Merge lp:~colindean/ubuntu/natty/squid-deb-proxy/allow-but-not-cache-unspecified-domains into lp:ubuntu/natty/squid-deb-proxy

[Colin Dean]

This adds commented lines which can be uncommented to allow access to domains not specified in the mirrors file, but with the caveat that such accesses are not cached. This essentially moves the recommendation from the bug report into the configuration file, wherein the administrator can make the decision.

It would be nicer if there was some kind of option for it ("Allow unspecified domains?") but I don't think the squid.conf options permit that kind of logic.

[Evan Broder (broder)]

Is it harmful to have "cache deny !to_ubuntu_mirrors" turned on by default? If that was OK, you could do something like

 cache deny !to_ubuntu_mirrors

 # Comment the next line and uncomment the one after it to allow but not
 # cache domains not listed in the mirrors file
 http_access deny !to_ubuntu_mirrors
 #http_access allow !to_ubuntu_mirrors

which would simplify the changes an admin would have to make.

[Colin Dean (colindean)]

I'm cool with that. Shall I make the change and repropose?

[Evan Broder (broder)]

That would be great, thanks.

[Michael Vogt (mvo)]

Thanks, merged and will be part of the next upload.

=== modified file 'squid-deb-proxy.conf'
--- squid-deb-proxy.conf	2010-01-26 09:19:50 +0000
+++ squid-deb-proxy.conf	2010-11-09 16:04:49 +0000
@@ -63,10 +63,20 @@
 acl Safe_ports port 80
 acl Safe_ports port 443 563   
 
-# only allow port we trust
+# only allow ports we trust
 http_access deny !Safe_ports
-# and only to ubuntu
+
+# allow access only to official ubuntu mirrors
+# uncomment the second line to permit unlisted domains
 http_access deny !to_ubuntu_mirrors
+#http_access allow !to_ubuntu_mirrors
+
+# don't cache domains not listed in the mirrors file
+# uncomment the second line to cache unlisted domains
+cache deny !to_ubuntu_mirrors
+#cache allow !to_ubuntu_mirrors
+
+
 
 # allow access from our network and localhost
 http_access allow allowed_networks