diff -u -r -N squid-3.3.9/acinclude/compiler-flags.m4 squid-3.3.10/acinclude/compiler-flags.m4
--- squid-3.3.9/acinclude/compiler-flags.m4	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/acinclude/compiler-flags.m4	2013-11-04 00:06:37.000000000 +1300
@@ -38,7 +38,7 @@
     AC_REQUIRE([AC_PROG_CC])
     SAVED_FLAGS="$CFLAGS"
     SAVED_CXXFLAGS="$CXXFLAGS"
-    CFLAGS="$CXXFLAGS $2"
+    CFLAGS="$CFLAGS $2"
     CXXFLAGS="$CXXFLAGS $2"
     AC_TRY_LINK([],[int foo; ],
       [$1=yes],[$1=no])
diff -u -r -N squid-3.3.9/ChangeLog squid-3.3.10/ChangeLog
--- squid-3.3.9/ChangeLog	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/ChangeLog	2013-11-04 00:06:37.000000000 +1300
@@ -1,4 +1,23 @@
 
+Changes to squid-3.3.10 (03 Nov 2013):
+
+	- Bug 3929: request_header_add not working for tunnel requests
+	- Bug 3923: cbdata and undefined behavior due to dynamic runtime enumeration
+	- Bug 3918: Self Test Failures on Mac OS X 10.8
+	- Bug 3887: tcp_outgoing_tos not working for IPv6
+	- Bug 3836: Fix issues with automake 1.13+ and make check
+	- Bug 3480: StoreEntry::kickProducer() segfaults in store_client::copy()
+	- Fix pinning hierarchy log information
+	- Fix close idle client connections associated with closed idle pinned connections.
+	- Fix cbdata 'error: expression result unused' errors
+	- Avoid "hot idle": A series of rapid select() calls with zero timeout.
+	- Append Connection:close to OPTIONS requests when icap_persistent_connections is off
+	- ntlm_fake_auth: pass DOMAIN data to Squid in original case
+	- kerberos_ldap_group: fix LDAP string duplication
+	- Use IPv6 localhost nameserver on DNS configuration errors
+	- Add cache_miss_revalidate
+	- ... and several portability improvements
+
 Changes to squid-3.3.9 (11 Sep 2013):
 
 	- Regression Bug 3077: off-by-one error in Digest header decoding
diff -u -r -N squid-3.3.9/configure squid-3.3.10/configure
--- squid-3.3.9/configure	2013-09-11 16:09:44.000000000 +1200
+++ squid-3.3.10/configure	2013-11-04 00:08:19.000000000 +1300
@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision.
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for Squid Web Proxy 3.3.9.
+# Generated by GNU Autoconf 2.68 for Squid Web Proxy 3.3.10.
 #
 # Report bugs to <http://bugs.squid-cache.org/>.
 #
@@ -575,8 +575,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='3.3.9'
-PACKAGE_STRING='Squid Web Proxy 3.3.9'
+PACKAGE_VERSION='3.3.10'
+PACKAGE_STRING='Squid Web Proxy 3.3.10'
 PACKAGE_BUGREPORT='http://bugs.squid-cache.org/'
 PACKAGE_URL=''
 
@@ -733,6 +733,10 @@
 STORE_TESTS
 STORE_LIBS_TO_ADD
 STORE_LIBS_TO_BUILD
+HAVE_FS_ROCK_FALSE
+HAVE_FS_ROCK_TRUE
+HAVE_FS_UFS_FALSE
+HAVE_FS_UFS_TRUE
 USE_AIO_WIN32_FALSE
 USE_AIO_WIN32_TRUE
 USE_AIOPS_WIN32_FALSE
@@ -1570,7 +1574,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 3.3.9 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 3.3.10 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1640,7 +1644,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 3.3.9:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 3.3.10:";;
    esac
   cat <<\_ACEOF
 
