From: Amos Jeffries <squid3@treenet.co.nz>
Date: Sat, 15 Nov 2014 07:42:32 +0000 (-0800)
Subject: Release Notes update for 3.6
X-Git-Tag: merge-candidate-3-v1~491
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9a2587777d1d7c88cccd7618206ecc51fc10c445;p=thirdparty%2Fsquid.git

Release Notes update for 3.6
---

diff --git a/doc/release-notes/release-3.6.sgml b/doc/release-notes/release-3.6.sgml
index dd36c54b19..c432fc605b 100644
--- a/doc/release-notes/release-3.6.sgml
+++ b/doc/release-notes/release-3.6.sgml
@@ -38,7 +38,8 @@ The 3.6 change history can be <url url="http://www.squid-cache.org/Versions/v3/3
 
 <p>The most important of these new features are:
 <itemize>
-	<item>BLAH
+	<item>Configurable helper queue size
+	<item>SSLv2 support removal
 </itemize>
 
 Most user-facing changes are reflected in squid.conf (see below).
@@ -48,6 +49,16 @@ Most user-facing changes are reflected in squid.conf (see below).
 <p>The new queue-size=N option to helpers configuration, allows users 
 to configure the maximum number of queued requests to busy helpers.
 
+
+<sect1>SSLv2 support removal
+<p>Details in <url url="https://tools.ietf.org/html/rfc6176" name="RFC 6176">
+
+<p>SSLv2 is not fit for purpose. Squid no longer supports being configured with
+any settings regarding this protocol. That includes settings manually disabling
+its use since it is now forced to disable by default. Also settings enabling
+various client/server workarounds specific to SSLv2 are removed.
+
+
 <sect>Changes to squid.conf since Squid-3.5
 <p>
 There have been changes to Squid's configuration file since Squid-3.5.
@@ -70,25 +81,48 @@ This section gives a thorough account of those changes in three categories:
 <sect1>Changes to existing tags<label id="modifiedtags">
 <p>
 <descrip>
-         <tag> auth_param </tag>
-         <p> New parameter <em>queue-size=</em> to set the maximum number
-             of queued requests.
+	<tag>auth_param</tag>
+	<p>New parameter <em>queue-size=</em> to set the maximum number
+	   of queued requests.
+
+	<tag>cache_peer</tag>
+	<p>All <em>ssloption=</em> and <em>sslversion=</em> values for
+	   SSLv2 configuration or disabling have been removed.
+	<p>Manual squid.conf update may be required on upgrade.
+
+	<tag>external_acl_type<tag>
+	<p>New parameter <em>queue-size=</em> to set the maximum number
+	   of queued requests.
+
+	<tag>http_port</tag>
+	<p>All <em>version=</em> <em>option=</em> values for SSLv2
+	   configuration or disabling have been removed.
+	<p>Manual squid.conf update may be required on upgrade.
+
+	<tag>https_port</tag>
+	<p>All <em>version=</em> <em>option=</em> values for SSLv2
+	   configuration or disabling have been removed.
+	<p>Manual squid.conf update may be required on upgrade.
+
+	<tag>sslcrtd_children</tag>
+	<p>New parameter <em>queue-size=</em> to set the maximum number
+	   of queued requests.
+
+	<tag>sslcrtvalidator_children</tag>
+	<p>New parameter <em>queue-size=</em> to set the maximum number
+	   of queued requests.
 
-         <tag>external_acl_type<tag>
-         <p> New parameter <em>queue-size=</em> to set the maximum number
-             of queued requests.
+	<tag>sslproxy_options</tag>
+	<p>All values for SSLv2 configuration or disabling have been removed.
+	<p>Manual squid.conf update may be required on upgrade.
 
-         <tag>url_rewrite_children<tag>
-         <p> New parameter <em>queue-size=</em> to set the maximum number
-             of queued requests.
+	<tag>sslproxy_version</tag>
+	<p>Value '2' for SSLv2-only operation is no longer supported.
 
-         <tag>sslcrtd_children</tag>
-         <p> New parameter <em>queue-size=</em> to set the maximum number
-             of queued requests.
+	<tag>url_rewrite_children<tag>
+	<p>New parameter <em>queue-size=</em> to set the maximum number
+	   of queued requests.
 
-         <tag>sslcrtvalidator_children</tag>
-         <p> New parameter <em>queue-size=</em> to set the maximum number
-             of queued requests.
 </descrip>
 
 <sect1>Removed tags<label id="removedtags">
diff --git a/src/cf.data.pre b/src/cf.data.pre
index 47078c378b..8edd21fad6 100644
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -3152,10 +3152,9 @@ DOC_START
 			reference a combined file containing both the
 			certificate and the key.
 	
-	sslversion=1|2|3|4|5|6
+	sslversion=1|3|4|5|6
 			The SSL version to use when connecting to this peer
 				1 = automatic (default)
-				2 = SSL v2 only
 				3 = SSL v3 only
 				4 = TLS v1.0 only
 				5 = TLS v1.1 only