Search squid archive

Re: No failover when default parent proxy fails (Squid 3.5.12)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is the sceanrio;

Squid 3.5.12 is installed on "squid-proxy.mycompany.com". The two parent proxies are:
- Primary: proxy.mycompany.de:8080 (139.2.1.3)
- Fallback: roxy.mycompany.de:8080 (139.2.1.4)

I have misunderstood the "default" option in "cache_peer". When I got it right, it has the meaning of a fallback, so I switched it to "roxy.mycompany.de". "proxy.mycompany.de" should always be used and "roxy.mycompany.de" only when "proxy.mycompany.de" fails.

squid.conf:

# ACCESS CONTROLS
# -----------------------------------------------------------------------------
  # Local Networks
  acl localnet src 139.2.0.0/16
  acl localnet src 193.96.112.0/21
  acl localnet src 192.109.216.0/24
  acl localnet src 100.1.4.0/22
  acl localnet src 10.0.0.0/8
  acl localnet src 172.16.0.0/12
  acl localnet src 192.168.0.0/16

  # Materna Networks
  acl to_matnet dst 139.2.0.0/16
  acl to_matnet dst 193.96.112.0/21
  acl to_matnet dst 192.109.216.0/24
  acl to_matnet dst 100.1.4.0/22
  acl to_matnet dst 10.0.0.0/8
  acl to_matnet dst 172.16.0.0/12
  acl to_matnet dst 192.168.0.0/16

  # SSL-Ports
  acl SSL_ports port 443 # https
  acl SSL_ports port 563 # snews
  acl SSL_ports port 873 # rsync

  # Safe-Ports
  acl Safe_ports port 80  # http
  acl Safe_ports port 21  # ftp
  acl Safe_ports port 443 # https
  acl Safe_ports port 70  # gopher
  acl Safe_ports port 210 # wais
  acl Safe_ports port 1025-65535 # unregistered ports
  acl Safe_ports port 280 # http-mgmt
  acl Safe_ports port 488 # gss-http
  acl Safe_ports port 591 # filemaker
  acl Safe_ports port 777 # multiling http
  acl Safe_ports port 631 # cups
  acl Safe_ports port 873 # rsync
  acl Safe_ports port 901 # SWAT

  # HTTPS
  acl CONNECT method CONNECT

  http_access deny !Safe_ports
  http_access deny CONNECT !SSL_ports
  http_access allow manager localhost
  http_access deny  manager
  http_access allow localnet
  http_access allow localhost
  http_access deny all

# NETWORK OPTIONS
# -----------------------------------------------------------------------------
  http_port 3128
  http_port 3129 intercept

# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
  cache_peer proxy.materna.de parent 8080 0 no-digest no-query connect-timeout=5 connect-fail-limit=2
  cache_peer  roxy.materna.de parent 8080 0 no-digest no-query connect-timeout=5 connect-fail-limit=2 default

# MEMORY CACHE OPTIONS
# -----------------------------------------------------------------------------
  maximum_object_size_in_memory 8 MB
  memory_replacement_policy heap LFUDA
  cache_mem 256 MB

# DISK CACHE OPTIONS
# -----------------------------------------------------------------------------
  maximum_object_size 10 GB
  cache_replacement_policy heap GDSF
  cache_dir ufs /var/cache/squid 88894 16 256 max-size=10737418240

# LOGFILE OPTIONS
# -----------------------------------------------------------------------------
  access_log daemon:/var/log/squid/access.log squid

# OPTIONS FOR TROUBLESHOOTING
# -----------------------------------------------------------------------------
  cache_log /var/log/squid/cache.log
  coredump_dir /var/log/squid
  debug_options 44,2

# OPTIONS FOR TUNING THE CACHE
# -----------------------------------------------------------------------------
  max_stale 6 days
  shutdown_lifetime 5 seconds

# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
  visible_hostname proxy.materna.com

# OPTIONS INFLUENCING REQUEST FORWARDING 
# -----------------------------------------------------------------------------
  always_direct allow to_matnet
  never_direct  allow all