@@ -2014,7 +2018,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 3.3.9
+Squid Web Proxy configure 3.3.10
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -3110,7 +3114,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 3.3.9, which was
+It was created by Squid Web Proxy $as_me 3.3.10, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -3929,7 +3933,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='3.3.9'
+ VERSION='3.3.10'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -19908,13 +19912,30 @@
 	  "x$squid_disk_module_candidates_Blocking" != "xyes"; then
 	  as_fn_error $? "Storage module Rock requires IpcIo or Blocking DiskIO module" "$LINENO" 5
 	fi
-	STORE_TESTS="$STORE_TESTS tests/testRock$EXEEXT"
+	squid_do_build_rock=true
 	;;
     ufs)
-      STORE_TESTS="$STORE_TESTS tests/testUfs$EXEEXT"
+	squid_do_build_ufs=true
+	;;
     esac
 done
 
+ if test "x$squid_do_build_ufs" = "xtrue" ; then
+  HAVE_FS_UFS_TRUE=
+  HAVE_FS_UFS_FALSE='#'
+else
+  HAVE_FS_UFS_TRUE='#'
+  HAVE_FS_UFS_FALSE=
+fi
+
+ if test "x$squid_do_build_rock" = "xtrue" ; then
+  HAVE_FS_ROCK_TRUE=
+  HAVE_FS_ROCK_FALSE='#'
+else
+  HAVE_FS_ROCK_TRUE='#'
+  HAVE_FS_ROCK_FALSE=
+fi
+
 
 
 
