diff -ruN squid-2.7.STABLE3/ChangeLog squid-2.7.STABLE4/ChangeLog
--- squid-2.7.STABLE3/ChangeLog	2008-06-25 01:17:19.000000000 +0200
+++ squid-2.7.STABLE4/ChangeLog	2008-08-08 21:17:40.000000000 +0200
@@ -1,3 +1,57 @@
+Changes to squid-2.7.SATBLE4 (8 August 2008)
+
+	- Bug #2387: The calculation of the number of hash buckets need to
+	  account for the memory size, not only disk size
+	- Bug #2393: DNS requests retried indefinitely at full speed on failed
+	  TCP connection
+	- Bug #2393: DNS retransmit queue could get hold up
+	- Correct socket syscalls statistics in commResetFD()
+	- Plug a small "squid -k reconfigure" race in the new round-robin
+	  counter management
+	- Windows port: fix typo in handling of notification of IP
+	  address changes
+	- Document the "zph_mode option" setting, got left out when merging
+	  the zph patches
+	- Bug #2396: Correct the opening of the PF device file.
+	- Make --with-large-files and --with-build-envirnment=default play
+	  nice together
+	- Bug #2407: Spelling error in http_port tcpkeepalive option
+	- Bug #2408: assertion failed: forward.c:529: "fs"
+	- Bug #2414: assertion failed: forward.c:110: "!EBIT_TEST(e->flags,
+	  ENTRY_FWD_HDR_WAIT)"
+	- Workaround for Linux-2.6.24 & 2.6.25 netfiler_ipv4.h include header
+	  __u32 problem
+	- Make dns_nameserver work when using --disable-internal-dns on glibc
+	  based systems
+	- Make clientCacheHit bail out gracefuly if hitting an aborted object
+	- Bug #2406: access.log logs rewritten URL and strip_query_terms
+	  ineffective
+	- More changes to deal properly with aborted requests
+
+Changes to squid-2.6.STABLE21 (27 June 2008)
+
+	- Bug #2350: Bugs in Linux kernel capabilities code
+	- Bug #2241: weights not applied properly in round-robin peer
+	  selection
+	- Off by one error in DNS label decompression could cause valid DNS
+	  messages to be rejected
+	- logformat docs contain extra whitespace
+	- Reject ridiculously large ASN.1 lengths
+	- Fix SNMP reporting of counters with a value > 0xFF80000
+	- Correct spelling of WCCPv2 dst_port_hash to match the source
+	- Plug some "squid -k reconfigure" memory leaks. Mostly SSL related.
+	- Bug #1993: Memory leak in http_reply_access deny processing
+	- Bug #2122: In some situations collapsed_forwarding could leak
+	  private information
+	- Bug #2376: Round-Robin becomes unbalanced when a peer dies and comes
+	  back
+	- Bug #2387: The calculation of the number of hash buckets need to
+	  account for the memory size, not only disk size
+	- Bug #2393: DNS requests retried indefinitely at full speed on failed
+	  TCP connection
+	- Bug #2393: DNS retransmit queue could get hold up
+	- Correct socket syscalls statistics in commResetFD()
+
 Changes to squid-2.7.STABLE3 (25 June 2008)
 
 	- Byg #2376: Round-Robin peer selection becomes unbalanced when a
diff -ruN squid-2.7.STABLE3/configure squid-2.7.STABLE4/configure
--- squid-2.7.STABLE3/configure	2008-06-26 00:18:55.000000000 +0200
+++ squid-2.7.STABLE4/configure	2008-08-08 21:21:03.000000000 +0200
@@ -1,7 +1,7 @@
 #! /bin/sh
-# From configure.in Revision: 1.430.2.11 .
+# From configure.in Revision: 1.430.2.14 .
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for Squid Web Proxy 2.7.STABLE3.
+# Generated by GNU Autoconf 2.61 for Squid Web Proxy 2.7.STABLE4.
 #
 # Report bugs to <http://www.squid-cache.org/bugs/>.
 #
@@ -575,8 +575,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='2.7.STABLE3'
-PACKAGE_STRING='Squid Web Proxy 2.7.STABLE3'
+PACKAGE_VERSION='2.7.STABLE4'
+PACKAGE_STRING='Squid Web Proxy 2.7.STABLE4'
 PACKAGE_BUGREPORT='http://www.squid-cache.org/bugs/'
 
 ac_default_prefix=/usr/local/squid
@@ -1312,7 +1312,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 2.7.STABLE3 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 2.7.STABLE4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1382,7 +1382,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 2.7.STABLE3:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 2.7.STABLE4:";;
    esac
   cat <<\_ACEOF
 
@@ -1663,7 +1663,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 2.7.STABLE3
+Squid Web Proxy configure 2.7.STABLE4
 generated by GNU Autoconf 2.61
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1677,7 +1677,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 2.7.STABLE3, which was
+It was created by Squid Web Proxy $as_me 2.7.STABLE4, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   $ $0 $@
@@ -2350,7 +2350,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='2.7.STABLE3'
+ VERSION='2.7.STABLE4'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -5228,10 +5228,16 @@
 	if test -z "$buildmodel"; then
 		echo "WARNING: No suitable build environment found for large files. Trying to use _FILE_OFFSET_BITS=64"
 		sleep 1
-		CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
 	fi
 fi
-if test -n "$buildmodel" && test "$buildmodel" != "default"; then
+case "$buildmodel" in
+"default"|"")
+	if test $needlargefiles; then
+		echo "Enabling -D_FILE_OFFSET_BITS=64 for large file support"
+		CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
+	fi
+	;;
+*)
 	echo "Using $buildmodel build environment"
 	if test "`getconf _$buildmodel 2>/dev/null || true`" = 1 || test "`getconf $buildmodel 2>/dev/null || true`" ; then
 	    : # All fine
@@ -5265,7 +5271,8 @@
 	    *)
 		;;
 	esac
-fi
+	;;
+esac
 
