--- squid-2.5.9.orig/debian/doc/FAQ-1.html
+++ squid-2.5.9/debian/doc/FAQ-1.html
@@ -0,0 +1,484 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: About Squid, this FAQ, and other Squid information resources</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-2.html">Next</A>
+Previous
+<A HREF="FAQ.html#toc1">Contents</A>
+<HR>
+<H2><A NAME="s1">1. About Squid, this FAQ, and other Squid information resources</A></H2>
+
+<H2><A NAME="ss1.1">1.1 What is Squid?</A>
+</H2>
+
+<P>Squid is a high-performance proxy caching server for web clients,
+supporting FTP, gopher, and HTTP data objects.  Unlike traditional
+caching software, Squid handles all requests in a single,
+non-blocking, I/O-driven process.
+<P>Squid keeps
+meta data and especially hot objects cached in RAM, caches
+DNS lookups, supports non-blocking DNS lookups, and implements
+negative caching of failed requests.
+<P>Squid supports SSL, extensive
+access controls, and full request logging.  By using the
+lightweight Internet Cache Protocol, Squid caches can be arranged
+in a hierarchy or mesh for additional bandwidth savings.
+<P>
+<P>Squid consists of a main server program <EM>squid</EM>, a Domain Name System
+lookup program <EM>dnsserver</EM>, some optional programs for rewriting
+requests and performing authentication, and some management and client
+tools.  When <EM>squid</EM> starts up, it spawns a configurable number of
+<EM>dnsserver</EM> processes, each of which can perform a single, blocking
+Domain Name System (DNS) lookup.  This reduces the amount of time the
+cache waits for DNS lookups.
+<P>
+<P>Squid is derived from the ARPA-funded
+<A HREF="http://webharvest.sourceforge.net/ng/">Harvest project</A>.
+<P>
+<H2><A NAME="ss1.2">1.2 What is Internet object caching?</A>
+</H2>
+
+<P>Internet object caching is a way to store requested Internet objects
+(i.e., data available via the HTTP, FTP, and gopher protocols) on a
+system closer to the requesting site than to the source. Web browsers
+can then use the local Squid cache as a proxy HTTP server, reducing
+access time as well as bandwidth consumption.
+<P>
+<H2><A NAME="ss1.3">1.3 Why is it called Squid?</A>
+</H2>
+
+<P>Harris' Lament says, ``All the good ones are taken."
+<P>
+<P>We needed to distinguish this new version from the Harvest
+cache software.  Squid was the code name for initial
+development, and it stuck.
+<P>
+<H2><A NAME="ss1.4">1.4 What is the latest version of Squid?</A>
+</H2>
+
+<P>Squid is updated often; please see
+<A HREF="http://www.squid-cache.org/">the Squid home page</A>
+for the most recent versions.
+<P>
+<H2><A NAME="ss1.5">1.5 Who is responsible for Squid?</A>
+</H2>
+
+<P>Squid is the result of efforts by numerous individuals from
+the Internet community.
+<A HREF="mailto:wessels@squid-cache.org">Duane Wessels</A>
+of the National Laboratory for Applied Network Research (funded by
+the National Science Foundation) leads code development.
+Please see
+<A HREF="http://www.squid-cache.org/CONTRIBUTORS">the CONTRIBUTORS file</A>
+for a list of our excellent contributors.
+<P>
+<H2><A NAME="ss1.6">1.6 Where can I get Squid?</A>
+</H2>
+
+<P>You can download Squid via FTP from
+<A HREF="ftp://ftp.squid-cache.org/pub/">the primary FTP site</A>
+or one of the many worldwide
+<A HREF="http://www.squid-cache.org/mirrors.html">mirror sites</A>.
+<P>
+<P>Many sushi bars also have Squid.
+<P>
+<H2><A NAME="ss1.7">1.7 What Operating Systems does Squid support?</A>
+</H2>
+
+<P>The software is designed to operate on any modern Unix system, and
+is known to work on at least the following platforms:
+<UL>
+<LI> Linux</LI>
+<LI> FreeBSD</LI>
+<LI> NetBSD</LI>
+<LI> BSDI</LI>
+<LI> Mac OS/X</LI>
+<LI> OSF and Digital Unix</LI>
+<LI> IRIX</LI>
+<LI> SunOS/Solaris</LI>
+<LI> NeXTStep</LI>
+<LI> SCO Unix</LI>
+<LI> AIX</LI>
+<LI> HP-UX</LI>
+<LI> 
+<A HREF="FAQ-2.html#building-os2">OS/2</A></LI>
+</UL>
+<P>
+<P>For more specific information, please see
+<A HREF="http://www.squid-cache.org/platforms.html">platforms.html</A>.
+If you encounter any platform-specific problems, please
+let us know by registering a entry in our
+<A HREF="http://www.squid-cache.org/bugs/">bug database</A>.
+<P>
+<H2><A NAME="squid-NT"></A> <A NAME="ss1.8">1.8 Does Squid run on Windows NT?</A>
+</H2>
+
+<P>Recent versions of Squid will <EM>compile and run</EM> on Windows/NT
+with the
+<A HREF="http://cygwin.com/">Cygwin</A> /
+<A HREF="http://gnuwin32.sourceforge.net/">GnuWin32</A> packages.
+<P>
+<P>
+<A HREF="http://serassio.interfree.it/SquidNT.htm">Guido Serassio</A>
+have Squid NT pages and is actively working on having the needed changes integrated into the standard Squid distribution. Partially based on earlier NT port by 
+<A HREF="http://www.phys-iasi.ro/users/romeo/squidnt.htm">Romeo Anghelache</A>.
+<P>
+<P>
+<A HREF="http://www.logisense.com/">LogiSense</A>
+has ported Squid to Windows NT and sells a supported
+version.  You can also download the source from
+<A HREF="ftp://ftp.logisense.com/pub/cachexpress/">their FTP site</A>.
+Thanks to LogiSense for making the code available as required by the GPL terms.
+<P>
+<H2><A NAME="ss1.9">1.9 What Squid mailing lists are available?</A>
+</H2>
+
+<P>
+<UL>
+<LI> squid-users@squid-cache.org: general discussions about the
+Squid cache software. Subscribe via
+<I>squid-users-subscribe@squid-cache.org</I>.
+
+Previous messages are available for browsing at
+<A HREF="http://www.squid-cache.org/mail-archive/squid-users/">the Squid Users Archive</A>,
+and also at 
+<A HREF="http://marc.theaimsgroup.com/?l=squid-users&amp;r=1&amp;w=2">theaimsgroup.com</A>.
+</LI>
+<LI>squid-users-digest: digested (daily) version of
+above.  Subscribe via
+<I>squid-users-digest-subscribe@squid-cache.org</I>.
+</LI>
+<LI>squid-announce@squid-cache.org: A receive-only list for
+announcements of new versions.
+Subscribe via
+<I>squid-announce-subscribe@squid-cache.org</I>.
+</LI>
+<LI><I>squid-bugs@squid-cache.org</I>:
+A closed list for sending us bug reports.
+Bug reports received here are given priority over
+those mentioned on squid-users.
+</LI>
+<LI><I>squid@squid-cache.org</I>:
+A closed list for sending us feed-back and ideas.
+</LI>
+<LI><I>squid-faq@squid-cache.org</I>:
+A closed list for sending us feed-back, updates, and additions to
+the Squid FAQ.</LI>
+</UL>
+<P>
+<P>We also have a few other mailing lists which are not strictly
+Squid-related.
+<P>
+<UL>
+<LI><I>cache-snmp@ircache.net</I>:
+A public list for discussion of Web Caching and SNMP issues and developments.
+Eventually we hope to put forth a standard Web Caching MIB.
+</LI>
+<LI><I>icp-wg@ircache.net</I>:
+Mostly-idle mailing list for the nonexistent ICP Working Group within
+the IETF.  It may be resurrected some day, you never know!
+</LI>
+</UL>
+<P>
+<H2><A NAME="ss1.10">1.10 I can't figure out how to unsubscribe from your mailing list.</A>
+</H2>
+
+<P>All of our mailing lists have ``-subscribe'' and ``-unsubscribe''
+addresses that you must
+use for subscribe and unsubscribe requests.  To unsubscribe from
+the squid-users list, you send a message to <EM>squid-users-unsubscribe@squid-cache.org</EM>.
+<P>
+<H2><A NAME="ss1.11">1.11 What Squid web pages are available?</A>
+</H2>
+
+<P>Several Squid and Caching-related web pages are available:
+<UL>
+<LI>
+<A HREF="http://www.squid-cache.org/">The Squid home page</A>
+for information on the Squid software
+</LI>
+<LI>
+<A HREF="http://www.ircache.net/Cache/">The IRCache Mesh</A>
+gives information on our operational mesh of caches.
+</LI>
+<LI>
+<A HREF="http://www.squid-cache.org/Doc/FAQ/">The Squid FAQ</A> (uh, you're reading it).
+</LI>
+<LI>
+<A HREF="http://squid-docs.sourceforge.net/latest/html/book1.htm">Oskar's Squid Users Guide</A>.
+</LI>
+<LI>
+<A HREF="http://www.ircache.net/Cache/FAQ/">The Information Resource Caching FAQ</A>
+</LI>
+<LI>
+<A HREF="http://www.squid-cache.org/Doc/Prog-Guide/prog-guide.html">Squid Programmers Guide</A>.
+Yeah, its extremely incomplete.  I assure you this is the most recent version.
+</LI>
+<LI>
+<A HREF="http://www.ircache.net/Cache/reading.html">Web Caching Reading list</A>
+</LI>
+<LI>
+<A HREF="/Versions/1.0/Release-Notes-1.0.txt">Squid-1.0 Release Notes</A></LI>
+<LI>
+<A HREF="/Versions/1.1/Release-Notes-1.1.txt">Squid-1.1 Release Notes</A></LI>
+<LI>
+<A HREF="http://www.squid-cache.org/Doc/Hierarchy-Tutorial/">Tutorial on Configuring Hierarchical Squid Caches</A></LI>
+<LI>
+<A HREF="http://info.internet.isi.edu/in-notes/rfc/files/rfc2186.txt">RFC 2186</A> ICPv2 -- Protocol</LI>
+<LI>
+<A HREF="http://info.internet.isi.edu/in-notes/rfc/files/rfc2187.txt">RFC 2187</A> ICPv2 -- Application</LI>
+<LI>
+<A HREF="http://info.internet.isi.edu/in-notes/rfc/files/rfc1016.txt">RFC 1016</A></LI>
+</UL>
+<P>
+<H2><A NAME="ss1.12">1.12 Does Squid support SSL/HTTPS/TLS?</A>
+</H2>
+
+<P>As of version 2.5, Squid can terminate SSL connections.  This is perhaps
+only useful in a surrogate (http accelerator) configuration.  You must
+run configure with <EM>--enable-ssl</EM>.  See <EM>https_port</EM> in
+squid.conf for more information.
+<P>
+<P>Squid also supports these encrypted protocols by ``tunelling''
+traffic between clients and servers.  In this case, Squid can relay
+the encrypted bits between a client and a server.
+<P>
+<P>Normally, when your browser comes across an <EM>https</EM> URL, it
+does one of two things:
+<P>
+<OL>
+<LI>The browser opens an SSL connection directly to the origin
+server.</LI>
+<LI>The browser tunnels the request through Squid with the
+<EM>CONNECT</EM> request method.</LI>
+</OL>
+<P>The <EM>CONNECT</EM> method is a way to tunnel any kind of
+connection through an HTTP proxy.  The proxy doesn't 
+understand or interpret the contents.  It just passes 
+bytes back and forth between the client and server.
+For the gory details on tunnelling and the CONNECT
+method, please see
+<A HREF="ftp://ftp.isi.edu/in-notes/rfc2817.txt">RFC 2817</A>
+and 
+<A HREF="http://www.web-cache.com/Writings/Internet-Drafts/draft-luotonen-web-proxy-tunneling-01.txt">Tunneling TCP based protocols through Web proxy servers</A> (expired).
+<P>
+<P>
+<H2><A NAME="ss1.13">1.13 What's the legal status of Squid?</A>
+</H2>
+
+<P>Squid is 
+<A HREF="squid-copyright.txt">copyrighted</A>
+by the University of California San Diego.
+Squid uses some 
+<A HREF="squid-credits.txt">code developed by others</A>.
+<P>
+<P>Squid is
+<A HREF="http://www.gnu.org/philosophy/free-sw.html">Free Software</A>.
+<P>
+<P>Squid is licensed under the terms of the
+<A HREF="http://www.gnu.org/copyleft/gpl.html">GNU General Public License</A>.
+<P>
+<H2><A NAME="ss1.14">1.14 Is Squid year-2000 compliant?</A>
+</H2>
+
+<P>We think so.  Squid uses the Unix time format for all internal time
+representations.  Potential problem areas are in printing and
+parsing other time representations.  We have made the following
+fixes in to address the year 2000:
+<UL>
+<LI><EM>cache.log</EM> timestamps use 4-digit years instead of just 2 digits.</LI>
+<LI><EM>parse_rfc1123()</EM> assumes years less than "70" are after 2000.</LI>
+<LI><EM>parse_iso3307_time()</EM> checks all four year digits.
+</LI>
+</UL>
+<P>
+<P>Year-2000 fixes were applied to the following Squid versions:
+<UL>
+<LI>
+<A HREF="/Versions/v2/2.1/">squid-2.1</A>:
+Year parsing bug fixed for dates in the "Wed Jun  9 01:29:59 1993 GMT"
+format (Richard Kettlewell).</LI>
+<LI>squid-1.1.22:
+Fixed likely year-2000 bug in ftpget's timestamp parsing (Henrik Nordstrom).</LI>
+<LI>squid-1.1.20:
+Misc fixes (Arjan de Vet).</LI>
+</UL>
+<P>
+<P>Patches:
+<UL>
+<LI>
+<A HREF="../Y2K/patch3">Richard's lib/rfc1123.c patch</A>.
+If you are still running 1.1.X, then you should apply this patch to
+your source and recompile.</LI>
+<LI>
+<A HREF="../Y2K/patch2">Henrik's src/ftpget.c patch</A>.</LI>
+<LI>
+<A HREF="../Y2K/patch1">Arjan's lib/rfc1123.c patch</A>.</LI>
+</UL>
+<P>
+<P>Squid-2.2 and earlier versions have a 
+<A HREF="http://www.squid-cache.org/Versions/v2/2.2/bugs/index.html#squid-2.2.stable5-mkhttpdlogtime-end-of-year">New Year bug</A>.  This is not strictly a Year-2000 bug; it would happen on the first day of any year.
+<P>
+<H2><A NAME="ss1.15">1.15 Can I pay someone for Squid support?</A>
+</H2>
+
+<P>Yep.  Please see the 
+<A HREF="/Support/services.html">commercial support page</A>.
+<P>
+<P>
+<H2><A NAME="ss1.16">1.16 Squid FAQ contributors</A>
+</H2>
+
+<P>The following people have made contributions to this document:
+<UL>
+<LI>
+<A HREF="mailto:JLarmour@origin-at.co.uk">Jonathan Larmour</A></LI>
+<LI>
+<A HREF="mailto:cord@Wunder-Nett.org">Cord Beermann</A></LI>
+<LI>
+<A HREF="mailto:tony@nlanr.net">Tony Sterrett</A></LI>
+<LI>
+<A HREF="mailto:ghynes@compusult.nf.ca">Gerard Hynes</A></LI>
+<LI>
+<A HREF="mailto:tkatayam@pi.titech.ac.jp">Katayama, Takeo</A></LI>
+<LI>
+<A HREF="mailto:wessels@ircache.net">Duane Wessels</A></LI>
+<LI>
+<A HREF="mailto:kc@caida.org">K Claffy</A></LI>
+<LI>
+<A HREF="mailto:pauls@etext.org">Paul Southworth</A></LI>
+<LI>
+<A HREF="mailto:oskar@is.co.za">Oskar Pearson</A></LI>
+<LI>
+<A HREF="mailto:ongbh@zpoprp.zpo.dec.com">Ong Beng Hui</A></LI>
+<LI>
+<A HREF="mailto:torsten.sturm@axis.de">Torsten Sturm</A></LI>
+<LI>
+<A HREF="mailto:jrg@blodwen.demon.co.uk">James R Grinter</A></LI>
+<LI>
+<A HREF="mailto:roever@nse.simac.nl">Rodney van den Oever</A></LI>
+<LI>
+<A HREF="mailto:bertold@tohotom.vein.hu">Kolics Bertold</A></LI>
+<LI>
+<A HREF="mailto:carson@cugc.org">Carson Gaspar</A></LI>
+<LI>
+<A HREF="mailto:michael@metal.iinet.net.au">Michael O'Reilly</A></LI>
+<LI>
+<A HREF="mailto:hclsmith@tallships.istar.ca">Hume Smith</A></LI>
+<LI>
+<A HREF="mailto:RichardA@noho.co.uk">Richard Ayres</A></LI>
+<LI>
+<A HREF="mailto:John.Saunders@scitec.com.au">John Saunders</A></LI>
+<LI>
+<A HREF="mailto:miquels@cistron.nl">Miquel van Smoorenburg</A></LI>
+<LI>
+<A HREF="mailto:david@avarice.nepean.uws.edu.au">David J N Begley</A></LI>
+<LI>
+<A HREF="mailto:SarKev@topnz.ac.nz">Kevin Sartorelli</A></LI>
+<LI>
+<A HREF="mailto:doering@usf.uni-kassel.de">Andreas Doering</A></LI>
+<LI>
+<A HREF="mailto:mark@cal026031.student.utwente.nl">Mark Visser</A></LI>
+<LI>
+<A HREF="mailto:tom@interact.net.au">tom minchin</A></LI>
+<LI>
+<A HREF="mailto:voeckler@rvs.uni-hannover.de">Jens-S. V&ouml;ckler</A></LI>
+<LI>
+<A HREF="mailto:andre.albsmeier@mchp.siemens.de">Andre Albsmeier</A></LI>
+<LI>
+<A HREF="mailto:nazard@man-assoc.on.ca">Doug Nazar</A></LI>
+<LI>
+<A HREF="mailto:hno@squid-cache.org">Henrik Nordstrom</A></LI>
+<LI>
+<A HREF="mailto:mark@rts.com.au">Mark Reynolds</A></LI>
+<LI>
+<A HREF="mailto:Arjan.deVet@adv.IAEhv.nl">Arjan de Vet</A></LI>
+<LI>
+<A HREF="mailto:peter@spinner.dialix.com.au">Peter Wemm</A></LI>
+<LI>
+<A HREF="mailto:webadm@info.cam.ac.uk">John Line</A></LI>
+<LI>
+<A HREF="mailto:ARMISTEJ@oeca.otis.com">Jason Armistead</A></LI>
+<LI>
+<A HREF="mailto:cudch@csv.warwick.ac.uk">Chris Tilbury</A></LI>
+<LI>
+<A HREF="mailto:jeff@sisna.com">Jeff Madison</A></LI>
+<LI>
+<A HREF="mailto:mbatchelor@citysearch.com">Mike Batchelor</A></LI>
+<LI>
+<A HREF="mailto:bogstad@pobox.com">Bill Bogstad</A></LI>
+<LI>
+<A HREF="mailto:radu at netsoft dot ro">Radu Greab</A></LI>
+<LI>
+<A HREF="mailto:f.j.bosscha@nhl.nl">F.J. Bosscha</A></LI>
+<LI>
+<A HREF="mailto:signal@shreve.net">Brian Feeny</A></LI>
+<LI>
+<A HREF="mailto:Support@dnet.co.uk">Martin Lyons</A></LI>
+<LI>
+<A HREF="mailto:david@luyer.net">David Luyer</A></LI>
+<LI>
+<A HREF="mailto:chris@senet.com.au">Chris Foote</A></LI>
+<LI>
+<A HREF="mailto:elkner@wotan.cs.Uni-Magdeburg.DE">Jens Elkner</A></LI>
+<LI>
+<A HREF="mailto:simon@mtds.com">Simon White</A></LI>
+<LI>
+<A HREF="mailto: jmurdoc at itraktech dot com">Jerry Murdock</A></LI>
+<LI>
+<A HREF="mailto: geviston at bigpond dot net dot au">Gerard Eviston</A></LI>
+<LI>
+<A HREF="mailto: rob at poeweb dot com">Rob Poe</A></LI>
+</UL>
+<P>Please send corrections, updates, and comments to:
+<A HREF="mailto:squid-faq@squid-cache.org">squid-faq@squid-cache.org</A>.
+<P>
+<H2><A NAME="ss1.17">1.17 About This Document</A>
+</H2>
+
+<P>This document is copyrighted (2000) by Duane Wessels.
+<P>
+<P>This document was written in SGML and converted with the
+<A HREF="http://www.sgmltools.org/">SGML-Tools package</A>.
+<P>
+<P>Most current version of this document can always be found at
+<A HREF="http://www.squid-cache.org/Doc/FAQ/">http://www.squid-cache.org/Doc/FAQ/</A> in HTML, Plain Text, Postscript and SGML formats.
+<P>
+<H3>Want to contribute?  Please write in SGML...</H3>
+
+<P>It is easier for us if you send us text which is close to "correct" SGML.
+The SQUID FAQ currently uses the LINUXDOC DTD.  Its probably easiest
+to follow examples in the this file.
+Here are the basics:
+<P>
+<P>Use the &lt;url&gt; tag for links, instead of HTML &lt;A HREF ...&gt;
+<PRE>
+        &lt;url url="http://www.squid-cache.org" name="Squid Home Page"&gt;
+</PRE>
+<P>
+<P>Use &lt;em&gt; for emphasis, config options, and pathnames:
+<PRE>
+        &lt;em&gt;usr/local/squid/etc/squid.conf&lt;/em&gt;
+        &lt;em/cache_peer/
+</PRE>
+<P>
+<P>Here is how you do lists:
+<PRE>
+        &lt;itemize&gt;
+        &lt;item&gt;foo
+        &lt;item&gt;bar
+        &lt;/itemize&gt;
+</PRE>
+<P>
+<P>Use &lt;verb&gt;, just like HTML's &lt;PRE&gt; to show
+unformatted text.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-2.html">Next</A>
+Previous
+<A HREF="FAQ.html#toc1">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-10.html
+++ squid-2.5.9/debian/doc/FAQ-10.html
@@ -0,0 +1,732 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Access Controls</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-11.html">Next</A>
+<A HREF="FAQ-9.html">Previous</A>
+<A HREF="FAQ.html#toc10">Contents</A>
+<HR>
+<H2><A NAME="access-controls"></A> <A NAME="s10">10. Access Controls</A></H2>
+
+<H2><A NAME="ss10.1">10.1 Introduction</A>
+</H2>
+
+<P>Squid's access control scheme is relatively comprehensive and difficult
+for some people to understand.  There are two different components: <EM>ACL elements</EM>,
+and <EM>access lists</EM>.  An access list consists of an <EM>allow</EM> or <EM>deny</EM> action
+followed by a number of ACL elements.
+<P>
+<H3>ACL elements</H3>
+
+<P><EM>Note: The information here is current for version 2.4.</EM>
+<P>Squid knows about the following types of ACL elements:
+<UL>
+<LI><B>src</B>: source (client) IP addresses</LI>
+<LI><B>dst</B>: destination (server) IP addresses</LI>
+<LI><B>myip</B>: the local IP address of a client's connection</LI>
+<LI><B>srcdomain</B>: source (client) domain name</LI>
+<LI><B>dstdomain</B>: destination (server) domain name</LI>
+<LI><B>srcdom_regex</B>: source (client) regular expression pattern matching</LI>
+<LI><B>dstdom_regex</B>: destination (server) regular expression pattern matching</LI>
+<LI><B>time</B>: time of day, and day of week</LI>
+<LI><B>url_regex</B>: URL regular expression pattern matching</LI>
+<LI><B>urlpath_regex</B>: URL-path regular expression pattern matching, leaves out the protocol and hostname</LI>
+<LI><B>port</B>: destination (server) port number</LI>
+<LI><B>myport</B>: local port number that client connected to</LI>
+<LI><B>proto</B>: transfer protocol (http, ftp, etc)</LI>
+<LI><B>method</B>: HTTP request method (get, post, etc)</LI>
+<LI><B>browser</B>: regular expression pattern matching on the request's user-agent header</LI>
+<LI><B>ident</B>: string matching on the user's name</LI>
+<LI><B>ident_regex</B>: regular expression pattern matching on the user's name</LI>
+<LI><B>src_as</B>: source (client) Autonomous System number</LI>
+<LI><B>dst_as</B>: destination (server) Autonomous System number</LI>
+<LI><B>proxy_auth</B>: user authentication via external processes</LI>
+<LI><B>proxy_auth_regex</B>: user authentication via external processes</LI>
+<LI><B>snmp_community</B>: SNMP community string matching</LI>
+<LI><B>maxconn</B>: a limit on the maximum number of connections from a single client IP address</LI>
+<LI><B>req_mime_type</B>: regular expression pattern matching on the request content-type header</LI>
+<LI><B>arp</B>: Ethernet (MAC) address matching</LI>
+</UL>
+<P>
+<P>Notes:
+<P>
+<P>Not all of the ACL elements can be used with all types of access lists (described below).
+For example, <EM>snmp_community</EM> is only meaningful when used with <EM>snmp_access</EM>.  The
+<EM>src_as</EM> and <EM>dst_as</EM> types are only used in <EM>cache_peer_access</EM> access lists.
+<P>
+<P>The <EM>arp</EM> ACL requires the special configure option --enable-arp-acl.  Furthermore, the 
+ARP ACL code is not portable to all operating systems.  It works on Linux, Solaris, and 
+some *BSD variants.
+<P>
+<P>The SNMP ACL element and access list require the --enable-snmp configure option.
+<P>
+<P>Some ACL elements can cause processing delays.  For example, use of <EM>src_domain</EM> and <EM>srcdom_regex</EM>
+require a reverse DNS lookup on the client's IP address.  This lookup adds some delay to the request.
+<P>
+<P>Each ACL element is assigned a unique <EM>name</EM>.  A named ACL element consists of a <EM>list of values</EM>.
+When checking for a match, the multiple values use OR logic.  In other words, an ACL element is <EM>matched</EM>
+when any one of its values is a match.
+<P>
+<P>You can't give the same name to two different types of ACL elements.  It will generate a syntax error.
+<P>
+<P>You can put different values for the same ACL name on different lines.  Squid combines them into
+one list.
+<P>
+<H3>Access Lists</H3>
+
+<P>There are a number of different access lists:
+<UL>
+<LI><B>http_access</B>: Allows HTTP clients (browsers) to access the HTTP port.  This is the primary access control list.</LI>
+<LI><B>icp_access</B>: Allows neighbor caches to query your cache with ICP.</LI>
+<LI><B>miss_access</B>: Allows certain clients to forward cache misses through your cache.</LI>
+<LI><B>no_cache</B>: Defines responses that should not be cached.</LI>
+<LI><B>redirector_access</B>: Controls which requests are sent through the redirector pool.</LI>
+<LI><B>ident_lookup_access</B>: Controls which requests need an Ident lookup.</LI>
+<LI><B>always_direct</B>: Controls which requests should always be forwarded directly to origin servers.</LI>
+<LI><B>never_direct</B>: Controls which requests should never be forwarded directly to origin servers.</LI>
+<LI><B>snmp_access</B>: Controls SNMP client access to the cache.</LI>
+<LI><B>broken_posts</B>: Defines requests for which squid appends an extra CRLF after POST message bodies as required by some broken origin servers.</LI>
+<LI><B>cache_peer_access</B>: Controls which requests can be forwarded to a given neighbor (peer).</LI>
+</UL>
+<P>
+<P>Notes:
+<P>
+<P>An access list <EM>rule</EM> consists of an <EM>allow</EM> or <EM>deny</EM> keyword, followed by a list of ACL element names.
+<P>
+<P>An access list consists of one or more access list rules.
+<P>
+<P>Access list rules are checked in the order they are written.  List searching terminates as soon as one
+of the rules is a match.
+<P>
+<P>If a rule has multiple ACL elements, it uses AND logic.  In other
+words, <EM>all</EM> ACL elements of the rule must be a match in order
+for the rule to be a match.  This means that it is possible to
+write a rule that can never be matched.  For example, a port number
+can never be equal to both 80 AND 8000 at the same time.
+<P>
+<P>To summarise the acl logics can be described as:
+<PRE>
+        http_access allow|deny acl AND acl AND ...
+            OR
+        http_access allow|deny acl AND acl AND ...
+            OR
+        ...
+</PRE>
+<P>
+<P>If none of the rules are matched, then the default action is the
+<EM>opposite</EM> of the last rule in the list.  Its a good idea to
+be explicit with the default action.  The best way is to thse
+the <EM>all</EM> ACL.  For example:
+<PRE>
+        acl all src 0/0
+        http_access deny all
+</PRE>
+<P>
+<P>
+<H2><A NAME="ss10.2">10.2 How do I allow my clients to use the cache?</A>
+</H2>
+
+<P>Define an ACL that corresponds to your client's IP addresses.
+For example:
+<PRE>
+        acl myclients src 172.16.5.0/24
+</PRE>
+
+Next, allow those clients in the <EM>http_access</EM> list:
+<PRE>
+        http_access allow myclients
+</PRE>
+<P>
+<H2><A NAME="ss10.3">10.3 how do I configure Squid not to cache a specific server? </A>
+</H2>
+
+<P>
+<PRE>
+        acl someserver dstdomain .someserver.com
+        no_cache deny someserver
+</PRE>
+<P>
+<P>
+<H2><A NAME="ss10.4">10.4 How do I implement an ACL ban list?</A>
+</H2>
+
+<P>As an example, we will assume that you would like to prevent users from
+accessing cooking recipes.
+<P>
+<P>One way to implement this would be to deny access to any URLs
+that contain the words ``cooking'' or ``recipe.''
+You would use these configuration lines:
+<PRE>
+        acl Cooking1 url_regex cooking
+        acl Recipe1 url_regex recipe
+        http_access deny Cooking1
+        http_access deny Recipe1
+        http_access allow all
+</PRE>
+
+The <EM>url_regex</EM> means to search the entire URL for the regular
+expression you specify.  Note that these regular expressions are case-sensitive,
+so a url containing ``Cooking'' would not be denied.
+<P>
+<P>Another way is to deny access to specific servers which are known
+to hold recipes.  For example:
+<PRE>
+        acl Cooking2 dstdomain www.gourmet-chef.com
+        http_access deny Cooking2
+        http_access allow all
+</PRE>
+
+The <EM>dstdomain</EM> means to search the hostname in the URL for the
+string ``www.gourmet-chef.com.''
+Note that when IP addresses are used in URLs (instead of domain names),
+Squid-1.1 implements relaxed access controls.  If the a domain name
+for the IP address has been saved in Squid's ``FQDN cache,'' then
+Squid can compare the destination domain against the access controls.
+However, if the domain is not immediately available, Squid allows
+the request and makes a lookup for the IP address so that it may
+be available for future reqeusts.
+<P>
+<P>
+<P>
+<H2><A NAME="ss10.5">10.5 How do I block specific users or groups from accessing my cache?</A>
+</H2>
+
+<H3>Ident</H3>
+
+<P>You can use
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc931.txt">ident lookups</A>
+to allow specific users access to your cache.  This requires that an
+<A HREF="ftp://ftp.lysator.liu.se/pub/ident/servers">ident server</A>
+process runs on the user's machine(s).
+In your <EM>squid.conf</EM> configuration
+file you would write something like this:
+<PRE>
+        ident_lookup on
+        acl friends user kim lisa frank joe
+        http_access allow friends
+        http_access deny all
+</PRE>
+<P>
+<H3><A NAME="proxy-auth-acl"></A> Proxy Authentication</H3>
+
+<P>Another option is to use proxy-authentication.    In this scheme, you assign
+usernames and passwords to individuals.  When they first use the proxy
+they are asked to authenticate themselves by entering their username and
+password.
+<P>
+<P>In Squid v2 this authentication is hanled via external processes.  For
+information on how to configure this, please see
+<A HREF="FAQ-19.html#configuring-proxy-auth">Configuring Proxy Authentication</A>.
+<P>
+<H2><A NAME="ss10.6">10.6 Do you have a CGI program which lets users change their own proxy passwords?</A>
+</H2>
+
+<P>
+<A HREF="mailto:orso@ineparnet.com.br">Pedro L Orso</A>
+has adapted the Apache's <EM>htpasswd</EM> into a CGI program
+called 
+<A HREF="/htpasswd/chpasswd-cgi.tar.gz">chpasswd.cgi</A>.
+<P>
+<P>
+<P>
+<H2><A NAME="ss10.7">10.7 Is there a way to do ident lookups only for a certain host and compare the result with a userlist in squid.conf?</A>
+</H2>
+
+<P>Sort of.
+<P>
+<P>If you use a <EM>user</EM> ACL in squid conf, then Squid will perform
+an
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc931.txt">ident lookup</A>
+for every client request.  In other words, Squid-1.1 will perform
+ident lookups for all requests or no requests.  Defining a <EM>user</EM> ACL
+enables ident lookups, regardless of the <EM>ident_lookup</EM> setting.
+<P>
+<P>However, even though ident lookups are performed for every request, Squid does
+not wait for the lookup to complete unless the ACL rules require it.  Consider this
+configuration:
+<PRE>
+        acl host1 src 10.0.0.1
+        acl host2 src 10.0.0.2
+        acl pals  user kim lisa frank joe
+        http_access allow host1
+        http_access allow host2 pals
+</PRE>
+
+Requests coming from 10.0.0.1 will be allowed immediately because
+there are no user requirements for that host.  However, requests
+from 10.0.0.2 will be allowed only after the ident lookup completes, and
+if the username is in the set kim, lisa, frank, or joe.
+<P>
+<H2><A NAME="ss10.8">10.8 Common Mistakes</A>
+</H2>
+
+<H3>And/Or logic</H3>
+
+<P>You've probably noticed (and been frustrated by) the fact that
+you cannot combine access controls with terms like ``and'' or ``or.''
+These operations are already built in to the access control scheme
+in a fundamental way which you must understand.
+<UL>
+<LI><B>All elements of an <EM>acl</EM> entry are OR'ed together</B>.</LI>
+<LI><B>All elements of an <EM>access</EM> entry are AND'ed together</B>.
+e.g. <EM>http_access</EM> and <EM>icp_access</EM>.</LI>
+</UL>
+<P>
+<P>For example, the following access control configuration will never work:
+<PRE>
+        acl ME src 10.0.0.1
+        acl YOU src 10.0.0.2
+        http_access allow ME YOU
+</PRE>
+
+In order for the request to be allowed, it must match the ``ME'' acl AND the ``YOU'' acl.
+This is impossible because any IP address could only match one or the other.  This
+should instead be rewritten as:
+<PRE>
+        acl ME src 10.0.0.1
+        acl YOU src 10.0.0.2
+        http_access allow ME
+        http_access allow YOU
+</PRE>
+
+Or, alternatively, this would also work:
+<PRE>
+        acl US src 10.0.0.1 10.0.0.2
+        http_access allow US
+</PRE>
+<P>
+<H3>allow/deny mixups</H3>
+
+<P><I>I have read through my squid.conf numerous times, spoken to my
+neighbors, read the FAQ and Squid Docs and cannot for the life of
+me work out why the following will not work.</I>
+<P>
+<P><I>I can successfully access cachemgr.cgi from our web server machine here,
+but I would like to use MRTG to monitor various aspects of our proxy.
+When I try to use 'client' or GET cache_object from the machine the
+proxy is running on, I always get access denied.</I>
+<P>
+<PRE>
+        acl manager proto cache_object
+        acl localhost src 127.0.0.1/255.255.255.255
+        acl server    src 1.2.3.4/255.255.255.255
+        acl all src 0.0.0.0/0.0.0.0
+        acl ourhosts src 1.2.0.0/255.255.0.0
+
+        http_access deny manager !localhost !server
+        http_access allow ourhosts
+        http_access deny all
+</PRE>
+<P>
+<P>The intent here is to allow cache manager requests from the <EM>localhost</EM>
+and <EM>server</EM> addresses, and deny all others.  This policy has been
+expressed here:
+<PRE>
+        http_access deny manager !localhost !server
+</PRE>
+<P>
+<P>The problem here is that for allowable requests, this access rule is
+not matched.  For example, if the source IP address is <EM>localhost</EM>,
+then ``!localhost'' is <EM>false</EM> and the access rule is not matched, so
+Squid continues checking the other rules.  Cache manager requests from
+the <EM>server</EM> address work because <EM>server</EM> is a subset of <EM>ourhosts</EM>
+and the second access rule will match and allow the request.  Also note that
+this means any cache manager request from <EM>ourhosts</EM> would be allowed.
+<P>
+<P>To implement the desired policy correctly, the access rules should be
+rewritten as
+<PRE>
+        http_access allow manager localhost
+        http_access allow manager server
+        http_access deny manager
+        http_access allow ourhosts
+        http_access deny all
+</PRE>
+
+If you're using <EM>miss_access</EM>, then don't forget to also add
+a <EM>miss_access</EM> rule for the cache manager:
+<PRE>
+        miss_access allow manager
+</PRE>
+<P>
+<P>You may be concerned that the having five access rules instead of three
+may have an impact on the cache performance.  In our experience this is
+not the case.  Squid is able to handle a moderate amount of access control
+checking without degrading overall performance.  You may like to verify
+that for yourself, however.
+<P>
+<H3>Differences between <EM>src</EM> and <EM>srcdomain</EM> ACL types.</H3>
+
+<P>For the <EM>srcdomain</EM> ACL type, Squid does a reverse lookup
+of the client's IP address and checks the result with the domains
+given on the <EM>acl</EM> line.  With the <EM>src</EM> ACL type, Squid
+converts hostnames to IP addresses at startup and then only compares
+the client's IP address.  The <EM>src</EM> ACL is preferred over <EM>srcdomain</EM>
+because it does not require address-to-name lookups for each request.
+<P>
+<P>
+<H2><A NAME="acl-debug"></A> <A NAME="ss10.9">10.9 I set up my access controls, but they don't work!  why?</A>
+</H2>
+
+<P>If ACLs are giving you problems and you don't know why they
+aren't working, you can use this tip to debug them.
+<P>In <EM>squid.conf</EM> enable debugging for section 33 at level 2.
+For example:
+<PRE>
+debug_options ALL,1 33,2
+</PRE>
+
+Then restart or reconfigure squid.
+<P>From now on, your <EM>cache.log</EM> should contain a line for every
+request that explains if it was allowed, or denied, and which
+ACL was the last one that it matched.
+<P>If this does not give you sufficient information to nail down the
+problem you can also enable detailed debug information on ACL processing
+<PRE>
+debug_options ALL,1 33,2 28,9
+</PRE>
+
+Then restart or reconfigure squid as above.
+<P>From now on, your <EM>cache.log</EM> should contain detailed traces
+of all access list processing. Be warned that this can be quite
+some lines per request.
+<P>
+<P>See also 
+<A HREF="FAQ-11.html#debug">11.20 Debug Squid</A><P>
+<H2><A NAME="ss10.10">10.10 Proxy-authentication and neighbor caches</A>
+</H2>
+
+<P>The problem...
+<BLOCKQUOTE>
+<PRE>
+                       [ Parents ]
+                       /         \
+                      /           \
+               [ Proxy A ] --- [ Proxy B ]
+                   |
+                   |
+                  USER
+</PRE>
+
+<P><I>Proxy A sends and ICP query to Proxy B about an object, Proxy B replies with an
+ICP_HIT.  Proxy A forwards the HTTP request to Proxy B, but
+does not pass on the authentication details, therefore the HTTP GET from
+Proxy A fails.</I>
+</BLOCKQUOTE>
+<P>
+<P>Only ONE proxy cache in a chain is allowed to ``use'' the Proxy-Authentication
+request header.  Once the header is used, it must not be passed on to
+other proxies.
+<P>
+<P>Therefore, you must allow the neighbor caches to request from each other
+without proxy authentication.  This is simply accomplished by listing
+the neighbor ACL's first in the list of <EM>http_access</EM> lines.  For example:
+<PRE>
+        acl proxy-A src 10.0.0.1
+        acl proxy-B src 10.0.0.2
+        acl user_passwords proxy_auth /tmp/user_passwds
+
+        http_access allow proxy-A
+        http_access allow proxy-B
+        http_access allow user_passwords
+        http_access deny all
+</PRE>
+<P>
+<H2><A NAME="ss10.11">10.11 Is there an easy way of banning all Destination addresses except one?</A>
+</H2>
+
+<P>
+<PRE>
+        acl GOOD dst 10.0.0.1
+        acl BAD dst 0.0.0.0/0.0.0.0
+        http_access allow GOOD
+        http_access deny BAD
+</PRE>
+<P>
+<H2><A NAME="ss10.12">10.12 Does anyone have a ban list of porn sites and such?</A>
+</H2>
+
+<P>
+<UL>
+<LI>
+<A HREF="http://members.lycos.co.uk/njadmin">Jasons Staudenmayer</A></LI>
+<LI>
+<A HREF="http://web.onda.com.br/orso/">Pedro Lineu Orso's List</A></LI>
+<LI>
+<A HREF="http://www.hklc.com/squidblock/">Linux Center Hong Kong's List</A></LI>
+<LI>Snerpa, an ISP in Iceland operates a DNS-database of
+IP-addresses of blacklisted sites containing porn, violence,
+etc. which is utilized using a small perl-script redirector.
+Information on this on the 
+<A HREF="http://www.snerpa.is/notendur/infilter/infilter-en.phtml">INfilter</A> webpage.</LI>
+<LI>The 
+<A HREF="http://www.squidguard.org/blacklist/">SquidGuard</A>
+redirector folks provide a blacklist.</LI>
+</UL>
+<P>
+<H2><A NAME="ss10.13">10.13 Squid doesn't match my subdomains</A>
+</H2>
+
+<P>NOTE: Current Squid versions (as of Squid-2.4) will warn you
+when this kind of configuration is used. Also the configuration here uses
+the dstdomain syntax of Squid-2.1 or earlier.. (2.2 and later needs to
+have domains prefixed by a dot)
+<P>There is a subtle problem with domain-name based access controls
+when a single ACL element has an entry that is a subdomain of
+another entry.  For example, consider this list:
+<PRE>
+        acl FOO dstdomain boulder.co.us vail.co.us co.us
+</PRE>
+<P>In the first place, the above list is simply wrong because
+the first two (<EM>boulder.co.us</EM> and <EM>vail.co.us</EM>) are
+unnecessary.  Any domain name that matches one of the first two
+will also match the last one (<EM>co.us</EM>).  Ok, but why does this
+happen?
+<P>
+<P>The problem stems from the data structure used to index domain
+names in an access control list.  Squid uses <EM>Splay trees</EM>
+for lists of domain names.  As other tree-based data structures,
+the searching algorithm requires a comparison function that returns
+-1, 0, or +1 for any pair of keys (domain names).  This is similar
+to the way that <EM>strcmp()</EM> works.
+<P>
+<P>The problem is that it is wrong to say that <EM>co.us</EM> is greater-than,
+equal-to, or less-than <EM>boulder.co.us</EM>.
+<P>
+<P>For example, if you
+said that <EM>co.us</EM> is LESS than <EM>fff.co.us</EM>, then
+the Splay tree searching algorithm might never discover
+<EM>co.us</EM> as a match for <EM>kkk.co.us</EM>.
+<P>
+<P>similarly, if you said that <EM>co.us</EM> is GREATER than <EM>fff.co.us</EM>,
+then the Splay tree searching algorithm might never
+discover <EM>co.us</EM> as a match for <EM>bbb.co.us</EM>.
+<P>
+<P>The bottom line is that you can't have one entry that is a subdomain
+of another.  Squid-2.2 will warn you if it detects this condition.
+<P>
+<H2><A NAME="ss10.14">10.14 Why does Squid deny some port numbers?</A>
+</H2>
+
+<P>It is dangerous to allow Squid to connect to certain port numbers.
+For example, it has been demonstrated that someone can use Squid
+as an SMTP (email) relay.  As I'm sure you know, SMTP relays are
+one of the ways that spammers are able to flood our mailboxes.
+To prevent mail relaying, Squid denies requests when the URL port
+number is 25.  Other ports should be blocked as well, as a precaution.
+<P>
+<P>There are two ways to filter by port number: either allow specific
+ports, or deny specific ports.  By default, Squid does the first.  This
+is the ACL entry that comes in the default <EM>squid.conf</EM>:
+<PRE>
+        acl Safe_ports port 80 21 443 563 70 210 1025-65535
+        http_access deny !Safe_ports
+</PRE>
+
+The above configuration denies requests when the URL port number is
+not in the list.  The list allows connections to the standard
+ports for HTTP, FTP, Gopher, SSL, WAIS, and all non-priveleged
+ports.
+<P>
+<P>Another approach is to deny dangerous ports.  The dangerous
+port list should look something like:
+<PRE>
+        acl Dangerous_ports 7 9 19 22 23 25 53 109 110 119
+        http_access deny Dangerous_ports
+</PRE>
+
+...and probably many others.
+<P>
+<P>Please consult the <EM>/etc/services</EM> file on your system
+for a list of known ports and protocols.
+<P>
+<H2><A NAME="ss10.15">10.15 Does Squid support the use of a database such as mySQL for storing the ACL list?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.2.</EM>
+<P>No, it does not.
+<P>
+<H2><A NAME="ss10.16">10.16 How can I allow a single address to access a specific URL?</A>
+</H2>
+
+<P>This example allows only the <EM>special_client</EM> to access
+the <EM>special_url</EM>.  Any other client that tries to access
+the <EM>special_url</EM> is denied.
+<PRE>
+        acl special_client src 10.1.2.3
+        acl special_url url_regex ^http://www.squid-cache.org/Doc/FAQ/$
+        http_access allow special_client special_url
+        http_access deny special_url
+</PRE>
+<P>
+<H2><A NAME="ss10.17">10.17 How can I allow some clients to use the cache at specific times?</A>
+</H2>
+
+<P>Let's say you have two workstations that should only be allowed access
+to the Internet during working hours (8:30 - 17:30).  You can use
+something like this:
+<PRE>
+acl FOO src 10.1.2.3 10.1.2.4
+acl WORKING time MTWHF 08:30-17:30
+http_access allow FOO WORKING
+http_access deny FOO
+</PRE>
+<P>
+<H2><A NAME="ss10.18">10.18 How can I allow some users to use the cache at specific times?</A>
+</H2>
+
+<P>
+<PRE>
+acl USER1 proxy_auth Dick
+acl USER2 proxy_auth Jane
+acl DAY time 06:00-18:00
+http_access allow USER1 DAY
+http_access deny USER1
+http_access allow USER2 !DAY
+http_access deny USER2
+</PRE>
+<P>
+<H2><A NAME="ss10.19">10.19 Problems with IP ACL's that have complicated netmasks</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.3.</EM>
+<P>The following ACL entry gives inconsistent or unexpected results:
+<PRE>
+        acl restricted  src 10.0.0.128/255.0.0.128 10.85.0.0/16
+</PRE>
+
+The reason is that IP access lists are stored in ``splay'' tree
+data structures.  These trees require the keys to be sortable.
+When you use a complicated, or non-standard, netmask (255.0.0.128), it confuses
+the function that compares two address/mask pairs.
+<P>The best way to fix this problem is to use separate ACL names
+for each ACL value.  For example, change the above to:
+<PRE>
+        acl restricted1 src 10.0.0.128/255.0.0.128
+        acl restricted2 src 10.85.0.0/16
+</PRE>
+<P>Then, of course, you'll have to rewrite your <EM>http_access</EM>
+lines as well.
+<P>
+<H2><A NAME="ss10.20">10.20 Can I set up ACL's based on MAC address rather than IP?</A>
+</H2>
+
+<P>Yes, for some operating systes.  Squid calls these ``ARP ACLs'' and
+they are supported on Linux, Solaris, and probably BSD variants.
+<P>NOTE: Squid can only determine the MAC address for clients that
+are on the same subnet.  If the client is on a different subnet,
+then Squid can not find out its MAC address.
+<P>To use ARP (MAC) access controls, you
+first need to compile in the optional code.  Do this with
+the <EM>--enable-arp-acl</EM> configure option:
+<PRE>
+% ./configure --enable-arp-acl ...
+% make clean
+% make
+</PRE>
+
+If <EM>src/acl.c</EM> doesn't compile, then ARP ACLs are probably not
+supported on your system.
+<P>If everything compiles, then you can add some ARP ACL lines to
+your <EM>squid.conf</EM>:
+<PRE>
+acl M1 arp 01:02:03:04:05:06
+acl M2 arp 11:12:13:14:15:16
+http_access allow M1
+http_access allow M2
+http_access deny all
+</PRE>
+<P>
+<H2><A NAME="ss10.21">10.21 Debugging ACLs</A>
+</H2>
+
+<P>See 
+<A HREF="#acl-debug">1.9 I set up my access controls, but they don't work! why?</A> and 
+<A HREF="FAQ-11.html#debug">11.20 Debugging Squid</A>.
+<P>
+<H2><A NAME="ss10.22">10.22 Can I limit the number of connections from a client?</A>
+</H2>
+
+<P>Yes, use the <EM>maxconn</EM> ACL type in conjunction with <EM>http_access deny</EM>.
+For example:
+<PRE>
+acl losers src 1.2.3.0/24
+acl 5CONN maxconn 5
+http_access deny 5CONN losers
+</PRE>
+<P>Given the above configuration, when a client whose source IP address
+is in the 1.2.3.0/24 subnet tries to establish 6 or more connections
+at once, Squid returns an error page.  Unless you use the
+<EM>deny_info</EM> feature, the error message will just say ``access
+denied.''
+<P>The <EM>maxconn</EM> ACL requires the client_db feature.  If you've
+disabled client_db (for example with <EM>client_db off</EM>) then
+<EM>maxconn</EM> ALCs will not work.
+<P>Note, the <EM>maxconn</EM> ACL type is kind of tricky because it
+uses less-than comparison.  The ACL is a match when the number
+of established connections is <EM>greater</EM> than the value you
+specify.  Because of that, you don't want to use the <EM>maxconn</EM>
+ACL with <EM>http_access allow</EM>.
+<P>Also note that you could use <EM>maxconn</EM> in conjunction with
+a user type (ident, proxy_auth), rather than an IP address type.  
+<P>
+<H2><A NAME="ss10.23">10.23 I'm trying to deny <EM>foo.com</EM>, but it's not working.</A>
+</H2>
+
+<P>In Squid-2.3 we changed the way that Squid matches subdomains.
+There is a difference between <EM>.foo.com</EM> and <EM>foo.com</EM>.  The
+first matches any domain in <EM>foo.com</EM>, while the latter matches
+only ``foo.com'' exactly.  So if you want to deny <EM>bar.foo.com</EM>,
+you should write
+<PRE>
+acl yuck dstdomain .foo.com
+http_access deny yuck
+</PRE>
+<P>
+<H2><A NAME="ss10.24">10.24 I want to customize, or make my own error messages.</A>
+</H2>
+
+<P>You can customize the existing error messages as described in
+<A HREF="FAQ-19.html#custom-err-msgs">Customizable Error Messages</A>.
+You can also create new error messages and use these in conjunction
+with the <EM>deny_info</EM> option.
+<P>For example, lets say you want your users to see a special message
+when they request something that matches your pornography list.
+First, create a file named ERR_NO_PORNO in the
+<EM>/usr/local/squid/etc/errors</EM> directory.  That file might
+contain something like this:
+<PRE>
+&lt;p&gt;
+Our company policy is to deny requests to known porno sites.  If you
+feel you've received this message in error, please contact 
+the support staff (support@this.company.com, 555-1234).
+</PRE>
+<P>Next, set up your access controls as follows:
+<PRE>
+acl porn url_regex "/usr/local/squid/etc/porno.txt"
+deny_info ERR_NO_PORNO porn
+http_access deny porn
+(additional http_access lines ...)
+</PRE>
+<P>
+<H2><A NAME="ss10.25">10.25 I want to use local time zone in error messages</A>
+</H2>
+
+<P>Squid by defaults uses GMT as timestamp in all geenrated error messages.
+This to allow the cache to participate in a hierarchy of caches in different
+timezones without risking confusion about what the time is.
+<P>
+<P>To change the timestamp in Squid generated error messages you must change
+the Squid signature. See 
+<A HREF="FAQ-19.html#custom-err-msgs">Customizable Error Messages</A>. The signature by defaults uses %T as timestamp, but if you like
+then you can use %t instead for a timestamp using local time zone.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-11.html">Next</A>
+<A HREF="FAQ-9.html">Previous</A>
+<A HREF="FAQ.html#toc10">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-11.html
+++ squid-2.5.9/debian/doc/FAQ-11.html
@@ -0,0 +1,1622 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Troubleshooting</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-12.html">Next</A>
+<A HREF="FAQ-10.html">Previous</A>
+<A HREF="FAQ.html#toc11">Contents</A>
+<HR>
+<H2><A NAME="s11">11. Troubleshooting</A></H2>
+
+<H2><A NAME="ss11.1">11.1 Why am I getting ``Proxy Access Denied?''</A>
+</H2>
+
+<P>You may need to set up the <EM>http_access</EM> option to allow
+requests from your IP addresses.    Please see 
+<A HREF="FAQ-10.html#access-controls">the Access Controls section</A> for information about that.
+<P>If <EM>squid</EM> is in httpd-accelerator mode, it will accept normal
+HTTP requests and forward them to a HTTP server, but it will not
+honor proxy requests.  If you want your cache to also accept
+proxy-HTTP requests then you must enable this feature:
+<PRE>
+        httpd_accel_with_proxy on
+</PRE>
+
+Alternately, you may have misconfigured one of your ACLs.  Check the
+<EM>access.log</EM> and <EM>squid.conf</EM> files for clues.
+<P>
+<H2><A NAME="ss11.2">11.2 I can't get <CODE>local_domain</CODE> to work; <EM>Squid</EM> is caching the objects from my local servers.</A>
+</H2>
+
+<P>The <CODE>local_domain</CODE> directive does not prevent local
+objects from being cached.  It prevents the use of sibling caches
+when fetching local objects.  If you want to prevent objects from
+being cached, use the <CODE>cache_stoplist</CODE> or <CODE>http_stop</CODE>
+configuration options (depending on your version).
+<P>
+<H2><A NAME="ss11.3">11.3 I get <CODE>Connection Refused</CODE> when the cache tries to retrieve an object located on a sibling, even though the sibling thinks it delivered the object to my cache.</A>
+</H2>
+
+<P>
+<P>If the HTTP port number is wrong but the ICP port is correct you
+will send ICP queries correctly and the ICP replies will fool your
+cache into thinking the configuration is correct but large objects
+will fail since you don't have the correct HTTP port for the sibling
+in your <EM>squid.conf</EM> file.  If your sibling changed their
+<CODE>http_port</CODE>, you could have this problem for some time
+before noticing.
+<P>
+<H2><A NAME="filedescriptors"></A> <A NAME="ss11.4">11.4 Running out of filedescriptors</A>
+</H2>
+
+<P>
+<P>If you see the <CODE>Too many open files</CODE> error message, you
+are most likely running out of file descriptors.  This may be due
+to running Squid on an operating system with a low filedescriptor
+limit.  This limit is often configurable in the kernel or with
+other system tuning tools.  There are two ways to run out of file
+descriptors:  first, you can hit the per-process limit on file
+descriptors.  Second, you can hit the system limit on total file
+descriptors for all processes.
+<P>
+<H3>Linux</H3>
+
+<P>Dancer has a 
+<A HREF="http://www2.simegen.com/~dancer/minihowto.html">Mini-'Adding File-descriptors-to-linux for squid' HOWTO</A>, but
+this information seems specific to the Linux 2.0.36 kernel.
+<P>
+<P>Henrik has a 
+<A HREF="http://squid.sourceforge.net/hno/linux-lfd.html">How to get many filedescriptors on Linux 2.2.X</A> page.
+<P>
+<P>You also might want to
+have a look at
+<A HREF="http://www.linux.org.za/oskar/patches/kernel/filehandle/">filehandle patch</A>
+by
+<A HREF="mailto:michael@metal.iinet.net.au">Michael O'Reilly</A><P>
+<P>If your kernel version is 2.2.x or greater, you can read and write
+the maximum number of file handles and/or inodes
+simply by accessing the special files:
+<PRE>
+        /proc/sys/fs/file-max
+        /proc/sys/fs/inode-max
+</PRE>
+
+So, to increase your file descriptor limit:
+<PRE>
+        echo 3072 > /proc/sys/fs/file-max
+</PRE>
+<P>
+<P>If your kernel version is between 2.0.35 and 2.1.x (?), you can read and write
+the maximum number of file handles and/or inodes
+simply by accessing the special files:
+<PRE>
+        /proc/sys/kernel/file-max
+        /proc/sys/kernel/inode-max
+</PRE>
+<P>
+<P>While this does increase the current number of file descriptors,
+Squid's <EM>configure</EM> script probably won't figure out the
+new value unless you also update the include files, specifically
+the value of <EM>OPEN_MAX</EM> in
+<EM>/usr/include/linux/limits.h</EM>.
+<P>
+<H3>Solaris</H3>
+
+<P>Add the following to your <EM>/etc/system</EM> file to
+increase your maximum file descriptors per process:
+<P>
+<PRE>
+        set rlim_fd_max = 4096
+</PRE>
+<P>Next you should re-run the <EM>configure</EM> script
+in the top directory so that it finds the new value.
+If it does not find the new limit, then you might try
+editing  <EM>include/autoconf.h</EM> and setting
+<CODE>#define DEFAULT_FD_SETSIZE</CODE> by hand.  Note that
+<EM>include/autoconf.h</EM> is created from <EM>autoconf.h.in</EM>
+every time you run configure.  Thus, if you edit it by
+hand, you might lose your changes later on.
+<P>
+<P>If you have a very old version of Squid (1.1.X), and you
+want to use more than 1024 descriptors, then you must
+edit <EM>src/Makefile</EM> and enable
+<CODE>$(USE_POLL_OPT)</CODE>.  Then recompile <EM>squid</EM>.
+<P>
+<P>
+<A HREF="mailto:voeckler at rvs dot uni-hannover dot de">Jens-S. Voeckler</A>
+advises that you should NOT change the default soft limit (<EM>rlim_fd_cur</EM>) to anything
+larger than 256.  It will break other programs, such as the license
+manager needed for the SUN workshop compiler.  Jens-S. also says that it
+should be safe to raise the limit for the Squid process as high as 16,384
+except that there may be problems duruing reconfigure or logrotate if all of
+the lower 256 filedescriptors are in use at the time or rotate/reconfigure.
+<P>
+<H3>IRIX</H3>
+
+<P>For some hints, please see SGI's 
+<A HREF="http://www.sgi.com/tech/web/irix62.html">Tuning IRIX 6.2 for a Web Server</A> document.
+<P>
+<H3>FreeBSD</H3>
+
+<P>by 
+<A HREF="mailto:torsten.sturm@axis.de">Torsten Sturm</A>
+<OL>
+<LI>How do I check my maximum filedescriptors?
+<P>Do <CODE>sysctl -a</CODE> and look for the value of
+<CODE>kern.maxfilesperproc</CODE>.
+</LI>
+<LI>How do I increase them?
+<PRE>
+        sysctl -w kern.maxfiles=XXXX
+        sysctl -w kern.maxfilesperproc=XXXX
+</PRE>
+
+<B>Warning</B>: You probably want <CODE>maxfiles
+&gt; maxfilesperproc</CODE> if you're going to be pushing the
+limit.</LI>
+<LI>What is the upper limit?
+<P>I don't think there is a formal upper limit inside the kernel.
+All the data structures are dynamically allocated.  In practice
+there might be unintended metaphenomena (kernel spending too much
+time searching tables, for example).
+</LI>
+</OL>
+<P>
+<H3>General BSD</H3>
+
+<P>For most BSD-derived systems (SunOS, 4.4BSD, OpenBSD, FreeBSD,
+NetBSD, BSD/OS, 386BSD, Ultrix) you can also use the ``brute force''
+method to increase these values in the kernel (requires a kernel
+rebuild):
+<OL>
+<LI>How do I check my maximum filedescriptors?
+<P>Do <CODE>pstat -T</CODE> and look for the <CODE>files</CODE>
+value, typically expressed as the ratio of <CODE>current</CODE>maximum/.
+</LI>
+<LI>How do I increase them the easy way?
+<P>One way is to increase the value of the <CODE>maxusers</CODE> variable
+in the kernel configuration file and build a new kernel.  This method
+is quick and easy but also has the effect of increasing a wide variety of
+other variables that you may not need or want increased.
+</LI>
+<LI>Is there a more precise method?
+<P>Another way is to find the <EM>param.c</EM> file in your kernel
+build area and change the arithmetic behind the relationship between
+<CODE>maxusers</CODE> and the maximum number of open files.
+</LI>
+</OL>
+
+Here are a few examples which should lead you in the right direction:
+<OL>
+<LI>SunOS
+<P>Change the value of <CODE>nfile</CODE> in <CODE></CODE>usr/kvm/sys/conf.common/param.c/tt> by altering this equation:
+<PRE>
+        int     nfile = 16 * (NPROC + 16 + MAXUSERS) / 10 + 64;
+</PRE>
+
+Where <CODE>NPROC</CODE> is defined by:
+<PRE>
+        #define NPROC (10 + 16 * MAXUSERS)
+</PRE>
+</LI>
+<LI>FreeBSD (from the 2.1.6 kernel)
+<P>Very similar to SunOS, edit <EM>/usr/src/sys/conf/param.c</EM>
+and alter the relationship between <CODE>maxusers</CODE> and the
+<CODE>maxfiles</CODE> and <CODE>maxfilesperproc</CODE> variables:
+<PRE>
+        int     maxfiles = NPROC*2;
+        int     maxfilesperproc = NPROC*2;
+</PRE>
+
+Where <CODE>NPROC</CODE> is defined by:
+<CODE>#define NPROC (20 + 16 * MAXUSERS)</CODE>
+The per-process limit can also be adjusted directly in the kernel
+configuration file with the following directive:
+<CODE>options OPEN_MAX=128</CODE>
+</LI>
+<LI>BSD/OS (from the 2.1 kernel)
+<P>Edit <CODE>/usr/src/sys/conf/param.c</CODE> and adjust the
+<CODE>maxfiles</CODE> math here:
+<PRE>
+        int     maxfiles = 3 * (NPROC + MAXUSERS) + 80;
+</PRE>
+
+Where <CODE>NPROC</CODE> is defined by:
+<CODE>#define NPROC (20 + 16 * MAXUSERS)</CODE>
+You should also set the <CODE>OPEN_MAX</CODE> value in your kernel
+configuration file to change the per-process limit.
+</LI>
+</OL>
+<P>
+<H3>Reconfigure afterwards</H3>
+
+<P><B>NOTE:</B> After you rebuild/reconfigure your kernel with more
+filedescriptors, you must then recompile Squid.  Squid's configure
+script determines how many filedescriptors are available, so you
+must make sure the configure script runs again as well.  For example:
+<PRE>
+    cd squid-1.1.x
+        make realclean
+        ./configure --prefix=/usr/local/squid
+        make
+</PRE>
+<P>
+<H2><A NAME="ss11.5">11.5 What are these strange lines about removing objects?</A>
+</H2>
+
+<P>For example:
+<PRE>
+        97/01/23 22:31:10| Removed 1 of 9 objects from bucket 3913
+        97/01/23 22:33:10| Removed 1 of 5 objects from bucket 4315
+        97/01/23 22:35:40| Removed 1 of 14 objects from bucket 6391
+</PRE>
+<P>These log entries are normal, and do not indicate that <EM>squid</EM> has
+reached <CODE>cache_swap_high</CODE>.
+<P>
+<P>Consult your cache information page in <EM>cachemgr.cgi</EM> for
+a line like this:
+<P>
+<PRE>
+       Storage LRU Expiration Age:     364.01 days
+</PRE>
+<P>Objects which have not been used for that amount of time are removed as
+a part of the regular maintenance.  You can set an upper limit on the
+<CODE>LRU Expiration Age</CODE> value with <CODE>reference_age</CODE> in the config
+file.
+<P>
+<H2><A NAME="ss11.6">11.6 Can I change a Windows NT FTP server to list directories in Unix format?</A>
+</H2>
+
+<P>Why, yes you can!  Select the following menus:
+<UL>
+<LI>Start</LI>
+<LI>Programs</LI>
+<LI>Microsoft Internet Server (Common)</LI>
+<LI>Internet Service Manager</LI>
+</UL>
+<P>This will bring up a box with icons for your various services. One of
+them should be a little ftp ``folder.'' Double click on this.
+<P>You will then have to select the server (there should only be one)
+Select that and then choose ``Properties'' from the menu and choose the
+``directories'' tab along the top.
+<P>There will be an option at the bottom saying ``Directory listing style.''
+Choose the ``Unix'' type, not the ``MS-DOS'' type.
+<P>
+<BLOCKQUOTE>
+--Oskar Pearson &lt;oskar@is.co.za&gt;
+</BLOCKQUOTE>
+<P>
+<H2><A NAME="ss11.7">11.7 Why am I getting ``Ignoring MISS from non-peer x.x.x.x?''</A>
+</H2>
+
+<P>You are receiving ICP MISSes (via UDP) from a parent or sibling cache
+whose IP address your cache does not know about.  This may happen
+in two situations.
+<P>
+<P>
+<OL>
+<LI>If the peer is multihomed, it is sending packets out an interface
+which is not advertised in the DNS.  Unfortunately, this is a
+configuration problem at the peer site.  You can tell them to either
+add the IP address interface to their DNS, or use Squid's
+"udp_outgoing_address" option to force the replies
+out a specific interface.  For example:
+<P><EM>on your parent squid.conf:</EM>
+<PRE>
+        udp_outgoing_address proxy.parent.com
+</PRE>
+
+<EM>on your squid.conf:</EM>
+<PRE>
+        cache_host proxy.parent.com parent 3128 3130
+</PRE>
+<P>
+</LI>
+<LI>You can also see this warning when sending ICP queries to
+multicast addresses.  For security reasons, Squid requires
+your configuration to list all other caches listening on the
+multicast group address.  If an unknown cache listens to that address
+and sends replies, your cache will log the warning message.  To fix
+this situation, either tell the unknown cache to stop listening
+on the multicast address, or if they are legitimate, add them
+to your configuration file.</LI>
+</OL>
+<P>
+<H2><A NAME="ss11.8">11.8 DNS lookups for domain names with underscores (_) always fail.</A>
+</H2>
+
+<P>The standards for naming hosts
+(
+<A HREF="http://ds.internic.net/rfc/rfc952.txt">RFC 952</A>,
+<A HREF="http://ds.internic.net/rfc/rfc1101.txt">RFC 1101</A>)
+do not allow underscores in domain names:
+<BLOCKQUOTE>
+A "name" (Net, Host, Gateway, or Domain name) is a text string up
+to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus
+sign (-), and period (.).
+</BLOCKQUOTE>
+
+The resolver library that ships with recent versions of BIND enforces
+this restriction, returning an error for any host with underscore in
+the hostname.  The best solution is to complain to the hostmaster of the
+offending site, and ask them to rename their host.
+<P>
+<P>See also the
+<A HREF="http://www.intac.com/~cdp/cptd-faq/section4.html#underscore">comp.protocols.tcp-ip.domains FAQ</A>.
+<P>
+<P>Some people have noticed that
+<A HREF="http://ds.internic.net/rfc/rfc1033.txt">RFC 1033</A>
+implies that underscores <B>are</B> allowed.  However, this is an
+<EM>informational</EM> RFC with a poorly chosen
+example, and not a <EM>standard</EM> by any means.
+<P>
+<H2><A NAME="ss11.9">11.9 Why does Squid say: ``Illegal character in hostname; underscores are not allowed?'</A>
+</H2>
+
+<P>See the above question.  The underscore character is not
+valid for hostnames.
+<P>
+<P>Some DNS resolvers allow the underscore, so yes, the hostname
+might work fine when you don't use Squid.
+<P>
+<P>To make Squid allow underscores in hostnames, re-run the
+<EM>configure</EM> script with this option:
+<PRE>
+        % ./configure --enable-underscores ...
+</PRE>
+
+and then recompile:
+<PRE>
+        % make clean
+        % make
+</PRE>
+<P>
+<H2><A NAME="ss11.10">11.10 Why am I getting access denied from a sibling cache?</A>
+</H2>
+
+<P>The answer to this is somewhat complicated, so please hold on.
+<EM>NOTE:</EM> most of this text is taken from
+<A HREF="http://www.nlanr.net/%7ewessels/Papers/icp-squid.ps.gz">ICP and the Squid Web Cache</A>.
+<P>
+<P>An ICP query does not include any parent or sibling designation,
+so the receiver really has no indication of how the peer
+cache is configured to use it.  This issue becomes important
+when a cache is willing to serve cache hits to anyone, but only
+handle cache misses for its paying users or customers.  In other
+words, whether or not to allow the request depends on if the
+result is a hit or a miss.  To accomplish this,
+Squid acquired the <CODE>miss_access</CODE> feature
+in October of 1996.
+<P>
+<P>The necessity of ``miss access'' makes life a little bit complicated,
+and not only because it was awkward to implement.  Miss access
+means that the ICP query reply must be an extremely accurate prediction
+of the result of a subsequent HTTP request.  Ascertaining
+this result is actually very hard, if not impossible to
+do, since the ICP request cannot convey the
+full HTTP request.
+Additionally, there are more types of HTTP request results than there
+are for ICP.  The ICP query reply will either be a hit or miss.
+However, the HTTP request might result in a ``<CODE>304 Not Modified</CODE>'' reply
+sent from the origin server.  Such a reply is not strictly a hit since the peer
+needed to forward a conditional request to the source.  At the same time,
+its not strictly a miss either since the local object data is still valid,
+and the Not-Modified reply is quite small.
+<P>
+<P>One serious problem for cache hierarchies is mismatched freshness
+parameters.  Consider a cache <EM>C</EM> using ``strict''
+freshness parameters so its users get maximally current data.
+<EM>C</EM> has a sibling <EM>S</EM> with less strict freshness parameters.
+When an object is requested at <EM>C</EM>, <EM>C</EM> might
+find that <EM>S</EM> already has the object via an ICP query and
+ICP HIT response.  <EM>C</EM> then retrieves the object
+from <EM>S</EM>.
+<P>
+<P>In an HTTP/1.0 world, <EM>C</EM> (and <EM>C</EM>'s client)
+will receive an object that was never
+subject to its local freshness rules.  Neither HTTP/1.0 nor ICP provides
+any way to ask only for objects less than a certain age.  If the
+retrieved object is stale by <EM>C</EM>s rules,
+it will be removed from <EM>C</EM>s cache, but
+it will subsequently be fetched from <EM>S</EM> so long as it
+remains fresh there.  This configuration miscoupling
+problem is a significant deterrent to establishing
+both parent and sibling relationships.
+<P>
+<P>HTTP/1.1 provides numerous request headers to specify freshness
+requirements, which actually introduces
+a different problem for cache hierarchies:  ICP
+still does not include any age information, neither in query nor
+reply.  So <EM>S</EM> may return an ICP HIT if its
+copy of the object is fresh by its configuration
+parameters, but the subsequent HTTP request may result
+in a cache miss due to any
+<CODE>Cache-control:</CODE> headers originated by <EM>C</EM> or by
+<EM>C</EM>'s client.  Situations now emerge where the ICP reply
+no longer matches the HTTP request result.
+<P>
+<P>In the end, the fundamental problem is that the ICP query does not
+provide enough information to accurately predict whether
+the HTTP request
+will be a hit or miss.   In fact, the current ICP Internet Draft is very
+vague on this subject.  What does ICP HIT really mean?  Does it mean
+``I know a little about that URL and have some copy of the object?''  Or
+does it mean ``I have a valid copy of that object and you are allowed to
+get it from me?''
+<P>
+<P>So, what can be done about this problem?  We really need to change ICP
+so that freshness parameters are included.  Until that happens, the members
+of a cache hierarchy have only two options to totally eliminate the ``access
+denied'' messages from sibling caches:
+<OL>
+<LI>Make sure all members have the same <CODE>refresh_rules</CODE> parameters.</LI>
+<LI>Do not use <CODE>miss_access</CODE> at all.  Promise your sibling cache
+administrator that <EM>your</EM> cache is properly configured and that you
+will not abuse their generosity.  The sibling cache administrator can
+check his log files to make sure you are keeping your word.</LI>
+</OL>
+
+If neither of these is realistic, then the sibling relationship should not
+exist.
+<P>
+<H2><A NAME="ss11.11">11.11 Cannot bind socket FD NN to *:8080 (125) Address already in use</A>
+</H2>
+
+<P>This means that another processes is already listening on port 8080
+(or whatever you're using).  It could mean that you have a Squid process
+already running, or it could be from another program.  To verify, use
+the <EM>netstat</EM> command:
+<PRE>
+        netstat -naf inet | grep LISTEN
+</PRE>
+
+That will show all sockets in the LISTEN state.  You might also try
+<PRE>
+        netstat -naf inet | grep 8080
+</PRE>
+
+If you find that some process has bound to your port, but you're not sure
+which process it is, you might be able to use the excellent
+<A HREF="ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/">lsof</A>
+program.  It will show you which processes own every open file descriptor
+on your system.
+<P>
+<H2><A NAME="ss11.12">11.12 icpDetectClientClose: ERROR xxx.xxx.xxx.xxx: (32) Broken pipe</A>
+</H2>
+
+<P>This means that the client socket was closed by the client
+before Squid was finished sending data to it.  Squid detects this
+by trying to <CODE>read(2)</CODE> some data from the socket.  If the
+<CODE>read(2)</CODE> call fails, then Squid konws the socket has been
+closed.   Normally the <CODE>read(2)</CODE> call returns <EM>ECONNRESET: Connection reset by peer</EM>
+and these are NOT logged.  Any other error messages (such as
+<EM>EPIPE: Broken pipe</EM> are logged to <EM>cache.log</EM>.  See the ``intro'' of
+section 2 of your Unix manual for a list of all error codes.
+<P>
+<H2><A NAME="ss11.13">11.13 icpDetectClientClose: FD 135, 255 unexpected bytes</A>
+</H2>
+
+<P>These are caused by misbehaving Web clients attempting to use persistent
+connections.  Squid-1.1 does not support persistent connections.
+<P>
+<H2><A NAME="ss11.14">11.14 Does Squid work with NTLM Authentication?</A>
+</H2>
+
+<P>
+<A HREF="/Versions/v2/2.5/">Version 2.5</A> will
+support Microsoft NTLM authentication.  However, there are some
+limits on our support: We cannot proxy connections to a origin
+server that use NTLM authentication, but we can act as a web
+accelerator or proxy server and authenticate the client connection
+using NTLM.
+<P>
+<P>We support NT4, Samba, and Windows 2000 Domain Controllers. For
+more information get squid 2.5 and run <EM>./configure --help</EM>.
+<P>
+<P>Why we cannot proxy NTLM even though we can use it.
+Quoting from summary at the end of the browser authentication section in
+<A HREF="http://support.microsoft.com/support/kb/articles/Q198/1/16.ASP">this article</A>:
+<BLOCKQUOTE>
+In summary, Basic authentication does not require an implicit end-to-end
+state, and can therefore be used through a proxy server. Windows NT
+Challenge/Response authentication requires implicit end-to-end state and  
+will not work through a proxy server.
+</BLOCKQUOTE>
+<P>
+<P>Squid transparently passes the NTLM request and response headers between
+clients and servers. NTLM relies on a single end-end connection (possibly
+with men-in-the-middle, but a single connection every step of the way. This
+implies that for NTLM authentication to work at all with proxy caches, the
+proxy would need to tightly link the client-proxy and proxy-server links, as
+well as understand the state of the link at any one time. NTLM through a 
+CONNECT might work, but we as far as we know that  hasn't been implemented
+by anyone, and it would prevent the pages being cached - removing the value
+of the proxy.
+<P>
+<P>NTLM authentication is carried entirely inside the HTTP protocol, but is
+different from Basic authentication in many ways.
+<P>
+<OL>
+<LI>It is dependent on a stateful end-to-end connection which collides with
+RFC 2616 for proxy-servers to disjoin the client-proxy and proxy-server
+connections.
+</LI>
+<LI>It is only taking place once per connection, not per request. Once the
+connection is authenticated then all future requests on the same connection
+inherities the authentication. The connection must be reestablished to set
+up other authentication or re-identify the user.</LI>
+</OL>
+<P>
+<P>The reasons why it is not implemented in Netscape is probably:
+<P>
+<UL>
+<LI> It is very specific for the Windows platform
+</LI>
+<LI> It is not defined in any RFC or even internet draft.
+</LI>
+<LI> The protocol has several shortcomings, where the most apparent one is
+that it cannot be proxied.
+</LI>
+<LI> There exists an open internet standard which does mostly the same but
+without the shortcomings or platform dependencies: 
+<A HREF="ftp://ftp.isi.edu/in-notes/rfc2617.txt">digest authentication</A>.</LI>
+</UL>
+<P>
+<P>
+<H2><A NAME="ss11.15">11.15 The <EM>default</EM> parent option isn't working!</A>
+</H2>
+
+<P>This message was received at <EM>squid-bugs</EM>:
+<BLOCKQUOTE>
+<I>If you have only one parent, configured as:</I>
+<PRE>
+        cache_host xxxx parent 3128 3130 no-query default
+</PRE>
+
+<I>nothing is sent to the parent; neither UDP packets, nor TCP connections.</I>
+</BLOCKQUOTE>
+<P>
+<P>Simply adding <EM>default</EM> to a parent does not force all requests to be sent
+to that parent.  The term <EM>default</EM> is perhaps a poor choice of words.  A <EM>default</EM>
+parent is only used as a <B>last resort</B>.  If the cache is able to make direct connections,
+direct will be preferred over default.  If you want to force all requests to your parent
+cache(s), use the <EM>never_direct</EM> option:
+<PRE>
+        acl all src 0.0.0.0/0.0.0.0
+        never_direct allow all
+</PRE>
+<P>
+<H2><A NAME="ss11.16">11.16 ``Hot Mail'' complains about: Intrusion Logged. Access denied.</A>
+</H2>
+
+<P>``Hot Mail'' is proxy-unfriendly and requires all requests to come from
+the same IP address.  You can fix this by adding to your
+<EM>squid.conf</EM>:
+<PRE>
+        hierarchy_stoplist hotmail.com
+</PRE>
+<P>
+<H2><A NAME="ss11.17">11.17 My Squid becomes very slow after it has been running for some time.</A>
+</H2>
+
+<P>This is most likely because Squid is using more memory than it should be
+for your system.  When the Squid process becomes large, it experiences a lot
+of paging.  This will very rapidly degrade the performance of Squid.
+Memory usage is a complicated problem.  There are a number
+of things to consider.
+<P>
+<P>Then, examine the Cache Manager <EM>Info</EM> ouput and look at these two lines:
+<PRE>
+        Number of HTTP requests received:  121104
+        Page faults with physical i/o:      16720
+</PRE>
+
+Note, if your system does not have the <EM>getrusage()</EM> function, then you will
+not see the page faults line.
+<P>
+<P>Divide the number of page faults by the number of connections.  In this
+case 16720/121104 = 0.14.  Ideally this ratio should be in the 0.0 - 0.1
+range.  It may be acceptable to be in the 0.1 - 0.2 range.  Above that,
+however, and you will most likely find that Squid's performance is
+unacceptably slow.
+<P>
+<P>If the ratio is too high, you will need to make some changes to
+<A HREF="FAQ-8.html#lower-mem-usage">lower the amount of memory Squid uses</A>.
+<P>
+<P>See also 
+<A HREF="FAQ-8.html#how-much-ram">How much memory do I need in my Squid server?</A>.
+<P>
+<H2><A NAME="ss11.18">11.18 WARNING: Failed to start 'dnsserver'</A>
+</H2>
+
+<P>This could be a permission problem.  Does the Squid userid have
+permission to execute the <EM>dnsserver</EM> program?
+<P>
+<P>You might also try testing <EM>dnsserver</EM> from the command line:
+<PRE>
+        > echo oceana.nlanr.net | ./dnsserver
+</PRE>
+
+Should produce something like:
+<PRE>
+        $name oceana.nlanr.net
+        $h_name oceana.nlanr.net
+        $h_len 4
+        $ipcount 1
+        132.249.40.200
+        $aliascount 0
+        $ttl 82067
+        $end
+</PRE>
+<P>
+<H2><A NAME="ss11.19">11.19 Sending in Squid bug reports</A>
+</H2>
+
+<P>Bug reports for Squid should be registered in our
+<A HREF="http://www.squid-cache.org/bugs/">bug database</A>.  Any bug report must include
+<UL>
+<LI>The Squid version</LI>
+<LI>Your Operating System type and version</LI>
+<LI>A clear description of the bug symptoms</LI>
+</UL>
+<P>
+<H3><A NAME="coredumps"></A> crashes and core dumps</H3>
+
+<P>There are two conditions under which squid will exit abnormally and
+generate a coredump.  First, a SIGSEGV or SIGBUS signal will cause Squid
+to exit and dump core.  Second, many functions include consistency
+checks.  If one of those checks fail, Squid calls abort() to generate a
+core dump.
+<P>
+<P>Many people report that Squid doesn't leave a coredump anywhere.  This may be
+due to one of the following reasons:
+<UL>
+<LI>Resource Limits.  The shell has limits on the size of a coredump
+file.  You may need to increase the limit.</LI>
+<LI>sysctl options.  On FreeBSD, you won't get a coredump from
+programs that call setuid() and/or setgid() (like Squid sometimes does)
+unless you enable this option:
+<PRE>
+# sysctl -w kern.sugid_coredump=1
+</PRE>
+</LI>
+<LI>No debugging symbols.
+The Squid binary must have debugging symbols in order to get
+a meaningful coredump. </LI>
+<LI>Threads and Linux.  On Linux, threaded applications do not generate
+core dumps.  When you use the aufs cache_dir type, it uses threads and
+you can't get a coredump.</LI>
+<LI>It did leave a coredump file, you just can't find it.</LI>
+</UL>
+<P>
+<P>
+<P><B>Resource Limits</B>:
+These limits can usually be changed in
+shell scripts.  The command to change the resource limits is usually
+either <EM>limit</EM> or <EM>limits</EM>.  Sometimes it is a shell-builtin function,
+and sometimes it is a regular program.  Also note that you can set resource
+limits in the <EM>/etc/login.conf</EM> file on FreeBSD and maybe other BSD
+systems.
+<P>
+<P>To change the coredumpsize limit you might use a command like:
+<PRE>
+        limit coredumpsize unlimited
+</PRE>
+
+or
+<PRE>
+        limits coredump unlimited
+</PRE>
+<P>
+<P><B>Debugging Symbols</B>:
+To see if your Squid binary has debugging symbols, use this command:
+<PRE>
+        % nm /usr/local/squid/bin/squid | head
+</PRE>
+
+The binary has debugging symbols if you see gobbledegook like this:
+<PRE>
+        0812abec B AS_tree_head
+        080a7540 D AclMatchedName
+        080a73fc D ActionTable
+        080908a4 r B_BYTES_STR
+        080908bc r B_GBYTES_STR
+        080908ac r B_KBYTES_STR
+        080908b4 r B_MBYTES_STR
+        080a7550 D Biggest_FD
+        08097c0c R CacheDigestHashFuncCount
+        08098f00 r CcAttrs
+</PRE>
+
+There are no debugging symbols if you see this instead:
+<PRE>
+        /usr/local/squid/bin/squid: no symbols
+</PRE>
+
+Debugging symbols may have been
+removed by your <EM>install</EM> program.  If you look at the
+squid binary from the source directory, then it might have
+the debugging symbols.
+<P>
+<P>
+<P><B>Coredump Location</B>:
+The core dump file will be left in one of the following locations:
+<OL>
+<LI>The <EM>coredump_dir</EM> directory, if you set that option.</LI>
+<LI>The first <EM>cache_dir</EM> directory if you have used the
+<EM>cache_effective_user</EM> option.</LI>
+<LI>The current directory when Squid was started</LI>
+</OL>
+
+Recent versions of Squid report their current directory after
+starting, so look there first:
+<PRE>
+        2000/03/14 00:12:36| Set Current Directory to /usr/local/squid/cache
+</PRE>
+
+If you cannot find a core file, then either Squid does not have
+permission to write in its current directory, or perhaps your shell
+limits are preventing the core file from being written.
+<P>
+<P>Often you can get a coredump if you run Squid from the 
+command line like this (csh shells and clones):
+<PRE>
+        % limit core un
+        % /usr/local/squid/bin/squid -NCd1
+</PRE>
+<P>
+<P>
+<P>Once you have located the core dump file, use a debugger such as
+<EM>dbx</EM> or <EM>gdb</EM> to generate a stack trace:
+<PRE>
+
+tirana-wessels squid/src 270% gdb squid /T2/Cache/core
+GDB is free software and you are welcome to distribute copies of it
+ under certain conditions; type "show copying" to see the conditions.
+There is absolutely no warranty for GDB; type "show warranty" for details.
+GDB 4.15.1 (hppa1.0-hp-hpux10.10), Copyright 1995 Free Software Foundation, Inc...
+Core was generated by `squid'.
+Program terminated with signal 6, Aborted.
+
+[...]
+
+(gdb) where
+#0  0xc01277a8 in _kill ()
+#1  0xc00b2944 in _raise ()
+#2  0xc007bb08 in abort ()
+#3  0x53f5c in __eprintf (string=0x7b037048 "", expression=0x5f &lt;Address 0x5f out of bounds>, line=8, filename=0x6b &lt;Address 0x6b out of bounds>)
+#4  0x29828 in fd_open (fd=10918, type=3221514150, desc=0x95e4 "HTTP Request") at fd.c:71
+#5  0x24f40 in comm_accept (fd=2063838200, peer=0x7b0390b0, me=0x6b) at comm.c:574
+#6  0x23874 in httpAccept (sock=33, notused=0xc00467a6) at client_side.c:1691
+#7  0x25510 in comm_select_incoming () at comm.c:784
+#8  0x25954 in comm_select (sec=29) at comm.c:1052
+#9  0x3b04c in main (argc=1073745368, argv=0x40000dd8) at main.c:671
+</PRE>
+<P>
+<P>If possible, you might keep the coredump file around for a day or
+two.  It is often helpful if we can ask you to send additional
+debugger output, such as the contents of some variables. But please
+note that a core file is only useful if paired with the exact same binary
+as generated the corefile. If you recompile Squid then any coredumps from
+previous versions will be useless unless you have saved the corresponding
+Squid binaries, and any attempts to analyze such coredumps will most certainly
+give misleading information about the cause to the crash.
+<P>
+<P>If you CANNOT get Squid to leave a core file for you then one of
+the following approaches can be used
+<A NAME="nocore"></A> <P>
+<P>First alternative is to start Squid under the contol of GDB
+<P>
+<PRE>
+        % gdb /path/to/squid
+        handle SIGPIPE pass nostop noprint
+        run -DNYCd3
+        [wait for crash]
+        backtrace
+        quit
+</PRE>
+<P>
+<P>The drawback from the above is that it isn't really suitable to run on a
+production system as Squid then won't restart automatically if it
+crashes. The good news is that it is fully possible to automate the
+process above to automatically get the stack trace and then restart
+Squid. Here is a short automated script that should work:
+<P>
+<PRE>
+        #!/bin/sh
+        trap "rm -f $$.gdb" 0
+        cat &lt;&lt;EOF >$$.gdb 
+        handle SIGPIPE pass nostop noprint
+        run -DNYCd3
+        backtrace
+        quit
+        EOF
+        while sleep 2; do
+           gdb -x $$.gdb /path/to/squid 2>&amp;1 | tee -a squid.out
+        done
+</PRE>
+<P>
+<P>Other options if the above cannot be done is to:
+<P>
+<P>a) Build Squid with the --enable-stacktraces option, if support exists for your OS (exists for Linux glibc on Intel, and Solaris with some extra libraries which seems rather impossible to find these days..)
+<P>
+<P>b) Run Squid using the "catchsegv" tool. (Linux glibc Intel)
+<P>
+<P>but these approaches does not by far provide as much details as using
+gdb.
+<P>
+<H2><A NAME="debug"></A> <A NAME="ss11.20">11.20 Debugging Squid</A>
+</H2>
+
+<P>If you believe you have found a non-fatal bug (such as incorrect HTTP
+processing) please send us a section of your cache.log with debugging to
+demonstrate the problem.  The cache.log file can become very large, so
+alternatively, you may want to copy it to an FTP or HTTP server where we
+can download it.
+<P>
+<P>It is very simple to
+enable full debugging on a running squid process.  Simply use the <EM>-k debug</EM>
+command line option:
+<PRE>
+        % ./squid -k debug
+</PRE>
+
+This causes every <EM>debug()</EM> statement in the source code to write a line
+in the <EM>cache.log</EM> file.
+You also use the same command to restore Squid to normal debugging level.
+<P>
+<P>To enable selective debugging (e.g. for one source file only), you
+need to edit <EM>squid.conf</EM> and add to the <EM>debug_options</EM> line.
+Every Squid source file is assigned a different debugging <EM>section</EM>.
+The debugging section assignments can be found by looking at the top
+of individual source files, or by reading the file <EM>doc/debug-levels.txt</EM>
+(correctly renamed to <EM>debug-sections.txt</EM> for Squid-2).
+You also specify the debugging <EM>level</EM> to control the amount of
+debugging.  Higher levels result in more debugging messages.
+For example, to enable full debugging of Access Control functions,
+you would use
+<PRE>
+        debug_options ALL,1 28,9
+</PRE>
+
+Then you have to restart or reconfigure Squid.
+<P>
+<P>Once you have the debugging captured to <EM>cache.log</EM>, take a look
+at it yourself and see if you can make sense of the behaviour which
+you see.  If not, please feel free to send your debugging output
+to the <EM>squid-users</EM> or <EM>squid-bugs</EM> lists.
+<P>
+<H2><A NAME="ss11.21">11.21 FATAL: ipcache_init: DNS name lookup tests failed</A>
+</H2>
+
+<P>Squid normally tests your system's DNS configuration before
+it starts server requests.  Squid tries to resolve some
+common DNS names, as defined in the <EM>dns_testnames</EM> configuration
+directive.  If Squid cannot resolve these names, it could mean:
+<OL>
+<LI>your DNS nameserver is unreachable or not running.</LI>
+<LI>your <EM>/etc/resolv.conf</EM> file may contain incorrect information.</LI>
+<LI>your <EM>/etc/resolv.conf</EM> file may have incorrect permissions, and
+may be unreadable by Squid.</LI>
+</OL>
+<P>
+<P>To disable this feature, use the <EM>-D</EM> command line option.
+<P>
+<P>Note, Squid does NOT use the <EM>dnsservers</EM> to test the DNS.  The
+test is performed internally, before the <EM>dnsservers</EM> start.
+<P>
+<H2><A NAME="ss11.22">11.22 FATAL: Failed to make swap directory /var/spool/cache: (13) Permission denied</A>
+</H2>
+
+<P>Starting with version 1.1.15, we have required that you first run
+<PRE>
+        squid -z
+</PRE>
+
+to create the swap directories on your filesystem.  If you have set the
+<EM>cache_effective_user</EM> option, then the Squid process takes on the
+given userid before making the directories.  If the <EM>cache_dir</EM>
+directory (e.g. /var/spool/cache) does not exist, and the Squid userid
+does not have permission to create it, then you will get the ``permission
+denied'' error.  This can be simply fixed by manually creating the
+cache directory.
+<PRE>
+        # mkdir /var/spool/cache
+        # chown &lt;userid> &lt;groupid> /var/spool/cache
+        # squid -z
+</PRE>
+<P>
+<P>Alternatively, if the directory already exists, then your operating
+system may be returning ``Permission Denied'' instead of ``File Exists''
+on the mkdir() system call.  This
+<A HREF="store.c-mkdir.patch">patch</A>
+by
+<A HREF="mailto:miquels@cistron.nl">Miquel van Smoorenburg</A>
+should fix it.
+<P>
+<H2><A NAME="ss11.23">11.23 FATAL: Cannot open HTTP Port</A>
+</H2>
+
+<P>Either (1) the Squid userid does not have permission to bind to the port, or
+(2) some other process has bound itself to the port.
+Remember that root privileges are required to open port numbers
+less than 1024.  If you see this message when using a high port number,
+or even when starting Squid as root, then the port has already been
+opened by another process.
+Maybe you are running in the HTTP Accelerator mode and there is
+already a HTTP server running on port 80?  If you're really stuck,
+install the way cool
+<A HREF="ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/">lsof</A>
+utility to show you which process has your port in use.
+<P>
+<H2><A NAME="ss11.24">11.24 FATAL: All redirectors have exited!</A>
+</H2>
+
+<P>This is explained in the 
+<A HREF="FAQ-15.html#redirectors-exit">Redirector section</A>.
+<P>
+<H2><A NAME="ss11.25">11.25 FATAL: file_map_allocate: Exceeded filemap limit</A>
+</H2>
+
+<P>See the next question.
+<P>
+<H2><A NAME="ss11.26">11.26 FATAL: You've run out of swap file numbers.</A>
+</H2>
+
+<P><EM>Note: The information here applies to version 2.2 and earlier.</EM>
+<P>Squid keeps an in-memory bitmap of disk files that are
+available for use, or are being used.  The size of this
+bitmap is determined at run name, based on two things:
+the size of your cache, and the average (mean) cache object size.
+<P>The size of your cache is specified in squid.conf, on the
+<EM>cache_dir</EM> lines.  The mean object size can also
+be specified in squid.conf, with the 'store_avg_object_size'
+directive.  By default, Squid uses 13 Kbytes as the average size.
+<P>
+<P>When allocating the bitmaps, Squid allocates this many bits:
+<PRE>
+        2 * cache_size / store_avg_object_size
+</PRE>
+<P>So, if you exactly specify the correct average object size,
+Squid should have 50% filemap bits free when the cache is full.
+You can see how many filemap bits are being used by looking
+at the 'storedir' cache manager page.  It looks like this:
+<P>
+<PRE>
+        Store Directory #0: /usr/local/squid/cache
+        First level subdirectories: 4
+        Second level subdirectories: 4
+        Maximum Size: 1024000 KB
+        Current Size: 924837 KB
+        Percent Used: 90.32%
+        Filemap bits in use: 77308 of 157538 (49%)
+        Flags:
+</PRE>
+<P>
+<P>Now, if you see the ``You've run out of swap file numbers'' message,
+then it means one of two things:
+<OL>
+<LI>You've found a Squid bug.</LI>
+<LI>Your cache's average file size is much smaller
+than the 'store_avg_object_size' value.</LI>
+</OL>
+<P>To check the average file size of object currently in your
+cache, look at the cache manager 'info' page, and you will
+find a line like:
+<PRE>
+        Mean Object Size:       11.96 KB
+</PRE>
+<P>
+<P>To make the warning message go away, set 'store_avg_object_size'
+to that value (or lower) and then restart Squid.
+<P>
+<H2><A NAME="ss11.27">11.27 I am using up over 95% of the filemap bits?!!</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.3</EM>
+<P>Calm down, this is now normal.  Squid now dynamically allocates
+filemap bits based on the number of objects in your cache.
+You won't run out of them, we promise.
+<P>
+<P>
+<H2><A NAME="ss11.28">11.28 FATAL: Cannot open /usr/local/squid/logs/access.log: (13) Permission denied</A>
+</H2>
+
+<P>In Unix, things like <EM>processes</EM> and <EM>files</EM> have an <EM>owner</EM>.  
+For Squid, the process owner and file owner should be the same.  If they
+are not the same, you may get messages like ``permission denied.''
+<P>To find out who owns a file, use the <EM>ls -l</EM> command:
+<PRE>
+        % ls -l /usr/local/squid/logs/access.log
+</PRE>
+<P>
+<P>A process is normally owned by the user who starts it.  However,
+Unix sometimes allows a process to change its owner.  If you
+specified a value for the <EM>effective_user</EM>
+option in <EM>squid.conf</EM>, then that will be the process owner.
+The files must be owned by this same userid.
+<P>
+<P>If all this is confusing, then you probably should not be
+running Squid until you learn some more about Unix.
+As a reference, I suggest 
+<A HREF="http://www.oreilly.com/catalog/lunix4/">Learning the UNIX Operating System, 4th Edition</A>.
+<P>
+<H2><A NAME="ss11.29">11.29 When using a username and password, I can not access some files.</A>
+</H2>
+
+<P><I>If I try by way of a test, to access</I>
+<PRE>
+        ftp://username:password@ftpserver/somewhere/foo.tar.gz
+</PRE>
+
+<I>I get</I>
+<PRE>
+        somewhere/foo.tar.gz: Not a directory.
+</PRE>
+<P>
+<P>Use this URL instead:
+<PRE>
+        ftp://username:password@ftpserver/%2fsomewhere/foo.tar.gz
+</PRE>
+<P>
+<H2><A NAME="ss11.30">11.30 pingerOpen: icmp_sock: (13) Permission denied</A>
+</H2>
+
+<P>This means your <EM>pinger</EM> program does not have root priveleges.
+You should either do this:
+<PRE>
+        % su
+        # make install-pinger
+</PRE>
+
+or
+<PRE>
+        # chown root /usr/local/squid/bin/pinger
+        # chmod 4755 /usr/local/squid/bin/pinger
+</PRE>
+<P>
+<H2><A NAME="ss11.31">11.31 What is a forwarding loop?</A>
+</H2>
+
+<P>A forwarding loop is when a request passes through one proxy more than
+once.  You can get a forwarding loop if
+<UL>
+<LI>a cache forwards requests to itself.  This might happen with
+interception caching (or server acceleration) configurations.</LI>
+<LI>a pair or group of caches forward requests to each other.  This can
+happen when Squid uses ICP, Cache Digests, or the ICMP RTT database
+to select a next-hop cache.</LI>
+</UL>
+<P>
+<P>Forwarding loops are detected by examining the <EM>Via</EM> request header.
+Each cache which "touches" a request must add its hostname to the
+<EM>Via</EM> header.  If a cache notices its own hostname in this header
+for an incoming request, it knows there is a forwarding loop somewhere.
+<P>NOTE:
+Squid may report a forwarding loop if a request goes through
+two caches that have the same <EM>visible_hostname</EM> value.
+If you want to have multiple machines with the same
+<EM>visible_hostname</EM> then you must give each machine a different
+<EM>unique_hostname</EM> so that forwarding loops are correctly detected.
+<P>
+<P>When Squid detects a forwarding loop, it is logged to the <EM>cache.log</EM>
+file with the recieved <EM>Via</EM> header.  From this header you can determine
+which cache (the last in the list) forwarded the request to you.
+<P>
+<P>One way to reduce forwarding loops is to change a <EM>parent</EM>
+relationship to a <EM>sibling</EM> relationship.
+<P>
+<P>Another way is to use <EM>cache_peer_access</EM> rules.  For example:
+<PRE>
+        # Our parent caches
+        cache_peer A.example.com parent 3128 3130
+        cache_peer B.example.com parent 3128 3130
+        cache_peer C.example.com parent 3128 3130
+
+        # An ACL list
+        acl PEERS src A.example.com
+        acl PEERS src B.example.com
+        acl PEERS src C.example.com
+
+        # Prevent forwarding loops
+        cache_peer_access A.example.com allow !PEERS
+        cache_peer_access B.example.com allow !PEERS
+        cache_peer_access C.example.com allow !PEERS
+</PRE>
+
+The above configuration instructs squid to NOT forward a request
+to parents A, B, or C when a request is received from any one
+of those caches.
+<P>
+<H2><A NAME="ss11.32">11.32 accept failure: (71) Protocol error</A>
+</H2>
+
+<P>This error message is seen mostly on Solaris systems.
+<A HREF="mailto:mtk@ny.ubs.com">Mark Kennedy</A>
+gives a great explanation:
+<BLOCKQUOTE>
+Error 71 [EPROTO] is an obscure way of reporting that clients made it onto your
+server's TCP incoming connection queue but the client tore down the
+connection before the server could accept it.  I.e.  your server ignored
+its clients for too long.  We've seen this happen when we ran out of
+file descriptors.  I guess it could also happen if something made squid
+block for a long time.
+</BLOCKQUOTE>
+<P>
+<H2><A NAME="ss11.33">11.33 storeSwapInFileOpened: ... Size mismatch</A>
+</H2>
+
+<P><I>Got these messages in my cache log - I guess it means that the index
+contents do not match the contents on disk.</I>
+<PRE>
+1998/09/23 09:31:30| storeSwapInFileOpened: /var/cache/00/00/00000015: Size mismatch: 776(fstat) != 3785(object)
+1998/09/23 09:31:31| storeSwapInFileOpened: /var/cache/00/00/00000017: Size mismatch: 2571(fstat) != 4159(object)
+</PRE>
+<P>
+<P><I>What does Squid do in this case?</I>
+<P>
+<P>NOTE, these messages are specific to Squid-2.  These happen when Squid
+reads an object from disk for a cache hit.  After it opens the file,
+Squid checks to see if the size is what it expects it should be.  If the
+size doesn't match, the error is printed.  In this case, Squid does not
+send the wrong object to the client.  It will re-fetch the object from
+the source.
+<P>
+<H2><A NAME="ss11.34">11.34 Why do I get <EM>fwdDispatch: Cannot retrieve 'https://www.buy.com/corp/ordertracking.asp'</EM></A>
+</H2>
+
+<P>These messages are caused by buggy clients, mostly Netscape Navigator.
+What happens is, Netscape sends an HTTPS/SSL request over a persistent HTTP connection.
+Normally, when Squid gets an SSL request, it looks like this:
+<PRE>
+        CONNECT www.buy.com:443 HTTP/1.0
+</PRE>
+
+Then Squid opens a TCP connection to the destination host and port, and
+the <EM>real</EM> request is sent encrypted over this connection.  Thats the
+whole point of SSL, that all of the information must be sent encrypted.
+<P>
+<P>With this client bug, however, Squid receives a request like this:
+<PRE>
+        GET https://www.buy.com/corp/ordertracking.asp HTTP/1.0
+        Accept: */*
+        User-agent: Netscape ...
+        ...
+</PRE>
+
+Now, all of the headers, and the message body have been sent, <EM>unencrypted</EM>
+to Squid.  There is no way for Squid to somehow turn this into an SSL request.
+The only thing we can do is return the error message.
+<P>
+<P>Note, this browser bug does represent a security risk because the browser
+is sending sensitive information unencrypted over the network.
+<P>
+<H2><A NAME="ss11.35">11.35 Squid can't access URLs like http://3626046468/ab2/cybercards/moreinfo.html</A>
+</H2>
+
+<P>by Dave J Woolley (DJW at bts dot co dot uk)
+<P>These are illegal URLs, generally only used by illegal sites;
+typically the web site that supports a spammer and is expected to
+survive a few hours longer than the spamming account.
+<P>Their intention is to:
+<UL>
+<LI>confuse content filtering rules on proxies, and possibly
+some browsers' idea of whether they are trusted sites on
+the local intranet;</LI>
+<LI>confuse whois (?);</LI>
+<LI>make people think they are not IP addresses and unknown
+domain names, in an attempt to stop them trying to locate
+and complain to the ISP.</LI>
+</UL>
+<P>Any browser or proxy that works with them should be considered a
+security risk.
+<P>
+<A HREF="http://www.ietf.org/rfc/rfc1738.txt">RFC 1738</A>
+has this to say about the hostname part of a URL:
+<BLOCKQUOTE>
+The fully qualified domain name of a network host, or its IP
+address as a set of four decimal digit groups separated by
+".". Fully qualified domain names take the form as described
+in Section 3.5 of RFC 1034 [13] and Section 2.1 of RFC 1123
+[5]: a sequence of domain labels separated by ".", each domain
+label starting and ending with an alphanumerical character and
+possibly also containing "-" characters. The rightmost domain
+label will never start with a digit, though, which
+syntactically distinguishes all domain names from the IP
+addresses.
+</BLOCKQUOTE>
+<P>
+<H2><A NAME="ss11.36">11.36 I get a lot of ``URI has whitespace'' error messages in my cache log, what should I do?</A>
+</H2>
+
+<P>Whitespace characters (space, tab, newline, carriage return) are
+not allowed in URI's and URL's.  Unfortunately, a number of Web services
+generate URL's with whitespace.  Of course your favorite browser silently
+accomodates these bad URL's.  The servers (or people) that generate
+these URL's are in violation of Internet standards.  The whitespace
+characters should be encoded.  
+<P>
+<P>If you want Squid to accept URL's with whitespace, you have to
+decide how to handle them.  There are four choices that you
+can set with the <EM>uri_whitespace</EM> option:
+<OL>
+<LI>DENY:
+The request is denied with an ``Invalid Request'' message.
+This is the default.</LI>
+<LI>ALLOW:
+The request is allowed and the URL remains unchanged.</LI>
+<LI>ENCODE:
+The whitespace characters are encoded according to
+<A HREF="http://www.ietf.org/rfc/rfc1738.txt">RFC 1738</A>.  This can be considered a violation
+of the HTTP specification.</LI>
+<LI>CHOP:
+The URL is chopped at the first whitespace character
+and then processed normally.  This also can be considered
+a violation of HTTP.</LI>
+</OL>
+<P>
+<H2><A NAME="comm-bind-loopback-fail"></A> <A NAME="ss11.37">11.37 commBind: Cannot bind socket FD 5 to 127.0.0.1:0: (49) Can't assign requested address</A>
+</H2>
+
+<P>This likely means that your system does not have a loopback network device, or
+that device is not properly configured.
+All Unix systems should have a network device named <EM>lo0</EM>, and it should
+be configured with the address 127.0.0.1.  If not, you may get the above
+error message.
+To check your system, run:
+<PRE>
+        % ifconfig lo0
+</PRE>
+
+The result should look something like:
+<PRE>
+        lo0: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
+                inet 127.0.0.1 netmask 0xff000000 
+</PRE>
+<P>
+<P>If you use FreeBSD, see 
+<A HREF="FAQ-14.html#freebsd-no-lo0">this</A>.
+<P>
+<H2><A NAME="ss11.38">11.38 Unknown cache_dir type '/var/squid/cache'</A>
+</H2>
+
+<P>The format of the <EM>cache_dir</EM> option changed with version
+2.3.  It now takes a <EM>type</EM> argument.  All you need to do
+is insert <CODE>ufs</CODE> in the line, like this:
+<PRE>
+        cache_dir ufs /var/squid/cache ...
+</PRE>
+<P>
+<H2><A NAME="ss11.39">11.39 unrecognized: 'cache_dns_program /usr/local/squid/bin/dnsserver'</A>
+</H2>
+
+<P>As of Squid 2.3, the default is to use internal DNS lookup code.
+The <EM>cache_dns_program</EM> and <EM>dns_children</EM> options are not
+known squid.conf directives in this case.  Simply comment out
+these two options.
+<P>If you want to use external DNS lookups, with the <EM>dnsserver</EM>
+program, then add this to your configure command:
+<PRE>
+        --disable-internal-dns
+</PRE>
+<P>
+<H2><A NAME="ss11.40">11.40 Is <EM>dns_defnames</EM> broken in 2.3.STABLE1 and STABLE2?</A>
+</H2>
+
+<P>Sort of.   As of Squid 2.3, the default is to use internal DNS lookup code.
+The <EM>dns_defnames</EM> option is only used with the external <EM>dnsserver</EM>
+processes.  If you relied on <EM>dns_defnames</EM> before, you have three choices:
+<OL>
+<LI>See if the <EM>append_domain</EM> option will work for you instead.</LI>
+<LI>Configure squid with --disable-internal-dns to use the external
+dnsservers.</LI>
+<LI>Enhance <EM>src/dns_internal.c</EM> to understand the <CODE>search</CODE>
+and <CODE>domain</CODE> lines from <EM>/etc/resolv.conf</EM>.</LI>
+</OL>
+<P>
+<H2><A NAME="ss11.41">11.41 What does <EM>sslReadClient: FD 14: read failure: (104) Connection reset by peer</EM> mean?</A>
+</H2>
+
+<P>``Connection reset by peer'' is an error code that Unix operating systems
+sometimes return for <EM>read</EM>, <EM>write</EM>, <EM>connect</EM>, and other 
+system calls.
+<P>Connection reset means that the other host, the peer, sent us a RESET
+packet on a TCP connection.  A host sends a RESET when it receives
+an unexpected packet for a nonexistent connection.  For example, if 
+one side sends data at the same time that the other side closes
+a connection, when the other side receives the data it may send
+a reset back.
+<P>The fact that these messages appear in Squid's log might indicate
+a problem, such as a broken origin server or parent cache.  On
+the other hand, they might be ``normal,'' especially since
+some applications are known to force connection resets rather
+than a proper close.
+<P>You probably don't need to worry about them, unless you receive
+a lot of user complaints relating to SSL sites.
+<P>
+<A HREF="mailto:raj at cup dot hp dot com">Rick Jones</A> notes that
+if the server is running a Microsoft TCP stack, clients
+receive RST segments whenever the listen queue overflows.  In other words,
+if the server is really busy, new connections receive the reset message.
+This is contrary to rational behaviour, but is unlikely to change.
+<P>
+<P>
+<H2><A NAME="ss11.42">11.42 What does <EM>Connection refused</EM> mean?</A>
+</H2>
+
+<P>This is an error message, generated by your operating system,
+in response to a <EM>connect()</EM> system call.  It happens when 
+there is no server at the other end listening on the port number
+that we tried to connect to.
+<P>Its quite easy to generate this error on your own.  Simply
+telnet to a random, high numbered port:
+<PRE>
+% telnet localhost 12345
+Trying 127.0.0.1...
+telnet: Unable to connect to remote host: Connection refused
+</PRE>
+
+It happens because there is no server listening for connections
+on port 12345.
+<P>When you see this in response to a URL request, it probably means
+the origin server web site is temporarily down.  It may also mean
+that your parent cache is down, if you have one.
+<P>
+<H2><A NAME="ss11.43">11.43 squid: ERROR: no running copy</A>
+</H2>
+
+<P>You may get this message when you run commands like <CODE>squid -krotate</CODE>.
+<P>This error message usually means that the <EM>squid.pid</EM> file is
+missing.  Since the PID file is normally present when squid is running,
+the absence of the PID file usually means Squid is not running.
+If you accidentally delete the PID file, Squid will continue running, and
+you won't be able to send it any signals.
+<P>If you accidentally removed the PID file, there are two ways to get it back.
+<OL>
+<LI>run <CODE>ps</CODE> and find the Squid process id.  You'll probably see
+two processes, like this:
+<PRE>
+bender-wessels % ps ax | grep squid
+83617  ??  Ss     0:00.00 squid -s
+83619  ??  S      0:00.48 (squid) -s (squid)
+</PRE>
+
+You want the second process id, 83619 in this case.   Create the PID file and put the
+process id number there.  For example:
+<PRE>
+echo 83619 > /usr/local/squid/logs/squid.pid
+</PRE>
+</LI>
+<LI>Use the above technique to find the Squid process id.  Send the process a HUP
+signal, which is the same as <CODE>squid -kreconfigure</CODE>:
+<PRE>
+kill -HUP 83619
+</PRE>
+
+The reconfigure process creates a new PID file automatically.</LI>
+</OL>
+<P>
+<H2><A NAME="ss11.44">11.44 FATAL: getgrnam failed to find groupid for effective group 'nogroup'</A>
+</H2>
+
+<P>You are probably starting Squid as root.  Squid is trying to find
+a group-id that doesn't have any special priveleges that it will
+run as.  The default is <EM>nogroup</EM>, but this may not be defined
+on your system.  You need to edit <EM>squid.conf</EM> and set 
+<EM>cache_effective_group</EM> to the name of an unpriveledged group
+from <EM>/etc/group</EM>.  There is a good chance that <EM>nobody</EM>
+will work for you.
+<P>
+<H2><A NAME="ss11.45">11.45 ``Unsupported Request Method and Protocol'' for <EM>https</EM> URLs.</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.3.</EM>
+<P>This is correct.  Squid does not know what to do with an <EM>https</EM>
+URL.  To handle such a URL, Squid would need to speak the SSL 
+protocol.  Unfortunately, it does not (yet).
+<P>Normally, when you type an <EM>https</EM> URL into your browser, one of
+two things happens.
+<OL>
+<LI>The browser opens an SSL connection directly to the origin
+server.</LI>
+<LI>The browser tunnels the request through Squid with the
+<EM>CONNECT</EM> request method.</LI>
+</OL>
+<P>The <EM>CONNECT</EM> method is a way to tunnel any kind of
+connection through an HTTP proxy.  The proxy doesn't 
+understand or interpret the contents.  It just passes 
+bytes back and forth between the client and server.
+For the gory details on tunnelling and the CONNECT
+method, please see
+<A HREF="ftp://ftp.isi.edu/in-notes/rfc2817.txt">RFC 2817</A>
+and 
+<A HREF="http://www.web-cache.com/Writings/Internet-Drafts/draft-luotonen-web-proxy-tunneling-01.txt">Tunneling TCP based protocols through Web proxy servers</A> (expired).
+<P>
+<H2><A NAME="ss11.46">11.46 Squid uses 100% CPU</A>
+</H2>
+
+<P>There may be many causes for this.
+<P>Andrew Doroshenko reports that removing <EM>/dev/null</EM>, or 
+mounting a filesystem with the <EM>nodev</EM> option, can cause
+Squid to use 100% of CPU.  His suggested solution is to ``touch /dev/null.''
+<P>
+<H2><A NAME="ss11.47">11.47 Webmin's <EM>cachemgr.cgi</EM> crashes the operating system</A>
+</H2>
+
+<P>Mikael Andersson reports that clicking on Webmin's <EM>cachemgr.cgi</EM> 
+link creates numerous instances of <EM>cachemgr.cgi</EM> that quickly
+consume all available memory and brings the system to its knees.
+<P>Joe Cooper reports this to be caused by SSL problems in some browsers
+(mainly Netscape 6.x/Mozilla) if your Webmin is SSL enabled. Try with
+another browser such as Netscape 4.x or Microsoft IE, or disable SSL
+encryption in Webmin.
+<P>
+<H2><A NAME="ss11.48">11.48 Segment Violation at startup or upon first request</A>
+</H2>
+
+<P>Some versions of GCC (notably 2.95.1 through 2.95.4 at least) have bugs
+with compiler optimization.  These GCC bugs may cause NULL pointer
+accesses in Squid, resulting in a ``FATAL: Received Segment
+Violation...dying'' message and a core dump.
+<P>You can work around these GCC bugs by disabling compiler
+optimization.  The best way to do that is start with a clean
+source tree and set the CC options specifically:
+<PRE>
+% cd squid-x.y
+% make distclean
+% setenv CFLAGS='-g -Wall'
+% ./configure ...
+</PRE>
+<P>To check that  you did it right, you can search for AC_CFLAGS in
+<EM>src/Makefile</EM>:
+<PRE>
+% grep AC_CFLAGS src/Makefile
+AC_CFLAGS       = -g -Wall
+</PRE>
+
+Now when you recompile, GCC won't try to optimize anything:
+<PRE>
+% make
+Making all in lib...
+gcc -g -Wall -I../include -I../include -c rfc1123.c
+...etc...
+</PRE>
+<P>NOTE: some people worry that disabling compiler optimization will
+negatively impact Squid's performance.  The impact should be
+negligible, unless your cache is really busy and already runs
+at a high CPU usage.  For most people, the compiler optimization
+makes little or no difference at all.
+<P>
+<H2><A NAME="ss11.49">11.49 urlParse: Illegal character in hostname 'proxy.mydomain.com:8080proxy.mydomain.com'</A>
+</H2>
+
+<P>By Yomler of fnac.net
+<P>A combination of a bad configuration of Internet Explorer and any 
+application which use the cydoor DLLs will produce the entry in the log. 
+See 
+<A HREF="http://www.cydoor.com/">cydoor.com</A> for a complete list.
+<P>The bad configuration of IE is the use of a active configuration script 
+(proxy.pac) and an active or inactive, but filled proxy settings. IE will 
+only use the proxy.pac. Cydoor aps will use both and will generate the errors.
+<P>Disabling the old proxy settings in IE is not enought, you should delete 
+them completely and only use the proxy.pac for example.
+<P>
+<H2><A NAME="ss11.50">11.50 Requests for international domain names does not work</A>
+</H2>
+
+<P>By Henrik Nordstr&ouml;m
+<P>Some people have asked why requests for domain names using national
+symbols as "supported" by the certain domain registrars does not work
+in Squid. This is because there as of yet is no standard on how to
+manage national characters in the current Internet protocols such
+as HTTP or DNS. The current Internet standards is very strict
+on what is an acceptable hostname and only accepts A-Z a-z 0-9 and -
+in Internet hostname labels. Anything outside this is outside
+the current Internet standards and will cause interoperability
+issues such as the problems seen with such names and Squid.
+<P>When there is a consensus in the DNS and HTTP standardization groups
+on how to handle international domain names Squid will be changed to
+support this if any changes to Squid will be required.
+<P>If you are interested in the progress of the standardization process
+for international domain names please see the 
+<A HREF="http://www.ietf.org/html.charters/idn-charter.html">IETF idn</A>
+working group or it's 
+<A HREF="http://www.i-d-n.net/">dedicated page</A>.
+<P>
+<H2><A NAME="ss11.51">11.51 Why do I sometimes get ``Zero Sized Reply''?</A>
+</H2>
+
+<P>This happens when Squid makes a TCP connection to an origin server, but
+for some reason, the connection is closed before Squid reads any data.
+Depending on various factors, Squid may be able to retry the request again.
+If you see the ``Zero Sized Reply'' error message, it means that Squid
+was unable to retry, or that all retry attempts also failed.
+<P>
+<P>What causes a connection to close prematurely?  It could be a number
+of things, including:
+<OL>
+<LI>An overloaded origin server.</LI>
+<LI>TCP implementation/interoperability bugs.</LI>
+<LI>Race conditions with HTTP persistent connections.</LI>
+<LI>Buggy or misconfigured NAT boxes, firewalls, and load-balancers.</LI>
+<LI>Denial of service attacks.</LI>
+</OL>
+<P>
+<P>You may be able to use <EM>tcpdump</EM> to track down and observe the
+problem.
+<P>
+<P>Some users believe the problem is caused by very large cookies.
+One user reports that his Zero Sized Reply problem went away
+when he told Internet Explorer to not accept third-party
+cookies.
+<P>
+<P>Here are some things you can try to reduce the occurance of the
+Zero Sized Reply error:
+<OL>
+<LI>Delete or rename your cookie file and configure your
+browser to prompt you before accepting any new cookies.</LI>
+<LI>Disable HTTP persistent connections with the
+<EM>server_persistent_connections</EM> and <EM>client_persistent_connections</EM>
+directives.</LI>
+<LI>Disable any advanced TCP features on the Squid system.  Disable
+ECN on Linux with <CODE>echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn/</CODE>.</LI>
+</OL>
+<P>
+<P>If this error causes serious problems for you,
+Squid developers would be happy to help you uncover the problem.  However,
+we will require high-quality debugging information from you, such as
+<EM>tcpdump</EM> output, server IP addresses, operating system versions,
+and <EM>access.log</EM> entries with full HTTP headers.
+<P>
+<P>If you want to make Squid give the Zero Sized error
+on demand, you can use the short C program below.  Simply compile and
+start the program on a system that doesn't already have a server
+running on port 80.  Then try to connect to this fake server through
+Squid:
+<PRE>
+#include &lt;stdio.h>
+#include &lt;stdlib.h>
+#include &lt;unistd.h>
+#include &lt;sys/types.h>
+#include &lt;sys/socket.h>
+#include &lt;netinet/in.h>
+#include &lt;arpa/inet.h>
+#include &lt;assert.h>
+
+int
+main(int a, char **b)
+{
+        struct sockaddr_in S;
+        int s,t,x;
+        s = socket(PF_INET, SOCK_STREAM, 0);
+        assert(s > 0);
+        memset(&amp;S, '\0', sizeof(S));
+        S.sin_family = AF_INET;
+        S.sin_port = htons(80);
+        x = bind(s, (struct sockaddr *) &amp;S, sizeof(S));
+        assert(x == 0);
+        x = listen(s, 10);
+        assert(x == 0);
+        while (1) {
+                struct sockaddr_in F;
+                int fl = sizeof(F);
+                t = accept(s, (struct sockaddr *) &amp;F, &amp;fl);
+                fprintf(stderr, "accpeted FD %d from %s:%d\n",
+                        t, inet_ntoa(F.sin_addr), (int)ntohs(F.sin_port));
+                close(t);
+                fprintf(stderr, "closed FD %d\n", t);
+        }
+        return 0;
+}
+</PRE>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-12.html">Next</A>
+<A HREF="FAQ-10.html">Previous</A>
+<A HREF="FAQ.html#toc11">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-12.html
+++ squid-2.5.9/debian/doc/FAQ-12.html
@@ -0,0 +1,1041 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: How does Squid work?</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-13.html">Next</A>
+<A HREF="FAQ-11.html">Previous</A>
+<A HREF="FAQ.html#toc12">Contents</A>
+<HR>
+<H2><A NAME="memory"></A> <A NAME="s12">12. How does Squid work?</A></H2>
+
+<H2><A NAME="ss12.1">12.1 What are cachable objects?</A>
+</H2>
+
+<P>An Internet Object is a file, document or response to a query for
+an Internet service such as FTP, HTTP, or gopher.  A client requests
+an Internet object from a caching proxy; if the object
+is not already cached, the proxy server fetches
+the object (either from the host specified in the URL or from a
+parent or sibling cache) and delivers it to the client.
+<P>
+<H2><A NAME="what-is-icp"></A> <A NAME="ss12.2">12.2 What is the ICP protocol?</A>
+</H2>
+
+<P>ICP is a protocol used for communication among squid caches.
+The ICP protocol is defined in two Internet RFC's.
+<A HREF="http://www.ircache.net/Cache/ICP/rfc2186.txt">RFC 2186</A>
+describes the protocol itself, while
+<A HREF="http://www.ircache.net/Cache/ICP/rfc2187.txt">RFC 2187</A>
+describes the application of ICP to hierarchical Web caching.
+<P>
+<P>ICP is primarily used within a cache hierarchy to locate specific
+objects in sibling caches.  If a squid cache does not have a
+requested document, it sends an ICP query to its siblings, and the
+siblings respond with ICP replies indicating a ``HIT'' or a ``MISS.''
+The cache then uses the replies to choose from which cache to
+resolve its own MISS.
+<P>
+<P>ICP also supports multiplexed transmission of multiple object
+streams over a single TCP connection.  ICP is currently implemented
+on top of UDP.  Current versions of Squid also support ICP via
+multicast.
+<P>
+<H2><A NAME="ss12.3">12.3 What is the <EM>dnsserver</EM>?</A>
+</H2>
+
+<P>The <EM>dnsserver</EM> is a process forked by <EM>squid</EM> to
+resolve IP addresses from domain names.  This is necessary because
+the <CODE>gethostbyname(3)</CODE> function blocks the calling process
+until the DNS query is completed.
+<P>Squid must use non-blocking I/O at all times, so DNS lookups are
+implemented external to the main process.  The <EM>dnsserver</EM>
+processes do not cache DNS lookups, that is implemented inside the
+<EM>squid</EM> process.
+<P>
+<P>
+<H2><A NAME="ss12.4">12.4 What is the <EM>ftpget</EM> program for?</A>
+</H2>
+
+<P><EM>ftpget</EM> exists only in Squid 1.1 and Squid 1.0 versions.
+<P>The <EM>ftpget</EM> program is an FTP client used for retrieving
+files from FTP servers.  Because the FTP protocol is complicated,
+it is easier to implement it separately from the main <EM>squid</EM>
+code.
+<P>
+<P>
+<H2><A NAME="ss12.5">12.5 FTP PUT's don't work!</A>
+</H2>
+
+<P>FTP PUT should work with Squid-2.0 and later versions.  If you
+are using Squid-1.1, then you need to upgrade before PUT will work.
+<P>
+<H2><A NAME="ss12.6">12.6 What is a cache hierarchy?  What are parents and siblings?</A>
+</H2>
+
+<P>
+<P>A cache hierarchy is a collection of caching proxy servers organized
+in a logical parent/child and sibling arrangement so that caches
+closest to Internet gateways (closest to the backbone transit
+entry-points) act as parents to caches at locations farther from
+the backbone.  The parent caches resolve ``misses'' for their children.
+In other words, when a cache requests an object from its parent,
+and the parent does not have the object in its cache, the parent
+fetches the object, caches it, and delivers it to the child.  This
+ensures that the hierarchy achieves the maximum reduction in
+bandwidth utilization on the backbone transit links, helps reduce
+load on Internet information servers outside the network served by
+the hierarchy, and builds a rich cache on the parents so that the
+other child caches in the hierarchy will obtain better ``hit'' rates
+against their parents.
+<P>
+<P>In addition to the parent-child relationships, squid supports the
+notion of siblings:  caches at the same level in the hierarchy,
+provided to distribute cache server load.  Each cache in the
+hierarchy independently decides whether to fetch the reference from
+the object's home site or from parent or sibling caches, using a
+a simple resolution protocol.  Siblings will not fetch an object
+for another sibling to resolve a cache ``miss.''
+<P>
+<H2><A NAME="ss12.7">12.7 What is the Squid cache resolution algorithm?</A>
+</H2>
+
+<P>
+<P>
+<UL>
+<LI>Send ICP queries to all appropriate siblings</LI>
+<LI>Wait for all replies to arrive with a configurable timeout
+(the default is two seconds).</LI>
+<LI>Begin fetching the object upon receipt of the first HIT reply,
+or</LI>
+<LI>Fetch the object from the first parent which replied with MISS
+(subject to weighting values), or</LI>
+<LI>Fetch the object from the source</LI>
+</UL>
+<P>
+<P>The algorithm is somewhat more complicated when firewalls
+are involved.
+<P>
+<P>The <CODE>single_parent_bypass</CODE> directive can be used to skip
+the ICP queries if the only appropriate sibling is a parent cache
+(i.e., if there's only one place you'd fetch the object from, why
+bother querying?)
+<P>
+<H2><A NAME="ss12.8">12.8 What features are Squid developers currently working on?</A>
+</H2>
+
+<P>
+<P>There are several open issues for the caching project namely
+more automatic load balancing and (both configured and
+dynamic) selection of parents, routing, multicast
+cache-to-cache communication, and better recognition of URLs
+that are not worth caching.
+<P>For our other to-do list items, please
+see our ``TODO'' file in the recent source distributions.
+<P>
+<P>Prospective developers should review the resources available at the
+<A HREF="http://www.squid-cache.org/Devel/">Squid developers corner</A><P>
+<H2><A NAME="ss12.9">12.9 Tell me more about Internet traffic workloads</A>
+</H2>
+
+<P>
+<P>Workload can be characterized as the burden a client or
+group of clients imposes on a system.  Understanding the
+nature of workloads is important to the managing system
+capacity.
+<P>If you are interested in Internet traffic workloads then NLANR's
+<A HREF="http://www.nlanr.net/NA/">Network Analysis activities</A> is a good place to start.
+<P>
+<H2><A NAME="ss12.10">12.10 What are the tradeoffs of caching with the NLANR cache system?</A>
+</H2>
+
+<P>
+<P>The NLANR root caches are at the NSF supercomputer centers (SCCs),
+which are interconnected via NSF's high speed backbone service
+(vBNS).  So inter-cache communication between the NLANR root caches
+does not cross the Internet.
+<P>
+<P>The benefits of hierarchical caching (namely, reduced network
+bandwidth consumption, reduced access latency, and improved
+resiliency) come at a price.  Caches higher in the hierarchy must
+field  the misses of their descendents. If the equilibrium hit rate
+of a leaf cache is 50%, half of all leaf references have to be
+resolved through a second level cache rather than directly from
+the object's source.  If this second level cache has most of the
+documents, it is usually still a win, but if higher level caches
+often don't have the document, or become overloaded, then they
+could actually increase access latency, rather than reduce it.
+<P>
+<P>
+<H2><A NAME="ss12.11">12.11 Where can I find out more about firewalls?</A>
+</H2>
+
+<P>Please see the
+<A HREF="http://lists.gnac.net/firewalls/">Firewalls mailing list and FAQ</A>
+information site.
+<P>
+<H2><A NAME="ss12.12">12.12 What is the ``Storage LRU Expiration Age?''</A>
+</H2>
+
+<P>For example:
+<PRE>
+        Storage LRU Expiration Age:      4.31 days
+</PRE>
+<P>
+<P>The LRU expiration age is a dynamically-calculated value.  Any objects
+which have not been accessed for this amount of time will be removed from
+the cache to make room for new, incoming objects.  Another way of looking
+at this is that it would
+take your cache approximately this many days to go from empty to full at
+your current traffic levels.
+<P>
+<P>As your cache becomes more busy, the LRU age becomes lower so that more
+objects will be removed to make room for the new ones.  Ideally, your
+cache will have an LRU age value in the range of at least 3 days.  If the
+LRU age is lower than 3 days, then your cache is probably not big enough
+to handle the volume of requests it receives.  By adding more disk space
+you could increase your cache hit ratio.
+<P>
+<P>The configuration parameter <EM>reference_age</EM> places an upper limit on
+your cache's LRU expiration age.
+<P>
+<H2><A NAME="ss12.13">12.13 What is ``Failure Ratio at 1.01; Going into hit-only-mode for 5 minutes''?</A>
+</H2>
+
+<P>Consider a pair of caches named A and B.  It may be the case that A can
+reach B, and vice-versa, but B has poor reachability to the rest of the
+Internet.
+In this case, we would like B to recognize that it has poor reachability
+and somehow convey this fact to its neighbor caches.
+<P>
+<P>Squid will track the ratio of failed-to-successful requests over short
+time periods.  A failed request is one which is logged as ERR_DNS_FAIL, ERR_CONNECT_FAIL, or ERR_READ_ERROR.  When the failed-to-successful ratio exceeds 1.0,
+then Squid will return ICP_MISS_NOFETCH instead of ICP_MISS to neighbors.
+Note, Squid will still return ICP_HIT for cache hits.
+<P>
+<H2><A NAME="ss12.14">12.14 Does squid periodically re-read its configuration file?</A>
+</H2>
+
+<P>No, you must send a HUP signal to have Squid re-read its configuration file,
+including access control lists.  An easy way to do this is with the <EM>-k</EM>
+command line option:
+<PRE>
+        squid -k reconfigure
+</PRE>
+<P>
+<H2><A NAME="ss12.15">12.15 How does <EM>unlinkd</EM> work?</A>
+</H2>
+
+<P><EM>unlinkd</EM> is an external process used for unlinking unused cache files.
+Performing the unlink operation in an external process opens up some
+race-condition problems for Squid.  If we are not careful, the following
+sequence of events could occur:
+<OL>
+<LI>An object with swap file number <B>S</B> is removed from the cache.</LI>
+<LI>We want to unlink file <B>F</B> which corresponds to swap file number <B>S</B>,
+so we write pathname <B>F</B> to the <EM>unlinkd</EM> socket.
+We also mark <B>S</B> as available in the filemap.</LI>
+<LI>We have a new object to swap out.  It is allocated to the first available
+file number, which happens to be <B>S</B>.  Squid opens file <B>F</B> for writing.</LI>
+<LI>The <EM>unlinkd</EM> process reads the request to unlink <B>F</B> and issues the
+actual unlink call.</LI>
+</OL>
+<P>So, the problem is, how can we guarantee that <EM>unlinkd</EM> will not
+remove a cache file that Squid has recently allocated to a new object?
+The approach we have taken is to have Squid keep a stack of unused (but
+not deleted!)  swap file numbers.  The stack size is hard-coded at 128
+entries.  We only give unlink requests to <EM>unlinkd</EM> when the unused
+file number stack is full.  Thus, if we ever have to start unlinking
+files, we have a pool of 128 file numbers to choose from which we know
+will not be removed by <EM>unlinkd</EM>.
+<P>
+<P>In terms of implementation, the only way to send unlink requests to
+the <EM>unlinkd</EM> process is via the <EM>storePutUnusedFileno</EM> function.
+<P>
+<P>Unfortunately there are times when Squid can not use the <EM>unlinkd</EM> process
+but must call <EM>unlink(2)</EM> directly.  One of these times is when the cache
+swap size is over the high water mark.  If we push the released file numbers
+onto the unused file number stack, and the stack is not full, then no files
+will be deleted, and the actual disk usage will remain unchanged.  So, when
+we exceed the high water mark, we must call <EM>unlink(2)</EM> directly.
+<P>
+<H2><A NAME="ss12.16">12.16 What is an icon URL?</A>
+</H2>
+
+<P>One of the most unpleasant things Squid must do is generate HTML
+pages of Gopher and FTP directory listings.  For some strange
+reason, people like to have little <EM>icons</EM> next to each
+listing entry, denoting the type of object to which the
+link refers (image, text file, etc.).
+<P>
+<P>In Squid 1.0 and 1.1, we used internal browser icons with names
+like <EM>gopher-internal-image</EM>.  Unfortunately, these were
+not very portable.  Not all browsers had internal icons, or
+even used the same names.  Perhaps only Netscape and Mosaic
+used these names.
+<P>
+<P>For Squid 2 we include a set of icons in the source distribution.
+These icon files are loaded by Squid as cached objects at runtime.
+Thus, every Squid cache now has its own icons to use in Gopher and FTP
+listings.  Just like other objects available on the web, we refer to
+the icons with
+<A HREF="http://info.internet.isi.edu/in-notes/rfc/files/rfc1738.txt">Uniform Resource Locators</A>, or <EM>URLs</EM>.
+<P>
+<H2><A NAME="ss12.17">12.17 Can I make my regular FTP clients use a Squid cache?</A>
+</H2>
+
+<P>Nope, its not possible.  Squid only accepts HTTP requests.  It speaks
+FTP on the <EM>server-side</EM>, but <B>not</B> on the <EM>client-side</EM>.
+<P>
+<P>The very cool
+<A HREF="ftp://gnjilux.cc.fer.hr/pub/unix/util/wget/">wget</A>
+will download FTP URLs via Squid (and probably any other proxy cache).
+<P>
+<H2><A NAME="ss12.18">12.18 Why is the select loop average time so high?</A>
+</H2>
+
+<P>
+<P><I>Is there any way to speed up the time spent dealing with select? Cachemgr
+shows:</I>
+<PRE>
+        Select loop called: 885025 times, 714.176 ms avg
+</PRE>
+<P>
+<P>This number is NOT how much time it takes to handle filedescriptor I/O.
+We simply count the number of times select was called, and divide the
+total process running time by the number of select calls.
+<P>
+<P>This means, on average it takes your cache .714 seconds to check all
+the open file descriptors once.   But this also includes time select()
+spends in a wait state when there is no I/O on any file descriptors.
+My relatively idle workstation cache has similar numbers:
+<PRE>
+        Select loop called: 336782 times, 715.938 ms avg
+</PRE>
+
+But my busy caches have much lower times:
+<PRE>
+        Select loop called: 16940436 times, 10.427 ms avg
+        Select loop called: 80524058 times, 10.030 ms avg
+        Select loop called: 10590369 times, 8.675 ms avg
+        Select loop called: 84319441 times, 9.578 ms avg
+</PRE>
+<P>
+<H2><A NAME="ss12.19">12.19 How does Squid deal with Cookies?</A>
+</H2>
+
+<P>The presence of Cookies headers in <B>requests</B> does not affect whether
+or not an HTTP reply can be cached.   Similarly, the presense of
+<EM>Set-Cookie</EM> headers in <B>replies</B> does not affect whether
+the reply can be cached.
+<P>
+<P>The proper way to deal with <EM>Set-Cookie</EM> reply headers, according
+to 
+<A HREF="http://info.internet.isi.edu/in-notes/rfc/files/rfc2109.txt">RFC 2109</A>
+is to cache the whole object, <EM>EXCEPT</EM> the <EM>Set-Cookie</EM> header lines.
+<P>
+<P>
+<P>With Squid-1.1, we can not filter out specific HTTP headers, so
+Squid-1.1 does not cache any response which contains a <EM>Set-Cookie</EM>
+header.
+<P>
+<P>With Squid-2, however, we can filter out specific HTTP headers.  But instead
+of filtering them on the receiving-side, we filter them on the sending-side.
+Thus, Squid-2 does cache replies with <EM>Set-Cookie</EM> headers, but
+it filters out the <EM>Set-Cookie</EM> header itself for cache hits.
+<P>
+<H2><A NAME="ss12.20">12.20 How does Squid decide when to refresh a cached object?</A>
+</H2>
+
+<P>When checking the object freshness, we calculate these values:
+<UL>
+<LI><EM>OBJ_DATE</EM> is the time when the object was given out by the
+origin server.  This is taken from the HTTP Date reply header.</LI>
+<LI><EM>OBJ_LASTMOD</EM> is the time when the object was last modified,
+given by the HTTP Last-Modified reply header.</LI>
+<LI><EM>OBJ_AGE</EM> is how much the object has aged <EM>since</EM> it was retrieved:
+<PRE>
+        OBJ_AGE = NOW - OBJ_DATE
+</PRE>
+</LI>
+<LI><EM>LM_AGE</EM> is how old the object was <EM>when</EM> it was retrieved:
+<PRE>
+        LM_AGE = OBJ_DATE - OBJ_LASTMOD
+</PRE>
+</LI>
+<LI><EM>LM_FACTOR</EM> is the ratio of <EM>OBJ_AGE</EM> to <EM>LM_AGE</EM>:
+<PRE>
+        LM_FACTOR = OBJ_AGE / LM_AGE
+</PRE>
+</LI>
+<LI><EM>CLIENT_MAX_AGE</EM> is the (optional) maximum object age the client will
+accept as taken from the HTTP/1.1 Cache-Control request header.</LI>
+<LI><EM>EXPIRES</EM> is the (optional) expiry time from the server reply headers.</LI>
+</UL>
+<P>
+<P>These values are compared with the parameters of the <EM>refresh_pattern</EM>
+rules.  The refresh parameters are:
+<UL>
+<LI>URL regular expression</LI>
+<LI><EM>CONF_MIN</EM>:
+The time (in minutes) an object without an explicit expiry
+time should be considered fresh. The recommended value is 0, any higher
+values may cause dynamic applications to be erronously cached unless the
+application designer has taken the appropriate actions.
+</LI>
+<LI><EM>CONF_PERCENT</EM>:
+A percentage of the objects age (time since last
+modification age) an object without explicit exipry time will be
+considered fresh.
+</LI>
+<LI><EM>CONF_MAX</EM>:
+An upper limit on how long objects without an explicit
+expiry time will be considered fresh.
+</LI>
+</UL>
+<P>
+<P>The URL regular expressions are checked in the order listed until a
+match is found.  Then the algorithms below are applied for determining
+if an object is fresh or stale.
+<P>
+<H3>Squid-1.1 and Squid-1.NOVM algorithm</H3>
+
+<P>
+<PRE>
+    if (CLIENT_MAX_AGE)
+        if (OBJ_AGE > CLIENT_MAX_AGE)
+            return STALE
+    if (OBJ_AGE &lt;= CONF_MIN)
+        return FRESH
+    if (EXPIRES) {
+        if (EXPIRES &lt;= NOW)
+            return STALE
+        else
+            return FRESH
+    }
+    if (OBJ_AGE > CONF_MAX)
+        return STALE
+    if (LM_FACTOR &lt; CONF_PERCENT)
+        return FRESH
+    return STALE
+</PRE>
+<P>
+<P>
+<A HREF="mailto:bertold@tohotom.vein.hu">Kolics Bertold</A>
+has made an excellent
+<A HREF="http://www.squid-cache.org/Doc/FAQ/refresh-flowchart.gif">flow chart diagram</A> showing this process.
+<P>
+<H3>Squid-2 algorithm</H3>
+
+<P>For Squid-2 the refresh algorithm has been slightly modified to give the
+<EM>EXPIRES</EM> value a higher precedence, and the <EM>CONF_MIN</EM> value
+lower precedence:
+<PRE>
+    if (EXPIRES) {
+        if (EXPIRES &lt;= NOW)
+            return STALE
+        else
+            return FRESH
+    }
+    if (CLIENT_MAX_AGE)
+        if (OBJ_AGE > CLIENT_MAX_AGE)
+            return STALE
+    if (OBJ_AGE > CONF_MAX)
+        return STALE
+    if (OBJ_DATE > OBJ_LASTMOD) {
+        if (LM_FACTOR &lt; CONF_PERCENT)
+            return FRESH
+        else
+            return STALE
+    }
+    if (OBJ_AGE &lt;= CONF_MIN)
+        return FRESH
+    return STALE
+</PRE>
+<P>
+<P>
+<H2><A NAME="ss12.21">12.21 What exactly is a <EM>deferred read</EM>?</A>
+</H2>
+
+<P>The cachemanager I/O page lists <EM>deferred reads</EM> for various
+server-side protocols.
+<P>Sometimes reading on the server-side gets ahead of writing to the
+client-side.  Especially if your cache is on a fast network and your
+clients are connected at modem speeds.  Squid-1.1 will read up to 256k
+(per request) ahead before it starts to defer the server-side reads.
+<P>
+<H2><A NAME="ss12.22">12.22 Why is my cache's inbound traffic equal to the outbound traffic?</A>
+</H2>
+
+<P><I>I've been monitoring
+the traffic on my cache's ethernet adapter an found a behavior I can't explain:
+the inbound traffic is equal to the outbound traffic. The differences are
+negligible. The hit ratio reports 40%.
+Shouldn't the outbound be at least 40% greater than the inbound?</I>
+<P>by 
+<A HREF="mailto:david@avarice.nepean.uws.edu.au">David J N Begley</A><P>I can't account for the exact behavior you're seeing, but I can offer this
+advice;  whenever you start measuring raw Ethernet or IP traffic on
+interfaces, you can forget about getting all the numbers to exactly match what
+Squid reports as the amount of traffic it has sent/received.
+<P>
+<P>Why?
+<P>
+<P>Squid is an application - it counts whatever data is sent to, or received
+from, the lower-level networking functions;  at each successively lower layer,
+additional traffic is involved (such as header overhead, retransmits and
+fragmentation, unrelated broadcasts/traffic, etc.).  The additional traffic is
+never seen by Squid and thus isn't counted - but if you run MRTG (or any
+SNMP/RMON measurement tool) against a specific interface, all this additional
+traffic will "magically appear".
+<P>
+<P>Also remember that an interface has no concept of upper-layer networking (so
+an Ethernet interface doesn't distinguish between IP traffic that's entirely
+internal to your organization, and traffic that's to/from the Internet);  this
+means that when you start measuring an interface, you have to be aware of
+*what* you are measuring before you can start comparing numbers elsewhere.
+<P>
+<P>It is possible (though by no means guaranteed) that you are seeing roughly
+equivalent input/output because you're measuring an interface that both
+retrieves data from the outside world (Internet), *and* serves it to end users
+(internal clients).  That wouldn't be the whole answer, but hopefully it gives
+you a few ideas to start applying to your own circumstance.
+<P>
+<P>To interpret any statistic, you have to first know what you are measuring;
+for example, an interface counts inbound and outbound bytes - that's it.  The
+interface doesn't distinguish between inbound bytes from external Internet
+sites or from internal (to the organization) clients (making requests).  If
+you want that, try looking at RMON2.
+<P>
+<P>Also, if you're talking about a 40% hit rate in terms of object
+requests/counts then there's absolutely no reason why you should expect a 40%
+reduction in traffic;  after all, not every request/object is going to be the
+same size so you may be saving a lot in terms of requests but very little in
+terms of actual traffic.
+<P>
+<H2><A NAME="ss12.23">12.23 How come some objects do not get cached?</A>
+</H2>
+
+<P>To determine whether a given object may be cached, Squid takes many
+things into consideration.  The current algorithm (for Squid-2)
+goes something like this:
+<P>
+<OL>
+<LI>Responses with <EM>Cache-Control: Private</EM> are NOT cachable.</LI>
+<LI>Responses with <EM>Cache-Control: No-Cache</EM> are NOT cachable.</LI>
+<LI>Responses with <EM>Cache-Control: No-Store</EM> are NOT cachable.</LI>
+<LI>Responses for requests with an <EM>Authorization</EM> header
+are cachable ONLY if the reponse includes <EM>Cache-Control: Public</EM>.</LI>
+<LI>Responses with <EM>Vary</EM> headers are NOT cachable because Squid
+does not yet support Vary features.</LI>
+<LI>The following HTTP status codes are cachable:
+<UL>
+<LI>200 OK</LI>
+<LI>203 Non-Authoritative Information</LI>
+<LI>300 Multiple Choices</LI>
+<LI>301 Moved Permanently</LI>
+<LI>410 Gone</LI>
+</UL>
+
+However, if Squid receives one of these responses from a neighbor
+cache, it will NOT be cached if ALL of the <EM>Date</EM>, <EM>Last-Modified</EM>,
+and <EM>Expires</EM> reply headers are missing.  This prevents such objects
+from bouncing back-and-forth between siblings forever.</LI>
+<LI>A 302 Moved Temporarily response is cachable ONLY if the response
+also includes an <EM>Expires</EM> header.</LI>
+<LI>The following HTTP status codes are ``negatively cached'' for
+a short amount of time (configurable):
+<UL>
+<LI>204 No Content</LI>
+<LI>305 Use Proxy</LI>
+<LI>400 Bad Request</LI>
+<LI>403 Forbidden</LI>
+<LI>404 Not Found</LI>
+<LI>405 Method Not Allowed</LI>
+<LI>414 Request-URI Too Large</LI>
+<LI>500 Internal Server Error</LI>
+<LI>501 Not Implemented</LI>
+<LI>502 Bad Gateway</LI>
+<LI>503 Service Unavailable</LI>
+<LI>504 Gateway Time-out</LI>
+</UL>
+</LI>
+<LI>All other HTTP status codes are NOT cachable, including:
+<UL>
+<LI>206 Partial Content</LI>
+<LI>303 See Other</LI>
+<LI>304 Not Modified</LI>
+<LI>401 Unauthorized</LI>
+<LI>407 Proxy Authentication Required</LI>
+</UL>
+</LI>
+</OL>
+<P>
+<H2><A NAME="ss12.24">12.24 What does <EM>keep-alive ratio</EM> mean?</A>
+</H2>
+
+<P>The <EM>keep-alive ratio</EM> shows up in the <EM>server_list</EM>
+cache manager page for Squid 2.
+<P>This is a mechanism to try detecting neighbor caches which might
+not be able to deal with persistent connections.  Every
+time we send a <EM>proxy-connection: keep-alive</EM> request header
+to a neighbor, we count how many times the neighbor sent us
+a <EM>proxy-connection: keep-alive</EM> reply header.  Thus, the
+<EM>keep-alive ratio</EM> is the ratio of these two counters.
+<P>
+<P>If the ratio stays above 0.5, then we continue to assume the neighbor
+properly implements persistent connections.  Otherwise, we will stop
+sending the keep-alive request header to that neighbor.
+<P>
+<H2><A NAME="ss12.25">12.25 How does Squid's cache replacement algorithm work?</A>
+</H2>
+
+<P>Squid uses an LRU (least recently used) algorithm to replace old cache
+objects.  This means objects which have not been accessed for the
+longest time are removed first.  In the source code, the
+StoreEntry->lastref value is updated every time an object is accessed.
+<P>
+<P>Objects are not necessarily removed ``on-demand.''  Instead, a regularly
+scheduled event runs to periodically remove objects.  Normally this
+event runs every second.
+<P>
+<P>Squid keeps the cache disk usage between the low and high water marks.
+By default the low mark is 90%, and the high mark is 95% of the total
+configured cache size.  When the disk usage is close to the low mark,
+the replacement is less aggressive (fewer objects removed).  When the
+usage is close to the high mark, the replacement is more aggressive
+(more objects removed).
+<P>
+<P>When selecting objects for removal, Squid examines some number of objects
+and determines which can be removed and which cannot.
+A number of factors determine whether or not any given object can be
+removed.  If the object is currently being requested, or retrieved
+from an upstream site, it will not be removed.   If the object is
+``negatively-cached'' it will be removed.  If the object has a private
+cache key, it will be removed (there would be no reason to keep it --
+because the key is private, it can never be ``found'' by subsequent requests).
+Finally, if the time since last access is greater than the LRU threshold,
+the object is removed.
+<P>
+<P>The LRU threshold value is dynamically calculated based on the current
+cache size and the low and high marks.  The LRU threshold scaled
+exponentially between the high and low water marks.  When the store swap
+size is near the low water mark, the LRU threshold is large.  When the
+store swap size is near the high water mark, the LRU threshold is small.
+The threshold automatically adjusts to the rate of incoming requests.
+In fact, when your cache size has stabilized, the LRU threshold
+represents how long it takes to fill (or fully replace) your cache at
+the current request rate.  Typical values for the LRU threshold are 1 to
+10 days.
+<P>
+<P>Back to selecting objects for removal.  Obviously it is not possible to
+check every object in the cache every time we need to remove some of them.
+We can only check a small subset each time.  The way in which
+this is implemented is very different between Squid-1.1 and Squid-2.
+<P>
+<H3>Squid 1.1</H3>
+
+<P>The Squid cache storage is implemented as a hash table with some number
+of "hash buckets."  Squid-1.1 scans one bucket at a time and sorts all the
+objects in the bucket by their LRU age.  Objects with an LRU age
+over the threshold are removed.  The scan rate is adjusted so that
+it takes approximately 24 hours to scan the entire cache.  The
+store buckets are randomized so that we don't always scan the same
+buckets at the same time of the day.
+<P>
+<P>This algorithm has some flaws.  Because we only scan one bucket,
+there are going to be better candidates for removal in some of
+the other 16,000 or so buckets.  Also, the qsort() function
+might take a non-trivial amount of CPU time, depending on how many
+entries are in each bucket.
+<P>
+<H3>Squid 2</H3>
+
+<P>For Squid-2 we eliminated the need to use qsort() by indexing
+cached objects into an automatically sorted linked list.  Every time
+an object is accessed, it gets moved to the top of the list.  Over time,
+the least used objects migrate to the bottom of the list.  When looking
+for objects to remove, we only need to check the last 100 or so objects
+in the list.  Unfortunately this approach increases our memory usage
+because of the need to store three additional pointers per cache object.
+But for Squid-2 we're still ahead of the game because we also replaced
+plain-text cache keys with MD5 hashes.
+<P>
+<H2><A NAME="pub-priv-keys"></A> <A NAME="ss12.26">12.26 What are private and public keys?</A>
+</H2>
+
+<P><EM>keys</EM> refers to the database keys which Squid uses to index
+cache objects.  Every object in the cache--whether saved on disk
+or currently being downloaded--has a cache key.  For Squid-1.0 and
+Squid-1.1 the cache key was basically the URL.  Squid-2 uses
+MD5 checksums for cache keys.
+<P>
+<P>The Squid cache uses the notions of <EM>private</EM> and <EM>public</EM>
+cache keys.  An object can start out as being private, but may later be
+changed to public status.  Private objects are associated with only a single
+client whereas a public object may be sent to multiple clients at the
+same time.  In other words, public objects can be located by any cache
+client.  Private keys can only be located by a single client--the one
+who requested it.
+<P>
+<P>Objects are changed from private to public after all of the HTTP
+reply headers have been received and parsed.  In some cases, the
+reply headers will indicate the object should not be made public.
+For example, if the <EM>no-cache</EM> Cache-Control directive is used.
+<P>
+<H2><A NAME="ss12.27">12.27 What is FORW_VIA_DB for?</A>
+</H2>
+
+<P>We use it to collect data for 
+<A HREF="http://www.ircache.net/Cache/Plankton/">Plankton</A>.
+<P>
+<H2><A NAME="ss12.28">12.28 Does Squid send packets to port 7 (echo)?  If so, why?</A>
+</H2>
+
+<P>It may.  This is an old feature from the Harvest cache software.
+The cache would send ICP ``SECHO'' message to the echo ports of
+origin servers.  If the SECHO message came back before any of the
+other ICP replies, then it meant the origin server was probably
+closer than any neighbor cache.  In that case Harvest/Squid sent
+the request directly to the origin server.
+<P>
+<P>With more attention focused on security, many administrators filter
+UDP packets to port 7.  The Computer Emergency Response Team (CERT)
+once issued an advisory note (
+<A HREF="http://www.cert.org/advisories/CA-96.01.UDP_service_denial.html">CA-96.01: UDP Port Denial-of-Service Attack</A>) that says UDP
+echo and chargen services can be used for a denial of service
+attack.  This made admins extremely nervous about any packets
+hitting port 7 on their systems, and they made complaints.
+<P>
+<P>The <EM>source_ping</EM> feature has been disabled in Squid-2. 
+If you're seeing packets to port 7 that are coming from a
+Squid cache (remote port 3130), then its probably a
+very old version of Squid.
+<P>
+<H2><A NAME="ss12.29">12.29 What does ``WARNING: Reply from unknown nameserver [a.b.c.d]'' mean?</A>
+</H2>
+
+<P>It means Squid sent a DNS query to one IP address, but the response 
+came back from a different IP address.  By default Squid checks that
+the addresses match.  If not, Squid ignores the response.
+<P>
+<P>There are a number of reasons why this would happen:
+<OL>
+<LI>Your DNS name server just works this way, either becuase
+its been configured to, or because its stupid and doesn't
+know any better.</LI>
+<LI>You have a weird broadcast address, like 0.0.0.0, in
+your <EM>/etc/resolv.conf</EM> file.</LI>
+<LI>Somebody is trying to send spoofed DNS responses to
+your cache.</LI>
+</OL>
+<P>
+<P>If you recognize the IP address in the warning as one of your
+name server hosts, then its probably numbers (1) or (2).
+<P>
+<P>You can make these warnings stop, and allow responses from
+``unknown'' name servers by setting this configuration option:
+<PRE>
+        ignore_unknown_nameservers off
+</PRE>
+<P>
+<H2><A NAME="ss12.30">12.30 How does Squid distribute cache files among the available directories?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.2.</EM>
+<P>See <EM>storeDirMapAllocate()</EM> in the source code.
+<P>
+<P>When Squid wants to create a new disk file for storing an object, it
+first selects which <EM>cache_dir</EM> the object will go into.  This is done
+with the <EM>storeDirSelectSwapDir()</EM> function.  If you have <EM>N</EM>
+cache directories, the function identifies the <EM>3N/4</EM> (75%)
+of them with the most available space.  These directories are
+then used, in order of having the most available space.  When Squid has
+stored one URL to each of the 
+<EM>3N/4</EM> <EM>cache_dir</EM>'s, the process repeats and 
+<EM>storeDirSelectSwapDir()</EM> finds a new set of <EM>3N/4</EM>
+cache directories with the most available space.
+<P>
+<P>Once the <EM>cache_dir</EM> has been selected, the next step is to find
+an available <EM>swap file number</EM>.  This is accomplished
+by checking the <EM>file map</EM>, with the <EM>file_map_allocate()</EM>
+function.  Essentially the swap file numbers are allocated
+sequentially.  For example, if the last number allocated 
+happens to be 1000, then the next one will be the first
+number after 1000 that is not already being used.
+<P>
+<H2><A NAME="ss12.31">12.31 Why do I see negative byte hit ratio?</A>
+</H2>
+
+<P>Byte hit ratio is calculated a bit differently than
+Request hit ratio.  Squid counts the number of bytes read
+from the network on the server-side, and the number of bytes written to
+the client-side.  The byte hit ratio is calculated as
+<PRE>
+        (client_bytes - server_bytes) / client_bytes
+</PRE>
+
+If server_bytes is greater than client_bytes, you end up
+with a negative value.
+<P>
+<P>The server_bytes may be greater than client_bytes for a number
+of reasons, including:
+<UL>
+<LI>Cache Digests and other internally generated requests.
+Cache Digest messages are quite large.  They are counted
+in the server_bytes, but since they are consumed internally,
+they do not count in client_bytes.</LI>
+<LI>User-aborted requests.  If your <EM>quick_abort</EM> setting
+allows it, Squid sometimes continues to fetch aborted
+requests from the server-side, without sending any
+data to the client-side.</LI>
+<LI>Some range requests, in combination with Squid bugs, can
+consume more bandwidth on the server-side than on the
+client-side.  In a range request, the client is asking for
+only some part of the object.  Squid may decide to retrieve
+the whole object anyway, so that it can be used later on.
+This means downloading more from the server than sending
+to the client.  You can affect this behavior with
+the <EM>range_offset_limit</EM> option.</LI>
+</UL>
+<P>
+<H2><A NAME="ss12.32">12.32 What does ``Disabling use of private keys'' mean?</A>
+</H2>
+
+<P>First you need to understand the 
+<A HREF="#pub-priv-keys">difference between public and private keys</A>.
+<P>
+<P>When Squid sends ICP queries, it uses the ICP <EM>reqnum</EM> field
+to hold the private key data.  In other words, when Squid gets an
+ICP reply, it uses the <EM>reqnum</EM> value to build the private cache key for
+the pending object.
+<P>
+<P>
+<P>Some ICP implementations always set the <EM>reqnum</EM> field to zero
+when they send a reply.   Squid can not use private cache keys with
+such neighbor caches because Squid will not be able to
+locate cache keys for those ICP replies.  Thus, if Squid detects a neighbor
+cache that sends zero reqnum's, it 
+disables the use of private cache keys.
+<P>
+<P>Not having private cache keys has some important privacy
+implications.  Two users could receive one response that was
+meant for only one of the users.  This response could contain
+personal, confidential information.  You will need to disable
+the ``zero reqnum'' neighbor if you want Squid to use private
+cache keys.
+<P>
+<H2><A NAME="ss12.33">12.33 What is a half-closed filedescriptor?</A>
+</H2>
+
+<P>TCP allows connections to be in a ``half-closed'' state.   This
+is accomplished with the <EM>shutdown(2)</EM> system call.  In Squid,
+this means that a client has closed its side of the connection for
+writing, but leaves it open for reading.  Half-closed connections
+are tricky because Squid can't tell the difference between a
+half-closed connection, and a fully closed one.
+<P>If Squid tries to read a connection, and <EM>read()</EM> returns
+0, and Squid knows that the client doesn't have the whole
+response yet, Squid puts marks the filedescriptor as half-closed.
+Most likely the client has aborted the request and the connection
+is really closed.  However, there is a slight chance that
+the client is using the <EM>shutdown()</EM> call, and that it
+can still read the response.
+<P>To disable half-closed connections, simply put this in
+squid.conf:
+<PRE>
+        half_closed_clients off
+</PRE>
+
+Then, Squid will always close its side of the connection
+instead of marking it as half-closed.
+<P>
+<H2><A NAME="ss12.34">12.34 What does --enable-heap-replacement do?</A>
+</H2>
+
+<P>Squid has traditionally used an LRU replacement algorithm.  As of
+<A HREF="/Versions/v2/2.3/">version 2.3</A>, you can use
+some other replacement algorithms by using the <EM>--enable-heap-replacement</EM>
+configure option.  Currently, the heap replacement code supports two
+additional algorithms: LFUDA, and GDS.
+<P>With Squid version 2.4 and later you should use this configure option:
+<PRE>
+./configure --enable-removal-policies=heap
+</PRE>
+<P>Then, in <EM>squid.conf</EM>, you can select different policies with the
+<EM>cache_replacement_policy</EM> option.  See the <EM>squid.conf</EM> comments
+for details.