@@ -31294,6 +31315,14 @@
   as_fn_error $? "conditional \"USE_AIO_WIN32\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
+if test -z "${HAVE_FS_UFS_TRUE}" && test -z "${HAVE_FS_UFS_FALSE}"; then
+  as_fn_error $? "conditional \"HAVE_FS_UFS\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
+if test -z "${HAVE_FS_ROCK_TRUE}" && test -z "${HAVE_FS_ROCK_FALSE}"; then
+  as_fn_error $? "conditional \"HAVE_FS_ROCK\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
 if test -z "${ENABLE_PINGER_TRUE}" && test -z "${ENABLE_PINGER_FALSE}"; then
   as_fn_error $? "conditional \"ENABLE_PINGER\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
@@ -31832,7 +31861,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 3.3.9, which was
+This file was extended by Squid Web Proxy $as_me 3.3.10, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -31898,7 +31927,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-Squid Web Proxy config.status 3.3.9
+Squid Web Proxy config.status 3.3.10
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 
diff -u -r -N squid-3.3.9/configure.ac squid-3.3.10/configure.ac
--- squid-3.3.9/configure.ac	2013-09-11 16:09:44.000000000 +1200
+++ squid-3.3.10/configure.ac	2013-11-04 00:08:19.000000000 +1300
@@ -1,4 +1,4 @@
-AC_INIT([Squid Web Proxy],[3.3.9],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[3.3.10],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
@@ -820,13 +820,16 @@
 	  "x$squid_disk_module_candidates_Blocking" != "xyes"; then
 	  AC_MSG_ERROR([Storage module Rock requires IpcIo or Blocking DiskIO module])
 	fi
-	STORE_TESTS="$STORE_TESTS tests/testRock$EXEEXT"
+	squid_do_build_rock=true
 	;;
     ufs)
-      STORE_TESTS="$STORE_TESTS tests/testUfs$EXEEXT"
+	squid_do_build_ufs=true
+	;;
     esac
 done
-
+ 
+AM_CONDITIONAL(HAVE_FS_UFS,[test "x$squid_do_build_ufs" = "xtrue" ])
+AM_CONDITIONAL(HAVE_FS_ROCK,[test "x$squid_do_build_rock" = "xtrue" ])
 dnl hack: need to define those even if not used in the build system to
 dnl make sure that global FS objects are linked to the squid binary.
 AH_TEMPLATE(HAVE_FS_UFS, "Define to 1 if ufs filesystem module is build")
diff -u -r -N squid-3.3.9/helpers/basic_auth/DB/basic_db_auth.8 squid-3.3.10/helpers/basic_auth/DB/basic_db_auth.8
--- squid-3.3.9/helpers/basic_auth/DB/basic_db_auth.8	2013-09-11 16:31:37.000000000 +1200
+++ squid-3.3.10/helpers/basic_auth/DB/basic_db_auth.8	2013-11-04 00:26:39.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_DB_AUTH 1"
-.TH BASIC_DB_AUTH 1 "2013-09-10" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH BASIC_DB_AUTH 1 "2013-11-03" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.3.9/helpers/external_acl/kerberos_ldap_group/support_ldap.cc squid-3.3.10/helpers/external_acl/kerberos_ldap_group/support_ldap.cc
--- squid-3.3.9/helpers/external_acl/kerberos_ldap_group/support_ldap.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/helpers/external_acl/kerberos_ldap_group/support_ldap.cc	2013-11-04 00:06:37.000000000 +1300
@@ -643,11 +643,11 @@
     memset(url, 0, sizeof(*url));
 #ifdef HAVE_LDAP_URL_LUD_SCHEME
     if (ssl)
-        url->lud_scheme = (char *) "ldaps";
+        url->lud_scheme = xstrdup("ldaps");
     else
-        url->lud_scheme = (char *) "ldap";
+        url->lud_scheme = xstrdup("ldap");
 #endif
-    url->lud_host = host;
+    url->lud_host = xstrdup(host);
     url->lud_port = port;
 #ifdef HAVE_LDAP_SCOPE_DEFAULT
     url->lud_scope = LDAP_SCOPE_DEFAULT;
@@ -710,9 +710,9 @@
             url = (LDAPURLDesc *) xmalloc(sizeof(*url));
             memset(url, 0, sizeof(*url));
 #ifdef HAVE_LDAP_URL_LUD_SCHEME
-            url->lud_scheme = (char *) "ldaps";
+            url->lud_scheme = xstrdup("ldaps");
 #endif
-            url->lud_host = host;
+            url->lud_host = xstrdup(host);
             url->lud_port = port;
 #ifdef HAVE_LDAP_SCOPE_DEFAULT
             url->lud_scope = LDAP_SCOPE_DEFAULT;
diff -u -r -N squid-3.3.9/helpers/external_acl/SQL_session/ext_sql_session_acl.8 squid-3.3.10/helpers/external_acl/SQL_session/ext_sql_session_acl.8
--- squid-3.3.9/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2013-09-11 16:31:43.000000000 +1200
+++ squid-3.3.10/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2013-11-04 00:27:22.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_SQL_SESSION_ACL 1"
-.TH EXT_SQL_SESSION_ACL 1 "2013-09-10" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH EXT_SQL_SESSION_ACL 1 "2013-11-03" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.3.9/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8 squid-3.3.10/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8
--- squid-3.3.9/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2013-09-11 16:31:43.000000000 +1200
+++ squid-3.3.10/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2013-11-04 00:27:24.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_WBINFO_GROUP_ACL.PL.IN 1"
-.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2013-09-10" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2013-11-03" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.3.9/helpers/log_daemon/DB/log_db_daemon.8 squid-3.3.10/helpers/log_daemon/DB/log_db_daemon.8
--- squid-3.3.9/helpers/log_daemon/DB/log_db_daemon.8	2013-09-11 16:31:44.000000000 +1200
+++ squid-3.3.10/helpers/log_daemon/DB/log_db_daemon.8	2013-11-04 00:27:28.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "LOG_DB_DAEMON 1"
-.TH LOG_DB_DAEMON 1 "2013-09-10" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH LOG_DB_DAEMON 1 "2013-11-03" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.3.9/helpers/ntlm_auth/fake/ntlm_fake_auth.cc squid-3.3.10/helpers/ntlm_auth/fake/ntlm_fake_auth.cc
--- squid-3.3.9/helpers/ntlm_auth/fake/ntlm_fake_auth.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/helpers/ntlm_auth/fake/ntlm_fake_auth.cc	2013-11-04 00:06:37.000000000 +1300
@@ -224,7 +224,6 @@
             } else if (ntlm_validate_packet(packet, NTLM_AUTHENTICATE) == NTLM_ERR_NONE) {
                 if (ntlm_unpack_auth((ntlm_authenticate *)packet, user, domain, decodedLen) == NTLM_ERR_NONE) {
                     lc(user);
-                    lc(domain);
                     if (strip_domain_enabled) {
                         SEND2("AF %s", user);
                     } else {
@@ -232,7 +231,6 @@
                     }
                 } else {
                     lc(user);
-                    lc(domain);
                     SEND4("NA invalid credentials, user=%s%s%s", domain, (*domain?"\\":""), user);
                 }
             } else {
diff -u -r -N squid-3.3.9/include/version.h squid-3.3.10/include/version.h
--- squid-3.3.9/include/version.h	2013-09-11 16:09:46.000000000 +1200
+++ squid-3.3.10/include/version.h	2013-11-04 00:08:20.000000000 +1300
@@ -7,7 +7,7 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1378872515
+#define SQUID_RELEASE_TIME 1383476793
 #endif
 
