Re: Spaces in ACL values

On 09/13/2012 05:22 PM, Marcus Kool wrote:
> On 09/13/2012 07:16 PM, Alex Rousskov wrote:
>> 2) Add squid.conf directives to turn the new parsing behavior on and off
>> for a section of the configuration file. This is also 100% backward
>> compatible but difficult to introduce gradually -- admins will expect
>> everything inside a "quoted strings" section to support quoted strings,
>> and I am not 100% sure we can easily support that because different
>> options use different token parsers.
>>
>> # start new quoting support section
>> configuration_value_parser quoted_strings
>> # now just use the new quoting support
>> acl badOne1 user_cert CN "Bad Guy"
>> acl badOne2 ext_user "Bad Guy"
>>
>> # restore backward-compatible mode
>> configuration_value_parser bare_tokens
>> acl oldOne user_cert CN One" "Two and Four"

> 2b) Add squid.conf directives _at the beginning_ of the conf file
> to specify the parser behavior. So do not toggle and force the admin
> to be aware of quoted strings and _must_ check the whole config file
> himself.
> The default value of "config_used_quoted_strings" is "off".
> This is still 100% backwards compatible without doing lots (?) of effort
> to please everybody and every situation.

Hi Marcus,

    One reason to prefer a toggle-like behavior are included 3rd-party
files. For example, an admin can review her squid.conf but has no
control over a file with special user identifiers because it is supplied
by a different department. In that situation, she can surround that file
inclusion with configuration_value_parser options to preserve the old
syntax:

    ... clean, checked directives here ...

    # start legacy section until URL filter supplier upgrades
    configuration_value_parser bare_tokens
    acl managers proxy_auth "/nas/opt/managers.txt"
    # end legacy section
    configuration_value_parser quoted_strings

    ... clean, checked directives here ...

Another reason is somewhat similar: The admin may control the middle
section of squid.conf but not the beginning of it because, again, the
outer squid.conf is supplied by another vendor/department and just
includes mysquid.conf in the middle of it.

I agree that a toggle approach is more work than a "must be the first
directive" approach but it is not that much more work, IMO. The biggest
challange is in supporting both syntax rules with code that does not use
one parser/tokenizer but implements special slightly-different parsers
in various places. If we clean that up, supporting multiple tokenizers
would be relatively easy, even with a toggle.

Thank you,

Alex.
Received on Fri Sep 14 2012 - 14:04:33 MDT