From 80fe4147a00373c57c351e69bd550e4e12c6bda5fbe950670326ddf3afbe77a6 Mon Sep 17 00:00:00 2001 From: Christian Wittmer Date: Sun, 28 Jul 2013 20:27:43 +0000 Subject: [PATCH] Accepting request 184541 from home:bruno_friedmann:branches:server:proxy Upgrade to last bugfix upstream release, Make version and date vars in description, Refreshed REALEASENOTE.html file OBS-URL: https://build.opensuse.org/request/show/184541 OBS-URL: https://build.opensuse.org/package/show/server:proxy/squid?expand=0&rev=41 --- RELEASENOTES.html | 94 ++++++++++++++++++++-------------------- squid-3.2.11.tar.bz2 | 3 -- squid-3.2.11.tar.bz2.asc | 20 --------- squid-3.2.13.tar.bz2 | 3 ++ squid-3.2.13.tar.bz2.asc | 20 +++++++++ squid.changes | 18 ++++++++ squid.spec | 7 +-- 7 files changed, 92 insertions(+), 73 deletions(-) delete mode 100644 squid-3.2.11.tar.bz2 delete mode 100644 squid-3.2.11.tar.bz2.asc create mode 100644 squid-3.2.13.tar.bz2 create mode 100644 squid-3.2.13.tar.bz2.asc diff --git a/RELEASENOTES.html b/RELEASENOTES.html index d7d87ca..e2fade6 100644 --- a/RELEASENOTES.html +++ b/RELEASENOTES.html @@ -1,11 +1,11 @@ - - Squid 3.2.6 release notes + + Squid 3.2.13 release notes -

Squid 3.2.6 release notes

+

Squid 3.2.13 release notes

Squid Developers

@@ -72,12 +72,14 @@ for Applied Network Research and members of the Web Caching community.

1. Notice

-

The Squid Team are pleased to announce the release of Squid-3.2.6 for -testing.

+

The Squid Team are pleased to announce the release of Squid-3.2.13.

This new release is available for download from -http://www.squid-cache.org/Versions/v3/3.2/ or the +http://www.squid-cache.org/Versions/v3/3.2/ or the mirrors.

-

While this release is not deemed ready for production use, we believe it is ready for wider testing by the community.

+ +

A large number of the show-stopper bugs have been fixed along with general improvements to the IPv6 support. +While this release is not fully bug-free we believe it is ready for use in production on many systems.

+

We welcome feedback and bug reports. If you find a bug, please see http://wiki.squid-cache.org/SquidFaq/BugReporting for how to submit a report with a stack trace.

@@ -86,7 +88,7 @@ report with a stack trace.

Although this release is deemed good enough for use in many setups, please note the existence of -open bugs against Squid-3.2.

+open bugs against Squid-3.2.

Some issues to note as currently known in this release which are not able to be fixed in the 3.2 series are:

@@ -160,7 +162,7 @@ only to the original destination IP the client was requesting or to explicit pee DNS lookups to locate alternative DIRECT destinations will not be done.

Known Issue: When non-strict validation fails Squid will relay the request, but can only do -so safely to the orginal destination IP the client was contacting. The client original +so safely to the original destination IP the client was contacting. The client original destination IP is lost when relaying to peers in a hierarchy. This means the upstream peers are still at risk of causing same-origin bypass CVE-2009-0801 vulnerability. Developer time is required to implement safe transit of these requests. @@ -253,7 +255,7 @@ in front of the name of whichever helper is being multiplexed. It takes the help path and parameters as its own command parameters. The concurrency setting already existing in Squid is used to configure how many child helpers it may run.

-

For example, a traditional configration is +

For example, a traditional configuration is 

         url_rewrite_program /your/redirector.sh
         url_rewrite_children 5
@@ -289,10 +291,10 @@ will be needed to be solved before starting Squid in production use.

 
The on-demand helpers feature allows greater flexibility and resolves this problem by allowing
 maximum, initial and idle thresholds to be configured. Squid will start the initial set during
 start and reconfigure phases. However over the operational use new helpers up to the maxium will
-be started as load demands. The idle threshold determins how many more helpers to start if the
+be started as load demands. The idle threshold determines how many more helpers to start if the
 currently running set is not enough to handle current request loads.

