Re: [squid-users] debugging ACLs

paul cooper wrote:
> so ive tried to simplify this to see if i can work out whats going on
>
> squid 2.6.17 on gentoo linux
>
>
> /etc/squid/ip_user.conf
> 127.0.0.1 ALL
>
> /etc/squid/squid.conf
> hepworth andrew # grep ^[a-z] /etc/squid/squid.conf
> auth_param basic children 5
> auth_param basic realm Squid proxy-caching web server
> auth_param basic credentialsttl 1 hours
> auth_param basic casesensitive off
> external_acl_type ip_user_helper %SRC %LOGIN
> /usr/libexec/squid/ip_user_check -f /etc/squid/ip_user.conf
> acl all src 0.0.0.0/0.0.0.0
> acl hepworth external ip_user_helper
> http_access allow hepworth
> http_access deny all
> icp_access allow all
> http_port 3128
> hierarchy_stoplist cgi-bin ?
> access_log /var/log/squid/access.log squid
> debug_options ALL,1 33,2 28,9
> acl QUERY urlpath_regex cgi-bin \?
> cache deny QUERY
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern . 0 20% 4320
> acl apache rep_header Server ^Apache
> broken_vary_encoding allow apache
> visible_hostname AnnesHouse
> forwarded_for off
> coredump_dir /var/cache/squid
> hepworth andrew #
>
> and i use a browser to get http://www.bbc.co.uk which -> cache access denied
>
>
> and this in cache.log
>
> 2008/03/19 21:37:16| aclCheckFast: list: 0x82a76f0
> 2008/03/19 21:37:16| aclMatchAclList: checking all
> 2008/03/19 21:37:16| aclMatchAcl: checking 'acl all src 0.0.0.0/0.0.0.0'
> 2008/03/19 21:37:16| aclMatchIp: '127.0.0.1' found
> 2008/03/19 21:37:16| aclMatchAclList: returning 1
> 2008/03/19 21:37:16| aclCheck: checking 'http_access allow hepworth'
> 2008/03/19 21:37:16| aclMatchAclList: checking hepworth
> 2008/03/19 21:37:16| aclMatchAcl: checking 'acl hepworth external
> ip_user_helper'
> 2008/03/19 21:37:16| aclMatchAcl: returning 0 sending authentication
> challenge.
> 2008/03/19 21:37:16| aclMatchAclList: no match, returning 0
> 2008/03/19 21:37:16| aclCheck: requiring Proxy Auth header.

checking for Proxy-Auth...:

> 2008/03/19 21:37:16| aclCheck: match found, returning 2

found the header (nothing about the headers content though)...

> 2008/03/19 21:37:16| aclCheckCallback: answer=2
> 2008/03/19 21:37:16| The request GET http://www.bbc.co.uk/ is DENIED,
> because it matched 'hepworth'

... the header content fails to match the ACL text.

> 2008/03/19 21:37:16| The reply for GET http://www.bbc.co.uk/ is ALLOWED,
> because it matched 'hepworth'

407 reply ('auth needed') gets sent out ok.

>
> it would appear to be authenticating the user ( ie ALL from 127.0.0.1)
> so where is it denying the request ?

It looks to me like the authentication details are being found but do
not match the ACL.

I think it may be related to the user-domain. Does the fix for bug 2172
fix this?

Amos

-- 
Please use Squid 2.6STABLE17+ or 3.0STABLE1+
There are serious security advisories out on all earlier releases.