<!doctype linuxdoc system>
<article>
<title>Squid 2.6.STABLE19 release notes</title>
<author>Squid Developers</author>
<date>$Id: release-2.6.sgml 12965 2008-06-28 06:50:51Z adrian.chadd $</date>

<abstract>
This document contains the release notes for version 2.6 of Squid.
Squid is a WWW Cache application developed by the Web Caching community.
</abstract>

<toc>

<sect>Key changes from squid 2.5
<p>
<itemize>
<item>Major improvements to the way that Squid handles web proxy, accelerated 
and transparent proxy requests to make it easier to configure transparent and 
acceleration functionality.  The default behaviour is to function as a standard 
HTTP proxy on each port that Squid is configured to listen on, but in addition 
in this release the keywords "accel" and "transparent" can be specified 
after each port to indicate to Squid the functionality that is to be enabled on 
that port.  This means that the old config directives relating to httpd_accel_* 
are now deprecated. See below for more details about these options.
<item>WCCPv2 support multiple cache engines registering with multiple WCCP 
routers and switches.  WCCPv2 is preferred over WCCPv1 for performance and 
flexibility reasons if your router or switch is able to support it (all recent 
versions of IOS do so).  Initially WCCPv2 under Linux is limited to registration 
with only one router due to kernel limitations in more recent versions, although 
this will be addressed in a future release of Squid.
<item>TPROXY totally transparent proxy support under Linux, which to allow Squid 
to appear totally invisible to both client and server systems when transparently 
caching requests.  This works by spoofing the source and destination address to 
both the client and server.
<item>Support for Etag and Vary HTTP headers.  This further moves Squid towards 
HTTP/1.1 compliance.  The Vary header field is used for improved caching and 
delivery of customized content to end clients, and the Etag is used similar to 
an MD5 checksum between client and server to determine if a web page has changed 
since it was last retrieved.
<item>Collapsed forwarding, which gives Squid the ability to intelligently merge 
client requests for objects into one request to the server.  Of particular 
benefit in accelerator setups but also provides some benefits to non accelerator 
setups.
<item>Support for epoll under Linux and kqueue under FreeBSD, which gives Squid
the ability to handle many many more concurrent requests with lower CPU
overhead. This feature is of particular benefit to very busy caches 
as the poll() and select() routines do not scale anywhere near as well as epoll 
and kqueue does under high loads.
<item>SSL assisted hardware encryption making use of OpenSSL functionality 
within Squid.
<item>Logging enhancements to allow even greater customization of the way Squid 
logs requests in the access-log or to syslog if required
<item>Authentication enhancements including Negotiate/Kerberos support, extra
workarounds for NTLM clients and others using Microsoft Integrated Login.
<item>Additional external_acl parameters to support SSL and even more client 
side parameters.
<item>ACL changes in conjunction with SSL changes which have been merged, to 
allow matching based on SSL certificate parameters.
<item>Improvements to Cygwin support for users who wish to run Squid in a 
Microsoft Windows/Cygwin environment as a system service.
<item>New authentication helpers:
<itemize>
<item>Digest LDAP helper
<item>Native Windows basic, NTLM and negotiate helpers
<item>External acl helpers for session monitoring and native Windows group
membership check
</itemize>
<item>HTCP significantly cleaned up and added support for the CLR operation to purge contents from the cache
<item>Support for parsing X-Forwarded-For headers allowing access controls to be based on the real client IP even if behind secondary proxies
<item>Support for proxying of Microsoft Integrated Login (NTLM &amp; Negotiate) connection oriented authentication schemes, enabling access to servers or proxies using such authentication methods.
<item>Support for the Linux TPROXY patch allowing Squid to masquerade using the clients original IP address
<item>urlgroups, tagging URLs for redirection and access controls, and divides the cache allowing different users to get different results for the same URL.
<item>Optional automatic monotoring of cache peers and configured origin servers
<item>SSL client support, allowing both http->https gatewaying and SSL encrypted peers (both origin servers and proxies).
<item>Full ETag/Vary based caching, allowing efficient caching of server driven content negotiation.
<item>Customizable access log format
<item>Selective access logging, and ability to log to more than access log possibly in different formats
<item>New more efficient helper protocol allowing for multiple concurrent lookups to the same helper
<item>Ability to rewrite Location headers (redirects sent by servers)
<item>Major cleanup or CARP. Now plays well with the other peering algorithms as just another non-ICP peering method.
</itemize>

