diff -u -r -N squid-3.4.2/ChangeLog squid-3.4.3/ChangeLog
--- squid-3.4.2/ChangeLog	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/ChangeLog	2014-02-02 21:41:53.000000000 +1300
@@ -1,3 +1,18 @@
+Changes to squid-3.4.3 (02 Feb 2014):
+
+	- Bug 4008: HttpHeader warnOnError should be an int not a bool
+	- Bug 4002: clang 3.4 unable to compile
+	- Bug 3996: Malformed DNS reply leads to crash
+	- Bug 3995: compile error on CentOS 5 with GCC 4.1.2
+	- Bug 3975: atomic detection cross-compilation failure
+	- Bug 3971: "cannot aggregate mgr:client_list: cmd->profile != NULL" in SMP mode
+	- Bug 3954: compile failure in CpuAffinity.cc
+	- Bug 3927: tests/testRock fatal.cc required
+	- Fix memory leak in peer Cache Digest exchange
+	- Fix external_acl_type async loop failures
+	- Fix destination IP address cycling
+	- ... and a few polishing changes
+
 Changes to squid-3.4.2 (30 Dec 2013):
 
 	- Regression Bug 3980: FATAL ERROR due to max_user_ip -s option
diff -u -r -N squid-3.4.2/compat/os/hpux.h squid-3.4.3/compat/os/hpux.h
--- squid-3.4.2/compat/os/hpux.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/compat/os/hpux.h	2014-02-02 21:41:53.000000000 +1300
@@ -1,5 +1,5 @@
 #ifndef SQUID_OS_HPUX_H
-#define SQUID_OS_PHUX_H
+#define SQUID_OS_HPUX_H
 
 #if _SQUID_HPUX_
 
diff -u -r -N squid-3.4.2/compat/xstrto.cc squid-3.4.3/compat/xstrto.cc
--- squid-3.4.2/compat/xstrto.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/compat/xstrto.cc	2014-02-02 21:41:53.000000000 +1300
@@ -55,11 +55,10 @@
 xstrtoul(const char *s, char **end, unsigned long *value,
          unsigned long min, unsigned long max)
 {
-    unsigned long v;
-    char *my_end;
+    char *my_end = NULL;
 
     errno = 0;
-    v = strtoul(s, &my_end, 0);
+    unsigned long v = strtoul(s, &my_end, 0);
 
     if (my_end == s)
         return false;
@@ -81,10 +80,8 @@
 xstrtoui(const char *s, char **end, unsigned int *value,
          unsigned int min, unsigned int max)
 {
-    unsigned long v;
-    bool ret;
-
-    ret = xstrtoul(s, end, &v, min, max);
+    unsigned long v = 0;
+    bool ret = xstrtoul(s, end, &v, min, max);
     if (value != NULL) {
         *value = v;
 
diff -u -r -N squid-3.4.2/configure squid-3.4.3/configure
--- squid-3.4.2/configure	2013-12-31 00:34:14.000000000 +1300
+++ squid-3.4.3/configure	2014-02-02 21:42:34.000000000 +1300
@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision.
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for Squid Web Proxy 3.4.2.
+# Generated by GNU Autoconf 2.68 for Squid Web Proxy 3.4.3.
 #
 # Report bugs to <http://bugs.squid-cache.org/>.
 #
@@ -575,8 +575,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='3.4.2'
-PACKAGE_STRING='Squid Web Proxy 3.4.2'
+PACKAGE_VERSION='3.4.3'
+PACKAGE_STRING='Squid Web Proxy 3.4.3'
 PACKAGE_BUGREPORT='http://bugs.squid-cache.org/'
 PACKAGE_URL=''
 
@@ -1579,7 +1579,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 3.4.2 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 3.4.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1649,7 +1649,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 3.4.2:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 3.4.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1872,9 +1872,9 @@
                           is usually only required on Windows and very old
                           Unix boxes which do not have their own regex library
                           built in.
-  --disable-translation   Prevent Squid generating localized error page
-                          templates and manuals. Which is usually tried, but
-                          may not be needed.
+  --enable-translation    Generate the localized error page templates and
+                          manuals. Which can also be downloaded from
+                          http://www.squid-cache.org/Versions/langpack/.
   --disable-auto-locale   This prevents Squid providing localized error pages
                           based on the clients request headers. When disabled
                           Squid requires explicit language configuration.
@@ -2037,7 +2037,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 3.4.2
+Squid Web Proxy configure 3.4.3
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -3133,7 +3133,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 3.4.2, which was
+It was created by Squid Web Proxy $as_me 3.4.3, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -3952,7 +3952,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='3.4.2'
+ VERSION='3.4.3'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -19038,10 +19038,9 @@
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU atomic operations support" >&5
 $as_echo_n "checking for GNU atomic operations support... " >&6; }
 if test "$cross_compiling" = yes; then :
-  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot run test program while cross compiling
-See \`config.log' for more details" "$LINENO" 5; }
+   { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compiler cant tell" >&5
+$as_echo "cross-compiler cant tell" >&6; }
+
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -19082,7 +19081,6 @@
 fi
 