 
-
For example, a traditional configration is
+
For example, a traditional configuration is
 
         auth_param ntlm /usr/libexec/squid/ntlm_auth
         auth_param ntlm children 200
@@ -357,7 +359,7 @@ For several helpers the directory name used in --enable-X-helpers configure opti
 

 
    
 
  • mswin_check_ad_group - ext_ad_group_acl - Check logged in users Group membership using Active Directory.
    • 
-
  • ip_user_check - ext_file_userip_acl - Restrict users to cetain IP addresses, using a text file backend.
    • 
+
  • ip_user_check - ext_file_userip_acl - Restrict users to certain IP addresses, using a text file backend.
    • 
 
  • squid_kerb_ldap - ext_kerberos_ldap_group_acl - Check logged in Kerberos or NTLM users Group membership using LDAP.
    • 
 
  • squid_ldap_group - ext_ldap_group_acl - Check logged in users Group membership using LDAP.
    • 
 
  • mswin_check_lm_group - ext_lm_group_acl - Check logged in users Group membership using LanManager.
    • 
@@ -416,8 +418,8 @@ This move begins the Localization of the internal administrator facing manuals.<
 
 
    Automatic detection and use of the pthreads library available from Solaris 10
    
 
-
    The result of this addition means that faster more efficient AUFS cache storage mechanisims
-are now available in Solaris 10.
    
+
    The result of this addition means that faster more efficient AUFS cache storage mechanism
+is now available in Solaris 10.
    
 
 
    Support is experimental at this stage due to lack of feedback on the results of enabling it.
 We recommend giving AUFS a try for faster disk storage and encourage feedback.
    
@@ -431,14 +433,14 @@ cache controls for a reverse proxy acting on its behalf. Previously this was clo
 feature support in Squid. This release opens Surrogate support to all reverse proxies.
    
 
 
    Reverse proxy requests sent on to the web server include the HTTP header Surrogate-Capabilities:
-specifying the capabilities of the reverse proxy along with an ID which can be used to target reponses with
+specifying the capabilities of the reverse proxy along with an ID which can be used to target responses with
 a Surrogate-Control: HTTP header used instead of the Cache-Control: header.
    
 
 
    The default surrogate ID is generated automatically from the Squid site-unique hostname as found by the
 automatic detection or manual configuration of visible_hostname although can be configured
 separately with the httpd_accel_surrogate_id option.
    
 
-
    Security Considerations: Websites sould be careful of accepting any surrogate ID.
+
    Security Considerations: Websites should be careful of accepting any surrogate ID.
 Older releases of Squid leak the Surrogate-Control headers to external servers.
 This 3.2 series of Squid will now prevent this leakage of its own ID destined responses, however it is possible
 and for some uses desirable to receive external reverse-proxies Surrogate-Capabilities: headers.
    
@@ -553,7 +555,7 @@ redirects required for their initial GUI display.
    
 
      
 
    • should contain a complete HTML page, with optional client-side scripting.
      • 
 
    • must not contain server-side scripting. 
      • 
-
    • will have macro substitution performed on it using the same macros as used by the error page tempates.
      • 
+
    • will have macro substitution performed on it using the same macros as used by the error page templates.
      • 
 
    
 
    
 
@@ -588,32 +590,32 @@ to those managers.
    
 headers or eCAP options to Squid ICAP requests or eCAP transactions.
    
 
 
    adaptation_send_client_ip
    
-
    Same as depricated icap_send_client_ip
+
    Same as deprecated icap_send_client_ip
 but applies to both ICAP and eCAP.
    
 
 
    adaptation_send_username
    
-
    Same as depricated icap_send_client_username
+
    Same as deprecated icap_send_client_username
 but applies to both ICAP and eCAP.
    
 
 
    adaptation_uses_indirect_client
    
-
    Same as depricated icap_uses_indirect_client
+
    Same as deprecated icap_uses_indirect_client
 but applies to both ICAP and eCAP.
    
 
 
    client_delay_pools
    
-
    New setting for client bandwith limits to specifies the number 
+
    New setting for client bandwidth limits to specifies the number 
 of client delay pools used.
    
 
 
    client_delay_initial_bucket_level
    
-
    New setting for client bandwith limits to determine the initial 
+
    New setting for client bandwidth limits to determine the initial 
 bucket size as a percentage of  max_bucket_size from 
 client_delay_parameters.
    
