Squid - part II

In the previous part we went through acl classes, now let's continue with acl operators.

13.7.2004 08:00 | Petr Houštěk | přečteno 28616×

Acl operators

You have already seen the http_access operator, but there are many others. The syntax is

http_access allow|deny [!]aclname1 [[!]aclname2 ... ]

(The syntax is the same for all operators, not only for http_access). In one of the examples, we blocked all IPs except myNet. Now the same result can be achieved with more acl classes in one operator.

acl myNet src
acl all src

http_access deny all !myNet
# http_access deny all

If the IP is in myNet, the result is 1 AND (NOT 1) = 1 AND 0 = 0, thus access will be granted. If the request is coming from the outside world (the IP is not defined in myNet), the result will be 1 AND (NOT 0) = 1 AND 1 = 1, so access will be denied.

The other acl operators are icp_access, no_cache, ident_lookup_access, miss_access, always_direct (never_direct), snmp_access, delay_access, broken_posts.


This operator is used not to store the selected pages in the cache. In the default configuration there are lines that match the results of cgi programs and eject them from the cache (by default it is commented, so you have to uncomment them).

acl QUERY urlpath_regex cgi-bin \\?
no_cache deny QUERY


Some servers do not comply with the HTTP specification. To communicate with these servers (which should be identified by the url_regex acl type) you should use the broken_posts operator.

acl broken_server url_regex http://broken-server-list.com
broken_posts allow broken_server

Delay classes

Delay classes are used to control the bandwidth. It is done by so-called delay pools. Downloads are classified into segments and binded to certain amounts of bandwidth. There are three types of delay classes.

ACL examples and FAQ

At the end there are some examples and common problems.

Logic mistakes

The access controls cannot be combined with the AND or OR operators. These operations are already built-in to the access control scheme. There are some rules for better understanding.

For example the acl configuration like this cannot work properly

acl ME src
acl YOU src
http_access allow ME YOU

In this example the http_access operator will grant the access only if both ME acl and YOU acl match the request and that is not the behaviour we want. The working example can be written like this

acl ME src
acl YOU src
http_access allow ME
http_access allow YOU

Or in the easier way.

acl US
http_access allow US

The acl debugging

If you really can't determine where the problem is, you should turn the debugging on. It is done by the command debug_options. To start the acl debugging add this line to your squid.conf.

debug_options ALL,1 33,2

This enables debugging for section 33 at level 2. Your cache.log now should contain a line for every request, where there is if it was allowed or denied, etc.

Customisation of the error messages

In some situations you need to customise some error messages. You can also create some new error messages.

The error messages are kept in the directory /usr/local/squid/etc/errors by default, but e. g. in Debian they are in /usr/lib/squid/errors/language. The location of this directory is set by the error_directory option. For example you want your users to know why the access to the pages with pornographic content are blocked. In the error directory create a file named ERR_PORN, which contains something like this:

The URL %U cannot be retrieved, because of it's pornographic content.
If you feel you have received this message in error, please contact our 
support centre.

Then put to squid.conf this entry.

acl porn url_regex "/usr/local/squid/etc/porn.txt"
deny_info ERR_PORN porn
http_access deny porn

Now when a user is trying to retrieve an URL matching regular expression in /usr/local/squid/etc/porn.txt, this error message is shown. The tag %U is replaced with the given URL. More information about these tags is available here.

Online verze článku: http://www.linuxsoft.cz/article.php?id_article=232