boot failure with squid

[SebastienLeMoal]

I left a new image, redo the installation several times, updated ... I still have the same problem.

The startup blocks after:

pf disabled
pf enabled
Firewall rules loaded.
Starting API dispatcher
Install : zone 0
overlay user template package for zone 0
Start : zone 0
Apr 11 09:49:27 lighttpd[16196]: (server.c.1423) server started (lighttpd/1.4.49)
start captiveportal background process
Starting squid.
2018/04/11 09:49:28| Warning: empty ACL: acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"

To finish the boot I need to connect to a GUI dashboard that I stop web proxy, and that I restart it (restart not found).
at this point he finishes booting:

>>>> Invoking start script 'carp'
>>> Invoking start script 'cron'
Starting Cron: OK
>>> Invoking start script 'beep'
Root file system: / dev / gpt / rootfs

I can provide an image to find and fix the problem very blocking.

[fichtner]

Hi Sebastien,

I'm guessing /usr/local/etc/squid/nobumpsites.acl is empty, but what are the steps to reproduce? This doesn't happen on a fresh image... do you import an existing config and reboot?

Cheers,
Franco

[SebastienLeMoal]

Hi Franco,

I leave a fresh installation, I configure everything without importing anything,
I always have the same problem.

here is the step-by-step procedure of my configuration.

Captive.portal.and.web proxy.Wiki.pdf

[AdSchellevis]

I guess nobody tried to leave the no bump sites empty before, usually the are some address in there like your bank and other sites which may not be intercepted by a man in the middle scenario.

Maybe we should enforce input there if sslbumping is enabled, although the warning should logically not be more then a warning.

@SebastienLeMoal if you add some nobump sites, does it bootup normally then? (I don't expect so, but just to be sure). If not there might be some other configuration issue preventing dns access, which may cause squid to behave like this.

[fichtner]

@SebastienLeMoal we've been stabbing at this for a while and it's a very weird timing issue that we've been unable to reliably avoid. it has to do with ipfw/dummynet temporarily blocking squid's local socket and preventing it from going into daemon mode. worst combination of unfortunate events ever...

[fichtner]

Continue in
#2569

Maybe FreeBSD 11.2 fixes this...

[fichtner]

FYI fixed via be0cdeb