summaryrefslogtreecommitdiff
path: root/network/squid
diff options
context:
space:
mode:
Diffstat (limited to 'network/squid')
-rw-r--r--network/squid/README2
-rw-r--r--network/squid/squid.SlackBuild6
-rw-r--r--network/squid/squid.conf352
-rw-r--r--network/squid/squid.conf.documented339
-rw-r--r--network/squid/squid.info6
5 files changed, 497 insertions, 208 deletions
diff --git a/network/squid/README b/network/squid/README
index e11228d124..aab94c3746 100644
--- a/network/squid/README
+++ b/network/squid/README
@@ -7,6 +7,6 @@ Squid supports SSL, extensive access controls, and full request logging.
By using the lightweight Internet Cache Protocol, squid caches can be
arranged in a hierarchy or mesh for additional bandwidth savings.
-See /usr/doc/squid-3.1.10/README.SBo for configuration help.
+See /usr/doc/squid-*/README.SBo for configuration help.
Note that the default squid.conf and /etc/logrotate.d/squid files have
changed in this release, so be sure to merge the changes into place.
diff --git a/network/squid/squid.SlackBuild b/network/squid/squid.SlackBuild
index 32fca21b37..4b4349e874 100644
--- a/network/squid/squid.SlackBuild
+++ b/network/squid/squid.SlackBuild
@@ -24,7 +24,7 @@
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
PRGNAM=squid
-VERSION=3.1.12
+VERSION=${VERSION:-3.1.20}
BUILD=${BUILD:-1}
TAG=${TAG:-_SBo}
@@ -73,6 +73,7 @@ find . \
\( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
-exec chmod 644 {} \;
+# last option is needed on current
CFLAGS="$SLKCFLAGS" \
CXXFLAGS="$SLKCFLAGS" \
./configure \
@@ -89,7 +90,8 @@ CXXFLAGS="$SLKCFLAGS" \
--enable-basic-auth-helpers="NCSA" \
--enable-linux-netfilter \
--enable-async-io \
- --build=$ARCH-slackware-linux
+ --build=$ARCH-slackware-linux \
+ --disable-strict-error-checking
make all
make install DESTDIR=$PKG
diff --git a/network/squid/squid.conf b/network/squid/squid.conf
index ecf4319bd7..804bdc8de8 100644
--- a/network/squid/squid.conf
+++ b/network/squid/squid.conf
@@ -1,21 +1,27 @@
-# WELCOME TO SQUID 3.1.12
+# WELCOME TO SQUID 3.1.20
# ----------------------------
-#
-# This is the default Squid configuration file. You may wish
-# to look at the Squid home page (http://www.squid-cache.org/)
-# for the FAQ and other documentation.
-#
-# The default Squid config file shows what the defaults for
-# various options happen to be. If you don't need to change the
-# default, you shouldn't uncomment the line. Doing so may cause
-# run-time problems. In some cases "none" refers to no default
-# setting at all, while in other cases it refers to a valid
-# option - the comments for that keyword indicate if this is the
-# case.
+#
+# This is the documentation for the Squid configuration file.
+# This documentation can also be found online at:
+# http://www.squid-cache.org/Doc/config/
+#
+# You may wish to look at the Squid home page and wiki for the
+# FAQ and other documentation:
+# http://www.squid-cache.org/
+# http://wiki.squid-cache.org/SquidFaq
+# http://wiki.squid-cache.org/ConfigExamples
+#
+# This documentation shows what the defaults for various directives
+# happen to be. If you don't need to change the default, you should
+# leave the line out of your squid.conf in most cases.
+#
+# In some cases "none" refers to no default setting at all,
+# while in other cases it refers to the value of the option
+# - the comments for that keyword indicate if this is the case.
#
# Configuration options can be included using the "include" directive.
-# Include takes a list of files to include. Quoting and wildcards is
+# Include takes a list of files to include. Quoting and wildcards are
# supported.
#
# For example,
@@ -38,6 +44,9 @@
# none
# TAG: incoming_rate
+#Default:
+# none
+
# TAG: server_http11
# Remove this line. HTTP/1.1 is supported by default.
#Default:
@@ -384,9 +393,8 @@
# cached entry should be initiated without needing to
# wait for a new reply. (default 0 for no grace period)
# protocol=2.5 Compatibility mode for Squid-2.5 external acl helpers
-# ipv4 / ipv6 IP-mode used to communicate to this helper.
-# For compatability with older configurations and helpers
-# the default is currently 'ipv4'.
+# ipv4 / ipv6 IP protocol used to communicate with this helper.
+# The default is to auto-detect IPv6 and use it when available.
#
# FORMAT specifications
#
@@ -425,6 +433,9 @@
# list separator. ; can be any non-alphanumeric
# character.
#
+# %% The percent sign. Useful for helpers which need
+# an unchanging input format.
+#
# In addition to the above, any string specified in the referencing
# acl will also be included in the helper request line, after the
# specified formats (see the "acl external" directive)
@@ -474,8 +485,9 @@
#
# When using "file", the file should contain one item per line.
#
-# By default, regular expressions are CASE-SENSITIVE. To make
-# them case-insensitive, use the -i option.
+# By default, regular expressions are CASE-SENSITIVE.
+# To make them case-insensitive, use the -i option. To return case-sensitive
+# use the +i option between patterns, or make a new ACL line without -i.
#
# Some acl types require suspending the current request in order
# to access some external data source.
@@ -926,18 +938,23 @@ htcp_access deny all
# htcp_clr_access deny all
# TAG: miss_access
-# Use to force your neighbors to use you as a sibling instead of
-# a parent. For example:
+# Determins whether network access is permitted when satisfying a request.
+#
+# For example;
+# to force your neighbors to use you as a sibling instead of
+# a parent.
#
# acl localclients src 172.16.0.0/16
# miss_access allow localclients
# miss_access deny !localclients
#
-# This means only your local clients are allowed to fetch
-# MISSES and all other clients can only fetch HITS.
+# This means only your local clients are allowed to fetch relayed/MISS
+# replies from the network and all other clients can only fetch cached
+# objects (HITs).
#
-# By default, allow all clients who passed the http_access rules
-# to fetch MISSES from us.
+#
+# The default for this setting allows all clients who passed the
+# http_access rules to relay via this proxy.
#
# This clause only supports fast acl types.
# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
@@ -1054,14 +1071,16 @@ htcp_access deny all
# accelerators should consider the default.
# Implies accel.
#
-# vhost Accelerator mode using Host header for virtual
-# domain support. Implies accel.
+# vhost Accelerator mode using Host header for virtual domain support.
+# Also uses the port as specified in Host: header unless
+# overridden by the vport option. Implies accel.
#
-# vport Accelerator with IP based virtual host support.
