· 8 years ago · Jul 19, 2018, 10:12 AM
1# WELCOME TO SQUID 4.1
2# ----------------------------
3#
4# This is the documentation for the Squid configuration file.
5# This documentation can also be found online at:
6# http://www.squid-cache.org/Doc/config/
7#
8# You may wish to look at the Squid home page and wiki for the
9# FAQ and other documentation:
10# http://www.squid-cache.org/
11# http://wiki.squid-cache.org/SquidFaq
12# http://wiki.squid-cache.org/ConfigExamples
13#
14# This documentation shows what the defaults for various directives
15# happen to be. If you don't need to change the default, you should
16# leave the line out of your squid.conf in most cases.
17#
18# In some cases "none" refers to no default setting at all,
19# while in other cases it refers to the value of the option
20# - the comments for that keyword indicate if this is the case.
21#
22
23# Configuration options can be included using the "include" directive.
24# Include takes a list of files to include. Quoting and wildcards are
25# supported.
26#
27# For example,
28#
29# include /path/to/included/file/squid.acl.config
30#
31# Includes can be nested up to a hard-coded depth of 16 levels.
32# This arbitrary restriction is to prevent recursive include references
33# from causing Squid entering an infinite loop whilst trying to load
34# configuration files.
35#
36# Values with byte units
37#
38# Squid accepts size units on some size related directives. All
39# such directives are documented with a default value displaying
40# a unit.
41#
42# Units accepted by Squid are:
43# bytes - byte
44# KB - Kilobyte (1024 bytes)
45# MB - Megabyte
46# GB - Gigabyte
47#
48# Values with spaces, quotes, and other special characters
49#
50# Squid supports directive parameters with spaces, quotes, and other
51# special characters. Surround such parameters with "double quotes". Use
52# the configuration_includes_quoted_values directive to enable or
53# disable that support.
54#
55# Squid supports reading configuration option parameters from external
56# files using the syntax:
57# parameters("/path/filename")
58# For example:
59# acl whitelist dstdomain parameters("/etc/squid/whitelist.txt")
60#
61# Conditional configuration
62#
63# If-statements can be used to make configuration directives
64# depend on conditions:
65#
66# if <CONDITION>
67# ... regular configuration directives ...
68# [else
69# ... regular configuration directives ...]
70# endif
71#
72# The else part is optional. The keywords "if", "else", and "endif"
73# must be typed on their own lines, as if they were regular
74# configuration directives.
75#
76# NOTE: An else-if condition is not supported.
77#
78# These individual conditions types are supported:
79#
80# true
81# Always evaluates to true.
82# false
83# Always evaluates to false.
84# <integer> = <integer>
85# Equality comparison of two integer numbers.
86#
87#
88# SMP-Related Macros
89#
90# The following SMP-related preprocessor macros can be used.
91#
92# ${process_name} expands to the current Squid process "name"
93# (e.g., squid1, squid2, or cache1).
94#
95# ${process_number} expands to the current Squid process
96# identifier, which is an integer number (e.g., 1, 2, 3) unique
97# across all Squid processes of the current service instance.
98#
99# ${service_name} expands into the current Squid service instance
100# name identifier which is provided by -n on the command line.
101#
102# Logformat Macros
103#
104# Logformat macros can be used in many places outside of the logformat
105# directive. In theory, all of the logformat codes can be used as %macros,
106# where they are supported. In practice, a %macro expands as a dash (-) when
107# the transaction does not yet have enough information and a value is needed.
108#
109# There is no definitive list of what tokens are available at the various
110# stages of the transaction.
111#
112# And some information may already be available to Squid but not yet
113# committed where the macro expansion code can access it (report
114# such instances!). The macro will be expanded into a single dash
115# ('-') in such cases. Not all macros have been tested.
116#
117
118# TAG: broken_vary_encoding
119# This option is not yet supported by Squid-3.
120#Default:
121# none
122
123# TAG: cache_vary
124# This option is not yet supported by Squid-3.
125#Default:
126# none
127
128# TAG: error_map
129# This option is not yet supported by Squid-3.
130#Default:
131# none
132
133# TAG: external_refresh_check
134# This option is not yet supported by Squid-3.
135#Default:
136# none
137
138# TAG: location_rewrite_program
139# This option is not yet supported by Squid-3.
140#Default:
141# none
142
143# TAG: refresh_stale_hit
144# This option is not yet supported by Squid-3.
145#Default:
146# none
147
148# TAG: cache_peer_domain
149# Replace with dstdomain ACLs and cache_peer_access.
150#Default:
151# none
152
153# TAG: ie_refresh
154# Remove this line. The behaviour enabled by this is no longer needed.
155#Default:
156# none
157
158# TAG: sslproxy_cafile
159# Remove this line. Use tls_outgoing_options cafile= instead.
160#Default:
161# none
162
163# TAG: sslproxy_capath
164# Remove this line. Use tls_outgoing_options capath= instead.
165#Default:
166# none
167
168# TAG: sslproxy_cipher
169# Remove this line. Use tls_outgoing_options cipher= instead.
170#Default:
171# none
172
173# TAG: sslproxy_client_certificate
174# Remove this line. Use tls_outgoing_options cert= instead.
175#Default:
176# none
177
178# TAG: sslproxy_client_key
179# Remove this line. Use tls_outgoing_options key= instead.
180#Default:
181# none
182
183# TAG: sslproxy_flags
184# Remove this line. Use tls_outgoing_options flags= instead.
185#Default:
186# none
187
188# TAG: sslproxy_options
189# Remove this line. Use tls_outgoing_options options= instead.
190#Default:
191# none
192
193# TAG: sslproxy_version
194# Remove this line. Use tls_outgoing_options options= instead.
195#Default:
196# none
197
198# TAG: hierarchy_stoplist
199# Remove this line. Use always_direct or cache_peer_access ACLs instead if you need to prevent cache_peer use.
200#Default:
201# none
202
203# TAG: log_access
204# Remove this line. Use acls with access_log directives to control access logging
205#Default:
206# none
207
208# TAG: log_icap
209# Remove this line. Use acls with icap_log directives to control icap logging
210#Default:
211# none
212
213# TAG: ignore_ims_on_miss
214# Remove this line. The HTTP/1.1 feature is now configured by 'cache_miss_revalidate'.
215#Default:
216# none
217
218# TAG: chunked_request_body_max_size
219# Remove this line. Squid is now HTTP/1.1 compliant.
220#Default:
221# none
222
223# TAG: dns_v4_fallback
224# Remove this line. Squid performs a 'Happy Eyeballs' algorithm, the 'fallback' algorithm is no longer relevant.
225#Default:
226# none
227
228# TAG: emulate_httpd_log
229# Replace this with an access_log directive using the format 'common' or 'combined'.
230#Default:
231# none
232
233# TAG: forward_log
234# Use a regular access.log with ACL limiting it to MISS events.
235#Default:
236# none
237
238# TAG: ftp_list_width
239# Remove this line. Configure FTP page display using the CSS controls in errorpages.css instead.
240#Default:
241# none
242
243# TAG: ignore_expect_100
244# Remove this line. The HTTP/1.1 feature is now fully supported by default.
245#Default:
246# none
247
248# TAG: log_fqdn
249# Remove this option from your config. To log FQDN use %>A in the log format.
250#Default:
251# none
252
253# TAG: log_ip_on_direct
254# Remove this option from your config. To log server or peer names use %<A in the log format.
255#Default:
256# none
257
258# TAG: maximum_single_addr_tries
259# Replaced by connect_retries. The behaviour has changed, please read the documentation before altering.
260#Default:
261# none
262
263# TAG: referer_log
264# Replace this with an access_log directive using the format 'referrer'.
265#Default:
266# none
267
268# TAG: update_headers
269# Remove this line. The feature is supported by default in storage types where update is implemented.
270#Default:
271# none
272
273# TAG: url_rewrite_concurrency
274# Remove this line. Set the 'concurrency=' option of url_rewrite_children instead.
275#Default:
276# none
277
278# TAG: useragent_log
279# Replace this with an access_log directive using the format 'useragent'.
280#Default:
281# none
282
283# TAG: dns_testnames
284# Remove this line. DNS is no longer tested on startup.
285#Default:
286# none
287
288# TAG: extension_methods
289# Remove this line. All valid methods for HTTP are accepted by default.
290#Default:
291# none
292
293# TAG: zero_buffers
294#Default:
295# none
296
297# TAG: incoming_rate
298#Default:
299# none
300
301# TAG: server_http11
302# Remove this line. HTTP/1.1 is supported by default.
303#Default:
304# none
305
306# TAG: upgrade_http0.9
307# Remove this line. ICY/1.0 streaming protocol is supported by default.
308#Default:
309# none
310
311# TAG: zph_local
312# Alter these entries. Use the qos_flows directive instead.
313#Default:
314# none
315
316# TAG: header_access
317# Since squid-3.0 replace with request_header_access or reply_header_access
318# depending on whether you wish to match client requests or server replies.
319#Default:
320# none
321
322# TAG: httpd_accel_no_pmtu_disc
323# Since squid-3.0 use the 'disable-pmtu-discovery' flag on http_port instead.
324#Default:
325# none
326
327# TAG: wais_relay_host
328# Replace this line with 'cache_peer' configuration.
329#Default:
330# none
331
332# TAG: wais_relay_port
333# Replace this line with 'cache_peer' configuration.
334#Default:
335# none
336
337# OPTIONS FOR SMP
338# -----------------------------------------------------------------------------
339
340# TAG: workers
341# Number of main Squid processes or "workers" to fork and maintain.
342# 0: "no daemon" mode, like running "squid -N ..."
343# 1: "no SMP" mode, start one main Squid process daemon (default)
344# N: start N main Squid process daemons (i.e., SMP mode)
345#
346# In SMP mode, each worker does nearly all what a single Squid daemon
347# does (e.g., listen on http_port and forward HTTP requests).
348#Default:
349# SMP support disabled.
350
351# TAG: cpu_affinity_map
352# Usage: cpu_affinity_map process_numbers=P1,P2,... cores=C1,C2,...
353#
354# Sets 1:1 mapping between Squid processes and CPU cores. For example,
355#
356# cpu_affinity_map process_numbers=1,2,3,4 cores=1,3,5,7
357#
358# affects processes 1 through 4 only and places them on the first
359# four even cores, starting with core #1.
360#
361# CPU cores are numbered starting from 1. Requires support for
362# sched_getaffinity(2) and sched_setaffinity(2) system calls.
363#
364# Multiple cpu_affinity_map options are merged.
365#
366# See also: workers
367#Default:
368# Let operating system decide.
369
370# TAG: shared_memory_locking on|off
371# Whether to ensure that all required shared memory is available by
372# "locking" that shared memory into RAM when Squid starts. The
373# alternative is faster startup time followed by slightly slower
374# performance and, if not enough RAM is actually available during
375# runtime, mysterious crashes.
376#
377# SMP Squid uses many shared memory segments. These segments are
378# brought into Squid memory space using an mmap(2) system call. During
379# Squid startup, the mmap() call often succeeds regardless of whether
380# the system has enough RAM. In general, Squid cannot tell whether the
381# kernel applies this "optimistic" memory allocation policy (but
382# popular modern kernels usually use it).
383#
384# Later, if Squid attempts to actually access the mapped memory
385# regions beyond what the kernel is willing to allocate, the
386# "optimistic" kernel simply kills Squid kid with a SIGBUS signal.
387# Some of the memory limits enforced by the kernel are currently
388# poorly understood: We do not know how to detect and check them. This
389# option ensures that the mapped memory will be available.
390#
391# This option may have a positive performance side-effect: Locking
392# memory at start avoids runtime paging I/O. Paging slows Squid down.
393#
394# Locking memory may require a large enough RLIMIT_MEMLOCK OS limit,
395# CAP_IPC_LOCK capability, or equivalent.
396#Default:
397# shared_memory_locking off
398
399# TAG: hopeless_kid_revival_delay time-units
400# Normally, when a kid process dies, Squid immediately restarts the
401# kid. A kid experiencing frequent deaths is marked as "hopeless" for
402# the duration specified by this directive. Hopeless kids are not
403# automatically restarted.
404#
405# Currently, zero values are not supported because they result in
406# misconfigured SMP Squid instances running forever, endlessly
407# restarting each dying kid. To effectively disable hopeless kids
408# revival, set the delay to a huge value (e.g., 1 year).
409#
410# Reconfiguration also clears all hopeless kids designations, allowing
411# for manual revival of hopeless kids.
412#Default:
413# hopeless_kid_revival_delay 1 hour
414
415# OPTIONS FOR AUTHENTICATION
416# -----------------------------------------------------------------------------
417
418# TAG: auth_param
419# This is used to define parameters for the various authentication
420# schemes supported by Squid.
421#
422# format: auth_param scheme parameter [setting]
423#
424# The order in which authentication schemes are presented to the client is
425# dependent on the order the scheme first appears in config file. IE
426# has a bug (it's not RFC 2617 compliant) in that it will use the basic
427# scheme if basic is the first entry presented, even if more secure
428# schemes are presented. For now use the order in the recommended
429# settings section below. If other browsers have difficulties (don't
430# recognize the schemes offered even if you are using basic) either
431# put basic first, or disable the other schemes (by commenting out their
432# program entry).
433#
434# Once an authentication scheme is fully configured, it can only be
435# shutdown by shutting squid down and restarting. Changes can be made on
436# the fly and activated with a reconfigure. I.E. You can change to a
437# different helper, but not unconfigure the helper completely.
438#
439# Please note that while this directive defines how Squid processes
440# authentication it does not automatically activate authentication.
441# To use authentication you must in addition make use of ACLs based
442# on login name in http_access (proxy_auth, proxy_auth_regex or
443# external with %LOGIN used in the format tag). The browser will be
444# challenged for authentication on the first such acl encountered
445# in http_access processing and will also be re-challenged for new
446# login credentials if the request is being denied by a proxy_auth
447# type acl.
448#
449# WARNING: authentication can't be used in a transparently intercepting
450# proxy as the client then thinks it is talking to an origin server and
451# not the proxy. This is a limitation of bending the TCP/IP protocol to
452# transparently intercepting port 80, not a limitation in Squid.
453# Ports flagged 'transparent', 'intercept', or 'tproxy' have
454# authentication disabled.
455#
456# === Parameters common to all schemes. ===
457#
458# "program" cmdline
459# Specifies the command for the external authenticator.
460#
461# By default, each authentication scheme is not used unless a
462# program is specified.
463#
464# See http://wiki.squid-cache.org/Features/AddonHelpers for
465# more details on helper operations and creating your own.
466#
467# "key_extras" format
468# Specifies a string to be append to request line format for
469# the authentication helper. "Quoted" format values may contain
470# spaces and logformat %macros. In theory, any logformat %macro
471# can be used. In practice, a %macro expands as a dash (-) if
472# the helper request is sent before the required macro
473# information is available to Squid.
474#
475# By default, Squid uses request formats provided in
476# scheme-specific examples below (search for %credentials).
477#
478# The expanded key_extras value is added to the Squid credentials
479# cache and, hence, will affect authentication. It can be used to
480# autenticate different users with identical user names (e.g.,
481# when user authentication depends on http_port).
482#
483# Avoid adding frequently changing information to key_extras. For
484# example, if you add user source IP, and it changes frequently
485# in your environment, then max_user_ip ACL is going to treat
486# every user+IP combination as a unique "user", breaking the ACL
487# and wasting a lot of memory on those user records. It will also
488# force users to authenticate from scratch whenever their IP
489# changes.
490#
491# "realm" string
492# Specifies the protection scope (aka realm name) which is to be
493# reported to the client for the authentication scheme. It is
494# commonly part of the text the user will see when prompted for
495# their username and password.
496#
497# For Basic the default is "Squid proxy-caching web server".
498# For Digest there is no default, this parameter is mandatory.
499# For NTLM and Negotiate this parameter is ignored.
500#
501# "children" numberofchildren [startup=N] [idle=N] [concurrency=N]
502# [queue-size=N] [on-persistent-overload=action]
503#
504# The maximum number of authenticator processes to spawn. If
505# you start too few Squid will have to wait for them to process
506# a backlog of credential verifications, slowing it down. When
507# password verifications are done via a (slow) network you are
508# likely to need lots of authenticator processes.
509#
510# The startup= and idle= options permit some skew in the exact
511# amount run. A minimum of startup=N will begin during startup
512# and reconfigure. Squid will start more in groups of up to
513# idle=N in an attempt to meet traffic needs and to keep idle=N
514# free above those traffic needs up to the maximum.
515#
516# The concurrency= option sets the number of concurrent requests
517# the helper can process. The default of 0 is used for helpers
518# who only supports one request at a time. Setting this to a
519# number greater than 0 changes the protocol used to include a
520# channel ID field first on the request/response line, allowing
521# multiple requests to be sent to the same helper in parallel
522# without waiting for the response.
523#
524# Concurrency must not be set unless it's known the helper
525# supports the input format with channel-ID fields.
526#
527# The queue-size=N option sets the maximum number of queued
528# requests to N. The default maximum is 2*numberofchildren. Squid
529# is allowed to temporarily exceed the configured maximum, marking
530# the affected helper as "overloaded". If the helper overload
531# lasts more than 3 minutes, the action prescribed by the
532# on-persistent-overload option applies.
533#
534# The on-persistent-overload=action option specifies Squid
535# reaction to a new helper request arriving when the helper
536# has been overloaded for more that 3 minutes already. The number
537# of queued requests determines whether the helper is overloaded
538# (see the queue-size option).
539#
540# Two actions are supported:
541#
542# die Squid worker quits. This is the default behavior.
543#
544# ERR Squid treats the helper request as if it was
545# immediately submitted, and the helper immediately
546# replied with an ERR response. This action has no effect
547# on the already queued and in-progress helper requests.
548#
549# NOTE: NTLM and Negotiate schemes do not support concurrency
550# in the Squid code module even though some helpers can.
551#
552#
553#
554# === Example Configuration ===
555#
556# This configuration displays the recommended authentication scheme
557# order from most to least secure with recommended minimum configuration
558# settings for each scheme:
559#
560##auth_param negotiate program <uncomment and complete this line to activate>
561##auth_param negotiate children 20 startup=0 idle=1
562##auth_param negotiate keep_alive on
563##
564##auth_param digest program <uncomment and complete this line to activate>
565##auth_param digest children 20 startup=0 idle=1
566##auth_param digest realm Squid proxy-caching web server
567##auth_param digest nonce_garbage_interval 5 minutes
568##auth_param digest nonce_max_duration 30 minutes
569##auth_param digest nonce_max_count 50
570##
571##auth_param ntlm program <uncomment and complete this line to activate>
572##auth_param ntlm children 20 startup=0 idle=1
573##auth_param ntlm keep_alive on
574##
575##auth_param basic program <uncomment and complete this line>
576##auth_param basic children 5 startup=5 idle=1
577##auth_param basic realm Squid proxy-caching web server
578##auth_param basic credentialsttl 2 hours
579#Default:
580# none
581
582# TAG: authenticate_cache_garbage_interval
583# The time period between garbage collection across the username cache.
584# This is a trade-off between memory utilization (long intervals - say
585# 2 days) and CPU (short intervals - say 1 minute). Only change if you
586# have good reason to.
587#Default:
588# authenticate_cache_garbage_interval 1 hour
589
590# TAG: authenticate_ttl
591# The time a user & their credentials stay in the logged in
592# user cache since their last request. When the garbage
593# interval passes, all user credentials that have passed their
594# TTL are removed from memory.
595#Default:
596# authenticate_ttl 1 hour
597
598# TAG: authenticate_ip_ttl
599# If you use proxy authentication and the 'max_user_ip' ACL,
600# this directive controls how long Squid remembers the IP
601# addresses associated with each user. Use a small value
602# (e.g., 60 seconds) if your users might change addresses
603# quickly, as is the case with dialup. You might be safe
604# using a larger value (e.g., 2 hours) in a corporate LAN
605# environment with relatively static address assignments.
606#Default:
607# authenticate_ip_ttl 1 second
608
609# ACCESS CONTROLS
610# -----------------------------------------------------------------------------
611
612# TAG: external_acl_type
613# This option defines external acl classes using a helper program
614# to look up the status
615#
616# external_acl_type name [options] FORMAT /path/to/helper [helper arguments]
617#
618# Options:
619#
620# ttl=n TTL in seconds for cached results (defaults to 3600
621# for 1 hour)
622#
623# negative_ttl=n
624# TTL for cached negative lookups (default same
625# as ttl)
626#
627# grace=n Percentage remaining of TTL where a refresh of a
628# cached entry should be initiated without needing to
629# wait for a new reply. (default is for no grace period)
630#
631# cache=n The maximum number of entries in the result cache. The
632# default limit is 262144 entries. Each cache entry usually
633# consumes at least 256 bytes. Squid currently does not remove
634# expired cache entries until the limit is reached, so a proxy
635# will sooner or later reach the limit. The expanded FORMAT
636# value is used as the cache key, so if the details in FORMAT
637# are highly variable, a larger cache may be needed to produce
638# reduction in helper load.
639#
640# children-max=n
641# Maximum number of acl helper processes spawned to service
642# external acl lookups of this type. (default 5)
643#
644# children-startup=n
645# Minimum number of acl helper processes to spawn during
646# startup and reconfigure to service external acl lookups
647# of this type. (default 0)
648#
649# children-idle=n
650# Number of acl helper processes to keep ahead of traffic
651# loads. Squid will spawn this many at once whenever load
652# rises above the capabilities of existing processes.
653# Up to the value of children-max. (default 1)
654#
655# concurrency=n concurrency level per process. Only used with helpers
656# capable of processing more than one query at a time.
657#
658# queue-size=N The queue-size= option sets the maximum number of queued
659# requests. If the queued requests exceed queue size
660# the acl is ignored.
661# The default value is set to 2*children-max.
662#
663# protocol=2.5 Compatibility mode for Squid-2.5 external acl helpers.
664#
665# ipv4 / ipv6 IP protocol used to communicate with this helper.
666# The default is to auto-detect IPv6 and use it when available.
667#
668#
669# FORMAT is a series of %macro codes. See logformat directive for a full list
670# of the accepted codes. Although note that at the time of any external ACL
671# being tested data may not be available and thus some %macro expand to '-'.
672#
673# In addition to the logformat codes; when processing external ACLs these
674# additional macros are made available:
675#
676# %ACL The name of the ACL being tested.
677#
678# %DATA The ACL arguments specified in the referencing config
679# 'acl ... external' line, separated by spaces (an
680# "argument string"). see acl external.
681#
682# If there are no ACL arguments %DATA expands to '-'.
683#
684# If you do not specify a DATA macro inside FORMAT,
685# Squid automatically appends %DATA to your FORMAT.
686#
687# By default, Squid applies URL-encoding to each ACL
688# argument inside the argument string. If an explicit
689# encoding modifier is used (e.g., %#DATA), then Squid
690# encodes the whole argument string as a single token
691# (e.g., with %#DATA, spaces between arguments become
692# %20).
693#
694# If SSL is enabled, the following formating codes become available:
695#
696# %USER_CERT SSL User certificate in PEM format
697# %USER_CERTCHAIN SSL User certificate chain in PEM format
698# %USER_CERT_xx SSL User certificate subject attribute xx
699# %USER_CA_CERT_xx SSL User certificate issuer attribute xx
700#
701#
702# NOTE: all other format codes accepted by older Squid versions
703# are deprecated.
704#
705#
706# General request syntax:
707#
708# [channel-ID] FORMAT-values
709#
710#
711# FORMAT-values consists of transaction details expanded with
712# whitespace separation per the config file FORMAT specification
713# using the FORMAT macros listed above.
714#
715# Request values sent to the helper are URL escaped to protect
716# each value in requests against whitespaces.
717#
718# If using protocol=2.5 then the request sent to the helper is not
719# URL escaped to protect against whitespace.
720#
721# NOTE: protocol=3.0 is deprecated as no longer necessary.
722#
723# When using the concurrency= option the protocol is changed by
724# introducing a query channel tag in front of the request/response.
725# The query channel tag is a number between 0 and concurrency-1.
726# This value must be echoed back unchanged to Squid as the first part
727# of the response relating to its request.
728#
729#
730# The helper receives lines expanded per the above format specification
731# and for each input line returns 1 line starting with OK/ERR/BH result
732# code and optionally followed by additional keywords with more details.
733#
734#
735# General result syntax:
736#
737# [channel-ID] result keyword=value ...
738#
739# Result consists of one of the codes:
740#
741# OK
742# the ACL test produced a match.
743#
744# ERR
745# the ACL test does not produce a match.
746#
747# BH
748# An internal error occurred in the helper, preventing
749# a result being identified.
750#
751# The meaning of 'a match' is determined by your squid.conf
752# access control configuration. See the Squid wiki for details.
753#
754# Defined keywords:
755#
756# user= The users name (login)
757#
758# password= The users password (for login= cache_peer option)
759#
760# message= Message describing the reason for this response.
761# Available as %o in error pages.
762# Useful on (ERR and BH results).
763#
764# tag= Apply a tag to a request. Only sets a tag once,
765# does not alter existing tags.
766#
767# log= String to be logged in access.log. Available as
768# %ea in logformat specifications.
769#
770# clt_conn_tag= Associates a TAG with the client TCP connection.
771# Please see url_rewrite_program related documentation
772# for this kv-pair.
773#
774# Any keywords may be sent on any response whether OK, ERR or BH.
775#
776# All response keyword values need to be a single token with URL
777# escaping, or enclosed in double quotes (") and escaped using \ on
778# any double quotes or \ characters within the value. The wrapping
779# double quotes are removed before the value is interpreted by Squid.
780# \r and \n are also replace by CR and LF.
781#
782# Some example key values:
783#
784# user=John%20Smith
785# user="John Smith"
786# user="J. \"Bob\" Smith"
787#Default:
788# none
789
790# TAG: acl
791# Defining an Access List
792#
793# Every access list definition must begin with an aclname and acltype,
794# followed by either type-specific arguments or a quoted filename that
795# they are read from.
796#
797# acl aclname acltype argument ...
798# acl aclname acltype "file" ...
799#
800# When using "file", the file should contain one item per line.
801#
802#
803# ACL Options
804#
805# Some acl types supports options which changes their default behaviour:
806#
807# -i,+i By default, regular expressions are CASE-SENSITIVE. To make them
808# case-insensitive, use the -i option. To return case-sensitive
809# use the +i option between patterns, or make a new ACL line
810# without -i.
811#
812# -n Disable lookups and address type conversions. If lookup or
813# conversion is required because the parameter type (IP or
814# domain name) does not match the message address type (domain
815# name or IP), then the ACL would immediately declare a mismatch
816# without any warnings or lookups.
817#
818# -m[=delimiters]
819# Perform a list membership test, interpreting values as
820# comma-separated token lists and matching against individual
821# tokens instead of whole values.
822# The optional "delimiters" parameter specifies one or more
823# alternative non-alphanumeric delimiter characters.
824# non-alphanumeric delimiter characters.
825#
826# -- Used to stop processing all options, in the case the first acl
827# value has '-' character as first character (for example the '-'
828# is a valid domain name)
829#
830# Some acl types require suspending the current request in order
831# to access some external data source.
832# Those which do are marked with the tag [slow], those which
833# don't are marked as [fast].
834# See http://wiki.squid-cache.org/SquidFaq/SquidAcl
835# for further information
836#
837# ***** ACL TYPES AVAILABLE *****
838#
839# acl aclname src ip-address/mask ... # clients IP address [fast]
840# acl aclname src addr1-addr2/mask ... # range of addresses [fast]
841# acl aclname dst [-n] ip-address/mask ... # URL host's IP address [slow]
842# acl aclname localip ip-address/mask ... # IP address the client connected to [fast]
843#
844#if USE_SQUID_EUI
845# acl aclname arp mac-address ...
846# acl aclname eui64 eui64-address ...
847# # [fast]
848# # MAC (EUI-48) and EUI-64 addresses use xx:xx:xx:xx:xx:xx notation.
849# #
850# # The 'arp' ACL code is not portable to all operating systems.
851# # It works on Linux, Solaris, Windows, FreeBSD, and some other
852# # BSD variants.
853# #
854# # The eui_lookup directive is required to be 'on' (the default)
855# # and Squid built with --enable-eui for MAC/EUI addresses to be
856# # available for this ACL.
857# #
858# # Squid can only determine the MAC/EUI address for IPv4
859# # clients that are on the same subnet. If the client is on a
860# # different subnet, then Squid cannot find out its address.
861# #
862# # IPv6 protocol does not contain ARP. MAC/EUI is either
863# # encoded directly in the IPv6 address or not available.
864#endif
865# acl aclname clientside_mark mark[/mask] ...
866# # matches CONNMARK of an accepted connection [fast]
867# #
868# # mark and mask are unsigned integers (hex, octal, or decimal).
869# # If multiple marks are given, then the ACL matches if at least
870# # one mark matches.
871# #
872# # Uses netfilter-conntrack library.
873# # Requires building Squid with --enable-linux-netfilter.
874# #
875# # The client, various intermediaries, and Squid itself may set
876# # CONNMARK at various times. The last CONNMARK set wins. This ACL
877# # checks the mark present on an accepted connection or set by
878# # Squid afterwards, depending on the ACL check timing. This ACL
879# # effectively ignores any mark set by other agents after Squid has
880# # accepted the connection.
881#
882# acl aclname srcdomain .foo.com ...
883# # reverse lookup, from client IP [slow]
884# acl aclname dstdomain [-n] .foo.com ...
885# # Destination server from URL [fast]
886# acl aclname srcdom_regex [-i] \.foo\.com ...
887# # regex matching client name [slow]
888# acl aclname dstdom_regex [-n] [-i] \.foo\.com ...
889# # regex matching server [fast]
890# #
891# # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
892# # based URL is used and no match is found. The name "none" is used
893# # if the reverse lookup fails.
894#
895# acl aclname src_as number ...
896# acl aclname dst_as number ...
897# # [fast]
898# # Except for access control, AS numbers can be used for
899# # routing of requests to specific caches. Here's an
900# # example for routing all requests for AS#1241 and only
901# # those to mycache.mydomain.net:
902# # acl asexample dst_as 1241
903# # cache_peer_access mycache.mydomain.net allow asexample
904# # cache_peer_access mycache_mydomain.net deny all
905#
906# acl aclname peername myPeer ...
907# acl aclname peername_regex [-i] regex-pattern ...
908# # [fast]
909# # match against a named cache_peer entry
910# # set unique name= on cache_peer lines for reliable use.
911#
912# acl aclname time [day-abbrevs] [h1:m1-h2:m2]
913# # [fast]
914# # day-abbrevs:
915# # S - Sunday
916# # M - Monday
917# # T - Tuesday
918# # W - Wednesday
919# # H - Thursday
920# # F - Friday
921# # A - Saturday
922# # h1:m1 must be less than h2:m2
923#
924# acl aclname url_regex [-i] ^http:// ...
925# # regex matching on whole URL [fast]
926# acl aclname urllogin [-i] [^a-zA-Z0-9] ...
927# # regex matching on URL login field
928# acl aclname urlpath_regex [-i] \.gif$ ...
929# # regex matching on URL path [fast]
930#
931# acl aclname port 80 70 21 0-1024... # destination TCP port [fast]
932# # ranges are alloed
933# acl aclname localport 3128 ... # TCP port the client connected to [fast]
934# # NP: for interception mode this is usually '80'
935#
936# acl aclname myportname 3128 ... # *_port name [fast]
937#
938# acl aclname proto HTTP FTP ... # request protocol [fast]
939#
940# acl aclname method GET POST ... # HTTP request method [fast]
941#
942# acl aclname http_status 200 301 500- 400-403 ...
943# # status code in reply [fast]
944#
945# acl aclname browser [-i] regexp ...
946# # pattern match on User-Agent header (see also req_header below) [fast]
947#
948# acl aclname referer_regex [-i] regexp ...
949# # pattern match on Referer header [fast]
950# # Referer is highly unreliable, so use with care
951#
952# acl aclname ident [-i] username ...
953# acl aclname ident_regex [-i] pattern ...
954# # string match on ident output [slow]
955# # use REQUIRED to accept any non-null ident.
956#
957# acl aclname proxy_auth [-i] username ...
958# acl aclname proxy_auth_regex [-i] pattern ...
959# # perform http authentication challenge to the client and match against
960# # supplied credentials [slow]
961# #
962# # takes a list of allowed usernames.
963# # use REQUIRED to accept any valid username.
964# #
965# # Will use proxy authentication in forward-proxy scenarios, and plain
966# # http authenticaiton in reverse-proxy scenarios
967# #
968# # NOTE: when a Proxy-Authentication header is sent but it is not
969# # needed during ACL checking the username is NOT logged
970# # in access.log.
971# #
972# # NOTE: proxy_auth requires a EXTERNAL authentication program
973# # to check username/password combinations (see
974# # auth_param directive).
975# #
976# # NOTE: proxy_auth can't be used in a transparent/intercepting proxy
977# # as the browser needs to be configured for using a proxy in order
978# # to respond to proxy authentication.
979#
980# acl aclname snmp_community string ...
981# # A community string to limit access to your SNMP Agent [fast]
982# # Example:
983# #
984# # acl snmppublic snmp_community public
985#
986# acl aclname maxconn number
987# # This will be matched when the client's IP address has
988# # more than <number> TCP connections established. [fast]
989# # NOTE: This only measures direct TCP links so X-Forwarded-For
990# # indirect clients are not counted.
991#
992# acl aclname max_user_ip [-s] number
993# # This will be matched when the user attempts to log in from more
994# # than <number> different ip addresses. The authenticate_ip_ttl
995# # parameter controls the timeout on the ip entries. [fast]
996# # If -s is specified the limit is strict, denying browsing
997# # from any further IP addresses until the ttl has expired. Without
998# # -s Squid will just annoy the user by "randomly" denying requests.
999# # (the counter is reset each time the limit is reached and a
1000# # request is denied)
1001# # NOTE: in acceleration mode or where there is mesh of child proxies,
1002# # clients may appear to come from multiple addresses if they are
1003# # going through proxy farms, so a limit of 1 may cause user problems.
1004#
1005# acl aclname random probability
1006# # Pseudo-randomly match requests. Based on the probability given.
1007# # Probability may be written as a decimal (0.333), fraction (1/3)
1008# # or ratio of matches:non-matches (3:5).
1009#
1010# acl aclname req_mime_type [-i] mime-type ...
1011# # regex match against the mime type of the request generated
1012# # by the client. Can be used to detect file upload or some
1013# # types HTTP tunneling requests [fast]
1014# # NOTE: This does NOT match the reply. You cannot use this
1015# # to match the returned file type.
1016#
1017# acl aclname req_header header-name [-i] any\.regex\.here
1018# # regex match against any of the known request headers. May be
1019# # thought of as a superset of "browser", "referer" and "mime-type"
1020# # ACL [fast]
1021#
1022# acl aclname rep_mime_type [-i] mime-type ...
1023# # regex match against the mime type of the reply received by
1024# # squid. Can be used to detect file download or some
1025# # types HTTP tunneling requests. [fast]
1026# # NOTE: This has no effect in http_access rules. It only has
1027# # effect in rules that affect the reply data stream such as
1028# # http_reply_access.
1029#
1030# acl aclname rep_header header-name [-i] any\.regex\.here
1031# # regex match against any of the known reply headers. May be
1032# # thought of as a superset of "browser", "referer" and "mime-type"
1033# # ACLs [fast]
1034#
1035# acl aclname external class_name [arguments...]
1036# # external ACL lookup via a helper class defined by the
1037# # external_acl_type directive [slow]
1038#
1039# acl aclname user_cert attribute values...
1040# # match against attributes in a user SSL certificate
1041# # attribute is one of DN/C/O/CN/L/ST or a numerical OID [fast]
1042#
1043# acl aclname ca_cert attribute values...
1044# # match against attributes a users issuing CA SSL certificate
1045# # attribute is one of DN/C/O/CN/L/ST or a numerical OID [fast]
1046#
1047# acl aclname ext_user [-i] username ...
1048# acl aclname ext_user_regex [-i] pattern ...
1049# # string match on username returned by external acl helper [slow]
1050# # use REQUIRED to accept any non-null user name.
1051#
1052# acl aclname tag tagvalue ...
1053# # string match on tag returned by external acl helper [fast]
1054# # DEPRECATED. Only the first tag will match with this ACL.
1055# # Use the 'note' ACL instead for handling multiple tag values.
1056#
1057# acl aclname hier_code codename ...
1058# # string match against squid hierarchy code(s); [fast]
1059# # e.g., DIRECT, PARENT_HIT, NONE, etc.
1060# #
1061# # NOTE: This has no effect in http_access rules. It only has
1062# # effect in rules that affect the reply data stream such as
1063# # http_reply_access.
1064#
1065# acl aclname note [-m[=delimiters]] name [value ...]
1066# # match transaction annotation [fast]
1067# # Without values, matches any annotation with a given name.
1068# # With value(s), matches any annotation with a given name that
1069# # also has one of the given values.
1070# # If the -m flag is used, then the value of the named
1071# # annotation is interpreted as a list of tokens, and the ACL
1072# # matches individual name=token pairs rather than whole
1073# # name=value pairs. See "ACL Options" above for more info.
1074# # Annotation sources include note and adaptation_meta directives
1075# # as well as helper and eCAP responses.
1076#
1077# acl aclname adaptation_service service ...
1078# # Matches the name of any icap_service, ecap_service,
1079# # adaptation_service_set, or adaptation_service_chain that Squid
1080# # has used (or attempted to use) for the master transaction.
1081# # This ACL must be defined after the corresponding adaptation
1082# # service is named in squid.conf. This ACL is usable with
1083# # adaptation_meta because it starts matching immediately after
1084# # the service has been selected for adaptation.
1085#
1086# acl aclname transaction_initiator initiator ...
1087# # Matches transaction's initiator [fast]
1088# #
1089# # Supported initiators are:
1090# # esi: matches transactions fetching ESI resources
1091# # certificate-fetching: matches transactions fetching
1092# # a missing intermediate TLS certificate
1093# # cache-digest: matches transactions fetching Cache Digests
1094# # from a cache_peer
1095# # htcp: matches HTCP requests from peers
1096# # icp: matches ICP requests to peers
1097# # icmp: matches ICMP RTT database (NetDB) requests to peers
1098# # asn: matches asns db requests
1099# # internal: matches any of the above
1100# # client: matches transactions containing an HTTP or FTP
1101# # client request received at a Squid *_port
1102# # all: matches any transaction, including internal transactions
1103# # without a configurable initiator and hopefully rare
1104# # transactions without a known-to-Squid initiator
1105# #
1106# # Multiple initiators are ORed.
1107#
1108# acl aclname has component
1109# # matches a transaction "component" [fast]
1110# #
1111# # Supported transaction components are:
1112# # request: transaction has a request header (at least)
1113# # response: transaction has a response header (at least)
1114# # ALE: transaction has an internally-generated Access Log Entry
1115# # structure; bugs notwithstanding, all transaction have it
1116# #
1117# # For example, the following configuration helps when dealing with HTTP
1118# # clients that close connections without sending a request header:
1119# #
1120# # acl hasRequest has request
1121# # acl logMe note important_transaction
1122# # # avoid "logMe ACL is used in context without an HTTP request" warnings
1123# # access_log ... logformat=detailed hasRequest logMe
1124# # # log request-less transactions, instead of ignoring them
1125# # access_log ... logformat=brief !hasRequest
1126# #
1127# # Multiple components are not supported for one "acl" rule, but
1128# # can be specified (and are ORed) using multiple same-name rules:
1129# #
1130# # # OK, this strange logging daemon needs request or response,
1131# # # but can work without either a request or a response:
1132# # acl hasWhatMyLoggingDaemonNeeds has request
1133# # acl hasWhatMyLoggingDaemonNeeds has response
1134#
1135# acl aclname ssl_error errorname
1136# # match against SSL certificate validation error [fast]
1137# #
1138# # For valid error names see in /usr/share/squid/errors/templates/error-details.txt
1139# # template file.