+<P>The LFUDA and GDS replacement code was contributed by John Dilley and others
+from Hewlett-Packard.  Their work is described in these papers:
+<OL>
+<LI>
+<A HREF="http://www.hpl.hp.com/techreports/1999/HPL-1999-69.html">Enhancement and Validation of Squid's Cache Replacement Policy</A>
+(HP Tech Report).</LI>
+<LI>
+<A HREF="http://workshop.ircache.net/Papers/dilley-abstract.html">Enhancement and Validation of the Squid Cache Replacement Policy</A>
+(WCW 1999 paper).</LI>
+</OL>
+<P>
+<H2><A NAME="ss12.35">12.35 Why is actual filesystem space used greater than what Squid thinks?</A>
+</H2>
+
+<P>If you compare <EM>df</EM> output and cachemgr <EM>storedir</EM> output,
+you will notice that actual disk usage is greater than what Squid
+reports.  This may be due to a number of reasons:
+<UL>
+<LI>Squid doesn't keep track of the size of the <EM>swap.state</EM>
+file, which normally resides on each <EM>cache_dir</EM>.</LI>
+<LI>Directory entries and take up filesystem space.</LI>
+<LI>Other applications might be using the same disk partition.</LI>
+<LI>Your filesystem block size might be larger than what Squid
+thinks.  When calculating total disk usage, Squid rounds
+file sizes up to a whole number of 1024 byte blocks.  If
+your filesystem uses larger blocks, then some "wasted" space
+is not accounted.</LI>
+</UL>
+<P>
+<H2><A NAME="ss12.36">12.36 How do <EM>positive_dns_ttl</EM> and <EM>negative_dns_ttl</EM> work?</A>
+</H2>
+
+<P><EM>positive_dns_ttl</EM> is how long Squid caches a successful DNS
+lookup. Similarly, <EM>negative_dns_ttl</EM> is how long Squid caches
+a failed DNS lookup.
+<P><EM>positive_dns_ttl</EM> is not always used.  It is NOT used in the following
+cases:
+<UL>
+<LI>Squid-2.3 and later versions with internal DNS lookups.  Internal
+lookups are the default for Squid-2.3 and later.</LI>
+<LI>If you applied the ``DNS TTL'' 
+<A HREF="FAQ-2.html#dns-ttl-hack">patch</A>
+for BIND.</LI>
+<LI>If you are using FreeBSD, then it already has the DNS TTL patch
+built in.</LI>
+</UL>
+<P>
+<P>Let's say you have the following settings:
+<PRE>
+positive_dns_ttl 1 hours
+negative_dns_ttl 1 minutes
+</PRE>
+
+When Squid looks up a name like <EM>www.squid-cache.org</EM>, it gets back
+an IP address like 204.144.128.89.  The address is cached for the
+next hour.  That means, when Squid needs to know the address for 
+<EM>www.squid-cache.org</EM> again, it uses the cached answer for the
+next hour.  After one hour, the cached information expires, and Squid
+makes a new query for the address of <EM>www.squid-cache.org</EM>.
+<P>
+<P>If you have the DNS TTL patch, or are using internal lookups, then
+each hostname has its own TTL value, which was set by the domain
+name administrator.  You can see these values in the 'ipcache'
+cache manager page.  For example:
+<PRE>
+ Hostname                      Flags lstref    TTL N
+ www.squid-cache.org               C   73043  12784  1( 0)  204.144.128.89-OK 
+ www.ircache.net                   C   73812  10891  1( 0)   192.52.106.12-OK 
+ polygraph.ircache.net             C  241768 -181261  1( 0)   192.52.106.12-OK 
+</PRE>
+
+The TTL field shows how how many seconds until the entry expires.
+Negative values mean the entry is already expired, and will be refreshed
+upon next use.
+<P>
+<P>The <EM>negative_dns_ttl</EM> specifies how long to cache failed DNS lookups.
+When Squid fails to resolve a hostname, you can be pretty sure that
+it is a real failure, and you are not likely to get a successful
+answer within a short time period.  Squid retries its lookups 
+many times before declaring a lookup has failed.
+If you like, you can set <EM>negative_dns_ttl</EM> to zero.
+<P>
+<H2><A NAME="ss12.37">12.37 What does <EM>swapin MD5 mismatch</EM> mean?</A>
+</H2>
+
+<P>It means that Squid opened up a disk file to serve a cache hit, but
+it found that the stored object doesn't match what the user's request.
+Squid stores the MD5 digest of the URL at the start of each disk file.
+When the file is opened, Squid checks that the disk file MD5 matches the
+MD5 of the URL requested by the user.  If they don't match, the warning
+is printed and Squid forwards the request to the origin server.
+<P>You do not need to worry about this warning.  It means that Squid is 
+recovering from a corrupted cache directory.
+<P>
+<H2><A NAME="ss12.38">12.38 What does <EM>failed to unpack swapfile meta data</EM> mean?</A>
+</H2>
+
+<P>Each of Squid's disk cache files has a metadata section at the beginning.
+This header is used to store the URL MD5, some StoreEntry data, and more.
+When Squid opens a disk file for reading, it looks for the meta data
+header and unpacks it.
+<P>This warning means that Squid couln't unpack the meta data.  This is
+non-fatal bug, from which Squid can recover.  Perhaps
+the meta data was just missing, or perhaps the file got corrupted.
+<P>You do not need to worry about this warning.  It means that Squid is 
+double-checking that the disk file matches what Squid thinks should
+be there, and the check failed.  Squid recorvers and generates
+a cache miss in this case.
+<P>
+<H2><A NAME="ss12.39">12.39 Why doesn't Squid make <EM>ident</EM> lookups in interception mode?</A>
+</H2>
+
+<P>Its a side-effect of the way interception proxying works.
+<P>When Squid is configured for interception proxying, the operating system
+pretends that it is the origin server.  That means that the "local" socket
+address for intercepted TCP
+connections is really the origin server's IP address.  If you run
+<EM>netstat -n</EM> on your interception proxy, you'll see a lot of 
+foreign IP addresses in the <EM>Local Address</EM> column.
+<P>When Squid wants to make an ident query, it creates a new TCP socket
+and <EM>binds</EM> the local endpoint to the same IP address as the
+local end of the client's TCP connection.  Since the local address
+isn't really local (its some far away origin server's IP address),
+the <EM>bind()</EM> system call fails.  Squid handles this as a failed
+ident lookup.
+<P><I>So why bind in that way? If you know you are interception proxying, then why
+not bind the local endpoint to the host's (intranet) IP address? Why make
+the masses suffer needlessly?</I>
+<P>Because thats just how ident works.  
+Please read 
+<A HREF="ftp://ftp.isi.edu/in-notes/rfc931.txt">RFC 931</A>,
+in particular the RESTRICTIONS section.
+<P>
+<H2><A NAME="ss12.40">12.40 dnsSubmit: queue overload, rejecting blah</A>
+</H2>
+
+<P>This means that you are using external <EM>dnsserver</EM> processes
+for lookups, and all processes are busy, and Squid's pending queue
+is full.  Each <EM>dnsserver</EM> program can only handle one request
+at a time.  When all <EM>dnsserver</EM> processes are busy, Squid queues
+up requests, but only to a certain point.
+<P>To alleviate this condition, you need to either (1) increase the number
+of <EM>dnsserver</EM> processes by changing the value for <EM>dns_children</EM>
+in your config file, or (2) switch to using Squid's internal DNS client
+code.
+<P>Note that in some versions, Squid limits <EM>dns_children</EM> to 32.  To
+increase it beyond that value, you would have to edit the source code.
+<P>
+<H2><A NAME="ss12.41">12.41 What are FTP passive connections?</A>
+</H2>
+
+<P>by Colin Campbell
+<P>Ftp uses two data streams, one for passing commands around, the other for
+moving data. The command channel is handled by the ftpd listening on port
+21.
+<P>The data channel varies depending on whether you ask for passive ftp or
+not. When you request data in a non-passive environment, you client tells
+the server ``I am listening on &lt;ip-address&gt; &lt;port&gt;.'' The server then
+connects FROM port 20 to the ip address and port specified by your client.
+This requires your "security device" to permit any host outside from port
+20 to any host inside on any port &gt; 1023. Somewhat of a hole.
+<P>In passive mode, when you request a data transfer, the server tells the
+client ``I am listening on &lt;ip address&gt; &lt;port&gt;.'' Your client then connects
+to the server on that IP and port and data flows.
+<P>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-13.html">Next</A>
+<A HREF="FAQ-11.html">Previous</A>
+<A HREF="FAQ.html#toc12">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-13.html
+++ squid-2.5.9/debian/doc/FAQ-13.html
@@ -0,0 +1,200 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Multicast</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-14.html">Next</A>
+<A HREF="FAQ-12.html">Previous</A>
+<A HREF="FAQ.html#toc13">Contents</A>
+<HR>
+<H2><A NAME="s13">13. Multicast</A></H2>
+
+<H2><A NAME="ss13.1">13.1 What is Multicast?</A>
+</H2>
+
+<P>Multicast is essentially the ability to send one IP packet to multiple
+receivers.  Multicast is often used for audio and video conferencing systems.
+<P>
+<P>You often hear about 
+<A HREF="http://www.mbone.com/">the Mbone</A> in
+reference to Multicast.  The Mbone is essentially a ``virtual backbone''
+which exists in the Internet itself.  If you want to send and/or receive
+Multicast, you need to be ``on the Mbone.''
+<P>
+<H2><A NAME="ss13.2">13.2 How do I know if I'm on the Mbone?</A>
+</H2>
+
+<P>One way is to ask someone who manages your network.  If your network manager
+doesn't know, or looks at you funny, then you are very likely NOT on the Mbone
+<P>
+<P>Another way is to use the <EM>mtrace</EM> program, which can be found
+on the 
+<A HREF="ftp://parcftp.xerox.com/pub/net-research/ipmulti/">Xerox PARC FTP site</A>.  Mtrace is similar to traceroute.  It will
+tell you about the multicast path between your site and another.  For example:
+<PRE>
+        > mtrace mbone.ucar.edu
+        mtrace: WARNING: no multicast group specified, so no statistics printed
+        Mtrace from 128.117.64.29 to 192.172.226.25 via group 224.2.0.1
+        Querying full reverse path... * switching to hop-by-hop:
+        0  oceana-ether.nlanr.net (192.172.226.25)
+        -1  avidya-ether.nlanr.net (192.172.226.57)  DVMRP  thresh^ 1
+        -2  mbone.sdsc.edu (198.17.46.39)  DVMRP  thresh^ 1
+        -3  * nccosc-mbone.dren.net (138.18.5.224)  DVMRP  thresh^ 48
+        -4  * * FIXW-MBONE.NSN.NASA.GOV (192.203.230.243)  PIM/Special  thresh^ 64
+        -5  dec3800-2-fddi-0.SanFrancisco.mci.net (204.70.158.61)  DVMRP  thresh^ 64
+        -6  dec3800-2-fddi-0.Denver.mci.net (204.70.152.61)  DVMRP  thresh^ 1
+        -7  mbone.ucar.edu (192.52.106.7)  DVMRP  thresh^ 64
+        -8  mbone.ucar.edu (128.117.64.29)
+        Round trip time 196 ms; total ttl of 68 required.
+</PRE>
+<P>
+<P>If you think you need to be on the Mbone, this is
+<A HREF="http://www.mbone.com/mbone/how-to-join.html">how you can join</A>.
+<P>
+<H2><A NAME="ss13.3">13.3 Should I be using Multicast ICP?</A>
+</H2>
+
+<P>Short answer: No, probably not.
+<P>
+<P>Reasons why you SHOULD use Multicast:
+<OL>
+<LI>It reduces the number of times Squid calls <EM>sendto()</EM> to put a UDP
+packet onto the network.</LI>
+<LI>Its trendy and cool to use Multicast.</LI>
+</OL>
+<P>
+<P>Reasons why you SHOULD NOT use Multicast:
+<OL>
+<LI>Multicast tunnels/configurations/infrastructure are often unstable.
+You may lose multicast connectivity but still have unicast connectivity.</LI>
+<LI>Multicast does not simplify your Squid configuration file.  Every trusted
+neighbor cache must still be specified.</LI>
+<LI>Multicast does not reduce the number of ICP replies being sent around.
+It does reduce the number of ICP queries sent, but not the number of replies.</LI>
+<LI>Multicast exposes your cache to some privacy issues.  There are no special
+emissions required to join a multicast group.  Anyone may join your
+group and eavesdrop on ICP query messages.  However, the scope of your
+multicast traffic can be controlled such that it does not exceed certain
+boundaries.</LI>
+</OL>
+<P>
+<P>We only recommend people to use Multicast ICP over network
+infrastructure which they have close control over.  In other words, only
+use Multicast over your local area network, or maybe your wide area
+network if you are an ISP.  We think it is probably a bad idea to use
+Multicast ICP over congested links or commodity backbones.
+<P>
+<H2><A NAME="ss13.4">13.4 How do I configure Squid to send Multicast ICP queries?</A>
+</H2>
+
+<P>To configure Squid to send ICP queries to a Multicast address, you
+need to create another neighbour cache entry specified as <EM>multicast</EM>.
+For example:
+<PRE>
+        cache_host 224.9.9.9 multicast 3128 3130 ttl=64
+</PRE>
+
+224.9.9.9 is a sample multicast group address.
+<EM>multicast</EM> indicates that this
+is a special type of neighbour.  The HTTP-port argument (3128)
+is ignored for multicast peers, but the ICP-port (3130) is
+very important.  The final argument, <EM>ttl=64</EM>
+specifies the multicast TTL value for queries sent to this
+address.
+It is probably a good
+idea to increment the minimum TTL by a few to provide a margin
+for error and changing conditions.
+<P>
+<P>You must also specify which of your neighbours will respond
+to your multicast queries, since it would
+be a bad idea to implicitly trust any ICP reply from an unknown
+address.  Note that ICP replies are sent back to <EM>unicast</EM>
+addresses; they are NOT multicast, so Squid has no indication
+whether a reply is from a regular query or a multicast
+query.  To configure your multicast group neighbours, use the
+<EM>cache_host</EM> directive and the <EM>multicast-responder</EM>
+option:
+<PRE>
+        cache_host cache1 sibling 3128 3130 multicast-responder
+        cache_host cache2 sibling 3128 3130 multicast-responder
+</PRE>
+
+Here all fields are relevant.  The ICP port number (3130)
+must be the same as in the <EM>cache_host</EM> line defining the
+multicast peer above.  The third field must either be
+<EM>parent</EM> or <EM>sibling</EM> to indicate how Squid should treat replies.
+With the <EM>multicast-responder</EM> flag set for a peer,
+Squid will NOT send ICP queries to it directly (i.e. unicast).
+<P>
+<H2><A NAME="ss13.5">13.5 How do I know what Multicast TTL to use?</A>
+</H2>
+
+<P>The Multicast TTL (which is specified on the <EM>cache_host</EM> line
+of your multicast group) determines how ``far'' your ICP queries
+will go.  In the Mbone, there is a certain TTL threshold defined
+for each network interface or tunnel.  A multicast packet's TTL must
+be larger than the defined TTL for that packet to be forwarded across
+that link.  For example, the <EM>mrouted</EM> manual page recommends:
+<PRE>
+        32   for links that separate sites within an organization.
+        64   for links that separate communities or organizations, and are
+             attached to the Internet MBONE.
+        128  for links that separate continents on the MBONE.
+</PRE>
+<P>
+<P>A good way to determine the TTL you need is to run <EM>mtrace</EM> as shown above
+and look at the last line.  It will show you the minimum TTL required to
+reach the other host.
+<P>
+<P>If you set you TTL too high, then your ICP messages may travel ``too far''
+and will be subject to eavesdropping by others.
+If you're only using multicast on your LAN, as we suggest, then your TTL will
+be quite small, for example <EM>ttl=4</EM>.
+<P>
+<H2><A NAME="ss13.6">13.6 How do I configure Squid to receive and respond to Multicast ICP?</A>
+</H2>
+
+<P>You must tell Squid to join a multicast group address with the
+<EM>mcast_groups</EM> directive.  For example:
+<PRE>
+        mcast_groups  224.9.9.9
+</PRE>
+
+Of course, all members of your Multicast ICP group will need to use the
+exact same multicast group address.
+<P>
+<P><B>NOTE:</B> Choose a multicast group address with care!  If two organizations
+happen to choose the same multicast address, then they may find that their
+groups ``overlap'' at some point.  This will be especially true if one of the
+querying caches uses a large TTL value.  There are two ways to reduce the risk
+of group overlap:
+<OL>
+<LI>Use a unique group address</LI>
+<LI>Limit the scope of multicast messages with TTLs or administrative scoping.</LI>
+</OL>
+<P>
+<P>Using a unique address is a good idea, but not without some potential
+problems.  If you choose an address randomly, how do you know that
+someone else will not also randomly choose the same address?  NLANR
+has been assigned a block of multicast addresses by the IANA for use
+in situations such as this.  If you would like to be assigned one
+of these addresses, please 
+<A HREF="mailto:nlanr-cache@nlanr.net">write to us</A>.  However, note that NLANR or IANA have no
+authority to prevent anyone from using an address assigned to you.
+<P>
+<P>Limiting the scope of your multicast messages is probably a better
+solution.  They can be limited with the TTL value discussed above, or
+with some newer techniques known as administratively scoped
+addresses.  Here you can configure well-defined boundaries for the
+traffic to a specific address.  The
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2365.txt">Administratively Scoped IP Multicast RFC</A>
+describes this.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-14.html">Next</A>
+<A HREF="FAQ-12.html">Previous</A>
+<A HREF="FAQ.html#toc13">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-14.html
+++ squid-2.5.9/debian/doc/FAQ-14.html
@@ -0,0 +1,668 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: System-Dependent Weirdnesses</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-15.html">Next</A>
+<A HREF="FAQ-13.html">Previous</A>
+<A HREF="FAQ.html#toc14">Contents</A>
+<HR>
+<H2><A NAME="s14">14. System-Dependent Weirdnesses</A></H2>
+
+<H2><A NAME="ss14.1">14.1 Solaris</A>
+</H2>
+
+<H3>TCP incompatibility?</H3>
+
+<P>J.D. Bronson (jb at ktxg dot com) reported that his Solaris box
+could not talk to certain origin servers, such as
+<A HREF="http://moneycentral.msn.com/">moneycentral.msn.com</A>
+and 
+<A HREF="http://www.mbnanetaccess.com">www.mbnanetaccess.com</A>.
+J.D. fixed his problem by setting:
+<PRE>
+tcp_xmit_hiwat 49152
+tcp_xmit_lowat 4096
+tcp_recv_hiwat 49152
+</PRE>
+<P>
+<P>
+<H3>select()</H3>
+
+<P><EM>select(3c)</EM> won't handle more than 1024 file descriptors.  The
+<EM>configure</EM> script should enable <EM>poll()</EM> by default for
+Solaris.  <EM>poll()</EM> allows you to use many more filedescriptors,
+probably 8192 or more.
+<P>
+<P>For older Squid versions you can enable <EM>poll()</EM>
+manually by changing HAVE_POLL in <EM>include/autoconf.h</EM>, or
+by adding -DUSE_POLL=1 to the DEFINES in src/Makefile.
+<P>
+<H3>malloc</H3>
+
+<P>libmalloc.a is leaky.  Squid's configure does not use -lmalloc on Solaris.
+<P>
+<H3>DNS lookups and <EM>nscd</EM></H3>
+
+<P>by 
+<A HREF="mailto:david@avarice.nepean.uws.edu.au">David J N Begley</A>.
+<P>DNS lookups can be slow because of some mysterious thing called
+<B>ncsd</B>.  You should edit <EM>/etc/nscd.conf</EM> and make it say:
+<PRE>
+        enable-cache            hosts           no
+</PRE>
+<P>Apparently nscd serializes DNS queries thus slowing everything down when
+an application (such as Squid) hits the resolver hard.  You may notice
+something similar if you run a log processor executing many DNS resolver
+queries - the resolver starts to slow.. right.. down.. .  .   .
+<P>
+<P>According to
+<A HREF="mailto:andre at online dot ee">Andres Kroonmaa</A>,
+users of Solaris starting from version 2.6 and up should NOT
+completely disable <EM>nscd</EM> daemon. <EM>nscd</EM> should be running and
+caching passwd and group files, although it is suggested to
+disable hosts caching as it may interfere with DNS lookups.
+<P>
+<P>Several library calls rely on available free FILE descriptors
+FD &lt; 256. Systems running without nscd may fail on such calls
+if first 256 files are all in use.
+<P>
+<P>Since solaris 2.6 Sun has changed the way some system calls
+work and is using <EM>nscd</EM> daemon as a implementor of them. To
+communicate to <EM>nscd</EM> Solaris is using undocumented door calls.
+Basically <EM>nscd</EM> is used to reduce memory usage of user-space
+system libraries that use passwd and group files. Before 2.6
+Solaris cached full passwd file in library memory on the first
+use but as this was considered to use up too much ram on large
+multiuser systems Sun has decided to move implementation of
+these calls out of libraries and to a single dedicated daemon.
+<P>
+<H3>DNS lookups and <EM>/etc/nsswitch.conf</EM></H3>
+
+<P>by 
+<A HREF="mailto:ARMISTEJ@oeca.otis.com">Jason Armistead</A>.
+<P>The <EM>/etc/nsswitch.conf</EM> file determines the order of searches
+for lookups (amongst other things).  You might only have it set up to
+allow NIS and HOSTS files to work.  You definitely want the "hosts:"
+line to include the word <EM>dns</EM>, e.g.:
+<PRE>
+        hosts:      nis dns [NOTFOUND=return] files
+</PRE>
+<P>
+<H3>DNS lookups and NIS</H3>
+
+<P>by 
+<A HREF="mailto:cudch@csv.warwick.ac.uk">Chris Tilbury</A>.
+<P>
+<P>Our site cache is running on a Solaris 2.6 machine. We use NIS to distribute
+authentication and local hosts information around and in common with our
+multiuser systems, we run a slave NIS server on it to help the response of
+NIS queries.
+<P>
+<P>We were seeing very high name-ip lookup times (avg ~2sec)
+and ip->name lookup times (avg ~8 sec), although there didn't
+seem to be that much of a problem with response times for valid
+sites until the cache was being placed under high load. Then,
+performance went down the toilet.
+<P>
+<P>After some time, and a bit of detective work, we found the problem.
+On Solaris 2.6, if you have a local NIS server running (<EM>ypserv</EM>)
+and you have NIS in your <EM>/etc/nsswitch.conf</EM> hosts entry,
+then check the flags it is being started with. The 2.6 ypstart
+script checks to see if there is a <EM>resolv.conf</EM> file present
+when it starts ypserv. If there is, then it starts it with the
+<EM>-d</EM> option.
+<P>
+<P>This has the same effect as putting the <EM>YP_INTERDOMAIN</EM> key in
+the hosts table -- namely, that failed NIS host lookups are tried
+against the DNS by the NIS server.
+<P>
+<P>This is a <B>bad thing(tm)</B>! If NIS itself tries to resolve names
+using the DNS, then the requests are serialised through the NIS
+server, creating a bottleneck (This is the same basic problem that
+is seen with <EM>nscd</EM>). Thus, one failing or slow lookup can, if
+you have NIS before DNS in the service switch file (which is the
+most common setup), hold up every other lookup taking place.
+<P>
+<P>If you're running in this kind of setup, then you will want to make
+sure that
+<P>
+<OL>
+<LI>ypserv doesn't start with the <EM>-d</EM> flag.</LI>
+<LI>you don't have the <EM>YP_INTERDOMAIN</EM> key in the hosts table
+(find the <EM>B=-b</EM> line in the yp Makefile and change it to <EM>B=</EM>)</LI>
+</OL>
+<P>
+<P>We changed these here, and saw our average lookup times drop by up
+to an order of magnitude (~150msec for name-ip queries and
+~1.5sec for ip-name queries, the latter still so high, I
+suspect, because more of these fail and timeout since they are not
+made so often and the entries are frequently non-existent anyway).
+<P>
+<H3>Tuning</H3>
+
+<P>
+<A HREF="http://www.rvs.uni-hannover.de/people/voeckler/tune/EN/tune.html">Solaris 2.x - tuning your TCP/IP stack and more</A> by 
+<A HREF="http://www.rvs.uni-hannover.de/people/voeckler/">Jens-S. Vckler</A><P>
+<H3>disk write error: (28) No space left on device</H3>
+
+<P>You might get this error even if your disk is not full, and is not out
+of inodes.  Check your syslog logs (/var/adm/messages, normally) for
+messages like either of these:
+<PRE>
+        NOTICE: realloccg /proxy/cache: file system full
+        NOTICE: alloc: /proxy/cache: file system full
+</PRE>
+<P>
+<P>In a nutshell, the UFS filesystem used by Solaris can't cope with the
+workload squid presents to it very well.  The filesystem will end up
+becoming highly fragmented, until it reaches a point where there are
+insufficient free blocks left to create files with, and only fragments
+available.  At this point, you'll get this error and squid will revise
+its idea of how much space is actually available to it.  You can do a
+"fsck -n raw_device" (no need to unmount, this checks in read only mode)
+to look at the fragmentation level of the filesystem.  It will probably
+be quite high (>15%).
+<P>
+<P>Sun suggest two solutions to this problem. One costs money, the other is
+free but may result in a loss of performance (although Sun do claim it
+shouldn't, given the already highly random nature of squid disk access).
+<P>
+<P>The first is to buy a copy of VxFS, the Veritas Filesystem. This is an
+extent-based filesystem and it's capable of having online defragmentation
+performed on mounted filesystems. This costs money, however (VxFS is not
+very cheap!)
+<P>
+<P>The second is to change certain parameters of the UFS filesystem. Unmount
+your cache filesystems and use tunefs to change optimization to "space" and
+to reduce the "minfree" value to 3-5% (under Solaris 2.6 and higher, very
+large filesystems will almost certainly have a minfree of 2% already and you
+shouldn't increase this). You should be able to get fragmentation down to
+around 3% by doing this, with an accompanied increase in the amount of space
+available.
+<P>
+<P>Thanks to 
+<A HREF="mailto:cudch@csv.warwick.ac.uk">Chris Tilbury</A>.
+<P>
+<H3>Solaris X86 and IPFilter</H3>
+
+<P>by 
+<A HREF="mailto:jeff@sisna.com">Jeff Madison</A><P>Important update regarding Squid running on Solaris x86.  I have been
+working for several months to resolve what appeared to be a memory leak in
+squid when running on Solaris x86 regardless of the malloc that was used.  I
+have made 2 discoveries that anyone running Squid on this platform may be
+interested in.
+<P>Number 1: There is not a memory leak in Squid even though after the system
+runs for some amount of time, this varies depending on the load the system
+is under, Top reports that there is very little memory free.  True to the
+claims of the Sun engineer I spoke to this statistic from Top is incorrect.
+The odd thing is that you do begin to see performance suffer substantially
+as time goes on and the only way to correct the situation is to reboot the
+system.  This leads me to discovery number 2.
+<P>Number 2:  There is some type of resource problem, memory or other, with
+IPFilter on Solaris x86.  I have not taken the time to investigate what the
+problem is because we no longer are using IPFilter.  We have switched to a
+Alteon ACE 180 Gigabit switch which will do the trans-proxy for you.  After
+moving the trans-proxy, redirection process out to the Alteon switch Squid
+has run for 3 days strait under a huge load with no problem what so ever.
+We currently have 2 boxes with 40 GB of cached objects on each box.  This 40
+GB was accumulated in the 3 days,  from this you can see what type of load
+these boxes are under.  Prior to this change we were never able to operate
+for more than 4 hours.
+<P>Because the problem appears to be with IPFilter  I would guess that you
+would only run into this issue if you are trying to run Squid as a
+interception proxy using IPFilter.  That makes sense.  If there is anyone
+with information that would indicate my finding are incorrect  I am willing
+to investigate further.
+<P>
+<H3>Changing the directory lookup cache size</H3>
+
+<P>by 
+<A HREF="mailto:mbatchelor@citysearch.com">Mike Batchelor</A><P>On Solaris, the kernel variable for the directory name lookup cache size is
+<EM>ncsize</EM>.  In <EM>/etc/system</EM>, you might want to try
+<PRE>
+        set ncsize = 8192
+</PRE>
+
+or even
+higher.  The kernel variable <EM>ufs_inode</EM> - which is the size of the inode
+cache itself - scales with <EM>ncsize</EM> in Solaris 2.5.1 and later.  Previous
+versions of Solaris required both to be adjusted independently, but now, it is
+not recommended to adjust <EM>ufs_inode</EM> directly on 2.5.1 and later.
+<P>You can set <EM>ncsize</EM> quite high, but at some point - dependent on the
+application - a too-large <EM>ncsize</EM> will increase the latency of lookups.
+<P>Defaults are:
+<PRE>
+        Solaris 2.5.1 : (max_nprocs + 16 + maxusers) + 64
+        Solaris 2.6/Solaris 7 : 4 * (max_nprocs + maxusers) + 320
+</PRE>
+<P>
+<H3>The priority_paging algorithm</H3>
+
+<P>by 
+<A HREF="mailto:mbatchelor@citysearch.com">Mike Batchelor</A><P>Another new tuneable (actually a toggle) in Solaris 2.5.1, 2.6 or Solaris 7 is
+the <EM>priority_paging</EM> algorithm.  This is actually a complete rewrite of the
+virtual memory system on Solaris.  It will page out application data last, and
+filesystem pages first, if you turn it on (set <EM>priority_paging</EM> = 1 in
+<EM>/etc/system</EM>).  As you may know, the Solaris buffer cache grows to fill
+available pages, and under the old VM system, applications could get paged out
+to make way for the buffer cache, which can lead to swap thrashing and
+degraded application performance.  The new <EM>priority_paging</EM> helps keep
+application and shared library pages in memory, preventing the buffer cache
+from paging them out, until memory gets REALLY short.  Solaris 2.5.1 requires
+patch 103640-25 or higher and Solaris 2.6 requires 105181-10 or higher to get
+priority_paging.  Solaris 7 needs no patch, but all versions have it turned
+off by default.
+<P>
+<H2><A NAME="ss14.2">14.2 FreeBSD</A>
+</H2>
+
+<H3>T/TCP bugs</H3>
+
+<P>We have found that with FreeBSD-2.2.2-RELEASE, there some bugs with T/TCP. FreeBSD will
+try to use T/TCP if you've enabled the ``TCP Extensions.''  To disable T/TCP,
+use <EM>sysinstall</EM> to disable TCP Extensions,
+or edit <EM>/etc/rc.conf</EM> and set
+<PRE>
+        tcp_extensions="NO"             # Allow RFC1323 &amp; RFC1544 extensions (or NO).
+</PRE>
+
+or add this to your /etc/rc files:
+<PRE>
+        sysctl -w net.inet.tcp.rfc1644=0
+</PRE>
+<P>
+<H3>mbuf size</H3>
+
+<P>We noticed an odd thing with some of Squid's interprocess communication.
+Often, output from the <EM>dnsserver</EM> processes would NOT be read in
+one chunk.  With full debugging, it looks like this:
+<P>
+<PRE>
+1998/04/02 15:18:48| comm_select: FD 46 ready for reading
+1998/04/02 15:18:48| ipcache_dnsHandleRead: Result from DNS ID 2 (100 bytes)
+1998/04/02 15:18:48| ipcache_dnsHandleRead: Incomplete reply
+....other processing occurs...
+1998/04/02 15:18:48| comm_select: FD 46 ready for reading
+1998/04/02 15:18:48| ipcache_dnsHandleRead: Result from DNS ID 2 (9 bytes)
+1998/04/02 15:18:48| ipcache_parsebuffer: parsing:
+$name www.karup.com
+$h_name www.karup.inter.net
+$h_len 4
+$ipcount 2
+38.15.68.128
+38.15.67.128
+$ttl 2348
+$end
+</PRE>
+<P>Interestingly, it is very common to get only 100 bytes on the first
+read.  When two read() calls are required, this adds additional latency
+to the overall request.  On our caches running Digital Unix, the median
+<EM>dnsserver</EM> response time was measured at 0.01 seconds.  On our
+FreeBSD cache, however, the median latency was 0.10 seconds.
+<P>
+<P>Here is a simple patch to fix the bug:
+<PRE>
+===================================================================
+RCS file: /home/ncvs/src/sys/kern/uipc_socket.c,v
+retrieving revision 1.40
+retrieving revision 1.41
+diff -p -u -r1.40 -r1.41
+--- src/sys/kern/uipc_socket.c  1998/05/15 20:11:30     1.40
++++ /home/ncvs/src/sys/kern/uipc_socket.c       1998/07/06 19:27:14     1.41
+@@ -31,7 +31,7 @@
+  * SUCH DAMAGE.
+  *
+  *     @(#)uipc_socket.c       8.3 (Berkeley) 4/15/94
+- *     $Id: FAQ.sgml,v 1.167 2003/03/11 17:48:54 wessels Exp $
++ *     $Id: FAQ.sgml,v 1.167 2003/03/11 17:48:54 wessels Exp $
+  */
+
+ #include &lt;sys/param.h>
+@@ -491,6 +491,7 @@ restart:
+                                mlen = MCLBYTES;
+                                len = min(min(mlen, resid), space);
+                        } else {
++                               atomic = 1;
+ nopages:
+                                len = min(min(mlen, resid), space);
+                                /*
+</PRE>
+<P>
+<P>
+<P>Another technique which may help, but does not fix the bug, is to
+increase the kernel's mbuf size.
+The default is 128 bytes.  The MSIZE symbol is defined in
+<EM>/usr/include/machine/param.h</EM>.  However, to change it we added
+this line to our kernel configuration file:
+<PRE>
+        options         MSIZE="256"
+</PRE>
+<P>
+<H3>Dealing with NIS</H3>
+
+<P><EM>/var/yp/Makefile</EM> has the following section:
+<PRE>
+        # The following line encodes the YP_INTERDOMAIN key into the hosts.byname
+        # and hosts.byaddr maps so that ypserv(8) will do DNS lookups to resolve
+        # hosts not in the current domain. Commenting this line out will disable
+        # the DNS lookups.
+        B=-b
+</PRE>
+
+You will want to comment out the <EM>B=-b</EM> line so that <EM>ypserv</EM> does not
+do DNS lookups.
+<P>
+<H3><A NAME="freebsd-no-lo0"></A> FreeBSD 3.3: The lo0 (loop-back) device is not configured on startup</H3>
+
+<P>Squid requires a the loopback interface to be up and configured.  If it is not, you will
+get errors such as 
+<A HREF="FAQ-11.html#comm-bind-loopback-fail">commBind</A>.
+<P>From 
+<A HREF="http://www.freebsd.org/releases/3.3R/errata.html">FreeBSD 3.3 Errata Notes</A>:
+<P>
+<BLOCKQUOTE>
+Fix: Assuming that you experience this problem at all, edit <EM>/etc/rc.conf</EM>
+and search for where the network_interfaces variable is set.  In
+its value, change the word <EM>auto</EM> to <EM>lo0</EM> since the auto keyword
+doesn't bring the loop-back device up properly, for reasons yet to
+be adequately determined.  Since your other interface(s) will already
+be set in the network_interfaces variable after initial installation,
+it's reasonable to simply s/auto/lo0/ in rc.conf and move on.
+</BLOCKQUOTE>
+<P>Thanks to 
+<A HREF="mailto:robl at lentil dot org">Robert Lister</A>.
+<P>
+<P>
+<H3><A NAME="freebsd-softupdates"></A> FreeBSD 3.x or newer: Speed up disk writes using Softupdates</H3>
+
+<P>by 
+<A HREF="mailto:andre.albsmeier@mchp.siemens.de">Andre Albsmeier</A><P>
+<P>FreeBSD 3.x and newer support Softupdates. This is a mechanism to
+speed up disk writes as it is possible by mounting ufs volumes
+async. However, Softupdates does this in a way that a performance
+similar or better than async is achieved but without loosing security
+in a case of a system crash. For more detailed information and the
+copyright terms see <EM>/sys/contrib/softupdates/README</EM> and
+<EM>/sys/ufs/ffs/README.softupdate</EM>.
+<P>
+<P>To build a system supporting softupdates, you have to build
+a kernel with <CODE>options SOFTUPDATES</CODE> set (see <EM>LINT</EM> for a commented
+out example). After rebooting with the new kernel, you can enable
+softupdates on a per filesystem base with the command:
+<PRE>
+        $ tunefs -n /mountpoint
+</PRE>
+
+The filesystem in question MUST NOT be mounted at
+this time. After that, softupdates are permanently enabled and the
+filesystem can be mounted normally. To verify that the softupdates
+code is running, simply issue a mount command and an output similar
+to the following will appear:
+<PRE>
+        $ mount
+        /dev/da2a on /usr/local/squid/cache (ufs, local, noatime, soft-updates, writes: sync 70 async 225)
+</PRE>
+<P>
+<H3>Internal DNS problems with jail environment</H3>
+
+<P>Some users report problems with running Squid in the jail environment.  Specifically,
+Squid logs messages like:
+<PRE>
+2001/10/12 02:08:49| comm_udp_sendto: FD 4, 192.168.1.3, port 53: (22) Invalid argument
+2001/10/12 02:08:49| idnsSendQuery: FD 4: sendto: (22) Invalid argument
+</PRE>
+<P>You can eliminate the problem by putting the jail's network interface
+address in the 'udp_outgoing_addr' configuration option
+in <EM>squid.conf</EM>.
+<P>
+<H2><A NAME="ss14.3">14.3 OSF1/3.2</A>
+</H2>
+
+<P>If you compile both libgnumalloc.a and Squid with <EM>cc</EM>, the <EM>mstats()</EM>
+function returns bogus values.  However, if you compile libgnumalloc.a with
+<EM>gcc</EM>, and Squid with <EM>cc</EM>, the values are correct.
+<P>
+<H2><A NAME="ss14.4">14.4 BSD/OS</A>
+</H2>
+
+<H3>gcc/yacc</H3>
+
+<P>Some people report
+<A HREF="FAQ-2.html#bsdi-compile">difficulties compiling squid on BSD/OS</A>.
+<P>
+<H3>process priority</H3>
+
+<P><I>I've noticed that my Squid process
+seems to stick at a nice value of four, and clicks back to that even
+after I renice it to a higher priority.  However, looking through the
+Squid source, I can't find any instance of a setpriority() call, or
+anything else that would seem to indicate Squid's adjusting its own
+priority.</I>
+<P>by 
+<A HREF="mailto:bogstad@pobox.com">Bill Bogstad</A><P>BSD Unices traditionally have auto-niced non-root processes to 4 after
+they used alot (4 minutes???) of CPU time.  My guess is that it's the BSD/OS
+not Squid that is doing this.  I don't know offhand if there is a way to
+disable this on BSD/OS.
+<P>by 
+<A HREF="mailto:Arjan.deVet@adv.iae.nl">Arjan de Vet</A><P>You can get around this by
+starting Squid with nice-level -4 (or another negative value).
+<P>by 
+<A HREF="mailto:bert_driehuis at nl dot compuware dot com">Bert Driehuis</A><P>The autonice behavior is a leftover from the history of BSD as a
+university OS. It penalises CPU bound jobs by nicing them after using 600
+CPU seconds.
+Adding
+<PRE>
+        sysctl -w kern.autonicetime=0
+</PRE>
+
+to <EM>/etc/rc.local</EM> will disable the behavior systemwide.
+<P>
+<P>
+<P>
+<H2><A NAME="ss14.5">14.5 Linux</A>
+</H2>
+
+<H3>Cannot bind socket FD 5 to 127.0.0.1:0: (49) Can't assign requested address</H3>
+
+<P>Try a different version of Linux.  We have received many reports of this
+``bug'' from people running Linux 2.0.30.  The <EM>bind(2)</EM> system
+call should NEVER give this error when binding to port 0.
+<P>
+<H3>FATAL: Don't run Squid as root, set 'cache_effective_user'!</H3>
+
+<P>Some users have reported that setting <CODE>cache_effective_user</CODE>
+to <CODE>nobody</CODE> under Linux does not work.
+However, it appears that using any <CODE>cache_effective_user</CODE> other
+than <CODE>nobody</CODE> will succeed.  One solution is to create a
+user account for Squid and set <CODE>cache_effective_user</CODE> to that.
+Alternately you can change the UID for the <CODE>nobody</CODE> account
+from 65535 to 65534.
+<P>Another problem is that RedHat 5.0 Linux seems to have a broken
+<EM>setresuid()</EM> function.  There are two ways to fix this.
+Before running configure:
+<PRE>
+        % setenv ac_cv_func_setresuid no
+        % ./configure ...
+        % make clean
+        % make install
+</PRE>
+
+Or after running configure, manually edit include/autoconf.h and
+change the HAVE_SETRESUID line to:
+<PRE>
+        #define HAVE_SETRESUID 0
+</PRE>
+<P>
+<P>Also, some users report this error is due to a NIS configuration
+problem.  By adding <EM>compat</EM> to the <EM>passwd</EM> and <EM>group</EM>
+lines of <EM>/etc/nsswitch.conf</EM>, the problem goes away.
+(
+<A HREF="mailto:acli@ada.ddns.org">Ambrose Li</A>).
+<P>
+<P>
+<A HREF="mailto:galifrey@crown.net">Russ Mellon</A> notes
+that these problems with <EM>cache_effective_user</EM> are fixed in
+version 2.2.x of the Linux kernel.
+<P>
+<H3>Large ACL lists make Squid slow</H3>
+
+<P>The regular expression library which comes with Linux is known
+to be very slow.  Some people report it entirely fails to work
+after long periods of time.
+<P>
+<P>To fix, use the GNUregex library included with the Squid source code.
+With Squid-2, use the <EM>--enable-gnuregex</EM> configure option.
+<P>
+<H3>gethostbyname() leaks memory in RedHat 6.0 with glibc 2.1.1.</H3>
+
+<P>by 
+<A HREF="mailto:radu at netsoft dot ro">Radu Greab</A><P>The gethostbyname() function leaks memory in RedHat
+6.0 with glibc 2.1.1. The quick fix is to delete nisplus service from
+hosts entry in <EM>/etc/nsswitch.conf</EM>. In my tests dnsserver memory use
+remained stable after I made the above change.
+<P>
+<P>See 
+<A HREF="http://developer.redhat.com/bugzilla/show_bug.cgi?id=3919">RedHat bug id 3919</A>.
+<P>
+<H3>assertion failed: StatHist.c:91: `statHistBin(H, max) == H->capacity - 1' on Alpha system.</H3>
+
+<P>by 
+<A HREF="mailto:jraymond@gnu.org">Jamie Raymond</A><P>Some early versions of Linux have a kernel bug that causes this.
+All that is needed is a recent kernel that doesn't have the mentioned bug.
+<P>
+<H3>tools.c:605: storage size of `rl' isn't known</H3>
+
+<P>This is a bug with some versions of glibc.  The glibc headers
+incorrectly depended on the contents of some kernel headers.
+Everything broke down when the kernel folks rearranged a bit in
+the kernel-specific header files.
+<P>We think this glibc bug is present in versions
+2.1.1 (or 2.1.0) and earlier.   There are two solutions:
+<OL>
+<LI>Make sure /usr/include/linux and /usr/include/asm are from the kernel
+version glibc is build/configured for, not any other kernel version.
+Only compiling of loadable kernel modules outside of the kernel sources
+depends on having the current versions of these, and for such builds
+-I/usr/src/linux/include (or where ever the new kernel headers are
+located) can be used to resolve the matter.
+</LI>
+<LI>Upgrade glibc to 2.1.2 or later. This is always a good idea anyway,
+provided a prebuilt upgrade package exists for the Linux distribution
+used.. Note: Do not attempt to manually build and install glibc from
+source unless you know exactly what you are doing, as this can easily
+render the system unuseable.</LI>
+</OL>
+<P>
+<H3>Can't connect to some sites through Squid</H3>
+
+<P>When using Squid, some sites may give erorrs such as
+``(111) Connection refused'' or ``(110) Connection timed out''
+although these sites work fine without going through Squid.
+<P>Some versions of linux implement 
+<A HREF="http://www.aciri.org/floyd/ecn.html">Explicit Congestion Notification</A> (ECN) and this can cause
+some TCP connections to fail when contacting some sites with broken firewalls
+or broken TCP/IP implementations.
+<P>To work around such broken sites you can disable ECN with
+the following command:
+<PRE>
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+</PRE>
+<P>Found this on the FreeBSD mailing list:
+<BLOCKQUOTE>
+<P>From: Robert Watson
+<P>As Bill Fumerola has indicated, and I thought I'd follow up in with a bit
+more detail, the behavior you're seeing is the result of a bug in the
+FreeBSD IPFW code.  FreeBSD did a direct comparison of the TCP header flag
+field with an internal field in the IPFW rule description structure.
+Unfortunately, at some point, someone decided to overload the IPFW rule
+description structure field to add a flag representing "ESTABLISHED". They
+used a flag value that was previously unused by the TCP protocol (which
+doesn't make it safer, just less noticeable).  Later, when that flag was
+allocated for ECN (Endpoint Congestion Notification) in TCP, and Linux
+began using ECN by default, the packets began to match ESTABLISHED rules
+regardless of the other TCP header flags.  This bug was corrected on the
+RELENG_4 branch, and security advisory for the bug was released.  This
+was, needless to say, a pretty serious bug, and good example of why you
+should be very careful to compare only the bits you really mean to, and
+should seperate packet state from protocol state in management structures,
+as well as make use of extensive testing to make sure rules actually have
+the effect you describe.
+</BLOCKQUOTE>
+<P>See also the 
+<A HREF="http://answerpointe.cctec.com/maillists/nanog/historical/0104/msg00714.html">thread on the NANOG mailing list</A>,
+<A HREF="ftp://ftp.isi.edu/in-notes/rfc3168.txt">RFC3168 &quot;The Addition of Explicit Congestion Notification (ECN) to IP, PROPOSED STANDARD&quot;</A>
+or 
+<A HREF="http://www.aciri.org/floyd/ecn.html">Sally Floyd's page on ECN and problems related to it</A><P>
+<P>
+<P>
+<H2><A NAME="ss14.6">14.6 HP-UX</A>
+</H2>
+
+<H3>StatHist.c:74: failed assertion `statHistBin(H, min) == 0'</H3>
+
+<P>This was a very mysterious and unexplainable bug with GCC on HP-UX.
+Certain functions, when specified as <EM>static</EM>, would cause
+math bugs.  The compiler also failed to handle implied
+int-double conversions properly.  These bugs should all be
+handled correctly in Squid version 2.2.
+<P>
+<H2><A NAME="ss14.7">14.7 IRIX</A>
+</H2>
+
+<H3><EM>dnsserver</EM> always returns 255.255.255.255</H3>
+
+<P>There is a problem with GCC (2.8.1 at least) on
+Irix 6 which causes it to always return the string 255.255.255.255 for _ANY_
+address when calling inet_ntoa().  If this happens to you, compile Squid
+with the native C compiler instead of GCC.
+<P>
+<H2><A NAME="ss14.8">14.8 SCO-UNIX</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:f.j.bosscha@nhl.nl">F.J. Bosscha</A><P>To make squid run comfortable on SCO-unix you need to do the following:
+<P>Increase the <EM>NOFILES</EM> paramater and the <EM>NUMSP</EM> parameter and compile squid
+with I had, although squid told in the cache.log file he had 3000
+filedescriptors, problems with the messages that there were no
+filedescriptors more available.  After I increase also the NUMSP value
+the problems were gone.
+<P>
+<P>One thing left is the number of tcp-connections the system can handle.
+Default is 256, but I increase that as well because of the number of
+clients we have.
+<P>
+<H2><A NAME="ss14.9">14.9 AIX</A>
+</H2>
+
+<H3>"shmat failed" errors with <EM>diskd</EM></H3>
+
+<P>32-bit processes on AIX and later are restricted by default to a maximum 
+of 11 shared memory segments. This restriction can be removed on AIX 4.2.1
+and later by setting the environment variable <CODE>EXTSHM=ON</CODE> in the script or
+shell which starts squid.
+<P>
+<H3>Core dumps when squid process grows to 256MB</H3>
+
+<P>32-bit processes cannot use more than 256MB of stack and data in the default 
+memory model. To force the loader to use large address space for squid, 
+either:
+<UL>
+<LI>set the <CODE>LDR_CNTRL</CODE> environment variable,
+eg <CODE>LDR_CNTRL="MAXDATA=0x80000000"</CODE>; or</LI>
+<LI>link with <CODE>-bmaxdata:0x80000000</CODE>; or</LI>
+<LI>patch the squid binary</LI>
+</UL>
+
+See 
+<A HREF="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixprggd/genprogc/lrg_prg_support.htm">IBM's documentation</A> on large program support for more information,
+including how to patch an already-compiled program.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-15.html">Next</A>
+<A HREF="FAQ-13.html">Previous</A>
+<A HREF="FAQ.html#toc14">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-15.html
+++ squid-2.5.9/debian/doc/FAQ-15.html
@@ -0,0 +1,140 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Redirectors</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-16.html">Next</A>
+<A HREF="FAQ-14.html">Previous</A>
+<A HREF="FAQ.html#toc15">Contents</A>
+<HR>
+<H2><A NAME="s15">15. Redirectors</A></H2>
+
+<H2><A NAME="ss15.1">15.1 What is a redirector?</A>
+</H2>
+
+<P>Squid has the ability to rewrite requested URLs.  Implemented
+as an external process (similar to a dnsserver), Squid can be
+configured to pass every incoming URL through a <EM>redirector</EM> process
+that returns either a new URL, or a blank line to indicate no change.
+<P>
+<P>The <EM>redirector</EM> program is <B>NOT</B> a standard part of the Squid
+package.  However, some examples are provided below, and in the
+"contrib/" directory of the source distribution.  Since everyone has
+different needs, it is up to the individual administrators to write
+their own implementation.
+<P>
+<H2><A NAME="ss15.2">15.2 Why use a redirector?</A>
+</H2>
+
+<P>A redirector allows the administrator to control the locations to which
+his users goto.  Using this in conjunction with interception proxies
+allows simple but effective porn control.
+<P>
+<H2><A NAME="ss15.3">15.3 How does it work?</A>
+</H2>
+
+<P>The redirector program must read URLs (one per line) on standard input,
+and write rewritten URLs or blank lines on standard output.  Note that
+the redirector program can not use buffered I/O.  Squid writes
+additional information after the URL which a redirector can use to make
+a decision.  The input line consists of four fields:
+<PRE>
+        URL ip-address/fqdn ident method
+</PRE>
+<P>
+<P>
+<P>Do you have any examples?
+<P>
+<P>A simple very fast redirector called 
+<A HREF="http://www.senet.com.au/squirm/">SQUIRM</A> is a good place to
+start, it uses the regex lib to allow pattern matching.
+<P>
+<P>Also see 
+<A HREF="http://ivs.cs.uni-magdeburg.de/%7eelkner/webtools/jesred/">jesred</A>.
+<P>
+<P>The following Perl script may also be used as a template for writing
+your own redirector:
+<PRE>
+        #!/usr/local/bin/perl
+        $|=1;
+        while (&lt;>) {
+                s@http://fromhost.com@http://tohost.org@;
+                print;
+        }
+</PRE>
+<P>
+<P>
+<H2><A NAME="ss15.4">15.4 Can I use the redirector to return HTTP redirect messages?</A>
+</H2>
+
+<P>Normally, the <EM>redirector</EM> feature is used to rewrite requested URLs.
+Squid then transparently requests the new URL.  However, in some situations,
+it may be desirable to return an HTTP "301" or "302" redirect message
+to the client.  This is now possible with Squid version 1.1.19.
+<P>
+<P>Simply modify your redirector program to prepend either "301:" or "302:"
+before the new URL.  For example, the following script might be used
+to direct external clients to a secure Web server for internal documents:
+<PRE>
+#!/usr/local/bin/perl
+$|=1;
+        while (&lt;>) {
+                @X = split;
+                $url = $X[0];
+                if ($url =~ /^http:\/\/internal\.foo\.com/) {
+                        $url =~ s/^http/https/;
+                        $url =~ s/internal/secure/;
+                        print "302:$url\n";
+                } else {
+                        print "$url\n";
+                }
+        }
+</PRE>
+<P>
+<P>Please see sections 10.3.2 and 10.3.3 of
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2068.txt">RFC 2068</A>
+for an explanation of the 301 and 302 HTTP reply codes.
+<P>
+<H2><A NAME="redirectors-exit"></A> <A NAME="ss15.5">15.5 FATAL: All redirectors have exited!</A>
+</H2>
+
+<P>A redirector process must <B>never</B> exit (stop running).  If you see
+the ``All redirectories have exited'' message, it probably means your
+redirector program has a bug.  Maybe it runs out of memory or has memory
+access errors.  You may want to test your redirector program outside of
+squid with a big input list, taken from your <EM>access.log</EM> perhaps.
+Also, check for 
+<A HREF="FAQ-11.html#coredumps">coredump</A> files from the redirector program.
+<P>
+<H2><A NAME="ss15.6">15.6 Redirector interface is broken re IDENT values</A>
+</H2>
+
+<P><I>I added a redirctor consisting of</I>
+<PRE>
+#! /bin/sh
+/usr/bin/tee /tmp/squid.log
+</PRE>
+
+<I>and many of the redirector requests don't have a username in the
+ident field.</I>
+<P>
+<P>Squid does not delay a request to wait for an ident lookup,
+unless you use the ident ACLs.  Thus, it is very likely that
+the ident was not available at the time of calling the redirector,
+but became available by the time the request is complete and
+logged to access.log.
+<P>If you want to block requests waiting for ident lookup, try something
+like this:
+<PRE>
+acl foo ident REQUIRED
+http_access allow foo
+</PRE>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-16.html">Next</A>
+<A HREF="FAQ-14.html">Previous</A>
+<A HREF="FAQ.html#toc15">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-16.html
+++ squid-2.5.9/debian/doc/FAQ-16.html
@@ -0,0 +1,647 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Cache Digests</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-17.html">Next</A>
+<A HREF="FAQ-15.html">Previous</A>
+<A HREF="FAQ.html#toc16">Contents</A>
+<HR>
+<H2><A NAME="cache-digests"></A> <A NAME="s16">16. Cache Digests</A></H2>
+
+<P><EM>Cache Digest FAQs compiled by
+<A HREF="mailto:ndoherty@eei.ericsson.se">Niall Doherty</A>.</EM>
+<P>
+<H2><A NAME="ss16.1">16.1 What is a Cache Digest?</A>
+</H2>
+
+<P>A Cache Digest is a summary of the contents of an Internet Object Caching
+Server.
+It contains, in a compact (i.e. compressed) format, an indication of whether
+or not particular URLs are in the cache.
+<P>
+<P>A "lossy" technique is used for compression, which means that very high
+compression factors can be achieved at the expense of not having 100%
+correct information.
+<P>
+<P>
+<H2><A NAME="ss16.2">16.2 How and why are they used?</A>
+</H2>
+
+<P>Cache servers periodically exchange their digests with each other.
+<P>
+<P>When a request for an object (URL) is received from a client a cache
+can use digests from its peers to find out which of its peers (if any)
+have that object.
+The cache can then request the object from the closest peer (Squid
+uses the NetDB database to determine this).
+<P>
+<P>Note that Squid will only make digest queries in those digests that are
+<EM>enabled</EM>.
+It will disable a peers digest IFF it cannot fetch a valid digest
+for that peer.
+It will enable that peers digest again when a valid one is fetched.
+<P>
+<P>The checks in the digest are very fast and they eliminate the need
+for per-request queries to peers. Hence:
+<P>
+<P>
+<UL>
+<LI>Latency is eliminated and client response time should be improved.</LI>
+<LI>Network utilisation may be improved.</LI>
+</UL>
+<P>
+<P>Note that the use of Cache Digests (for querying the cache contents of peers)
+and the generation of a Cache Digest (for retrieval by peers) are independent.
+So, it is possible for a cache to make a digest available for peers, and not
+use the functionality itself and vice versa.
+<P>
+<P>
+<H2><A NAME="ss16.3">16.3 What is the theory behind Cache Digests?</A>
+</H2>
+
+<P>Cache Digests are based on Bloom Filters - they are a method for
+representing a set of keys with lookup capabilities;
+where lookup means "is the key in the filter or not?".
+<P>
+<P>In building a cache digest:
+<P>
+<P>
+<UL>
+<LI> A vector (1-dimensional array) of m bits is allocated, with all
+bits initially set to 0.</LI>
+<LI> A number, k, of independent hash functions are chosen, h1, h2,
+..., hk, with range { 1, ..., m }
+(i.e. a key hashed with any of these functions gives a value between 1
+and m inclusive).</LI>
+<LI> The set of n keys to be operated on are denoted by:
+A = { a1, a2, a3, ..., an }.</LI>
+</UL>
+<P>
+<P>
+<H3>Adding a Key</H3>
+
+<P>To add a key the value of each hash function for that key is calculated.
+So, if the key was denoted by <EM>a</EM>, then h1(a), h2(a), ...,
+hk(a) are calculated.
+<P>
+<P>The value of each hash function for that key represents an index into
+the array and the corresponding bits are set to 1. So, a digest with
+6 hash functions would have 6 bits to be set to 1 for each key added.
+<P>
+<P>Note that the addition of a number of <EM>different</EM> keys could
+cause one particular bit to be set to 1 multiple times.
+<P>
+<P>
+<H3>Querying a Key</H3>
+
+<P>To query for the existence of a key the indices into the array are
+calculated from the hash functions as above.
+<P>
+<P>
+<UL>
+<LI> If any of the corresponding bits in the array are 0 then the key is
+not present.</LI>
+<LI> If all of the corresponding bits in the array are 1 then the key is
+<EM>likely</EM> to be present.</LI>
+</UL>
+<P>
+<P>Note the term <EM>likely</EM>.
+It is possible that a <EM>collision</EM> in the digest can occur, whereby
+the digest incorrectly indicates a key is present.
+This is the price paid for the compact representation.
+While the probability of a collision can never be reduced to zero it can
+be controlled.
+Larger values for the ratio of the digest size to the number of entries added
+lower the probability.
+The number of hash functions chosen also influence the probability.
+<P>
+<P>
+<H3>Deleting a Key</H3>
+
+<P>
+<P>To delete a key, it is not possible to simply set the associated bits
+to 0 since any one of those bits could have been set to 1 by the addition
+of a different key!
+<P>
+<P>Therefore, to support deletions a counter is required for each bit position
+in the array.
+The procedures to follow would be:
+<P>
+<P>
+<UL>
+<LI> When adding a key, set appropriate bits to 1 and increment the
+corresponding counters.</LI>
+<LI> When deleting a key, decrement the appropriate counters (while > 0),
+and if a counter reaches 0 <EM>then</EM> the corresponding bit is set to 0.</LI>
+</UL>
+<P>
+<P>
+<H2><A NAME="ss16.4">16.4 How is the size of the Cache Digest in Squid determined?</A>
+</H2>
+
+<P>Upon initialisation, the <EM>capacity</EM> is set to the number
+of objects that can be (are) stored in the cache.
+Note that there are upper and lower limits here.
+<P>
+<P>An arbitrary constant, bits_per_entry (currently set to 5), is
+used to calculate the size of the array using the following formula:
+<P>
+<P>
+<PRE>
+  number of bits in array = capacity * bits_per_entry + 7
+</PRE>
+<P>
+<P>The size of the digest, in bytes, is therefore:
+<P>
+<P>
+<PRE>
+  digest size = int (number of bits in array / 8)
+</PRE>
+<P>
+<P>When a digest rebuild occurs, the change in the cache size (capacity)
+is measured.
+If the capacity has changed by a large enough amount (10%) then
+the digest array is freed and reallocated memory, otherwise the
+same digest is re-used.
+<P>
+<P>
+<H2><A NAME="ss16.5">16.5 What hash functions (and how many of them) does Squid use?</A>
+</H2>
+
+<P>The protocol design allows for a variable number of hash functions (k).
+However, Squid employs a very efficient method using a fixed number - four.
+<P>
+<P>Rather than computing a number of independent hash functions over a URL
+Squid uses a 128-bit MD5 hash of the key (actually a combination of the URL
+and the HTTP retrieval method) and then splits this into four equal
+chunks.
+<P>Each chunk, modulo the digest size (m), is used as the value for one of
+the hash functions - i.e. an index into the bit array.
+<P>
+<P>Note: As Squid retrieves objects and stores them in its cache on disk,
+it adds them to the in-RAM index using a lookup key which is an MD5 hash
+- the very one discussed above.
+This means that the values for the Cache Digest hash functions are
+already available and consequently the operations are extremely
+efficient!
+<P>
+<P>Obviously, modifying the code to support a variable number of hash functions
+would prove a little more difficult and would most likely reduce efficiency.
+<P>
+<P>
+<H2><A NAME="ss16.6">16.6 How are objects added to the Cache Digest in Squid?</A>
+</H2>
+
+<P>Every object referenced in the index in RAM is checked to see if
+it is suitable for addition to the digest.
+<P>A number of objects are not suitable, e.g. those that are private,
+not cachable, negatively cached etc. and are skipped immediately.
+<P>
+<P>A <EM>freshness</EM> test is next made in an attempt to guess if
+the object will expire soon, since if it does, it is not worthwhile
+adding it to the digest.
+The object is checked against the refresh patterns for staleness...
+<P>
+<P>Since Squid stores references to objects in its index using the MD5 key
+discussed earlier there is no URL actually available for each object -
+which means that the pattern used will fall back to the default pattern, ".".
+This is an unfortunate state of affairs, but little can be done about
+it.
+A <EM>cd_refresh_pattern</EM> option will be added to the configuration
+file soon which will at least make the confusion a little clearer :-)
+<P>
+<P>Note that it is best to be conservative with your refresh pattern
+for the Cache Digest, i.e.
+do <EM>not</EM> add objects if they might become stale soon.
+This will reduce the number of False Hits.
+<P>
+<P>
+<H2><A NAME="ss16.7">16.7 Does Squid support deletions in Cache Digests? What are diffs/deltas?</A>
+</H2>
+
+<P>Squid does not support deletions from the digest.
+Because of this the digest must, periodically, be rebuilt from scratch to
+erase stale bits and prevent digest pollution.
+<P>
+<P>A more sophisticated option is to use <EM>diffs</EM> or <EM>deltas</EM>.
+These would be created by building a new digest and comparing with the
+current/old one.
+They would essentially consist of aggregated deletions and additions
+since the <EM>previous</EM> digest.
+<P>
+<P>Since less bandwidth should be required using these it would be possible
+to have more frequent updates (and hence, more accurate information).
+<P>
+<P>Costs:
+<P>
+<P>
+<UL>
+<LI>RAM - extra RAM needed to hold two digests while comparisons takes place.</LI>
+<LI>CPU - probably a negligible amount.</LI>
+</UL>
+<P>
+<P>
+<H2><A NAME="ss16.8">16.8 When and how often is the local digest built?</A>
+</H2>
+
+<P>The local digest is built:
+<P>
+<P>
+<UL>
+<LI> when store_rebuild completes after startup
+(the cache contents have been indexed in RAM), and</LI>
+<LI> periodically thereafter. Currently, it is rebuilt every hour
+(more data and experience is required before other periods, whether
+fixed or dynamically varying, can "intelligently" be chosen).
+The good thing is that the local cache decides on the expiry time and
+peers must obey (see later).</LI>
+</UL>
+<P>
+<P>While the [new] digest is being built in RAM the old version (stored
+on disk) is still valid, and will be returned to any peer requesting it.
+When the digest has completed building it is then swapped out to disk,
+overwriting the old version.
+<P>
+<P>The rebuild is CPU intensive, but not overly so.
+Since Squid is programmed using an event-handling model, the approach
+taken is to split the digest building task into chunks (i.e.  chunks
+of entries to add) and to register each chunk as an event.
+If CPU load is overly high, it is possible to extend the build period
+- as long as it is finished before the next rebuild is due!
+<P>
+<P>It may prove more efficient to implement the digest building as a separate
+process/thread in the future...
+<P>
+<P>
+<H2><A NAME="ss16.9">16.9 How are Cache Digests transferred between peers?</A>
+</H2>
+
+<P>Cache Digests are fetched from peers using the standard HTTP protocol
+(note that a <EM>pull</EM> rather than <EM>push</EM> technique is
+used).
+<P>
+<P>After the first access to a peer, a <EM>peerDigestValidate</EM> event
+is queued
+(this event decides if it is time to fetch a new version of a digest
+from a peer).
+The queuing delay depends on the number of peers already queued
+for validation - so that all digests from different peers are not
+fetched simultaneously.
+<P>
+<P>A peer answering a request for its digest will specify an expiry
+time for that digest by using the HTTP <EM>Expires</EM> header.
+The requesting cache thus knows when it should request a fresh
+copy of that peers digest.
+<P>
+<P>Note: requesting caches use an If-Modified-Since request in case the peer
+has not rebuilt its digest for some reason since the last time it was
+fetched.
+<P>
+<P>
+<H2><A NAME="ss16.10">16.10 How and where are Cache Digests stored?</A>
+</H2>
+
+<P>
+<H3>Cache Digest built locally</H3>
+
+<P>Since the local digest is generated purely for the benefit of its neighbours
+keeping it in RAM is not strictly required.
+However, it was decided to keep the local digest in RAM partly because of
+the following:
+<P>
+<P>
+<UL>
+<LI> Approximately the same amount of memory will be (re-)allocated on every
+rebuild of the digest,</LI>
+<LI> the memory requirements are probably quite small (when compared to other
+requirements of the cache server),</LI>
+<LI> if ongoing updates of the digest are to be supported (e.g. additions/deletions) it will be necessary to perform these operations on a digest
+in RAM, and</LI>
+<LI> if diffs/deltas are to be supported the "old" digest would have to
+be swapped into RAM anyway for the comparisons.</LI>
+</UL>
+<P>
+<P>When the digest is built in RAM, it is then swapped out to disk, where it is
+stored as a "normal" cache item - which is how peers request it.
+<P>
+<P>
+<H3>Cache Digest fetched from peer</H3>
+
+<P>When a query from a client arrives, <EM>fast lookups</EM> are
+required to decide if a request should be made to a neighbour cache.
+It it therefore required to keep all peer digests in RAM.
+<P>
+<P>Peer digests are also stored on disk for the following reasons:
+<P>
+<P>
+<UL>
+<LI><EM>Recovery</EM>
+- If stopped and restarted, peer digests can be reused from the local
+on-disk copy (they will soon be validated using an HTTP IMS request
+to the appropriate peers as discussed earlier), and</LI>
+<LI><EM>Sharing</EM>
+- peer digests are stored as normal objects in the cache. This
+allows them to be given to neighbour caches.</LI>
+</UL>
+<P>
+<P>
+<H2><A NAME="ss16.11">16.11 How are the Cache Digest statistics in the Cache Manager to be interpreted?</A>
+</H2>
+
+<P>Cache Digest statistics can be seen from the Cache Manager or through the
+<EM>client</EM> utility.
+The following examples show how to use the <EM>client</EM> utility
+to request the list of possible operations from the localhost, local
+digest statistics from the localhost, refresh statistics from the
+localhost and local digest statistics from another cache, respectively.
+<P>
+<P>
+<PRE>
+  ./client mgr:menu
+
+  ./client mgr:store_digest
+
+  ./client mgr:refresh
+
+  ./client -h peer mgr:store_digest
+</PRE>
+<P>
+<P>The available statistics provide a lot of useful debugging information.
+The refresh statistics include a section for Cache Digests which
+explains why items were added (or not) to the digest.
+<P>
+<P>The following example shows local digest statistics for a 16GB
+cache in a corporate intranet environment
+(may be a useful reference for the discussion below).
+<P>
+<P>
+<PRE>
+store digest: size: 768000 bytes
+         entries: count: 588327 capacity: 1228800 util: 48%
+         deletion attempts: 0
+         bits: per entry: 5 on: 1953311 capacity: 6144000 util: 32%
+         bit-seq: count: 2664350 avg.len: 2.31
+         added: 588327 rejected: 528703 ( 47.33 %) del-ed: 0
+         collisions: on add: 0.23 % on rej: 0.23 %
+</PRE>
+<P>
+<P><EM>entries:capacity</EM> is a measure of how many items "are likely" to
+be added to the digest.
+It represents the number of items that were in the local cache at the
+start of digest creation - however, upper and lower limits currently
+apply.
+This value is multiplied by <EM>bits: per entry</EM> (an arbitrary constant)
+to give <EM>bits:capacity</EM>, which is the size of the cache digest in bits.
+Dividing this by 8 will give <EM>store digest: size</EM> which is the
+size in bytes.
+<P>
+<P>The number of items represented in the digest is given by
+<EM>entries:count</EM>.
+This should be equal to <EM>added</EM> minus <EM>deletion attempts</EM>.
+<P>Since (currently) no modifications are made to the digest after the initial
+build (no additions are made and deletions are not supported)
+<EM>deletion attempts</EM> will always be 0 and <EM>entries:count</EM>
+should simply be equal to <EM>added</EM>.
+<P>
+<P><EM>entries:util</EM> is not really a significant statistic.
+At most it gives a measure of how many of the items in the store were
+deemed suitable for entry into the cache compared to how many were
+"prepared" for.
+<P>
+<P><EM>rej</EM> shows how many objects were rejected.
+Objects will not be added for a number of reasons, the most common being
+refresh pattern settings.
+Remember that (currently) the default refresh pattern will be used for
+checking for entry here and also note that changing this pattern can
+significantly affect the number of items added to the digest!
+Too relaxed and False Hits increase, too strict and False Misses increase.
+Remember also that at time of validation (on the peer) the "real" refresh
+pattern will be used - so it is wise to keep the default refresh pattern
+conservative.
+<P>
+<P><EM>bits: on</EM> indicates the number of bits in the digest that are set
+to 1.
+<EM>bits: util</EM> gives this figure as a percentage of the total number
+of bits in the digest.
+As we saw earlier, a figure of 50% represents the optimal trade-off.
+Values too high (say > 75%) would cause a larger number of collisions,
+and hence False Hits,
+while lower values mean the digest is under-utilised (using unnecessary RAM).
+Note that low values are normal for caches that are starting to fill up.
+<P>
+<P>A bit sequence is an uninterrupted sequence of bits with the same value.
+<EM>bit-seq: avg.len</EM> gives some insight into the quality of the hash
+functions.
+Long values indicate problem, even if <EM>bits:util</EM> is 50%
+(> 3 = suspicious, > 10 = very suspicious).
+<P>
+<P>
+<H2><A NAME="ss16.12">16.12 What are False Hits and how should they be handled?</A>
+</H2>
+
+<P>A False Hit occurs when a cache believes a peer has an object
+and asks the peer for it <EM>but</EM> the peer is not able to
+satisfy the request.
+<P>
+<P>Expiring or stale objects on the peer are frequent causes of False
+Hits.
+At the time of the query actual refresh patterns are used on the
+peer and stale entries are marked for revalidation.
+However, revalidation is prohibited unless the peer is behaving
+as a parent, or <EM>miss_access</EM> is enabled.
+Thus, clients can receive error messages instead of revalidated
+objects!
+<P>
+<P>The frequency of False Hits can be reduced but never eliminated
+completely, therefore there must be a robust way of handling them
+when they occur.
+The philosophy behind the design of Squid is to use lightweight
+techniques and optimise for the common case and robustly handle the
+unusual case (False Hits).
+<P>
+<P>Squid will soon support the HTTP <EM>only-if-cached</EM> header.
+Requests for objects made to a peer will use this header and if
+the objects are not available, the peer can reply appropriately
+allowing Squid to recognise the situation.
+The following describes what Squid is aiming towards:
+<P>
+<P>
+<UL>
+<LI>Cache Digests used to obtain good estimates of where a
+requested object is located in a Cache Hierarchy.</LI>
+<LI>Persistent HTTP Connections between peers.
+There will be no TCP startup overhead and both latency and
+network load will be similar for ICP (i.e. fast).</LI>
+<LI>HTTP False Hit Recognition using the <EM>only-if-cached</EM>
+HTTP header - allowing fall back to another peer or, if no other
+peers are available with the object, then going direct (or
+<EM>through</EM> a parent if behind a firewall).</LI>
+</UL>
+<P>
+<P>
+<H2><A NAME="ss16.13">16.13 How can Cache Digest related activity be traced/debugged?</A>
+</H2>
+
+<P>
+<H3>Enabling Cache Digests</H3>
+
+<P>If you wish to use Cache Digests (available in Squid version 2) you need to
+add a <EM>configure</EM> option, so that the relevant code is compiled in:
+<P>
+<P>
+<PRE>
+  ./configure --enable-cache-digests ...
+</PRE>
+<P>
+<P>
+<H3>What do the access.log entries look like?</H3>
+
+<P>If a request is forwarded to a neighbour due a HIT in that neighbour's
+Cache Digest the hierarchy (9th) field of the access.log file for
+the <EM>local cache</EM> will look like <EM>CACHE_DIGEST_HIT/neighbour</EM>.
+The Log Tag (4th field) should obviously show a MISS.
+<P>
+<P>On the peer cache the request should appear as a normal HTTP request
+from the first cache.
+<P>
+<P>
+<H3>What does a False Hit look like?</H3>
+
+<P>The easiest situation to analyse is when two caches (say A and B) are
+involved neither of which uses the other as a parent.
+In this case, a False Hit would show up as a CACHE_DIGEST_HIT on A and
+<EM>NOT</EM> as a TCP_HIT on B (or vice versa).
+If B does not fetch the object for A then the hierarchy field will
+look like <EM>NONE/-</EM> (and A will have received an Access Denied
+or Forbidden message).
+This will happen if the object is not "available" on B and B does not
+have <EM>miss_access</EM> enabled for A (or is not acting as a parent
+for A).
+<P>
+<P>
+<H3>How is the cause of a False Hit determined?</H3>
+
+<P>Assume A requests a URL from B and receives a False Hit
+<P>
+<UL>
+<LI> Using the <EM>client</EM> utility <EM>PURGE</EM> the URL from A, e.g.
+
+<P>
+<PRE>
+  ./client -m PURGE 'URL'
+</PRE>
+<P>
+</LI>
+<LI> Using the <EM>client</EM> utility request the object from A, e.g.
+
+<P>
+<PRE>
+  ./client 'URL'
+</PRE>
+<P>
+</LI>
+</UL>
+<P>
+<P>The HTTP headers of the request are available.
+Two header types are of particular interest:
+<P>
+<P>
+<UL>
+<LI> <EM>X-Cache</EM> - this shows whether an object is available or not.</LI>
+<LI> <EM>X-Cache-Lookup</EM> - this keeps the result of a store table lookup
+<EM>before</EM> refresh causing rules are checked (i.e. it indicates if the
+object is available before any validation would be attempted).</LI>
+</UL>
+<P>
+<P>The X-Cache and X-Cache-Lookup headers from A should both show MISS.
+<P>
+<P>If A requests the object from B (which it will if the digest lookup indicates
+B has it - assuming B is closest peer of course :-) then there will be another
+set of these headers from B.
+<P>
+<P>If the X-Cache header from B shows a MISS a False Hit has occurred.
+This means that A thought B had an object but B tells A it does not
+have it available for retrieval.
+The reason why it is not available for retrieval is indicated by the
+X-Cache-Lookup header. If:
+<P>
+<P>
+<UL>
+<LI><EM>X-Cache-Lookup = MISS</EM> then either A's (version of
+B's) digest is out-of-date or corrupt OR a collision occurred
+in the digest (very small probability) OR B recently purged
+the object.</LI>
+<LI><EM>X-Cache-Lookup = HIT</EM> then B had the object, but
+refresh rules (or A's max-age requirements) prevent A from
+getting a HIT (validation failed).</LI>
+</UL>
+<P>
+<P>
+<H3>Use The Source</H3>
+
+<P>If there is something else you need to check you can always look at the
+source code.
+The main Cache Digest functionality is organised as follows:
+<P>
+<P>
+<UL>
+<LI> <EM>CacheDigest.c (debug section 70)</EM> Generic Cache Digest routines</LI>
+<LI> <EM>store_digest.c (debug section 71)</EM> Local Cache Digest routines</LI>
+<LI> <EM>peer_digest.c (debug section 72)</EM> Peer Cache Digest routines</LI>
+</UL>
+<P>
+<P>Note that in the source the term <EM>Store Digest</EM> refers to the digest
+created locally.
+The Cache Digest code is fairly self-explanatory (once you understand how Cache
+Digests work):
+<P>
+<P>
+<H2><A NAME="ss16.14">16.14 What about ICP?</A>
+</H2>
+
+<P>
+<P>COMING SOON!
+<P>
+<P>
+<H2><A NAME="ss16.15">16.15 Is there a Cache Digest Specification?</A>
+</H2>
+
+<P>There is now, thanks to
+<A HREF="mailto:martin@net.lut.ac.uk">Martin Hamilton</A> and
+<A HREF="mailto:rousskov@ircache.net">Alex Rousskov</A>.
+<P>
+<P>Cache Digests, as implemented in Squid 2.1.PATCH2, are described in
+<A HREF="/CacheDigest/cache-digest-v5.txt">cache-digest-v5.txt</A>.
+<P>You'll notice the format is similar to an Internet Draft.
+We decided not to submit this document as a draft because Cache Digests
+will likely undergo some important changes before we want to try to make
+it a standard.
+<P>
+<H2><A NAME="ss16.16">16.16 Would it be possible to stagger the timings when cache_digests are retrieved from peers?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.2.</EM>
+<P>Squid already has code to spread the digest updates. The algorithm is
+currently controlled by a few hard-coded constants in <EM>peer_digest.c</EM>. For
+example, <EM>GlobDigestReqMinGap</EM> variable determines the minimum interval
+between two requests for a digest. You may want to try to increase the
+value of GlobDigestReqMinGap from 60 seconds to whatever you feel
+comfortable with (but it should be smaller than hour/number_of_peers, of
+course).
+<P>
+<P>Note that whatever you do, you still need to give Squid enough time and
+bandwidth to fetch all the digests. Depending on your environment, that
+bandwidth may be more or less than an ICP would require. Upcoming digest
+deltas (x10 smaller than the digests themselves) may be the only way to
+solve the ``big scale'' problem.
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-17.html">Next</A>
+<A HREF="FAQ-15.html">Previous</A>
+<A HREF="FAQ.html#toc16">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-17.html
+++ squid-2.5.9/debian/doc/FAQ-17.html
@@ -0,0 +1,1125 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Interception Caching/Proxying</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-18.html">Next</A>
+<A HREF="FAQ-16.html">Previous</A>
+<A HREF="FAQ.html#toc17">Contents</A>
+<HR>
+<H2><A NAME="trans-caching"></A> <A NAME="s17">17. Interception Caching/Proxying</A></H2>
+
+<P><I>How can I make my users' browsers use my cache without configuring
+the browsers for proxying?</I>
+<P>First, it is <EM>critical</EM> to read the full comments in the squid.conf
+file!  That is the only authoritative source for configuration
+information.  However, the following instructions are correct as of
+this writing (July 1999.)
+<P>
+<P>Getting interception caching to work requires four distinct steps:
+<OL>
+<LI>
+<B>Compile and run a version of Squid which accepts
+connections for other addresses</B>.  For some operating systems,
+you need to have configured and built a version of Squid which
+can recognize the hijacked connections and discern the
+destination addresses. For Linux this seems to work
+automatically.  For *BSD-based systems, you probably have to
+configure squid with the <EM>--enable-ipf-transparent</EM> option.
+(Do a <EM>make clean</EM> if you previously configured without that
+option, or the correct settings may not be present.)
+</LI>
+<LI>
+<B>Configure Squid to accept and process the connections</B>.
+You have to change the Squid configuration settings to
+recognize the hijacked connections and discern the destination
+addresses.  Here are the important settings in <EM>squid.conf</EM>:
+<PRE>
+http_port 8080
+httpd_accel_host virtual
+httpd_accel_port 80
+httpd_accel_with_proxy  on
+httpd_accel_uses_host_header on
+</PRE>
+
+</LI>
+<LI>
+<B>Get your cache server to accept the packets</B>. You have to
+configure your cache host to accept the redirected packets -
+any IP address, on port 80 - and deliver them to your cache
+application.  This is typically done with IP
+filtering/forwarding features built into the kernel.
+On linux they call this <EM>iptables</EM> (kernel 2.4.x),
+<EM>ipchains</EM> (2.2.x) or <EM>ipfwadm</EM> (2.0.x).
+On FreeBSD its called <EM>ipfw</EM>.  Other
+BSD systems may use <EM>ip filter</EM> or <EM>ipnat</EM>.  On most
+systems, it may require rebuilding the kernel or adding a new
+loadable kernel module.
+</LI>
+<LI>
+<B>Get the packets to your cache server</B>.  There are several
+ways to do this.  First, if your proxy machine is already in
+the path of the packets (i.e. it is routing between your proxy
+users and the Internet) then you don't have to worry about this
+step.  This would be true if you install Squid on a firewall
+machine, or on a UNIX-based router.  If the cache is not in the
+natural path of the connections, then you have to divert the
+packets from the normal path to your cache host using a router
+or switch. You may be able to do this with a Cisco router using
+their "route maps" feature, depending on your IOS version. You
+might also use a so-called layer-4 switch, such as the Alteon
+ACE-director or the Foundry Networks ServerIron.  Finally, you
+might be able to use a stand-alone router/load-balancer type
+product, or routing capabilities of an access server.
+</LI>
+</OL>
+<P><B>Notes</B>:
+<UL>
+<LI>The <EM>http_port 8080</EM> in this example assumes you will redirect
+incoming port 80 packets to port 8080 on your cache machine.  If you
+are running Squid on port 3128 (for example) you can leave it there via
+<EM>http_port 3128</EM>, and redirect to that port via your IP filtering or
+forwarding commands.
+</LI>
+<LI>In the <EM>httpd_accel_host</EM> option, <EM>virtual</EM> is the magic word!
+</LI>
+<LI>The <EM>httpd_accel_with_proxy on</EM> is required to enable interception
+proxy mode; essentially in interception proxy mode Squid thinks it is acting
+both as an accelerator (hence accepting packets for other IPs on port 80) and
+a caching proxy (hence serving files out of cache.)
+</LI>
+<LI> You <B>must</B> use <EM>httpd_accel_uses_host_header on</EM> to get
+the cache to work properly in interception mode.  This enables the cache
+to index its stored objects under the true hostname, as is done in a
+normal proxy, rather than under the IP address.  This is especially
+important if you want to use a parent cache hierarchy, or to share
+cache data between interception proxy users and non-interception proxy
+users, which you can do with Squid in this configuration.
+</LI>
+</UL>
+<P>
+<H2><A NAME="ss17.1">17.1 Interception caching for Solaris, SunOS, and BSD systems</A>
+</H2>
+
+<P>NOTE: You don't need to use IP Filter on FreeBSD.  Use the built-in <EM>ipfw</EM> feature
+instead.  See the FreeBSD subsection below.
+<P>
+<H3>Install IP Filter</H3>
+
+<P>First, get and install the
+<A HREF="http://coombs.anu.edu.au/ipfilter/">IP Filter package</A>.
+<P>
+<H3>Configure ipnat</H3>
+
+<P>Put these lines in <EM>/etc/ipnat.rules</EM>:
+<PRE>
+        # Redirect direct web traffic to local web server.
+        rdr de0 1.2.3.4/32 port 80 -> 1.2.3.4 port 80 tcp
+
+        # Redirect everything else to squid on port 8080
+        rdr de0 0.0.0.0/0 port 80 -> 1.2.3.4 port 8080 tcp
+</PRE>
+<P>
+<P>Modify your startup scripts to enable ipnat.  For example, on FreeBSD it
+looks something like this:
+<PRE>
+        /sbin/modload /lkm/if_ipl.o
+        /sbin/ipnat -f /etc/ipnat.rules
+        chgrp nobody /dev/ipnat
+        chmod 644 /dev/ipnat
+</PRE>
+<P>
+<H3>Configure Squid</H3>
+
+<H3>Squid-2</H3>
+
+<P>Squid-2 (after version beta25) has IP filter support built in.
+Simple enable it when you run <EM>configure</EM>:
+<PRE>
+        ./configure --enable-ipf-transparent
+</PRE>
+
+Add these lines to your <EM>squid.conf</EM> file:
+<PRE>
+        http_port 8080
+        httpd_accel_host virtual
+        httpd_accel_port 80
+        httpd_accel_with_proxy on
+        httpd_accel_uses_host_header on
+</PRE>
+
+Note, you don't have to use port 8080, but it must match whatever you
+used in the <EM>/etc/ipnat.rules</EM> file.
+<H3>Squid-1.1</H3>
+
+<P>Patches for Squid-1.X are available from
+<A HREF="http://www.fan.net.au/~q/squid/">Quinton Dolan's Squid page</A>.
+Add these lines to <EM>squid.conf</EM>:
+<PRE>
+        http_port 8080
+        httpd_accel virtual 80
+        httpd_accel_with_proxy on
+        httpd_accel_uses_host_header on
+</PRE>
+<P>
+<P>Thanks to 
+<A HREF="mailto:q@fan.net.au">Quinton Dolan</A>.
+<P>
+<H2><A NAME="trans-linux-1"></A> <A NAME="ss17.2">17.2 Interception caching with Linux 2.0 and ipfwadm</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:Rodney.van.den.Oever@tip.nl">Rodney van den Oever</A><P>
+<P><B>Note:</B> Interception proxying does NOT work with Linux&nbsp;2.0.30!
+Linux&nbsp;2.0.29 is known to work well.  If you're using a more recent
+kernel, like 2.2.X, then you should probably use an ipchains configuration,
+<A HREF="#trans-linux-2">as described below</A>.
+<P>
+<P><B>Warning:</B> this technique has some shortcomings.
+<OL>
+<LI><B>This method only supports the HTTP protocol, not gopher or FTP</B></LI>
+<LI>Since the browser wasn't set up to use a proxy server, it uses
+the FTP protocol (with destination port 21) and not the required
+HTTP protocol.  You can't setup a redirection-rule to the proxy
+server since the browser is speaking the wrong protocol.  A similar
+problem occurs with gopher.  Normally all proxy requests are
+translated by the client into the HTTP protocol, but since the
+client isn't aware of the redirection, this never happens.</LI>
+</OL>
+<P>
+<P>If you can live with the side-effects, go ahead and compile your
+kernel with firewalling and redirection support.  Here are the
+important parameters from <EM>/usr/src/linux/.config</EM>:
+<P>
+<PRE>
+        #
+        # Code maturity level options
+        #
+        CONFIG_EXPERIMENTAL=y
+        #
+        # Networking options
+        #
+        CONFIG_FIREWALL=y
+        # CONFIG_NET_ALIAS is not set
+        CONFIG_INET=y
+        CONFIG_IP_FORWARD=y
+        # CONFIG_IP_MULTICAST is not set
+        CONFIG_IP_FIREWALL=y
+        # CONFIG_IP_FIREWALL_VERBOSE is not set
+        CONFIG_IP_MASQUERADE=y
+        CONFIG_IP_TRANSPARENT_PROXY=y
+        CONFIG_IP_ALWAYS_DEFRAG=y
+        # CONFIG_IP_ACCT is not set
+        CONFIG_IP_ROUTER=y
+</PRE>
+<P>
+<P>You may also need to enable <B>IP Forwarding</B>.  One way to do it
+is to add this line to your startup scripts:
+<PRE>
+        echo 1 > /proc/sys/net/ipv4/ip_forward
+</PRE>
+<P>
+<P>Go to the
+<A HREF="http://www.xos.nl/linux/ipfwadm/">Linux IP Firewall and Accounting</A> page,
+obtain the source distribution to <EM>ipfwadm</EM> and install it.
+Older versions of <EM>ipfwadm</EM> may not work.  You might need
+at least version <B>2.3.0</B>.
+You'll use <EM>ipfwadm</EM> to setup the redirection rules.  I
+added this rule to the script that runs from <EM>/etc/rc.d/rc.inet1</EM>
+(Slackware) which sets up the interfaces at boot-time. The redirection
+should be done before any other Input-accept rule.  To really make
+sure it worked I disabled the forwarding (masquerading) I normally
+do.
+<P><EM>/etc/rc.d/rc.firewall</EM>:
+<P>
+<PRE>
+        #!/bin/sh
+        # rc.firewall   Linux kernel firewalling rules
+        FW=/sbin/ipfwadm
+
+        # Flush rules, for testing purposes
+        for i in I O F # A      # If we enabled accounting too
+        do
+                ${FW} -$i -f
+        done
+
+        # Default policies:
+        ${FW} -I -p rej         # Incoming policy: reject (quick error)
+        ${FW} -O -p acc         # Output policy: accept
+        ${FW} -F -p den         # Forwarding policy: deny
+
+        # Input Rules:
+
+        # Loopback-interface (local access, eg, to local nameserver):
+        ${FW} -I -a acc -S localhost/32 -D localhost/32
+
+        # Local Ethernet-interface:
+
+        # Redirect to Squid proxy server:
+        ${FW} -I -a acc -P tcp -D default/0 80 -r 8080
+
+        # Accept packets from local network:
+        ${FW} -I -a acc -P all -S localnet/8 -D default/0 -W eth0
+
+        # Only required for other types of traffic (FTP, Telnet):
+
+        # Forward localnet with masquerading (udp and tcp, no icmp!):
+        ${FW} -F -a m -P tcp -S localnet/8 -D default/0
+        ${FW} -F -a m -P udp -S localnet/8 -D default/0
+</PRE>
+<P>
+<P>Here all traffic from the local LAN with any destination gets redirected to
+the local port 8080.  Rules can be viewed like this:
+<PRE>
+        IP firewall input rules, default policy: reject
+        type  prot source               destination          ports
+        acc   all  127.0.0.1            127.0.0.1            n/a
+        acc/r tcp  10.0.0.0/8           0.0.0.0/0            * -> 80 => 8080
+        acc   all  10.0.0.0/8           0.0.0.0/0            n/a
+        acc   tcp  0.0.0.0/0            0.0.0.0/0            * -> *
+</PRE>
+<P>
+<P>I did some testing on Windows 95 with both Microsoft Internet
+Explorer 3.01 and Netscape Communicator pre-release and it worked
+with both browsers with the proxy-settings disabled.
+<P>
+<P>At one time <EM>squid</EM> seemed to get in a loop when I pointed the
+browser to the local port 80.  But this could be avoided by adding a
+reject rule for client to this address:
+<PRE>
+        ${FW} -I -a rej -P tcp -S localnet/8 -D hostname/32 80
+
+        IP firewall input rules, default policy: reject
+        type  prot source               destination          ports
+        acc   all  127.0.0.1            127.0.0.1            n/a
+        rej   tcp  10.0.0.0/8           10.0.0.1             * -> 80
+        acc/r tcp  10.0.0.0/8           0.0.0.0/0            * -> 80 => 8080
+        acc   all  10.0.0.0/8           0.0.0.0/0            n/a
+        acc   tcp  0.0.0.0/0            0.0.0.0/0            * -> *
+</PRE>
+<P>
+<P><EM>NOTE on resolving names</EM>:  Instead of just
+passing the URLs to the proxy server, the browser itself has to
+resolve the URLs.  Make sure the workstations are setup to query
+a local nameserver, to minimize outgoing traffic.
+<P>If you're already running a nameserver at the firewall or proxy server
+(which is a good idea anyway IMHO) let the workstations use this
+nameserver.
+<P>
+<P>Additional notes from
+<A HREF="mailto:RichardA@noho.co.uk">Richard Ayres</A><P>
+<BLOCKQUOTE>
+<P>I'm using such a setup. The only issues so far have been that:
+<P>
+<OL>
+<LI>It's fairly useless to use my service providers parent caches
+(cache-?.www.demon.net) because by proxying squid only sees IP addresses,
+not host names and demon aren't generally asked for IP addresses by other
+users;
+</LI>
+<LI>Linux kernel 2.0.30 is a no-no as interception proxying is broken (I use
+2.0.29);
+</LI>
+<LI>Client browsers must do host name lookups themselves, as they don't know
+they're using a proxy;
+</LI>
+<LI>The Microsoft Network won't authorize its users through a proxy, so I
+have to specifically *not* redirect those packets (my company is a MSN
+content provider).</LI>
+</OL>
+<P>Aside from this, I get a 30-40% hit rate on a 50MB cache for 30-40 users and
+am quite pleased with the results.
+</BLOCKQUOTE>
+<P>
+<P>See also 
+<A HREF="http://www.unxsoft.com/transproxy.html">Daniel Kiracofe's page</A>.
+<P>
+<H2><A NAME="trans-linux-2"></A> <A NAME="ss17.3">17.3 Interception caching with Linux 2.2 and ipchains</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:Support@dnet.co.uk">Martin Lyons</A><P>You need to configure your kernel for ipchains.
+Configuring Linux kernels is beyond the scope of 
+this FAQ.  One way to do it is:
+<PRE>
+        # cd /usr/src/linux
+        # make menuconfig
+</PRE>
+<P>The following shows important kernel features to include:
+<PRE>
+        [*] Network firewalls
+        [ ] Socket Filtering
+        [*] Unix domain sockets
+        [*] TCP/IP networking
+        [ ] IP: multicasting
+        [ ] IP: advanced router
+        [ ] IP: kernel level autoconfiguration
+        [*] IP: firewalling
+        [ ] IP: firewall packet netlink device
+        [*] IP: always defragment (required for masquerading)
+        [*] IP: transparent proxy support
+</PRE>
+<P>You must include the <EM>IP: always defragment</EM>, otherwise it prevents
+you from using the REDIRECT chain.
+<P>
+<P>You can use this script as a template for your own <EM>rc.firewall</EM>
+to configure ipchains:
+<PRE>
+        #!/bin/sh
+        # rc.firewall   Linux kernel firewalling rules
+        # Leon Brooks (leon at brooks dot fdns dot net)
+        FW=/sbin/ipchains
+        ADD="$FW -A"
+
+        # Flush rules, for testing purposes
+        for i in I O F # A      # If we enabled accounting too
+        do
+                ${FW} -F $i
+        done
+
+        # Default policies:
+        ${FW} -P input REJECT   # Incoming policy: reject (quick error)
+        ${FW} -P output ACCEPT  # Output policy: accept
+        ${FW} -P forward DENY   # Forwarding policy: deny
+
+        # Input Rules:
+
+        # Loopback-interface (local access, eg, to local nameserver):
+        ${ADD} input -j ACCEPT -s localhost/32 -d localhost/32
+
+        # Local Ethernet-interface:
+
+        # Redirect to Squid proxy server:
+        ${ADD} input -p tcp -d 0/0 80 -j REDIRECT 8080
+
+        # Accept packets from local network:
+        ${ADD} input -j ACCEPT -s localnet/8 -d 0/0 -i eth0
+
+        # Only required for other types of traffic (FTP, Telnet):
+
+        # Forward localnet with masquerading (udp and tcp, no icmp!):
+        ${ADD} forward -j MASQ -p tcp -s localnet/8 -d 0/0
+        ${ADD} forward -j MASQ -P udp -s localnet/8 -d 0/0
+</PRE>
+<P>
+<P>Also, 
+<A HREF="mailto:andrew@careless.net">Andrew Shipton</A>
+notes that with 2.0.x kernels you don't need to enable packet forwarding,
+but with the 2.1.x and 2.2.x kernels using ipchains you do.  Packet
+forwarding is enabled with the following command:
+<PRE>
+        echo 1 > /proc/sys/net/ipv4/ip_forward
+</PRE>
+<P>
+<H2><A NAME="trans-linux-3"></A> <A NAME="ss17.4">17.4 Interception caching with Linux 2.4 and netfilter</A>
+</H2>
+
+<P>NOTE: this information comes from Daniel Kiracofe's
+<A HREF="http://www.linuxdoc.org/HOWTO/mini/TransparentProxy.html">Transparent Proxy with Squid mini-HOWTO</A>.
+<P>To support netfilter transparent interception on Linux 2.4 Squid
+must be compiled with the --enable-linux-netfilter option.
+<P>To enable netwfilter support you may need to build a new kernel.
+Be sure to enable all of these options:
+<UL>
+<LI>Networking support </LI>
+<LI>Sysctl support </LI>
+<LI>Network packet filtering </LI>
+<LI>TCP/IP networking </LI>
+<LI>Connection tracking (Under ``IP: Netfilter Configuration'' in menuconfig) </LI>
+<LI>IP tables support </LI>
+<LI>Full NAT </LI>
+<LI>REDIRECT target support </LI>
+<LI>/proc filesystem support </LI>
+</UL>
+<P>You must say NO to ``Fast switching'' 
+<P>After building the kernel, install it and reboot.
+<P>You may need to enable packet forwarding (e.g. in your startup scripts):
+<PRE>
+echo 1 > /proc/sys/net/ipv4/ip_forward
+</PRE>
+<P>Use the <EM>iptables</EM> command to make your kernel intercept HTTP connections
+and send them to Squid:
+<PRE>
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 
+</PRE>
+<P>
+<P>
+<H2><A NAME="ss17.5">17.5 Interception caching with Cisco routers</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:John.Saunders@scitec.com.au">John Saunders</A><P>
+<P>This works with at least IOS 11.1 and later I guess. Possibly earlier,
+as I'm no CISCO expert I can't say for sure. If your router is doing
+anything more complicated that shuffling packets between an ethernet
+interface and either a serial port or BRI port, then you should work
+through if this will work for you.
+<P>
+<P>First define a route map with a name of proxy-redirect (name doesn't
+matter) and specify the next hop to be the machine Squid runs on.
+<PRE>
+        !
+        route-map proxy-redirect permit 10
+         match ip address 110
+         set ip next-hop 203.24.133.2
+        !
+</PRE>
+
+Define an access list to trap HTTP requests. The second line allows
+the Squid host direct access so an routing loop is not formed.
+By carefully writing your access list as show below, common
+cases are found quickly and this can greatly reduce the load on your
+router's processor.
+<PRE>
+        !
+        access-list 110 deny   tcp any any neq www
+        access-list 110 deny   tcp host 203.24.133.2 any
+        access-list 110 permit tcp any any
+        !
+</PRE>
+
+Apply the route map to the ethernet interface.
+<PRE>
+        !
+        interface Ethernet0
+         ip policy route-map proxy-redirect
+        !
+</PRE>
+<P>
+<H3>possible bugs</H3>
+
+<P>
+<A HREF="mailto:morgan@curtin.net">Bruce Morgan</A> notes that
+there is a Cisco bug relating to interception proxying using IP
+policy route maps, that causes NFS and other applications to break.
+Apparently there are two bug reports raised in Cisco, but they are
+not available for public dissemination.
+<P>
+<P>The problem occurs with o/s packets with more than 1472 data bytes.  If you try
+to ping a host with more than 1472 data bytes across a Cisco interface with the
+access-lists and ip policy route map, the icmp request will fail.  The
+packet will be fragmented, and the first fragment is checked against the
+access-list and rejected - it goes the "normal path" as it is an icmp
+packet - however when the second fragment is checked against the
+access-list it is accepted (it isn't regarded as an icmp packet), and
+goes to the action determined by the policy route map!
+<P>
+<P>
+<A HREF="mailto:John.Saunders@scitec.com.au">John</A> notes that you
+may be able to get around this bug by carefully writing your access lists.
+If the last/default rule is to permit then this bug
+would be a problem, but if the last/default rule was to deny then
+it won't be a problem.  I guess fragments, other than the first,
+don't have the information available to properly policy route them.
+Normally TCP packets should not be fragmented, at least my network
+runs an MTU of 1500 everywhere to avoid fragmentation.  So this would
+affect UDP and ICMP traffic only.
+<P>
+<P>Basically, you will have to pick between living with the bug or better
+performance.  This set has better performance, but suffers from the
+bug:
+<PRE>
+        access-list 110 deny   tcp any any neq www
+        access-list 110 deny   tcp host 10.1.2.3 any
+        access-list 110 permit tcp any any
+</PRE>
+
+Conversely, this set has worse performance, but works for all protocols:
+<PRE>
+        access-list 110 deny   tcp host 10.1.2.3 any
+        access-list 110 permit tcp any any eq www
+        access-list 110 deny   tcp any any
+</PRE>
+<P>
+<H2><A NAME="ss17.6">17.6 Interception caching with LINUX 2.0.29 and CISCO IOS 11.1</A>
+</H2>
+
+<P>Just for kicks, here's an email message posted to squid-users
+on how to make interception proxying work with a Cisco router
+and Squid running on Linux.
+<P>
+<P>by 
+<A HREF="mailto:signal@shreve.net">Brian Feeny</A><P>
+<P>Here is how I have Interception proxying working for me, in an environment
+where my router is a Cisco 2501 running IOS 11.1, and Squid machine is
+running Linux 2.0.33.
+<P>
+<P>Many thanks to the following individuals and the squid-users list for
+helping me get redirection and interception proxying working on my
+Cisco/Linux box.
+<P>
+<UL>
+<LI>Lincoln Dale</LI>
+<LI>Riccardo Vratogna</LI>
+<LI>Mark White</LI>
+<LI>Henrik Nordstrom</LI>
+</UL>
+<P>
+<P>First, here is what I added to my Cisco, which is running IOS 11.1.  In
+IOS 11.1 the route-map command is "process switched" as opposed to the
+faster "fast-switched" route-map which is found in IOS 11.2 and later.
+You may wish to be running IOS 11.2.  I am running 11.1, and have had no
+problems with my current load of about 150 simultaneous connections to
+squid.:
+<PRE>
+        !
+        interface Ethernet0
+         description To Office Ethernet
+         ip address 208.206.76.1 255.255.255.0
+         no ip directed-broadcast
+         no ip mroute-cache
+         ip policy route-map proxy-redir
+        !
+        access-list 110 deny   tcp host 208.206.76.44 any eq www
+        access-list 110 permit tcp any any eq www
+        route-map proxy-redir permit 10
+         match ip address 110
+         set ip next-hop 208.206.76.44
+</PRE>
+<P>
+<P>So basically from above you can see I added the "route-map" declaration,
+and an access-list, and then turned the route-map on under int e0 "ip
+policy route-map proxy-redir"
+<P>
+<P>ok, so the Cisco is taken care of at this point.  The host above:
+208.206.76.44, is the ip number of my squid host.
+<P>
+<P>My squid box runs Linux, so I had to do the following on it:
+<P>
+<P>my kernel (2.0.33) config looks like this:
+<PRE>
+        #
+        # Networking options
+        #
+        CONFIG_FIREWALL=y
+        # CONFIG_NET_ALIAS is not set
+        CONFIG_INET=y
+        CONFIG_IP_FORWARD=y
+        CONFIG_IP_MULTICAST=y
+        CONFIG_SYN_COOKIES=y
+        # CONFIG_RST_COOKIES is not set
+        CONFIG_IP_FIREWALL=y
+        # CONFIG_IP_FIREWALL_VERBOSE is not set
+        CONFIG_IP_MASQUERADE=y
+        # CONFIG_IP_MASQUERADE_IPAUTOFW is not set
+        CONFIG_IP_MASQUERADE_ICMP=y
+        CONFIG_IP_TRANSPARENT_PROXY=y
+        CONFIG_IP_ALWAYS_DEFRAG=y
+        # CONFIG_IP_ACCT is not set
+        CONFIG_IP_ROUTER=y
+</PRE>
+<P>
+<P>You will need Firewalling and Transparent Proxy turned on at a minimum.
+<P>
+<P>Then some ipfwadm stuff:
+<PRE>
+        # Accept all on loopback
+        ipfwadm -I -a accept -W lo
+        # Accept my own IP, to prevent loops (repeat for each interface/alias)
+        ipfwadm -I -a accept -P tcp -D 208.206.76.44 80
+        # Send all traffic destined to port 80 to Squid on port 3128
+        ipfwadm -I -a accept -P tcp -D 0/0 80 -r 3128
+</PRE>
+<P>it accepts packets on port 80 (redirected from the Cisco), and redirects
+them to 3128 which is the port my squid process is sitting on.  I put all
+this in /etc/rc.d/rc.local
+<P>
+<P>I am using
+<A HREF="/Versions/1.1/1.1.20/">v1.1.20 of Squid</A> with
+<A HREF="http://devel.squid-cache.org/hno/patches/squid-1.1.20.host_and_virtual.patch">Henrik's patch</A>
+installed.  You will want to install this patch if using a setup similar
+to mine.
+<P>
+<H2><A NAME="ss17.7">17.7 The cache is trying to connect to itself...</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:hno@squid-cache.org">Henrik Nordstrom</A><P>I think almost everyone who have tried to build a interception proxy
+setup have been bitten by this one.
+<P>
+<P>Measures you can take:
+<UL>
+<LI>Deny Squid from fetching objects from itself (using ACL lists).</LI>
+<LI>Apply a small patch that prevents Squid from looping infinitely
+(available from 
+<A HREF="http://devel.squid-cache.org/hno/">Henrik's Squid Patches</A>)</LI>
+<LI>Don't run Squid on port 80, and redirect port 80 not destined for
+the local machine to Squid (redirection == ipfilter/ipfw/ipfadm). This
+avoids the most common loops.</LI>
+<LI>If you are using ipfilter then you should also use transproxyd in
+front of Squid. Squid does not yet know how to interface to ipfilter
+(patches are welcome: squid-bugs@squid-cache.org).</LI>
+</UL>
+<P>
+<H2><A NAME="trans-freebsd"></A> <A NAME="ss17.8">17.8 Interception caching with FreeBSD</A>
+</H2>
+
+<P>by Duane Wessels
+<P>I set out yesterday to make interception caching work with Squid and
+FreeBSD.  It was, uh, fun.
+<P>It was relatively easy to configure a cisco to divert port 80
+packets to my FreeBSD box.  Configuration goes something like this:
+<PRE>
+access-list 110 deny   tcp host 10.0.3.22 any eq www
+access-list 110 permit tcp any any eq www
+route-map proxy-redirect permit 10
+ match ip address 110
+ set ip next-hop 10.0.3.22
+int eth2/0
+ ip policy route-map proxy-redirect
+</PRE>
+
+Here, 10.0.3.22 is the IP address of the FreeBSD cache machine.
+<P>
+<P>Once I have packets going to the FreeBSD box, I need to get the
+kernel to deliver them to Squid.
+I started on FreeBSD-2.2.7, and then downloaded
+<A HREF="ftp://coombs.anu.edu.au/pub/net/ip-filter/">IPFilter</A>.  This was a dead end for me.  The IPFilter distribution
+includes patches to the FreeBSD kernel sources, but many of these had
+conflicts.  Then I noticed that the IPFilter page says
+``It comes as a part of [FreeBSD-2.2 and later].''  Fair enough.  Unfortunately,
+you can't hijack connections with the FreeBSD-2.2.X IPFIREWALL code (<EM>ipfw</EM>), and
+you can't (or at least I couldn't) do it with <EM>natd</EM> either.
+<P>
+<P>FreeBSD-3.0 has much better support for connection hijacking, so I suggest
+you start with that.  You need to build a kernel with the following options:
+<PRE>
+        options         IPFIREWALL
+        options         IPFIREWALL_FORWARD
+</PRE>
+<P>
+<P>Next, its time to configure the IP firewall rules with <EM>ipfw</EM>.
+By default, there are no "allow" rules and all packets are denied.
+I added these commands to <EM>/etc/rc.local</EM>
+just to be able to use the machine on my network:
+<PRE>
+        ipfw add 60000 allow all from any to any
+</PRE>
+
+But we're still not hijacking connections.  To accomplish that,
+add these rules:
+<PRE>
+        ipfw add 49  allow tcp from 10.0.3.22 to any
+        ipfw add 50  fwd 127.0.0.1 tcp from any to any 80
+</PRE>
+
+The second line (rule 50) is the one which hijacks the connection.
+The first line makes sure we never hit rule 50 for traffic originated
+by the local machine.  This prevents forwarding loops.
+<P>
+<P>Note that I am not changing the port number here.  That is,
+port 80 packets are simply diverted to Squid on port 80.
+My Squid configuration is:
+<PRE>
+        http_port 80
+        httpd_accel_host virtual
+        httpd_accel_port 80
+        httpd_accel_with_proxy on
+        httpd_accel_uses_host_header on
+</PRE>
+<P>
+<P>If you don't want Squid to listen on port 80 (because that
+requires root privileges) then you can use another port.
+In that case your ipfw redirect rule looks like:
+<PRE>
+        ipfw add 50 fwd 127.0.0.1,3128 tcp from any to any 80
+</PRE>
+
+and the <EM>squid.conf</EM> lines are:
+<PRE>
+        http_port 3128
+        httpd_accel_host virtual
+        httpd_accel_port 80
+        httpd_accel_with_proxy on
+        httpd_accel_uses_host_header on
+</PRE>
+<P>
+<H2><A NAME="ss17.9">17.9 Interception caching with ACC Tigris digital access server</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:John.Saunders@scitec.com.au">John Saunders</A><P>This is to do with configuring interception proxy
+for an ACC Tigris digital access server (like a CISCO 5200/5300
+or an Ascend MAX 4000). I've found that doing this in the NAS
+reduces traffic on the LAN and reduces processing load on the
+CISCO. The Tigris has ample CPU for filtering.
+<P>
+<P>Step 1 is to create filters that allow local traffic to pass.
+Add as many as needed for all of your address ranges.
+<PRE>
+        ADD PROFILE IP FILTER ENTRY local1 INPUT  10.0.3.0 255.255.255.0 0.0.0.0 0.0.0.0 NORMAL
+        ADD PROFILE IP FILTER ENTRY local2 INPUT  10.0.4.0 255.255.255.0 0.0.0.0 0.0.0.0 NORMAL
+</PRE>
+<P>
+<P>Step 2 is to create a filter to trap port 80 traffic.
+<PRE>
+        ADD PROFILE IP FILTER ENTRY http INPUT  0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 = 0x6 D= 80 NORMAL
+</PRE>
+<P>
+<P>Step 3 is to set the "APPLICATION_ID" on port 80 traffic to 80.
+This causes all packets matching this filter to have ID 80
+instead of the default ID of 0.
+<PRE>
+        SET PROFILE IP FILTER APPLICATION_ID http 80
+</PRE>
+<P>
+<P>Step 4 is to create a special route that is used for
+packets with "APPLICATION_ID" set to 80. The routing
+engine uses the ID to select which routes to use.
+<PRE>
+        ADD IP ROUTE ENTRY 0.0.0.0 0.0.0.0 PROXY-IP 1
+        SET IP ROUTE APPLICATION_ID 0.0.0.0 0.0.0.0 PROXY-IP 80
+</PRE>
+<P>
+<P>Step 5 is to bind everything to a filter ID called transproxy.
+List all local filters first and the http one last.
+<PRE>
+        ADD PROFILE ENTRY transproxy local1 local2 http
+</PRE>
+<P>
+<P>With this in place use your RADIUS server to send back the
+``Framed-Filter-Id = transproxy'' key/value pair to the NAS.
+<P>
+<P>You can check if the filter is being assigned to logins with
+the following command:
+<PRE>
+        display profile port table
+</PRE>
+<P>
+<H2><A NAME="ss17.10">17.10 ``Connection reset by peer'' and Cisco policy routing</A>
+</H2>
+
+<P>
+<A HREF="mailto:fygrave at tigerteam dot net">Fyodor</A>
+has tracked down the cause of unusual ``connection reset by peer'' messages
+when using Cisco policy routing to hijack HTTP requests.
+<P>When the network link between router and the cache goes down for just a
+moment, the packets that are supposed to be redirected are instead sent
+out the default route.  If this happens, a TCP ACK from the client host
+may be sent to the origin server, instead of being diverted to the
+cache.  The origin server, upon receiving an unexpected ACK packet,
+sends a TCP RESET back to the client, which aborts the client's request.
+<P>To work around this problem, you can install a static route to the
+<EM>null0</EM> interface for the cache address with a higher metric (lower
+precedence), such as 250.  Then, when the link goes down, packets from the client
+just get dropped instead of sent out the default route.  For example, if
+1.2.3.4 is the IP address of your Squid cache, you may add:
+<PRE>
+        ip route 1.2.3.4 255.255.255.255 Null0 250
+</PRE>
+
+This appears to cause the correct behaviour.
+<P>
+<P>
+<H2><A NAME="ss17.11">17.11 WCCP - Web Cache Coordination Protocol</A>
+</H2>
+
+<P>Contributors: 
+<A HREF="mailto:glenn@ircache.net">Glenn Chisholm</A>, 
+<A HREF="mailto:ltd@cisco.com">Lincoln Dale</A> and 
+<A HREF="mailto:reuben-squid@reub.net">Reuben Farrelly</A>.
+<P>
+<H3>Does Squid support WCCP?</H3>
+
+<P>CISCO's Web Cache Coordination Protocol V1.0 is supported in squid
+2.3 and later. support WCCP V2.0.  Now that WCCP V2 is an open protocol,
+Squid may be able to support it in the future.
+<P>
+<H3>Configuring your Router</H3>
+
+<P>There are two different methods of configuring WCCP on CISCO routers.
+The first method is for routers that only support V1.0 of the
+protocol. The second is for routers that support both.
+<P>
+<H3>IOS Version 11.x</H3>
+
+<P>It is possible that later versions of IOS 11.x will support V2.0 of the
+protocol. If that is the case follow the 12.x instructions. Several
+people have reported that the squid implimentation of WCCP does not
+work with their 11.x routers. If you experience this please mail the
+debug output from your router to <EM>squid-bugs</EM>.
+<P>
+<PRE>
+        conf t
+
+        wccp enable
+        !
+        interface [Interface carrying Outgoing Traffic]x/x
+        !
+        ip wccp web-cache redirect
+        !
+        CTRL Z
+        write mem
+</PRE>
+<P>
+<H3>IOS Version 12.x</H3>
+
+<P>Some of the early versions of 12.x do not have the 'ip wccp version'
+command. You will need to upgrade your IOS version to use V1.0.
+<P>
+<P>You will need to be running at least IOS Software Release <EM>12.0(5)T</EM>
+if you're running the 12.0 T-train.  IOS Software Releases <EM>12.0(3)T</EM>
+and <EM>12.0(4)T</EM> do not have WCCPv1, but  <EM>12.0(5)T</EM> does.
+<P>
+<P>
+<PRE>
+        conf t
+
+        ip wccp version 1
+        ip wccp web-cache redirect-list 150
+        !
+        interface [Interface carrying Outgoing/Incoming Traffic]x/x
+        ip wccp web-cache redirect out|in
+        !
+        CTRL Z
+        write mem
+</PRE>
+<P>
+<P>Replace 150 with an access list number (either standard or extended) 
+which lists IP addresses which you do not wish to be transparently 
+redirected to your cache.  Otherwise simply user the word 'redirect'
+on it's own to redirect traffic from all sources to all destinations.
+<P>
+<H3>IOS 12.x problems</H3>
+
+<P>Some people report problems with WCCP and IOS 12.x.  They see
+truncated or fragmented GRE packets arriving at the cache.  Apparently
+it works if you disable Cisco Express Forwarding for the interface:
+<PRE>
+conf t
+ip cef          # some systems may already have 'ip cef global'
+int Ethernet 0/0      (or int FastEthernet 0/0 or other internal interface)
+no ip route-cache cef
+CTRL Z
+</PRE>
+<P>This may well be fixed in later releases of IOS.
+<P>
+<H3>Configuring FreeBSD</H3>
+
+<P>FreeBSD first needs to be configured to receive and strip the GRE 
+encapsulation from the packets from the router. To do this you will
+need to patch and recompile your kernel.
+<P>
+<P>First, a patch needs to be applied to your kernel for GRE
+support. Apply the
+<A HREF="../../WCCP-support/FreeBSD-3.x/gre.patch">patch for FreeBSD-3.x kernels</A>
+or the
+<A HREF="../../WCCP-support/FreeBSD-4.x/gre.patch">patch for FreeBSD-4.x kernels</A>
+as appropriate.
+<P>
+<P>Secondly you will need to download
+<A HREF="../../WCCP-support/FreeBSD-3.x/gre.c">gre.c for FreeBSD-3.x</A>
+or 
+<A HREF="../../WCCP-support/FreeBSD-4.x/gre.c">gre.c for FreeBSD-4.x</A>
+and copy it to <EM>/usr/src/sys/netinet/gre.c</EM>. 
+<P>
+<P>Finally add "OPTION GRE" to your kernel config file and rebuild
+your kernel. Note, the <EM>opt_gre.h</EM> file is
+created when you run <EM>config</EM>.
+Once your kernel is installed you will need to
+<A HREF="#trans-freebsd">configure FreeBSD for interception proxying</A>.
+<P>
+<H3>Configuring Linux 2.2</H3>
+
+<P>Al Blake has written a 
+<A HREF="http://www.spc.int/it/TechHead/Wccp-squid.html">Cookbook for setting up transparent WCCP using Squid on RedHat Linux and a cisco access server</A>.
+<P>
+<P>There are currently two methods for supporting WCCP with Linux 2.2.
+A specific purpose module. Or the standard Linux GRE tunneling
+driver. People have reported difficulty with the standard GRE
+tunneling driver, however it does allow GRE functionality other
+than WCCP. You should choose the method that suits your enviroment.
+<P>
+<H3>Standard Linux GRE Tunnel</H3>
+
+<P>Linux 2.2 kernels already support GRE, as long as the GRE module is
+compiled into the kernel.
+<P>
+<P>You will need to patch the <EM>ip_gre.c</EM> code that comes with your Linux
+kernel with this 
+<A HREF="http://www.vsb.cz/~hal01/cache/wccp/ip_gre.patch">patch</A> supplied by 
+<A HREF="mailto:Jan.Haluza@vsb.cz">Jan Haluza</A>.
+<P>
+<P>Ensure that the GRE code is either built as static or as a module by chosing
+the appropriate option in your kernel config. Then rebuild your kernel.
+If it is a module you will need to:
+<PRE>
+        modprobe ip_gre
+</PRE>
+<P>The next step is to tell Linux to establish an IP tunnel between the router and
+your host.  Daniele Orlandi  reports
+that you have to give the gre1 interface an address, but any old
+address seems to work.
+<PRE>
+        iptunnel add gre1 mode gre remote &lt;Router-IP&gt; local &lt;Host-IP&gt; dev &lt;interface&gt;
+        ifconfig gre1 127.0.0.2 up
+</PRE>
+
+&lt;Router-IP&gt; is the IP address of your router that is intercepting the 
+HTTP packets.  &lt;Host-IP&gt; is the IP address of your cache, and
+&lt;interface&gt; is the network interface that receives those packets (probably eth0).
+<P>
+<H3>Joe Cooper's Patch</H3>
+
+<P>Joe Cooper has a patch for Linux 2.2.18 kernel on his 
+<A HREF="http://www.swelltech.com/pengies/joe/patches/">Squid page</A>.
+<P>
+<H3>WCCP Specific Module</H3>
+
+<P>This module is not part of the standard Linux distributon. It needs
+to be compiled as a module and loaded on your system to function.
+Do not attempt to build this in as a static part of your kernel.
+<P>
+<P>Download the 
+<A HREF="../../WCCP-support/Linux/ip_wccp.c">Linux WCCP module</A>
+and compile it as you would any Linux network module.
+<P>
+<P>Copy the module to <EM>/lib/modules/kernel-version/ipv4/ip_wccp.o</EM>. Edit
+<EM>/lib/modules/kernel-version/modules.dep</EM> and add:
+<P>
+<PRE>
+        /lib/modules/kernel-version/ipv4/ip_wccp.o:
+</PRE>
+<P>
+<P>Finally you will need to load the module:
+<P>
+<PRE>
+        modprobe ip_wccp
+</PRE>
+<P>
+<H3>Common Steps</H3>
+
+<P>The machine should now be striping the GRE encapsulation from any packets
+recieved and requeuing them. The system will also need to be configured
+for interception proxying, either with 
+<A HREF="#trans-linux-1">ipfwadm</A> 
+or with 
+<A HREF="#trans-linux-2">ipchains</A>.
+<P>
+<H3>Configuring Others</H3>
+
+<P>If you have managed to configuring your operating system to support WCCP
+with Squid
+please contact us with the details so we may share them with others.
+<P>
+<H2><A NAME="ss17.12">17.12 Can someone tell me what version of cisco IOS WCCP is added in?</A>
+</H2>
+
+<P>IOS releases:
+<UL>
+<LI>11.1(19?)CA/CC or later</LI>
+<LI>11.2(14)P or later</LI>
+<LI>12.0(anything) or later</LI>
+</UL>
+<P>
+<H2><A NAME="ss17.13">17.13 What about WCCPv2?</A>
+</H2>
+
+<P>Cisco has published WCCPv2 as an 
+<A HREF="http://www.web-cache.com/Writings/Internet-Drafts/draft-wilson-wrec-wccp-v2-00.txt">Internet Draft</A> (expired Jan 2001).  
+At this point, Squid does not support WCCPv2, but anyone 
+is welcome to code it up and contribute to the Squid project.
+<P>
+<H2><A NAME="ss17.14">17.14 Interception caching with Foundry L4 switches</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:signal at shreve dot net">Brian Feeny</A>.
+<P>First, configure Squid for interception caching as detailed
+at the 
+<A HREF="#trans-caching">beginning of this section</A>.
+<P>Next, configure
+the Foundry layer 4 switch to 
+redirect traffic to your Squid box or boxes.  By default,
+the Foundry
+redirects to port 80 of your squid box.  This can
+be changed to a different port if needed, but won't be covered
+here.  
+<P>
+<P>In addition, the switch does a "health check" of the port to make 
+sure your squid is answering.  If you squid does not answer, the
+switch defaults to sending traffic directly thru instead of 
+redirecting it.  When the Squid comes back up, it begins
+redirecting once again.
+<P>
+<P>This example assumes you have two squid caches:
+<PRE>
+squid1.foo.com  192.168.1.10
+squid2.foo.com  192.168.1.11
+</PRE>
+<P>
+<P>We will assume you have various workstations, customers, etc, plugged
+into the switch for which you want them to be intercepted and sent to Squid.
+The squid caches themselves should be plugged into the switch as well.
+Only the interface that the router is connected to is important.  Where you
+put the squid caches or other connections does not matter.
+<P>
+<P>This example assumes your router is plugged into interface <B>17</B>
+of the switch.  If not, adjust the following commands accordingly.
+<P>
+<OL>
+<LI>Enter configuration mode:
+<PRE>
+telnet@ServerIron#conf t
+</PRE>
+
+</LI>
+<LI>Configure each squid on the Foundry:
+<PRE>
+telnet@ServerIron(config)# server cache-name squid1 192.168.1.10
+telnet@ServerIron(config)# server cache-name squid2 192.168.1.11
+</PRE>
+
+</LI>
+<LI>Add the squids to a cache-group:
+<PRE>
+telnet@ServerIron(config)#server cache-group 1
+telnet@ServerIron(config-tc-1)#cache-name squid1
+telnet@ServerIron(config-tc-1)#cache-name squid2
+</PRE>
+
+</LI>
+<LI>Create a policy for caching http on a local port
+<PRE>
+telnet@ServerIron(config)# ip policy 1 cache tcp http local
+</PRE>
+
+</LI>
+<LI>Enable that policy on the port connected to your router
+<PRE>
+telnet@ServerIron(config)#int e 17
+telnet@ServerIron(config-if-17)# ip-policy 1 
+</PRE>
+
+</LI>
+</OL>
+<P>
+<P>Since all outbound traffic to the Internet goes out interface
+<B>17</B> (the router), and interface <B>17</B> has the caching policy applied to
+it, HTTP traffic is going to be intercepted and redirected to the 
+caches you have configured.
+<P>
+<P>The default port to redirect to can be changed.  The load balancing
+algorithm used can be changed (Least Used, Round Robin, etc).  Ports
+can be exempted from caching if needed.  Access Lists can be applied
+so that only certain source IP Addresses are redirected, etc.  This
+information was left out of this document since this was just a quick
+howto that would apply for most people, not meant to be a comprehensive
+manual of how to configure a Foundry switch.  I can however revise this
+with any information necessary if people feel it should be included.
+<P>
+<H2><A NAME="ss17.15">17.15 Can I use <EM>proxy_auth</EM> with interception?</A>
+</H2>
+
+<P>No, you cannot.  With interception proxying, the client thinks
+it is talking to an origin server and would never send the
+<EM>Proxy-authorization</EM> request header.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-18.html">Next</A>
+<A HREF="FAQ-16.html">Previous</A>
+<A HREF="FAQ.html#toc17">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-18.html
+++ squid-2.5.9/debian/doc/FAQ-18.html
@@ -0,0 +1,198 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: SNMP</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-19.html">Next</A>
+<A HREF="FAQ-17.html">Previous</A>
+<A HREF="FAQ.html#toc18">Contents</A>
+<HR>
+<H2><A NAME="s18">18. SNMP</A></H2>
+
+<P>Contributors: 
+<A HREF="mailto:glenn@ircache.net">Glenn Chisholm</A>.
+<P>
+<H2><A NAME="ss18.1">18.1 Does Squid support SNMP?</A>
+</H2>
+
+<P>True SNMP support is available in squid 2 and above. A significant change in the implimentation
+occured starting with the development 2.2 code. Therefore there are two sets of instructions
+on how to configure SNMP in squid, please make sure that you follow the correct one.
+<P>
+<H2><A NAME="ss18.2">18.2 Enabling SNMP in Squid</A>
+</H2>
+
+<P>To use SNMP, it must first be enabled with the <EM>configure</EM> script,
+and squid rebuilt. To enable is first run the script:
+<PRE>
+        ./configure --enable-snmp  [ ... other configure options ]
+</PRE>
+
+Next, recompile after cleaning the source tree :
+<PRE>
+        make clean
+        make all
+        make install
+</PRE>
+
+Once the compile is completed and the new binary is installed the <EM>squid.conf</EM> file
+needs to be configured to allow access; the default is to deny all requests. The
+instructions on how to do this have been broken into two parts, the first for all versions
+of Squid from 2.2 onwards and the second for 2.1 and below.
+<P>
+<H2><A NAME="ss18.3">18.3 Configuring Squid 2.2</A>
+</H2>
+
+<P>To configure SNMP first specify a list of communities that you would like to allow access
+by using a standard acl of the form:
+<PRE>
+        acl aclname snmp_community string
+</PRE>
+
+For example:
+<PRE>
+        acl snmppublic snmp_community public
+        acl snmpjoebloggs snmp_community joebloggs
+</PRE>
+
+This creates two acl's, with two different communities, public and joebloggs. You can
+name the acl's and the community strings anything that you like.
+<P>
+<P>To specify the port that the agent will listen on modify the "snmp_port" parameter,
+it is defaulted to 3401. The port that the agent will forward requests that can
+not be furfilled by this agent to is set by "forward_snmpd_port" it is defaulted
+to off. It must be configured for this to work. Remember that as the requests will
+be originating from this agent you will need to make sure that you configure
+your access accordingly.
+<P>
+<P>To allow access to Squid's SNMP agent, define an <EM>snmp_access</EM> ACL with the community
+strings that you previously defined.
+For example:
+<PRE>
+        snmp_access allow snmppublic localhost
+        snmp_access deny all
+</PRE>
+
+The above will allow anyone on the localhost who uses the community <EM>public</EM> to
+access the agent. It will deny all others access.
+<P>
+<P>If you do not define any <EM>snmp_access</EM> ACL's, then
+SNMP access is denied by default.
+<P>
+<P>Finally squid allows to you to configure the address that the agent will bind to
+for incomming and outgoing traffic. These are defaulted to 0.0.0.0, changing these
+will cause the agent to bind to a specific address on the host, rather than the
+default which is all.
+<PRE>
+        snmp_incoming_address 0.0.0.0
+        snmp_outgoing_address 0.0.0.0
+</PRE>
+<P>
+<H2><A NAME="ss18.4">18.4 Configuring Squid 2.1</A>
+</H2>
+
+<P>Prior to Squid 2.1 the SNMP code had a number of issues with the ACL's. If you are
+a frequent user of SNMP with Squid, please upgrade to 2.2 or higher.
+<P>
+<P>A sort of default, working configuration is:
+<PRE>
+        snmp_port 3401
+        snmp_mib_path /local/squid/etc/mib.txt
+
+        snmp_agent_conf view all .1.3.6 included
+        snmp_agent_conf view squid .1.3.6 included
+        snmp_agent_conf user squid - all all public
+        snmp_agent_conf user all all all all  squid
+        snmp_agent_conf community public squid squid
+        snmp_agent_conf community readwrite all all
+</PRE>
+<P>Note that for security you are advised to restrict SNMP access to your
+caches. You can do this easily as follows:
+<PRE>
+        acl snmpmanagementhosts 1.2.3.4/255.255.255.255 1.2.3.0/255.255.255.0
+        snmp_acl public deny all !snmpmanagementhosts
+        snmp_acl readwrite deny all
+</PRE>
+
+You must follow these instructions for 2.1 and below exactly or you are
+likely to have problems. The parser has some issues which have been corrected
+in 2.2.
+<P>
+<H2><A NAME="ss18.5">18.5 How can I query the Squid SNMP Agent</A>
+</H2>
+
+<P>You can test if your Squid supports SNMP with the <EM>snmpwalk</EM> program
+(<EM>snmpwalk</EM> is a part of the
+<A HREF="http://net-snmp.sourceforge.net/">NET-SNMP project</A>).
+Note that you have to specify the SNMP port, which in Squid defaults to
+3401.
+<PRE>
+        snmpwalk -p 3401 hostname communitystring .1.3.6.1.4.1.3495.1.1
+</PRE>
+
+If it gives output like:
+<PRE>
+        enterprises.nlanr.squid.cacheSystem.cacheSysVMsize = 7970816
+        enterprises.nlanr.squid.cacheSystem.cacheSysStorage = 2796142
+        enterprises.nlanr.squid.cacheSystem.cacheUptime = Timeticks: (766299) 2:07:42.99
+</PRE>
+
+then it is working ok, and you should be able to make nice statistics out of it.
+<P>
+<P>For an explanation of what every string (OID) does, you should
+refer to the 
+<A HREF="/SNMP/">Squid SNMP web pages</A>.
+<P>
+<H2><A NAME="ss18.6">18.6 What can I use SNMP and Squid for?</A>
+</H2>
+
+<P>There are a lot of things you can do with SNMP and Squid. It can be useful
+in some extent for a longer term overview of how your proxy is doing. It can
+also be used as a problem solver. For example: how is it going with your
+filedescriptor usage? or how much does your LRU vary along a day. Things
+you can't monitor very well normally, aside from clicking at the cachemgr
+frequently. Why not let MRTG do it for you?
+<P>
+<H2><A NAME="ss18.7">18.7 How can I use SNMP with Squid?</A>
+</H2>
+
+<P>There are a number of tools that you can use to monitor Squid via
+SNMP.  Many people use MRTG.  Another good combination is 
+<A HREF="http://net-snmp.sourceforge.net/">NET-SNMP</A> plus 
+<A HREF="http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/">RRDTool</A>.  You might be able to find more
+information at the 
+<A HREF="/SNMP/">Squid SNMP web pages</A>.
+<P>
+<P>
+<H3>MRTG</H3>
+
+<P>Some people use 
+<A HREF="http://www.mrtg.org/">MRTG</A>
+to query Squid through its SNMP interface.
+<P>
+<P>To get instruction on using MRTG with Squid please visit these pages:
+<OL>
+<LI>
+<A HREF="http://unary.calvin.edu/squid.html">Squid + MRTG graphs</A></LI>
+</OL>
+<P>
+<H2><A NAME="ss18.8">18.8 Where can I get more information/discussion about Squid and SNMP?</A>
+</H2>
+
+<P>General Discussion: 
+<A HREF="mailto:cache-snmp@ircache.net">cache-snmp@ircache.net</A>
+These messages are 
+<A HREF="http://www.squid-cache.org/mail-archive/cache-snmp/">archived</A>.
+<P>
+<P>Subscriptions should be sent to: 
+<A HREF="mailto:cache-snmp-request@ircache.net">cache-snmp-request@ircache.net</A>.
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-19.html">Next</A>
+<A HREF="FAQ-17.html">Previous</A>
+<A HREF="FAQ.html#toc18">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-19.html
+++ squid-2.5.9/debian/doc/FAQ-19.html
@@ -0,0 +1,664 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Squid version 2</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-20.html">Next</A>
+<A HREF="FAQ-18.html">Previous</A>
+<A HREF="FAQ.html#toc19">Contents</A>
+<HR>
+<H2><A NAME="s19">19. Squid version 2</A></H2>
+
+<H2><A NAME="ss19.1">19.1 What are the new features?</A>
+</H2>
+
+<P>
+<UL>
+<LI>persistent connections.</LI>
+<LI>Lower VM usage; in-transit objects are not held fully in memory.</LI>
+<LI>Totally independent swap directories.</LI>
+<LI>Customizable error texts.</LI>
+<LI>FTP supported internally; no more ftpget.</LI>
+<LI>Asynchronous disk operations (optional, requires pthreads library).</LI>
+<LI>Internal icons for FTP and gopher directories.</LI>
+<LI>snprintf() used everywhere instead of sprintf().</LI>
+<LI>SNMP.</LI>
+<LI>
+<A HREF="/urn-support.html">URN support</A></LI>
+<LI>Routing requests based on AS numbers.</LI>
+<LI>
+<A HREF="FAQ-16.html">Cache Digests</A></LI>
+<LI>...and many more!</LI>
+</UL>
+<P>
+<P>
+<P>
+<H2><A NAME="ss19.2">19.2 How do I configure 'ssl_proxy' now?</A>
+</H2>
+
+<P>By default, Squid connects directly to origin servers for SSL requests.
+But if you must force SSL requests through a parent, first tell Squid
+it can not go direct for SSL:
+<PRE>
+        acl SSL method CONNECT
+        never_direct allow SSL
+</PRE>
+
+With this in place, Squid <EM>should</EM> pick one of your parents to
+use for SSL requests.  If you want it to pick a particular parent,
+you must use the <EM>cache_peer_access</EM> configuration:
+<PRE>
+        cache_peer parent1 parent 3128 3130
+        cache_peer parent2 parent 3128 3130
+        cache_peer_access parent2 allow !SSL
+</PRE>
+
+The above lines tell Squid to NOT use <EM>parent2</EM> for SSL, so it
+should always use <EM>parent1</EM>.
+<P>
+<H2><A NAME="ss19.3">19.3 Logfile rotation doesn't work with Async I/O</A>
+</H2>
+
+<P>It is a know limitation when using Async I/O on Linux. The Linux
+Threads package steals (uses internally) the SIGUSR1 signal that squid uses
+to rotate logs.
+<P>
+<P>In order to not disturb the threads package SIGUSR1 use is disabled in
+Squid when threads is enabled on Linux.
+<P>
+<H2><A NAME="ss19.4">19.4 Adding a new cache disk</A>
+</H2>
+
+<P>Simply add your new <EM>cache_dir</EM> line to <EM>squid.conf</EM>, then
+run <EM>squid -z</EM> again.  Squid will create swap directories on the
+new disk and leave the existing ones in place.
+<P>
+<H2><A NAME="ss19.5">19.5 Squid 2 performs badly on Linux</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:hno@squid-cache.org">Henrik Nordstrom</A><P>You may have enabled Asyncronous I/O with the <EM>--enable-async-io</EM>
+configure option.
+Be careful when using threads on Linux. Most versions of libc5 and
+very early versions of glibc have problems with threaded applications.
+I would not recommend <EM>--enable-async-io</EM> on Linux unless your system
+uses glibc 2.1.3 or later.
+<P>
+<P>You should also know that <EM>--enable-async-io</EM> is not optimal unless
+you have a very busy cache. For low loads the cache performs slightly
+better without <EM>--enable-async-io</EM>.
+<P>Try recompiling Squid without <EM>--enable-async-io</EM>. If a non-threaded
+Squid performs better then your libc probably can't handle threads
+correctly. (don't forget "make clean" after running configure)
+<P>
+<H2><A NAME="configuring-proxy-auth"></A> <A NAME="ss19.6">19.6 How do I configure proxy authentication with Squid-2?</A>
+</H2>
+
+<P>For Squid-2, the implementation and configuration has changed.
+Authentication is now handled via external processes.
+Arjan's 
+<A HREF="http://www.iae.nl/users/devet/squid/proxy_auth/">proxy auth page</A>
+describes how to set it up.  Some simple instructions are given below as well.
+<P>
+<OL>
+<LI>We assume you have configured an ACL entry with proxy_auth, for example:
+<PRE>
+        acl foo proxy_auth REQUIRED
+        http_access allow foo
+</PRE>
+
+</LI>
+<LI>You will need to compile and install an external authenticator program.
+Most people will want to use <EM>ncsa_auth</EM>.  The source for this program
+is included in the source distribution, in the <EM>auth_modules/NCSA</EM>
+directory.
+<PRE>
+        % cd auth_modules/NCSA
+        % make
+        % make install
+</PRE>
+
+You should now have an <EM>ncsa_auth</EM> program in the same directory where
+your <EM>squid</EM> binary lives.
+</LI>
+<LI>You may need to create a password file.  If you have been using
+proxy authentication before, you probably already have such a file.
+You can get 
+<A HREF="../../htpasswd/">apache's htpasswd program</A>
+from our server.  Pick a pathname for your password file.  We will assume
+you will want to put it in the same directory as your squid.conf.
+</LI>
+<LI>Configure the external authenticator in <EM>squid.conf</EM>.
+For <EM>ncsa_auth</EM> you need to give the pathname to the executable and
+the password file as an argument.  For example:
+<PRE>
+        authenticate_program /usr/local/squid/bin/ncsa_auth /usr/local/squid/etc/passwd
+</PRE>
+</LI>
+</OL>
+<P>
+<P>After all that, you should be able to start up Squid.  If we left something out, or
+haven't been clear enough, please let us know (squid-faq@squid-cache.org).
+<P>
+<H2><A NAME="ss19.7">19.7 Why does proxy-auth reject all users with Squid-2.2?</A>
+</H2>
+
+<P>The ACL for proxy-authentication has changed from:
+<PRE>
+        acl foo proxy_auth timeout
+</PRE>
+
+to:
+<PRE>
+        acl foo proxy_auth username
+</PRE>
+
+Please update your ACL appropriately - a username of <EM>REQUIRED</EM> will permit
+all valid usernames.  The timeout is now specified with the configuration
+option:
+<PRE>
+        authenticate_ttl timeout
+</PRE>
+<P>
+<H2><A NAME="ss19.8">19.8 Delay Pools</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:david@luyer.net">David Luyer</A>.
+<P>
+<P><B>The information here is current for version 2.2.  It is strongly
+recommended that you use at least Squid 2.2 if you wish to use delay pools.</B>
+<P>
+<P>Delay pools provide a way to limit the bandwidth of certain requests
+based on any list of criteria.  The idea came from a Western Australian
+university who wanted to restrict student traffic costs (without
+affecting staff traffic, and still getting cache and local peering hits
+at full speed).  There was some early Squid 1.0 code by Central Network
+Services at Murdoch University, which I then developed (at the University
+of Western Australia) into a much more complex patch for Squid 1.0
+called ``DELAY_HACK.''  I then tried to code it in a much cleaner style
+and with slightly more generic options than I personally needed, and
+called this ``delay pools'' in Squid 2.  I almost completely recoded
+this in Squid 2.2 to provide the greater flexibility requested by people
+using the feature.
+<P>
+<P>To enable delay pools features in Squid 2.2, you must use the
+<EM>--enable-delay-pools</EM> configure option before compilation.
+<P>
+<P>Terminology for this FAQ entry:
+<P>
+<DL>
+<DT><B>pool</B><DD><P>a collection of bucket groups as appropriate to a given class
+<P>
+<DT><B>bucket group</B><DD><P>a group of buckets within a pool, such as the per-host bucket
+group, the per-network bucket group or the aggregate bucket
+group (the aggregate bucket group is actually a single bucket)
+<P>
+<DT><B>bucket</B><DD><P>an individual delay bucket represents a traffic allocation
+which is replenished at a given rate (up to a given limit) and
+causes traffic to be delayed when empty
+<P>
+<DT><B>class</B><DD><P>the class of a delay pool determines how the delay is applied,
+ie, whether the different client IPs are treated seperately or
+as a group (or both)
+<P>
+<DT><B>class 1</B><DD><P>a class 1 delay pool contains a single unified bucket which is
+used for all requests from hosts subject to the pool
+<P>
+<DT><B>class 2</B><DD><P>a class 2 delay pool contains one unified bucket and 255
+buckets, one for each host on an 8-bit network (IPv4 class C)
+<P>
+<DT><B>class 3</B><DD><P>contains 255 buckets for the subnets in a 16-bit network, and
+individual buckets for every host on these networks (IPv4 class
+B)
+<P>
+</DL>
+<P>
+<P>Delay pools allows you to limit traffic for clients or client groups,
+with various features:
+<UL>
+<LI>can specify peer hosts which aren't affected by delay pools,
+ie, local peering or other 'free' traffic (with the
+<EM>no-delay</EM> peer option).
+</LI>
+<LI>delay behavior is selected by ACLs (low and high priority
+traffic, staff vs students or student vs authenticated student
+or so on).
+</LI>
+<LI>each group of users has a number of buckets, a bucket has an
+amount coming into it in a second and a maximum amount it can
+grow to; when  it reaches zero, objects reads are deferred
+until one of the object's clients has some traffic allowance.
+</LI>
+<LI>any number of pools can be configured with a given class and
+any set of limits within the pools can be disabled, for example
+you might only want to use the aggregate and per-host bucket
+groups of class 3, not the per-network one.
+</LI>
+</UL>
+<P>
+<P>This allows options such as creating a number of class 1 delay pools
+and allowing a certain amount of bandwidth to given object types (by
+using URL regular expressions or similar), and many other uses I'm sure
+I haven't even though of beyond the original fair balancing of a
+relatively small traffic allocation across a large number of users.
+<P>
+<P>There are some limitations of delay pools:
+<UL>
+<LI>delay pools are incompatible with slow aborts; quick abort
+should be set fairly low to prevent objects being retrived at
+full speed once there are no clients requesting them (as the
+traffic allocation is based on the current clients, and when
+there are no clients attached to the object there is no way to
+determine the traffic allocation).</LI>
+<LI>delay pools only limits the actual data transferred and is not
+inclusive of overheads such as TCP overheads, ICP, DNS, icmp
+pings, etc.</LI>
+<LI>it is possible for one connection or a small number of
+connections to take all the bandwidth from a given bucket and
+the other connections to be starved completely, which can be a
+major problem if there are a number of large objects being
+transferred and the parameters are set in a way that a few
+large objects will cause all clients to be starved (potentially
+fixed by a currently experimental patch).</LI>
+</UL>
+<P>
+<H3>How can I limit Squid's total bandwidth to, say, 512 Kbps?</H3>
+
+<P>
+<PRE>
+        acl all src 0.0.0.0/0.0.0.0             # might already be defined
+        delay_pools 1
+        delay_class 1 1
+        delay_access 1 allow all
+        delay_parameters 1 64000/64000          # 512 kbits == 64 kbytes per second
+</PRE>
+<P><B>For an explanation of these tags please see the configuration file.</B>
+<P>
+<P>
+<P>The 1 second buffer (max = restore = 64kbytes/sec) is because a limit
+is requested, and no responsiveness to a busrt is requested. If you
+want it to be able to respond to a burst, increase the aggregate_max to
+a larger value, and traffic bursts will be handled.  It is recommended
+that the maximum is at least twice the restore value - if there is only
+a single object being downloaded, sometimes the download rate will fall
+below the requested throughput as the bucket is not empty when it comes
+to be replenished.
+<P>
+<H3>How to limit a single connection to 128 Kbps?</H3>
+
+<P>You can not limit a single HTTP request's connection speed.  You
+<EM>can</EM> limit individual hosts to some bandwidth rate.  To limit a
+specific host, define an <EM>acl</EM> for that host and use the example
+above.  To limit a group of hosts, then you must use a delay pool of
+class 2 or 3.  For example:
+<PRE>
+        acl only128kusers src 192.168.1.0/255.255.192.0
+        acl all src 0.0.0.0/0.0.0.0
+        delay_pools 1
+        delay_class 1 3
+        delay_access 1 allow only128kusers
+        delay_access 1 deny all
+        delay_parameters 1 64000/64000 -1/-1 16000/64000
+</PRE>
+
+<B>For an explanation of these tags please see the configuration file.</B>
+<P>The above gives a solution where a cache is given a total of 512kbits to
+operate in, and each IP address gets only 128kbits out of that pool.
+<P>
+<H3>How do you personally use delay pools?</H3>
+
+<P>We have six local cache peers, all with the options 'proxy-only no-delay'
+since they are fast machines connected via a fast ethernet and microwave (ATM)
+network.
+<P>
+<P>For our local access we use a dstdomain ACL, and for delay pool exceptions
+we use a dst ACL as well since the delay pool ACL processing is done using
+"fast lookups", which means (among other things) it won't wait for a DNS
+lookup if it would need one.
+<P>
+<P>Our proxy has two virtual interfaces, one which requires student
+authentication to connect from machines where a department is not
+paying for traffic, and one which uses delay pools.  Also, users of the
+main Unix system are allowed to choose slow or fast traffic, but must
+pay for any traffic they do using the fast cache.  Ident lookups are
+disabled for accesses through the slow cache since they aren't needed.
+Slow accesses are delayed using a class 3 delay pool to give fairness
+between departments as well as between users.  We recognize users of
+Lynx on the main host are grouped together in one delay bucket but they
+are mostly viewing text pages anyway, so this isn't considered a
+serious problem.  If it was we could take those hosts into a class 1
+delay pool and give it a larger allocation.
+<P>
+<P>I prefer using a slow restore rate and a large maximum rate to give
+preference to people who are looking at web pages as their individual
+bucket fills while they are reading, and those downloading large
+objects are disadvantaged.  This depends on which clients you believe
+are more important.  Also, one individual 8 bit network (a residential
+college) have paid extra to get more bandwidth.
+<P>
+<P>The relevant parts of my configuration file are (IP addresses, etc, all
+changed):
+<PRE>
+        # ACL definitions
+        # Local network definitions, domains a.net, b.net
+        acl LOCAL-NET dstdomain a.net b.net
+        # Local network; nets 64 - 127.  Also nearby network class A, 10.
+        acl LOCAL-IP dst 192.168.64.0/255.255.192.0 10.0.0.0/255.0.0.0
+        # Virtual i/f used for slow access
+        acl virtual_slowcache myip 192.168.100.13/255.255.255.255
+        # All permitted slow access, nets 96 - 127
+        acl slownets src 192.168.96.0/255.255.224.0
+        # Special 'fast' slow access, net 123
+        acl fast_slow src 192.168.123.0/255.255.255.0
+        # User hosts
+        acl my_user_hosts src 192.168.100.2/255.255.255.254
+        # "All" ACL
+        acl all src 0.0.0.0/0.0.0.0
+
+        # Don't need ident lookups for billing on (free) slow cache
+        ident_lookup_access allow my_user_hosts !virtual_slowcache
+        ident_lookup_access deny all
+
+        # Security access checks
+        http_access [...]
+
+        # These people get in for slow cache access
+        http_access allow virtual_slowcache slownets
+        http_access deny virtual_slowcache
+
+        # Access checks for main cache
+        http_access [...]
+
+        # Delay definitions (read config file for clarification)
+        delay_pools 2
+        delay_initial_bucket_level 50
+
+        delay_class 1 3
+        delay_access 1 allow virtual_slowcache !LOCAL-NET !LOCAL-IP !fast_slow
+        delay_access 1 deny all
+        delay_parameters 1 8192/131072 1024/65536 256/32768
+
+        delay_class 2 2
+        delay_access 2 allow virtual_slowcache !LOCAL-NET !LOCAL-IP fast_slow
+        delay_access 2 deny all
+        delay_parameters 2 2048/65536 512/32768
+</PRE>
+<P>
+<P>The same code is also used by a some of departments using class 2 delay
+pools to give them more flexibility in giving different performance to
+different labs or students.
+<P>
+<H3>Where else can I find out about delay pools?</H3>
+
+<P>This is also pretty well documented in the configuration file, with
+examples.  Since people seem to loose their config files, here's a copy
+of the relevant section.
+<P>
+<PRE>
+# DELAY POOL PARAMETERS (all require DELAY_POOLS compilation option)
+# -----------------------------------------------------------------------------
+
+#  TAG: delay_pools
+#       This represents the number of delay pools to be used.  For example,
+#       if you have one class 2 delay pool and one class 3 delays pool, you
+#       have a total of 2 delay pools.
+#
+#       To enable this option, you must use --enable-delay-pools with the
+#       configure script.
+#delay_pools 0
+
+#  TAG: delay_class
+#       This defines the class of each delay pool.  There must be exactly one
+#       delay_class line for each delay pool.  For example, to define two
+#       delay pools, one of class 2 and one of class 3, the settings above
+#       and here would be:
+#
+#delay_pools 2      # 2 delay pools
+#delay_class 1 2    # pool 1 is a class 2 pool
+#delay_class 2 3    # pool 2 is a class 3 pool
+#
+#       The delay pool classes are:
+#
+#               class 1         Everything is limited by a single aggregate
+#                               bucket.
+#
+#               class 2         Everything is limited by a single aggregate
+#                               bucket as well as an "individual" bucket chosen
+#                               from bits 25 through 32 of the IP address.
+#
+#               class 3         Everything is limited by a single aggregate
+#                               bucket as well as a "network" bucket chosen
+#                               from bits 17 through 24 of the IP address and a
+#                               "individual" bucket chosen from bits 17 through
+#                               32 of the IP address.
+#
+#       NOTE: If an IP address is a.b.c.d
+#               -> bits 25 through 32 are "d"
+#               -> bits 17 through 24 are "c"
+#               -> bits 17 through 32 are "c * 256 + d"
+
+#  TAG: delay_access
+#       This is used to determine which delay pool a request falls into.
+#       The first matched delay pool is always used, ie, if a request falls
+#       into delay pool number one, no more delay are checked, otherwise the
+#       rest are checked in order of their delay pool number until they have
+#       all been checked.  For example, if you want some_big_clients in delay
+#       pool 1 and lotsa_little_clients in delay pool 2:
+#
+#delay_access 1 allow some_big_clients
+#delay_access 1 deny all
+#delay_access 2 allow lotsa_little_clients
+#delay_access 2 deny all
+
+#  TAG: delay_parameters
+#       This defines the parameters for a delay pool.  Each delay pool has
+#       a number of "buckets" associated with it, as explained in the
+#       description of delay_class.  For a class 1 delay pool, the syntax is:
+#
+#delay_parameters pool aggregate
+#
+#       For a class 2 delay pool:
+#
+#delay_parameters pool aggregate individual
+#
+#       For a class 3 delay pool:
+#
+#delay_parameters pool aggregate network individual
+#
+#       The variables here are:
+#
+#               pool            a pool number - ie, a number between 1 and the
+#                               number specified in delay_pools as used in
+#                               delay_class lines.
+#
+#               aggregate       the "delay parameters" for the aggregate bucket
+#                               (class 1, 2, 3).
+#
+#               individual      the "delay parameters" for the individual
+#                               buckets (class 2, 3).
+#
+#               network         the "delay parameters" for the network buckets
+#                               (class 3).
+#
+#       A pair of delay parameters is written restore/maximum, where restore is
+#       the number of bytes (not bits - modem and network speeds are usually
+#       quoted in bits) per second placed into the bucket, and maximum is the
+#       maximum number of bytes which can be in the bucket at any time.
+#
+#       For example, if delay pool number 1 is a class 2 delay pool as in the
+#       above example, and is being used to strictly limit each host to 64kbps
+#       (plus overheads), with no overall limit, the line is:
+#
+#delay_parameters 1 -1/-1 8000/8000
+#
+#       Note that the figure -1 is used to represent "unlimited".
+#
+#       And, if delay pool number 2 is a class 3 delay pool as in the above
+#       example, and you want to limit it to a total of 256kbps (strict limit)
+#       with each 8-bit network permitted 64kbps (strict limit) and each
+#       individual host permitted 4800bps with a bucket maximum size of 64kb
+#       to permit a decent web page to be downloaded at a decent speed
+#       (if the network is not being limited due to overuse) but slow down
+#       large downloads more significantly:
+#
+#delay_parameters 2 32000/32000 8000/8000 600/8000
+#
+#       There must be one delay_parameters line for each delay pool.
+
+#  TAG: delay_initial_bucket_level      (percent, 0-100)
+#       The initial bucket percentage is used to determine how much is put
+#       in each bucket when squid starts, is reconfigured, or first notices
+#       a host accessing it (in class 2 and class 3, individual hosts and
+#       networks only have buckets associated with them once they have been
+#       "seen" by squid).
+#
+#delay_initial_bucket_level 50
+</PRE>
+<P>
+<H2><A NAME="ss19.9">19.9 Can I preserve my cache when upgrading from 1.1 to 2?</A>
+</H2>
+
+<P>At the moment we do not have a script which will convert your cache
+contents from the 1.1 to the Squid-2 format.  If enough people ask for
+one, then somebody will probably write such a script.
+<P>
+<P>If you like, you can configure a new Squid-2 cache with your old
+Squid-1.1 cache as a sibling.  After a few days, weeks, or
+however long you want to wait, shut down the old Squid cache.
+If you want to force-load your new cache with the objects
+from the old cache, you can try something like this:
+<OL>
+<LI>Install Squid-2 and configure it to have the same
+amount of disk space as your Squid-1 cache, even
+if there is not currently that much space free.</LI>
+<LI>Configure Squid-2 with Squid-1 as a parent cache.
+You might want to enable <EM>never_direct</EM> on
+the Squid-2 cache so that all of Squid-2's requests
+go through Squid-1.</LI>
+<LI>Enable the 
+<A HREF="FAQ-7.html#purging-objects">PURGE method</A> on Squid-1.</LI>
+<LI>Set the refresh rules on Squid-1 to be very liberal so that it
+does not generate IMS requests for cached objects.</LI>
+<LI>Create a list of all the URLs in the Squid-1 cache.  These can
+be extracted from the access.log, store.log and swap logs.</LI>
+<LI>For every URL in the list, request the URL from Squid-2, and then
+immediately send a PURGE request to Squid-1.</LI>
+<LI>Eventually Squid-2 will have all the objects, and Squid-1
+will be empty.</LI>
+</OL>
+<P>
+<P>
+<P>
+<H2><A NAME="custom-err-msgs"></A> <A NAME="ss19.10">19.10 Customizable Error Messages</A>
+</H2>
+
+<P>Squid-2 lets you customize your error messages.  The source distribution
+includes error messages in different languages.  You can select the
+language with the configure option:
+<PRE>
+        --enable-err-language=lang
+</PRE>
+<P>
+<P>Furthermore, you can rewrite the error message template files if you like.
+This list describes the tags which Squid will insert into the messages:
+<DL>
+<DT><B>%B</B><DD><P>URL with FTP %2f hack
+<DT><B>%c</B><DD><P>Squid error code
+<DT><B>%d</B><DD><P>seconds elapsed since request received (not yet implemented)
+<DT><B>%e</B><DD><P>errno
+<DT><B>%E</B><DD><P>strerror()
+<DT><B>%f</B><DD><P>FTP request line
+<DT><B>%F</B><DD><P>FTP reply line
+<DT><B>%g</B><DD><P>FTP server message
+<DT><B>%h</B><DD><P>cache hostname
+<DT><B>%H</B><DD><P>server host name
+<DT><B>%i</B><DD><P>client IP address
+<DT><B>%I</B><DD><P>server IP address
+<DT><B>%L</B><DD><P>contents of <EM>err_html_text</EM> config option
+<DT><B>%M</B><DD><P>Request Method
+<DT><B>%m</B><DD><P>Error message returned by external auth helper
+<DT><B>%p</B><DD><P>URL port \#
+<DT><B>%P</B><DD><P>Protocol
+<DT><B>%R</B><DD><P>Full HTTP Request
+<DT><B>%S</B><DD><P>squid default signature
+<DT><B>%s</B><DD><P>caching proxy software with version
+<DT><B>%t</B><DD><P>local time
+<DT><B>%T</B><DD><P>UTC
+<DT><B>%U</B><DD><P>URL without password
+<DT><B>%u</B><DD><P>URL with password (Squid-2.5 and later only)
+<DT><B>%w</B><DD><P>cachemgr email address
+<DT><B>%z</B><DD><P>dns server error message
+</DL>
+<P>The Squid default signature is added automatically unless %s or %S
+is used in the error page. To change the signature you must manually append
+the signature to each error page.
+<P>
+<P>The default signature reads like:
+<PRE>
+    &lt;BR clear="all"&gt;
+    &lt;HR noshade size="1px"&gt;
+    &lt;ADDRESS&gt;
+    Generated %T by %h (%s)
+    &lt;/ADDRESS&gt;
+    &lt;/BODY&gt;&lt;/HTML&gt;
+</PRE>
+<P>
+<H2><A NAME="ss19.11">19.11 My squid.conf from version 1.1 doesn't work!</A>
+</H2>
+
+<P>Yes, a number of configuration directives have been renamed.
+Here are some of them:
+<DL>
+<DT><B>cache_host</B><DD><P>This is now called <EM>cache_peer</EM>.  The old term does not
+really describe what you are configuring, but the new name
+tells you that you are configuring a peer for your cache.
+<DT><B>cache_host_domain</B><DD><P>Renamed to <EM>cache_peer_domain</EM>.
+<DT><B>local_ip, local_domain</B><DD><P>The functaionality provided by these directives is now implemented
+as access control lists.  You will use the <EM>always_direct</EM> and
+<EM>never_direct</EM> options.  The new <EM>squid.conf</EM> file has some
+examples.
+<DT><B>cache_stoplist</B><DD><P>This directive also has been reimplemented with access control
+lists.  You will use the <EM>no_cache</EM> option.  For example:
+<PRE>
+        acl Uncachable url_regex cgi ?
+        no_cache deny Uncachable
+        
+</PRE>
+<DT><B>cache_swap</B><DD><P>This option used to specify the cache disk size.  Now you
+specify the disk size on each <EM>cache_dir</EM> line.
+<DT><B>cache_host_acl</B><DD><P>This option has been renamed to <EM>cache_peer_access</EM>
+<B>and</B> the syntax has changed.  Now this option is a
+true access control list, and you must include an
+<EM>allow</EM> or <EM>deny</EM> keyword.  For example:
+<PRE>
+        acl that-AS dst_as 1241
+        cache_peer_access thatcache.thatdomain.net allow that-AS
+        cache_peer_access thatcache.thatdomain.net deny all
+        
+</PRE>
+
+This example sends requests to your peer <EM>thatcache.thatdomain.net</EM>
+only for origin servers in Autonomous System Number 1241.
+<DT><B>units</B><DD><P>In Squid-1.1 many of the configuration options had implied
+units associated with them.  For example, the <EM>connect_timeout</EM>
+value may have been in seconds, but the <EM>read_timeout</EM> value
+had to be given in minutes.  With Squid-2, these directives take
+units after the numbers, and you will get a warning if you
+leave off the units.  For example, you should now write:
+<PRE>
+        connect_timeout 120 seconds
+        read_timeout 15 minutes
+        
+</PRE>
+</DL>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-20.html">Next</A>
+<A HREF="FAQ-18.html">Previous</A>
+<A HREF="FAQ.html#toc19">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-2.html
+++ squid-2.5.9/debian/doc/FAQ-2.html
@@ -0,0 +1,437 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Getting and Compiling Squid</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-3.html">Next</A>
+<A HREF="FAQ-1.html">Previous</A>
+<A HREF="FAQ.html#toc2">Contents</A>
+<HR>
+<H2><A NAME="compiling"></A> <A NAME="s2">2. Getting and Compiling Squid</A></H2>
+
+<H2><A NAME="ss2.1">2.1 Which file do I download to get Squid?</A>
+</H2>
+
+<P>You must download a source archive file of the form
+squid-x.y.z-src.tar.gz (eg, squid-1.1.6-src.tar.gz) from
+<A HREF="http://www.squid-cache.org/">the Squid home page</A>, or.
