Re: [squid-dev] Bzr to git migration schedule

2017-07-17 Thread Alex Rousskov
On 07/17/2017 04:20 AM, Amos Jeffries wrote: > On 17/07/17 06:14, Alex Rousskov wrote: >> Since we will switch to PR-only commit >> path (for master) as soon as Eduard's CI integration is ready, I suggest >> that we keep the current review-required setup to practice. We can

Re: [squid-dev] Bzr to git migration schedule

2017-07-16 Thread Alex Rousskov
On 07/16/2017 06:40 AM, Amos Jeffries wrote: >> On 16/07/17 16:43, Alex Rousskov wrote: >>> I tried to "lock" the >>> official repository on Github to prevent commits (without pull >>> requests), but I have not tested whether that lock was

Re: [squid-dev] Bzr to git migration schedule

2017-07-16 Thread Alex Rousskov
On 07/15/2017 10:50 PM, Amos Jeffries wrote: > The -5 and -4 repo's are going to be deleted ASAP, right? Those branches are handled under issue #18: https://github.com/squid-cache/squid/issues/18 I was going to hide them first, but I do not see to find a way to do that -- I was probably thinking

Re: [squid-dev] Bzr to git migration schedule

2017-07-15 Thread Alex Rousskov
On 07/11/2017 10:20 PM, Alex Rousskov wrote: > 2017-07-11: No more new tags in the official bzr repo. > 2017-07-13: No more new commits(*) in the official bzr repo. > 2017-07-14: Migration starts. > 2017-07-15: Anticipated optimistic migration end. > 2017-07-18: Anticipa

Re: [squid-dev] [PATCH] Fix SSL certificate cache refresh and collision handling.

2017-07-14 Thread Alex Rousskov
On 07/14/2017 09:18 AM, Christos Tsantilas wrote: > SslBump was ignoring origin server certificate changes and using the > previously cached fake certificate (mimicking now-stale properties). I suggest replacing the above claim with a more accurate one (based on our off-list discussions): """

Re: [squid-dev] [PATCH] Happy Eyeballs: Deliver DNS results to peer selection ASAP

2017-07-11 Thread Alex Rousskov
On 07/08/2017 04:30 PM, Alex Rousskov wrote: > On 07/01/2017 10:16 PM, Alex Rousskov wrote: >> On 07/01/2017 12:57 AM, Amos Jeffries wrote: >>> On 01/07/17 10:44, Alex Rousskov wrote: >>>> >>>> If caching IPv6 /etc/hosts entries when IPv6 suppor

[squid-dev] Bzr to git migration schedule

2017-07-11 Thread Alex Rousskov
Hello, The Squid Project will be transitioning its official source code repository from bzr to git. Most of the currently stored official information will be preserved during the migration. The lists of all bzr branches and tags to be migrated or abandoned are available[1,2]. If you find any

Re: [squid-dev] [PATCH] switch session/connection for OpenSSL

2017-07-10 Thread Alex Rousskov
On 07/09/2017 04:30 AM, Amos Jeffries wrote: > On 09/07/17 15:28, Alex Rousskov wrote: >> On 06/10/2017 06:27 AM, Amos Jeffries wrote: >>> - I have not gone through and renamed uses of SessionPointer beyond >>> those directly involved with the above code shuffle.

Re: [squid-dev] [PATCH] switch session/connection for OpenSSL

2017-07-08 Thread Alex Rousskov
o much controversy. The details are further below. > On 27/04/17 05:24, Alex Rousskov wrote: >> Needless to say, I would be happy if we can come up with better >> definitions or even better concepts. The above is a starting point. > I do not think it is up to us to define these

Re: [squid-dev] [PATCH] Happy Eyeballs: Deliver DNS results to peer selection ASAP

2017-07-08 Thread Alex Rousskov
On 07/01/2017 10:16 PM, Alex Rousskov wrote: > On 07/01/2017 12:57 AM, Amos Jeffries wrote: >> On 01/07/17 10:44, Alex Rousskov wrote: >>> >>> If caching IPv6 /etc/hosts entries when IPv6 support is disabled was an >>> accident, then I will remove that

Re: [squid-dev] [PATH] Convert the URL::parse method API to take const URI strings

2017-07-08 Thread Alex Rousskov
On 07/08/2017 10:36 AM, Amos Jeffries wrote: > The input buffer is no longer truncated when overly long. All callers > have been checked that they handle the bool false return value in ways > that do not rely on that truncation. That is a useful change, thank you. I cannot check whether any

Re: [squid-dev] [PATCH] Happy Eyeballs: Deliver DNS results to peer selection ASAP

2017-07-01 Thread Alex Rousskov
On 07/01/2017 12:57 AM, Amos Jeffries wrote: > On 01/07/17 10:44, Alex Rousskov wrote: >> >> If caching IPv6 /etc/hosts entries when IPv6 support is disabled was an >> accident, then I will remove that functionality, simplifying the patch. >> If it was intentional,

