*** ./include/config.h.osr6	Fri Apr 22 18:32:27 2005
--- ./include/config.h	Mon Oct 24 14:14:39 2005
***************
*** 58,63 ****
--- 58,72 ----
  #define _SQUID_SUNOS_
  #endif
  
+ #elif defined(__USLC__)		/* UnixWare - SysV */
+ #define _SQUID_UW_
+ #define _SQUID_SYSV_
+ #define _SQUID_SOLARIS_
+ #define SOLARIS
+ #if !defined(__SVR4)
+ #define __SVR4
+ #endif
+ 
  #elif defined(__hpux)		/* HP-UX - SysV-like? */
  #define _SQUID_HPUX_
  #define _SQUID_SYSV_
*** ./src/protos.h.osr6	Thu Sep 15 02:53:28 2005
--- ./src/protos.h	Mon Oct 24 14:14:39 2005
***************
*** 1304,1311 ****
--- 1304,1313 ----
  #ifdef _SQUID_SOLARIS_
  extern int getrusage(int, struct rusage *);
  extern int getpagesize(void);
+ #ifndef __USLC__
  extern int gethostname(char *, int);
  #endif
+ #endif
  
  #if URL_CHECKSUM_DEBUG
  extern unsigned int url_checksum(const char *url);
*** ./src/tools.c.osr6	Fri Sep 16 14:13:18 2005
--- ./src/tools.c	Mon Oct 24 14:14:39 2005
***************
*** 179,190 ****
  {
      memset(r, '\0', sizeof(struct rusage));
  #if HAVE_GETRUSAGE && defined(RUSAGE_SELF)
! #ifdef _SQUID_SOLARIS_
      /* Solaris 2.5 has getrusage() permission bug -- Arjan de Vet */
      enter_suid();
  #endif
      getrusage(RUSAGE_SELF, r);
! #ifdef _SQUID_SOLARIS_
      leave_suid();
  #endif
  #endif
--- 179,190 ----
  {
      memset(r, '\0', sizeof(struct rusage));
  #if HAVE_GETRUSAGE && defined(RUSAGE_SELF)
! #if defined(_SQUID_SOLARIS_) && !defined(__USLC__)
      /* Solaris 2.5 has getrusage() permission bug -- Arjan de Vet */
      enter_suid();
  #endif
      getrusage(RUSAGE_SELF, r);
! #if defined(_SQUID_SOLARIS_)  && !defined(__USLC__)
      leave_suid();
  #endif
  #endif
***************
*** 273,278 ****
--- 273,279 ----
      }
  #endif /* _SQUID_HPUX_ */
  #ifdef _SQUID_SOLARIS_
+ #ifndef __USLC__
      {				/* get ftp://opcom.sun.ca/pub/tars/opcom_stack.tar.gz and */
  	extern void opcom_stack_trace(void);	/* link with -lopcom_stack */
  	fflush(debug_log);
***************
*** 280,285 ****
--- 281,287 ----
  	opcom_stack_trace();
  	fflush(stdout);
      }
+ #endif /* __USLC__ */
  #endif /* _SQUID_SOLARIS_ */
  #if HAVE_BACKTRACE_SYMBOLS_FD
      {
*** ./src/cache_cf.c.osr6	Wed Sep 28 14:42:33 2005
--- ./src/cache_cf.c	Mon Oct 24 14:17:50 2005
***************
*** 440,447 ****
  		    Config.effectiveUser);
  	    Config2.effectiveUserID = pwd->pw_uid;
  	    Config2.effectiveGroupID = pwd->pw_gid;
- 	    if (pwd->pw_dir && *pwd->pw_dir)
- 		setenv("HOME", pwd->pw_dir, 1);
  	}
      } else {
  	Config2.effectiveUserID = geteuid();
--- 440,445 ----
*** ./helpers/basic_auth/getpwnam/getpwnam_auth.c.osr6	Sun Apr 24 09:28:16 2005
--- ./helpers/basic_auth/getpwnam/getpwnam_auth.c	Mon Oct 24 14:14:39 2005
***************
*** 42,47 ****
--- 42,51 ----
  
  #include "util.h"
  
+ #ifdef _USE_SHADOW
+ #include <shadow.h>
+ #endif
+ 
  #define ERR    "ERR\n"
  #define OK     "OK\n"
  
***************
*** 49,55 ****
--- 53,63 ----
  main()
  {
      char buf[256];
+ #ifdef _USE_SHADOW
+     struct spwd *pwd;
+ #else
      struct passwd *pwd;
+ #endif
      char *user, *passwd, *p;
  
      setbuf(stdout, NULL);
***************
*** 68,83 ****
  	}
  	rfc1738_unescape(user);
  	rfc1738_unescape(passwd);
  	pwd = getpwnam(user);
  	if (pwd == NULL) {
  	    printf("ERR No such user\n");
  	} else {
! 	    if (strcmp(pwd->pw_passwd, (char *) crypt(passwd, pwd->pw_passwd))) {
! 		printf("ERR Wrong password\n");
  	    } else {
! 		printf(OK);
  	    }
! 	}
      }
      exit(0);
  }
--- 76,100 ----
  	}
  	rfc1738_unescape(user);
  	rfc1738_unescape(passwd);
+ #ifdef _USE_SHADOW
+     pwd = getspnam(user);
+ #else
  	pwd = getpwnam(user);
+ #endif
  	if (pwd == NULL) {
  	    printf("ERR No such user\n");
  	} else {
! #ifdef _USE_SHADOW
!         if (strcmp(pwd->sp_pwdp, (char *)crypt(passwd, pwd->sp_pwdp)))
! #else
!         if (strcmp(pwd->pw_passwd, (char *)crypt(passwd, pwd->pw_passwd)))
! #endif
!         {
! 		    printf("ERR Wrong password\n");
  	    } else {
! 		    printf(OK);
  	    }
!     }
      }
      exit(0);
  }
*** ./helpers/basic_auth/getpwnam/Makefile.in.osr6	Wed Sep 28 13:57:19 2005
--- ./helpers/basic_auth/getpwnam/Makefile.in	Mon Oct 24 14:14:39 2005
***************
*** 144,150 ****
  getpwname_auth_DEPENDENCIES =
  getpwname_auth_LDFLAGS =
  
! DEFS = @DEFS@
  DEFAULT_INCLUDES =  -I. -I$(srcdir) -I$(top_builddir)/include
  CPPFLAGS = @CPPFLAGS@
  LDFLAGS = @LDFLAGS@
--- 144,150 ----
  getpwname_auth_DEPENDENCIES =
  getpwname_auth_LDFLAGS =
  
! DEFS = @DEFS@ -D_USE_SHADOW
  DEFAULT_INCLUDES =  -I. -I$(srcdir) -I$(top_builddir)/include
  CPPFLAGS = @CPPFLAGS@
  LDFLAGS = @LDFLAGS@
*** ./Build-OSR6.osr6	Mon Oct 24 14:14:39 2005
--- ./Build-OSR6	Mon Oct 24 14:14:39 2005
***************
*** 0 ****
--- 1,66 ----
+ #!/bin/sh
+ #
+ #set -x
+ # These must get set in the UW build but we need them set here
+ INSTALL=/usr/gnu/bin/install
+ VER=2.5.STABLE12
+ ROOT=/var/tmp/squid-${VER}-root
+ # We need GNU make.
+ MAKE=/usr/gnu/bin/make
+ export MAKE
+ [ ! -x $MAKE ] && {
+ 	error "ERROR: $MAKE not found" >&2
+ 	exit 1
+ }
+ # Auth schemes.
+ PAM=
+ AUTH="basic ntlm digest"
+ # Basic auth helpers.  We are excluding LDAP and SASL.
+ BASIC_AUTH_HELPERS="LDAP MSNT NCSA $PAM SMB YP getpwnam multi-domain-NTLM winbind"
+ CFLAGS='-O2 -Xa -Dasm=__asm -DANSICPP'
+ LDFLAGS=' '
+ CC="cc -Kthread -Kalloca"
+ export CFLAGS LDFLAGS CC
+ #set -e
+ # Configure and build in a separate work directory.
+ rm -rf work
+ mkdir work
+ cd work
+ #
+ # Note:
+ # Do not use --with-samba-sources option to point to samba-3.0.10.
+ #
+ ../configure \
+ 	--cache-file=/dev/null \
+ 	--host=i686-sco-sysv5 \
+ 	--build=i686-sco-sysv5 \
+ 	--prefix=/usr \
+ 	--libexecdir=/usr/bin \
+ 	--datadir=/usr/share/squid \
+ 	--sysconfdir=/etc/squid \
+ 	--localstatedir=/var/squid \
+ 	--enable-gnuregex \
+ 	--enable-carp \
+ 	--with-pthreads \
+ 	--with-dl \
+ 	--enable-removal-policies \
+ 	--enable-icmp \
+ 	--enable-delay-pools \
+ 	--enable-useragent-log \
+ 	--enable-referer-log \
+ 	--enable-kill-parent-hack \
+ 	--enable-snmp \
+ 	--disable-apr-acl \
+ 	--enable-htcp \
+ 	--enable-ssl \
+ 	--enable-cache-digests \
+ 	--enable-poll \
+ 	--enable-auth="$AUTH" \
+ 	--enable-basic-auth-helpers="$BASIC_AUTH_HELPERS" \
+ 	--enable-ntlm-auth-helpers \
+ 	--enable-digest-auth-helpers \
+ 	--enable-external-acl-helpers="ip_user ldap_group unix_group"
+ 
+ # Make and install.
+ $MAKE DESTDIR=$ROOT/$MACH install
+ 
*** ./squid.init.osr6	Mon Oct 24 14:14:39 2005
--- ./squid.init	Mon Oct 24 14:14:39 2005
***************
*** 0 ****
--- 1,264 ----
+ #!/bin/sh
+ #
+ #	@(#) squid 15.1 99/09/02 
+ #
+ # Copyright (c) 1999 The Santa Cruz Operation, Inc.. All Rights Reserved.
+ # THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF THE SANTA CRUZ OPERATION INC.
+ # The copyright notice above does not evidence any actual or intended
+ # publication of such source code.
+ # 
+ #
+ # squid start/stop script
+ # Usage: squid [ start | stop | enable | disable | query | restart | rotate ]
+ #
+ 
+ # definitions
+ USAGE="Usage: %s [ start | stop | enable | disable | query | restart | rotate ]"
+ CAT="squid.cat"
+ 
+ # paths to squid files, and a label
+ SQUID_LABEL="squid"
+ SQUID_BINARY="/usr/sbin/squid"
+ #SQUID_PIDFILE="/var/run/squid.pid"
+ SQUID_PIDFILE="/var/log/squid/logs/squid.pid"
+ 
+ # more paths, and some wait timeouts
+ PATH="/bin:/sbin:/usr/bin:/usr/sbin:/etc"; export PATH
+ SCRIPTDIR="/etc/init.d"
+ SCRIPT="squid"
+ SCRIPTNUM="S91"
+ STOP_TIMEOUT=90
+ START_TIMEOUT=30
+ 
+ #############################################################################
+ #
+ # squid_start
+ #
+ # start the server daemon running
+ #
+ #############################################################################
+ squid_start() {
+ 	$SQUID_BINARY -k check 2> /dev/null
+ 	if [ $? -eq 0 ]; then
+ 		dspmsg $CAT 2 "%s is already running.\n" $SQUID_LABEL
+ 	else
+ 		dspmsg $CAT 3 "Starting %s ... " $SQUID_LABEL
+ 		$SQUID_BINARY -sY 
+ 		count=0; while [ $count -lt $START_TIMEOUT ]; do
+ 			sleep 1                 # wait for startup
+ 			$SQUID_BINARY -k check 2> /dev/null
+ 			if [ $? -eq 0 ]; then
+ 				break
+ 			fi
+ 			count=`expr $count + 1`
+ 		done
+ 		if [ $count -lt $START_TIMEOUT ]; then
+ 			dspmsg $CAT 4 "done.\n"
+ 		else
+ 			echo "" #newline
+ 			dspmsg $CAT 5 "%s could not be started\n" $SQUID_LABEL
+ 		fi
+ 	fi
+ }
+ 
+ #############################################################################
+ #
+ # squid_stop
+ #
+ # stop the server daemon if it is running
+ #
+ #############################################################################
+ squid_stop() {
+ 	$SQUID_BINARY -k check 2> /dev/null
+ 	if [ $? -eq 0 ]; then
+ 		dspmsg $CAT 6 "Stopping %s ... " $SQUID_LABEL
+ #		PPID=`ps -ef | grep $SQUID_BINARY | awk ' { print $2 } '`
+ #               kill $PPID
+ #		PID=`ps -ef | grep squid | grep sY | awk ' { print $2 } '`
+ #               kill $PID
+ 		$SQUID_BINARY -k shutdown
+ 		count=0; while [ $count -lt $STOP_TIMEOUT ]; do
+ 			sleep 1			# let server stop
+ 			$SQUID_BINARY -k check 2> /dev/null
+ 			if [ $? -ne 0 ]; then
+ 				dspmsg $CAT 7 "done.\n"
+ 				break
+ 			fi
+ 			count=`expr $count + 1`
+ 		done
+ 		if [ $count -ge $STOP_TIMEOUT ]; then
+ 			echo "" #newline
+ 			dspmsg $CAT 8 "stop wait timed out.\n"
+ 		fi
+ 	else
+ 		dspmsg $CAT 9 "%s does not appear to be running.\n" $SQUID_LABEL
+ 	fi
+ }
+ 
+ #############################################################################
+ #
+ # squid_restart
+ #
+ # restart the server daemon by sending it a SIGHUP
+ #
+ #############################################################################
+ squid_restart() {
+ 	if [ -r $SQUID_PIDFILE ]; then
+ 		read line < $SQUID_PIDFILE
+ 		set -- junk $line		# protects against empty line
+ 		shift				# get rid of junk
+ 		KILL_PID=$1
+ 		kill -0 $KILL_PID 2>/dev/null
+ 		if [ $? -eq 0 ]; then
+ 			dspmsg $CAT 10 "Restarting %s ... " $SQUID_LABEL
+ 			kill -HUP $KILL_PID 2>/dev/null
+ 			dspmsg $CAT 11 "done.\n"
+ 		else
+ 			dspmsg $CAT 13 "%s does not appear to be running.\n" $SQUID_LABEL
+ 		fi
+ 	else
+ 		dspmsg $CAT 13 "%s does not appear to be running.\n" $SQUID_LABEL
+ 	fi
+ }
+ 
+ #############################################################################
+ #
+ # squid_enable
+ #
+ # add a link to this script into the /etc/rc2.d/ directory, then start
+ # the server
+ #
+ #############################################################################
+ squid_enable() {
+ 	if [ -f /etc/rc2.d/$SCRIPTNUM$SCRIPT ]; then
+ 		dspmsg $CAT 14 "%s is already enabled.\n" $SQUID_LABEL
+ 	else
+ 		dspmsg $CAT 15 "Enabling %s ... " $SQUID_LABEL
+ 		ln $SCRIPTDIR/$SCRIPT /etc/rc2.d/$SCRIPTNUM$SCRIPT
+ 		dspmsg $CAT 16 "done.\n"
+ 	fi
+ 	squid_start
+ }
+ 
+ #############################################################################
+ #
+ # squid_disable
+ #
+ # stop the server, then remove any links to this script in /etc/rc2.d/
+ #
+ #############################################################################
+ squid_disable() {
+ 	squid_stop
+ 	if [ -f /etc/rc2.d/$SCRIPTNUM$SCRIPT ]; then
+ 		dspmsg $CAT 17 "Disabling %s ... " $SQUID_LABEL
+ 		rm -f /etc/rc2.d/$SCRIPTNUM$SCRIPT
+ 		dspmsg $CAT 18 "done.\n"
+ 	else
+ 		dspmsg $CAT 19 "%s is already disabled.\n" $SQUID_LABEL
+ 	fi
+ }
+ 
+ #############################################################################
+ #
+ # squid_query 
+ #
+ # query the server to see if it is running
+ #
+ #############################################################################
+ squid_query() {
+ 	$SQUID_BINARY -k check 2> /dev/null
+ 	if [ $? -eq 0 ]; then
+ 		dspmsg $CAT 20 "%s is currently running.\n" $SQUID_LABEL
+ 	else
+ 		dspmsg $CAT 21 "%s is not running.\n" $SQUID_LABEL
+ 	fi
+ 	if [ -f /etc/rc2.d/$SCRIPTNUM$SCRIPT ]; then
+ 		dspmsg $CAT 22 "%s is enabled.\n" $SQUID_LABEL
+ 	else
+ 		dspmsg $CAT 23 "%s is disabled.\n" $SQUID_LABEL
+ 	fi
+ }
+ 
+ #############################################################################
+ #
+ # squid_rotate
+ #
+ # Rotates the logfiles by using squid's -k rotate command line option.
+ # If server is not running, this starts the server, rotates the logs, and
+ # then stops the server.
+ # 
+ #############################################################################
+ squid_rotate() {
+ 	$SQUID_BINARY -k check 2> /dev/null
+ 	#If it is running, rotate the logs
+ 	if [ $? -eq 0 ]; then
+ 		dspmsg $CAT 12 "Rotating logs ... "
+ 		if $SQUID_BINARY -k rotate ; then 
+ 			dspmsg $CAT 18 "done.\n"
+ 		else
+ 			echo "" #newline
+ 			dspmsg $CAT 24 "Unable to rotate logs.\n"	
+ 		fi
+ 	#if it is not running, start it, rotate logs, and then stop it
+ 	else
+ 		squid_start
+ 		$SQUID_BINARY -k check 2> /dev/null
+ 		if [ $? -eq 0 ]; then
+                 	dspmsg $CAT 12 "Rotating logs ... "
+                 	if $SQUID_BINARY -k rotate ; then
+ 	                        dspmsg $CAT 18 "done.\n"
+         	        else
+                 	        echo "" #newline
+                         	dspmsg $CAT 24 "Unable to rotate logs.\n"      
+ 			fi
+ 			squid_stop
+ 		else
+ 			dspmsg $CAT 24 "Unable to rotate logs.\n"
+                 fi
+ 	fi
+ }
+ 
+ 
+ #############################################################################
+ # main()
+ #############################################################################
+ 
+ # squid creates cached entries on disk using existing umask
+ # uw7's default of 0022 allows world readability, a security issue when
+ # dealing with cookies.
+ umask 0027
+ 
+ # Check usage
+ if [ $# -gt 1 ]; then
+         dspmsg $CAT 1 "$USAGE\n" $0
+         exit 1
+ fi
+ 
+ # function to perform is in $1
+ FUNCTION="$1"
+ 
+ # execute the routine for the requested function
+ case $FUNCTION in
+ start)
+ 	squid_start	;;
+ stop)
+ 	squid_stop	;;
+ enable)
+ 	squid_enable	;;
+ disable)
+ 	squid_disable	;;
+ query)
+ 	squid_query	;;
+ status)
+ 	squid_query	;;
+ restart)
+ 	squid_restart	;;
+ rotate)
+ 	squid_rotate	;;
+ *)
+ 	dspmsg $CAT 1 "$USAGE\n" $0
+ 	exit 1	;;
+ esac
+ 
+ #done
+ exit 0
*** ./squid.html.osr6	Mon Oct 24 14:14:39 2005
--- ./squid.html	Mon Oct 24 14:14:39 2005
***************
*** 0 ****
--- 1,14480 ----
+ <HTML
+ ><HEAD
+ ><TITLE
+ >Squid</TITLE
+ ><META
+ NAME="GENERATOR"
+ CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
+ "></HEAD
+ ><BODY
+ CLASS="BOOK"
+ BGCOLOR="#FFFFFF"
+ TEXT="#000000"
+ LINK="#0000FF"
+ VLINK="#840084"
+ ALINK="#0000FF"
+ ><DIV
+ CLASS="BOOK"
+ ><A
+ NAME="AEN1"><DIV
+ CLASS="TITLEPAGE"
+ ><H1
+ CLASS="TITLE"
+ ><A
+ NAME="AEN1">Squid</H1
+ ><H2
+ CLASS="SUBTITLE"
+ >A User's Guide</H2
+ ><H3
+ CLASS="AUTHOR"
+ ><A
+ NAME="AEN6">Oskar Pearson</H3
+ ><DIV
+ CLASS="AFFILIATION"
+ ><SPAN
+ CLASS="ORGNAME"
+ >Qualica Technologies (Pty) Ltd.<BR></SPAN
+ ><DIV
+ CLASS="ADDRESS"
+ ><P
+ CLASS="ADDRESS"
+ >oskar@linux.org.za</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="LEGALNOTICE"
+ ><A
+ NAME="AEN13"><P
+ ></P
+ ><P
+ >	Copyright (c)  2003  Oskar Pearson
+ 	c/o Qualica Technologies (Pty) Ltd, PO Box 783168, Sandton, JHB, Gauteng, 2184, South Africa
+ 	</P
+ ><P
+ >	Permission is granted to copy, distribute and/or modify this
+ 	document under the terms of the GNU Free Documentation License,
+ 	Version 1.1 or any later version published by the Free Software
+ 	Foundation; with one Invariant Section: "History and Credits" , no Front-Cover Texts, and
+ 	no Back-Cover Texts.
+ 	A copy of the license is included in the section entitled "GNU Free Documentation License".
+ 	</P
+ ><P
+ ></P
+ ></DIV
+ ><HR></DIV
+ ><DIV
+ CLASS="TOC"
+ ><DL
+ ><DT
+ ><B
+ >Table of Contents</B
+ ></DT
+ ><DT
+ >1. <A
+ HREF="#AEN16"
+ >History and Credits</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN18"
+ >History and Credits</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ >2. <A
+ HREF="#AEN21"
+ >Installing Squid</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN26"
+ >Hardware Requirements</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN40"
+ >Gathering statistics</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN49"
+ >Hard Disks</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN82"
+ >RAM requirements</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN89"
+ >CPU Power</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN94"
+ >Choosing an Operating System</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN102"
+ >Experience</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN106"
+ >Features</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN113"
+ >Compilers</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN123"
+ >Basic System Setup</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN126"
+ >Default Squid directory structure</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN159"
+ >User and Group IDs</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN179"
+ >Getting Squid</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN191"
+ >Getting the Squid source code</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN208"
+ >Getting Binary Versions of Squid</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN220"
+ >Compiling Squid</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN225"
+ >Compilation Tools</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN237"
+ >Unpacking the Source Archive</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN250"
+ >Compilation options</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN405"
+ >Running configure</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN428"
+ >Compiling the Squid Source</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN438"
+ >Installing the Squid binary</A
+ ></DT
+ ></DL
+ ></DD
+ ></DL
+ ></DD
+ ><DT
+ >3. <A
+ HREF="#AEN458"
+ >Squid Configuration Basics</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN475"
+ >Version Control Systems</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN495"
+ >The Configuration File</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN505"
+ >Setting Squid's HTTP Port</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN525"
+ >Using Port 80</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN564"
+ >Email for the Cache Administrator</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN568"
+ >Effective User and Group ID</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN580"
+ >FTP login information</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN591"
+ >Access Control Lists and Access Control Operators</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN595"
+ >Simple Access Control</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN641"
+ >Ensuring Direct Access to Internal Machines</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN666"
+ >Communicating with other proxy servers</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN688"
+ >Your ISP's cache</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN702"
+ >Firewall Interactions</A
+ ></DT
+ ></DL
+ ></DD
+ ></DL
+ ></DD
+ ><DT
+ >4. <A
+ HREF="#AEN777"
+ >Starting Squid</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN779"
+ >Before Running Squid</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN782"
+ >Subdirectory Permissions</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN897"
+ >Running Squid</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN922"
+ >Testing Squid</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN974"
+ >Testing a Cache or Proxy Server with Client</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1013"
+ >Addition to Startup Files</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ >5. <A
+ HREF="#AEN1021"
+ >Browser Configuration</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1023"
+ >Browsers</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1034"
+ >Basic Configuration</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1037"
+ >Advanced Configuration</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1054"
+ >Basic Configuration</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1062"
+ >Host name</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1159"
+ >Browser-cache Interaction</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1177"
+ >Testing the Cache</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1187"
+ >Cache Auto-config</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1191"
+ >Web server config changes for autoconfig files</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1220"
+ >Autoconfig Script Coding</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1339"
+ >Super Proxy Script</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1353"
+ >cgi generated autoconfig files</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1357"
+ >Future directions</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1362"
+ >Roaming</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1369"
+ >Browsers</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1373"
+ >Transparency</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1386"
+ >Ready to Go</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ >6. <A
+ HREF="#AEN1389"
+ >Access Control and Access Control Operators</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1393"
+ >Uses of ACLs</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1396"
+ >Access Classes and Operators</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1455"
+ >Acl lines</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1462"
+ >A unique name</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1471"
+ >Type</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1474"
+ >Decision String</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1493"
+ >Types of acl</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1793"
+ >Acl-operator lines</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1831"
+ >The other Acl-operators</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1912"
+ >SNMP Configuration</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1924"
+ >Querying the Squid SNMP server on port 3401</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1939"
+ >Running multiple SNMP servers on a cache machine</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN1982"
+ >Delay Classes</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN1991"
+ >Slowing down access to specific URLs</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN1995"
+ >The Second Pool Class</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2028"
+ >The Second Pool Class</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2039"
+ >The Third Pool Class</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2053"
+ >Using Delay Pools in Real Life</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2072"
+ >Conclusion</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ >7. <A
+ HREF="#AEN2075"
+ >Cache Hierarchies</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2077"
+ >Introduction</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2081"
+ >Why Peer</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2088"
+ >Peer Configuration</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2094"
+ >The cache_peer Option</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2163"
+ >Peer Selection</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2166"
+ >Selecting by Destination Domain</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2172"
+ >Selecting with Acls</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2243"
+ >Other Peering Options</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2263"
+ >Multicast Cache Communication</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2279"
+ >Getting your machine ready for Multicast</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2291"
+ >Querying a Multicast Cache</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2308"
+ >Accepting Multicast Queries: The mcast_groups option</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2315"
+ >Other Multicast Cache Options</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2328"
+ >Cache Digests</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2338"
+ >Cache Hierarchy Structures</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2342"
+ >Two Peering Caches</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2365"
+ >Trees</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2377"
+ >Meshes</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2386"
+ >Load Balancing Servers</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2398"
+ >The Cache Array Routing Protocol (CARP)</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ >8. <A
+ HREF="#AEN2416"
+ >Accelerator Mode</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2422"
+ >When to use Accelerator Mode</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2425"
+ >Acceleration of a slow server</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2428"
+ >Replacing a combination cache/web server with Squid</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2431"
+ >Transparent Caching</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2435"
+ >Security</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2439"
+ >Accelerator Configuration Options</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2442"
+ >The httpd_accel_host option</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2446"
+ >The httpd_accel_port option</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2450"
+ >The httpd_accel_with_proxy option</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2457"
+ >The httpd_accel_uses_host_header option</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2468"
+ >Related Configuration Options</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2471"
+ >The redirect_rewrites_host_header option</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2474"
+ >Refresh patterns</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2478"
+ >Access Control</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2491"
+ >Example Configurations</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2494"
+ >Replacing a Combination Web/Cache server</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2510"
+ >Accelerating Requests to a Slow Server</A
+ ></DT
+ ></DL
+ ></DD
+ ></DL
+ ></DD
+ ><DT
+ >9. <A
+ HREF="#AEN2519"
+ >Transparent Caching</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2531"
+ >The Problem with Transparency</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2539"
+ >The Transparent Caching Process</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2542"
+ >Some Routing Basics</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2564"
+ >Packet Flow with Transparent Caches</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2588"
+ >Network Layout</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2595"
+ >Filtering Traffic</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2600"
+ >Unix machines</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2603"
+ >Routers (not done)</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2606"
+ >Layer-Four Switches (not done)</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ ><A
+ HREF="#AEN2609"
+ >Kernel Redirection (not done)</A
+ ></DT
+ ><DT
+ ><A
+ HREF="#AEN2612"
+ >Squid Settings (not done)</A
+ ></DT
+ ></DL
+ ></DD
+ ><DT
+ >10. <A
+ HREF="#AEN2615"
+ >Not Yet Done: Squid Config files and options</A
+ ></DT
+ ><DT
+ >11. <A
+ HREF="#AEN2620"
+ >Overall Layout (for writers)</A
+ ></DT
+ ><DT
+ >12. <A
+ HREF="#AEN2627"
+ >GNU Free Documentation License</A
+ ></DT
+ ><DD
+ ><DL
+ ><DT
+ ><A
+ HREF="#AEN2629"
+ >GNU Free Documentation License</A
+ ></DT
+ ></DL
+ ></DD
+ ></DL
+ ></DIV
+ ><DIV
+ CLASS="LOT"
+ ><DL
+ CLASS="LOT"
+ ><DT
+ ><B
+ >List of Examples</B
+ ></DT
+ ><DT
+ >3-1. <A
+ HREF="#AEN577"
+ >Effective User and Group IDs</A
+ ></DT
+ ><DT
+ >3-2. <A
+ HREF="#AEN603"
+ >Theoretical Access List</A
+ ></DT
+ ><DT
+ >3-3. <A
+ HREF="#AEN608"
+ >Access Lists using Classes</A
+ ></DT
+ ><DT
+ >3-4. <A
+ HREF="#AEN624"
+ >CIDR vs Netmask Source-IP Notation</A
+ ></DT
+ ><DT
+ >3-5. <A
+ HREF="#AEN638"
+ >Example Complete ACL list</A
+ ></DT
+ ><DT
+ >3-6. <A
+ HREF="#AEN657"
+ >Using always and never_direct</A
+ ></DT
+ ><DT
+ >4-1. <A
+ HREF="#AEN954"
+ >Using the -h and -p client Options</A
+ ></DT
+ ><DT
+ >4-2. <A
+ HREF="#AEN967"
+ >Retrieving Pages directly from a remote site with client</A
+ ></DT
+ ><DT
+ >4-3. <A
+ HREF="#AEN971"
+ >Printing timing information for a page download</A
+ ></DT
+ ><DT
+ >4-4. <A
+ HREF="#AEN977"
+ >Accessing a site through the cache</A
+ ></DT
+ ><DT
+ >4-5. <A
+ HREF="#AEN1017"
+ >Runcache command in the startup files</A
+ ></DT
+ ><DT
+ >5-1. <A
+ HREF="#AEN1211"
+ >Restarting Apache</A
+ ></DT
+ ><DT
+ >5-2. <A
+ HREF="#AEN1230"
+ >A very basic autoconfig file</A
+ ></DT
+ ><DT
+ >5-3. <A
+ HREF="#AEN1238"
+ >Connecting to a cache server</A
+ ></DT
+ ><DT
+ >5-4. <A
+ HREF="#AEN1243"
+ >Connecting to a cache server, with failover</A
+ ></DT
+ ><DT
+ >5-5. <A
+ HREF="#AEN1261"
+ >dnsDomainIs</A
+ ></DT
+ ><DT
+ >5-6. <A
+ HREF="#AEN1267"
+ >Using multiple dnsDomainIs calls</A
+ ></DT
+ ><DT
+ >5-7. <A
+ HREF="#AEN1276"
+ >using the isInNet call</A
+ ></DT
+ ><DT
+ >5-8. <A
+ HREF="#AEN1287"
+ >using isPlainHostName to decide if the connection should be direct</A
+ ></DT
+ ><DT
+ >5-9. <A
+ HREF="#AEN1297"
+ >myIpAddress</A
+ ></DT
+ ><DT
+ >5-10. <A
+ HREF="#AEN1304"
+ >shExpMatch</A
+ ></DT
+ ><DT
+ >5-11. <A
+ HREF="#AEN1312"
+ >url.substring</A
+ ></DT
+ ><DT
+ >5-12. <A
+ HREF="#AEN1323"
+ >A small organization's proxy config file</A
+ ></DT
+ ><DT
+ >5-13. <A
+ HREF="#AEN1329"
+ >Dialup ISP autoconfig file</A
+ ></DT
+ ><DT
+ >5-14. <A
+ HREF="#AEN1335"
+ ></A
+ ></DT
+ ><DT
+ >6-1. <A
+ HREF="#AEN1415"
+ >Explicit allow, explicit deny (do not use this!, see later text for reasons)</A
+ ></DT
+ ><DT
+ >6-2. <A
+ HREF="#AEN1438"
+ >Only an allow acl-operator</A
+ ></DT
+ ><DT
+ >6-3. <A
+ HREF="#AEN1446"
+ >Corrected example 6-1, explicit deny all</A
+ ></DT
+ ><DT
+ >6-4. <A
+ HREF="#AEN1451"
+ >Example 6-1 once the cache is considered stable</A
+ ></DT
+ ><DT
+ >6-5. <A
+ HREF="#AEN1482"
+ >Using multiple acl Decision Strings per line</A
+ ></DT
+ ><DT
+ >6-6. <A
+ HREF="#AEN1489"
+ ></A
+ ></DT
+ ><DT
+ >6-7. <A
+ HREF="#AEN1541"
+ >Denying access to a small section of a larger block</A
+ ></DT
+ ><DT
+ >6-8. <A
+ HREF="#AEN1564"
+ >Filtering out unwanted destination sites</A
+ ></DT
+ ><DT
+ >6-9. <A
+ HREF="#AEN1595"
+ >Denying access to sites with the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > in the URL</A
+ ></DT
+ ><DT
+ >6-10. <A
+ HREF="#AEN1605"
+ ></A
+ ></DT
+ ><DT
+ >6-11. <A
+ HREF="#AEN1656"
+ >Allowing Web access during the weekend only</A
+ ></DT
+ ><DT
+ >6-12. <A
+ HREF="#AEN1685"
+ >Denying access to FTP sites</A
+ ></DT
+ ><DT
+ >6-13. <A
+ HREF="#AEN1713"
+ >Breaking search site access</A
+ ></DT
+ ><DT
+ >6-14. <A
+ HREF="#AEN1721"
+ ></A
+ ></DT
+ ><DT
+ >6-15. <A
+ HREF="#AEN1729"
+ >Using ident usernames to deny cache access</A
+ ></DT
+ ><DT
+ >6-16. <A
+ HREF="#AEN1735"
+ >Using Ident to classify users, and using Squid to deny classes</A
+ ></DT
+ ><DT
+ >6-17. <A
+ HREF="#AEN1814"
+ >Using more than one acl operator on an http_access line</A
+ ></DT
+ ><DT
+ >6-18. <A
+ HREF="#AEN1820"
+ >Specifying more than one acl per http_access line</A
+ ></DT
+ ><DT
+ >6-19. <A
+ HREF="#AEN1870"
+ >Logging ident values from specific machines</A
+ ></DT
+ ><DT
+ >6-20. <A
+ HREF="#AEN1874"
+ >Doing ident lookups for unknown machines</A
+ ></DT
+ ><DT
+ >6-21. <A
+ HREF="#AEN1896"
+ >Allowing a subnet range to only get data we already have (hits)</A
+ ></DT
+ ><DT
+ >6-22. <A
+ HREF="#AEN1909"
+ >Using the broken_posts acl-operator</A
+ ></DT
+ ><DT
+ >6-23. <A
+ HREF="#AEN1936"
+ >Using the snmp_community acl type</A
+ ></DT
+ ><DT
+ >6-24. <A
+ HREF="#AEN1969"
+ >Allowing SNMP access from only one machine</A
+ ></DT
+ ><DT
+ >6-25. <A
+ HREF="#AEN1979"
+ >Using the snmp_community acl type</A
+ ></DT
+ ><DT
+ >6-26. <A
+ HREF="#AEN1999"
+ >Limiting download speed by a word in the URL</A
+ ></DT
+ ><DT
+ >6-27. <A
+ HREF="#AEN2036"
+ >Limiting both overall and per-user bandwidth usage</A
+ ></DT
+ ><DT
+ >6-28. <A
+ HREF="#AEN2043"
+ >Using Class 3 Delay Pools</A
+ ></DT
+ ><DT
+ >7-1. <A
+ HREF="#AEN2098"
+ >The cache_peer tag</A
+ ></DT
+ ><DT
+ >7-2. <A
+ HREF="#AEN2169"
+ >The cache_peer_domain tag</A
+ ></DT
+ ><DT
+ >7-3. <A
+ HREF="#AEN2176"
+ >Using acls to select peers</A
+ ></DT
+ ><DT
+ >7-4. <A
+ HREF="#AEN2184"
+ >Passing suspect urls to a filtering cache</A
+ ></DT
+ ><DT
+ >7-5. <A
+ HREF="#AEN2191"
+ >Ignoring Hierarchy Caches for a Local Top-Level Domain</A
+ ></DT
+ ><DT
+ >7-6. <A
+ HREF="#AEN2203"
+ >Bypassing a parent for a local machine</A
+ ></DT
+ ><DT
+ >7-7. <A
+ HREF="#AEN2240"
+ >Changing the Cache Type by Destination Domain</A
+ ></DT
+ ><DT
+ >7-8. <A
+ HREF="#AEN2252"
+ ></A
+ ></DT
+ ><DT
+ >7-9. <A
+ HREF="#AEN2305"
+ >Sending Queries to a Multicast Server</A
+ ></DT
+ ><DT
+ >7-10. <A
+ HREF="#AEN2312"
+ >Listening for Multicast Queries</A
+ ></DT
+ ><DT
+ >7-11. <A
+ HREF="#AEN2410"
+ >Using CARP Load Factor variables</A
+ ></DT
+ ><DT
+ >8-1. <A
+ HREF="#AEN2482"
+ >Before Accelerator Configuration</A
+ ></DT
+ ><DT
+ >8-2. <A
+ HREF="#AEN2488"
+ >After Accelerator Configuration</A
+ ></DT
+ ><DT
+ >8-3. <A
+ HREF="#AEN2507"
+ >Forwarding Web Requests to a Server on the Same Machine</A
+ ></DT
+ ><DT
+ >8-4. <A
+ HREF="#AEN2514"
+ >Accelerating a Slow Server</A
+ ></DT
+ ></DL
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN16">Chapter 1. History and Credits</H1
+ ><DIV
+ CLASS="SECT1"
+ ><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN18">History and Credits</H2
+ ><P
+ >Oskar Pearson (oskar@linux.org.za) wrote the original
+ version of this document, with the support of both Internet Solutions
+ (Pty) Ltd (http://www.is.co.za/) and Qualica Technologies (Pty) Ltd
+ (http://www.qualica.com/), both of South Africa.
+ He gives many thanks to both of these organisations for their support.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN21">Chapter 2. Installing Squid</H1
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN26">Hardware Requirements</H2
+ ><P
+ >Caching stresses certain hardware subsystems more than others. Although the
+ key to good cache performance is good overall system performance, the
+ following list is arranged in order of decreasing importance:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Disk random seek time</P
+ ></LI
+ ><LI
+ ><P
+ >Amount of system memory</P
+ ></LI
+ ><LI
+ ><P
+ >Sustained disk throughput</P
+ ></LI
+ ><LI
+ ><P
+ >CPU power</P
+ ></LI
+ ></UL
+ ><P
+ >Do not drastically underpower any one subsystem, or performance <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >will</I
+ ></SPAN
+ >
+ suffer.
+ In the case of catastrophic hardware failure you must have a ready supply
+ of alternate parts. When your cache is critical, you should have a (working!)
+ standby machine with operating system and Squid installed. This can be kept
+ ready for nearly instantaneous swap-out. This will, of course, increase
+ your costs, something that you may want to take into account. Chapter 13
+ covers standby procedures in detail.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN40">Gathering statistics</H3
+ ><P
+ >When deciding on your cache's horsepower, many factors must be
+ taken into account. To decide on your machine, you need an idea of the load
+ that it will need to sustain: the peak number of requests per minute.
+ This number indicates the number of 'objects' downloaded in a minute by
+ clients, and can be used to get an idea of your cache load.</P
+ ><P
+ >Computing the peak number of requests is difficult, since it depends on the
+ browsing habits of users.
+ This, in turn, makes deciding on the required hardware difficult. If you
+ don't have many statistics as to your Internet usage, it is probably worth
+ your while installing a test cache server (on any machine that you have
+ handy) and pointing some of your staff at it. Using ratios you can
+ estimate the number of requests with a larger user base.</P
+ ><P
+ >When gathering statistics, make sure that you judge the 'peak' number of
+ requests, rather than an <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >average</I
+ ></SPAN
+ > value. You shouldn't take the number
+ of requests per day and divide, since your peak (during, for example, lunch
+ hour) can be many times your average number of requests.</P
+ ><P
+ >It's a very good idea to over-estimate hardware requirements.
+ Stay ahead of the growth curve too, since an overloaded cache can spiral
+ out of control due to a transient network problems If a cache cannot deal
+ with incoming requests for some reason (say a DNS outage), it still continues
+ to accept incoming requests, in the hope that it can deal with them.
+ If no requests can be handled, the number of concurrent connections
+ will increase at the rate that new requests arrive.</P
+ ><P
+ >If your cache runs close to capacity, a temporary glitch can increase the
+ number of concurrent, waiting, requests tremendously. If your cache can't
+ cope with this number of established connections, it may never be able to
+ recover, with current connections never being cleared while
+ it tries to deal with a huge backlog.</P
+ ><P
+ >Squid 2.0 may be configured to use threads to perform asynchronous
+ Input/Output on operating systems that supports Posix threads.
+ Including async-IO can dramatically reduce your cache latency, allowing you
+ to use a less powerful machine. Unfortunately not all systems support
+ Posix threads correctly, so your choice of hardware can depend on the
+ abilities of your operating system. Your choice of operating system is
+ discussed in the next section - see if your system will support threads
+ there.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN49">Hard Disks</H3
+ ><P
+ >There are numerous things to consider when buying disks. Earlier on we
+ mentioned the importance of disks with a fast random-seek time, and with high
+ sustained-throughput. Having the world's fastest drive is not useful,
+ though, if it holds a tiny amount of data. To cache effectively you need
+ disks that can hold a significant amount of downloaded data, but that are
+ fast enough to not slow your cache to a crawl.</P
+ ><P
+ >Seek time is one of the most important considerations if your cache is
+ going to be loaded. If you have a look at a disk's documentation there is
+ normally a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >random seek time</I
+ ></SPAN
+ > figure. The smaller this value the
+ better: it is the average time that the disk's heads take to move from a
+ random track to another (in milliseconds).
+ 
+ 
+ Operating systems do all sorts of interesting things (which are not covered
+ here) to attempt to speed up disk access times: waiting for disks 
+ can slow a machine down dramatically. These operating system features make
+ it difficult to estimate how many requests per second your cache can handle
+ before being slowed by disk access times (rather than by network speed). In
+ the next few paragraphs we ignore operating system readahead, inode update
+ seeks and more: it's a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >back of the envelope</I
+ ></SPAN
+ > approximation for your
+ use.</P
+ ><P
+ >If your cache does not use <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >asynchronous Input-Output</I
+ ></SPAN
+ > (described in
+ the Operating system section shortly) then your cache loses a lot of the
+ advantage gained by multiple disks. If your cache is going to be loaded
+ (or is running anywhere approaching capacity according to the formulae
+ below) you must ensure that your operating system supports posix threads!</P
+ ><P
+ >A cache with one disk has to seek at least once per request (ignoring
+ RAM caching of the disk and inode update times). If you have only one disk,
+ the formula for working out seeks per second (and hence requests per
+ second) is quite simple:
+ 
+ 
+ 
+ <A
+ NAME="AEN63"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >requests&nbsp;per&nbsp;second&nbsp;=&nbsp;1000/seek&nbsp;time</P
+ ></BLOCKQUOTE
+ >
+ Squid load-balances writes between multiple cache disks, so if you
+ have more than one data disk your seeks-per-second per disk will be lower.
+ Almost all operating systems will increase random seek time in a
+ semi-linear fashion as you add more disks, though others may have a small
+ performance penalty. If you add more disks to the equation, the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >requests per second</I
+ ></SPAN
+ > value becomes even more approximate! To simplify things in the
+ meantime, we are going to assume that you use only disks with the same seek
+ time. Our formula thus becomes:
+ <A
+ NAME="AEN66"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >					&nbsp;1000<br>
+ theoretical&nbsp;requests&nbsp;per&nbsp;second&nbsp;=	&nbsp;-----------------<br>
+ 					&nbsp;(seek&nbsp;time)/(number&nbsp;of&nbsp;disks)</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >Let's consider a less theoretical example:
+ I have three disks - all have 12ms seek times. I can thus (theoretically,
+ as always) handle:
+ <A
+ NAME="AEN69"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >requests&nbsp;per&nbsp;second&nbsp;=&nbsp;1000/(12/3)&nbsp;=&nbsp;1000/4&nbsp;=&nbsp;250&nbsp;requests&nbsp;per&nbsp;second</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >While we are on this topic: many people query the use of IDE disks in
+ caches. IDE disks these days generally have very similar seek times to SCSI
+ disks, and (with DMA-compatible IDE controllers) approach the speed of data
+ transfer without slowing the whole machine down. </P
+ ><P
+ >Deciding how much disk space to allocate to Squid is difficult. For the
+ pilot project you can simply allocate a few megabytes, but this is unlikely
+ to be useful on a production cache.</P
+ ><P
+ >The amount of disk space required depends on quite a few factors.</P
+ ><P
+ >Assume that you were to run a cache just for yourself. If you were to
+ allocate 1 gig of disk, and you browse pages at a rate of 10 megabytes per
+ day, it will take at least 100 days for you to fill the cache.</P
+ ><P
+ >You can thus see that the rate of incoming cache queries influences the
+ amount of disk to allocate.</P
+ ><P
+ >If you examine the other end of the scale, where you have 10 megabytes of
+ disk, and 10 incoming queries per second, you will realize that at this rate
+ your disk space will not last very long. Objects are likely to be pushed
+ out of the cache as they arrive, so getting a hit would require two people
+ to be downloading the object at almost exactly the same time. Note that the
+ latter is definitely not impossible, but it happens only occasionally on
+ loaded caches.</P
+ ><P
+ >The above certainly appears simple, but many people do not extrapolate.
+ The same relationships govern the expulsion of objects from your cache at
+ larger cache store sizes. When deciding on the amount of disk space to
+ allocate, you should determine approximately how much data will pass
+ through the cache each day. If you are unable to determine this, you could
+ simply use your theoretical maximum transfer rate of your line as a basis.
+ A 1mb/s line can transfer about 125000 bytes per second. If all clients
+ were setup to access the cache, disk would be used at about 125k per
+ second, which translates to about 450 megabytes per hour. If the bulk of your
+ traffic is transferred during the day, you are probably transferring 3.6
+ gigabytes per day. If your line was 100% used, however, you would probably
+ have upgraded it a while ago, so let's assume you transfer 2 gigabytes
+ per day. If you wanted to keep ALL data for a day, you would have to have 2
+ gigabytes of disk for Squid.</P
+ ><P
+ >The feasibility of caching depends on two or more users visiting the same
+ page while the object is still on disk. This is quite likely to happen with
+ the large sites (search engines, and the default home pages in respective
+ browsers), but the chances of a user visiting the same obscure page is
+ slim, simply due to the volume of pages. In many cases the obscure pages
+ are on the slowest links, frustrating users. Depending on the number of
+ users requesting pages you should keep pages for longer, so that the
+ chances of different users accessing the same page twice is higher.
+ Determining this value, however, is difficult, since it also depends on the
+ average object size, which, in turn, depends on user habits.</P
+ ><P
+ >Some people use RAID systems on their caches. This can dramatically
+ increase availability, but a RAID-5 system can reduce disk throughput
+ significantly. If you are really concerned with uptime, you may find a RAID
+ system useful. Since the actual data in the cache store is not vital,
+ though, you may prefer to manually fail-over the cache, simply
+ re-formatting or replacing drives. Sure, your cache may have a lower
+ hit-ratio for a short while, but you can easily balance this minute cost
+ against what hardware to do automatic failover would have cost you.</P
+ ><P
+ >You should probably base your purchase on the bandwidth description above,
+ and use the data discussed in chapter 11 to decide when to add more disk.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN82">RAM requirements</H3
+ ><P
+ >Squid keeps an in-memory table of objects in RAM. Because of the way that
+ Squid checks if objects are in the file store, fast access to the table is
+ very important. Squid slows down dramatically when parts of the table are in
+ swap.</P
+ ><P
+ >Since Squid is one large process, swapping is particularly bad. If the
+ operating system has to swap data, Squid is placed on the 'sleeping tasks'
+ queue, and cannot service other established connections. (? hmm. it will
+ actually get woken up straight away. I wonder if this is relevant ?)</P
+ ><P
+ >Each object stored on disk uses about 75 bytes (? get exact value ?) of RAM
+ in the index. The average size of an object on the Internet is about 13kb, so
+ if you have a gigabyte of disk space you will probably store around about
+ 80 000 objects.</P
+ ><P
+ >At 75 bytes of RAM per object, 80 000 objects require about six megabytes of
+ RAM. If you have 8gigs of disk you will need 48Mb of RAM just for the
+ object index. It is important to note that this excludes memory for your
+ operating system, the Squid binary, memory for in-transit objects and spare
+ RAM for for disk cache.</P
+ ><P
+ >So, what should your sustained-thoughput of your disks be? Squid tends
+ to read in small blocks, so throughput is of lesser importance than random
+ seek times. Generally disks with fast seeks are high throughput, and most
+ disks (even IDE disks these days) can transfer data faster than clients can
+ download it from you. Don't blow a year's budget on really high-speed
+ disks, go for lower-seek times instead - or add more disks.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN89">CPU Power</H3
+ ><P
+ >Squid is not generally CPU intensive. On startup Squid can use a lot of CPU
+ while it works out what is in the cache, and a slow CPU can slow down
+ access to the cache for the first few minutes upon startup. A Pentium 133
+ machine generally runs pretty idle, while receiving 7 TCP requests a second
+ 
+ 
+ A multiprocessor machine generally doesn't increase speed dramatically:
+ only certain portions of the Squid code are threaded. These sections of
+ code are not processor intensive either: they are the code paths where
+ Squid is waiting for the operating system to complete something. A
+ multiprocessor machine generally does not reduce these wait times: more
+ memory (for caching of data) and more disks may help more.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN94">Choosing an Operating System</H2
+ ><P
+ >Where I work, we run many varieties of Unix. When I first installed Squid it
+ was on my desktop Linux machine - if I break it by mistake it's not going
+ to cause users hassles, so I am free to do on it what I wish.</P
+ ><P
+ >Once I had tested Squid, we decided to allow general access to the cache.
+ I installed Squid on the fastest unused machine we had available at the
+ time: a (then, at least) top of the range Pentium 133 with 128Mb of RAM
+ running FreeBSD.</P
+ ><P
+ >I was much more familiar with Linux at that stage, and eventually installed
+ Linux on the public cache machine. Though running Linux caused some
+ inconveniences (specifically with low per-process filehandle limits), it was
+ the right choice, simply because I could maintain the machine better. Many
+ times my experience with Linux has gotten me out of potentially sticky
+ situations.</P
+ ><P
+ >If your choice of operating system saves you time, and runs Squid, use it!
+ Just as I didn't use Digital Unix (Squid is developed on funded Digital
+ Unix machines at NLANR), you don't need to use Linux just because I do.</P
+ ><P
+ >Most modern operating systems sport both similar performance and similar feature
+ sets. If your system is commonly used and roughly Posix compliant at the
+ source level, it will almost certainly be supported by Squid.</P
+ ><P
+ >When was the last time you had an outage due to hardware failure?
+ Unless you are particularly unlucky, the interval between hardware failures
+ is low. While the quality of hardware has increased dramatically, software
+ often does not keep pace. Many outages are caused by faulty application
+ of operating system software. You must thus be able to pick up the pieces
+ if your operating system crashes for some reason.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN102">Experience</H3
+ ><P
+ >If you normally work on a specific operating system, you should probably not
+ use your cache as a system to experiment with a new 'flavor' of Unix. If
+ you have more experience in an operating system, you should use that system as
+ the basis for your cache server. Customers rapidly turn off caching when
+ a cache stops accepting requests (while you learn your way around some
+ 'feature').</P
+ ><P
+ >Your cache system will almost certainly form a core part of your network as
+ soon as it is stable. You must be able to return the system to working
+ order in minimal time in the event of a system failure, and this is where your
+ existing experience becomes crucial. If the failure happens out of business
+ hours you may not be able to get technical support from your vendor. A
+ dialup ISP's hours of business differ dramatically to that of Operating
+ System vendors.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN106">Features</H3
+ ><P
+ >Though most operating systems support similar features, there are often
+ no standards for functions required for some of the less commonly used
+ operating system features. One example is transparency: many operating systems
+ can now support transparent redirection to a local program, but almost all
+ of them function in a different way, since there is not a real standard for
+ the way an operating system is supposed to function in this scenario.</P
+ ><P
+ >If you are unable to find information about Squid on your operating system,
+ you may want to organize a trial hardware installation (assuming that you are
+ using a commercial operating system) as a test. Only when you have
+ the system running can you be sure that your operating system supports the
+ required features.</P
+ ><P
+ >Squid works on the following systems:
+ (? List ?)</P
+ ><P
+ >If you are using Squid without extensions like transparency and ARP access
+ control lists, you should not have problems. For your convenience a table
+ of operating system support of specific features is included. Since Squid
+ is constantly being developed, it's likely that this list will change.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN113">Compilers</H3
+ ><P
+ >Squid is written on Digital Unix (?version ?) machines running the GNU
+ C compiler (GCC). GCC is included with free operating systems such as
+ Linux and FreeBSD, and is easily available for many other operating systems
+ and hardware platforms. The GNU compiler adheres as closely to the ANSI C
+ standard as possible, so if a different compiler is included with your operating
+ system, it may (or may not) have trouble interpreting Squid's source code,
+ depending on it's level of ANSI compliance. In practice, most compilers
+ work fine.</P
+ ><P
+ >Some commercial compilers choose backward compatibility with older versions
+ over ANSI compliance. These compilers generally support an option that turns
+ on 'ANSI compliant mode'. If you have trouble compiling
+ Squid you may have to turn this mode on. (? is this still valid? I remember
+ things like this back in the Borland C days - though I seem to remember
+ this on a Unix system too... ?) In the worst possible scenario you may have to
+ compile GCC with your existing compiler and use GCC to compile Squid.</P
+ ><P
+ >If you do not have a compiler, you may be able to find a precompiled version
+ of GCC for your system on the Internet. Be very careful when installing
+ software from untrusted sources. This is discussed shortly in the
+ "precompiled binary" section.</P
+ ><P
+ >&#13;&#13;</P
+ ><P
+ >If you cannot find versions of GCC for your platform, you may have to factor
+ in the cost of the compiler when deciding on your operating
+ system and hardware.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN123">Basic System Setup</H2
+ ><P
+ >Before you even install the operating system, it's best to get an idea as to
+ how the system will look once Squid is up and running. This will allow
+ you to partition the disks on the machine so that their mount path will match
+ Squid's default configuration.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN126">Default Squid directory structure</H3
+ ><P
+ >Normally Squid's directory tree looks like this:</P
+ ><P
+ ><A
+ NAME="AEN130"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >/<br>
+ &nbsp;usr/<br>
+ 	local/<br>
+ 		squid/<br>
+ 			bin/<br>
+ 			cache/<br>
+ 			etc/<br>
+ 			src/<br>
+ 				squid-2.0/</P
+ ></BLOCKQUOTE
+ >
+ Working through each directory below <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid</I
+ ></SPAN
+ > in the order
+ presented above:</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >bin. </B
+ >The Squid binary and associated tools are stored in this directory. Some
+ tools are included with the Squid source to help you manage and tune your
+ cache server.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >cache. </B
+ >Squid has to store cached data on disk somewhere. The path
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/cache</I
+ ></SPAN
+ > is the default location. You can change the
+ location of this directory by editing the Squid config file.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >etc. </B
+ >Squid configuration files are stored in this directory. The most commonly
+ changed file in here is <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ >. We discuss the basic tags in that
+ file in the next chapter.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >src. </B
+ >Since you are likely to download the source code for Squid from the net,
+ it is useful to compile the code where you can find it easily. I generally
+ create a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >src</I
+ ></SPAN
+ > directory and extract the code in there. This way I can
+ revert to a previous version (without downloading it all over again). If
+ you wish, you can easily keep Squid in your <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/src</I
+ ></SPAN
+ > directory,
+ or delete it completely once you have installed the binaries.</P
+ ></DIV
+ ><P
+ >Back to the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache</I
+ ></SPAN
+ > directory: if you have more than one partition for
+ the cached data, you can make subdirectories for each of the filesystems
+ in the cache directory. Normally people name these directories
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache1</I
+ ></SPAN
+ >, <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache2</I
+ ></SPAN
+ >', <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache3</I
+ ></SPAN
+ > and so forth. Your cache
+ directories should be mounted somewhere like <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/cache/1/</I
+ ></SPAN
+ >
+ and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/cache/2/</I
+ ></SPAN
+ >.