-# Implies accel.
+# vport Virtual host port support. Using the http_port number
+# instead of the port passed on Host: headers. Implies accel.
#
-# vport=NN As above, but uses specified port number rather
-# than the http_port number. Implies accel.
+# vport=NN Virtual host port support. Using the specified port
+# number instead of the port passed on Host: headers.
+# Implies accel.
#
# protocol= Protocol to reconstruct accelerated requests with.
# Defaults to http.
@@ -1173,6 +1192,10 @@ http_port 3128
# 4 TLSv1 only
#
# cipher= Colon separated list of supported ciphers.
+# NOTE: some ciphers such as EDH ciphers depend on
+# additional settings. If those settings are
+# omitted the ciphers may be silently ignored
+# by the OpenSSL library.
#
# options= Various SSL engine options. The most important
# being:
@@ -1181,8 +1204,8 @@ http_port 3128
# NO_TLSv1 Disallow the use of TLSv1
# SINGLE_DH_USE Always create a new key when using
# temporary/ephemeral DH key exchanges
-# See src/ssl_support.c or OpenSSL SSL_CTX_set_options
-# documentation for a complete list of options.
+# See OpenSSL SSL_CTX_set_options documentation for a
+# complete list of options.
#
# clientca= File containing the list of CAs to use when
# requesting a client certificate.
@@ -1199,7 +1222,10 @@ http_port 3128
# the capath. Implies VERIFY_CRL flag below.
#
# dhparams= File containing DH parameters for temporary/ephemeral
-# DH key exchanges.
+# DH key exchanges. See OpenSSL documentation for details
+# on how to create this file.
+# WARNING: EDH ciphers will be silently disabled if this
+# option is not set.
#
# sslflags= Various flags modifying the use of SSL:
# DELAYED_AUTH
@@ -1221,6 +1247,25 @@ http_port 3128
#
# sslcontext= SSL session ID context identifier.
#
+# generate-host-certificates[=<on|off>]
+# Dynamically create SSL server certificates for the
+# destination hosts of bumped CONNECT requests.When
+# enabled, the cert and key options are used to sign
+# generated certificates. Otherwise generated
+# certificate will be selfsigned.
+# If there is CA certificate life time of generated
+# certificate equals lifetime of CA certificate. If
+# generated certificate is selfsigned lifetime is three
+# years.
+# This option is enabled by default when SslBump is used.
+# See the sslBump option above for more information.
+#
+# dynamic_cert_mem_cache_size=SIZE
+# Approximate total RAM size spent on cached generated
+# certificates. If set to zero, caching is disabled. The
+# default value is 4MB. An average XXX-bit certificate
+# consumes about XXX bytes of RAM.
+#
# vport Accelerator with IP based virtual host support.
#
# vport=NN As above, but uses specified port number rather
@@ -1490,9 +1535,9 @@ http_port 3128
#
# By default, no requests are bumped.
#
-# See also: http_port sslBump
+# See also: http_port ssl-bump
#
-# This clause only supports fast acl types.
+# This clause supports both fast and slow acl types.
# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
#
#
@@ -1564,6 +1609,31 @@ http_port 3128
#Default:
# none
+#OPTIONS RELATING TO EXTERNAL SSL_CRTD
+#-----------------------------------------------------------------------------
+
+# TAG: sslcrtd_program
+# Note: This option is only available if Squid is rebuilt with the
+# -DUSE_SSL_CRTD define
+#
+# Specify the location and options of the executable for ssl_crtd process.
+# /usr/libexec/ssl_crtd program requires -s and -M parameters
+# For more information use:
+# /usr/libexec/ssl_crtd -h
+#Default:
+# sslcrtd_program /usr/libexec/ssl_crtd -s /var/log/squid/lib/ssl_db -M 4MB
+
+# TAG: sslcrtd_children
+# Note: This option is only available if Squid is rebuilt with the
+# -DUSE_SSL_CRTD define
+#
+# The maximum number of processes spawn to service ssl server.
+# The maximum this may be safely set to is 32.
+#
+# You must have at least one ssl_crtd process.
+#Default:
+# sslcrtd_children 5
+
# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
@@ -1580,7 +1650,7 @@ http_port 3128
# cache_peer parent.foo.net parent 3128 3130 default
# cache_peer sib1.foo.net sibling 3128 3130 proxy-only
# cache_peer sib2.foo.net sibling 3128 3130 proxy-only
-# cache_peer example.com parent 80 0 no-query default
+# cache_peer example.com parent 80 0 default
# cache_peer cdn.example.com sibling 3128 0
#
# type: either 'parent', 'sibling', or 'multicast'.
@@ -1675,7 +1745,7 @@ http_port 3128
# multicast-siblings
# To be used only for cache peers of type "multicast".
# ALL members of this multicast group have "sibling"
-# relationship with it, not "parent". This is to a mulicast
+# relationship with it, not "parent". This is to a multicast
# group when the requested object would be fetched only from
# a "parent" cache, anyway. It's useful, e.g., when
# configuring a pool of redundant Squid proxies, being
@@ -1967,11 +2037,13 @@ http_port 3128
# be handled directly by this cache. In other words, use this
# to not query neighbor caches for certain objects. You may
# list this option multiple times.
-# Note: never_direct overrides this option.
#
-
-# We recommend you to use at least the following line.
-hierarchy_stoplist cgi-bin ?
+# Example:
+# hierarchy_stoplist cgi-bin ?
+#
+# Note: never_direct overrides this option.
+#Default:
+# none
# MEMORY CACHE OPTIONS
# -----------------------------------------------------------------------------
@@ -2208,6 +2280,9 @@ cache_dir ufs /var/cache/squid/ 256 16 256
# maximum_object_size 4096 KB
# TAG: cache_swap_low (percent, 0-100)
+#Default:
+# cache_swap_low 90
+
# TAG: cache_swap_high (percent, 0-100)
#
# The low- and high-water marks for cache object replacement.
@@ -2221,7 +2296,6 @@ cache_dir ufs /var/cache/squid/ 256 16 256
# hundreds of MB. If this is the case you may wish to set these
# numbers closer together.
#Default:
-# cache_swap_low 90
# cache_swap_high 95
# LOGFILE OPTIONS
@@ -2263,6 +2337,8 @@ cache_dir ufs /var/cache/squid/ 256 16 256
# <A Server IP address or peer name
# la Local IP address (http_port)
# lp Local port number (http_port)
+# <la Local IP address of the last server or peer connection
+# <lp Local port number of the last server or peer connection
# ts Seconds since epoch
# tu subsecond time (milliseconds)
# tl Local time. Optional strftime format argument
@@ -2370,6 +2446,7 @@ cache_dir ufs /var/cache/squid/ 256 16 256
# Will log to the specified file using the specified format (which
# must be defined in a logformat directive) those entries which match
# ALL the acl's specified (which must be defined in acl clauses).
+#
# If no acl is specified, all requests will be logged to this file.
#
# To disable logging of a request use the filepath "none", in which case
@@ -2487,7 +2564,7 @@ access_log /var/log/squid/access.log squid
# This options allows you to control which requests get logged
# to icap.log. See the icap_log directive for ICAP log details.
#Default:
-cache_log /var/log/squid/cache.log
+# none
# TAG: cache_store_log
# Logs the activities of the storage manager. Shows which
@@ -2611,17 +2688,6 @@ logfile_rotate 0
#Default:
pid_filename /var/run/squid/squid.pid
-# TAG: debug_options
-# Logging options are set as section,level where each source file
-# is assigned a unique section. Lower levels result in less
-# output, Full debugging (level 9) can result in a very large
-# log file, so be careful. The magic word "ALL" sets debugging
-# levels for all sections. We recommend normally running with
-# "ALL,1".
-#
-#Default:
-# debug_options ALL,1
-
# TAG: log_fqdn on|off
# Turn this on if you wish to log fully qualified domain names
# in the access.log. To do this Squid does a DNS lookup of all
@@ -2858,10 +2924,10 @@ coredump_dir /var/log/squid/cache
# -----------------------------------------------------------------------------
# TAG: url_rewrite_program
-# Specify the location of the executable for the URL rewriter.
+# Specify the location of the executable URL rewriter to use.
# Since they can perform almost any function there isn't one included.
#
-# For each requested URL rewriter will receive on line with the format
+# For each requested URL, the rewriter will receive on line with the format
#
# URL <SP> client_ip "/" fqdn <SP> user <SP> method [<SP> kvpairs]<NL>
#
@@ -2875,7 +2941,7 @@ coredump_dir /var/log/squid/cache
#
# The rewriter can also indicate that a client-side redirect should
# be performed to the new URL. This is done by prefixing the returned
-# URL with "301:" (moved permanently) or 302: (moved temporarily).
+# URL with "301:" (moved permanently) or 302: (moved temporarily), etc.
#
# By default, a URL rewriter is not used.
#Default:
@@ -3064,7 +3130,13 @@ refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# TAG: quick_abort_min (KB)
+#Default:
+# quick_abort_min 16 KB
+
# TAG: quick_abort_max (KB)
+#Default:
+# quick_abort_max 16 KB
+
# TAG: quick_abort_pct (percent)
# The cache by default continues downloading aborted requests
# which are almost completed (less than 16 KB remaining). This
@@ -3093,8 +3165,6 @@ refresh_pattern . 0 20% 4320
# If you want retrievals to always continue if they are being
# cached set 'quick_abort_min' to '-1 KB'.
#Default:
-# quick_abort_min 16 KB
-# quick_abort_max 16 KB
# quick_abort_pct 95
# TAG: read_ahead_gap buffer-size
@@ -3270,10 +3340,10 @@ refresh_pattern . 0 20% 4320
# Note: This option is only available if Squid is rebuilt with the
# --enable-follow-x-forwarded-for and --enable-icap-client option
#
-# Controls whether the indirect client address
-# (see follow_x_forwarded_for) instead of the
-# direct client address is passed to an ICAP
-# server as "X-Client-IP".
+# Controls whether the indirect client IP address (instead of the direct
+# client IP address) is passed to adaptation services.
+#
+# See also: follow_x_forwarded_for adaptation_send_client_ip
#Default:
# icap_uses_indirect_client on
@@ -3555,7 +3625,7 @@ refresh_pattern . 0 20% 4320
# read_timeout 15 minutes
# TAG: request_timeout
-# How long to wait for an HTTP request after initial
+# How long to wait for complete HTTP request headers after initial
# connection establishment.
#Default:
# request_timeout 5 minutes
@@ -3748,7 +3818,13 @@ cache_effective_group nobody
# announce_period 0
# TAG: announce_host
+#Default:
+# announce_host tracker.ircache.net
+
# TAG: announce_file
+#Default:
+# none
+
# TAG: announce_port
# announce_host and announce_port set the hostname and port
# number where the registration message will be sent.
@@ -3758,7 +3834,6 @@ cache_effective_group nobody
# the contents of that file will be included in the announce
# message.
#Default:
-# announce_host tracker.ircache.net
# announce_port 3131
# HTTPD-ACCELERATOR OPTIONS
@@ -3847,6 +3922,11 @@ cache_effective_group nobody
# class 5 Requests are grouped according their tag (see
# external_acl's tag= reply).
#
+#
+# Each pool also requires a delay_parameters directive to configure the pool size
+# and speed limits used whenever the pool is applied to a request. Along with
+# a set of delay_access directives to determine when it is used.
+#
# NOTE: If an IP address is a.b.c.d
# -> bits 25 through 32 are "d"
# -> bits 17 through 24 are "c"
@@ -3886,45 +3966,47 @@ cache_effective_group nobody
#
# This defines the parameters for a delay pool. Each delay pool has
# a number of "buckets" associated with it, as explained in the
-# description of delay_class. For a class 1 delay pool, the syntax is:
+# description of delay_class.
#
-#delay_parameters pool aggregate
+# For a class 1 delay pool, the syntax is:
+# delay_pools pool 1
+# delay_parameters pool aggregate
#
# For a class 2 delay pool:
-#
-#delay_parameters pool aggregate individual
+# delay_pools pool 2
+# delay_parameters pool aggregate individual
#
# For a class 3 delay pool:
-#
-#delay_parameters pool aggregate network individual
+# delay_pools pool 3
+# delay_parameters pool aggregate network individual
#
# For a class 4 delay pool:
-#
-#delay_parameters pool aggregate network individual user
+# delay_pools pool 4
+# delay_parameters pool aggregate network individual user
#
# For a class 5 delay pool:
+# delay_pools pool 5
+# delay_parameters pool tagrate
#
-#delay_parameters pool tag
-#
-# The variables here are:
+# The option variables are:
#
# pool a pool number - ie, a number between 1 and the
# number specified in delay_pools as used in
# delay_class lines.
#
-# aggregate the "delay parameters" for the aggregate bucket
+# aggregate the speed limit parameters for the aggregate bucket
# (class 1, 2, 3).
#
-# individual the "delay parameters" for the individual
+# individual the speed limit parameters for the individual
# buckets (class 2, 3).
#
-# network the "delay parameters" for the network buckets
+# network the speed limit parameters for the network buckets
# (class 3).
#
-# user the delay parameters for the user buckets
+# user the speed limit parameters for the user buckets
# (class 4).
#
-# tag the delay parameters for the tag buckets
+# tagrate the speed limit parameters for the tag buckets
# (class 5).
#
# A pair of delay parameters is written restore/maximum, where restore is
@@ -3932,30 +4014,39 @@ cache_effective_group nobody
# quoted in bits) per second placed into the bucket, and maximum is the
# maximum number of bytes which can be in the bucket at any time.
#
+# There must be one delay_parameters line for each delay pool.