Re: [squid-dev] RFP: ssl-bump support for upstream proxy in transparent mode

2017-07-01 Thread Alex Rousskov
On 06/30/2017 10:07 PM, Alexandr wrote: > В Пт, 30/06/2017 в 11:52 -0600, Alex Rousskov пишет: >> Please keep our terms confidential. So much for that. Sigh. You should be more careful. Alex. ___ squid-dev mailing list squid-dev@lists.squid-

Re: [squid-dev] RFP: ssl-bump support for upstream proxy in transparent mode

2017-07-01 Thread Alex Rousskov
On 06/30/2017 10:07 PM, Alexandr wrote: > В Пт, 30/06/2017 в 11:52 -0600, Alex Rousskov пишет: >> Measurement Factory can add basic upstream proxy support for SslBump in >> Squid v5. That support will match existing upstream proxy support in >> Squid but will be applied to f

[squid-dev] [PATCH] Happy Eyeballs: Deliver DNS results to peer selection ASAP

2017-06-30 Thread Alex Rousskov
Hello, This patch completes a series of Happy Eyeballs-related changes: 1. stable Squid: Parallel DNS A and queries. 2. v5 r15183: ASAP delivery of IPs from peer selection to FwdState. 3. This patch: ASAP delivery of IPs from DNS to peer selection. 4. A separate project should add:

Re: [squid-dev] [PATCH] Fix 'miss_access' and 'cache' checks when no ACL rules matched

2017-06-25 Thread Alex Rousskov
On 06/21/2017 01:48 PM, Amos Jeffries wrote: >> On 12.06.2017 14:14, Eduard Bagdasaryan wrote: >>> >>> On 01.06.2017 17:37, Amos Jeffries wrote: The admin intention here is almost invariably to prevent certain users getting cached data. Preventing cache being used simply for lack of

Re: [squid-dev] [PATCH] Reduce "!Comm::MonitorsRead(serverConnection->fd)" assertions.

2017-06-23 Thread Alex Rousskov
On 06/23/2017 03:53 AM, Christos Tsantilas wrote: > Στις 21/06/2017 08:07 μμ, ο Alex Rousskov έγραψε: >> 2. *If* the request object is actually always there, then change the >> pinConnection() parameter to an Http::Request reference (and change >> callers to dereference t

Re: [squid-dev] [PATCH] Reduce "!Comm::MonitorsRead(serverConnection->fd)" assertions.

2017-06-21 Thread Alex Rousskov
On 06/21/2017 05:40 AM, Christos Tsantilas wrote: > Replaced primary ConnStateData::pinConnection() calls with a pair of > pinBusyConnection() and notePinnedConnectionBecameIdle() calls, > depending on the pinned connection state ("busy" or "idle"). > > Removed pinConnection() parameters that

Re: [squid-dev] [PATCH] Reduce "!Comm::MonitorsRead(serverConnection->fd)" assertions.

2017-06-21 Thread Alex Rousskov
On 06/21/2017 08:24 AM, Amos Jeffries wrote: > On 21/06/17 23:40, Christos Tsantilas wrote: >> * Protect Squid Client classes from new requests that compete with >> ongoing pinned connection use and >> * resume dealing with new requests when those Client classes are done >> using the pinned

Re: [squid-dev] Squid-4 status update

2017-06-20 Thread Alex Rousskov
On 06/20/2017 08:43 AM, Amos Jeffries wrote: > On 20/04/17 05:40, Amos Jeffries wrote: >> On 20/04/17 04:26, Alex Rousskov wrote: >>> On 03/26/2017 09:20 PM, Amos Jeffries wrote: >>>> Any other issues that dont have bug reports I should wait for? >>> I re

Re: [squid-dev] src/forward.h

2017-06-20 Thread Alex Rousskov
On 06/20/2017 03:39 AM, Amos Jeffries wrote: > On 20/06/17 21:06, Christos Tsantilas wrote: >> Στις 20/06/2017 01:59 πμ, ο Alex Rousskov έγραψε: >>>> revno: 15212 >>>> committer: Amos Jeffries <squ...@treenet.co.nz> >>>> branch nick: 5 >>

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-18 Thread Alex Rousskov
On 06/18/2017 07:39 AM, Amos Jeffries wrote: > So, I update my vote to +1. > > Since you seem okay with this Alex I am assuming that is another +1 from > you and applying to Squid-5. I actually wanted to apply a couple of polishing touches before committing. Now done in v5 r15210. Thank you,

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-16 Thread Alex Rousskov
nstead of running with a WARNING, but the patch does not change that behavior so we should not discuss it here. I hope my explanation of what the patch does will allow you to change your vote. Thank you, Alex. >> On 15.06.2017 17:35, Alex Rousskov wrote: >>> On 06/15/2017 04

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-15 Thread Alex Rousskov
On 06/15/2017 04:57 AM, Andreas Weigel wrote: > From discussion on squid-dev, the following behavior is implemented by > this patch: > > * -N: The initial process is a master and a worker process. > No kids. > No daemonimization. > > * --foreground: The initial process is the master process.

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-09 Thread Alex Rousskov
On 06/09/2017 09:21 AM, Andreas Weigel wrote: > Alex Rousskov wrote: >> I would _not_ change that terminology now because >> all the renaming will obfuscate your true fix and make it more difficult >> to understand/review. > I have to disagree to that one. Renaming

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-09 Thread Alex Rousskov
On 06/09/2017 05:34 AM, Andreas Weigel wrote: > - a SIGTERM to the master process makes it wait for its children to > shutdown for 30 seconds > --> Is that desired behavior? The question is out of scope, but the answer is "yes". See shutdown_lifetime in squid.conf.documented. > I would

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-09 Thread Alex Rousskov
On 06/09/2017 01:38 AM, Andreas Weigel wrote: > The > overall idea was to make the decision to create and manage kids to > depend on the number of configured workers/diskers. It feels like you may be drifting into a dangerous territory of fixing/changing "everything" related to SMP. Please stay

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-09 Thread Alex Rousskov
On 06/09/2017 07:23 AM, Amos Jeffries wrote: > Since 3.5 is in stable it is quite limited in the types of > things I'm accepting ports for. Changing the -N behaviour is not one of > those due to the fragile net of things people have depending on it. I do not think we should be changing -N

Re: [squid-dev] [POSSIBLE BUG???] "FS Block Size = 1024" printed by cachemgr.cgi

2017-06-08 Thread Alex Rousskov
On 06/08/2017 09:36 PM, Stéphane Ouellette wrote: > Isn't storeDirGetBlkSize() meant to return the "file system block size"? Naturally, storeDirGetBlkSize() is not meant to return the file system block size. AFAICT, storeDirGetBlkSize() users expect this function to return, roughly, the disk

Re: [squid-dev] [BUG] Incorrect "FS Block Size" printed by cachemgr.cgi for the Rock store

2017-06-08 Thread Alex Rousskov
On 06/08/2017 09:06 PM, Stéphane Ouellette wrote: >while I was testing the use of the rock store on a ZFS pool using > file system block sizes of 4K, 8K and 16K, I noticed that cachemgr.cgi > always printed "FS Block Size = 1024" in all cases. > >I tracked down the issue by comparing

Re: [squid-dev] [PATCH] Happy Eyeballs: Use each fully resolved destination ASAP

2017-06-08 Thread Alex Rousskov
On 05/24/2017 10:27 PM, Amos Jeffries wrote: > Okay. +1 on the code now Committed to v5 (r15183). The next step is in the works. Alex. > 1. Squid currently implements: Use parallel A and queries. > 2. This patch: ASAP delivery of IPs from peer selection to FwdState. > 3. The next step:

Re: [squid-dev] SMP scaling in no_daemon mode?

2017-06-08 Thread Alex Rousskov
On 06/08/2017 05:49 AM, Andreas Weigel wrote: > Being interested in the SMP feature of squid we face the problem that it > only works in daemon mode, which is inherently incompatible with runit > supervising the service (would notice the process exiting and start it > over and over again). Hi

Re: [squid-dev] [PATCH] Do not die silently when dying via std::terminate()

2017-06-04 Thread Alex Rousskov
On 06/01/2017 06:38 PM, Alex Rousskov wrote: > On 05/17/2017 06:20 PM, Alex Rousskov wrote: >> Hello, >> >> While triaging a silent crash of a production Squid, I realized that >> our death reporting code has a serious (and recently grown) hole. The >> attache

Re: [squid-dev] [PATCH] Do not die silently when dying early

2017-06-01 Thread Alex Rousskov
On 05/20/2017 10:31 AM, Alex Rousskov wrote: > On 05/20/2017 05:04 AM, Amos Jeffries wrote: > >> in src/Debug.h: >> >> * instead of adding yet another wrapper macro, please replace all uses >> of debug_log with DebugStream(). > I will not do that because ma

Re: [squid-dev] [PATCH] Do not die silently when dying via std::terminate()

2017-06-01 Thread Alex Rousskov
On 05/17/2017 06:20 PM, Alex Rousskov wrote: > Hello, > > While triaging a silent crash of a production Squid, I realized that > our death reporting code has a serious (and recently grown) hole. The > attached patch closes it. This reporting-only patch does not fi

Re: [squid-dev] [PATCH] Fix reopened bug 2833

2017-06-01 Thread Alex Rousskov
On 05/22/2017 10:26 AM, Alex Rousskov wrote: > On 05/08/2017 08:03 AM, Eduard Bagdasaryan wrote: >> This patch fixes [reopened] bug 2833. >> >> A security fix made in r14979 had a negative effect on collapsed >> forwarding. All "private" entries were considered

Re: [squid-dev] [PATCH] ssl::server_name options to control matching logic.