+ If you have only one cache disk, you can simply name the directory
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/cache/</I
+ ></SPAN
+ >.</P
+ ><P
+ >In Squid-1.1 cache directories had to be identical in size. This is no
+ longer the case, so if you are upgrading to Squid 2.0 you may be able to
+ resize your cache partitions. To do this, however, you may have to
+ repartition disks and reformat.</P
+ ><P
+ >When you upgrade to the latest version of Squid, it's a good idea
+ to keep the old working compiled source tree somewhere. If you upgrade to the
+ latest Squid and encounter problems, simply kill Squid, change to the previous
+ source directory and reinstall the old binaries. This is a lot faster than
+ trying to remember which source tree you were running, downloading it,
+ compiling it, applying local patches and then reinstalling.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN159">User and Group IDs</H3
+ ><P
+ >Squid, like most daemon processes on Unix machines, normally runs as the user
+ nobody and with the group nogroup.</P
+ ><P
+ >For the maximum flexibility in allowing root and non-root users to manipulate
+ the Squid configuration, you should make both a new user and two new groups,
+ specifically for the Squid system, rather than using the nobody and nogroup
+ IDs. Throughout this book we assume that you have done so, and that a
+ group and a user have been created, (both called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ >) and a second
+ admin group, called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ >. The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > user's primary group
+ should be <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ >, and the user's home directory should be
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid</I
+ ></SPAN
+ > (the default squid software install destination).</P
+ ><P
+ >When you have multiple administrators of a cache machine,
+ it is useful to have a dedicated <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > group, with
+ sub-administrators added to this group. This way, you don't have
+ to change to the root user whenever you want to make changes to
+ the Squid config. It's possible, for users in the squidadm group
+ to gain root access, so you shouldn't place people without root access
+ in the squidadm group.</P
+ ><P
+ >When the config file has been changed, a signal has to be sent to the
+ Squid process to inform it that that config files are to be re-read. Sending
+ signals to running processes isn't possible when the signal sender isn't
+ the same userid as the receiver. Other config file maintainers need permission
+ to change their user-id (either by using the 'su' command, or by logging in
+ with another session) to either the root user or to the user Squid is
+ running as.</P
+ ><P
+ >In some environments cache software maintainers aren't trusted
+ with root access, and the user <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >nobody</I
+ ></SPAN
+ > isn't allowed to log in.
+ The best solution is to allow users that need to make changes to the config
+ file access to a reload script using <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sudo</I
+ ></SPAN
+ >.  <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Sudo</I
+ ></SPAN
+ > is available
+ for many systems, and source code is available.</P
+ ><P
+ >In Chapter 4 we go through the process of changing the user-id that Squid runs
+ as, so that files Squid creates are owned by the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > user-id, and
+ by the group <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ >. Binaries are owned by root, and config files are
+ changeable by the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > group.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN179">Getting Squid</H2
+ ><P
+ >Now that your machine is ready for your Squid install, you need to download
+ and install the Squid program. This can be done in two ways: you can
+ download a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >source</I
+ ></SPAN
+ > version and compile it, or you can download a
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >precompiled binary</I
+ ></SPAN
+ > version and install that, relying on someone else
+ to do the compilation for you.</P
+ ><P
+ >Binary versions of Squid are generally easier to install than source
+ code versions, specifically if your operating system vendor distributes a
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >package</I
+ ></SPAN
+ > which you can simply install.</P
+ ><P
+ >Installing Squid from source code is recommended. This method allows you to
+ turn on compile-time options that may not be included in distributed binary
+ versions (one of many examples: SNMP support is not included into the
+ source at compile time unless it is specifically included, and most binary
+ versions available do not include snmp support). If your operating
+ system has been optimized so that Squid can run better (let's say you have
+ increased the number of open filehandles per process) a precompiled binary
+ will not take advantage of this tuning, since your compiler header files are
+ probably different to the ones where the binaries where compiled.</P
+ ><P
+ >It's also a little worrying running binaries that other people
+ distribute (unless, of course, they are officially supplied by your
+ operating system vendor): what if they have placed a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >trojan</I
+ ></SPAN
+ > into
+ the binary version? To ensure the security of your system it is recommended
+ that you compile from the official source tree.</P
+ ><P
+ >Since we suggest installing from source code first, we cover that first: if
+ you have to download a Squid binary from somewhere, simply skip to the next
+ sub-section: <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Getting a binary version of Squid</I
+ ></SPAN
+ >.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN191">Getting the Squid source code</H3
+ ><P
+ >Squid source is mirrored by numerous sites. For a list of mirrors, have a
+ look at&#13;</P
+ ><P
+ >Deciding which of the available files to download can become an issue,
+ especially if you are not familiar with the Squid version naming convention.
+ Squid is (as of this writing) in version 2. As features are added, the minor
+ version number is incremented (Squid 2.0 becomes Squid 2.1, then Squid 2.2
+ etc etc). Since new features may introduce new bugs, the first version including
+ new features is distributed as a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >pre-release</I
+ ></SPAN
+ > (or beta) version. The
+ first pre-release of Squid 1.2 is called <B
+ CLASS="COMMAND"
+ >squid-2.1.PRE1-src.tar.gz</B
+ >. The
+ second is <B
+ CLASS="COMMAND"
+ >squid-2.1.PRE2-src.tar.gz</B
+ >. Once Squid is considered
+ stable, a general release version is distributed: the first release version
+ is called <B
+ CLASS="COMMAND"
+ >squid-2.0.RELEASE-src.tar.gz</B
+ >, the second (which would
+ include minor bugfixes) <B
+ CLASS="COMMAND"
+ >squid-2.0.RELEASE2-src.tar.gz</B
+ >.</P
+ ><P
+ >In short, files are named as follows:
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid-2.minor-version-number.stability-info.release-number.tar.gz</I
+ ></SPAN
+ >.
+ Unless you are a Squid developer, you should download the last available
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >RELEASE</I
+ ></SPAN
+ > version: you are less likely to encounter bugs this way.</P
+ ><P
+ >Squid source is normally available via FTP (the File Transfer Protocol), so
+ you should be able to download Squid source by using the <B
+ CLASS="COMMAND"
+ >ftp</B
+ >
+ program, available on almost every Unix system. If you are not familiar
+ with ftp, you can simply select the mirror closest to you with your
+ browser and save the Squid source to your disk by right-clicking on the
+ filename and selecting <B
+ CLASS="COMMAND"
+ >save as</B
+ > (do not simply click on the filename
+ - many browsers attempt to extract compressed files, printing the tar file 
+ to your browser window: this is definitely not what you want!). Once
+ the download is complete, transfer the file to the cache machine.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN208">Getting Binary Versions of Squid</H3
+ ><P
+ >Finding binary versions of Squid to install is easy: deciding which binary
+ to trust is more difficult. If you do not choose carefully, someone could
+ undermine your system security. If you cannot compile Squid, but know (and
+ trust) someone that can do it for you, get them to help. It's better than
+ downloading a version contributed by someone that you don't know.</P
+ ><P
+ >The worst places to download precompiled packages from are sites that
+ accept contributions from the public at large: avoid files in paths like
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >incoming</I
+ ></SPAN
+ > or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >uploads</I
+ ></SPAN
+ >, since the source of the file is unknown.</P
+ ><P
+ >Mailing lists are often good places to find compiled Software (though
+ people become irritated if you do not actually make a concerted effort to
+ find a trusted version before bothering the list). Regular contributors to
+ mailing lists have a reputation at stake, and are likely to provide binary
+ versions of software that actually match the official source.</P
+ ><P
+ >Binaries compiled by people the core Squid developers (www.ircache.net) know
+ and trust are available at
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ftp://squid.nlanr.net/pub/contrib/binaries/</I
+ ></SPAN
+ >. You may be able to find a
+ Squid binary for your operating system here.</P
+ ><P
+ >Files can be distributed in many different ways. Generally Squid is
+ tranformed into a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >package</I
+ ></SPAN
+ > that can be installed with some <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >package tool</I
+ ></SPAN
+ >. There are many competing package managers, so there is no way of
+ covering them all here.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN220">Compiling Squid</H2
+ ><P
+ >Compiling Squid is quite easy: you need the right tools to do the job,
+ though. First, let's go through getting the tools, then you can
+ extract the source code package, include optional Squid components (using
+ the <B
+ CLASS="COMMAND"
+ >configure</B
+ > command) and then actually compile the distributed code
+ into a binary format.</P
+ ><P
+ >A word of warning, though: this is the stage where most people run into
+ problems. If you haven't compiled source before, try and follow the
+ next section in order - it shouldn't be too bad. If you don't manage to get
+ Squid running, at least you have gained experience.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN225">Compilation Tools</H3
+ ><P
+ >All GNU utilities mentioned below are avaliable via FTP from the official
+ GNU ftp site or one of it's mirrors. A list of mirrors is available at
+ 
+ http://www.gnu.org/, or download them directly from
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ftp://ftp.gnu.org/</I
+ ></SPAN
+ >.</P
+ ><P
+ >The GNU compiler is only distributed as source (creating a
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >chicken-and-egg</I
+ ></SPAN
+ > problem if you do not have a compiler) you may have to
+ do an Internet search (using one of the standard search engines) to try and find a binary copy of the GNU compiler for your
+ system.
+ The Squid source is distributed in compressed form. First a standard tar
+ file is created. This file is then compressed with the GNU <B
+ CLASS="COMMAND"
+ >gzip</B
+ >
+ program. To decompress this file you need a copy of gzip.
+ GCC (The Gnu C Compiler) is the recommended compiler: the developers wrote
+ Squid with it, and it is available for almost all systems.</P
+ ><P
+ >You will also need the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >make</I
+ ></SPAN
+ > program, of which there is also a GNU
+ version easily available. </P
+ ><P
+ >If possible, install a C debugger: the GNU debugger (GDB) is
+ available for most platforms. Though a debugger is not necessary for
+ installation, but is very useful in the case of software bugs (as discussed
+ in chapter 13). </P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN237">Unpacking the Source Archive</H3
+ ><P
+ >Earlier we looked at the tree structure of the <B
+ CLASS="COMMAND"
+ >/usr/local/squid</B
+ >
+ directory. I suggest extracting the Squid source to the
+ <B
+ CLASS="COMMAND"
+ >/usr/local/squid/src</B
+ > directory. So, create the directory and copy
+ the downloaded Squid <B
+ CLASS="COMMAND"
+ >tar.gz</B
+ > file into it.</P
+ ><P
+ >First let's decompress the file. Some versions of tar can decompress the
+ file in one step, but for compatability's sake we are going to do it in two
+ steps. Decompress the tar file by running
+ <B
+ CLASS="COMMAND"
+ >gzip -dv squid-version.tar.gz</B
+ >. If all has gone well you should have
+ a file called <B
+ CLASS="COMMAND"
+ >squid-version.tar</B
+ > in the current directory. To get
+ the files out of the "tarball", run <B
+ CLASS="COMMAND"
+ >tar xvf squid-version.tar</B
+ >.</P
+ ><P
+ >Tar automatically puts the files into a subdirectory: something like
+ <B
+ CLASS="COMMAND"
+ >squid-2.1.PRE2</B
+ >. Change into the extracted directory, and we can start
+ configuring the Squid source. </P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN250">Compilation options</H3
+ ><P
+ >Squid features are enabled (or disabled) with the <B
+ CLASS="COMMAND"
+ >configure</B
+ > shell
+ script. Some Squid features have to be specifically enabled when Squid is
+ compiled, which can mean that you have to recompile at a later stage. There
+ are two reasons that a feature can be disabled by default:</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Operating system Compatibility. </B
+ >Although Squid is written in as generic a way possible, certain functions
+ (such as async-io, transparency and ARP-based access control lists) are not
+ available on all operating systems. When many operating systems cannot use
+ a feature, it is included as a compile time option.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Efficiency. </B
+ >On a very lightly loaded cache, async-io can actually slow down requests
+ minutely. Some system administrators may wish to disable certain features
+ to speed up their caches.</P
+ ></DIV
+ ><P
+ >You may be wondering why there simply aren't config file options for these
+ less used features. For most of the features there really isn't a reason other
+ than (?minimalisim?). Why have code sitting in the executable that
+ isn't actually used? You can include the features that you might use at some
+ time in the future without detrimental effects (other than a slightly larger
+ binary), so as to avoid having to recompile the Squid source later on.</P
+ ><P
+ >The configure program also has a second function: with some source code you
+ have to edit a header file which tell the compiler which function calls to
+ use on the system. This very often makes source compilation difficult. With
+ Squid, however, the GNU <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >configure</I
+ ></SPAN
+ > script checks what programs,
+ libraries and function calls are available on your system. This simplifies
+ setup dramatically.</P
+ ><P
+ >To make configure as generic as possible, it's actually a Bourne Shell
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/bin/sh</I
+ ></SPAN
+ > script. If you have replaced your <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/bin/sh</I
+ ></SPAN
+ > shell with a
+ less Posix-capable shell
+ (like ash) you may not be able to run configure. If this is the case you
+ will have to change the first line of the <B
+ CLASS="COMMAND"
+ >configure</B
+ > script to run
+ the full shell.</P
+ ><P
+ >all source inclusion options are set with the command './configure option'.
+ On most systems root doesn't have a '.' in their search path for security
+ reasons, so you have to fully specify the path to the binary (hence the
+ '<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/</I
+ ></SPAN
+ >').</P
+ ><P
+ >To turn more than one configuration option on at once you simply append
+ each option to the end of the command line.
+ You can, for example, change the prefix install directory and turn
+ Async-IO on with a command like the following (more on what each of these
+ options is for shortly).
+ <A
+ NAME="AEN270"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >&nbsp;./configure&nbsp;--prefix=/usr/people/staff/oskar/squid&nbsp;--enable-async-io</P
+ ></BLOCKQUOTE
+ >
+ Note that only the commonly used configuration options are included here.
+ To get a complete list of options you can run './configure --help'. Many of
+ the resulting options are standard to the GNU configure script that Squid
+ uses, and are used for some things like cross compilation.</P
+ ><P
+ >If you wish to find out about some of the more obscure options you may have to
+ ask someone on one of the relevant mailing lists, or even read the source code!</P
+ ><P
+ ></P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN274">Reducing output of configure</H4
+ ><P
+ ></P
+ ><P
+ >When you run configure you normally get a fairly verbose output as to what
+ is being checked for. Most people don't need all this information, so there
+ is an option to stop configure printing the messages that aren't important.
+ To reduce the amount of printed output, use the <B
+ CLASS="COMMAND"
+ >--quiet</B
+ > option.
+ This way you will only see error messages, not debug information.</P
+ ><P
+ >The first time you run configure you should run it in verbose mode. The
+ configure process can take a while on slower machines, so you should get an
+ idea as to how long it will take to run. Should you need to submit a bug
+ report, you should always include as much information as
+ possible, and should include the full configure output.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN281">Destination directory</H4
+ ><P
+ ></P
+ ><P
+ >Some system administrators would prefer to dispense with the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid</I
+ ></SPAN
+ > directory described earlier. On some systems you may
+ even be installing Squid on a machine where you do not have root access
+ (and can thus not create the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid</I
+ ></SPAN
+ > directory). In either
+ of these cases you will need to change your destination path.</P
+ ><P
+ >Throughout this book I assume that you have installed Squid in the default
+ directory. Using the default destination will make it easier for you to
+ follow the examples in this book. </P
+ ><P
+ >Changing the destination directory is done with the <B
+ CLASS="COMMAND"
+ >--prefix</B
+ >
+ configure option. Here are some examples where we use this option.</P
+ ><P
+ >Installing Squid in your home directory:
+ <A
+ NAME="AEN291"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >&nbsp;./configure&nbsp;--prefix=/usr/people/staff/oskar/squid</P
+ ></BLOCKQUOTE
+ >
+ If you are installing Squid on a dedicated cache machine you may wish to
+ place all Squid-related files in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local</I
+ ></SPAN
+ > directory. Config
+ files (for example) will thus live in <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/etc</I
+ ></SPAN
+ >.
+ <A
+ NAME="AEN295"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >&nbsp;./configure&nbsp;--prefix=/usr/local/</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN297">Using the DL-Malloc Library</H4
+ ><P
+ >The memory allocation routines included with many operating systems aren't
+ very good for the way that Squid allocates and uses memory.
+ Squid uses the memory subsystem more intensively than most programs,
+ since it's a single process which runs for an extended period of time and
+ continuously allocates and frees small sections of memory. On some systems
+ the Squid process size increases at a rapid rate. When it eventually
+ consumes all the memory on the system, it crashes.</P
+ ><P
+ >This option enables a different system memory allocator: DL-Malloc, by
+ Doug Lea, which is known to be efficient for Squid's allocation patterns.</P
+ ><P
+ >Squid <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >will</I
+ ></SPAN
+ > increase in size as objects are added to the disk cache,
+ as discussed in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Hardware Requirements</I
+ ></SPAN
+ > section. The index of
+ objects in the disk cache takes up RAM, so make sure that you have
+ sufficient memory in your system before deciding that the memory
+ allocation system is at fault.</P
+ ><P
+ >If a recently started copy of Squid uses substantially less memory than one
+ that has been running for a few days (with the same size cache store), you
+ might want to configure Squid to use DL-Malloc.</P
+ ><P
+ >The included DL-Malloc memory allocation routines are not thread-safe, so
+ you may not be able to use this option in conjunction with Async-IO.
+ (? need to check details ?)</P
+ ><P
+ >To use DL-Malloc, simply use the <B
+ CLASS="COMMAND"
+ >--enable-dl-malloc</B
+ > option:
+ <A
+ NAME="AEN308"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >&nbsp;./configure&nbsp;--enable-dl-malloc</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN310">Regular expression routines</H4
+ ><P
+ ></P
+ ><P
+ >Regular expressions allow you to do complex string matching, and are used
+ for various things in the Squid config files (most notably in the rules
+ that control how long objects stay in the cache).</P
+ ><P
+ >On some systems you may wish to replace the default regular-expression
+ routines with the GNU routines. This may be because the default operating
+ system ones are incompatible with Squid or do not function correctly. If
+ your system doesn't have regular expression libraries, Squid will
+ automatically use the GNU library, so the GNU regular expression routines are
+ included in the default Squid source code tree, and don't have to be
+ downloaded seperately.</P
+ ><P
+ >To enable use of the GNU libraries, simply use the
+ <B
+ CLASS="COMMAND"
+ >--enable-gnuregex</B
+ > configure option.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN318">Asynchronous IO</H4
+ ><P
+ ></P
+ ><P
+ >Squid 2.0 includes a major performance increase in the form of Async-IO.</P
+ ><P
+ >It's important to remember that Squid is <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >one</I
+ ></SPAN
+ > processes. In many
+ Internet daemons, more than one copy runs at a time, so if one process is
+ by a system call, it does not effect the other running copies.</P
+ ><P
+ >Squid is only one process. If the main loop stops running for some reason, all
+ connections are slowed. In all versions of Squid, the main loop uses the
+ select and poll system calls to decide which connections to service. As Squid
+ receives data from the server, it writes the data to disk and to the client.</P
+ ><P
+ >To write data to disk, a file has to be opened on the cache drive.
+ When lots of clients are opening and closing connections to a busy cache, the
+ main loop has to make lots of calls to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >open</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >close</I
+ ></SPAN
+ > network and
+ disk filehandles (note that the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >filehandle</I
+ ></SPAN
+ > can refer to both a
+ network connection and an on-disk file). These two functions block the flow of
+ all data through the cache. While waiting for <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >open</I
+ ></SPAN
+ > to return, Squid
+ cannot perform any other functions.</P
+ ><P
+ >When you enable Async-IO, Squid 2.0 uses threads to open and close
+ filedescriptors. A thread is part of the main Squid program in most ways,
+ except that if it makes use of a blocking system call (such as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >open</I
+ ></SPAN
+ >),
+ only the thread stops, not the main loop or other threads. Note that there
+ is not one thread per connection.</P
+ ><P
+ >Using threads to make calls to blocking function calls reduces the latency
+ that a cache adds to each request. (People sometimes worry about the latency
+ that caches add, but if you have a fast enough cache the latency is not an
+ issue - the client sees no noticeable overhead. Network overhead normally
+ outweighs Squid overhead). Async-IO drastically reduces cache overhead when
+ you have a loaded cache.</P
+ ><P
+ >Unfortunately Posix threads aren't available on all operating systems.
+ This ties your hardware choice into your choice of operating system, since
+ if your operating system does not support threads there may be no choice but
+ to use a faster system, or even to split the load between multiple machines.
+ (? need a table of machines that work ?)</P
+ ><P
+ >You should probably try and run Squid with Async-IO enabled if you have a
+ few thousand requests per hour. Some systems only support threads properly
+ with a fair amount of initial setup. If your load is low and Async-IO doesn't
+ work straight away you can leave Squid in the default configuration.</P
+ ><P
+ >Use the <B
+ CLASS="COMMAND"
+ >--enable-async-io</B
+ > configure option to include the async-io
+ code into Squid.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN338">User Agent logging</H4
+ ><P
+ >Most modern browsers include a header with each outgoing request that includes
+ some basic information about the user's browser and operating system. This
+ header is called a 'user-agent' header, since it describes the agent program
+ (the browser) used. An automated agent includes different user-agent
+ headers, so logging user-agent headers allow you to see if someone using an
+ automated web fetcher program (commonly referred to as a spider) to fetch
+ pages on their behalf. It can also be used to find statistics as to the most
+ commonly used browsers. The captured information is written to a log file
+ specified in the configuration file. To include the code responsible for
+ logging this information into the Squid binary, use the
+ <B
+ CLASS="COMMAND"
+ >--enable-useragent-log</B
+ > option to configure.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN343">Simple Network Monitoring Protocol (SNMP)</H4
+ ><P
+ ></P
+ ><P
+ >Enabling the Simple Network Monitoring Protocol (SNMP) allows you to query
+ your cache machine with one of the many SNMP tools available. If you
+ have an existing SNMP monitoring system, you should be able to use
+ your existing software to monitor Squid performance and retrieve usage
+ information. This is discussed in detail in Chapter 6.</P
+ ><P
+ >Some tools will read the Squid MIB (? what does this stand for ?) included
+ with Squid (as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/mib.txt</I
+ ></SPAN
+ >, once Squid is installed).
+ Some tools, on the other hand, will have to be patched to understand the MIB
+ that Squid uses. Since most SNMP products are written with a router in mind,
+ they may not talk to an application like Squid, since the Squid MIB is quite
+ different from a router MIB. (For more information on Squid and SNMP, see
+ chapter 11)</P
+ ><P
+ >Use the <B
+ CLASS="COMMAND"
+ >--enable-snmp</B
+ > configure option to enable the Squid SNMP
+ code.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN352">Killing the parent process on exit</H4
+ ><P
+ >Since Squid will be a very important part of your network when it is
+ installed, you will probably have a program which simply restarts Squid if
+ the running process exits. The RunCache program included with Squid does just
+ this.</P
+ ><P
+ >If you are doing maintenance on the cache system and actually wanted to kill
+ the Squid process, having it automatically restarted as you work can be
+ irritating, or even cause real problems.</P
+ ><P
+ >This option puts code into Squid that kills the parent process if Squid is
+ shutdown cleanly. If Squid crashes it leaves the parent process alone, and
+ will this be automatically restarted.</P
+ ><P
+ >Use the <B
+ CLASS="COMMAND"
+ >--enable-kill-parent-hack</B
+ > to enable killing of the parent
+ process on exit.</P
+ ><P
+ >If you don't use this option, the correct procedure is to kill the parent
+ with the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >kill</I
+ ></SPAN
+ > command, and to then use the shutdown command described in
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Running Squid</I
+ ></SPAN
+ > section to shutdown Squid. Do not use the 'kill'
+ command if you can avoid it: Squid needs time to shut down cleanly, since it
+ writes a complete list of objects to disk). </P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN363">Reducing time system-calls</H4
+ ><P
+ >When writing logs of cache events and client accesses, Squid calls the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >gettimeofday()</I
+ ></SPAN
+ > operating system call to determine the accurate time.</P
+ ><P
+ >This system call can take a short while to return, leaving Squid doing nothing
+ while while it could be reading and writing data for something that doesn't
+ require logging. The amount of time that Squid takes to make the system call
+ is negligible on most machines, but under very high load the huge number of
+ calls can impact overall performance. Enabling the 'time-hack' option
+ makes Squid update the clock only once per second, reducing the overhead
+ dramatically on such caches. This does means that your log messages are less
+ accurate. The log accuracy is important to some people, though. When you have
+ accurate time stamps of how long transfers take, you can create graphs of
+ response time, and use them to decide when you need to upgrade your
+ machine.  (More on this in chapter 11: <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Cache analysis</I
+ ></SPAN
+ >).</P
+ ><P
+ >Most people do not need to use the <B
+ CLASS="COMMAND"
+ >--enable-time-hack</B
+ > option. It's
+ useful mainly on very slow machines, or on operating systems where the
+ gettimeofday call is very slow.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN371">ARP-based Access Control Lists</H4
+ ><P
+ >All ethernet cards have a (supposedly) unique identifier which is used as an
+ address for all network traffic destined for that card. This number is
+ referred to as a MAC address. If the card didn't have this address the
+ operating system would have to check every packet on the network and decide if
+ the packet was destined for it's IP address. With ethernet, however, the
+ card's internal optimized hardware can check all the packets and decide if
+ the packet needs to be passed up to the operating system. The network protocol
+ that associates MAC addresses with IP numbers is known as ARP (Address
+ Resolution Protocol).  </P
+ ><P
+ >If you want to control cache access by MAC address, you can enable ARP
+ access control lists.</P
+ ><P
+ >This option is only available on certain operating systems, since there is
+ no standard method of finding the ARP address of a host when you are
+ connected at the TCP level. As of this writing, ARP acl lists only work on
+ Linux. If you are an operating system that can return this information to a
+ user-level process, use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >--enable-arp-acl</I
+ ></SPAN
+ > option to use MAC acls.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN378">Inter-cache Communication</H4
+ ><P
+ >Squid includes multiple Inter-Cache communication protocols. By default,
+ the original Inter-Cache protocol (ICP) is included in the source code. If
+ you wish to include some of the less used protocols, you will need to
+ include them at compile time. Inter-cache communication is covered in depth
+ in chapter 8. For the initial install you should probably not enable
+ these protocols, since they may not be used.</P
+ ><P
+ >If you are planning on joining an existing hierarchy you should ask the
+ hierarchy administrators as to what protocols are supported or needed. If you
+ are setting up a new hierarchy then you should only enable these after reading
+ the above referenced chapter.</P
+ ><P
+ >You cna enable the cache-digests with the <B
+ CLASS="COMMAND"
+ >--enable-cache-digests</B
+ >
+ option, and the Hyper Text Caching Protocol (HTCP) with
+ <B
+ CLASS="COMMAND"
+ >--enable-htcp</B
+ >.</P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN386">Keeping track of origin request hosts</H4
+ ><P
+ >(? I have never used this function. I think that it may be used mainly by
+ the NLANR caches. I need to find out exactly what this is used for. This is
+ my 'best guess' in the meantime. ?)</P
+ ><P
+ >When Squid caches forward requests on to a destination server (or, in
+ fact, to a parent cache) it adds headers to the request indicating both the
+ origin IP of the requester and the IP address of the cache that is doing
+ the forwarding (it's own IP). Squid can be configured to keep track of both of
+ these headers for access logs of incoming requests. If you have caches
+ beneath yours, this logs the headers the client caches add.</P
+ ><P
+ >This feature is only really useful if you are at the top of a hierarchy and
+ want to see who the biggest users of lower caches are. Currently,
+ you can only access the data stored in this way with the cachemgr.cgi
+ cgi program. (? not sure ?).</P
+ ><P
+ >You probably don't want to enable this option, but if you do, use the
+ <B
+ CLASS="COMMAND"
+ >--enable-forw-via-db</B
+ > option.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN393">Language selection</H4
+ ><P
+ >When Squid is unable to fulfill a request, an error page is returned to
+ the user with information on what went wrong. This page can be in the
+ language of your choice. Squid already includes error pages in quite a
+ number of languages: for list of included languages, check the contents of
+ the directory <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >errors/</I
+ ></SPAN
+ > in the extracted source directory.
+ <A
+ NAME="AEN397"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache:~/src/squid-2.0.RELEASE&#62;&nbsp;ls&nbsp;errors/<br>
+ Bulgarian&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Estonian&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Italian&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Russian-1251&nbsp;&nbsp;&nbsp;&nbsp;list<br>
+ Czech&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;French&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Makefile.in&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Russian-koi8-r<br>
+ Dutch&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;German&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Polish&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Spanish<br>
+ English&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Hungarian&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Portuguese&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Turkish</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >The file 'list' contains a list of files to edit, when creating your own
+ language error files.</P
+ ><P
+ >Unfortunately there are not versions of the config file in different
+ languages - only the error messages returned to users have been translated.
+ The language defaults to English if you do not specify a language.</P
+ ><P
+ >To use a specific language, replace <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >language-name</I
+ ></SPAN
+ > in the below text
+ with something like <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Bulgarian</I
+ ></SPAN
+ >.
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >enable-err-language=language-name</I
+ ></SPAN
+ ></P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN405">Running configure</H3
+ ><P
+ >Now that you have decided which options to use, it's time to run configure.
+ Here's an example:</P
+ ><P
+ ><A
+ NAME="AEN409"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >&nbsp;./configure&nbsp;--enable-err-language=Bulgarian&nbsp;--prefix=/usr/local</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >Running ./configure with the options that you have chosen should go
+ smoothly. In the unlikely event that configure returns with an error
+ message, here are some suggestions that may help.</P
+ ><P
+ ></P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN413">Broken compilers</H4
+ ><P
+ >The most common problem for new installers is that there is a problem with
+ the installed compiler (or the headers) for the system.</P
+ ><P
+ >To test this theory simply try and run configure with no options at all.
+ If you still get an error message it is almost certainly a compiler or header
+ file problem.</P
+ ><P
+ >To make sure try and compile a program that uses some of the less used
+ system calls and see if this compiles.</P
+ ><P
+ >If your compiler doesn't compile files correctly, you might want to check if 
+ he header files exist, and if they do, permissions on the directory and the
+ include files themselves.</P
+ ><P
+ >If you have installed GCC in a non-standard directory, or if you are cross
+ compiling, you may need configure to append options to the GCC command it
+ uses during it's tests. You can get configure to append options to the GCC
+ command line by setting the 'CFLAGS' shell variable prior to running configure.
+ If, for example, you compiler only works when you you modify the default
+ include directory, you can get configure to append that option to the default
+ command line with a (Bourne Shell) command like:</P
+ ><P
+ ><A
+ NAME="AEN421"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >CFLAGS=-I/usr/people/staff/oskar/gcc/include<br>
+ export&nbsp;CFLAGS</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN424">Incompatible Options</H4
+ ><P
+ >Some configuration options exclude the use of others. This is another
+ common cause of problems. To test this you should just try and run configure
+ without any options at all, and see if the problem disappears. If so, you can
+ try and work out which option is causing the conflict by adding each option
+ to the configure command line one-by-one. You may find that you have to
+ choose between two options (for example Async-IO and the DL-Malloc routines).
+ In this case you may have to decide which of the options is the most important
+ in your setup.</P
+ ><P
+ ></P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN428">Compiling the Squid Source</H3
+ ><P
+ >Now that you have configured Squid, you need to make the Squid binaries.
+ You should simply have to run <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >make</I
+ ></SPAN
+ > in the extracted source directory, and
+ a binary will be created as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >src/squid</I
+ ></SPAN
+ >.
+ <A
+ NAME="AEN433"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache:/&nbsp;#&nbsp;cd&nbsp;/usr/local/squid/src/squid-2.2.RELEASE<br>
+ cache:/usr/local/squid/src/squid-2.2.RELEASE&nbsp;#&nbsp;make</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >If the compilation fails, it may be because of conflicting configure options
+ as described in the configure section. Follow the same instructions
+ described there to find the offending option. (You should run <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >make clean</I
+ ></SPAN
+ > between configure runs, to ensure that old binaries are removed)
+ As a start, try running configure without any options at all and then see if
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >make</I
+ ></SPAN
+ > completes. If this works, try additional configure options one at
+ a time to see which one causes the problem.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN438">Installing the Squid binary</H3
+ ><P
+ >The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >make</I
+ ></SPAN
+ > command creates the binary, but doesn't install it.</P
+ ><P
+ >Running <B
+ CLASS="COMMAND"
+ >make install</B
+ > creates the <B
+ CLASS="COMMAND"
+ >/usr/local/squid/bin</B
+ > and
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc</I
+ ></SPAN
+ > subdirectories, and copies the binaries and
+ default config files in the appropriate directories. Permissions may not
+ be set correctly, but we will work through all created directories and set
+ them up correctly shortly.</P
+ ><P
+ >This command also copies the relevant config files into the default
+ directories. The standard config file included with the source is placed in
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >etc</I
+ ></SPAN
+ > subdirectory, as are the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mime.types</I
+ ></SPAN
+ > file and the default
+ Squid MIB file (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.mib</I
+ ></SPAN
+ >).</P
+ ><P
+ >If you are upgrading (or reinstalling), <B
+ CLASS="COMMAND"
+ >make install</B
+ > will overwrite
+ binary files in the bin directory, but will not overwrite your painfully
+ manipulated configuration files. If the destination configuration file exists,
+ <B
+ CLASS="COMMAND"
+ >make install</B
+ > will instead create a file called
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >filename.default</I
+ ></SPAN
+ >. This allows you to check if useful options have been
+ added by comparing config files.</P
+ ><P
+ >If all has gone well you should have a fully installed (but unconfigured)
+ Squid system setup.</P
+ ><P
+ ><SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Congratulations!</I
+ ></SPAN
+ ></P
+ ><P
+ ></P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN458">Chapter 3. Squid Configuration Basics</H1
+ ><P
+ ></P
+ ><P
+ >The first high-performance proxy-cache program was developed as part of the
+ Harvest project. The Harvest project was an NSF (?check this info for
+ accuracy?) funded project to create a web indexing system. Part of this
+ project included writing a high-performance cache daemon, or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cached</I
+ ></SPAN
+ >
+ (pronounced "Cache-Dee") to speed the re-indexing of pages. Once the
+ project was completed the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cached</I
+ ></SPAN
+ > source code was used as the basis
+ for many commercial cache servers, as the source was freely available.
+ Many of the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cached</I
+ ></SPAN
+ > developers moved on to or formed companies
+ that developed commercial cache software.</P
+ ><P
+ >I remember first installing <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cached</I
+ ></SPAN
+ >: I was boggled at the number
+ of options in the configuration file. I tried working through the options
+ from top to bottom, deciding which to change and which to leave. I had no
+ idea what they all meant. As I worked though the file, I figured more and
+ more options out, though others remained mysteries.</P
+ ><P
+ >After a lot of changes I tried to start <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cached</I
+ ></SPAN
+ >, and had no luck.
+ It spat out loads of errors, and I couldn't connect to the machine
+ with my web browser at all. I had no idea what the real problem was - and
+ I changed more and more options with time. This simply buried the real
+ problem beneath hundreds of other possible problems.</P
+ ><P
+ >Though Squid is now easier to install, the lessons I learned then are still
+ relevant. The default configuration file is probably right for 90% of
+ installations - once you have Squid running, you should change the
+ configuration file one option at a time. Don't get over-ambitious in your
+ changes quite yet! Leave things like refresh rules until you have experimented
+ with the basic options - what port you want your to accept requests on, what
+ user to run as, and where to keep cached pages on your drives.</P
+ ><P
+ >So that you can get Squid running, this chapter works through the basic Squid
+ options, giving you background information and introducing you to some of
+ the basic concepts. In later chapters you'll move on to more advanced
+ topics.</P
+ ><P
+ >The Squid config file is not arranged in the order as this book. The config
+ file also does not progress from basic to advanced config options in any
+ specific order, but instead consists of related sections, with all hierarchy
+ settings in a specific section of the file, all access controls in another
+ and so forth.</P
+ ><P
+ >To make changes detailed in this chapter you are going to have to skip
+ around in the config file a bit. It's probably easiest to simply search
+ for the options discussed in each subsection of this chapter, but if you
+ have some time it will be best if you read through the config file, so
+ that you have an idea of how sections fit together.</P
+ ><P
+ >The chapter also points out options that may have to be changed on the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >other 10%</I
+ ></SPAN
+ > of machines. If you have a firewall, for example, you will
+ almost certainly have to configure Squid differently to someone that
+ doesn't.</P
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN475">Version Control Systems</H2
+ ><P
+ >I recommend that you put all Squid configuration files and startup scripts
+ under revision control. If you are like me, you love to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >play</I
+ ></SPAN
+ > with
+ new software. You change an option, get the program to re-read the
+ configuration file, and see what difference it makes. By repeating this
+ process, I learn what each option does, and at the same time I gain
+ experience, and discover why the program is written the way it is.
+ Quite often configuration files make no sense until you discover the
+ overall structure of the underlying program.</P
+ ><P
+ >The best way for you to understand each of the options in the Squid
+ config file (and to understand Squid itself) is to experiment with
+ the multitude of options. At some stage in the experimentation stage,
+ you will find that you break something. It's useful to be able to revert
+ to a previous version (or simply to be reminded what changes you have
+ made).</P
+ ><P
+ >Many readers will already have used a Revision Control System. The RCS
+ system is included with many Unix systems, and source is freely
+ available. For the few that haven't used RCS, however, it's worth
+ including some pointers to some manual pages:
+ <A
+ NAME="AEN481"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >ci(1)<br>
+ co(1)<br>
+ rcs(1)<br>
+ rcsdiff(1)<br>
+ rlog(1)</P
+ ></BLOCKQUOTE
+ >
+ One of the wonders of Unix is the ability to create scripts which reduce
+ the number of commands that you have to type to get something done. I have
+ a short script on all the machines I maintain called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >rvi</I
+ ></SPAN
+ >. Using
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >rvi</I
+ ></SPAN
+ > instead of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >vi</I
+ ></SPAN
+ > allows me to use one command to edit files
+ under RCS (as opposed to the customary four). Put this file somewhere in
+ your path and make it executable <B
+ CLASS="COMMAND"
+ >chmod +x rvi</B
+ >. You can then simply
+ use a command like <B
+ CLASS="COMMAND"
+ >rvi squid.conf</B
+ > to edit files that are under
+ revision control. This is a lot quicker than running each of the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >co</I
+ ></SPAN
+ >,
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >rcsdiff</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ci</I
+ ></SPAN
+ > commands.
+ 
+ 
+ <A
+ NAME="AEN493"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >#!/bin/sh<br>
+ co&nbsp;-l&nbsp;$1<br>
+ $VISUAL&nbsp;$1<br>
+ rcsdiff&nbsp;-u&nbsp;$1<br>
+ ci&nbsp;-u&nbsp;$1</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN495">The Configuration File</H2
+ ><P
+ >All Squid configuration files are kept in the directory
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc</I
+ ></SPAN
+ >. Though there is more than one file in this
+ directory, only one file is important to most administrators, the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > file. Though there are (as of this writing) one hundred and
+ twenty five option tags in this file, you should only need to change eight
+ options to get Squid up and running. The other one hundred and seventeen
+ options give you amazing flexibility, but you can learn about them once
+ you have Squid running, by <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >playing</I
+ ></SPAN
+ > with the options or by reading
+ the descriptions in chapter 10.</P
+ ><P
+ >Squid assumes that you wish to use the default value if there is no
+ occurrence of a tag in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > file. Theoretically, you could
+ even run Squid with a zero length configuration file.</P
+ ><P
+ >The remainder of this chapter works through the options that you may need
+ to change to get Squid to run. Most people will not need to change all of
+ these settings. You will need to change at least one part of the
+ configuration file though: the default <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > denies access to
+ all browsers. If you don't change this, Squid will not be very useful!</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN505">Setting Squid's HTTP Port</H2
+ ><P
+ >The first option in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > file sets the HTTP port(s) that
+ Squid will listen to for incoming requests.</P
+ ><P
+ >Network services listen on particular ports. Ports below 1024 can
+ only be used by the system administrator, and are used by programs
+ that provide basic Internet services: SMTP, POP, DNS and HTTP (web).
+ Ports above 1024 are used for untrusted services (where a service does
+ not run as administrator), and for transient connections, such as
+ outgoing data requests.</P
+ ><P
+ >Typically, web servers listen for incoming web requests (using the
+ HyperText Transfer Protocol - HTTP) on port 80.</P
+ ><P
+ >Squid's default HTTP port is <B
+ CLASS="COMMAND"
+ >3129</B
+ >. Many people run their cache
+ servers on a port which is easier to remember: something like
+ <B
+ CLASS="COMMAND"
+ >80</B
+ > or <B
+ CLASS="COMMAND"
+ >8080</B
+ >). If you choose a low-numbered port, you
+ will have to start Squid as root (otherwise you are considered
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >untrusted</I
+ ></SPAN
+ >, and you will not be able to start Squid. Many ISPs
+ use port 8080, making it an accepted <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >pseudo-standard</I
+ ></SPAN
+ >.</P
+ ><P
+ >If you wish, you can use multiple ports appending a second port number
+ to the <B
+ CLASS="COMMAND"
+ >http_port</B
+ > variable. Here is an example:
+ <A
+ NAME="AEN519"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >http_port&nbsp;3128&nbsp;8080</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >It is very important to refer to your cache server with a generic DNS
+ name. Simply because you only have one server now does not mean that
+ you should not plan for the future. It is a good idea to setup a DNS
+ hostname for your proxy server. Do this right away! A simple DNS entry
+ can save many hours further down the line. Configuring client machines
+ to access the cache server by IP address is asking for a long, painful
+ transition down the road. Generally people add a hostname like
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache.mydomain.com</I
+ ></SPAN
+ > to the DNS. Other people prefer the name
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proxy</I
+ ></SPAN
+ >, and create a name like <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proxy.mydomain.com</I
+ ></SPAN
+ >.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN525">Using Port 80</H3
+ ><P
+ >HTTP defines the format of both the request for information and the
+ format of the server response. The basic aspects of the protocol are quite
+ straight forward: a client (such as your browser) connects to port
+ 80 and asks for the file by supplying the full path and filename that
+ it wishes to download. The client also specifies the version of the
+ HTTP protocol it wishes to use for the retrieval.</P
+ ><P
+ >With a proxy request the format is only a little different. The client
+ specifies the whole URL instead of just the path to the file.
+ The proxy server then connects to the web server specified in the URL, and
+ sends a normal HTTP request for the page. (? The format of HTTP requests is
+ described in more detail in chapter 4, where you type in an HTTP request,
+ just as a browser would send it to test that the cache is responding to
+ requests - may use the 'client' program instead.?)</P
+ ><P
+ >Since the format of proxy requests is so similar to a normal HTTP
+ request, it is not especially surprising that many web servers can
+ function as proxy servers too. Changing a web server program to function
+ as a proxy normally involves comparatively small changes to the code,
+ especially if the code is
+ written in a modular manner - as is the Apache web server. In many
+ cases the resulting server is not as fast, or as configurable, as a
+ dedicated cache server can be.</P
+ ><P
+ >The CERN web server <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >httpd</I
+ ></SPAN
+ > was the first widely available web
+ proxy server. The whole WWW system was initially created to give people
+ easy access to CERN data, and CERN HTTPD was thus the de-facto test-bed
+ for new additions to the initial informal HTTP specification. Most
+ (and certainly at one stage <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >all</I
+ ></SPAN
+ >) of the early web sites ran
+ the CERN server. Many system administrators who wanted a proxy server
+ simply used their standard CERN web server (listening on port 80) as
+ their proxy server, since it could function as one. It is easy for
+ the web server to distinguish a web site request from a normal web page
+ request, since it simply has to check if the full URL is given
+ instead of simply a path name. Given the choice (even today) many
+ system administrators would choose port 80 as their proxy server
+ port simply as 'port 80 is the standard port for web requests'.</P
+ ><P
+ >There are, however, good reasons for you to choose a port <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >other than</I
+ ></SPAN
+ >
+ 80.</P
+ ><P
+ >Running both services on the same port meant that if the system administrator
+ wanted to install a different web server package (for extra features available
+ in the new software) they would be limited to software that could perform both
+ as a web server and as a proxy. Similarly, if the same sysadmin found that
+ their web server's low-end proxy module could not handle the load of their
+ ever-expanding local client base, they would be restricted to a proxy server
+ that could function as a web server. The only other alternative is to
+ re-configure all the clients, which normally involves spending a few
+ days apologizing to users and helping them through the steps involved in
+ changing over.</P
+ ><P
+ >Microsoft use the Microsoft web server (IIS) as a basis for their proxy server
+ component, and Microsoft proxy thus only (? tried once - let's see if
+ it's changed since ?) accepts incoming proxy request on port 80. If you are
+ installing a Squid system to replace either CERN, Apache or IIS running in
+ both web-server and cache-server modes on the same port, you will have to
+ set <B
+ CLASS="COMMAND"
+ >http_port</B
+ > to 80. Squid is written only as a high-performance
+ proxy server, so there is no way for it to function as a web server, since
+ Squid has no support for reading files from a local disk, running CGI
+ scripts and so forth. There is, however, a workaround.</P
+ ><P
+ >If you have both services running on the same port, and you cannot
+ change your client PC's, do not despair. Squid can accept requests in
+ web-server format and forward them to another server. If you have only one
+ machine, and you can get your web server software to accept incoming requests on
+ a non-default port (for example 81), Squid can be configured to forward
+ incoming web requests to that port. This is called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >accelerator mode</I
+ ></SPAN
+ >
+ (since it's initial purpose was to speed up very slow web servers). Squid
+ effectively does some translation on the original request, and then simply
+ acts as if the request were a proxy request and connects to the host: the
+ fact that it's not a remote host is irrelevant. Accelerator mode
+ is discussed in more detail in chapter 9. Until then, get Squid installed and
+ running on another port, and work your way through the first couple of
+ chapters of this book, until you have a working pilot-phase system.
+ Once Squid is stable and tested you can move on to changing web server
+ settings. If you feel adventurous, however, you can skip there shortly!</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN540">Where to Store Cached Data</H4
+ ><P
+ >Cached Data has to be kept somewhere. In the section on hardware
+ sizing, we discussed the size and number of drives to use for caching.
+ Squid cannot autodetect where to store this data, though, so you need
+ to let Squid know which directories it can use for data storage.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >cache_dir</B
+ > operator in the
+ <B
+ CLASS="COMMAND"
+ >squid.conf</B
+ > file is used to configure
+ specific storage areas. If you use more than one disk for
+ cached data, you may need more than one mount point (for example
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/cache1</I
+ ></SPAN
+ > for the first disk,
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/cache2</I
+ ></SPAN
+ > for the second). Squid
+ allows you to have more than one <B
+ CLASS="COMMAND"
+ >cache_dir</B
+ >
+ option in your config file.</P
+ ><P
+ >Let's consider only one <B
+ CLASS="COMMAND"
+ >cache_dir</B
+ > entry in the
+ meantime. Here I am using the default values from the standard
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ >.  <A
+ NAME="AEN552"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache_dir&nbsp;/usr/local/squid/cache/&nbsp;100&nbsp;16&nbsp;256&nbsp;</P
+ ></BLOCKQUOTE
+ > The first option to the <B
+ CLASS="COMMAND"
+ >cache_dir</B
+ >
+ tag sets the directory where data will be stored. The prefix value
+ simply has <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/cache/</I
+ ></SPAN
+ > tagged onto the end and
+ it's used as the default directory. This directory is also made by
+ the <B
+ CLASS="COMMAND"
+ >make install</B
+ > command that we used earlier.&#13;</P
+ ><P
+ >The next option to <B
+ CLASS="COMMAND"
+ >cache_dir</B
+ > is straight forward: it's a size value.
+ Squid will store up to that amount of data in that directory. The
+ value is in megabytes, so 
+ 
+ 
+ of the cache store. The default is 100 megabytes.</P
+ ><P
+ >The other two options are more complex: they set the number of
+ subdirectories (first and second tier) to create in this directory.
+ Squid makes lots of directories and stores a few files in each of them
+ in an attempt to speed up disk access (finding the correct entry in a
+ directory with one million files in it is not efficient: it's better
+ to split the files up into lots of smaller sets of files... don't
+ worry too much about this for the moment). I suggest that you use the
+ default values for these options in the mean time: if you have a very
+ large cache store you may want to increase these values, but this is
+ covered in the section on&#13;</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN564">Email for the Cache Administrator</H2
+ ><P
+ >If Squid dies email is sent to the address specified with the
+ <B
+ CLASS="COMMAND"
+ >cache_mgr</B
+ > tag. This address is also appended to the end of
+ error pages returned to users if, for example, the remote machine is
+ unreachable.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN568">Effective User and Group ID</H2
+ ><P
+ >Squid can only bind to low numbered ports (such as port 80) if it is
+ started as root. Squid is normally started by your system's rc scripts when
+ the machine boots. Since these scripts run as root, Squid is started as
+ root at bootup time.</P
+ ><P
+ >Once Squid has been started, however, there is no need to run it as root.
+ Good security practice is to run programs as root only when it's absolutely
+ necessary, and for this reason Squid changes user and group ID's once it has
+ bound to the incoming network port.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >cache_effective_user</B
+ > and <B
+ CLASS="COMMAND"
+ >cache_effective_group</B
+ > tags tell
+ Squid what ID's to change to. The Unix security system would be useless if it
+ allowed all users to change their ID's at will, so Squid only attempts to
+ change ID's if the main program is started as root.</P
+ ><P
+ >If you do not have root access to the machine, and are thus not starting
+ Squid as root, you can simply leave this option commented out. Squid will
+ then run with whatever user ID starts the actual Squid binary.</P
+ ><P
+ >As discussed in chapter 2, this book assumes that you have created both a
+ squid user and a squid group on your cache machine. The above tags should
+ thus both be set to "squid".</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN577"><P
+ ><B
+ >Example 3-1. Effective User and Group IDs</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_effective_user squid
+ cache_effective_group squid</PRE
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN580">FTP login information</H3
+ ><P
+ >Squid can act as a proxy server for various Internet protocols. The
+ most commonly used protocol is HTTP, but the File Transfer Protocol
+ (FTP) is still alive and well.</P
+ ><P
+ >FTP was written for authenticated file transfer (it requires a
+ username and password). To provide public access, a special account is
+ created: the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >anonymous</I
+ ></SPAN
+ > user. When you log into an FTP server you
+ use this as your username. As a password you generally use your email
+ address. Most browsers these days automatically enter a useless email
+ address.</P
+ ><P
+ >It's polite to give an address that works, though. If one of your
+ users abuses a site, it allows the site admin get hold of you easily.</P
+ ><P
+ >Squid allows you to set the email address that is used with the
+ <B
+ CLASS="COMMAND"
+ >ftp_user</B
+ > tag. You should probably create a
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid@yourdomain.example</I
+ ></SPAN
+ > email address specifically for people
+ to contact you on.</P
+ ><P
+ >There is another reason to enter a proper address here: some servers
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >require</I
+ ></SPAN
+ > a real email address. For your proxy to log into these
+ ftp servers you will have to enter a real email address here.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN591">Access Control Lists and Access Control Operators</H2
+ ><P
+ >Squid could not be used in an ISP environment without a sophisticated access
+ control system. Indeed, Squid should not be used in ANY environment without
+ some kind of basic authentication system. It is amazing how fast other
+ Internet users will find out that they can relay requests through your
+ cache, and then proceed to do so.</P
+ ><P
+ >Why? Sometimes to obfusticate their real identity, and other times since they
+ have a fast line to you, but a slow line to the remainder of the Internet.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN595">Simple Access Control</H3
+ ><P
+ >In many cases only the most basic level of access control is needed. If you
+ have a small network, and do not wish to use things like user/password
+ authentication or blocking by destination domain, you may find that this
+ small section is sufficient for all your access control setup. If not, you
+ should read chapter 6, where access control is discussed in detail.</P
+ ><P
+ >The simplest way of restricting access is to only allow IPs that are on
+ your network. If you wish to implement different access control, it's
+ suggested that you put this in place later, after Squid is running. In the
+ meantime, set it up, but only allow access from your PC's IP address.</P
+ ><P
+ >Example access control entries are included in the default <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ >.
+ The included entries should help you avoid some of the more obscure
+ problems, such as bandwidth-chewing loops, cache tunneling with SSL CONNECTs
+ and other strange access problems. In chapter 6 we work through the config
+ file's default config options, since some of them are pretty complex.</P
+ ><P
+ >Access control is done on a per-protocol basis: when Squid accepts an
+ HTTP request, the list of HTTP controls is checked. Similarly, when an
+ ICP request is accepted, the ICP list is checked before a reply is
+ sent.</P
+ ><P
+ >Assume that you have a list of IP addresses that are to have access to
+ your cache. If you want them to be able to access your cache with both
+ HTTP and ICP, you would have to enter the list of IP addresses twice:
+ you would have lines something like this:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN603"><P
+ ><B
+ >Example 3-2. Theoretical Access List</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >http_access deny 10.0.1.0/255.255.255.0
+ http_access allow 10.0.0.0/255.0.0.0
+ icp_access allow 10.0.0.0/255.0.0.0</PRE
+ ></DIV
+ ><P
+ >Rule sets like the above are great for small organisations: they are
+ straight forward.</P
+ ><P
+ >For large organizations, though, things are more convenient if you can
+ create classes of users. You can then allow or deny classes of users
+ in more complex relationships. Let's look at an example like this,
+ where we duplicate the above example with classes of users:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN608"><P
+ ><B
+ >Example 3-3. Access Lists using Classes</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ ># classes
+ acl mynetwork src 10.0.0.0/255.0.0.0
+ acl servernet src 10.0.1.0/255.255.255.0
+ # what HTTP access to allow classes
+ http_access deny servernet
+ http_access allow mynet
+ # what ICP access to allow classes
+ icp_access deny servernet
+ icp_access allow mynet</PRE
+ ></DIV
+ ><P
+ >Sure, it's more complex for this example. The benefits only become
+ apparent if you have large access lists, or when you want to integrate
+ refresh-times (which control how long objects are kept) and the
+ sources of incoming requests. I am getting quite far ahead of myself,
+ though, so let's skip back.</P
+ ><P
+ >We need some terminology to discuss access control lists, otherwise this
+ could become a rather long chapter. So: lines beginning with <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >acl</I
+ ></SPAN
+ >
+ are (appropriately, I believe) acl lines. The lines that use these
+ acls (such as <B
+ CLASS="COMMAND"
+ >http_access</B
+ > and <B
+ CLASS="COMMAND"
+ >icp_access</B
+ > in the above
+ example) are called acl-operators. An acl-operator can either allow or
+ deny a request.</P
+ ><P
+ >So, to recap: acls are used to define classes. When Squid accepts a
+ request it checks the list of acl-operators specific to the type of
+ request: an HTTP request causes the <B
+ CLASS="COMMAND"
+ >http_access</B
+ > lines to be checked;
+ an ICP request checks the <B
+ CLASS="COMMAND"
+ >icp_access</B
+ > lists.</P
+ ><P
+ >Acl-operators are checked in the order that they occur in the file (ie
+ from top to bottom). The frst acl-operator line that matches causes
+ Squid to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >drop out</I
+ ></SPAN
+ > of the acl list. Squid will not check through
+ all acl-operators if the first denies the request.</P
+ ><P
+ >In the previous example, we used a <B
+ CLASS="COMMAND"
+ >src</B
+ > acl: this checks that
+ the source of the request is within the given IP range. The src acl-type
+ accepts IP address lists in many formats, though we used the
+ subnet/netmask in the earlier example. CIDR (Classless Internet Domain
+ 
+ Routing) notation can also be used here. Here is an example of the
+ same address range in either notation:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN624"><P
+ ><B
+ >Example 3-4. CIDR vs Netmask Source-IP Notation</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl mynet1 src 10.1.0.0/255.0.0.0
+ acl mynet2 src 10.2.0.0/16</PRE
+ ></DIV
+ ><P
+ >Access control lists inherit permissions when there is no matching
+ acl If all acl-operators in the file are checked, and no match is
+ found, the last acl-operator checked determines whether the request
+ is allowed or denied.  This can be confusing, so it's normally a
+ good idea to place a final "catch-all" acl-operator at the end of
+ the list. The simplest way to create such an operator is to create
+ an acl that matches any IP address. This is done with a src acl
+ with a netmask of all 0's. When the netmask arithmetic is done,
+ Squid will find that any IP matches this acl.</P
+ ><P
+ >Your cache server may well be on the network placed in the relevant
+ allow lists on your cache, and if you were thus to run the client on
+ the cache machine (as opposed to another machine somewhere on your
+ network) the above acl and <B
+ CLASS="COMMAND"
+ >http_access</B
+ > rules would allow
+ you to test the cache. In many cases, however, a program running on
+ the cache server will end up connecting to (and from) the address
+ '127.0.0.1' (also known as localhost).  Your cache should thus allow
+ requests to come from the address 127.0.0.1/255.255.255.255. In the
+ below example we don't allow icp requests from the localhost address,
+ since there is no reason to run two caches on the same machine.</P
+ ><P
+ >The squid.conf file that comes with Squid includes acls that
+ deny all HTTP requests. To use your cache, you need to
+ explicitly allow incoming requests from the appropriate range. The
+ squid.conf file includes text that reads:</P
+ ><A
+ NAME="AEN631"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >#<br>
+ #&nbsp;INSERT&nbsp;YOUR&nbsp;OWN&nbsp;RULE(S)&nbsp;HERE&nbsp;TO&nbsp;ALLOW&nbsp;ACCESS&nbsp;FROM&nbsp;YOUR&nbsp;CLIENTS<br>
+ #</P
+ ></BLOCKQUOTE
+ ><P
+ >To allow your client machines access, you need to add rules similar to
+ the below in this space. The default access-control rules stop people
+ exploiting your cache, it's best to leave them in.
