From: Amos Jeffries
-
-
-
-
-
- The Squid Team are pleased to announce the release of Squid-3.5.7. This new release is available for download from
-http://www.squid-cache.org/Versions/v3/3.5/ or the
-mirrors. Some interesting new features adding system flexibility have been added along with general improvements all around.
-While this release is not fully bug-free we believe it is ready for use in production on many systems. We welcome feedback and bug reports. If you find a bug, please see
-http://wiki.squid-cache.org/SquidFaq/BugReporting
-for how to submit a report with a stack trace. Although this release is deemed good enough for use in many setups, please note the existence of
-open bugs against Squid-3.5. The 3.5 change history can be
-viewed here. Squid sources are now administered by the Squid Software Foundation on
-behalf of the Squid Project and community. This version of Squid contains initial changes to streamline copyright
-declarations in Squid sources and related metafiles. No functionality
-or licensing changes are intended. Once completed, the changes will consistently declare Squid contributors
-(listed in CONTRIBUTORS and represented by the Squid Software Foundation) as
-Squid copyright owners while referring the reader to the COPYING file for GPL
-licensing details. The boilerplate with the above information is provided. These changes do not affect copyright rights of individuals or organizations.
-We are simply confirming the fact that there are many Squid copyright owners,
-just like there are many Linux kernel copyright owners. We are also providing
-a simple, consistent way to document that fact. Squid 3.5 represents a new feature release above 3.4. The most important of these new features are:
-Squid 3.5.7 release notes
-
-Squid Developers
-
-This document contains the release notes for version 3.5 of Squid.
-Squid is a WWW Cache application developed by the National Laboratory
-for Applied Network Research and members of the Web Caching community.
-
-1. Notice
-
-
-
-2. Major new features since Squid-3.4
-
-
-
-3. Changes to squid.conf since Squid-3.4
-
-
-4. Changes to ./configure options since Squid-3.4
-
-
-5. Regressions since Squid-2.7
-
-
-6. Copyright
-
-
-
-1. Notice
-
-1.1 Known issues
-
-
-1.2 Changes since earlier releases of Squid-3.5
-
-
-1.3 Copyright disclaimer adjustments
-
-
-2. Major new features since Squid-3.4
-
-
-
-
Most user-facing changes are reflected in squid.conf (see below).
- - -Details at -http://wiki.squid-cache.org/Features/eCAP.
- -The new libecap version allows Squid to better check the version of -the eCAP adapter being loaded as well as the version of the eCAP library -being used.
- -Squid-3.5 can support eCAP adapters built with libecap v1.0, -but no longer supports adapters built with earlier libecap versions -due to API changes.
- - -Details at -http://www.squid-cache.org/Doc/config/auth_param/.
- -The new key_extras parameter allows sending of additional -details to the authentication helper beyond the minimum required for -the HTTP authentication. This is primarily intended to allow switching -of authentication databases based on criteria such as client IP subnet, -Squid receiving port, or in reverse-proxy the requested domain name.
- -In theory any logformat code may be used, however only the -codes which have available details at the time of authentication -will send any meaningful detail.
- - -Details at -http://wiki.squid-cache.org/MultipleInstances.
-Terminology details at -http://wiki.squid-cache.org/Features/SmpScale#Terminology.
- -The command line option -n assigns a name to the Squid service -instance to be used as a unique identifier for all SMP processes run as -part of that instance. This allows multiple instances of Squid service to -be run on a single machine without background SMP systems such as shared -memory and inter-process communication becoming confused or requiring -additional configuration.
- -A service name is always used. When the -n option is missing -from the command line the default service name is squid.
- -When multiple instances are being run the -n service name is -required to target all other options such as -z or -k -commands at the correct service.
- -The squid.conf macro ${service_name} is added to provide the service name -of the process parsing the config.
- - -Details at -http://www.squid-cache.org/Versions/v3/3.5/manuals/squidclient.html.
