doc/release-notes/release-4.sgml

   1 <!doctype linuxdoc system>
   2 <article>
   3 <title>Squid 4.0.22 release notes</title>
   4 <author>Squid Developers</author>
   5
   6 <abstract>
   7 This document contains the release notes for version 4 of Squid.
   8 Squid is a WWW Cache application developed by the National Laboratory
   9 for Applied Network Research and members of the Web Caching community.
  10 </abstract>
  11
  12 <toc>
  13
  14 <sect>Notice
  15 <p>The Squid Team are pleased to announce the release of Squid-4.0.22 for testing.
  16
  17 This new release is available for download from <url url="http://www.squid-cache.org/Versions/v4/"> or the
  18  <url url="http://www.squid-cache.org/Download/http-mirrors.html" name="mirrors">.
  19
  20 <p>While this release is not deemed ready for production use, we believe it is ready for wider testing by the community.
  21
  22 <p>We welcome feedback and bug reports. If you find a bug, please see <url url="http://wiki.squid-cache.org/SquidFaq/BugReporting">
  23    for how to submit a report with a stack trace.
  24
  25 <sect1>Known issues
  26 <p>Although this release is deemed good enough for use in many setups, please note the existence of
  27 <url url="http://bugs.squid-cache.org/buglist.cgi?query_format=advanced&amp;product=Squid&amp;bug_status=UNCONFIRMED&amp;bug_status=NEW&amp;bug_status=ASSIGNED&amp;bug_status=REOPENED&amp;version=4" name="open bugs against Squid-4">.
  28
  29 <p>This release adds a dependency on C++11 support in any compiler used to build Squid.
  30   As a result older C++03 -only and most C++0x compilers will no longer build successfully.
  31   GCC 4.9+ and Clang 3.5+ are known to have working C++11 support and are usable.
  32   GCC-4.8 will also build for now despite lack of full C++11 support, but some future features may not be available.
  33
  34 <p>This release does not support LibreSSL.
  35    Due to a bug in the way LibreSSL uses the OpenSSL version macro some changes
  36    necessary to support OpenSSL 1.1 prevent building with LibreSSL.
  37
  38
  39 <sect1>Changes since earlier releases of Squid-4
  40 <p>
  41 The Squid-4 change history can be <url url="http://www.squid-cache.org/Versions/v4/changesets/" name="viewed here">.
  42
  43
  44 <sect>Major new features since Squid-3.5
  45 <p>Squid 4 represents a new feature release above 3.5.
  46
  47 <p>The most important of these new features are:
  48 <itemize>
  49         <item>Configurable helper queue size
  50         <item>Helper concurrency channels changes
  51         <item>SSL support removal
  52         <item>Helper Binary Changes
  53         <item>Secure ICAP
  54         <item>Improved SMP support
  55         <item>Improved process management
  56         <item>Initial GnuTLS support
  57 </itemize>
  58
  59 Most user-facing changes are reflected in squid.conf (see below).
  60
  61
  62 <sect1>Configurable helper queue size
  63 <p>The new queue-size=N option to helpers configuration, allows users
  64    to configure the maximum number of queued requests to busy helpers.
  65
  66 <sect1>Helper concurrency channels changes
  67 <p>helper-mux.pl we have been distributing for the past few years to
  68    encourage use of concurrency is no longer compatible with Squid. If
  69    used it will spawn up to 2^64 helpers and DoS the Squid server.
  70
  71 <p>Helpers utilizing arrays to handle fixed amounts of concurrency
  72    channels MUST be re-written to use queues and capable of handling a
  73    64-bit int as index or they will be vulnerable to buffer overrun and
  74    arbitrary memory accesses.
  75
  76 <p>32-bit helpers need re-writing to handle the concurrency channel ID
  77    as a 64-bit integer value. If not updated they will cause proxies to
  78    return unexpected results or timeout once crossing the 32-bit wrap
  79    boundary. Leading to undefined behaviour in the client HTTP traffic.
