Search squid archive

Re: [squid][v5.6] : problem with "slow" or "fast" acl

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 6/09/22 00:56, PERROT Eric DNUM SDCAST BST SSAIM wrote:
Hello,

We use directives "reply_body_max_size", "request_body_max_size" and "delay_access" to limit upload, download and passband in our infra.


All of which are "fast" type.


This configuration existes since a while, but we have noticed that with squid v4.16, our delay pool didn't react as we wanted anymore.


FYI, use of "slow" type ACLs in "fast" type checks is subject to what Squid happens to have in its processing state information and available in caches from previous traffic.

Even if a config like this *appears* to work, it may not be actually working for all transactions. The delicate balance may change at any time.


Can you tell me if what we want to do is still possible? Limiting upload/download/passband for all logged user except those starting by cg_*..?.

You need to:

 1) do authentication checks to http_access.



 2) make the cg_* accounts part of a "group".

The usual way to do that is with the authentication systems "group" functionality and a helper to fetch that.

However, in Squid-4+ you can also add a temporary "group" label as needed based on other ACL checks (eg the username regex matching) like so:

   acl userCgPrefix proxy_auth_regex ^cg_
   acl markCgGroup annotate_transaction group=cgUsers
   http_access allow userCgPrefix markCgGroup !all


3) check the 'group' annotation in fast type controls, not the username:

  acl userrgt note group cgUsers

  reply_body_max_size 800 MB userrgt
  deny_access 1 deny userrgt

FTR; the above should work on any Squid-4 or later. So you can revert to the v4 Squid install which was otherwise working for you.


HTH
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users



[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux