1 <!doctype linuxdoc system>
3 <title>Squid 4.15 release notes</title>
4 <author>Squid Developers</author>
7 This document contains the release notes for version 4 of Squid.
8 Squid is a WWW Cache application developed by the National Laboratory
9 for Applied Network Research and members of the Web Caching community.
15 <p>The Squid Team are pleased to announce the release of Squid-4.15.
17 This new release is available for download from <url url="http://www.squid-cache.org/Versions/v4/"> or the
18 <url url="http://www.squid-cache.org/Download/http-mirrors.html" name="mirrors">.
20 <p>We welcome feedback and bug reports. If you find a bug, please see <url url="http://wiki.squid-cache.org/SquidFaq/BugReporting">
21 for how to submit a report with a stack trace.
24 <p>Although this release is deemed good enough for use in production, please note the existence of
25 <url url="http://bugs.squid-cache.org/buglist.cgi?query_format=advanced&product=Squid&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&version=4" name="open bugs against Squid-4">.
27 <p>This release adds a dependency on C++11 support in any compiler used to build Squid.
28 As a result older C++03 -only and most C++0x compilers will no longer build successfully.
29 GCC 4.9+ and Clang 3.5+ are known to have working C++11 support and are usable.
30 GCC-4.8 will also build for now despite lack of full C++11 support, but some future features may not be available.
32 <p>This release does not support LibreSSL.
33 Due to a bug in the way LibreSSL uses the OpenSSL version macro some changes
34 necessary to support OpenSSL 1.1 prevent building with LibreSSL.
37 <sect1>Changes since earlier releases of Squid-4
39 The Squid-4 change history can be <url url="http://www.squid-cache.org/Versions/v4/changesets/" name="viewed here">.
42 <sect>Major new features since Squid-3.5
43 <p>Squid 4 represents a new feature release above 3.5.
45 <p>The most important of these new features are:
47 <item>Configurable helper queue size
48 <item>Helper concurrency channels changes
49 <item>SSL support removal
50 <item>Helper Binary Changes
52 <item>Improved SMP support
53 <item>Improved process management
54 <item>Initial GnuTLS support
55 <item>ESI Custom Parser removal
58 Most user-facing changes are reflected in squid.conf (see below).
61 <sect1>Configurable helper queue size
62 <p>The new <em>queue-size=N</em> option to helpers configuration, allows users
63 to configure the maximum number of queued requests to busy helpers.
65 <sect1>Helper concurrency channels changes
66 <p>helper-mux.pl we have been distributing for the past few years to
67 encourage use of concurrency is no longer compatible with Squid. If
68 used it will spawn up to 2^64 helpers and DoS the Squid server.
70 <p>Helpers utilizing arrays to handle fixed amounts of concurrency
71 channels MUST be re-written to use queues and capable of handling a
72 64-bit int as index or they will be vulnerable to buffer overrun and
73 arbitrary memory accesses.
75 <p>32-bit helpers need re-writing to handle the concurrency channel ID
76 as a 64-bit integer value. If not updated they will cause proxies to
77 return unexpected results or timeout once crossing the 32-bit wrap
78 boundary. Leading to undefined behaviour in the client HTTP traffic.
81 <sect1>SSL support removal
82 <p>Details in <url url="https://tools.ietf.org/html/rfc6176" name="RFC 6176">
83 and <url url="https://tools.ietf.org/html/rfc7568" name="RFC 7568">
85 <p>SSLv2 is not fit for purpose. Squid no longer supports being configured with
86 any settings regarding this protocol. That includes settings manually disabling
87 its use since it is now forced to disable by default. Also settings enabling
88 various client/server workarounds specific to SSLv2 are removed.
90 <p>SSLv3 is not fit for purpose. Squid still accepts configuration, but use
91 is deprecated and will be removed entirely in a future version.
92 Squid default behavour is to follow the TLS built in negotiation mechanism
93 which prefers the latest TLS version. But also to accept downgrades to SSLv3.
94 Use <em>tls-options=NO_SSLv3</em> to disable SSLv3 support completely.
96 <p>A new option <em>tls-min-version=1.N</em> is added in place of <em>sslversion=</em>
97 to configure the minimum version the TLS negotiation will allow to be used
98 when an old TLS version is requested by the remote endpoint.
100 <p>The system Trusted CAs are no longer used by default when verifying client
101 certificates. The <em>cafile=</em> option should be used instead to
102 explicitly load the specific CA which signed acceptible client certificates,
103 even if that CA is one of the system Trusted CAs.
104 The <em>tls-default-ca</em> option can be used to restore the old
108 <sect1>Helper Binary Changes
109 <p>The <em>basic_msnt_multi_domain_auth</em> helper has been removed. The
110 <em>basic_smb_lm_auth</em> helper performs the same actions without extra
111 Perl and Samba dependencies.
113 <p>The <em>cert_valid.pl</em> testing helper has been renamed to
114 <em>security_fake_certverify</em>, reflecting the Squid helper naming schema
115 and that it does not actually perform any certificate checks.
117 <p>The <em>security_fake_certverify</em> helper is also now built and installed
118 by default. It is written in Perl so does not require OpenSSL dependencies
119 for installation. But does use the Perl Crypt::OpenSSL::X509 module for execution.
120 Building the helper can be controlled using the <em>--enable-security-cert-validators="fake"</em>
123 <p>The <em>ssl_crtd</em> helper has been renamed to <em>security_file_certgen</em>
124 and is now built and installed by default whenever OpenSSL support is enabled.
125 Building the helper can be controlled using the <em>--enable-security-cert-generators="file"</em>
128 <p>NOTE: The <em>--enable-ssl-crtd</em> option is still required to enable the
129 <em>sslcrtd_program</em> helper interface within Squid that uses the helper.
131 <p>The <em>ntlm_smb_lm_auth</em> helper is now built using <em>--enable-auth-ntlm="SMB_LM"</em>.
132 Notice the upper case where it was previously a (wrongly) lower cased acronym.
136 <p>ICAP services can now be used over TLS connections.
138 <p>To mark an ICAP service as secure, use an <em>icaps://</em> service URI scheme when
139 listing your service via an icap_service directive. The industry is using a
140 <em>Secure ICAP</em> term, and Squid follows that convention, but <em>icaps</em> seems more
141 appropriate for a <em>scheme</em> name.
143 <p>Squid uses <em>port 11344</em> for Secure ICAP by default, following another popular
144 proxy convention. The old 1344 default for plain ICAP ports has not changed.
147 <sect1>Improved SMP support
148 <p>Use of C++11 atomic operations instead of GNU atomics allows a wider range of
149 operating systems and compilers to build Squid SMP and multi-process features.
150 However this does require a C++11 compiler with a recent version of the C++
153 <p>IpcIo and Mmapped disk I/O modules are now auto-detected properly which
154 enables Rock storage on more systems by default than previously.
157 <sect1>Improved process management
158 <p>Squid is traditionally refered to as a daemon. But is actually a combination
159 of daemon and daemon manager processes. This has caused significant problems
160 integrating it with other third-party daemon managers.
162 <p>The Squid process which places its PID into the squid.pid file has always
163 been the process to which control signals are sent. The manager process is
164 now taking on signal handling instead of the main daemon process. Enabling
165 integration with daemon managers such as Upstart or systemd which assume the
166 process they initiated is the daemon with a PID to control.
168 <p>The squid binary now has a new <em>--foreground</em> command line option,
169 which (only) prevents daemonizing the master process.
170 Unlike the old <em>-N</em> option,
171 <em>--foreground</em> supports SMP workers and multi-process features.
172 <em>--foreground</em> is particularly useful for use with <em>-z</em> (disk
173 cache structures creation), as it allows the caller to wait until Squid has
176 <p>The squid binary now accepts a <em>--kid</em> command line option which
177 informs the process which role it is to take on. This aids with debugging
178 SMP issues with specific process types and resolves some SMP forking issues.
181 <sect1>Initial GnuTLS support
182 <p>Squid can now be built to use GnuTLS in place of OpenSSL for the core
183 features of receiving TLS connections from clients and making TLS
184 connections to servers. The GnuTLS support is still very much experimental
185 and should be tested before use.
