<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Amos, I spent a couple of days doing some test with the info you
gave me:<br>
<br>
Retested emptying the cache several times, disabled the rewriter,
different config files .. all I could think of<br>
<br>
<br>
Downloaded fresh 3.5.8 tar.gz (just in case it was some 3.5.4 thing)
and compiled it using this configure options:<br>
<br>
Squid Cache: Version 3.5.8<br>
Service Name: squid<br>
configure options: '--prefix=/usr/local'
'--datadir=/usr/local/share' '--bindir=/usr/local/sbin'
'--libexecdir=/usr/local/lib/squid' '--localstatedir=/var'
'--sysconfdir=/etc/squid3' '--enable-delay-pools' '--enable-ssl'
'--enable-ssl-crtd' '--enable-linux-netfilter' '--enable-eui'
'--enable-snmp' '--enable-gnuregex' '--enable-ltdl-convenience'
'--enable-removal-policies=lru heap' '--enable-http-violations'
'--with-openssl' '--with-filedescriptors=24321' '--enable-poll'
'--enable-epoll' '--enable-storeio=ufs,aufs,diskd,rock'
'--disable-ipv6'<br>
<br>
<br>
<br>
And the problem appeared again, I am suspicious that the problem is
in the configuration, I even removed all my refresh patterns, but:<br>
<br>
2015/09/02 15:03:42 kid1| varyEvaluateMatch: Oops. Not a Vary match
on second attempt, '<a class="moz-txt-link-freetext"
href="http://assets.pinterest.com/js/pinit.js">http://assets.pinterest.com/js/pinit.js</a>'
'accept-encoding="gzip,%20deflate"'<br>
2015/09/02 15:03:42 kid1| clientProcessHit: Vary object loop!<br>
2015/09/02 15:03:43 kid1| varyEvaluateMatch: Oops. Not a Vary match
on second attempt, '<a class="moz-txt-link-freetext"
href="http://static.cmptch.com/v/lib/str.html">http://static.cmptch.com/v/lib/str.html</a>'
'accept-encoding="gzip,%20deflate,%20sdch"'<br>
2015/09/02 15:03:43 kid1| clientProcessHit: Vary object loop!<br>
2015/09/02 15:03:43 kid1| varyEvaluateMatch: Oops. Not a Vary match
on second attempt, '<a class="moz-txt-link-freetext"
href="http://pstatic.bestpriceninja.com/nwp/v0_0_773/release/Shared/Extra/IFrameStoreReciever.js">http://pstatic.bestpriceninja.com/nwp/v0_0_773/release/Shared/Extra/IFrameStoreReciever.js</a>'
'accept-encoding="gzip,%20deflate,%20sdch"'<br>
2015/09/02 15:03:43 kid1| clientProcessHit: Vary object loop!<br>
2015/09/02 15:03:59 kid1| varyEvaluateMatch: Oops. Not a Vary match
on second attempt, '<a class="moz-txt-link-freetext"
href="http://static.xvideos.com/v2/css/xv-video-styles.css?v=7">http://static.xvideos.com/v2/css/xv-video-styles.css?v=7</a>'
'accept-encoding="gzip,deflate"'<br>
2015/09/02 15:03:59 kid1| clientProcessHit: Vary object loop!<br>
2015/09/02 15:03:59 kid1| varyEvaluateMatch: Oops. Not a Vary match
on second attempt, '<a class="moz-txt-link-freetext"
href="http://s7.addthis.com/js/250/addthis_widget.js">http://s7.addthis.com/js/250/addthis_widget.js</a>'
'accept-encoding="gzip,deflate"'<br>
2015/09/02 15:03:59 kid1| clientProcessHit: Vary object loop!<br>
<br>
<br>
<br>
Later on I tested it with this short config file and the problem
persisted:<br>
<br>
http_access allow localhost manager<br>
http_access deny manager<br>
acl purge method PURGE<br>
http_access allow purge localhost<br>
http_access deny purge<br>
acl all src all<br>
acl localhost src 127.0.0.1/32<br>
acl localnet src 127.0.0.0/8<br>
acl Safe_ports port 80<br>
acl snmppublic snmp_community public<br>
http_access deny !Safe_ports<br>
http_access allow all<br>
dns_v4_first on<br>
cache_mem 1024 MB<br>
maximum_object_size_in_memory 64 KB<br>
memory_cache_mode always<br>
maximum_object_size 150000 KB<br>
minimum_object_size 100 bytes<br>
collapsed_forwarding on<br>
logfile_rotate 5<br>
mime_table /etc/squid3/mime.conf<br>
debug_options ALL,1<br>
store_id_access deny all<br>
store_id_bypass on<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern ^<a class="moz-txt-link-freetext" href="http:\/\/movies\.apple\.com">http:\/\/movies\.apple\.com</a> 86400
20% 86400 override-expire override-lastmod ignore-no-cache
ignore-private ignore-reload<br>
refresh_pattern -i \.flv$ 10080 90% 999999
ignore-no-cache override-expire ignore-private<br>
refresh_pattern -i \.mov$ 10080 90% 999999
ignore-no-cache override-expire ignore-private<br>
refresh_pattern windowsupdate.com/.*\.(cab|exe) 4320 100% 43200
reload-into-ims<br>
refresh_pattern download.microsoft.com/.*\.(cab|exe) 4320 100% 43200