 
 
    client_delay_parameters
    
-
    New setting for client bandwith limits to configures client-side 
+
    New setting for client bandwidth limits to configures client-side 
 bandwidth limits.
    
 
 
    client_delay_access
    
-
    New setting for client bandwith limits to determines the 
+
    New setting for client bandwidth limits to determines the 
 client-side delay pool for the request.
    
 
 
    client_dst_passthru
    
@@ -727,17 +729,12 @@ It is recommended to upgrade logging to the faster daemon: module.
    
 New installs, or installs with no logs configured explicitly will use this module by default.
    
 
    New tcp module to send each log line as text data to a TCP receiver.
    
 
    New udp module to send each log line as text data to a UDP receiver.
    
-
    New format referrer to log with the format prevously used by referer_log directive.
    
-
    New format useragent to log with the format prevously used by useragent_log directive.
    
+
    New format referrer to log with the format previously used by referer_log directive.
    
+
    New format useragent to log with the format previously used by useragent_log directive.
    
 
-
    acl : random, localip, localport
    
+
    acl : random, urllogin
    
 
    New type random. Pseudo-randomly match requests based on a configured probability.
    
-
    Renamed myip to localip. It matches the IP which the client connected to.
    
-
    Renamed myport to localport. It matches the port which the client connected to.
    
 
    Ported urllogin option from Squid 2.7, to match a regex pattern on the URL login field (if any).
    
-
    The localip/localport differ from earlier releases where they matched a mix of
-of an invalid IP and port 0, the client destination IP/port or the Squid listening IP/port.
-This definition is now consistent across all modes of traffic received by Squid.
    
 
    The manager ACL requires adjustment to cover new cache manager access. So it has now been
 built-in as a predefined ACL name matching URLs equivalent to the following regular expression:
 
    @@ -749,7 +746,7 @@ squid.conf containing the old manager definition can expect to see ACL type coll
 
 
    auth_param
    
 
    New options for Basic, Digest, NTLM, Negotiate children settings.
-startup=N determins minimum number of helper processes used.
+startup=N determines minimum number of helper processes used.
 idle=N determines how many helper to retain as buffer against sudden traffic loads.
 concurrency=N previously called auth_param ... concurrency as a separate option.
    
 
    Removed Basic, Digest, NTLM, Negotiate auth_param ... concurrency setting option.
    
@@ -783,8 +780,8 @@ Other status only available when supplying an error template body.
    
 
    %SRCEUI64 EUI-64 of clients with SLAAC address.
    
 
    %EXT_LOG log= message returned by previous external ACL calls. An updated version may be returned.
    
 
    %EXT_TAG tag= value returned by previous external ACL calls. Tag may not be altered once set.
    
-
    children-max=N determins maximum number of helper processes used.
    
-
    children-startup=N determins minimum number of helper processes used.
    
+
    children-max=N determines maximum number of helper processes used.
    
+
    children-startup=N determines minimum number of helper processes used.
    
 
    children-idle=N determines how many helper to retain as buffer against sudden traffic loads.
    
 
    Deprecated children=N in favor of children-max=N.
    
 
@@ -1024,16 +1021,16 @@ default is to auto-detect the library and use where available.
    
 
    Replaced by --enable-eui
    
 
 
    --enable-auth-basic-helpers
    
-
    replaced by --enable-auth-basic.
    
+
    Replaced by --enable-auth-basic.
    
 
 
    --enable-auth-digest-helpers
    
-
    replaced by --enable-auth-digest.
    
+
    Replaced by --enable-auth-digest.
    
 
 
    --enable-auth-negotiate-helpers
    
-
    replaced by --enable-auth-negotiate.
    
+
    Replaced by --enable-auth-negotiate.
    
 
 
    --enable-auth-ntlm-helpers
    
-
    replaced by --enable-auth-ntlm.
    
+
    Replaced by --enable-auth-ntlm.
    
 
 
    --enable-referer-log
    
 
    Obsolete.
    
@@ -1066,7 +1063,7 @@ An external_acl_type helper may be used to bypass authentication if that is suit
 An external_acl_type helper may be used to bypass authentication if that is suitable.
    