187 <p>SSL-Bump and certificate generation features are not yet supported by
188 GnuTLS builds. Nor are many other less commonly used Squid TLS/SSL features.
190 <p><em>squid.conf</em> directives and configuration options which have undergone
191 name changes from 'ssl' to 'tls' prefix in Squid-4 have GnuTLS support, unless
192 explicitly stated otherwise.
194 <p>Advanced configuration with specific selection of ciphers and similar settings
195 should still work, but needs the GnuTLS <em>Priority Strings</em> instead of
196 the OpenSSL options when using GnuTLS.
197 See <url url="https://www.gnutls.org/manual/gnutls.html#Priority-Strings" name="GnuTLS manual">
201 <sect1>ESI Custom Parser removal
202 <p>The Squid custom ESI (Edge Side Includes) parser has been removed in favour
203 of better supported and maintained third-party libraries. At least one of libxml2
204 or libexpat is now mandatory to build support for the ESI response processor.
207 <sect>Changes to squid.conf since Squid-3.5
209 There have been changes to Squid's configuration file since Squid-3.5.
211 This section gives a thorough account of those changes in three categories:
214 <item><ref id="newtags" name="New tags">
215 <item><ref id="modifiedtags" name="Changes to existing tags">
216 <item><ref id="removedtags" name="Removed tags">
220 <sect1>New tags<label id="newtags">
223 <tag>collapsed_forwarding_shared_entries_limit</tag>
224 <p>New directive to limit the size of a table used for sharing information
225 about collapsible entries among SMP workers.
227 <tag>force_request_body_continuation</tag>
228 <p>New directive to control Squid behaviour on the client connection when
229 receiving an HTTP request with an Expect:100-continue header.
231 <tag>hopeless_kid_revival_delay</tag>
232 <p>New directive to set a cool-down delay reviving a child process if
233 the process is encountering frequent deaths.
235 <tag>on_unsupported_protocol</tag>
236 <p>New directive to set the action performed when encountering strange
237 protocol requests at the beginning of an accepted TCP connection.
239 <tag>pconn_lifetime</tag>
240 <p>New directive to limit the lifetime of persistent connections.
242 <tag>reply_header_add</tag>
243 <p>New directive to add header fields to outgoing HTTP responses to
246 <tag>request_start_timeout</tag>
247 <p>New directive controlling how long Squid waits for the first request
248 bytes to arrive after initial connection establishment by a client.
250 <tag>server_pconn_for_nonretriable</tag>
251 <p>New directive to provide fine-grained control over persistent connection
252 reuse when forwarding HTTP requests that Squid cannot retry. It is useful
253 in environments where opening new connections is very expensive
254 and race conditions associated with persistent connections are very rare
255 and/or only cause minor problems.
257 <tag>shared_memory_locking</tag>
258 <p>New directive to ensure shared memory is all available immediately
259 on startup. Protects against SIGBUS errors, but delays startup.
261 <tag>tls_outgoing_options</tag>
262 <p>New directive to define TLS security context options for outgoing
263 connections. For example to HTTPS servers.
265 <tag>url_rewrite_timeout</tag>
266 <p>Squid times active requests to redirector. This directive sets
267 the timeout value and the Squid reaction to a timed out
272 <sect1>Changes to existing tags<label id="modifiedtags">
275 <tag>access_log</tag>
276 <p>TCP accept(2) errors logged with URI <em>error:accept-client-connection</em>.
277 <p>Unused connections received in <em>http_port</em> or <em>https_port</em>
278 or transactions terminated before reading[parsing] request headers are
279 logged with URI <em>error:transaction-end-before-headers</em>.
280 <p>New option <em>rotate=</em> to control the number of log file rotations
281 to make when <em>-k rotate</em> command is received. Default is to
282 obey the <em>logfile_rotate</em> directive.
