Re: [PATCH] ACL to control TPROXY spoofing

From: Amos Jeffries <squid3_at_treenet.co.nz>
Date: Wed, 27 Feb 2013 11:52:42 +1300

On 27/02/2013 10:54 a.m., Kinkie wrote:
> May I chime in?
> While I'm not an expert too, why can't we have the best of both worlds
> without even letting the cache admin know?
> This could be as simple as having some code which detects if the
> config has changed from the "deny all" default and enters the ACL
> checking code path only if it is so.. there'd be a negligible overhead
> in the uncommon case, and just a bit of unused code carried around in
> the common case..

That is what we should have now for all ACL checklists. A NULL check
against the configured ACL tree, with some hard-coded default action if
there is nothing configured.

Amos
Received on Tue Feb 26 2013 - 22:52:54 MST

This archive was generated by hypermail 2.2.0 : Wed Feb 27 2013 - 12:00:08 MST