From: Amos Jeffries Date: Sun, 21 Jul 2013 23:02:09 +0000 (-0600) Subject: Release Notes: update squid.conf directive status X-Git-Tag: SQUID_3_4_0_1~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a77ed31af8b6787e743054a829263ba3751a03ec;p=thirdparty%2Fsquid.git Release Notes: update squid.conf directive status --- diff --git a/doc/release-notes/release-3.4.html b/doc/release-notes/release-3.4.html index 5b7347a1db..5401699732 100644 --- a/doc/release-notes/release-3.4.html +++ b/doc/release-notes/release-3.4.html @@ -26,7 +26,9 @@ for Applied Network Research and members of the Web Caching community.

3. Changes to squid.conf since Squid-3.3

@@ -84,7 +86,9 @@ for how to submit a report with a stack trace.

Most user-facing changes are reflected in squid.conf (see below).

@@ -146,7 +150,39 @@ triggering the existing SSL error processing code.

ssl_crtd related options.

-

2.3 TPROXY Support for OpenBSD 5.1+ and FreeBSD 9+ +

2.3 Store-ID +

+ +

Details at +http://wiki.squid-cache.org/Features/StoreID.

+ +

This feature is a redesigned equivalent to the Squid-2.7 feature known as StoreURL-rewrite.

+ +

Notice that this is not a direct portage of the Squid-2.7 feature so behaviour +differences do exist. Although the new feature works in similar enough ways that the old +helper scripts used for Squid-2.7 are expected to work in this and later versions of Squid.

+ +

Squid traditionally uses the requested URL as an index key ID to locate objects in cache. +It is not the only key possible and the Store-ID feature exposes an API for external +helpers to provide Squid with an alternative key name for any URL.

+ +

When any client request is received which requires a cache lookup the URL is passed to +a helper specified with the store_id_program directive to check for an alternative +Store ID. This allows the helper to identify URLs which refer to duplicate resources and +de-duplicate the cache content. store_id_access is provided to allow ACL-based +tuning of which traffic gets sent to the helper and reduce overheads.

+ +

One subtle and noteworthy difference between Squid-2 and Squid-3 which is highlighted by +this feature is that refresh_pattern applies its regex argument against the Store +ID key and not the transaction URL. So using the Store-ID feature to alter the value +affects which refresh_pattern directive will be matched.

+ +

Store-ID helpers bundled with Squid can be built with the --enable-storeid-rewrite-helpers +options which is added in this version. Currently there is a file helper +provided.

+ + +

2.4 TPROXY Support for OpenBSD 5.1+ and FreeBSD 9+

Details at @@ -170,6 +206,38 @@ which do not yet support the getsockname() API. These systems require --with-nat-devpf to enable /dev/pf support when using PF firewall.

+

2.5 Transaction Annotations +

+ +

Previously the only annotation methods available were ICAP/eCAP HTTP header insertions +or external ACL tag= result code. Each of which had only limited possibilities +for use and little or no correlation.

+ +

It is now possible to add annotations to a client transaction from several sources: +

+

+ +

Annotations on the transaction can be passed to ICAP services or eCAP modules using the +adaptation_meta directive to send them as headers. +They can also be logged using the %note log format code in custom logs. With +the new helper response syntax changes this means all helper response key=value details +such as URL-rewrite or store-id changes, external ACL tag etc. are now able to be logged.

+ +

Annotations which are already assigned to a transaction can be checked using an ACL test +of the new note ACL type. This can match a particular note by name and value, +of for any notes with a given name.

+ +

NOTE: not all helper interfaces are yet enabled to convert key=value into annotations +and the external ACL interface does not yet send annotations to the helper.

+ +

3. Changes to squid.conf since Squid-3.3

There have been changes to Squid's configuration file since Squid-3.3.

@@ -205,6 +273,28 @@ validator helpers are run and when they are started.

sslcrtvalidator_program

Specifies the location of a SSL server certificate validator helper.

+
store_id_access
+

Whether the URL for a given request is passed to the Store-ID helper process. +Used to improve StoreID performance by quickly eliminating helper delays using ACL tests.

