squid-cache.org

	Determine which client proxies can be trusted to provide correct
	information regarding real client IP address.

	Requests may pass through a chain of several other proxies
	before reaching us. The original source details may by sent in:
		* HTTP message Forwarded header, or
		* HTTP message X-Forwarded-For header, or
		* PROXY protocol connection header.

	PROXY protocol connections are controlled by the proxy_protocol_access
	directive which is checked before this.

	If a request reaches us from a source that is allowed by this
	directive, then we trust the information it provides regarding
	the IP of the client it received from (if any).

	For the purpose of ACLs used in this directive the src ACL type always
	matches the address we are testing and srcdomain matches its rDNS.

	On each HTTP request Squid checks for X-Forwarded-For header fields.
	If found the header values are iterated in reverse order and an allow
	match is required for Squid to continue on to the next value.
	The verification ends when a value receives a deny match, cannot be
	tested, or there are no more values to test.
	NOTE: Squid does not yet follow the Forwarded HTTP header.

	The end result of this process is an IP address that we will
	refer to as the indirect client address.  This address may
	be treated as the client address for access control, ICAP, delay
	pools and logging, depending on the acl_uses_indirect_client,
	icap_uses_indirect_client, delay_pool_uses_indirect_client,
	log_uses_indirect_client and tproxy_uses_indirect_client options.

	This clause only supports fast acl types.
	See https://wiki.squid-cache.org/SquidFaq/SquidAcl for details.

	SECURITY CONSIDERATIONS:

		Any host from which we accept client IP details can place
		incorrect information in the relevant header, and Squid
		will use the incorrect information as if it were the
		source address of the request.  This may enable remote
		hosts to bypass any access control restrictions that are
		based on the client's source addresses.

	For example:

		acl localhost src 127.0.0.1
		acl my_other_proxy srcdomain .proxy.example.com
		follow_x_forwarded_for allow localhost
		follow_x_forwarded_for allow my_other_proxy