Re: [squid-users] Re: [patch] Re: [squid-users] X-Forwarded-For and cache_peer_access -- Fixed!

2013-08-24 Thread Amos Jeffries
On 24/08/2013 5:50 p.m., David Isaacs wrote: Amos, I've also come across what Michael identified. This is actually a bug, right? The checklist() constructor initialises checklist.src_addr correctly based on acl_uses_indirect_client but it is then overridden with the request's true client_addr

[squid-users] Re: [patch] Re: [squid-users] X-Forwarded-For and cache_peer_access -- Fixed!

2013-08-23 Thread David Isaacs
Amos, I've also come across what Michael identified. This is actually a bug, right? The checklist() constructor initialises checklist.src_addr correctly based on acl_uses_indirect_client but it is then overridden with the request's true client_addr by the calling function. I filed it as #3895

Re: [squid-users] [patch] Re: [squid-users] X-Forwarded-For and cache_peer_access -- Fixed!

2013-08-12 Thread Michael Graham
On Sat, 2013-08-10 at 14:27 +1200, Amos Jeffries wrote: Er. What Squid version are you using? The checklist() constructor pulls those details out of the request object itself in the current Squid versions. The patch I provided was from trunk in the bazaar repo, but I'm actually running

[squid-users] [patch] Re: [squid-users] X-Forwarded-For and cache_peer_access -- Fixed!

2013-08-09 Thread Michael Graham
Hi all, I've had a look at this issue and I believe I have found the problem. Just to recap I have: follow_x_forwarded_for allow localhost acl forwardTrafficSubnet1 src 172.21.120.0/24 cache_peer 172.21.120.24 parent 8881 0 proxy-only no-query cache_peer_access 172.21.120.24 deny

[squid-users] Re: [patch] Re: [squid-users] X-Forwarded-For and cache_peer_access -- Fixed!

2013-08-09 Thread babajaga
Back to original squid.conf: Instead of follow_x_forwarded_for allow localhost acl forwardTrafficSubnet1 src 172.21.120.0/24 cache_peer 172.21.120.24 parent 8881 0 proxy-only no-query cache_peer_access 172.21.120.24 deny forwardTrafficSubnet1 never_direct deny forwardTrafficSubnet1

Re: [squid-users] [patch] Re: [squid-users] X-Forwarded-For and cache_peer_access -- Fixed!

2013-08-09 Thread Amos Jeffries
On 10/08/2013 3:42 a.m., Michael Graham wrote: Hi all, I've had a look at this issue and I believe I have found the problem. Just to recap I have: follow_x_forwarded_for allow localhost acl forwardTrafficSubnet1 src 172.21.120.0/24 cache_peer 172.21.120.24 parent 8881 0 proxy-only no-query

Re: [squid-users] X-Forwarded-For and cache_peer_access

2013-07-17 Thread Michael Graham
On Tue, 2013-07-16 at 09:31 -0400, Michael Graham wrote: On Tue, 2013-07-16 at 23:30 +1200, Amos Jeffries wrote: Does the X-Forwarded-For header actually contain an IP from the 172.21.120.0/24 subnet (and not some IPv6 address from that subnets IPv6 ranges). Yeah it seems to be: GET

Re: [squid-users] X-Forwarded-For and cache_peer_access

2013-07-16 Thread Amos Jeffries
On 16/07/2013 7:31 a.m., Michael Graham wrote: Hi all, I'm having a problem getting squid to select the upstream proxy based on the source address set in the X-Forwarded-For header. Here is the appropriate lines from my squid.conf: follow_x_forwarded_for allow all You should never have

Re: [squid-users] X-Forwarded-For and cache_peer_access

2013-07-16 Thread Michael Graham
On Tue, 2013-07-16 at 23:30 +1200, Amos Jeffries wrote: Does the X-Forwarded-For header actually contain an IP from the 172.21.120.0/24 subnet (and not some IPv6 address from that subnets IPv6 ranges). Yeah it seems to be: GET http://www.google.com/ HTTP/1.1 Accept: */* Host: www.google.com

[squid-users] X-Forwarded-For and cache_peer_access

2013-07-15 Thread Michael Graham
Hi all, I'm having a problem getting squid to select the upstream proxy based on the source address set in the X-Forwarded-For header. Here is the appropriate lines from my squid.conf: follow_x_forwarded_for allow all acl forwardTrafficSubnet1 src 172.21.120.0/24 cache_peer 172.21.120.24 parent