+<A HREF="ftp://www.squid-cache.org/pub/">the Squid FTP site</A>.
+Context diffs are available for upgrading to new versions.
+These can be applied with the <EM>patch</EM> program (available from
+<A HREF="ftp://prep.ai.mit.edu/pub/gnu/">the GNU FTP site</A>).
+<P>
+<H2><A NAME="ss2.2">2.2 How do I compile Squid?</A>
+</H2>
+
+<P>For <B>Squid-1.0</B> and <B>Squid-1.1</B> versions, you can just
+type <EM>make</EM> from the top-level directory after unpacking
+the source files.  For example:
+<PRE>
+        % tar xzf squid-1.1.21-src.tar.gz
+        % cd squid-1.1.21
+        % make
+</PRE>
+<P>For <B>Squid-2</B> you must run the <EM>configure</EM> script yourself
+before running <EM>make</EM>:
+<PRE>
+        % tar xzf squid-2.0.RELEASE-src.tar.gz
+        % cd squid-2.0.RELEASE
+        % ./configure
+        % make
+</PRE>
+<P>
+<H2><A NAME="ss2.3">2.3 What kind of compiler do I need?</A>
+</H2>
+
+<P>To compile Squid, you will need an ANSI C compiler.  Almost all
+modern Unix systems come with pre-installed compilers which work
+just fine.  The old <EM>SunOS</EM> compilers do not have support for ANSI
+C, and the Sun compiler for <EM>Solaris</EM> is a product which
+must be purchased separately.
+<P>
+<P>If you are uncertain about your system's C compiler, The GNU C compiler is
+available at
+<A HREF="ftp://prep.ai.mit.edu/pub/gnu/">the GNU FTP site</A>.
+In addition to gcc, you may also want or need to install the <EM>binutils</EM>
+package.
+<P>
+<H2><A NAME="ss2.4">2.4 What else do I need to compile Squid?</A>
+</H2>
+
+<P>You will need 
+<A HREF="http://www.perl.com/">Perl</A> installed
+on your system.
+<P>
+<H2><A NAME="ss2.5">2.5 Do you have pre-compiled binaries available?</A>
+</H2>
+
+<P>The developers do not have the resources to make pre-compiled
+binaries available.  Instead, we invest effort into making
+the source code very portable.  Some people have made
+binary packages available.  Please see our
+<A HREF="http://www.squid-cache.org/platforms.html">Platforms Page</A>.
+<P>
+<P>The 
+<A HREF="http://freeware.sgi.com/">SGI Freeware</A> site
+has pre-compiled packages for SGI IRIX.
+<P>
+<P> 
+Squid binaries for
+<A HREF="http://www.freebsd.org/cgi/ports.cgi?query=squid-2&amp;stype=all">FreeBSD on Alpha and Intel</A>.
+<P>
+<P>Squid binaries for
+<A HREF="ftp://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/www/squid/README.html">NetBSD on everything</A><P>
+<P>Gurkan Sengun has some
+<A HREF="http://www.linuks.mine.nu/solaris/">Sparc/Solaris packages</A>
+available.
+<P>
+<H2><A NAME="ss2.6">2.6 How do I apply a patch or a diff?</A>
+</H2>
+
+<P>You need the <CODE>patch</CODE> program.  You should probably duplicate the
+entire directory structure before applying the patch.  For example, if
+you are upgrading from squid-1.1.10 to 1.1.11, you would run
+these commands:
+<PRE>
+        cd squid-1.1.10
+        mkdir ../squid-1.1.11
+        find . -depth -print | cpio -pdv ../squid-1.1.11
+        cd ../squid-1.1.11
+        patch &lt; /tmp/diff-1.1.10-1.1.11
+</PRE>
+
+After the patch has been applied, you must rebuild Squid from the
+very beginning, i.e.:
+<PRE>
+        make realclean
+        ./configure
+        make
+        make install
+</PRE>
+
+Note, In later distributions (Squid 2), 'realclean' has been changed
+to 'distclean'.
+<P>
+<P>If patch keeps asking for a file name, try adding ``-p0'':
+<PRE>
+        patch -p0 &lt; filename
+</PRE>
+<P>
+<P>If your <CODE>patch</CODE> program seems to complain or refuses to work,
+you should get a more recent version, from the
+<A HREF="ftp://ftp.gnu.ai.mit.edu/pub/gnu/">GNU FTP site</A>, for example.
+<P>
+<H2><A NAME="ss2.7">2.7 <EM>configure</EM> options</A>
+</H2>
+
+<P>The configure script can take numerous options.  The most
+useful is <CODE>--prefix</CODE> to install it in a different directory.
+The default installation directory is <EM>/usr/local/squid/</EM>.  To
+change the default, you could do:
+<PRE>
+        % cd squid-x.y.z
+        % ./configure --prefix=/some/other/directory/squid
+</PRE>
+<P>
+<P>Type
+<PRE>
+        % ./configure --help
+</PRE>
+
+to see all available options.  You will need to specify some
+of these options to enable or disable certain features.
+Some options which are used often include:
+<P>
+<PRE>
+  --prefix=PREFIX         install architecture-independent files in PREFIX
+                          [/usr/local/squid]
+  --enable-dlmalloc[=LIB] Compile &amp; use the malloc package by Doug Lea
+  --enable-gnuregex       Compile GNUregex
+  --enable-splaytree      Use SPLAY trees to store ACL lists
+  --enable-xmalloc-debug  Do some simple malloc debugging
+  --enable-xmalloc-debug-trace
+                          Detailed trace of memory allocations
+  --enable-xmalloc-statistics
+                          Show malloc statistics in status page
+  --enable-carp           Enable CARP support
+  --enable-async-io       Do ASYNC disk I/O using threads
+  --enable-icmp           Enable ICMP pinging
+  --enable-delay-pools    Enable delay pools to limit bandwith usage
+  --enable-mem-gen-trace  Do trace of memory stuff
+  --enable-useragent-log  Enable logging of User-Agent header
+  --enable-kill-parent-hack
+                          Kill parent on shutdown
+  --enable-snmp           Enable SNMP monitoring
+  --enable-cachemgr-hostname[=hostname]
+                          Make cachemgr.cgi default to this host
+  --enable-arp-acl        Enable use of ARP ACL lists (ether address)
+  --enable-htpc           Enable HTCP protocol
+  --enable-forw-via-db    Enable Forw/Via database
+  --enable-cache-digests  Use Cache Digests
+                          see http://www.squid-cache.org/Doc/FAQ/FAQ-16.html
+  --enable-err-language=lang
+                          Select language for Error pages (see errors dir)
+</PRE>
+<P>
+<H2><A NAME="ss2.8">2.8 undefined reference to __inet_ntoa</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:SarKev@topnz.ac.nz">Kevin Sartorelli</A>
+and 
+<A HREF="mailto:doering@usf.uni-kassel.de">Andreas Doering</A>.
+<P>
+<P>Probably you've recently installed bind 8.x.  There is a mismatch between
+the header files and DNS library that Squid has found.  There are a couple
+of things you can try.
+<P>
+<P>First, try adding <CODE>-lbind</CODE> to <EM>XTRA_LIBS</EM>  in <EM>src/Makefile</EM>.
+If <CODE>-lresolv</CODE> is already there, remove it.
+<P>
+<P>If that doesn't seem to work, edit your <EM>arpa/inet.h</EM> file and comment out the following:
+<P>
+<PRE>
+        #define inet_addr               __inet_addr
+        #define inet_aton               __inet_aton
+        #define inet_lnaof              __inet_lnaof
+        #define inet_makeaddr           __inet_makeaddr
+        #define inet_neta               __inet_neta
+        #define inet_netof              __inet_netof
+        #define inet_network            __inet_network
+        #define inet_net_ntop           __inet_net_ntop
+        #define inet_net_pton           __inet_net_pton
+        #define inet_ntoa               __inet_ntoa
+        #define inet_pton               __inet_pton
+        #define inet_ntop               __inet_ntop
+        #define inet_nsap_addr          __inet_nsap_addr
+        #define inet_nsap_ntoa          __inet_nsap_ntoa
+</PRE>
+<P>
+<H2><A NAME="dns-ttl-hack"></A> <A NAME="ss2.9">2.9 How can I get true DNS TTL info into Squid's IP cache?</A>
+</H2>
+
+<P>If you have source for BIND, you can modify it as indicated in the diff
+below.  It causes the global variable _dns_ttl_ to be set with the TTL
+of the most recent lookup.  Then, when you compile Squid, the configure
+script will look for the _dns_ttl_ symbol in libresolv.a.  If found,
+dnsserver will return the TTL value for every lookup.
+<P>This hack was contributed by
+<A HREF="mailto:bne@CareNet.hu">Endre Balint Nagy</A>.
+<P>
+<PRE>
+diff -ru bind-4.9.4-orig/res/gethnamaddr.c bind-4.9.4/res/gethnamaddr.c
+--- bind-4.9.4-orig/res/gethnamaddr.c   Mon Aug  5 02:31:35 1996
++++ bind-4.9.4/res/gethnamaddr.c        Tue Aug 27 15:33:11 1996
+@@ -133,6 +133,7 @@
+ } align;
+
+ extern int h_errno;
++int _dns_ttl_;
+
+ #ifdef DEBUG
+ static void
+@@ -223,6 +224,7 @@
+        host.h_addr_list = h_addr_ptrs;
+        haveanswer = 0;
+        had_error = 0;
++       _dns_ttl_ = -1;
+        while (ancount-- > 0 &amp;&amp; cp &lt; eom &amp;&amp; !had_error) {
+                n = dn_expand(answer->buf, eom, cp, bp, buflen);
+                if ((n &lt; 0) || !(*name_ok)(bp)) {
+@@ -232,8 +234,11 @@
+                cp += n;                        /* name */
+                type = _getshort(cp);
+                cp += INT16SZ;                  /* type */
+-               class = _getshort(cp);
+-               cp += INT16SZ + INT32SZ;        /* class, TTL */
++               class = _getshort(cp);
++               cp += INT16SZ;                  /* class */
++               if (qtype == T_A  &amp;&amp; type == T_A)
++                       _dns_ttl_ = _getlong(cp);
++               cp += INT32SZ;                  /* TTL */
+                n = _getshort(cp);
+                cp += INT16SZ;                  /* len */
+                if (class != C_IN) {
+</PRE>
+<P>
+<P>And here is a patch for BIND-8:
+<PRE>
+*** src/lib/irs/dns_ho.c.orig   Tue May 26 21:55:51 1998
+--- src/lib/irs/dns_ho.c        Tue May 26 21:59:57 1998
+***************
+*** 87,92 ****
+--- 87,93 ----
+  #endif
+
+  extern int h_errno;
++ int _dns_ttl_;
+
+  /* Definitions. */
+
+***************
+*** 395,400 ****
+--- 396,402 ----
+        pvt->host.h_addr_list = pvt->h_addr_ptrs;
+        haveanswer = 0;
+        had_error = 0;
++       _dns_ttl_ = -1;
+        while (ancount-- > 0 &amp;&amp; cp &lt; eom &amp;&amp; !had_error) {
+                n = dn_expand(ansbuf, eom, cp, bp, buflen);
+                if ((n &lt; 0) || !(*name_ok)(bp)) {
+***************
+*** 404,411 ****
+                cp += n;                        /* name */
+                type = ns_get16(cp);
+                cp += INT16SZ;                  /* type */
+!               class = ns_get16(cp);
+!               cp += INT16SZ + INT32SZ;        /* class, TTL */
+                n = ns_get16(cp);
+                cp += INT16SZ;                  /* len */
+                if (class != C_IN) {
+--- 406,416 ----
+                cp += n;                        /* name */
+                type = ns_get16(cp);
+                cp += INT16SZ;                  /* type */
+!               class = _getshort(cp);
+!               cp += INT16SZ;                  /* class */
+!               if (qtype == T_A  &amp;&amp; type == T_A)
+!                       _dns_ttl_ = _getlong(cp);
+!               cp += INT32SZ;                  /* TTL */
+                n = ns_get16(cp);
+                cp += INT16SZ;                  /* len */
+                if (class != C_IN) {
+</PRE>
+<P>
+<H2><A NAME="bsdi-compile"></A> <A NAME="ss2.10">2.10 My platform is BSD/OS or BSDI and I can't compile Squid</A>
+</H2>
+
+<P>
+<PRE>
+        cache_cf.c: In function `parseConfigFile':
+        cache_cf.c:1353: yacc stack overflow before `token'
+        ...
+</PRE>
+<P>
+<P>You may need to upgrade your gcc installation to a more recent version.
+Check your gcc version with
+<PRE>
+        gcc -v
+</PRE>
+
+If it is earlier than 2.7.2, you might consider upgrading.
+<P>
+<P>Alternatively, you can get pre-compiled Squid binaries for BSD/OS 2.1 at
+the 
+<A HREF="ftp://ftp.bsdi.com/patches/patches-2.1">BSD patches FTP site</A>,
+patch 
+<A HREF="ftp://ftp.bsdi.com/patches/patches-2.1/U210-019">U210-019</A>.
+<P>
+<P>
+<H2><A NAME="ss2.11">2.11 Problems compiling <EM>libmiscutil.a</EM> on Solaris</A>
+</H2>
+
+<P>The following error occurs on Solaris systems using gcc when the Solaris C
+compiler is not installed:
+<PRE>
+        /usr/bin/rm -f libmiscutil.a
+        /usr/bin/false r libmiscutil.a rfc1123.o rfc1738.o util.o ...
+        make[1]: *** [libmiscutil.a] Error 255
+        make[1]: Leaving directory `/tmp/squid-1.1.11/lib'
+        make: *** [all] Error 1
+</PRE>
+
+Note on the second line the <B>/usr/bin/false</B>.   This is supposed
+to be a path to the <EM>ar</EM> program.  If <EM>configure</EM> cannot find <EM>ar</EM>
+on your system, then it substitues <EM>false</EM>.
+<P>
+<P>To fix this you either need to:
+<UL>
+<LI>Add <EM>/usr/ccs/bin</EM> to your PATH.  This is where the <EM>ar</EM>
+command should be.  You need to install SUNWbtool if <EM>ar</EM>
+is not there.  Otherwise,</LI>
+<LI>Install the <B>binutils</B> package from
+<A HREF="ftp://prep.ai.mit.edu/pub/gnu/">the GNU FTP site</A>.
+This package includes programs such as <EM>ar</EM>, <EM>as</EM>, and <EM>ld</EM>.</LI>
+</UL>
+<P>
+<H2><A NAME="ss2.12">2.12 I have problems compiling Squid on Platform Foo.</A>
+</H2>
+
+<P>Please check the
+<A HREF="/platforms.html">page of platforms</A>
+on which Squid is known to compile.  Your problem might be listed
+there together with a solution.  If it isn't listed there, mail
+us what you are trying, your Squid version, and the problems
+you encounter.
+<P>
+<H2><A NAME="ss2.13">2.13 I see a lot warnings while compiling Squid.</A>
+</H2>
+
+<P>Warnings are usually not a big concern, and can be common with software
+designed to operate on multiple platforms.  If you feel like fixing
+compile-time warnings, please do so and send us the patches.
+<P>
+<P>
+<H2><A NAME="building-os2"></A> <A NAME="ss2.14">2.14 Building Squid on OS/2</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:nazard@man-assoc.on.ca">Doug Nazar</A><P>
+<P>In order in compile squid, you need to have a reasonable facsimile of a
+Unix system installed.  This includes <EM>bash</EM>, <EM>make</EM>, <EM>sed</EM>,
+<EM>emx</EM>, various file utilities and a few more. I've setup a TVFS
+drive that matches a Unix file system but this probably isn't strictly
+necessary.
+<P>
+<P>I made a few modifications to the pristine EMX 0.9d install.
+<OL>
+<LI>added defines for <EM>strcasecmp()</EM> &amp; <EM>strncasecmp()</EM> to <EM>string.h</EM></LI>
+<LI>changed all occurrences of time_t to signed long instead
+of unsigned long</LI>
+<LI>hacked ld.exe
+<OL>
+<LI>to search for both xxxx.a and libxxxx.a</LI>
+<LI>to produce the correct filename when using the
+-Zexe option</LI>
+</OL>
+</LI>
+</OL>
+<P>
+<P>You will need to run <EM>scripts/convert.configure.to.os2</EM> (in the
+Squid source distribution) to modify
+the configure script so that it can search for the various programs.
+<P>
+<P>Next, you need to set a few environment variables (see EMX docs
+for meaning):
+<PRE>
+        export EMXOPT="-h256 -c"
+        export LDFLAGS="-Zexe -Zbin -s"
+</PRE>
+<P>
+<P>Now you are ready to configure squid:
+<PRE>
+        ./configure
+</PRE>
+<P>Compile everything:
+<PRE>
+        make
+</PRE>
+<P>and finally, install:
+<PRE>
+        make install
+</PRE>
+<P>This will by default, install into <EM>/usr/local/squid</EM>. If you wish
+to install somewhere else, see the <EM>--prefix</EM> option for configure.
+<P>
+<P>Now, don't forget to set EMXOPT before running squid each time. I
+recommend using the -Y and -N options.
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-3.html">Next</A>
+<A HREF="FAQ-1.html">Previous</A>
+<A HREF="FAQ.html#toc2">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-20.html
+++ squid-2.5.9/debian/doc/FAQ-20.html
@@ -0,0 +1,156 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: httpd-accelerator mode</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-21.html">Next</A>
+<A HREF="FAQ-19.html">Previous</A>
+<A HREF="FAQ.html#toc20">Contents</A>
+<HR>
+<H2><A NAME="s20">20. httpd-accelerator mode</A></H2>
+
+<H2><A NAME="what-is-httpd-accelerator"></A> <A NAME="ss20.1">20.1 What is the httpd-accelerator mode?</A>
+</H2>
+
+<P>Occasionally people have trouble understanding accelerators and
+proxy caches, usually resulting from mixed up interpretations of
+"incoming" and ``outgoing" data.  I think in terms of requests (i.e.,
+an outgoing request is from the local site out to the big bad
+Internet).  The data received in reply is incoming, of course.
+Others think in the opposite sense of ``a request for incoming data".
+<P>
+<P>An accelerator caches incoming requests for outgoing data (i.e.,
+that which you publish to the world).  It takes load away from your
+HTTP server and internal network.  You move the server away from
+port 80 (or whatever your published port is), and substitute the
+accelerator, which then pulls the HTTP data from the ``real"
+HTTP server (only the accelerator needs to know where the real
+server is).  The outside world sees no difference (apart from an
+increase in speed, with luck).
+<P>
+<P>Quite apart from taking the load of a site's normal web server,
+accelerators can also sit outside firewalls or other network
+bottlenecks and talk to HTTP servers inside, reducing traffic across
+the bottleneck and simplifying the configuration.  Two or more
+accelerators communicating via ICP can increase the speed and
+resilience of a web service to any single failure.
+<P>
+<P>The Squid redirector can make one accelerator act as a single
+front-end for multiple servers.  If you need to move parts of your
+filesystem from one server to another, or if separately administered
+HTTP servers should logically appear under a single URL hierarchy,
+the accelerator makes the right thing happen.
+<P>
+<P>If you wish only to cache the ``rest of the world" to improve local users
+browsing performance, then accelerator mode is irrelevant.  Sites which
+own and publish a URL hierarchy use an accelerator to improve other
+sites' access to it.  Sites wishing to improve their local users' access
+to other sites' URLs use proxy caches.  Many sites, like us, do both and
+hence run both.
+<P>
+<P>Measurement of the Squid cache and its Harvest counterpart suggest an
+order of magnitude performance improvement over CERN or other widely
+available caching software.  This order of magnitude performance
+improvement on hits suggests that the cache can serve as an httpd
+accelerator, a cache configured to act as a site's primary httpd server
+(on port 80), forwarding references that miss to the site's real httpd
+(on port 81).
+<P>
+<P>In such a configuration, the web administrator renames all
+non-cachable URLs to the httpd's port (81).  The cache serves
+references to cachable objects, such as HTML pages and GIFs, and
+the true httpd (on port 81) serves references to non-cachable
+objects, such as queries and cgi-bin programs.  If a site's usage
+characteristics tend toward cachable objects, this configuration
+can dramatically reduce the site's web workload.
+<P>
+<P>Note that it is best not to run a single <EM>squid</EM> process as
+both an httpd-accelerator and a proxy cache, since these two modes
+will have different working sets. You will get better performance
+by running two separate caches on separate machines. However, for
+compatability with how administrators are accustomed to running
+other servers that provide both proxy and Web serving capability
+(eg, CERN), the Squid supports operation as both a proxy and
+an accelerator if you set the <CODE>httpd_accel_with_proxy</CODE>
+variable to <CODE>on</CODE> inside your <EM>squid.conf</EM>
+configuration file.
+<P>
+<H2><A NAME="ss20.2">20.2 How do I set it up?</A>
+</H2>
+
+<P>First, you have to tell Squid to listen on port 80 (usually), so set the 'http_port'
+option:
+<PRE>
+        http_port 80
+</PRE>
+<P>Next, you need to move your normal HTTP server to another port and/or
+another machine.  If you want to run your HTTP server on the same
+machine, then it can not also use port 80 (except see the next FAQ entry
+below).  A common choice is port 81.  Configure squid as follows:
+<PRE>
+        httpd_accel_host localhost
+        httpd_accel_port 81
+</PRE>
+
+Alternatively, you could move the HTTP server to another machine and leave it
+on port 80:
+<PRE>
+        httpd_accel_host otherhost.foo.com
+        httpd_accel_port 80
+</PRE>
+<P>You should now be able to start Squid and it will serve requests as a HTTP server.
+<P>
+<P>
+<P>If you are using Squid has an accelerator for a virtual host system, then you
+need to specify
+<PRE>
+        httpd_accel_host virtual
+</PRE>
+<P>
+<P>
+<P>Finally, if you want Squid to also accept <EM>proxy</EM> requests (like it used to
+before you turned it into an accelerator), then you need to enable this option:
+<PRE>
+        httpd_accel_with_proxy on
+</PRE>
+<P>
+<H2><A NAME="ss20.3">20.3 When using an httpd-accelerator, the port number for redirects is wrong</A>
+</H2>
+
+<P>Yes, this is because you probably moved your real httpd to port 81.  When
+your httpd issues a redirect message (e.g. 302 Moved Temporarily), it knows
+it is not running on the standard port (80), so it inserts <EM>:81</EM> in the
+redirected URL.  Then, when the client requests the redirected URL, it
+bypasses the accelerator.
+<P>
+<P>How can you fix this?
+<P>
+<P>One way is to leave your httpd running on port 80, but bind the httpd
+socket to a <EM>specific</EM> interface, namely the loopback interface.
+With 
+<A HREF="http://www.apache.org/">Apache</A> you can do it
+like this in <EM>httpd.conf</EM>:
+<PRE>
+        Port 80
+        BindAddress 127.0.0.1
+</PRE>
+
+Then, in your <EM>squid.conf</EM> file, you must specify the loopback address
+as the accelerator:
+<PRE>
+        httpd_accel_host 127.0.0.1
+        httpd_accel_port 80
+</PRE>
+<P>
+<P>Note, you probably also need to add an <EM>/etc/hosts</EM> entry
+of 127.0.0.1 for your server hostname.  Otherwise, Squid may
+get stuck in a forwarding loop.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-21.html">Next</A>
+<A HREF="FAQ-19.html">Previous</A>
+<A HREF="FAQ.html#toc20">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-21.html
+++ squid-2.5.9/debian/doc/FAQ-21.html
@@ -0,0 +1,145 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Related Software</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-22.html">Next</A>
+<A HREF="FAQ-20.html">Previous</A>
+<A HREF="FAQ.html#toc21">Contents</A>
+<HR>
+<H2><A NAME="s21">21. Related Software</A></H2>
+
+<H2><A NAME="ss21.1">21.1 Clients</A>
+</H2>
+
+<H3>Wget</H3>
+
+<P>
+<A HREF="ftp://gnjilux.cc.fer.hr/pub/unix/util/wget/">Wget</A> is a
+command-line Web client.  It supports HTTP and FTP URLs, recursive retrievals, and
+HTTP proxies.
+<P>
+<H3>echoping</H3>
+
+<P>If you want to test your Squid cache in batch (from a cron command, for
+instance), you can use the 
+<A HREF="ftp://ftp.internatif.org/pub/unix/echoping/">echoping</A> program,
+which will tell you (in plain text or via an exit code) if the cache is
+up or not, and will indicate the response times.
+<P>
+<H2><A NAME="ss21.2">21.2 Logfile Analysis</A>
+</H2>
+
+<P>Rather than maintain the same list in two places, please see the
+<A HREF="/Scripts/">Logfile Analysis Scripts</A> page
+on the Web server.
+<P>
+<H2><A NAME="ss21.3">21.3 Configuration Tools</A>
+</H2>
+
+<H3>3Dhierarchy.pl</H3>
+
+<P>Kenichi Matsui has a simple perl script which generates a 3D hierarchy map (in VRML) from
+squid.conf.
+<A HREF="ftp://ftp.nemoto.ecei.tohoku.ac.jp/pub/Net/WWW/VRML/converter/3Dhierarchy.pl">3Dhierarchy.pl</A>.
+<P>
+<H2><A NAME="ss21.4">21.4 Squid add-ons</A>
+</H2>
+
+<H3>transproxy</H3>
+
+<P>
+<A HREF="http://www.transproxy.nlc.net.au/">transproxy</A>
+is a program used in conjunction with the Linux Transparent Proxy
+networking feature, and ipfwadm, to intercept HTTP and
+other requests.  Transproxy is written by 
+<A HREF="mailto:john@nlc.net.au">John Saunders</A>.
+<P>
+<H3>Iain's redirector package</H3>
+
+<P>A 
+<A HREF="ftp://ftp.sbs.de/pub/www/cache/redirector/redirector.tar.gz">redirector package</A> from
+<A HREF="mailto:iain@ecrc.de">Iain Lea</A> to allow Intranet (restricted) or Internet
+(full) access with URL deny and redirection for sites that are not deemed
+acceptable for a userbase all via a single proxy port.
+<P>
+<H3>Junkbusters</H3>
+
+<P>
+<A HREF="http://internet.junkbuster.com">Junkbusters</A> Corp has a
+copyleft privacy-enhancing, ad-blocking proxy server which you can
+use in conjunction with Squid.
+<P>
+<H3>Squirm</H3>
+
+<P>
+<A HREF="http://www.senet.com.au/squirm/">Squirm</A> is a configurable, efficient redirector for Squid
+by 
+<A HREF="mailto:chris@senet.com.au">Chris Foote</A>.  Features:
+<UL>
+<LI> Very fast</LI>
+<LI> Virtually no memory usage</LI>
+<LI> It can re-read it's config files while running by sending it a HUP signal</LI>
+<LI> Interactive test mode for checking new configs</LI>
+<LI> Full regular expression matching and replacement</LI>
+<LI> Config files for patterns and IP addresses.</LI>
+<LI> If you mess up the config file, Squirm runs in Dodo Mode so your squid keeps working :-)</LI>
+</UL>
+<P>
+<H3>chpasswd.cgi</H3>
+
+<P>
+<A HREF="mailto:orso@ineparnet.com.br">Pedro L Orso</A>
+has adapated the Apache's 
+<A HREF="../../htpasswd/">htpasswd</A> into a CGI program
+called 
+<A HREF="http://www.ineparnet.com.br/orso/index.html">chpasswd.cgi</A>.
+<P>
+<H3>jesred</H3>
+
+<P>
+<A HREF="http://ivs.cs.uni-magdeburg.de/~elkner/webtools/jesred/">jesred</A>
+by 
+<A HREF="mailto:elkner@wotan.cs.Uni-Magdeburg.DE">Jens Elkner</A>.
+<P>
+<H3>squidGuard</H3>
+
+<P>
+<A HREF="http://ftp.ost.eltele.no/pub/www/proxy/">squidGuard</A> is
+a free (GPL), flexible and efficient filter and
+redirector program for squid.  It lets you define multiple access
+rules with different restrictions for different user groups on a squid
+cache.  squidGuard uses squid standard redirector interface.
+<P>
+<H3>Central Squid Server</H3>
+
+<P>The 
+<A HREF="http://www.senet.com.au/css/">Smart Neighbour</A>
+(or 'Central Squid Server' - CSS) is a cut-down
+version of Squid without HTTP or object caching functionality.  The
+CSS deals only with ICP messages.  Instead of caching objects, the CSS
+records the availability of objects in each of its neighbour caches.
+Caches that have smart neighbours update each smart neighbour with the
+status of their cache by sending ICP_STORE_NOTIFY/ICP_RELEASE_NOTIFY
+messages upon storing/releasing an object from their cache.  The CSS
+maintains an up to date 'object map' recording the availability of
+objects in its neighbouring caches.
+<P>
+<H2><A NAME="ss21.5">21.5 Ident Servers</A>
+</H2>
+
+<P>For 
+<A HREF="http://info.ost.eltele.no/freeware/identd/">Windows NT</A>,
+<A HREF="http://identd.sourceforge.net/">Windows 95/98</A>,
+and
+<A HREF="http://www2.lysator.liu.se/~pen/pidentd/">Unix</A>.
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-22.html">Next</A>
+<A HREF="FAQ-20.html">Previous</A>
+<A HREF="FAQ.html#toc21">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-22.html
+++ squid-2.5.9/debian/doc/FAQ-22.html
@@ -0,0 +1,340 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: DISKD</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-23.html">Next</A>
+<A HREF="FAQ-21.html">Previous</A>
+<A HREF="FAQ.html#toc22">Contents</A>
+<HR>
+<H2><A NAME="s22">22. DISKD</A></H2>
+
+<H2><A NAME="ss22.1">22.1 What is DISKD?</A>
+</H2>
+
+<P>DISKD refers to some features in Squid-2.4 to improve Disk I/O
+performance.  The basic idea is that each <EM>cache_dir</EM> has its
+own <EM>diskd</EM> child process.  The diskd process performs all disk
+I/O operations (open, close, read, write, unlink) for the cache_dir.
+Message queues are used to send requests and responses between the
+Squid and diskd processes.  Shared memory is used for chunks of
+data to be read and written.
+<P>
+<H2><A NAME="ss22.2">22.2 Does it perform better?</A>
+</H2>
+
+<P>Yes.  We benchmarked Squid-2.4 with DISKD at the 
+<A HREF="http://polygraph.ircache.net/Results/bakeoff-2/">Second IRCache Bake-Off</A>.  The results are also described 
+<A HREF="/Benchmarking/bakeoff-02/">here</A>.  At the bakeoff, we
+got 160 req/sec with diskd.  Without diskd, we'd have gotten about
+40 req/sec.
+<P>
+<H2><A NAME="ss22.3">22.3 How do I use it?</A>
+</H2>
+
+<P>You need to run Squid version 
+<A HREF="/Versions/v2/2.4">2.4</A> or later.
+Your operating system must support message queues, and shared memory.
+<P>To configure Squid for DISKD, use the <EM>--enable-storeio</EM> option:
+<PRE>
+% ./configure --enable-storeio=diskd,ufs
+</PRE>
+<P>
+<H2><A NAME="ss22.4">22.4 FATAL: Unknown cache_dir type 'diskd'</A>
+</H2>
+
+<P>You didn't put <EM>diskd</EM> in the list of storeio modules as described
+above.  You need to run <EM>configure</EM> and and recompile Squid.
+<P>
+<H2><A NAME="ss22.5">22.5 If I use DISKD, do I have to wipe out my current cache?</A>
+</H2>
+
+<P>No.  Diskd uses the same storage scheme as the standard "UFS"
+type.  It only changes how I/O is performed.
+<P>
+<H2><A NAME="ss22.6">22.6 How do I configure message queues?</A>
+</H2>
+
+<P>Most Unix operating systems have message queue support
+by default.  One way to check is to see if you have
+an <EM>ipcs</EM> command.
+<P>
+<P>However, you will likely need to increase the message
+queue parameters for Squid.  Message queue implementations
+normally have the following parameters:
+<DL>
+<DT><B>MSGMNB</B><DD><P>Maximum number of bytes per message queue.
+<DT><B>MSGMNI</B><DD><P>Maximum number of message queue identifiers (system wide).
+<DT><B>MSGSEG</B><DD><P>Maximum number of message segments per queue.
+<DT><B>MSGSSZ</B><DD><P>Size of a message segment.
+<DT><B>MSGTQL</B><DD><P>Maximum number of messages (system wide).
+<DT><B>MSGMAX</B><DD><P>Maximum size of a whole message.  On some systems you may need to
+increase this limit.  On other systems, you may not be able
+to change it.
+</DL>
+<P>
+<P>The messages between Squid and diskd are 32 bytes for 32-bit CPUs
+and 40 bytes for 64-bit CPUs.  Thus, MSGSSZ should be 32 or greater.
+You may want to set it to a larger value, just to be safe.
+<P>
+<P>We'll have two queues for each <EM>cache_dir</EM> -- one in each direction.
+So, MSGMNI needs to be at least two times the number of <EM>cache_dir</EM>'s.
+<P>
+<P>I've found that 75 messages per queue is about the limit of decent performance.
+If each diskd message consists of just one segment (depending on your
+value of MSGSSZ), then MSGSEG should be greater than 75.
+<P>
+<P>MSGMNB and MSGTQL affect how many messages can be in the queues
+at one time.  Diskd messages shouldn't be
+more than 40 bytes, but let's use 64 bytes to be safe.  MSGMNB
+should be at least 64*75.  I recommend rounding up to the nearest
+power of two, or 8192.
+<P>
+<P>MSGTQL should be at least 75 times the number of <EM>cache_dir</EM>'s
+that you'll have.
+<P>
+<H3>FreeBSD</H3>
+
+<P>Your kernel must have
+<PRE>
+options         SYSVMSG
+</PRE>
+<P>
+<P>You can set the parameters in the kernel as follows.  This is just
+an example.  Make sure the values are appropriate for your system:
+<PRE>
+options         MSGMNB=8192     # max # of bytes in a queue
+options         MSGMNI=40       # number of message queue identifiers
+options         MSGSEG=512      # number of message segments per queue
+options         MSGSSZ=64       # size of a message segment
+options         MSGTQL=2048     # max messages in system
+</PRE>
+<P>
+<H3>OpenBSD</H3>
+
+<P>You can set the parameters in the kernel as follows.  This is just
+an example.  Make sure the values are appropriate for your system:
+<PRE>
+option          MSGMNB=16384    # max characters per message queue
+option          MSGMNI=40       # max number of message queue identifiers
+option          MSGSEG=2048     # max number of message segments in the system
+option          MSGSSZ=64       # size of a message segment (Must be 2^N)
+option          MSGTQL=1024     # max amount of messages in the system
+</PRE>
+<P>
+<H3>Digital Unix</H3>
+
+<P>Message queue support seems to be in the kernel
+by default.  Setting the options is as follows:
+<PRE>
+options         MSGMNB="8192"     # max # bytes on queue
+options         MSGMNI="40"       # # of message queue identifiers
+options         MSGMAX="2048"     # max message size
+options         MSGTQL="2048"     # # of system message headers
+</PRE>
+<P>
+<P>by 
+<A HREF="mailto:B.C.Phillips at massey dot ac dot nz">Brenden Phillips</A><P>If you have a newer version (DU64), then you can probably use
+<EM>sysconfig</EM> instead.  To see what the current IPC settings are run 
+<PRE>
+# sysconfig -q ipc
+</PRE>
+
+To change them make a file like this called ipc.stanza:
+<PRE>
+ipc:
+        msg-max = 2048
+        msg-mni = 40
+        msg-tql = 2048
+        msg-mnb = 8192
+</PRE>
+
+then run
+<PRE>
+# sysconfigdb -a -f ipc.stanza 
+</PRE>
+
+You have to reboot for the change to take effect.
+<P>
+<P>
+<P>
+<H3>Linux</H3>
+
+<P>In my limited browsing on Linux, I didn't see any way to change
+message queue parameters except to modify the include files
+and build a new kernel.  On my system, the file
+is <EM>/usr/src/linux/include/linux/msg.h</EM>.
+<P>
+<P>Stefan K&ouml;psell reports that if you compile sysctl support
+into your kernel, then you can change the following values:
+<UL>
+<LI>kernel.msgmnb</LI>
+<LI>kernel.msgmni</LI>
+<LI>kernel.msgmax</LI>
+</UL>
+<P>
+<H3>Solaris</H3>
+
+<P>Refer to 
+<A HREF="http://www.sunworld.com/sunworldonline/swol-11-1997/swol-11-insidesolaris.html">Demangling Message Queues</A> in Sunworld Magazine.
+<P>
+<P>I don't think the above article really tells you how to set the parameters.
+You do it in <EM>/etc/system</EM> with lines like this:
+<PRE>
+set msgsys:msginfo_msgmax=2048
+set msgsys:msginfo_msgmnb=8192
+set msgsys:msginfo_msgmni=40
+set msgsys:msginfo_msgssz=64
+set msgsys:msginfo_msgtql=2048
+</PRE>
+<P>Of course, you must reboot whenever you modify <EM>/etc/system</EM>
+before changes take effect.
+<P>
+<H2><A NAME="ss22.7">22.7 How do I configure shared memory?</A>
+</H2>
+
+<P>Shared memory uses a set of parameters similar to the ones for message
+queues.  The Squid DISKD implementation uses one shared memory area
+for each cache_dir.  Each shared memory area is about
+800 kilobytes in size.  You may need to modify your system's
+shared memory parameters:
+<P>
+<P>
+<DL>
+<DT><B>SHMSEG</B><DD><P>Maximum number of shared memory segments per process.
+<DT><B>SHMMNI</B><DD><P>Maximum number of shared memory segments for the whole system.
+<DT><B>SHMMAX</B><DD><P>Largest shared memory segment size allowed.
+<DT><B>SHMALL</B><DD><P>Total amount of shared memory that can be used.
+</DL>
+<P>
+<P>For Squid and DISKD, <EM>SHMMNI</EM> and <EM>SHMMNI</EM> must be greater than
+or equal to the number of <EM>cache_dir</EM>'s that you have.   <EM>SHMMAX</EM>
+must be at least 800 kilobytes.  <EM>SHMALL</EM> must be at least 
+<EM>SHMMAX</EM> 800 kilobytes multiplied by the number of <EM>cache_dir</EM>'s.
+<P>
+<H3>FreeBSD</H3>
+
+<P>Your kernel must have
+<PRE>
+options         SYSVSHM
+</PRE>
+<P>
+<P>You can set the parameters in the kernel as follows.  This is just
+an example.  Make sure the values are appropriate for your system:
+<PRE>
+options         SHMSEG=16       # max shared mem id's per process
+options         SHMMNI=32       # max shared mem id's per system
+options         SHMMAX=2097152  # max shared memory segment size (bytes)
+options         SHMALL=4096     # max amount of shared memory (pages)
+</PRE>
+<P>
+<H3>Digital Unix</H3>
+
+<P>Message queue support seems to be in the kernel
+by default.  Setting the options is as follows:
+<PRE>
+options         SHMSEG="16"       # max shared mem id's per process
+options         SHMMNI="32"       # max shared mem id's per system
+options         SHMMAX="2097152"  # max shared memory segment size (bytes)
+options         SHMALL=4096       # max amount of shared memory (pages)
+</PRE>
+<P>
+<P>by 
+<A HREF="mailto:B.C.Phillips at massey dot ac dot nz">Brenden Phillips</A><P>If you have a newer version (DU64), then you can probably use
+<EM>sysconfig</EM> instead.  To see what the current IPC settings are run 
+<PRE>
+# sysconfig -q ipc
+</PRE>
+
+To change them make a file like this called ipc.stanza:
+<PRE>
+ipc:
+        shm-seg = 16
+        shm-mni = 32
+        shm-max = 2097152
+        shm-all = 4096
+</PRE>
+
+then run
+<PRE>
+# sysconfigdb -a -f ipc.stanza 
+</PRE>
+
+You have to reboot for the change to take effect.
+<P>
+<P>
+<H3>Linux</H3>
+
+<P>In my limited browsing on Linux, I didn't see any way to change
+shared memory parameters except to modify the include files
+and build a new kernel.  On my system, the file
+is <EM>/usr/src/linux/include/asm-i386/shmparam.h</EM>
+<P>
+<P>Oh, it looks like you can change <EM>SHMMAX</EM> by writing
+the file <EM>/proc/sys/kernel/shmmax</EM>.
+<P>
+<P>Stefan K&ouml;psell reports that if you compile sysctl support
+into your kernel, then you can change the following values:
+<UL>
+<LI>kernel.shmall</LI>
+<LI>kernel.shmmni</LI>
+<LI>kernel.shmmax</LI>
+</UL>
+<P>
+<H3>Solaris</H3>
+
+<P>Refer to
+<A HREF="http://www.sunworld.com/swol-09-1997/swol-09-insidesolaris.html">Shared memory uncovered</A>
+in Sunworld Magazine.
+<P>
+<P>To set the values, you can put these lines in <EM>/etc/system</EM>:
+<PRE>
+set shmsys:shminfo_shmmax=2097152
+set shmsys:shminfo_shmmni=32
+set shmsys:shminfo_shmseg=16
+</PRE>
+<P>
+<H2><A NAME="ss22.8">22.8 Sometimes shared memory and message queues aren't released when Squid exits.</A>
+</H2>
+
+<P>Yes, this is a little problem sometimes.  Seems like the operating system
+gets confused and doesn't always release shared memory and message
+queue resources when processes exit, especially if they exit abnormally.
+To fix it you can ``manually'' clear the resources with the <EM>ipcs</EM> command.
+Add this command into your <EM>RunCache</EM> or <EM>squid_start</EM>
+script:
+<PRE>
+ipcs | grep '^[mq]' | awk '{printf "ipcrm -%s %s\n", $1, $2}' | /bin/sh
+</PRE>
+<P>
+<H2><A NAME="ss22.9">22.9 What are the Q1 and Q2 parameters?</A>
+</H2>
+
+<P>In the source code, these are called <EM>magic1</EM> and <EM>magic2</EM>.
+These numbers refer to the number of oustanding requests on a message
+queue.  They are specified on the <EM>cache_dir</EM> option line, after
+the L1 and L2 directories:
+<PRE>
+cache_dir diskd /cache1 1024 16 256 Q1=72 Q2=64
+</PRE>
+<P>If there are more than Q1 messages outstanding, then Squid will
+intentionally fail to open disk files for reading and writing.
+This is a load-shedding mechanism.  If your cache gets really really
+busy and the disks can not keep up, Squid bypasses the disks until
+the load goes down again.
+<P>If there are more than Q2 messages outstanding, then the main Squid
+process ``blocks'' for a little bit until the diskd process services
+some of the messages and sends back some replies. 
+<P>Q1 should be larger than Q2.  You want Squid to get to the 
+``blocking'' condition before it gets to the ``refuse to open files''
+condition.
+<P>Reasonable values for Q1 and Q2 are 72 and 64, respectively.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-23.html">Next</A>
+<A HREF="FAQ-21.html">Previous</A>
+<A HREF="FAQ.html#toc22">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-23.html
+++ squid-2.5.9/debian/doc/FAQ-23.html
@@ -0,0 +1,356 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Authentication</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-24.html">Next</A>
+<A HREF="FAQ-22.html">Previous</A>
+<A HREF="FAQ.html#toc23">Contents</A>
+<HR>
+<H2><A NAME="s23">23. Authentication</A></H2>
+
+<H2><A NAME="ss23.1">23.1 How does Proxy Authentication work in Squid?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.4.</EM>
+<P>Users will be authenticated if squid is configured to use <EM>proxy_auth</EM>
+ACLs (see next question).
+<P>Browsers send the user's authentication credentials in the
+<EM>Authorization</EM> request header.
+<P>If Squid gets a request and the <EM>http_access</EM> rule list
+gets to a <EM>proxy_auth</EM> ACL, Squid looks for the <EM>Authorization</EM>
+header.  If the header is present, Squid decodes it and extracts
+a username and password.
+<P>If the header is missing, Squid returns
+an HTTP reply with status 407 (Proxy Authentication Required).
+The user agent (browser) receives the 407 reply and then prompts
+the user to enter a name and password.  The name and password are
+encoded, and sent in the <EM>Authorization</EM> header for subsequent
+requests to the proxy.
+<P>
+<P><EM>NOTE</EM>: The name and password are encoded using ``base64''
+(See section 11.1 of 
+<A HREF="ftp://ftp.isi.edu/in-notes/rfc2616.txt">RFC 2616</A>).  However, base64 is a binary-to-text encoding only,
+it does NOT encrypt the information it encodes.  This means that
+the username and password are essentially ``cleartext'' between
+the browser and the proxy.  Therefore, you probably should not use
+the same username and password that you would use for your account login.
+<P>
+<P>Authentication is actually performed outside of main Squid process.
+When Squid starts, it spawns a number of authentication subprocesses.
+These processes read usernames and passwords on stdin, and reply
+with "OK" or "ERR" on stdout.  This technique allows you to use
+a number of different authentication schemes, although currently
+you can only use one scheme at a time.
+<P>The Squid source code comes with a few authentcation processes.
+These include:
+<UL>
+<LI>LDAP: Uses the Lightweight Directory Access Protocol</LI>
+<LI>NCSA: Uses an NCSA-style username and password file.</LI>
+<LI>MSNT: Uses a Windows NT authentication domain.</LI>
+<LI>PAM: Uses the Linux Pluggable Authentication Modules scheme.</LI>
+<LI>SMB: Uses a SMB server like Windows NT or Samba. </LI>
+<LI>getpwam: Uses the old-fashioned Unix password file.</LI>
+</UL>
+<P>
+<P>In order to authenticate users, you need to compile and install
+one of the supplied authentication modules, one of 
+<A HREF="http://www.squid-cache.org/related-software.html#auth">the others</A>,
+or supply your own.
+<P>
+<P>You tell Squid which authentcation program to use with the
+<EM>authenticate_program</EM> option in squid.conf.  You specify 
+the name of the program, plus any command line options if
+necessary.  For example:
+<PRE>
+authenticate_program /usr/local/squid/bin/ncsa_auth /usr/local/squid/etc/passwd
+</PRE>
+<P>
+<P>
+<H2><A NAME="ss23.2">23.2 How do I use authentication in access controls?</A>
+</H2>
+
+<P>Make sure that your authentication program is installed
+and working correctly.  You can test it by hand.
+<P>Add some <EM>proxy_auth</EM> ACL entries to your squid configuration.
+For example:
+<PRE>
+acl foo proxy_auth REQUIRED
+acl all src 0/0
+http_access allow foo
+http_access deny all
+</PRE>
+
+The REQURIED term means that any authenticated user will match the
+ACL named <EM>foo</EM>.
+<P>Squid allows you to provide fine-grained controls
+by specifying individual user names.  For example:
+<PRE>
+acl foo proxy_auth REQUIRED
+acl bar proxy_auth lisa sarah frank joe
+acl daytime time 08:00-17:00
+acl all src 0/0
+http_access allow bar
+http_access allow foo daytime
+http_access deny all
+</PRE>
+
+In this example, users named lisa, sarah, joe, and frank
+are allowed to use the proxy at all times.  Other users
+are allowed only during daytime hours.
+<P>
+<H2><A NAME="ss23.3">23.3 Does Squid cache authentication lookups?</A>
+</H2>
+
+<P>Yes.  Successful authentication lookups are cached for
+one hour by default.  That means (in the worst case) its possible
+for someone to keep using your cache up to an hour after he
+has been removed from the authentication database.
+<P>You can control the expiration
+time with the <EM>authenticate_ttl</EM> option.
+<P>
+<P>
+<H2><A NAME="ss23.4">23.4 Are passwords stored in clear text or encrypted?</A>
+</H2>
+
+<P>Squid stores cleartext passwords in itsmemory cache.
+<P>Squid writes cleartext usernames and passwords when talking to
+the external authentication processes.  Note, however, that this 
+interprocess communication occors over TCP connections bound to
+the loopback interface.  Thus, its not possile for processes on
+other comuters to "snoop" on the authentication traffic.
+<P>
+<P>Each authentication program must select its own scheme for persistent
+storage of passwords and usernames.
+<P>
+<P>
+<H2><A NAME="ss23.5">23.5 How do I use the Winbind authenticators?</A>
+</H2>
+
+<P>by
+<A HREF="mailto: jmurdock at itraktech dot com">Jerry Murdock</A><P>
+<P>Winbind is a recent addition to Samba providing some impressive 
+capabilities for NT based user accounts.  From Squid's perspective winbind provides a 
+robust and efficient engine for both basic and NTLM challenge/response authentication
+against an NT domain controller.
+<P>The winbind authenticators have been used successfully under Linux, FreeBSD and Solaris.
+<P>
+<P>
+<H3>Supported Samba Releases</H3>
+
+<P>Squid 2.5 uses an internal Samba interface to communicate with the winbindd daemon. 
+It is therefore sensitive to any changes the Samba team may make to the interface.
+<P>
+<P>Squid-2.5.STABLE1 works with Samba 2.2.4 or 2.2.5. With Samba 2.2.6, the
+winbindd interface changed and Squid 2.5.STABLE1 will not work as 
+distributed.  Replacing the <CODE>winbindd_nss.h</CODE> file in Squid's 
+<CODE>helpers/basic_auth/winbind</CODE>, <CODE>helpers/ntlm_auth/winbind</CODE>
+and <CODE>helpers/external_acl/winbind_group/</CODE> directories with the
+version in Samba's <CODE>source/nsswitch</CODE> directory is needed for the
+helpers to work properly.
+<P>
+<P>Squid-2.5.STABLE2 will support Samba-2.2.6 to Samba-2.2.7a and hopefully
+later Samba versions. To use Squid-2.5.STABLE2 with Samba versions 2.2.5
+or ealier the new --with-samba-sources=... configure option is required.
+This may also be the case with Samba-2.2.X versions later than 2.2.7a or
+if you have applied any winbind related patches to your Samba tree.
+<P>
+<P>The Samba and Squid teams are actively working together to insure future Samba 
+stable releases will be supported, with the goal that Samba-3.X will allow
+Squid and other NTLM appliations to operate without depending on Samba
+internals. The exact details of how this will work is not yet defined.
+<P>
+<H3>Configure Samba</H3>
+
+<P><B>Build/Install Samba</B>
+<P>Samba must be built with configure options:
+<PRE>
+        --with-winbind
+        --with-winbind-auth-challenge (needed for ntlm)
+</PRE>
+<P>Optionally, if building Samba 2.2.5, apply the
+<A HREF="http://www.squid-cache.org/mail-archive/squid-dev/200207/att-0117/01-smbpasswd.diff">smbpasswd.diff</A>
+patch.  See 
+<A HREF="#WinbindTrustAccounts">SMBD and Machine Trust Accounts</A> below to
+determine if the patch is worthwhile.
+<P><B>Test Samba's winbindd</B>
+<OL>
+<LI>Edit smb.conf for winbindd functionality.  The following entries in 
+the [global] section of smbd.conf may be used as a template.
+<PRE>
+workgroup = mydomain
+password server = myPDC
+security = domain
+winbind uid = 10000-20000
+winbind gid = 10000-20000
+winbind use default domain = yes 
+</PRE>
+</LI>
+<LI>Join the NT domain as outlined in the winbindd man page for your 
+version of samba. </LI>
+<LI>Test winbindd functionality.
+<UL>
+<LI>Start nmbd (required to insure proper operation).</LI>
+<LI>Start winbindd.</LI>
+<LI>Test basic winbindd functionality "wbinfo -t":
+<PRE>
+# wbinfo -t
+Secret is good
+</PRE>
+</LI>
+<LI>Test winbindd user authentication:
+<PRE>
+# wbinfo -a mydomain\\myuser%mypasswd
+plaintext password authentication succeeded
+error code was NT_STATUS_OK (0x0)
+challenge/response password authentication succeeded
+error code was NT_STATUS_OK (0x0)
+</PRE>
+</LI>
+</UL>
+
+
+<EM>NOTE</EM>: both plaintext and challenge/response should return
+"succeeded." If there is no "challenge/response" status returned then Samba 
+was not built with "--with-winbind-auth-challenge" and cannot support ntlm
+authentication.
+<P>
+</LI>
+</OL>
+<P><B>SMBD and Machine Trust Accounts</B>
+<A NAME="WinbindTrustAccounts"></A> <P>
+<P><B>Samba 2.2.x</B>
+<P>Samba's smbd daemon, while not strictly required by winbindd may be needed
+to manage the machine's trust account.
+<P>Well behaved domain members change the account password on a regular
+basis.  Windows and Samba servers default to changing this password
+every seven days.  
+<P>The Samba component responsible for managing the trust account password
+is smbd. Smbd needs to receive requests to trigger the password change.
+If the machine will be used for file and print services, then just
+running smbd to serve routine requests should keep everything happy.  
+<P>However, in cases where Squid's winbind helpers are the only reason
+Samba components are running, smbd may sit idle.  Indeed, there may be
+no other reason to run smbd at all. 
+<P>There are two sample options to change the trust account. Either may be scheduled daily via a cron job to
+change the trust password.
+<P>
+<A HREF="http://www.squid-cache.org/mail-archive/squid-dev/200207/att-0076/02-UglySolution.pl">UglySolution.pl</A>
+is a sample perl script to load smbd, connect to
+a Samba share using smbclient, and generate enough dummy activity to
+trigger smbd's machine trust account password change code.  
+<P>
+<A HREF="http://www.squid-cache.org/mail-archive/squid-dev/200207/att-0117/01-smbpasswd.diff">smbpasswd.diff</A>
+is a patch to Samba 2.2.5's smbpasswd utility to allow
+changing the machine account password at will.  It is a minimal patch
+simply exposing a command line interface to an existing Samba function.
+<P><B>Note: This patch has been included in Samba as of 2.2.6pre2.</B> 
+<P>
+<P>Once patched, the smbpasswd syntax to change the password is:
+<PRE>
+        smbpasswd -t DOMAIN -r PDC
+</PRE>
+<P><B>Samba 3.x</B>
+<P>The Samba team has incorporated functionality to change the machine 
+trust account password in the new "net" command.  A simple daily cron
+job scheduling "<CODE>net rpc changetrustpw</CODE>" is all that is needed.
+<P>
+<P>
+<H3>Configure Squid</H3>
+
+<P>
+<P><B>Build/Install Squid</B>
+<P>Squid must be built with the configure options:
+<PRE>
+        --enable-auth="ntlm,basic"
+        --enable-basic-auth-helpers="winbind"
+        --enable-ntlm-auth-helpers="winbind"
+</PRE>
+<P><B>Test Squid without auth</B>
+<P>Before going further, test basic Squid functionality.  Make sure squid 
+is functioning without requiring authorization.
+<P>
+<P><B>Test the helpers</B>
+<P>Testing the winbind ntlm helper is not really possible from the command
+line, but the winbind basic authenticator can be tested like any other
+basic helper:
+<PRE>
+        # /usr/local/squid/libexec/wb_auth -d
+        /wb_auth[65180](wb_basic_auth.c:136): basic winbindd auth helper ...
+        mydomain\myuser mypasswd                   
+        /wb_auth[65180](wb_basic_auth.c:107): Got 'mydomain\myuser mypasswd' from squid (length: 24).
+        /wb_auth[65180](wb_basic_auth.c:54): winbindd result: 0
+        /wb_auth[65180](wb_basic_auth.c:57): sending 'OK' to squid
+        OK
+</PRE>
+
+The helper should return "OK" if given a valid username/password.
+<P>
+<P>
+<P><B>Edit squid.conf</B>
+<P>
+<OL>
+<LI>Setup the authenticators.
+<P>Add the following to enable both the winbind basic and ntlm 
+authenticators. IE will use ntlm and everything else basic:
+<PRE>
+        auth_param ntlm program /usr/local/squid/libexec/wb_ntlmauth         
+        auth_param ntlm children 5
+        auth_param ntlm max_challenge_reuses 0
+        auth_param ntlm max_challenge_lifetime 2 minutes
+
+        auth_param basic program /usr/local/squid/libexec/wb_auth
+        auth_param basic children 5
+        auth_param basic realm Squid proxy-caching web server
+        auth_param basic credentialsttl 2 hours
+</PRE>
+</LI>
+<LI>Add acl entries to require authentication:
+<PRE>
+        acl AuthorizedUsers proxy_auth REQUIRED
+        ..
+        http_access allow all AuthorizedUsers
+</PRE>
+</LI>
+</OL>
+<P>
+<P><B>Test Squid with auth</B>
+<P>
+<OL>
+<LI>Internet Explorer:
+<P>Test browsing through squid with IE. If logged into the domain,
+a password prompt should NOT pop up. 
+<P>Confirm the traffic really is being authorized by tailing access.log.
+The domain\username should be present.
+<P>
+</LI>
+<LI>Netscape, mozilla, opera...:
+<P>Test with a non-IE browser.  A standard password dialog should appear.
+<P>Entering the domain should not be required if the user is in the 
+default domain and "winbind use default domain = yes" is set in 
+smb.conf.  Otherwise, the username must be entered in "domain\username" format.
+</LI>
+</OL>
+<P>
+<P>If no usernames appear in access.log and/or no password dialogs appear
+in either browser, then the acl/http_access portions of squid.conf are
+not correct. 
+<P>
+<P><B>References</B>
+<P>
+<A HREF="http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection.html#WINBIND">Samba Winbind Overview</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection.html#AEN1134">Joining a Domain in Samba 2.2.x</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/winbindd.8.html">winbindd man page</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/wbinfo.1.html">wbinfo man page</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/nmbd.8.html">nmbd man page</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/smbd.8.html">smbd man page</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/smb.conf.5.html">smb.conf man page</A><P>
+<A HREF="http://www.samba.org/samba/docs/man/smbclient.1.html">smbclient man page</A><P>
+<P>
+<HR>
+<A HREF="FAQ-24.html">Next</A>
+<A HREF="FAQ-22.html">Previous</A>
+<A HREF="FAQ.html#toc23">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-24.html
+++ squid-2.5.9/debian/doc/FAQ-24.html
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Terms and Definitions</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-25.html">Next</A>
+<A HREF="FAQ-23.html">Previous</A>
+<A HREF="FAQ.html#toc24">Contents</A>
+<HR>
+<H2><A NAME="s24">24. Terms and Definitions</A></H2>
+
+<H2><A NAME="ss24.1">24.1 Neighbor</A>
+</H2>
+
+<P>In Squid, <EM>neighbor</EM> usually means the same thing as <EM>peer</EM>.
+A neighbor cache is one that you have defined with the <EM>cache_host</EM> configuration
+option.  Neighbor refers to either a parent or a sibling.
+<P>
+<P>In Harvest 1.4, neighbor referred to what Squid calls a sibling.  That is, Harvest
+had <EM>parents</EM> and <EM>neighbors</EM>.  For backward compatability, the term
+neighbor is still accepted in some Squid configuration options.
+<P>
+<H2><A NAME="ss24.2">24.2 Regular Expression</A>
+</H2>
+
+<P>Regular expressions are patterns that used for matching sequences
+of characters in text.  For more information, see
+<A HREF="http://jmason.org/software/sitescooper/tao_regexps.html">A Tao of Regular Expressions</A> and
+<A HREF="http://www.newbie.org/gazette/xxaxx/xprmnt02.html">Newbie's page</A>.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-25.html">Next</A>
+<A HREF="FAQ-23.html">Previous</A>
+<A HREF="FAQ.html#toc24">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-25.html
+++ squid-2.5.9/debian/doc/FAQ-25.html
@@ -0,0 +1,59 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Security Concerns</TITLE>
+</HEAD>
+<BODY>
+Next
+<A HREF="FAQ-24.html">Previous</A>
+<A HREF="FAQ.html#toc25">Contents</A>
+<HR>
+<H2><A NAME="s25">25. Security Concerns</A></H2>
+
+<H2><A NAME="ss25.1">25.1 Open-access proxies</A>
+</H2>
+
+<P>Squid's default configuration file denies all client requests.  It is the
+administrator's responsibility to configure Squid to allow access only
+to trusted hosts and/or users.
+<P>If your proxy allows access from untrusted hosts or users, you can be
+sure that people will find and abuse your service.  Some people
+will use your proxy to make their browsing anonymous.  Others will
+intentionally use your proxy for transactions that may be illegal
+(such as credit card fraud).  A number of web sites exist simply
+to provide the world with a list of open-access HTTP proxies.  You
+don't want to end up on this list.
+<P>Be sure to carefully design your access control scheme.  You should
+also check it from time to time to make sure that it works as you
+expect. 
+<P>
+<H2><A NAME="ss25.2">25.2 Mail relaying</A>
+</H2>
+
+<P>SMTP and HTTP are rather similar in design.  This, unfortunately, may
+allow someone to relay an email message through your HTTP proxy.  To
+prevent this, you must make sure that your proxy denies HTTP requests
+to port 25, the SMTP port.
+<P>Squid is configured this way by default.  The default <EM>squid.conf</EM>
+file lists a small number of trusted ports.  See the <EM>Safe_ports</EM>
+ACL in <EM>squid.conf</EM>.  Your configuration file should always deny
+unsafe ports early in the <EM>http_access</EM> lists:
+<PRE>
+http_access deny !Safe_ports
+(additional http_access lines ...)
+</PRE>
+<P>Do NOT add port 25 to <EM>Safe_ports</EM> (unless your goal is to end
+up in the 
+<A HREF="http://mail-abuse.org/rbl/">RBL</A>).  You may
+want to make a cron job that regularly verifies that your proxy blocks
+access to port 25.
+<P>
+<PRE>
+$Id: FAQ.sgml,v 1.167 2003/03/11 17:48:54 wessels Exp $
+</PRE>
+<HR>
+Next
+<A HREF="FAQ-24.html">Previous</A>
+<A HREF="FAQ.html#toc25">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-3.html
+++ squid-2.5.9/debian/doc/FAQ-3.html
@@ -0,0 +1,369 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Installing and Running Squid</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-4.html">Next</A>
+<A HREF="FAQ-2.html">Previous</A>
+<A HREF="FAQ.html#toc3">Contents</A>
+<HR>
+<H2><A NAME="s3">3. Installing and Running Squid</A></H2>
+
+<H2><A NAME="ss3.1">3.1 How big of a system do I need to run Squid?</A>
+</H2>
+
+<P>There are no hard-and-fast rules.  The most important resource
+for Squid is physical memory.  Your processor does not need
+to be ultra-fast.  Your disk system will be the major bottleneck,
+so fast disks are important for high-volume caches.  Do not use
+IDE disks if you can help it.
+<P>
+<P>In late 1998, if you are buying a new machine for
+a cache, I would recommend the following configuration:
+<UL>
+<LI>300 MHz Pentium II CPU</LI>
+<LI>512 MB RAM</LI>
+<LI>Five 9 GB UW-SCSI disks</LI>
+</UL>
+
+Your system disk, and logfile disk can probably be IDE without losing
+any cache performance.
+<P>
+<P>Also, see 
+<A HREF="http://wwwcache.ja.net/servers/squids.html">Squid Sizing for Intel Platforms</A> by Martin Hamilton This is a
+very nice page summarizing system configurations people are using for
+large Squid caches.
+<P>
+<H2><A NAME="ss3.2">3.2 How do I install Squid?</A>
+</H2>
+
+<P>After 
+<A HREF="FAQ-2.html#compiling">compiling Squid</A>, you can install it
+with this simple command:
+<PRE>
+        % make install
+</PRE>
+
+If you have enabled the
+<A HREF="FAQ-7.html#using-icmp">ICMP features</A>
+then you will also want to type
+<PRE>
+        % su
+        # make install-pinger
+</PRE>
+<P>
+<P>After installing, you will want to edit and customize
+the <EM>squid.conf</EM> file.  By default, this file is
+located at <EM>/usr/local/squid/etc/squid.conf</EM>.
+<P>
+<P>Also, a QUICKSTART guide has been included with the source
+distribution.  Please see the directory where you
+unpacked the source archive.
+<P>
+<H2><A NAME="ss3.3">3.3 What does the <EM>squid.conf</EM> file do?</A>
+</H2>
+
+<P>The <EM>squid.conf</EM> file defines the configuration for
+<EM>squid</EM>.  the configuration includes (but not limited to)
+HTTP port number, the ICP request port number, incoming and outgoing
+requests, information about firewall access, and various timeout
+information.
+<P>
+<H2><A NAME="ss3.4">3.4 Do you have a <EM>squid.conf</EM> example?</A>
+</H2>
+
+<P>Yes, after you <CODE>make install</CODE>, a sample <EM>squid.conf</EM> file will
+exist in the ``etc" directory under the Squid installation directory.
+<P>The sample <EM>squid.conf</EM> file contains comments explaining each
+option.
+<P>
+<P>
+<H2><A NAME="ss3.5">3.5 How do I start Squid?</A>
+</H2>
+
+<P>First you need to make your Squid configuration. The Squid configuration
+can be found in /usr/local/squid/etc/squid.conf and by default includes
+documentation on all directives.
+<P>
+<P>In the Suqid distribution there is a small QUICKSTART guide indicating
+which directives you need to look closer at and why. At a absolute minimum
+you need to change the http_access configuration to allow access from
+your clients.
+<P>
+<P>To verify your configuration file you can use the -k parse option
+<PRE>
+        % /usr/local/squid/sbin/squid -k parse
+</PRE>
+
+If this outputs any errors then these are syntax errors or other fatal
+misconfigurations and needs to be corrected before you continue. If it is
+silent and immediately gives back the command promt then your squid.conf
+is syntactically correct and could be understood by Squid.
+<P>
+<P>After you've finished editing the configuration file, you can
+start Squid for the first time.  The procedure depends a little
+bit on which version you are using.
+<P>
+<P>First, you must create the swap directories.  Do this by
+running Squid with the -z option:
+<PRE>
+        % /usr/local/squid/sbin/squid -z
+</PRE>
+<P>
+<P>NOTE: If you run Squid as root then you may need to first create
+/usr/local/squid/var/logs and your cache_dir directories and assign ownership
+of these to the cache_effective_user configured in your squid.conf.
+<P>
+<P>Once the creation of the cache directories completes, you can start Squid
+and try it out. Probably the best thing to do is run it from your terminal
+and watch the debugging output.  Use this command:
+<PRE>
+        % /usr/local/squid/sbin/squid -NCd1
+</PRE>
+
+If everything is working okay, you will see the line:
+<PRE>
+        Ready to serve requests.
+</PRE>
+
+If you want to run squid in the background, as a daemon process,
+just leave off all options:
+<PRE>
+        % /usr/local/squid/sbin/squid
+</PRE>
+<P>NOTE: depending on which http_port you select you may need to start
+squid as root (http_port &lt;1024).
+<P>
+<P>NOTE: In Squid-2.4 and earlier Squid was installed in bin by default, not sbin.
+<P>
+<H2><A NAME="ss3.6">3.6 How do I start Squid automatically when the system boots?</A>
+</H2>
+
+<P>Squid-2 has a restart feature built in.  This greatly simplifies
+starting Squid and means that you don't need to use <EM>RunCache</EM>
+or <EM>inittab</EM>.  At the minimum, you only need to enter the
+pathname to the Squid executable.  For example:
+<PRE>
+        /usr/local/squid/sbin/squid
+</PRE>
+<P>
+<P>Squid will automatically background itself and then spawn
+a child process.  In your <EM>syslog</EM> messages file, you
+should see something like this:
+<PRE>
+        Sep 23 23:55:58 kitty squid[14616]: Squid Parent: child process 14617 started
+</PRE>
+
+That means that process ID 14563 is the parent process which monitors the child
+process (pid 14617).  The child process is the one that does all of the
+work.  The parent process just waits for the child process to exit.  If the 
+child process exits unexpectedly, the parent will automatically start another
+child process.  In that case, <EM>syslog</EM> shows:
+<PRE>
+        Sep 23 23:56:02 kitty squid[14616]: Squid Parent: child process 14617 exited with status 1
+        Sep 23 23:56:05 kitty squid[14616]: Squid Parent: child process 14619 started
+</PRE>
+<P>
+<P>If there is some problem, and Squid can not start, the parent process will give up
+after a while.  Your <EM>syslog</EM> will show:
+<PRE>
+        Sep 23 23:56:12 kitty squid[14616]: Exiting due to repeated, frequent failures
+</PRE>
+
+When this happens you should check your <EM>syslog</EM> messages and
+<EM>cache.log</EM> file for error messages.
+<P>
+<P>When  you look at a process (<EM>ps</EM> command) listing,  you'll see two squid processes:
+<PRE>
+        24353  ??  Ss     0:00.00 /usr/local/squid/bin/squid
+        24354  ??  R      0:03.39 (squid) (squid)
+</PRE>
+
+The first is the parent process, and the child process is the one called ``(squid)''.
+Note that if you accidentally kill the parent process, the child process will not
+notice.
+<P>
+<P>If you want to run Squid from your termainal and prevent it from
+backgrounding and spawning a child process, use the <EM>-N</EM> command
+line option.
+<PRE>
+        /usr/local/squid/bin/squid -N
+</PRE>
+<P>
+<H3>From inittab</H3>
+
+<P>On systems which have an <EM>/etc/inittab</EM> file (Digital Unix,
+Solaris, IRIX, HP-UX, Linux), you can add a line like this:
+<PRE>
+        sq:3:respawn:/usr/local/squid/sbin/squid.sh &lt; /dev/null >> /tmp/squid.log 2>&amp;1
+</PRE>
+
+We recommend using a <EM>squid.sh</EM> shell script, but you could instead call
+Squid directly with the -N option and other options you may require.  A sameple <EM>squid.sh</EM> script is shown below:
+<PRE>
+        #!/bin/sh
+        C=/usr/local/squid
+        PATH=/usr/bin:$C/bin
+        TZ=PST8PDT
+        export PATH TZ
+        
+        # User to notify on restarts
+        notify="root"
+
+        # Squid command line options
+        opts=""
+
+        cd $C
+        umask 022
+        sleep 10
+        while [ -f /var/run/nosquid ]; do
+                sleep 1
+        done
+        /usr/bin/tail -20 $C/logs/cache.log \
+                | Mail -s "Squid restart on `hostname` at `date`" $notify
+        exec bin/squid -N $opts
+</PRE>
+<P>
+<H3>From rc.local</H3>
+
+<P>On BSD-ish systems, you will need to start Squid from the ``rc'' files,
+usually <EM>/etc/rc.local</EM>.  For example:
+<PRE>
+        if [ -f /usr/local/squid/sbin/squid ]; then
+                echo -n ' Squid'
+                /usr/local/squid/sbin/squid
+        fi
+</PRE>
+<P>
+<H3>From init.d</H3>
+
+<P>Squid ships with a init.d type startup script in contrib/squid.rc which
+works on most init.d type systems. Or you can write your own using any
+normal init.d script found in your system as template and add the
+start/stop fragments shown below.
+<P>
+<P>Start:
+<PRE>
+        /usr/local/squid/sbin/squid
+</PRE>
+<P>
+<P>Stop:
+<PRE>
+        /usr/local/squid/sbin/squid -k shutdown
+        n=120
+        while /usr/local/squid/sbin/squid -k check &amp;&amp; [ $n -gt 120 ]; do
+            sleep 1
+            echo -n .
+            n=`expr $n - 1`
+        done
+</PRE>
+<P>
+<H2><A NAME="ss3.7">3.7 How do I tell if Squid is running?</A>
+</H2>
+
+<P>You can use the <EM>client</EM> program:
+<PRE>
+        % client http://www.netscape.com/ > test
+</PRE>
+<P>
+<P>There are other command-line HTTP client programs available
+as well.  Two that you may find useful are
+<A HREF="ftp://gnjilux.cc.fer.hr/pub/unix/util/wget/">wget</A>
+and
+<A HREF="ftp://ftp.internatif.org/pub/unix/echoping/">echoping</A>.
+<P>
+<P>Another way is to use Squid itself to see if it can signal a running
+Squid process:
+<PRE>
+        % squid -k check
+</PRE>
+
+And then check the shell's exit status variable.
+<P>
+<P>Also, check the log files, most importantly the <EM>access.log</EM> and
+<EM>cache.log</EM> files.
+<P>
+<H2><A NAME="ss3.8">3.8 <EM>squid</EM> command line options</A>
+</H2>
+
+<P>These are the command line options for <B>Squid-2</B>:
+<DL>
+<DT><B>-a</B><DD><P>Specify an alternate port number for incoming HTTP requests.
+Useful for testing a configuration file on a non-standard port.
+<DT><B>-d</B><DD><P>Debugging level for ``stderr'' messages.  If you use this
+option, then debugging messages up to the specified level will
+also be written to stderr.
+<DT><B>-f</B><DD><P>Specify an alternate <EM>squid.conf</EM> file instead of the
+pathname compiled into the executable.
+<DT><B>-h</B><DD><P>Prints the usage and help message.
+<DT><B>-k reconfigure</B><DD><P>Sends a <EM>HUP</EM> signal, which causes Squid to re-read
+its configuration files.
+<DT><B>-k rotate</B><DD><P>Sends an <EM>USR1</EM> signal, which causes Squid to
+rotate its log files.  Note, if <EM>logfile_rotate</EM>
+is set to zero, Squid still closes and re-opens
+all log files.
+<DT><B>-k shutdown</B><DD><P>Sends a <EM>TERM</EM> signal, which causes Squid to
+wait briefly for current connections to finish and then
+exit.  The amount of time to wait is specified with
+<EM>shutdown_lifetime</EM>.
+<DT><B>-k interrupt</B><DD><P>Sends an <EM>INT</EM> signal, which causes Squid to
+shutdown immediately, without waiting for
+current connections.
+<DT><B>-k kill</B><DD><P>Sends a <EM>KILL</EM> signal, which causes the Squid
+process to exit immediately, without closing
+any connections or log files.  Use this only
+as a last resort.
+<DT><B>-k debug</B><DD><P>Sends an <EM>USR2</EM> signal, which causes Squid
+to generate full debugging messages until the
+next <EM>USR2</EM> signal is recieved.  Obviously
+very useful for debugging problems.
+<DT><B>-k check</B><DD><P>Sends a ``<EM>ZERO</EM>'' signal to the Squid process.
+This simply checks whether or not the process
+is actually running.
+<DT><B>-s</B><DD><P>Send debugging (level 0 only) message to syslog.
+<DT><B>-u</B><DD><P>Specify an alternate port number for ICP messages.
+Useful for testing a configuration file on a non-standard port.
+<DT><B>-v</B><DD><P>Prints the Squid version.
+<DT><B>-z</B><DD><P>Creates disk swap directories.  You must use this option when
+installing Squid for the first time, or when you add or
+modify the <EM>cache_dir</EM> configuration.
+<DT><B>-D</B><DD><P>Do not make initial DNS tests.  Normally, Squid looks up
+some well-known DNS hostnames to ensure that your DNS
+name resolution service is working properly.
+<DT><B>-F</B><DD><P>If the <EM>swap.state</EM> logs are clean, then the cache is
+rebuilt in the ``foreground'' before any requests are
+served.  This will decrease the time required to rebuild
+the cache, but HTTP requests will not be satisified during
+this time.
+<DT><B>-N</B><DD><P>Do not automatically become a background daemon process.
+<DT><B>-R</B><DD><P>Do not set the SO_REUSEADDR option on sockets.
+<DT><B>-V</B><DD><P>Enable virtual host support for the httpd-accelerator mode.
+This is identical to writing <EM>httpd_accel_host virtual</EM>
+in the config file.
+<DT><B>-X</B><DD><P>Enable full debugging while parsing the config file.
+<DT><B>-Y</B><DD><P>Return ICP_OP_MISS_NOFETCH instead of ICP_OP_MISS while
+the <EM>swap.state</EM> file is being read.  If your cache has
+mostly child caches which use ICP, this will allow your
+cache to rebuild faster.
+</DL>
+<P>
+<H2><A NAME="ss3.9">3.9 How do I see how Squid works?</A>
+</H2>
+
+<P>
+<UL>
+<LI>Check the <EM>cache.log</EM> file in your logs directory.  It logs
+interesting (and boring) things as a part of its normal operation.</LI>
+<LI>Install and use the
+<A HREF="FAQ-9.html#cachemgr-section">Cache Manager</A>.</LI>
+</UL>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-4.html">Next</A>
+<A HREF="FAQ-2.html">Previous</A>
+<A HREF="FAQ.html#toc3">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-4.html
+++ squid-2.5.9/debian/doc/FAQ-4.html
@@ -0,0 +1,583 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Configuration issues</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-5.html">Next</A>
+<A HREF="FAQ-3.html">Previous</A>
+<A HREF="FAQ.html#toc4">Contents</A>
+<HR>
+<H2><A NAME="s4">4. Configuration issues</A></H2>
+
+<H2><A NAME="ss4.1">4.1 How do I join a cache hierarchy?</A>
+</H2>
+
+<P>To place your cache in a hierarchy, use the <CODE>cache_host</CODE>
+directive in <EM>squid.conf</EM> to specify the parent and sibling
+nodes.
+<P>
+<P>For example, the following <EM>squid.conf</EM> file on
+<CODE>childcache.example.com</CODE> configures its cache to retrieve
+data from one parent cache and two sibling caches:
+<P>
+<PRE>
+        #  squid.conf - On the host: childcache.example.com
+        #
+        #  Format is: hostname  type  http_port  udp_port
+        #
+        cache_host parentcache.example.com   parent  3128 3130
+        cache_host childcache2.example.com   sibling 3128 3130
+        cache_host childcache3.example.com   sibling 3128 3130
+</PRE>
+<P>The <CODE>cache_host_domain</CODE> directive allows you to specify that
+certain caches siblings or parents for certain domains:
+<P>
+<PRE>
+        #  squid.conf - On the host: sv.cache.nlanr.net
+        #
+        #  Format is: hostname  type  http_port  udp_port
+        #
+
+        cache_host electraglide.geog.unsw.edu.au parent 3128 3130
+        cache_host cache1.nzgate.net.nz          parent 3128 3130
+        cache_host pb.cache.nlanr.net   parent 3128 3130
+        cache_host it.cache.nlanr.net   parent 3128 3130
+        cache_host sd.cache.nlanr.net   parent 3128 3130
+        cache_host uc.cache.nlanr.net   sibling 3128 3130
+        cache_host bo.cache.nlanr.net   sibling 3128 3130
+        cache_host_domain electraglide.geog.unsw.edu.au .au
+        cache_host_domain cache1.nzgate.net.nz   .au .aq .fj .nz
+        cache_host_domain pb.cache.nlanr.net     .uk .de .fr .no .se .it
+        cache_host_domain it.cache.nlanr.net     .uk .de .fr .no .se .it
+        cache_host_domain sd.cache.nlanr.net     .mx .za .mu .zm
+</PRE>
+<P>The configuration above indicates that the cache will use
+<CODE>pb.cache.nlanr.net</CODE> and <CODE>it.cache.nlanr.net</CODE>
+for domains uk, de, fr, no, se and it, <CODE>sd.cache.nlanr.net</CODE>
+for domains mx, za, mu and zm, and <CODE>cache1.nzgate.net.nz</CODE>
+for domains au, aq, fj, and nz.
+<P>
+<H2><A NAME="ss4.2">4.2 How do I join NLANR's cache hierarchy?</A>
+</H2>
+
+<P>We have a simple set of
+<A HREF="http://www.ircache.net/Cache/joining.html">guidelines for joining</A>
+the NLANR cache hierarchy.
+<P>
+<H2><A NAME="ss4.3">4.3 Why should I want to join NLANR's cache hierarchy?</A>
+</H2>
+
+<P>The NLANR hierarchy can provide you with an initial source for parent or
+sibling caches.  Joining the NLANR global cache system will frequently
+improve the performance of your caching service.
+<P>
+<H2><A NAME="ss4.4">4.4 How do I register my cache with NLANR's registration service?</A>
+</H2>
+
+<P>Just enable these options in your <EM>squid.conf</EM> and you'll be
+registered:
+<PRE>
+        cache_announce 24
+        announce_to sd.cache.nlanr.net:3131
+</PRE>
+<P><EM>NOTE:</EM> announcing your cache <B>is not</B> the same thing as
+joining the NLANR cache hierarchy.
+You can join the NLANR cache hierarchy without registering, and
+you can register without joining the NLANR cache hierarchy.
+<P>
+<P>
+<H2><A NAME="ss4.5">4.5 How do I find other caches close to me and arrange parent/child/sibling relationships with them?</A>
+</H2>
+
+<P>Visit the NLANR cache
+<A HREF="http://www.ircache.net/Cache/Tracker/">registration database</A>
+to discover other caches near you.  Keep in mind that just because
+a cache is registered in the database <B>does not</B> mean they
+are willing to be your parent/sibling/child.  But it can't hurt to ask...
+<P>
+<P>
+<H2><A NAME="ss4.6">4.6 My cache registration is not appearing in the Tracker database.</A>
+</H2>
+
+<P>
+<UL>
+<LI>Your site will not be listed if your cache IP address does not have
+a DNS PTR record. If we can't map the IP address back to a domain
+name, it will be listed as ``Unknown.''</LI>
+<LI>The registration messages are sent with UDP. We may not be receiving
+your announcement message due to firewalls which block UDP, or
+dropped packets due to congestion.</LI>
+</UL>
+<P>
+<H2><A NAME="ss4.7">4.7 What is the httpd-accelerator mode?</A>
+</H2>
+
+<P>This entry has been moved to 
+<A HREF="FAQ-20.html#what-is-httpd-accelerator">a different section</A>.
+<P>
+<H2><A NAME="ss4.8">4.8 How do I configure Squid to work behind a firewall?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.2.</EM>
+<P>
+<P>If you are behind a firewall then you can't make direct connections
+to the outside world, so you <B>must</B> use a
+parent cache.  Squid doesn't use ICP queries for a request if it's
+behind a firewall or if there is only one parent.
+<P>
+<P>You can use the <CODE>never_direct</CODE> access list in
+<EM>squid.conf</EM> to specify which requests must be forwarded to
+your parent cache outside the firewall, and the <CODE>always_direct</CODE> access list
+to specify which requests must not be forwarded.  For example, if Squid
+must connect directly to all servers that end with <EM>mydomain.com</EM>, but
+must use the parent for all others, you would write:
+<PRE>
+        acl INSIDE dstdomain .mydomain.com
+        always_direct allow INSIDE
+        never_direct allow all
+</PRE>
+<P>
+<P>You could also specify internal servers by IP address
+<PRE>
+        acl INSIDE_IP dst 1.2.3.0/24
+        always_direct allow INSIDE_IP
+        never_direct allow all
+</PRE>
+
+Note, however that when you use IP addresses, Squid must
+perform a DNS lookup to convert URL hostnames to an
+address.  Your internal DNS servers may not be able to
+lookup external domains.
+<P>
+<P>If you use <EM>never_direct</EM> and you have multiple parent caches,
+then you probably will want to mark one of them as a default
+choice in case Squid can't decide which one to use.  That is
+done with the <EM>default</EM> keyword on a <EM>cache_peer</EM>
+line.  For example:
+<PRE>
+        cache_peer xyz.mydomain.com parent 3128 0 default
+</PRE>
+<P>
+<H2><A NAME="ss4.9">4.9 How do I configure Squid forward all requests to another proxy?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.2.</EM>
+<P>First, you need to give Squid a parent cache.  Second, you need
+to tell Squid it can not connect directly to origin servers.  This is done
+with three configuration file lines:
+<PRE>
+        cache_peer parentcache.foo.com parent 3128 0 no-query default
+        acl all src 0.0.0.0/0.0.0.0
+        never_direct allow all
+</PRE>
+
+Note, with this configuration, if the parent cache fails or becomes
+unreachable, then every request will result in an error message.
+<P>
+<P>In case you want to be able to use direct connections when all the
+parents go down you should use a different approach:
+<PRE>
+        cache_peer parentcache.foo.com parent 3128 0 no-query
+        prefer_direct off
+</PRE>
+
+The default behaviour of Squid in the absence of positive ICP, HTCP, etc
+replies is to connect to the origin server instead of using parents.
+The <EM>prefer_direct off</EM> directive tells Squid to try parents first.
+<P>
+<H2><A NAME="ss4.10">4.10 I have <EM>dnsserver</EM> processes that aren't being used, should I lower the number in <EM>squid.conf</EM>?</A>
+</H2>
+
+<P>The <EM>dnsserver</EM> processes are used by <EM>squid</EM> because the <CODE>gethostbyname(3)</CODE> library routines used to
+convert web sites names to their internet addresses
+blocks until the function returns (i.e., the process that calls
+it has to wait for a reply). Since there is only one <EM>squid</EM>
+process, everyone who uses the cache would have to wait each
+time the routine was called.  This is why the <EM>dnsserver</EM> is
+a separate process, so that these processes can block,
+without causing blocking in <EM>squid</EM>.
+<P>
+<P>It's very important that there are enough <EM>dnsserver</EM>
+processes to cope with every access you will need, otherwise
+<EM>squid</EM> will stop occasionally.  A good rule of thumb is to
+make sure you have at least the maximum number of dnsservers
+<EM>squid</EM> has <B>ever</B> needed on your system,
+and probably add two to be on the safe side. In other words, if
+you have only ever seen at most three <EM>dnsserver</EM> processes
+in use, make at least five.  Remember that a <EM>dnsserver</EM> is
+small and, if unused, will be swapped out.
+<P>
+<H2><A NAME="ss4.11">4.11 My <EM>dnsserver</EM> average/median service time seems high, how can I reduce it?</A>
+</H2>
+
+<P>First, find out if you have enough <EM>dnsserver</EM> processes running by
+looking at the Cachemanager <EM>dns</EM> output.  Ideally, you should see
+that the first <EM>dnsserver</EM> handles a lot of requests, the second one
+less than the first, etc.  The last <EM>dnsserver</EM> should have serviced
+relatively few requests.  If there is not an obvious decreasing trend, then
+you need to increase the number of <EM>dns_children</EM> in the configuration
+file.  If the last <EM>dnsserver</EM> has zero requests, then you definately
+have enough.
+<P>
+<P>Another factor which affects the <EM>dnsserver</EM> service time is the
+proximity of your DNS resolver.  Normally we do not recommend running
+Squid and <EM>named</EM> on the same host.  Instead you should try use a
+DNS resolver (<EM>named</EM>) on a different host, but on the same LAN.
+If your DNS traffic must pass through one or more routers, this could
+be causing unnecessary delays.
+<P>
+<H2><A NAME="ss4.12">4.12 How can I easily change the default HTTP port?</A>
+</H2>
+
+<P>Before you run the configure script, simply set the <EM>CACHE_HTTP_PORT</EM>
+environment variable.
+<PRE>
+        setenv CACHE_HTTP_PORT 8080
+        ./configure
+        make
+        make install
+</PRE>
+<P>
+<H2><A NAME="ss4.13">4.13 Is it possible to control how big each <EM>cache_dir</EM> is?</A>
+</H2>
+
+<P>With Squid-1.1 it is NOT possible.  Each <EM>cache_dir</EM> is assumed
+to be the same size.  The <EM>cache_swap</EM> setting defines the size of
+all <EM>cache_dir</EM>'s taken together.  If you have N <EM>cache_dir</EM>'s
+then each one will hold <EM>cache_swap</EM> &divide; N Megabytes.
+<P>
+<H2><A NAME="ss4.14">4.14 What <EM>cache_dir</EM> size should I use?</A>
+</H2>
+
+<P>Most people have a disk partition dedicated to the Squid cache.
+You don't want to use the entire partition size.  You have to leave
+some extra room.  Currently, Squid is not very tolerant of running
+out of disk space. 
+<P>Lets say you have a 9GB disk.
+Remember that disk manufacturers lie about the space available.
+A so-called 9GB disk usually results in about 8.5GB of raw, usable space.
+First, put a filesystem on it, and mount
+it.  Then check the ``available space'' with your <EM>df</EM> program.
+Note that you lose some disk space to filesystem overheads, like superblocks,
+inodes, and directory entries.  Also note that Unix normally keeps
+10% free for itself.   So with a 9GB disk, you're probably down to
+about 8GB after formatting.
+<P>
+<P>Next, I suggest taking off another 10%
+or so for Squid overheads, and a "safe buffer."  Squid normally puts
+its <EM>swap.state</EM> files in each cache directory.  These grow in size
+until you rotate the logs, or restart squid.
+Also note that Squid performs better when there is
+more free space.  So if performance is important to you, then take off
+even more space.  Typically, for a 9GB disk, I recommend a <EM>cache_dir</EM>
+setting of 6000 to 7500 Megabytes:
+<PRE>
+cache_dir ... 7000 16 256
+</PRE>
+<P>
+<P>Its better to start out conservative.  After the cache becomes full,
+look at the disk usage.  If you think there is plenty of unused space,
+then increase the <EM>cache_dir</EM> setting a little.
+<P>
+<P>If you're getting ``disk full'' write errors, then you definately need
+to decrease your cache size.
+<P>
+<H2><A NAME="ss4.15">4.15 I'm adding a new <EM>cache_dir</EM>.  Will I lose my cache?</A>
+</H2>
+
+<P>With Squid-1.1, yes, you will lose your cache.  This is because
+version 1.1 uses a simplistic algorithm to distribute files
+between cache directories.
+<P>
+<P>With Squid-2, you will not lose your existing cache.
+You can add and delete <EM>cache_dir</EM>'s without affecting
+any of the others.
+<P>
+<H2><A NAME="ss4.16">4.16 Squid and <EM>http-gw</EM> from the TIS toolkit.</A>
+</H2>
+
+<P>Several people on both the <EM>fwtk-users</EM> and the
+<EM>squid-users</EM> mailing asked
+about using Squid in combination with http-gw from the
+<A HREF="http://www.tis.com/">TIS toolkit</A>.
+The most elegant way in my opinion is to run an internal Squid caching
+proxyserver which handles client requests and let this server forward
+it's requests to the http-gw running on the firewall. Cache hits won't
+need to be handled by the firewall.
+<P>
+<P>In this example Squid runs on the same server as the http-gw, Squid uses
+8000 and http-gw uses 8080 (web).  The local domain is <EM>home.nl</EM>.
+<P>
+<H3>Firewall configuration:</H3>
+
+<P>Either run http-gw as a daemon from the <EM>/etc/rc.d/rc.local</EM> (Linux
+Slackware):
+<PRE>
+        exec /usr/local/fwtk/http-gw -daemon 8080
+</PRE>
+
+or run it from inetd like this:
+<PRE>
+        web stream      tcp      nowait.100  root /usr/local/fwtk/http-gw http-gw
+</PRE>
+
+I increased the watermark to 100 because a lot of people run into
+problems with the default value.
+<P>
+<P>Make sure you have at least the following line in
+<EM>/usr/local/etc/netperm-table</EM>:
+<PRE>
+        http-gw:        hosts 127.0.0.1
+</PRE>
+
+You could add the IP-address of your own workstation to this rule and
+make sure the http-gw by itself works, like:
+<PRE>
+        http-gw:                hosts 127.0.0.1 10.0.0.1
+</PRE>
+<P>
+<H3>Squid configuration:</H3>
+
+<P>The following settings are important:
+<P>
+<PRE>
+        http_port       8000
+        icp_port        0
+
+        cache_host      localhost.home.nl parent 8080 0 default
+        acl HOME        dstdomain .home.nl
+        never_direct    deny HOME
+</PRE>
+
+This tells Squid to use the parent for all domains other than <EM>home.nl</EM>.
+Below, <EM>access.log</EM> entries show what happens if you do a reload on the
+Squid-homepage:
+<P>
+<PRE>
+872739961.631   1566 10.0.0.21 ERR_CLIENT_ABORT/304 83 GET http://www.squid-cache.org/ - DEFAULT_PARENT/localhost.home.nl -
+872739962.976   1266 10.0.0.21 TCP_CLIENT_REFRESH/304 88 GET http://www.nlanr.net/Images/cache_now.gif - DEFAULT_PARENT/localhost.home.nl -
+872739963.007   1299 10.0.0.21 ERR_CLIENT_ABORT/304 83 GET http://www.squid-cache.org/Icons/squidnow.gif - DEFAULT_PARENT/localhost.home.nl -
+872739963.061   1354 10.0.0.21 TCP_CLIENT_REFRESH/304 83 GET http://www.squid-cache.org/Icons/Squidlogo2.gif - DEFAULT_PARENT/localhost.home.nl
+</PRE>
+<P>
+<P>http-gw entries in syslog:
+<P>
+<PRE>
+Aug 28 02:46:00 memo http-gw[2052]: permit host=localhost/127.0.0.1 use of gateway (V2.0beta)
+Aug 28 02:46:00 memo http-gw[2052]: log host=localhost/127.0.0.1 protocol=HTTP cmd=dir dest=www.squid-cache.org path=/
+Aug 28 02:46:01 memo http-gw[2052]: exit host=localhost/127.0.0.1 cmds=1 in=0 out=0 user=unauth duration=1
+Aug 28 02:46:01 memo http-gw[2053]: permit host=localhost/127.0.0.1 use of gateway (V2.0beta)
+Aug 28 02:46:01 memo http-gw[2053]: log host=localhost/127.0.0.1 protocol=HTTP cmd=get dest=www.squid-cache.org path=/Icons/Squidlogo2.gif
+Aug 28 02:46:01 memo http-gw[2054]: permit host=localhost/127.0.0.1 use of gateway (V2.0beta)
+Aug 28 02:46:01 memo http-gw[2054]: log host=localhost/127.0.0.1 protocol=HTTP cmd=get dest=www.squid-cache.org path=/Icons/squidnow.gif
+Aug 28 02:46:01 memo http-gw[2055]: permit host=localhost/127.0.0.1 use of gateway (V2.0beta)
+Aug 28 02:46:01 memo http-gw[2055]: log host=localhost/127.0.0.1 protocol=HTTP cmd=get dest=www.nlanr.net path=/Images/cache_now.gif
+Aug 28 02:46:02 memo http-gw[2055]: exit host=localhost/127.0.0.1 cmds=1 in=0 out=0 user=unauth duration=1
+Aug 28 02:46:03 memo http-gw[2053]: exit host=localhost/127.0.0.1 cmds=1 in=0 out=0 user=unauth duration=2
+Aug 28 02:46:04 memo http-gw[2054]: exit host=localhost/127.0.0.1 cmds=1 in=0 out=0 user=unauth duration=3
+</PRE>
+<P>
+<P>
+<P>To summarize:
+<P>
+<P>Advantages:
+<UL>
+<LI>http-gw allows you to selectively block ActiveX and Java, and it's
+primary design goal is security.</LI>
+<LI>The firewall doesn't need to run large applications like Squid.</LI>
+<LI>The internal Squid-server still gives you the benefit of caching.</LI>
+</UL>
+<P>
+<P>Disadvantages:
+<UL>
+<LI>The internal Squid proxyserver can't (and shouldn't) work with other
+parent or neighbor caches.</LI>
+<LI>Initial requests are slower because these go through http-gw, http-gw
+also does reverse lookups. Run a nameserver on the firewall or use an
+internal nameserver.</LI>
+</UL>
+<P>
+<P>
+<BLOCKQUOTE>
+--
+<A HREF="mailto:RvdOever@baan.nl">Rodney van den Oever</A></BLOCKQUOTE>
+<P>
+<P>
+<H2><A NAME="ss4.17">4.17 What is ``HTTP_X_FORWARDED_FOR''?  Why does squid provide it to WWW servers, and how can I stop it?</A>
+</H2>
+
+<P>When a proxy-cache is used, a server does not see the connection
+coming from the originating client.  Many people like to implement
+access controls based on the client address.
+To accommodate these people, Squid adds its own request header
+called "X-Forwarded-For" which looks like this:
+<PRE>
+        X-Forwarded-For: 128.138.243.150, unknown, 192.52.106.30
+</PRE>
+
+Entries are always IP addresses, or the word <EM>unknown</EM> if the address
+could not be determined or if it has been disabled with the
+<EM>forwarded_for</EM> configuration option.
+<P>
+<P>We must note that access controls based on this header are extremely
+weak and simple to fake.  Anyone may hand-enter a request with any IP
+address whatsoever.  This is perhaps the reason why client IP addresses
+have been omitted from the HTTP/1.1 specification.
+<P>
+<H2><A NAME="ss4.18">4.18 Can Squid anonymize HTTP requests?</A>
+</H2>
+
+<P>Yes it can, however the way of doing it has changed from earlier versions
+of squid. As of squid-2.2 a more customisable method has been introduced.
+Please follow the instructions for the version of squid that you are using.
+As a default, no anonymizing is done.
+<P>
+<P>If you choose to use the anonymizer you might wish to investigate the forwarded_for
+option to prevent the client address being disclosed. Failure to turn off the
+forwarded_for option will reduce the effectiveness of the anonymizer. Finally
+if you filter the User-Agent header using the fake_user_agent option can
+prevent some user problems as some sites require the User-Agent header.
+<P>
+<H3>Squid 2.2</H3>
+
+<P>With the introduction of squid 2.2 the anonoymizer has become more customisable.
+It now allows specification of exactly which headers will be allowed to pass.
+<P>The new anonymizer uses the 'anonymize_headers' tag. It has two modes 'deny' all
+and allow the specified headers. The following example will simulate the old
+paranoid mode.
+<P>
+<PRE>
+               anonymize_headers allow Allow Authorization Cache-Control
+               anonymize_headers allow Content-Encoding Content-Length
+               anonymize_headers allow Content-Type Date Expires Host
+               anonymize_headers allow If-Modified-Since Last-Modified
+               anonymize_headers allow Location Pragma Accept Charset
+               anonymize_headers allow Accept-Encoding Accept-Language
+               anonymize_headers allow Content-Language Mime-Version
+               anonymize_headers allow Retry-After Title Connection
+               anonymize_headers allow Proxy-Connection
+</PRE>
+<P>This will prevent any headers other than those listed from being passed by the
+proxy.
+<P>
+<P>The second mode is 'allow' all and deny the specified headers. The example
+replicates the old standard mode.
+<P>
+<PRE>
+               anonymize_headers deny From Referer Server
+               anonymize_headers deny User-Agent WWW-Authenticate Link
+</PRE>
+<P>It allows all headers to pass unless they are listed.
+<P>
+<P>You can not mix allow and deny in a squid configuration it is either one
+or the other!
+<P>
+<H3>Squid 2.1 and Earlier</H3>
+
+<P>There are three modes: <EM>none</EM>, <EM>standard</EM>, and
+<EM>paranoid</EM>.  The mode is set with the <EM>http_anonymizer</EM>
+configuration option.
+<P>With no anonymizing (the default), Squid forwards all request headers
+as received from the client, to the origin server (subject to the regular
+rules of HTTP).
+<P>In the <EM>standard</EM> mode, Squid filters out the following specific request
+headers:
+<UL>
+<LI>From:</LI>
+<LI>Referer:</LI>
+<LI>Server:</LI>
+<LI>User-Agent:</LI>
+<LI>WWW-Authenticate:</LI>
+<LI>Link:</LI>
+</UL>
+<P>
+<P>In the <EM>paranoid</EM> mode, Squid allows only the following specific
+request headers:
+<UL>
+<LI>Allow:</LI>
+<LI>Authorization:</LI>
+<LI>Cache-Control:</LI>
+<LI>Content-Encoding:</LI>
+<LI>Content-Length:</LI>
+<LI>Content-Type:</LI>
+<LI>Date:</LI>
+<LI>Expires:</LI>
+<LI>Host:</LI>
+<LI>If-Modified-Since:</LI>
+<LI>Last-Modified:</LI>
+<LI>Location:</LI>
+<LI>Pragma:</LI>
+<LI>Accept:</LI>
+<LI>Accept-Charset:</LI>
+<LI>Accept-Encoding:</LI>
+<LI>Accept-Language:</LI>
+<LI>Content-Language:</LI>
+<LI>Mime-Version:</LI>
+<LI>Retry-After:</LI>
+<LI>Title:</LI>
+<LI>Connection:</LI>
+<LI>Proxy-Connection:</LI>
+</UL>
+<P>
+<P>References:
+<A HREF="http://www.iks-jena.de/mitarb/lutz/anon/web.en.html">Anonymous WWW</A><P>
+<P>
+<H2><A NAME="ss4.19">4.19 Can I make Squid go direct for some sites?</A>
+</H2>
+
+<P>Sure, just use the <EM>always_direct</EM> access list.
+<P>For example, if you want Squid to connect directly to <EM>hotmail.com</EM> servers,
+you can use these lines in  your config file:
+<PRE>
+acl hotmail dstdomain .hotmail.com
+always_direct allow hotmail
+</PRE>
+<P>
+<H2><A NAME="ss4.20">4.20 Can I make Squid proxy only, without caching anything?</A>
+</H2>
+
+<P>Sure, there are few things you can do.
+<P>You can use the <EM>no_cache</EM> access list to make Squid never cache any response:
+<PRE>
+        acl all src 0/0
+        no_cache deny all
+</PRE>
+<P>With Squid-2.4 and later you can use the ``null'' storage module:
+<PRE>
+        cache_dir null /tmp
+</PRE>
+<P>
+<P>Note: the directory (e.g., <EM>/tmp</EM>) must exist so that squid
+can chdir to it, unless you also use the <EM>coredump_dir</EM> option.
+<P>To configure Squid for the ``null'' storage module, specify it
+on the <EM>configure</EM> command line:
+<PRE>
+        ./configure --enable-storeio=ufs,null ...
+</PRE>
+<P>
+<H2><A NAME="ss4.21">4.21 Can I prevent users from downloading large files?</A>
+</H2>
+
+<P>You can set the global <EM>reply_body_max_size</EM> parameter.  This option
+controls the largest HTTP message body that will be sent to a cache
+client for one request.
+<P>If the HTTP response coming from the server has a <CODE>Content-length</CODE>
+header, then Squid compares the content-length value to the
+<EM>reply_body_max_size</EM> value.  If the content-length is larger,
+the server connection is closed and the user receives an error
+message from Squid.
+<P>Some responses don't have <CODE>Content-length</CODE>
+headers.  In this case, Squid counts how many bytes are written
+to the client.  Once the limit is reached, the client's connection
+is simply closed.
+<P>Note that ``creative'' user-agents will still be able to download
+really large files through the cache using HTTP/1.1 range requests.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-5.html">Next</A>
+<A HREF="FAQ-3.html">Previous</A>
+<A HREF="FAQ.html#toc4">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-5.html
+++ squid-2.5.9/debian/doc/FAQ-5.html
@@ -0,0 +1,456 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Communication between browsers and Squid</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-6.html">Next</A>
+<A HREF="FAQ-4.html">Previous</A>
+<A HREF="FAQ.html#toc5">Contents</A>
+<HR>
+<H2><A NAME="s5">5. Communication between browsers and Squid</A></H2>
+
+<P>Most web browsers available today support proxying and are easily configured
+to use a Squid server as a proxy.  Some browsers support advanced features
+such as lists of domains or URL patterns that shouldn't be fetched through
+the proxy, or JavaScript automatic proxy configuration.
+<P>
+<H2><A NAME="ss5.1">5.1 Netscape manual configuration</A>
+</H2>
+
+<P>Select <B>Network Preferences</B> from the
+<B>Options</B> menu.  On the <B>Proxies</B>
+page, click the radio button next to <B>Manual Proxy
+Configuration</B> and then click on the <B>View</B>
+button.  For each protocol that your Squid server supports (by default,
+HTTP, FTP, and gopher) enter the Squid server's hostname or IP address
+and put the HTTP port number for the Squid server (by default, 3128) in
+the <B>Port</B> column.  For any protocols that your Squid
+does not support, leave the fields blank.
+<P>Here is a
+<A HREF="/Doc/FAQ/navigator.jpg">screen shot</A> of the Netscape Navigator manual proxy
+configuration screen.
+<P>
+<P>
+<H2><A NAME="netscape-pac"></A> <A NAME="ss5.2">5.2 Netscape automatic configuration</A>
+</H2>
+
+<P>Netscape Navigator's proxy configuration can be automated with
+JavaScript (for Navigator versions 2.0 or higher).  Select
+<B>Network Preferences</B> from the <B>Options</B>
+menu.  On the <B>Proxies</B> page, click the radio button
+next to <B>Automatic Proxy Configuration</B> and then
+fill in the URL for your JavaScript proxy configuration file in the
+text box.  The box is too small, but the text will scroll to the
+right as you go.
+<P>Here is a
+<A HREF="/Doc/FAQ/navigator-auto.jpg">screen shot</A>
+of the Netscape Navigator automatic proxy configuration screen.
+<P>You may also wish to consult Netscape's documentation for the Navigator
+<A HREF="http://home.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html">JavaScript proxy configuration</A><P>
+<P>Here is a sample auto configuration JavaScript from Oskar Pearson:
+<HR>
+<PRE>
+//We (www.is.co.za) run a central cache for our customers that they
+//access through a firewall - thus if they want to connect to their intranet
+//system (or anything in their domain at all) they have to connect
+//directly - hence all the "fiddling" to see if they are trying to connect
+//to their local domain.
+
+//Replace each occurrence of company.com with your domain name
+//and if you have some kind of intranet system, make sure
+//that you put it's name in place of "internal" below.
+
+//We also assume that your cache is called "cache.company.com", and
+//that it runs on port 8080. Change it down at the bottom.
+
+//(C) Oskar Pearson and the Internet Solution (http://www.is.co.za)
+
+    function FindProxyForURL(url, host)
+        {
+            //If they have only specified a hostname, go directly.
+            if (isPlainHostName(host))
+                    return "DIRECT";
+
+            //These connect directly if the machine they are trying to
+            //connect to starts with "intranet" - ie http://intranet
+            //Connect  directly if it is intranet.*
+            //If you have another machine that you want them to
+            //access directly, replace "internal*" with that
+            //machine's name
+            if (shExpMatch( host, "intranet*")||
+                            shExpMatch(host, "internal*"))
+                return "DIRECT";
+
+            //Connect directly to our domains (NB for Important News)
+            if (dnsDomainIs( host,"company.com")||
+            //If you have another domain that you wish to connect to
+            //directly, put it in here
+                            dnsDomainIs(host,"sistercompany.com"))
+                return "DIRECT";
+
+            //So the error message "no such host" will appear through the
+            //normal Netscape box - less support queries :)
+            if (!isResolvable(host))
+                    return "DIRECT";
+
+            //We only cache http, ftp and gopher
+            if (url.substring(0, 5) == "http:" ||
+                            url.substring(0, 4) == "ftp:"||
+                            url.substring(0, 7) == "gopher:")
+
+            //Change the ":8080" to the port that your cache
+            //runs on, and "cache.company.com" to the machine that
+            //you run the cache on
+                    return "PROXY cache.company.com:8080; DIRECT";
+
+            //We don't cache WAIS
+            if (url.substring(0, 5) == "wais:")
+                    return "DIRECT";
+
+            else
+                    return "DIRECT";
+        }
+</PRE>
+<HR>
+<P>
+<H2><A NAME="ss5.3">5.3 Lynx and Mosaic configuration</A>
+</H2>
+
+<P>For Mosaic and Lynx, you can set environment variables
+before starting the application.  For example (assuming csh or tcsh):
+<P>
+<PRE>
+        % setenv http_proxy http://mycache.example.com:3128/
+        % setenv gopher_proxy http://mycache.example.com:3128/
+        % setenv ftp_proxy http://mycache.example.com:3128/
+</PRE>
+<P>For Lynx you can also edit the <EM>lynx.cfg</EM> file to configure
+proxy usage.  This has the added benefit of causing all Lynx users on
+a system to access the proxy without making environment variable changes
+for each user.  For example:
+<PRE>
+        http_proxy:http://mycache.example.com:3128/
+        ftp_proxy:http://mycache.example.com:3128/
+        gopher_proxy:http://mycache.example.com:3128/
+</PRE>
+<P>
+<H2><A NAME="ss5.4">5.4 Redundant Proxy Auto-Configuration</A>
+</H2>
+
+<P>There's one nasty side-effect to using auto-proxy scripts: if you start
+the web browser it will try and load the auto-proxy-script.
+<P>
+<P>If your script isn't available either because the web server hosting the
+script is down or your workstation can't reach the web server (e.g.
+because you're working off-line with your notebook and just want to
+read a previously saved HTML-file) you'll get different errors depending
+on the browser you use.
+<P>
+<P>The Netscape browser will just return an error after a timeout (after
+that it tries to find the site 'www.proxy.com' if the script you use is
+called 'proxy.pac').
+<P>
+<P>The Microsoft Internet Explorer on the other hand won't even start, no
+window displays, only after about 1 minute it'll display a window asking
+you to go on with/without proxy configuration.
+<P>
+<P>The point is that your workstations always need to locate the
+proxy-script. I created some extra redundancy by hosting the script on
+two web servers (actually Apache web servers on the proxy servers
+themselves) and adding the following records to my primary nameserver:
+<PRE>
+        proxy   CNAME           proxy1
+                CNAME           proxy2
+</PRE>
+
+The clients just refer to 'http://proxy/proxy.pac'.  This script looks like this:
+<P>
+<PRE>
+function FindProxyForURL(url,host)
+{
+        // Hostname without domainname or host within our own domain?
+        // Try them directly:
+        // http://www.domain.com actually lives before the firewall, so
+        // make an exception:
+        if ((isPlainHostName(host)||dnsDomainIs( host,".domain.com")) &amp;&amp;
+                !localHostOrDomainIs(host, "www.domain.com"))
+                return "DIRECT";
+
+        // First try proxy1 then proxy2. One server mostly caches '.com'
+        // to make sure both servers are not
+        // caching the same data in the normal situation. The other
+        // server caches the other domains normally.
+        // If one of 'm is down the client will try the other server.
+        else if (shExpMatch(host, "*.com"))
+                return "PROXY proxy1.domain.com:8080; PROXY proxy2.domain.com:8081; DIRECT";
+        return "PROXY proxy2.domain.com:8081; PROXY proxy1.domain.com:8080; DIRECT";
+}
+</PRE>
+<P>
+<P>I made sure every client domain has the appropriate 'proxy' entry.
+The clients are automatically configured with two nameservers using
+DHCP.
+<P>
+<BLOCKQUOTE>
+--
+<A HREF="mailto:RvdOever@baan.nl">Rodney van den Oever</A></BLOCKQUOTE>
+<P>
+<H2><A NAME="ss5.5">5.5 Proxy Auto-Configuration with URL Hashing</A>
+</H2>
+
+<P>The
+<A HREF="http://naragw.sharp.co.jp/sps/">Sharp Super Proxy Script page</A>
+contains a lot of good information about hash-based proxy auto-configuration
+scripts.  With these you can distribute the load between a number
+of caching proxies.
+<P>
+<H2><A NAME="ss5.6">5.6 Microsoft Internet Explorer configuration</A>
+</H2>
+
+<P>Select <B>Options</B> from the <B>View</B>
+menu.  Click on the <B>Connection</B> tab.  Tick the
+<B>Connect through Proxy Server</B> option and hit the
+<B>Proxy Settings</B> button.  For each protocol that
+your Squid server supports (by default, HTTP, FTP, and gopher)
+enter the Squid server's hostname or IP address and put the HTTP
+port number for the Squid server (by default, 3128) in the
+<B>Port</B> column.  For any protocols that your Squid
+does not support, leave the fields blank.
+<P>Here is a
+<A HREF="/Doc/FAQ/msie.jpg">screen shot</A> of the Internet Explorer proxy
+configuration screen.
+<P>Microsoft is also starting to support Netscape-style JavaScript
+automated proxy configuration.  As of now, only MSIE version 3.0a
+for Windows 3.1 and Windows NT 3.51 supports this feature (i.e.,
+as of version 3.01 build 1225 for Windows 95 and NT 4.0, the feature
+was not included).
+<P>If you have a version of MSIE that does have this feature, elect
+<B>Options</B> from the <B>View</B> menu.
+Click on the <B>Advanced</B> tab.  In the lower left-hand
+corner, click on the <B>Automatic Configuration</B>
+button.  Fill in the URL for your JavaScript file in the dialog
+box it presents you.  Then exit MSIE and restart it for the changes
+to take effect.  MSIE will reload the JavaScript file every time
+it starts.
+<P>
+<H2><A NAME="ss5.7">5.7 Netmanage Internet Chameleon WebSurfer configuration</A>
+</H2>
+
+<P>Netmanage WebSurfer supports manual proxy configuration and exclusion
+lists for hosts or domains that should not be fetched via proxy
+(this information is current as of WebSurfer 5.0).  Select
+<B>Preferences</B> from the <B>Settings</B>
+menu.  Click on the <B>Proxies</B> tab.  Select the
+<B>Use Proxy</B> options for HTTP, FTP, and gopher.  For
+each protocol that enter the Squid server's hostname or IP address
+and put the HTTP port number for the Squid server (by default,
+3128) in the <B>Port</B> boxes.  For any protocols that
+your Squid does not support, leave the fields blank.
+<P>Take a look at this
+<A HREF="/Doc/FAQ/netmanage.jpg">screen shot</A>
+if the instructions confused you.
+<P>On the same configuration window, you'll find a button to bring up
+the exclusion list dialog box, which will let you enter some hosts
+or domains that you don't want fetched via proxy.  It should be
+self-explanatory, but you might look at this
+<A HREF="/Doc/FAQ/netmanage-exclusion.jpg">screen shot</A>
+just for fun anyway.
+<P>
+<H2><A NAME="ss5.8">5.8 Opera 2.12 proxy configuration</A>
+</H2>
+
+<P>Select <EM>Proxy Servers...</EM> from the <EM>Preferences</EM> menu.  Check each
+protocol that your Squid server supports (by default, HTTP, FTP, and
+Gopher) and enter the Squid server's address as hostname:port (e.g.
+mycache.example.com:3128 or 123.45.67.89:3128).  Click on <EM>Okay</EM> to accept the
+setup.
+<P>
+<P>Notes:
+<UL>
+<LI>Opera 2.12 doesn't support gopher on its own, but requires a proxy; therefore
+Squid's gopher proxying can extend the utility of your Opera immensely.</LI>
+<LI>Unfortunately, Opera 2.12 chokes on some HTTP requests, for example
+<A HREF="http://spam.abuse.net/spam/">abuse.net</A>.
+At the moment I think it has something to do with cookies.  If you have
+trouble with a site, try disabling the HTTP proxying by unchecking
+that protocol in the <EM>Preferences</EM>|<EM>Proxy Servers...</EM> dialogue.  Opera will
+remember the address, so reenabling is easy.</LI>
+</UL>
+<P>
+<BLOCKQUOTE>
+--
+<A HREF="mailto:hclsmith@tallships.istar.ca">Hume Smith</A></BLOCKQUOTE>
+<P>
+<H2><A NAME="ss5.9">5.9 How do I tell Squid to use a specific username for FTP urls?</A>
+</H2>
+
+<P>Insert your username in the host part of the URL, for example:
+<PRE>
+        ftp://joecool@ftp.foo.org/
+</PRE>
+
+Squid should then prompt you for your account password.  Alternatively,
+you can specify both your username and password in the URL itself:
+<PRE>
+        ftp://joecool:secret@ftp.foo.org/
+</PRE>
+
+However, we certainly do not recommend this, as it could be very
+easy for someone to see or grab your password.
+<P>
+<H2><A NAME="ss5.10">5.10 Configuring Browsers for WPAD</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:mark@rts.com.au">Mark Reynolds</A><P>You may like to start by reading the
+<A HREF="http://www.web-cache.com/Writings/Internet-Drafts/draft-ietf-wrec-wpad-01.txt">Expired Internet-Draft</A>
+that describes WPAD.
+<P>
+<P>After reading the 8 steps below, if you don't understand any of the
+terms or methods mentioned, you probably shouldn't be doing this.
+Implementing wpad requires you to <B>fully</B> understand:
+<OL>
+<LI> web server installations and modifications.</LI>
+<LI>squid proxy server (or others) installation etc.</LI>
+<LI>Domain Name System maintenance etc.</LI>
+</OL>
+
+Please don't bombard the squid list with web server or dns questions. See
+your system administrator, or do some more research on those topics.
+<P>
+<P>This is not a recommendation for any product or version. As far as I
+know IE5 is the only browser out now implementing wpad. I think wpad
+is an excellent feature that will return several hours of life per month.
+Hopefully, all browser clients will implement it as well. But it will take
+years for all the older browsers to fade away though.
+<P>
+<P>I have only focused on the domain name method, to the exclusion of the
+DHCP method. I think the dns method might be easier for most people.
+I don't currently, and may never, fully understand wpad and IE5, but this
+method worked for me. It <B>may</B> work for you.
+<P>
+<P>But if you'd rather just have a go ...
+<OL>
+<LI>Create a standard 
+<A HREF="#netscape-pac">netscape auto    proxy config file</A>.  The sample provided there is more than
+adequate to get you going.  No doubt all the other load balancing
+and backup scripts will be fine also.
+</LI>
+<LI>Store the resultant file in the document root directory of a
+handy web server as <EM>wpad.dat</EM> (Not <EM>proxy.pac</EM> as you
+may have previously done.)
+
+<P>
+<A HREF="mailto:ira at racoon.riga.lv">Andrei Ivanov</A>
+notes that you should be able to use an HTTP redirect if you
+want to store the wpad.dat file somewhere else.  You can probably
+even redirect <EM>wpad.dat</EM> to <EM>proxy.pac</EM>:
+<PRE>
+Redirect /wpad.dat http://racoon.riga.lv/proxy.pac
+</PRE>
+<P>
+</LI>
+<LI>If you do nothing more, a url like
+<CODE>http://www.your.domain.name/wpad.dat</CODE> should bring up
+the script text in your browser window.
+</LI>
+<LI>Insert the following entry into your web server <EM>mime.types</EM> file.
+Maybe in addition to your pac file type, if you've done this before.
+<PRE>
+        application/x-ns-proxy-autoconfig       dat
+</PRE>
+
+And then restart your web server, for new mime type to work.
+</LI>
+<LI>Assuming Internet Explorer 5, under <EM>Tools</EM>, <EM>Internet
+Options</EM>, <EM>Connections</EM>, <EM>Settings</EM> <B>or</B> <EM>Lan
+Settings</EM>, set <B>ONLY</B> <EM>Use Automatic Configuration Script</EM>
+to be the URL for where your new <EM>wpad.dat</EM> file can be found.
+i.e.  <CODE>http://www.your.domain.name/wpad.dat</CODE> Test that
+that all works as per your script and network.  There's no point
+continuing until this works ...
+</LI>
+<LI>Create/install/implement a DNS record so that
+<CODE>wpad.your.domain.name</CODE> resolves to the host above where
+you have a functioning auto config script running. You should
+now be able to use <CODE>http://wpad.your.domain.name/wpad.dat</CODE>
+as the Auto Config Script location in step 5 above.
+</LI>
+<LI>And finally, go back to the setup screen detailed in 5 above,
+and choose nothing but the <EM>Automatically Detect Settings</EM>
+option, turning everything else off. Best to restart IE5, as
+you normally do with any Microsoft product... And it should all
+work. Did for me anyway.
+</LI>
+<LI>One final question might be 'Which domain name does the client
+(IE5) use for the wpad... lookup?' It uses the hostname from
+the control panel setting.  It starts the search by adding the
+hostname "WPAD" to current fully-qualified domain name.  For
+instance, a client in a.b.Microsoft.com would search for a WPAD
+server at wpad.a.b.microsoft.com. If it could not locate one,
+it would remove the bottom-most domain and try again; for
+instance, it would try wpad.b.microsoft.com next. IE 5 would
+stop searching when it found a WPAD server or reached the
+third-level domain, wpad.microsoft.com.
+
+</LI>
+</OL>
+<P>
+<P>Anybody using these steps to install and test, please feel free to make
+notes, corrections or additions for improvements, and post back to the
+squid list...
+<P>
+<P>There are probably many more tricks and tips which hopefully will be
+detailed here in the future. Things like <EM>wpad.dat</EM> files being served
+from the proxy server themselves, maybe with a round robin dns setup
+for the WPAD host.
+<P>
+<H2><A NAME="ss5.11">5.11 IE 5.0x crops trailing slashes from FTP URL's</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:reuben at reub dot net">Reuben Farrelly</A><P>There was a bug in the 5.0x releases of Internet Explorer in which IE 
+cropped any trailing slash off an FTP URL.  The URL showed up correctly in 
+the browser's ``Address:'' field, however squid logs show that the trailing 
+slash was being taken off.
+<P>An example of where this impacted squid if you had a setup where squid 
+would go direct for FTP directory listings but forward a request to a 
+parent for FTP file transfers.  This was useful if your upstream proxy was 
+an older version of Squid or another vendors software which displayed 
+directory listings with broken icons and you wanted your own local version 
+of squid to generate proper FTP directory listings instead.
+The workaround for this is to add a double slash to any directory listing 
+in which the slash was important, or else upgrade to IE 5.5.  (Or use Netscape)
+<P>
+<H2><A NAME="ss5.12">5.12 IE 6.0 SP1 fails when using basic authentication</A>
+</H2>
+
+<P>When using basic authentication with Internet Explorer 6 SP1, you may 
+encounter issues when you first launch Internet Explorer.
+<P>
+<P>The problem will show itself when you first authenticate, you will
+receive a "Page Cannot Be Displayed" error.Â  However, if you click
+refresh, the page will be correctly displayed.Â  
+<P>
+<P>This only happens immediately after you authenticate.
+<P>
+<P>This is not a Squid error or bug.Â  Microsoft broke the Basic
+Authentication when they put out IE6 SP1.Â  
+<P>
+<P>There is a knowledgebase article regarding this issue.Â  The fix 
+is to call Microsoft, open an incident referencing this KB article
+and they will send you a "hot fix".Â  They do warn that this code
+is not "regression tested" but so far there have not been any
+reports of this breaking anything else.Â  The problematic file
+is wininet.dll.
+<P>
+<P>The Microsoft Knowledgebase article is
+<A HREF="http://support.microsoft.com/default.aspx?id=kb;en-us;331906">331906</A><P>
+<P>
+<HR>
+<A HREF="FAQ-6.html">Next</A>
+<A HREF="FAQ-4.html">Previous</A>
+<A HREF="FAQ.html#toc5">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-6.html
+++ squid-2.5.9/debian/doc/FAQ-6.html
@@ -0,0 +1,911 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Squid Log Files</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-7.html">Next</A>
+<A HREF="FAQ-5.html">Previous</A>
+<A HREF="FAQ.html#toc6">Contents</A>
+<HR>
+<H2><A NAME="s6">6. Squid Log Files</A></H2>
+
+<P>The logs are a valuable source of information about Squid workloads and
+performance. The logs record not only access information, but also system
+configuration errors and resource consumption (eg, memory, disk
+space). There are several log file maintained by Squid. Some have to be
+explicitely activated during compile time, others can safely be deactivated
+during run-time.
+<P>
+<P>There are a few basic points common to all log files. The time stamps
+logged into the log files are usually UTC seconds unless stated otherwise.
+The initial time stamp usually contains a millisecond extension.
+<P>
+<H2><A NAME="ss6.1">6.1 <EM>squid.out</EM></A>
+</H2>
+
+<P>If you run your Squid from the <EM>RunCache</EM> script, a file
+<EM>squid.out</EM> contains the Squid startup times, and also all fatal
+errors, e.g. as produced by an <EM>assert()</EM> failure. If you are not
+using <EM>RunCache</EM>, you will not see such a file.
+<P>
+<H2><A NAME="ss6.2">6.2 <EM>cache.log</EM></A>
+</H2>
+
+<P>The <EM>cache.log</EM> file contains the debug and error messages that Squid
+generates. If you start your Squid using the default <EM>RunCache</EM> script,
+or start it with the <EM>-s</EM> command line option, a copy of certain
+messages will go into your syslog facilities. It is a matter of personal
+preferences to use a separate file for the squid log data.
+<P>
+<P>From the area of automatic log file analysis, the <EM>cache.log</EM> file does
+not have much to offer. You will usually look into this file for automated
+error reports, when programming Squid, testing new features, or searching
+for reasons of a perceived misbehaviour, etc.
+<P>
+<P>
+<H2><A NAME="ss6.3">6.3 <EM>useragent.log</EM></A>
+</H2>
+
+<P>The user agent log file is only maintained, if 
+<P>
+<OL>
+<LI>you configured the compile time <EM>--enable-useragent-log</EM>
+option, and</LI>
+<LI>you pointed the <EM>useragent_log</EM> configuration option to a
+file.</LI>
+</OL>
+<P>
+<P>From the user agent log file you are able to find out about distributation
+of browsers of your clients. Using this option in conjunction with a loaded
+production squid might not be the best of all ideas.
+<P>
+<H2><A NAME="ss6.4">6.4 <EM>store.log</EM></A>
+</H2>
+
+<P>The <EM>store.log</EM> file covers the objects currently kept on disk or
+removed ones. As a kind of transaction log it is ususally used for
+debugging purposes. A definitive statement, whether an object resides on
+your disks is only possible after analysing the <EM>complete</EM> log file.
+The release (deletion) of an object may be logged at a later time than the
+swap out (save to disk).
+<P>
+<P>The <EM>store.log</EM> file may be of interest to log file analysis which
+looks into the objects on your disks and the time they spend there, or how
+many times a hot object was accessed. The latter may be covered by another
+log file, too. With knowledge of the <EM>cache_dir</EM> configuration option,
+this log file allows for a URL to filename mapping without recursing your
+cache disks. However, the Squid developers recommend to treat
+<EM>store.log</EM> primarily as a debug file, and so should you, unless you
+know what you are doing.
+<P>
+<P>The print format for a store log entry (one line) consists of eleven
+space-separated columns, compare with the <EM>storeLog()</EM> function in file
+<EM>src/store_log.c</EM>:
+<P>
+<PRE>
+    "%9d.%03d %-7s %08X %4d %9d %9d %9d %s %d/%d %s %s\n"
+</PRE>
+<P>
+<DL>
+<DT><B>time</B><DD><P>The timestamp when the line was logged in UTC with a millisecond fraction.
+<P>
+<DT><B>action</B><DD><P>The action the object was sumitted to, compare with <EM>src/store_log.c</EM>:
+<P>
+<UL>
+<LI><B>CREATE</B> Seems to be unused.</LI>
+<LI><B>RELEASE</B> The object was removed from the cache (see also
+<A HREF="#log-fileno">file number</A>).  </LI>
+<LI><B>SWAPOUT</B> The object was saved to disk.</LI>
+<LI><B>SWAPIN</B> The object existed on disk and was read into memory.</LI>
+</UL>
+<P>
+<DT><B>file number</B><DD><P>
+<A NAME="log-fileno"></A> <P>The file number for the object storage file. Please note that the path to
+this file is calculated according to your <EM>cache_dir</EM> configuration.
+<P>
+<P>A file number of <EM>FFFFFFFF</EM> denominates "memory only" objects. Any
+action code for such a file number refers to an object which existed only
+in memory, not on disk.  For instance, if a <EM>RELEASE</EM> code was logged
+with file number <EM>FFFFFFFF</EM>, the object existed only in memory, and was
+released from memory.
+<P>
+<DT><B>status</B><DD><P>The HTTP reply status code.
+<P>
+<DT><B>datehdr</B><DD><P>
+<A NAME="log-Date"></A> <P>The value of the HTTP "Date: " reply header.
+<P>
+<DT><B>lastmod
+<A NAME="log-LM"></A> </B><DD><P>The value of the HTTP "Last-Modified: " reply header.
+<P>
+<DT><B>expires</B><DD><P>
+<A NAME="log-Expires"></A> <P>The value of the HTTP "Expires: " reply header.
+<P>
+<DT><B>type</B><DD><P>The HTTP "Content-Type" major value, or "unknown" if it cannot be
+determined.
+<P>
+<DT><B>sizes</B><DD><P>This column consists of two slash separated fields:
+<P>
+<OL>
+<LI>The advertised content length from the HTTP "Content-Length: " reply
+header.</LI>
+<LI>The size actually read.</LI>
+</OL>
+<P>
+<P>If the advertised (or expected) length is missing, it will be set to
+zero. If the advertised length is not zero, but not equal to the real
+length, the object will be realeased from the cache.
+<P>
+<DT><B>method</B><DD><P>The request method for the object, e.g. <EM>GET</EM>.
+<P>
+<DT><B>key</B><DD><P>
+<A NAME="log-key"></A> <P>The key to the object, usually the URL.
+</DL>
+<P>
+<P>The timestamp format for the columns 
+<A HREF="#log-Date">Date</A> to
+<A HREF="#log-Expires">Expires</A> are all expressed in UTC seconds. The
+actual values are parsed from the HTTP reply headers. An unparsable header
+is represented by a value of -1, and a missing header is represented by a
+value of -2.
+<P>
+<P>The column 
+<A HREF="#log-key">key</A> usually contains just the URL of
+the object. Some objects though will never become public. Thus the key is
+said to include a unique integer number and the request method in addition
+to the URL.
+<P>
+<H2><A NAME="ss6.5">6.5 <EM>hierarchy.log</EM></A>
+</H2>
+
+<P>This logfile exists for Squid-1.0 only.  The format is
+<PRE>
+        [date] URL peerstatus peerhost
+</PRE>
+<P>
+<H2><A NAME="ss6.6">6.6 <EM>access.log</EM></A>
+</H2>
+
+<P>Most log file analysis program are based on the entries in
+<EM>access.log</EM>. Currently, there are two file formats possible for the log
+file, depending on your configuration for the <EM>emulate_httpd_log</EM>
+option. By default, Squid will log in its native log file format. If the
+above option is enabled, Squid will log in the common log file format as
+defined by the CERN web daemon.
+<P>
+<P>The common log file format contains other information than the native log
+file, and less. The native format contains more information for the admin
+interested in cache evaluation.
+<P>
+<H3><EM>The common log file format</EM></H3>
+
+<P>The
+<A HREF="http://www.w3.org/pub/WWW/Daemon/User/Config/Logging.html#common-logfile-format">Common Logfile Format</A>
+is used by numerous HTTP servers. This format consists of the following
+seven fields:
+<PRE>
+        remotehost rfc931 authuser [date] "method URL" status bytes
+</PRE>
+<P>It is parsable by a variety of tools. The common format contains different
+information than the native log file format. The HTTP version is logged,
+which is not logged in native log file format.
+<P>
+<P>
+<H3><EM>The native log file format</EM></H3>
+
+<P>The native format is different for different major versions of Squid.  For
+Squid-1.0 it is:
+<PRE>
+        time elapsed remotehost code/status/peerstatus bytes method URL
+</PRE>
+<P>
+<P>For Squid-1.1, the information from the <EM>hierarchy.log</EM> was moved
+into <EM>access.log</EM>.  The format is:
+<PRE>
+        time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type
+</PRE>
+<P>
+<P>For Squid-2 the columns stay the same, though the content within may change
+a little.
+<P>
+<P>The native log file format logs more and different information than the
+common log file format: the request duration, some timeout information,
+the next upstream server address, and the content type.
+<P>There exist tools, which convert one file format into the other. Please
+mind that even though the log formats share most information, both formats
+contain information which is not part of the other format, and thus this
+part of the information is lost when converting. Especially converting back
+and forth is not possible without loss.
+<P><EM>squid2common.pl</EM> is a conversion utility, which converts any of the
+squid log file formats into the old CERN proxy style output. There exist
+tools to analyse, evaluate and graph results from that format.
+<P>
+<P>
+<H3><EM>access.log native format in detail</EM></H3>
+
+<P>It is recommended though to use Squid's native log format due to its
+greater amount of information made available for later analysis. The print
+format line for native <EM>access.log</EM> entries looks like this:
+<P>
+<PRE>
+    "%9d.%03d %6d %s %s/%03d %d %s %s %s %s%s/%s %s"
+</PRE>
+<P>
+<P>Therefore, an <EM>access.log</EM> entry usually consists of (at least) 10
+columns separated by one ore more spaces:
+<P>
+<DL>
+<DT><B>time</B><DD><P>A Unix timestamp as UTC seconds with a millisecond resolution. You
+can convert Unix timestamps into something more human readable using
+this short perl script:
+<PRE>
+        #! /usr/bin/perl -p
+        s/^\d+\.\d+/localtime $&amp;/e;
+</PRE>
+<P>
+<DT><B>duration</B><DD><P>The elapsed time considers how many milliseconds the transaction
+busied the cache. It differs in interpretation between TCP and UDP:
+<P>
+<UL>
+<LI>For HTTP/1.0, this is basically the time between <EM>accept()</EM>
+and <EM>close()</EM>.</LI>
+<LI>For persistent connections, this ought to be the time between
+scheduling the reply and finishing sending it.</LI>
+<LI>For ICP, this is the time between scheduling a reply and actually
+sending it.</LI>
+</UL>
+<P>Please note that the entries are logged <EM>after</EM> the reply finished
+being sent, <EM>not</EM> during the lifetime of the transaction.
+<P>
+<DT><B>client address</B><DD><P>The IP address of the requesting instance, the client IP address. The
+<EM>client_netmask</EM> configuration option can distort the clients for data
+protection reasons, but it makes analysis more difficult. Often it is
+better to use one of the log file anonymizers.
+<P>Also, the <EM>log_fqdn</EM> configuration option may log the fully qualified
+domain name of the client instead of the dotted quad. The use of that
+option is discouraged due to its performance impact.
+<P>
+<DT><B>result codes</B><DD><P>
+<A NAME="log-resultcode"></A> <P>This column is made up of two entries separated by a slash. This column
+encodes the transaction result:
+<P>
+<OL>
+<LI>The cache result of the request contains information on the kind of
+request, how it was satisfied, or in what way it failed. Please refer
+to section 
+<A HREF="#cache-result-codes">Squid result codes</A>
+for valid symbolic result codes.
+    
+<P>Several codes from older versions are no longer available, were
+renamed, or split. Especially the <EM>ERR_</EM> codes do not seem to
+appear in the log file any more. Also refer to section
+<A HREF="#cache-result-codes">Squid result codes</A> for details
+on the codes no longer available in Squid-2.
+<P>
+<P>The NOVM versions and Squid-2 also rely on the Unix buffer cache, thus
+you will see less <EM>TCP_MEM_HIT</EM>s than with a Squid-1.
+Basically, the NOVM feature relies on <EM>read()</EM> to obtain an
+object, but due to the kernel buffer cache, no disk activity is needed.
+Only small objects (below 8KByte) are kept in Squid's part of main
+memory.
+<P>
+</LI>
+<LI>The status part contains the HTTP result codes with some Squid specific
+extensions. Squid uses a subset of the RFC defined error codes for
+HTTP. Refer to section 
+<A HREF="#http-status-codes">status codes</A>
+for details of the status codes recognized by a Squid-2.</LI>
+</OL>
+<P>
+<DT><B>bytes</B><DD><P>The size is the amount of data delivered to the client. Mind that this does
+not constitute the net object size, as headers are also counted. Also,
+failed requests may deliver an error page, the size of which is also logged
+here.
+<P>
+<DT><B>request method</B><DD><P>The request method to obtain an object. Please refer to section
+<A HREF="#request-methods">request-methods</A>
+ for available methods.
+If you turned off <EM>log_icp_queries</EM> in your configuration, you
+will not see (and thus unable to analyse) ICP exchanges. The <EM>PURGE</EM>
+method is only available, if you have an ACL for ``method purge'' enabled
+in your configuration file.
+<P>
+<DT><B>URL</B><DD><P>This column contains the URL requested. Please note that the log file
+may contain whitespaces for the URI. The default configuration for
+<EM>uri_whitespace</EM> denies whitespaces, though.
+<P>
+<DT><B>rfc931</B><DD><P>The eigth column may contain the ident lookups for the requesting
+client. Since ident lookups have performance impact, the default
+configuration turns <EM>ident_loookups</EM> off. If turned off, or no ident
+information is available, a ``-'' will be logged.
+<P>
+<DT><B>hierarchy code</B><DD><P>The hierarchy information consists of three items:
+<P>
+<OL>
+<LI>Any hierarchy tag may be prefixed with <EM>TIMEOUT_</EM>, if the
+timeout occurs waiting for all ICP replies to return from the
+neighbours. The timeout is either dynamic, if the
+<EM>icp_query_timeout</EM> was not set, or the time configured there
+has run up.</LI>
+<LI>A code that explains how the request was handled, e.g. by
+forwarding it to a peer, or going straight to the source. Refer to
+section 
+<A HREF="#hier-codes">hier-codes</A>
+ for details on hierarchy codes and
+removed hierarchy codes.</LI>
+<LI>The IP address or hostname where the request (if a miss) was forwarded.
+For requests sent to origin servers, this is the origin server's IP address.
+For requests sent to a neighbor cache, this is the neighbor's hostname.
+NOTE: older versions of Squid would put the origin server hostname here.</LI>
+</OL>
+<P>
+<DT><B>type</B><DD><P>The content type of the object as seen in the HTTP reply
+header. Please note that ICP exchanges usually don't have any content
+type, and thus are logged ``-''. Also, some weird replies have content
+types ``:'' or even empty ones.
+</DL>
+<P>
+<P>There may be two more columns in the <EM>access.log</EM>, if the (debug) option
+<EM>log_mime_headers</EM> is enabled In this case, the HTTP request headers are
+logged between a ``['' and a ``]'', and the HTTP reply headers are also
+logged between ``['' and ``]''. All control characters like CR and LF are
+URL-escaped, but spaces are <EM>not</EM> escaped! Parsers should watch out for
+this.
+<P>
+<H2><A NAME="cache-result-codes"></A> <A NAME="ss6.7">6.7 Squid result codes</A>
+</H2>
+
+<P>The <B>TCP_</B> codes refer to requests on the HTTP port (usually 3128). The
+<B>UDP_</B> codes refer to requests on the ICP port (usually 3130). If
+ICP logging was disabled using the <EM>log_icp_queries</EM> option, no ICP 
+replies will be logged.
+<P>
+<P>The following result codes were taken from a Squid-2, compare with the
+<EM>log_tags</EM> struct in <EM>src/access_log.c</EM>:
+<P>
+<DL>
+<P>
+<DT><B>TCP_HIT</B><DD><P>A valid copy of the requested object was in the cache.
+<P>
+<DT><B>TCP_MISS</B><DD><P>The requested object was not in the cache.
+<P>
+<DT><B>TCP_REFRESH_HIT</B><DD><P>The requested object was cached but <EM>STALE</EM>. The IMS query
+for the object resulted in "304 not modified".
+<P>
+<DT><B>TCP_REF_FAIL_HIT</B><DD><P>The requested object was cached but <EM>STALE</EM>. The IMS query
+failed and the stale object was delivered.
+<P>
+<DT><B>TCP_REFRESH_MISS</B><DD><P>The requested object was cached but <EM>STALE</EM>. The IMS query
+returned the new content.
+<P>
+<DT><B>TCP_CLIENT_REFRESH_MISS</B><DD><P>
+<A NAME="tcp-client-refresh-miss"></A> 
+The client issued a "no-cache" pragma, or some analogous cache
+control command along with the request. Thus, the cache has to
+refetch the object.
+<P>
+<DT><B>TCP_IMS_HIT</B><DD><P>
+<A NAME="tcp-ims-hit"></A> 
+The client issued an IMS request for an object which was in the
+cache and fresh.
+<P>
+<DT><B>TCP_SWAPFAIL_MISS</B><DD><P>
+<A NAME="tcp-swapfail-miss"></A> 
+The object was believed to be in the cache,
+but could not be accessed.
+<P>
+<DT><B>TCP_NEGATIVE_HIT</B><DD><P>Request for a negatively cached object,
+e.g. "404 not found", for which the cache believes to know that
+it is inaccessible. Also refer to the explainations for
+<EM>negative_ttl</EM> in your <EM>squid.conf</EM> file.
+<P>
+<DT><B>TCP_MEM_HIT</B><DD><P>A valid copy of the requested object was in the
+cache <EM>and</EM> it was in memory, thus avoiding disk accesses.
+<P>
+<DT><B>TCP_DENIED</B><DD><P>Access was denied for this request.
+<P>
+<DT><B>TCP_OFFLINE_HIT</B><DD><P>The requested object was retrieved from the
+cache during offline mode. The offline mode never
+validates any object, see <EM>offline_mode</EM> in
+<EM>squid.conf</EM> file.
+<P>
+<DT><B>UDP_HIT</B><DD><P>A valid copy of the requested object was in the cache.
+<P>
+<DT><B>UDP_MISS</B><DD><P>The requested object is not in this cache.
+<P>
+<DT><B>UDP_DENIED</B><DD><P>Access was denied for this request.
+<P>
+<DT><B>UDP_INVALID</B><DD><P>An invalid request was received.
+<P>
+<DT><B>UDP_MISS_NOFETCH</B><DD><P>
+<A NAME="udp-miss-nofetch"></A> 
+During "-Y" startup, or during frequent
+failures, a cache in hit only mode will return either UDP_HIT or
+this code. Neighbours will thus only fetch hits.
+<P>
+<DT><B>NONE</B><DD><P>Seen with errors and cachemgr requests.
+</DL>
+<P>
+<P>The following codes are no longer available in Squid-2:
+<P>
+<DL>
+<DT><B>ERR_*</B><DD><P>Errors are now contained in the status code.
+<P>
+<DT><B>TCP_CLIENT_REFRESH</B><DD><P>See: 
+<A HREF="#tcp-client-refresh-miss">TCP_CLIENT_REFRESH_MISS</A>.
+<P>
+<DT><B>TCP_SWAPFAIL</B><DD><P>See: 
+<A HREF="#tcp-swapfail-miss">TCP_SWAPFAIL_MISS</A>.
+<P>
+<DT><B>TCP_IMS_MISS</B><DD><P>Deleted, 
+<A HREF="#tcp-ims-hit">TCP_IMS_HIT</A> used instead.
+<P>
+<DT><B>UDP_HIT_OBJ</B><DD><P>Hit objects are no longer available.
+<P>
+<DT><B>UDP_RELOADING</B><DD><P>See: 
+<A HREF="#udp-miss-nofetch">UDP_MISS_NOFETCH</A>.
+</DL>
+<P>
+<H2><A NAME="http-status-codes"></A> <A NAME="ss6.8">6.8 HTTP status codes</A>
+</H2>
+
+<P>These are taken from
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2616.txt">RFC 2616</A> and verified for Squid. Squid-2 uses almost all 
+codes except 307 (Temporary Redirect), 416 (Request Range Not Satisfiable),
+and 417 (Expectation Failed). Extra codes include 0 for a result code being
+unavailable, and 600 to signal an invalid header, a proxy error. Also, some
+definitions were added as for 
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2518.txt">RFC 2518</A> (WebDAV).
+Yes, there are really two entries for status code
+424, compare with <EM>http_status</EM> in <EM>src/enums.h</EM>:
+<P>
+<PRE>
+ 000 Used mostly with UDP traffic.
+
+ 100 Continue
+ 101 Switching Protocols
+*102 Processing
+
+ 200 OK
+ 201 Created
+ 202 Accepted
+ 203 Non-Authoritative Information
+ 204 No Content
+ 205 Reset Content
+ 206 Partial Content
+*207 Multi Status
+
+ 300 Multiple Choices
+ 301 Moved Permanently
+ 302 Moved Temporarily
+ 303 See Other
+ 304 Not Modified
+ 305 Use Proxy
+[307 Temporary Redirect]
+
+ 400 Bad Request
+ 401 Unauthorized
+ 402 Payment Required
+ 403 Forbidden
+ 404 Not Found
+ 405 Method Not Allowed
+ 406 Not Acceptable
+ 407 Proxy Authentication Required
+ 408 Request Timeout
+ 409 Conflict
+ 410 Gone
+ 411 Length Required
+ 412 Precondition Failed
+ 413 Request Entity Too Large
+ 414 Request URI Too Large
+ 415 Unsupported Media Type
+[416 Request Range Not Satisfiable]
+[417 Expectation Failed]
+*424 Locked
+*424 Failed Dependency
+*433 Unprocessable Entity
+
+ 500 Internal Server Error
+ 501 Not Implemented
+ 502 Bad Gateway
+ 503 Service Unavailable
+ 504 Gateway Timeout
+ 505 HTTP Version Not Supported
+*507 Insufficient Storage
+
+ 600 Squid header parsing error
+</PRE>
+<P>
+<H2><A NAME="request-methods"></A> <A NAME="ss6.9">6.9 Request methods</A>
+</H2>
+
+<P>Squid recognizes several request methods as defined in 
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2616.txt">RFC 2616</A>. Newer versions of Squid (2.2.STABLE5 and above)
+also recognize 
+<A HREF="http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2616.txt">RFC 2518</A> ``HTTP Extensions for Distributed Authoring --
+WEBDAV'' extensions.
+<P>
+<PRE>
+ method    defined    cachabil.  meaning
+ --------- ---------- ---------- -------------------------------------------
+ GET       HTTP/0.9   possibly   object retrieval and simple searches.
+ HEAD      HTTP/1.0   possibly   metadata retrieval.
+ POST      HTTP/1.0   CC or Exp. submit data (to a program).
+ PUT       HTTP/1.1   never      upload data (e.g. to a file).
+ DELETE    HTTP/1.1   never      remove resource (e.g. file).
+ TRACE     HTTP/1.1   never      appl. layer trace of request route.
+ OPTIONS   HTTP/1.1   never      request available comm. options.
+ CONNECT   HTTP/1.1r3 never      tunnel SSL connection.
+
+ ICP_QUERY Squid      never      used for ICP based exchanges.
+ PURGE     Squid      never      remove object from cache.
+
+ PROPFIND  rfc2518    ?          retrieve properties of an object.
+ PROPATCH  rfc2518    ?          change properties of an object.
+ MKCOL     rfc2518    never      create a new collection.
+ COPY      rfc2518    never      create a duplicate of src in dst.
+ MOVE      rfc2518    never      atomically move src to dst.
+ LOCK      rfc2518    never      lock an object against modifications.
+ UNLOCK    rfc2518    never      unlock an object.
+</PRE>
+ 
+<P>
+<P>
+<P>
+<H2><A NAME="hier-codes"></A> <A NAME="ss6.10">6.10 Hierarchy Codes</A>
+</H2>
+
+<P>The following hierarchy codes are used with Squid-2:
+<DL>
+<DT><B>NONE</B><DD><P>For TCP HIT, TCP failures, cachemgr requests and all UDP
+requests, there is no hierarchy information.
+<P>
+<DT><B>DIRECT</B><DD><P>The object was fetched from the origin server.
+<P>
+<DT><B>SIBLING_HIT</B><DD><P>The object was fetched from a sibling cache which replied with
+UDP_HIT.
+<P>
+<DT><B>PARENT_HIT</B><DD><P>The object was requested from a parent cache which replied with 
+UDP_HIT.
+<P>
+<DT><B>DEFAULT_PARENT</B><DD><P>No ICP queries were sent. This parent was chosen because it was
+marked ``default'' in the config file.
+<P>
+<DT><B>SINGLE_PARENT</B><DD><P>The object was requested from the only parent appropriate for the 
+given URL.
+<P>
+<DT><B>FIRST_UP_PARENT</B><DD><P>The object was fetched from the first parent in the list of
+parents.
+<P>
+<DT><B>NO_PARENT_DIRECT</B><DD><P>The object was fetched from the origin server, because no parents
+existed for the given URL.
+<P>
+<DT><B>FIRST_PARENT_MISS</B><DD><P>The object was fetched from the parent with the fastest (possibly
+weighted) round trip time. 
+<P>
+<DT><B>CLOSEST_PARENT_MISS</B><DD><P>This parent was chosen, because it included the the lowest RTT
+measurement to the origin server. See also the <EM>closests-only</EM>
+peer configuration option.
+<P>
+<DT><B>CLOSEST_PARENT</B><DD><P>The parent selection was based on our own RTT measurements.
+<P>
+<DT><B>CLOSEST_DIRECT</B><DD><P>Our own RTT measurements returned a shorter time than any parent.
+<P>
+<DT><B>NO_DIRECT_FAIL</B><DD><P>The object could not be requested because of a firewall
+configuration, see also <EM>never_direct</EM> and related material,
+and no parents were available.
+<P>
+<DT><B>SOURCE_FASTEST</B><DD><P>The origin site was chosen, because the source ping arrived fastest.
+<P>
+<DT><B>ROUNDROBIN_PARENT</B><DD><P>No ICP replies were received from any parent. The parent was
+chosen, because it was marked for round robin in the config file
+and had the lowest usage count.
+<P>
+<DT><B>CACHE_DIGEST_HIT</B><DD><P>The peer was chosen, because the cache digest predicted a
+hit. This option was later replaced in order to distinguish
+between parents and siblings.
+<P>
+<DT><B>CD_PARENT_HIT</B><DD><P>The parent was chosen, because the cache digest predicted a
+hit.
+<P>
+<DT><B>CD_SIBLING_HIT</B><DD><P>The sibling was chosen, because the cache digest predicted a
+hit.
+<P>
+<DT><B>NO_CACHE_DIGEST_DIRECT</B><DD><P>This output seems to be unused?
+<P>
+<DT><B>CARP</B><DD><P>The peer was selected by CARP.
+<P>
+<DT><B>ANY_PARENT</B><DD><P>part of <EM>src/peer_select.c:hier_strings[]</EM>.
+<P>
+<DT><B>INVALID CODE</B><DD><P>part of <EM>src/peer_select.c:hier_strings[]</EM>.
+</DL>
+<P>
+<P>Almost any of these may be preceded by 'TIMEOUT_' if the two-second
+(default) timeout occurs waiting for all ICP replies to arrive from
+neighbors, see also the <EM>icp_query_timeout</EM> configuration option.
+<P>
+<P>The following hierarchy codes were removed from Squid-2:
+<PRE>
+code                  meaning
+--------------------  -------------------------------------------------
+PARENT_UDP_HIT_OBJ    hit objects are not longer available.
+SIBLING_UDP_HIT_OBJ   hit objects are not longer available.
+SSL_PARENT_MISS       SSL can now be handled by squid.
+FIREWALL_IP_DIRECT    No special logging for hosts inside the firewall.
+LOCAL_IP_DIRECT       No special logging for local networks.
+</PRE>
+<P>
+<H2><A NAME="swaplog"></A> <A NAME="ss6.11">6.11 <EM>cache/log</EM> (Squid-1.x)</A>
+</H2>
+
+<P>This file has a rather unfortunate name.  It also is often called the
+<EM>swap log</EM>.  It is a record of every cache object written to disk.
+It is read when Squid starts up to ``reload'' the cache.  If you remove
+this file when squid is NOT running, you will effectively wipe out your
+cache contents.  If you remove this file while squid IS running,
+you can easily recreate it.  The safest way is to simply shutdown
+the running process:
+<PRE>
+        % squid -k shutdown
+</PRE>
+
+This will disrupt service, but at least you will have your swap log
+back.
+Alternatively, you can tell squid to rotate its log files.  This also
+causes a clean swap log to be written.
+<PRE>
+        % squid -k rotate
+</PRE>
+<P>
+<P>For Squid-1.1, there are six fields:
+<OL>
+<LI><B>fileno</B>:
+The swap file number holding the object data.  This is mapped to a pathname on your filesystem.
+</LI>
+<LI><B>timestamp</B>:
+This is the time when the object was last verified to be current.  The time is a
+hexadecimal representation of Unix time.
+</LI>
+<LI><B>expires</B>:
+This is the value of the Expires header in the HTTP reply.  If an Expires header
+was not present, this will be -2 or fffffffe.  If the Expires header was
+present, but invalid (unparsable), this will be -1 or ffffffff.
+</LI>
+<LI><B>lastmod</B>:
+Value of the HTTP reply Last-Modified header.  If missing it will be -2,
+if invalid it will be -1.
+</LI>
+<LI><B>size</B>:
+Size of the object, including headers.
+</LI>
+<LI><B>url</B>:
+The URL naming this object.
+</LI>
+</OL>
+<P>
+<H2><A NAME="ss6.12">6.12 <EM>swap.state</EM> (Squid-2.x)</A>
+</H2>
+
+<P>In Squid-2, the swap log file is now called <EM>swap.state</EM>.  This is
+a binary file that includes MD5 checksums, and <EM>StoreEntry</EM> fields.
+Please see the 
+<A HREF="../Prog-Guide/">Programmers Guide</A> for
+information on the contents and format of that file.
+<P>
+<P>If you remove <EM>swap.state</EM> while Squid is running, simply send 
+Squid the signal to rotate its log files:
+<PRE>
+        % squid -k rotate
+</PRE>
+
+Alternatively, you can tell Squid to shutdown and it will
+rewrite this file before it exits.
+<P>
+<P>If you remove the <EM>swap.state</EM> while Squid is not running, you will
+not lose your entire cache.  In this case, Squid will scan all of
+the cache directories and read each swap file to rebuild the cache.
+This can take a very long time, so you'll have to be patient.
+<P>
+<P>By default the <EM>swap.state</EM> file is stored in the top-level
+of each <EM>cache_dir</EM>.  You can move the logs to a different
+location with the <EM>cache_swap_log</EM> option.
+<P>
+<P>
+<H2><A NAME="ss6.13">6.13 Which log files can I delete safely?</A>
+</H2>
+
+<P>You should never delete <EM>access.log</EM>, <EM>store.log</EM>,
+<EM>cache.log</EM>, or <EM>swap.state</EM> while Squid is running.
+With Unix, you can delete a file when a process
+has the file opened.  However, the filesystem space is
+not reclaimed until the process closes the file.
+<P>
+<P>If you accidentally delete <EM>swap.state</EM> while Squid is running,
+you can recover it by following the instructions in the previous
+questions.  If you delete the others while Squid is running,
+you can not recover them.
+<P>
+<P>The correct way to maintain your log files is with Squid's ``rotate''
+feature.  You should rotate your log files at least once per day.
+The current log files are closed and then renamed with numeric extensions
+(.0, .1, etc).  If you want to, you can write your own scripts
+to archive or remove the old log files.  If not, Squid will
+only keep up to <EM>logfile_rotate</EM> versions of each log file.
+The logfile rotation procedure also writes a clean <EM>swap.state</EM>
+file, but it does not leave numbered versions of the old files.
+<P>
+<P>If you set <EM>logfile_rotate</EM> to 0, Squid simply closes and then
+re-opens the logs.  This allows third-party logfile management systems,
+such as <EM>newsyslog</EM>, to maintain the log files.
+<P>
+<P>
+<P>To rotate Squid's logs, simple use this command:
+<PRE>
+        squid -k rotate
+</PRE>
+
+For example, use this cron entry to rotate the logs at midnight:
+<PRE>
+        0 0 * * * /usr/local/squid/bin/squid -k rotate
+</PRE>
+<P>
+<H2><A NAME="ss6.14">6.14 How can I disable Squid's log files?</A>
+</H2>
+
+<P>To disable <EM>access.log</EM>:
+<PRE>
+        cache_access_log /dev/null
+</PRE>
+<P>
+<P>To disable <EM>store.log</EM>:
+<PRE>
+        cache_store_log none
+</PRE>
+<P>
+<P>It is a bad idea to disable the <EM>cache.log</EM> because this file
+contains many important status and debugging messages.   However,
+if you really want to, you can:
+To disable <EM>access.log</EM>:
+<PRE>
+        cache_log /dev/null
+</PRE>
+<P>
+<H2><A NAME="log-large"></A> <A NAME="ss6.15">6.15 My log files get very big!</A>
+</H2>
+
+<P>You need to <EM>rotate</EM> your log files with a cron job.  For example:
+<PRE>
+        0 0 * * * /usr/local/squid/bin/squid -k rotate
+</PRE>
+<P>
+<H2><A NAME="ss6.16">6.16 I want to use another tool to maintain the log files.</A>
+</H2>
+
+<P>If you set <EM>logfile_rotate</EM> to 0, Squid simply closes and then
+re-opens the logs.  This allows third-party logfile management systems,
+such as <EM>newsyslog</EM>, to maintain the log files.
+<P>
+<H2><A NAME="ss6.17">6.17 Managing log files</A>
+</H2>
+
+<P>The preferred log file for analysis is the <EM>access.log</EM> file in native
+format. For long term evaluations, the log file should be obtained at
+regular intervals. Squid offers an easy to use API for rotating log files,
+in order that they may be moved (or removed) without disturbing the cache
+operations in progress. The procedures were described above.
+<P>
+<P>Depending on the disk space allocated for log file storage, it is
+recommended to set up a cron job which rotates the log files every 24, 12,
+or 8 hour. You will need to set your <EM>logfile_rotate</EM> to a sufficiently
+large number. During a time of some idleness, you can safely transfer the
+log files to your analysis host in one burst.
+<P>
+<P>Before transport, the log files can be compressed during off-peak time. On
+the analysis host, the log file are concatinated into one file, so one file
+for 24 hours is the yield. Also note that with <EM>log_icp_queries</EM>
+enabled, you might have around 1 GB of uncompressed log information per day
+and busy cache. Look into you cache manager info page to make an educated
+guess on the size of your log files.
+<P>
+<P>The EU project 
+<A HREF="http://www.desire.org/">DESIRE</A>
+developed some 
+<A HREF="http://www.uninett.no/prosjekt/desire/arneberg/statistics.html">some basic rules</A>
+to obey when handling and processing log files:
+<P>
+<UL>
+<LI>Respect the privacy of your clients when publishing results.</LI>
+<LI>Keep logs unavailable unless anonymized. Most countries have laws on
+privacy protection, and some even on how long you are legally allowed to
+keep certain kinds of information. </LI>
+<LI>Rotate and process log files at least once a day. Even if you don't
+process the log files, they will grow quite large, see section
+<A HREF="#log-large">log-large</A>
+. If you rely on processing the log files, reserve
+a large enough partition solely for log files.</LI>
+<LI>Keep the size in mind when processing. It might take longer to 
+process log files than to generate them!</LI>
+<LI>Limit yourself to the numbers you are interested in. There is data
+beyond your dreams available in your log file, some quite obvious, others
+by combination of different views. Here are some examples for figures to
+watch:
+<UL>
+<LI>The hosts using your cache.</LI>
+<LI>The elapsed time for HTTP requests - this is the latency the user
+sees. Usually, you will want to make a distinction for HITs and MISSes
+and overall times. Also, medians are preferred over averages.</LI>
+<LI>The requests handled per interval (e.g. second, minute or hour). </LI>
+</UL>
+</LI>
+</UL>
+<P>
+<P>
+<H2><A NAME="ss6.18">6.18 Why do I get ERR_NO_CLIENTS_BIG_OBJ messages so often?</A>
+</H2>
+
+<P>This message means that the requested object was in ``Delete Behind''
+mode and the user aborted the transfer.  An object will go into
+``Delete Behind'' mode if
+<UL>
+<LI>It is larger than <EM>maximum_object_size</EM></LI>
+<LI>It is being fetched from a neighbor which has the <EM>proxy-only</EM> option set.</LI>
+</UL>
+<P>
+<H2><A NAME="ss6.19">6.19 What does ERR_LIFETIME_EXP mean?</A>
+</H2>
+
+<P>This means that a timeout occurred while the object was being transferred.  Most
+likely the retrieval of this object was very slow (or it stalled before finishing)
+and the user aborted the request.  However, depending on your settings for
+<EM>quick_abort</EM>, Squid may have continued to try retrieving the object.
+Squid imposes a maximum amount of time on all open sockets, so after some amount
+of time the stalled request was aborted and logged win an ERR_LIFETIME_EXP
+message.
+<P>
+<H2><A NAME="ss6.20">6.20 Retrieving ``lost'' files from the cache</A>
+</H2>
+
+<P>
+<BLOCKQUOTE>
+<I>I've been asked to retrieve an object which was accidentally
+destroyed at the source for recovery.
+So, how do I figure out where the things are so I can copy
+them out and strip off the headers?</I>
+</BLOCKQUOTE>
+<P>The following method applies only to the Squid-1.1 versions:
+<P>Use <EM>grep</EM> to find the named object (Url) in the
+<A HREF="#swaplog">cache/log</A> file.  The first field in
+this file is an integer <EM>file number</EM>.