 # Check whether --enable-linux-tproxy was given.
 if test "${enable_linux_tproxy+set}" = set; then
@@ -24909,6 +24916,7 @@
 
 
 
+
 for ac_func in \
 	bcopy \
 	backtrace_symbols_fd \
@@ -24944,6 +24952,7 @@
 	regexec \
 	regfree \
 	res_init \
+	__res_init \
 	rint \
 	sbrk \
 	select \
@@ -27789,7 +27798,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 2.7.STABLE3, which was
+This file was extended by Squid Web Proxy $as_me 2.7.STABLE4, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -27842,7 +27851,7 @@
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-Squid Web Proxy config.status 2.7.STABLE3
+Squid Web Proxy config.status 2.7.STABLE4
 configured by $0, generated by GNU Autoconf 2.61,
   with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 
diff -ruN squid-2.7.STABLE3/configure.in squid-2.7.STABLE4/configure.in
--- squid-2.7.STABLE3/configure.in	2008-06-26 00:18:55.000000000 +0200
+++ squid-2.7.STABLE4/configure.in	2008-08-08 21:21:03.000000000 +0200
@@ -1,16 +1,16 @@
 dnl
 dnl  Configuration input file for Squid
 dnl
-dnl  $Id: configure.in,v 1.430.2.11 2008/06/24 23:17:19 hno Exp $
+dnl  $Id: configure.in,v 1.430.2.14 2008/08/03 22:27:01 hno Exp $
 dnl
 dnl
 dnl
-AC_INIT(Squid Web Proxy, 2.7.STABLE3, http://www.squid-cache.org/bugs/, squid)
+AC_INIT(Squid Web Proxy, 2.7.STABLE4, http://www.squid-cache.org/bugs/, squid)
 AC_PREREQ(2.52)
 AM_CONFIG_HEADER(include/autoconf.h)
 AC_CONFIG_AUX_DIR(cfgaux)
 AM_INIT_AUTOMAKE
-AC_REVISION($Revision: 1.430.2.11 $)dnl
+AC_REVISION($Revision: 1.430.2.14 $)dnl
 AC_PREFIX_DEFAULT(/usr/local/squid)
 AM_MAINTAINER_MODE
 
@@ -1077,10 +1077,16 @@
 	if test -z "$buildmodel"; then
 		echo "WARNING: No suitable build environment found for large files. Trying to use _FILE_OFFSET_BITS=64"
 		sleep 1
-		CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
 	fi
 fi
-if test -n "$buildmodel" && test "$buildmodel" != "default"; then
+case "$buildmodel" in
+"default"|"")
+	if test $needlargefiles; then
+		echo "Enabling -D_FILE_OFFSET_BITS=64 for large file support"
+		CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
+	fi
+	;;
+*)
 	echo "Using $buildmodel build environment"
 	if test "`getconf _$buildmodel 2>/dev/null || true`" = 1 || test "`getconf $buildmodel 2>/dev/null || true`" ; then
 	    : # All fine
@@ -1127,7 +1133,8 @@
 	    *)
 		;;
 	esac
-fi
+	;;
+esac
 
 dnl Enable Linux transparent proxy support
 AC_ARG_ENABLE(linux-tproxy,
@@ -2391,6 +2398,7 @@
 	regexec \
 	regfree \
 	res_init \
+	__res_init \
 	rint \
 	sbrk \
 	select \
diff -ruN squid-2.7.STABLE3/helpers/external_acl/ldap_group/squid_ldap_group.c squid-2.7.STABLE4/helpers/external_acl/ldap_group/squid_ldap_group.c
--- squid-2.7.STABLE3/helpers/external_acl/ldap_group/squid_ldap_group.c	2008-03-18 03:49:58.000000000 +0100
+++ squid-2.7.STABLE4/helpers/external_acl/ldap_group/squid_ldap_group.c	2008-08-04 00:11:37.000000000 +0200
@@ -404,7 +404,7 @@
 	fprintf(stderr, "\n" PROGRAM_NAME " version " PROGRAM_VERSION "\n\n");
 	fprintf(stderr, "Usage: " PROGRAM_NAME " -b basedn -f filter [options] ldap_server_name\n\n");
 	fprintf(stderr, "\t-b basedn (REQUIRED)\tbase dn under where to search for groups\n");
-	fprintf(stderr, "\t-f filter (REQUIRED)\tgroup search filter pattern. %%v = user,\n\t\t\t\t%%a = group\n");
+	fprintf(stderr, "\t-f filter (REQUIRED)\tgroup search filter pattern. %%u = user,\n\t\t\t\t%%g = group\n");
 	fprintf(stderr, "\t-B basedn (REQUIRED)\tbase dn under where to search for users\n");
 	fprintf(stderr, "\t-F filter (REQUIRED)\tuser search filter pattern. %%s = login\n");
 	fprintf(stderr, "\t-s base|one|sub\t\tsearch scope\n");
diff -ruN squid-2.7.STABLE3/include/autoconf.h.in squid-2.7.STABLE4/include/autoconf.h.in
--- squid-2.7.STABLE3/include/autoconf.h.in	2008-06-05 02:18:07.000000000 +0200
+++ squid-2.7.STABLE4/include/autoconf.h.in	2008-07-19 02:18:58.000000000 +0200
@@ -624,6 +624,9 @@
 /* Define to 1 if you have the <winsock.h> header file. */
 #undef HAVE_WINSOCK_H
 
