On 6/09/22 00:56, PERROT Eric DNUM SDCAST BST SSAIM wrote:
Hello,
We use directives "reply_body_max_size", "request_body_max_size" and
"delay_access" to limit upload, download and passband in our infra.
All of which are "fast" type.
This configuration existes since a while, but we have noticed that with
squid v4.16, our delay pool didn't react as we wanted anymore.
FYI, use of "slow" type ACLs in "fast" type checks is subject to what
Squid happens to have in its processing state information and available
in caches from previous traffic.
Even if a config like this *appears* to work, it may not be actually
working for all transactions. The delicate balance may change at any time.
Can you tell me if what we want to do is still possible? Limiting
upload/download/passband for all logged user except those starting by
cg_*..?.
You need to:
1) do authentication checks to http_access.
2) make the cg_* accounts part of a "group".
The usual way to do that is with the authentication systems "group"
functionality and a helper to fetch that.
However, in Squid-4+ you can also add a temporary "group" label as
needed based on other ACL checks (eg the username regex matching) like so:
acl userCgPrefix proxy_auth_regex ^cg_
acl markCgGroup annotate_transaction group=cgUsers
http_access allow userCgPrefix markCgGroup !all
3) check the 'group' annotation in fast type controls, not the username:
acl userrgt note group cgUsers
reply_body_max_size 800 MB userrgt
deny_access 1 deny userrgt
FTR; the above should work on any Squid-4 or later. So you can revert to
the v4 Squid install which was otherwise working for you.
HTH
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
