v4.0.18

Changes to squid-4.0.18 (06 Feb 2017):

- Bug 4661: compile error 'warning: _XPG4_2 redefined' with GCC on Solaris 10
- Bug 4636: assertion 'byteCount > 0 && byteCount <= inBuf.length()'
- Bug 4610 partial: compile errors on Solaris 11.3 with Oracle Studio 12.5
- Bug 4599: support OpenSSL 1.1
- squidclient: link GnuTLS library debugs to -v level display
- Fix GCC6: unused local variable 'weInitiatedThisClosure'
- ... and some code polishing
- ... and some copyright updates
- ... and all fixes from 3.5.24

v3.5.24

Changes to squid-3.5.24 (28 Jan 2017):

- Regression Bug 3940: Make 'cache deny' do what is documented
- TLS: Fix SSLv2 records bumping despite a matching step2 peek rule
- TLS: Mitigate DoS attacks that use client-initiated SSL/TLS renegotiation
- Fix "Source and destination overlap in memcpy" Valgrind errors
- Reduce crashes due to unexpected ClientHttpRequest termination
- Update External ACL helpers error handling and caching
- Detect HTTP header ACL issues
- ... and some documentation fixes

v4.0.17

Changes to squid-4.0.17 (16 Dec 2016):

- Bug 4630: user credentials cache cleanup not re-scheduled
- Bug 4610 partial: compile errors on Solaris 11.3 with Oracle Studio 12.5
- Bug 4599 partial: initial support for OpenSSL v1.1
- TLS: Support tunneling of bumped non-HTTP traffic
- ... and many code polishing and performance updates
- ... and some documentation updates
- ... and some fixes from 3.5.23

v3.5.23

Changes to squid-3.5.23 (16 Dec 2016):

- Bug 4627: fix generate-host-certificates and dynamic_cert_mem_cache_size docs
- Bug 4620: NetBSD build error with --enable-ipf-transparent
- Bug 4567: Strange IPv6 shown in access.log
- Bug 4406: SIGSEV in TunnelStateData::handleConnectResponse() during reconfigure and restart
- Bug 4174 partial: fix Write.cc:41 "!ccb->active()" assertion.
- Bug 4169: HIT marked as MISS when If-None-Match does not match
- Bug 4007: Hang on DNS query with dead-end CNAME
- Bug 4004 partial: Fix segfault via Ftp::Client::readControlReply
- Bug 3940 partial: hostHeaderVerify failures MISS when they should be HIT
- Bug 3533: Cache still valid after HTTP/1.1 303 See Other
- Bug 3379: Combination of If-Match and a Cache Hit result in TCP Connection Failure
- Bug 3290: authenticate_ttl not working for digest authentication
- Bug 2258: bypassing cache but not destroying cache entry
- HTTP/1.1: make Vary:* objects cacheable
- HTTP/1.1: Add registered codes entry for new 103 (Early Hints) status code
- Support IPv6 NAT with PF for NetBSD and FreeBSD
- TLS: Make key= before cert= an error instead of quietly hiding the issue
- ... and some debug updates
- ... and some build fixes
- ... and several documentation updates

v4.0.16

Changes to squid-4.0.16 (30 Oct 2016):

- Avoid segfaults when lacking the server name for certificate validator
- HTTP: initial support for Cache-Control:immutable
- Fix ssl::server_name ACL
- ... and many code polishing updates
- ... and some fixes from 3.5.23

v4.0.15

Changes to squid-4.0.15 (09 Oct 2016):

- Regression fix crash on reconfigure with TOS/DiffServ/MARK configured
- Bug 4610: compile errors on Solaris 11.3 with Oracle Studio 12.5
- Bug 4581: Secure ICAP segfault in checkForMissingCertificates
- Bug 4578: changes required to install squid.service
- Fix crash on shutdown while cleaning up idle ICAP connections
- Fix memory leak of Downloader-related objects
- HTTP/1.1: handle syntactically valid requests with unsupported HTTP versions
- Log TCP client port for error:transaction-end-before-headers and such
- ... and many portability and build fixes
- ... and some documentation updates
- ... and all fixes from 3.5.22

v3.5.22

Changes to squid-3.5.22 (09 Oct 2016):

- Bug 4594: build failure with clang 3.9
- Bug 4471: revalidation does not work when expired cached object lacks Last-Modified
- Bug 4302 pt2: IPv6 support for IPFilter v5 transparent interception
- Bug 4228: ./configure bug/typo in r14394
- Bug 3819: "fd >= 0" assertion in file_write() during reconfiguration
- Bug 2833: Collapse internal revalidation requests (SMP-unaware caches)
- Fix logged request size (%http::>st) and other size-related %codes
- Fix some memory leaks from putenv()
- Fix memory leaks from url_rewrite_extras and store_id_extras on reconfigure/shutdown
- Fix segfault crash when debugging section 4 at level 9
- HTTP: MUST ignore a [revalidation] response with an older Date header

v4.0.14

Changes to squid-4.0.14 (08 Sep 2016):

- Regression Bug 4570: crash after rev.14755
- Regression Bug 4561: Replace use of default move operators with explicit implementation
- Bug 4503: Do not access-log SslBump-faked CONNECTs with _ABORTED suffixes
- Bug 4404: Do not access-log chunked non-persistent responses with _ABORTED suffix
- Fix crashes on shutdown while cleaning up idle ICAP connections
- Fix logformat unable to configure codes with /-escape
- HTTP: MUST respond with 414 (URI Too Long) when request-target exceeds limits
- HTTP: validate Content-Length header values
- Make Squid death due to overloaded helpers optional
- Better support for unknown URL schemes
- Do not log error:transaction-end-before-headers after invalid requests
- ... and many portability and build fixes
- ... and some documentation updates
- ... and all fixes from 3.5.20

v3.5.21

Changes to squid-3.5.21 (08 Sep 2016):

- Bug 4563: duplicate code in httpMakeVaryMark
- Bug 4542: authentication credentials IP TTL updated incorrectly
- Bug 4534: assertion failure in xcalloc when using many cache_dir
- Bug 4428: mal-formed Cache-Control:stale-if-error header
- Bug 3025: Proxy-Authenticate problem using ICAP server
- Fix segfault via Ftp::Client::readControlReply()
- Fix SSL-Bump failure results in SEGFAULT
- HTTP/1.1: MUST always revalidate Cache-Control:no-cache responses
- HTTP/1.1: do not allow Proxy-Connection to override Connection header
- SSL: CN wildcard must only match a single domain component [fragment]

v4.0.13

Changes to squid-4.0.13 (05 Aug 2016):

- Regression Bug 4540: revert r14720 buffer update
- Bug 4555: Minor improvements to error pages CSS
- Bug 4551: fix exceptions in new chunked decoder
- Bug 4311: support collapse for internal revalidation requests (SMP-unaware caches)
- Fix Certificate Validator buffer-overflow crashes Squid
- Fix some failed transactions not being logged
- Fix segfault via Ftp::Client::readControlReply().
- basic_db_auth: add support for unsalted SHA1 passwords
- kerberos_ldap_group: add support for SSL/TLS connection to an LDAP server
- TLS: Add missing 'tls' option for cache_peer
- TLS: Do not hang when 'connector' fails
- TLS: Add support for fetching missing certificates
- Remove XSTD_USE_LIBLTDL, which has not been needed in a long while
- ... and many code polishing updates
- ... and some documentation updates