Squid 3.0 发行注记

syd168

Squid 3.0 release notes
Squid Developers
$Id: release-3.0.html,v 1.2 2003/09/06 10:55:57 hno Exp $
--------------------------------------------------------------------------------
This document contains the release notes for version 3.0 of Squid. Squid is a WWW Cache application developed by the National Laboratory for Applied Network Research and members of the Web Caching community.
--------------------------------------------------------------------------------

1. Key changes from squid 2.5:

Convert core squid source to C++ (Robert Collins).
http_port optional, allowing for SSL-only operation. Squid will refuse to start unless at least one port is defined. (Henrik Nordström).
Ability to read the configuration file from an external program pipe (Henrik Nordström).
Major cleanup or CARP. Now plays well with the other peering algorithms as just another non-ICP peering method. This also allows CARP support to be compiled by default with no need to recompile Squid to use CARP (Henrik Nordström)
Class 4 delay pools - user specific buckets. (Robert Collins).
Comms layer refactored to increase efficiency (Adrian Chadd).
epoll support (David Nicklay)
kqueue support (Adrian Chadd)
Range processing moved from client side to both client and server (Robert Collins).
Added support for sys/bitypes.h, apparently needed for some of the bittypes on tru64 and possibly others. (Henrik Nordström)
Edge Side Include implementation (www.esi.org). (Robert Collins).
Reduce the depth of recursion in make, improving make -j performance. (Robert Collins)
Cleanup of the relation between accelerated request and transparently intercepted request. The two are now handled separately from each other. This fixes two issues:
Transparently intercepted requests is no longer under the restrictions of accelerated requests in peering relations etc..
No risk of confusion in authentication. Authentication is now allowed for accelerated requests but not transparently intercepted requests.
(Henrik Nordström)
Change --disable-hostname-checks to --enable-hostname-checks, default to not verify hostname sanity. (Henrik Nordström)
also removed the dot magics from hostname parsing. These are more evil than helpful and breaks semantic transparency in certain configurations. (Henrik Nordström)
added reporting of "rocess Data Segment Size via sbrk()" when sbrk() call exists. According to the sbrk() man page, calling sbrk(0) returns the end of the data segment. By storing the data segment offset when Squid starts, we can report the size of the data segment at any time. This might be a better metric than getrusage()'s MAX RSS, which, in my experience, is often less than the process size reported by 'ps' (presumably because some of the processes memory is swapped to disk). However, initial tests show that the sbrk() trick reports a value slightly smaller than reported by 'ps'. (Duane Wessels)
failure_ratio is a ratio, not a percentage. Removed %% from printf. (Duane Wessels)
Start using inline C and C++ code via .cci source files. This defaults to inlined, with a configure option to disable for troubleshooting or development. (Robert Collins).
Better MacOSX support (Robert Collins, Adrian Chadd, Henrik Nordström)
--with-filedescriptors=XX configure option (Francesco Chemolli)
UNIX domain IPC now used by default for helpers, no loger relying on TCP/IP sockets via loopback. (Henrik Nordström)
Removed potentially dangerous debugging related configure options. Developers know how to edit configure.in or set defines. (Henrik Nordström)
--enable-large-files to enable support for large files (>2GB) on 32-bit GNU libc systems. (Henrik Nordström)
Digest auth helper improvements (Robert Collins, Sean Burford)
Digest authentication scheme bugfixs & improvements (Robert Collins)
accelerator mode cleaned up, using the design from the rproxy development branch