+ 
+ 
+ &#13;</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN638"><P
+ ><B
+ >Example 3-5. Example Complete ACL list</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >#
+ # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
+ #
+ # acls for my network addresses
+ acl my-iplist-1 src 192.168.1.0/24
+ acl my-iplist-2 src 10.0.0.0/255.255.0.0
+ # Check that requests are from users on our network
+ http_access allow my-iplist-1
+ http_access allow my-iplist-2
+ icp_access allow my-iplist-1
+ icp_access allow my-iplist-2
+ # allow requests from the local machine (for testing and the like)
+ http_access allow localhost
+ # End of locally-inserted rules
+ http_access deny all</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN641">Ensuring Direct Access to Internal Machines</H3
+ ><P
+ >Acl-operator lines are not only used for authentication. In an earlier section
+ we discussed communication with other cache servers. Acl lines are used
+ to ensure that requests for specific URLs are handled by your cache,
+ not passed on to another (further away) cache.</P
+ ><P
+ >If you don't have a parent cache (a firewall, or you have a parent ISP
+ cache) you can probably skip this section.</P
+ ><P
+ >Let's assume that you connect to your ISP's cache server as a parent.
+ A client machine (on your local network) connects to your cache and
+ requests <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http://www.yourdomain.example/</I
+ ></SPAN
+ >. Your cache server will
+ look in the local cache store. If the page is not there, Squid wil
+ will connect to it's configured parent (your ISP's cache: across your
+ serial link), and request the page from there. The problem, though, is
+ that there is no need to connect across your internet line: the web
+ server is sitting a few feet from your cache in the machine room.</P
+ ><P
+ >Squid cannot know that it's being very inefficient unless you give
+ it a list of sites that are "near by". This is not the only way around
+ this problem though: your browser could be configure to ignore the
+ cache for certain IPs and domains, and the request will never reach
+ the cache in the first place. Browser config is covered in Chapter 5,
+ but in the meantime here is some info on how to configure Squid to
+ communicate directly with internal machines.</P
+ ><P
+ >The acl-operators <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > and <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > determine
+ whether to pass the connection to a parent or to proceed directly.</P
+ ><P
+ >The following is a set of operators are based on the final configuration
+ created in the previous section, but using <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > and
+ <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > operators. It is assumed that all servers that you wish
+ to connect to directly are in the address ranges specified in with the
+ my-iplist directives. In some cases you may run a web server on the same
+ machine as the cache server, and the localhost acl is thus also
+ considered local.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > and <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > tags are covered in
+ more detail in Chapter 7, where we cover hierarchies in detail.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN657"><P
+ ><B
+ >Example 3-6. Using always and never_direct</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ ># acls for my network addresses
+ acl my-iplist-1 src 192.168.1.0/24
+ acl my-iplist-2 src 10.0.0.0/255.255.0.0
+ # Various programs running on the cache box connect to Squid, so it's
+ # useful to allow connections from the localhost address.
+ acl localhost src 127.0.0.1/255.255.255.255
+ # used to deny all requests: Since the netmask is all 0's, any request
+ # matches this acl
+ acl all src 0.0.0.0/0.0.0.0
+ # Check that requests are from users on our network
+ http_access allow my-iplist-1
+ http_access allow my-iplist-2
+ icp_access allow my-iplist-1
+ icp_access allow my-iplist-2
+ # check the localhost acl as a special case
+ http_access allow localhost
+ # If the requests comes from any other IP, deny all access.
+ http_access deny all
+ # always go direct to local machines
+ always_direct allow my-iplist-1
+ always_direct allow my-iplist-2
+ # never go direct to other hosts
+ never_direct allow all</PRE
+ ></DIV
+ ><P
+ >&#13;&#13;</P
+ ><P
+ >Squid always attempts to cache pages. If you have a large Intranet system,
+ it's a waste of cache store disk space to cache your Intranet. Controlling
+ which URLs and IP ranges not to cache are covered in detail in chapter 6,
+ using the <B
+ CLASS="COMMAND"
+ >no_cache</B
+ > acl operator.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN666">Communicating with other proxy servers</H2
+ ><P
+ >Squid supports the concept of a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >hierarchy</I
+ ></SPAN
+ > of proxies. If your proxy does
+ not have an object on disk, it's default action is to connect to the
+ origin web server and retrieve the page. In a hierarchy, your proxy can
+ communicate with other proxies (in the hope that one of these servers will
+ have the relevant page). You will, obviously, only peer with servers that are
+ 'close' to you, otherwise you would end up slowing down access.
+ If access to the origin server is faster than access to neighboring cache
+ servers it is not a good idea to get the page from the slower link!</P
+ ><P
+ >Having the ability to treat other caches as siblings is very useful in some
+ interactions. For example: if you often do business with another company,
+ and have a permanent link to their premises, you can configure your cache
+ to communicate with their cache. This will reduce overall latency:
+ it's almost certainly faster to get the page from them than from the
+ other side of the country.</P
+ ><P
+ >When querying more than one cache, Squid does not query each in turn, and
+ wait for a reply from the first before querying the second (since this would
+ create a linear slowdown as you add more siblings, and if the first server
+ stops responding, you would slow down all incoming requests). Squid thus
+ sends all ICP queries together - without waiting for replies. Squid then
+ puts the client's request on hold until the first positive reply from a
+ sibling cache is received, and will retrieve the object from the
+ fastest-replying cache server. Since the earliest returning reply packet is
+ usually on the fastest link (and from the least loaded sibling server), your
+ server gets the page fast.</P
+ ><P
+ >Squid will always get the page from the fastest-responding cache - be it a
+ parent or a sibling.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > option allows you to specify proxy servers that
+ your server is to communicate with. The first line of the following
+ example configures Squid to query the cache machine
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache.myparent.example</I
+ ></SPAN
+ > as a parent. Squid will communicate with
+ the parent on HTTP port 3128, and will use ICP to query the server using
+ port 3130. Configuring Squid to query more than one server is easy:
+ simply add another <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line. The second line configures
+ cache.sibling.example as a sibling, listening for HTTP request on port
+ 8080 and ICP queries on port 3130.
+ <A
+ NAME="AEN677"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache_peer&nbsp;cache.myparent.example&nbsp;parent&nbsp;3128&nbsp;3130<br>
+ cache_peer&nbsp;cache.sibling.example&nbsp;sibling&nbsp;8080&nbsp;3130</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >If you do not wish to query any other caches, simply leave all
+ <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > lines commented out: the default is to talk directly to
+ origin servers.</P
+ ><P
+ >Cache peering and hierarchy interactions are discussed in quite some detail in
+ this book. In some cases hierarchy setups are the most difficult part of
+ your cache setup process (especially in a distributed environment like a
+ nationwide ISP). In depth discussion of hierarchies is beyond the scope of
+ this chapter, so much more information is given in chapter 8. There are
+ cases, where you need at least one hierarchy line to get Squid to
+ work at all. This section covers the basics, just for those setups.</P
+ ><P
+ >You only need to read this material if one of the following scenarios
+ applies to you:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >You have to use your Internet Service Provider's cache.</P
+ ></LI
+ ><LI
+ ><P
+ >You have a firewall.</P
+ ></LI
+ ></UL
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN688">Your ISP's cache</H3
+ ><P
+ >If you <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >have</I
+ ></SPAN
+ > to use your Internet Service Provider's cache, you will
+ have to configure Squid to query that machine as a parent. Configuring
+ their cache as a sibling would probably return error pages for every
+ URL that they do not already have in their cache.</P
+ ><P
+ >Squid will attempt to contact parent caches with ICP for each request.
+ This is essentially a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ping</I
+ ></SPAN
+ >. If there is no response to this
+ request, Squid will attempt to go direct to the origin server. since
+ (in this case, at least) you cannot bypass your ISP's cache, you may
+ want to reduce the latency added by this extra query. To do this,
+ place the <B
+ CLASS="COMMAND"
+ >default</B
+ > and <B
+ CLASS="COMMAND"
+ >no-query</B
+ > keywords at the end of
+ your <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line:
+ <A
+ NAME="AEN697"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache_peer&nbsp;cache.myisp.example&nbsp;parent&nbsp;3128&nbsp;3130&nbsp;default&nbsp;no-query</P
+ ></BLOCKQUOTE
+ >
+ The <B
+ CLASS="COMMAND"
+ >default</B
+ > option essentially tells Squid "Go through this
+ cache for all requests. If it's down, return an error message to the
+ client: you cannot go direct".</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >no-query</B
+ > option gets Squid to ignore the given ICP port
+ (leaving the port number out will return an error), and never to
+ attempt to query the cache with ICP.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN702">Firewall Interactions</H3
+ ><P
+ >Firewalls can make cache configuration hairy. Inter-cache protocols
+ generally use packets which firewalls inherently distrust. Most caches
+ (Squid included) use ICP, which is a layer on top of UDP. UDP is
+ difficult to make secure, and firewall administrators generally
+ disable it if at all possible.</P
+ ><P
+ >It's suggested that you place your cache server on your DMZ (if you
+ have one). There are a few advantages to this:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Your cache server is kept secure.</P
+ ></LI
+ ><LI
+ ><P
+ >The firewall can be configured to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >hand off</I
+ ></SPAN
+ > requests to the cache
+ server, assuming it is capable.</P
+ ></LI
+ ><LI
+ ><P
+ >You will be able to peer with other, outside, caches (like your ISP's),
+ since DMZ networks generally have less rigid rule sets.</P
+ ></LI
+ ></UL
+ ><P
+ >The remainder of this section should help you getting Squid and your
+ firewall to co-operate. A few cases are covered for each type of
+ firewall: the cache inside the firewall; the cache outside the
+ firewall; and, finally, on the DMZ.</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN715">Proxying Firewalls</H4
+ ><P
+ >The vast majority of firewalls no nothing about ICP. If, on the other
+ hand, your firewall does not support HTTP, it's a good time to have a
+ serious talk to the buyer that had an all-expenses-paid weekend on
+ the firewall supplier. Configuring the firewall to understand ICP is
+ likely to be painful, but HTTP should be easy.</P
+ ><P
+ >If you are using a proxy-level firewall, your client machines are
+ probably configured to use the firewall's internal IP address as
+ their proxy server. Your firewall could also be running in
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >transparent</I
+ ></SPAN
+ > mode, where it automatically picks up outgoing web
+ requests. If you have a fair number of client machines, you may not
+ relish the idea of reconfiguring all of them. If you fall into this
+ category, you may wish to put your firewall on the outside (or on the
+ DMZ) and configure the firewall to pass requests to the cache, rather
+ than reconfiguring all client machines.&#13;</P
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN721">Inside</H5
+ ><P
+ >The cache is considered a trusted host, and is protected by the firewall.
+ You will configure client machines to use the cache server in their browser
+ proxy settings, and when a request is made, the cache server will pass the
+ outgoing request to the firewall, treating the firewall as a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >parent</I
+ ></SPAN
+ >
+ proxy server. The firewall will then, connect to the destination server. If
+ you have a large number of clients configured to use the firewall as
+ their proxy server, you could get the firewall to hand-off incoming
+ HTTP requests back into the network, to the cache server. This is less
+ efficient though, since the cache will then have to re-pass these
+ requests through the firewall to get to the outside, using the parent
+ option to <B
+ CLASS="COMMAND"
+ >cache_pee</B
+ >r. Since the latter involves traffic passing through
+ the firewall twice, your load is very likely to increase. You should
+ also beware of loops, with the cache server parenting to the firewall
+ and the firewall <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >handing-off</I
+ ></SPAN
+ > the cache's request back to the cache!</P
+ ><P
+ >As described in chapter 1, Squid will also send ICP queries to
+ parents. Firewalls don't care for UDP packets, and normally log (and then
+ discard) such packets.</P
+ ><P
+ >When Squid does not receive a response from a configured parent, it will
+ mark the parent as down, and proceed to go directly.</P
+ ><P
+ >Whenever Squid is setup to use a parent that does not support ICP, the
+ <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line should include the "default" and "no-query" options. These
+ options stop Squid from attempting to go direct when all caches are considered
+ down, and specify that Squid is not to send ICP requests to that parent.</P
+ ><P
+ >Here is an example config entry:
+ <A
+ NAME="AEN732"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache_peer&nbsp;inside.fw.address.domain&nbsp;parent&nbsp;3128&nbsp;3130&nbsp;default&nbsp;no-query</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN734">Outside</H5
+ ><P
+ >There are only two major reasons for you to put your cache outside
+ the firewall:</P
+ ><P
+ >One: Although squid can be configured to do authentication, this can
+ lead to the duplication of effort (you will encounter the "add new staff
+ to 500 servers" syndrome). If you want to continue to authenticate users
+ on the firewall, you will have to put your cache on the outside or on
+ the DMZ.  The firewall will thus accept requests from clients,
+ authenticate them, and then pass them on to the cache server.</P
+ ><P
+ >Two: Communicating with cache hierarchies is easy. The cache server can
+ communicate with other systems using any protocol. Sibling caches, for
+ example, are difficult to contact through a proxying firewall.</P
+ ><P
+ >You can <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >only</I
+ ></SPAN
+ > place your cache outside if your firewall supports
+ hand-offs. Browsers inside will connect to the firewall and request a
+ URL, and the firewall will connect to the outside cache and request the
+ page.</P
+ ><P
+ >If you place your cache outside your firewall, you may find that your
+ client PC's have problems connecting to internal web servers (your
+ intranet, for example, may be unreachable). The problem is that the
+ cache is unable to connect back through to your internal network (which is
+ actually a good thing: don't change that). The best thing to do here is
+ to add exclusions to your browser settings: this is described in
+ Chapter 5 - you should specifically have a look at the section on
+ browser autoconfig. In the meantime, let's just get Squid going, and
+ we will configure browsers once you have a cache to talk to.</P
+ ><P
+ >Since the cache is not protected by the firewall, it must be very
+ carefully configured - it must only accept requests from the firewall,
+ and must not run any strange services. If possible, you should disable
+ telnet, and use something like SSH (Secure SHell) instead. The access
+ control lists (which you will setup shortly) must only allow the
+ firewall, otherwise people will be able to relay their requests
+ through your cache, using your bandwidth.</P
+ ><P
+ >If you place the cache outside the firewall, you client
+ PC's will be configured to use the firewall as their proxy server
+ (this is probably the case already). The firewall must be
+ configured to hand-off client HTTP requests to the cache server.
+ The cache must be configured to only allow HTTP requests when from
+ the firewall's outside IP address. If not configured this way, other
+ Internet users could use your cache server as a relay, using your
+ bandwidth and hardware resources for illegitimate (and possibly
+ illegal) purposes.</P
+ ><P
+ >With your cache server on the outside network, you should treat
+ the machine as a completely untrusted host, lest a cracker find a
+ hole somewhere on the system. It is recommended that you place the
+ cache server on a dedicated firewall network card, or on a switched
+ ethernet port. This way, if your cache server were to be cracked,
+ the cracker would only be able to read passing HTTP data. Since the
+ majority of sensitive information is sent via email, this would reduce
+ the potential for sensitive data loss.</P
+ ><P
+ >Since your cache server only accepts requests from the firewall,
+ there is no <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line needed in the
+ <B
+ CLASS="COMMAND"
+ >squid.conf</B
+ >. If you have to talk to your ISP's
+ cache you will, of course, need one: see the section on this a bit
+ further back.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN748">DMZ</H5
+ ><P
+ >The best place for a cache is your DMZ.</P
+ ><P
+ >If you are concerned with the security of your cache server, and want
+ to be able to communicate with outside cache servers (using ICP), you
+ may want to put your cache on the DMZ.</P
+ ><P
+ >With Squid on your DMZ, internal client PCs are setup to proxy
+ to the firewall. The firewall is then responsible for handing-off
+ these HTTP requests to the cache server (so the firewall in fact
+ treats the cache server as a parent).</P
+ ><P
+ >Since your cache server is (essentially) on the outside of the
+ firewall, the cache doesn't need to treat the firewall as a parent or
+ sibling: it only accepts requests from the firewall: it never passes
+ them <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >to</I
+ ></SPAN
+ > the firewall.</P
+ ><P
+ >If your cache is outside your firewall, you will need to configure
+ your client PC's not to use the firewall as a proxy server for
+ internal hosts. This is quite easy, and is discussed in the chapter on
+ browser configuration.</P
+ ><P
+ >Since the firewall is acting as a filter between your cache and the
+ outside world, you are going to have to open up some ports on the
+ firewall. The cache will need to be able to connect to port 80 on any
+ machine on the outside world. Since some valid web servers will run on
+ ports other than 80, you should consider allowing connections to any
+ port from the cache server. In short, allow connections to:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Port 80 (for normal HTTP requests)</P
+ ></LI
+ ><LI
+ ><P
+ >Port 443 (for HTTPS requests)</P
+ ></LI
+ ><LI
+ ><P
+ >Ports higher than 1024 (site search engines often use high-numbered
+ ports)</P
+ ></LI
+ ></UL
+ ><P
+ >If you are going to communicate with a cache server outside the
+ firewall, you will need even more ports opened. If you are going to
+ communicate with ICP, you will need to allow UDP traffic from and to
+ your cache machine on port 3130. You may find that the cache server
+ that you are peering with uses different ports for reply packets. It's
+ probably a bad idea to open all UDP traffic, though.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN765">Packet Filtering firewalls</H4
+ ><P
+ >Squid will normally live on the inside of your packet-filtering
+ firewall. If you have a DMZ, it may be best to put your cache on this
+ network, as you may want to allow UDP traffic to and from the cache
+ server (to communicate with other caches).</P
+ ><P
+ >To configure your firewall correctly, you should make the minimum
+ number of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >holes</I
+ ></SPAN
+ > in your filter set. In the remainder of this
+ section we assume that your internal machines can connect to the cache
+ server unimpeded. If your cache is on the DMZ (or outside the firewall
+ altogether) you will need to allow TCP connections from your internal
+ network (on a random source port) to the HTTP port that Squid will be
+ accepting requests on (this is the port that you set a bit earlier, in
+ the "Setting Squid's HTTP Port" section of this chapter.</P
+ ><P
+ >First, let's consider the firewall setup when you do not query any
+ outside caches. On accepting a request, Squid will attempt to connect
+ to a machine on the Internet at large. Almost always, the destination
+ port will be the default HTTP port, port 80. A few percent of the
+ time, however, the request will be destined for a high-numbered port
+ (any port number higher than 1023 is a high-numbered port).
+ Squid always sources TCP requests <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >from</I
+ ></SPAN
+ > a high-numbered port, so
+ you will thus need to allow TCP requests (all HTTP is TCP-based) from
+ a random high-numbered port to both port 80 and any high-numbered
+ port.</P
+ ><P
+ >There is another low-numbered port that you will probably need to
+ open. The HTTPS port (used for secure Internet transactions) is
+ normally listening on TCP port 443, so this should also be opened.</P
+ ><P
+ >In the second situation, let's look at cache-peering. If you are
+ planning to interact with other caches, you will need to open a few
+ more ports. First, let's look at ICP. As mentioned previously, ICP is
+ UDP-based. Almost all ICP-compliant caches listen for ICP requests on
+ UDP port 3130. Squid will always source requests from port 3130 too,
+ though other ICP-compliant caches may source their requests from a
+ different port.</P
+ ><P
+ >It's probably not a good idea to allow these UDP packets no matter
+ what source address they come from. Your filter should probably
+ specify the IP addresses for each of the caches that you wish to peer
+ from, rather than allowing UDP packets from any source address.
+ 
+ 
+ That should be it: You should now be able to save the config file, and get
+ ready to start the Squid program.</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN777">Chapter 4. Starting Squid</H1
+ ><DIV
+ CLASS="SECT1"
+ ><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN779">Before Running Squid</H2
+ ><P
+ >Before we can start Squid, we have to create a few directories on
+ the system. It's important that these directories have the correct
+ permissions, otherwise someone with a login on the cache may be able
+ to gain root access. Let's work through the default directory tree,
+ and set the permissions on each directory correctly. Since you may
+ have special requirements, I won't simply give you a sequence of
+ commands to run: if you need to use different permissions, it's
+ important to understand the possible consequences.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN782">Subdirectory Permissions</H3
+ ><P
+ >In Chapter 2 we created a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > user and group, and created
+ another group, <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > for the people that will maintain
+ the cache. When Squid starts up, it changes it's user and group
+ ids to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > (thanks to the <B
+ CLASS="COMMAND"
+ >cache_effective_user</B
+ >
+ and <B
+ CLASS="COMMAND"
+ >cache_effective_group</B
+ > tags in squid.conf.) Changing
+ userids reduces the chance of a complete exploit because of a bug
+ in Squid. It's important, however, to remember that users in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > group can probably get root on your machine, so you
+ should not put people that do not already have root on the machine in
+ that group: it's just so that you don't have to <B
+ CLASS="COMMAND"
+ >su</B
+ > to root
+ continuously.</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN792">System Dependant Information</H4
+ ><P
+ >In the below examples, we assume that a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >root</I
+ ></SPAN
+ > group exists
+ on your system. This may not be the case: some of you may have to
+ replace the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >root</I
+ ></SPAN
+ > group (not the user id!) in the examples
+ below with either <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >wheel</I
+ ></SPAN
+ > or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >bin</I
+ ></SPAN
+ >.</P
+ ><P
+ >There are many versions of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >chown</I
+ ></SPAN
+ > that don't use the
+ "userid:groupid" notation we use in the following examples.  On some
+ systems the ":" may have to be replaced by a ".", on others you may
+ have to run a separate "chgrp groupid" command to achieve the same
+ end. See your system's chown manpage for more information.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN801">Walking the Directory Tree</H4
+ ><P
+ >Let's start with the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/</I
+ ></SPAN
+ > directory. If your
+ system starts Squid at bootup, a startup script running as root
+ starts the program <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/bin/squid</I
+ ></SPAN
+ >. If someone
+ were to replace this binary with a trojan, they could gain root
+ access. The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/</I
+ ></SPAN
+ > directory should be owned by
+ root, group root, and should not be writable by anyone else. This
+ stops someone from moving the entire <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >bin</I
+ ></SPAN
+ > directory to (say)
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >bin.off</I
+ ></SPAN
+ >, and creating a new <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >bin</I
+ ></SPAN
+ > directory which contains
+ their own <B
+ CLASS="COMMAND"
+ >squid</B
+ > binary. Use the following commands to set
+ the permissions on this directory correctly:
+ <A
+ NAME="AEN811"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >chown&nbsp;root:root&nbsp;/usr/local/squid/<br>
+ chmod&nbsp;755&nbsp;/usr/local/squid/</P
+ ></BLOCKQUOTE
+ >
+ Since we have already introduced the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/bin</I
+ ></SPAN
+ >
+ directory, let's set it's permissions correctly next. If the
+ directory itself was writeable by malicious users, we would have
+ the same problem that we described above. Let's change it to be
+ owned by root, group root, and make sure that only these root can
+ write to the directory. We also need the files in this directory
+ to be readable (and executable) by everyone, so that normal users
+ can run programs like <B
+ CLASS="COMMAND"
+ >client</B
+ >. There are no setuid binaries
+ in this directory, and if the rest of the files have the correct
+ permissions, there is no reason not to let users into this directory.
+ <A
+ NAME="AEN815"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cd&nbsp;/usr/local/squid/bin<br>
+ chown&nbsp;root:root&nbsp;.&nbsp;&nbsp;chown&nbsp;root:root&nbsp;*<br>
+ chmod&nbsp;755&nbsp;.&nbsp;*</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >Config files all live in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/</I
+ ></SPAN
+ > directory. If
+ a user can write to these files, they can almost certainly do
+ malicious things. Because of this, you should not let normal users
+ edit these files: only users which already have root access should be
+ allowed to edit <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ >. Earlier in the book, we created a
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > for these users.</P
+ ><P
+ >The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/</I
+ ></SPAN
+ >  directory should be owned by root,
+ group <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ >, so that squid-administrators would be able
+ to create and update config files.</P
+ ><P
+ >Many of you will not have encountered <B
+ CLASS="COMMAND"
+ >chown</B
+ > commands which
+ use more than three numbers before. The following command sets the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sticky bit</I
+ ></SPAN
+ > on the directory. Let's assume that my primary
+ group-id is <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >staff</I
+ ></SPAN
+ > (not <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ >.) On some systems, any
+ file that I create will be owned by group <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >staff</I
+ ></SPAN
+ >, even if the
+ directory is owned by the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > group. On these systems this
+ would be a security problem: if I create the squid.conf file, people
+ in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >staff</I
+ ></SPAN
+ > group may be able to make changes to the file.</P
+ ><P
+ >With the sticky bit set on the directory, any files I create will
+ be owned by the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squidadm</I
+ ></SPAN
+ > group. As I have said: this isn't
+ necessary on some operating systems, but these permissions shouldn't
+ have any adverse effect.
+ <A
+ NAME="AEN834"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cd&nbsp;/usr/local/squid/etc<br>
+ chmod&nbsp;2775&nbsp;.<br>
+ chown&nbsp;root:squidadm&nbsp;.&nbsp;*</P
+ ></BLOCKQUOTE
+ >
+ When you use RCS (introduced in Chapter 2), the revision history
+ of a file is stored in an RCS logfile. These files will normally be
+ created in the current directory (the <B
+ CLASS="COMMAND"
+ >ci</B
+ > command appends a
+ comma to the filename to decide the name of the logfile, leading to
+ filenames like <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf,v</I
+ ></SPAN
+ >.) If you don't want your directory
+ cluttered with these files, you can create an <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >RCS</I
+ ></SPAN
+ > directory,
+ and move RCS files into it. The Revision Control System
+ only stores logfiles in the current directory if an RCS directory
+ doesn't exist, if one does, all new log files are created in it.</P
+ ><P
+ >If someone can gain access to the log files, they essentially have
+ write access to original file, since when you check a file out (to
+ make changes to it) the log file is considered to be the authoritive
+ source. Don't forget to change the permissions on the RCS log files
+ Squid doesn't create an RCS directory automatically; we create it in
+ the example below.
+ 
+ <A
+ NAME="AEN841"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >#&nbsp;first,&nbsp;make&nbsp;the&nbsp;RCS&nbsp;directory<br>
+ cd&nbsp;/usr/local/squid/etc<br>
+ mkdir&nbsp;RCS<br>
+ #&nbsp;move&nbsp;any&nbsp;RCS&nbsp;logfiles&nbsp;into&nbsp;the&nbsp;RCS&nbsp;directory,&nbsp;so&nbsp;that&nbsp;they&nbsp;don't<br>
+ #&nbsp;clutter&nbsp;the&nbsp;config-file&nbsp;directory<br>
+ mv&nbsp;*,v&nbsp;RCS<br>
+ #&nbsp;make&nbsp;sure&nbsp;that&nbsp;the&nbsp;RCS&nbsp;directory&nbsp;is&nbsp;owned&nbsp;by&nbsp;the&nbsp;right&nbsp;people,&nbsp;and<br>
+ #&nbsp;can&nbsp;be&nbsp;writeable&nbsp;by&nbsp;them<br>
+ chown&nbsp;root:squidadm&nbsp;RCS<br>
+ chmod&nbsp;2770&nbsp;RCS<br>
+ #&nbsp;change&nbsp;the&nbsp;permissions&nbsp;of&nbsp;the&nbsp;files&nbsp;in&nbsp;the&nbsp;RCS&nbsp;directory&nbsp;to&nbsp;match<br>
+ #&nbsp;newly&nbsp;created&nbsp;files<br>
+ chown&nbsp;root:squidadm&nbsp;RCS/*<br>
+ chmod&nbsp;770&nbsp;RCS/*</P
+ ></BLOCKQUOTE
+ >
+ Cache log files should be confidential. You (and other Squid
+ administrators) may have to look at them occasionally, but other users
+ should have no access to the files. Squid runs as the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ >
+ user, though, and needs to create the logs, so any directory we make
+ needs to be writeable by the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > user too.</P
+ ><P
+ ><A
+ NAME="AEN846"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >chown&nbsp;squid:squidadm&nbsp;/usr/local/squid/logs<br>
+ chmod&nbsp;770&nbsp;/usr/local/squid/logs</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN848">Object Store Directory Permissions</H4
+ ><P
+ >As you may recall from Chapter 3, downloaded objects are placed in
+ a hierarchy of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >swap directories</I
+ ></SPAN
+ >. Squid.conf contains a
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache_store</I
+ ></SPAN
+ > line for each directory that files are to be stored
+ in, and specifies the number of subdirectories that are to be created
+ in each cache store (most people leave this at the default, 4096
+ directories per cache store.)</P
+ ><P
+ >Squid's <B
+ CLASS="COMMAND"
+ >-z</B
+ > command-line option will create the
+ appropriate cache-swap directories (since creating them by
+ hand would be painful!)  If the top-level cache directory
+ specified in squid.conf does not exist, Squid will attempt
+ to create it too, as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ >, group <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > (or
+ whatever cache_effective_user/cache_effective_group is
+ set to in squid.conf.) Since we changed the permissions on
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid</I
+ ></SPAN
+ > above so that only <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >root</I
+ ></SPAN
+ > can write
+ to this directory, Squid's directory create will fail. Instead,
+ let's create these directories and set their permissions manually.</P
+ ><P
+ >If someone has read access to the cache logs, they can invade people's
+ privacy. It may seem harmless to let people access the cache store
+ indiscriminately, but I contend that it isn't.</P
+ ><P
+ >Many web accesses reveal something about the person examining the
+ page, be it their sexuality, their financial status, or their job
+ satisfaction. This is why we stop people accessing log files and
+ finding out who went to what pages, right? Well, it also means that
+ we must stop people accessing the cache store directly. In many
+ systems using cryptography, you can discover much about the nature
+ of the contents of the traffic by <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >traffic analysis</I
+ ></SPAN
+ >, relating
+ traffic flows to other events. If people only have access to the
+ cache using a browser, it difficult for them to associate any hits
+ they see with a given person. If they can examine other information
+ about the object (say, the time that the file was created) they
+ may be able to discover information about the person that requested
+ the object. A simple example: let's say that someone connected to
+ a job-search site at the middle of the night. You can immediately
+ narrow down the list of possible requestors to night-staff. If you
+ can find out who was on duty on that day, you narrow the number of
+ possible requestors even more.</P
+ ><P
+ >Let's change the permissions on the cache store so that only
+ squid-administrators can access files in it. Note that you are going
+ to have to repeat this process for every <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache_dir</I
+ ></SPAN
+ > in the
+ squid.conf file.
+ <A
+ NAME="AEN864"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >mkdir&nbsp;/usr/local/squid/cache/<br>
+ chown&nbsp;squid:squidadm&nbsp;/usr/local/squid/cache/<br>
+ chmod&nbsp;770&nbsp;/usr/local/squid/cache/</P
+ ></BLOCKQUOTE
+ >
+ Once the permissions on the cache directories are set correctly, you can
+ run <B
+ CLASS="COMMAND"
+ >squid -z</B
+ >.</P
+ ><P
+ >Your output should look something like this:
+ <A
+ NAME="AEN868"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache1:~&nbsp;#&nbsp;/usr/local/squid/bin/squid&nbsp;-z<br>
+ 1999/06/12&nbsp;19:15:34|&nbsp;Creating&nbsp;Swap&nbsp;Directories<br>
+ cache1:~&nbsp;#</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN870">Problems Creating Swap Directories</H4
+ ><P
+ >If you get <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >permission denied</I
+ ></SPAN
+ > errors running <B
+ CLASS="COMMAND"
+ >squid -z</B
+ >,
+ double check that you are root, then check that squid.conf's
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache_effective_user</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache_effective_group</I
+ ></SPAN
+ > tags are
+ both set to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ >.</P
+ ><P
+ >What occasionally happens is that a directory further towards <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/</I
+ ></SPAN
+ >
+ (the directories <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/</I
+ ></SPAN
+ > or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/</I
+ ></SPAN
+ >, for
+ example) are not
+ set as readable/executable by the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid</I
+ ></SPAN
+ > user. Because the
+ appropriate user cannot access these directories, it cannot create
+ files in the cache store directory. If you are still having problems
+ running <B
+ CLASS="COMMAND"
+ >squid -z</B
+ >, ensure that each of the directories
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid</I
+ ></SPAN
+ > have reasonable
+ permissions.</P
+ ><P
+ >Right:
+ <A
+ NAME="AEN892"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache1:~&nbsp;#&nbsp;ls&nbsp;-ld&nbsp;/usr/local/<br>
+ drwxr-xr-x&nbsp;&nbsp;10&nbsp;root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1024&nbsp;May&nbsp;&nbsp;1&nbsp;10:31&nbsp;/usr/local/</P
+ ></BLOCKQUOTE
+ >
+ Wrong:
+ <A
+ NAME="AEN894"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache1:~&nbsp;#&nbsp;ls&nbsp;-ld&nbsp;/usr/local/<br>
+ drwxr-x---&nbsp;&nbsp;10&nbsp;root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1024&nbsp;May&nbsp;&nbsp;1&nbsp;10:31&nbsp;/usr/local/</P
+ ></BLOCKQUOTE
+ >
+ Use the <B
+ CLASS="COMMAND"
+ >chmod o+rx /usr/local/</B
+ > command to make the directory
+ readable and executable by everyone.</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN897">Running Squid</H2
+ ><P
+ >Squid should now be configured, and the directories should have the
+ correct permissions. We should now be able to start Squid, and you
+ can try and access the cache with a web browser. Squid is normally
+ run by starting the RunCache script. RunCache (as mentioned ealier)
+ restarts Squid if it dies for some reason, but at this stage we are
+ merely testing that it will run properly: we can add it to startup
+ scripts at a later stage.</P
+ ><P
+ >Programs which handle network requests (such as inetd and sendmail)
+ normally run in the background. They are run at startup, and log any
+ messages to a file (instead of printing it to a screen or terminal,
+ as most user-level programs do.) These programs are often referred
+ to as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >daemon</I
+ ></SPAN
+ > programs. Squid is such a program: when you run
+ the squid binary, you should be immediately returned to the command
+ line. While it looks as if the program ran and did nothing, it's
+ actually sitting in the background waiting for incoming requests. We
+ want to be able to see that Squid's actually doing something useful,
+ so we increase the debug level (using <B
+ CLASS="COMMAND"
+ >-d 1</B
+ >) and tell it
+ not to dissapear into the background (using <B
+ CLASS="COMMAND"
+ >-N</B
+ >.) If your
+ machine is not connected to the Internet (you are doing a trial
+ squid-install on your home machine, for example) you should use
+ the <B
+ CLASS="COMMAND"
+ >-D</B
+ > flag too, since Squid tries to do DNS lookups for
+ a few common domains, and dies with an error if it is not able to
+ resolve them.</P
+ ><P
+ >The following output is that printed by a default install of Squid:
+ <A
+ NAME="AEN906"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache1:~&nbsp;#&nbsp;/usr/local/squid/bin/squid&nbsp;-N&nbsp;-d&nbsp;1&nbsp;-D</P
+ ></BLOCKQUOTE
+ >
+ Squid reads the config file, and changes user-id's here:
+ <A
+ NAME="AEN908"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >1999/06/12&nbsp;19:16:20|&nbsp;Starting&nbsp;Squid&nbsp;Cache&nbsp;version&nbsp;2.2.DEVEL3&nbsp;for&nbsp;i586-pc-linux-gnu...<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Process&nbsp;ID&nbsp;4121</P
+ ></BLOCKQUOTE
+ >
+ Each concurrent incoming request uses at least one
+ filedescriptor. 256 filedescriptors is only enough for a small,
+ lightly loaded cache server, see Chapter 12 for more details.
+ Most of the following is diagnostic:
+ <A
+ NAME="AEN910"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >1999/06/12&nbsp;19:16:20|&nbsp;With&nbsp;256&nbsp;file&nbsp;descriptors&nbsp;available<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;helperOpenServers:&nbsp;Starting&nbsp;5&nbsp;'dnsserver'&nbsp;processes<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Unlinkd&nbsp;pipe&nbsp;opened&nbsp;on&nbsp;FD&nbsp;13<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Swap&nbsp;maxSize&nbsp;10240&nbsp;KB,&nbsp;estimated&nbsp;787&nbsp;objects<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Target&nbsp;number&nbsp;of&nbsp;buckets:&nbsp;15<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Using&nbsp;8192&nbsp;Store&nbsp;buckets,&nbsp;replacement&nbsp;runs&nbsp;every&nbsp;10&nbsp;seconds<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Max&nbsp;Mem&nbsp;&nbsp;size:&nbsp;8192&nbsp;KB<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Max&nbsp;Swap&nbsp;size:&nbsp;10240&nbsp;KB<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Rebuilding&nbsp;storage&nbsp;in&nbsp;Cache&nbsp;Dir&nbsp;#0&nbsp;(DIRTY)</P
+ ></BLOCKQUOTE
+ >
+ When you connect to an ftp server without a cache, your browser
+ chooses icons to match the files based on their filenames. When you
+ connect through a cache server, it assumes that the page returned will
+ be in html form, and will include tags to load any images so that the
+ directory listing looks <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >normal</I
+ ></SPAN
+ >.
+ Squid adds these tags, and has a collection of icons that it refers
+ clients to. These icons are stored in
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/icons/</I
+ ></SPAN
+ >. If Squid has permission problems
+ here, you need to make sure that these files are owned by the
+ appropriate users (in the previous section we set permissions on the
+ files in this directory.)
+ <A
+ NAME="AEN914"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >1999/06/12&nbsp;19:16:20|&nbsp;Loaded&nbsp;Icons.</P
+ ></BLOCKQUOTE
+ >
+ The next few lines are the most important. Once you see the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Ready to serve requests</I
+ ></SPAN
+ > line, you should be able to start using the cache
+ server. The HTTP port is where Squid is waiting for browser
+ connections, and should be the same as whatever we set it to in the
+ previous chapter. The ICP port should be 3130, the default, and if you
+ have included other protocols (such as HTCP) you should see them here.
+ If you see permission denied errors here, it's possible that you are
+ trying to bind to a low-numbered port (like 80) as a normal user. Try
+ run the startup command is root, or (if you don't have root access on
+ the machine) choose a high-numbered port.
+ Another common error message at this stage is <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Address already in use</I
+ ></SPAN
+ >. This occurs when another process is already listening to the
+ given port. This could be because Squid is already started (perhaps
+ you are upgrading from an older version which is being restarted by
+ the RunCache script) or you have some other process listening  on the
+ same port (such as a web server.)
+ <A
+ NAME="AEN918"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >1999/06/12&nbsp;19:16:20|&nbsp;Accepting&nbsp;HTTP&nbsp;connections&nbsp;on&nbsp;port&nbsp;3128,&nbsp;FD&nbsp;35.<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Accepting&nbsp;ICP&nbsp;messages&nbsp;on&nbsp;port&nbsp;3130,&nbsp;FD&nbsp;36.<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Accepting&nbsp;HTCP&nbsp;messages&nbsp;on&nbsp;port&nbsp;4827,&nbsp;FD&nbsp;37.<br>
+ 1999/06/12&nbsp;19:16:20|&nbsp;Ready&nbsp;to&nbsp;serve&nbsp;requests.</P
+ ></BLOCKQUOTE
+ >
+ Once Squid is up-and-running, it reads the cache-store. Since we are
+ starting Squid for the first time, you should see only zeros for all
+ the numbers below:
+ <A
+ NAME="AEN920"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >1999/06/12&nbsp;19:16:20|&nbsp;storeRebuildFromDirectory:&nbsp;DIR&nbsp;#0&nbsp;done!<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;Finished&nbsp;rebuilding&nbsp;storage&nbsp;disk.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Entries&nbsp;read&nbsp;from&nbsp;previous&nbsp;logfile.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Entries&nbsp;scanned&nbsp;from&nbsp;swap&nbsp;files.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Invalid&nbsp;entries.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;With&nbsp;invalid&nbsp;flags.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Objects&nbsp;loaded.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Objects&nbsp;expired.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Objects&nbsp;cancelled.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Duplicate&nbsp;URLs&nbsp;purged.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;Swapfile&nbsp;clashes&nbsp;avoided.<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;&nbsp;&nbsp;Took&nbsp;5&nbsp;seconds&nbsp;(&nbsp;&nbsp;&nbsp;0.0&nbsp;objects/sec).<br>
+ 1999/06/12&nbsp;19:16:25|&nbsp;Beginning&nbsp;Validation&nbsp;Procedure<br>
+ 1999/06/12&nbsp;19:16:26|&nbsp;storeLateRelease:&nbsp;released&nbsp;0&nbsp;objects<br>
+ 1999/06/12&nbsp;19:16:27|&nbsp;&nbsp;&nbsp;Completed&nbsp;Validation&nbsp;Procedure<br>
+ 1999/06/12&nbsp;19:16:27|&nbsp;&nbsp;&nbsp;Validated&nbsp;0&nbsp;Entries<br>
+ 1999/06/12&nbsp;19:16:27|&nbsp;&nbsp;&nbsp;store_swap_size&nbsp;=&nbsp;21k</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN922">Testing Squid</H2
+ ><P
+ >&#13;
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ If all has gone well, we can begin to test the cache. True browser
+ access is only covered in the next chapter, and there is a whole
+ chapter devoted to configuring your browser. Until then, testing
+ is done with the <B
+ CLASS="COMMAND"
+ >client</B
+ > program, which is included with
+ the Squid source, and is in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/bin</I
+ ></SPAN
+ > directory.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >client</B
+ > program connects to a cache and request a page,
+ and prints out useful timing information. Since <B
+ CLASS="COMMAND"
+ >client</B
+ > is
+ available on all systems that Squid runs on, and has the same
+ interface on all of them, we use it for the initial testing.</P
+ ><P
+ >At this stage Squid should be in the foreground, logging everything
+ to your terminal. Since <B
+ CLASS="COMMAND"
+ >client</B
+ > is a unix program, you need
+ access to a command prompt to run it. At this stage it's probably
+ easiest to simply start another session (this way you can see if
+ errors are printed in the main window).</P
+ ><P
+ >The client program is compiled to connect to localhost on port 3128
+ (you can override these defaults from the command line, see the
+ output of <B
+ CLASS="COMMAND"
+ >client -h</B
+ > for more details.)</P
+ ><P
+ >If you are running <B
+ CLASS="COMMAND"
+ >client</B
+ > on the cache server, and are
+ using port 3128 for incoming requests, you should be able to type a
+ command like this, and the client program will retrieve the page
+ through the cache server:
+ <A
+ NAME="AEN949"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >client&nbsp;http://squid.nlanr.net/</P
+ ></BLOCKQUOTE
+ >
+ If your cache is running on a different machine you will have to use
+ the <B
+ CLASS="COMMAND"
+ >-h</B
+ > and <B
+ CLASS="COMMAND"
+ >-p</B
+ > options. The following command will
+ connect to the machine <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache.qualica.comf</I
+ ></SPAN
+ > on port 8080 and
+ retrieve the above web page.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN954"><P
+ ><B
+ >Example 4-1. Using the -h and -p client Options</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache1:~ $ /usr/local/squid/bin/client -h cache.qualica.com -p 8080 http://www.squid-cache.com/</PRE
+ ></DIV
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >client</B
+ > program can also be used to access web sites
+ directly. As you may remember from reading Chapter 2, the protocol that
+ clients use to access pages through a cache is part of the HTTP
+ specification. The client program can be used to send both "normal"
+ and "cache" HTTP requests. To check that your cache machine can
+ actually connect to the outside world, it's a good idea to test
+ access to an outside web server.</P
+ ><P
+ >The next example will retrieve the page at
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http://www.qualica.com/</I
+ ></SPAN
+ >, and send the html contents of the
+ page to your terminal.</P
+ ><P
+ >If you have a firewall between you and the internet, the request
+ may not work, since the firewall may require authentication (or, if
+ it's a proxy-level firewall and is not doing transparent proxying
+ of the data, you may explicitly have to tell client to connect to
+ the machine.) To test requests through the firewall, look at the
+ next section.</P
+ ><P
+ >A note about the syntax of the next request: you are telling
+ <B
+ CLASS="COMMAND"
+ >client</B
+ > to connect directly to the remote site, and request
+ the page <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/</I
+ ></SPAN
+ >.  With a request through a cache server, you connect
+ to the cache (as you would expect) and request a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >whole url</I
+ ></SPAN
+ >
+ instead of just the path to a file. In essence, both normal-HTTP
+ and cache-HTTP requests are identical; one just happens to refer
+ to a whole URL, the other to a file.</P
+ ><P
+ ></P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN967"><P
+ ><B
+ >Example 4-2. Retrieving Pages directly from a remote site with client</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache1:~ $ /usr/local/squid/bin/client -h www.squid-cache.com -p 80 /</PRE
+ ></DIV
+ ><P
+ >Client can also print out timing information for the download of a
+ page. In this mode, the contents of thi page isn't printed: only the
+ timing information is. The zero in the below example indicates that
+ Squid is to retrieve the page until interrupted (with Control-C or
+ Break.) If you want to retrieve the page a limited number of times,
+ simply replace the zero with a number.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN971"><P
+ ><B
+ >Example 4-3. Printing timing information for a page download</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache1:~ $ /usr/local/squid/bin/client -g 0 -h www.squid-cache.com -p 80 /</PRE
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN974">Testing a Cache or Proxy Server with Client</H3
+ ><P
+ >Now that you have client working, you</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN977"><P
+ ><B
+ >Example 4-4. Accessing a site through the cache</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache1:~ $ /usr/local/squid/bin/client -h cache1.domain.example -p 3128 http://www.squid-cache.com/</PRE
+ ></DIV
+ ><P
+ >If the request through the cache returned the same page as you retrieved
+ with direct access (you didn't receive an error message from Squid), Squid
+ should be up and running. Congratulations!
+ If things aren't going so well for you, you will have received
+ an error message here. Normally, this is because of the acls
+ described in the previous chapter. First, you should have a
+ look at the terminal where you are running Squid (Or, if you
+ are skipping ahead and have put Squid in the background, in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/logs/cache.log</I
+ ></SPAN
+ > file.) If Squid encountered
+ some sort of problem, there should be an error or warning in this
+ file. If there are no messages here, you should look at the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/logs/access.log</I
+ ></SPAN
+ > file next. We haven't coverd
+ the details of this file yet, but they are coverded in the next
+ section of this chapter. First, though, let's see if your cache can
+ process requests to internal servers. There are many cases where a
+ request will work to internal servers but not to external machines.</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN983">Testing Intranet Access</H4
+ ><P
+ >If you have a proxy-based firewall, Squid should be configured to pass
+ outgoing requests to the proxy running on the firewall. This quite often
+ presents a problem when an internal client is attempting to connect to an
+ internal (Intranet) server, as discussed in section 2.2.5.2.
+ To ensure that the acl-operator lists created in section 2.2.5.2 are working,
+ you should use client to attempt to connect to a machine on the local
+ network through the cache.
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >cache1:~ $ client -h cache1.domain.example -p 3128 http://www.localdomain.example</PRE
+ ></P
+ ><P
+ >If you didn't get an error message from a command like the above, access to
+ local servers should be working.
+ It is possible, however, that the connection could be being passed from the
+ local cache to the parent (across a serial line), and the parent could be
+ connecting back into the local network, slowing the connection enormously.
+ The only way to ensure that the connection is not passing through your
+ parent is to check the access logs, and see which server the connection is
+ being passed to.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN988">Access.log basics</H4
+ ><P
+ >The access.log file logs all incoming requests. chapter 11 covers the
+ fields in the access.log in detail.
+ The most important fields are the URL (field 7), and hierarchy access type
+ (field 9) fields. Note that a "-" indicates that there is no data for that
+ field.</P
+ ><P
+ >The following example access.log entries indicate the changes in log output
+ when connecting to another server, without a cache, with a single parent,
+ and with multiple parents.</P
+ ><P
+ >Though fields are seperated by spaces, fields can contain sub-fields,
+ where a "/" indicates the split.</P
+ ><P
+ >When connecting directly to a destination server, field 9 contains two
+ subfields - the key word "DIRECT", followed by the name of the server that it
+ is connecting to. Access to local servers (on your network) should always
+ be DIRECT, even if you have a firewall, as discussed in section 3.1.2. The
+ acl operator always_direct controls this behaviour.
+ 
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >905144366.259   1010 127.0.0.1 TCP_MISS/200 20868 GET http://www.squid-cache.com/ - DIRECT/www.squid-cache.com text/html</PRE
+ ></P
+ ><P
+ >When you have configured only one parent cache, the hierarchy access type
+ indicates this, and includes the name of that cache.
+ 
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >905144426.435    289 127.0.0.1 TCP_MISS/200 20868 GET http://www.squid-cache.com/ - SINGLE_PARENT/cache1.squid-cache.com text/html</PRE
+ ></P
+ ><P
+ >There are many more types that can appear in the hierarchy access information
+ field, but these are covered in chapter 11.</P
+ ><P
+ >Another useful field is the 'Log Tag' field, field four. In the following
+ example this is the field "TCP_MISS/200".
+ 
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >905225025.225    609 127.0.0.1 TCP_MISS/200 10089 GET http://www.is.co.za/ - DIRECT/www.is.co.za text/html</PRE
+ ></P
+ ><P
+ >A MISS indicates that the request was already stored in the cache (or that
+ the page contained headers indicating that the page was not to be cached).
+ A HIT would indicate that the page was already stored in the cache. In the
+ latter case the request time for a remote page should be substantially
+ less than the first occurence in the logs.</P
+ ><P
+ >The time that Squid took to service the request is the second field. This
+ value is in milliseconds. This value should approach that returned by
+ examining a client request, but given operating system buffering there is
+ likely to be a discrepancy.</P
+ ><P
+ >The fifth field is the size of the page returned to the client. Note that
+ an aborted request can end up downloading more than this from the origin
+ server if the quick_abort feature set is turned on in the Squid config file.</P
+ ><P
+ >Here is an example request direct from the origin server:
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >905230201.136   6642 127.0.0.1 TCP_MISS/200 20847 GET http://www.squid-cache.com/ - DIRECT/www.squid-cache.com text/html</PRE
+ ></P
+ ><P
+ >If we use client to fetch the page a short time later, a HIT is returned, 
+ and the time is reduced hugely.
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >905230209.899    151 127.0.0.1 TCP_HIT/200 20869 GET http://www.squid-cache.com/ - NONE/- text/html</PRE
+ >&#13;</P
+ ><P
+ >Some of you will have noticed that the size of the hit has increased
+ slightly. If you have checked the size of a request from the origin
+ server and compared it to that of the same page through the cache, you will
+ also note that the size of the returned data has increased very slightly.
+ Extra headers are added to pages passing through the cache, indicating which
+ peer the page was returned from (if applicable), age information and other
+ information. Clients never see this information, but it can be useful for
+ debugging.</P
+ ><P
+ >Since Squid 1.2 has support for HTTP/1.1, extra features can be used by
+ clients accessing a copy of a page that Squid already has. Certain extra
+ headers are included into the HTTP headers returned in HITS, indicating
+ support for features which are not available to clients when returning
+ MISSes. In the above example Squid has included a header in the page
+ indicating that range-request are supported.</P
+ ><P
+ >If Squid is performing correctly, you should shut Squid down and add it to
+ your startup files.</P
+ ><P
+ >Since Squid maintains an in-memory index of all objects in the cache, a
+ kill -9 could cause corruption, and should never be used. The correct way to
+ shutdown Squid is to use the command:
+ <PRE
+ CLASS="PROGRAMLISTING"
+ >	cache1:~ # ~squid/bin/squid -k shutdown</PRE
+ ></P
+ ><P
+ >Squid command-line options are covered in chapter 10.</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1013">Addition to Startup Files</H2
+ ><P
+ >The location of startup files vary from system to system. The location and
+ naming scheme of these files is beyond the scope of this book.</P
+ ><P
+ >If you already have a local startup file, it's a pretty good idea to simply
+ add the RunCache program to that file. Note that you should place RunCache
+ in the background on startup, which is normally done by placing an '&#38;'
+ after the command.
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1017"><P
+ ><B
+ >Example 4-5. Runcache command in the startup files</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >/usr/local/bin/RunCache &#38;</PRE
+ ></DIV
+ ></P
+ ><P
+ >The RunCache program attempts to restart Squid if it dies for some reason,
+ and logs basic Squid debug output both to the file
+ "/usr/local/squid/squid.out" and to syslog.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN1021">Chapter 5. Browser Configuration</H1
+ ><DIV
+ CLASS="SECT1"
+ ><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1023">Browsers</H2
+ ><P
+ >Squid is the server half of a client-server relationship. Though you have
+ configured Squid, your client (the browser) is still configured to talk to
+ the menagerie of servers that make up the Internet.</P
+ ><P
+ >You have already used the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >client</I
+ ></SPAN
+ > program included with Squid to test
+ that the cache is working. Browsers are more complicated to configure than
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >client</I
+ ></SPAN
+ >, especially since there are so many different types of
+ browser.</P
+ ><P
+ >This chapter covers the three most common browsers. It also includes
+ information on the proxy configuration of Unix tools, since you may wish to
+ use these for automatic download of pages. Once your browser is configured,
+ some of the proxy-oriented features of browsers are covered. Many browsers
+ allow you to force your cache server to reload the page, and have other
+ proxy-specific features.</P
+ ><P
+ >So that you can skip sections in this chapter that you don't need to read,
+ browsers are configured in the following order: Netscape Communicator,
+ Microsoft Internet Explorer, Opera and finally Unix Clients.</P
+ ><P
+ >You can configure most browsers in more than one way. The first method is
+ the simplest for a sysadmin, the second is simplest for the user. Since
+ this book is written for system administrators, we term the first
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >basic configuration</I
+ ></SPAN
+ >, the second <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >advanced configuration</I
+ ></SPAN
+ >.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1034">Basic Configuration</H3
+ ><P
+ >In this mode, each browser is configured independently to the others. If
+ you need to change something about the server (the port that it accepts
+ requests on, for example), each browser will have to be reconfigured
+ manually: you will have to physically walk to it and change the setup. To
+ avoid caching intranet sites, you will have to add exclusions for each
+ intranet site.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1037">Advanced Configuration</H3
+ ><P
+ >In this mode, you will configure a so-called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >rule server</I
+ ></SPAN
+ >. Clients
+ connect to this server on startup, and download information on which proxy
+ server to talk to, and which URLs to retrieve from which proxy server.