+/* Define to 1 if you have the `__res_init' function. */
+#undef HAVE___RES_INIT
+
 /* Some systems support __va_copy */
 #undef HAVE___VA_COPY
 
diff -ruN squid-2.7.STABLE3/include/version.h squid-2.7.STABLE4/include/version.h
--- squid-2.7.STABLE3/include/version.h	2008-06-26 00:18:55.000000000 +0200
+++ squid-2.7.STABLE4/include/version.h	2008-08-08 21:21:03.000000000 +0200
@@ -9,5 +9,5 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1214432332
+#define SQUID_RELEASE_TIME 1218223259
 #endif
diff -ruN squid-2.7.STABLE3/RELEASENOTES.html squid-2.7.STABLE4/RELEASENOTES.html
--- squid-2.7.STABLE3/RELEASENOTES.html	2008-06-26 00:19:27.000000000 +0200
+++ squid-2.7.STABLE4/RELEASENOTES.html	2008-08-08 21:21:35.000000000 +0200
@@ -2,12 +2,12 @@
 <HTML>
 <HEAD>
  <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.21">
- <TITLE>Squid 2.7.STABLE3 release notes</TITLE>
+ <TITLE>Squid 2.7.STABLE4 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 2.7.STABLE3 release notes</H1>
+<H1>Squid 2.7.STABLE4 release notes</H1>
 
-<H2>Squid Developers</H2>$Id: release.html,v 1.1.2.7 2008/06/24 23:17:59 hno Exp $
+<H2>Squid Developers</H2>$Id: release.html,v 1.1.2.9 2008/08/08 19:19:32 hno Exp $
 <HR>
 <EM>This document contains the release notes for version 2.7 of Squid.
 Squid is a WWW Cache application developed by the Web Caching community.</EM>
@@ -47,6 +47,9 @@
 <P>
 <H2><A NAME="toc6">6.</A> <A HREF="#s6">Key changes in squid-2.7.STABLE3</A></H2>
 
+<P>
+<H2><A NAME="toc7">7.</A> <A HREF="#s7">Key changes in squid-2.7.STABLE4</A></H2>
+
 
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Key changes from squid 2.6</A></H2>
@@ -432,5 +435,19 @@
 </UL>
 </P>
 
+<H2><A NAME="s7">7.</A> <A HREF="#toc7">Key changes in squid-2.7.STABLE4</A></H2>
+
+<P>
+<UL>
+<LI>Bug <a href="http://www.squid-cache.org/bugs/show_bug.cgi?id=2393">#2393</a>: DNS retransmit queue could get hold up</LI>
+<LI>Bug <a href="http://www.squid-cache.org/bugs/show_bug.cgi?id=2408">#2408</a>: assertion failed: forward.c:529: "fs"</LI>
+<LI>Bug <a href="http://www.squid-cache.org/bugs/show_bug.cgi?id=2414">#2414</a>: assertion failed: forward.c:110: "!EBIT_TEST(e->flags, ENTRY_FWD_HDR_WAIT)"</LI>
+<LI>Workaround for Linux-2.6.24 &amp; 2.6.25 netfiler_ipv4.h include header __u32 problem</LI>
+<LI>Make dns_nameserver work when using --disable-internal-dns on glibc based systems</LI>
+<LI>Handle aborted objects properly. The change in 2.7.STABLE3 triggered a number of issues.</LI>
+<LI>Bug <a href="http://www.squid-cache.org/bugs/show_bug.cgi?id=2406">#2406</a>: access.log logs rewritten URL and strip_query_terms ineffective</LI>
+</UL>
+</P>
+
 </BODY>
 </HTML>
diff -ruN squid-2.7.STABLE3/src/cache_cf.c squid-2.7.STABLE4/src/cache_cf.c
--- squid-2.7.STABLE3/src/cache_cf.c	2008-06-25 01:14:18.000000000 +0200
+++ squid-2.7.STABLE4/src/cache_cf.c	2008-06-27 23:52:56.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: cache_cf.c,v 1.480.2.11 2008/06/24 23:14:18 hno Exp $
+ * $Id: cache_cf.c,v 1.480.2.12 2008/06/27 21:52:56 hno Exp $
  *
  * DEBUG: section 3     Configuration File Parsing
  * AUTHOR: Harvest Derived
@@ -1716,7 +1716,6 @@
 parse_peer(peer ** head)
 {
     char *token = NULL;
-    void *arg = NULL;		/* throwaway arg to make eventAdd happy */
     peer *p;
     p = cbdataAlloc(peer);
     p->http_port = CACHE_HTTP_PORT;
@@ -1916,9 +1915,7 @@
 	head = &(*head)->next;
     *head = p;
     Config.npeers++;
-    if (!reconfiguring && Config.npeers == 1) {
-	peerClearRRLoop(arg);
-    }
+    peerClearRRStart();
 }
 
 static void
diff -ruN squid-2.7.STABLE3/src/cf.data.pre squid-2.7.STABLE4/src/cf.data.pre
--- squid-2.7.STABLE3/src/cf.data.pre	2008-06-25 00:54:18.000000000 +0200
+++ squid-2.7.STABLE4/src/cf.data.pre	2008-07-10 11:47:28.000000000 +0200
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.450.2.24 2008/06/24 22:54:18 hno Exp $
+# $Id: cf.data.pre,v 1.450.2.26 2008/07/10 09:47:28 hno Exp $
 #
 # SQUID Web Proxy Cache          http://www.squid-cache.org/
 # ----------------------------------------------------------
@@ -1209,7 +1209,7 @@
 	   name=	Specifies a internal name for the port. Defaults to
 			the port specification (port or addr:port)
 
