From: Amos Jeffries Date: Thu, 16 May 2013 03:19:46 +0000 (-0600) Subject: Release Notes: rebuild HTML notes for 3.4 X-Git-Tag: SQUID_3_4_0_1~136 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5231b9f797d0b8a7ae4b7e03278a6328b8b7de4c;p=thirdparty%2Fsquid.git Release Notes: rebuild HTML notes for 3.4 --- diff --git a/doc/release-notes/release-3.4.html b/doc/release-notes/release-3.4.html index 2f5544569a..5b7347a1db 100644 --- a/doc/release-notes/release-3.4.html +++ b/doc/release-notes/release-3.4.html @@ -1,7 +1,7 @@ - + Squid 3.4.0.0 release notes @@ -26,6 +26,7 @@ for Applied Network Research and members of the Web Caching community.

3. Changes to squid.conf since Squid-3.3

@@ -55,17 +56,19 @@ for Applied Network Research and members of the Web Caching community.

The Squid Team are pleased to announce the release of Squid-3.4.0.0 for testing.

This new release is available for download from -http://www.squid-cache.org/Versions/v3/3.HEAD/ or the +http://www.squid-cache.org/Versions/v3/3.HEAD/ or the mirrors.

While this release is not deemed ready for production use, we believe it is ready for wider testing by the community.

We welcome feedback and bug reports. If you find a bug, please see -http://wiki.squid-cache.org/SquidFaq/TroubleShooting#head-7067fc0034ce967e67911becaabb8c95a34d576d for how to submit a report with a stack trace.

+http://wiki.squid-cache.org/SquidFaq/BugReporting +for how to submit a report with a stack trace.

1.1 Known issues

Although this release is deemed good enough for use in many setups, please note the existence of -open bugs against Squid-3.4.

+open bugs against Squid-3.4.

+

1.2 Changes since earlier releases of Squid-3.4

@@ -81,6 +84,7 @@ for Applied Network Research and members of the Web Caching community.

Most user-facing changes are reflected in squid.conf (see below).

@@ -142,6 +146,30 @@ triggering the existing SSL error processing code.

ssl_crtd related options.

+

2.3 TPROXY Support for OpenBSD 5.1+ and FreeBSD 9+ +

+ +

Details at +http://wiki.squid-cache.org/ConfigExamples/Intercept/OpenBsdPf.

+ +

The Packet Filter (PF) firewall in OpenBSD 4.4 and later offers traffic interception +using several very simple methods. One of which is the divert-to rule type +which acts as a simple routing diversion instead of performing NAT packet alterations.

+ +

The IP Firewall (IPFW) on FreeBSD 9+ contains a port of the Linux Netfilter TPROXY feature.

+ +

This version of Squid adds support for these features through the ./configure +options --enable-pf-transparent and --enable-ipfw-transparent when Squid is built on +systems with the required support. No special extras are required to enable +http_port ... tproxy configuration to work.

+ +

NOTE: To resolve NAT lookup issues on recent PF firewall versions the code behind +./configure --enable-pf-transparent has been altered and is expected to +break on the version of PF firewall shipped with BSD systems such as NetBSD and FreeBSD +which do not yet support the getsockname() API. +These systems require --with-nat-devpf to enable /dev/pf support when using PF firewall.

+ +

3. Changes to squid.conf since Squid-3.3

There have been changes to Squid's configuration file since Squid-3.3.

@@ -167,6 +195,9 @@ triggering the existing SSL error processing code.

Use ACLs to annotate a transaction with customized annotations which can be logged in access.log

+
spoof_client_ip
+

Access control to determine whether to disable the TPROXY spoofing on upstream traffic.

+
sslcrtvalidator_children

Specifies the settings for how many SSL server certificate validator helpers are run and when they are started.

@@ -203,6 +234,12 @@ and NA in NTLM and Negotiate authentication.

Details at http://wiki.squid-cache.org/Features/AddonHelpers.

+
http_port
+

Support tproxy mode traffic on BSD systems with BINDANY support +(OpenBSD 5+, FreeBSD 9+ so far).

+

Changed build options behind intercept traffic mode handling on BSD. +see --enable-pf-transparent for more details.

+
logformat

New format code %note to log a transaction annotation linked to the transaction by ICAP, eCAP, a helper, or the note squid.conf directive.

@@ -231,6 +268,18 @@ values to return multiple values to Squid.

There are no removed squid.conf tags in Squid-3.4.

+
storeurl_access
+

Not yet ported from 2.7

+ +
storeurl_rewrite_children
+

Not yet ported from 2.7

+ +
storeurl_rewrite_concurrency
+

Not yet ported from 2.7

+ +
storeurl_rewrite_program
+

Not yet ported from 2.7

+

@@ -256,7 +305,14 @@ values to return multiple values to Squid.

-

There are no new ./configure options in Squid-3.4.

+
--with-nat-pf
+

New option to alter the behaviour of http_port ... intercept option +in squid.conf.

+

When this option is used Squid performs the /dev/pf lookups required to +support PF rdr-to rules. Otherwise Squid will perform perform the +getsockname() API calls to support PF divert-to rules.

+

NOTE: systems such as NetBSD and FreeBSD which do not yet support +the getsockname() API in recent PF versions require this option.

@@ -266,7 +322,14 @@ values to return multiple values to Squid.

-

There are no changed ./configure options in Squid-3.4.

+
--enable-pf-transparent
+

NAT table support updated to use the getsockname() API provided by the +latest PF versions divert-to. This allows http_port +in squid.conf to support both intercept and tproxy traffic +and to silence NAT lookup failure messages on recent BSD.

+

NOTE: systems such as NetBSD and FreeBSD which do not yet support +the getsockname() API in recent PF versions require --with-nat-devpf +to re-enable /dev/pf support when using PF firewall.

@@ -318,16 +381,9 @@ values to return multiple values to Squid.

error_map

Not yet ported from 2.6

-
external_acl_type
-

%ACL format tag not yet ported from 2.6

-

%DATA format tag not yet ported from 2.6

-
external_refresh_check

Not yet ported from 2.7

-
http_port
-

act-as-origin not yet ported from 2.7

-
ignore_ims_on_miss

Not yet ported from 2.7

@@ -351,18 +407,6 @@ values to return multiple values to Squid.

refresh_stale_hit

Not yet ported from 2.7

-
storeurl_access
-

Not yet ported from 2.7

- -
storeurl_rewrite_children
-

Not yet ported from 2.7

- -
storeurl_rewrite_concurrency
-

Not yet ported from 2.7

- -
storeurl_rewrite_program
-

Not yet ported from 2.7

-
update_headers

Not yet ported from 2.7