23.01 Squid issue

JonathanLee

@hugoeyng It's a fail over firewall, or high availability Example is if one firewall fails and goes down the other firewall takes over so the user side in a business, they have no impact it's about 100% uptime. High Availability or (H.A.)

https://docs.netgate.com/pfsense/en/latest/recipes/high-availability.html

JonathanLee

@hugoeyng try to resave the HA settings on pfsense, they might be missing

hugoeyng

@ben-ihelputech I have only one computer running pfSense

JonathanLee

@hugoeyng said in 23.01 Squid issue:

@jonathanlee The log:
Crash report begins. Anonymous machine information:
amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT #0 plus-RELENG_23_01-n256037-6e914874a5e: Fri Feb 10 20:30:29 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/obj/amd64/VDZvZksF/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBS
Crash report details:
PHP Errors:
[03-May-2023 18:12:49 America/Sao_Paulo] PHP Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1184
Stack trace:
#0 /usr/local/pkg/squidguard.inc(1038): convert_pfxml_to_sgxml_time(Array)
#1 /usr/local/pkg/squidguard.inc(93): convert_pfxml_to_sgxml()
#2 /etc/inc/pkg-utils.inc(691): require_once('/usr/local/pkg/...')
#3 /etc/rc.start_packages(66): sync_package('squidGuard')
#4 {main}
thrown in /usr/local/pkg/squidguard.inc on line 1184
[03-May-2023 18:34:31 America/Sao_Paulo] PHP Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1184
Stack trace:
#0 /usr/local/pkg/squidguard.inc(1038): convert_pfxml_to_sgxml_time(Array)
#1 /usr/local/pkg/squidguard.inc(93): convert_pfxml_to_sgxml()
#2 /etc/inc/pkg-utils.inc(691): require_once('/usr/local/pkg/...')
#3 /etc/rc.start_packages(66): sync_package('squidGuard')
#4 {main}
thrown in /usr/local/pkg/squidguard.inc on line 1184
[03-May-2023 18:34:41 America/Sao_Paulo] PHP Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1184
Stack trace:
#0 /usr/local/pkg/squidguard.inc(1038): convert_pfxml_to_sgxml_time(Array)
#1 /usr/local/pkg/squidguard.inc(93): convert_pfxml_to_sgxml()
#2 /etc/inc/pkg-utils.inc(1068): require_once('/usr/local/pkg/...')
#3 /etc/rc.packages(80): delete_package_xml('squidGuard', 'deinstall')
#4 {main}
thrown in /usr/local/pkg/squidguard.inc on line 1184
[03-May-2023 18:34:42 America/Sao_Paulo] PHP Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1193
Stack trace:
#0 /usr/local/pkg/squidguard.inc(1047): convert_pfxml_to_sgxml_time(Array)
#1 /usr/local/pkg/squidguard.inc(93): convert_pfxml_to_sgxml()
#2 /etc/inc/pkg-utils.inc(868): require_once('/usr/local/pkg/...')
#3 /etc/rc.packages(76): install_package_xml('squidGuard')
#4 {main}
thrown in /usr/local/pkg/squidguard.inc on line 1193
No FreeBSD crash data found.

added to Redmine #13984

hugoeyng

@jonathanlee Should I do it when the patches are aplied or when they are not?

JonathanLee

@hugoeyng Try to resave that area, my errors pointed to missing config too that I never used. I had to resave reverse squid for my php errors to stop. What is INFIX? Mine shows WAN as default unused value

hugoeyng

@jonathanlee INFIX is a WAN

HA is not active.

I resaved RP too

Did not work.

JonathanLee

@hugoeyng Marcos has created a new patch please see link after your logs were submitted.

https://redmine.pfsense.org/issues/13984

JonathanLee

Marcos created a new fix

https://redmine.pfsense.org/issues/13984

Fresh New Patch!!!!

as of 5-3-23 4:43PM PST

Please apply both Squid and Squid_guard patches again.

ben-ihelputech

@jonathanlee Looks like that resolved my issue also

JonathanLee

@hugoeyng Hello, I wanted to check with you, did Marcos Patch #3 work? This was made after your logs were sent in.

hugoeyng

@jonathanlee Hello, Jonathan. Thank you for so kindly help.

Yes and no.

The PHP error has gone, but now squidGuard do not start.

When I look in pf Sense services, squidGuard is not there:

Thank you for so kindly help

When I look O.S. process, squdiGuard is there:

When I look to pfSense menu, squidGuard is not there:

I already removed squidGuard e and reinstalled few times.

JonathanLee

@hugoeyng I have had this issue in the past. I had to remove both Squid and Squidguard and lightSquid. After reboot the firewall and install in order Squid proxy first and after Squidguard and that fixed this issue for me. After its both visable install lightsquid. It has to be in that order, or it would not work for me. It was stuck in the in-between land.

stephenw10

If it's not showing as a service or in the menus that means pfSense thinks it is uninstalled. Those things are created from values in the config file. Reinstall it fro the package manager.

hugoeyng

@jonathanlee @stephenw10 I uninstalled Squid, SquidGuard an LightSquid.

After that I rebooted pfSense e started reinstalling in the sequence: Squid, SquidGuard.

Squid, ok.

SqudiGuard, raised the error I had before the patch (13984) and do not correctly install (no appears in menu).

PHP ERROR: Type: 1, File: /usr/local/pkg/squidguard.inc, Line: 1193, Message: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1193

Install log:

>>> Installing pfSense-pkg-squidGuard... 
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 3 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	db5: 5.3.28_9 [pfSense]
	pfSense-pkg-squidGuard: 1.16.18_20 [pfSense]
	squidGuard: 1.4_15 [pfSense]

Number of packages to be installed: 3

The process will require 15 MiB more space.
41 KiB to be downloaded.
[1/1] Fetching squidGuard-1.4_15.pkg: ...... done
Checking integrity... done (0 conflicting)
[1/3] Installing db5-5.3.28_9...
[1/3] Extracting db5-5.3.28_9: .......... done
[2/3] Installing squidGuard-1.4_15...
[2/3] Extracting squidGuard-1.4_15: ...... done
[3/3] Installing pfSense-pkg-squidGuard-1.16.18_20...
[3/3] Extracting pfSense-pkg-squidGuard-1.16.18_20: .......... done
Saving updated package information...
done.
Loading package configuration... done.
Configuring package components...
Loading package instructions...

Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1193
Stack trace:
#0 /usr/local/pkg/squidguard.inc(1047): convert_pfxml_to_sgxml_time(Array)
#1 /usr/local/pkg/squidguard.inc(93): convert_pfxml_to_sgxml()
#2 /etc/inc/pkg-utils.inc(870): require_once('/usr/local/pkg/...')
#3 /etc/rc.packages(76): install_package_xml('squidGuard')
#4 {main}
  thrown in /usr/local/pkg/squidguard.inc on line 1193
PHP ERROR: Type: 1, File: /usr/local/pkg/squidguard.inc, Line: 1193, Message: Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/squidguard.inc:1193
Stack trace:
#0 /usr/local/pkg/squidguard.inc(1047): convert_pfxml_to_sgxml_time(Array)
#1 /usr/local/pkg/squidguard.inc(93): convert_pfxml_to_sgxml()
#2 /etc/inc/pkg-utils.inc(870): require_once('/usr/local/pkg/...')
#3 /etc/rc.packages(76): install_package_xml('squidGuard')
#4 {main}
  thrownpkg-static: POST-INSTALL script failed
=====
Message from db5-5.3.28_9:

--
===>   NOTICE:

The db5 port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://docs.freebsd.org/en/articles/contributing/#ports-contributing
--
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

EOLd, potential security issues, maybe use db18 instead.

It is scheduled to be removed on or after 2022-06-30.
=====
Message from squidGuard-1.4_15:

--
In order to activate squidGuard you have to edit squid.conf
 To the contain "url_rewrite_program /usr/local/bin/squidGuard"
 and create a configuration file for squidGuard.

 Sample blacklists have been installed in /usr/local/share/examples/squidGuard.

 A sample configuration file has beeen installed in
 /usr/local/etc/squid/squidGuard.conf.sample.

 You need to edit the configuration and compile the blacklist
 you choose to use with:
 squidGuard -d -C all

 Please bear in mind that this is just a sample configuration file
 and for any real world usage you need to download or create your
 own updated blacklists and create your own configuration file.

 Check documentation here:

 http://www.squidguard.org/Doc/

 To activate the changes do a /usr/local/sbin/squid -k reconfigure
=====
Message from pfSense-pkg-squidGuard-1.16.18_20:

--
Please visit Services - SquidGuard Proxy Filter - Target Categories and set up at least one category there before enabling SquidGuard. See https://docs.netgate.com/pfsense/en/latest/packages/cache-proxy/squidguard.html for details.
>>> Cleaning up cache... done.
Success

After that I applied the patches for Squid and SquidGuard and rebooted. Even so the SquidGuard do not appear in the menu and do not start.

JonathanLee

@hugoeyng said in 23.01 Squid issue:

PHP ERROR: Type: 1, File: /usr/local/pkg/squidguard.inc

What about you delete that file from the firewall if your up for reconfiguring Squidguard like a fresh install and after reinstall that package? It is like you are stuck in a reinstall loop now.

JonathanLee

@hugoeyng I added your notes to the Redmine

hugoeyng

@jonathanlee I did it and didn´t work. Sincerely, I did not see how deleting the file could help.

In another way, you are right when say that I am "stuck in a reinstall loop".

I think taht the way to solve this troble would beinstalling manually the package squidguard. Unpacking the package and replacing squidguard.inc with another squidguard.inc that was submitted to the patch. After that packing again and reinstalling.

I am not able to do something like that.

JonathanLee

@hugoeyng dang I thought maybe you could do the rename .old trick and after revert the patched version back once it installs. Path under edit file would be /usr/local open the file and rename the name and resave it

JonathanLee

The Patch seems to be working fine for my 2100-MAX it even caught a new virus with HTTPS intercept. Clam AV normalized. "VIRUS FOUND"

Screenshot 2023-05-05 at 5.41.42 PM.png