  80
  81
  82 <sect1>SSL support removal
  83 <p>Details in <url url="https://tools.ietf.org/html/rfc6176" name="RFC 6176">
  84    and <url url="https://tools.ietf.org/html/rfc7568" name="RFC 7568">
  85
  86 <p>SSLv2 is not fit for purpose. Squid no longer supports being configured with
  87    any settings regarding this protocol. That includes settings manually disabling
  88    its use since it is now forced to disable by default. Also settings enabling
  89    various client/server workarounds specific to SSLv2 are removed.
  90
  91 <p>SSLv3 is not fit for purpose. Squid still accepts configuration, but use
  92    is deprecated and will be removed entirely in a future version.
  93    Squid default behavour is to follow the TLS built in negotiation mechanism
  94    which prefers the latest TLS version. But also to accept downgrades to SSLv3.
  95    Use <em>tls-options=NO_SSLv3</em> to disable SSLv3 support completely.
  96
  97 <p>A new option <em>tls-min-version=1.N</em> is added in place of <em>sslversion=</em>
  98    to configure the minimum version the TLS negotiation will allow to be used
  99    when an old TLS version is requested by the remote endpoint.
 100
 101 <p>The system Trusted CAs are no longer used by default when verifying client
 102    certificates. The <em>cafile=</em> option should be used instead to load
 103    the specific CA which signed acceptible client certificates explicitly,
 104    even if that CA is one of the system Trusted CAs.
 105    The <em>tls-default-ca</em> option can be used to restore the old
 106    behaviour explicitly if needed.
 107
 108
 109 <sect1>Helper Binary Changes
 110 <p>The <em>basic_msnt_multi_domain_auth</em> helper has been removed. The
 111    <em>basic_smb_lm_auth</em> helper performs the same actions without extra
 112    Perl and Samba dependencies.
 113
 114 <p>The <em>cert_valid.pl</em> testing helper has been renamed to
 115    <em>security_fake_certverify</em>, reflecting the Squid helper naming schema
 116    and that it does not actually perform any certificate checks.
 117
 118 <p>The <em>security_fake_certverify</em> helper is also now built and installed
 119    by default. It is written in Perl so does not require OpenSSL dependencies
 120    for installation. But does use the Perl Crypt::OpenSSL::X509 module for execution.
 121    Building the helper can be controlled using the <em>--enable-security-cert-validators="fake"</em>
 122    option.
 123
 124 <p>The <em>ssl_crtd</em> helper has been renamed to <em>security_file_certgen</em>
 125    and is now built and installed by default whenever OpenSSL support is enabled.
 126    Building the helper can be controlled using the <em>--enable-security-cert-generators="file"</em>
 127    option.
 128    NOTE: The <em>--enable-ssl-crtd</em> option is still required to enable the
 129    <em>sslcrtd_program</em> helper interface within Squid that uses the helper.
 130
 131 <p>The <em>ntlm_smb_lm_auth</em> helper is now built using <em>--enable-auth-ntlm="SMB_LM"</em>.
 132    Notice the upper case where it was previously a (wrongly) lower cased acronym.
 133
 134
 135 <sect1>Secure ICAP
 136 <p>ICAP services can now be used over TLS connections.
 137
 138 <p>To mark an ICAP service as secure, use an <em>icaps://</em> service URI scheme when
 139    listing your service via an icap_service directive. The industry is using a
 140    <em>Secure ICAP</em> term, and Squid follows that convention, but <em>icaps</em> seems more
 141    appropriate for a <em>scheme</em> name.
 142
 143 <p>Squid uses <em>port 11344</em> for Secure ICAP by default, following another popular
 144    proxy convention. The old 1344 default for plain ICAP ports has not changed.
 145
 146
 147 <sect1>Improved SMP support
 148 <p>Use of C++11 atomic operations instead of GNU atomics allows a wider range of
 149    operating systems and compilers to build Squid SMP and multi-process features.
 150    However this does require a C++11 or C++0x compiler with a recent version of
 151    the C++ standard library.