2017-05-31 Thread Alex Rousskov
On 05/30/2017 10:58 PM, Amos Jeffries wrote: > On 26/05/17 22:08, Christos Tsantilas wrote: >> --consensus allows matching a part of the conglomerate when the part's >> subject name is included in certificates used by many other >> conglomerate parts (e.g., matching Google but not Youtube). > So

Re: [squid-dev] Memory error

2017-05-24 Thread Alex Rousskov
If there are none, file a new bug report. Alex > - Original Message ----- > From: "Alex Rousskov" <rouss...@measurement-factory.com> > To: "William Lima" <william.l...@hscbrasil.com.br> > Cc: squid-dev@lists.squid-cache.org > Sent: Wednesday, May 24,

Re: [squid-dev] [PATCH] Happy Eyeballs: Use each fully resolved destination ASAP

2017-05-24 Thread Alex Rousskov
On 05/24/2017 09:04 AM, Amos Jeffries wrote: > For the 1st destination ps_state::handlePath() calls noteDestination() > which results in the entire TunnelState::startConnecting() / > FwdState::startConnectionOrFail() sequence happening synchronously > before returning to ps_state::handlePaths()

Re: [squid-dev] Memory error

2017-05-24 Thread Alex Rousskov
On 05/24/2017 11:29 AM, William Lima wrote: > > Sharing a single cache_dir (diskd) entry for a multiple worker setup is a > valid approach, right? No, it is not valid. Diskd is not SMP-aware. Using a single diskd cache_dir with multiple workers results in undefined behavior which may include

Re: [squid-dev] [PATCH] Adds support for --long-acl-options

2017-05-24 Thread Alex Rousskov
On 05/24/2017 02:31 AM, Christos Tsantilas wrote: > Adds support for --long-acl-options s/Adds/Add/ or s/Adds support for/Support/. > This patch adds support for --long-acl-options. The old single-letter The first sentence in the second paragraph can be removed as it duplicates the first

Re: [squid-dev] [PATCH] Do not revive unconditionally dead peers after DNS refresh

2017-05-22 Thread Alex Rousskov
On 05/15/2017 11:08 AM, Alex Rousskov wrote: > On 05/15/2017 08:31 AM, Eduard Bagdasaryan wrote: >> I followed your plan with few adjustments and reattached the patch. > > LGTM. Will commit soon if there are not objections. Committed to v5 (r15145) with minor polishing touches. T

Re: [squid-dev] [PATCH] xstrndup has to go

2017-05-22 Thread Alex Rousskov
On 04/29/2017 10:17 AM, Alex Rousskov wrote: > On 04/29/2017 02:33 AM, Amos Jeffries wrote: >> +1 if you update the patch to do the above. +0 otherwise - ie. go ahead >> with commit if you want, but I'd rather see the fixed caller(s) fixed to >> use a more long-ish term f

Re: [squid-dev] [PATCH] Fix reopened bug 2833

2017-05-22 Thread Alex Rousskov
On 05/08/2017 08:03 AM, Eduard Bagdasaryan wrote: > This patch fixes [reopened] bug 2833. > > A security fix made in r14979 had a negative effect on collapsed > forwarding. All "private" entries were considered automatically > non-shareable among collapsed clients. However this is not true: there

Re: [squid-dev] [PATCH] Do not die silently when dying early

2017-05-20 Thread Alex Rousskov
On 05/20/2017 05:04 AM, Amos Jeffries wrote: > in src/Debug.h: > > * instead of adding yet another wrapper macro, please replace all uses > of debug_log with DebugStream(). I will not do that because many (most?) debug_log users should not use DebugStream(). They should use the standard

[squid-dev] [PATCH] Do not die silently when dying early

2017-05-19 Thread Alex Rousskov
Hello, The attached patch allows Squid to report various problems (e.g., mishandled exceptions) that may occur very early in Squid lifetime, before proper logging is configured by the first _db_init() call. To enable such early reporting, we started with a trivial debug.cc change: -FILE

Re: [squid-dev] [PATCH] Make PID file check/creation atomic

2017-05-19 Thread Alex Rousskov
Amos Jeffries wrote: > Please use std::atomic > locks to ensure actually atomic operations on the file locks. std::atomic<> is defined for integers and pointers. It is not defined for "file locks", which are complex OS-maintained objects largely invisible to Squid. C++11 std::atomic cannot

Re: [squid-dev] OpenSSL 1.1 regression

2017-05-18 Thread Alex Rousskov
On 05/18/2017 10:23 AM, Christos Tsantilas wrote: > On 18/05/2017 06:05 μμ, Alex Rousskov wrote: >> I suspect it would be cheaper, in the long term, to use feature tests. > However is not easy to always use this method. The OpenSSL-1.1.0 put > many API changes trying to hide st

Re: [squid-dev] OpenSSL 1.1 regression

2017-05-18 Thread Alex Rousskov
On 05/18/2017 09:34 AM, Ingo Schwarze wrote: > Alex Rousskov wrote on Thu, May 18, 2017 at 09:05:29AM -0600: >> On 05/18/2017 05:12 AM, Christos Tsantilas wrote: >>> Agrr... Using the openSSL version was the faster/easier way. Touching >>> autoconf may result

Re: [squid-dev] OpenSSL 1.1 regression

2017-05-18 Thread Alex Rousskov
On 05/18/2017 05:12 AM, Christos Tsantilas wrote: > Agrr... Using the openSSL version was the faster/easier way. Touching > autoconf may result to 2-3 full squid rebuilds to implement/test similar > fixes. The alternative is to convince others that Squid will not support OpenSSL API

[squid-dev] [PATCH] Do not die silently when dying via std::terminate()

