Re: cache deny all

Achim Weber <[email protected]> Thu, 07 Mar 2013 10:01:52 +0100
Newsgroups gmane.comp.security.ipcop.devel
Message-ID <[email protected]>
Hi Eric

> Following Todd Wiegel's report on the ipcop-user mailing list that he was
> unable to turn off caching, I had a look at the code in the
> makesquidconf.plscript and there is a line that should print "cache
> deny all" if this test
> fails:
> if (($proxysettings{'CACHE_SIZE'} > 0) || ($proxysettings{'CACHE_MEM'} > 0))
> 
> ie, both CACHE_SIZE and CACHE_MEM have to be 0 to turn off caching

This was introduced in svn rev. #5831 [1] from Olaf.


> But there is error checking in proxy.cgi that prevents CACHE_MEM being less
> than 1
> 
> So, at the moment, I think "cache deny all" is broken.

Think so too.


> What's the best way to repair? Allow a zero for CACHE_MEM? What might that
> break?

I think if it can be set to zero, there should be a check if it is >0 before
writing "cache_mem $proxysettings{'CACHE_MEM'} MB" to squid.conf.


> The Admin Manual refers to turning off harddisk caching with a 0 in
> CACHE_SIZE, but it doesn't mention CACHE_MEM, so perhaps the fix lies in
> the makesquidconf.pl script?
> 
> Eric

I think the correct way to fix this would be to change the check in proxy.cgi so
CACHE_MEM can be set to 0 too. If this is changed, the docu too should mention
the CACHE_MEM in the "disable cache" section.

What do the others think, Olaf, Marco?


Achim

[1]
http://ipcop.svn.sourceforge.net/viewvc/ipcop/ipcop/trunk/html/cgi-bin/proxy.cgi?r1=5814&r2=5831

------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester  
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the  
endpoint security space. For insight on selecting the right partner to 
tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev