The Squid Team are pleased to announce the release of Squid-3.2.1 for testing.
+The Squid Team are pleased to announce the release of Squid-3.2.2 for testing.
This new release is available for download from http://www.squid-cache.org/Versions/v3/3.2/ or the mirrors.
@@ -404,7 +404,7 @@ versions and beginning with 3.2 they are available in languages other than English (where translated).Details in -The Squid wiki
+The Squid wiki3.1 began the Internationalization of Squid with the public facing error pages. This move begins the Localization of the internal administrator facing manuals.
@@ -458,7 +458,8 @@ direct filesystem logging (stdio, daemon) to network logging (syslog, UDP and TCP). The daemon logging interface allows for a custom helper to be written to process logs in real-time. -Upgrading: the access_log was previously logged via what is now called the stdio module. +
Upgrading: the access_log and cache_store_log were previously logged via what is +now called the stdio module. This is still supported and used by default if no module is named. For best performance particularly in SMP environments we recommend the daemon be used. The provided log_file_daemon helper performs the traditional logging to local filesystem.
@@ -470,8 +471,8 @@ logging a single cache.log at relatively high debug levels on a high-traffic system. Or one which is required to store a long period of access.log and needs to conserve disk space. -The referer_log and useragent_log directives have been converted to built-in log formats. -These logs are now created using an access_log line with the format "referrer" or "useragent". +
The referer_log and useragent_log directives have been converted to built-in log formats. +These logs are now created using an access_log line with the format "referrer" or "useragent". They also now log all client requests, if there was no Referer or User-Agent header a dash (-) is logged.
Known Issue: The TCP logging module does not recover from broken connections well. @@ -748,6 +749,10 @@
htcp-* options collapsed into htcp= taking an optional comma-separated list of flags. The old form is deprecated but still accepted.
+Now uses logging modules. Example: stdio:/file/path +see access_log for a list of supported modules and their parameters.
+New configuration parameter clientside_mark
Allows packets leaving Squid on the client side to be marked with a Netfilter mark value in the same way as the existing clientside_tos feature.
diff -u -r -N squid-3.2.1/src/acl/DomainData.cc squid-3.2.2/src/acl/DomainData.cc --- squid-3.2.1/src/acl/DomainData.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/acl/DomainData.cc 2012-10-06 15:08:36.000000000 +1200 @@ -98,16 +98,24 @@ if (ret == 0) { // When a.example.com comes after .example.com in an ACL // sub-domain is ignored. That is okay. Just important - debugs(28, DBG_IMPORTANT, "WARNING: '" << d3 << "' is a subdomain of '" << d4 << "'"); - debugs(28, DBG_IMPORTANT, "WARNING: because of this '" << d3 << "' is ignored to keep splay tree searching predictable"); - debugs(28, DBG_IMPORTANT, "WARNING: You should remove '" << (*d3=='.'?d4:d3) << "' from the ACL named '" << AclMatchedName << "'"); + bool d3big = (strlen(d3) > strlen(d4)); // Always suggest removing the longer one. + debugs(28, DBG_IMPORTANT, "WARNING: '" << (d3big?d3:d4) << "' is a subdomain of '" << (d3big?d4:d3) << "'"); + debugs(28, DBG_IMPORTANT, "WARNING: You should remove '" << (d3big?d3:d4) << "' from the ACL named '" << AclMatchedName << "'"); + debugs(28, 2, HERE << "Ignore '" << d3 << "' to keep splay tree searching predictable"); } } else if (ret == 0) { + // It may be an exact duplicate. No problem. Just drop. + if (strcmp(d1,d2)==0) { + debugs(28, 2, "WARNING: '" << d2 << "' is duplicated in the list."); + debugs(28, 2, "WARNING: You should remove one '" << d2 << "' from the ACL named '" << AclMatchedName << "'"); + return ret; + } // When a.example.com comes before .example.com in an ACL // discarding the wildcard is critically bad. - debugs(28, DBG_CRITICAL, "ERROR: '" << d1 << "' is a subdomain of '" << d2 << "'"); - debugs(28, DBG_CRITICAL, "ERROR: because of this '" << d2 << "' is ignored to keep splay tree searching predictable"); - debugs(28, DBG_CRITICAL, "ERROR: You should remove '" << (*d1=='.'