+#
+#
# For example, if delay pool number 1 is a class 2 delay pool as in the
-# above example, and is being used to strictly limit each host to 64kbps
+# above example, and is being used to strictly limit each host to 64Kbit/sec
# (plus overheads), with no overall limit, the line is:
#
-#delay_parameters 1 -1/-1 8000/8000
+# delay_parameters 1 -1/-1 8000/8000
+#
+# Note that 8 x 8000 KByte/sec -> 64Kbit/sec.
#
# Note that the figure -1 is used to represent "unlimited".
#
+#
# And, if delay pool number 2 is a class 3 delay pool as in the above
-# example, and you want to limit it to a total of 256kbps (strict limit)
-# with each 8-bit network permitted 64kbps (strict limit) and each
-# individual host permitted 4800bps with a bucket maximum size of 64kb
+# example, and you want to limit it to a total of 256Kbit/sec (strict limit)
+# with each 8-bit network permitted 64Kbit/sec (strict limit) and each
+# individual host permitted 4800bit/sec with a bucket maximum size of 64Kbits
# to permit a decent web page to be downloaded at a decent speed
# (if the network is not being limited due to overuse) but slow down
# large downloads more significantly:
#
-#delay_parameters 2 32000/32000 8000/8000 600/8000
+# delay_parameters 2 32000/32000 8000/8000 600/8000
+#
+# Note that 8 x 32000 KByte/sec -> 256Kbit/sec.
+# 8 x 8000 KByte/sec -> 64Kbit/sec.
+# 8 x 600 Byte/sec -> 4800bit/sec.
#
-# There must be one delay_parameters line for each delay pool.
#
# Finally, for a class 4 delay pool as in the example - each user will
-# be limited to 128Kb no matter how many workstations they are logged into.:
+# be limited to 128Kbits/sec no matter how many workstations they are logged into.:
#
-#delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000
+# delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000
#Default:
# none
@@ -4120,13 +4211,15 @@ cache_effective_group nobody
# wccp2_weight 10000
# TAG: wccp_address
+#Default:
+# wccp_address 0.0.0.0
+
# TAG: wccp2_address
# Use this option if you require WCCP to use a specific
# interface address.
#
# The default behavior is to not bind to any specific address.
#Default:
-# wccp_address 0.0.0.0
# wccp2_address 0.0.0.0
# PERSISTENT CONNECTION HANDLING
@@ -4135,13 +4228,15 @@ cache_effective_group nobody
# Also see "pconn_timeout" in the TIMEOUTS section
# TAG: client_persistent_connections
+#Default:
+# client_persistent_connections on
+
# TAG: server_persistent_connections
# Persistent connection support for clients and servers. By
# default, Squid uses persistent connections (when allowed)
# with its clients and servers. You can use these options to
# disable persistent connections with clients and/or servers.
#Default:
-# client_persistent_connections on
# server_persistent_connections on
# TAG: persistent_connection_after_error
@@ -4253,6 +4348,9 @@ cache_effective_group nobody
# snmp_access deny all
# TAG: snmp_incoming_address
+#Default:
+# snmp_incoming_address any_addr
+
# TAG: snmp_outgoing_address
# Just like 'udp_incoming_address', but for the SNMP port.
#
@@ -4272,7 +4370,6 @@ cache_effective_group nobody
# NOTE, snmp_incoming_address and snmp_outgoing_address can not have
# the same value since they both use port 3401.
#Default:
-# snmp_incoming_address any_addr
# snmp_outgoing_address no_addr
# ICP OPTIONS
@@ -4369,13 +4466,15 @@ cache_effective_group nobody
# minimum_direct_rtt 400
# TAG: netdb_low
+#Default:
+# netdb_low 900
+
# TAG: netdb_high
# The low and high water marks for the ICMP measurement
# database. These are counts, not percents. The defaults are
# 900 and 1000. When the high water mark is reached, database
# entries will be deleted until the low mark is reached.
#Default:
-# netdb_low 900
# netdb_high 1000
# TAG: netdb_ping_period
@@ -4766,20 +4865,30 @@ cache_effective_group nobody
# -----------------------------------------------------------------------------
# TAG: incoming_icp_average
+#Default:
+# incoming_icp_average 6
+
# TAG: incoming_http_average
+#Default:
+# incoming_http_average 4
+
# TAG: incoming_dns_average
+#Default:
+# incoming_dns_average 4
+
# TAG: min_icp_poll_cnt
+#Default:
+# min_icp_poll_cnt 8
+
# TAG: min_dns_poll_cnt
+#Default:
+# min_dns_poll_cnt 8
+
# TAG: min_http_poll_cnt
# Heavy voodoo here. I can't even believe you are reading this.
# Are you crazy? Don't even think about adjusting these unless
# you understand the algorithms in comm_select.c first!
#Default:
-# incoming_icp_average 6
-# incoming_http_average 4
-# incoming_dns_average 4
-# min_icp_poll_cnt 8
-# min_dns_poll_cnt 8
# min_http_poll_cnt 8
# TAG: accept_filter
@@ -4955,7 +5064,11 @@ cache_effective_group nobody
# Note: This option is only available if Squid is rebuilt with the
# --enable-icap-client option
#
-# This adds the header "X-Client-IP" to ICAP requests.
+# If enabled, Squid shares HTTP client IP information with adaptation
+# services. For ICAP, Squid adds the X-Client-IP header to ICAP requests.
+# For eCAP, Squid sets the libecap::metaClientIp transaction option.
+#
+# See also: adaptation_uses_indirect_client
#Default:
# icap_send_client_ip off
@@ -5463,13 +5576,32 @@ cache_effective_group nobody
#Default:
# dns_v4_fallback on
+# TAG: dns_v4_first
+# With the IPv6 Internet being as fast or faster than IPv4 Internet
+# for most networks Squid prefers to contact websites over IPv6.
+#
+# This option reverses the order of preference to make Squid contact
+# dual-stack websites over IPv4 first. Squid will still perform both
+# IPv6 and IPv4 DNS lookups before connecting.
+#
+# WARNING:
+# This option will restrict the situations under which IPv6
+# connectivity is used (and tested). Hiding network problems
+# which would otherwise be detected and warned about.