 152
 153 <p>IpcIo and Mmapped disk I/O modules are now auto-detected properly which
 154    enables Rock storage on more systems by default than previously.
 155
 156
 157 <sect1>Improved process management
 158 <p>Squid is traditionally refered to as a daemon. But is actually a combination
 159    of daemon and daemon manager processes. This has caused significant problems
 160    integrating it with other third-party daemon managers.
 161
 162 <p>The Squid process which places its PID into the squid.pid file has always
 163    been the process to which control signals are sent. The manager process is
 164    now taking on signal handling instead of the main daemon process. Enabling
 165    integration with daemon managers such as Upstart or systemd which assume the
 166    process they initiated is the daemon with a PID to control.
 167
 168 <p>The squid binary now has a new <em>--foreground</em> command line option,
 169    which (only) prevents daemonizing the master process.
 170    Unlike the old <em>-N</em> option,
 171    <em>--foreground</em> supports SMP workers and multi-process features.
 172    <em>--foreground</em> is particularly useful for use with <em>-z</em> (disk
 173    cache structures creation), as it allows the caller to wait until Squid has
 174    finished.
 175
 176
 177 <sect1>Initial GnuTLS support
 178 <p>If all you need is a proxy that connects over TLS/SSL to a <em>cache_peer</em>
 179    or accepts <em>https://</em> URLs over clear-text and performs the necessary
 180    upstream TLS connections. Then you now have the choice to build Squid with
 181    GnuTLS instead of OpenSSL.
 182
 183 <p><em>squid.conf</em> directives and configuration options which have undergone
 184    name changes from 'ssl' to 'tls' prefix in Squid-4 have GnuTLS support, unless
 185    explicitly stated otherwise.
 186
 187 <p>Advanced configuration with specific selection of ciphers and similar settings
 188    should still work, but needs the GnuTLS <em>Priority Strings</em> instead of
 189    the OpenSSL options when using GnuTLS.
 190
 191
 192 <sect>Changes to squid.conf since Squid-3.5
 193 <p>
 194 There have been changes to Squid's configuration file since Squid-3.5.
 195
 196 This section gives a thorough account of those changes in three categories:
 197
 198 <itemize>
 199         <item><ref id="newtags" name="New tags">
 200         <item><ref id="modifiedtags" name="Changes to existing tags">
 201         <item><ref id="removedtags" name="Removed tags">
 202 </itemize>
 203 <p>
 204
 205 <sect1>New tags<label id="newtags">
 206 <p>
 207 <descrip>
 208         <tag>collapsed_forwarding_shared_entries_limit</tag>
 209         <p>New directive to limit the size of a table used for sharing information
 210            about collapsible entries among SMP workers.
 211
 212         <tag>hopeless_kid_revival_delay</tag>
 213         <p>New directive to set a cool-down delay reviving a child process if
 214            the process is encountering frequent deaths.
 215
 216         <tag>on_unsupported_protocol</tag>
 217         <p>New directive to set the action performed when encountering strange
 218            protocol requests at the beginning of an accepted TCP connection.
 219
 220         <tag>reply_header_add</tag>
 221         <p>New directive to add header fields to outgoing HTTP responses to
 222            the client.
 223
 224         <tag>request_start_timeout</tag>
 225         <p>New directive controlling how long Squid waits for the first request
 226            bytes to arrive after initial connection establishment by a client.
 227
 228         <tag>server_pconn_for_nonretriable</tag>
 229         <p>New directive to provide fine-grained control over persistent connection
 230            reuse when forwarding HTTP requests that Squid cannot retry. It is useful
 231            in environments where opening new connections is very expensive
 232            and race conditions associated with persistent connections are very rare
 233            and/or only cause minor problems.
 234
 235         <tag>shared_memory_locking</tag>
 236         <p>New directive to ensure shared memory is all available immediately
 237            on startup. Protects against SIGBUS errors, but delays startup.
 238
 239         <tag>tls_outgoing_options</tag>
 240         <p>New directive to define TLS security context options for outgoing
 241            connections. For example to HTTPS servers.
