5.7 (#1133)

diff --git a/ChangeLog b/ChangeLog
index f42c6d10893248cd17d957fd55ab107bdc36b372..49174d44b8255cd121887aac5b3223f9a53e6705 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+Changes in squid-5.7 (05 Sep 2022):
+
+       - Regression Fix: Typo in manager ACL
+       - Bug 5186: noteDestinationsEnd check failed: transportWait
+       - Bug 5160: Test suite fails with -flto=auto
+       - Bug 3193 pt2: NTLM decoder truncating strings
+       - Bug 5133: OpenSSL 3.0 support
+       - ext_session_acl: fix TDB key lookup
+       - forward_max_tries: Do not count discarded connections
+       - ... and many compile and debugging fixes
+
 Changes in squid-5.6 (06 Jun 2022):
 
        - Bug 5208: Part 1: Restart kids killed by SIGKILL

diff --git a/configure.ac b/configure.ac
index dcfb59043bfba93dfe9f97df0678104dbe24104e..2087a8d9be4cc7e07250c3d2818de96b7abda25e 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -5,7 +5,7 @@
 ## Please see the COPYING and CONTRIBUTORS files for details.
 ##
 
-AC_INIT([Squid Web Proxy],[5.6-VCS],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[5.7-VCS],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)

diff --git a/doc/release-notes/release-5.sgml b/doc/release-notes/release-5.sgml
index 2dd410f475201a04d033fd9a05df438599255648..940449fe50a796c071afe2d92d4d3b1aea4b7d84 100644 (file)
--- a/doc/release-notes/release-5.sgml
+++ b/doc/release-notes/release-5.sgml
@@ -1,6 +1,6 @@
 <!doctype linuxdoc system>
 <article>
-<title>Squid 5.6 release notes</title>
+<title>Squid 5.7 release notes</title>
 <author>Squid Developers</author>
 
 <abstract>
@@ -12,7 +12,7 @@ for Applied Network Research and members of the Web Caching community.
 <toc>
 
 <sect>Notice
-<p>The Squid Team are pleased to announce the release of Squid-5.6.
+<p>The Squid Team are pleased to announce the release of Squid-5.7.
 
 This new release is available for download from <url url="http://www.squid-cache.org/Versions/v5/"> or the
  <url url="http://www.squid-cache.org/Download/http-mirrors.html" name="mirrors">.
@@ -40,6 +40,7 @@ The Squid-5 change history can be <url url="http://www.squid-cache.org/Versions/
        <item>TrivialDB Support
        <item>RFC 8586: Loop Detection in Content Delivery Networks
        <item>Peering support for SSL-Bump
+       <item>OpenSSL 3.0 Support
 </itemize>
 
 Most user-facing changes are reflected in squid.conf (see below).
@@ -151,6 +152,19 @@ Most user-facing changes are reflected in squid.conf (see below).
    yet do TLS-in-TLS.
 
 
+<sect1>OpenSSL 3.0 Support
+<p>Squid-5.7 adds OpenSSL 3.0 support.
+
+<p>This version of Squid does not add any of the new features provided by
+   OpenSSL 3.0. It only contains support for features already supported by prior
+   versions of Squid using new APIs provided by OpenSSL 3.0.
+
+<p>Notably the libssl custom Engine feature has been deprecated by OpenSSL 3.0
+   and new Providers replacement is not supported by this Squid.
+
+<p>OpenSSL 3.0 uses new licensing terms.
+
+
 <sect>Changes to squid.conf since Squid-4
 <p>
 There have been changes to Squid's configuration file since Squid-4.
@@ -287,6 +301,10 @@ This section gives a thorough account of those changes in three categories:
        <p>Codes <em>rm</em>, <em>&lt;rm</em> and <em>&gt;rm</em> display "-"
           instead of the made-up method NONE.
 
+       <tag>ssl_engine</tag>
+       <p>OpenSSL 3.0 deprecates the Engine feature. This directive is
+          only supported when Squid is built for older OpenSSL versions.
+
 </descrip>
 
 <sect1>Removed directives<label id="removeddirectives">

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 9b744715b36bec975df2f9147e971fbde5b93c6b..ee8c7206ce851e321cb158d691e303e9a8faafea 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -3050,7 +3050,7 @@ DOC_START
        The OpenSSL engine to use. You will need to set this if you
        would like to use hardware SSL acceleration for example.
 
-       Not supported in builds with OpenSSL v3 or newer.
+       Not supported in builds with OpenSSL 3.0 or newer.
 DOC_END
 
 NAME: sslproxy_session_ttl

diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc
index 4897692bb316e8d51f1444a9e0d8af47e8ab2538..a5ddb43acb373d4bc6ade806682fdc8c040cf132 100644 (file)
--- a/src/security/ServerOptions.cc
+++ b/src/security/ServerOptions.cc
@@ -424,11 +424,13 @@ Security::ServerOptions::loadDhParams()
                     case -2: {
                         auto ssl_error = ERR_get_error();
                         debugs(83, DBG_PARSE_NOTE(2), "WARNING: OpenSSL does not support " << type << " parameters check: " << dhParamsFile << ". " << Security::ErrorString(ssl_error));
-                        } break;
+                    }
+                    break;
                     default: {
                         auto ssl_error = ERR_get_error();
                         debugs(83, DBG_IMPORTANT, "ERROR: Failed to verify " << type << " parameters in " << dhParamsFile << ". " << Security::ErrorString(ssl_error));
-                        } break;
+                    }
+                    break;
                     }
                 } else {
                     // TODO: Reduce error reporting code duplication.

diff --git a/src/ssl/support.cc b/src/ssl/support.cc
index 2cfb8b3ba8d7e50f522201c9b3438a65e71f5c68..40c1e324e39408283a262e8a20d075ce1db0ff34 100644 (file)
--- a/src/ssl/support.cc
+++ b/src/ssl/support.cc
@@ -660,9 +660,9 @@ Ssl::Initialize(void)
 
     if (::Config.SSL.ssl_engine) {
 #if OPENSSL_VERSION_MAJOR < 3
-    debugs(83, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Support for ssl_engine is deprecated " <<
-           "in Squids built with OpenSSL v1 (like this Squid). " <<
-           "It is removed in Squids built with OpenSSL v3+.");
+        debugs(83, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Support for ssl_engine is deprecated " <<
+               "in Squids built with OpenSSL 1.x (like this Squid). " <<
+               "It is removed in Squids built with OpenSSL 3.0 or newer.");
 #if !defined(OPENSSL_NO_ENGINE)
         ENGINE_load_builtin_engines();
         ENGINE *e;
@@ -678,7 +678,7 @@ Ssl::Initialize(void)
 #endif
 
 #else /* OPENSSL_VERSION_MAJOR */
-        throw TextException("Cannot use ssl_engine in Squid built with OpenSSL v3+", Here());
+        throw TextException("Cannot use ssl_engine in Squid built with OpenSSL 3.0 or newer", Here());
 #endif
     }