 #ifndef APP_SHORTNAME
diff -u -r -N squid-3.3.9/lib/ntlmauth/ntlmauth.cc squid-3.3.10/lib/ntlmauth/ntlmauth.cc
--- squid-3.3.9/lib/ntlmauth/ntlmauth.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/lib/ntlmauth/ntlmauth.cc	2013-11-04 00:06:37.000000000 +1300
@@ -99,8 +99,6 @@
     return NTLM_ERR_NONE;
 }
 
-#define lstring_zero(s) s.str=NULL; s.l=-1;
-
 /**
  * Fetches a string from the authentication packet.
  * The lstring data-part may point to inside the packet itself or a temporary static buffer.
@@ -119,7 +117,8 @@
     lstring rv;
     char *d;
 
-    lstring_zero(rv);
+    rv.str = NULL;
+    rv.l = -1;
 
     l = le16toh(str->len);
     o = le32toh(str->offset);
@@ -130,6 +129,7 @@
         return rv;
     }
     rv.str = (char *)packet + o;
+    rv.l = 0;
     if ((flags & NTLM_NEGOTIATE_ASCII) == 0) {
         /* UNICODE string */
         unsigned short *s = (unsigned short *)rv.str;
diff -u -r -N squid-3.3.9/RELEASENOTES.html squid-3.3.10/RELEASENOTES.html
--- squid-3.3.9/RELEASENOTES.html	2013-09-11 16:32:08.000000000 +1200
+++ squid-3.3.10/RELEASENOTES.html	2013-11-04 00:30:54.000000000 +1300
@@ -2,10 +2,10 @@
 <HTML>
 <HEAD>
  <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.69">
- <TITLE>Squid 3.3.9 release notes</TITLE>
+ <TITLE>Squid 3.3.10 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 3.3.9 release notes</H1>
+<H1>Squid 3.3.10 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -56,7 +56,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-3.3.9.</P>
+<P>The Squid Team are pleased to announce the release of Squid-3.3.10.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v3/3.3/">http://www.squid-cache.org/Versions/v3/3.3/</A> or the 
 <A HREF="http://www.squid-cache.org/Mirrors/http-mirrors.html">mirrors</A>.</P>
@@ -246,6 +246,12 @@
 
 <P>
 <DL>
+<DT><B>cache_miss_revalidate</B><DD>
+<P>Whether Squid is to pass-through If-Modified-Since and If-None-Match headers on cache MISS.
+Revalidation requests can prevent cache gathering objects to HIT on.</P>
+<P>Based on the Squid-2.7 <EM>ignore_ims_on_miss</EM> feature.</P>
+<P><EM>IMPORTANT:</EM> the meaning for on/off values has changed along with the name since 2.7.</P>
+
 <DT><B>request_header_add</B><DD>
 <P>New directive to add custom headers on HTTP traffic sent to upstream servers.</P>
 