283 <p>Extend <em>buffer-size=</em> support to UDP logging. Prior to Squid-4.7
284 log entries would be buffered up to 1400 bytes before sending to UDP logger.
285 This option may now set smaller buffers, but not larger than 1400 bytes.
288 <p>New <em>-m</em> flag for <em>note</em> ACL to match substrings.
289 <p>New <em>client_connection_mark</em> type for matching Netfilter
290 CONNMARK of the client TCP connection.
291 <p>New <em>connections_encrypted</em> type for matching transactions
292 where all HTTP messages were received over TLS transport connections,
293 including messages received from ICAP servers.
294 <p>New <em>has</em> type for matching whether or not Squid is able to provide
295 certain sets of transaction state. For example HTTP reply headers.
296 <p>New <em>transaction_initiator</em> type for detecting various
297 unusual transactions.
298 <p>New <em>--consensus</em>, <em>--client-requested</em> and
299 <em>--server-provided</em> flags for the <em>ssl::server_name</em>
300 type to control which server name to match against.
301 <p>Added <em>::/128</em> IPv6 range to <em>to_localhost</em> ACL.
303 <tag>auth_param</tag>
304 <p>New parameter <em>queue-size=</em> to set the maximum number
306 <p>New parameter <em>on-persistent-overload=</em> to set the action taken
307 when the helper queue is overloaded.
309 <tag>cache_peer</tag>
310 <p>New option <em>auth-no-keytab</em> to let GSSAPI implementation determine
311 which Kerberos credentials to use, instead of specifying a keytab.
312 <p>Replaced option <em>ssl</em> with <em>tls</em>. Use of any
313 <em>tls-</em> prefixed options implies <em>tls</em> is enabled.
314 <p>New option <em>tls-min-version=1.N</em> to set minimum TLS version allowed.
315 <p>New option <em>tls-default-ca</em> replaces <em>sslflags=NO_DEFAULT_CA</em>
316 <p>New option <em>tls-no-npn</em> to disable sending TLS NPN extension.
317 <p>New <em>tls-options=</em> option value to disable TLS/1.3.
318 <p>All <em>ssloptions=</em> values for SSLv2 configuration or disabling
320 <p>Removed <em>sslversion=</em> option. Use <em>tls-options=</em> instead.
321 <p>Manual squid.conf update may be required on upgrade.
322 <p>Replaced option <em>sslcafile=</em> with <em>tls-cafile=</em>
323 which takes multiple entries.
326 <p>New format macro <em>%O</em> to expand the <em>message=</em> value supplied
327 by external ACL helpers.
329 <tag>ecap_service</tag>
330 <p>New <em>connection-encryption=</em> option to determine ICAP service
331 effect on <em>connections_encrypted</em> ACL.
333 <tag>esi_parser</tag>
334 <p>Removed <em>custom</em> parser option.
335 <p>Changed default to auto-detect available parsers instead of <em>custom</em>.
337 <tag>external_acl_type</tag>
338 <p>New parameter <em>queue-size=</em> to set the maximum number
340 <p>New parameter <em>on-persistent-overload=</em> to set the action taken
341 when the helper queue is overloaded.
342 <p>Format field updated to accept any logformat %macro code.
343 <p>The optional <em>acl-value</em> fields in this helper input now expand
344 to a dash ('-') if the %DATA macro is not specified explicitly.
347 <p>New option <em>tls-min-version=1.N</em> to set minimum TLS version allowed.
348 <p>New option <em>tls-default-ca</em> replaces <em>sslflags=NO_DEFAULT_CA</em>,
349 the default is also changed to OFF.
350 <p>New option <em>tls-no-npn</em> to disable sending TLS NPN extension.
351 <p>New <em>tls-options=</em> option value to disable TLS/1.3.
352 <p>All <em>option=</em> values for SSLv2 configuration or disabling
354 <p>Removed <em>version=</em> option. Use <em>tls-options=</em> instead.
355 <p>Manual squid.conf update may be required on upgrade.
356 <p>Replaced <em>cafile=</em> with <em>tls-cafile=</em> which takes multiple entries.
357 <p>Changed default value of <em>generate-host-certificates</em> to ON.