 
-
 # Check whether --enable-debug-cbdata was given.
 if test "${enable_debug_cbdata+set}" = set; then :
   enableval=$enable_debug_cbdata;
@@ -32124,13 +32122,13 @@
   enableval=$enable_translation;
 
 if test "$enableval" != "yes" -a "$enableval" != "no" ; then
-  as_fn_error $? "unrecognized argument to --disable-translation: $enableval" "$LINENO" 5
+  as_fn_error $? "unrecognized argument to --enable-translation: $enableval" "$LINENO" 5
 fi
 
 
 fi
 
-if test "x${enable_translation:=yes}" = "xyes" ; then
+if test "x${enable_translation:=no}" = "xyes" ; then
 
 
 
@@ -33121,7 +33119,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 3.4.2, which was
+This file was extended by Squid Web Proxy $as_me 3.4.3, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -33187,7 +33185,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-Squid Web Proxy config.status 3.4.2
+Squid Web Proxy config.status 3.4.3
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 
diff -u -r -N squid-3.4.2/configure.ac squid-3.4.3/configure.ac
--- squid-3.4.2/configure.ac	2013-12-31 00:34:14.000000000 +1300
+++ squid-3.4.3/configure.ac	2014-02-02 21:42:34.000000000 +1300
@@ -1,4 +1,4 @@
-AC_INIT([Squid Web Proxy],[3.4.2],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[3.4.3],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
@@ -431,9 +431,9 @@
     AC_MSG_RESULT(yes)
 ],[
     AC_MSG_RESULT(no)
+],[ AC_MSG_RESULT(cross-compiler cant tell)
 ])
 
-
 AC_ARG_ENABLE(debug-cbdata,
   AS_HELP_STRING([--enable-debug-cbdata],
       [Provide some debug information in cbdata]), [ 
@@ -3367,15 +3367,14 @@
 fi
 
