Squid 3.2.0.17 release notes

-Squid 3.2.0.17 release notes +Squid 3.2.0.18 release notes Squid Developers @@ -13,7 +13,7 @@ for Applied Network Research and members of the Web Caching community. Notice

-The Squid Team are pleased to announce the release of Squid-3.2.0.17 for testing. +The Squid Team are pleased to announce the release of Squid-3.2.0.18 for testing. This new release is available for download from or the . @@ -26,6 +26,17 @@ report with a stack trace.

Although this release is deemed good enough for use in many setups, please note the existence of . +

Currently known issues which only depends on available developer time and may still be resolved in a future 3.2 release are: + + + CVE-2009-0801 : interception proxies cannot relay certain requests to peers. see the CVE section below for details. + SMP Support still has a number of important bugs needing to be resolved. see the bugs list above for details. + Windows support is still incomplete. + TCP logging of access.log does not recover from broken connections well. + The lack of some features available in Squid-2.x series. See the regression sections below for full details. + + + Changes since earlier releases of Squid-3.2

The 3.2 change history can be . @@ -41,7 +52,7 @@ The 3.2 change history can be + directive. Squid will respond with 409 Conflict error response when strict validation + fails and handles the request normally when strict validation succeeds or is OFF (default). + +

Relaying of messages which FAIL non-strct Host: validation are permitted through Squid but + only to the original destination IP the client was requesting. This means interception proxies + can not be used as feeder gateways into a cluster or peer hierarchy without strict validation. + +

Known Issue: When non-strict validation fails Squid will relay the request, but can only do + so to the orginal destination IP the client was contacting. This means that interception + proxy Squid are unable to pass traffic reliably to peers in a cache hierarchy. + Developer time is required to implement safe transit of these requests. + Please contact squid-dev if you are able to assist or sponsor the development. NCSA helper DES algorithm password limits @@ -327,6 +350,9 @@ Most user-facing changes are reflected in squid.conf (see below). These logs are now created using an access_log line with the format "referrer" or "useragent". They also now log all client requests, if there was no Referer or User-Agent header a dash (-) is logged. +

Known Issue: The TCP logging module does not recover from broken connections well. + At present it will restart the affected Squid instance if the TCP connection is broken. + Client Bandwidth Limits

In mobile environments, Squid may need to limit Squid-to-client bandwidth @@ -362,6 +388,9 @@ Most user-facing changes are reflected in squid.conf (see below).

Support for libecap version 0.2.0 has been added with this series of Squid. Bringing better support for body handling, and logging. +

Known Issue: Due to API changes in libecap this release of Squid will not build + against any older libecap releases. + Cache Manager access changes

The Squid Cache Manager has previously only been accessible under the cache_object:// @@ -470,6 +499,14 @@ This section gives a thorough account of those changes in three categories: eui_lookup

Whether to lookup the EUI or MAC address of a connected client. + host_verify_strict +

New option to enable super-strict HTTP and DNS information match. + Ensuring the HTTP URI details, DNS records, and TCP connection layers all match in a + three-legged security verification. Preventing domain hijacking or malicious poisoning + attacks by malicious scripts. +

The default is to verify only intercepted traffic, to log all issues and let failed + traffic through when doing so can be done safely. + icap_206_enable

New option to toggle whether the ICAP 206 (Partial Content) responses extension. Default is on. @@ -557,6 +594,7 @@ This section gives a thorough account of those changes in three categories: idle=N determines how many helper to retain as buffer against sudden traffic loads. concurrency=N previously called auth_param ... concurrency as a separate option.

Removed Basic, Digest, NTLM, Negotiate auth_param ... concurrency setting option. +

Known Issue: NTLM and Negotiate protocols do not support concurrency. When set this option is ignored. cache_dir

min-size option ported from Squid-2

Squid 3.2.0.17 release notes

Squid 3.2.0.18 release notes

Squid Developers

3. Changes to squid.conf since Squid-3.1

1. Notice

1.2 Changes since earlier releases of Squid-3.2

2.2 NCSA helper DES algorithm password limits -

2.3 SMP scalability +

2.2 SMP scalability

2.4 Helper Multiplexer +

2.3 Helper Multiplexer

2.5 Helpers On-Demand +

2.4 Helpers On-Demand

2.6 Helper Name Changes +

2.5 Helper Name Changes

2.7 Multi-Lingual manuals +

2.6 Multi-Lingual manuals

2.8 Solaris 10 pthreads Support (Experimental) +

2.7 Solaris 10 pthreads Support (Experimental)

2.9 Surrogate/1.0 protocol extensions to HTTP +

2.8 Surrogate/1.0 protocol extensions to HTTP

2.10 Logging Infrastructure Updated +

2.9 Logging Infrastructure Updated

2.11 Client Bandwidth Limits + +

2.10 Client Bandwidth Limits

2.12 Better eCAP Suport +

2.11 Better eCAP Suport

2.13 Cache Manager access changes +

2.12 Cache Manager access changes