+ Exclusion of intranet sites is handled centrally: so one change will update
+ all clients. If your organization is is large, or is growing, you should
+ use the auto-config option.</P
+ ><P
+ >Though this method is called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >auto-config</I
+ ></SPAN
+ >, it's not completely
+ automatic, since the user still has to enter a URL indicating the location
+ of the list of rules.
+ Advanced configuration has some advantages:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Changes to the proxy server are easy, since you only change the rule
+ server.</P
+ ></LI
+ ><LI
+ ><P
+ >A proxy server can be chosen based on destination machine name, destination
+ port and more. Since this list is maintained centrally, chances also only
+ have to be made once.</P
+ ></LI
+ ><LI
+ ><P
+ >Browser configuration is easy, instead of adding complicated lists of IP's, a
+ user simply has to type in a URL.</P
+ ></LI
+ ><LI
+ ><P
+ >Since it's easy to configure, users are more likely to use the cache.</P
+ ></LI
+ ></UL
+ ><P
+ >&#13;When you write your list of rules (also called a proxy auto-config script),
+ you will still need to supply the client with the same information as with
+ the basic configuration, it's just that the list of this information is
+ maintained centrally. Even if you decide to use only autoconfig on your
+ network, you should probably work through the basic configuration first.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1054">Basic Configuration</H3
+ ><P
+ >To configure any browser, you need at least two pieces of information:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >The proxy server's host name</P
+ ></LI
+ ><LI
+ ><P
+ >The port that the proxy server is accepting requests on</P
+ ></LI
+ ></UL
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1062">Host name</H3
+ ><P
+ >It's very important to use a proxy specific host name. If you decide to
+ move the cache to another machine at a later stage you will find that it's
+ much easier to change DNS settings than to change the configuration of
+ every browser on your network.</P
+ ><P
+ >If your operating system supports IP aliases you should organize a dedicated
+ IP address for the cache server, and use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >tcp_incoming_address</I
+ ></SPAN
+ > and
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >tcp_outgoing_address</I
+ ></SPAN
+ > squid.conf options to make Squid only accept
+ incoming HTTP requests on that IP address.</P
+ ><P
+ >There isn't really a naming convention for caches, but people generally use
+ one of the following: <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache, proxy, www-proxy, www-cache</I
+ ></SPAN
+ >, or even the
+ name of the product they are using; <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid, netapp, netscape</I
+ ></SPAN
+ >. Some
+ people also include the location of the cache, and configure people in a
+ region to talk to their local cache. More and more people are simply using
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache</I
+ ></SPAN
+ >, and it's the suggested name. If you wish to use regional
+ names, you can use something along the lines of
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >region.cache.domain.example</I
+ ></SPAN
+ >.</P
+ ><P
+ >Your choice of port has already been discussed. Have a look at
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >HTTP:port</I
+ ></SPAN
+ > in the index for more information.</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1075">Netscape Communicator 4.5</H4
+ ><P
+ >(? Screen shots here ?)
+ <A
+ NAME="AEN1078"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >Select&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Edit</I
+ ></SPAN
+ >&nbsp;menu<br>
+ Select&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Preferences</I
+ ></SPAN
+ ><br>
+ Maximize&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Advanced</I
+ ></SPAN
+ ><br>
+ Select&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Proxies</I
+ ></SPAN
+ ><br>
+ Choose&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Manual proxy configuration</I
+ ></SPAN
+ ><br>
+ Click&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >View...</I
+ ></SPAN
+ >&nbsp;button</P
+ ></BLOCKQUOTE
+ >
+ For each of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >FTP Proxy, Gopher Proxy, HTTP Proxy, Security Proxy</I
+ ></SPAN
+ >,
+ enter the hostname of your cache on the left, and the chosen http_port on the
+ right. Squid can function as a WAIS proxy when it has a WAIS relay (see
+ the tags <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >wais_relay_host</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >wais_relay_port</I
+ ></SPAN
+ > in chapter 10 for
+ more information).</P
+ ><P
+ >If you have an intranet server, you can enter the host name in the box
+ titled "No Proxy for". If you wish to add more than one server, simply use
+ a comma to separate the entries.</P
+ ><P
+ >Since you are going to be accessing a large cache server, the disk space
+ allocated for the browsers cache is disk space that could be used for
+ something else. It's worth having some disk space allocated to the
+ browsers' cache, especially if the cache is across a serial line. Modem
+ users, for example, should keep their cache settings as is.
+ <A
+ NAME="AEN1091"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >Select&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Edit</I
+ ></SPAN
+ >&nbsp;menu<br>
+ Select&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Preferences</I
+ ></SPAN
+ ><br>
+ Maximize&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Advanced</I
+ ></SPAN
+ ><br>
+ Select&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Cache</I
+ ></SPAN
+ ><br>
+ Change&nbsp;the&nbsp;text&nbsp;in&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Disk Cache</I
+ ></SPAN
+ >&nbsp;box&nbsp;to&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >1000</I
+ ></SPAN
+ ></P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1099">Internet Explorer 4.0</H4
+ ><P
+ >Select the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >View</I
+ ></SPAN
+ > menu option
+ Select <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Internet Options</I
+ ></SPAN
+ >
+ Click on the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Connection</I
+ ></SPAN
+ > tab
+ Select <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Access the Internet using a proxy server</I
+ ></SPAN
+ >
+ Type in your hostname in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Address:</I
+ ></SPAN
+ > field, and your chosen port in
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Port:</I
+ ></SPAN
+ > field.
+ Internet Explorer can attempt to connect directly to the destination server
+ if the URL you are going to is in the local domain (? I presume ?). You
+ should turn this option on, so that local accesses are not cached, and do
+ not pass through the cache server. If you have more than one domain, you
+ will have to specifically change options so that all your domains are
+ ignored, using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Advanced</I
+ ></SPAN
+ > button.</P
+ ><P
+ >In the advanced menu, you can configure per-protocol cache server/port
+ pairs, or you can type in only the first proxy/port pair, and select
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Use the same proxy for all protocols</I
+ ></SPAN
+ >. Although Squid doesn't normally work
+ with SOCKS, it's rarely used, so you can probably use the same proxy for
+ all protocols.</P
+ ><P
+ >The main advantage of using the Advanced menu is the ability to specify
+ which domains are to be connected to directly, rather than through the
+ proxy server. If all your local sites' hostnames begin with <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >intranet</I
+ ></SPAN
+ >,
+ you can simply put that into the box titled <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Do not use proxy for addresses beginning with</I
+ ></SPAN
+ >. You can add more than one exception by using a
+ semicolon (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >;</I
+ ></SPAN
+ >) between entries.</P
+ ><P
+ >You will probably wish to exclude all local sites too. Since the exception
+ list allows you to use a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >*</I
+ ></SPAN
+ > character for what is known as a wildcard
+ match, you can add <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >*.localdomain.example</I
+ ></SPAN
+ >, and all hosts in your
+ domain will be accessed directly. Many people access local sites by IP
+ address, rather than by name. Since the exception list matches against the
+ URL (??) these will still pass through the cache, and you will need to add
+ an IP address range to the list of hosts to exclude: <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >192.168.0.*</I
+ ></SPAN
+ >
+ should do nicely.</P
+ ><P
+ >To reduce the local browser cache space (as discussed in the Netscape
+ section in the previous section):
+ <A
+ NAME="AEN1120"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ ><SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >View</I
+ ></SPAN
+ ><br>
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Options</I
+ ></SPAN
+ ><br>
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >General</I
+ ></SPAN
+ ><br>
+ In&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Temporary Internet files section</I
+ ></SPAN
+ >,&nbsp;click&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Settings</I
+ ></SPAN
+ ><br>
+ button.<br>
+ Move&nbsp;the&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >slider</I
+ ></SPAN
+ >&nbsp;all&nbsp;the&nbsp;way&nbsp;to&nbsp;the&nbsp;left.</P
+ ></BLOCKQUOTE
+ >
+ Since Squid-2.0 and above handle HTTP/1.1 correctly, you should also
+ configure Internet Explorer to use HTTP/1.1 when communicating with the
+ proxy server:
+ <A
+ NAME="AEN1128"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ ><SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >View</I
+ ></SPAN
+ ><br>
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Internet Options</I
+ ></SPAN
+ ><br>
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Advanced</I
+ ></SPAN
+ >&nbsp;tab<br>
+ Scroll&nbsp;down&nbsp;until&nbsp;you&nbsp;see&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >HTTP 1.1 Settings</I
+ ></SPAN
+ ><br>
+ Tick&nbsp;<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Use HTTP 1.1 through proxy server</I
+ ></SPAN
+ ></P
+ ></BLOCKQUOTE
+ >
+ (? I believe that opera is the third most common browser ?)
+ (? I don't have a machine with it on... since I run Linux?)</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1135">Unix clients</H4
+ ><P
+ >Most Unix client programs use a single environment variable to decide how
+ they are to access the Internet. If you run lynx (a terminal-based
+ browser) on any of your machines, or use the recursive web-spider wget, you
+ can simply set a shell variable and these programs will use the correct
+ proxy server.</P
+ ><P
+ >Each protocol has a different environmental variable, so that you can
+ configure your client to use a different proxy for each protocol. Each
+ protocol simply has the text <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >_proxy</I
+ ></SPAN
+ > tagged onto the end, so some of
+ the most common protocols end up as follows:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >http_proxy</P
+ ></LI
+ ><LI
+ ><P
+ >ftp_proxy</P
+ ></LI
+ ><LI
+ ><P
+ >gopher_proxy</P
+ ></LI
+ ></UL
+ ><P
+ ></P
+ ><P
+ >Since many people prefer a shell other than bash, we make an exception to
+ our rule that "all examples are based on sh" here.</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >sh. </B
+ >The Bourne Shell (or Bash, the freeware alternative) 
+ <A
+ NAME="AEN1152"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >http_proxy=http://cache.domain.example:3128/<br>
+ export&nbsp;http_proxy<br>
+ OR<br>
+ ftp_proxy=http://cache.domain.example:3128/<br>
+ export&nbsp;ftp_proxy</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >tcsh. </B
+ >The C Shell
+ <A
+ NAME="AEN1157"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >setenv&nbsp;http_proxy&nbsp;http://cache.domain.example:3128/<br>
+ OR<br>
+ setenv&nbsp;ftp_proxy&nbsp;http://cache.domain.example:3128/</P
+ ></BLOCKQUOTE
+ >
+ (? ksh, others ?)</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1159">Browser-cache Interaction</H2
+ ><P
+ >The Internet is a transient place, and at some stage a server that does not
+ correctly handle caching will be found. You can easily add the server to
+ the appropriate <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >do not cache</I
+ ></SPAN
+ > lists, but most browsers give users a way of
+ forcing a web page reload.</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Netscape Communicator. </B
+ >Pressing the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Reload</I
+ ></SPAN
+ > button forces the cache server to reload the HTML
+ page that is being viewed. Holding down the
+ key and pressing <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Reload</I
+ ></SPAN
+ > forces a reload of all the objects on the
+ current page.</P
+ ></DIV
+ ><P
+ >page or graphic brings up a menu where you can select <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >reload</I
+ ></SPAN
+ >, which
+ forces a re-get of the page. If you right click in a frame, you can re-load
+ only the frame.</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Microsoft Internet Explorer 4. </B
+ >With Internet Explorer there is no difference between a reload and a
+ reload. A reload also does a different type of request, which essentially
+ checks if the cache considers the page to be <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >fresh</I
+ ></SPAN
+ >. If the refresh
+ rules on the cache are set to refresh in a long time, the page will
+ come from the cache, and will not be re-fetched from the origin server.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Lynx. </B
+ >Pressing
+ will force a reload of the page.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1177">Testing the Cache</H2
+ ><P
+ >As you can see, pressing reload in Netscape (and some other browsers)
+ doesn't simply re-fetch the page, it forces the cache not to serve the
+ cached page. Many people doing tests of how the cache increases performance
+ simply press reload, and believe that there has been no change in speed.
+ The cache is, in fact, re-downloading the page from the origin server, so a
+ speed increase is impossible.</P
+ ><P
+ >To test the cache properly you need two machines setup to access the cache,
+ and a page that does not contain <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >do not cache me</I
+ ></SPAN
+ > headers. Pages that
+ use ASP often include headers that force Squid not to cache the page, even
+ if the authors are not aware of it's implications.</P
+ ><P
+ >So, to test the cache, choose a site that is off your local network (for a
+ marked change, choose one in a different country) and access it from the
+ first machine. Once it has download, change to the second machine and
+ re-download the page. Once the page has downloaded there, check that the
+ page is marked as a 'HIT' (in the file called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >access.log</I
+ ></SPAN
+ > - the basics of
+ which are covered earlier in this book). If the second accesses were marked
+ as misses, it is probably because the origin server is asking Squid not to
+ cache the page. Try a different page and see difference the cache makes to
+ browsing speed.</P
+ ><P
+ >Many people are looking for an increase in performance on problem pages,
+ since this is when people believe that they are getting the short end of
+ the stick. If you choose a site that is too close, you may only be able to
+ see a difference in the speed in the transaction-time field of the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >access.log</I
+ ></SPAN
+ >.</P
+ ><P
+ >Since you have a completely unloaded cache, you should access a local,
+ unloaded web server a few times, and see what kind of latency you
+ experience with the cache. If you have time, print out some of the access
+ log entries. If, some time in the future, you are unsure as to the cache
+ load, you can compare the latency added now to the latency added by the
+ same cache later on; if there is a difference you know it's time to upgrade
+ the cache.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1187">Cache Auto-config</H2
+ ><P
+ >Client browsers can have all options configured manually, or they can be
+ configured to download a autoconfig file (every time the startup), which
+ provides all of the information about your cache setup.</P
+ ><P
+ >Each URL referenced (be it the URL that
+ you typed, or the URL for a graphic on the page yet to be retrieved) is
+ checked against the list of rules. You should keep the list of rules as
+ short as possible, otherwise you could end up slowing down page loads - not
+ at the cache level, but at the browser.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1191">Web server config changes for autoconfig files</H3
+ ><P
+ >The original Netscape documentation for the <A
+ HREF="http://home.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html"
+ TARGET="_top"
+ ><I
+ CLASS="CITETITLE"
+ >proxy autoconfig file</I
+ ></A
+ >
+ suggested the filename <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proxy.pac</I
+ ></SPAN
+ > for Proxy
+ AutoConfig files. Since it's possible to have a file ending in
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.pac</I
+ ></SPAN
+ > that is not used for autoconfiguration,
+ browsers require a server returning an autoconfig file to indicate so
+ in the mime type. Most web servers do not automatically recognize
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.pac</I
+ ></SPAN
+ > extension as a proxy-autoconfig
+ file, and have to be reconfigured to return the correct mime type
+ (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >application/x-ns-proxy-autoconfig</I
+ ></SPAN
+ >).  </P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1200">Apache</H4
+ ><P
+ >On some systems Apache already defines the autoconfig mime type.
+ The Apache config file <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mime.types</I
+ ></SPAN
+ > is used to associate filename
+ extensions with mime types. This file is normally stored in the apache
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >conf</I
+ ></SPAN
+ > directory. This directory also contains the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >access.conf</I
+ ></SPAN
+ >
+ and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >httpd.conf</I
+ ></SPAN
+ > files, which you may be more familiar with editing.
+ As you can probalby see, the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mime.types</I
+ ></SPAN
+ > file consists of two fields:
+ a mime type on the left, the associated filename extension on the right.
+ Since this file is only read at startup or reconfigure, you will need to
+ send a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >HUP</I
+ ></SPAN
+ > signal to the parent apache process for your changes to
+ take affect. The following line should be added to the file, assuming that
+ it is not already included:
+ <A
+ NAME="AEN1209"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >application/x-ns-proxy-autoconfig&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;pac</P
+ ></BLOCKQUOTE
+ >
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1211"><P
+ ><B
+ >Example 5-1. Restarting Apache</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cd /usr/local/lib/httpd/logs
+ kill -HUP `cat httpd.pid`</PRE
+ ></DIV
+ >&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1214">Internet Information Server</H4
+ ><P
+ >(?nothing here yet?)</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1217">Netscape</H4
+ ><P
+ >(? or here ?)</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1220">Autoconfig Script Coding</H3
+ ><P
+ >The autoconfig file is actually a Java function, put in a file and served
+ by your standard web server program. Don't panic if you don't know Java,
+ since this section acts as a cookbook. Besides: the basic structure of the
+ Java language is quite easy to get the hang of, especially if you have
+ previous programming experience, whether it be in C, Pascal or Perl.</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1223">The Hello World! of auto-configuration scripts</H4
+ ><P
+ >If you have learned a programming language, you probably remember one of
+ the most basic programs simply printing the phrase <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Hello World!</I
+ ></SPAN
+ >.
+ We don't want to print anything when someone tries to go to a page, but
+ the following example is similar to the original <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Hello World</I
+ ></SPAN
+ > program
+ in that it's the shortest piece of code that does something useful.</P
+ ><P
+ >The following simply connects direct to the origin server for every
+ URL, just as it would if you had no proxy-cache configured at all.</P
+ ><P
+ ></P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1230"><P
+ ><B
+ >Example 5-2. A very basic autoconfig file</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >function FindProxyForURL(url, host) {
+ 	return DIRECT;
+ }</PRE
+ ></DIV
+ ><P
+ ></P
+ ><P
+ >The next example gets the browser to connect to the cache server named
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache.domain.example</I
+ ></SPAN
+ > on port <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >3128</I
+ ></SPAN
+ >. If the machine is down for
+ some reason, an error message will be returned to the user.</P
+ ><P
+ ></P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1238"><P
+ ><B
+ >Example 5-3. Connecting to a cache server</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >function FindProxyForURL(url, host) {
+ 	return "PROXY cache.domain.example:3128";
+ }</PRE
+ ></DIV
+ ><P
+ ></P
+ ><P
+ ></P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1243"><P
+ ><B
+ >Example 5-4. Connecting to a cache server, with failover</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >function FindProxyForURL(url, host) {
+ 	return "PROXY cache.domain.example:3128; DIRECT";
+ }</PRE
+ ></DIV
+ ><P
+ >As you may be able to guess from the above, returning text with a semicolon
+ (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >;</I
+ ></SPAN
+ >) splits the answer returned into two sub-strings. If the first
+ cache server is unavailable, the second will be tried. This provides you
+ with a failover mechanism: you can attempt a local proxy server first and,
+ if it is down, try another proxy. If all are down, a direct attempt will be
+ made. After a short period of time, the proxy will be retried.</P
+ ><P
+ >A third return type is included, for <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >SOCKS</I
+ ></SPAN
+ > proxies, and is in the
+ same format as the HTTP type:
+ <A
+ NAME="AEN1250"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >return&nbsp;"SOCKS&nbsp;socks.domain.example:3128";</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >If you have no intranet, and require no exclusions, you should use the
+ above autoconfig file. Configuring machines with above autoconfig file allows
+ you to add future required exclusions very easily.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1253">Auto-config functions</H4
+ ><P
+ >Web browsers include various built-in functions to make your autoconfig
+ coding as simple as possible. You don't have to write the code that does a
+ string match of the hostname, since you can use a standard function call to
+ do a match. Not all functions are covered here, since some of them are
+ very rarely used. You can find a complete list of autoconfig functions
+ (with examples) at the
+ <A
+ HREF="http://home.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html"
+ TARGET="_top"
+ > <I
+ CLASS="CITETITLE"
+ >proxy autoconfig file homepage</I
+ ></A
+ ></P
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1258">dnsDomainIs</H5
+ ><P
+ >Returns true if the first argument (normally specified as the variable
+ host, which is defined in the autoconfig function by default) is in the
+ domain specified in the second argument.
+ Checks if a host is in a domain.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1261"><P
+ ><B
+ >Example 5-5. dnsDomainIs</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if dnsDomainIs(host,".mydomain.example") {
+ 	return "DIRECT";
+ }</PRE
+ ></DIV
+ ><P
+ ></P
+ ><P
+ >You can check more than one domain by using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >||</I
+ ></SPAN
+ > Java operator.
+ Since this is a Java operator you can use the layout described in this
+ example in any combination.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1267"><P
+ ><B
+ >Example 5-6. Using multiple dnsDomainIs calls</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if (dnsDomainIs(host,".mydomain.example")||
+ 	dnsDomainIs(host,".anotherdomain.example")) {
+ 		return "DIRECT";
+ }</PRE
+ ></DIV
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1271">isInNet</H5
+ ><P
+ >Sometimes you will wish to check if a host is in your local IP address
+ range. To do this, the browser resolves the name to find the IP address.
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Do not</I
+ ></SPAN
+ > use more than one isInNet call if you can help it: each call
+ causes the browser to resolve the hostname all over again, which takes time.
+ A string of these calls can reduce browser performance noticeably.</P
+ ><P
+ >The isInNet function takes three arguments: the hostname, and a
+ subnet/netmask pair.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1276"><P
+ ><B
+ >Example 5-7. using the isInNet call</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if isInNet(host, "192.168.0.0", "255.255.0.0") {
+ 	return "DIRECT";
+ }</PRE
+ ></DIV
+ ><P
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1280">isPlainHostname</H5
+ ><P
+ >Simply checks that there is no full-stop in the hostname (the only argument
+ for this call). Many people refer
+ to local machines simply by hostname, since the resolver library will
+ automatically attempt to look up <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >host.domain.example</I
+ ></SPAN
+ > if you simply
+ attempt to connect to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >host</I
+ ></SPAN
+ >. For example: typing <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >www</I
+ ></SPAN
+ > in your
+ browser should bring up your web site.</P
+ ><P
+ >Many people connect to internal web servers (such as one sitting on their
+ co-worker's desk) by typing in the hostname of the machine. These
+ connections should not pass through the cache server, so many people use a
+ function like the following:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1287"><P
+ ><B
+ >Example 5-8. using isPlainHostName to decide if the connection should be direct</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if isPlainHostName(host) {
+ 	return "DIRECT";
+ } else {
+ 	return "PROXY cache.mydomain.example:3128";
+ }</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1290">myIpAddress</H5
+ ><P
+ >Returns the IP address of the machine that the browser is running on,
+ requires no arguments.</P
+ ><P
+ >On a network with more than one cache, your script can use this information
+ to decide which cache to communicate with. In the next subsection we look at
+ different ways of communicating with a local proxy (with minimal manual user
+ intervention), so the example here is comparatively basic. The below
+ example assumes that you have more than two networks: one with a private
+ address range (10.0.0.*), the others with real IP addresses.</P
+ ><P
+ >If the client machine is in the private address range, it cannot connect
+ directly to the destination server, so if the cache is down for some reason
+ they cannot access the Internet. A machine with a real IP address, on the
+ other hand, should attempt to connect directly to the origin server if the
+ cache is down. (? need to check it will work too! ?).</P
+ ><P
+ >Since myIpAddress requires no arguments, we can simply place it in where we
+ would have put <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >host</I
+ ></SPAN
+ > in the isInNet function call.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1297"><P
+ ><B
+ >Example 5-9. myIpAddress</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if (isInNet(myIpAddress, "10.0.0.0", "255.255.255.0")) {
+ 	return "PROXY cache.mydomain.example:3128";
+ } else {
+ 	return "DIRECT";
+ }</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1300">shExpMatch</H5
+ ><P
+ >The shExpMatch function accepts two arguments: a string and a shell
+ expression. Shell expressions are similar to regular expressions, though
+ are more limited. This function is often used to check if the url or
+ host variables have a specific word in them.</P
+ ><P
+ >If you are configuring a ISP-wide script, this function can be quite
+ useful. Since you do not know if a customer will call their machine
+ "intranet" or "intra" or "admin", you can chain many shExpMatch checks
+ together. Note that in the below example uses a single "intra*" shell
+ expression to match both "intranet" and "intra.mydomain.example".</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1304"><P
+ ><B
+ >Example 5-10. shExpMatch</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if (shExpMatch(host, "intra*")||
+ 	shExpMatch(host, "admin*")) {
+ 		return "DIRECT";
+ } else {
+ 		return "PROXY cache.mydomain.example:3128";
+ }</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1307">url.substring</H5
+ ><P
+ >This function doesn't take the same form as those described above.
+ Since Squid does not support all possible protocols, you need a way of
+ comparing the first few characters of the destination URL with the list of
+ possible protocols. The function has two arguments. The first is a starting
+ position, the second the number of characters to retrieve. Note that (like C),
+ string start at position 0, rather than at 1.</P
+ ><P
+ >All of this is best demonstrated with an example. The following attempts to
+ connect to the cache for the most common URL types (http, ftp and gopher),
+ but attempts to go directly for protocols that Squid doesn't recognize.</P
+ ><P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1312"><P
+ ><B
+ >Example 5-11. url.substring</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >if (url.substring(0, 5) == "http:" ||
+ 	url.substring(0, 4) == "ftp:"||
+ 	url.substring(0, 7) == "gopher:")
+ 		return "PROXY cache.is.co.za:8080; DIRECT";
+ else
+ 	return "DIRECT";</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1315">Example autoconfig files</H4
+ ><P
+ >The main reason that autoconfig files were invented was the sheer number of
+ possible cache setups. It's difficult (or even impossible) to represent all
+ of the possible combinations that a autoconfig file can provide you with.</P
+ ><P
+ >There is no config file that will work for everyone, so a couple of config files
+ are included here, one of which should suit your setup.</P
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1319">A Small Organization</H5
+ ><P
+ >A small organization is the easiest to create an autoconfig file for. Since
+ you will have a moderately small number of IP addresses you can use the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >isInNet</I
+ ></SPAN
+ > function to discover if the destination host is local or not
+ (a large organization, such as an ISP would need a very long autoconfig file
+ simply because they have many IP address ranges). </P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1323"><P
+ ><B
+ >Example 5-12. A small organization's proxy config file</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >function FindProxyForURL(url, host) {
+ 	// We only have one network range, and one DNS request doesn't
+ 	// mean a large slowdown
+ 	if (isInNet(host, "196.4.160.0", "255.255.255.0"))
+ 			return DIRECT;
+ 	// If it's not local, use the cache server, with automatic
+ 	// connection to the outside in case of problems
+ 	return "PROXY cache.domain.example:3128; DIRECT"
+ }</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1326">A Dialup ISP</H5
+ ><P
+ >Since dialup customers don't have intranet systems, a dialup ISP would have
+ a very straight forward config file. If you wish your customers to connect
+ directly to your web server (why waste the disk space of a cache when you
+ have the origin server rack-mounted above it), you should use the
+ dnsDomainIs function:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1329"><P
+ ><B
+ >Example 5-13. Dialup ISP autoconfig file</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >function FindProxyForURL(url, host) {
+ 	// For servers in the local domain, go direct
+ 	if dnsDomainIs(host, "mydomain.example")
+ 		return "DIRECT";
+ 	// Otherwise go through the cache server, with fail-over
+ 	return "PROXY cache.mydomain.example:3128; DIRECT";
+ }</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1332">Leased Line ISP</H5
+ ><P
+ >When you are providing a public service, you have no control over what your
+ customers call their machines. You have to handle the generic names (like
+ intranet) and hope that people name their machines according to the
+ de-facto standards.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1335"><P
+ ><B
+ >Example 5-14. </B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >function FindProxyForURL(url, host) {
+ 	// so that people can type just "intranet" or just "mypc"
+ 	if isPlainHostName(host)
+ 		return "DIRECT";
+ 	
+ 	// For servers in our domain, go direct: for announcements etc
+ 	if dnsDomainIs(host, "mydomain.example")
+ 		return "DIRECT";
+ 	// since there are many domains, we cannot do them all. We assume
+ 	// that people are going to type "intranet" instead of
+ 	// "intranet.customerdomain.example"
+ 	return "PROXY cache.mydomain.example:3128; DIRECT";</PRE
+ ></DIV
+ ><P
+ >(? I need some info on ieak - waiting for people here?)</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1339">Super Proxy Script</H3
+ ><P
+ >Many large ISPs will have more than one cache server. To avoid duplicating
+ objects, these cache servers have to communicate with one another. Consider
+ the following;</P
+ ><P
+ >cache1 gets a request for an object. It caches the page, and stores it on
+ disk. An hour or so later, cache2 gets a request for the same page. To find
+ a local copy of the object, cache2 has to query the other caches. Add more
+ and more caches, and your number of queries goes up.</P
+ ><P
+ >If an incoming request for a specific URL only ever went to one cache, your
+ caches would not need to communicate with one another. A client requesting
+ the page <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http://www.qualica.com/</I
+ ></SPAN
+ > would always connect to cache1.</P
+ ><P
+ >Let's assume that you have 5 caches. Splitting the Internet into five
+ pieces would split the load across the caches almost evenly. How do you
+ split though? By destination IP address? No, since IP's like 19?.*.*.* are
+ much more common than "5.*.*.*". By domain? No again, since one domain like
+ microsoft.com would mean that you were distributing load incorrectly.</P
+ ><P
+ >Some of you will know what a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >hash function</I
+ ></SPAN
+ >
+ is. If not, don't panic: you can still use the Super Proxy script
+ without knowing the theoretical basis of the algorithms involved.</P
+ ><P
+ >The Super Proxy Script allows you to split up the Internet by URL
+ (the combination of hostname, path and filename). If you have 5 cache
+ servers, you split up the domain of possible answers into 5 parts. (A
+ hash function returns a number, so we are using the appropriate
+ terms - a domain is not an Internet domain in this context). With a
+ good hashing function, the numbers returned are going to be spread
+ across the 5 parts evenly, which spreads your load perfectly.</P
+ ><P
+ >If you have a cache which is twice as powerful as your others, you can
+ allocate it more of the domain, and put more load on it.</P
+ ><P
+ >Carp is used by some cache servers (most notably Microsoft
+ Proxy and Squid) to decide which parent cache to send a request
+ too. Browsers can also use CARP to decide which cache to talk
+ to, using a java auto-config script.  For more information
+ (and an example Java script), you should look at the <A
+ HREF="http://naragw.sharp.co.jp/sps/"
+ TARGET="_top"
+ > <I
+ CLASS="CITETITLE"
+ >Super Proxy
+ Script</I
+ ></A
+ > web page.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1353">cgi generated autoconfig files</H2
+ ><P
+ >It is possible to associate the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.pac</I
+ ></SPAN
+ > extension with a cgi program on
+ most web servers. A program could then generate an autoconfig script
+ depending on the source address of the request. Since the autconfig file is
+ only loaded on startup (or when the autoconfig refresh button is pressed)
+ the slight delay due to a cgi program would not be noticeable to the user.
+ Most large ISPs allocate subnets to regions, so a browser could be
+ configured to access the nearest cache by looking at the source address of
+ the request to the cgi program.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1357">Future directions</H2
+ ><P
+ >There has recently been a move towards a standard for the automatic
+ configuration of proxy-caches. New versions of Netscape and Internet
+ Explorer are expected to use the new <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >unknown</I
+ ></SPAN
+ > standard to
+ 
+ automatically change their proxy settings. This allows you to
+ manipulate your cache server settings without inconveniencing clients.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1362">Roaming</H3
+ ><P
+ >Roaming customers have to remove their configured caches, since your access
+ control lists should stop them accessing your cache from another network.</P
+ ><P
+ >Although both problems can be reduced by the cgi-generated configs (discussed
+ above) a firewall between the browser and your cgi server would still mean
+ that roaming users cannot access the Internet.&#13;</P
+ ><P
+ >There are changes on the horizon that would help. As more and more
+ protocols take roaming users into account, standards will evolve that make
+ Internet usage plug-and-play. If you are in Tanzania today, plug in your
+ modem and use the Internet. If you are in France in a weeks time, plug in
+ again and (without config changes) you will be ready to go.</P
+ ><P
+ >Progress on standards for autoconfiguration of Internet applications is
+ underway, which will allow administrators to specify config files depending
+ on where a user connects from without something like the cgi kludge above.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1369">Browsers</H3
+ ><P
+ >Browser support for CARP is not at the stage where it is tremendously
+ useful: once there is a proper standard for setup, it's likely to be
+ included into the main browsers.</P
+ ><P
+ >At some stage, expect support for ICP and cache-digests in browsers. The
+ browser will then be able to make intelligent decisions as to which cache
+ to talk to. Since ICP requests are efficient, a browser could send requests
+ for each of the links on a page once it has retrieved the HTML source.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1373">Transparency</H3
+ ><P
+ >Currently there is a major trend towards transparent caching, not only in
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >"Outer Internet"</I
+ ></SPAN
+ > (where bandwidth is very expensive), but in the
+ USA. (Transparency is covered in detail in chapter 12.)</P
+ ><P
+ >Transparency has one major advantage: Users do not have to configure their
+ browsers to access the cache.</P
+ ><P
+ >To backbone providers this means that they can cache all passing traffic. A
+ local ISP would configure their clients to talk to their cache; a backbone
+ provider could then ask their ISP clients to use theirs as parents,
+ but transparent caching has another advantage.</P
+ ><P
+ >A backbone provider is acting as transit for requests that originate on
+ other backbone provider's networks. With transparency, a backbone
+ provider reduces this traffic as well as requests from their network to
+ other backbone providers.</P
+ ><P
+ >Assume you place a cache the hop before a major peering point. Here the
+ cache intercepts both incoming requests (from other providers <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >to</I
+ ></SPAN
+ > web
+ servers on your network) and outgoing (from your network <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >to</I
+ ></SPAN
+ > web
+ servers on other provider's networks).
+ This will reduce your peering-point usage (by caching outgoing requets for
+ pages), and will also reduce the money you spend on other people's
+ customers: since you reduce the cost it takes for data to flow <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >out</I
+ ></SPAN
+ > of
+ your network. The latter cost may be minimal, but in times of network trouble
+ it can reduce your latency noticibly.</P
+ ><P
+ >As more and more backbone providers cache pages, more local ISPs will
+ cache ("since it's cached further along the path, we may as well implement
+ caching here - it's not going to change anything"). Though this will
+ probably cause a drop in the hit rate of the backbone providers, their
+ ever increasing user-base may make up for it. Backbone providers are
+ caching centrally - with large numbers of edge caches (local ISP caches),
+ they are likely to see fewer hits. Certain Inter-University networks have
+ already noticed such a hit rate decline. As more and more universities add
+ local caches, their hit rate falls.</P
+ ><P
+ >Since the Universities are large, it's likely that their users will surf
+ the same web page twice. Previously the Inter-University network would have
+ returned the hit for that page, now the University's local cache does; this
+ reduces the edge-cache's number of queries, and hence it's hit rate.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1386">Ready to Go</H2
+ ><P
+ >If all has gone well, you should be ready to use your cache, at least on a
+ trial basis. People around your office or division can now be configured to
+ use the cache, and once you are happy with it's performance and stability, you
+ can make it a proper service.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN1389">Chapter 6. Access Control and Access Control Operators</H1
+ ><P
+ >Access control lists (acls) are often the most difficult part of the
+ configuration of a Squid cache: the layout and concept is not immediately
+ obvious to most people. Hang on to your hat!</P
+ ><P
+ >Unless chapter 3 is still fresh in your mind, you may wish to skip back
+ and review the access control section of that chapter before you continue.
+ This chapter assumes that you understood the difference between an acl and
+ an acl-operator.</P
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1393">Uses of ACLs</H2
+ ><P
+ >The primary use of the acl system is to implement simple access control: to
+ stop other people using your cache infrastructure. (There are other uses of
+ acls, described later in this chapter; in the meantime we are going to
+ discuss only the access control function of acls.) Most people implement
+ only very basic access control, denying access to people that are not on
+ their network. Squid's access system is incredibly flexible, but 99% of
+ administrators only use the most basic elements. In this chapter some
+ examples of the less common uses of acls are covered: hopefully you will
+ discover some Squid feature which suits your organization - and which
+ you didn't think was part of Squid before.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1396">Access Classes and Operators</H2
+ ><P
+ >There are two elements to access control: <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >classes</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >operators</I
+ ></SPAN
+ >.
+ Classes are defined with the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >acl</I
+ ></SPAN
+ > squid.conf tag, while
+ the names of the operators vary: the most common operator used is
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http_access</I
+ ></SPAN
+ >.</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Classes. </B
+ >A class normally refers to a set of users. (A class can also refer to a
+ list of destination domains, filename extensions and more, but for now
+ let's start with the basics!). If you have 50 people that are allowed
+ Internet access, you could put all of their IP addresses in a list,
+ and use that list as a "class of IP addresses that have Internet access".</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Operators. </B
+ >It's often useful to use one set of ACLs for ICP and another for
+ HTTP. This way you can apply different sets of rules for different
+ protocols; this comes in very useful when you have a number of peering
+ arrangements. Most ISP's do not want their caches to be SNMP-queried by
+ all of their customers: they do, however, want all their customers to
+ have access to browser access. In short, you want one set of acls to
+ apply to HTTP traffic, another to apply to SNMP - and that's exactly what
+ you get. For each protocol there is a different acl-operator, examples
+ include the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http_access</I
+ ></SPAN
+ >, <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >icp_access</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >snmp_access</I
+ ></SPAN
+ > tags.
+ It's very important to note that there
+ is a not an <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ftp_access</I
+ ></SPAN
+ > type. FTP requests are passed to the cache
+ using the HTTP format (it's just a different format URL that gets sent to
+ the cache server). The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proto</I
+ ></SPAN
+ > acl type (discussed shortly, with
+ examples!) allows you to deny access to the cache if it's FTP, HTTP, SSL
+ etc.</P
+ ></DIV
+ ><P
+ >Let's work through the below example line-by-line. Here, a systema
+ administrator is in the process of installing a cache, and doesn't want
+ other staff to access it while it's being installed, since it's likely to
+ ping-pong up and down during the installation. Once the administrator is
+ happy with the config, the whole network will be allowed access. The
+ admin's PC is at the IP 10.0.0.3.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1415"><P
+ ><B
+ >Example 6-1. Explicit allow, explicit deny (do not use this!, see later text for reasons)</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myIP src 10.0.0.3/255.255.255.255
+ acl myNet src 10.0.0.0/255.255.0.0
+ http_access allow myIP
+ http_access deny myNet</PRE
+ ></DIV
+ ><P
+ >If the admin connects to the cache from the PC, Squid does the following:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Accepts the (HTTP) connection and reads the request</P
+ ></LI
+ ><LI
+ ><P
+ >Checks the line that reads <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http_access allow myIP</I
+ ></SPAN
+ >.</P
+ ></LI
+ ><LI
+ ><P
+ >Since your IP address matches the IP defined in the myIP acl, access is
+ allowed. Remember that Squid drops out of the operator list on the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >first</I
+ ></SPAN
+ > match.</P
+ ></LI
+ ></UL
+ ><P
+ >If you connect from a different PC (on the 10.0.*.* network) things
+ are very similar:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Accepts the connection and reads the request</P
+ ></LI
+ ><LI
+ ><P
+ >The source of the connection doesn't match the myIP acl, so the next
+ http_access line is checked.</P
+ ></LI
+ ><LI
+ ><P
+ >The myNet acl matches the source of the connection, so access is denied. An
+ error page is returned to the user instead of the requested page.</P
+ ></LI
+ ></UL
+ ><P
+ >If someone reaches your cache from another netblock (from, say,
+ 192.168.*.*), the above access list will not block access. The reason for
+ this is quite complicated.
+ If Squid
+ works through a set of acl-operators and finds no match, it defaults to
+ using the opposite of the last match (if the previous operator is an allow,
+ the default is to deny; if it's a deny, the default is to allow). This
+ seems a bit strange at first, but let's look at an example where this
+ behaviour is used: it's more sensible than it seems.</P
+ ><P
+ >The following acl example is nice and simple: it's something a first-time
+ cache admin could create.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1438"><P
+ ><B
+ >Example 6-2. Only an allow acl-operator</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.0.0
+ http_access allow myNet</PRE
+ ></DIV
+ ><P
+ >A config file with no access lists will allow cache access without any
+ restrictions. An administrator using the above access lists obviously
+ wishes to allow only his network access to the cache. Given the Squid
+ behavior of inverting the last decision, we have an invisible line reading
+ <A
+ NAME="AEN1442"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >http_access&nbsp;deny&nbsp;all</P
+ ></BLOCKQUOTE
+ >
+ Inverting the last decision is a simple (if not immediately obvious)
+ solution to one of the most common acl mistakes: not adding a final
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >deny all</I
+ ></SPAN
+ > to the end of your acl list.</P
+ ><P
+ >With this new knowledge, have a look at the first example in this chapter:
+ you will see why I said not to use it in your configs. Given that the
+ last operator denies the local network, local people will not be able
+ to access the cache. The remainder of the Internet, however, will! 
+ As discussed in chapter 1, the simplest way of creating a catch-all acl
+ is to match requests when they come from any IP address. When programs do
+ netmask arithmetic a subnet of all zeros will match any IP address. A
+ corrected version of the first example dispenses with the myNet acl.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1446"><P
+ ><B
+ >Example 6-3. Corrected example 6-1, explicit deny all</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myIP src 10.0.0.3/255.255.255.255
+ acl all src 0.0.0.0/0.0.0.0
+ http_access allow myIP
+ http_access deny all</PRE
+ ></DIV
+ ><P
+ >Once the cache is considered stable and is moved into production, the
+ config would change. http_access lines do add a very small amount of
+ overhead, but that's not the only reason to have simple access rulesets: the
+ less rulesets, the easier your setup is to understand. The below example
+ includes a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >deny all</I
+ ></SPAN
+ > rule although it doesn't really need one: you may
+ know of the automatic inversion of the last rule, but someone else working
+ on the cache may not.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1451"><P
+ ><B
+ >Example 6-4. Example 6-1 once the cache is considered stable</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.0.0
+ acl all src 0.0.0.0/0.0.0.0
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ><P
+ >You should always end your access lists with an explicit deny. In Squid-2.1
+ the default config file does this for you when you insert your HTTP acl
+ operators in the appropriate place.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1455">Acl lines</H2
+ ><P
+ >The Examples so far have given you an idea of an acl line's layout. Their
+ layout can be symbolized as follows (? Check! ?):
+ <A
+ NAME="AEN1458"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;name&nbsp;type&nbsp;(string|"filename")&nbsp;[string2]&nbsp;[string3]&nbsp;["filename2"]</P
+ ></BLOCKQUOTE
+ >
+ The acl tag consists of a minimum of three fields: a unique name; an
+ acl type and a decision string. An acl line can have more than one
+ decision string, hence the <B
+ CLASS="COMMAND"
+ >[string2]</B
+ > and <B
+ CLASS="COMMAND"
+ >[string3]</B
+ > in the
+ line above.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1462">A unique name</H3
+ ><P
+ >This is supposed to be descriptive. Use a name such as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >customers</I
+ ></SPAN
+ > or
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mynet</I
+ ></SPAN
+ >. You have seen this lots of times before: the word myNet in
+ the above example is one such case.</P
+ ><P
+ >There must only be one acl with a given name; if you find that you have two
+ or more classes with similar names, you can append a number to the name:
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >customer1</I
+ ></SPAN
+ >, <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >customer2</I
+ ></SPAN
+ > etc. I generally avoid this, instead
+ putting all similar data on these classes into a file, and including the
+ whole file as one acl. Check the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Decision String</I
+ ></SPAN
+ > section for
+ some more info on this.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1471">Type</H3
+ ><P
+ >So far we have discussed only acls that check the source IP address of the
+ connection. This isn't sufficient for many people: it may be useful
+ for you to allow connections at only certain times, or to only
+ specific domains, or by only some users (using usernames and passwords).
+ If you really want to, you can even combine all of the above: only allow
+ connections from users that have the right password, have the right
+ destination and are going to the right domain. There are quite a few
+ different acl types: the next section of this chapter discusses all of
+ the different types in detail. In the meantime, let's finish the
+ description of the structure of the acl line.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1474">Decision String</H3
+ ><P
+ >The acl code uses this string to check if the acl matches a given
+ connection. When using this field, Squid checks the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >type</I
+ ></SPAN
+ > field
+ of the acl line to decide how to use the decision string. The decision
+ string could be an IP address range, a regular expression or a list of
+ domains or more. In the next section (where we discuss the types of
+ acls available) we discuss the different forms of the Decision String.</P
+ ><P
+ >If you have another look at the formal definition of the acl line
+ above, you will note that you can have more than one decision string
+ per acl line. Strings in this format are <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >OR</I
+ ></SPAN
+ >d together; if you
+ were to specify two IP address ranges on the same line the return
+ result of the acl would be true if <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >either</I
+ ></SPAN
+ > of the IP addresses match.
+ (If source strings were <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >AND</I
+ ></SPAN
+ >d together, then an incoming request
+ would have to come from two IP address ranges at the same time. This
+ is not impossible, but would almost certainly be pointless.)</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1482"><P
+ ><B
+ >Example 6-5. Using multiple acl Decision Strings per line</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ ># This line will match requests from either address range: 
+ # 10.0.0.0/255.255.255.0 OR 10.1.0.0/255.255.255.0
+ acl myNets src 10.0.0.0/255.255.255.0 10.1.0.0/255.255.255.0
+ acl all src 0.0.0.0/0.0.0.0
+ http_access allow myNets
+ http_access deny all</PRE
+ ></DIV
+ ><P
+ >Large decision lists can be stored in files, so that your squid.conf
+ doesn't get cluttered. Some of the caches I have worked on have had
+ 
+ in the region of 2000 lines of acl rules, which could lead to a very
+ cluttered <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > file. You can include a file into the
+ decision section of an acl list by placing the filename (with path)
+ in double-quotes. The file simply contains the data set; one datum
+ per line. In the next example the file
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/conf/data/myNets</I
+ ></SPAN
+ > can contain any number of IP
+ ranges, one range per line.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1489"><P
+ ><B
+ >Example 6-6. </B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNets src "/usr/local/squid/conf/data/myNets"
+ acl all src 0.0.0.0/0.0.0.0
+ http_access allow myNets
+ http_access deny all</PRE
+ ></DIV
+ ><P
+ >While on the topic of long lists of acls: it's important to note that you
+ can end up slowing your cache response with very long lists of acls.
+ Checking acls requires CPU time, and long lists can decrease cache
+ performance, since instead of moving data to clients Squid is busy
+ checking access lists. What constitutes a long list? Don't worry about
+ lists with a few hundred entries unless you have a really slow or busy
+ CPU. Lists thousands of lines long can, however, cause problems.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1493">Types of acl</H3
+ ><P
+ >So far we have only spoken about acls that filter by source IP
+ address. There are numerous other acl types:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Source/Destination IP address</P
+ ></LI
+ ><LI
+ ><P
+ >Source/Destination Domain</P
+ ></LI
+ ><LI
+ ><P
+ >Regular Expression match of requested domain</P
+ ></LI
+ ><LI
+ ><P
+ >Words in the requested URL</P
+ ></LI
+ ><LI
+ ><P
+ >Words in the source or destination domain</P
+ ></LI
+ ><LI
+ ><P
+ >Current day/time</P
+ ></LI
+ ><LI
+ ><P
+ >Destination port</P
+ ></LI
+ ><LI
+ ><P
+ >Protocol (FTP, HTTP, SSL)</P
+ ></LI
+ ><LI
+ ><P
+ >Method (HTTP GET or HTTP POST)</P
+ ></LI
+ ><LI
+ ><P
+ >Browser type</P
+ ></LI
+ ><LI
+ ><P
+ >Name (according to the Ident protocol)</P
+ ></LI
+ ><LI
+ ><P
+ >Autonomous System (AS) number</P
+ ></LI
+ ><LI
+ ><P
+ >Username/Password pair</P
+ ></LI
+ ><LI
+ ><P
+ >SNMP Community</P
+ ></LI
+ ></UL
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1525">Source/Destination IP address</H4
+ ><P
+ >In the examples earlier in this chapter you saw lines in the following
+ format:
+ <A
+ NAME="AEN1528"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;myNet&nbsp;src&nbsp;10.0.0.0/255.255.0.0<br>
+ http_access&nbsp;allow&nbsp;myNet</P
+ ></BLOCKQUOTE
+ >
+ The above acl will match when the IP address comes <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >from</I
+ ></SPAN
+ > any
+ IP address between <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.0.0.0</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.0.255.255</I
+ ></SPAN
+ >.
+ In recent years more and more people are using Classless Internet
+ Domain Routing (CIDR) format netmasks, like <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.0.0.0/16</I
+ ></SPAN
+ >.
+ Squid handles both the traditional <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >IP/Netmask</I
+ ></SPAN
+ > and more recent
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >IP/Bits</I
+ ></SPAN
+ > notation in the src acl type. IP ranges can also be
+ specified in a further format: one that is Squid specific. (? I
+ need to spend some time hacking around with these: I am not sure
+ of the layout ?)
+ <A
+ NAME="AEN1536"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;myNet&nbsp;src&nbsp;addr1-addr2/netmask<br>
+ http_access&nbsp;allow&nbsp;myNet</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >Squid can also match connections by destination IP. The layout is very
+ similar: simply replace <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >src</I
+ ></SPAN
+ > with <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >dst</I
+ ></SPAN
+ >. Here are a couple of
+ examples:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1541"><P
+ ><B
+ >Example 6-7. Denying access to a small section of a larger block</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl BadDest dst 10.0.0.0/255.255.0.0
+ acl NiceDest dst 10.1.0.0/16
+ http_access deny BadDest
+ http_access allow NiceDest</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1544">Source/Destination Domain</H4
+ ><P
+ >Squid can also limit requests by their source domain. Though it
+ doesn't always happen in the real world, network administrators can add
+ reverse DNS entries for each of the hosts on their network. (These records
+ are normally referred to as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >PTR</I
+ ></SPAN
+ > records.) Squid can make decisions
+ about the validity of incoming requests by checking their reverse DNS
+ entries. In the below example, the acl is true if the
+ request comes from a host with a reverse entry that is in either the
+ qualica.com or squid-cache.org domains.
+ <A
+ NAME="AEN1548"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;myDomain&nbsp;srcdomain&nbsp;.qualica.com&nbsp;.squid-cache.org<br>
+ acl&nbsp;allow&nbsp;myDomain</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >&#13;
+ Reverse DNS matches should not be used where security is important. A
+ determined attacker (who controlled the reverse DNS entries for the
+ attacking host) would be able to manipulate these entries so that the request
+ comes from your domain. Squid doesn't attempt to check that reverse and
+ forward DNS entries match, so this option is not recommended.</P
+ ><P
+ >Squid can also be configured to deny requests <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >to</I
+ ></SPAN
+ > specific
+ domains. Many people implement these filter lists for pornographic
+ sites. The legal implications of this filtering are not covered here:
+ there are many, and the relevant law is in a constant state of flux,
+ so advice here would likely be obsolete in a very short period of
+ time. I suggest that you consult a good lawyer if you want to do
+ something like this.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >dst</B
+ > acl type allows one to match accesses by
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >destination</I
+ ></SPAN
+ > domain. This could be used to match urls for popular
+ adult sites, and refuse access (perhaps during specific times).</P
+ ><P
+ >If you want to deny access to a set of sites, you will need to find out
+ these site's IP addresses, and deny access to these <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >IP addresses</I
+ ></SPAN
+ >
+ too. If you just put the IP addresses in, someone determined to access
+ a specific site could find out the IP address associated with that
+ hostname and access it by entering the IP address in their browser.</P
+ ><P
+ >The above is best described with an example. Here, I assume that you
+ want to restrict access to the site <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >www.adomain.example</I
+ ></SPAN
+ >. If you
+ use either the <B
+ CLASS="COMMAND"
+ >host</B
+ > of <B
+ CLASS="COMMAND"
+ >nslookup</B
+ > commands, you would
+ find that this server has the IP address 10.255.1.2. It's easiest to
+ just have two acls: one for IPs and one for domains. If the lists get
+ to large, you can simply place them in a file.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1564"><P
+ ><B
+ >Example 6-8. Filtering out unwanted destination sites</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl badDomains dstdomain adomain.example
+ acl badIPs dst 10.255.1.2
+ http_access deny badlist
+ http_access deny badIPs
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1567">Words in the requested URL</H4
+ ><P
+ >Most caches can filter out URLs that contain a set of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >banned</I
+ ></SPAN
+ >
+ words. Regular expressions allow you to simply check if a word is in a
+ given URL, but they also allow for more powerful searches of the URL.
+ With a simple word check you would find it nearly impossible to create
+ a rule that allows access to sites with the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > in the URL,
+ but at the same time denies access to all <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >avi</I
+ ></SPAN
+ > files on that
+ site. With regular expressions this sort of checking becomes easy,
+ once you understand the regex syntax.</P
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1573">A Quick introduction to regular expressions</H5
+ ><P
+ >We haven't encountered regular expressions in this book yet. A regular
+ expression (regex) is an incredibly useful way of matching strings. As
+ they are incredibly powerful they can get a little complicated.
+ Regexes are often used in string-oriented languages like Perl, where
+ they make processing of large text files (such as logs) incredibly
+ easy. Squid uses regular expressions for numerous things: refresh
+ patterns and access control among them.</P
+ ><P
+ >&#13;If you have not used regular expressions before, you might want to
+ have a look at the O'Reilly book on regular expressions or the
+ appropriate section in the O'Reilly perl book. Instead of
+ going into detail here, I am just going to give some (hopefully)
+ useful examples. If you have perl installed on your machine, you could
+ have a look at the <B
+ CLASS="COMMAND"
+ >perlre</B
+ > manual page to get an idea as to how
+ the various regex operators (such as <B
+ CLASS="COMMAND"
+ >.</B
+ >) function.</P
+ ><P
+ >Regular expressions in Squid are case-sensitive by default. If you
+ want to match both upper or lower-case text, you can prefix the
+ regular expression with a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >-i</I
+ ></SPAN
+ >. Have a look at the next example,
+ where we use this to match either <B
+ CLASS="COMMAND"
+ >sex</B
+ > <B
+ CLASS="COMMAND"
+ >SEX</B
+ > (or even
+ <B
+ CLASS="COMMAND"
+ >SeX</B
+ >).</P
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1585">Using Regular expressions to match words in the requested URL</H5
+ ><P
+ >Using regular expressions allows you to create more flexible access
+ lists. So far you have only been able to filter sites by destination
+ domain, where you have to match the entire domain to deny access to
+ the site. Since regular expressions are used to match text
+ strings, you can use them to match words, partial words or patterns
+ in URLs or domains.</P
+ ><P
+ >The most common use of regex filters in ACL lists is for the
+ creation of far-reaching site filters: if the url or domain
+ contain a set of banned words, access to the site is denied.
+ If you wish to deny access to sites that contain the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > in
+ the URL, you would add one acl rule, rather than trying to find every
+ site that has adult material on it.</P
+ ><P
+ >The big problem with regex filters is that not all sites that contain
+ the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > in the URL are pornographic. By denying these sites
+ you are likely to be infringing people's rights, and you should refer to
+ a lawyer for advice on the legality of this.</P
+ ><P
+ >Creating a list of sites that you don't want accessed can be tedious.
+ There are companies that sell adult/unwanted material lists which plug
+ into Squid, but these can be expensive. If you cannot justify the
+ cost, you can </P
+ ><P
+ >The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >url_regex</I
+ ></SPAN
+ > acl type is used to match any word in the URL.
