<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#464646" bgcolor="#FFFFFF">
<font face="Arial">Thanks Amos for quick answer.<br>
<br>
Can you take away any hope of a workaround with Squid ?<br>
<br>
This makes me plan having to develop a function that has to
perform DNS resolution inside the helper with the performance
consequences that this will impose.<br>
<br>
<br>
</font><br>
<div class="moz-cite-prefix">Le 16/09/2021 à 16:21, Amos Jeffries a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:6803dd48-0513-61fa-9088-713244c27ea0@treenet.co.nz">On
16/09/21 10:09 pm, David Touzeau wrote:
<br>
<blockquote type="cite">Hi comunity, Squid fans
<br>
<br>
I would like to use an external acl process for Geoip processing
<br>
<br>
i have tried to setup squid to send the remote peer address
using %<a code but it always reply with a "-"
<br>
<br>
external_acl_type MyGeopip ttl=3600 negative_ttl=3600
children-startup=2 children-idle=2 children-max=20 concurrency=1
ipv4 %un %SRC %SRCEUI48 %>ha{X-Forwarded-For} %DST
%ssl::>sni %USER_CERT_CN %note %<a
/lib/squid3/squid-geoip
<br>
<br>
acl MyGeopip_acl external MyGeopip
<br>
http_access deny !MyGeopip_acl
<br>
<br>
I was thinking that Squid call the helper before resolving the
remote route.
<br>
<br>
</blockquote>
<br>
The problem is there is no server/peer connection at all for a
transaction that has only been received and not yet processed by
Squid.
<br>
<br>
<br>
<blockquote type="cite">So to force it, i have added a "fake" acl
to force Squid to calculate the remote address.
<br>
<br>
acl fake_dst dst 127.0.0.2
<br>
http_access deny !fake_dst !MyGeopip_acl
<br>
<br>
But it failed too, the external_acl still receive the "-"
instead of the remote public IP address of the server
<br>
<br>
</blockquote>
<br>
Aye. There is still no server.
<br>
<br>
All this dst ACL changed was that Squid knows a group of IPs it
*might* select from. The decision whether to use one of them (or
somewhere entirely different) has not yet been made, so there is
still no server.
<br>
<br>
The "%<a" displays the "last server or peer connection". It can
change when automated retries are done, and is "-" at all points
before any server contact.
<br>
<br>
<br>
Amos
<br>
_______________________________________________
<br>
squid-users mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<br>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
<br>
</blockquote>
<br>
</body>
</html>