- -The squidclient has begun the process of upgrading to support -protocols other than HTTP.
- -The tool displays the server response message on STDOUT unless the -q -command line option is used. Error messages will be output to STDERR. -All other possible output is considered debug and output to STDERR using -a range of debug verbosity levels (currently 1, 2 and 3).
- -When the -v command line option is used debugging is enabled. -The level of debug display is raised for each repetition of the option.
- -When --ping is given the tool will send its message repeatedly -using whichever protocol that message has been formatted for. -Optional parameters to limit the number of pings and their frequency are -available.
- -Older tool versions also provide this feature but require the loop count -parameter to be set to enable use of the feature.
- -When Squid is built with the GnuTLS encryption library the tool is able -to open TLS (or SSL/3.0) connections to servers.
- -The --https option enables TLS using default values.
- -The --cert option specifies a file containing X.509 client -certificate and private key in PEM format to be loaded for use. Multiple -certificates are supported and the option may be used multiple times to -load certificates. -The default is not to use a client certificate.
- -The --params option specifies a library specific set of parameters -to be sent to the library for configuring the security context. -See -http://gnutls.org/manual/html_node/Priority-Strings.html for -available GnuTLS parameters.
- -The --trusted-ca option specifies a file in PEM format containing -one or more Certificate Authority (CA) certificates used to verify the -remote server. This option may be used multiple times to load additional -CA certificate lists. -The default is not to use any CA, nor trust any server.
- -Anonymous TLS (using non-authenticated Diffi-Hellman or Elliptic Curve -encryption) is available with the --anonymous-tls option. -The default is to use X.509 certificate encryption instead.
- -When performing TLS/SSL server certificates are always verified, the -results shown at debug level 3. The encrypted type is displayed at debug -level 2 and the connection is used to send and receive the messages -regardless of verification results.
- - -Helper concurrency greatly reduces the communication lag between Squid -and its helpers allowing faster transaction speeds even on sequential -helpers.
- -The Digest authentication, Store-ID, and URL-rewrite helpers packaged -with Squid have been updated to support concurrency channels. They will -auto-detect the channel-ID field and will produce the appropriate -response format. -With these helpers concurrency may now be set to 0 or any higher number as desired.
- - -Details at -http://wiki.squid-cache.org/Features/FtpRelay.
- -Squid is now capable of accepting native FTP commands and relaying native -FTP messages between FTP clients and FTP servers. Native FTP commands -accepted at ftp_port are internally converted or wrapped into HTTP-like -messages. The same happens to Native FTP responses received from FTP origin -servers. Those HTTP-like messages are shoveled through regular access -control and adaptation layers between the FTP client and the FTP origin -server. This allows Squid to examine, adapt, block, and log FTP exchanges. -Squid reuses most HTTP mechanisms when shoveling wrapped FTP messages. For -example, http_access and adaptation_access directives are used.
- -FTP Relay is a new, experimental, complex feature that has seen limited -production exposure. Some Squid modules (e.g., caching) do not currently -work with native FTP proxying, and many features have not even been tested -for compatibility. Test well before deploying!
- -Native FTP proxying differs substantially from proxying HTTP requests with -ftp:// URIs because Squid works as an FTP server and receives -actual FTP commands (rather than HTTP requests with FTP URLs).
- -FTP Relay highlights: -
More info at -http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt
- -PROXY protocol provides a simple way for proxies and tunnels of any kind to -relay the original client source details without having to alter or understand -the protocol being relayed on the connection.
- -Squid currently supports receiving HTTP traffic from a client proxy using this protocol. -An http_port which has been configured to receive this protocol may only be used to -receive traffic from client software sending in this protocol. -HTTP traffic without the PROXY header is not accepted on such a port.
- -The accel and intercept options are still used to identify the HTTP -traffic syntax being delivered by the client proxy.