 
-dnl Squid will usually attempt to translate when packaging or building from VCS 
+dnl Squid will not usually attempt to translate templates when building
 AC_ARG_ENABLE(translation,
- AS_HELP_STRING([--disable-translation],[Prevent Squid generating localized error page templates and manuals.
-		 Which is usually tried, but may not be needed.]), [ 
-SQUID_YESNO([$enableval],
-     [unrecognized argument to --disable-translation: $enableval])
+ AS_HELP_STRING([--enable-translation],[Generate the localized error page templates and manuals.
+		 Which can also be downloaded from http://www.squid-cache.org/Versions/langpack/.]), [ 
+  SQUID_YESNO([$enableval],
+     [unrecognized argument to --enable-translation: $enableval])
 ])
-dnl Squid now has .po translation capability, given the right toolkit
-if test "x${enable_translation:=yes}" = "xyes" ; then
+if test "x${enable_translation:=no}" = "xyes" ; then
   AX_WITH_PROG([PO2HTML],[po2html])
   AX_WITH_PROG([PO2TEXT],[po2txt])
 else
diff -u -r -N squid-3.4.2/CONTRIBUTORS squid-3.4.3/CONTRIBUTORS
--- squid-3.4.2/CONTRIBUTORS	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/CONTRIBUTORS	2014-02-02 21:41:53.000000000 +1300
@@ -23,6 +23,7 @@
     Assar Westerlund <assar@pdc.kth.se>
     Automatic source maintenance <squidadm@squid-cache.org>
     Axel Westerhold <ml.awesterhold@dts.de>
+    Benjamin Kerensa <bkerensa@ubuntu.com>
     Benno Rice <benno@squid-cache.org>
     Bertrand Jacquin <beber@meleeweb.net>
     Bojan Smojver <bojan@rexursive.com>
@@ -196,4 +197,3 @@
     benno@jeamland.net
     fancyrabbit <fancyrabbit@gmail.com>
     vollkommen <vollkommen@gmx.net>
-    Benjamin Kerensa <bkerensa@ubuntu.com>
diff -u -r -N squid-3.4.2/helpers/basic_auth/DB/basic_db_auth.8 squid-3.4.3/helpers/basic_auth/DB/basic_db_auth.8
--- squid-3.4.2/helpers/basic_auth/DB/basic_db_auth.8	2013-12-31 00:51:34.000000000 +1300
+++ squid-3.4.3/helpers/basic_auth/DB/basic_db_auth.8	2014-02-02 21:58:46.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_DB_AUTH 1"
-.TH BASIC_DB_AUTH 1 "2013-12-30" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH BASIC_DB_AUTH 1 "2014-02-02" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.2/helpers/external_acl/SQL_session/ext_sql_session_acl.8 squid-3.4.3/helpers/external_acl/SQL_session/ext_sql_session_acl.8
--- squid-3.4.2/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2013-12-31 00:51:37.000000000 +1300
+++ squid-3.4.3/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2014-02-02 21:58:48.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_SQL_SESSION_ACL 1"
-.TH EXT_SQL_SESSION_ACL 1 "2013-12-30" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH EXT_SQL_SESSION_ACL 1 "2014-02-02" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.2/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8 squid-3.4.3/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8
--- squid-3.4.2/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2013-12-31 00:51:38.000000000 +1300
+++ squid-3.4.3/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2014-02-02 21:58:49.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_WBINFO_GROUP_ACL.PL.IN 1"
-.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2013-12-30" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2014-02-02" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.2/helpers/log_daemon/DB/log_db_daemon.8 squid-3.4.3/helpers/log_daemon/DB/log_db_daemon.8
--- squid-3.4.2/helpers/log_daemon/DB/log_db_daemon.8	2013-12-31 00:51:38.000000000 +1300
+++ squid-3.4.3/helpers/log_daemon/DB/log_db_daemon.8	2014-02-02 21:58:49.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "LOG_DB_DAEMON 1"
-.TH LOG_DB_DAEMON 1 "2013-12-30" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH LOG_DB_DAEMON 1 "2014-02-02" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.2/helpers/storeid_rewrite/file/storeid_file_rewrite.8 squid-3.4.3/helpers/storeid_rewrite/file/storeid_file_rewrite.8
--- squid-3.4.2/helpers/storeid_rewrite/file/storeid_file_rewrite.8	2013-12-31 00:51:41.000000000 +1300
+++ squid-3.4.3/helpers/storeid_rewrite/file/storeid_file_rewrite.8	2014-02-02 21:58:50.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "STOREID_FILE_REWRITE 1"
-.TH STOREID_FILE_REWRITE 1 "2013-12-30" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH STOREID_FILE_REWRITE 1 "2014-02-02" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.2/include/heap.h squid-3.4.3/include/heap.h
--- squid-3.4.2/include/heap.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/include/heap.h	2014-02-02 21:41:53.000000000 +1300
@@ -158,7 +158,7 @@
 SQUIDCEXTERN int heap_nodes(heap *);
 #else /* MACRO_DEBUG */
 #define	heap_nodes(heap)	((heap)->last)
-#define	heap_empty(heap)	(((heap)->last <= 0) ? 1 : 0)
+#define	heap_empty(heap)	((heap)->last <= 0 ? 1 : 0)
 #endif /* MACRO_DEBUG */
 
 /*
diff -u -r -N squid-3.4.2/include/rfc1123.h squid-3.4.3/include/rfc1123.h
--- squid-3.4.2/include/rfc1123.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/include/rfc1123.h	2014-02-02 21:41:53.000000000 +1300
@@ -1,5 +1,5 @@
 #ifndef _SQUID_RFC1123_H
-#define _SQUID_RFC1123_
+#define _SQUID_RFC1123_H
 
 #ifdef __cplusplus
 extern "C" {
diff -u -r -N squid-3.4.2/include/SquidNew.h squid-3.4.3/include/SquidNew.h
--- squid-3.4.2/include/SquidNew.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/include/SquidNew.h	2014-02-02 21:41:53.000000000 +1300
@@ -31,7 +31,7 @@
 #ifndef SQUID_NEW_H
 #define SQUID_NEW_H
 
-#ifndef __SUNPRO_CC
+#if !defined(__SUNPRO_CC) && !defined(__clang__)
 /* Any code using libstdc++ must have externally resolvable overloads
  * for void * operator new - which means in the .o for the binary,
  * or in a shared library. static libs don't propogate the symbol
@@ -57,6 +57,6 @@
     xfree(address);
 }
 
