[squid-users] ICAP - not sending Respmod

Discussion:

(too old to reply)

Thiago Cruz

2007-09-20 15:57:25 UTC

Hi all,

I was testing Squid 3.0.PRE6-20070718 and the ICAP protocol was working
fine. I've updated to 3.0.PRE7-20070919 and squid stop sending Respmod,
although the Reqmod is ok, follow my conf:

icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_class filtro_url service_1 service_2
icap_access filtro_url allow all

I've tracked the connection and I can see ICAP server answering his Methods:

OPTIONS icap://127.0.0.1:1344/wwreqmod ICAP/1.0
Host: 127.0.0.1:1344

ICAP/1.0 200 OK
Allow: 204
Encapsulated: null-body=0
ISTAG: "001-000-000003"
Max-Connections: 50
Methods: REQMOD, RESPMOD, PROFILE, CERTVERIFY
Options-TTL: 300
Preview: 30
Service: Webwasher 6.5.2.2676 (WW 6.5)
Service-ID: ww
Transfer-Preview: *
X-Include: X-Authenticated-Groups,X-Authenticated-User,X-Client-IP

Bugzilla?

Thanks,
Thiago Cruz

Christos Tsantilas

2007-09-20 18:55:14 UTC

Permalink

Hi,
Works very well for me. How are you testing it?
Maybe the problem is repeated ICAP service failures. In this case squid
stops using the service.

if you change the line:
icap_service service_2 respmod_precache 0 .....
to
icap_service service_2 respmod_precache 1 .....

What are you seeing?

The squid bugzilla is here:
http://www.squid-cache.org/bugs/

Regards,
Christos

Post by Thiago Cruz
Hi all,
I was testing Squid 3.0.PRE6-20070718 and the ICAP protocol was working
fine. I've updated to 3.0.PRE7-20070919 and squid stop sending Respmod,
icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_class filtro_url service_1 service_2
icap_access filtro_url allow all
OPTIONS icap://127.0.0.1:1344/wwreqmod ICAP/1.0
Host: 127.0.0.1:1344
ICAP/1.0 200 OK
Allow: 204
Encapsulated: null-body=0
ISTAG: "001-000-000003"
Max-Connections: 50
Methods: REQMOD, RESPMOD, PROFILE, CERTVERIFY
Options-TTL: 300
Preview: 30
Service: Webwasher 6.5.2.2676 (WW 6.5)
Service-ID: ww
Transfer-Preview: *
X-Include: X-Authenticated-Groups,X-Authenticated-User,X-Client-IP
Bugzilla?
Thanks,
Thiago Cruz

Thiago Cruz

2007-09-20 21:39:58 UTC

Permalink

Hi Christos,

I guess that there is a misconfiguration with my ICAP server I'm
working on this.

Have you tried a configuration like this? It seems that service_3 will
never be actived.

icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_service service_3 respmod_precache 0 icap://172.1.1.16:1344/respmod

icap_class filtro_url service_1 service_2 service_3
icap_access filtro_url allow all

Thanks,
Thiago Cruz

Post by Christos Tsantilas
Hi,
Works very well for me. How are you testing it?
Maybe the problem is repeated ICAP service failures. In this case squid
stops using the service.
icap_service service_2 respmod_precache 0 .....
to
icap_service service_2 respmod_precache 1 .....
What are you seeing?
http://www.squid-cache.org/bugs/
Regards,
Christos

Post by Thiago Cruz
Hi all,
I was testing Squid 3.0.PRE6-20070718 and the ICAP protocol was working
fine. I've updated to 3.0.PRE7-20070919 and squid stop sending Respmod,
icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_class filtro_url service_1 service_2
icap_access filtro_url allow all
I've tracked the connection and I can see ICAP server answering his
OPTIONS icap://127.0.0.1:1344/wwreqmod ICAP/1.0
Host: 127.0.0.1:1344
ICAP/1.0 200 OK
Allow: 204
Encapsulated: null-body=0
ISTAG: "001-000-000003"
Max-Connections: 50
Methods: REQMOD, RESPMOD, PROFILE, CERTVERIFY
Options-TTL: 300
Preview: 30
Service: Webwasher 6.5.2.2676 (WW 6.5)
Service-ID: ww
Transfer-Preview: *
X-Include: X-Authenticated-Groups,X-Authenticated-User,X-Client-IP
Bugzilla?
Thanks,
Thiago Cruz

Henrik Nordstrom

2007-09-21 06:59:15 UTC

Permalink

Post by Thiago Cruz
Have you tried a configuration like this? It seems that service_3 will
never be actived.
icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_service service_3 respmod_precache 0 icap://172.1.1.16:1344/respmod
icap_class filtro_url service_1 service_2 service_3

Curretntly chaining of multipleservices at the same service point is not
supported, which means you can at most have two icap services per
request, one at reqmod_precache and one at respmod_precache.