 242
 243         <tag>url_rewrite_timeout</tag>
 244         <p>Squid times active requests to redirector. This option sets
 245            the timeout value and the Squid reaction to a timed out
 246            request.
 247
 248 </descrip>
 249
 250 <sect1>Changes to existing tags<label id="modifiedtags">
 251 <p>
 252 <descrip>
 253         <tag>access_log</tag>
 254         <p>TCP accept(2) errors logged with URI <em>error:accept-client-connection</em>.
 255         <p>Unused connections received in <em>http_port</em> or <em>https_port</em>
 256            or transactions terminated before reading[parsing] request headers
 257            logged with URI <em>error:transaction-end-before-headers</em>.
 258
 259         <tag>acl</tag>
 260         <p>New <em>-m</em> flag for <em>note</em> ACL to match substrings.
 261         <p>New <em>connections_encrypted</em> type for matching transactions
 262            where all HTTP messages were received over TLS transport connections,
 263            including messages received from ICAP servers.
 264         <p>New <em>has</em> type for matching whether or not Squid is able to provide
 265           certain sets of transaction state. For example HTTP reply headers.
 266         <p>New <em>transaction_initiator</em> type for detecting various
 267            unusual transactions.
 268         <p>New <em>--consensus</em>, <em>--client-requested</em> and
 269            <em>--server-provided</em> flags for the <em>ssl::server_name</em>
 270            type to control which server name to match against.
 271
 272         <tag>auth_param</tag>
 273         <p>New parameter <em>queue-size=</em> to set the maximum number
 274            of queued requests.
 275         <p>New parameter <em>on-persistent-overload=</em> to set the action taken
 276            when the helper queue is overloaded.
 277
 278         <tag>cache_peer</tag>
 279         <p>New option <em>auth-no-keytab</em> to let GSSAPI implementation determine
 280            which Kerberos credentials to use, instead of specifying a keytab.
 281         <p>Replaced option <em>ssl</em> with <em>tls</em>. Use of any
 282            <em>tls-</em> prefixed options implies <em>tls</em> is enabled.
 283         <p>New option <em>tls-min-version=1.N</em> to set minimum TLS version allowed.
 284         <p>New option <em>tls-default-ca</em> replaces <em>sslflags=NO_DEFAULT_CA</em>
 285         <p>New option <em>tls-no-npn</em> to disable sending TLS NPN extension.
 286         <p>All <em>ssloptions=</em> values for SSLv2 configuration or disabling
 287            have been removed.
 288         <p>Removed <em>sslversion=</em> option. Use <em>tls-options=</em> instead.
 289         <p>Manual squid.conf update may be required on upgrade.
 290         <p>Replaced option <em>sslcafile=</em> with <em>tls-cafile=</em>
 291            which takes multiple entries.
 292
 293         <tag>external_acl_type</tag>
 294         <p>New parameter <em>queue-size=</em> to set the maximum number
 295            of queued requests.
 296         <p>New parameter <em>on-persistent-overload=</em> to set the action taken
 297            when the helper queue is overloaded.
 298         <p>Format field updated to accept any logformat %macro code.
 299
 300         <tag>http_port</tag>
 301         <p>New option <em>tls-min-version=1.N</em> to set minimum TLS version allowed.
 302         <p>New option <em>tls-default-ca</em> replaces <em>sslflags=NO_DEFAULT_CA</em>,
 303            the default is also changed to OFF.
 304         <p>New option <em>tls-no-npn</em> to disable sending TLS NPN extension.
 305         <p>All <em>option=</em> values for SSLv2 configuration or disabling
 306            have been removed.
 307         <p>Removed <em>version=</em> option. Use <em>tls-options=</em> instead.
 308         <p>Manual squid.conf update may be required on upgrade.
 309         <p>Replaced <em>cafile=</em> with <em>tls-cafile=</em> which takes multiple entries.
 310         <p>Changed default value of <em>generate-host-certificates</em> to ON.
