Re: when 'cache_peer_access <cache> deny all_dst' is not enough

Henrik Nordstrom wrote:

> Dancer wrote:
>
> > third-party interfacing requires me to do a DNS lookup in a redirector.
> > Yes, I've implemented my own caches....but I would love to be able to
> > force squid to perform the lookup earlier in the lifetime of the
> > request, so that it will be in the DNS cache (positively or negatively)
> > when we get to needing it in the redirector.
>
> Use http_access which does block for lookups and is used prior to
> redirection.
>
> Insert the following somewhere before where your requests are being
> allowed:
>
> acl all_destinations dst 0.0.0.0/0
> acl none 0.0.0.0/32
> http_access allow all_destinations none
>
> The intent of the above is to have ACL processing use destination IP
> withour actually doing anything with it. No clients ever matches the
> none acl, so the http_access line is never true.

Ah, I misunderstood you then, and thought that you had said that 'dst' acls
were occasionally bypassed in the interests of expediency. I took it to mean
http_access as well.

D
Received on Fri Nov 12 1999 - 16:25:42 MST