2017-05-17 Thread Alex Rousskov
Hello, While triaging a silent crash of a production Squid, I realized that our death reporting code has a serious (and recently grown) hole. The attached patch closes it. This reporting-only patch does not fix any crashes. There are more technical details in the preamble. Researching this

Re: [squid-dev] Introduction / SslBump prototype patch to ignore unknown ciphers

2017-05-17 Thread Alex Rousskov
On 05/17/2017 03:18 PM, David Hogan wrote: > I found that applying a blacklist at step3 resulted in too many false > positives > caused by subjectAltName matches. Factory is working on a patch to address that problem. > I am hoping separately to figure > out how to match missing SNI and

Re: [squid-dev] Introduction / SslBump prototype patch to ignore unknown ciphers

2017-05-17 Thread Alex Rousskov
On 05/17/2017 12:09 PM, David Hogan wrote: > ssl_bump peek step1 > ssl_bump peek step2 whitelist > ssl_bump terminate step2 blacklist > ssl_bump peek step2 > ssl_bump splice step3 The above configuration looks strange but this is squid-dev not squid-users, so I trust you

Re: [squid-dev] OpenSSL 1.1 regression

2017-05-17 Thread Alex Rousskov
On 05/17/2017 10:35 AM, Christos Tsantilas wrote: > +#if (OPENSSL_VERSION_NUMBER >= 0x10002000L) > +X509 * cert = SSL_CTX_get0_certificate(ctx.get()); If it is possible to replace this version check with a ./configure-time detection of SSL_CTX_get0_certificate() availability, please do that.

Re: [squid-dev] [PATCH] Happy Eyeballs: Use each fully resolved destination ASAP

2017-05-16 Thread Alex Rousskov
On 05/16/2017 03:31 AM, Amos Jeffries wrote: > On 16/05/17 16:33, Alex Rousskov wrote: >> The attached patch is the first in a short series of patches that >> improve Squid support for the Happy Eyeballs principle. The motivation >> for these patches has been discussed on

Re: [squid-dev] [PATCH] Make PID file check/creation atomic

2017-05-16 Thread Alex Rousskov
On 05/16/2017 06:23 AM, Amos Jeffries wrote: > On 16/05/17 06:53, Eduard Bagdasaryan wrote: >> Ssl::Lock class resides in >> src/security/cert_generators/file/certificate_db.h. > I suspect the limitations you found to that class are behind the > ssl_crtd helper bugs Those Ssl::Lock limitations

Re: [squid-dev] [PATCH] Do not revive unconditionally dead peers after DNS refresh

2017-05-15 Thread Alex Rousskov
On 05/15/2017 08:31 AM, Eduard Bagdasaryan wrote: > I followed your plan with few adjustments and reattached the patch. LGTM. Will commit soon if there are not objections. Alex. > On 06.05.2017 00:33, Alex Rousskov wrote: >> On 04/27/2017 02:39 PM, Eduard Bagdasaryan wrote: >&g

Re: [squid-dev] [PATCH] Second adaptation missing for CONNECTs

2017-05-07 Thread Alex Rousskov
On 03/31/2017 07:21 AM, Christos Tsantilas wrote: > Avoid sending second CONNECT request to adaptation > > > The users may not want to send the second request to the adaptation > services. In this case they can use acls as follows: > > acl

Re: [squid-dev] [PATCH] Do not revive unconditionally dead peers after DNS refresh

2017-05-05 Thread Alex Rousskov
On 04/27/2017 02:39 PM, Eduard Bagdasaryan wrote: > +// always start probing in order to effectively detect > +// dead or revived peers > +(void)peerProbeConnect(p); I think we can simplify that comment while making it more precise: peerProbeConnect(p); // detect any died or

Re: [squid-dev] [PATCH] Do not forward HTTP requests to dead idle peers

2017-05-05 Thread Alex Rousskov
On 05/01/2017 07:38 AM, Eduard Bagdasaryan wrote: > There are still no remarks about this patch. > Is there something to be fixed before it can go in? Committed to v5 (r15133) without changes. Thank you, Alex. > On 18.04.2017 13:40, Eduard Bagdasaryan wrote: >> Hello, >> >> This patch removes

Re: [squid-dev] A new 'has' ACL

2017-05-02 Thread Alex Rousskov
no reason to resist supporting "has ALE" if Squid support for ALE is currently broken and cannot be fixed easily/quickly. If you see flaws in this logic, please point them out. I may be missing something. Thank you, Alex. > On 01.05.2017 19:11, Alex Rousskov wrote: >> On 04/30/201

Re: [squid-dev] [PATCH] xstrndup has to go

2017-05-01 Thread Alex Rousskov
On 04/30/2017 11:26 PM, Amos Jeffries wrote: > On 30/04/17 04:17, Alex Rousskov wrote: >> On 04/29/2017 02:33 AM, Amos Jeffries wrote: >> >>> If that is too hard, making callers do the allocate bit themselves and >>> xstrncpy() instead should be a good medi

Re: [squid-dev] A new 'has' ACL

2017-05-01 Thread Alex Rousskov
On 04/30/2017 10:03 PM, Amos Jeffries wrote: > Is there an explicit need you have found for ALE to be on the > component list? Since ALE is currently standing in as a "master > transaction" object for most of the Squid code. It needs to be either > created or provided/fetched from elsewhere

