Trying to whitelist *.gov in Squid

[Cerulean]

So help me to understand this:

#
# CONFIG FILE FOR SQUIDGUARD
#

dbhome /var/lib/squidguard/db
logdir /var/log/squid

#
# TIME RULES:
# abbrev for weekdays: 
# s = sun, m = mon, t =tue, w = wed, h = thu, f = fri, a = sat

#
# REWRITE RULES:
#

#rew dmz {
#    s@://admin/@://admin.foo.bar.no/@i
#    s@://foo.bar.no/@://www.foo.bar.no/@i
#}

#
# SOURCE ADDRESSES:
#

src restricted {
#        ip 10.0.1.222/32
#        ip 10.0.1.219/32
#        ip 10.0.1.188/32
}

src admin {
        ip 10.0.1.73 
        ip 10.0.1.168 
        ip 10.0.255.17 
        ip 10.0.255.2 
        ip 10.0.1.113 
#        ip 10.0.0.253 
        ip 10.0.1.77 
#        ip 10.0.1.183
#                ip 10.0.1.188
#        ip 10.0.2.244
#        ip 10.0.2.249
                ip 10.0.1.55
}

src super {
        ip 10.0.1.183
                ip 10.0.0.252
                ip 10.0.0.253
                ip 10.0.2.250 #
#               ip 10.0.2.244

}

src elevated {
        ip 10.0.0.222
}

src everyone {
        ip 10.0.0.0/8
}


#time worktime {     
#    weekly mtwhf 0:01-23:59
#    weekly mtwhf 0:01-23:59
#}    

time prisontime {
        weekly mtwhf 08:00-11:30
        weekly mtwhf 14:00-17:00
}


dest noads {
    domainlist    ads/domains
    urllist        ads/urls
#    expressionlist    ads/expressions
}

dest work {
    domainlist    business/domains
    urllist        business/urls
#     expressionlist    business/expressions
}

dest override {
    domainlist    override/domains
    urllist        override/urls
#    expressionlist    override/expressions
}

dest denyall {
    domainlist    denyall/domains
    urllist        denyall/urls
#    expressionlist    denyall/expressions
    log default.log
}

dest denyallsuper {
    domainlist    denyallsuper/domains
    urllist        denyallsuper/urls
#    expressionlist    denyallsuper/expressions
    log default.log
}

dest tmp {
    domainlist    tmp/domains
    urllist        tmp/urls
#    expressionlist    tmp/expressions
    log default.log
}

dest allowall {
    domainlist    allowall/domains
    urllist        allowall/urls
#    expressionlist    allowall/expressions
}

acl {

    super    {
            pass !denyallsuper all
                        redirect http://www.companysite.com/
        }

    admin    {
            pass !noads !denyall all
                        redirect http://www.companysite.com/
        }

    elevated within prisontime { 
            pass work !noads !denyall !tmp all
                        redirect http://www.companysite.com/
        } else    {
            pass !noads !denyall all
                        redirect http://www.companysite.com/
        }

    restricted within prisontime {
            pass allowall work override !noads !denyall !tmp none
            redirect http://www.companysite.com/
        } else {
                        pass allowall !denyall !noads all
                        redirect http://www.companysite.com/
                        }

    everyone {
            pass allowall work override !denyall !tmp !noads none
            redirect http://www.companysite.com/
        } else {
            pass allowall work !denyall !tmp !noads all
                        redirect http://www.companysite.com/
                       }

        default {
        pass allowall work !denyall !noads all
        redirect http://www.companysite.com/    
        log default.log        
    }
}

#        default {
#        pass allowall !denyall !noads all
#        redirect http://www.companysite.com/denied.html
#        log default.log        
#    }

I think the prisontime thing means that between 8AM and 11:30AM, and 2PM and 5PM, it uses either "defaults" (as they are defined) or a different set of rules.

1) If you put ! in front of something (ie. !denyall), what does that mean?

2) How do I whitelist all *.gov websites?

Thanks!

 

[Dytralis]

the exclamation point means "not". so !denyall would mean not-denyall (eg... anything not in the denyall acl)

as far as whitelisting sites in squid, I can't help you... I use Dansguardian on top of our squid installation to do content filtering. It's much cleaner than writing ACL's for squid IMO.