Author: Alex Rousskov
Revision Date: 2017-07-06 19:19:42 UTC

Removed all differences with v5 r15230

... remaining after (or made by) bag1 r12459.

Author: Christos Tsantilas
Revision Date: 2017-06-29 07:26:24 UTC

Try fixing compile problems after r13879

Author: Alex Rousskov
Revision Date: 2017-05-30 15:46:29 UTC

Count failures and use peer-specific connect timeouts when tunneling.

Same as v4 r15025.

Author: Alex Rousskov
Revision Date: 2017-05-22 17:28:31 UTC

Do not unconditionally revive dead peers after a DNS refresh.

A simpler version of v5 r15145 (and bag14 r14071).

Author: Alex Rousskov
Revision Date: 2017-05-19 17:41:16 UTC

Assorted fixes and improvements accumulated for several years.

Author: eduard-bagdasaryan
Revision Date: 2017-01-30 13:50:37 UTC

Autoformatted.

Author: eduard-bagdasaryan
Revision Date: 2016-07-15 22:05:22 UTC

Auto-formatted

Author: eduard-bagdasaryan
Revision Date: 2016-07-06 08:07:55 UTC

Merged from trunk r14734

Author: Alex Rousskov
Revision Date: 2016-03-11 17:10:47 UTC

Polished to address official review concerns.

No functionality changes expected.

Author: Christos Tsantilas
Revision Date: 2015-06-08 16:31:06 UTC

Fix assertion String.cc:221: "str"

This bug can be caused by certificates does not contain a CN field. In this
case the Ssl::ErrorDetail::cn method may return NULL causing this assertion
somewhere inside Ssl::ErrorDetail::buildDetail method, which expects always
a non NULL value from Ssl::ErrorDetail::cn and similar methods.

This patch try to hardening the Ssl::ErrorDetail error formating functions to
avoid always check for NULL values and also avoid sending wrong information
for various certificate fields in the case of an error while extracting the
information from certificate..

This is a Measurement Factory project

same as squid-3.5 r13846

Author: Christos Tsantilas
Revision Date: 2015-04-23 18:30:38 UTC

Secure ICAP

This patch adds support for ICAP services that require SSL/TLS transport
connections. The same options used for the cache_peer directive are used for
the icap_service directive, with similar certificate validation logic.

To mark an ICAP service as "secure", use an "icaps://" service URI scheme when
listing your service via an icap_service directive. The industry is using a
"Secure ICAP" term, and Squid follows that convention, but "icaps" seems more
appropriate for a _scheme_ name.

Squid uses port 11344 for Secure ICAP by default, following another popular
proxy convention. The old 1344 default for plain ICAP ports has not changed.

This is a Measurement Factory project

This is the t5 patch posted to squid-dev

Author: Alex Rousskov
Revision Date: 2014-09-19 00:27:10 UTC

A hack to ease transition from legacy configurations
still using server_ssl_cert_fingerprint instead of server_cert_fingerprint.

Author: Alex Rousskov
Revision Date: 2014-08-26 15:58:49 UTC

Ignore Range headers with unidentifiable byte-range values.

Same as trunk r13555.

Author: Alex Rousskov
Revision Date: 2014-06-25 00:16:52 UTC

Merged from trunk r13477
to get Collapsed Forwarding fixes.

Author: Alex Rousskov
Revision Date: 2014-03-13 04:25:28 UTC

Added secure peer support to the steady connection pool feature
(cache_peer ... ssl steady=N).

Supply a fake HTTP OPTIONS request to getOutgoingAddress() and
GetMarkingsToServer() to make their ACLs happier. The request is also needed
for Ssl::PeerConnector's ErrorState generation code.

Polished/finalized Ssl::PeerConnector callback answer API.

Removed double-negotiateSsl() call from Ssl::PeerConnector. The old bug did
not manifest itself except under valgrind tests for some reason.

Author: Alex Rousskov
Revision Date: 2014-03-13 21:24:19 UTC

Avoid assertions on Range requests that trigger Squid-generated errors.

Same as trunk r13306.

Author: Alex Rousskov
Revision Date: 2014-01-21 00:47:55 UTC

Simplify SSL session cache label used for naming the shared segment
in hope to avoid "Permission denied" errors for that segment on some appliances.

Same as bag5 r12741.

Author: Christos Tsantilas
Revision Date: 2014-01-08 11:31:19 UTC

merge from trunk

Author: Alex Rousskov
Revision Date: 2013-11-29 18:14:15 UTC

Make SupportedVersion() arguments "consistent" and use the newly added SBuf.

Author: Alex Rousskov
Revision Date: 2013-06-06 16:44:00 UTC

Do not log bogus ERRORs when url_rewrite_access bypasses url_rewriter.

Same as trunk r12896.

Author: Alex Rousskov
Revision Date: 2013-05-17 02:23:45 UTC

Moved most of the helper queue overflow maintenance from callers into the helper class.
Documented overflow maintenance logic.

TODO: Make the queue limits configurable. Propagate changes to stateful helpers.
Remove remaining custom maintenance code from StoreID and URL rewriter helpers.

Author: Alex Rousskov
Revision Date: 2013-03-23 03:58:17 UTC

Support proper bootstrapping and "make dist".

Author: Alex Rousskov
Revision Date: 2013-03-23 02:07:38 UTC

Initial support for "values with spaces" in ACL directives.

Needs more work to support escape sequences, macros, and include files, but
can be disabled using "configuration_includes_quoted_values off" in squid.conf.

Needs better documentation.

Author: Christos Tsantilas
Revision Date: 2012-12-07 14:01:35 UTC

Fix to allow build on amd64-CentOs-icc

Author: Christos Tsantilas
Revision Date: 2012-12-07 13:42:26 UTC

Ssl::CertValidationMsg::parseResponse: fix parsed errors checking

The parsed SSL errors returned by cert validator checking was wrong and caused
the Ssl::CertValidationMsg::parseResponse method to return false on valid
messages

Author: Alex Rousskov
Revision Date: 2012-12-03 02:27:39 UTC

Fixed storing SSL session data in the shared cache.

i2d_SSL_SESSION() increments buffer pointer passed to it, so we cannot use
that pointer to retrieve buffer contents that i2d_SSL_SESSION() created.

And if the above increment did not happen (perhaps the increment is OpenSSL
version dependent?), our Ipc::MemMapSlot::set() was copying session data
pointed by "block" into Slot::p data member while "block" was already pointing
to p, violating memcpy() "no overlap" prerequisite.

Author: Christos Tsantilas
Revision Date: 2012-11-13 13:10:18 UTC

cert validation cache

The
 - investigates the LruMap template class which can be used to implement object
   caches in squid
 - Use LruMap as cache for SSL_CTX objects. The LocalContextStorage removed and
   replaced with a LruMap based class.
 - Use LruMap to cache cert validator responses. New parameters add to cert
   validator helper line to allow user control caching behaviour:
     ttl=n TTL in seconds for cached results.The default is 60 secs
     cache=n limit the result cache size. The default value is 2048

Author: Alex Rousskov
Revision Date: 2012-10-13 05:12:56 UTC

GCC v4.1.2 requires <new> for the placement-new operator to be declared.

Author: Alex Rousskov
Revision Date: 2012-03-06 03:57:40 UTC

Merged from parent (trunk r12075, v3.2.0.15+).