?d2:d1) << "' from the ACL named '" << AclMatchedName << "'"); + // or Maybe even both are wildcards. Things are very weird in those cases. + bool d1big = (strlen(d1) > strlen(d2)); // Always suggest removing the longer one. + debugs(28, DBG_CRITICAL, "ERROR: '" << (d1big?d1:d2) << "' is a subdomain of '" << (d1big?d2:d1) << "'"); + debugs(28, DBG_CRITICAL, "ERROR: You need to remove '" << (d1big?d1:d2) << "' from the ACL named '" << AclMatchedName << "'"); self_destruct(); } diff -u -r -N squid-3.2.1/src/acl/FilledChecklist.cc squid-3.2.2/src/acl/FilledChecklist.cc --- squid-3.2.1/src/acl/FilledChecklist.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/acl/FilledChecklist.cc 2012-10-06 15:08:36.000000000 +1200 @@ -110,6 +110,8 @@ void ACLFilledChecklist::conn(ConnStateData *aConn) { + if (conn() == aConn) + return; assert (conn() == NULL); conn_ = cbdataReference(aConn); } @@ -205,6 +207,9 @@ #endif /* FOLLOW_X_FORWARDED_FOR */ src_addr = request->client_addr; my_addr = request->my_addr; + + if (request->clientConnectionManager.valid()) + conn(request->clientConnectionManager.get()); } #if USE_IDENT diff -u -r -N squid-3.2.1/src/acl/FilledChecklist.h squid-3.2.2/src/acl/FilledChecklist.h --- squid-3.2.1/src/acl/FilledChecklist.h 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/acl/FilledChecklist.h 2012-10-06 15:08:36.000000000 +1200 @@ -23,14 +23,15 @@ ~ACLFilledChecklist(); public: + /// The client connection manager ConnStateData * conn() const; - /// uses conn() if available + /// The client side fd. It uses conn() if available int fd() const; /// set either conn void conn(ConnStateData *); - /// set FD + /// set the client side FD void fd(int aDescriptor); //int authenticated(); diff -u -r -N squid-3.2.1/src/acl/Ip.cc squid-3.2.2/src/acl/Ip.cc --- squid-3.2.1/src/acl/Ip.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/acl/Ip.cc 2012-10-06 15:08:36.000000000 +1200 @@ -471,6 +471,7 @@ /* ignore IPv6 addresses when built with IPv4-only */ if ( iptype == AF_INET6 && !Ip::EnableIpv6) { debugs(28, DBG_IMPORTANT, "aclIpParseIpData: IPv6 has not been enabled."); + delete q; return NULL; } diff -u -r -N squid-3.2.1/src/auth/negotiate/UserRequest.cc squid-3.2.2/src/auth/negotiate/UserRequest.cc --- squid-3.2.1/src/auth/negotiate/UserRequest.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/auth/negotiate/UserRequest.cc 2012-10-06 15:08:36.000000000 +1200 @@ -365,7 +365,10 @@ fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply); } - lm_request->request = NULL; + if (lm_request->request) { + HTTPMSGUNLOCK(lm_request->request); + lm_request->request = NULL; + } r->handler(r->data); delete r; } diff -u -r -N squid-3.2.1/src/cf.data.pre squid-3.2.2/src/cf.data.pre --- squid-3.2.1/src/cf.data.pre 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/cf.data.pre 2012-10-06 15:08:36.000000000 +1200 @@ -123,6 +123,12 @@ Remove this line. Configure FTP page display using the CSS controls in errorpages.css instead. DOC_END +NAME: maximum_single_addr_tries +TYPE: obsolete +DOC_START + Replaced by connect_retries. The behaviour has changed, please read the documentation before altering. +DOC_END + NAME: url_rewrite_concurrency TYPE: obsolete DOC_START @@ -3351,12 +3357,16 @@ DOC_START Logs the activities of the storage manager. Shows which objects are ejected from the cache, and which objects are - saved and for how long. To disable, enter "none" or remove the line. + saved and for how long. There are not really utilities to analyze this data, so you can safely - disable it. - + disable it (the default). + + Store log uses modular logging outputs. See access_log for the list + of modules supported. + Example: - cache_store_log @DEFAULT_STORE_LOG@ + cache_store_log stdio:@DEFAULT_STORE_LOG@ + cache_store_log daemon:@DEFAULT_STORE_LOG@ DOC_END NAME: cache_swap_state cache_swap_log diff -u -r -N squid-3.2.1/src/client_side.cc squid-3.2.2/src/client_side.cc --- squid-3.2.1/src/client_side.