-#endif /* __SUNPRO_CC */
+#endif /* !__SUNPRO_CC && !__clang__*/
 
 #endif /* SQUID_NEW_H */
diff -u -r -N squid-3.4.2/include/uudecode.h squid-3.4.3/include/uudecode.h
--- squid-3.4.2/include/uudecode.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/include/uudecode.h	2014-02-02 21:41:53.000000000 +1300
@@ -1,5 +1,5 @@
 #ifndef _SQUID_UUDECODE_H
-#define _SQUID_UUDECODE_
+#define _SQUID_UUDECODE_H
 
 #ifdef __cplusplus
 extern "C"
diff -u -r -N squid-3.4.2/include/version.h squid-3.4.3/include/version.h
--- squid-3.4.2/include/version.h	2013-12-31 00:34:14.000000000 +1300
+++ squid-3.4.3/include/version.h	2014-02-02 21:42:34.000000000 +1300
@@ -7,7 +7,7 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1388403205
+#define SQUID_RELEASE_TIME 1391330511
 #endif
 
 #ifndef APP_SHORTNAME
diff -u -r -N squid-3.4.2/RELEASENOTES.html squid-3.4.3/RELEASENOTES.html
--- squid-3.4.2/RELEASENOTES.html	2013-12-31 00:51:58.000000000 +1300
+++ squid-3.4.3/RELEASENOTES.html	2014-02-02 21:59:01.000000000 +1300
@@ -2,10 +2,10 @@
 <HTML>
 <HEAD>
  <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.69">
- <TITLE>Squid 3.4.2 release notes</TITLE>
+ <TITLE>Squid 3.4.3 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 3.4.2 release notes</H1>
+<H1>Squid 3.4.3 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -57,7 +57,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-3.4.2 for testing.</P>
+<P>The Squid Team are pleased to announce the release of Squid-3.4.3 for testing.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v3/3.4/">http://www.squid-cache.org/Versions/v3/3.4/</A> or the
 <A HREF="http://www.squid-cache.org/Mirrors/http-mirrors.html">mirrors</A>.</P>
@@ -505,6 +505,12 @@
 the getsockname() API in recent PF versions require <EM>--with-nat-devpf</EM>
 to re-enable /dev/pf support when using PF firewall.</P>
 
+<DT><B>--disable-translation</B><DD>
+<P>Default changed to prevent translating error page templates during build.
+Use --enable-translation to explicitly build and install the templates.</P>
+<P>The latest pre-translated templates can be downloaded from 
+<A HREF="http://www.squid-cache.org/Versions/langpack/">http://www.squid-cache.org/Versions/langpack/</A></P>
+
 </DL>
 </P>
 <H2><A NAME="removedoptions"></A> <A NAME="ss4.3">4.3</A> <A HREF="#toc4.3">Removed options</A>
diff -u -r -N squid-3.4.2/src/acl/Acl.cc squid-3.4.3/src/acl/Acl.cc
--- squid-3.4.2/src/acl/Acl.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/Acl.cc	2014-02-02 21:41:53.000000000 +1300
@@ -31,6 +31,7 @@
 #include "squid.h"
 #include "acl/Acl.h"
 #include "acl/Checklist.h"
+#include "acl/Gadgets.h"
 #include "anyp/PortCfg.h"
 #include "cache_cf.h"
 #include "ConfigParser.h"
@@ -298,12 +299,13 @@
                A->cfgline);
     }
 
-    // prepend so that ACLs declared later (and possibly using earlier ACLs)
-    // are destroyed earlier (before the ACLs they use are destroyed)
+    // add to the global list for searching explicit ACLs by name
     assert(head && *head == Config.aclList);
-    A->registered = true;
     A->next = *head;
     *head = A;
+
+    // register for centralized cleanup
+    aclRegister(A);
 }
 
 bool
diff -u -r -N squid-3.4.2/src/acl/Acl.h squid-3.4.3/src/acl/Acl.h
--- squid-3.4.2/src/acl/Acl.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/Acl.h	2014-02-02 21:41:53.000000000 +1300
@@ -138,7 +138,7 @@
     char *cfgline;
     ACL *next; // XXX: remove or at least use refcounting
     ACLFlags flags; ///< The list of given ACL flags
-    bool registered; ///< added to Config.aclList and can be reused via by FindByName()
+    bool registered; ///< added to the global list of ACLs via aclRegister()
 
 public:
 
diff -u -r -N squid-3.4.2/src/acl/Checklist.cc squid-3.4.3/src/acl/Checklist.cc
--- squid-3.4.2/src/acl/Checklist.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/Checklist.cc	2014-02-02 21:41:53.000000000 +1300
@@ -64,6 +64,7 @@
     // concurrent checks using the same Checklist are not supported
     assert(!occupied_);
     occupied_ = true;
+    asyncLoopDepth_ = 0;
 