The httpd_accel_* directives is now gone, replaced by http(s)_port options and cache_peer based request forwarding.
The http(s)_port options has a list of new options for controlling the type and mode of port created with respect to
transparent proxying
plain acceleration
host header based acceleration
normal proxying (default)
To enforce a reasonable level of security in accelerators, accelerated requests are denied to go direct unless forced by always_direct.
(Henrik Nordström)
Cache manager auth helper output tidyup (Duane Wessels).
Native Windows port enhancements:
Another fix for profiling support
Added correct timezone handling
Fixed rotate problem
Added native Windows support to client.cc
This patch add the native Windows support for profiling and fix some C++/C include files problems.
Support for Windows .NET (5.2).
Added native Windows and Cygwin support to pinger.cc
Introduced the use of IPPROTO_TCP and IPPROTO_UDP defines instead of '0' on comm_open, needed by Winsocket. See this old squid-dev thread about http://www.squid-cache.org/mail- ... ev/200108/0162.html.
Added native Windows support to cachemgr.cc
Added native Windows support to dnsserver.cc
On Windows, fork() is not available, so we need to use a workaround in store_dir.cc for create store directories sequentially
By Guido Serassio.
SSL support update
SSL encrypted peers
https:// gatewaying/proxying for clients not supporting SSL or URLs rewritten via a redirector to https://...
Client certificate support
Hardware crypto SSL acceleration support via OpenSSL engine
SSL key/certificate now read while parsing squid.conf to support secure key protection in combination with chroot..
A few minor bugfixes/optimizations
(Henrik Nordström)
--enable-default-hostsfile configure option by Guido Serassio. Tells the default /etc/hosts file location
New squid.conf directive to disable hostname verifications. It isn't really our business to enforce what characters is used in hostnames. (Henrik Nordström).
Peering enhancement options for satellite or other high latency links by Robert Cohen.
Cleanup of authentication forwarding, and added authentication gatewaying proxy->reverseproxy when the same Squid is acting as both proxy and reverseproxy with authentication. (Henrik Nordström)
The mailto links on Squid's ERR pages now contain data about the cccurred error by default, so that the email will contain this data in its body. This feature can be disabled via the email_err_data directive. (Clemens Löser)
pipeline_prefetch is disabled and known to be broken due to internal store_client_copy() change (Henrik Nordström)
ncsa_auth extened with support for MD5 hashes. (Henrik Nordström)
Complain if open of /dev/null fails; avoids infinite loop in ipcCreate() and gives a correct error message should this occur.
Properly quote the quoting character '%' in log_quote() and username_quote().
in icmpRecv(), Handle the case when recv() returns EAGAIN and do not treat it like an error.
Update squid to build with gcc/g++ 3.3 with no warnings.
wb_group updated to support domain qualified groups (Guido Serassio)
most helper interfaces now support multiple overlapping requests (external_acl_type, redirect_program, basic auth).
custom log formats, and the ability to log different requests to different log files.
ext_user acl type added for matching the user name returned by external acls. Not longer abusing the ident acl for this purpose
external_acl extended with soft timeouts
external_acl can optionally return information to be logged in access.log
Requests denied due to 'http_reply_access' are now logged with TCP_DENIED_REPLY.
Added counters for HTCP messages sent and received, reported in 'info' cache manager page.
Fixed 'ICP dynamic timeout algorithm ignores multicast' bug
Bug #743: "#ifdef HTTP_VIOLATIONS" should be "#if HTTP_VIOLATIONS"

