Log Message:
Update squid-2.5.5 (squid 2.5.STABLE5 with two official patches).

Most of these changes from 2.5.STABLE4 to 2.5STABLE5 are already applied
in previous squid-2.5.4nb8 package.

Changes to squid-2.5.STABLE5 (1 Mar 2004):

	- cache.log message on "squid -k reconfigure" was slightly confusing,
	  claiming Squid restarted when it just reread the configuration.
	- Bug #787: digest auth never detects password changes
	- Bug #789: login with space confuses redirector helpers
	- Bug #791: FQDNcache discards negative responses when using
	  internal DNS
	- pam_auth fails on Solaris when using pam_authtok_get. Persistent
	  PAM connections are unsafe and now disabled by default.
	- auth_param documentation clarifications and added default realm
	  values making only the helper program a required attribute
	- Bug #795: German ERR_DNS_FAIL correction
	- Bug #803: Lithuantian error messages update
	- Bug #806: Segfault if failing to load error page
	- Bug #812: Mozilla/Netscape plugins mime type defined (.xpi)
	- Bug #817: maximum_object_size too large causes squid not to cache
	- Bug #824: 100% CPU loop if external_acl combined with separate
          authentication acl in the same http_access line
	- squid_ldap_group updated to version 2.12 with support for ldaps://
	  (LDAPv2 over SSL) and a numer of other improvements.
	- Bug #799: positive_dns_ttl ignored when using internal DNS.
	- Bug #690: Incorrect html on empty Gopher responses
	- Bug #729: --enable-arp-acl may give warning about net/route.h
	- Bug #14: attempts to establish connection may look like syn flood
	  attack if the contacted server is refusing connections
	- errorpage README files included in the distribution again showing
	  who contributed which translation
	- Bug #848: connect_timeout connect_timeout ends up twice the length.
	  forward_timeout option added to address this.
	- Bug #849: DNS log error messages should report the failed query
	- Bug #851: DNS retransmits too often
	- Bug #862: Very frequently repeated POST requests may cause a
	  filedescriptor shortage due to persitent connections building up
	- Bug #853: Sporatic segmentation faults on aborted FTP PUT requests
	- Bug #571: Need to limit use of persistent connections when
	  filedescriptor usage is high
	- Bug #856: FTP/Gopher Icon URLs are unneededly complex and often
	  does not work properly
	- Bug #860: redirector_access does not handle "slow" acls such as
	  "dst" or "external" requiring a external lookup.
	- Bug #865: Persistent connection usage too high after sudden burst
	  of traffic.
	- Bug #867: cache_peer max-conn=.. option does not work
	- Bug #868: refuses to start if pid_filename none is specified
	- Bug #887: LDAP helper -Z (TLS) option does not work
	- Bug #877: Squid doesn't follow telnet protocol on FTP control
	  connections
	- Bug #908: Random auth popups and account lockouts when using ntlm
	- Support for NTLM_NEGOTIATE exchanges with ntlm helpers
	- Bug #585: cache_peer_access fails with NTLM authentication
	- Bug #592: always/never_direct fails with NTLM authentication
	- wbinfo_group update for Samba-3
	- Bug #892: helpers/ntlm_auth/SMB/ fails to compile on FreeBSD 5.0
	- Bug #924: miss_access restricts internal and cachemgr requests
	  even if these are local
	- Bug #925: auth headers send by squidclient are mildly malformed
	- Bug #922: miss_access and delay_access and several other
	  authentication related bug fixes.
	- Bug #909: Added ARP acl support for FreeBSD
	- Bug #926: deny_info with http_reply_access or miss_access
	- Bug #872: reply_body_max_size problems when using NTLM auth
	- Bug #825: random segmentation faults when using digest auth
	- Bug #910: Partial fix for temporary memory leaks when using NTLM
	  auth. There is still problems if challenge reuse is enabled.
	- ftp://anonymous@host/ now accepted without requiring a password
	- Bug #594: several mime type updates (ftp:// related)
	- url_regex enhanced to allow matching of %00

And two official patches' changes.

assertion failed: helper.c:323: "srv->flags.reserved"

	synopsis	If using ntlm authentication then Squid may
			randomly abort with the above assertion
			failure if a request is aborted while Squid
			waits for a response from the domain controller
	severity	Medium
	date		2004-03-01 23:55
	bugzilla	#937
	versions	Squid-2.5.STABLE5
	platforms	All
	workaround	half_closed_connections on (the default)

squid_ldap_auth can be confused by the use of reserved characters

	synopsis	squid_ldap_auth may be confused by the use of
			reserved characters allowing the login name to
			be masqueraded in different manners possibly
			allowing the user to partially bypass certain
			per-user restrictions or confuse third party
			accounting packages.

			Note that the user can not bypass the login
			procedure as such. All he can do is to make
			the login name look different than normal.
			There is still full audit trails on who the
			user is etc.

			The patch also adds and documents a -d flag to
			both squid_ldap_auth and squid_ldap_group to
			allow for easier tracing of the operation of
			these programs if results is not what is
			expected.

	severity	Major
	date		2004-03-04 09:37
	bugzilla	#935
	versions	Squid-2.5 and earlier
	platforms	All
	configuration	configurations where squid_ldap_auth is used
			for authentication using a search filter (-f
			option) and where squid_ldap_group is not used
			to further restrict the valid usernames.
	workaround	Combine squid_ldap_auth with squid_ldap_group
			to only allow valid logins who are member of a
			certain group, or alternatively use a
			proxy_auth_regex acl to deny the use of any
			login using restricted characters.

				acl bad_login proxy_auth_regex [()\\*]
				http_access deny bad_login