     AclMatchedName = NULL;
     finished_ = false;
@@ -77,6 +78,7 @@
     // Remember the current tree location to prevent "async loop" cases where
     // the same child node wants to go async more than once.
     matchLoc_ = Breadcrumb(current, pos);
+    asyncLoopDepth_ = 0;
 
     // if there are any breadcrumbs left, then follow them on the way down
     bool result = false;
@@ -116,11 +118,16 @@
 
     // TODO: add a once-in-a-while WARNING about async loops?
     if (matchLoc_ == asyncLoc_) {
-        debugs(28, 2, this << " a slow ACL resumes by going async again!");
-        return false;
+        debugs(28, 2, this << " a slow ACL resumes by going async again! (loop #" << asyncLoopDepth_ << ")");
+        // external_acl_type may cause async auth lookup plus its own async check
+        // which has the appearance of a loop. Allow some retries.
+        // TODO: make it configurable and check BH retry attempts vs this check?
+        if (asyncLoopDepth_ > 5)
+            return false;
     }
 
     asyncLoc_ = matchLoc_; // prevent async loops
+    ++asyncLoopDepth_;
 
     asyncStage_ = asyncStarting;
     changeState(state);
@@ -168,7 +175,8 @@
         finished_(false),
         allow_(ACCESS_DENIED),
         asyncStage_(asyncNone),
-        state_(NullState::Instance())
+        state_(NullState::Instance()),
+        asyncLoopDepth_(0)
 {
 }
 
diff -u -r -N squid-3.4.2/src/acl/Checklist.h squid-3.4.3/src/acl/Checklist.h
--- squid-3.4.2/src/acl/Checklist.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/Checklist.h	2014-02-02 21:41:53.000000000 +1300
@@ -233,6 +233,7 @@
     AsyncState *state_;
     Breadcrumb matchLoc_; ///< location of the node running matches() now
     Breadcrumb asyncLoc_; ///< currentNode_ that called goAsync()
+    unsigned asyncLoopDepth_; ///< how many times the current async state has resumed
 
     bool callerGone();
 
diff -u -r -N squid-3.4.2/src/acl/Gadgets.cc squid-3.4.3/src/acl/Gadgets.cc
--- squid-3.4.2/src/acl/Gadgets.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/Gadgets.cc	2014-02-02 21:41:53.000000000 +1300
@@ -50,6 +50,14 @@
 #include "HttpRequest.h"
 #include "Mem.h"
 
+#include <set>
+#include <algorithm>
+
+
+typedef std::set<ACL*> AclSet;
+/// Accumulates all ACLs to facilitate their clean deletion despite reuse.
+static AclSet *RegisteredAcls; // TODO: Remove when ACLs are refcounted
+
 /* does name lookup, returns page_id */
 err_type
 aclGetDenyInfoPage(AclDenyInfoList ** head, const char *name, int redirect_allowed)
@@ -244,23 +252,38 @@
     *treep = tree;
 }
 
+void
+aclRegister(ACL *acl)
+{
+    if (!acl->registered) {
+        if (!RegisteredAcls)
+            RegisteredAcls = new AclSet;
+        RegisteredAcls->insert(acl);
+        acl->registered = true;
+    }
+}
+
 /*********************/
 /* Destroy functions */
 /*********************/
 
+/// helper for RegisteredAcls cleanup
+static void
+aclDeleteOne(ACL *acl)
+{
+    delete acl;
+}
+
+/// called to delete ALL Acls.
 void
 aclDestroyAcls(ACL ** head)
 {
-    ACL *next = NULL;
-
-    debugs(28, 8, "aclDestroyACLs: invoked");
-
-    for (ACL *a = *head; a; a = next) {
-        next = a->next;
-        delete a;
+    *head = NULL; // Config.aclList
+    if (AclSet *acls = RegisteredAcls) {
+        debugs(28, 8, "deleting all " << acls->size() << " ACLs");
+        std::for_each(acls->begin(), acls->end(), &aclDeleteOne);
+        acls->clear();
     }
-
-    *head = NULL;
 }
 
 void
diff -u -r -N squid-3.4.2/src/acl/Gadgets.h squid-3.4.3/src/acl/Gadgets.h
--- squid-3.4.2/src/acl/Gadgets.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/Gadgets.h	2014-02-02 21:41:53.000000000 +1300
@@ -13,6 +13,9 @@
 class StoreEntry;
 class wordlist;
 