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/client_side.cc 2012-10-06 15:08:36.000000000 +1200 @@ -3856,16 +3856,6 @@ * the ident result on persistent connections... */ /* connection oriented auth also needs these two lines for it's operation. */ - /* - * Internal requests do not have a connection reference, because: A) their - * byte count may be transformed before being applied to an outbound - * connection B) they are internal - any limiting on them should be done on - * the server end. - */ - - if (conn != NULL) - ch->conn(conn); /* unreferenced in FilledCheckList.cc */ - return ch; } diff -u -r -N squid-3.2.1/src/client_side_reply.cc squid-3.2.2/src/client_side_reply.cc --- squid-3.2.1/src/client_side_reply.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/client_side_reply.cc 2012-10-06 15:08:36.000000000 +1200 @@ -630,9 +630,8 @@ return; } - /// Deny loops for accelerator and interceptor. TODO: deny in all modes? - if (r->flags.loopdetect && - (http->flags.accel || http->flags.intercepted)) { + /// Deny loops + if (r->flags.loopdetect) { http->al->http.code = HTTP_FORBIDDEN; err = clientBuildError(ERR_ACCESS_DENIED, HTTP_FORBIDDEN, NULL, http->getConn()->clientConnection->remote, http->request); createStoreEntry(r->method, request_flags()); @@ -1433,7 +1432,11 @@ #endif - const bool maySendChunkedReply = !request->multipartRangeRequest() && + // XXX: chunking a Content-Range response may not violate specs, but our + // ClientSocketContext::writeComplete() confuses the end of ClientStream + // with the end of to-client writing and may quit before writing last-chunk + const bool maySendChunkedReply = !reply->content_range && + !request->multipartRangeRequest() && reply->sline.protocol == AnyP::PROTO_HTTP && // response is HTTP (request->http_ver >= HttpVersion(1, 1)); diff -u -r -N squid-3.2.1/src/CpuAffinitySet.cc squid-3.2.2/src/CpuAffinitySet.cc --- squid-3.2.1/src/CpuAffinitySet.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/CpuAffinitySet.cc 2012-10-06 15:08:36.000000000 +1200 @@ -68,8 +68,11 @@ } bool -CpuAffinitySet::applied() const +CpuAffinitySet::applied() { + // NOTE: cannot be const. + // According to CPU_SET(3) and, apparently, on some systems (e.g., + // OpenSuSE 10.3) CPU_COUNT macro expects a non-const argument. return (CPU_COUNT(&theOrigCpuSet) > 0); } diff -u -r -N squid-3.2.1/src/CpuAffinitySet.h squid-3.2.2/src/CpuAffinitySet.h --- squid-3.2.1/src/CpuAffinitySet.h 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/CpuAffinitySet.h 2012-10-06 15:08:36.000000000 +1200 @@ -21,7 +21,7 @@ void undo(); /// whether apply() was called and was not undone - bool applied() const; + bool applied(); /// set CPU affinity mask void set(const cpu_set_t &aCpuSet); diff -u -r -N squid-3.2.1/src/forward.cc squid-3.2.2/src/forward.cc --- squid-3.2.1/src/forward.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/forward.cc 2012-10-06 15:08:36.000000000 +1200 @@ -345,6 +345,7 @@ // this server link regardless of what happens when connecting to it. // IF sucessfuly connected this top destination will become the serverConnection(). request->hier.note(serverDestinations[0], request->GetHost()); + request->clearError(); connectStart(); } else { @@ -547,6 +548,12 @@ bool FwdState::checkRetriable() { + // Optimize: A compliant proxy may retry PUTs, but Squid lacks the [rather + // complicated] code required to protect the PUT request body from being + // nibbled during the first try. Thus, Squid cannot retry some PUTs today. + if (request->body_pipe != NULL) + return false; + /* RFC2616 9.1 Safe and Idempotent Methods */ switch (request->method.id()) { /* 9.1.1 Safe Methods */ @@ -761,7 +768,6 @@ // The list is used in ssl_verify_cb() and is freed in ssl_free(). if (acl_access *acl = Config.ssl_client.cert_error) { ACLFilledChecklist *check = new ACLFilledChecklist(acl, request, dash_str); - check->fd(fd); SSL_set_ex_data(ssl, ssl_ex_index_cert_error_check, check); } diff -u -r -N squid-3.2.1/src/hier_code.h squid-3.2.2/src/hier_code.h --- squid-3.2.1/src/hier_code.h 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/hier_code.h 2012-10-06 15:08:36.000000000 +1200 @@ -31,6 +31,6 @@ extern const char *hier_code_str[]; -inline hier_code operator++(hier_code &i) { return (hier_code)(i+1); } +inline hier_code operator++(hier_code &i) { return i = (hier_code)(1+(int)i); } #endif /* SQUID__HIER_CODE_H */ diff -u -r -N squid-3.2.1/src/http.cc squid-3.2.2/src/http.cc --- squid-3.2.1/src/http.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/http.cc 2012-10-06 15:08:36.000000000 +1200 @@ -1576,6 +1576,9 @@ old_base64_encode(loginbuf)); return; } + // if no external user credentials are available to fake authentication with PASS acts like PASSTHRU + if (strcmp(request->peer_login, "PASS") == 0) + return; /* Kerberos login to peer */ #if HAVE_AUTH_MODULE_NEGOTIATE && HAVE_KRB5 && HAVE_GSSAPI diff -u -r -N squid-3.2.1/src/HttpRequest.cc squid-3.2.2/src/HttpRequest.cc --- squid-3.2.1/src/HttpRequest.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/HttpRequest.cc 2012-10-06 15:08:36.000000000 +1200 @@ -207,6 +207,7 @@ copy->hier = hier; // Is it safe to copy? Should we? copy->errType = errType; + copy->errDetail = errDetail; // XXX: what to do with copy->peer_login? @@ -528,6 +529,14 @@ errDetail = aDetail; } +void +HttpRequest::clearError() +{ + debugs(11, 7, HERE << "old error details: " << errType << '/' << errDetail); + errType = ERR_NONE; + errDetail = ERR_DETAIL_NONE; +} + const char *HttpRequest::packableURI(bool full_uri) const { if (full_uri) diff -u -r -N squid-3.2.1/src/HttpRequest.h squid-3.2.2/src/HttpRequest.h --- squid-3.2.1/src/HttpRequest.h 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/HttpRequest.h 2012-10-06 15:08:36.000000000 +1200 @@ -121,6 +121,8 @@ /// sets error detail if no earlier detail was available void detailError(err_type aType, int aDetail); + /// clear error details, useful for retries/repeats + void clearError(); protected: void clean(); diff -u -r -N squid-3.2.1/src/ip/Address.cc squid-3.2.2/src/ip/Address.cc --- squid-3.2.1/src/ip/Address.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/ip/Address.cc 2012-10-06 15:08:36.000000000 +1200 @@ -631,7 +631,12 @@ memset(dst, 0, sizeof(struct addrinfo)); // set defaults + // Mac OS X does not emit a flag indicating the output is numeric (IP address) +#if _SQUID_APPLE_ + dst->ai_flags = 0; +#else dst->ai_flags = AI_NUMERICHOST; +#endif if (dst->ai_socktype == 0) dst->ai_socktype = SOCK_STREAM; diff -u -r -N squid-3.2.1/src/ipc/mem/PageStack.cc squid-3.2.2/src/ipc/mem/PageStack.cc --- squid-3.2.1/src/ipc/mem/PageStack.cc 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/ipc/mem/PageStack.cc 2012-10-06 15:08:36.000000000 +1200 @@ -20,11 +20,17 @@ theSize(theCapacity), theLastReadable(prev(theSize)), theFirstWritable(next(theLastReadable)) { + theItems=new Item[theSize]; // initially, all pages are free for (Offset i = 0; i < theSize; ++i) theItems[i] = i + 1; // skip page number zero to keep numbers positive } +Ipc::Mem::PageStack::~PageStack() +{ + delete[] theItems; +} + /* * TODO: We currently rely on the theLastReadable hint during each * loop iteration. We could also use hint just for the start position: diff -u -r -N squid-3.2.1/src/ipc/mem/PageStack.h squid-3.2.2/src/ipc/mem/PageStack.h --- squid-3.2.1/src/ipc/mem/PageStack.h 2012-08-15 15:24:19.000000000 +1200 +++ squid-3.2.2/src/ipc/mem/PageStack.h 2012-10-06 15:08:36.000000000 +1200 @@ -25,6 +25,7 @@ typedef uint32_t Value; ///< stack item type (a free page number) PageStack(const uint32_t aPoolId, const unsigned int aCapacity, const size_t aPageSize); + ~PageStack(); unsigned int capacity() const { return theCapacity; } size_t pageSize() const { return thePageSize; } @@ -67,7 +68,7 @@ Atomic::WordT