+#Default:
+# dns_v4_first off
+
# TAG: ipcache_size (number of entries)
+#Default:
+# ipcache_size 1024
+
# TAG: ipcache_low (percent)
+#Default:
+# ipcache_low 90
+
# TAG: ipcache_high (percent)
# The size, low-, and high-water marks for the IP cache.
#Default:
-# ipcache_size 1024
-# ipcache_low 90
# ipcache_high 95
# TAG: fqdncache_size (number of entries)
@@ -5639,10 +5771,16 @@ cache_effective_group nobody
# maximum_single_addr_tries 1
# TAG: retry_on_error
-# If set to on Squid will automatically retry requests when
-# receiving an error response. This is mainly useful if you
-# are in a complex cache hierarchy to work around access
-# control errors.
+# If set to ON Squid will automatically retry requests when
+# receiving an error response with status 403 (Forbidden),
+# 500 (Internal Error), 501 or 503 (Service not available).
+# Status 502 and 504 (Gateway errors) are always retried.
+#
+# This is mainly useful if you are in a complex cache hierarchy to
+# work around access control errors.
+#
+# NOTE: This retry will attempt to find another working destination.
+# Which is different from the server which just failed.
#Default:
# retry_on_error off
diff --git a/network/squid/squid.conf.documented b/network/squid/squid.conf.documented
index 4dc84c53cc..3efcd48cda 100644
--- a/network/squid/squid.conf.documented
+++ b/network/squid/squid.conf.documented
@@ -1,21 +1,27 @@
-# WELCOME TO SQUID 3.1.12
+# WELCOME TO SQUID 3.1.20
# ----------------------------
-#
-# This is the default Squid configuration file. You may wish
-# to look at the Squid home page (http://www.squid-cache.org/)
-# for the FAQ and other documentation.
-#
-# The default Squid config file shows what the defaults for
-# various options happen to be. If you don't need to change the
-# default, you shouldn't uncomment the line. Doing so may cause
-# run-time problems. In some cases "none" refers to no default
-# setting at all, while in other cases it refers to a valid
-# option - the comments for that keyword indicate if this is the
-# case.
+#
+# This is the documentation for the Squid configuration file.
+# This documentation can also be found online at:
+# http://www.squid-cache.org/Doc/config/
+#
+# You may wish to look at the Squid home page and wiki for the
+# FAQ and other documentation:
+# http://www.squid-cache.org/
+# http://wiki.squid-cache.org/SquidFaq
+# http://wiki.squid-cache.org/ConfigExamples
+#
+# This documentation shows what the defaults for various directives
+# happen to be. If you don't need to change the default, you should
+# leave the line out of your squid.conf in most cases.
+#
+# In some cases "none" refers to no default setting at all,
+# while in other cases it refers to the value of the option
+# - the comments for that keyword indicate if this is the case.
#
# Configuration options can be included using the "include" directive.
-# Include takes a list of files to include. Quoting and wildcards is
+# Include takes a list of files to include. Quoting and wildcards are
# supported.
#
# For example,
@@ -38,6 +44,9 @@
# none
# TAG: incoming_rate
+#Default:
+# none
+
# TAG: server_http11
# Remove this line. HTTP/1.1 is supported by default.
#Default:
@@ -384,9 +393,8 @@
# cached entry should be initiated without needing to
# wait for a new reply. (default 0 for no grace period)
# protocol=2.5 Compatibility mode for Squid-2.5 external acl helpers
-# ipv4 / ipv6 IP-mode used to communicate to this helper.
-# For compatability with older configurations and helpers
-# the default is currently 'ipv4'.
+# ipv4 / ipv6 IP protocol used to communicate with this helper.
+# The default is to auto-detect IPv6 and use it when available.
#
# FORMAT specifications
#
@@ -425,6 +433,9 @@
# list separator. ; can be any non-alphanumeric
# character.
#
+# %% The percent sign. Useful for helpers which need
+# an unchanging input format.
+#
# In addition to the above, any string specified in the referencing
# acl will also be included in the helper request line, after the
# specified formats (see the "acl external" directive)
@@ -474,8 +485,9 @@
#
# When using "file", the file should contain one item per line.
#
-# By default, regular expressions are CASE-SENSITIVE. To make
-# them case-insensitive, use the -i option.
+# By default, regular expressions are CASE-SENSITIVE.
+# To make them case-insensitive, use the -i option. To return case-sensitive
+# use the +i option between patterns, or make a new ACL line without -i.
#
# Some acl types require suspending the current request in order
# to access some external data source.
@@ -918,18 +930,23 @@ http_access deny all
# htcp_clr_access deny all
# TAG: miss_access
-# Use to force your neighbors to use you as a sibling instead of
-# a parent. For example:
+# Determins whether network access is permitted when satisfying a request.
+#
+# For example;
+# to force your neighbors to use you as a sibling instead of
+# a parent.
#
# acl localclients src 172.16.0.0/16
# miss_access allow localclients
# miss_access deny !localclients
#
-# This means only your local clients are allowed to fetch
-# MISSES and all other clients can only fetch HITS.
+# This means only your local clients are allowed to fetch relayed/MISS
+# replies from the network and all other clients can only fetch cached
+# objects (HITs).
+#
#
-# By default, allow all clients who passed the http_access rules
-# to fetch MISSES from us.
+# The default for this setting allows all clients who passed the
+# http_access rules to relay via this proxy.
#
# This clause only supports fast acl types.
# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
@@ -1046,14 +1063,16 @@ http_access deny all
# accelerators should consider the default.
# Implies accel.
#
-# vhost Accelerator mode using Host header for virtual
-# domain support. Implies accel.
+# vhost Accelerator mode using Host header for virtual domain support.
+# Also uses the port as specified in Host: header unless
+# overridden by the vport option. Implies accel.
#
-# vport Accelerator with IP based virtual host support.
-# Implies accel.
+# vport Virtual host port support. Using the http_port number
+# instead of the port passed on Host: headers. Implies accel.
#
-# vport=NN As above, but uses specified port number rather
-# than the http_port number. Implies accel.
+# vport=NN Virtual host port support. Using the specified port
+# number instead of the port passed on Host: headers.
+# Implies accel.
#
# protocol= Protocol to reconstruct accelerated requests with.
# Defaults to http.
@@ -1165,6 +1184,10 @@ http_port 3128
# 4 TLSv1 only
#
# cipher= Colon separated list of supported ciphers.
+# NOTE: some ciphers such as EDH ciphers depend on
+# additional settings. If those settings are
+# omitted the ciphers may be silently ignored
+# by the OpenSSL library.
#
# options= Various SSL engine options. The most important
# being:
@@ -1173,8 +1196,8 @@ http_port 3128
# NO_TLSv1 Disallow the use of TLSv1
# SINGLE_DH_USE Always create a new key when using
# temporary/ephemeral DH key exchanges
-# See src/ssl_support.c or OpenSSL SSL_CTX_set_options
-# documentation for a complete list of options.