reload-into-ims<br>
refresh_pattern -i
\.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|pdf|tiff)$ 10080 90%
43200 override-expire ignore-no-cache ignore-private<br>
refresh_pattern -i (/cgi-bin/) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
quick_abort_min 0 KB<br>
quick_abort_max 0 KB<br>
quick_abort_pct 100<br>
range_offset_limit 0<br>
negative_ttl 1 minute<br>
negative_dns_ttl 1 minute<br>
read_ahead_gap 128 KB<br>
request_header_max_size 100 KB<br>
reply_header_max_size 100 KB<br>
via off<br>
acl apache rep_header Server ^Apache<br>
half_closed_clients off<br>
cache_mgr webmaster<br>
cache_effective_user squid<br>
cache_effective_group squid<br>
httpd_suppress_version_string on<br>
snmp_access allow snmppublic localhost<br>
snmp_access deny all<br>
snmp_incoming_address 127.0.0.1<br>
error_directory /etc/squid3/errors/English<br>
max_filedescriptors 65535 <br>
ipcache_size 1024<br>
forwarded_for off <br>
log_icp_queries off<br>
icp_access allow localnet<br>
icp_access deny all<br>
htcp_access allow localnet<br>
htcp_access deny all<br>
digest_rebuild_period 15 minutes<br>
digest_rewrite_period 15 minutes<br>
strip_query_terms off<br>
max_open_disk_fds 150<br>
cache_replacement_policy heap LFUDA<br>
memory_pools off<br>
http_port 9001 <br>
http_port 901 tproxy <br>
if ${process_number} = 1<br>
access_log stdio:/var/log/squid/1/access.log squid<br>
cache_log /var/log/squid/1/cache.log<br>
cache_store_log none<br>
cache_swap_state /var/log/squid/1/%s.swap.state<br>
else<br>
access_log none <br>
cache_log /dev/null<br>
endif<br>
pid_filename /var/run/squid1.pid<br>
visible_hostname localhost<br>
snmp_port 1611<br>
icp_port 3131<br>
htcp_port 4828<br>
cachemgr_passwd admin thisisnotmyrealpassword<br>
memory_cache_shared off<br>
cache_dir rock /cache1/rock1 256 min-size=100 max-size=3000 <br>
cache_dir rock /cache1/rock2 2000 min-size=3000 max-size=20000 <br>
cache_dir diskd /cache1/diskd2 60000 16 256 min-size=20000
max-size=200000<br>
cache_dir diskd /cache2/2 100000 16 256 min-size=200000
max-size=1048576<br>
cache_dir diskd /cache2/1 680000 16 256 min-size=1048576<br>
<br>
<br>
<br>
Any ideas what could be wrong?<br>
<br>
<br>
<br>
Thanks,<br>
Sebastian<br>
<br>
<br>
<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">El 26/08/15 a las 17:15, Amos Jeffries
escribió:<br>
</div>
<blockquote class=" cite" id="mid_55DE1E48_1090900_treenet_co_nz"
cite="mid:55DE1E48.1090900@treenet.co.nz" type="cite">
<pre wrap="">On 27/08/2015 7:53 a.m., Sebastián Goicochea wrote:
</pre>
<blockquote class=" cite" id="Cite_6570844" type="cite">
<pre wrap="">After I sent you my previous email, I continued investigating the
subject .. I made a change in the source code as follows:
File: /src/http.cc
HttpStateData::haveParsedReplyHeaders()
{
.
.
##### THIS IS NEW STUFF ###########
if (rep->header.has(HDR_VARY)) {
rep->header.delById(HDR_VARY);
debugs(11,3, "Vary detected. Hack Cleaning it up");
}
##### END OF NEW STUFF ###########
#if X_ACCELERATOR_VARY
if (rep->header.has(HDR_X_ACCELERATOR_VARY)) {
rep->header.delById(HDR_X_ACCELERATOR_VARY);
debugs(11,3, "HDR_X_ACCELERATOR_VARY Vary detected. Hack Cleaning it
up");
}
#endif
.
.
Deleting Vary from the header at this point gives me hits in every
object I test (that previously didn't hit) .. web browser never receives
the Vary in the response header.
Now I read your answer and you say that this is a critical validity
check and that worries me. Taking away the vary altogether at this point
could lead to the problems that you described? If that is the case .. I
have to investigate other alternatives.
</pre>
</blockquote>
<pre wrap="">I'll have to look into that function when I'm back at the code later to
confirm this. But IIRC that function is acting directly on a freshly
received reply message. You are not removing the validity check, you are
removing Squids ability to see that it is a Vary object at all. So it is
never even cached as one.
The side effect of that is that clients asking for non-gzip can get the
cached gzip copy, etc. but at least its the same URL. So the security
risks are gone. But the user experience is not always good either way.
Amos
_______________________________________________
squid-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<br>
<br>
</body>
</html>