+ Here is an example:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1595"><P
+ ><B
+ >Example 6-9. Denying access to sites with the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > in the URL</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl badURL url_regex -i sex
+ http_access deny badUrl
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ><P
+ >In places where bandwidth is very expensive, system administrators may
+ have no problem with people visiting pornograpic sites. They may,
+ however, want to stop people downloading huge <B
+ CLASS="COMMAND"
+ >avi</B
+ > files from
+ these sites. The following example would deny downloads of <B
+ CLASS="COMMAND"
+ >avi</B
+ >
+ files from sites that contain the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > in the URL. The
+ regular expression below matches any URL that contains the word
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sex</I
+ ></SPAN
+ > AND ends with <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.avi</I
+ ></SPAN
+ >.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1605"><P
+ ><B
+ >Example 6-10. </B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl badURL url_regex -i sex.*\.avi$
+ http_access deny badUrl
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >urlpath_regex</B
+ > acl strips off the url-type and hostname,
+ checking instead only the path and filename.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT4"
+ ><HR><H5
+ CLASS="SECT4"
+ ><A
+ NAME="AEN1610">Words in the source or destination domain</H5
+ ><P
+ >Regular expressions can also be used for checking the source and
+ destination domains of a request. The <B
+ CLASS="COMMAND"
+ >dstdom_regex</B
+ > tag is used
+ to check that a request comes from a specific subdomain, while the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >dstdom_regex</I
+ ></SPAN
+ > checks the domain part of the requested URL. (You
+ could check the requested domain with a <B
+ CLASS="COMMAND"
+ >url_regex</B
+ > tag, but you
+ could run into interesting problems with sites that refer to pages
+ with urls like
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http://www.company.example/www.anothersite.example</I
+ ></SPAN
+ >.)</P
+ ><P
+ >Here is an example acl set that uses a regular
+ expression (rather than using the <B
+ CLASS="COMMAND"
+ >srcdomain</B
+ > and
+ <B
+ CLASS="COMMAND"
+ >dstdomain</B
+ > tags). This example allows you to deny access to
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.com</I
+ ></SPAN
+ > or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.net</I
+ ></SPAN
+ > sites if the request is from the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >.za</I
+ ></SPAN
+ >
+ domain. This could be useful if you are providing a "public peering"
+ infrastructure to other caches in your geographical region.
+ Note that this example is only a fragment of a complete acl set: you would
+ presumably want your customers to be able to access any site, and
+ there is no final deny acl.
+ <A
+ NAME="AEN1623"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;bad_dst_TLD&nbsp;dstdom_regex&nbsp;\.com$&nbsp;\.net$<br>
+ acl&nbsp;good_src_TLD&nbsp;srcdom_regex&nbsp;\.za$<br>
+ #&nbsp;allow&nbsp;requests&nbsp;FROM&nbsp;the&nbsp;za&nbsp;domain&nbsp;UNLESS&nbsp;they&nbsp;want&nbsp;to&nbsp;go&nbsp;to&nbsp;\.com&nbsp;or&nbsp;\.net<br>
+ http_access&nbsp;deny&nbsp;bad_dst_TLD<br>
+ http_access&nbsp;allow&nbsp;good_src_TLD</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1625">Current day/time</H4
+ ><P
+ >Squid allows one to allow access to specific sites by time. Often
+ businesses wish to filter out irrelevant sites during work hours. The Squid
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >time</I
+ ></SPAN
+ > acl type allws you to filter by the current day and time. By
+ combining the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >dstdomain</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >time</I
+ ></SPAN
+ > acls you can allow access to
+ specific sites (such as your the sites of suppliers or other associates)
+ during work hours, but allow access to other sites after work hours.</P
+ ><P
+ >The layout is quite compact:
+ <A
+ NAME="AEN1632"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;name&nbsp;time&nbsp;[day-list]&nbsp;[start_hour:minute-end_hour:minute]</P
+ ></BLOCKQUOTE
+ >
+ Day list is a list of single characters indicating the days that the acl
+ applies to. Using the first letter of the day would be ambiguous (since,
+ for example, both Tuesday and Thursday start with the same letter). When
+ the first letter is ambiguous, the second letter is used: <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >T</I
+ ></SPAN
+ > stands
+ for Tuesday, <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >H</I
+ ></SPAN
+ > for Thursday.  Here is a list of the days with
+ their single-letter abreviations:</P
+ ><P
+ ><SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >S</I
+ ></SPAN
+ > - Sunday
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >M</I
+ ></SPAN
+ > - Monday
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >T</I
+ ></SPAN
+ > - Tuesday
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >W</I
+ ></SPAN
+ > - Wednesday
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >H</I
+ ></SPAN
+ > - Thursday
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >F</I
+ ></SPAN
+ > - Friday
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >A</I
+ ></SPAN
+ > - Saturday</P
+ ><P
+ >Start_hour and end_hour are values in military time (17:00 instead of
+ 5:00). End_hour must always be larger than start_hour; this means
+ (unfortunately) that you <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cannot</I
+ ></SPAN
+ > do the following:
+ <A
+ NAME="AEN1646"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >#&nbsp;since&nbsp;start_time&nbsp;must&nbsp;be&nbsp;smaller&nbsp;than&nbsp;end_time,&nbsp;this&nbsp;won't&nbsp;work:<br>
+ acl&nbsp;darkness&nbsp;17:00-6:00</P
+ ></BLOCKQUOTE
+ >
+ The only alternative to the darkness example above is something like
+ this:
+ 
+ <A
+ NAME="AEN1649"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;night&nbsp;time&nbsp;17:00-24:00<br>
+ acl&nbsp;early_morning&nbsp;time&nbsp;00:00-6:00</P
+ ></BLOCKQUOTE
+ ></P
+ ><P
+ >As you can see from the original definition of the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >time</I
+ ></SPAN
+ > acl, you can
+ specify the day of the week (with no time), the time (with no day), or both
+ the time and day (?check!?). You can, for example, create a rule that
+ specifies weekends without specifying that the day starts at midnight and
+ ends at the following midnight. The following acl will match on either
+ Saturday or Sunday.
+ <A
+ NAME="AEN1653"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;weekends&nbsp;time&nbsp;SA</P
+ ></BLOCKQUOTE
+ >
+ The following example is too basic for real-world use. Unfortunately
+ creating a good example requires some of the more advanced features of the
+ http_access line; these are covered in the next section of this chapter,
+ and examples are included there.</P
+ ><P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1656"><P
+ ><B
+ >Example 6-11. Allowing Web access during the weekend only</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/16
+ acl workdays time MTWHF
+ # allow web access only on the weekends!
+ http_access deny workdays
+ http_access allow myNet</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1659">Destination Port</H4
+ ><P
+ >Web servers almost always listen for incoming requests on port 80.
+ Some servers (notably site-specific search engines and unofficial
+ sites) listen on other ports, such as 8080. Other services (such as
+ IRC) also use high-numbered ports. Because of the way HTTP is
+ designed, people can connect to things like IRC servers through your
+ cache servers (even though the IRC protocol is very different to the
+ HTTP protocol). The same problems can be used to tunnel telnet
+ connections through your cache server. The major part of the HTTP
+ specification that allows for this is the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >CONNECT</I
+ ></SPAN
+ > method, which
+ is used by clients to connect to web servers using SSL.</P
+ ><P
+ >Since you generally don't want to proxy anything other than the
+ standard supported protocols, you can restrict the ports that your
+ cache is willing to connect to. The default Squid config file limits
+ standard HTTP requests to the port ranges defined in the
+ <B
+ CLASS="COMMAND"
+ >Safe_ports</B
+ > squid.conf acl. SSL <B
+ CLASS="COMMAND"
+ >CONNECT</B
+ > requests are even
+ more limited, allowing connections to only ports 443 and 563.</P
+ ><P
+ >Port ranges are limited with the <B
+ CLASS="COMMAND"
+ >port</B
+ > acl type. If you look in
+ the default <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ >, you will see lines like the following:
+ <A
+ NAME="AEN1669"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;Safe_ports&nbsp;port&nbsp;80&nbsp;21&nbsp;443&nbsp;563&nbsp;70&nbsp;210&nbsp;1025-65535</P
+ ></BLOCKQUOTE
+ >
+ The format is pretty straight-forward: destination ports 443 OR 563
+ are matched by the first acl, 80 21 443, 563 and so forth by the
+ second line. The most complicated section of the examples above is the
+ end of the line: the text that reads "1024-65535".</P
+ ><P
+ >The "-" character is used in squid to specify a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >range</I
+ ></SPAN
+ >. The
+ example thus matches any port from 1025 all the way up to 65535. These
+ ranges are inclusive, so the second line matches ports 1025 and 65535
+ too.</P
+ ><P
+ >The only low-numbered ports which Squid should need to connect to are
+ 80 (the HTTP port), 21 (the FTP port), 70 (the Gopher port), 210
+ (wais) and the appropriate SSL ports. All other low-numbered ports
+ (where common services like telnet run) do not fall into the
+ 1024-65535 range, and are thus denied.</P
+ ><P
+ >The following http_access line denies access to URLs that are not in
+ the correct port ranges. You have not seen the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >!</I
+ ></SPAN
+ > http_access
+ operator before: it inverts the decision. The line below would
+ read "deny access if the request does not fall in the range
+ specified by acl Safe_ports" if it were written in english. If the
+ port matches one of those specified in the Safe_ports acl line, the
+ next http_access line is checked. More information on the format of
+ http_access lines is given in the next section <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Acl-operator lines</I
+ ></SPAN
+ >.
+ <A
+ NAME="AEN1677"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >http_access&nbsp;deny&nbsp;!Safe_ports</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1679">Protocol (FTP, HTTP, SSL)</H4
+ ><P
+ >Some people may wish to restrict their users to specific protocols.
+ The <B
+ CLASS="COMMAND"
+ >proto</B
+ > acl type allows you to restrict access by the URL
+ prefix: the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http://</I
+ ></SPAN
+ > or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ftp://</I
+ ></SPAN
+ > bit at the front. The
+ following example will deny request that uses the FTP protocol.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1685"><P
+ ><B
+ >Example 6-12. Denying access to FTP sites</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl ftp proto FTP
+ acl myNet src 10.0.0.0/16
+ acl all src 0.0.0.0/0.0.0.0
+ http_access deny ftp
+ http_access allow mynet
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ><P
+ >The default <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > file
+ denies access to a special type of URL, urls which use the
+ <B
+ CLASS="COMMAND"
+ >cache_object</B
+ > protocol. When Squid sees a request
+ for one of these URLs it serves up information about itself: usage
+ statistics, performance information and the like. The world at large
+ has no need for this information, and it could be a security risk.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1691">Method (HTTP GET, POST or CONNECT)</H4
+ ><P
+ >HTTP can be used for downloading (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >GETting</I
+ ></SPAN
+ >
+ data) or uploads (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >POST</I
+ ></SPAN
+ >ing data to a site).
+ The <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >CONNECT</I
+ ></SPAN
+ > mode is used for SSL data
+ transfers. When a connection is made to the proxy the client
+ specifies what kind of request (called a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >method</I
+ ></SPAN
+ >)
+ it is sending.
+ A <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >GET</I
+ ></SPAN
+ > request looks like this:
+ <A
+ NAME="AEN1699"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >GET&nbsp;http://www.qualica.com/&nbsp;HTTP/1.1<br>
+ blank-line</P
+ ></BLOCKQUOTE
+ >
+ If you were connecting using SSL, the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >GET</I
+ ></SPAN
+ > word would be replaced
+ with the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >CONNECT</I
+ ></SPAN
+ >.</P
+ ><P
+ >You can control what methods are allowed through the cache using the
+ <B
+ CLASS="COMMAND"
+ >post</B
+ > acl type. The most common use is to stop
+ <B
+ CLASS="COMMAND"
+ >CONNECT</B
+ > type requests to non-SSL ports. The
+ <B
+ CLASS="COMMAND"
+ >CONNECT</B
+ > method allows data transfer in any
+ direction at any time: if you telnet to a badly configured proxy,
+ and enter something like the following, you could end up connected
+ to a machine if you had telnetted there from the cache server. This
+ could get around packet-filters, firewall access lists and passwords,
+ which is generally considered a bad thing!
+ 
+ <A
+ NAME="AEN1707"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >CONNECT&nbsp;www.domain.example:23&nbsp;HTTP/1.1<br>
+ blank-line</P
+ ></BLOCKQUOTE
+ >
+ Since <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >CONNECT</I
+ ></SPAN
+ > requests can be quite easily
+ exploited, the default <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > denies access
+ to SSL requests to non-standard ports, as we spoke about in the
+ previous section (on the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >port</I
+ ></SPAN
+ > acl-operator.)</P
+ ><P
+ >Let's assume that you want to stop your clients from POSTing to any
+ sites (note that doing this is not a good idea, since people using
+ some search engines (for example) would run into problems: at this
+ stage this is just an example.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1713"><P
+ ><B
+ >Example 6-13. Breaking search site access</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl Post_class method POST
+ acl myNet src 10.0.0.0/16
+ acl all src 0.0.0.0/0.0.0.0
+ # stop requests before they are allowed by being from my address
+ #  range
+ http_access deny Post_class
+ # allow my clients access to sites that aren't data posts
+ http_access allow myNet
+ # deny everyone else
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1716">Browser type</H4
+ ><P
+ >Companies sometimes have policies as to what browsers people can use.
+ The <B
+ CLASS="COMMAND"
+ >browser</B
+ > acl type allows you to specify
+ a regular expression that can be used to allow or deny access.
+ 
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1721"><P
+ ><B
+ >Example 6-14. </B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ ></PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1724">User name</H4
+ ><P
+ >Logs generally show the source IP address of a connection. When
+ this address is on a multiuser machine (let's use a Unix machine
+ at a university as an example) you cannot pin down a request as
+ being from a specific user. There could be hundreds of people
+ logged into the Unix machine, and they could all be using the
+ cache server. Trying to track down a misbehaver is very difficult
+ in this case, since you can never be sure which user is actually
+ doing what. To solve this problem, the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ident</I
+ ></SPAN
+ >
+ protocol was created. When the cache server accepts a connection,
+ it can connect back to the origin server (on a low-numbered port,
+ so the reply cannot be faked) and finds out who just connected. This
+ doesn't make any sense on windows systems: people can just load their
+ own <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ident</I
+ ></SPAN
+ > servers (and become daffy duck for a
+ day). If you run multi-user systems then you may want only certain
+ people on those machines to be able to use the cache. In this case
+ you can use the ident username to allow or deny access.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1729"><P
+ ><B
+ >Example 6-15. Using ident usernames to deny cache access</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl ident goodusers oskar tom
+ http_access allow goodusers</PRE
+ ></DIV
+ ></P
+ ><P
+ >One of the best things about Unix is the flexibility you get. If you
+ wanted (for example) only students in their second year on to have
+ access to the cache servers via your Unix machines, you could create a
+ replacement <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ident</I
+ ></SPAN
+ > server. This server could find out which user
+ that has connected to the cache, but instead of returning the username
+ you could return a string like "third_year" or "postgrad". Rather
+ than maintaining a list of which students are in on both the cache
+ server <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >and</I
+ ></SPAN
+ > the central Unix system, you could simple Squid
+ rules, and the ident server could do all the work where it checks
+ which user is which.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1735"><P
+ ><B
+ >Example 6-16. Using Ident to classify users, and using Squid to deny classes</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl responsible ident third_year fourth_year postgrad staff
+ http_access allow responsible</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1738">Autonomous System (AS) Number</H4
+ ><P
+ >Squid is often used by large ISPs. These ISPs want all of their
+ customers to have access to their caches without having incredibly
+ long manually-maintained ACL lists (don't forget that such long lists
+ of IPs generally increase the CPU usage of Squid too). Large ISP's
+ all have <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >AS</I
+ ></SPAN
+ > (Autonomous System) numbers which are used by other
+ Internet routers which run the BGP (Border Gateway Protocol) routing
+ protocol.</P
+ ><P
+ >&#13;
+ The whois server <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >whois.ra.net</I
+ ></SPAN
+ > keeps a (supposedly authoritive)
+ list of all the IP ranges that are in each AS. Squid can query this
+ server and get a list of all IP addresses that the ISP controls,
+ reducing the number of rules required. The data returned is also
+ 
+ stored in a radix tree, for more cpu-friendly retrieval.</P
+ ><P
+ >Sometimes the whois server is updated only sporadically. This could
+ lead to problems with new networks being denied access incorrectly.
+ It's probably best to automate the process of adding new IP ranges to
+ the whois server if you are going to use this function.</P
+ ><P
+ >If your region has some sort of local whois server that handles
+ queries in the same way, you can use the <B
+ CLASS="COMMAND"
+ >as_whois_server</B
+ >
+ Squid config file option to query a different server.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1750">Username/Password pair</H4
+ ><P
+ >If you want to track Internet usage it's best to get users to log into
+ the cache server when they want to use the net. You can then use a
+ stats program to generate per-user reports, no matter which machine on
+ your network a person is using. Universities and colleges often have
+ labs with many machines, where it is difficult to tell which user is
+ sitting in front of a machine at any specific time. By using names and
+ passwords you will solve this problem.</P
+ ><P
+ >Squid uses modules to do user authentication, rather than including
+ code to do it directly. The default Squid source does, however,
+ include two standard modules; The first authenticates users from a file,
+ the other uses SMB (Windows NT) authentication. These modules are in
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >auth_modules</I
+ ></SPAN
+ > directory in the source directory. These
+ modules are not compiled when you compile Squid itself, and you will
+ need to chooes an authentication module and run <B
+ CLASS="COMMAND"
+ >make</B
+ > in the
+ appropriate directory. If the compile goes well, a <B
+ CLASS="COMMAND"
+ >make install</B
+ > will place the program file in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/bin/</I
+ ></SPAN
+ > directory and any config files in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/</I
+ ></SPAN
+ > directory.</P
+ ><P
+ >NCSA authentication is the easiest to use, since it's self contained.
+ The SMB authentication program requires that SAMBA be installed, since
+ it effectively talks to the NT server through SAMBA.&#13;</P
+ ><P
+ >The squid.conf file uses the <B
+ CLASS="COMMAND"
+ >authenticate_program</B
+ > tag to
+ decide which external program to use to authenticate users. If Squid
+ were to only start one authentication program, a slow username/password
+ lookup could slow the whole cache down (while all other connections
+ waited to be authenticated). Squid thus opens more than one
+ authentication program at a time, sending pending requests to the
+ second when the first is busy, the third when the second is and so
+ forth. The actual number started is specified by the 
+ <B
+ CLASS="COMMAND"
+ >authenticate_children</B
+ > squid.conf value. The default number
+ started is five, but if you have a heavily loaded cache then you will
+ need to increase this value.</P
+ ><P
+ >&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1767">Using the NCSA authentication module</H4
+ ><P
+ >To use the NCSA authentication module, you will need to add the following
+ line to your squid.conf:
+ <A
+ NAME="AEN1770"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >authenticate_program&nbsp;/usr/local/squid/bin/ncsa_auth&nbsp;/usr/local/squid/etc/passwd&nbsp;</P
+ ></BLOCKQUOTE
+ >
+ You will also need to create the appropriate password file
+ (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/passwd</I
+ ></SPAN
+ > in the example above). This file
+ consists of a username and password pair, one per line, where the username
+ and password are seperated by a colon (:), just as they are in your
+ /etc/passwd file (assuming you are running Unix). The password is
+ encrypted with the same function as the passwords in /etc/passwd (or
+ /etc/shadow on newer systems) are.
+ Here is an example password line:
+ <A
+ NAME="AEN1773"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >oskar:lKdpxbNzhlo.w</P
+ ></BLOCKQUOTE
+ >
+ Since the encrypted passwords are the same, you could simply copy the
+ system password file periodically, since the ncsa_auth module
+ understands the /etc/passwd or /etc/shadow file format. If your
+ users do not already have passwords in unix crypt format somewhere, you
+ will
+ 
+ 
+ 
+ 
+ 
+ have to use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >htpasswd</I
+ ></SPAN
+ > program to generate the appropriate
+ user and password pairs. This program is included in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/bin/</I
+ ></SPAN
+ > directory.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1782">Using the SMB authentication module</H4
+ ><P
+ >&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1787">SNMP Community</H4
+ ><P
+ >If you have configured Squid to support SNMP, you can also create acls
+ that filter by the requested SNMP community. By combining source
+ address (with the <B
+ CLASS="COMMAND"
+ >src</B
+ > acl type) and community filters
+ (using the <B
+ CLASS="COMMAND"
+ >snmp_community</B
+ > acl type) you can restrict sensitive
+ SNMP queries to administrative machines while allowing safer queries
+ from the public. SNMP setup is covered in more detail later in the
+ chapter, where we discuss the <B
+ CLASS="COMMAND"
+ >snmp_access</B
+ > acl-operator.</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1793">Acl-operator lines</H2
+ ><P
+ >Acl-operators are the other half of the acl system. For each
+ connection the appropriate acl-operators are checked (in the order
+ that they appear in the file). You have met the <B
+ CLASS="COMMAND"
+ >http_access</B
+ >
+ and <B
+ CLASS="COMMAND"
+ >icp_access</B
+ > operators before, but they aren't the only
+ Squid acl-operators. All acl-operator lines have the same format;
+ although the below format mentions <B
+ CLASS="COMMAND"
+ >http_access</B
+ > specifically,
+ the layout also applies to all the other acl-operators too.
+ <A
+ NAME="AEN1799"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >http_access&nbsp;allow|deny&nbsp;[!]aclname&nbsp;[&#38;&nbsp;[!]aclname2&nbsp;...&nbsp;]</P
+ ></BLOCKQUOTE
+ >
+ Let's work through the fields from left to right. The first word is
+ <B
+ CLASS="COMMAND"
+ >http_access</B
+ >, the actual acl-operator.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >allow</B
+ > and <B
+ CLASS="COMMAND"
+ >deny</B
+ > words come next. If you want to deny
+ access to a specific class of users, you can change the customary
+ <B
+ CLASS="COMMAND"
+ >allow</B
+ > to <B
+ CLASS="COMMAND"
+ >deny</B
+ > in the acl line. We have seen where a
+ deny line is useful before, with the final deny of all IP ranges in
+ previous examples.</P
+ ><P
+ >Let's say that you wanted to deny Internet access to a specific list
+ of IP addresses during the day. Since acls can only have one type per
+ acl, you could not create an acl line that matches an IP address
+ during specific times. By combining more than one acl per acl-operator
+ line, though, you get the same effect. Consider the following acls:
+ <A
+ NAME="AEN1808"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;dialup&nbsp;src&nbsp;10.0.0.0/255.255.255.0<br>
+ acl&nbsp;work&nbsp;time&nbsp;08:00-17:00</P
+ ></BLOCKQUOTE
+ >
+ If you could create an acl-operator that was matched when both the
+ <B
+ CLASS="COMMAND"
+ >dialup</B
+ > and <B
+ CLASS="COMMAND"
+ >work</B
+ > acls were true, clients in the range
+ could only connect during the right times. This is where the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >aclname2</I
+ ></SPAN
+ > in the above acl-operator definition comes in. When you
+ specify more than one acl per acl-operator line, both acls have to be
+ matched for the acl-operator to be true. The acl-operator function
+ AND's the results from each acl check together to see if it is to return
+ true of false.</P
+ ><P
+ >You could thus deny the dialup range cache access during working hours
+ with the following acl rules:
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1814"><P
+ ><B
+ >Example 6-17. Using more than one acl operator on an http_access line</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 168.209.2.0/255.255.255.0
+ acl dialup src 10.0.0.0/255.255.255.0
+ acl work_hours time 08:00-17:00
+ # If a connection arrives during work hours, dialup is 1, and
+ # work_hours is 1. When ANDed together the http_access line matches
+ # and denies the client access
+ # during work hours:
+ #	1 AND 1 = TRUE, so the http_access line matches them and
+ #			they are denied
+ # after work hours:
+ #	1 AND 0 = FALSE, so the line does not match: the next
+ #			http_acess line is checked. Note that
+ #
+ http_access deny dialup work_hours
+ # If it's not during work hours, the above line will fail, and the
+ # next http_access line will be checked. You want to allow dialup
+ # users explicit access here, otherwise they are not caught by the
+ # myNet acl, and are denied by the final deny line.
+ http_access allow dialup
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ><P
+ >You can also invert an acl's result value by using an exclamation mark
+ (the traditional NOT value from many programming languages) before the
+ appropriate acl. In the following example I have reduced Example 6-4
+ into one <B
+ CLASS="COMMAND"
+ >http_access</B
+ > line, taking advantage of the implicit
+ inversion of the last rule to deny access to all clients.</P
+ ><P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1820"><P
+ ><B
+ >Example 6-18. Specifying more than one acl per http_access line</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.0.0
+ acl all src 0.0.0.0/0.0.0.0
+ # A request from an outside network:
+ #		1 AND (NOT 0) = True, so the request is denied
+ # A request from an internal network:
+ #		1 AND (NOT 1) = False. Because the last definition
+ #		is inverted (see earlier discussions in this chapter
+ #		for more detail), the local network is allowed: the
+ #		'deny' is inverted.
+ http_access deny all !myNet
+ # There is an invisible "http_access allow all" here because of the
+ # way Squid inverts the last http_access rule.</PRE
+ ></DIV
+ ></P
+ ><P
+ >Since the above example is quite complicated: let's cover it in more
+ detail:</P
+ ><P
+ >In the above example an IP from the outside world will match the 'all'
+ acl, but not the 'myNet' acl; the IP will thus match the http_access line.
+ Consider the binary logic for a request coming in from the outside
+ world, where the IP is not defined in the myNet acl.
+ <A
+ NAME="AEN1825"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >Deny&nbsp;http&nbsp;access&nbsp;if&nbsp;((true)&nbsp;&#38;&nbsp;(!false))</P
+ ></BLOCKQUOTE
+ >
+ If you consider the relevant matching of an IP in the 10.0.0.0 range,
+ the myNet value is true, the binary representation is as follows:
+ <A
+ NAME="AEN1827"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >Deny&nbsp;http&nbsp;access&nbsp;if&nbsp;((true)&nbsp;&#38;&nbsp;(!true))</P
+ ></BLOCKQUOTE
+ >
+ A 10.0.0.0 range IP will thus <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >not match</I
+ ></SPAN
+ > the only
+ <B
+ CLASS="COMMAND"
+ >http_access</B
+ > line in the squid config file. Remembering that
+ Squid will default to using the inverse of the last match in the file,
+ accesses will be allowed from the myNet IP range.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1831">The other Acl-operators</H3
+ ><P
+ >You have encountered only the <B
+ CLASS="COMMAND"
+ >http_access</B
+ > and
+ <B
+ CLASS="COMMAND"
+ >icp_access</B
+ > acl-operators so far. Other acl-operators are:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >no_cache</P
+ ></LI
+ ><LI
+ ><P
+ >ident_lookup_access</P
+ ></LI
+ ><LI
+ ><P
+ >miss_access</P
+ ></LI
+ ><LI
+ ><P
+ >always_direct, never_direct</P
+ ></LI
+ ><LI
+ ><P
+ >snmp_access (covered in the next section of this chapter)</P
+ ></LI
+ ><LI
+ ><P
+ >delay_classes (covered in the next section of this chapter) </P
+ ></LI
+ ><LI
+ ><P
+ >broken_posts</P
+ ></LI
+ ></UL
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1851">The no_cache acl-operator</H4
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >no_cache</B
+ > acl-operator is used to ensure freshness of
+ objects in the cache. The default Squid config file includes an
+ example <B
+ CLASS="COMMAND"
+ >no_cache</B
+ > line that ejects the results of cgi programs
+ from the cache. If you want to ensure that cgi pages are not cached,
+ you must un-comment the following lines from <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ >:
+ <A
+ NAME="AEN1857"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >acl&nbsp;QUERY&nbsp;urlpath_regex&nbsp;cgi-bin&nbsp;\\?<br>
+ no_cache&nbsp;deny&nbsp;QUERY</P
+ ></BLOCKQUOTE
+ >
+ The first line uses a regular expression match to find urls that have
+ <B
+ CLASS="COMMAND"
+ >cgi-bin</B
+ > or <B
+ CLASS="COMMAND"
+ >?</B
+ > in the path (since we are using the
+ <B
+ CLASS="COMMAND"
+ >urlpath_regex</B
+ > acl type, a site with a name like
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cgi-bin.qualica.com</I
+ ></SPAN
+ > will not be matched.) The <B
+ CLASS="COMMAND"
+ >no_cache</B
+ >
+ acl-operator is then used to eject matching objects from the cache.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1864">The ident_lookup_access acl-operator</H4
+ ><P
+ >&#13;Earlier we discussed using the ident protocol to control cache access. 
+ To reduce network overhead, Squid does an ident lookup only when it
+ needs to. If you are using ident to do access control, Squid will do an
+ ident lookup for every request, and you don't have to worry about this
+ acl-operator.</P
+ ><P
+ >Many administrators would like to log the the ident value for
+ connections without actually using it for access control. Squid used
+ to have a simple on/off switch for ident lookups, but this incurred
+ extra overhead for the cases where the ident lookup wasn't useful
+ (where, for example, the connection is from a desktop PC).</P
+ ><P
+ >Let's consider some examples. Assume that a you have one Unix server
+ (at IP address 10.0.0.3), and all remaining IP's in the
+ 10.0.0.0/255.255.255.0 range are desktop PC's. You don't want to log
+ the ident value from PC's, but you do want to record it when the
+ connection is from the Unix machine. Here is an example acl set that
+ does this:
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1870"><P
+ ><B
+ >Example 6-19. Logging ident values from specific machines</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.255.0
+ acl all src 0.0.0.0/0.0.0.0
+ # not used for access control, just to differentiate ident lookups:
+ acl Unixmachine src 10.0.0.3/255.255.255.255
+ http_access allow myNet
+ http_access deny all
+ # do an ident lookup when the request is from Unixmachine
+ ident_lookup_access allow Unixmachine
+ # but don't log ident values for anything else
+ ident_lookup_access deny all</PRE
+ ></DIV
+ ></P
+ ><P
+ >If a system cracker is attempting to attack your cache, it can be
+ useful to have their ident value logged. The following example gets
+ Squid not to do ident lookups for machines that are allowed access,
+ but if a request comes from a disallowed IP range, an ident lookup is
+ done and inserted into the log.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1874"><P
+ ><B
+ >Example 6-20. Doing ident lookups for unknown machines</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.255.0
+ acl all src 0.0.0.0/0.0.0.0
+ http_access allow myNet
+ http_access deny all
+ # If the request is from a local machine, don't do an ident query
+ ident_lookup_access deny myNet
+ # If the request is from another network, do an ident query
+ ident_lookup_access allow all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1877">The miss_access acl-operator</H4
+ ><P
+ >The ICP protocol is used by many caches to find out if objects
+ are in another cache's on-disk store. If you are peering with
+ other organisation's caches, you may wish them to treat you as
+ a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sibling</I
+ ></SPAN
+ >, where they only get data that
+ you already have stored on disk. If an unscrupulous cache-admin
+ were to change their <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line to read
+ <B
+ CLASS="COMMAND"
+ >parent</B
+ > instead of <B
+ CLASS="COMMAND"
+ >sibling</B
+ >,
+ they could get you to retrieve objects on their behalf.</P
+ ><P
+ >To stop this from happening, you can create an acl that contains the
+ peering caches, and use the <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > acl-operator to ensure
+ that only hits are served to these caches. In response to all other
+ requests, an access-denied message is sent (so if a sibling complains
+ that they almost always get error messages, it's likely that they
+ think that you should be their parent, and you think that they should
+ be treating you as a sibling.)</P
+ ><P
+ >When looking at the following example it is important to realise that
+ <B
+ CLASS="COMMAND"
+ >http_access</B
+ > lines are checked <B
+ CLASS="COMMAND"
+ >before</B
+ > any
+ <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > lines. If the request is denied by the
+ <B
+ CLASS="COMMAND"
+ >http_access</B
+ > lines, an error page is returned and the
+ connection closed, so <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > lines are never checked.
+ This means that the last <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > line in the example
+ doesn't allow random IP ranges to access your cache, it only allows
+ ranges that have passed the <B
+ CLASS="COMMAND"
+ >http_access</B
+ > test through. This is
+ simpler than having one <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > line for each
+ <B
+ CLASS="COMMAND"
+ >http_access</B
+ > line in the file, and it will reduce CPU usage
+ too, since only two acls are checked instead of the six we would have
+ instead.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1896"><P
+ ><B
+ >Example 6-21. Allowing a subnet range to only get data we already have (hits)</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myFirstNet src 10.0.0.0/255.255.255.0
+ acl mySecondNet src 10.1.0.0/255.255.255.0
+ acl myThirdNet src 10.2.0.0/255.255.255.0
+ acl othercompany src 10.11.12.13/255.255.255.255
+ acl all src 0.0.0.0/0.0.0.0
+ http_access allow myNet
+ http_access allow myFirstNet
+ http_access allow mySecondNet
+ http_access allow myThirdNet
+ http_access allow othercompany
+ http_access deny all
+ #If the request is for a miss, and it's from othercompany, deny it
+ miss_access deny othercompany
+ miss_access allow all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1899">The always_direct and never_direct acl-operators</H4
+ ><P
+ >These operators help you make controlled decisions about which servers
+ to connect to directly, and which to connect through a parent
+ cache/proxy. I previously discussed this set of options briefly in Chapter
+ Three, during the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Basic Installation</I
+ ></SPAN
+ > phase.</P
+ ><P
+ >These tags are covered in detail in the following chapter, in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Peer Selection</I
+ ></SPAN
+ > section.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1905">The broken_posts acl-operator</H4
+ ><P
+ >Some servers incorrectly handle POST data, requiring an extra
+ Carridge-Return (CR) and Line-Feed (LF) after a POST request. Since
+ obeying the HTTP specification will make Squid incompatable with these
+ server, there is an option to be non-compliant when talking to a
+ specific set of servers. This option should be very rarely used. The
+ <B
+ CLASS="COMMAND"
+ >url_regex</B
+ > acl type should be used for specifying the broken
+ server.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1909"><P
+ ><B
+ >Example 6-22. Using the broken_posts acl-operator</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl broken_server url_regex http://broken-server.domain.example/
+ broken_posts allow broken_server</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1912">SNMP Configuration</H2
+ ><P
+ >Before we continue: if you wish to use Squid's SNMP functions, you
+ will need to have configured Squid with the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >--enable-snmp</I
+ ></SPAN
+ >
+ option, as discussed way back in Chapter 2. The Squid source only
+ includes SNMP code if it is compiled with the correct options.</P
+ ><P
+ >Normally a Unix SNMP server (also called an agent) collects data from the
+ various services running on a machine, returning information about the
+ number of users logged in, the number of sendmail processes running and so
+ forth. As of this writing, there is no SNMP server which gathers Squid
+ statistics and makes them available to SNMP managment stations for
+ interpretation. Code has thus been added to Squid to handle SNMP queries
+ directly.</P
+ ><P
+ >Squid normally listens for incoming SNMP requests on port <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >3401</I
+ ></SPAN
+ >.
+ The standard SNMP port is <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >161</I
+ ></SPAN
+ >.</P
+ ><P
+ >For the moment I am going to assume that your management station 
+ can collect SNMP data from a port other than 161. Squid will thus listen
+ on port 3401, where it will not interfere with any other SNMP agents
+ running on the machine.</P
+ ><P
+ >No specific SNMP agent or mangement station software is covered by this
+ text.  A Squid-specific <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mib.txt</I
+ ></SPAN
+ > file is included in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/usr/local/squid/etc/</I
+ ></SPAN
+ > directory. Most management station
+ software should be able to use this file to construct Squid-specific
+ queries.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1924">Querying the Squid SNMP server on port 3401</H3
+ ><P
+ >All <B
+ CLASS="COMMAND"
+ >snmp_access</B
+ > acl-operators are checked when Squid is
+ queried by an SNMP management station. The default <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > file
+ allows SNMP queries from any machine, which is probably not what you want. 
+ Generally you will want only one machine to be able to do SNMP queries
+ of your cache. Some SNMP information is confidential, and you don't
+ want random people to poke around your cache settings. To restrict
+ 
+ access, simply create a <B
+ CLASS="COMMAND"
+ >src</B
+ > acl for the appropriate IP address,
+ and use <B
+ CLASS="COMMAND"
+ >snmp_access</B
+ > to deny access for every other IP.</P
+ ><P
+ >Not all Squid SNMP information is confidential. If you want to allow
+ split up SNMP information into <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >public</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >private</I
+ ></SPAN
+ >, you can
+ use an SNMP-specific acl type to allow or deny requests based on the
+ community the client has requested.
+ 
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1936"><P
+ ><B
+ >Example 6-23. Using the snmp_community acl type</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.255.0
+ acl snmpServer src 10.0.0.3/255.255.255.255
+ acl all src 0.0.0.0/0.0.0.0
+ acl public_snmp snmp_community cacheSysPerf
+ # let the SNMP Server get any SNMP information
+ snmp_access allow snmpServer
+ # Stop people outside getting any further
+ snmp_access deny !myNet
+ # Let anyone inside my network get useful (but not sensitive) data
+ snmp_access allow public_snmp
+ snmp_access deny all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1939">Running multiple SNMP servers on a cache machine</H3
+ ><P
+ >If you are running multiple SNMP servers on your cache machine, you
+ probably want to see all the SNMP data returned on one set of graphs
+ or summaries. You don't want to have to query two SNMP servers on the
+ same machine, since many SNMP analysis tools will not allow you to
+ relate (for example) load average to number of requests per second
+ when the SNMP data comes from more than one source.</P
+ ><P
+ >Let's work through the steps Squid goes through when it receives an
+ SNMP query: The request is accepted, and access-control lists are
+ checked. If the request is allowed, Squid checks to see if it's a
+ request for Squid information or a request for something it doesn't
+ understand. Squid handles all Squid-specific queries internally, but
+ all other SNMP requests are simply passed to the other SNMP server;
+ Squid essentially acts as an SNMP proxy for SNMP queries it doesn't
+ understand.</P
+ ><P
+ >This <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >SNMP proxy-mode</I
+ ></SPAN
+ > allows you to run two servers on a machine,
+ but query them both on the same port. In this mode Squid will normally
+ listen on port <B
+ CLASS="COMMAND"
+ >161</B
+ >, and the other SNMP server is configured to
+ listen on another port (let's use port 3456 for argument's sake).
+ This way the client software doesn't have to be configured to query a
+ different port, which especially helps when the client is not under
+ your control.</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1946">Binding the SNMP server to a non-standard port</H4
+ ><P
+ >Getting your SNMP server to listen on a different port may be as easy
+ as changing one line in a config file. In the worst case, though, you
+ may have to trick it to listen somewhere else. This section is a bit
+ of a guide to IP server trickery!</P
+ ><P
+ >Server software can either listen for connections on a hard-coded port
+ (where the port to listen to is coded into the source and placed
+ directly into the binary on compilation time), or it can use standard
+ system calls to find the port that it should be listening to. Changing
+ programs that use the second set of options to use a different port is
+ easy: you edit the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/etc/services</I
+ ></SPAN
+ > file, changing the value for
+ the appropriate port there. If this doesn't work, it probably means
+ that your program uses hard-coded values, and your only recourse is to
+ recompile from source (if you have it) or speak to your vendor.</P
+ ><P
+ >You can check that your server is listening to the new port by
+ checking the output of the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >netstat</I
+ ></SPAN
+ > command. The following
+ command should show you if some process is listening for UDP data on
+ port 3456:
+ <A
+ NAME="AEN1953"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >cache1:~&nbsp;$&nbsp;netstat&nbsp;-na&nbsp;|&nbsp;grep&nbsp;udp&nbsp;|&nbsp;grep&nbsp;3456<br>
+ udp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;0.0.0.0:3456&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0:*<br>
+ cache1:~&nbsp;$&nbsp;</P
+ ></BLOCKQUOTE
+ >
+ Changing the services port does have implications: client programs
+ (like any SNMP management station software running on the machine)
+ will also use the services file to find out which port they should
+ connect when forming <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >outgoing</I
+ ></SPAN
+ > requests.
+ If you are running anything other than a simple SNMP agent on the
+ cache machine, you must not change the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/etc/services</I
+ ></SPAN
+ > file: if you
+ do you will encounter all sorts of strange problems!</P
+ ><P
+ >Squid doesn't use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >/etc/services</I
+ ></SPAN
+ > file, but the port to listen
+ to is stored in the standard Squid config file. Once the other server
+ is listening on port 3456, we need to get Squid to listen on the
+ standard SNMP port and proxy requests to port 3456.</P
+ ><P
+ >First, change the <B
+ CLASS="COMMAND"
+ >snmp_port</B
+ > value in <B
+ CLASS="COMMAND"
+ >squid.conf</B
+ > to 161.
+ Since we are forwarding requests to another SNMP server, we also need
+ to set <B
+ CLASS="COMMAND"
+ >forward_snmpd_port</B
+ > to our other-server port, port 3456.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN1963">Access Control with more than one Agent</H4
+ ><P
+ >&#13;
+ Since Squid is actually creating all the queries that reach the second
+ SNMP server, using an IP-based access control system in the second
+ server's config is useless: all requests will come from localhost.
+ Since the second server cannot find out where the requests came from
+ originally, Squid will have to take over the access control functions
+ that were handled by the other server.</P
+ ><P
+ >For the first example, let's assume that you have a single SNMP
+ management station, and you want this machine to have access to all
+ SNMP functions. Here we assume that the management station is at IP
+ 10.0.0.2.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1969"><P
+ ><B
+ >Example 6-24. Allowing SNMP access from only one machine</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet 10.0.0.0/255.255.255.0
+ acl all src 0.0.0.0/0.0.0.0
+ acl snmpManager src 10.0.0.2/255.255.255.255
+ http_access allow myNet
+ http_access deny all
+ snmp_access allow snmpManager
+ snmp_access deny all</PRE
+ ></DIV
+ ></P
+ ><P
+ >You may have classes of SNMP stations too: you may wish some machines
+ to be able to inspect public data, but others are to be considered
+ completely trusted. The special <B
+ CLASS="COMMAND"
+ >snmp_community</B
+ >
+ acl type is used to filter requests by destination community.
+ In the following example all local machines are  able to get data in the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >public</I
+ ></SPAN
+ > SNMP community, but only the
+ snmpManager machine is able to get other information. In this
+ example we are using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >AND</I
+ ></SPAN
+ >ing of the
+ <B
+ CLASS="COMMAND"
+ >publicCommunity</B
+ > and <B
+ CLASS="COMMAND"
+ >myNet</B
+ >
+ acls to ensure that only people on the local network can get even
+ public information.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1979"><P
+ ><B
+ >Example 6-25. Using the snmp_community acl type</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet 10.0.0.0/255.255.255.0
+ acl all src 0.0.0.0/0.0.0.0
+ acl snmpManager src 10.0.0.2/255.255.255.255
+ acl publicCommunity snmp_community public
+ http_access allow myNet
+ http_access deny all
+ snmp_access allow snmpManager
+ snmp_access allow publicCommunity myNet
+ # deny people outside of the local network to ALL data, even public
+ snmp_access deny all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN1982">Delay Classes</H2
+ ><P
+ >Delay Classes are generally used in places where bandwidth is
+ expensive. They let you slow down access to specific sites (so that
+ other downloads can happen at a reasonable rate), and they allow you
+ to stop a small number of users from using all your bandwidth (at the
+ expense of those just trying to use the Internet for work).</P
+ ><P
+ >Many non-US Universities have very small pipes to the Internet.
+ Unfortunately these Universities often end up with huge amounts of
+ their bandwidth being used for surfing that is not study-related. In
+ the US this is fine, since the cost is negligible, but in other
+ countries the cost of this casual surfing is astronomical.</P
+ ><P
+ >To ensure that some bandwidth is available for work-related
+ downloads, you can use delay-pools. By classifying downloads
+ into segments, and then allocating these segments a certain amount of
+ bandwidth (in kilobytes per second), your link can remain
+ uncongested for <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >useful</I
+ ></SPAN
+ > traffic.</P
+ ><P
+ >To use delay-pools you need to have compiled Squid with the
+ appropriate source code: you will have to have used the
+ <B
+ CLASS="COMMAND"
+ >--enable-delay-pools</B
+ > option when running the
+ <B
+ CLASS="COMMAND"
+ >configure</B
+ > program back in Chapter 2.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1991">Slowing down access to specific URLs</H3
+ ><P
+ >An acl-operator (<B
+ CLASS="COMMAND"
+ >delay_access</B
+ >) is used to split requests into
+ pools. Since we are using acls, you can split up requests by source
+ address, destination url or more. There is more than one type (or
+ class) of pool. Each type of pool allows you to limit bandwidth in
+ different ways.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN1995">The Second Pool Class</H3
+ ><P
+ >Rather than cover all of the available classes immediately, let's deal with a
+ basic example first. In this example we have only one pool, and the
+ pool catches all URLs containing the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >abracadabra</I
+ ></SPAN
+ >.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN1999"><P
+ ><B
+ >Example 6-26. Limiting download speed by a word in the URL</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl magic_words url_regex -i abracadabra
+ delay_pools 1
+ delay_class 1 1
+ delay_parameters 1 16000/16000
+ delay_access 1 allow magic_words</PRE
+ ></DIV
+ ></P
+ ><P
+ >The first line is a standard ACL: it returns <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >true</I
+ ></SPAN
+ > if the
+ requested URL has the word abracadabra in it. The <B
+ CLASS="COMMAND"
+ >-i</B
+ > flag is
+ used to make the search case-insensitive.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >delay_pool_count</B
+ > variable tells Squid how many delay pools
+ there will be. Here we have only one pool, so this option is set to 1.</P
+ ><P
+ >The third line creates a delay pool (delay pool number <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >1</I
+ ></SPAN
+ >, the
+ first option) of class 1 (the second option to <B
+ CLASS="COMMAND"
+ >delay_class</B
+ >).</P
+ ><P
+ >The first delay <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >class</I
+ ></SPAN
+ > is the simplest: the download rate of all
+ connections in the class are added together, and Squid keeps this
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >aggregate</I
+ ></SPAN
+ > value below a given maximum value.</P
+ ><P
+ >The fourth line is the most complex, as if you can see. The
+ <B
+ CLASS="COMMAND"
+ >delay_parameters</B
+ > option allows you to set speed limits on each
+ pool.
+ 
+ The first option is the pool to be manipulated: since we have
+ only one pool in this example, this is set to 1. The second option
+ consists of two values: the <B
+ CLASS="COMMAND"
+ >restore</B
+ > and <B
+ CLASS="COMMAND"
+ >max</B
+ > values,
+ 
+ seperated by a forward-slash (/).</P
+ ><P
+ >If you download a short file at high speed, you create a so-called
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >burst</I
+ ></SPAN
+ > of traffic. Generally these short bursts of traffic are
+ not a problem: these are normally html or text files, which are not
+ the real bandwidth consumers. Since we don't want to slow everyone's
+ access down (just the people downloading comparitively large files),
+ Squid allows you to configure a size that the download is to start
+ slowing down at. If you download a short file, it arrives at full
+ speed, but when you hit a certain threshold the file arrives more
+ slowly.</P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >restore</B
+ > value is used to set the download speed, and the
+ <B
+ CLASS="COMMAND"
+ >max</B
+ > value lets you set the size at which the files are to be
+ 
+ slowed down from. <B
+ CLASS="COMMAND"
+ >Restore</B
+ > is in bytes per second,
+ <B
+ CLASS="COMMAND"
+ >max</B
+ > is in bytes.</P
+ ><P
+ >In the above example, downloads proceed at full speed until they have
+ downloaded 16000 bytes. This limit ensures that small file arrive
+ reasonably fast. Once this much data has been transferred, however, the
+ transfer rate is slowed to 16000 bytes per second. At 8 bits per byte this
+ means that connections are limited to 128kilobits per second (16000
+ * 8).</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2028">The Second Pool Class</H3
+ ><P
+ >As I discussed in this section's introduction, delay pools can help
+ you stop one user from flooding your links with downloads. You could
+ place each user in their own pool, and then set limits on a per-user
+ basis, but administrating these lists would become painful almost
+ immediately. By using a different pool type, you can set rate limits
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >by IP address</I
+ ></SPAN
+ > easily.</P
+ ><P
+ >Let's consider another example: you have a 128kbit per second line.
+ Since you want some bandwidth available for things like SMTP,
+ you want to limit web access to 100kbit per second. At the same time,
+ you don't want a single user to use more than their fair share of
+ sustained bandwidth. Given that you have 20 staff members, and
+ 100kbit per second remaining bandwidth, each person should not use
+ more than 5kbit per second of bandwidth. Since it's unlikely that
+ every user will be surfing at once, we can probably limit people to
+ about four times their limit (that's 20kbit per second, or 2.5kbytes
+ per second).</P
+ ><P
+ >In the following example, we change the delay class for pool 1 to 2.
+ Delay class 2 allows us to specify both an aggregate (overall)
+ bandwidth usage and a per-user usage. In the previous example the
+ <B
+ CLASS="COMMAND"
+ >delay_paramaters</B
+ > tag only took one set of options, the
+ aggregate peak and burst rates. Given that we are now using a
+ class-two pool, we have to supply two sets of options to
+ <B
+ CLASS="COMMAND"
+ >delay_parameters</B
+ >: the overall speed and the per-IP speed. The
+ 100kbits per second value is converted to bytes per second by dividing
+ by 8 (giving us the 12500 values), and the per-IP value of 2.5kbits
+ per second we discovered is converted to bytes per second (giving us
+ the 2500 values.)
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2036"><P
+ ><B
+ >Example 6-27. Limiting both overall and per-user bandwidth usage</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl all src 0.0.0.0/0.0.0.0
+ delay_pool_count 1
+ delay_class 1 2
+ delay_parameters 1 12500/12500 2500/2500
+ delay_access 1 allow all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2039">The Third Pool Class</H3
+ ><P
+ >This class is useful to very organizations like Universities. The
+ second pool class lets you stop individual users from flooding your
+ links. A lab full of students all operating at their maximum download
+ rate can, however, still flood the link. Since such a lab (or
+ department, if you are not at a University) will all have IP addresses
+ in the same range, it is useful to be able to put a cap on the
+ download rate of an entire network range. The third pool class lets you do
+ this. Currently this option only works on class-C network ranges, so
+ if you are using variable length subnet masks then this will not help.</P
+ ><P
+ >In the next example we assume that you have three IP ranges. Each
+ range must not use more than 1/3 of your available bandwidth. 
+ For this example I am assuming that you have a 512kbit/s line, and
+ you want 64kbit/s available for SMTP and other protocols. This will
+ leave you with an overall download rate cap of 448kbit/s.) Each
+ Class-C IP range will have about 150kbit/s available.
+ With 3 ranges of 256 IP addresses each, you should have in the region
+ of 500 pc's, which (if calculated exactly) gives you .669kbit per
+ second per machine. Since it is unlikely that all machines will be
+ using the net at the same time, you can probably allocate each machine
+ (say) 4kbit per second (a mere 500 bytes per second).
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2043"><P
+ ><B
+ >Example 6-28. Using Class 3 Delay Pools</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl all src 0.0.0.0/0.0.0.0
+ delay_pool_count 1
+ delay_class 1 3
+ # 56000*8 sets your overall limit at 448kbit/s
+ # 18750*8 sets your per-network limit at 150kbit/s
+ # 500*8 sets your per-user limit at 4kbit/s
+ delay_parameters 1 56000/56000 18750/18750 500/500
+ delay_access 1 allow all</PRE
+ ></DIV
+ ></P
+ ><P
+ >In this example, we changed the delay class of the pool to <B
+ CLASS="COMMAND"
+ >3</B
+ >.
+ The <B
+ CLASS="COMMAND"
+ >delay_parameters</B
+ > option now takes four arguments: the pool
+ number; the overall bandwidth rate; the per-network bandwidth rate and
+ the per-user bandwidth rate.</P
+ ><P
+ >The 4kbit per second limit for users seems a little low. You can
+ increase the per-user limit, but you may find that it's a better idea
+ to change the <B
+ CLASS="COMMAND"
+ >max</B
+ > value instead, so that the limit sets in
+ after only (say) 16kilobytes or so. This will allow small pages to be
+ downloaded as fast as possible, but large pages will be brought down
+ without influencing other users.</P
+ ><P
+ >If you want, you can set the per-user limit to something quite high,
+ or even set them to <B
+ CLASS="COMMAND"
+ >-1</B
+ >, which effectively means that there is
+ no limit. Limits work from right to left, so if I user is sitting
+ alone in a lab they will be limited by their per-user speed. If this
+ value is undefined, they are limited by their per-network speed, and
+ if that is undefined then they are limited by their overall speed.
+ This means that you can set the per-user limit higher than you would
+ expect: if the lab is not busy then they will get good download rates
+ (since they are only limited by the per-network limit).</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2053">Using Delay Pools in Real Life</H3
+ ><P
+ >By combining multiple ACLs, you can do interesting things with delay
+ pools. Here are some examples:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >By using time-based acls, you can limit people's speed during working
+ hours, but allow them full-speed access outside hours.</P
+ ></LI
+ ><LI
+ ><P
+ >Again (with time-based acl lists), you can allocate a very small
+ amount of bandwidth to http during working hours, discouraging people
+ from browsing the Web during office hours. </P
+ ></LI
+ ><LI
+ ><P
+ >By using acls that match specific source IP addresses, you can ensure
+ that sibling caches have full-speed access to your cache.</P
+ ></LI
+ ><LI
+ ><P
+ >You can prioritize access to a limited set of destination sites by
+ using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >dst</I
+ ></SPAN
+ > or <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >dstdomain</I
+ ></SPAN
+ > acl types by inverting the
+ rules we used to slow access to some sites down.</P
+ ></LI
+ ><LI
+ ><P
+ >You can combine username/password access-lists and speed-limits. You
+ can, for example. allow users that have not logged into the cache 
+ access to the Internet, but at a much slower speed than users who have
+ logged in. Users that are logged in get access to dedicated bandwidth,
+ but are charged for their downloads.</P
+ ></LI
+ ></UL
+ ><P
+ >&#13;</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2072">Conclusion</H2
+ ><P
+ >Once your acl system is correctly set up, your cache should
+ essentially be ready to become a functional part of your
+ infrastructure. If you are going to use some of the advanced Squid
+ features (like transparent operation mode, for example),</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN2075">Chapter 7. Cache Hierarchies</H1
+ ><DIV
+ CLASS="SECT1"
+ ><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2077">Introduction</H2
+ ><P
+ >Squid is particularly good at communicating with other caches and
+ proxies. Numerous inter-cache communication protocols are supported,
+ including ICP (Inter-Cache Protocol), Cache-Digests, HTCP (Hyper-Text
+ Cache Protocol) and CARP (Cache Array Routing Protocol). Each of these
+ protocols has specific strengths and weaknesses; they are more suited
+ to some circumstances than others.</P
+ ><P
+ >In this chapter we look at each of the protocols in detail. We also
+ look at the different ways that you can structure your cache
+ hierarchy, and work through the config options that effect cache
+ hierarchies.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2081">Why Peer</H2
+ ><P
+ >The primary function of an inter-cache protocol is to stop object
+ duplication, increasing hit rates. If you have a large network with
+ widely separated caches, you may wish to store objects in each cache
+ even if one of your other caches has it: by keeping objects close to
+ your users, you reduce their network latency (even if you end up
+ "wasting" disk space in the process.)</P
+ ><P
+ >Inter-branch traffic can be reduced by placing a cache at each branch.
+ Since caches can avoid duplicating objects between them, each disk
+ you add to a cache adds space to the overall hierarchy, increasing
+ your hierarchy hit-rate. This is a lot better than simply having
+ caches at branches which do not communicate with one another, since
+ with that setup you end up end up with multiple copies of each cache
+ object; one per server. Clients can also be configured to query
+ another branches cache if their local one goes down, adding
+ redundancy.</P
+ ><P
+ >If overloaded, a central cache machine can become a network
+ bottleneck. Unlike one cache machine, caches in a hierarchy can be close
+ to all parts of the network; they can also handle a much larger load
+ (with a near-linear increase in performance with each added machine).