- -Squid can be configured by adding an http_port -with the require-proxy-header mode flag. The proxy_protocol_access -must also be configured with src ACLs to whitelist proxies which are -trusted to send correct client details.
- -Forward-proxy traffic from a client proxy: -
- acl frontend src 192.0.2.1 - http_port 3128 require-proxy-header - proxy_protocol_access allow frontend -- - -
Intercepted traffic from a client proxy or tunnel: -
- acl frontend src 192.0.2.2 - http_port 3128 intercept require-proxy-header - proxy_protocol_access allow frontend -- - -
Reverse-proxy traffic from a frontend load balancer sending PROXY protocol: -
- acl frontend src 192.0.2.3 - http_port 3128 accel require-proxy-header - proxy_protocol_access allow frontend -- - -
Known Issue: -Use of require-proxy-header on https_port and ftp_port is not supported.
- - -The authentication helper previously known as basic_msnt_auth has -been deprecated and renamed to basic_smb_lm_auth to reflect that -it only performs SMB LanMan protocol(s) instead of modern MS authentication -protocols.
- -The basic_smb_lm_auth helper has been remodelled and no longer uses -configuration files. The Doman Controller servers are now configured via -command line parameters and user credentials are looked up in each DC in the -order configured until one matches or all have confirmed a non-match.
- -The MSNT-multi-domain helper provides the same functionality and -is also deprecated. It will be removed in the Squid-3.6 series.
- - - -There have been changes to Squid's configuration file since Squid-3.4.
- -Squid supports reading configuration option parameters from external -files using the syntax parameters("/path/filename"). For example: -
- acl whitelist dstdomain parameters("/etc/squid/whitelist.txt") -- - -
The squid.conf macro ${service_name} is added to provide the service name -of the process parsing the config.
- -There have also been changes to individual directives in the config file.
-This section gives a thorough account of those changes in three categories:
--
-
Ported from Squid-2 with no configuration or visible behaviour changes. -Collapsing of requests is performed across SMP workers.
- -New directive controlling how long to wait for an FTP request on a -client connection to Squid ftp_port.
-Many FTP clients do not deal with idle connection closures well, -necessitating a longer default timeout (30 minutes) than -client_idle_pconn_timeout used for incoming HTTP requests (2 -minutes).
-The current default may be changed as we get more experience with FTP relaying.
- -New configuration directive to accept and relay native FTP -commands. Typically used for port 21 traffic. By default, native -FTP commands are not accepted.
- -New directive to control which clients are permitted to open PROXY -protocol connections on a port flagged with require-proxy-header.
- -New configuration directive to enable/disable sending cached content -based on ACL selection. ACL can be based on client request or cached -response details.
- -New directive to set the hashing algorithm to use when signing generated certificates.
- -New directive which sets the cache size to use for TLS/SSL sessions cache.
- -New directive to specify the time in seconds the TLS/SSL session is valid.
- -New directive to send additional lookup parameters to the configured -Store-ID helper program. It takes a string which may contain logformat %macros.
-The Store-ID helper input format is now: -
- [channel-ID] url [extras] - -- -
The default value for extras is: "%>a/%>A %un %>rm myip=%la myport=%lp"
- -New configuration directive to enable/disable caching of MISS responses. -ACL can be based on any request or response details.
- -New directive to send additional lookup parameters to the configured -URL-rewriter/redirector helper program. It takes a string which may -contain logformat %macros.
-The url rewrite and redirector helper input format is now: -
- [channel-ID] url [extras] - -- -
The default value for extras is: "%>a/%>A %un %>rm myip=%la myport=%lp"
- --
Deprecated type tag. Use type note with 'tag' key -name instead.
-New type adaptation_service to match the name of any -icap_service, ecap_service, adaptation_service_set, or -adaptation_service_chain that Squid has used (or attempted to use) -for the HTTP transaction so far.
-New type at_step to match the current SSL-Bump processing step. -Never matches and should not be used outside of ssl_bump.