359 <tag>https_port</tag>
360 <p>New option <em>tls-min-version=1.N</em> to set minimum TLS version allowed.
361 <p>New option <em>tls-default-ca</em> replaces <em>sslflags=NO_DEFAULT_CA</em>,
362 the default is also changed to OFF.
363 <p>New option <em>tls-no-npn</em> to disable sending TLS NPN extension.
364 <p>New <em>tls-options=</em> option value to disable TLS/1.3.
365 <p>All <em>options=</em> values for SSLv2
366 configuration or disabling have been removed.
367 <p>Removed <em>version=</em> option. Use <em>tls-options=</em> instead.
368 <p>Manual squid.conf update may be required on upgrade.
369 <p>Replaced <em>cafile=</em> with <em>tls-cafile=</em> which takes multiple entries.
370 <p>Changed default value of <em>generate-host-certificates</em> to ON.
372 <tag>icap_service</tag>
373 <p>New scheme <em>icaps://</em> to enable TLS/SSL connections to Secure ICAP
374 servers on port 11344.
375 <p>New <em>connection-encryption=</em> option to determine ICAP service
376 effect on <em>connections_encrypted</em> ACL.
377 <p>New <em>tls-cert=</em> option to set TLS client certificate to use.
378 <p>New <em>tls-key=</em> option to set TLS private key matching the client
380 <p>New <em>tls-min-version=1.N</em> option to set minimum TLS version allowed
381 on server connections.
382 <p>New <em>tls-options=</em> option to set OpenSSL library parameters.
383 <p>New <em>tls-options=</em> option value to disable TLS/1.3.
384 <p>New <em>tls-flags=</em> option to set flags modifying Squid TLS operations.
385 <p>New <em>tls-cipher=</em> option to set a list of ciphers permitted.
386 <p>New <em>tls-cafile=</em> option to set a file with additional CA
387 certificate(s) to verify the server certificate.
388 <p>New <em>tls-capath=</em> option to set a directory with additional CA
389 certificate(s) to verify the server certificate.
390 <p>New <em>tls-crlfile=</em> option to set a file with a CRL to verify the
392 <p>New <em>tls-default-ca</em> option to use the system Trusted CAs to
393 verify the server certificate.
394 <p>New <em>tls-domain=</em> option to verify the server certificate domain.
396 <tag>logfile_daemon</tag>
397 <p>Now only requires that helper binary exists when daemon: log module
398 is actually being used.
401 <p>New quoting modifier to produce <em>\-escaped</em> output.
402 <p>New code <em>%ssl::<cert_errors</em> to display server X.509
404 <p>New code <em>%ssl::<cert_issuer</em> to display Issuer field of
405 the received server X.509 certificate.
406 <p>New code <em>%ssl::<cert_subject</em> to display Subject field of
407 the received server X.509 certificate.
408 <p>New code <em>%ssl::>negotiated_version</em> to display
409 negotiated TLS version of the client connection.
410 <p>New code <em>%ssl::<negotiated_version</em> to display
411 negotiated TLS version of the last server or peer connection.
412 <p>New code <em>%ssl::>received_hello_version</em> to display the
413 TLS version of the Hello message received from TLS client.
414 <p>New code <em>%ssl::<received_hello_version</em> to display the
415 TLS version of the Hello message received from TLS server.
416 <p>New code <em>%ssl::>received_supported_version</em> to display
417 the maximum TLS version supported by the TLS client.
418 <p>New code <em>%ssl::<received_supported_version</em> to display
419 the maximum TLS version supported by the TLS server.
420 <p>New code <em>%ssl::>negotiated_cipher</em> to display the
421 negotiated cipher of the client connection.
422 <p>New code <em>%ssl::<negotiated_cipher</em> to display the
423 negotiated cipher of the last server or peer connection.
424 <p>New code <em>%>handshake</em> to display initial octets
425 received on a client connection (Base64 encoded).
426 <p>Fixed <em>%<Hs</em>, <em>%<pt</em> and <em>%<tt</em>
427 codes for received CONNECT errors.