@@ -302,8 +308,8 @@
 
 <P>
 <DL>
-
-<P><EM>There are no removed squid.conf options in Squid-3.3.</EM></P>
+<DT><B>ignore_ims_on_miss</B><DD>
+<P>This option has been replaced by the <EM>cache_miss_revalidate</EM> feature.</P>
 
 </DL>
 </P>
@@ -403,9 +409,6 @@
 <DT><B>external_refresh_check</B><DD>
 <P>Not yet ported from 2.7</P>
 
-<DT><B>ignore_ims_on_miss</B><DD>
-<P>Not yet ported from 2.7</P>
-
 <DT><B>location_rewrite_access</B><DD>
 <P>Not yet ported from 2.6</P>
 
diff -u -r -N squid-3.3.9/src/adaptation/icap/OptXact.cc squid-3.3.10/src/adaptation/icap/OptXact.cc
--- squid-3.3.9/src/adaptation/icap/OptXact.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/adaptation/icap/OptXact.cc	2013-11-04 00:06:37.000000000 +1300
@@ -51,6 +51,10 @@
     buf.Printf("OPTIONS " SQUIDSTRINGPH " ICAP/1.0\r\n", SQUIDSTRINGPRINT(uri));
     const String host = s.cfg().host;
     buf.Printf("Host: " SQUIDSTRINGPH ":%d\r\n", SQUIDSTRINGPRINT(host), s.cfg().port);
+
+    if (!TheConfig.reuse_connections)
+        buf.Printf("Connection: close\r\n");
+
     if (TheConfig.allow206_enable)
         buf.Printf("Allow: 206\r\n");
     buf.append(ICAP::crlf, 2);
diff -u -r -N squid-3.3.9/src/cache_cf.cc squid-3.3.10/src/cache_cf.cc
--- squid-3.3.9/src/cache_cf.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/cache_cf.cc	2013-11-04 00:06:37.000000000 +1300
@@ -984,6 +984,14 @@
         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
         Config.redirectChildren.concurrency = cval;
     }
+
+    if (!strcmp(name, "ignore_ims_on_miss")) {
+        // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
+        // than the 2.7 directive. We need to parse and invert the configured value.
+        int temp = 0;
+        parse_onoff(&temp);
+        Config.onoff.cache_miss_revalidate = !temp;
+    }
 }
 
 /* Parse a time specification from the config file.  Store the
diff -u -r -N squid-3.3.9/src/cbdata.h squid-3.3.10/src/cbdata.h
--- squid-3.3.9/src/cbdata.h	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/cbdata.h	2013-11-04 00:06:37.000000000 +1300
@@ -224,14 +224,12 @@
 
 /**
  *\ingroup CBDATAAPI
- * cbdata types. similar to the MEM_* types above, but managed
- * in cbdata.c. A big difference is that these types are dynamically
- * allocated. This list is only a list of predefined types. Other types
- * are added runtime
- */
-typedef enum {
-    CBDATA_UNKNOWN = 0
-} cbdata_type;
+ * cbdata types. Similar to the MEM_* types, but managed in cbdata.cc
+ * A big difference is that cbdata types are dynamically allocated.
+ * Initially only UNKNOWN type is predefined. Other types are added runtime.
+ */
+typedef int cbdata_type;
+static const cbdata_type CBDATA_UNKNOWN = 0;
 
 /// \ingroup CBDATAAPI
 void cbdataRegisterWithCacheManager(void);
@@ -287,7 +285,8 @@
 	public: \
 		void *operator new(size_t size) { \
 		  assert(size == sizeof(type)); \
-		  (CBDATA_##type ?  CBDATA_UNKNOWN : (CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), NULL))); \
+		  if (!CBDATA_##type) \
+                      CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), NULL); \
 		  return cbdataInternalAllocDbg(CBDATA_##type,__FILE__,__LINE__); \
 		} \
   		void operator delete (void *address) { \
@@ -334,7 +333,7 @@
 /**
  * \ingroup CBDATAAPI
  *
- * This needs to be defined LAST in teh class definition. It plays with private/public states in C++.
+ * This needs to be defined LAST in the class definition. It plays with private/public states in C++.
  */
 #define CBDATA_CLASS2(type)	\
 	private: \
@@ -342,7 +341,8 @@
 	public: \
 		void *operator new(size_t size) { \
 		  assert(size == sizeof(type)); \
-		  (CBDATA_##type ?  CBDATA_UNKNOWN : (CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), NULL))); \
+		  if (!CBDATA_##type) \
+                      CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), NULL); \
 		  return (type *)cbdataInternalAlloc(CBDATA_##type); \
 		} \
   		void operator delete (void *address) { \
@@ -415,11 +415,12 @@
  * Initializes the cbdatatype. Must be called prior to the first use of cbdataAlloc() for the type.
  *
  \par
- * Alternative to CBDATA_INIT_TYPE_FREECB()
+ * Alternative to CBDATA_INIT_TYPE()
  *
  \param type		Type being initialized
+ \param free_func	The freehandler called when the last known reference to an allocated entry goes away.
  */
-#define CBDATA_INIT_TYPE(type)	(CBDATA_##type ?  CBDATA_UNKNOWN : (CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), NULL)))
+#define CBDATA_INIT_TYPE_FREECB(type, free_func) do { if (!CBDATA_##type) CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), free_func); } while (false)
 
 /**
  \ingroup CBDATAAPI
@@ -427,12 +428,11 @@
  * Initializes the cbdatatype. Must be called prior to the first use of cbdataAlloc() for the type.
  *
  \par
- * Alternative to CBDATA_INIT_TYPE()
+ * Alternative to CBDATA_INIT_TYPE_FREECB()
  *
  \param type		Type being initialized
- \param free_func	The freehandler called when the last known reference to an allocated entry goes away.
  */
-#define CBDATA_INIT_TYPE_FREECB(type, free_func)	(CBDATA_##type ?  CBDATA_UNKNOWN : (CBDATA_##type = cbdataInternalAddType(CBDATA_##type, #type, sizeof(type), free_func)))
+#define CBDATA_INIT_TYPE(type)	CBDATA_INIT_TYPE_FREECB(type, NULL)
 
 /**
  \ingroup CBDATA
diff -u -r -N squid-3.3.9/src/cf.data.pre squid-3.3.10/src/cf.data.pre
--- squid-3.3.9/src/cf.data.pre	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/cf.data.pre	2013-11-04 00:06:37.000000000 +1300
@@ -135,12 +135,6 @@
 	This option is not yet supported by Squid-3.
 DOC_END
 
-NAME: ignore_ims_on_miss
-TYPE: obsolete
-DOC_START
-	This option is not yet supported by Squid-3.
-DOC_END
-
 NAME: location_rewrite_program location_rewrite_access location_rewrite_children location_rewrite_concurrency
 TYPE: obsolete
 DOC_START
@@ -159,6 +153,13 @@
 	This option is not yet supported by this version of Squid-3. Please try a later release.
 DOC_END
 
+# Options Removed in 3.3
+NAME: ignore_ims_on_miss
+TYPE: obsolete
+DOC_START
+	Remove this line. The HTTP/1.1 feature is now fully supported by default.
+DOC_END
+
 # Options Removed in 3.2
 NAME: ignore_expect_100
 TYPE: obsolete
@@ -6876,6 +6877,25 @@
 	acts on cacheable requests.
 DOC_END
 
