In the previous part we went through acl classes, now let's continue with acl
13.7.2004 08:00 | Petr Houštěk | přečteno 28616×
You have already seen the
http_access operator, but there are many
others. The syntax is
http_access allow|deny [!]aclname1 [[!]aclname2 ... ]
(The syntax is the same for all operators, not only for
http_access). In one of the examples, we blocked all IPs except
myNet. Now the same result can be achieved with more acl classes in one
acl myNet src 192.168.0.0/255.255.0.0 acl all src 0.0.0.0/0.0.0.0 http_access deny all !myNet # http_access deny all
If the IP is in myNet, the result is
1 AND (NOT 1) = 1 AND 0 =
0, thus access will be granted. If the request is coming from the
outside world (the IP is not defined in myNet), the result will be
(NOT 0) = 1 AND 1 = 1, so access will be denied.
The other acl operators are
This operator is used not to store the selected pages in the cache. In the default configuration there are lines that match the results of cgi programs and eject them from the cache (by default it is commented, so you have to uncomment them).
acl QUERY urlpath_regex cgi-bin \\? no_cache deny QUERY
Some servers do not comply with the HTTP specification. To communicate with
these servers (which should be identified by the
type) you should use the
acl broken_server url_regex http://broken-server-list.com broken_posts allow broken_server
Delay classes are used to control the bandwidth. It is done by so-called delay pools. Downloads are classified into segments and binded to certain amounts of bandwidth. There are three types of delay classes.
The first pool class
Let's show an example first.
acl throttled_site url_regex -i microsoft.com delay_pools 1 delay_class 1 1 delay_parameters 1 16384/16384 delay_access 1 allow throttled_site
First we decide which requests we want to throttle. This can be done
according to the source IP, destination domain, whatever. Then
delay_pools operator tells Squid how many delay pools there will
be, in our case there is one delay pool. Then we create the delay pool number
one of the first class (line 3 in the example). The first pool class is the
simplest, so the download rates of all connections are put together and the
only thing you have to fill is the speed (in bytes per second) and the amount
of data after reaching the connection should be throttled (in bytes) - this
amount is downloaded in full speed.
The second pool class
If you want to limit only a small number of users, the first pool class is convenient, but for a greater number of users it would be very painful to create a special pool for every new user. By using a different pool type, you can set limits for all IP addresses easily. For example you have a 1024kbit line, 20 users and you want them not to flood it. You also want to spare some bandwidth for SMTP and other services like it. So we will limit web access to 1000kbit for all users and every user to 200kbit.
acl all src 0.0.0.0/0.0.0.0 delay_pools 1 delay_class 1 2 delay_parameters 1 128000/128000 25600/25600 delay_access 1 allow all
The third pool class
The third pool class can be used to limit entire class-C network ranges. For example you have 2048kbit line, you want 48kbit for SMTP, etc. You have 3 IP ranges with 100 computers in each range. So you will grant 667kbit for each range and 20kbit for each computer (we assume that all computers won't download at the same time).
acl all src 0.0.0.0/0.0.0.0 delay_pools 1 delay_class 1 3 delay_parameters 1 256000/256000 85333/85333 2560/2560 delay_access 1 allow all
You can set -1 as a speed, which means that no limit is set. For example if you are alone in a computer lab and per-user limit is set to -1, you are only limited by per-network speed.
By using delay pools and proper acls you can limit people during working hours and let them enjoy full speed at night, for example to stop people browsing the Web and to encourage them using some sites (company sites, ...) etc.
At the end there are some examples and common problems.
The access controls cannot be combined with the
OR operators. These operations are already built-in to the
access control scheme. There are some rules for better understanding.
All elements of an acl class entry are connected together with the
All elements of an acl operator entry are connected together with the
For example the acl configuration like this cannot work properly
acl ME src 192.168.1.1 acl YOU src 192.168.1.2 http_access allow ME YOU
In this example the http_access operator will grant the access only if both ME acl and YOU acl match the request and that is not the behaviour we want. The working example can be written like this
acl ME src 192.168.1.1 acl YOU src 192.168.1.2 http_access allow ME http_access allow YOU
Or in the easier way.
acl US 192.168.1.1 192.168.1.2 http_access allow US
If you really can't determine where the problem is, you should turn the debugging on. It is done by the command debug_options. To start the acl debugging add this line to your squid.conf.
debug_options ALL,1 33,2
This enables debugging for section 33 at level 2. Your cache.log now should contain a line for every request, where there is if it was allowed or denied, etc.
In some situations you need to customise some error messages. You can also create some new error messages.
The error messages are kept in the directory /usr/local/squid/etc/errors by
default, but e. g. in Debian they are in /usr/lib/squid/errors/language. The
location of this directory is set by the
For example you want your users to know why the access to the pages with
pornographic content are blocked. In the error directory create a file named
ERR_PORN, which contains something like this:
<p> The URL %U cannot be retrieved, because of it's pornographic content. If you feel you have received this message in error, please contact our support centre. </p>
Then put to squid.conf this entry.
acl porn url_regex "/usr/local/squid/etc/porn.txt" deny_info ERR_PORN porn http_access deny porn
Now when a user is trying to retrieve an URL matching regular expression in
/usr/local/squid/etc/porn.txt, this error message is shown. The tag
%U is replaced with the given URL. More information about these
tags is available