Prep for 3.1.15 and 3.2.0.11

diff --git a/ChangeLog b/ChangeLog
index dd8f5759380a691d4340e43d092482626f94af58..bf8711d99a5b0306388401121ef130d6be20236f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,28 @@
+Changes to squid-3.2.0.11 (28 Aug 2011):
+
+       - Bug 3243: CVE-2009-0801 Bypass of browser same-origin access control
+               - Host: authority validation of intercepted destination IP
+               - Host: authority validation of request URL
+               - Host: authority validation of CONNECT tunnel destination
+               - Preserve client destination IP in intercepted communication
+       - Regression Bug 3316: Failed to connect to nameserver using TCP
+       - Regression Bug 3311: segmentation fault in getMyPort() with only intercept port set
+       - Regression Bug 3310: %<pt translates as %<p
+       - Regression Bug 3301: ERR_DNS_FAIL never shown (partial)
+       - Regression Bug 3288: %<la and %<lp not displaying
+       - Bug 3289: cache manager parameters not parsed without password
+       - Bug 2279: Log Format options to log server source IP and port
+       - Bug 3211: ssl_crtd start even if no ssl-bump port is configured
+       - Bug 3138: squidclient mgr:objects/mgr:vm_objects never ends
+       - Bug 3118: ecap_enable on forces icap_enable on
+       - Bug 3107: ncsa_auth DES silently truncates passwords to 8 bytes
+       - Default to vhost for accelerator mode (reverse proxy)
+       - Display HTTP protocol syntax at section 11 level 2
+       - Support for using custom keys in CARP parents
+       - Optimize regular expression ACLs
+       - ... and a lot of code portability fixes
+       - ... and all bugs and polish changes from 3.1.15
+
 Changes to squid-3.2.0.10 (24 Jul 2011):
 
        - Port from 2.7: act-as-origin for reverse proxy ports
@@ -224,6 +249,7 @@ Changes to squid-3.2.0.1 (03 Aug 2010):
 Changes to squid-3.1.15 (28 Aug 2011):
 
        - Regression fix: vhost and defaultsite causing vport to be ignored
+       - Regression Bug 3295: broken escaping in rfc1738_do_escape
        - Bug #3232: fails to compile with OpenSSL v1.0.0
        - Bug #3222: cache_peer name is not logging on CONNECT
        - Bug #3131: fd_table[fd].closing() assert from ConnStateData::noteMoreBodySpaceAvailable()
@@ -239,6 +265,7 @@ Changes to squid-3.1.15 (28 Aug 2011):
        - Bug #1791: timestampsSet does not validate Date: if server sends very old date
        - Correct parsing of large Gopher indexes
        - Enable negative cacheing on unknown or -1 expiry timestamp
+       - Remove hierarchy_stoplist default value
        - Migrate cf_gen tool from C-style to C++
        - ... and several documentation and compiler warning fixes
 

diff --git a/doc/release-notes/release-3.1.sgml b/doc/release-notes/release-3.1.sgml
index 8eb7092a96bec775b81fbd6795b0558a62ca5088..eb7ea23d0ffd94dfc7706d3dc98aa2817ac243db 100644 (file)
--- a/doc/release-notes/release-3.1.sgml
+++ b/doc/release-notes/release-3.1.sgml
@@ -31,7 +31,7 @@ Although this release is deemed good enough for use in many setups, please note
 
 <itemize>
        <item>The lack of some features available in Squid-2.x series. See the regression sections below for full details.
-       <item>CVE-2009-0801 : NAT interception vulnerability to malicious clients.
+       <item>CVE-2009-0801 : NAT interception vulnerability to malicious clients. This is fixed in 3.2 series.
 </itemize>
 
 <p>Currently known issues which only depends on available developer time and may still be resolved in a future 3.1 release are:

diff --git a/doc/release-notes/release-3.2.sgml b/doc/release-notes/release-3.2.sgml
index c7d722810ee7163a2b169088c1fc89721addbbe5..7d2becb58d196df89fbcabdfacf3767d28eabdd3 100644 (file)
--- a/doc/release-notes/release-3.2.sgml
+++ b/doc/release-notes/release-3.2.sgml
@@ -1,6 +1,6 @@
 <!doctype linuxdoc system>
 <article>
-<title>Squid 3.2.0.10 release notes</title>
+<title>Squid 3.2.0.11 release notes</title>
 <author>Squid Developers</author>
 
 <abstract>
@@ -13,13 +13,14 @@ for Applied Network Research and members of the Web Caching community.
 
 <sect>Notice
 <p>
-The Squid Team are pleased to announce the release of Squid-3.2.0.10 for testing.
+The Squid Team are pleased to announce the release of Squid-3.2.0.11 for testing.
 
 This new release is available for download from <url url="http://www.squid-cache.org/Versions/v3/3.2/"> or the <url url="http://www.squid-cache.org/Mirrors/http-mirrors.html" name="mirrors">.
 
 While this release is not deemed ready for production use, we believe it is ready for wider testing by the community.
 
-We welcome feedback and bug reports. If you find a bug, please see <url url="http://wiki.squid-cache.org/SquidFaq/TroubleShooting#head-7067fc0034ce967e67911becaabb8c95a34d576d"> for how to submit a report with a stack trace.
+We welcome feedback and bug reports. If you find a bug, please see <url url="http://wiki.squid-cache.org/SquidFaq/BugReporting"> for how to submit a 
+report with a stack trace.
 
 <sect1>Known issues
 <p>
@@ -34,6 +35,7 @@ The 3.2 change history can be <url url="http://www.squid-cache.org/Versions/v3/3
 
 <p>The most important of these new features are:
 <itemize>
+       <item>Fixed CVE-2009-0801 : NAT interception vulnerability to malicious clients.
        <item>SMP scalability
        <item>Helper Multiplexer and On-Demand
        <item>Helper Name Changes
@@ -49,6 +51,20 @@ The 3.2 change history can be <url url="http://www.squid-cache.org/Versions/v3/3
 Most user-facing changes are reflected in squid.conf (see below).
 
 
+<sect1>Fixed CVE-2009-0801 : NAT interception vulnerability to malicious clients.
+<p>Details in Advisory <url url="http://www.squid-cache.org/Advisories/SQUID-2011_1.txt" name="SQUID-2011:1">
+
+<p>Squid locates the authority-URL details available in an HTTP request as
+  defined by RFC 2616 and validates that all found representations are
+  <em>textually</em> equivalent. In the case of intercepted traffic the
+  client destination IP is also compared to the Host: authority domains
+  DNS entries.
+
+<p>When the Host: authority contradicts another authority source Squid will log
+  "SECURITY ALERT: Host: header forgery detected" and respond with a 409 Conflict
+  error status page.
+
+
 <sect1>SMP scalability
 <p>The new "workers" squid.conf option can be used to launch multiple worker
    processes and utilize multiple CPU cores. The overall intent is to make
@@ -393,8 +409,11 @@ This section gives a thorough account of those changes in three categories:
          client-side delay pool for the request.
 
        <tag>client_dst_passthru</tag>
-       <p>New setting to disable Host: header security on interception proxies.
+       <p>New setting to disable extra Host: header security on interception proxies.
           Impacts cache integrity/reliability and client browser security.
+       <p><em>IMPORTANT:</em> disabling this directive only allows Squid to change the
+          destination IP to another source indicated by Host: domain DNS or
+          cache_peer configuration. It <em>does not</em> affect Host: validation.
 
        <tag>cpu_affinity_map</tag>
        <p>New setting for SMP support to map Squid processes onto specific CPU cores.