+NAME: cache_miss_revalidate
+COMMENT: on|off
+TYPE: onoff
+DEFAULT: on
+LOC: Config.onoff.cache_miss_revalidate
+DOC_START
+	Whether Squid on cache MISS will pass client revalidation requests
+	to the server or tries to fetch new content for caching.
+	This is useful while the cache is mostly empty to more quickly
+	have the cache populated.
+
+	When set to 'on' (default), Squid will pass all client If-* headers
+	to the server.
+
+	When set to 'off' and if the request is cacheable, Squid will
+	remove the clients If-Modified-Since and If-None-Match headers from
+	the request sent to the server.
+DOC_END
+
 NAME: always_direct
 TYPE: acl_access
 LOC: Config.accessList.AlwaysDirect
diff -u -r -N squid-3.3.9/src/client_side.cc squid-3.3.10/src/client_side.cc
--- squid-3.3.9/src/client_side.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/client_side.cc	2013-11-04 00:06:37.000000000 +1300
@@ -4425,7 +4425,7 @@
     pinning.closeHandler = NULL; // Comm unregisters handlers before calling
     const bool sawZeroReply = pinning.zeroReply; // reset when unpinning
     unpinConnection();
-    if (sawZeroReply) {
+    if (sawZeroReply && clientConnection != NULL) {
         debugs(33, 3, "Closing client connection on pinned zero reply.");
         clientConnection->close();
     }
@@ -4437,8 +4437,10 @@
     char desc[FD_DESC_SZ];
 
     if (Comm::IsConnOpen(pinning.serverConnection)) {
-        if (pinning.serverConnection->fd == pinServer->fd)
+        if (pinning.serverConnection->fd == pinServer->fd) {
+            startPinnedConnectionMonitoring();
             return;
+        }
     }
 
     unpinConnection(); // closes pinned connection, if any, and resets fields
@@ -4475,6 +4477,57 @@
     Params &params = GetCommParams<Params>(pinning.closeHandler);
     params.conn = pinning.serverConnection;
     comm_add_close_handler(pinning.serverConnection->fd, pinning.closeHandler);
+
+    startPinnedConnectionMonitoring();
+}
+
+/// Assign a read handler to an idle pinned connection so that we can detect connection closures.
+void
+ConnStateData::startPinnedConnectionMonitoring()
+{
+    if (pinning.readHandler != NULL)
+        return; // already monitoring
+
+    typedef CommCbMemFunT<ConnStateData, CommIoCbParams> Dialer;
+    pinning.readHandler = JobCallback(33, 3,
+                                      Dialer, this, ConnStateData::clientPinnedConnectionRead);
+    static char unusedBuf[8];
+    comm_read(pinning.serverConnection, unusedBuf, sizeof(unusedBuf), pinning.readHandler);
+}
+
+void
+ConnStateData::stopPinnedConnectionMonitoring()
+{
+    if (pinning.readHandler != NULL) {
+        comm_read_cancel(pinning.serverConnection->fd, pinning.readHandler);
+        pinning.readHandler = NULL;
+    }
+}
+
+/// Our read handler called by Comm when the server either closes an idle pinned connection or
+/// perhaps unexpectedly sends something on that idle (from Squid p.o.v.) connection.
+void
+ConnStateData::clientPinnedConnectionRead(const CommIoCbParams &io)
+{
+    pinning.readHandler = NULL; // Comm unregisters handlers before calling
+
+    if (io.flag == COMM_ERR_CLOSING)
+        return; // close handler will clean up
+
+    // We could use getConcurrentRequestCount(), but this may be faster.
+    const bool clientIsIdle = !getCurrentContext();
+
+    debugs(33, 3, "idle pinned " << pinning.serverConnection << " read " <<
+           io.size << (clientIsIdle ? " with idle client" : ""));
+
+    assert(pinning.serverConnection == io.conn);
+    pinning.serverConnection->close();
+
+    // If we are still sending data to the client, do not close now. When we are done sending,
+    // ClientSocketContext::keepaliveNextRequest() checks pinning.serverConnection and will close.
+    // However, if we are idle, then we must close to inform the idle client and minimize races.
+    if (clientIsIdle && clientConnection != NULL)
+        clientConnection->close();
 }
 
