\nOr
\nWhen is the software stable enough?<\/h1>\n
![\"\"](\"http:\/\/www1.ngtech.co.il\/wpe\/wp-content\/uploads\/2017\/01\/dessert_sushi_by_outlawxvega-300x225.jpg\")
<\/h1>\nI am not developing software daily\u00a0but it seems that the inner debate on the stability of our different “kids” and fruits of work is always there. Every time when I consider something as stable enough for production some other voice adds a doubt on the stability of a software.<\/p>\n
Specifically, in the squid-cache and the open-source world the question is always on the board or the desktop. The source is open to everyone to find the next bug. Some are happy with what they have already while some expect the equivalent of a Ferrari.<\/p>\n
When I am writing a software, I am doing my best effort to write it with the main goal that human lives can be entrusted to this software. One of the reasons why I am trying to meet such a goal is that in real life I try to do the same. When someone asks me a question or turns to me with a request or a\u00a0word, I know that he asks for a reason. There is no chance in the world that the occasion is a result of only “A series of of unfortunate events”. I was asked in my past couple times “Why do you bother to answer?” and the answer is the simplest: the sanity of the other party is in my hands.<\/p>\n
Sometimes a REDIRECT is the right answer but never DROP or REJECT. These are the actions of “war” and when we are talking about HTTP in general there is a war out there. \u00a0I had the choice in the past to work in couple layers of the Internet from the hardware to the application and I choose to invest lots of time on layer 4 and above.<\/p>\n
There are many tools in this warzone and\u00a0every time that a new tool is in use it get’s it’s own life cycle. The issue is that it takes time for every tool to become mature enough to serve different purposes.<\/p>\n
Squid 3.5 is already in use by many users and admins for a while and is considered Stable for a very long time, but now aging start showing up. \u00a0There are different levels of maturity but the basic one is a period of 30 days uptime. We do expect more but a restart once every 30 days without any crash would be considered stable.<\/p>\n
For now I am\u00a0in the hunt for fatal bugs on the 3.5 series. The reason for this is to measure the maturity of the the branch!<\/p>\n
Lately I have been working on couple tools and one of them is a library for distributed rate blacklists querying and blocking. Using this library\u00a0I wrote\u00a0an external acl helper for squid that\u00a0can help many\u00a0admins to use OpenDNS and Symantech or other internal DNS Blacklists.<\/p>\n
The library sources can be found at: And in binaries package at: squid.conf example of usage:<\/p>\n external_acl_type dnsbl_check ipv4 concurrency=200 ttl=15 %DST %SRC %METHOD \/opt\/bin\/squid-external-acl-helper -peers-filename=\/opt\/bin\/peersfile.txt http_access deny dnsbl_check_acl<\/p><\/blockquote>\n Example of peersfile.txt: The syntax of the above file is: The http and https destinatiosn are queried with a HEAD request to the host and path and\u00a0a match will be reflected in the response headers with “X-Vote”\u00a0value to be “BLOCK”. dns 208.67.220.123 \/ 53 128 146.112.61.104 146.112.61.105 146.112.61.106<\/p><\/blockquote>\n would be the addresses: and the weight of a match is 128 and specifically the default match weight of the helper is 128 and this line would be a match and no more lookups will be done. In the case which one list is not a match each of the listed would be tested until either found or the timeout(default 30 seconds) is reached. If the timeout or the list of peers was not found as fully matching the weight, the request will be allowed.<\/p>\n With this tool you can use regular DNS services on your system and on the proxy intercept the traffic and\u00a0get a decision using a “consultation” with an external system not compromising your clients with special block pages that the dns redirect towards.<\/p>\n So we have both a proxy and a simple tool which can help us to prevent access to specific sites. The stability of\u00a0Squid for this release is considered “Very Stable” but yet to be tested on a larger scale then 400 users. If you are managing a system which runs squid for filtering or caching that have more than 400 users please send us some input from the squid manager info page so we would be able to rate the state of the software.<\/p>\n I am planning to write a tiny tool\\script that will help to scrap the squid manager info page and send the Squid-Cache systems some\u00a0feedback. If you are a squid system administrator which are willing to\u00a0share some statistics on your system with the project, please contact me at: eliezer@ngtech.co.il<\/a><\/p>\n I believe that\u00a0if we could gather enough statistics we would be able to declare\u00a0that the software passed the “masses” test compared to couple single systems.<\/p>\n All The Bests, On the plate:<\/p>\n References:<\/p>\n When is the kid considered stable? Or When is the software stable enough? I am not developing software daily\u00a0but it seems that the inner debate on the stability of our different “kids” and fruits of work is always there. Every time when I consider something as stable enough for production some other voice adds a … Continue reading When is the kid considered stable? – Squid 3.5.23+4.0.17<\/span>
\nhttps:\/\/github.com\/elico\/drbl-peer<\/a><\/p>\n
\nhttp:\/\/moodle.ngtech.co.il\/drbl-extacl\/<\/a><\/p>\n
\nacl dnsbl_check_acl external dnsbl_check
\ndeny_info http:\/\/ngtech.co.il\/block_page\/?url=%u&domain=%H dnsbl_check_acl<\/p>\n
\nhttp:\/\/moodle.ngtech.co.il\/drbl-extacl\/peersfile.txt<\/a><\/p>\n
\ntype<space>address<space>path(for http services)<space>port<space>rate for the host(uint)<space>address which will indicate a blacklisted domain with spaces between them.
\nThe type options are:<\/p>\n\n
\nThe dns and dnsrbl will be a match for one of the addresses\u00a0which are defined from the six value on the definition and on ie matches in\u00a0the line:<\/p>\n
\n146.112.61.104 or 146.112.61.105 or 146.112.61.106<\/p>\n
\n
\nEliezer Croitoru<\/p>\n\n
\n<\/a>– Package of Binaries\u00a0Sources and scripts<\/a>
\n–\u00a0Sources and startup scripts\u00a0on github
\n<\/a>–\u00a0I have hope to publish the tool in RPM and DEB format<\/li>\n\n