2. Changes to squid.conf

read_ahead_gap
Config directive by Jeffrey D. Wheelhouse. Allows the read-ahead gap to be configured from squid.conf (previously hardcoded at 16 KB)

request_entities
New squid.conf directive "request_entities on/off".If set to "on" then Squid will allow GET/HEAD requests with request entities, even if such entites are "undefined" in the HTTP specification. (Henrik Nordström)

cache_peer
New options for reverse proxy setups

originserver
name=XXX
forceddomain=XXX

https_port
Many new SSL options

dhparams=/path/to/file.pem
https_port option to specify DH parameters for forward-secrecy in encryption. (Henrik Nordström)

clientca= etc
specifies which CA to accept client certificates from

defaultsite
specifies the accelerated site name


http(s)_port
Many new options to control acceleration, transparent proxying etc

header_replace
This is now dependent on --disable-http-violations (Henrik Nordström)

email_err_data
Allow disabling the data now embedded in the mailto links on Squid's ERR pages.

reply_body_max_size
No longer uses allow/deny. Instead it is specified as a size followed by acl elements. The size "none" can be used for no limit (the default)

external_acl_type
The argument which was named concurrenty= in Squid-2.5 is now named children=. concurrency= has a different meaing in Squid-3.0 and your external acls will not work until updated.

ext_user acl
this acl matches the username returned by external acl. ident can no longer be used for this purpose.

access_log
The access_log directive now optionally includes specifications on what log format to use and acls matching which requests to log. Can be specified multiple times to log different requests to different files.

logformat
new directive to define custom log formats

httpd_accel_*
These directives have been replaced by http(s)_port options and cache_peer based request forwarding. Note that you can no longer run proxy and acceleration mode on the same port. If you previously did this you now need to define two ports, one for acceleration, one for proxying.


3. Known limitations

SSL Acceleration Support - CRL's are not currently supported. The design has been completed, but time to implement is missing - contact squid-dev@squid-cache.org for more details.
tcp_outgoing_addr/tos uses "fast" ACL checks and is somewhat limited in what kind of acl types you may use. Probably only src/my_port/my_addr/dstdomain/method/port/url* acl types is reliable.
reply_body_max_size is uses "fast" ACL checks and may occationally fail on acls which may require external lookups (dst/srcdomain/external).

4. Other internal changes mostly of interest to developers

Andres Kroonmaa's chunked memory pool allocator included.
clientStreams, rationalising the client side logic to allow plugin output streams, and providing a simple interface to the store. See the programmers guide for details. (Robert Collins).
Clean up the squid code to consistenly use [u_]int<len>_t throughout, rather than some [u_]num<len> and some [u_]<len>_t instances. (Robert Collins).
Spelling corrections by Reuben Farrelly.
Object reference counting supported to ease some programming tasks (Robert Collins).
Deferred reads removed from comms layer, implemented a layer above, allowing more efficent comms layers (such as epoll). (Robert Collins).
ACL Source code extracted into multiple separate classes, allowing great flexability in future development, and also for custom squid builds today. (Robert Collins)
Delay classes heavily refactored to allow easier extension and reuse. (Robert Collins).
autoconf 2.5 support (Robert Collins).
Hi-resolution CPU profiling from Andres Kroonma, for single-threaded use only.
Cleaned up module/helper configure checks to use the same logics everywhere. (Henrik Nordstr&ouml;m)
Unify much of the IO logic, shrinking the code base for diskd/aufs/ufs. (Robert Collins).
Introduce 'make check' support to provide an automated test suite for squid. (Robert Collins).
pthreads detection and compilation bugfixes. (Henrik Nordstr&ouml;m, Robert Collins)
Killed the remains of ALARM_UPDATES_TIME (--enable-time-hack) (Henrik Nordstr&ouml;m)
Centralised the IPC type selection to defines.h by the defines IPC_STREAM and IPC_DGRAM. (Henrik Nordstr&ouml;m)
Astyle is the code formatter of choice for squid-3 C++ code. See http://www.squid-cache.org/ robertc/squid-3-style.txt for the squid 3 style conventions.
Fix "access_log none" (and "forward_log none") (Arkadi E. Shishlov).

syd168

所有的配置参数
Usage: configure [options] [host]
Options: [defaults in brackets after descriptions]
Configuration:
  --cache-file=FILE       cache test results in FILE
  --help                  print this message
  --no-create             do not create output files
  --quiet, --silent       do not print `checking...' messages
  --site-file=FILE        use FILE as the site file
  --version               print the version of autoconf that created configure
Directory and file names:
  --prefix=PREFIX         install architecture-independent files in PREFIX
                          [/usr/local/squid]
  --exec-prefix=EPREFIX   install architecture-dependent files in EPREFIX
                          [same as prefix]
  --bindir=DIR            user executables in DIR [EPREFIX/bin]
  --sbindir=DIR           system admin executables in DIR [EPREFIX/sbin]
  --libexecdir=DIR        program executables in DIR [EPREFIX/libexec]
  --datadir=DIR           read-only architecture-independent data in DIR
                          [PREFIX/share]
  --sysconfdir=DIR        read-only single-machine data in DIR [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data in DIR
                          [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data in DIR [PREFIX/var]
  --libdir=DIR            object code libraries in DIR [EPREFIX/lib]
  --includedir=DIR        C header files in DIR [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc in DIR [/usr/include]
  --infodir=DIR           info documentation in DIR [PREFIX/info]
  --mandir=DIR            man documentation in DIR [PREFIX/man]
  --srcdir=DIR            find the sources in DIR [configure dir or ..]
  --program-prefix=PREFIX prepend PREFIX to installed program names
  --program-suffix=SUFFIX append SUFFIX to installed program names
  --program-transform-name=PROGRAM
                          run sed PROGRAM on installed program names
Host type:
  --build=BUILD           configure for building on BUILD [BUILD=HOST]
  --host=HOST             configure for HOST [guessed]
  --target=TARGET         configure for TARGET [TARGET=HOST]
Features and packages:
  --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
  --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
  --x-includes=DIR        X include files are in DIR
  --x-libraries=DIR       X library files are in DIR
--enable and --with options recognized:
  --disable-dependency-tracking Speeds up one-time builds
  --enable-dependency-tracking  Do not reject slow dependency extractors
  --enable-maintainer-mode enable make rules and dependencies not useful
                          (and sometimes confusing) to the casual installer
  --enable-dlmalloc[=LIB] Compile & use the malloc package by Doug Lea
  --enable-gnuregex       Compile GNUregex
  --enable-xmalloc-statistics
                          Show malloc statistics in status page
  --enable-carp           Enable CARP support
  --enable-async-io[=N_THREADS]
                          Shorthand for
                          --with-aufs-threads=N_THREADS
                          --with-pthreads
                          --enable-storeio=ufs,aufs
  --with-aufs-threads=N_THREADS
                          Tune the number of worker threads for the aufs object
                          store.
  --with-pthreads         Use POSIX Threads
  --with-aio              Use POSIX AIO
  --with-dl               Use dynamic linking
  --enable-storeio="list of modules"
                          Build support for the list of store I/O modules.
                          The default is only to build the ufs module.
                          See src/fs for a list of available modules, or
                          Programmers Guide section <not yet written>
                          for details on how to build your custom store module
  --enable-heap-replacement
                          Backwards compatibility option. Please use the
                          new --enable-removal-policies directive instead.
  --enable-removal-policies="list of policies"
                          Build support for the list of removal policies.
                          The default is only to build the lru module.
                          See src/repl for a list of available modules, or
                          Programmers Guide section 9.9 for details on how
                          to build your custom policy
  --enable-icmp           Enable ICMP pinging
  --enable-delay-pools    Enable delay pools to limit bandwidth usage
  --enable-useragent-log  Enable logging of User-Agent header
  --enable-referer-log    Enable logging of Referer header
  --disable-wccp          Disable Web Cache Coordination Protocol
  --enable-kill-parent-hack
                          Kill parent on shutdown
  --enable-snmp           Enable SNMP monitoring
  --enable-cachemgr-hostname[=hostname]
                          Make cachemgr.cgi default to this host
  --enable-arp-acl        Enable use of ARP ACL lists (ether address)
  --enable-htcp           Enable HTCP protocol
  --enable-ssl            Enable ssl gatewaying support using OpenSSL
  --with-openssl[=prefix]
                          Compile with the OpenSSL libraries. The path to
                          the OpenSSL development libraries and headers
                          installation can be specified if outside of the
                          system standard directories
  --enable-forw-via-db    Enable Forw/Via database
  --enable-cache-digests  Use Cache Digests
                          see http://www.squid-cache.org/FAQ/FAQ-16.html
  --enable-default-err-language=lang
                          Select default language for Error pages (see
                          errors directory)
  --enable-err-languages="lang1 lang2.."
                          Select languages to be installed. (All will be
                          installed by default)
  --with-coss-membuf-size COSS membuf size (default 1048576 bytes)
