порет чушь, похоже на баг, но не могу найти подобного

правила в конфиге:

external_acl_type auth_helper ttl=2 %SRC %DST /etc/squid3/python/1.sh
acl IP external auth_helper IP
acl A src X.X.X.X
http_access allow IP
http_access deny all

внешний хелпер был заменен на простой баш-скрипт, на любой запрос выдает OK
все работает ровно до тех пор, пока не придет время сквиду сделать очередной запрос к внешнему скрипту, и тогда происходит следующее:

2014/06/04 00:26:18.158| ACLChecklist::preCheck: 0x7ffe36f530b8 checking 'http_access allow IP'
2014/06/04 00:26:18.158| ACLList::matches: checking IP
2014/06/04 00:26:18.158| ACL::checklistMatches: checking 'IP'
2014/06/04 00:26:18.158| aclMatchExternal: acl=«auth_helper»
2014/06/04 00:26:18.158| aclMatchExternal: auth_helper(«X.X.X.X http://www.hulu.com IP») = lookup needed
2014/06/04 00:26:18.158| aclMatchExternal: «X.X.X.X http://www.hulu.com IP»: entry=@0x7ffe36f2cb28, age=2
2014/06/04 00:26:18.158| aclMatchExternal: «X.X.X.X http://www.hulu.com IP»: queueing a call.
2014/06/04 00:26:18.158| aclMatchExternal: «X.X.X.X http://www.hulu.com IP»: return -1.
2014/06/04 00:26:18.158| ACL::ChecklistMatches: result for 'IP' is -1
2014/06/04 00:26:18.158| ACLList::matches: result is false
2014/06/04 00:26:18.158| aclmatchAclList: 0x7ffe36f530b8 returning false (AND list entry failed to match)
2014/06/04 00:26:18.158| ACL::FindByName 'IP'
2014/06/04 00:26:18.158| ACLChecklist::asyncInProgress: 0x7ffe36f530b8 async set to 1
2014/06/04 00:26:18.158| externalAclLookup: lookup in 'auth_helper' for 'X.X.X.X http://www.hulu.com IP'
2014/06/04 00:26:18.158| externalAclLookup: looking up for 'X.X.X.X http://www.hulu.com IP' in 'auth_helper'.
2014/06/04 00:26:18.158| externalAclLookup: no need to wait for the result of 'X.X.X.X http://www.hulu.com IP' in 'auth_helper' (ch=0x7ffe36f530b8).
2014/06/04 00:26:18.158| externalAclLookup: using cached entry 0x7ffe36f2cb28
2014/06/04 00:26:18.158| externalAclLookup: entry = { date=1401855976, result=1, user= tag= log= }
2014/06/04 00:26:18.158| ACLChecklist::asyncInProgress: 0x7ffe36f530b8 async set to 0
2014/06/04 00:26:18.158| aclmatchAclList: async=1 nodeMatched=0 async_in_progress=0 lastACLResult() = 0 finished() = 0
2014/06/04 00:26:18.158| ACLChecklist::preCheck: 0x7ffe36f530b8 checking 'http_access deny all'
2014/06/04 00:26:18.158| ACLList::matches: checking all
2014/06/04 00:26:18.158| ACL::checklistMatches: checking 'all'
2014/06/04 00:26:18.158| aclIpAddrNetworkCompare: compare: X.X.X.X:35387/[::] ([::]:35387)  vs [::]-[::]/[::]
2014/06/04 00:26:18.158| aclIpMatchIp: 'X.X.X.X:35387' found
2014/06/04 00:26:18.158| ACL::ChecklistMatches: result for 'all' is 1
2014/06/04 00:26:18.158| ACLList::matches: result is true
2014/06/04 00:26:18.158| aclmatchAclList: 0x7ffe36f530b8 returning true (AND list satisfied)
2014/06/04 00:26:18.158| ACLChecklist::markFinished: 0x7ffe36f530b8 checklist processing finished
2014/06/04 00:26:18.158| ACLChecklist::check: 0x7ffe36f530b8 match found, calling back with 0
2014/06/04 00:26:18.158| ACLFilledChecklist::checkCallback: 0x7ffe36f530b8 answer=0
2014/06/04 00:26:18.158| ACLChecklist::checkCallback: 0x7ffe36f530b8 answer=0

Как видим, забил он на внешний acl и отработал http_access deny all. Клиент получил TCP_DENIED/403. Я его не понимаю...