+/// Register an ACL object for future deletion. Repeated registrations are OK.
+/// \ingroup ACLAPI
+void aclRegister(ACL *acl);
 /// \ingroup ACLAPI
 void aclDestroyAccessList(acl_access **list);
 /// \ingroup ACLAPI
diff -u -r -N squid-3.4.2/src/acl/InnerNode.cc squid-3.4.3/src/acl/InnerNode.cc
--- squid-3.4.2/src/acl/InnerNode.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/InnerNode.cc	2014-02-02 21:41:53.000000000 +1300
@@ -10,22 +10,6 @@
 #include "wordlist.h"
 #include <algorithm>
 
-// "delete acl" class to use with std::for_each() in InnerNode::~InnerNode()
-class AclDeleter
-{
-public:
-    void operator()(ACL* acl) {
-        // Do not delete explicit ACLs; they are maintained by Config.aclList.
-        if (acl && !acl->registered)
-            delete acl;
-    }
-};
-
-Acl::InnerNode::~InnerNode()
-{
-    std::for_each(nodes.begin(), nodes.end(), AclDeleter());
-}
-
 void
 Acl::InnerNode::prepareForUse()
 {
diff -u -r -N squid-3.4.2/src/acl/InnerNode.h squid-3.4.3/src/acl/InnerNode.h
--- squid-3.4.2/src/acl/InnerNode.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/acl/InnerNode.h	2014-02-02 21:41:53.000000000 +1300
@@ -13,7 +13,7 @@
 class InnerNode: public ACL
 {
 public:
-    virtual ~InnerNode();
+    // No ~InnerNode() to delete children. They are aclRegister()ed instead.
 
     /// Resumes matching (suspended by an async call) at the given position.
     bool resumeMatchingAt(ACLChecklist *checklist, Acl::Nodes::const_iterator pos) const;
diff -u -r -N squid-3.4.2/src/base/Vector.h squid-3.4.3/src/base/Vector.h
--- squid-3.4.2/src/base/Vector.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/base/Vector.h	2014-02-02 21:41:53.000000000 +1300
@@ -42,12 +42,18 @@
 #include "compat/assert.h"
 
 /* iterator support */
+#include <iterator>
 
 template <class C>
 class VectorIteratorBase
 {
-
 public:
+    typedef typename C::value_type value_type;
+    typedef std::forward_iterator_tag iterator_category;
+    typedef typename C::pointer pointer;
+    typedef typename C::reference reference;
+    typedef typename C::difference_type difference_type;
+
     VectorIteratorBase();
     VectorIteratorBase(C &);
     VectorIteratorBase(size_t, C &);
@@ -75,12 +81,13 @@
 template<class E>
 class Vector
 {
-
 public:
     typedef E value_type;
     typedef E* pointer;
+    typedef E& reference;
     typedef VectorIteratorBase<Vector<E> > iterator;
     typedef VectorIteratorBase<Vector<E> const> const_iterator;
+    typedef ptrdiff_t difference_type;
 
     void *operator new (size_t);
     void operator delete (void *);
diff -u -r -N squid-3.4.2/src/client_db.cc squid-3.4.3/src/client_db.cc
--- squid-3.4.2/src/client_db.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/client_db.cc	2014-02-02 21:41:53.000000000 +1300
@@ -31,6 +31,7 @@
  */
 
 #include "squid.h"
+#include "base/RunnersRegistry.h"
 #include "client_db.h"
 #include "event.h"
 #include "format/Token.h"
@@ -112,22 +113,28 @@
 }
 
 static void
-clientdbRegisterWithCacheManager(void)
-{
-    Mgr::RegisterAction("client_list", "Cache Client List", clientdbDump, 0, 1);
-}
-
-void
 clientdbInit(void)
 {
-    clientdbRegisterWithCacheManager();
-
     if (client_table)
         return;
 
     client_table = hash_create((HASHCMP *) strcmp, CLIENT_DB_HASH_SIZE, hash_string);
 }
 
+class ClientDbRr: public RegisteredRunner
+{
+    public:
+        virtual void run(const RunnerRegistry &);
+};
+RunnerRegistrationEntry(rrAfterConfig, ClientDbRr);
+
+void
+ClientDbRr::run(const RunnerRegistry &r)
+{
+    clientdbInit();
+    Mgr::RegisterAction("client_list", "Cache Client List", clientdbDump, 0, 1);
+}
+
 #if USE_DELAY_POOLS
 /* returns ClientInfo for given IP addr
    Returns NULL if no such client (or clientdb turned off)
diff -u -r -N squid-3.4.2/src/client_db.h squid-3.4.3/src/client_db.h
--- squid-3.4.2/src/client_db.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/client_db.h	2014-02-02 21:41:53.000000000 +1300
@@ -46,7 +46,6 @@
 class StoreEntry;
 class ClientInfo;
 