<sect>Changes to squid.conf
<p><descrip>
<tag>http_port</tag>Now takes a list of options in addition to the port address, specifying the purpose of this http_port. Default is plain Internet proxy as usual. Also there is no longer a default port and you must include a http_port directive in your squid.conf if you want Squid to listen for http requests.
<tag>httpd_accel_* for transparent proxy</tag>Now implemented by the "transparent" http_port option
<tag>httpd_accel_* for accelerator mode</tag>Now implemented by other options and the http_port accel option. See individual directives below.
<tag>httpd_accel_host</tag>Replaced by defaultsite http_port option and cache_peer originserver option.
<tag>httpd_accel_port</tag>No longer needed. Server port defined by the cache_peer port.
<tag>httpd_accel_uses_host_header</tag>Replaced by vhost http_port option
<tag>https_port</tag>Many new options. Reconstructs URLs as https:// by default.
<tag>cache_peer</tag>Many new options to support origin servers and SSL encryption
<tag>ssl_engine</tag>New directive for hardware assisted SSL encryption
<tag>sslproxy_*</tag>New directives defining how to gateway http-&gt;https
<tag>sslpassword_program</tag>New helper directive to query an external program for SSL key encryption password (if any)
<tag>no_cache</tag>Renamed to cache to better reflect the functionaliy. no_cache still accepted.
<tag>cache</tag>New name for the old no_cache directive.
<tag>cache_vary</tag>New directive to disable caching of Vary:ing responses
<tag>broken_vary_encoding</tag>New directive to work around known broken compression modules which hasn't understood the meaning of the ETag HTTP header in relation to Accept-Encoding.
<tag>logformat</tag>New directive for defining custom log formats
<tag>cache_access_log</tag>Renamed to access_log
<tag>access_log</tag>Select what requests to log where any by what format. Support for multiple log files and multiple log formats.
<tag>check_hostnames</tag>New option to disable the hostname validity/sanity checks usually performed by Squid, replacing the similar build time configure option in 2.5.
<tag>allow_underscore</tag>New option to allow _ in hostnames, replacing the similar build time configure option in 2.5 and earlier.
<tag>dns_defnames</tag>Allow for domain searches. Now possible even when using the internal DNS client
<tag>redirect_*</tag>Renamed to url_rewrite_* to better reflect the functionality of this helper (rewriting requested URLs)
<tag>url_rewrite_concurrency</tag>Activates a new and more efficient helper protocol. Requires changes in the helper.
<tag>location_rewrite_*</tag>New helper hook for rewriting Location headers
<tag>auth_param basic blankpassword</tag>New option to allow the use of blank passwords.
<tag>auth_param basic/digest concurrency</tag>New option enabling a multiplexed helper protocol allowing the same helper to process multiple concurrent requests in an efficient manner. Requires support from the helper. (2.6.STABLE2 and later)
<tag>auth_param ntlm max_challenge_reuse / max_challenge_lifetime</tag>No longer supported
<tag>auth_param ntlm use_ntlm_negotiate</tag>Directive no longer supported. Use of NTLM negotiate packet is always on.
<tag>auth_param ntlm keep_alive</tag>New option to fine-tune the use of HTTP keep-alive in combination with NTLM
<tag>auth_param negotiate</tag>New Negotiate authentication scheme, the "next generation" scheme in the family of Microsoft authentication.
<tag>external_acl_type</tag>Many new format options %SRCPORT, %MYADDR, %MYPORT, %PATH, %USER_CERT, %ACL, %DATA and a few variants. Helper protocol defaults to the simpler "3.0" protocol, and there is support for a highly efficient protocol via the concurrency= option if supported by the helper.
<tag>refresh_pattern</tag>Several new HTTP override/ignore options
<tag>read_ahead_gap</tag>New directive to set the response buffer size.
<tag>collapsed_forwarding</tag>New directive to enable an alternative optimized forwarding path when there is very many concurrent requests for the same URL.
<tag>refresh_stale_hit</tag>New directive similar to collapsed_forwarding and activates an alternative optimized request processing when there is very many concurrent requests for the same recently expired URL.
<tag>acl urlgroup</tag>New acl class
<tag>acl user_cert</tag>New acl class matching the user SSL certificate (https_port)
<tag>acl ca_cert</tag>New acl class matching the CA of the user SSL certificate (https_port)
<tag>acl ext_user / ext_user_regex</tag>New acl matching usernames returned by external acl
<tag>follow_x_forwarded_for</tag>New option to enable parsing of X-Forwarded-For headers allowing access controls to be based on the real client IP even if behind secondary proxies
<tag>http_access2</tag>New http_access type directive but evaluated after url rewrites
<tag>htcp_access, htcp_clr_access</tag>Access control on HTCP requests
<tag>log_access</tag>New directive to limit what gets logged.
<tag>httpd_suppress_version_string</tag>Enable hiding of the Squid version
<tag>umask</tag>New directive to specify the minimum umask Squid should run under
<tag>error_map</tag>New directive to allow dynamic rewrites of error pages
<tag>via</tag>New directive to disable the use of the Via directive
<tag>wccp2_*</tag>WCCP2 protocol support
<tag>minimum_expiry_time</tag>tune the magic 60 seconds limit of what is considered cachable when the object doesn't have any cache validators. (2.6.STABLE2)
<tag>wccp2_rebuild_wait</tag>make Squid delay registering with a WCCP router until store rebuild have finished. Default on. (2.6.STABLE2)
<tag>wccp2_weight</tag>Cache server load weigth in the cluster. (2.6.STABLE4)
<tag>check_hostnames</tag>Control if Squid should check the sanity of host names before trying to look them up in DNS
<tag>allow_underscores</tag>Control if _ is to be considered a valid character in hostnames or not
<tag>cache_peer carp-load-factor</tag>Option removed. CARP now uses the weight parameter instead.
<tag>cache_peer login=</tag>Controls how Squid forwards login information to peer caches and servers.
</descrip>