Re: [squid-dev] [PATCH] shuffle remaining session cache code to libsecurity

2017-04-29 Thread Alex Rousskov
On 04/29/2017 02:45 AM, Amos Jeffries wrote: >> "auto" needs "const" and "&" but not "*". > FYI: that statement does not match my experiences with auto in the > general case. I suspect it matches your experiences but not your interpretation of those experiences. Squid has many examples where

[squid-dev] [PATCH] xstrndup has to go

2017-04-26 Thread Alex Rousskov
Hello, I accidentally discovered that our xstrndup() documentation lies and its implementation is dangerously nothing like the standard one. The attached patch fixes documentation and three callers. Please see the patch preamble for details, including lack of ESI testing. The attached patch

Re: [squid-dev] [PATCH] switch session/connection for OpenSSL

2017-04-26 Thread Alex Rousskov
On 04/26/2017 06:53 AM, Amos Jeffries wrote: > Been digging around in library guts and yes you were right Alex - for > OpenSSL and the very old ones based on SSL protocol. Just not for the > other N libraries based on TLS design which I/we hope to support. There > is structural difference between

Re: [squid-dev] [RFC] CRUSH peer selection method

2017-04-19 Thread Alex Rousskov
On 04/19/2017 08:06 AM, Loic Dachary wrote: > On 04/19/2017 03:53 PM, Alex Rousskov wrote: >> On 04/18/2017 01:00 AM, Loic Dachary wrote: >> >>> It turns out [CARP] performs as well as CRUSH >> On 04/19/2017 06:51 AM, Loic Dachary wrote: >> >>

Re: [squid-dev] [RFC] CRUSH peer selection method

2017-04-17 Thread Alex Rousskov
On 04/17/2017 10:53 AM, Loic Dachary wrote: > On 04/17/2017 06:28 PM, Alex Rousskov wrote: >> On 04/17/2017 09:08 AM, Loic Dachary wrote: >> >>> peer 1 targeted by a set of requests (X1) >>> peer 2 targeted by a set of requests (X2) >> >>&

Re: [squid-dev] [RFC] CRUSH peer selection method

2017-04-17 Thread Alex Rousskov
On 04/17/2017 09:08 AM, Loic Dachary wrote: > peer 1 targeted by a set of requests (X1) > peer 2 targeted by a set of requests (X2) > and we add a new peer, CRUSH makes it so 1/3 of the requests from peer 1 and > 2 move to peer 3 > peer 1 targeted by a set of requests (2/3 of X1) >

Re: [squid-dev] [PATCH] cleanup external_acl_type cache

2017-04-12 Thread Alex Rousskov
On 04/12/2017 10:13 AM, Amos Jeffries wrote: > The current O(1) is achieved only through the way dlink requires an > iterator raw-pointer to be stored in the Entry itself, not the list > owner object. Yes, dlink is an intrusive list. > That itself is a yuck factor that causes us a lot of >

Re: [squid-dev] [RFC] nullptr conversion (again)

2017-04-12 Thread Alex Rousskov
On 04/12/2017 09:53 AM, Amos Jeffries wrote: > I have been thinking of this again and think I have come up with a way > to make some better progress. > > The idea is to split the NULL -> nullptr changes into two groups: > > 1) those lines where sed s/nullptr/NULL/g can be used to reverse the >

Re: [squid-dev] [PATCH] cleanup external_acl_type cache

2017-04-12 Thread Alex Rousskov
On 04/12/2017 09:30 AM, Adam Majer wrote: >>> If you need an intrusive list container for performance reasons, please >>> consider using Boost.Intrusive instead of rolling your own. >> The idea of using Boost for Squid has been discussed and, IIRC, rejected >> (for the time being): We have more

Re: [squid-dev] [PATCH] cleanup external_acl_type cache

2017-04-12 Thread Alex Rousskov
On 04/12/2017 06:08 AM, Adam Majer wrote: > On 04/12/2017 03:48 AM, Alex Rousskov wrote: >> BTW, if you do end up removing this intrusive list, please check whether >> its ExternalACLEntry::lru "anchor" member should be removed as a side >> effect. P

Re: [squid-dev] on_unsupported_protocol rewrite to support tcp connection, relay

2017-04-04 Thread Alex Rousskov
On 03/27/2017 12:35 AM, 钱国正 wrote: > What if the protocol is not http, but using 80 port, can squid relay it > to its target server? Yes, if you intercept port 80 connections. Assuming you do intercept, what you want should be already supported by on_unsupported_protocol. However, there is a

Re: [squid-dev] on_unsupported_protocol rewrite to support tcp connection relay

2017-03-24 Thread Alex Rousskov
On 03/24/2017 04:54 AM, 钱国正 wrote: > I want to know what's the > pinning.serverConnection mean? and what it is used for? Before we dive into low-level details, please allow me to ask an important high-level question. Your answer may render those low-level detail irrelevant: > I want to rewrite

Re: [squid-dev] [PATCH] Fix ext_session_acl to handle - when no argument is passed

2017-03-23 Thread Alex Rousskov
On 03/22/2017 07:53 PM, Amos Jeffries wrote: > This helpers' passive mode does not need to care what the input is, so > long as it is consistent. I do not recommend ignoring input format in hope that ignored input is consistent/acceptable/compatible/etc. However, I am not going to object to any

Re: [squid-dev] [PATCH] Fix ext_session_acl to handle - when no argument is passed

2017-03-22 Thread Alex Rousskov
On 03/22/2017 06:44 AM, Amos Jeffries wrote: > This is a side effect of the change to using logformat tokens. The > %DATA field is always present now. My understanding is that, after the logformat changes, Squid started appending "-" to the helper query when an external ACL has no parameters.