-void clientdbInit(void);
 void clientdbUpdate(const Ip::Address &, LogTags, AnyP::ProtocolType, size_t);
 int clientdbCutoffDenied(const Ip::Address &);
 void clientdbDump(StoreEntry *);
diff -u -r -N squid-3.4.2/src/CommCalls.h squid-3.4.3/src/CommCalls.h
--- squid-3.4.2/src/CommCalls.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/CommCalls.h	2014-02-02 21:41:53.000000000 +1300
@@ -176,7 +176,7 @@
     typedef void (C::*Method)(const Params &io);
 
     CommCbMemFunT(const CbcPointer<C> &aJob, Method aMeth): JobDialer<C>(aJob),
-            CommDialerParamsT<Params_>(aJob.get()),
+            CommDialerParamsT<Params_>(aJob->toCbdata()),
             method(aMeth) {}
 
     virtual bool canDial(AsyncCall &c) {
diff -u -r -N squid-3.4.2/src/dns_internal.cc squid-3.4.3/src/dns_internal.cc
--- squid-3.4.2/src/dns_internal.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/dns_internal.cc	2014-02-02 21:41:53.000000000 +1300
@@ -1504,6 +1504,12 @@
 
     vc->msglen = ntohs(vc->msglen);
 
+    if (!vc->msglen) {
+        if (Comm::IsConnOpen(conn))
+            conn->close();
+        return;
+    }
+
     vc->msg->init(vc->msglen, vc->msglen);
     AsyncCall::Pointer call = commCbCall(5,4, "idnsReadVC",
                                          CommIoCbPtrFun(idnsReadVC, vc));
diff -u -r -N squid-3.4.2/src/format/Token.h squid-3.4.3/src/format/Token.h
--- squid-3.4.2/src/format/Token.h	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/format/Token.h	2014-02-02 21:41:53.000000000 +1300
@@ -35,7 +35,7 @@
             left(false),
             space(false),
             zero(false),
-            divisor(0),
+            divisor(1),
             next(NULL)
     { data.string = NULL; }
 
@@ -68,7 +68,7 @@
     bool left;
     bool space;
     bool zero;
-    int divisor;
+    int divisor;    // class invariant: MUST NOT be zero.
     Token *next;	/* todo: move from linked list to array */
 
 private:
diff -u -r -N squid-3.4.2/src/HttpHeader.cc squid-3.4.3/src/HttpHeader.cc
--- squid-3.4.2/src/HttpHeader.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/HttpHeader.cc	2014-02-02 21:41:53.000000000 +1300
@@ -549,7 +549,7 @@
 {
     const char *field_ptr = header_start;
     HttpHeaderEntry *e, *e2;
-    bool warnOnError = (Config.onoff.relaxed_header_parser <= 0 ? DBG_IMPORTANT : 2);
+    int warnOnError = (Config.onoff.relaxed_header_parser <= 0 ? DBG_IMPORTANT : 2);
 
     PROF_start(HttpHeaderParse);
 
diff -u -r -N squid-3.4.2/src/main.cc squid-3.4.3/src/main.cc
--- squid-3.4.2/src/main.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/main.cc	2014-02-02 21:41:53.000000000 +1300
@@ -700,7 +700,6 @@
         snmpOpenPorts();
 #endif
 