  --enable-poll           Enable poll() instead of select().  Normally poll
                          is preferred over select, but configure knows poll
                          is broken on some platforms.  If you think you are
                          smarter than the configure script, you may enable
                          poll with this option.
  --disable-poll          Disable the use of poll().
  --disable-http-violations
                          This allows you to remove code which is known to
                          violate the HTTP protocol specification.
  --enable-ipf-transparent
                          Enable Transparent Proxy support for systems
                          using IP-Filter network address redirection.
  --enable-pf-transparent
                          Enable Transparent Proxy support for systems
                          using PF network address redirection.
  --enable-linux-netfilter
                          Enable Transparent Proxy support for Linux 2.4.
  --enable-leakfinder
                          Enable Leak Finding code.  Enabling this alone
                          does nothing; you also have to modify the source
                          code to use the leak finding functions.  Probably
                          Useful for hackers only.
  --disable-ident-lookups
                          This allows you to remove code that performs
                          Ident (RFC 931) lookups.
  --disable-internal-dns  This prevents Squid from directly sending and
                          receiving DNS messages, and instead enables the
                          old external 'dnsserver' processes.
  --enable-truncate       This uses truncate() instead of unlink() when
                          removing cache files.  Truncate gives a little
                          performance improvement, but may cause problems
                          when used with async I/O.  Truncate uses more
                          filesystem inodes than unlink..
  --disable-hostname-checks
                          Squid by default rejects any host names with
                          odd characters in their name to conform with
                          internet standards. If you disagree with this
                          you may use this switch to turn off any such
                          checks, provided that the resolver used by
                          Squid does not reject such host names.. This
                          may be required to participate in testbeds for
                          international domain names.
  --enable-underscores    Squid by default rejects any host names with _
                          in their name to conform with internet standards.
                          If you disagree with this you may allow _ in
                          hostnames by using this switch, provided that
                          the resolver library on the host where Squid runs
                          does not reject _ in hostnames...
  --enable-auth="list of auth scheme modules"
                          Build support for the list of authentication schemes.
                          The default is to build support for the Basic scheme.
                          See src/auth for a list of available modules, or
                          Programmers Guide section authentication schemes
                          for details on how to build your custom auth scheme
                          module
  --enable-auth-modules="list of helpers"
                          Backwards compatibility alias for
                          --enable-basic-auth-helpers
  --enable-basic-auth-helpers="list of helpers"
                          This option selects which basic scheme proxy_auth
                          helpers to build and install as part of the normal
                          build process. For a list of available
                          helpers see the helpers/basic_auth directory.
  --enable-ntlm-auth-helpers="list of helpers"
                          This option selects which proxy_auth ntlm helpers
                          to build and install as part of the normal build
                          process. For a list of available helpers see
                          the helpers/ntlm_auth directory.
  --enable-digest-auth-helpers="list of helpers"
                          This option selects which digest scheme authentication
                          helpers to build and install as part of the normal build
                          process. For a list of available helpers see the
                          helpers/digest_auth directory.
  --enable-ntlm-fail-open Enable NTLM fail open, where a helper that fails one of the
                          Authentication steps can allow squid to still authenticate
                          the user.
  --enable-external-acl-helpers="list of helpers"
                          This option selects which external_acl helpers to
                          build and install as part of the normal build
                          process. For a list of available helpers see the
                          helpers/external_acl directory.
  --with-samba-sources=/path/to/samba-source-tree
                          Path where the correct Samba source files can be
                          found while building winbind helpers. (defaults to
                          use internal copies of the headers from Samba-2.2.7)
                          
  --disable-unlinkd       Do not use unlinkd
  --enable-stacktraces    Enable automatic call backtrace on fatal errors
  --enable-x-accelerator-vary
                          Enable support for the X-Accelerator-Vary
                          HTTP header. Can be used to indicate
                          variance within an accelerator setup.
                          Typically used together with other code
                          that adds custom HTTP headers to the requests.