23.7.8 - Squid 6.4 unusable due to repeated crashes

[xavx]

Squid6.4 keeps crashing and dumping core. This wasn't happening with the previous version.
Always the same fatal error in cache log :
kid1| FATAL: assertion failed: stmem.cc:98: "lowestOffset () <= target_offset"   

This isn't an isolated occurrence - see https://www.mail-archive.com/squid-users@lists.squid-cache.org/msg25028.html. Crashes were apparently not happening in 6.3

[franco]

Yeah, people asked for Squid to be updated due to security updates. 6.5 is out but FreeBSD ports only has 6.4 and it's not 100% clear 6.5 will fix it. Also see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274825

[xavx]

I guess almost constant crashing is a good way to prevent security risks.
More seriously, I think it would have been better to keep the previous version or go for 6.3 and highlight the risks rather than providing an updated version that doesn't work and will trigger people to ask for help.

[franco]

Yeah, hindsight is always 20/20, but I'm not going to touch subject again before Monday.


Cheers,
Franco

[dmark]

FYI: Same error here.

[skar_cgn]

Same error here.

Is there any workarround for this ?
- Downgrade manually ?
- other webproxy
- ...

My users are complaining, they do not have direct internet access.

Regards
Skar

[franco]

FreeBSD ports just updated to 6.5 so here is a test package:

# opnsense-revert -z squid


Cheers,
Franco

[skar_cgn]

Thanks, works fine for me.

[franco]

ok, hotfixed it

[xavx]

6.5 seems fine. No crash so far.
Please improve the QA. Are updates not pushed first to development branch and test gear before deployment to production branch ? This issue and the others would have been quickly spotted. Guess it's better to wait a week before deploying updates

[bulmaro]

Today I updated the version and I had the same problem, I updated to version 6.5, the problem was corrected, it is working fine.

Thank you so much

FreeBSD ports just updated to 6.5 so here is a test package:

# opnsense-revert -z squid


Cheers,
Franco

[franco]

Please improve the QA. Are updates not pushed first to development branch and test gear before deployment to production branch ? This issue and the others would have been quickly spotted. Guess it's better to wait a week before deploying updates

You want us to spot an issue that neither FreeBSD ports nor Squid itself found in 6.4? I'm not sure how that works, but I can say for a free software with a BSD license a hotfix within 24 hours is a responsible procedure.

To be frank I did not see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274825 before 23.7.8 was out. Then people actually started reporting the issue with Squid. I've spent much time migrating and testing 5.9 to 6.4 this week to make sure it builds and runs and the language pack is still in place.

The safest bet would have been to keep Squid at 5.9 for the whole 23.7.x progression, but the security issues made this more or less an impossible choice: migrate to next stable version and receive regression complaints or not update it at all and receive missing security update complains. I'd rather choose the regression complaints also because forward is the only viable direction eventually.


Cheers,
Franco

[doktornotor]

So, frankly - how many of those endless exploits and 0days have been fixed in upstream and/or in FreeBSD ports? I'd say the future is not exactly bright for Squid.

The Squid Team have been helpful and supportive during the process of reporting these issues. However, they are effectively understaffed, and simply do not have the resources to fix the discovered issues.

For everyone here, instead of complaining about QA, I'd seriously reconsider your use case for Squid proxy.

[tillsense]

So, frankly - how many of those endless exploits and 0days have been fixed in upstream and/or in FreeBSD ports? I'd say the future is not exactly bright for Squid.

The Squid Team have been helpful and supportive during the process of reporting these issues. However, they are effectively understaffed, and simply do not have the resources to fix the discovered issues.

For everyone here, instead of complaining about QA, I'd seriously reconsider your use case for Squid proxy.

Hi,
i can only agree 100%!

cheers
till

[Mega32]

AFAIK "The other side" will pull squid support from next release(s) , due to the increasing security issues.