-	   keepalive[=idle,interval,timeout]
+	   tcpkeepalive[=idle,interval,timeout]
 			Enable TCP keepalive probes of idle connections
 			idle is the initial time before TCP starts probing
 			the connection, interval how often to probe, and
@@ -1389,9 +1389,11 @@
 	This option enables packet level marking of HIT/MISS responses,
 	either using IP TOS or socket priority.
 	    off		Feature disabled
-	    tos		Set the IP TOS field
+	    tos		Set the IP TOS/Diffserv field
 	    priority	Set the socket priority (may get mapped to TOS by OS,
 			otherwise only usable in local rulesets)
+	    option	Embed the mark in an IP option field. See also
+	    		zph_option.
 
 	See also tcp_outgoing_tos for details/requirements about TOS usage.
 DOC_END
diff -ruN squid-2.7.STABLE3/src/client_side.c squid-2.7.STABLE4/src/client_side.c
--- squid-2.7.STABLE3/src/client_side.c	2008-06-25 00:54:47.000000000 +0200
+++ squid-2.7.STABLE4/src/client_side.c	2008-07-21 22:43:27.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: client_side.c,v 1.754.2.16 2008/06/24 22:54:47 hno Exp $
+ * $Id: client_side.c,v 1.754.2.21 2008/07/21 20:43:27 hno Exp $
  *
  * DEBUG: section 33    Client-side Routines
  * AUTHOR: Duane Wessels
@@ -92,6 +92,7 @@
 #endif
 
 #if LINUX_NETFILTER
+#include <linux/types.h>
 #include <linux/netfilter_ipv4.h>
 #endif
 
@@ -949,7 +950,10 @@
 	clientProcessMiss(http);
 	return;
     }
-    assert(!EBIT_TEST(entry->flags, ENTRY_ABORTED));
+    if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
+	/* Old object got aborted, not good */
+	clientProcessMiss(http);
+    }
     if (recopy) {
 	storeClientCopyHeaders(http->sc, entry,
 	    clientSendHeaders,
@@ -1185,7 +1189,9 @@
 	mem = http->entry->mem_obj;
     if (http->out.size || http->log_type) {
 	http->al.icp.opcode = ICP_INVALID;
-	http->al.url = http->uri;
+	http->al.url = http->log_uri;
+	if (!http->al.url)
+	    http->al.url = urlCanonicalClean(request);
 	debug(33, 9) ("httpRequestFree: al.url='%s'\n", http->al.url);
 	http->al.cache.out_ip = request->out_ip;
 	if (http->reply && http->log_type != LOG_TCP_DENIED) {
@@ -1245,6 +1251,7 @@
     if (request)
 	checkFailureRatio(request->err_type, http->al.hier.code);
     safe_free(http->uri);
+    safe_free(http->log_uri);
     safe_free(http->al.headers.request);
     safe_free(http->al.headers.reply);
     safe_free(http->al.cache.authuser);
@@ -2225,10 +2232,15 @@
 	http->log_type = LOG_TCP_SWAPFAIL_MISS;
 	clientProcessMiss(http);
 	return;
+    } else if (EBIT_TEST(e->flags, ENTRY_ABORTED)) {
+	/* aborted object */
+	debug(33, 3) ("clientCacheHit: hit an aborted object %s\n", http->uri);
+	http->log_type = LOG_TCP_SWAPFAIL_MISS;
+	clientProcessMiss(http);
+	return;
     }
     mem = e->mem_obj;
     debug(33, 3) ("clientCacheHit: %s = %d\n", http->uri, rep->sline.status);
-    assert(!EBIT_TEST(e->flags, ENTRY_ABORTED));
 
