Dear all, I got some debug information from cache.log, and I found a strange behavior in its logs. According to logs, it looks opposite behavior after comparing a rule. #my configureation adaptation_access svcBlocker deny eicar adaptation_access svcBlocker deny trend Go to www.trendmicro.com 2008/08/14 10:58:14.062| Adaptation::AccessCheck has 2 rules 2008/08/14 10:58:14.062| ACLChecklist::preCheck: 0xdedb028 checking 'adaptation_access svcBlocker deny eicar' 2008/08/14 10:58:14.062| ACLList::matches: checking eicar 2008/08/14 10:58:14.062| ACL::checklistMatches: checking 'eicar' 2008/08/14 10:58:14.062| aclRegexData::match: checking 'http://www.trendmicro.co.jp/download/test-virus.asp' 2008/08/14 10:58:14.062| aclRegexData::match: looking for 'http://www.eicar.org/' 2008/08/14 10:58:14.062| ACL::ChecklistMatches: result for 'eicar' is 0 2008/08/14 10:58:14.062| ACLList::matches: result is false 2008/08/14 10:58:14.062| aclmatchAclList: 0xdedb028 returning false (AND list entry failed to match) 2008/08/14 10:58:14.062| aclmatchAclList: async=0 nodeMatched=0 async_in_progress=0 lastACLResult() = 0 finished() = 0 2008/08/14 10:58:14.062| ACLChecklist::check: 0xdedb028 NO match found, returning 1 2008/08/14 10:58:14.062| ACLChecklist::checkCallback: 0xdedb028 answer=1 ***** No more check for the rest of rules even though the match was false. Go to www.eicar.com 2008/08/14 11:03:33.038| ACLList::matches: checking eicar 2008/08/14 11:03:33.038| ACL::checklistMatches: checking 'eicar' 2008/08/14 11:03:33.038| aclRegexData::match: checking 'http://www.eicar.org/anti_virus_test_file.htm' 2008/08/14 11:03:33.038| aclRegexData::match: looking for 'http://www.eicar.org/' 2008/08/14 11:03:33.038| aclRegexData::match: match 'http://www.eicar.org/' found in 'http://www.eicar.org/anti_virus_test_file.htm' 2008/08/14 11:03:33.038| ACL::ChecklistMatches: result for 'eicar' is 1 2008/08/14 11:03:33.038| ACLList::matches: result is true ***** Going on checking for the rest of rules even though the match was true. 2008/08/14 11:03:33.038| ACLChecklist::preCheck: 0xc172160 checking 'adaptation_access svcBlocker deny trend' 2008/08/14 11:03:33.038| ACLList::matches: checking trend 2008/08/14 11:03:33.038| ACL::checklistMatches: checking 'trend' 2008/08/14 11:03:33.038| aclRegexData::match: checking 'http://www.eicar.org/anti_virus_test_file.htm' 2008/08/14 11:03:33.038| aclRegexData::match: looking for 'http://www.trendmicro.co.jp/' 2008/08/14 11:03:33.038| ACL::ChecklistMatches: result for 'trend' is 0 2008/08/14 11:03:33.038| ACLList::matches: result is false 2008/08/14 11:03:33.038| aclmatchAclList: 0xc172160 returning false (AND list entry failed to match) 2008/08/14 11:03:33.038| aclmatchAclList: async=0 nodeMatched=0 async_in_progress=0 lastACLResult() = 0 finished() = 0 2008/08/14 11:03:33.038| ACLChecklist::check: 0xc172160 NO match found, returning 1 Best Regards, Seiji Kobayashi -----Original Message----- From: S.KOBAYASHI [mailto:kobayashi@xxxxxxxxxx] Sent: Thursday, August 14, 2008 9:19 AM To: squid-users@xxxxxxxxxxxxxxx Subject: RE: Can't controle adaptation_access properly in ICAP. Could anyone ask something please? I have a bit information for this case. When I configure only one ACL at the adaptation_access, it worked fine. As bellow, Squid's icap client didn't activate for only eicar ACL and another ACL was activated. # This is OK. adaptation_access svcBlocker deny eicar #adaptation_access svcBlocker deny trend --->commented I think that this problem emerges, when two more adaptation_access is used for a service_set. Best Regards, Seiji Kobayashi -----Original Message----- From: S.KOBAYASHI [mailto:kobayashi@xxxxxxxxxx] Sent: Tuesday, August 12, 2008 5:21 PM To: squid-users@xxxxxxxxxxxxxxx Subject: Can't controle adaptation_access properly in ICAP. Dear developer, I'm using the squid-3.HEAD-20080811, and trying to activate icap connections properly as I expected. It means to activate icap or not by using adaptation_access with ACL. However, adaptation_access didn't seem worked properly. I configured ICAP settings as below. acl eicar url_regex http://www.eicar.org/ acl trend url_regex http://www.trendmicro.co.jp/ icap_service service_1 respmod_precache 0 icap://192.168.10.231:1344/interscan icap_service service_2 respmod_precache 0 icap://192.168.10.232:1344/interscan adaptation_service_set svcBlocker service_1 service_2 adaptation_access svcBlocker deny eicar adaptation_access svcBlocker deny trend #adaptation_access svcBlocker allow all --> commented In this case, squid did activate both eicar and trend, and then connected to the ICAP server. I'm wondering, if adaptation_access has a lack of software, or my configuration is something wrong? Best Regards, Seiji Kobayashi
