From d99a9e47ba552b46a7ee25bec81a81925ccf7707 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Tue, 14 Aug 2012 21:22:50 -0600 Subject: [PATCH] 3.2.1 --- configure.ac | 2 +- doc/release-notes/release-3.2.html | 51 ++++++++++++++---------------- 2 files changed, 24 insertions(+), 29 deletions(-) diff --git a/configure.ac b/configure.ac index 2af17fabbf..e8b26394be 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl $Id$ dnl dnl dnl -AC_INIT([Squid Web Proxy],[3.2.0.19-BZR],[http://www.squid-cache.org/bugs/],[squid]) +AC_INIT([Squid Web Proxy],[3.2.1-BZR],[http://www.squid-cache.org/bugs/],[squid]) AC_PREREQ(2.61) AC_CONFIG_HEADERS([include/autoconf.h]) AC_CONFIG_AUX_DIR(cfgaux) diff --git a/doc/release-notes/release-3.2.html b/doc/release-notes/release-3.2.html index 3d0cbf7be0..34802d0c18 100644 --- a/doc/release-notes/release-3.2.html +++ b/doc/release-notes/release-3.2.html @@ -2,10 +2,10 @@ - Squid 3.2.0.19 release notes + Squid 3.2.1 release notes -

Squid 3.2.0.19 release notes

Squid 3.2.1 release notes

Squid Developers

@@ -67,13 +67,12 @@ for Applied Network Research and members of the Web Caching community.

6.1 Missing squid.conf options available in Squid-2.7 -
6.2 Missing ./configure options available in Squid-2.7

1. Notice

The Squid Team are pleased to announce the release of Squid-3.2.0.19 for testing.

The Squid Team are pleased to announce the release of Squid-3.2.1 for testing.

This new release is available for download from http://www.squid-cache.org/Versions/v3/3.2/ or the mirrors.

@@ -91,8 +90,9 @@ report with a stack trace.

Some issues to note as currently known in this release which are not able to be fixed in the 3.2 series are:

CVE-2009-0801 : interception proxies cannot relay certain requests to peers safely. see the CVE section below for details.
TCP logging of access.log does not recover from broken connections well.
SSL-Bump not re-wrapping decrypted traffic in CONNECT for peers.
Cache Manager reports in txt/plain format even when requested directly via browser.

@@ -154,14 +154,14 @@ by the directive. Squid will respond with 409 Conflict error response when strict validation fails and handles the request normally when strict validation succeeds or is OFF (default).

Relaying of messages which FAIL non-strct Host: validation are permitted through Squid but -only to the original destination IP the client was requesting. This means interception proxies -can not be used as feeder gateways into a cluster or peer hierarchy without strict validation.

Relaying of messages which FAIL non-strict Host: validation are permitted through Squid but +only to the original destination IP the client was requesting or to explicit peers. This means +DNS lookups to locate alternative DIRECT destinations will not be done.

Known Issue: When non-strict validation fails Squid will relay the request, but can only do so safely to the orginal destination IP the client was contacting. The client original -destinatio IP is lost when relayign to peers in a hierarchy. This means the upstream peers -are at risk of cache poisoning from CVE-2009-0801 vulnerability. +destination IP is lost when relaying to peers in a hierarchy. This means the upstream peers +are still at risk of causing same-origin bypass CVE-2009-0801 vulnerability. Developer time is required to implement safe transit of these requests. Please contact squid-dev if you are able to assist or sponsor the development.

@@ -1101,9 +1101,18 @@ An external_acl_type helper may be used to bypass authentication if that is suit

acl: +
urlgroup type removed. Use myportname type instead.
+
cache_dir: read-only option replaced by no-store.
+
http_port: +
urlgroup= removed. Use name= feature instead.
+ +
zero_buffers: +
Replaced by native support.
+

@@ -1160,6 +1169,9 @@ An external_acl_type helper may be used to bypass authentication if that is suit

--disable-kqueue

Obsolete. Disabled by default.

--without-system-md5

Obsolete. Disabled by default.

@@ -1212,9 +1224,6 @@ An external_acl_type helper may be used to bypass authentication if that is suit

external_refresh_check

Not yet ported from 2.7

http_port

urlgroup= not yet ported from 2.6

ignore_ims_on_miss

Not yet ported from 2.7

@@ -1251,23 +1260,9 @@ An external_acl_type helper may be used to bypass authentication if that is suit

Not yet ported from 2.7

update_headers

Not yet ported from 2.7

- -

zero_buffers

Not yet ported from 2.7

- - -

- -

6.2 Missing ./configure options available in Squid-2.7 -

- -

--without-system-md5: +
Not yet fully ported from 2.7. Memory and rock storage caches support this natively. UFS caches do not support it.

- -- 2.47.2