Fix for broken HTTPS / TLS / Certificates in Leopard-Webkit

[wicknix]

I don't believe that CPU architecture is the problem here.

Agreed. Works fine on ppc linux in my tests. Not that it's needed with current linux and newer browsers though.

This is on Tiger. 100 processes seems really low. For instance on 12.6.2 Monterey the max user processes default to 1392, which is much much larger than Tigers 100 and i believe Leopard is also low at around 128.

For reference, here is 10.6 Intel at 266 and squid has no issues or crashes. Everything else is nearly identical.

More info on the subject here: https://serverfault.com/questions/15564/where-are-the-default-ulimits-specified-on-os-x-10-5
The last post seems the most useful.

 

[socom_22]

This is really interesting @wicknix.

So I'm currently running Sorbet Leopard (aka 10.5.9) on a G5 Quad and ulimit -a reports max user processes of 266 as well...I assume stock 10.5.8 is the same (I don't have an installation of that to verify at the moment).

Since you say Squid works fine on Intel SL (also 266 processes) then perhaps this isn't the problem.

 

[wicknix]

Hmm. I wonder if it has to do with the "data seg size", as that's the only difference in the 2 screen shots otherwise. I don't know. I feel i'm on the right track. I've rebuilt Squid multiple times, and multiple versions, all with the same result on 10.4 and 10.5. It has to be something. Just what differs between 10.4/10.5 and 10.6 is beyond me.

 

[socom_22]

My data seg size is also unlimited. On my Sorbet install, the entire output of ulimit -a is identical to your 10.6 Intel screenshot.

Yes, it has to be something. It's good if we can rule out certain things to narrow down what the difference is between the OS versions that is causing the issues. If you feel you're onto something, by all means keep going!

I don't know what tweaks you've experimented with (if any) other than trying different versions on PPC. If you have any experimental PPC builds you want me to test out on my machine I'm more than happy to do so.

 

[Wowfunhappy]

Well, it still could be a compiler/toolchain issue. Squid on Snow Leopard is compiled with clang and uses libcpp. I don't know exactly what you've tried wicknix but MacPorts on 10.5 usually uses gcc.

 

[socom_22]

@Wowfunhappy might be on to something here. It appears that there are PPC ports of clang out there.

http://vlsi.cornell.edu/~fang/sw/llvm/

@wicknix I wonder if compiling with clang will produce a stable build? Perhaps something you could try out?

 

[aurora72]

Just noticed these messages constantly repeating in the system.log (Console.app)

My system: Mac mini 2009 macOS 10.7.5 (Lion)
I don't use Safari nor Web-Kit on this machine. I typically use only the Firefox Legacy-68.12.0p2

Oct 17 13:54:17 <some-private-name-on-my-computer> com.apple.launchd.peruser.504[114] (com.wowfunhappy.squid[22106]): Exited with code: 1
Oct 17 13:54:32 <some-private-name-on-my-computer> com.wowfunhappy.squid[22116]: 2024/10/17 13:54:32| ALERT: setgid: (1) Operation not permitted
Oct 17 13:54:32 <some-private-name-on-my-computer> com.wowfunhappy.squid[22116]: 2024/10/17 13:54:32| FATAL: No valid signing certificate configured for HTTP_port [::]:3128
Oct 17 13:54:32 <some-private-name-on-my-computer> squid[22118]: FATAL: No valid signing certificate configured for HTTP_port [::]:3128
Oct 17 13:54:32 <some-private-name-on-my-computer> com.wowfunhappy.squid[22116]: 2024/10/17 13:54:32| Squid Cache (Version 4.17): Terminated abnormally.
Oct 17 13:54:32 <some-private-name-on-my-computer> com.wowfunhappy.squid[22116]: CPU Usage: 0.030 seconds = 0.023 user + 0.008 sys
Oct 17 13:54:32 <some-private-name-on-my-computer> com.wowfunhappy.squid[22116]: Maximum Resident Size: 25657344 KB
Oct 17 13:54:32 <some-private-name-on-my-computer> com.wowfunhappy.squid[22116]: Page faults with physical i/o: 0
Oct 17 13:54:32 <some-private-name-on-my-computer> com.apple.launchd.peruser.504[114] (com.wowfunhappy.squid[22116]): Exited with code: 1

How to get rid of those repeating messages, if it's possible of course?