<sect>Known issues

<P>There is a few known issues in this version of Squid which we hope to correct in a later release

<itemize>
<item>Bug #761: Unstable under load when using diskd
</itemize>

<sect>Known limitations

<P>In addition there is a set of limitations in this version of Squid which we hope to correct later

<itemize>
<item>Bug #1420: 302 responses with an Expires header is always cached
<item>Bug #1059: mime.conf and referenced icons must be within chroot
<item>Bug #692: tcp_outgoing_address using an ident ACL does not work
<item>Bug #581: acl max_user_ip and multiple authentication schemes
<item>Bug #528: miss_access fails on "slow" acl types such as dst.
<item>Bug #513: squid -F is starting server sockets to early
<item>Bug #457: does not handle swap.state corruption properly
<item>Bug #410: unstable if runs out of disk space
<item>Bug #355: diskd may appear slow on low loads
<item>Bug #219: delay_pools stops working on -k reconfigure
</itemize>

<sect>Other issues

<P>Ipfilter 4.x compile problem on HP Tru64
<itemize>
    <item>Running configure --enable-ipf-transparent on an HP Tru64 5.1B system with ipfilter 4.x installed, the following error can occur:
    <verb>
      checking if IP-Filter header files are installed... no
      WARNING: Cannot find necessary IP-Filter header files
               Transparent Proxy support WILL NOT be enabled</verb>
    To fix the problem first check if the ip_fil.h, ip_compat.h, ip_nat.h and ipl.h files are present in
    /usr/include/netinet and copy them from ipfilter source tree if needed.
    Don't forget to fix files permission and ownership after the copy.<newline>
    If the error still persist, run configure making it skip the ip_compat.h test:<newline>
    <verb>
    env ac_cv_header_netinet_ip_compat_h=yes ./configure --enable-ipf-transparent</verb>
    <item>On Sun Solaris 10, ipfilter 4.0.22 is provided with the OS, but related include files (ip_fil.h, ip_compat.h, ip_nat.h, ipl.h) are missing.<newline>
      Before running configure --enable-ipf-transparent, they must be downloaded from the
      <url url="http://cvs.opensolaris.org/source/xref/usr/src/common/ipf/" name="OpenSolaris Web Site">
      in the /usr/include local directory. Don't forget to fix files permission and ownership after the download.
</itemize>


<sect>Windows support
<P>This Squid version can run on Windows as a system service using the Cygwin emulation environment, 
or can be compiled in Windows native mode using the MinGW + MSYS development environment. Windows NT 4 SP4 and later are supported.<newline>
On Windows 2000 and later the service is configured to use the Windows Service Recovery option
restarting automatically after 60 seconds.
<descrip>

<tag>Usage</tag>

Some new command line options was added for the Windows service support:<newline>

The service installation is made with -i command line switch, it's possible to use -f switch at
the same time for specify a different config-file settings for the Squid Service that will be
stored on the Windows Registry.

