Squid acls

[merkava]

Hi guys,

There is a line in squid default configuration:

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

acls are applied from top down, so CONNECT acl will deny access to all non SSL and SSL ports. I mean it never reaches the second access rule.

[marriedto51]

It is my understanding that the ACLs at the end of "http_access deny ..." are conjoined with a logical AND, so I would read your example as "deny any match to both CONNECT and !SSL_ports". (This rule would have nothing to say about a match to SSL_ports whether or not it matches CONNECT.)

[merkava]

Thank you very much.