     /*
      * This particular logic is a bit hairy.
@@ -3073,11 +3085,6 @@
 	debug(33, 1) ("clientSendMoreData: Deferring %s\n", storeUrl(entry));
 	memFree(buf, MEM_STORE_CLIENT_BUF);
 	return;
-    } else if (entry && EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
-	/* call clientWriteComplete so the client socket gets closed */
-	clientWriteComplete(fd, NULL, 0, COMM_OK, http);
-	memFree(buf, MEM_STORE_CLIENT_BUF);
-	return;
     } else if (size < 0) {
 	/* call clientWriteComplete so the client socket gets closed */
 	clientWriteComplete(fd, NULL, 0, COMM_OK, http);
@@ -3225,7 +3232,7 @@
 	debug(33, 1) ("WARNING: closing FD %d to prevent counter overflow\n", fd);
 	debug(33, 1) ("\tclient %s\n", inet_ntoa(http->conn->peer.sin_addr));
 	debug(33, 1) ("\treceived %d bytes\n", (int) http->out.size);
-	debug(33, 1) ("\tURI %s\n", http->log_uri);
+	debug(33, 1) ("\tURI %s\n", http->uri);
 	comm_close(fd);
     } else
 #endif
@@ -3235,7 +3242,7 @@
 	debug(33, 1) ("\tclient %s\n", inet_ntoa(http->conn->peer.sin_addr));
 	debug(33, 1) ("\treceived %d bytes (offset %d)\n", (int) http->out.size,
 	    (int) http->out.offset);
-	debug(33, 1) ("\tURI %s\n", http->log_uri);
+	debug(33, 1) ("\tURI %s\n", http->uri);
 	comm_close(fd);
     } else
 #endif
@@ -3246,17 +3253,21 @@
 	comm_close(fd);
     } else if (NULL == entry) {
 	comm_close(fd);		/* yuk */
-    } else if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
-	comm_close(fd);
     } else if ((done = clientCheckTransferDone(http)) != 0 || size == 0) {
 	debug(33, 5) ("clientWriteComplete: FD %d transfer is DONE\n", fd);
 	/* We're finished case */
 	if (!done) {
 	    debug(33, 5) ("clientWriteComplete: closing, !done\n");
 	    comm_close(fd);
+	} else if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
+	    debug(33, 2) ("clientWriteComplete: Object aborted\n");
+	    comm_close(fd);
 	} else if (clientGotNotEnough(http)) {
 	    debug(33, 5) ("clientWriteComplete: client didn't get all it expected\n");
 	    comm_close(fd);
+	} else if (EBIT_TEST(http->entry->flags, ENTRY_ABORTED)) {
+	    debug(33, 5) ("clientWriteComplete: aborted object\n");
+	    comm_close(fd);
 	} else if (http->request->flags.chunked_response) {
 	    /* Finish chunked transfer encoding */
 	    http->request->flags.chunked_response = 0;	/* no longer chunking */
@@ -3282,8 +3293,6 @@
     } else {
 	/* More data will be coming from primary server; register with 
 	 * storage manager. */
-	if (EBIT_TEST(entry->flags, ENTRY_ABORTED))
-	    debug(33, 0) ("clientWriteComplete 2: ENTRY_ABORTED\n");
 	storeClientCopy(http->sc, entry,
 	    http->out.offset,
 	    http->out.offset,
@@ -4519,7 +4528,7 @@
     static int pffd = -1;
     static time_t last_reported = 0;
     if (pffd < 0) {
-	pffd = open("/dev/pf", O_RDWR);
+	pffd = open("/dev/pf", O_RDONLY);
 	if (pffd >= 0)
 	    commSetCloseOnExec(pffd);
     }
diff -ruN squid-2.7.STABLE3/src/client_side_rewrite.c squid-2.7.STABLE4/src/client_side_rewrite.c
--- squid-2.7.STABLE3/src/client_side_rewrite.c	2008-01-05 08:33:18.000000000 +0100
+++ squid-2.7.STABLE4/src/client_side_rewrite.c	2008-07-21 22:18:50.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: client_side_rewrite.c,v 1.2.2.1 2008/01/05 07:33:18 adrian Exp $
+ * $Id: client_side_rewrite.c,v 1.2.2.2 2008/07/21 20:18:50 hno Exp $
  *
  * DEBUG: section 33    Client-side Routines - URL Rewriter
  * AUTHOR: Duane Wessels; Adrian Chadd
@@ -108,6 +108,7 @@
     if (new_request) {
 	safe_free(http->uri);
 	http->uri = xstrdup(urlCanonical(new_request));
+	http->log_uri = xstrdup(urlCanonicalClean(old_request));
 	new_request->http_ver = old_request->http_ver;
 	httpHeaderAppend(&new_request->header, &old_request->header);
 	new_request->client_addr = old_request->client_addr;
diff -ruN squid-2.7.STABLE3/src/comm.c squid-2.7.STABLE4/src/comm.c
--- squid-2.7.STABLE3/src/comm.c	2008-05-05 01:23:13.000000000 +0200
+++ squid-2.7.STABLE4/src/comm.c	2008-06-27 22:56:56.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: comm.c,v 1.366.2.4 2008/05/04 23:23:13 hno Exp $
+ * $Id: comm.c,v 1.366.2.5 2008/06/27 20:56:56 hno Exp $
  *
  * DEBUG: section 5     Socket Functions
  * AUTHOR: Harvest Derived