+<P>
+<P>Then, find the file <EM>fileno-to-pathname.pl</EM> from the ``scripts''
+directory of the Squid source distribution.  The usage is
+<PRE>
+        perl fileno-to-pathname.pl [-c squid.conf]
+</PRE>
+
+file numbers are read on stdin, and pathnames are printed on
+stdout.
+<P>
+<H2><A NAME="ss6.21">6.21 Can I use <EM>store.log</EM> to figure out if a response was cachable?</A>
+</H2>
+
+<P>Sort of.  You can use <EM>store.log</EM> to find out if a particular response
+was <EM>cached</EM>.
+<P>Cached responses are logged with the SWAPOUT tag.
+Uncached responses are logged with the RELEASE tag.
+<P>However, your
+analysis must also consider that when a cached response is removed
+from the cache (for example due to cache replacement) it is also
+logged in <EM>store.log</EM> with the RELEASE tag.  To differentiate these
+two, you can look at the filenumber (3rd) field.  When an uncachable
+response is released, the filenumber is FFFFFFFF (-1).  Any other
+filenumber indicates a cached response was released.
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-7.html">Next</A>
+<A HREF="FAQ-5.html">Previous</A>
+<A HREF="FAQ.html#toc6">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/README.transparent-proxy
+++ squid-2.5.9/debian/doc/README.transparent-proxy
@@ -0,0 +1,38 @@
+
+You can do transparent caching on Linux, Solaris, and BSD derivations.
+
+The FAQ talks about this, see FAQ-17.html. It says:
+
+The trick is to get the operating system to forward certain IP packets 
+to the application.  This document currently contains only instruction
+for configuring transparent caching on Linux and Solaris.
+
+Here are the important settings in squid.conf:
+
+        http_port               80
+        icp_port                3130
+        httpd_accel             virtual 80
+        httpd_accel_with_proxy  on
+
+The Linux section of the FAQ is out of date. For example it says:
+
+  It's fairly useless to use my service providers parent caches
+  (cache-?.www.demon.net) because by proxying squid only sees IP addresses,
+  not host names and demon aren't generally asked for IP addresses by other
+  users
+
+That's not true if you set "httpd_accel_with_proxy  on".
+
+It also says:
+
+  Linux kernel 2.0.30 is a no-no as transparent proxying is broken (I use
+  2.0.29)
+
+That might be true, but you should ofcourse use a 2.0.35 or later
+kernel which are guaranteed to work fine with transparant proxying.
+
+If you keep this in mind the general info in the FAQ should get
+you up and running without any further problems.
+
+      Miquel van Smoorenburg <miquels@cistron.nl> 13-Oct-1998
+
--- squid-2.5.9.orig/debian/doc/cachemgr.html
+++ squid-2.5.9/debian/doc/cachemgr.html
@@ -0,0 +1,16 @@
+<HTML><HEAD><TITLE>Cache Manager Interface</TITLE></HEAD>
+<BODY><H1>Cache Manager Interface</H1>
+<P>This is a WWW interface to the instrumentation interface
+for the Squid object cache.</P>
+<HR>
+<FORM METHOD="GET" ACTION="/cgi-bin/cachemgr.cgi">
+<TABLE BORDER=0>
+<TR><TH ALIGN="left">Cache Host:</TH><TD><INPUT NAME="host" SIZE=30 VALUE="localhost"></TD></TR>
+<TR><TH ALIGN="left">Cache Port:</TH><TD><INPUT NAME="port" SIZE=30 VALUE="3128"></TD></TR>
+<TR><TH ALIGN="left">Manager name:</TH><TD><INPUT NAME="user_name" SIZE=30 VALUE=""></TD></TR>
+<TR><TH ALIGN="left">Password:</TH><TD><INPUT TYPE="password" NAME="passwd" SIZE=30 VALUE=""></TD></TR>
+</TABLE><BR CLEAR="all">
+<INPUT TYPE="submit" VALUE="Continue...">
+</FORM>
+<HR>
+</BODY></HTML>
--- squid-2.5.9.orig/debian/doc/README.morefds
+++ squid-2.5.9/debian/doc/README.morefds
@@ -0,0 +1,23 @@
+
+
+		More filedescriptors for squid
+
+
+The old Linux 2.0.x kernel had support for a maximum of 256
+filedescriptors per process. The squid FAQ talks about this,
+and recommends use of a special patch for 2.0.x kernels.
+Don't use that patch - use a 2.2.19 kernel or later, since the
+recent 2.2.x kernels (and 2.4, ofcourse) have support for lots
+of filedescriptors built in.
+
+The Debian Squid package has a special patch included that makes
+it possible for squid to use more than 1024 filedescriptors. You
+can enable this by increasing SQUID_MAXFD in /etc/default/squid.
+
+The /etc/init.d/squid script then sets the maximum number of
+filedescriptors at startup using 'ulimit'. It also examines
+the global file maximum in /proc/sys/fs/file-max and increases
+that to (SQUID_MAXFD + 4096) if it is lower than that.
+
+	README.morefds  1.20  01-Oct-2001  miquels@cistron.nl
+
--- squid-2.5.9.orig/debian/doc/cachemgr.README
+++ squid-2.5.9/debian/doc/cachemgr.README
@@ -0,0 +1,45 @@
+
+
+	README for the squid-cgi cachemanager package.
+
+
+0. INTRODUCTION
+
+   This package was seperated from the main squid proxy cache package so
+   that you can install it on another server than the one squid is
+   running on, usually your webserver host.
+
+1. DOCUMENTATION
+
+   There's a chapter on the cache manager in the squid FAQ. The relevant
+   section of the FAQ is installed as /usr/doc/squid-cgi/cachemgrfaq.html.
+
+2. POINTING IT TO YOUR CACHE HOST
+
+   The FAQ tells you that if you want to use the cachemgr.cgi program to
+   connect by default to another host instead of localhost and/or another port
+   that you should recompile cachemgr.cgi. This is not strictly true; you
+   can save the output of the initial screen to cachemgr.html, change
+   the defaults, save it somewhere into your HTML documents tree and call
+   up that screen instead of cachemgr.cgi.
+
+   A sample cachemgr.html is provided in /usr/doc/squid-cgi/examples/
+
+3. WARNING
+
+   Because it is easy to point the cache manager to any host and port,
+   the cache manager can be used to connect to any service on any host
+   inside or outside your network. If cachemgr.cgi can be reached from
+   any remote host, it can be used to connect to any other host/port and
+   the connection then comes from your webserver. Attackers/crackers
+   can abuse this to do eg portscans that then originate from your
+   machine.
+
+   If you don't use the cache manager, it's probably wise to uninstall
+   the squid-cgi package. Otherwise a few access restrictions in
+   /etc/apache/access.conf or in a .htaccess file in /usr/lib/cgi-bin/
+   should be added to only alow connections to the cachemgr.cgi program
+   from trusted hosts.
+
+
+           cachemgr.README  1.3  30-Oct-1999  miquels@cistron.nl
--- squid-2.5.9.orig/debian/doc/README.auth_modules
+++ squid-2.5.9/debian/doc/README.auth_modules
@@ -0,0 +1,15 @@
+
+The Debian package of squid includes a number of SAMPLE authentication
+modules in /usr/lib/squid. These are:
+
+ncsa_auth	Authentication against an NCSA/Apache style password file
+smb_auth	Authentication against an SMB (for example NT) server
+getpwnam_auth	Authentication using the getpwnam() library call.
+pam_auth	Authentication using standard PAM services.
+ldap_auth	Authentication against an LDAP database.
+
+Note that these are really sample modules. The documentation leaves a
+bit to be desired, and they probably haven't been fully tested.
+
+See the README.auth_module.* files for more information.
+
--- squid-2.5.9.orig/debian/doc/FAQ.html
+++ squid-2.5.9/debian/doc/FAQ.html
@@ -0,0 +1,511 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-1.html">Next</A>
+Previous
+Contents
+<HR>
+<H1>SQUID Frequently Asked Questions</H1>
+
+<H2>&copy; 2001 Duane Wessels, <CODE>wessels@squid-cache.org</CODE></H2>
+<P><HR>
+<EM>Frequently Asked Questions (with answers!) about the Squid Internet
+Object Cache software.</EM>
+<HR>
+<P>You can download the FAQ as
+<A HREF="FAQ.pdf">PDF</A>, 
+<A HREF="FAQ.ps.gz">compressed Postscript</A>, 
+<A HREF="FAQ.txt">plain text</A>,
+<A HREF="FAQ.sgml">linuxdoc SGML source</A> or as a
+<A HREF="FAQ.tar.gz">compressed tar of HTML</A>.
+<P>
+<H2><A NAME="toc1">1.</A> <A HREF="FAQ-1.html">About Squid, this FAQ, and other Squid information resources</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-1.html#ss1.1">1.1 What is Squid?</A>
+<LI><A HREF="FAQ-1.html#ss1.2">1.2 What is Internet object caching?</A>
+<LI><A HREF="FAQ-1.html#ss1.3">1.3 Why is it called Squid?</A>
+<LI><A HREF="FAQ-1.html#ss1.4">1.4 What is the latest version of Squid?</A>
+<LI><A HREF="FAQ-1.html#ss1.5">1.5 Who is responsible for Squid?</A>
+<LI><A HREF="FAQ-1.html#ss1.6">1.6 Where can I get Squid?</A>
+<LI><A HREF="FAQ-1.html#ss1.7">1.7 What Operating Systems does Squid support?</A>
+<LI><A HREF="FAQ-1.html#ss1.8">1.8 Does Squid run on Windows NT?</A>
+<LI><A HREF="FAQ-1.html#ss1.9">1.9 What Squid mailing lists are available?</A>
+<LI><A HREF="FAQ-1.html#ss1.10">1.10 I can't figure out how to unsubscribe from your mailing list.</A>
+<LI><A HREF="FAQ-1.html#ss1.11">1.11 What Squid web pages are available?</A>
+<LI><A HREF="FAQ-1.html#ss1.12">1.12 Does Squid support SSL/HTTPS/TLS?</A>
+<LI><A HREF="FAQ-1.html#ss1.13">1.13 What's the legal status of Squid?</A>
+<LI><A HREF="FAQ-1.html#ss1.14">1.14 Is Squid year-2000 compliant?</A>
+<LI><A HREF="FAQ-1.html#ss1.15">1.15 Can I pay someone for Squid support?</A>
+<LI><A HREF="FAQ-1.html#ss1.16">1.16 Squid FAQ contributors</A>
+<LI><A HREF="FAQ-1.html#ss1.17">1.17 About This Document</A>
+</UL>
+<P>
+<H2><A NAME="toc2">2.</A> <A HREF="FAQ-2.html">Getting and Compiling Squid</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-2.html#ss2.1">2.1 Which file do I download to get Squid?</A>
+<LI><A HREF="FAQ-2.html#ss2.2">2.2 How do I compile Squid?</A>
+<LI><A HREF="FAQ-2.html#ss2.3">2.3 What kind of compiler do I need?</A>
+<LI><A HREF="FAQ-2.html#ss2.4">2.4 What else do I need to compile Squid?</A>
+<LI><A HREF="FAQ-2.html#ss2.5">2.5 Do you have pre-compiled binaries available?</A>
+<LI><A HREF="FAQ-2.html#ss2.6">2.6 How do I apply a patch or a diff?</A>
+<LI><A HREF="FAQ-2.html#ss2.7">2.7 <EM>configure</EM> options</A>
+<LI><A HREF="FAQ-2.html#ss2.8">2.8 undefined reference to __inet_ntoa</A>
+<LI><A HREF="FAQ-2.html#ss2.9">2.9 How can I get true DNS TTL info into Squid's IP cache?</A>
+<LI><A HREF="FAQ-2.html#ss2.10">2.10 My platform is BSD/OS or BSDI and I can't compile Squid</A>
+<LI><A HREF="FAQ-2.html#ss2.11">2.11 Problems compiling <EM>libmiscutil.a</EM> on Solaris</A>
+<LI><A HREF="FAQ-2.html#ss2.12">2.12 I have problems compiling Squid on Platform Foo.</A>
+<LI><A HREF="FAQ-2.html#ss2.13">2.13 I see a lot warnings while compiling Squid.</A>
+<LI><A HREF="FAQ-2.html#ss2.14">2.14 Building Squid on OS/2</A>
+</UL>
+<P>
+<H2><A NAME="toc3">3.</A> <A HREF="FAQ-3.html">Installing and Running Squid</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-3.html#ss3.1">3.1 How big of a system do I need to run Squid?</A>
+<LI><A HREF="FAQ-3.html#ss3.2">3.2 How do I install Squid?</A>
+<LI><A HREF="FAQ-3.html#ss3.3">3.3 What does the <EM>squid.conf</EM> file do?</A>
+<LI><A HREF="FAQ-3.html#ss3.4">3.4 Do you have a <EM>squid.conf</EM> example?</A>
+<LI><A HREF="FAQ-3.html#ss3.5">3.5 How do I start Squid?</A>
+<LI><A HREF="FAQ-3.html#ss3.6">3.6 How do I start Squid automatically when the system boots?</A>
+<LI><A HREF="FAQ-3.html#ss3.7">3.7 How do I tell if Squid is running?</A>
+<LI><A HREF="FAQ-3.html#ss3.8">3.8 <EM>squid</EM> command line options</A>
+<LI><A HREF="FAQ-3.html#ss3.9">3.9 How do I see how Squid works?</A>
+</UL>
+<P>
+<H2><A NAME="toc4">4.</A> <A HREF="FAQ-4.html">Configuration issues</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-4.html#ss4.1">4.1 How do I join a cache hierarchy?</A>
+<LI><A HREF="FAQ-4.html#ss4.2">4.2 How do I join NLANR's cache hierarchy?</A>
+<LI><A HREF="FAQ-4.html#ss4.3">4.3 Why should I want to join NLANR's cache hierarchy?</A>
+<LI><A HREF="FAQ-4.html#ss4.4">4.4 How do I register my cache with NLANR's registration service?</A>
+<LI><A HREF="FAQ-4.html#ss4.5">4.5 How do I find other caches close to me and arrange parent/child/sibling relationships with them?</A>
+<LI><A HREF="FAQ-4.html#ss4.6">4.6 My cache registration is not appearing in the Tracker database.</A>
+<LI><A HREF="FAQ-4.html#ss4.7">4.7 What is the httpd-accelerator mode?</A>
+<LI><A HREF="FAQ-4.html#ss4.8">4.8 How do I configure Squid to work behind a firewall?</A>
+<LI><A HREF="FAQ-4.html#ss4.9">4.9 How do I configure Squid forward all requests to another proxy?</A>
+<LI><A HREF="FAQ-4.html#ss4.10">4.10 I have <EM>dnsserver</EM> processes that aren't being used, should I lower the number in <EM>squid.conf</EM>?</A>
+<LI><A HREF="FAQ-4.html#ss4.11">4.11 My <EM>dnsserver</EM> average/median service time seems high, how can I reduce it?</A>
+<LI><A HREF="FAQ-4.html#ss4.12">4.12 How can I easily change the default HTTP port?</A>
+<LI><A HREF="FAQ-4.html#ss4.13">4.13 Is it possible to control how big each <EM>cache_dir</EM> is?</A>
+<LI><A HREF="FAQ-4.html#ss4.14">4.14 What <EM>cache_dir</EM> size should I use?</A>
+<LI><A HREF="FAQ-4.html#ss4.15">4.15 I'm adding a new <EM>cache_dir</EM>.  Will I lose my cache?</A>
+<LI><A HREF="FAQ-4.html#ss4.16">4.16 Squid and <EM>http-gw</EM> from the TIS toolkit.</A>
+<LI><A HREF="FAQ-4.html#ss4.17">4.17 What is ``HTTP_X_FORWARDED_FOR''?  Why does squid provide it to WWW servers, and how can I stop it?</A>
+<LI><A HREF="FAQ-4.html#ss4.18">4.18 Can Squid anonymize HTTP requests?</A>
+<LI><A HREF="FAQ-4.html#ss4.19">4.19 Can I make Squid go direct for some sites?</A>
+<LI><A HREF="FAQ-4.html#ss4.20">4.20 Can I make Squid proxy only, without caching anything?</A>
+<LI><A HREF="FAQ-4.html#ss4.21">4.21 Can I prevent users from downloading large files?</A>
+</UL>
+<P>
+<H2><A NAME="toc5">5.</A> <A HREF="FAQ-5.html">Communication between browsers and Squid</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-5.html#ss5.1">5.1 Netscape manual configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.2">5.2 Netscape automatic configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.3">5.3 Lynx and Mosaic configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.4">5.4 Redundant Proxy Auto-Configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.5">5.5 Proxy Auto-Configuration with URL Hashing</A>
+<LI><A HREF="FAQ-5.html#ss5.6">5.6 Microsoft Internet Explorer configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.7">5.7 Netmanage Internet Chameleon WebSurfer configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.8">5.8 Opera 2.12 proxy configuration</A>
+<LI><A HREF="FAQ-5.html#ss5.9">5.9 How do I tell Squid to use a specific username for FTP urls?</A>
+<LI><A HREF="FAQ-5.html#ss5.10">5.10 Configuring Browsers for WPAD</A>
+<LI><A HREF="FAQ-5.html#ss5.11">5.11 IE 5.0x crops trailing slashes from FTP URL's</A>
+<LI><A HREF="FAQ-5.html#ss5.12">5.12 IE 6.0 SP1 fails when using basic authentication</A>
+</UL>
+<P>
+<H2><A NAME="toc6">6.</A> <A HREF="FAQ-6.html">Squid Log Files</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-6.html#ss6.1">6.1 <EM>squid.out</EM></A>
+<LI><A HREF="FAQ-6.html#ss6.2">6.2 <EM>cache.log</EM></A>
+<LI><A HREF="FAQ-6.html#ss6.3">6.3 <EM>useragent.log</EM></A>
+<LI><A HREF="FAQ-6.html#ss6.4">6.4 <EM>store.log</EM></A>
+<LI><A HREF="FAQ-6.html#ss6.5">6.5 <EM>hierarchy.log</EM></A>
+<LI><A HREF="FAQ-6.html#ss6.6">6.6 <EM>access.log</EM></A>
+<LI><A HREF="FAQ-6.html#ss6.7">6.7 Squid result codes</A>
+<LI><A HREF="FAQ-6.html#ss6.8">6.8 HTTP status codes</A>
+<LI><A HREF="FAQ-6.html#ss6.9">6.9 Request methods</A>
+<LI><A HREF="FAQ-6.html#ss6.10">6.10 Hierarchy Codes</A>
+<LI><A HREF="FAQ-6.html#ss6.11">6.11 <EM>cache/log</EM> (Squid-1.x)</A>
+<LI><A HREF="FAQ-6.html#ss6.12">6.12 <EM>swap.state</EM> (Squid-2.x)</A>
+<LI><A HREF="FAQ-6.html#ss6.13">6.13 Which log files can I delete safely?</A>
+<LI><A HREF="FAQ-6.html#ss6.14">6.14 How can I disable Squid's log files?</A>
+<LI><A HREF="FAQ-6.html#ss6.15">6.15 My log files get very big!</A>
+<LI><A HREF="FAQ-6.html#ss6.16">6.16 I want to use another tool to maintain the log files.</A>
+<LI><A HREF="FAQ-6.html#ss6.17">6.17 Managing log files</A>
+<LI><A HREF="FAQ-6.html#ss6.18">6.18 Why do I get ERR_NO_CLIENTS_BIG_OBJ messages so often?</A>
+<LI><A HREF="FAQ-6.html#ss6.19">6.19 What does ERR_LIFETIME_EXP mean?</A>
+<LI><A HREF="FAQ-6.html#ss6.20">6.20 Retrieving ``lost'' files from the cache</A>
+<LI><A HREF="FAQ-6.html#ss6.21">6.21 Can I use <EM>store.log</EM> to figure out if a response was cachable?</A>
+</UL>
+<P>
+<H2><A NAME="toc7">7.</A> <A HREF="FAQ-7.html">Operational issues</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-7.html#ss7.1">7.1 How do I see system level Squid statistics?</A>
+<LI><A HREF="FAQ-7.html#ss7.2">7.2 How can I find the biggest objects in my cache?</A>
+<LI><A HREF="FAQ-7.html#ss7.3">7.3 I want to restart Squid with a clean cache</A>
+<LI><A HREF="FAQ-7.html#ss7.4">7.4 How can I proxy/cache Real Audio?</A>
+<LI><A HREF="FAQ-7.html#ss7.5">7.5 How can I purge an object from my cache?</A>
+<LI><A HREF="FAQ-7.html#ss7.6">7.6 Using ICMP to Measure the Network</A>
+<LI><A HREF="FAQ-7.html#ss7.7">7.7 Why are so few requests logged as TCP_IMS_MISS?</A>
+<LI><A HREF="FAQ-7.html#ss7.8">7.8 How can I make Squid NOT cache some servers or URLs?</A>
+<LI><A HREF="FAQ-7.html#ss7.9">7.9 How can I delete and recreate a cache directory?</A>
+<LI><A HREF="FAQ-7.html#ss7.10">7.10 Why can't I run Squid as root?</A>
+<LI><A HREF="FAQ-7.html#ss7.11">7.11 Can you tell me a good way to upgrade Squid with minimal downtime?</A>
+<LI><A HREF="FAQ-7.html#ss7.12">7.12 Can Squid listen on more than one HTTP port?</A>
+<LI><A HREF="FAQ-7.html#ss7.13">7.13 Can I make origin servers see the client's IP address when going through Squid?</A>
+</UL>
+<P>
+<H2><A NAME="toc8">8.</A> <A HREF="FAQ-8.html">Memory</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-8.html#ss8.1">8.1 Why does Squid use so much memory!?</A>
+<LI><A HREF="FAQ-8.html#ss8.2">8.2 How can I tell how much memory my Squid process is using?</A>
+<LI><A HREF="FAQ-8.html#ss8.3">8.3 My Squid process grows without bounds.</A>
+<LI><A HREF="FAQ-8.html#ss8.4">8.4 I set <EM>cache_mem</EM> to XX, but the process grows beyond that!</A>
+<LI><A HREF="FAQ-8.html#ss8.5">8.5 How do I analyze memory usage from the cache manger output?</A>
+<LI><A HREF="FAQ-8.html#ss8.6">8.6 The ``Total memory accounted'' value is less than the size of my Squid process.</A>
+<LI><A HREF="FAQ-8.html#ss8.7">8.7 xmalloc: Unable to allocate 4096 bytes!</A>
+<LI><A HREF="FAQ-8.html#ss8.8">8.8 fork: (12) Cannot allocate memory</A>
+<LI><A HREF="FAQ-8.html#ss8.9">8.9 What can I do to reduce Squid's memory usage?</A>
+<LI><A HREF="FAQ-8.html#ss8.10">8.10 Using an alternate <EM>malloc</EM> library.</A>
+<LI><A HREF="FAQ-8.html#ss8.11">8.11 How much memory do I need in my Squid server?</A>
+</UL>
+<P>
+<H2><A NAME="toc9">9.</A> <A HREF="FAQ-9.html">The Cache Manager</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-9.html#ss9.1">9.1 What is the cache manager?</A>
+<LI><A HREF="FAQ-9.html#ss9.2">9.2 How do you set it up?</A>
+<LI><A HREF="FAQ-9.html#ss9.3">9.3 Cache manager configuration for CERN httpd 3.0</A>
+<LI><A HREF="FAQ-9.html#ss9.4">9.4 Cache manager configuration for Apache</A>
+<LI><A HREF="FAQ-9.html#ss9.5">9.5 Cache manager configuration for Roxen 2.0 and later</A>
+<LI><A HREF="FAQ-9.html#ss9.6">9.6 Cache manager ACLs in <EM>squid.conf</EM></A>
+<LI><A HREF="FAQ-9.html#ss9.7">9.7 Why does it say I need a password and a URL?</A>
+<LI><A HREF="FAQ-9.html#ss9.8">9.8 I want to shutdown the cache remotely. What's the password?</A>
+<LI><A HREF="FAQ-9.html#ss9.9">9.9 How do I make the cache host default to <EM>my</EM> cache?</A>
+<LI><A HREF="FAQ-9.html#ss9.10">9.10 What's the difference between Squid TCP connections and Squid UDP connections?</A>
+<LI><A HREF="FAQ-9.html#ss9.11">9.11 It says the storage expiration will happen in 1970!</A>
+<LI><A HREF="FAQ-9.html#ss9.12">9.12 What do the Meta Data entries mean?</A>
+<LI><A HREF="FAQ-9.html#ss9.13">9.13 In the utilization section, what is <CODE>Other</CODE>?</A>
+<LI><A HREF="FAQ-9.html#ss9.14">9.14 In the utilization section, why is the <CODE>Transfer KB/sec</CODE></A>
+<LI><A HREF="FAQ-9.html#ss9.15">9.15 In the utilization section, what is the <CODE>Object Count</CODE>?</A>
+<LI><A HREF="FAQ-9.html#ss9.16">9.16 In the utilization section, what is the <CODE>Max/Current/Min KB</CODE>?</A>
+<LI><A HREF="FAQ-9.html#ss9.17">9.17 What is the <CODE>I/O</CODE> section about?</A>
+<LI><A HREF="FAQ-9.html#ss9.18">9.18 What is the <CODE>Objects</CODE> section for?</A>
+<LI><A HREF="FAQ-9.html#ss9.19">9.19 What is the <CODE>VM Objects</CODE> section for?</A>
+<LI><A HREF="FAQ-9.html#ss9.20">9.20 What does <CODE>AVG RTT</CODE> mean?</A>
+<LI><A HREF="FAQ-9.html#ss9.21">9.21 In the IP cache section, what's the difference between a hit, a negative hit and a miss?</A>
+<LI><A HREF="FAQ-9.html#ss9.22">9.22 What do the IP cache contents mean anyway?</A>
+<LI><A HREF="FAQ-9.html#ss9.23">9.23 What is the fqdncache and how is it different from the ipcache?</A>
+<LI><A HREF="FAQ-9.html#ss9.24">9.24 What does ``Page faults with physical i/o: 4897'' mean?</A>
+<LI><A HREF="FAQ-9.html#ss9.25">9.25 What does the IGNORED field mean in the 'cache server list'?</A>
+</UL>
+<P>
+<H2><A NAME="toc10">10.</A> <A HREF="FAQ-10.html">Access Controls</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-10.html#ss10.1">10.1 Introduction</A>
+<LI><A HREF="FAQ-10.html#ss10.2">10.2 How do I allow my clients to use the cache?</A>
+<LI><A HREF="FAQ-10.html#ss10.3">10.3 how do I configure Squid not to cache a specific server? </A>
+<LI><A HREF="FAQ-10.html#ss10.4">10.4 How do I implement an ACL ban list?</A>
+<LI><A HREF="FAQ-10.html#ss10.5">10.5 How do I block specific users or groups from accessing my cache?</A>
+<LI><A HREF="FAQ-10.html#ss10.6">10.6 Do you have a CGI program which lets users change their own proxy passwords?</A>
+<LI><A HREF="FAQ-10.html#ss10.7">10.7 Is there a way to do ident lookups only for a certain host and compare the result with a userlist in squid.conf?</A>
+<LI><A HREF="FAQ-10.html#ss10.8">10.8 Common Mistakes</A>
+<LI><A HREF="FAQ-10.html#ss10.9">10.9 I set up my access controls, but they don't work!  why?</A>
+<LI><A HREF="FAQ-10.html#ss10.10">10.10 Proxy-authentication and neighbor caches</A>
+<LI><A HREF="FAQ-10.html#ss10.11">10.11 Is there an easy way of banning all Destination addresses except one?</A>
+<LI><A HREF="FAQ-10.html#ss10.12">10.12 Does anyone have a ban list of porn sites and such?</A>
+<LI><A HREF="FAQ-10.html#ss10.13">10.13 Squid doesn't match my subdomains</A>
+<LI><A HREF="FAQ-10.html#ss10.14">10.14 Why does Squid deny some port numbers?</A>
+<LI><A HREF="FAQ-10.html#ss10.15">10.15 Does Squid support the use of a database such as mySQL for storing the ACL list?</A>
+<LI><A HREF="FAQ-10.html#ss10.16">10.16 How can I allow a single address to access a specific URL?</A>
+<LI><A HREF="FAQ-10.html#ss10.17">10.17 How can I allow some clients to use the cache at specific times?</A>
+<LI><A HREF="FAQ-10.html#ss10.18">10.18 How can I allow some users to use the cache at specific times?</A>
+<LI><A HREF="FAQ-10.html#ss10.19">10.19 Problems with IP ACL's that have complicated netmasks</A>
+<LI><A HREF="FAQ-10.html#ss10.20">10.20 Can I set up ACL's based on MAC address rather than IP?</A>
+<LI><A HREF="FAQ-10.html#ss10.21">10.21 Debugging ACLs</A>
+<LI><A HREF="FAQ-10.html#ss10.22">10.22 Can I limit the number of connections from a client?</A>
+<LI><A HREF="FAQ-10.html#ss10.23">10.23 I'm trying to deny <EM>foo.com</EM>, but it's not working.</A>
+<LI><A HREF="FAQ-10.html#ss10.24">10.24 I want to customize, or make my own error messages.</A>
+<LI><A HREF="FAQ-10.html#ss10.25">10.25 I want to use local time zone in error messages</A>
+</UL>
+<P>
+<H2><A NAME="toc11">11.</A> <A HREF="FAQ-11.html">Troubleshooting</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-11.html#ss11.1">11.1 Why am I getting ``Proxy Access Denied?''</A>
+<LI><A HREF="FAQ-11.html#ss11.2">11.2 I can't get <CODE>local_domain</CODE> to work; <EM>Squid</EM> is caching the objects from my local servers.</A>
+<LI><A HREF="FAQ-11.html#ss11.3">11.3 I get <CODE>Connection Refused</CODE> when the cache tries to retrieve an object located on a sibling, even though the sibling thinks it delivered the object to my cache.</A>
+<LI><A HREF="FAQ-11.html#ss11.4">11.4 Running out of filedescriptors</A>
+<LI><A HREF="FAQ-11.html#ss11.5">11.5 What are these strange lines about removing objects?</A>
+<LI><A HREF="FAQ-11.html#ss11.6">11.6 Can I change a Windows NT FTP server to list directories in Unix format?</A>
+<LI><A HREF="FAQ-11.html#ss11.7">11.7 Why am I getting ``Ignoring MISS from non-peer x.x.x.x?''</A>
+<LI><A HREF="FAQ-11.html#ss11.8">11.8 DNS lookups for domain names with underscores (_) always fail.</A>
+<LI><A HREF="FAQ-11.html#ss11.9">11.9 Why does Squid say: ``Illegal character in hostname; underscores are not allowed?'</A>
+<LI><A HREF="FAQ-11.html#ss11.10">11.10 Why am I getting access denied from a sibling cache?</A>
+<LI><A HREF="FAQ-11.html#ss11.11">11.11 Cannot bind socket FD NN to *:8080 (125) Address already in use</A>
+<LI><A HREF="FAQ-11.html#ss11.12">11.12 icpDetectClientClose: ERROR xxx.xxx.xxx.xxx: (32) Broken pipe</A>
+<LI><A HREF="FAQ-11.html#ss11.13">11.13 icpDetectClientClose: FD 135, 255 unexpected bytes</A>
+<LI><A HREF="FAQ-11.html#ss11.14">11.14 Does Squid work with NTLM Authentication?</A>
+<LI><A HREF="FAQ-11.html#ss11.15">11.15 The <EM>default</EM> parent option isn't working!</A>
+<LI><A HREF="FAQ-11.html#ss11.16">11.16 ``Hot Mail'' complains about: Intrusion Logged. Access denied.</A>
+<LI><A HREF="FAQ-11.html#ss11.17">11.17 My Squid becomes very slow after it has been running for some time.</A>
+<LI><A HREF="FAQ-11.html#ss11.18">11.18 WARNING: Failed to start 'dnsserver'</A>
+<LI><A HREF="FAQ-11.html#ss11.19">11.19 Sending in Squid bug reports</A>
+<LI><A HREF="FAQ-11.html#ss11.20">11.20 Debugging Squid</A>
+<LI><A HREF="FAQ-11.html#ss11.21">11.21 FATAL: ipcache_init: DNS name lookup tests failed</A>
+<LI><A HREF="FAQ-11.html#ss11.22">11.22 FATAL: Failed to make swap directory /var/spool/cache: (13) Permission denied</A>
+<LI><A HREF="FAQ-11.html#ss11.23">11.23 FATAL: Cannot open HTTP Port</A>
+<LI><A HREF="FAQ-11.html#ss11.24">11.24 FATAL: All redirectors have exited!</A>
+<LI><A HREF="FAQ-11.html#ss11.25">11.25 FATAL: file_map_allocate: Exceeded filemap limit</A>
+<LI><A HREF="FAQ-11.html#ss11.26">11.26 FATAL: You've run out of swap file numbers.</A>
+<LI><A HREF="FAQ-11.html#ss11.27">11.27 I am using up over 95% of the filemap bits?!!</A>
+<LI><A HREF="FAQ-11.html#ss11.28">11.28 FATAL: Cannot open /usr/local/squid/logs/access.log: (13) Permission denied</A>
+<LI><A HREF="FAQ-11.html#ss11.29">11.29 When using a username and password, I can not access some files.</A>
+<LI><A HREF="FAQ-11.html#ss11.30">11.30 pingerOpen: icmp_sock: (13) Permission denied</A>
+<LI><A HREF="FAQ-11.html#ss11.31">11.31 What is a forwarding loop?</A>
+<LI><A HREF="FAQ-11.html#ss11.32">11.32 accept failure: (71) Protocol error</A>
+<LI><A HREF="FAQ-11.html#ss11.33">11.33 storeSwapInFileOpened: ... Size mismatch</A>
+<LI><A HREF="FAQ-11.html#ss11.34">11.34 Why do I get <EM>fwdDispatch: Cannot retrieve 'https://www.buy.com/corp/ordertracking.asp'</EM></A>
+<LI><A HREF="FAQ-11.html#ss11.35">11.35 Squid can't access URLs like http://3626046468/ab2/cybercards/moreinfo.html</A>
+<LI><A HREF="FAQ-11.html#ss11.36">11.36 I get a lot of ``URI has whitespace'' error messages in my cache log, what should I do?</A>
+<LI><A HREF="FAQ-11.html#ss11.37">11.37 commBind: Cannot bind socket FD 5 to 127.0.0.1:0: (49) Can't assign requested address</A>
+<LI><A HREF="FAQ-11.html#ss11.38">11.38 Unknown cache_dir type '/var/squid/cache'</A>
+<LI><A HREF="FAQ-11.html#ss11.39">11.39 unrecognized: 'cache_dns_program /usr/local/squid/bin/dnsserver'</A>
+<LI><A HREF="FAQ-11.html#ss11.40">11.40 Is <EM>dns_defnames</EM> broken in 2.3.STABLE1 and STABLE2?</A>
+<LI><A HREF="FAQ-11.html#ss11.41">11.41 What does <EM>sslReadClient: FD 14: read failure: (104) Connection reset by peer</EM> mean?</A>
+<LI><A HREF="FAQ-11.html#ss11.42">11.42 What does <EM>Connection refused</EM> mean?</A>
+<LI><A HREF="FAQ-11.html#ss11.43">11.43 squid: ERROR: no running copy</A>
+<LI><A HREF="FAQ-11.html#ss11.44">11.44 FATAL: getgrnam failed to find groupid for effective group 'nogroup'</A>
+<LI><A HREF="FAQ-11.html#ss11.45">11.45 ``Unsupported Request Method and Protocol'' for <EM>https</EM> URLs.</A>
+<LI><A HREF="FAQ-11.html#ss11.46">11.46 Squid uses 100% CPU</A>
+<LI><A HREF="FAQ-11.html#ss11.47">11.47 Webmin's <EM>cachemgr.cgi</EM> crashes the operating system</A>
+<LI><A HREF="FAQ-11.html#ss11.48">11.48 Segment Violation at startup or upon first request</A>
+<LI><A HREF="FAQ-11.html#ss11.49">11.49 urlParse: Illegal character in hostname 'proxy.mydomain.com:8080proxy.mydomain.com'</A>
+<LI><A HREF="FAQ-11.html#ss11.50">11.50 Requests for international domain names does not work</A>
+<LI><A HREF="FAQ-11.html#ss11.51">11.51 Why do I sometimes get ``Zero Sized Reply''?</A>
+</UL>
+<P>
+<H2><A NAME="toc12">12.</A> <A HREF="FAQ-12.html">How does Squid work?</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-12.html#ss12.1">12.1 What are cachable objects?</A>
+<LI><A HREF="FAQ-12.html#ss12.2">12.2 What is the ICP protocol?</A>
+<LI><A HREF="FAQ-12.html#ss12.3">12.3 What is the <EM>dnsserver</EM>?</A>
+<LI><A HREF="FAQ-12.html#ss12.4">12.4 What is the <EM>ftpget</EM> program for?</A>
+<LI><A HREF="FAQ-12.html#ss12.5">12.5 FTP PUT's don't work!</A>
+<LI><A HREF="FAQ-12.html#ss12.6">12.6 What is a cache hierarchy?  What are parents and siblings?</A>
+<LI><A HREF="FAQ-12.html#ss12.7">12.7 What is the Squid cache resolution algorithm?</A>
+<LI><A HREF="FAQ-12.html#ss12.8">12.8 What features are Squid developers currently working on?</A>
+<LI><A HREF="FAQ-12.html#ss12.9">12.9 Tell me more about Internet traffic workloads</A>
+<LI><A HREF="FAQ-12.html#ss12.10">12.10 What are the tradeoffs of caching with the NLANR cache system?</A>
+<LI><A HREF="FAQ-12.html#ss12.11">12.11 Where can I find out more about firewalls?</A>
+<LI><A HREF="FAQ-12.html#ss12.12">12.12 What is the ``Storage LRU Expiration Age?''</A>
+<LI><A HREF="FAQ-12.html#ss12.13">12.13 What is ``Failure Ratio at 1.01; Going into hit-only-mode for 5 minutes''?</A>
+<LI><A HREF="FAQ-12.html#ss12.14">12.14 Does squid periodically re-read its configuration file?</A>
+<LI><A HREF="FAQ-12.html#ss12.15">12.15 How does <EM>unlinkd</EM> work?</A>
+<LI><A HREF="FAQ-12.html#ss12.16">12.16 What is an icon URL?</A>
+<LI><A HREF="FAQ-12.html#ss12.17">12.17 Can I make my regular FTP clients use a Squid cache?</A>
+<LI><A HREF="FAQ-12.html#ss12.18">12.18 Why is the select loop average time so high?</A>
+<LI><A HREF="FAQ-12.html#ss12.19">12.19 How does Squid deal with Cookies?</A>
+<LI><A HREF="FAQ-12.html#ss12.20">12.20 How does Squid decide when to refresh a cached object?</A>
+<LI><A HREF="FAQ-12.html#ss12.21">12.21 What exactly is a <EM>deferred read</EM>?</A>
+<LI><A HREF="FAQ-12.html#ss12.22">12.22 Why is my cache's inbound traffic equal to the outbound traffic?</A>
+<LI><A HREF="FAQ-12.html#ss12.23">12.23 How come some objects do not get cached?</A>
+<LI><A HREF="FAQ-12.html#ss12.24">12.24 What does <EM>keep-alive ratio</EM> mean?</A>
+<LI><A HREF="FAQ-12.html#ss12.25">12.25 How does Squid's cache replacement algorithm work?</A>
+<LI><A HREF="FAQ-12.html#ss12.26">12.26 What are private and public keys?</A>
+<LI><A HREF="FAQ-12.html#ss12.27">12.27 What is FORW_VIA_DB for?</A>
+<LI><A HREF="FAQ-12.html#ss12.28">12.28 Does Squid send packets to port 7 (echo)?  If so, why?</A>
+<LI><A HREF="FAQ-12.html#ss12.29">12.29 What does ``WARNING: Reply from unknown nameserver [a.b.c.d]'' mean?</A>
+<LI><A HREF="FAQ-12.html#ss12.30">12.30 How does Squid distribute cache files among the available directories?</A>
+<LI><A HREF="FAQ-12.html#ss12.31">12.31 Why do I see negative byte hit ratio?</A>
+<LI><A HREF="FAQ-12.html#ss12.32">12.32 What does ``Disabling use of private keys'' mean?</A>
+<LI><A HREF="FAQ-12.html#ss12.33">12.33 What is a half-closed filedescriptor?</A>
+<LI><A HREF="FAQ-12.html#ss12.34">12.34 What does --enable-heap-replacement do?</A>
+<LI><A HREF="FAQ-12.html#ss12.35">12.35 Why is actual filesystem space used greater than what Squid thinks?</A>
+<LI><A HREF="FAQ-12.html#ss12.36">12.36 How do <EM>positive_dns_ttl</EM> and <EM>negative_dns_ttl</EM> work?</A>
+<LI><A HREF="FAQ-12.html#ss12.37">12.37 What does <EM>swapin MD5 mismatch</EM> mean?</A>
+<LI><A HREF="FAQ-12.html#ss12.38">12.38 What does <EM>failed to unpack swapfile meta data</EM> mean?</A>
+<LI><A HREF="FAQ-12.html#ss12.39">12.39 Why doesn't Squid make <EM>ident</EM> lookups in interception mode?</A>
+<LI><A HREF="FAQ-12.html#ss12.40">12.40 dnsSubmit: queue overload, rejecting blah</A>
+<LI><A HREF="FAQ-12.html#ss12.41">12.41 What are FTP passive connections?</A>
+</UL>
+<P>
+<H2><A NAME="toc13">13.</A> <A HREF="FAQ-13.html">Multicast</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-13.html#ss13.1">13.1 What is Multicast?</A>
+<LI><A HREF="FAQ-13.html#ss13.2">13.2 How do I know if I'm on the Mbone?</A>
+<LI><A HREF="FAQ-13.html#ss13.3">13.3 Should I be using Multicast ICP?</A>
+<LI><A HREF="FAQ-13.html#ss13.4">13.4 How do I configure Squid to send Multicast ICP queries?</A>
+<LI><A HREF="FAQ-13.html#ss13.5">13.5 How do I know what Multicast TTL to use?</A>
+<LI><A HREF="FAQ-13.html#ss13.6">13.6 How do I configure Squid to receive and respond to Multicast ICP?</A>
+</UL>
+<P>
+<H2><A NAME="toc14">14.</A> <A HREF="FAQ-14.html">System-Dependent Weirdnesses</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-14.html#ss14.1">14.1 Solaris</A>
+<LI><A HREF="FAQ-14.html#ss14.2">14.2 FreeBSD</A>
+<LI><A HREF="FAQ-14.html#ss14.3">14.3 OSF1/3.2</A>
+<LI><A HREF="FAQ-14.html#ss14.4">14.4 BSD/OS</A>
+<LI><A HREF="FAQ-14.html#ss14.5">14.5 Linux</A>
+<LI><A HREF="FAQ-14.html#ss14.6">14.6 HP-UX</A>
+<LI><A HREF="FAQ-14.html#ss14.7">14.7 IRIX</A>
+<LI><A HREF="FAQ-14.html#ss14.8">14.8 SCO-UNIX</A>
+<LI><A HREF="FAQ-14.html#ss14.9">14.9 AIX</A>
+</UL>
+<P>
+<H2><A NAME="toc15">15.</A> <A HREF="FAQ-15.html">Redirectors</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-15.html#ss15.1">15.1 What is a redirector?</A>
+<LI><A HREF="FAQ-15.html#ss15.2">15.2 Why use a redirector?</A>
+<LI><A HREF="FAQ-15.html#ss15.3">15.3 How does it work?</A>
+<LI><A HREF="FAQ-15.html#ss15.4">15.4 Can I use the redirector to return HTTP redirect messages?</A>
+<LI><A HREF="FAQ-15.html#ss15.5">15.5 FATAL: All redirectors have exited!</A>
+<LI><A HREF="FAQ-15.html#ss15.6">15.6 Redirector interface is broken re IDENT values</A>
+</UL>
+<P>
+<H2><A NAME="toc16">16.</A> <A HREF="FAQ-16.html">Cache Digests</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-16.html#ss16.1">16.1 What is a Cache Digest?</A>
+<LI><A HREF="FAQ-16.html#ss16.2">16.2 How and why are they used?</A>
+<LI><A HREF="FAQ-16.html#ss16.3">16.3 What is the theory behind Cache Digests?</A>
+<LI><A HREF="FAQ-16.html#ss16.4">16.4 How is the size of the Cache Digest in Squid determined?</A>
+<LI><A HREF="FAQ-16.html#ss16.5">16.5 What hash functions (and how many of them) does Squid use?</A>
+<LI><A HREF="FAQ-16.html#ss16.6">16.6 How are objects added to the Cache Digest in Squid?</A>
+<LI><A HREF="FAQ-16.html#ss16.7">16.7 Does Squid support deletions in Cache Digests? What are diffs/deltas?</A>
+<LI><A HREF="FAQ-16.html#ss16.8">16.8 When and how often is the local digest built?</A>
+<LI><A HREF="FAQ-16.html#ss16.9">16.9 How are Cache Digests transferred between peers?</A>
+<LI><A HREF="FAQ-16.html#ss16.10">16.10 How and where are Cache Digests stored?</A>
+<LI><A HREF="FAQ-16.html#ss16.11">16.11 How are the Cache Digest statistics in the Cache Manager to be interpreted?</A>
+<LI><A HREF="FAQ-16.html#ss16.12">16.12 What are False Hits and how should they be handled?</A>
+<LI><A HREF="FAQ-16.html#ss16.13">16.13 How can Cache Digest related activity be traced/debugged?</A>
+<LI><A HREF="FAQ-16.html#ss16.14">16.14 What about ICP?</A>
+<LI><A HREF="FAQ-16.html#ss16.15">16.15 Is there a Cache Digest Specification?</A>
+<LI><A HREF="FAQ-16.html#ss16.16">16.16 Would it be possible to stagger the timings when cache_digests are retrieved from peers?</A>
+</UL>
+<P>
+<H2><A NAME="toc17">17.</A> <A HREF="FAQ-17.html">Interception Caching/Proxying</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-17.html#ss17.1">17.1 Interception caching for Solaris, SunOS, and BSD systems</A>
+<LI><A HREF="FAQ-17.html#ss17.2">17.2 Interception caching with Linux 2.0 and ipfwadm</A>
+<LI><A HREF="FAQ-17.html#ss17.3">17.3 Interception caching with Linux 2.2 and ipchains</A>
+<LI><A HREF="FAQ-17.html#ss17.4">17.4 Interception caching with Linux 2.4 and netfilter</A>
+<LI><A HREF="FAQ-17.html#ss17.5">17.5 Interception caching with Cisco routers</A>
+<LI><A HREF="FAQ-17.html#ss17.6">17.6 Interception caching with LINUX 2.0.29 and CISCO IOS 11.1</A>
+<LI><A HREF="FAQ-17.html#ss17.7">17.7 The cache is trying to connect to itself...</A>
+<LI><A HREF="FAQ-17.html#ss17.8">17.8 Interception caching with FreeBSD</A>
+<LI><A HREF="FAQ-17.html#ss17.9">17.9 Interception caching with ACC Tigris digital access server</A>
+<LI><A HREF="FAQ-17.html#ss17.10">17.10 ``Connection reset by peer'' and Cisco policy routing</A>
+<LI><A HREF="FAQ-17.html#ss17.11">17.11 WCCP - Web Cache Coordination Protocol</A>
+<LI><A HREF="FAQ-17.html#ss17.12">17.12 Can someone tell me what version of cisco IOS WCCP is added in?</A>
+<LI><A HREF="FAQ-17.html#ss17.13">17.13 What about WCCPv2?</A>
+<LI><A HREF="FAQ-17.html#ss17.14">17.14 Interception caching with Foundry L4 switches</A>
+<LI><A HREF="FAQ-17.html#ss17.15">17.15 Can I use <EM>proxy_auth</EM> with interception?</A>
+</UL>
+<P>
+<H2><A NAME="toc18">18.</A> <A HREF="FAQ-18.html">SNMP</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-18.html#ss18.1">18.1 Does Squid support SNMP?</A>
+<LI><A HREF="FAQ-18.html#ss18.2">18.2 Enabling SNMP in Squid</A>
+<LI><A HREF="FAQ-18.html#ss18.3">18.3 Configuring Squid 2.2</A>
+<LI><A HREF="FAQ-18.html#ss18.4">18.4 Configuring Squid 2.1</A>
+<LI><A HREF="FAQ-18.html#ss18.5">18.5 How can I query the Squid SNMP Agent</A>
+<LI><A HREF="FAQ-18.html#ss18.6">18.6 What can I use SNMP and Squid for?</A>
+<LI><A HREF="FAQ-18.html#ss18.7">18.7 How can I use SNMP with Squid?</A>
+<LI><A HREF="FAQ-18.html#ss18.8">18.8 Where can I get more information/discussion about Squid and SNMP?</A>
+</UL>
+<P>
+<H2><A NAME="toc19">19.</A> <A HREF="FAQ-19.html">Squid version 2</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-19.html#ss19.1">19.1 What are the new features?</A>
+<LI><A HREF="FAQ-19.html#ss19.2">19.2 How do I configure 'ssl_proxy' now?</A>
+<LI><A HREF="FAQ-19.html#ss19.3">19.3 Logfile rotation doesn't work with Async I/O</A>
+<LI><A HREF="FAQ-19.html#ss19.4">19.4 Adding a new cache disk</A>
+<LI><A HREF="FAQ-19.html#ss19.5">19.5 Squid 2 performs badly on Linux</A>
+<LI><A HREF="FAQ-19.html#ss19.6">19.6 How do I configure proxy authentication with Squid-2?</A>
+<LI><A HREF="FAQ-19.html#ss19.7">19.7 Why does proxy-auth reject all users with Squid-2.2?</A>
+<LI><A HREF="FAQ-19.html#ss19.8">19.8 Delay Pools</A>
+<LI><A HREF="FAQ-19.html#ss19.9">19.9 Can I preserve my cache when upgrading from 1.1 to 2?</A>
+<LI><A HREF="FAQ-19.html#ss19.10">19.10 Customizable Error Messages</A>
+<LI><A HREF="FAQ-19.html#ss19.11">19.11 My squid.conf from version 1.1 doesn't work!</A>
+</UL>
+<P>
+<H2><A NAME="toc20">20.</A> <A HREF="FAQ-20.html">httpd-accelerator mode</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-20.html#ss20.1">20.1 What is the httpd-accelerator mode?</A>
+<LI><A HREF="FAQ-20.html#ss20.2">20.2 How do I set it up?</A>
+<LI><A HREF="FAQ-20.html#ss20.3">20.3 When using an httpd-accelerator, the port number for redirects is wrong</A>
+</UL>
+<P>
+<H2><A NAME="toc21">21.</A> <A HREF="FAQ-21.html">Related Software</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-21.html#ss21.1">21.1 Clients</A>
+<LI><A HREF="FAQ-21.html#ss21.2">21.2 Logfile Analysis</A>
+<LI><A HREF="FAQ-21.html#ss21.3">21.3 Configuration Tools</A>
+<LI><A HREF="FAQ-21.html#ss21.4">21.4 Squid add-ons</A>
+<LI><A HREF="FAQ-21.html#ss21.5">21.5 Ident Servers</A>
+</UL>
+<P>
+<H2><A NAME="toc22">22.</A> <A HREF="FAQ-22.html">DISKD</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-22.html#ss22.1">22.1 What is DISKD?</A>
+<LI><A HREF="FAQ-22.html#ss22.2">22.2 Does it perform better?</A>
+<LI><A HREF="FAQ-22.html#ss22.3">22.3 How do I use it?</A>
+<LI><A HREF="FAQ-22.html#ss22.4">22.4 FATAL: Unknown cache_dir type 'diskd'</A>
+<LI><A HREF="FAQ-22.html#ss22.5">22.5 If I use DISKD, do I have to wipe out my current cache?</A>
+<LI><A HREF="FAQ-22.html#ss22.6">22.6 How do I configure message queues?</A>
+<LI><A HREF="FAQ-22.html#ss22.7">22.7 How do I configure shared memory?</A>
+<LI><A HREF="FAQ-22.html#ss22.8">22.8 Sometimes shared memory and message queues aren't released when Squid exits.</A>
+<LI><A HREF="FAQ-22.html#ss22.9">22.9 What are the Q1 and Q2 parameters?</A>
+</UL>
+<P>
+<H2><A NAME="toc23">23.</A> <A HREF="FAQ-23.html">Authentication</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-23.html#ss23.1">23.1 How does Proxy Authentication work in Squid?</A>
+<LI><A HREF="FAQ-23.html#ss23.2">23.2 How do I use authentication in access controls?</A>
+<LI><A HREF="FAQ-23.html#ss23.3">23.3 Does Squid cache authentication lookups?</A>
+<LI><A HREF="FAQ-23.html#ss23.4">23.4 Are passwords stored in clear text or encrypted?</A>
+<LI><A HREF="FAQ-23.html#ss23.5">23.5 How do I use the Winbind authenticators?</A>
+</UL>
+<P>
+<H2><A NAME="toc24">24.</A> <A HREF="FAQ-24.html">Terms and Definitions</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-24.html#ss24.1">24.1 Neighbor</A>
+<LI><A HREF="FAQ-24.html#ss24.2">24.2 Regular Expression</A>
+</UL>
+<P>
+<H2><A NAME="toc25">25.</A> <A HREF="FAQ-25.html">Security Concerns</A></H2>
+
+<UL>
+<LI><A HREF="FAQ-25.html#ss25.1">25.1 Open-access proxies</A>
+<LI><A HREF="FAQ-25.html#ss25.2">25.2 Mail relaying</A>
+</UL>
+<HR>
+<A HREF="FAQ-1.html">Next</A>
+Previous
+Contents
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/cachemgrfaq.html
+++ squid-2.5.9/debian/doc/cachemgrfaq.html
@@ -0,0 +1,569 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: The Cache Manager</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-10.html">Next</A>
+<A HREF="FAQ-8.html">Previous</A>
+<A HREF="FAQ.html#toc9">Contents</A>
+<HR>
+<H2><A NAME="cachemgr-section"></A> <A NAME="s9">9. The Cache Manager</A></H2>
+
+<P>by 
+<A HREF="mailto:JLarmour@origin-at.co.uk">Jonathan Larmour</A><P>
+<H2><A NAME="ss9.1">9.1 What is the cache manager?</A>
+</H2>
+
+<P>The cache manager (<EM>cachemgr.cgi</EM>) is a CGI utility for
+displaying statistics about the <EM>squid</EM> process as it runs.
+The cache manager is a convenient way to manage the cache and view
+statistics without logging into the server.
+<P>
+<H2><A NAME="ss9.2">9.2 How do you set it up?</A>
+</H2>
+
+<P>That depends on which web server you're using.  Below you will
+find instructions for configuring the CERN and Apache servers
+to permit <EM>cachemgr.cgi</EM> usage.
+<P><EM>EDITOR&quot;S NOTE: readers are encouraged to submit instructions
+for configuration of cachemgr.cgi on other web server platforms, such
+as Netscape.</EM>
+<P>
+<P>After you edit the server configuration files, you will probably
+need to either restart your web server or or send it a <CODE>SIGHUP</CODE> signal
+to tell it to re-read its configuration files.
+<P>
+<P>When you're done configuring your web server, you'll connect to
+the cache manager with a web browser, using a URL such as:
+<PRE>
+        http://www.example.com/Squid/cgi-bin/cachemgr.cgi/
+</PRE>
+<P>
+<H2><A NAME="ss9.3">9.3 Cache manager configuration for CERN httpd 3.0</A>
+</H2>
+
+<P>First, you should ensure that only specified workstations can access
+the cache manager.  That is done in your CERN <EM>httpd.conf</EM>, not in
+<EM>squid.conf</EM>.
+<P>
+<PRE>
+        Protection MGR-PROT {
+                 Mask    @(workstation.example.com)
+        }
+</PRE>
+<P>Wildcards are acceptable, IP addresses are acceptable, and others
+can be added with a comma-separated list of IP addresses. There
+are many more ways of protection.  Your server documentation has
+details.
+<P>
+<P>You also need to add:
+<PRE>
+        Protect         /Squid/*        MGR-PROT
+        Exec            /Squid/cgi-bin/*.cgi    /usr/local/squid/bin/*.cgi
+</PRE>
+
+This marks the script as executable to those in <CODE>MGR-PROT</CODE>.
+<P>
+<H2><A NAME="ss9.4">9.4 Cache manager configuration for Apache</A>
+</H2>
+
+<P>First, make sure the cgi-bin directory you're using is listed with a
+<CODE>ScriptAlias</CODE> in your Apache <EM>srm.conf</EM> file like this:
+<PRE>
+        ScriptAlias /Squid/cgi-bin/ /usr/local/squid/cgi-bin/
+</PRE>
+
+It's probably a <B>bad</B> idea to <CODE>ScriptAlias</CODE>
+the entire <EM></EM>usr/local/squid/bin/ directory where all the
+Squid executables live.
+<P>Next, you should ensure that only specified workstations can access
+the cache manager.  That is done in your Apache <EM>access.conf</EM>,
+not in <EM>squid.conf</EM>.  At the bottom of <EM>access.conf</EM>
+file, insert:
+<PRE>
+        &lt;Location /Squid/cgi-bin/cachemgr.cgi>
+        order deny,allow
+        deny from all
+        allow from workstation.example.com
+        &lt;/Location>
+</PRE>
+<P>You can have more than one allow line, and you can allow
+domains or networks.
+<P>Alternately, <EM>cachemgr.cgi</EM> can be password-protected.  You'd
+add the following to <EM>access.conf</EM>:
+<P>
+<PRE>
+        &lt;Location /Squid/cgi-bin/cachemgr.cgi>
+        AuthUserFile /path/to/password/file
+        AuthGroupFile /dev/null
+        AuthName User/Password Required
+        AuthType Basic
+        require user cachemanager
+        &lt;/Location>
+</PRE>
+<P>Consult the Apache documentation for information on using <EM>htpasswd</EM>
+to set a password for this ``user.''
+<P>
+<H2><A NAME="ss9.5">9.5 Cache manager configuration for Roxen 2.0 and later</A>
+</H2>
+
+<P>by Francesco ``kinkie'' Chemolli
+<P>Notice: this is <EM>not</EM> how things would get best done
+with Roxen, but this what you need to do go adhere to the
+example.
+Also, knowledge of basic Roxen configuration is required.
+<P>
+<P>This is what's required to start up a fresh Virtual Server, only
+serving the cache manager. If you already have some Virtual Server
+you wish to use to host the Cache Manager, just add a new CGI
+support module to it.
+<P>
+<P>Create a new virtual server, and set it to host http://www.example.com/.
+Add to it at least the following modules:
+<UL>
+<LI>Content Types</LI>
+<LI>CGI scripting support</LI>
+</UL>
+<P>
+<P>In the <EM>CGI scripting support</EM> module, section <EM>Settings</EM>,
+change the following settings:
+<UL>
+<LI>CGI-bin path: set to /Squid/cgi-bin/</LI>
+<LI>Handle *.cgi: set to <EM>no</EM></LI>
+<LI>Run user scripts as owner: set to <EM>no</EM></LI>
+<LI>Search path: set to the directory containing the cachemgr.cgi file</LI>
+</UL>
+<P>
+<P>In section <EM>Security</EM>, set <EM>Patterns</EM> to:
+<PRE>
+allow ip=1.2.3.4
+</PRE>
+
+where 1.2.3.4 is the IP address for workstation.example.com
+<P>
+<P>Save the configuration, and you're done.
+<P>
+<H2><A NAME="ss9.6">9.6 Cache manager ACLs in <EM>squid.conf</EM></A>
+</H2>
+
+<P>The default cache manager access configuration in <EM>squid.conf</EM> is:
+<P>
+<PRE>
+        acl manager proto cache_object
+        acl localhost src 127.0.0.1/255.255.255.255
+        acl all src 0.0.0.0/0.0.0.0
+</PRE>
+<P>With the following rules:
+<P>
+<PRE>
+        http_access deny manager !localhost
+        http_access allow all
+</PRE>
+<P>
+<P>The first ACL is the most important as the cache manager program
+interrogates squid using a special <CODE>cache_object</CODE> protocol.
+Try it yourself by doing:
+<P>
+<PRE>
+        telnet mycache.example.com 3128
+        GET cache_object://mycache.example.com/info HTTP/1.0
+</PRE>
+<P>The default ACLs say that if the request is for a
+<CODE>cache_object</CODE>, and it isn't the local host, then deny
+access; otherwise allow access.
+<P>
+<P>In fact, only allowing localhost access means that on the
+initial <EM>cachemgr.cgi</EM> form you can only specify the cache
+host as <CODE>localhost</CODE>. We recommend the following:
+<P>
+<PRE>
+        acl manager proto cache_object
+        acl localhost src 127.0.0.1/255.255.255.255
+        acl example src 123.123.123.123/255.255.255.255
+        acl all src 0.0.0.0/0.0.0.0
+</PRE>
+<P>Where <CODE>123.123.123.123</CODE> is the IP address of your web server.
+Then modify the rules like this:
+<P>
+<PRE>
+        http_access allow manager localhost
+        http_access allow manager example
+        http_access deny manager
+        http_access allow all
+</PRE>
+
+If you're using <EM>miss_access</EM>, then don't forget to also add
+a <EM>miss_access</EM> rule for the cache manager:
+<PRE>
+        miss_access allow manager
+</PRE>
+<P>
+<P>
+<P>The default ACLs assume that your web server is on the same machine
+as <EM>squid</EM>. Remember that the connection from the cache
+manager program to squid originates at the web server, not the
+browser. So if your web server lives somewhere else, you should
+make sure that IP address of the web server that has <EM>cachemgr.cgi</EM>
+installed on it is in the <CODE>example</CODE> ACL above.
+<P>
+<P>Always be sure to send a <CODE>SIGHUP</CODE> signal to <EM>squid</EM>
+any time you change the <EM>squid.conf</EM> file.
+<P>
+<H2><A NAME="ss9.7">9.7 Why does it say I need a password and a URL?</A>
+</H2>
+
+<P>If you ``drop'' the list box, and browse it, you will see that the
+password is only required to shutdown the cache, and the URL is
+required to refresh an object (i.e., retrieve it from its original
+source again) Otherwise these fields can be left blank:  a password
+is not required to obtain access to the informational aspects of
+<EM>cachemgr.cgi</EM>.
+<P>
+<H2><A NAME="ss9.8">9.8 I want to shutdown the cache remotely. What's the password?</A>
+</H2>
+
+<P>See the <CODE>cachemgr_passwd</CODE> directive in <EM>squid.conf</EM>.
+<P>
+<H2><A NAME="ss9.9">9.9 How do I make the cache host default to <EM>my</EM> cache?</A>
+</H2>
+
+<P>When you run <EM>configure</EM> use the <EM>--enable-cachemgr-hostname</EM> option:
+<PRE>
+% ./configure --enable-cachemgr-hostname=`hostname` ...
+</PRE>
+<P>Note, if you do this after you already installed Squid before, you need to
+make sure <EM>cachemgr.cgi</EM> gets recompiled.  For example:
+<PRE>
+% cd src
+% rm cachemgr.o cachemgr.cgi
+% make cachemgr.cgi
+</PRE>
+<P>Then copy <EM>cachemgr.cgi</EM> to your HTTP server's <EM>cgi-bin</EM> directory.
+<P>
+<H2><A NAME="ss9.10">9.10 What's the difference between Squid TCP connections and Squid UDP connections?</A>
+</H2>
+
+<P>Browsers and caches use TCP connections to retrieve web objects
+from web servers or caches.  UDP connections are used when another
+cache using you as a sibling or parent wants to find out if you
+have an object in your cache that it's looking for.  The UDP
+connections are ICP queries.
+<P>
+<H2><A NAME="ss9.11">9.11 It says the storage expiration will happen in 1970!</A>
+</H2>
+
+<P>Don't worry. The default (and sensible) behavior of <EM>squid</EM>
+is to expire an object when it happens to overwrite it.  It doesn't
+explicitly garbage collect (unless you tell it to in other ways).
+<P>
+<H2><A NAME="ss9.12">9.12 What do the Meta Data entries mean?</A>
+</H2>
+
+<P>
+<DL>
+<P>
+<DT><B>StoreEntry</B><DD><P>Entry describing an object in the cache.
+<P>
+<DT><B>IPCacheEntry</B><DD><P>An entry in the DNS cache.
+<P>
+<DT><B>Hash link</B><DD><P>Link in the cache hash table structure.
+<P>
+<DT><B>URL strings</B><DD><P>The strings of the URLs themselves that map to
+an object number in the cache, allowing access to the
+StoreEntry.
+<P>
+</DL>
+<P>
+<P>Basically just like the <CODE>log</CODE> file in your cache directory:
+<P>
+<OL>
+<LI><CODE>PoolMemObject structures</CODE></LI>
+<LI>Info about objects currently in memory,
+(eg, in the process of being transferred).</LI>
+<LI><CODE>Pool for Request structures</CODE></LI>
+<LI>Information about each request as it happens.</LI>
+<LI><CODE>Pool for in-memory object</CODE></LI>
+<LI>Space for object data as it is retrieved.</LI>
+</OL>
+<P>
+<P>If <EM>squid</EM> is much smaller than this field, run for cover!
+Something is very wrong, and you should probably restart <EM>squid</EM>.
+<P>
+<H2><A NAME="ss9.13">9.13 In the utilization section, what is <CODE>Other</CODE>?</A>
+</H2>
+
+<P>
+<P><CODE>Other</CODE> is a default category to track objects which
+don't fall into one of the defined categories.
+<P>
+<H2><A NAME="ss9.14">9.14 In the utilization section, why is the <CODE>Transfer KB/sec</CODE></A>
+column always zero?</H2>
+
+<P>This column contains gross estimations of data transfer rates
+averaged over the entire time the cache has been running.  These
+numbers are unreliable and mostly useless.
+<P>
+<H2><A NAME="ss9.15">9.15 In the utilization section, what is the <CODE>Object Count</CODE>?</A>
+</H2>
+
+<P>The number of objects of that type in the cache right now.
+<P>
+<H2><A NAME="ss9.16">9.16 In the utilization section, what is the <CODE>Max/Current/Min KB</CODE>?</A>
+</H2>
+
+<P>These refer to the size all the objects of this type have grown
+to/currently are/shrunk to.
+<P>
+<H2><A NAME="ss9.17">9.17 What is the <CODE>I/O</CODE> section about?</A>
+</H2>
+
+<P>These are histograms on the number of bytes read from the network
+per <CODE>read(2)</CODE> call.  Somewhat useful for determining
+maximum buffer sizes.
+<P>
+<H2><A NAME="ss9.18">9.18 What is the <CODE>Objects</CODE> section for?</A>
+</H2>
+
+<P><B><EM>Warning:</EM></B> this will download to your browser
+a list of every URL in the cache and statistics about it. It can
+be very, very large.  <B><EM>Sometimes it will be larger than
+the amount of available memory in your client!</EM></B> You
+probably don't need this information anyway.
+<P>
+<H2><A NAME="ss9.19">9.19 What is the <CODE>VM Objects</CODE> section for?</A>
+</H2>
+
+<P><CODE>VM Objects</CODE> are the objects which are in Virtual Memory.
+These are objects which are currently being retrieved and
+those which were kept in memory for fast access (accelerator
+mode).
+<P>
+<H2><A NAME="ss9.20">9.20 What does <CODE>AVG RTT</CODE> mean?</A>
+</H2>
+
+<P>Average Round Trip Time. This is how long on average after
+an ICP ping is sent that a reply is received.
+<P>
+<H2><A NAME="ss9.21">9.21 In the IP cache section, what's the difference between a hit, a negative hit and a miss?</A>
+</H2>
+
+<P>
+<P>A HIT means that the document was found in the cache. A
+MISS, that it wasn't found in the cache. A negative hit
+means that it was found in the cache, but it doesn't exist.
+<P>
+<H2><A NAME="ss9.22">9.22 What do the IP cache contents mean anyway?</A>
+</H2>
+
+<P>
+<P>The hostname is the name that was requested to be resolved.
+<P>
+<P>For the <CODE>Flags</CODE> column:
+<P>
+<UL>
+<LI><CODE>C</CODE> Means positively cached.</LI>
+<LI><CODE>N</CODE> Means negatively cached.</LI>
+<LI><CODE>P</CODE> Means the request is pending being dispatched.</LI>
+<LI><CODE>D</CODE> Means the request has been dispatched and we're waiting for an answer.</LI>
+<LI><CODE>L</CODE> Means it is a locked entry because it represents a parent or sibling.</LI>
+</UL>
+<P>The <CODE>TTL</CODE> column represents ``Time To Live'' (i.e., how long
+the cache entry is valid).  (May be negative if the document has
+expired.)
+<P>
+<P>The <CODE>N</CODE> column is the number of IP addresses from which
+the cache has documents.
+<P>
+<P>The rest of the line lists all the IP addresses that have been associated
+with that IP cache entry.
+<P>
+<P>
+<H2><A NAME="ss9.23">9.23 What is the fqdncache and how is it different from the ipcache?</A>
+</H2>
+
+<P>IPCache contains data for the Hostname to IP-Number mapping, and
+FQDNCache does it the other way round.  For example:
+<P><EM>IP Cache Contents:</EM>
+<PRE>
+        Hostname                      Flags lstref    TTL  N [IP-Number]
+        gorn.cc.fh-lippe.de               C       0  21581 1 193.16.112.73
+        lagrange.uni-paderborn.de         C       6  21594 1 131.234.128.245
+        www.altavista.digital.com         C      10  21299 4 204.123.2.75  ...
+        2/ftp.symantec.com                DL   1583 -772855 0
+
+        Flags:  C --> Cached
+                D --> Dispatched
+                N --> Negative Cached
+                L --> Locked
+        lstref: Time since last use
+        TTL:    Time-To-Live until information expires
+        N:      Count of addresses
+</PRE>
+<P>
+<P><EM>FQDN Cache Contents:</EM>
+<PRE>
+        IP-Number                    Flags    TTL N Hostname
+        130.149.17.15                    C -45570 1 andele.cs.tu-berlin.de
+        194.77.122.18                    C -58133 1 komet.teuto.de
+        206.155.117.51                   N -73747 0
+
+        Flags:  C --> Cached
+                D --> Dispatched
+                N --> Negative Cached
+                L --> Locked
+        TTL:    Time-To-Live until information expires
+        N:      Count of names
+</PRE>
+<P>
+<H2><A NAME="paging"></A> <A NAME="ss9.24">9.24 What does ``Page faults with physical i/o: 4897'' mean?</A>
+</H2>
+
+<P>This question was asked on the <EM>squid-users</EM> mailing list, to which
+there were three excellent replies.
+<P>
+<P>by 
+<A HREF="mailto:JLarmour@origin-at.co.uk">Jonathan Larmour</A><P>
+<P>You get a ``page fault'' when your OS tries to access something in memory
+which is actually swapped to disk. The term ``page fault'' while correct at
+the kernel and CPU level, is a bit deceptive to a user, as there's no
+actual error - this is a normal feature of operation.
+<P>
+<P>Also, this doesn't necessarily mean your squid is swapping by that much.
+Most operating systems also implement paging for executables, so that only
+sections of the executable which are actually used are read from disk into
+memory. Also, whenever squid needs more memory, the fact that the memory
+was allocated will show up in the page faults.
+<P>
+<P>However, if the number of faults is unusually high, and getting bigger,
+this could mean that squid is swapping. Another way to verify this is using
+a program called ``vmstat'' which is found on most UNIX platforms. If you run
+this as ``vmstat 5'' this will update a display every 5 seconds. This can
+tell you if the system as a whole is swapping a lot (see your local man
+page for vmstat for more information).
+<P>
+<P>It is very bad for squid to swap, as every single request will be blocked
+until the requested data is swapped in. It is better to tweak the <EM>cache_mem</EM>
+and/or <EM>memory_pools</EM> setting in squid.conf, or switch to the NOVM versions
+of squid, than allow this to happen.
+<P>
+<P>by 
+<A HREF="mailto:peter@spinner.dialix.com.au">Peter Wemm</A><P>
+<P>There's two different operations at work, Paging and swapping.  Paging
+is when individual pages are shuffled (either discarded or swapped
+to/from disk), while ``swapping'' <EM>generally</EM> means the entire
+process got sent to/from disk.
+<P>
+<P>Needless to say, swapping a process is a pretty drastic event, and usually
+only reserved for when there's a memory crunch and paging out cannot free
+enough memory quickly enough.  Also, there's some variation on how
+swapping is implemented in OS's.  Some don't do it at all or do a hybrid
+of paging and swapping instead.
+<P>
+<P>As you say, paging out doesn't necessarily involve disk IO, eg: text (code)
+pages are read-only and can simply be discarded if they are not used (and
+reloaded if/when needed).  Data pages are also discarded if unmodified, and
+paged out if there's been any changes.  Allocated memory (malloc) is always
+saved to disk since there's no executable file to recover the data from.
+mmap() memory is variable..  If it's backed from a file, it uses the same
+rules as the data segment of a file - ie: either discarded if unmodified or
+paged out.
+<P>
+<P>There's also ``demand zeroing'' of pages as well that cause faults..  If you
+malloc memory and it calls brk()/sbrk() to allocate new pages, the chances
+are that you are allocated demand zero pages.  Ie: the pages are not
+``really'' attached to your process yet, but when you access them for the
+first time, the page fault causes the page to be connected to the process
+address space and zeroed - this saves unnecessary zeroing of pages that are
+allocated but never used.
+<P>
+<P>The ``page faults with physical IO'' comes from the OS via getrusage(). It's
+highly OS dependent on what it means.  Generally, it means that the process
+accessed a page that was not present in memory (for whatever reason) and
+there was disk access to fetch it.  Many OS's load executables by demand
+paging as well, so the act of starting squid implicitly causes page faults
+with disk IO - however, many (but not all) OS's use ``read ahead'' and
+``prefault'' heuristics to streamline the loading.  Some OS's maintain
+``intent queues'' so that pages can be selected as pageout candidates ahead
+of time.  When (say) squid touches a freshly allocated demand zero page and
+one is needed, the OS can page out one of the candidates on the spot,
+causing a 'fault with physical IO' with demand zeroing of allocated memory
+which doesn't happen on many other OS's.  (The other OS's generally put
+the process to sleep while the pageout daemon finds a page for it).
+<P>
+<P>The meaning of ``swapping'' varies.  On FreeBSD for example, swapping out is
+implemented as unlocking upages, kernel stack, PTD etc for aggressive
+pageout with the process.  The only thing left of the process in memory is
+the 'struct proc'.  The FreeBSD paging system is highly adaptive and can
+resort to paging in a way that is equivalent to the traditional swapping
+style operation (ie: entire process).  FreeBSD also tries stealing pages
+from active processes in order to make space for disk cache.  I suspect
+this is why setting 'memory_pools off' on the non-NOVM squids on FreeBSD is
+reported to work better - the VM/buffer system could be competing with
+squid to cache the same pages.  It's a pity that squid cannot use mmap() to
+do file IO on the 4K chunks in it's memory pool (I can see that this is not
+a simple thing to do though, but that won't stop me wishing. :-).
+<P>
+<P>by 
+<A HREF="mailto:webadm@info.cam.ac.uk">John Line</A><P>
+<P>The comments so far have been about what paging/swapping figures mean in
+a ``traditional'' context, but it's worth bearing in mind that on some systems
+(Sun's Solaris 2, at least), the virtual memory and filesystem handling are
+unified and what a user process sees as reading or writing a file, the system
+simply sees as paging something in from disk or a page being updated so it
+needs to be paged out. (I suppose you could view it as similar to the operating
+system memory-mapping the files behind-the-scenes.)
+<P>
+<P>The effect of this is that on Solaris 2, paging figures will also include file
+I/O. Or rather, the figures from vmstat certainly appear to include file I/O,
+and I presume (but can't quickly test) that figures such as those quoted by
+Squid will also include file I/O.
+<P>
+<P>To confirm the above (which represents an impression from what I've read and
+observed, rather than 100% certain facts...), using an otherwise idle Sun Ultra
+1 system system I just tried using cat (small, shouldn't need to page) to copy
+(a) one file to another, (b) a file to /dev/null, (c) /dev/zero to a file, and
+(d) /dev/zero to /dev/null (interrupting the last two with control-C after a
+while!), while watching with vmstat. 300-600 page-ins or page-outs per second
+when reading or writing a file (rather than a device), essentially zero in
+other cases (and when not cat-ing).
+<P>
+<P>So ... beware assuming that all systems are similar and that paging figures
+represent *only* program code and data being shuffled to/from disk - they
+may also include the work in reading/writing all those files you were
+accessing...
+<P>
+<H3>Ok, so what is unusually high?</H3>
+
+<P>You'll probably want to compare the number of page faults to the number of
+HTTP requests.  If this ratio is close to, or exceeding&nbsp;1, then
+Squid is paging too much.
+<P>
+<H2><A NAME="ss9.25">9.25 What does the IGNORED field mean in the 'cache server list'?</A>
+</H2>
+
+<P>This refers to ICP replies which Squid ignored, for one of these
+reasons:
+<UL>
+<LI>The URL in the reply could not be found in the cache at all.</LI>
+<LI>The URL in the reply was already being fetched.  Probably
+this ICP reply arrived too late.</LI>
+<LI>The URL in the reply did not have a MemObject associated with
+it.  Either the request is already finished, or the user aborted
+before the ICP arrived.</LI>
+<LI>The reply came from a multicast-responder, but the
+<EM>cache_peer_access</EM> configuration does not allow us to
+forward this request to that
+neighbor.</LI>
+<LI>Source-Echo replies from known neighbors are ignored.</LI>
+<LI>ICP_OP_DENIED replies are ignored after the first 100.</LI>
+</UL>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-10.html">Next</A>
+<A HREF="FAQ-8.html">Previous</A>
+<A HREF="FAQ.html#toc9">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-7.html
+++ squid-2.5.9/debian/doc/FAQ-7.html
@@ -0,0 +1,466 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Operational issues</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-8.html">Next</A>
+<A HREF="FAQ-6.html">Previous</A>
+<A HREF="FAQ.html#toc7">Contents</A>
+<HR>
+<H2><A NAME="s7">7. Operational issues</A></H2>
+
+<H2><A NAME="ss7.1">7.1 How do I see system level Squid statistics?</A>
+</H2>
+
+<P>The Squid distribution includes a CGI utility called <EM>cachemgr.cgi</EM>
+which can be used to view squid statistics with a web browser.
+This document has a section devoted to <EM>cachemgr.cgi</EM> usage
+which you should consult for more information.
+<P>
+<H2><A NAME="ss7.2">7.2 How can I find the biggest objects in my cache?</A>
+</H2>
+
+<P>
+<PRE>
+        sort -r -n +4 -5 access.log | awk '{print $5, $7}' | head -25
+</PRE>
+<P>
+<H2><A NAME="ss7.3">7.3 I want to restart Squid with a clean cache</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.2.</EM>
+<P>First of all, you must stop Squid of course.  You can use
+the command:
+<PRE>
+        % squid -k shutdown
+</PRE>
+<P>
+<P>The fastest way to restart with an entirely clean cache is
+to over write the <EM>swap.state</EM> files for each <EM>cache_dir</EM>
+in  your config file.  Note, you can not just remove the
+<EM>swap.state</EM> file, or truncate it to zero size.  Instead,
+you should put just one byte of garbage there.  For example:
+<PRE>
+        % echo "" > /cache1/swap.state
+</PRE>
+
+Repeat that for every <EM>cache_dir</EM>, then restart Squid.
+Be sure to leave the <EM>swap.state</EM> file with the same
+owner and permissions that it had before!
+<P>
+<P>Another way, which takes longer, is to have squid recreate all the
+<EM>cache_dir</EM> directories.  But first you must move the existing
+directories out of the way.  For example,  you can try this:
+<PRE>
+        % cd /cache1
+        % mkdir JUNK
+        % mv ?? swap.state* JUNK
+        % rm -rf JUNK &amp;
+</PRE>
+
+Repeat this for your other <EM>cache_dir</EM>'s, then tell Squid
+to create new directories:
+<PRE>
+        % squid -z
+</PRE>
+<P>
+<H2><A NAME="ss7.4">7.4 How can I proxy/cache Real Audio?</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:roever@nse.simac.nl">Rodney van den Oever</A>,
+and 
+<A HREF="mailto:jrg@blodwen.demon.co.uk">James R Grinter</A><P>
+<P>
+<UL>
+<LI>Point the RealPlayer at your Squid server's HTTP port (e.g. 3128).
+</LI>
+<LI>Using the Preferences->Transport tab, select <EM>Use specified transports</EM>
+and with the <EM>Specified Transports</EM> button, select use <EM>HTTP Only</EM>.</LI>
+</UL>
+<P>The RealPlayer (and RealPlayer Plus) manual states:
+<PRE>
+Use HTTP Only
+        Select this option if you are behind a firewall and cannot
+        receive data through TCP.  All data will be streamed through
+        HTTP.
+
+        Note:  You may not be able to receive some content if you select
+        this option.
+</PRE>
+<P>
+<P>Again, from the documentation:
+<PRE>
+RealPlayer 4.0 identifies itself to the firewall when making a
+request for content to a RealServer.  The following string is
+attached to any URL that the Player requests using HTTP GET:
+
+        /SmpDsBhgRl
+
+Thus, to identify an HTTP GET request from the RealPlayer, look
+for:
+
+        http://[^/]+/SmpDsBhgRl
+
+The Player can also be identified by the mime type in a POST to
+the RealServer.  The RealPlayer POST has the following mime
+type:
+
+        "application/x-pncmd"
+</PRE>
+<P>Note that the first request is a POST, and the second has a '?' in the URL, so
+standard Squid configurations would treat it as non-cachable. It also looks
+rather ``magic.''
+<P>
+<P>HTTP is an alternative delivery mechanism introduced with version 3 players,
+and it allows a reasonable approximation to ``streaming'' data - that is playing
+it as you receive it.  For more details, see their notes on
+<A HREF="http://www.real.com/products/encoder/realvideo/httpstream.html">HTTP Pseudo-Streaming</A>.
+<P>
+<P>It isn't available in the general case: only if someone has made the realaudio
+file available via an HTTP server, or they're using a version 4 server, they've
+switched it on, and you're using a version 4 client. If someone has made the
+file available via their HTTP server, then it'll be cachable. Otherwise, it
+won't be (as far as we can tell.)
+<P>
+<P>The more common RealAudio link connects via their own <EM>pnm:</EM> method and is
+transferred using their proprietary protocol (via TCP or UDP) and not using
+HTTP. It can't be cached nor proxied by Squid, and requires something such as
+the simple proxy that Progressive Networks themselves have made available, if
+you're in a firewall/no direct route situation. Their product does not cache
+(and I don't know of any software available that does.)
+<P>
+<P>Some confusion arises because there is also a configuration option to use an
+HTTP proxy (such as Squid) with the Realaudio/RealVideo players. This is
+because the players can fetch the ``<CODE>.ram</CODE>'' file that contains the <EM>pnm:</EM>
+reference for the audio/video stream. They fetch that .ram file from an HTTP
+server, using HTTP.
+<P>
+<H2><A NAME="purging-objects"></A> <A NAME="ss7.5">7.5 How can I purge an object from my cache?</A>
+</H2>
+
+<P>Squid does not allow
+you to purge objects unless it is configured with access controls
+in <EM>squid.conf</EM>.  First you must add something like
+<PRE>
+        acl PURGE method PURGE
+        acl localhost src 127.0.0.1
+        http_access allow PURGE localhost
+        http_access deny PURGE
+</PRE>
+
+The above only allows purge requests which come from the local host and
+denies all other purge requests.
+<P>
+<P>To purge an object, you can use the <EM>client</EM> program:
+<PRE>
+        client -m PURGE http://www.miscreant.com/
+</PRE>
+
+If the purge was successful, you will see a ``200 OK'' response:
+<PRE>
+        HTTP/1.0 200 OK
+        Date: Thu, 17 Jul 1997 16:03:32 GMT
+        Server: Squid/1.1.14
+</PRE>
+
+If the object was not found in the cache, you will see a ``404 Not Found''
+response:
+<PRE>
+        HTTP/1.0 404 Not Found
+        Date: Thu, 17 Jul 1997 16:03:22 GMT
+        Server: Squid/1.1.14
+</PRE>
+<P>
+<P>
+<P>
+<H2><A NAME="using-icmp"></A> <A NAME="ss7.6">7.6 Using ICMP to Measure the Network</A>
+</H2>
+
+<P>As of version 1.1.9, Squid is able to utilize ICMP Round-Trip-Time (RTT)
+measurements to select the optimal location to forward a cache miss.
+Previously, cache misses would be forwarded to the parent cache
+which returned the first ICP reply message.  These were logged
+with FIRST_PARENT_MISS in the access.log file.  Now we can
+select the parent which is closest (RTT-wise) to the origin
+server.
+<P>
+<H3>Supporting ICMP in your Squid cache</H3>
+
+<P>It is more important that your parent caches enable the ICMP
+features.  If you are acting as a parent, then you may want
+to enable ICMP on your cache.  Also, if your cache makes
+RTT measurements, it will fetch objects directly if your
+cache is closer than any of the parents.
+<P>
+<P>If you want your Squid cache to measure RTT's to origin servers,
+Squid must be compiled with the USE_ICMP option.  This is easily
+accomplished by uncommenting "-DUSE_ICMP=1" in <EM>src/Makefile</EM> and/or
+<EM>src/Makefile.in</EM>.
+<P>
+<P>An external program called <EM>pinger</EM> is responsible for sending and
+receiving ICMP packets.  It must run with root privileges.  After
+Squid has been compiled, the pinger program must be installed
+separately.  A special Makefile target will install <EM>pinger</EM> with
+appropriate permissions.
+<PRE>
+        % make install
+        % su
+        # make install-pinger
+</PRE>
+
+There are three configuration file options for tuning the
+measurement database on your cache.  <EM>netdb_low</EM> and <EM>netdb_high</EM>
+specify high and low water marks for keeping the database to a
+certain size  (e.g. just like with the IP cache).  The <EM>netdb_ttl</EM>
+option specifies the minimum rate for pinging a site.  If
+<EM>netdb_ttl</EM> is set to 300 seconds (5 minutes) then an ICMP packet
+will not be sent to the same site more than once every five
+minutes.  Note that a site is only pinged when an HTTP request for
+the site is received.
+<P>Another option, <EM>minimum_direct_hops</EM> can be used to try finding
+servers which are close to your cache.  If the measured hop count
+to the origin server is less than or equal to <EM>minimum_direct_hops</EM>,
+the request will be forwarded directly to the origin server.
+<P>
+<H3>Utilizing your parents database</H3>
+
+<P>Your parent caches can be asked to include the RTT measurements
+in their ICP replies.  To do this, you must enable <EM>query_icmp</EM>
+in your config file:
+<PRE>
+        query_icmp on
+</PRE>
+
+This causes a flag to be set in your outgoing ICP queries.
+<P>If your parent caches return ICMP RTT measurements then
+the eighth column of your access.log will have lines
+similar to:
+<PRE>
+        CLOSEST_PARENT_MISS/it.cache.nlanr.net
+</PRE>
+
+In this case, it means that <EM>it.cache.nlanr.net</EM> returned
+the lowest RTT to the origin server.  If your cache measured
+a lower RTT than any of the parents, the request will
+be logged with
+<PRE>
+        CLOSEST_DIRECT/www.sample.com
+</PRE>
+<P>
+<H3>Inspecting the database</H3>
+
+<P>The measurement database can be viewed from the cachemgr by
+selecting "Network Probe Database."  Hostnames are aggregated
+into /24 networks.  All measurements made are averaged over
+time.  Measurements are made to specific hosts, taken from
+the URLs of HTTP requests.  The recv and sent fields are the
+number of ICMP packets sent and received.  At this time they
+are only informational.
+<P>A typical database entry looks something like this:
+<PRE>
+    Network          recv/sent     RTT  Hops Hostnames
+    192.41.10.0        20/  21    82.3   6.0 www.jisedu.org www.dozo.com
+        bo.cache.nlanr.net        42.0   7.0
+        uc.cache.nlanr.net        48.0  10.0
+        pb.cache.nlanr.net        55.0  10.0
+        it.cache.nlanr.net       185.0  13.0
+</PRE>
+
+This means we have sent 21 pings to both www.jisedu.org and
+www.dozo.com.  The average RTT is 82.3 milliseconds.  The
+next four lines show the measured values from our parent
+caches.  Since <EM>bo.cache.nlanr.net</EM> has the lowest RTT,
+it would be selected as the location to forward a request
+for a www.jisedu.org or www.dozo.com URL.
+<P>
+<H2><A NAME="ss7.7">7.7 Why are so few requests logged as TCP_IMS_MISS?</A>
+</H2>
+
+<P>When Squid receives an <EM>If-Modified-Since</EM> request, it will
+not forward the request unless the object needs to be refreshed
+according to the <EM>refresh_pattern</EM> rules.  If the request
+does need to be refreshed, then it will be logged as TCP_REFRESH_HIT
+or TCP_REFRESH_MISS.
+<P>
+<P>If the request is not forwarded, Squid replies to the IMS request
+according to the object in its cache.  If the modification times are the
+same, then Squid returns TCP_IMS_HIT.  If the modification times are
+different, then Squid returns TCP_IMS_MISS.  In most cases, the cached
+object will not have changed, so the result is TCP_IMS_HIT.  Squid will
+only return TCP_IMS_MISS if some other client causes a newer version of
+the object to be pulled into the cache.
+<P>
+<H2><A NAME="ss7.8">7.8 How can I make Squid NOT cache some servers or URLs?</A>
+</H2>
+
+<P>In Squid-2, you use the <EM>no_cache</EM> option to specify uncachable
+requests.  For example, this makes all responses from origin servers
+in the 10.0.1.0/24 network uncachable:
+<PRE>
+        acl Local dst 10.0.1.0/24
+        no_cache deny Local
+</PRE>
+<P>
+<P>This example makes all URL's with '.html' uncachable:
+<PRE>
+        acl HTML url_regex .html$
+        no_cache deny HTML
+</PRE>
+<P>
+<P>This example makes  a specific URL uncachable:
+<PRE>
+        acl XYZZY url_regex ^http://www.i.suck.com/foo.html$
+        no_cache deny XYZZY
+</PRE>
+<P>
+<P>This example caches nothing between the hours of 8AM to 11AM:
+<PRE>
+        acl Morning time 08:00-11:00
+        no_cache deny Morning
+</PRE>
+<P>
+<P>In Squid-1.1,
+whether or not an object gets cached is controlled by the
+<EM>cache_stoplist</EM>, and <EM>cache_stoplist_pattern</EM> options.  So, you may add:
+<PRE>
+        cache_stoplist my.domain.com
+</PRE>
+
+Specifying uncachable objects by IP address is harder.  The 
+<A HREF="../1.1/patches.html">1.1 patch page</A> includes a patch called <EM>no-cache-local.patch</EM> which
+changes the behaviour of the <EM>local_ip</EM> and <EM>local_domain</EM> so
+that matching requests are NOT CACHED, in addition to being fetched directly.
+<P>
+<H2><A NAME="ss7.9">7.9 How can I delete and recreate a cache directory?</A>
+</H2>
+
+<P>Deleting an existing cache directory is not too difficult.  Unfortunately,
+you can't simply change squid.conf and then reconfigure.  You can't
+stop using a <EM>cache_dir</EM> while Squid is running.  Also note
+that Squid requires at least one <EM>cache_dir</EM> to run.
+<P>
+<OL>
+<LI>Edit your <EM>squid.conf</EM> file and comment out, or delete
+the <EM>cache_dir</EM> line for the cache directory that you want to
+remove.</LI>
+<LI>If you don't have any <EM>cache_dir</EM> lines in your squid.conf,
+then Squid was using the default.   You'll need to add a new
+<EM>cache_dir</EM> line because Squid will continue to use
+the default otherwise.  You can add a small, temporary directory, fo
+example:
+<PRE>
+/usr/local/squid/cachetmp ....
+</PRE>
+
+If you add a new <EM>cache_dir</EM> you have to run <EM>squid -z</EM>
+to initialize that directory.
+</LI>
+<LI>Remeber that
+you can not delete a cache directory from a running Squid process;
+you can not simply reconfigure squid.  You must
+shutdown Squid:
+<PRE>
+        squid -k shutdown
+</PRE>
+</LI>
+<LI>Once Squid exits, you may immediately start it up again.  Since  you
+deleted the old <EM>cache_dir</EM> from squid.conf, Squid won't
+try to access that directory.
+If you
+use the RunCache script, Squid should start up again automatically.</LI>
+<LI>Now Squid is no longer using the cache directory that you removed
+from the config file.  You can verify this by checking "Store Directory"
+information with the cache manager.  From the command line, type:
+<PRE>
+        client mgr:storedir
+</PRE>
+
+</LI>
+<LI>Now that Squid is not using the cache directory, you can <EM>rm -rf</EM> it,
+format the disk, build a new filesystem, or whatever.
+</LI>
+</OL>
+<P>
+<P>The procedure is similar to recreate the directory.
+<OL>
+<LI>Edit <EM>squid.conf</EM> and add a new <EM>cache_dir</EM> line.</LI>
+<LI>Initialize the new directory by running
+<PRE>
+        % squid -z
+</PRE>
+
+NOTE: it is safe to run this even if Squid is already running.  <EM>squid -z</EM>
+will harmlessly try to create all of the subdirectories that already exist.</LI>
+<LI>Reconfigure Squid
+<PRE>
+        squid -k reconfigure
+</PRE>
+
+Unlike deleting, you can add new cache directories while Squid is
+already running.</LI>
+</OL>
+<P>
+<H2><A NAME="ss7.10">7.10 Why can't I run Squid as root?</A>
+</H2>
+
+<P>by Dave J Woolley
+<P>If someone were to discover a buffer overrun bug in Squid and it runs as
+a user other than root, they can only corrupt the files writeable to
+that user, but if it runs a root, they can take over the whole machine.
+This applies to all programs that don't absolutely need root status, not
+just squid.
+<P>
+<H2><A NAME="ss7.11">7.11 Can you tell me a good way to upgrade Squid with minimal downtime?</A>
+</H2>
+
+<P>Here is a technique that was described by 
+<A HREF="mailto:radu@netsoft.ro">Radu Greab</A>.
+<P>Start a second Squid server on an unused HTTP port (say 4128).  This
+instance of Squid probably doesn't need a large disk cache.  When this
+second server has finished reloading the disk store, swap the
+<EM>http_port</EM> values in the two <EM>squid.conf</EM> files.  Set the
+original Squid to use port 5128, and the second one to use 3128.  Next,
+run ``squid -k reconfigure'' for both Squids.  New requests will go to
+the second Squid, now on port 3128 and the first Squid will finish
+handling its current requests.  After a few minutes, it should be safe
+to fully shut down the first Squid and upgrade it.  Later you can simply
+repeat this process in reverse.
+<P>
+<H2><A NAME="ss7.12">7.12 Can Squid listen on more than one HTTP port?</A>
+</H2>
+
+<P><EM>Note: The information here is current for version 2.3.</EM>
+<P>Yes, you can specify multiple <EM>http_port</EM> lines in your <EM>squid.conf</EM>
+file.   Squid attempts to bind() to each port that you specify.  Sometimes
+Squid may not be able to bind to a port, either because of permissions
+or because the port is already in use.  If Squid can bind to at least
+one port, then it will continue running.  If it can not bind to
+any of the ports, then Squid stops.
+<P>
+<P>With version 2.3 and later you can specify IP addresses
+and port numbers together (see the squid.conf comments).
+<P>
+<H2><A NAME="ss7.13">7.13 Can I make origin servers see the client's IP address when going through Squid?</A>
+</H2>
+
+<P>Normally you cannot.  Most TCP/IP stacks do not allow applications to
+create sockets with the local endpoint assigned to a foreign IP address.
+However, some folks have some 
+<A HREF="http://www.balabit.hu/en/downloads/tproxy/">patches to Linux</A> that allow exactly that.
+<P>
+<P>In this situation, you must ensure that all HTTP packets destined for
+the client IP addresses are routed to the Squid box.  If the packets
+take another path, the real clients will send TCP resets to the
+origin servers, thereby breaking the connections.
+<P>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-8.html">Next</A>
+<A HREF="FAQ-6.html">Previous</A>
+<A HREF="FAQ.html#toc7">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-8.html
+++ squid-2.5.9/debian/doc/FAQ-8.html
@@ -0,0 +1,520 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: Memory</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-9.html">Next</A>
+<A HREF="FAQ-7.html">Previous</A>
+<A HREF="FAQ.html#toc8">Contents</A>
+<HR>
+<H2><A NAME="memorye"></A> <A NAME="s8">8. Memory</A></H2>
+
+<H2><A NAME="ss8.1">8.1 Why does Squid use so much memory!?</A>
+</H2>
+
+<P>Squid uses a lot of memory for performance reasons.  It takes much, much
+longer to read something from disk than it does to read directly from
+memory.
+<P>
+<P>A small amount of metadata for each cached object is kept in memory.
+This is the <EM>StoreEntry</EM> data structure.  For <EM>Squid-2</EM> this is
+56-bytes on "small" pointer architectures (Intel, Sparc, MIPS, etc) and
+88-bytes on "large" pointer architectures (Alpha).  In addition, There
+is a 16-byte cache key (MD5 checksum) associated with each
+<EM>StoreEntry</EM>.  This means there are 72 or 104 bytes of metadata in
+memory for every object in your cache.  A cache with 1,000,000
+objects therefore requires 72&nbsp;MB of memory for <EM>metadata only</EM>.
+In practice it requires much more than that.
+<P>
+<P>Squid-1.1 also uses a lot of memory to store in-transit objects.
+This version stores incoming objects only in memory, until the transfer
+is complete.  At that point it decides whether or not to store the object
+on disk.  This means that when users download large files, your memory
+usage will increase significantly.  The squid.conf parameter <EM>maximum_object_size</EM>
+determines how much memory an in-transit object can consume before we
+mark it as uncachable.  When an object is marked uncachable, there is no
+need to keep all of the object in memory, so the memory is freed for
+the part of the object which has already been written to the client.
+In other words, lowering <EM>maximum_object_size</EM> also lowers Squid-1.1
+memory usage.
+<P>
+<P>Other uses of memory by Squid include:
+<UL>
+<LI>Disk buffers for reading and writing</LI>
+<LI>Network I/O buffers</LI>
+<LI>IP Cache contents</LI>
+<LI>FQDN Cache contents</LI>
+<LI>Netdb ICMP measurement database</LI>
+<LI>Per-request state information, including full request and
+reply headers</LI>
+<LI>Miscellaneous statistics collection.</LI>
+<LI>``Hot objects'' which are kept entirely in memory.</LI>
+</UL>
+<P>
+<H2><A NAME="ss8.2">8.2 How can I tell how much memory my Squid process is using?</A>
+</H2>
+
+<P>One way is to simply look at <EM>ps</EM> output on your system.
+For BSD-ish systems, you probably want to use the <EM>-u</EM> option
+and look at the <EM>VSZ</EM> and <EM>RSS</EM> fields:
+<PRE>
+    wessels ~ 236% ps -axuhm
+    USER       PID %CPU %MEM   VSZ  RSS  TT  STAT STARTED       TIME COMMAND
+    squid     9631  4.6 26.4 141204 137852  ??  S    10:13PM   78:22.80 squid -NCYs
+</PRE>
+
+For SYSV-ish, you probably want to use the <EM>-l</EM> option.
+When interpreting the <EM>ps</EM> output, be sure to check your <EM>ps</EM>
+manual page.  It may not be obvious if the reported numbers are kbytes,
+or pages (usually 4 kb).
+<P>
+<P>A nicer way to check the memory usage is with a program called
+<EM>top</EM>:
+<PRE>
+            last pid: 20128;  load averages:  0.06,  0.12,  0.11                   14:10:58
+    46 processes:  1 running, 45 sleeping
+    CPU states:     % user,     % nice,     % system,     % interrupt,     % idle
+    Mem: 187M Active, 1884K Inact, 45M Wired, 268M Cache, 8351K Buf, 1296K Free
+    Swap: 1024M Total, 256K Used, 1024M Free
+
+      PID USERNAME PRI NICE SIZE    RES STATE    TIME   WCPU    CPU COMMAND
+     9631 squid     2   0   138M   135M select  78:45  3.93%  3.93% squid
+</PRE>
+<P>
+<P>Finally, you can ask the Squid process to report its own memory
+usage.  This is available on the Cache Manager <EM>info</EM> page.
+Your output may vary depending upon your operating system and
+Squid version, but it looks similar to this:
+<PRE>
+    Resource usage for squid:
+            Maximum Resident Size: 137892 KB
+    Memory usage for squid via mstats():
+            Total space in arena:  140144 KB
+            Total free:              8153 KB 6%
+</PRE>
+<P>
+<P>If your RSS (Resident Set Size) value is much lower than your
+process size, then your cache performance is most likely suffering
+due to 
+<A HREF="FAQ-9.html#paging">paging</A>.
+<P>
+<P>
+<H2><A NAME="ss8.3">8.3 My Squid process grows without bounds.</A>
+</H2>
+
+<P>You might just have your <EM>cache_mem</EM> parameter set too high.
+See the ``
+<A HREF="#lower-mem-usage">What can I do to reduce Squid's memory usage?</A>''
+entry below.
+<P>
+<P>When a process continually grows in size, without levelling off
+or slowing down, it often indicates a memory leak.  A memory leak
+is when some chunk of memory is used, but not free'd when it is
+done being used.
+<P>
+<P>Memory leaks are a real problem for programs (like Squid) which do all
+of their processing within a single process.  Historically, Squid has
+had real memory leak problems.  But as the software has matured, we
+believe almost all of Squid's memory leaks have been eliminated, and
+new ones are least easy to identify.
+<P>
+<P>Memory leaks may also be present in your system's libraries, such
+as <EM>libc.a</EM> or even <EM>libmalloc.a</EM>.  If you experience the ever-growing
+process size phenomenon, we suggest you first try an
+<A HREF="#alternate-malloc">alternative malloc library</A>.
+<P>
+<H2><A NAME="ss8.4">8.4 I set <EM>cache_mem</EM> to XX, but the process grows beyond that!</A>
+</H2>
+
+<P>The <EM>cache_mem</EM> parameter <B>does NOT</B> specify the maximum
+size of the process.  It only specifies how much memory to use
+for caching ``hot'' (very popular) replies.   Squid's actual memory
+usage is depends very strongly on your cache size (disk space) and
+your incoming request load.  Reducing <EM>cache_mem</EM> will usually
+also reduce the process size, but not necessarily, and there are
+other ways to reduce Squid's memory usage (see below).
+<P>
+<P>See also 
+<A HREF="#how-much-ram">How much memory do I need in my Squid server?</A>.
+<P>
+<P>
+<H2><A NAME="analyze-memory-usage"></A> <A NAME="ss8.5">8.5 How do I analyze memory usage from the cache manger output?</A>
+</H2>
+
+<P>
+<P><I>Note: This information is specific to Squid-1.1 versions</I>
+<P>
+<P>Look at your <EM>cachemgr.cgi</EM> <CODE>Cache
+Information</CODE> page.  For example:
+<PRE>
+        Memory usage for squid via mallinfo():
+               Total space in arena:   94687 KB
+               Ordinary blocks:        32019 KB 210034 blks
+               Small blocks:           44364 KB 569500 blks
+               Holding blocks:             0 KB   5695 blks
+               Free Small blocks:       6650 KB
+               Free Ordinary blocks:   11652 KB
+               Total in use:           76384 KB 81%
+               Total free:             18302 KB 19%
+
+        Meta Data:
+        StoreEntry                246043 x 64 bytes =  15377 KB
+        IPCacheEntry              971 x   88 bytes  =     83 KB
+        Hash link                 2 x   24 bytes    =      0 KB
+        URL strings                                 =  11422 KB
+        Pool MemObject structures 514 x  144 bytes  =     72 KB (    70 free)
+        Pool for Request structur 516 x 4380 bytes  =   2207 KB (  2121 free)
+        Pool for in-memory object 6200 x 4096 bytes =  24800 KB ( 22888 free)
+        Pool for disk I/O         242 x 8192 bytes =   1936 KB (  1888 free)
+        Miscellaneous                              =   2600 KB
+        total Accounted                            =  58499 KB
+</PRE>
+<P>
+<P>First note that <CODE>mallinfo()</CODE> reports 94M in ``arena.''  This
+is pretty close to what <EM>top</EM> says (97M).
+<P>
+<P>Of that 94M, 81% (76M) is actually being used at the moment.  The
+rest has been freed, or pre-allocated by <CODE>malloc(3)</CODE>
+and not yet used.
+<P>
+<P>Of the 76M in use, we can account for 58.5M (76%).  There are some
+calls to <CODE>malloc(3)</CODE> for which we can't account.
+<P>
+<P>The <CODE>Meta Data</CODE> list gives the breakdown of where the
+accounted memory has gone.  45% has gone to <CODE>StoreEntry</CODE>
+and URL strings.  Another 42% has gone to buffering hold objects
+in VM while they are fetched and relayed to the clients (<CODE>Pool
+for in-memory object</CODE>).
+<P>
+<P>The pool sizes are specified by <EM>squid.conf</EM> parameters.
+In version 1.0, these pools are somewhat broken:  we keep a stack
+of unused pages instead of freeing the block.  In the <CODE>Pool
+for in-memory object</CODE>, the unused stack size is 1/2 of
+<CODE>cache_mem</CODE>.  The <CODE>Pool for disk I/O</CODE> is
+hardcoded at 200.  For <CODE>MemObject</CODE> and <CODE>Request</CODE>
+it's 1/8 of your system's <CODE>FD_SETSIZE</CODE> value.
+<P>
+<P>If you need to lower your process size, we recommend lowering the
+max object sizes in the 'http', 'ftp' and 'gopher' config lines.
+You may also want to lower <CODE>cache_mem</CODE> to suit your
+needs. But if you <CODE>make cache_mem</CODE> too low, then some
+objects may not get saved to disk during high-load periods.  Newer
+Squid versions allow you to set <CODE>memory_pools off</CODE> to
+disable the free memory pools.
+<P>
+<H2><A NAME="ss8.6">8.6 The ``Total memory accounted'' value is less than the size of my Squid process.</A>
+</H2>
+
+<P>We are not able to account for <EM>all</EM> memory that Squid uses.  This
+would require excessive amounts of code to keep track of every last byte.
+We do our best to account for the major uses of memory.
+<P>
+<P>Also, note that the <EM>malloc</EM> and <EM>free</EM> functions have
+their own overhead.  Some additional memory is required to keep
+track of which chunks are in use, and which are free.  Additionally,
+most operating systems do not allow processes to shrink in size.
+When a process gives up memory by calling <EM>free</EM>, the total
+process size does not shrink.  So the process size really
+represents the maximum size your Squid process has reached.
+<P>
+<P>
+<H2><A NAME="malloc-death"></A> <A NAME="ss8.7">8.7 xmalloc: Unable to allocate 4096 bytes!</A>
+</H2>
+
+<P>by 
+<A HREF="mailto:hno@squid-cache.org">Henrik Nordstrom</A><P>
+<P>Messages like "FATAL: xcalloc: Unable to allocate 4096 blocks of 1 bytes!"
+appear when Squid can't allocate more memory, and on most operating systems
+(inclusive BSD) there are only two possible reasons:
+<OL>
+<LI>The machine is out of swap</LI>
+<LI>The process' maximum data segment size has been reached</LI>
+</OL>
+
+The first case is detected using the normal swap monitoring tools
+available on the platform (<EM>pstat</EM> on SunOS, perhaps <EM>pstat</EM> is
+used on BSD as well).
+<P>To tell if it is the second case, first rule out the first case and then
+monitor the size of the Squid process. If it dies at a certain size with
+plenty of swap left then the max data segment size is reached without no
+doubts.
+<P>The data segment size can be limited by two factors:
+<OL>
+<LI>Kernel imposed maximum, which no user can go above</LI>
+<LI>The size set with ulimit, which the user can control.</LI>
+</OL>
+<P>When squid starts it sets data and file ulimit's to the hard level. If
+you manually tune ulimit before starting Squid make sure that you set
+the hard limit and not only the soft limit (the default operation of
+ulimit is to only change the soft limit). root is allowed to raise the
+soft limit above the hard limit.
+<P>This command prints the hard limits:
+<PRE>
+        ulimit -aH
+</PRE>
+<P>This command sets the data size to unlimited:
+<PRE>
+        ulimit -HSd unlimited
+</PRE>
+<P>
+<P>
+<H3>BSD/OS</H3>
+
+<P>by 
+<A HREF="mailto:Arjan.deVet@adv.IAEhv.nl">Arjan de Vet</A><P>The default kernel limit on BSD/OS for datasize is 64MB (at least on 3.0
+which I'm using).
+<P>
+<P>Recompile a kernel with larger datasize settings:
+<P>
+<PRE>
+        maxusers        128
+        # Support for large inpcb hash tables, e.g. busy WEB servers.
+        options         INET_SERVER
+        # support for large routing tables, e.g. gated with full Internet routing:
+        options         "KMEMSIZE=\(16*1024*1024\)"
+        options         "DFLDSIZ=\(128*1024*1024\)"
+        options         "DFLSSIZ=\(8*1024*1024\)"
+        options         "SOMAXCONN=128"
+        options         "MAXDSIZ=\(256*1024*1024\)"
+</PRE>
+<P>See <EM>/usr/share/doc/bsdi/config.n</EM> for more info.
+<P>
+<P>In /etc/login.conf I have this:
+<P>
+<PRE>
+        default:\
+                :path=/bin /usr/bin /usr/contrib/bin:\
+                :datasize-cur=256M:\
+                :openfiles-cur=1024:\
+                :openfiles-max=1024:\
+                :maxproc-cur=1024:\
+                :stacksize-cur=64M:\
+                :radius-challenge-styles=activ,crypto,skey,snk,token:\
+                :tc=auth-bsdi-defaults:\
+                :tc=auth-ftp-bsdi-defaults:
+
+        #
+        # Settings used by /etc/rc and root
+        # This must be set properly for daemons started as root by inetd as well.
+        # Be sure reset these values back to system defaults in the default class!
+        #
+        daemon:\
+                :path=/bin /usr/bin /sbin /usr/sbin:\
+                :widepasswords:\
+                :tc=default:
+        #       :datasize-cur=128M:\
+        #       :openfiles-cur=256:\
+        #       :maxproc-cur=256:\
+</PRE>
+<P>
+<P>This should give enough space for a 256MB squid process.
+<P>
+<H3>FreeBSD (2.2.X)</H3>
+
+<P>by Duane Wessels
+<P>The procedure is almost identical to that for BSD/OS above.
+Increase the open filedescriptor limit in <EM>/sys/conf/param.c</EM>:
+<PRE>
+        int     maxfiles = 4096;
+        int     maxfilesperproc = 1024;
+</PRE>
+
+Increase the maximum and default data segment size in your kernel
+config file, e.g. <EM>/sys/conf/i386/CONFIG</EM>:
+<PRE>
+        options         "MAXDSIZ=(512*1024*1024)"
+        options         "DFLDSIZ=(128*1024*1024)"
+</PRE>
+
+We also found it necessary to increase the number of mbuf clusters:
+<PRE>
+        options         "NMBCLUSTERS=10240"
+</PRE>
+
+And, if you have more than 256 MB of physical memory, you probably
+have to disable BOUNCE_BUFFERS (whatever that is), so comment
+out this line:
+<PRE>
+        #options        BOUNCE_BUFFERS          #include support for DMA bounce buffers
+</PRE>
+<P>
+<P>Also, update limits in <EM>/etc/login.conf</EM>:
+<PRE>
+        # Settings used by /etc/rc
+        #
+        daemon:\
+                :coredumpsize=infinity:\
+                :datasize=infinity:\
+                :maxproc=256:\
+                :maxproc-cur@:\
+                :memoryuse-cur=64M:\
+                :memorylocked-cur=64M:\
+                :openfiles=4096:\
+                :openfiles-cur@:\
+                :stacksize=64M:\
+                :tc=default:
+</PRE>
+
+And don't forget to run ``cap_mkdb /etc/login.conf'' after editing that file.
+<P>
+<P>
+<H3>OSF, Digital Unix</H3>
+
+<P>by 
+<A HREF="mailto:ongbh@zpoprp.zpo.dec.com">Ong Beng Hui</A><P>To increase the data size for Digital UNIX, edit the file <CODE>/etc/sysconfigtab</CODE>
+and add the entry...
+<PRE>
+        proc:
+                per-proc-data-size=1073741824
+</PRE>
+
+Or, with csh, use the limit command, such as
+<PRE>
+        &gt; limit datasize 1024M
+</PRE>
+<P>
+<P>Editing <CODE>/etc/sysconfigtab</CODE> requires a reboot, but the limit command
+doesn't.
+<P>
+<H2><A NAME="ss8.8">8.8 fork: (12) Cannot allocate memory</A>
+</H2>
+
+<P>When Squid is reconfigured (SIGHUP) or the logs are rotated (SIGUSR1),
+some of the helper processes (dnsserver) must be killed and
+restarted.  If your system does not have enough virtual memory,
+the Squid process may not be able to fork to start the new helper
+processes.
+The best way to fix this is to increase your virtual memory by adding
+swap space.  Normally your system uses raw disk partitions for swap
+space, but most operating systems also support swapping on regular
+files (Digital Unix excepted).  See your system manual pages for
+<EM>swap</EM>, <EM>swapon</EM>, and <EM>mkfile</EM>.
+<P>
+<H2><A NAME="lower-mem-usage"></A> <A NAME="ss8.9">8.9 What can I do to reduce Squid's memory usage?</A>
+</H2>
+
+<P>If your cache performance is suffering because of memory limitations,
+you might consider buying more memory.  But if that is not an option,
+There are a number of things to try:
+<UL>
+<LI>Try a 
+<A HREF="#alternate-malloc">different malloc library</A>.</LI>
+<LI>Reduce the <EM>cache_mem</EM> parameter in the config file.  This controls
+how many ``hot'' objects are kept in memory.  Reducing this parameter
+will not significantly affect performance, but you may recieve
+some warnings in <EM>cache.log</EM> if your cache is busy.</LI>
+<LI>Turn the <EM>memory_pools off</EM> in the config file.  This causes
+Squid to give up unused memory by calling <EM>free()</EM> instead of
+holding on to the chunk for potential, future use.</LI>
+<LI>Reduce the <EM>cache_swap</EM> parameter in your config file.  This will
+reduce the number of objects Squid keeps.  Your overall hit ratio may go down a
+little, but your cache will perform significantly better.</LI>
+<LI>Reduce the <EM>maximum_object_size</EM> parameter (Squid-1.1 only).
+You won't be able to
+cache the larger objects, and your byte volume hit ratio may go down,
+but Squid will perform better overall.</LI>
+<LI>If you are using Squid-1.1.x, try the ``NOVM'' version.</LI>
+</UL>
+<P>
+<H2><A NAME="alternate-malloc"></A> <A NAME="ss8.10">8.10 Using an alternate <EM>malloc</EM> library.</A>
+</H2>
+
+<P>Many users have found improved performance and memory utilization when
+linking Squid with an external malloc library.  We recommend either
+GNU malloc, or dlmalloc.
+<P>
+<H3>Using GNU malloc</H3>
+
+<P>To make Squid use GNU malloc follow these simple steps:
+<P>
+<OL>
+<LI>Download the GNU malloc source, available from one of
+<A HREF="http://www.gnu.org/order/ftp.html">The GNU FTP Mirror sites</A>.</LI>
+<LI>Compile GNU malloc
+<PRE>
+        % gzip -dc malloc.tar.gz | tar xf -
+        % cd malloc
+        % vi Makefile     # edit as needed
+        % make
+</PRE>
+</LI>
+<LI>Copy libmalloc.a to your system's library directory and be sure to
+name it <EM>libgnumalloc.a</EM>.
+<PRE>
+        % su
+        # cp malloc.a /usr/lib/libgnumalloc.a
+</PRE>
+</LI>
+<LI>(Optional) Copy the GNU malloc.h to your system's include directory and
+be sure to name it <EM>gnumalloc.h</EM>.  This step is not required, but if
+you do this, then Squid will be able to use the <EM>mstat()</EM> function to
+report memory usage statistics on the cachemgr info page.
+<PRE>
+        # cp malloc.h /usr/include/gnumalloc.h
+</PRE>
+</LI>
+<LI>Reconfigure and recompile Squid
+<PRE>
+        % make realclean
+        % ./configure ...
+        % make
+        % make install
+</PRE>
+
+Note, In later distributions, 'realclean' has been changed to 'distclean'.
+As the configure script runs, watch its output.  You should find that
+it locates libgnumalloc.a and optionally gnumalloc.h.</LI>
+</OL>
+<P>
+<H3>dlmalloc</H3>
+
+<P>
+<A HREF="http://g.oswego.edu/dl/html/malloc.html">dlmalloc</A>
+has been written by 
+<A HREF="mailto:dl@cs.oswego.edu">Doug Lea</A>.  According to Doug:
+<BLOCKQUOTE>
+This is not the fastest, most space-conserving, most portable, or
+most tunable malloc ever written. However it is among the fastest
+while also being among the most space-conserving, portable and tunable.
+</BLOCKQUOTE>
+<P>
+<P>dlmalloc is included with the <EM>Squid-2</EM> source distribution.
+To use this library, you simply give an option to the <EM>configure</EM>
+script:
+<PRE>
+        % ./configure --enable-dlmalloc ...
+</PRE>
+<P>
+<H2><A NAME="how-much-ram"></A> <A NAME="ss8.11">8.11 How much memory do I need in my Squid server?</A>
+</H2>
+
+<P>As a rule of thumb on Squid uses approximately 10 MB of RAM per GB of the
+total of all cache_dirs (more on 64 bit servers such as Alpha), plus your
+cache_mem setting and about an additional 10-20MB. It is recommended to
+have at least twice this amount of physical RAM available on your Squid
+server. For a more detailed discussion on Squid's memory usage see the
+sections above.
+<P>
+<P>The recommended extra RAM besides what is used by Squid is used by the
+operating system to improve disk I/O performance and by other applications or
+services running on the server. This will be true even of a server which
+runs Squid as the only tcp service, since there is a minimum level of
+memory needed for process management, logging, and other OS level
+routines.
+<P>
+<P>If you have a low memory server, and a large disk, then you will not
+necessarily be able to use all the disk space, since as the cache fills
+the memory available will be insufficient, forcing Squid to swap out
+memory and affecting performance. A very large cache_dir total and
+insufficient physical RAM + Swap could cause Squid to stop functioning
+completely. The solution for larger caches is to get more physical RAM;
+allocating more to Squid via cache_mem will not help.
+<P>
+<P>
+<HR>
+<A HREF="FAQ-9.html">Next</A>
+<A HREF="FAQ-7.html">Previous</A>
+<A HREF="FAQ.html#toc8">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/doc/FAQ-9.html
+++ squid-2.5.9/debian/doc/FAQ-9.html
@@ -0,0 +1,568 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Draft//EN">
+<HTML>
+<HEAD>
+<TITLE>SQUID Frequently Asked Questions: The Cache Manager</TITLE>
+</HEAD>
+<BODY>
+<A HREF="FAQ-10.html">Next</A>
+<A HREF="FAQ-8.html">Previous</A>
+<A HREF="FAQ.html#toc9">Contents</A>
+<HR>
+<H2><A NAME="cachemgr-section"></A> <A NAME="s9">9. The Cache Manager</A></H2>
+
+<P>by 
+<A HREF="mailto:JLarmour@origin-at.co.uk">Jonathan Larmour</A><P>
+<H2><A NAME="ss9.1">9.1 What is the cache manager?</A>
+</H2>
+
+<P>The cache manager (<EM>cachemgr.cgi</EM>) is a CGI utility for
+displaying statistics about the <EM>squid</EM> process as it runs.
+The cache manager is a convenient way to manage the cache and view
+statistics without logging into the server.
+<P>
+<H2><A NAME="ss9.2">9.2 How do you set it up?</A>
+</H2>
+
+<P>That depends on which web server you're using.  Below you will
+find instructions for configuring the CERN and Apache servers
+to permit <EM>cachemgr.cgi</EM> usage.
+<P><EM>EDITOR&quot;S NOTE: readers are encouraged to submit instructions
+for configuration of cachemgr.cgi on other web server platforms, such
+as Netscape.</EM>
+<P>
+<P>After you edit the server configuration files, you will probably
+need to either restart your web server or or send it a <CODE>SIGHUP</CODE> signal
+to tell it to re-read its configuration files.
+<P>
+<P>When you're done configuring your web server, you'll connect to
+the cache manager with a web browser, using a URL such as:
+<PRE>
+        http://www.example.com/Squid/cgi-bin/cachemgr.cgi/
+</PRE>
+<P>
+<H2><A NAME="ss9.3">9.3 Cache manager configuration for CERN httpd 3.0</A>
+</H2>
+
+<P>First, you should ensure that only specified workstations can access
+the cache manager.  That is done in your CERN <EM>httpd.conf</EM>, not in
+<EM>squid.conf</EM>.
+<P>
+<PRE>
+        Protection MGR-PROT {
+                 Mask    @(workstation.example.com)
+        }
+</PRE>
+<P>Wildcards are acceptable, IP addresses are acceptable, and others
+can be added with a comma-separated list of IP addresses. There
+are many more ways of protection.  Your server documentation has
+details.
+<P>
+<P>You also need to add:
+<PRE>
+        Protect         /Squid/*        MGR-PROT
+        Exec            /Squid/cgi-bin/*.cgi    /usr/local/squid/bin/*.cgi
+</PRE>
+
+This marks the script as executable to those in <CODE>MGR-PROT</CODE>.
+<P>
+<H2><A NAME="ss9.4">9.4 Cache manager configuration for Apache</A>
+</H2>
+
+<P>First, make sure the cgi-bin directory you're using is listed with a
+<CODE>ScriptAlias</CODE> in your Apache <EM>httpd.conf</EM> file like this:
+<PRE>
+        ScriptAlias /Squid/cgi-bin/ /usr/local/squid/cgi-bin/
+</PRE>
+
+It's probably a <B>bad</B> idea to <CODE>ScriptAlias</CODE>
+the entire <EM></EM>usr/local/squid/bin/ directory where all the
+Squid executables live.
+<P>Next, you should ensure that only specified workstations can access
+the cache manager.  That is done in your Apache <EM>httpd.conf</EM>,
+not in <EM>squid.conf</EM>.  At the bottom of <EM>httpd.conf</EM>
+file, insert:
+<PRE>
+        &lt;Location /Squid/cgi-bin/cachemgr.cgi&gt;
+        order allow,deny
+        allow from workstation.example.com
+        &lt;/Location&gt;
+</PRE>
+<P>You can have more than one allow line, and you can allow
+domains or networks.
+<P>Alternately, <EM>cachemgr.cgi</EM> can be password-protected.  You'd
+add the following to <EM>httpd.conf</EM>:
+<P>
+<PRE>
+        &lt;Location /Squid/cgi-bin/cachemgr.cgi&gt;
+        AuthUserFile /path/to/password/file
+        AuthGroupFile /dev/null
+        AuthName User/Password Required
+        AuthType Basic
+        require user cachemanager
+        &lt;/Location&gt;
+</PRE>
+<P>Consult the Apache documentation for information on using <EM>htpasswd</EM>
+to set a password for this ``user.''
+<P>
+<H2><A NAME="ss9.5">9.5 Cache manager configuration for Roxen 2.0 and later</A>
+</H2>
+
+<P>by Francesco ``kinkie'' Chemolli
+<P>Notice: this is <EM>not</EM> how things would get best done
+with Roxen, but this what you need to do go adhere to the
+example.
+Also, knowledge of basic Roxen configuration is required.
+<P>
+<P>This is what's required to start up a fresh Virtual Server, only
+serving the cache manager. If you already have some Virtual Server
+you wish to use to host the Cache Manager, just add a new CGI
+support module to it.
+<P>
+<P>Create a new virtual server, and set it to host http://www.example.com/.
+Add to it at least the following modules:
+<UL>
+<LI>Content Types</LI>
+<LI>CGI scripting support</LI>
+</UL>
+<P>
+<P>In the <EM>CGI scripting support</EM> module, section <EM>Settings</EM>,
+change the following settings:
+<UL>
+<LI>CGI-bin path: set to /Squid/cgi-bin/</LI>
+<LI>Handle *.cgi: set to <EM>no</EM></LI>
+<LI>Run user scripts as owner: set to <EM>no</EM></LI>
+<LI>Search path: set to the directory containing the cachemgr.cgi file</LI>
+</UL>
+<P>
+<P>In section <EM>Security</EM>, set <EM>Patterns</EM> to:
+<PRE>
+allow ip=1.2.3.4
+</PRE>
+
+where 1.2.3.4 is the IP address for workstation.example.com
+<P>
+<P>Save the configuration, and you're done.
+<P>
+<H2><A NAME="ss9.6">9.6 Cache manager ACLs in <EM>squid.conf</EM></A>
+</H2>
+
+<P>The default cache manager access configuration in <EM>squid.conf</EM> is:
+<P>
+<PRE>
+        acl manager proto cache_object
+        acl localhost src 127.0.0.1/255.255.255.255
+        acl all src 0.0.0.0/0.0.0.0
+</PRE>
+<P>With the following rules:
+<P>
+<PRE>
+        http_access deny manager !localhost
+        http_access allow all
+</PRE>
+<P>
+<P>The first ACL is the most important as the cache manager program
+interrogates squid using a special <CODE>cache_object</CODE> protocol.
+Try it yourself by doing:
+<P>
+<PRE>
+        telnet mycache.example.com 3128
+        GET cache_object://mycache.example.com/info HTTP/1.0
+</PRE>
+<P>The default ACLs say that if the request is for a
+<CODE>cache_object</CODE>, and it isn't the local host, then deny
+access; otherwise allow access.
+<P>
+<P>In fact, only allowing localhost access means that on the
+initial <EM>cachemgr.cgi</EM> form you can only specify the cache
+host as <CODE>localhost</CODE>. We recommend the following:
+<P>
+<PRE>
+        acl manager proto cache_object
+        acl localhost src 127.0.0.1/255.255.255.255
+        acl example src 123.123.123.123/255.255.255.255
+        acl all src 0.0.0.0/0.0.0.0
+</PRE>
+<P>Where <CODE>123.123.123.123</CODE> is the IP address of your web server.
+Then modify the rules like this:
+<P>
+<PRE>
+        http_access allow manager localhost
+        http_access allow manager example
+        http_access deny manager
+        http_access allow all
+</PRE>
+
+If you're using <EM>miss_access</EM>, then don't forget to also add
+a <EM>miss_access</EM> rule for the cache manager:
+<PRE>
+        miss_access allow manager
+</PRE>
+<P>
+<P>
+<P>The default ACLs assume that your web server is on the same machine
+as <EM>squid</EM>. Remember that the connection from the cache
+manager program to squid originates at the web server, not the
+browser. So if your web server lives somewhere else, you should
+make sure that IP address of the web server that has <EM>cachemgr.cgi</EM>
+installed on it is in the <CODE>example</CODE> ACL above.
+<P>
+<P>Always be sure to send a <CODE>SIGHUP</CODE> signal to <EM>squid</EM>
+any time you change the <EM>squid.conf</EM> file.
+<P>
+<H2><A NAME="ss9.7">9.7 Why does it say I need a password and a URL?</A>
+</H2>
+
+<P>If you ``drop'' the list box, and browse it, you will see that the
+password is only required to shutdown the cache, and the URL is
+required to refresh an object (i.e., retrieve it from its original
+source again) Otherwise these fields can be left blank:  a password
+is not required to obtain access to the informational aspects of
+<EM>cachemgr.cgi</EM>.
+<P>
+<H2><A NAME="ss9.8">9.8 I want to shutdown the cache remotely. What's the password?</A>
+</H2>
+
+<P>See the <CODE>cachemgr_passwd</CODE> directive in <EM>squid.conf</EM>.
+<P>
+<H2><A NAME="ss9.9">9.9 How do I make the cache host default to <EM>my</EM> cache?</A>
+</H2>
+
+<P>When you run <EM>configure</EM> use the <EM>--enable-cachemgr-hostname</EM> option:
+<PRE>
+% ./configure --enable-cachemgr-hostname=`hostname` ...
+</PRE>
+<P>Note, if you do this after you already installed Squid before, you need to
+make sure <EM>cachemgr.cgi</EM> gets recompiled.  For example:
+<PRE>
+% cd src
+% rm cachemgr.o cachemgr.cgi
+% make cachemgr.cgi
+</PRE>
+<P>Then copy <EM>cachemgr.cgi</EM> to your HTTP server's <EM>cgi-bin</EM> directory.
+<P>
+<H2><A NAME="ss9.10">9.10 What's the difference between Squid TCP connections and Squid UDP connections?</A>
+</H2>
+
+<P>Browsers and caches use TCP connections to retrieve web objects
+from web servers or caches.  UDP connections are used when another
+cache using you as a sibling or parent wants to find out if you
+have an object in your cache that it's looking for.  The UDP
+connections are ICP queries.
+<P>
+<H2><A NAME="ss9.11">9.11 It says the storage expiration will happen in 1970!</A>
+</H2>
+
+<P>Don't worry. The default (and sensible) behavior of <EM>squid</EM>
+is to expire an object when it happens to overwrite it.  It doesn't
+explicitly garbage collect (unless you tell it to in other ways).
+<P>
+<H2><A NAME="ss9.12">9.12 What do the Meta Data entries mean?</A>
+</H2>
+
+<P>
+<DL>
+<P>
+<DT><B>StoreEntry</B><DD><P>Entry describing an object in the cache.
+<P>
+<DT><B>IPCacheEntry</B><DD><P>An entry in the DNS cache.
+<P>
+<DT><B>Hash link</B><DD><P>Link in the cache hash table structure.
+<P>
+<DT><B>URL strings</B><DD><P>The strings of the URLs themselves that map to
+an object number in the cache, allowing access to the
+StoreEntry.
+<P>
+</DL>
+<P>
+<P>Basically just like the <CODE>log</CODE> file in your cache directory:
+<P>
+<OL>
+<LI><CODE>PoolMemObject structures</CODE></LI>
+<LI>Info about objects currently in memory,
+(eg, in the process of being transferred).</LI>
+<LI><CODE>Pool for Request structures</CODE></LI>
+<LI>Information about each request as it happens.</LI>
+<LI><CODE>Pool for in-memory object</CODE></LI>
+<LI>Space for object data as it is retrieved.</LI>
+</OL>
+<P>
+<P>If <EM>squid</EM> is much smaller than this field, run for cover!
+Something is very wrong, and you should probably restart <EM>squid</EM>.
+<P>
+<H2><A NAME="ss9.13">9.13 In the utilization section, what is <CODE>Other</CODE>?</A>
+</H2>
+
+<P>
+<P><CODE>Other</CODE> is a default category to track objects which
+don't fall into one of the defined categories.
+<P>
+<H2><A NAME="ss9.14">9.14 In the utilization section, why is the <CODE>Transfer KB/sec</CODE></A>
+column always zero?</H2>
+
+<P>This column contains gross estimations of data transfer rates
+averaged over the entire time the cache has been running.  These
+numbers are unreliable and mostly useless.
+<P>
+<H2><A NAME="ss9.15">9.15 In the utilization section, what is the <CODE>Object Count</CODE>?</A>
+</H2>
+
+<P>The number of objects of that type in the cache right now.
+<P>
+<H2><A NAME="ss9.16">9.16 In the utilization section, what is the <CODE>Max/Current/Min KB</CODE>?</A>
+</H2>
+
+<P>These refer to the size all the objects of this type have grown
+to/currently are/shrunk to.
+<P>
+<H2><A NAME="ss9.17">9.17 What is the <CODE>I/O</CODE> section about?</A>
+</H2>
+
+<P>These are histograms on the number of bytes read from the network
+per <CODE>read(2)</CODE> call.  Somewhat useful for determining
+maximum buffer sizes.
+<P>
+<H2><A NAME="ss9.18">9.18 What is the <CODE>Objects</CODE> section for?</A>
+</H2>
+
+<P><B><EM>Warning:</EM></B> this will download to your browser
+a list of every URL in the cache and statistics about it. It can
+be very, very large.  <B><EM>Sometimes it will be larger than
+the amount of available memory in your client!</EM></B> You
+probably don't need this information anyway.
+<P>
+<H2><A NAME="ss9.19">9.19 What is the <CODE>VM Objects</CODE> section for?</A>
+</H2>
+
+<P><CODE>VM Objects</CODE> are the objects which are in Virtual Memory.
+These are objects which are currently being retrieved and
+those which were kept in memory for fast access (accelerator
+mode).
+<P>
+<H2><A NAME="ss9.20">9.20 What does <CODE>AVG RTT</CODE> mean?</A>
+</H2>
+
+<P>Average Round Trip Time. This is how long on average after
+an ICP ping is sent that a reply is received.
+<P>
+<H2><A NAME="ss9.21">9.21 In the IP cache section, what's the difference between a hit, a negative hit and a miss?</A>
+</H2>
+
+<P>
+<P>A HIT means that the document was found in the cache. A
+MISS, that it wasn't found in the cache. A negative hit
+means that it was found in the cache, but it doesn't exist.
+<P>
+<H2><A NAME="ss9.22">9.22 What do the IP cache contents mean anyway?</A>
+</H2>
+
+<P>
+<P>The hostname is the name that was requested to be resolved.
+<P>
+<P>For the <CODE>Flags</CODE> column:
+<P>
+<UL>
+<LI><CODE>C</CODE> Means positively cached.</LI>
+<LI><CODE>N</CODE> Means negatively cached.</LI>
+<LI><CODE>P</CODE> Means the request is pending being dispatched.</LI>
+<LI><CODE>D</CODE> Means the request has been dispatched and we're waiting for an answer.</LI>
+<LI><CODE>L</CODE> Means it is a locked entry because it represents a parent or sibling.</LI>
+</UL>
+<P>The <CODE>TTL</CODE> column represents ``Time To Live'' (i.e., how long
+the cache entry is valid).  (May be negative if the document has
+expired.)
+<P>
+<P>The <CODE>N</CODE> column is the number of IP addresses from which
+the cache has documents.
+<P>
+<P>The rest of the line lists all the IP addresses that have been associated
+with that IP cache entry.
+<P>
+<P>
+<H2><A NAME="ss9.23">9.23 What is the fqdncache and how is it different from the ipcache?</A>
+</H2>
+
+<P>IPCache contains data for the Hostname to IP-Number mapping, and
+FQDNCache does it the other way round.  For example:
+<P><EM>IP Cache Contents:</EM>
+<PRE>
+        Hostname                      Flags lstref    TTL  N [IP-Number]
+        gorn.cc.fh-lippe.de               C       0  21581 1 193.16.112.73
+        lagrange.uni-paderborn.de         C       6  21594 1 131.234.128.245
+        www.altavista.digital.com         C      10  21299 4 204.123.2.75  ...
+        2/ftp.symantec.com                DL   1583 -772855 0
+
+        Flags:  C --> Cached
+                D --> Dispatched
+                N --> Negative Cached
+                L --> Locked
+        lstref: Time since last use
+        TTL:    Time-To-Live until information expires
+        N:      Count of addresses
+</PRE>
+<P>
+<P><EM>FQDN Cache Contents:</EM>
+<PRE>
+        IP-Number                    Flags    TTL N Hostname
+        130.149.17.15                    C -45570 1 andele.cs.tu-berlin.de
+        194.77.122.18                    C -58133 1 komet.teuto.de
+        206.155.117.51                   N -73747 0
+
+        Flags:  C --> Cached
+                D --> Dispatched
+                N --> Negative Cached
+                L --> Locked
+        TTL:    Time-To-Live until information expires
+        N:      Count of names
+</PRE>
+<P>
+<H2><A NAME="paging"></A> <A NAME="ss9.24">9.24 What does ``Page faults with physical i/o: 4897'' mean?</A>
+</H2>
+
+<P>This question was asked on the <EM>squid-users</EM> mailing list, to which
+there were three excellent replies.
+<P>
+<P>by 
+<A HREF="mailto:JLarmour@origin-at.co.uk">Jonathan Larmour</A><P>
+<P>You get a ``page fault'' when your OS tries to access something in memory
+which is actually swapped to disk. The term ``page fault'' while correct at
+the kernel and CPU level, is a bit deceptive to a user, as there's no
+actual error - this is a normal feature of operation.
+<P>
+<P>Also, this doesn't necessarily mean your squid is swapping by that much.
+Most operating systems also implement paging for executables, so that only
+sections of the executable which are actually used are read from disk into
+memory. Also, whenever squid needs more memory, the fact that the memory
+was allocated will show up in the page faults.
+<P>
+<P>However, if the number of faults is unusually high, and getting bigger,
+this could mean that squid is swapping. Another way to verify this is using
+a program called ``vmstat'' which is found on most UNIX platforms. If you run
+this as ``vmstat 5'' this will update a display every 5 seconds. This can
+tell you if the system as a whole is swapping a lot (see your local man
+page for vmstat for more information).
+<P>
+<P>It is very bad for squid to swap, as every single request will be blocked
+until the requested data is swapped in. It is better to tweak the <EM>cache_mem</EM>
+and/or <EM>memory_pools</EM> setting in squid.conf, or switch to the NOVM versions
+of squid, than allow this to happen.
+<P>
+<P>by 
+<A HREF="mailto:peter@spinner.dialix.com.au">Peter Wemm</A><P>
+<P>There's two different operations at work, Paging and swapping.  Paging
+is when individual pages are shuffled (either discarded or swapped
+to/from disk), while ``swapping'' <EM>generally</EM> means the entire
+process got sent to/from disk.
+<P>
+<P>Needless to say, swapping a process is a pretty drastic event, and usually
+only reserved for when there's a memory crunch and paging out cannot free
+enough memory quickly enough.  Also, there's some variation on how
+swapping is implemented in OS's.  Some don't do it at all or do a hybrid
+of paging and swapping instead.
+<P>
+<P>As you say, paging out doesn't necessarily involve disk IO, eg: text (code)
+pages are read-only and can simply be discarded if they are not used (and
+reloaded if/when needed).  Data pages are also discarded if unmodified, and
+paged out if there's been any changes.  Allocated memory (malloc) is always
+saved to disk since there's no executable file to recover the data from.
+mmap() memory is variable..  If it's backed from a file, it uses the same
+rules as the data segment of a file - ie: either discarded if unmodified or
+paged out.
+<P>
+<P>There's also ``demand zeroing'' of pages as well that cause faults..  If you
+malloc memory and it calls brk()/sbrk() to allocate new pages, the chances
+are that you are allocated demand zero pages.  Ie: the pages are not
+``really'' attached to your process yet, but when you access them for the
+first time, the page fault causes the page to be connected to the process
+address space and zeroed - this saves unnecessary zeroing of pages that are
+allocated but never used.
+<P>
+<P>The ``page faults with physical IO'' comes from the OS via getrusage(). It's
+highly OS dependent on what it means.  Generally, it means that the process
+accessed a page that was not present in memory (for whatever reason) and
+there was disk access to fetch it.  Many OS's load executables by demand
+paging as well, so the act of starting squid implicitly causes page faults
+with disk IO - however, many (but not all) OS's use ``read ahead'' and
+``prefault'' heuristics to streamline the loading.  Some OS's maintain
+``intent queues'' so that pages can be selected as pageout candidates ahead
+of time.  When (say) squid touches a freshly allocated demand zero page and
+one is needed, the OS can page out one of the candidates on the spot,
+causing a 'fault with physical IO' with demand zeroing of allocated memory
+which doesn't happen on many other OS's.  (The other OS's generally put
+the process to sleep while the pageout daemon finds a page for it).
+<P>
+<P>The meaning of ``swapping'' varies.  On FreeBSD for example, swapping out is
+implemented as unlocking upages, kernel stack, PTD etc for aggressive
+pageout with the process.  The only thing left of the process in memory is
+the 'struct proc'.  The FreeBSD paging system is highly adaptive and can
+resort to paging in a way that is equivalent to the traditional swapping
+style operation (ie: entire process).  FreeBSD also tries stealing pages
+from active processes in order to make space for disk cache.  I suspect
+this is why setting 'memory_pools off' on the non-NOVM squids on FreeBSD is
+reported to work better - the VM/buffer system could be competing with
+squid to cache the same pages.  It's a pity that squid cannot use mmap() to
+do file IO on the 4K chunks in it's memory pool (I can see that this is not
+a simple thing to do though, but that won't stop me wishing. :-).
+<P>
+<P>by 
+<A HREF="mailto:webadm@info.cam.ac.uk">John Line</A><P>
+<P>The comments so far have been about what paging/swapping figures mean in
+a ``traditional'' context, but it's worth bearing in mind that on some systems
+(Sun's Solaris 2, at least), the virtual memory and filesystem handling are
+unified and what a user process sees as reading or writing a file, the system
+simply sees as paging something in from disk or a page being updated so it
+needs to be paged out. (I suppose you could view it as similar to the operating
+system memory-mapping the files behind-the-scenes.)
+<P>
+<P>The effect of this is that on Solaris 2, paging figures will also include file
+I/O. Or rather, the figures from vmstat certainly appear to include file I/O,
+and I presume (but can't quickly test) that figures such as those quoted by
+Squid will also include file I/O.
+<P>
+<P>To confirm the above (which represents an impression from what I've read and
+observed, rather than 100% certain facts...), using an otherwise idle Sun Ultra
+1 system system I just tried using cat (small, shouldn't need to page) to copy
+(a) one file to another, (b) a file to /dev/null, (c) /dev/zero to a file, and
+(d) /dev/zero to /dev/null (interrupting the last two with control-C after a
+while!), while watching with vmstat. 300-600 page-ins or page-outs per second
+when reading or writing a file (rather than a device), essentially zero in
+other cases (and when not cat-ing).
+<P>
+<P>So ... beware assuming that all systems are similar and that paging figures
+represent *only* program code and data being shuffled to/from disk - they
+may also include the work in reading/writing all those files you were
+accessing...
+<P>
+<H3>Ok, so what is unusually high?</H3>
+
+<P>You'll probably want to compare the number of page faults to the number of
+HTTP requests.  If this ratio is close to, or exceeding&nbsp;1, then
+Squid is paging too much.
+<P>
+<H2><A NAME="ss9.25">9.25 What does the IGNORED field mean in the 'cache server list'?</A>
+</H2>
+
+<P>This refers to ICP replies which Squid ignored, for one of these
+reasons:
+<UL>
+<LI>The URL in the reply could not be found in the cache at all.</LI>
+<LI>The URL in the reply was already being fetched.  Probably
+this ICP reply arrived too late.</LI>
+<LI>The URL in the reply did not have a MemObject associated with
+it.  Either the request is already finished, or the user aborted
+before the ICP arrived.</LI>
+<LI>The reply came from a multicast-responder, but the
+<EM>cache_peer_access</EM> configuration does not allow us to
+forward this request to that
+neighbor.</LI>
+<LI>Source-Echo replies from known neighbors are ignored.</LI>
+<LI>ICP_OP_DENIED replies are ignored after the first 100.</LI>
+</UL>
+<P>
+<P>
+<P>
+<HR>
+<A HREF="FAQ-10.html">Next</A>
+<A HREF="FAQ-8.html">Previous</A>
+<A HREF="FAQ.html#toc9">Contents</A>
+</BODY>
+</HTML>
--- squid-2.5.9.orig/debian/postinst.squid-cgi
+++ squid-2.5.9/debian/postinst.squid-cgi
@@ -0,0 +1,25 @@
+#! /bin/sh
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+case "$1" in
+	configure)
+		case "$2" in
+			"<unknown>"|"")
+				db_text high squid-cgi/cachemgr || true
+				db_go
+				;;
+		esac
+		;;
+	abort-upgrade|abort-remove|abort-deconfigure)
+		;;
+	*)
+		#
+		#	Unknown action - do nothing.
+		#
+		exit 0
+		;;
+esac
+
--- squid-2.5.9.orig/debian/rules
+++ squid-2.5.9/debian/rules
@@ -0,0 +1,380 @@
+#! /usr/bin/make -f
+#
+#	debian/rules file for squid.
+#
+
+# Version.
+package = squid
+
+# Include dpatch stuff.
+include /usr/share/dpatch/dpatch.make
+
+SHELL	= /bin/bash
+LC_ALL	= POSIX
+
+DEB_HOST_GNU_CPU := $(shell dpkg-architecture -qDEB_HOST_GNU_CPU)
+DEB_HOST_GNU_SYSTEM := $(shell dpkg-architecture -qDEB_HOST_GNU_SYSTEM)
+
+tmp	     = debian/tmp
+bindir       = /usr/sbin
+libexecdir   = /usr/lib/squid
+sysconfdir   = /etc/squid
+logdir       = /var/log/squid
+docdir       = /usr/share/doc/squid
+datadir      = /usr/share/squid
+
+DEFAULTS     =	logdir=$(logdir) \
+		DEFAULT_CACHE_LOG=$(logdir)/cache.log \
+		DEFAULT_ACCESS_LOG=$(logdir)/access.log \
+		DEFAULT_STORE_LOG=$(logdir)/store.log \
+		DEFAULT_PID_FILE=/var/run/squid.pid \
+		DEFAULT_SWAP_DIR=/var/spool/squid \
+		DEFAULT_ICON_DIR=$(datadir)/icons \
+		DEFAULT_ERROR_DIR=$(datadir)/errors/English \
+		DEFAULT_MIME_TABLE=$(datadir)/mime.conf \
+		DEFAULT_MIB_PATH=$(datadir)/mib.txt
+
+# The HURD doesn't have pthreads yet.
+ifeq ($(DEB_HOST_GNU_SYSTEM), gnu)
+	with_pthreads = --enable-storeio=ufs,diskd,null
+	with_netfilter =
+	with_arp_acl =
+else
+	with_pthreads = --enable-async-io --with-pthreads \
+		--enable-storeio=ufs,aufs,diskd,null
+	with_netfilter = --enable-linux-netfilter
+	with_arp_acl = --enable-arp-acl
+endif
+
+# setresuid is broken on sparc
+ifeq ($(DEB_HOST_GNU_CPU), sparc)
+	opt_ac_cv_func_setresuid = ac_cv_func_setresuid=no
+else
+	opt_ac_cv_func_setresuid = ac_cv_func_setresuid=yes
+endif
+
+define checkdir
+	test -f src/squid.h
+endef
+
+
+# Build the binaries.
+build: patch config.status
+	$(checkdir)
+	$(MAKE) $(DEFAULTS) all
+	# Authentication modules
+	cd helpers/basic_auth/NCSA && make
+	cd helpers/basic_auth/SMB && make SAMBAPREFIX=/usr INSTALLBIN=/usr/lib/squid
+	cd helpers/basic_auth/PAM && make
+	cd helpers/basic_auth/LDAP && make
+	cd helpers/basic_auth/YP && make
+	cd helpers/basic_auth/MSNT && make
+	cd helpers/basic_auth/getpwnam && make
+	cd helpers/basic_auth/winbind && make
+	cd helpers/digest_auth/password && make
+	cd helpers/external_acl/ip_user && make
+	cd helpers/external_acl/ldap_group && make
+	cd helpers/external_acl/unix_group && make
+	cd helpers/external_acl/winbind_group && make
+	cd helpers/external_acl/wbinfo_group && make
+	cd helpers/ntlm_auth/SMB && make
+	cd helpers/ntlm_auth/winbind && make
+	touch build
+
+# Configure the package.
+config.status: 
+	$(opt_ac_cv_func_setresuid) \
+	./configure \
+	--prefix=/usr \
+	--exec_prefix=/usr \
+	--bindir=/usr/sbin --sbindir=/usr/sbin \
+	--libexecdir=/usr/lib/squid \
+	--sysconfdir=$(sysconfdir) \
+	--localstatedir=/var/spool/squid \
+	--datadir=/usr/share/squid \
+	$(with_pthreads) \
+	$(with_netfilter) \
+	$(with_arp_acl) \
+	--enable-removal-policies=lru,heap \
+	--enable-snmp \
+	--enable-delay-pools \
+	--enable-htcp \
+	--enable-poll \
+	--enable-cache-digests \
+	--enable-underscores \
+	--enable-referer-log \
+	--enable-useragent-log \
+	--enable-auth="basic,digest,ntlm" \
+	--enable-carp \
+	--with-large-files \
+	$(DEB_HOST_GNU_CPU)-debian-$(DEB_HOST_GNU_SYSTEM)
+ifeq ($(DEB_HOST_GNU_SYSTEM), linux)
+	# Force 4096 filedescriptors
+	perl -pi -e 's/^#define SQUID_MAXFD.*/#define SQUID_MAXFD 4096/;' \
+		include/autoconf.h
+endif
+
+# Architecture independant files.
+binary-indep:	build checkroot
+	-rm -rf $(tmp) debian/files
+	$(checkdir)
+	install -m 755 -g root -d $(tmp)/DEBIAN
+	install -m 755 -g root -d $(tmp)/usr/share/doc/squid-common
+	install -m 644 -g root ChangeLog $(tmp)/usr/share/doc/squid-common/changelog
+	install -m 644 -g root debian/changelog \
+		$(tmp)/usr/share/doc/squid-common/changelog.Debian
+	gzip -9f $(tmp)/usr/share/doc/squid-common/*
+	install -m 644 -g root debian/copyright $(tmp)/usr/share/doc/squid-common
+	install -m 755 -g root -d $(tmp)/usr/share/$(package)
+	install -m 755 -g root -d $(tmp)/usr/share/squid/{errors,icons}
+	install -m 644 -g root src/mib.txt \
+		./$(tmp)$(datadir)/mib.txt
+	install -m 644 -g root src/mime.conf.default \
+		./$(tmp)$(datadir)/mime.conf
+	#
+	cp -R errors/* ./$(tmp)$(datadir)/errors
+	rm -f ./$(tmp)$(datadir)/errors/Makefile*
+	rm -f ./$(tmp)$(datadir)/errors/list
+	chmod 755 ./$(tmp)$(datadir)/errors/*
+	chmod 644 ./$(tmp)$(datadir)/errors/*/*
+	chown -R root:root ./$(tmp)$(datadir)/errors
+	install -m 644 -g root icons/*.gif ./$(tmp)$(datadir)/icons
+	dpkg-gencontrol -isp -psquid-common
+	dpkg --build $(tmp) ..
+	rm -f debian/substvars
+	rm -rf $(tmp)
+
+# Make a binary package (.deb file)
+binary-arch:	build checkroot
+	#
+	#	Build squid package.
+	#
+	install -m 755 -g root -d $(tmp)/DEBIAN
+	install -m 755 -g root -d $(tmp)/etc/{squid,logrotate.d,init.d}
+	install -m 755 -g root -d $(tmp)/etc/resolvconf/update-libc.d
+	install -m 755 -g root -d $(tmp)/usr/{bin,sbin}
+	install -m 755 -g root -d $(tmp)/usr/share/doc/$(package)
+	install -m 755 -g root -d $(tmp)/usr/share/doc/$(package)/examples
+	install -m 755 -g root -d $(tmp)/usr/lib/squid
+	install -m 755 -g root -d $(tmp)/var/{log,spool}
+	install -m 750 -o proxy -g proxy -d $(tmp)/var/log/squid
+	install -m 750 -o proxy -g proxy -d $(tmp)/var/spool/squid
+	install -m 755 -g root -d $(tmp)/usr/share/man/man8
+	#
+	install -s -m 755 -g root src/squid $(tmp)/usr/sbin
+	install -s -m 755 -g root src/unlinkd src/fs/diskd/diskd \
+		$(tmp)/usr/lib/squid
+	#install -s -m 4754 -g proxy src/pinger $(tmp)/usr/lib/squid
+	#
+	install -m 644 -g root debian/logrotate \
+		$(tmp)/etc/logrotate.d/squid
+	# Added for resolvconf
+	install -m 755 -g root debian/squid.resolvconf \
+		$(tmp)/etc/resolvconf/update-libc.d/squid
+	# TO BE REMOVED (left in for people with an old /etc/init.d/squid)
+	install -m 755 -g root debian/squid.RunCache \
+		$(tmp)/$(libexecdir)/RunCache
+	#
+	install -m 644 -g root debian/doc/README.auth_modules $(tmp)$(docdir)
+	install -m 755 -g root -s helpers/basic_auth/SMB/smb_auth $(tmp)$(libexecdir)
+	install -m 755 -g root helpers/basic_auth/SMB/smb_auth.sh \
+		$(tmp)$(libexecdir)
+	install -m 644 -g root helpers/basic_auth/SMB/README \
+		$(tmp)$(docdir)/README.auth_module.smb_auth
+	umask 022; head -19 helpers/basic_auth/NCSA/ncsa_auth.c > \
+		$(tmp)$(docdir)/README.auth_module.ncsa_auth
+	install -m 755 -g root -s helpers/basic_auth/NCSA/ncsa_auth \
+		$(tmp)$(libexecdir)
+	umask 022; head -56 helpers/basic_auth/PAM/pam_auth.c > \
+		$(tmp)$(docdir)/README.auth_module.pam_auth
+	install -m 2750 -o proxy -g shadow -s helpers/basic_auth/PAM/pam_auth \
+		$(tmp)$(libexecdir)
+	install -m 644 -g root debian/README.ldap_auth \
+		$(tmp)$(docdir)/README.auth_module.ldap_auth
+	install -m 755 -g root -s helpers/basic_auth/LDAP/squid_ldap_auth \
+		$(tmp)$(libexecdir)/ldap_auth
+	install -m 755 -g root -s helpers/basic_auth/YP/yp_auth \
+		$(tmp)$(libexecdir)/yp_auth
+	install -m 755 -g root -s helpers/basic_auth/MSNT/msnt_auth \
+		$(tmp)$(libexecdir)/msnt_auth
+	install -m 644 -g root helpers/basic_auth/MSNT/README.html \
+		$(tmp)$(docdir)/README.auth_module.msnt_auth.html
+	umask 022; head -21 helpers/basic_auth/getpwnam/getpwnam_auth.c > \
+		$(tmp)$(docdir)/README.auth_module.getpwnam_auth
+	install -m 2750 -o proxy -g shadow -s \
+		helpers/basic_auth/getpwnam/getpwname_auth \
+		$(tmp)$(libexecdir)/getpwnam_auth
+	install -m 755 -g root -s helpers/basic_auth/winbind/wb_auth \
+		$(tmp)$(libexecdir)/wb_auth
+	install -m 755 -g root -s helpers/digest_auth/password/digest_pw_auth \
+		$(tmp)$(libexecdir)/digest_pw_auth
+	umask 022; head -26 helpers/digest_auth/password/digest_pw_auth.c > \
+		$(tmp)$(docdir)/README.auth_module.digest_pw_auth
+	install -m 755 -g root -s helpers/external_acl/ip_user/ip_user_check \
+		$(tmp)$(libexecdir)/ip_user_check
+	install -m 644 -g root helpers/external_acl/ip_user/README \
+		$(tmp)$(docdir)/README.auth_module.ip_user
+	install -m 644 -g root helpers/external_acl/ip_user/example.conf \
+		$(tmp)$(docdir)/examples/ip_user-example.conf
+	install -m 755 -g root -s helpers/external_acl/ldap_group/squid_ldap_group \
+		$(tmp)$(libexecdir)/squid_ldap_group
+	install -m 644 helpers/external_acl/ldap_group/squid_ldap_group.8 \
+		$(tmp)/usr/share/man/man8/squid_ldap_group.8
+	install -m 755 -g root -s helpers/external_acl/unix_group/squid_unix_group \
+		$(tmp)$(libexecdir)/squid_unix_group
+	install -m 644 helpers/external_acl/unix_group/squid_unix_group.8 \
+		$(tmp)/usr/share/man/man8/squid_unix_group.8
+	install -m 644 -g root helpers/external_acl/unix_group/README \
+		$(tmp)$(docdir)/README.auth_module.unix_group
+	install -m 755 -g root -s helpers/external_acl/winbind_group/wb_group \
+		$(tmp)$(libexecdir)/wb_group
+	install -m 644 -g root helpers/external_acl/winbind_group/readme.txt \
+		$(tmp)$(docdir)/README.auth_module.winbind_group
+	install -m 755 -g root helpers/external_acl/wbinfo_group/wbinfo_group.pl \
+		$(tmp)$(libexecdir)/wbinfo_group.pl
+	install -m 755 -g root -s helpers/ntlm_auth/SMB/ntlm_auth \
+		$(tmp)$(libexecdir)/ntlm_auth
+	install -m 755 -g root -s helpers/ntlm_auth/winbind/wb_ntlmauth \
+		$(tmp)$(libexecdir)/wb_ntlmauth
+	# the examples. Most have been removed from upstream :/
+	install -m 644 -g root src/squid.conf.default \
+	        $(tmp)/usr/share/doc/$(package)/examples/squid.conf
+	#install -m 644 -g root contrib/rredir.c \
+	#	$(tmp)/usr/share/doc/$(package)/examples
+	#install -m 755 -g root contrib/{rredir.pl,url-normalizer.pl} \
+        #        $(tmp)/usr/share/doc/$(package)/examples
+	install -m 644 -g root debian/default.squid \
+		$(tmp)/usr/share/doc/$(package)/examples
+	
+	#
+	install -m 644 -g root ChangeLog $(tmp)/usr/share/doc/$(package)/changelog
+	install -m 644 -g root debian/changelog \
+		$(tmp)/usr/share/doc/$(package)/changelog.Debian
+	install -m 644 -g root debian/README.Debian \
+		$(tmp)/usr/share/doc/$(package)/README.Debian
+	install -m 644 -g root CONTRIBUTORS QUICKSTART \
+		README debian/doc/README.transparent-proxy \
+		debian/doc/README.morefds doc/debug-sections.txt \
+		$(tmp)/usr/share/doc/$(package)
+	gzip -9f `find debian/tmp/usr/share/doc/squid/* | grep -v examples`
+#$(tmp)/usr/share/doc/$(package)/[A-Za-df-z]*
+	install -m 644 -g root debian/copyright $(tmp)/usr/share/doc/$(package)
+	install -m 644 -g root debian/doc/FAQ*.html $(tmp)/usr/share/doc/$(package)
+	install -m 644 doc/squid.8 $(tmp)/usr/share/man/man8
+	gzip -9f $(tmp)/usr/share/man/man?/*
+	install -m 755 debian/squid.rc $(tmp)/etc/init.d/squid
+	#
+	install -m 755 debian/preinst $(tmp)/DEBIAN/preinst
+	install -m 755 debian/postinst $(tmp)/DEBIAN/postinst
+	install -m 755 debian/prerm $(tmp)/DEBIAN/prerm
+	install -m 755 debian/postrm $(tmp)/DEBIAN/postrm
+	install -m 644 debian/conffiles $(tmp)/DEBIAN/conffiles
+	#install -m 644 debian/templates $(tmp)/DEBIAN/templates
+	po2debconf debian/templates > debian/templates.merged
+	install -m 644 debian/templates.merged $(tmp)/DEBIAN/templates
+	install -m 755 debian/config $(tmp)/DEBIAN/config
+
+	# overrides file
+	install -m 755 -g root -d $(tmp)/usr/share/lintian/overrides/
+	install -m 644 debian/squid.overrides $(tmp)/usr/share/lintian/overrides/squid
+	
+	dpkg-shlibdeps $(tmp)/usr/sbin/* $(tmp)$(libexecdir)/*
+	dpkg-gencontrol -isp -p$(package)
+	dpkg --build $(tmp) ..