A new -n switch specify the Windows Service Name, so multiple Squid instance are allowed.
<em/"Squid"/ is the default when the switch is not used.

So, to install the service, the syntax is: 

<verb>squid -i [-f file] [-n name]</verb>

Service uninstallation is made with -r command line switch with the appropriate -n switch.

The -k switch family must be used with the appropriate -f and -n switches, so the syntax is: 

<verb>squid -k command [-f file] -n service-name</verb>
where <em/service-name/ is the name specified with -n options at service install time.

To use the Squid original command line, the new -O switch must be used ONCE, the syntax is: 

<verb>squid -O cmdline [-n service-name]</verb>
If multiple service command line options must be specified, use quote. The -n switch is
needed only when a non default service name is in use.

Don't use the "Start parameters" in the Windows 2000/XP/2003 Service applet: they are
specific to Windows services functionality and Squid is not designed for understand they.

In the following example the command line of the "squidsvc" Squid service is set to "-D -u 3130": 

<verb>squid -O "-D -u 3130" -n squidsvc</verb>
</descrip>

<descrip>
<tag>PSAPI.DLL (Process Status Helper) Considerations</tag>

The process status helper functions make it easier for you to obtain information about
processes and device drivers running on Microsoft® Windows NT®/Windows® 2000. These
functions are available in PSAPI.DLL, which is distributed in the Microsoft® Platform
Software Development Kit (SDK). The same information is generally available through the
performance data in the registry, but it is more difficult to get to it. PSAPI.DLL is
freely redistributable.

PSAPI.DLL is available only on Windows NT, 2000, XP and 2003. The implementation in Squid is
aware of this, and try to use it only on the right platform.

On Windows NT PSAPI.DLL can be found as component of many applications, if you need it,
you can find it on Windows NT Resource KIT. If you have problem, it can be
downloaded from here:
<url url="http://download.microsoft.com/download/platformsdk/Redist/4.0.1371.1/NT4/EN-US/psinst.EXE" name="http://download.microsoft.com/download/platformsdk/Redist/4.0.1371.1/NT4/EN-US/psinst.EXE">

On Windows 2000 and later it is available installing the Windows Support Tools, located on the
Support\Tools folder of the installation Windows CD-ROM.
</descrip>

<descrip>
<tag>Registry DNS lookup</tag>
On Windows platforms, if no value is specified in the <em/dns_nameservers/ option on
squid.conf or in the /etc/resolv.conf file, the list of DNS name servers are
taken from the Windows registry, both static and dynamic DHCP configurations
are supported.
</descrip>

<descrip>
<tag>Compatibility Notes</tag>
<itemize>
<item>It's recommended to use '/' char in Squid paths instead of '\'
<item>Paths with spaces (like 'C:\Programs Files\Squid) are NOT supported by Squid
<item>When using ACL like 'acl aclname acltype "file"' the file must be in DOS text
format (CR+LF) and the full Windows path must be specified, for example:

<verb>acl blocklist url_regex -i "c:/squid/etc/blocked1.txt"</verb>

<item>The Windows equivalent of '/dev/null' is 'NUL'
<item>Squid doesn't know how to run external helpers based on scripts, like .bat, .cmd,
.vbs, .pl, etc. So in squid.conf the interpreter path must be always specified, for example:

<verb>redirect_program c:/perl/bin/perl.exe c:/squid/libexec/redir.pl
redirect_program c:/winnt/system32/cmd.exe /C c:/squid/libexec/redir.cmd</verb>
<item>When Squid runs in command line mode, the launching user account must have administrative privilege on the system
<item>"Start parameters" in the Windows 2000/XP/2003 Service applet cannot be used
<item>Building with MinGW, when the configure option --enable-truncate is used, Squid cannot run on Windows NT, only Windows 2000 and later are supported
</itemize>
</descrip>

