Re: squid, outgoing port depending on matched acl

Marek,

I have added support for TOS marking of outbound packets that retrieve
data from
upstream servers, but as Henrik mentions, these actual data packets will
likely come
back unmarked.

It is the work of moments to get the... here: try this to do the
outgoing address selection:

--- acl.c.orig Sun Apr 1 19:35:48 2001
+++ acl.c Sun Apr 1 19:34:06 2001
@@ -998,7 +998,8 @@
           /* maybe it is a permissible trailing integer - in which case
there
           is nothing left on the line */
        if (!strtok(NULL, w_space) && /* OK to discard, trust me */
- (sscanf(t, "0x%x", &trailer) || sscanf(t, "%d", &trailer))) {
+ (sscanf(t, "0x%x", &trailer) || sscanf(t, "%d", &trailer) ||
+ safe_inet_addr(t, (struct in_addr *)&trailer))) {
            /* we really do have a int on the end of the line, in 0x1234
         or plain 1234 format */
            A->trailer = trailer;

--- forward.c.orig Sun Apr 1 19:23:51 2001
+++ forward.c Sun Apr 1 19:30:08 2001
@@ -278,7 +278,7 @@
    unsigned short port;
    time_t ctimeout;
    aclCheck_t ch;
- unsigned short tos;
+ struct in_addr outgoing;
    assert(fs);
    assert(fwdState->server_fd == -1);
    debug(17, 3) ("fwdConnectStart: %s\n", url);
@@ -316,14 +316,16 @@
    debug(17,1) ("fwdConnectStart: my addr %s\n", inet_ntoa(ch.my_addr));
    ch.my_port = fwdState->request->my_port; /* data like this? */
    ch.request = fwdState->request;
- tos = (unsigned short)aclCheckFast(Config.accessList.tosacl, &ch);
- debug(17,1) ("fwdConnectStart: got tos %d\n", tos);
- fd = comm_openex(SOCK_STREAM,
+ outgoing.s_addr = (unsigned
short)aclCheckFast(Config.accessList.tosacl, &ch);
+ if(!outgoing.s_addr)
+ outgoing = Config.Addrs.tcp_outgoing;
+
+ debug(17,3) ("fwdConnectStart: got addr %s\n", outgoing);
+ fd = comm_open(SOCK_STREAM,
    0,
- Config.Addrs.tcp_outgoing,
+ outgoing,
    0,
    COMM_NONBLOCKING,
- tos,
    url);
    if (fd < 0) {
    debug(50, 4) ("fwdConnectStart: %s\n", xstrerror());

This will apply to the previous patches, and mean that you should
(untested) be able
to write acess lists like this:
acl normal_net src 10.0.0.0/255.255.255.0
acl better_net src 10.1.1.0/255.255.255.0
acl_map2_tos allow normal_net 1.2.3.4
acl_map2_tos allow better_net 1.2.3.5

Access from clients that match normal_net, will end up with the data
being sunk to IP
address of 1.2.3.4 of the server. I'll fix up the thing to make it an
acl_map2_outgoing config
option. If no acl matches, normal tcp.outgoing address will be used, but
I haven't the time right
now, gotta do dishes & pack (heading to Seoul at 6am tomorrow)

In summary, things to do:
   o test that outgoing address setting works including interplay with
measurement stats etc.
   o make tos setting & outgoing address setting work together
   o document outside of squid.conf
   

Roger.

Henrik Nordstrom wrote:

> The squid-dev mailinglist is the proper location for questions like
> this. You are most welcome to try to address issues like this.
>
> To become a Squid developer please get subscribed to squid-dev (see
> <http://www.squid-cache.org/mailing-lists.html>) and create yourself a
> SourceForge account.
>
> I think the TOS support Roger Venning is working on might be something
> for you, but there might be problems with TOS not being reflected in
> return traffic.. The reason to why it is not currently on SourceForge is
> a small mishap in where it got committed and will get corrected in a few
> days. Until then the patch is in the commit and squid-dev archives.
>
> The ability to select which source ip to use is quite commonly
> requested, and an implementation of this would be very nice.
>
> /Henrik
>
>
> Marek Veber wrote:
>
>> Hi Hendric,
>> I contact you as the first person on Squid's CONTRIBUTORS list,
>> please sorry me if you are not the correct one and please help me to
>> find the correct person to solve my problem.
>>
>> Thanks for your time, asistence and reply.
>> -----------------------------------------------
>>
>> We need to separate the linux's network device band (using QoS) to
>> some part's for given customers, which use
>> 1) common Squid-proxy
>> 2) other diferent separated packet comunication
>>
>> We find that there is a need to separate on IP packets level, which
>> outgoing/incoming data to/from ISP from the Squid-proxy are used by
>> the given customer and sum it together with the rest
>> of the customer's packet traffic.
>>
>> Our idea is: equip Squid with abilty to
>> assign outgoing port/ip_addr for the request(from the given customer) depending
>> on matched acl.
>>
>> As I thing, I'm a person, which is able to do it, but only with coordination
>> with other Squid's developers.
>> Please let me know, about the common idea and latest work to do such a thing
>> in "Squid team".
>>
>> At the www page:
>> http://www.geocrawler.com/lists/3/SourceForge/1783/0/
>> in Roger Venning's comments to his commit from 03/30/2001 08:33:06
>> I have find the some idea to do the same thing, bud CVS
>> CVSROOT=':pserver:anoncvs@cvs.squid-cache.org:/squid' hasn't this update
>> build in.
>> --
>> -----------------------------------------------
>> | Marek Veber email: mara@solnet.cz |
>> | Tvorihraz 67 http://www.solnet.cz |
>> | 671 34, (CZ) private:+42 / 0602/767386 |
>> | mobil:+42 / 0603/378281 |
>> | school:+42 / 05/41512377 |
>> | ICQ UIN: 85222257 |
>> -----------------------------------------------
>

-- 
-------------------------------------------------------------
Roger Venning	\ Do not go gentle into that good night
Melbourne        \ Rage, rage against the dying of the light.
Australia <r.venning@bipond.com>                 Dylan Thomas