faeba042c1
Most of these changes from 2.5.STABLE4 to 2.5STABLE5 are already applied in previous squid-2.5.4nb8 package. Changes to squid-2.5.STABLE5 (1 Mar 2004): - cache.log message on "squid -k reconfigure" was slightly confusing, claiming Squid restarted when it just reread the configuration. - Bug #787: digest auth never detects password changes - Bug #789: login with space confuses redirector helpers - Bug #791: FQDNcache discards negative responses when using internal DNS - pam_auth fails on Solaris when using pam_authtok_get. Persistent PAM connections are unsafe and now disabled by default. - auth_param documentation clarifications and added default realm values making only the helper program a required attribute - Bug #795: German ERR_DNS_FAIL correction - Bug #803: Lithuantian error messages update - Bug #806: Segfault if failing to load error page - Bug #812: Mozilla/Netscape plugins mime type defined (.xpi) - Bug #817: maximum_object_size too large causes squid not to cache - Bug #824: 100% CPU loop if external_acl combined with separate authentication acl in the same http_access line - squid_ldap_group updated to version 2.12 with support for ldaps:// (LDAPv2 over SSL) and a numer of other improvements. - Bug #799: positive_dns_ttl ignored when using internal DNS. - Bug #690: Incorrect html on empty Gopher responses - Bug #729: --enable-arp-acl may give warning about net/route.h - Bug #14: attempts to establish connection may look like syn flood attack if the contacted server is refusing connections - errorpage README files included in the distribution again showing who contributed which translation - Bug #848: connect_timeout connect_timeout ends up twice the length. forward_timeout option added to address this. - Bug #849: DNS log error messages should report the failed query - Bug #851: DNS retransmits too often - Bug #862: Very frequently repeated POST requests may cause a filedescriptor shortage due to persitent connections building up - Bug #853: Sporatic segmentation faults on aborted FTP PUT requests - Bug #571: Need to limit use of persistent connections when filedescriptor usage is high - Bug #856: FTP/Gopher Icon URLs are unneededly complex and often does not work properly - Bug #860: redirector_access does not handle "slow" acls such as "dst" or "external" requiring a external lookup. - Bug #865: Persistent connection usage too high after sudden burst of traffic. - Bug #867: cache_peer max-conn=.. option does not work - Bug #868: refuses to start if pid_filename none is specified - Bug #887: LDAP helper -Z (TLS) option does not work - Bug #877: Squid doesn't follow telnet protocol on FTP control connections - Bug #908: Random auth popups and account lockouts when using ntlm - Support for NTLM_NEGOTIATE exchanges with ntlm helpers - Bug #585: cache_peer_access fails with NTLM authentication - Bug #592: always/never_direct fails with NTLM authentication - wbinfo_group update for Samba-3 - Bug #892: helpers/ntlm_auth/SMB/ fails to compile on FreeBSD 5.0 - Bug #924: miss_access restricts internal and cachemgr requests even if these are local - Bug #925: auth headers send by squidclient are mildly malformed - Bug #922: miss_access and delay_access and several other authentication related bug fixes. - Bug #909: Added ARP acl support for FreeBSD - Bug #926: deny_info with http_reply_access or miss_access - Bug #872: reply_body_max_size problems when using NTLM auth - Bug #825: random segmentation faults when using digest auth - Bug #910: Partial fix for temporary memory