Port from 2.6: external acl %ACL and %DATA tags

[thirdparty/squid.git] / src / cf.data.pre

diff --git a/src/cf.data.pre b/src/cf.data.pre
index e6f3ddb9aa4386c8421a02ea5bb0cd0d8a13a362..f5b794a90756d83fa77e736a03b69a9da2e59f2a 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -709,6 +709,13 @@ DOC_START
                        list separator. ; can be any non-alphanumeric
                        character.
 
+         %ACL          The name of the ACL being tested.
+         %DATA         The ACL arguments. If not used then any arguments
+                       is automatically added at the end of the line
+                       sent to the helper.
+                       NOTE: this will encode the arguments as one token,
+                       whereas the default will pass each separately.
+
          %%            The percent sign. Useful for helpers which need
                        an unchanging input format.
 
@@ -1224,6 +1231,26 @@ DOC_START
        sources is required to prevent abuse of your proxy.
 DOC_END
 
+NAME: spoof_client_ip
+TYPE: acl_access
+LOC: Config.accessList.spoof_client_ip
+DEFAULT: none
+DEFAULT_DOC: Allow spoofing on all TPROXY traffic.
+DOC_START
+       Control client IP address spoofing of TPROXY traffic based on
+       defined access lists.
+
+       spoof_client_ip allow|deny [!]aclname ...
+
+       If there are no "spoof_client_ip" lines present, the default
+       is to "allow" spoofing of any suitable request.
+
+       Note that the cache_peer "no-tproxy" option overrides this ACL.
+
+       This clause supports fast acl types.
+       See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
+DOC_END
+
 NAME: http_access
 TYPE: acl_access
 LOC: Config.accessList.http
@@ -2960,6 +2987,7 @@ DOC_START
        
        no-tproxy       Do not use the client-spoof TPROXY support when forwarding
                        requests to this peer. Use normal address selection instead.
+                       This overrides the spoof_client_ip ACL.
        
        proxy-only      objects fetched from the peer will not be stored locally.
        
@@ -3797,16 +3825,47 @@ TYPE: access_log
 LOC: Config.Log.accesslogs
 DEFAULT_IF_NONE: daemon:@DEFAULT_ACCESS_LOG@ squid
 DOC_START
-       These files log client request activities. Has a line every HTTP or
-       ICP request. The format is:
+       Configures whether and how Squid logs HTTP and ICP transactions.
+       If access logging is enabled, a single line is logged for every 
+       matching HTTP or ICP request. The recommended directive formats are:
+
+       access_log <module>:<place> [option ...] [acl acl ...]
+       access_log none [acl acl ...]
+
+       The following directive format is accepted but may be deprecated:
        access_log <module>:<place> [<logformat name> [acl acl ...]]
-       access_log none [acl acl ...]]
+
+        In most cases, the first ACL name must not contain the '=' character
+       and should not be equal to an existing logformat name. You can always
+       start with an 'all' ACL to work around those restrictions.
        
        Will log to the specified module:place using the specified format (which
        must be defined in a logformat directive) those entries which match
        ALL the acl's specified (which must be defined in acl clauses).
        If no acl is specified, all requests will be logged to this destination.
        
+       ===== Available options for the recommended directive format =====
+
+       logformat=name          Names log line format (either built-in or
+                               defined by a logformat directive). Defaults
+                               to 'squid'.
+
+       buffer-size=64KB        Defines approximate buffering limit for log
+                               records (see buffered_logs).  Squid should not
+                               keep more than the specified size and, hence,
+                               should flush records before the buffer becomes
+                               full to avoid overflows under normal
+                               conditions (the exact flushing algorithm is
+                               module-dependent though).  The on-error option
+                               controls overflow handling.
+
+       on-error=die|drop       Defines action on unrecoverable errors. The
+                               'drop' action ignores (i.e., does not log)
+                               affected log records. The default 'die' action
+                               kills the affected worker. The drop action 
+                               support has not been tested for modules other
+                               than tcp.
+
        ===== Modules Currently available =====
        
        none    Do not log any requests matching these ACL.
@@ -3837,6 +3896,7 @@ DOC_START
                Place Format:   //host:port
 
        tcp     To send each log line as text data to a TCP receiver.
+               Lines may be accumulated before sending (see buffered_logs).
                Place: The destination host name or IP and port.
                Place Format:   //host:port
 
@@ -4165,7 +4225,7 @@ DOC_START
        records if it cannot write/send them immediately due to pending I/Os
        (e.g., the I/O writing the previous log record) or connectivity loss.
 
-       Currently honored by 'daemon' access_log module only.
+       Currently honored by 'daemon' and 'tcp' access_log modules only.
 DOC_END
 
 NAME: netdb_filename
@@ -4198,7 +4258,7 @@ DOC_START
 DOC_END
 
 NAME: debug_options
-TYPE: debug_options
+TYPE: eol
 DEFAULT: ALL,1
 DEFAULT_DOC: Log all critical and important messages.
 LOC: Debug::debugOptions