@@ -388,7 +388,6 @@
 	return 0;
     statCounter.syscalls.sock.sockets++;
     fd2 = socket(AF_INET, SOCK_STREAM, 0);
-    statCounter.syscalls.sock.sockets++;
     if (fd2 < 0) {
 	debug(5, 0) ("commResetFD: socket: %s\n", xstrerror());
 	if (ENFILE == errno || EMFILE == errno)
diff -ruN squid-2.7.STABLE3/src/dns_internal.c squid-2.7.STABLE4/src/dns_internal.c
--- squid-2.7.STABLE3/src/dns_internal.c	2008-05-05 01:26:36.000000000 +0200
+++ squid-2.7.STABLE4/src/dns_internal.c	2008-06-27 22:56:26.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: dns_internal.c,v 1.63.2.5 2008/05/04 23:26:36 hno Exp $
+ * $Id: dns_internal.c,v 1.63.2.7 2008/06/27 20:56:26 hno Exp $
  *
  * DEBUG: section 78    DNS lookups; interacts with lib/rfc1035.c
  * AUTHOR: Duane Wessels
@@ -98,6 +98,7 @@
     int nsends;
     struct timeval start_t;
     struct timeval sent_t;
+    struct timeval queue_t;
     dlink_node lru;
     IDNSCB *callback;
     void *callback_data;
@@ -605,7 +606,7 @@
 	q->buf,
 	q->sz);
     q->nsends++;
-    q->sent_t = current_time;
+    q->queue_t = q->sent_t = current_time;
     if (x < 0) {
 	debug(50, 1) ("idnsSendQuery: FD %d: sendto: %s\n",
 	    DnsSocket, xstrerror());
@@ -704,9 +705,8 @@
 	return;
     }
     if (n <= 0) {
-	debug(78, 2) ("idnsReadTcp: Short response for %s.\n", q->name);
-	dlinkDelete(&q->lru, &lru_list);
-	idnsSendQuery(q);
+	debug(78, 1) ("idnsReadTcp: Short response from nameserver %d for %s.\n", ns + 1, q->name);
+	idnsTcpCleanup(q);
 	return;
     }
     fd_bytes(fd, n, FD_READ);
@@ -733,8 +733,7 @@
     if (errflag == COMM_ERR_CLOSING)
 	return;
     if (errflag) {
-	dlinkDelete(&q->lru, &lru_list);
-	idnsSendQuery(q);
+	idnsTcpCleanup(q);
 	return;
     }
     commSetSelect(q->tcp_socket, COMM_SELECT_READ, idnsReadTcp, q, 0);
@@ -747,8 +746,9 @@
     idns_query *q = data;
     short nsz;
     if (status != COMM_OK) {
-	dlinkDelete(&q->lru, &lru_list);
-	idnsSendQuery(q);
+	int ns = (q->nsends - 1) % nns;
+	debug(78, 1) ("idnsSendTcpQuery: Failed to connect to DNS server %d using TCP\n", ns + 1);
+	idnsTcpCleanup(q);
 	return;
     }
     memBufInit(&buf, q->sz + 2, q->sz + 2);
@@ -774,6 +774,7 @@
 	0,
 	COMM_NONBLOCKING,
 	"DNS TCP Socket");
+    q->queue_t = q->sent_t = current_time;
     dlinkAdd(q, &q->lru, &lru_list);
     commConnectStart(q->tcp_socket,
 	inet_ntoa(nameservers[ns].S.sin_addr),
@@ -837,7 +838,6 @@
 	    return;
 	}
 	if (q->rcode == 3 && q->do_searchpath && q->attempt < MAX_ATTEMPT) {
-	    assert(NULL == message->answer);
 	    strcpy(q->name, q->orig);
 	    if (q->domain < npc) {
 		strcat(q->name, ".");
@@ -934,16 +934,24 @@
     dlink_node *p = NULL;
     idns_query *q;
     event_queued = 0;
+    if (0 == nns)
+	/* name servers went away; reconfiguring or shutting down */
+	return;
     for (n = lru_list.tail; n; n = p) {
-	if (0 == nns)
-	    /* name servers went away; reconfiguring or shutting down */
-	    break;
+	p = n->prev;
 	q = n->data;
-	if (tvSubDsec(q->sent_t, current_time) < Config.Timeout.idns_retransmit * 1 << ((q->nsends - 1) / nns))
+	/* Anything to process in the queue? */
+	if (tvSubDsec(q->queue_t, current_time) < Config.Timeout.idns_retransmit)
 	    break;
+	/* Query timer expired? */
+	if (tvSubDsec(q->sent_t, current_time) < Config.Timeout.idns_retransmit * 1 << ((q->nsends - 1) / nns)) {
+	    dlinkDelete(&q->lru, &lru_list);
+	    q->queue_t = current_time;
+	    dlinkAdd(q, &q->lru, &lru_list);
+	    continue;
+	}
 	debug(78, 3) ("idnsCheckQueue: ID %#04x timeout\n",
 	    q->id);
-	p = n->prev;
 	dlinkDelete(&q->lru, &lru_list);
 	if (tvSubDsec(q->start_t, current_time) < Config.Timeout.idns_query) {
 	    idnsSendQuery(q);
diff -ruN squid-2.7.STABLE3/src/dnsserver.c squid-2.7.STABLE4/src/dnsserver.c
--- squid-2.7.STABLE3/src/dnsserver.c	2008-06-04 22:32:48.000000000 +0200
+++ squid-2.7.STABLE4/src/dnsserver.c	2008-07-18 02:48:23.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: dnsserver.c,v 1.62.6.1 2008/06/04 20:32:48 hno Exp $
+ * $Id: dnsserver.c,v 1.62.6.2 2008/07/18 00:48:23 hno Exp $
  *
  * DEBUG: section 0     DNS Resolver
  * AUTHOR: Harvest Derived
@@ -142,7 +142,7 @@
 #include "util.h"
 #include "snprintf.h"
 
