe.net" target="_blank">dave@killthe.net</a>><br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Fri, 25 Feb 2022 08:47:40 +0100<br>
From: Dieter Bloms <<a href="mailto:squid.org@bloms.de" target="_blank">squid.org@bloms.de</a>><br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: [squid-users] slow down response to broken clients ?<br>
Message-ID: <<a href="mailto:20220225074740.pclldvx4rtrpiifc@bloms.de" target="_blank">20220225074740.pclldvx4rtrpiifc@bloms.de</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
Hello,<br>
<br>
Sometimes a client tries to reach a destination that is blocked at the<br>
proxy. The proxy responds with a 403 and the client then immediately<br>
tries again and again, making hundreds of requests per second. Is it<br>
possible to add an artificial delay here so that the proxy answers<br>
the client later?<br>
Best combined with a rate limit, so that the delays only become active<br>
when a certain limit of 403 answers is exceeded?<br>
<br>
<br>
-- <br>
Regards<br>
<br>
Dieter<br>
<br>
--<br>
I do not get viruses because I do not use MS software.<br>
If you use Outlook then please do not put my email address in your<br>
address-book so that WHEN you get a virus it won't use my address in the<br>
>From field.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Fri, 25 Feb 2022 23:30:47 +1300<br>
From: Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>><br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: Re: [squid-users] getsockopt failures, although direct access<br>
to intercept ports is blocked<br>
Message-ID: <<a href="mailto:b75703c5-3be1-a645-7e05-3b557b5b1336@treenet.co.nz" target="_blank">b75703c5-3be1-a645-7e05-3b557b5b1336@treenet.co.nz</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
On 24/02/22 12:05, Andreas Weigel wrote:<br>
> Hi everyone,<br>
> <br>
> I had the following issue with Squid in Transparent Mode (and SSL <br>
> Interception in mode splice). It is working as expected, however after <br>
> multiple long-running (talking about several seconds) anti-virus <br>
> ecap-Processes have finished, I *sometimes* get the following in the log:<br>
> <br>
> 2022/02/23 14:56:40.668 kid1| 5,2| src/comm/TcpAcceptor.cc(224) <br>
> doAccept: New connection on FD 21<br>
> 2022/02/23 14:56:40.668 kid1| 5,2| src/comm/TcpAcceptor.cc(312) <br>
> acceptNext: connection on local=[::]:2412 remote=[::] FD 21 flags=41<br>
> 2022/02/23 14:56:40.668 kid1| 89,5| src/ip/Intercept.cc(405) Lookup: <br>
> address BEGIN: me/client= <a href="http://192.168.180.1:2412" rel="noreferrer" target="_blank">192.168.180.1:2412</a>, destination/me= <br>
> <a href="http://192.168.180.10:48582" rel="noreferrer" target="_blank">192.168.180.10:48582</a><br>
> 2022/02/23 14:56:40.668 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed <br>
> on local=<a href="http://192.168.180.1:2412" rel="noreferrer" target="_blank">192.168.180.1:2412</a> remote=<a href="http://192.168.180.10:48582" rel="noreferrer" target="_blank">192.168.180.10:48582</a> FD 37 flags=33: <br>
> (2) No such file or directory<br>
> 2022/02/23 14:56:40.669 kid1| 89,9| src/ip/Intercept.cc(151) <br>
> NetfilterInterception: address: local=<a href="http://192.168.180.1:2412" rel="noreferrer" target="_blank">192.168.180.1:2412</a> <br>
> remote=<a href="http://192.168.180.10:48582" rel="noreferrer" target="_blank">192.168.180.10:48582</a> FD 37 flags=33<br>
> 2022/02/23 14:56:40.669 kid1| ERROR: NAT/TPROXY lookup failed to locate <br>
> original IPs on local=<a href="http://192.168.180.1:2412" rel="noreferrer" target="_blank">192.168.180.1:2412</a> remote=<a href="http://192.168.180.10:48582" rel="noreferrer" target="_blank">192.168.180.10:48582</a> FD <br>
> 37 flags=33<br>
<br>
<br>
These can happen if the NAT table entries expire or otherwise get <br>
dropped by conntrack between the client initiating TCP SYN and Squid <br>
accept(2) receiving the connection.<br>
<br>
Your config looks good to me and the lack of regularity indicates the <br>
issue is likely this type of transient state situation.<br>
Is this happening at times of unusually high client connections <br>
through the NAT?<br>
Is eCAP processing blocking the Squid worker for all those seconds?<br>
<br>
<br>
> 2022/02/23 14:56:40.669 kid1| 5,5| src/comm/TcpAcceptor.cc(287) <br>
> acceptOne: non-recoverable error: FD 21, [::] [ job2] handler <br>
> Subscription: 0x55edac3d08d0*1<br>
> <br>
> Sometimes, this only appears on on of the two interception ports, <br>
> sometimes on both. After that, the squid worker does not poll the <br>
> intercept listen port any longer, i.e. stops working.<br>
<br>
That part is likely to be the issue recently worked around by <br>
<<a href="http://www.squid-cache.org/Versions/v6/changesets/squid-6-9fd3e68c3d0dfd6035db98ce142cf425be6c5fc1.patch" rel="noreferrer" target="_blank">http://www.squid-cache.org/Versions/v6/changesets/squid-6-9fd3e68c3d0dfd6035db98ce142cf425be6c5fc1.patch</a>><br>
<br>
<br>
Amos<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of squid-users Digest, Vol 90, Issue 38<br>
*******************************************<br>
</blockquote></div></div></div></div>