-New types ssl::server_name and ssl::server_name_regex -to match server name from various sources (CONNECT authority name, -TLS SNI domain, or X.509 certificate Subject Name).
- -New parameter key_extras to send additional parameters to -the authentication helper.
- -New support for larger than 32KB objects in both rock type -cache and shared memory cache.
-New slot-size=N option for rock cache to specify the database -slot/page size when small slot sizes are desired. The default and -maximum slot size is 32KB.
-Removal of old rock cache dir followed by squid -z is required -when upgrading from earlier versions of Squid.
-COSS storage type is formally replaced by Rock storage type. -COSS storage type and all COSS specific options are removed.
- -New standby=N option to retain a set of N open and unused -connections to the peer at virtually all times to reduce TCP handshake -delays.
-These connections differ from HTTP persistent connections in that they -have not been used for HTTP messaging (and may never be). They may be -turned into persistent connections after their first use subject to the -same keep-alive critera any HTTP connection is checked for.
-Squid-2 option idle= replaced by standby=.
-NOTE that standby connections are started earlier and available in -more circumstances than squid-2 idle connections were. They are -also spread over all IPs of the peer.
- -Regex pattern values cannot be parsed in parts of squid.conf when this -directive is configured to ON. Instead of quoted strings Squid -now accepts regex \-escaped characters (including escaped spaces) in all -regex patterns.
- -New format code %ssl::>sni to send SSL client SNI.
-New format code %ssl::<cert_subject to send SSL server certificate DN.
-New format code %ssl::<cert_issuer to send SSL server certificate issuer DN.
-New format code %un to send any available user name (requires 3.5.7 or later).
-New response kv-pair clt_conn_tag= to associates a given tag with the client TCP connection.
- -Default value increased to 25 destinations to allow better -contact and IPv4 failover with domains using long lists of IPv6 -addresses.
- -Converted into an Access List with allow/deny value driven by ACLs -using Squid standard first line wins matching basis.
-The old values of on and off imply allow all -and deny all respectively and are now deprecated. -Do not combine use of on/off values with ACL configuration.
- -protocol= option altered to accept protocol version details. -Currently supported values are: HTTP, HTTP/1.1, HTTPS, HTTPS/1.1
-New option require-proxy-header to mark ports receiving PROXY -protocol version 1 or 2 traffic.
- -protocol= option altered to accept protocol version details. -Currently supported values are: HTTP, HTTP/1.1, HTTPS, HTTPS/1.1
- -New format code %credentials to log the client credentials token.
-New format code %ssl::>sni to TLS client SNI sent to Squid.
-New format code %tS to log transaction start time in -"seconds.milliseconds" format, similar to the existing access.log -"current time" field (%ts.%03tu) which logs the corresponding -transaction finish time.
-New format codes %<rs and %>rs to log request URL -scheme from client or sent to server/peer respectively.
-New format codes %<rd and %>rd to log request URL -domain from client or sent to server/peer respectively.
-New format codes %<rP and %>rP to log request URL -port from client or sent to server/peer respectively.
- -Bumping 'modes' redesigned as 'actions' and ACLs evaluated repeatedly in a number of steps.
-Renamed server-first as bump action.
-Renamed none as splice action.
-New actions peek and stare to receive client or server -certificate while preserving the ability to later decide between bumping -or splicing the connections later.
-New action terminate to close the client and server connections.
- -New response kv-pair clt_conn_tag= to associates a given tag with the client TCP connection.
- --
DNS external helper interface has been removed. It was no longer -able to provide high performance service and the internal DNS -client library with multicast DNS cover all modern use-cases.
- -DNS external helper interface has been removed.
- -Removed. The old directive values prohibiting CGI and dynamic content -going to cache_peer are no longer relevant.
-The functionality provided by this directive can be configured -using always_direct allow if still needed.
- -There have been some changes to Squid's build configuration since Squid-3.4.