1140# #
1141# # The following can be used as shortcuts for certificate properties:
1142# # [ssl::]certHasExpired: the "not after" field is in the past
1143# # [ssl::]certNotYetValid: the "not before" field is in the future
1144# # [ssl::]certUntrusted: The certificate issuer is not to be trusted.
1145# # [ssl::]certSelfSigned: The certificate is self signed.
1146# # [ssl::]certDomainMismatch: The certificate CN domain does not
1147# # match the name the name of the host we are connecting to.
1148# #
1149# # The ssl::certHasExpired, ssl::certNotYetValid, ssl::certDomainMismatch,
1150# # ssl::certUntrusted, and ssl::certSelfSigned can also be used as
1151# # predefined ACLs, just like the 'all' ACL.
1152# #
1153# # NOTE: The ssl_error ACL is only supported with sslproxy_cert_error,
1154# # sslproxy_cert_sign, and sslproxy_cert_adapt options.
1155#
1156# acl aclname server_cert_fingerprint [-sha1] fingerprint
1157# # match against server SSL certificate fingerprint [fast]
1158# #
1159# # The fingerprint is the digest of the DER encoded version
1160# # of the whole certificate. The user should use the form: XX:XX:...
1161# # Optional argument specifies the digest algorithm to use.
1162# # The SHA1 digest algorithm is the default and is currently
1163# # the only algorithm supported (-sha1).
1164#
1165# acl aclname at_step step
1166# # match against the current step during ssl_bump evaluation [fast]
1167# # Never matches and should not be used outside the ssl_bump context.
1168# #
1169# # At each SslBump step, Squid evaluates ssl_bump directives to find
1170# # the next bumping action (e.g., peek or splice). Valid SslBump step
1171# # values and the corresponding ssl_bump evaluation moments are:
1172# # SslBump1: After getting TCP-level and HTTP CONNECT info.
1173# # SslBump2: After getting SSL Client Hello info.
1174# # SslBump3: After getting SSL Server Hello info.
1175#
1176# acl aclname ssl::server_name [option] .foo.com ...
1177# # matches server name obtained from various sources [fast]
1178# #
1179# # The ACL computes server name(s) using such information sources as
1180# # CONNECT request URI, TLS client SNI, and TLS server certificate
1181# # subject (CN and SubjectAltName). The computed server name(s) usually
1182# # change with each SslBump step, as more info becomes available:
1183# # * SNI is used as the server name instead of the request URI,
1184# # * subject name(s) from the server certificate (CN and
1185# # SubjectAltName) are used as the server names instead of SNI.
1186# #
1187# # When the ACL computes multiple server names, matching any single
1188# # computed name is sufficient for the ACL to match.
1189# #
1190# # The "none" name can be used to match transactions where the ACL
1191# # could not compute the server name using any information source
1192# # that was both available and allowed to be used by the ACL options at
1193# # the ACL evaluation time.
1194# #
1195# # Unlike dstdomain, this ACL does not perform DNS lookups.
1196# #
1197# # An ACL option below may be used to restrict what information
1198# # sources are used to extract the server names from:
1199# #
1200# # --client-requested
1201# # The server name is SNI regardless of what the server says.
1202# # --server-provided
1203# # The server name(s) are the certificate subject name(s), regardless
1204# # of what the client has requested. If the server certificate is
1205# # unavailable, then the name is "none".
1206# # --consensus
1207# # The server name is either SNI (if SNI matches at least one of the
1208# # certificate subject names) or "none" (otherwise). When the server
1209# # certificate is unavailable, the consensus server name is SNI.
1210# #
1211# # Combining multiple options in one ACL is a fatal configuration
1212# # error.
1213# #
1214# # For all options: If no SNI is available, then the CONNECT request
1215# # target (a.k.a. URI) is used instead of SNI (for an intercepted
1216# # connection, this target is the destination IP address).
1217#
1218# acl aclname ssl::server_name_regex [-i] \.foo\.com ...
1219# # regex matches server name obtained from various sources [fast]
1220#
1221# acl aclname connections_encrypted
1222# # matches transactions with all HTTP messages received over TLS
1223# # transport connections. [fast]
1224# #
1225# # The master transaction deals with HTTP messages received from
1226# # various sources. All sources used by the master transaction in the
1227# # past are considered by the ACL. The following rules define whether
1228# # a given message source taints the entire master transaction,
1229# # resulting in ACL mismatches:
1230# #
1231# # * The HTTP client transport connection is not TLS.
1232# # * An adaptation service connection-encryption flag is off.
1233# # * The peer or origin server transport connection is not TLS.
1234# #
1235# # Caching currently does not affect these rules. This cache ignorance
1236# # implies that only the current HTTP client transport and REQMOD
1237# # services status determine whether this ACL matches a from-cache
1238# # transaction. The source of the cached response does not have any
1239# # effect on future transaction that use the cached response without
1240# # revalidation. This may change.
1241# #
1242# # DNS, ICP, and HTCP exchanges during the master transaction do not
1243# # affect these rules.
1244# acl aclname any-of acl1 acl2 ...
1245# # match any one of the acls [fast or slow]
1246# # The first matching ACL stops further ACL evaluation.
1247# #
1248# # ACLs from multiple any-of lines with the same name are ORed.
1249# # For example, A = (a1 or a2) or (a3 or a4) can be written as
1250# # acl A any-of a1 a2
1251# # acl A any-of a3 a4
1252# #
1253# # This group ACL is fast if all evaluated ACLs in the group are fast
1254# # and slow otherwise.
1255#
1256# acl aclname all-of acl1 acl2 ...
1257# # match all of the acls [fast or slow]
1258# # The first mismatching ACL stops further ACL evaluation.
1259# #
1260# # ACLs from multiple all-of lines with the same name are ORed.
1261# # For example, B = (b1 and b2) or (b3 and b4) can be written as
1262# # acl B all-of b1 b2
1263# # acl B all-of b3 b4
1264# #
1265# # This group ACL is fast if all evaluated ACLs in the group are fast
1266# # and slow otherwise.
1267#
1268# Examples:
1269# acl macaddress arp 09:00:2b:23:45:67
1270# acl myexample dst_as 1241
1271# acl password proxy_auth REQUIRED
1272# acl fileupload req_mime_type -i ^multipart/form-data$
1273# acl javascript rep_mime_type -i ^application/x-javascript$
1274#
1275#Default:
1276# ACLs all, manager, localhost, and to_localhost are predefined.
1277#
1278#
1279# Recommended minimum configuration:
1280#
1281
1282# Example rule allowing access from your local networks.
1283# Adapt to list your (internal) IP networks from where browsing
1284# should be allowed
1285acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
1286acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
1287acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
1288acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
1289acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)
1290acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
1291acl localnet src fc00::/7 # RFC 4193 local private network range
1292acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
1293
1294acl SSL_ports port 443
1295acl Safe_ports port 80 # http
1296acl Safe_ports port 21 # ftp
1297acl Safe_ports port 443 # https
1298acl Safe_ports port 70 # gopher
1299acl Safe_ports port 210 # wais
1300acl Safe_ports port 1025-65535 # unregistered ports
1301acl Safe_ports port 280 # http-mgmt
1302acl Safe_ports port 488 # gss-http
1303acl Safe_ports port 591 # filemaker
1304acl Safe_ports port 777 # multiling http
1305acl CONNECT method CONNECT
1306
1307# TAG: proxy_protocol_access
1308# Determine which client proxies can be trusted to provide correct
1309# information regarding real client IP address using PROXY protocol.
1310#
1311# Requests may pass through a chain of several other proxies
1312# before reaching us. The original source details may by sent in:
1313# * HTTP message Forwarded header, or
1314# * HTTP message X-Forwarded-For header, or
1315# * PROXY protocol connection header.
1316#
1317# This directive is solely for validating new PROXY protocol
1318# connections received from a port flagged with require-proxy-header.
1319# It is checked only once after TCP connection setup.
1320#
1321# A deny match results in TCP connection closure.
1322#
1323# An allow match is required for Squid to permit the corresponding
1324# TCP connection, before Squid even looks for HTTP request headers.
1325# If there is an allow match, Squid starts using PROXY header information
1326# to determine the source address of the connection for all future ACL
1327# checks, logging, etc.
1328#
1329# SECURITY CONSIDERATIONS:
1330#
1331# Any host from which we accept client IP details can place
1332# incorrect information in the relevant header, and Squid
1333# will use the incorrect information as if it were the
1334# source address of the request. This may enable remote
1335# hosts to bypass any access control restrictions that are
1336# based on the client's source addresses.
1337#
1338# This clause only supports fast acl types.
1339# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1340#Default:
1341# all TCP connections to ports with require-proxy-header will be denied
1342
1343# TAG: follow_x_forwarded_for
1344# Determine which client proxies can be trusted to provide correct
1345# information regarding real client IP address.
1346#
1347# Requests may pass through a chain of several other proxies
1348# before reaching us. The original source details may by sent in:
1349# * HTTP message Forwarded header, or
1350# * HTTP message X-Forwarded-For header, or
1351# * PROXY protocol connection header.
1352#
1353# PROXY protocol connections are controlled by the proxy_protocol_access
1354# directive which is checked before this.
1355#
1356# If a request reaches us from a source that is allowed by this
1357# directive, then we trust the information it provides regarding
1358# the IP of the client it received from (if any).
1359#
1360# For the purpose of ACLs used in this directive the src ACL type always
1361# matches the address we are testing and srcdomain matches its rDNS.
1362#
1363# On each HTTP request Squid checks for X-Forwarded-For header fields.
1364# If found the header values are iterated in reverse order and an allow
1365# match is required for Squid to continue on to the next value.
1366# The verification ends when a value receives a deny match, cannot be
1367# tested, or there are no more values to test.
1368# NOTE: Squid does not yet follow the Forwarded HTTP header.
1369#
1370# The end result of this process is an IP address that we will
1371# refer to as the indirect client address. This address may
1372# be treated as the client address for access control, ICAP, delay
1373# pools and logging, depending on the acl_uses_indirect_client,
1374# icap_uses_indirect_client, delay_pool_uses_indirect_client,
1375# log_uses_indirect_client and tproxy_uses_indirect_client options.
1376#
1377# This clause only supports fast acl types.
1378# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1379#
1380# SECURITY CONSIDERATIONS:
1381#
1382# Any host from which we accept client IP details can place
1383# incorrect information in the relevant header, and Squid
1384# will use the incorrect information as if it were the
1385# source address of the request. This may enable remote
1386# hosts to bypass any access control restrictions that are
1387# based on the client's source addresses.
1388#
1389# For example:
1390#
1391# acl localhost src 127.0.0.1
1392# acl my_other_proxy srcdomain .proxy.example.com
1393# follow_x_forwarded_for allow localhost
1394# follow_x_forwarded_for allow my_other_proxy
1395#Default:
1396# X-Forwarded-For header will be ignored.
1397
1398# TAG: acl_uses_indirect_client on|off
1399# Controls whether the indirect client address
1400# (see follow_x_forwarded_for) is used instead of the
1401# direct client address in acl matching.
1402#
1403# NOTE: maxconn ACL considers direct TCP links and indirect
1404# clients will always have zero. So no match.
1405#Default:
1406# acl_uses_indirect_client on
1407
1408# TAG: delay_pool_uses_indirect_client on|off
1409# Controls whether the indirect client address
1410# (see follow_x_forwarded_for) is used instead of the
1411# direct client address in delay pools.
1412#Default:
1413# delay_pool_uses_indirect_client on
1414
1415# TAG: log_uses_indirect_client on|off
1416# Controls whether the indirect client address
1417# (see follow_x_forwarded_for) is used instead of the
1418# direct client address in the access log.
1419#Default:
1420# log_uses_indirect_client on
1421
1422# TAG: tproxy_uses_indirect_client on|off
1423# Controls whether the indirect client address
1424# (see follow_x_forwarded_for) is used instead of the
1425# direct client address when spoofing the outgoing client.
1426#
1427# This has no effect on requests arriving in non-tproxy
1428# mode ports.
1429#
1430# SECURITY WARNING: Usage of this option is dangerous
1431# and should not be used trivially. Correct configuration
1432# of follow_x_forwarded_for with a limited set of trusted
1433# sources is required to prevent abuse of your proxy.
1434#Default:
1435# tproxy_uses_indirect_client off
1436
1437# TAG: spoof_client_ip
1438# Control client IP address spoofing of TPROXY traffic based on
1439# defined access lists.
1440#
1441# spoof_client_ip allow|deny [!]aclname ...
1442#
1443# If there are no "spoof_client_ip" lines present, the default
1444# is to "allow" spoofing of any suitable request.
1445#
1446# Note that the cache_peer "no-tproxy" option overrides this ACL.
1447#
1448# This clause supports fast acl types.
1449# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1450#Default:
1451# Allow spoofing on all TPROXY traffic.
1452
1453# TAG: http_access
1454# Allowing or Denying access based on defined access lists
1455#
1456# To allow or deny a message received on an HTTP, HTTPS, or FTP port:
1457# http_access allow|deny [!]aclname ...
1458#
1459# NOTE on default values:
1460#
1461# If there are no "access" lines present, the default is to deny
1462# the request.
1463#
1464# If none of the "access" lines cause a match, the default is the
1465# opposite of the last line in the list. If the last line was
1466# deny, the default is allow. Conversely, if the last line
1467# is allow, the default will be deny. For these reasons, it is a
1468# good idea to have an "deny all" entry at the end of your access
1469# lists to avoid potential confusion.
1470#
1471# This clause supports both fast and slow acl types.
1472# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1473#
1474#Default:
1475# Deny, unless rules exist in squid.conf.
1476#
1477
1478#
1479# Recommended minimum Access Permission configuration:
1480#
1481# Deny requests to certain unsafe ports
1482http_access deny !Safe_ports
1483
1484# Deny CONNECT to other than secure SSL ports
1485http_access deny CONNECT !SSL_ports
1486
1487# Only allow cachemgr access from localhost
1488http_access allow localhost manager
1489http_access deny manager
1490
1491# We strongly recommend the following be uncommented to protect innocent
1492# web applications running on the proxy server who think the only
1493# one who can access services on "localhost" is a local user
1494#http_access deny to_localhost
1495
1496#
1497# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
1498#
1499include /etc/squid/conf.d/*
1500
1501# Example rule allowing access from your local networks.
1502# Adapt localnet in the ACL section to list your (internal) IP networks
1503# from where browsing should be allowed
1504#http_access allow localnet
1505http_access allow localhost
1506
1507# And finally deny all other access to this proxy
1508http_access deny all
1509
1510# TAG: adapted_http_access
1511# Allowing or Denying access based on defined access lists
1512#
1513# Essentially identical to http_access, but runs after redirectors
1514# and ICAP/eCAP adaptation. Allowing access control based on their
1515# output.
1516#
1517# If not set then only http_access is used.
1518#Default:
1519# Allow, unless rules exist in squid.conf.
1520
1521# TAG: http_reply_access
1522# Allow replies to client requests. This is complementary to http_access.
1523#
1524# http_reply_access allow|deny [!] aclname ...
1525#
1526# NOTE: if there are no access lines present, the default is to allow
1527# all replies.
1528#
1529# If none of the access lines cause a match the opposite of the
1530# last line will apply. Thus it is good practice to end the rules
1531# with an "allow all" or "deny all" entry.
1532#
1533# This clause supports both fast and slow acl types.
1534# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1535#Default:
1536# Allow, unless rules exist in squid.conf.
1537
1538# TAG: icp_access
1539# Allowing or Denying access to the ICP port based on defined
1540# access lists
1541#
1542# icp_access allow|deny [!]aclname ...
1543#
1544# NOTE: The default if no icp_access lines are present is to
1545# deny all traffic. This default may cause problems with peers
1546# using ICP.
1547#
1548# This clause only supports fast acl types.
1549# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1550#
1551## Allow ICP queries from local networks only
1552##icp_access allow localnet
1553##icp_access deny all
1554#Default:
1555# Deny, unless rules exist in squid.conf.
1556
1557# TAG: htcp_access
1558# Allowing or Denying access to the HTCP port based on defined
1559# access lists
1560#
1561# htcp_access allow|deny [!]aclname ...
1562#
1563# See also htcp_clr_access for details on access control for
1564# cache purge (CLR) HTCP messages.
1565#
1566# NOTE: The default if no htcp_access lines are present is to
1567# deny all traffic. This default may cause problems with peers
1568# using the htcp option.
1569#
1570# This clause only supports fast acl types.
1571# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1572#
1573## Allow HTCP queries from local networks only
1574##htcp_access allow localnet
1575##htcp_access deny all
1576#Default:
1577# Deny, unless rules exist in squid.conf.
1578
1579# TAG: htcp_clr_access
1580# Allowing or Denying access to purge content using HTCP based
1581# on defined access lists.
1582# See htcp_access for details on general HTCP access control.
1583#
1584# htcp_clr_access allow|deny [!]aclname ...
1585#
1586# This clause only supports fast acl types.
1587# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1588#
1589## Allow HTCP CLR requests from trusted peers
1590#acl htcp_clr_peer src 192.0.2.2 2001:DB8::2
1591#htcp_clr_access allow htcp_clr_peer
1592#htcp_clr_access deny all
1593#Default:
1594# Deny, unless rules exist in squid.conf.
1595
1596# TAG: miss_access
1597# Determines whether network access is permitted when satisfying a request.
1598#
1599# For example;
1600# to force your neighbors to use you as a sibling instead of
1601# a parent.
1602#
1603# acl localclients src 192.0.2.0/24 2001:DB8::a:0/64
1604# miss_access deny !localclients
1605# miss_access allow all
1606#
1607# This means only your local clients are allowed to fetch relayed/MISS
1608# replies from the network and all other clients can only fetch cached
1609# objects (HITs).
1610#
1611# The default for this setting allows all clients who passed the
1612# http_access rules to relay via this proxy.
1613#
1614# This clause only supports fast acl types.
1615# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1616#Default:
1617# Allow, unless rules exist in squid.conf.
1618
1619# TAG: ident_lookup_access
1620# A list of ACL elements which, if matched, cause an ident
1621# (RFC 931) lookup to be performed for this request. For
1622# example, you might choose to always perform ident lookups
1623# for your main multi-user Unix boxes, but not for your Macs
1624# and PCs. By default, ident lookups are not performed for
1625# any requests.
1626#
1627# To enable ident lookups for specific client addresses, you
1628# can follow this example:
1629#
1630# acl ident_aware_hosts src 198.168.1.0/24
1631# ident_lookup_access allow ident_aware_hosts
1632# ident_lookup_access deny all
1633#
1634# Only src type ACL checks are fully supported. A srcdomain
1635# ACL might work at times, but it will not always provide
1636# the correct result.
1637#
1638# This clause only supports fast acl types.
1639# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
1640#Default:
1641# Unless rules exist in squid.conf, IDENT is not fetched.
1642
1643# TAG: reply_body_max_size size [acl acl...]
1644# This option specifies the maximum size of a reply body. It can be
1645# used to prevent users from downloading very large files, such as
1646# MP3's and movies. When the reply headers are received, the
1647# reply_body_max_size lines are processed, and the first line where
1648# all (if any) listed ACLs are true is used as the maximum body size
1649# for this reply.
1650#
1651# This size is checked twice. First when we get the reply headers,
1652# we check the content-length value. If the content length value exists
1653# and is larger than the allowed size, the request is denied and the
1654# user receives an error message that says "the request or reply
1655# is too large." If there is no content-length, and the reply
1656# size exceeds this limit, the client's connection is just closed
1657# and they will receive a partial reply.
1658#
1659# WARNING: downstream caches probably can not detect a partial reply
1660# if there is no content-length header, so they will cache
1661# partial responses and give them out as hits. You should NOT
1662# use this option if you have downstream caches.
1663#
1664# WARNING: A maximum size smaller than the size of squid's error messages
1665# will cause an infinite loop and crash squid. Ensure that the smallest
1666# non-zero value you use is greater that the maximum header size plus
1667# the size of your largest error page.
1668#
1669# If you set this parameter none (the default), there will be
1670# no limit imposed.
1671#
1672# Configuration Format is:
1673# reply_body_max_size SIZE UNITS [acl ...]
1674# ie.
1675# reply_body_max_size 10 MB
1676#
1677#Default:
1678# No limit is applied.
1679
1680# TAG: on_unsupported_protocol
1681# Determines Squid behavior when encountering strange requests at the
1682# beginning of an accepted TCP connection or the beginning of a bumped
1683# CONNECT tunnel. Controlling Squid reaction to unexpected traffic is
1684# especially useful in interception environments where Squid is likely
1685# to see connections for unsupported protocols that Squid should either
1686# terminate or tunnel at TCP level.
1687#
1688# on_unsupported_protocol <action> [!]acl ...
1689#
1690# The first matching action wins. Only fast ACLs are supported.
1691#
1692# Supported actions are:
1693#
1694# tunnel: Establish a TCP connection with the intended server and
1695# blindly shovel TCP packets between the client and server.
1696#
1697# respond: Respond with an error message, using the transfer protocol
1698# for the Squid port that received the request (e.g., HTTP
1699# for connections intercepted at the http_port). This is the
1700# default.
1701#
1702# Squid expects the following traffic patterns:
1703#
1704# http_port: a plain HTTP request
1705# https_port: SSL/TLS handshake followed by an [encrypted] HTTP request
1706# ftp_port: a plain FTP command (no on_unsupported_protocol support yet!)
1707# CONNECT tunnel on http_port: same as https_port
1708# CONNECT tunnel on https_port: same as https_port
1709#
1710# Currently, this directive has effect on intercepted connections and
1711# bumped tunnels only. Other cases are not supported because Squid
1712# cannot know the intended destination of other traffic.
1713#
1714# For example:
1715# # define what Squid errors indicate receiving non-HTTP traffic:
1716# acl foreignProtocol squid_error ERR_PROTOCOL_UNKNOWN ERR_TOO_BIG
1717# # define what Squid errors indicate receiving nothing:
1718# acl serverTalksFirstProtocol squid_error ERR_REQUEST_START_TIMEOUT
1719# # tunnel everything that does not look like HTTP:
1720# on_unsupported_protocol tunnel foreignProtocol
1721# # tunnel if we think the client waits for the server to talk first:
1722# on_unsupported_protocol tunnel serverTalksFirstProtocol
1723# # in all other error cases, just send an HTTP "error page" response:
1724# on_unsupported_protocol respond all
1725#
1726# See also: squid_error ACL
1727#Default:
1728# Respond with an error message to unidentifiable traffic
1729
1730# NETWORK OPTIONS
1731# -----------------------------------------------------------------------------
1732
1733# TAG: http_port
1734# Usage: port [mode] [options]
1735# hostname:port [mode] [options]
1736# 1.2.3.4:port [mode] [options]
1737#
1738# The socket addresses where Squid will listen for HTTP client
1739# requests. You may specify multiple socket addresses.
1740# There are three forms: port alone, hostname with port, and
1741# IP address with port. If you specify a hostname or IP
1742# address, Squid binds the socket to that specific
1743# address. Most likely, you do not need to bind to a specific
1744# address, so you can use the port number alone.
1745#
1746# If you are running Squid in accelerator mode, you
1747# probably want to listen on port 80 also, or instead.
1748#
1749# The -a command line option may be used to specify additional
1750# port(s) where Squid listens for proxy request. Such ports will
1751# be plain proxy ports with no options.
1752#
1753# You may specify multiple socket addresses on multiple lines.
1754#
1755# Modes:
1756#
1757# intercept Support for IP-Layer NAT interception delivering
1758# traffic to this Squid port.
1759# NP: disables authentication on the port.
1760#
1761# tproxy Support Linux TPROXY (or BSD divert-to) with spoofing
1762# of outgoing connections using the client IP address.
1763# NP: disables authentication on the port.
1764#
1765# accel Accelerator / reverse proxy mode
1766#
1767# ssl-bump For each CONNECT request allowed by ssl_bump ACLs,
1768# establish secure connection with the client and with
1769# the server, decrypt HTTPS messages as they pass through
1770# Squid, and treat them as unencrypted HTTP messages,
1771# becoming the man-in-the-middle.
1772#
1773# The ssl_bump option is required to fully enable
1774# bumping of CONNECT requests.
1775#
1776# Omitting the mode flag causes default forward proxy mode to be used.
1777#
1778#
1779# Accelerator Mode Options:
1780#
1781# defaultsite=domainname
1782# What to use for the Host: header if it is not present
1783# in a request. Determines what site (not origin server)
1784# accelerators should consider the default.
1785#
1786# no-vhost Disable using HTTP/1.1 Host header for virtual domain support.
1787#
1788# protocol= Protocol to reconstruct accelerated and intercepted
1789# requests with. Defaults to HTTP/1.1 for http_port and
1790# HTTPS/1.1 for https_port.
1791# When an unsupported value is configured Squid will
1792# produce a FATAL error.
1793# Values: HTTP or HTTP/1.1, HTTPS or HTTPS/1.1
1794#
1795# vport Virtual host port support. Using the http_port number
1796# instead of the port passed on Host: headers.
1797#
1798# vport=NN Virtual host port support. Using the specified port
1799# number instead of the port passed on Host: headers.
1800#
1801# act-as-origin
1802# Act as if this Squid is the origin server.
1803# This currently means generate new Date: and Expires:
1804# headers on HIT instead of adding Age:.
1805#
1806# ignore-cc Ignore request Cache-Control headers.
1807#
1808# WARNING: This option violates HTTP specifications if
1809# used in non-accelerator setups.
1810#
1811# allow-direct Allow direct forwarding in accelerator mode. Normally
1812# accelerated requests are denied direct forwarding as if
1813# never_direct was used.
1814#
1815# WARNING: this option opens accelerator mode to security
1816# vulnerabilities usually only affecting in interception
1817# mode. Make sure to protect forwarding with suitable
1818# http_access rules when using this.
1819#
1820#
1821# SSL Bump Mode Options:
1822# In addition to these options ssl-bump requires TLS/SSL options.
1823#
1824# generate-host-certificates[=<on|off>]
1825# Dynamically create SSL server certificates for the
1826# destination hosts of bumped CONNECT requests.When
1827# enabled, the cert and key options are used to sign
1828# generated certificates. Otherwise generated
1829# certificate will be selfsigned.
1830# If there is a CA certificate lifetime of the generated
1831# certificate equals lifetime of the CA certificate. If
1832# generated certificate is selfsigned lifetime is three
1833# years.
1834# This option is enabled by default when ssl-bump is used.
1835# See the ssl-bump option above for more information.
1836#
1837# dynamic_cert_mem_cache_size=SIZE
1838# Approximate total RAM size spent on cached generated
1839# certificates. If set to zero, caching is disabled. The
1840# default value is 4MB.
1841#
1842# TLS / SSL Options:
1843#
1844# tls-cert= Path to file containing an X.509 certificate (PEM format)
1845# to be used in the TLS handshake ServerHello.
1846#
1847# If this certificate is constrained by KeyUsage TLS
1848# feature it must allow HTTP server usage, along with
1849# any additional restrictions imposed by your choice
1850# of options= settings.
1851#
1852# When OpenSSL is used this file may also contain a
1853# chain of intermediate CA certificates to send in the
1854# TLS handshake.
1855#
1856# When GnuTLS is used this option (and any paired
1857# tls-key= option) may be repeated to load multiple
1858# certificates for different domains.
1859#
1860# Also, when generate-host-certificates=on is configured
1861# the first tls-cert= option must be a CA certificate
1862# capable of signing the automatically generated
1863# certificates.
1864#
1865# tls-key= Path to a file containing private key file (PEM format)
1866# for the previous tls-cert= option.
1867#
1868# If tls-key= is not specified tls-cert= is assumed to
1869# reference a PEM file containing both the certificate
1870# and private key.
1871#
1872# cipher= Colon separated list of supported ciphers.
1873# NOTE: some ciphers such as EDH ciphers depend on
1874# additional settings. If those settings are
1875# omitted the ciphers may be silently ignored
1876# by the OpenSSL library.
1877#
1878# options= Various SSL implementation options. The most important
1879# being:
1880#
1881# NO_SSLv3 Disallow the use of SSLv3
1882#
1883# NO_TLSv1 Disallow the use of TLSv1.0
1884#
1885# NO_TLSv1_1 Disallow the use of TLSv1.1
1886#
1887# NO_TLSv1_2 Disallow the use of TLSv1.2
1888#
1889# SINGLE_DH_USE
1890# Always create a new key when using
1891# temporary/ephemeral DH key exchanges
1892#
1893# SINGLE_ECDH_USE
1894# Enable ephemeral ECDH key exchange.
1895# The adopted curve should be specified
1896# using the tls-dh option.
1897#
1898# NO_TICKET
1899# Disable use of RFC5077 session tickets.
1900# Some servers may have problems
1901# understanding the TLS extension due
1902# to ambiguous specification in RFC4507.
1903#
1904# ALL Enable various bug workarounds
1905# suggested as "harmless" by OpenSSL
1906# Be warned that this reduces SSL/TLS
1907# strength to some attacks.
1908#
1909# See the OpenSSL SSL_CTX_set_options documentation for a
1910# more complete list.
1911#
1912# clientca= File containing the list of CAs to use when
1913# requesting a client certificate.
1914#
1915# tls-cafile= PEM file containing CA certificates to use when verifying
1916# client certificates. If not configured clientca will be
1917# used. May be repeated to load multiple files.
1918#
1919# capath= Directory containing additional CA certificates
1920# and CRL lists to use when verifying client certificates.
1921# Requires OpenSSL or LibreSSL.
1922#
1923# crlfile= File of additional CRL lists to use when verifying
1924# the client certificate, in addition to CRLs stored in
1925# the capath. Implies VERIFY_CRL flag below.
1926#
1927# tls-dh=[curve:]file
1928# File containing DH parameters for temporary/ephemeral DH key
1929# exchanges, optionally prefixed by a curve for ephemeral ECDH
1930# key exchanges.
1931# See OpenSSL documentation for details on how to create the
1932# DH parameter file. Supported curves for ECDH can be listed
1933# using the "openssl ecparam -list_curves" command.
1934# WARNING: EDH and EECDH ciphers will be silently disabled if
1935# this option is not set.
1936#
1937# sslflags= Various flags modifying the use of SSL:
1938# DELAYED_AUTH
1939# Don't request client certificates
1940# immediately, but wait until acl processing
1941# requires a certificate (not yet implemented).
1942# NO_SESSION_REUSE
1943# Don't allow for session reuse. Each connection
1944# will result in a new SSL session.
1945# VERIFY_CRL
1946# Verify CRL lists when accepting client
1947# certificates.
1948# VERIFY_CRL_ALL
1949# Verify CRL lists for all certificates in the
1950# client certificate chain.
1951#
1952# tls-default-ca[=off]
1953# Whether to use the system Trusted CAs. Default is OFF.
1954#
1955# tls-no-npn Do not use the TLS NPN extension to advertise HTTP/1.1.
1956#
1957# sslcontext= SSL session ID context identifier.
1958#
1959# Other Options:
1960#
1961# connection-auth[=on|off]
1962# use connection-auth=off to tell Squid to prevent
1963# forwarding Microsoft connection oriented authentication
1964# (NTLM, Negotiate and Kerberos)
1965#
1966# disable-pmtu-discovery=
1967# Control Path-MTU discovery usage:
1968# off lets OS decide on what to do (default).
1969# transparent disable PMTU discovery when transparent
1970# support is enabled.
1971# always disable always PMTU discovery.
1972#
1973# In many setups of transparently intercepting proxies
1974# Path-MTU discovery can not work on traffic towards the
1975# clients. This is the case when the intercepting device
1976# does not fully track connections and fails to forward
1977# ICMP must fragment messages to the cache server. If you
1978# have such setup and experience that certain clients
1979# sporadically hang or never complete requests set
1980# disable-pmtu-discovery option to 'transparent'.
1981#
1982# name= Specifies a internal name for the port. Defaults to
1983# the port specification (port or addr:port)
1984#
1985# tcpkeepalive[=idle,interval,timeout]
1986# Enable TCP keepalive probes of idle connections.
1987# In seconds; idle is the initial time before TCP starts
1988# probing the connection, interval how often to probe, and
1989# timeout the time before giving up.
1990#
1991# require-proxy-header
1992# Require PROXY protocol version 1 or 2 connections.
1993# The proxy_protocol_access is required to whitelist
1994# downstream proxies which can be trusted.
1995#
1996# If you run Squid on a dual-homed machine with an internal
1997# and an external interface we recommend you to specify the
1998# internal address:port in http_port. This way Squid will only be
1999# visible on the internal address.
2000#
2001#
2002
2003# Squid normally listens to port 3128
2004http_port 3128
2005
2006# TAG: https_port
2007# Usage: [ip:]port [mode] tls-cert=certificate.pem [options]
2008#
2009# The socket address where Squid will listen for client requests made
2010# over TLS or SSL connections. Commonly referred to as HTTPS.
2011#
2012# This is most useful for situations where you are running squid in
2013# accelerator mode and you want to do the TLS work at the accelerator
2014# level.
2015#
2016# You may specify multiple socket addresses on multiple lines,
2017# each with their own certificate and/or options.
2018#
2019# The tls-cert= option is mandatory on HTTPS ports.
2020#
2021# See http_port for a list of modes and options.
2022#Default:
2023# none
2024
2025# TAG: ftp_port
2026# Enables Native FTP proxy by specifying the socket address where Squid
2027# listens for FTP client requests. See http_port directive for various
2028# ways to specify the listening address and mode.
2029#
2030# Usage: ftp_port address [mode] [options]
2031#
2032# WARNING: This is a new, experimental, complex feature that has seen
2033# limited production exposure. Some Squid modules (e.g., caching) do not
2034# currently work with native FTP proxying, and many features have not
2035# even been tested for compatibility. Test well before deploying!
2036#
2037# Native FTP proxying differs substantially from proxying HTTP requests
2038# with ftp:// URIs because Squid works as an FTP server and receives
2039# actual FTP commands (rather than HTTP requests with FTP URLs).
2040#
2041# Native FTP commands accepted at ftp_port are internally converted or
2042# wrapped into HTTP-like messages. The same happens to Native FTP
2043# responses received from FTP origin servers. Those HTTP-like messages
2044# are shoveled through regular access control and adaptation layers
2045# between the FTP client and the FTP origin server. This allows Squid to
2046# examine, adapt, block, and log FTP exchanges. Squid reuses most HTTP
2047# mechanisms when shoveling wrapped FTP messages. For example,
2048# http_access and adaptation_access directives are used.
2049#
2050# Modes:
2051#
2052# intercept Same as http_port intercept. The FTP origin address is
2053# determined based on the intended destination of the
2054# intercepted connection.
2055#
2056# tproxy Support Linux TPROXY for spoofing outgoing
2057# connections using the client IP address.
2058# NP: disables authentication and maybe IPv6 on the port.
2059#
2060# By default (i.e., without an explicit mode option), Squid extracts the
2061# FTP origin address from the login@origin parameter of the FTP USER
2062# command. Many popular FTP clients support such native FTP proxying.
2063#
2064# Options:
2065#
2066# name=token Specifies an internal name for the port. Defaults to
2067# the port address. Usable with myportname ACL.
2068#
2069# ftp-track-dirs
2070# Enables tracking of FTP directories by injecting extra
2071# PWD commands and adjusting Request-URI (in wrapping
2072# HTTP requests) to reflect the current FTP server
2073# directory. Tracking is disabled by default.
2074#
2075# protocol=FTP Protocol to reconstruct accelerated and intercepted
2076# requests with. Defaults to FTP. No other accepted
2077# values have been tested with. An unsupported value
2078# results in a FATAL error. Accepted values are FTP,
2079# HTTP (or HTTP/1.1), and HTTPS (or HTTPS/1.1).
2080#
2081# Other http_port modes and options that are not specific to HTTP and
2082# HTTPS may also work.
2083#Default:
2084# none
2085
2086# TAG: tcp_outgoing_tos
2087# Allows you to select a TOS/Diffserv value for packets outgoing
2088# on the server side, based on an ACL.
2089#
2090# tcp_outgoing_tos ds-field [!]aclname ...
2091#
2092# Example where normal_service_net uses the TOS value 0x00
2093# and good_service_net uses 0x20
2094#
2095# acl normal_service_net src 10.0.0.0/24
2096# acl good_service_net src 10.0.1.0/24
2097# tcp_outgoing_tos 0x00 normal_service_net
2098# tcp_outgoing_tos 0x20 good_service_net
2099#
2100# TOS/DSCP values really only have local significance - so you should
2101# know what you're specifying. For more information, see RFC2474,
2102# RFC2475, and RFC3260.
2103#
2104# The TOS/DSCP byte must be exactly that - a octet value 0 - 255, or
2105# "default" to use whatever default your host has.
2106# Note that only multiples of 4 are usable as the two rightmost bits have
2107# been redefined for use by ECN (RFC 3168 section 23.1).
2108# The squid parser will enforce this by masking away the ECN bits.
2109#
2110# Processing proceeds in the order specified, and stops at first fully
2111# matching line.
2112#
2113# Only fast ACLs are supported.
2114#Default:
2115# none
2116
2117# TAG: clientside_tos
2118# Allows you to select a TOS/DSCP value for packets being transmitted
2119# on the client-side, based on an ACL.
2120#
2121# clientside_tos ds-field [!]aclname ...
2122#
2123# Example where normal_service_net uses the TOS value 0x00
2124# and good_service_net uses 0x20
2125#
2126# acl normal_service_net src 10.0.0.0/24
2127# acl good_service_net src 10.0.1.0/24
2128# clientside_tos 0x00 normal_service_net
2129# clientside_tos 0x20 good_service_net
2130#
2131# Note: This feature is incompatible with qos_flows. Any TOS values set here
2132# will be overwritten by TOS values in qos_flows.
2133#
2134# The TOS/DSCP byte must be exactly that - a octet value 0 - 255, or
2135# "default" to use whatever default your host has.
2136# Note that only multiples of 4 are usable as the two rightmost bits have
2137# been redefined for use by ECN (RFC 3168 section 23.1).
2138# The squid parser will enforce this by masking away the ECN bits.
2139#
2140# This clause only supports fast acl types.
2141# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
2142#Default:
2143# none
2144
2145# TAG: tcp_outgoing_mark
2146# Note: This option is only available if Squid is rebuilt with the
2147# Packet MARK (Linux)
2148#
2149# Allows you to apply a Netfilter mark value to outgoing packets
2150# on the server side, based on an ACL.
2151#
2152# tcp_outgoing_mark mark-value [!]aclname ...
2153#
2154# Example where normal_service_net uses the mark value 0x00
2155# and good_service_net uses 0x20
2156#
2157# acl normal_service_net src 10.0.0.0/24
2158# acl good_service_net src 10.0.1.0/24
2159# tcp_outgoing_mark 0x00 normal_service_net
2160# tcp_outgoing_mark 0x20 good_service_net
2161#
2162# Only fast ACLs are supported.
2163#Default:
2164# none
2165
2166# TAG: clientside_mark
2167# Note: This option is only available if Squid is rebuilt with the
2168# Packet MARK (Linux)
2169#
2170# Allows you to apply a Netfilter mark value to packets being transmitted
2171# on the client-side, based on an ACL.
2172#
2173# clientside_mark mark-value [!]aclname ...
2174#
2175# Example where normal_service_net uses the mark value 0x00
2176# and good_service_net uses 0x20
2177#
2178# acl normal_service_net src 10.0.0.0/24
2179# acl good_service_net src 10.0.1.0/24
2180# clientside_mark 0x00 normal_service_net
2181# clientside_mark 0x20 good_service_net
2182#
2183# Note: This feature is incompatible with qos_flows. Any mark values set here
2184# will be overwritten by mark values in qos_flows.
2185#
2186# This clause only supports fast acl types.
2187# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
2188#Default:
2189# none
2190
2191# TAG: qos_flows
2192# Allows you to select a TOS/DSCP value to mark outgoing
2193# connections to the client, based on where the reply was sourced.
2194# For platforms using netfilter, allows you to set a netfilter mark
2195# value instead of, or in addition to, a TOS value.
2196#
2197# By default this functionality is disabled. To enable it with the default
2198# settings simply use "qos_flows mark" or "qos_flows tos". Default
2199# settings will result in the netfilter mark or TOS value being copied
2200# from the upstream connection to the client. Note that it is the connection
2201# CONNMARK value not the packet MARK value that is copied.
2202#
2203# It is not currently possible to copy the mark or TOS value from the
2204# client to the upstream connection request.
2205#
2206# TOS values really only have local significance - so you should
2207# know what you're specifying. For more information, see RFC2474,
2208# RFC2475, and RFC3260.
2209#
2210# The TOS/DSCP byte must be exactly that - a octet value 0 - 255.
2211# Note that only multiples of 4 are usable as the two rightmost bits have
2212# been redefined for use by ECN (RFC 3168 section 23.1).
2213# The squid parser will enforce this by masking away the ECN bits.
2214#
2215# Mark values can be any unsigned 32-bit integer value.
2216#
2217# This setting is configured by setting the following values:
2218#
2219# tos|mark Whether to set TOS or netfilter mark values
2220#
2221# local-hit=0xFF Value to mark local cache hits.
2222#
2223# sibling-hit=0xFF Value to mark hits from sibling peers.
2224#
2225# parent-hit=0xFF Value to mark hits from parent peers.
2226#
2227# miss=0xFF[/mask] Value to mark cache misses. Takes precedence
2228# over the preserve-miss feature (see below), unless
2229# mask is specified, in which case only the bits
2230# specified in the mask are written.
2231#
2232# The TOS variant of the following features are only possible on Linux
2233# and require your kernel to be patched with the TOS preserving ZPH
2234# patch, available from http://zph.bratcheda.org
2235# No patch is needed to preserve the netfilter mark, which will work
2236# with all variants of netfilter.
2237#
2238# disable-preserve-miss
2239# This option disables the preservation of the TOS or netfilter
2240# mark. By default, the existing TOS or netfilter mark value of
2241# the response coming from the remote server will be retained
2242# and masked with miss-mark.
2243# NOTE: in the case of a netfilter mark, the mark must be set on
2244# the connection (using the CONNMARK target) not on the packet
2245# (MARK target).
2246#
2247# miss-mask=0xFF
2248# Allows you to mask certain bits in the TOS or mark value
2249# received from the remote server, before copying the value to
2250# the TOS sent towards clients.
2251# Default for tos: 0xFF (TOS from server is not changed).
2252# Default for mark: 0xFFFFFFFF (mark from server is not changed).
2253#
2254# All of these features require the --enable-zph-qos compilation flag
2255# (enabled by default). Netfilter marking also requires the
2256# libnetfilter_conntrack libraries (--with-netfilter-conntrack) and
2257# libcap 2.09+ (--with-libcap).
2258#
2259#Default:
2260# none
2261
2262# TAG: tcp_outgoing_address
2263# Allows you to map requests to different outgoing IP addresses
2264# based on the username or source address of the user making
2265# the request.
2266#
2267# tcp_outgoing_address ipaddr [[!]aclname] ...
2268#
2269# For example;
2270# Forwarding clients with dedicated IPs for certain subnets.
2271#
2272# acl normal_service_net src 10.0.0.0/24
2273# acl good_service_net src 10.0.2.0/24
2274#
2275# tcp_outgoing_address 2001:db8::c001 good_service_net
2276# tcp_outgoing_address 10.1.0.2 good_service_net
2277#
2278# tcp_outgoing_address 2001:db8::beef normal_service_net
2279# tcp_outgoing_address 10.1.0.1 normal_service_net
2280#
2281# tcp_outgoing_address 2001:db8::1
2282# tcp_outgoing_address 10.1.0.3
2283#
2284# Processing proceeds in the order specified, and stops at first fully
2285# matching line.
2286#
2287# Squid will add an implicit IP version test to each line.
2288# Requests going to IPv4 websites will use the outgoing 10.1.0.* addresses.
2289# Requests going to IPv6 websites will use the outgoing 2001:db8:* addresses.
2290#
2291#
2292# NOTE: The use of this directive using client dependent ACLs is
2293# incompatible with the use of server side persistent connections. To
2294# ensure correct results it is best to set server_persistent_connections
2295# to off when using this directive in such configurations.
2296#
2297# NOTE: The use of this directive to set a local IP on outgoing TCP links
2298# is incompatible with using TPROXY to set client IP out outbound TCP links.
2299# When needing to contact peers use the no-tproxy cache_peer option and the
2300# client_dst_passthru directive re-enable normal forwarding such as this.
2301#
2302# This clause only supports fast acl types.
2303# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
2304#Default:
2305# Address selection is performed by the operating system.
2306
2307# TAG: host_verify_strict
2308# Regardless of this option setting, when dealing with intercepted
2309# traffic, Squid always verifies that the destination IP address matches
2310# the Host header domain or IP (called 'authority form URL').
2311#
2312# This enforcement is performed to satisfy a MUST-level requirement in
2313# RFC 2616 section 14.23: "The Host field value MUST represent the naming
2314# authority of the origin server or gateway given by the original URL".
2315#
2316# When set to ON:
2317# Squid always responds with an HTTP 409 (Conflict) error
2318# page and logs a security warning if there is no match.
2319#
2320# Squid verifies that the destination IP address matches
2321# the Host header for forward-proxy and reverse-proxy traffic
2322# as well. For those traffic types, Squid also enables the
2323# following checks, comparing the corresponding Host header
2324# and Request-URI components:
2325#
2326# * The host names (domain or IP) must be identical,
2327# but valueless or missing Host header disables all checks.
2328# For the two host names to match, both must be either IP
2329# or FQDN.
2330#
2331# * Port numbers must be identical, but if a port is missing
2332# the scheme-default port is assumed.
2333#
2334#
2335# When set to OFF (the default):
2336# Squid allows suspicious requests to continue but logs a
2337# security warning and blocks caching of the response.
2338#
2339# * Forward-proxy traffic is not checked at all.
2340#
2341# * Reverse-proxy traffic is not checked at all.
2342#
2343# * Intercepted traffic which passes verification is handled
2344# according to client_dst_passthru.
2345#
2346# * Intercepted requests which fail verification are sent
2347# to the client original destination instead of DIRECT.
2348# This overrides 'client_dst_passthru off'.
2349#
2350# For now suspicious intercepted CONNECT requests are always
2351# responded to with an HTTP 409 (Conflict) error page.
2352#
2353#
2354# SECURITY NOTE:
2355#
2356# As described in CVE-2009-0801 when the Host: header alone is used
2357# to determine the destination of a request it becomes trivial for
2358# malicious scripts on remote websites to bypass browser same-origin
2359# security policy and sandboxing protections.
2360#
2361# The cause of this is that such applets are allowed to perform their
2362# own HTTP stack, in which case the same-origin policy of the browser
2363# sandbox only verifies that the applet tries to contact the same IP
2364# as from where it was loaded at the IP level. The Host: header may
2365# be different from the connected IP and approved origin.
2366#
2367#Default:
2368# host_verify_strict off
2369
2370# TAG: client_dst_passthru
2371# With NAT or TPROXY intercepted traffic Squid may pass the request
2372# directly to the original client destination IP or seek a faster
2373# source using the HTTP Host header.
2374#
2375# Using Host to locate alternative servers can provide faster
2376# connectivity with a range of failure recovery options.
2377# But can also lead to connectivity trouble when the client and
2378# server are attempting stateful interactions unaware of the proxy.
2379#
2380# This option (on by default) prevents alternative DNS entries being
2381# located to send intercepted traffic DIRECT to an origin server.
2382# The clients original destination IP and port will be used instead.
2383#
2384# Regardless of this option setting, when dealing with intercepted
2385# traffic Squid will verify the Host: header and any traffic which
2386# fails Host verification will be treated as if this option were ON.
2387#
2388# see host_verify_strict for details on the verification process.
2389#Default:
2390# client_dst_passthru on
2391
2392# TLS OPTIONS
2393# -----------------------------------------------------------------------------
2394
2395# TAG: tls_outgoing_options
2396# disable Do not support https:// URLs.
2397#
2398# cert=/path/to/client/certificate
2399# A client X.509 certificate to use when connecting.
2400#
2401# key=/path/to/client/private_key
2402# The private key corresponding to the cert= above.
2403#
2404# If key= is not specified cert= is assumed to
2405# reference a PEM file containing both the certificate
2406# and private key.
2407#
2408# cipher=... The list of valid TLS ciphers to use.
2409#
2410# min-version=1.N
2411# The minimum TLS protocol version to permit.
2412# To control SSLv3 use the options= parameter.
2413# Supported Values: 1.0 (default), 1.1, 1.2
2414#
2415# options=... Specify various TLS/SSL implementation options.
2416#
2417# OpenSSL options most important are:
2418#
2419# NO_SSLv3 Disallow the use of SSLv3
2420#
2421# SINGLE_DH_USE
2422# Always create a new key when using
2423# temporary/ephemeral DH key exchanges
2424#
2425# NO_TICKET
2426# Disable use of RFC5077 session tickets.
2427# Some servers may have problems
2428# understanding the TLS extension due
2429# to ambiguous specification in RFC4507.
2430#
2431# ALL Enable various bug workarounds
2432# suggested as "harmless" by OpenSSL
2433# Be warned that this reduces SSL/TLS
2434# strength to some attacks.
2435#
2436# See the OpenSSL SSL_CTX_set_options documentation
2437# for a more complete list.
2438#
2439# GnuTLS options most important are:
2440#
2441# %NO_TICKETS
2442# Disable use of RFC5077 session tickets.
2443# Some servers may have problems
2444# understanding the TLS extension due
2445# to ambiguous specification in RFC4507.
2446#
2447# See the GnuTLS Priority Strings documentation
2448# for a more complete list.
2449# http://www.gnutls.org/manual/gnutls.html#Priority-Strings
2450#
2451#
2452# cafile= PEM file containing CA certificates to use when verifying
2453# the peer certificate. May be repeated to load multiple files.
2454#
2455# capath= A directory containing additional CA certificates to
2456# use when verifying the peer certificate.
2457# Requires OpenSSL or LibreSSL.
2458#
2459# crlfile=... A certificate revocation list file to use when
2460# verifying the peer certificate.
2461#
2462# flags=... Specify various flags modifying the TLS implementation:
2463#
2464# DONT_VERIFY_PEER
2465# Accept certificates even if they fail to
2466# verify.
2467# DONT_VERIFY_DOMAIN
2468# Don't verify the peer certificate
2469# matches the server name
2470#
2471# default-ca[=off]
2472# Whether to use the system Trusted CAs. Default is ON.
2473#
2474# domain= The peer name as advertised in its certificate.
2475# Used for verifying the correctness of the received peer
2476# certificate. If not specified the peer hostname will be
2477# used.
2478#Default:
2479# tls_outgoing_options min-version=1.0
2480
2481# SSL OPTIONS
2482# -----------------------------------------------------------------------------
2483
2484# TAG: ssl_unclean_shutdown
2485# Some browsers (especially MSIE) bugs out on SSL shutdown
2486# messages.
2487#Default:
2488# ssl_unclean_shutdown off
2489
2490# TAG: ssl_engine
2491# The OpenSSL engine to use. You will need to set this if you
2492# would like to use hardware SSL acceleration for example.
2493#Default:
2494# none
2495
2496# TAG: sslproxy_session_ttl
2497# Sets the timeout value for SSL sessions
2498#Default:
2499# sslproxy_session_ttl 300
2500
2501# TAG: sslproxy_session_cache_size
2502# Sets the cache size to use for ssl session
2503#Default:
2504# sslproxy_session_cache_size 2 MB
2505
2506# TAG: sslproxy_foreign_intermediate_certs
2507# Many origin servers fail to send their full server certificate
2508# chain for verification, assuming the client already has or can
2509# easily locate any missing intermediate certificates.
2510#
2511# Squid uses the certificates from the specified file to fill in
2512# these missing chains when trying to validate origin server
2513# certificate chains.
2514#
2515# The file is expected to contain zero or more PEM-encoded
2516# intermediate certificates. These certificates are not treated
2517# as trusted root certificates, and any self-signed certificate in
2518# this file will be ignored.
2519#Default:
2520# none
2521
2522# TAG: sslproxy_cert_sign_hash
2523# Sets the hashing algorithm to use when signing generated certificates.
2524# Valid algorithm names depend on the OpenSSL library used. The following
2525# names are usually available: sha1, sha256, sha512, and md5. Please see
2526# your OpenSSL library manual for the available hashes. By default, Squids
2527# that support this option use sha256 hashes.
2528#
2529# Squid does not forcefully purge cached certificates that were generated
2530# with an algorithm other than the currently configured one. They remain
2531# in the cache, subject to the regular cache eviction policy, and become
2532# useful if the algorithm changes again.
2533#Default:
2534# none
2535
2536# TAG: ssl_bump
2537# This option is consulted when a CONNECT request is received on
2538# an http_port (or a new connection is intercepted at an
2539# https_port), provided that port was configured with an ssl-bump
2540# flag. The subsequent data on the connection is either treated as
2541# HTTPS and decrypted OR tunneled at TCP level without decryption,
2542# depending on the first matching bumping "action".
2543#
2544# ssl_bump <action> [!]acl ...
2545#
2546# The following bumping actions are currently supported:
2547#
2548# splice
2549# Become a TCP tunnel without decrypting proxied traffic.
2550# This is the default action.
2551#
2552# bump
2553# When used on step SslBump1, establishes a secure connection
2554# with the client first, then connect to the server.
2555# When used on step SslBump2 or SslBump3, establishes a secure
2556# connection with the server and, using a mimicked server
2557# certificate, with the client.
2558#
2559# peek
2560# Receive client (step SslBump1) or server (step SslBump2)
2561# certificate while preserving the possibility of splicing the
2562# connection. Peeking at the server certificate (during step 2)
2563# usually precludes bumping of the connection at step 3.
2564#
2565# stare
2566# Receive client (step SslBump1) or server (step SslBump2)
2567# certificate while preserving the possibility of bumping the
2568# connection. Staring at the server certificate (during step 2)
2569# usually precludes splicing of the connection at step 3.
2570#
2571# terminate
2572# Close client and server connections.
2573#
2574# Backward compatibility actions available at step SslBump1:
2575#
2576# client-first
2577# Bump the connection. Establish a secure connection with the
2578# client first, then connect to the server. This old mode does
2579# not allow Squid to mimic server SSL certificate and does not
2580# work with intercepted SSL connections.
2581#
2582# server-first
2583# Bump the connection. Establish a secure connection with the
2584# server first, then establish a secure connection with the
2585# client, using a mimicked server certificate. Works with both
2586# CONNECT requests and intercepted SSL connections, but does
2587# not allow to make decisions based on SSL handshake info.
2588#
2589# peek-and-splice
2590# Decide whether to bump or splice the connection based on
2591# client-to-squid and server-to-squid SSL hello messages.
2592# XXX: Remove.
2593#
2594# none
2595# Same as the "splice" action.
2596#
2597# All ssl_bump rules are evaluated at each of the supported bumping
2598# steps. Rules with actions that are impossible at the current step are
2599# ignored. The first matching ssl_bump action wins and is applied at the
2600# end of the current step. If no rules match, the splice action is used.
2601# See the at_step ACL for a list of the supported SslBump steps.
2602#
2603# This clause supports both fast and slow acl types.
2604# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
2605#
2606# See also: http_port ssl-bump, https_port ssl-bump, and acl at_step.
2607#
2608#
2609# # Example: Bump all TLS connections except those originating from
2610# # localhost or those going to example.com.
2611#
2612# acl broken_sites ssl::server_name .example.com
2613# ssl_bump splice localhost
2614# ssl_bump splice broken_sites
2615# ssl_bump bump all
2616#Default:
2617# Become a TCP tunnel without decrypting proxied traffic.
2618
2619# TAG: sslproxy_cert_error
2620# Use this ACL to bypass server certificate validation errors.
2621#
2622# For example, the following lines will bypass all validation errors
2623# when talking to servers for example.com. All other
2624# validation errors will result in ERR_SECURE_CONNECT_FAIL error.
2625#
2626# acl BrokenButTrustedServers dstdomain example.com
2627# sslproxy_cert_error allow BrokenButTrustedServers
2628# sslproxy_cert_error deny all
2629#
2630# This clause only supports fast acl types.
2631# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
2632# Using slow acl types may result in server crashes
2633#
2634# Without this option, all server certificate validation errors
2635# terminate the transaction to protect Squid and the client.
2636#
2637# SQUID_X509_V_ERR_INFINITE_VALIDATION error cannot be bypassed
2638# but should not happen unless your OpenSSL library is buggy.
2639#
2640# SECURITY WARNING:
2641# Bypassing validation errors is dangerous because an
2642# error usually implies that the server cannot be trusted
2643# and the connection may be insecure.
2644#
2645# See also: sslproxy_flags and DONT_VERIFY_PEER.
2646#Default:
2647# Server certificate errors terminate the transaction.
2648
2649# TAG: sslproxy_cert_sign
2650#
2651# sslproxy_cert_sign <signing algorithm> acl ...
2652#
2653# The following certificate signing algorithms are supported:
2654#
2655# signTrusted
2656# Sign using the configured CA certificate which is usually
2657# placed in and trusted by end-user browsers. This is the
2658# default for trusted origin server certificates.
2659#
2660# signUntrusted
2661# Sign to guarantee an X509_V_ERR_CERT_UNTRUSTED browser error.
2662# This is the default for untrusted origin server certificates
2663# that are not self-signed (see ssl::certUntrusted).
2664#
2665# signSelf
2666# Sign using a self-signed certificate with the right CN to
2667# generate a X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT error in the
2668# browser. This is the default for self-signed origin server
2669# certificates (see ssl::certSelfSigned).
2670#
2671# This clause only supports fast acl types.
2672#
2673# When sslproxy_cert_sign acl(s) match, Squid uses the corresponding
2674# signing algorithm to generate the certificate and ignores all
2675# subsequent sslproxy_cert_sign options (the first match wins). If no
2676# acl(s) match, the default signing algorithm is determined by errors
2677# detected when obtaining and validating the origin server certificate.
2678#
2679# WARNING: SQUID_X509_V_ERR_DOMAIN_MISMATCH and ssl:certDomainMismatch can
2680# be used with sslproxy_cert_adapt, but if and only if Squid is bumping a
2681# CONNECT request that carries a domain name. In all other cases (CONNECT
2682# to an IP address or an intercepted SSL connection), Squid cannot detect
2683# the domain mismatch at certificate generation time when
2684# bump-server-first is used.
2685#Default:
2686# none
2687
2688# TAG: sslproxy_cert_adapt
2689#
2690# sslproxy_cert_adapt <adaptation algorithm> acl ...
2691#
2692# The following certificate adaptation algorithms are supported:
2693#
2694# setValidAfter
2695# Sets the "Not After" property to the "Not After" property of
2696# the CA certificate used to sign generated certificates.
2697#
2698# setValidBefore
2699# Sets the "Not Before" property to the "Not Before" property of
2700# the CA certificate used to sign generated certificates.
2701#
2702# setCommonName or setCommonName{CN}
2703# Sets Subject.CN property to the host name specified as a
2704# CN parameter or, if no explicit CN parameter was specified,
2705# extracted from the CONNECT request. It is a misconfiguration
2706# to use setCommonName without an explicit parameter for
2707# intercepted or tproxied SSL connections.
2708#
2709# This clause only supports fast acl types.
2710#
2711# Squid first groups sslproxy_cert_adapt options by adaptation algorithm.
2712# Within a group, when sslproxy_cert_adapt acl(s) match, Squid uses the
2713# corresponding adaptation algorithm to generate the certificate and
2714# ignores all subsequent sslproxy_cert_adapt options in that algorithm's
2715# group (i.e., the first match wins within each algorithm group). If no
2716# acl(s) match, the default mimicking action takes place.
2717#
2718# WARNING: SQUID_X509_V_ERR_DOMAIN_MISMATCH and ssl:certDomainMismatch can
2719# be used with sslproxy_cert_adapt, but if and only if Squid is bumping a
2720# CONNECT request that carries a domain name. In all other cases (CONNECT
2721# to an IP address or an intercepted SSL connection), Squid cannot detect
2722# the domain mismatch at certificate generation time when
2723# bump-server-first is used.
2724#Default:
2725# none
2726
2727# TAG: sslpassword_program
2728# Specify a program used for entering SSL key passphrases
2729# when using encrypted SSL certificate keys. If not specified
2730# keys must either be unencrypted, or Squid started with the -N
2731# option to allow it to query interactively for the passphrase.
2732#
2733# The key file name is given as argument to the program allowing
2734# selection of the right password if you have multiple encrypted
2735# keys.
2736#Default:
2737# none
2738
2739# OPTIONS RELATING TO EXTERNAL SSL_CRTD
2740# -----------------------------------------------------------------------------
2741
2742# TAG: sslcrtd_program
2743# Specify the location and options of the executable for certificate
2744# generator.
2745#
2746# /usr/lib/squid/security_file_certgen program can use a disk cache to improve response
2747# times on repeated requests. To enable caching, specify -s and -M
2748# parameters. If those parameters are not given, the program generates
2749# a new certificate on every request.
2750#
2751# For more information use:
2752# /usr/lib/squid/security_file_certgen -h
2753#Default:
2754# sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB
2755
2756# TAG: sslcrtd_children
2757# The maximum number of processes spawn to service ssl server.
2758# The maximum this may be safely set to is 32.
2759#
2760# The startup= and idle= options allow some measure of skew in your
2761# tuning.
2762#
2763# startup=N
2764#
2765# Sets the minimum number of processes to spawn when Squid
2766# starts or reconfigures. When set to zero the first request will
2767# cause spawning of the first child process to handle it.
2768#
2769# Starting too few children temporary slows Squid under load while it
2770# tries to spawn enough additional processes to cope with traffic.
2771#
2772# idle=N
2773#
2774# Sets a minimum of how many processes Squid is to try and keep available
2775# at all times. When traffic begins to rise above what the existing
2776# processes can handle this many more will be spawned up to the maximum
2777# configured. A minimum setting of 1 is required.
2778#
2779# queue-size=N
2780#
2781# Sets the maximum number of queued requests.
2782# If the queued requests exceed queue size for more than 3 minutes
2783# squid aborts its operation.
2784# The default value is set to 2*numberofchildren.
2785#
2786# You must have at least one ssl_crtd process.
2787#Default:
2788# sslcrtd_children 32 startup=5 idle=1
2789
2790# TAG: sslcrtvalidator_program
2791# Specify the location and options of the executable for ssl_crt_validator
2792# process.
2793#
2794# Usage: sslcrtvalidator_program [ttl=n] [cache=n] path ...
2795#
2796# Options:
2797# ttl=n TTL in seconds for cached results. The default is 60 secs
2798# cache=n limit the result cache size. The default value is 2048
2799#Default:
2800# none
2801
2802# TAG: sslcrtvalidator_children
2803# The maximum number of processes spawn to service SSL server.
2804# The maximum this may be safely set to is 32.
2805#
2806# The startup= and idle= options allow some measure of skew in your
2807# tuning.
2808#
2809# startup=N
2810#
2811# Sets the minimum number of processes to spawn when Squid
2812# starts or reconfigures. When set to zero the first request will
2813# cause spawning of the first child process to handle it.
2814#
2815# Starting too few children temporary slows Squid under load while it
2816# tries to spawn enough additional processes to cope with traffic.
2817#
2818# idle=N
2819#
2820# Sets a minimum of how many processes Squid is to try and keep available
2821# at all times. When traffic begins to rise above what the existing
2822# processes can handle this many more will be spawned up to the maximum
2823# configured. A minimum setting of 1 is required.
2824#
2825# concurrency=
2826#
2827# The number of requests each certificate validator helper can handle in
2828# parallel. A value of 0 indicates the certficate validator does not
2829# support concurrency. Defaults to 1.
2830#
2831# When this directive is set to a value >= 1 then the protocol
2832# used to communicate with the helper is modified to include
2833# a request ID in front of the request/response. The request
2834# ID from the request must be echoed back with the response
2835# to that request.
2836#
2837# queue-size=N
2838#
2839# Sets the maximum number of queued requests.
2840# If the queued requests exceed queue size for more than 3 minutes
2841# squid aborts its operation.
2842# The default value is set to 2*numberofchildren.
2843#
2844# You must have at least one ssl_crt_validator process.
2845#Default:
2846# sslcrtvalidator_children 32 startup=5 idle=1 concurrency=1
2847
2848# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
2849# -----------------------------------------------------------------------------
2850
2851# TAG: cache_peer
2852# To specify other caches in a hierarchy, use the format:
2853#
2854# cache_peer hostname type http-port icp-port [options]
2855#
2856# For example,
2857#
2858# # proxy icp
2859# # hostname type port port options
2860# # -------------------- -------- ----- ----- -----------
2861# cache_peer parent.foo.net parent 3128 3130 default
2862# cache_peer sib1.foo.net sibling 3128 3130 proxy-only
2863# cache_peer sib2.foo.net sibling 3128 3130 proxy-only
2864# cache_peer example.com parent 80 0 default
2865# cache_peer cdn.example.com sibling 3128 0
2866#
2867# type: either 'parent', 'sibling', or 'multicast'.
2868#
2869# proxy-port: The port number where the peer accept HTTP requests.
2870# For other Squid proxies this is usually 3128
2871# For web servers this is usually 80
2872#
2873# icp-port: Used for querying neighbor caches about objects.
2874# Set to 0 if the peer does not support ICP or HTCP.
2875# See ICP and HTCP options below for additional details.
2876#
2877#
2878# ==== ICP OPTIONS ====
2879#
2880# You MUST also set icp_port and icp_access explicitly when using these options.
2881# The defaults will prevent peer traffic using ICP.
2882#
2883#
2884# no-query Disable ICP queries to this neighbor.
2885#
2886# multicast-responder
2887# Indicates the named peer is a member of a multicast group.
2888# ICP queries will not be sent directly to the peer, but ICP
2889# replies will be accepted from it.
2890#
2891# closest-only Indicates that, for ICP_OP_MISS replies, we'll only forward
2892# CLOSEST_PARENT_MISSes and never FIRST_PARENT_MISSes.
2893#
2894# background-ping
2895# To only send ICP queries to this neighbor infrequently.
2896# This is used to keep the neighbor round trip time updated
2897# and is usually used in conjunction with weighted-round-robin.
2898#
2899#
2900# ==== HTCP OPTIONS ====
2901#
2902# You MUST also set htcp_port and htcp_access explicitly when using these options.
2903# The defaults will prevent peer traffic using HTCP.
2904#
2905#
2906# htcp Send HTCP, instead of ICP, queries to the neighbor.
2907# You probably also want to set the "icp-port" to 4827
2908# instead of 3130. This directive accepts a comma separated
2909# list of options described below.
2910#
2911# htcp=oldsquid Send HTCP to old Squid versions (2.5 or earlier).
2912#
2913# htcp=no-clr Send HTCP to the neighbor but without
2914# sending any CLR requests. This cannot be used with
2915# only-clr.
2916#
2917# htcp=only-clr Send HTCP to the neighbor but ONLY CLR requests.
2918# This cannot be used with no-clr.
2919#
2920# htcp=no-purge-clr
2921# Send HTCP to the neighbor including CLRs but only when
2922# they do not result from PURGE requests.
2923#
2924# htcp=forward-clr
2925# Forward any HTCP CLR requests this proxy receives to the peer.
2926#
2927#
2928# ==== PEER SELECTION METHODS ====
2929#
2930# The default peer selection method is ICP, with the first responding peer
2931# being used as source. These options can be used for better load balancing.
2932#
2933#
2934# default This is a parent cache which can be used as a "last-resort"
2935# if a peer cannot be located by any of the peer-selection methods.
2936# If specified more than once, only the first is used.
2937#
2938# round-robin Load-Balance parents which should be used in a round-robin
2939# fashion in the absence of any ICP queries.
2940# weight=N can be used to add bias.
2941#
2942# weighted-round-robin
2943# Load-Balance parents which should be used in a round-robin
2944# fashion with the frequency of each parent being based on the
2945# round trip time. Closer parents are used more often.
2946# Usually used for background-ping parents.
2947# weight=N can be used to add bias.
2948#
2949# carp Load-Balance parents which should be used as a CARP array.
2950# The requests will be distributed among the parents based on the
2951# CARP load balancing hash function based on their weight.
2952#
2953# userhash Load-balance parents based on the client proxy_auth or ident username.
2954#
2955# sourcehash Load-balance parents based on the client source IP.
2956#
2957# multicast-siblings
2958# To be used only for cache peers of type "multicast".
2959# ALL members of this multicast group have "sibling"
2960# relationship with it, not "parent". This is to a multicast
2961# group when the requested object would be fetched only from
2962# a "parent" cache, anyway. It's useful, e.g., when
2963# configuring a pool of redundant Squid proxies, being
2964# members of the same multicast group.
2965#
2966#
2967# ==== PEER SELECTION OPTIONS ====
2968#
2969# weight=N use to affect the selection of a peer during any weighted
2970# peer-selection mechanisms.
2971# The weight must be an integer; default is 1,
2972# larger weights are favored more.
2973# This option does not affect parent selection if a peering
2974# protocol is not in use.
2975#
2976# basetime=N Specify a base amount to be subtracted from round trip
2977# times of parents.
2978# It is subtracted before division by weight in calculating
2979# which parent to fectch from. If the rtt is less than the
2980# base time the rtt is set to a minimal value.
2981#
2982# ttl=N Specify a TTL to use when sending multicast ICP queries
2983# to this address.
2984# Only useful when sending to a multicast group.
2985# Because we don't accept ICP replies from random
2986# hosts, you must configure other group members as
2987# peers with the 'multicast-responder' option.
2988#
2989# no-delay To prevent access to this neighbor from influencing the
2990# delay pools.
2991#
2992# digest-url=URL Tell Squid to fetch the cache digest (if digests are
2993# enabled) for this host from the specified URL rather
2994# than the Squid default location.
2995#
2996#
2997# ==== CARP OPTIONS ====
2998#
2999# carp-key=key-specification
3000# use a different key than the full URL to hash against the peer.
3001# the key-specification is a comma-separated list of the keywords
3002# scheme, host, port, path, params
3003# Order is not important.
3004#
3005# ==== ACCELERATOR / REVERSE-PROXY OPTIONS ====
3006#
3007# originserver Causes this parent to be contacted as an origin server.
3008# Meant to be used in accelerator setups when the peer
3009# is a web server.
3010#
3011# forceddomain=name
3012# Set the Host header of requests forwarded to this peer.
3013# Useful in accelerator setups where the server (peer)
3014# expects a certain domain name but clients may request
3015# others. ie example.com or www.example.com
3016#
3017# no-digest Disable request of cache digests.
3018#
3019# no-netdb-exchange
3020# Disables requesting ICMP RTT database (NetDB).
3021#
3022#
3023# ==== AUTHENTICATION OPTIONS ====
3024#
3025# login=user:password
3026# If this is a personal/workgroup proxy and your parent
3027# requires proxy authentication.
3028#
3029# Note: The string can include URL escapes (i.e. %20 for
3030# spaces). This also means % must be written as %%.
3031#
3032# login=PASSTHRU
3033# Send login details received from client to this peer.
3034# Both Proxy- and WWW-Authorization headers are passed
3035# without alteration to the peer.
3036# Authentication is not required by Squid for this to work.
3037#
3038# Note: This will pass any form of authentication but
3039# only Basic auth will work through a proxy unless the
3040# connection-auth options are also used.
3041#
3042# login=PASS Send login details received from client to this peer.
3043# Authentication is not required by this option.
3044#
3045# If there are no client-provided authentication headers
3046# to pass on, but username and password are available
3047# from an external ACL user= and password= result tags
3048# they may be sent instead.
3049#
3050# Note: To combine this with proxy_auth both proxies must
3051# share the same user database as HTTP only allows for
3052# a single login (one for proxy, one for origin server).
3053# Also be warned this will expose your users proxy
3054# password to the peer. USE WITH CAUTION
3055#
3056# login=*:password
3057# Send the username to the upstream cache, but with a
3058# fixed password. This is meant to be used when the peer
3059# is in another administrative domain, but it is still
3060# needed to identify each user.
3061# The star can optionally be followed by some extra
3062# information which is added to the username. This can
3063# be used to identify this proxy to the peer, similar to
3064# the login=username:password option above.
3065#
3066# login=NEGOTIATE
3067# If this is a personal/workgroup proxy and your parent
3068# requires a secure proxy authentication.
3069# The first principal from the default keytab or defined by
3070# the environment variable KRB5_KTNAME will be used.
3071#
3072# WARNING: The connection may transmit requests from multiple
3073# clients. Negotiate often assumes end-to-end authentication
3074# and a single-client. Which is not strictly true here.
3075#
3076# login=NEGOTIATE:principal_name
3077# If this is a personal/workgroup proxy and your parent
3078# requires a secure proxy authentication.
3079# The principal principal_name from the default keytab or
3080# defined by the environment variable KRB5_KTNAME will be
3081# used.
3082#
3083# WARNING: The connection may transmit requests from multiple
3084# clients. Negotiate often assumes end-to-end authentication
3085# and a single-client. Which is not strictly true here.
3086#
3087# connection-auth=on|off
3088# Tell Squid that this peer does or not support Microsoft
3089# connection oriented authentication, and any such
3090# challenges received from there should be ignored.
3091# Default is auto to automatically determine the status
3092# of the peer.
3093#
3094# auth-no-keytab
3095# Do not use a keytab to authenticate to a peer when
3096# login=NEGOTIATE is specified. Let the GSSAPI
3097# implementation determine which already existing
3098# credentials cache to use instead.
3099#
3100#
3101# ==== SSL / HTTPS / TLS OPTIONS ====
3102#
3103# tls Encrypt connections to this peer with TLS.
3104#
3105# sslcert=/path/to/ssl/certificate
3106# A client X.509 certificate to use when connecting to
3107# this peer.
3108#
3109# sslkey=/path/to/ssl/key
3110# The private key corresponding to sslcert above.
3111#
3112# If sslkey= is not specified sslcert= is assumed to
3113# reference a PEM file containing both the certificate
3114# and private key.
3115#
3116# sslcipher=... The list of valid SSL ciphers to use when connecting
3117# to this peer.
3118#
3119# tls-min-version=1.N
3120# The minimum TLS protocol version to permit. To control
3121# SSLv3 use the tls-options= parameter.
3122# Supported Values: 1.0 (default), 1.1, 1.2
3123#
3124# tls-options=... Specify various TLS implementation options.
3125#
3126# OpenSSL options most important are:
3127#
3128# NO_SSLv3 Disallow the use of SSLv3
3129#
3130# SINGLE_DH_USE
3131# Always create a new key when using
3132# temporary/ephemeral DH key exchanges
3133#
3134# NO_TICKET
3135# Disable use of RFC5077 session tickets.
3136# Some servers may have problems
3137# understanding the TLS extension due
3138# to ambiguous specification in RFC4507.
3139#
3140# ALL Enable various bug workarounds
3141# suggested as "harmless" by OpenSSL
3142# Be warned that this reduces SSL/TLS
3143# strength to some attacks.
3144#
3145# See the OpenSSL SSL_CTX_set_options documentation for a
3146# more complete list.
3147#
3148# GnuTLS options most important are:
3149#
3150# %NO_TICKETS
3151# Disable use of RFC5077 session tickets.
3152# Some servers may have problems
3153# understanding the TLS extension due
3154# to ambiguous specification in RFC4507.
3155#
3156# See the GnuTLS Priority Strings documentation
3157# for a more complete list.
3158# http://www.gnutls.org/manual/gnutls.html#Priority-Strings
3159#
3160# tls-cafile= PEM file containing CA certificates to use when verifying
3161# the peer certificate. May be repeated to load multiple files.
3162#
3163# sslcapath=... A directory containing additional CA certificates to
3164# use when verifying the peer certificate.
3165# Requires OpenSSL or LibreSSL.
3166#
3167# sslcrlfile=... A certificate revocation list file to use when
3168# verifying the peer certificate.
3169#
3170# sslflags=... Specify various flags modifying the SSL implementation:
3171#
3172# DONT_VERIFY_PEER
3173# Accept certificates even if they fail to
3174# verify.
3175#
3176# DONT_VERIFY_DOMAIN
3177# Don't verify the peer certificate
3178# matches the server name
3179#
3180# ssldomain= The peer name as advertised in it's certificate.
3181# Used for verifying the correctness of the received peer
3182# certificate. If not specified the peer hostname will be
3183# used.
3184#
3185# front-end-https[=off|on|auto]
3186# Enable the "Front-End-Https: On" header needed when
3187# using Squid as a SSL frontend in front of Microsoft OWA.
3188# See MS KB document Q307347 for details on this header.
3189# If set to auto the header will only be added if the
3190# request is forwarded as a https:// URL.
3191#
3192# tls-default-ca[=off]
3193# Whether to use the system Trusted CAs. Default is ON.
3194#
3195# tls-no-npn Do not use the TLS NPN extension to advertise HTTP/1.1.
3196#
3197# ==== GENERAL OPTIONS ====
3198#
3199# connect-timeout=N
3200# A peer-specific connect timeout.
3201# Also see the peer_connect_timeout directive.
3202#
3203# connect-fail-limit=N
3204# How many times connecting to a peer must fail before
3205# it is marked as down. Standby connection failures
3206# count towards this limit. Default is 10.
3207#
3208# allow-miss Disable Squid's use of only-if-cached when forwarding
3209# requests to siblings. This is primarily useful when
3210# icp_hit_stale is used by the sibling. Excessive use
3211# of this option may result in forwarding loops. One way
3212# to prevent peering loops when using this option, is to
3213# deny cache peer usage on requests from a peer:
3214# acl fromPeer ...
3215# cache_peer_access peerName deny fromPeer
3216#
3217# max-conn=N Limit the number of concurrent connections the Squid
3218# may open to this peer, including already opened idle
3219# and standby connections. There is no peer-specific
3220# connection limit by default.
3221#
3222# A peer exceeding the limit is not used for new
3223# requests unless a standby connection is available.
3224#
3225# max-conn currently works poorly with idle persistent
3226# connections: When a peer reaches its max-conn limit,
3227# and there are idle persistent connections to the peer,
3228# the peer may not be selected because the limiting code
3229# does not know whether Squid can reuse those idle
3230# connections.
3231#
3232# standby=N Maintain a pool of N "hot standby" connections to an
3233# UP peer, available for requests when no idle
3234# persistent connection is available (or safe) to use.
3235# By default and with zero N, no such pool is maintained.
3236# N must not exceed the max-conn limit (if any).
3237#
3238# At start or after reconfiguration, Squid opens new TCP
3239# standby connections until there are N connections
3240# available and then replenishes the standby pool as
3241# opened connections are used up for requests. A used
3242# connection never goes back to the standby pool, but
3243# may go to the regular idle persistent connection pool
3244# shared by all peers and origin servers.
3245#
3246# Squid never opens multiple new standby connections
3247# concurrently. This one-at-a-time approach minimizes
3248# flooding-like effect on peers. Furthermore, just a few
3249# standby connections should be sufficient in most cases
3250# to supply most new requests with a ready-to-use
3251# connection.
3252#
3253# Standby connections obey server_idle_pconn_timeout.
3254# For the feature to work as intended, the peer must be
3255# configured to accept and keep them open longer than
3256# the idle timeout at the connecting Squid, to minimize
3257# race conditions typical to idle used persistent
3258# connections. Default request_timeout and
3259# server_idle_pconn_timeout values ensure such a
3260# configuration.
3261#
3262# name=xxx Unique name for the peer.
3263# Required if you have multiple peers on the same host
3264# but different ports.
3265# This name can be used in cache_peer_access and similar
3266# directives to identify the peer.
3267# Can be used by outgoing access controls through the
3268# peername ACL type.
3269#
3270# no-tproxy Do not use the client-spoof TPROXY support when forwarding
3271# requests to this peer. Use normal address selection instead.
3272# This overrides the spoof_client_ip ACL.
3273#
3274# proxy-only objects fetched from the peer will not be stored locally.
3275#
3276#Default:
3277# none
3278
3279# TAG: cache_peer_access
3280# Restricts usage of cache_peer proxies.
3281#
3282# Usage:
3283# cache_peer_access peer-name allow|deny [!]aclname ...
3284#
3285# For the required peer-name parameter, use either the value of the
3286# cache_peer name=value parameter or, if name=value is missing, the
3287# cache_peer hostname parameter.
3288#
3289# This directive narrows down the selection of peering candidates, but
3290# does not determine the order in which the selected candidates are
3291# contacted. That order is determined by the peer selection algorithms
3292# (see PEER SELECTION sections in the cache_peer documentation).
3293#
3294# If a deny rule matches, the corresponding peer will not be contacted
3295# for the current transaction -- Squid will not send ICP queries and
3296# will not forward HTTP requests to that peer. An allow match leaves
3297# the corresponding peer in the selection. The first match for a given
3298# peer wins for that peer.
3299#
3300# The relative order of cache_peer_access directives for the same peer
3301# matters. The relative order of any two cache_peer_access directives
3302# for different peers does not matter. To ease interpretation, it is a
3303# good idea to group cache_peer_access directives for the same peer
3304# together.
3305#
3306# A single cache_peer_access directive may be evaluated multiple times
3307# for a given transaction because individual peer selection algorithms
3308# may check it independently from each other. These redundant checks
3309# may be optimized away in future Squid versions.
3310#
3311# This clause only supports fast acl types.
3312# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
3313#
3314#Default:
3315# No peer usage restrictions.
3316
3317# TAG: neighbor_type_domain
3318# Modify the cache_peer neighbor type when passing requests
3319# about specific domains to the peer.
3320#
3321# Usage:
3322# neighbor_type_domain neighbor parent|sibling domain domain ...
3323#
3324# For example:
3325# cache_peer foo.example.com parent 3128 3130
3326# neighbor_type_domain foo.example.com sibling .au .de
3327#
3328# The above configuration treats all requests to foo.example.com as a
3329# parent proxy unless the request is for a .au or .de ccTLD domain name.
3330#Default:
3331# The peer type from cache_peer directive is used for all requests to that peer.
3332
3333# TAG: dead_peer_timeout (seconds)
3334# This controls how long Squid waits to declare a peer cache
3335# as "dead." If there are no ICP replies received in this
3336# amount of time, Squid will declare the peer dead and not
3337# expect to receive any further ICP replies. However, it
3338# continues to send ICP queries, and will mark the peer as
3339# alive upon receipt of the first subsequent ICP reply.
3340#
3341# This timeout also affects when Squid expects to receive ICP
3342# replies from peers. If more than 'dead_peer' seconds have
3343# passed since the last ICP reply was received, Squid will not
3344# expect to receive an ICP reply on the next query. Thus, if
3345# your time between requests is greater than this timeout, you
3346# will see a lot of requests sent DIRECT to origin servers
3347# instead of to your parents.
3348#Default:
3349# dead_peer_timeout 10 seconds
3350
3351# TAG: forward_max_tries
3352# Controls how many different forward paths Squid will try
3353# before giving up. See also forward_timeout.
3354#
3355# NOTE: connect_retries (default: none) can make each of these
3356# possible forwarding paths be tried multiple times.
3357#Default:
3358# forward_max_tries 25
3359
3360# MEMORY CACHE OPTIONS
3361# -----------------------------------------------------------------------------
3362
3363# TAG: cache_mem (bytes)
3364# NOTE: THIS PARAMETER DOES NOT SPECIFY THE MAXIMUM PROCESS SIZE.
3365# IT ONLY PLACES A LIMIT ON HOW MUCH ADDITIONAL MEMORY SQUID WILL
3366# USE AS A MEMORY CACHE OF OBJECTS. SQUID USES MEMORY FOR OTHER
3367# THINGS AS WELL. SEE THE SQUID FAQ SECTION 8 FOR DETAILS.
3368#
3369# 'cache_mem' specifies the ideal amount of memory to be used
3370# for:
3371# * In-Transit objects
3372# * Hot Objects
3373# * Negative-Cached objects
3374#
3375# Data for these objects are stored in 4 KB blocks. This
3376# parameter specifies the ideal upper limit on the total size of
3377# 4 KB blocks allocated. In-Transit objects take the highest
3378# priority.
3379#
3380# In-transit objects have priority over the others. When
3381# additional space is needed for incoming data, negative-cached
3382# and hot objects will be released. In other words, the
3383# negative-cached and hot objects will fill up any unused space
3384# not needed for in-transit objects.
3385#
3386# If circumstances require, this limit will be exceeded.
3387# Specifically, if your incoming request rate requires more than
3388# 'cache_mem' of memory to hold in-transit objects, Squid will
3389# exceed this limit to satisfy the new requests. When the load
3390# decreases, blocks will be freed until the high-water mark is
3391# reached. Thereafter, blocks will be used to store hot
3392# objects.
3393#
3394# If shared memory caching is enabled, Squid does not use the shared
3395# cache space for in-transit objects, but they still consume as much
3396# local memory as they need. For more details about the shared memory
3397# cache, see memory_cache_shared.
3398#Default:
3399# cache_mem 256 MB
3400
3401# TAG: maximum_object_size_in_memory (bytes)
3402# Objects greater than this size will not be attempted to kept in
3403# the memory cache. This should be set high enough to keep objects
3404# accessed frequently in memory to improve performance whilst low
3405# enough to keep larger objects from hoarding cache_mem.
3406#Default:
3407# maximum_object_size_in_memory 512 KB
3408
3409# TAG: memory_cache_shared on|off
3410# Controls whether the memory cache is shared among SMP workers.
3411#
3412# The shared memory cache is meant to occupy cache_mem bytes and replace
3413# the non-shared memory cache, although some entities may still be
3414# cached locally by workers for now (e.g., internal and in-transit
3415# objects may be served from a local memory cache even if shared memory
3416# caching is enabled).
3417#
3418# By default, the memory cache is shared if and only if all of the
3419# following conditions are satisfied: Squid runs in SMP mode with
3420# multiple workers, cache_mem is positive, and Squid environment
3421# supports required IPC primitives (e.g., POSIX shared memory segments
3422# and GCC-style atomic operations).
3423#
3424# To avoid blocking locks, shared memory uses opportunistic algorithms
3425# that do not guarantee that every cachable entity that could have been
3426# shared among SMP workers will actually be shared.
3427#Default:
3428# "on" where supported if doing memory caching with multiple SMP workers.
3429
3430# TAG: memory_cache_mode
3431# Controls which objects to keep in the memory cache (cache_mem)
3432#
3433# always Keep most recently fetched objects in memory (default)
3434#
3435# disk Only disk cache hits are kept in memory, which means
3436# an object must first be cached on disk and then hit
3437# a second time before cached in memory.
3438#
3439# network Only objects fetched from network is kept in memory
3440#Default:
3441# Keep the most recently fetched objects in memory
3442
3443# TAG: memory_replacement_policy
3444# The memory replacement policy parameter determines which
3445# objects are purged from memory when memory space is needed.
3446#
3447# See cache_replacement_policy for details on algorithms.
3448#Default:
3449# memory_replacement_policy lru
3450
3451# DISK CACHE OPTIONS
3452# -----------------------------------------------------------------------------
3453
3454# TAG: cache_replacement_policy
3455# The cache replacement policy parameter determines which
3456# objects are evicted (replaced) when disk space is needed.
3457#
3458# lru : Squid's original list based LRU policy
3459# heap GDSF : Greedy-Dual Size Frequency
3460# heap LFUDA: Least Frequently Used with Dynamic Aging
3461# heap LRU : LRU policy implemented using a heap
3462#
3463# Applies to any cache_dir lines listed below this directive.
3464#
3465# The LRU policies keeps recently referenced objects.
3466#
3467# The heap GDSF policy optimizes object hit rate by keeping smaller
3468# popular objects in cache so it has a better chance of getting a
3469# hit. It achieves a lower byte hit rate than LFUDA though since
3470# it evicts larger (possibly popular) objects.
3471#
3472# The heap LFUDA policy keeps popular objects in cache regardless of
3473# their size and thus optimizes byte hit rate at the expense of
3474# hit rate since one large, popular object will prevent many
3475# smaller, slightly less popular objects from being cached.
3476#
3477# Both policies utilize a dynamic aging mechanism that prevents
3478# cache pollution that can otherwise occur with frequency-based
3479# replacement policies.
3480#
3481# NOTE: if using the LFUDA replacement policy you should increase
3482# the value of maximum_object_size above its default of 4 MB to
3483# to maximize the potential byte hit rate improvement of LFUDA.
3484#
3485# For more information about the GDSF and LFUDA cache replacement
3486# policies see http://www.hpl.hp.com/techreports/1999/HPL-1999-69.html
3487# and http://fog.hpl.external.hp.com/techreports/98/HPL-98-173.html.
3488#Default:
3489# cache_replacement_policy lru
3490
3491# TAG: minimum_object_size (bytes)
3492# Objects smaller than this size will NOT be saved on disk. The
3493# value is specified in bytes, and the default is 0 KB, which
3494# means all responses can be stored.
3495#Default:
3496# no limit
3497
3498# TAG: maximum_object_size (bytes)
3499# Set the default value for max-size parameter on any cache_dir.
3500# The value is specified in bytes, and the default is 4 MB.
3501#
3502# If you wish to get a high BYTES hit ratio, you should probably
3503# increase this (one 32 MB object hit counts for 3200 10KB
3504# hits).
3505#
3506# If you wish to increase hit ratio more than you want to
3507# save bandwidth you should leave this low.
3508#
3509# NOTE: if using the LFUDA replacement policy you should increase
3510# this value to maximize the byte hit rate improvement of LFUDA!
3511# See cache_replacement_policy for a discussion of this policy.
3512#Default:
3513# maximum_object_size 4 MB
3514
3515# TAG: cache_dir
3516# Format:
3517# cache_dir Type Directory-Name Fs-specific-data [options]
3518#
3519# You can specify multiple cache_dir lines to spread the
3520# cache among different disk partitions.
3521#
3522# Type specifies the kind of storage system to use. Only "ufs"
3523# is built by default. To enable any of the other storage systems
3524# see the --enable-storeio configure option.
3525#
3526# 'Directory' is a top-level directory where cache swap
3527# files will be stored. If you want to use an entire disk
3528# for caching, this can be the mount-point directory.
3529# The directory must exist and be writable by the Squid
3530# process. Squid will NOT create this directory for you.
3531#
3532# In SMP configurations, cache_dir must not precede the workers option
3533# and should use configuration macros or conditionals to give each
3534# worker interested in disk caching a dedicated cache directory.
3535#
3536#
3537# ==== The ufs store type ====
3538#
3539# "ufs" is the old well-known Squid storage format that has always
3540# been there.
3541#
3542# Usage:
3543# cache_dir ufs Directory-Name Mbytes L1 L2 [options]
3544#
3545# 'Mbytes' is the amount of disk space (MB) to use under this
3546# directory. The default is 100 MB. Change this to suit your
3547# configuration. Do NOT put the size of your disk drive here.
3548# Instead, if you want Squid to use the entire disk drive,
3549# subtract 20% and use that value.
3550#
3551# 'L1' is the number of first-level subdirectories which
3552# will be created under the 'Directory'. The default is 16.
3553#
3554# 'L2' is the number of second-level subdirectories which
3555# will be created under each first-level directory. The default
3556# is 256.
3557#
3558#
3559# ==== The aufs store type ====
3560#
3561# "aufs" uses the same storage format as "ufs", utilizing
3562# POSIX-threads to avoid blocking the main Squid process on
3563# disk-I/O. This was formerly known in Squid as async-io.
3564#
3565# Usage:
3566# cache_dir aufs Directory-Name Mbytes L1 L2 [options]
3567#
3568# see argument descriptions under ufs above
3569#
3570#
3571# ==== The diskd store type ====
3572#
3573# "diskd" uses the same storage format as "ufs", utilizing a
3574# separate process to avoid blocking the main Squid process on
3575# disk-I/O.
3576#
3577# Usage:
3578# cache_dir diskd Directory-Name Mbytes L1 L2 [options] [Q1=n] [Q2=n]
3579#
3580# see argument descriptions under ufs above
3581#
3582# Q1 specifies the number of unacknowledged I/O requests when Squid
3583# stops opening new files. If this many messages are in the queues,
3584# Squid won't open new files. Default is 64
3585#
3586# Q2 specifies the number of unacknowledged messages when Squid
3587# starts blocking. If this many messages are in the queues,
3588# Squid blocks until it receives some replies. Default is 72
3589#
3590# When Q1 < Q2 (the default), the cache directory is optimized
3591# for lower response time at the expense of a decrease in hit
3592# ratio. If Q1 > Q2, the cache directory is optimized for
3593# higher hit ratio at the expense of an increase in response
3594# time.
3595#
3596#
3597# ==== The rock store type ====
3598#
3599# Usage:
3600# cache_dir rock Directory-Name Mbytes [options]
3601#
3602# The Rock Store type is a database-style storage. All cached
3603# entries are stored in a "database" file, using fixed-size slots.
3604# A single entry occupies one or more slots.
3605#
3606# If possible, Squid using Rock Store creates a dedicated kid
3607# process called "disker" to avoid blocking Squid worker(s) on disk
3608# I/O. One disker kid is created for each rock cache_dir. Diskers
3609# are created only when Squid, running in daemon mode, has support
3610# for the IpcIo disk I/O module.
3611#
3612# swap-timeout=msec: Squid will not start writing a miss to or
3613# reading a hit from disk if it estimates that the swap operation
3614# will take more than the specified number of milliseconds. By
3615# default and when set to zero, disables the disk I/O time limit
3616# enforcement. Ignored when using blocking I/O module because
3617# blocking synchronous I/O does not allow Squid to estimate the
3618# expected swap wait time.
3619#
3620# max-swap-rate=swaps/sec: Artificially limits disk access using
3621# the specified I/O rate limit. Swap out requests that
3622# would cause the average I/O rate to exceed the limit are
3623# delayed. Individual swap in requests (i.e., hits or reads) are
3624# not delayed, but they do contribute to measured swap rate and
3625# since they are placed in the same FIFO queue as swap out
3626# requests, they may wait longer if max-swap-rate is smaller.
3627# This is necessary on file systems that buffer "too
3628# many" writes and then start blocking Squid and other processes
3629# while committing those writes to disk. Usually used together
3630# with swap-timeout to avoid excessive delays and queue overflows
3631# when disk demand exceeds available disk "bandwidth". By default
3632# and when set to zero, disables the disk I/O rate limit
3633# enforcement. Currently supported by IpcIo module only.
3634#
3635# slot-size=bytes: The size of a database "record" used for
3636# storing cached responses. A cached response occupies at least
3637# one slot and all database I/O is done using individual slots so
3638# increasing this parameter leads to more disk space waste while
3639# decreasing it leads to more disk I/O overheads. Should be a
3640# multiple of your operating system I/O page size. Defaults to
3641# 16KBytes. A housekeeping header is stored with each slot and
3642# smaller slot-sizes will be rejected. The header is smaller than
3643# 100 bytes.
3644#
3645#
3646# ==== COMMON OPTIONS ====
3647#
3648# no-store no new objects should be stored to this cache_dir.
3649#
3650# min-size=n the minimum object size in bytes this cache_dir
3651# will accept. It's used to restrict a cache_dir
3652# to only store large objects (e.g. AUFS) while
3653# other stores are optimized for smaller objects
3654# (e.g. Rock).
3655# Defaults to 0.
3656#
3657# max-size=n the maximum object size in bytes this cache_dir
3658# supports.
3659# The value in maximum_object_size directive sets
3660# the default unless more specific details are
3661# available (ie a small store capacity).
3662#
3663# Note: To make optimal use of the max-size limits you should order
3664# the cache_dir lines with the smallest max-size value first.
3665#
3666#Default:
3667# No disk cache. Store cache ojects only in memory.
3668#
3669
3670# Uncomment and adjust the following to add a disk cache directory.
3671#cache_dir ufs /var/spool/squid 100 16 256
3672
3673# TAG: store_dir_select_algorithm
3674# How Squid selects which cache_dir to use when the response
3675# object will fit into more than one.
3676#
3677# Regardless of which algorithm is used the cache_dir min-size
3678# and max-size parameters are obeyed. As such they can affect
3679# the selection algorithm by limiting the set of considered
3680# cache_dir.
3681#
3682# Algorithms:
3683#
3684# least-load
3685#
3686# This algorithm is suited to caches with similar cache_dir
3687# sizes and disk speeds.
3688#
3689# The disk with the least I/O pending is selected.
3690# When there are multiple disks with the same I/O load ranking
3691# the cache_dir with most available capacity is selected.
3692#
3693# When a mix of cache_dir sizes are configured the faster disks
3694# have a naturally lower I/O loading and larger disks have more
3695# capacity. So space used to store objects and data throughput
3696# may be very unbalanced towards larger disks.
3697#
3698#
3699# round-robin
3700#
3701# This algorithm is suited to caches with unequal cache_dir
3702# disk sizes.
3703#
3704# Each cache_dir is selected in a rotation. The next suitable
3705# cache_dir is used.
3706#
3707# Available cache_dir capacity is only considered in relation
3708# to whether the object will fit and meets the min-size and
3709# max-size parameters.
3710#
3711# Disk I/O loading is only considered to prevent overload on slow
3712# disks. This algorithm does not spread objects by size, so any
3713# I/O loading per-disk may appear very unbalanced and volatile.
3714#
3715# If several cache_dirs use similar min-size, max-size, or other
3716# limits to to reject certain responses, then do not group such
3717# cache_dir lines together, to avoid round-robin selection bias
3718# towards the first cache_dir after the group. Instead, interleave
3719# cache_dir lines from different groups. For example:
3720#
3721# store_dir_select_algorithm round-robin
3722# cache_dir rock /hdd1 ... min-size=100000
3723# cache_dir rock /ssd1 ... max-size=99999
3724# cache_dir rock /hdd2 ... min-size=100000
3725# cache_dir rock /ssd2 ... max-size=99999
3726# cache_dir rock /hdd3 ... min-size=100000
3727# cache_dir rock /ssd3 ... max-size=99999
3728#Default:
3729# store_dir_select_algorithm least-load
3730
3731# TAG: max_open_disk_fds
3732# To avoid having disk as the I/O bottleneck Squid can optionally
3733# bypass the on-disk cache if more than this amount of disk file
3734# descriptors are open.
3735#
3736# A value of 0 indicates no limit.
3737#Default:
3738# no limit
3739
3740# TAG: cache_swap_low (percent, 0-100)
3741# The low-water mark for AUFS/UFS/diskd cache object eviction by
3742# the cache_replacement_policy algorithm.
3743#
3744# Removal begins when the swap (disk) usage of a cache_dir is
3745# above this low-water mark and attempts to maintain utilization
3746# near the low-water mark.
3747#
3748# As swap utilization increases towards the high-water mark set
3749# by cache_swap_high object eviction becomes more agressive.
3750#
3751# The value difference in percentages between low- and high-water
3752# marks represent an eviction rate of 300 objects per second and
3753# the rate continues to scale in agressiveness by multiples of
3754# this above the high-water mark.
3755#
3756# Defaults are 90% and 95%. If you have a large cache, 5% could be
3757# hundreds of MB. If this is the case you may wish to set these
3758# numbers closer together.
3759#
3760# See also cache_swap_high and cache_replacement_policy
3761#Default:
3762# cache_swap_low 90
3763
3764# TAG: cache_swap_high (percent, 0-100)
3765# The high-water mark for AUFS/UFS/diskd cache object eviction by
3766# the cache_replacement_policy algorithm.
3767#
3768# Removal begins when the swap (disk) usage of a cache_dir is
3769# above the low-water mark set by cache_swap_low and attempts to
3770# maintain utilization near the low-water mark.
3771#
3772# As swap utilization increases towards this high-water mark object
3773# eviction becomes more agressive.
3774#
3775# The value difference in percentages between low- and high-water
3776# marks represent an eviction rate of 300 objects per second and
3777# the rate continues to scale in agressiveness by multiples of
3778# this above the high-water mark.
3779#
3780# Defaults are 90% and 95%. If you have a large cache, 5% could be
3781# hundreds of MB. If this is the case you may wish to set these
3782# numbers closer together.
3783#
3784# See also cache_swap_low and cache_replacement_policy
3785#Default:
3786# cache_swap_high 95
3787
3788# LOGFILE OPTIONS
3789# -----------------------------------------------------------------------------
3790
3791# TAG: logformat
3792# Usage:
3793#
3794# logformat <name> <format specification>
3795#
3796# Defines an access log format.
3797#
3798# The <format specification> is a string with embedded % format codes
3799#
3800# % format codes all follow the same basic structure where all but
3801# the formatcode is optional. Output strings are automatically escaped
3802# as required according to their context and the output format
3803# modifiers are usually not needed, but can be specified if an explicit
3804# output format is desired.
3805#
3806# % ["|[|'|#|/] [-] [[0]width] [{arg}] formatcode [{arg}]
3807#
3808# " output in quoted string format
3809# [ output in squid text log format as used by log_mime_hdrs
3810# # output in URL quoted format
3811# / output in shell \-escaped format
3812# ' output as-is
3813#
3814# - left aligned
3815#
3816# width minimum and/or maximum field width:
3817# [width_min][.width_max]
3818# When minimum starts with 0, the field is zero-padded.
3819# String values exceeding maximum width are truncated.
3820#
3821# {arg} argument such as header name etc. This field may be
3822# placed before or after the token, but not both at once.
3823#
3824# Format codes:
3825#
3826# % a literal % character
3827# sn Unique sequence number per log line entry
3828# err_code The ID of an error response served by Squid or
3829# a similar internal error identifier.
3830# err_detail Additional err_code-dependent error information.
3831# note The annotation specified by the argument. Also
3832# logs the adaptation meta headers set by the
3833# adaptation_meta configuration parameter.
3834# If no argument given all annotations logged.
3835# The argument may include a separator to use with
3836# annotation values:
3837# name[:separator]
3838# By default, multiple note values are separated with ","
3839# and multiple notes are separated with "\r\n".
3840# When logging named notes with %{name}note, the
3841# explicitly configured separator is used between note
3842# values. When logging all notes with %note, the
3843# explicitly configured separator is used between
3844# individual notes. There is currently no way to
3845# specify both value and notes separators when logging
3846# all notes with %note.
3847#
3848# Connection related format codes:
3849#
3850# >a Client source IP address
3851# >A Client FQDN
3852# >p Client source port
3853# >eui Client source EUI (MAC address, EUI-48 or EUI-64 identifier)
3854# >la Local IP address the client connected to
3855# >lp Local port number the client connected to
3856# >qos Client connection TOS/DSCP value set by Squid
3857# >nfmark Client connection netfilter mark set by Squid
3858#
3859# la Local listening IP address the client connection was connected to.
3860# lp Local listening port number the client connection was connected to.
3861#
3862# <a Server IP address of the last server or peer connection
3863# <A Server FQDN or peer name
3864# <p Server port number of the last server or peer connection
3865# <la Local IP address of the last server or peer connection
3866# <lp Local port number of the last server or peer connection
3867# <qos Server connection TOS/DSCP value set by Squid
3868# <nfmark Server connection netfilter mark set by Squid
3869#
3870# Time related format codes:
3871#
3872# ts Seconds since epoch
3873# tu subsecond time (milliseconds)
3874# tl Local time. Optional strftime format argument
3875# default %d/%b/%Y:%H:%M:%S %z
3876# tg GMT time. Optional strftime format argument
3877# default %d/%b/%Y:%H:%M:%S %z
3878# tr Response time (milliseconds)
3879# dt Total time spent making DNS lookups (milliseconds)
3880# tS Approximate master transaction start time in
3881# <full seconds since epoch>.<fractional seconds> format.
3882# Currently, Squid considers the master transaction
3883# started when a complete HTTP request header initiating
3884# the transaction is received from the client. This is
3885# the same value that Squid uses to calculate transaction
3886# response time when logging %tr to access.log. Currently,
3887# Squid uses millisecond resolution for %tS values,
3888# similar to the default access.log "current time" field
3889# (%ts.%03tu).
3890#
3891# Access Control related format codes:
3892#
3893# et Tag returned by external acl
3894# ea Log string returned by external acl
3895# un User name (any available)
3896# ul User name from authentication
3897# ue User name from external acl helper
3898# ui User name from ident
3899# un A user name. Expands to the first available name
3900# from the following list of information sources:
3901# - authenticated user name, like %ul
3902# - user name supplied by an external ACL, like %ue
3903# - SSL client name, like %us
3904# - ident user name, like %ui
3905# credentials Client credentials. The exact meaning depends on
3906# the authentication scheme: For Basic authentication,
3907# it is the password; for Digest, the realm sent by the
3908# client; for NTLM and Negotiate, the client challenge
3909# or client credentials prefixed with "YR " or "KK ".
3910#
3911# HTTP related format codes:
3912#
3913# REQUEST
3914#
3915# [http::]rm Request method (GET/POST etc)
3916# [http::]>rm Request method from client
3917# [http::]<rm Request method sent to server or peer
3918# [http::]ru Request URL from client (historic, filtered for logging)
3919# [http::]>ru Request URL from client
3920# [http::]<ru Request URL sent to server or peer
3921# [http::]>rs Request URL scheme from client
3922# [http::]<rs Request URL scheme sent to server or peer
3923# [http::]>rd Request URL domain from client
3924# [http::]<rd Request URL domain sent to server or peer
3925# [http::]>rP Request URL port from client
3926# [http::]<rP Request URL port sent to server or peer
3927# [http::]rp Request URL path excluding hostname
3928# [http::]>rp Request URL path excluding hostname from client
3929# [http::]<rp Request URL path excluding hostname sent to server or peer
3930# [http::]rv Request protocol version
3931# [http::]>rv Request protocol version from client
3932# [http::]<rv Request protocol version sent to server or peer
3933#
3934# [http::]>h Original received request header.
3935# Usually differs from the request header sent by
3936# Squid, although most fields are often preserved.
3937# Accepts optional header field name/value filter
3938# argument using name[:[separator]element] format.
3939# [http::]>ha Received request header after adaptation and
3940# redirection (pre-cache REQMOD vectoring point).
3941# Usually differs from the request header sent by
3942# Squid, although most fields are often preserved.
3943# Optional header name argument as for >h
3944#
3945# RESPONSE
3946#
3947# [http::]<Hs HTTP status code received from the next hop
3948# [http::]>Hs HTTP status code sent to the client
3949#
3950# [http::]<h Reply header. Optional header name argument
3951# as for >h
3952#
3953# [http::]mt MIME content type
3954#
3955#
3956# SIZE COUNTERS
3957#
3958# [http::]st Total size of request + reply traffic with client
3959# [http::]>st Total size of request received from client.
3960# Excluding chunked encoding bytes.
3961# [http::]<st Total size of reply sent to client (after adaptation)
3962#
3963# [http::]>sh Size of request headers received from client
3964# [http::]<sh Size of reply headers sent to client (after adaptation)
3965#
3966# [http::]<sH Reply high offset sent
3967# [http::]<sS Upstream object size
3968#
3969# [http::]<bs Number of HTTP-equivalent message body bytes
3970# received from the next hop, excluding chunked
3971# transfer encoding and control messages.
3972# Generated FTP/Gopher listings are treated as
3973# received bodies.
3974#
3975# TIMING
3976#
3977# [http::]<pt Peer response time in milliseconds. The timer starts
3978# when the last request byte is sent to the next hop
3979# and stops when the last response byte is received.
3980# [http::]<tt Total time in milliseconds. The timer
3981# starts with the first connect request (or write I/O)
3982# sent to the first selected peer. The timer stops
3983# with the last I/O with the last peer.
3984#
3985# Squid handling related format codes:
3986#
3987# Ss Squid request status (TCP_MISS etc)
3988# Sh Squid hierarchy status (DEFAULT_PARENT etc)
3989#
3990# SSL-related format codes:
3991#
3992# ssl::bump_mode SslBump decision for the transaction:
3993#
3994# For CONNECT requests that initiated bumping of
3995# a connection and for any request received on
3996# an already bumped connection, Squid logs the
3997# corresponding SslBump mode ("splice", "bump",
3998# "peek", "stare", "terminate", "server-first"
3999# or "client-first"). See the ssl_bump option
4000# for more information about these modes.
4001#
4002# A "none" token is logged for requests that
4003# triggered "ssl_bump" ACL evaluation matching
4004# a "none" rule.
4005#
4006# In all other cases, a single dash ("-") is
4007# logged.
4008#
4009# ssl::>sni SSL client SNI sent to Squid.
4010#
4011# ssl::>cert_subject
4012# The Subject field of the received client
4013# SSL certificate or a dash ('-') if Squid has
4014# received an invalid/malformed certificate or
4015# no certificate at all. Consider encoding the
4016# logged value because Subject often has spaces.
4017#
4018# ssl::>cert_issuer
4019# The Issuer field of the received client
4020# SSL certificate or a dash ('-') if Squid has
4021# received an invalid/malformed certificate or
4022# no certificate at all. Consider encoding the
4023# logged value because Issuer often has spaces.
4024#
4025# ssl::<cert_subject
4026# The Subject field of the received server
4027# TLS certificate or a dash ('-') if this is
4028# not available. Consider encoding the logged
4029# value because Subject often has spaces.
4030#
4031# ssl::<cert_issuer
4032# The Issuer field of the received server
4033# TLS certificate or a dash ('-') if this is
4034# not available. Consider encoding the logged
4035# value because Issuer often has spaces.
4036#
4037# ssl::<cert_errors
4038# The list of certificate validation errors
4039# detected by Squid (including OpenSSL and
4040# certificate validation helper components). The
4041# errors are listed in the discovery order. By
4042# default, the error codes are separated by ':'.
4043# Accepts an optional separator argument.
4044#
4045# %ssl::>negotiated_version The negotiated TLS version of the
4046# client connection.
4047#
4048# %ssl::<negotiated_version The negotiated TLS version of the
4049# last server or peer connection.
4050#
4051# %ssl::>received_hello_version The TLS version of the Hello
4052# message received from TLS client.
4053#
4054# %ssl::<received_hello_version The TLS version of the Hello
4055# message received from TLS server.
4056#
4057# %ssl::>received_supported_version The maximum TLS version
4058# supported by the TLS client.
4059#
4060# %ssl::<received_supported_version The maximum TLS version
4061# supported by the TLS server.
4062#
4063# %ssl::>negotiated_cipher The negotiated cipher of the
4064# client connection.
4065#
4066# %ssl::<negotiated_cipher The negotiated cipher of the
4067# last server or peer connection.
4068#
4069# If ICAP is enabled, the following code becomes available (as
4070# well as ICAP log codes documented with the icap_log option):
4071#
4072# icap::tt Total ICAP processing time for the HTTP
4073# transaction. The timer ticks when ICAP
4074# ACLs are checked and when ICAP
4075# transaction is in progress.
4076#
4077# If adaptation is enabled the following codes become available:
4078#
4079# adapt::<last_h The header of the last ICAP response or
4080# meta-information from the last eCAP
4081# transaction related to the HTTP transaction.
4082# Like <h, accepts an optional header name
4083# argument.
4084#
4085# adapt::sum_trs Summed adaptation transaction response
4086# times recorded as a comma-separated list in
4087# the order of transaction start time. Each time
4088# value is recorded as an integer number,
4089# representing response time of one or more
4090# adaptation (ICAP or eCAP) transaction in
4091# milliseconds. When a failed transaction is
4092# being retried or repeated, its time is not
4093# logged individually but added to the
4094# replacement (next) transaction. See also:
4095# adapt::all_trs.
4096#
4097# adapt::all_trs All adaptation transaction response times.
4098# Same as adaptation_strs but response times of
4099# individual transactions are never added
4100# together. Instead, all transaction response
4101# times are recorded individually.
4102#
4103# You can prefix adapt::*_trs format codes with adaptation
4104# service name in curly braces to record response time(s) specific
4105# to that service. For example: %{my_service}adapt::sum_trs
4106#
4107# The default formats available (which do not need re-defining) are:
4108#
4109#logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
4110#logformat common %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st %Ss:%Sh
4111#logformat combined %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
4112#logformat referrer %ts.%03tu %>a %{Referer}>h %ru
4113#logformat useragent %>a [%tl] "%{User-Agent}>h"
4114#
4115# NOTE: When the log_mime_hdrs directive is set to ON.
4116# The squid, common and combined formats have a safely encoded copy
4117# of the mime headers appended to each line within a pair of brackets.
4118#
4119# NOTE: The common and combined formats are not quite true to the Apache definition.
4120# The logs from Squid contain an extra status and hierarchy code appended.
4121#
4122#Default:
4123# The format definitions squid, common, combined, referrer, useragent are built in.
4124
4125# TAG: access_log
4126# Configures whether and how Squid logs HTTP and ICP transactions.
4127# If access logging is enabled, a single line is logged for every
4128# matching HTTP or ICP request. The recommended directive formats are:
4129#
4130# access_log <module>:<place> [option ...] [acl acl ...]
4131# access_log none [acl acl ...]
4132#
4133# The following directive format is accepted but may be deprecated:
4134# access_log <module>:<place> [<logformat name> [acl acl ...]]
4135#
4136# In most cases, the first ACL name must not contain the '=' character
4137# and should not be equal to an existing logformat name. You can always
4138# start with an 'all' ACL to work around those restrictions.
4139#
4140# Will log to the specified module:place using the specified format (which
4141# must be defined in a logformat directive) those entries which match
4142# ALL the acl's specified (which must be defined in acl clauses).
4143# If no acl is specified, all requests will be logged to this destination.
4144#
4145# ===== Available options for the recommended directive format =====
4146#
4147# logformat=name Names log line format (either built-in or
4148# defined by a logformat directive). Defaults
4149# to 'squid'.
4150#
4151# buffer-size=64KB Defines approximate buffering limit for log
4152# records (see buffered_logs). Squid should not
4153# keep more than the specified size and, hence,
4154# should flush records before the buffer becomes
4155# full to avoid overflows under normal
4156# conditions (the exact flushing algorithm is
4157# module-dependent though). The on-error option
4158# controls overflow handling.
4159#
4160# on-error=die|drop Defines action on unrecoverable errors. The
4161# 'drop' action ignores (i.e., does not log)
4162# affected log records. The default 'die' action
4163# kills the affected worker. The drop action
4164# support has not been tested for modules other
4165# than tcp.
4166#
4167# rotate=N Specifies the number of log file rotations to
4168# make when you run 'squid -k rotate'. The default
4169# is to obey the logfile_rotate directive. Setting
4170# rotate=0 will disable the file name rotation,
4171# but the log files are still closed and re-opened.
4172# This will enable you to rename the logfiles
4173# yourself just before sending the rotate signal.
4174# Only supported by the stdio module.
4175#
4176# ===== Modules Currently available =====
4177#
4178# none Do not log any requests matching these ACL.
4179# Do not specify Place or logformat name.
4180#
4181# stdio Write each log line to disk immediately at the completion of
4182# each request.
4183# Place: the filename and path to be written.
4184#
4185# daemon Very similar to stdio. But instead of writing to disk the log
4186# line is passed to a daemon helper for asychronous handling instead.
4187# Place: varies depending on the daemon.
4188#
4189# log_file_daemon Place: the file name and path to be written.
4190#
4191# syslog To log each request via syslog facility.
4192# Place: The syslog facility and priority level for these entries.
4193# Place Format: facility.priority
4194#
4195# where facility could be any of:
4196# authpriv, daemon, local0 ... local7 or user.
4197#
4198# And priority could be any of:
4199# err, warning, notice, info, debug.
4200#
4201# udp To send each log line as text data to a UDP receiver.
4202# Place: The destination host name or IP and port.
4203# Place Format: //host:port
4204#
4205# tcp To send each log line as text data to a TCP receiver.
4206# Lines may be accumulated before sending (see buffered_logs).
4207# Place: The destination host name or IP and port.
4208# Place Format: //host:port
4209#
4210# Default:
4211# access_log daemon:/var/log/squid/access.log squid
4212#Default:
4213# access_log daemon:/var/log/squid/access.log squid
4214
4215# TAG: icap_log
4216# ICAP log files record ICAP transaction summaries, one line per
4217# transaction.
4218#
4219# The icap_log option format is:
4220# icap_log <filepath> [<logformat name> [acl acl ...]]
4221# icap_log none [acl acl ...]]
4222#
4223# Please see access_log option documentation for details. The two
4224# kinds of logs share the overall configuration approach and many
4225# features.
4226#
4227# ICAP processing of a single HTTP message or transaction may
4228# require multiple ICAP transactions. In such cases, multiple
4229# ICAP transaction log lines will correspond to a single access
4230# log line.
4231#
4232# ICAP log supports many access.log logformat %codes. In ICAP context,
4233# HTTP message-related %codes are applied to the HTTP message embedded
4234# in an ICAP message. Logformat "%http::>..." codes are used for HTTP
4235# messages embedded in ICAP requests while "%http::<..." codes are used
4236# for HTTP messages embedded in ICAP responses. For example:
4237#
4238# http::>h To-be-adapted HTTP message headers sent by Squid to
4239# the ICAP service. For REQMOD transactions, these are
4240# HTTP request headers. For RESPMOD, these are HTTP
4241# response headers, but Squid currently cannot log them
4242# (i.e., %http::>h will expand to "-" for RESPMOD).
4243#
4244# http::<h Adapted HTTP message headers sent by the ICAP
4245# service to Squid (i.e., HTTP request headers in regular
4246# REQMOD; HTTP response headers in RESPMOD and during
4247# request satisfaction in REQMOD).
4248#
4249# ICAP OPTIONS transactions do not embed HTTP messages.
4250#
4251# Several logformat codes below deal with ICAP message bodies. An ICAP
4252# message body, if any, typically includes a complete HTTP message
4253# (required HTTP headers plus optional HTTP message body). When
4254# computing HTTP message body size for these logformat codes, Squid
4255# either includes or excludes chunked encoding overheads; see
4256# code-specific documentation for details.
4257#
4258# For Secure ICAP services, all size-related information is currently
4259# computed before/after TLS encryption/decryption, as if TLS was not
4260# in use at all.
4261#
4262# The following format codes are also available for ICAP logs:
4263#
4264# icap::<A ICAP server IP address. Similar to <A.
4265#
4266# icap::<service_name ICAP service name from the icap_service
4267# option in Squid configuration file.
4268#
4269# icap::ru ICAP Request-URI. Similar to ru.
4270#
4271# icap::rm ICAP request method (REQMOD, RESPMOD, or
4272# OPTIONS). Similar to existing rm.
4273#
4274# icap::>st The total size of the ICAP request sent to the ICAP
4275# server (ICAP headers + ICAP body), including chunking
4276# metadata (if any).
4277#
4278# icap::<st The total size of the ICAP response received from the
4279# ICAP server (ICAP headers + ICAP body), including
4280# chunking metadata (if any).
4281#
4282# icap::<bs The size of the ICAP response body received from the
4283# ICAP server, excluding chunking metadata (if any).
4284#
4285# icap::tr Transaction response time (in
4286# milliseconds). The timer starts when
4287# the ICAP transaction is created and
4288# stops when the transaction is completed.
4289# Similar to tr.
4290#
4291# icap::tio Transaction I/O time (in milliseconds). The
4292# timer starts when the first ICAP request
4293# byte is scheduled for sending. The timers
4294# stops when the last byte of the ICAP response
4295# is received.
4296#
4297# icap::to Transaction outcome: ICAP_ERR* for all
4298# transaction errors, ICAP_OPT for OPTION
4299# transactions, ICAP_ECHO for 204
4300# responses, ICAP_MOD for message
4301# modification, and ICAP_SAT for request
4302# satisfaction. Similar to Ss.
4303#
4304# icap::Hs ICAP response status code. Similar to Hs.
4305#
4306# icap::>h ICAP request header(s). Similar to >h.
4307#
4308# icap::<h ICAP response header(s). Similar to <h.
4309#
4310# The default ICAP log format, which can be used without an explicit
4311# definition, is called icap_squid:
4312#
4313#logformat icap_squid %ts.%03tu %6icap::tr %>A %icap::to/%03icap::Hs %icap::<st %icap::rm %icap::ru %un -/%icap::<A -
4314#
4315# See also: logformat and %adapt::<last_h
4316#Default:
4317# none
4318
4319# TAG: logfile_daemon
4320# Specify the path to the logfile-writing daemon. This daemon is
4321# used to write the access and store logs, if configured.
4322#
4323# Squid sends a number of commands to the log daemon:
4324# L<data>\n - logfile data
4325# R\n - rotate file
4326# T\n - truncate file
4327# O\n - reopen file
4328# F\n - flush file
4329# r<n>\n - set rotate count to <n>
4330# b<n>\n - 1 = buffer output, 0 = don't buffer output
4331#
4332# No responses is expected.
4333#Default:
4334# logfile_daemon /usr/lib/squid/log_file_daemon
4335
4336# TAG: stats_collection allow|deny acl acl...
4337# This options allows you to control which requests gets accounted
4338# in performance counters.
4339#
4340# This clause only supports fast acl types.
4341# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
4342#Default:
4343# Allow logging for all transactions.
4344
4345# TAG: cache_store_log
4346# Logs the activities of the storage manager. Shows which
4347# objects are ejected from the cache, and which objects are
4348# saved and for how long.
4349# There are not really utilities to analyze this data, so you can safely
4350# disable it (the default).
4351#
4352# Store log uses modular logging outputs. See access_log for the list
4353# of modules supported.
4354#
4355# Example:
4356# cache_store_log stdio:/var/log/squid/store.log
4357# cache_store_log daemon:/var/log/squid/store.log
4358#Default:
4359# none
4360
4361# TAG: cache_swap_state
4362# Location for the cache "swap.state" file. This index file holds
4363# the metadata of objects saved on disk. It is used to rebuild
4364# the cache during startup. Normally this file resides in each
4365# 'cache_dir' directory, but you may specify an alternate
4366# pathname here. Note you must give a full filename, not just
4367# a directory. Since this is the index for the whole object
4368# list you CANNOT periodically rotate it!
4369#
4370# If %s can be used in the file name it will be replaced with a
4371# a representation of the cache_dir name where each / is replaced
4372# with '.'. This is needed to allow adding/removing cache_dir
4373# lines when cache_swap_log is being used.
4374#
4375# If have more than one 'cache_dir', and %s is not used in the name
4376# these swap logs will have names such as:
4377#
4378# cache_swap_log.00
4379# cache_swap_log.01
4380# cache_swap_log.02
4381#
4382# The numbered extension (which is added automatically)
4383# corresponds to the order of the 'cache_dir' lines in this
4384# configuration file. If you change the order of the 'cache_dir'
4385# lines in this file, these index files will NOT correspond to
4386# the correct 'cache_dir' entry (unless you manually rename
4387# them). We recommend you do NOT use this option. It is
4388# better to keep these index files in each 'cache_dir' directory.
4389#Default:
4390# Store the journal inside its cache_dir
4391
4392# TAG: logfile_rotate
4393# Specifies the default number of logfile rotations to make when you
4394# type 'squid -k rotate'. The default is 10, which will rotate
4395# with extensions 0 through 9. Setting logfile_rotate to 0 will
4396# disable the file name rotation, but the logfiles are still closed
4397# and re-opened. This will enable you to rename the logfiles
4398# yourself just before sending the rotate signal.
4399#
4400# Note, from Squid-3.1 this option is only a default for cache.log,
4401# that log can be rotated separately by using debug_options.
4402#
4403# Note, from Squid-4 this option is only a default for access.log
4404# recorded by stdio: module. Those logs can be rotated separately by
4405# using the rotate=N option on their access_log directive.
4406#
4407# Note, the 'squid -k rotate' command normally sends a USR1
4408# signal to the running squid process. In certain situations
4409# (e.g. on Linux with Async I/O), USR1 is used for other
4410# purposes, so -k rotate uses another signal. It is best to get
4411# in the habit of using 'squid -k rotate' instead of 'kill -USR1
4412# <pid>'.
4413#
4414# Note, for Debian/Linux the default of logfile_rotate is
4415# zero, since it includes external logfile-rotation methods.
4416#Default:
4417# logfile_rotate 0
4418
4419# TAG: mime_table
4420# Path to Squid's icon configuration file.
4421#
4422# You shouldn't need to change this, but the default file contains
4423# examples and formatting information if you do.
4424#Default:
4425# mime_table /usr/share/squid/mime.conf
4426
4427# TAG: log_mime_hdrs on|off
4428# The Cache can record both the request and the response MIME
4429# headers for each HTTP transaction. The headers are encoded
4430# safely and will appear as two bracketed fields at the end of
4431# the access log (for either the native or httpd-emulated log
4432# formats). To enable this logging set log_mime_hdrs to 'on'.
4433#Default:
4434# log_mime_hdrs off
4435
4436# TAG: pid_filename
4437# A filename to write the process-id to. To disable, enter "none".
4438#Default:
4439# pid_filename /var/run/squid.pid
4440
4441# TAG: client_netmask
4442# A netmask for client addresses in logfiles and cachemgr output.
4443# Change this to protect the privacy of your cache clients.
4444# A netmask of 255.255.255.0 will log all IP's in that range with
4445# the last digit set to '0'.
4446#Default:
4447# Log full client IP address
4448
4449# TAG: strip_query_terms
4450# By default, Squid strips query terms from requested URLs before
4451# logging. This protects your user's privacy and reduces log size.
4452#
4453# When investigating HIT/MISS or other caching behaviour you
4454# will need to disable this to see the full URL used by Squid.
4455#Default:
4456# strip_query_terms on
4457
4458# TAG: buffered_logs on|off
4459# Whether to write/send access_log records ASAP or accumulate them and
4460# then write/send them in larger chunks. Buffering may improve
4461# performance because it decreases the number of I/Os. However,
4462# buffering increases the delay before log records become available to
4463# the final recipient (e.g., a disk file or logging daemon) and,
4464# hence, increases the risk of log records loss.
4465#
4466# Note that even when buffered_logs are off, Squid may have to buffer
4467# records if it cannot write/send them immediately due to pending I/Os
4468# (e.g., the I/O writing the previous log record) or connectivity loss.
4469#
4470# Currently honored by 'daemon' and 'tcp' access_log modules only.
4471#Default:
4472# buffered_logs off
4473
4474# TAG: netdb_filename
4475# Where Squid stores it's netdb journal.
4476# When enabled this journal preserves netdb state between restarts.
4477#
4478# To disable, enter "none".
4479#Default:
4480# netdb_filename stdio:/var/spool/squid/netdb.state
4481
4482# OPTIONS FOR TROUBLESHOOTING
4483# -----------------------------------------------------------------------------
4484
4485# TAG: cache_log
4486# Squid administrative logging file.
4487#
4488# This is where general information about Squid behavior goes. You can
4489# increase the amount of data logged to this file and how often it is
4490# rotated with "debug_options"
4491#Default:
4492# cache_log /var/log/squid/cache.log
4493
4494# TAG: debug_options
4495# Logging options are set as section,level where each source file
4496# is assigned a unique section. Lower levels result in less
4497# output, Full debugging (level 9) can result in a very large
4498# log file, so be careful.
4499#
4500# The magic word "ALL" sets debugging levels for all sections.
4501# The default is to run with "ALL,1" to record important warnings.
4502#
4503# The rotate=N option can be used to keep more or less of these logs
4504# than would otherwise be kept by logfile_rotate.
4505# For most uses a single log should be enough to monitor current
4506# events affecting Squid.
4507#Default:
4508# Log all critical and important messages.
4509
4510# TAG: coredump_dir
4511# By default Squid leaves core files in the directory from where
4512# it was started. If you set 'coredump_dir' to a directory
4513# that exists, Squid will chdir() to that directory at startup
4514# and coredump files will be left there.
4515#
4516#Default:
4517# Use the directory from where Squid was started.
4518#
4519
4520# Leave coredumps in the first cache dir
4521coredump_dir /var/spool/squid
4522
4523# OPTIONS FOR FTP GATEWAYING
4524# -----------------------------------------------------------------------------
4525
4526# TAG: ftp_user
4527# If you want the anonymous login password to be more informative
4528# (and enable the use of picky FTP servers), set this to something
4529# reasonable for your domain, like wwwuser@somewhere.net
4530#
4531# The reason why this is domainless by default is the
4532# request can be made on the behalf of a user in any domain,
4533# depending on how the cache is used.
4534# Some FTP server also validate the email address is valid
4535# (for example perl.com).
4536#Default:
4537# ftp_user Squid@
4538
4539# TAG: ftp_passive
4540# If your firewall does not allow Squid to use passive
4541# connections, turn off this option.
4542#
4543# Use of ftp_epsv_all option requires this to be ON.
4544#Default:
4545# ftp_passive on
4546
4547# TAG: ftp_epsv_all
4548# FTP Protocol extensions permit the use of a special "EPSV ALL" command.
4549#
4550# NATs may be able to put the connection on a "fast path" through the
4551# translator, as the EPRT command will never be used and therefore,
4552# translation of the data portion of the segments will never be needed.
4553#
4554# When a client only expects to do two-way FTP transfers this may be
4555# useful.
4556# If squid finds that it must do a three-way FTP transfer after issuing
4557# an EPSV ALL command, the FTP session will fail.
4558#
4559# If you have any doubts about this option do not use it.
4560# Squid will nicely attempt all other connection methods.
4561#
4562# Requires ftp_passive to be ON (default) for any effect.
4563#Default:
4564# ftp_epsv_all off
4565
4566# TAG: ftp_epsv
4567# FTP Protocol extensions permit the use of a special "EPSV" command.
4568#
4569# NATs may be able to put the connection on a "fast path" through the
4570# translator using EPSV, as the EPRT command will never be used
4571# and therefore, translation of the data portion of the segments
4572# will never be needed.
4573#
4574# EPSV is often required to interoperate with FTP servers on IPv6
4575# networks. On the other hand, it may break some IPv4 servers.
4576#
4577# By default, EPSV may try EPSV with any FTP server. To fine tune
4578# that decision, you may restrict EPSV to certain clients or servers
4579# using ACLs:
4580#
4581# ftp_epsv allow|deny al1 acl2 ...
4582#
4583# WARNING: Disabling EPSV may cause problems with external NAT and IPv6.
4584#
4585# Only fast ACLs are supported.
4586# Requires ftp_passive to be ON (default) for any effect.
4587#Default:
4588# none
4589
4590# TAG: ftp_eprt
4591# FTP Protocol extensions permit the use of a special "EPRT" command.
4592#
4593# This extension provides a protocol neutral alternative to the
4594# IPv4-only PORT command. When supported it enables active FTP data
4595# channels over IPv6 and efficient NAT handling.
4596#
4597# Turning this OFF will prevent EPRT being attempted and will skip
4598# straight to using PORT for IPv4 servers.
4599#
4600# Some devices are known to not handle this extension correctly and
4601# may result in crashes. Devices which suport EPRT enough to fail
4602# cleanly will result in Squid attempting PORT anyway. This directive
4603# should only be disabled when EPRT results in device failures.
4604#
4605# WARNING: Doing so will convert Squid back to the old behavior with all
4606# the related problems with external NAT devices/layers and IPv4-only FTP.
4607#Default:
4608# ftp_eprt on
4609
4610# TAG: ftp_sanitycheck
4611# For security and data integrity reasons Squid by default performs
4612# sanity checks of the addresses of FTP data connections ensure the
4613# data connection is to the requested server. If you need to allow
4614# FTP connections to servers using another IP address for the data
4615# connection turn this off.
4616#Default:
4617# ftp_sanitycheck on
4618
4619# TAG: ftp_telnet_protocol
4620# The FTP protocol is officially defined to use the telnet protocol
4621# as transport channel for the control connection. However, many
4622# implementations are broken and does not respect this aspect of
4623# the FTP protocol.
4624#
4625# If you have trouble accessing files with ASCII code 255 in the
4626# path or similar problems involving this ASCII code you can
4627# try setting this directive to off. If that helps, report to the
4628# operator of the FTP server in question that their FTP server
4629# is broken and does not follow the FTP standard.
4630#Default:
4631# ftp_telnet_protocol on
4632
4633# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
4634# -----------------------------------------------------------------------------
4635
4636# TAG: diskd_program
4637# Specify the location of the diskd executable.
4638# Note this is only useful if you have compiled in
4639# diskd as one of the store io modules.
4640#Default:
4641# diskd_program /usr/lib/squid/diskd
4642
4643# TAG: unlinkd_program
4644# Specify the location of the executable for file deletion process.
4645#Default:
4646# unlinkd_program /usr/lib/squid/unlinkd
4647
4648# TAG: pinger_program
4649# Specify the location of the executable for the pinger process.
4650#Default:
4651# pinger_program /usr/lib/squid/pinger
4652
4653# TAG: pinger_enable
4654# Control whether the pinger is active at run-time.
4655# Enables turning ICMP pinger on and off with a simple
4656# squid -k reconfigure.
4657#Default:
4658# pinger_enable on
4659
4660# OPTIONS FOR URL REWRITING
4661# -----------------------------------------------------------------------------
4662
4663# TAG: url_rewrite_program
4664# Specify the location of the executable URL rewriter to use.
4665# Since they can perform almost any function there isn't one included.
4666#
4667# For each requested URL, the rewriter will receive on line with the format
4668#
4669# [channel-ID <SP>] URL [<SP> extras]<NL>
4670#
4671# See url_rewrite_extras on how to send "extras" with optional values to
4672# the helper.
4673# After processing the request the helper must reply using the following format:
4674#
4675# [channel-ID <SP>] result [<SP> kv-pairs]
4676#
4677# The result code can be:
4678#
4679# OK status=30N url="..."
4680# Redirect the URL to the one supplied in 'url='.
4681# 'status=' is optional and contains the status code to send
4682# the client in Squids HTTP response. It must be one of the
4683# HTTP redirect status codes: 301, 302, 303, 307, 308.
4684# When no status is given Squid will use 302.
4685#
4686# OK rewrite-url="..."
4687# Rewrite the URL to the one supplied in 'rewrite-url='.
4688# The new URL is fetched directly by Squid and returned to
4689# the client as the response to its request.
4690#
4691# OK
4692# When neither of url= and rewrite-url= are sent Squid does
4693# not change the URL.
4694#
4695# ERR
4696# Do not change the URL.
4697#
4698# BH
4699# An internal error occurred in the helper, preventing
4700# a result being identified. The 'message=' key name is
4701# reserved for delivering a log message.
4702#
4703#
4704# In addition to the above kv-pairs Squid also understands the following
4705# optional kv-pairs received from URL rewriters:
4706# clt_conn_tag=TAG
4707# Associates a TAG with the client TCP connection.
4708# The TAG is treated as a regular annotation but persists across
4709# future requests on the client connection rather than just the
4710# current request. A helper may update the TAG during subsequent
4711# requests be returning a new kv-pair.
4712#
4713# When using the concurrency= option the protocol is changed by
4714# introducing a query channel tag in front of the request/response.
4715# The query channel tag is a number between 0 and concurrency-1.
4716# This value must be echoed back unchanged to Squid as the first part
4717# of the response relating to its request.
4718#
4719# WARNING: URL re-writing ability should be avoided whenever possible.
4720# Use the URL redirect form of response instead.
4721#
4722# Re-write creates a difference in the state held by the client
4723# and server. Possibly causing confusion when the server response
4724# contains snippets of its view state. Embeded URLs, response
4725# and content Location headers, etc. are not re-written by this
4726# interface.
4727#
4728# By default, a URL rewriter is not used.
4729#Default:
4730# none
4731
4732# TAG: url_rewrite_children
4733# The maximum number of redirector processes to spawn. If you limit
4734# it too few Squid will have to wait for them to process a backlog of
4735# URLs, slowing it down. If you allow too many they will use RAM
4736# and other system resources noticably.
4737#
4738# The startup= and idle= options allow some measure of skew in your
4739# tuning.
4740#
4741# startup=
4742#
4743# Sets a minimum of how many processes are to be spawned when Squid
4744# starts or reconfigures. When set to zero the first request will
4745# cause spawning of the first child process to handle it.
4746#
4747# Starting too few will cause an initial slowdown in traffic as Squid
4748# attempts to simultaneously spawn enough processes to cope.
4749#
4750# idle=
4751#
4752# Sets a minimum of how many processes Squid is to try and keep available
4753# at all times. When traffic begins to rise above what the existing
4754# processes can handle this many more will be spawned up to the maximum
4755# configured. A minimum setting of 1 is required.
4756#
4757# concurrency=
4758#
4759# The number of requests each redirector helper can handle in
4760# parallel. Defaults to 0 which indicates the redirector
4761# is a old-style single threaded redirector.
4762#
4763# When this directive is set to a value >= 1 then the protocol
4764# used to communicate with the helper is modified to include
4765# an ID in front of the request/response. The ID from the request
4766# must be echoed back with the response to that request.
4767#
4768# queue-size=N
4769#
4770# Sets the maximum number of queued requests to N. The default maximum
4771# is 2*numberofchildren. If the queued requests exceed queue size and
4772# redirector_bypass configuration option is set, then redirector is bypassed.
4773# Otherwise, Squid is allowed to temporarily exceed the configured maximum,
4774# marking the affected helper as "overloaded". If the helper overload lasts
4775# more than 3 minutes, the action prescribed by the on-persistent-overload
4776# option applies.
4777#
4778# on-persistent-overload=action
4779#
4780# Specifies Squid reaction to a new helper request arriving when the helper
4781# has been overloaded for more that 3 minutes already. The number of queued
4782# requests determines whether the helper is overloaded (see the queue-size
4783# option).
4784#
4785# Two actions are supported:
4786#
4787# die Squid worker quits. This is the default behavior.
4788#
4789# ERR Squid treats the helper request as if it was
4790# immediately submitted, and the helper immediately
4791# replied with an ERR response. This action has no effect
4792# on the already queued and in-progress helper requests.
4793#Default:
4794# url_rewrite_children 20 startup=0 idle=1 concurrency=0
4795
4796# TAG: url_rewrite_host_header
4797# To preserve same-origin security policies in browsers and
4798# prevent Host: header forgery by redirectors Squid rewrites
4799# any Host: header in redirected requests.
4800#
4801# If you are running an accelerator this may not be a wanted
4802# effect of a redirector. This directive enables you disable
4803# Host: alteration in reverse-proxy traffic.
4804#
4805# WARNING: Entries are cached on the result of the URL rewriting
4806# process, so be careful if you have domain-virtual hosts.
4807#
4808# WARNING: Squid and other software verifies the URL and Host
4809# are matching, so be careful not to relay through other proxies
4810# or inspecting firewalls with this disabled.
4811#Default:
4812# url_rewrite_host_header on
4813
4814# TAG: url_rewrite_access
4815# If defined, this access list specifies which requests are
4816# sent to the redirector processes.
4817#
4818# This clause supports both fast and slow acl types.
4819# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
4820#Default:
4821# Allow, unless rules exist in squid.conf.
4822
4823# TAG: url_rewrite_bypass
4824# When this is 'on', a request will not go through the
4825# redirector if all the helpers are busy. If this is 'off' and the
4826# redirector queue grows too large, the action is prescribed by the
4827# on-persistent-overload option. You should only enable this if the
4828# redirectors are not critical to your caching system. If you use
4829# redirectors for access control, and you enable this option,
4830# users may have access to pages they should not
4831# be allowed to request.
4832# This options sets default queue-size option of the url_rewrite_children
4833# to 0.
4834#Default:
4835# url_rewrite_bypass off
4836
4837# TAG: url_rewrite_extras
4838# Specifies a string to be append to request line format for the
4839# rewriter helper. "Quoted" format values may contain spaces and
4840# logformat %macros. In theory, any logformat %macro can be used.
4841# In practice, a %macro expands as a dash (-) if the helper request is
4842# sent before the required macro information is available to Squid.
4843#Default:
4844# url_rewrite_extras "%>a/%>A %un %>rm myip=%la myport=%lp"
4845
4846# TAG: url_rewrite_timeout
4847# Squid times active requests to redirector. The timeout value and Squid
4848# reaction to a timed out request are configurable using the following
4849# format:
4850#
4851# url_rewrite_timeout timeout time-units on_timeout=<action> [response=<quoted-response>]
4852#
4853# supported timeout actions:
4854# fail Squid return a ERR_GATEWAY_FAILURE error page
4855#
4856# bypass Do not re-write the URL
4857#
4858# retry Send the lookup to the helper again
4859#
4860# use_configured_response
4861# Use the <quoted-response> as helper response
4862#Default:
4863# Squid waits for the helper response forever
4864
4865# OPTIONS FOR STORE ID
4866# -----------------------------------------------------------------------------
4867
4868# TAG: store_id_program
4869# Specify the location of the executable StoreID helper to use.
4870# Since they can perform almost any function there isn't one included.
4871#
4872# For each requested URL, the helper will receive one line with the format
4873#
4874# [channel-ID <SP>] URL [<SP> extras]<NL>
4875#
4876#
4877# After processing the request the helper must reply using the following format:
4878#
4879# [channel-ID <SP>] result [<SP> kv-pairs]
4880#
4881# The result code can be:
4882#
4883# OK store-id="..."
4884# Use the StoreID supplied in 'store-id='.
4885#
4886# ERR
4887# The default is to use HTTP request URL as the store ID.
4888#
4889# BH
4890# An internal error occurred in the helper, preventing
4891# a result being identified.
4892#
4893# In addition to the above kv-pairs Squid also understands the following
4894# optional kv-pairs received from URL rewriters:
4895# clt_conn_tag=TAG
4896# Associates a TAG with the client TCP connection.
4897# Please see url_rewrite_program related documentation for this
4898# kv-pair
4899#
4900# Helper programs should be prepared to receive and possibly ignore
4901# additional whitespace-separated tokens on each input line.
4902#
4903# When using the concurrency= option the protocol is changed by
4904# introducing a query channel tag in front of the request/response.
4905# The query channel tag is a number between 0 and concurrency-1.
4906# This value must be echoed back unchanged to Squid as the first part
4907# of the response relating to its request.
4908#
4909# NOTE: when using StoreID refresh_pattern will apply to the StoreID
4910# returned from the helper and not the URL.
4911#
4912# WARNING: Wrong StoreID value returned by a careless helper may result
4913# in the wrong cached response returned to the user.
4914#
4915# By default, a StoreID helper is not used.
4916#Default:
4917# none
4918
4919# TAG: store_id_extras
4920# Specifies a string to be append to request line format for the
4921# StoreId helper. "Quoted" format values may contain spaces and
4922# logformat %macros. In theory, any logformat %macro can be used.
4923# In practice, a %macro expands as a dash (-) if the helper request is
4924# sent before the required macro information is available to Squid.
4925#Default:
4926# store_id_extras "%>a/%>A %un %>rm myip=%la myport=%lp"
4927
4928# TAG: store_id_children
4929# The maximum number of StoreID helper processes to spawn. If you limit
4930# it too few Squid will have to wait for them to process a backlog of
4931# requests, slowing it down. If you allow too many they will use RAM
4932# and other system resources noticably.
4933#
4934# The startup= and idle= options allow some measure of skew in your
4935# tuning.
4936#
4937# startup=
4938#
4939# Sets a minimum of how many processes are to be spawned when Squid
4940# starts or reconfigures. When set to zero the first request will
4941# cause spawning of the first child process to handle it.
4942#
4943# Starting too few will cause an initial slowdown in traffic as Squid
4944# attempts to simultaneously spawn enough processes to cope.
4945#
4946# idle=
4947#
4948# Sets a minimum of how many processes Squid is to try and keep available
4949# at all times. When traffic begins to rise above what the existing
4950# processes can handle this many more will be spawned up to the maximum
4951# configured. A minimum setting of 1 is required.
4952#
4953# concurrency=
4954#
4955# The number of requests each storeID helper can handle in
4956# parallel. Defaults to 0 which indicates the helper
4957# is a old-style single threaded program.
4958#
4959# When this directive is set to a value >= 1 then the protocol
4960# used to communicate with the helper is modified to include
4961# an ID in front of the request/response. The ID from the request
4962# must be echoed back with the response to that request.
4963#
4964# queue-size=N
4965#
4966# Sets the maximum number of queued requests to N. The default maximum
4967# is 2*numberofchildren. If the queued requests exceed queue size and
4968# redirector_bypass configuration option is set, then redirector is bypassed.
4969# Otherwise, Squid is allowed to temporarily exceed the configured maximum,
4970# marking the affected helper as "overloaded". If the helper overload lasts
4971# more than 3 minutes, the action prescribed by the on-persistent-overload
4972# option applies.
4973#
4974# on-persistent-overload=action
4975#
4976# Specifies Squid reaction to a new helper request arriving when the helper
4977# has been overloaded for more that 3 minutes already. The number of queued
4978# requests determines whether the helper is overloaded (see the queue-size
4979# option).
4980#
4981# Two actions are supported:
4982#
4983# die Squid worker quits. This is the default behavior.
4984#
4985# ERR Squid treats the helper request as if it was
4986# immediately submitted, and the helper immediately
4987# replied with an ERR response. This action has no effect
4988# on the already queued and in-progress helper requests.
4989#Default:
4990# store_id_children 20 startup=0 idle=1 concurrency=0
4991
4992# TAG: store_id_access
4993# If defined, this access list specifies which requests are
4994# sent to the StoreID processes. By default all requests
4995# are sent.
4996#
4997# This clause supports both fast and slow acl types.
4998# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
4999#Default:
5000# Allow, unless rules exist in squid.conf.
5001
5002# TAG: store_id_bypass
5003# When this is 'on', a request will not go through the
5004# helper if all helpers are busy. If this is 'off' and the helper
5005# queue grows too large, the action is prescribed by the
5006# on-persistent-overload option. You should only enable this if the
5007# helpers are not critical to your caching system. If you use
5008# helpers for critical caching components, and you enable this
5009# option, users may not get objects from cache.
5010# This options sets default queue-size option of the store_id_children
5011# to 0.
5012#Default:
5013# store_id_bypass on
5014
5015# OPTIONS FOR TUNING THE CACHE
5016# -----------------------------------------------------------------------------
5017
5018# TAG: cache
5019# Requests denied by this directive will not be served from the cache
5020# and their responses will not be stored in the cache. This directive
5021# has no effect on other transactions and on already cached responses.
5022#
5023# This clause supports both fast and slow acl types.
5024# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
5025#
5026# This and the two other similar caching directives listed below are
5027# checked at different transaction processing stages, have different
5028# access to response information, affect different cache operations,
5029# and differ in slow ACLs support:
5030#
5031# * cache: Checked before Squid makes a hit/miss determination.
5032# No access to reply information!
5033# Denies both serving a hit and storing a miss.
5034# Supports both fast and slow ACLs.
5035# * send_hit: Checked after a hit was detected.
5036# Has access to reply (hit) information.
5037# Denies serving a hit only.
5038# Supports fast ACLs only.
5039# * store_miss: Checked before storing a cachable miss.
5040# Has access to reply (miss) information.
5041# Denies storing a miss only.
5042# Supports fast ACLs only.
5043#
5044# If you are not sure which of the three directives to use, apply the
5045# following decision logic:
5046#
5047# * If your ACL(s) are of slow type _and_ need response info, redesign.
5048# Squid does not support that particular combination at this time.
5049# Otherwise:
5050# * If your directive ACL(s) are of slow type, use "cache"; and/or
5051# * if your directive ACL(s) need no response info, use "cache".
5052# Otherwise:
5053# * If you do not want the response cached, use store_miss; and/or
5054# * if you do not want a hit on a cached response, use send_hit.
5055#Default:
5056# By default, this directive is unused and has no effect.
5057
5058# TAG: send_hit
5059# Responses denied by this directive will not be served from the cache
5060# (but may still be cached, see store_miss). This directive has no
5061# effect on the responses it allows and on the cached objects.
5062#
5063# Please see the "cache" directive for a summary of differences among
5064# store_miss, send_hit, and cache directives.
5065#
5066# Unlike the "cache" directive, send_hit only supports fast acl
5067# types. See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
5068#
5069# For example:
5070#
5071# # apply custom Store ID mapping to some URLs
5072# acl MapMe dstdomain .c.example.com
5073# store_id_program ...
5074# store_id_access allow MapMe
5075#
5076# # but prevent caching of special responses
5077# # such as 302 redirects that cause StoreID loops
5078# acl Ordinary http_status 200-299
5079# store_miss deny MapMe !Ordinary
5080#
5081# # and do not serve any previously stored special responses
5082# # from the cache (in case they were already cached before
5083# # the above store_miss rule was in effect).
5084# send_hit deny MapMe !Ordinary
5085#Default:
5086# By default, this directive is unused and has no effect.
5087
5088# TAG: store_miss
5089# Responses denied by this directive will not be cached (but may still
5090# be served from the cache, see send_hit). This directive has no
5091# effect on the responses it allows and on the already cached responses.
5092#
5093# Please see the "cache" directive for a summary of differences among
5094# store_miss, send_hit, and cache directives. See the
5095# send_hit directive for a usage example.
5096#
5097# Unlike the "cache" directive, store_miss only supports fast acl
5098# types. See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
5099#Default:
5100# By default, this directive is unused and has no effect.
5101
5102# TAG: max_stale time-units
5103# This option puts an upper limit on how stale content Squid
5104# will serve from the cache if cache validation fails.
5105# Can be overriden by the refresh_pattern max-stale option.
5106#Default:
5107# max_stale 1 week
5108
5109# TAG: refresh_pattern
5110# usage: refresh_pattern [-i] regex min percent max [options]
5111#
5112# By default, regular expressions are CASE-SENSITIVE. To make
5113# them case-insensitive, use the -i option.
5114#
5115# 'Min' is the time (in minutes) an object without an explicit
5116# expiry time should be considered fresh. The recommended
5117# value is 0, any higher values may cause dynamic applications
5118# to be erroneously cached unless the application designer
5119# has taken the appropriate actions.
5120#
5121# 'Percent' is a percentage of the objects age (time since last
5122# modification age) an object without explicit expiry time
5123# will be considered fresh.
5124#
5125# 'Max' is an upper limit on how long objects without an explicit
5126# expiry time will be considered fresh. The value is also used
5127# to form Cache-Control: max-age header for a request sent from
5128# Squid to origin/parent.
5129#
5130# options: override-expire
5131# override-lastmod
5132# reload-into-ims
5133# ignore-reload
5134# ignore-no-store
5135# ignore-private
5136# max-stale=NN
5137# refresh-ims
5138# store-stale
5139#
5140# override-expire enforces min age even if the server
5141# sent an explicit expiry time (e.g., with the
5142# Expires: header or Cache-Control: max-age). Doing this
5143# VIOLATES the HTTP standard. Enabling this feature
5144# could make you liable for problems which it causes.
5145#
5146# Note: override-expire does not enforce staleness - it only extends
5147# freshness / min. If the server returns a Expires time which
5148# is longer than your max time, Squid will still consider
5149# the object fresh for that period of time.
5150#
5151# override-lastmod enforces min age even on objects
5152# that were modified recently.
5153#
5154# reload-into-ims changes a client no-cache or ``reload''
5155# request for a cached entry into a conditional request using
5156# If-Modified-Since and/or If-None-Match headers, provided the
5157# cached entry has a Last-Modified and/or a strong ETag header.
5158# Doing this VIOLATES the HTTP standard. Enabling this feature
5159# could make you liable for problems which it causes.
5160#
5161# ignore-reload ignores a client no-cache or ``reload''
5162# header. Doing this VIOLATES the HTTP standard. Enabling
5163# this feature could make you liable for problems which
5164# it causes.
5165#
5166# ignore-no-store ignores any ``Cache-control: no-store''
5167# headers received from a server. Doing this VIOLATES
5168# the HTTP standard. Enabling this feature could make you
5169# liable for problems which it causes.
5170#
5171# ignore-private ignores any ``Cache-control: private''
5172# headers received from a server. Doing this VIOLATES
5173# the HTTP standard. Enabling this feature could make you
5174# liable for problems which it causes.
5175#
5176# refresh-ims causes squid to contact the origin server
5177# when a client issues an If-Modified-Since request. This
5178# ensures that the client will receive an updated version
5179# if one is available.
5180#
5181# store-stale stores responses even if they don't have explicit
5182# freshness or a validator (i.e., Last-Modified or an ETag)
5183# present, or if they're already stale. By default, Squid will
5184# not cache such responses because they usually can't be
5185# reused. Note that such responses will be stale by default.
5186#
5187# max-stale=NN provide a maximum staleness factor. Squid won't
5188# serve objects more stale than this even if it failed to
5189# validate the object. Default: use the max_stale global limit.
5190#
5191# Basically a cached object is:
5192#
5193# FRESH if expire > now, else STALE
5194# STALE if age > max
5195# FRESH if lm-factor < percent, else STALE
5196# FRESH if age < min
5197# else STALE
5198#
5199# The refresh_pattern lines are checked in the order listed here.
5200# The first entry which matches is used. If none of the entries
5201# match the default will be used.
5202#
5203# Note, you must uncomment all the default lines if you want
5204# to change one. The default setting is only active if none is
5205# used.
5206#
5207#
5208
5209#
5210# Add any of your own refresh_pattern entries above these.
5211#
5212refresh_pattern ^ftp: 1440 20% 10080
5213refresh_pattern ^gopher: 1440 0% 1440
5214refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
5215refresh_pattern . 0 20% 4320
5216
5217# TAG: quick_abort_min (KB)
5218#Default:
5219# quick_abort_min 16 KB
5220
5221# TAG: quick_abort_max (KB)
5222#Default:
5223# quick_abort_max 16 KB
5224
5225# TAG: quick_abort_pct (percent)
5226# The cache by default continues downloading aborted requests
5227# which are almost completed (less than 16 KB remaining). This
5228# may be undesirable on slow (e.g. SLIP) links and/or very busy
5229# caches. Impatient users may tie up file descriptors and
5230# bandwidth by repeatedly requesting and immediately aborting
5231# downloads.
5232#
5233# When the user aborts a request, Squid will check the
5234# quick_abort values to the amount of data transferred until
5235# then.
5236#
5237# If the transfer has less than 'quick_abort_min' KB remaining,
5238# it will finish the retrieval.
5239#
5240# If the transfer has more than 'quick_abort_max' KB remaining,
5241# it will abort the retrieval.
5242#
5243# If more than 'quick_abort_pct' of the transfer has completed,
5244# it will finish the retrieval.
5245#
5246# If you do not want any retrieval to continue after the client
5247# has aborted, set both 'quick_abort_min' and 'quick_abort_max'
5248# to '0 KB'.
5249#
5250# If you want retrievals to always continue if they are being
5251# cached set 'quick_abort_min' to '-1 KB'.
5252#Default:
5253# quick_abort_pct 95
5254
5255# TAG: read_ahead_gap buffer-size
5256# The amount of data the cache will buffer ahead of what has been
5257# sent to the client when retrieving an object from another server.
5258#Default:
5259# read_ahead_gap 16 KB
5260
5261# TAG: negative_ttl time-units
5262# Set the Default Time-to-Live (TTL) for failed requests.
5263# Certain types of failures (such as "connection refused" and
5264# "404 Not Found") are able to be negatively-cached for a short time.
5265# Modern web servers should provide Expires: header, however if they
5266# do not this can provide a minimum TTL.
5267# The default is not to cache errors with unknown expiry details.
5268#
5269# Note that this is different from negative caching of DNS lookups.
5270#
5271# WARNING: Doing this VIOLATES the HTTP standard. Enabling
5272# this feature could make you liable for problems which it
5273# causes.
5274#Default:
5275# negative_ttl 0 seconds
5276
5277# TAG: positive_dns_ttl time-units
5278# Upper limit on how long Squid will cache positive DNS responses.
5279# Default is 6 hours (360 minutes). This directive must be set
5280# larger than negative_dns_ttl.
5281#Default:
5282# positive_dns_ttl 6 hours
5283
5284# TAG: negative_dns_ttl time-units
5285# Time-to-Live (TTL) for negative caching of failed DNS lookups.
5286# This also sets the lower cache limit on positive lookups.
5287# Minimum value is 1 second, and it is not recommendable to go
5288# much below 10 seconds.
5289#Default:
5290# negative_dns_ttl 1 minutes
5291
5292# TAG: range_offset_limit size [acl acl...]
5293# usage: (size) [units] [[!]aclname]
5294#
5295# Sets an upper limit on how far (number of bytes) into the file
5296# a Range request may be to cause Squid to prefetch the whole file.
5297# If beyond this limit, Squid forwards the Range request as it is and
5298# the result is NOT cached.
5299#
5300# This is to stop a far ahead range request (lets say start at 17MB)
5301# from making Squid fetch the whole object up to that point before
5302# sending anything to the client.
5303#
5304# Multiple range_offset_limit lines may be specified, and they will
5305# be searched from top to bottom on each request until a match is found.
5306# The first match found will be used. If no line matches a request, the
5307# default limit of 0 bytes will be used.
5308#
5309# 'size' is the limit specified as a number of units.
5310#
5311# 'units' specifies whether to use bytes, KB, MB, etc.
5312# If no units are specified bytes are assumed.
5313#
5314# A size of 0 causes Squid to never fetch more than the
5315# client requested. (default)
5316#
5317# A size of 'none' causes Squid to always fetch the object from the
5318# beginning so it may cache the result. (2.0 style)
5319#
5320# 'aclname' is the name of a defined ACL.
5321#
5322# NP: Using 'none' as the byte value here will override any quick_abort settings
5323# that may otherwise apply to the range request. The range request will
5324# be fully fetched from start to finish regardless of the client
5325# actions. This affects bandwidth usage.
5326#Default:
5327# none
5328
5329# TAG: minimum_expiry_time (seconds)
5330# The minimum caching time according to (Expires - Date)
5331# headers Squid honors if the object can't be revalidated.
5332# The default is 60 seconds.
5333#
5334# In reverse proxy environments it might be desirable to honor
5335# shorter object lifetimes. It is most likely better to make
5336# your server return a meaningful Last-Modified header however.
5337#
5338# In ESI environments where page fragments often have short
5339# lifetimes, this will often be best set to 0.
5340#Default:
5341# minimum_expiry_time 60 seconds
5342
5343# TAG: store_avg_object_size (bytes)
5344# Average object size, used to estimate number of objects your
5345# cache can hold. The default is 13 KB.
5346#
5347# This is used to pre-seed the cache index memory allocation to
5348# reduce expensive reallocate operations while handling clients
5349# traffic. Too-large values may result in memory allocation during
5350# peak traffic, too-small values will result in wasted memory.
5351#
5352# Check the cache manager 'info' report metrics for the real
5353# object sizes seen by your Squid before tuning this.
5354#Default:
5355# store_avg_object_size 13 KB
5356
5357# TAG: store_objects_per_bucket
5358# Target number of objects per bucket in the store hash table.
5359# Lowering this value increases the total number of buckets and
5360# also the storage maintenance rate. The default is 20.
5361#Default:
5362# store_objects_per_bucket 20
5363
5364# HTTP OPTIONS
5365# -----------------------------------------------------------------------------
5366
5367# TAG: request_header_max_size (KB)
5368# This specifies the maximum size for HTTP headers in a request.
5369# Request headers are usually relatively small (about 512 bytes).
5370# Placing a limit on the request header size will catch certain
5371# bugs (for example with persistent connections) and possibly
5372# buffer-overflow or denial-of-service attacks.
5373#Default:
5374# request_header_max_size 64 KB
5375
5376# TAG: reply_header_max_size (KB)
5377# This specifies the maximum size for HTTP headers in a reply.
5378# Reply headers are usually relatively small (about 512 bytes).
5379# Placing a limit on the reply header size will catch certain
5380# bugs (for example with persistent connections) and possibly
5381# buffer-overflow or denial-of-service attacks.
5382#Default:
5383# reply_header_max_size 64 KB
5384
5385# TAG: request_body_max_size (bytes)
5386# This specifies the maximum size for an HTTP request body.
5387# In other words, the maximum size of a PUT/POST request.
5388# A user who attempts to send a request with a body larger
5389# than this limit receives an "Invalid Request" error message.
5390# If you set this parameter to a zero (the default), there will
5391# be no limit imposed.
5392#
5393# See also client_request_buffer_max_size for an alternative
5394# limitation on client uploads which can be configured.
5395#Default:
5396# No limit.
5397
5398# TAG: client_request_buffer_max_size (bytes)
5399# This specifies the maximum buffer size of a client request.
5400# It prevents squid eating too much memory when somebody uploads
5401# a large file.
5402#Default:
5403# client_request_buffer_max_size 512 KB
5404
5405# TAG: broken_posts
5406# A list of ACL elements which, if matched, causes Squid to send
5407# an extra CRLF pair after the body of a PUT/POST request.
5408#
5409# Some HTTP servers has broken implementations of PUT/POST,
5410# and rely on an extra CRLF pair sent by some WWW clients.
5411#
5412# Quote from RFC2616 section 4.1 on this matter:
5413#
5414# Note: certain buggy HTTP/1.0 client implementations generate an
5415# extra CRLF's after a POST request. To restate what is explicitly
5416# forbidden by the BNF, an HTTP/1.1 client must not preface or follow
5417# a request with an extra CRLF.
5418#
5419# This clause only supports fast acl types.
5420# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
5421#
5422#Example:
5423# acl buggy_server url_regex ^http://....
5424# broken_posts allow buggy_server
5425#Default:
5426# Obey RFC 2616.
5427
5428# TAG: adaptation_uses_indirect_client on|off
5429# Controls whether the indirect client IP address (instead of the direct
5430# client IP address) is passed to adaptation services.
5431#
5432# See also: follow_x_forwarded_for adaptation_send_client_ip
5433#Default:
5434# adaptation_uses_indirect_client on
5435
5436# TAG: via on|off
5437# If set (default), Squid will include a Via header in requests and
5438# replies as required by RFC2616.
5439#Default:
5440# via on
5441
5442# TAG: vary_ignore_expire on|off
5443# Many HTTP servers supporting Vary gives such objects
5444# immediate expiry time with no cache-control header
5445# when requested by a HTTP/1.0 client. This option
5446# enables Squid to ignore such expiry times until
5447# HTTP/1.1 is fully implemented.
5448#
5449# WARNING: If turned on this may eventually cause some
5450# varying objects not intended for caching to get cached.
5451#Default:
5452# vary_ignore_expire off
5453
5454# TAG: request_entities
5455# Squid defaults to deny GET and HEAD requests with request entities,
5456# as the meaning of such requests are undefined in the HTTP standard
5457# even if not explicitly forbidden.
5458#
5459# Set this directive to on if you have clients which insists
5460# on sending request entities in GET or HEAD requests. But be warned
5461# that there is server software (both proxies and web servers) which
5462# can fail to properly process this kind of request which may make you
5463# vulnerable to cache pollution attacks if enabled.
5464#Default:
5465# request_entities off
5466
5467# TAG: request_header_access
5468# Usage: request_header_access header_name allow|deny [!]aclname ...
5469#
5470# WARNING: Doing this VIOLATES the HTTP standard. Enabling
5471# this feature could make you liable for problems which it
5472# causes.
5473#
5474# This option replaces the old 'anonymize_headers' and the
5475# older 'http_anonymizer' option with something that is much
5476# more configurable. A list of ACLs for each header name allows
5477# removal of specific header fields under specific conditions.
5478#
5479# This option only applies to outgoing HTTP request headers (i.e.,
5480# headers sent by Squid to the next HTTP hop such as a cache peer
5481# or an origin server). The option has no effect during cache hit
5482# detection. The equivalent adaptation vectoring point in ICAP
5483# terminology is post-cache REQMOD.
5484#
5485# The option is applied to individual outgoing request header
5486# fields. For each request header field F, Squid uses the first
5487# qualifying sets of request_header_access rules:
5488#
5489# 1. Rules with header_name equal to F's name.
5490# 2. Rules with header_name 'Other', provided F's name is not
5491# on the hard-coded list of commonly used HTTP header names.
5492# 3. Rules with header_name 'All'.
5493#
5494# Within that qualifying rule set, rule ACLs are checked as usual.
5495# If ACLs of an "allow" rule match, the header field is allowed to
5496# go through as is. If ACLs of a "deny" rule match, the header is
5497# removed and request_header_replace is then checked to identify
5498# if the removed header has a replacement. If no rules within the
5499# set have matching ACLs, the header field is left as is.
5500#
5501# For example, to achieve the same behavior as the old
5502# 'http_anonymizer standard' option, you should use:
5503#
5504# request_header_access From deny all
5505# request_header_access Referer deny all
5506# request_header_access User-Agent deny all
5507#
5508# Or, to reproduce the old 'http_anonymizer paranoid' feature
5509# you should use:
5510#
5511# request_header_access Authorization allow all
5512# request_header_access Proxy-Authorization allow all
5513# request_header_access Cache-Control allow all
5514# request_header_access Content-Length allow all
5515# request_header_access Content-Type allow all
5516# request_header_access Date allow all
5517# request_header_access Host allow all
5518# request_header_access If-Modified-Since allow all
5519# request_header_access Pragma allow all
5520# request_header_access Accept allow all
5521# request_header_access Accept-Charset allow all
5522# request_header_access Accept-Encoding allow all
5523# request_header_access Accept-Language allow all
5524# request_header_access Connection allow all
5525# request_header_access All deny all
5526#
5527# HTTP reply headers are controlled with the reply_header_access directive.
5528#
5529# By default, all headers are allowed (no anonymizing is performed).
5530#Default:
5531# No limits.
5532
5533# TAG: reply_header_access
5534# Usage: reply_header_access header_name allow|deny [!]aclname ...
5535#
5536# WARNING: Doing this VIOLATES the HTTP standard. Enabling
5537# this feature could make you liable for problems which it
5538# causes.
5539#
5540# This option only applies to reply headers, i.e., from the
5541# server to the client.
5542#
5543# This is the same as request_header_access, but in the other
5544# direction. Please see request_header_access for detailed
5545# documentation.
5546#
5547# For example, to achieve the same behavior as the old
5548# 'http_anonymizer standard' option, you should use:
5549#
5550# reply_header_access Server deny all
5551# reply_header_access WWW-Authenticate deny all
5552# reply_header_access Link deny all
5553#
5554# Or, to reproduce the old 'http_anonymizer paranoid' feature
5555# you should use:
5556#
5557# reply_header_access Allow allow all
5558# reply_header_access WWW-Authenticate allow all
5559# reply_header_access Proxy-Authenticate allow all
5560# reply_header_access Cache-Control allow all
5561# reply_header_access Content-Encoding allow all
5562# reply_header_access Content-Length allow all
5563# reply_header_access Content-Type allow all
5564# reply_header_access Date allow all
5565# reply_header_access Expires allow all
5566# reply_header_access Last-Modified allow all
5567# reply_header_access Location allow all
5568# reply_header_access Pragma allow all
5569# reply_header_access Content-Language allow all
5570# reply_header_access Retry-After allow all
5571# reply_header_access Title allow all
5572# reply_header_access Content-Disposition allow all
5573# reply_header_access Connection allow all
5574# reply_header_access All deny all
5575#
5576# HTTP request headers are controlled with the request_header_access directive.
5577#
5578# By default, all headers are allowed (no anonymizing is
5579# performed).
5580#Default:
5581# No limits.
5582
5583# TAG: request_header_replace
5584# Usage: request_header_replace header_name message
5585# Example: request_header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
5586#
5587# This option allows you to change the contents of headers
5588# denied with request_header_access above, by replacing them
5589# with some fixed string.
5590#
5591# This only applies to request headers, not reply headers.
5592#
5593# By default, headers are removed if denied.
5594#Default:
5595# none
5596
5597# TAG: reply_header_replace
5598# Usage: reply_header_replace header_name message
5599# Example: reply_header_replace Server Foo/1.0
5600#
5601# This option allows you to change the contents of headers
5602# denied with reply_header_access above, by replacing them
5603# with some fixed string.
5604#
5605# This only applies to reply headers, not request headers.
5606#
5607# By default, headers are removed if denied.
5608#Default:
5609# none
5610
5611# TAG: request_header_add
5612# Usage: request_header_add field-name field-value [ acl ... ]
5613# Example: request_header_add X-Client-CA "CA=%ssl::>cert_issuer" all
5614#
5615# This option adds header fields to outgoing HTTP requests (i.e.,
5616# request headers sent by Squid to the next HTTP hop such as a
5617# cache peer or an origin server). The option has no effect during
5618# cache hit detection. The equivalent adaptation vectoring point
5619# in ICAP terminology is post-cache REQMOD.
5620#
5621# Field-name is a token specifying an HTTP header name. If a
5622# standard HTTP header name is used, Squid does not check whether
5623# the new header conflicts with any existing headers or violates
5624# HTTP rules. If the request to be modified already contains a
5625# field with the same name, the old field is preserved but the
5626# header field values are not merged.
5627#
5628# Field-value is either a token or a quoted string. If quoted
5629# string format is used, then the surrounding quotes are removed
5630# while escape sequences and %macros are processed.
5631#
5632# One or more Squid ACLs may be specified to restrict header
5633# injection to matching requests. As always in squid.conf, all
5634# ACLs in the ACL list must be satisfied for the insertion to
5635# happen. The request_header_add supports fast ACLs only.
5636#
5637# See also: reply_header_add.
5638#Default:
5639# none
5640
5641# TAG: reply_header_add
5642# Usage: reply_header_add field-name field-value [ acl ... ]
5643# Example: reply_header_add X-Client-CA "CA=%ssl::>cert_issuer" all
5644#
5645# This option adds header fields to outgoing HTTP responses (i.e., response
5646# headers delivered by Squid to the client). This option has no effect on
5647# cache hit detection. The equivalent adaptation vectoring point in
5648# ICAP terminology is post-cache RESPMOD. This option does not apply to
5649# successful CONNECT replies.
5650#
5651# Field-name is a token specifying an HTTP header name. If a
5652# standard HTTP header name is used, Squid does not check whether
5653# the new header conflicts with any existing headers or violates
5654# HTTP rules. If the response to be modified already contains a
5655# field with the same name, the old field is preserved but the
5656# header field values are not merged.
5657#
5658# Field-value is either a token or a quoted string. If quoted
5659# string format is used, then the surrounding quotes are removed
5660# while escape sequences and %macros are processed.
5661#
5662# One or more Squid ACLs may be specified to restrict header
5663# injection to matching responses. As always in squid.conf, all
5664# ACLs in the ACL list must be satisfied for the insertion to
5665# happen. The reply_header_add option supports fast ACLs only.
5666#
5667# See also: request_header_add.
5668#Default:
5669# none
5670
5671# TAG: note
5672# This option used to log custom information about the master
5673# transaction. For example, an admin may configure Squid to log
5674# which "user group" the transaction belongs to, where "user group"
5675# will be determined based on a set of ACLs and not [just]
5676# authentication information.
5677# Values of key/value pairs can be logged using %{key}note macros:
5678#
5679# note key value acl ...
5680# logformat myFormat ... %{key}note ...
5681#Default:
5682# none
5683
5684# TAG: relaxed_header_parser on|off|warn
5685# In the default "on" setting Squid accepts certain forms
5686# of non-compliant HTTP messages where it is unambiguous
5687# what the sending application intended even if the message
5688# is not correctly formatted. The messages is then normalized
5689# to the correct form when forwarded by Squid.
5690#
5691# If set to "warn" then a warning will be emitted in cache.log
5692# each time such HTTP error is encountered.
5693#
5694# If set to "off" then such HTTP errors will cause the request
5695# or response to be rejected.
5696#Default:
5697# relaxed_header_parser on
5698
5699# TAG: collapsed_forwarding (on|off)
5700# This option controls whether Squid is allowed to merge multiple
5701# potentially cachable requests for the same URI before Squid knows
5702# whether the response is going to be cachable.
5703#
5704# When enabled, instead of forwarding each concurrent request for
5705# the same URL, Squid just sends the first of them. The other, so
5706# called "collapsed" requests, wait for the response to the first
5707# request and, if it happens to be cachable, use that response.
5708# Here, "concurrent requests" means "received after the first
5709# request headers were parsed and before the corresponding response
5710# headers were parsed".
5711#
5712# This feature is disabled by default: enabling collapsed
5713# forwarding needlessly delays forwarding requests that look
5714# cachable (when they are collapsed) but then need to be forwarded
5715# individually anyway because they end up being for uncachable
5716# content. However, in some cases, such as acceleration of highly
5717# cachable content with periodic or grouped expiration times, the
5718# gains from collapsing [large volumes of simultaneous refresh
5719# requests] outweigh losses from such delays.
5720#
5721# Squid collapses two kinds of requests: regular client requests
5722# received on one of the listening ports and internal "cache
5723# revalidation" requests which are triggered by those regular
5724# requests hitting a stale cached object. Revalidation collapsing
5725# is currently disabled for Squid instances containing SMP-aware
5726# disk or memory caches and for Vary-controlled cached objects.
5727#Default:
5728# collapsed_forwarding off
5729
5730# TAG: collapsed_forwarding_shared_entries_limit (number of entries)
5731# This limits the size of a table used for sharing information
5732# about collapsible entries among SMP workers. Limiting sharing
5733# too much results in cache content duplication and missed
5734# collapsing opportunities. Using excessively large values
5735# wastes shared memory.
5736#
5737# The limit should be significantly larger then the number of
5738# concurrent collapsible entries one wants to share. For a cache
5739# that handles less than 5000 concurrent requests, the default
5740# setting of 16384 should be plenty.
5741#
5742# If the limit is set to zero, it disables sharing of collapsed
5743# forwarding between SMP workers.
5744#Default:
5745# collapsed_forwarding_shared_entries_limit 16384
5746
5747# TIMEOUTS
5748# -----------------------------------------------------------------------------
5749
5750# TAG: forward_timeout time-units
5751# This parameter specifies how long Squid should at most attempt in
5752# finding a forwarding path for the request before giving up.
5753#Default:
5754# forward_timeout 4 minutes
5755
5756# TAG: connect_timeout time-units
5757# This parameter specifies how long to wait for the TCP connect to
5758# the requested server or peer to complete before Squid should
5759# attempt to find another path where to forward the request.
5760#Default:
5761# connect_timeout 1 minute
5762
5763# TAG: peer_connect_timeout time-units
5764# This parameter specifies how long to wait for a pending TCP
5765# connection to a peer cache. The default is 30 seconds. You
5766# may also set different timeout values for individual neighbors
5767# with the 'connect-timeout' option on a 'cache_peer' line.
5768#Default:
5769# peer_connect_timeout 30 seconds
5770
5771# TAG: read_timeout time-units
5772# Applied on peer server connections.
5773#
5774# After each successful read(), the timeout will be extended by this
5775# amount. If no data is read again after this amount of time,
5776# the request is aborted and logged with ERR_READ_TIMEOUT.
5777#
5778# The default is 15 minutes.
5779#Default:
5780# read_timeout 15 minutes
5781
5782# TAG: write_timeout time-units
5783# This timeout is tracked for all connections that have data
5784# available for writing and are waiting for the socket to become
5785# ready. After each successful write, the timeout is extended by
5786# the configured amount. If Squid has data to write but the
5787# connection is not ready for the configured duration, the
5788# transaction associated with the connection is terminated. The
5789# default is 15 minutes.
5790#Default:
5791# write_timeout 15 minutes
5792
5793# TAG: request_timeout
5794# How long to wait for complete HTTP request headers after initial
5795# connection establishment.
5796#Default:
5797# request_timeout 5 minutes
5798
5799# TAG: request_start_timeout
5800# How long to wait for the first request byte after initial
5801# connection establishment.
5802#Default:
5803# request_start_timeout 5 minutes
5804
5805# TAG: client_idle_pconn_timeout
5806# How long to wait for the next HTTP request on a persistent
5807# client connection after the previous request completes.
5808#Default:
5809# client_idle_pconn_timeout 2 minutes
5810
5811# TAG: ftp_client_idle_timeout
5812# How long to wait for an FTP request on a connection to Squid ftp_port.
5813# Many FTP clients do not deal with idle connection closures well,
5814# necessitating a longer default timeout than client_idle_pconn_timeout
5815# used for incoming HTTP requests.
5816#Default:
5817# ftp_client_idle_timeout 30 minutes
5818
5819# TAG: client_lifetime time-units
5820# The maximum amount of time a client (browser) is allowed to
5821# remain connected to the cache process. This protects the Cache
5822# from having a lot of sockets (and hence file descriptors) tied up
5823# in a CLOSE_WAIT state from remote clients that go away without
5824# properly shutting down (either because of a network failure or
5825# because of a poor client implementation). The default is one
5826# day, 1440 minutes.
5827#
5828# NOTE: The default value is intended to be much larger than any
5829# client would ever need to be connected to your cache. You
5830# should probably change client_lifetime only as a last resort.
5831# If you seem to have many client connections tying up
5832# filedescriptors, we recommend first tuning the read_timeout,
5833# request_timeout, persistent_request_timeout and quick_abort values.
5834#Default:
5835# client_lifetime 1 day
5836
5837# TAG: pconn_lifetime time-units
5838# Desired maximum lifetime of a persistent connection.
5839# When set, Squid will close a now-idle persistent connection that
5840# exceeded configured lifetime instead of moving the connection into
5841# the idle connection pool (or equivalent). No effect on ongoing/active
5842# transactions. Connection lifetime is the time period from the
5843# connection acceptance or opening time until "now".
5844#
5845# This limit is useful in environments with long-lived connections
5846# where Squid configuration or environmental factors change during a
5847# single connection lifetime. If unrestricted, some connections may
5848# last for hours and even days, ignoring those changes that should
5849# have affected their behavior or their existence.
5850#
5851# Currently, a new lifetime value supplied via Squid reconfiguration
5852# has no effect on already idle connections unless they become busy.
5853#
5854# When set to '0' this limit is not used.
5855#Default:
5856# pconn_lifetime 0 seconds
5857
5858# TAG: half_closed_clients
5859# Some clients may shutdown the sending side of their TCP
5860# connections, while leaving their receiving sides open. Sometimes,
5861# Squid can not tell the difference between a half-closed and a
5862# fully-closed TCP connection.
5863#
5864# By default, Squid will immediately close client connections when
5865# read(2) returns "no more data to read."
5866#
5867# Change this option to 'on' and Squid will keep open connections
5868# until a read(2) or write(2) on the socket returns an error.
5869# This may show some benefits for reverse proxies. But if not
5870# it is recommended to leave OFF.
5871#Default:
5872# half_closed_clients off
5873
5874# TAG: server_idle_pconn_timeout
5875# Timeout for idle persistent connections to servers and other
5876# proxies.
5877#Default:
5878# server_idle_pconn_timeout 1 minute
5879
5880# TAG: ident_timeout
5881# Maximum time to wait for IDENT lookups to complete.
5882#
5883# If this is too high, and you enabled IDENT lookups from untrusted
5884# users, you might be susceptible to denial-of-service by having
5885# many ident requests going at once.
5886#Default:
5887# ident_timeout 10 seconds
5888
5889# TAG: shutdown_lifetime time-units
5890# When SIGTERM or SIGHUP is received, the cache is put into
5891# "shutdown pending" mode until all active sockets are closed.
5892# This value is the lifetime to set for all open descriptors
5893# during shutdown mode. Any active clients after this many
5894# seconds will receive a 'timeout' message.
5895#Default:
5896# shutdown_lifetime 30 seconds
5897
5898# ADMINISTRATIVE PARAMETERS
5899# -----------------------------------------------------------------------------
5900
5901# TAG: cache_mgr
5902# Email-address of local cache manager who will receive
5903# mail if the cache dies. The default is "webmaster".
5904#Default:
5905# cache_mgr webmaster
5906
5907# TAG: mail_from
5908# From: email-address for mail sent when the cache dies.
5909# The default is to use 'squid@unique_hostname'.
5910#
5911# See also: unique_hostname directive.
5912#Default:
5913# none
5914
5915# TAG: mail_program
5916# Email program used to send mail if the cache dies.
5917# The default is "mail". The specified program must comply
5918# with the standard Unix mail syntax:
5919# mail-program recipient < mailfile
5920#
5921# Optional command line options can be specified.
5922#Default:
5923# mail_program mail
5924
5925# TAG: cache_effective_user
5926# If you start Squid as root, it will change its effective/real
5927# UID/GID to the user specified below. The default is to change
5928# to UID of proxy.
5929# see also; cache_effective_group
5930#Default:
5931# cache_effective_user proxy
5932
5933# TAG: cache_effective_group
5934# Squid sets the GID to the effective user's default group ID
5935# (taken from the password file) and supplementary group list
5936# from the groups membership.
5937#
5938# If you want Squid to run with a specific GID regardless of
5939# the group memberships of the effective user then set this
5940# to the group (or GID) you want Squid to run as. When set
5941# all other group privileges of the effective user are ignored
5942# and only this GID is effective. If Squid is not started as
5943# root the user starting Squid MUST be member of the specified
5944# group.
5945#
5946# This option is not recommended by the Squid Team.
5947# Our preference is for administrators to configure a secure
5948# user account for squid with UID/GID matching system policies.
5949#Default:
5950# Use system group memberships of the cache_effective_user account
5951
5952# TAG: httpd_suppress_version_string on|off
5953# Suppress Squid version string info in HTTP headers and HTML error pages.
5954#Default:
5955# httpd_suppress_version_string off
5956
5957# TAG: visible_hostname
5958# If you want to present a special hostname in error messages, etc,
5959# define this. Otherwise, the return value of gethostname()
5960# will be used. If you have multiple caches in a cluster and
5961# get errors about IP-forwarding you must set them to have individual
5962# names with this setting.
5963#Default:
5964# Automatically detect the system host name
5965
5966# TAG: unique_hostname
5967# If you want to have multiple machines with the same
5968# 'visible_hostname' you must give each machine a different
5969# 'unique_hostname' so forwarding loops can be detected.
5970#Default:
5971# Copy the value from visible_hostname
5972
5973# TAG: hostname_aliases
5974# A list of other DNS names your cache has.
5975#Default:
5976# none
5977
5978# TAG: umask
5979# Minimum umask which should be enforced while the proxy
5980# is running, in addition to the umask set at startup.
5981#
5982# For a traditional octal representation of umasks, start
5983# your value with 0.
5984#Default:
5985# umask 027
5986
5987# OPTIONS FOR THE CACHE REGISTRATION SERVICE
5988# -----------------------------------------------------------------------------
5989#
5990# This section contains parameters for the (optional) cache
5991# announcement service. This service is provided to help
5992# cache administrators locate one another in order to join or
5993# create cache hierarchies.
5994#
5995# An 'announcement' message is sent (via UDP) to the registration
5996# service by Squid. By default, the announcement message is NOT
5997# SENT unless you enable it with 'announce_period' below.
5998#
5999# The announcement message includes your hostname, plus the
6000# following information from this configuration file:
6001#
6002# http_port
6003# icp_port
6004# cache_mgr
6005#
6006# All current information is processed regularly and made
6007# available on the Web at http://www.ircache.net/Cache/Tracker/.
6008
6009# TAG: announce_period
6010# This is how frequently to send cache announcements.
6011#
6012# To enable announcing your cache, just set an announce period.
6013#
6014# Example:
6015# announce_period 1 day
6016#Default:
6017# Announcement messages disabled.
6018
6019# TAG: announce_host
6020# Set the hostname where announce registration messages will be sent.
6021#
6022# See also announce_port and announce_file
6023#Default:
6024# announce_host tracker.ircache.net
6025
6026# TAG: announce_file
6027# The contents of this file will be included in the announce
6028# registration messages.
6029#Default:
6030# none
6031
6032# TAG: announce_port
6033# Set the port where announce registration messages will be sent.
6034#
6035# See also announce_host and announce_file
6036#Default:
6037# announce_port 3131
6038
6039# HTTPD-ACCELERATOR OPTIONS
6040# -----------------------------------------------------------------------------
6041
6042# TAG: httpd_accel_surrogate_id
6043# Surrogates (http://www.esi.org/architecture_spec_1.0.html)
6044# need an identification token to allow control targeting. Because
6045# a farm of surrogates may all perform the same tasks, they may share
6046# an identification token.
6047#Default:
6048# visible_hostname is used if no specific ID is set.
6049
6050# TAG: http_accel_surrogate_remote on|off
6051# Remote surrogates (such as those in a CDN) honour the header
6052# "Surrogate-Control: no-store-remote".
6053#
6054# Set this to on to have squid behave as a remote surrogate.
6055#Default:
6056# http_accel_surrogate_remote off
6057
6058# TAG: esi_parser libxml2|expat
6059# Selects the XML parsing library to use when interpreting responses with
6060# Edge Side Includes.
6061#
6062# To disable ESI handling completely, ./configure Squid with --disable-esi.
6063#Default:
6064# Selects libxml2 if available at ./configure time or libexpat otherwise.
6065
6066# DELAY POOL PARAMETERS
6067# -----------------------------------------------------------------------------
6068
6069# TAG: delay_pools
6070# This represents the number of delay pools to be used. For example,
6071# if you have one class 2 delay pool and one class 3 delays pool, you
6072# have a total of 2 delay pools.
6073#
6074# See also delay_parameters, delay_class, delay_access for pool
6075# configuration details.
6076#Default:
6077# delay_pools 0
6078
6079# TAG: delay_class
6080# This defines the class of each delay pool. There must be exactly one
6081# delay_class line for each delay pool. For example, to define two
6082# delay pools, one of class 2 and one of class 3, the settings above
6083# and here would be:
6084#
6085# Example:
6086# delay_pools 4 # 4 delay pools
6087# delay_class 1 2 # pool 1 is a class 2 pool
6088# delay_class 2 3 # pool 2 is a class 3 pool
6089# delay_class 3 4 # pool 3 is a class 4 pool
6090# delay_class 4 5 # pool 4 is a class 5 pool
6091#
6092# The delay pool classes are:
6093#
6094# class 1 Everything is limited by a single aggregate
6095# bucket.
6096#
6097# class 2 Everything is limited by a single aggregate
6098# bucket as well as an "individual" bucket chosen
6099# from bits 25 through 32 of the IPv4 address.
6100#
6101# class 3 Everything is limited by a single aggregate
6102# bucket as well as a "network" bucket chosen
6103# from bits 17 through 24 of the IP address and a
6104# "individual" bucket chosen from bits 17 through
6105# 32 of the IPv4 address.
6106#
6107# class 4 Everything in a class 3 delay pool, with an
6108# additional limit on a per user basis. This
6109# only takes effect if the username is established
6110# in advance - by forcing authentication in your
6111# http_access rules.
6112#
6113# class 5 Requests are grouped according their tag (see
6114# external_acl's tag= reply).
6115#
6116#
6117# Each pool also requires a delay_parameters directive to configure the pool size
6118# and speed limits used whenever the pool is applied to a request. Along with
6119# a set of delay_access directives to determine when it is used.
6120#
6121# NOTE: If an IP address is a.b.c.d
6122# -> bits 25 through 32 are "d"
6123# -> bits 17 through 24 are "c"
6124# -> bits 17 through 32 are "c * 256 + d"
6125#
6126# NOTE-2: Due to the use of bitmasks in class 2,3,4 pools they only apply to
6127# IPv4 traffic. Class 1 and 5 pools may be used with IPv6 traffic.
6128#
6129# This clause only supports fast acl types.
6130# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
6131#
6132# See also delay_parameters and delay_access.
6133#Default:
6134# none
6135
6136# TAG: delay_access
6137# This is used to determine which delay pool a request falls into.
6138#
6139# delay_access is sorted per pool and the matching starts with pool 1,
6140# then pool 2, ..., and finally pool N. The first delay pool where the
6141# request is allowed is selected for the request. If it does not allow
6142# the request to any pool then the request is not delayed (default).
6143#
6144# For example, if you want some_big_clients in delay
6145# pool 1 and lotsa_little_clients in delay pool 2:
6146#
6147# delay_access 1 allow some_big_clients
6148# delay_access 1 deny all
6149# delay_access 2 allow lotsa_little_clients
6150# delay_access 2 deny all
6151# delay_access 3 allow authenticated_clients
6152#
6153# See also delay_parameters and delay_class.
6154#
6155#Default:
6156# Deny using the pool, unless allow rules exist in squid.conf for the pool.
6157
6158# TAG: delay_parameters
6159# This defines the parameters for a delay pool. Each delay pool has
6160# a number of "buckets" associated with it, as explained in the
6161# description of delay_class.
6162#
6163# For a class 1 delay pool, the syntax is:
6164# delay_class pool 1
6165# delay_parameters pool aggregate
6166#
6167# For a class 2 delay pool:
6168# delay_class pool 2
6169# delay_parameters pool aggregate individual
6170#
6171# For a class 3 delay pool:
6172# delay_class pool 3
6173# delay_parameters pool aggregate network individual
6174#
6175# For a class 4 delay pool:
6176# delay_class pool 4
6177# delay_parameters pool aggregate network individual user
6178#
6179# For a class 5 delay pool:
6180# delay_class pool 5
6181# delay_parameters pool tagrate
6182#
6183# The option variables are:
6184#
6185# pool a pool number - ie, a number between 1 and the
6186# number specified in delay_pools as used in
6187# delay_class lines.
6188#
6189# aggregate the speed limit parameters for the aggregate bucket
6190# (class 1, 2, 3).
6191#
6192# individual the speed limit parameters for the individual
6193# buckets (class 2, 3).
6194#
6195# network the speed limit parameters for the network buckets
6196# (class 3).
6197#
6198# user the speed limit parameters for the user buckets
6199# (class 4).
6200#
6201# tagrate the speed limit parameters for the tag buckets
6202# (class 5).
6203#
6204# A pair of delay parameters is written restore/maximum, where restore is
6205# the number of bytes (not bits - modem and network speeds are usually
6206# quoted in bits) per second placed into the bucket, and maximum is the
6207# maximum number of bytes which can be in the bucket at any time.
6208#
6209# There must be one delay_parameters line for each delay pool.
6210#
6211#
6212# For example, if delay pool number 1 is a class 2 delay pool as in the
6213# above example, and is being used to strictly limit each host to 64Kbit/sec
6214# (plus overheads), with no overall limit, the line is:
6215#
6216# delay_parameters 1 none 8000/8000
6217#
6218# Note that 8 x 8K Byte/sec -> 64K bit/sec.
6219#
6220# Note that the word 'none' is used to represent no limit.
6221#
6222#
6223# And, if delay pool number 2 is a class 3 delay pool as in the above
6224# example, and you want to limit it to a total of 256Kbit/sec (strict limit)
6225# with each 8-bit network permitted 64Kbit/sec (strict limit) and each
6226# individual host permitted 4800bit/sec with a bucket maximum size of 64Kbits
6227# to permit a decent web page to be downloaded at a decent speed
6228# (if the network is not being limited due to overuse) but slow down
6229# large downloads more significantly:
6230#
6231# delay_parameters 2 32000/32000 8000/8000 600/8000
6232#
6233# Note that 8 x 32K Byte/sec -> 256K bit/sec.
6234# 8 x 8K Byte/sec -> 64K bit/sec.
6235# 8 x 600 Byte/sec -> 4800 bit/sec.
6236#
6237#
6238# Finally, for a class 4 delay pool as in the example - each user will
6239# be limited to 128Kbits/sec no matter how many workstations they are logged into.:
6240#
6241# delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000
6242#
6243#
6244# See also delay_class and delay_access.
6245#
6246#Default:
6247# none
6248
6249# TAG: delay_initial_bucket_level (percent, 0-100)
6250# The initial bucket percentage is used to determine how much is put
6251# in each bucket when squid starts, is reconfigured, or first notices
6252# a host accessing it (in class 2 and class 3, individual hosts and
6253# networks only have buckets associated with them once they have been
6254# "seen" by squid).
6255#Default:
6256# delay_initial_bucket_level 50
6257
6258# CLIENT DELAY POOL PARAMETERS
6259# -----------------------------------------------------------------------------
6260
6261# TAG: client_delay_pools
6262# This option specifies the number of client delay pools used. It must
6263# preceed other client_delay_* options.
6264#
6265# Example:
6266# client_delay_pools 2
6267#
6268# See also client_delay_parameters and client_delay_access.
6269#Default:
6270# client_delay_pools 0
6271
6272# TAG: client_delay_initial_bucket_level (percent, 0-no_limit)
6273# This option determines the initial bucket size as a percentage of
6274# max_bucket_size from client_delay_parameters. Buckets are created
6275# at the time of the "first" connection from the matching IP. Idle
6276# buckets are periodically deleted up.
6277#
6278# You can specify more than 100 percent but note that such "oversized"
6279# buckets are not refilled until their size goes down to max_bucket_size
6280# from client_delay_parameters.
6281#
6282# Example:
6283# client_delay_initial_bucket_level 50
6284#Default:
6285# client_delay_initial_bucket_level 50
6286
6287# TAG: client_delay_parameters
6288#
6289# This option configures client-side bandwidth limits using the
6290# following format:
6291#
6292# client_delay_parameters pool speed_limit max_bucket_size
6293#
6294# pool is an integer ID used for client_delay_access matching.
6295#
6296# speed_limit is bytes added to the bucket per second.
6297#
6298# max_bucket_size is the maximum size of a bucket, enforced after any
6299# speed_limit additions.
6300#
6301# Please see the delay_parameters option for more information and
6302# examples.
6303#
6304# Example:
6305# client_delay_parameters 1 1024 2048
6306# client_delay_parameters 2 51200 16384
6307#
6308# See also client_delay_access.
6309#
6310#Default:
6311# none
6312
6313# TAG: client_delay_access
6314# This option determines the client-side delay pool for the
6315# request:
6316#
6317# client_delay_access pool_ID allow|deny acl_name
6318#
6319# All client_delay_access options are checked in their pool ID
6320# order, starting with pool 1. The first checked pool with allowed
6321# request is selected for the request. If no ACL matches or there
6322# are no client_delay_access options, the request bandwidth is not
6323# limited.
6324#
6325# The ACL-selected pool is then used to find the
6326# client_delay_parameters for the request. Client-side pools are
6327# not used to aggregate clients. Clients are always aggregated
6328# based on their source IP addresses (one bucket per source IP).
6329#
6330# This clause only supports fast acl types.
6331# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
6332# Additionally, only the client TCP connection details are available.
6333# ACLs testing HTTP properties will not work.
6334#
6335# Please see delay_access for more examples.
6336#
6337# Example:
6338# client_delay_access 1 allow low_rate_network
6339# client_delay_access 2 allow vips_network
6340#
6341#
6342# See also client_delay_parameters and client_delay_pools.
6343#Default:
6344# Deny use of the pool, unless allow rules exist in squid.conf for the pool.
6345
6346# WCCPv1 AND WCCPv2 CONFIGURATION OPTIONS
6347# -----------------------------------------------------------------------------
6348
6349# TAG: wccp_router
6350# Use this option to define your WCCP ``home'' router for
6351# Squid.
6352#
6353# wccp_router supports a single WCCP(v1) router
6354#
6355# wccp2_router supports multiple WCCPv2 routers
6356#
6357# only one of the two may be used at the same time and defines
6358# which version of WCCP to use.
6359#Default:
6360# WCCP disabled.
6361
6362# TAG: wccp2_router
6363# Use this option to define your WCCP ``home'' router for
6364# Squid.
6365#
6366# wccp_router supports a single WCCP(v1) router
6367#
6368# wccp2_router supports multiple WCCPv2 routers
6369#
6370# only one of the two may be used at the same time and defines
6371# which version of WCCP to use.
6372#Default:
6373# WCCPv2 disabled.
6374
6375# TAG: wccp_version
6376# This directive is only relevant if you need to set up WCCP(v1)
6377# to some very old and end-of-life Cisco routers. In all other
6378# setups it must be left unset or at the default setting.
6379# It defines an internal version in the WCCP(v1) protocol,
6380# with version 4 being the officially documented protocol.
6381#
6382# According to some users, Cisco IOS 11.2 and earlier only
6383# support WCCP version 3. If you're using that or an earlier
6384# version of IOS, you may need to change this value to 3, otherwise
6385# do not specify this parameter.
6386#Default:
6387# wccp_version 4
6388
6389# TAG: wccp2_rebuild_wait
6390# If this is enabled Squid will wait for the cache dir rebuild to finish
6391# before sending the first wccp2 HereIAm packet
6392#Default:
6393# wccp2_rebuild_wait on
6394
6395# TAG: wccp2_forwarding_method
6396# WCCP2 allows the setting of forwarding methods between the
6397# router/switch and the cache. Valid values are as follows:
6398#
6399# gre - GRE encapsulation (forward the packet in a GRE/WCCP tunnel)
6400# l2 - L2 redirect (forward the packet using Layer 2/MAC rewriting)
6401#
6402# Currently (as of IOS 12.4) cisco routers only support GRE.
6403# Cisco switches only support the L2 redirect assignment method.
6404#Default:
6405# wccp2_forwarding_method gre
6406
6407# TAG: wccp2_return_method
6408# WCCP2 allows the setting of return methods between the
6409# router/switch and the cache for packets that the cache
6410# decides not to handle. Valid values are as follows:
6411#
6412# gre - GRE encapsulation (forward the packet in a GRE/WCCP tunnel)
6413# l2 - L2 redirect (forward the packet using Layer 2/MAC rewriting)
6414#
6415# Currently (as of IOS 12.4) cisco routers only support GRE.
6416# Cisco switches only support the L2 redirect assignment.
6417#
6418# If the "ip wccp redirect exclude in" command has been
6419# enabled on the cache interface, then it is still safe for
6420# the proxy server to use a l2 redirect method even if this
6421# option is set to GRE.
6422#Default:
6423# wccp2_return_method gre
6424
6425# TAG: wccp2_assignment_method
6426# WCCP2 allows the setting of methods to assign the WCCP hash
6427# Valid values are as follows:
6428#
6429# hash - Hash assignment
6430# mask - Mask assignment
6431#
6432# As a general rule, cisco routers support the hash assignment method
6433# and cisco switches support the mask assignment method.
6434#Default:
6435# wccp2_assignment_method hash
6436
6437# TAG: wccp2_service
6438# WCCP2 allows for multiple traffic services. There are two
6439# types: "standard" and "dynamic". The standard type defines
6440# one service id - http (id 0). The dynamic service ids can be from
6441# 51 to 255 inclusive. In order to use a dynamic service id
6442# one must define the type of traffic to be redirected; this is done
6443# using the wccp2_service_info option.
6444#
6445# The "standard" type does not require a wccp2_service_info option,
6446# just specifying the service id will suffice.
6447#
6448# MD5 service authentication can be enabled by adding
6449# "password=<password>" to the end of this service declaration.
6450#
6451# Examples:
6452#
6453# wccp2_service standard 0 # for the 'web-cache' standard service
6454# wccp2_service dynamic 80 # a dynamic service type which will be
6455# # fleshed out with subsequent options.
6456# wccp2_service standard 0 password=foo
6457#Default:
6458# Use the 'web-cache' standard service.
6459
6460# TAG: wccp2_service_info
6461# Dynamic WCCPv2 services require further information to define the
6462# traffic you wish to have diverted.
6463#
6464# The format is:
6465#
6466# wccp2_service_info <id> protocol=<protocol> flags=<flag>,<flag>..
6467# priority=<priority> ports=<port>,<port>..
6468#
6469# The relevant WCCPv2 flags:
6470# + src_ip_hash, dst_ip_hash
6471# + source_port_hash, dst_port_hash
6472# + src_ip_alt_hash, dst_ip_alt_hash
6473# + src_port_alt_hash, dst_port_alt_hash
6474# + ports_source
6475#
6476# The port list can be one to eight entries.
6477#
6478# Example:
6479#
6480# wccp2_service_info 80 protocol=tcp flags=src_ip_hash,ports_source
6481# priority=240 ports=80
6482#
6483# Note: the service id must have been defined by a previous
6484# 'wccp2_service dynamic <id>' entry.
6485#Default:
6486# none
6487
6488# TAG: wccp2_weight
6489# Each cache server gets assigned a set of the destination
6490# hash proportional to their weight.
6491#Default:
6492# wccp2_weight 10000
6493
6494# TAG: wccp_address
6495# Use this option if you require WCCPv2 to use a specific
6496# interface address.
6497#
6498# The default behavior is to not bind to any specific address.
6499#Default:
6500# Address selected by the operating system.
6501
6502# TAG: wccp2_address
6503# Use this option if you require WCCP to use a specific
6504# interface address.
6505#
6506# The default behavior is to not bind to any specific address.
6507#Default:
6508# Address selected by the operating system.
6509
6510# PERSISTENT CONNECTION HANDLING
6511# -----------------------------------------------------------------------------
6512#
6513# Also see "pconn_timeout" in the TIMEOUTS section
6514
6515# TAG: client_persistent_connections
6516# Persistent connection support for clients.
6517# Squid uses persistent connections (when allowed). You can use
6518# this option to disable persistent connections with clients.
6519#Default:
6520# client_persistent_connections on
6521
6522# TAG: server_persistent_connections
6523# Persistent connection support for servers.
6524# Squid uses persistent connections (when allowed). You can use
6525# this option to disable persistent connections with servers.
6526#Default:
6527# server_persistent_connections on
6528
6529# TAG: persistent_connection_after_error
6530# With this directive the use of persistent connections after
6531# HTTP errors can be disabled. Useful if you have clients
6532# who fail to handle errors on persistent connections proper.
6533#Default:
6534# persistent_connection_after_error on
6535
6536# TAG: detect_broken_pconn
6537# Some servers have been found to incorrectly signal the use
6538# of HTTP/1.0 persistent connections even on replies not
6539# compatible, causing significant delays. This server problem
6540# has mostly been seen on redirects.
6541#
6542# By enabling this directive Squid attempts to detect such
6543# broken replies and automatically assume the reply is finished
6544# after 10 seconds timeout.
6545#Default:
6546# detect_broken_pconn off
6547
6548# CACHE DIGEST OPTIONS
6549# -----------------------------------------------------------------------------
6550
6551# TAG: digest_generation
6552# This controls whether the server will generate a Cache Digest
6553# of its contents. By default, Cache Digest generation is
6554# enabled if Squid is compiled with --enable-cache-digests defined.
6555#Default:
6556# digest_generation on
6557
6558# TAG: digest_bits_per_entry
6559# This is the number of bits of the server's Cache Digest which
6560# will be associated with the Digest entry for a given HTTP
6561# Method and URL (public key) combination. The default is 5.
6562#Default:
6563# digest_bits_per_entry 5
6564
6565# TAG: digest_rebuild_period (seconds)
6566# This is the wait time between Cache Digest rebuilds.
6567#Default:
6568# digest_rebuild_period 1 hour
6569
6570# TAG: digest_rewrite_period (seconds)
6571# This is the wait time between Cache Digest writes to
6572# disk.
6573#Default:
6574# digest_rewrite_period 1 hour
6575
6576# TAG: digest_swapout_chunk_size (bytes)
6577# This is the number of bytes of the Cache Digest to write to
6578# disk at a time. It defaults to 4096 bytes (4KB), the Squid
6579# default swap page.
6580#Default:
6581# digest_swapout_chunk_size 4096 bytes
6582
6583# TAG: digest_rebuild_chunk_percentage (percent, 0-100)
6584# This is the percentage of the Cache Digest to be scanned at a
6585# time. By default it is set to 10% of the Cache Digest.
6586#Default:
6587# digest_rebuild_chunk_percentage 10
6588
6589# SNMP OPTIONS
6590# -----------------------------------------------------------------------------
6591
6592# TAG: snmp_port
6593# The port number where Squid listens for SNMP requests. To enable
6594# SNMP support set this to a suitable port number. Port number
6595# 3401 is often used for the Squid SNMP agent. By default it's
6596# set to "0" (disabled)
6597#
6598# Example:
6599# snmp_port 3401
6600#Default:
6601# SNMP disabled.
6602
6603# TAG: snmp_access
6604# Allowing or denying access to the SNMP port.
6605#
6606# All access to the agent is denied by default.
6607# usage:
6608#
6609# snmp_access allow|deny [!]aclname ...
6610#
6611# This clause only supports fast acl types.
6612# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
6613#
6614#Example:
6615# snmp_access allow snmppublic localhost
6616# snmp_access deny all
6617#Default:
6618# Deny, unless rules exist in squid.conf.
6619
6620# TAG: snmp_incoming_address
6621# Just like 'udp_incoming_address', but for the SNMP port.
6622#
6623# snmp_incoming_address is used for the SNMP socket receiving
6624# messages from SNMP agents.
6625#
6626# The default snmp_incoming_address is to listen on all
6627# available network interfaces.
6628#Default:
6629# Accept SNMP packets from all machine interfaces.
6630
6631# TAG: snmp_outgoing_address
6632# Just like 'udp_outgoing_address', but for the SNMP port.
6633#
6634# snmp_outgoing_address is used for SNMP packets returned to SNMP
6635# agents.
6636#
6637# If snmp_outgoing_address is not set it will use the same socket
6638# as snmp_incoming_address. Only change this if you want to have
6639# SNMP replies sent using another address than where this Squid
6640# listens for SNMP queries.
6641#
6642# NOTE, snmp_incoming_address and snmp_outgoing_address can not have
6643# the same value since they both use the same port.
6644#Default:
6645# Use snmp_incoming_address or an address selected by the operating system.
6646
6647# ICP OPTIONS
6648# -----------------------------------------------------------------------------
6649
6650# TAG: icp_port
6651# The port number where Squid sends and receives ICP queries to
6652# and from neighbor caches. The standard UDP port for ICP is 3130.
6653#
6654# Example:
6655# icp_port 3130
6656#Default:
6657# ICP disabled.
6658
6659# TAG: htcp_port
6660# The port number where Squid sends and receives HTCP queries to
6661# and from neighbor caches. To turn it on you want to set it to
6662# 4827.
6663#
6664# Example:
6665# htcp_port 4827
6666#Default:
6667# HTCP disabled.
6668
6669# TAG: log_icp_queries on|off
6670# If set, ICP queries are logged to access.log. You may wish
6671# do disable this if your ICP load is VERY high to speed things
6672# up or to simplify log analysis.
6673#Default:
6674# log_icp_queries on
6675
6676# TAG: udp_incoming_address
6677# udp_incoming_address is used for UDP packets received from other
6678# caches.
6679#
6680# The default behavior is to not bind to any specific address.
6681#
6682# Only change this if you want to have all UDP queries received on
6683# a specific interface/address.
6684#
6685# NOTE: udp_incoming_address is used by the ICP, HTCP, and DNS
6686# modules. Altering it will affect all of them in the same manner.
6687#
6688# see also; udp_outgoing_address
6689#
6690# NOTE, udp_incoming_address and udp_outgoing_address can not
6691# have the same value since they both use the same port.
6692#Default:
6693# Accept packets from all machine interfaces.
6694
6695# TAG: udp_outgoing_address
6696# udp_outgoing_address is used for UDP packets sent out to other
6697# caches.
6698#
6699# The default behavior is to not bind to any specific address.
6700#
6701# Instead it will use the same socket as udp_incoming_address.
6702# Only change this if you want to have UDP queries sent using another
6703# address than where this Squid listens for UDP queries from other
6704# caches.
6705#
6706# NOTE: udp_outgoing_address is used by the ICP, HTCP, and DNS
6707# modules. Altering it will affect all of them in the same manner.
6708#
6709# see also; udp_incoming_address
6710#
6711# NOTE, udp_incoming_address and udp_outgoing_address can not
6712# have the same value since they both use the same port.
6713#Default:
6714# Use udp_incoming_address or an address selected by the operating system.
6715
6716# TAG: icp_hit_stale on|off
6717# If you want to return ICP_HIT for stale cache objects, set this
6718# option to 'on'. If you have sibling relationships with caches
6719# in other administrative domains, this should be 'off'. If you only
6720# have sibling relationships with caches under your control,
6721# it is probably okay to set this to 'on'.
6722# If set to 'on', your siblings should use the option "allow-miss"
6723# on their cache_peer lines for connecting to you.
6724#Default:
6725# icp_hit_stale off
6726
6727# TAG: minimum_direct_hops
6728# If using the ICMP pinging stuff, do direct fetches for sites
6729# which are no more than this many hops away.
6730#Default:
6731# minimum_direct_hops 4
6732
6733# TAG: minimum_direct_rtt (msec)
6734# If using the ICMP pinging stuff, do direct fetches for sites
6735# which are no more than this many rtt milliseconds away.
6736#Default:
6737# minimum_direct_rtt 400
6738
6739# TAG: netdb_low
6740# The low water mark for the ICMP measurement database.
6741#
6742# Note: high watermark controlled by netdb_high directive.
6743#
6744# These watermarks are counts, not percents. The defaults are
6745# (low) 900 and (high) 1000. When the high water mark is
6746# reached, database entries will be deleted until the low
6747# mark is reached.
6748#Default:
6749# netdb_low 900
6750
6751# TAG: netdb_high
6752# The high water mark for the ICMP measurement database.
6753#
6754# Note: low watermark controlled by netdb_low directive.
6755#
6756# These watermarks are counts, not percents. The defaults are
6757# (low) 900 and (high) 1000. When the high water mark is
6758# reached, database entries will be deleted until the low
6759# mark is reached.
6760#Default:
6761# netdb_high 1000
6762
6763# TAG: netdb_ping_period
6764# The minimum period for measuring a site. There will be at
6765# least this much delay between successive pings to the same
6766# network. The default is five minutes.
6767#Default:
6768# netdb_ping_period 5 minutes
6769
6770# TAG: query_icmp on|off
6771# If you want to ask your peers to include ICMP data in their ICP
6772# replies, enable this option.
6773#
6774# If your peer has configured Squid (during compilation) with
6775# '--enable-icmp' that peer will send ICMP pings to origin server
6776# sites of the URLs it receives. If you enable this option the
6777# ICP replies from that peer will include the ICMP data (if available).
6778# Then, when choosing a parent cache, Squid will choose the parent with
6779# the minimal RTT to the origin server. When this happens, the
6780# hierarchy field of the access.log will be
6781# "CLOSEST_PARENT_MISS". This option is off by default.
6782#Default:
6783# query_icmp off
6784
6785# TAG: test_reachability on|off
6786# When this is 'on', ICP MISS replies will be ICP_MISS_NOFETCH
6787# instead of ICP_MISS if the target host is NOT in the ICMP
6788# database, or has a zero RTT.
6789#Default:
6790# test_reachability off
6791
6792# TAG: icp_query_timeout (msec)
6793# Normally Squid will automatically determine an optimal ICP
6794# query timeout value based on the round-trip-time of recent ICP
6795# queries. If you want to override the value determined by
6796# Squid, set this 'icp_query_timeout' to a non-zero value. This
6797# value is specified in MILLISECONDS, so, to use a 2-second
6798# timeout (the old default), you would write:
6799#
6800# icp_query_timeout 2000
6801#Default:
6802# Dynamic detection.
6803
6804# TAG: maximum_icp_query_timeout (msec)
6805# Normally the ICP query timeout is determined dynamically. But
6806# sometimes it can lead to very large values (say 5 seconds).
6807# Use this option to put an upper limit on the dynamic timeout
6808# value. Do NOT use this option to always use a fixed (instead
6809# of a dynamic) timeout value. To set a fixed timeout see the
6810# 'icp_query_timeout' directive.
6811#Default:
6812# maximum_icp_query_timeout 2000
6813
6814# TAG: minimum_icp_query_timeout (msec)
6815# Normally the ICP query timeout is determined dynamically. But
6816# sometimes it can lead to very small timeouts, even lower than
6817# the normal latency variance on your link due to traffic.
6818# Use this option to put an lower limit on the dynamic timeout
6819# value. Do NOT use this option to always use a fixed (instead
6820# of a dynamic) timeout value. To set a fixed timeout see the
6821# 'icp_query_timeout' directive.
6822#Default:
6823# minimum_icp_query_timeout 5
6824
6825# TAG: background_ping_rate time-units
6826# Controls how often the ICP pings are sent to siblings that
6827# have background-ping set.
6828#Default:
6829# background_ping_rate 10 seconds
6830
6831# MULTICAST ICP OPTIONS
6832# -----------------------------------------------------------------------------
6833
6834# TAG: mcast_groups
6835# This tag specifies a list of multicast groups which your server
6836# should join to receive multicasted ICP queries.
6837#
6838# NOTE! Be very careful what you put here! Be sure you
6839# understand the difference between an ICP _query_ and an ICP
6840# _reply_. This option is to be set only if you want to RECEIVE
6841# multicast queries. Do NOT set this option to SEND multicast
6842# ICP (use cache_peer for that). ICP replies are always sent via
6843# unicast, so this option does not affect whether or not you will
6844# receive replies from multicast group members.
6845#
6846# You must be very careful to NOT use a multicast address which
6847# is already in use by another group of caches.
6848#
6849# If you are unsure about multicast, please read the Multicast
6850# chapter in the Squid FAQ (http://www.squid-cache.org/FAQ/).
6851#
6852# Usage: mcast_groups 239.128.16.128 224.0.1.20
6853#
6854# By default, Squid doesn't listen on any multicast groups.
6855#Default:
6856# none
6857
6858# TAG: mcast_miss_addr
6859# Note: This option is only available if Squid is rebuilt with the
6860# -DMULTICAST_MISS_STREAM define
6861#
6862# If you enable this option, every "cache miss" URL will
6863# be sent out on the specified multicast address.
6864#
6865# Do not enable this option unless you are are absolutely
6866# certain you understand what you are doing.
6867#Default:
6868# disabled.
6869
6870# TAG: mcast_miss_ttl
6871# Note: This option is only available if Squid is rebuilt with the
6872# -DMULTICAST_MISS_STREAM define
6873#
6874# This is the time-to-live value for packets multicasted
6875# when multicasting off cache miss URLs is enabled. By
6876# default this is set to 'site scope', i.e. 16.
6877#Default:
6878# mcast_miss_ttl 16
6879
6880# TAG: mcast_miss_port
6881# Note: This option is only available if Squid is rebuilt with the
6882# -DMULTICAST_MISS_STREAM define
6883#
6884# This is the port number to be used in conjunction with
6885# 'mcast_miss_addr'.
6886#Default:
6887# mcast_miss_port 3135
6888
6889# TAG: mcast_miss_encode_key
6890# Note: This option is only available if Squid is rebuilt with the
6891# -DMULTICAST_MISS_STREAM define
6892#
6893# The URLs that are sent in the multicast miss stream are
6894# encrypted. This is the encryption key.
6895#Default:
6896# mcast_miss_encode_key XXXXXXXXXXXXXXXX
6897
6898# TAG: mcast_icp_query_timeout (msec)
6899# For multicast peers, Squid regularly sends out ICP "probes" to
6900# count how many other peers are listening on the given multicast
6901# address. This value specifies how long Squid should wait to
6902# count all the replies. The default is 2000 msec, or 2
6903# seconds.
6904#Default:
6905# mcast_icp_query_timeout 2000
6906
6907# INTERNAL ICON OPTIONS
6908# -----------------------------------------------------------------------------
6909
6910# TAG: icon_directory
6911# Where the icons are stored. These are normally kept in
6912# /usr/share/squid/icons
6913#Default:
6914# icon_directory /usr/share/squid/icons
6915
6916# TAG: global_internal_static
6917# This directive controls is Squid should intercept all requests for
6918# /squid-internal-static/ no matter which host the URL is requesting
6919# (default on setting), or if nothing special should be done for
6920# such URLs (off setting). The purpose of this directive is to make
6921# icons etc work better in complex cache hierarchies where it may
6922# not always be possible for all corners in the cache mesh to reach
6923# the server generating a directory listing.
6924#Default:
6925# global_internal_static on
6926
6927# TAG: short_icon_urls
6928# If this is enabled Squid will use short URLs for icons.
6929# If disabled it will revert to the old behavior of including
6930# it's own name and port in the URL.
6931#
6932# If you run a complex cache hierarchy with a mix of Squid and
6933# other proxies you may need to disable this directive.
6934#Default:
6935# short_icon_urls on
6936
6937# ERROR PAGE OPTIONS
6938# -----------------------------------------------------------------------------
6939
6940# TAG: error_directory
6941# If you wish to create your own versions of the default
6942# error files to customize them to suit your company copy
6943# the error/template files to another directory and point
6944# this tag at them.
6945#
6946# WARNING: This option will disable multi-language support
6947# on error pages if used.
6948#
6949# The squid developers are interested in making squid available in
6950# a wide variety of languages. If you are making translations for a
6951# language that Squid does not currently provide please consider
6952# contributing your translation back to the project.
6953# http://wiki.squid-cache.org/Translations
6954#
6955# The squid developers working on translations are happy to supply drop-in
6956# translated error files in exchange for any new language contributions.
6957#Default:
6958# Send error pages in the clients preferred language
6959
6960# TAG: error_default_language
6961# Set the default language which squid will send error pages in
6962# if no existing translation matches the clients language
6963# preferences.
6964#
6965# If unset (default) generic English will be used.
6966#
6967# The squid developers are interested in making squid available in
6968# a wide variety of languages. If you are interested in making
6969# translations for any language see the squid wiki for details.
6970# http://wiki.squid-cache.org/Translations
6971#Default:
6972# Generate English language pages.
6973
6974# TAG: error_log_languages
6975# Log to cache.log what languages users are attempting to
6976# auto-negotiate for translations.
6977#
6978# Successful negotiations are not logged. Only failures
6979# have meaning to indicate that Squid may need an upgrade
6980# of its error page translations.
6981#Default:
6982# error_log_languages on
6983
6984# TAG: err_page_stylesheet
6985# CSS Stylesheet to pattern the display of Squid default error pages.
6986#
6987# For information on CSS see http://www.w3.org/Style/CSS/
6988#Default:
6989# err_page_stylesheet /etc/squid/errorpage.css
6990
6991# TAG: err_html_text
6992# HTML text to include in error messages. Make this a "mailto"
6993# URL to your admin address, or maybe just a link to your
6994# organizations Web page.
6995#
6996# To include this in your error messages, you must rewrite
6997# the error template files (found in the "errors" directory).
6998# Wherever you want the 'err_html_text' line to appear,
6999# insert a %L tag in the error template file.
7000#Default:
7001# none
7002
7003# TAG: email_err_data on|off
7004# If enabled, information about the occurred error will be
7005# included in the mailto links of the ERR pages (if %W is set)
7006# so that the email body contains the data.
7007# Syntax is <A HREF="mailto:%w%W">%w</A>
7008#Default:
7009# email_err_data on
7010
7011# TAG: deny_info
7012# Usage: deny_info err_page_name acl
7013# or deny_info http://... acl
7014# or deny_info TCP_RESET acl
7015#
7016# This can be used to return a ERR_ page for requests which
7017# do not pass the 'http_access' rules. Squid remembers the last
7018# acl it evaluated in http_access, and if a 'deny_info' line exists
7019# for that ACL Squid returns a corresponding error page.
7020#
7021# The acl is typically the last acl on the http_access deny line which
7022# denied access. The exceptions to this rule are:
7023# - When Squid needs to request authentication credentials. It's then
7024# the first authentication related acl encountered
7025# - When none of the http_access lines matches. It's then the last
7026# acl processed on the last http_access line.
7027# - When the decision to deny access was made by an adaptation service,
7028# the acl name is the corresponding eCAP or ICAP service_name.
7029#
7030# NP: If providing your own custom error pages with error_directory
7031# you may also specify them by your custom file name:
7032# Example: deny_info ERR_CUSTOM_ACCESS_DENIED bad_guys
7033#
7034# By defaut Squid will send "403 Forbidden". A different 4xx or 5xx
7035# may be specified by prefixing the file name with the code and a colon.
7036# e.g. 404:ERR_CUSTOM_ACCESS_DENIED
7037#
7038# Alternatively you can tell Squid to reset the TCP connection
7039# by specifying TCP_RESET.
7040#
7041# Or you can specify an error URL or URL pattern. The browsers will
7042# get redirected to the specified URL after formatting tags have
7043# been replaced. Redirect will be done with 302 or 307 according to
7044# HTTP/1.1 specs. A different 3xx code may be specified by prefixing
7045# the URL. e.g. 303:http://example.com/
7046#
7047# URL FORMAT TAGS:
7048# %a - username (if available. Password NOT included)
7049# %B - FTP path URL
7050# %e - Error number
7051# %E - Error description
7052# %h - Squid hostname
7053# %H - Request domain name
7054# %i - Client IP Address
7055# %M - Request Method
7056# %O - Unescaped message result from external ACL helper
7057# %o - Message result from external ACL helper
7058# %p - Request Port number
7059# %P - Request Protocol name
7060# %R - Request URL path
7061# %T - Timestamp in RFC 1123 format
7062# %U - Full canonical URL from client
7063# (HTTPS URLs terminate with *)
7064# %u - Full canonical URL from client
7065# %w - Admin email from squid.conf
7066# %x - Error name
7067# %% - Literal percent (%) code
7068#
7069#Default:
7070# none
7071
7072# OPTIONS INFLUENCING REQUEST FORWARDING
7073# -----------------------------------------------------------------------------
7074
7075# TAG: nonhierarchical_direct
7076# By default, Squid will send any non-hierarchical requests
7077# (not cacheable request type) direct to origin servers.
7078#
7079# When this is set to "off", Squid will prefer to send these
7080# requests to parents.
7081#
7082# Note that in most configurations, by turning this off you will only
7083# add latency to these request without any improvement in global hit
7084# ratio.
7085#
7086# This option only sets a preference. If the parent is unavailable a
7087# direct connection to the origin server may still be attempted. To
7088# completely prevent direct connections use never_direct.
7089#Default:
7090# nonhierarchical_direct on
7091
7092# TAG: prefer_direct
7093# Normally Squid tries to use parents for most requests. If you for some
7094# reason like it to first try going direct and only use a parent if
7095# going direct fails set this to on.
7096#
7097# By combining nonhierarchical_direct off and prefer_direct on you
7098# can set up Squid to use a parent as a backup path if going direct
7099# fails.
7100#
7101# Note: If you want Squid to use parents for all requests see
7102# the never_direct directive. prefer_direct only modifies how Squid
7103# acts on cacheable requests.
7104#Default:
7105# prefer_direct off
7106
7107# TAG: cache_miss_revalidate on|off
7108# RFC 7232 defines a conditional request mechanism to prevent
7109# response objects being unnecessarily transferred over the network.
7110# If that mechanism is used by the client and a cache MISS occurs
7111# it can prevent new cache entries being created.
7112#
7113# This option determines whether Squid on cache MISS will pass the
7114# client revalidation request to the server or tries to fetch new
7115# content for caching. It can be useful while the cache is mostly
7116# empty to more quickly have the cache populated by generating
7117# non-conditional GETs.
7118#
7119# When set to 'on' (default), Squid will pass all client If-* headers
7120# to the server. This permits server responses without a cacheable
7121# payload to be delivered and on MISS no new cache entry is created.
7122#
7123# When set to 'off' and if the request is cacheable, Squid will
7124# remove the clients If-Modified-Since and If-None-Match headers from
7125# the request sent to the server. This requests a 200 status response
7126# from the server to create a new cache entry with.
7127#Default:
7128# cache_miss_revalidate on
7129
7130# TAG: always_direct
7131# Usage: always_direct allow|deny [!]aclname ...
7132#
7133# Here you can use ACL elements to specify requests which should
7134# ALWAYS be forwarded by Squid to the origin servers without using
7135# any peers. For example, to always directly forward requests for
7136# local servers ignoring any parents or siblings you may have use
7137# something like:
7138#
7139# acl local-servers dstdomain my.domain.net
7140# always_direct allow local-servers
7141#
7142# To always forward FTP requests directly, use
7143#
7144# acl FTP proto FTP
7145# always_direct allow FTP
7146#
7147# NOTE: There is a similar, but opposite option named
7148# 'never_direct'. You need to be aware that "always_direct deny
7149# foo" is NOT the same thing as "never_direct allow foo". You
7150# may need to use a deny rule to exclude a more-specific case of
7151# some other rule. Example:
7152#
7153# acl local-external dstdomain external.foo.net
7154# acl local-servers dstdomain .foo.net
7155# always_direct deny local-external
7156# always_direct allow local-servers
7157#
7158# NOTE: If your goal is to make the client forward the request
7159# directly to the origin server bypassing Squid then this needs
7160# to be done in the client configuration. Squid configuration
7161# can only tell Squid how Squid should fetch the object.
7162#
7163# NOTE: This directive is not related to caching. The replies
7164# is cached as usual even if you use always_direct. To not cache
7165# the replies see the 'cache' directive.
7166#
7167# This clause supports both fast and slow acl types.
7168# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
7169#Default:
7170# Prevent any cache_peer being used for this request.
7171
7172# TAG: never_direct
7173# Usage: never_direct allow|deny [!]aclname ...
7174#
7175# never_direct is the opposite of always_direct. Please read
7176# the description for always_direct if you have not already.
7177#
7178# With 'never_direct' you can use ACL elements to specify
7179# requests which should NEVER be forwarded directly to origin
7180# servers. For example, to force the use of a proxy for all
7181# requests, except those in your local domain use something like:
7182#
7183# acl local-servers dstdomain .foo.net
7184# never_direct deny local-servers
7185# never_direct allow all
7186#
7187# or if Squid is inside a firewall and there are local intranet
7188# servers inside the firewall use something like:
7189#
7190# acl local-intranet dstdomain .foo.net
7191# acl local-external dstdomain external.foo.net
7192# always_direct deny local-external
7193# always_direct allow local-intranet
7194# never_direct allow all
7195#
7196# This clause supports both fast and slow acl types.
7197# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
7198#Default:
7199# Allow DNS results to be used for this request.
7200
7201# ADVANCED NETWORKING OPTIONS
7202# -----------------------------------------------------------------------------
7203
7204# TAG: incoming_udp_average
7205# Heavy voodoo here. I can't even believe you are reading this.
7206# Are you crazy? Don't even think about adjusting these unless
7207# you understand the algorithms in comm_select.c first!
7208#Default:
7209# incoming_udp_average 6
7210
7211# TAG: incoming_tcp_average
7212# Heavy voodoo here. I can't even believe you are reading this.
7213# Are you crazy? Don't even think about adjusting these unless
7214# you understand the algorithms in comm_select.c first!
7215#Default:
7216# incoming_tcp_average 4
7217
7218# TAG: incoming_dns_average
7219# Heavy voodoo here. I can't even believe you are reading this.
7220# Are you crazy? Don't even think about adjusting these unless
7221# you understand the algorithms in comm_select.c first!
7222#Default:
7223# incoming_dns_average 4
7224
7225# TAG: min_udp_poll_cnt
7226# Heavy voodoo here. I can't even believe you are reading this.
7227# Are you crazy? Don't even think about adjusting these unless
7228# you understand the algorithms in comm_select.c first!
7229#Default:
7230# min_udp_poll_cnt 8
7231
7232# TAG: min_dns_poll_cnt
7233# Heavy voodoo here. I can't even believe you are reading this.
7234# Are you crazy? Don't even think about adjusting these unless
7235# you understand the algorithms in comm_select.c first!
7236#Default:
7237# min_dns_poll_cnt 8
7238
7239# TAG: min_tcp_poll_cnt
7240# Heavy voodoo here. I can't even believe you are reading this.
7241# Are you crazy? Don't even think about adjusting these unless
7242# you understand the algorithms in comm_select.c first!
7243#Default:
7244# min_tcp_poll_cnt 8
7245
7246# TAG: accept_filter
7247# FreeBSD:
7248#
7249# The name of an accept(2) filter to install on Squid's
7250# listen socket(s). This feature is perhaps specific to
7251# FreeBSD and requires support in the kernel.
7252#
7253# The 'httpready' filter delays delivering new connections
7254# to Squid until a full HTTP request has been received.
7255# See the accf_http(9) man page for details.
7256#
7257# The 'dataready' filter delays delivering new connections
7258# to Squid until there is some data to process.
7259# See the accf_dataready(9) man page for details.
7260#
7261# Linux:
7262#
7263# The 'data' filter delays delivering of new connections
7264# to Squid until there is some data to process by TCP_ACCEPT_DEFER.
7265# You may optionally specify a number of seconds to wait by
7266# 'data=N' where N is the number of seconds. Defaults to 30
7267# if not specified. See the tcp(7) man page for details.
7268#EXAMPLE:
7269## FreeBSD
7270#accept_filter httpready
7271## Linux
7272#accept_filter data
7273#Default:
7274# none
7275
7276# TAG: client_ip_max_connections
7277# Set an absolute limit on the number of connections a single
7278# client IP can use. Any more than this and Squid will begin to drop
7279# new connections from the client until it closes some links.
7280#
7281# Note that this is a global limit. It affects all HTTP, HTCP, Gopher and FTP
7282# connections from the client. For finer control use the ACL access controls.
7283#
7284# Requires client_db to be enabled (the default).
7285#
7286# WARNING: This may noticably slow down traffic received via external proxies
7287# or NAT devices and cause them to rebound error messages back to their clients.
7288#Default:
7289# No limit.
7290
7291# TAG: tcp_recv_bufsize (bytes)
7292# Size of receive buffer to set for TCP sockets. Probably just
7293# as easy to change your kernel's default.
7294# Omit from squid.conf to use the default buffer size.
7295#Default:
7296# Use operating system TCP defaults.
7297
7298# ICAP OPTIONS
7299# -----------------------------------------------------------------------------
7300
7301# TAG: icap_enable on|off
7302# If you want to enable the ICAP module support, set this to on.
7303#Default:
7304# icap_enable off
7305
7306# TAG: icap_connect_timeout
7307# This parameter specifies how long to wait for the TCP connect to
7308# the requested ICAP server to complete before giving up and either
7309# terminating the HTTP transaction or bypassing the failure.
7310#
7311# The default for optional services is peer_connect_timeout.
7312# The default for essential services is connect_timeout.
7313# If this option is explicitly set, its value applies to all services.
7314#Default:
7315# none
7316
7317# TAG: icap_io_timeout time-units
7318# This parameter specifies how long to wait for an I/O activity on
7319# an established, active ICAP connection before giving up and
7320# either terminating the HTTP transaction or bypassing the
7321# failure.
7322#Default:
7323# Use read_timeout.
7324
7325# TAG: icap_service_failure_limit limit [in memory-depth time-units]
7326# The limit specifies the number of failures that Squid tolerates
7327# when establishing a new TCP connection with an ICAP service. If
7328# the number of failures exceeds the limit, the ICAP service is
7329# not used for new ICAP requests until it is time to refresh its
7330# OPTIONS.
7331#
7332# A negative value disables the limit. Without the limit, an ICAP
7333# service will not be considered down due to connectivity failures
7334# between ICAP OPTIONS requests.
7335#
7336# Squid forgets ICAP service failures older than the specified
7337# value of memory-depth. The memory fading algorithm
7338# is approximate because Squid does not remember individual
7339# errors but groups them instead, splitting the option
7340# value into ten time slots of equal length.
7341#
7342# When memory-depth is 0 and by default this option has no
7343# effect on service failure expiration.
7344#
7345# Squid always forgets failures when updating service settings
7346# using an ICAP OPTIONS transaction, regardless of this option
7347# setting.
7348#
7349# For example,
7350# # suspend service usage after 10 failures in 5 seconds:
7351# icap_service_failure_limit 10 in 5 seconds
7352#Default:
7353# icap_service_failure_limit 10
7354
7355# TAG: icap_service_revival_delay
7356# The delay specifies the number of seconds to wait after an ICAP
7357# OPTIONS request failure before requesting the options again. The
7358# failed ICAP service is considered "down" until fresh OPTIONS are
7359# fetched.
7360#
7361# The actual delay cannot be smaller than the hardcoded minimum
7362# delay of 30 seconds.
7363#Default:
7364# icap_service_revival_delay 180
7365
7366# TAG: icap_preview_enable on|off
7367# The ICAP Preview feature allows the ICAP server to handle the
7368# HTTP message by looking only at the beginning of the message body
7369# or even without receiving the body at all. In some environments,
7370# previews greatly speedup ICAP processing.
7371#
7372# During an ICAP OPTIONS transaction, the server may tell Squid what
7373# HTTP messages should be previewed and how big the preview should be.
7374# Squid will not use Preview if the server did not request one.
7375#
7376# To disable ICAP Preview for all ICAP services, regardless of
7377# individual ICAP server OPTIONS responses, set this option to "off".
7378#Example:
7379#icap_preview_enable off
7380#Default:
7381# icap_preview_enable on
7382
7383# TAG: icap_preview_size
7384# The default size of preview data to be sent to the ICAP server.
7385# This value might be overwritten on a per server basis by OPTIONS requests.
7386#Default:
7387# No preview sent.
7388
7389# TAG: icap_206_enable on|off
7390# 206 (Partial Content) responses is an ICAP extension that allows the
7391# ICAP agents to optionally combine adapted and original HTTP message
7392# content. The decision to combine is postponed until the end of the
7393# ICAP response. Squid supports Partial Content extension by default.
7394#
7395# Activation of the Partial Content extension is negotiated with each
7396# ICAP service during OPTIONS exchange. Most ICAP servers should handle
7397# negotation correctly even if they do not support the extension, but
7398# some might fail. To disable Partial Content support for all ICAP
7399# services and to avoid any negotiation, set this option to "off".
7400#
7401# Example:
7402# icap_206_enable off
7403#Default:
7404# icap_206_enable on
7405
7406# TAG: icap_default_options_ttl
7407# The default TTL value for ICAP OPTIONS responses that don't have
7408# an Options-TTL header.
7409#Default:
7410# icap_default_options_ttl 60
7411
7412# TAG: icap_persistent_connections on|off
7413# Whether or not Squid should use persistent connections to
7414# an ICAP server.
7415#Default:
7416# icap_persistent_connections on
7417
7418# TAG: adaptation_send_client_ip on|off
7419# If enabled, Squid shares HTTP client IP information with adaptation
7420# services. For ICAP, Squid adds the X-Client-IP header to ICAP requests.
7421# For eCAP, Squid sets the libecap::metaClientIp transaction option.
7422#
7423# See also: adaptation_uses_indirect_client
7424#Default:
7425# adaptation_send_client_ip off
7426
7427# TAG: adaptation_send_username on|off
7428# This sends authenticated HTTP client username (if available) to
7429# the adaptation service.
7430#
7431# For ICAP, the username value is encoded based on the
7432# icap_client_username_encode option and is sent using the header
7433# specified by the icap_client_username_header option.
7434#Default:
7435# adaptation_send_username off
7436
7437# TAG: icap_client_username_header
7438# ICAP request header name to use for adaptation_send_username.
7439#Default:
7440# icap_client_username_header X-Client-Username
7441
7442# TAG: icap_client_username_encode on|off
7443# Whether to base64 encode the authenticated client username.
7444#Default:
7445# icap_client_username_encode off
7446
7447# TAG: icap_service
7448# Defines a single ICAP service using the following format:
7449#
7450# icap_service id vectoring_point uri [option ...]
7451#
7452# id: ID
7453# an opaque identifier or name which is used to direct traffic to
7454# this specific service. Must be unique among all adaptation
7455# services in squid.conf.
7456#
7457# vectoring_point: reqmod_precache|reqmod_postcache|respmod_precache|respmod_postcache
7458# This specifies at which point of transaction processing the
7459# ICAP service should be activated. *_postcache vectoring points
7460# are not yet supported.
7461#
7462# uri: icap://servername:port/servicepath
7463# ICAP server and service location.
7464# icaps://servername:port/servicepath
7465# The "icap:" URI scheme is used for traditional ICAP server and
7466# service location (default port is 1344, connections are not
7467# encrypted). The "icaps:" URI scheme is for Secure ICAP
7468# services that use SSL/TLS-encrypted ICAP connections (by
7469# default, on port 11344).
7470#
7471# ICAP does not allow a single service to handle both REQMOD and RESPMOD
7472# transactions. Squid does not enforce that requirement. You can specify
7473# services with the same service_url and different vectoring_points. You
7474# can even specify multiple identical services as long as their
7475# service_names differ.
7476#
7477# To activate a service, use the adaptation_access directive. To group
7478# services, use adaptation_service_chain and adaptation_service_set.
7479#
7480# Service options are separated by white space. ICAP services support
7481# the following name=value options:
7482#
7483# bypass=on|off|1|0
7484# If set to 'on' or '1', the ICAP service is treated as
7485# optional. If the service cannot be reached or malfunctions,
7486# Squid will try to ignore any errors and process the message as
7487# if the service was not enabled. No all ICAP errors can be
7488# bypassed. If set to 0, the ICAP service is treated as
7489# essential and all ICAP errors will result in an error page
7490# returned to the HTTP client.
7491#
7492# Bypass is off by default: services are treated as essential.
7493#
7494# routing=on|off|1|0
7495# If set to 'on' or '1', the ICAP service is allowed to
7496# dynamically change the current message adaptation plan by
7497# returning a chain of services to be used next. The services
7498# are specified using the X-Next-Services ICAP response header
7499# value, formatted as a comma-separated list of service names.
7500# Each named service should be configured in squid.conf. Other
7501# services are ignored. An empty X-Next-Services value results
7502# in an empty plan which ends the current adaptation.
7503#
7504# Dynamic adaptation plan may cross or cover multiple supported
7505# vectoring points in their natural processing order.
7506#
7507# Routing is not allowed by default: the ICAP X-Next-Services
7508# response header is ignored.
7509#
7510# ipv6=on|off
7511# Only has effect on split-stack systems. The default on those systems
7512# is to use IPv4-only connections. When set to 'on' this option will
7513# make Squid use IPv6-only connections to contact this ICAP service.
7514#
7515# on-overload=block|bypass|wait|force
7516# If the service Max-Connections limit has been reached, do
7517# one of the following for each new ICAP transaction:
7518# * block: send an HTTP error response to the client
7519# * bypass: ignore the "over-connected" ICAP service
7520# * wait: wait (in a FIFO queue) for an ICAP connection slot
7521# * force: proceed, ignoring the Max-Connections limit
7522#
7523# In SMP mode with N workers, each worker assumes the service
7524# connection limit is Max-Connections/N, even though not all
7525# workers may use a given service.
7526#
7527# The default value is "bypass" if service is bypassable,
7528# otherwise it is set to "wait".
7529#
7530#
7531# max-conn=number
7532# Use the given number as the Max-Connections limit, regardless
7533# of the Max-Connections value given by the service, if any.
7534#
7535# connection-encryption=on|off
7536# Determines the ICAP service effect on the connections_encrypted
7537# ACL.
7538#
7539# The default is "on" for Secure ICAP services (i.e., those
7540# with the icaps:// service URIs scheme) and "off" for plain ICAP
7541# services.
7542#
7543# Does not affect ICAP connections (e.g., does not turn Secure
7544# ICAP on or off).
7545#
7546# ==== ICAPS / TLS OPTIONS ====
7547#
7548# These options are used for Secure ICAP (icaps://....) services only.
7549#
7550# tls-cert=/path/to/ssl/certificate
7551# A client X.509 certificate to use when connecting to
7552# this ICAP server.
7553#
7554# tls-key=/path/to/ssl/key
7555# The private key corresponding to the previous
7556# tls-cert= option.
7557#
7558# If tls-key= is not specified tls-cert= is assumed to
7559# reference a PEM file containing both the certificate
7560# and private key.
7561#
7562# tls-cipher=... The list of valid TLS/SSL ciphers to use when connecting
7563# to this icap server.
7564#
7565# tls-min-version=1.N
7566# The minimum TLS protocol version to permit. To control
7567# SSLv3 use the tls-options= parameter.
7568# Supported Values: 1.0 (default), 1.1, 1.2
7569#
7570# tls-options=... Specify various OpenSSL library options:
7571#
7572# NO_SSLv3 Disallow the use of SSLv3
7573#
7574# SINGLE_DH_USE
7575# Always create a new key when using
7576# temporary/ephemeral DH key exchanges
7577#
7578# ALL Enable various bug workarounds
7579# suggested as "harmless" by OpenSSL
7580# Be warned that this reduces SSL/TLS
7581# strength to some attacks.
7582#
7583# See the OpenSSL SSL_CTX_set_options documentation for a
7584# more complete list. Options relevant only to SSLv2 are
7585# not supported.
7586#
7587# tls-cafile= PEM file containing CA certificates to use when verifying
7588# the icap server certificate.
7589# Use to specify intermediate CA certificate(s) if not sent
7590# by the server. Or the full CA chain for the server when
7591# using the tls-default-ca=off flag.
7592# May be repeated to load multiple files.
7593#
7594# tls-capath=... A directory containing additional CA certificates to
7595# use when verifying the icap server certificate.
7596# Requires OpenSSL or LibreSSL.
7597#
7598# tls-crlfile=... A certificate revocation list file to use when
7599# verifying the icap server certificate.
7600#
7601# tls-flags=... Specify various flags modifying the Squid TLS implementation:
7602#
7603# DONT_VERIFY_PEER
7604# Accept certificates even if they fail to
7605# verify.
7606# DONT_VERIFY_DOMAIN
7607# Don't verify the icap server certificate
7608# matches the server name
7609#
7610# tls-default-ca[=off]
7611# Whether to use the system Trusted CAs. Default is ON.
7612#
7613# tls-domain= The icap server name as advertised in it's certificate.
7614# Used for verifying the correctness of the received icap
7615# server certificate. If not specified the icap server
7616# hostname extracted from ICAP URI will be used.
7617#
7618# Older icap_service format without optional named parameters is
7619# deprecated but supported for backward compatibility.
7620#
7621#Example:
7622#icap_service svcBlocker reqmod_precache icap://icap1.mydomain.net:1344/reqmod bypass=0
7623#icap_service svcLogger reqmod_precache icaps://icap2.mydomain.net:11344/reqmod routing=on
7624#Default:
7625# none
7626
7627# TAG: icap_class
7628# This deprecated option was documented to define an ICAP service
7629# chain, even though it actually defined a set of similar, redundant
7630# services, and the chains were not supported.
7631#
7632# To define a set of redundant services, please use the
7633# adaptation_service_set directive. For service chains, use
7634# adaptation_service_chain.
7635#Default:
7636# none
7637
7638# TAG: icap_access
7639# This option is deprecated. Please use adaptation_access, which
7640# has the same ICAP functionality, but comes with better
7641# documentation, and eCAP support.
7642#Default:
7643# none
7644
7645# eCAP OPTIONS
7646# -----------------------------------------------------------------------------
7647
7648# TAG: ecap_enable on|off
7649# Controls whether eCAP support is enabled.
7650#Default:
7651# ecap_enable off
7652
7653# TAG: ecap_service
7654# Defines a single eCAP service
7655#
7656# ecap_service id vectoring_point uri [option ...]
7657#
7658# id: ID
7659# an opaque identifier or name which is used to direct traffic to
7660# this specific service. Must be unique among all adaptation
7661# services in squid.conf.
7662#
7663# vectoring_point: reqmod_precache|reqmod_postcache|respmod_precache|respmod_postcache
7664# This specifies at which point of transaction processing the
7665# eCAP service should be activated. *_postcache vectoring points
7666# are not yet supported.
7667#
7668# uri: ecap://vendor/service_name?custom&cgi=style¶meters=optional
7669# Squid uses the eCAP service URI to match this configuration
7670# line with one of the dynamically loaded services. Each loaded
7671# eCAP service must have a unique URI. Obtain the right URI from
7672# the service provider.
7673#
7674# To activate a service, use the adaptation_access directive. To group
7675# services, use adaptation_service_chain and adaptation_service_set.
7676#
7677# Service options are separated by white space. eCAP services support
7678# the following name=value options:
7679#
7680# bypass=on|off|1|0
7681# If set to 'on' or '1', the eCAP service is treated as optional.
7682# If the service cannot be reached or malfunctions, Squid will try
7683# to ignore any errors and process the message as if the service
7684# was not enabled. No all eCAP errors can be bypassed.
7685# If set to 'off' or '0', the eCAP service is treated as essential
7686# and all eCAP errors will result in an error page returned to the
7687# HTTP client.
7688#
7689# Bypass is off by default: services are treated as essential.
7690#
7691# routing=on|off|1|0
7692# If set to 'on' or '1', the eCAP service is allowed to
7693# dynamically change the current message adaptation plan by
7694# returning a chain of services to be used next.
7695#
7696# Dynamic adaptation plan may cross or cover multiple supported
7697# vectoring points in their natural processing order.
7698#
7699# Routing is not allowed by default.
7700#
7701# connection-encryption=on|off
7702# Determines the eCAP service effect on the connections_encrypted
7703# ACL.
7704#
7705# Defaults to "on", which does not taint the master transaction
7706# w.r.t. that ACL.
7707#
7708# Does not affect eCAP API calls.
7709#
7710# Older ecap_service format without optional named parameters is
7711# deprecated but supported for backward compatibility.
7712#
7713#
7714#Example:
7715#ecap_service s1 reqmod_precache ecap://filters.R.us/leakDetector?on_error=block bypass=off
7716#ecap_service s2 respmod_precache ecap://filters.R.us/virusFilter config=/etc/vf.cfg bypass=on
7717#Default:
7718# none
7719
7720# TAG: loadable_modules
7721# Instructs Squid to load the specified dynamic module(s) or activate
7722# preloaded module(s).
7723#Example:
7724#loadable_modules /usr/lib/MinimalAdapter.so
7725#Default:
7726# none
7727
7728# MESSAGE ADAPTATION OPTIONS
7729# -----------------------------------------------------------------------------
7730
7731# TAG: adaptation_service_set
7732#
7733# Configures an ordered set of similar, redundant services. This is
7734# useful when hot standby or backup adaptation servers are available.
7735#
7736# adaptation_service_set set_name service_name1 service_name2 ...
7737#
7738# The named services are used in the set declaration order. The first
7739# applicable adaptation service from the set is used first. The next
7740# applicable service is tried if and only if the transaction with the
7741# previous service fails and the message waiting to be adapted is still
7742# intact.
7743#
7744# When adaptation starts, broken services are ignored as if they were
7745# not a part of the set. A broken service is a down optional service.
7746#
7747# The services in a set must be attached to the same vectoring point
7748# (e.g., pre-cache) and use the same adaptation method (e.g., REQMOD).
7749#
7750# If all services in a set are optional then adaptation failures are
7751# bypassable. If all services in the set are essential, then a
7752# transaction failure with one service may still be retried using
7753# another service from the set, but when all services fail, the master
7754# transaction fails as well.
7755#
7756# A set may contain a mix of optional and essential services, but that
7757# is likely to lead to surprising results because broken services become
7758# ignored (see above), making previously bypassable failures fatal.
7759# Technically, it is the bypassability of the last failed service that
7760# matters.
7761#
7762# See also: adaptation_access adaptation_service_chain
7763#
7764#Example:
7765#adaptation_service_set svcBlocker urlFilterPrimary urlFilterBackup
7766#adaptation service_set svcLogger loggerLocal loggerRemote
7767#Default:
7768# none
7769
7770# TAG: adaptation_service_chain
7771#
7772# Configures a list of complementary services that will be applied
7773# one-by-one, forming an adaptation chain or pipeline. This is useful
7774# when Squid must perform different adaptations on the same message.
7775#
7776# adaptation_service_chain chain_name service_name1 svc_name2 ...
7777#
7778# The named services are used in the chain declaration order. The first
7779# applicable adaptation service from the chain is used first. The next
7780# applicable service is applied to the successful adaptation results of
7781# the previous service in the chain.
7782#
7783# When adaptation starts, broken services are ignored as if they were
7784# not a part of the chain. A broken service is a down optional service.
7785#
7786# Request satisfaction terminates the adaptation chain because Squid
7787# does not currently allow declaration of RESPMOD services at the
7788# "reqmod_precache" vectoring point (see icap_service or ecap_service).
7789#
7790# The services in a chain must be attached to the same vectoring point
7791# (e.g., pre-cache) and use the same adaptation method (e.g., REQMOD).
7792#
7793# A chain may contain a mix of optional and essential services. If an
7794# essential adaptation fails (or the failure cannot be bypassed for
7795# other reasons), the master transaction fails. Otherwise, the failure
7796# is bypassed as if the failed adaptation service was not in the chain.
7797#
7798# See also: adaptation_access adaptation_service_set
7799#
7800#Example:
7801#adaptation_service_chain svcRequest requestLogger urlFilter leakDetector
7802#Default:
7803# none
7804
7805# TAG: adaptation_access
7806# Sends an HTTP transaction to an ICAP or eCAP adaptation service.
7807#
7808# adaptation_access service_name allow|deny [!]aclname...
7809# adaptation_access set_name allow|deny [!]aclname...
7810#
7811# At each supported vectoring point, the adaptation_access
7812# statements are processed in the order they appear in this
7813# configuration file. Statements pointing to the following services
7814# are ignored (i.e., skipped without checking their ACL):
7815#
7816# - services serving different vectoring points
7817# - "broken-but-bypassable" services
7818# - "up" services configured to ignore such transactions
7819# (e.g., based on the ICAP Transfer-Ignore header).
7820#
7821# When a set_name is used, all services in the set are checked
7822# using the same rules, to find the first applicable one. See
7823# adaptation_service_set for details.
7824#
7825# If an access list is checked and there is a match, the
7826# processing stops: For an "allow" rule, the corresponding
7827# adaptation service is used for the transaction. For a "deny"
7828# rule, no adaptation service is activated.
7829#
7830# It is currently not possible to apply more than one adaptation
7831# service at the same vectoring point to the same HTTP transaction.
7832#
7833# See also: icap_service and ecap_service
7834#
7835#Example:
7836#adaptation_access service_1 allow all
7837#Default:
7838# Allow, unless rules exist in squid.conf.
7839
7840# TAG: adaptation_service_iteration_limit
7841# Limits the number of iterations allowed when applying adaptation
7842# services to a message. If your longest adaptation set or chain
7843# may have more than 16 services, increase the limit beyond its
7844# default value of 16. If detecting infinite iteration loops sooner
7845# is critical, make the iteration limit match the actual number
7846# of services in your longest adaptation set or chain.
7847#
7848# Infinite adaptation loops are most likely with routing services.
7849#
7850# See also: icap_service routing=1
7851#Default:
7852# adaptation_service_iteration_limit 16
7853
7854# TAG: adaptation_masterx_shared_names
7855# For each master transaction (i.e., the HTTP request and response
7856# sequence, including all related ICAP and eCAP exchanges), Squid
7857# maintains a table of metadata. The table entries are (name, value)
7858# pairs shared among eCAP and ICAP exchanges. The table is destroyed
7859# with the master transaction.
7860#
7861# This option specifies the table entry names that Squid must accept
7862# from and forward to the adaptation transactions.
7863#
7864# An ICAP REQMOD or RESPMOD transaction may set an entry in the
7865# shared table by returning an ICAP header field with a name
7866# specified in adaptation_masterx_shared_names.
7867#
7868# An eCAP REQMOD or RESPMOD transaction may set an entry in the
7869# shared table by implementing the libecap::visitEachOption() API
7870# to provide an option with a name specified in
7871# adaptation_masterx_shared_names.
7872#
7873# Squid will store and forward the set entry to subsequent adaptation
7874# transactions within the same master transaction scope.
7875#
7876# Only one shared entry name is supported at this time.
7877#
7878#Example:
7879## share authentication information among ICAP services
7880#adaptation_masterx_shared_names X-Subscriber-ID
7881#Default:
7882# none
7883
7884# TAG: adaptation_meta
7885# This option allows Squid administrator to add custom ICAP request
7886# headers or eCAP options to Squid ICAP requests or eCAP transactions.
7887# Use it to pass custom authentication tokens and other
7888# transaction-state related meta information to an ICAP/eCAP service.
7889#
7890# The addition of a meta header is ACL-driven:
7891# adaptation_meta name value [!]aclname ...
7892#
7893# Processing for a given header name stops after the first ACL list match.
7894# Thus, it is impossible to add two headers with the same name. If no ACL
7895# lists match for a given header name, no such header is added. For
7896# example:
7897#
7898# # do not debug transactions except for those that need debugging
7899# adaptation_meta X-Debug 1 needs_debugging
7900#
7901# # log all transactions except for those that must remain secret
7902# adaptation_meta X-Log 1 !keep_secret
7903#
7904# # mark transactions from users in the "G 1" group
7905# adaptation_meta X-Authenticated-Groups "G 1" authed_as_G1
7906#
7907# The "value" parameter may be a regular squid.conf token or a "double
7908# quoted string". Within the quoted string, use backslash (\) to escape
7909# any character, which is currently only useful for escaping backslashes
7910# and double quotes. For example,
7911# "this string has one backslash (\\) and two \"quotes\""
7912#
7913# Used adaptation_meta header values may be logged via %note
7914# logformat code. If multiple adaptation_meta headers with the same name
7915# are used during master transaction lifetime, the header values are
7916# logged in the order they were used and duplicate values are ignored
7917# (only the first repeated value will be logged).
7918#Default:
7919# none
7920
7921# TAG: icap_retry
7922# This ACL determines which retriable ICAP transactions are
7923# retried. Transactions that received a complete ICAP response
7924# and did not have to consume or produce HTTP bodies to receive
7925# that response are usually retriable.
7926#
7927# icap_retry allow|deny [!]aclname ...
7928#
7929# Squid automatically retries some ICAP I/O timeouts and errors
7930# due to persistent connection race conditions.
7931#
7932# See also: icap_retry_limit
7933#Default:
7934# icap_retry deny all
7935
7936# TAG: icap_retry_limit
7937# Limits the number of retries allowed.
7938#
7939# Communication errors due to persistent connection race
7940# conditions are unavoidable, automatically retried, and do not
7941# count against this limit.
7942#
7943# See also: icap_retry
7944#Default:
7945# No retries are allowed.
7946
7947# DNS OPTIONS
7948# -----------------------------------------------------------------------------
7949
7950# TAG: check_hostnames
7951# For security and stability reasons Squid can check
7952# hostnames for Internet standard RFC compliance. If you want
7953# Squid to perform these checks turn this directive on.
7954#Default:
7955# check_hostnames off
7956
7957# TAG: allow_underscore
7958# Underscore characters is not strictly allowed in Internet hostnames
7959# but nevertheless used by many sites. Set this to off if you want
7960# Squid to be strict about the standard.
7961# This check is performed only when check_hostnames is set to on.
7962#Default:
7963# allow_underscore on
7964
7965# TAG: dns_retransmit_interval
7966# Initial retransmit interval for DNS queries. The interval is
7967# doubled each time all configured DNS servers have been tried.
7968#Default:
7969# dns_retransmit_interval 5 seconds
7970
7971# TAG: dns_timeout
7972# DNS Query timeout. If no response is received to a DNS query
7973# within this time all DNS servers for the queried domain
7974# are assumed to be unavailable.
7975#Default:
7976# dns_timeout 30 seconds
7977
7978# TAG: dns_packet_max
7979# Maximum number of bytes packet size to advertise via EDNS.
7980# Set to "none" to disable EDNS large packet support.
7981#
7982# For legacy reasons DNS UDP replies will default to 512 bytes which
7983# is too small for many responses. EDNS provides a means for Squid to
7984# negotiate receiving larger responses back immediately without having
7985# to failover with repeat requests. Responses larger than this limit
7986# will retain the old behaviour of failover to TCP DNS.
7987#
7988# Squid has no real fixed limit internally, but allowing packet sizes
7989# over 1500 bytes requires network jumbogram support and is usually not
7990# necessary.
7991#
7992# WARNING: The RFC also indicates that some older resolvers will reply
7993# with failure of the whole request if the extension is added. Some
7994# resolvers have already been identified which will reply with mangled
7995# EDNS response on occasion. Usually in response to many-KB jumbogram
7996# sizes being advertised by Squid.
7997# Squid will currently treat these both as an unable-to-resolve domain
7998# even if it would be resolvable without EDNS.
7999#Default:
8000# EDNS disabled
8001
8002# TAG: dns_defnames on|off
8003# Normally the RES_DEFNAMES resolver option is disabled
8004# (see res_init(3)). This prevents caches in a hierarchy
8005# from interpreting single-component hostnames locally. To allow
8006# Squid to handle single-component names, enable this option.
8007#Default:
8008# Search for single-label domain names is disabled.
8009
8010# TAG: dns_multicast_local on|off
8011# When set to on, Squid sends multicast DNS lookups on the local
8012# network for domains ending in .local and .arpa.
8013# This enables local servers and devices to be contacted in an
8014# ad-hoc or zero-configuration network environment.
8015#Default:
8016# Search for .local and .arpa names is disabled.
8017
8018# TAG: dns_nameservers
8019# Use this if you want to specify a list of DNS name servers
8020# (IP addresses) to use instead of those given in your
8021# /etc/resolv.conf file.
8022#
8023# On Windows platforms, if no value is specified here or in
8024# the /etc/resolv.conf file, the list of DNS name servers are
8025# taken from the Windows registry, both static and dynamic DHCP
8026# configurations are supported.
8027#
8028# Example: dns_nameservers 10.0.0.1 192.172.0.4
8029#Default:
8030# Use operating system definitions
8031
8032# TAG: hosts_file
8033# Location of the host-local IP name-address associations
8034# database. Most Operating Systems have such a file on different
8035# default locations:
8036# - Un*X & Linux: /etc/hosts
8037# - Windows NT/2000: %SystemRoot%\system32\drivers\etc\hosts
8038# (%SystemRoot% value install default is c:\winnt)
8039# - Windows XP/2003: %SystemRoot%\system32\drivers\etc\hosts
8040# (%SystemRoot% value install default is c:\windows)
8041# - Windows 9x/Me: %windir%\hosts
8042# (%windir% value is usually c:\windows)
8043# - Cygwin: /etc/hosts
8044#
8045# The file contains newline-separated definitions, in the
8046# form ip_address_in_dotted_form name [name ...] names are
8047# whitespace-separated. Lines beginning with an hash (#)
8048# character are comments.
8049#
8050# The file is checked at startup and upon configuration.
8051# If set to 'none', it won't be checked.
8052# If append_domain is used, that domain will be added to
8053# domain-local (i.e. not containing any dot character) host
8054# definitions.
8055#Default:
8056# hosts_file /etc/hosts
8057
8058# TAG: append_domain
8059# Appends local domain name to hostnames without any dots in
8060# them. append_domain must begin with a period.
8061#
8062# Be warned there are now Internet names with no dots in
8063# them using only top-domain names, so setting this may
8064# cause some Internet sites to become unavailable.
8065#
8066#Example:
8067# append_domain .yourdomain.com
8068#Default:
8069# Use operating system definitions
8070
8071# TAG: ignore_unknown_nameservers
8072# By default Squid checks that DNS responses are received
8073# from the same IP addresses they are sent to. If they
8074# don't match, Squid ignores the response and writes a warning
8075# message to cache.log. You can allow responses from unknown
8076# nameservers by setting this option to 'off'.
8077#Default:
8078# ignore_unknown_nameservers on
8079
8080# TAG: dns_v4_first
8081# With the IPv6 Internet being as fast or faster than IPv4 Internet
8082# for most networks Squid prefers to contact websites over IPv6.
8083#
8084# This option reverses the order of preference to make Squid contact
8085# dual-stack websites over IPv4 first. Squid will still perform both
8086# IPv6 and IPv4 DNS lookups before connecting.
8087#
8088# WARNING:
8089# This option will restrict the situations under which IPv6
8090# connectivity is used (and tested), potentially hiding network
8091# problems which would otherwise be detected and warned about.
8092#Default:
8093# dns_v4_first off
8094
8095# TAG: ipcache_size (number of entries)
8096# Maximum number of DNS IP cache entries.
8097#Default:
8098# ipcache_size 1024
8099
8100# TAG: ipcache_low (percent)
8101#Default:
8102# ipcache_low 90
8103
8104# TAG: ipcache_high (percent)
8105# The size, low-, and high-water marks for the IP cache.
8106#Default:
8107# ipcache_high 95
8108
8109# TAG: fqdncache_size (number of entries)
8110# Maximum number of FQDN cache entries.
8111#Default:
8112# fqdncache_size 1024
8113
8114# MISCELLANEOUS
8115# -----------------------------------------------------------------------------
8116
8117# TAG: configuration_includes_quoted_values on|off
8118# If set, Squid will recognize each "quoted string" after a configuration
8119# directive as a single parameter. The quotes are stripped before the
8120# parameter value is interpreted or used.
8121# See "Values with spaces, quotes, and other special characters"
8122# section for more details.
8123#Default:
8124# configuration_includes_quoted_values off
8125
8126# TAG: memory_pools on|off
8127# If set, Squid will keep pools of allocated (but unused) memory
8128# available for future use. If memory is a premium on your
8129# system and you believe your malloc library outperforms Squid
8130# routines, disable this.
8131#Default:
8132# memory_pools on
8133
8134# TAG: memory_pools_limit (bytes)
8135# Used only with memory_pools on:
8136# memory_pools_limit 50 MB
8137#
8138# If set to a non-zero value, Squid will keep at most the specified
8139# limit of allocated (but unused) memory in memory pools. All free()
8140# requests that exceed this limit will be handled by your malloc
8141# library. Squid does not pre-allocate any memory, just safe-keeps
8142# objects that otherwise would be free()d. Thus, it is safe to set
8143# memory_pools_limit to a reasonably high value even if your
8144# configuration will use less memory.
8145#
8146# If set to none, Squid will keep all memory it can. That is, there
8147# will be no limit on the total amount of memory used for safe-keeping.
8148#
8149# To disable memory allocation optimization, do not set
8150# memory_pools_limit to 0 or none. Set memory_pools to "off" instead.
8151#
8152# An overhead for maintaining memory pools is not taken into account
8153# when the limit is checked. This overhead is close to four bytes per
8154# object kept. However, pools may actually _save_ memory because of
8155# reduced memory thrashing in your malloc library.
8156#Default:
8157# memory_pools_limit 5 MB
8158
8159# TAG: forwarded_for on|off|transparent|truncate|delete
8160# If set to "on", Squid will append your client's IP address
8161# in the HTTP requests it forwards. By default it looks like:
8162#
8163# X-Forwarded-For: 192.1.2.3
8164#
8165# If set to "off", it will appear as
8166#
8167# X-Forwarded-For: unknown
8168#
8169# If set to "transparent", Squid will not alter the
8170# X-Forwarded-For header in any way.
8171#
8172# If set to "delete", Squid will delete the entire
8173# X-Forwarded-For header.
8174#
8175# If set to "truncate", Squid will remove all existing
8176# X-Forwarded-For entries, and place the client IP as the sole entry.
8177#Default:
8178# forwarded_for on
8179
8180# TAG: cachemgr_passwd
8181# Specify passwords for cachemgr operations.
8182#
8183# Usage: cachemgr_passwd password action action ...
8184#
8185# Some valid actions are (see cache manager menu for a full list):
8186# 5min
8187# 60min
8188# asndb
8189# authenticator
8190# cbdata
8191# client_list
8192# comm_incoming
8193# config *
8194# counters
8195# delay
8196# digest_stats
8197# dns
8198# events
8199# filedescriptors
8200# fqdncache
8201# histograms
8202# http_headers
8203# info
8204# io
8205# ipcache
8206# mem
8207# menu
8208# netdb
8209# non_peers
8210# objects
8211# offline_toggle *
8212# pconn
8213# peer_select
8214# reconfigure *
8215# redirector
8216# refresh
8217# server_list
8218# shutdown *
8219# store_digest
8220# storedir
8221# utilization
8222# via_headers
8223# vm_objects
8224#
8225# * Indicates actions which will not be performed without a
8226# valid password, others can be performed if not listed here.
8227#
8228# To disable an action, set the password to "disable".
8229# To allow performing an action without a password, set the
8230# password to "none".
8231#
8232# Use the keyword "all" to set the same password for all actions.
8233#
8234#Example:
8235# cachemgr_passwd secret shutdown
8236# cachemgr_passwd lesssssssecret info stats/objects
8237# cachemgr_passwd disable all
8238#Default:
8239# No password. Actions which require password are denied.
8240
8241# TAG: client_db on|off
8242# If you want to disable collecting per-client statistics,
8243# turn off client_db here.
8244#Default:
8245# client_db on
8246
8247# TAG: refresh_all_ims on|off
8248# When you enable this option, squid will always check
8249# the origin server for an update when a client sends an
8250# If-Modified-Since request. Many browsers use IMS
8251# requests when the user requests a reload, and this
8252# ensures those clients receive the latest version.
8253#
8254# By default (off), squid may return a Not Modified response
8255# based on the age of the cached version.
8256#Default:
8257# refresh_all_ims off
8258
8259# TAG: reload_into_ims on|off
8260# When you enable this option, client no-cache or ``reload''
8261# requests will be changed to If-Modified-Since requests.
8262# Doing this VIOLATES the HTTP standard. Enabling this
8263# feature could make you liable for problems which it
8264# causes.
8265#
8266# see also refresh_pattern for a more selective approach.
8267#Default:
8268# reload_into_ims off
8269
8270# TAG: connect_retries
8271# This sets the maximum number of connection attempts made for each
8272# TCP connection. The connect_retries attempts must all still
8273# complete within the connection timeout period.
8274#
8275# The default is not to re-try if the first connection attempt fails.
8276# The (not recommended) maximum is 10 tries.
8277#
8278# A warning message will be generated if it is set to a too-high
8279# value and the configured value will be over-ridden.
8280#
8281# Note: These re-tries are in addition to forward_max_tries
8282# which limit how many different addresses may be tried to find
8283# a useful server.
8284#Default:
8285# Do not retry failed connections.
8286
8287# TAG: retry_on_error
8288# If set to ON Squid will automatically retry requests when
8289# receiving an error response with status 403 (Forbidden),
8290# 500 (Internal Error), 501 or 503 (Service not available).
8291# Status 502 and 504 (Gateway errors) are always retried.
8292#
8293# This is mainly useful if you are in a complex cache hierarchy to
8294# work around access control errors.
8295#
8296# NOTE: This retry will attempt to find another working destination.
8297# Which is different from the server which just failed.
8298#Default:
8299# retry_on_error off
8300
8301# TAG: as_whois_server
8302# WHOIS server to query for AS numbers. NOTE: AS numbers are
8303# queried only when Squid starts up, not for every request.
8304#Default:
8305# as_whois_server whois.ra.net
8306
8307# TAG: offline_mode
8308# Enable this option and Squid will never try to validate cached
8309# objects.
8310#Default:
8311# offline_mode off
8312
8313# TAG: uri_whitespace
8314# What to do with requests that have whitespace characters in the
8315# URI. Options:
8316#
8317# strip: The whitespace characters are stripped out of the URL.
8318# This is the behavior recommended by RFC2396 and RFC3986
8319# for tolerant handling of generic URI.
8320# NOTE: This is one difference between generic URI and HTTP URLs.
8321#
8322# deny: The request is denied. The user receives an "Invalid
8323# Request" message.
8324# This is the behaviour recommended by RFC2616 for safe
8325# handling of HTTP request URL.
8326#
8327# allow: The request is allowed and the URI is not changed. The
8328# whitespace characters remain in the URI. Note the
8329# whitespace is passed to redirector processes if they
8330# are in use.
8331# Note this may be considered a violation of RFC2616
8332# request parsing where whitespace is prohibited in the
8333# URL field.
8334#
8335# encode: The request is allowed and the whitespace characters are
8336# encoded according to RFC1738.
8337#
8338# chop: The request is allowed and the URI is chopped at the
8339# first whitespace.
8340#
8341#
8342# NOTE the current Squid implementation of encode and chop violates
8343# RFC2616 by not using a 301 redirect after altering the URL.
8344#Default:
8345# uri_whitespace strip
8346
8347# TAG: chroot
8348# Specifies a directory where Squid should do a chroot() while
8349# initializing. This also causes Squid to fully drop root
8350# privileges after initializing. This means, for example, if you
8351# use a HTTP port less than 1024 and try to reconfigure, you may
8352# get an error saying that Squid can not open the port.
8353#Default:
8354# none
8355
8356# TAG: balance_on_multiple_ip
8357# Modern IP resolvers in squid sort lookup results by preferred access.
8358# By default squid will use these IP in order and only rotates to
8359# the next listed when the most preffered fails.
8360#
8361# Some load balancing servers based on round robin DNS have been
8362# found not to preserve user session state across requests
8363# to different IP addresses.
8364#
8365# Enabling this directive Squid rotates IP's per request.
8366#Default:
8367# balance_on_multiple_ip off
8368
8369# TAG: pipeline_prefetch
8370# HTTP clients may send a pipeline of 1+N requests to Squid using a
8371# single connection, without waiting for Squid to respond to the first
8372# of those requests. This option limits the number of concurrent
8373# requests Squid will try to handle in parallel. If set to N, Squid
8374# will try to receive and process up to 1+N requests on the same
8375# connection concurrently.
8376#
8377# Defaults to 0 (off) for bandwidth management and access logging
8378# reasons.
8379#
8380# NOTE: pipelining requires persistent connections to clients.
8381#
8382# WARNING: pipelining breaks NTLM and Negotiate/Kerberos authentication.
8383#Default:
8384# Do not pre-parse pipelined requests.
8385
8386# TAG: high_response_time_warning (msec)
8387# If the one-minute median response time exceeds this value,
8388# Squid prints a WARNING with debug level 0 to get the
8389# administrators attention. The value is in milliseconds.
8390#Default:
8391# disabled.
8392
8393# TAG: high_page_fault_warning
8394# If the one-minute average page fault rate exceeds this
8395# value, Squid prints a WARNING with debug level 0 to get
8396# the administrators attention. The value is in page faults
8397# per second.
8398#Default:
8399# disabled.
8400
8401# TAG: high_memory_warning
8402# Note: This option is only available if Squid is rebuilt with the
8403# GNU Malloc with mstats()
8404#
8405# If the memory usage (as determined by gnumalloc, if available and used)
8406# exceeds this amount, Squid prints a WARNING with debug level 0 to get
8407# the administrators attention.
8408#Default:
8409# disabled.
8410
8411# TAG: sleep_after_fork (microseconds)
8412# When this is set to a non-zero value, the main Squid process
8413# sleeps the specified number of microseconds after a fork()
8414# system call. This sleep may help the situation where your
8415# system reports fork() failures due to lack of (virtual)
8416# memory. Note, however, if you have a lot of child
8417# processes, these sleep delays will add up and your
8418# Squid will not service requests for some amount of time
8419# until all the child processes have been started.
8420# On Windows value less then 1000 (1 milliseconds) are
8421# rounded to 1000.
8422#Default:
8423# sleep_after_fork 0
8424
8425# TAG: windows_ipaddrchangemonitor on|off
8426# Note: This option is only available if Squid is rebuilt with the
8427# MS Windows
8428#
8429# On Windows Squid by default will monitor IP address changes and will
8430# reconfigure itself after any detected event. This is very useful for
8431# proxies connected to internet with dial-up interfaces.
8432# In some cases (a Proxy server acting as VPN gateway is one) it could be
8433# desiderable to disable this behaviour setting this to 'off'.
8434# Note: after changing this, Squid service must be restarted.
8435#Default:
8436# windows_ipaddrchangemonitor on
8437
8438# TAG: eui_lookup
8439# Whether to lookup the EUI or MAC address of a connected client.
8440#Default:
8441# eui_lookup on
8442
8443# TAG: max_filedescriptors
8444# Reduce the maximum number of filedescriptors supported below
8445# the usual operating system defaults.
8446#
8447# Remove from squid.conf to inherit the current ulimit setting.
8448#
8449# Note: Changing this requires a restart of Squid. Also
8450# not all I/O types supports large values (eg on Windows).
8451#Default:
8452# Use operating system limits set by ulimit.
8453
8454# TAG: force_request_body_continuation
8455# This option controls how Squid handles data upload requests from HTTP
8456# and FTP agents that require a "Please Continue" control message response
8457# to actually send the request body to Squid. It is mostly useful in
8458# adaptation environments.
8459#
8460# When Squid receives an HTTP request with an "Expect: 100-continue"
8461# header or an FTP upload command (e.g., STOR), Squid normally sends the
8462# request headers or FTP command information to an adaptation service (or
8463# peer) and waits for a response. Most adaptation services (and some
8464# broken peers) may not respond to Squid at that stage because they may
8465# decide to wait for the HTTP request body or FTP data transfer. However,
8466# that request body or data transfer may never come because Squid has not
8467# responded with the HTTP 100 or FTP 150 (Please Continue) control message
8468# to the request sender yet!
8469#
8470# An allow match tells Squid to respond with the HTTP 100 or FTP 150
8471# (Please Continue) control message on its own, before forwarding the
8472# request to an adaptation service or peer. Such a response usually forces
8473# the request sender to proceed with sending the body. A deny match tells
8474# Squid to delay that control response until the origin server confirms
8475# that the request body is needed. Delaying is the default behavior.
8476#Default:
8477# Deny, unless rules exist in squid.conf.
8478
8479# TAG: server_pconn_for_nonretriable
8480# This option provides fine-grained control over persistent connection
8481# reuse when forwarding HTTP requests that Squid cannot retry. It is useful
8482# in environments where opening new connections is very expensive
8483# (e.g., all connections are secured with TLS with complex client and server
8484# certificate validation) and race conditions associated with persistent
8485# connections are very rare and/or only cause minor problems.
8486#
8487# HTTP prohibits retrying unsafe and non-idempotent requests (e.g., POST).
8488# Squid limitations also prohibit retrying all requests with bodies (e.g., PUT).
8489# By default, when forwarding such "risky" requests, Squid opens a new
8490# connection to the server or cache_peer, even if there is an idle persistent
8491# connection available. When Squid is configured to risk sending a non-retriable
8492# request on a previously used persistent connection, and the server closes
8493# the connection before seeing that risky request, the user gets an error response
8494# from Squid. In most cases, that error response will be HTTP 502 (Bad Gateway)
8495# with ERR_ZERO_SIZE_OBJECT or ERR_WRITE_ERROR (peer connection reset) error detail.
8496#
8497# If an allow rule matches, Squid reuses an available idle persistent connection
8498# (if any) for the request that Squid cannot retry. If a deny rule matches, then
8499# Squid opens a new connection for the request that Squid cannot retry.
8500#
8501# This option does not affect requests that Squid can retry. They will reuse idle
8502# persistent connections (if any).
8503#
8504# This clause only supports fast acl types.
8505# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
8506#
8507# Example:
8508# acl SpeedIsWorthTheRisk method POST
8509# server_pconn_for_nonretriable allow SpeedIsWorthTheRisk
8510#Default:
8511# Open new connections for forwarding requests Squid cannot retry safely.