3.5.13

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 644ae6297e3d78dc3b97f53836dc80f7ce255456..01ba893a4d02a8da734416d46096f69e59ce7aef 100644 (file)
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -54,6 +54,7 @@ Thank you!
     Assar Westerlund <assar@pdc.kth.se>
     Automatic source maintenance <squidadm@squid-cache.org>
     Axel Westerhold <ml.awesterhold@dts.de>
+    Aymeric Vincent <aymericvincent@free.fr>
     Barry Dobyns <barry@dobyns.com>
     Benjamin Kerensa <bkerensa@ubuntu.com>
     Benno Rice <benno@jeamland.net>
@@ -249,6 +250,7 @@ Thank you!
     Marcello Romani <marcello.romani@libero.it>
     Marcin Wisnicki <mwisnicki@gmail.com>
     Marco Beck <mbeck@miamod.de>
+    Marcos Mello <marcosfrm@gmail.com>
     Marcus Kool
     Marcus Kool <marcus.kool@urlfilterdb.com>
     Marc van Selm <selm@cistron.nl>
@@ -384,6 +386,7 @@ Thank you!
     Stefano Cordibella <stefano.cordibella@edalab.it>
     Stephen R. van den Berg <srb@cuci.nl>
     Stephen Thorne <stephen@thorne.id.au>
+    Stephen Welker <stephen.welker@nemostar.com.au>
     Steve Bennett <S.Bennett@lancaster.ac.uk>
     Steve Hill <steve@opendium.com>
     Steven Lawrance <squid@moonlightdesign.org>
@@ -423,6 +426,7 @@ Thank you!
     Vincent Regnard
     Vitaliy Matytsyn (main) <vm@if.bank.gov.ua>
     Vitaliy Matytsyn <vm@if.bank.gov.ua>
+    Vitaly Lavrov <vel21ripn@gmail.com>
     vollkommen <vollkommen@gmx.net>
     Walter <bundestrojaner2@googlemail.com>
     Wang DaQing <wdq@bigfoot.com>

diff --git a/ChangeLog b/ChangeLog
index 7cf3904fc6a5f2b26c34d4b3806e31b6086b1f73..46160ffe08827a842ee4cbcfacc42e649fb92277 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+Changes to squid-3.5.13 (06 Jan 2016):
+
+       - Bug 4397: DragonFly BSD, POSIX shared memory is implemented as filepath
+       - Bug 4387: Kerberos build errors on Solaris
+       - TLS: Support Ephemeral Elliptic Curve Diffie-Hellman (EECDH) key exchange
+       - TLS: Complete certificate chains using external intermediate certificates
+       - Avoid memory leaks when an X.509 certificate validator is used with SslBump
+       - Fix connection retry and fallback after failed server TLS connections
+       - Fix GnuTLS detection via pkg-config
+       - Fix startup crash with a misconfigured (too-small) shared memory cache
+       - ... and some documentation updates
+
 Changes to squid-3.5.12 (28 Nov 2015):
 
        - Bug 4374: refresh_pattern config parser (%)

diff --git a/SPONSORS.list b/SPONSORS.list
index 0d6288b74a11eb4d1db4b03e5014f450dddde7bf..6d2cd35e48cfa56846c61f945a7ce1c3996b3822 100644 (file)
--- a/SPONSORS.list
+++ b/SPONSORS.list
@@ -1,7 +1,7 @@
 The following organizations have supported the Squid Project by providing
 their resources or funding various Squid development activities:
 
-@Squid-3.4:
+@Squid-3.5:
 LaunchPad - http://launchpad.net/
 
        Provide Bazaar mirroring services and host the Squid-3 developer

diff --git a/configure.ac b/configure.ac
index 8e0d4ca68a5d0955f7211702052f77963d48d22e..a138a9e626f8e4674e75b9ca5e71b1432b78ecc7 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -5,7 +5,7 @@
 ## Please see the COPYING and CONTRIBUTORS files for details.
 ##
 
-AC_INIT([Squid Web Proxy],[3.5.12-BZR],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[3.5.13-BZR],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)

diff --git a/doc/release-notes/release-3.5.sgml b/doc/release-notes/release-3.5.sgml
index dc14c6a69f22865ce44e22b1d58dffa55c6e177b..61656322aa5c4942669f5a91c959016f79901c57 100644 (file)
--- a/doc/release-notes/release-3.5.sgml
+++ b/doc/release-notes/release-3.5.sgml
@@ -1,6 +1,6 @@
 <!doctype linuxdoc system>
 <article>
-<title>Squid 3.5.12 release notes</title>
+<title>Squid 3.5.13 release notes</title>
 <author>Squid Developers</author>
 
 <abstract>
@@ -13,7 +13,7 @@ for Applied Network Research and members of the Web Caching community.
 
 <sect>Notice
 <p>
-The Squid Team are pleased to announce the release of Squid-3.5.12.
+The Squid Team are pleased to announce the release of Squid-3.5.13.
 
