0

There is a line in squid default configuration:

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

acls are applied from top down, so CONNECT acl will deny access to all non SSL and SSL ports. I mean it never reaches the second access rule.

1 Answer 1

3

CONNECT here means the HTTPS CONNECT method, i.e., the standardized way a browser talks to a proxy server, asking for a connection to an HTTPS-serving site

http_access deny CONNECT !SSL_ports means 'deny all HTTPS CONNECT that asks to be connected to a port other than SSL_ports'. If the browser sends a CONNECT method asking to be connected to an SSL_port, the rule doesn't fire.

Whether or not the CONNECT actually gets through depends on the successive http_access rules.

2
  • So the acls after http_access deny are conjoined with a logical AND. am I right? Apr 25, 2011 at 5:40
  • @Majid yes. In general, everything on the same line are conjoined with logical AND, while rules on different lines are conjoined with logical OR
    – pepoluan
    Apr 25, 2011 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .