squid.conf and Squid 2.6 vs. Squid 2.7

[Michael Lenaghan]

I ran into a problem switching from Squid 2.6 to Squid 2.7. The details are available at http://n2.nabble.com/Problem-using-Squid-2-7-with-plone-recipe-squid-1-0b1-tp3731526p3731526.html;cid=1253202576022-69. To summarize, with the same config options Squid's port number started appearing in URLs embedded within Zope pages when I moved to 2.7. (That was in a Nginx -> Squid -> Zope chain where Squid wasn't running on port 80.)

By trying various configs I found a fix: adding "vport=80" to the http_port line in squid.conf made the problem go away. Since I wasn't sure exactly why that worked I posted a query on squid-users. There's a response at http://<email address hidden>/msg67432.html. Also interesting is a parallel thread: http://<email address hidden>/msg67431.html. I'll try to summarize them here.

First, these comments were made by Henrik Nordstrom in response to a bug report. (This is the change that broken things from the recipe's perspective.)

===

It's fine to combine vhost defaultsite vport in the same port specification,
and acheives what you are looking for.

1. If there is a Host header, use it's site name and port (if any).

2. If there was no port in the Host header use the vport assigned port number.

3. If there was no Host header then use defaultsite for both the hostname and
port.

Or alternatively just vhost vport, in which case it n 3 falls back on the
incoming ip:port if there is no Host header.

defaultsite, vport, vhost is all options defining how Squid is to rebuild the
requested URL when given a URL-Path.. Or put in a different angle it should not
react differently when given an absolute-URI compared to a URL-Path + Host
header.

Which means

If using Host header and it has a port, that's the port.

If not then the http_port, possibly overridden by vport=NN.

This patch also changes the default site to be visible_hostname, overridden by
defaultsite or ip based vport (without =NN), as this is what most people
expect.

===

Second, this was Amos' summary of how it works (from the parallel thread).

===

"accel vhost defaultsite=192.168.24.198 vport=8080" means ...

... 'accelerate' the URL.
... (vhost) use client-given Host: header when available.
... (vport=) use the client-given Host: HTTP port (default 8088 if none
found).
... (defaultsite=) use 192.168.24.198 if neither of the above give a usable
domain/IP.

So Squid check the URL. Finds /rdims/index.jsp.
... checks the Host: header. Finds 192.168.0.164:88, making
URL=http://192.168.0.164:88/rdims/index.jsp
... checks the Host: header port. Finds 88, making
URL=http://192.168.0.164:88/rdims/index.jsp
... has a domain '192.168.0.164', so skips defaultsite

===

Interestingly, having taken a very quick look at the code I think his description is slightly wrong. I believe that if vport is passed a specific port number it *always* becomes the port:

    if (vport > 0)
        port = vport;
    else
        port = htons(http->conn->me.sin_port);

But, hey, I only read a snippet, so don't just take my word for it. :-) I think, though, that that's why it fixes the problem in 2.7.

(The 2.6 code has a similar intent:

- if (vport)
- snprintf(http->uri, url_sz, "%s://%s:%d%s",
- conn->port->protocol, t, port, url);

but I don't know whether or not it has a similar effect.)

Two other notes.

First, in template-vhm.conf there's no "accel" on the http_port line. I think it should be there. First, it's in the sample VHM config at http://wiki.squid-cache.org/ConfigExamples/Reverse/VirtualHosting. Second, "s->accel" is tested throughout the code. It's possible that "accel" is turned on when the other options appear--but it isn't a sure thing, and it certainly doesn't seem to be wrong to leave it in. (The docs aren't clear. Does "Implies accel" mean that setting the one sets the other--or that the one config isn't used unless the other is set? Better safe than sorry, I think.)

Second, Amos made this comment:

>> # Cache Peer Access
>> acl all src 0.0.0.0/0.0.0.0
>
> Please make that "acl all src all". And note that it needs to be removed
> entirely for squid 3.x to work.

[Michael Lenaghan (michaell)]

> Interestingly, having taken a very quick look at the code I think his description
> is slightly wrong. I believe that if vport is passed a specific port number it
> *always* becomes the port:

I followed up on that. Amos confirmed it:

"Aye. While looking up your problem after wangwen's I found the details."

> First, in template-vhm.conf there's no "accel" on the http_port line.

I followed up on that. Amos confirmed it too:

"That was a bit fuzzy across a few releases as well. I've now settled on saying its needed. It's the mode specifier, the others are just options to tweak how the mode works."

[Michael Lenaghan (michaell)]

Henrik Nordstrom, the primary maintainer of Squid, added this description:

===

vport is a little overloaded and serves two purposes. Controls both the
port number of the reconstructed URL and may be used to enable IP based
host reconstruction as fallback when there is no Host header (or when
vhost is not enabled).

You need at least one of vhost, vport or defaultsite enabled.

Basically

1. If vhost is enabled then use the Host header.

2. If vhost is not enabled or if there is no host header then use
defaultsite if set.

3. If none of the above and vport is set without argument then use the
local IP address as hostname.

4. If the above do not contain a port number then vport=NN is used as
port number, or if vport is not set to a static port number then the
local http_port number.

> (The 2.7 change notes say that for http_port "Accelerator mode options
> cleaned up (accel, defaultsite, vport, vhost and combinations
> thereof)". Is the difference in behaviour here related to that
> clean-up?)

Yes. Was even more odd before..

===

I believe it's the last part of no. 4 that I was seeing in action: "or if vport is not set to a static port number then the
local http_port number".