+	rm -f debian/substvars
+	rm -rf $(tmp)
+	#
+	#	Generate squidclient package.
+	#
+	install -m 755 -g root -d $(tmp)/DEBIAN
+	install -m 755 -g root -d $(tmp)/usr/bin
+	install -m 755 -g root -d $(tmp)/usr/share/doc/squidclient
+	install -m 755 -g root -d $(tmp)/usr/share/man/man1
+	#
+	install -s -m 755 -g root src/squidclient $(tmp)/usr/bin/squidclient
+	install -m 644 -g root debian/squidclient.1 $(tmp)/usr/share/man/man1
+	install -m 644 -g root ChangeLog $(tmp)/usr/share/doc/squidclient/changelog
+	install -m 644 -g root debian/changelog \
+		$(tmp)/usr/share/doc/squidclient/changelog.Debian
+	gzip -9f $(tmp)/usr/share/doc/squidclient/*
+	install -m 644 -g root debian/copyright $(tmp)/usr/share/doc/squidclient
+	gzip -9f $(tmp)/usr/share/man/man?/*
+	#
+	install -m 755  debian/postinst.squidclient $(tmp)/DEBIAN/prerm
+	install -m 755  debian/prerm.squidclient $(tmp)/DEBIAN/prerm
+	dpkg-shlibdeps src/squidclient
+	dpkg-gencontrol -isp -psquidclient
+	dpkg --build $(tmp) ..
+	rm -f debian/substvars
+	rm -rf $(tmp)
+	#
+	#	Generate squid-cgi package.
+	#
+	install -m 755 -g root -d $(tmp)/DEBIAN
+	install -m 755 -g root -d $(tmp)/etc/squid
+	install -m 755 -g root -d $(tmp)/usr/lib/cgi-bin
+	install -m 755 -g root -d $(tmp)/usr/share/doc/squid-cgi
+	install -m 755 -g root -d $(tmp)/usr/share/man/man8
+	#
+	install -m 644 debian/cachemgr.conf $(tmp)/etc/squid/cachemgr.conf
+	install -s -m 755 -g root src/cachemgr.cgi $(tmp)/usr/lib/cgi-bin/
+	install -m 644 -g root debian/squid-cgi.8 $(tmp)/usr/share/man/man8
+	install -m 644 -g root ChangeLog $(tmp)/usr/share/doc/squid-cgi/changelog
+	install -m 644 -g root debian/changelog \
+		$(tmp)/usr/share/doc/squid-cgi/changelog.Debian
+	install -m 644 -g root debian/doc/cachemgr.README \
+		$(tmp)/usr/share/doc/squid-cgi/README.cachemgr
+	gzip -9f $(tmp)/usr/share/doc/squid-cgi/*
+	install -m 644 -g root debian/copyright $(tmp)/usr/share/doc/squid-cgi
+	install -m 644 -g root debian/doc/cachemgrfaq.html \
+		$(tmp)/usr/share/doc/squid-cgi
+	gzip -9f $(tmp)/usr/share/man/man8/*
+	install -m 755 -g root -d $(tmp)/usr/share/doc/squid-cgi/examples
+	install -m 644 -g root debian/doc/cachemgr.html \
+		$(tmp)/usr/share/doc/squid-cgi/examples
+	#
+	install -m 755 debian/postinst.squid-cgi $(tmp)/DEBIAN/postinst
+	install -m 755 debian/postrm.squid-cgi $(tmp)/DEBIAN/postrm
+	install -m 755 debian/prerm.squid-cgi $(tmp)/DEBIAN/prerm
+	#install -m 644 debian/templates $(tmp)/DEBIAN/templates
+	install -m 644 debian/conffiles.squid-cgi $(tmp)/DEBIAN/conffiles
+	install -m 644 debian/templates.merged $(tmp)/DEBIAN/templates
+	dpkg-shlibdeps src/cachemgr.cgi
+	dpkg-gencontrol -isp -psquid-cgi
+	dpkg --build $(tmp) ..
+	rm -rf $(tmp)
+
+# Clean up.
+clean: clean1 unpatch
+clean1:	checkroot
+	-$(MAKE) -i distclean
+	rm -f helpers/basic_auth/NCSA/{Makefile,ncsa_auth.o,ncsa_auth}
+	rm -f helpers/basic_auth/SMB/{smb_auth.o,smb_auth}
+	rm -f helpers/basic_auth/PAM/{pam_auth.o,pam_auth}
+	rm -f helpers/basic_auth/YP/{Makefile,yp_auth,yp_auth.o,nis_support.o}
+	rm -f helpers/basic_auth/MSNT/{Makefile,msnt_auth,*.o}
+	rm -f helpers/basic_auth/LDAP/{Makefile,squid_ldap_auth,*.o}
+	rm -f helpers/basic_auth/winbind/{Makefile,wb_common.o,wb_basic_auth.o,wb_authi}
+	rm -f helpers/basic_auth/getpwnam/{Makefile,getpwnam_auth.o,getpwnam_auth}
+	rm -f helpers/digest_auth/password/{Makefile,digest_pw_auth,digest_pw_auth.o}
+	rm -f helpers/external_acl/ip_user/{Makefile,ip_user,dict.o,main.o,match.o}
+	rm -f helpers/external_acl/ldap_group/{Makefile,squid_ldap_group,squid_ldap_group.o}
+	rm -f helpers/external_acl/unix_group/{Makefile,squid_unix_group,check_group.o}
+	rm -f helpers/external_acl/winbind_group/{Makefile,wb_group,*.o}
+	rm -f helpers/ntlm_auth/SMB/{Makefile,ntlm_auth,*.o,smbval/*.o}
+	rm -f helpers/ntlm_auth/winbind/{Makefile,wb_ntlmauth,*.o}
+	-rm -f build debian/{substvars,files,templates.merged}
+	rm -rf $(tmp) *~
+	-find . -name '*.bak' -o -name '*~' | xargs -r rm -f --
+	cd icons && /bin/sh ./icons.shar
+
+binary:	binary-indep binary-arch
+
+checkroot:
+	$(checkdir)
+	test root = "`whoami`"
+
+dist:	binary
+	dpkg-source -b
+
+.PHONY: binary binary-arch binary-indep clean checkroot clean1 patch unpatch
--- squid-2.5.9.orig/debian/changelog
+++ squid-2.5.9/debian/changelog
@@ -0,0 +1,1274 @@
+squid (2.5.9-5woody1) woody-backports; urgency=medium
+
+  * Recompiled for woody.
+
+ -- Norbert Tretkowski <nobse@debian.org>  Mon, 25 Apr 2005 10:23:35 +0200
+
+squid (2.5.9-6) unstable; urgency=medium
+
+  * Urgency still medium due to upstream fixes that should go into sarge
+
+  * debian/patches/09-enable-large-files
+    - Updated again upstream patch, fixing failed assertion
+      store_swapout.c:232: "mem->inmem_lo == 0"
+      (Closes: #305387)
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu, 21 Apr 2005 01:21:58 +0200
+
+squid (2.5.9-5) unstable; urgency=medium
+
+  * Urgency still medium due to upstream fixes that should go into sarge
+
+  * debian/patches/09-enable-large-files
+    - Updated upstream patch, fixing race condition causing segfault
+      (Closes: #305387)
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed, 20 Apr 2005 01:55:42 +0200
+
+squid (2.5.9-4) unstable; urgency=medium
+
+  * Urgency still medium due to upstream fixes that should go into sarge
+
+  * debian/patches/09-enable-large-files
+    - Updated upstream patch, fixing crashes with diskd (Closes: #302634)
+
+  * debian/patches/00list
+    - Reworked patch order
+
+ -- Luigi Gangitano <luigi@debian.org>  Sun,  3 Apr 2005 01:43:31 +0200
+
+squid (2.5.9-3) unstable; urgency=medium
+
+  * Urgency medium due to upstream fixes that should go into sarge
+  
+  * debian/patches/09-enable-large-files
+    - Substituded with official upstream patch for large file support.
+      This patch is definetly better than the one previously used.
+
+  * debian/rules
+    - Changed configure option --enable-large-files to --with-large-files
+
+  * debian/patches/38-aufs-fixes
+    - Added upstream patch fixing small issues with aufs and enhancing
+      performance
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri,  1 Apr 2005 17:19:23 +0200
+
+squid (2.5.9-2) unstable; urgency=medium
+  
+  * Urgency medium due to small security fix
+
+  * debian/patches/37-setcookie.dpatch
+    - Added upstream patchto fix race condition with Set-Cookie headers
+      (Closes: #298053)
+  
+  * debian/watch
+    - Re-Updated watch file, this should really work
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue,  8 Mar 2005 04:37:22 +0100
+
+squid (2.5.9-1) unstable; urgency=low
+
+  * New upstream release
+    - removed patches that have been integrated upstream:
+      debian/patches/30-amd64-gcc40-compile
+      debian/patches/36-dns-assert
+
+  * debian/watch
+    - Updated watch file, this should work
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 28 Feb 2005 03:06:18 +0100
+
+squid (2.5.8-3) unstable; urgency=high
+
+  * Urgency high due security fixes
+
+  * debian/patches/36-dns-assert.dpatch
+    - Added upstream patch to fix DoS in DNS reply parsing
+      (Ref: CAN-2005-0446)
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu, 17 Feb 2005 01:10:05 +0100
+
+squid (2.5.8-2) unstable; urgency=low
+
+  * debian/squid.rc
+    - Added db_stop call before invoke-rc.d (Closes: #294866)
+
+ -- Luigi Gangitano <luigi@debian.org>  Sat, 12 Feb 2005 18:14:34 +0100
+
+squid (2.5.8-1) unstable; urgency=low
+
+  * New upstream release
+    - removed patches that have been integrated upstream:
+      debian/patches/23-deny-internal-object-purge
+      debian/patches/24-gopher-html-parsing
+      debian/patches/25-wccp-dos
+      debian/patches/26-dns-memleak
+      debian/patches/27-ldap-spaces
+      debian/patches/28-fakeauth-memleak
+      debian/patches/29-fqdn-truncated
+      debian/patches/31-wccp-buffer-overflow
+      debian/patches/32-response-splitting
+      debian/patches/33-header-parsing
+      debian/patches/34-oversize-reply-header
+      debian/patches/35-empty-acl
+
+    - Fixed 100% CPU usage on half closed PUT/POST requests
+      (Closes: #294551)
+
+  * debian/squid.rc
+    - Applied patch from Thomas Hood to improve initscript output
+      (Closes: #294465)
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri, 11 Feb 2005 18:33:13 +0100
+
+squid (2.5.7-8) unstable; urgency=high
+
+  * Urgency high due security fixes, previous version not yet in sarge and
+    this version makes just a litte change to dependencies
+  
+  * debian/control 
+    - Added versioned depends on the same version of squid-common
+      (Closes: #293552, #293626)
+
+ -- Luigi Gangitano <luigi@debian.org>  Sat,  5 Feb 2005 01:52:03 +0100
+
+squid (2.5.7-7) unstable; urgency=high
+
+  * Urgency high due security fixes
+
+  * debian/patches/34-oversize-reply-header.dpatch
+    - Added upstream patch to correct HTTP protocol mismatch introduced
+      by the header-parsing patch
+      (Ref: CAN-2005-0241)
+
+  * debian/patches/35-empty-acl.dpatch
+    - Added upstream patch to fix minor security issues with 'empty' acls
+      (Ref: CAN-2005-0194)
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue,  1 Feb 2005 18:00:16 +0100
+
+squid (2.5.7-6) unstable; urgency=high
+
+  * Urgency high due security fixes
+
+  * debian/patches/01-cf.data.pre
+    - Explicitly set hosts_file to /etc/hosts (Closes: #185555)
+
+  * debian/patches/31-wccp-buffer-overflow.dpatch
+    - Added upstream patch that fixes BoF in WCCP recvfrom()
+      (Ref: CAN-2005-0211)
+
+  * debian/patches/32-response-splitting.dpatch
+    - Added upstream patch that fixes HTTP response splitting cache pollution
+      (Ref: CAN-2005-0175)
+
+  * debian/patches/33-header-parsing.dpatch
+    - Added upstream patch to reject malformed HTTP requests and responses
+      (Ref: CAN-2005-0174)
+
+ -- Luigi Gangitano <luigi@debian.org>  Sat, 29 Jan 2005 17:44:49 +0100
+
+squid (2.5.7-5) unstable; urgency=high
+
+  * Urgency high due security fixes
+
+  * Updated references in changelog to CAN advisories
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 18 Jan 2005 22:40:19 +0100
+
+squid (2.5.7-4) unstable; urgency=low
+
+  * "A round of upstream patches" release
+
+  * debian/patches/24-gopher-html-parsing
+    - Added upstream patch that fixes BoF in gopherToHTML()
+      (Ref: CAN-2005-0094)
+    
+  * debian/patches/25-wccp-dos
+    - Added upstream patch that fixes DoS in WCCP message handling
+      (Ref: CAN-2005-0095)
+
+  * debian/patches/26-dns-memleak
+    - Added upstream patch that fixes memory leak in internal DNS resolver
+
+  * debian/patches/27-ldap-spaces
+    - Added upstream patch that fixes minor security issues in LDAP account
+      handling
+      (Ref: CAN-2005-0173)
+
+  * debian/patches/28-fakeauth-memleak
+    - Added upstream patch that fixes memory leak in fakeauth NTLM helper
+
+  * debian/patches/29-fqdn-truncated
+    - Added upstream patch that fixes name truncation in compressed DNS
+      responses
+
+  * debian/patches/30-amd64-gcc40-compile
+    - Added patch to compile squid on AMD64 with GCC-4.0 (Closes: #288542)
+  
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 17 Jan 2005 18:15:49 +0100
+
+squid (2.5.7-3) unstable; urgency=low
+
+  * debian/patches/07-manpage
+    - Removed, since now the config file is in /etc/squid
+      (Closes: #284791)
+
+  * debian/patches/23-deny-internal-object-purge
+    - Added upstream patch that fixes internal object expiry
+      (Closes: #75468)
+
+  * debian/po/de.po
+    - Updated German debconf translation (thanks to Jens Nachtigall)
+      (Closes: #283848)
+    
+  * debian/po/nl.po
+    - Updated Dutch debconf translation (thanks to Luk Claes)
+      (Closes: #281563)
+
+ -- Luigi Gangitano <luigi@debian.org>  Sat, 11 Dec 2004 16:37:23 +0100
+
+squid (2.5.7-2) unstable; urgency=low
+
+  * debian/watch
+    - Added debian watch file
+
+  * debian/po/fr.po
+    - Updated French debconf translation (thanks to Christian Perrier)
+      (Closes: #279304)
+
+  * debian/rules
+    - Added wbinfo_group external acl (Closes: #280895)
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu, 28 Oct 2004 16:02:46 +0200
+
+squid (2.5.7-1) unstable; urgency=medium
+
+  * Urgency medium due to security issues
+  
+  * New upstream release
+    - removed patches that have been integrated upstream:
+      debian/patches/17-head
+      debian/patches/18-no-valid-dir
+      debian/patches/19-heap-segfault
+      debian/patches/20-ntlm-fetch-string
+      debian/patches/21-ntlm-noreuse-leak
+    
+    - Fixes Denial of Service in SNMP asn_parse_header module
+      (Ref: CAN-2004-0918)
+      
+  * debian/po/nl.po
+    - Updated Dutch debconf translation (Thanks to Luk Claes)
+      (Closes: #277763)
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri, 22 Oct 2004 17:24:58 +0200
+
+squid (2.5.6-11) unstable; urgency=medium
+
+  * Urgency still medium due to RC bug fix in squid-cgi
+
+  * debian/templates
+    - Applied patch to fix typos (thanks to Jens Nachtingal)
+      (Closes: #275524)
+  
+  * debian/po/de.po
+    - Updated german debconf translation (thanks to Jens Nachtingall)
+      (Closes: #275523)
+
+  * debian/control
+    - Fix versioned build-depend on dpatch to fix FTBFS on alpha and sparc
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu,  7 Oct 2004 20:36:55 +0200
+
+squid (2.5.6-10) unstable; urgency=medium
+
+  * Urgency medium due to RC bug fix in squid-cgi
+
+  * debian/patches/22-cachemgr-acl
+    - Reworked code flow (thanks to Martin Schulze)
+
+  * debian/cachemgr.conf
+    - Added comments at the start (again, thanks to Martin Schulze)
+
+  * debian/control
+    - Add version to build-depend on dpatch to fix FTBFS on alpha and sparc
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu,  7 Oct 2004 18:16:53 +0200
+
+squid (2.5.6-9) unstable; urgency=medium
+
+  * Urgency medium due to RC bug fix in squid-cgi
+
+  * debian/patches/22-cachemgr-acl
+    - Added config file (/etc/squid/cachemgr.conf) checking to cachemgr.cgi
+      (Closes for sid/sarge: #133131)
+      Ref: CAN-2004-0913
+  
+  * debian/cachemgr.conf
+    - Added default configuration file for squid-cgi
+
+  * debian/templates
+    - Modified squid-cgi template with informations on the new config
+      file format
+  
+  * debian/po/it.po
+    - Updated italian debconf translation
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed,  6 Oct 2004 19:47:19 +0200
+
+squid (2.5.6-8) unstable; urgency=medium
+
+  * Urgency medium due to DoS fix in ntlm_auth (this should really make it
+    into sarge)
+
+  * debian/po/fr.po
+    Updated French translation (Closes: #267577)
+
+  * debian/po/pt_BR.po
+    Updated Brazilian Portuguese translation (Closes: #267187)
+
+  * debian/patches/20-ntlm-fetch-string
+    Added upstream patch that fixes DoS in ntlm authentication
+    (http://www.squid-cache.org/bugs/show_bug.cgi?id=1045)
+    Ref: CAN-2004-0832
+
+  * debian/patches/21-ntlm-noreuse-leak
+    Added upstream patch that fixes memory leak in ntlm authentication
+    with challenge reuse disabled
+
+ -- Luigi Gangitano <luigi@debian.org>  Sat, 28 Aug 2004 18:24:13 +0200
+
+squid (2.5.6-7) unstable; urgency=medium
+
+  * I should have checked upstream patches before -6 upload
+
+  * Still urgency medium because of grave bug and upcoming sarge freeze.
+
+  * debian/patches/19-heap-segfault
+    - Added upstream patches to fix segfaults with heap replacement policy
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon,  9 Aug 2004 17:56:06 +0200
+
+squid (2.5.6-6) unstable; urgency=medium
+
+  * Urgency medium because of grave bug and upcoming sarge freeze.
+
+  * debian/config
+    - Fix access to config file if config file does not exist
+      (Closes: #264595)
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon,  9 Aug 2004 17:36:20 +0200
+
+squid (2.5.6-5) unstable; urgency=low
+
+  * debian/patches/18-no-valid-dir
+    - Added upstream patch to fix invalid store with ufs
+
+  * debian/{templates,postinst,config,squid.rc}
+    - Added debconf question asking user to confirm before changing
+      owner/group of cache_dir (Closes: #259541)
+    - Removed permission fix from rc script. Will check only on upgrades
+      to avoid messing up filesystem when administrator selects wrong
+      values for cache_dir (See #259541 for an example)
+
+  * debian/squid.rc
+    - Added support for CHUID in start-stop-daemon (Closes: #137122). Beware
+      of /etc/squid/squid.conf permissions if you use it!
+
+  * debian/po/it.po
+    - Added italian debconf translation
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed,  4 Aug 2004 15:11:12 +0200
+
+squid (2.5.6-4) unstable; urgency=low
+
+  * debian/patches/17-head
+    - Added upstream patch to fix stale informations returned on HEAD request
+      (Closes: #222499)
+
+  * debian/patches/09-enable-large-files
+    - Re-enable upstream support for logfiles bigger than 2GB. If no side
+      effect shows up in a short time I'll close the bug (229327).
+
+  * debian/preinst
+    - Removed warning for logfiles bigger than 2GB.
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed,  4 Aug 2004 14:06:52 +0200
+
+squid (2.5.6-3) unstable; urgency=low
+
+  * debian/control
+    - Added dependency on coreutils to be abel to use /usr/bin/stat in postinst
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 13 Jul 2004 16:56:30 +0200
+
+squid (2.5.6-2) unstable; urgency=low
+
+  * debian/postinst
+    - chown directories only if actual owernship doesn't match configfile
+    (Closes: #259217)
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 13 Jul 2004 15:56:16 +0200
+
+squid (2.5.6-1) unstable; urgency=low
+
+  * New Upstream Release
+    - removed patches that have been integrated upstream:
+      debian/patches/16-range-offset-limit
+      debian/patches/15-dns-localhost
+      debian/patches/14-proxy-abuse
+      debian/patches/13-ntlm-overflow
+      debian/patches/12-post-assert
+      debian/patches/11-digest-blank
+      debian/patches/10-ntlm-assert
+
+ -- Luigi Gangitano <luigi@debian.org>  Sun, 11 Jul 2004 21:57:48 +0200
+
+squid (2.5.5-7) unstable; urgency=low
+
+  * debian/patches/13-ntlm-overflow
+    - Updated to officially released upstrem patch (Closes: #256666)
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 28 Jun 2004 20:10:39 +0200
+
+squid (2.5.5-6) unstable; urgency=low
+
+  * debian/{squid.rc,postinst}
+    - Fixed permissions on files when upgrading/starting squid. Now it
+      uses cache_effective_user and cache_effective_group (Closes: #249292)
+
+  * debian/patches/15-dns-localhost
+    - Added upstram patch for missing /etc/resolf.conf (Closes: #222262)
+
+  * debian/patches/16-range-offset-limit
+    - Added upstram patch for -1 values in config (Closes: #242141)
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri, 18 Jun 2004 18:30:33 +0200
+
+squid (2.5.5-5) unstable; urgency=high
+
+  * Urgency high because of security patch
+
+  * debian/patches/13-ntlm-overflow
+    - Fix for CAN-2004-0541 (Closes: #253406)
+
+  * debian/patches/14-proxy-abuse
+    - Added ustream patch for segmentation fault while writing cache.log
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu, 10 Jun 2004 00:17:39 +0200
+
+squid (2.5.5-4) unstable; urgency=low
+
+  * debian/control
+    - Removed depdendecies on libssl-dev (linking GPL with SSL is not free)
+      (Closes: #251988)
+
+  * debian/rules
+    - Removed --enable-ssl from configure
+    - Added --enable-carp to configure (Closes: #180884)
+
+  * debian/{preinst,postrm,postinst}
+    - Moved configuration directory to /etc/squid (Closes: #83821)
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue,  1 Jun 2004 23:30:32 +0200
+
+squid (2.5.5-3) unstable; urgency=low
+
+  * The 'Thanks to Robert Collins' Release
+
+  * debian/patches/12-post-assert
+    - Added upstream patch to fix assertion failure in rare POST/PUT 
+      conditions (Closes: #251702)
+
+  * debian/control
+    - Added dependencies on libssl-dev
+
+  * debian/rules
+    - Added --enable-ssl to configure (Closes: #180886)
+
+  * debian/templates
+    - Fixed default for old_version question
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 31 May 2004 22:15:15 +0200
+
+squid (2.5.5-2) unstable; urgency=low
+
+  * debian/control
+    - Added Suggest: on smbclient (Closes: #240316)
+
+  * debian/patches/10-ntlm-assert.dpatch
+    - Added upstream patch to fix assert failure in ntlm_auth (Closes: #243540)
+
+  * debian/patches/11-digest-blank
+    - Added upstream patch to fix segmentation fault in digest authentication
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 19 Apr 2004 16:27:53 +0200
+
+squid (2.5.5-1) unstable; urgency=low
+
+  * New upstream release
+    - Integrated redirect login space patch
+
+  * debian/control
+    - Added Suggest: on winbind >= 3.0.2
+
+  * debian/patches/01-cf.data.debian.dpatch
+    - Updated path to helpers
+    - Added note about ntlm_auth and Samba 3
+
+  * debian/patches/08-redirect_login_space.dpatch
+    - Removed since this patch has been integrated upstream
+
+  * debian/po/es.po
+  	- Added Spanish translation (Closes: #238024)
+
+  * debian/po/fr.po
+  	- Updated French translation (Closes: #238015)
+
+  * debian/po/ja.po
+    - Updated Japanese translation (Closes: #237788)
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 23 Mar 2004 17:25:16 +0100
+
+squid (2.5.4-5) unstable; urgency=low
+
+  * debian/patches/09-enable-large-files.dpatch
+    - Removed since side effects on file-related structures is not 
+      verified
+
+  * debian/control
+    - Split arch-independent files to squid-common (Closes: #233442)
+
+  * debian/templates
+    - Fixed reference to example squid.conf (Closes: #228390)
+    - Added warning for logfiles bigger than 2GB
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 17 Feb 2004 14:20:28 +0100
+
+squid (2.5.4-4) unstable; urgency=low
+
+  * debian/patches/09-enable-large-files.dpatch
+    - Added upstream CVS patch to enable logfiles > 2GB
+
+  * debian/rules
+    - Added --enable-large-files option to configure
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed,  4 Feb 2004 14:23:12 +0100
+
+squid (2.5.4-3) unstable; urgency=low
+
+  * debian/po/pt_BR.po
+    - Updated translation (Closes: #220909)
+  * debian/po/ru.po
+    - Updated translation (Closes: #219261)
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri,  5 Dec 2003 02:10:56 +0100
+
+squid (2.5.4-2) unstable; urgency=low
+
+  * The 'Look at BTS before upload' release
+  * debian/patches/08-redirect_login_space.dpatch
+    - Added upstream patch to fix auth names with space characters
+      (Closes: #212639)
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu, 25 Sep 2003 00:50:05 +0200
+
+squid (2.5.4-1) unstable; urgency=low
+
+  * The 'Cake' release
+  * New upstream release
+    - Added Spanish ERR_TOO_BIG translation (Closes: 143052)
+    - Integrated upstream patch 08-deny-info
+  * debian/po/fr.po
+  	- Updated (Closes: #211812)
+  * debian/po/ja.po
+    - Added Japanese translation (Closes: #211965)
+  * debian/control
+    - Bumped Standard-Version to 3.6.1.0 (no not-debconf user interaction
+      was used, so no change needed)
+
+ -- Luigi Gangitano <luigi@debian.org>  Thu, 25 Sep 2003 00:31:02 +0200
+
+squid (2.5.3-8) unstable; urgency=low
+
+  * debian/postinst
+    - Added checks for unsupported anonymize_headers and fake_user_agent
+      options in config file (Closes: #187510)
+  * debian/templates
+    - Added note about unsupported anonymize_headers and fake_user_agent
+      options in config file
+  * debian/squid.rc
+    - Added check for cache_dir hierarchy and reconstruct it if missing
+      (this is on the road to solve #146472, please provide feedback)
+  * debian/conffiles
+    - Added resolvconf script
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue,  9 Sep 2003 17:20:36 +0200
+
+squid (2.5.3-7) unstable; urgency=low
+
+  * debian/squid.resolvconf
+    - Added support for resolvconf (Closes: #200572)
+  * debian/rules
+    - Install file in /etc/resolvconf/update-libc.d
+  * debian/po/nl.po
+    - Added dutch debconf translation (Closes: #208239)
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue,  9 Sep 2003 00:39:52 +0200
+
+squid (2.5.3-6) unstable; urgency=low
+
+  * debian/patches/08-deny_info.dpatch
+    - Upstream patch fixes segmentation fault when multiple deny_info
+      messages are defined in config file (Closes: #203946)
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 18 Aug 2003 19:27:46 +0200
+
+squid (2.5.3-5) unstable; urgency=low
+
+  * debian/control
+    - Bumped Standard-Version to 3.6.0
+  * debian/changelog
+    - Converted to UTF-8 to comply with Standard-Version 3.6.0
+  * debian/patches/01-cf.data.debian.dpatch
+    - Fixed auth_paras paths in examples (Closes: #205222)
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 18 Ago 2003 19:08:47 +0200
+
+squid (2.5.3-4) unstable; urgency=low
+
+  * Switch to gettext for debconf templates (Closes: #202271)
+  * debian/control
+    - Added Build-Depend on po-debconf
+  * debian/rules
+    - Handle templates merging
+  * debian/po/
+    - Moved translations from debian/templates (via debconf-gettextize)
+  * debian/po/fr.po
+    - Added French template translation (Closes: #202272)
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 21 Jul 2003 16:20:31 +0200
+
+squid (2.5.3-3) unstable; urgency=low
+
+  * debian/rules
+    - fixed configuration options to build null store module on hurd and not
+      aufs.
+  * debian/postinst
+    - use invoke-rc.d instead of starting squid via /etc/init.d/squid
+      (Closes: #200096)
+  * debian/patches/07-manpage
+    - Fixed wrong reference to /etc/squid/squid.conf (Closes: #200081)
+  * debian/README.Debian
+    - Clean up and resync with the current configuration.
+    - Added a note about the example file (Closes: #190970)
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon,  7 Jul 2003 18:36:20 +0200
+
+squid (2.5.3-2) unstable; urgency=low
+
+  * debian/rules
+    - added config option to enable digest and ntlm authentication 
+      (Closes: #188303)
+    - added config option to enable null and aufs store modules
+      (Closes: #160028)
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri,  4 Jul 2003 17:28:33 +0200
+
+squid (2.5.3-1) unstable; urgency=low
+
+  * New upstream release
+  * debian/patches/07-ldap_auth_unavailable:
+    - Removed, patch has been integrated upstream
+  * debian/control:
+    - Bumped Standar-Version to 3.5.10 (no change needed)
+
+ -- Luigi Gangitano <luigi@debian.org>  Sat, 31 May 2003 18:25:27 +0200
+
+squid (2.5.2-2) unstable; urgency=low
+
+  * debian/control:
+    - Added versioned depend on debconf
+  * debian/patches/07-ldap_auth_unavailable
+    - Added patch to fix ldap_auth helper crash if LDAP server is
+      unreachable (closes: #186540)
+
+ -- Luigi Gangitano <luigi@debian.org>  Fri, 21 Mar 2003 13:30:31 +0100
+
+squid (2.5.2-1) unstable; urgency=low
+
+  * New upstream release
+  * Bumped Standard-Version to 3.5.9
+
+ -- Luigi Gangitano <luigi@debian.org>  Tue, 18 Mar 2003 15:24:34 +0100
+
+squid (2.5.1-8) unstable; urgency=low
+
+  * Fixed permissions of sample config file (closes: #153649)
+  * Use dpatch to handle patches.
+  * Fixed missing Section and Priority fields in packages.
+  * Added Suggests for logcheck-database. (closes: #125799)
+  * Updated FAQs.
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed, 12 Mar 2003 19:49:02 +0100
+
+squid (2.5.1-7) unstable; urgency=low
+
+  * Fixed README.Debian with new configuration
+  * Updated patches in debian/patches
+
+ -- Luigi Gangitano <luigi@debian.org>  Sun,  9 Mar 2003 20:21:48 +0100
+
+squid (2.5.1-6) unstable; urgency=low
+
+  * Upload to unstable (closes: #162832)
+  * Fixed typo in template
+
+ -- Luigi Gangitano <luigi@debian.org>  Sun,  9 Mar 2003 19:30:49 +0100
+
+squid (2.5.1-5) experimental; urgency=low
+
+  * Set ac_cv_func_setresuid to yes for any arch than sparc (fixes: #171245)
+  * Commented default auth_param settings from default configfile
+  * Added a debconf warning about new authentication directives
+  * Not published
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon, 13 Jan 2003 16:26:57 +0100
+
+squid (2.5.1-4) experimental; urgency=low
+
+  * /etc/init.d/squid cleanup (closes: #153626, #156752)
+  * Authentication helpers added:
+    - digest_auth: password
+    - external_acl: ip_user, ldap_group, unix_group, winbind_group
+    - ntlm_auth: SMB, winbind
+  * CONFIG FILE FORMAT STILL INCOMPATIBLE WITH 2.4.x
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed, 18 Dec 2002 22:23:52 +0100
+
+squid (2.5.1-3) experimental; urgency=low
+
+  * Moving read-only non-architecture specific file to /usr/share/squid
+  * Got the example config file back in place.
+  * Updated lintian override
+  * Authentication helpers added:
+    - basic_auth: YP, MSNT, winbind
+  * CONFIG FILE FORMAT STILL INCOMPATIBLE WITH 2.4.x
+
+ -- Luigi Gangitano <luigi@debian.org>  Wed, 11 Dec 2002 23:50:34 +0100
+
+squid (2.5.1-2) experimental; urgency=low
+
+  * Taking over squid with Miquel's approval
+  * Cleaning scripts (/usr/doc links removal, etc...) for subsequent
+    config file incompatibility handling. Please be patient.
+  * CONFIG FILE FORMAT STILL INCOMPATIBLE WITH 2.4.x
+  * Bump Standars-Version to 3.5.8
+  * Removing custom man page for squid.8 (upstream provides one...)
+
+ -- Luigi Gangitano <luigi@debian.org>  Mon,  2 Dec 2002 00:21:40 +0100
+
+squid (2.5.1-1) experimental; urgency=low
+
+  * Experimental 2.5 version. A lot has changed in the config
+    file again; see http://www.squid-cache.org/Versions/v2/2.5/ \
+        squid-2.5.STABLE1-RELEASENOTES.html
+    for more info. We need to either fix this automatically or
+    inform the user about it, but this version doesn't do it yet.
+  * Once more: INCOMPATIBLE CONFIG FILE FORMAT CHANGES !!
+  * FAQ needs to be updated I guess
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue, 29 Oct 2002 11:01:56 +0100
+
+squid (2.4.7-1) unstable; urgency=high
+
+  * New upstream release, fixes ftp/gopher buffer overflows.
+  * Enable ARP ACL support (fixes: #149312)
+  * Move examples back to /usr/share/doc/squid/examples.
+    Why put them in *&^*&^ /usr/share/squid ? No-one is going
+    to find them there. It broke postinst as well (fixes: #151657)
+  * Add localhost ACL to defaults, so that after installation
+    localhost is allowed to use the cache.
+  * Add 631 (cups) to Safe_ports (fixes: #150524)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu,  4 Jul 2002 14:03:16 +0200
+
+squid (2.4.6-1woody1) woody-proposed-updates; urgency=medium
+
+  * Eduard Bloch: NMU, blessed by maintainer
+  * Eduard Bloch: Changed default permissions of squid.conf to 600, 
+  closes: #122563
+  * Eduard Bloch: New debconf question to ask before making changes in squid.conf,
+  closes: #144255
+  * Eduard Bloch: changed expression not working with recent bash version, 
+  potential FTBFS..
+  * Eduard Bloch: make debconf-notice urgency=high
+  * Martin Loschwitz: debian/control: updated Standards-Version to 3.5.6.0
+  * Martin Loschwitz: Fix the debconf-thingie for #144255
+  * Martin Loschwitz: fixed some lintian warnings
+  * Martin Loschwitz: removed squid.conf from debian/conffiles
+
+ -- Martin Loschwitz <madkiss@madkiss.org>  Thu, 30 May 2002 22:29:00 +0200
+
+squid (2.4.6-1) unstable; urgency=high
+
+  * New upstream version (2.4.5 was never released) that fixes a
+    security bug in the built-in DNS resolver.
+  * Turn off setresuid code again - on certain platforms (sparc) with
+    a 2.2 glibc and a 2.2 kernel it fails at runtime (?!) (closes: #137262)
+  * Fix PAM ttl bug (was fixed in 2.4.4, actually) (closes: #128692)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon, 25 Mar 2002 15:47:34 +0100
+
+squid (2.4.4-1) unstable; urgency=high
+
+  * New upstream version with the "Coredup on certain ftp:// style URL's"
+    security fix. This version also fixes a memory leak in the SNMP code and
+    fixes in SNMP code are always good, certainly right now (closes: #134574)
+  * dropped htcp-off patch, now integrated in mainline.
+  * Set LC_ALL=POSIX in debian/rules (closes: #130231)
+  * Fix regexp in smb_auth.sh to read correct field from nmblookup
+    even if a wins server is defined in smb.conf (closes: #131300)
+  * Fix crash in debug.c when debug_options set to 11,3 (closes: #129262)
+  * remove duplicate diskd_program in src/cf.data.pre (closes: #124300)
+  * Add webdav SEARCH support (closes: #128693)
+  * Add Russian templates (closes: #114863)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue, 19 Feb 2002 13:35:47 +0100
+
+squid (2.4.3-2) unstable; urgency=medium
+
+  * Change pipeline debug level in pipeline-shutup.patch to 2 instead
+    of 3 to match the upcoming squid-2.5
+  * Take out icp_hit_stale.patch. It's not needed anymore, it has been
+    replaced by the "allow-miss" cache_peer option
+  * Change unlinkd to run for diskd too. In the future (2.5, 2.6?)
+    aufs might start to use unlinkd as well so then the entire
+    unlinkd.patch must be dropped.
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu, 13 Dec 2001 12:57:11 +0100
+
+squid (2.4.3-1) unstable; urgency=medium
+
+  * Add http://www.ircache.net/cgi-bin/cacheability.py to README.Debian
+  * Upgrade to 2.4.STABLE3 which fixes some filedescriptor leakage
+    and on-disk metadata corruption
+  * Compile with netfilter support for 2.4 kernels
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu, 29 Nov 2001 16:09:58 +0100
+
+squid (2.4.2-1) unstable; urgency=high
+
+  * Fix possible DOS attack on squid (closes: #113344)
+  * Fix build problems on Hurd (no pthreads) (closes: #108605)
+  * Update to latest version in stable series (2.4.STABLE2)
+  * Set umask to 027 in /etc/init.d/squid file, so that logfiles
+    and datafiles aren't created world-readable (closes: #107073)
+  * logrotate now shuts up if squid isn't running (closes: #105543)
+  * Install pam_auth module executable by user proxy, setgid shadow
+    so that it can read shadow password files (closes: #98694)
+  * Add brazilian debconf translation (closes: #105288)
+  * Drop LDAP searchbase patch - something similar is now included
+    in the upstream. Unfortunately with an incompatible syntax,
+    the debian patch uses "ldapauth server searchbase" the new
+    syntax is now "ldapauth -b searchbase server".
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon,  1 Oct 2001 14:52:38 +0200
+
+squid (2.4.1-6) unstable; urgency=low
+
+  * Add port 901 (SWAT) to Safe_ports (closes: #99384)
+  * Add "sharedscripts" to logrotate script (closes: #99356, #99230)
+  * Fix type in config file (closes: #98992)
+  * Update manpage (closes: #98294)
+  * Update usage summary in src/main.c (closes: #98293)
+  * Up max# of file descriptors in squid to 4096 (closes: #102483)
+  * Let squid-cgi depend on httpd|webmin-squid (closes: 100769)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue,  3 Jul 2001 15:33:54 +0200
+
+squid (2.4.1-5) unstable; urgency=low
+
+  * Fix prerotate script in logrotate file (closes: #97247)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon, 14 May 2001 13:12:30 +0200
+
+squid (2.4.1-4) unstable; urgency=low
+
+  * Applied the patches from http://www.squid-cache.org/Versions/v2/2.4/bugs/
+  * Call sarg-maint in prerotate (closes: #93352). Also now conflicts
+    with sarg (<< 1.1.1-2) so that a sarg update is forced.
+  * Added German translation to debconf templates (closes: #93838)
+  * Compile with referer and useragent log (closes: #95094)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue,  8 May 2001 13:47:18 +0200
+
+squid (2.4.1-3) unstable; urgency=low
+
+  * Now that pipelining is turned back on, "apt" is using it heavily
+    and that results in debugging garbage in the logfiles. Added
+    a patch ("pipeline-shutup.patch") to turn that off (closes: #91213)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue, 27 Mar 2001 17:17:35 +0200
+
+squid (2.4.1-2) unstable; urgency=low
+
+  * Added libpam0g-dev to Build-Depends (closes: #90935)
+  * Added Depends: on logrotate, fix logrotate script (squid -k rotate)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon, 26 Mar 2001 23:06:40 +0200
+
+squid (2.4.1-1) unstable; urgency=low
+
+  * New upstream release.
+  * Uses mkstemp (closes: #82758)
+  * Start using debconf
+  * Removed while loop from RunCache
+  * Check squid.conf for 2.1/2.2 stuff and upgrade (closes: #87754)
+  * Build with --enable-removal-policies=lru,heap (closes: #79205)
+  * Use logrotate instead of home-brew cron script
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Fri, 23 Mar 2001 04:43:44 +0100
+
+squid (2.3.4-2) unstable; urgency=low
+
+  * Add "exit 0" to cron.daily script (closes: #76734)
+  * By default allow cache access to clients from localhost (closes: #60850)
+  * Add customized LDAP module (closes: #68352).
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon, 27 Nov 2000 18:02:39 +0100
+
+squid (2.3.4-1) unstable; urgency=low
+
+  * Take the plunge and update to 2.3.STABLE4 even though Henrik
+    Nordstrom says he doesn't really trust it. Time will tell I guess.
+    Anyway it isn't that big an issue for woody. Hopefully 2.4 will
+    be released in time for woody. (closes: #60409)
+  * Applied squid-2.3.DEVEL3.httpd_accel_single_host-2.patch
+  * Applied squid-2.3.STABLE4-hno.20000819.patch
+  * Don't use append_domain for "localhost" (closes: #55974)
+  * Include some redirector examples (closes: #58767)
+  * Turn off pinger (closes: #65490)
+  * netdbExchangeHandleReply() fixed by new upstream version (closes: #66124)
+  * Apply icp_hit_stale patch by herbert@gondor.apana.org.au (closes: #67251)
+  * Read SMBPASS with read -r in smb_auth.sh (closes: #67418)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu,  9 Nov 2000 17:45:06 +0100
+
+squid (2.2.5-3) frozen unstable; urgency=medium
+
+  * With a 2.2.14 kernel, the Alpha version works fine
+    (closes: #45003,#45036,#45043)
+  * Squid using only a few dirs is normal (closes: #49282)
+  * Syslog as LOG_DAEMON instead of LOCAL4, also delete LOG_CONSOLE
+    (closes: #53163)
+  * Remove comment in sample squid.conf about setting dns_children to 0
+    (closes: #54568)
+  * Fix postinst (closes: #54692)
+  * New /etc/init.d/squid that doesn't use RunCache (closes: #55315)
+  * Always use httpd_accel_host even if httpd_accel_uses_host_header is set
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed,  2 Feb 2000 20:43:28 +0100
+
+squid (2.2.5-2) unstable; urgency=low
+
+  * Fix potential security bug. When using external authenticators
+    sometimes a user could get access to sites he shouldn't have access
+    to. Applied squid-2.2.stable5-newlines_in_auth.patch (closes: #49756)
+  * Also applied squid-2.2.stable5-ipcache_negative.patch
+  * And squid-2.2.stable5-no_cache.patch
+  * And squid-2.2.STABLE5.ignore_host_header.patch (closes: #50292)
+  * Added paragraph about unautorized use of squid-cgi to README.cachemgr
+  * Set SHELL to /bin/bash in debian/rules (closes: #50551)
+  * init.d script now greps squid.conf for cache_dir (closes: #47247)
+  * Enabled cache digests (closes: #47292, #47293)
+  * Use unlink() instead of safeunlink to remove pidfile (closes: #40501)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Sat, 20 Nov 1999 15:20:20 +0100
+    
+squid (2.2.5-1) unstable; urgency=low
+
+  * New upstream release
+  * enable USE_PROPER_MUTEX in src/aiops.c as per recommendation
+    of Henrik Nordstrom (see also debian/proper-mutex.patch).
+  * Use poll() instead of select()
+  * Add README.Debian (closes: #38592)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu,  7 Oct 1999 13:25:33 +0200
+
+squid (2.2.4-1) unstable; urgency=low
+
+  * New upstream version.
+  * Fixes bugs:
+    #40418: squid: cannot compile from source
+    #41098: cron jobs (squid)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed, 14 Jul 1999 14:46:11 +0200
+
+squid (2.2.3-1) unstable; urgency=low
+
+  * New upstream version.
+  * Enable delay pools option
+  * Fixes bugs:
+    #36899: squid: DEFAULT_SQUID_ERROR_DIR (defines.h)
+    #37077: squid: getpwnam authmodule missing
+    #37488: squid: htcp_port
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Fri, 28 May 1999 12:09:14 +0200
+
+squid (2.2.2-1) unstable; urgency=low
+
+  * New upstream version.
+  * Fixes bugs:
+    #36267 squid: cron.daily/squid still exists after package removal
+    #36029 squid: Please reenable snmp support
+    #34909 Squid's cron job seems to break policy 4.4
+    #36013: squid: authentication modules
+    #32203 squid: squid crashes when prefetching http 1.1 pipelined requests
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed, 21 Apr 1999 11:41:55 +0200
+
+squid (2.1.2-1) frozen unstable; urgency=medium
+
+  * Includes squid-2.1.PATCH2-clientHandleIMSReply-leak.patch
+  * Fix include/autoconf.h after configure, so that HAVE_SETRESUID is
+    set to 0 again (ugh, libc6 is broken, and the squid workaround
+    is broken too ....)
+  * Make "pinger" program setuid root.
+  * Rewrote /etc/init.d/squid and RunCache
+  * Warn in postinst for squid.conf defaults
+  * Upload to both frozen and unstable, since I fixed a lot of
+    long-standing bugs with this release.
+  * Fixes:
+    #22586: Permissions on logfiles [was: Re: Suggestion for Squid]
+    #23427: start/stop script provides no means to add cmd line options to squid
+    #27804: squid: depends on libc >= 2.0.7u
+    #30436: default /etc/squid.conf file rejects connections from all machines.
+    #30802: man page glitches
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu, 17 Dec 1998 13:32:04 +0100
+
+squid (2.1.1-1) unstable; urgency=low
+
+  * New upstream version
+  * Added latest FAQ
+  * Added patch for "ftp site full" bug
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed,  2 Dec 1998 17:48:03 +0100
+
+squid (2.0.2-1) unstable; urgency=low
+
+  * Upgraded to 2.0.PATCH2
+  * Added -N option to squid invocation in RunCache
+  * Added latest FAQ, updated all other docs for squid-2.0
+  * Compiled without SNMP support
+  * Fixes:
+    #27905: squid spreads out an error
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed, 14 Oct 1998 15:08:45 +0200
+
+squid (2.0-1) unstable; urgency=low
+
+  * Official release version.
+  * Added a small patch/hack to allow spaces in URLs
+  * Changed default start level to 30 to at least accomodate
+    msqld (see Bug#27660) a bit
+  * Fixes squid-1.2 bugs:
+    #20357: squid: Bashism
+    #21601: squid: doesn't wait long enough when stopping
+    #23232: squid: RunCache doesn't close stdin, stdout, or stderr
+    #27444: squid repeats an error message nearly endless
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu,  8 Oct 1998 23:24:28 +0200
+
+squid (1.2-beta25-1) experimental; urgency=low
+
+  * New upstream version
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Sat, 26 Sep 1998 11:49:35 +0200
+
+squid (1.2-beta23-1) experimental; urgency=low
+
+  * New upstream version
+  * Added patch sets 1, 2 and 3
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu, 30 Jul 1998 18:05:34 +0200
+
+squid (1.2-beta22-2) experimental; urgency=low
+
+  * Fix logfile rotation problem
+  * Added squid-1.2.beta22.aio_fd_leak.patch from Henrik NordstrÃ¶m,
+    see http://hem.passagen.se/hno/squid/
+  * Use SIGQUIT/SIGTRAP instead of USR1/USR2 which are reserved
+    for LinuxThreads
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon,  6 Jul 1998 14:26:20 +0200
+
+squid (1.2-beta22-1) experimental; urgency=low
+
+  * Experimental beta version.
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu,  4 Jun 1998 17:20:01 +0200
+
+squid (1.1.21-1) frozen unstable; urgency=medium
+
+  * New bugfix-only upstream release
+  * Added latest FAQ
+  * Updated squidclient manual page
+  * Lintian-clean
+  * Fixes bugs:
+    #18428: squid: it possible to bypass ACLs
+    #17719: squid-cgi: /usr/doc/squid-cgi/copyright.gz should not be gzipped
+    #18168: squid-novm: documentation request
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Fri, 20 Mar 1998 13:55:08 +0100
+
+(1.1.20-2) unstable; urgency=low
+
+  * Now really fixed #16863: squid: does not recognize Host: header
+  * Added /usr/doc/squid/README.transparent-proxy
+  * Fixes:
+    #17057: squid: squid still does not recognize hosts: header
+    #14489: /usr/doc/$(PACKAGE)/copyright should not be compressed
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed, 21 Jan 1998 16:22:44 +0100
+
+squid (1.1.20-1) unstable; urgency=low
+
+  * New upstream version.
+  * Rewrote squid manpage, added squid-cgi manpage
+  * Now includes HTML FAQ
+  * Fixed bugs:
+    #16864: squid-cgi: Variety of issues
+    #16451: squid: /etc/cron.daily/squid is installed without execute permissio
+    #16716: squid: executable bit missing on /etc/cron.daily/squid
+    #16863: squid: does not recognize Host: header
+  * Cristoph: that last one was fixed in the upstream source. You need to
+    set "httpd_accel_uses_host_header" to "on" in squid.conf for it to work.
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue, 13 Jan 1998 00:37:12 +0100
+
+squid (1.1.17-1) unstable; urgency=low
+
+  * New upstream version.
+  * Applied ftpget.patch from Duane W.
+  * Added 2 binary packages: squidclient and squid-cgi
+  * Fixed debian/ files so that it can be used to build both squid
+    and squid-novm by only editting one var at the top of debian/rules
+  * Fixed bugs:
+     #10180: squid: you can't assume a log rotate depth of 7!
+     #11894: squid uses pidof
+     #10852: squid: squid-cgi package needed
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu, 30 Oct 1997 14:47:07 +0100
+
+squid (1.1.16-1) unstable; urgency=low
+
+  * New upstream version
+  * Compiled for glibc
+  * Call "squid -z" in postinst script to create directory structure
+  * fix pre/post inst/rm script to have a "case" statement with all
+    possible dpkg-arguments (every debian package should do this)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue,  9 Sep 1997 11:20:36 +0200
+
+squid (1.1.11-1) unstable; urgency=low
+
+  * New upstream version.
+  * Applied 2 patches from squid-1.1.11 page at http://squid.nlanr.org/
+    (long-dns-coredump.patch and config.h.in.patch)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Fri, 25 Jul 1997 00:24:30 +0200
+
+squid (1.1.10-1) unstable; urgency=low
+
+  * Upgraded to new upstream version 1.1.10
+  * Updated default config file to latest sample version
+  * Removed Recommends: web-browser, apache
+  * Added manpage for squidclient
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Thu, 8 May 1997 16:27:44 +0200
+
+squid (1.1.9-1) unstable; urgency=low
+
+  * Upgraded to new upstream version 1.1.9, plus maintenance patch.
+  * Use max. 1024 fd's if available instead of 256
+  * Updated default config file to latest sample version
+  * Updated FAQ to latest version
+  * Compile in PROXY_AUTH code
+  * Fixed start/stop script to wait for squid to die at "stop" action
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon, 14 Apr 1997 13:49:56 +0200
+
+squid (1.1.1-1) unstable; urgency=low
+
+  * Upgraded to new upstream version 1.1.1
+  * Fixed a bug with SQUID_MAXFD
+  * Beware: this version is NOT compatible with squid-1.0.x
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed, 18 Dec 1996 13:20:30 +0100
+
+squid (1.0.20-1) frozen unstable; urgency=high
+
+  * Upgraded to 1.0.20 - fixes SERIOUS trouble in 1.0.19
+  * Changed default log_rotate factor to 0
+  * cron script knows about this
+  * cron script is conffile now
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Mon, 11 Nov 1996 11:57:05 +0100
+
+squid (1.0.19-1) unstable; urgency=low
+
+  * Upgraded to 1.0.19
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed, 30 Oct 1996 11:54:25 +0100
+
+squid (1.0.18-1) unstable; urgency=low
+
+  * Upgraded to 1.0.18
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Tue, 29 Oct 1996 12:23:00 +0100
+
+squid (1.0.17-1) unstable; urgency=low
+
+  * Upgraded to 1.0.17
+  * Fixed Bug#4613 (no conffiles)
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Sat, 28 Sep 1996 16:06:54 +0200
+
+squid (1.0.16-1) unstable; urgency=low
+
+  * Upgraded to 1.0.16
+  * I took over this package from Craig Sanders <cas@taz.net.au>
+  * New source format
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Fri, 20 Sep 1996 13:00:04 +0200
+
+squid (1.0.12-1) unstable; urgency=low
+
+  * Upgraded to 1.0.12
+  * Changed cron.daily file again.
+  * Still an Interim release. (perhaps I'll take over).
+    Maintainer: Craig Sanders <cas@taz.net.au>
+    Interim-By: Miquel van Smoorenburg <miquels@cistron.nl>
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed Aug 14 12:13:24 MET DST 1996
+
+squid (1.0.7-1) unstable; urgency=low
+
+  * Upgraded to 1.0.7
+  * Added cron.daily file
+  * squid runs as "proxy.proxy" user now.
+  * Interim release.
+    Maintainer: Craig Sanders <cas@taz.net.au>
+    Interim-By: Miquel van Smoorenburg <miquels@cistron.nl>
+
+ -- Miquel van Smoorenburg <miquels@cistron.nl>  Wed Aug 14 12:13:24 MET DST 1996
+
+squid (1.0.beta16) stable; urgency=low
+
+  * First debian release
+  * added debian package information
+
+ -- Craig Sanders <cas@taz.net.au>  Fri Jun 14 18:55:45 EST 1996
--- squid-2.5.9.orig/debian/control
+++ squid-2.5.9/debian/control
@@ -0,0 +1,54 @@
+Source: squid
+Section: web
+Priority: optional
+Maintainer: Luigi Gangitano <luigi@debian.org>
+Standards-Version: 3.6.1.0
+Build-Depends: libldap2-dev, libpam0g-dev, sharutils, dpatch (>= 2.0.9), po-debconf
+
+Package: squid
+Architecture: any
+Section: web
+Priority: optional
+Pre-Depends: debconf (>= 1.2.9)
+Depends: ${shlibs:Depends}, netbase, adduser, logrotate (>= 3.5.4-1), squid-common (= ${Source-Version}), coreutils | stat
+Conflicts: squid-novm, sarg (<< 1.1.1-2)
+Replaces: squid-novm
+Suggests: squidclient, squid-cgi, logcheck-database, resolvconf (>= 0.40), winbind (>= 3.0.2), smbclient
+Description: Internet Object Cache (WWW proxy cache)
+ This is the Squid Internet Object Cache developed by the National
+ Laboratory for Applied Networking Research (NLANR) and Internet
+ volunteers.  This software is freely available for anyone to use.  The
+ Squid home page is http://www.squid-cache.org/
+
+Package: squid-common
+Architecture: all
+Section: web
+Priority: optional
+Depends: squid
+Conflicts: squid (<< 2.5.4-5)
+Description: Internet Object Cache (WWW proxy cache) - common file
+ This is the Squid Internet Object Cache developed by the National
+ Laboratory for Applied Networking Research (NLANR) and Internet
+ volunteers.  This software is freely available for anyone to use.  The
+ Squid home page is http://www.squid-cache.org/
+ .
+ This package contains common files (errors and icons)
+
+Package: squidclient
+Architecture: any
+Section: web
+Priority: optional
+Conflicts: squid (<= 1.1.16)
+Depends: ${shlibs:Depends}
+Description: Command line URL extractor that talks to (a) squid
+ This small utility can be used to get URLs from the command line. It needs
+ to talk to a `squid' proxy server.
+
+Package: squid-cgi
+Architecture: any
+Section: web
+Priority: optional
+Depends: webmin-squid|httpd, ${shlibs:Depends}, debconf
+Description: Squid cache manager CGI program
+ This CGI program can be used to query and administrate a `squid' proxy
+ cache trough your web browser.
--- squid-2.5.9.orig/debian/squid.RunCache
+++ squid-2.5.9/debian/squid.RunCache
@@ -0,0 +1,51 @@
+#!/bin/sh
+#
+# RunCache	Run squid. Script used to restart it if it died.
+#		This is overly cautious - with new versions of
+#		squid, it just doesn't die. So we don't restart ;)
+#
+# Version:	@(#)RunCache  2.10  23-Mar-2001  miquels@cistron.nl
+#
+
+#
+#	Squid gets run with the arguments passed to "RunCache".
+#	Set some defaults args if none were passed. If a filename
+#	was passed, treat it as configfile location (backwards compat).
+#
+case "$1" in
+	"")
+		set -- -D -sNY
+		;;
+	/*)
+		set -- -D -sNY -f "$1"
+		;;
+esac
+
+PIDFILE=/var/run/runcache.pid
+PATH=/usr/lib/squid:/bin:/sbin:/usr/sbin:/usr/bin
+export PATH
+umask 022
+
+#
+#	Just to be sure, check if squid is not already running.
+#
+if [ -f /var/run/squid.pid ]
+then
+	spid=`cat /var/run/squid.pid`
+	kill -CONT $spid 2>/dev/null
+	if [ $? = 0 ]
+	then
+		#echo "RunCache: squid is already running." >&2
+		exit 0
+	fi
+fi
+
+rm -f $PIDFILE
+echo $$ > $PIDFILE
+
+# 23-Mar-2001 - removed the while loop. This whole script should be
+# removed, but older /etc/init.d/squid scripts might still refer
+# to it, alas. -- miquels.
+
+/usr/sbin/squid "$@"
+
--- squid-2.5.9.orig/debian/templates
+++ squid-2.5.9/debian/templates
@@ -0,0 +1,88 @@
+Template: squid/http_anonymizer
+Type: note
+_Description: The http_anonymizer directive has been replaced with header_replace and header_access.
+ The http_anonymizer directive that was present in squid 2.1 and 2.2
+ doesn't exist anymore in squid 2.3 and up. It has been replaced with
+ header_replace and header_access that provide more fine-grained control over
+ HTTP headers. Right now, your squid doesn't anonymize the HTTP
+ headers anymore so you probably want to fix this. The new format is
+ explained in the new 2.5 config file, of which you probably have a copy in
+ /usr/share/doc/squid/examples/squid.conf.
+
+Template: squid/anonymize_headers
+Type: note
+_Description: The anonymize_headers and fake_user_agent directives have been replaced with header_access and header_replace.
+ The anonymize_headers and fake_user_agent directives that were present in squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been replaced 
+ with header_replace and header_access that provide more fine-grained control 
+ over HTTP headers. Right now, your squid doesn't anonymize the HTTP
+ headers anymore so you probably want to fix this. The new format is
+ explained in the new 2.5 config file, of which you probably have a copy in
+ /usr/share/doc/squid/examples/squid.conf.
+
+Template: squid/old_version
+Type: boolean
+Default: false
+_Description: There is no automatic upgrade path to squid 2.5.
+              SQUID 2.5 INSTALLATION WARNING
+ .
+ You are upgrading squid from an 1.x version to the 2.5 version. The 1.x
+ and 2.5 versions are NOT compatible. The structure of the cache directory
+ is different and the configuration file "squid.conf" is not entirely
+ compatible.
+ .
+ If you have an old cache directory, please quit NOW and remove the old
+ cache by hand (in /var/spool/squid). Then re-install this squid version.
+ .
+ Also, please accept the new configuration file. After upgrading your old
+ configuration file can be found in "/etc/squid.conf.dpkg-old". Then you
+ have to edit the new configuration file by hand to match your old
+ configuration.
+ .
+ Do you want to quit now?
+
+Template: squid-cgi/cachemgr
+Type: note
+_Description: squid-cgi now uses config file for target ACL
+ squid-cgi now checks a configuration file before connecting to the target
+ host. Only allowed target will be contacted. Please add hosts you want to
+ access to the file /etc/squid/cachemgr.conf, one per line in the form
+ .
+   hostname:port
+
+Template: squid/fix_lines
+Type: boolean
+Default: true
+_Description: Upgrade squid.conf automatically?
+ Incompatible settings have been found in the existing squid.conf file;
+ they will prevent squid from starting or working correctly. However, this
+ setup can try to modify them to work again. Do you want to apply the
+ changes?
+
+Template: squid/authenticate_program
+Type: note
+_Description: The authenticate_program directive has been replaced with auth_param.
+ The authenticate_program directive that was present in squid <= 2.4
+ doesn't exist anymore in squid 2.5 and up. All authentication directives
+ have been replaced with auth_param. Right now, your squid doesn't
+ authenticate users anymore so you probably want to fix this. The new
+ format is explained in the new 2.5 config file, of which you probably have
+ a copy in /usr/share/doc/squid/examples/squid.conf.
+
+Template: squid/largefiles_warning
+Type: note
+_Description: Warning: squid may crash when logfiles size is bigger than 2GB.
+ Squid may crash if any of the logfiles grows bigger than 2GB. Please
+ configure /etc/logrotate.d/squid accordingly to your site's traffic.
+
+Template: squid/fix_cachedir_perms
+Type: boolean
+Default: false
+_Description: Fix permissions of cache_dir?
+ Values for cache_effective_user and/or cache_effective_group in config file 
+ are incompatible with owner/group of cache directories. Do you want to
+ automatically fix permissions on cache directory?
+ .
+ WARNING: If you specified a cache directory different from /var/spool/squid
+ and selected some other directory used by other programs (e.g. /tmp), this
+ could affect those programs.
+
--- squid-2.5.9.orig/debian/po/templates.pot
+++ squid-2.5.9/debian/po/templates.pot
@@ -0,0 +1,205 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:14
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:14
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
--- squid-2.5.9.orig/debian/po/de.po
+++ squid-2.5.9/debian/po/de.po
@@ -0,0 +1,269 @@
+# translation of de_squid.po to deutsch
+# translation of de.po to German
+# translation of squid_2.5.6-8_de.po to German
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+# Jens Nachtigall <nachtigall@web.de>, 2004.
+# Sabine Hahn <Hahn.sda@arcor.de>, 2004.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: de\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: 2004-12-01 21:01+0100\n"
+"Last-Translator: Jens Nachtigall <nachtigall@web.de>\n"
+"Language-Team: German <debian-l10n-german@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.9.1\n"
+"Plural-Forms:  nplurals=2; plural=(n != 1);\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr ""
+"Die Direktive http_anonymizer wurde durch header_replace und "
+"header_access ersetzt."
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"Die http_anonymizer-Direktive aus den Squid-Versionen 2.1 und 2.2 existiert "
+"in den Squid-Versionen 2.3 und hÃ¶her nicht mehr. Sie wurde durch "
+"header_replace und header_access ersetzt, die eine feinere Kontrolle Ã¼ber "
+"HTTP-Header erlauben. Im Moment anonymisiert Ihr Squid die HTTP-Header nicht "
+"mehr, so dass Sie diese Sache wahrscheinlich beheben wollen. Das neue Format "
+"wird in der neuen 2.5er-Konfigurationsdatei in /etc/share/doc/squid/examples/"
+"squid.conf erklÃ¤rt."
+
+#. Type: note
+#. Description
+#: ../templates:14
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+"Die Direktiven anonymize_headers und fake_user_agent wurden durch "
+"header_access und header_replace ersetzt."
+
+#. Type: note
+#. Description
+#: ../templates:14
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"Die Direktiven anonymize_headers und fake_user_agent aus den Squid-Versionen "
+"2.3 und 2.4 existieren in den Squid-Versionen 2.5 und hÃ¶her nicht mehr. Sie "
+"wurden durch header_replace und header_access ersetzt, die eine feinere "
+"Kontrolle Ã¼ber HTTP-Header erlauben. Im Moment anonymisiert Ihr Squid die "
+"HTTP-Header nicht mehr, so dass Sie diese Sache wahrscheinlich beheben "
+"wollen. Das neue Format wird in der neuen 2.5er-Konfigurationsdatei erklÃ¤rt, "
+"von der Sie unter "
+"/etc/share/doc/squid/examples/squid.conf wahrscheinlich "
+"eine Kopie haben."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "Eine automatische Aktualisierung auf Squid 2.5 ist unmÃ¶glich."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "             SQUID 2.5 INSTALLATIONS-WARNUNG"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"Sie wollen von einer 1.x Version auf Squid 2.5 aktualisieren. Diese "
+"Versionen sind zueinander inkompatibel. Die Struktur des Cache-"
+"Verzeichnisses ist verschieden; ebenfalls ist die Konfigurationsdatei Â»squid."
+"confÂ« nicht vollstÃ¤ndig kompatibel."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"Wenn Sie ein altes Cache-Verzeichnis haben, dann beenden Sie die "
+"Installation jetzt bitte und entfernen dieses Verzeichnis von Hand (in /var/"
+"spool/squid). AnschlieÃŸend installieren Sie diese Squid-Version neu."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"Achten Sie auch auf die neue Konfigurationsdatei. Nach der Installation "
+"finden Sie die alte Version der Konfiguration unter Â»/etc/squid.conf.dpkg-"
+"oldÂ«. Passen Sie die neue Konfigurationsdatei dann entsprechend Ihrer "
+"BedÃ¼rfnisse von Hand an."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "Installation beenden?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+"squid-cgi benutzt nun eine Konfigurationsdatei als Zugangskontrollliste "
+"(Â»Access Control ListÂ«) fÃ¼r Zielhosts"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+"squid-cgi liest nun eine Konfigurationsdatei, bevor eine Verbindung zum Ziel-"
+"Host aufgebaut wird. Nur zu erlaubten Hosts wird eine Verbindung "
+"hergestellt. Bitte fÃ¼hren Sie die Hosts, zu denen Sie eine Verbindung "
+"aufbauen wollen, in der Datei /etc/squid/cachemgr.conf auf. Jeweils einen "
+"pro Zeile in der Form"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr "  hostname:port"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "squid.conf automatisch aktualisieren?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"In Ihrer existierenden squid.conf wurden inkompatible Einstellungen "
+"gefunden. Sie fÃ¼hren dazu, dass squid nicht starten bzw. nicht korrekt "
+"funktionieren wird. Diese Einrichtung kann jedoch dafÃ¼r sorgen die "
+"Einstellungen so zu verÃ¤ndern, dass sie wieder funktionieren. Sollen diese "
+"Ã„nderungen durchgefÃ¼hrt werden?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "Die Direktive authenticate_program wurde durch auth_param ersetzt."
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"Die authenticate_program-Direktive aus den Squid-Versionen <= 2.4 existiert "
+"in den Squid-Versionen 2.5 und hÃ¶her nicht mehr. Sie wurde durch auth_param "
+"ersetzt. Im Moment authentifiziert Ihr Squid Benutzer nicht mehr, so dass "
+"Sie diese Sache wahrscheinlich beheben wollen. Das neue Format wird in der "
+"neuen 2.5er-Konfigurationsdatei in /etc/share/doc/squid/examples/squid.conf "
+"erklÃ¤rt."
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr "Warnung: squid kann abstÃ¼rzen, wenn Log-Dateien grÃ¶ÃŸer als 2GB sind."
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+"Squid kann abstÃ¼rzen, wenn eine seiner Log-Dateien grÃ¶ÃŸer als 2GB wird. "
+"Bitte konfigurieren Sie /etc/logrotate.d/squid entsprechend dem Netzwerk-"
+"Traffic Ihrer Site."
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr "Berechtigungen fÃ¼r cache_dir beheben?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+"Werte fÃ¼r cache_effective_user und/oder cache_effective_group in der "
+"Konfigurationsdatei sind inkompatibel mit dem EigentÃ¼mer bzw. der Gruppe des "
+"Cache-Verzeichnisses. Sollen die Berechtigungen des Cache-Verzeichnisses "
+"automatisch behoben werden?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+"WARNUNG: Wenn Sie ein Cache-Verzeichnis verschieden von /var/spool/squid "
+"angegeben haben und dieses Verzeichnis (z.B. /tmp) von anderen Programmen "
+"benutzt wird, dann kÃ¶nnte sich das auf diese Programme auswirken."
+
--- squid-2.5.9.orig/debian/po/POTFILES.in
+++ squid-2.5.9/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] templates
--- squid-2.5.9.orig/debian/po/pt_BR.po
+++ squid-2.5.9/debian/po/pt_BR.po
@@ -0,0 +1,277 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: squid\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: 2004-08-20 21:55-0300\n"
+"Last-Translator: André Luís Lopes <andrelop@debian.org>\n"
+"Language-Team: Debian-BR Project <debian-l10n-portuguese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+#, fuzzy
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr "A diretiva http_anonymizer foi substituída por headers_access."
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"A diretiva http_anonymizer, presente no Squid 2.1 e 2.2, não existe mais no "
+"Squid 2.3 e em versões posteriores. Ela foi substituída pelas diretivas "
+"header_replace e header_access, as quais oferecem um controle mais fino "
+"sobre cabeçalhos HTTP. No momento, seu Squid não mais 'anonimiza' cabeçalhos "
+"HTTP e, portanto, você irá provavelmente desejar corrigir isso. O novo "
+"formato é explicado no novo arquivo de configuração da versão 2.5, do qual "
+"provavelmente você possui uma cópia em /usr/share/doc/squid/examples/squid."
+"conf."
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+"As diretivas anonymize_headers e fake_user_agent foram substituídas por "
+"header_access e header_replace."
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"As diretivas anonymize_headers e fake_user_agent que estavam presente no "
+"Squid 2.3 e 2.4 não existem mais no Squid 2.5 e em versões posteriores. As "
+"mesmas foram substituídas pelas diretivas header_replace e header_access, as "
+"quais fornecem um controle mais fino sobre cabeçalhos HTTP. No momento, seu "
+"Squid não mais 'anonimiza' cabeçalhos HTTP e portanto você irá provavelmente "
+"desejar corrigir isso. O novo formato é explicado no novo arquivo de "
+"configuração da versão 2.5, do qual provavelmente você possui uma cópia em /"
+"usr/share/doc/squid/examples/squid.conf."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+#, fuzzy
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "Não existe um caminho de atualização automático para o squid 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "             AVISO DE INSTALAÇÃO DO SQUID 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"Você está atualizando o Squid de uma versão 1.x para a versão 2.5. As "
+"versões 1.x e 2.5 NÃO são compatíveis. A estrutura do diretório de cache é "
+"diferente e o arquivo de configuração \"squid.conf\" não é inteiramente "
+"compatível."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"Caso você possua um diretório de cache antigo, por favor, aborte a "
+"atualização AGORA e remova-o manualmente (em /var/spool/squid). Após a "
+"remoção, instale esta versão do Squid."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"Adicionalmente, por favor, aceite o novo arquivo de configuração. Após a "
+"atualização, seu antigo arquivo de configuração poderá ser encontrado em \"/"
+"etc/squid.conf.dpkg-old\". Você precisará então editar o novo arquivo de "
+"configuração manualmente para ajustá-lo para sua antiga configuração."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "Você deseja abortar agora ?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "Atualizar arquivo squid.conf automaticamente ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"Mudanças incompatíveis foram encontradas no arquivo squid.conf existente. As "
+"mesmas impossibilitarão que o Squid seja iniciado ou que o mesmo funcione "
+"corretamente. Porém, este processo de configuração pode tentar modificá-las "
+"para fazer com que as mesmas funcionem novamente. Você deseja aplicar as "
+"mudanças ?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+#, fuzzy
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "A diretiva autenticate_program foi substituída por auth_param"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"A diretiva authenticate_program que estava presente no Squid com versões "
+"anteriores ou iguais a 2.4 não existe mais no Squid 2.5 e em versões "
+"posteriores. A mesma foi substituída pela diretiva auth_param. No momento, "
+"seu Squid não mais autenticará usuários e, portanto, você provavelmente irá "
+"desejar corrigir isso. O novo formato é explicado no novo arquivo de "
+"configuração da versão 2.5, do qual provavelmente você possui uma cópia em /"
+"usr/share/doc/squid/examples/squid.conf."
+
+#. Type: note
+#. Description
+#: ../templates:73
+#, fuzzy
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr ""
+"Aviso : o squid pode travar quando arquivos de log maiores forem maiores que "
+"2GB"
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+"O Squid pode travar caso qualquer um dos arquivos de log forem maisores do "
+"que 2GB. Por favor, configure o arquivo /etc/logrotate.d/squid de acordo com "
+"o tráfego de seu ambiente."
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr "Corrigir permissões de cache_dir ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+"Os valor para cache_effective_user e/ou cache_effective_groups no arquivo de "
+"configuração são incompatíveis com o dono/grupo dos diretórios de cache. "
+"Você deseja corrigir automaticamente as permissões do diretório de cache ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+"AVISO : Caso você tenha especificado um diretório de cache diferente do "
+"diretório /var/spool/squid e tenha selecionando alguns outros diretórios "
+"usados por outros programas (por exemplo, /tmp), isso poderá afetar esses "
+"programas."
+
+#~ msgid "Warning: squid-cgi can be (ab)used from a remote host."
+#~ msgstr "Aviso: squid-cgi pode ser (ab)usado a partir de um host remoto."
+
+#~ msgid ""
+#~ "This package contains a cgi-program that is installed and turned on by "
+#~ "default. It can be abused from a remote host to connect to any other host/"
+#~ "port with the connection originating from your webserver. Read /usr/share/"
+#~ "doc/squid-cgi/README.cachemgr.gz for details!"
+#~ msgstr ""
+#~ "Este pacote contém um programa cgi que é instalado e habilitado por "
+#~ "padrão. Ele pode ser abusado a partir de um host remoto para conectar a "
+#~ "qualquer outro host/porta com a conexão originando de seu servidor web. "
+#~ "Leia /usr/share/doc/squid-cgi/README.cachemgr.gz para detalhes !"
--- squid-2.5.9.orig/debian/po/ru.po
+++ squid-2.5.9/debian/po/ru.po
@@ -0,0 +1,264 @@
+# Russian messages:
+# Ilgiz Kalmetev <translator@ilgiz.pp.ru>, 2003
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=KOI8-R\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+#, fuzzy
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr "äÉÒÅËÔÉ×Á http_anonymizer ÂÙÌÁ ÚÁÍÅÎÅÎÁ ÎÁ header_access"
+
+#. Type: note
+#. Description
+#: ../templates:3
+#, fuzzy
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"äÉÒÅËÔÉ×Á http_anonymizer, ËÏÔÏÒÁÑ ÂÙÌÁ × squid 2.1 É 2.2 ÂÏÌØÛÅ ÎÅ ÂÕÄÅÔ "
+"ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × squid 2.3 É ×ÙÛÅ. ïÎÁ ÂÙÌÁ ÚÁÍÅÎÅÎÁ ÎÁ header_replace É "
+"header_access, ËÏÔÏÒÙÅ ÐÒÅÄÏÓÔÁ×ÌÑÀÔ ÕÌÕÞÛÅÎÎÙÅ ×ÏÚÍÏÖÎÏÓÔÉ ÐÏ ÕÐÒÁ×ÌÅÎÉÀ "
+"ÚÁÇÏÌÏ×ËÁÍÉ HTTP. óÅÊÞÁÓ ×ÁÛ squid ÂÏÌØÛÅ ÎÅ ÁÎÏÎÉÍÉÚÉÒÕÅÔ ÚÁÇÏÌÏ×ËÉ HTTP, "
+"ÔÁË ÞÔÏ ÷Ù ÎÁ×ÅÒÎÑËÁ ÚÁÈÏÔÉÔÅ ÉÓÐÒÁ×ÉÔØ ÜÔÕ ÓÉÔÕÁÃÉÀ. îÏ×ÙÊ ÆÏÒÍÁÔ "
+"ÏÂßÑÓÎÑÅÔÓÑ × ÎÁÓÔÒÏÅÞÎÏÍ ÆÁÊÌÅ 2.5, ËÏÐÉÑ ËÏÔÏÒÏÇÏ ×ÏÚÍÏÖÎÏ ÎÁÈÏÄÉÔÓÑ × "
+"ÆÁÊÌÅ /etc/squid.conf.dpkg-dist."
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+"äÉÒÅËÔÉ×Ù anonymize_headers É fake_user_agnet ÂÙÌÉ ÚÁÍÅÎÅÎÁ ÎÁ header_access "
+"and header_replace"
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"äÉÒÅËÔÉ×Ù anonymize_headers É fake_user_agnet, ËÏÔÏÒÁÑ ÂÙÌÉ × squid 2.3 É "
+"2.4 ÂÏÌØÛÅ ÎÅ ÂÕÄÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × squid 2.5 É ×ÙÛÅ. ïÎÉ ÂÙÌÁ ÚÁÍÅÎÅÎÁ ÎÁ "
+"header_replace É header_access, ËÏÔÏÒÙÅ ÐÒÅÄÏÓÔÁ×ÌÑÀÔ ÕÌÕÞÛÅÎÎÙÅ ×ÏÚÍÏÖÎÏÓÔÉ "
+"ÐÏ ÕÐÒÁ×ÌÅÎÉÀ ÚÁÇÏÌÏ×ËÁÍÉ HTTP. óÅÊÞÁÓ ×ÁÛ squid ÂÏÌØÛÅ ÎÅ ÁÎÏÎÉÍÉÚÉÒÕÅÔ "
+"ÚÁÇÏÌÏ×ËÉ HTTP, ÔÁË ÞÔÏ ÷Ù ÎÁ×ÅÒÎÑËÁ ÚÁÈÏÔÉÔÅ ÉÓÐÒÁ×ÉÔØ ÜÔÕ ÓÉÔÕÁÃÉÀ. îÏ×ÙÊ "
+"ÆÏÒÍÁÔ ÏÂßÑÓÎÑÅÔÓÑ × ÎÁÓÔÒÏÅÞÎÏÍ ÆÁÊÌÅ 2.5, ËÏÐÉÑ ËÏÔÏÒÏÇÏ ×ÏÚÍÏÖÎÏ "
+"ÎÁÈÏÄÉÔÓÑ × ÆÁÊÌÅ /etc/squid.conf.dpkg-dist."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+#, fuzzy
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "á×ÔÏÍÁÔÉÞÅÓËÉ ÐÅÒÅÊÔÉ ÎÁ squid 2.5 ÎÅÌØÚÑ"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "             ðòåäïóôåòåöåîéñ ðï õóôáîï÷ëå SQUID 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"÷Ù ÏÂÎÏ×ÌÑÅÔÅ squid Ó ×ÅÒÓÉÉ 1.È ÄÏ ×ÅÒÓÉÉ 2.5. üÔÉ ×ÅÒÓÉÉ îå ÓÏ×ÍÅÓÔÉÍÙ. "
+"óÔÒÕËÔÕÒÁ ËÁÔÁÌÏÇÁ ËÅÛÁ ÏÔÌÉÞÁÅÔÓÑ É ÎÁÓÔÒÏÅÞÎÙÊ ÆÁÊÌ \"squid.conf\" ÎÅ "
+"ÐÏÌÎÏÓÔØÀ ÎÅÓÏ×ÍÅÓÔÉÍ."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"åÓÌÉ Õ ×ÁÓ ÓÔÁÒÏÅ ÄÅÒÅ×Ï ËÁÔÁÌÏÇÏ× ËÅÛÁ, ÔÏ, ÐÏÖÁÌÕÊÓÔÁ, óåêþáó ×ÙÊÄÉÔÅ É "
+"ÕÄÁÌÉÔÅ ÓÔÁÒÙÊ ËÅÛ ÒÕËÁÍÉ. (× /var/spool/squid). úÁÔÅÍ ÐÅÒÅÕÓÔÁÎÏ×ÉÔÅ ÜÔÕ "
+"×ÅÒÓÉÀ squid."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"ôÁËÖÅ, ÐÏÖÁÌÕÊÓÔÁ, ×ÏÚØÍÉÔÅ ÎÏ×ÙÊ ÎÁÓÔÒÏÅÞÎÙÊ ÆÁÊÌ. ðÏÓÌÅ ÏÂÎÏ×ÌÅÎÉÑ ×ÁÛ "
+"ÓÔÁÒÙÊ ÎÁÓÔÒÏÅÞÎÙÊ ÆÁÊÌ ÂÕÄÅÔ ÎÁÚÙ×ÁÔØÓÑ \"/etc/squid.conf.dpkg-old\". úÁÔÅÍ "
+"ÏÔÒÅÄÁËÔÉÒÕÊÔÅ ×ÁÛ ÎÏ×ÙÊ ÎÁÓÔÒÏÅÞÎÙÊ ÆÁÊÌ ÔÁË, ÞÔÏÂÙ ÏÎ ÓÏÏÔ×ÅÔÓÔ×Ï×ÁÌ "
+"ÓÔÁÒÏÍÕ."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "èÏÔÉÔÅ ×ÙÊÔÉ ÓÅÊÞÁÓ?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "ïÂÎÏ×ÉÔØ squid.conf Á×ÔÏÍÁÔÉÞÅÓËÉ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"÷ ÓÕÝÅÓÔ×ÕÀÝÅÍ ÆÁÊÌÅ squid.conf ÂÙÌÉ ÎÁÊÄÅÎÙ ÎÅÓÏ×ÍÅÓÔÉÍÙÅ ÎÁÓÔÒÏÊËÉ; ÏÎÉ ÎÅ "
+"ÄÁÄÕÔ squid ÚÁÐÕÓÔÉÔØÓÑ ÉÌÉ ÒÁÂÏÔÁÔØ ËÏÒÒÅËÔÎÏ. ïÄÎÁËÏ ÍÏÖÎÏ ÐÏÐÒÏÂÏ×ÁÔØ "
+"ÉÓÐÒÁ×ÉÔØ ÉÈ, ÞÔÏÂÙ ×ÓÅ ÓÎÏ×Á ÚÁÒÁÂÏÔÁÌÏ. ÷Ù ÐÏÚ×ÏÌÑÅÔÅ ÓÄÅÌÁÔØ ÉÚÍÅÎÅÎÉÑ?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+#, fuzzy
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "äÉÒÅËÔÉ×Á authenticate_program ÂÙÌÁ ÚÁÍÅÎÅÎÁ ÎÁ auth_param"
+
+#. Type: note
+#. Description
+#: ../templates:63
+#, fuzzy
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"äÉÒÅËÔÉ×Á authenticate_program, ËÏÔÏÒÁÑ ÂÙÌÁ × squid <= 2.4 ÂÏÌØÛÅ ÎÅ ÂÕÄÅÔ "
+"ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × squid 2.5 É ÄÁÌÅÅ. ÷ÓÅ ÄÉÒÅËÔÉ×Ù ÁÕÔÅÎÔÉÆÉËÁÃÉÉ ÂÙÌÉ "
+"ÚÁÍÅÎÅÎÙ ÎÁ auth_param. óÅÊÞÁÓ ÷ÁÛ squid ÂÏÌØÛÅ ÎÅ ÁÕÔÅÎÔÉÆÉÃÉÒÕÅÔ "
+"ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÔÁË ÞÔÏ ÷Ù ÎÁ×ÅÒÎÑËÁ ÚÁÈÏÔÉÔÅ ÉÓÐÒÁ×ÉÔØ ÜÔÕ ÓÉÔÕÁÃÉÀ. ÎÏ×ÙÊ "
+"ÆÏÒÍÁÔ ÏÂßÑÓÎÑÅÔÓÑ × ÎÁÓÔÒÏÅÞÎÏÍ ÆÁÊÌÅ 2.5, ËÏÐÉÑ ËÏÔÏÒÏÇÏ ×ÏÚÍÏÖÎÏ "
+"ÎÁÈÏÄÉÔÓÑ × ÆÁÊÌÅ /etc/squid.conf.dpkg-dist."
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+
+#~ msgid "Warning: squid-cgi can be (ab)used from a remote host."
+#~ msgstr ""
+#~ "ðÒÅÄÕÐÒÅÖÄÅÎÉÅ: squid-cgi ÍÏÖÅÔ (ÎÅÁÄÅË×ÁÔÎÏ) ÉÓÐÏÌØÚÏ×ÁÎ ÕÄÁÌÅÎÎÙÍ ÕÚÌÏÍ."
+
+#~ msgid ""
+#~ "This package contains a cgi-program that is installed and turned on by "
+#~ "default. It can be abused from a remote host to connect to any other host/"
+#~ "port with the connection originating from your webserver. Read /usr/share/"
+#~ "doc/squid-cgi/README.cachemgr.gz for details!"
+#~ msgstr ""
+#~ "üÔÏÔ ÐÁËÅÔ ÓÏÄÅÒÖÉÔ cgi-ÐÒÏÇÒÁÍÍÕ, ËÏÔÏÒÁÑ ÕÓÔÁÎÁ×ÌÉ×ÁÅÔÓÑ É ×ËÌÀÞÁÅÔÓÑ "
+#~ "ÐÏ ÕÍÏÌÞÁÎÉÀ. ïÎÁ ÍÏÖÅÔ ÂÙÔØ ÎÅÁÄÅË×ÁÔÎÏ ÉÓÐÏÌØÚÏ×ÁÎÁ ÕÄÁÌÅÎÎÙÍ ÕÚÌÏÍ ÄÌÑ "
+#~ "ÐÏÄËÌÀÞÅÎÉÑ Ë ÌÀÂÏÍÕ ÄÒÕÇÏÍÕ ÐÏÒÔÕ/ÕÚÌÕ ÏÔ ÌÉÃÁ ×ÁÛÅÇÏ ×ÅÂÓÅÒ×ÅÒÁ. "
+#~ "ðÒÏÞÔÉÔÅ ÐÏÄÒÏÂÎÏÓÔÉ × /usr/share/doc/squid-cgi/README.cachemgr.gz!"
--- squid-2.5.9.orig/debian/po/fr.po
+++ squid-2.5.9/debian/po/fr.po
@@ -0,0 +1,272 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: squid_2.5.6-7\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-06 20:01+0200\n"
+"PO-Revision-Date: 2004-10-13 21:37+0200\n"
+"Last-Translator: Michel Grentzinger <mic.grentz@online.fr>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid "The http_anonymizer directive has been replaced with header_access"
+msgstr "« http_anonymizer » remplacé par « header_access »"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"La directive « http_anonymizer » présente dans squid 2.1 et 2.2 n'existe "
+"plus dans squid version 2.3 et suivantes. Elle a été remplacée par les "
+"directives « header_replace » et « header_access » qui permettent un "
+"contrôle plus fin des en-têtes HTTP. Actuellement, votre serveur Squid n'est "
+"plus en mesure de réaliser l'anonymat des en-têtes HTTP et vous souhaitez "
+"sans doute corriger cela. Le nouveau format est expliqué dans le nouveau "
+"fichier de configuration 2.5, dont vous trouverez certainement une copie "
+"dans /usr/share/doc/squid/examples/squid.conf."
+
+#. Type: note
+#. Description
+#: ../templates:14
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace"
+msgstr ""
+"« anonymize_headers » et « fake_user_agent » remplacés par « header_access » "
+"et « header_replace »"
+
+#. Type: note
+#. Description
+#: ../templates:14
+msgid ""
+"The anonymize_headers and fake_user_agnet directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"Les directives « anonymize_headers » et « fake_user_agent » présentes dans "
+"squid 2.3 et 2.4 n'existent plus dans squid version 2.5 et suivantes. Elles "
+"ont été remplacées par les directives « header_replace » et "
+"« header_access » qui permettent un contrôle plus fin des en-têtes HTTP. "
+"Actuellement, votre serveur Squid n'est plus en mesure de réaliser "
+"l'anonymat des en-têtes HTTP et vous souhaitez sans doute corriger cela. Le "
+"nouveau format est expliqué dans le nouveau fichier de configuration 2.5, "
+"dont vous trouverez certainement une copie dans /usr/share/doc/squid/"
+"examples/squid.conf."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "There is no automatic upgrade path to squid 2.5"
+msgstr "La mise à jour de squid pour la version 2.5 n'est pas automatique"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "Avertissement concernant l'installation de Squid 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"Vous mettez à jour squid depuis une version 1.x vers la version 2.5. Les "
+"versions 1.x et 2.5 ne sont PAS compatibles. La structure du répertoire "
+"cache est différente et le fichier de configuration « squid.conf » n'est pas "
+"totalement compatible."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"Si vous avez un ancien répertoire de cache, veuillez quitter MAINTENANT et "
+"supprimer vous-même ce répertoire (situé dans /var/spool/squid). Ensuite, "
+"veuillez réinstaller cette version de squid."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"Veuillez également accepter le nouveau fichier de configuration. Après la "
+"mise à jour, votre ancien fichier de configuration se trouvera dans « /etc/"
+"squid.conf.dpkg-old ». Ensuite, vous devrez modifier vous-même le nouveau "
+"fichier de configuration pour l'adapter à votre ancienne configuration."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "Souhaitez-vous quitter maintenant ?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+"squid-cgi utilise désormais un fichier de configuration pour les cibles ACL "
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+"squid-cgi vérifie le fichier de configuration avant de se connecter à l'hôte "
+"cible. Seules les cibles autorisées seront contactées. Veuillez ajouter les "
+"hôtes auxquel vous voulez accéder dans le fichier /etc/squid/cachemgr.conf, "
+"en respectant une entrée par ligne sous la forme"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr "  nom d'hôte: porte"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "Faut-il automatiquement mettre à jour squid.conf ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"Des paramètres incompatibles ont été détectés dans le fichier squid.conf "
+"actuel. Ils empêchent le démarrage ou le bon fonctionnement de squid. "
+"Cependant, ce programme de configuration peut essayer de les modifier afin "
+"qu'ils soient à nouveau corrects. Souhaitez-vous effectuer ces changements ?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid "The authenticate_program directive has been replaced with auth_param"
+msgstr "« authenticate_program » remplacé par « auth_param »"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"La directive « authenticate_program » qui était présente jusqu'à la version "
+"2.4 de squid n'existe plus dans les versions 2.5 et suivantes. Toutes les "
+"directives d'authentification ont été remplacées par la directive "
+"« auth_param ». Actuellement, votre serveur Squid n'est plus en mesure "
+"d'authentifier les utilisateurs et vous souhaitez sans doute corriger cela. "
+"Le nouveau format est expliqué dans le nouveau fichier de configuration 2.5, "
+"dont vous trouverez certainement une copie dans /usr/share/doc/squid/"
+"examples/squid.conf."
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB"
+msgstr "Blocage possible avec des fichiers journaux supérieurs à 2 Go"
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+"Squid peut se bloquer si la taille de l'un des fichiers journaux est "
+"supérieure à 2 Go. Veuillez configurer /etc/logrotate.d/squid en l'adaptant "
+"au trafic de votre site."
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr "Faut-il corriger les droits de cache_dir ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+"Les valeurs pour « cache_effective_user » et « cache_effective_group » dans "
+"le fichier de configuration sont incompatibles avec le propriétaire et le "
+"groupe des répertoires de cache. Veuillez confirmer si vous souhaitez régler "
+"automatiquement les droits des répertoires de cache."
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+"Attention : si vous indiquez un répertoire de cache différent de /var/spool/"
+"squid et utilisé par d'autres programmes (p. ex. /tmp), cela peut affecter "
+"leur comportement."
+
+#~ msgid "Warning: squid-cgi can be (ab)used from a remote host."
+#~ msgstr "Squid-cgi peut être (abusivement) utilisé depuis un hôte distant"
+
+#~ msgid ""
+#~ "This package contains a cgi-program that is installed and turned on by "
+#~ "default. It can be abused from a remote host to connect to any other host/"
+#~ "port with the connection originating from your webserver. Read /usr/share/"
+#~ "doc/squid-cgi/README.cachemgr.gz for details!"
+#~ msgstr ""
+#~ "Ce paquet contient un script CGI qui est installé et activé par défaut. "
+#~ "Il peut être utilisé à mauvais escient depuis un hôte distant pour se "
+#~ "connecter à n'importe quel port d'un autre hôte en utilisant l'adresse "
+#~ "originelle de connexion de votre serveur web. Veuillez consulter /usr/"
+#~ "share/doc/squid-cgi/README.cachemgr.gz pour des informations détaillées."
--- squid-2.5.9.orig/debian/po/nl.po
+++ squid-2.5.9/debian/po/nl.po
@@ -0,0 +1,135 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: squid 2.5.7-2\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: 2004-11-16 18:38+0100\n"
+"Last-Translator: Luk Claes <luk.claes@ugent.be>\n"
+"Language-Team: Debian l10n Dutch <debian-l10n-dutch@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#: ../templates:3
+msgid "The http_anonymizer directive has been replaced with header_replace and header_access."
+msgstr "De http_anonymizer-richtlijn is vervangen door header_replace en header_access."
+
+#. Type: note
+#: ../templates:3
+msgid "The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't exist anymore in squid 2.3 and up. It has been replaced with header_replace and header_access that provide more fine-grained control over HTTP headers. Right now, your squid doesn't anonymize the HTTP headers anymore so you probably want to fix this. The new format is explained in the new 2.5 config file, of which you probably have a copy in /usr/share/doc/squid/examples/squid.conf."
+msgstr "De http_anonymizer-richtlijn die aanwezig was in squid 2.1 en 2.2 bestaat niet meer in squid 2.3 en latere versies. Deze richtlijn is vervangen door header_replace en header_access die een preciezere controle toelaten over HTTP-headers. Op dit moment maakt squid uw gebruikers niet anoniem, u wil dit waarschijnlijk repareren. Het nieuwe formaat wordt uitgelegd in het nieuwe squid 2.5 configuratiebestand, waarvan u waarschijnlijk een kopie heeft in /usr/share/doc/squid/examples/squid.conf."
+
+#. Type: note
+#: ../templates:14
+msgid "The anonymize_headers and fake_user_agent directives have been replaced with header_access and header_replace."
+msgstr "De anonymize_headers- en fake_user_agent-richtlijnen zijn vervangen door header_access en header_replace"
+
+#. Type: note
+#: ../templates:14
+msgid "The anonymize_headers and fake_user_agent directives that were present in squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been replaced  with header_replace and header_access that provide more fine-grained control  over HTTP headers. Right now, your squid doesn't anonymize the HTTP headers anymore so you probably want to fix this. The new format is explained in the new 2.5 config file, of which you probably have a copy in /usr/share/doc/squid/examples/squid.conf."
+msgstr "De anonymize_headers- en fake_user_agent-richtlijnen die aanwezig waren in squid 2.3 en 2.4 bestaan niet meer in squid 2.5 en latere versies. Ze zijn vervangen door header_replace en header_access die een preciezere controle toelaten over HTTP-headers. Op dit moment maakt squid uw gebruikers niet meer anoniem, u wil dit waarschijnlijk repareren. Het nieuwe formaat wordt uitgelegd in het nieuwe squid 2.5 configuratiebestand, waarvan u waarschijnlijk een kopie heeft in /usr/share/doc/squid/examples/squid.conf."
+
+#. Type: boolean
+#: ../templates:25
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "Er is geen automatisch opwaarderingspad voor squid 2.5."
+
+#. Type: boolean
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "             SQUID 2.5 INSTALLATIE WAARSCHUWING"
+
+#. Type: boolean
+#: ../templates:25
+msgid "You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and 2.5 versions are NOT compatible. The structure of the cache directory is different and the configuration file \"squid.conf\" is not entirely compatible."
+msgstr "U bent squid aan het opwaarderen van een 1.x versie naar de 2.5 versie. De 1.x en 2.5 versies zijn NIET compatibel. De structuur van de buffer map is verschillend en het configuratiebestand \"squid.conf\" is niet helemaal compatibel."
+
+#. Type: boolean
+#: ../templates:25
+msgid "If you have an old cache directory, please quit NOW and remove the old cache by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr "Als u nog een oude buffermap heeft, gelieve dan NU te stoppen en de oude buffer handmatig te verwijderen (/var/spool/squid). Herinstalleer daarna deze versie van squid."
+
+#. Type: boolean
+#: ../templates:25
+msgid "Also, please accept the new configuration file. After upgrading your old configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you have to edit the new configuration file by hand to match your old configuration."
+msgstr "Gelieve het nieuwe configuratiebestand te aanvaarden. Na het opwaarderen kan u uw oude configuratie bestand vinden in \"/etc/squid.conf.dpkg-old\". Dan kan u het nieuwe configuratiebestand handmatig veranderen om uw oude configuratie terug te krijgen."
+
+#. Type: boolean
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "Wilt u nu stoppen?"
+
+#. Type: note
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr "squid-cgi gebruikt nu een configuratiebestand voor doel-ACL"
+
+#. Type: note
+#: ../templates:45
+msgid "squid-cgi now checks a configuration file before connecting to the target host. Only allowed target will be contacted. Please add hosts you want to access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr "squid-cgi controleert nu een configuratiebestand alvorens een verbinding op te zetten met de doelcomputer. Enkel toegestane doelen zullen worden gecontacteerd. Voeg computers waarmee u wilt contact leggen toe aan het bestand /etc/squid/cachemgr.conf, Ã©Ã©n per lijn in de vorm"
+
+#. Type: note
+#: ../templates:45
+msgid "  hostname:port"
+msgstr "  computernaam:poort"
+
+#. Type: boolean
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "squid.conf automatisch opwaarderen?"
+
+#. Type: boolean
+#: ../templates:55
+msgid "Incompatible settings have been found in the existing squid.conf file; they will prevent squid from starting or working correctly. However, this setup can try to modify them to work again. Do you want to apply the changes?"
+msgstr "Er zijn incompatibele instellingen gevonden in het squid.conf-bestand; ze zullen squid verhinderen te starten of correct te werken. Deze setup kan ze proberen te wijzigen om opnieuw te werken. Wilt u de veranderingen toepassen?"
+
+#. Type: note
+#: ../templates:63
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "De authenticate_program-instelling is vervangen door auth_param."
+
+#. Type: note
+#: ../templates:63
+msgid "The authenticate_program directive that was present in squid <= 2.4 doesn't exist anymore in squid 2.5 and up. All authentication directives have been replaced with auth_param. Right now, your squid doesn't authenticate users anymore so you probably want to fix this. The new format is explained in the new 2.5 config file, of which you probably have a copy in /usr/share/doc/squid/examples/squid.conf."
+msgstr "De authenticate_program-richtlijn die aanwezig was in squid <= 2.4 bestaat niet meer in squid 2.5 en latere versies. Alle authenticatierichtlijnen zijn vervangen door auth_param. Op dit moment authenticeert uw squid geen gebruikers meer, u wil dit waarschijnlijk repareren. Het nieuwe formaat wordt uitgelegd in het nieuwe squid 2.5 configuratiebestand, waarvan u waarschijnlijk een kopie heeft in /usr/share/doc/squid/examples/squid.conf."
+
+#. Type: note
+#: ../templates:73
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr "Waarschuwing: squid kan vastlopen wanneer de grootte van een logbestand meer is dan 2GB."
+
+#. Type: note
+#: ../templates:73
+msgid "Squid may crash if any of the logfiles grows bigger than 2GB. Please configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr "Squid kan vastlopen als Ã©Ã©n van de logbestanden groter wordt dan 2GB. Configureer /etc/logrotate.d/squid aangepast aan het verkeer op uw site."
+
+#. Type: boolean
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr "Permissies van cache_dir repareren?"
+
+#. Type: boolean
+#: ../templates:80
+msgid "Values for cache_effective_user and/or cache_effective_group in config file  are incompatible with owner/group of cache directories. Do you want to automatically fix permissions on cache directory?"
+msgstr "De waarden voor cache_effective_user en/of cache_effective_group in het configuratiebestand zijn incompatibel met de gebruiker/groep van cache-mappen. Wilt u de permissies van de cache-map automatisch laten repareren?"
+
+#. Type: boolean
+#: ../templates:80
+msgid "WARNING: If you specified a cache directory different from /var/spool/squid and selected some other directory used by other programs (e.g. /tmp), this could affect those programs."
+msgstr "WAARSCHUWING: als u een cache-map opgaf verschillend van /var/spool/squid en u selecteerde een andere map die gebruikt wordt door andere programma's (v.b. /tmp), dan kan dit deze programma's beÃ¯nvloeden."
+
--- squid-2.5.9.orig/debian/po/ja.po
+++ squid-2.5.9/debian/po/ja.po
@@ -0,0 +1,262 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: 2004-03-13 22:38+0900\n"
+"Last-Translator: Kenshi Muto <kmuto@debian.org>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=EUC-JP\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+#, fuzzy
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr "http_anonymizer ¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï header_access ¤ÇÃÖ¤­´¹¤¨¤é¤ì¤Þ¤·¤¿"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"squid 2.1 ¤ª¤è¤Ó 2.2 ¤ÇÄó¶¡¤µ¤ì¤Æ¤¤¤¿ http_anonymizer ¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï¡¢"
+"squid 2.3 °Ê¹ß¤Ç¤Ï¤â¤¦Â¸ºß¤·¤Þ¤»¤ó¡£¤³¤ì¤Ï¡¢HTTP ¥Ø¥Ã¥À¤Î¤è¤ê¹â¤¤Î³ÅÙ¤ÎÀ©¸æ¤ò"
+"Äó¶¡¤¹¤ë header_replace ¤È header_access ¤ÇÃÖ¤­´¹¤¨¤é¤ì¤Æ¤¤¤Þ¤¹¡£º£¤Î¤È¤³¤í¡¢"
+"¤¢¤Ê¤¿¤Î squid ¤Ï HTTP ¥Ø¥Ã¥À¤òÆ¿Ì¾²½¤·¤Æ¤¤¤Ê¤¤¤Î¤Ç¡¢¤ª¤½¤é¤¯¤³¤ì¤ò½¤Àµ¤·¤¿¤¤"
+"¤Ç¤·¤ç¤¦¡£¿·¤·¤¤¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï¡¢¤ª¤½¤é¤¯ /usr/share/doc/squid/examples/squid."
+"conf ¤Ë¥³¥Ô¡¼¤¬¤¢¤ë¿·¤·¤¤ 2.5 ÀßÄê¥Õ¥¡¥¤¥ë¤Ç²ò¼á¤µ¤ì¤Þ¤¹¡£"
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+"anonymize_header ¤È fake_user_agent ¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï header_access ¤È "
+"header_replace ¤ÇÃÖ¤­´¹¤¨¤é¤ì¤Þ¤·¤¿"
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"squid 2.3 ¤ª¤è¤Ó 2.4 ¤ÇÄó¶¡¤µ¤ì¤Æ¤¤¤¿ http_headers ¤ª¤è¤Ó fake_user_agent "
+"¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï¡¢squid 2.5 °Ê¹ß¤Ç¤Ï¤â¤¦Â¸ºß¤·¤Þ¤»¤ó¡£¤³¤ì¤Ï¡¢HTTP ¥Ø¥Ã¥À¤Î¤è"
+"¤ê¹â¤¤Î³ÅÙ¤ÎÀ©¸æ¤òÄó¶¡¤¹¤ë header_replace ¤È header_access ¤ÇÃÖ¤­´¹¤¨¤é¤ì¤Æ¤¤"
+"¤Þ¤¹¡£º£¤Î¤È¤³¤í¡¢¤¢¤Ê¤¿¤Î squid ¤Ï HTTP ¥Ø¥Ã¥À¤òÆ¿Ì¾²½¤·¤Æ¤¤¤Ê¤¤¤Î¤Ç¡¢¤ª¤½¤é"
+"¤¯¤³¤ì¤ò½¤Àµ¤·¤¿¤¤¤Ç¤·¤ç¤¦¡£¿·¤·¤¤¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï¡¢¤ª¤½¤é¤¯ /usr/share/doc/"
+"squid/examples/squid.conf ¤Ë¥³¥Ô¡¼¤¬¤¢¤ë¿·¤·¤¤ 2.5 ÀßÄê¥Õ¥¡¥¤¥ë¤Ç²ò¼á¤µ¤ì¤Þ"
+"¤¹¡£"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+#, fuzzy
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "squid 2.5 ¤Ø¤Î¼«Æ°¹¹¿·¤Î¼êÃÊ¤¬¤¢¤ê¤Þ¤»¤ó"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "             Squid 2.5 ¥¤¥ó¥¹¥È¡¼¥ë¤Î·Ù¹ð"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"squid ¤ò 1.x ¥Ð¡¼¥¸¥ç¥ó¤«¤é 2.5 ¥Ð¡¼¥¸¥ç¥ó¤Ë¹¹¿·¤·¤è¤¦¤È¤·¤Æ¤¤¤Þ¤¹¡£1.x ¤È "
+"2.5 ¥Ð¥¸¥ç¥ó¤Ï¸ß´¹À­¤¬*¤¢¤ê¤Þ¤»¤ó*¡£¥­¥ã¥Ã¥·¥å¥Ç¥£¥ì¥¯¥È¥ê¤Î¹½Â¤¤¬°Û¤Ê¤ê¡¢Àß"
+"Äê¥Õ¥¡¥¤¥ë \"squid.conf\" ¤Ï¤Þ¤Ã¤¿¤¯Èó¸ß´¹¤Ç¤¹¡£"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"¸Å¤¤¥­¥ã¥Ã¥·¥å¥Ç¥£¥ì¥¯¥È¥ê¤¬¤¢¤ë¤Î¤Ç¤¢¤ì¤Ð¡¢¡Öº£¤¹¤°¡×Ãæ»ß¤·¡¢(/var/spool/"
+"squid Æâ¤Î) ¸Å¤¤¥­¥ã¥Ã¥·¥å¤ò¼êÆ°¤Çºï½ü¤·¤Æ¤¯¤À¤µ¤¤¡£¤½¤ì¤«¤é¤³¤Î squild ¥Ð¡¼"
+"¥¸¥ç¥ó¤òºÆ¥¤¥ó¥¹¥È¡¼¥ë¤·¤Æ¤¯¤À¤µ¤¤¡£"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"¤µ¤é¤Ë¡¢¿·¤·¤¤ÀßÄê¥Õ¥¡¥¤¥ë¤ò¼õ¤±Æþ¤ì¤Æ¤¯¤À¤µ¤¤¡£¹¹¿·¸å¡¢¤¢¤Ê¤¿¤Î¸Å¤¤ÀßÄê¥Õ¥¡"
+"¥¤¥ë¤Ï \"/etc/squid.conf.dpkg-old\" ¤È¤·¤Æ¸«¤Ä¤±¤é¤ì¤Þ¤¹¡£¤½¤ì¤«¤é¿·¤·¤¤ÀßÄê"
+"¥Õ¥¡¥¤¥ë¤ò¸Å¤¤ÀßÄê¥Õ¥¡¥¤¥ë¤ÈÅ¬¹ç¤¹¤ë¤è¤¦¼êÆ°¤ÇÊÔ½¸¤¹¤ëÉ¬Í×¤¬¤¢¤ê¤Þ¤¹¡£"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "º£¤¹¤°Ãæ»ß¤·¤Þ¤¹¤«?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "squid.conf ¤ò¼«Æ°Åª¤Ë¹¹¿·¤·¤Þ¤¹¤«?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"Èó¸ß´¹¤ÎÀßÄê¤¬´ûÂ¸¤Î squid.conf ¥Õ¥¡¥¤¥ë¤Ë¸«¤Ä¤«¤ê¤Þ¤·¤¿¡£¤³¤ì¤é¤Ï squid ¤¬Àµ"
+"¤·¤¯µ¯Æ°¤¢¤ë¤¤¤ÏÆ°ºî¤¹¤ë¤Î¤òË¸¤²¤Þ¤¹¡£¤·¤«¤·¡¢¤³¤Î¥»¥Ã¥È¥¢¥Ã¥×¤ÏºÆ¤ÓÆ°ºî¤¹¤ë"
+"¤è¤¦ÊÑ¹¹¤ò»î¹Ô¤Ç¤­¤Þ¤¹¡£ÊÑ¹¹¤òÅ¬ÍÑ¤·¤Þ¤¹¤«?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+#, fuzzy
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "authenticate_program ¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï auth_param ¤ËÃÖ¤­´¹¤¨¤é¤ì¤Þ¤·¤¿"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"squid 2.4 °ÊÁ°¤ÇÄó¶¡¤µ¤ì¤Æ¤¤¤¿ authenticate_program ¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï¡¢squid "
+"2.5 °Ê¹ß¤Ç¤Ï¤â¤¦Â¸ºß¤·¤Þ¤»¤ó¡£¤¹¤Ù¤Æ¤ÎÇ§¾Ú¥Ç¥£¥ì¥¯¥Æ¥£¥Ö¤Ï auth_param ¤ÇÃÖ¤­"
+"´¹¤¨¤é¤ì¤Æ¤¤¤Þ¤¹¡£º£¤Î¤È¤³¤í¡¢¤¢¤Ê¤¿¤Î squid ¤Ï ¥æ¡¼¥¶¤òÇ§¾Ú¤·¤Æ¤¤¤Ê¤¤¤Î¤Ç¡¢"
+"¤ª¤½¤é¤¯¤³¤ì¤ò½¤Àµ¤·¤¿¤¤¤Ç¤·¤ç¤¦¡£¿·¤·¤¤¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï¡¢¤ª¤½¤é¤¯ /usr/share/"
+"doc/squid/examples/squid.conf ¤Ë¥³¥Ô¡¼¤¬¤¢¤ë¿·¤·¤¤ 2.5 ÀßÄê¥Õ¥¡¥¤¥ë¤Ç²ò¼á¤µ¤ì"
+"¤Þ¤¹¡£"
+
+#. Type: note
+#. Description
+#: ../templates:73
+#, fuzzy
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr ""
+"·Ù¹ð: squid ¤Ï¥í¥°¥Õ¥¡¥¤¥ë¥µ¥¤¥º¤¬ 2GB ¤òÄ¶¤¨¤¿¤È¤­¤Ë¥¯¥é¥Ã¥·¥å¤¹¤ë¶²¤ì¤¬¤¢¤ê"
+"¤Þ¤¹"
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+"squid ¤Ï¥í¥°¥Õ¥¡¥¤¥ë¤¬ 2GB ¤òÄ¶¤¨¤Æ¤·¤Þ¤Ã¤¿¤È¤­¤Ë¥¯¥é¥Ã¥·¥å¤¹¤ë¶²¤ì¤¬¤¢¤ê¤Þ"
+"¤¹¡£¤¢¤Ê¤¿¤Î¥µ¥¤¥È¤Î¥È¥é¥Õ¥£¥Ã¥¯¤Ë±þ¤¸¤Æ¡¢/etc/logrotate.d/squid ¤òÀßÄê¤·¤Æ¤¯"
+"¤À¤µ¤¤¡£"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+
+#~ msgid "Warning: squid-cgi can be (ab)used from a remote host."
+#~ msgstr "·Ù¹ð: squid-cgi ¤Ï¥ê¥â¡¼¥È¥Û¥¹¥È¤«¤é (ÉÔÀµ¤ò´Þ¤á) ÍøÍÑ¤Ç¤­¤Þ¤¹¡£"
+
+#~ msgid ""
+#~ "This package contains a cgi-program that is installed and turned on by "
+#~ "default. It can be abused from a remote host to connect to any other host/"
+#~ "port with the connection originating from your webserver. Read /usr/share/"
+#~ "doc/squid-cgi/README.cachemgr.gz for details!"
+#~ msgstr ""
+#~ "¤³¤Î¥Ñ¥Ã¥±¡¼¥¸¤Ï¡¢¥Ç¥Õ¥©¥ë¥È¤Ç¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ìÍ­¸ú¤Ë¤Ê¤Ã¤Æ¤¤¤ë cgi ¥×¥í¥°"
+#~ "¥é¥à¤ò´Þ¤ó¤Ç¤¤¤Þ¤¹¡£¤¢¤Ê¤¿¤Î web ¥µ¡¼¥Ð¤òµ¯¸»¤È¤¹¤ëÀÜÂ³¤Ç¤Û¤«¤Î¥Û¥¹¥È/¥Ý¡¼"
+#~ "¥È¤ËÀÜÂ³¤¹¤ë¤³¤È¤Ë¤è¤ê¡¢¥ê¥â¡¼¥È¥Û¥¹¥È¤«¤éÉÔÀµ¤ËÍøÍÑ¤µ¤ìÆÀ¤Þ¤¹¡£¾ÜºÙ¤Ë¤Ä¤¤"
+#~ "¤Æ¤Ï /usr/share/doc/squid-cgi/README.cachemgr.gz ¤ò»²¾È¤·¤Æ¤¯¤À¤µ¤¤!"
--- squid-2.5.9.orig/debian/po/es.po
+++ squid-2.5.9/debian/po/es.po
@@ -0,0 +1,283 @@
+# squid debconf translation to spanish
+# Copyright (C) 2004 Software in the Public Interest
+# This file is distributed under the same license as the squid package.
+#
+# Changes:
+# - Initial translation
+#       Javi Castelo <javicastelo@ono.com> , 2004
+#
+#  Traductores, si no conoce el formato PO, merece la pena leer la 
+#  documentación de gettext, especialmente las secciones dedicadas a este
+#  formato, por ejemplo ejecutando:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+# 
+# - El proyecto de traducción de Debian al español
+#   http://www.debian.org/intl/spanish/coordinacion
+#   especialmente las notas de traducción en
+#   http://www.debian.org/intl/spanish/notas
+#
+# - La guía de traducción de po's de debconf:
+#   /usr/share/doc/po-debconf/README-trans
+#   o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: squid 2.5.4-3\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: 2004-3-6 21:35+100\n"
+"Last-Translator: Javi Castelo\n"
+"Language-Team: Debian Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+#, fuzzy
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr "La directiva «http_anonymizer» se ha reemplazado por «header_access»"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"La directiva «http_anonymizer» que existía en squid 2.1 y 2.2 desaparece en "
+"squid versión 2.3 y posteriores. Ha sido reemplazada por «header_replace» y "
+"«header_access» que proporcionan un control más detallado sobre las "
+"cabeceras HTTP. Actualmente, squid no preserva más el anonimato de las "
+"cabeceras HTTP de modo que probablemente desee subsanar ésto. El nuevo "
+"formato se explica en el archivo de configuración de la nueva versión 2.5, "
+"del cuál probablemente tenga una copia en «/usr/share/doc/squid/examples/"
+"squid.conf»."
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+"Las directivas «anonymize_headers» y «fake_user_agent» se han reemplazado "
+"por «header_access» y «header_replace»"
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"Las directivas «anonymize_headers» y «fake_user_agnet» que existían en squid "
+"2.3 y 2.4 desaparecen en squid versión 2.5 y posteriores. Han sido "
+"reemplazadas por «header_replace» y «header_access» que proporcionan un "
+"control más detallado sobre las cabeceras HTTP. Actualmente, squid no "
+"preserva más el anonimato de las cabeceras HTTP de modo que probablemente "
+"desee subsanar ésto. El nuevo formato se explica en el archivo de "
+"configuración de la nueva versión 2.5, del cuál probablemente tendrá una "
+"copia en «/usr/share/doc/squid/examples/squid.conf»."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+#, fuzzy
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "No hay ruta para la actualización automática a squid 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "       ADVERTENCIA SOBRE LA INSTALACION DE SQUID 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"Usted está actualizando squid desde una versión 1.x a la versión 2.5. Las "
+"versiones 1.x y 2.5 NO son compatibles. La estructura del directorio de "
+"almacenamiento es diferente y el archivo «squid.conf» no es totalmente "
+"compatible."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"Si conserva un directorio de almacenamiento antiguo, por favor salga AHORA y "
+"borre dicho directorio a mano (en «/var/spool/squid»). Luego reinstale esta "
+"versión de squid."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"Asimismo, por favor acepte el nuevo archivo de configuración. Después de la "
+"actualización podrá encontrar en «/etc/squid.conf.dpkg-old» su archivo de "
+"configuración anterior. Entonces tiene que editar el archivo de "
+"configuración nuevo a mano para que coincida con suconfiguración anterior."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "¿Desea salir ahora?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "¿Actualizar «squid.conf» automáticamente?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"Se ha encontrado una configuración incompatible en el archivo existente "
+"«squid.conf»; dicha configuración impedirá que squid inicie o funcione "
+"correctamente. Sin embargo, este instalador puede intentar modificarla para "
+"que funcione de nuevo. ¿Desea aplicar los cambios?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+#, fuzzy
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "La directiva «authenticate_program» se ha reemplazado por «auth_param»"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"La directiva «authenticate_program» que existía en las versiones 2.4 y "
+"anteriores de squid deja de estar presente en squid 2.5 y posteriores. Todas "
+"las directivas de autentificación se han reemplazado por la directiva "
+"«auth_param». Actualmente, squid no autentifica ya usuarios así que "
+"probablemente quiera cambiarlo. El nuevo formato se explica en el nuevo "
+"archivo de configuración 2.5, del cuál probablemente tenga una copia en «/"
+"usr/share/doc/squid/examples/squid.conf»."
+
+#. Type: note
+#. Description
+#: ../templates:73
+#, fuzzy
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr ""
+"Advertencia: squid puede fallar si los archivos de registro superan los 2 GB"
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+"Squid puede fallar si alguno de los archivos de registro alcanza un tamaño "
+"superior a 2 GB. Por favor configure «/etc/logrotate.d/squid» conforme al "
+"tráfico de su sitio de internet"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+
+#~ msgid "Warning: squid-cgi can be (ab)used from a remote host."
+#~ msgstr ""
+#~ "Advertencia: «squid-cgi» puede ser manipulado desde un servidor remoto."
+
+#~ msgid ""
+#~ "This package contains a cgi-program that is installed and turned on by "
+#~ "default. It can be abused from a remote host to connect to any other host/"
+#~ "port with the connection originating from your webserver. Read /usr/share/"
+#~ "doc/squid-cgi/README.cachemgr.gz for details!"
+#~ msgstr ""
+#~ "Este paquete contiene un programa cgi que se instala y activa por "
+#~ "defecto. Puede ser manipulado desde un servidor remoto para conectarse a "
+#~ "cualquier otro servidor/puerto con la conexión proveniente de su servidor "
+#~ "web. ¡Para mayor información lea «/usr/share/doc/squid-cgi/README."
+#~ "cachemgr.gz»!"
--- squid-2.5.9.orig/debian/po/it.po
+++ squid-2.5.9/debian/po/it.po
@@ -0,0 +1,286 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: squid_2.5.6-9\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2004-10-22 17:50+0200\n"
+"PO-Revision-Date: 2004-08-04 16:25+0200\n"
+"Last-Translator: Luigi Gangitano <luigi@debian.org>\n"
+"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: note
+#. Description
+#: ../templates:3
+#, fuzzy
+msgid ""
+"The http_anonymizer directive has been replaced with header_replace and "
+"header_access."
+msgstr ""
+"L'opzione http_anonymizer è stata sostituita con l'opzione header_access"
+
+#. Type: note
+#. Description
+#: ../templates:3
+msgid ""
+"The http_anonymizer directive that was present in squid 2.1 and 2.2 doesn't "
+"exist anymore in squid 2.3 and up. It has been replaced with header_replace "
+"and header_access that provide more fine-grained control over HTTP headers. "
+"Right now, your squid doesn't anonymize the HTTP headers anymore so you "
+"probably want to fix this. The new format is explained in the new 2.5 config "
+"file, of which you probably have a copy in /usr/share/doc/squid/examples/"
+"squid.conf."
+msgstr ""
+"L'opzione http_anonymizer che era presente nelle versioni 2.1 e 2.2 di "
+"squidnon esiste più nella versione 2.3 e successive. Tale opzione è stata "
+"sostituitacon le opzioni header_replace e header_access che forniscono un "
+"controllo piùgranulare sulle intestazioni HTTP.In questo momento squid non "
+"maschera più le intestazioni HTTP; è probabilequindi che vorrai correggere "
+"questo problema. Il formato delle nuoveopzioni è descritto nel file di "
+"configurazione della versione 2.5 di squiddi cui puoi trovare una copia in /"
+"usr/share/doc/squid/examples/squid.conf"
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives have been replaced with "
+"header_access and header_replace."
+msgstr ""
+"Le opzioni anonymize_headers e fake_user_agent sono state sostituite "
+"conheader_access e header_replace"
+
+#. Type: note
+#. Description
+#: ../templates:14
+#, fuzzy
+msgid ""
+"The anonymize_headers and fake_user_agent directives that were present in "
+"squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been "
+"replaced  with header_replace and header_access that provide more fine-"
+"grained control  over HTTP headers. Right now, your squid doesn't anonymize "
+"the HTTP headers anymore so you probably want to fix this. The new format is "
+"explained in the new 2.5 config file, of which you probably have a copy in /"
+"usr/share/doc/squid/examples/squid.conf."
+msgstr ""
+"Le opzioni anonymize_header e fake_user_agent che erano presente nelle "
+"versioni 2.3 e 2.4 di squid non esiste più nella versione 2.5 e successive."
+"Tali opzioni sono state sostituite con le opzioni header_replace "
+"eheader_access che forniscono un controllo più granulare sulle intestazioni "
+"HTTP.In questo momento squid non maschera più le intestazioni HTTP; è "
+"probabilequindi che vorrai correggere questo problema. Il formato delle "
+"nuoveopzioni è descritto nel file di configurazione della versione 2.5 di "
+"squiddi cui puoi trovare una copia in /usr/share/doc/squid/examples/squid."
+"conf"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+#, fuzzy
+msgid "There is no automatic upgrade path to squid 2.5."
+msgstr "Non esiste un metodo automatico di aggiornamento a squid 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "             SQUID 2.5 INSTALLATION WARNING"
+msgstr "             ATTENZIONE: INSTALLAZIONE DI SQUID 2.5"
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"You are upgrading squid from an 1.x version to the 2.5 version. The 1.x and "
+"2.5 versions are NOT compatible. The structure of the cache directory is "
+"different and the configuration file \"squid.conf\" is not entirely "
+"compatible."
+msgstr ""
+"Stai effettuando l'aggiornamento di squid dalla versione 1.x alla "
+"versione2.5. Le versioni 1.x e 2.5 non sono compatibili. La struttura delle "
+"directorydi cache è stata cambiata e il file di configurazione \"squid.conf"
+"\" non èinteramente compatibile."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"If you have an old cache directory, please quit NOW and remove the old cache "
+"by hand (in /var/spool/squid). Then re-install this squid version."
+msgstr ""
+"Se hai una directory di cache nel vecchio formato, per favore esci ORA "
+"erimuovi la vecchia directory manualmente (in /var/spool/squid). In "
+"seguitoripeti l'installazione di questa versione di squid."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid ""
+"Also, please accept the new configuration file. After upgrading your old "
+"configuration file can be found in \"/etc/squid.conf.dpkg-old\". Then you "
+"have to edit the new configuration file by hand to match your old "
+"configuration."
+msgstr ""
+"Inoltre, per favore, installa il nuovo file di configurazione. Al "
+"terminedell'aggiornamento puoi trovare il tuo vecchio file di "
+"configurazione  in\"/etc/squid.conf.dpkg-old\". Dovrai modificare "
+"manualmente il nuovo file diconfigurazione per ottenere la tua vecchia "
+"configurazione."
+
+#. Type: boolean
+#. Description
+#: ../templates:25
+msgid "Do you want to quit now?"
+msgstr "Vuoi uscire ora?"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "squid-cgi now uses config file for target ACL"
+msgstr "Ora squid-cgi usa un file di configurazione per le ACL"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid ""
+"squid-cgi now checks a configuration file before connecting to the target "
+"host. Only allowed target will be contacted. Please add hosts you want to "
+"access to the file /etc/squid/cachemgr.conf, one per line in the form"
+msgstr ""
+"Da ora squid-cgi controlla un file di configurazione prima di connettersial "
+"server di destinazione. Solo le destinazioni autorizzate sarannocontattate. "
+"Per favore aggiungi i nomi dei server a cui vuoi accedere alfile /etc/squid/"
+"cachemgr.conf, uno per line, nella forma"
+
+#. Type: note
+#. Description
+#: ../templates:45
+msgid "  hostname:port"
+msgstr "  nomehost:porta"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid "Upgrade squid.conf automatically?"
+msgstr "Aggiornare squid.conf automaticamente?"
+
+#. Type: boolean
+#. Description
+#: ../templates:55
+msgid ""
+"Incompatible settings have been found in the existing squid.conf file; they "
+"will prevent squid from starting or working correctly. However, this setup "
+"can try to modify them to work again. Do you want to apply the changes?"
+msgstr ""
+"Sono state trovate impostazioni non compatibili nel file squid.conf "
+"esistente;tali opzioni inpediscono a squid di avviarsi o funzionare "
+"correttamente.Questo processo, comunque, può provare a modificarle per "
+"rendere squidnuovamente funzionante. Vuoi applicare le modifiche?"
+
+#. Type: note
+#. Description
+#: ../templates:63
+#, fuzzy
+msgid "The authenticate_program directive has been replaced with auth_param."
+msgstr "L'opzione authenticate_program è stata sostituita da auth_param"
+
+#. Type: note
+#. Description
+#: ../templates:63
+msgid ""
+"The authenticate_program directive that was present in squid <= 2.4 doesn't "
+"exist anymore in squid 2.5 and up. All authentication directives have been "
+"replaced with auth_param. Right now, your squid doesn't authenticate users "
+"anymore so you probably want to fix this. The new format is explained in the "
+"new 2.5 config file, of which you probably have a copy in /usr/share/doc/"
+"squid/examples/squid.conf."
+msgstr ""
+"L'opzione authenticate_program che era presente nelle versioni di "
+"squidprecedenti alla 2.4 non esiste più nelle versioni 2.5 e successive. "
+"Tutte leopzioni di autenticazione sono state sostituite con auth_param. In "
+"questomomento squid non è in grado di autenticare gli utenti; è probabile "
+"quindi chevorrai correggere questo problema. Il formato delle nuove opzioni "
+"è descrittonel file di configurazione della versione 2.5 di squid di cui "
+"puoi trovareuna copia in /usr/share/doc/squid/examples/squid.conf"
+
+#. Type: note
+#. Description
+#: ../templates:73
+#, fuzzy
+msgid "Warning: squid may crash when logfiles size is bigger than 2GB."
+msgstr ""
+"Attenzione: squid può smettere di funzionare quando la dimensione deifile di "
+"log supera i 2GB"
+
+#. Type: note
+#. Description
+#: ../templates:73
+msgid ""
+"Squid may crash if any of the logfiles grows bigger than 2GB. Please "
+"configure /etc/logrotate.d/squid accordingly to your site's traffic."
+msgstr ""
+"Squid può smettere di funzionare se la dimensione di uno qualsiasi dei "
+"filedi log cresce oltre i 2GB. Per favore configura /etc/logrotate/squid "
+"inmaniera consona al traffico sul tuo server"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid "Fix permissions of cache_dir?"
+msgstr "Correggo i permessi della cache_dir?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"Values for cache_effective_user and/or cache_effective_group in config file  "
+"are incompatible with owner/group of cache directories. Do you want to "
+"automatically fix permissions on cache directory?"
+msgstr ""
+"Il valore delle opzioni cache_effective_user e/o cache_effective_group "
+"nelfile di configurazione è incompatibile con il proprietario/gruppo "
+"delledirectory di cache. Vuoi correggere automaticamente i permessi sulla "
+"directorydi cache?"
+
+#. Type: boolean
+#. Description
+#: ../templates:80
+msgid ""
+"WARNING: If you specified a cache directory different from /var/spool/squid "
+"and selected some other directory used by other programs (e.g. /tmp), this "
+"could affect those programs."
+msgstr ""
+"ATTENZIONE: Se hai impostato come directory di cache una directory diversa "
+"da/var/spool/squid e questa directory è usata da altri programmi (per "
+"esempio/tmp), questa correzione potrebbe impedire a quei programmi di "
+"funzionarecorrettamente."
+
+#~ msgid "Warning: squid-cgi can be (ab)used from a remote host."
+#~ msgstr "Attenzione: squid-cgi può essere (ab)usato da un host remoto."
+
+#~ msgid ""
+#~ "This package contains a cgi-program that is installed and turned on by "
+#~ "default. It can be abused from a remote host to connect to any other host/"
+#~ "port with the connection originating from your webserver. Read /usr/share/"
+#~ "doc/squid-cgi/README.cachemgr.gz for details!"
+#~ msgstr ""
+#~ "Questo pacchetto contiene un programma CGI che viene installato ed "
+#~ "attivatoautomaticamente. Può essere utilizzato da un host remoto per "
+#~ "connettersi aun qualsiasi altro host facendo apparire la connessione come "
+#~ "proveniente daltuo webserver. Leggi /usr/share/doc/squid-cgi/README."
+#~ "cachemgr.gz per idettagli"
--- squid-2.5.9.orig/debian/preinst
+++ squid-2.5.9/debian/preinst
@@ -0,0 +1,95 @@
+#! /bin/sh
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+warn() {
+	db_reset squid/old_version
+	db_input high squid/old_version || true
+	db_go
+	db_get squid/old_version
+	if [ "$RET" = "true" ]
+	then
+		exit 1
+	fi
+}
+
+case "$1" in
+	upgrade|install-upgrade)
+		;;
+	abort-upgrade)
+		exit 0
+		;;
+esac
+
+#
+# See if we upgraded from 1.0 or 1.2
+#
+if [ "$1" = upgrade ] || [ "$1" = install ]
+then
+	case "$2" in
+		1.0*)
+			warn 1.0
+			;;
+		1.1*)
+			warn 1.1
+			;;
+	esac
+fi
+
+
+#
+# See if we upgraded from <= 2.4.5-3
+#
+#if ([ "$1" = upgrade ] && dpkg --compare-versions "$2" le '2.5.4-4' ) || [ "$1" = install ]
+#then
+#	db_reset squid/largefiles_warning
+#	db_input high squid/largefiles_warning || true
+#	db_go
+#	db_get squid/old_version
+#	if [ "$RET" = "true" ]
+#	then
+#		exit 1
+#	fi
+#fi
+
+#
+# See if we upgraded from < 2.5.5-3 and need to move config file
+#
+if ([ "$1" = upgrade ] && dpkg --compare-versions "$2" le '2.5.5-3' )
+then
+	if [ -e /etc/squid.conf ]
+	then
+		if [ ! -d /etc/squid ]
+		then
+			mkdir /etc/squid
+		fi
+		if [ -e /etc/squid/squid.conf ]
+		then
+			mv /etc/squid/squid.conf /etc/squid/squid.conf.dpkg-old
+		fi
+		mv /etc/squid.conf /etc/squid/squid.conf
+		touch /etc/squid/conffile-moved
+	fi
+fi
+
+#
+# Add the "proxy" user/group to /etc/passwd if needed.
+#
+
+if ! grep -q "^proxy:" /etc/passwd
+then
+	#
+	#	Let's hope that this works; if /var/spool/squid is
+	#	already present this fails :(
+	#
+	adduser --system --home /var/spool/squid --group proxy
+	#
+	# Change the shell so that cron jobs will work.
+	# (They run as root now, but you can never know).
+	#
+	chsh -s /bin/sh proxy
+fi
+
+exit 0
--- squid-2.5.9.orig/debian/squidclient.1
+++ squid-2.5.9/debian/squidclient.1
@@ -0,0 +1,48 @@
+.TH SQUIDCLIENT 1 "Mar 1998" "Squid Cache" "Debian Linux"
+.SH NAME
+squidclient -- client interface to the squid cache
+.SH SYNOPSIS
+.B squidclient
+.RB [ \-r ]
+.RB [ \-s ]
+.RB [ \-i
+.IR IMS ]
+.RB [ \-h
+.IR host ]
+.RB [ \-p
+.IR port ]
+.RB [ \-m
+.IR method ]
+.B url
+.SH DESCRIPTION
+.B Squidclient
+is a command line interface to retrieve URLs through the squid object cache.
+.SH OPTIONS
+.IP -r
+Force cache to reload URL.
+.IP -s
+Silent.  Do not print data to stdout.
+.IP -i \fIIMS\fP
+If-Modified-Since time (in Epoch seconds).
+.IP -h \fIhost\fP
+Retrieve URL from cache on hostname.  Default is localhost.
+.IP -p \fIport\fP
+Port number of cache.  Default is 3128.
+.IP -m \fImethod\fP
+Request method, default is GET. Squid also supports a non-standard method
+called \fBPURGE\fP. You can use that to purge a specific URL from the cache.
+You need to have \fIpurge\fP access setup in squid.conf similar to
+\fImanager\fP access. Here is an example:
+.nf
+
+      acl purge method PURGE
+      http_access deny  purge !localhost
+.fi
+
+.SH SEE ALSO
+squid(8).
+.SH AUTHOR
+Derived from Harvest. Further developed by by numerous individuals from
+the internet community. Development is led by Duane Wessels of the
+National Laboratory for Applied Network Research and funded by
+the National Science Foundation.
--- squid-2.5.9.orig/debian/postinst
+++ squid-2.5.9/debian/postinst
@@ -0,0 +1,207 @@
+#! /bin/sh
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+grepconf () {
+	w=" 	" # space tab
+	sq=/etc/squid/squid.conf
+	# sed is cool.
+	res=`sed -ne '
+		s/^'$1'['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
+		t end;
+		d;
+		:end q' < $sq`
+	[ -n "$res" ] || res=$2
+	echo "$res"
+}
+
+grepconf2 () {
+	w=" 	" # space tab
+	sq=/etc/squid/squid.conf
+	# sed is cool.
+	res=`sed -ne '
+		s/^'$1'['"$w"']\+[^'"$w"']\+['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
+		t end;
+		d;
+		:end q' < $sq`
+	[ -n "$res" ] || res=$2
+	echo "$res"
+}
+
+#
+#	Fix old style "cache_dir /var/spool/squid 100 16 256"
+#	to include "ufs" (Unix File System) after "cache_dir".
+#
+conf_fix_cache_dir () {
+
+   # get value for squid/fix_lines
+   db_get squid/fix_lines
+  
+   # handle it!
+   if [ "$RET" = "true" ] ; then
+      sed -e 's/^cache_dir\(.*\)$/cache_dir ufs\1/' \
+      -e 's/^\(dns_children.*\)$/#NOT IN 2.3#\1/' \
+      -e 's/^\(dns_defnames.*\)$/#NOT IN 2.3#\1/' \
+      -e 's/^\(cache_dns_program.*\)$/#NOT IN 2.3#\1/' \
+      < /etc/squid/squid.conf > /etc/squid/squid.conf.TMP && \
+      mv /etc/squid/squid.conf.TMP /etc/squid/squid.conf
+   fi
+
+}
+#
+#	The http_anonymizer option doesn't exist anymore.
+#	Warn the user through debconf.
+#
+conf_fix_anonymizer () {
+	w=" 	" # space tab
+	if grep -q "^http_anonymizer[$w]*" /etc/squid/squid.conf
+	then
+		db_text high squid/http_anonymizer || true
+		db_go
+	fi
+}
+
+#
+#	The anonymize_headers and fake_user_agent options don't exist anymore.
+#	Warn the user through debconf.
+#
+conf_fix_anonymizer2 () {
+	w=" 	" # space tab
+	if grep -q "^anonymize_headers[$w]*" /etc/squid/squid.conf || grep -q "^fake_user_agent[$w]*" /etc/squid/squid.conf
+	then
+		db_text high squid/anonymize_headers || true
+		db_go
+	fi
+}
+
+#
+#	We moved from /etc/cron.d/squid to /etc/logrotate.d/squid
+#
+conf_fix_logrotate () {
+	c=/etc/cron.daily/squid
+	if [ -f $c ]
+	then
+		##db_text high squid/logrotate || true
+		##db_go
+		cp -a $c $c.disabled
+		( head -1 $c
+		  echo "#"
+		  echo "# DISABLED - squid now uses /etc/logrotate.d/squid"
+		  echo "#            please remove this file."
+		  echo "#"
+		) > $c.disabled
+		tail +2 $c >> $c.disabled
+		rm -f $c
+	fi
+}
+
+#
+#	The authenticate_program option doesn't exist anymore.
+#	Warn the user through debconf.
+#
+conf_fix_auth_param () {
+	w=" 	" # space tab
+	if grep -q "^authenticate_program[$w]*" /etc/squid/squid.conf
+	then
+		db_text high squid/authenticate_program || true
+		db_go
+	fi
+}
+
+
+case "$1" in
+	configure)
+		if [ -e /etc/squid/conffile-moved ] ; then
+			rm /etc/squid/conffile-moved
+		fi
+
+		if [ ! -f /etc/squid/squid.conf ]; then
+			cp /usr/share/doc/squid/examples/squid.conf \
+				/etc/squid/squid.conf
+			chmod 0600 /etc/squid/squid.conf
+		fi
+
+		# Check for old incompatible configs
+		case "$2" in
+			2.[12].*)
+				conf_fix_cache_dir
+				FIXLINES="$RET"
+				;;
+		esac
+		conf_fix_anonymizer
+		conf_fix_anonymizer2
+		conf_fix_logrotate
+		conf_fix_auth_param
+
+		#
+		# Chown the directories.
+		#
+		dir=`grepconf2 cache_dir /var/spool/squid`
+        usr=`grepconf cache_effective_user proxy`
+		grp=`grepconf cache_effective_group proxy`
+		
+		if [ "$FIXLINES" = "false" ]; then
+		  echo "squid.conf contains 2.2.5 syntax - not doing anything!" 
+		else
+			if [ "$(/usr/bin/stat -c %U $dir)" != "$usr" ] || [ "$(/usr/bin/stat -c %G $dir)" != "$grp" ] ; then
+   				db_get "squid/fix_cachedir_perms"
+   				if [ "$RET" = "true" ] ; then
+		      		chown $usr:$grp $dir -R
+				fi
+   				db_reset "squid/fix_cachedir_perms"
+			fi
+			if [ "$(/usr/bin/stat -c %U /var/log/squid)" != "$usr" ] || [ "$(/usr/bin/stat -c %G /var/log/squid)" != "$grp" ] ; then
+		  		chown $usr:$grp /var/log/squid -R
+			fi
+		fi
+	 
+		#
+		# Create spool dirs if they don't exist.
+		#
+		if [ -d "$dir" -a ! -d "$dir/00" ]
+		then
+			echo "Creating squid spool directory structure"
+			/usr/sbin/squid -z
+		fi
+
+		#
+		# Install /etc/default/squid file if it doesn't
+		# exist yet.
+		#
+		if [ ! -f /etc/default/squid ]
+		then
+			cp /usr/share/doc/squid/examples/default.squid \
+				/etc/default/squid
+			chmod 644 /etc/default/squid
+		fi
+
+		;;
+	abort-upgrade|abort-remove|abort-deconfigure)
+		;;
+	*)
+		#
+		#	Unknown action - do nothing.
+		#
+		exit 0
+		;;
+esac
+
+db_stop
+
+#
+#	Update links if needed and start squid.
+#
+update-rc.d squid defaults 30 >/dev/null
+
+cd /
+
+if [ "$FIXLINES" = "false" ]; then
+  echo "squid.conf contains 2.2.5 syntax - cache_dir directive - not starting "
+  echo "Run 'dpkg-reconfigure -plow squid' to fix this automatically," 
+  echo "or fix the 'cache_dir'-entry in your squid.conf manually." 
+  echo "See documentation in /usr/share/doc/squid for nearer instructions."
+else
+  invoke-rc.d squid start
+fi
--- squid-2.5.9.orig/debian/prerm
+++ squid-2.5.9/debian/prerm
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+	remove|upgrade|remove-in-favour|deconfigure-in-favour)
+		#
+		#	Stop the daemon
+		#
+		/etc/init.d/squid stop
+		[ -L /usr/doc/squid ] && rm -f /usr/doc/squid
+		;;
+	failed-upgrade)
+		;;
+esac
+
+exit 0
--- squid-2.5.9.orig/debian/README.Debian
+++ squid-2.5.9/debian/README.Debian
@@ -0,0 +1,115 @@
+
+The squid homepage is at http://www.squid-cache.org/
+Squid was downloaded from that site with HTTP.
+
+**** Configuration File ****
+
+The upstream squid.conf contains ACLs so that squid denies all
+requests by default, forcing you to configure it first. The Debian
+package allows access from 'localhost'. To use it you need to
+configure your browser to use proxyserver 'localhost', port 3128.
+
+Please see /usr/share/doc/squid/example/default.squid for documentation 
+on the configuration file.
+
+You can increase the maximum number of filedescriptors that squid
+uses through /etc/default/squid. See the README.morefds file.
+
+You can also run squid with a userid different from root from the beginning
+(no just dropping root privileges after running). To do so add a CHUID=user
+line in /etc/default/squid where 'user' is the user you want squid to run 
+as. Please adjust permission accordingly, expecially for squid.conf that
+is installed as root with permission set to 0600.
+
+The default /etc/squid/squid.conf file turns off icmp, htcp and snmp.
+
+Note that the syntax of the command line arguments to auth_ldap
+changed in 2.4.2 (relative to 2.3.4-2 to 2.4.1-6). See README.ldap_auth
+
+**** Patches applied and build-time options ****
+
+A number of patches were applied using dpatch. A lot of them are Debian 
+specific, you will not find them outside of Debian (yet).
+
+cf.data.debian.patch	Debian specific squid.conf patches
+dfl-error-dir.patch		Default error dir is under /usr/share/squid
+						for Debian
+no_append_domain_localhost.patch
+						Don't apply "append_domain" setting to "localhost"
+						in unqualified URLs.
+smb_auth.patch			Read password with '-r' so backslashes work
+syslog.patch			Log to daemon.log instead of local4.log
+unlinkd.patch			Compile in unlinkd support even with async io
+manpages.patch			Fixed a wrong reference to the config file
+
+
+Squid was compiled with the following options:
+
+config.status: 
+	./configure \
+	--prefix=/usr \
+	--exec_prefix=/usr \
+	--bindir=/usr/sbin --sbindir=/usr/sbin \
+	--libexecdir=/usr/lib/squid \
+	--sysconfdir=/etc/squid \
+	--localstatedir=/var/spool/squid \
+	--datadir=/usr/share/squid \
+	--enable-linux-netfilter					[1]
+	--enable-storeio=ufs,aufs,diskd,null \		[1]
+	--enable-arp-acl \							[1]
+	--enable-removal-policies=lru,heap \
+	--enable-snmp \
+	--enable-delay-pools \
+	--enable-htcp \
+	--enable-poll \
+	--enable-cache-digests \
+	--enable-underscores \
+	--enable-referer-log \
+	--enable-useragent-log \
+	--enable-auth="basic,digest,ntlm" \
+	--enable-carp \
+	--enable-large-files \
+	$(arch)-debian-$(system)
+
+Where $(arch) is i386 or alpha or sparc etc and $(system) is linux or hurd.
+
+[1] For the Hurd squid is compiled without netfilter, arp-acl,
+    aufs and pthread support
+
+Furthermore the following flags were passed to the squid Makefile
+to customize some locations:
+
+bindir       = /usr/sbin
+libexecdir   = /usr/lib/squid
+sysconfdir   = /etc/squid
+logdir       = /var/log/squid
+docdir       = /usr/share/doc/squid
+datadir      = /usr/share/squid
+
+DEFAULTS     =	logdir=$(logdir) \
+DEFAULT_CACHE_LOG=$(logdir)/cache.log \
+DEFAULT_ACCESS_LOG=$(logdir)/access.log \
+DEFAULT_STORE_LOG=$(logdir)/store.log \
+DEFAULT_PID_FILE=/var/run/squid.pid \
+DEFAULT_SWAP_DIR=/var/spool/squid \
+DEFAULT_ICON_DIR=$(datadir)/icons \
+DEFAULT_ERROR_DIR=$(datadir)/errors/English \
+DEFAULT_MIME_TABLE=$(datadir)/mime.conf \
+DEFAULT_MIB_PATH=$(datadir)/mib.txt
+
+So squid uses the following paths:
+
+- configfile:  /etc/squid/squid.conf
+- binary:      /usr/sbin/squid
+- private dir: /usr/share/squid (mime.conf, error messages, modules)
+- logfiles:    /var/log/squid
+- cache:       /var/spool/squid
+
+**** TroubleShooting ****
+
+If you are in doubt as to why squid doesn't cache a certain
+object or webpage, you can try the "cacheability service" at
+http://www.ircache.net/cgi-bin/cacheability.py . It will check
+an URL for you and tell you if it is or isn't cachable and why.
+
+ -- Luigi Gangitano <luigi@debian.org>, Mon, 04 Aug 2004 18:08:00 +0200
--- squid-2.5.9.orig/debian/README.ldap_auth
+++ squid-2.5.9/debian/README.ldap_auth
@@ -0,0 +1,34 @@
+
+This LDAP Authentication code is written by Glen Newton
+<gnewton@wapiti.cisti.nrc.ca>.
+
+Please see his Web page at:
+http://orca.cisti.nrc.ca/~gnewton/opensource/squid_ldap_auth/
+
+Description:
+
+squid_ladp_auth is a drop in replacement for the ncsa_auth.c
+distributed with the squid proxy server (http://squid.nlanr.net) which
+allows you to authenticate against an LDAP server. To use, include
+something like the following in your squid.conf file:
+
+# authenticate_program
+/usr/lib/squid/ldap_auth -b searchbase my.ldap.server.com
+#
+
+This indicates that you want squid_ldap_auth to take the userid
+and password submited by the proxy user, and see if you can bind to
+the LDAP server running on 'my.ldap.server.com'. The searchbase
+should be something like "ou=people,o=nrc.ca" or
+"ou=users,dc=debian,dc=org".
+
+In order to use squid_ldap_auth, you will also need to install
+the OpenLDAP libraries (libopenldap2_*.deb)
+
+You can test it by running it manually like
+
+/usr/lib/squid/ldap_auth -b ou=users,dc=debian,dc=org db.debian.org
+
+Input "username<SPACE>password<ENTER>" pairs. The authentication module
+will answer back with OK or ERR. End the session with Control-D.
+
--- squid-2.5.9.orig/debian/conffiles
+++ squid-2.5.9/debian/conffiles
@@ -0,0 +1,3 @@
+/etc/init.d/squid
+/etc/logrotate.d/squid
+/etc/resolvconf/update-libc.d/squid
--- squid-2.5.9.orig/debian/squid-cgi.8
+++ squid-2.5.9/debian/squid-cgi.8
@@ -0,0 +1,13 @@
+.TH SQUID-CGI 8 "Januari 1998" "Squid CGI Interface" "Debian Linux"
+.SH NAME
+squid-cgi \- CGI interface to squid
+.SH SYNOPSIS
+.B /usr/lib/cgi-bin/squid-cgi
+.SH DESCRIPTION
+.B Squid-cgi
+is a CGI program that can be used as a WWW-based frontend to the
+squid object cache. It should be run as a CGI script through your
+WWW server.
+.PP
+.SH "SEE ALSO"
+.BR squid (8)
--- squid-2.5.9.orig/debian/squid.resolvconf
+++ squid-2.5.9/debian/squid.resolvconf
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+# Make squid aware of changes to resolv.conf
+/etc/init.d/squid reload || true
--- squid-2.5.9.orig/debian/default.squid
+++ squid-2.5.9/debian/default.squid
@@ -0,0 +1,8 @@
+#
+# /etc/default/squid	Configuration settings for the Squid proxy server.
+#
+
+# Max. number of filedescriptors to use. You can increase this on a busy
+# cache to a maximum of (currently) 4096 filedescriptors. Default is 1024.
+SQUID_MAXFD=1024
+
--- squid-2.5.9.orig/debian/squid.rc
+++ squid-2.5.9/debian/squid.rc
@@ -0,0 +1,187 @@
+#! /bin/sh
+#
+# squid		Startup script for the SQUID HTTP proxy-cache.
+#
+# Version:	@(#)squid.rc  2.20  01-Oct-2001  miquels@cistron.nl
+#
+
+NAME=squid
+DAEMON=/usr/sbin/squid
+LIB=/usr/lib/squid
+PIDFILE=/var/run/$NAME.pid
+SQUID_ARGS="-D -sYC"
+
+[ ! -f /etc/default/squid ] || . /etc/default/squid
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+[ -x $DAEMON ] || exit 0
+
+grepconf () {
+	w=" 	" # space tab
+	sq=/etc/squid/squid.conf
+	# sed is cool.
+	res=`sed -ne '
+		s/^'$1'['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
+		t end;
+		d;
+		:end q' < $sq`
+	[ -n "$res" ] || res=$2
+	echo "$res"
+}
+
+grepconf2 () {
+	w=" 	" # space tab
+	sq=/etc/squid/$NAME.conf
+	# sed is cool.
+	res=`sed -ne '
+		s/^'$1'['"$w"']\+[^'"$w"']\+['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
+		t end;
+		d;
+		:end q' < $sq`
+	[ -n "$res" ] || res=$2
+	echo "$res"
+}
+
+#
+#	Try to increase the # of filedescriptors we can open.
+#
+maxfds () {
+	[ -n "$SQUID_MAXFD" ] || return
+	[ -f /proc/sys/fs/file-max ] || return 0
+	[ $SQUID_MAXFD -le 4096 ] || SQUID_MAXFD=4096
+	global_file_max=`cat /proc/sys/fs/file-max`
+	minimal_file_max=$(($SQUID_MAXFD + 4096))
+	if [ "$global_file_max" -lt $minimal_file_max ]
+	then
+		echo $minimal_file_max > /proc/sys/fs/file-max
+	fi
+	ulimit -n $SQUID_MAXFD
+}
+
+fixperms () {
+	dir=$1
+	usr=$2
+	grp=$3
+
+	currusr=`/usr/bin/stat -c '%U' $dir`
+	currgrp=`/usr/bin/stat -c '%G' $dir`
+
+	if [ $currusr != $usr ]
+	then
+		chown $usr $dir -R
+	fi
+	
+	if [ $currgrp != $grp ]
+	then
+		chgrp $grp $dir -R
+	fi
+	
+}
+
+start () {
+	cdr=`grepconf2 cache_dir /var/spool/$NAME`
+    usr=`grepconf cache_effective_user proxy`
+	grp=`grepconf cache_effective_group proxy`
+
+	case "$cdr" in
+		[0-9]*)
+			echo "squid: squid.conf contains 2.2.5 syntax - not starting!" >&2
+			exit 1
+			;;
+	esac
+	
+	#
+    # Create spool dirs if they don't exist.
+    #
+	if [ -d "$cdr" -a ! -d "$cdr/00" ]
+	then
+		echo "Creating squid spool directory structure"
+		/usr/sbin/squid -z
+	fi
+
+	if [ "$CHUID" = "" ]; then
+		CHUID=root
+	fi
+
+	maxfds
+	umask 027
+	cd $cdr
+	start-stop-daemon --quiet --start \
+		--pidfile $PIDFILE \
+		--chuid $CHUID \
+		--exec $DAEMON -- $SQUID_ARGS < /dev/null
+	sleep 1
+}
+
+stop () {
+	PID=`cat $PIDFILE 2>/dev/null`
+	start-stop-daemon --stop --quiet --pidfile $PIDFILE --exec $DAEMON
+	#
+	#	Now we have to wait until squid has _really_ stopped.
+	#
+	sleep 2
+	if test -n "$PID" && kill -0 $PID 2>/dev/null
+	then
+		echo -n "(waiting..."
+		cnt=0
+		while kill -0 $PID 2>/dev/null
+		do
+			cnt=`expr $cnt + 1`
+			if [ $cnt -gt 60 ]
+			then
+				#
+				#	Waited 120 seconds now. Fail.
+				#
+				echo -n "failed)"
+				if [ "$1" = verbose ] ; then
+					echo "."
+				else
+					echo -n " "
+				fi
+				return
+			fi
+			sleep 2
+			echo -n "."
+		done
+		echo -n "done)"
+		if [ "$1" = verbose ] ; then
+			echo " $NAME."
+		else
+			echo -n " "
+		fi
+	else
+		[ "$1" = verbose ] && echo "$NAME."
+	fi
+}
+
+case "$1" in
+    start)
+	echo -n "Starting proxy server: "
+	start
+	echo "$NAME."
+	;;
+    stop)
+	echo -n "Stopping proxy server: "
+	stop verbose
+	;;
+    reload|force-reload)
+	echo -n "Reloading $NAME configuration files..."
+	start-stop-daemon --stop --signal 1 \
+		--pidfile $PIDFILE --quiet --exec $DAEMON
+	echo "done."
+	;;
+    restart)
+	echo -n "Restarting proxy server: "
+	stop
+	start
+	echo "$NAME."
+	;;
+    *)
+	echo "Usage: /etc/init.d/$NAME {start|stop|reload|force-reload|restart}"
+	exit 3
+	;;
+esac
+
+exit 0
+
--- squid-2.5.9.orig/debian/postinst.squidclient
+++ squid-2.5.9/debian/postinst.squidclient
@@ -0,0 +1,15 @@
+#! /bin/sh
+
+case "$1" in
+	configure)
+		;;
+	abort-upgrade|abort-remove|abort-deconfigure)
+		;;
+	*)
+		#
+		#	Unknown action - do nothing.
+		#
+		exit 0
+		;;
+esac
+
--- squid-2.5.9.orig/debian/postrm.squid-cgi
+++ squid-2.5.9/debian/postrm.squid-cgi
@@ -0,0 +1,8 @@
+#! /bin/sh
+
+if [ "$1" = "purge" -a -e /usr/share/debconf/confmodule ]; then
+	# Source debconf library.
+	. /usr/share/debconf/confmodule
+	# Remove my changes to the db.
+	db_purge
+fi
--- squid-2.5.9.orig/debian/prerm.squidclient
+++ squid-2.5.9/debian/prerm.squidclient
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+	remove|upgrade)
+		[ -L /usr/doc/squidclient ] && rm -f /usr/doc/squidclient
+		;;
+	*)
+		;;
+esac
+
+exit 0
--- squid-2.5.9.orig/debian/config
+++ squid-2.5.9/debian/config
@@ -0,0 +1,73 @@
+#!/bin/sh -e
+
+#
+#       check for old config-style in squid.conf
+#       (include "ufs" (Unix File System) after "cache_dir".)
+#
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+db_version 2.0
+          
+grepconf () {
+	w=" 	" # space tab
+	sq=/etc/squid/squid.conf
+	# sed is cool.
+	res=`sed -ne '
+		s/^'$1'['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
+		t end;
+		d;
+		:end q' < $sq`
+	[ -n "$res" ] || res=$2
+	echo "$res"
+}
+
+grepconf2 () {
+	w=" 	" # space tab
+	sq=/etc/squid/squid.conf
+	# sed is cool.
+	res=`sed -ne '
+		s/^'$1'['"$w"']\+[^'"$w"']\+['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
+		t end;
+		d;
+		:end q' < $sq`
+	[ -n "$res" ] || res=$2
+	echo "$res"
+}
+
+conf_fix_check_cache_dir () {
+  
+  if [ -f "/etc/squid/squid.conf" ]; then
+  
+    sq=/etc/squid/squid.conf
+    w="     " # space tab
+    grep -q "^cache_dir[$w]*[^/$w]" /etc/squid/squid.conf && return
+    umask 022
+    
+    if grep -q '^dns_children\|^dns_defnames\|^cache_dns_program' $sq || ( grep -q '^cache_dir' $sq && ! grep -q '^cache_dir.*ufs' $sq ); then
+   
+       # ask debconf-question here
+       db_input high squid/fix_lines || true
+       db_go
+    
+    fi
+  
+  fi
+} 
+
+conf_fix_cachedir_perms () {
+
+  if [ -f "/etc/squid/squid.conf" ]; then
+	dir=`grepconf2 cache_dir /var/spool/squid`
+	usr=`grepconf cache_effective_user proxy`
+	grp=`grepconf cache_effective_group proxy`
+		
+	if [ "$(/usr/bin/stat -c %U $dir)" != "$usr" ] || [ "$(/usr/bin/stat -c %G $dir)" != "$grp" ] ; then
+	  db_input high "squid/fix_cachedir_perms" || true
+	  db_go
+	fi
+  fi
+}
+
+conf_fix_check_cache_dir
+conf_fix_cachedir_perms
--- squid-2.5.9.orig/debian/logrotate
+++ squid-2.5.9/debian/logrotate
@@ -0,0 +1,18 @@
+#
+#	Logrotate fragment for squid.
+#
+/var/log/squid/*.log {
+	daily
+	compress
+	delaycompress
+	rotate 2
+	missingok
+	nocreate
+	sharedscripts
+	prerotate
+		test ! -x /usr/sbin/sarg-maint || /usr/sbin/sarg-maint
+	endscript
+	postrotate
+		test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
+	endscript
+}
--- squid-2.5.9.orig/debian/postrm
+++ squid-2.5.9/debian/postrm
@@ -0,0 +1,43 @@
+#! /bin/sh
+
+case "$1" in
+	remove)
+		;;
+	purge)
+		if [ -e /usr/share/debconf/confmodule ]; then
+			# Source debconf library.
+			. /usr/share/debconf/confmodule
+			# Remove my changes to the db.
+			db_purge
+		fi
+		echo "Purging startup links .."
+		rm -f /etc/init.d/squid
+		update-rc.d squid remove > /dev/null
+		echo "Purging logfiles .."
+		rm -rf /var/log/squid
+        	if [ -f /etc/squid/squid.conf ]; then
+			echo "Removing the config-file .."
+			rm -f /etc/squid/squid.conf
+		fi
+		if [ -f /etc/default/squid ]; then
+			rm -f /etc/default/squid
+		fi
+
+		#
+        	# We do not remove /var/spool/squid because that might
+        	# take a lot of time. Most of the time it is on a seperate
+        	# disk anyway and it is faster to do a mkfs on it..
+        	#
+        	echo "Remove the proxy cache in /var/spool/squid yourself!"
