# Squid 2.5.STABLE12 release notes

## Squid Developers

$Id: release-2.5.html,v 1.1.2.52 2006/03/14 03:16:33 squidadm Exp $

This document contains the release notes for version 2.5 of Squid. Squid is a WWW Cache application developed by the National Laboratory for Applied Network Research and members of the Web Caching community.

## 1. Key changes from squid 2.4:

- Major rewrite of proxy authentication to support other schemes than basic. First in the line is NTLM support but others can easily be added (minimal digest is present). See the Programmers Guide for the internals. Thanks to the SAMBA team for some excellent collaboration on the NTLM support! (Robert Collins & Francesco Chemolli)
- Optimized searching in proxy_auth and ident ACL types. Squid should now handle large access lists a lot more efficiently. (Francesco Chemolli)
- Fixed forwarding/peer loop detection code (Brian Degenhardt) - now a peer is ignored if it turns out to be us, rather than committing suicide
- Changed the internal URL code to obey appendDomain for internal objects if it needs appending. This fixes weirdnesses where a machine can think it is "foo.bar.com", and "foo" is requested. (Brian Degenhardt)
- Added the use of Automake to create the Makefile.in's in the squid source tree. This will allow libtool in the future, and immediately allows better dependency tracking - with or without gcc - as well as the dist-all and distcheck targets for developers which respectively build a tar.gz and a tar.bz2 distribution, and check that what will be distributed builds. (Robert Collins)
- Added TOS and source address selection based on ACLs, written by Roger Venning. This allows administrators to set the TOS precedence bits and/or the source IP from a set of available IPs based upon some ACLs, generally to map different users to different outgoing links and traffic profiles.
- Added 'max-conn' option to 'cache_peer'
- Added SSL gatewaying support, allowing Squid to act as a SSL server in accelerator setups.
- Many new authentication helpers.
- no_cache now applies to cache hits as well as cache misses
- the Gopher client in Squid has been significantly improved
- Squid now sanity checks FTP data connections to ensure the connection is from the requested server. Can be disabled if needed by turning off the ftp_sanitycheck option.
- external acl support. A mechanism where flexible ACL checks can be driven by external helpers. See the external_acl_type and acl external directives. (MARA Systems AB)
- Countless other small things and fixes
- HTML pages generated by Squid or CacheMgr as well as the ERR documents now contain a doctype declaration so that browsers know which HTML specification the document uses. In addition to that they have a new look (background-color, font) and are valid according to the HTML standards at www.w3.org. (Clemens Löser)
- Login and password send to Basic auth helpers is now URL escaped to allow for spaces and other "odd" characters in logins and passwords
- Proxy Authentication is no longer blindly forwarded to peer caches if not used locally. If forwarding of proxy authentication is desired then it must now be configured with the login=PASS cache_peer option.
- Responses with Vary: in the header are now cached by squid. (Henrik Nordstrom).
- Support for openBSD pf interface in interception mode.
- It is now possible to send complex arguments to helpers by quoting the arguments by " and/or \
- The directory structure has changed slightly. The squid binary has been moved into sbin, errors and icons into share/, and the libexec programs are now in libexec/ (was previously libexec/squid/). See configure --help for instructions on how to move these around to exacly where you want to have them in your system.

## 2. Changes to squid.conf

http_port

  Allows ip address specification.

https_port

  This is an option for use with SSL acceleration - it determines where squid listens for SSL requests.

ssl_unclean_shutdown

  This is used to handle some bugs in browsers that don't fully support SSL.

tcp_incoming_address

  This has been removed - use the http_port line to specify ip address's.

cache_peer

  login= has been extended to allow pass through authentication, fixed password authentication and maximum connection limits.

hosts_file

  Directs squid to read in a set of name-address associations upon startup and reconfiguration.

authenticate_program
authenticate_children
proxy_auth_realm

  Removed. See auth_param.

auth_param

  This replaces the authenticate_program directive. It allows configuration of multiple authentication helpers, one for each of the supported authentication schemes. Such schemes include "NTLM", "Digest (from RFC 2617)", and "Basic".

authenticate_cache_garbage_interval

  This directive sets the garbage collection interval for the authentication cache.

external_acl_type

  This directive configures the new external ACL Helper interface. VERY useful for authenticating by group membership - i.e. from an LDAP server or NT domain.

request_body_max_size

  The default for this is now 0 - unlimited.

reply_body_max_size

  Now multiple size limits are allowed based on ACL lists.

refresh_pattern

  The default is now blank - users must uncomment the suggested default to use it. This allows the use of a blank refresh pattern if desired.

request_timeout

  Raised the default to 5 minutes.

persistent_request_timeout

  New directive - how long to wait after a reply is completed before closing the connection.