-#if !defined(_SQUID_AIX_) && !defined(_SQUID_MSWIN_)
+#if !defined(_SQUID_AIX_) && !defined(_SQUID_MSWIN_) && !defined(h_errno)
 extern int h_errno;
 #endif
 
@@ -150,6 +150,16 @@
 extern int _dns_ttl_;		/* this is a really *dirty* hack - bne */
 #endif
 
+/*
+ * res_init() is a macro re-definition of __res_init on: Debian
+ */
+#if !defined(HAVE_RES_INIT) && defined(HAVE___RES_INIT)
+#ifndef res_init
+#define res_init  __res_init
+#endif
+#define HAVE_RES_INIT   HAVE___RES_INIT
+#endif
+
 #ifdef _SQUID_NEXT_
 /* This is a really bloody hack. frank@langen.bull.de
  * Workaround bug in gethostbyname which sets h_errno wrong
@@ -167,7 +177,7 @@
 #endif
 
 /* error messages from gethostbyname() */
-static char *
+static const char *
 my_h_msgs(int x)
 {
     if (x == HOST_NOT_FOUND)
diff -ruN squid-2.7.STABLE3/src/forward.c squid-2.7.STABLE4/src/forward.c
--- squid-2.7.STABLE3/src/forward.c	2008-06-19 03:08:29.000000000 +0200
+++ squid-2.7.STABLE4/src/forward.c	2008-07-18 02:47:48.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: forward.c,v 1.131.2.3 2008/06/19 01:08:29 hno Exp $
+ * $Id: forward.c,v 1.131.2.5 2008/07/18 00:47:48 hno Exp $
  *
  * DEBUG: section 17    Request Forwarding
  * AUTHOR: Duane Wessels
@@ -37,6 +37,7 @@
 #include "squid.h"
 
 #if LINUX_NETFILTER
+#include <linux/types.h>
 #include <linux/netfilter_ipv4.h>
 #endif
 #if LINUX_TPROXY
@@ -53,6 +54,7 @@
 static CNCB fwdConnectDone;
 static int fwdCheckRetry(FwdState * fwdState);
 static int fwdReforward(FwdState *);
+static void fwdRestart(void *);
 static void fwdStartFail(FwdState *);
 static void fwdLogReplyStatus(int tries, http_status status);
 static OBJH fwdStats;
@@ -207,7 +209,7 @@
 	    }
 	}
 	/* use eventAdd to break potential call sequence loops and to slow things down a little */
-	eventAdd("fwdConnectStart", fwdConnectStart, fwdState, originserver ? 0.05 : 0.005, 0);
+	eventAdd("fwdRestart", fwdRestart, fwdState, originserver ? 0.05 : 0.005, 0);
 	return;
     }
     if (!fwdState->err && shutting_down)
@@ -571,7 +573,7 @@
 	fwdState->request->pinned_connection = NULL;
 	fwdState->servers = fs->next;
 	fwdServerFree(fs);
-	fwdConnectStart(fwdState);
+	fwdRestart(fwdState);
 	return;
     }
 #if LINUX_TPROXY
@@ -697,6 +699,16 @@
 }
 
 static void
+fwdRestart(void *data)
+{
+    FwdState *fwdState = data;
+    if (fwdState->servers)
+	fwdConnectStart(fwdState);
+    else
+	fwdStartFail(fwdState);
+}
+
+static void
 fwdStartComplete(FwdServer * servers, void *data)
 {
     FwdState *fwdState = data;
diff -ruN squid-2.7.STABLE3/src/neighbors.c squid-2.7.STABLE4/src/neighbors.c
--- squid-2.7.STABLE3/src/neighbors.c	2008-06-25 01:14:18.000000000 +0200
+++ squid-2.7.STABLE4/src/neighbors.c	2008-06-27 23:52:56.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: neighbors.c,v 1.319.2.7 2008/06/24 23:14:18 hno Exp $
+ * $Id: neighbors.c,v 1.319.2.8 2008/06/27 21:52:56 hno Exp $
  *
  * DEBUG: section 15    Neighbor Routines
  * AUTHOR: Harvest Derived
@@ -281,13 +281,22 @@
 }
 
 /* This gets called every 5 minutes to clear the round-robin counter. */
-void
+static void
 peerClearRRLoop(void *data)
 {
     peerClearRR();
     eventAdd("peerClearRR", peerClearRRLoop, data, 5 * 60.0, 0);
 }
 