 
 
    cache_peer
    
-
    http11 Obsolete.
    
+
    Option http11 obsolete.
    
 
 
    external_acl_type
    
 
    Format tag %{Header} replaced by %>{Header}
    
@@ -1076,9 +1073,9 @@ An external_acl_type helper may be used to bypass authentication if that is suit
 
    Replaced by request_header_access and reply_header_access
    
 
 
    http_port
    
-
    no-connection-auth replaced by connection-auth=[on|off]. Default is ON.
    
-
    transparent option replaced by intercept
    
-
    http11 obsolete.
    
+
    Option no-connection-auth replaced by connection-auth=[on|off]. Default is ON.
    
+
    Option transparent option replaced by intercept
    
+
    Option http11 obsolete.
    
 
 
    http_access2
    
 
    Replaced by adapted_http_access
    
@@ -1095,6 +1092,12 @@ An external_acl_type helper may be used to bypass authentication if that is suit
 
    server_http11
    
 
    Obsolete.
    
 
+
    update_headers
    
+
    Obsolete. The experimental actions enabled in 2.7 by this option have been integrated as default
+actions for the rock storage type and memory caches.
+The configuration option is no longer necessary and has been dropped.
+NOTE: It is not yet supported by ufs, aufs, or diskd storage.
    
+
 
    upgrade_http0.9
    
 
    Obsolete.
    
 
@@ -1275,9 +1278,6 @@ An external_acl_type helper may be used to bypass authentication if that is suit
 
    storeurl_rewrite_program
    
 
    Not yet ported from 2.7
    
 
-
    update_headers
    
-
    Not yet fully ported from 2.7. Memory and rock storage caches support this natively. UFS caches do not support it.
    
-
 
 
    