+ Loaded caches can thus be replaced with clusters of low-load caches,
+ without wasting disk space.</P
+ ><P
+ >Integrating your caches into a public cache hierarchy can increase
+ your hit rate (since you increase your effective disk space by accessing
+ other machine's object stores.) By choosing peers carefully, you can reduce
+ latency, or reduce costs by saving Internet bandwidth (if
+ communicating with your peers is cheaper than going direct to the
+ source.) On the other hand, communicating with peers via loaded (or
+ high-latency) line can slow down your cache. It's best to check your
+ peer response times periodically to check if the peering arrangement
+ is beneficial. You can use the <B
+ CLASS="COMMAND"
+ >client</B
+ > program to check cache
+ response times, and the cache manager (discussed in Chapter 12) to
+ look at Squid's view on the cache.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2088">Peer Configuration</H2
+ ><P
+ >First, let's look at the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >squid.conf</I
+ ></SPAN
+ > options available for
+ hierarchy configuration. We will then work through the most common
+ hierarchy structures, so that you can see the way that the options are
+ used.</P
+ ><P
+ >You use the <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > option to configure the peers that
+ Squid will communicate with. Other options are then used to select
+ which peer to pass a request to.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2094">The cache_peer Option</H3
+ ><P
+ >When communicating with a peer, Squid needs some basic information
+ about how to talk to the machine; the hostname, what ports to send
+ queries to, and so forth. The <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > config line does
+ this. Let's look at an example line:
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2098"><P
+ ><B
+ >Example 7-1. The cache_peer tag</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_peer cache.domain.example parent 3128 3130 default</PRE
+ ></DIV
+ ></P
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > option is split into five fields. The first
+ field (<B
+ CLASS="COMMAND"
+ >cache.domain.example</B
+ >) is the hostname or IP of the
+ cache that is to be queried. The second field indicates the
+ type of relationship, and must be set to either <B
+ CLASS="COMMAND"
+ >parent</B
+ > or
+ <B
+ CLASS="COMMAND"
+ >sibling</B
+ > or <B
+ CLASS="COMMAND"
+ >multicast</B
+ >. The third field sets the HTTP port
+ of the destination server, while the fourth sets the ICP (UDP) query port.
+ The fifth field can contain more than zero or more keywords, although we
+ only use one in the example above; the keyword <B
+ CLASS="COMMAND"
+ >default</B
+ > sets that the
+ cache will be used as the default path to the outside world.
+ If you compiled Squid to support HTCP, your cache will automatically
+ attempt to connect to TCP port <B
+ CLASS="COMMAND"
+ >4827</B
+ > (there is currently no option
+ to change this port value). Cache digests are transferred via the HTTP port
+ specified on the <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line.</P
+ ><P
+ >Here is a summary of the available <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > options:</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >proxy-only. </B
+ >Data retrieved from this remote cache will not be stored locally, but
+ retrieved again on any subsequent request. By default Squid will store
+ objects it retrieves from other caches: by having the object available
+ locally it can return the object fast if it's ever requested again.
+ While this is good for latency, it can be a waste of bandwidth,
+ especially if the other cache is on the same piece of ethernet. In the
+ examples section of this chapter, we use this option when
+ load-balancing between two cache servers.
+ &#13;</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >weight. </B
+ >If more than one cache server has an object (based on the result of
+ an ICP query), Squid decides which cache to get the data from the
+ cache that responded fastest. If you want to prefer one cache over
+ another, you can add a weight value to the preferred cache's config
+ line. Larger values are preferred. Squid times how long each ICP
+ 
+ request takes (in milliseconds), and divides the time by the weight value,
+ using the cache with the smallest result. Your weight value should
+ thus not be an unreasonable value.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >ttl. </B
+ >This tag is covered in the multicast section, later in this chapter.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >no-query. </B
+ >Squid will send ICP requests to all configured caches. The response
+ time is measured, and used to decide which parent to send the HTTP
+ request to. There is another function of these requests: if there is
+ no response to a request, the cache is marked down. If you are
+ communicating with a cache that does not support ICP, you must use the
+ <B
+ CLASS="COMMAND"
+ >no-query</B
+ > option: if you don't, Squid will consider that cache
+ down, and attempt to go directly to the destination server. (If you want,
+ you can set the ICP port on the config line to point to the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >echo</I
+ ></SPAN
+ >
+ port, port 7. Squid will then use this port to check if the machine is
+ available. Note that you will have to configure <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >inetd.conf</I
+ ></SPAN
+ > to
+ support the UDP echo port.) This option is normally used in conjunction
+ with the <B
+ CLASS="COMMAND"
+ >default</B
+ > option.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >default. </B
+ >This sets the host to be the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proxy of last resort</I
+ ></SPAN
+ >. If no other
+ cache matches a rule (due to acl or domain filtering), this cache is
+ used. If you have only one way of reaching the outside world, and it
+ doesn't support ICP, you can use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >default</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >no-query</I
+ ></SPAN
+ >
+ options to ensure that all queries are passed through it. If this
+ cache is then down, the client will see an error message (without
+ these options, Squid would attempt to route around the problem.)</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >round-robin. </B
+ >This option must be used on more than one <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line to
+ be useful. Connections to caches configured with this options are
+ spread evenly (<SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >round-robined</I
+ ></SPAN
+ >) among the caches. This can be
+ used by client caches to communicate with a group of loaded parents,
+ so that load is spread evenly. If you have multiple Internet
+ connections, with a parent cache on each side, you can use this option
+ to do some basic load-balancing of the connections.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >multicast-responder. </B
+ >This option is covered in the multicast section later in this chapter.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >closest-only. </B
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >no-netdb-exchange. </B
+ >If your cache was configured to keep ICMP (ping) timing information
+ with the <B
+ CLASS="COMMAND"
+ >--enable-icmp</B
+ > configure option, your cache will
+ attempt to retrieve the remote machine's ICMP timing information from
+ any peers. If you don't want this to happen (or the remote cache
+ doesn't support it), you can use the <B
+ CLASS="COMMAND"
+ >no-netdb-exchange</B
+ > option
+ to stop Squid from requesting this information from the cache.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >no-delay. </B
+ >
+ Hits from other caches will normally be included into a client's
+ delay-pool information. If you have two caches load-balancing, you
+ don't want the hits from the other cache to be limited. You may also
+ want hits from caches in a nearby hierarchy to come down at full
+ speed, not to be limited as if they were misses. Use the
+ <B
+ CLASS="COMMAND"
+ >no-delay</B
+ > option to ensure that requests come down at their
+ full speed.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >login. </B
+ >Caches can be configured to use usernames and passwords on accesses.
+ To authenticate with a parent cache, you can enter a username and
+ password using this tag. Note that the HTTP protocol makes
+ authenticating to multiple cache servers impossible: you cannot chain
+ 
+ together a string of proxies, each one requiring authentication. You
+ should only use this option if this is a personal proxy.</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2163">Peer Selection</H2
+ ><P
+ >Let's say that you have only one parent cache server: the server at
+ your ISP. In Chapter 3, we configured Squid so that the parent cache
+ server would not be queried for internal hosts, so queries to the
+ internal machines went direct, instead of adding needless load to your
+ parent cache (and the line between you). Squid can use access-control
+ lists to decide which cache to talk to, rather than just the
+ destination domain. With access lists, you can use different caches
+ depending on the source IP, domain, text in the URL and more. The
+ advantages of this flexibility are not immediately obvious (even to
+ me), but some examples are given in th remainder of this chapter.
+ First, however, let's cover filtering by destination domain.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2166">Selecting by Destination Domain</H3
+ ><P
+ >This tag is used to communicate with different caches depending on the
+ domain that the request is destined for. To ensure that you don't
+ query another cache server for your local domain, you can use the
+ following config line:</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2169"><P
+ ><B
+ >Example 7-2. The cache_peer_domain tag</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_peer_domain peer-cache.otherdomain.example !.mydomain.example</PRE
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2172">Selecting with Acls</H3
+ ><P
+ >Squid can also make peer selections based on the results of acl rules.
+ The cache_peer_access line is discussed in the previous chapter. The
+ following example could be used if you want all requests from a
+ specific IP address range to go to a specific cache server (for
+ accounting purposes, for example). In the following example, all
+ requests from the 10.0.1.* range are passed to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache.domain.example</I
+ ></SPAN
+ >,
+ but all other requests are handled directly.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2176"><P
+ ><B
+ >Example 7-3. Using acls to select peers</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl myNet src 10.0.0.0/255.255.255.0
+ acl custNet src 10.0.1.0/255.255.255.0
+ acl all src 0.0.0.0/0.0.0.0
+ cache_peer cache.domain.example parent 3128 3130
+ cache_peer_access cache.domain.example allow custNet
+ cache_peer_access cache.domain.example deny all</PRE
+ ></DIV
+ ></P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2179">Querying an Adult-Site Filtering-cache for Specific URLs</H4
+ ><P
+ >Let's say that you have a separate Adult-Site cache, which filters out
+ urls. The company that maintains the filter list charges by <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >number of queries</I
+ ></SPAN
+ >, so it's in your interest to bypass them for URLs that
+ you know are fine. Their documentation says that you should set their
+ machine up as your default parent, so you create a list of
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >suspect</I
+ ></SPAN
+ > words, and set the cache up to forward requests for any
+ URL that contains one of these words to the filtering cache server. By
+ avoiding the filtering server, you will end up missing a fairly large
+ number of sites. At the same time, however, you don't end up filtering
+ out valid sites that do contain suspect words in the URL.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2184"><P
+ ><B
+ >Example 7-4. Passing suspect urls to a filtering cache</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl suspect_url url_regex "/usr/local/squid/etc/suspect-url-list"
+ acl all src 0.0.0.0/0.0.0.0
+ cache_peer filtercache.domain.example parent 3128 3130
+ cache_peer_access filtercache.domain.example allow suspect_url
+ # all other requests go direct
+ cache_peer_access filtercache.domain.example deny all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2187">Filtering with Cache Hierarchies</H4
+ ><P
+ >ISPs in the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >outer regions</I
+ ></SPAN
+ > quite often peer with large
+ hierarchies in the USA, so as to avoid any extra latency in the USA.
+ Since it's almost certainly faster to get any local data directly from
+ the source, they configure their caches to retrieve data for their
+ local top-level domain directly, rather than via a USA cache.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2191"><P
+ ><B
+ >Example 7-5. Ignoring Hierarchy Caches for a Local Top-Level Domain</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl local-tld dstdomain -i \.za
+ cache_peer cache1.domain.example.us parent 3128 3130
+ cache_peer_access cache1.domain.example.us deny local-tld</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2194">The always_direct and never_direct tags</H4
+ ><P
+ >Squid checks all <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > tags before it checks any
+ <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > tags. If a matching <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > tag is
+ found, Squid will not check the <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > tags, but
+ decides which cache to talk to immediately. This behavior is demonstrated
+ by the following example; here, Squid will attempt to go
+ the machine <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >intranet</I
+ ></SPAN
+ >, even though the same host is also matched by
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >all</I
+ ></SPAN
+ > acl.</P
+ ><DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2203"><P
+ ><B
+ >Example 7-6. Bypassing a parent for a local machine</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_peer cache.otherdomain.example parent 3128 3130
+ acl all src 0.0.0.0/0.0.0
+ acl localmachines dstdomain intranet.mydomain.example
+ never_direct allow all
+ always_direct allow localmachines</PRE
+ ></DIV
+ ><P
+ >Let's work through the logic that Squid uses in the above example, so
+ that you can work out which cache Squid is going to talk to when you
+ construct your own rules.</P
+ ><P
+ >First, let's consider a request destined for the web server
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >intranet.mydomain.example</I
+ ></SPAN
+ >. Squid first works through all the
+ <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > lines; the request is matched by the first (and
+ only) line. The <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > and <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > tags
+ are acl-operators, which means that the first match is considered.
+ In this illustration, the matching line instructs Squid to go directly
+ when the acl matches, so all neighboring peers are ignored for this
+ request. If the line used the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >deny</I
+ ></SPAN
+ > keyword instead of
+ 
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >allow</I
+ ></SPAN
+ >, Squid would have simply skipped on to checking the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >never_direct</I
+ ></SPAN
+ > lines.</P
+ ><P
+ >Now, the second case: a request arrives for an external host. Squid
+ works through the <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > lines, and finds that none of
+ them match. The <B
+ CLASS="COMMAND"
+ >never_direct</B
+ > lines are then checked. The
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >all</I
+ ></SPAN
+ > acl matches the connection, so Squid marks the connection as
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >never to be forwarded directly to the origin server</I
+ ></SPAN
+ >. Squid then
+ works through it's list of peers, trying to find the cache that the
+ request is best forwarded to (servers that have the object are more
+ likely to get the request, as are servers that respond fast). The
+ algorithm that Squid uses to decide which of it's peers to use is
+ discussed shortly.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2221">prefer_direct</H4
+ ><P
+ >&#13;&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2227">hierarchy_stoplist</H4
+ ><P
+ >Squid can be configured to avoid cache siblings when the requested URL
+ contains specific word-lists. The <B
+ CLASS="COMMAND"
+ >hierarchy_stoplist</B
+ > tag
+ normally contains words that occur when the remote page is dynamically
+ generated, such as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cgi-bin</I
+ ></SPAN
+ >, <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >asp</I
+ ></SPAN
+ > or more.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2233">neighbor_type_domain</H4
+ ><P
+ >You can blur the distinction between peers and a siblings with this
+ tag. Let's say that you work for a very large organization, with many
+ regions, some in different countries.</P
+ ><P
+ >These organizations generally have their own network infrastructure:
+ you will install a link to a local regional office, and they will run
+ links to a core backbone. Let's assume that you work for the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >regional</I
+ ></SPAN
+ > office, and you have an Internet line that your various
+ divisions share. You also have a link to your head-office, where they
+ have a large cache, and their own Internet link. You peer with their
+ cache (with them set up as a sibling), and you also peer with your
+ local ISP's server.</P
+ ><P
+ >When you request pages from the outside world, you treat your
+ ISP's cache server as a parent, but when you query web servers in
+ your own domain you want the requests to go to your head-office's
+ cache, so that any web sites within your organization are cached. By
+ using the <B
+ CLASS="COMMAND"
+ >neighbor_type_domain</B
+ > option, you can
+ specify that requests for your local domain are to be passed to your
+ head-office's cache, but other requests are to be passed directly.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2240"><P
+ ><B
+ >Example 7-7. Changing the Cache Type by Destination Domain</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_peer core-cache.mydomain.example sibling 3128 3130
+ cache_peer cache.isp.example parent 3128 3130
+ neighbor_type_domain parent mydomain.example </PRE
+ ></DIV
+ ></P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2243">Other Peering Options</H3
+ ><P
+ >Various other options allow you to tune various values that effect
+ your cache's interaction with hierarchies. These options all effect
+ all peering caches (rather than individual machines).</P
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2246">miss_access</H4
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > tag is an acl-operator. This tag has already
+ been covered in the acls chapter (Chapter 6), but is covered here
+ again for completeness. The <B
+ CLASS="COMMAND"
+ >miss_access</B
+ > tag allows you to
+ create a list of caches which are only allowed to retrieve <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >hits</I
+ ></SPAN
+ >
+ from your cache. If they request an object that is missed, Squid will
+ return an error page denying them access. If the example below is not
+ immediately clear, please refer to Chapter 6 for more information
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2252"><P
+ ><B
+ >Example 7-8. </B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl all src 0.0.0.0/0.0.0.0
+ acl friendly_company src 10.2.0.3/255.255.255.0
+ http_access allow friendly_company
+ icp_access allow friendly_company
+ # This line stops the machine 10.2.0.3 from getting hits from our
+ # cache
+ miss_access deny friendly_company
+ miss_access allow all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2255">dead_peer_timeout</H4
+ ><P
+ >If a peer cache has not responded to an ICP request for
+ <B
+ CLASS="COMMAND"
+ >dead_peer_timeout</B
+ > seconds, the cache will be marked as down,
+ and the object will be retrieved from somewhere else (probably
+ directly from the source.)</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2259">icp_hit_stale</H4
+ ><P
+ >Turning this option on can cause problems if you peer with anyone.&#13;</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2263">Multicast Cache Communication</H2
+ ><P
+ >Cache digests are in some ways a replacement for multicast cache
+ peering. There are some advantages to cache-digests: they are handled
+ at the Squid level (so you don't have to fiddle with kernel multicast
+ settings and so forth), and they add significantly less latency
+ (finding out if a cache has an object simply involves checking an
+ in-memory bit-array, which is significantly faster than checking
+ across the network).</P
+ ><P
+ >First, though, let's cover some terminology. Most people are familiar
+ with the term <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >broadcast</I
+ ></SPAN
+ >, where data is sent from one host to all
+ hosts on the local network. Broadcasts are normally used to discover
+ things, not for general inter-machine transfer: a machine will send out
+ a broadcast ARP request to try and find the hardware address that a
+ specific IP address belongs to. You can also send ping packets to the
+ broadcast address, and find machines on the local network when they
+ respond. Broadcasts only work across physical segments (or
+ bridged/switched networks), so an ARP request doesn't go to every
+ machine on the Internet.</P
+ ><P
+ >A <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >unicast</I
+ ></SPAN
+ > packet is the complete opposite: one machine is talking
+ to only one other machine. All TCP connections are unicast, since they can
+ only have one destination host for each source host. UDP packets are
+ almost always unicast too, though they can be sent to the broadcast address
+ so that they reach every single machine in some cases.</P
+ ><P
+ >A <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >multicast</I
+ ></SPAN
+ > packet is from one machine to one or more. The
+ difference between a multicast packet and a broadcast packet is that
+ hosts receiving multicast packets can be on different lans, and that
+ each multicast data-stream is only transmitted between networks once,
+ not once per machine on the remote network. Rather than each machine
+ connecting to a video server, the multicast data is streamed
+ per-network, and multiple machines just listen-in on the multicast
+ data once it's on the network.</P
+ ><P
+ >This efficient use of bandwidth is perfect for large groups of caches.
+ If you have more than one server (for load-distribution, say), and
+ someone wants to peer with you, they will have to configure their
+ server to send one ICP packet to each of your caches. If Squid gets an
+ ICP request from somewhere, it doesn't check with all of it's peers to
+ see if they have the object. This "check with my peers" behavior only
+ happens when an HTTP request arrives. If you have 5 caches, anyone who
+ wants to find out if your hierarchy has an object will have to send 5
+ ICP requests (or treat you as a parent, so that your caches check with
+ one another). This is a real waste of bandwidth. With a multicast
+ network, though, the remote cache would only send one ICP request,
+ destined for your multicast address. Routers between you would only
+ transfer one packet (instead of 5), saving the duplication of
+ requests. Once on your network, each machine would pick up one packet,
+ and reply with their answer. 
+ 
+ 
+ &#13;</P
+ ><P
+ >Multicast packets are also useful on local networks, if you have the
+ right network cards. If you have a large group of caches on the same
+ network, you can end up with a lot of local traffic. Each request that
+ a cache receives prompts one ICP request to all the other local
+ caches, swamping the local network with small packets (and their
+ replies). A multicast packet, on the other hand, is a kind of
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >broadcast</I
+ ></SPAN
+ > to the machines on the local network. They will each
+ receive a copy of the packet, although only one went out onto the
+ wire. If you have a good ethernet card, the card will handle a fair
+ amount of the filtering (some cards may have to be put into
+ promiscuous mode to pick up all the packets, which can cause load on
+ the machine: make sure that the card you buy supports hardware
+ multicast filters). This solution is still not linearly scalable,
+ however, since the reply packets can easily become the bottleneck by
+ themselves.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2279">Getting your machine ready for Multicast</H3
+ ><P
+ >The kernel's IP stack (the piece of kernel code that handles IP
+ networking) needs to look out for multicast packets, otherwise they will
+ be discarded (either by the network card or the lower levels of the IP
+ stack.) Your kernel may already have multicast support, or you will
+ have to turn it on. Doing this is, unfortunately, beyond the scope of
+ this book, and you may have to root around for a howto guide
+ somewhere.
+ 
+ &#13;</P
+ ><P
+ >Once your machine is setup to receive multicast packets, you need your
+ machines to talk to one another. You can either join the mbone (a
+ virtual multicast backbone), or set up an internal multicast network.
+ Joining the mbone could be a good thing anyway, since you get access
+ to other services. You must be sure not to use a random set of
+ multicast IP addresses, since they may belong to someone else. You can
+ 
+ get your own IP range from the people at the mbone.</P
+ ><P
+ >An outgoing multicast packet has a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >ttl</I
+ ></SPAN
+ > (Time To Live) value,
+ which is used to ensure that loops are not created. Each time a packet
+ passes through a router, the router decrements this ttl value, and the
+ value is then checked. Once the value reaches zero, the packet is dropped.
+ If you want multicast packets to stay on your local network, you would
+ set the ttl value to 1. The first router to see the packet would
+ decrement the packet, discover the ttl was zero and discard it. This
+ value gives you a level of control on how many multicast routers will
+ see the packet. You should set this value carefully, so that you
+ limit packets to your local network or immediate multicast peers
+ (larger multicast groups are seldom of any use: they generate too many
+ responses, and when geographically dispersed, may simply add latency.
+ You also don't want crackers picking up all your ICP requests by
+ joining the appropriate multicast group.)</P
+ ><P
+ >Various multicast debugging tools are available. One of the most
+ useful is <B
+ CLASS="COMMAND"
+ >mtrace</B
+ >, which is effectively a traceroute program
+ for multicast connections. This program should help you choose the
+ right ttl value.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2291">Querying a Multicast Cache</H3
+ ><P
+ >The <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > option traditionally can have two types of
+ cache: a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >parent</I
+ ></SPAN
+ > and a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >sibling</I
+ ></SPAN
+ >. If you are querying a set
+ or multicast caches, you need to use a different tag, the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >multicast</I
+ ></SPAN
+ > cache type. When you send a multicast request to a
+ cache, each of the servers in the group will send you a response
+ packet (from their <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >real</I
+ ></SPAN
+ > IP address.) Squid discards unexpected
+ ICP responses by default, and since it can't determine which ICP
+ replies are valid automatically, you will have to add lines to the
+ Squid config file that stop it rejecting packets from hosts in the
+ multicast group.</P
+ ><P
+ >In the following example, the multicast group <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >224.0.1.20</I
+ ></SPAN
+ >
+ consists of three hosts, at IP addresses <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.11.12.1</I
+ ></SPAN
+ >,
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.11.13.1</I
+ ></SPAN
+ > and <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.11.14.1</I
+ ></SPAN
+ >. These hosts are quite close to
+ your cache, so the <B
+ CLASS="COMMAND"
+ >ttl</B
+ > value is set to 5. 
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2305"><P
+ ><B
+ >Example 7-9. Sending Queries to a Multicast Server</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_peer 224.0.1.20 multicast 3128 3130 ttl=5
+ # these servers belong to the 224.0.1.20 multicast group
+ cache_peer 10.11.12.1 sibling 3128 3130 multicast-responder
+ cache_peer 10.11.13.1 sibling 3128 3130 multicast-responder
+ cache_peer 10.11.14.1 sibling 3128 3130 multicast-responder</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2308">Accepting Multicast Queries: The mcast_groups option</H3
+ ><P
+ >As a multicast server, Squid needs to listen out for the right packets.
+ Since you can have more than one multicast group on a network, you need
+ to configure Squid to listen to the right multicast-group (the IP that you
+ have allocated to Squid.) The following (very simple) example is from
+ the config of the server machine <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >10.11.12.1</I
+ ></SPAN
+ > in the example above.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2312"><P
+ ><B
+ >Example 7-10. Listening for Multicast Queries</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >multicast_groups 224.0.1.20</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2315">Other Multicast Cache Options</H3
+ ><DIV
+ CLASS="SECT3"
+ ><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2317">The mcast_icp_query_timeout Option</H4
+ ><P
+ >As you may recall, Squid will wait for up to <B
+ CLASS="COMMAND"
+ >dead_peer_timeout</B
+ >
+ seconds after sending out an ICP request before deciding to ignore a
+ peer. With a multicast group, peers can leave and join at will, and it
+ should make no difference to a client. This presents a problem for
+ Squid: it can't wait for a number of seconds each time (what if the
+ caches are on the same network, and responses come back in
+ milliseconds: the waiting just adds latency.) Squid gets around this
+ problem by sending ICP <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >probes</I
+ ></SPAN
+ > to the multicast address
+ occasionally. Each host in the group responds to the probe, and Squid
+ will know how many machines are currently in the group. When sending a
+ real request, Squid will wait until it gets at least as many responses
+ as were returned in the last probe: if more arrive, great. If less
+ arrive, though, Squid will wait until the <B
+ CLASS="COMMAND"
+ >dead_peer_timeout</B
+ >
+ value is reached. If there is still no reply, Squid marks that peer as
+ down, so that all connections are not held up by one peer.</P
+ ><P
+ >When Squid sends out a multicast query, it will wait at most
+ <B
+ CLASS="COMMAND"
+ >mcast_icp_query_timeout</B
+ > seconds (it's perfectly possible that
+ one day a peer will be on the moon: and it would probably be a bad
+ idea to peer with that cache seriously, unless it was a parent for the
+ Mars top-level domain.) It's unlikely that you will want to increase
+ this value, but you may wish to drop it, so that only reasonably
+ speedy replies are considered.
+ 
+ &#13;</P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2328">Cache Digests</H2
+ ><P
+ >Cache digests are one of the latest peering developments. Currently
+ they are only supported by Squid, and they have to be turned on at
+ compile time.</P
+ ><P
+ >Squid keeps it's "list" of objects in an in-memory hash. The hash
+ table (which is based on MD5) helps Squid find out if an object is in
+ the cache without using huge amounts of memory or reading files on
+ disk. Periodically Squid takes this table of objects and summarizes it
+ into a small bitmap (suitable for transfer across a modem). If a bit in
+ the map is on, it means that the object is in the store, if it's off,
+ the object is not. This bitmap/summary is available to other caches,
+ which connect on the HTTP port and request a special URL. If the
+ client cache (the one that just collected the bitmap) wants to know if
+ the server has an object, it simply performs the same mathematical
+ function that generated the values in the bitmap. If the server
+ has the object, the appropriate bit in the bitmap will be defined.</P
+ ><P
+ >There are various advantages to this idea: if you have a set of loaded
+ caches, you will find that inter-cache communication can use
+ significant amounts of bandwidth. Each request to one cache sparks off
+ a series of requests to all neighboring caches. Each of these queries
+ also causes some server load: the networking stack has to deal with
+ these extra packets, for one thing. With cache-digests, however, load
+ is reduced. The cache digest is generated only once every 10 minutes
+ (the exact value is tunable). The transfer of the digest thus happens
+ 
+ fairly seldom, even if the bitmap is rather large (a few 100kbytes is
+ common.) If you were to run 10 caches on the same physical network,
+ however, with each ICP request being a few hundred bytes, the numbers
+ add up. This network load reduction can give your cache time to
+ breathe too, since the kernel will not have to deal with as many small
+ packets.</P
+ ><P
+ >ICP packets are incredibly simple: they essentially contain only the
+ requested URL. Today, however, a lot of data is transferred in the
+ headers of a request. The contents of a static URL may differ
+ depending on the browser that a user uses, cookie values and more.
+ Since the ICP packet only contains the URL, Squid can only check the
+ URL to see if it has the object, not both the headers and the URL.
+ This can (very occasionally) cause strange problems, with the wrong
+ pages being served. With cache digests, however, the bitmap value
+ depends on both the headers AND the url, which stops these strange
+ hits of objects that are actually generated on-the-fly (normally these
+ pages contain <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cgi-bin</I
+ ></SPAN
+ > in their path, but some don't, and cause
+ problems.)</P
+ ><P
+ >Cache digests can generate a small percentage of false hits: since the
+ list of objects is updated only every 10 minutes, your cache could
+ expire an object a second after you download the summarized index. For
+ the next ten minutes, the client cache would believe your server has
+ 
+ data that it doesn't. Some five percent of hits may be false, but
+ they are simply retrieved directly from the origin server if this
+ turns out to be the case.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2338">Cache Hierarchy Structures</H2
+ ><P
+ >Deciding what hierarchy structure to use is difficult. Not only that,
+ but it's quite often very difficult to change, since you can have
+ thousands of clients accessing you directly, and even more through
+ your peers.</P
+ ><P
+ >Here, I cover the most common cache-peer architectures. We start off
+ with the most simple setup that's considered peering: two caches talking
+ to one another as siblings. I am going to try and cover all the issues
+ with this simple setup, and then move to larger cache meshes.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2342">Two Peering Caches</H3
+ ><P
+ >We have two caches, your cache and their cache. You have a nice fast
+ link between them, with low-latency, both caches have quite a lot of
+ disk space, and they aren't going to be running into problems with
+ load anytime soon. Let's look at the peering options you have:</P
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >ICP peering. </B
+ >ICP is the obvious choice here; the low latency line means that
+ checking with the other cache doesn't cause significant added latency,
+ and the server on the other side isn't going to become a limiting
+ factor soon.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Multicast ICP peering. </B
+ >Multicast is not really useful here. Multicast is useful only when
+ your cache is talking to lots of other caches. With one cache on the
+ other side, the setup time for multicast doesn't seem worth it. If you
+ got some other benefit from the multicast configuration
+ (video conferencing, for example), then things would become more
+ worthwhile. In the meantime, however, there is no significant
+ bandwidth or load saving advantage to using multicast.</P
+ ></DIV
+ ><DIV
+ CLASS="FORMALPARA"
+ ><P
+ ><B
+ >Cache Digests. </B
+ >Cache digests are normally quite large. By the sounds if this, the
+ caches are not very busy. Transferring digest summaries between the
+ caches may use more bandwidth than you think. ICP queries are only
+ sent when an object is requested, but cache-digests are retrieved
+ automatically throughout the day and night. If the cache is
+ transferring less than the digest size in a ten minute period, you
+ should probably use ICP. If the line was high-latency, you should
+ consider digests more carefully: high-latency lines are normally
+ better at bulk-data transfer than at sending lots of small packets.
+ With a high-latency link, Squid can spend so much time waiting for
+ returning ICP packets that browsing feels slow. With cache-digests,
+ the cache would know if the remote side has the object or not, at the
+ cost of more bandwidth.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT3"
+ ><HR><H4
+ CLASS="SECT3"
+ ><A
+ NAME="AEN2354">Things to Watch Out For</H4
+ ><P
+ >The most common problem with this kind of setup is the "continuous
+ object exchange". Let's say that your cache has an object. A user of
+ 
+ 
+ 
+ 
+ their cache wants the object, so they retrieve it from you. A few
+ hours later you expire the object. The next day, one of your users
+ requests the object. Your cache checks with the other cache and finds
+ that it does, indeed, have the object (it doesn't realize that it was
+ the one that retrieved the object in the first place). It retrieves
+ the object. Later on the whole process repeats itself, with their
+ cache getting the object from you again. To stop this from happening,
+ you may have to use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proxy-only</I
+ ></SPAN
+ > option to the
+ <B
+ CLASS="COMMAND"
+ >cache_peer</B
+ > line on both caches. This way, the caches simply
+ retrieve their data from the fast sibling cache each time: if that
+ cache expires the object, the object cannot return from the other
+ cache, since it was never saved there.</P
+ ><P
+ >With ICP, there is a chance that an object that is <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >hit</I
+ ></SPAN
+ > is
+ dynamically generated (even if the path does not say so). Cache
+ digests fix this problem, which may make their extra bandwidth usage
+ worthwhile.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2365">Trees</H3
+ ><P
+ >The traditional cache hierarchy structure involves lots of small
+ servers (with their own disk space, each holding the most common
+ objects) which query another set of large parent servers (there can
+ even be only one large server.) These large servers then query the
+ outside on the client cache's behalf. The large servers keep a copy of
+ the object so that other internal caches requesting the page get it
+ from them. Generally, the little servers have a small amount of disk
+ space, and are connected to the large servers by quite small lines.</P
+ ><P
+ >This structure generally works well, as long as you can stop the
+ top-level servers from becoming overloaded. If these machines have
+ problems, all performance will suffer.</P
+ ><P
+ >Client caches generally do not talk to one another at all. The parent
+ cache server should have any object that the lower-down cache may have
+ (since it fetched the object on behalf of the lower-down cache). It's
+ invariably faster to communicate with the head-office (where the core
+ servers would be situated) than another region (where another sibling
+ cache is kept).</P
+ ><P
+ >In this case, the smaller servers may as well treat the core servers
+ as <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >default</I
+ ></SPAN
+ > parents, even using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >no-query</I
+ ></SPAN
+ > option, to
+ reduce cache latency. If the head-office is unreachable it's quite
+ likely that things may be unusable altogether (if, on the other hand,
+ your regional offices have their own Internet lines, you can configure
+ the cache as a normal parent: this way Squid will detect that the core
+ servers are down, and try to go direct. If you each have your own
+ Internet link, though, there may not be a reason to use a tree
+ structure. You might want to look at the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mesh</I
+ ></SPAN
+ > section instead,
+ which follows shortly.)</P
+ ><P
+ >To avoid overloading one server, you can use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >round-robin</I
+ ></SPAN
+ >
+ option on the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache_peer</I
+ ></SPAN
+ > lines for each core server. This way, the
+ load on each machine should be spread evenly.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2377">Meshes</H3
+ ><P
+ >Large hierarchies generally use either a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >tree</I
+ ></SPAN
+ > structure, or they
+ are <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >true meshes</I
+ ></SPAN
+ >. A true mesh considers all machines equal: there
+ is no set of large root machines, mainly since they are almost
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >all</I
+ ></SPAN
+ > large machines. Multicast ICP and Cache digests allow large
+ meshes to scale well, but some meshes have been around for a long
+ time, and are only using vanilla ICP.</P
+ ><P
+ >Cache digests seem to be the best for large mesh setups these days:
+ they involve bulk data transfer, but as the average mesh size
+ increases machines will have to be more and more powerful to deal with
+ the number of queries coming in. Instead of trying to deal with so
+ many small packets, it is almost certainly better to do a larger
+ transfer every 10 minutes. This way, machines only have to check their
+ local ram to see which machines have the object.</P
+ ><P
+ >Pure multicast cache meshes are another alternative: unfortunately
+ there are still many reply packets generated, but it still effectively
+ halves the number of packets flung around the network.&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2386">Load Balancing Servers</H3
+ ><P
+ >Sometimes, a single server cannot handle the load required. DNS or
+ CARP load balancing will allow you to split the load between two (or
+ more) machines.</P
+ ><P
+ >DNS load balancing is the simplest option: In your DNS file, you
+ simply add <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >two</I
+ ></SPAN
+ > A records for the cache's hostname (you did use a
+ hostname for the cache when you configured all those thousands of
+ browsers like I told you, right?) The order that the DNS server returns
+ the names in is continuously, randomly switched, and the client
+ requesting the lookup will connect to a random server. These server
+ machines can be setup to communicate with one-another as peers. By
+ using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >proxy-only</I
+ ></SPAN
+ > option, you reduce duplication of objects
+ between the machines, saving disk space (and, hopefully, increasing
+ your hit rate.)</P
+ ><P
+ >There are other load-balancing options. If you have client
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >caches</I
+ ></SPAN
+ > accessing the overloaded server (rather than client
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >pcs</I
+ ></SPAN
+ >), you can configure Squid on these machines with the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >round-robin</I
+ ></SPAN
+ > option on the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache_peer</I
+ ></SPAN
+ > lines. You could also
+ use the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >CARP</I
+ ></SPAN
+ > (Cache Array Routing Protocol) to split the load
+ unevenly (if you have one very powerful machine and two less powerful
+ machines, you can use CARP to load the fast cache twice as much as the
+ other machines).</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2398">The Cache Array Routing Protocol (CARP)</H2
+ ><P
+ >The CARP protocol uses a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >hash function</I
+ ></SPAN
+ > to decide which cache a
+ request is to be forwarded to. When a request is to be sent out, the
+ code takes the URL requested and feeds it through a formula that
+ essentially generates a large number from the text of the URL. A
+ different URL (even if it differs by only one character) is likely to
+ end up as a very different number (it won't, for example, differ by
+ one). If you take 50 URLs and put them through the function, the
+ numbers generated are going to be spread far apart from one another,
+ and would be spread evenly across a graph. The numbers generated, however,
+ all fit in a certain range. Because the number are spread across the
+ range evenly, we can split the range into two, and the same number of
+ URLs will have ended up in the first half as the second.</P
+ ><P
+ >Let's say that we create a rule that effectively says: "I have two
+ caches. Whenever I receive a request, I want to pass it to one of
+ these caches. I know that any number generated by the hash function
+ will be less than X, and that numbers are as likely to fall above
+ one-half X as below. By sending all requests that hash to less than
+ one-half X to cache one, and the remaining requests to cache two, the
+ load should be even."</P
+ ><P
+ >To terminology: the total range of numbers is split into equally large
+ number ranges (called buckets).</P
+ ><P
+ >Let's say that we have two caches, again. This time, though, cache one
+ is able to handle twice the load of cache two. If we split the hash
+ space into three ranges, and allocate buckets one and three to cache one
+ (and bucket two to cache two), a URL will have twice the chance of
+ going to cache one as it does to cache two.</P
+ ><P
+ >Squid caches can talk to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >parent</I
+ ></SPAN
+ > caches using CARP balancing
+ if CARP was enabled when the source was configured (using the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >./configure --enable-carp</I
+ ></SPAN
+ > command.)</P
+ ><P
+ >The load-factor values on all cache_peer lines must add up to 1.0. The
+ below example splits 70% of the load onto the machine
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >bigcache.mydomain.example</I
+ ></SPAN
+ >, leaving the other 30% up to the other
+ cache.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2410"><P
+ ><B
+ >Example 7-11. Using CARP Load Factor variables</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >cache_peer smallcache.mydomain.example parent 3128 3130 carp-load-factor=0.3
+ cache_peer bigcache.mydomain.example parent 3128 3130 carp-load-factor=0.70</PRE
+ ></DIV
+ ></P
+ ><P
+ >Now that your cache is integrated into a hierarchy (or is a
+ hierarchy!), we can move to the next section. Accelerator mode allows
+ your cache to function as a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >front-end</I
+ ></SPAN
+ > for a real web server,
+ speeding up web page access on those old servers.</P
+ ><P
+ >Transparent caches effectively accelerate web servers from a distance
+ (the code, at least, to perform both functions is effectively the
+ same.) If you are going to do transparent proxying, I suggest that you
+ read the next two Chapters. If you aren't interested in either of
+ these Squid features, your Squid installation should be up and
+ running. The remainder of the book (Section III) covers cache
+ maintenance and debugging.</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN2416">Chapter 8. Accelerator Mode</H1
+ ><P
+ >Some cache servers can act as web servers (or vis versa). These
+ servers accept requests in both the standard web-request format
+ (where only the path and filename are given), and in the proxy-specific
+ format (where the entire URL is given).</P
+ ><P
+ >The Squid designers have decided not to let Squid be configured in
+ this way. This avoids various complicated issues, and reduces code
+ complexity, making Squid more reliable. All in all, Squid is a web
+ cache, not a web server.</P
+ ><P
+ >By adding a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >translation</I
+ ></SPAN
+ > layer into Squid, we can accept (and
+ understand) web requests, since the format is essentially the same.
+ The additional layer can re-write incoming web requests, changing the
+ destination server and port. This re-written request is then treated
+ as a normal request: the remote server is contacted, the data
+ requested and the results cached. This lets you get Squid to pretend
+ to be a web server, re-writing requests so that they are passed on to
+ some other web server.</P
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2422">When to use Accelerator Mode</H2
+ ><P
+ >Accelerator mode should not be enabled unless you need it. There are a
+ limited set of circumstances in which it is needed, so if one of the
+ following setups applies to you, you should have a look at the
+ remainder of this chapter.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2425">Acceleration of a slow server</H3
+ ><P
+ >Squid can sit in front of a slow server, caching the server's results
+ and passing the data on to clients. This is very useful when the
+ origin server (the server that is actually serving the original data) is
+ very slow, or is across a slow line). If the origin server is across a
+ slow line, you could just move the origin server closer to the
+ clients, but this may not be possible for administrative reasons.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2428">Replacing a combination cache/web server with Squid</H3
+ ><P
+ >If you are in the process of replacing a combination cache/web server,
+ your client machines may be configured to talk to the cache on port
+ 80. Rather than reconfiguring all of you clients, you can get Squid to
+ listen for incoming connections on port 80 (moving the real server to
+ another port or server.) When Squid finds that it's received a web
+ request, it will forward the request to the origin server, so that the
+ machine continues to function as both a web and cache server.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2431">Transparent Caching</H3
+ ><P
+ >Squid can be configured to <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >magically</I
+ ></SPAN
+ > intercept outgoing web
+ requests and cache them. Since the outgoing requests are in web-server
+ format, it needs to translate them to cache-format requests.
+ Transparent caching is covered in detail in the following section.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2435">Security</H3
+ ><P
+ >Squid can be placed in front of an insecure web server to protect it
+ from the outside world: not merely to stop unwanted clients from
+ accessing the machine, but also to stop people from exploiting bugs in
+ the server code.&#13;</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2439">Accelerator Configuration Options</H2
+ ><P
+ >The list of accelerator options is short, and setup is fairly simple.
+ Once we have a working accelerator cache, you will have to create the
+ appropriate access-list rules. (Since you probably want people outside
+ your local network to be able to access your server, you cannot simple
+ use source-IP address rulesets anymore.)</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2442">The httpd_accel_host option</H3
+ ><P
+ >You will need to set the hostname of the accelerated server here. It's
+ only possible to have one destination server, so you can only have one
+ occurence of this line. If you are going accelerate more than one
+ server, or transparently cache traffic (as described in the next
+ chapter), you will have to use the word <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >virtual</I
+ ></SPAN
+ > instead of a
+ hostname here.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2446">The httpd_accel_port option</H3
+ ><P
+ >Accelerated requests can only be forwarded to one port: there is no
+ table that associates accelerated hosts and a destination port. Squid
+ will connect to the port that you set the <B
+ CLASS="COMMAND"
+ >httpd_accel_port</B
+ >
+ value to. When acting as a front-end for a web server on the local
+ machine, you will set up the web server to listen for connections on a
+ different port (8000, for example), and set this squid.conf option to
+ match the same value. If, on the other hand, you are forwarding requests
+ to a set of slow backend servers, they will almost certainly be
+ listening to port 80 (the default web-server port), and this option
+ will need to be set to 80.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2450">The httpd_accel_with_proxy option</H3
+ ><P
+ >If you use the <B
+ CLASS="COMMAND"
+ >httpd_accel_host</B
+ > option, Squid
+ will stop recognizing <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache</I
+ ></SPAN
+ > requests. So that
+ your cache can function both as an accelerator and as a web cache,
+ you will need to set the <B
+ CLASS="COMMAND"
+ >httpd_accel_with_proxy</B
+ >
+ option to <B
+ CLASS="COMMAND"
+ >on</B
+ >.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2457">The httpd_accel_uses_host_header option</H3
+ ><P
+ >A normal HTTP request consists of three values: the type of transfer
+ (normally a GET, which is used for downloads); the path and filename
+ to be retrieved (or executed, in the case of a cgi program); and the
+ HTTP version.</P
+ ><P
+ >This layout is fine if you only have one web site on a machine. On
+ systems where you have more than one site, though, it makes life
+ difficult: the request does not contain enough information, since it
+ doesn't include information about the destination domain. Most
+ operating systems allow you to have <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >IP aliases</I
+ ></SPAN
+ >, where you
+ have more than one IP address per network card. By allocating one IP
+ per hosted site, you could run one web server per IP address. Once the
+ programs were made more efficient, one running program could act as a
+ server for many sites: the only requirement was that you had one IP
+ address per domain. Server programs would find out which of the IP
+ addresses clients were connected to, and would serve data from
+ different directories for each IP.</P
+ ><P
+ >There are a limited number of IP addresses, and they are fast running
+ out. Some systems also have a limited number of IP aliases, which
+ means that you cannot host more than a (fairly arbitrary) number of
+ web sites on machine. If the client were to pass the destination host
+ name along with the path and filename, the web server could listen to
+ only one IP address, and would find the right destination directores
+ by looking in a simple hostname table.</P
+ ><P
+ >From version 1.1 on, the HTTP standard supports a special <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >Host</I
+ ></SPAN
+ >
+ header, which is passed along with every outgoing request. This header
+ also makes transparent caching and acceleration easier: by pulling the
+ host value out of the headers, Squid can translate a standard
+ HTTP request to a cache-specific HTTP request, which can then be
+ handled by the standard Squid code. Turning on the
+ <B
+ CLASS="COMMAND"
+ >httpd_accel_uses_host_header</B
+ > option enables this translation.
+ You will need to use this option when doing transparent caching.</P
+ ><P
+ >It's important to note that acls are checked <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >before</I
+ ></SPAN
+ > this
+ translation. You must combine this option with strict source-address
+ checks, so you cannot use this option to accelerate multiple backend
+ servers (this is certain to change in a later version of Squid).</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2468">Related Configuration Options</H2
+ ><P
+ >So far, we have only covered the Config options that directly
+ relate to accelerator mode.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2471">The redirect_rewrites_host_header option</H3
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2474">Refresh patterns</H3
+ ><P
+ >Accelerating a slow web server is only useful if the cache can keep
+ copies of returned pages (so that it can avoid contacting the back-end
+ server.) Since you know about the backend server, you can specify
+ refresh patterns that suit the machine exactly. Refresh patterns
+ aren't covered here (they are covered in-depth in Chapter 11), but
+ it's worth looking at how your site changes, and tuning your refresh
+ patterns to match.</P
+ ><P
+ >If, on the other hand, you are using simply using accelerator mode to
+ replace a combination cache (or to act as a secure front-end for
+ another server), you can disable caching of that site altogether:
+ otherwise you simply end up duplicating data (once on the origin site,
+ once for the cached copy) with no benefit.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2478">Access Control</H3
+ ><P
+ >Presumably you will want people from outside your network to be able
+ to access the web server that Squid is accelerating. If you have based
+ your access lists on the examples in this book, you will find that
+ machines on the outside cannot access the site being accelerated. The
+ accelerated request is treated exactly like a normal http request, so
+ people accesing the site from the outside world will be rejected since
+ your acl rules deny access from IPs that are not on your network. By
+ using the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >dst</I
+ ></SPAN
+ > acl type, you can add specific exclusions to your
+ access lists to allow requests to the accelerated host.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2482"><P
+ ><B
+ >Example 8-1. Before Accelerator Configuration</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >acl all src 0.0.0.0/0.0.0.0
+ acl myNet src 10.0.0.0/255.255.255.0
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ><P
+ >In the following example, we have changed the config so that the first
+ rule matches (and allows) any request to the machine at IP 10.0.0.5,
+ the accelerated machine. If we did not have the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >port</I
+ ></SPAN
+ > acl in the
+ below rules, someone could request a URL with a different port number
+ with a request that explicitly specifies a non-standard port. If we
+ were to leave out this rule, it could let a system cracker poke around
+ the system with requests for things like
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >http://server.mydomain.example:25</I
+ ></SPAN
+ >.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2488"><P
+ ><B
+ >Example 8-2. After Accelerator Configuration</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ ># the remote server is at 10.0.0.5, port 80
+ httpd_accel_host 10.0.0.5
+ httpd_accel_port 80
+ acl all src 0.0.0.0/0.0.0.0
+ acl myNet src 10.0.0.0/255.255.255.0
+ acl acceleratedHost dst 10.0.0.5
+ acl acceleratedPort port 80
+ # requests must be the the right host AND the right port to be allowed:
+ http_access allow acceleratedHost acceleratedPort
+ # if they aren't accelerated requests, are they at least from my
+ # network?
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2491">Example Configurations</H2
+ ><P
+ >Let's cover two example setups: one, where you are simply using
+ Squid's accelerator function so that the machine has both a web server
+ and a cache server on port 80; two, where you are using Squid as an
+ accelerator to speed up a slow machine.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2494">Replacing a Combination Web/Cache server</H3
+ ><P
+ >First, let's cover the most common use of <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >accelerator mode</I
+ ></SPAN
+ >:
+ replacing a combination web/cache server with Squid. When Squid is
+ acting as an accelerator (speeding up a slow web server), Squid will
+ accept requests on port 80 (on any IP address) and pass them to a
+ cache server on a different machine (also on port 80). Since it's
+ unlikely that you want to use two machines where you can use one
+ (unless you are changing to Squid due to server overload), we will
+ need to configure Squid to pass requests to the local machine.</P
+ ><P
+ >Squid will need to accept incoming requests on port 80 (using the
+ <B
+ CLASS="COMMAND"
+ >http_port</B
+ > option), and pass the requests on to the web server
+ on another port (since only one process can listen for requests on port
+ 80 at a time). I normally get web servers to listen for requests on
+ port <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >8000</I
+ ></SPAN
+ >.</P
+ ><P
+ >Since you want Squid to function both as an accelerator and as a cache
+ server, you will need to use the <B
+ CLASS="COMMAND"
+ >httpd_accel_with_proxy</B
+ >
+ option.</P
+ ><P
+ >The cache in this example is the local machine: there is almost
+ certainly no reason to cache results from this server. I could have
+ used an extremely conservative <B
+ CLASS="COMMAND"
+ >refresh_pattern</B
+ > in the below
+ example, but instead I decide to use the <B
+ CLASS="COMMAND"
+ >no_cache</B
+ > tag:
+ this way I can make use of my predefined acl. The
+ <B
+ CLASS="COMMAND"
+ >always_direct</B
+ > tag in the below example will be very useful if
+ you have a peer cache: you don't want the request passed on to a peer
+ machine.
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2507"><P
+ ><B
+ >Example 8-3. Forwarding Web Requests to a Server on the Same Machine</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >http_port 80
+ # forward incoming requests to localhost, port 8000
+ httpd_accel_host 127.0.0.1
+ acl acceleratedHost dst 127.0.0.1/255.255.255.255
+ httpd_accel_port 8000
+ acl acceleratedPort port 8000
+ httpd_accel_with_proxy on
+ acl all src 0.0.0.0/0.0.0.0
+ acl myNet src 10.0.0.0/255.255.255.0
+ # we don't want to cache localhost: it's a waste of disk space
+ no_cache deny acceleratedHost
+ # we also don't want requests for localhost passed on to a peer
+ always_direct allow acceleratedHost
+ # Allow requests when they are to the accelerated machine AND to the
+ # right port
+ http_access allow acceleratedHost acceleratedPort
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2510">Accelerating Requests to a Slow Server</H3
+ ><P
+ >When accelerating a slow server, you may find that communicating with
+ peer caches is faster than communicating with the accelerated host.
+ In the following example, we remove all the options that stop Squid
+ from caching the server's results. We also assume that the accelerated
+ host is listening on port 80, since there is no conflict with Squid
+ trying to listen to the same port.</P
+ ><P
+ >Once you have tested that connecting to Squid brings up the correct
+ pages, you will have to change the DNS entry to point to your cache
+ server. 
+ 
+ <DIV
+ CLASS="EXAMPLE"
+ ><A
+ NAME="AEN2514"><P
+ ><B
+ >Example 8-4. Accelerating a Slow Server</B
+ ></P
+ ><PRE
+ CLASS="PROGRAMLISTING"
+ >http_port 80
+ # forward incoming requests to 10.0.0.5, port 80
+ httpd_accel_host 10.0.0.5
+ acl acceleratedHost dst 10.0.0.5/255.255.255.255
+ httpd_accel_port 80
+ acl acceleratedPort port 8000
+ httpd_accel_with_proxy on
+ acl all src 0.0.0.0/0.0.0.0
+ acl myNet src 10.0.0.0/255.255.255.0
+ # since we want to try get accelerated pages through peers, and we
+ # want to cache the results, we remove the no_cache and always_direct
+ # options
+ # Allow requests when they are to the accelerated machine AND to the
+ # right port
+ http_access allow acceleratedHost acceleratedPort
+ http_access allow myNet
+ http_access deny all</PRE
+ ></DIV
+ ></P
+ ><P
+ ></P
+ ></DIV
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN2519">Chapter 9. Transparent Caching</H1
+ ><P
+ >When you implement disk caching in an Operating System Kernel, all
+ applications automatically see the benefit: the data caching happens
+ without their knowledge. Since the Operating System ensures that
+ on-disk copies of data are always the same as the cached copies, the
+ data that an application reads is never out of date.</P
+ ><P
+ >With web caching, however, there is a chance that the original data
+ can change without the cache knowing. Squid uses refresh patterns
+ (described in chapter 11) to decide when cached objects are to
+ be removed. If these rules are too agressive, you could end up
+ serving stale objects to clients. Even if these rules are perfect,
+ an incorrectly configured source-server could get Squid to return
+ old objects. Because users <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >could</I
+ ></SPAN
+ > retrieve an out of date page,
+ you should not implement caching without their knowledge.</P
+ ><P
+ >Squid can be configured to act <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >transparently</I
+ ></SPAN
+ >. In
+ this mode, clients will not configure their browsers to access
+ the cache, but Squid will <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >transparently</I
+ ></SPAN
+ >
+ pick up the appropriate packets and cache requests. This solves
+ the biggest problem with caching: getting users to use the cache
+ server. Users hardly ever know how to configure their browsers to
+ use a cache, which means that support staff have to spend time with
+ every user getting them to change their settings. Some users are
+ worried about their privacy, or they think (that since it's a host
+ between them and the Internet) that the cache is slower (certainly
+ not the case, as a few tests with the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >client</I
+ ></SPAN
+ >
+ program will show).</P
+ ><P
+ >However: transparent caching isn't really transparent. The
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >cache setup</I
+ ></SPAN
+ > is transparent, but using the cache isn't.
+ Users will notice a difference in error messages, and even the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >progress bars</I
+ ></SPAN
+ > that browsers show can act differently.</P
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2531">The Problem with Transparency</H2
+ ><P
+ >When Squid transparently caches a site, the source IP address of
+ the connection changes: the request comes from the cache server
+ rather than the client machine. This can play havoc with web sites
+ that use IP-address authentication (such sites only allow requests
+ from a small set of IP addresses, rather than authenticating requests
+ with a name and password.)</P
+ ><P
+ >Since the cache changes the source IP address of the connection, some
+ servers may deny legitimate users access. In many cases, this will
+ cost users money (they may pay for the service, or use the information
+ on that site to make money.)</P
+ ><P
+ >If you know your network inside out, and know exactly who would be
+ accessing a site like this, there is probably no problem with using
+ transparent caching. If this is the case, though, it might be easier
+ to simply change all of your users' settings.</P
+ ><P
+ >Dialup ISPs generally have little problem implementing transparent
+ caching, since dialup customers almost always get a different IP
+ address whenever they connect. They cannot thus access sites which
+ require a static IP address, so when requests start coming from the
+ cache server there is no problem.</P
+ ><P
+ >ISPs which transparently cache leased-line customers are the most
+ likely to have problems with IP-authenticating servers.  If you are
+ phasing transparency in for such an ISP, you must make sure that
+ your customers know all the implications. They must know how to
+ refresh pages (and who to tell if they find such out-of-date pages,
+ so that the Squid refresh rules can be changed), and how the source
+ IP address is going to change. You must <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >not</I
+ ></SPAN
+ > simply install
+ the transparent cache and hope for the best!</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2539">The Transparent Caching Process</H2
+ ><P
+ >Let's look at what happens when you use transparency. First, though,
+ you need to know something of what happens to IP packets at the
+ ethernet level.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2542">Some Routing Basics</H3
+ ><P
+ >An ethernet IP packet contains four addresses:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >The destination <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mac</I
+ ></SPAN
+ > address. When a packet is transmitted down
+ the ethernet wire, all ethernet cards on the network will check the
+ destination mac address value. Each ethernet has a (supposedly) unique
+ mac address. If the ethernet card's mac address matches the
+ destination mac address of the packet, the ethernet card will pass the
+ packet to the operating system, which will then deal with the contents
+ of the packet.</P
+ ></LI
+ ><LI
+ ><P
+ >The source <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mac</I
+ ></SPAN
+ > address: set by the sending ethernet card</P
+ ></LI
+ ><LI
+ ><P
+ >The destination IP address: set by the application sending the packet.</P
+ ></LI
+ ><LI
+ ><P
+ >The source <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >IP</I
+ ></SPAN
+ > address: set by the operating system of the
+ <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >source</I
+ ></SPAN
+ > host (or, in some circumstances, the application on the
+ source machine.) This value is not changed by routers along the way,
+ routers re-forward the contents of the packet intact, and change only
+ the destination mac addresses. If the source address was changed by
+ each router, the routers would have to keep state of all the
+ connections passing through it. This way, it can simply forward
+ packets and forget about them.</P
+ ></LI
+ ></UL
+ ><P
+ >When a host wants to communicate with a machine that isn't on
+ the local network, it uses a smart <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >router</I
+ ></SPAN
+ >
+ to find the path to that network. When the client wants to send
+ a packet <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >through</I
+ ></SPAN
+ > a router, the client sets
+ the destination <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mac address</I
+ ></SPAN
+ > of the packet to
+ the router's interface, and sets the IP destination address to the
+ required end host. It's important to know that the destination IP
+ address of the packet isn't set to the router's IP address, only
+ the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >mac</I
+ ></SPAN
+ > address is changed.
