Hello,
I need to select a cache peer based on the user group.
As cache_peer_access need a fast acl to have predicable result, I tried to
- annotate transactions with "note"
- match the annotation with a fast acl
- use the acl in the cache_peer_access directive
But I still got warning about slow acl in use where fast are required.
I am missing something ?
I saw a proper configuration for something like that in the mailing list
but no longer find it.
Log:
2017/06/20 12:13:37.024 kid1| 82,2| external_acl.cc(788) aclMatchExternal: ldap_group("anne.test ACCESINTERNET") = lookup needed
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(791) aclMatchExternal: "anne.test ACCESINTERNET": queueing a call.
2017/06/20 12:13:37.025 kid1| 28,2| Checklist.cc(123) goAsync: 0x7ffde8afc0e0 a fast-only directive uses a slow ACL!
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(793) aclMatchExternal: "anne.test ACCESINTERNET": no async support!
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(794) aclMatchExternal: "anne.test ACCESINTERNET": return -1.
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(788) aclMatchExternal: ldap_group("anne.test ACCESCHARGEDECOM") = lookup needed
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(791) aclMatchExternal: "anne.test ACCESCHARGEDECOM": queueing a call.
2017/06/20 12:13:37.025 kid1| 28,2| Checklist.cc(123) goAsync: 0x7ffde8afc0e0 a fast-only directive uses a slow ACL!
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(793) aclMatchExternal: "anne.test ACCESCHARGEDECOM": no async support!
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(794) aclMatchExternal: "anne.test ACCESCHARGEDECOM": return -1.
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(788) aclMatchExternal: ldap_group("anne.test INITIAL") = lookup needed
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(791) aclMatchExternal: "anne.test INITIAL": queueing a call.
2017/06/20 12:13:37.025 kid1| 28,2| Checklist.cc(123) goAsync: 0x7ffde8afc0e0 a fast-only directive uses a slow ACL!
2017/06/20 12:13:37.025 kid1| 82,2| external_acl.cc(793) aclMatchExternal: "anne.test INITIAL": no async support!
2017/06/20 12:13:37.026 kid1| 82,2| external_acl.cc(794) aclMatchExternal: "anne.test INITIAL": return -1.
conf:
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 8002 # multiling http
acl Safe_ports port 8080 # multiling http
acl CONNECT method CONNECT
acl AuthorizedUsers proxy_auth REQUIRED
acl StandardUser external ldap_group ACCESINTERNET
acl VIPUser external ldap_group ACCESCHARGEDECOM
acl NoNetUser external ldap_group INITIAL
acl hostnoauth src "/etc/squid/hosts_noauth"
acl urlnoauth url_regex "/etc/squid/urls_noauth"
note profil StdUser StandardUser
note profil VIP VIPUser
note profil NoNet NoNetUser
acl match-StandardUser note profil StdUser
acl match-VIPUser note profil VIP
acl match-NoNetUser note profil NoNet
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow urlnoauth hostnoauth
http_access allow AuthorizedUsers
http_access deny all
http_port 3128
http_port 10.10.10.10:8080
http_port 10.10.10.10:8002
http_port 10.10.10.10:8001
nonhierarchical_direct off
cache_peer 10.10.10.10 parent 8080 0 name=server_std
cache_peer 10.10.10.10 parent 8002 0 name=server_vip
cache_peer 10.10.10.10 parent 8002 0 name=server_urlnoauth
cache_peer 127.0.0.1 parent 80 0 name=server_nonet
never_direct allow all
always_direct deny all
cache_peer_access server_std allow match-StandardUser
cache_peer_access server_std deny all
cache_peer_access server_vip allow match-VIPUser
cache_peer_access server_vip deny all
cache_peer_access server_nonet allow match-NoNetUser
cache_peer_access server_nonet deny all
cache_peer_access server_urlnoauth allow urlnoauth
cache_peer_access server_urlnoauth deny all
cache_mem 2048 MB
maximum_object_size_in_memory 50 MB
logformat squid [%tl] %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
debug_options ALL,2
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
