Search squid archive

Re: Upgrade of SQUID from 3.1 to 3.2 on Freebsd 8.3

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 15/01/2013 5:00 a.m., Leslie Jensen wrote:


2013-01-14 16:05, Eliezer Croitoru skrev:
On 1/14/2013 1:48 PM, Leslie Jensen wrote:

I've now upgraded squid to 3.2 and rewritten the firewall rule that
resulted in a forwarding loop.

Unfortunately I've got no access now and I can't see where I've made the
error.

The browser says squid is rejecting the requests:
Access control configuration prevents your request from being allowed at
this time.


1358162295.975      0 172.18.0.1 TCP_MISS/403 4052 GET
http://www.skatteverket.se/ - HIER_NONE/- text/html
1358162295.976     11 172.18.0.102 TCP_MISS/403 4137 GET
http://www.skatteverket.se/ - HIER_DIRECT/172.18.0.1 text/html
1358162296.110      0 172.18.0.1 TCP_MISS/403 4166 GET
http://www.squid-cache.org/Artwork/SN.png - HIER_NONE/- text/html
1358162296.110     99 172.18.0.102 TCP_MISS/403 4251 GET
http://www.squid-cache.org/Artwork/SN.png - HIER_DIRECT/172.18.0.1
text/html
1358162296.219      0 172.18.0.1 TCP_MISS/403 4058 GET
http://www.skatteverket.se/favicon.ico - HIER_NONE/- text/html
1358162296.219      1 172.18.0.102 TCP_MISS/403 4143 GET
http://www.skatteverket.se/favicon.ico - HIER_DIRECT/172.18.0.1 text/html
1358162296.239      0 172.18.0.1 TCP_MISS/403 4090 GET
http://www.skatteverket.se/favicon.ico - HIER_NONE/- text/html
1358162296.240      1 172.18.0.102 TCP_MISS/403 4175 GET
http://www.skatteverket.se/favicon.ico - HIER_DIRECT/172.18.0.1 text/html


Look closly.. it's not squid.
if it was squid you would have seen TCP_DENIED.
you get a TCP_MISS which squid is ok with but a remote server DENIES you
with a 403 response.

Looking even closer there is a HEIR_NONE showing the frst TCP_MISS we from Squid.

I think there are two bugs here:
1) the Host verification logic is resulting in TCP_MISS being logged instead of TCP_DENIED on its 403 rejection.

2) his firewall intercept rules are catching Squid outbound traffic and redirecting it to Squid.


I would say it looks pretty bad since every request seems to go into
squid from two IP addresses which is like a loop.. but one which squid
can not recognize from an unknown reason.

172.18.0.1 is Squids own IP.




What have you done in the firewall to prevent the forwarding loop?

By the way did you tried to have a rule that allows all web requests
from the local machine of the proxy to not be intercepted?

Regards,
Eliezer

I've tried two things.

First I disabled the rule that redirects the web traffic so that it goes directly to the Internet.

It works.

Then with the above rule still disabled I made the browser aware of the proxy by setting it manually in the browser settings.

Then I get the same behaviour.

I'm aware that tcp_miss should not be squid but with the redirecting rule disabled I do not quite understand where it goes wrong.

I'll look into your suggestion and see if it helps.

Thanks :-)

/Leslie






[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux