Re: [squid-users] whitelisted IP problem

On 20/03/2012 07:53, Vijay wrote:
> 2012/03/20 10:14:23.889| aclCheckFast: list: 0x175c860
> 2012/03/20 10:14:23.889| ACLChecklist::preCheck: 0xbfccd8b4 checking
> 'ident_lookup_access deny all'
> 2012/03/20 10:14:23.889| ACLList::matches: checking all
> 2012/03/20 10:14:23.889| ACL::checklistMatches: checking 'all'
> 2012/03/20 10:14:23.889| aclIpAddrNetworkCompare: compare:
> 122.166.1.184:48347/[::] ([::]:48347) vs [::]-[::]/[::]
> 2012/03/20 10:14:23.890| aclIpMatchIp: '122.166.1.184:48347' found
> 2012/03/20 10:14:23.890| ACL::ChecklistMatches: result for 'all' is 1
> 2012/03/20 10:14:23.890| ACLList::matches: result is true
> 2012/03/20 10:14:23.890| aclmatchAclList: 0xbfccd8b4 returning true (AND
> list satisfied)
> 2012/03/20 10:14:23.890| ACLChecklist::markFinished: 0xbfccd8b4 checklist
> processing finished
> 2012/03/20 10:14:23.890| FilledChecklist.cc(168) ~ACLFilledChecklist:
> ACLFilledChecklist destroyed 0xbfccd8b4
> 2012/03/20 10:14:23.890| ACLChecklist::~ACLChecklist: destroyed 0xbfccd8b4

i'm trying again to understand and if your htt_access wasnt changed thi
line here is the beginning of the aclchek for the client.
starts with manager = 127.0.0.1
> 2012/03/20 10:14:23.890| ACLChecklist::preCheck: 0x19f0128 checking
> 'http_access allow manager localhost server'
> 2012/03/20 10:14:23.890| ACLList::matches: checking manager
> 2012/03/20 10:14:23.890| ACL::checklistMatches: checking 'manager'
> 2012/03/20 10:14:23.890| ACL::ChecklistMatches: result for 'manager' is 0
> 2012/03/20 10:14:23.890| ACLList::matches: result is false
conclusion not from 127.0.0.1 means other ip and moving to the next
htt_access rule to check if there is allow to accomplish there.
> 2012/03/20 10:14:23.890| aclmatchAclList: 0x19f0128 returning false (AND
> list entry failed to match)
> 2012/03/20 10:14:23.890| aclmatchAclList: async=0 nodeMatched=0
> async_in_progress=0 lastACLResult() = 0 finished() = 0
starting the dont allow manager rule
> 2012/03/20 10:14:23.890| ACLChecklist::preCheck: 0x19f0128 checking
> 'http_access deny manager'
> 2012/03/20 10:14:23.890| ACLList::matches: checking manager
> 2012/03/20 10:14:23.891| ACL::checklistMatches: checking 'manager'
> 2012/03/20 10:14:23.891| ACL::ChecklistMatches: result for 'manager' is 0
> 2012/03/20 10:14:23.891| ACLList::matches: result is false
it's not mangaer so moving on to the next rule.
> 2012/03/20 10:14:23.891| aclmatchAclList: 0x19f0128 returning false (AND
> list entry failed to match)
> 2012/03/20 10:14:23.891| aclmatchAclList: async=0 nodeMatched=0
> async_in_progress=0 lastACLResult() = 0 finished() = 0
moving to the next wich means dont allow to any of ports other then the
list of safe "443,80 etc.."
> 2012/03/20 10:14:23.891| ACLChecklist::preCheck: 0x19f0128 checking
> 'http_access deny !Safe_ports'
> 2012/03/20 10:14:23.891| ACLList::matches: checking !Safe_ports
> 2012/03/20 10:14:23.891| ACL::checklistMatches: checking 'Safe_ports'
> 2012/03/20 10:14:23.891| ACL::ChecklistMatches: result for 'Safe_ports' is 1
> 2012/03/20 10:14:23.891| ACLList::matches: result is false
it's not matching not dafe ports cause it's port 80
> 2012/03/20 10:14:23.891| aclmatchAclList: 0x19f0128 returning false (AND
> list entry failed to match)
> 2012/03/20 10:14:23.891| aclmatchAclList: async=0 nodeMatched=0
> async_in_progress=0 lastACLResult() = 0 finished() = 0
the next rule will be trying the CONNECT method on not SSL ports (443).
> 2012/03/20 10:14:23.891| ACLChecklist::preCheck: 0x19f0128 checking
> 'http_access deny CONNECT !SSL_ports'
> 2012/03/20 10:14:23.891| ACLList::matches: checking CONNECT
> 2012/03/20 10:14:23.891| ACL::checklistMatches: checking 'CONNECT'
> 2012/03/20 10:14:23.891| ACL::ChecklistMatches: result for 'CONNECT' is 1
> 2012/03/20 10:14:23.891| ACLList::matches: result is true
and you <<< do try to use ssl>>> (why?)
squid client wont use connect... ssl.. means i suppose you are using
wrong code to get the site content.

> 2012/03/20 10:14:23.891| ACLList::matches: checking !SSL_ports
> 2012/03/20 10:14:23.891| ACL::checklistMatches: checking 'SSL_ports'
> 2012/03/20 10:14:23.892| ACL::ChecklistMatches: result for 'SSL_ports' is 0
> 2012/03/20 10:14:23.892| ACLList::matches: result is true
conclusion ..you are trying to use CONNECT to not SSL port so...
> 2012/03/20 10:14:23.892| aclmatchAclList: 0x19f0128 returning true (AND list
> satisfied)
squid finding you answering the http_access acl and will deny the connection
means you didn't add the acl's and http_access rule i sent you.

look at what i sent you and try again after.

Regards,
Eliezer
> 2012/03/20 10:14:23.892| ACLChecklist::markFinished: 0x19f0128 checklist
> processing finished
> 2012/03/20 10:14:23.892| ACLChecklist::check: 0x19f0128 match found, calling
> back with 0
> 2012/03/20 10:14:23.892| ACLFilledChecklist::checkCallback: 0x19f0128
> answer=0
> 2012/03/20 10:14:23.892| ACLChecklist::checkCallback: 0x19f0128 answer=0
> 2012/03/20 10:14:23.892| aclIsProxyAuth: called for SSL_ports
> 2012/03/20 10:14:23.892| ACL::FindByName 'SSL_ports'
> 2012/03/20 10:14:23.892| aclIsProxyAuth: returning 0
> 2012/03/20 10:14:23.892| Gadgets.cc(57) aclGetDenyInfoPage: got called for
> SSL_ports
> 2012/03/20 10:14:23.892| aclGetDenyInfoPage: no match
> 2012/03/20 10:14:23.892| FilledChecklist.cc(168) ~ACLFilledChecklist:
> ACLFilledChecklist destroyed 0x19f0128
> 2012/03/20 10:14:23.892| ACLChecklist::~ACLChecklist: destroyed 0x19f0128
> 2012/03/20 10:14:23.893| FilledChecklist.cc(168) ~ACLFilledChecklist:
> ACLFilledChecklist destroyed 0x19f0128
> 2012/03/20 10:14:23.893| ACLChecklist::~ACLChecklist: destroyed 0x19f0128
> 2012/03/20 10:14:23.893| ConnStateData::swanSong: FD 11
>
>
>
> Thanks& Regards
> Vijay

-- 
Eliezer Croitoru
https://www1.ngtech.co.il
IT consulting for Nonprofit organizations
elilezer <at> ngtech.co.il