428 <p>Improved <em>%<bs</em> logging on forwarding retries.
429 <p>Improved <em>%<Hs</em>, <em>%<pt</em>, <em>%<tt</em>,
430 <em>%<bs</em> logging on SslBump errors.
432 <tag>pid_filename</tag>
433 <p>Default value now based on squid -n command line parameter.
434 <p>This directive is no longer mandatory to edit for
435 multi-instance/tenant Squid installations.
437 <tag>refresh_pattern</tag>
438 <p>Removed option <em>ignore-auth</em>. Its commonly desired behaviour
439 is performed by default with correct HTTP/1.1 revalidation.
440 <p>Removed option <em>ignore-must-revalidate</em>. Other more HTTP compliant
441 directives (<em>cache</em>, <em>store_miss</em>) can be used to prevent
442 objects from caching.
444 <tag>sslcrtd_children</tag>
445 <p>New parameter <em>queue-size=</em> to set the maximum number
447 <p>New parameter <em>on-persistent-overload=</em> to set the action taken
448 when the helper queue is overloaded.
450 <tag>sslcrtvalidator_children</tag>
451 <p>New parameter <em>queue-size=</em> to set the maximum number
453 <p>New parameter <em>on-persistent-overload=</em> to set the action taken
454 when the helper queue is overloaded.
456 <tag>store_id_children</tag>
457 <p>New parameter <em>queue-size=</em> to set the maximum number
459 <p>New parameter <em>on-persistent-overload=</em> to set the action taken
460 when the helper queue is overloaded.
462 <tag>url_rewrite_children</tag>
463 <p>New parameter <em>queue-size=</em> to set the maximum number
465 <p>New parameter <em>on-persistent-overload=</em> to set the action taken
466 when the helper queue is overloaded.
470 <sect1>Removed tags<label id="removedtags">
473 <tag>cache_peer_domain</tag>
474 <p>Superceded by <em>cache_peer_access</em>. Use dstdomain ACL
475 in the access control list to restrict domains requested.
477 <tag>ie_refresh</tag>
478 <p>Removed. MSIE 3.x, 4.x, 5.0 and 5.01 are no longer popular browsers.
480 <tag>sslproxy_cafile</tag>
481 <p>Replaced by <em>tls_outgoing_options cafile=</em>.
482 Which now takes multiple entries.
484 <tag>sslproxy_capath</tag>
485 <p>Replaced by <em>tls_outgoing_options capath=</em>.
487 <tag>sslproxy_cipher</tag>
488 <p>Replaced by <em>tls_outgoing_options cipher=</em>.
490 <tag>sslproxy_client_certificate</tag>
491 <p>Replaced by <em>tls_outgoing_options cert=</em>.
493 <tag>sslproxy_client_key</tag>
494 <p>Replaced by <em>tls_outgoing_options key=</em>.
496 <tag>sslproxy_flags</tag>
497 <p>Replaced by <em>tls_outgoing_options flags=</em>.
499 <tag>sslproxy_options</tag>
500 <p>Replaced by <em>tls_outgoing_options options=</em>.
501 <p>All values for SSLv2 configuration or disabling have been removed.
502 <p>Manual squid.conf update may be required on upgrade.
504 <tag>sslproxy_version</tag>
505 <p>Replaced by <em>tls_outgoing_options options=</em>.
506 <p>All values for SSLv2 configuration or disabling have been removed.
507 <p>Manual squid.conf update may be required on upgrade.
512 <sect>Changes to ./configure options since Squid-3.5
514 There have been some changes to Squid's build configuration since Squid-3.5.
516 This section gives an account of those changes in three categories:
519 <item><ref id="newoptions" name="New options">
520 <item><ref id="modifiedoptions" name="Changes to existing options">
521 <item><ref id="removedoptions" name="Removed options">
525 <sect1>New options<label id="newoptions">
528 <tag>--enable-security-cert-generators</tag>
529 <p>New option to control which TLS/SSL dynamic certificate generator
530 helpers are built and installed.