 311
 312         <tag>https_port</tag>
 313         <p>New option <em>tls-min-version=1.N</em> to set minimum TLS version allowed.
 314         <p>New option <em>tls-default-ca</em> replaces <em>sslflags=NO_DEFAULT_CA</em>,
 315            the default is also changed to OFF.
 316         <p>New option <em>tls-no-npn</em> to disable sending TLS NPN extension.
 317         <p>All <em>options=</em> values for SSLv2
 318            configuration or disabling have been removed.
 319         <p>Removed <em>version=</em> option. Use <em>tls-options=</em> instead.
 320         <p>Manual squid.conf update may be required on upgrade.
 321         <p>Replaced <em>cafile=</em> with <em>tls-cafile=</em> which takes multiple entries.
 322         <p>Changed default value of <em>generate-host-certificates</em> to ON.
 323
 324         <tag>icap_service</tag>
 325         <p>New scheme <em>icaps://</em> to enable TLS/SSL connections to Secure ICAP
 326            servers on port 11344.
 327         <p>New <em>tls-cert=</em> option to set TLS client certificate to use.
 328         <p>New <em>tls-key=</em> option to set TLS private key matching the client
 329            certificate used.
 330         <p>New <em>tls-min-version=1.N</em> option to set minimum TLS version allowed
 331            on server connections.
 332         <p>New <em>tls-options=</em> option to set OpenSSL library parameters.
 333         <p>New <em>tls-flags=</em> option to set flags modifying Squid TLS operations.
 334         <p>New <em>tls-cipher=</em> option to set a list of ciphers permitted.
 335         <p>New <em>tls-cafile=</em> option to set a file with additional CA
 336            certificate(s) to verify the server certificate.
 337         <p>New <em>tls-crlfile=</em> option to set a file with a CRL to verify the
 338            server certificate.
 339         <p>New <em>tls-default-ca</em> option to use the system Trusted CAs to
 340            verify the server certificate.
 341         <p>New <em>tls-domain=</em> option to verify the server certificate domain.
 342
 343         <tag>logformat</tag>
 344         <p>New code <em>%ssl::&lt;cert_errors</em> to display server
 345            certificate errors.
 346         <p>New code <em>%ssl::&gt;negotiated_version</em> to display
 347            negotiated TLS version of the client connection.
 348         <p>New code <em>%ssl::&lt;negotiated_version</em> to display
 349            negotiated TLS version of the last server or peer connection.
 350         <p>New code <em>%ssl::&gt;received_hello_version</em> to display the
 351            TLS version of the Hello message received from TLS client.
 352         <p>New code <em>%ssl::&lt;received_hello_version</em> to display the
 353            TLS version of the Hello message received from TLS server.
 354         <p>New code <em>%ssl::&gt;received_supported_version</em> to display
 355            the maximum TLS version supported by the TLS client.
 356         <p>New code <em>%ssl::&lt;received_supported_version</em> to display
 357            the maximum TLS version supported by the TLS server.
 358         <p>New code <em>%ssl::&gt;negotiated_cipher</em> to display the
 359            negotiated cipher of the client connection.
 360         <p>New code <em>%ssl::&lt;negotiated_cipher</em> to display the
 361            negotiated cipher of the last server or peer connection.
 362
 363         <tag>pid_filename</tag>
 364         <p>Default value now based on squid -n command line parameter.
 365
 366         <tag>refresh_pattern</tag>
 367         <p>Removed option <em>ignore-auth</em>. Its commonly desired behaviour
 368            is performed by default with correct HTTP/1.1 revalidation.
 369         <p>Removed <em>ignore-must-revalidate</em>. Other more HTTP compliant
 370            directives (cache, store_miss) can be used to prevent objects from
 371            caching.
 372
 373         <tag>sslcrtd_children</tag>
 374         <p>New parameter <em>queue-size=</em> to set the maximum number
 375            of queued requests.
 376         <p>New parameter <em>on-persistent-overload=</em> to set the action taken
 377            when the helper queue is overloaded.