+# See OpenSSL SSL_CTX_set_options documentation for a
+# complete list of options.
#
# clientca= File containing the list of CAs to use when
# requesting a client certificate.
@@ -1191,7 +1214,10 @@ http_port 3128
# the capath. Implies VERIFY_CRL flag below.
#
# dhparams= File containing DH parameters for temporary/ephemeral
-# DH key exchanges.
+# DH key exchanges. See OpenSSL documentation for details
+# on how to create this file.
+# WARNING: EDH ciphers will be silently disabled if this
+# option is not set.
#
# sslflags= Various flags modifying the use of SSL:
# DELAYED_AUTH
@@ -1213,6 +1239,25 @@ http_port 3128
#
# sslcontext= SSL session ID context identifier.
#
+# generate-host-certificates[=<on|off>]
+# Dynamically create SSL server certificates for the
+# destination hosts of bumped CONNECT requests.When
+# enabled, the cert and key options are used to sign
+# generated certificates. Otherwise generated
+# certificate will be selfsigned.
+# If there is CA certificate life time of generated
+# certificate equals lifetime of CA certificate. If
+# generated certificate is selfsigned lifetime is three
+# years.
+# This option is enabled by default when SslBump is used.
+# See the sslBump option above for more information.
+#
+# dynamic_cert_mem_cache_size=SIZE
+# Approximate total RAM size spent on cached generated
+# certificates. If set to zero, caching is disabled. The
+# default value is 4MB. An average XXX-bit certificate
+# consumes about XXX bytes of RAM.
+#
# vport Accelerator with IP based virtual host support.
#
# vport=NN As above, but uses specified port number rather
@@ -1482,9 +1527,9 @@ http_port 3128
#
# By default, no requests are bumped.
#
-# See also: http_port sslBump
+# See also: http_port ssl-bump
#
-# This clause only supports fast acl types.
+# This clause supports both fast and slow acl types.
# See http://wiki.squid-cache.org/SquidFaq/SquidAcl for details.
#
#
@@ -1556,6 +1601,31 @@ http_port 3128
#Default:
# none
+#OPTIONS RELATING TO EXTERNAL SSL_CRTD
+#-----------------------------------------------------------------------------
+
+# TAG: sslcrtd_program
+# Note: This option is only available if Squid is rebuilt with the
+# -DUSE_SSL_CRTD define
+#
+# Specify the location and options of the executable for ssl_crtd process.
+# /usr/libexec/ssl_crtd program requires -s and -M parameters
+# For more information use:
+# /usr/libexec/ssl_crtd -h
+#Default:
+# sslcrtd_program /usr/libexec/ssl_crtd -s /var/log/squid/lib/ssl_db -M 4MB
+
+# TAG: sslcrtd_children
+# Note: This option is only available if Squid is rebuilt with the
+# -DUSE_SSL_CRTD define
+#
+# The maximum number of processes spawn to service ssl server.
+# The maximum this may be safely set to is 32.
+#
+# You must have at least one ssl_crtd process.
+#Default:
+# sslcrtd_children 5
+
# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
@@ -1572,7 +1642,7 @@ http_port 3128
# cache_peer parent.foo.net parent 3128 3130 default
# cache_peer sib1.foo.net sibling 3128 3130 proxy-only
# cache_peer sib2.foo.net sibling 3128 3130 proxy-only
-# cache_peer example.com parent 80 0 no-query default
+# cache_peer example.com parent 80 0 default
# cache_peer cdn.example.com sibling 3128 0
#
# type: either 'parent', 'sibling', or 'multicast'.
@@ -1667,7 +1737,7 @@ http_port 3128
# multicast-siblings
# To be used only for cache peers of type "multicast".
# ALL members of this multicast group have "sibling"
-# relationship with it, not "parent". This is to a mulicast
+# relationship with it, not "parent". This is to a multicast
# group when the requested object would be fetched only from
# a "parent" cache, anyway. It's useful, e.g., when
# configuring a pool of redundant Squid proxies, being
@@ -1959,11 +2029,13 @@ http_port 3128
# be handled directly by this cache. In other words, use this
# to not query neighbor caches for certain objects. You may
# list this option multiple times.
-# Note: never_direct overrides this option.
#
-
-# We recommend you to use at least the following line.
-hierarchy_stoplist cgi-bin ?
+# Example:
+# hierarchy_stoplist cgi-bin ?
+#
+# Note: never_direct overrides this option.
+#Default:
+# none
# MEMORY CACHE OPTIONS
# -----------------------------------------------------------------------------
@@ -2201,6 +2273,9 @@ hierarchy_stoplist cgi-bin ?
# maximum_object_size 4096 KB
# TAG: cache_swap_low (percent, 0-100)
+#Default:
+# cache_swap_low 90
+
# TAG: cache_swap_high (percent, 0-100)
#
# The low- and high-water marks for cache object replacement.
@@ -2214,7 +2289,6 @@ hierarchy_stoplist cgi-bin ?
# hundreds of MB. If this is the case you may wish to set these
# numbers closer together.
#Default:
-# cache_swap_low 90
# cache_swap_high 95
# LOGFILE OPTIONS
@@ -2256,6 +2330,8 @@ hierarchy_stoplist cgi-bin ?
# <A Server IP address or peer name
# la Local IP address (http_port)
# lp Local port number (http_port)
+# <la Local IP address of the last server or peer connection
+# <lp Local port number of the last server or peer connection
# ts Seconds since epoch
# tu subsecond time (milliseconds)
# tl Local time. Optional strftime format argument
@@ -2363,6 +2439,7 @@ hierarchy_stoplist cgi-bin ?
# Will log to the specified file using the specified format (which
# must be defined in a logformat directive) those entries which match
# ALL the acl's specified (which must be defined in acl clauses).
+#
# If no acl is specified, all requests will be logged to this file.
#
# To disable logging of a request use the filepath "none", in which case
@@ -2840,10 +2917,10 @@ coredump_dir /var/log/squid/cache
# -----------------------------------------------------------------------------
# TAG: url_rewrite_program
-# Specify the location of the executable for the URL rewriter.
+# Specify the location of the executable URL rewriter to use.
# Since they can perform almost any function there isn't one included.
#
-# For each requested URL rewriter will receive on line with the format
+# For each requested URL, the rewriter will receive on line with the format
#
# URL <SP> client_ip "/" fqdn <SP> user <SP> method [<SP> kvpairs]<NL>
#
@@ -2857,7 +2934,7 @@ coredump_dir /var/log/squid/cache
#
# The rewriter can also indicate that a client-side redirect should
# be performed to the new URL. This is done by prefixing the returned
-# URL with "301:" (moved permanently) or 302: (moved temporarily).