<descrip>
<tag>Known Limitations</tag>
<itemize>
<item>Squid features not operational:<newline>
<itemize>
<item>DISKD: still needs to be ported<newline>
<item>WCCP: cannot work because user space GRE support on Windows is missing<newline>
<item>Transparent Proxy: missing Windows non commercial interception driver<newline>
</itemize>
<item>Some code sections can make blocking calls.
<item>Some external helpers may not work.
<item>File Descriptors number hard-limited to 2048 when building with MinGW.
</itemize>
</descrip>

<descrip>
<tag>Building Squid on Windows</tag>
A reasonably recent release of <url url="http://www.cygwin.com/" name="Cygwin"> or <url url="http://www.mingw.org/" name="MinGW"> is needed.<newline>
The usage of the Cygwin environment is very similar to other Unix/Linux environments, and -devel version of libraries must be installed.<newline>
For the MinGW environment, the packages MSYS, MinGW and msysDTK must be installed. Some additional libraries and tools must be downloaded separately:<newline><newline>
OpenSSL: <url url="http://www.slproweb.com/products/Win32OpenSSL.html" name="Shining Light Productions Win32 OpenSSL"><newline>
libcrypt: <url url="http://sourceforge.net/projects/mingwrep/" name="MinGW packages repository"><newline>
db-1.85: <url url="http://tinycobol.org/download.html" name="TinyCOBOL download area"><newline>
uudecode: <url url="http://unxutils.sourceforge.net/" name="Native Win32 ports of some GNU utilities"><newline><newline>
When running configure, --disable-wccp and --disable-wccpv2 options should always specified to avoid compile errors.<newline>
<itemize>
<item>New configure options:<newline>
<itemize>
<item>--enable-win32-service<newline>
</itemize>
<item>Updated configure options:<newline>
<itemize>
<item>--enable-arp-acl<newline>
<item>--enable-default-hostsfile<newline>
</itemize>
<item>Unsupported configure options:<newline>
<itemize>
<item>--enable-coss-aio-ops: On Windows Posix AIO is not available<newline>
<item>--with-large-files: No suitable build environment is available on both Cygwin and MinGW, but --enable-large-cache-files works fine<newline>
</itemize>
<item>Recommended configure minimal options for Windows:<newline>
<itemize>
<item>--prefix=c:/squid --disable-wccp --disable-wccpv2 --enable-win32-service --enable-default-hostsfile=none
</itemize>
</itemize>
<newline>
Before build Squid with SSL support, some operations are needed (in the following example OpenSSL is installed in C:\OpenSSL and MinGW in C:\MinGW):
<itemize>
<item>Copy C:\OpenSSL\lib\MinGW content to C:\MinGW\lib<newline>
<item>Copy C:\OpenSSL\include\openssl content to C:\MinGW\include\openssl<newline>
<item>Rename C:\MinGW\lib\ssleay32.a to C:\MinGW\lib\libssleay32.a<newline>
</itemize>

</descrip>

<descrip>
<tag>Using cache manager on Windows:</tag>
On Windows, cache manager (cachemgr.cgi) can be used with Microsoft IIS or Apache.<newline>
Some specific configuration could be needed:<newline>
<itemize>
<item>IIS 6 (Windows 2003):<newline>
<itemize>
<item>On IIS 6.0 all CGI extensions are denied by default for security reason, so the following configuration is needed:<newline>
<itemize>
<item>Create a cgi-bin Directory
<item>Define the cgi-bin IIS Virtual Directory with read and CGI execute IIS
permissions, ASP scripts are not needed. This automatically defines a
cgi-bin IIS web application 
<item>Copy cachemgr.cgi into cgi-bin directory and look to file permissions:
the IIS system account and SYSTEM must be able to read and execute the file
<item>In IIS manager go to Web Service extensions and add a new Web Service
Extension called <em/"Squid Cachemgr"/, add the cachemgr.cgi file and set the
extension status to <em/Allowed/
</itemize>
</itemize>
<item>Apache:<newline>
<itemize>
<item>On Windows, cachemgr.cgi needs to create a temporary file, so Apache must be instructed
 to pass the TMP and TEMP Windows environment variables to CGI applications:<newline>
<verb>
ScriptAlias /squid/cgi-bin/ "c:/squid/libexec/"
&lt;Location /squid/cgi-bin/cachemgr.cgi&gt;
    PassEnv TMP TEMP
    Order allow,deny
    Allow from workstation.example.com
&lt;/Location&gt;
</verb>
</itemize>
</itemize>
</descrip>

