Policy with multiple ACL calls

--===============0736259158438857697==
Content-Type: multipart/alternative; boundary="000000000000a6a9a3064d607024"

--000000000000a6a9a3064d607024
Content-Type: text/plain; charset="UTF-8"

Hello,

I'd be curious to know, is the dstdomain ACL evaluated once per transaction
or every time it occurs in the policy?

For example, in the following simplified policy, will the Squid go through
the long list of bank-sites once or six times?

  acl bank-sites dstdomain bank-sites.txt
  acl user1 proxy_auth user1
  acl user2 proxy_auth user2
  acl user3 proxy_auth user3

  http_access allow user1 bank-sites
  http_access allow user2 bank-sites
  http_access deny  user3 bank-sites

  ssl_bump splice    user1 bank-sites
  ssl_bump bump      user2 bank-sites
  ssl_bump terminate user3 bank-sites

I believe that the ACL is calculated only once and the result is reused.

How do you think, would it be more efficient to use annotations, like in
the following example?

  acl bank-sites dstdomain bank-sites.txt
  acl user1 proxy_auth user1
  acl user2 proxy_auth user2
  acl user3 proxy_auth user3

  acl annotate_banks annotate_client categories+=bank
  acl is_bank note categories bank

  # evaluate bank-sites just once and annotate a connection
  http_access deny bank-sites annotate_banks !all

  http_access allow user1 is_bank
  http_access allow user2 is_bank
  http_access deny  user3 is_bank

  ssl_bump splice    user1 is_bank
  ssl_bump bump      user2 is_bank
  ssl_bump terminate user3 is_bank

Kind regards,
    Ankor.

--000000000000a6a9a3064d607024
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>I&#39;d be curious to=
 know, is the dstdomain ACL evaluated once per transaction or every time it=
 occurs in the policy?</div><br>For example, in the following simplified po=
licy, will the Squid go through the long list of bank-sites once or six tim=
es?<br><br><font face=3D"monospace">=C2=A0 acl bank-sites dstdomain bank-si=
tes.txt<br>=C2=A0 acl user1 proxy_auth user1<br>=C2=A0 acl user2 proxy_auth=
 user2<br>=C2=A0 acl user3 proxy_auth user3<br><br>=C2=A0 http_access allow=
 user1 bank-sites<br>=C2=A0 http_access allow user2 bank-sites<br>=C2=A0 ht=
tp_access deny=C2=A0 user3 bank-sites<br><br>=C2=A0 ssl_bump splice=C2=A0 =
=C2=A0 user1 bank-sites<br>=C2=A0 ssl_bump bump=C2=A0 =C2=A0 =C2=A0 user2 b=
ank-sites<br>=C2=A0 ssl_bump terminate user3 bank-sites<br></font><br>I bel=
ieve that the ACL is calculated only once and the result is reused.<div><br=
>How do you think, would it be more efficient to use annotations, like in t=
he following example?<br><br><font face=3D"monospace">=C2=A0 acl bank-sites=
 dstdomain bank-sites.txt<br>=C2=A0 acl user1 proxy_auth user1<br>=C2=A0 ac=
l user2 proxy_auth user2<br>=C2=A0 acl user3 proxy_auth user3<br><br>=C2=A0=
 acl annotate_banks annotate_client categories+=3Dbank<br>=C2=A0 acl is_ban=
k note categories bank<br><br>=C2=A0 # evaluate bank-sites just once and an=
notate a connection<br>=C2=A0 http_access deny bank-sites annotate_banks !a=
ll<br><br>=C2=A0 http_access allow user1 is_bank<br>=C2=A0 http_access allo=
w user2 is_bank<br>=C2=A0 http_access deny=C2=A0 user3 is_bank<br><br></fon=
t></div><div><font face=3D"monospace">=C2=A0 ssl_bump splice=C2=A0 =C2=A0 u=
ser1 is_bank</font></div><font face=3D"monospace">=C2=A0 ssl_bump bump=C2=
=A0 =C2=A0 =C2=A0 user2 is_bank<br>=C2=A0 ssl_bump terminate user3 is_bank<=
/font><div><br></div><div>Kind regards,</div><div>=C2=A0 =C2=A0 Ankor.</div=
><div><br></div><div><br></div></div>

--000000000000a6a9a3064d607024--

--===============0736259158438857697==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============0736259158438857697==--