+

Ported equivalent to storeurl_access from 2.7

+ +
store_id_bypass
+

Whether the StoreID helper may be bypassed when overloaded.

+ +
store_id_children
+

Controls the number of StoreID helper processes.

+

Options startup=N, idle=N, concurrency=N +

+

+ +
storeurl_rewrite_program
+

A helper program to provide cache storage internal key ID value for a request.

+

Ported equivalent to storeurl_rewrite_program from 2.7

+

@@ -213,9 +303,24 @@ validator helpers are run and when they are started.

+
access_log
+

Configuration syntax extended to support name=value options. +New Syntax: access_log module:place [option ...] [acl ...]

+

New option logformat= to specify the logging format name.

+

New option buffer-size= to specify how large the log buffer +for this log is to be when buffered_logs is enabled.

+

New option on-error= to specify what handling is to be done +if the logging module encounters a non-recoverable error writing logs. +With the value die (the default) Squid halts operation. +With the value drop Squid drops log lines and continue running.

+
acl

New test type server_cert_fingerprint to match against server SSL certificate fingerprint.

+

New test type note to match against transaction annotations +by name and value, or just by name.

+

New test type any-of to match if any one of a set of named ACLs.

+

New test type all-of to match against all of a set of named ACLs.

auth_param

New result code BH to signal helper internal errors @@ -235,6 +340,10 @@ and NA in NTLM and Negotiate authentication.

http://wiki.squid-cache.org/Features/AddonHelpers.

http_port
+

Support IPv6 for intercept mode. Requires ip6tables support on Linux, +PF support on OpenBSD and IPFW support on FreeBSD. Squid will no longer complain +about misconfiguration if IPv6 support is missing, we now rely on the firewall +tools reporting misconfiguration when the NAT rules are created.

Support tproxy mode traffic on BSD systems with BINDANY support (OpenBSD 5+, FreeBSD 9+ so far).

Changed build options behind intercept traffic mode handling on BSD. @@ -244,6 +353,14 @@ see --enable-pf-transparent for more details.

New format code %note to log a transaction annotation linked to the transaction by ICAP, eCAP, a helper, or the note squid.conf directive.

+
pipeline_prefetch
+

Updated to take a numeric count of prefetched pipeline requests instead of ON/OFF.

+ +
refresh_pattern
+

NOTE: the regular expression pattern operates on the cache Store-ID value. +Which by default is identical to the requested URL, but may differ for some +objects if the Store-ID feature is in use.

+
unlinkd_program

New helper response format utilizing result codes OK and BH, to signal helper lookup results. Also, key-value response values to return @@ -266,19 +383,17 @@ values to return multiple values to Squid.

-

There are no removed squid.conf tags in Squid-3.4.

-
storeurl_access
-

Not yet ported from 2.7

+

Replaced by store_id_access.

storeurl_rewrite_children
-

Not yet ported from 2.7

+

Replaced by store_id_children.

storeurl_rewrite_concurrency
-

Not yet ported from 2.7

+

Replaced by store_id_children with concurrency=N option.

storeurl_rewrite_program
-

Not yet ported from 2.7

+

Replaced by store_id_program.

@@ -305,6 +420,12 @@ values to return multiple values to Squid.

+
--enable-storeid-rewrite-helpers
+

New option to control which Store-ID helpers are built. As with other +helper options use --disable-* to prevent any helpers building and +omit to get all helper auto-detected.

+

Currenly only a helper using file for backend is provided.

+
--with-nat-pf

New option to alter the behaviour of http_port ... intercept option in squid.conf.

@@ -346,7 +467,7 @@ to re-enable /dev/pf support when using PF firewall.

5. Regressions since Squid-2.7

-

Some squid.conf and ./configure options which were available in Squid-2.7 are not yet available in Squid-3.3

+

Some squid.conf options which were available in Squid-2.7 are not yet available in Squid-3.4

If you need something to do then porting one of these from Squid-2 to Squid-3 is most welcome.

diff --git a/doc/release-notes/release-3.4.sgml b/doc/release-notes/release-3.4.sgml index 821038972a..10f6b2d9d4 100644 --- a/doc/release-notes/release-3.4.sgml +++ b/doc/release-notes/release-3.4.sgml @@ -110,10 +110,10 @@ Most user-facing changes are reflected in squid.conf (see below). helpers to provide Squid with an alternative key name for any URL.

