Acl operators

You have already seen the http_access operator, but there are many others. The syntax is

http_access allow|deny [!]aclname1 [[!]aclname2 ... ]

(The syntax is the same for all operators, not only for http_access). In one of the examples, we blocked all IPs except myNet. Now the same result can be achieved with more acl classes in one operator.

acl myNet src 192.168.0.0/255.255.0.0
acl all src 0.0.0.0/0.0.0.0

http_access deny all !myNet
# http_access deny all

If the IP is in myNet, the result is 1 AND (NOT 1) = 1 AND 0 = 0, thus access will be granted. If the request is coming from the outside world (the IP is not defined in myNet), the result will be 1 AND (NOT 0) = 1 AND 1 = 1, so access will be denied.

The other acl operators are icp_access, no_cache, ident_lookup_access, miss_access, always_direct (never_direct), snmp_access, delay_access, broken_posts.

No_cache

This operator is used not to store the selected pages in the cache. In the default configuration there are lines that match the results of cgi programs and eject them from the cache (by default it is commented, so you have to uncomment them).

acl QUERY urlpath_regex cgi-bin \\?
no_cache deny QUERY

Broken_posts

Some servers do not comply with the HTTP specification. To communicate with these servers (which should be identified by the url_regex acl type) you should use the broken_posts operator.

acl broken_server url_regex http://broken-server-list.com
broken_posts allow broken_server

Delay classes

Delay classes are used to control the bandwidth. It is done by so-called delay pools. Downloads are classified into segments and binded to certain amounts of bandwidth. There are three types of delay classes.

• The first pool class

  Let's show an example first.

  acl throttled_site url_regex -i microsoft.com
  delay_pools 1
  delay_class 1 1
  delay_parameters 1 16384/16384
  delay_access 1 allow throttled_site
  

  First we decide which requests we want to throttle. This can be done according to the source IP, destination domain, whatever. Then delay_pools operator tells Squid how many delay pools there will be, in our case there is one delay pool. Then we create the delay pool number one of the first class (line 3 in the example). The first pool class is the simplest, so the download rates of all connections are put together and the only thing you have to fill is the speed (in bytes per second) and the amount of data after reaching the connection should be throttled (in bytes) - this amount is downloaded in full speed.

• The second pool class

  If you want to limit only a small number of users, the first pool class is convenient, but for a greater number of users it would be very painful to create a special pool for every new user. By using a different pool type, you can set limits for all IP addresses easily. For example you have a 1024kbit line, 20 users and you want them not to flood it. You also want to spare some bandwidth for SMTP and other services like it. So we will limit web access to 1000kbit for all users and every user to 200kbit.

  acl all src 0.0.0.0/0.0.0.0
  delay_pools 1
  delay_class 1 2
  delay_parameters 1 128000/128000 25600/25600
  delay_access 1 allow all
  

• The third pool class

  The third pool class can be used to limit entire class-C network ranges. For example you have 2048kbit line, you want 48kbit for SMTP, etc. You have 3 IP ranges with 100 computers in each range. So you will grant 667kbit for each range and 20kbit for each computer (we assume that all computers won't download at the same time).

  acl all src 0.0.0.0/0.0.0.0
  delay_pools 1
  delay_class 1 3
  delay_parameters 1 256000/256000 85333/85333 2560/2560
  delay_access 1 allow all
  

  You can set -1 as a speed, which means that no limit is set. For example if you are alone in a computer lab and per-user limit is set to -1, you are only limited by per-network speed.

  By using delay pools and proper acls you can limit people during working hours and let them enjoy full speed at night, for example to stop people browsing the Web and to encourage them using some sites (company sites, ...) etc.

ACL examples and FAQ

At the end there are some examples and common problems.

Logic mistakes

The access controls cannot be combined with the AND or OR operators. These operations are already built-in to the access control scheme. There are some rules for better understanding.

• All elements of an acl class entry are connected together with the OR operator

• All elements of an acl operator entry are connected together with the AND operator

For example the acl configuration like this cannot work properly

acl ME src 192.168.1.1
acl YOU src 192.168.1.2
http_access allow ME YOU

In this example the http_access operator will grant the access only if both ME acl and YOU acl match the request and that is not the behaviour we want. The working example can be written like this

acl ME src 192.168.1.1
acl YOU src 192.168.1.2
http_access allow ME
http_access allow YOU

Or in the easier way.

acl US 192.168.1.1 192.168.1.2
http_access allow US

The acl debugging

If you really can't determine where the problem is, you should turn the debugging on. It is done by the command debug_options. To start the acl debugging add this line to your squid.conf.

debug_options ALL,1 33,2

This enables debugging for section 33 at level 2. Your cache.log now should contain a line for every request, where there is if it was allowed or denied, etc.

Customisation of the error messages

In some situations you need to customise some error messages. You can also create some new error messages.

The error messages are kept in the directory /usr/local/squid/etc/errors by default, but e. g. in Debian they are in /usr/lib/squid/errors/language. The location of this directory is set by the error_directory option. For example you want your users to know why the access to the pages with pornographic content are blocked. In the error directory create a file named ERR_PORN, which contains something like this:

<p>
The URL %U cannot be retrieved, because of it's pornographic content.
If you feel you have received this message in error, please contact our 
support centre.
</p>

Then put to squid.conf this entry.

acl porn url_regex "/usr/local/squid/etc/porn.txt"
deny_info ERR_PORN porn
http_access deny porn

Now when a user is trying to retrieve an URL matching regular expression in /usr/local/squid/etc/porn.txt, this error message is shown. The tag %U is replaced with the given URL. More information about these tags is available here.