+# URL with "301:" (moved permanently) or 302: (moved temporarily), etc.
#
# By default, a URL rewriter is not used.
#Default:
@@ -3046,7 +3123,13 @@ refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# TAG: quick_abort_min (KB)
+#Default:
+# quick_abort_min 16 KB
+
# TAG: quick_abort_max (KB)
+#Default:
+# quick_abort_max 16 KB
+
# TAG: quick_abort_pct (percent)
# The cache by default continues downloading aborted requests
# which are almost completed (less than 16 KB remaining). This
@@ -3075,8 +3158,6 @@ refresh_pattern . 0 20% 4320
# If you want retrievals to always continue if they are being
# cached set 'quick_abort_min' to '-1 KB'.
#Default:
-# quick_abort_min 16 KB
-# quick_abort_max 16 KB
# quick_abort_pct 95
# TAG: read_ahead_gap buffer-size
@@ -3252,10 +3333,10 @@ refresh_pattern . 0 20% 4320
# Note: This option is only available if Squid is rebuilt with the
# --enable-follow-x-forwarded-for and --enable-icap-client option
#
-# Controls whether the indirect client address
-# (see follow_x_forwarded_for) instead of the
-# direct client address is passed to an ICAP
-# server as "X-Client-IP".
+# Controls whether the indirect client IP address (instead of the direct
+# client IP address) is passed to adaptation services.
+#
+# See also: follow_x_forwarded_for adaptation_send_client_ip
#Default:
# icap_uses_indirect_client on
@@ -3537,7 +3618,7 @@ refresh_pattern . 0 20% 4320
# read_timeout 15 minutes
# TAG: request_timeout
-# How long to wait for an HTTP request after initial
+# How long to wait for complete HTTP request headers after initial
# connection establishment.
#Default:
# request_timeout 5 minutes
@@ -3730,7 +3811,13 @@ refresh_pattern . 0 20% 4320
# announce_period 0
# TAG: announce_host
+#Default:
+# announce_host tracker.ircache.net
+
# TAG: announce_file
+#Default:
+# none
+
# TAG: announce_port
# announce_host and announce_port set the hostname and port
# number where the registration message will be sent.
@@ -3740,7 +3827,6 @@ refresh_pattern . 0 20% 4320
# the contents of that file will be included in the announce
# message.
#Default:
-# announce_host tracker.ircache.net
# announce_port 3131
# HTTPD-ACCELERATOR OPTIONS
@@ -3829,6 +3915,11 @@ refresh_pattern . 0 20% 4320
# class 5 Requests are grouped according their tag (see
# external_acl's tag= reply).
#
+#
+# Each pool also requires a delay_parameters directive to configure the pool size
+# and speed limits used whenever the pool is applied to a request. Along with
+# a set of delay_access directives to determine when it is used.
+#
# NOTE: If an IP address is a.b.c.d
# -> bits 25 through 32 are "d"
# -> bits 17 through 24 are "c"
@@ -3868,45 +3959,47 @@ refresh_pattern . 0 20% 4320
#
# This defines the parameters for a delay pool. Each delay pool has
# a number of "buckets" associated with it, as explained in the
-# description of delay_class. For a class 1 delay pool, the syntax is:
+# description of delay_class.
#
-#delay_parameters pool aggregate
+# For a class 1 delay pool, the syntax is:
+# delay_pools pool 1
+# delay_parameters pool aggregate
#
# For a class 2 delay pool:
-#
-#delay_parameters pool aggregate individual
+# delay_pools pool 2
+# delay_parameters pool aggregate individual
#
# For a class 3 delay pool:
-#
-#delay_parameters pool aggregate network individual
+# delay_pools pool 3
+# delay_parameters pool aggregate network individual
#
# For a class 4 delay pool:
-#
-#delay_parameters pool aggregate network individual user
+# delay_pools pool 4
+# delay_parameters pool aggregate network individual user
#
# For a class 5 delay pool:
+# delay_pools pool 5
+# delay_parameters pool tagrate
#
-#delay_parameters pool tag
-#
-# The variables here are:
+# The option variables are:
#
# pool a pool number - ie, a number between 1 and the
# number specified in delay_pools as used in
# delay_class lines.
#
-# aggregate the "delay parameters" for the aggregate bucket
+# aggregate the speed limit parameters for the aggregate bucket
# (class 1, 2, 3).
#
-# individual the "delay parameters" for the individual
+# individual the speed limit parameters for the individual
# buckets (class 2, 3).
#
-# network the "delay parameters" for the network buckets
+# network the speed limit parameters for the network buckets
# (class 3).
#
-# user the delay parameters for the user buckets
+# user the speed limit parameters for the user buckets
# (class 4).
#
-# tag the delay parameters for the tag buckets
+# tagrate the speed limit parameters for the tag buckets
# (class 5).
#
# A pair of delay parameters is written restore/maximum, where restore is
@@ -3914,30 +4007,39 @@ refresh_pattern . 0 20% 4320
# quoted in bits) per second placed into the bucket, and maximum is the
# maximum number of bytes which can be in the bucket at any time.
#
+# There must be one delay_parameters line for each delay pool.
+#
+#
# For example, if delay pool number 1 is a class 2 delay pool as in the
-# above example, and is being used to strictly limit each host to 64kbps
+# above example, and is being used to strictly limit each host to 64Kbit/sec
# (plus overheads), with no overall limit, the line is:
#
-#delay_parameters 1 -1/-1 8000/8000
+# delay_parameters 1 -1/-1 8000/8000
+#
+# Note that 8 x 8000 KByte/sec -> 64Kbit/sec.
#
# Note that the figure -1 is used to represent "unlimited".
#
+#
# And, if delay pool number 2 is a class 3 delay pool as in the above
-# example, and you want to limit it to a total of 256kbps (strict limit)
-# with each 8-bit network permitted 64kbps (strict limit) and each
-# individual host permitted 4800bps with a bucket maximum size of 64kb
+# example, and you want to limit it to a total of 256Kbit/sec (strict limit)
+# with each 8-bit network permitted 64Kbit/sec (strict limit) and each
+# individual host permitted 4800bit/sec with a bucket maximum size of 64Kbits
# to permit a decent web page to be downloaded at a decent speed
# (if the network is not being limited due to overuse) but slow down
# large downloads more significantly:
#
-#delay_parameters 2 32000/32000 8000/8000 600/8000
+# delay_parameters 2 32000/32000 8000/8000 600/8000
+#
+# Note that 8 x 32000 KByte/sec -> 256Kbit/sec.
+# 8 x 8000 KByte/sec -> 64Kbit/sec.
+# 8 x 600 Byte/sec -> 4800bit/sec.
#
-# There must be one delay_parameters line for each delay pool.
