|
I'm running Squid 3.5.10 on Debian Jessie and after some hours of execution it runs out of file descriptors.
Squid is listening on port 3125, 3126 and 3127.
Port 3126 is used for intercepting, via iptables redirect, https connections mostly from mobile devices like smartphones. On this port is active ssl-bump but I'm not decrypting https traffic, only "peek" to get https server host name.
Port 3125 is used for intercepting http connections of the same mobile devices whose https traffic is intercepted on port 3126.
Port 3127 is used for clients configured to use a proxy.
Leaked file descriptors are all related to connection on port 3126 (https intercept ssl-bump).
A sample output of lsof command gives:
squid 32490 proxy 12u IPv6 4065613 0t0 TCP 172.16.10.22:3126->192.168.93.113:55815 (CLOSE_WAIT)
squid 32490 proxy 14u IPv6 4097822 0t0 TCP 172.16.10.22:3126->192.168.90.207:52288 (ESTABLISHED)
...
where 172.16.10.22 is an IP address of my Squid installation and 192.168.x.x are mobile devices.
Is seems that this condition is triggered by "local IP does not match any domain IP" error logged by Squid in cache.log, but I'm not sure if all stuck connections are caused by this kind of error.
For the 2 connections of the sample above the related cache.log errors are:
2015/11/21 12:57:51.229 kid1| SECURITY ALERT: Host header forgery detected on local=23.0.163.57:443 remote=192.168.93.113:55815 FD 12 flags=33 (local IP does not match any domain IP)
2015/11/21 13:59:44.230 kid1| SECURITY ALERT: Host header forgery detected on local=198.144.127.162:443 remote=192.168.90.207:52288 FD 14 flags=33 (local IP does not match any domain IP)
"lsof" sample output was taken more that 10 hours after Squid logged these errors and it shows that Squid is still holding connections open, using a lot of file descriptors.
Regards,
André
--- my squid.conf ---
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl CONNECT method CONNECT
acl squid-internal-static url_regex ^http://nat-academico:3127/squid-internal-static/
acl e2guardian localport 3127
follow_x_forwarded_for allow localhost
http_access allow squid-internal-static
http_access allow localhost manager
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost
http_access allow localhost
http_access allow localnet e2guardian
include /etc/squid/transparent-blacklist.conf
include /etc/squid/transparent-whitelist.conf
http_access allow transparent-whitelist-http
http_access deny transparent-blacklist-http
http_access allow localnet
http_access deny all
http_port 3127
http_port 3125 intercept
https_port 3126 cert=/etc/ssl/certs/nat-academico.crt key=/etc/ssl/private/services.key intercept ssl-bump
acl step1 at_step SslBump1
ssl_bump peek step1 all
ssl_bump splice transparent-whitelist-https
ssl_bump terminate transparent-blacklist-https
cache_dir ufs /var/spool/squid 10000 16 256
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
dns_v4_first on
|
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