+void
+peerClearRRStart(void)
+{
+    static int event_added = 0;
+    if (!event_added) {
+	peerClearRRLoop(NULL);
+    }
+}
+
 /* Actually clear the round-robin counter. */
 void
 peerClearRR(void)
diff -ruN squid-2.7.STABLE3/src/peer_select.c squid-2.7.STABLE4/src/peer_select.c
--- squid-2.7.STABLE3/src/peer_select.c	2008-06-25 00:53:49.000000000 +0200
+++ squid-2.7.STABLE4/src/peer_select.c	2008-07-10 11:48:41.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: peer_select.c,v 1.134.2.3 2008/06/24 22:53:49 hno Exp $
+ * $Id: peer_select.c,v 1.134.2.4 2008/07/10 09:48:41 hno Exp $
  *
  * DEBUG: section 44    Peer Selection Algorithm
  * AUTHOR: Duane Wessels
@@ -685,7 +685,7 @@
 	p ? p->name : "DIRECT",
 	hier_strings[code]);
     while (*FS) {
-	if ((*FS)->peer == p) {
+	if ((*FS)->peer == p && (*FS)->code != PINNED) {
 	    debug(44, 5) ("peerAddFwdServer: Skipping duplicate registration of %s\n", p ? p->name : "DIRECT");
 	    return;
 	}
diff -ruN squid-2.7.STABLE3/src/protos.h squid-2.7.STABLE4/src/protos.h
--- squid-2.7.STABLE3/src/protos.h	2008-06-25 01:14:18.000000000 +0200
+++ squid-2.7.STABLE4/src/protos.h	2008-06-27 23:52:56.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: protos.h,v 1.547.2.9 2008/06/24 23:14:18 hno Exp $
+ * $Id: protos.h,v 1.547.2.10 2008/06/27 21:52:56 hno Exp $
  *
  *
  * SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -688,7 +688,7 @@
 extern peer *peerFindByNameAndPort(const char *, unsigned short);
 extern peer *getDefaultParent(request_t * request);
 extern peer *getRoundRobinParent(request_t * request);
-EVH peerClearRRLoop;
+extern void peerClearRRStart(void);
 extern void peerClearRR(void);
 extern peer *getAnyParent(request_t * request);
 extern lookup_t peerDigestLookup(peer * p, request_t * request);
diff -ruN squid-2.7.STABLE3/src/store.c squid-2.7.STABLE4/src/store.c
--- squid-2.7.STABLE3/src/store.c	2008-06-19 03:08:30.000000000 +0200
+++ squid-2.7.STABLE4/src/store.c	2008-07-18 02:44:02.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: store.c,v 1.584.2.4 2008/06/19 01:08:30 hno Exp $
+ * $Id: store.c,v 1.584.2.6 2008/07/18 00:44:02 hno Exp $
  *
  * DEBUG: section 20    Storage Manager
  * AUTHOR: Harvest Derived
@@ -1362,6 +1362,7 @@
 	errorAppendEntry(e, err);
     } else {
 	EBIT_SET(e->flags, ENTRY_ABORTED);
+	EBIT_CLR(e->flags, ENTRY_FWD_HDR_WAIT);
     }
     e->store_status = STORE_OK;
     mem->object_sz = mem->inmem_hi;
@@ -1612,9 +1613,9 @@
 {
     long int i;
     /* Calculate size of hash table (maximum currently 64k buckets).  */
-    i = Config.Swap.maxSize / Config.Store.avgObjectSize;
-    debug(20, 1) ("Swap maxSize %lu KB, estimated %ld objects\n",
-	(unsigned long int) Config.Swap.maxSize, i);
+    i = (Config.Swap.maxSize + (Config.memMaxSize >> 10)) / Config.Store.avgObjectSize;
+    debug(20, 1) ("Swap maxSize %lu + %lu KB, estimated %ld objects\n",
+	(unsigned long int) Config.Swap.maxSize, (Config.memMaxSize >> 10), i);
     i /= Config.Store.objectsPerBucket;
     debug(20, 1) ("Target number of buckets: %ld\n", i);
     /* ideally the full scan period should be configurable, for the
diff -ruN squid-2.7.STABLE3/src/store_client.c squid-2.7.STABLE4/src/store_client.c
--- squid-2.7.STABLE3/src/store_client.c	2008-05-27 14:49:39.000000000 +0200
+++ squid-2.7.STABLE4/src/store_client.c	2008-07-21 22:43:27.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: store_client.c,v 1.127.2.3 2008/05/27 12:49:39 hno Exp $
+ * $Id: store_client.c,v 1.127.2.4 2008/07/21 20:43:27 hno Exp $
  *
  * DEBUG: section 20    Storage Manager Client-Side Interface
  * AUTHOR: Duane Wessels
@@ -169,7 +169,6 @@
     STCB * callback,
     void *data)
 {
-    assert(!EBIT_TEST(e->flags, ENTRY_ABORTED));
     debug(20, 3) ("storeClientCopy: %s, seen %" PRINTF_OFF_T ", want %" PRINTF_OFF_T ", size %d, cb %p, cbdata %p\n",
 	storeKeyText(e->hash.key),
 	seen_offset,
diff -ruN squid-2.7.STABLE3/src/structs.h squid-2.7.STABLE4/src/structs.h
--- squid-2.7.STABLE3/src/structs.h	2008-06-25 01:14:18.000000000 +0200
+++ squid-2.7.STABLE4/src/structs.h	2008-07-21 22:18:50.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: structs.h,v 1.538.2.14 2008/06/24 23:14:18 hno Exp $
+ * $Id: structs.h,v 1.538.2.15 2008/07/21 20:18:50 hno Exp $
  *
  *
  * SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -1233,6 +1233,7 @@
     store_client *sc;		/* The store_client we're using */
     store_client *old_sc;	/* ... for entry to be validated */
     char *uri;
+    char *log_uri;
     struct {
 	squid_off_t offset;
 	squid_off_t size;
diff -ruN squid-2.7.STABLE3/src/win32.c squid-2.7.STABLE4/src/win32.c
--- squid-2.7.STABLE3/src/win32.c	2008-06-04 22:35:37.000000000 +0200
+++ squid-2.7.STABLE4/src/win32.c	2008-06-30 18:20:06.000000000 +0200
@@ -1,6 +1,6 @@
 
 /*
- * $Id: win32.c,v 1.18.2.4 2008/06/04 20:35:37 hno Exp $
+ * $Id: win32.c,v 1.18.2.5 2008/06/30 16:20:06 serassio Exp $
  *
  * Windows support
  * AUTHOR: Guido Serassio <serassio@squid-cache.org>
@@ -368,7 +368,7 @@
 {
     DWORD status = ERROR_SUCCESS;
 
-    if (NotifyAddrChange_thread = !INVALID_HANDLE_VALUE) {
+    if (NotifyAddrChange_thread != INVALID_HANDLE_VALUE) {
 	TerminateThread(NotifyAddrChange_thread, status);
 	CloseHandle(NotifyAddrChange_thread);
     }
