From e1d58710d8bb041fdfa5304f4fc903f72875210a Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Tue, 7 May 2024 14:40:57 +0200 Subject: [PATCH] www/squid - workaround for coredumps when openssl's legacy provider is enabled. While debugging https://github.com/opnsense/plugins/issues/3827, @fichtner found some reports at redhat which point to some squid openssl 3 compatibility issue [1][2]. To workaround this issue, we can ship squid it's own openssl.cnf file which has legacy disabled. [1] https://bugzilla.redhat.com/show_bug.cgi?id=2155867 [2] https://issues.redhat.com/browse/RHEL-6873 --- www/squid/Makefile | 2 +- www/squid/src/opnsense/scripts/proxy/setup.sh | 2 ++ .../src/opnsense/service/templates/OPNsense/Proxy/rc.conf.d | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/www/squid/Makefile b/www/squid/Makefile index debbe26ca..cfc272dd5 100644 --- a/www/squid/Makefile +++ b/www/squid/Makefile @@ -1,6 +1,6 @@ PLUGIN_NAME= squid PLUGIN_VERSION= 1.0 -PLUGIN_REVISION= 1 +PLUGIN_REVISION= 2 PLUGIN_COMMENT= Squid is a caching proxy for the web PLUGIN_DEPENDS= squid squid-langpack PLUGIN_TIER= 2 diff --git a/www/squid/src/opnsense/scripts/proxy/setup.sh b/www/squid/src/opnsense/scripts/proxy/setup.sh index 795ebdd0d..9e3bb5598 100755 --- a/www/squid/src/opnsense/scripts/proxy/setup.sh +++ b/www/squid/src/opnsense/scripts/proxy/setup.sh @@ -40,3 +40,5 @@ fi # install theme files /usr/local/opnsense/scripts/proxy/deploy_error_pages.py > /dev/null 2>&1 + +sed 's/legacy = legacy_sect/#legacy = legacy_sect/' /usr/local/openssl/openssl.cnf > /usr/local/etc/squid/openssl.cnf diff --git a/www/squid/src/opnsense/service/templates/OPNsense/Proxy/rc.conf.d b/www/squid/src/opnsense/service/templates/OPNsense/Proxy/rc.conf.d index 2a1dc037f..21c5d79b4 100644 --- a/www/squid/src/opnsense/service/templates/OPNsense/Proxy/rc.conf.d +++ b/www/squid/src/opnsense/service/templates/OPNsense/Proxy/rc.conf.d @@ -4,3 +4,5 @@ squid_enable="YES" {% else %} squid_enable="NO" {% endif %} + +squid_env="OPENSSL_CONF=/usr/local/etc/squid/openssl.cnf"