+ 
+ 
+ 
+ When a router accepts a packet, it decides which host to forward
+ it to, based on it's routing tables. The router then sets the
+ destination mac address of the packet to the next-hop router's
+ ethernet address, and sends the packet to that machine. The remote
+ host then repeats this process: if it's the destination machine,
+ it uses the packet, but if it's another router, it will try and
+ move the packet closer to it's final destination.&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2564">Packet Flow with Transparent Caches</H3
+ ><P
+ >Transparent caches essentially look out for TCP connections destined
+ for port 80. The cache server will intercept these packets, convert
+ them to a standard TCP <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >stream</I
+ ></SPAN
+ > and pass them
+ to Squid. When Squid sends reply data to the client, the Operating
+ System <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >fakes</I
+ ></SPAN
+ > the source address of the packets,
+ so that the client believes it is connected to the server that it
+ originally sent the request to.</P
+ ><P
+ >You can't simply plug a transparent cache into the network and get it
+ to transparently cache pages. The cache server needs to be in a
+ position where it can fake the reply packets (without the real server
+ interrupting the conversation and confusing things.) The server needs
+ to be the <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >gateway</I
+ ></SPAN
+ > to the outside world.</P
+ ><P
+ >&#13;
+ 
+ 
+ Let's look at the simplest transparent cache setup. The client machine
+ (10.0.0.50) treats the cache server's internal (10.0.0.1) interface
+ as it's <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >default gateway</I
+ ></SPAN
+ >. This way, all packets arrive on the
+ cache server before they reach the rest of the Internet. The filter
+ looks for port 80 packets, and passes them to Squid, but allows all
+ other packets to be passed to the routing layer, which passes the
+ packets to the router's IP (172.31.0.2).</P
+ ><P
+ >Once the connection is established, Squid needs to communicate with
+ the client. Squid doesn't do any strange packet assembly: that's left
+ to the transparency layer. When Squid sends reply data to the client,
+ the kernel automatically changes the packet's from address, so it
+ appears to the client that the server is just routing the requests
+ from the outside world. When Squid connects to the remote server, however,
+ the connect comes from the external interface of the cache server
+ (172.31.0.1, in the example.) This is where IP-authentication breaks:
+ since the request is coming from the cache (rather than the client's
+ real address (10.0.0.50).</P
+ ><P
+ >Effectively, we need to get four things right to get transparency
+ right:</P
+ ><P
+ ></P
+ ><UL
+ ><LI
+ ><P
+ >Correct network layout</P
+ ></LI
+ ><LI
+ ><P
+ >Filtering out the appropriate packets</P
+ ></LI
+ ><LI
+ ><P
+ >Kernel Transparency: redirecting port 80 connections to Squid</P
+ ></LI
+ ><LI
+ ><P
+ >Squid settings. Squid needs to know that it's supposed to act in
+ transparent mode.</P
+ ></LI
+ ></UL
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2588">Network Layout</H2
+ ><P
+ >For traffic to be filtered, all network traffic needs to pass
+ through a <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >filter device</I
+ ></SPAN
+ >. On smaller networks,
+ the cache server can do the filtering (as it does in the above
+ example network), but many people are now opting for secondary filter
+ machines. These filter machines can be routers, Unix machines or even
+ so-called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >layer four</I
+ ></SPAN
+ > switches. These filtering
+ machines allow for automatic failover (in case of cache failure)
+ and load balancing. At the same time, the CPU load on the cache
+ machine is vastly reduced: the CPU doesn't have to examine every
+ passing packet <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >and</I
+ ></SPAN
+ > do caching.</P
+ ><P
+ >Sometimes, data is load-balanced across multiple Internet lines.
+ You must ensure that all outgoing data is routed through the cache
+ machine: the ougoing packets have to pass through the filter server,
+ so if you are load-balancing outgoing traffic across more than one
+ line, you may have to restructure your network so that packets pass
+ through the filter server before they reach the outside world.</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2595">Filtering Traffic</H2
+ ><P
+ >Traffic filtering can now be done by numerous devices. A short time
+ ago, only Unix servers (with special modifications) could sort traffic
+ streams by destination port. These days, however, routers, switches
+ and (of course) Unix machines can filter IP traffic.</P
+ ><P
+ >Which device you use to do your filtering depends on your load. For
+ light loads, your cache server can do everything: the filtering,
+ the redirection and the transparent caching. For heavier loads,
+ you may want to use a seperate Unix machine, or you may want to get
+ your router to filter the streams for you (only certain routers can
+ do filtering fast at the hardware level: doing filtering on other
+ routers will add additional load to the CPU). You could even get
+ a so-called <SPAN
+ CLASS="emphasis"
+ ><I
+ CLASS="EMPHASIS"
+ >layer four switch</I
+ ></SPAN
+ >, which can do
+ filtering at gigabit ethernet speeds.</P
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2600">Unix machines</H3
+ ><P
+ >Some Unix systems have built in support for filtering by destination
+ TCP port. Since very few people do filter like this, many of the
+ free Unix-like systems will need their kernel recompiled to include
+ this functionality. Commercial systems may not support transparency,
+ but if you are running a BSD-based system, you may be able to install
+ the</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2603">Routers (not done)</H3
+ ><P
+ >Not Done</P
+ ></DIV
+ ><DIV
+ CLASS="SECT2"
+ ><HR><H3
+ CLASS="SECT2"
+ ><A
+ NAME="AEN2606">Layer-Four Switches (not done)</H3
+ ><P
+ >Not Done</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2609">Kernel Redirection (not done)</H2
+ ><P
+ >Not Done</P
+ ></DIV
+ ><DIV
+ CLASS="SECT1"
+ ><HR><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2612">Squid Settings (not done)</H2
+ ><P
+ >Not Done</P
+ ></DIV
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN2615">Chapter 10. Not Yet Done: Squid Config files and options</H1
+ ><P
+ ><A
+ NAME="AEN2618"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ ><br>
+ 3.2:&nbsp;Squid&nbsp;Command&nbsp;Line&nbsp;Options<br>
+ 3.2.1:&nbsp;Help<br>
+ To&nbsp;get&nbsp;a&nbsp;complete&nbsp;list&nbsp;of&nbsp;Squid's&nbsp;command-line&nbsp;options,&nbsp;with&nbsp;a&nbsp;short<br>
+ description&nbsp;of&nbsp;each&nbsp;option,&nbsp;use&nbsp;the&nbsp;'-h'&nbsp;option.<br>
+ 3.2.2:&nbsp;HTTP&nbsp;Port<br>
+ Option:&nbsp;-a<br>
+ Format:&nbsp;-a&nbsp;port&nbsp;number<br>
+ Example:&nbsp;squid&nbsp;-a&nbsp;3128<br>
+ Squid&nbsp;will&nbsp;normally&nbsp;accept&nbsp;incoming&nbsp;HTTP&nbsp;requests&nbsp;on&nbsp;the&nbsp;port&nbsp;specified&nbsp;in<br>
+ the&nbsp;squid.conf&nbsp;file&nbsp;with&nbsp;the&nbsp;http_port&nbsp;tag.&nbsp;If&nbsp;you&nbsp;wish&nbsp;to&nbsp;override&nbsp;the&nbsp;tag<br>
+ for&nbsp;some&nbsp;reason,&nbsp;you&nbsp;can&nbsp;use&nbsp;the&nbsp;'-a'&nbsp;option.<br>
+ 3.2.3:&nbsp;Debug&nbsp;Information<br>
+ Option:&nbsp;-d<br>
+ Format:&nbsp;-d&nbsp;debug&nbsp;level&nbsp;value<br>
+ Example:&nbsp;squid&nbsp;-d&nbsp;3<br>
+ By&nbsp;default&nbsp;Squid&nbsp;only&nbsp;logs&nbsp;fatal&nbsp;errors&nbsp;to&nbsp;the&nbsp;screen,&nbsp;logging&nbsp;all&nbsp;other<br>
+ errors&nbsp;to&nbsp;the&nbsp;cache.log&nbsp;file.<br>
+ If&nbsp;you&nbsp;wish&nbsp;to&nbsp;log&nbsp;more&nbsp;information&nbsp;(for&nbsp;example&nbsp;debugging&nbsp;information,<br>
+ rather&nbsp;than&nbsp;only&nbsp;errors)<br>
+ The&nbsp;"-d"&nbsp;option&nbsp;allows&nbsp;you&nbsp;to&nbsp;increase&nbsp;the&nbsp;amount&nbsp;of&nbsp;debug&nbsp;information<br>
+ logged&nbsp;to&nbsp;the&nbsp;screen.&nbsp;If&nbsp;squid&nbsp;is&nbsp;started&nbsp;from&nbsp;your&nbsp;startup&nbsp;scripts,&nbsp;then<br>
+ this&nbsp;output&nbsp;will&nbsp;appear&nbsp;on&nbsp;the&nbsp;console&nbsp;of&nbsp;the&nbsp;machine.&nbsp;If&nbsp;started&nbsp;from&nbsp;a<br>
+ remote&nbsp;login,&nbsp;this&nbsp;output&nbsp;will&nbsp;be&nbsp;written&nbsp;to&nbsp;the&nbsp;screen&nbsp;of&nbsp;your&nbsp;remote<br>
+ session.<br>
+ 3.2.4:&nbsp;Config&nbsp;file<br>
+ Option:&nbsp;-f<br>
+ Format:&nbsp;-f&nbsp;path<br>
+ Example:&nbsp;squid&nbsp;-f&nbsp;/usr/local/etc/squid.conf<br>
+ This&nbsp;option&nbsp;allows&nbsp;you&nbsp;to&nbsp;specify&nbsp;a&nbsp;different&nbsp;path&nbsp;to&nbsp;the&nbsp;squid&nbsp;config&nbsp;file.<br>
+ When&nbsp;installing&nbsp;a&nbsp;binary&nbsp;version&nbsp;of&nbsp;squid,&nbsp;the&nbsp;default&nbsp;path&nbsp;to&nbsp;the<br>
+ squid.conf&nbsp;file&nbsp;may&nbsp;be&nbsp;inappropriate&nbsp;to&nbsp;your&nbsp;system.<br>
+ If&nbsp;you&nbsp;wish&nbsp;to&nbsp;test&nbsp;a&nbsp;different&nbsp;version&nbsp;of&nbsp;the&nbsp;config&nbsp;file,&nbsp;but&nbsp;wish&nbsp;to&nbsp;be<br>
+ able&nbsp;to&nbsp;revert&nbsp;to&nbsp;the&nbsp;previous&nbsp;config&nbsp;file&nbsp;in&nbsp;a&nbsp;hurry,&nbsp;you&nbsp;can&nbsp;use&nbsp;this<br>
+ option&nbsp;to&nbsp;refer&nbsp;to&nbsp;a&nbsp;different&nbsp;config&nbsp;file.&nbsp;To&nbsp;change&nbsp;back&nbsp;to&nbsp;the&nbsp;other<br>
+ config&nbsp;file&nbsp;you&nbsp;just&nbsp;have&nbsp;to&nbsp;restart&nbsp;Squid&nbsp;without&nbsp;this&nbsp;option.<br>
+ 3.2.5:&nbsp;Signaling&nbsp;a&nbsp;running&nbsp;Squid<br>
+ Option:&nbsp;-k<br>
+ Format:&nbsp;-k&nbsp;action<br>
+ Example:&nbsp;squid&nbsp;-k&nbsp;rotate<br>
+ You&nbsp;can&nbsp;communicate&nbsp;with&nbsp;a&nbsp;running&nbsp;copy&nbsp;of&nbsp;Squid&nbsp;by&nbsp;sending&nbsp;it&nbsp;signals.<br>
+ These&nbsp;signals&nbsp;will&nbsp;cause&nbsp;Squid&nbsp;to&nbsp;perform&nbsp;maintenance&nbsp;functions,&nbsp;doing<br>
+ things&nbsp;like&nbsp;reloading&nbsp;the&nbsp;config&nbsp;file,&nbsp;rotating&nbsp;the&nbsp;logs&nbsp;(for&nbsp;analysis)&nbsp;and<br>
+ so&nbsp;forth.<br>
+ On&nbsp;some&nbsp;operating&nbsp;systems&nbsp;certain&nbsp;signals&nbsp;are&nbsp;reserved.&nbsp;The&nbsp;threads&nbsp;library<br>
+ on&nbsp;Linux,&nbsp;for&nbsp;example,&nbsp;uses&nbsp;the&nbsp;SIGUSR1&nbsp;and&nbsp;SIGUSR2&nbsp;signals&nbsp;for&nbsp;thread<br>
+ communication.<br>
+ Sending&nbsp;the&nbsp;wrong&nbsp;signal&nbsp;to&nbsp;a&nbsp;running&nbsp;Squid&nbsp;is&nbsp;easy,&nbsp;and&nbsp;can&nbsp;have<br>
+ unfortunate&nbsp;consequences.<br>
+ This&nbsp;option&nbsp;allows&nbsp;you&nbsp;to&nbsp;use&nbsp;descriptive&nbsp;options&nbsp;to&nbsp;send&nbsp;a&nbsp;running&nbsp;Squid<br>
+ signals,&nbsp;creating&nbsp;a&nbsp;standardized&nbsp;cross-platform&nbsp;user&nbsp;interface.<br>
+ Tag:&nbsp;reconfigure<br>
+ Action:&nbsp;Reloads&nbsp;the&nbsp;squid.conf&nbsp;file.<br>
+ Description:<br>
+ 	It's&nbsp;important&nbsp;to&nbsp;note&nbsp;that&nbsp;when&nbsp;Squid&nbsp;re-reads&nbsp;this&nbsp;file&nbsp;it<br>
+ 	closes&nbsp;all&nbsp;current&nbsp;connections,&nbsp;which&nbsp;means&nbsp;that&nbsp;clients&nbsp;that&nbsp;were<br>
+ 	downloading&nbsp;files&nbsp;will&nbsp;be&nbsp;cut&nbsp;off&nbsp;mid-download.&nbsp;You&nbsp;should&nbsp;only<br>
+ 	schedule&nbsp;reloads&nbsp;for&nbsp;after-hours,&nbsp;when&nbsp;their&nbsp;impact&nbsp;is&nbsp;minimal.<br>
+ Tag:&nbsp;rotate<br>
+ Action:&nbsp;Rotates&nbsp;the&nbsp;cache.log&nbsp;and&nbsp;access.log&nbsp;files<br>
+ Description:<br>
+ 	Cache&nbsp;log&nbsp;files&nbsp;get&nbsp;very&nbsp;large.&nbsp;To&nbsp;stop&nbsp;the&nbsp;log&nbsp;files&nbsp;using<br>
+ 	up&nbsp;all&nbsp;your&nbsp;disk&nbsp;space&nbsp;you&nbsp;should&nbsp;rotate&nbsp;the&nbsp;logs&nbsp;daily.<br>
+ 	The&nbsp;squid.conf&nbsp;logfile_rotate&nbsp;option&nbsp;sets&nbsp;the&nbsp;maximum&nbsp;number&nbsp;of<br>
+ 	rotated&nbsp;logs&nbsp;that&nbsp;you&nbsp;wish&nbsp;to&nbsp;keep.<br>
+ 	The&nbsp;most&nbsp;common&nbsp;use&nbsp;of&nbsp;this&nbsp;action&nbsp;is&nbsp;to&nbsp;rotate&nbsp;the&nbsp;logs&nbsp;just<br>
+ 	before&nbsp;logfile&nbsp;analysis&nbsp;(see&nbsp;Chapter&nbsp;10).&nbsp;A&nbsp;crontab&nbsp;signals<br>
+ 	the&nbsp;rotation,&nbsp;sleeps&nbsp;for&nbsp;a&nbsp;short&nbsp;time,&nbsp;and&nbsp;then&nbsp;calls&nbsp;the&nbsp;logfile<br>
+ 	analysis&nbsp;program.<br>
+ Tags:&nbsp;shutdown,&nbsp;interrupt<br>
+ Action:&nbsp;Closes&nbsp;current&nbsp;connections,&nbsp;writes&nbsp;index&nbsp;and&nbsp;exits<br>
+ Description:<br>
+ 	Squid&nbsp;keeps&nbsp;an&nbsp;index&nbsp;of&nbsp;cache&nbsp;objects&nbsp;in&nbsp;memory.&nbsp;When&nbsp;you&nbsp;wish&nbsp;to<br>
+ 	shutdown&nbsp;Squid&nbsp;you&nbsp;should&nbsp;use&nbsp;this&nbsp;option,&nbsp;rather&nbsp;than&nbsp;simply<br>
+ 	killing&nbsp;Squid.&nbsp;Shutting&nbsp;down&nbsp;Squid&nbsp;can&nbsp;take&nbsp;a&nbsp;short&nbsp;while,&nbsp;while&nbsp;it<br>
+ 	writes&nbsp;the&nbsp;object&nbsp;index&nbsp;to&nbsp;disk.&nbsp;Squid&nbsp;writes&nbsp;to&nbsp;the&nbsp;cache.log<br>
+ 	file&nbsp;while&nbsp;it&nbsp;shuts&nbsp;down,&nbsp;indicating&nbsp;how&nbsp;many&nbsp;objects&nbsp;it&nbsp;has<br>
+ 	written&nbsp;to&nbsp;the&nbsp;index.<br>
+ 	Both&nbsp;the&nbsp;shutdown&nbsp;and&nbsp;interrupt&nbsp;tag&nbsp;have&nbsp;the&nbsp;same&nbsp;effect.&nbsp;(?why<br>
+ 	I&nbsp;thing&nbsp;it's&nbsp;since&nbsp;there&nbsp;isn't&nbsp;a&nbsp;"kill"&nbsp;command&nbsp;for&nbsp;NT?)<br>
+ Tag:&nbsp;kill<br>
+ Action:&nbsp;Kills&nbsp;the&nbsp;Squid&nbsp;process<br>
+ Description:<br>
+ 	The&nbsp;kill&nbsp;tag&nbsp;should&nbsp;only&nbsp;be&nbsp;used&nbsp;if&nbsp;shutdown&nbsp;or&nbsp;interrupt&nbsp;have<br>
+ 	no&nbsp;effect.&nbsp;Using&nbsp;this&nbsp;tag&nbsp;will&nbsp;kill&nbsp;Squid&nbsp;without&nbsp;giving&nbsp;it&nbsp;a<br>
+ 	chance&nbsp;to&nbsp;write&nbsp;the&nbsp;cache&nbsp;index&nbsp;file,&nbsp;causing&nbsp;a&nbsp;slow&nbsp;rebuild&nbsp;on&nbsp;the<br>
+ 	next&nbsp;start.<br>
+ Tag:&nbsp;debug<br>
+ Action:&nbsp;Turns&nbsp;on&nbsp;maximum&nbsp;debugging<br>
+ Description:<br>
+ 	At&nbsp;times&nbsp;it&nbsp;is&nbsp;useful&nbsp;to&nbsp;see&nbsp;exactly&nbsp;what&nbsp;the&nbsp;running&nbsp;copy&nbsp;of&nbsp;Squid<br>
+ 	is&nbsp;doing.&nbsp;Using&nbsp;the&nbsp;debug&nbsp;option&nbsp;will&nbsp;turn&nbsp;maximum&nbsp;logging&nbsp;on&nbsp;for<br>
+ 	the&nbsp;main&nbsp;Squid&nbsp;process.&nbsp;The&nbsp;output&nbsp;is&nbsp;very&nbsp;verbose,&nbsp;and&nbsp;with&nbsp;a<br>
+ 	heavily&nbsp;loaded&nbsp;cache&nbsp;can&nbsp;consume&nbsp;megabytes&nbsp;of&nbsp;disk&nbsp;space,&nbsp;so&nbsp;use<br>
+ 	this&nbsp;only&nbsp;on&nbsp;a&nbsp;lightly&nbsp;loaded&nbsp;cache,&nbsp;and&nbsp;for&nbsp;small&nbsp;periods&nbsp;of&nbsp;time.<br>
+ Tag:&nbsp;check<br>
+ Action:&nbsp;Prints&nbsp;an&nbsp;error&nbsp;message&nbsp;if&nbsp;Squid&nbsp;isn't&nbsp;running<br>
+ Description:<br>
+ 	Using&nbsp;this&nbsp;tag&nbsp;causes&nbsp;a&nbsp;'kill&nbsp;-0'&nbsp;signal&nbsp;to&nbsp;the&nbsp;running&nbsp;copy&nbsp;of<br>
+ 	Squid.&nbsp;This&nbsp;doesn't&nbsp;do&nbsp;anything&nbsp;to&nbsp;the&nbsp;running&nbsp;process,&nbsp;other&nbsp;than<br>
+ 	check&nbsp;that&nbsp;it&nbsp;exists&nbsp;(and&nbsp;that&nbsp;the&nbsp;user&nbsp;running&nbsp;the&nbsp;command&nbsp;has<br>
+ 	permission&nbsp;to&nbsp;send&nbsp;signals&nbsp;to&nbsp;the&nbsp;process).<br>
+ 3.2.5:&nbsp;Logging&nbsp;to&nbsp;syslog<br>
+ Option:&nbsp;-s<br>
+ Format:&nbsp;-s<br>
+ Example:&nbsp;squid&nbsp;-s<br>
+ Squid&nbsp;normally&nbsp;logs&nbsp;events&nbsp;and&nbsp;debug&nbsp;information&nbsp;to&nbsp;a&nbsp;special&nbsp;file,<br>
+ normally&nbsp;stored&nbsp;in&nbsp;"/usr/local/squid/logs/cache.log".<br>
+ In&nbsp;some&nbsp;environments&nbsp;you&nbsp;may&nbsp;wish&nbsp;for&nbsp;events&nbsp;to&nbsp;be&nbsp;logged&nbsp;to&nbsp;central&nbsp;"log<br>
+ server",&nbsp;using&nbsp;syslog.<br>
+ Turning&nbsp;on&nbsp;this&nbsp;flag&nbsp;will&nbsp;<br>
+ are&nbsp;not&nbsp;logged&nbsp;to&nbsp;syslog.&nbsp;Logs&nbsp;of&nbsp;client&nbsp;accesses&nbsp;are&nbsp;stored&nbsp;in<br>
+ the&nbsp;file&nbsp;"/usr/local/squid/logs/access.log"<br>
+ ------------------<br>
+ cache_dir:<br>
+ Squid&nbsp;is&nbsp;designed&nbsp;with&nbsp;the&nbsp;ability&nbsp;to&nbsp;store&nbsp;millions&nbsp;of&nbsp;objects.&nbsp;Given&nbsp;that<br>
+ many&nbsp;operating&nbsp;systems&nbsp;have&nbsp;a&nbsp;limit&nbsp;on&nbsp;file&nbsp;size&nbsp;it's&nbsp;not&nbsp;feasible&nbsp;for&nbsp;a<br>
+ cross&nbsp;platform&nbsp;program&nbsp;like&nbsp;Squid&nbsp;to&nbsp;store&nbsp;all&nbsp;objects&nbsp;in&nbsp;one&nbsp;file,&nbsp;though<br>
+ there&nbsp;are&nbsp;patches&nbsp;to&nbsp;allow&nbsp;users&nbsp;to&nbsp;create&nbsp;squid&nbsp;stores&nbsp;on&nbsp;large&nbsp;files&nbsp;or<br>
+ on&nbsp;raw&nbsp;devices.<br>
+ If&nbsp;you&nbsp;run&nbsp;a&nbsp;news&nbsp;server&nbsp;you&nbsp;will&nbsp;probably&nbsp;have&nbsp;an&nbsp;idea&nbsp;of&nbsp;how&nbsp;slow&nbsp;it&nbsp;is<br>
+ to&nbsp;do&nbsp;a&nbsp;directory&nbsp;listing&nbsp;of&nbsp;a&nbsp;directory&nbsp;with&nbsp;hundreds&nbsp;of&nbsp;thousands&nbsp;of<br>
+ files&nbsp;in&nbsp;it.&nbsp;On&nbsp;almost&nbsp;all&nbsp;filesystems&nbsp;there&nbsp;is&nbsp;a&nbsp;linear&nbsp;slowdown&nbsp;as&nbsp;more<br>
+ files&nbsp;are&nbsp;added&nbsp;to&nbsp;a&nbsp;directory.&nbsp;This&nbsp;rules&nbsp;out&nbsp;the&nbsp;other&nbsp;option,&nbsp;creating<br>
+ unique&nbsp;filenames&nbsp;and&nbsp;storing&nbsp;them&nbsp;all&nbsp;in&nbsp;one&nbsp;directory.<br>
+ Squid&nbsp;uses&nbsp;a&nbsp;hierarchy&nbsp;of&nbsp;directories&nbsp;for&nbsp;file&nbsp;storage.&nbsp;The&nbsp;default&nbsp;setup<br>
+ creates&nbsp;16&nbsp;first-tier&nbsp;directories.&nbsp;Each&nbsp;one&nbsp;of&nbsp;these&nbsp;directories&nbsp;then<br>
+ contains&nbsp;256&nbsp;second-tier&nbsp;directories.&nbsp;Files&nbsp;are&nbsp;only&nbsp;stored&nbsp;in&nbsp;the<br>
+ second-tier&nbsp;directories.&nbsp;This</P
+ ></BLOCKQUOTE
+ >&#13;</P
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN2620">Chapter 11. Overall Layout (for writers)</H1
+ ><P
+ >When originally working on this document, I (Oskar Pearson)
+ put together an overall structure text file, to help me decide
+ where all the info would go, and how we would introduce the reader
+ to squid in a structured, useful fashion. You are welcome to
+ change the ordering, and add and remove from it as you will. The
+ numbers below do not directly match with the final structure, nor do
+ the numbers used match the numbers used in the free-release version
+ of the document. The "X pages" values may be freely ignored; they
+ were for the original proposal for the (paper) book.</P
+ ><P
+ >You are welcome to change the overall document structure as you wish,
+ and to add new sections as you will. If you do, though, please bear
+ in mind that someone coming into the editing process may benefit from
+ having an "overall structure" in which to place their contribution. If
+ you alter the document structure, please change this section of the document
+ to match. If you find differences between the flow of concepts in
+ this area and the text (entirely possible), you should probably
+ ignore this section, and (preferably) update this to match the real
+ document.</P
+ ><P
+ ><A
+ NAME="AEN2625"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >I)&nbsp;Installation<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;When&nbsp;installing&nbsp;Squid&nbsp;the&nbsp;first&nbsp;step&nbsp;is&nbsp;to&nbsp;get&nbsp;it&nbsp;up&nbsp;and&nbsp;running<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;on&nbsp;a&nbsp;test&nbsp;machine.&nbsp;This&nbsp;allows&nbsp;the&nbsp;user&nbsp;to&nbsp;get&nbsp;familiar&nbsp;with<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;Squid's&nbsp;basic&nbsp;setup&nbsp;and&nbsp;feel&nbsp;that&nbsp;they&nbsp;are&nbsp;progressing&nbsp;towards<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;something&nbsp;tangible&nbsp;(rather&nbsp;than&nbsp;slogging&nbsp;through&nbsp;the&nbsp;whole<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;book&nbsp;before&nbsp;actually&nbsp;getting&nbsp;Squid&nbsp;running).&nbsp;Only&nbsp;the&nbsp;very<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;basics&nbsp;of&nbsp;the&nbsp;config&nbsp;file&nbsp;are&nbsp;going&nbsp;to&nbsp;be&nbsp;covered.<br>
+ <br>
+ Chapter&nbsp;1)&nbsp;Introduction&nbsp;to&nbsp;Squid&nbsp;terminology&nbsp;and&nbsp;technology<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;1.1)&nbsp;What&nbsp;Squid&nbsp;is<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;1.1.1)&nbsp;Why&nbsp;cache<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;1.2)&nbsp;What&nbsp;Squid&nbsp;is&nbsp;not<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;1.3)&nbsp;Supported&nbsp;Internet&nbsp;Server&nbsp;protocols<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;1.4)&nbsp;Inter-Cache&nbsp;communication<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;1.4.1)&nbsp;Hierarchy&nbsp;terminology<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;1.4.2)&nbsp;Inter-Cache&nbsp;protocols<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;1.5)&nbsp;Operating&nbsp;Systems<br>
+ <br>
+ Chapter&nbsp;2)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;2.1)&nbsp;Advanced&nbsp;Planning:<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.1.1)&nbsp;Hardware&nbsp;requirements:<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;2.2)&nbsp;Operating&nbsp;System:<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.2.1)&nbsp;Use&nbsp;the&nbsp;OS&nbsp;that&nbsp;you&nbsp;have&nbsp;experience&nbsp;in<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.2.2)&nbsp;All&nbsp;examples&nbsp;will&nbsp;be&nbsp;generic.<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.2.3)&nbsp;need&nbsp;a&nbsp;compiler.<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;2.3)&nbsp;System&nbsp;setup<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.3.1)&nbsp;The&nbsp;default&nbsp;Squid&nbsp;directory&nbsp;structure<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.3.2)&nbsp;Creation&nbsp;of&nbsp;the&nbsp;squid&nbsp;user&nbsp;and&nbsp;group<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;(includes&nbsp;permissions&nbsp;etc)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;2.4)&nbsp;Working&nbsp;with&nbsp;precompiled&nbsp;binaries<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.4.1)&nbsp;precompiled&nbsp;binaries<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.4.2)&nbsp;Trusted&nbsp;sources&nbsp;of&nbsp;binaries<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;2.5)&nbsp;Source&nbsp;compilation<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.5.1)&nbsp;Recommended&nbsp;compilation&nbsp;tools<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.5.2)&nbsp;Compilation&nbsp;configuration&nbsp;options<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;2.5.3)&nbsp;compilation:&nbsp;make&nbsp;all;&nbsp;make&nbsp;install<br>
+ <br>
+ Chapter&nbsp;3)&nbsp;Introduction&nbsp;to&nbsp;the&nbsp;configuration&nbsp;file:<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;Only&nbsp;the&nbsp;very&nbsp;basics&nbsp;of&nbsp;the&nbsp;config&nbsp;file&nbsp;are&nbsp;covered.&nbsp;This<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;allows&nbsp;people&nbsp;to&nbsp;get&nbsp;Squid&nbsp;running&nbsp;as&nbsp;soon&nbsp;as&nbsp;they&nbsp;can.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;3.1)&nbsp;note&nbsp;on&nbsp;RCS<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;3.2)&nbsp;The&nbsp;configuration&nbsp;file:<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.1)&nbsp;HTTP&nbsp;port<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.2)&nbsp;Communicating&nbsp;with&nbsp;other&nbsp;proxy&nbsp;servers<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.2.1)&nbsp;Basic&nbsp;cache&nbsp;hierarchy&nbsp;terminology<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.2.2)&nbsp;Proxy-level&nbsp;firewall<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.2.3)&nbsp;Packet-filter&nbsp;firewall<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.2.4)&nbsp;Source/Destination&nbsp;IP&nbsp;and&nbsp;Port&nbsp;pairs<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.3)&nbsp;Cache&nbsp;Store&nbsp;location<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.3.1)&nbsp;Disk&nbsp;space&nbsp;allocation&nbsp;(?&nbsp;move&nbsp;to<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;chapter1?)<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.4)&nbsp;FTP&nbsp;login&nbsp;information<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.5)&nbsp;acl,&nbsp;http_access<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.5.1)&nbsp;create&nbsp;a&nbsp;basic&nbsp;acl&nbsp;that&nbsp;denies<br>
+ 			&nbsp;&nbsp;&nbsp;everything&nbsp;but&nbsp;one&nbsp;address&nbsp;range<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;3.2.5.2)&nbsp;Intranet&nbsp;access&nbsp;with&nbsp;parents<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.6)&nbsp;cache_mgr<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.7)&nbsp;cache_effective_group<br>
+ <br>
+ Chapter&nbsp;4)&nbsp;Starting&nbsp;and&nbsp;Running&nbsp;Squid&nbsp;(15&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;4.1)&nbsp;Running&nbsp;Squid&nbsp;for&nbsp;the&nbsp;first&nbsp;time<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;4.1.1)	Permissions<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;on&nbsp;each&nbsp;~squid/*&nbsp;directory<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;4.1.2)	Creating&nbsp;cache&nbsp;directories<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;4.1.2.1)&nbsp;Problems&nbsp;creating&nbsp;Swap&nbsp;Directories<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;problems:<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;not&nbsp;root<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;squid&nbsp;user&nbsp;id&nbsp;doesn't&nbsp;exist<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;squid&nbsp;user&nbsp;doesn't&nbsp;have&nbsp;write&nbsp;to<br>
+ 					&nbsp;&nbsp;&nbsp;&nbsp;cache&nbsp;dir<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;squid&nbsp;user&nbsp;doesn't&nbsp;have&nbsp;read/exec<br>
+ 					&nbsp;&nbsp;&nbsp;&nbsp;to&nbsp;a&nbsp;directory&nbsp;up&nbsp;the&nbsp;tree<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;4.2)&nbsp;Running&nbsp;Squid<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;3.2.1)&nbsp;What&nbsp;is&nbsp;expected&nbsp;in&nbsp;cache.log<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;4.3)&nbsp;Testing&nbsp;the&nbsp;cache&nbsp;with&nbsp;the&nbsp;included&nbsp;client<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;4.3.1)&nbsp;checking&nbsp;if&nbsp;Internet&nbsp;works<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;4.3.2)&nbsp;checking&nbsp;if&nbsp;intranet&nbsp;works&nbsp;(if&nbsp;configured&nbsp;with&nbsp;a&nbsp;parent)<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;4.3.3)&nbsp;Checking&nbsp;Access.log&nbsp;for&nbsp;hits&nbsp;vs&nbsp;misses<br>
+ 		&nbsp;&nbsp;&nbsp;Include&nbsp;basic&nbsp;fields<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;4.4)&nbsp;Addition&nbsp;to&nbsp;startup&nbsp;files<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;(?&nbsp;check&nbsp;NT&nbsp;?)<br>
+ <br>
+ Chapter&nbsp;5)&nbsp;Client&nbsp;configuration:&nbsp;(24&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;Include&nbsp;some&nbsp;screen&nbsp;shots&nbsp;of&nbsp;the&nbsp;configuration&nbsp;menus<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;5.1)&nbsp;Basic&nbsp;client&nbsp;configuration.<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;5.1.1)&nbsp;Netscape<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;5.1.2)&nbsp;Internet&nbsp;Explorer<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;5.1.3)&nbsp;Unix&nbsp;environment&nbsp;variables<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;(Important&nbsp;for&nbsp;both&nbsp;lynx&nbsp;and&nbsp;for&nbsp;wget&nbsp;-&nbsp;for<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;prefetching&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;5.2)&nbsp;Client&nbsp;cache-specific&nbsp;modifications<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;5.3)&nbsp;Testing&nbsp;client&nbsp;access<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;5.4)&nbsp;Setting&nbsp;clients&nbsp;to&nbsp;use&nbsp;LOCAL&nbsp;caches<br>
+ 	&nbsp;5.4.1)&nbsp;CARP<br>
+ 	&nbsp;5.4.2)&nbsp;Autoconfigs<br>
+ 	&nbsp;5.4.3)&nbsp;Future&nbsp;directions<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;5.2.4.1)&nbsp;DNS&nbsp;destination&nbsp;selection&nbsp;based&nbsp;on&nbsp;<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;5.2.4.2)&nbsp;Roaming&nbsp;ability&nbsp;will&nbsp;help<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;5.2.4.3)&nbsp;Transparency&nbsp;(see&nbsp;11.1)<br>
+ <br>
+ II)&nbsp;Integration<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;By&nbsp;this&nbsp;point&nbsp;Squid&nbsp;should&nbsp;be&nbsp;installed&nbsp;with&nbsp;a&nbsp;minimum&nbsp;working<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;environment.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;section&nbsp;covers&nbsp;changing&nbsp;cache&nbsp;setup&nbsp;to&nbsp;suit&nbsp;the&nbsp;local&nbsp;network<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;configuration.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;section&nbsp;covers&nbsp;Access&nbsp;Control,&nbsp;Refresh&nbsp;patterns&nbsp;and&nbsp;Cache-peer<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;relationships.&nbsp;These&nbsp;are&nbsp;the&nbsp;painful&nbsp;sections&nbsp;of&nbsp;the&nbsp;setup.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;section&nbsp;also&nbsp;goes&nbsp;through&nbsp;the&nbsp;options&nbsp;in&nbsp;the&nbsp;config&nbsp;file<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;that&nbsp;haven't&nbsp;been&nbsp;covered.&nbsp;This&nbsp;is&nbsp;essentially&nbsp;a&nbsp;'reference<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;guide'&nbsp;to&nbsp;the&nbsp;config&nbsp;options.<br>
+ <br>
+ Chapter&nbsp;6)&nbsp;ACLs:&nbsp;(38&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;Each&nbsp;of&nbsp;these&nbsp;includes&nbsp;a&nbsp;short&nbsp;example&nbsp;that&nbsp;shows&nbsp;how<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;they&nbsp;work.&nbsp;At&nbsp;the&nbsp;end&nbsp;of&nbsp;the&nbsp;Chapter&nbsp;there&nbsp;is&nbsp;a&nbsp;nice&nbsp;long<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;complex&nbsp;ACL&nbsp;list&nbsp;that&nbsp;should&nbsp;suit&nbsp;almost&nbsp;everyone.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;6.1)&nbsp;Introduction&nbsp;to&nbsp;ACLs<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;6.1.1)&nbsp;ACL&nbsp;lines&nbsp;vs&nbsp;Operator&nbsp;lines<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;6.1.2)&nbsp;How&nbsp;decisions&nbsp;work<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;6.2)&nbsp;Data&nbsp;specification:<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;6.2.1)&nbsp;regular&nbsp;expressions<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;6.2.2)&nbsp;IP&nbsp;address&nbsp;range&nbsp;specifications<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;6.2.3)&nbsp;AS&nbsp;numbers<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;6.2.4)&nbsp;putting&nbsp;the&nbsp;data&nbsp;in&nbsp;files<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;6.3)&nbsp;types&nbsp;of&nbsp;acl&nbsp;lines:<br>
+ 	&nbsp;Works&nbsp;through&nbsp;all&nbsp;the&nbsp;acl&nbsp;types.&nbsp;(src,&nbsp;srcdomain,&nbsp;dst,<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;dstdomain&nbsp;etc)<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;must&nbsp;include&nbsp;info&nbsp;on&nbsp;"no_cache",&nbsp;specifically<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;3.2.5.2<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;6.4)&nbsp;Delay&nbsp;classes&nbsp;<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;6.5)&nbsp;SNMP&nbsp;configuration<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;6.5)&nbsp;The&nbsp;default&nbsp;acl&nbsp;set<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;info&nbsp;on&nbsp;why&nbsp;the&nbsp;SSL&nbsp;setup&nbsp;is&nbsp;the&nbsp;way&nbsp;that&nbsp;it&nbsp;is,<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;and&nbsp;information&nbsp;on&nbsp;the&nbsp;echo/chargen&nbsp;ports<br>
+ <br>
+ Chapter&nbsp;7)&nbsp;Hierarchies:&nbsp;(42&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;7.1)&nbsp;Inter-cache&nbsp;communication&nbsp;protocols<br>
+ 	&nbsp;How&nbsp;each&nbsp;one&nbsp;is&nbsp;suited&nbsp;to&nbsp;specific<br>
+ 	&nbsp;circumstances.&nbsp;Compatability&nbsp;notes<br>
+ 	&nbsp;(with&nbsp;other&nbsp;programs)&nbsp;are&nbsp;included.<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.1.1)&nbsp;ICP<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.1.2)&nbsp;Digests<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.1.3)&nbsp;HTCP<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.1.4)&nbsp;CARP<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;7.2)&nbsp;Various&nbsp;types&nbsp;of&nbsp;hierarchy&nbsp;structures<br>
+ 	&nbsp;are&nbsp;covered:<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;7.2.1)&nbsp;The&nbsp;Tree&nbsp;stucture<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;7.2.2)&nbsp;Load&nbsp;balancing&nbsp;peer&nbsp;system<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;7.2.3)&nbsp;True&nbsp;distributed&nbsp;system<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;7.3)&nbsp;Configuring&nbsp;Squid&nbsp;to&nbsp;talk&nbsp;to&nbsp;other&nbsp;caches<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.3.1)&nbsp;The&nbsp;cache_peer&nbsp;config&nbsp;option<br>
+ 		&nbsp;&nbsp;&nbsp;All&nbsp;options&nbsp;are&nbsp;covered&nbsp;with&nbsp;examples<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.3.2)&nbsp;cache_peer_domain&nbsp;config&nbsp;option<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;7.3.3)&nbsp;miss_access&nbsp;acl&nbsp;line<br>
+ <br>
+ Chapter&nbsp;8)&nbsp;Accelerator&nbsp;mode&nbsp;(11&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;(?&nbsp;I&nbsp;haven't&nbsp;use&nbsp;accelerator&nbsp;mode&nbsp;-&nbsp;I&nbsp;am&nbsp;using&nbsp;Miguel&nbsp;a.l.&nbsp;Paraz's<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;page&nbsp;in&nbsp;the&nbsp;Squid&nbsp;Documentation&nbsp;as&nbsp;a&nbsp;guide&nbsp;?)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;8.1)&nbsp;Intro&nbsp;-&nbsp;why&nbsp;use&nbsp;this&nbsp;mode<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.1.1)&nbsp;performance<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.1.2)&nbsp;security<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;8.2)&nbsp;Types&nbsp;of&nbsp;accelerator&nbsp;mode<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.2.1)&nbsp;Virtual&nbsp;mode<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;(note&nbsp;on&nbsp;security&nbsp;problems)<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.2.2)&nbsp;Host&nbsp;header<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;8.3)&nbsp;Options<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.3.1)&nbsp;http_port<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.3.2)&nbsp;httpd_accel_host<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.3.3)&nbsp;httpd_accel_port<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.3.4)&nbsp;httpd_accel_with_proxy<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;8.3.5)&nbsp;httpd_accel_uses_host_header<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;8.4)&nbsp;Reverse&nbsp;caching&nbsp;using&nbsp;accelerator&nbsp;mode&nbsp;on&nbsp;the&nbsp;return<br>
+ 	&nbsp;path&nbsp;of&nbsp;an&nbsp;International&nbsp;link<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;See&nbsp;Transparency<br>
+ <br>
+ Chapter&nbsp;9)&nbsp;Transparency:&nbsp;(24&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.1)&nbsp;TCP&nbsp;basics<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.2)&nbsp;Operating&nbsp;System&nbsp;function<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.3)&nbsp;Squid&nbsp;'accept'&nbsp;destination&nbsp;sensing<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.4)&nbsp;Special&nbsp;ACLs&nbsp;to&nbsp;stop&nbsp;loops<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.5)&nbsp;FTP&nbsp;transparency&nbsp;problems<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.6)&nbsp;Routing&nbsp;the&nbsp;actual&nbsp;TCP&nbsp;packets&nbsp;to&nbsp;Squid<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;9.7)&nbsp;Changing&nbsp;hierarchies&nbsp;to&nbsp;work&nbsp;with&nbsp;transparency<br>
+ <br>
+ Chapter&nbsp;10)&nbsp;The&nbsp;config&nbsp;file&nbsp;and&nbsp;Squid&nbsp;options&nbsp;(48&nbsp;pages)<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;The&nbsp;options&nbsp;list&nbsp;doesn't&nbsp;really&nbsp;belong&nbsp;in&nbsp;section&nbsp;(I).&nbsp;I&nbsp;am,<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;instead&nbsp;going&nbsp;to&nbsp;cover&nbsp;it&nbsp;here.&nbsp;Also&nbsp;cover&nbsp;the&nbsp;options&nbsp;to&nbsp;'client'.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;covers&nbsp;ALL&nbsp;the&nbsp;tags&nbsp;in&nbsp;the&nbsp;config&nbsp;file.&nbsp;Where<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;the&nbsp;tag&nbsp;has&nbsp;been&nbsp;covered&nbsp;already&nbsp;it&nbsp;refers&nbsp;people&nbsp;to<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;that&nbsp;section&nbsp;of&nbsp;the&nbsp;book.<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;Arranged&nbsp;in&nbsp;alphabetical&nbsp;order.<br>
+ <br>
+ III)&nbsp;Maintainence&nbsp;and&nbsp;Site-Specific&nbsp;Optimization<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;Covers&nbsp;the&nbsp;further&nbsp;development&nbsp;of&nbsp;your&nbsp;cache&nbsp;setup.&nbsp;This&nbsp;covers<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;both&nbsp;maintainence&nbsp;and&nbsp;specialized&nbsp;setups&nbsp;(like&nbsp;transparent&nbsp;caches)<br>
+ <br>
+ Chapter&nbsp;11)&nbsp;Refresh&nbsp;Patterns:&nbsp;(24&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;11.1)&nbsp;distribution&nbsp;of&nbsp;file&nbsp;types<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;(gifs&nbsp;vs&nbsp;jpg&nbsp;vs&nbsp;html)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;11.2)&nbsp;distribution&nbsp;of&nbsp;protocols<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;11.3)&nbsp;Server-Sent&nbsp;Header&nbsp;fields<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;11.3.1)&nbsp;Work&nbsp;through&nbsp;the&nbsp;types&nbsp;of&nbsp;headers<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;11.3.2)&nbsp;meta-tags<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;11.4)&nbsp;Client-Sent&nbsp;Header&nbsp;fields<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;11.4.1)&nbsp;If-Modified-Since&nbsp;Requests<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;11.4.2)&nbsp;Refresh&nbsp;button<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;11.5)&nbsp;refresh_pattern&nbsp;tag<br>
+ 	&nbsp;First&nbsp;match&nbsp;selection.&nbsp;Describes&nbsp;order&nbsp;of<br>
+ 	&nbsp;checking&nbsp;each&nbsp;of&nbsp;the&nbsp;fields.<br>
+ <br>
+ Chapter&nbsp;12)&nbsp;Cache&nbsp;analysis&nbsp;(24&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;section&nbsp;covers&nbsp;disadvantages&nbsp;and&nbsp;advantages<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;of&nbsp;the&nbsp;various&nbsp;types&nbsp;of&nbsp;cache&nbsp;performance/savings<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;analysis&nbsp;systems<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;12.1)&nbsp;access.log&nbsp;fields<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;12.2)&nbsp;Simple&nbsp;Network&nbsp;Management&nbsp;Protocol&nbsp;(SNMP)<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;configuring,&nbsp;access&nbsp;control,&nbsp;multiple&nbsp;servers,<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;multiple&nbsp;agent&nbsp;configurations,&nbsp;understanding<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;results.&nbsp;Shew!<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;12.3)&nbsp;Cache-specific&nbsp;analysis&nbsp;using&nbsp;a&nbsp;squid&nbsp;analysis<br>