+		;;
+	failed-upgrade)
+		if (dpkg --compare-versions "$2" le '2.5.4-4' && [ -e /etc/squid/conffile-moved ])
+		then
+			mv /etc/squid/squid.conf /etc/squid.conf
+			rm /etc/squid/conffile-moved
+		fi
+		;;
+	upgrade|abort-install|abort-upgrade|disappear)
+		;;
+esac
+
--- squid-2.5.9.orig/debian/squid.overrides
+++ squid-2.5.9/debian/squid.overrides
@@ -0,0 +1,5 @@
+squid: non-standard-file-perm usr/share/doc/squid/examples/squid.conf 0600 != 0644
+squid: setgid-binary usr/lib/squid/pam_auth 2750 proxy/shadow
+squid: setgid-binary usr/lib/squid/getpwnam_auth 2750 proxy/shadow
+squid: non-standard-dir-perm var/log/squid/ 0750 != 0755
+squid: non-standard-dir-perm var/spool/squid/ 0750 != 0755
--- squid-2.5.9.orig/debian/patches/38-aufs-fixes.dpatch
+++ squid-2.5.9/debian/patches/38-aufs-fixes.dpatch
@@ -0,0 +1,502 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 38-aufs-fixes.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.9/src/fs/aufs/aiops.c /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/aiops.c
+--- squid-2.5.9/src/fs/aufs/aiops.c	2003-08-06 16:16:26.000000000 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/aiops.c	2005-04-04 02:06:56.276432738 +0200
+@@ -92,7 +92,6 @@
+     mode_t mode;
+     int fd;
+     char *bufferp;
+-    char *tmpbufp;
+     int buflen;
+     off_t offset;
+     int whence;
+@@ -121,7 +120,6 @@
+     unsigned long requests;
+ };
+ 
+-static void squidaio_init(void);
+ static void squidaio_queue_request(squidaio_request_t *);
+ static void squidaio_cleanup_request(squidaio_request_t *);
+ static void *squidaio_thread_loop(void *);
+@@ -256,7 +254,7 @@
+     commSetSelect(fd, COMM_SELECT_READ, squidaio_fdhandler, NULL, 0);
+ }
+ 
+-static void
++void
+ squidaio_init(void)
+ {
+     int i;
+@@ -308,8 +306,8 @@
+     pipe(done_pipe);
+     done_fd = done_pipe[1];
+     done_fd_read = done_pipe[0];
+-    fd_open(done_pipe[0], FD_PIPE, "async-io completetion event: main");
+-    fd_open(done_pipe[1], FD_PIPE, "async-io completetion event: threads");
++    fd_open(done_fd_read, FD_PIPE, "async-io completion event: main");
++    fd_open(done_fd, FD_PIPE, "async-io completion event: threads");
+     commSetNonBlocking(done_pipe[0]);
+     commSetNonBlocking(done_pipe[1]);
+     commSetSelect(done_pipe[0], COMM_SELECT_READ, squidaio_fdhandler, NULL, 0);
+@@ -352,6 +350,23 @@
+     squidaio_initialised = 1;
+ }
+ 
++void
++squidaio_shutdown(void)
++{
++    if (!squidaio_initialised)
++	return;
++
++    /* This is the same as in squidaio_sync */
++    do {
++	squidaio_poll_queues();
++    } while (request_queue_len > 0);
++
++    close(done_fd);
++    close(done_fd_read);
++    fd_close(done_fd);
++    fd_close(done_fd_read);
++}
++
+ 
+ static void *
+ squidaio_thread_loop(void *ptr)
+@@ -573,7 +588,6 @@
+     case _AIO_OP_READ:
+ 	break;
+     case _AIO_OP_WRITE:
+-	squidaio_xfree(requestp->tmpbufp, requestp->buflen);
+ 	break;
+     default:
+ 	break;
+@@ -608,8 +622,6 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->path = (char *) squidaio_xstrdup(path);
+     requestp->oflag = oflag;
+@@ -636,8 +648,6 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->fd = fd;
+     requestp->bufferp = bufp;
+@@ -667,12 +677,9 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->fd = fd;
+-    requestp->tmpbufp = (char *) squidaio_xmalloc(bufs);
+-    xmemcpy(requestp->tmpbufp, bufp, bufs);
++    requestp->bufferp = bufp;
+     requestp->buflen = bufs;
+     requestp->offset = offset;
+     requestp->whence = whence;
+@@ -688,7 +695,7 @@
+ static void
+ squidaio_do_write(squidaio_request_t * requestp)
+ {
+-    requestp->ret = write(requestp->fd, requestp->tmpbufp, requestp->buflen);
++    requestp->ret = write(requestp->fd, requestp->bufferp, requestp->buflen);
+     requestp->err = errno;
+ }
+ 
+@@ -698,8 +705,6 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->fd = fd;
+     requestp->resultp = resultp;
+@@ -724,8 +729,6 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->path = (char *) squidaio_xstrdup(path);
+     requestp->statp = sb;
+@@ -752,8 +755,6 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->path = squidaio_xstrdup(path);
+     requestp->resultp = resultp;
+@@ -777,8 +778,6 @@
+ {
+     squidaio_request_t *requestp;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     requestp->path = (char *) squidaio_xstrdup(path);
+     requestp->offset = length;
+@@ -808,8 +807,6 @@
+     squidaio_request_t *requestp;
+     int len;
+ 
+-    if (!squidaio_initialised)
+-	squidaio_init();
+     requestp = memPoolAlloc(squidaio_request_pool);
+     return -1;
+ }
+diff -urNad squid-2.5.9/src/fs/aufs/async_io.c /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/async_io.c
+--- squid-2.5.9/src/fs/aufs/async_io.c	2003-01-04 02:19:42.000000000 +0100
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/async_io.c	2005-04-04 02:06:56.280432839 +0200
+@@ -79,15 +79,6 @@
+ static int initialised = 0;
+ static OBJH aioStats;
+ static MemPool *squidaio_ctrl_pool;
+-static void aioFDWasClosed(int fd);
+-
+-static void
+-aioFDWasClosed(int fd)
+-{
+-    if (fd_table[fd].flags.closing)
+-	fd_close(fd);
+-}
+-
+ 
+ void
+ aioInit(void)
+@@ -103,6 +94,7 @@
+ void
+ aioDone(void)
+ {
++    squidaio_shutdown();
+     memPoolDestroy(squidaio_ctrl_pool);
+     initialised = 0;
+ }
+@@ -336,8 +328,6 @@
+ 	/* free temporary read buffer */
+ 	if (ctrlp->operation == _AIO_READ)
+ 	    squidaio_xfree(ctrlp->bufp, ctrlp->len);
+-	if (ctrlp->operation == _AIO_CLOSE)
+-	    aioFDWasClosed(ctrlp->fd);
+ 	memPoolFree(squidaio_ctrl_pool, ctrlp);
+     }
+     return retval;
+diff -urNad squid-2.5.9/src/fs/aufs/store_asyncufs.h /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/store_asyncufs.h
+--- squid-2.5.9/src/fs/aufs/store_asyncufs.h	2003-08-06 16:16:26.000000000 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/store_asyncufs.h	2005-04-04 02:06:56.282432889 +0200
+@@ -41,6 +41,8 @@
+ 
+ typedef void AIOCB(int fd, void *cbdata, const char *buf, int aio_return, int aio_errno);
+ 
++void squidaio_init(void);
++void squidaio_shutdown(void);
+ int squidaio_cancel(squidaio_result_t *);
+ int squidaio_open(const char *, int, mode_t, squidaio_result_t *);
+ int squidaio_read(int, char *, int, off_t, int, squidaio_result_t *);
+@@ -86,8 +88,9 @@
+ 	unsigned int reading:1;
+ 	unsigned int writing:1;
+ 	unsigned int opening:1;
++#if !ASYNC_WRITE
+ 	unsigned int write_kicking:1;
+-	unsigned int read_kicking:1;
++#endif
+ 	unsigned int inreaddone:1;
+     } flags;
+     char *read_buf;
+diff -urNad squid-2.5.9/src/fs/aufs/store_dir_aufs.c /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/store_dir_aufs.c
+--- squid-2.5.9/src/fs/aufs/store_dir_aufs.c	2004-08-25 23:07:25.000000000 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/store_dir_aufs.c	2005-04-04 02:06:56.289433067 +0200
+@@ -111,7 +111,6 @@
+ static QS rev_int_sort;
+ static int storeAufsDirClean(int swap_index);
+ static EVH storeAufsDirCleanEvent;
+-static int storeAufsDirIs(SwapDir * sd);
+ static int storeAufsFilenoBelongsHere(int fn, int F0, int F1, int F2);
+ static int storeAufsCleanupDoubleCheck(SwapDir *, StoreEntry *);
+ static void storeAufsDirStats(SwapDir *, StoreEntry *);
+@@ -331,10 +330,6 @@
+     }
+     debug(50, 3) ("Cache Dir #%d log opened on FD %d\n", sd->index, fd);
+     aioinfo->swaplog_fd = fd;
+-    if (0 == n_asyncufs_dirs)
+-	assert(NULL == asyncufs_dir_index);
+-    n_asyncufs_dirs++;
+-    assert(n_asyncufs_dirs <= Config.cacheSwap.n_configured);
+ }
+ 
+ static void
+@@ -347,10 +342,6 @@
+     debug(47, 3) ("Cache Dir #%d log closed on FD %d\n",
+ 	sd->index, aioinfo->swaplog_fd);
+     aioinfo->swaplog_fd = -1;
+-    n_asyncufs_dirs--;
+-    assert(n_asyncufs_dirs >= 0);
+-    if (0 == n_asyncufs_dirs)
+-	safe_free(asyncufs_dir_index);
+ }
+ 
+ static void
+@@ -364,6 +355,7 @@
+     storeAufsDirInitBitmap(sd);
+     if (storeAufsDirVerifyCacheDirs(sd) < 0)
+ 	fatal(errmsg);
++    squidaio_init();
+     storeAufsDirOpenSwapLog(sd);
+     storeAufsDirRebuild(sd);
+     if (!started_clean_event) {
+@@ -1227,55 +1219,38 @@
+ static void
+ storeAufsDirCleanEvent(void *unused)
+ {
+-    static int swap_index = 0;
+-    int i;
++    static int swap_index = -1;
+     int j = 0;
+     int n = 0;
+     /*
+      * Assert that there are AUFS cache_dirs configured, otherwise
+      * we should never be called.
+      */
+-    assert(n_asyncufs_dirs);
+-    if (NULL == asyncufs_dir_index) {
++    if (swap_index == -1) {
+ 	SwapDir *sd;
+ 	squidaioinfo_t *aioinfo;
+ 	/*
+-	 * Initialize the little array that translates AUFS cache_dir
+-	 * number into the Config.cacheSwap.swapDirs array index.
+-	 */
+-	asyncufs_dir_index = xcalloc(n_asyncufs_dirs, sizeof(*asyncufs_dir_index));
+-	for (i = 0, n = 0; i < Config.cacheSwap.n_configured; i++) {
+-	    sd = &Config.cacheSwap.swapDirs[i];
+-	    if (!storeAufsDirIs(sd))
+-		continue;
+-	    asyncufs_dir_index[n++] = i;
+-	    aioinfo = (squidaioinfo_t *) sd->fsdata;
+-	    j += (aioinfo->l1 * aioinfo->l2);
+-	}
+-	assert(n == n_asyncufs_dirs);
+-	/*
+ 	 * Start the storeAufsDirClean() swap_index with a random
+ 	 * value.  j equals the total number of AUFS level 2
+ 	 * swap directories
+ 	 */
++	for (n = 0; n < n_asyncufs_dirs; n++) {
++	    sd = &Config.cacheSwap.swapDirs[asyncufs_dir_index[n]];
++	    aioinfo = (squidaioinfo_t *) sd->fsdata;
++	    j += (aioinfo->l1 * aioinfo->l2);
++	}
+ 	swap_index = (int) (squid_random() % j);
+     }
+     if (0 == store_dirs_rebuilding) {
+ 	n = storeAufsDirClean(swap_index);
+ 	swap_index++;
++	if (swap_index < 0)
++	    swap_index = 0;
+     }
+     eventAdd("storeDirClean", storeAufsDirCleanEvent, NULL,
+ 	15.0 * exp(-0.25 * n), 1);
+ }
+ 
+-static int
+-storeAufsDirIs(SwapDir * sd)
+-{
+-    if (strncmp(sd->type, "aufs", 4) == 0)
+-	return 1;
+-    return 0;
+-}
+-
+ /*
+  * Does swapfile number 'fn' belong in cachedir #F0,
+  * level1 dir #F1, level2 dir #F2?
+@@ -1689,6 +1664,9 @@
+ 
+     /* Initialise replacement policy stuff */
+     sd->repl = createRemovalPolicy(Config.replPolicy);
++
++    asyncufs_dir_index = realloc(asyncufs_dir_index, (n_asyncufs_dirs + 1) * sizeof(*asyncufs_dir_index));
++    asyncufs_dir_index[n_asyncufs_dirs++] = index;
+ }
+ 
+ /*
+diff -urNad squid-2.5.9/src/fs/aufs/store_io_aufs.c /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/store_io_aufs.c
+--- squid-2.5.9/src/fs/aufs/store_io_aufs.c	2004-06-05 21:42:14.000000000 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/fs/aufs/store_io_aufs.c	2005-04-04 02:06:46.653189198 +0200
+@@ -393,18 +393,29 @@
+     }
+     sio->offset += len;
+ #if ASYNC_WRITE
+-    if (!storeAufsKickWriteQueue(sio))
++    if (storeAufsKickWriteQueue(sio))
+ 	(void) 0;
+     else if (aiostate->flags.close_request)
+ 	storeAufsIOCallback(sio, errflag);
+ #else
++    /* loop around storeAufsKickWriteQueue to break recursion stack
++     * overflow when large amounts of data has been queued for write.
++     * As writes are blocking here we immediately get called again
++     * without going via the I/O event loop..
++     */
+     if (!aiostate->flags.write_kicking) {
++	/* cbdataLock to protect us from the storeAufsIOCallback on error above */
++	cbdataLock(sio);
+ 	aiostate->flags.write_kicking = 1;
+ 	while (storeAufsKickWriteQueue(sio))
+-	    (void) 0;
+-	aiostate->flags.write_kicking = 0;
+-	if (aiostate->flags.close_request)
+-	    storeAufsIOCallback(sio, errflag);
++	    if (!cbdataValid(sio))
++		break;
++	if (cbdataValid(sio)) {
++	    aiostate->flags.write_kicking = 0;
++	    if (aiostate->flags.close_request)
++		storeAufsIOCallback(sio, errflag);
++	}
++	cbdataUnlock(sio);
+     }
+ #endif
+     loop_detect--;
+@@ -433,8 +444,13 @@
+     if (fd < 0)
+ 	return;
+     debug(79, 9) ("%s:%d\n", __FILE__, __LINE__);
++#if ASYNC_CLOSE
+     aioClose(fd);
+     fd_close(fd);
++#else
++    aioCancel(fd);
++    file_close(fd);
++#endif
+     store_open_disk_fd--;
+     statCounter.syscalls.disk.closes++;
+     debug(79, 9) ("%s:%d\n", __FILE__, __LINE__);
+diff -urNad squid-2.5.9/src/main.c /tmp/dpep.Tla2n1/squid-2.5.9/src/main.c
+--- squid-2.5.9/src/main.c	2005-04-04 02:06:54.551168528 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/main.c	2005-04-04 02:06:56.294433193 +0200
+@@ -1009,8 +1009,8 @@
+     fwdUninit();
+ #endif
+     storeDirSync();		/* Flush log close */
+-#if PURIFY || XMALLOC_TRACE
+     storeFsDone();
++#if PURIFY || XMALLOC_TRACE
+     configFreeMemory();
+     storeFreeMemory();
+     /*stmemFreeMemory(); */
+diff -urNad squid-2.5.9/src/protos.h /tmp/dpep.Tla2n1/squid-2.5.9/src/protos.h
+--- squid-2.5.9/src/protos.h	2005-02-21 03:55:04.000000000 +0100
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/protos.h	2005-04-04 02:06:46.631188641 +0200
+@@ -874,6 +874,8 @@
+ extern ssize_t stmemCopy(const mem_hdr *, off_t, char *, size_t);
+ extern void stmemFree(mem_hdr *);
+ extern void stmemFreeData(mem_hdr *);
++extern void stmemNodeFree(void *);
++extern char *stmemNodeGet(mem_node *);
+ 
+ /* ----------------------------------------------------------------- */
+ 
+diff -urNad squid-2.5.9/src/stmem.c /tmp/dpep.Tla2n1/squid-2.5.9/src/stmem.c
+--- squid-2.5.9/src/stmem.c	2001-10-24 10:19:08.000000000 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/stmem.c	2005-04-04 02:06:46.634188717 +0200
+@@ -36,16 +36,30 @@
+ #include "squid.h"
+ 
+ void
++stmemNodeFree(void *buf)
++{
++    mem_node *p = (mem_node *) buf;
++    if (!p->uses)
++	memFree(p, MEM_MEM_NODE);
++    else
++	p->uses--;
++}
++
++char *
++stmemNodeGet(mem_node * p)
++{
++    p->uses++;
++    return p->data;
++}
++
++void
+ stmemFree(mem_hdr * mem)
+ {
+     mem_node *p;
+     while ((p = mem->head)) {
+ 	mem->head = p->next;
+ 	store_mem_size -= SM_PAGE_SIZE;
+-	if (p) {
+-	    memFree(p, MEM_MEM_NODE);
+-	    p = NULL;
+-	}
++	stmemNodeFree(p);
+     }
+     mem->head = mem->tail = NULL;
+     mem->origin_offset = 0;
+@@ -55,7 +69,6 @@
+ stmemFreeDataUpto(mem_hdr * mem, int target_offset)
+ {
+     int current_offset = mem->origin_offset;
+-    mem_node *lastp;
+     mem_node *p = mem->head;
+     while (p && ((current_offset + p->len) <= target_offset)) {
+ 	if (p == mem->tail) {
+@@ -64,14 +77,11 @@
+ 	    mem->origin_offset = current_offset;
+ 	    return current_offset;
+ 	} else {
+-	    lastp = p;
++	    mem_node *lastp = p;
+ 	    p = p->next;
+ 	    current_offset += lastp->len;
+ 	    store_mem_size -= SM_PAGE_SIZE;
+-	    if (lastp) {
+-		memFree(lastp, MEM_MEM_NODE);
+-		lastp = NULL;
+-	    }
++	    stmemNodeFree(lastp);
+ 	}
+     }
+     mem->head = p;
+diff -urNad squid-2.5.9/src/store_swapout.c /tmp/dpep.Tla2n1/squid-2.5.9/src/store_swapout.c
+--- squid-2.5.9/src/store_swapout.c	2002-04-13 23:47:21.000000000 +0200
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/store_swapout.c	2005-04-04 02:06:46.637188793 +0200
+@@ -256,7 +256,7 @@
+ 	debug(20, 3) ("storeSwapOut: swapping out %ld bytes from %ld\n",
+ 	    (long int) swap_buf_len, (long int) mem->swapout.queue_offset);
+ 	mem->swapout.queue_offset += swap_buf_len;
+-	storeWrite(mem->swapout.sio, mem->swapout.memnode->data, swap_buf_len, -1, NULL);
++	storeWrite(mem->swapout.sio, stmemNodeGet(mem->swapout.memnode), swap_buf_len, -1, stmemNodeFree);
+ 	/* the storeWrite() call might generate an error */
+ 	if (e->swap_status != SWAPOUT_WRITING)
+ 	    break;
+diff -urNad squid-2.5.9/src/structs.h /tmp/dpep.Tla2n1/squid-2.5.9/src/structs.h
+--- squid-2.5.9/src/structs.h	2005-02-23 01:06:35.000000000 +0100
++++ /tmp/dpep.Tla2n1/squid-2.5.9/src/structs.h	2005-04-04 02:06:46.643188945 +0200
+@@ -1430,6 +1430,7 @@
+ struct _mem_node {
+     char data[SM_PAGE_SIZE];
+     int len;
++    int uses;
+     mem_node *next;
+ };
+ 
--- squid-2.5.9.orig/debian/patches/09-enable-large-files.dpatch
+++ squid-2.5.9/debian/patches/09-enable-large-files.dpatch
@@ -0,0 +1,5315 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 09-enable-large-files.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.9/configure /tmp/dpep.8Ml6B6/squid-2.5.9/configure
+--- squid-2.5.9/configure	2005-04-21 01:24:40.485248798 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/configure	2005-04-21 01:24:50.209646870 +0200
+@@ -129,6 +129,24 @@
+   --enable-linux-netfilter
+                           Enable Transparent Proxy support for Linux 2.4."
+ ac_help="$ac_help
++  --with-large-files      Enable support for large files (logs etc)."
++ac_help="$ac_help
++  --enable-large-cache-files
++                          Enable support for large cache files (>2GB).
++                          WARNING: on-disk cache format is changed by this option"
++ac_help="$ac_help
++  --with-build-environment=model
++                          The build environment to use. Normally one of
++                          POSIX_V6_ILP32_OFF32   32 bits
++                          POSIX_V6_ILP32_OFFBIG  32 bits with large file support
++                          POSIX_V6_LP64_OFF64    64 bits
++                          POSIX_V6_LPBIG_OFFBIG  large pointers and files
++                          XBS5_ILP32_OFF32       32 bits (legacy)
++                          XBS5_ILP32_OFFBIG      32 bits with large file support (legacy)
++                          XBS5_LP64_OFF64        64 bits (legacy)
++                          XBS5_LPBIG_OFFBIG      large pointers and files (legacy)
++                          default                The default for your OS"
++ac_help="$ac_help
+   --enable-leakfinder
+                           Enable Leak Finding code.  Enabling this alone
+                           does nothing; you also have to modify the source
+@@ -2585,6 +2603,72 @@
+ fi
+ 
+ 
++buildmodel=""
++needlargefiles=
++
++# Check whether --with-large-files or --without-large-files was given.
++if test "${with_large_files+set}" = set; then
++  withval="$with_large_files"
++   if test "$withval" = yes; then
++	needlargefiles=1
++  fi
++
++fi
++
++
++# Check whether --enable-large-cache-files or --disable-large-cache-files was given.
++if test "${enable_large_cache_files+set}" = set; then
++  enableval="$enable_large_cache_files"
++   if test "$enableval" = "yes" ; then
++	echo "Large cache file support enabled"
++	cat >> confdefs.h <<\EOF
++#define LARGE_CACHE_FILES 1
++EOF
++
++  fi
++
++fi
++
++
++# Check whether --with-build-environment or --without-build-environment was given.
++if test "${with_build_environment+set}" = set; then
++  withval="$with_build_environment"
++   case "$enableval" in
++  yes|no)
++	echo "--with-build-environment expects a build environment string as used by getconf"
++	exit 1
++	;;
++  _*)
++	buildmodel="$enableval"
++	;;
++  *)
++	buildmodel="_$enableval"
++	;;
++  esac
++
++fi
++
++
++if test $needlargefiles && test -z "$buildmodel"; then
++	for model in POSIX_V6_ILP32_OFFBIG XBS5_ILP32_OFFBIG POSIX_V6_LP64_OFF64 XBS5_LP64_OFF64 POSIX_V6_LPBIG_OFFBIG XBS5_LPBIG_OFFBIG; do
++		if test "`getconf _$model 2>/dev/null || true`" = 1 || test "`getconf $model 2>/dev/null || true`" ; then
++			buildmodel=$model
++			break
++		fi
++	done
++	if test -z "$buildmodel"; then
++		echo "WARNING: No suitable build environment found for large files. Trying to use _FILE_OFFSET_BITS=64"
++		sleep 1
++		CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
++	fi
++fi
++if test -n "$buildmodel" && test "$buildmodel" != "_default"; then
++	echo "Using $buildmodel build environment"
++	CFLAGS="`getconf ${buildmodel}_CFLAGS` $CFLAGS"
++	LIBS="`getconf ${buildmodel}_LIBS` $LIBS"
++	LDFLAGS="`getconf ${buildmodel}_LDFLAGS` $LDFLAGS"
++fi
++
+ 
+ 
+ if false; then
+@@ -7615,6 +7699,7 @@
+ 	srand48 \
+ 	srandom \
+ 	statfs \
++	strtoll \
+ 	sysconf \
+ 	syslog \
+ 	timegm \
+diff -urNad squid-2.5.9/configure.in /tmp/dpep.8Ml6B6/squid-2.5.9/configure.in
+--- squid-2.5.9/configure.in	2005-04-21 01:24:40.539240171 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/configure.in	2005-04-21 01:24:50.216649474 +0200
+@@ -747,6 +747,75 @@
+   fi
+ ])
+ 
++dnl Enable Large file support
++buildmodel=""
++needlargefiles=
++
++AC_ARG_WITH(large-files,
++[  --with-large-files      Enable support for large files (logs etc).],
++[ if test "$withval" = yes; then
++	needlargefiles=1
++  fi
++])
++
++AC_ARG_ENABLE(large-cache-files,
++[  --enable-large-cache-files
++                          Enable support for large cache files (>2GB).
++                          WARNING: on-disk cache format is changed by this option],
++[ if test "$enableval" = "yes" ; then
++	echo "Large cache file support enabled"
++	AC_DEFINE(LARGE_CACHE_FILES, 1, [Support large cache files > 2GB])
++dnl	needlargefiles=1
++  fi
++])
++
++dnl UNIX Build environment
++AC_ARG_WITH(build-environment,
++[  --with-build-environment=model
++                          The build environment to use. Normally one of
++                          POSIX_V6_ILP32_OFF32   32 bits
++                          POSIX_V6_ILP32_OFFBIG  32 bits with large file support
++                          POSIX_V6_LP64_OFF64    64 bits
++                          POSIX_V6_LPBIG_OFFBIG  large pointers and files
++                          XBS5_ILP32_OFF32       32 bits (legacy)
++                          XBS5_ILP32_OFFBIG      32 bits with large file support (legacy)
++                          XBS5_LP64_OFF64        64 bits (legacy)
++                          XBS5_LPBIG_OFFBIG      large pointers and files (legacy)
++                          default                The default for your OS],
++[ case "$enableval" in
++  yes|no)
++	echo "--with-build-environment expects a build environment string as used by getconf"
++	exit 1
++	;;
++  _*)
++	buildmodel="$enableval"
++	;;
++  *)
++	buildmodel="_$enableval"
++	;;
++  esac
++])
++
++if test $needlargefiles && test -z "$buildmodel"; then
++	for model in POSIX_V6_ILP32_OFFBIG XBS5_ILP32_OFFBIG POSIX_V6_LP64_OFF64 XBS5_LP64_OFF64 POSIX_V6_LPBIG_OFFBIG XBS5_LPBIG_OFFBIG; do
++		if test "`getconf _$model 2>/dev/null || true`" = 1 || test "`getconf $model 2>/dev/null || true`" ; then
++			buildmodel=$model
++			break
++		fi
++	done
++	if test -z "$buildmodel"; then
++		echo "WARNING: No suitable build environment found for large files. Trying to use _FILE_OFFSET_BITS=64"
++		sleep 1
++		CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
++	fi
++fi
++if test -n "$buildmodel" && test "$buildmodel" != "_default"; then
++	echo "Using $buildmodel build environment"
++	CFLAGS="`getconf ${buildmodel}_CFLAGS` $CFLAGS"
++	LIBS="`getconf ${buildmodel}_LIBS` $LIBS"
++	LDFLAGS="`getconf ${buildmodel}_LDFLAGS` $LDFLAGS"
++fi
++
+ AM_CONDITIONAL(MAKE_LEAKFINDER, false)
+ dnl Enable Leak Finding Functions
+ AC_ARG_ENABLE(leakfinder,
+@@ -1740,6 +1809,7 @@
+ 	srand48 \
+ 	srandom \
+ 	statfs \
++	strtoll \
+ 	sysconf \
+ 	syslog \
+ 	timegm \
+diff -urNad squid-2.5.9/helpers/basic_auth/MSNT/smblib-util.c /tmp/dpep.8Ml6B6/squid-2.5.9/helpers/basic_auth/MSNT/smblib-util.c
+--- squid-2.5.9/helpers/basic_auth/MSNT/smblib-util.c	2005-04-21 01:24:40.560236817 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/helpers/basic_auth/MSNT/smblib-util.c	2005-04-21 01:24:50.219650590 +0200
+@@ -255,7 +255,6 @@
+ 	Con_Handle->Encrypt_Key_Len = SVAL(SMB_Hdr(pkt), SMB_negrLM_ekl_offset);
+ 
+ 	p = (SMB_Hdr(pkt) + SMB_negrLM_buf_offset);
+-	fprintf(stderr, "%d", (int) (SMB_Hdr(pkt) + SMB_negrLM_buf_offset));
+ 	memcpy(Con_Handle->Encrypt_Key, p, 8);
+ 
+ 	p = (SMB_Hdr(pkt) + SMB_negrLM_buf_offset + Con_Handle->Encrypt_Key_Len);
+diff -urNad squid-2.5.9/helpers/external_acl/winbind_group/wb_check_group.c /tmp/dpep.8Ml6B6/squid-2.5.9/helpers/external_acl/winbind_group/wb_check_group.c
+--- squid-2.5.9/helpers/external_acl/winbind_group/wb_check_group.c	2005-04-21 01:24:40.582233302 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/helpers/external_acl/winbind_group/wb_check_group.c	2005-04-21 01:24:50.221651334 +0200
+@@ -364,7 +364,7 @@
+ 	if ((p = strchr(buf, '\r')) != NULL)
+ 	    *p = '\0';		/* strip \r */
+ 
+-	debug("Got '%s' from Squid (length: %d).\n",buf,strlen(buf));
++	debug("Got '%s' from Squid (length: %d).\n",buf,(int)strlen(buf));
+ 	
+ 	if (buf[0] == '\0') {
+ 	    warn("Invalid Request\n");
+diff -urNad squid-2.5.9/include/autoconf.h.in /tmp/dpep.8Ml6B6/squid-2.5.9/include/autoconf.h.in
+--- squid-2.5.9/include/autoconf.h.in	2005-04-21 01:24:40.605229628 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/include/autoconf.h.in	2005-04-21 01:24:50.224652450 +0200
+@@ -575,6 +575,9 @@
+ /* Define if you have the strerror function.  */
+ #undef HAVE_STRERROR
+ 
++/* Define if you have the strtoll function.  */
++#undef HAVE_STRTOLL
++
+ /* Define if you have the sysconf function.  */
+ #undef HAVE_SYSCONF
+ 
+@@ -884,6 +887,9 @@
+ /* Version number of package */
+ #undef VERSION
+ 
++/* Support large cache files > 2GB */
++#undef LARGE_CACHE_FILES
++
+ /* Enable hostname sanity checks */
+ #undef CHECK_HOSTNAMES
+ 
+diff -urNad squid-2.5.9/lib/rfc1035.c /tmp/dpep.8Ml6B6/squid-2.5.9/lib/rfc1035.c
+--- squid-2.5.9/lib/rfc1035.c	2005-04-21 01:24:40.629225793 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/lib/rfc1035.c	2005-04-21 01:24:50.228653938 +0200
+@@ -113,10 +113,10 @@
+  * Packs a rfc1035_header structure into a buffer.
+  * Returns number of octets packed (should always be 12)
+  */
+-static off_t
++static int
+ rfc1035HeaderPack(char *buf, size_t sz, rfc1035_header * hdr)
+ {
+-    off_t off = 0;
++    int off = 0;
+     unsigned short s;
+     unsigned short t;
+     assert(sz >= 12);
+@@ -158,10 +158,10 @@
+  * bytes to follow.  Labels must be smaller than 64 octets.
+  * Returns number of octets packed.
+  */
+-static off_t
++static int
+ rfc1035LabelPack(char *buf, size_t sz, const char *label)
+ {
+-    off_t off = 0;
++    int off = 0;
+     size_t len = label ? strlen(label) : 0;
+     if (label)
+ 	assert(!strchr(label, '.'));
+@@ -183,10 +183,10 @@
+  * Note message compression is not supported here.
+  * Returns number of octets packed.
+  */
+-static off_t
++static int
+ rfc1035NamePack(char *buf, size_t sz, const char *name)
+ {
+-    off_t off = 0;
++    int off = 0;
+     char *copy = strdup(name);
+     char *t;
+     /*
+@@ -206,14 +206,14 @@
+  * Packs a QUESTION section of a message.
+  * Returns number of octets packed.
+  */
+-static off_t
++static int
+ rfc1035QuestionPack(char *buf,
+     size_t sz,
+     const char *name,
+     unsigned short type,
+     unsigned short class)
+ {
+-    off_t off = 0;
++    int off = 0;
+     unsigned short s;
+     off += rfc1035NamePack(buf + off, sz - off, name);
+     s = htons(type);
+@@ -238,7 +238,7 @@
+  * Returns 0 (success) or 1 (error)
+  */
+ static int
+-rfc1035HeaderUnpack(const char *buf, size_t sz, off_t * off, rfc1035_header * h)
++rfc1035HeaderUnpack(const char *buf, size_t sz, int *off, rfc1035_header * h)
+ {
+     unsigned short s;
+     unsigned short t;
+@@ -299,9 +299,9 @@
+  * Returns 0 (success) or 1 (error)
+  */
+ static int
+-rfc1035NameUnpack(const char *buf, size_t sz, off_t * off, unsigned short *rdlength, char *name, size_t ns, int rdepth)
++rfc1035NameUnpack(const char *buf, size_t sz, int *off, unsigned short *rdlength, char *name, size_t ns, int rdepth)
+ {
+-    off_t no = 0;
++    int no = 0;
+     unsigned char c;
+     size_t len;
+     assert(ns > 0);
+@@ -311,8 +311,8 @@
+ 	if (c > 191) {
+ 	    /* blasted compression */
+ 	    unsigned short s;
+-	    off_t ptr;
+-	    if (rdepth > 64)		/* infinite pointer loop */
++	    int ptr;
++	    if (rdepth > 64)	/* infinite pointer loop */
+ 		return 1;
+ 	    memcpy(&s, buf + (*off), sizeof(s));
+ 	    s = ntohs(s);
+@@ -367,12 +367,12 @@
+  * Returns 0 (success) or 1 (error)
+  */
+ static int
+-rfc1035RRUnpack(const char *buf, size_t sz, off_t * off, rfc1035_rr * RR)
++rfc1035RRUnpack(const char *buf, size_t sz, int *off, rfc1035_rr * RR)
+ {
+     unsigned short s;
+     unsigned int i;
+     unsigned short rdlength;
+-    off_t rdata_off;
++    int rdata_off;
+     if (rfc1035NameUnpack(buf, sz, off, NULL, RR->name, RFC1035_MAXHOSTNAMESZ, 0)) {
+ 	RFC1035_UNPACK_DEBUG;
+ 	memset(RR, '\0', sizeof(*RR));
+@@ -413,7 +413,7 @@
+     case RFC1035_TYPE_PTR:
+ 	RR->rdata = malloc(RFC1035_MAXHOSTNAMESZ);
+ 	rdata_off = *off;
+-	RR->rdlength = 0; /* Filled in by rfc1035NameUnpack */
++	RR->rdlength = 0;	/* Filled in by rfc1035NameUnpack */
+ 	if (rfc1035NameUnpack(buf, sz, &rdata_off, &RR->rdlength, RR->rdata, RFC1035_MAXHOSTNAMESZ, 0))
+ 	    return 1;
+ 	if (rdata_off != ((*off) + rdlength)) {
+@@ -515,7 +515,7 @@
+     rfc1035_rr ** records,
+     unsigned short *id)
+ {
+-    off_t off = 0;
++    int off = 0;
+     int l;
+     int i;
+     int nr = 0;
+@@ -562,8 +562,8 @@
+     }
+     if (hdr.ancount == 0)
+ 	return 0;
+-    recs = calloc((int)hdr.ancount, sizeof(*recs));
+-    for (i = 0; i < (int)hdr.ancount; i++) {
++    recs = calloc((int) hdr.ancount, sizeof(*recs));
++    for (i = 0; i < (int) hdr.ancount; i++) {
+ 	if (off >= sz) {	/* corrupt packet */
+ 	    RFC1035_UNPACK_DEBUG;
+ 	    break;
+diff -urNad squid-2.5.9/src/access_log.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/access_log.c
+--- squid-2.5.9/src/access_log.c	2005-04-21 01:24:40.653221959 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/access_log.c	2005-04-21 01:24:50.230654682 +0200
+@@ -245,14 +245,14 @@
+ 	client = inet_ntoa(al->cache.caddr);
+     user = accessLogFormatName(al->cache.authuser ?
+ 	al->cache.authuser : al->cache.rfc931);
+-    logfilePrintf(logfile, "%9d.%03d %6d %s %s/%03d %lu %s %s %s %s%s/%s %s",
+-	(int) current_time.tv_sec,
++    logfilePrintf(logfile, "%9ld.%03d %6d %s %s/%03d %" PRINTF_OFF_T " %s %s %s %s%s/%s %s",
++	(long int) current_time.tv_sec,
+ 	(int) current_time.tv_usec / 1000,
+ 	al->cache.msec,
+ 	client,
+ 	log_tags[al->cache.code],
+ 	al->http.code,
+-	(unsigned long) al->cache.size,
++	al->cache.size,
+ 	al->private.method_str,
+ 	al->url,
+ 	user && *user ? user : dash_str,
+@@ -274,7 +274,7 @@
+ 	client = inet_ntoa(al->cache.caddr);
+     user1 = accessLogFormatName(al->cache.authuser);
+     user2 = accessLogFormatName(al->cache.rfc931);
+-    logfilePrintf(logfile, "%s %s %s [%s] \"%s %s HTTP/%d.%d\" %d %ld %s:%s",
++    logfilePrintf(logfile, "%s %s %s [%s] \"%s %s HTTP/%d.%d\" %d %" PRINTF_OFF_T " %s:%s",
+ 	client,
+ 	user2 ? user2 : dash_str,
+ 	user1 ? user1 : dash_str,
+@@ -283,7 +283,7 @@
+ 	al->url,
+ 	al->http.version.major, al->http.version.minor,
+ 	al->http.code,
+-	(long int) al->cache.size,
++	al->cache.size,
+ 	log_tags[al->cache.code],
+ 	hier_strings[al->hier.code]);
+     safe_free(user1);
+diff -urNad squid-2.5.9/src/asn.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/asn.c
+--- squid-2.5.9/src/asn.c	2005-04-21 01:24:40.671219084 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/asn.c	2005-04-21 01:24:50.232655426 +0200
+@@ -73,8 +73,8 @@
+     store_client *sc;
+     request_t *request;
+     int as_number;
+-    off_t seen;
+-    off_t offset;
++    squid_off_t seen;
++    squid_off_t offset;
+ };
+ 
+ typedef struct _ASState ASState;
+diff -urNad squid-2.5.9/src/authenticate.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/authenticate.c
+--- squid-2.5.9/src/authenticate.c	2005-04-21 01:24:40.702214131 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/authenticate.c	2005-04-21 01:24:50.235656542 +0200
+@@ -352,7 +352,7 @@
+ 	authenticateAuthUserClearIp(auth_user_request->auth_user);
+ }
+ 
+-size_t
++int
+ authenticateAuthUserRequestIPCount(auth_user_request_t * auth_user_request)
+ {
+     assert(auth_user_request);
+diff -urNad squid-2.5.9/src/cache_cf.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/cache_cf.c
+--- squid-2.5.9/src/cache_cf.c	2005-04-21 01:24:40.761204706 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/cache_cf.c	2005-04-21 01:24:50.243659518 +0200
+@@ -78,7 +78,7 @@
+ static void default_all(void);
+ static void defaults_if_none(void);
+ static int parse_line(char *);
+-static void parseBytesLine(size_t * bptr, const char *units);
++static void parseBytesLine(squid_off_t * bptr, const char *units);
+ static size_t parseBytesUnits(const char *unit);
+ static void free_all(void);
+ void requirePathnameExists(const char *name, const char *path);
+@@ -210,10 +210,35 @@
+ GetInteger(void)
+ {
+     char *token = strtok(NULL, w_space);
++    char *end;
+     int i;
++    double d;
+     if (token == NULL)
+ 	self_destruct();
+-    if (sscanf(token, "%d", &i) != 1)
++    i = strtol(token, &end, 0);
++    d = strtod(token, NULL);
++    if (d > INT_MAX || end == token)
++	self_destruct();
++    return i;
++}
++
++static squid_off_t
++GetOffT(void)
++{
++    char *token = strtok(NULL, w_space);
++    char *end;
++    squid_off_t i;
++    if (token == NULL)
++	self_destruct();
++    i = strto_off_t(token, &end, 0);
++#if SIZEOF_SQUID_OFF_T <= 4
++    {
++	double d = strtod(token, NULL);
++	if (d > INT_MAX)
++	    end = token;
++    }
++#endif
++    if (end == token)
+ 	self_destruct();
+     return i;
+ }
+@@ -222,7 +247,7 @@
+ update_maxobjsize(void)
+ {
+     int i;
+-    ssize_t ms = -1;
++    squid_off_t ms = -1;
+ 
+     for (i = 0; i < Config.cacheSwap.n_configured; i++) {
+ 	if (Config.cacheSwap.swapDirs[i].max_objsize > ms)
+@@ -439,6 +464,26 @@
+ 	debug(22, 0) ("NOTICE: positive_dns_ttl must be larger than negative_dns_ttl. Resetting negative_dns_ttl to match\n");
+ 	Config.positiveDnsTtl = Config.negativeDnsTtl;
+     }
++#if SIZEOF_SQUID_FILE_SZ <= 4
++#if SIZEOF_SQUID_OFF_T <= 4
++    if (Config.Store.maxObjectSize > 0x7FFF0000) {
++	debug(22, 0) ("NOTICE: maximum_object_size limited to %d KB due to hardware limitations\n", 0x7FFF0000 / 1024);
++	Config.Store.maxObjectSize = 0x7FFF0000;
++    }
++#elif SIZEOF_OFF_T <= 4
++    if (Config.Store.maxObjectSize > 0xFFFF0000) {
++	debug(22, 0) ("NOTICE: maximum_object_size limited to %d KB due to OS limitations\n", 0xFFFF0000 / 1024);
++	Config.Store.maxObjectSize = 0xFFFF0000;
++    }
++#else
++    if (Config.Store.maxObjectSize > 0xFFFF0000) {
++	debug(22, 0) ("NOTICE: maximum_object_size limited to %d KB to keep compatibility with existing cache\n", 0xFFFF0000 / 1024);
++	Config.Store.maxObjectSize = 0xFFFF0000;
++    }
++#endif
++#endif
++    if (Config.Store.maxInMemObjSize > 8 * 1024 * 1024)
++	debug(22, 0) ("WARNING: Very large maximum_object_size_in_memory settings can have negative impact on performance\n");
+ }
+ 
+ /* Parse a time specification from the config file.  Store the
+@@ -492,18 +537,18 @@
+ }
+ 
+ static void
+-parseBytesLine(size_t * bptr, const char *units)
++parseBytesLine(squid_off_t * bptr, const char *units)
+ {
+     char *token;
+     double d;
+-    size_t m;
+-    size_t u;
++    squid_off_t m;
++    squid_off_t u;
+     if ((u = parseBytesUnits(units)) == 0)
+ 	self_destruct();
+     if ((token = strtok(NULL, w_space)) == NULL)
+ 	self_destruct();
+     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
+-	*bptr = (size_t) - 1;
++	*bptr = (squid_off_t) - 1;
+ 	return;
+     }
+     d = atof(token);
+@@ -1323,12 +1368,12 @@
+ static void
+ parse_cachedir_option_maxsize(SwapDir * sd, const char *option, const char *value, int reconfiguring)
+ {
+-    ssize_t size;
++    squid_off_t size;
+ 
+     if (!value)
+ 	self_destruct();
+ 
+-    size = atoi(value);
++    size = strto_off_t(value, NULL, 10);
+ 
+     if (reconfiguring && sd->max_objsize != size)
+ 	debug(3, 1) ("Cache dir '%s' max object size now %ld\n", sd->path, (long int) size);
+@@ -2073,34 +2118,29 @@
+     *var = 0;
+ }
+ 
++#if UNUSED_CODE
+ static void
+-dump_size_t(StoreEntry * entry, const char *name, size_t var)
++dump_size_t(StoreEntry * entry, const char *name, squid_off_t var)
+ {
+-    storeAppendPrintf(entry, "%s %d\n", name, (int) var);
++    storeAppendPrintf(entry, "%s %" PRINTF_OFF_T "\n", name, var);
+ }
+ 
+-static void
+-dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
+-{
+-    storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
+-}
++#endif
+ 
+ static void
+-dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
++dump_b_size_t(StoreEntry * entry, const char *name, squid_off_t var)
+ {
+-    storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
++    storeAppendPrintf(entry, "%s %" PRINTF_OFF_T " %s\n", name, var, B_BYTES_STR);
+ }
+ 
+ static void
+-parse_size_t(size_t * var)
++dump_kb_size_t(StoreEntry * entry, const char *name, squid_off_t var)
+ {
+-    int i;
+-    i = GetInteger();
+-    *var = (size_t) i;
++    storeAppendPrintf(entry, "%s %" PRINTF_OFF_T " %s\n", name, var, B_KBYTES_STR);
+ }
+ 
+ static void
+-parse_b_size_t(size_t * var)
++parse_b_size_t(squid_off_t * var)
+ {
+     parseBytesLine(var, B_BYTES_STR);
+ }
+@@ -2113,7 +2153,7 @@
+     body_size *bs;
+     CBDATA_INIT_TYPE(body_size);
+     bs = cbdataAlloc(body_size);
+-    parse_size_t(&bs->maxsize);
++    bs->maxsize = GetOffT();
+     aclParseAccessLine(&bs->access_list);
+ 
+     dlinkAddTail(bs, &bs->node, bodylist);
+@@ -2128,7 +2168,7 @@
+ 	acl_list *l;
+ 	acl_access *head = bs->access_list;
+ 	while (head != NULL) {
+-	    storeAppendPrintf(entry, "%s %ld %s", name, (long int) bs->maxsize,
++	    storeAppendPrintf(entry, "%s %" PRINTF_OFF_T " %s", name, bs->maxsize,
+ 		head->allow ? "Allow" : "Deny");
+ 	    for (l = head->acl_list; l != NULL; l = l->next) {
+ 		storeAppendPrintf(entry, " %s%s",
+@@ -2165,13 +2205,13 @@
+ 
+ 
+ static void
+-parse_kb_size_t(size_t * var)
++parse_kb_size_t(squid_off_t * var)
+ {
+     parseBytesLine(var, B_KBYTES_STR);
+ }
+ 
+ static void
+-free_size_t(size_t * var)
++free_size_t(squid_off_t * var)
+ {
+     *var = 0;
+ }
+diff -urNad squid-2.5.9/src/cachemgr.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/cachemgr.c
+--- squid-2.5.9/src/cachemgr.c	2005-04-21 01:24:40.780201670 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/cachemgr.c	2005-04-21 01:24:50.246660634 +0200
+@@ -735,7 +735,7 @@
+ make_auth_header(const cachemgr_request * req)
+ {
+     static char buf[1024];
+-    off_t l = 0;
++    int l = 0;
+     const char *str64;
+     if (!req->passwd)
+ 	return "";
+diff -urNad squid-2.5.9/src/cf.data.pre /tmp/dpep.8Ml6B6/squid-2.5.9/src/cf.data.pre
+--- squid-2.5.9/src/cf.data.pre	2005-04-21 01:24:44.357630081 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/cf.data.pre	2005-04-21 01:24:50.255663982 +0200
+@@ -1046,7 +1046,7 @@
+ DOC_END
+ 
+ NAME: ftp_list_width
+-TYPE: size_t
++TYPE: int
+ DEFAULT: 32
+ LOC: Config.Ftp.list_width
+ DOC_START
+diff -urNad squid-2.5.9/src/client.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/client.c
+--- squid-2.5.9/src/client.c	2005-04-21 01:24:40.886184736 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/client.c	2005-04-21 01:24:50.258665098 +0200
+@@ -311,7 +311,7 @@
+     }
+     loops = ping ? pcount : 1;
+     for (i = 0; loops == 0 || i < loops; i++) {
+-	int fsize = 0;
++	squid_off_t fsize = 0;
+ 	/* Connect to the server */
+ 	if ((conn = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
+ 	    perror("client: socket");
+@@ -321,7 +321,7 @@
+ 	    perror("client: bind");
+ 	    exit(1);
+ 	}
+-	if (client_comm_connect(conn, hostname, port, ping ? &tv1 : NULL) < 0) {
++	if (client_comm_connect(conn, hostname, port, (ping || opt_verbose) ? &tv1 : NULL) < 0) {
+ 	    if (errno == 0) {
+ 		fprintf(stderr, "client: ERROR: Cannot connect to %s:%d: Host unknown.\n", hostname, port);
+ 	    } else {
+@@ -365,7 +365,7 @@
+ 	if (interrupted)
+ 	    break;
+ 
+-	if (ping) {
++	if (ping || opt_verbose) {
+ 	    struct tm *tmp;
+ 	    time_t t2s;
+ 	    long elapsed_msec;
+@@ -374,18 +374,19 @@
+ 	    elapsed_msec = tvSubMsec(tv1, tv2);
+ 	    t2s = tv2.tv_sec;
+ 	    tmp = localtime(&t2s);
+-	    fprintf(stderr, "%d-%02d-%02d %02d:%02d:%02d [%d]: %ld.%03ld secs, %f KB/s\n",
++	    fprintf(stderr, "%d-%02d-%02d %02d:%02d:%02d [%d]: %ld.%03ld secs, %f KB/s (%" PRINTF_OFF_T "KB)\n",
+ 		tmp->tm_year + 1900, tmp->tm_mon + 1, tmp->tm_mday,
+ 		tmp->tm_hour, tmp->tm_min, tmp->tm_sec, i + 1,
+ 		elapsed_msec / 1000, elapsed_msec % 1000,
+-		elapsed_msec ? (double) fsize / elapsed_msec : -1.0);
++		elapsed_msec ? (double) fsize / elapsed_msec * 1000 / 1024 : -1.0,
++		(fsize + 1023) / 1024);
+ 	    if (i == 0 || elapsed_msec < ping_min)
+ 		ping_min = elapsed_msec;
+ 	    if (i == 0 || elapsed_msec > ping_max)
+ 		ping_max = elapsed_msec;
+ 	    ping_sum += elapsed_msec;
+ 	    /* Delay until next "ping_int" boundary */
+-	    if ((loops == 0 || i + 1 < loops) && elapsed_msec < ping_int) {
++	    if (ping && (loops == 0 || i + 1 < loops) && elapsed_msec < ping_int) {
+ 		struct timeval tvs;
+ 		long msec_left = ping_int - elapsed_msec;
+ 
+diff -urNad squid-2.5.9/src/client_db.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/client_db.c
+--- squid-2.5.9/src/client_db.c	2005-04-21 01:24:40.904181861 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/client_db.c	2005-04-21 01:24:50.260665842 +0200
+@@ -77,7 +77,7 @@
+ }
+ 
+ void
+-clientdbUpdate(struct in_addr addr, log_type ltype, protocol_t p, size_t size)
++clientdbUpdate(struct in_addr addr, log_type ltype, protocol_t p, squid_off_t size)
+ {
+     char *key;
+     ClientInfo *c;
+diff -urNad squid-2.5.9/src/client_side.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/client_side.c
+--- squid-2.5.9/src/client_side.c	2005-04-21 01:24:40.963172435 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/client_side.c	2005-04-21 01:24:50.290677002 +0200
+@@ -125,8 +125,8 @@
+ static int clientCheckContentLength(request_t * r);
+ static DEFER httpAcceptDefer;
+ static log_type clientProcessRequest2(clientHttpRequest * http);
+-static int clientReplyBodyTooLarge(clientHttpRequest *, ssize_t clen);
+-static int clientRequestBodyTooLarge(int clen);
++static int clientReplyBodyTooLarge(clientHttpRequest *, squid_off_t clen);
++static int clientRequestBodyTooLarge(squid_off_t clen);
+ static void clientProcessBody(ConnStateData * conn);
+ static void clientEatRequestBody(clientHttpRequest *);
+ static BODY_HANDLER clientReadBody;
+@@ -602,7 +602,7 @@
+ int
+ modifiedSince(StoreEntry * entry, request_t * request)
+ {
+-    int object_length;
++    squid_off_t object_length;
+     MemObject *mem = entry->mem_obj;
+     time_t mod_time = entry->lastmod;
+     debug(33, 3) ("modifiedSince: '%s'\n", storeUrl(entry));
+@@ -1224,10 +1224,10 @@
+  * warning: assumes that HTTP headers for individual ranges at the
+  *          time of the actuall assembly will be exactly the same as
+  *          the headers when clientMRangeCLen() is called */
+-static int
++static squid_off_t
+ clientMRangeCLen(clientHttpRequest * http)
+ {
+-    int clen = 0;
++    squid_off_t clen = 0;
+     HttpHdrRangePos pos = HttpHdrRangeInitPos;
+     const HttpHdrRangeSpec *spec;
+     MemBuf mb;
+@@ -1246,8 +1246,8 @@
+ 	/* account for range content */
+ 	clen += spec->length;
+ 
+-	debug(33, 6) ("clientMRangeCLen: (clen += %ld + %ld) == %d\n",
+-	    (long int) mb.size, (long int) spec->length, clen);
++	debug(33, 6) ("clientMRangeCLen: (clen += %ld + %" PRINTF_OFF_T ") == %" PRINTF_OFF_T "\n",
++	    (long int) mb.size, spec->length, clen);
+     }
+     /* account for the terminating boundary */
+     memBufReset(&mb);
+@@ -1295,9 +1295,9 @@
+ 	http->request->range = NULL;
+     } else {
+ 	const int spec_count = http->request->range->specs.count;
+-	int actual_clen = -1;
++	squid_off_t actual_clen = -1;
+ 
+-	debug(33, 3) ("clientBuildRangeHeader: range spec count: %d virgin clen: %d\n",
++	debug(33, 3) ("clientBuildRangeHeader: range spec count: %d virgin clen: %" PRINTF_OFF_T "\n",
+ 	    spec_count, rep->content_length);
+ 	assert(spec_count > 0);
+ 	/* ETags should not be returned with Partial Content replies? */
+@@ -1329,8 +1329,8 @@
+ 	/* replace Content-Length header */
+ 	assert(actual_clen >= 0);
+ 	httpHeaderDelById(hdr, HDR_CONTENT_LENGTH);
+-	httpHeaderPutInt(hdr, HDR_CONTENT_LENGTH, actual_clen);
+-	debug(33, 3) ("clientBuildRangeHeader: actual content length: %d\n", actual_clen);
++	httpHeaderPutSize(hdr, HDR_CONTENT_LENGTH, actual_clen);
++	debug(33, 3) ("clientBuildRangeHeader: actual content length: %" PRINTF_OFF_T "\n", actual_clen);
+     }
+ }
+ 
+@@ -1729,11 +1729,11 @@
+ clientPackRange(clientHttpRequest * http,
+     HttpHdrRangeIter * i,
+     const char **buf,
+-    ssize_t * size,
++    size_t * size,
+     MemBuf * mb)
+ {
+-    const ssize_t copy_sz = i->debt_size <= *size ? i->debt_size : *size;
+-    off_t body_off = http->out.offset - i->prefix_size;
++    const size_t copy_sz = i->debt_size <= *size ? i->debt_size : *size;
++    squid_off_t body_off = http->out.offset - i->prefix_size;
+     assert(*size > 0);
+     assert(i->spec);
+     /*
+@@ -1777,7 +1777,7 @@
+  * increments iterator "i"
+  * used by clientPackMoreRanges */
+ static int
+-clientCanPackMoreRanges(const clientHttpRequest * http, HttpHdrRangeIter * i, ssize_t size)
++clientCanPackMoreRanges(const clientHttpRequest * http, HttpHdrRangeIter * i, size_t size)
+ {
+     /* first update "i" if needed */
+     if (!i->debt_size) {
+@@ -1792,17 +1792,17 @@
+ /* extracts "ranges" from buf and appends them to mb, updating all offsets and such */
+ /* returns true if we need more data */
+ static int
+-clientPackMoreRanges(clientHttpRequest * http, const char *buf, ssize_t size, MemBuf * mb)
++clientPackMoreRanges(clientHttpRequest * http, const char *buf, size_t size, MemBuf * mb)
+ {
+     HttpHdrRangeIter *i = &http->range_iter;
+     /* offset in range specs does not count the prefix of an http msg */
+-    off_t body_off = http->out.offset - i->prefix_size;
++    squid_off_t body_off = http->out.offset - i->prefix_size;
+     assert(size >= 0);
+     /* check: reply was parsed and range iterator was initialized */
+     assert(i->prefix_size > 0);
+     /* filter out data according to range specs */
+     while (clientCanPackMoreRanges(http, i, size)) {
+-	off_t start;		/* offset of still missing data */
++	squid_off_t start;	/* offset of still missing data */
+ 	assert(i->spec);
+ 	start = i->spec->offset + i->spec->length - i->debt_size;
+ 	debug(33, 3) ("clientPackMoreRanges: in:  offset: %ld size: %ld\n",
+@@ -1876,7 +1876,7 @@
+ }
+ 
+ static int
+-clientReplyBodyTooLarge(clientHttpRequest * http, ssize_t clen)
++clientReplyBodyTooLarge(clientHttpRequest * http, squid_off_t clen)
+ {
+     if (0 == http->maxBodySize)
+ 	return 0;		/* disabled */
+@@ -1888,7 +1888,7 @@
+ }
+ 
+ static int
+-clientRequestBodyTooLarge(int clen)
++clientRequestBodyTooLarge(squid_off_t clen)
+ {
+     if (0 == Config.maxRequestBodySize)
+ 	return 0;		/* disabled */
+@@ -1939,9 +1939,9 @@
+     int fd = conn->fd;
+     HttpReply *rep = NULL;
+     const char *body_buf = buf;
+-    ssize_t body_size = size;
++    squid_off_t body_size = size;
+     MemBuf mb;
+-    ssize_t check_size = 0;
++    squid_off_t check_size = 0;
+     debug(33, 5) ("clientSendMoreData: %s, %d bytes\n", http->uri, (int) size);
+     assert(size <= CLIENT_SOCK_SZ);
+     assert(http->request != NULL);
+@@ -2184,14 +2184,14 @@
+     StoreEntry *entry = http->entry;
+     int done;
+     http->out.size += size;
+-    debug(33, 5) ("clientWriteComplete: FD %d, sz %ld, err %d, off %ld, len %d\n",
+-	fd, (long int) size, errflag, (long int) http->out.offset, entry ? objectLen(entry) : 0);
++    debug(33, 5) ("clientWriteComplete: FD %d, sz %d, err %d, off %" PRINTF_OFF_T ", len %" PRINTF_OFF_T "\n",
++	fd, (int) size, errflag, http->out.offset, entry ? objectLen(entry) : (squid_off_t) 0);
+     if (size > 0) {
+ 	kb_incr(&statCounter.client_http.kbytes_out, size);
+ 	if (isTcpHit(http->log_type))
+ 	    kb_incr(&statCounter.client_http.hit_kbytes_out, size);
+     }
+-#if SIZEOF_SIZE_T == 4
++#if SIZEOF_SQUID_OFF_T <= 4
+     if (http->out.size > 0x7FFF0000) {
+ 	debug(33, 1) ("WARNING: closing FD %d to prevent counter overflow\n", fd);
+ 	debug(33, 1) ("\tclient %s\n", inet_ntoa(http->conn->peer.sin_addr));
+@@ -2200,7 +2200,7 @@
+ 	comm_close(fd);
+     } else
+ #endif
+-#if SIZEOF_OFF_T == 4
++#if SIZEOF_SQUID_OFF_T <= 4
+     if (http->out.offset > 0x7FFF0000) {
+ 	debug(33, 1) ("WARNING: closing FD %d to prevent counter overflow\n", fd);
+ 	debug(33, 1) ("\tclient %s\n", inet_ntoa(http->conn->peer.sin_addr));
+@@ -2589,7 +2589,7 @@
+     static int pffd = -1;
+ #endif
+ #if LINUX_NETFILTER
+-    size_t sock_sz = sizeof(conn->me);
++    socklen_t sock_sz = sizeof(conn->me);
+ #endif
+ 
+     /* pre-set these values to make aborting simpler */
+@@ -3124,7 +3124,7 @@
+ 	    /*
+ 	     * cache the Content-length value in request_t.
+ 	     */
+-	    request->content_length = httpHeaderGetInt(&request->header,
++	    request->content_length = httpHeaderGetSize(&request->header,
+ 		HDR_CONTENT_LENGTH);
+ 	    request->flags.internal = http->flags.internal;
+ 	    safe_free(prefix);
+@@ -3636,7 +3636,7 @@
+     StoreEntry *entry = http->entry;
+     MemObject *mem;
+     http_reply *reply;
+-    int sendlen;
++    squid_off_t sendlen;
+     if (entry == NULL)
+ 	return 0;
+     /*
+@@ -3699,7 +3699,7 @@
+ static int
+ clientGotNotEnough(clientHttpRequest * http)
+ {
+-    int cl = httpReplyBodySize(http->request->method, http->entry->mem_obj->reply);
++    squid_off_t cl = httpReplyBodySize(http->request->method, http->entry->mem_obj->reply);
+     int hs = http->entry->mem_obj->reply->hdr_sz;
+     assert(cl >= 0);
+     if (http->out.offset < cl + hs)
+diff -urNad squid-2.5.9/src/defines.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/defines.h
+--- squid-2.5.9/src/defines.h	2005-04-21 01:24:44.441616662 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/defines.h	2005-04-21 01:24:50.293678118 +0200
+@@ -200,7 +200,8 @@
+ #define SwapMetaType(x) (char)x[0]
+ #define SwapMetaSize(x) &x[sizeof(char)]
+ #define SwapMetaData(x) &x[STORE_META_TLD_START]
+-#define STORE_HDR_METASIZE (4*sizeof(time_t)+2*sizeof(u_short)+sizeof(size_t))
++#define STORE_HDR_METASIZE (4*sizeof(time_t)+2*sizeof(u_short)+sizeof(squid_file_sz))
++#define STORE_HDR_METASIZE_OLD (4*sizeof(time_t)+2*sizeof(u_short)+sizeof(size_t))
+ 
+ #define STORE_ENTRY_WITH_MEMOBJ		1
+ #define STORE_ENTRY_WITHOUT_MEMOBJ	0
+diff -urNad squid-2.5.9/src/disk.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/disk.c
+--- squid-2.5.9/src/disk.c	2005-04-21 01:24:40.998166843 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/disk.c	2005-04-21 01:24:50.296679234 +0200
+@@ -239,7 +239,7 @@
+ 	q->buf_offset += len;
+ 	if (q->buf_offset > q->len)
+ 	    debug(50, 1) ("diskHandleWriteComplete: q->buf_offset > q->len (%p,%d, %d, %d FD %d)\n",
+-		q, (int) q->buf_offset, q->len, len, fd);
++		q, (int) q->buf_offset, (int) q->len, len, fd);
+ 	assert(q->buf_offset <= q->len);
+ 	if (q->buf_offset == q->len) {
+ 	    /* complete write */
+@@ -293,7 +293,7 @@
+ file_write(int fd,
+     off_t file_offset,
+     void *ptr_to_buf,
+-    int len,
++    size_t len,
+     DWCB * handle,
+     void *handle_data,
+     FREE * free_func)
+@@ -331,9 +331,9 @@
+  * in a snap
+  */
+ void
+-file_write_mbuf(int fd, off_t off, MemBuf mb, DWCB * handler, void *handler_data)
++file_write_mbuf(int fd, off_t file_offset, MemBuf mb, DWCB * handler, void *handler_data)
+ {
+-    file_write(fd, off, mb.buf, mb.size, handler, handler_data, memBufFreeFunc(&mb));
++    file_write(fd, file_offset, mb.buf, mb.size, handler, handler_data, memBufFreeFunc(&mb));
+ }
+ 
+ /* Read from FD */
+@@ -352,12 +352,12 @@
+ 	memFree(ctrl_dat, MEM_DREAD_CTRL);
+ 	return;
+     }
+-    if (F->disk.offset != ctrl_dat->offset) {
++    if (F->disk.offset != ctrl_dat->file_offset) {
+ 	debug(6, 3) ("diskHandleRead: FD %d seeking to offset %d\n",
+-	    fd, (int) ctrl_dat->offset);
+-	lseek(fd, ctrl_dat->offset, SEEK_SET);	/* XXX ignore return? */
++	    fd, (int) ctrl_dat->file_offset);
++	lseek(fd, ctrl_dat->file_offset, SEEK_SET);	/* XXX ignore return? */
+ 	statCounter.syscalls.disk.seeks++;
+-	F->disk.offset = ctrl_dat->offset;
++	F->disk.offset = ctrl_dat->file_offset;
+     }
+     errno = 0;
+     len = FD_READ_METHOD(fd, ctrl_dat->buf, ctrl_dat->req_len);
+@@ -388,13 +388,13 @@
+  * It must have at least req_len space in there. 
+  * call handler when a reading is complete. */
+ void
+-file_read(int fd, char *buf, int req_len, off_t offset, DRCB * handler, void *client_data)
++file_read(int fd, char *buf, size_t req_len, off_t file_offset, DRCB * handler, void *client_data)
+ {
+     dread_ctrl *ctrl_dat;
+     assert(fd >= 0);
+     ctrl_dat = memAllocate(MEM_DREAD_CTRL);
+     ctrl_dat->fd = fd;
+-    ctrl_dat->offset = offset;
++    ctrl_dat->file_offset = file_offset;
+     ctrl_dat->req_len = req_len;
+     ctrl_dat->buf = buf;
+     ctrl_dat->end_of_file = 0;
+diff -urNad squid-2.5.9/src/enums.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/enums.h
+--- squid-2.5.9/src/enums.h	2005-04-21 01:24:41.018163648 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/enums.h	2005-04-21 01:24:50.299680350 +0200
+@@ -274,7 +274,8 @@
+     ftPCc,
+     ftPContRange,
+     ftPRange,
+-    ftDate_1123_or_ETag
++    ftDate_1123_or_ETag,
++    ftSize
+ } field_type;
+ 
+ /* possible owners of http header */
+@@ -623,6 +624,7 @@
+     STORE_META_HITMETERING,	/* reserved for hit metering */
+     STORE_META_VALID,
+     STORE_META_VARY_HEADERS,	/* Stores Vary request headers */
++    STORE_META_STD_LFS,		/* standard metadata in lfs format */
+     STORE_META_END
+ };
+ 
+@@ -638,6 +640,7 @@
+     SWAP_LOG_NOP,
+     SWAP_LOG_ADD,
+     SWAP_LOG_DEL,
++    SWAP_LOG_VERSION,
+     SWAP_LOG_MAX
+ } swap_log_op;
+ 
+diff -urNad squid-2.5.9/src/forward.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/forward.c
+--- squid-2.5.9/src/forward.c	2005-04-21 01:24:41.041159974 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/forward.c	2005-04-21 01:24:50.302681466 +0200
+@@ -693,9 +693,18 @@
+ #endif
+     if (EBIT_TEST(e->flags, ENTRY_FWD_HDR_WAIT))
+ 	return rc;
+-    if (mem->inmem_hi - storeLowestMemReaderOffset(e) < READ_AHEAD_GAP)
+-	return rc;
+-    return 1;
++    if (EBIT_TEST(e->flags, RELEASE_REQUEST)) {
++	/* Just a small safety cap to defer storing more data into the object
++	 * if there already is way too much. This handles the case when there
++	 * is disk clients pending on a too large object being fetched and a
++	 * few other corner cases.
++	 */
++	if (mem->inmem_hi - mem->inmem_lo > SM_PAGE_SIZE + Config.Store.maxInMemObjSize + READ_AHEAD_GAP)
++	    return 1;
++    }
++    if (mem->inmem_hi - storeLowestMemReaderOffset(e) > READ_AHEAD_GAP)
++	return 1;
++    return rc;
+ }
+ 
+ void
+diff -urNad squid-2.5.9/src/fs/aufs/async_io.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/async_io.c
+--- squid-2.5.9/src/fs/aufs/async_io.c	2005-04-21 01:24:44.899543499 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/async_io.c	2005-04-21 01:24:50.305682582 +0200
+@@ -177,7 +177,7 @@
+ 
+ 
+ void
+-aioWrite(int fd, int offset, char *bufp, int len, AIOCB * callback, void *callback_data, FREE * free_func)
++aioWrite(int fd, off_t offset, char *bufp, int len, AIOCB * callback, void *callback_data, FREE * free_func)
+ {
+     squidaio_ctrl_t *ctrlp;
+     int seekmode;
+@@ -205,7 +205,7 @@
+ 
+ 
+ void
+-aioRead(int fd, int offset, int len, AIOCB * callback, void *callback_data)
++aioRead(int fd, off_t offset, int len, AIOCB * callback, void *callback_data)
+ {
+     squidaio_ctrl_t *ctrlp;
+     int seekmode;
+diff -urNad squid-2.5.9/src/fs/aufs/store_asyncufs.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/store_asyncufs.h
+--- squid-2.5.9/src/fs/aufs/store_asyncufs.h	2005-04-21 01:24:44.910541741 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/store_asyncufs.h	2005-04-21 01:24:50.306682954 +0200
+@@ -64,8 +64,8 @@
+ void aioCancel(int);
+ void aioOpen(const char *, int, mode_t, AIOCB *, void *);
+ void aioClose(int);
+-void aioWrite(int, int offset, char *, int size, AIOCB *, void *, FREE *);
+-void aioRead(int, int offset, int size, AIOCB *, void *);
++void aioWrite(int, off_t offset, char *, int size, AIOCB *, void *, FREE *);
++void aioRead(int, off_t offset, int size, AIOCB *, void *);
+ void aioStat(char *, struct stat *, AIOCB *, void *);
+ void aioUnlink(const char *, AIOCB *, void *);
+ void aioTruncate(const char *, off_t length, AIOCB *, void *);
+diff -urNad squid-2.5.9/src/fs/aufs/store_dir_aufs.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/store_dir_aufs.c
+--- squid-2.5.9/src/fs/aufs/store_dir_aufs.c	2005-04-21 01:24:44.941536789 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/store_dir_aufs.c	2005-04-21 01:24:50.316686674 +0200
+@@ -82,7 +82,7 @@
+ static int storeAufsDirGetNextFile(RebuildState *, sfileno *, int *size);
+ static StoreEntry *storeAufsDirAddDiskRestore(SwapDir * SD, const cache_key * key,
+     sfileno file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -366,6 +366,24 @@
+ }
+ 
+ static void
++storeAufsDirRebuildComplete(RebuildState * rb)
++{
++    if (rb->log) {
++	debug(47, 1) ("Done reading %s swaplog (%d entries)\n",
++	    rb->sd->path, rb->n_read);
++	fclose(rb->log);
++	rb->log = NULL;
++    } else {
++	debug(47, 1) ("Done scanning %s (%d entries)\n",
++	    rb->sd->path, rb->counts.scancount);
++    }
++    store_dirs_rebuilding--;
++    storeAufsDirCloseTmpSwapLog(rb->sd);
++    storeRebuildComplete(&rb->counts);
++    cbdataFree(rb);
++}
++
++static void
+ storeAufsDirRebuildFromDirectory(void *data)
+ {
+     RebuildState *rb = data;
+@@ -388,12 +406,7 @@
+ 	assert(fd == -1);
+ 	fd = storeAufsDirGetNextFile(rb, &filn, &size);
+ 	if (fd == -2) {
+-	    debug(47, 1) ("Done scanning %s swaplog (%d entries)\n",
+-		rb->sd->path, rb->n_read);
+-	    store_dirs_rebuilding--;
+-	    storeAufsDirCloseTmpSwapLog(rb->sd);
+-	    storeRebuildComplete(&rb->counts);
+-	    cbdataFree(rb);
++	    storeAufsDirRebuildComplete(rb);
+ 	    return;
+ 	} else if (fd < 0) {
+ 	    continue;
+@@ -445,10 +458,39 @@
+ 		assert(t->length == MD5_DIGEST_CHARS);
+ 		xmemcpy(key, t->value, MD5_DIGEST_CHARS);
+ 		break;
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+ 	    case STORE_META_STD:
+ 		assert(t->length == STORE_HDR_METASIZE);
+ 		xmemcpy(&tmpe.timestamp, t->value, STORE_HDR_METASIZE);
+ 		break;
++#else
++	    case STORE_META_STD_LFS:
++		assert(t->length == STORE_HDR_METASIZE);
++		xmemcpy(&tmpe.timestamp, t->value, STORE_HDR_METASIZE);
++		break;
++	    case STORE_META_STD:
++		assert(t->length == STORE_HDR_METASIZE_OLD);
++		{
++		    struct {
++			time_t timestamp;
++			time_t lastref;
++			time_t expires;
++			time_t lastmod;
++			size_t swap_file_sz;
++			u_short refcount;
++			u_short flags;
++		    }     *tmp = t->value;
++		    assert(sizeof(*tmp) == STORE_HDR_METASIZE_OLD);
++		    tmpe.timestamp = tmp->timestamp;
++		    tmpe.lastref = tmp->lastref;
++		    tmpe.expires = tmp->expires;
++		    tmpe.lastmod = tmp->lastmod;
++		    tmpe.swap_file_sz = tmp->swap_file_sz;
++		    tmpe.refcount = tmp->refcount;
++		    tmpe.flags = tmp->flags;
++		}
++		break;
++#endif
+ 	    default:
+ 		break;
+ 	    }
+@@ -522,21 +564,178 @@
+     /* load a number of objects per invocation */
+     for (count = 0; count < rb->speed; count++) {
+ 	if (fread(&s, ss, 1, rb->log) != 1) {
+-	    debug(47, 1) ("Done reading %s swaplog (%d entries)\n",
+-		rb->sd->path, rb->n_read);
+-	    fclose(rb->log);
+-	    rb->log = NULL;
+-	    store_dirs_rebuilding--;
+-	    storeAufsDirCloseTmpSwapLog(rb->sd);
+-	    storeRebuildComplete(&rb->counts);
+-	    cbdataFree(rb);
++	    storeAufsDirRebuildComplete(rb);
+ 	    return;
+ 	}
+ 	rb->n_read++;
+-	if (s.op <= SWAP_LOG_NOP)
++	/*
++	 * BC: during 2.4 development, we changed the way swap file
++	 * numbers are assigned and stored.  The high 16 bits used
++	 * to encode the SD index number.  There used to be a call
++	 * to storeDirProperFileno here that re-assigned the index 
++	 * bits.  Now, for backwards compatibility, we just need
++	 * to mask it off.
++	 */
++	s.swap_filen &= 0x00FFFFFF;
++	debug(47, 3) ("storeAufsDirRebuildFromSwapLog: %s %s %08X\n",
++	    swap_log_op_str[(int) s.op],
++	    storeKeyText(s.key),
++	    s.swap_filen);
++	if (s.op == SWAP_LOG_ADD) {
++	    (void) 0;
++	} else if (s.op == SWAP_LOG_DEL) {
++	    /* Delete unless we already have a newer copy */
++	    if ((e = storeGet(s.key)) != NULL && s.lastref > e->lastref) {
++		/*
++		 * Make sure we don't unlink the file, it might be
++		 * in use by a subsequent entry.  Also note that
++		 * we don't have to subtract from store_swap_size
++		 * because adding to store_swap_size happens in
++		 * the cleanup procedure.
++		 */
++		storeExpireNow(e);
++		storeReleaseRequest(e);
++		if (e->swap_filen > -1) {
++		    storeAufsDirReplRemove(e);
++		    storeAufsDirMapBitReset(SD, e->swap_filen);
++		    e->swap_filen = -1;
++		    e->swap_dirn = -1;
++		}
++		storeRelease(e);
++		rb->counts.objcount--;
++		rb->counts.cancelcount++;
++	    }
+ 	    continue;
+-	if (s.op >= SWAP_LOG_MAX)
++	} else {
++	    x = log(++rb->counts.bad_log_op) / log(10.0);
++	    if (0.0 == x - (double) (int) x)
++		debug(47, 1) ("WARNING: %d invalid swap log entries found\n",
++		    rb->counts.bad_log_op);
++	    rb->counts.invalid++;
++	    continue;
++	}
++	if ((++rb->counts.scancount & 0xFFF) == 0) {
++	    struct stat sb;
++	    if (0 == fstat(fileno(rb->log), &sb))
++		storeRebuildProgress(SD->index,
++		    (int) sb.st_size / ss, rb->n_read);
++	}
++	if (!storeAufsDirValidFileno(SD, s.swap_filen, 0)) {
++	    rb->counts.invalid++;
++	    continue;
++	}
++	if (EBIT_TEST(s.flags, KEY_PRIVATE)) {
++	    rb->counts.badflags++;
++	    continue;
++	}
++	e = storeGet(s.key);
++	used = storeAufsDirMapBitTest(SD, s.swap_filen);
++	/* If this URL already exists in the cache, does the swap log
++	 * appear to have a newer entry?  Compare 'lastref' from the
++	 * swap log to e->lastref. */
++	disk_entry_newer = e ? (s.lastref > e->lastref ? 1 : 0) : 0;
++	if (used && !disk_entry_newer) {
++	    /* log entry is old, ignore it */
++	    rb->counts.clashcount++;
++	    continue;
++	} else if (used && e && e->swap_filen == s.swap_filen && e->swap_dirn == SD->index) {
++	    /* swapfile taken, same URL, newer, update meta */
++	    if (e->store_status == STORE_OK) {
++		e->lastref = s.timestamp;
++		e->timestamp = s.timestamp;
++		e->expires = s.expires;
++		e->lastmod = s.lastmod;
++		e->flags = s.flags;
++		e->refcount += s.refcount;
++		storeAufsDirUnrefObj(SD, e);
++	    } else {
++		debug_trap("storeAufsDirRebuildFromSwapLog: bad condition");
++		debug(47, 1) ("\tSee %s:%d\n", __FILE__, __LINE__);
++	    }
++	    continue;
++	} else if (used) {
++	    /* swapfile in use, not by this URL, log entry is newer */
++	    /* This is sorta bad: the log entry should NOT be newer at this
++	     * point.  If the log is dirty, the filesize check should have
++	     * caught this.  If the log is clean, there should never be a
++	     * newer entry. */
++	    debug(47, 1) ("WARNING: newer swaplog entry for dirno %d, fileno %08X\n",
++		SD->index, s.swap_filen);
++	    /* I'm tempted to remove the swapfile here just to be safe,
++	     * but there is a bad race condition in the NOVM version if
++	     * the swapfile has recently been opened for writing, but
++	     * not yet opened for reading.  Because we can't map
++	     * swapfiles back to StoreEntrys, we don't know the state
++	     * of the entry using that file.  */
++	    /* We'll assume the existing entry is valid, probably because
++	     * were in a slow rebuild and the the swap file number got taken
++	     * and the validation procedure hasn't run. */
++	    assert(rb->flags.need_to_validate);
++	    rb->counts.clashcount++;
++	    continue;
++	} else if (e && !disk_entry_newer) {
++	    /* key already exists, current entry is newer */
++	    /* keep old, ignore new */
++	    rb->counts.dupcount++;
+ 	    continue;
++	} else if (e) {
++	    /* key already exists, this swapfile not being used */
++	    /* junk old, load new */
++	    storeExpireNow(e);
++	    storeReleaseRequest(e);
++	    if (e->swap_filen > -1) {
++		storeAufsDirReplRemove(e);
++		/* Make sure we don't actually unlink the file */
++		storeAufsDirMapBitReset(SD, e->swap_filen);
++		e->swap_filen = -1;
++		e->swap_dirn = -1;
++	    }
++	    storeRelease(e);
++	    rb->counts.dupcount++;
++	} else {
++	    /* URL doesnt exist, swapfile not in use */
++	    /* load new */
++	    (void) 0;
++	}
++	/* update store_swap_size */
++	rb->counts.objcount++;
++	e = storeAufsDirAddDiskRestore(SD, s.key,
++	    s.swap_filen,
++	    s.swap_file_sz,
++	    s.expires,
++	    s.timestamp,
++	    s.lastref,
++	    s.lastmod,
++	    s.refcount,
++	    s.flags,
++	    (int) rb->flags.clean);
++	storeDirSwapLog(e, SWAP_LOG_ADD);
++    }
++    eventAdd("storeRebuild", storeAufsDirRebuildFromSwapLog, rb, 0.0, 1);
++}
++
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++/* This is an exact copy of the above, but using storeSwapLogDataOld entry type */
++static void
++storeAufsDirRebuildFromSwapLogOld(void *data)
++{
++    RebuildState *rb = data;
++    SwapDir *SD = rb->sd;
++    StoreEntry *e = NULL;
++    storeSwapLogDataOld s;
++    size_t ss = sizeof(storeSwapLogDataOld);
++    int count;
++    int used;			/* is swapfile already in use? */
++    int disk_entry_newer;	/* is the log entry newer than current entry? */
++    double x;
++    assert(rb != NULL);
++    /* load a number of objects per invocation */
++    for (count = 0; count < rb->speed; count++) {
++	if (fread(&s, ss, 1, rb->log) != 1) {
++	    storeAufsDirRebuildComplete(rb);
++	    return;
++	}
++	rb->n_read++;
+ 	/*
+ 	 * BC: during 2.4 development, we changed the way swap file
+ 	 * numbers are assigned and stored.  The high 16 bits used
+@@ -680,7 +879,49 @@
+ 	    (int) rb->flags.clean);
+ 	storeDirSwapLog(e, SWAP_LOG_ADD);
+     }
++    eventAdd("storeRebuild", storeAufsDirRebuildFromSwapLogOld, rb, 0.0, 1);
++}
++
++#endif
++
++static void
++storeAufsDirRebuildFromSwapLogCheckVersion(void *data)
++{
++    RebuildState *rb = data;
++    storeSwapLogHeader hdr;
++
++    if (fread(&hdr, sizeof(hdr), 1, rb->log) != 1) {
++	storeAufsDirRebuildComplete(rb);
++	return;
++    }
++    if (hdr.op == SWAP_LOG_VERSION) {
++	if (fseek(rb->log, hdr.record_size, SEEK_SET) != 0) {
++	    storeAufsDirRebuildComplete(rb);
++	    return;
++	}
++	if (hdr.version == 1 && hdr.record_size == sizeof(storeSwapLogData)) {
++	    eventAdd("storeRebuild", storeAufsDirRebuildFromSwapLog, rb, 0.0, 1);
++	    return;
++	}
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++	if (hdr.version == 1 && hdr.record_size == sizeof(storeSwapLogDataOld)) {
++	    debug(47, 1) ("storeAufsDirRebuildFromSwapLog: Found current version but without large file support. Upgrading\n");
++	    eventAdd("storeRebuild", storeAufsDirRebuildFromSwapLogOld, rb, 0.0, 1);
++	    return;
++	}
++#endif
++	debug(47, 1) ("storeAufsDirRebuildFromSwapLog: Unsupported swap.state version %d size %d\n",
++	    hdr.version, hdr.record_size);
++	storeAufsDirRebuildComplete(rb);
++	return;
++    }
++    rewind(rb->log);
++    debug(47, 1) ("storeAufsDirRebuildFromSwapLog: Old version detected. Upgrading\n");
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+     eventAdd("storeRebuild", storeAufsDirRebuildFromSwapLog, rb, 0.0, 1);
++#else
++    eventAdd("storeRebuild", storeAufsDirRebuildFromSwapLogOld, rb, 0.0, 1);
++#endif
+ }
+ 
+ static int
+@@ -775,7 +1016,7 @@
+ static StoreEntry *
+ storeAufsDirAddDiskRestore(SwapDir * SD, const cache_key * key,
+     sfileno file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -839,7 +1080,7 @@
+ 	    fclose(fp);
+ 	func = storeAufsDirRebuildFromDirectory;
+     } else {
+-	func = storeAufsDirRebuildFromSwapLog;
++	func = storeAufsDirRebuildFromSwapLogCheckVersion;
+ 	rb->log = fp;
+ 	rb->flags.clean = (unsigned int) clean;
+     }
+@@ -879,6 +1120,31 @@
+     debug(47, 3) ("Cache Dir #%d log opened on FD %d\n", sd->index, fd);
+ }
+ 
++static void
++storeSwapLogDataFree(void *s)
++{
++    memFree(s, MEM_SWAP_LOG_DATA);
++}
++
++static void
++storeAufsWriteSwapLogheader(int fd)
++{
++    storeSwapLogHeader *hdr = memAllocate(MEM_SWAP_LOG_DATA);
++    hdr->op = SWAP_LOG_VERSION;
++    hdr->version = 1;
++    hdr->record_size = sizeof(storeSwapLogData);
++    /* The header size is a full log record to keep some level of backward
++     * compatibility even if the actual header is smaller
++     */
++    file_write(fd,
++	-1,
++	hdr,
++	sizeof(storeSwapLogData),
++	NULL,
++	NULL,
++	(FREE *) storeSwapLogDataFree);
++}
++
+ static FILE *
+ storeAufsDirOpenTmpSwapLog(SwapDir * sd, int *clean_flag, int *zero_flag)
+ {
+@@ -908,6 +1174,7 @@
+ 	fatal("storeDirOpenTmpSwapLog: Failed to open swap log.");
+     }
+     aioinfo->swaplog_fd = fd;
++    storeAufsWriteSwapLogheader(fd);
+     /* open a read-only stream of the old log */
+     fp = fopen(swaplog_path, "r");
+     if (fp == NULL) {
+@@ -936,7 +1203,7 @@
+     char *new;
+     char *cln;
+     char *outbuf;
+-    off_t outbuf_offset;
++    int outbuf_offset;
+     int fd;
+     RemovalPolicyWalker *walker;
+ };
+@@ -967,6 +1234,7 @@
+ 	xfree(state);
+ 	return -1;
+     }
++    storeAufsWriteSwapLogheader(state->fd);
+     state->cur = xstrdup(storeAufsDirSwapLogFile(sd, NULL));
+     state->cln = xstrdup(storeAufsDirSwapLogFile(sd, ".last-clean"));
+     state->outbuf = xcalloc(CLEAN_BUF_SZ, 1);
+@@ -1095,12 +1363,6 @@
+ }
+ 
+ static void
+-storeSwapLogDataFree(void *s)
+-{
+-    memFree(s, MEM_SWAP_LOG_DATA);
+-}
+-
+-static void
+ storeAufsDirSwapLog(const SwapDir * sd, const StoreEntry * e, int op)
+ {
+     squidaioinfo_t *aioinfo = (squidaioinfo_t *) sd->fsdata;
+diff -urNad squid-2.5.9/src/fs/aufs/store_io_aufs.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/store_io_aufs.c
+--- squid-2.5.9/src/fs/aufs/store_io_aufs.c	2005-04-21 01:24:44.957534233 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/aufs/store_io_aufs.c	2005-04-21 01:24:50.320688162 +0200
+@@ -153,7 +153,7 @@
+ 
+ /* Read */
+ void
+-storeAufsRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, STRCB * callback, void *callback_data)
++storeAufsRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, STRCB * callback, void *callback_data)
+ {
+     squidaiostate_t *aiostate = (squidaiostate_t *) sio->fsstate;
+     assert(sio->read.callback == NULL);
+@@ -167,7 +167,7 @@
+ 	q = memPoolAlloc(aufs_qread_pool);
+ 	q->buf = buf;
+ 	q->size = size;
+-	q->offset = offset;
++	q->offset = (off_t) offset;
+ 	q->callback = callback;
+ 	q->callback_data = callback_data;
+ 	cbdataLock(q->callback_data);
+@@ -183,10 +183,10 @@
+     sio->offset = offset;
+     aiostate->flags.reading = 1;
+ #if ASYNC_READ
+-    aioRead(aiostate->fd, offset, size, storeAufsReadDone, sio);
++    aioRead(aiostate->fd, (off_t) offset, size, storeAufsReadDone, sio);
+     statCounter.syscalls.disk.reads++;
+ #else
+-    file_read(aiostate->fd, buf, size, offset, storeAufsReadDone, sio);
++    file_read(aiostate->fd, buf, size, (off_t) offset, storeAufsReadDone, sio);
+     /* file_read() increments syscalls.disk.reads */
+ #endif
+ }
+@@ -194,7 +194,7 @@
+ 
+ /* Write */
+ void
+-storeAufsWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, FREE * free_func)
++storeAufsWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, FREE * free_func)
+ {
+     squidaiostate_t *aiostate = (squidaiostate_t *) sio->fsstate;
+     debug(79, 3) ("storeAufsWrite: dirno %d, fileno %08X, FD %d\n",
+@@ -206,7 +206,7 @@
+ 	q = memPoolAlloc(aufs_qwrite_pool);
+ 	q->buf = buf;
+ 	q->size = size;
+-	q->offset = offset;
++	q->offset = (off_t) offset;
+ 	q->free_func = free_func;
+ 	linklistPush(&(aiostate->pending_writes), q);
+ 	return;
+@@ -218,17 +218,17 @@
+ 	q = memPoolAlloc(aufs_qwrite_pool);
+ 	q->buf = buf;
+ 	q->size = size;
+-	q->offset = offset;
++	q->offset = (off_t) offset;
+ 	q->free_func = free_func;
+ 	linklistPush(&(aiostate->pending_writes), q);
+ 	return;
+     }
+     aiostate->flags.writing = 1;
+-    aioWrite(aiostate->fd, offset, buf, size, storeAufsWriteDone, sio,
++    aioWrite(aiostate->fd, (off_t) offset, buf, size, storeAufsWriteDone, sio,
+ 	free_func);
+     statCounter.syscalls.disk.writes++;
+ #else
+-    file_write(aiostate->fd, offset, buf, size, storeAufsWriteDone, sio,
++    file_write(aiostate->fd, (off_t) offset, buf, size, storeAufsWriteDone, sio,
+ 	free_func);
+     /* file_write() increments syscalls.disk.writes */
+ #endif
+@@ -330,7 +330,7 @@
+ 	debug(79, 3) ("storeAufsReadDone: got failure (%d)\n", errflag);
+ 	rlen = -1;
+     } else {
+-	rlen = (ssize_t) len;
++	rlen = len;
+ 	sio->offset += len;
+     }
+ #if ASYNC_READ
+diff -urNad squid-2.5.9/src/fs/coss/store_dir_coss.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/coss/store_dir_coss.c
+--- squid-2.5.9/src/fs/coss/store_dir_coss.c	2005-04-21 01:24:41.167139845 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/coss/store_dir_coss.c	2005-04-21 01:24:50.323689278 +0200
+@@ -63,7 +63,7 @@
+ static EVH storeCossRebuildFromSwapLog;
+ static StoreEntry *storeCossAddDiskRestore(SwapDir * SD, const cache_key * key,
+     int file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -318,7 +318,7 @@
+ static StoreEntry *
+ storeCossAddDiskRestore(SwapDir * SD, const cache_key * key,
+     int file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -485,7 +485,7 @@
+     char *new;
+     char *cln;
+     char *outbuf;
+-    off_t outbuf_offset;
++    int outbuf_offset;
+     int fd;
+     dlink_node *current;
+ };
+diff -urNad squid-2.5.9/src/fs/coss/store_io_coss.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/coss/store_io_coss.c
+--- squid-2.5.9/src/fs/coss/store_io_coss.c	2005-04-21 01:24:41.202134254 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/coss/store_io_coss.c	2005-04-21 01:24:50.326690394 +0200
+@@ -296,7 +296,7 @@
+ }
+ 
+ void
+-storeCossRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, STRCB * callback, void *callback_data)
++storeCossRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, STRCB * callback, void *callback_data)
+ {
+     char *p;
+     CossState *cstate = (CossState *) sio->fsstate;
+@@ -337,7 +337,7 @@
+ }
+ 
+ void
+-storeCossWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, FREE * free_func)
++storeCossWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, FREE * free_func)
+ {
+     char *dest;
+     CossMemBuf *membuf;
+@@ -373,7 +373,7 @@
+     void *their_data = sio->read.callback_data;
+     SwapDir *SD = INDEXSD(sio->swap_dirn);
+     CossState *cstate = (CossState *) sio->fsstate;
+-    size_t rlen;
++    ssize_t rlen;
+ 
+     debug(79, 3) ("storeCossReadDone: fileno %d, FD %d, len %d\n",
+ 	sio->swap_filen, fd, len);
+@@ -547,7 +547,7 @@
+     if (errflag) {
+ 	coss_stats.stripe_write.fail++;
+ 	debug(79, 1) ("storeCossWriteMemBufDone: got failure (%d)\n", errflag);
+-	debug(79, 1) ("FD %d, size=%x\n", fd, t->diskend - t->diskstart);
++	debug(79, 1) ("FD %d, size=%x\n", fd, (int) (t->diskend - t->diskstart));
+     } else {
+ 	coss_stats.stripe_write.success++;
+     }
+diff -urNad squid-2.5.9/src/fs/diskd/diskd.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/diskd.c
+--- squid-2.5.9/src/fs/diskd/diskd.c	2005-04-21 01:24:41.216132017 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/diskd.c	2005-04-21 01:24:50.328691138 +0200
+@@ -135,18 +135,18 @@
+     }
+     if (r->offset > -1 && r->offset != fs->offset) {
+ 	DEBUG(2)
+-	    fprintf(stderr, "seeking to %d\n", r->offset);
++	    fprintf(stderr, "seeking to %" PRINTF_OFF_T "\n", (squid_off_t) r->offset);
+ 	if (lseek(fs->fd, r->offset, SEEK_SET) < 0) {
+ 	    DEBUG(1) {
+-		fprintf(stderr, "%d FD %d, offset %d: ", (int) mypid, fs->fd, r->offset);
++		fprintf(stderr, "%d FD %d, offset %" PRINTF_OFF_T ": ", (int) mypid, fs->fd, (squid_off_t) r->offset);
+ 		perror("lseek");
+ 	    }
+ 	}
+     }
+     x = read(fs->fd, buf, readlen);
+     DEBUG(2)
+-	fprintf(stderr, "%d READ %d,%d,%d ret %d\n", (int) mypid,
+-	fs->fd, readlen, r->offset, x);
++	fprintf(stderr, "%d READ %d,%d,%" PRINTF_OFF_T " ret %d\n", (int) mypid,
++	fs->fd, readlen, (squid_off_t) r->offset, x);
+     if (x < 0) {
+ 	DEBUG(1) {
+ 	    fprintf(stderr, "%d FD %d: ", (int) mypid, fs->fd);
+@@ -176,14 +176,14 @@
+     if (r->offset > -1 && r->offset != fs->offset) {
+ 	if (lseek(fs->fd, r->offset, SEEK_SET) < 0) {
+ 	    DEBUG(1) {
+-		fprintf(stderr, "%d FD %d, offset %d: ", (int) mypid, fs->fd, r->offset);
++		fprintf(stderr, "%d FD %d, offset %" PRINTF_OFF_T ": ", (int) mypid, fs->fd, (squid_off_t) r->offset);
+ 		perror("lseek");
+ 	    }
+ 	}
+     }
+     DEBUG(2)
+-	fprintf(stderr, "%d WRITE %d,%d,%d\n", (int) mypid,
+-	fs->fd, wrtlen, r->offset);
++	fprintf(stderr, "%d WRITE %d,%d,%" PRINTF_OFF_T "\n", (int) mypid,
++	fs->fd, wrtlen, (squid_off_t) r->offset);
+     x = write(fs->fd, buf, wrtlen);
+     if (x < 0) {
+ 	DEBUG(1) {
+diff -urNad squid-2.5.9/src/fs/diskd/store_dir_diskd.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/store_dir_diskd.c
+--- squid-2.5.9/src/fs/diskd/store_dir_diskd.c	2005-04-21 01:24:41.272123071 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/store_dir_diskd.c	2005-04-21 01:24:50.339695230 +0200
+@@ -86,7 +86,7 @@
+ static int storeDiskdDirGetNextFile(RebuildState *, sfileno *, int *size);
+ static StoreEntry *storeDiskdDirAddDiskRestore(SwapDir * SD, const cache_key * key,
+     sfileno file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -528,7 +528,7 @@
+ 	storeDiskdHandle(&M);
+ 	retval = 1;		/* Return that we've actually done some work */
+ 	if (M.shm_offset > -1)
+-	    storeDiskdShmPut(SD, (off_t) M.shm_offset);
++	    storeDiskdShmPut(SD, M.shm_offset);
+     }
+     return retval;
+ }
+@@ -536,6 +536,24 @@
+ 
+ 
+ static void
++storeDiskdDirRebuildComplete(RebuildState * rb)
++{
++    if (rb->log) {
++	debug(47, 1) ("Done reading %s swaplog (%d entries)\n",
++	    rb->sd->path, rb->n_read);
++	fclose(rb->log);
++	rb->log = NULL;
++    } else {
++	debug(47, 1) ("Done scanning %s (%d entries)\n",
++	    rb->sd->path, rb->counts.scancount);
++    }
++    store_dirs_rebuilding--;
++    storeDiskdDirCloseTmpSwapLog(rb->sd);
++    storeRebuildComplete(&rb->counts);
++    cbdataFree(rb);
++}
++
++static void
+ storeDiskdDirRebuildFromDirectory(void *data)
+ {
+     RebuildState *rb = data;
+@@ -558,12 +576,7 @@
+ 	assert(fd == -1);
+ 	fd = storeDiskdDirGetNextFile(rb, &filn, &size);
+ 	if (fd == -2) {
+-	    debug(20, 1) ("Done scanning %s swaplog (%d entries)\n",
+-		rb->sd->path, rb->n_read);
+-	    store_dirs_rebuilding--;
+-	    storeDiskdDirCloseTmpSwapLog(rb->sd);
+-	    storeRebuildComplete(&rb->counts);
+-	    cbdataFree(rb);
++	    storeDiskdDirRebuildComplete(rb);
+ 	    return;
+ 	} else if (fd < 0) {
+ 	    continue;
+@@ -615,10 +628,39 @@
+ 		assert(t->length == MD5_DIGEST_CHARS);
+ 		xmemcpy(key, t->value, MD5_DIGEST_CHARS);
+ 		break;
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+ 	    case STORE_META_STD:
+ 		assert(t->length == STORE_HDR_METASIZE);
+ 		xmemcpy(&tmpe.timestamp, t->value, STORE_HDR_METASIZE);
+ 		break;
++#else
++	    case STORE_META_STD_LFS:
++		assert(t->length == STORE_HDR_METASIZE);
++		xmemcpy(&tmpe.timestamp, t->value, STORE_HDR_METASIZE);
++		break;
++	    case STORE_META_STD:
++		assert(t->length == STORE_HDR_METASIZE_OLD);
++		{
++		    struct {
++			time_t timestamp;
++			time_t lastref;
++			time_t expires;
++			time_t lastmod;
++			size_t swap_file_sz;
++			u_short refcount;
++			u_short flags;
++		    }     *tmp = t->value;
++		    assert(sizeof(*tmp) == STORE_HDR_METASIZE_OLD);
++		    tmpe.timestamp = tmp->timestamp;
++		    tmpe.lastref = tmp->lastref;
++		    tmpe.expires = tmp->expires;
++		    tmpe.lastmod = tmp->lastmod;
++		    tmpe.swap_file_sz = tmp->swap_file_sz;
++		    tmpe.refcount = tmp->refcount;
++		    tmpe.flags = tmp->flags;
++		}
++		break;
++#endif
+ 	    default:
+ 		break;
+ 	    }
+@@ -692,21 +734,203 @@
+     /* load a number of objects per invocation */
+     for (count = 0; count < rb->speed; count++) {
+ 	if (fread(&s, ss, 1, rb->log) != 1) {
+-	    debug(20, 1) ("Done reading %s swaplog (%d entries)\n",
+-		rb->sd->path, rb->n_read);
+-	    fclose(rb->log);
+-	    rb->log = NULL;
+-	    store_dirs_rebuilding--;
+-	    storeDiskdDirCloseTmpSwapLog(rb->sd);
+-	    storeRebuildComplete(&rb->counts);
+-	    cbdataFree(rb);
++	    storeDiskdDirRebuildComplete(rb);
+ 	    return;
+ 	}
+ 	rb->n_read++;
+-	if (s.op <= SWAP_LOG_NOP)
++	/*
++	 * BC: during 2.4 development, we changed the way swap file
++	 * numbers are assigned and stored.  The high 16 bits used
++	 * to encode the SD index number.  There used to be a call
++	 * to storeDirProperFileno here that re-assigned the index
++	 * bits.  Now, for backwards compatibility, we just need
++	 * to mask it off.
++	 */
++	s.swap_filen &= 0x00FFFFFF;
++	debug(20, 3) ("storeDiskdDirRebuildFromSwapLog: %s %s %08X\n",
++	    swap_log_op_str[(int) s.op],
++	    storeKeyText(s.key),
++	    s.swap_filen);
++	if (s.op == SWAP_LOG_ADD) {
++	    /*
++	     * Here we have some special checks for large files.
++	     * I've been seeing a system crash followed by a reboot
++	     * that seems to corrupt the swap log.  Squid believes
++	     * that the disk holds some really large files.  It
++	     * complains about using being over the high water mark
++	     * and proceeds to delete files as fast as it can.  To
++	     * prevent that, we call stat() on sufficiently large
++	     * files (>128KB) and reject those that are missing or
++	     * have the wrong size.
++	     */
++	    struct stat sb;
++	    char *p = storeDiskdDirFullPath(SD, s.swap_filen, NULL);
++	    if (s.swap_file_sz < (1 << 17)) {
++		(void) 0;
++	    } else if (stat(p, &sb) < 0) {
++		debug(47, 2) ("its missing!: %s\n", p);
++		continue;
++	    } else if (sb.st_size != s.swap_file_sz) {
++		debug(47, 2) ("size mismatch!: stat=%d, log=%d\n",
++		    (int) sb.st_size, (int) s.swap_file_sz);
++		continue;
++	    } else {
++		debug(47, 2) ("big file (%d bytes) checks out\n",
++		    (int) s.swap_file_sz);
++	    }
++	} else if (s.op == SWAP_LOG_DEL) {
++	    /* Delete unless we already have a newer copy */
++	    if ((e = storeGet(s.key)) != NULL && s.lastref > e->lastref) {
++		/*
++		 * Make sure we don't unlink the file, it might be
++		 * in use by a subsequent entry.  Also note that
++		 * we don't have to subtract from store_swap_size
++		 * because adding to store_swap_size happens in
++		 * the cleanup procedure.
++		 */
++		storeExpireNow(e);
++		storeReleaseRequest(e);
++		if (e->swap_filen > -1) {
++		    storeDiskdDirReplRemove(e);
++		    storeDiskdDirMapBitReset(SD, e->swap_filen);
++		    e->swap_filen = -1;
++		    e->swap_dirn = -1;
++		}
++		storeRelease(e);
++		rb->counts.objcount--;
++		rb->counts.cancelcount++;
++	    }
+ 	    continue;
+-	if (s.op >= SWAP_LOG_MAX)
++	} else {
++	    x = log(++rb->counts.bad_log_op) / log(10.0);
++	    if (0.0 == x - (double) (int) x)
++		debug(20, 1) ("WARNING: %d invalid swap log entries found\n",
++		    rb->counts.bad_log_op);
++	    rb->counts.invalid++;
++	    continue;
++	}
++	if ((++rb->counts.scancount & 0xFFF) == 0) {
++	    struct stat sb;
++	    if (0 == fstat(fileno(rb->log), &sb))
++		storeRebuildProgress(SD->index,
++		    (int) sb.st_size / ss, rb->n_read);
++	}
++	if (!storeDiskdDirValidFileno(SD, s.swap_filen, 0)) {
++	    rb->counts.invalid++;
+ 	    continue;
++	}
++	if (EBIT_TEST(s.flags, KEY_PRIVATE)) {
++	    rb->counts.badflags++;
++	    continue;
++	}
++	e = storeGet(s.key);
++	used = storeDiskdDirMapBitTest(SD, s.swap_filen);
++	/* If this URL already exists in the cache, does the swap log
++	 * appear to have a newer entry?  Compare 'lastref' from the
++	 * swap log to e->lastref. */
++	disk_entry_newer = e ? (s.lastref > e->lastref ? 1 : 0) : 0;
++	if (used && !disk_entry_newer) {
++	    /* log entry is old, ignore it */
++	    rb->counts.clashcount++;
++	    continue;
++	} else if (used && e && e->swap_filen == s.swap_filen && e->swap_dirn == SD->index) {
++	    /* swapfile taken, same URL, newer, update meta */
++	    if (e->store_status == STORE_OK) {
++		e->lastref = s.timestamp;
++		e->timestamp = s.timestamp;
++		e->expires = s.expires;
++		e->lastmod = s.lastmod;
++		e->flags = s.flags;
++		e->refcount += s.refcount;
++		storeDiskdDirUnrefObj(SD, e);
++	    } else {
++		debug_trap("storeDiskdDirRebuildFromSwapLog: bad condition");
++		debug(20, 1) ("\tSee %s:%d\n", __FILE__, __LINE__);
++	    }
++	    continue;
++	} else if (used) {
++	    /* swapfile in use, not by this URL, log entry is newer */
++	    /* This is sorta bad: the log entry should NOT be newer at this
++	     * point.  If the log is dirty, the filesize check should have
++	     * caught this.  If the log is clean, there should never be a
++	     * newer entry. */
++	    debug(20, 1) ("WARNING: newer swaplog entry for dirno %d, fileno %08X\n",
++		SD->index, s.swap_filen);
++	    /* I'm tempted to remove the swapfile here just to be safe,
++	     * but there is a bad race condition in the NOVM version if
++	     * the swapfile has recently been opened for writing, but
++	     * not yet opened for reading.  Because we can't map
++	     * swapfiles back to StoreEntrys, we don't know the state
++	     * of the entry using that file.  */
++	    /* We'll assume the existing entry is valid, probably because
++	     * were in a slow rebuild and the the swap file number got taken
++	     * and the validation procedure hasn't run. */
++	    assert(rb->flags.need_to_validate);
++	    rb->counts.clashcount++;
++	    continue;
++	} else if (e && !disk_entry_newer) {
++	    /* key already exists, current entry is newer */
++	    /* keep old, ignore new */
++	    rb->counts.dupcount++;
++	    continue;
++	} else if (e) {
++	    /* key already exists, this swapfile not being used */
++	    /* junk old, load new */
++	    storeExpireNow(e);
++	    storeReleaseRequest(e);
++	    if (e->swap_filen > -1) {
++		storeDiskdDirReplRemove(e);
++		/* Make sure we don't actually unlink the file */
++		storeDiskdDirMapBitReset(SD, e->swap_filen);
++		e->swap_filen = -1;
++		e->swap_dirn = -1;
++	    }
++	    storeRelease(e);
++	    rb->counts.dupcount++;
++	} else {
++	    /* URL doesnt exist, swapfile not in use */
++	    /* load new */
++	    (void) 0;
++	}
++	/* update store_swap_size */
++	rb->counts.objcount++;
++	e = storeDiskdDirAddDiskRestore(SD, s.key,
++	    s.swap_filen,
++	    s.swap_file_sz,
++	    s.expires,
++	    s.timestamp,
++	    s.lastref,
++	    s.lastmod,
++	    s.refcount,
++	    s.flags,
++	    (int) rb->flags.clean);
++	storeDirSwapLog(e, SWAP_LOG_ADD);
++    }
++    eventAdd("storeRebuild", storeDiskdDirRebuildFromSwapLog, rb, 0.0, 1);
++}
++
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++/* This is an exact copy of the above, but using storeSwapLogDataOld entry type */
++static void
++storeDiskdDirRebuildFromSwapLogOld(void *data)
++{
++    RebuildState *rb = data;
++    SwapDir *SD = rb->sd;
++    StoreEntry *e = NULL;
++    storeSwapLogDataOld s;
++    size_t ss = sizeof(storeSwapLogDataOld);
++    int count;
++    int used;			/* is swapfile already in use? */
++    int disk_entry_newer;	/* is the log entry newer than current entry? */
++    double x;
++    assert(rb != NULL);
++    /* load a number of objects per invocation */
++    for (count = 0; count < rb->speed; count++) {
++	if (fread(&s, ss, 1, rb->log) != 1) {
++	    storeDiskdDirRebuildComplete(rb);
++	    return;
++	}
++	rb->n_read++;
+ 	/*
+ 	 * BC: during 2.4 development, we changed the way swap file
+ 	 * numbers are assigned and stored.  The high 16 bits used
+@@ -875,7 +1099,49 @@
+ 	    (int) rb->flags.clean);
+ 	storeDirSwapLog(e, SWAP_LOG_ADD);
+     }
++    eventAdd("storeRebuild", storeDiskdDirRebuildFromSwapLogOld, rb, 0.0, 1);
++}
++
++#endif
++
++static void
++storeDiskdDirRebuildFromSwapLogCheckVersion(void *data)
++{
++    RebuildState *rb = data;
++    storeSwapLogHeader hdr;
++
++    if (fread(&hdr, sizeof(hdr), 1, rb->log) != 1) {
++	storeDiskdDirRebuildComplete(rb);
++	return;
++    }
++    if (hdr.op == SWAP_LOG_VERSION) {
++	if (fseek(rb->log, hdr.record_size, SEEK_SET) != 0) {
++	    storeDiskdDirRebuildComplete(rb);
++	    return;
++	}
++	if (hdr.version == 1 && hdr.record_size == sizeof(storeSwapLogData)) {
++	    eventAdd("storeRebuild", storeDiskdDirRebuildFromSwapLog, rb, 0.0, 1);
++	    return;
++	}
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++	if (hdr.version == 1 && hdr.record_size == sizeof(storeSwapLogDataOld)) {
++	    debug(47, 1) ("storeDiskdDirRebuildFromSwapLog: Found current version but without large file support. Upgrading\n");
++	    eventAdd("storeRebuild", storeDiskdDirRebuildFromSwapLogOld, rb, 0.0, 1);
++	    return;
++	}
++#endif
++	debug(47, 1) ("storeDiskdDirRebuildFromSwapLog: Unsupported swap.state version %d size %d\n",
++	    hdr.version, hdr.record_size);
++	storeDiskdDirRebuildComplete(rb);
++	return;
++    }
++    rewind(rb->log);
++    debug(47, 1) ("storeDiskdDirRebuildFromSwapLog: Old version detected. Upgrading\n");
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+     eventAdd("storeRebuild", storeDiskdDirRebuildFromSwapLog, rb, 0.0, 1);
++#else
++    eventAdd("storeRebuild", storeDiskdDirRebuildFromSwapLogOld, rb, 0.0, 1);
++#endif
+ }
+ 
+ static int
+@@ -970,7 +1236,7 @@
+ static StoreEntry *
+ storeDiskdDirAddDiskRestore(SwapDir * SD, const cache_key * key,
+     int file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -1034,7 +1300,7 @@
+ 	    fclose(fp);
+ 	func = storeDiskdDirRebuildFromDirectory;
+     } else {
+-	func = storeDiskdDirRebuildFromSwapLog;
++	func = storeDiskdDirRebuildFromSwapLogCheckVersion;
+ 	rb->log = fp;
+ 	rb->flags.clean = (unsigned int) clean;
+     }
+@@ -1074,6 +1340,31 @@
+     debug(47, 3) ("Cache Dir #%d log opened on FD %d\n", sd->index, fd);
+ }
+ 
++static void
++storeSwapLogDataFree(void *s)
++{
++    memFree(s, MEM_SWAP_LOG_DATA);
++}
++
++static void
++storeDiskdWriteSwapLogheader(int fd)
++{
++    storeSwapLogHeader *hdr = memAllocate(MEM_SWAP_LOG_DATA);
++    hdr->op = SWAP_LOG_VERSION;
++    hdr->version = 1;
++    hdr->record_size = sizeof(storeSwapLogData);
++    /* The header size is a full log record to keep some level of backward
++     * compatibility even if the actual header is smaller
++     */
++    file_write(fd,
++	-1,
++	hdr,
++	sizeof(storeSwapLogData),
++	NULL,
++	NULL,
++	(FREE *) storeSwapLogDataFree);
++}
++
+ static FILE *
+ storeDiskdDirOpenTmpSwapLog(SwapDir * sd, int *clean_flag, int *zero_flag)
+ {
+@@ -1103,6 +1394,7 @@
+ 	fatal("storeDirOpenTmpSwapLog: Failed to open swap log.");
+     }
+     diskdinfo->swaplog_fd = fd;
++    storeDiskdWriteSwapLogheader(fd);
+     /* open a read-only stream of the old log */
+     fp = fopen(swaplog_path, "r");
+     if (fp == NULL) {
+@@ -1128,7 +1420,7 @@
+     char *new;
+     char *cln;
+     char *outbuf;
+-    off_t outbuf_offset;
++    int outbuf_offset;
+     int fd;
+     RemovalPolicyWalker *walker;
+ };
+@@ -1165,6 +1457,7 @@
+     }
+     debug(20, 3) ("storeDirWriteCleanLogs: opened %s, FD %d\n",
+ 	state->new, state->fd);
++    storeDiskdWriteSwapLogheader(state->fd);
+ #if HAVE_FCHMOD
+     if (stat(state->cur, &sb) == 0)
+ 	fchmod(state->fd, sb.st_mode);
+@@ -1282,12 +1575,6 @@
+ }
+ 
+ static void
+-storeSwapLogDataFree(void *s)
+-{
+-    memFree(s, MEM_SWAP_LOG_DATA);
+-}
+-
+-static void
+ storeDiskdDirSwapLog(const SwapDir * sd, const StoreEntry * e, int op)
+ {
+     diskdinfo_t *diskdinfo = sd->fsdata;
+@@ -1636,7 +1923,7 @@
+  */
+ 
+ void *
+-storeDiskdShmGet(SwapDir * sd, off_t * shm_offset)
++storeDiskdShmGet(SwapDir * sd, int *shm_offset)
+ {
+     char *buf = NULL;
+     diskdinfo_t *diskdinfo = sd->fsdata;
+@@ -1659,7 +1946,7 @@
+ }
+ 
+ void
+-storeDiskdShmPut(SwapDir * sd, off_t offset)
++storeDiskdShmPut(SwapDir * sd, int offset)
+ {
+     int i;
+     diskdinfo_t *diskdinfo = sd->fsdata;
+diff -urNad squid-2.5.9/src/fs/diskd/store_diskd.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/store_diskd.h
+--- squid-2.5.9/src/fs/diskd/store_diskd.h	2005-04-21 01:24:41.286120834 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/store_diskd.h	2005-04-21 01:24:50.341695974 +0200
+@@ -59,7 +59,7 @@
+     int seq_no;
+     void *callback_data;
+     int size;
+-    int offset;
++    off_t offset;
+     int status;
+     int shm_offset;
+ } diomsg;
+@@ -95,8 +95,8 @@
+ extern void storeDiskdDirUnlinkFile(SwapDir *, sfileno);
+ extern void storeDiskdDirReplAdd(SwapDir *, StoreEntry *);
+ extern void storeDiskdDirReplRemove(StoreEntry *);
+-extern void storeDiskdShmPut(SwapDir *, off_t);
+-extern void *storeDiskdShmGet(SwapDir *, off_t *);
++extern void storeDiskdShmPut(SwapDir *, int);
++extern void *storeDiskdShmGet(SwapDir *, int *);
+ extern void storeDiskdHandle(diomsg * M);
+ extern int storeDiskdDirCallback(SwapDir *);
+ 
+diff -urNad squid-2.5.9/src/fs/diskd/store_io_diskd.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/store_io_diskd.c
+--- squid-2.5.9/src/fs/diskd/store_io_diskd.c	2005-04-21 01:24:41.306117639 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/diskd/store_io_diskd.c	2005-04-21 01:24:50.345697462 +0200
+@@ -42,7 +42,7 @@
+ 
+ #include "store_diskd.h"
+ 
+-static int storeDiskdSend(int, SwapDir *, int, storeIOState *, int, int, off_t);
++static int storeDiskdSend(int, SwapDir *, int, storeIOState *, int, off_t, int);
+ static void storeDiskdIOCallback(storeIOState * sio, int errflag);
+ static CBDUNL storeDiskdIOFreeEntry;
+ 
+@@ -59,7 +59,7 @@
+     storeIOState *sio;
+     char *buf;
+     diskdstate_t *diskdstate;
+-    off_t shm_offset;
++    int shm_offset;
+     diskdinfo_t *diskdinfo = SD->fsdata;
+     debug(79, 3) ("storeDiskdOpen: fileno %08X\n", f);
+     /*
+@@ -115,7 +115,7 @@
+     int x;
+     storeIOState *sio;
+     char *buf;
+-    off_t shm_offset;
++    int shm_offset;
+     diskdinfo_t *diskdinfo = SD->fsdata;
+     diskdstate_t *diskdstate;
+     /*
+@@ -191,10 +191,10 @@
+ }
+ 
+ void
+-storeDiskdRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, STRCB * callback, void *callback_data)
++storeDiskdRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, STRCB * callback, void *callback_data)
+ {
+     int x;
+-    off_t shm_offset;
++    int shm_offset;
+     char *rbuf;
+     diskdstate_t *diskdstate = sio->fsstate;
+     debug(79, 3) ("storeDiskdRead: dirno %d, fileno %08X\n", sio->swap_dirn, sio->swap_filen);
+@@ -219,8 +219,8 @@
+ 	SD,
+ 	diskdstate->id,
+ 	sio,
+-	(int) size,
+-	(int) offset,
++	size,
++	(off_t) offset,
+ 	shm_offset);
+     if (x < 0) {
+ 	debug(79, 1) ("storeDiskdSend READ: %s\n", xstrerror());
+@@ -231,11 +231,11 @@
+ }
+ 
+ void
+-storeDiskdWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, FREE * free_func)
++storeDiskdWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, FREE * free_func)
+ {
+     int x;
+     char *sbuf;
+-    off_t shm_offset;
++    int shm_offset;
+     diskdstate_t *diskdstate = sio->fsstate;
+     debug(79, 3) ("storeDiskdWrite: dirno %d, fileno %08X\n", SD->index, sio->swap_filen);
+     assert(!diskdstate->flags.close_request);
+@@ -252,8 +252,8 @@
+ 	SD,
+ 	diskdstate->id,
+ 	sio,
+-	(int) size,
+-	(int) offset,
++	size,
++	(off_t) offset,
+ 	shm_offset);
+     if (x < 0) {
+ 	debug(79, 1) ("storeDiskdSend WRITE: %s\n", xstrerror());
+@@ -267,7 +267,7 @@
+ storeDiskdUnlink(SwapDir * SD, StoreEntry * e)
+ {
+     int x;
+-    off_t shm_offset;
++    int shm_offset;
+     char *buf;
+     diskdinfo_t *diskdinfo = SD->fsdata;
+ 
+@@ -462,7 +462,7 @@
+ }
+ 
+ static int
+-storeDiskdSend(int mtype, SwapDir * sd, int id, storeIOState * sio, int size, int offset, off_t shm_offset)
++storeDiskdSend(int mtype, SwapDir * sd, int id, storeIOState * sio, int size, off_t offset, int shm_offset)
+ {
+     int x;
+     diomsg M;
+diff -urNad squid-2.5.9/src/fs/ufs/store_dir_ufs.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/ufs/store_dir_ufs.c
+--- squid-2.5.9/src/fs/ufs/store_dir_ufs.c	2005-04-21 01:24:41.357109492 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/ufs/store_dir_ufs.c	2005-04-21 01:24:50.354700810 +0200
+@@ -80,7 +80,7 @@
+ static int storeUfsDirGetNextFile(RebuildState *, sfileno *, int *size);
+ static StoreEntry *storeUfsDirAddDiskRestore(SwapDir * SD, const cache_key * key,
+     int file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -373,6 +373,24 @@
+ }
+ 
+ static void
++storeUfsDirRebuildComplete(RebuildState * rb)
++{
++    if (rb->log) {
++	debug(47, 1) ("Done reading %s swaplog (%d entries)\n",
++	    rb->sd->path, rb->n_read);
++	fclose(rb->log);
++	rb->log = NULL;
++    } else {
++	debug(47, 1) ("Done scanning %s (%d entries)\n",
++	    rb->sd->path, rb->counts.scancount);
++    }
++    store_dirs_rebuilding--;
++    storeUfsDirCloseTmpSwapLog(rb->sd);
++    storeRebuildComplete(&rb->counts);
++    cbdataFree(rb);
++}
++
++static void
+ storeUfsDirRebuildFromDirectory(void *data)
+ {
+     RebuildState *rb = data;
+@@ -395,12 +413,7 @@
+ 	assert(fd == -1);
+ 	fd = storeUfsDirGetNextFile(rb, &filn, &size);
+ 	if (fd == -2) {
+-	    debug(47, 1) ("Done scanning %s swaplog (%d entries)\n",
+-		rb->sd->path, rb->n_read);
+-	    store_dirs_rebuilding--;
+-	    storeUfsDirCloseTmpSwapLog(rb->sd);
+-	    storeRebuildComplete(&rb->counts);
+-	    cbdataFree(rb);
++	    storeUfsDirRebuildComplete(rb);
+ 	    return;
+ 	} else if (fd < 0) {
+ 	    continue;
+@@ -452,10 +465,39 @@
+ 		assert(t->length == MD5_DIGEST_CHARS);
+ 		xmemcpy(key, t->value, MD5_DIGEST_CHARS);
+ 		break;
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+ 	    case STORE_META_STD:
+ 		assert(t->length == STORE_HDR_METASIZE);
+ 		xmemcpy(&tmpe.timestamp, t->value, STORE_HDR_METASIZE);
+ 		break;
++#else
++	    case STORE_META_STD_LFS:
++		assert(t->length == STORE_HDR_METASIZE);
++		xmemcpy(&tmpe.timestamp, t->value, STORE_HDR_METASIZE);
++		break;
++	    case STORE_META_STD:
++		assert(t->length == STORE_HDR_METASIZE_OLD);
++		{
++		    struct {
++			time_t timestamp;
++			time_t lastref;
++			time_t expires;
++			time_t lastmod;
++			size_t swap_file_sz;
++			u_short refcount;
++			u_short flags;
++		    }     *tmp = t->value;
++		    assert(sizeof(*tmp) == STORE_HDR_METASIZE_OLD);
++		    tmpe.timestamp = tmp->timestamp;
++		    tmpe.lastref = tmp->lastref;
++		    tmpe.expires = tmp->expires;
++		    tmpe.lastmod = tmp->lastmod;
++		    tmpe.swap_file_sz = tmp->swap_file_sz;
++		    tmpe.refcount = tmp->refcount;
++		    tmpe.flags = tmp->flags;
++		}
++		break;
++#endif
+ 	    default:
+ 		break;
+ 	    }
+@@ -529,21 +571,178 @@
+     /* load a number of objects per invocation */
+     for (count = 0; count < rb->speed; count++) {
+ 	if (fread(&s, ss, 1, rb->log) != 1) {
+-	    debug(47, 1) ("Done reading %s swaplog (%d entries)\n",
+-		rb->sd->path, rb->n_read);
+-	    fclose(rb->log);
+-	    rb->log = NULL;
+-	    store_dirs_rebuilding--;
+-	    storeUfsDirCloseTmpSwapLog(rb->sd);
+-	    storeRebuildComplete(&rb->counts);
+-	    cbdataFree(rb);
++	    storeUfsDirRebuildComplete(rb);
+ 	    return;
+ 	}
+ 	rb->n_read++;
+-	if (s.op <= SWAP_LOG_NOP)
++	/*
++	 * BC: during 2.4 development, we changed the way swap file
++	 * numbers are assigned and stored.  The high 16 bits used
++	 * to encode the SD index number.  There used to be a call
++	 * to storeDirProperFileno here that re-assigned the index 
++	 * bits.  Now, for backwards compatibility, we just need
++	 * to mask it off.
++	 */
++	s.swap_filen &= 0x00FFFFFF;
++	debug(47, 3) ("storeUfsDirRebuildFromSwapLog: %s %s %08X\n",
++	    swap_log_op_str[(int) s.op],
++	    storeKeyText(s.key),
++	    s.swap_filen);
++	if (s.op == SWAP_LOG_ADD) {
++	    (void) 0;
++	} else if (s.op == SWAP_LOG_DEL) {
++	    /* Delete unless we already have a newer copy */
++	    if ((e = storeGet(s.key)) != NULL && s.lastref > e->lastref) {
++		/*
++		 * Make sure we don't unlink the file, it might be
++		 * in use by a subsequent entry.  Also note that
++		 * we don't have to subtract from store_swap_size
++		 * because adding to store_swap_size happens in
++		 * the cleanup procedure.
++		 */
++		storeExpireNow(e);
++		storeReleaseRequest(e);
++		if (e->swap_filen > -1) {
++		    storeUfsDirReplRemove(e);
++		    storeUfsDirMapBitReset(SD, e->swap_filen);
++		    e->swap_filen = -1;
++		    e->swap_dirn = -1;
++		}
++		storeRelease(e);
++		rb->counts.objcount--;
++		rb->counts.cancelcount++;
++	    }
+ 	    continue;
+-	if (s.op >= SWAP_LOG_MAX)
++	} else {
++	    x = log(++rb->counts.bad_log_op) / log(10.0);
++	    if (0.0 == x - (double) (int) x)
++		debug(47, 1) ("WARNING: %d invalid swap log entries found\n",
++		    rb->counts.bad_log_op);
++	    rb->counts.invalid++;
++	    continue;
++	}
++	if ((++rb->counts.scancount & 0xFFF) == 0) {
++	    struct stat sb;
++	    if (0 == fstat(fileno(rb->log), &sb))
++		storeRebuildProgress(SD->index,
++		    (int) sb.st_size / ss, rb->n_read);
++	}
++	if (!storeUfsDirValidFileno(SD, s.swap_filen, 0)) {
++	    rb->counts.invalid++;
++	    continue;
++	}
++	if (EBIT_TEST(s.flags, KEY_PRIVATE)) {
++	    rb->counts.badflags++;
++	    continue;
++	}
++	e = storeGet(s.key);
++	used = storeUfsDirMapBitTest(SD, s.swap_filen);
++	/* If this URL already exists in the cache, does the swap log
++	 * appear to have a newer entry?  Compare 'lastref' from the
++	 * swap log to e->lastref. */
++	disk_entry_newer = e ? (s.lastref > e->lastref ? 1 : 0) : 0;
++	if (used && !disk_entry_newer) {
++	    /* log entry is old, ignore it */
++	    rb->counts.clashcount++;
++	    continue;
++	} else if (used && e && e->swap_filen == s.swap_filen && e->swap_dirn == SD->index) {
++	    /* swapfile taken, same URL, newer, update meta */
++	    if (e->store_status == STORE_OK) {
++		e->lastref = s.timestamp;
++		e->timestamp = s.timestamp;
++		e->expires = s.expires;
++		e->lastmod = s.lastmod;
++		e->flags = s.flags;
++		e->refcount += s.refcount;
++		storeUfsDirUnrefObj(SD, e);
++	    } else {
++		debug_trap("storeUfsDirRebuildFromSwapLog: bad condition");
++		debug(47, 1) ("\tSee %s:%d\n", __FILE__, __LINE__);
++	    }
++	    continue;
++	} else if (used) {
++	    /* swapfile in use, not by this URL, log entry is newer */
++	    /* This is sorta bad: the log entry should NOT be newer at this
++	     * point.  If the log is dirty, the filesize check should have
++	     * caught this.  If the log is clean, there should never be a
++	     * newer entry. */
++	    debug(47, 1) ("WARNING: newer swaplog entry for dirno %d, fileno %08X\n",
++		SD->index, s.swap_filen);
++	    /* I'm tempted to remove the swapfile here just to be safe,
++	     * but there is a bad race condition in the NOVM version if
++	     * the swapfile has recently been opened for writing, but
++	     * not yet opened for reading.  Because we can't map
++	     * swapfiles back to StoreEntrys, we don't know the state
++	     * of the entry using that file.  */
++	    /* We'll assume the existing entry is valid, probably because
++	     * were in a slow rebuild and the the swap file number got taken
++	     * and the validation procedure hasn't run. */
++	    assert(rb->flags.need_to_validate);
++	    rb->counts.clashcount++;
++	    continue;
++	} else if (e && !disk_entry_newer) {
++	    /* key already exists, current entry is newer */
++	    /* keep old, ignore new */
++	    rb->counts.dupcount++;
+ 	    continue;
++	} else if (e) {
++	    /* key already exists, this swapfile not being used */
++	    /* junk old, load new */
++	    storeExpireNow(e);
++	    storeReleaseRequest(e);
++	    if (e->swap_filen > -1) {
++		storeUfsDirReplRemove(e);
++		/* Make sure we don't actually unlink the file */
++		storeUfsDirMapBitReset(SD, e->swap_filen);
++		e->swap_filen = -1;
++		e->swap_dirn = -1;
++	    }
++	    storeRelease(e);
++	    rb->counts.dupcount++;
++	} else {
++	    /* URL doesnt exist, swapfile not in use */
++	    /* load new */
++	    (void) 0;
++	}
++	/* update store_swap_size */
++	rb->counts.objcount++;
++	e = storeUfsDirAddDiskRestore(SD, s.key,
++	    s.swap_filen,
++	    s.swap_file_sz,
++	    s.expires,
++	    s.timestamp,
++	    s.lastref,
++	    s.lastmod,
++	    s.refcount,
++	    s.flags,
++	    (int) rb->flags.clean);
++	storeDirSwapLog(e, SWAP_LOG_ADD);
++    }
++    eventAdd("storeRebuild", storeUfsDirRebuildFromSwapLog, rb, 0.0, 1);
++}
++
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++/* This is an exact copy of the above, but using storeSwapLogDataOld entry type */
++static void
++storeUfsDirRebuildFromSwapLogOld(void *data)
++{
++    RebuildState *rb = data;
++    SwapDir *SD = rb->sd;
++    StoreEntry *e = NULL;
++    storeSwapLogDataOld s;
++    size_t ss = sizeof(storeSwapLogDataOld);
++    int count;
++    int used;			/* is swapfile already in use? */
++    int disk_entry_newer;	/* is the log entry newer than current entry? */
++    double x;
++    assert(rb != NULL);
++    /* load a number of objects per invocation */
++    for (count = 0; count < rb->speed; count++) {
++	if (fread(&s, ss, 1, rb->log) != 1) {
++	    storeUfsDirRebuildComplete(rb);
++	    return;
++	}
++	rb->n_read++;
+ 	/*
+ 	 * BC: during 2.4 development, we changed the way swap file
+ 	 * numbers are assigned and stored.  The high 16 bits used
+@@ -687,7 +886,49 @@
+ 	    (int) rb->flags.clean);
+ 	storeDirSwapLog(e, SWAP_LOG_ADD);
+     }
++    eventAdd("storeRebuild", storeUfsDirRebuildFromSwapLogOld, rb, 0.0, 1);
++}
++
++#endif
++
++static void
++storeUfsDirRebuildFromSwapLogCheckVersion(void *data)
++{
++    RebuildState *rb = data;
++    storeSwapLogHeader hdr;
++
++    if (fread(&hdr, sizeof(hdr), 1, rb->log) != 1) {
++	storeUfsDirRebuildComplete(rb);
++	return;
++    }
++    if (hdr.op == SWAP_LOG_VERSION) {
++	if (fseek(rb->log, hdr.record_size, SEEK_SET) != 0) {
++	    storeUfsDirRebuildComplete(rb);
++	    return;
++	}
++	if (hdr.version == 1 && hdr.record_size == sizeof(storeSwapLogData)) {
++	    eventAdd("storeRebuild", storeUfsDirRebuildFromSwapLog, rb, 0.0, 1);
++	    return;
++	}
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++	if (hdr.version == 1 && hdr.record_size == sizeof(storeSwapLogDataOld)) {
++	    debug(47, 1) ("storeUfsDirRebuildFromSwapLog: Found current version but without large file support. Upgrading\n");
++	    eventAdd("storeRebuild", storeUfsDirRebuildFromSwapLogOld, rb, 0.0, 1);
++	    return;
++	}
++#endif
++	debug(47, 1) ("storeUfsDirRebuildFromSwapLog: Unsupported swap.state version %d size %d\n",
++	    hdr.version, hdr.record_size);
++	storeUfsDirRebuildComplete(rb);
++	return;
++    }
++    rewind(rb->log);
++    debug(47, 1) ("storeUfsDirRebuildFromSwapLog: Old version detected. Upgrading\n");
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+     eventAdd("storeRebuild", storeUfsDirRebuildFromSwapLog, rb, 0.0, 1);
++#else
++    eventAdd("storeRebuild", storeUfsDirRebuildFromSwapLogOld, rb, 0.0, 1);
++#endif
+ }
+ 
+ static int
+@@ -782,7 +1023,7 @@
+ static StoreEntry *
+ storeUfsDirAddDiskRestore(SwapDir * SD, const cache_key * key,
+     int file_number,
+-    size_t swap_file_sz,
++    squid_file_sz swap_file_sz,
+     time_t expires,
+     time_t timestamp,
+     time_t lastref,
+@@ -845,7 +1086,7 @@
+ 	    fclose(fp);
+ 	func = storeUfsDirRebuildFromDirectory;
+     } else {
+-	func = storeUfsDirRebuildFromSwapLog;
++	func = storeUfsDirRebuildFromSwapLogCheckVersion;
+ 	rb->log = fp;
+ 	rb->flags.clean = (unsigned int) clean;
+     }
+@@ -885,6 +1126,31 @@
+     debug(47, 3) ("Cache Dir #%d log opened on FD %d\n", sd->index, fd);
+ }
+ 
++static void
++storeSwapLogDataFree(void *s)
++{
++    memFree(s, MEM_SWAP_LOG_DATA);
++}
++
++static void
++storeUfsWriteSwapLogheader(int fd)
++{
++    storeSwapLogHeader *hdr = memAllocate(MEM_SWAP_LOG_DATA);
++    hdr->op = SWAP_LOG_VERSION;
++    hdr->version = 1;
++    hdr->record_size = sizeof(storeSwapLogData);
++    /* The header size is a full log record to keep some level of backward
++     * compatibility even if the actual header is smaller
++     */
++    file_write(fd,
++	-1,
++	hdr,
++	sizeof(storeSwapLogData),
++	NULL,
++	NULL,
++	(FREE *) storeSwapLogDataFree);
++}
++
+ static FILE *
+ storeUfsDirOpenTmpSwapLog(SwapDir * sd, int *clean_flag, int *zero_flag)
+ {
+@@ -914,6 +1180,7 @@
+ 	fatal("storeDirOpenTmpSwapLog: Failed to open swap log.");
+     }
+     ufsinfo->swaplog_fd = fd;
++    storeUfsWriteSwapLogheader(fd);
+     /* open a read-only stream of the old log */
+     fp = fopen(swaplog_path, "r");
+     if (fp == NULL) {
+@@ -942,7 +1209,7 @@
+     char *new;
+     char *cln;
+     char *outbuf;
+-    off_t outbuf_offset;
++    int outbuf_offset;
+     int fd;
+     RemovalPolicyWalker *walker;
+ };
+@@ -973,6 +1240,7 @@
+ 	xfree(state);
+ 	return -1;
+     }
++    storeUfsWriteSwapLogheader(state->fd);
+     state->cur = xstrdup(storeUfsDirSwapLogFile(sd, NULL));
+     state->cln = xstrdup(storeUfsDirSwapLogFile(sd, ".last-clean"));
+     state->outbuf = xcalloc(CLEAN_BUF_SZ, 1);
+@@ -1101,12 +1369,6 @@
+ }
+ 
+ static void
+-storeSwapLogDataFree(void *s)
+-{
+-    memFree(s, MEM_SWAP_LOG_DATA);
+-}
+-
+-static void
+ storeUfsDirSwapLog(const SwapDir * sd, const StoreEntry * e, int op)
+ {
+     ufsinfo_t *ufsinfo = (ufsinfo_t *) sd->fsdata;
+diff -urNad squid-2.5.9/src/fs/ufs/store_io_ufs.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/ufs/store_io_ufs.c
+--- squid-2.5.9/src/fs/ufs/store_io_ufs.c	2005-04-21 01:24:41.375106616 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/fs/ufs/store_io_ufs.c	2005-04-21 01:24:50.356701554 +0200
+@@ -150,7 +150,7 @@
+ }
+ 
+ void
+-storeUfsRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, STRCB * callback, void *callback_data)
++storeUfsRead(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, STRCB * callback, void *callback_data)
+ {
+     ufsstate_t *ufsstate = (ufsstate_t *) sio->fsstate;
+ 
+@@ -166,19 +166,19 @@
+     file_read(ufsstate->fd,
+ 	buf,
+ 	size,
+-	offset,
++	(off_t) offset,
+ 	storeUfsReadDone,
+ 	sio);
+ }
+ 
+ void
+-storeUfsWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, off_t offset, FREE * free_func)
++storeUfsWrite(SwapDir * SD, storeIOState * sio, char *buf, size_t size, squid_off_t offset, FREE * free_func)
+ {
+     ufsstate_t *ufsstate = (ufsstate_t *) sio->fsstate;
+     debug(79, 3) ("storeUfsWrite: dirn %d, fileno %08X, FD %d\n", sio->swap_dirn, sio->swap_filen, ufsstate->fd);
+     ufsstate->flags.writing = 1;
+     file_write(ufsstate->fd,
+-	offset,
++	(off_t) offset,
+ 	buf,
+ 	size,
+ 	storeUfsWriteDone,
+@@ -213,7 +213,7 @@
+ 	debug(79, 3) ("storeUfsReadDone: got failure (%d)\n", errflag);
+ 	rlen = -1;
+     } else {
+-	rlen = (ssize_t) len;
++	rlen = len;
+ 	sio->offset += len;
+     }
+     assert(callback);
+@@ -221,7 +221,7 @@
+     sio->read.callback = NULL;
+     sio->read.callback_data = NULL;
+     if (cbdataValid(their_data))
+-	callback(their_data, buf, (size_t) rlen);
++	callback(their_data, buf, rlen);
+     cbdataUnlock(their_data);
+ }
+ 
+diff -urNad squid-2.5.9/src/ftp.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/ftp.c
+--- squid-2.5.9/src/ftp.c	2005-04-21 01:24:41.432097510 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/ftp.c	2005-04-21 01:24:50.366705274 +0200
+@@ -93,14 +93,14 @@
+     int login_att;
+     ftp_state_t state;
+     time_t mdtm;
+-    int size;
++    squid_off_t size;
+     wordlist *pathcomps;
+     char *filepath;
+-    int restart_offset;
+-    int restarted_offset;
++    squid_off_t restart_offset;
++    squid_off_t restarted_offset;
+     int rest_att;
+     char *proxy_host;
+-    size_t list_width;
++    int list_width;
+     wordlist *cwd_message;
+     char *old_request;
+     char *old_reply;
+@@ -110,7 +110,7 @@
+ 	int fd;
+ 	char *buf;
+ 	size_t size;
+-	off_t offset;
++	size_t offset;
+ 	FREE *freefunc;
+ 	wordlist *message;
+ 	char *last_command;
+@@ -121,7 +121,7 @@
+ 	int fd;
+ 	char *buf;
+ 	size_t size;
+-	off_t offset;
++	size_t offset;
+ 	FREE *freefunc;
+ 	char *host;
+ 	u_short port;
+@@ -132,7 +132,7 @@
+ 
+ typedef struct {
+     char type;
+-    int size;
++    squid_off_t size;
+     char *date;
+     char *name;
+     char *showname;
+@@ -537,7 +537,7 @@
+ 		month, day, year);
+ 	if ((t = strstr(buf, tbuf))) {
+ 	    p->type = *tokens[0];
+-	    p->size = atoi(size);
++	    p->size = strto_off_t(size, NULL, 10);
+ 	    p->date = xstrdup(tbuf);
+ 	    if (flags.skip_whitespace) {
+ 		t += strlen(tbuf);
+@@ -566,7 +566,7 @@
+ 	    p->type = 'd';
+ 	} else {
+ 	    p->type = '-';
+-	    p->size = atoi(tokens[2]);
++	    p->size = strto_off_t(tokens[2], NULL, 10);
+ 	}
+ 	snprintf(tbuf, 128, "%s %s", tokens[0], tokens[1]);
+ 	p->date = xstrdup(tbuf);
+@@ -595,7 +595,7 @@
+ 	p->type = 0;
+ 	while (ct && *ct) {
+ 	    time_t t;
+-	    int l = strcspn(ct + 1, ",");
++	    int l = strcspn(ct, ",");
+ 	    char *tmp;
+ 	    if (l < 1)
+ 		goto blank;
+@@ -604,11 +604,11 @@
+ 		p->name = xstrndup(ct + 1, l + 1);
+ 		break;
+ 	    case 's':
+-		p->size = atoi(ct + 1);
++		p->size = strto_off_t(ct + 1, NULL, 10);
+ 		break;
+ 	    case 'm':
+-		t = (time_t) strtol(ct + 1, &tmp, 0);
+-		if (*tmp || (tmp == ct + 1))
++		t = (time_t) strto_off_t(ct + 1, &tmp, 0);
++		if (tmp != ct + l)
+ 		    break;	/* not a valid integer */
+ 		p->date = xstrdup(ctime(&t));
+ 		*(strstr(p->date, "\n")) = '\0';
+@@ -728,8 +728,6 @@
+ 	ftpListPartsFree(&parts);
+ 	return html;
+     }
+-    parts->size += 1023;
+-    parts->size >>= 10;
+     parts->showname = xstrdup(parts->name);
+     if (!Config.Ftp.list_wrap) {
+ 	if (strlen(parts->showname) > width - 1) {
+@@ -771,10 +769,26 @@
+ 	break;
+     case '-':
+     default:
+-	snprintf(icon, 2048, "<IMG border=\"0\" SRC=\"%s\" ALT=\"%-6s\">",
+-	    mimeGetIconURL(parts->name),
+-	    "[FILE]");
+-	snprintf(size, 2048, " %6dk", parts->size);
++	{
++	    squid_off_t sz = parts->size;
++	    char units = ' ';
++	    snprintf(icon, 2048, "<IMG border=\"0\" SRC=\"%s\" ALT=\"%-6s\">",
++		mimeGetIconURL(parts->name),
++		"[FILE]");
++	    if (sz > 10 * 1024) {
++		sz = (sz + 1023) >> 10;
++		units = 'K';
++	    }
++	    if (sz > 10 * 1024) {
++		sz = (sz + 1023) >> 10;
++		units = 'M';
++	    }
++	    if (sz > 10 * 1024) {
++		sz = (sz + 1023) >> 10;
++		units = 'G';
++	    }
++	    snprintf(size, 2048, " %6" PRINTF_OFF_T "%c", sz, units);
++	}
+ 	break;
+     }
+     if (parts->type != 'd') {
+@@ -818,7 +832,7 @@
+     size_t linelen;
+     size_t usable;
+     StoreEntry *e = ftpState->entry;
+-    int len = ftpState->data.offset;
++    size_t len = ftpState->data.offset;
+     /*
+      * We need a NULL-terminated buffer for scanning, ick
+      */
+@@ -834,7 +848,7 @@
+ 	xfree(sbuf);
+ 	return;
+     }
+-    debug(9, 3) ("ftpParseListing: %d bytes to play with\n", len);
++    debug(9, 3) ("ftpParseListing: %d bytes to play with\n", (int) len);
+     line = memAllocate(MEM_4K_BUF);
+     end++;
+     storeBuffer(e);
+@@ -1224,8 +1238,8 @@
+     wordlist *head = NULL;
+     wordlist *list;
+     wordlist **tail = &head;
+-    off_t offset;
+-    size_t linelen;
++    int offset;
++    int linelen;
+     int code = -1;
+     debug(9, 5) ("ftpParseControlReply\n");
+     /*
+@@ -1648,6 +1662,7 @@
+ 	debug(9, 3) ("Directory path did not end in /\n");
+ 	strCat(ftpState->title_url, "/");
+ 	ftpState->flags.isdir = 1;
++	ftpState->flags.use_base = 1;
+     }
+     ftpSendPasv(ftpState);
+ }
+@@ -1698,7 +1713,7 @@
+     debug(9, 3) ("This is ftpReadSize\n");
+     if (code == 213) {
+ 	ftpUnhack(ftpState);
+-	ftpState->size = atoi(ftpState->ctrl.last_reply);
++	ftpState->size = strto_off_t(ftpState->ctrl.last_reply, NULL, 10);
+ 	if (ftpState->size == 0) {
+ 	    debug(9, 2) ("ftpReadSize: SIZE reported %s on %s\n",
+ 		ftpState->ctrl.last_reply,
+@@ -1800,16 +1815,10 @@
+     /*  227 Entering Passive Mode (h1,h2,h3,h4,p1,p2).  */
+     /*  ANSI sez [^0-9] is undefined, it breaks on Watcom cc */
+     debug(9, 5) ("scanning: %s\n", ftpState->ctrl.last_reply);
+-    buf = strstr(ftpState->ctrl.last_reply, "(");
+-    if (!buf) {
+-	debug(9, 1) ("Unsafe PASV reply from %s: '%s'\n", fd_table[ftpState->ctrl.fd].ipaddr, ftpState->ctrl.last_reply);
+-	ftpSendPort(ftpState);
+-	return;
+-    }
+-    buf++;			/* skip ( */
++    buf = ftpState->ctrl.last_reply + strcspn(ftpState->ctrl.last_reply, "0123456789");
+     n = sscanf(buf, "%d,%d,%d,%d,%d,%d", &h1, &h2, &h3, &h4, &p1, &p2);
+     if (n != 6 || p1 < 0 || p2 < 0 || p1 > 255 || p2 > 255) {
+-	debug(9, 1) ("Unsafe PASV reply from %s: %s\n", fd_table[ftpState->ctrl.fd].ipaddr, ftpState->ctrl.last_reply);
++	debug(9, 1) ("Odd PASV reply from %s: %s\n", fd_table[ftpState->ctrl.fd].ipaddr, ftpState->ctrl.last_reply);
+ 	ftpSendPort(ftpState);
+ 	return;
+     }
+@@ -1826,23 +1835,21 @@
+ 	return;
+     }
+     if (Config.Ftp.sanitycheck) {
+-	if (strcmp(fd_table[ftpState->ctrl.fd].ipaddr, ipaddr) != 0) {
+-	    debug(9, 1) ("Unsafe PASV reply from %s: %s\n", fd_table[ftpState->ctrl.fd].ipaddr, ftpState->ctrl.last_reply);
+-	    ftpSendPort(ftpState);
+-	    return;
+-	}
+ 	if (port < 1024) {
+ 	    debug(9, 1) ("Unsafe PASV reply from %s: %s\n", fd_table[ftpState->ctrl.fd].ipaddr, ftpState->ctrl.last_reply);
+ 	    ftpSendPort(ftpState);
+ 	    return;
+ 	}
+     }
+-    debug(9, 5) ("ftpReadPasv: connecting to %s, port %d\n", ipaddr, port);
+     ftpState->data.port = port;
+-    ftpState->data.host = xstrdup(ipaddr);
++    if (Config.Ftp.sanitycheck)
++	ftpState->data.host = xstrdup(fd_table[ftpState->ctrl.fd].ipaddr);
++    else
++	ftpState->data.host = xstrdup(ipaddr);
+     safe_free(ftpState->ctrl.last_command);
+     safe_free(ftpState->ctrl.last_reply);
+     ftpState->ctrl.last_command = xstrdup("Connect to server data port");
++    debug(9, 5) ("ftpReadPasv: connecting to %s, port %d\n", ftpState->data.host, ftpState->data.port);
+     commConnectStart(fd, ipaddr, port, ftpPasvCallback, ftpState);
+ }
+ 
+@@ -2036,7 +2043,7 @@
+ 	snprintf(cbuf, 1024, "STOR %s\r\n", ftpState->filepath);
+ 	ftpWriteCommand(cbuf, ftpState);
+ 	ftpState->state = SENT_STOR;
+-    } else if (httpHeaderGetInt(&ftpState->request->header, HDR_CONTENT_LENGTH) > 0) {
++    } else if (httpHeaderGetSize(&ftpState->request->header, HDR_CONTENT_LENGTH) > 0) {
+ 	/* File upload without a filename. use STOU to generate one */
+ 	snprintf(cbuf, 1024, "STOU\r\n");
+ 	ftpWriteCommand(cbuf, ftpState);
+@@ -2086,7 +2093,7 @@
+ static void
+ ftpSendRest(FtpStateData * ftpState)
+ {
+-    snprintf(cbuf, 1024, "REST %d\r\n", ftpState->restart_offset);
++    snprintf(cbuf, 1024, "REST %" PRINTF_OFF_T "\r\n", ftpState->restart_offset);
+     ftpWriteCommand(cbuf, ftpState);
+     ftpState->state = SENT_REST;
+ }
+@@ -2131,7 +2138,6 @@
+ ftpSendList(FtpStateData * ftpState)
+ {
+     if (ftpState->filepath) {
+-	ftpState->flags.use_base = 1;
+ 	snprintf(cbuf, 1024, "LIST %s\r\n", ftpState->filepath);
+     } else {
+ 	snprintf(cbuf, 1024, "LIST\r\n");
+diff -urNad squid-2.5.9/src/globals.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/globals.h
+--- squid-2.5.9/src/globals.h	2005-04-21 01:24:41.452094315 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/globals.h	2005-04-21 01:24:50.368706018 +0200
+@@ -154,7 +154,7 @@
+ extern int store_swap_low;	/* 0 */
+ extern int store_swap_high;	/* 0 */
+ extern int store_pages_max;	/* 0 */
+-extern ssize_t store_maxobjsize;	/* -1 */
++extern squid_off_t store_maxobjsize;	/* -1 */
+ extern RemovalPolicy *mem_policy;
+ extern hash_table *proxy_auth_username_cache;	/* NULL */
+ extern int incoming_sockets_accepted;
+diff -urNad squid-2.5.9/src/helper.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/helper.c
+--- squid-2.5.9/src/helper.c	2005-04-21 01:24:41.478090162 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/helper.c	2005-04-21 01:24:50.371707134 +0200
+@@ -374,7 +374,7 @@
+ 	    srv->flags.closing ? 'C' : ' ',
+ 	    srv->flags.shutdown ? 'S' : ' ',
+ 	    tt < 0.0 ? 0.0 : tt,
+-	    (int) srv->offset,
++	    srv->offset,
+ 	    srv->request ? log_quote(srv->request->buf) : "(none)");
+     }
+     storeAppendPrintf(sentry, "\nFlags key:\n\n");
+@@ -423,7 +423,7 @@
+ 	    srv->flags.reserved ? 'R' : ' ',
+ 	    srv->flags.shutdown ? 'S' : ' ',
+ 	    tt < 0.0 ? 0.0 : tt,
+-	    (int) srv->offset,
++	    srv->offset,
+ 	    srv->request ? log_quote(srv->request->buf) : "(none)");
+     }
+     storeAppendPrintf(sentry, "\nFlags key:\n\n");
+diff -urNad squid-2.5.9/src/htcp.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/htcp.c
+--- squid-2.5.9/src/htcp.c	2005-04-21 01:24:41.504086008 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/htcp.c	2005-04-21 01:24:50.374708250 +0200
+@@ -227,14 +227,14 @@
+ {
+     u_short length;
+     size_t len;
+-    off_t off = 0;
++    int off = 0;
+     if (buflen - off < 2)
+ 	return -1;
+     if (s)
+ 	len = strlen(s);
+     else
+ 	len = 0;
+-    debug(31, 3) ("htcpBuildCountstr: LENGTH = %d\n", len);
++    debug(31, 3) ("htcpBuildCountstr: LENGTH = %d\n", (int) len);
+     debug(31, 3) ("htcpBuildCountstr: TEXT = {%s}\n", s ? s : "<NULL>");
+     length = htons((u_short) len);
+     xmemcpy(buf + off, &length, 2);
+diff -urNad squid-2.5.9/src/http.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/http.c
+--- squid-2.5.9/src/http.c	2005-04-21 01:24:41.538080576 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/http.c	2005-04-21 01:24:50.378709738 +0200
+@@ -528,9 +528,9 @@
+     /* return 1 if we got the last of the data on a persistent connection */
+     MemObject *mem = httpState->entry->mem_obj;
+     HttpReply *reply = mem->reply;
+-    int clen;
++    squid_off_t clen;
+     debug(11, 3) ("httpPconnTransferDone: FD %d\n", httpState->fd);
+-    debug(11, 5) ("httpPconnTransferDone: content_length=%d\n",
++    debug(11, 5) ("httpPconnTransferDone: content_length=%" PRINTF_OFF_T "\n",
+ 	reply->content_length);
+     /* If we haven't seen the end of reply headers, we are not done */
+     if (httpState->reply_hdr_state < 2)
+@@ -1059,7 +1059,7 @@
+ 
+ /* build request prefix and append it to a given MemBuf; 
+  * return the length of the prefix */
+-mb_size_t
++int
+ httpBuildRequestPrefix(request_t * request,
+     request_t * orig_request,
+     StoreEntry * entry,
+diff -urNad squid-2.5.9/src/HttpHdrContRange.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHdrContRange.c
+--- squid-2.5.9/src/HttpHdrContRange.c	2005-04-21 01:24:41.553078180 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHdrContRange.c	2005-04-21 01:24:50.380710482 +0200
+@@ -81,7 +81,7 @@
+     p++;
+     /* do we have last-pos ? */
+     if (p - field < flen) {
+-	ssize_t last_pos;
++	squid_off_t last_pos;
+ 	if (!httpHeaderParseSize(p, &last_pos))
+ 	    return 0;
+ 	spec->length = size_diff(last_pos + 1, spec->offset);
+@@ -101,8 +101,8 @@
+     if (!known_spec(spec->offset) || !known_spec(spec->length))
+ 	packerPrintf(p, "*");
+     else
+-	packerPrintf(p, "bytes %ld-%ld",
+-	    (long int) spec->offset, (long int) spec->offset + spec->length - 1);
++	packerPrintf(p, "bytes %" PRINTF_OFF_T "-%" PRINTF_OFF_T "",
++	    spec->offset, spec->offset + spec->length - 1);
+ }
+ 
+ /*
+@@ -152,9 +152,9 @@
+ 	range->elength = range_spec_unknown;
+     else if (!httpHeaderParseSize(p, &range->elength))
+ 	return 0;
+-    debug(68, 8) ("parsed content-range field: %ld-%ld / %ld\n",
+-	(long int) range->spec.offset, (long int) range->spec.offset + range->spec.length - 1,
+-	(long int) range->elength);
++    debug(68, 8) ("parsed content-range field: %" PRINTF_OFF_T "-%" PRINTF_OFF_T " / %" PRINTF_OFF_T "\n",
++	range->spec.offset, range->spec.offset + range->spec.length - 1,
++	range->elength);
+     return 1;
+ }
+ 
+@@ -187,7 +187,7 @@
+ }
+ 
+ void
+-httpHdrContRangeSet(HttpHdrContRange * cr, HttpHdrRangeSpec spec, ssize_t ent_len)
++httpHdrContRangeSet(HttpHdrContRange * cr, HttpHdrRangeSpec spec, squid_off_t ent_len)
+ {
+     assert(cr && ent_len >= 0);
+     cr->spec = spec;
+diff -urNad squid-2.5.9/src/HttpHdrRange.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHdrRange.c
+--- squid-2.5.9/src/HttpHdrRange.c	2005-04-21 01:24:41.574074825 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHdrRange.c	2005-04-21 01:24:50.383711598 +0200
+@@ -55,7 +55,7 @@
+ 
+ 
+ /* local constants */
+-#define range_spec_unknown ((ssize_t)-1)
++#define range_spec_unknown ((squid_off_t)-1)
+ 
+ /* local routines */
+ #define known_spec(s) ((s) != range_spec_unknown)
+@@ -102,7 +102,7 @@
+ 	p++;
+ 	/* do we have last-pos ? */
+ 	if (p - field < flen) {
+-	    ssize_t last_pos;
++	    squid_off_t last_pos;
+ 	    if (!httpHeaderParseSize(p, &last_pos))
+ 		return NULL;
+ 	    spec.length = size_diff(last_pos + 1, spec.offset);
+@@ -136,12 +136,12 @@
+ httpHdrRangeSpecPackInto(const HttpHdrRangeSpec * spec, Packer * p)
+ {
+     if (!known_spec(spec->offset))	/* suffix */
+-	packerPrintf(p, "-%ld", (long int) spec->length);
++	packerPrintf(p, "-%" PRINTF_OFF_T, spec->length);
+     else if (!known_spec(spec->length))		/* trailer */
+-	packerPrintf(p, "%ld-", (long int) spec->offset);
++	packerPrintf(p, "%" PRINTF_OFF_T "-", spec->offset);
+     else			/* range */
+-	packerPrintf(p, "%ld-%ld",
+-	    (long int) spec->offset, (long int) spec->offset + spec->length - 1);
++	packerPrintf(p, "%" PRINTF_OFF_T "-%" PRINTF_OFF_T,
++	    spec->offset, spec->offset + spec->length - 1);
+ }
+ 
+ /* fills "absent" positions in range specification based on response body size 
+@@ -151,8 +151,8 @@
+ static int
+ httpHdrRangeSpecCanonize(HttpHdrRangeSpec * spec, size_t clen)
+ {
+-    debug(64, 5) ("httpHdrRangeSpecCanonize: have: [%ld, %ld) len: %ld\n",
+-	(long int) spec->offset, (long int) spec->offset + spec->length, (long int) spec->length);
++    debug(64, 5) ("httpHdrRangeSpecCanonize: have: [%" PRINTF_OFF_T ", %" PRINTF_OFF_T ") len: %" PRINTF_OFF_T "\n",
++	spec->offset, spec->offset + spec->length, spec->length);
+     if (!known_spec(spec->offset))	/* suffix */
+ 	spec->offset = size_diff(clen, spec->length);
+     else if (!known_spec(spec->length))		/* trailer */
+@@ -162,8 +162,8 @@
+     assert(known_spec(spec->offset));
+     spec->length = size_min(size_diff(clen, spec->offset), spec->length);
+     /* check range validity */
+-    debug(64, 5) ("httpHdrRangeSpecCanonize: done: [%ld, %ld) len: %ld\n",
+-	(long int) spec->offset, (long int) spec->offset + (long int) spec->length, (long int) spec->length);
++    debug(64, 5) ("httpHdrRangeSpecCanonize: done: [%" PRINTF_OFF_T ", %" PRINTF_OFF_T ") len: %" PRINTF_OFF_T "\n",
++	spec->offset, spec->offset + spec->length, spec->length);
+     return spec->length > 0;
+ }
+ 
+@@ -303,7 +303,7 @@
+  *   - there is at least one range spec
+  */
+ int
+-httpHdrRangeCanonize(HttpHdrRange * range, ssize_t clen)
++httpHdrRangeCanonize(HttpHdrRange * range, squid_off_t clen)
+ {
+     int i;
+     HttpHdrRangeSpec *spec;
+@@ -415,10 +415,10 @@
+  * Returns lowest known offset in range spec(s), or range_spec_unknown
+  * this is used for size limiting
+  */
+-ssize_t
++squid_off_t
+ httpHdrRangeFirstOffset(const HttpHdrRange * range)
+ {
+-    ssize_t offset = range_spec_unknown;
++    squid_off_t offset = range_spec_unknown;
+     HttpHdrRangePos pos = HttpHdrRangeInitPos;
+     const HttpHdrRangeSpec *spec;
+     assert(range);
+@@ -435,11 +435,11 @@
+  * ranges are combined into one, for example FTP REST.
+  * Use 0 for size if unknown
+  */
+-ssize_t
+-httpHdrRangeLowestOffset(const HttpHdrRange * range, ssize_t size)
++squid_off_t
++httpHdrRangeLowestOffset(const HttpHdrRange * range, squid_off_t size)
+ {
+-    ssize_t offset = range_spec_unknown;
+-    ssize_t current;
++    squid_off_t offset = range_spec_unknown;
++    squid_off_t current;
+     HttpHdrRangePos pos = HttpHdrRangeInitPos;
+     const HttpHdrRangeSpec *spec;
+     assert(range);
+diff -urNad squid-2.5.9/src/HttpHeader.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHeader.c
+--- squid-2.5.9/src/HttpHeader.c	2005-04-21 01:24:41.607069553 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHeader.c	2005-04-21 01:24:50.388713458 +0200
+@@ -80,7 +80,7 @@
+     {"Content-Disposition", HDR_CONTENT_DISPOSITION, ftStr},
+     {"Content-Encoding", HDR_CONTENT_ENCODING, ftStr},
+     {"Content-Language", HDR_CONTENT_LANGUAGE, ftStr},
+-    {"Content-Length", HDR_CONTENT_LENGTH, ftInt},
++    {"Content-Length", HDR_CONTENT_LENGTH, ftSize},
+     {"Content-Location", HDR_CONTENT_LOCATION, ftStr},
+     {"Content-MD5", HDR_CONTENT_MD5, ftStr},	/* for now */
+     {"Content-Range", HDR_CONTENT_RANGE, ftPContRange},
+@@ -807,6 +807,17 @@
+ }
+ 
+ void
++httpHeaderPutSize(HttpHeader * hdr, http_hdr_type id, squid_off_t number)
++{
++    char size[64];
++    assert_eid(id);
++    assert(Headers[id].type == ftSize);		/* must be of an appropriate type */
++    assert(number >= 0);
++    snprintf(size, sizeof(size), "%" PRINTF_OFF_T, number);
++    httpHeaderAddEntry(hdr, httpHeaderEntryCreate(id, NULL, size));
++}
++
++void
+ httpHeaderPutTime(HttpHeader * hdr, http_hdr_type id, time_t htime)
+ {
+     assert_eid(id);
+@@ -912,6 +923,21 @@
+     return value;
+ }
+ 
++squid_off_t
++httpHeaderGetSize(const HttpHeader * hdr, http_hdr_type id)
++{
++    HttpHeaderEntry *e;
++    squid_off_t value = -1;
++    int ok;
++    assert_eid(id);
++    assert(Headers[id].type == ftSize);		/* must be of an appropriate type */
++    if ((e = httpHeaderFindEntry(hdr, id))) {
++	ok = httpHeaderParseSize(strBuf(e->value), &value);
++	httpHeaderNoteParsedEntry(e->id, e->value, !ok);
++    }
++    return value;
++}
++
+ time_t
+ httpHeaderGetTime(const HttpHeader * hdr, http_hdr_type id)
+ {
+diff -urNad squid-2.5.9/src/HttpHeaderTools.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHeaderTools.c
+--- squid-2.5.9/src/HttpHeaderTools.c	2005-04-21 01:24:41.628066199 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpHeaderTools.c	2005-04-21 01:24:50.390714202 +0200
+@@ -138,7 +138,7 @@
+ 
+ /* wrapper arrounf PutContRange */
+ void
+-httpHeaderAddContRange(HttpHeader * hdr, HttpHdrRangeSpec spec, ssize_t ent_len)
++httpHeaderAddContRange(HttpHeader * hdr, HttpHdrRangeSpec spec, squid_off_t ent_len)
+ {
+     HttpHdrContRange *cr = httpHdrContRangeCreate();
+     assert(hdr && ent_len >= 0);
+@@ -316,11 +316,14 @@
+     return 1;
+ }
+ 
+-int
+-httpHeaderParseSize(const char *start, ssize_t * value)
++squid_off_t
++httpHeaderParseSize(const char *start, squid_off_t * value)
+ {
+-    int v;
+-    const int res = httpHeaderParseInt(start, &v);
++    squid_off_t v;
++    char *end;
++    int res;
++    v = strto_off_t(start, &end, 10);
++    res = start != end;
+     assert(value);
+     *value = res ? v : 0;
+     return res;
+diff -urNad squid-2.5.9/src/HttpReply.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpReply.c
+--- squid-2.5.9/src/HttpReply.c	2005-04-21 01:24:41.647063163 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/HttpReply.c	2005-04-21 01:24:50.393715318 +0200
+@@ -135,7 +135,7 @@
+  * returns true on success.
