Squid 3.1.12 release notes

2.8 Dynamic SSL Certificate Generation +

Squid certificate is not signed by a trusted authority.

Squid certificate name does not match the site domain name.

2.11 ICY streaming protocol support

Squid-3.1 adds native support for streaming protocol ICY. @@ -1047,6 +1071,12 @@ NOCOMMENT_START

sslcrtd_program

Specify the location and options of the executable for ssl_crtd process.

+ +

sslcrtd_children

Configures the number of sslcrtd processes to spawn

sslproxy_cert_error

New Access Control to selectively bypass server certificate validation errors. DEFAULT: None bypassed. @@ -1575,6 +1605,10 @@ Cannot be used with --disable-loadable-modules.

original or indirect client when a request has been forwarded through other proxies.

--enable-ssl-crtd

Prevent Squid from direct generation of SSL private key and +certificate request and instead enables the ssl_crtd processes.

--enable-zph-qos

Build with support for ZPH Quality of Service controls

diff --git a/doc/release-notes/release-3.1.sgml b/doc/release-notes/release-3.1.sgml index 8439638b94..c8719ed817 100644 --- a/doc/release-notes/release-3.1.sgml +++ b/doc/release-notes/release-3.1.sgml @@ -1,6 +1,6 @@

-Squid 3.1.12 release notes +Squid 3.1.12.1 release notes Squid Developers @@ -13,7 +13,7 @@ for Applied Network Research and members of the Web Caching community. Notice

-The Squid Team are pleased to announce the release of Squid-3.1.12 +The Squid Team are pleased to announce the release of Squid-3.1.12.1 This new release is available for download from or the . @@ -62,6 +62,7 @@ The most important of these new features are: eCAP Adaptation Module support ICAP Bypass and Retry enhancements ICY streaming protocol support + Dynamic SSL Certificate Generation (3.1.12.1 and later) Most user-facing changes are reflected in squid.conf (see below). @@ -287,6 +288,25 @@ Microsoft NTLM Authentication instead of HTTP standard authentication through a configuration. Use of interception for port 443 is not officially supported, despite being known to work under certain limited networking circumstances. + Dynamic SSL Certificate Generation +

SslBump users know how many certificate warnings a single complex site +(using dedicated image, style, and/or advertisement servers for embedded content) +can generate. The warnings are legitimate and are caused by Squid-provided site +certificate. Two things may be wrong with that certificate: + + Squid certificate is not signed by a trusted authority. + Squid certificate name does not match the site domain name. + +Squid can do nothing about (A), but in most targeted environments, users will +trust the "man in the middle" authority and install the corresponding root +certificate. + +

To avoid mismatch (B), the DynamicSslCert feature concentrates on generating +site certificates that match the requested site domain name. Please note that +the browser site name check does not really add much security in an SslBump +environment where the user already trusts the "man in the middle". The check +only adds warnings and creates page rendering problems in browsers that try to +reduce the number of warnings by blocking some embedded content. eCAP Adaptation Module support @@ -894,6 +914,12 @@ NOCOMMENT_START # ssl_bump allow all + sslcrtd_program +

Specify the location and options of the executable for ssl_crtd process. + + sslcrtd_children +

Configures the number of sslcrtd processes to spawn + sslproxy_cert_error

New Access Control to selectively bypass server certificate validation errors. DEFAULT: None bypassed. @@ -1379,6 +1405,10 @@ This section gives an account of those changes in three categories: original or indirect client when a request has been forwarded through other proxies. + --enable-ssl-crtd +

Prevent Squid from direct generation of SSL private key and + certificate request and instead enables the ssl_crtd processes. + --enable-zph-qos

Build with support for ZPH Quality of Service controls diff --git a/src/cf.data.pre b/src/cf.data.pre index ace7a45fa2..d329774863 100644 --- a/src/cf.data.pre +++ b/src/cf.data.pre @@ -3743,10 +3743,10 @@ IFDEF: FOLLOW_X_FORWARDED_FOR&&ICAP_CLIENT DEFAULT: on LOC: Adaptation::Icap::TheConfig.icap_uses_indirect_client DOC_START - Controls whether the indirect client address - (see follow_x_forwarded_for) instead of the - direct client address is passed to an ICAP - server as "X-Client-IP". + Controls whether the indirect client IP address (instead of the direct + client IP address) is passed to adaptation services. + + See also: follow_x_forwarded_for adaptation_send_client_ip DOC_END NAME: via @@ -4523,7 +4523,7 @@ delay_parameters pool aggregate network individual user For a class 5 delay pool: -delay_parameters pool tag +delay_parameters pool tagrate The variables here are: @@ -4531,19 +4531,19 @@ delay_parameters pool tag number specified in delay_pools as used in delay_class lines. - aggregate the "delay parameters" for the aggregate bucket + aggregate the speed limit parameters for the aggregate bucket (class 1, 2, 3). - individual the "delay parameters" for the individual + individual the speed limit parameters for the individual buckets (class 2, 3). - network the "delay parameters" for the network buckets + network the speed limit parameters for the network buckets (class 3). - user the delay parameters for the user buckets + user the speed limit parameters for the user buckets (class 4). - tag the delay parameters for the tag buckets + tagrate the speed limit parameters for the tag buckets (class 5). A pair of delay parameters is written restore/maximum, where restore is @@ -5852,7 +5852,11 @@ COMMENT: on|off LOC: Adaptation::Icap::TheConfig.send_client_ip DEFAULT: off DOC_START - This adds the header "X-Client-IP" to ICAP requests. + If enabled, Squid shares HTTP client IP information with adaptation + services. For ICAP, Squid adds the X-Client-IP header to ICAP requests. + For eCAP, Squid sets the libecap::metaClientIp transaction option. + + See also: adaptation_uses_indirect_client DOC_END NAME: icap_send_client_username

Squid 3.1.12 release notes

Squid 3.1.12.1 release notes

Squid Developers

3. Changes to squid.conf since Squid-3.0

1. Notice

2.8 Dynamic SSL Certificate Generation +

2.9 eCAP Adaptation Module support

2.9 ICAP Bypass and Retry enhancements +

2.10 ICAP Bypass and Retry enhancements

2.10 ICY streaming protocol support +

2.11 ICY streaming protocol support