# DNS OPTIONS
# -----------------------------------------------------------------------------
  dns_nameservers 139.2.34.171
  dns_nameservers 139.2.34.37

# MISCELLANEOUS
# -----------------------------------------------------------------------------
  memory_pools off

Now, I block traffic on "squid-proxy.mycompany.com" to the primary proxy "proxy.mycompany.de" (139.2.1.3) using IPTables:
$ iptables -A OUTPUT -p icmp -d 139.2.1.3 -j DROP
$ iptables -A OUTPUT -p tcp -d 139.2.1.3 -j DROP
$ iptables -A OUTPUT -p udp -d 139.2.1.3 -j DROP

On the test machine, I use:
$ export http_proxy=http://squid-proxy.mycompany.com:3128/
$ export https_proxy=http://squid-proxy.mycompany.com:3128/
$ export HTTP_PROXY=http://squid-proxy.mycompany.com:3128/
$ export HTTPS_PROXY=http://squid-proxy.mycompany.com:3128/

Trying to download a resource:
$ wget https://repository.apache.org/content/groups/snapshots/org/apache/karaf/apache-karaf/4.1.1-SNAPSHOT/apache-karaf-4.1.1-20170315.084054-35.tar.gz

The download hangs for 2 minutes until it gets started. A retry shows the same results, the download starts after 2 minutes showing:
--2017-03-16 09:31:26--  https://repository.apache.org/content/groups/snapshots/org/apache/karaf/apache-karaf/4.1.1-SNAPSHOT/apache-karaf-4.1.1-20170314.154157-34.tar.gz
Resolving squid-proxy.mycompany.com (squid-proxy.mycompany.com)... 10.152.132.41
Connecting to squid-proxy.mycompany.com (squid-proxy.mycompany.com)|10.152.132.41|:3128... connected.

cache.log:

2017/03/16 10:17:47 kid1| Shutdown: NTLM authentication.
2017/03/16 10:17:47 kid1| Shutdown: Negotiate authentication.
2017/03/16 10:17:47 kid1| Shutdown: Digest authentication.
2017/03/16 10:17:47 kid1| Shutdown: Basic authentication.
CPU Usage: 0.084 seconds = 0.052 user + 0.032 sys
Maximum Resident Size: 113840 KB
Page faults with physical i/o: 0
2017/03/16 10:17:48 kid1| Starting Squid Cache version 3.5.12 for x86_64-pc-linux-gnu...
2017/03/16 10:17:48 kid1| Service Name: squid
2017/03/16 10:17:48| pinger: Initialising ICMP pinger ...
2017/03/16 10:18:09.579 kid1| 44,2| peer_select.cc(258) peerSelectDnsPaths: Find IP destination for: http://proxy.materna.de:8080/squid-internal-dynamic/netdb' via proxy.materna.de
2017/03/16 10:18:09.579 kid1| 44,2| peer_select.cc(280) peerSelectDnsPaths: Found sources for 'http://proxy.materna.de:8080/squid-internal-dynamic/netdb'
2017/03/16 10:18:09.579 kid1| 44,2| peer_select.cc(281) peerSelectDnsPaths:   always_direct = ALLOWED
2017/03/16 10:18:09.579 kid1| 44,2| peer_select.cc(282) peerSelectDnsPaths:    never_direct = DUNNO
2017/03/16 10:18:09.579 kid1| 44,2| peer_select.cc(286) peerSelectDnsPaths:          DIRECT = local=0.0.0.0 remote=139.2.1.3:8080 flags=1
2017/03/16 10:18:09.579 kid1| 44,2| peer_select.cc(295) peerSelectDnsPaths:        timedout = 0
2017/03/16 10:18:12.279 kid1| 44,2| peer_select.cc(258) peerSelectDnsPaths: Find IP destination for: http://roxy.materna.de:8080/squid-internal-dynamic/netdb' via roxy.materna.de
2017/03/16 10:18:12.279 kid1| 44,2| peer_select.cc(280) peerSelectDnsPaths: Found sources for 'http://roxy.materna.de:8080/squid-internal-dynamic/netdb'
2017/03/16 10:18:12.279 kid1| 44,2| peer_select.cc(281) peerSelectDnsPaths:   always_direct = ALLOWED
2017/03/16 10:18:12.279 kid1| 44,2| peer_select.cc(282) peerSelectDnsPaths:    never_direct = DUNNO
2017/03/16 10:18:12.279 kid1| 44,2| peer_select.cc(286) peerSelectDnsPaths:          DIRECT = local=0.0.0.0 remote=139.2.1.4:8080 flags=1
2017/03/16 10:18:12.279 kid1| 44,2| peer_select.cc(295) peerSelectDnsPaths:        timedout = 0
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(258) peerSelectDnsPaths: Find IP destination for: repository.apache.org:443' via proxy.materna.de
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(258) peerSelectDnsPaths: Find IP destination for: repository.apache.org:443' via proxy.materna.de
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(258) peerSelectDnsPaths: Find IP destination for: repository.apache.org:443' via roxy.materna.de
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(258) peerSelectDnsPaths: Find IP destination for: repository.apache.org:443' via roxy.materna.de
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(280) peerSelectDnsPaths: Found sources for 'repository.apache.org:443'
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(281) peerSelectDnsPaths:   always_direct = DENIED
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(282) peerSelectDnsPaths:    never_direct = ALLOWED
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(292) peerSelectDnsPaths:      cache_peer = local=0.0.0.0 remote=139.2.1.3:8080 flags=1
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(292) peerSelectDnsPaths:      cache_peer = local=0.0.0.0 remote=139.2.1.3:8080 flags=1
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(292) peerSelectDnsPaths:      cache_peer = local=0.0.0.0 remote=139.2.1.4:8080 flags=1
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(292) peerSelectDnsPaths:      cache_peer = local=0.0.0.0 remote=139.2.1.4:8080 flags=1
2017/03/16 10:18:37.951 kid1| 44,2| peer_select.cc(295) peerSelectDnsPaths:        timedout = 0