+ 	&nbsp;&nbsp;program<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;12.4)&nbsp;The&nbsp;cachemgr.cgi&nbsp;script<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;Using&nbsp;the&nbsp;output&nbsp;(eg&nbsp;LRU&nbsp;values)<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;deciding&nbsp;when&nbsp;to&nbsp;buy&nbsp;more&nbsp;disk&nbsp;space&nbsp;etc<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;12.5)&nbsp;Using&nbsp;a&nbsp;cache-query-tool<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;12.6)&nbsp;Using&nbsp;your&nbsp;results<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;Graphing&nbsp;response&nbsp;times&nbsp;over&nbsp;the&nbsp;months,&nbsp;for&nbsp;example.<br>
+ <br>
+ Chapter&nbsp;13)&nbsp;Standby&nbsp;procedures:&nbsp;(15&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;13.1)&nbsp;Hardware&nbsp;failure<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;13.1.1)&nbsp;Standby&nbsp;machines<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;13.1.2)&nbsp;DNS&nbsp;modification<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;13.1.3)&nbsp;Automatic&nbsp;configuration<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;13.2)&nbsp;Software&nbsp;failure<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;13.3.1)<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;We&nbsp;need&nbsp;lots&nbsp;of&nbsp;info&nbsp;on&nbsp;'vmstat',&nbsp;'iostat',&nbsp;strace&nbsp;-T,<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;(and&nbsp;other&nbsp;stuff&nbsp;like&nbsp;that)&nbsp;here.<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;cachemgr:<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;Slowness:&nbsp;<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;queued&nbsp;DNS&nbsp;queries<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;DNS&nbsp;response&nbsp;times<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;queued&nbsp;username/password&nbsp;authentication<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;requests<br>
+ 		&nbsp;&nbsp;&nbsp;&nbsp;page&nbsp;faults:<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;vmstat<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;13.2.2)&nbsp;Consistent&nbsp;crashing<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;filehandles<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;memory<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;all&nbsp;dnsservers&nbsp;busy<br>
+ 			&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;slow!<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;latency&nbsp;of&nbsp;local&nbsp;request,<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;comparing&nbsp;with&nbsp;"client"&nbsp;through<br>
+ 				&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cache&nbsp;and&nbsp;without&nbsp;it.<br>
+ <br>
+ Chapter&nbsp;14)&nbsp;Future&nbsp;directions:&nbsp;(18&nbsp;pages)<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;14.1)&nbsp;Wide&nbsp;ranging&nbsp;use&nbsp;of&nbsp;Skycache<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;14.2)&nbsp;Wide&nbsp;ranging&nbsp;use&nbsp;of&nbsp;transparency<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;14.3)&nbsp;Very&nbsp;heavily&nbsp;used&nbsp;parents<br>
+ 	&nbsp;&nbsp;For&nbsp;example&nbsp;at&nbsp;Exchange&nbsp;Points<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;14.4)&nbsp;compression&nbsp;between&nbsp;server&nbsp;and&nbsp;client&nbsp;-&nbsp;like&nbsp;the&nbsp;berkely<br>
+ 	&nbsp;&nbsp;&nbsp;&nbsp;thing...<br>&#13;</P
+ ></BLOCKQUOTE
+ ></P
+ ></DIV
+ ><DIV
+ CLASS="CHAPTER"
+ ><HR><H1
+ ><A
+ NAME="AEN2627">Chapter 12. GNU Free Documentation License</H1
+ ><DIV
+ CLASS="SECT1"
+ ><H2
+ CLASS="SECT1"
+ ><A
+ NAME="AEN2629">GNU Free Documentation License</H2
+ ><A
+ NAME="AEN2631"><BLOCKQUOTE
+ CLASS="BLOCKQUOTE"
+ ><P
+ CLASS="LITERALLAYOUT"
+ >		GNU&nbsp;Free&nbsp;Documentation&nbsp;License<br>
+ 		&nbsp;&nbsp;&nbsp;Version&nbsp;1.1,&nbsp;March&nbsp;2000<br>
+ <br>
+ &nbsp;Copyright&nbsp;(C)&nbsp;2000&nbsp;&nbsp;Free&nbsp;Software&nbsp;Foundation,&nbsp;Inc.<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;59&nbsp;Temple&nbsp;Place,&nbsp;Suite&nbsp;330,&nbsp;Boston,&nbsp;MA&nbsp;&nbsp;02111-1307&nbsp;&nbsp;USA<br>
+ &nbsp;Everyone&nbsp;is&nbsp;permitted&nbsp;to&nbsp;copy&nbsp;and&nbsp;distribute&nbsp;verbatim&nbsp;copies<br>
+ &nbsp;of&nbsp;this&nbsp;license&nbsp;document,&nbsp;but&nbsp;changing&nbsp;it&nbsp;is&nbsp;not&nbsp;allowed.<br>
+ <br>
+ <br>
+ 0.&nbsp;PREAMBLE<br>
+ <br>
+ The&nbsp;purpose&nbsp;of&nbsp;this&nbsp;License&nbsp;is&nbsp;to&nbsp;make&nbsp;a&nbsp;manual,&nbsp;textbook,&nbsp;or&nbsp;other<br>
+ written&nbsp;document&nbsp;"free"&nbsp;in&nbsp;the&nbsp;sense&nbsp;of&nbsp;freedom:&nbsp;to&nbsp;assure&nbsp;everyone<br>
+ the&nbsp;effective&nbsp;freedom&nbsp;to&nbsp;copy&nbsp;and&nbsp;redistribute&nbsp;it,&nbsp;with&nbsp;or&nbsp;without<br>
+ modifying&nbsp;it,&nbsp;either&nbsp;commercially&nbsp;or&nbsp;noncommercially.&nbsp;&nbsp;Secondarily,<br>
+ this&nbsp;License&nbsp;preserves&nbsp;for&nbsp;the&nbsp;author&nbsp;and&nbsp;publisher&nbsp;a&nbsp;way&nbsp;to&nbsp;get<br>
+ credit&nbsp;for&nbsp;their&nbsp;work,&nbsp;while&nbsp;not&nbsp;being&nbsp;considered&nbsp;responsible&nbsp;for<br>
+ modifications&nbsp;made&nbsp;by&nbsp;others.<br>
+ <br>
+ This&nbsp;License&nbsp;is&nbsp;a&nbsp;kind&nbsp;of&nbsp;"copyleft",&nbsp;which&nbsp;means&nbsp;that&nbsp;derivative<br>
+ works&nbsp;of&nbsp;the&nbsp;document&nbsp;must&nbsp;themselves&nbsp;be&nbsp;free&nbsp;in&nbsp;the&nbsp;same&nbsp;sense.&nbsp;&nbsp;It<br>
+ complements&nbsp;the&nbsp;GNU&nbsp;General&nbsp;Public&nbsp;License,&nbsp;which&nbsp;is&nbsp;a&nbsp;copyleft<br>
+ license&nbsp;designed&nbsp;for&nbsp;free&nbsp;software.<br>
+ <br>
+ We&nbsp;have&nbsp;designed&nbsp;this&nbsp;License&nbsp;in&nbsp;order&nbsp;to&nbsp;use&nbsp;it&nbsp;for&nbsp;manuals&nbsp;for&nbsp;free<br>
+ software,&nbsp;because&nbsp;free&nbsp;software&nbsp;needs&nbsp;free&nbsp;documentation:&nbsp;a&nbsp;free<br>
+ program&nbsp;should&nbsp;come&nbsp;with&nbsp;manuals&nbsp;providing&nbsp;the&nbsp;same&nbsp;freedoms&nbsp;that&nbsp;the<br>
+ software&nbsp;does.&nbsp;&nbsp;But&nbsp;this&nbsp;License&nbsp;is&nbsp;not&nbsp;limited&nbsp;to&nbsp;software&nbsp;manuals;<br>
+ it&nbsp;can&nbsp;be&nbsp;used&nbsp;for&nbsp;any&nbsp;textual&nbsp;work,&nbsp;regardless&nbsp;of&nbsp;subject&nbsp;matter&nbsp;or<br>
+ whether&nbsp;it&nbsp;is&nbsp;published&nbsp;as&nbsp;a&nbsp;printed&nbsp;book.&nbsp;&nbsp;We&nbsp;recommend&nbsp;this&nbsp;License<br>
+ principally&nbsp;for&nbsp;works&nbsp;whose&nbsp;purpose&nbsp;is&nbsp;instruction&nbsp;or&nbsp;reference.<br>
+ <br>
+ <br>
+ 1.&nbsp;APPLICABILITY&nbsp;AND&nbsp;DEFINITIONS<br>
+ <br>
+ This&nbsp;License&nbsp;applies&nbsp;to&nbsp;any&nbsp;manual&nbsp;or&nbsp;other&nbsp;work&nbsp;that&nbsp;contains&nbsp;a<br>
+ notice&nbsp;placed&nbsp;by&nbsp;the&nbsp;copyright&nbsp;holder&nbsp;saying&nbsp;it&nbsp;can&nbsp;be&nbsp;distributed<br>
+ under&nbsp;the&nbsp;terms&nbsp;of&nbsp;this&nbsp;License.&nbsp;&nbsp;The&nbsp;"Document",&nbsp;below,&nbsp;refers&nbsp;to&nbsp;any<br>
+ such&nbsp;manual&nbsp;or&nbsp;work.&nbsp;&nbsp;Any&nbsp;member&nbsp;of&nbsp;the&nbsp;public&nbsp;is&nbsp;a&nbsp;licensee,&nbsp;and&nbsp;is<br>
+ addressed&nbsp;as&nbsp;"you".<br>
+ <br>
+ A&nbsp;"Modified&nbsp;Version"&nbsp;of&nbsp;the&nbsp;Document&nbsp;means&nbsp;any&nbsp;work&nbsp;containing&nbsp;the<br>
+ Document&nbsp;or&nbsp;a&nbsp;portion&nbsp;of&nbsp;it,&nbsp;either&nbsp;copied&nbsp;verbatim,&nbsp;or&nbsp;with<br>
+ modifications&nbsp;and/or&nbsp;translated&nbsp;into&nbsp;another&nbsp;language.<br>
+ <br>
+ A&nbsp;"Secondary&nbsp;Section"&nbsp;is&nbsp;a&nbsp;named&nbsp;appendix&nbsp;or&nbsp;a&nbsp;front-matter&nbsp;section&nbsp;of<br>
+ the&nbsp;Document&nbsp;that&nbsp;deals&nbsp;exclusively&nbsp;with&nbsp;the&nbsp;relationship&nbsp;of&nbsp;the<br>
+ publishers&nbsp;or&nbsp;authors&nbsp;of&nbsp;the&nbsp;Document&nbsp;to&nbsp;the&nbsp;Document's&nbsp;overall&nbsp;subject<br>
+ (or&nbsp;to&nbsp;related&nbsp;matters)&nbsp;and&nbsp;contains&nbsp;nothing&nbsp;that&nbsp;could&nbsp;fall&nbsp;directly<br>
+ within&nbsp;that&nbsp;overall&nbsp;subject.&nbsp;&nbsp;(For&nbsp;example,&nbsp;if&nbsp;the&nbsp;Document&nbsp;is&nbsp;in&nbsp;part&nbsp;a<br>
+ textbook&nbsp;of&nbsp;mathematics,&nbsp;a&nbsp;Secondary&nbsp;Section&nbsp;may&nbsp;not&nbsp;explain&nbsp;any<br>
+ mathematics.)&nbsp;&nbsp;The&nbsp;relationship&nbsp;could&nbsp;be&nbsp;a&nbsp;matter&nbsp;of&nbsp;historical<br>
+ connection&nbsp;with&nbsp;the&nbsp;subject&nbsp;or&nbsp;with&nbsp;related&nbsp;matters,&nbsp;or&nbsp;of&nbsp;legal,<br>
+ commercial,&nbsp;philosophical,&nbsp;ethical&nbsp;or&nbsp;political&nbsp;position&nbsp;regarding<br>
+ them.<br>
+ <br>
+ The&nbsp;"Invariant&nbsp;Sections"&nbsp;are&nbsp;certain&nbsp;Secondary&nbsp;Sections&nbsp;whose&nbsp;titles<br>
+ are&nbsp;designated,&nbsp;as&nbsp;being&nbsp;those&nbsp;of&nbsp;Invariant&nbsp;Sections,&nbsp;in&nbsp;the&nbsp;notice<br>
+ that&nbsp;says&nbsp;that&nbsp;the&nbsp;Document&nbsp;is&nbsp;released&nbsp;under&nbsp;this&nbsp;License.<br>
+ <br>
+ The&nbsp;"Cover&nbsp;Texts"&nbsp;are&nbsp;certain&nbsp;short&nbsp;passages&nbsp;of&nbsp;text&nbsp;that&nbsp;are&nbsp;listed,<br>
+ as&nbsp;Front-Cover&nbsp;Texts&nbsp;or&nbsp;Back-Cover&nbsp;Texts,&nbsp;in&nbsp;the&nbsp;notice&nbsp;that&nbsp;says&nbsp;that<br>
+ the&nbsp;Document&nbsp;is&nbsp;released&nbsp;under&nbsp;this&nbsp;License.<br>
+ <br>
+ A&nbsp;"Transparent"&nbsp;copy&nbsp;of&nbsp;the&nbsp;Document&nbsp;means&nbsp;a&nbsp;machine-readable&nbsp;copy,<br>
+ represented&nbsp;in&nbsp;a&nbsp;format&nbsp;whose&nbsp;specification&nbsp;is&nbsp;available&nbsp;to&nbsp;the<br>
+ general&nbsp;public,&nbsp;whose&nbsp;contents&nbsp;can&nbsp;be&nbsp;viewed&nbsp;and&nbsp;edited&nbsp;directly&nbsp;and<br>
+ straightforwardly&nbsp;with&nbsp;generic&nbsp;text&nbsp;editors&nbsp;or&nbsp;(for&nbsp;images&nbsp;composed&nbsp;of<br>
+ pixels)&nbsp;generic&nbsp;paint&nbsp;programs&nbsp;or&nbsp;(for&nbsp;drawings)&nbsp;some&nbsp;widely&nbsp;available<br>
+ drawing&nbsp;editor,&nbsp;and&nbsp;that&nbsp;is&nbsp;suitable&nbsp;for&nbsp;input&nbsp;to&nbsp;text&nbsp;formatters&nbsp;or<br>
+ for&nbsp;automatic&nbsp;translation&nbsp;to&nbsp;a&nbsp;variety&nbsp;of&nbsp;formats&nbsp;suitable&nbsp;for&nbsp;input<br>
+ to&nbsp;text&nbsp;formatters.&nbsp;&nbsp;A&nbsp;copy&nbsp;made&nbsp;in&nbsp;an&nbsp;otherwise&nbsp;Transparent&nbsp;file<br>
+ format&nbsp;whose&nbsp;markup&nbsp;has&nbsp;been&nbsp;designed&nbsp;to&nbsp;thwart&nbsp;or&nbsp;discourage<br>
+ subsequent&nbsp;modification&nbsp;by&nbsp;readers&nbsp;is&nbsp;not&nbsp;Transparent.&nbsp;&nbsp;A&nbsp;copy&nbsp;that&nbsp;is<br>
+ not&nbsp;"Transparent"&nbsp;is&nbsp;called&nbsp;"Opaque".<br>
+ <br>
+ Examples&nbsp;of&nbsp;suitable&nbsp;formats&nbsp;for&nbsp;Transparent&nbsp;copies&nbsp;include&nbsp;plain<br>
+ ASCII&nbsp;without&nbsp;markup,&nbsp;Texinfo&nbsp;input&nbsp;format,&nbsp;LaTeX&nbsp;input&nbsp;format,&nbsp;SGML<br>
+ or&nbsp;XML&nbsp;using&nbsp;a&nbsp;publicly&nbsp;available&nbsp;DTD,&nbsp;and&nbsp;standard-conforming&nbsp;simple<br>
+ HTML&nbsp;designed&nbsp;for&nbsp;human&nbsp;modification.&nbsp;&nbsp;Opaque&nbsp;formats&nbsp;include<br>
+ PostScript,&nbsp;PDF,&nbsp;proprietary&nbsp;formats&nbsp;that&nbsp;can&nbsp;be&nbsp;read&nbsp;and&nbsp;edited&nbsp;only<br>
+ by&nbsp;proprietary&nbsp;word&nbsp;processors,&nbsp;SGML&nbsp;or&nbsp;XML&nbsp;for&nbsp;which&nbsp;the&nbsp;DTD&nbsp;and/or<br>
+ processing&nbsp;tools&nbsp;are&nbsp;not&nbsp;generally&nbsp;available,&nbsp;and&nbsp;the<br>
+ machine-generated&nbsp;HTML&nbsp;produced&nbsp;by&nbsp;some&nbsp;word&nbsp;processors&nbsp;for&nbsp;output<br>
+ purposes&nbsp;only.<br>
+ <br>
+ The&nbsp;"Title&nbsp;Page"&nbsp;means,&nbsp;for&nbsp;a&nbsp;printed&nbsp;book,&nbsp;the&nbsp;title&nbsp;page&nbsp;itself,<br>
+ plus&nbsp;such&nbsp;following&nbsp;pages&nbsp;as&nbsp;are&nbsp;needed&nbsp;to&nbsp;hold,&nbsp;legibly,&nbsp;the&nbsp;material<br>
+ this&nbsp;License&nbsp;requires&nbsp;to&nbsp;appear&nbsp;in&nbsp;the&nbsp;title&nbsp;page.&nbsp;&nbsp;For&nbsp;works&nbsp;in<br>
+ formats&nbsp;which&nbsp;do&nbsp;not&nbsp;have&nbsp;any&nbsp;title&nbsp;page&nbsp;as&nbsp;such,&nbsp;"Title&nbsp;Page"&nbsp;means<br>
+ the&nbsp;text&nbsp;near&nbsp;the&nbsp;most&nbsp;prominent&nbsp;appearance&nbsp;of&nbsp;the&nbsp;work's&nbsp;title,<br>
+ preceding&nbsp;the&nbsp;beginning&nbsp;of&nbsp;the&nbsp;body&nbsp;of&nbsp;the&nbsp;text.<br>
+ <br>
+ <br>
+ 2.&nbsp;VERBATIM&nbsp;COPYING<br>
+ <br>
+ You&nbsp;may&nbsp;copy&nbsp;and&nbsp;distribute&nbsp;the&nbsp;Document&nbsp;in&nbsp;any&nbsp;medium,&nbsp;either<br>
+ commercially&nbsp;or&nbsp;noncommercially,&nbsp;provided&nbsp;that&nbsp;this&nbsp;License,&nbsp;the<br>
+ copyright&nbsp;notices,&nbsp;and&nbsp;the&nbsp;license&nbsp;notice&nbsp;saying&nbsp;this&nbsp;License&nbsp;applies<br>
+ to&nbsp;the&nbsp;Document&nbsp;are&nbsp;reproduced&nbsp;in&nbsp;all&nbsp;copies,&nbsp;and&nbsp;that&nbsp;you&nbsp;add&nbsp;no&nbsp;other<br>
+ conditions&nbsp;whatsoever&nbsp;to&nbsp;those&nbsp;of&nbsp;this&nbsp;License.&nbsp;&nbsp;You&nbsp;may&nbsp;not&nbsp;use<br>
+ technical&nbsp;measures&nbsp;to&nbsp;obstruct&nbsp;or&nbsp;control&nbsp;the&nbsp;reading&nbsp;or&nbsp;further<br>
+ copying&nbsp;of&nbsp;the&nbsp;copies&nbsp;you&nbsp;make&nbsp;or&nbsp;distribute.&nbsp;&nbsp;However,&nbsp;you&nbsp;may&nbsp;accept<br>
+ compensation&nbsp;in&nbsp;exchange&nbsp;for&nbsp;copies.&nbsp;&nbsp;If&nbsp;you&nbsp;distribute&nbsp;a&nbsp;large&nbsp;enough<br>
+ number&nbsp;of&nbsp;copies&nbsp;you&nbsp;must&nbsp;also&nbsp;follow&nbsp;the&nbsp;conditions&nbsp;in&nbsp;section&nbsp;3.<br>
+ <br>
+ You&nbsp;may&nbsp;also&nbsp;lend&nbsp;copies,&nbsp;under&nbsp;the&nbsp;same&nbsp;conditions&nbsp;stated&nbsp;above,&nbsp;and<br>
+ you&nbsp;may&nbsp;publicly&nbsp;display&nbsp;copies.<br>
+ <br>
+ <br>
+ 3.&nbsp;COPYING&nbsp;IN&nbsp;QUANTITY<br>
+ <br>
+ If&nbsp;you&nbsp;publish&nbsp;printed&nbsp;copies&nbsp;of&nbsp;the&nbsp;Document&nbsp;numbering&nbsp;more&nbsp;than&nbsp;100,<br>
+ and&nbsp;the&nbsp;Document's&nbsp;license&nbsp;notice&nbsp;requires&nbsp;Cover&nbsp;Texts,&nbsp;you&nbsp;must&nbsp;enclose<br>
+ the&nbsp;copies&nbsp;in&nbsp;covers&nbsp;that&nbsp;carry,&nbsp;clearly&nbsp;and&nbsp;legibly,&nbsp;all&nbsp;these&nbsp;Cover<br>
+ Texts:&nbsp;Front-Cover&nbsp;Texts&nbsp;on&nbsp;the&nbsp;front&nbsp;cover,&nbsp;and&nbsp;Back-Cover&nbsp;Texts&nbsp;on<br>
+ the&nbsp;back&nbsp;cover.&nbsp;&nbsp;Both&nbsp;covers&nbsp;must&nbsp;also&nbsp;clearly&nbsp;and&nbsp;legibly&nbsp;identify<br>
+ you&nbsp;as&nbsp;the&nbsp;publisher&nbsp;of&nbsp;these&nbsp;copies.&nbsp;&nbsp;The&nbsp;front&nbsp;cover&nbsp;must&nbsp;present<br>
+ the&nbsp;full&nbsp;title&nbsp;with&nbsp;all&nbsp;words&nbsp;of&nbsp;the&nbsp;title&nbsp;equally&nbsp;prominent&nbsp;and<br>
+ visible.&nbsp;&nbsp;You&nbsp;may&nbsp;add&nbsp;other&nbsp;material&nbsp;on&nbsp;the&nbsp;covers&nbsp;in&nbsp;addition.<br>
+ Copying&nbsp;with&nbsp;changes&nbsp;limited&nbsp;to&nbsp;the&nbsp;covers,&nbsp;as&nbsp;long&nbsp;as&nbsp;they&nbsp;preserve<br>
+ the&nbsp;title&nbsp;of&nbsp;the&nbsp;Document&nbsp;and&nbsp;satisfy&nbsp;these&nbsp;conditions,&nbsp;can&nbsp;be&nbsp;treated<br>
+ as&nbsp;verbatim&nbsp;copying&nbsp;in&nbsp;other&nbsp;respects.<br>
+ <br>
+ If&nbsp;the&nbsp;required&nbsp;texts&nbsp;for&nbsp;either&nbsp;cover&nbsp;are&nbsp;too&nbsp;voluminous&nbsp;to&nbsp;fit<br>
+ legibly,&nbsp;you&nbsp;should&nbsp;put&nbsp;the&nbsp;first&nbsp;ones&nbsp;listed&nbsp;(as&nbsp;many&nbsp;as&nbsp;fit<br>
+ reasonably)&nbsp;on&nbsp;the&nbsp;actual&nbsp;cover,&nbsp;and&nbsp;continue&nbsp;the&nbsp;rest&nbsp;onto&nbsp;adjacent<br>
+ pages.<br>
+ <br>
+ If&nbsp;you&nbsp;publish&nbsp;or&nbsp;distribute&nbsp;Opaque&nbsp;copies&nbsp;of&nbsp;the&nbsp;Document&nbsp;numbering<br>
+ more&nbsp;than&nbsp;100,&nbsp;you&nbsp;must&nbsp;either&nbsp;include&nbsp;a&nbsp;machine-readable&nbsp;Transparent<br>
+ copy&nbsp;along&nbsp;with&nbsp;each&nbsp;Opaque&nbsp;copy,&nbsp;or&nbsp;state&nbsp;in&nbsp;or&nbsp;with&nbsp;each&nbsp;Opaque&nbsp;copy<br>
+ a&nbsp;publicly-accessible&nbsp;computer-network&nbsp;location&nbsp;containing&nbsp;a&nbsp;complete<br>
+ Transparent&nbsp;copy&nbsp;of&nbsp;the&nbsp;Document,&nbsp;free&nbsp;of&nbsp;added&nbsp;material,&nbsp;which&nbsp;the<br>
+ general&nbsp;network-using&nbsp;public&nbsp;has&nbsp;access&nbsp;to&nbsp;download&nbsp;anonymously&nbsp;at&nbsp;no<br>
+ charge&nbsp;using&nbsp;public-standard&nbsp;network&nbsp;protocols.&nbsp;&nbsp;If&nbsp;you&nbsp;use&nbsp;the&nbsp;latter<br>
+ option,&nbsp;you&nbsp;must&nbsp;take&nbsp;reasonably&nbsp;prudent&nbsp;steps,&nbsp;when&nbsp;you&nbsp;begin<br>
+ distribution&nbsp;of&nbsp;Opaque&nbsp;copies&nbsp;in&nbsp;quantity,&nbsp;to&nbsp;ensure&nbsp;that&nbsp;this<br>
+ Transparent&nbsp;copy&nbsp;will&nbsp;remain&nbsp;thus&nbsp;accessible&nbsp;at&nbsp;the&nbsp;stated&nbsp;location<br>
+ until&nbsp;at&nbsp;least&nbsp;one&nbsp;year&nbsp;after&nbsp;the&nbsp;last&nbsp;time&nbsp;you&nbsp;distribute&nbsp;an&nbsp;Opaque<br>
+ copy&nbsp;(directly&nbsp;or&nbsp;through&nbsp;your&nbsp;agents&nbsp;or&nbsp;retailers)&nbsp;of&nbsp;that&nbsp;edition&nbsp;to<br>
+ the&nbsp;public.<br>
+ <br>
+ It&nbsp;is&nbsp;requested,&nbsp;but&nbsp;not&nbsp;required,&nbsp;that&nbsp;you&nbsp;contact&nbsp;the&nbsp;authors&nbsp;of&nbsp;the<br>
+ Document&nbsp;well&nbsp;before&nbsp;redistributing&nbsp;any&nbsp;large&nbsp;number&nbsp;of&nbsp;copies,&nbsp;to&nbsp;give<br>
+ them&nbsp;a&nbsp;chance&nbsp;to&nbsp;provide&nbsp;you&nbsp;with&nbsp;an&nbsp;updated&nbsp;version&nbsp;of&nbsp;the&nbsp;Document.<br>
+ <br>
+ <br>
+ 4.&nbsp;MODIFICATIONS<br>
+ <br>
+ You&nbsp;may&nbsp;copy&nbsp;and&nbsp;distribute&nbsp;a&nbsp;Modified&nbsp;Version&nbsp;of&nbsp;the&nbsp;Document&nbsp;under<br>
+ the&nbsp;conditions&nbsp;of&nbsp;sections&nbsp;2&nbsp;and&nbsp;3&nbsp;above,&nbsp;provided&nbsp;that&nbsp;you&nbsp;release<br>
+ the&nbsp;Modified&nbsp;Version&nbsp;under&nbsp;precisely&nbsp;this&nbsp;License,&nbsp;with&nbsp;the&nbsp;Modified<br>
+ Version&nbsp;filling&nbsp;the&nbsp;role&nbsp;of&nbsp;the&nbsp;Document,&nbsp;thus&nbsp;licensing&nbsp;distribution<br>
+ and&nbsp;modification&nbsp;of&nbsp;the&nbsp;Modified&nbsp;Version&nbsp;to&nbsp;whoever&nbsp;possesses&nbsp;a&nbsp;copy<br>
+ of&nbsp;it.&nbsp;&nbsp;In&nbsp;addition,&nbsp;you&nbsp;must&nbsp;do&nbsp;these&nbsp;things&nbsp;in&nbsp;the&nbsp;Modified&nbsp;Version:<br>
+ <br>
+ A.&nbsp;Use&nbsp;in&nbsp;the&nbsp;Title&nbsp;Page&nbsp;(and&nbsp;on&nbsp;the&nbsp;covers,&nbsp;if&nbsp;any)&nbsp;a&nbsp;title&nbsp;distinct<br>
+ &nbsp;&nbsp;&nbsp;from&nbsp;that&nbsp;of&nbsp;the&nbsp;Document,&nbsp;and&nbsp;from&nbsp;those&nbsp;of&nbsp;previous&nbsp;versions<br>
+ &nbsp;&nbsp;&nbsp;(which&nbsp;should,&nbsp;if&nbsp;there&nbsp;were&nbsp;any,&nbsp;be&nbsp;listed&nbsp;in&nbsp;the&nbsp;History&nbsp;section<br>
+ &nbsp;&nbsp;&nbsp;of&nbsp;the&nbsp;Document).&nbsp;&nbsp;You&nbsp;may&nbsp;use&nbsp;the&nbsp;same&nbsp;title&nbsp;as&nbsp;a&nbsp;previous&nbsp;version<br>
+ &nbsp;&nbsp;&nbsp;if&nbsp;the&nbsp;original&nbsp;publisher&nbsp;of&nbsp;that&nbsp;version&nbsp;gives&nbsp;permission.<br>
+ B.&nbsp;List&nbsp;on&nbsp;the&nbsp;Title&nbsp;Page,&nbsp;as&nbsp;authors,&nbsp;one&nbsp;or&nbsp;more&nbsp;persons&nbsp;or&nbsp;entities<br>
+ &nbsp;&nbsp;&nbsp;responsible&nbsp;for&nbsp;authorship&nbsp;of&nbsp;the&nbsp;modifications&nbsp;in&nbsp;the&nbsp;Modified<br>
+ &nbsp;&nbsp;&nbsp;Version,&nbsp;together&nbsp;with&nbsp;at&nbsp;least&nbsp;five&nbsp;of&nbsp;the&nbsp;principal&nbsp;authors&nbsp;of&nbsp;the<br>
+ &nbsp;&nbsp;&nbsp;Document&nbsp;(all&nbsp;of&nbsp;its&nbsp;principal&nbsp;authors,&nbsp;if&nbsp;it&nbsp;has&nbsp;less&nbsp;than&nbsp;five).<br>
+ C.&nbsp;State&nbsp;on&nbsp;the&nbsp;Title&nbsp;page&nbsp;the&nbsp;name&nbsp;of&nbsp;the&nbsp;publisher&nbsp;of&nbsp;the<br>
+ &nbsp;&nbsp;&nbsp;Modified&nbsp;Version,&nbsp;as&nbsp;the&nbsp;publisher.<br>
+ D.&nbsp;Preserve&nbsp;all&nbsp;the&nbsp;copyright&nbsp;notices&nbsp;of&nbsp;the&nbsp;Document.<br>
+ E.&nbsp;Add&nbsp;an&nbsp;appropriate&nbsp;copyright&nbsp;notice&nbsp;for&nbsp;your&nbsp;modifications<br>
+ &nbsp;&nbsp;&nbsp;adjacent&nbsp;to&nbsp;the&nbsp;other&nbsp;copyright&nbsp;notices.<br>
+ F.&nbsp;Include,&nbsp;immediately&nbsp;after&nbsp;the&nbsp;copyright&nbsp;notices,&nbsp;a&nbsp;license&nbsp;notice<br>
+ &nbsp;&nbsp;&nbsp;giving&nbsp;the&nbsp;public&nbsp;permission&nbsp;to&nbsp;use&nbsp;the&nbsp;Modified&nbsp;Version&nbsp;under&nbsp;the<br>
+ &nbsp;&nbsp;&nbsp;terms&nbsp;of&nbsp;this&nbsp;License,&nbsp;in&nbsp;the&nbsp;form&nbsp;shown&nbsp;in&nbsp;the&nbsp;Addendum&nbsp;below.<br>
+ G.&nbsp;Preserve&nbsp;in&nbsp;that&nbsp;license&nbsp;notice&nbsp;the&nbsp;full&nbsp;lists&nbsp;of&nbsp;Invariant&nbsp;Sections<br>
+ &nbsp;&nbsp;&nbsp;and&nbsp;required&nbsp;Cover&nbsp;Texts&nbsp;given&nbsp;in&nbsp;the&nbsp;Document's&nbsp;license&nbsp;notice.<br>
+ H.&nbsp;Include&nbsp;an&nbsp;unaltered&nbsp;copy&nbsp;of&nbsp;this&nbsp;License.<br>
+ I.&nbsp;Preserve&nbsp;the&nbsp;section&nbsp;entitled&nbsp;"History",&nbsp;and&nbsp;its&nbsp;title,&nbsp;and&nbsp;add&nbsp;to<br>
+ &nbsp;&nbsp;&nbsp;it&nbsp;an&nbsp;item&nbsp;stating&nbsp;at&nbsp;least&nbsp;the&nbsp;title,&nbsp;year,&nbsp;new&nbsp;authors,&nbsp;and<br>
+ &nbsp;&nbsp;&nbsp;publisher&nbsp;of&nbsp;the&nbsp;Modified&nbsp;Version&nbsp;as&nbsp;given&nbsp;on&nbsp;the&nbsp;Title&nbsp;Page.&nbsp;&nbsp;If<br>
+ &nbsp;&nbsp;&nbsp;there&nbsp;is&nbsp;no&nbsp;section&nbsp;entitled&nbsp;"History"&nbsp;in&nbsp;the&nbsp;Document,&nbsp;create&nbsp;one<br>
+ &nbsp;&nbsp;&nbsp;stating&nbsp;the&nbsp;title,&nbsp;year,&nbsp;authors,&nbsp;and&nbsp;publisher&nbsp;of&nbsp;the&nbsp;Document&nbsp;as<br>
+ &nbsp;&nbsp;&nbsp;given&nbsp;on&nbsp;its&nbsp;Title&nbsp;Page,&nbsp;then&nbsp;add&nbsp;an&nbsp;item&nbsp;describing&nbsp;the&nbsp;Modified<br>
+ &nbsp;&nbsp;&nbsp;Version&nbsp;as&nbsp;stated&nbsp;in&nbsp;the&nbsp;previous&nbsp;sentence.<br>
+ J.&nbsp;Preserve&nbsp;the&nbsp;network&nbsp;location,&nbsp;if&nbsp;any,&nbsp;given&nbsp;in&nbsp;the&nbsp;Document&nbsp;for<br>
+ &nbsp;&nbsp;&nbsp;public&nbsp;access&nbsp;to&nbsp;a&nbsp;Transparent&nbsp;copy&nbsp;of&nbsp;the&nbsp;Document,&nbsp;and&nbsp;likewise<br>
+ &nbsp;&nbsp;&nbsp;the&nbsp;network&nbsp;locations&nbsp;given&nbsp;in&nbsp;the&nbsp;Document&nbsp;for&nbsp;previous&nbsp;versions<br>
+ &nbsp;&nbsp;&nbsp;it&nbsp;was&nbsp;based&nbsp;on.&nbsp;&nbsp;These&nbsp;may&nbsp;be&nbsp;placed&nbsp;in&nbsp;the&nbsp;"History"&nbsp;section.<br>
+ &nbsp;&nbsp;&nbsp;You&nbsp;may&nbsp;omit&nbsp;a&nbsp;network&nbsp;location&nbsp;for&nbsp;a&nbsp;work&nbsp;that&nbsp;was&nbsp;published&nbsp;at<br>
+ &nbsp;&nbsp;&nbsp;least&nbsp;four&nbsp;years&nbsp;before&nbsp;the&nbsp;Document&nbsp;itself,&nbsp;or&nbsp;if&nbsp;the&nbsp;original<br>
+ &nbsp;&nbsp;&nbsp;publisher&nbsp;of&nbsp;the&nbsp;version&nbsp;it&nbsp;refers&nbsp;to&nbsp;gives&nbsp;permission.<br>
+ K.&nbsp;In&nbsp;any&nbsp;section&nbsp;entitled&nbsp;"Acknowledgements"&nbsp;or&nbsp;"Dedications",<br>
+ &nbsp;&nbsp;&nbsp;preserve&nbsp;the&nbsp;section's&nbsp;title,&nbsp;and&nbsp;preserve&nbsp;in&nbsp;the&nbsp;section&nbsp;all&nbsp;the<br>
+ &nbsp;&nbsp;&nbsp;substance&nbsp;and&nbsp;tone&nbsp;of&nbsp;each&nbsp;of&nbsp;the&nbsp;contributor&nbsp;acknowledgements<br>
+ &nbsp;&nbsp;&nbsp;and/or&nbsp;dedications&nbsp;given&nbsp;therein.<br>
+ L.&nbsp;Preserve&nbsp;all&nbsp;the&nbsp;Invariant&nbsp;Sections&nbsp;of&nbsp;the&nbsp;Document,<br>
+ &nbsp;&nbsp;&nbsp;unaltered&nbsp;in&nbsp;their&nbsp;text&nbsp;and&nbsp;in&nbsp;their&nbsp;titles.&nbsp;&nbsp;Section&nbsp;numbers<br>
+ &nbsp;&nbsp;&nbsp;or&nbsp;the&nbsp;equivalent&nbsp;are&nbsp;not&nbsp;considered&nbsp;part&nbsp;of&nbsp;the&nbsp;section&nbsp;titles.<br>
+ M.&nbsp;Delete&nbsp;any&nbsp;section&nbsp;entitled&nbsp;"Endorsements".&nbsp;&nbsp;Such&nbsp;a&nbsp;section<br>
+ &nbsp;&nbsp;&nbsp;may&nbsp;not&nbsp;be&nbsp;included&nbsp;in&nbsp;the&nbsp;Modified&nbsp;Version.<br>
+ N.&nbsp;Do&nbsp;not&nbsp;retitle&nbsp;any&nbsp;existing&nbsp;section&nbsp;as&nbsp;"Endorsements"<br>
+ &nbsp;&nbsp;&nbsp;or&nbsp;to&nbsp;conflict&nbsp;in&nbsp;title&nbsp;with&nbsp;any&nbsp;Invariant&nbsp;Section.<br>
+ <br>
+ If&nbsp;the&nbsp;Modified&nbsp;Version&nbsp;includes&nbsp;new&nbsp;front-matter&nbsp;sections&nbsp;or<br>
+ appendices&nbsp;that&nbsp;qualify&nbsp;as&nbsp;Secondary&nbsp;Sections&nbsp;and&nbsp;contain&nbsp;no&nbsp;material<br>
+ copied&nbsp;from&nbsp;the&nbsp;Document,&nbsp;you&nbsp;may&nbsp;at&nbsp;your&nbsp;option&nbsp;designate&nbsp;some&nbsp;or&nbsp;all<br>
+ of&nbsp;these&nbsp;sections&nbsp;as&nbsp;invariant.&nbsp;&nbsp;To&nbsp;do&nbsp;this,&nbsp;add&nbsp;their&nbsp;titles&nbsp;to&nbsp;the<br>
+ list&nbsp;of&nbsp;Invariant&nbsp;Sections&nbsp;in&nbsp;the&nbsp;Modified&nbsp;Version's&nbsp;license&nbsp;notice.<br>
+ These&nbsp;titles&nbsp;must&nbsp;be&nbsp;distinct&nbsp;from&nbsp;any&nbsp;other&nbsp;section&nbsp;titles.<br>
+ <br>
+ You&nbsp;may&nbsp;add&nbsp;a&nbsp;section&nbsp;entitled&nbsp;"Endorsements",&nbsp;provided&nbsp;it&nbsp;contains<br>
+ nothing&nbsp;but&nbsp;endorsements&nbsp;of&nbsp;your&nbsp;Modified&nbsp;Version&nbsp;by&nbsp;various<br>
+ parties--for&nbsp;example,&nbsp;statements&nbsp;of&nbsp;peer&nbsp;review&nbsp;or&nbsp;that&nbsp;the&nbsp;text&nbsp;has<br>
+ been&nbsp;approved&nbsp;by&nbsp;an&nbsp;organization&nbsp;as&nbsp;the&nbsp;authoritative&nbsp;definition&nbsp;of&nbsp;a<br>
+ standard.<br>
+ <br>
+ You&nbsp;may&nbsp;add&nbsp;a&nbsp;passage&nbsp;of&nbsp;up&nbsp;to&nbsp;five&nbsp;words&nbsp;as&nbsp;a&nbsp;Front-Cover&nbsp;Text,&nbsp;and&nbsp;a<br>
+ passage&nbsp;of&nbsp;up&nbsp;to&nbsp;25&nbsp;words&nbsp;as&nbsp;a&nbsp;Back-Cover&nbsp;Text,&nbsp;to&nbsp;the&nbsp;end&nbsp;of&nbsp;the&nbsp;list<br>
+ of&nbsp;Cover&nbsp;Texts&nbsp;in&nbsp;the&nbsp;Modified&nbsp;Version.&nbsp;&nbsp;Only&nbsp;one&nbsp;passage&nbsp;of<br>
+ Front-Cover&nbsp;Text&nbsp;and&nbsp;one&nbsp;of&nbsp;Back-Cover&nbsp;Text&nbsp;may&nbsp;be&nbsp;added&nbsp;by&nbsp;(or<br>
+ through&nbsp;arrangements&nbsp;made&nbsp;by)&nbsp;any&nbsp;one&nbsp;entity.&nbsp;&nbsp;If&nbsp;the&nbsp;Document&nbsp;already<br>
+ includes&nbsp;a&nbsp;cover&nbsp;text&nbsp;for&nbsp;the&nbsp;same&nbsp;cover,&nbsp;previously&nbsp;added&nbsp;by&nbsp;you&nbsp;or<br>
+ by&nbsp;arrangement&nbsp;made&nbsp;by&nbsp;the&nbsp;same&nbsp;entity&nbsp;you&nbsp;are&nbsp;acting&nbsp;on&nbsp;behalf&nbsp;of,<br>
+ you&nbsp;may&nbsp;not&nbsp;add&nbsp;another;&nbsp;but&nbsp;you&nbsp;may&nbsp;replace&nbsp;the&nbsp;old&nbsp;one,&nbsp;on&nbsp;explicit<br>
+ permission&nbsp;from&nbsp;the&nbsp;previous&nbsp;publisher&nbsp;that&nbsp;added&nbsp;the&nbsp;old&nbsp;one.<br>
+ <br>
+ The&nbsp;author(s)&nbsp;and&nbsp;publisher(s)&nbsp;of&nbsp;the&nbsp;Document&nbsp;do&nbsp;not&nbsp;by&nbsp;this&nbsp;License<br>
+ give&nbsp;permission&nbsp;to&nbsp;use&nbsp;their&nbsp;names&nbsp;for&nbsp;publicity&nbsp;for&nbsp;or&nbsp;to&nbsp;assert&nbsp;or<br>
+ imply&nbsp;endorsement&nbsp;of&nbsp;any&nbsp;Modified&nbsp;Version.<br>
+ <br>
+ <br>
+ 5.&nbsp;COMBINING&nbsp;DOCUMENTS<br>
+ <br>
+ You&nbsp;may&nbsp;combine&nbsp;the&nbsp;Document&nbsp;with&nbsp;other&nbsp;documents&nbsp;released&nbsp;under&nbsp;this<br>
+ License,&nbsp;under&nbsp;the&nbsp;terms&nbsp;defined&nbsp;in&nbsp;section&nbsp;4&nbsp;above&nbsp;for&nbsp;modified<br>
+ versions,&nbsp;provided&nbsp;that&nbsp;you&nbsp;include&nbsp;in&nbsp;the&nbsp;combination&nbsp;all&nbsp;of&nbsp;the<br>
+ Invariant&nbsp;Sections&nbsp;of&nbsp;all&nbsp;of&nbsp;the&nbsp;original&nbsp;documents,&nbsp;unmodified,&nbsp;and<br>
+ list&nbsp;them&nbsp;all&nbsp;as&nbsp;Invariant&nbsp;Sections&nbsp;of&nbsp;your&nbsp;combined&nbsp;work&nbsp;in&nbsp;its<br>
+ license&nbsp;notice.<br>
+ <br>
+ The&nbsp;combined&nbsp;work&nbsp;need&nbsp;only&nbsp;contain&nbsp;one&nbsp;copy&nbsp;of&nbsp;this&nbsp;License,&nbsp;and<br>
+ multiple&nbsp;identical&nbsp;Invariant&nbsp;Sections&nbsp;may&nbsp;be&nbsp;replaced&nbsp;with&nbsp;a&nbsp;single<br>
+ copy.&nbsp;&nbsp;If&nbsp;there&nbsp;are&nbsp;multiple&nbsp;Invariant&nbsp;Sections&nbsp;with&nbsp;the&nbsp;same&nbsp;name&nbsp;but<br>
+ different&nbsp;contents,&nbsp;make&nbsp;the&nbsp;title&nbsp;of&nbsp;each&nbsp;such&nbsp;section&nbsp;unique&nbsp;by<br>
+ adding&nbsp;at&nbsp;the&nbsp;end&nbsp;of&nbsp;it,&nbsp;in&nbsp;parentheses,&nbsp;the&nbsp;name&nbsp;of&nbsp;the&nbsp;original<br>
+ author&nbsp;or&nbsp;publisher&nbsp;of&nbsp;that&nbsp;section&nbsp;if&nbsp;known,&nbsp;or&nbsp;else&nbsp;a&nbsp;unique&nbsp;number.<br>
+ Make&nbsp;the&nbsp;same&nbsp;adjustment&nbsp;to&nbsp;the&nbsp;section&nbsp;titles&nbsp;in&nbsp;the&nbsp;list&nbsp;of<br>
+ Invariant&nbsp;Sections&nbsp;in&nbsp;the&nbsp;license&nbsp;notice&nbsp;of&nbsp;the&nbsp;combined&nbsp;work.<br>
+ <br>
+ In&nbsp;the&nbsp;combination,&nbsp;you&nbsp;must&nbsp;combine&nbsp;any&nbsp;sections&nbsp;entitled&nbsp;"History"<br>
+ in&nbsp;the&nbsp;various&nbsp;original&nbsp;documents,&nbsp;forming&nbsp;one&nbsp;section&nbsp;entitled<br>
+ "History";&nbsp;likewise&nbsp;combine&nbsp;any&nbsp;sections&nbsp;entitled&nbsp;"Acknowledgements",<br>
+ and&nbsp;any&nbsp;sections&nbsp;entitled&nbsp;"Dedications".&nbsp;&nbsp;You&nbsp;must&nbsp;delete&nbsp;all&nbsp;sections<br>
+ entitled&nbsp;"Endorsements."<br>
+ <br>
+ <br>
+ 6.&nbsp;COLLECTIONS&nbsp;OF&nbsp;DOCUMENTS<br>
+ <br>
+ You&nbsp;may&nbsp;make&nbsp;a&nbsp;collection&nbsp;consisting&nbsp;of&nbsp;the&nbsp;Document&nbsp;and&nbsp;other&nbsp;documents<br>
+ released&nbsp;under&nbsp;this&nbsp;License,&nbsp;and&nbsp;replace&nbsp;the&nbsp;individual&nbsp;copies&nbsp;of&nbsp;this<br>
+ License&nbsp;in&nbsp;the&nbsp;various&nbsp;documents&nbsp;with&nbsp;a&nbsp;single&nbsp;copy&nbsp;that&nbsp;is&nbsp;included&nbsp;in<br>
+ the&nbsp;collection,&nbsp;provided&nbsp;that&nbsp;you&nbsp;follow&nbsp;the&nbsp;rules&nbsp;of&nbsp;this&nbsp;License&nbsp;for<br>
+ verbatim&nbsp;copying&nbsp;of&nbsp;each&nbsp;of&nbsp;the&nbsp;documents&nbsp;in&nbsp;all&nbsp;other&nbsp;respects.<br>
+ <br>
+ You&nbsp;may&nbsp;extract&nbsp;a&nbsp;single&nbsp;document&nbsp;from&nbsp;such&nbsp;a&nbsp;collection,&nbsp;and&nbsp;distribute<br>
+ it&nbsp;individually&nbsp;under&nbsp;this&nbsp;License,&nbsp;provided&nbsp;you&nbsp;insert&nbsp;a&nbsp;copy&nbsp;of&nbsp;this<br>
+ License&nbsp;into&nbsp;the&nbsp;extracted&nbsp;document,&nbsp;and&nbsp;follow&nbsp;this&nbsp;License&nbsp;in&nbsp;all<br>
+ other&nbsp;respects&nbsp;regarding&nbsp;verbatim&nbsp;copying&nbsp;of&nbsp;that&nbsp;document.<br>
+ <br>
+ <br>
+ 7.&nbsp;AGGREGATION&nbsp;WITH&nbsp;INDEPENDENT&nbsp;WORKS<br>
+ <br>
+ A&nbsp;compilation&nbsp;of&nbsp;the&nbsp;Document&nbsp;or&nbsp;its&nbsp;derivatives&nbsp;with&nbsp;other&nbsp;separate<br>
+ and&nbsp;independent&nbsp;documents&nbsp;or&nbsp;works,&nbsp;in&nbsp;or&nbsp;on&nbsp;a&nbsp;volume&nbsp;of&nbsp;a&nbsp;storage&nbsp;or<br>
+ distribution&nbsp;medium,&nbsp;does&nbsp;not&nbsp;as&nbsp;a&nbsp;whole&nbsp;count&nbsp;as&nbsp;a&nbsp;Modified&nbsp;Version<br>
+ of&nbsp;the&nbsp;Document,&nbsp;provided&nbsp;no&nbsp;compilation&nbsp;copyright&nbsp;is&nbsp;claimed&nbsp;for&nbsp;the<br>
+ compilation.&nbsp;&nbsp;Such&nbsp;a&nbsp;compilation&nbsp;is&nbsp;called&nbsp;an&nbsp;"aggregate",&nbsp;and&nbsp;this<br>
+ License&nbsp;does&nbsp;not&nbsp;apply&nbsp;to&nbsp;the&nbsp;other&nbsp;self-contained&nbsp;works&nbsp;thus&nbsp;compiled<br>
+ with&nbsp;the&nbsp;Document,&nbsp;on&nbsp;account&nbsp;of&nbsp;their&nbsp;being&nbsp;thus&nbsp;compiled,&nbsp;if&nbsp;they<br>
+ are&nbsp;not&nbsp;themselves&nbsp;derivative&nbsp;works&nbsp;of&nbsp;the&nbsp;Document.<br>
+ <br>
+ If&nbsp;the&nbsp;Cover&nbsp;Text&nbsp;requirement&nbsp;of&nbsp;section&nbsp;3&nbsp;is&nbsp;applicable&nbsp;to&nbsp;these<br>
+ copies&nbsp;of&nbsp;the&nbsp;Document,&nbsp;then&nbsp;if&nbsp;the&nbsp;Document&nbsp;is&nbsp;less&nbsp;than&nbsp;one&nbsp;quarter<br>
+ of&nbsp;the&nbsp;entire&nbsp;aggregate,&nbsp;the&nbsp;Document's&nbsp;Cover&nbsp;Texts&nbsp;may&nbsp;be&nbsp;placed&nbsp;on<br>
+ covers&nbsp;that&nbsp;surround&nbsp;only&nbsp;the&nbsp;Document&nbsp;within&nbsp;the&nbsp;aggregate.<br>
+ Otherwise&nbsp;they&nbsp;must&nbsp;appear&nbsp;on&nbsp;covers&nbsp;around&nbsp;the&nbsp;whole&nbsp;aggregate.<br>
+ <br>
+ <br>
+ 8.&nbsp;TRANSLATION<br>
+ <br>
+ Translation&nbsp;is&nbsp;considered&nbsp;a&nbsp;kind&nbsp;of&nbsp;modification,&nbsp;so&nbsp;you&nbsp;may<br>
+ distribute&nbsp;translations&nbsp;of&nbsp;the&nbsp;Document&nbsp;under&nbsp;the&nbsp;terms&nbsp;of&nbsp;section&nbsp;4.<br>
+ Replacing&nbsp;Invariant&nbsp;Sections&nbsp;with&nbsp;translations&nbsp;requires&nbsp;special<br>
+ permission&nbsp;from&nbsp;their&nbsp;copyright&nbsp;holders,&nbsp;but&nbsp;you&nbsp;may&nbsp;include<br>
+ translations&nbsp;of&nbsp;some&nbsp;or&nbsp;all&nbsp;Invariant&nbsp;Sections&nbsp;in&nbsp;addition&nbsp;to&nbsp;the<br>
+ original&nbsp;versions&nbsp;of&nbsp;these&nbsp;Invariant&nbsp;Sections.&nbsp;&nbsp;You&nbsp;may&nbsp;include&nbsp;a<br>
+ translation&nbsp;of&nbsp;this&nbsp;License&nbsp;provided&nbsp;that&nbsp;you&nbsp;also&nbsp;include&nbsp;the<br>
+ original&nbsp;English&nbsp;version&nbsp;of&nbsp;this&nbsp;License.&nbsp;&nbsp;In&nbsp;case&nbsp;of&nbsp;a&nbsp;disagreement<br>
+ between&nbsp;the&nbsp;translation&nbsp;and&nbsp;the&nbsp;original&nbsp;English&nbsp;version&nbsp;of&nbsp;this<br>
+ License,&nbsp;the&nbsp;original&nbsp;English&nbsp;version&nbsp;will&nbsp;prevail.<br>
+ <br>
+ <br>
+ 9.&nbsp;TERMINATION<br>
+ <br>
+ You&nbsp;may&nbsp;not&nbsp;copy,&nbsp;modify,&nbsp;sublicense,&nbsp;or&nbsp;distribute&nbsp;the&nbsp;Document&nbsp;except<br>
+ as&nbsp;expressly&nbsp;provided&nbsp;for&nbsp;under&nbsp;this&nbsp;License.&nbsp;&nbsp;Any&nbsp;other&nbsp;attempt&nbsp;to<br>
+ copy,&nbsp;modify,&nbsp;sublicense&nbsp;or&nbsp;distribute&nbsp;the&nbsp;Document&nbsp;is&nbsp;void,&nbsp;and&nbsp;will<br>
+ automatically&nbsp;terminate&nbsp;your&nbsp;rights&nbsp;under&nbsp;this&nbsp;License.&nbsp;&nbsp;However,<br>
+ parties&nbsp;who&nbsp;have&nbsp;received&nbsp;copies,&nbsp;or&nbsp;rights,&nbsp;from&nbsp;you&nbsp;under&nbsp;this<br>
+ License&nbsp;will&nbsp;not&nbsp;have&nbsp;their&nbsp;licenses&nbsp;terminated&nbsp;so&nbsp;long&nbsp;as&nbsp;such<br>
+ parties&nbsp;remain&nbsp;in&nbsp;full&nbsp;compliance.<br>
+ <br>
+ <br>
+ 10.&nbsp;FUTURE&nbsp;REVISIONS&nbsp;OF&nbsp;THIS&nbsp;LICENSE<br>
+ <br>
+ The&nbsp;Free&nbsp;Software&nbsp;Foundation&nbsp;may&nbsp;publish&nbsp;new,&nbsp;revised&nbsp;versions<br>
+ of&nbsp;the&nbsp;GNU&nbsp;Free&nbsp;Documentation&nbsp;License&nbsp;from&nbsp;time&nbsp;to&nbsp;time.&nbsp;&nbsp;Such&nbsp;new<br>
+ versions&nbsp;will&nbsp;be&nbsp;similar&nbsp;in&nbsp;spirit&nbsp;to&nbsp;the&nbsp;present&nbsp;version,&nbsp;but&nbsp;may<br>
+ differ&nbsp;in&nbsp;detail&nbsp;to&nbsp;address&nbsp;new&nbsp;problems&nbsp;or&nbsp;concerns.&nbsp;&nbsp;See<br>
+ http://www.gnu.org/copyleft/.<br>
+ <br>
+ Each&nbsp;version&nbsp;of&nbsp;the&nbsp;License&nbsp;is&nbsp;given&nbsp;a&nbsp;distinguishing&nbsp;version&nbsp;number.<br>
+ If&nbsp;the&nbsp;Document&nbsp;specifies&nbsp;that&nbsp;a&nbsp;particular&nbsp;numbered&nbsp;version&nbsp;of&nbsp;this<br>
+ License&nbsp;"or&nbsp;any&nbsp;later&nbsp;version"&nbsp;applies&nbsp;to&nbsp;it,&nbsp;you&nbsp;have&nbsp;the&nbsp;option&nbsp;of<br>
+ following&nbsp;the&nbsp;terms&nbsp;and&nbsp;conditions&nbsp;either&nbsp;of&nbsp;that&nbsp;specified&nbsp;version&nbsp;or<br>
+ of&nbsp;any&nbsp;later&nbsp;version&nbsp;that&nbsp;has&nbsp;been&nbsp;published&nbsp;(not&nbsp;as&nbsp;a&nbsp;draft)&nbsp;by&nbsp;the<br>
+ Free&nbsp;Software&nbsp;Foundation.&nbsp;&nbsp;If&nbsp;the&nbsp;Document&nbsp;does&nbsp;not&nbsp;specify&nbsp;a&nbsp;version<br>
+ number&nbsp;of&nbsp;this&nbsp;License,&nbsp;you&nbsp;may&nbsp;choose&nbsp;any&nbsp;version&nbsp;ever&nbsp;published&nbsp;(not<br>
+ as&nbsp;a&nbsp;draft)&nbsp;by&nbsp;the&nbsp;Free&nbsp;Software&nbsp;Foundation.<br>
+ <br>
+ <br>
+ ADDENDUM:&nbsp;How&nbsp;to&nbsp;use&nbsp;this&nbsp;License&nbsp;for&nbsp;your&nbsp;documents<br>
+ <br>
+ To&nbsp;use&nbsp;this&nbsp;License&nbsp;in&nbsp;a&nbsp;document&nbsp;you&nbsp;have&nbsp;written,&nbsp;include&nbsp;a&nbsp;copy&nbsp;of<br>
+ the&nbsp;License&nbsp;in&nbsp;the&nbsp;document&nbsp;and&nbsp;put&nbsp;the&nbsp;following&nbsp;copyright&nbsp;and<br>
+ license&nbsp;notices&nbsp;just&nbsp;after&nbsp;the&nbsp;title&nbsp;page:<br>
+ <br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Copyright&nbsp;(c)&nbsp;&nbsp;YEAR&nbsp;&nbsp;YOUR&nbsp;NAME.<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Permission&nbsp;is&nbsp;granted&nbsp;to&nbsp;copy,&nbsp;distribute&nbsp;and/or&nbsp;modify&nbsp;this&nbsp;document<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;under&nbsp;the&nbsp;terms&nbsp;of&nbsp;the&nbsp;GNU&nbsp;Free&nbsp;Documentation&nbsp;License,&nbsp;Version&nbsp;1.1<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;or&nbsp;any&nbsp;later&nbsp;version&nbsp;published&nbsp;by&nbsp;the&nbsp;Free&nbsp;Software&nbsp;Foundation;<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;with&nbsp;the&nbsp;Invariant&nbsp;Sections&nbsp;being&nbsp;LIST&nbsp;THEIR&nbsp;TITLES,&nbsp;with&nbsp;the<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Front-Cover&nbsp;Texts&nbsp;being&nbsp;LIST,&nbsp;and&nbsp;with&nbsp;the&nbsp;Back-Cover&nbsp;Texts&nbsp;being&nbsp;LIST.<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A&nbsp;copy&nbsp;of&nbsp;the&nbsp;license&nbsp;is&nbsp;included&nbsp;in&nbsp;the&nbsp;section&nbsp;entitled&nbsp;"GNU<br>
+ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Free&nbsp;Documentation&nbsp;License".<br>
+ <br>
+ If&nbsp;you&nbsp;have&nbsp;no&nbsp;Invariant&nbsp;Sections,&nbsp;write&nbsp;"with&nbsp;no&nbsp;Invariant&nbsp;Sections"<br>
+ instead&nbsp;of&nbsp;saying&nbsp;which&nbsp;ones&nbsp;are&nbsp;invariant.&nbsp;&nbsp;If&nbsp;you&nbsp;have&nbsp;no<br>
+ Front-Cover&nbsp;Texts,&nbsp;write&nbsp;"no&nbsp;Front-Cover&nbsp;Texts"&nbsp;instead&nbsp;of<br>
+ "Front-Cover&nbsp;Texts&nbsp;being&nbsp;LIST";&nbsp;likewise&nbsp;for&nbsp;Back-Cover&nbsp;Texts.<br>
+ <br>
+ If&nbsp;your&nbsp;document&nbsp;contains&nbsp;nontrivial&nbsp;examples&nbsp;of&nbsp;program&nbsp;code,&nbsp;we<br>
+ recommend&nbsp;releasing&nbsp;these&nbsp;examples&nbsp;in&nbsp;parallel&nbsp;under&nbsp;your&nbsp;choice&nbsp;of<br>
+ free&nbsp;software&nbsp;license,&nbsp;such&nbsp;as&nbsp;the&nbsp;GNU&nbsp;General&nbsp;Public&nbsp;License,<br>
+ to&nbsp;permit&nbsp;their&nbsp;use&nbsp;in&nbsp;free&nbsp;software.</P
+ ></BLOCKQUOTE
+ ></DIV
+ ></DIV
+ ></DIV
+ ></BODY
+ ></HTML
+ >
\ No newline at end of file
*** ./squid.desktop.osr6	Mon Oct 24 14:14:39 2005
--- ./squid.desktop	Mon Oct 24 14:14:39 2005
***************
*** 0 ****
--- 1,4 ----
+ [Desktop Entry]
+ Name=Squid Documentation
+ Name[fr]=Documentation du Squid
+ DocPath=/usr/share/doc/packages/squid-2.5.STABLE7/FAQ/index.html
*** ./Install-OSR6.osr6	Mon Oct 24 14:14:39 2005
--- ./Install-OSR6	Mon Oct 24 14:14:39 2005
***************
*** 0 ****
--- 1,56 ----
+ #!/bin/sh
+ #
+ #set -x
+ # These must get set in the UW build but we need them set here
+ INSTALL=/usr/gnu/bin/install
+ VER=2.5.STABLE12
+ ROOT=/var/tmp/squid-${VER}-root
+ # We need GNU make.
+ MAKE=/usr/gnu/bin/make
+ export MAKE
+ [ ! -x $MAKE ] && {
+ 	error "ERROR: $MAKE not found" >&2
+ 	exit 1
+ }
+ # Auth schemes.
+ PAM=
+ AUTH="basic ntlm digest"
+ # Basic auth helpers.  We are excluding LDAP and SASL.
+ BASIC_AUTH_HELPERS="LDAP MSNT NCSA $PAM SMB YP getpwnam multi-domain-NTLM winbind"
+ CFLAGS='-O2 -Xa -Dasm=__asm -DANSICPP'
+ LDFLAGS=' '
+ CC="cc -Kthread -Kalloca"
+ export CFLAGS LDFLAGS CC
+ #set -e
+ # Configure and build in a separate work directory.
+ [ -d work ] || ./Build-OSR6
+ 
+ # Install copyright files.
+ $INSTALL -d $ROOT/$MACH/usr/share/squid
+ $INSTALL -m 0444 COPYING COPYRIGHT $ROOT/$MACH/usr/share/squid
+ 
+ # Install /etc/init.d script.
+ $INSTALL -d $ROOT/$MACH/etc/init.d
+ $INSTALL -m 0444 squid.init $ROOT/$MACH/etc/init.d/squid
+ 
+ # Install documentation.
+ DOCDIR=/usr/share/squid/doc
+ $INSTALL -d $ROOT/$MACH/$DOCDIR
+ $INSTALL -m 0444 squid.html $ROOT/$MACH/$DOCDIR/squid.html
+ 
+ # Remember to bring the FAQ files up from the last dist
+ #mkdir FAQ
+ #cd FAQ
+ #tar xjvf ../squid-FAQ.tar.bz2 FAQ/FAQ.txt FAQ/FAQ.ps.gz
+ #mv FAQ/* .
+ #rmdir FAQ
+ #gzip -d FAQ.ps.gz
+ #bzip2 -9 FAQ.ps FAQ.txt
+ #cd ..
+ 
+ # Install docview glue.
+ INTGroup=/usr/share/meta/doc/HelpTopics/INThome/INTgroup
+ $INSTALL -d $ROOT/$MACH/$INTGroup
+ $INSTALL -m 0444 squid.desktop $ROOT/$MACH/$INTGroup/SquidDoc.desktop
+ 
+ exit 0