acl

  New acl types

  - referer_regex (match Referer headers),
  - max_user_ip (limit concurrent IP's a single user may use)
  - rep_mime_type (filter replies based on their content type).
  - external (use an external helper)
http_reply_access

  Limit HTTP replies based on ACL's. This is complementary to http_access.

tcp_outgoing_tos
tcp_outgoing_ds
tcp_outgoing_dscp

  These three directives allow marking of outbound connections at the IP level - i.e. for choosing routes based on the usercode.

tcp_outgoing_address

  Allows mapping of requests onto specific outbound IP address's.

anonymize_headers

  Removed. See header_access.

header_access

  Allow granular filtering of HTTP headers.

header_replace

  Replace specific headers with custom values.

pipeline_prefetch

  Now defaults to off for bandwidth management and access logging reasons.

vary_ignore_expire

  Enables a workaround for web servers that immediately expire Varied objects because they think squid is unable to handle Vary:.

sleep_after_fork

  Give the OS a small amount of time to accomodate the fork+exec used to launch helpers - if squid has a lot of virtual memory allocated the OS may run out of virtual memory during helper spawning otherwise.

reference_age

  This has been removed - starting with Squid-2.4 this directive have had no effect and has now been fully removed to avoid confusion.

siteselect_timeout

  This has been removed - it is not referenced anywhere in the source code.

minimum_retry_timeout

  This has been removed - it is not referenced anywhere in the source code.

forward_timeout

  New directive in 2.5.STABLE5 complement connect_timeout in management of timeouts while connecting to origin servers or peers

short_icon_urls

  New directive in 2.5.STABLE5 to enable an alternative way of referring to icons in FTP directory listings etc.

acl urllogin

  New acl type in 2.5.STABLE5 to match the login component of Internet style URLs (protocol://user:password@host/path/to/file)

balance_on_multiple_ip

  New directive in 2.5.STABLE7 to make it possible to disable the automatic round-robin load balancing on multiple IP addresses normally done by Squid.

reply_header_max_size

  New directive in 2.5.STABLE7 limiting the size of HTTP reply headers, similar to request_header_max_size but in the reply direction (from servers to clients). Default is 20KB.

acl req_hdr/resp_hdr

  New acl types in 2.5.STABLE7 to match arbitrary HTTP headers, useful to block certain malware/spyware etc.

relaxed_http_parser

  New directive in 2.5.STABLE8 to control how strict the HTTP parser should be.

retry_on_error

  New directive in 2.5.STABLE9 to aggressive retry requests on errors (was the default in earlier versions)

acl dst

  No longer matches invalid hosts. Was previously using the IP address "255.255.255.255" on invalid hosts.

persistent_connection_after_error

  New directive in 2.5.STABLE13 to allow disabling the use of persistent connections after error pages (access denied etc).

## 3. Known issues and limitations

There is a few known issues in this version of Squid which we hope to correct in a later release

Bug #761

  assertion failed: cbdata.c:249: "c->locks > 0" when using diskd

Bug #649

  Problems refreshing pages stored with 'vary' information

Bug #888

  ntlm_user_pool assertion error on shutdown

Bug #1420

  302 responses with an Expires header is always cached

Bug #1500

  diskd related memory corruption under heavy load

Ipfilter 4.x compile problem on HP Tru64

- Running configure --enable-ipf-transparent on an HP Tru64 5.1B system with ipfilter 4.x installed, the following error can occur:

            checking if IP-Filter header files are installed... no
            WARNING: Cannot find necessary IP-Filter header files
                     Transparent Proxy support WILL NOT be enabled

  To fix the problem first check if the ip_fil.h, ip_compat.h, ip_nat.h and ipl.h files are present in /usr/include/netinet and copy them from ipfilter source tree if needed. Don't forget to fix files permission and ownership after the copy.
  If the error still persist, run configure making it skip the ip_compat.h test:

          env ac_cv_header_netinet_ip_compat_h=yes ./configure --enable-ipf-transparent

- On Sun Solaris 10, ipfilter 4.0.22 is provided with the OS, but related include files (ip_fil.h, ip_compat.h, ip_nat.h, ipl.h) are missing.
  Before running configure --enable-ipf-transparent, they must be downloaded from the OpenSolaris Web Site in the /usr/include local directory. Don't forget to fix files permission and ownership after the download.

In addition there is a set of limitations in this version of Squid which we hope to correct later

Bug #1059

  mime.conf and referenced icons must be within chroot

Bug #692

  tcp_outgoing_address using an ident ACL does not work

Bug #581

  acl max_user_ip and multiple authentication schemes

Bug #528

  miss_access fails on "slow" acl types such as dst.

Bug #513

  squid -F is starting server sockets to early

Bug #457

  does not handle swap.state corruption properly

Bug #410

  unstable if runs out of disk space

Bug #355

  diskd may appear slow on low loads

Bug #219

  delay_pools stops working on -k reconfigure

## 4. Key changes squid-2.5.STABLE1 to 2.5.STABLE2:

- authentication now works in most access directives if first enforced in http_access
- contrib files included in the distribution again
- aufs bugfixes to address both stability and data corruption issues, and some aufs performance improvements.
- now possible to specify acl values with spaces in them via the "include file" technique
- winbind helpers updated to match Samba-2.2.7a and should work with Samba-2.2.6 or later (required). For compatibility with older Samba versions A new configure option --with-samba-sources=... has been added to allow you to specify which Samba version the helpers should be built for if different than the above versions.
- squid_ldap_group updated to correctly handle LDAP groups
- new experimental configure option --disable-hostname-checks to make Squid not validate that received hostnames are valid for use within HTTP. Required to participate in testbeds for international domain names etc.
- several assertion or segmentation faults corrected
- a large number of minor bugfixes. See the list of squid-2.5.STABLE1 patches and the ChangeLog file for details.

## 5. Key changes squid-2.5.STABLE2 to 2.5.STABLE3:

- a large number of minor bug fixes. See the list of squid-2.5.STABLE2 patches and the ChangeLog file for details.

## 6. Key changes squid-2.5.STABLE3 to 2.5.STABLE4:

- several memory leaks corrected
- segmentation fault if more than one deny_info corrected
- Lithuanian error messages added
- a crash related to ftpTimeout: timeout in SENT_PASV state corrected
- http_reply_access deny now logs the request with TCP_DENIED to allow them to be accounted for properly in statistics
- minimum_retry_timeout configuration directive removed. If you have this directive in your existing squid.conf you will need to remove the line.
- Improvements to the (experimental) COSS storage scheme.
- Updates to allow Squid to be compiled with GCC-3.3
- POST now works well with NTLM and Digest authentication
- http_header_access now works in combination with cache_peer
- Most Squid generated errors are now logged as TCP_DENIED/XXX rather than TCP_MISS/XXX or NONE/XXX. This to work around issues relating to access controls.
- external_acl_type concurrency= option renamed to children= to prepare for Squid-3 upgrade. The old syntax is still accepted but you may want to upgrade your configuration now to save you from the trouble when upgrading to Squid-3 later.
- a large number of minor bugfixes. See the list of squid-2.5.STABLE3 patches and the ChangeLog file for details.

## 7. Key changes squid-2.5.STABLE4 to 2.5.STABLE5:

- redirector interface modified to try to deal with login names containing spaces or other odd characters. This is accomplished by URL-encoding the login name before sent to redirectors. Note: Existing redirectors or their configuration may need to be slightly modified in how they process the ident column to support the new username format (only applies to redirectors looking into the username)
- new forward_timeout option to complement connect_timeout in management of timeouts while connecting to origin servers or peers
- various timeouts adjusted: connect_timeout 1 minute (was 2 minutes which is now forward_timeout), negative_dns_ttl 1 minute (was 5 minutes) and is now also used as minimum positive dns ttl, dns_timeout 2 minutes (was 5 minutes)
- "short_icon_urls on" can be used to simplify the URLs used for icons etc to avoid issues with proxy host naming and authentication when requesting icons.
- A new "urllogin" ACL type has been introducing allowing regex matches to the "login" component of Internet style URLs (protocol://user:password@host/path/to/file).
- Squid now respects the Telnet protocol on connections to FTP servers. The ftp_telnet_protocol directive can be used to revert back to the old incorrect implementation.
- Several NTLM related bugfixes and improvements fixing the problem of random auth popups and account lockouts. Support for the NEGOTIATE NTLM packet is also added to allow Samba-3.0.2 or later to negotiate the use of NTLMv2.
- Several authentication related bugfixes to allow authentication to work in additional acl driven directives, correct an number of assertion or segmentation and some memory leaks.
- The default mime.conf has been updated with many new mime types and a few minor corrections. In addition the download and view links is used more frequently to allow view/download of different ftp:// contents regardless of their mime type assignment.
- url_regex enhanced to allow matching of %00
- a large number of minor and cosmetic bugfixes. See the list of squid-2.5.STABLE4 patches and the ChangeLog file for details.

## 8. Key changes squid-2.5.STABLE5 to 2.5.STABLE6:

- Several "Assertion error" bugs fixed
- Several "Segmentation fault" bugs fixes
- Corrects a security issue in the old ntlm_auth NTLM helper used in transparent NTLM authentication to a NT domain without using samba.
- Processing of Vary: * and Vary on error messages corrected
- a large number of minor and cosmetic bugfixes. See the list of squid-2.5.STABLE5 patches and the ChangeLog file for details.

## 9. Key changes squid-2.5.STABLE6 to 2.5.STABLE7:

- SNMP related Denial of Service issue corrected (CAN-2004-0918)
- NTLM related bugfix noticed by the Samba group
- UFS cache_dir bugfix to issue introduced in STABLE6 causing no objects to get cached in some configurations.
- cache_effective_user now sets supplementary group list if cache_effective_group not set
- cache_effective_group now used if specified even if not started as root. If you do not start Squid as root you may need to remove this directive from your squid.conf if not set correctly.
- request_header_max_size directive corrected. You may need to increase this value after upgrading if set very low. The default have been increased from 10 KB to 20 KB which should be sufficient for most uses.
- reply_header_max_size directive added
- http_header_access & replace now support arbitrary headers, not only the well known headers known by Squid
- new acl types req_hdr and resp_hdr to match arbitrary HTTP headers, useful to block certain malware/spyware etc.
- new balance_on_multiple_ip squid.conf directive
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE6 patches and the ChangeLog file for details.

## 10. Key changes squid-2.5.STABLE7 to 2.5.STABLE8:

- Squid no longer closes all open filedescriptors. Previous Squid versions have for increased security closed any open filedescriptors left open by the process starting Squid, but this is not really our business and causes problems for certain libraries opening internal filedescriptors in some conditions (some SSL libraries, syslog, DNS resolver etc).
- Configuration parser made more strict and consistent. Previously empty acl declarations were ignored in http_access causing some unexpected results. Now empty acl declarations are allowed (matching nothing) and http_access requires all listed acls to be defined.
- A minor information leak in error messages due to malformed host names corrected
- Several HTTP security fixes to prevent cache pollution attacks or theft of user confidential information. New relaxed_http_parser directive to control how strict the HTTP parser should be.
- Buffer overflow fix in gopherToHTML.
- Corrected a Segmentation fault on malformed WCCP packets.
- squid_ldap_auth now sanity checks usernames
- Corrected a Segmentation fault and other malfunctions on failed PUT/POST requests.
- Properly handle oversized reply headers
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE7 patches and the ChangeLog file for details.

## 11. Key changes squid-2.5.STABLE8 to 2.5.STABLE9:

- DNS related assertion error
- High characters allowed in FTP & Gopher listings.
- Additional workarounds for broken web servers rejected by 2.5.STABLE8.
- No longer automatically retries requests on 403 Access Denied or many other server errors. New squid.conf directive retry_on_error to revert back to the old behavior if needed.
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE8 patches and the ChangeLog file for details.

## 12. Key changes squid-2.5.STABLE9 to 2.5.STABLE10:

- Fixed a Set-Cookie race condition causing inconsistent cache behaviour
- Abort on misconfigured http_access rules to prevent unexpected results from partial configuration
- FTP directory listings corrected again (broken by 2.5.STABLE9)
- Support for proxying huge objects greater than 2GB in size
- IP-Filter 4.0 support in --enable-ipf-transparent
- cachemgr.cgi now uses a configuration controlling which servers may be managed. This to prevent abuse of the program. See `<prefix>/etc/cachemgr.conf` for details. The configuration is read first from the current directory (normally where you installed cachemgr.cgi) and if not found there from `<prefix>/etc/cachemgr.conf`. If neither is found only access to localhost and the full server name is provided, or the cachemgr default host if specified to configure.
- The internal DNS client has been hardened against spoofing of DNS responses.
- The SNMP agent now supports the use of SNMPv2, and has a few other related minor bugfixes.
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE9 patches and the ChangeLog file for details.

## 13. Key changes squid-2.5.STABLE10 to 2.5.STABLE11:

- Segmentation fault in sslConnectTimeout
- Assertion failed StatHist.c:93
- Assertion failed store_status == STORE_PENDING
- Clients could bypass delay pools settings by faking a cache hit
- Odd results was seen on pipelined CONNECT requests
- Squid crashing with "FATAL: Incorrect scheme in auth header" when using NTLM authentication.
- dst acl changed to not match invalid hosts as 255.255.255.255
- New --with-maxfd=N configure option to override build time filedescriptor limit test
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE10 patches and the ChangeLog file for details.

## 14. Key changes squid-2.5.STABLE11 to 2.5.STABLE12:

- Truncated responses when using delay pools
- Set-Cookie lost on cache revalidations
- Segmentation fault in rfc1738_do_escape
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE11 patches and the ChangeLog file for details.

## 15. Key changes squid-2.5.STABLE12 to 2.5.STABLE13:

- connstate related memory leak plugged
- ftp upload issues fixed
- delay pools working better on -k reconfigure
- error pages translated to Azerbaijani
- a number of other minor and cosmetic bugfixes. See the list of squid-2.5.STABLE12 patches and the ChangeLog file for details.