Re: [squid-dev] [RFC] Do not use idle dead peers

2017-03-22 Thread Alex Rousskov
On 03/21/2017 10:27 PM, Amos Jeffries wrote: > On 22/03/2017 10:27 a.m., Alex Rousskov wrote: >> This Request For Comments proposes to remove a subtle Squid >> (mis)feature. If you happen to use the corresponding feature, please >> speak up to protect it! If nobody defends

Re: [squid-dev] [PATCH] VIA creation code duplication

2017-03-22 Thread Alex Rousskov
On 03/22/2017 07:20 AM, Amos Jeffries wrote: > On 17/03/2017 6:17 a.m., Alex Rousskov wrote: >> On 03/16/2017 05:15 AM, Amos Jeffries wrote: >> >> >>> Any objections to applying this with this added: >>> >>> // XXX: putStr() still has String

Re: [squid-dev] Rock store stopped accessing discs

2017-03-17 Thread Alex Rousskov
On 03/17/2017 09:48 AM, Heiler Bemerguy wrote: > Sadly the same thing occurred again. It seems the hole is deeper lol.. Most likely, it is the same hole. However, the more we panic and jump to conclusions, the deeper that hole below us may look... > I couldn't find any previous messages that

Re: [squid-dev] To make squid works in snap world.

2017-03-17 Thread Alex Rousskov
On 03/17/2017 02:05 AM, Gary Wang wrote: > I made another change to keep new DEFAULT_IPC_PREFIX > consistent in src/ipc/Port.cc file. >Could you guys help review the MP? >https://code.launchpad.net/~gary-wzl77/squid/ipc_prefix/+merge/318714 I can only repeat what I have already

Re: [squid-dev] Support forward unknown protocol using http port which redirected to squid

2017-03-17 Thread Alex Rousskov
On 03/17/2017 01:06 AM, 钱国正 wrote: > I am using squid as a transparent proxy in Router, > redirecting data which destination port is 80 to squid, > and it work fine for a long time, just days before, I found there is one > case that will not make the mobile app not work. > > The case is the

Re: [squid-dev] To make squid works in snap world.

2017-03-16 Thread Alex Rousskov
On 03/16/2017 05:30 PM, Gary Wang wrote: > On Thu, Mar 16, 2017 at 2:49 AM, Alex Rousskov wrote: >> On 03/15/2017 11:03 AM, Gary Wang wrote: >>>In snap world, only the following name pattern is allowed >>> /dev/shm/sem.snap.@{SNAP_NAME}.* >>>

Re: [squid-dev] Fwd: [PATCH] for loops modernization

2017-03-16 Thread Alex Rousskov
On 03/16/2017 11:00 AM, khaled belhout wrote: > but we need to annotate the some functions with [[noreturn]] attribute like : I do not think such annotations belong to the source code. If we add various annotations for various tools, the code readability and maintainability will suffer. AFAIK,

Re: [squid-dev] [PATCH] Honor peer timeouts when forwarding CONNECTs

2017-03-16 Thread Alex Rousskov
On 03/16/2017 01:15 AM, Amos Jeffries wrote: > * "start" is an action name and we use it (almost?) exclusively for Job > initiation. By comparison "started" means/implies more clearly a state > or time point. The Tunnel member stores a time point. > - IMO both are bad, but "started" is better

Re: [squid-dev] [PATCH] VIA creation code duplication

2017-03-16 Thread Alex Rousskov
On 03/16/2017 05:15 AM, Amos Jeffries wrote: > Any objections to applying this with this added: > > // XXX: putStr() still has String 64KB limits > Must(strVia.length() < 64*1024); No objections from me if you replace the magic constant with a new inlined String::MaxSizeXXX() method. The

Re: [squid-dev] [PATCH] Fix broken build for ufsdump

2017-03-16 Thread Alex Rousskov
On 03/16/2017 01:43 AM, Amos Jeffries wrote: > On 6/03/2017 3:54 p.m., Alex Rousskov wrote: >> On 03/05/2017 12:28 PM, Eduard Bagdasaryan wrote: >>> ufsdump build is broken now [...] >>> This patch fixes this, however I am not sure that >>> does it in a best po

Re: [squid-dev] To make squid works in snap world.