<sect>Key changes squid-2.6.STABLE1 to 2.6.STABLE2

<p>
<itemize>
        <item>Bug #1650: transparent interception "Unable to forward this request at this time"
	<item>Bug #1658: Memory corruption when using client-side SSL certificates
	<item>Multiple fixes to the experimental COSS cache_dir type
	<item>Added the missing concurrency parameter to basic/digest auth schemes
	<item>Bug #1669: SEGV in storeAddVaryReadOld
	<item>Bug #1670: assertion failure: i-&gt;prefix_size &gt; 0 in client_side.c:2509
	<item>Bug #1671: transparent interception fails with FreeBSD ipfw or Linux-2.2 ipchains
	<item>Bug #1660: Accept-Encoding related memory corruption
	<item>Bug #1673: cache digests not served to other caches
	<item>Bug #1684: xstrdup: tried to dup a NULL pointer!
	<item>Bug #1688: Assertion failure in HttpHeader.c in some header_access configurations
	<item>Bug #1696, Bug #1700 and more: WCCP2 fixes
	<item>Bug #1677: Duplicate etags in the If-None-Match in cache validations causing lighttpd to fail with error 400
	<item>Added ARP acl support for OpenBSD and ARP fixes for Windows
	<item>Bug #1681: All ntlmauthenticator processes are busy
	<item>new minimum_expiry_time squid.conf directive backported from Squid-3
	<item>Bug #1703: Wrong default path to the diskd helper causing hangs at 100% CPU
	<item>Bug #1685: Crashes or other odd results after storeSwapMetaUnpack: errors
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE2.html"
			name="squid-2.6.STABLE2 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>


<sect>Key changes squid-2.6.STABLE2 to 2.6.STABLE3

<p>
<itemize>
	<item>src/dst acl parsing changed to not attempt to guess a netmask
	if none was specified. Instead assume it's an IP address and not
	a network even if it ends in 0
	<item>Several memory leaks plugged
	<item>Delay pools now work again (broken in 2.6.STABLE1 & 2)
	<item>New log_format %ue and %us tags for external acl or ssl user id
	<item>COSS fixes and performance improvements
	<item>Include acl's is now shown in their original form in cachemgr configuration dumps.
	<item>ntlm fake_auth finally handles non-ascii user names
	<item>TCP fallback on truncated DNS responses, making the internal
	DNS client complete.
	<item>Downloads could hang when using the cache_dir max-size option
	<item>Fixed some assertion failures and segmentation faults
	<item>Some small optimizations to reduce CPU usage
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE3.html"
			name="squid-2.6.STABLE3 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>


<sect>Key changes squid-2.6.STABLE3 to 2.6.STABLE4

<p>
<itemize>
	<item>New wccp2_weight directive
	<item>Numeros COSS fixes and improvements
	<item>Support for WCCP2 hash based assignment and weighted assignments
	<item>Windows port update
	<item>Many small fixes to better detect invalid configurations
	<item>Bug #1760: FTP related memory leak
	<item>SNMP mib updates for some minor missing details
	<item>Bug #1590: Silence those harmless ETag loop warnings
	<item>Bug #1740: Squid crashes on certain malformed HTTP responses
	<item>Bug #1699: assertion failed: authenticate.c:836: "auth_user_request != NULL"
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE4.html"
			name="squid-2.6.STABLE4 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE4 to 2.6.STABLE5

<p>
<itemize>
        <item>Bug #1776: 2.6.STABLE4 aufs fails to compile if coss isn't enabled
        <item>COSS improvements and cleanups
        <item>Bug #1785: Memory leak in handling of negatively cached objects
        <item>Bug #1780: Incorrect Vary processing in combination with collapsed_forwarding
        <item>Bug #1779: Delay pools fairness when multiple connections compete for bandwidth
        <item>Bug #1796: Assertion error HttpHeader.c:914: "str"
        <item>All comm loops now use the generic event framework
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE5.html"
			name="squid-2.6.STABLE5 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE5 to 2.6.STABLE6