 This new release is available for download from <url url="http://www.squid-cache.org/Versions/v3/3.5/"> or the
  <url url="http://www.squid-cache.org/Download/http-mirrors.html" name="mirrors">.
@@ -65,6 +65,7 @@ The 3.5 change history can be <url url="http://www.squid-cache.org/Versions/v3/3
        <item>Native FTP Relay
        <item>Receive PROXY protocol, Versions 1 & 2
        <item>Basic authentication MSNT helper changes
+       <item>Elliptic Curve Diffie-Hellman (ECDH) (since 3.5.13)
 </itemize>
 
 Most user-facing changes are reflected in squid.conf (see below).
@@ -235,8 +236,8 @@ Most user-facing changes are reflected in squid.conf (see below).
    the protocol being relayed on the connection.
 
 <p>Squid currently supports receiving HTTP traffic from a client proxy using this protocol.
-   An http_port which has been configured to receive this protocol may only be used to
-   receive traffic from client software sending in this protocol.
+   An <em>http_port</em> which has been configured to receive this protocol may only be used
+   to receive traffic from client software sending in this protocol.
    HTTP traffic without the PROXY header is not accepted on such a port.
 
 <p>The <em>accel</em> and <em>intercept</em> options are still used to identify the HTTP
@@ -288,6 +289,19 @@ Most user-facing changes are reflected in squid.conf (see below).
    is also deprecated. It will be removed in the Squid-3.6 series.
 
 
+<sect1>Elliptic Curve Diffie-Hellman (ECDH)
+<p>All listening port which supported Diffie-Hellman key exchange are now updated
+   to support Elliptic Curve configuration which allows for forward secrecy with
+   better performance than traditional ephemeral Diffie-Hellman.
+
+<p>The http(s)_port <em>dhparams=</em> option is replaced with <em>tls-dh=</em> that
+   takes an optional curve name as well as filename for curve parameters. The new
+   option configured without a curve name uses the traditional ephemeral DH.
+
+<p>A new <em>options=SINGLE_ECDH_USE</em> parameter is added to enable ephemeral
+   key exchanges for Elliptic Curve DH.
+
+
 
 <sect>Changes to squid.conf since Squid-3.4
 <p>
@@ -320,6 +334,10 @@ This section gives a thorough account of those changes in three categories:
        <p>Ported from Squid-2 with no configuration or visible behaviour changes.
            Collapsing of requests is performed across SMP workers.
 
+       <tag>sslproxy_foreign_intermediate_certs</tag>
+       <p>New directive to load intermediate TLS certificates for
+          filling incomplete server certificate chains. Added in 3.5.13.
+
        <tag>ftp_client_idle_timeout</tag>
        <p>New directive controlling how long to wait for an FTP request on a
           client connection to Squid <em>ftp_port</em>.
@@ -396,6 +414,8 @@ This section gives a thorough account of those changes in three categories:
        <p>New types <em>ssl::server_name</em> and <em>ssl::server_name_regex</em>
           to match server name from various sources (CONNECT authority name,
           TLS SNI domain, or X.509 certificate Subject Name).
+       <p>Extended <em>user_cert</em> and <em>ca_cert</em> types to accept
+          numeric OID for certificate attributes.
 
        <tag>auth_param</tag>
        <p>New parameter <em>key_extras</em> to send additional parameters to
@@ -455,10 +475,26 @@ This section gives a thorough account of those changes in three categories:
           Currently supported values are: HTTP, HTTP/1.1, HTTPS, HTTPS/1.1
        <p>New option <em>require-proxy-header</em> to mark ports receiving PROXY
           protocol version 1 or 2 traffic.
+       <p>New <em>options=NO_TICKET</em> parameter to disable TLS tickets
+          extension.
+       <p>New <em>options=SINGLE_ECDH_USE</em> parameter to enable ephemeral
+          ECDH key exchange. Added in 3.5.13.
+       <p>Deprecated <em>dhparams=</em> option. Use <em>tls-dh=</em> instead.
+          The new option allows to optionally specify an elliptic curve for
+          ephemeral ECDH by adding <em>curve-name:</em> in front of the
+          parameter file name. Added in 3.5.13.
 
        <tag>https_port</tag>
        <p><em>protocol=</em> option altered to accept protocol version details.
           Currently supported values are: HTTP, HTTP/1.1, HTTPS, HTTPS/1.1
+       <p>New <em>options=NO_TICKET</em> parameter to disable TLS tickets
+          extension.
+       <p>New <em>options=SINGLE_ECDH_USE</em> parameter to enable ephemeral
+          ECDH key exchange. Added in 3.5.13.
+       <p>Deprecated <em>dhparams=</em> option. Use <em>tls-dh=</em> instead.
+          The new option allows to optionally specify an elliptic curve for
+          ephemeral ECDH by adding <em>curve-name:</em> in front of the
+          parameter file name. Added in 3.5.13.
 
        <tag>logformat</tag>
        <p>New format code <em>%credentials</em> to log the client credentials token.