Regards
Henrik

Thiago Cruz

2007-09-21 15:55:12 UTC

Permalink

Instead of using multipleservices, could I use ICAP with cache_peer?
Something like this:

...
acl USERS external NTGroup @USERS
acl sites_1 url_regex "/etc/squid/sites"

http_access allow sites_1
http_access allow all USERS
http_access deny all
icp_access deny all

always_direct allow sites_1
never_direct allow all

icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_class filtro_url service_1 service_2

icap_access filtro_url deny sites_1
icap_access filtro_url allow all

cache_peer 172.1.1.16 parent 8088 7 no-query no-delay no-digest default

When I use this configuration, Respmod doesn't work. I only can see
Reqmod at the track file.

Regards,
Thiago Cruz

Post by Henrik Nordstrom

Henrik Nordstrom

2007-09-21 23:41:45 UTC

Permalink

Post by Thiago Cruz
Instead of using multipleservices, could I use ICAP with cache_peer?

should work fine.

Regards
Henrik

Thiago Cruz

2007-10-05 22:05:34 UTC

Permalink

I solved the problem which squid wasn't sending respmod using Squid3
RC1, but I have another problem, when I don't want to use ICAP (acl
sites_no_authentication), the squid bypass the cache peer too. Is
there some way to force it to use cache_peer?

icap_service service_1 reqmod_precache 0 icap://127.0.0.1:1344/wwreqmod
icap_service service_2 respmod_precache 0 icap://127.0.0.1:1344/wwrespmod
icap_class filtro_url2 service_1 service_2
icap_access filtro_url2 deny sites_no_authentication
icap_access filtro_url2 allow USUARIOS_PERMITIDOS

cache_peer 172.17.5.106 parent 8088 7 no-query no-delay no-digest default

Thanks,
Thiago Cruz

Post by Henrik Nordstrom

Post by Thiago Cruz
Instead of using multipleservices, could I use ICAP with cache_peer?

should work fine.
Regards
Henrik

Henrik Nordstrom

2007-10-06 10:30:30 UTC

Permalink

Post by Thiago Cruz
I solved the problem which squid wasn't sending respmod using Squid3
RC1, but I have another problem, when I don't want to use ICAP (acl
sites_no_authentication), the squid bypass the cache peer too. Is
there some way to force it to use cache_peer?

Squid FAQ How do I configure Squid forward all requests to another
proxy?
<url:http://wiki.squid-cache.org/SquidFaq/ConfiguringSquid#head-c050a0a0382c01fbfb9da7e9c18d58bafd4eb027>

Regards
Henrik

Thiago Cruz

2007-10-08 13:11:45 UTC

Permalink

Hello H. Nordstrom,

I had already read that but unfortunately it didn't work. For some
reason when I negate ICAP for some ACL it bypass cache_peer too. Debug
all 9 could help us?

Regards,
Thiago Cruz

Post by Henrik Nordstrom

Squid FAQ How do I configure Squid forward all requests to another
proxy?
<url:http://wiki.squid-cache.org/SquidFaq/ConfiguringSquid#head-c050a0a0382c01fbfb9da7e9c18d58bafd4eb027>
Regards
Henrik

Amos Jeffries

2007-10-08 13:46:01 UTC

Permalink

Post by Thiago Cruz
Hello H. Nordstrom,
I had already read that but unfortunately it didn't work. For some
reason when I negate ICAP for some ACL it bypass cache_peer too.

Most weird. Would you mind posting the related config both negated and
non-negated for comparison?

Post by Thiago Cruz
Debug
all 9 could help us?

Possibly. It will generate a LOT of data for even moderate server load.
I'd suggest starting at 5-6 to peek where the problems might be, then
raise a particular section.

Amos