-        clientdbInit();
         icmpEngine.Open();
         netdbInit();
         asnInit();
diff -u -r -N squid-3.4.2/src/Makefile.am squid-3.4.3/src/Makefile.am
--- squid-3.4.2/src/Makefile.am	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/Makefile.am	2014-02-02 21:41:53.000000000 +1300
@@ -3272,7 +3272,7 @@
 	EventLoop.cc \
 	event.cc \
 	fatal.h \
-	tests/stub_fatal.cc \
+	fatal.cc \
 	fd.h \
 	fd.cc \
 	fde.h \
diff -u -r -N squid-3.4.2/src/Makefile.in squid-3.4.3/src/Makefile.in
--- squid-3.4.2/src/Makefile.in	2013-12-31 00:34:02.000000000 +1300
+++ squid-3.4.3/src/Makefile.in	2014-02-02 21:42:24.000000000 +1300
@@ -1269,8 +1269,8 @@
 	$(CXXFLAGS) $(tests_testHttpRequest_LDFLAGS) $(LDFLAGS) -o $@
 am__tests_testRock_SOURCES_DIST = cbdata.cc CacheDigest.h \
 	CacheDigest.cc ConfigOption.cc ConfigParser.cc disk.h disk.cc \
-	ETag.cc EventLoop.cc event.cc fatal.h tests/stub_fatal.cc fd.h \
-	fd.cc fde.h fde.cc FileMap.h filemap.cc HttpHeaderFieldStat.h \
+	ETag.cc EventLoop.cc event.cc fatal.h fatal.cc fd.h fd.cc \
+	fde.h fde.cc FileMap.h filemap.cc HttpHeaderFieldStat.h \
 	HttpBody.h HttpBody.cc HttpHdrCc.cc HttpHdrContRange.cc \
 	HttpHdrRange.cc HttpHdrSc.cc HttpHdrScTarget.cc HttpHeader.h \
 	HttpHeader.cc HttpHeaderFieldInfo.h HttpHeaderTools.h \
@@ -1316,8 +1316,8 @@
 am_tests_testRock_OBJECTS = cbdata.$(OBJEXT) CacheDigest.$(OBJEXT) \
 	ConfigOption.$(OBJEXT) ConfigParser.$(OBJEXT) disk.$(OBJEXT) \
 	ETag.$(OBJEXT) EventLoop.$(OBJEXT) event.$(OBJEXT) \
-	tests/stub_fatal.$(OBJEXT) fd.$(OBJEXT) fde.$(OBJEXT) \
-	filemap.$(OBJEXT) HttpBody.$(OBJEXT) HttpHdrCc.$(OBJEXT) \
+	fatal.$(OBJEXT) fd.$(OBJEXT) fde.$(OBJEXT) filemap.$(OBJEXT) \
+	HttpBody.$(OBJEXT) HttpHdrCc.$(OBJEXT) \
 	HttpHdrContRange.$(OBJEXT) HttpHdrRange.$(OBJEXT) \
 	HttpHdrSc.$(OBJEXT) HttpHdrScTarget.$(OBJEXT) \
 	HttpHeader.$(OBJEXT) HttpHeaderTools.$(OBJEXT) \
@@ -5036,7 +5036,7 @@
 	EventLoop.cc \
 	event.cc \
 	fatal.h \
-	tests/stub_fatal.cc \
+	fatal.cc \
 	fd.h \
 	fd.cc \
 	fde.h \
diff -u -r -N squid-3.4.2/src/peer_digest.cc squid-3.4.3/src/peer_digest.cc
--- squid-3.4.2/src/peer_digest.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/peer_digest.cc	2014-02-02 21:41:53.000000000 +1300
@@ -300,7 +300,7 @@
 {
     CachePeer *p = pd->peer;
     StoreEntry *e, *old_e;
-    char *url;
+    char *url = NULL;
     const cache_key *key;
     HttpRequest *req;
     DigestFetchState *fetch = NULL;
@@ -398,6 +398,8 @@
 
     storeClientCopy(fetch->sc, e, tempBuffer,
                     peerDigestHandleReply, fetch);
+
+    safe_free(url);
 }
 
 /* Handle the data copying .. */
diff -u -r -N squid-3.4.2/src/peer_select.cc squid-3.4.3/src/peer_select.cc
--- squid-3.4.2/src/peer_select.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/peer_select.cc	2014-02-02 21:41:53.000000000 +1300
@@ -337,14 +337,14 @@
 
             // for TPROXY spoofing we must skip unusable addresses.
             if (psstate->request->flags.spoofClientIp && !(fs->_peer && fs->_peer->options.no_tproxy) ) {
-                if (ia->in_addrs[n].isIPv4() != psstate->request->client_addr.isIPv4()) {
+                if (ia->in_addrs[ip].isIPv4() != psstate->request->client_addr.isIPv4()) {
                     // we CAN'T spoof the address on this link. find another.
                     continue;
                 }
             }
 
             p = new Comm::Connection();
-            p->remote = ia->in_addrs[n];
+            p->remote = ia->in_addrs[ip];
 
             // when IPv6 is disabled we cannot use it
             if (!Ip::EnableIpv6 && p->remote.isIPv6()) {
diff -u -r -N squid-3.4.2/src/repl/heap/store_repl_heap.cc squid-3.4.3/src/repl/heap/store_repl_heap.cc
--- squid-3.4.2/src/repl/heap/store_repl_heap.cc	2013-12-31 00:33:27.000000000 +1300
+++ squid-3.4.3/src/repl/heap/store_repl_heap.cc	2014-02-02 21:41:53.000000000 +1300
@@ -221,7 +221,7 @@
 
 try_again:
 
-    if (!heap_nodes(h->theHeap) > 0)
+    if (heap_empty(h->theHeap))
         return NULL;		/* done */
 
     age = heap_peepminkey(h->theHeap);