-This section gives an account of those changes in three categories:
--
- - - --
Used when cross-compiling Squid.
-The path and name of a compiler for building cf_gen and related -tools used in the compile process.
- -Used when cross-compiling Squid.
-C++ compiler flags used for building cf_gen and related -tools used in the compile process.
- -New option to explicitly disable use of GnuTLS encryption library. -Use of this library is auto-enabled if v3.1.5 or later is available.
-It is currently only used by the squidclient tool.
- -New option to explicitly disable use of MIT Kerberos library. -Default is to auto-detect and use if possible.
-Only one Kerberos library may be built against.
- -New option to explicitly disable use of Hiemdal Kerberos library. -Default is to auto-detect and use if possible.
-Only one Kerberos library may be built against.
- -New option to explicitly disable use of GNU GSSAPI library for Kerberos. -Default is to auto-detect and use if possible.
-Only one Kerberos library may be built against.
- --
Deprecated. ICAP client is now auto-enabled. -Use --disable-icap-client to disable if you need to.
- --
DNS external helper interface has been removed. It was no longer -able to provide high performance service and the internal DNS -client library with multicast DNS cover all modern use-cases.
- -Removed. Use --with-openssl to enable OpenSSL library support.
- -The COSS cache type has been removed. -It has been replaced by rock cache type.
- -Removed. The Kerberos library is auto-detected now.
-Use --with/--without-mit-krb5, --with/--without-heimdal-krb5, or ---with/--without-gnugss options for specific library selection if necesary.
- -Some squid.conf options which were available in Squid-2.7 are not yet available in Squid-3.5
- -If you need something to do then porting one of these from Squid-2 to Squid-3 is most welcome.
- --
Not yet ported from 2.6
- -monitorinterval= not yet ported from 2.6
-monitorsize= not yet ported from 2.6
-monitortimeout= not yet ported from 2.6
-monitorurl= not yet ported from 2.6
- -Not yet ported from 2.6
- -Not yet ported from 2.6
- -Not yet ported from 2.7
- -Not yet ported from 2.6
- -Not yet ported from 2.6
- -Not yet ported from 2.6
- -Not yet ported from 2.6
- -stale-while-revalidate= not yet ported from 2.7
-ignore-stale-while-revalidate= not yet ported from 2.7
-negative-ttl= not yet ported from 2.7
- -Not yet ported from 2.7
- -Not yet ported from 2.7
- -Copyright (C) 1996-2015 The Squid Software Foundation and contributors
-Squid software is distributed under GPLv2+ license and includes -contributions from numerous individuals and organizations. -Please see the COPYING and CONTRIBUTORS files for details.
- - - diff --git a/mksnapshot.sh b/mksnapshot.sh index e9e0168487..c08d70951f 100755 --- a/mksnapshot.sh +++ b/mksnapshot.sh @@ -94,7 +94,12 @@ if [ -f ${tmpdir}/${PACKAGE}-${VERSION}-${suffix}.diff ]; then echo ${PACKAGE}-${VERSION}-${suffix}.diff >>${tag}.out fi -relnotes=${tmpdir}/doc/release-notes/release-`echo ${VERSION} | cut -d. -f1,2 | cut -d- -f1`.html +# latest Squid 'make' builds a RELEASENOTES.html at top directory +relnotes=${tmpdir}/RELEASENOTES.html +if [ ! -f ${relnotes} ]; then + # for older Squid-3.x versions we may need to move find the release notes by version + relnotes=${tmpdir}/doc/release-notes/release-`echo ${VERSION} | cut -d. -f1,2 | cut -d- -f1`.html +fi if [ -f ${relnotes} ]; then cp -p ${relnotes} ${PACKAGE}-${VERSION}-${suffix}-RELEASENOTES.html echo ${PACKAGE}-${VERSION}-${suffix}-RELEASENOTES.html >>${tag}.out