531 <p>Helper <em>ssl_crtd</em> has been renamed to <em>security_file_certgen</em>
532 and built with module name <em>file</em>. Requires <em>--with-openssl</em>.
534 <tag>--enable-security-cert-validators</tag>
535 <p>New option to control which TLS/SSL certificate validation
536 helpers are built and installed.
537 <p>One <em>fake</em> helper that does not actually perform any
538 certificate checks is provided for testing and as an example
539 for writing custom helpers.
541 <tag>--without-cppunit</tag>
542 <p>The cppunit testing framework is auto-detected and used when available.
543 This option can be used to disable it explicitly.
545 <tag>--without-systemd</tag>
546 <p>SystemD init environment features are auto-detected and used when available.
547 This option can be used to disable systemd features explicitly.
551 <sect1>Changes to existing options<label id="modifiedoptions">
554 <tag>--enable-auth-basic</tag>
555 <p>The <em>MSNT-multi-domain</em> helper has been removed.
556 <p>The SMB LanMan helper <em>SMB_LM</em> is no longer built by default.
557 It needs to be explicitly listed to be built.
559 <tag>--enable-auth-ntlm</tag>
560 <p>The SMB LanMan helper is now built using <em>SMB_LM</em>
561 (was lower case <em>smb_lm</em>).
562 <p>The SMB LanMan helper <em>SMB_LM</em> is no longer built by default.
563 It needs to be explicitly listed to be built.
565 <tag>--enable-diskio</tag>
566 <p>Auto-detection of SMP related modules has been fixed to
567 actually auto-detect them without configuring the module
570 <tag>--enable-esi</tag>
571 <p>Custom ESI parser has been removed.
572 Libxml2 or libexpat is now required to enable ESI processing.
577 <sect1>Removed options<label id="removedoptions">
580 <tag>--with-cppunit-basedir</tag>
581 <p>Replaced by <em>--with-cppunit=PATH</em>.
582 Please prefer the default auto-detection though.
584 <tag>XSTD_USE_LIBLTDL</tag>
585 <p>Removed. Use <em>--with-included-ltdl</em> instead.
589 <sect>Regressions since Squid-2.7
591 <p>Some squid.conf options which were available in Squid-2.7 are not yet available in Squid-4
593 <p>If you need something to do then porting one of these from Squid-2 to Squid-3 is most welcome.
595 <sect1>Missing squid.conf options available in Squid-2.7
598 <tag>broken_vary_encoding</tag>
599 <p>Not yet ported from 2.6
601 <tag>cache_peer</tag>
602 <p><em>monitorinterval=</em> not yet ported from 2.6
603 <p><em>monitorsize=</em> not yet ported from 2.6
604 <p><em>monitortimeout=</em> not yet ported from 2.6
605 <p><em>monitorurl=</em> not yet ported from 2.6
607 <tag>cache_vary</tag>
608 <p>Not yet ported from 2.6
611 <p>Not yet ported from 2.6
613 <tag>external_refresh_check</tag>
614 <p>Not yet ported from 2.7
616 <tag>location_rewrite_access</tag>
617 <p>Not yet ported from 2.6
619 <tag>location_rewrite_children</tag>
620 <p>Not yet ported from 2.6
622 <tag>location_rewrite_concurrency</tag>
623 <p>Not yet ported from 2.6
625 <tag>location_rewrite_program</tag>
626 <p>Not yet ported from 2.6
628 <tag>refresh_pattern</tag>
629 <p><em>stale-while-revalidate=</em> not yet ported from 2.7
630 <p><em>ignore-stale-while-revalidate=</em> not yet ported from 2.7
631 <p><em>negative-ttl=</em> not yet ported from 2.7
633 <tag>refresh_stale_hit</tag>
634 <p>Not yet ported from 2.7
636 <tag>update_headers</tag>
637 <p>Not yet ported from 2.7
643 Copyright (C) 1996-2021 The Squid Software Foundation and contributors
645 Squid software is distributed under GPLv2+ license and includes
646 contributions from numerous individuals and organizations.
647 Please see the COPYING and CONTRIBUTORS files for details.