Addition:

Typing /Library/Squid/squid -d 0 in Terminal gives:

2024/10/17 14:16:23| ALERT: setgid: (1) Operation not permitted
2024/10/17 14:16:23| FATAL: No valid signing certificate configured for HTTP_port [::]:3128
2024/10/17 14:16:23| Squid Cache (Version 4.17): Terminated abnormally.
CPU Usage: 0.030 seconds = 0.022 user + 0.008 sys
Maximum Resident Size: 25673728 KB
Page faults with physical i/o: 0

 

[barracuda156]

@Wowfunhappy might be on to something here. It appears that there are PPC ports of clang out there.

http://vlsi.cornell.edu/~fang/sw/llvm/

@wicknix I wonder if compiling with clang will produce a stable build? Perhaps something you could try out?

No clang works on macOS ppc. There are very old clangs that can be built, but they cannot generate ABI-compliant code.

libc++ might work on ppc, but so far no one tested that. It should be easy to try, but requires building everything against it, and that likely to be non-trivial (since again, no one ever did that).

 

[barracuda156]

Well, it still could be a compiler/toolchain issue. Squid on Snow Leopard is compiled with clang and uses libcpp. I don't know exactly what you've tried wicknix but MacPorts on 10.5 usually uses gcc.

If you mean normally, then no, 10.6.8 (and even 10.7–10.8) use libstdc++ by default. 10.6.8 does not even lave libc++.
MacPorts does go against Apple setup here and uses libc++. On 10.6 is it libcxx from llvm 5.0; on later systems it is Apple native one, unless a newer version is pulled in via legacysupport.

gcc/clang choice is predicated on the arch, primarily (and while very old x86 defaults to gcc because its Xcode has no clang, it can still use MacPorts’ clangs). The only choice on PowerPC is gcc (but that includes the latest gcc, not just archaic ones).

 

[barracuda156]

Thanks. Running Squid with -d 0 does print some additional info:

Starting Squid Cache version 4.14 for powerpc-apple-darwin9.8.0...
Service name: squid

But not much beyond that.

Running squid -Nd1 produces more verbose output, but I'm still not seeing any useful errors to diagnose.

Is there some special reason to use such an old version of squid? The current is 6.x.

 

[Wowfunhappy]

If you mean normally, then no, 10.6.8 (and even 10.7–10.8) use libstdc++ by default.

...oh, oops, I think this was my misunderstanding—I thought libstdc+ was the gcc library (in the way that libcxx is the clang library). But now that I think about it, gcc uses the libgcc lbrary, right? What is the lineage of libstdc+?

 

[barracuda156]

...oh, oops, I think this was my misunderstanding—I thought libstdc+ was the gcc library (in the way that libcxx is the clang library). But now that I think about it, gcc uses the libgcc lbrary, right? What is the lineage of libstdc+?

There are two options with C++ runtime libraries: libstdc++ and libc++. The first one is usually used by gcc, the second one usually used by clang (and libstdc++ belongs to gcc, while libc++ to llvm).
Now, macOS before 10.7 only has libstdc++. libc++ appears in 10.7, but is not used by default until 10.9, AFAIK.
Modern gcc can use either, in principle, but libc++ with gcc is not well tested – and not tested at all on ppc.

MacPorts installs its own libc++ from llvm 5.0 on 10.6 and uses it by default on 10.6+, on x86. This has some benefits, but also breaks a lot of stuff. Outside of MacPorts you won’t even have libc++ on 10.6, unless it is built manually, installed into the OS, and compilers are hacked to use it by default.