+  */
+ int
+-httpReplyParse(HttpReply * rep, const char *buf, ssize_t end)
++httpReplyParse(HttpReply * rep, const char *buf, size_t end)
+ {
+     /*
+      * this extra buffer/copy will be eliminated when headers become
+@@ -194,9 +194,10 @@
+     packerClean(&p);
+ }
+ 
++#if UNUSED_CODE
+ MemBuf
+ httpPackedReply(http_version_t ver, http_status status, const char *ctype,
+-    int clen, time_t lmt, time_t expires)
++    squid_off_t clen, time_t lmt, time_t expires)
+ {
+     HttpReply *rep = httpReplyCreate();
+     MemBuf mb;
+@@ -205,6 +206,7 @@
+     httpReplyDestroy(rep);
+     return mb;
+ }
++#endif
+ 
+ MemBuf
+ httpPacked304Reply(const HttpReply * rep)
+@@ -230,7 +232,7 @@
+ 
+ void
+ httpReplySetHeaders(HttpReply * reply, http_version_t ver, http_status status, const char *reason,
+-    const char *ctype, int clen, time_t lmt, time_t expires)
++    const char *ctype, squid_off_t clen, time_t lmt, time_t expires)
+ {
+     HttpHeader *hdr;
+     assert(reply);
+@@ -245,7 +247,7 @@
+     } else
+ 	reply->content_type = StringNull;
+     if (clen >= 0)
+-	httpHeaderPutInt(hdr, HDR_CONTENT_LENGTH, clen);
++	httpHeaderPutSize(hdr, HDR_CONTENT_LENGTH, clen);
+     if (expires >= 0)
+ 	httpHeaderPutTime(hdr, HDR_EXPIRES, expires);
+     if (lmt > 0)		/* this used to be lmt != 0 @?@ */
+@@ -267,7 +269,7 @@
+     hdr = &reply->header;
+     httpHeaderPutStr(hdr, HDR_SERVER, full_appname_string);
+     httpHeaderPutTime(hdr, HDR_DATE, squid_curtime);
+-    httpHeaderPutInt(hdr, HDR_CONTENT_LENGTH, 0);
++    httpHeaderPutSize(hdr, HDR_CONTENT_LENGTH, 0);
+     httpHeaderPutStr(hdr, HDR_LOCATION, loc);
+     reply->date = squid_curtime;
+     reply->content_length = 0;
+@@ -342,7 +344,7 @@
+ {
+     const HttpHeader *hdr = &rep->header;
+     const char *str;
+-    rep->content_length = httpHeaderGetInt(hdr, HDR_CONTENT_LENGTH);
++    rep->content_length = httpHeaderGetSize(hdr, HDR_CONTENT_LENGTH);
+     rep->date = httpHeaderGetTime(hdr, HDR_DATE);
+     rep->last_modified = httpHeaderGetTime(hdr, HDR_LAST_MODIFIED);
+     str = httpHeaderGetStr(hdr, HDR_CONTENT_TYPE);
+@@ -449,7 +451,7 @@
+ /*
+  * Returns the body size of a HTTP response
+  */
+-int
++squid_off_t
+ httpReplyBodySize(method_t method, const HttpReply * reply)
+ {
+     if (reply->sline.version.major < 1)
+diff -urNad squid-2.5.9/src/MemBuf.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/MemBuf.c
+--- squid-2.5.9/src/MemBuf.c	2005-04-21 01:24:41.664060447 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/MemBuf.c	2005-04-21 01:24:50.395716062 +0200
+@@ -192,7 +192,7 @@
+ 
+ /* calls memcpy, appends exactly size bytes, extends buffer if needed */
+ void
+-memBufAppend(MemBuf * mb, const char *buf, mb_size_t sz)
++memBufAppend(MemBuf * mb, const char *buf, int sz)
+ {
+     assert(mb && buf && sz >= 0);
+     assert(mb->buf);
+diff -urNad squid-2.5.9/src/MemPool.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/MemPool.c
+--- squid-2.5.9/src/MemPool.c	2005-04-21 01:24:41.683057412 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/MemPool.c	2005-04-21 01:24:50.398717178 +0200
+@@ -46,7 +46,7 @@
+ /* module globals */
+ 
+ /* huge constant to set mem_idle_limit to "unlimited" */
+-static const size_t mem_unlimited_size = 2 * 1024 * MB;
++static const size_t mem_unlimited_size = 2 * 1024 * MB - 1;
+ 
+ /* we cannot keep idle more than this limit */
+ static size_t mem_idle_limit = 0;
+@@ -58,9 +58,9 @@
+ static Stack Pools;
+ 
+ /* local prototypes */
+-static void memShrink(ssize_t new_limit);
++static void memShrink(size_t new_limit);
+ static void memPoolDescribe(const MemPool * pool);
+-static void memPoolShrink(MemPool * pool, ssize_t new_limit);
++static void memPoolShrink(MemPool * pool, size_t new_limit);
+ 
+ 
+ static double
+@@ -135,9 +135,9 @@
+ 
+ 
+ static void
+-memShrink(ssize_t new_limit)
++memShrink(size_t new_limit)
+ {
+-    ssize_t start_limit = TheMeter.idle.level;
++    size_t start_limit = TheMeter.idle.level;
+     int i;
+     assert(start_limit >= 0 && new_limit >= 0);
+     debug(63, 1) ("memShrink: started with %ld KB goal: %ld KB\n",
+@@ -145,7 +145,7 @@
+     /* first phase: cut proportionally to the pool idle size */
+     for (i = 0; i < Pools.count && TheMeter.idle.level > new_limit; ++i) {
+ 	MemPool *pool = Pools.items[i];
+-	const ssize_t target_pool_size = (size_t) ((double) pool->meter.idle.level * new_limit) / start_limit;
++	const size_t target_pool_size = (size_t) ((double) pool->meter.idle.level * new_limit) / start_limit;
+ 	memPoolShrink(pool, target_pool_size);
+     }
+     debug(63, 1) ("memShrink: 1st phase done with %ld KB left\n", (long int) toKB(TheMeter.idle.level));
+@@ -276,7 +276,7 @@
+ }
+ 
+ static void
+-memPoolShrink(MemPool * pool, ssize_t new_limit)
++memPoolShrink(MemPool * pool, size_t new_limit)
+ {
+     assert(pool);
+     assert(new_limit >= 0);
+@@ -308,7 +308,7 @@
+ memPoolInUseSize(const MemPool * pool)
+ {
+     assert(pool);
+-    return pool->obj_size * pool->meter.inuse.level;
++    return (pool->obj_size * pool->meter.inuse.level);
+ }
+ 
+ /* to-do: make debug level a parameter? */
+@@ -321,7 +321,7 @@
+ 	(long int) toKB(memPoolInUseSize(pool)));
+ }
+ 
+-size_t
++int
+ memTotalAllocated(void)
+ {
+     return TheMeter.alloc.level;
+diff -urNad squid-2.5.9/src/mime.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/mime.c
+--- squid-2.5.9/src/mime.c	2005-04-21 01:24:41.701054537 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/mime.c	2005-04-21 01:24:50.400717922 +0200
+@@ -442,7 +442,7 @@
+     httpReplyReset(reply = e->mem_obj->reply);
+     httpBuildVersion(&version, 1, 0);
+     httpReplySetHeaders(reply, version, HTTP_OK, NULL,
+-	type, (int) sb.st_size, sb.st_mtime, -1);
++	type, sb.st_size, sb.st_mtime, -1);
+     reply->cache_control = httpHdrCcCreate();
+     httpHdrCcSetMaxAge(reply->cache_control, 86400);
+     httpHeaderPutCc(&reply->header, reply->cache_control);
+diff -urNad squid-2.5.9/src/net_db.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/net_db.c
+--- squid-2.5.9/src/net_db.c	2005-04-21 01:24:41.727050383 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/net_db.c	2005-04-21 01:24:50.403719038 +0200
+@@ -42,8 +42,8 @@
+     StoreEntry *e;
+     store_client *sc;
+     request_t *r;
+-    off_t seen;
+-    off_t used;
++    squid_off_t seen;
++    squid_off_t used;
+     size_t buf_sz;
+     char *buf;
+ } netdbExchangeState;
+@@ -531,7 +531,7 @@
+ {
+     netdbExchangeState *ex = data;
+     int rec_sz = 0;
+-    off_t o;
++    ssize_t o;
+     struct in_addr addr;
+     double rtt;
+     double hops;
+diff -urNad squid-2.5.9/src/Packer.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/Packer.c
+--- squid-2.5.9/src/Packer.c	2005-04-21 01:24:41.741048146 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/Packer.c	2005-04-21 01:24:50.405719782 +0200
+@@ -93,7 +93,7 @@
+ 
+ /* append()'s */
+ static void (*const store_append) (StoreEntry *, const char *, int) = &storeAppend;
+-static void (*const memBuf_append) (MemBuf *, const char *, mb_size_t) = &memBufAppend;
++static void (*const memBuf_append) (MemBuf *, const char *, int) = &memBufAppend;
+ 
+ /* vprintf()'s */
+ static void (*const store_vprintf) (StoreEntry *, const char *, va_list ap) = &storeAppendVPrintf;
+@@ -109,7 +109,7 @@
+     assert(p && e);
+     p->append = (append_f) store_append;
+     p->vprintf = (vprintf_f) store_vprintf;
+-    p->real_handler = e;
++    p->real_handle = e;
+ }
+ 
+ /* init with this to accumulate data in MemBuf */
+@@ -119,7 +119,7 @@
+     assert(p && mb);
+     p->append = (append_f) memBuf_append;
+     p->vprintf = (vprintf_f) memBuf_vprintf;
+-    p->real_handler = mb;
++    p->real_handle = mb;
+ }
+ 
+ /* call this when you are done */
+@@ -130,15 +130,15 @@
+     /* it is not really necessary to do this, but, just in case... */
+     p->append = NULL;
+     p->vprintf = NULL;
+-    p->real_handler = NULL;
++    p->real_handle = NULL;
+ }
+ 
+ void
+ packerAppend(Packer * p, const char *buf, int sz)
+ {
+     assert(p);
+-    assert(p->real_handler && p->append);
+-    p->append(p->real_handler, buf, sz);
++    assert(p->real_handle && p->append);
++    p->append(p->real_handle, buf, sz);
+ }
+ 
+ #if STDC_HEADERS
+@@ -161,7 +161,7 @@
+     fmt = va_arg(args, char *);
+ #endif
+     assert(p);
+-    assert(p->real_handler && p->vprintf);
+-    p->vprintf(p->real_handler, fmt, args);
++    assert(p->real_handle && p->vprintf);
++    p->vprintf(p->real_handle, fmt, args);
+     va_end(args);
+ }
+diff -urNad squid-2.5.9/src/peer_digest.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/peer_digest.c
+--- squid-2.5.9/src/peer_digest.c	2005-04-21 01:24:41.768043833 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/peer_digest.c	2005-04-21 01:24:50.409721270 +0200
+@@ -453,7 +453,7 @@
+     if (size >= StoreDigestCBlockSize) {
+ 	PeerDigest *pd = fetch->pd;
+ 	HttpReply *rep = fetch->entry->mem_obj->reply;
+-	const int seen = fetch->offset + size;
++	const squid_off_t seen = fetch->offset + size;
+ 
+ 	assert(pd && rep);
+ 	if (peerDigestSetCBlock(pd, buf)) {
+@@ -498,7 +498,7 @@
+     fetch->offset += size;
+     fetch->mask_offset += size;
+     if (fetch->mask_offset >= pd->cd->mask_size) {
+-	debug(72, 2) ("peerDigestSwapInMask: Done! Got %d, expected %d\n",
++	debug(72, 2) ("peerDigestSwapInMask: Done! Got %" PRINTF_OFF_T ", expected %d\n",
+ 	    fetch->mask_offset, pd->cd->mask_size);
+ 	assert(fetch->mask_offset == pd->cd->mask_size);
+ 	assert(peerDigestFetchedEnough(fetch, NULL, 0, "peerDigestSwapInMask"));
+@@ -540,8 +540,8 @@
+ 	else
+ 	    host = strBuf(pd->host);
+     }
+-    debug(72, 6) ("%s: peer %s, offset: %d size: %d.\n",
+-	step_name, host, fcb_valid ? fetch->offset : -1, size);
++    debug(72, 6) ("%s: peer %s, offset: %" PRINTF_OFF_T " size: %d.\n",
++	step_name, host, fcb_valid ? fetch->offset : (squid_off_t) - 1, (int) size);
+ 
+     /* continue checking (with pd and host known and valid) */
+     if (!reason) {
+@@ -778,7 +778,7 @@
+     /* check consistency further */
+     if (cblock.mask_size != cacheDigestCalcMaskSize(cblock.capacity, cblock.bits_per_entry)) {
+ 	debug(72, 0) ("%s digest cblock is corrupted (mask size mismatch: %d ? %d).\n",
+-	    host, cblock.mask_size, cacheDigestCalcMaskSize(cblock.capacity, cblock.bits_per_entry));
++	    host, cblock.mask_size, (int) cacheDigestCalcMaskSize(cblock.capacity, cblock.bits_per_entry));
+ 	return 0;
+     }
+     /* there are some things we cannot do yet */
+diff -urNad squid-2.5.9/src/protos.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/protos.h
+--- squid-2.5.9/src/protos.h	2005-04-21 01:24:45.007526246 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/protos.h	2005-04-21 01:24:50.418724618 +0200
+@@ -125,7 +125,7 @@
+ extern int cbdataLocked(const void *p);
+ 
+ extern void clientdbInit(void);
+-extern void clientdbUpdate(struct in_addr, log_type, protocol_t, size_t);
++extern void clientdbUpdate(struct in_addr, log_type, protocol_t, squid_off_t);
+ extern int clientdbCutoffDenied(struct in_addr);
+ extern void clientdbDump(StoreEntry *);
+ extern void clientdbFreeMemory(void);
+@@ -223,24 +223,12 @@
+ /* disk.c */
+ extern int file_open(const char *path, int mode);
+ extern void file_close(int fd);
+-extern void file_write(int, off_t, void *, int len, DWCB *, void *, FREE *);
++extern void file_write(int, off_t, void *, size_t len, DWCB *, void *, FREE *);
+ extern void file_write_mbuf(int fd, off_t, MemBuf mb, DWCB * handler, void *handler_data);
+-extern void file_read(int, char *, int, off_t, DRCB *, void *);
++extern void file_read(int, char *, size_t, off_t, DRCB *, void *);
+ extern void disk_init(void);
+ 
+-/* diskd.c */
+-extern diskd_queue *afile_create_queue(void);
+-extern void afile_destroy_queue(diskd_queue *);
+-extern void afile_sync_queue(diskd_queue *);
+-extern void afile_sync(void);
+-extern void afile_open(const char *path, int mode, DOCB *, void *);
+-extern void afile_close(int fd, DCCB * callback, void *data);
+-extern void afile_write(int, off_t, void *, int len, DWCB *, void *, FREE *);
+-extern void afile_write_mbuf(int fd, off_t, MemBuf, DWCB *, void *);
+-extern void afile_read(int, char *, int, off_t, DRCB *, void *);
+-extern void afile_unlink(const char *path, DUCB *, void *);
+-extern void afile_truncate(const char *path, DTCB *, void *);
+-
++/* dns.s */
+ extern void dnsShutdown(void);
+ extern void dnsInit(void);
+ extern void dnsSubmit(const char *lookup, HLPCB * callback, void *data);
+@@ -303,7 +291,7 @@
+ /* http.c */
+ extern int httpCachable(method_t);
+ extern void httpStart(FwdState *);
+-extern mb_size_t httpBuildRequestPrefix(request_t * request,
++extern int httpBuildRequestPrefix(request_t * request,
+     request_t * orig_request,
+     StoreEntry * entry,
+     MemBuf * mb,
+@@ -371,13 +359,13 @@
+ /* iterate through specs */
+ extern HttpHdrRangeSpec *httpHdrRangeGetSpec(const HttpHdrRange * range, HttpHdrRangePos * pos);
+ /* adjust specs after the length is known */
+-extern int httpHdrRangeCanonize(HttpHdrRange *, ssize_t);
++extern int httpHdrRangeCanonize(HttpHdrRange *, squid_off_t);
+ /* other */
+ extern String httpHdrRangeBoundaryStr(clientHttpRequest * http);
+ extern int httpHdrRangeIsComplex(const HttpHdrRange * range);
+ extern int httpHdrRangeWillBeComplex(const HttpHdrRange * range);
+-extern ssize_t httpHdrRangeFirstOffset(const HttpHdrRange * range);
+-extern ssize_t httpHdrRangeLowestOffset(const HttpHdrRange * range, ssize_t);
++extern squid_off_t httpHdrRangeFirstOffset(const HttpHdrRange * range);
++extern squid_off_t httpHdrRangeLowestOffset(const HttpHdrRange * range, squid_off_t);
+ extern int httpHdrRangeOffsetLimit(HttpHdrRange *);
+ 
+ 
+@@ -390,7 +378,7 @@
+ extern HttpHdrContRange *httpHdrContRangeDup(const HttpHdrContRange * crange);
+ extern void httpHdrContRangePackInto(const HttpHdrContRange * crange, Packer * p);
+ /* inits with given spec */
+-extern void httpHdrContRangeSet(HttpHdrContRange *, HttpHdrRangeSpec, ssize_t);
++extern void httpHdrContRangeSet(HttpHdrContRange *, HttpHdrRangeSpec, squid_off_t);
+ 
+ /* Http Header Tools */
+ extern HttpHeaderFieldInfo *httpHeaderBuildFieldsInfo(const HttpHeaderFieldAttrs * attrs, int count);
+@@ -401,14 +389,14 @@
+ extern void httpHeaderMaskInit(HttpHeaderMask * mask, int value);
+ extern void httpHeaderCalcMask(HttpHeaderMask * mask, const int *enums, int count);
+ extern int httpHeaderHasConnDir(const HttpHeader * hdr, const char *directive);
+-extern void httpHeaderAddContRange(HttpHeader *, HttpHdrRangeSpec, ssize_t);
++extern void httpHeaderAddContRange(HttpHeader *, HttpHdrRangeSpec, squid_off_t);
+ extern void strListAdd(String * str, const char *item, char del);
+ extern int strListIsMember(const String * str, const char *item, char del);
+ extern int strListIsSubstr(const String * list, const char *s, char del);
+ extern int strListGetItem(const String * str, char del, const char **item, int *ilen, const char **pos);
+ extern const char *getStringPrefix(const char *str, const char *end);
+ extern int httpHeaderParseInt(const char *start, int *val);
+-extern int httpHeaderParseSize(const char *start, ssize_t * sz);
++extern squid_off_t httpHeaderParseSize(const char *start, squid_off_t * sz);
+ extern int httpHeaderReset(HttpHeader * hdr);
+ #if STDC_HEADERS
+ extern void
+@@ -433,6 +421,7 @@
+ /* field manipulation */
+ extern int httpHeaderHas(const HttpHeader * hdr, http_hdr_type type);
+ extern void httpHeaderPutInt(HttpHeader * hdr, http_hdr_type type, int number);
++extern void httpHeaderPutSize(HttpHeader * hdr, http_hdr_type type, squid_off_t number);
+ extern void httpHeaderPutTime(HttpHeader * hdr, http_hdr_type type, time_t htime);
+ extern void httpHeaderPutStr(HttpHeader * hdr, http_hdr_type type, const char *str);
+ extern void httpHeaderPutAuth(HttpHeader * hdr, const char *auth_scheme, const char *realm);
+@@ -441,6 +430,7 @@
+ extern void httpHeaderPutRange(HttpHeader * hdr, const HttpHdrRange * range);
+ extern void httpHeaderPutExt(HttpHeader * hdr, const char *name, const char *value);
+ extern int httpHeaderGetInt(const HttpHeader * hdr, http_hdr_type id);
++extern squid_off_t httpHeaderGetSize(const HttpHeader * hdr, http_hdr_type id);
+ extern time_t httpHeaderGetTime(const HttpHeader * hdr, http_hdr_type id);
+ extern TimeOrTag httpHeaderGetTimeOrTag(const HttpHeader * hdr, http_hdr_type id);
+ extern HttpHdrCc *httpHeaderGetCc(const HttpHeader * hdr);
+@@ -482,7 +472,7 @@
+ /* absorb: copy the contents of a new reply to the old one, destroy new one */
+ extern void httpReplyAbsorb(HttpReply * rep, HttpReply * new_rep);
+ /* parse returns -1,0,+1 on error,need-more-data,success */
+-extern int httpReplyParse(HttpReply * rep, const char *buf, ssize_t);
++extern int httpReplyParse(HttpReply * rep, const char *buf, size_t);
+ extern void httpReplyPackInto(const HttpReply * rep, Packer * p);
+ /* ez-routines */
+ /* mem-pack: returns a ready to use mem buffer with a packed reply */
+@@ -491,10 +481,10 @@
+ extern void httpReplySwapOut(const HttpReply * rep, StoreEntry * e);
+ /* set commonly used info with one call */
+ extern void httpReplySetHeaders(HttpReply * rep, http_version_t ver, http_status status,
+-    const char *reason, const char *ctype, int clen, time_t lmt, time_t expires);
++    const char *reason, const char *ctype, squid_off_t clen, time_t lmt, time_t expires);
+ /* do everything in one call: init, set, pack, clean, return MemBuf */
+ extern MemBuf httpPackedReply(http_version_t ver, http_status status, const char *ctype,
+-    int clen, time_t lmt, time_t expires);
++    squid_off_t clen, time_t lmt, time_t expires);
+ /* construct 304 reply and pack it into MemBuf, return MemBuf */
+ extern MemBuf httpPacked304Reply(const HttpReply * rep);
+ /* update when 304 reply is received for a cached object */
+@@ -505,7 +495,7 @@
+ extern time_t httpReplyExpires(const HttpReply * rep);
+ extern int httpReplyHasCc(const HttpReply * rep, http_hdr_cc_type type);
+ extern void httpRedirectReply(HttpReply *, http_status, const char *);
+-extern int httpReplyBodySize(method_t, const HttpReply *);
++extern squid_off_t httpReplyBodySize(method_t, const HttpReply *);
+ 
+ /* Http Request */
+ extern request_t *requestCreate(method_t, protocol_t, const char *urlpath);
+@@ -607,7 +597,7 @@
+ /* unfirtunate hack to test if the buffer has been Init()ialized */
+ extern int memBufIsNull(MemBuf * mb);
+ /* calls memcpy, appends exactly size bytes, extends buffer if needed */
+-extern void memBufAppend(MemBuf * mb, const char *buf, mb_size_t size);
++extern void memBufAppend(MemBuf * mb, const char *buf, int size);
+ /* calls snprintf, extends buffer if needed */
+ #if STDC_HEADERS
+ extern void
+@@ -756,7 +746,7 @@
+ extern int authenticateAuthUserInuse(auth_user_t * auth_user);
+ extern void authenticateAuthUserRequestRemoveIp(auth_user_request_t *, struct in_addr);
+ extern void authenticateAuthUserRequestClearIp(auth_user_request_t *);
+-extern size_t authenticateAuthUserRequestIPCount(auth_user_request_t *);
++extern int authenticateAuthUserRequestIPCount(auth_user_request_t *);
+ extern int authenticateDirection(auth_user_request_t *);
+ extern FREE authenticateFreeProxyAuthUser;
+ extern void authenticateFreeProxyAuthUserACLResults(void *data);
+@@ -788,7 +778,7 @@
+ 
+ 
+ extern void start_announce(void *unused);
+-extern void sslStart(clientHttpRequest *, size_t *, int *);
++extern void sslStart(clientHttpRequest *, squid_off_t *, int *);
+ extern void waisStart(FwdState *);
+ 
+ /* ident.c */
+@@ -851,7 +841,7 @@
+ extern void memFree32K(void *);
+ extern void memFree64K(void *);
+ extern int memInUse(mem_type);
+-extern size_t memTotalAllocated(void);
++extern int memTotalAllocated(void);
+ extern void memDataInit(mem_type, const char *, size_t, int);
+ extern void memCheckInit(void);
+ 
+@@ -869,9 +859,9 @@
+ /* Mem */
+ extern void memReport(StoreEntry * e);
+ 
+-extern int stmemFreeDataUpto(mem_hdr *, int);
++extern squid_off_t stmemFreeDataUpto(mem_hdr *, squid_off_t);
+ extern void stmemAppend(mem_hdr *, const char *, int);
+-extern ssize_t stmemCopy(const mem_hdr *, off_t, char *, size_t);
++extern ssize_t stmemCopy(const mem_hdr *, squid_off_t, char *, size_t);
+ extern void stmemFree(mem_hdr *);
+ extern void stmemFreeData(mem_hdr *);
+ extern void stmemNodeFree(void *);
+@@ -926,8 +916,8 @@
+ extern void storeAppendVPrintf(StoreEntry *, const char *, va_list ap);
+ extern int storeCheckCachable(StoreEntry * e);
+ extern void storeSetPrivateKey(StoreEntry *);
+-extern int objectLen(const StoreEntry * e);
+-extern int contentLen(const StoreEntry * e);
++extern squid_off_t objectLen(const StoreEntry * e);
++extern squid_off_t contentLen(const StoreEntry * e);
+ extern HttpReply *storeEntryReply(StoreEntry *);
+ extern int storeTooManyDiskFilesOpen(void);
+ extern void storeEntryReset(StoreEntry *);
+@@ -948,10 +938,10 @@
+ extern storeIOState *storeCreate(StoreEntry *, STFNCB *, STIOCB *, void *);
+ extern storeIOState *storeOpen(StoreEntry *, STFNCB *, STIOCB *, void *);
+ extern void storeClose(storeIOState *);
+-extern void storeRead(storeIOState *, char *, size_t, off_t, STRCB *, void *);
+-extern void storeWrite(storeIOState *, char *, size_t, off_t, FREE *);
++extern void storeRead(storeIOState *, char *, size_t, squid_off_t, STRCB *, void *);
++extern void storeWrite(storeIOState *, char *, size_t, squid_off_t, FREE *);
+ extern void storeUnlink(StoreEntry *);
+-extern off_t storeOffset(storeIOState *);
++extern squid_off_t storeOffset(storeIOState *);
+ 
+ /*
+  * store_log.c
+@@ -1009,7 +999,7 @@
+ extern void storeDirInit(void);
+ extern void storeDirOpenSwapLogs(void);
+ extern void storeDirSwapLog(const StoreEntry *, int op);
+-extern void storeDirUpdateSwapSize(SwapDir *, size_t size, int sign);
++extern void storeDirUpdateSwapSize(SwapDir *, squid_off_t size, int sign);
+ extern void storeDirSync(void);
+ extern void storeDirCallback(void);
+ extern void storeDirLRUDelete(StoreEntry *);
+@@ -1042,7 +1032,8 @@
+  */
+ extern void storeSwapOut(StoreEntry * e);
+ extern void storeSwapOutFileClose(StoreEntry * e);
+-extern int storeSwapOutAble(const StoreEntry * e);
++extern int /* swapout_able */ storeSwapOutMaintainMemObject(StoreEntry * e);
++extern squid_off_t storeSwapOutObjectBytesOnDisk(const MemObject * mem);
+ 
+ /*
+  * store_client.c
+@@ -1051,10 +1042,10 @@
+ extern store_client *storeClientListSearch(const MemObject * mem, void *data);
+ #endif
+ extern store_client *storeClientListAdd(StoreEntry * e, void *data);
+-extern void storeClientCopy(store_client *, StoreEntry *, off_t, off_t, size_t, char *, STCB *, void *);
++extern void storeClientCopy(store_client *, StoreEntry *, squid_off_t, squid_off_t, size_t, char *, STCB *, void *);
+ extern int storeClientCopyPending(store_client *, StoreEntry * e, void *data);
+ extern int storeUnregister(store_client * sc, StoreEntry * e, void *data);
+-extern off_t storeLowestMemReaderOffset(const StoreEntry * entry);
++extern squid_off_t storeLowestMemReaderOffset(const StoreEntry * entry);
+ extern void InvokeHandlers(StoreEntry * e);
+ extern int storePendingNClients(const StoreEntry * e);
+ 
+@@ -1154,7 +1145,7 @@
+ extern void dlinkNodeDelete(dlink_node * m);
+ extern dlink_node *dlinkNodeNew(void);
+ 
+-extern void kb_incr(kb_t *, size_t);
++extern void kb_incr(kb_t *, squid_off_t);
+ extern double gb_to_double(const gb_t *);
+ extern const char *gb_to_str(const gb_t *);
+ extern void gb_flush(gb_t *);	/* internal, do not use this */
+diff -urNad squid-2.5.9/src/squid.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/squid.h
+--- squid-2.5.9/src/squid.h	2005-04-21 01:24:41.847031213 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/squid.h	2005-04-21 01:24:50.420725362 +0200
+@@ -481,4 +481,12 @@
+ #define FD_READ_METHOD(fd, buf, len) (*fd_table[fd].read_method)(fd, buf, len)
+ #define FD_WRITE_METHOD(fd, buf, len) (*fd_table[fd].write_method)(fd, buf, len)
+ 
++/*
++ * Trap attempts to build large file cache support without support for
++ * large objects
++ */
++#if LARGE_CACHE_FILES && SIZEOF_SQUID_OFF_T <= 4
++#error Your platform does not support large integers. Can not build with --enable-large-cache-files
++#endif
++
+ #endif /* SQUID_H */
+diff -urNad squid-2.5.9/src/ssl.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/ssl.c
+--- squid-2.5.9/src/ssl.c	2005-04-21 01:24:41.878026260 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/ssl.c	2005-04-21 01:24:50.423726478 +0200
+@@ -46,7 +46,7 @@
+ 	int len;
+ 	char *buf;
+     } client, server;
+-    size_t *size_ptr;		/* pointer to size in an ConnStateData for logging */
++    squid_off_t *size_ptr;	/* pointer to size in an ConnStateData for logging */
+     int *status_ptr;		/* pointer to status for logging */
+ #if DELAY_POOLS
+     delay_id delay_id;
+@@ -289,6 +289,12 @@
+ 	fd_bytes(fd, len, FD_WRITE);
+ 	kb_incr(&statCounter.server.all.kbytes_out, len);
+ 	kb_incr(&statCounter.server.other.kbytes_out, len);
++	/* increment total object size */
++	if (sslState->size_ptr && sslState->client.fd != -1)
++#if SIZEOF_SQUID_OFF_T <= 4
++	    if (*sslState->size_ptr < 0x7FFF0000)
++#endif
++		*sslState->size_ptr += len;
+ 	assert(len <= sslState->client.len);
+ 	sslState->client.len -= len;
+ 	if (sslState->client.len > 0) {
+@@ -331,7 +337,7 @@
+ 	sslState->server.len -= len;
+ 	/* increment total object size */
+ 	if (sslState->size_ptr)
+-#if SIZEOF_SIZE_T == 4
++#if SIZEOF_SQUID_OFF_T <= 4
+ 	    if (*sslState->size_ptr < 0x7FFF0000)
+ #endif
+ 		*sslState->size_ptr += len;
+@@ -461,7 +467,7 @@
+ 
+ CBDATA_TYPE(SslStateData);
+ void
+-sslStart(clientHttpRequest * http, size_t * size_ptr, int *status_ptr)
++sslStart(clientHttpRequest * http, squid_off_t * size_ptr, int *status_ptr)
+ {
+     /* Create state structure. */
+     SslStateData *sslState = NULL;
+diff -urNad squid-2.5.9/src/stat.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/stat.c
+--- squid-2.5.9/src/stat.c	2005-04-21 01:24:41.922019231 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/stat.c	2005-04-21 01:24:50.429728710 +0200
+@@ -274,22 +274,22 @@
+     memBufPrintf(mb, "\tSwap Dir %d, File %#08X\n",
+ 	e->swap_dirn, e->swap_filen);
+     if (mem != NULL) {
+-	memBufPrintf(mb, "\tinmem_lo: %d\n", (int) mem->inmem_lo);
+-	memBufPrintf(mb, "\tinmem_hi: %d\n", (int) mem->inmem_hi);
+-	memBufPrintf(mb, "\tswapout: %d bytes queued\n",
+-	    (int) mem->swapout.queue_offset);
++	memBufPrintf(mb, "\tinmem_lo: %" PRINTF_OFF_T "\n", mem->inmem_lo);
++	memBufPrintf(mb, "\tinmem_hi: %" PRINTF_OFF_T "\n", mem->inmem_hi);
++	memBufPrintf(mb, "\tswapout: %" PRINTF_OFF_T " bytes queued\n",
++	    mem->swapout.queue_offset);
+ 	if (mem->swapout.sio)
+-	    memBufPrintf(mb, "\tswapout: %d bytes written\n",
+-		(int) storeOffset(mem->swapout.sio));
++	    memBufPrintf(mb, "\tswapout: %" PRINTF_OFF_T " bytes written\n",
++		storeOffset(mem->swapout.sio));
+ 	for (i = 0, node = mem->clients.head; node; node = node->next, i++) {
+ 	    sc = (store_client *) node->data;
+ 	    if (sc->callback_data == NULL)
+ 		continue;
+ 	    memBufPrintf(mb, "\tClient #%d, %p\n", i, sc->callback_data);
+-	    memBufPrintf(mb, "\t\tcopy_offset: %d\n",
+-		(int) sc->copy_offset);
+-	    memBufPrintf(mb, "\t\tseen_offset: %d\n",
+-		(int) sc->seen_offset);
++	    memBufPrintf(mb, "\t\tcopy_offset: %" PRINTF_OFF_T "\n",
++		sc->copy_offset);
++	    memBufPrintf(mb, "\t\tseen_offset: %" PRINTF_OFF_T "\n",
++		sc->seen_offset);
+ 	    memBufPrintf(mb, "\t\tcopy_size: %d\n",
+ 		(int) sc->copy_size);
+ 	    memBufPrintf(mb, "\t\tflags:");
+@@ -432,7 +432,7 @@
+ 	f = &fd_table[i];
+ 	if (!f->flags.open)
+ 	    continue;
+-	storeAppendPrintf(sentry, "%4d %-6.6s %4d %7d%c %7d%c %-21s %s\n",
++	storeAppendPrintf(sentry, "%4d %-6.6s %4d %7" PRINTF_OFF_T "%c %7" PRINTF_OFF_T "%c %-21s %s\n",
+ 	    i,
+ 	    fdTypeStr[f->type],
+ 	    f->timeout_handler ? (int) (f->timeout - squid_curtime) / 60 : 0,
+@@ -1397,7 +1397,7 @@
+      */
+     cd = CountHist[0].cd.kbytes_recv.kb - CountHist[minutes].cd.kbytes_recv.kb;
+     if (s < cd)
+-	debug(18, 1) ("STRANGE: srv_kbytes=%d, cd_kbytes=%d\n", s, cd);
++	debug(18, 1) ("STRANGE: srv_kbytes=%d, cd_kbytes=%d\n", (int) s, (int) cd);
+     s -= cd;
+ #endif
+     if (c > s)
+@@ -1421,7 +1421,7 @@
+ 	storeAppendPrintf(s, "Connection: %p\n", conn);
+ 	if (conn) {
+ 	    fd = conn->fd;
+-	    storeAppendPrintf(s, "\tFD %d, read %d, wrote %d\n", fd,
++	    storeAppendPrintf(s, "\tFD %d, read %" PRINTF_OFF_T ", wrote %" PRINTF_OFF_T "\n", fd,
+ 		fd_table[fd].bytes_read, fd_table[fd].bytes_written);
+ 	    storeAppendPrintf(s, "\tFD desc: %s\n", fd_table[fd].desc);
+ 	    storeAppendPrintf(s, "\tin: buf %p, offset %ld, size %ld\n",
+diff -urNad squid-2.5.9/src/stmem.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/stmem.c
+--- squid-2.5.9/src/stmem.c	2005-04-21 01:24:45.020524169 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/stmem.c	2005-04-21 01:24:50.431729454 +0200
+@@ -65,10 +65,10 @@
+     mem->origin_offset = 0;
+ }
+ 
+-int
+-stmemFreeDataUpto(mem_hdr * mem, int target_offset)
++squid_off_t
++stmemFreeDataUpto(mem_hdr * mem, squid_off_t target_offset)
+ {
+-    int current_offset = mem->origin_offset;
++    squid_off_t current_offset = mem->origin_offset;
+     mem_node *p = mem->head;
+     while (p && ((current_offset + p->len) <= target_offset)) {
+ 	if (p == mem->tail) {
+@@ -135,15 +135,15 @@
+ }
+ 
+ ssize_t
+-stmemCopy(const mem_hdr * mem, off_t offset, char *buf, size_t size)
++stmemCopy(const mem_hdr * mem, squid_off_t offset, char *buf, size_t size)
+ {
+     mem_node *p = mem->head;
+-    off_t t_off = mem->origin_offset;
++    squid_off_t t_off = mem->origin_offset;
+     size_t bytes_to_go = size;
+     char *ptr_to_buf = NULL;
+     int bytes_from_this_packet = 0;
+     int bytes_into_this_packet = 0;
+-    debug(19, 6) ("memCopy: offset %ld: size %d\n", (long int) offset, (int) size);
++    debug(19, 6) ("memCopy: offset %" PRINTF_OFF_T ": size %d\n", offset, (int) size);
+     if (p == NULL)
+ 	return 0;
+     assert(size > 0);
+diff -urNad squid-2.5.9/src/store.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store.c
+--- squid-2.5.9/src/store.c	2005-04-21 01:24:41.970011563 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store.c	2005-04-21 01:24:50.437731686 +0200
+@@ -606,7 +606,7 @@
+ 	if (mem->object_sz < Config.Store.minObjectSize)
+ 	    return 1;
+     if (mem->reply->content_length > -1)
+-	if (mem->reply->content_length < (int) Config.Store.minObjectSize)
++	if (mem->reply->content_length < Config.Store.minObjectSize)
+ 	    return 1;
+     return 0;
+ }
+@@ -638,9 +638,6 @@
+ 	e->mem_obj->inmem_hi > Config.Store.maxObjectSize) {
+ 	debug(20, 2) ("storeCheckCachable: NO: too big\n");
+ 	store_check_cachable_hist.no.too_big++;
+-    } else if (e->mem_obj->reply->content_length > (int) Config.Store.maxObjectSize) {
+-	debug(20, 2) ("storeCheckCachable: NO: too big\n");
+-	store_check_cachable_hist.no.too_big++;
+     } else if (storeCheckTooSmall(e)) {
+ 	debug(20, 2) ("storeCheckCachable: NO: too small\n");
+ 	store_check_cachable_hist.no.too_small++;
+@@ -939,18 +936,18 @@
+ static int
+ storeEntryValidLength(const StoreEntry * e)
+ {
+-    int diff;
+-    int clen;
++    squid_off_t diff;
++    squid_off_t clen;
+     const HttpReply *reply;
+     assert(e->mem_obj != NULL);
+     reply = e->mem_obj->reply;
+     debug(20, 3) ("storeEntryValidLength: Checking '%s'\n", storeKeyText(e->hash.key));
+-    debug(20, 5) ("storeEntryValidLength:     object_len = %d\n",
++    debug(20, 5) ("storeEntryValidLength:     object_len = %" PRINTF_OFF_T "\n",
+ 	objectLen(e));
+     debug(20, 5) ("storeEntryValidLength:         hdr_sz = %d\n",
+ 	reply->hdr_sz);
+     clen = httpReplyBodySize(e->mem_obj->method, reply);
+-    debug(20, 5) ("storeEntryValidLength: content_length = %d\n",
++    debug(20, 5) ("storeEntryValidLength: content_length = %" PRINTF_OFF_T "\n",
+ 	clen);
+     if (clen < 0) {
+ 	debug(20, 5) ("storeEntryValidLength: Unspecified content length: %s\n",
+@@ -960,7 +957,7 @@
+     diff = reply->hdr_sz + clen - objectLen(e);
+     if (diff == 0)
+ 	return 1;
+-    debug(20, 2) ("storeEntryValidLength: %d bytes too %s; '%s'\n",
++    debug(20, 2) ("storeEntryValidLength: %" PRINTF_OFF_T " bytes too %s; '%s'\n",
+ 	diff < 0 ? -diff : diff,
+ 	diff < 0 ? "big" : "small",
+ 	storeKeyText(e->hash.key));
+@@ -1128,15 +1125,15 @@
+ 	mem->data_hdr.head);
+     debug(20, 1) ("MemObject->data.tail: %p\n",
+ 	mem->data_hdr.tail);
+-    debug(20, 1) ("MemObject->data.origin_offset: %d\n",
++    debug(20, 1) ("MemObject->data.origin_offset: %" PRINTF_OFF_T "\n",
+ 	mem->data_hdr.origin_offset);
+-    debug(20, 1) ("MemObject->start_ping: %d.%06d\n",
+-	(int) mem->start_ping.tv_sec,
++    debug(20, 1) ("MemObject->start_ping: %ld.%06d\n",
++	(long int) mem->start_ping.tv_sec,
+ 	(int) mem->start_ping.tv_usec);
+-    debug(20, 1) ("MemObject->inmem_hi: %d\n",
+-	(int) mem->inmem_hi);
+-    debug(20, 1) ("MemObject->inmem_lo: %d\n",
+-	(int) mem->inmem_lo);
++    debug(20, 1) ("MemObject->inmem_hi: %" PRINTF_OFF_T "\n",
++	mem->inmem_hi);
++    debug(20, 1) ("MemObject->inmem_lo: %" PRINTF_OFF_T "\n",
++	mem->inmem_lo);
+     debug(20, 1) ("MemObject->nclients: %d\n",
+ 	mem->nclients);
+     debug(20, 1) ("MemObject->reply: %p\n",
+@@ -1154,11 +1151,11 @@
+     debug(20, l) ("StoreEntry->key: %s\n", storeKeyText(e->hash.key));
+     debug(20, l) ("StoreEntry->next: %p\n", e->hash.next);
+     debug(20, l) ("StoreEntry->mem_obj: %p\n", e->mem_obj);
+-    debug(20, l) ("StoreEntry->timestamp: %d\n", (int) e->timestamp);
+-    debug(20, l) ("StoreEntry->lastref: %d\n", (int) e->lastref);
+-    debug(20, l) ("StoreEntry->expires: %d\n", (int) e->expires);
+-    debug(20, l) ("StoreEntry->lastmod: %d\n", (int) e->lastmod);
+-    debug(20, l) ("StoreEntry->swap_file_sz: %d\n", (int) e->swap_file_sz);
++    debug(20, l) ("StoreEntry->timestamp: %ld\n", (long int) e->timestamp);
++    debug(20, l) ("StoreEntry->lastref: %ld\n", (long int) e->lastref);
++    debug(20, l) ("StoreEntry->expires: %ld\n", (long int) e->expires);
++    debug(20, l) ("StoreEntry->lastmod: %ld\n", (long int) e->lastmod);
++    debug(20, l) ("StoreEntry->swap_file_sz: %" PRINTF_OFF_T "\n", (squid_off_t) e->swap_file_sz);
+     debug(20, l) ("StoreEntry->refcount: %d\n", e->refcount);
+     debug(20, l) ("StoreEntry->flags: %s\n", storeEntryFlags(e));
+     debug(20, l) ("StoreEntry->swap_dirn: %d\n", (int) e->swap_dirn);
+@@ -1240,14 +1237,14 @@
+     storeSwapOut(e);
+ }
+ 
+-int
++squid_off_t
+ objectLen(const StoreEntry * e)
+ {
+     assert(e->mem_obj != NULL);
+     return e->mem_obj->object_sz;
+ }
+ 
+-int
++squid_off_t
+ contentLen(const StoreEntry * e)
+ {
+     assert(e->mem_obj != NULL);
+diff -urNad squid-2.5.9/src/store_client.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_client.c
+--- squid-2.5.9/src/store_client.c	2005-04-21 01:24:41.994007729 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_client.c	2005-04-21 01:24:50.441733174 +0200
+@@ -141,10 +141,6 @@
+     sc->flags.disk_io_pending = 0;
+     sc->entry = e;
+     sc->type = storeClientType(e);
+-    if (sc->type == STORE_DISK_CLIENT)
+-	/* assert we'll be able to get the data we want */
+-	/* maybe we should open swapin_fd here */
+-	assert(e->swap_filen > -1 || storeSwapOutAble(e));
+     dlinkAdd(sc, &sc->node, &mem->clients);
+ #if DELAY_POOLS
+     sc->delay_id = 0;
+@@ -179,18 +175,18 @@
+ void
+ storeClientCopy(store_client * sc,
+     StoreEntry * e,
+-    off_t seen_offset,
+-    off_t copy_offset,
++    squid_off_t seen_offset,
++    squid_off_t copy_offset,
+     size_t size,
+     char *buf,
+     STCB * callback,
+     void *data)
+ {
+     assert(!EBIT_TEST(e->flags, ENTRY_ABORTED));
+-    debug(20, 3) ("storeClientCopy: %s, seen %d, want %d, size %d, cb %p, cbdata %p\n",
++    debug(20, 3) ("storeClientCopy: %s, seen %" PRINTF_OFF_T ", want %" PRINTF_OFF_T ", size %d, cb %p, cbdata %p\n",
+ 	storeKeyText(e->hash.key),
+-	(int) seen_offset,
+-	(int) copy_offset,
++	seen_offset,
++	copy_offset,
+ 	(int) size,
+ 	callback,
+ 	data);
+@@ -220,7 +216,7 @@
+ static int
+ storeClientNoMoreToSend(StoreEntry * e, store_client * sc)
+ {
+-    ssize_t len;
++    squid_off_t len;
+     if (e->store_status == STORE_PENDING)
+ 	return 0;
+     if ((len = objectLen(e)) < 0)
+@@ -265,7 +261,7 @@
+ storeClientCopy3(StoreEntry * e, store_client * sc)
+ {
+     MemObject *mem = e->mem_obj;
+-    size_t sz;
++    ssize_t sz;
+ 
+     if (storeClientNoMoreToSend(e, sc)) {
+ 	/* There is no more to send! */
+@@ -316,6 +312,8 @@
+ 	debug(20, 3) ("storeClientCopy3: Copying from memory\n");
+ 	sz = stmemCopy(&mem->data_hdr,
+ 	    sc->copy_offset, sc->copy_buf, sc->copy_size);
++	if (EBIT_TEST(e->flags, RELEASE_REQUEST))
++	    storeSwapOutMaintainMemObject(e);
+ 	storeClientCallback(sc, sz);
+ 	return;
+     }
+@@ -342,7 +340,7 @@
+ 	    sc);
+     } else {
+ 	if (sc->entry->swap_status == SWAPOUT_WRITING)
+-	    assert(storeOffset(mem->swapout.sio) > sc->copy_offset + mem->swap_hdr_sz);
++	    assert(storeSwapOutObjectBytesOnDisk(mem) > sc->copy_offset);
+ 	storeRead(sc->swapin_sio,
+ 	    sc->copy_buf,
+ 	    sc->copy_size,
+@@ -431,6 +429,7 @@
+ 	    }
+ 	    break;
+ 	case STORE_META_STD:
++	case STORE_META_STD_LFS:
+ 	    break;
+ 	case STORE_META_VARY_HEADERS:
+ 	    if (mem->vary_headers) {
+@@ -534,16 +533,18 @@
+     /*assert(!sc->flags.disk_io_pending); */
+     cbdataFree(sc);
+     assert(e->lock_count > 0);
++    storeSwapOutMaintainMemObject(e);
+     if (mem->nclients == 0)
+ 	CheckQuickAbort(e);
+     return 1;
+ }
+ 
+-off_t
++squid_off_t
+ storeLowestMemReaderOffset(const StoreEntry * entry)
+ {
+     const MemObject *mem = entry->mem_obj;
+-    off_t lowest = mem->inmem_hi + 1;
++    squid_off_t lowest = mem->inmem_hi + 1;
++    squid_off_t highest = -1;
+     store_client *sc;
+     dlink_node *nx = NULL;
+     dlink_node *node;
+@@ -553,14 +554,15 @@
+ 	nx = node->next;
+ 	if (sc->callback_data == NULL)	/* open slot */
+ 	    continue;
+-	if (sc->type != STORE_MEM_CLIENT)
++	if (sc->copy_offset > highest)
++	    highest = sc->copy_offset;
++	if (mem->swapout.sio != NULL && sc->type != STORE_MEM_CLIENT)
+ 	    continue;
+-	if (sc->type == STORE_DISK_CLIENT)
+-	    if (NULL != sc->swapin_sio)
+-		continue;
+ 	if (sc->copy_offset < lowest)
+ 	    lowest = sc->copy_offset;
+     }
++    if (highest < lowest && highest >= 0)
++	return highest;
+     return lowest;
+ }
+ 
+@@ -603,9 +605,9 @@
+ static int
+ CheckQuickAbort2(StoreEntry * entry)
+ {
+-    int curlen;
+-    int minlen;
+-    int expectlen;
++    squid_off_t curlen;
++    squid_off_t minlen;
++    squid_off_t expectlen;
+     MemObject *mem = entry->mem_obj;
+     assert(mem);
+     debug(20, 3) ("CheckQuickAbort2: entry=%p, mem=%p\n", entry, mem);
+@@ -618,8 +620,8 @@
+ 	return 1;
+     }
+     expectlen = mem->reply->content_length + mem->reply->hdr_sz;
+-    curlen = (int) mem->inmem_hi;
+-    minlen = (int) Config.quickAbort.min << 10;
++    curlen = mem->inmem_hi;
++    minlen = Config.quickAbort.min << 10;
+     if (minlen < 0) {
+ 	debug(20, 3) ("CheckQuickAbort2: NO disabled\n");
+ 	return 0;
+diff -urNad squid-2.5.9/src/store_dir.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_dir.c
+--- squid-2.5.9/src/store_dir.c	2005-04-21 01:24:42.014004534 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_dir.c	2005-04-21 01:24:50.446735034 +0200
+@@ -45,7 +45,7 @@
+ #include <sys/vfs.h>
+ #endif
+ 
+-static int storeDirValidSwapDirSize(int, ssize_t);
++static int storeDirValidSwapDirSize(int, squid_off_t);
+ static STDIRSELECT storeDirSelectSwapDirRoundRobin;
+ static STDIRSELECT storeDirSelectSwapDirLeastLoad;
+ 
+@@ -106,7 +106,7 @@
+  * ie any-sized-object swapdirs. This is a good thing.
+  */
+ static int
+-storeDirValidSwapDirSize(int swapdir, ssize_t objsize)
++storeDirValidSwapDirSize(int swapdir, squid_off_t objsize)
+ {
+     /*
+      * If the swapdir's max_obj_size is -1, then it definitely can
+@@ -144,7 +144,7 @@
+     int i;
+     int load;
+     SwapDir *sd;
+-    ssize_t objsize = (ssize_t) objectLen(e);
++    squid_off_t objsize = objectLen(e);
+     for (i = 0; i <= Config.cacheSwap.n_configured; i++) {
+ 	if (++dirn >= Config.cacheSwap.n_configured)
+ 	    dirn = 0;
+@@ -181,9 +181,9 @@
+ static int
+ storeDirSelectSwapDirLeastLoad(const StoreEntry * e)
+ {
+-    ssize_t objsize;
+-    ssize_t most_free = 0, cur_free;
+-    ssize_t least_objsize = -1;
++    squid_off_t objsize;
++    int most_free = 0, cur_free;
++    squid_off_t least_objsize = -1;
+     int least_load = INT_MAX;
+     int load;
+     int dirn = -1;
+@@ -191,7 +191,7 @@
+     SwapDir *SD;
+ 
+     /* Calculate the object size */
+-    objsize = (ssize_t) objectLen(e);
++    objsize = objectLen(e);
+     if (objsize != -1)
+ 	objsize += e->mem_obj->swap_hdr_sz;
+     for (i = 0; i < Config.cacheSwap.n_configured; i++) {
+@@ -270,7 +270,7 @@
+ }
+ 
+ void
+-storeDirUpdateSwapSize(SwapDir * SD, size_t size, int sign)
++storeDirUpdateSwapSize(SwapDir * SD, squid_off_t size, int sign)
+ {
+     int blks = (size + SD->fs.blksize - 1) / SD->fs.blksize;
+     int k = (blks * SD->fs.blksize >> 10) * sign;
+diff -urNad squid-2.5.9/src/store_io.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_io.c
+--- squid-2.5.9/src/store_io.c	2005-04-21 01:24:42.027002457 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_io.c	2005-04-21 01:24:50.448735778 +0200
+@@ -76,14 +76,14 @@
+ }
+ 
+ void
+-storeRead(storeIOState * sio, char *buf, size_t size, off_t offset, STRCB * callback, void *callback_data)
++storeRead(storeIOState * sio, char *buf, size_t size, squid_off_t offset, STRCB * callback, void *callback_data)
+ {
+     SwapDir *SD = &Config.cacheSwap.swapDirs[sio->swap_dirn];
+     SD->obj.read(SD, sio, buf, size, offset, callback, callback_data);
+ }
+ 
+ void
+-storeWrite(storeIOState * sio, char *buf, size_t size, off_t offset, FREE * free_func)
++storeWrite(storeIOState * sio, char *buf, size_t size, squid_off_t offset, FREE * free_func)
+ {
+     SwapDir *SD = &Config.cacheSwap.swapDirs[sio->swap_dirn];
+     SD->obj.write(SD, sio, buf, size, offset, free_func);
+@@ -96,7 +96,7 @@
+     SD->obj.unlink(SD, e);
+ }
+ 
+-off_t
++squid_off_t
+ storeOffset(storeIOState * sio)
+ {
+     return sio->offset;
+diff -urNad squid-2.5.9/src/store_log.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_log.c
+--- squid-2.5.9/src/store_log.c	2005-04-21 01:24:42.041000220 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_log.c	2005-04-21 01:24:50.450736522 +0200
+@@ -69,26 +69,26 @@
+ 	 * Because if we print it before the swap file number, it'll break
+ 	 * the existing log format.
+ 	 */
+-	logfilePrintf(storelog, "%9d.%03d %-7s %02d %08X %s %4d %9d %9d %9d %s %d/%d %s %s\n",
+-	    (int) current_time.tv_sec,
++	logfilePrintf(storelog, "%9ld.%03d %-7s %02d %08X %s %4d %9ld %9ld %9ld %s %" PRINTF_OFF_T "/%" PRINTF_OFF_T " %s %s\n",
++	    (long int) current_time.tv_sec,
+ 	    (int) current_time.tv_usec / 1000,
+ 	    storeLogTags[tag],
+ 	    e->swap_dirn,
+ 	    e->swap_filen,
+ 	    storeKeyText(e->hash.key),
+ 	    reply->sline.status,
+-	    (int) reply->date,
+-	    (int) reply->last_modified,
+-	    (int) reply->expires,
++	    (long int) reply->date,
++	    (long int) reply->last_modified,
++	    (long int) reply->expires,
+ 	    strLen(reply->content_type) ? strBuf(reply->content_type) : "unknown",
+ 	    reply->content_length,
+-	    (int) (mem->inmem_hi - mem->reply->hdr_sz),
++	    mem->inmem_hi - mem->reply->hdr_sz,
+ 	    RequestMethodStr[mem->method],
+ 	    mem->log_url);
+     } else {
+ 	/* no mem object. Most RELEASE cases */
+-	logfilePrintf(storelog, "%9d.%03d %-7s %02d %08X %s   ?         ?         ?         ? ?/? ?/? ? ?\n",
+-	    (int) current_time.tv_sec,
++	logfilePrintf(storelog, "%9ld.%03d %-7s %02d %08X %s   ?         ?         ?         ? ?/? ?/? ? ?\n",
++	    (long int) current_time.tv_sec,
+ 	    (int) current_time.tv_usec / 1000,
+ 	    storeLogTags[tag],
+ 	    e->swap_dirn,
+diff -urNad squid-2.5.9/src/store_swapmeta.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_swapmeta.c
+--- squid-2.5.9/src/store_swapmeta.c	2005-04-21 01:24:42.054997984 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_swapmeta.c	2005-04-21 01:24:50.452737266 +0200
+@@ -73,7 +73,11 @@
+     url = storeUrl(e);
+     debug(20, 3) ("storeSwapMetaBuild: %s\n", url);
+     T = storeSwapTLVAdd(STORE_META_KEY, e->hash.key, MD5_DIGEST_CHARS, T);
++#if SIZEOF_SQUID_FILE_SZ == SIZEOF_SIZE_T
+     T = storeSwapTLVAdd(STORE_META_STD, &e->timestamp, STORE_HDR_METASIZE, T);
++#else
++    T = storeSwapTLVAdd(STORE_META_STD_LFS, &e->timestamp, STORE_HDR_METASIZE, T);
++#endif
+     T = storeSwapTLVAdd(STORE_META_URL, url, strlen(url) + 1, T);
+     vary = e->mem_obj->vary_headers;
+     if (vary)
+@@ -86,7 +90,7 @@
+ {
+     int buflen = 0;
+     tlv *t;
+-    off_t j = 0;
++    int j = 0;
+     char *buf;
+     assert(length != NULL);
+     buflen++;			/* STORE_META_OK */
+@@ -119,7 +123,7 @@
+     char type;
+     int length;
+     int buflen;
+-    off_t j = 0;
++    int j = 0;
+     assert(buf != NULL);
+     assert(hdr_len != NULL);
+     if (buf[j++] != (char) STORE_META_OK)
+diff -urNad squid-2.5.9/src/store_swapout.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_swapout.c
+--- squid-2.5.9/src/store_swapout.c	2005-04-21 01:24:45.035521773 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/store_swapout.c	2005-04-21 01:27:05.972131734 +0200
+@@ -35,10 +35,10 @@
+ 
+ #include "squid.h"
+ 
+-static off_t storeSwapOutObjectBytesOnDisk(const MemObject *);
+ static void storeSwapOutStart(StoreEntry * e);
+ static STIOCB storeSwapOutFileClosed;
+ static STIOCB storeSwapOutFileNotify;
++static int storeSwapOutAble(const StoreEntry * e);
+ 
+ /* start swapping object to disk */
+ static void
+@@ -95,15 +95,65 @@
+     e->swap_dirn = mem->swapout.sio->swap_dirn;
+ }
+ 
++/* as sideeffect returns if the object can be cached */
++int
++storeSwapOutMaintainMemObject(StoreEntry * e)
++{
++    MemObject *mem = e->mem_obj;
++    squid_off_t lowest_offset;
++    squid_off_t new_mem_lo;
++    int swapout_able = storeSwapOutAble(e);
++
++    /* Don't pollute the disk with icons and other special entries */
++    if (EBIT_TEST(e->flags, ENTRY_SPECIAL))
++	return -1;
++
++    if (!swapout_able) {
++	/* Stop writing to disk */
++	storeReleaseRequest(e);
++	if (e->mem_obj->swapout.sio != NULL)
++	    storeSwapOutFileClose(e);
++    }
++    /* storeLowestMemReaderOffset must be after the storeSwapOutFileClose
++     * call above as storeLowestMemReaderOffset needs to know if we are
++     * still writing to disk or not
++     */
++    lowest_offset = storeLowestMemReaderOffset(e);
++    debug(20, 7) ("storeSwapOut: lowest_offset = %" PRINTF_OFF_T "\n",
++	lowest_offset);
++    /*
++     * Careful.  lowest_offset can be greater than inmem_hi, such
++     * as in the case of a range request.
++     */
++    if (mem->inmem_hi < lowest_offset)
++	new_mem_lo = lowest_offset;
++    else if (mem->inmem_hi > Config.Store.maxInMemObjSize)
++	new_mem_lo = lowest_offset;
++    else if (mem->reply->content_length > Config.Store.maxInMemObjSize)
++	new_mem_lo = lowest_offset;
++    else
++	new_mem_lo = mem->inmem_lo;
++    /* The -1 makes sure the page isn't freed until storeSwapOut has
++     * walked to the next page. (mem->swapout.memnode) */
++	if (swapout_able) {
++	squid_off_t on_disk = storeSwapOutObjectBytesOnDisk(e->mem_obj);
++	if (on_disk - 1 < new_mem_lo)
++	    new_mem_lo = on_disk - 1;
++    }
++    if (new_mem_lo < mem->inmem_lo)
++	new_mem_lo = mem->inmem_lo;
++    if (mem->inmem_lo != new_mem_lo)
++	mem->inmem_lo = stmemFreeDataUpto(&mem->data_hdr, new_mem_lo);
++    return swapout_able;
++}
++
+ void
+ storeSwapOut(StoreEntry * e)
+ {
+     MemObject *mem = e->mem_obj;
+-    off_t lowest_offset;
+-    off_t new_mem_lo;
+-    off_t on_disk = 0;
+-    ssize_t swapout_size;
+-    ssize_t swap_buf_len;
++    int swapout_able;
++    squid_off_t swapout_size;
++    size_t swap_buf_len;
+     if (mem == NULL)
+ 	return;
+     /* should we swap something out to disk? */
+@@ -119,24 +169,21 @@
+ 	debug(20, 3) ("storeSwapOut: %s SPECIAL\n", storeUrl(e));
+ 	return;
+     }
+-    debug(20, 7) ("storeSwapOut: mem->inmem_lo = %d\n",
+-	(int) mem->inmem_lo);
+-    debug(20, 7) ("storeSwapOut: mem->inmem_hi = %d\n",
+-	(int) mem->inmem_hi);
+-    debug(20, 7) ("storeSwapOut: swapout.queue_offset = %d\n",
+-	(int) mem->swapout.queue_offset);
++    debug(20, 7) ("storeSwapOut: mem->inmem_lo = %" PRINTF_OFF_T "\n",
++	mem->inmem_lo);
++    debug(20, 7) ("storeSwapOut: mem->inmem_hi = %" PRINTF_OFF_T "\n",
++	mem->inmem_hi);
++    debug(20, 7) ("storeSwapOut: swapout.queue_offset = %" PRINTF_OFF_T "\n",
++	mem->swapout.queue_offset);
+     if (mem->swapout.sio)
+-	debug(20, 7) ("storeSwapOut: storeOffset() = %d\n",
+-	    (int) storeOffset(mem->swapout.sio));
++	debug(20, 7) ("storeSwapOut: storeOffset() = %" PRINTF_OFF_T "\n",
++	    storeOffset(mem->swapout.sio));
+     assert(mem->inmem_hi >= mem->swapout.queue_offset);
+-    lowest_offset = storeLowestMemReaderOffset(e);
+-    debug(20, 7) ("storeSwapOut: lowest_offset = %d\n",
+-	(int) lowest_offset);
+     /*
+      * Grab the swapout_size and check to see whether we're going to defer
+      * the swapout based upon size
+      */
+-    swapout_size = (ssize_t) (mem->inmem_hi - mem->swapout.queue_offset);
++    swapout_size = mem->inmem_hi - mem->swapout.queue_offset;
+     if ((e->store_status != STORE_OK) && (swapout_size < store_maxobjsize)) {
+ 	/*
+ 	 * NOTE: the store_maxobjsize here is the max of optional
+@@ -151,53 +198,18 @@
+ 	debug(20, 5) ("storeSwapOut: Deferring starting swapping out\n");
+ 	return;
+     }
+-    /*
+-     * Careful.  lowest_offset can be greater than inmem_hi, such
+-     * as in the case of a range request.
+-     */
+-    if (mem->inmem_hi < lowest_offset)
+-	new_mem_lo = lowest_offset;
+-    else if (mem->inmem_hi - mem->inmem_lo > Config.Store.maxInMemObjSize)
+-	new_mem_lo = lowest_offset;
+-    else
+-	new_mem_lo = mem->inmem_lo;
+-    assert(new_mem_lo >= mem->inmem_lo);
+-    if (storeSwapOutAble(e)) {
+-	/*
+-	 * We should only free up to what we know has been written
+-	 * to disk, not what has been queued for writing.  Otherwise
+-	 * there will be a chunk of the data which is not in memory
+-	 * and is not yet on disk.
+-	 * The -1 makes sure the page isn't freed until storeSwapOut has
+-	 * walked to the next page. (mem->swapout.memnode)
+-	 */
+-	if ((on_disk = storeSwapOutObjectBytesOnDisk(mem)) - 1 < new_mem_lo)
+-	    new_mem_lo = on_disk - 1;
+-	if (new_mem_lo == -1)
+-	    new_mem_lo = 0;	/* the above might become -1 */
+-    } else if (new_mem_lo > 0) {
+-	/*
+-	 * Its not swap-able, and we're about to delete a chunk,
+-	 * so we must make it PRIVATE.  This is tricky/ugly because
+-	 * for the most part, we treat swapable == cachable here.
+-	 */
+-	storeReleaseRequest(e);
+-    }
+-    stmemFreeDataUpto(&mem->data_hdr, new_mem_lo);
+-    mem->inmem_lo = new_mem_lo;
+-#if SIZEOF_OFF_T == 4
++    swapout_able = storeSwapOutMaintainMemObject(e);
++#if SIZEOF_SQUID_OFF_T <= 4
+     if (mem->inmem_hi > 0x7FFF0000) {
+-	debug(20, 0) ("WARNING: preventing off_t overflow for %s\n", storeUrl(e));
++	debug(20, 0) ("WARNING: preventing squid_off_t overflow for %s\n", storeUrl(e));
+ 	storeAbort(e);
+ 	return;
+     }
+ #endif
+-    if (e->swap_status == SWAPOUT_WRITING)
+-	assert(mem->inmem_lo <= on_disk);
+-    if (!storeSwapOutAble(e))
++    if (!swapout_able)
+ 	return;
+-    debug(20, 7) ("storeSwapOut: swapout_size = %d\n",
+-	(int) swapout_size);
++    debug(20, 7) ("storeSwapOut: swapout_size = %" PRINTF_OFF_T "\n",
++	swapout_size);
+     if (swapout_size == 0) {
+ 	if (e->store_status == STORE_OK)
+ 	    storeSwapOutFileClose(e);
+@@ -253,14 +265,14 @@
+ 
+ 	debug(20, 3) ("storeSwapOut: swap_buf_len = %d\n", (int) swap_buf_len);
+ 	assert(swap_buf_len > 0);
+-	debug(20, 3) ("storeSwapOut: swapping out %ld bytes from %ld\n",
+-	    (long int) swap_buf_len, (long int) mem->swapout.queue_offset);
++	debug(20, 3) ("storeSwapOut: swapping out %d bytes from %" PRINTF_OFF_T "\n",
++	    (int) swap_buf_len, mem->swapout.queue_offset);
+ 	mem->swapout.queue_offset += swap_buf_len;
+ 	storeWrite(mem->swapout.sio, stmemNodeGet(mem->swapout.memnode), swap_buf_len, -1, stmemNodeFree);
+ 	/* the storeWrite() call might generate an error */
+ 	if (e->swap_status != SWAPOUT_WRITING)
+ 	    break;
+-	swapout_size = (ssize_t) (mem->inmem_hi - mem->swapout.queue_offset);
++	swapout_size = mem->inmem_hi - mem->swapout.queue_offset;
+ 	if (e->store_status == STORE_PENDING)
+ 	    if (swapout_size < SM_PAGE_SIZE)
+ 		break;
+@@ -283,12 +295,14 @@
+ storeSwapOutFileClose(StoreEntry * e)
+ {
+     MemObject *mem = e->mem_obj;
++    storeIOState *sio = mem->swapout.sio;
+     assert(mem != NULL);
+     debug(20, 3) ("storeSwapOutFileClose: %s\n", storeKeyText(e->hash.key));
+     debug(20, 3) ("storeSwapOutFileClose: sio = %p\n", mem->swapout.sio);
+-    if (mem->swapout.sio == NULL)
++    if (sio == NULL)
+ 	return;
+-    storeClose(mem->swapout.sio);
++    mem->swapout.sio = NULL;
++    storeClose(sio);
+ }
+ 
+ static void
+@@ -329,13 +343,14 @@
+     debug(20, 3) ("storeSwapOutFileClosed: %s:%d\n", __FILE__, __LINE__);
+     mem->swapout.sio = NULL;
+     cbdataUnlock(sio);
++    storeSwapOutMaintainMemObject(e);
+     storeUnlockObject(e);
+ }
+ 
+ /*
+  * How much of the object data is on the disk?
+  */
+-static off_t
++squid_off_t
+ storeSwapOutObjectBytesOnDisk(const MemObject * mem)
+ {
+     /*
+@@ -351,7 +366,7 @@
+      */
+     off_t nwritten;
+     if (mem->swapout.sio == NULL)
+-	return 0;
++	return mem->swapout.queue_offset;
+     nwritten = storeOffset(mem->swapout.sio);
+     if (nwritten <= mem->swap_hdr_sz)
+ 	return 0;
+@@ -361,24 +376,19 @@
+ /*
+  * Is this entry a candidate for writing to disk?
+  */
+-int
++static int
+ storeSwapOutAble(const StoreEntry * e)
+ {
+-    dlink_node *node;
++    if (e->mem_obj->inmem_hi > Config.Store.maxObjectSize)
++	return 0;
++    if (!EBIT_TEST(e->flags, ENTRY_CACHABLE))
++	return 0;
+     if (e->mem_obj->swapout.sio != NULL)
+ 	return 1;
+-    if (e->mem_obj->inmem_lo > 0)
+-	return 0;
+-    /*
+-     * If there are DISK clients, we must write to disk
+-     * even if its not cachable
+-     */
+-    for (node = e->mem_obj->clients.head; node; node = node->next) {
+-	if (((store_client *) node->data)->type == STORE_DISK_CLIENT)
++    if (e->mem_obj->swapout.queue_offset)
++	if (e->mem_obj->swapout.queue_offset == e->mem_obj->inmem_hi)
+ 	    return 1;
+-    }
+-    /* Don't pollute the disk with icons and other special entries */
+-    if (EBIT_TEST(e->flags, ENTRY_SPECIAL))
++    if (e->mem_obj->inmem_lo > 0)
+ 	return 0;
+-    return EBIT_TEST(e->flags, ENTRY_CACHABLE);
++    return 1;
+ }
+diff -urNad squid-2.5.9/src/structs.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/structs.h
+--- squid-2.5.9/src/structs.h	2005-04-21 01:24:45.064517141 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/structs.h	2005-04-21 01:24:50.467742846 +0200
+@@ -57,7 +57,7 @@
+ };
+ 
+ struct _acl_user_ip_data {
+-    size_t max;
++    int max;
+     struct {
+ 	unsigned int strict:1;
+     } flags;
+@@ -122,10 +122,10 @@
+     dlink_list proxy_match_cache;
+     /* what ip addresses has this user been seen at?, plus a list length cache */
+     dlink_list ip_list;
+-    size_t ipcount;
++    int ipcount;
+     long expiretime;
+     /* how many references are outstanding to this instance */
+-    size_t references;
++    int references;
+     /* the auth scheme has it's own private data area */
+     void *scheme_data;
+     /* the auth_user_request structures that link to this. Yes it could be a splaytree
+@@ -143,7 +143,7 @@
+     /* any scheme specific request related data */
+     void *scheme_data;
+     /* how many 'processes' are working on this data */
+-    size_t references;
++    int references;
+     /* We only attempt authentication once per http request. This 
+      * is to allow multiple auth acl references from different _access areas
+      * when using connection based authentication
+@@ -228,7 +228,7 @@
+ struct _body_size {
+     dlink_node node;
+     acl_access *access_list;
+-    size_t maxsize;
++    squid_off_t maxsize;
+ };
+ 
+ struct _http_version_t {
+@@ -385,20 +385,20 @@
+ 
+ struct _SquidConfig {
+     struct {
+-	size_t maxSize;
++	squid_off_t maxSize;
+ 	int highWaterMark;
+ 	int lowWaterMark;
+     } Swap;
+-    size_t memMaxSize;
++    squid_off_t memMaxSize;
+     struct {
+ 	char *relayHost;
+ 	u_short relayPort;
+ 	peer *peer;
+     } Wais;
+     struct {
+-	size_t min;
++	squid_off_t min;
+ 	int pct;
+-	size_t max;
++	squid_off_t max;
+     } quickAbort;
+     RemovalPolicySettings *replPolicy;
+     RemovalPolicySettings *memPolicy;
+@@ -428,9 +428,9 @@
+ 	time_t idns_query;
+ #endif
+     } Timeout;
+-    size_t maxRequestHeaderSize;
+-    size_t maxRequestBodySize;
+-    size_t maxReplyHeaderSize;
++    squid_off_t maxRequestHeaderSize;
++    squid_off_t maxRequestBodySize;
++    squid_off_t maxReplyHeaderSize;
+     dlink_list ReplyBodySize;
+     struct {
+ 	u_short icp;
+@@ -507,7 +507,7 @@
+ 	u_short port;
+     } Accel;
+     char *appendDomain;
+-    size_t appendDomainLen;
++    int appendDomainLen;
+     char *debugOptions;
+     char *pidFilename;
+     char *mimeTablePathname;
+@@ -531,8 +531,8 @@
+ #endif
+ 	struct in_addr client_netmask;
+     } Addrs;
+-    size_t tcpRcvBufsz;
+-    size_t udpMaxHitObjsz;
++    squid_off_t tcpRcvBufsz;
++    squid_off_t udpMaxHitObjsz;
+     wordlist *hierarchy_stoplist;
+     wordlist *mcast_group_list;
+     wordlist *dns_testname_list;
+@@ -552,10 +552,10 @@
+     cachemgr_passwd *passwd_list;
+     struct {
+ 	int objectsPerBucket;
+-	size_t avgObjectSize;
+-	size_t maxObjectSize;
+-	size_t minObjectSize;
+-	size_t maxInMemObjSize;
++	squid_off_t avgObjectSize;
++	squid_off_t maxObjectSize;
++	squid_off_t minObjectSize;
++	squid_off_t maxInMemObjSize;
+     } Store;
+     struct {
+ 	int high;
+@@ -637,7 +637,7 @@
+ 	int n_configured;
+     } authConfig;
+     struct {
+-	size_t list_width;
++	int list_width;
+ 	int list_wrap;
+ 	char *anon_user;
+ 	int passive;
+@@ -660,7 +660,7 @@
+ 	int onerror;
+     } retry;
+     struct {
+-	size_t limit;
++	squid_off_t limit;
+     } MemPools;
+ #if DELAY_POOLS
+     delayConfig Delay;
+@@ -675,7 +675,7 @@
+     } comm_incoming;
+     int max_open_disk_fds;
+     int uri_whitespace;
+-    size_t rangeOffsetLimit;
++    squid_off_t rangeOffsetLimit;
+ #if MULTICAST_MISS_STREAM
+     struct {
+ 	struct in_addr addr;
+@@ -692,7 +692,7 @@
+ 	int bits_per_entry;
+ 	time_t rebuild_period;
+ 	time_t rewrite_period;
+-	size_t swapout_chunk_size;
++	squid_off_t swapout_chunk_size;
+ 	int rebuild_chunk_percentage;
+     } digest;
+ #endif
+@@ -705,7 +705,7 @@
+     struct {
+ 	int high_rptm;
+ 	int high_pf;
+-	size_t high_memory;
++	squid_off_t high_memory;
+     } warnings;
+     char *store_dir_select_algorithm;
+     int sleep_after_fork;	/* microseconds */
+@@ -732,31 +732,19 @@
+ 
+ struct _dread_ctrl {
+     int fd;
+-    off_t offset;
+-    int req_len;
++    off_t file_offset;
++    size_t req_len;
+     char *buf;
+     int end_of_file;
+     DRCB *handler;
+     void *client_data;
+ };
+ 
+-struct _dnsserver_t {
+-    int id;
+-    int inpipe;
+-    int outpipe;
+-    time_t answer;
+-    off_t offset;
+-    size_t size;
+-    char ip_inbuf[DNS_INBUF_SZ];
+-    struct timeval dispatch_time;
+-    void *data;
+-};
+-
+ struct _dwrite_q {
+     off_t file_offset;
+     char *buf;
+-    int len;
+-    off_t buf_offset;
++    size_t len;
++    size_t buf_offset;
+     dwrite_q *next;
+     FREE *free_func;
+ };
+@@ -793,8 +781,8 @@
+ 	unsigned int close_on_exec:1;
+ 	unsigned int read_pending:1;
+     } flags;
+-    int bytes_read;
+-    int bytes_written;
++    squid_off_t bytes_read;
++    squid_off_t bytes_written;
+     int uses;			/* ie # req's over persistent conn */
+     struct _fde_disk {
+ 	DWCB *wrt_handle;
+@@ -849,7 +837,7 @@
+     /* protected, use interface functions instead */
+     append_f append;
+     vprintf_f vprintf;
+-    void *real_handler;		/* first parameter to real append and vprintf */
++    void *real_handle;		/* first parameter to real append and vprintf */
+ };
+ 
+ /* http status line */
+@@ -885,8 +873,8 @@
+ 
+ /* http byte-range-spec */
+ struct _HttpHdrRangeSpec {
+-    ssize_t offset;
+-    ssize_t length;
++    squid_off_t offset;
++    squid_off_t length;
+ };
+ 
+ /* There may be more than one byte range specified in the request.
+@@ -900,7 +888,7 @@
+ /* http content-range header field */
+ struct _HttpHdrContRange {
+     HttpHdrRangeSpec spec;
+-    ssize_t elength;		/* entity length, not content length */
++    squid_off_t elength;	/* entity length, not content length */
+ };
+ 
+ /* some fields can hold either time or etag specs (e.g. If-Range) */
+@@ -914,8 +902,8 @@
+ struct _HttpHdrRangeIter {
+     HttpHdrRangePos pos;
+     const HttpHdrRangeSpec *spec;	/* current spec at pos */
+-    ssize_t debt_size;		/* bytes left to send from the current spec */
+-    ssize_t prefix_size;	/* the size of the incoming HTTP msg prefix */
++    squid_off_t debt_size;	/* bytes left to send from the current spec */
++    squid_off_t prefix_size;	/* the size of the incoming HTTP msg prefix */
+     String boundary;		/* boundary for multipart responses */
+ };
+ 
+@@ -962,7 +950,7 @@
+     int hdr_sz;			/* sums _stored_ status-line, headers, and <CRLF> */
+ 
+     /* public, readable; never update these or their .hdr equivalents directly */
+-    int content_length;
++    squid_off_t content_length;
+     time_t date;
+     time_t last_modified;
+     time_t expires;
+@@ -1053,7 +1041,7 @@
+     } icp;
+     struct {
+ 	struct in_addr caddr;
+-	size_t size;
++	squid_off_t size;
+ 	log_type code;
+ 	int msec;
+ 	const char *rfc931;
+@@ -1077,8 +1065,8 @@
+     char *uri;
+     char *log_uri;
+     struct {
+-	off_t offset;
+-	size_t size;
++	squid_off_t offset;
++	squid_off_t size;
+     } out;
+     HttpHdrRangeIter range_iter;	/* data for iterating thru range specs */
+     size_t req_sz;		/* raw request size on input, not current request size */
+@@ -1105,18 +1093,18 @@
+ 	char *location;
+     } redirect;
+     dlink_node active;
+-    size_t maxBodySize;
++    squid_off_t maxBodySize;
+ };
+ 
+ struct _ConnStateData {
+     int fd;
+     struct {
+ 	char *buf;
+-	off_t offset;
++	size_t offset;
+ 	size_t size;
+     } in;
+     struct {
+-	size_t size_left;	/* How much body left to process */
++	squid_off_t size_left;	/* How much body left to process */
+ 	request_t *request;	/* Parameters passed to clientReadBody */
+ 	char *buf;
+ 	size_t bufsize;
+@@ -1186,8 +1174,8 @@
+     store_client *sc;
+     store_client *old_sc;
+     request_t *request;
+-    int offset;
+-    int mask_offset;
++    squid_off_t offset;
++    squid_off_t mask_offset;
+     time_t start_time;
+     time_t resp_time;
+     time_t expires;
+@@ -1437,14 +1425,14 @@
+ struct _mem_hdr {
+     mem_node *head;
+     mem_node *tail;
+-    int origin_offset;
++    squid_off_t origin_offset;
+ };
+ 
+ /* keep track each client receiving data from that particular StoreEntry */
+ struct _store_client {
+     int type;
+-    off_t copy_offset;
+-    off_t seen_offset;
++    squid_off_t copy_offset;
++    squid_off_t seen_offset;
+     size_t copy_size;
+     char *copy_buf;
+     STCB *callback;
+@@ -1502,12 +1490,12 @@
+     method_t method;
+     char *url;
+     mem_hdr data_hdr;
+-    off_t inmem_hi;
+-    off_t inmem_lo;
++    squid_off_t inmem_hi;
++    squid_off_t inmem_lo;
+     dlink_list clients;
+     int nclients;
+     struct {
+-	off_t queue_offset;	/* relative to in-mem data */
++	squid_off_t queue_offset;	/* relative to in-mem data */
+ 	mem_node *memnode;	/* which node we're currently paging out */
+ 	storeIOState *sio;
+     } swapout;
+@@ -1523,7 +1511,7 @@
+     char *log_url;
+     RemovalPolicyNode repl;
+     int id;
+-    ssize_t object_sz;
++    squid_off_t object_sz;
+     size_t swap_hdr_sz;
+ #if URL_CHECKSUM_DEBUG
+     unsigned int chksum;
+@@ -1540,7 +1528,7 @@
+     time_t lastref;
+     time_t expires;
+     time_t lastmod;
+-    size_t swap_file_sz;
++    squid_file_sz swap_file_sz;
+     u_short refcount;
+     u_short flags;
+     /* END OF ON-DISK STORE_META_STD */
+@@ -1560,7 +1548,7 @@
+     int max_size;
+     char *path;
+     int index;			/* This entry's index into the swapDirs array */
+-    ssize_t max_objsize;
++    squid_off_t max_objsize;
+     RemovalPolicy *repl;
+     int removals;
+     int scanned;
+@@ -1640,8 +1628,8 @@
+     sfileno swap_filen;
+     StoreEntry *e;		/* Need this so the FS layers can play god */
+     mode_t mode;
+-    size_t st_size;		/* do stat(2) after read open */
+-    off_t offset;		/* current on-disk offset pointer */
++    squid_off_t st_size;	/* do stat(2) after read open */
++    squid_off_t offset;		/* current on-disk offset pointer */
+     STFNCB *file_callback;	/* called on delayed sfileno assignments */
+     STIOCB *callback;
+     void *callback_data;
+@@ -1677,7 +1665,7 @@
+     struct in_addr my_addr;
+     unsigned short my_port;
+     HttpHeader header;
+-    int content_length;
++    squid_off_t content_length;
+     HierarchyLogEntry hier;
+     err_type err_type;
+     char *peer_login;		/* Configured peer login:password */
+@@ -1714,7 +1702,7 @@
+ struct _CommWriteStateData {
+     char *buf;
+     size_t size;
+-    off_t offset;
++    size_t offset;
+     CWCB *handler;
+     void *handler_data;
+     FREE *free_func;
+@@ -1911,12 +1899,35 @@
+     time_t lastref;
+     time_t expires;
+     time_t lastmod;
++    squid_file_sz swap_file_sz;
++    u_short refcount;
++    u_short flags;
++    unsigned char key[MD5_DIGEST_CHARS];
++};
++
++struct _storeSwapLogHeader {
++    char op;
++    int version;
++    int record_size;
++};
++
++#if SIZEOF_SQUID_FILE_SZ != SIZEOF_SIZE_T
++struct _storeSwapLogDataOld {
++    char op;
++    sfileno swap_filen;
++    time_t timestamp;
++    time_t lastref;
++    time_t expires;
++    time_t lastmod;
+     size_t swap_file_sz;
+     u_short refcount;
+     u_short flags;
+     unsigned char key[MD5_DIGEST_CHARS];
+ };
+ 
++#endif
++
++
+ /* object to track per-action memory usage (e.g. #idle objects) */
+ struct _MemMeter {
+     ssize_t level;		/* current level (count or volume) */
+@@ -1963,7 +1974,7 @@
+ struct _CacheDigest {
+     /* public, read-only */
+     char *mask;			/* bit mask */
+-    size_t mask_size;		/* mask size in bytes */
++    int mask_size;		/* mask size in bytes */
+     int capacity;		/* expected maximum for .count, not a hard limit */
+     int bits_per_entry;		/* number of bits allocated for each entry from capacity */
+     int count;			/* number of digested entries */
+@@ -2075,7 +2086,7 @@
+     int wfd;
+     char *buf;
+     size_t buf_sz;
+-    off_t offset;
++    int offset;
+     struct timeval dispatch_time;
+     struct timeval answer_time;
+     dlink_node link;
+@@ -2099,7 +2110,7 @@
+     int wfd;
+     char *buf;
+     size_t buf_sz;
+-    off_t offset;
++    int offset;
+     struct timeval dispatch_time;
+     struct timeval answer_time;
+     dlink_node link;
+@@ -2184,7 +2195,7 @@
+     char path[MAXPATHLEN];
+     char *buf;
+     size_t bufsz;
+-    off_t offset;
++    ssize_t offset;
+     struct {
+ 	unsigned int fatal:1;
+     } flags;
+diff -urNad squid-2.5.9/src/tools.c /tmp/dpep.8Ml6B6/squid-2.5.9/src/tools.c
+--- squid-2.5.9/src/tools.c	2005-04-21 01:24:42.138984565 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/tools.c	2005-04-21 01:24:50.471744334 +0200
+@@ -839,7 +839,7 @@
+ }
+ 
+ void
+-kb_incr(kb_t * k, size_t v)
++kb_incr(kb_t * k, squid_off_t v)
+ {
+     k->bytes += v;
+     k->kb += (k->bytes >> 10);
+diff -urNad squid-2.5.9/src/typedefs.h /tmp/dpep.8Ml6B6/squid-2.5.9/src/typedefs.h
+--- squid-2.5.9/src/typedefs.h	2005-04-21 01:24:42.189976418 +0200
++++ /tmp/dpep.8Ml6B6/squid-2.5.9/src/typedefs.h	2005-04-21 01:24:50.474745450 +0200
+@@ -41,9 +41,29 @@
+ typedef signed int sfileno;
+ typedef signed int sdirno;
+ 
++#if SIZEOF_INT64_T > SIZEOF_LONG && defined(PRId64) && defined(INT64_MAX) && HAVE_STRTOLL
++typedef int64_t squid_off_t;
++#define SIZEOF_SQUID_OFF_T SIZEOF_INT64_T
++#define PRINTF_OFF_T PRId64
++#define strto_off_t (int64_t)strtoll
++#else
++typedef long squid_off_t;
++#define SIZEOF_SQUID_OFF_T SIZEOF_LONG
++#define PRINTF_OFF_T "ld"
++#define strto_off_t strtol
++#endif
++
++#if LARGE_CACHE_FILES
++typedef squid_off_t squid_file_sz;
++#define SIZEOF_SQUID_FILE_SZ SIZEOF_SQUID_OFF_T
++#else
++typedef size_t squid_file_sz;
++#define SIZEOF_SQUID_FILE_SZ SIZEOF_SIZE_T
++#endif
++
+ typedef struct {
+-    size_t bytes;
+-    size_t kb;
++    squid_off_t bytes;
++    squid_off_t kb;
+ } kb_t;
+ 
+ typedef struct {
+@@ -90,7 +110,6 @@
+ typedef struct _SquidConfig2 SquidConfig2;
+ typedef struct _close_handler close_handler;
+ typedef struct _dread_ctrl dread_ctrl;
+-typedef struct _dnsserver_t dnsserver_t;
+ typedef struct _dwrite_q dwrite_q;
+ typedef struct _ETag ETag;
+ typedef struct _fde fde;
+@@ -160,6 +179,8 @@
+ typedef struct _StatCounters StatCounters;
+ typedef struct _tlv tlv;
+ typedef struct _storeSwapLogData storeSwapLogData;
++typedef struct _storeSwapLogDataOld storeSwapLogDataOld;
++typedef struct _storeSwapLogHeader storeSwapLogHeader;
+ typedef struct _authConfig authConfig;
+ typedef struct _cacheSwap cacheSwap;
+ typedef struct _StatHist StatHist;
+@@ -275,8 +296,8 @@
+ typedef storeIOState *STOBJCREATE(SwapDir *, StoreEntry *, STFNCB *, STIOCB *, void *);
+ typedef storeIOState *STOBJOPEN(SwapDir *, StoreEntry *, STFNCB *, STIOCB *, void *);
+ typedef void STOBJCLOSE(SwapDir *, storeIOState *);
+-typedef void STOBJREAD(SwapDir *, storeIOState *, char *, size_t, off_t, STRCB *, void *);
+-typedef void STOBJWRITE(SwapDir *, storeIOState *, char *, size_t, off_t, FREE *);
++typedef void STOBJREAD(SwapDir *, storeIOState *, char *, size_t, squid_off_t, STRCB *, void *);
++typedef void STOBJWRITE(SwapDir *, storeIOState *, char *, size_t, squid_off_t, FREE *);
+ typedef void STOBJUNLINK(SwapDir *, StoreEntry *);
+ 
+ typedef void STLOGOPEN(SwapDir *);
+@@ -322,7 +343,7 @@
+ typedef const char *AUTHSCONNLASTHEADER(auth_user_request_t *);
+ 
+ /* append/vprintf's for Packer */
+-typedef void (*append_f) (void *, const char *buf, int size);
++typedef void (*append_f) (void *, const char *buf, size_t size);
+ #if STDC_HEADERS
+ typedef void (*vprintf_f) (void *, const char *fmt, va_list args);
+ #else
+@@ -336,13 +357,13 @@
+ typedef int Ctx;
+ 
+ /* in case we want to change it later */
+-typedef ssize_t mb_size_t;
++typedef int mb_size_t;
+ 
+ /* iteration for HttpHdrRange */
+ typedef int HttpHdrRangePos;
+ 
+ /*iteration for headers; use HttpHeaderPos as opaque type, do not interpret */
+-typedef ssize_t HttpHeaderPos;
++typedef int HttpHeaderPos;
+ 
+ /* big mask for http headers */
+ typedef char HttpHeaderMask[8];
--- squid-2.5.9.orig/debian/patches/00list
+++ squid-2.5.9/debian/patches/00list
@@ -0,0 +1,10 @@
+01-cf.data.debian
+02-dfl-error-dir
+03-no-append-domain-localhost
+04-smb-auth
+05-syslog
+06-unlinkd
+38-aufs-fixes
+09-enable-large-files
+22-cachemgr-acl
+37-setcookie
--- squid-2.5.9.orig/debian/patches/31-wccp-buffer-overflow.dpatch
+++ squid-2.5.9/debian/patches/31-wccp-buffer-overflow.dpatch
@@ -0,0 +1,19 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 31-wccp-buffer-overflow.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/wccp.c /tmp/dpep.2fMAVb/squid-2.5.7/src/wccp.c
+--- squid-2.5.7/src/wccp.c	2005-01-29 17:47:08.000000000 +0100
++++ /tmp/dpep.2fMAVb/squid-2.5.7/src/wccp.c	2005-01-29 17:47:29.000000000 +0100
+@@ -225,7 +225,7 @@
+ 
+     len = recvfrom(sock,
+ 	(void *) &wccp_i_see_you,
+-	WCCP_RESPONSE_SIZE,
++	sizeof(wccp_i_see_you),
+ 	0,
+ 	(struct sockaddr *) &from,
+ 	&from_len);
--- squid-2.5.9.orig/debian/patches/32-response-splitting.dpatch
+++ squid-2.5.9/debian/patches/32-response-splitting.dpatch
@@ -0,0 +1,224 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 32-response-splitting.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/http.c /tmp/dpep.dNoIWj/squid-2.5.7/src/http.c
+--- squid-2.5.7/src/http.c	2004-10-07 20:43:44.000000000 +0200
++++ /tmp/dpep.dNoIWj/squid-2.5.7/src/http.c	2005-01-29 17:48:55.000000000 +0100
+@@ -523,40 +523,23 @@
+     HttpReply *reply = mem->reply;
+     int clen;
+     debug(11, 3) ("httpPconnTransferDone: FD %d\n", httpState->fd);
+-    /*
+-     * If we didn't send a keep-alive request header, then this
+-     * can not be a persistent connection.
+-     */
+-    if (!httpState->flags.keepalive)
+-	return 0;
+-    /*
+-     * What does the reply have to say about keep-alive?
+-     */
+-    /*
+-     * XXX BUG?
+-     * If the origin server (HTTP/1.0) does not send a keep-alive
+-     * header, but keeps the connection open anyway, what happens?
+-     * We'll return here and http.c waits for an EOF before changing
+-     * store_status to STORE_OK.   Combine this with ENTRY_FWD_HDR_WAIT
+-     * and an error status code, and we might have to wait until
+-     * the server times out the socket.
+-     */
+-    if (!reply->keep_alive)
+-	return 0;
+     debug(11, 5) ("httpPconnTransferDone: content_length=%d\n",
+ 	reply->content_length);
+     /* If we haven't seen the end of reply headers, we are not done */
+     if (httpState->reply_hdr_state < 2)
+ 	return 0;
+     clen = httpReplyBodySize(httpState->request->method, reply);
+-    /* If there is no message body, we can be persistent */
+-    if (0 == clen)
+-	return 1;
+     /* If the body size is unknown we must wait for EOF */
+     if (clen < 0)
+ 	return 0;
++    /* Barf if we got more than we asked for */
++    if (mem->inmem_hi > clen + reply->hdr_sz)
++	return -1;
++    /* If there is no message body, we can be persistent */
++    if (0 == clen)
++	return 1;
+     /* If the body size is known, we must wait until we've gotten all of it.  */
+-    if (mem->inmem_hi < reply->content_length + reply->hdr_sz)
++    if (mem->inmem_hi < clen + reply->hdr_sz)
+ 	return 0;
+     /* We got it all */
+     return 1;
+@@ -700,22 +683,60 @@
+ 	     * in that case, the server FD should already be closed.
+ 	     * there's nothing for us to do.
+ 	     */
+-	    (void) 0;
+-	} else if (httpPconnTransferDone(httpState)) {
+-	    /* yes we have to clear all these! */
+-	    commSetDefer(fd, NULL, NULL);
+-	    commSetTimeout(fd, -1, NULL, NULL);
+-	    commSetSelect(fd, COMM_SELECT_READ, NULL, NULL, 0);
++	    return;
++	}
++	switch (httpPconnTransferDone(httpState)) {
++	case 1:
++	    {
++		int keep_alive = 1;
++		/*
++		 * If we didn't send a keep-alive request header, then this
++		 * can not be a persistent connection.
++		 */
++		if (!httpState->flags.keepalive)
++		    keep_alive = 0;
++		/*
++		 * What does the reply have to say about keep-alive?
++		 */
++		if (!entry->mem_obj->reply->keep_alive)
++		    keep_alive = 0;
++		/*
++		 * Verify that the connection is clean
++		 */
++		if (len == read_sz) {
++		    statCounter.syscalls.sock.reads++;
++		    len = FD_READ_METHOD(fd, buf, SQUID_TCP_SO_RCVBUF);
++		    if ((len < 0 && !ignoreErrno(errno)) || len == 0) {
++			keep_alive = 0;
++		    } else if (len > 0) {
++			debug(11, 1) ("httpReadReply: Excess data from \"%s %s\"\n",
++			    RequestMethodStr[httpState->orig_request->method],
++			    storeUrl(entry));
++			storeAppend(entry, buf, len);
++			keep_alive = 0;
++		    }
++		}
++		if (keep_alive) {
++		    /* yes we have to clear all these! */
++		    commSetDefer(fd, NULL, NULL);
++		    commSetTimeout(fd, -1, NULL, NULL);
++		    commSetSelect(fd, COMM_SELECT_READ, NULL, NULL, 0);
+ #if DELAY_POOLS
+-	    delayClearNoDelay(fd);
++		    delayClearNoDelay(fd);
+ #endif
+-	    comm_remove_close_handler(fd, httpStateFree, httpState);
+-	    fwdUnregister(fd, httpState->fwd);
+-	    pconnPush(fd, request->host, request->port);
+-	    fwdComplete(httpState->fwd);
+-	    httpState->fd = -1;
+-	    httpStateFree(fd, httpState);
+-	} else {
++		    comm_remove_close_handler(fd, httpStateFree, httpState);
++		    fwdUnregister(fd, httpState->fwd);
++		    pconnPush(fd, request->host, request->port);
++		    fwdComplete(httpState->fwd);
++		    httpState->fd = -1;
++		    httpStateFree(fd, httpState);
++		} else {
++		    fwdComplete(httpState->fwd);
++		    comm_close(fd);
++		}
++	    }
++	    return;
++	case 0:
+ 	    /* Wait for more data or EOF condition */
+ 	    if (httpState->flags.keepalive_broken) {
+ 		commSetTimeout(fd, 10, NULL, NULL);
+@@ -723,6 +744,18 @@
+ 		commSetTimeout(fd, Config.Timeout.read, NULL, NULL);
+ 	    }
+ 	    commSetSelect(fd, COMM_SELECT_READ, httpReadReply, httpState, 0);
++	    return;
++	case -1:
++	    /* Server is nasty on us. Shut down */
++	    debug(11, 1) ("httpReadReply: Excess data from \"%s %s\"\n",
++		RequestMethodStr[httpState->orig_request->method],
++		storeUrl(entry));
++	    fwdComplete(httpState->fwd);
++	    comm_close(fd);
++	    return;
++	default:
++	    fatal("Unexpected httpPconnTransferDone() status\n");
++	    break;
+ 	}
+     }
+ }
+diff -urNad squid-2.5.7/src/HttpReply.c /tmp/dpep.dNoIWj/squid-2.5.7/src/HttpReply.c
+--- squid-2.5.7/src/HttpReply.c	2004-10-05 23:31:25.000000000 +0200
++++ /tmp/dpep.dNoIWj/squid-2.5.7/src/HttpReply.c	2005-01-29 17:48:55.000000000 +0100
+@@ -450,7 +450,7 @@
+  * Returns the body size of a HTTP response
+  */
+ int
+-httpReplyBodySize(method_t method, HttpReply * reply)
++httpReplyBodySize(method_t method, const HttpReply * reply)
+ {
+     if (METHOD_HEAD == method)
+ 	return 0;
+diff -urNad squid-2.5.7/src/protos.h /tmp/dpep.dNoIWj/squid-2.5.7/src/protos.h
+--- squid-2.5.7/src/protos.h	2004-10-06 00:34:42.000000000 +0200
++++ /tmp/dpep.dNoIWj/squid-2.5.7/src/protos.h	2005-01-29 17:48:55.000000000 +0100
+@@ -504,7 +504,7 @@
+ extern time_t httpReplyExpires(const HttpReply * rep);
+ extern int httpReplyHasCc(const HttpReply * rep, http_hdr_cc_type type);
+ extern void httpRedirectReply(HttpReply *, http_status, const char *);
+-extern int httpReplyBodySize(method_t, HttpReply *);
++extern int httpReplyBodySize(method_t, const HttpReply *);
+ 
+ /* Http Request */
+ extern request_t *requestCreate(method_t, protocol_t, const char *urlpath);
+diff -urNad squid-2.5.7/src/store.c /tmp/dpep.dNoIWj/squid-2.5.7/src/store.c
+--- squid-2.5.7/src/store.c	2004-05-31 23:28:30.000000000 +0200
++++ /tmp/dpep.dNoIWj/squid-2.5.7/src/store.c	2005-01-29 17:48:55.000000000 +0100
+@@ -940,6 +940,7 @@
+ storeEntryValidLength(const StoreEntry * e)
+ {
+     int diff;
++    int clen;
+     const HttpReply *reply;
+     assert(e->mem_obj != NULL);
+     reply = e->mem_obj->reply;
+@@ -948,31 +949,18 @@
+ 	objectLen(e));
+     debug(20, 5) ("storeEntryValidLength:         hdr_sz = %d\n",
+ 	reply->hdr_sz);
++    clen = httpReplyBodySize(e->mem_obj->method, reply);
+     debug(20, 5) ("storeEntryValidLength: content_length = %d\n",
+-	reply->content_length);
+-    if (reply->content_length < 0) {
++	clen);
++    if (clen < 0) {
+ 	debug(20, 5) ("storeEntryValidLength: Unspecified content length: %s\n",
+ 	    storeKeyText(e->hash.key));
+ 	return 1;
+     }
+-    if (reply->hdr_sz == 0) {
+-	debug(20, 5) ("storeEntryValidLength: Zero header size: %s\n",
+-	    storeKeyText(e->hash.key));
+-	return 1;
+-    }
+-    if (e->mem_obj->method == METHOD_HEAD) {
+-	debug(20, 5) ("storeEntryValidLength: HEAD request: %s\n",
+-	    storeKeyText(e->hash.key));
+-	return 1;
+-    }
+-    if (reply->sline.status == HTTP_NOT_MODIFIED)
+-	return 1;
+-    if (reply->sline.status == HTTP_NO_CONTENT)
+-	return 1;
+-    diff = reply->hdr_sz + reply->content_length - objectLen(e);
++    diff = reply->hdr_sz + clen - objectLen(e);
+     if (diff == 0)
+ 	return 1;
+-    debug(20, 3) ("storeEntryValidLength: %d bytes too %s; '%s'\n",
++    debug(20, 2) ("storeEntryValidLength: %d bytes too %s; '%s'\n",
+ 	diff < 0 ? -diff : diff,
+ 	diff < 0 ? "big" : "small",
+ 	storeKeyText(e->hash.key));
--- squid-2.5.9.orig/debian/patches/07-manpage.dpatch
+++ squid-2.5.9/debian/patches/07-manpage.dpatch
@@ -0,0 +1,37 @@
+#! /bin/sh -e
+## 07-manpage.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fixed wrong reference to /etc/squid/squid.conf
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch}"
+
+case "$1" in
+       -patch) patch $patch_opts -p1 < $0;;
+       -unpatch) patch $patch_opts -p1 -R < $0;;
+        *)
+                echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+                exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.3/doc/squid.8 squid-2.5.3/doc/squid.8
+--- /home/gangitano/debian/squid/squid-2.5.3/doc/squid.8	2000-12-18 22:54:18.000000000 +0100
++++ squid-2.5.3/doc/squid.8	2003-07-07 03:25:57.000000000 +0200
+@@ -98,7 +98,7 @@
+ .IP -Y
+ Only return UDP_HIT or UDP_MISS_NOFETCH during fast reload.   
+ .SH FILES
+-.I /etc/squid/squid.conf
++.I /etc/squid.conf
+ .RS
+ The main configuration file.  You must initially make 
+ changes to this file for 
--- squid-2.5.9.orig/debian/patches/04-smb-auth.dpatch
+++ squid-2.5.9/debian/patches/04-smb-auth.dpatch
@@ -0,0 +1,40 @@
+#! /bin/sh -e
+## 04-smb-auth.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Read password with '-r' so backslashes work
+## DP: Patch awk regexp to read correct field from nmblookup
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+case "$1" in
+    -patch) patch -f --no-backup-if-mismatch -p0 < $0;;
+    -unpatch) patch -f --no-backup-if-mismatch -R -p0 < $0;;
+    *)
+	echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+	exit 1;;
+esac
+
+exit 0
+--- helpers/basic_auth/SMB/smb_auth.sh	2001-01-08 00:36:46.000000000 +0100
++++ helpers/basic_auth/SMB/smb_auth.sh	2002-10-10 19:45:33.000000000 +0200
+@@ -24,7 +24,7 @@
+ read AUTHSHARE
+ read AUTHFILE
+ read SMBUSER
+-read SMBPASS
++read -r SMBPASS
+ 
+ # Find domain controller
+ echo "Domain name: $DOMAINNAME"
+@@ -47,7 +47,7 @@
+   addropt=""
+ fi
+ echo "Query address options: $addropt"
+-dcip=`$SAMBAPREFIX/bin/nmblookup $addropt "$PASSTHROUGH#1c" | awk '/^[0-9.]+ / { print $1 ; exit }'`
++dcip=`$SAMBAPREFIX/bin/nmblookup $addropt "$PASSTHROUGH#1c" | awk '/^[0-9.]+\..+ / { print $1 ; exit }'`
+ echo "Domain controller IP address: $dcip"
+ [ -n "$dcip" ] || exit 1
+ 
--- squid-2.5.9.orig/debian/patches/35-empty-acls.dpatch
+++ squid-2.5.9/debian/patches/35-empty-acls.dpatch
@@ -0,0 +1,93 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 35-empty-acls.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/lib/splay.c /tmp/dpep.LlcH5m/squid-2.5.7/lib/splay.c
+--- squid-2.5.7/lib/splay.c	2004-01-15 08:38:35.000000000 +0100
++++ /tmp/dpep.LlcH5m/squid-2.5.7/lib/splay.c	2005-02-01 18:06:51.000000000 +0100
+@@ -104,6 +104,8 @@
+ void
+ splay_destroy(splayNode * top, SPLAYFREE * free_func)
+ {
++    if (!top)
++	return;
+     if (top->left)
+ 	splay_destroy(top->left, free_func);
+     if (top->right)
+diff -urNad squid-2.5.7/src/acl.c /tmp/dpep.LlcH5m/squid-2.5.7/src/acl.c
+--- squid-2.5.7/src/acl.c	2004-09-25 13:56:16.000000000 +0200
++++ /tmp/dpep.LlcH5m/squid-2.5.7/src/acl.c	2005-02-01 18:06:51.000000000 +0100
+@@ -557,11 +557,9 @@
+ 	} else {
+ 	    /* assume its time-of-day spec */
+ 	    if (sscanf(t, "%d:%d-%d:%d", &h1, &m1, &h2, &m2) < 4) {
+-		debug(28, 0) ("%s line %d: %s\n",
++		fatalf("aclParseTimeSpec: ERROR: Bad time range in"
++		    "%s line %d: %s\n",
+ 		    cfg_filename, config_lineno, config_input_line);
+-		debug(28, 0) ("aclParseTimeSpec: IGNORING Bad time range\n");
+-		memFree(q, MEM_ACL_TIME_DATA);
+-		return;
+ 	    }
+ 	    q = memAllocate(MEM_ACL_TIME_DATA);
+ 	    q->start = h1 * 60 + m1;
+@@ -569,11 +567,9 @@
+ 	    q->weekbits = weekbits;
+ 	    weekbits = 0;
+ 	    if (q->start > q->stop) {
+-		debug(28, 0) ("%s line %d: %s\n",
++		fatalf("aclParseTimeSpec: ERROR: Reversed time range in"
++		    "%s line %d: %s\n",
+ 		    cfg_filename, config_lineno, config_input_line);
+-		debug(28, 0) ("aclParseTimeSpec: IGNORING Reversed time range\n");
+-		memFree(q, MEM_ACL_TIME_DATA);
+-		return;
+ 	    }
+ 	    if (q->weekbits == 0)
+ 		q->weekbits = ACL_ALLWEEK;
+@@ -885,22 +881,22 @@
+ 	break;
+     case ACL_PROXY_AUTH:
+ 	if (authenticateSchemeCount() == 0) {
+-	    debug(28, 0) ("aclParseAclLine: IGNORING: Proxy Auth ACL '%s' \
+-because no authentication schemes were compiled.\n", A->cfgline);
++	    fatalf("Invalid Proxy Auth ACL '%s' "
++		"because no authentication schemes were compiled.\n", A->cfgline);
+ 	} else if (authenticateActiveSchemeCount() == 0) {
+-	    debug(28, 0) ("aclParseAclLine: IGNORING: Proxy Auth ACL '%s' \
+-because no authentication schemes are fully configured.\n", A->cfgline);
++	    fatalf("Invalid Proxy Auth ACL '%s' "
++		"because no authentication schemes are fully configured.\n", A->cfgline);
+ 	} else {
+ 	    aclParseUserList(&A->data);
+ 	}
+ 	break;
+     case ACL_PROXY_AUTH_REGEX:
+ 	if (authenticateSchemeCount() == 0) {
+-	    debug(28, 0) ("aclParseAclLine: IGNORING: Proxy Auth ACL '%s' \
+-because no authentication schemes were compiled.\n", A->cfgline);
++	    fatalf("Invalid Proxy Auth ACL '%s' "
++		"because no authentication schemes were compiled.\n", A->cfgline);
+ 	} else if (authenticateActiveSchemeCount() == 0) {
+-	    debug(28, 0) ("aclParseAclLine: IGNORING: Proxy Auth ACL '%s' \
+-because no authentication schemes are fully configured.\n", A->cfgline);
++	    fatalf("Invalid Proxy Auth ACL '%s' "
++		"because no authentication schemes are fully configured.\n", A->cfgline);
+ 	} else {
+ 	    aclParseRegexList(&A->data);
+ 	}
+@@ -930,10 +926,8 @@
+     if (!new_acl)
+ 	return;
+     if (A->data == NULL) {
+-	debug(28, 0) ("aclParseAclLine: IGNORING invalid ACL: %s\n",
++	debug(28, 0) ("aclParseAclLine: WARNING: empty ACL: %s\n",
+ 	    A->cfgline);
+-	memFree(A, MEM_ACL);
+-	return;
+     }
+     /* append */
+     while (*head)
--- squid-2.5.9.orig/debian/patches/00README
+++ squid-2.5.9/debian/patches/00README
@@ -0,0 +1,24 @@
+
+Upstream patches against the release, that will be integrated into
+the next stable release (http://www.squid-cache.org/Versions/v2/2.5/bugs/)
+
+[currently none]
+
+Debian specific patches:
+All patches that were in the debian squid-2.3.4 and squid-2.4.7 have been
+applied to squid-2.5.1 as well, if they hadn't been integrated yet.
+
+cf.data.debian.patch	Debian specific squid.conf patches
+dfl-error-dir.patch	Default error dir is under /usr/lib/squid for Debian
+no_append_domain_localhost.patch
+			Don't apply "append_domain" setting to "localhost"
+			in unqualified URLs.
+smb_auth.patch		Read password with '-r' so backslashes work
+			Patch awk regexp to read correct field from nmblookup
+syslog.patch		Log to daemon.log instead of local4.log
+unlinkd.patch		Only run unlinkd for diskd and ufs storage methods
+
+Not applied (yet?):
+
+vms-ftp.patch.NOT-YET	Not finished and not working
+
--- squid-2.5.9.orig/debian/patches/33-header-parsing.dpatch
+++ squid-2.5.9/debian/patches/33-header-parsing.dpatch
@@ -0,0 +1,1087 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 33-header-parsing.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/errors/Bulgarian/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Bulgarian/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Bulgarian/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Bulgarian/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Catalan/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Catalan/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Catalan/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Catalan/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Czech/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Czech/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Czech/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Czech/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Danish/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Danish/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Danish/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Danish/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Dutch/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Dutch/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Dutch/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Dutch/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/English/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/English/ERR_INVALID_RESP
+--- squid-2.5.7/errors/English/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/English/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Estonian/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Estonian/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Estonian/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Estonian/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Finnish/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Finnish/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Finnish/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Finnish/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/French/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/French/ERR_INVALID_RESP
+--- squid-2.5.7/errors/French/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/French/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/German/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/German/ERR_INVALID_RESP
+--- squid-2.5.7/errors/German/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/German/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Hebrew/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Hebrew/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Hebrew/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Hebrew/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Hungarian/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Hungarian/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Hungarian/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Hungarian/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Italian/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Italian/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Italian/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Italian/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERRORE: La URL richiesta non pu&ograve; essere recuperata</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERRORE</H1>
++<H2>La URL richiesta non pu&ograve; essere recuperata</H2>
++<HR noshade size="1px">
++<P>
++Mentre si elaborava la richiesta:
++<PRE>
++%R
++</PRE>
++<P>
++&Egrave; avvenuto il seguente errore:
++<UL>
++<LI>
++<STRONG>
++Risposta non valida
++</STRONG>
++</UL>
++
++<P>
++Il messaggio contenente la risposta HTTP ricevuto dal server che si sta
++contattando non pu&ograve; essere interpretato od &egrave; stato in qualche modo alterato.
++Si prega di contattare un operatore del sito. Se necessario, l'amministratore della vostra
++cache potr&agrave; fornirvi maggiori dettagli sull'esatta natura del problema.
++
++<P>L'amministratore della vostra cache &egrave; <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Japanese/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Japanese/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Japanese/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Japanese/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Russian-1251/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Russian-1251/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Russian-1251/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Russian-1251/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Russian-koi8-r/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Russian-koi8-r/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Russian-koi8-r/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Russian-koi8-r/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Serbian/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Serbian/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Serbian/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Serbian/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Simplify_Chinese/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Simplify_Chinese/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Simplify_Chinese/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Simplify_Chinese/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Slovak/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Slovak/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Slovak/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Slovak/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Spanish/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Spanish/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Spanish/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Spanish/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Swedish/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Swedish/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Swedish/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Swedish/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,30 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD>
++<TITLE>Fel: Beg&auml;rd URL kunde inte h&auml;mtas</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff; font-family:verdana,sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>FEL</H1>
++<H2>Beg&auml;rd URL kunde inte h&auml;mtas</H2>
++<HR noshade size="1px">
++<P>
++Vid f&ouml;rs&ouml;ket att h&auml;mta URL:
++<A HREF="%U">%U</A>
++<P>
++Mottogs f&ouml;ljande fel:
++<UL>
++<LI>
++<STRONG>
++Felaktigt svarsmeddelande
++</STRONG>
++</UL>
++
++<P>
++HTTP svarsmeddelandet ifr&aring;n den kontaktade servern &auml;r felaktigt och
++kunde inte tolkas. V&auml;nligen kontakta den ansvariga f&ouml;r webbservern ifr&aring;ga.
++Din cacheserver administrat&ouml;r man eventuellt ge dig mera information om
++det specifika problemet med denna sida.
++</P>
++
++<P>Din cacheserver administrat&ouml;r &auml;r <A HREF="mailto:%w">%w</A>. 
++</P>
++
+diff -urNad squid-2.5.7/errors/Traditional_Chinese/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Traditional_Chinese/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Traditional_Chinese/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Traditional_Chinese/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/errors/Turkish/ERR_INVALID_RESP /tmp/dpep.hUyGIM/squid-2.5.7/errors/Turkish/ERR_INVALID_RESP
+--- squid-2.5.7/errors/Turkish/ERR_INVALID_RESP	1970-01-01 01:00:00.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/errors/Turkish/ERR_INVALID_RESP	2005-01-29 17:50:30.000000000 +0100
+@@ -0,0 +1,29 @@
++<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
++<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
++<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
++<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
++</HEAD><BODY>
++<H1>ERROR</H1>
++<H2>The requested URL could not be retrieved</H2>
++<HR noshade size="1px">
++<P>
++While trying to process the request:
++<PRE>
++%R
++</PRE>
++<P>
++The following error was encountered:
++<UL>
++<LI>
++<STRONG>
++Invalid Response
++</STRONG>
++</UL>
++
++<P>
++The HTTP Response message received from the contacted server
++could not be understood or was otherwise malformed. Please contact
++the site operator. Your cache administrator may be able to provide
++you with more details about the exact nature of the problem if needed.
++
++<P>Your cache administrator is <A HREF="mailto:%w">%w</A>. 
+diff -urNad squid-2.5.7/src/cf.data.pre /tmp/dpep.hUyGIM/squid-2.5.7/src/cf.data.pre
+--- squid-2.5.7/src/cf.data.pre	2005-01-29 17:50:15.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/cf.data.pre	2005-01-29 17:50:30.000000000 +0100
+@@ -4039,4 +4039,20 @@
+ 	until all the child processes have been started.
+ DOC_END
+ 
++NAME: relaxed_header_parser
++COMMENT: on|off
++TYPE: onoff
++LOC: Config.onoff.relaxed_header_parser
++DEFAULT: on
++DOC_START
++	Set this to off if you want Squid to be strict about
++	the HTTP protocol syntax and reject non-compliant requests
++	or responses.
++
++	In the default "on" setting Squid accepts certain forms
++	of non-compliant HTTP messages where it is unambigous
++	what the sending application indended even if the message
++	is not correctly formatted. The messages is then normalized
++	to the correct form when forwarded by Squid.
++DOC_END
+ EOF
+diff -urNad squid-2.5.7/src/client_side.c /tmp/dpep.hUyGIM/squid-2.5.7/src/client_side.c
+--- squid-2.5.7/src/client_side.c	2005-01-29 17:50:15.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/client_side.c	2005-01-29 17:50:30.000000000 +0100
+@@ -3059,13 +3059,21 @@
+ 		errorAppendEntry(http->entry, err);
+ 		safe_free(prefix);
+ 		break;
+-	    } else {
+-		/* compile headers */
+-		/* we should skip request line! */
+-		if (!httpRequestParseHeader(request, prefix + req_line_sz))
+-		    debug(33, 1) ("Failed to parse request headers: %s\n%s\n",
+-			http->uri, prefix);
+-		/* continue anyway? */
++	    }
++	    /* compile headers */
++	    /* we should skip request line! */
++	    if (!httpRequestParseHeader(request, prefix + req_line_sz)) {
++		debug(33, 1) ("Failed to parse request headers: %s\n%s\n",
++		    http->uri, prefix);
++		err = errorCon(ERR_INVALID_URL, HTTP_BAD_REQUEST);
++		err->src_addr = conn->peer.sin_addr;
++		err->url = xstrdup(http->uri);
++		http->al.http.code = err->http_status;
++		http->log_type = LOG_TCP_DENIED;
++		http->entry = clientCreateStoreEntry(http, method, null_request_flags);
++		errorAppendEntry(http->entry, err);
++		safe_free(prefix);
++		break;
+ 	    }
+ 	    request->flags.accelerated = http->flags.accel;
+ 	    if (!http->flags.internal) {
+diff -urNad squid-2.5.7/src/enums.h /tmp/dpep.hUyGIM/squid-2.5.7/src/enums.h
+--- squid-2.5.7/src/enums.h	2004-10-05 23:31:26.000000000 +0200
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/enums.h	2005-01-29 17:50:30.000000000 +0100
+@@ -93,6 +93,7 @@
+     ERR_ONLY_IF_CACHED_MISS,	/* failure to satisfy only-if-cached request */
+     ERR_TOO_BIG,
+     TCP_RESET,
++    ERR_INVALID_RESP,
+     ERR_MAX
+ } err_type;
+ 
+diff -urNad squid-2.5.7/src/http.c /tmp/dpep.hUyGIM/squid-2.5.7/src/http.c
+--- squid-2.5.7/src/http.c	2005-01-29 17:50:15.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/http.c	2005-01-29 17:50:30.000000000 +0100
+@@ -416,6 +416,7 @@
+ 	debug(11, 3) ("httpProcessReplyHeader: Non-HTTP-compliant header: '%s'\n", httpState->reply_hdr.buf);
+ 	httpState->reply_hdr_state += 2;
+ 	memBufClean(&httpState->reply_hdr);
++	httpBuildVersion(&reply->sline.version, 0, 9);
+ 	reply->sline.status = HTTP_INVALID_HEADER;
+ 	return;
+     }
+@@ -449,6 +450,11 @@
+     /* Parse headers into reply structure */
+     /* what happens if we fail to parse here? */
+     httpReplyParse(reply, httpState->reply_hdr.buf, hdr_size);
++    if (reply->sline.status >= HTTP_INVALID_HEADER) {
++	debug(11, 3) ("httpProcessReplyHeader: Non-HTTP-compliant header: '%s'\n", httpState->reply_hdr.buf);
++	memBufClean(&httpState->reply_hdr);
++	return;
++    }
+     storeTimestampsSet(entry);
+     /* Check if object is cacheable or not based on reply code */
+     debug(11, 3) ("httpProcessReplyHeader: HTTP CODE: %d\n", reply->sline.status);
+@@ -645,6 +651,13 @@
+ 	    err->request = requestLink((request_t *) request);
+ 	    fwdFail(httpState->fwd, err);
+ 	    httpState->fwd->flags.dont_retry = 1;
++	} else if (entry->mem_obj->reply->sline.status == HTTP_INVALID_HEADER && !(entry->mem_obj->reply->sline.version.major == 0 && entry->mem_obj->reply->sline.version.minor == 9)) {
++	    ErrorState *err;
++	    storeEntryReset(entry);
++	    err = errorCon(ERR_INVALID_RESP, HTTP_BAD_GATEWAY);
++	    err->request = requestLink((request_t *) request);
++	    fwdFail(httpState->fwd, err);
++	    httpState->fwd->flags.dont_retry = 1;
+ 	} else {
+ 	    fwdComplete(httpState->fwd);
+ 	}
+@@ -653,18 +666,29 @@
+     } else {
+ 	if (httpState->reply_hdr_state < 2) {
+ 	    httpProcessReplyHeader(httpState, buf, len);
+-	    if (entry->mem_obj->reply->sline.status == HTTP_HEADER_TOO_LARGE) {
+-		ErrorState *err;
+-		storeEntryReset(entry);
+-		err = errorCon(ERR_TOO_BIG, HTTP_BAD_GATEWAY);
+-		err->request = requestLink((request_t *) request);
+-		fwdFail(httpState->fwd, err);
+-		httpState->fwd->flags.dont_retry = 1;
+-		comm_close(fd);
+-		return;
+-	    }
+ 	    if (httpState->reply_hdr_state == 2) {
+ 		http_status s = entry->mem_obj->reply->sline.status;
++		if (s == HTTP_HEADER_TOO_LARGE) {
++		    ErrorState *err;
++		    debug(11, 1) ("WARNING: %s:%d: HTTP header too large\n", __FILE__, __LINE__);
++		    storeEntryReset(entry);
++		    err = errorCon(ERR_TOO_BIG, HTTP_BAD_GATEWAY);
++		    err->request = requestLink((request_t *) request);
++		    fwdFail(httpState->fwd, err);
++		    httpState->fwd->flags.dont_retry = 1;
++		    comm_close(fd);
++		    return;
++		}
++		if (s == HTTP_INVALID_HEADER && !(entry->mem_obj->reply->sline.version.major == 0 && entry->mem_obj->reply->sline.version.minor == 9)) {
++		    ErrorState *err;
++		    storeEntryReset(entry);
++		    err = errorCon(ERR_INVALID_RESP, HTTP_BAD_GATEWAY);
++		    err->request = requestLink((request_t *) request);
++		    fwdFail(httpState->fwd, err);
++		    httpState->fwd->flags.dont_retry = 1;
++		    comm_close(fd);
++		    return;
++		}
+ #if WIP_FWD_LOG
+ 		fwdStatus(httpState->fwd, s);
+ #endif
+diff -urNad squid-2.5.7/src/HttpHeader.c /tmp/dpep.hUyGIM/squid-2.5.7/src/HttpHeader.c
+--- squid-2.5.7/src/HttpHeader.c	2004-09-01 15:55:47.000000000 +0200
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/HttpHeader.c	2005-01-29 17:50:30.000000000 +0100
+@@ -404,40 +404,79 @@
+ int
+ httpHeaderParse(HttpHeader * hdr, const char *header_start, const char *header_end)
+ {
+-    const char *field_start = header_start;
+-    HttpHeaderEntry *e;
++    const char *field_ptr = header_start;
++    HttpHeaderEntry *e, *e2;
+ 
+     assert(hdr);
+     assert(header_start && header_end);
+     debug(55, 7) ("parsing hdr: (%p)\n%s\n", hdr, getStringPrefix(header_start, header_end));
+     HttpHeaderStats[hdr->owner].parsedCount++;
+-    /* commonn format headers are "<name>:[ws]<value>" lines delimited by <CRLF> */
+-    while (field_start < header_end) {
++    if (memchr(header_start, '\0', header_end - header_start)) {
++	debug(55, 1) ("WARNING: HTTP header contains NULL characters {%s}\n",
++	    getStringPrefix(header_start, header_end));
++	return httpHeaderReset(hdr);
++    }
++    /* common format headers are "<name>:[ws]<value>" lines delimited by <CRLF>.
++     * continuation lines start with a (single) space or tab */
++    while (field_ptr < header_end) {
++	const char *field_start = field_ptr;
+ 	const char *field_end;
+-	const char *field_ptr = field_start;
+ 	do {
+-	    field_end = field_ptr = field_ptr + strcspn(field_ptr, "\r\n");
+-	    /* skip CRLF */
+-	    if (*field_ptr == '\r')
+-		field_ptr++;
+-	    if (*field_ptr == '\n')
+-		field_ptr++;
++	    const char *this_line = field_ptr;
++	    field_ptr = memchr(field_ptr, '\n', header_end - field_ptr);
++	    if (!field_ptr)
++		return httpHeaderReset(hdr);	/* missing <LF> */
++	    field_end = field_ptr;
++	    field_ptr++;	/* Move to next line */
++	    if (field_end > this_line && field_end[-1] == '\r') {
++		field_end--;	/* Ignore CR LF */
++		/* Ignore CR CR LF in relaxed mode */
++		if (Config.onoff.relaxed_header_parser && field_end > this_line + 1 && field_end[-1] == '\r')
++		    field_end--;
++	    }
++	    /* Barf on stray CR characters */
++	    if (memchr(this_line, '\r', field_end - this_line)) {
++		debug(55, 1) ("WARNING: suspicious CR characters in HTTP header near {%s}\n",
++		    getStringPrefix(field_start, header_end));
++		return httpHeaderReset(hdr);
++	    }
++	    if (this_line + 1 == field_end && this_line > field_start) {
++		debug(55, 1) ("WARNING: Blank continuation line in HTTP header near {%s}\n",
++		    getStringPrefix(field_start, header_end));
++		return httpHeaderReset(hdr);
++	    }
++	} while (field_ptr < header_end && (*field_ptr == ' ' || *field_ptr == '\t'));
++	if (field_start == field_end) {
++	    if (field_ptr < header_end) {
++		debug(55, 1) ("WARNING: unparseable HTTP header field near {%s}\n",
++		    getStringPrefix(field_start, header_end));
++		return httpHeaderReset(hdr);
++	    }
++	    break;		/* terminating blank line */
+ 	}
+-	while (*field_ptr == ' ' || *field_ptr == '\t');
+-	if (!*field_end || field_end > header_end)
+-	    return httpHeaderReset(hdr);	/* missing <CRLF> */
+ 	e = httpHeaderEntryParseCreate(field_start, field_end);
+-	if (e != NULL)
+-	    httpHeaderAddEntry(hdr, e);
+-	else
+-	    debug(55, 2) ("warning: ignoring unparseable http header field near '%s'\n",
+-		getStringPrefix(field_start, field_end));
+-	field_start = field_end;
+-	/* skip CRLF */
+-	if (*field_start == '\r')
+-	    field_start++;
+-	if (*field_start == '\n')
+-	    field_start++;
++	if (NULL == e) {
++	    debug(55, 1) ("WARNING: unparseable HTTP header field near {%s}\n",
++		getStringPrefix(field_start, header_end));
++	    return httpHeaderReset(hdr);
++	}
++	if (e->id == HDR_CONTENT_LENGTH && (e2 = httpHeaderFindEntry(hdr, e->id)) != NULL) {
++	    if (strCmp(e->value, strBuf(e2->value)) != 0) {
++		debug(55, 1) ("WARNING: found two conflicting content-length headers\n");
++		httpHeaderEntryDestroy(e);
++		return httpHeaderReset(hdr);
++	    } else {
++		debug(55, 2) ("NOTICE: found double content-length header\n");
++	    }
++	}
++	if (e->id == HDR_OTHER && stringHasWhitespace(strBuf(e->name))) {
++	    debug(55, 1) ("WARNING: found whitespace in HTTP header name {%s}\n", getStringPrefix(field_start, field_end));
++	    if (!Config.onoff.relaxed_header_parser) {
++		httpHeaderEntryDestroy(e);
++		return httpHeaderReset(hdr);
++	    }
++	}
++	httpHeaderAddEntry(hdr, e);
+     }
+     return 1;			/* even if no fields where found, it is a valid header */
+ }
+@@ -1048,8 +1087,8 @@
+     HttpHeaderEntry *e;
+     int id;
+     /* note: name_start == field_start */
+-    const char *name_end = strchr(field_start, ':');
+-    const int name_len = name_end ? name_end - field_start : 0;
++    const char *name_end = memchr(field_start, ':', field_end - field_start);
++    int name_len = name_end ? name_end - field_start : 0;
+     const char *value_start = field_start + name_len + 1;	/* skip ':' */
+     /* note: value_end == field_end */
+ 
+@@ -1063,6 +1102,13 @@
+ 	debug(55, 1) ("WARNING: ignoring header name of %d bytes\n", name_len);
+ 	return NULL;
+     }
++    if (Config.onoff.relaxed_header_parser && xisspace(field_start[name_len - 1])) {
++	debug(55, 1) ("NOTICE: Whitespace after header name in '%s'\n", getStringPrefix(field_start, field_end));
++	while (name_len > 0 && xisspace(field_start[name_len - 1]))
++	    name_len--;
++	if (!name_len)
++	    return NULL;
++    }
+     /* now we know we can parse it */
+     e = memAllocate(MEM_HTTP_HDR_ENTRY);
+     debug(55, 9) ("creating entry %p: near '%s'\n", e, getStringPrefix(field_start, field_end));
+@@ -1080,6 +1126,8 @@
+     /* trim field value */
+     while (value_start < field_end && xisspace(*value_start))
+ 	value_start++;
++    while (value_start < field_end && xisspace(field_end[-1]))
++	field_end--;
+     if (field_end - value_start > 65536) {
+ 	/* String has a 64K limit */
+ 	debug(55, 1) ("WARNING: ignoring '%s' header of %d bytes\n",
+diff -urNad squid-2.5.7/src/mime.c /tmp/dpep.hUyGIM/squid-2.5.7/src/mime.c
+--- squid-2.5.7/src/mime.c	2003-12-14 14:33:47.000000000 +0100
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/mime.c	2005-01-29 17:50:30.000000000 +0100
+@@ -118,7 +118,7 @@
+ headersEnd(const char *mime, size_t l)
+ {
+     size_t e = 0;
+-    int state = 0;
++    int state = 1;
+     while (e < l && state < 3) {
+ 	switch (state) {
+ 	case 0:
+@@ -134,9 +134,7 @@
+ 		state = 0;
+ 	    break;
+ 	case 2:
+-	    if ('\r' == mime[e])	/* ignore repeated CR */
+-		(void) 0;
+-	    else if ('\n' == mime[e])
++	    if ('\n' == mime[e])
+ 		state = 3;
+ 	    else
+ 		state = 0;
+diff -urNad squid-2.5.7/src/structs.h /tmp/dpep.hUyGIM/squid-2.5.7/src/structs.h
+--- squid-2.5.7/src/structs.h	2004-10-06 00:56:36.000000000 +0200
++++ /tmp/dpep.hUyGIM/squid-2.5.7/src/structs.h	2005-01-29 17:50:30.000000000 +0100
+@@ -606,6 +606,7 @@
+ 	int request_entities;
+ 	int detect_broken_server_pconns;
+ 	int balance_on_multiple_ip;
++	int relaxed_header_parser;
+     } onoff;
+     acl *aclList;
+     struct {
--- squid-2.5.9.orig/debian/patches/01-cf.data.debian.dpatch
+++ squid-2.5.9/debian/patches/01-cf.data.debian.dpatch
@@ -0,0 +1,199 @@
+#!/bin/sh -e
+## 01-cf.data.debian.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Default configuration file for Debian.
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch}"
+
+case "$1" in
+       -patch) patch $patch_opts -p1 < $0;;
+       -unpatch) patch $patch_opts -p1 -R < $0;;
+        *)
+                echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+                exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/cf.data.pre /tmp/dpep.KA9Oav/squid-2.5.7/src/cf.data.pre
+--- squid-2.5.7/src/cf.data.pre	2005-01-22 19:07:52.000000000 +0100
++++ /tmp/dpep.KA9Oav/squid-2.5.7/src/cf.data.pre	2005-01-22 19:11:59.000000000 +0100
+@@ -156,12 +156,12 @@
+ NAME: htcp_port
+ IFDEF: USE_HTCP
+ TYPE: ushort
+-DEFAULT: 4827
++DEFAULT: 0
+ LOC: Config.Port.htcp
+ DOC_START
+ 	The port number where Squid sends and receives HTCP queries to
+-	and from neighbor caches.  Default is 4827.  To disable use
+-	"0".
++	and from neighbor caches.  To turn it on you want to set it 4827.
++	By default it is set to "0" (disabled).
+ DOC_END
+ 
+ 
+@@ -1190,6 +1190,10 @@
+ 	set to 'none', it won't be checked.  If append_domain is
+ 	used, that domain will be added to domain-local (i.e. not
+ 	containing any dot character) host definitions.
++
++NOCOMMENT_START
++hosts_file /etc/hosts
++NOCOMMENT_END
+ DOC_END
+ 
+ NAME: diskd_program
+@@ -1316,7 +1320,7 @@
+ 
+ 	Then, set this line to something like
+ 
+-	auth_param basic program @DEFAULT_PREFIX@/libexec/ncsa_auth @DEFAULT_PREFIX@/etc/passwd
++  	auth_param basic program @DEFAULT_PREFIX@/lib/squid/ncsa_auth @DEFAULT_PREFIX@/etc/passwd
+ 
+ 	"children" numberofchildren
+ 	The number of authenticator processes to spawn.
+@@ -1369,7 +1373,7 @@
+ 
+ 	Then, set this line to something like
+ 
+-	auth_param digest program @DEFAULT_PREFIX@/libexec/digest_auth_pw @DEFAULT_PREFIX@/etc/digpass
++ 	auth_param digest program @DEFAULT_PREFIX@/lib/squid/digest_auth_pw @DEFAULT_PREFIX@/etc/digpass
+ 
+ 
+ 	"children" numberofchildren
+@@ -1431,7 +1435,10 @@
+ 	By default, the ntlm authentication scheme is not used unless a
+ 	program is specified.
+ 
+-	auth_param ntlm program /path/to/samba/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
++	Note: If you're using Samba >= 3.0.2, please install the winbind
++	package and use the ntlm_auth helper from that package.
++
++	auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
+ 
+ 	"children" numberofchildren
+ 	The number of authenticator processes to spawn (no default). If you
+@@ -1488,10 +1495,10 @@
+ #auth_param ntlm max_challenge_lifetime 2 minutes
+ #auth_param ntlm use_ntlm_negotiate off
+ #auth_param basic program <uncomment and complete this line>
+-auth_param basic children 5
+-auth_param basic realm Squid proxy-caching web server
+-auth_param basic credentialsttl 2 hours
+-auth_param basic casesensitive off
++#auth_param basic children 5
++#auth_param basic realm Squid proxy-caching web server
++#auth_param basic credentialsttl 2 hours
++#auth_param basic casesensitive off
+ NOCOMMENT_END
+ DOC_END
+ 
+@@ -2129,7 +2136,8 @@
+ acl manager proto cache_object
+ acl localhost src 127.0.0.1/255.255.255.255
+ acl to_localhost dst 127.0.0.0/8
+-acl SSL_ports port 443 563
++acl SSL_ports port 443 563	# https, snews
++acl SSL_ports port 873		# rsync
+ acl Safe_ports port 80		# http
+ acl Safe_ports port 21		# ftp
+ acl Safe_ports port 443 563	# https, snews
+@@ -2140,6 +2148,10 @@
+ acl Safe_ports port 488		# gss-http
+ acl Safe_ports port 591		# filemaker
+ acl Safe_ports port 777		# multiling http
++acl Safe_ports port 631		# cups
++acl Safe_ports port 873		# rsync
++acl Safe_ports port 901		# SWAT
++acl purge method PURGE
+ acl CONNECT method CONNECT
+ NOCOMMENT_END
+ DOC_END
+@@ -2173,6 +2185,9 @@
+ # Only allow cachemgr access from localhost
+ http_access allow manager localhost
+ http_access deny manager
++# Only allow purge requests from localhost
++http_access allow purge localhost
++http_access deny purge
+ # Deny requests to unknown ports
+ http_access deny !Safe_ports
+ # Deny CONNECT to other than SSL ports
+@@ -2190,6 +2205,7 @@
+ # be allowed
+ #acl our_networks src 192.168.1.0/24 192.168.2.0/24
+ #http_access allow our_networks
++http_access allow localhost
+ 
+ # And finally deny all other access to this proxy
+ http_access deny all
+@@ -2425,12 +2441,12 @@
+ 
+ NAME: cache_effective_user
+ TYPE: string
+-DEFAULT: nobody
++DEFAULT: proxy
+ LOC: Config.effectiveUser
+ DOC_START
+ 	If you start Squid as root, it will change its effective/real
+ 	UID/GID to the user specified below.  The default is to change
+-	to UID to nobody.  If you define cache_effective_user, but not
++	to UID to proxy.  If you define cache_effective_user, but not
+ 	cache_effective_group, Squid sets the GID to the effective
+ 	user's default group ID (taken from the password file) and
+ 	supplementary group list from the from groups membership of
+@@ -2440,7 +2456,7 @@
+ 
+ NAME: cache_effective_group
+ TYPE: string
+-DEFAULT: none
++DEFAULT: proxy
+ LOC: Config.effectiveGroup
+ DOC_START
+ 	If you want Squid to run with a specific GID regardless of
+@@ -2661,7 +2677,7 @@
+ 
+ NAME: logfile_rotate
+ TYPE: int
+-DEFAULT: 10
++DEFAULT: 0
+ LOC: Config.Log.rotateNumber
+ DOC_START
+ 	Specifies the number of logfile rotations to make when you
+@@ -2677,6 +2693,9 @@
+ 	purposes, so -k rotate uses another signal.  It is best to get
+ 	in the habit of using 'squid -k rotate' instead of 'kill -USR1
+ 	<pid>'.
++
++	Note2, for Debian/Linux the default of logfile_rotate is
++	zero, since it includes external logfile-rotation methods.
+ DOC_END
+ 
+ 
+@@ -3237,12 +3256,15 @@
+ NAME: snmp_port
+ TYPE: ushort
+ LOC: Config.Port.snmp
+-DEFAULT: 3401
++DEFAULT: 0
+ IFDEF: SQUID_SNMP
+ DOC_START
+ 	Squid can now serve statistics and status information via SNMP.
+ 	By default it listens to port 3401 on the machine. If you don't
+ 	wish to use SNMP, set this to "0".
++
++	Note: on Debian/Linux, the default is zero - you need to
++	set it to 3401 to enable it.
+ DOC_END
+ 
+ NAME: snmp_access
--- squid-2.5.9.orig/debian/patches/05-syslog.dpatch
+++ squid-2.5.9/debian/patches/05-syslog.dpatch
@@ -0,0 +1,44 @@
+#! /bin/sh -e
+## 05-syslog.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Log to daemon.log instead of local4.log
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+case "$1" in
+    -patch) patch -f --no-backup-if-mismatch -p0 < $0;;
+    -unpatch) patch -f --no-backup-if-mismatch -R -p0 < $0;;
+    *)
+	echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+	exit 1;;
+esac
+
+exit 0
+--- src/debug.c	2001-12-17 19:01:54.000000000 +0100
++++ src/debug.c	2002-10-10 19:46:31.000000000 +0200
+@@ -200,9 +200,9 @@
+     }
+     debugOpenLog(logfile);
+ 
+-#if HAVE_SYSLOG && defined(LOG_LOCAL4)
++#if HAVE_SYSLOG
+     if (opt_syslog_enable)
+-	openlog(appname, LOG_PID | LOG_NDELAY | LOG_CONS, LOG_LOCAL4);
++	openlog(appname, LOG_PID | LOG_NDELAY , LOG_DAEMON);
+ #endif /* HAVE_SYSLOG */
+ 
+ }
+--- src/main.c	2002-07-14 19:20:49.000000000 +0200
++++ src/main.c	2002-10-10 19:49:04.000000000 +0200
+@@ -853,7 +874,7 @@
+     int nullfd;
+     if (*(argv[0]) == '(')
+ 	return;
+-    openlog(appname, LOG_PID | LOG_NDELAY | LOG_CONS, LOG_LOCAL4);
++    openlog(appname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
+     if ((pid = fork()) < 0)
+ 	syslog(LOG_ALERT, "fork failed: %s", xstrerror());
+     else if (pid > 0)
--- squid-2.5.9.orig/debian/patches/34-oversize-reply-header.dpatch
+++ squid-2.5.9/debian/patches/34-oversize-reply-header.dpatch
@@ -0,0 +1,62 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 34-oversize-reply-header.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/http.c /tmp/dpep.7ftpCZ/squid-2.5.7/src/http.c
+--- squid-2.5.7/src/http.c	2005-02-01 17:59:45.000000000 +0100
++++ /tmp/dpep.7ftpCZ/squid-2.5.7/src/http.c	2005-02-01 18:00:01.000000000 +0100
+@@ -401,7 +401,7 @@
+     size_t hdr_len;
+     size_t hdr_size = headersEnd(buf, size);
+     HttpReply *reply = entry->mem_obj->reply;
+-    Ctx ctx;
++    Ctx ctx = ctx_enter(entry->mem_obj->url);
+     debug(11, 3) ("httpProcessReplyHeader: key '%s'\n",
+ 	storeKeyText(entry->hash.key));
+     if (memBufIsNull(&httpState->reply_hdr))
+@@ -418,6 +418,7 @@
+ 	memBufClean(&httpState->reply_hdr);
+ 	httpBuildVersion(&reply->sline.version, 0, 9);
+ 	reply->sline.status = HTTP_INVALID_HEADER;
++	ctx_exit(ctx);
+ 	return;
+     }
+     if (hdr_size != hdr_len)
+@@ -429,21 +430,24 @@
+ 	if (!memBufIsNull(&httpState->reply_hdr))
+ 	    memBufClean(&httpState->reply_hdr);
+ 	reply->sline.status = HTTP_HEADER_TOO_LARGE;
++	httpState->reply_hdr_state += 2;
++	ctx_exit(ctx);
+ 	return;
+     }
+     /* headers can be incomplete only if object still arriving */
+     if (!hdr_size) {
+ 	if (httpState->eof)
+ 	    hdr_size = hdr_len;
+-	else
++	else {
++	    ctx_exit(ctx);
+ 	    return;		/* headers not complete */
++	}
+     }
+     /* Cut away any excess body data (only needed for debug?) */
+     memBufAppend(&httpState->reply_hdr, "\0", 1);
+     httpState->reply_hdr.buf[hdr_size] = '\0';
+     httpState->reply_hdr_state++;
+     assert(httpState->reply_hdr_state == 1);
+-    ctx = ctx_enter(entry->mem_obj->url);
+     httpState->reply_hdr_state++;
+     debug(11, 9) ("GOT HTTP REPLY HDR:\n---------\n%s\n----------\n",
+ 	httpState->reply_hdr.buf);
+@@ -453,6 +457,7 @@
+     if (reply->sline.status >= HTTP_INVALID_HEADER) {
+ 	debug(11, 3) ("httpProcessReplyHeader: Non-HTTP-compliant header: '%s'\n", httpState->reply_hdr.buf);
+ 	memBufClean(&httpState->reply_hdr);
++	ctx_exit(ctx);
+ 	return;
+     }
+     storeTimestampsSet(entry);
--- squid-2.5.9.orig/debian/patches/smb_auth.README
+++ squid-2.5.9/debian/patches/smb_auth.README
@@ -0,0 +1,31 @@
+From: Jeff Licquia <jlicquia@scinet.springfieldclinic.com>
+Subject: squid: SMB auth proxy has problems with some passwords
+To: submit@bugs.debian.org
+X-Mailer: bug 3.2.7
+Message-Id: <20000718174501.0B4A132915@scinet.springfieldclinic.com>
+Date: Tue, 18 Jul 2000 12:45:01 -0500 (CDT)
+
+Package: squid
+Version: 2.2.5-2
+Severity: normal
+
+
+The SMB authenticator doesn't handle passwords with backslashes in them
+correctly.  The fix appears to be easy; just put a -r in the "read SMBPASS"
+line in smb_auth.sh.
+
+
+From: John M Cooper <john.cooper@yourcommunications.co.uk>
+To: Debian Bug Tracking System <submit@bugs.debian.org>
+Subject: squid: smb_auth does not work with a wins server defined in smb.conf
+Date: 28 Jan 2002 17:46:13 +0000
+Message-Id: <1012239973.15093.4.camel@johnclin>
+
+If you define a wins server in the file /etc/samba/smb.conf then the
+smb_auth script gets the wrong Domain Controller IP address.
+
+There should be a change to mb_auth.sh at line 50
+
+basically adding in the extra "\..+" stops the number of Wins servers
+from being returned from the nmblookup command.
+
--- squid-2.5.9.orig/debian/patches/06-unlinkd.dpatch
+++ squid-2.5.9/debian/patches/06-unlinkd.dpatch
@@ -0,0 +1,72 @@
+#! /bin/sh -e
+## 06-unlinkd.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Only run unlinkd for diskd and ufs storage methods
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+case "$1" in
+    -patch) patch -f --no-backup-if-mismatch -p0 < $0;;
+    -unpatch) patch -f --no-backup-if-mismatch -R -p0 < $0;;
+    *)
+	echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+	exit 1;;
+esac
+
+exit 0
+--- src/main.c	2002-07-14 19:20:49.000000000 +0200
++++ src/main.c	2002-10-10 19:49:04.000000000 +0200
+@@ -326,6 +326,21 @@
+     asnFreeMemory();
+ }
+ 
++#if USE_UNLINKD
++static int
++needUnlinkd(void)
++{
++    int i;
++    int r = 0;
++    for (i = 0; i < Config.cacheSwap.n_configured; i++) {
++	if (strcmp(Config.cacheSwap.swapDirs[i].type, "ufs") == 0 ||
++	strcmp(Config.cacheSwap.swapDirs[i].type, "diskd") == 0)
++	r++;
++    }
++    return r;
++}
++#endif
++
+ static void
+ mainReconfigure(void)
+ {
+@@ -350,6 +365,9 @@
+ #endif
+     redirectShutdown();
+     authenticateShutdown();
++#if USE_UNLINKD
++    unlinkdClose();
++#endif
+     externalAclShutdown();
+     storeDirCloseSwapLogs();
+     errorClean();
+@@ -373,6 +391,9 @@
+ #if USE_WCCP
+     wccpInit();
+ #endif
++#if USE_UNLINKD
++    if (needUnlinkd()) unlinkdInit();
++#endif
+     serverConnectionsOpen();
+     if (theOutIcpConnection >= 0) {
+ 	if (!Config2.Accel.on || Config.onoff.accel_with_proxy)
+@@ -516,7 +537,7 @@
+ 
+     if (!configured_once) {
+ #if USE_UNLINKD
+-	unlinkdInit();
++	if (needUnlinkd()) unlinkdInit();
+ #endif
+ 	urlInitialize();
+ 	cachemgrInit();
--- squid-2.5.9.orig/debian/patches/08-redirect_login_space.dpatch
+++ squid-2.5.9/debian/patches/08-redirect_login_space.dpatch
@@ -0,0 +1,37 @@
+#!/bin/sh -e
+## 08-redirect_login_space.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Upstream patch to fix auth names containing a space character
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch}"
+
+case "$1" in
+       -patch) patch $patch_opts -p1 < $0;;
+       -unpatch) patch $patch_opts -p1 -R < $0;;
+        *)
+                echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+                exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.4/src/redirect.c squid-2.5.4/src/redirect.c
+--- /home/gangitano/debian/squid/squid-2.5.4/src/redirect.c	2002-07-21 02:30:02.000000000 +0200
++++ squid-2.5.4/src/redirect.c	2003-09-25 00:52:36.000000000 +0200
+@@ -143,7 +143,7 @@
+ 	r->orig_url,
+ 	inet_ntoa(r->client_addr),
+ 	fqdn,
+-	r->client_ident,
++	r->client_ident[0] ? rfc1738_escape(r->client_ident) : dash_str,
+ 	r->method_s);
+     helperSubmit(redirectors, buf, redirectHandleReply, r);
+ }
--- squid-2.5.9.orig/debian/patches/vms-ftp.patch.NOT-YET
+++ squid-2.5.9/debian/patches/vms-ftp.patch.NOT-YET
@@ -0,0 +1,101 @@
+diff -ruN squid-2.2.5.orig/src/ftp.c squid-2.2.5/src/ftp.c
+--- squid-2.2.5.orig/src/ftp.c	Wed Sep 22 23:22:50 1999
++++ squid-2.2.5/src/ftp.c	Thu Jan  6 14:12:42 2000
+@@ -461,6 +461,8 @@
+ #define SCAN_FTP2       "%[0123456789:]"
+ #define SCAN_FTP3       "%[0123456789]-%[0123456789]-%[0123456789]"
+ #define SCAN_FTP4       "%[0123456789]:%[0123456789]%[AaPp]%[Mm]"
++#define SCAN_FTP5	"%s;%*d"
++#define SCAN_FTP6	"%[0123456789]-%s-%[0123456789]"
+ 
+ static ftpListParts *
+ ftpListParseParts(const char *buf, struct _ftp_flags flags)
+@@ -468,6 +470,7 @@
+     ftpListParts *p = NULL;
+     char *t = NULL;
+     const char *ct = NULL;
++    char *q;
+     char *tokens[MAX_TOKENS];
+     int i;
+     int n_tokens;
+@@ -598,6 +601,32 @@
+ 	    p->type = '-';
+ 	}
+     }
++    /* try it as a VMS listing */
++    if (n_tokens > 3 && p->name == NULL &&
++	sscanf(tokens[0], SCAN_FTP5, sbuf) == 1 &&
++	/* FILENAME;ver */
++	sscanf(tokens[2], SCAN_FTP6, sbuf, sbuf, sbuf) == 3) {
++	/* 8-SEP-1998 */
++	if ((q = strstr(tokens[0], ".DIR;")) != NULL) {
++	    p->type = 'd';
++	    *q = 0;
++	} else {
++	    p->type = '-';
++	    p->size = atoi(tokens[1]);
++	}
++	snprintf(sbuf, 128, "%s %s", tokens[2], tokens[3]);
++	p->date = xstrdup(sbuf);
++	if ((p->name = xstrdup(tokens[0])) != NULL) {
++	    /* Lowercase name and remove version. */
++	    for (q = p->name; *q; q++) {
++		*q = tolower(*q);
++		    if (*q == ';') {
++			*q = 0;
++			break;
++		    }
++	    }
++	}
++    }
+     for (i = 0; i < n_tokens; i++)
+ 	xfree(tokens[i]);
+     if (p->name == NULL)
+@@ -769,12 +798,14 @@
+     char *sbuf;			/* NULL-terminated copy of buf */
+     char *end;
+     char *line;
++    char *p;
+     char *s;
+     char *t;
+     size_t linelen;
+     size_t usable;
+     StoreEntry *e = ftpState->entry;
+     int len = ftpState->data.offset;
++    int xx, is_vms = -1;
+     /*
+      * We need a NULL-terminated buffer for scanning, ick
+      */
+@@ -799,12 +830,32 @@
+     for (; s < end; s += strcspn(s, crlf), s += strspn(s, crlf)) {
+ 	debug(9, 3) ("ftpParseListing: s = {%s}\n", s);
+ 	linelen = strcspn(s, crlf) + 1;
++	/* VMS splits listings of filenames > 19 characters over 2 lines. */
++	if (is_vms > 0 && linelen > 2 && s + linelen < end) {
++	    xx = 0;
++	    for (p = s; *p && *p != '\r'; p++) {
++		if (*p == ' ' || *p == '\t')
++		    break;
++		if (*p == ';') xx = 1;
++	    }
++	    if (*p == '\r' && xx) {
++		s[linelen - 3] = ' ';
++		s[linelen - 2] = ' ';
++		linelen = strcspn(s, crlf) + 1;
++	    }
++	}
+ 	if (linelen < 2)
+ 	    break;
+ 	if (linelen > 4096)
+ 	    linelen = 4096;
+ 	xstrncpy(line, s, linelen);
+ 	debug(9, 7) ("ftpParseListing: {%s}\n", line);
++	/* VMS doesn't print "total" but "\r\nANONYMOUS:[000000]\r\n" */
++	if (is_vms == 0 && sscanf(line, "%*s:[%d.%*s]", &xx) == 1) {
++	    is_vms = 1;
++	    continue;
++	}
++	if (is_vms < 0 && strncmp(line, crlf, 2) == 0) is_vms = 0;
+ 	if (!strncmp(line, "total", 5))
+ 	    continue;
+ 	t = ftpHtmlifyListEntry(line, ftpState);
--- squid-2.5.9.orig/debian/patches/02-dfl-error-dir.dpatch
+++ squid-2.5.9/debian/patches/02-dfl-error-dir.dpatch
@@ -0,0 +1,30 @@
+#! /bin/sh -e
+## 02-dfl-error-dir.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Default error dir is under /usr/share/squid for Debian
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+case "$1" in
+    -patch) patch -f --no-backup-if-mismatch -p0 < $0;;
+    -unpatch) patch -f --no-backup-if-mismatch -R -p0 < $0;;
+    *)
+	echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+	exit 1;;
+esac
+
+exit 0
+--- src/defines.h	2002-08-08 22:17:39.000000000 +0200
++++ src/defines.h	2002-10-10 19:57:22.000000000 +0200
+@@ -219,7 +219,7 @@
+ 
+ /* were to look for errors if config path fails */
+ #ifndef DEFAULT_SQUID_ERROR_DIR
+-#define DEFAULT_SQUID_ERROR_DIR "/usr/local/squid/etc/errors"
++#define DEFAULT_SQUID_ERROR_DIR "/usr/share/squid/errors/English"
+ #endif
+ 
+ /* gb_type operations */
--- squid-2.5.9.orig/debian/patches/03-no-append-domain-localhost.dpatch
+++ squid-2.5.9/debian/patches/03-no-append-domain-localhost.dpatch
@@ -0,0 +1,28 @@
+#! /bin/sh -e
+## 03-no-append-domain-localhost.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Don't apply "append_domain" setting to "localhost" in unqualified URLs
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+case "$1" in
+    -patch) patch -f --no-backup-if-mismatch -p0 < $0;;
+    -unpatch) patch -f --no-backup-if-mismatch -R -p0 < $0;;
+    *)
+	echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+	exit 1;;
+esac
+
+exit 0
+--- src/url.c	2002-09-12 07:21:00.000000000 +0200
++++ src/url.c	2002-10-10 19:37:43.000000000 +0200
+@@ -313,5 +313,5 @@
+     }
+ #endif
+-    if (Config.appendDomain && !strchr(host, '.'))
