4 Replies Latest reply on Jul 10, 2012 3:38 AM by fschulte

    Safe Search Enforcer with MWG as ICAP Server

      Hi all.

       

      I'm using MWG 7.2 as ICAP Server and SQUID as ICAP Client.

       

      I enabled rule Safe Search Enforcer, but I can change Safe Search filter to "no filter" (Google Search) in my lab.

       

      Explicit Mode Proxy it works.

       

      Anybody can help me?

       

      Thanks!

        • 1. Re: Safe Search Enforcer with MWG as ICAP Server
          Jon Scholten

          Hi Lucas,

           

          I would get connection traces from a working scenario (direct proxy), and from a non-working scenario (as ICAP server). Then submit this to support, connection traces can be gathered under Configuration > Troubleshooting, then you will need to specify the client IP, and check both of the boxes for connection tracing.

           

          Turn connection tracing off immediatley after you reproduced the issue. They can be collected from the CLI or under Troubleshooting > Connection tracing.

           

          Connection tracing will allow us to see what is different. SafeSearch enforcer should work if MWG is an ICAP server.

           

          Hope this helps,

          Jon

          • 2. Re: Safe Search Enforcer with MWG as ICAP Server

            Keep in mind that SafeSearch is used in the REQMOD cycle only.

            It modifies the request before it goes out to google.

             

            If you are using Squid in RESPMOD, it will have no effect.

            • 3. Re: Safe Search Enforcer with MWG as ICAP Server

              Hi all

               

              I opened a case to support. I sent TCP Dump and connection traces to support.

               

              We are using MWG as ICAP Server with REQMOD and RESPMOD.

               

              I will post results here.

               

              Thanks!

               

              Lucas

              • 4. Re: Safe Search Enforcer with MWG as ICAP Server
                fschulte

                MWGs ICAP server component did not detect that the SSE changed the URL and sent back the original one. So SafeSearch was effectively not enforced. This has been fixed in 7.3 and 7.2.0.2.

                The Bugzilla discussion tells the following workaround: "As a workaround the customer can add an arbitrary header in the request cycle."

                Workaround.png

                 

                Message was edited by: fschulte on 7/10/12 3:38:08 AM CDT