 
diff --git a/squid-3.2.11.tar.bz2 b/squid-3.2.11.tar.bz2
deleted file mode 100644
index 5a3c502..0000000
--- a/squid-3.2.11.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:5d5a140e9b72753e6efe467cfa3c56d4db8ba6a8313beeca25145d34ddcadc49
-size 2897354
diff --git a/squid-3.2.11.tar.bz2.asc b/squid-3.2.11.tar.bz2.asc
deleted file mode 100644
index 1ef0d63..0000000
--- a/squid-3.2.11.tar.bz2.asc
+++ /dev/null
@@ -1,20 +0,0 @@
-File: squid-3.2.11.tar.bz2
-Date: Tue Apr 30 05:08:44 UTC 2013
-Size: 2897354
-MD5 : cdd3612bed27e8d513b713004c78bf5b
-SHA1: 124c0af704f88afb2feb5054b36f253544173a4b
-Key : 0xFF5CF463 
-      fingerprint = EA31 CC5E 9488 E516 8D2D  CC5E B268 E706 FF5C F463
-      keyring = http://www.squid-cache.org/pgp.asc
-      keyserver = subkeys.pgp.net
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.12 (GNU/Linux)
-
-iQEcBAABAgAGBQJRf1OIAAoJELJo5wb/XPRjwg4H/iNZaKfeqRLVtpFOXT0RKY+l
-4+FVq1ptu6VLXRtkJWAj5RZfk6hmO9G+ZwZTnZWLf46c6kUvB/4Nlt0LD98FB9ng
-ZtWfcTSked7idj3pInjMvNNa7j0qeOy4tvjUvxKtPAg2ZiRJXoPOKkS6TXnyyGvf
-zlSWqmFUNvBsVULGALk9stq03jxqzf2CamNho8g2Tly//suJr8aHj38E8oMoCHWX
-SCjo9yVTRdZjaGa6RKkyMGYpPpM9Wh4qIixAGT6Ih94YxzXg/mcWpcl6A6Pwc8CT
-lrkKV2mDuGMoL1gGWYo8pUCEjvzKjRtoevu1wjzX/mqYbpilfLNnGg3vqZu7pfM=
-=mQwq
------END PGP SIGNATURE-----
diff --git a/squid-3.2.13.tar.bz2 b/squid-3.2.13.tar.bz2
new file mode 100644
index 0000000..39f1104
--- /dev/null
+++ b/squid-3.2.13.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:92144b72088ac93de7a0d387266172238bfd4e36ed90996af676e406c0c64e35
+size 2898293
diff --git a/squid-3.2.13.tar.bz2.asc b/squid-3.2.13.tar.bz2.asc
new file mode 100644
index 0000000..47a4088
--- /dev/null
+++ b/squid-3.2.13.tar.bz2.asc
@@ -0,0 +1,20 @@
+File: squid-3.2.13.tar.bz2
+Date: Sat Jul 13 13:49:04 UTC 2013
+Size: 2898293
+MD5 : 367e59c9c25da7ebbfbf7cbc36d2444e
+SHA1: f253df4981981c297cc7e719908e07b046506952
+Key : 0xFF5CF463 
+      fingerprint = EA31 CC5E 9488 E516 8D2D  CC5E B268 E706 FF5C F463
+      keyring = http://www.squid-cache.org/pgp.asc
+      keyserver = subkeys.pgp.net
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.12 (GNU/Linux)
+
+iQEcBAABAgAGBQJR4VuSAAoJELJo5wb/XPRjDMsH+gN9MyL0RAegBfeJtScW7dOU
+E7ZPl8BjUqYTOoLPxXX95MTm6gJzzZ69S6ss8+db4fYd6kbGgkX/G05R0E5PBQJG
+2OnJU1LUUzBcqTedai1SCuL90gVgy7oqzke6qlT43SSzuKPzmvlrtnBOrXK1guy0
+xCFNFRtuZKIUVAyERlgE6tP0iPn5DZqSqGwGOx/lkNB20bgx83Amy7uav1F/d9Ps
+sillN9btek4azrPqyqDXoSv+Tqh0u3Ni+zSQJrbVJ59QGFA38OLdW3i3MphgNg5N
+/HkAGnfsCzJHQlxoM5kKz11U4caIv57gy9ZXIJ8peIIldOiLrfG1zcL/awyQVJc=
+=hNXf
+-----END PGP SIGNATURE-----
diff --git a/squid.changes b/squid.changes
index 158a794..de31e93 100644
--- a/squid.changes
+++ b/squid.changes
@@ -1,3 +1,21 @@
+-------------------------------------------------------------------
+Sun Jul 28 12:44:37 UTC 2013 - bruno@ioda-net.ch
+
+- Changes for squid 3.2.13 release (July 13th 2013)
+	Better handling of strange port values in Host:
+	Bug #3869: assertion failed: MemBuf.cc:272: size < capacity
+
+- Changes for squid 3.2.12 release (July 10th 2013) 
+ 	Protect against buffer overrun in DNS query generation
+	Revert rev.11818 - not applicable to 3.2.
+	Allocate ClientInfo::hash.key using malloc() instead of new char[]
+	Remove origin_tries limiter on forwarding
+	Fixed leaking configurable SSL error details.
+	Fix memory error with Kerberos authentication
+	Avoid !closing assertions when helpers call comm_read [during reconfigure].
+	Avoid Comm::Connection leaks when helpers are reconfigured or otherwise closed.
+	Add missing piece omitted from rev.9677
+
 -------------------------------------------------------------------
 Thu Jul 25 10:19:05 UTC 2013 - tchvatal@suse.com
 
diff --git a/squid.spec b/squid.spec
index 8753877..518e0e0 100644
--- a/squid.spec
+++ b/squid.spec
@@ -18,12 +18,13 @@
 
 %define		squidlibdir %{_libdir}/squid
 %define		squidconfdir /etc/squid
+%define		version_published	"2013-07-24"
 
 Name:           squid
 Summary:        Squid Version 3.2 WWW Proxy Server
 License:        GPL-2.0+
 Group:          Productivity/Networking/Web/Proxy
-Version:        3.2.11
+Version:        3.2.13
 Release:        0
 Url:            http://www.squid-cache.org/Versions/v3/3.2
 Source0:        http://www.squid-cache.org/Versions/v3/3.2/%{name}-%{version}.tar.bz2
@@ -135,8 +136,8 @@ The most important of these new features are:
  * Cache Manager access changes
 
   First STABLE release Date: 02 Aug 2010
-  Latest Release: 3.2.9
-  Latest Release Date: 12 Mar 2013
+  Latest Release: %{version}
+  Latest Release Date: %{version_published}
 
 %prep
 %gpg_verify %{S:1}