<p>
<itemize>
	<item>Bug #1805: assertion failed: StatHist.c:195: "D&lsqb;i&rsqb; &gt;= 0"
	<item>Add support for the weight= parameter to round-robin peers
	<item>Bug #1584: Unable to register with multiple WCCP2 routers
	<item>Bug #439: Multicast ICP peering is unstable and considers most peers dead
	<item>Bug #1801: NTLM authentication ends up in a loop if the server responds with a retriable error
	<item>Bug #1641: assertion failed: stmem.c:149: "size &gt; 0" while processing certain Vary objects
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE6.html"
			name="squid-2.6.STABLE6 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE6 to 2.6.STABLE7

<p>
<itemize>
	<item>Bug #1857: Segmentation fault on certain types of ftp:// requests
	<item>Bug #1848: external_acl crashes with an infinite loop under high load
	<item>Bug #1867: squid.pid isn't removed on shutdown
	<item>Bug #1792: max_user_ip not working with ntlm_auth
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE7.html"
			name="squid-2.6.STABLE7 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE7 to 2.6.STABLE8

<p>
<itemize>
	<item>Bug #1872: Date parsing error causing objects to get unexpectedly cached. Problem introduced in 2.6.STABLE6.
	<item>Bug #1873: authenticateNTLMFixErrorHeader: state 4. NTLM &amp;
	      Negotiate instability introduced in 2.6.STABLE6.
	<item>Primitive support for HTTP/1.1 chunked encoding, working around broken servers sending chunked encoding in response to HTTP/1.0 requests.
	<item>Bug #1783: STALE: Entry's timestamp greater than check time. Clock going backwards?
	<item>Don't update object timestamps on a failed revalidation.
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE8.html"
			name="squid-2.6.STABLE8 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE8 to 2.6.STABLE9

<p>
<itemize>
	<item>Bug #1878: If-Modified-Since broken in 2.6.STABLE8
	<item>Bug #1877 diskd bug in storeDiskdIOCallback()
	<item>See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE9.html"
			name="squid-2.6.STABLE9 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE9 to 2.6.STABLE10

<p>
<itemize>
	<item>Upgrade HTTP/0.9 responses to our HTTP version (HTTP/1.0)
	<item>various diskd bugfixes
	<item>In the access.log hierarchy field log the unique peer name
	  instead of the host name
	<item>logging format for HTTP-request size
	<item>Primitive support for HTTP/1.1 chunked encoding, working around
	  broken servers
	<item>a number of other minor and cosmetic bugfixes. See the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE10.html"
			name="squid-2.6.STABLE10 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE10 to 2.6.STABLE11

<p>
<itemize>
	<item>Bug #1915: assertion failed: client_side.c:4055: "buf != NULL ||
	          !conn-&gt;body.request"
	<item>Handle garbage helper responses better in concurrent protocol format
	<item>Fix kqueue when overflowing the changes queue
	<item>Make sure the child worker process commits suicide if it could not start up
	<item>Don't log short responses at debug level 1
	<item>Fix collapsed_forwarding for non-GET requests
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE11.html"
			name="squid-2.6.STABLE11 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE11 to 2.6.STABLE12

<p>
<itemize>
	<item>Assertion error on TRACE
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE12.html"
			name="squid-2.6.STABLE12 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE12 to 2.6.STABLE13

<p>
<itemize>
	<item>Make sure reply headers gets sent even if there is no body available
	      yet, fixing RealMedia streaming over HTTP issues.
	<item>Bug #1814: SSL memory leak on persistent SSL connections
	<item>Ukrainan error messages
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE13.html"
			name="squid-2.6.STABLE13 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE13 to 2.6.STABLE14

<p>
<itemize>
	<item>Make sure reply headers gets sent even if there is no body available
	      yet, fixing RealMedia streaming over HTTP issues.
	<item>Bug #1814: SSL memory leak on persistent SSL connections
	<item>Ukrainan error messages
	<item>New Kerberos Negotiate / SPNEGO helper
	<item>New SQL Database basic auth helper
	<item>New Solaris /dev/poll support
	<item>New Novell eDirectory Digest auth helper
	<item>New cache_dir min-size option
	<item>New pop3 basic auth helper
	<item>squid.conf.default cleanups
	<item>NTLM workaround for some applications not negotiating HTTP/1.0 persistent connetions
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE14.html"
		name="squid-2.6.STABLE14 changes"> and the <url url="ChangeLog"
		name="ChangeLog"> file for details.
</itemize>