 378
 379         <tag>sslcrtvalidator_children</tag>
 380         <p>New parameter <em>queue-size=</em> to set the maximum number
 381            of queued requests.
 382         <p>New parameter <em>on-persistent-overload=</em> to set the action taken
 383            when the helper queue is overloaded.
 384
 385         <tag>store_id_children</tag>
 386         <p>New parameter <em>queue-size=</em> to set the maximum number
 387            of queued requests.
 388         <p>New parameter <em>on-persistent-overload=</em> to set the action taken
 389            when the helper queue is overloaded.
 390
 391         <tag>url_rewrite_children</tag>
 392         <p>New parameter <em>queue-size=</em> to set the maximum number
 393            of queued requests.
 394         <p>New parameter <em>on-persistent-overload=</em> to set the action taken
 395            when the helper queue is overloaded.
 396
 397 </descrip>
 398
 399 <sect1>Removed tags<label id="removedtags">
 400 <p>
 401 <descrip>
 402         <tag>cache_peer_domain</tag>
 403         <p>Superceded by <em>cache_peer_access</em>. Use dstdomain ACL
 404            in the access control list to restrict domains requested.
 405
 406         <tag>ie_refresh</tag>
 407         <p>Removed. MSIE 3.x, 4.x, 5.0 and 5.01 are no longer popular browsers.
 408
 409         <tag>sslproxy_cafile</tag>
 410         <p>Replaced by <em>tls_outgoing_options cafile=</em>.
 411            Which now takes multiple entries.
 412
 413         <tag>sslproxy_capath</tag>
 414         <p>Replaced by <em>tls_outgoing_options capath=</em>.
 415
 416         <tag>sslproxy_cipher</tag>
 417         <p>Replaced by <em>tls_outgoing_options cipher=</em>.
 418
 419         <tag>sslproxy_client_certificate</tag>
 420         <p>Replaced by <em>tls_outgoing_options cert=</em>.
 421
 422         <tag>sslproxy_client_key</tag>
 423         <p>Replaced by <em>tls_outgoing_options key=</em>.
 424
 425         <tag>sslproxy_flags</tag>
 426         <p>Replaced by <em>tls_outgoing_options flags=</em>.
 427
 428         <tag>sslproxy_options</tag>
 429         <p>Replaced by <em>tls_outgoing_options options=</em>.
 430         <p>All values for SSLv2 configuration or disabling have been removed.
 431         <p>Manual squid.conf update may be required on upgrade.
 432
 433         <tag>sslproxy_version</tag>
 434         <p>Replaced by <em>tls_outgoing_options options=</em>.
 435         <p>All values for SSLv2 configuration or disabling have been removed.
 436         <p>Manual squid.conf update may be required on upgrade.
 437
 438 </descrip>
 439
 440
 441 <sect>Changes to ./configure options since Squid-3.5
 442 <p>
 443 There have been some changes to Squid's build configuration since Squid-3.5.
 444
 445 This section gives an account of those changes in three categories:
 446
 447 <itemize>
 448         <item><ref id="newoptions" name="New options">
 449         <item><ref id="modifiedoptions" name="Changes to existing options">
 450         <item><ref id="removedoptions" name="Removed options">
 451 </itemize>
 452
 453
 454 <sect1>New options<label id="newoptions">
 455 <p>
 456 <descrip>
 457         <tag>--enable-security-cert-generators</tag>
 458         <p>New option to control which TLS/SSL dynamic certificate generator
 459            helpers are built and installed.
 460         <p>Helper <em>ssl_crtd</em> has been renamed to <em>security_file_certgen</em>
 461            and built with module name <em>file</em>. Requires <em>--with-openssl</em>.
 462
 463         <tag>--enable-security-cert-validators</tag>
 464         <p>New option to control which TLS/SSL certificate validation
 465            helpers are built and installed.
 466         <p>One <em>fake</em> helper that does not actually perform any
 467            certificate checks is provided for testing and as an example
 468            for writing custom helpers.