2017-03-15 Thread Alex Rousskov
On 03/15/2017 11:03 AM, Gary Wang wrote: > On Thu, Mar 16, 2017 at 12:33 AM, Alex Rousskov wrote: >> On 03/15/2017 03:24 AM, Gary Wang wrote: >> > Regarding the confinement of usage of shared memory in snap world, >> >Please take a look at th

Re: [squid-dev] Fwd: [PATCH] for loops modernization

2017-03-15 Thread Alex Rousskov
On 03/15/2017 08:17 AM, Amos Jeffries wrote: > That said, there are points in the lifecycle which are more friendly to > bg changes. The next one I expect these C++11 changes can even have a > chance is after 3.5 ceases to be a supported version. I agree, especially if "supported" includes "we

Re: [squid-dev] Fwd: [PATCH] for loops modernization

2017-03-15 Thread Alex Rousskov
acement noise. In summary: I still do not think these changes are desirable (even in their polished variant), but if others overrule me on that, my comments about the quality of the current changes still apply. Thank you, Alex. > 2017-03-13 14:45 GMT+01:00 Alex Rousskov <rouss...@measur

Re: [squid-dev] To make squid works in snap world.

2017-03-14 Thread Alex Rousskov
On 03/14/2017 09:52 PM, Gary Wang wrote: > On Tue, Mar 14, 2017 at 11:49 PM, Alex Rousskov wrote: >> On 03/14/2017 08:44 AM, Gary Wang wrote: >> > About the DEFAULT_STATEDIR, >> > ... >> > DEFS += -DDEFAULT_S

Re: [squid-dev] Rock store stopped accessing discs

2017-03-14 Thread Alex Rousskov
On 03/14/2017 10:43 AM, Heiler Bemerguy wrote: > Em 07/03/2017 20:26, Alex Rousskov escreveu: >> How can a disker response get stuck? Most likely, something unusual >> happened ~13 days ago. This could be a Squid bug and/or a kid restart. > root@proxy:~# ps auxw |grep squid

Re: [squid-dev] To make squid works in snap world.

2017-03-14 Thread Alex Rousskov
On 03/14/2017 08:44 AM, Gary Wang wrote: > About the DEFAULT_STATEDIR, > ... > DEFS += -DDEFAULT_STATEDIR=\"$(localstatedir)/run/squid\" > ... > According to the above share memory namespace in snap world, it > couldn't help on this either. Here is how I [mis]interpret the

Re: [squid-dev] [PATCH] VIA creation code duplication

2017-03-13 Thread Alex Rousskov
On 03/13/2017 08:25 AM, Eduard Bagdasaryan wrote: > On 14.02.2017 04:22, Amos Jeffries wrote: >> The problem is with proxy where the admin has configured large headers >> to be allowed, and receives a Via just under the 6KB liit. Our append >> pushing it over by even one byte would assert. Yes,

Re: [squid-dev] my kids are dying :( Squid Cache: Version 4.0.18

2017-03-13 Thread Alex Rousskov
On 03/13/2017 09:38 AM, Heiler Bemerguy wrote: > > root@proxy:/var/log/squid# cat cache.log |grep assertion > 2017/03/13 07:50:54 kid6| assertion failed: client_side_reply.cc:1167: > "http->storeEntry()->objectLen() >= headers_sz" > 2017/03/13 08:17:46 kid4| assertion failed:

Re: [squid-dev] Fwd: [PATCH] for loops modernization

2017-03-13 Thread Alex Rousskov
are good and new code should use them! However, I doubt the advantages of changing those old loops outweigh cross-branch development costs right now. Others may disagree, and, if they do, I would not object to a polished patch being committed. Thank you, Alex. > 2017-03-12 16:31 GMT+01:00 Al

Re: [squid-dev] [PATCH] for loops modernization

2017-03-12 Thread Alex Rousskov
On 03/12/2017 07:45 AM, khaled belhout wrote: > this patch modernize for loops using c++11 Range-based for loop Please use "const auto" where possible and avoid using "i" for naming the current iteration object. I am curious why did you decide to change all these loops? How did you select the

Re: [squid-dev] [PATCH] Detail swapfile header inconsistencies

2017-03-09 Thread Alex Rousskov
On 03/09/2017 06:51 PM, Amos Jeffries wrote: > On 6/03/2017 6:02 a.m., Eduard Bagdasaryan wrote: >> This patch improves Squid to better distinguish error cases when loading >> cache entry metadata is failed. Knowing the exact failure reason may >> help triage and guide development. Refactoring

Re: [squid-dev] Rock store stopped accessing discs

2017-03-07 Thread Alex Rousskov
On 03/07/2017 01:08 PM, Heiler Bemerguy wrote: > Some log from right now... Here is my analysis: > 15:53:05.255| ipc/Queue.h findOldest: peeking from 7 to 6 at 1 Squid worker (kid6) is looking at the queue of disker (kid7) responses. There is just one response in the queue. > IpcIoFile.cc

Re: [squid-dev] Rock store stopped accessing discs

2017-03-07 Thread Alex Rousskov
On 03/07/2017 10:58 AM, Heiler Bemerguy wrote: > I used iostat to check if "right now" the hds were being accessed. A > lot of minutes passed and all writes/reads remained Zero. Understood. > With a 80mbit/s traffic going on, how could nothing be written nor read from > disc? I can come up

<    1   2   3   4   5   6   7   8   >