[squid-users] X-Next-Services

[Alex Rousskov]

On 3/25/21 9:06 AM, Moti Berger wrote:

> I want to be able to skip all subsequent ICAP servers defined in squid
> based on some logic I have in one of my ICAP servers.
> I used the X-Next-Services and it seems to control only the current ICAP
> chain.
> I also saw it while configuring two ICAP servers to handle requests and
> one ICAP server to handle responses. When the header was sent from the
> first ICAP on the request chain, the ICAP request didn't arrive at the
> second ICAP server handling requests but did get to the ICAP server that
> handles responses. I wish to also skip the ICAP which handles the
> responses. 
> Is that possible?

Yes, it is.

IIRC, the current X-Next-Services implementation at REQMOD vectoring
point always proceeds to RESPMOD. Ideally, this algorithm should be
enhanced to allow a service to be explicit about its desire to end all
adaption (or continue with the default service at the explicitly
specified vectoring point). This enhancement should not be very
difficult to implement, but it does require non-trivial source code
changes.
https://wiki.squid-cache.org/SquidFaq/AboutSquid#How_to_add_a_new_Squid_feature.2C_enhance.2C_of_fix_something.3F

Meanwhile, you should be able to block RESPMOD adaptation for selected
requests using icap_service_access ACLs. As you know, this is possible
by adapting the HTTP request.

Ideally, it would also be possible by annotating the master transaction
using an ICAP response header, but only eCAP services can do that today
IIRC. Another missing enhancement for ICAP... However, you should try
this approach in combination with the adaptation_masterx_shared_names
mentioned below. I hope that when an ICAP response header field has the
shared header field name, the "note" ACL will have access to that field.


> If not, is it possible for an ICAP server to add an ICAP header during
> request handling to be read by the other ICAP servers that come after it
> when they handle the same request or the same request's response?

Yes, cross-service sharing should be possible by specifying your custom
ICAP header field name in adaptation_masterx_shared_names. As you can
tell, this will allow you to short-circuit unwanted RESPMOD adaptation
if the "note" ACL trick mentioned above does not work.


HTH,

Alex.