<sect>Key changes squid-2.6.STABLE14 to 2.6.STABLE15

<p>
<itemize>
	<item>Portability fix for systems requiring select(). Got broken when
	adding /dev/poll support in 2.6.STABLE14
	<item>Bug #2017: Work around broken servers sending just the HTTP headers
	<item>squid.conf.default documentation update and reorganisation
	<item>access_log syslog syntax cleaned up and documented
	<item>Armenian error pages translation
	<item>Bug #2057: NTLM stop work in messengers after upgrade to 2.6.STABLE14
	<item>Bug #1972: Squid sets peers to down state when they are in fact working.
	<item>Bug #2066: chdir after chroot
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE15.html"
			name="squid-2.6.STABLE15 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE15 to 2.6.STABLE16

<p>
<itemize>
	<item>Bug #2073: assertion failed: client_side.c:4175: "buf != NULL ||
	      !conn->body.request on POST
	<item>Test for sys/capability.h linux include file to avoid failing on
	      linux systems missing libcap
	<item>More squid.conf reordering to get the dependencies between options
	      sorted proper
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE16.html"
			name="squid-2.6.STABLE16 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE16 to 2.6.STABLE17

<p>
<itemize>
	<item>A temporary memory leak fixed on cache updates
	<item>New squid_radius_auth RADIUS authentication helper
	<item>Documentation cleanups
	<item>Code cleanups and portability fixes
	<item>Several minor bugfixes
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE17.html"
			name="squid-2.6.STABLE17 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE17 to 2.6.STABLE18

<p>
<itemize>
	<item>2 assertion failures related to the fix for SQUID-2007:2
	<item>Digest authentication bugfixes, fixing random auth popups and failures when using digest authentication (auth_param digest ..)
	<item>License cleanup of edir_digest_auth
	<item>Code cleanups and portability fixes
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE18.html"
			name="squid-2.6.STABLE18 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE18 to 2.6.STABLE19

<p>
<itemize>
	<item>Bugzilla #761 : Handle recursive completion operations in diskd.
	<item>Bug #2198: assertion failed sc != NULL when using peer monitor function
	<item>Sort cache list in wccpv2 to ensure a consistent hash allocation across all services
	<item>Updated Ukrainan error pages
	<item>Documentation fixes
	<item>squid_radius_auth failed to process more than 256 requests
	<item>Make range_offset_limit 0 disable local range processing as documented
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE19.html"
			name="squid-2.6.STABLE19 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE19 to 2.6.STABLE20

<p>
<itemize>
	<item>Bug #2263: Custom log formats fail to log file sizes >2GB properly
          on 32-bit platforms
        <item>Bug #1886: tcp_outgoing_address acl doesn't work with indirect
          source address (follow-x-forwarded-for)
        <item>Bug #2296: Stuck in 100% CPU when fetching an corrupt peer digest
        <item>Add support for the resolv.conf domain directive, and also
          automatically derived default domain
        <item>minimum_icp_query_timeout directive
	<item>Bug #2329: Range header ignored on HIT
	<item>And some other trivial/cosmetic changes
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE20.html"
			name="squid-2.6.STABLE20 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

<sect>Key changes squid-2.6.STABLE20 to 2.6.STABLE21

<p>
<itemize>
	<item>Reject ridiculously large ASN.1 lengths (SNMP)
	<item>Fix SNMP reporting of counters with a value > 0xFF80000
	<item>Bug #1993: Memory leak in http_reply_access deny processing
	<item>Bug #2122: In some situations collapsed_forwarding could leak private information
	<item>Bug #2393: DNS requests retried indefinitely at full speed on failed TCP connection
	<item>Bug #2393: DNS retransmit queue could get hold up
	<item>See also the list of <url
		url="http://www.squid-cache.org/Versions/v2/2.6/changesets/SQUID_2_6_STABLE21.html"
			name="squid-2.6.STABLE21 changes"> and the <url url="ChangeLog"
				name="ChangeLog"> file for details.
</itemize>

</article>