 

[Wowfunhappy]

There are two options with C++ runtime libraries: libstdc++ and libc++. The first one is usually used by gcc, the second one usually used by clang (and libstdc++ belongs to gcc, while libc++ to llvm).
Now, macOS before 10.7 only has libstdc++. libc++ appears in 10.7, but is not used by default until 10.9, AFAIK.
Modern gcc can use either, in principle, but libc++ with gcc is not well tested – and not tested at all on ppc.

MacPorts installs its own libc++ from llvm 5.0 on 10.6 and uses it by default on 10.6+, on x86. This has some benefits, but also breaks a lot of stuff. Outside of MacPorts you won’t even have libc++ on 10.6, unless it is built manually, installed into the OS, and compilers are hacked to use it by default.

Oh, now I see the mixup.

I ship squid on 10.6 with its own copy of the libc++ library (taken from MacPorts). I used install_name_tool so it loads the local dylib.

On 10.5 you can't do that, or at least I haven't tried to do that.

 

[barracuda156]

Oh, now I see the mixup.

I ship squid on 10.6 with its own copy of the libc++ library (taken from MacPorts). I used install_name_tool so it loads the local dylib.

On 10.5 you can't do that, or at least I haven't tried to do that.

It is probably easy to build squid against both C++ runtime libs and compare results, since it does not depend on anything which needs C++, apparently:

% port deps squid
Full Name: squid @6.12_0+openssl
Extract Dependencies: xz
Build Dependencies:   pkgconfig
Library Dependencies: libtool, zlib, openssl

To build it against libc++ on powerpc, you will need libcxx-powerpc port, gcc14 +stdlib_flag and minor addition to squid portfile in order for required flags to be passed to gcc. I think this should all work on 10.5.8 too.

Having said that, I do not think C++ runtime should be an issue, as long as the build succeeds (and it does, since I have built both squid5 and squid6 for ppc against libstdc++).

What is the problem with squid on ppc btw? I know nothing about how squid itself works, but if it something build related, we can try to address that.

 

[Wowfunhappy]

What is the problem with squid on ppc btw? I know nothing about how squid itself works, but if it something build related, we can try to address that.

It crashes constantly when you make more than a non-trivial number of requests.

I'm sorry I don't have more detailed information, it would be cool if you fixed this but I last looked at the problem in 2021. I also don't have access to PPC hardware myself.

 

[barracuda156]

It crashes constantly when you make more than a non-trivial number of requests.

I'm sorry I don't have more detailed information, it would be cool if you fixed this but I last looked at the problem in 2021. I also don't have access to PPC hardware myself.

Normally anything which crashes will produce a log in ~/Library/Logs/Crash Reports (or something very similar). That may be helpful to figure out what goes wrong.
It may also be possible to attach gdb to a running process or just run squid via gdb.

Any idea why no one seems to have tried newer version of squid?

 

[ppcpp]

Hey, bumping an old thread

I'm trying to install Squid on an iMac G5 running 10.5.8. The only reason I need it is to get CalDAV sync going between Calendar.app and a local server, and installing Squid on another host or lessening the server's security aren't realistic options.

I got squid compiled via Macports, but I need a hand sorting the SSL certificate side of things.

I did attempt to use the cacert.pem file in the Legacy Mac Proxy.pkg file, but it failed to import to Keychain Access, and squid.conf still refers to the files squid.pem and squid-key.pem. To create the latter files I tried the options for the security_file_keygen executable, but only got it to produce a directory structure.

How does one generate cacert.pem, and the related squid.pem and squid-key.pem files?

As far as I know, that's the last thing I need to have a working squid proxy running local on OS X 10.5 Leopard on PowerPC - it's currently giving me an error due to these cert files. Thanks in advance.

 

[wicknix]

Squid crashes and causes 100% cpu spikes on PowerPC OSX. Not worth trying to get working. You are better off using this solution. Here's the direct link to the file.

 

[ppcpp]

Ah, awesome! That works

 

[leency]

Thanks for an an, works nicely.

Two improvements could be:
1. prevent running a copy of this app (if run it twice)
2. make an app that I could attach to dock and run in background