++    if (Config.appendDomain && !strchr(host, '.')&& strcasecmp(host,"localhost") != 0)
+ 	strncat(host, Config.appendDomain, SQUIDHOSTNAMELEN);
+     /* remove trailing dots from hostnames */
--- squid-2.5.9.orig/debian/patches/10-ntlm-assert.dpatch
+++ squid-2.5.9/debian/patches/10-ntlm-assert.dpatch
@@ -0,0 +1,36 @@
+#! /bin/sh -e
+## 10-ntlm-assert.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix assertion failure in ntlm_auth
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/auth/ntlm/auth_ntlm.c squid-2.5.5/src/auth/ntlm/auth_ntlm.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/auth/ntlm/auth_ntlm.c	2004-02-24 18:11:52.000000000 +0100
++++ squid-2.5.5/src/auth/ntlm/auth_ntlm.c	2004-04-19 16:33:42.000000000 +0200
+@@ -481,7 +481,6 @@
+ 	debug(29, 2) ("AuthenticateNTLMHandleReply: invalid callback data. Releasing helper '%p'.\n", srv);
+ 	cbdataUnlock(r->data);
+ 	authenticateStateFree(r);
+-	helperStatefulReleaseServer(srv);
+ 	return;
+     }
+     if (!reply) {
--- squid-2.5.9.orig/debian/patches/11-digest-blank.dpatch
+++ squid-2.5.9/debian/patches/11-digest-blank.dpatch
@@ -0,0 +1,107 @@
+#! /bin/sh -e
+## 11-digest-blank.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/include/config.h squid-2.5.5/include/config.h
+--- /home/gangitano/debian/squid/squid-2.5.5/include/config.h	2001-11-13 22:27:47.000000000 +0100
++++ squid-2.5.5/include/config.h	2004-04-19 16:35:45.000000000 +0200
+@@ -163,6 +163,7 @@
+ #define xisascii(x) isascii((unsigned char)x)
+ #define xislower(x) islower((unsigned char)x)
+ #define xisalpha(x) isalpha((unsigned char)x)
++#define xisgraph(x) isgraph((unsigned char)x)
+ 
+ #if HAVE_RANDOM
+ #define squid_random random
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/auth/basic/auth_basic.c squid-2.5.5/src/auth/basic/auth_basic.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/auth/basic/auth_basic.c	2004-02-18 18:50:51.000000000 +0100
++++ squid-2.5.5/src/auth/basic/auth_basic.c	2004-04-19 16:35:45.000000000 +0200
+@@ -421,7 +421,7 @@
+ 
+     /* decode the username */
+     /* trim BASIC from string */
+-    while (!xisspace(*proxy_auth))
++    while (xisgraph(*proxy_auth))
+ 	proxy_auth++;
+ 
+     local_basic.passwd = NULL;
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/auth/digest/auth_digest.c squid-2.5.5/src/auth/digest/auth_digest.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/auth/digest/auth_digest.c	2004-02-19 13:28:01.000000000 +0100
++++ squid-2.5.5/src/auth/digest/auth_digest.c	2004-04-19 16:35:45.000000000 +0200
+@@ -764,7 +764,8 @@
+ authenticateDigestDirection(auth_user_request_t * auth_user_request)
+ {
+     digest_request_h *digest_request = auth_user_request->scheme_data;
+-    /* null auth_user is checked for by authenticateDirection */
++    if (!digest_request)
++	return -2;
+     switch (digest_request->flags.credentials_ok) {
+     case 0:			/* not checked */
+ 	return -1;
+@@ -790,6 +791,8 @@
+     if (!auth_user_request)
+ 	return;
+     digest_request = auth_user_request->scheme_data;
++    if (!digest_request)
++	return;
+     /* don't add to authentication error pages */
+     if ((!accel && rep->sline.status == HTTP_PROXY_AUTHENTICATION_REQUIRED)
+ 	|| (accel && rep->sline.status == HTTP_UNAUTHORIZED))
+@@ -1136,7 +1139,7 @@
+     digest_request = authDigestRequestNew();
+ 
+     /* trim DIGEST from string */
+-    while (!xisspace(*proxy_auth))
++    while (xisgraph(*proxy_auth))
+ 	proxy_auth++;
+ 
+     /* Trim leading whitespace before decoding */
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/auth/ntlm/auth_ntlm.c squid-2.5.5/src/auth/ntlm/auth_ntlm.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/auth/ntlm/auth_ntlm.c	2004-04-19 16:35:41.000000000 +0200
++++ squid-2.5.5/src/auth/ntlm/auth_ntlm.c	2004-04-19 16:35:45.000000000 +0200
+@@ -671,7 +671,7 @@
+ 	fatal("Invalid authenticate state for NTLMStart");
+     }
+ 
+-    while (!xisspace(*sent_string))	/*trim NTLM */
++    while (xisgraph(*sent_string))	/*trim NTLM */
+ 	sent_string++;
+ 
+     while (xisspace(*sent_string))	/*trim leading spaces */
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/authenticate.c squid-2.5.5/src/authenticate.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/authenticate.c	2004-02-18 19:51:16.000000000 +0100
++++ squid-2.5.5/src/authenticate.c	2004-04-19 16:35:45.000000000 +0200
+@@ -94,7 +94,11 @@
+ 	/* we're configured to use this scheme - but is it active ? */
+ 	if ((i = authenticateAuthSchemeId(proxy_auth)) != -1) {
+ 	    authscheme_list[i].decodeauth(auth_user_request, proxy_auth);
+-	    auth_user_request->auth_user->auth_module = i + 1;
++	    if (auth_user_request->auth_user) {
++		auth_user_request->auth_user->auth_module = i + 1;
++	    } else {
++		debug(29, 1) ("authenticateDecodeAuth: Invalid proxy-auth header, '%s'\n", proxy_auth);
++	    }
+ 	    return;
+ 	}
+     }
--- squid-2.5.9.orig/debian/patches/12-post-assert.dpatch
+++ squid-2.5.9/debian/patches/12-post-assert.dpatch
@@ -0,0 +1,1276 @@
+#! /bin/sh -e
+## 12-post-assert.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/http.c squid-2.5.5/src/http.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/http.c	2004-01-31 00:09:12.000000000 +0100
++++ squid-2.5.5/src/http.c	2004-05-31 22:14:43.000000000 +0200
+@@ -708,10 +708,12 @@
+     if (errflag == COMM_ERR_CLOSING)
+ 	return;
+     if (errflag) {
+-	err = errorCon(ERR_WRITE_ERROR, HTTP_INTERNAL_SERVER_ERROR);
+-	err->xerrno = errno;
+-	err->request = requestLink(httpState->orig_request);
+-	errorAppendEntry(entry, err);
++	if (entry->mem_obj->inmem_hi == 0) {
++	    err = errorCon(ERR_WRITE_ERROR, HTTP_INTERNAL_SERVER_ERROR);
++	    err->xerrno = errno;
++	    err->request = requestLink(httpState->orig_request);
++	    errorAppendEntry(entry, err);
++	}
+ 	comm_close(fd);
+ 	return;
+     } else {
+@@ -1103,6 +1105,15 @@
+ }
+ 
+ static void
++httpRequestBodyHandler2(void *data)
++{
++    HttpStateData *httpState = (HttpStateData *) data;
++    char *buf = httpState->body_buf;
++    httpState->body_buf = NULL;
++    comm_write(httpState->fd, buf, httpState->body_buf_sz, httpSendRequestEntry, data, memFree8K);
++}
++
++static void
+ httpRequestBodyHandler(char *buf, ssize_t size, void *data)
+ {
+     HttpStateData *httpState = (HttpStateData *) data;
+@@ -1118,6 +1129,12 @@
+ 		comm_close(httpState->fd);
+ 		return;
+ 	    }
++	    httpState->body_buf = buf;
++	    httpState->body_buf_sz = size;
++	    /* Give response some time to propagate before sending rest
++	     * of request in case of error */
++	    eventAdd("POST delay on response", httpRequestBodyHandler2, httpState, 2.0, 1);
++	    return;
+ 	}
+ 	comm_write(httpState->fd, buf, size, httpSendRequestEntry, data, memFree8K);
+     } else if (size == 0) {
+@@ -1147,10 +1164,12 @@
+     if (errflag == COMM_ERR_CLOSING)
+ 	return;
+     if (errflag) {
+-	err = errorCon(ERR_WRITE_ERROR, HTTP_INTERNAL_SERVER_ERROR);
+-	err->xerrno = errno;
+-	err->request = requestLink(httpState->orig_request);
+-	errorAppendEntry(entry, err);
++	if (entry->mem_obj->inmem_hi == 0) {
++	    err = errorCon(ERR_WRITE_ERROR, HTTP_INTERNAL_SERVER_ERROR);
++	    err->xerrno = errno;
++	    err->request = requestLink(httpState->orig_request);
++	    errorAppendEntry(entry, err);
++	}
+ 	comm_close(fd);
+ 	return;
+     }
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/http.c.orig squid-2.5.5/src/http.c.orig
+--- /home/gangitano/debian/squid/squid-2.5.5/src/http.c.orig	1970-01-01 01:00:00.000000000 +0100
++++ squid-2.5.5/src/http.c.orig	2004-01-31 00:09:12.000000000 +0100
+@@ -0,0 +1,1170 @@
++
++/*
++ * $Id: http.c,v 1.384.2.12 2004/01/30 23:09:12 hno Exp $
++ *
++ * DEBUG: section 11    Hypertext Transfer Protocol (HTTP)
++ * AUTHOR: Harvest Derived
++ *
++ * SQUID Web Proxy Cache          http://www.squid-cache.org/
++ * ----------------------------------------------------------
++ *
++ *  Squid is the result of efforts by numerous individuals from
++ *  the Internet community; see the CONTRIBUTORS file for full
++ *  details.   Many organizations have provided support for Squid's
++ *  development; see the SPONSORS file for full details.  Squid is
++ *  Copyrighted (C) 2001 by the Regents of the University of
++ *  California; see the COPYRIGHT file for full details.  Squid
++ *  incorporates software developed and/or copyrighted by other
++ *  sources; see the CREDITS file for full details.
++ *
++ *  This program is free software; you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License as published by
++ *  the Free Software Foundation; either version 2 of the License, or
++ *  (at your option) any later version.
++ *  
++ *  This program is distributed in the hope that it will be useful,
++ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *  GNU General Public License for more details.
++ *  
++ *  You should have received a copy of the GNU General Public License
++ *  along with this program; if not, write to the Free Software
++ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
++ *
++ */
++
++/*
++ * Anonymizing patch by lutz@as-node.jena.thur.de
++ * have a look into http-anon.c to get more informations.
++ */
++
++#include "squid.h"
++
++static const char *const crlf = "\r\n";
++
++static CWCB httpSendComplete;
++static CWCB httpSendRequestEntry;
++
++static PF httpReadReply;
++static void httpSendRequest(HttpStateData *);
++static PF httpStateFree;
++static PF httpTimeout;
++static void httpCacheNegatively(StoreEntry *);
++static void httpMakePrivate(StoreEntry *);
++static void httpMakePublic(StoreEntry *);
++static int httpCachableReply(HttpStateData *);
++static void httpMaybeRemovePublic(StoreEntry *, http_status);
++
++static void
++httpStateFree(int fd, void *data)
++{
++    HttpStateData *httpState = data;
++#if DELAY_POOLS
++    delayClearNoDelay(fd);
++#endif
++    if (httpState == NULL)
++	return;
++    if (httpState->body_buf) {
++	clientAbortBody(httpState->orig_request);
++	if (httpState->body_buf) {
++	    memFree(httpState->body_buf, MEM_8K_BUF);
++	    httpState->body_buf = NULL;
++	}
++    }
++    storeUnlockObject(httpState->entry);
++    if (httpState->reply_hdr) {
++	memFree(httpState->reply_hdr, MEM_8K_BUF);
++	httpState->reply_hdr = NULL;
++    }
++    requestUnlink(httpState->request);
++    requestUnlink(httpState->orig_request);
++    httpState->request = NULL;
++    httpState->orig_request = NULL;
++    cbdataFree(httpState);
++}
++
++int
++httpCachable(method_t method)
++{
++    /* GET and HEAD are cachable. Others are not. */
++    if (method != METHOD_GET && method != METHOD_HEAD)
++	return 0;
++    /* else cachable */
++    return 1;
++}
++
++static void
++httpTimeout(int fd, void *data)
++{
++    HttpStateData *httpState = data;
++    StoreEntry *entry = httpState->entry;
++    debug(11, 4) ("httpTimeout: FD %d: '%s'\n", fd, storeUrl(entry));
++    if (entry->store_status == STORE_PENDING) {
++	if (entry->mem_obj->inmem_hi == 0) {
++	    fwdFail(httpState->fwd,
++		errorCon(ERR_READ_TIMEOUT, HTTP_GATEWAY_TIMEOUT));
++	}
++    }
++    comm_close(fd);
++}
++
++/* This object can be cached for a long time */
++static void
++httpMakePublic(StoreEntry * entry)
++{
++    if (EBIT_TEST(entry->flags, ENTRY_CACHABLE))
++	storeSetPublicKey(entry);
++}
++
++/* This object should never be cached at all */
++static void
++httpMakePrivate(StoreEntry * entry)
++{
++    storeExpireNow(entry);
++    storeReleaseRequest(entry);	/* delete object when not used */
++    /* storeReleaseRequest clears ENTRY_CACHABLE flag */
++}
++
++/* This object may be negatively cached */
++static void
++httpCacheNegatively(StoreEntry * entry)
++{
++    storeNegativeCache(entry);
++    if (EBIT_TEST(entry->flags, ENTRY_CACHABLE))
++	storeSetPublicKey(entry);
++}
++
++static void
++httpMaybeRemovePublic(StoreEntry * e, http_status status)
++{
++    int remove = 0;
++    int forbidden = 0;
++    StoreEntry *pe;
++    if (!EBIT_TEST(e->flags, KEY_PRIVATE))
++	return;
++    switch (status) {
++    case HTTP_OK:
++    case HTTP_NON_AUTHORITATIVE_INFORMATION:
++    case HTTP_MULTIPLE_CHOICES:
++    case HTTP_MOVED_PERMANENTLY:
++    case HTTP_MOVED_TEMPORARILY:
++    case HTTP_GONE:
++    case HTTP_NOT_FOUND:
++	remove = 1;
++	break;
++    case HTTP_FORBIDDEN:
++    case HTTP_METHOD_NOT_ALLOWED:
++	forbidden = 1;
++	break;
++#if WORK_IN_PROGRESS
++    case HTTP_UNAUTHORIZED:
++	forbidden = 1;
++	break;
++#endif
++    default:
++#if QUESTIONABLE
++	/*
++	 * Any 2xx response should eject previously cached entities...
++	 */
++	if (status >= 200 && status < 300)
++	    remove = 1;
++#endif
++	break;
++    }
++    if (!remove && !forbidden)
++	return;
++    assert(e->mem_obj);
++    if (e->mem_obj->request)
++	pe = storeGetPublicByRequest(e->mem_obj->request);
++    else
++	pe = storeGetPublic(e->mem_obj->url, e->mem_obj->method);
++    if (pe != NULL) {
++	assert(e != pe);
++	storeRelease(pe);
++    }
++    /*
++     * Also remove any cached HEAD response in case the object has
++     * changed.
++     */
++    if (e->mem_obj->request)
++	pe = storeGetPublicByRequestMethod(e->mem_obj->request, METHOD_HEAD);
++    else
++	pe = storeGetPublic(e->mem_obj->url, METHOD_HEAD);
++    if (pe != NULL) {
++	assert(e != pe);
++	storeRelease(pe);
++    }
++    if (forbidden)
++	return;
++    switch (e->mem_obj->method) {
++    case METHOD_PUT:
++    case METHOD_DELETE:
++    case METHOD_PROPPATCH:
++    case METHOD_MKCOL:
++    case METHOD_MOVE:
++    case METHOD_BMOVE:
++    case METHOD_BDELETE:
++	/*
++	 * Remove any cached GET object if it is beleived that the
++	 * object may have changed as a result of other methods
++	 */
++	if (e->mem_obj->request)
++	    pe = storeGetPublicByRequestMethod(e->mem_obj->request, METHOD_GET);
++	else
++	    pe = storeGetPublic(e->mem_obj->url, METHOD_GET);
++	if (pe != NULL) {
++	    assert(e != pe);
++	    storeRelease(pe);
++	}
++	break;
++    }
++}
++
++static int
++httpCachableReply(HttpStateData * httpState)
++{
++    HttpReply *rep = httpState->entry->mem_obj->reply;
++    HttpHeader *hdr = &rep->header;
++    const int cc_mask = (rep->cache_control) ? rep->cache_control->mask : 0;
++    const char *v;
++    if (EBIT_TEST(cc_mask, CC_PRIVATE))
++	return 0;
++    if (EBIT_TEST(cc_mask, CC_NO_CACHE))
++	return 0;
++    if (EBIT_TEST(cc_mask, CC_NO_STORE))
++	return 0;
++    if (httpState->request->flags.auth) {
++	/*
++	 * Responses to requests with authorization may be cached
++	 * only if a Cache-Control: public reply header is present.
++	 * RFC 2068, sec 14.9.4
++	 */
++	if (!EBIT_TEST(cc_mask, CC_PUBLIC))
++	    return 0;
++    }
++    /* Pragma: no-cache in _replies_ is not documented in HTTP,
++     * but servers like "Active Imaging Webcast/2.0" sure do use it */
++    if (httpHeaderHas(hdr, HDR_PRAGMA)) {
++	String s = httpHeaderGetList(hdr, HDR_PRAGMA);
++	const int no_cache = strListIsMember(&s, "no-cache", ',');
++	stringClean(&s);
++	if (no_cache)
++	    return 0;
++    }
++    /*
++     * The "multipart/x-mixed-replace" content type is used for
++     * continuous push replies.  These are generally dynamic and
++     * probably should not be cachable
++     */
++    if ((v = httpHeaderGetStr(hdr, HDR_CONTENT_TYPE)))
++	if (!strncasecmp(v, "multipart/x-mixed-replace", 25))
++	    return 0;
++    switch (httpState->entry->mem_obj->reply->sline.status) {
++	/* Responses that are cacheable */
++    case HTTP_OK:
++    case HTTP_NON_AUTHORITATIVE_INFORMATION:
++    case HTTP_MULTIPLE_CHOICES:
++    case HTTP_MOVED_PERMANENTLY:
++    case HTTP_GONE:
++	/*
++	 * Don't cache objects that need to be refreshed on next request,
++	 * unless we know how to refresh it.
++	 */
++	if (!refreshIsCachable(httpState->entry))
++	    return 0;
++	/* don't cache objects from peers w/o LMT, Date, or Expires */
++	/* check that is it enough to check headers @?@ */
++	if (rep->date > -1)
++	    return 1;
++	else if (rep->last_modified > -1)
++	    return 1;
++	else if (!httpState->peer)
++	    return 1;
++	/* @?@ (here and 302): invalid expires header compiles to squid_curtime */
++	else if (rep->expires > -1)
++	    return 1;
++	else
++	    return 0;
++	/* NOTREACHED */
++	break;
++	/* Responses that only are cacheable if the server says so */
++    case HTTP_MOVED_TEMPORARILY:
++	if (rep->expires > -1)
++	    return 1;
++	else
++	    return 0;
++	/* NOTREACHED */
++	break;
++	/* Errors can be negatively cached */
++    case HTTP_NO_CONTENT:
++    case HTTP_USE_PROXY:
++    case HTTP_BAD_REQUEST:
++    case HTTP_FORBIDDEN:
++    case HTTP_NOT_FOUND:
++    case HTTP_METHOD_NOT_ALLOWED:
++    case HTTP_REQUEST_URI_TOO_LARGE:
++    case HTTP_INTERNAL_SERVER_ERROR:
++    case HTTP_NOT_IMPLEMENTED:
++    case HTTP_BAD_GATEWAY:
++    case HTTP_SERVICE_UNAVAILABLE:
++    case HTTP_GATEWAY_TIMEOUT:
++	return -1;
++	/* NOTREACHED */
++	break;
++	/* Some responses can never be cached */
++    case HTTP_PARTIAL_CONTENT:	/* Not yet supported */
++    case HTTP_SEE_OTHER:
++    case HTTP_NOT_MODIFIED:
++    case HTTP_UNAUTHORIZED:
++    case HTTP_PROXY_AUTHENTICATION_REQUIRED:
++    case HTTP_INVALID_HEADER:	/* Squid header parsing error */
++    default:			/* Unknown status code */
++	return 0;
++	/* NOTREACHED */
++	break;
++    }
++    /* NOTREACHED */
++}
++
++/*
++ * For Vary, store the relevant request headers as 
++ * virtual headers in the reply
++ * Returns false if the variance cannot be stored
++ */
++const char *
++httpMakeVaryMark(request_t * request, HttpReply * reply)
++{
++    String vary, hdr;
++    const char *pos = NULL;
++    const char *item;
++    const char *value;
++    int ilen;
++    static String vstr =
++    {0, 0, NULL};
++
++    stringClean(&vstr);
++    vary = httpHeaderGetList(&reply->header, HDR_VARY);
++    while (strListGetItem(&vary, ',', &item, &ilen, &pos)) {
++	char *name = xmalloc(ilen + 1);
++	xstrncpy(name, item, ilen + 1);
++	Tolower(name);
++	strListAdd(&vstr, name, ',');
++	hdr = httpHeaderGetByName(&request->header, name);
++	safe_free(name);
++	value = strBuf(hdr);
++	if (value) {
++	    value = rfc1738_escape_part(value);
++	    stringAppend(&vstr, "=\"", 2);
++	    stringAppend(&vstr, value, strlen(value));
++	    stringAppend(&vstr, "\"", 1);
++	}
++	stringClean(&hdr);
++    }
++    stringClean(&vary);
++#if X_ACCELERATOR_VARY
++    vary = httpHeaderGetList(&reply->header, HDR_X_ACCELERATOR_VARY);
++    while (strListGetItem(&vary, ',', &item, &ilen, &pos)) {
++	char *name = xmalloc(ilen + 1);
++	xstrncpy(name, item, ilen + 1);
++	Tolower(name);
++	strListAdd(&vstr, name, ',');
++	hdr = httpHeaderGetByName(&request->header, name);
++	safe_free(name);
++	value = strBuf(hdr);
++	if (value) {
++	    value = rfc1738_escape_part(value);
++	    stringAppend(&vstr, "=\"", 2);
++	    stringAppend(&vstr, value, strlen(value));
++	    stringAppend(&vstr, "\"", 1);
++	}
++	stringClean(&hdr);
++    }
++    stringClean(&vary);
++#endif
++    debug(11, 3) ("httpMakeVaryMark: %s\n", strBuf(vstr));
++    return strBuf(vstr);
++}
++
++/* rewrite this later using new interfaces @?@ */
++void
++httpProcessReplyHeader(HttpStateData * httpState, const char *buf, int size)
++{
++    char *t = NULL;
++    StoreEntry *entry = httpState->entry;
++    int room;
++    size_t hdr_len;
++    HttpReply *reply = entry->mem_obj->reply;
++    Ctx ctx;
++    debug(11, 3) ("httpProcessReplyHeader: key '%s'\n",
++	storeKeyText(entry->hash.key));
++    if (httpState->reply_hdr == NULL)
++	httpState->reply_hdr = memAllocate(MEM_8K_BUF);
++    assert(httpState->reply_hdr_state == 0);
++    hdr_len = httpState->reply_hdr_size;
++    room = 8191 - hdr_len;
++    xmemcpy(httpState->reply_hdr + hdr_len, buf, room < size ? room : size);
++    hdr_len += room < size ? room : size;
++    httpState->reply_hdr[hdr_len] = '\0';
++    httpState->reply_hdr_size = hdr_len;
++    if (hdr_len > 4 && strncmp(httpState->reply_hdr, "HTTP/", 5)) {
++	debug(11, 3) ("httpProcessReplyHeader: Non-HTTP-compliant header: '%s'\n", httpState->reply_hdr);
++	httpState->reply_hdr_state += 2;
++	reply->sline.status = HTTP_INVALID_HEADER;
++	return;
++    }
++    t = httpState->reply_hdr + hdr_len;
++    /* headers can be incomplete only if object still arriving */
++    if (!httpState->eof) {
++	size_t k = headersEnd(httpState->reply_hdr, 8192);
++	if (0 == k)
++	    return;		/* headers not complete */
++	t = httpState->reply_hdr + k;
++    }
++    *t = '\0';
++    httpState->reply_hdr_state++;
++    assert(httpState->reply_hdr_state == 1);
++    ctx = ctx_enter(entry->mem_obj->url);
++    httpState->reply_hdr_state++;
++    debug(11, 9) ("GOT HTTP REPLY HDR:\n---------\n%s\n----------\n",
++	httpState->reply_hdr);
++    /* Parse headers into reply structure */
++    /* what happens if we fail to parse here? */
++    httpReplyParse(reply, httpState->reply_hdr, hdr_len);
++    storeTimestampsSet(entry);
++    /* Check if object is cacheable or not based on reply code */
++    debug(11, 3) ("httpProcessReplyHeader: HTTP CODE: %d\n", reply->sline.status);
++    if (neighbors_do_private_keys)
++	httpMaybeRemovePublic(entry, reply->sline.status);
++    switch (httpCachableReply(httpState)) {
++    case 1:
++	if (httpHeaderHas(&reply->header, HDR_VARY)
++#if X_ACCELERATOR_VARY
++	    || httpHeaderHas(&reply->header, HDR_X_ACCELERATOR_VARY)
++#endif
++	    ) {
++	    const char *vary = httpMakeVaryMark(httpState->orig_request, reply);
++	    if (vary) {
++		entry->mem_obj->vary_headers = xstrdup(vary);
++		/* Kill the old base object if a change in variance is detected */
++		httpMakePublic(entry);
++	    } else {
++		httpMakePrivate(entry);
++	    }
++	} else {
++	    httpMakePublic(entry);
++	}
++	break;
++    case 0:
++	httpMakePrivate(entry);
++	break;
++    case -1:
++	httpCacheNegatively(entry);
++	break;
++    default:
++	assert(0);
++	break;
++    }
++    if (reply->cache_control) {
++	if (EBIT_TEST(reply->cache_control->mask, CC_PROXY_REVALIDATE))
++	    EBIT_SET(entry->flags, ENTRY_REVALIDATE);
++	else if (EBIT_TEST(reply->cache_control->mask, CC_MUST_REVALIDATE))
++	    EBIT_SET(entry->flags, ENTRY_REVALIDATE);
++    }
++    if (httpState->flags.keepalive)
++	if (httpState->peer)
++	    httpState->peer->stats.n_keepalives_sent++;
++    if (reply->keep_alive) {
++	if (httpState->peer)
++	    httpState->peer->stats.n_keepalives_recv++;
++	if (Config.onoff.detect_broken_server_pconns && httpReplyBodySize(httpState->request->method, reply) == -1) {
++	    debug(11, 1) ("httpProcessReplyHeader: Impossible keep-alive header from '%s'\n", storeUrl(entry));
++	    debug(11, 2) ("GOT HTTP REPLY HDR:\n---------\n%s\n----------\n",
++		httpState->reply_hdr);
++	    httpState->flags.keepalive_broken = 1;
++	}
++    }
++    if (reply->date > -1 && !httpState->peer) {
++	int skew = abs(reply->date - squid_curtime);
++	if (skew > 86400)
++	    debug(11, 3) ("%s's clock is skewed by %d seconds!\n",
++		httpState->request->host, skew);
++    }
++    ctx_exit(ctx);
++#if HEADERS_LOG
++    headersLog(1, 0, httpState->request->method, reply);
++#endif
++}
++
++static int
++httpPconnTransferDone(HttpStateData * httpState)
++{
++    /* return 1 if we got the last of the data on a persistent connection */
++    MemObject *mem = httpState->entry->mem_obj;
++    HttpReply *reply = mem->reply;
++    int clen;
++    debug(11, 3) ("httpPconnTransferDone: FD %d\n", httpState->fd);
++    /*
++     * If we didn't send a keep-alive request header, then this
++     * can not be a persistent connection.
++     */
++    if (!httpState->flags.keepalive)
++	return 0;
++    /*
++     * What does the reply have to say about keep-alive?
++     */
++    /*
++     * XXX BUG?
++     * If the origin server (HTTP/1.0) does not send a keep-alive
++     * header, but keeps the connection open anyway, what happens?
++     * We'll return here and http.c waits for an EOF before changing
++     * store_status to STORE_OK.   Combine this with ENTRY_FWD_HDR_WAIT
++     * and an error status code, and we might have to wait until
++     * the server times out the socket.
++     */
++    if (!reply->keep_alive)
++	return 0;
++    debug(11, 5) ("httpPconnTransferDone: content_length=%d\n",
++	reply->content_length);
++    /* If we haven't seen the end of reply headers, we are not done */
++    if (httpState->reply_hdr_state < 2)
++	return 0;
++    clen = httpReplyBodySize(httpState->request->method, reply);
++    /* If there is no message body, we can be persistent */
++    if (0 == clen)
++	return 1;
++    /* If the body size is unknown we must wait for EOF */
++    if (clen < 0)
++	return 0;
++    /* If the body size is known, we must wait until we've gotten all of it.  */
++    if (mem->inmem_hi < reply->content_length + reply->hdr_sz)
++	return 0;
++    /* We got it all */
++    return 1;
++}
++
++/* This will be called when data is ready to be read from fd.  Read until
++ * error or connection closed. */
++/* XXX this function is too long! */
++static void
++httpReadReply(int fd, void *data)
++{
++    HttpStateData *httpState = data;
++    LOCAL_ARRAY(char, buf, SQUID_TCP_SO_RCVBUF);
++    StoreEntry *entry = httpState->entry;
++    const request_t *request = httpState->request;
++    int len;
++    int bin;
++    int clen;
++    size_t read_sz;
++#if DELAY_POOLS
++    delay_id delay_id;
++
++    /* special "if" only for http (for nodelay proxy conns) */
++    if (delayIsNoDelay(fd))
++	delay_id = 0;
++    else
++	delay_id = delayMostBytesAllowed(entry->mem_obj);
++#endif
++    if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
++	comm_close(fd);
++	return;
++    }
++    /* check if we want to defer reading */
++    errno = 0;
++    read_sz = SQUID_TCP_SO_RCVBUF;
++#if DELAY_POOLS
++    read_sz = delayBytesWanted(delay_id, 1, read_sz);
++#endif
++    statCounter.syscalls.sock.reads++;
++    len = FD_READ_METHOD(fd, buf, read_sz);
++    debug(11, 5) ("httpReadReply: FD %d: len %d.\n", fd, len);
++    if (len > 0) {
++	fd_bytes(fd, len, FD_READ);
++#if DELAY_POOLS
++	delayBytesIn(delay_id, len);
++#endif
++	kb_incr(&statCounter.server.all.kbytes_in, len);
++	kb_incr(&statCounter.server.http.kbytes_in, len);
++	IOStats.Http.reads++;
++	for (clen = len - 1, bin = 0; clen; bin++)
++	    clen >>= 1;
++	IOStats.Http.read_hist[bin]++;
++    }
++    if (!httpState->reply_hdr && len > 0 && fd_table[fd].uses > 1) {
++	/* Skip whitespace */
++	while (len > 0 && xisspace(*buf))
++	    xmemmove(buf, buf + 1, len--);
++	if (len == 0) {
++	    /* Continue to read... */
++	    /* Timeout NOT increased. This whitespace was from previous reply */
++	    commSetSelect(fd, COMM_SELECT_READ, httpReadReply, httpState, 0);
++	    return;
++	}
++    }
++    if (len < 0) {
++	debug(50, 2) ("httpReadReply: FD %d: read failure: %s.\n",
++	    fd, xstrerror());
++	if (ignoreErrno(errno)) {
++	    commSetSelect(fd, COMM_SELECT_READ, httpReadReply, httpState, 0);
++	} else if (entry->mem_obj->inmem_hi == 0) {
++	    ErrorState *err;
++	    err = errorCon(ERR_READ_ERROR, HTTP_INTERNAL_SERVER_ERROR);
++	    err->request = requestLink((request_t *) request);
++	    err->xerrno = errno;
++	    fwdFail(httpState->fwd, err);
++	    comm_close(fd);
++	} else {
++	    comm_close(fd);
++	}
++    } else if (len == 0 && entry->mem_obj->inmem_hi == 0) {
++	ErrorState *err;
++	err = errorCon(ERR_ZERO_SIZE_OBJECT, HTTP_SERVICE_UNAVAILABLE);
++	err->xerrno = errno;
++	err->request = requestLink((request_t *) request);
++	fwdFail(httpState->fwd, err);
++	httpState->eof = 1;
++	comm_close(fd);
++    } else if (len == 0) {
++	/* Connection closed; retrieval done. */
++	httpState->eof = 1;
++	if (httpState->reply_hdr_state < 2)
++	    /*
++	     * Yes Henrik, there is a point to doing this.  When we
++	     * called httpProcessReplyHeader() before, we didn't find
++	     * the end of headers, but now we are definately at EOF, so
++	     * we want to process the reply headers.
++	     */
++	    httpProcessReplyHeader(httpState, buf, len);
++	fwdComplete(httpState->fwd);
++	comm_close(fd);
++    } else {
++	if (httpState->reply_hdr_state < 2) {
++	    httpProcessReplyHeader(httpState, buf, len);
++	    if (httpState->reply_hdr_state == 2) {
++		http_status s = entry->mem_obj->reply->sline.status;
++#if WIP_FWD_LOG
++		fwdStatus(httpState->fwd, s);
++#endif
++		/*
++		 * If its not a reply that we will re-forward, then
++		 * allow the client to get it.
++		 */
++		if (!fwdReforwardableStatus(s))
++		    EBIT_CLR(entry->flags, ENTRY_FWD_HDR_WAIT);
++	    }
++	}
++	storeAppend(entry, buf, len);
++	if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
++	    /*
++	     * the above storeAppend() call could ABORT this entry,
++	     * in that case, the server FD should already be closed.
++	     * there's nothing for us to do.
++	     */
++	    (void) 0;
++	} else if (httpPconnTransferDone(httpState)) {
++	    /* yes we have to clear all these! */
++	    commSetDefer(fd, NULL, NULL);
++	    commSetTimeout(fd, -1, NULL, NULL);
++	    commSetSelect(fd, COMM_SELECT_READ, NULL, NULL, 0);
++#if DELAY_POOLS
++	    delayClearNoDelay(fd);
++#endif
++	    comm_remove_close_handler(fd, httpStateFree, httpState);
++	    fwdUnregister(fd, httpState->fwd);
++	    pconnPush(fd, request->host, request->port);
++	    fwdComplete(httpState->fwd);
++	    httpState->fd = -1;
++	    httpStateFree(fd, httpState);
++	} else {
++	    /* Wait for more data or EOF condition */
++	    if (httpState->flags.keepalive_broken) {
++		commSetTimeout(fd, 10, NULL, NULL);
++	    } else {
++		commSetTimeout(fd, Config.Timeout.read, NULL, NULL);
++	    }
++	    commSetSelect(fd, COMM_SELECT_READ, httpReadReply, httpState, 0);
++	}
++    }
++}
++
++/* This will be called when request write is complete. Schedule read of
++ * reply. */
++static void
++httpSendComplete(int fd, char *bufnotused, size_t size, int errflag, void *data)
++{
++    HttpStateData *httpState = data;
++    StoreEntry *entry = httpState->entry;
++    ErrorState *err;
++    debug(11, 5) ("httpSendComplete: FD %d: size %d: errflag %d.\n",
++	fd, (int) size, errflag);
++#if URL_CHECKSUM_DEBUG
++    assert(entry->mem_obj->chksum == url_checksum(entry->mem_obj->url));
++#endif
++    if (size > 0) {
++	fd_bytes(fd, size, FD_WRITE);
++	kb_incr(&statCounter.server.all.kbytes_out, size);
++	kb_incr(&statCounter.server.http.kbytes_out, size);
++    }
++    if (errflag == COMM_ERR_CLOSING)
++	return;
++    if (errflag) {
++	err = errorCon(ERR_WRITE_ERROR, HTTP_INTERNAL_SERVER_ERROR);
++	err->xerrno = errno;
++	err->request = requestLink(httpState->orig_request);
++	errorAppendEntry(entry, err);
++	comm_close(fd);
++	return;
++    } else {
++	/*
++	 * Set the read timeout here because it hasn't been set yet.
++	 * We only set the read timeout after the request has been
++	 * fully written to the server-side.  If we start the timeout
++	 * after connection establishment, then we are likely to hit
++	 * the timeout for POST/PUT requests that have very large
++	 * request bodies.
++	 */
++	commSetTimeout(fd, Config.Timeout.read, httpTimeout, httpState);
++	commSetDefer(fd, fwdCheckDeferRead, entry);
++    }
++}
++
++/*
++ * build request headers and append them to a given MemBuf 
++ * used by httpBuildRequestPrefix()
++ * note: calls httpHeaderInit(), the caller is responsible for Clean()-ing
++ */
++void
++httpBuildRequestHeader(request_t * request,
++    request_t * orig_request,
++    StoreEntry * entry,
++    HttpHeader * hdr_out,
++    http_state_flags flags)
++{
++    /* building buffer for complex strings */
++#define BBUF_SZ (MAX_URL+32)
++    LOCAL_ARRAY(char, bbuf, BBUF_SZ);
++    String strConnection = StringNull;
++    const HttpHeader *hdr_in = &orig_request->header;
++    int we_do_ranges;
++    const HttpHeaderEntry *e;
++    String strVia;
++    String strFwd;
++    HttpHeaderPos pos = HttpHeaderInitPos;
++    httpHeaderInit(hdr_out, hoRequest);
++    /* append our IMS header */
++    if (request->lastmod > -1 && request->method == METHOD_GET)
++	httpHeaderPutTime(hdr_out, HDR_IF_MODIFIED_SINCE, request->lastmod);
++
++    /* decide if we want to do Ranges ourselves 
++     * (and fetch the whole object now)
++     * We want to handle Ranges ourselves iff
++     *    - we can actually parse client Range specs
++     *    - the specs are expected to be simple enough (e.g. no out-of-order ranges)
++     *    - reply will be cachable
++     * (If the reply will be uncachable we have to throw it away after 
++     *  serving this request, so it is better to forward ranges to 
++     *  the server and fetch only the requested content) 
++     */
++    if (NULL == orig_request->range)
++	we_do_ranges = 0;
++    else if (!orig_request->flags.cachable)
++	we_do_ranges = 0;
++    else if (httpHdrRangeOffsetLimit(orig_request->range))
++	we_do_ranges = 0;
++    else
++	we_do_ranges = 1;
++    debug(11, 8) ("httpBuildRequestHeader: range specs: %p, cachable: %d; we_do_ranges: %d\n",
++	orig_request->range, orig_request->flags.cachable, we_do_ranges);
++
++    strConnection = httpHeaderGetList(hdr_in, HDR_CONNECTION);
++    while ((e = httpHeaderGetEntry(hdr_in, &pos))) {
++	debug(11, 5) ("httpBuildRequestHeader: %s: %s\n",
++	    strBuf(e->name), strBuf(e->value));
++	if (!httpRequestHdrAllowed(e, &strConnection)) {
++	    debug(11, 2) ("'%s' header denied by anonymize_headers configuration\n",
++		strBuf(e->name));
++	    continue;
++	}
++	switch (e->id) {
++	case HDR_PROXY_AUTHORIZATION:
++	    /* Only pass on proxy authentication to peers for which
++	     * authentication forwarding is explicitly enabled
++	     */
++	    if (request->flags.proxying && orig_request->peer_login &&
++		strcmp(orig_request->peer_login, "PASS") == 0) {
++		httpHeaderAddEntry(hdr_out, httpHeaderEntryClone(e));
++	    }
++	    break;
++	case HDR_AUTHORIZATION:
++	    /* Pass on WWW authentication even if used locally. If this is
++	     * not wanted in an accelerator then the header can be removed
++	     * using the anonymization functions
++	     */
++	    httpHeaderAddEntry(hdr_out, httpHeaderEntryClone(e));
++	    /* XXX Some accelerators might want to strip the header
++	     * and regard the reply as cacheable, but authentication
++	     * is not normally enabled for accelerators without reading
++	     * the code, so there is not much use in adding logics here
++	     * without first defining the concept of having authentication
++	     * in the accelerator...
++	     */
++	    break;
++	case HDR_HOST:
++	    /*
++	     * Normally Squid rewrites the Host: header.
++	     * However, there is one case when we don't: If the URL
++	     * went through our redirector and the admin configured
++	     * 'redir_rewrites_host' to be off.
++	     */
++	    if (request->flags.redirected && !Config.onoff.redir_rewrites_host)
++		httpHeaderAddEntry(hdr_out, httpHeaderEntryClone(e));
++	    else {
++		/* use port# only if not default */
++		if (orig_request->port == urlDefaultPort(orig_request->protocol)) {
++		    httpHeaderPutStr(hdr_out, HDR_HOST, orig_request->host);
++		} else {
++		    httpHeaderPutStrf(hdr_out, HDR_HOST, "%s:%d",
++			orig_request->host, (int) orig_request->port);
++		}
++	    }
++	    break;
++	case HDR_IF_MODIFIED_SINCE:
++	    /* append unless we added our own;
++	     * note: at most one client's ims header can pass through */
++	    if (!httpHeaderHas(hdr_out, HDR_IF_MODIFIED_SINCE))
++		httpHeaderAddEntry(hdr_out, httpHeaderEntryClone(e));
++	    break;
++	case HDR_MAX_FORWARDS:
++	    if (orig_request->method == METHOD_TRACE) {
++		/* sacrificing efficiency over clarity, etc. */
++		const int hops = httpHeaderGetInt(hdr_in, HDR_MAX_FORWARDS);
++		if (hops > 0)
++		    httpHeaderPutInt(hdr_out, HDR_MAX_FORWARDS, hops - 1);
++	    }
++	    break;
++	case HDR_RANGE:
++	case HDR_IF_RANGE:
++	case HDR_REQUEST_RANGE:
++	    if (!we_do_ranges)
++		httpHeaderAddEntry(hdr_out, httpHeaderEntryClone(e));
++	    break;
++	case HDR_PROXY_CONNECTION:
++	case HDR_CONNECTION:
++	case HDR_VIA:
++	case HDR_X_FORWARDED_FOR:
++	case HDR_CACHE_CONTROL:
++	    /* append these after the loop if needed */
++	    break;
++	default:
++	    /* pass on all other header fields */
++	    httpHeaderAddEntry(hdr_out, httpHeaderEntryClone(e));
++	}
++    }
++
++    /* append Via */
++    strVia = httpHeaderGetList(hdr_in, HDR_VIA);
++    snprintf(bbuf, BBUF_SZ, "%d.%d %s",
++	orig_request->http_ver.major,
++	orig_request->http_ver.minor, ThisCache);
++    strListAdd(&strVia, bbuf, ',');
++    httpHeaderPutStr(hdr_out, HDR_VIA, strBuf(strVia));
++    stringClean(&strVia);
++
++    /* append X-Forwarded-For */
++    strFwd = httpHeaderGetList(hdr_in, HDR_X_FORWARDED_FOR);
++    strListAdd(&strFwd,
++	(((orig_request->client_addr.s_addr != no_addr.s_addr) && opt_forwarded_for) ?
++	    inet_ntoa(orig_request->client_addr) : "unknown"), ',');
++    httpHeaderPutStr(hdr_out, HDR_X_FORWARDED_FOR, strBuf(strFwd));
++    stringClean(&strFwd);
++
++    /* append Host if not there already */
++    if (!httpHeaderHas(hdr_out, HDR_HOST)) {
++	/* use port# only if not default */
++	if (orig_request->port == urlDefaultPort(orig_request->protocol)) {
++	    httpHeaderPutStr(hdr_out, HDR_HOST, orig_request->host);
++	} else {
++	    httpHeaderPutStrf(hdr_out, HDR_HOST, "%s:%d",
++		orig_request->host, (int) orig_request->port);
++	}
++    }
++    /* append Authorization if known in URL, not in header and going direct */
++    if (!httpHeaderHas(hdr_out, HDR_AUTHORIZATION)) {
++	if (!request->flags.proxying && *request->login) {
++	    httpHeaderPutStrf(hdr_out, HDR_AUTHORIZATION, "Basic %s",
++		base64_encode(request->login));
++	}
++    }
++    /* append Proxy-Authorization if configured for peer, and proxying */
++    if (request->flags.proxying && orig_request->peer_login &&
++	!httpHeaderHas(hdr_out, HDR_PROXY_AUTHORIZATION) &&
++	strcmp(orig_request->peer_login, "PASS") != 0) {
++	if (*orig_request->peer_login == '*') {
++	    /* Special mode, to pass the username to the upstream cache */
++	    char loginbuf[256];
++	    const char *username = "-";
++	    if (orig_request->auth_user_request)
++		username = authenticateUserRequestUsername(orig_request->auth_user_request);
++	    snprintf(loginbuf, sizeof(loginbuf), "%s%s", username, orig_request->peer_login + 1);
++	    httpHeaderPutStrf(hdr_out, HDR_PROXY_AUTHORIZATION, "Basic %s",
++		base64_encode(loginbuf));
++	} else {
++	    httpHeaderPutStrf(hdr_out, HDR_PROXY_AUTHORIZATION, "Basic %s",
++		base64_encode(orig_request->peer_login));
++	}
++    }
++    /* append Cache-Control, add max-age if not there already */
++    {
++	HttpHdrCc *cc = httpHeaderGetCc(hdr_in);
++	if (!cc)
++	    cc = httpHdrCcCreate();
++	if (!EBIT_TEST(cc->mask, CC_MAX_AGE)) {
++	    const char *url = entry ? storeUrl(entry) : urlCanonical(orig_request);
++	    httpHdrCcSetMaxAge(cc, getMaxAge(url));
++	    if (strLen(request->urlpath))
++		assert(strstr(url, strBuf(request->urlpath)));
++	}
++	/* Set no-cache if determined needed but not found */
++	if (orig_request->flags.nocache && !httpHeaderHas(hdr_in, HDR_PRAGMA))
++	    EBIT_SET(cc->mask, CC_NO_CACHE);
++	/* Enforce sibling relations */
++	if (flags.only_if_cached)
++	    EBIT_SET(cc->mask, CC_ONLY_IF_CACHED);
++	httpHeaderPutCc(hdr_out, cc);
++	httpHdrCcDestroy(cc);
++    }
++    /* maybe append Connection: keep-alive */
++    if (flags.keepalive) {
++	if (flags.proxying) {
++	    httpHeaderPutStr(hdr_out, HDR_PROXY_CONNECTION, "keep-alive");
++	} else {
++	    httpHeaderPutStr(hdr_out, HDR_CONNECTION, "keep-alive");
++	}
++    }
++    /* Now mangle the headers. */
++    httpHdrMangleList(hdr_out, orig_request);
++    stringClean(&strConnection);
++}
++
++/* build request prefix and append it to a given MemBuf; 
++ * return the length of the prefix */
++mb_size_t
++httpBuildRequestPrefix(request_t * request,
++    request_t * orig_request,
++    StoreEntry * entry,
++    MemBuf * mb,
++    http_state_flags flags)
++{
++    const int offset = mb->size;
++    memBufPrintf(mb, "%s %s HTTP/1.0\r\n",
++	RequestMethodStr[request->method],
++	strLen(request->urlpath) ? strBuf(request->urlpath) : "/");
++    /* build and pack headers */
++    {
++	HttpHeader hdr;
++	Packer p;
++	httpBuildRequestHeader(request, orig_request, entry, &hdr, flags);
++	packerToMemInit(&p, mb);
++	httpHeaderPackInto(&hdr, &p);
++	httpHeaderClean(&hdr);
++	packerClean(&p);
++    }
++    /* append header terminator */
++    memBufAppend(mb, crlf, 2);
++    return mb->size - offset;
++}
++/* This will be called when connect completes. Write request. */
++static void
++httpSendRequest(HttpStateData * httpState)
++{
++    MemBuf mb;
++    request_t *req = httpState->request;
++    StoreEntry *entry = httpState->entry;
++    peer *p = httpState->peer;
++    CWCB *sendHeaderDone;
++    int fd = httpState->fd;
++
++    debug(11, 5) ("httpSendRequest: FD %d: httpState %p.\n", fd, httpState);
++
++    /* Schedule read reply. (but no timeout set until request fully sent) */
++    commSetTimeout(fd, Config.Timeout.lifetime, httpTimeout, httpState);
++    commSetSelect(fd, COMM_SELECT_READ, httpReadReply, httpState, 0);
++
++    if (httpState->orig_request->body_connection)
++	sendHeaderDone = httpSendRequestEntry;
++    else
++	sendHeaderDone = httpSendComplete;
++
++    if (p != NULL)
++	httpState->flags.proxying = 1;
++    else
++	httpState->flags.proxying = 0;
++    /*
++     * Is keep-alive okay for all request methods?
++     */
++    if (!Config.onoff.server_pconns)
++	httpState->flags.keepalive = 0;
++    else if (p == NULL)
++	httpState->flags.keepalive = 1;
++    else if (p->stats.n_keepalives_sent < 10)
++	httpState->flags.keepalive = 1;
++    else if ((double) p->stats.n_keepalives_recv / (double) p->stats.n_keepalives_sent > 0.50)
++	httpState->flags.keepalive = 1;
++    if (httpState->peer)
++	if (neighborType(httpState->peer, httpState->request) == PEER_SIBLING &&
++	    !httpState->peer->options.allow_miss)
++	    httpState->flags.only_if_cached = 1;
++    memBufDefInit(&mb);
++    httpBuildRequestPrefix(req,
++	httpState->orig_request,
++	entry,
++	&mb,
++	httpState->flags);
++    debug(11, 6) ("httpSendRequest: FD %d:\n%s\n", fd, mb.buf);
++    comm_write_mbuf(fd, mb, sendHeaderDone, httpState);
++}
++
++void
++httpStart(FwdState * fwd)
++{
++    int fd = fwd->server_fd;
++    HttpStateData *httpState;
++    request_t *proxy_req;
++    request_t *orig_req = fwd->request;
++    debug(11, 3) ("httpStart: \"%s %s\"\n",
++	RequestMethodStr[orig_req->method],
++	storeUrl(fwd->entry));
++    httpState = cbdataAlloc(HttpStateData);
++    storeLockObject(fwd->entry);
++    httpState->fwd = fwd;
++    httpState->entry = fwd->entry;
++    httpState->fd = fd;
++    if (fwd->servers)
++	httpState->peer = fwd->servers->peer;	/* might be NULL */
++    if (httpState->peer) {
++	proxy_req = requestCreate(orig_req->method,
++	    PROTO_NONE, storeUrl(httpState->entry));
++	xstrncpy(proxy_req->host, httpState->peer->host, SQUIDHOSTNAMELEN);
++	proxy_req->port = httpState->peer->http_port;
++	proxy_req->flags = orig_req->flags;
++	proxy_req->lastmod = orig_req->lastmod;
++	httpState->request = requestLink(proxy_req);
++	httpState->orig_request = requestLink(orig_req);
++	proxy_req->flags.proxying = 1;
++	/*
++	 * This NEIGHBOR_PROXY_ONLY check probably shouldn't be here.
++	 * We might end up getting the object from somewhere else if,
++	 * for example, the request to this neighbor fails.
++	 */
++	if (httpState->peer->options.proxy_only)
++	    storeReleaseRequest(httpState->entry);
++#if DELAY_POOLS
++	assert(delayIsNoDelay(fd) == 0);
++	if (httpState->peer->options.no_delay)
++	    delaySetNoDelay(fd);
++#endif
++    } else {
++	httpState->request = requestLink(orig_req);
++	httpState->orig_request = requestLink(orig_req);
++    }
++    /*
++     * register the handler to free HTTP state data when the FD closes
++     */
++    comm_add_close_handler(fd, httpStateFree, httpState);
++    statCounter.server.all.requests++;
++    statCounter.server.http.requests++;
++    httpSendRequest(httpState);
++    /*
++     * We used to set the read timeout here, but not any more.
++     * Now its set in httpSendComplete() after the full request,
++     * including request body, has been written to the server.
++     */
++}
++
++static void
++httpSendRequestEntryDone(int fd, void *data)
++{
++    HttpStateData *httpState = data;
++    aclCheck_t ch;
++    debug(11, 5) ("httpSendRequestEntryDone: FD %d\n",
++	fd);
++    memset(&ch, '\0', sizeof(ch));
++    ch.request = httpState->request;
++    if (!Config.accessList.brokenPosts) {
++	debug(11, 5) ("httpSendRequestEntryDone: No brokenPosts list\n");
++	httpSendComplete(fd, NULL, 0, 0, data);
++    } else if (!aclCheckFast(Config.accessList.brokenPosts, &ch)) {
++	debug(11, 5) ("httpSendRequestEntryDone: didn't match brokenPosts\n");
++	httpSendComplete(fd, NULL, 0, 0, data);
++    } else {
++	debug(11, 2) ("httpSendRequestEntryDone: matched brokenPosts\n");
++	comm_write(fd, "\r\n", 2, httpSendComplete, data, NULL);
++    }
++}
++
++static void
++httpRequestBodyHandler(char *buf, ssize_t size, void *data)
++{
++    HttpStateData *httpState = (HttpStateData *) data;
++    httpState->body_buf = NULL;
++    if (size > 0) {
++	if (httpState->reply_hdr_state >= 2 && !httpState->flags.abuse_detected) {
++	    httpState->flags.abuse_detected = 1;
++	    debug(11, 1) ("httpSendRequestEntryDone: Likely proxy abuse detected '%s' -> '%s'\n",
++		inet_ntoa(httpState->orig_request->client_addr),
++		storeUrl(httpState->entry));
++	    if (httpState->entry->mem_obj->reply->sline.status == HTTP_INVALID_HEADER) {
++		memFree8K(buf);
++		comm_close(httpState->fd);
++		return;
++	    }
++	}
++	comm_write(httpState->fd, buf, size, httpSendRequestEntry, data, memFree8K);
++    } else if (size == 0) {
++	/* End of body */
++	memFree8K(buf);
++	httpSendRequestEntryDone(httpState->fd, data);
++    } else {
++	/* Failed to get whole body, probably aborted */
++	memFree8K(buf);
++	httpSendComplete(httpState->fd, NULL, 0, COMM_ERR_CLOSING, data);
++    }
++}
++
++static void
++httpSendRequestEntry(int fd, char *bufnotused, size_t size, int errflag, void *data)
++{
++    HttpStateData *httpState = data;
++    StoreEntry *entry = httpState->entry;
++    ErrorState *err;
++    debug(11, 5) ("httpSendRequestEntry: FD %d: size %d: errflag %d.\n",
++	fd, (int) size, errflag);
++    if (size > 0) {
++	fd_bytes(fd, size, FD_WRITE);
++	kb_incr(&statCounter.server.all.kbytes_out, size);
++	kb_incr(&statCounter.server.http.kbytes_out, size);
++    }
++    if (errflag == COMM_ERR_CLOSING)
++	return;
++    if (errflag) {
++	err = errorCon(ERR_WRITE_ERROR, HTTP_INTERNAL_SERVER_ERROR);
++	err->xerrno = errno;
++	err->request = requestLink(httpState->orig_request);
++	errorAppendEntry(entry, err);
++	comm_close(fd);
++	return;
++    }
++    if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
++	comm_close(fd);
++	return;
++    }
++    httpState->body_buf = memAllocate(MEM_8K_BUF);
++    clientReadBody(httpState->orig_request, httpState->body_buf, 8192, httpRequestBodyHandler, httpState);
++}
++
++void
++httpBuildVersion(http_version_t * version, unsigned int major, unsigned int minor)
++{
++    version->major = major;
++    version->minor = minor;
++}
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/structs.h squid-2.5.5/src/structs.h
+--- /home/gangitano/debian/squid/squid-2.5.5/src/structs.h	2004-02-04 18:42:28.000000000 +0100
++++ squid-2.5.5/src/structs.h	2004-05-31 22:14:43.000000000 +0200
+@@ -986,6 +986,7 @@
+     http_state_flags flags;
+     FwdState *fwd;
+     char *body_buf;
++    int body_buf_sz;
+ };
+ 
+ struct _icpUdpData {
--- squid-2.5.9.orig/debian/patches/13-ntlm-overflow.dpatch
+++ squid-2.5.9/debian/patches/13-ntlm-overflow.dpatch
@@ -0,0 +1,95 @@
+#! /bin/sh -e
+## 17-ntlm-overflow.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/helpers/ntlm_auth/SMB/libntlmssp.c squid-2.5.5/helpers/ntlm_auth/SMB/libntlmssp.c
+--- /home/gangitano/debian/squid/squid-2.5.5/helpers/ntlm_auth/SMB/libntlmssp.c	2004-06-28 20:06:53.000000000 +0200
++++ squid-2.5.5/helpers/ntlm_auth/SMB/libntlmssp.c	2004-06-28 20:07:20.000000000 +0200
+@@ -161,7 +161,10 @@
+ #define min(A,B) (A<B?A:B)
+ 
+ int ntlm_errno;
+-static char credentials[1024];	/* we can afford to waste */
++#define MAX_USERNAME_LEN 255
++#define MAX_DOMAIN_LEN 255
++#define MAX_PASSWD_LEN 31
++static char credentials[MAX_USERNAME_LEN+MAX_DOMAIN_LEN+2];	/* we can afford to waste */
+ 
+ 
+ /* Fetches the user's credentials from the challenge.
+@@ -197,7 +200,7 @@
+ ntlm_check_auth(ntlm_authenticate * auth, int auth_length)
+ {
+     int rv;
+-    char pass[25] /*, encrypted_pass[40] */;
++    char pass[MAX_PASSWD_LEN+1];
+     char *domain = credentials;
+     char *user;
+     lstring tmp;
+@@ -215,6 +218,11 @@
+ 	ntlm_errno = NTLM_LOGON_ERROR;
+ 	return NULL;
+     }
++    if (tmp.l > MAX_DOMAIN_LEN) {
++	debug("Domain string exceeds %d bytes, rejecting\n", MAX_DOMAIN_LEN);
++	ntlm_errno = NTLM_LOGON_ERROR;
++	return NULL;
++    }
+     memcpy(domain, tmp.str, tmp.l);
+     user = domain + tmp.l;
+     *user++ = '\0';
+@@ -226,20 +234,30 @@
+ 	ntlm_errno = NTLM_LOGON_ERROR;
+ 	return NULL;
+     }
++    if (tmp.l > MAX_USERNAME_LEN) {
++	debug("Username string exceeds %d bytes, rejecting\n", MAX_USERNAME_LEN);
++	ntlm_errno = NTLM_LOGON_ERROR;
++	return NULL;
++    }
+     memcpy(user, tmp.str, tmp.l);
+     *(user + tmp.l) = '\0';
+ 
+ 		
+-		/* Authenticating against the NT response doesn't seem to work... */
++    /* Authenticating against the NT response doesn't seem to work... */
+     tmp = ntlm_fetch_string((char *) auth, auth_length, &auth->lmresponse);
+     if (tmp.str == NULL || tmp.l == 0) {
+ 	fprintf(stderr, "No auth at all. Returning no-auth\n");
+ 	ntlm_errno = NTLM_LOGON_ERROR;
+ 	return NULL;
+     }
+-		
++    if (tmp.l > MAX_PASSWD_LEN) {
++	debug("Password string exceeds %d bytes, rejecting\n", MAX_PASSWD_LEN);
++	ntlm_errno = NTLM_LOGON_ERROR;
++	return NULL;
++    }
++
+     memcpy(pass, tmp.str, tmp.l);
+-    pass[25] = '\0';
++    pass[min(MAX_PASSWD_LEN,tmp.l)] = '\0';
+ 
+ #if 1
+ 		debug ("Empty LM pass detection: user: '%s', ours:'%s', his: '%s'"
--- squid-2.5.9.orig/debian/patches/14-proxy-abuse.dpatch
+++ squid-2.5.9/debian/patches/14-proxy-abuse.dpatch
@@ -0,0 +1,39 @@
+#! /bin/sh -e
+## 14-proxy-abuse.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/http.c squid-2.5.5/src/http.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/http.c	2004-06-10 00:09:23.000000000 +0200
++++ squid-2.5.5/src/http.c	2004-06-10 00:09:58.000000000 +0200
+@@ -65,7 +65,9 @@
+     if (httpState == NULL)
+ 	return;
+     if (httpState->body_buf) {
+-	clientAbortBody(httpState->orig_request);
++	if (httpState->orig_request->body_connection) {
++	    clientAbortBody(httpState->orig_request);
++	}
+ 	if (httpState->body_buf) {
+ 	    memFree(httpState->body_buf, MEM_8K_BUF);
+ 	    httpState->body_buf = NULL;
--- squid-2.5.9.orig/debian/patches/15-dns-localhost.dpatch
+++ squid-2.5.9/debian/patches/15-dns-localhost.dpatch
@@ -0,0 +1,50 @@
+#! /bin/sh -e
+## 15-dns-localhost.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/dns_internal.c squid-2.5.5/src/dns_internal.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/dns_internal.c	2003-12-06 18:19:37.000000000 +0100
++++ squid-2.5.5/src/dns_internal.c	2004-06-18 18:45:45.000000000 +0200
+@@ -656,14 +656,16 @@
+     if (0 == nns)
+ 	idnsParseWIN32Registry();
+ #endif
+-    if (0 == nns)
+-	fatal("Could not find any nameservers.\n"
++    if (0 == nns) {
++	debug(78, 1) ("Warning: Could not find any nameservers. Trying to use localhost\n");
+ #if defined(_SQUID_MSWIN_) || defined(_SQUID_CYGWIN_)
+-	    "       Please check your TCP-IP settings or /etc/resolv.conf file\n"
++	debug(78, 1) ("Please check your TCP-IP settings or /etc/resolv.conf file\n");
+ #else
+-	    "       Please check your /etc/resolv.conf file\n"
++	debug(78, 1) ("Please check your /etc/resolv.conf file\n");
+ #endif
+-	    "       or use the 'dns_nameservers' option in squid.conf.");
++	debug(78, 1) ("or use the 'dns_nameservers' option in squid.conf.");
++	idnsAddNameserver("127.0.0.1");
++    }
+     if (!init) {
+ 	memDataInit(MEM_IDNS_QUERY, "idns_query", sizeof(idns_query), 0);
+ 	cachemgrRegister("idns",
--- squid-2.5.9.orig/debian/patches/16-range-offset-limit.dpatch
+++ squid-2.5.9/debian/patches/16-range-offset-limit.dpatch
@@ -0,0 +1,39 @@
+#! /bin/sh -e
+## 16-range-offset-limit.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.5/src/cache_cf.c squid-2.5.5/src/cache_cf.c
+--- /home/gangitano/debian/squid/squid-2.5.5/src/cache_cf.c	2003-12-06 18:19:36.000000000 +0100
++++ squid-2.5.5/src/cache_cf.c	2004-06-18 18:49:51.000000000 +0200
+@@ -502,6 +502,10 @@
+ 	self_destruct();
+     if ((token = strtok(NULL, w_space)) == NULL)
+ 	self_destruct();
++    if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
++	*bptr = (size_t) - 1;
++	return;
++    }
+     d = atof(token);
+     m = u;			/* default to 'units' if none specified */
+     if (0.0 == d)
--- squid-2.5.9.orig/debian/patches/17-head.dpatch
+++ squid-2.5.9/debian/patches/17-head.dpatch
@@ -0,0 +1,44 @@
+#! /bin/sh -e
+## 17-head.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/src/client_side.c squid-2.5.6/src/client_side.c
+--- /home/gangitano/debian/squid/squid-2.5.6/src/client_side.c	2004-06-01 00:57:09.000000000 +0200
++++ squid-2.5.6/src/client_side.c	2004-07-27 19:46:35.000000000 +0200
+@@ -1584,15 +1584,6 @@
+     if (checkNegativeHit(e)) {
+ 	http->log_type = LOG_TCP_NEGATIVE_HIT;
+ 	clientSendMoreData(data, buf, size);
+-    } else if (r->method == METHOD_HEAD) {
+-	/*
+-	 * RFC 2068 seems to indicate there is no "conditional HEAD"
+-	 * request.  We cannot validate a cached object for a HEAD
+-	 * request, nor can we return 304.
+-	 */
+-	if (e->mem_status == IN_MEMORY)
+-	    http->log_type = LOG_TCP_MEM_HIT;
+-	clientSendMoreData(data, buf, size);
+     } else if (!Config.onoff.offline && refreshCheckHTTP(e, r) && !http->flags.internal) {
+ 	debug(33, 5) ("clientCacheHit: in refreshCheck() block\n");
+ 	/*
--- squid-2.5.9.orig/debian/patches/18-ufs-no-valid-dir.dpatch
+++ squid-2.5.9/debian/patches/18-ufs-no-valid-dir.dpatch
@@ -0,0 +1,36 @@
+#! /bin/sh -e
+## 18-ufs-no-valid-dir.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Upstream patch to fix store errors with ufs
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/src/fs/ufs/store_dir_ufs.c squid-2.5.6/src/fs/ufs/store_dir_ufs.c
+--- /home/gangitano/debian/squid/squid-2.5.6/src/fs/ufs/store_dir_ufs.c	2004-06-01 00:03:31.000000000 +0200
++++ squid-2.5.6/src/fs/ufs/store_dir_ufs.c	2004-08-04 15:10:10.000000000 +0200
+@@ -1636,6 +1636,7 @@
+     ufsinfo->swaplog_fd = -1;
+     ufsinfo->map = NULL;	/* Debugging purposes */
+     ufsinfo->suggest = 0;
++    ufsinfo->open_files = 0;
+     sd->init = storeUfsDirInit;
+     sd->newfs = storeUfsDirNewfs;
+     sd->dump = storeUfsDirDump;
--- squid-2.5.9.orig/debian/patches/22-cachemgr-acl.dpatch
+++ squid-2.5.9/debian/patches/22-cachemgr-acl.dpatch
@@ -0,0 +1,78 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 22-cachemgr-acl.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix potential malicous usage of cachemgr.cgi
+
+@DPATCH@
+diff -urNad squid-2.5.6/src/cachemgr.c /tmp/dpep.tQfre2/squid-2.5.6/src/cachemgr.c
+--- squid-2.5.6/src/cachemgr.c	2004-10-07 18:48:14.000000000 +0200
++++ /tmp/dpep.tQfre2/squid-2.5.6/src/cachemgr.c	2004-10-07 18:53:48.000000000 +0200
+@@ -159,6 +159,7 @@
+ static const char *progname = NULL;
+ static time_t now;
+ static struct in_addr no_addr;
++static const char *configfile = "/etc/squid/cachemgr.conf";
+ 
+ /*
+  * Function prototypes
+@@ -180,6 +181,8 @@
+ static void reset_auth(cachemgr_request * req);
+ static const char *make_auth_header(const cachemgr_request * req);
+ 
++static int check_target_acl(const char *hostname, int port);
++
+ 
+ static const char *
+ safe_str(const char *str)
+@@ -534,6 +537,11 @@
+ 	auth_html(req->hostname, req->port, req->user_name);
+ 	return 0;
+     }
++	if ((check_target_acl(req->hostname, req->port)) > 0) {
++	snprintf(buf, 1024, "acl: target not allowed\n");
++	error_html(buf);
++	return 1;
++	}
+     if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
+ 	snprintf(buf, 1024, "socket: %s\n", xstrerror());
+ 	error_html(buf);
+@@ -751,3 +759,38 @@
+ 	"Proxy-Authorization: Basic %s\r\n", str64);
+     return buf;
+ }
++
++static int 
++check_target_acl(const char *hostname, int port)
++{
++    char config_line[BUFSIZ];
++	char *token = NULL;
++	int i;
++    FILE *fp = NULL;
++	if ((fp = fopen(configfile, "r")) == NULL) {
++		if ((strcmp(hostname, CACHEMGR_HOSTNAME) == 0) || port == CACHE_HTTP_PORT)
++			return 0;
++	} else {
++		while (fgets(config_line, BUFSIZ, fp)) {
++    		if ((token = strchr(config_line, '\n')))
++        		*token = '\0';
++    		if (config_line[0] == '#')
++        		continue;
++    		if (config_line[0] == '\0')
++        		continue;
++			if ((token = strtok(config_line, ":")) == NULL)
++				continue;
++			if (strcmp(token, hostname) != 0) {
++				continue;
++			} else {
++				if ((token = strtok(NULL, ":")) == NULL)
++					continue;
++				if (sscanf(token, "%d", &i) != 1)
++					continue;
++				if (i == port)
++					return 0;
++			}
++		}	
++	}
++	return 1;	
++}
--- squid-2.5.9.orig/debian/patches/19-heap-segfault.dpatch
+++ squid-2.5.9/debian/patches/19-heap-segfault.dpatch
@@ -0,0 +1,44 @@
+#! /bin/sh -e
+## 19-heap-segfault.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Upstream patch to fix segfault using heap replacing policies
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/src/repl/heap/store_repl_heap.c squid-2.5.6/src/repl/heap/store_repl_heap.c
+--- /home/gangitano/debian/squid/squid-2.5.6/src/repl/heap/store_repl_heap.c	2002-07-22 02:07:17.000000000 +0200
++++ squid-2.5.6/src/repl/heap/store_repl_heap.c	2004-08-09 17:54:57.000000000 +0200
+@@ -191,6 +191,7 @@
+     age = heap_peepminkey(heap->heap);
+     entry = heap_extractmin(heap->heap);
+     if (storeEntryLocked(entry)) {
++	storeLockObject(entry);
+ 	linklistPush(&heap_walker->locked_entries, entry);
+ 	goto try_again;
+     }
+@@ -220,6 +221,7 @@
+     while ((entry = linklistShift(&heap_walker->locked_entries))) {
+ 	heap_node *node = heap_insert(heap->heap, entry);
+ 	SET_POLICY_NODE(entry, node);
++	storeUnlockObject(entry);
+     }
+     safe_free(walker->_data);
+     cbdataFree(walker);
--- squid-2.5.9.orig/debian/patches/20-ntlm-fetch-string.dpatch
+++ squid-2.5.9/debian/patches/20-ntlm-fetch-string.dpatch
@@ -0,0 +1,49 @@
+#! /bin/sh -e
+## 20-ntlm-fetch-string.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/helpers/ntlm_auth/fakeauth/fakeauth_auth.c squid-2.5.6/helpers/ntlm_auth/fakeauth/fakeauth_auth.c
+--- /home/gangitano/debian/squid/squid-2.5.6/helpers/ntlm_auth/fakeauth/fakeauth_auth.c	2001-08-29 16:57:38.000000000 +0200
++++ squid-2.5.6/helpers/ntlm_auth/fakeauth/fakeauth_auth.c	2004-08-28 18:31:11.000000000 +0200
+@@ -150,7 +150,7 @@
+     o = WSWAP(str->offset);
+ 
+     /* Sanity checks. XXX values arbitrarialy chosen */
+-    if (l <= 0 || l >= 32 || o >= 256) {
++    if (l <= 0 || o <= 0 || l >= 32 || o >= 256) {
+ 	fprintf(stderr, "ntlmGetString: insane: l:%d o:%d\n", l, o);
+ 	return (NULL);
+     }
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/lib/ntlmauth.c squid-2.5.6/lib/ntlmauth.c
+--- /home/gangitano/debian/squid/squid-2.5.6/lib/ntlmauth.c	2002-07-22 04:06:31.000000000 +0200
++++ squid-2.5.6/lib/ntlmauth.c	2004-08-28 18:31:11.000000000 +0200
+@@ -84,7 +84,7 @@
+     o = WSWAP(str->offset);
+     /* debug("fetch_string(plength=%d,l=%d,o=%d)\n",length,l,o); */
+ 
+-    if (l < 0 || l > MAX_FIELD_LENGTH || o + l > length || o == 0) {
++    if (l < 0 || o <= 0 || l > MAX_FIELD_LENGTH || o + l > length) {
+ 	/* debug("ntlmssp: insane data (l: %d, o: %d)\n", l,o); */
+ 	return rv;
+     }
--- squid-2.5.9.orig/debian/patches/21-ntlm-noreuse-leak.dpatch
+++ squid-2.5.9/debian/patches/21-ntlm-noreuse-leak.dpatch
@@ -0,0 +1,1152 @@
+#! /bin/sh -e
+## 21-ntlm-noreuse-leak.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/src/auth/ntlm/auth_ntlm.c squid-2.5.6/src/auth/ntlm/auth_ntlm.c
+--- /home/gangitano/debian/squid/squid-2.5.6/src/auth/ntlm/auth_ntlm.c	2004-04-18 03:29:52.000000000 +0200
++++ squid-2.5.6/src/auth/ntlm/auth_ntlm.c	2004-08-28 18:37:26.000000000 +0200
+@@ -91,6 +91,7 @@
+ 
+ static hash_table *proxy_auth_cache = NULL;
+ 
++static void authenticateNTLMReleaseServer(ntlm_request_t * ntlm_request);
+ /*
+  *
+  * Private Functions
+@@ -379,8 +380,7 @@
+ 	xfree(ntlm_request->ntlmauthenticate);
+     if (ntlm_request->authserver != NULL) {
+ 	debug(29, 9) ("authenticateNTLMRequestFree: releasing server '%p'\n", ntlm_request->authserver);
+-	helperStatefulReleaseServer(ntlm_request->authserver);
+-	ntlm_request->authserver = NULL;
++	authenticateNTLMReleaseServer(ntlm_request);
+     }
+     memPoolFree(ntlm_request_pool, ntlm_request);
+ }
+@@ -427,6 +427,10 @@
+     helper_stateful_server *server = ntlm_request->authserver;
+     debug(29, 9) ("authenticateNTLMReleaseServer: releasing server '%p'\n", server);
+     ntlm_request->authserver = NULL;
++    if (!ntlmConfig->challengeuses) {
++	ntlm_helper_state_t *helperstate = helperStatefulServerGetData(server);
++	helperstate->starve = 1;
++    }
+     helperStatefulReleaseServer(server);
+ }
+ 
+@@ -436,7 +440,7 @@
+ {
+     helper_stateful_server *server = ntlm_request->authserver;
+     ntlm_helper_state_t *helperstate = helperStatefulServerGetData(server);
+-    debug(29, 9) ("authenticateNTLMReleaseServer: releasing server '%p'\n", server);
++    debug(29, 9) ("authenticateNTLMResetServer: releasing server '%p'\n", server);
+     ntlm_request->authserver = NULL;
+     helperstate->starve = 1;
+     helperStatefulReleaseServer(server);
+@@ -699,7 +703,7 @@
+ 	    while ((server != NULL) && authenticateNTLMChangeChallenge_p(helperstate)) {
+ 		/* flag this helper for challenge changing */
+ 		helperstate->starve = 1;
+-		helperStatefulReset(server);
++		helperStatefulReleaseServer(server);
+ 		/* Get another server */
+ 		server = helperStatefulGetServer(ntlmauthenticators);
+ 		helperstate = server ? helperStatefulServerGetData(server) : NULL;
+@@ -734,6 +738,8 @@
+ 		helperStatefulSubmit(ntlmauthenticators, buf, authenticateNTLMHandleReply, r, ntlm_request->authserver);
+ 	    }
+ 	} else {
++	    if (!ntlmConfig->challengeuses)
++		debug(29, 0) ("authenticateNTLMStart: Reused challenge in server %p even if challenge reuse is disabled!", server);
+ 	    /* (server != NULL and we have a valid challenge) */
+ 	    /* TODO: turn the below into a function and call from here and handlereply */
+ 	    /* increment the challenge uses */
+diff -urNad /home/gangitano/debian/squid/squid-2.5.6/src/auth/ntlm/auth_ntlm.c.orig squid-2.5.6/src/auth/ntlm/auth_ntlm.c.orig
+--- /home/gangitano/debian/squid/squid-2.5.6/src/auth/ntlm/auth_ntlm.c.orig	1970-01-01 01:00:00.000000000 +0100
++++ squid-2.5.6/src/auth/ntlm/auth_ntlm.c.orig	2004-04-18 03:29:52.000000000 +0200
+@@ -0,0 +1,1064 @@
++
++/*
++ * $Id: auth_ntlm.c,v 1.17.2.12 2004/04/18 01:29:52 hno Exp $
++ *
++ * DEBUG: section 29    NTLM Authenticator
++ * AUTHOR: Robert Collins
++ *
++ * SQUID Web Proxy Cache          http://www.squid-cache.org/
++ * ----------------------------------------------------------
++ *
++ *  Squid is the result of efforts by numerous individuals from
++ *  the Internet community; see the CONTRIBUTORS file for full
++ *  details.   Many organizations have provided support for Squid's
++ *  development; see the SPONSORS file for full details.  Squid is
++ *  Copyrighted (C) 2001 by the Regents of the University of
++ *  California; see the COPYRIGHT file for full details.  Squid
++ *  incorporates software developed and/or copyrighted by other
++ *  sources; see the CREDITS file for full details.
++ *
++ *  This program is free software; you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License as published by
++ *  the Free Software Foundation; either version 2 of the License, or
++ *  (at your option) any later version.
++ *  
++ *  This program is distributed in the hope that it will be useful,
++ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *  GNU General Public License for more details.
++ *  
++ *  You should have received a copy of the GNU General Public License
++ *  along with this program; if not, write to the Free Software
++ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
++ *
++ */
++
++/* The functions in this file handle authentication.
++ * They DO NOT perform access control or auditing.
++ * See acl.c for access control and client_side.c for auditing */
++
++
++#include "squid.h"
++#include "auth_ntlm.h"
++
++extern AUTHSSETUP authSchemeSetup_ntlm;
++
++static void
++authenticateStateFree(authenticateStateData * r)
++{
++    authenticateAuthUserRequestUnlock(r->auth_user_request);
++    r->auth_user_request = NULL;
++    cbdataFree(r);
++}
++
++/* NTLM Scheme */
++static HLPSCB authenticateNTLMHandleReply;
++static HLPSCB authenticateNTLMHandleplaceholder;
++static AUTHSACTIVE authenticateNTLMActive;
++static AUTHSAUTHED authNTLMAuthenticated;
++static AUTHSAUTHUSER authenticateNTLMAuthenticateUser;
++static AUTHSCONFIGURED authNTLMConfigured;
++static AUTHSFIXERR authenticateNTLMFixErrorHeader;
++static AUTHSFREE authenticateNTLMFreeUser;
++static AUTHSDIRECTION authenticateNTLMDirection;
++static AUTHSDECODE authenticateDecodeNTLMAuth;
++static AUTHSDUMP authNTLMCfgDump;
++static AUTHSFREECONFIG authNTLMFreeConfig;
++static AUTHSINIT authNTLMInit;
++static AUTHSONCLOSEC authenticateNTLMOnCloseConnection;
++static AUTHSCONNLASTHEADER NTLMLastHeader;
++static AUTHSUSERNAME authenticateNTLMUsername;
++static AUTHSREQFREE authNTLMAURequestFree;
++static AUTHSPARSE authNTLMParse;
++static AUTHSSTART authenticateNTLMStart;
++static AUTHSSTATS authenticateNTLMStats;
++static AUTHSSHUTDOWN authNTLMDone;
++
++/* helper callbacks to handle per server state data */
++static HLPSAVAIL authenticateNTLMHelperServerAvailable;
++static HLPSRESET authenticateNTLMHelperServerReset;
++
++static statefulhelper *ntlmauthenticators = NULL;
++
++CBDATA_TYPE(authenticateStateData);
++
++static int authntlm_initialised = 0;
++
++static MemPool *ntlm_helper_state_pool = NULL;
++static MemPool *ntlm_user_pool = NULL;
++static MemPool *ntlm_request_pool = NULL;
++static auth_ntlm_config *ntlmConfig = NULL;
++
++static hash_table *proxy_auth_cache = NULL;
++
++/*
++ *
++ * Private Functions
++ *
++ */
++
++static void
++authNTLMDone(void)
++{
++    debug(29, 2) ("authNTLMDone: shutting down NTLM authentication.\n");
++    if (ntlmauthenticators)
++	helperStatefulShutdown(ntlmauthenticators);
++    authntlm_initialised = 0;
++    if (!shutting_down)
++	return;
++    if (ntlmauthenticators)
++	helperStatefulFree(ntlmauthenticators);
++    ntlmauthenticators = NULL;
++    if (ntlm_helper_state_pool) {
++	assert(memPoolInUseCount(ntlm_helper_state_pool) == 0);
++	memPoolDestroy(ntlm_helper_state_pool);
++	ntlm_helper_state_pool = NULL;
++    }
++    if (ntlm_request_pool) {
++	assert(memPoolInUseCount(ntlm_request_pool) == 0);
++	memPoolDestroy(ntlm_request_pool);
++	ntlm_request_pool = NULL;
++    }
++    if (ntlm_user_pool) {
++	assert(memPoolInUseCount(ntlm_user_pool) == 0);
++	memPoolDestroy(ntlm_user_pool);
++	ntlm_user_pool = NULL;
++    }
++    debug(29, 2) ("authNTLMDone: NTLM authentication Shutdown.\n");
++}
++
++/* free any allocated configuration details */
++static void
++authNTLMFreeConfig(authScheme * scheme)
++{
++    if (ntlmConfig == NULL)
++	return;
++    assert(ntlmConfig == scheme->scheme_data);
++    if (ntlmConfig->authenticate)
++	wordlistDestroy(&ntlmConfig->authenticate);
++    xfree(ntlmConfig);
++    ntlmConfig = NULL;
++}
++
++static void
++authNTLMCfgDump(StoreEntry * entry, const char *name, authScheme * scheme)
++{
++    auth_ntlm_config *config = scheme->scheme_data;
++    wordlist *list = config->authenticate;
++    storeAppendPrintf(entry, "%s %s", name, "ntlm");
++    while (list != NULL) {
++	storeAppendPrintf(entry, " %s", list->key);
++	list = list->next;
++    }
++    storeAppendPrintf(entry, "\n%s %s children %d\n%s %s max_challenge_reuses %d\n%s %s max_challenge_lifetime %d seconds\n%s %s use_ntlm_negotiate %s\n",
++	name, "ntlm", config->authenticateChildren,
++	name, "ntlm", config->challengeuses,
++	name, "ntlm", (int) config->challengelifetime,
++	name, "ntlm", config->use_ntlm_negotiate ? "on" : "off");
++
++}
++
++static void
++authNTLMParse(authScheme * scheme, int n_configured, char *param_str)
++{
++    if (scheme->scheme_data == NULL) {
++	assert(ntlmConfig == NULL);
++	/* this is the first param to be found */
++	scheme->scheme_data = xmalloc(sizeof(auth_ntlm_config));
++	memset(scheme->scheme_data, 0, sizeof(auth_ntlm_config));
++	ntlmConfig = scheme->scheme_data;
++	ntlmConfig->authenticateChildren = 5;
++	ntlmConfig->challengeuses = 0;
++	ntlmConfig->challengelifetime = 60;
++	ntlmConfig->use_ntlm_negotiate = 0;
++    }
++    ntlmConfig = scheme->scheme_data;
++    if (strcasecmp(param_str, "program") == 0) {
++	if (ntlmConfig->authenticate)
++	    wordlistDestroy(&ntlmConfig->authenticate);
++	parse_wordlist(&ntlmConfig->authenticate);
++	requirePathnameExists("authparam ntlm program", ntlmConfig->authenticate->key);
++    } else if (strcasecmp(param_str, "children") == 0) {
++	parse_int(&ntlmConfig->authenticateChildren);
++    } else if (strcasecmp(param_str, "max_challenge_reuses") == 0) {
++	parse_int(&ntlmConfig->challengeuses);
++    } else if (strcasecmp(param_str, "max_challenge_lifetime") == 0) {
++	parse_time_t(&ntlmConfig->challengelifetime);
++    } else if (strcasecmp(param_str, "use_ntlm_negotiate") == 0) {
++	parse_onoff(&ntlmConfig->use_ntlm_negotiate);
++    } else {
++	debug(28, 0) ("unrecognised ntlm auth scheme parameter '%s'\n", param_str);
++    }
++    /*
++     * disable client side request pipelining. There is a race with
++     * NTLM when the client sends a second request on an NTLM
++     * connection before the authenticate challenge is sent. With
++     * this patch, the client may fail to authenticate, but squid's
++     * state will be preserved.  Caveats: this should be a post-parse
++     * test, but that can wait for the modular parser to be integrated.
++     */
++    if (ntlmConfig->authenticate && Config.onoff.pipeline_prefetch != 0)
++	Config.onoff.pipeline_prefetch = 0;
++
++    if (ntlmConfig->use_ntlm_negotiate && ntlmConfig->challengeuses > 0) {
++	debug(28, 1) ("challenge reuses incompatible with use_ntlm_negotiate. Disabling challenge reuse\n");
++	ntlmConfig->challengeuses = 0;
++    }
++}
++
++
++void
++authSchemeSetup_ntlm(authscheme_entry_t * authscheme)
++{
++    assert(!authntlm_initialised);
++    authscheme->Active = authenticateNTLMActive;
++    authscheme->configured = authNTLMConfigured;
++    authscheme->parse = authNTLMParse;
++    authscheme->dump = authNTLMCfgDump;
++    authscheme->requestFree = authNTLMAURequestFree;
++    authscheme->freeconfig = authNTLMFreeConfig;
++    authscheme->init = authNTLMInit;
++    authscheme->authAuthenticate = authenticateNTLMAuthenticateUser;
++    authscheme->authenticated = authNTLMAuthenticated;
++    authscheme->authFixHeader = authenticateNTLMFixErrorHeader;
++    authscheme->FreeUser = authenticateNTLMFreeUser;
++    authscheme->authStart = authenticateNTLMStart;
++    authscheme->authStats = authenticateNTLMStats;
++    authscheme->authUserUsername = authenticateNTLMUsername;
++    authscheme->getdirection = authenticateNTLMDirection;
++    authscheme->decodeauth = authenticateDecodeNTLMAuth;
++    authscheme->donefunc = authNTLMDone;
++    authscheme->oncloseconnection = authenticateNTLMOnCloseConnection;
++    authscheme->authConnLastHeader = NTLMLastHeader;
++}
++
++/* Initialize helpers and the like for this auth scheme. Called AFTER parsing the
++ * config file */
++static void
++authNTLMInit(authScheme * scheme)
++{
++    static int ntlminit = 0;
++    if (ntlmConfig->authenticate) {
++	if (!ntlm_helper_state_pool)
++	    ntlm_helper_state_pool = memPoolCreate("NTLM Helper State data", sizeof(ntlm_helper_state_t));
++	if (!ntlm_user_pool)
++	    ntlm_user_pool = memPoolCreate("NTLM Scheme User Data", sizeof(ntlm_user_t));
++	if (!ntlm_request_pool)
++	    ntlm_request_pool = memPoolCreate("NTLM Scheme Request Data", sizeof(ntlm_request_t));
++	authntlm_initialised = 1;
++	if (ntlmauthenticators == NULL)
++	    ntlmauthenticators = helperStatefulCreate("ntlmauthenticator");
++	if (ntlmConfig->challengeuses) {
++	    if (!proxy_auth_cache)
++		proxy_auth_cache = hash_create((HASHCMP *) strcmp, 7921, hash_string);
++	    assert(proxy_auth_cache);
++	}
++	ntlmauthenticators->cmdline = ntlmConfig->authenticate;
++	ntlmauthenticators->n_to_start = ntlmConfig->authenticateChildren;
++	ntlmauthenticators->ipc_type = IPC_TCP_SOCKET;
++	ntlmauthenticators->datapool = ntlm_helper_state_pool;
++	ntlmauthenticators->IsAvailable = authenticateNTLMHelperServerAvailable;
++	ntlmauthenticators->Reset = authenticateNTLMHelperServerReset;
++	helperStatefulOpenServers(ntlmauthenticators);
++	/*
++	 * TODO: In here send the initial YR to preinitialise the
++	 * challenge cache
++	 */
++	/*
++	 * Think about this... currently we ask when the challenge
++	 * is needed. Better?
++	 */
++	if (!ntlminit) {
++	    cachemgrRegister("ntlmauthenticator",
++		"NTLM User Authenticator Stats",
++		authenticateNTLMStats, 0, 1);
++	    ntlminit++;
++	}
++	CBDATA_INIT_TYPE(authenticateStateData);
++    }
++}
++
++static int
++authenticateNTLMActive()
++{
++    return (authntlm_initialised == 1) ? 1 : 0;
++}
++
++
++static int
++authNTLMConfigured()
++{
++    if ((ntlmConfig != NULL) && (ntlmConfig->authenticate != NULL) && (ntlmConfig->authenticateChildren != 0) && (ntlmConfig->challengeuses > -1) && (ntlmConfig->challengelifetime > -1)) {
++	debug(29, 9) ("authNTLMConfigured: returning configured\n");
++	return 1;
++    }
++    debug(29, 9) ("authNTLMConfigured: returning unconfigured\n");
++    return 0;
++}
++
++/* NTLM Scheme */
++
++static int
++authenticateNTLMDirection(auth_user_request_t * auth_user_request)
++{
++    ntlm_request_t *ntlm_request = auth_user_request->scheme_data;
++    /* null auth_user is checked for by authenticateDirection */
++    switch (ntlm_request->auth_state) {
++    case AUTHENTICATE_STATE_NONE:	/* no progress at all. */
++	debug(29, 1) ("authenticateNTLMDirection: called before NTLM Authenticate!. Report a bug to squid-dev. au %p\n", auth_user_request);
++	/* fall thru */
++    case AUTHENTICATE_STATE_FAILED:
++	return -2;
++    case AUTHENTICATE_STATE_NEGOTIATE:		/* send to helper */
++    case AUTHENTICATE_STATE_RESPONSE:	/*send to helper */
++	return -1;
++    case AUTHENTICATE_STATE_CHALLENGE:		/* send to client */
++	return 1;
++    case AUTHENTICATE_STATE_DONE:	/* do nothing.. */
++	return 0;
++    }
++    return -2;
++}
++
++/*
++ * Send the authenticate error header(s). Note: IE has a bug and the NTLM header
++ * must be first. To ensure that, the configure use --enable-auth=ntlm, anything
++ * else.
++ */
++static void
++authenticateNTLMFixErrorHeader(auth_user_request_t * auth_user_request, HttpReply * rep, http_hdr_type type, request_t * request)
++{
++    ntlm_request_t *ntlm_request;
++    if (ntlmConfig->authenticate) {
++	/* New request, no user details */
++	if (auth_user_request == NULL) {
++	    debug(29, 9) ("authenticateNTLMFixErrorHeader: Sending type:%d header: 'NTLM'\n", type);
++	    httpHeaderPutStrf(&rep->header, type, "NTLM");
++	    /* drop the connection */
++	    httpHeaderDelByName(&rep->header, "keep-alive");
++	    /* NTLM has problems if the initial connection is not dropped
++	     * I haven't checked the RFC compliance of this hack - RBCollins */
++	    request->flags.proxy_keepalive = 0;
++	} else {
++	    ntlm_request = auth_user_request->scheme_data;
++	    switch (ntlm_request->auth_state) {
++	    case AUTHENTICATE_STATE_NONE:
++	    case AUTHENTICATE_STATE_FAILED:
++		debug(29, 9) ("authenticateNTLMFixErrorHeader: Sending type:%d header: 'NTLM'\n", type);
++		httpHeaderPutStrf(&rep->header, type, "NTLM");
++		/* drop the connection */
++		httpHeaderDelByName(&rep->header, "keep-alive");
++		/* NTLM has problems if the initial connection is not dropped
++		 * I haven't checked the RFC compliance of this hack - RBCollins */
++		request->flags.proxy_keepalive = 0;
++		break;
++	    case AUTHENTICATE_STATE_CHALLENGE:
++		/* we are 'waiting' for a response */
++		/* pass the challenge to the client */
++		debug(29, 9) ("authenticateNTLMFixErrorHeader: Sending type:%d header: 'NTLM %s'\n", type, ntlm_request->authchallenge);
++		httpHeaderPutStrf(&rep->header, type, "NTLM %s", ntlm_request->authchallenge);
++		break;
++	    default:
++		debug(29, 0) ("authenticateNTLMFixErrorHeader: state %d.\n", ntlm_request->auth_state);
++		fatal("unexpected state in AuthenticateNTLMFixErrorHeader.\n");
++	    }
++	}
++    }
++}
++
++static void
++authNTLMRequestFree(ntlm_request_t * ntlm_request)
++{
++    if (!ntlm_request)
++	return;
++    if (ntlm_request->ntlmnegotiate)
++	xfree(ntlm_request->ntlmnegotiate);
++    if (ntlm_request->authchallenge)
++	xfree(ntlm_request->authchallenge);
++    if (ntlm_request->ntlmauthenticate)
++	xfree(ntlm_request->ntlmauthenticate);
++    if (ntlm_request->authserver != NULL) {
++	debug(29, 9) ("authenticateNTLMRequestFree: releasing server '%p'\n", ntlm_request->authserver);
++	helperStatefulReleaseServer(ntlm_request->authserver);
++	ntlm_request->authserver = NULL;
++    }
++    memPoolFree(ntlm_request_pool, ntlm_request);
++}
++
++static void
++authNTLMAURequestFree(auth_user_request_t * auth_user_request)
++{
++    if (auth_user_request->scheme_data)
++	authNTLMRequestFree((ntlm_request_t *) auth_user_request->scheme_data);
++    auth_user_request->scheme_data = NULL;
++}
++
++static void
++authenticateNTLMFreeUser(auth_user_t * auth_user)
++{
++    dlink_node *link, *tmplink;
++    ntlm_user_t *ntlm_user = auth_user->scheme_data;
++    auth_user_hash_pointer *proxy_auth_hash;
++
++    debug(29, 5) ("authenticateNTLMFreeUser: Clearing NTLM scheme data\n");
++    if (ntlm_user->username)
++	xfree(ntlm_user->username);
++    /* were they linked in by one or more proxy-authenticate headers */
++    link = ntlm_user->proxy_auth_list.head;
++    while (link) {
++	debug(29, 9) ("authenticateFreeProxyAuthUser: removing proxy_auth hash entry '%p'\n", link->data);
++	proxy_auth_hash = link->data;
++	tmplink = link;
++	link = link->next;
++	dlinkDelete(tmplink, &ntlm_user->proxy_auth_list);
++	hash_remove_link(proxy_auth_cache, (hash_link *) proxy_auth_hash);
++	/* free the key (usually the proxy_auth header) */
++	xfree(proxy_auth_hash->key);
++	memFree(proxy_auth_hash, MEM_AUTH_USER_HASH);
++    }
++    memPoolFree(ntlm_user_pool, ntlm_user);
++    auth_user->scheme_data = NULL;
++}
++
++/* clear the NTLM helper of being reserved for future requests */
++static void
++authenticateNTLMReleaseServer(ntlm_request_t * ntlm_request)
++{
++    helper_stateful_server *server = ntlm_request->authserver;
++    debug(29, 9) ("authenticateNTLMReleaseServer: releasing server '%p'\n", server);
++    ntlm_request->authserver = NULL;
++    helperStatefulReleaseServer(server);
++}
++
++/* clear the NTLM helper of being reserved for future requests */
++static void
++authenticateNTLMResetServer(ntlm_request_t * ntlm_request)
++{
++    helper_stateful_server *server = ntlm_request->authserver;
++    ntlm_helper_state_t *helperstate = helperStatefulServerGetData(server);
++    debug(29, 9) ("authenticateNTLMReleaseServer: releasing server '%p'\n", server);
++    ntlm_request->authserver = NULL;
++    helperstate->starve = 1;
++    helperStatefulReleaseServer(server);
++}
++
++static void
++authenticateNTLMHandleplaceholder(void *data, void *srv, char *reply)
++{
++    authenticateStateData *r = data;
++    int valid;
++    /* we should only be called for placeholder requests - which have no reply string */
++    assert(reply == NULL);
++    assert(r->auth_user_request);
++    /* standard callback stuff */
++    valid = cbdataValid(r->data);
++    if (!valid) {
++	debug(29, 2) ("AuthenticateNTLMHandlePlacheholder: invalid callback data.\n");
++	helperStatefulReleaseServer(srv);
++	return;
++    }
++    /* call authenticateNTLMStart to retry this request */
++    debug(29, 9) ("authenticateNTLMHandleplaceholder: calling authenticateNTLMStart\n");
++    helperStatefulReleaseServer(srv);
++    authenticateNTLMStart(r->auth_user_request, r->handler, r->data);
++    cbdataUnlock(r->data);
++    authenticateStateFree(r);
++}
++
++static void
++authenticateNTLMHandleReply(void *data, void *srv, char *reply)
++{
++    authenticateStateData *r = data;
++    ntlm_helper_state_t *helperstate;
++    int valid;
++    auth_user_request_t *auth_user_request;
++    auth_user_t *auth_user;
++    ntlm_user_t *ntlm_user;
++    ntlm_request_t *ntlm_request;
++    debug(29, 9) ("authenticateNTLMHandleReply: Helper: '%p' {%s}\n", srv, reply ? reply : "<NULL>");
++    valid = cbdataValid(r->data);
++    if (!valid) {
++	debug(29, 2) ("AuthenticateNTLMHandleReply: invalid callback data. Releasing helper '%p'.\n", srv);
++	cbdataUnlock(r->data);
++	authenticateStateFree(r);
++	return;
++    }
++    if (!reply) {
++	/*
++	 * TODO: this occurs when a helper crashes. We should clean
++	 * up that helpers resources and queued requests.
++	 */
++	fatal("authenticateNTLMHandleReply: called with no result string\n");
++    }
++    assert(r->auth_user_request != NULL);
++    assert(r->auth_user_request->auth_user->auth_type == AUTH_NTLM);
++    auth_user_request = r->auth_user_request;
++    ntlm_request = auth_user_request->scheme_data;
++    assert(ntlm_request != NULL);
++
++    /* seperate out the useful data */
++    if (strncasecmp(reply, "TT ", 3) == 0) {
++	reply += 3;
++	/* we have been given a Challenge */
++	/* we should check we weren't given an empty challenge */
++	/* copy the challenge to the state data */
++	helperstate = helperStatefulServerGetData(srv);
++	if (helperstate == NULL)
++	    fatal("lost NTLM helper state! quitting\n");
++	helperstate->challenge = xstrndup(reply, NTLM_CHALLENGE_SZ + 5);
++	helperstate->renewed = squid_curtime;
++	/* and we satisfy the request that happended on the refresh boundary */
++	/* note this code is now in two places FIXME */
++	assert(ntlm_request->auth_state == AUTHENTICATE_STATE_NEGOTIATE);
++	ntlm_request->authserver = srv;
++	ntlm_request->authchallenge = xstrndup(reply, NTLM_CHALLENGE_SZ + 5);
++	helperstate->challengeuses = 1;
++    } else if (strncasecmp(reply, "AF ", 3) == 0) {
++	/* we're finished, release the helper */
++	reply += 3;
++	auth_user = auth_user_request->auth_user;
++	ntlm_user = auth_user_request->auth_user->scheme_data;
++	assert(ntlm_user != NULL);
++	/* we only expect OK when finishing the handshake */
++	assert(ntlm_request->auth_state == AUTHENTICATE_STATE_RESPONSE);
++	ntlm_user->username = xstrndup(reply, MAX_LOGIN_SZ);
++	ntlm_request->authserver = NULL;
++	helperStatefulReleaseServer(srv);
++#ifdef NTLM_FAIL_OPEN
++    } else if (strncasecmp(reply, "LD ", 3) == 0) {
++	/* This is a variant of BH, which rather than deny access
++	 * allows the user through. The helper is starved and then refreshed
++	 * via YR, all pending authentications are likely to fail also.
++	 * It is meant for those helpers which occasionally fail for
++	 * no reason at all (casus belli, NTLMSSP helper on NT domain,
++	 * failing about 1 auth out of 1k.
++	 * The code is a merge from the BH case with snippets of the AF
++	 * case */
++	/* AF code: mark user as authenticated */
++	reply += 3;
++	auth_user = auth_user_request->auth_user;
++	ntlm_user = auth_user_request->auth_user->scheme_data;
++	assert(ntlm_user != NULL);
++	/* we only expect LD when finishing the handshake */
++	assert(ntlm_request->auth_state == AUTHENTICATE_STATE_RESPONSE);
++	ntlm_user->username = xstrndup(reply, MAX_LOGIN_SZ);
++	helperstate = helperStatefulServerGetData(ntlm_request->authserver);
++	/* BH code: mark helper as broken */
++	authenticateNTLMResetServer(ntlm_request);
++	debug(29, 4) ("authenticateNTLMHandleReply: Error validating user via NTLM. Error returned '%s'\n", reply);
++#endif
++    } else if (strncasecmp(reply, "NA ", 3) == 0) {
++	/* todo: action of Negotiate state on error */
++	ntlm_request->auth_state = AUTHENTICATE_STATE_FAILED;
++	authenticateNTLMResetServer(ntlm_request);
++	debug(29, 4) ("authenticateNTLMHandleReply: Error validating user via NTLM. Error returned '%s'\n", reply);
++    } else if (strncasecmp(reply, "BH ", 3) == 0) {
++	/* TODO kick off a refresh process. This can occur after a YR or after
++	 * a KK. If after a YR release the helper and resubmit the request via 
++	 * Authenticate NTLM start. 
++	 * If after a KK deny the user's request w/ 407 and mark the helper as 
++	 * Needing YR. */
++	assert(r->auth_user_request != NULL);
++	assert(r->auth_user_request->auth_user->auth_type == AUTH_NTLM);
++	auth_user_request = r->auth_user_request;
++	auth_user = auth_user_request->auth_user;
++	assert(auth_user != NULL);
++	ntlm_user = auth_user->scheme_data;
++	ntlm_request = auth_user_request->scheme_data;
++	assert((ntlm_user != NULL) && (ntlm_request != NULL));
++	assert(!ntlm_request->authserver || ntlm_request->authserver == srv);
++	helperstate = helperStatefulServerGetData(ntlm_request->authserver);
++	authenticateNTLMResetServer(ntlm_request);
++	if (ntlm_request->auth_state == AUTHENTICATE_STATE_NEGOTIATE) {
++	    /* The helper broke on YR. It automatically
++	     * resets */
++	    debug(29, 1) ("authenticateNTLMHandleReply: Error obtaining challenge from helper: %p. Error returned '%s'\n", srv, reply);
++	    /* resubmit the request. This helper is currently busy, so we will get
++	     * a different one. Our auth state stays the same */
++	    authenticateNTLMStart(auth_user_request, r->handler, r->data);
++	    /* don't call the callback */
++	    cbdataUnlock(r->data);
++	    authenticateStateFree(r);
++	    return;
++	} else {
++	    /* the helper broke on a KK */
++	    debug(29, 1) ("authenticateNTLMHandleReply: Error validating user via NTLM. Error returned '%s'\n", reply);
++	    ntlm_request->auth_state = AUTHENTICATE_STATE_FAILED;
++	}
++    } else {
++	fatalf("authenticateNTLMHandleReply: *** Unsupported helper response ***, '%s'\n", reply);
++    }
++    r->handler(r->data, NULL);
++    cbdataUnlock(r->data);
++    authenticateStateFree(r);
++}
++
++static void
++authenticateNTLMStats(StoreEntry * sentry)
++{
++    storeAppendPrintf(sentry, "NTLM Authenticator Statistics:\n");
++    helperStatefulStats(sentry, ntlmauthenticators);
++}
++
++/* is a particular challenge still valid ? */
++static int
++authenticateNTLMValidChallenge(ntlm_helper_state_t * helperstate)
++{
++    debug(29, 9) ("authenticateNTLMValidChallenge: Challenge is %s\n", helperstate->challenge ? "Valid" : "Invalid");
++    if (helperstate->challenge == NULL)
++	return 0;
++    return 1;
++}
++
++/* does our policy call for changing the challenge now? */
++static int
++authenticateNTLMChangeChallenge_p(ntlm_helper_state_t * helperstate)
++{
++    /* don't check for invalid challenges just for expiry choices */
++    /* this is needed because we have to starve the helper until all old
++     * requests have been satisfied */
++    if (!helperstate->renewed) {
++	/* first use, no challenge has been set. Without this check, it will
++	 * loop forever */
++	debug(29, 5) ("authenticateNTLMChangeChallenge_p: first use\n");
++	return 0;
++    }
++    if (helperstate->challengeuses > ntlmConfig->challengeuses) {
++	debug(29, 4) ("authenticateNTLMChangeChallenge_p: Challenge uses (%d) exceeded max uses (%d)\n", helperstate->challengeuses, ntlmConfig->challengeuses);
++	return 1;
++    }
++    if (helperstate->renewed + ntlmConfig->challengelifetime < squid_curtime) {
++	debug(29, 4) ("authenticateNTLMChangeChallenge_p: Challenge exceeded max lifetime by %d seconds\n", (int) (squid_curtime - (helperstate->renewed + ntlmConfig->challengelifetime)));
++	return 1;
++    }
++    debug(29, 9) ("Challenge is to be reused\n");
++    return 0;
++}
++
++/* send the initial data to a stateful ntlm authenticator module */
++static void
++authenticateNTLMStart(auth_user_request_t * auth_user_request, RH * handler, void *data)
++{
++    authenticateStateData *r = NULL;
++    helper_stateful_server *server;
++    ntlm_helper_state_t *helperstate;
++    char buf[8192];
++    char *sent_string = NULL;
++    ntlm_user_t *ntlm_user;
++    ntlm_request_t *ntlm_request;
++    auth_user_t *auth_user;
++
++    assert(auth_user_request);
++    auth_user = auth_user_request->auth_user;
++    ntlm_user = auth_user->scheme_data;
++    ntlm_request = auth_user_request->scheme_data;
++    assert(ntlm_user);
++    assert(ntlm_request);
++    assert(handler);
++    assert(data);
++    assert(auth_user->auth_type == AUTH_NTLM);
++    debug(29, 9) ("authenticateNTLMStart: auth state '%d'\n", ntlm_request->auth_state);
++    switch (ntlm_request->auth_state) {
++    case AUTHENTICATE_STATE_NEGOTIATE:
++	sent_string = ntlm_request->ntlmnegotiate;
++	break;
++    case AUTHENTICATE_STATE_RESPONSE:
++	sent_string = ntlm_request->ntlmauthenticate;
++	assert(ntlm_request->authserver);
++	debug(29, 9) ("authenticateNTLMStart: Asking NTLMauthenticator '%p'.\n", ntlm_request->authserver);
++	break;
++    default:
++	fatal("Invalid authenticate state for NTLMStart");
++    }
++
++    while (xisgraph(*sent_string))	/*trim NTLM */
++	sent_string++;
++
++    while (xisspace(*sent_string))	/*trim leading spaces */
++	sent_string++;
++
++    debug(29, 9) ("authenticateNTLMStart: state '%d'\n", ntlm_request->auth_state);
++    debug(29, 9) ("authenticateNTLMStart: '%s'\n", sent_string);
++    if (ntlmConfig->authenticate == NULL) {
++	debug(29, 0) ("authenticateNTLMStart: no NTLM program specified:'%s'\n", sent_string);
++	handler(data, NULL);
++	return;
++    }
++    /* this is ugly TODO: move the challenge generation routines to their own function and
++     * tidy the logic up to make use of the efficiency we now have */
++    switch (ntlm_request->auth_state) {
++    case AUTHENTICATE_STATE_NEGOTIATE:
++	/*  
++	 * 1: get a helper server
++	 * 2: does it have a challenge?
++	 * 3: tell it to get a challenge, or give ntlmauthdone the challenge
++	 */
++	server = helperStatefulGetServer(ntlmauthenticators);
++	helperstate = server ? helperStatefulServerGetData(server) : NULL;
++	if (ntlmConfig->challengeuses) {
++	    while ((server != NULL) && authenticateNTLMChangeChallenge_p(helperstate)) {
++		/* flag this helper for challenge changing */
++		helperstate->starve = 1;
++		helperStatefulReset(server);
++		/* Get another server */
++		server = helperStatefulGetServer(ntlmauthenticators);
++		helperstate = server ? helperStatefulServerGetData(server) : NULL;
++	    }
++	}
++	ntlm_request->authserver = server;
++	/* tell the log what helper we have been given */
++	if (server == NULL)
++	    debug(29, 9) ("authenticateNTLMStart: unable to get a ntlm helper... Queuing as a placeholder request.\n");
++	else
++	    debug(29, 9) ("authenticateNTLMStart: helper '%p' assigned\n", server);
++	/* server and valid challenge? */
++	if ((server == NULL) || ntlmConfig->challengeuses == 0 || !authenticateNTLMValidChallenge(helperstate)) {
++	    /* No server, or server with invalid challenge */
++	    r = cbdataAlloc(authenticateStateData);
++	    r->handler = handler;
++	    cbdataLock(data);
++	    r->data = data;
++	    r->auth_user_request = auth_user_request;
++	    authenticateAuthUserRequestLock(r->auth_user_request);
++	    if (server == NULL && ntlmConfig->challengeuses) {
++		helperStatefulSubmit(ntlmauthenticators, NULL, authenticateNTLMHandleplaceholder, r, NULL);
++	    } else {
++		/* Server with invalid challenge */
++
++		if (ntlmConfig->use_ntlm_negotiate) {
++		    snprintf(buf, 8192, "YR %s\n", sent_string);
++		} else {
++		    snprintf(buf, 8192, "YR\n");
++		}
++
++		helperStatefulSubmit(ntlmauthenticators, buf, authenticateNTLMHandleReply, r, ntlm_request->authserver);
++	    }
++	} else {
++	    /* (server != NULL and we have a valid challenge) */
++	    /* TODO: turn the below into a function and call from here and handlereply */
++	    /* increment the challenge uses */
++	    helperstate->challengeuses++;
++	    /* assign the challenge */
++	    ntlm_request->authchallenge = xstrndup(helperstate->challenge, NTLM_CHALLENGE_SZ + 5);
++	    handler(data, NULL);
++	}
++
++	break;
++    case AUTHENTICATE_STATE_RESPONSE:
++	r = cbdataAlloc(authenticateStateData);
++	r->handler = handler;
++	cbdataLock(data);
++	r->data = data;
++	r->auth_user_request = auth_user_request;
++	authenticateAuthUserRequestLock(r->auth_user_request);
++	snprintf(buf, 8192, "KK %s\n", sent_string);
++	helperStatefulSubmit(ntlmauthenticators, buf, authenticateNTLMHandleReply, r, ntlm_request->authserver);
++	debug(29, 9) ("authenticateNTLMstart: finished\n");
++	break;
++    default:
++	fatal("Invalid authenticate state for NTLMStart");
++    }
++}
++
++/* callback used by stateful helper routines */
++static int
++authenticateNTLMHelperServerAvailable(void *data)
++{
++    ntlm_helper_state_t *statedata = data;
++    if (statedata != NULL) {
++	if (statedata->starve) {
++	    debug(29, 4) ("authenticateNTLMHelperServerAvailable: starving - returning 0\n");
++	    return 0;
++	} else {
++	    debug(29, 4) ("authenticateNTLMHelperServerAvailable: not starving - returning 1\n");
++	    return 1;
++	}
++    }
++    debug(29, 4) ("authenticateNTLMHelperServerAvailable: no state data - returning 0\n");
++    return 0;
++}
++
++static void
++authenticateNTLMHelperServerReset(void *data)
++{
++    ntlm_helper_state_t *statedata = data;
++    if (statedata == NULL)
++	return;
++    if (statedata->starve) {
++	/* we have been starving the helper */
++	debug(29, 9) ("authenticateNTLMHelperServerReset: resetting challenge details\n");
++	statedata->starve = 0;
++	statedata->challengeuses = 0;
++	statedata->renewed = 0;
++	xfree(statedata->challenge);
++	statedata->challenge = NULL;
++    }
++}
++
++/* clear any connection related authentication details */
++static void
++authenticateNTLMOnCloseConnection(ConnStateData * conn)
++{
++    ntlm_request_t *ntlm_request;
++    assert(conn != NULL);
++    if (conn->auth_user_request != NULL) {
++	assert(conn->auth_user_request->scheme_data != NULL);
++	ntlm_request = conn->auth_user_request->scheme_data;
++	assert(ntlm_request->conn == conn);
++	if (ntlm_request->authserver != NULL)
++	    authenticateNTLMReleaseServer(ntlm_request);
++	/* unlock the connection based lock */
++	debug(29, 9) ("authenticateNTLMOnCloseConnection: Unlocking auth_user from the connection.\n");
++	/* minor abstraction break here: FIXME */
++	/* Ensure that the auth user request will be getting closed */
++	/* IFF we start persisting the struct after the conn closes - say for logging
++	 * then this test may become invalid
++	 */
++	assert(conn->auth_user_request->references == 1);
++	authenticateAuthUserRequestUnlock(conn->auth_user_request);
++	conn->auth_user_request = NULL;
++    }
++}
++
++/* authenticateUserUsername: return a pointer to the username in the */
++static char *
++authenticateNTLMUsername(auth_user_t * auth_user)
++{
++    ntlm_user_t *ntlm_user = auth_user->scheme_data;
++    if (ntlm_user)
++	return ntlm_user->username;
++    return NULL;
++}
++
++/* NTLMLastHeader: return a pointer to the last header used in authenticating
++ * the request/conneciton
++ */
++static const char *
++NTLMLastHeader(auth_user_request_t * auth_user_request)
++{
++    ntlm_request_t *ntlm_request;
++    assert(auth_user_request != NULL);
++    assert(auth_user_request->scheme_data != NULL);
++    ntlm_request = auth_user_request->scheme_data;
++    return ntlm_request->ntlmauthenticate;
++}
++
++/*
++ * Decode an NTLM [Proxy-]Auth string, placing the results in the passed
++ * Auth_user structure.
++ */
++
++static void
++authenticateDecodeNTLMAuth(auth_user_request_t * auth_user_request, const char *proxy_auth)
++{
++    dlink_node *node;
++    assert(auth_user_request->auth_user == NULL);
++    auth_user_request->auth_user = authenticateAuthUserNew("ntlm");
++    auth_user_request->auth_user->auth_type = AUTH_NTLM;
++    auth_user_request->auth_user->scheme_data = memPoolAlloc(ntlm_user_pool);
++    auth_user_request->scheme_data = memPoolAlloc(ntlm_request_pool);
++    memset(auth_user_request->scheme_data, '\0', sizeof(ntlm_request_t));
++    /* lock for the auth_user_request link */
++    authenticateAuthUserLock(auth_user_request->auth_user);
++    node = dlinkNodeNew();
++    dlinkAdd(auth_user_request, node, &auth_user_request->auth_user->requests);
++
++    /* all we have to do is identify that it's NTLM - the helper does the rest */
++    debug(29, 9) ("authenticateDecodeNTLMAuth: NTLM authentication\n");
++    return;
++}
++
++static int
++authenticateNTLMcmpUsername(ntlm_user_t * u1, ntlm_user_t * u2)
++{
++    return strcmp(u1->username, u2->username);
++}
++
++
++/* there is a known race where a single client recieves the same challenge
++ * and sends the same response to squid on a single select cycle.
++ * Check for this and if found ignore the new link 
++ */
++static void
++authenticateProxyAuthCacheAddLink(const char *key, auth_user_t * auth_user)
++{
++    auth_user_hash_pointer *proxy_auth_hash;
++    dlink_node *node;
++    ntlm_user_t *ntlm_user;
++    ntlm_user = auth_user->scheme_data;
++    node = ntlm_user->proxy_auth_list.head;
++    /* prevent duplicates */
++    while (node) {
++	if (!strcmp(key, ((auth_user_hash_pointer *) node->data)->key))
++	    return;
++	node = node->next;
++    }
++    proxy_auth_hash = memAllocate(MEM_AUTH_USER_HASH);
++    proxy_auth_hash->key = xstrdup(key);
++    proxy_auth_hash->auth_user = auth_user;
++    dlinkAddTail(proxy_auth_hash, &proxy_auth_hash->link, &ntlm_user->proxy_auth_list);
++    hash_join(proxy_auth_cache, (hash_link *) proxy_auth_hash);
++}
++
++
++static int
++authNTLMAuthenticated(auth_user_request_t * auth_user_request)
++{
++    ntlm_request_t *ntlm_request = auth_user_request->scheme_data;
++    if (ntlm_request->auth_state == AUTHENTICATE_STATE_DONE)
++	return 1;
++    debug(29, 9) ("User not fully authenticated.\n");
++    return 0;
++}
++
++static void
++authenticateNTLMAuthenticateUser(auth_user_request_t * auth_user_request, request_t * request, ConnStateData * conn, http_hdr_type type)
++{
++    const char *proxy_auth;
++    auth_user_hash_pointer *usernamehash, *proxy_auth_hash = NULL;
++    auth_user_t *auth_user;
++    ntlm_request_t *ntlm_request;
++    ntlm_user_t *ntlm_user;
++    LOCAL_ARRAY(char, ntlmhash, NTLM_CHALLENGE_SZ * 2);
++    /* get header */
++    proxy_auth = httpHeaderGetStr(&request->header, type);
++
++    auth_user = auth_user_request->auth_user;
++    assert(auth_user);
++    assert(auth_user->auth_type == AUTH_NTLM);
++    assert(auth_user->scheme_data != NULL);
++    assert(auth_user_request->scheme_data != NULL);
++    ntlm_user = auth_user->scheme_data;
++    ntlm_request = auth_user_request->scheme_data;
++    /* Check that we are in the client side, where we can generate
++     * auth challenges */
++    if (!conn) {
++	ntlm_request->auth_state = AUTHENTICATE_STATE_FAILED;
++	debug(29, 1) ("authenticateNTLMAuthenticateUser: attempt to perform authentication without a connection!\n");
++	return;
++    }
++    switch (ntlm_request->auth_state) {
++    case AUTHENTICATE_STATE_NONE:
++	/* we've recieved a negotiate request. pass to a helper */
++	debug(29, 9) ("authenticateNTLMAuthenticateUser: auth state ntlm none. %s\n", proxy_auth);
++	ntlm_request->auth_state = AUTHENTICATE_STATE_NEGOTIATE;
++	ntlm_request->ntlmnegotiate = xstrndup(proxy_auth, NTLM_CHALLENGE_SZ + 5);
++	conn->auth_type = AUTH_NTLM;
++	conn->auth_user_request = auth_user_request;
++	ntlm_request->conn = conn;
++	/* and lock for the connection duration */
++	debug(29, 9) ("authenticateNTLMAuthenticateUser: Locking auth_user from the connection.\n");
++	authenticateAuthUserRequestLock(auth_user_request);
++	return;
++	break;
++    case AUTHENTICATE_STATE_NEGOTIATE:
++	ntlm_request->auth_state = AUTHENTICATE_STATE_CHALLENGE;
++	/* We _MUST_ have the auth challenge by now */
++	assert(ntlm_request->authchallenge);
++	return;
++	break;
++    case AUTHENTICATE_STATE_CHALLENGE:
++	/* we should have recieved a NTLM challenge. pass it to the same 
++	 * helper process */
++	debug(29, 9) ("authenticateNTLMAuthenticateUser: auth state challenge with header %s.\n", proxy_auth);
++	/* do a cache lookup here. If it matches it's a successful ntlm 
++	 * challenge - release the helper and use the existing auth_user 
++	 * details. */
++	if (strncmp("NTLM ", proxy_auth, 5) == 0) {
++	    ntlm_request->ntlmauthenticate = xstrdup(proxy_auth);
++	} else {
++	    fatal("Incorrect scheme in auth header\n");
++	    /* TODO: more fault tolerance.. reset the auth scheme here */
++	}
++	/* normal case with challenge reuses disabled */
++	if (ntlmConfig->challengeuses == 0) {
++	    /* verify with the ntlm helper */
++	    ntlm_request->auth_state = AUTHENTICATE_STATE_RESPONSE;
++	    return;
++	}
++	/* cache entries have authenticateauthheaderchallengestring */
++	snprintf(ntlmhash, sizeof(ntlmhash) - 1, "%s%s",
++	    ntlm_request->ntlmauthenticate,
++	    ntlm_request->authchallenge);
++	/* see if we already know this user's authenticate */
++	debug(29, 9) ("aclMatchProxyAuth: cache lookup with key '%s'\n", ntlmhash);
++	assert(proxy_auth_cache != NULL);
++	proxy_auth_hash = hash_lookup(proxy_auth_cache, ntlmhash);
++	if (!proxy_auth_hash) {	/* not in the hash table */
++	    debug(29, 4) ("authenticateNTLMAuthenticateUser: proxy-auth cache miss.\n");
++	    ntlm_request->auth_state = AUTHENTICATE_STATE_RESPONSE;
++	    /* verify with the ntlm helper */
++	} else {
++	    debug(29, 4) ("authenticateNTLMAuthenticateUser: ntlm proxy-auth cache hit\n");
++	    /* throw away the temporary entry */
++	    ntlm_request->authserver_deferred = 0;
++	    authenticateNTLMReleaseServer(ntlm_request);
++	    authenticateAuthUserMerge(auth_user, proxy_auth_hash->auth_user);
++	    auth_user = proxy_auth_hash->auth_user;
++	    auth_user_request->auth_user = auth_user;
++	    ntlm_request->auth_state = AUTHENTICATE_STATE_DONE;
++	    /* we found one */
++	    debug(29, 9) ("found matching cache entry\n");
++	    assert(auth_user->auth_type == AUTH_NTLM);
++	    /* get the existing entries details */
++	    ntlm_user = auth_user->scheme_data;
++	    debug(29, 9) ("Username to be used is %s\n", ntlm_user->username);
++	    /* on ntlm auth we do not unlock the auth_user until the
++	     * connection is dropped. Thank MS for this quirk */
++	    auth_user->expiretime = current_time.tv_sec;
++	}
++	return;
++	break;
++    case AUTHENTICATE_STATE_RESPONSE:
++	/* auth-challenge pair cache miss. We've just got the response from the helper */
++	/*add to cache and let them through */
++	ntlm_request->auth_state = AUTHENTICATE_STATE_DONE;
++	/* this connection is authenticated */
++	debug(29, 4) ("authenticated\nch    %s\nauth     %s\nauthuser %s\n",
++	    ntlm_request->authchallenge,
++	    ntlm_request->ntlmauthenticate,
++	    ntlm_user->username);
++	/* see if this is an existing user with a different proxy_auth 
++	 * string */
++	usernamehash = hash_lookup(proxy_auth_username_cache, ntlm_user->username);
++	if (usernamehash) {
++	    while (usernamehash && (usernamehash->auth_user->auth_type != auth_user->auth_type || authenticateNTLMcmpUsername(usernamehash->auth_user->scheme_data, ntlm_user) != 0))
++		usernamehash = usernamehash->next;
++	}
++	if (usernamehash) {
++	    /*
++	     * add another link from the new proxy_auth to the
++	     * auth_user structure and update the information */
++	    assert(proxy_auth_hash == NULL);
++	    /* we can't seamlessly recheck the username due to the 
++	     * challenge nature of the protocol. Just free the 
++	     * temporary auth_user */
++	    authenticateAuthUserMerge(auth_user, usernamehash->auth_user);
++	    auth_user = usernamehash->auth_user;
++	    auth_user_request->auth_user = auth_user;
++	} else {
++	    /* store user in hash's */
++	    authenticateUserNameCacheAdd(auth_user);
++	}
++	if (ntlmConfig->challengeuses) {
++	    /* cache entries have authenticateauthheaderchallengestring */
++	    snprintf(ntlmhash, sizeof(ntlmhash) - 1, "%s%s",
++		ntlm_request->ntlmauthenticate,
++		ntlm_request->authchallenge);
++	    authenticateProxyAuthCacheAddLink(ntlmhash, auth_user);
++	}
++	/* set these to now because this is either a new login from an 
++	 * existing user or a new user */
++	auth_user->expiretime = current_time.tv_sec;
++	return;
++	break;
++    case AUTHENTICATE_STATE_DONE:
++	fatal("authenticateNTLMAuthenticateUser: unexpect auth state DONE! Report a bug to the squid developers.\n");
++	break;
++    case AUTHENTICATE_STATE_FAILED:
++	/* we've failed somewhere in authentication */
++	debug(29, 9) ("authenticateNTLMAuthenticateUser: auth state ntlm failed. %s\n", proxy_auth);
++	return;
++    }
++    return;
++}
--- squid-2.5.9.orig/debian/patches/23-deny-internal-object-purge.dpatch
+++ squid-2.5.9/debian/patches/23-deny-internal-object-purge.dpatch
@@ -0,0 +1,26 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 23-deny-internal-object-purge.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/client_side.c /tmp/dpep.BRwvli/squid-2.5.7/src/client_side.c
+--- squid-2.5.7/src/client_side.c	2004-10-06 00:34:42.000000000 +0200
++++ /tmp/dpep.BRwvli/squid-2.5.7/src/client_side.c	2004-12-11 17:23:47.000000000 +0100
+@@ -661,6 +661,15 @@
+ 	if (!entry)
+ 	    entry = storeGetPublicByRequestMethod(http->request, METHOD_HEAD);
+ 	if (entry) {
++	    if (EBIT_TEST(entry->flags, ENTRY_SPECIAL)) {
++			http->log_type = LOG_TCP_DENIED;
++			err = errorCon(ERR_ACCESS_DENIED, HTTP_FORBIDDEN);
++			err->request = requestLink(http->request);
++			err->src_addr = http->conn->peer.sin_addr;
++			http->entry = clientCreateStoreEntry(http, http->request->method, null_request_flags);
++			errorAppendEntry(http->entry, err);
++			return;
++	    }
+ 	    /* Swap in the metadata */
+ 	    http->entry = entry;
+ 	    storeLockObject(http->entry);
--- squid-2.5.9.orig/debian/patches/24-gopher-html-parsing.dpatch
+++ squid-2.5.9/debian/patches/24-gopher-html-parsing.dpatch
@@ -0,0 +1,22 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 24-gopher-html-parsing.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/gopher.c /tmp/dpep.UTATHb/squid-2.5.7/src/gopher.c
+--- squid-2.5.7/src/gopher.c	2003-11-29 09:38:36.000000000 +0100
++++ /tmp/dpep.UTATHb/squid-2.5.7/src/gopher.c	2005-01-17 18:17:17.000000000 +0100
+@@ -342,6 +342,11 @@
+ 	if (gopherState->len != 0) {
+ 	    /* there is something left from last tx. */
+ 	    xstrncpy(line, gopherState->buf, gopherState->len + 1);
++	    if (gopherState->len + len > TEMP_BUF_SIZE) {
++		debug(10, 1) ("GopherHTML: Buffer overflow. Lost some data on URL: %s\n",
++		    storeUrl(entry));
++		len = TEMP_BUF_SIZE - gopherState->len;
++	    }
+ 	    lpos = (char *) memccpy(line + gopherState->len, inbuf, '\n', len);
+ 	    if (lpos)
+ 		*lpos = '\0';
--- squid-2.5.9.orig/debian/patches/25-wccp-dos.dpatch
+++ squid-2.5.9/debian/patches/25-wccp-dos.dpatch
@@ -0,0 +1,50 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 25-wccp-dos.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/src/wccp.c /tmp/dpep.h51unK/squid-2.5.7/src/wccp.c
+--- squid-2.5.7/src/wccp.c	2002-10-24 20:51:14.000000000 +0200
++++ /tmp/dpep.h51unK/squid-2.5.7/src/wccp.c	2005-01-17 18:18:06.000000000 +0100
+@@ -245,6 +245,16 @@
+ 	return;
+     if (ntohl(wccp_i_see_you.type) != WCCP_I_SEE_YOU)
+ 	return;
++    if (ntohl(wccp_i_see_you.number) > WCCP_ACTIVE_CACHES) {
++	debug(80, 1) ("Ignoring WCCP_I_SEE_YOU from %s with number of caches set to %d\n",
++	    inet_ntoa(from.sin_addr), (int) ntohl(wccp_i_see_you.number));
++	return;
++    }
++    if (ntohl(wccp_i_see_you.number) <= 0) {
++	debug(80, 1) ("Ignoring WCCP_I_SEE_YOU from %s with non-positive number of caches\n",
++	    inet_ntoa(from.sin_addr));
++	return;
++    }
+     if ((0 == change) && (number_caches == ntohl(wccp_i_see_you.number))) {
+ 	if (last_assign_buckets_change == wccp_i_see_you.change) {
+ 	    /*
+@@ -274,7 +284,11 @@
+ wccpLowestIP(void)
+ {
+     int loop;
++    /*
++     * We sanity checked wccp_i_see_you.number back in wccpHandleUdp()
++     */
+     for (loop = 0; loop < ntohl(wccp_i_see_you.number); loop++) {
++	assert(loop < WCCP_ACTIVE_CACHES);
+ 	if (wccp_i_see_you.wccp_cache_entry[loop].ip_addr.s_addr < local_ip.s_addr)
+ 	    return 0;
+     }
+@@ -311,8 +325,8 @@
+ 
+     debug(80, 6) ("wccpAssignBuckets: Called\n");
+     number_caches = ntohl(wccp_i_see_you.number);
+-    if (number_caches > WCCP_ACTIVE_CACHES)
+-	number_caches = WCCP_ACTIVE_CACHES;
++    assert(number_caches > 0);
++    assert(number_caches <= WCCP_ACTIVE_CACHES);
+     wab_len = sizeof(struct wccp_assign_bucket_t);
+     cache_len = WCCP_CACHE_LEN * number_caches;
+ 
--- squid-2.5.9.orig/debian/patches/26-dns-memleak.dpatch
+++ squid-2.5.9/debian/patches/26-dns-memleak.dpatch
@@ -0,0 +1,25 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 26-dns-memleak.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/lib/rfc1035.c /tmp/dpep.IxAMeC/squid-2.5.7/lib/rfc1035.c
+--- squid-2.5.7/lib/rfc1035.c	2004-04-11 11:14:52.000000000 +0200
++++ /tmp/dpep.IxAMeC/squid-2.5.7/lib/rfc1035.c	2005-01-17 18:18:31.000000000 +0100
+@@ -554,11 +554,10 @@
+ 	    return -rfc1035_unpack_error;
+ 	}
+     }
+-    i = (int) hdr.ancount;
+-    if (i == 0)
++    if (hdr.ancount == 0)
+ 	return 0;
+-    recs = calloc(i, sizeof(*recs));
+-    while (i--) {
++    recs = calloc((int)hdr.ancount, sizeof(*recs));
++    for (i = 0; i < (int)hdr.ancount; i++) {
+ 	if (off >= sz) {	/* corrupt packet */
+ 	    RFC1035_UNPACK_DEBUG;
+ 	    break;
--- squid-2.5.9.orig/debian/patches/27-ldap-spaces.dpatch
+++ squid-2.5.9/debian/patches/27-ldap-spaces.dpatch
@@ -0,0 +1,73 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 27-ldap-spaces.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/helpers/basic_auth/LDAP/squid_ldap_auth.c /tmp/dpep.CfKmxq/squid-2.5.7/helpers/basic_auth/LDAP/squid_ldap_auth.c
+--- squid-2.5.7/helpers/basic_auth/LDAP/squid_ldap_auth.c	2004-08-10 11:39:29.000000000 +0200
++++ /tmp/dpep.CfKmxq/squid-2.5.7/helpers/basic_auth/LDAP/squid_ldap_auth.c	2005-01-17 18:19:01.000000000 +0100
+@@ -30,6 +30,10 @@
+  * or (at your option) any later version.
+  *
+  * Changes:
++ * 2005-01-07: Henrik Nordstrom <hno@squid-cache.org>
++ *             - Added some sanity checks on login names to avoid
++ *             users bypassing equality checks by exploring the
++ *             overly helpful match capabilities of LDAP
+  * 2004-07-17: Henrik Nordstrom <hno@squid-cache.org>
+  *             - Corrected non-persistent mode to only issue one
+  *             ldap_bind per connection.
+@@ -83,6 +87,7 @@
+ #include <stdlib.h>
+ #include <lber.h>
+ #include <ldap.h>
++#include <ctype.h>
+ 
+ #include "util.h"
+ 
+@@ -261,6 +266,32 @@
+     return ld;
+ }
+ 
++/* Make a sanity check on the username to reject oddly typed names */
++static int
++validUsername(const char *user)
++{
++    const unsigned char *p = user;
++
++    /* Leading whitespace? */
++    if (isspace(p[0]))
++	return 0;
++    while(p[0] && p[1]) {
++	if (isspace(p[0])) {
++	    /* More than one consequitive space? */
++	    if (isspace(p[1]))
++		return 0;
++	    /* or odd space type character used? */
++	    if (p[0] != ' ')
++		return 0;
++	}
++	p++;
++    }
++    /* Trailing whitespace? */
++    if (isspace(p[0]))
++	return 0;
++    return 1;
++}
++
+ int
+ main(int argc, char **argv)
+ {
+@@ -481,6 +512,10 @@
+ 	}
+ 	rfc1738_unescape(user);
+ 	rfc1738_unescape(passwd);
++	if (!validUsername(user)) {
++	    printf("ERR\n");
++	    continue;
++	}
+ 	tryagain = (ld != NULL);
+       recover:
+ 	if (ld == NULL && persistent)
--- squid-2.5.9.orig/debian/patches/28-fakeauth-memleak.dpatch
+++ squid-2.5.9/debian/patches/28-fakeauth-memleak.dpatch
@@ -0,0 +1,215 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 28-fakeauth-memleak.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/helpers/ntlm_auth/fakeauth/fakeauth_auth.c /tmp/dpep.W3TlOh/squid-2.5.7/helpers/ntlm_auth/fakeauth/fakeauth_auth.c
+--- squid-2.5.7/helpers/ntlm_auth/fakeauth/fakeauth_auth.c	2004-08-20 10:09:58.000000000 +0200
++++ /tmp/dpep.W3TlOh/squid-2.5.7/helpers/ntlm_auth/fakeauth/fakeauth_auth.c	2005-01-17 18:19:54.000000000 +0100
+@@ -38,10 +38,9 @@
+ #if HAVE_PWD_H
+ #include <pwd.h>
+ #endif
+-
+-
+-#define ERR    "ERR\n"
+-#define OK     "OK\n"
++#if HAVE_ASSERT_H
++#include <assert.h>
++#endif
+ 
+ #if 0
+ #define NTLM_STATIC_CHALLENGE "deadbeef"
+@@ -55,7 +54,8 @@
+ static void
+ lc(char *string)
+ {
+-    char *p = string, c;
++    char *p = string;
++    char c;
+     while ((c = *p)) {
+ 	*p = tolower(c);
+ 	p++;
+@@ -65,7 +65,7 @@
+ 
+ /*
+  * Generates a challenge request. The randomness of the 8 byte 
+- * challenge strings can be guarenteed to be poor at best.
++ * challenge strings can be guaranteed to be poor at best.
+  */
+ void
+ ntlmMakeChallenge(struct ntlm_challenge *chal)
+@@ -89,7 +89,6 @@
+     if (authenticate_ntlm_domain != NULL)
+ 	while (authenticate_ntlm_domain[i++]);
+ 
+-
+     chal->target.offset = WSWAP(48);
+     chal->target.maxlen = SSWAP(i);
+     chal->target.len = chal->target.maxlen;
+@@ -110,7 +109,7 @@
+ }
+ 
+ /*
+- * Check the vailidity of a request header. Return -1 on error.
++ * Check the validity of a request header. Return -1 on error.
+  */
+ int
+ ntlmCheckHeader(ntlmhdr * hdr, int type)
+@@ -127,9 +126,8 @@
+ 	return 0;
+ 
+     if (WSWAP(hdr->type) != type) {
+-/* don't report this error - it's ok as we do a if() around this function */
+-//      fprintf(stderr, "ntlmCheckHeader: type is %d, wanted %d\n",
+-	//          WSWAP(hdr->type), type);
++	/* don't report this error - it's ok as we do a if() around this function */
++	/* fprintf(stderr, "ntlmCheckHeader: type is %d, wanted %d\n", WSWAP(hdr->type), type); */
+ 	return (-1);
+     }
+     return (0);
+@@ -142,9 +140,12 @@
+ ntlmGetString(ntlmhdr * hdr, strhdr * str, int flags)
+ {
+     static char buf[512];
+-    u_short *s, c;
+-    char *d, *sc;
+-    int l, o;
++    u_short *s;
++    u_short c;
++    char *d;
++    char *sc;
++    int l;
++    int o;
+ 
+     l = SSWAP(str->len);
+     o = WSWAP(str->offset);
+@@ -195,62 +196,70 @@
+ int
+ ntlmDecodeAuth(struct ntlm_authenticate *auth, char *buf, size_t size)
+ {
+-    char *p, *origbuf;
++    char *p;
++    char *origbuf;
+     int s;
+ 
+-    if (!buf) {
++    if (!buf)
+ 	return 1;
+-    }
+     origbuf = buf;
+-    if (ntlmCheckHeader(&auth->hdr, NTLM_AUTHENTICATE)) {
++    assert (0 == ntlmCheckHeader(&auth->hdr, NTLM_AUTHENTICATE));
++
++#if DEBUG_FAKEAUTH
++    fprintf(stderr,"ntlmDecodeAuth: size of %d\n", size);
++    fprintf(stderr,"ntlmDecodeAuth: flg %08x\n", auth->flags);
++    fprintf(stderr,"ntlmDecodeAuth: usr o(%d) l(%d)\n", auth->user.offset,
++	auth->user.len);
++#endif
+ 
+-	fprintf(stderr, "ntlmDecodeAuth: header check fails\n");
+-	return -1;
+-    }
+-/* only on when you need to debug
+- * fprintf(stderr,"ntlmDecodeAuth: size of %d\n", size);
+- * fprintf(stderr,"ntlmDecodeAuth: flg %08x\n", auth->flags);
+- * fprintf(stderr,"ntlmDecodeAuth: usr o(%d) l(%d)\n", auth->user.offset, auth->user.len);
+- */
+     if ((p = ntlmGetString(&auth->hdr, &auth->domain, 2)) == NULL)
+ 	p = authenticate_ntlm_domain;
+-//      fprintf(stderr,"ntlmDecodeAuth: Domain '%s'.\n",p);
++#if DEBUG_FAKEAUTH
++    fprintf(stderr,"ntlmDecodeAuth: Domain '%s'.\n",p);
++#endif
+     if ((s = strlen(p) + 1) >= size)
+ 	return 1;
+     strcpy(buf, p);
+-//      fprintf(stdout,"ntlmDecodeAuth: Domain '%s'.\n",buf);
++#if DEBUG_FAKEAUTH
++    fprintf(stdout,"ntlmDecodeAuth: Domain '%s'.\n",buf);
++#endif
+ 
+     size -= s;
+     buf += (s - 1);
+     *buf++ = '\\';		/* Using \ is more consistent with MS-proxy */
+ 
+     p = ntlmGetString(&auth->hdr, &auth->user, 2);
++    if (NULL == p)
++	return 1;
+     if ((s = strlen(p) + 1) >= size)
+ 	return 1;
+     while (*p)
+-	*buf++ = (*p++);	//tolower
++	*buf++ = (*p++);	/* tolower */
+ 
+     *buf++ = '\0';
+     size -= s;
+-//      fprintf(stderr, "ntlmDecodeAuth: user: %s%s\n",origbuf, p);
+-
++#if DEBUG_FAKEAUTH
++    fprintf(stderr, "ntlmDecodeAuth: user: %s%s\n",origbuf, p);
++#endif
+ 
+     return 0;
+ }
+ 
+ 
+ int
+-main()
++main(int argc, char *argv[])
+ {
+     char buf[256];
+-    char user[256], *p, *cleartext;
++    char user[256];
++    char *p;
++    char *cleartext = NULL;
+     struct ntlm_challenge chal;
+     int len;
+     char *data = NULL;
+ 
+     setbuf(stdout, NULL);
+     while (fgets(buf, 256, stdin) != NULL) {
+-	user[0] = '\0';		/*no usercode */
++	memset(user, '\0', sizeof(user));	/* no usercode */
+ 
+ 	if ((p = strchr(buf, '\n')) != NULL)
+ 	    *p = '\0';		/* strip \n */
+@@ -270,11 +279,11 @@
+ 		    printf("AF %s\n", user);
+ 		} else {
+ 		    lc(user);
+-		    printf("NA invalid credentials%s\n", user);
++		    printf("NA invalid credentials, user=%s\n", user);
+ 		}
+ 	    } else {
+ 		lc(user);
+-		printf("BH wrong packet type!%s\n", user);
++		printf("BH wrong packet type! user=%s\n", user);
+ 	    }
+ 	}
+ #endif
+@@ -291,10 +300,8 @@
+ 		    SSWAP(chal.target.maxlen);
+ 		data = (char *) base64_encode_bin((char *) &chal, len);
+ 		printf("CH %s\n", data);
+-	    } else if (!ntlmCheckHeader
+-		((struct ntlmhdr *) cleartext, NTLM_AUTHENTICATE)) {
+-		if (!ntlmDecodeAuth
+-		    ((struct ntlm_authenticate *) cleartext, user, 256)) {
++	    } else if (!ntlmCheckHeader ((struct ntlmhdr *) cleartext, NTLM_AUTHENTICATE)) {
++		if (!ntlmDecodeAuth ((struct ntlm_authenticate *) cleartext, user, 256)) {
+ 		    lc(user);
+ 		    printf("OK %s\n", user);
+ 		} else {
+@@ -307,6 +314,8 @@
+ 	    }
+ 	}
+ #endif /*v2 */
++	free(cleartext);
++	cleartext = NULL;
+     }
+     exit(0);
+ }
--- squid-2.5.9.orig/debian/patches/29-fqdn-truncated.dpatch
+++ squid-2.5.9/debian/patches/29-fqdn-truncated.dpatch
@@ -0,0 +1,98 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 29-fqdn-truncated.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/lib/rfc1035.c /tmp/dpep.cuCrmj/squid-2.5.7/lib/rfc1035.c
+--- squid-2.5.7/lib/rfc1035.c	2004-04-11 11:14:52.000000000 +0200
++++ /tmp/dpep.cuCrmj/squid-2.5.7/lib/rfc1035.c	2005-01-17 18:21:36.000000000 +0100
+@@ -299,7 +299,7 @@
+  * Returns 0 (success) or 1 (error)
+  */
+ static int
+-rfc1035NameUnpack(const char *buf, size_t sz, off_t * off, char *name, size_t ns, int rdepth)
++rfc1035NameUnpack(const char *buf, size_t sz, off_t * off, unsigned short *rdlength, char *name, size_t ns, int rdepth)
+ {
+     off_t no = 0;
+     unsigned char c;
+@@ -324,7 +324,7 @@
+ 	    /* Make sure the pointer is inside this message */
+ 	    if (ptr >= sz)
+ 		return 1;
+-	    return rfc1035NameUnpack(buf, sz, &ptr, name + no, ns - no, rdepth + 1);
++	    return rfc1035NameUnpack(buf, sz, &ptr, rdlength, name + no, ns - no, rdepth + 1);
+ 	} else if (c > RFC1035_MAXLABELSZ) {
+ 	    /*
+ 	     * "(The 10 and 01 combinations are reserved for future use.)"
+@@ -343,6 +343,8 @@
+ 	    (*off) += len;
+ 	    no += len;
+ 	    *(name + (no++)) = '.';
++	    if (rdlength)
++		*rdlength += len + 1;
+ 	}
+     } while (c > 0 && no < ns);
+     if (no)
+@@ -369,8 +371,9 @@
+ {
+     unsigned short s;
+     unsigned int i;
++    unsigned short rdlength;
+     off_t rdata_off;
+-    if (rfc1035NameUnpack(buf, sz, off, RR->name, RFC1035_MAXHOSTNAMESZ, 0)) {
++    if (rfc1035NameUnpack(buf, sz, off, NULL, RR->name, RFC1035_MAXHOSTNAMESZ, 0)) {
+ 	RFC1035_UNPACK_DEBUG;
+ 	memset(RR, '\0', sizeof(*RR));
+ 	return 1;
+@@ -395,7 +398,8 @@
+     RR->ttl = ntohl(i);
+     memcpy(&s, buf + (*off), sizeof(s));
+     (*off) += sizeof(s);
+-    if ((*off) + ntohs(s) > sz) {
++    rdlength = ntohs(s);
++    if ((*off) + rdlength > sz) {
+ 	/*
+ 	 * We got a truncated packet.  'dnscache' truncates UDP
+ 	 * replies at 512 octets, as per RFC 1035.
+@@ -404,31 +408,33 @@
+ 	memset(RR, '\0', sizeof(*RR));
+ 	return 1;
+     }
+-    RR->rdlength = ntohs(s);
++    RR->rdlength = rdlength;
+     switch (RR->type) {
+     case RFC1035_TYPE_PTR:
+ 	RR->rdata = malloc(RFC1035_MAXHOSTNAMESZ);
+ 	rdata_off = *off;
+-	if (rfc1035NameUnpack(buf, sz, &rdata_off, RR->rdata, RFC1035_MAXHOSTNAMESZ, 0))
++	RR->rdlength = 0; /* Filled in by rfc1035NameUnpack */
++	if (rfc1035NameUnpack(buf, sz, &rdata_off, &RR->rdlength, RR->rdata, RFC1035_MAXHOSTNAMESZ, 0))
+ 	    return 1;
+-	if (rdata_off != ((*off) + RR->rdlength)) {
++	if (rdata_off != ((*off) + rdlength)) {
+ 	    /*
+ 	     * This probably doesn't happen for valid packets, but
+ 	     * I want to make sure that NameUnpack doesn't go beyond
+ 	     * the RDATA area.
+ 	     */
+ 	    RFC1035_UNPACK_DEBUG;
++	    free(RR->rdata);
+ 	    memset(RR, '\0', sizeof(*RR));
+ 	    return 1;
+ 	}
+ 	break;
+     case RFC1035_TYPE_A:
+     default:
+-	RR->rdata = malloc(RR->rdlength);
+-	memcpy(RR->rdata, buf + (*off), RR->rdlength);
++	RR->rdata = malloc(rdlength);
++	memcpy(RR->rdata, buf + (*off), rdlength);
+ 	break;
+     }
+-    (*off) += RR->rdlength;
++    (*off) += rdlength;
+     assert((*off) <= sz);
+     return 0;
+ }
--- squid-2.5.9.orig/debian/patches/30-amd64-gcc40-compile.dpatch
+++ squid-2.5.9/debian/patches/30-amd64-gcc40-compile.dpatch
@@ -0,0 +1,42 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 30-amd64-gcc40-compile.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.7/helpers/ntlm_auth/SMB/smbval/smblib-priv.h /tmp/dpep.0dIAiT/squid-2.5.7/helpers/ntlm_auth/SMB/smbval/smblib-priv.h
+--- squid-2.5.7/helpers/ntlm_auth/SMB/smbval/smblib-priv.h	2001-03-10 01:55:38.000000000 +0100
++++ /tmp/dpep.0dIAiT/squid-2.5.7/helpers/ntlm_auth/SMB/smbval/smblib-priv.h	2005-01-17 18:34:52.000000000 +0100
+@@ -498,7 +498,7 @@
+ /* We must make it possible for callers to specify these ... */
+ 
+ 
+-extern char *SMB_Prots[];
++/* extern char *SMB_Prots[]; */
+ 
+ /*
+  * static char *SMB_Prots[] = {"PC NETWORK PROGRAM 1.0", 
+@@ -515,7 +515,7 @@
+  * "NT LANMAN 1.0",
+  * NULL};
+  */
+-extern int SMB_Types[];
++/* extern int SMB_Types[]; */
+ 
+ /*
+  * static int SMB_Types[] = {SMB_P_Core,
+diff -urNad squid-2.5.7/src/auth/ntlm/auth_ntlm.h /tmp/dpep.0dIAiT/squid-2.5.7/src/auth/ntlm/auth_ntlm.h
+--- squid-2.5.7/src/auth/ntlm/auth_ntlm.h	2004-08-25 22:24:04.000000000 +0200
++++ /tmp/dpep.0dIAiT/squid-2.5.7/src/auth/ntlm/auth_ntlm.h	2005-01-17 18:35:53.000000000 +0100
+@@ -85,8 +85,10 @@
+ typedef struct _auth_ntlm_config auth_ntlm_config;
+ typedef struct _ntlm_challenge_hash_pointer ntlm_challenge_hash_pointer;
+ 
++/*
+ extern MemPool *ntlm_helper_state_pool;
+ extern MemPool *ntlm_user_pool;
+ extern MemPool *ntlm_request_pool;
++*/
+ 
+ #endif
--- squid-2.5.9.orig/debian/patches/36-dns-assert.dpatch
+++ squid-2.5.9/debian/patches/36-dns-assert.dpatch
@@ -0,0 +1,59 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 36-dns-assert.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.8/src/comm.c /tmp/dpep.HqVOOi/squid-2.5.8/src/comm.c
+--- squid-2.5.8/src/comm.c	2004-09-27 20:17:39.000000000 +0200
++++ /tmp/dpep.HqVOOi/squid-2.5.8/src/comm.c	2005-02-17 01:16:24.000000000 +0100
+@@ -411,8 +411,6 @@
+ 	cs->S.sin_family = AF_INET;
+ 	cs->S.sin_addr = cs->in_addr;
+ 	cs->S.sin_port = htons(cs->port);
+-	if (Config.onoff.log_fqdn)
+-	    fqdncache_gethostbyaddr(cs->S.sin_addr, FQDN_LOOKUP_IF_MISS);
+     }
+     switch (comm_connect_addr(fd, &cs->S)) {
+     case COMM_INPROGRESS:
+diff -urNad squid-2.5.8/src/fqdncache.c /tmp/dpep.HqVOOi/squid-2.5.8/src/fqdncache.c
+--- squid-2.5.8/src/fqdncache.c	2004-12-08 00:40:57.000000000 +0100
++++ /tmp/dpep.HqVOOi/squid-2.5.8/src/fqdncache.c	2005-02-17 01:16:24.000000000 +0100
+@@ -303,7 +303,9 @@
+ 	    continue;
+ 	if (answers[k].class != RFC1035_CLASS_IN)
+ 	    continue;
+-	f->names[f->name_count++] = xstrndup(answers[k].rdata, answers[k].rdlength);
++	if (!answers[k].rdata[0])
++	    continue;
++	f->names[f->name_count++] = xstrdup(answers[k].rdata);
+ 	if (ttl == 0 || answers[k].ttl < ttl)
+ 	    ttl = answers[k].ttl;
+ 	if (f->name_count >= FQDN_MAX_NAMES)
+diff -urNad squid-2.5.8/src/ipcache.c /tmp/dpep.HqVOOi/squid-2.5.8/src/ipcache.c
+--- squid-2.5.8/src/ipcache.c	2004-12-08 00:40:57.000000000 +0100
++++ /tmp/dpep.HqVOOi/squid-2.5.8/src/ipcache.c	2005-02-17 01:16:24.000000000 +0100
+@@ -338,6 +338,10 @@
+ 	    continue;
+ 	if (answers[k].class != RFC1035_CLASS_IN)
+ 	    continue;
++	if (answers[k].rdlength != 4) {
++	    debug(14, 1) ("ipcacheParse: Invalid IP address in response to '%s'\n", name);
++	    continue;
++	}
+ 	na++;
+     }
+     if (na == 0) {
+@@ -353,9 +357,10 @@
+ 	    continue;
+ 	if (answers[k].class != RFC1035_CLASS_IN)
+ 	    continue;
++	if (answers[k].rdlength != 4)
++	    continue;
+ 	if (ttl == 0 || ttl > answers[k].ttl)
+ 	    ttl = answers[k].ttl;
+-	assert(answers[k].rdlength == 4);
+ 	xmemcpy(&i->addrs.in_addrs[j++], answers[k].rdata, 4);
+ 	debug(14, 3) ("ipcacheParse: #%d %s\n",
+ 	    j - 1,
--- squid-2.5.9.orig/debian/patches/37-setcookie.dpatch
+++ squid-2.5.9/debian/patches/37-setcookie.dpatch
@@ -0,0 +1,105 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 37-setcookie.dpatch by Luigi Gangitano <luigi@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad squid-2.5.9/src/client_side.c /tmp/dpep.5JNJLF/squid-2.5.9/src/client_side.c
+--- squid-2.5.9/src/client_side.c	2005-02-20 20:07:45.000000000 +0100
++++ /tmp/dpep.5JNJLF/squid-2.5.9/src/client_side.c	2005-03-08 04:40:55.854730599 +0100
+@@ -572,6 +572,7 @@
+ 	}
+     } else {
+ 	/* the client can handle this reply, whatever it is */
++	http->flags.hit = 0;
+ 	http->log_type = LOG_TCP_REFRESH_MISS;
+ 	if (HTTP_NOT_MODIFIED == mem->reply->sline.status) {
+ 	    httpReplyUpdateOnNotModified(http->old_entry->mem_obj->reply,
+@@ -1265,7 +1266,6 @@
+     HttpHeader *hdr = rep ? &rep->header : 0;
+     const char *range_err = NULL;
+     request_t *request = http->request;
+-    int is_hit = isTcpHit(http->log_type);
+     assert(request->range);
+     /* check if we still want to do ranges */
+     if (!rep)
+@@ -1286,7 +1286,7 @@
+ 	range_err = "too complex range header";
+     else if (!request->flags.cachable)	/* from we_do_ranges in http.c */
+ 	range_err = "non-cachable request";
+-    else if (!is_hit && httpHdrRangeOffsetLimit(http->request->range))
++    else if (!http->flags.hit && httpHdrRangeOffsetLimit(http->request->range))
+ 	range_err = "range outside range_offset_limit";
+     /* get rid of our range specs on error */
+     if (range_err) {
+@@ -1343,7 +1343,6 @@
+ clientBuildReplyHeader(clientHttpRequest * http, HttpReply * rep)
+ {
+     HttpHeader *hdr = &rep->header;
+-    int is_hit = isTcpHit(http->log_type);
+     request_t *request = http->request;
+ #if DONT_FILTER_THESE
+     /* but you might want to if you run Squid as an HTTP accelerator */
+@@ -1354,7 +1353,7 @@
+     /* here: Keep-Alive is a field-name, not a connection directive! */
+     httpHeaderDelByName(hdr, "Keep-Alive");
+     /* remove Set-Cookie if a hit */
+-    if (is_hit)
++    if (http->flags.hit)
+ 	httpHeaderDelById(hdr, HDR_SET_COOKIE);
+     /* handle Connection header */
+     if (httpHeaderHas(hdr, HDR_CONNECTION)) {
+@@ -1383,7 +1382,7 @@
+     /*
+      * Add a estimated Age header on cache hits.
+      */
+-    if (is_hit) {
++    if (http->flags.hit) {
+ 	/*
+ 	 * Remove any existing Age header sent by upstream caches
+ 	 * (note that the existing header is passed along unmodified
+@@ -1431,7 +1430,7 @@
+ 	authenticateFixHeader(rep, request->auth_user_request, request, http->flags.accel, 0);
+     /* Append X-Cache */
+     httpHeaderPutStrf(hdr, HDR_X_CACHE, "%s from %s",
+-	is_hit ? "HIT" : "MISS", getMyHostname());
++	http->flags.hit ? "HIT" : "MISS", getMyHostname());
+ #if USE_CACHE_DIGESTS
+     /* Append X-Cache-Lookup: -- temporary hack, to be removed @?@ @?@ */
+     httpHeaderPutStrf(hdr, HDR_X_CACHE_LOOKUP, "%s from %s:%d",
+@@ -1505,6 +1504,7 @@
+     MemObject *mem;
+     request_t *r = http->request;
+     debug(33, 3) ("clientCacheHit: %s, %d bytes\n", http->uri, (int) size);
++    http->flags.hit = 0;
+     if (http->entry == NULL) {
+ 	memFree(buf, MEM_CLIENT_SOCK_BUF);
+ 	debug(33, 3) ("clientCacheHit: request aborted\n");
+@@ -1592,6 +1592,7 @@
+ 	clientPurgeRequest(http);
+ 	return;
+     }
++    http->flags.hit = 1;
+     if (checkNegativeHit(e)) {
+ 	http->log_type = LOG_TCP_NEGATIVE_HIT;
+ 	clientSendMoreData(data, buf, size);
+@@ -2276,6 +2277,7 @@
+     char *url = http->uri;
+     request_t *r = http->request;
+     ErrorState *err = NULL;
++    http->flags.hit = 0;
+     debug(33, 4) ("clientProcessOnlyIfCachedMiss: '%s %s'\n",
+ 	RequestMethodStr[r->method], url);
+     http->al.http.code = HTTP_GATEWAY_TIMEOUT;
+diff -urNad squid-2.5.9/src/structs.h /tmp/dpep.5JNJLF/squid-2.5.9/src/structs.h
+--- squid-2.5.9/src/structs.h	2005-02-23 01:06:35.000000000 +0100
++++ /tmp/dpep.5JNJLF/squid-2.5.9/src/structs.h	2005-03-08 04:40:55.856730304 +0100
+@@ -1099,6 +1099,7 @@
+ 	unsigned int internal:1;
+ 	unsigned int done_copying:1;
+ 	unsigned int purging:1;
++	unsigned int hit:1;
+     } flags;
+     struct {
+ 	http_status status;
--- squid-2.5.9.orig/debian/copyright
+++ squid-2.5.9/debian/copyright
@@ -0,0 +1,30 @@
+
+SQUID Internet Object Cache  http://squid.nlanr.net/Squid/
+--------------------------------------------------------
+
+  Squid is the result of efforts by numerous individuals from the
+  Internet community.  Development is led by Duane Wessels of the
+  National Laboratory for Applied Network Research and funded by
+  the National Science Foundation.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+  
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+  
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software Foundation,
+  Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+  On Debian GNU/Linux systems, a copy of the GNU General Public License
+  can be found in /usr/share/common-licenses/GPL.
+
+Squid is derived from the ``cached'' software from the ARPA-funded
+Harvest research project.  The Harvest home page is
+http://harvest.cs.colorado.edu/.
+
--- squid-2.5.9.orig/debian/prerm.squid-cgi
+++ squid-2.5.9/debian/prerm.squid-cgi
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+	remove|upgrade)
+		[ -L /usr/doc/squid-cgi ] && rm -f /usr/doc/squid-cgi
+		;;
+	*)
+		;;
+esac
+
+exit 0
--- squid-2.5.9.orig/debian/getFAQ.sh
+++ squid-2.5.9/debian/getFAQ.sh
@@ -0,0 +1,9 @@
+#! /bin/sh
+#
+#	Get the latest FAQ from the www.squid-cache.org site using wget.
+#
+
+cd doc || exit 1
+rm -f FAQ*
+wget -r -l 1 -L http://www.squid-cache.org/Doc/FAQ/FAQ.html
+
--- squid-2.5.9.orig/debian/cachemgr.conf
+++ squid-2.5.9/debian/cachemgr.conf
@@ -0,0 +1,6 @@
+# cachemgr.conf - Configuration of the squid cachemgr.cgi
+#
+# Simply place pairs of hostnames and ports that the cachemgr
+# should be permitted to connect to in lines of their own.
+#
+localhost:3128
--- squid-2.5.9.orig/debian/conffiles.squid-cgi
+++ squid-2.5.9/debian/conffiles.squid-cgi
@@ -0,0 +1 @@
+/etc/squid/cachemgr.conf
--- squid-2.5.9.orig/debian/templates.orig
+++ squid-2.5.9/debian/templates.orig
@@ -0,0 +1,88 @@
+Template: squid/http_anonymizer
+Type: note
+_Description: The http_anonymizer directive has been replaced with header_access
+ The http_anonymizer directive that was present in squid 2.1 and 2.2
+ doesn't exist anymore in squid 2.3 and up. It has been replaced with
+ header_replace and header_access that provide more fine-grained control over
+ HTTP headers. Right now, your squid doesn't anonymize the HTTP
+ headers anymore so you probably want to fix this. The new format is
+ explained in the new 2.5 config file, of which you probably have a copy in
+ /usr/share/doc/squid/examples/squid.conf.
+
+Template: squid/anonymize_headers
+Type: note
+_Description: The anonymize_headers and fake_user_agent directives have been replaced with header_access and header_replace
+ The anonymize_headers and fake_user_agnet directives that were present in squid 2.3 and 2.4 don't exist anymore in squid 2.5 and up. They have been replaced 
+ with header_replace and header_access that provide more fine-grained control 
+ over HTTP headers. Right now, your squid doesn't anonymize the HTTP
+ headers anymore so you probably want to fix this. The new format is
+ explained in the new 2.5 config file, of which you probably have a copy in
+ /usr/share/doc/squid/examples/squid.conf.
+
+Template: squid/old_version
+Type: boolean
+Default: false
+_Description: There is no automatic upgrade path to squid 2.5
+              SQUID 2.5 INSTALLATION WARNING
+ .
+ You are upgrading squid from an 1.x version to the 2.5 version. The 1.x
+ and 2.5 versions are NOT compatible. The structure of the cache directory
+ is different and the configuration file "squid.conf" is not entirely
+ compatible.
+ .
+ If you have an old cache directory, please quit NOW and remove the old
+ cache by hand (in /var/spool/squid). Then re-install this squid version.
+ .
+ Also, please accept the new configuration file. After upgrading your old
+ configuration file can be found in "/etc/squid.conf.dpkg-old". Then you
+ have to edit the new configuration file by hand to match your old
+ configuration.
+ .
+ Do you want to quit now?
+
+Template: squid-cgi/cachemgr
+Type: note
+_Description: squid-cgi now uses config file for target ACL
+ squid-cgi now checks a configuration file before connecting to the target
+ host. Only allowed target will be contacted. Please add hosts you want to
+ access to the file /etc/squid/cachemgr.conf, one per line in the form
+ .
+   hostname:port
+
+Template: squid/fix_lines
+Type: boolean
+Default: true
+_Description: Upgrade squid.conf automatically?
+ Incompatible settings have been found in the existing squid.conf file;
+ they will prevent squid from starting or working correctly. However, this
+ setup can try to modify them to work again. Do you want to apply the
+ changes?
+
+Template: squid/authenticate_program
+Type: note
+_Description: The authenticate_program directive has been replaced with auth_param
+ The authenticate_program directive that was present in squid <= 2.4
+ doesn't exist anymore in squid 2.5 and up. All authentication directives
+ have been replaced with auth_param. Right now, your squid doesn't
+ authenticate users anymore so you probably want to fix this. The new
+ format is explained in the new 2.5 config file, of which you probably have
+ a copy in /usr/share/doc/squid/examples/squid.conf.
+
+Template: squid/largefiles_warning
+Type: note
+_Description: Warning: squid may crash when logfiles size is bigger than 2GB
+ Squid may crash if any of the logfiles grows bigger than 2GB. Please
+ configure /etc/logrotate.d/squid accordingly to your site's traffic.
+
+Template: squid/fix_cachedir_perms
+Type: boolean
+Default: false
+_Description: Fix permissions of cache_dir?
+ Values for cache_effective_user and/or cache_effective_group in config file 
+ are incompatible with owner/group of cache directories. Do you want to
+ automatically fix permissions on cache directory?
+ .
+ WARNING: If you specified a cache directory different from /var/spool/squid
+ and selected some other directory used by other programs (e.g. /tmp), this
+ could affect those programs.
+
--- squid-2.5.9.orig/debian/watch
+++ squid-2.5.9/debian/watch
@@ -0,0 +1,2 @@
+version=2
+http://www.squid-cache.org/Versions/v2/2.5/squid-(.?\..?\.STABLE.{1,2})\.tar\.gz 2.5.STABLE9 uupdate