leaks when using NTLM auth. There is still problems if challenge reuse is enabled. - ftp://anonymous@host/ now accepted without requiring a password - Bug #594: several mime type updates (ftp:// related) - url_regex enhanced to allow matching of %00 And two official patches' changes. assertion failed: helper.c:323: "srv->flags.reserved" synopsis If using ntlm authentication then Squid may randomly abort with the above assertion failure if a request is aborted while Squid waits for a response from the domain controller severity Medium date 2004-03-01 23:55 bugzilla #937 versions Squid-2.5.STABLE5 platforms All workaround half_closed_connections on (the default) squid_ldap_auth can be confused by the use of reserved characters synopsis squid_ldap_auth may be confused by the use of reserved characters allowing the login name to be masqueraded in different manners possibly allowing the user to partially bypass certain per-user restrictions or confuse third party accounting packages. Note that the user can not bypass the login procedure as such. All he can do is to make the login name look different than normal. There is still full audit trails on who the user is etc. The patch also adds and documents a -d flag to both squid_ldap_auth and squid_ldap_group to allow for easier tracing of the operation of these programs if results is not what is expected. severity Major date 2004-03-04 09:37 bugzilla #935 versions Squid-2.5 and earlier platforms All configuration configurations where squid_ldap_auth is used for authentication using a search filter (-f option) and where squid_ldap_group is not used to further restrict the valid usernames. workaround Combine squid_ldap_auth with squid_ldap_group to only allow valid logins who are member of a certain group, or alternatively use a proxy_auth_regex acl to deny the use of any login using restricted characters. acl bad_login proxy_auth_regex [()\\*] http_access deny bad_login
24 lines
1.4 KiB
Text
24 lines
1.4 KiB
Text
$NetBSD: distinfo,v 1.50 2004/03/04 17:05:51 taca Exp $
|
|
|
|
SHA1 (squid-2.5.5/squid-2.5.STABLE5.tar.bz2) = fd632ebaad656566db11cf875868b19a9b4a71db
|
|
Size (squid-2.5.5/squid-2.5.STABLE5.tar.bz2) = 1044932 bytes
|
|
SHA1 (squid-2.5.5/squid-2.5.STABLE5-ntlm_assert.patch) = 28c62c898a653269bee01540dd34c0fc7545b958
|
|
Size (squid-2.5.5/squid-2.5.STABLE5-ntlm_assert.patch) = 545 bytes
|
|
SHA1 (squid-2.5.5/squid-2.5.STABLE5-ldap.patch) = b569f946c318f6cb7e84dd237bb33ce2022e7ccf
|
|
Size (squid-2.5.5/squid-2.5.STABLE5-ldap.patch) = 6245 bytes
|
|
SHA1 (patch-aa) = 2e0d96f6ccb9d0c42db2da49e76846edad09624f
|
|
SHA1 (patch-ab) = 1224ba4cee98a26d2c9d670eb6d57c6187ff2d56
|
|
SHA1 (patch-ac) = 1b283f0a573c02c82ce26f75e67d19b1ec5ff9f0
|
|
SHA1 (patch-ad) = 23a906011ffef78d070cc49c94c4f4837eb319ec
|
|
SHA1 (patch-ae) = 5031183c7512573c8c8602d0b0541999f43343f2
|
|
SHA1 (patch-ag) = fc215888a815d2b39f408b980f8bce3bf5ca998c
|
|
SHA1 (patch-aj) = aa2271e53602fe168604aeced6ed66d28fe47707
|
|
SHA1 (patch-ak) = 19861281d8a9ece352ce9e881e1e60f6787933e3
|
|
SHA1 (patch-al) = 534f273ec63f6de0818f1f86a2b655eac4564213
|
|
SHA1 (patch-an) = 8748cfb50e0acb6588228b87b424f87b0c48cc59
|
|
SHA1 (patch-ba) = c91bc26e4b6df2cb4b7042591efb4afd7c989462
|
|
SHA1 (patch-bb) = 70e92462230ac3b9920946b089290d9ec814fade
|
|
SHA1 (patch-bc) = 536299e59c396829f23484a14bb9a6f5c0a4de35
|
|
SHA1 (patch-ca) = 652e35b253a6b75a3ac452773d681e70c5fc310d
|
|
SHA1 (patch-cb) = 7fb49ee4f9e21dea9ca6e54da9a581866b225853
|
|
SHA1 (patch-cc) = 9d9cf0b66768b3942c1683a7a908bfb0aa2fe0f2
|