Hubert Choma wrote:
Hello
My squid ver. 2.6 stable Centos 2.6.18-164.el5 .
I'm using the configuration of the WU from the example
http://wiki.squid-cache.org/SquidFaq/WindowsUpdate
I would like to force squid to cache all windows update (version V6)
files e.g .cab .exe and 700MB ISO files
I am noticed that windows media player does not update via squid. WU
generates error 0x8024402F.
I would like to setup squid cache maximum web content, antivirus updates
and WU.
Where can I find example how to cache dynamic pages ?
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
By deleting the above. And the lines which make use of QUERY they begin
to cache.
I understand that I must hash these lines. Is that you meant ?
# hierarchy_stoplist cgi-bin ?
# acl QUERY urlpath_regex cgi-bin \?
# cache deny QUERY
Thaht's correct ?
<snip>
mime_table /etc/squid/mime.conf
refresh_pattern ^ftp: 1440 20% 10080
Right here between the FTP default handling and the general traffic
default handing (.) you need to add this:
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
to properly prevent evil dynamic content from sticking around longer
than it should (ie if its not giving cache-control and/or expiry, drop
it. if it is okay then).
refresh_pattern . 0 20% 4320
You mean like this ??
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
"ie if its not giving cache-control and/or expiry, drop
it."
What to drop ?
Nevermind. My small attempt to educate you what the config means seems
to have failed.
Hmm. "." matches every URL. Squid stops processing refresh_pattern at
the first matching pattern.
--> point: no refresh_pattern below here will ever be used.
"point: no refresh_pattern below here will ever be used."
So what to do with this ?
Only you know what the proxy needs to be doing. Nobody can answer that
question for you.
I do not know what or why you wrote the refresh_pattern lines the way
they were. All I can do is tell you what they are doing because they are
obviously not doing what you want, whatever that is.
What makes "." ??
refresh_pattern . 0 20% 4320
Remove first line and leave
yours ? I didn't understand.
"." aka "refresh_pattern ." aka "refresh_pattern -i ." are all the
'dot' pattern.
Like I said earlier, the "." pattern matches every URL that exists.
Squid will stop processing the refresh_pattern list at the first
matching pattern.
Those two facts together mean that the dot "." pattern is _always_ the
last refresh_pattern Squid will use. Even if you happen to put others
below it. The ones below it will never be used.
Understand now?
refresh_pattern -i \.(gif|jpg|jpeg|png|js|css|flv|bmp|)(\?.*)?$ 0 50%
7200 what with reload-into-ims ?
I just left it off. No special reason. My point was to demonstrate the
tricky (\?.*)?$ bit at the end of the pattern. It's needed to catch
nasty websites obfuscating their URLs.
I don't like reload-into-ims. It prevents the users, who are the
authoritative peoples able to actually see and know when the page is
displaying badly from refreshing the objects and causing the page to
display properly.
Sadly some broken software sends the reload at bad times, causing
bandwidth waste but no actual problems. So its up to you.
refresh_pattern -i \.(gif|jpg|jpeg|png|js|css|flv|bmp|) 0 50% 7200
reload-into-ims
Ahm...
refresh_pattern -i \.(gif|jpg|jpeg|png|js|css|flv|bmp|)(\?.*)?$ 0
50% 7200
refresh_pattern update.microsoft.com/windowsupdate/v6/.*\.(cab|exe|dll)
43200 100% 43200 reload-into-ims
refresh_pattern windowsupdate.com/.*\.(cab|exe|dll) 43200 100% 43200
reload-into-ims
refresh_pattern windowsupdate.microsoft.com/.*\.(cab|exe|dll) 43200 100%
43200 reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe|dll) 43200 100%
43200 reload-into-ims
refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll) 43200
100% 43200 reload-into-ims
refresh_pattern symantecliveupdate.com/.*\.(zip|exe) 43200 100% 43200
reload-into-ims
refresh_pattern windowsupdate.com/.*\.(cab|exe) 43200 100% 43200
reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe) 43200 100% 43200
reload-into-ims
refresh_pattern avast.com/.*\.(vpu|vpaa) 4320 100% 43200 reload-into-ims
refresh_pattern . 0 20% 4320
Aha!. The dot pattern did get copied down. (or cut-n-pasted from the
wiki?)
On Wiki I cant' find this patterns where are they ?
An old example config for media content. I removed the lines from the
wiki a while back but people still appear sometimes with errors
cut-n-paste'd from the old examples.
range_offset_limit -1 KB
## MOJE ACL #####
acl mojasiec src 192.168.0.0/255.255.255.0
thats 192.168.0.0/24.
acl dozwolone dstdomain -i "/etc/squid/dozwolone.txt"
acl ograniczone_komputery src 192.168.0.3 192.168.0.6 192.168.0.17
192.168.0.12 192.168.0.15 192.168.0.16
acl poczta dstdom_regex .*poczta.* .*mail.*
Hmm. you can drop the .* at beginning and end of squid patterns. They
are added automatically.
No !!
without * eg. poczta.* .mail.* users can go on wembail and I would like
to denied webmail ! So * are necessary .*mail.* !!
The text "webmail" is matched by the pattern " .*mail "
In regex patterns . and .* is special code meaning "any letters or
numbers or symbols may go here".
The only difference is that with . there is a minimum of 1 symbol. with
.* there is a minimum of zero
<snip>
Squid (192.168.0.12) is behind NAT router redirect traffic to 80.
Now I change my net topology and would like to set squid as a
transparent proxy ( 2 NIC's with iptables redirect 80->8080
1) 192.168.0.12/24 (NIc From router)
2) 192.168.0.13/24 (NiC to LAN)
So I use squid for LAN users to accelerate HTTP trafic .
acl javascript rep_mime_type -i ^application/x-javascript$
http_access allow javascript
What is it ?? I don't understand ? (line below )
http_access _request_ test allowed if _reply_ contains... WTF?
The "rep_" bit at the start of the ACL type label means *reply*.
It can only be used inside *_access rules which handle reply response
data. Such as http_reply_access.
http_access handles _only_ the data available during a request. The
reply data is empty at that point.
The configuration lines:
acl javascript rep_mime_type -i ^application/x-javascript$
http_access allow javascript
... are telling Squid to permit a clients requests to happen if the data
that is going to arrive some unknown time in the future contains a
certain text string "application/x-javascript" for the mime type header.
Squid will ignore the entire lot.
Amos
--
Please be using
Current Stable Squid 2.7.STABLE7 or 3.0.STABLE23
Current Beta Squid 3.1.0.16