#
# Finally, for a class 4 delay pool as in the example - each user will
-# be limited to 128Kb no matter how many workstations they are logged into.:
+# be limited to 128Kbits/sec no matter how many workstations they are logged into.:
#
-#delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000
+# delay_parameters 4 32000/32000 8000/8000 600/64000 16000/16000
#Default:
# none
@@ -4102,13 +4204,15 @@ refresh_pattern . 0 20% 4320
# wccp2_weight 10000
# TAG: wccp_address
+#Default:
+# wccp_address 0.0.0.0
+
# TAG: wccp2_address
# Use this option if you require WCCP to use a specific
# interface address.
#
# The default behavior is to not bind to any specific address.
#Default:
-# wccp_address 0.0.0.0
# wccp2_address 0.0.0.0
# PERSISTENT CONNECTION HANDLING
@@ -4117,13 +4221,15 @@ refresh_pattern . 0 20% 4320
# Also see "pconn_timeout" in the TIMEOUTS section
# TAG: client_persistent_connections
+#Default:
+# client_persistent_connections on
+
# TAG: server_persistent_connections
# Persistent connection support for clients and servers. By
# default, Squid uses persistent connections (when allowed)
# with its clients and servers. You can use these options to
# disable persistent connections with clients and/or servers.
#Default:
-# client_persistent_connections on
# server_persistent_connections on
# TAG: persistent_connection_after_error
@@ -4235,6 +4341,9 @@ refresh_pattern . 0 20% 4320
# snmp_access deny all
# TAG: snmp_incoming_address
+#Default:
+# snmp_incoming_address any_addr
+
# TAG: snmp_outgoing_address
# Just like 'udp_incoming_address', but for the SNMP port.
#
@@ -4254,7 +4363,6 @@ refresh_pattern . 0 20% 4320
# NOTE, snmp_incoming_address and snmp_outgoing_address can not have
# the same value since they both use port 3401.
#Default:
-# snmp_incoming_address any_addr
# snmp_outgoing_address no_addr
# ICP OPTIONS
@@ -4351,13 +4459,15 @@ refresh_pattern . 0 20% 4320
# minimum_direct_rtt 400
# TAG: netdb_low
+#Default:
+# netdb_low 900
+
# TAG: netdb_high
# The low and high water marks for the ICMP measurement
# database. These are counts, not percents. The defaults are
# 900 and 1000. When the high water mark is reached, database
# entries will be deleted until the low mark is reached.
#Default:
-# netdb_low 900
# netdb_high 1000
# TAG: netdb_ping_period
@@ -4748,20 +4858,30 @@ refresh_pattern . 0 20% 4320
# -----------------------------------------------------------------------------
# TAG: incoming_icp_average
+#Default:
+# incoming_icp_average 6
+
# TAG: incoming_http_average
+#Default:
+# incoming_http_average 4
+
# TAG: incoming_dns_average
+#Default:
+# incoming_dns_average 4
+
# TAG: min_icp_poll_cnt
+#Default:
+# min_icp_poll_cnt 8
+
# TAG: min_dns_poll_cnt
+#Default:
+# min_dns_poll_cnt 8
+
# TAG: min_http_poll_cnt
# Heavy voodoo here. I can't even believe you are reading this.
# Are you crazy? Don't even think about adjusting these unless
# you understand the algorithms in comm_select.c first!
#Default:
-# incoming_icp_average 6
-# incoming_http_average 4
-# incoming_dns_average 4
-# min_icp_poll_cnt 8
-# min_dns_poll_cnt 8
# min_http_poll_cnt 8
# TAG: accept_filter
@@ -4937,7 +5057,11 @@ refresh_pattern . 0 20% 4320
# Note: This option is only available if Squid is rebuilt with the
# --enable-icap-client option
#
-# This adds the header "X-Client-IP" to ICAP requests.
+# If enabled, Squid shares HTTP client IP information with adaptation
+# services. For ICAP, Squid adds the X-Client-IP header to ICAP requests.
+# For eCAP, Squid sets the libecap::metaClientIp transaction option.
+#
+# See also: adaptation_uses_indirect_client
#Default:
# icap_send_client_ip off
@@ -5445,13 +5569,32 @@ refresh_pattern . 0 20% 4320
#Default:
# dns_v4_fallback on
+# TAG: dns_v4_first
+# With the IPv6 Internet being as fast or faster than IPv4 Internet
+# for most networks Squid prefers to contact websites over IPv6.
+#
+# This option reverses the order of preference to make Squid contact
+# dual-stack websites over IPv4 first. Squid will still perform both
+# IPv6 and IPv4 DNS lookups before connecting.
+#
+# WARNING:
+# This option will restrict the situations under which IPv6
+# connectivity is used (and tested). Hiding network problems
+# which would otherwise be detected and warned about.
+#Default:
+# dns_v4_first off
+
# TAG: ipcache_size (number of entries)
+#Default:
+# ipcache_size 1024
+
# TAG: ipcache_low (percent)
+#Default:
+# ipcache_low 90
+
# TAG: ipcache_high (percent)
# The size, low-, and high-water marks for the IP cache.
#Default:
-# ipcache_size 1024
-# ipcache_low 90
# ipcache_high 95
# TAG: fqdncache_size (number of entries)
@@ -5621,10 +5764,16 @@ refresh_pattern . 0 20% 4320
# maximum_single_addr_tries 1
# TAG: retry_on_error
-# If set to on Squid will automatically retry requests when
-# receiving an error response. This is mainly useful if you
-# are in a complex cache hierarchy to work around access
-# control errors.
+# If set to ON Squid will automatically retry requests when
+# receiving an error response with status 403 (Forbidden),
+# 500 (Internal Error), 501 or 503 (Service not available).
+# Status 502 and 504 (Gateway errors) are always retried.
+#
+# This is mainly useful if you are in a complex cache hierarchy to
+# work around access control errors.
+#
+# NOTE: This retry will attempt to find another working destination.
+# Which is different from the server which just failed.
#Default:
# retry_on_error off
diff --git a/network/squid/squid.info b/network/squid/squid.info
index 4bf455b6a1..e182eda03f 100644
--- a/network/squid/squid.info
+++ b/network/squid/squid.info
@@ -1,8 +1,8 @@
PRGNAM="squid"
-VERSION="3.1.12"
+VERSION="3.1.20"
HOMEPAGE="http://www.squid-cache.org/"
-DOWNLOAD="http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.12.tar.bz2"
-MD5SUM="3b4979e4b44f46d4e13f50326c537d89"
+DOWNLOAD="http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.20.tar.bz2"
+MD5SUM="c4d733a383c0508fd0746d64a2d7278a"
DOWNLOAD_x86_64=""
MD5SUM_x86_64=""
REQUIRES=""