When any client request is received which requires a cache lookup the URL is passed to - a helper specified with the store_id_rewrite_program directive to check for - an alternative Store ID. This allows the helper to identify URLs which refer to duplicate - resources and de-duplicate the cache content. store_id_access is provided to - allow ACL-based tuning of which traffic gets sent to the helper and reduce overheads. + a helper specified with the store_id_program directive to check for an alternative + Store ID. This allows the helper to identify URLs which refer to duplicate resources and + de-duplicate the cache content. store_id_access is provided to allow ACL-based + tuning of which traffic gets sent to the helper and reduce overheads.

One subtle and noteworthy difference between Squid-2 and Squid-3 which is highlighted by this feature is that refresh_pattern applies its regex argument against the Store @@ -145,6 +145,7 @@ Most user-facing changes are reflected in squid.conf (see below). which do not yet support the getsockname() API. These systems require --with-nat-devpf to enable /dev/pf support when using PF firewall. + Transaction Annotations

Previously the only annotation methods available were ICAP/eCAP HTTP header insertions or external ACL tag= result code. Each of which had only limited possibilities @@ -204,6 +205,27 @@ This section gives a thorough account of those changes in three categories: sslcrtvalidator_program

Specifies the location of a SSL server certificate validator helper. + store_id_access +

Whether the URL for a given request is passed to the Store-ID helper process. + Used to improve StoreID performance by quickly eliminating helper delays using ACL tests. +

Ported equivalent to storeurl_access from 2.7 + + store_id_bypass +

Whether the StoreID helper may be bypassed when overloaded. + + store_id_children +

Controls the number of StoreID helper processes. +

Options startup=N, idle=N, concurrency=N + + startup=N allow finer tuning of how many helpers are started initially. + idle=N allow fine tuning of how many helper to retain as buffer against sudden traffic loads. + concurrency=N was previously called url_rewrite_concurrency as a distinct directive. + + + storeurl_rewrite_program +

A helper program to provide cache storage internal key ID value for a request. +

Ported equivalent to storeurl_rewrite_program from 2.7 + Changes to existing tags

Updated to take a numeric count of prefetched pipeline requests instead of ON/OFF. + refresh_pattern +

NOTE: the regular expression pattern operates on the cache Store-ID value. + Which by default is identical to the requested URL, but may differ for some + objects if the Store-ID feature is in use. + unlinkd_program

New helper response format utilizing result codes OK and BH, to signal helper lookup results. Also, key-value response values to return @@ -277,8 +304,18 @@ This section gives a thorough account of those changes in three categories: Removed tags

-

There are no removed squid.conf tags in Squid-3.4. + storeurl_access +

Replaced by store_id_access. + + storeurl_rewrite_children +

Replaced by store_id_children. + storeurl_rewrite_concurrency +

Replaced by store_id_children with concurrency=N option. + + storeurl_rewrite_program +

Replaced by store_id_program. + @@ -340,7 +377,7 @@ This section gives an account of those changes in three categories: Regressions since Squid-2.7 -

Some squid.conf and ./configure options which were available in Squid-2.7 are not yet available in Squid-3.3 +

Some squid.conf options which were available in Squid-2.7 are not yet available in Squid-3.4

If you need something to do then porting one of these from Squid-2 to Squid-3 is most welcome. @@ -399,18 +436,6 @@ This section gives an account of those changes in three categories: refresh_stale_hit

Not yet ported from 2.7 - storeurl_access -

Not yet ported from 2.7 - - storeurl_rewrite_children -

Not yet ported from 2.7 - - storeurl_rewrite_concurrency -

Not yet ported from 2.7 - - storeurl_rewrite_program -

Not yet ported from 2.7 - update_headers

Not yet ported from 2.7