 469
 470         <tag>--without-cppunit</tag>
 471         <p>The cppunit testing framework is auto-detected and used when available.
 472            This option can be used to disable it explicitly.
 473
 474 </descrip>
 475
 476 <sect1>Changes to existing options<label id="modifiedoptions">
 477 <p>
 478 <descrip>
 479         <tag>--enable-auth-basic</tag>
 480         <p>The <em>MSNT-multi-domain</em> helper has been removed.
 481         <p>The SMB LanMan helper <em>SMB_LM</em> is no longer built by default.
 482            It needs to be explicitly listed to be built.
 483
 484         <tag>--enable-auth-ntlm</tag>
 485         <p>The SMB LanMan helper is now built using <em>SMB_LM</em>
 486            (was lower case <em>smb_lm</em>).
 487         <p>The SMB LanMan helper <em>SMB_LM</em> is no longer built by default.
 488            It needs to be explicitly listed to be built.
 489
 490         <tag>--enable-diskio</tag>
 491         <p>Auto-detection of SMP related modules has been fixed to
 492            actually auto-detect them without configuring the module
 493            list manually.
 494
 495 </descrip>
 496 </p>
 497
 498 <sect1>Removed options<label id="removedoptions">
 499 <p>
 500 <descrip>
 501         <tag>--with-cppunit-basedir</tag>
 502         <p>Replaced by <em>--with-cppunit=PATH</em>.
 503            Please prefer the default auto-detection though.
 504
 505         <tag>XSTD_USE_LIBLTDL</tag>
 506         <p>Removed. Use <em>--with-included-ltdl</em> instead.
 507 </descrip>
 508
 509
 510 <sect>Regressions since Squid-2.7
 511
 512 <p>Some squid.conf options which were available in Squid-2.7 are not yet available in Squid-4
 513
 514 <p>If you need something to do then porting one of these from Squid-2 to Squid-3 is most welcome.
 515
 516 <sect1>Missing squid.conf options available in Squid-2.7
 517 <p>
 518 <descrip>
 519         <tag>broken_vary_encoding</tag>
 520         <p>Not yet ported from 2.6
 521
 522         <tag>cache_peer</tag>
 523         <p><em>monitorinterval=</em> not yet ported from 2.6
 524         <p><em>monitorsize=</em> not yet ported from 2.6
 525         <p><em>monitortimeout=</em> not yet ported from 2.6
 526         <p><em>monitorurl=</em> not yet ported from 2.6
 527
 528         <tag>cache_vary</tag>
 529         <p>Not yet ported from 2.6
 530
 531         <tag>error_map</tag>
 532         <p>Not yet ported from 2.6
 533
 534         <tag>external_refresh_check</tag>
 535         <p>Not yet ported from 2.7
 536
 537         <tag>location_rewrite_access</tag>
 538         <p>Not yet ported from 2.6
 539
 540         <tag>location_rewrite_children</tag>
 541         <p>Not yet ported from 2.6
 542
 543         <tag>location_rewrite_concurrency</tag>
 544         <p>Not yet ported from 2.6
 545
 546         <tag>location_rewrite_program</tag>
 547         <p>Not yet ported from 2.6
 548
 549         <tag>refresh_pattern</tag>
 550         <p><em>stale-while-revalidate=</em> not yet ported from 2.7
 551         <p><em>ignore-stale-while-revalidate=</em> not yet ported from 2.7
 552         <p><em>negative-ttl=</em> not yet ported from 2.7
 553
 554         <tag>refresh_stale_hit</tag>
 555         <p>Not yet ported from 2.7
 556
 557         <tag>update_headers</tag>
 558         <p>Not yet ported from 2.7
 559
 560 </descrip>
 561
 562 <sect>Copyright
 563 <p>
 564 Copyright (C) 1996-2018 The Squid Software Foundation and contributors
 565 <p>
 566 Squid software is distributed under GPLv2+ license and includes
 567 contributions from numerous individuals and organizations.
 568 Please see the COPYING and CONTRIBUTORS files for details.
 569
 570 </article>