From: Amos Jeffries Date: Tue, 14 Jan 2020 03:56:20 +0000 (+0000) Subject: Prep for v4.10 and v5.0.1 (#538) X-Git-Tag: 4.15-20210522-snapshot~175 X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=755eac9438614e4acadae7d7d6dc727ecdc40865;p=thirdparty%2Fsquid.git Prep for v4.10 and v5.0.1 (#538) --- diff --git a/ChangeLog b/ChangeLog index c6271c85fb..2bff5d7e51 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,64 @@ +Changes in squid-5.0.1 (14 Jan 2020): + + - Bug 4989: Leaking StoreEntry objects on Cache Digest rebuilds + - Bug 4912: same-name notes being appended instead of replaced + - Bug 4864: !Comm::MonitorsRead assertion in maybeReadVirginBody() + - Bug 4579: cannot hit an entry being written by another worker + - ICAP: Initial support for trailers + - Add auth_schemes to control schemes presence and order in 401s/407s + - Make CONNECT ACL a built-in default + - Remove USE_CHUNKEDMEMPOOLS compiler flag + - Two new ACLs implemented: annotate_transaction and annotate_client + - Add response delay pools feature for Squid-to-client speed limiting + - QA: allow test-suite to be run without a full build + - Happy Eyeballs: Use each fully resolved forwarding destination ASAP + - Support selective CF: collapsed_forwarding_access + - Reworked packet/connection marking + - Add new deny_info %A macro + - Identify collapsed transactions + - Add sample Kerberos group authentication external_acl helper + - Optimization: Fewer memory (re)allocations for HTTP headers + - Add TrivialDB support + - Do not send Content-Length in 1xx or 204 responses + - negotiate_kerberos_auth: fix memory leaks + - ntlm_fake_auth: add ability to test delayed responses + - Add %ssl::
-Squid 4.9 release notes +Squid 4.10 release notes Squid Developers @@ -12,7 +12,7 @@ for Applied Network Research and members of the Web Caching community. Notice -

The Squid Team are pleased to announce the release of Squid-4.9 for testing. +

The Squid Team are pleased to announce the release of Squid-4.10. This new release is available for download from or the . diff --git a/doc/release-notes/release-5.sgml b/doc/release-notes/release-5.sgml index f6603742c7..a1db7ed05a 100644 --- a/doc/release-notes/release-5.sgml +++ b/doc/release-notes/release-5.sgml @@ -1,6 +1,6 @@

-Squid 5.0.0 release notes +Squid 5.0.1 release notes Squid Developers @@ -12,7 +12,7 @@ for Applied Network Research and members of the Web Caching community. Notice -

The Squid Team are pleased to announce the release of Squid-5.0.0 for testing. +

The Squid Team are pleased to announce the release of Squid-5.0.1 for testing. This new release is available for download from or the . @@ -40,6 +40,8 @@ The Squid-5 change history can be + +

Squid now uses the CDN-Loop header as a source for loop detection. + +

This header is only relevant to CDN installations. For which the + surrogate_id configuration directive specifies the authoritative + ID. + +

Squid does not add this header by default, preferring to use the + Via mechanism instead. Administrators may add it to requests + with the request_header_add directive or remove with + request_header_remove. + + +Peering support for SSL-Bump +

Squid now supports forwarding of bumped, re-encrypted HTTPS requests through + a cache_peer using a standard HTTP CONNECT tunnel. + +

No support for triggering client authentication when a cache_peer + configuration instructs the bumping Squid to relay authentication info + contained in client CONNECT request. The bumping Squid still responds + with HTTP 200 (Connection Established) to the client CONNECT request (to + see TLS client handshake) before selecting the cache_peer. + +

HTTPS cache_peers are not yet supported primarily because Squid cannot + yet do TLS-in-TLS. + + Changes to squid.conf since Squid-4

There have been changes to Squid's configuration file since Squid-4. @@ -147,6 +178,19 @@ This section gives a thorough account of those changes in three categories:

New access control to restrict collapsed forwarding to a subset of eligible HTTP, ICP and HTCP requests. + happy_eyeballs_connect_gap +

New directive to specify the minimum delay between opening spare + connections to any server. + + happy_eyeballs_connect_limit +

New directive to specify the maximum number of spare connections + to any server. + + happy_eyeballs_connect_timeout +

New directive to specify the minimum delay between opening a + primary to-server connection and opening a spare to-server + connection for the same transaction. + mark_client_connection

New access control to apply a Netfilter CONNMARK value to a TCP client connection. @@ -164,6 +208,9 @@ This section gives a thorough account of those changes in three categories:

New access control to determines whether a specific named response delay pool is used for the HTTP transaction. + shared_transient_entries_limit +

Replacement for collapsed_forwarding_shared_entries_limit. + Changes to existing directives

New annotate_transaction type to annotate an HTTP transaction. Annotations can be used by other ACLs or helpers and persist until logging of the HTTP transaction is completed. +

New value GeneratingCONNECT for the at_step type to + match when Squid is about to send a CONNECT request to a cache peer.

Replaced clientside_mark with client_connection_mark type to match Netfilter CONNMARK of the client TCP connection. + auth_param +

New reservation-timeout= option to allow NTLM and Negotiate + helpers to forget about clients with outstanding authentication + requests. +

Added support for CP1251 charset conversion when utf8 option + is configured. + + authenticate_cache_garbage_interval +

Now disabled when --disable-auth build parameter is used. + + authenticate_ttl +

Now disabled when --disable-auth build parameter is used. + + authenticate_ip_ttl +

Now disabled when --disable-auth build parameter is used. + deny_info

New code %A to display Squid listening IP address the client TCP connection was connected to. @@ -187,8 +252,14 @@ This section gives a thorough account of those changes in three categories: logformat

New ssl::<cert macro code to display received server X.509 certificate in PEM format. +

New proxy_protocol::>h code to display received PROXY + protocol version 2 TLV values. +

New master_xaction code to display Squids internal + transaction ID.

New CF value for %Ss code to indicate the response was handled by Collapsed Forwarding. +

Codes rm, <rm and >rm display "-" + instead of the made-up method NONE. @@ -198,6 +269,9 @@ This section gives a thorough account of those changes in three categories: clientside_mark

Replaced by mark_client_packet. + collapsed_forwarding_shared_entries_limit +

Replaced by shared_transient_entries_limit. + dns_v4_first

Removed. The new "Happy Eyeballs" algorithm uses received IP addresses as soon as they are needed.