access.log

1489656077.628 159679 10.30.216.160 TCP_TUNNEL/200 26328966 CONNECT repository.apache.org:443 - ANY_OLD_PARENT/139.2.1.4 -


Any hints?

Jens
 

Gesendet: Donnerstag, 16. März 2017 um 09:27 Uhr
Von: "Amos Jeffries" <squid3@xxxxxxxxxxxxx>
An: squid-users@xxxxxxxxxxxxxxxxxxxxx
Betreff: Re:  No failover when default parent proxy fails (Squid 3.5.12)
On 16/03/2017 7:05 p.m., Jens Offenbach wrote:
> Thanks for your quick response...
>
> I have also configured, but the value seems not to be honored:
> connect_timeout 30 seconds
>
> The primary peer is down, but Squid does not print any "Dead parent"
> in the logs. Every HTTPS request is forwarded to the primary peer and
> it takes 1 minute until the secondary peer gets used, even with
> "connect_timeout 30 seconds". I think, I am facing the first issue
> that has been fixed by your patch.
>

The global config options being ignored completely is correct because
your peer have individual connect-timeout=5 settings.

So, those 5sec timeouts should be used instead now as before.

Though note that they apply only to how long a TCP connection (SYN,
SYN-ACK) is waited for. There is also a dns_timeout and peer selection
timeout that apply separately to the act of connecting. And a
forward_timeout global limit that all those operations have to fit
within, including retries.


Did you have a chance to try the debug setting I suggested at the
beginning? That will give you an immediate view about what Squid is
detecting as usable paths for each and every request and at what times
relative to the DEAD/LIVE notice.



> Are there any plans to backport this fix to Xenial APT repositories
> or to create a new Debian package for Squid4/5?

That is up to the Ubuntu server team, but I think it Unlikely. Zesty is
the current stable and things like this generally dont have enough
widespread impact to qualify for LTS backports.

Debian is now frozen to stabilize for the "Buster" release, that will
contain Squid-3.5.23 plus some few critical patches which are already
set. A Squid-4 package is ready and waiting for the release freeze to
end before it goes public in the Debian Unstable/Testing repos.

Amos

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users




[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux