From: Henrik Nordstrom <hno@hem.passagen.se>

Give always_direct higher precedence than never_direct.

To simplify setups that are inside a firewall, which is about the only
case when always_direct AND never_direct are used together. Currently
every object that is always_direct allow must also be never_direct deny
or the request fails.

diff --git a/src/cf.data.pre b/src/cf.data.pre
index db59cb979607de9a945c44c80b67d976214049c3..84e54837e073ee17f11dcec16dca4b0488b1c802 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.111 1998/09/14 22:34:02 wessels Exp $
+# $Id: cf.data.pre,v 1.112 1998/09/18 21:44:16 wessels Exp $
 #
 #
 # SQUID Internet Object Cache  http://squid.nlanr.net/Squid/
@@ -2093,10 +2093,8 @@ DOC_START
        Usage: always_direct allow|deny [!]aclname ...
 
        Here you can use ACL elements to specify requests which should
-       ALWAYS be forwarded directly to origin servers.  This option
-       replaces some v1.1 options such as inside_firewall,
-       firewall_ip, local_domain, and local_ip.  For example, to
-       always directly forward requests for local servers use
+       ALWAYS be forwarded directly to origin servers.  For example,
+       to always directly forward requests for local servers use
        something like:
 
                acl local-servers dstdomain my.domain.net
@@ -2117,6 +2115,9 @@ DOC_START
                acl local-servers dstdomain  foo.net
                always_direct deny local-external
                always_direct allow local-servers
+
+       This option replaces some v1.1 options such as local_domain
+       and local_ip.
 DOC_END
 
 NAME: never_direct
@@ -2131,15 +2132,25 @@ DOC_START
 
        With 'never_direct' you can use ACL elements to specify
        requests which should NEVER be forwarded directly to origin
-       servers.  This option replaces some v1.1 options such as
-       inside_firewall, firewall_ip, local_domain, and local_ip.  For
-       example, to force the use of a proxy for all requests, except
-       those in your local domain, use something like:
+       servers.  For example, to force the use of a proxy for all
+       requests, except those in your local domain use something like:
 
-               acl local-servers dstdomain my.domain.net
+               acl local-servers dstdomain foo.net
                acl all src 0.0.0.0/0.0.0.0
                never_direct deny local-servers
                never_direct allow all
+       
+       or if squid is inside a firewall and there is local intranet
+       servers inside the firewall then use something like:
+
+               acl local-intranet dstdomain foo.net
+               acl local-external dstdomain external.foo.net
+               always_direct deny local-external
+               always_direct allow local-intranet
+               never_direct allow all
+       
+       This option replaces some v1.1 options such as inside_firewall
+       and firewall_ip.
 DOC_END
 
 NAME: fake_user_agent

diff --git a/src/peer_select.cc b/src/peer_select.cc
index 6ea7f183f2de54ac0d9931d64197f60fa487c8b9..368be806f4e8f57fc5861eee60aafcf83582e28a 100644 (file)
--- a/src/peer_select.cc
+++ b/src/peer_select.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: peer_select.cc,v 1.82 1998/09/18 17:13:42 wessels Exp $
+ * $Id: peer_select.cc,v 1.83 1998/09/18 21:44:17 wessels Exp $
  *
  * DEBUG: section 44    Peer Selection Algorithm
  * AUTHOR: Duane Wessels
@@ -262,32 +262,32 @@ peerSelectFoo(ps_state * psstate)
     debug(44, 3) ("peerSelectFoo: '%s %s'\n",
        RequestMethodStr[request->method],
        request->host);
-    if (psstate->never_direct == 0 && Config.accessList.NeverDirect) {
+    if (psstate->always_direct == 0 && Config.accessList.AlwaysDirect) {
        psstate->acl_checklist = aclChecklistCreate(
-           Config.accessList.NeverDirect,
+           Config.accessList.AlwaysDirect,
            request,
            request->client_addr,
            NULL,               /* user agent */
            NULL);              /* ident */
        aclNBCheck(psstate->acl_checklist,
-           peerCheckNeverDirectDone,
+           peerCheckAlwaysDirectDone,
            psstate);
        return;
-    } else if (psstate->never_direct > 0) {
-       direct = DIRECT_NO;
-    } else if (psstate->always_direct == 0 && Config.accessList.AlwaysDirect) {
+    } else if (psstate->always_direct > 0) {
+       direct = DIRECT_YES;
+    } else if (psstate->never_direct == 0 && Config.accessList.NeverDirect) {
        psstate->acl_checklist = aclChecklistCreate(
-           Config.accessList.AlwaysDirect,
+           Config.accessList.NeverDirect,
            request,
            request->client_addr,
            NULL,               /* user agent */
            NULL);              /* ident */
        aclNBCheck(psstate->acl_checklist,
-           peerCheckAlwaysDirectDone,
+           peerCheckNeverDirectDone,
            psstate);
        return;
-    } else if (psstate->always_direct > 0) {
-       direct = DIRECT_YES;
+    } else if (psstate->never_direct > 0) {
+       direct = DIRECT_NO;
     } else if (request->flags.loopdetect) {
        direct = DIRECT_YES;
     } else {