ssl - Squid:透明 SSL 代理的总线错误

Question

我尝试将 squid(在 openwrt 上运行)配置为充当 ssl 连接的透明代理。虽然“正常”非加密连接工作正常，但当我尝试使用 ssl 连接运行它时，squid 总是崩溃。

我的配置如下所示:

https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/opt/ssl/ssl.pem key=/opt/ssl/ssl.pem              
ssl_bump server-first all

但每次我尝试启动 squid 时，我只会遇到一行错误:

Bus error

我正在使用 Squid 3.5.2-2，调试日志如下所示:

2015/12/02 17:28:42.021| Initializing https proxy context
2015/12/02 17:28:42.026| support.cc(1068) method: Using SSLv2/SSLv3.
2015/12/02 17:28:42.029| support.cc(1200) sslCreateClientContext: Setting RSA key generation callback.
2015/12/02 17:28:42.029| support.cc(1204) sslCreateClientContext: NOTICE: Peer certificates are not verified for validity!
2015/12/02 17:28:42.030| support.cc(1211) sslCreateClientContext: Setting CA certificate locations.
2015/12/02 17:28:42.030| Initializing https_port [::]:3129 SSL context
2015/12/02 17:28:42.030| Using certificate in /opt/ssl/ssl.pem
2015/12/02 17:28:42.034| support.cc(1714) readSslX509CertificatesChain: Certificate is self-signed, will not be chained
2015/12/02 17:28:42.093| support.cc(1533) contextMethod: Using SSLv2/SSLv3.
2015/12/02 17:28:42.096| support.cc(855) configureSslContext: Setting RSA key generation callback.
2015/12/02 17:28:42.098| support.cc(858) configureSslContext: Setting CA certificate locations.
2015/12/02 17:28:42.100| support.cc(901) configureSslContext: Not requiring any client certificates
2015/12/02 17:28:42.101| tools.cc(543) leave_suid: leave_suid: PID 6477 called
2015/12/02 17:28:42.103| tools.cc(565) leave_suid: leave_suid: PID 6477 giving up root, becoming 'nobody'
2015/12/02 17:28:42.106| debug.cc(403) parseOptions: command-line -X overrides: ALL,1
Bus error

所以我现在的问题是:为什么 squid 甚至不启动？导致总线错误的原因是什么？

Answer 1

我很确定这是一个剩余空间问题，请尝试减小动态证书的大小:

dynamic_cert_mem_cache_size=1MB

你的 Squid 配置文件中的这个选项也很有用:

sslproxy_session_cache_size 500 KB

如果您仍然遇到总线错误，请使用opkg 安装strace 并尝试使用Squid。您将获得有关所发生情况的更多日志。