 const Comm::ConnectionPointer
diff -u -r -N squid-3.3.9/src/client_side.h squid-3.3.10/src/client_side.h
--- squid-3.3.9/src/client_side.h	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/client_side.h	2013-11-04 00:06:37.000000000 +1300
@@ -265,6 +265,7 @@
         bool auth;               /* pinned for www authentication */
         bool zeroReply; ///< server closed w/o response (ERR_ZERO_SIZE_OBJECT)
         CachePeer *peer;             /* CachePeer the connection goes via */
+        AsyncCall::Pointer readHandler; ///< detects serverConnection closure
         AsyncCall::Pointer closeHandler; /*The close handler for pinned server side connection*/
     } pinning;
 
@@ -330,6 +331,9 @@
     /// the client-side-detected error response instead of getting stuck.
     void quitAfterError(HttpRequest *request); // meant to be private
 
+    /// The caller assumes responsibility for connection closure detection.
+    void stopPinnedConnectionMonitoring();
+
 #if USE_SSL
     /// called by FwdState when it is done bumping the server
     void httpsPeeked(Comm::ConnectionPointer serverConnection);
@@ -377,6 +381,9 @@
     void abortChunkedRequestBody(const err_type error);
     err_type handleChunkedRequestBody(size_t &putSize);
 
+    void startPinnedConnectionMonitoring();
+    void clientPinnedConnectionRead(const CommIoCbParams &io);
+
 private:
     int connReadWasError(comm_err_t flag, int size, int xerrno);
     int connFinishedWithConn(int size);
diff -u -r -N squid-3.3.9/src/client_side_request.cc squid-3.3.10/src/client_side_request.cc
--- squid-3.3.9/src/client_side_request.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/client_side_request.cc	2013-11-04 00:06:37.000000000 +1300
@@ -1386,7 +1386,7 @@
 #endif
         logType = LOG_TCP_MISS;
         getConn()->stopReading(); // tunnels read for themselves
-        tunnelStart(this, &out.size, &al->http.code);
+        tunnelStart(this, &out.size, &al->http.code, al);
         return;
     }
 
diff -u -r -N squid-3.3.9/src/client_side_request.h squid-3.3.10/src/client_side_request.h
--- squid-3.3.9/src/client_side_request.h	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/client_side_request.h	2013-11-04 00:06:37.000000000 +1300
@@ -207,7 +207,7 @@
 
 /* ones that should be elsewhere */
 void redirectStart(ClientHttpRequest *, RH *, void *);
-void tunnelStart(ClientHttpRequest *, int64_t *, int *);
+void tunnelStart(ClientHttpRequest *, int64_t *, int *, const AccessLogEntry::Pointer &al);
 
 #if _USE_INLINE_
 #include "Store.h"
diff -u -r -N squid-3.3.9/src/dns_internal.cc squid-3.3.10/src/dns_internal.cc
--- squid-3.3.9/src/dns_internal.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/dns_internal.cc	2013-11-04 00:06:37.000000000 +1300
@@ -1555,6 +1555,8 @@
 #endif
 
         debugs(78, DBG_IMPORTANT, "or use the 'dns_nameservers' option in squid.conf.");
+        if (Ip::EnableIpv6)
+            idnsAddNameserver("::1");
         idnsAddNameserver("127.0.0.1");
     }
 
diff -u -r -N squid-3.3.9/src/event.cc squid-3.3.10/src/event.cc
--- squid-3.3.9/src/event.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/event.cc	2013-11-04 00:06:37.000000000 +1300
@@ -39,6 +39,10 @@
 #include "profiler/Profiler.h"
 #include "tools.h"
 
+#if HAVE_MATH_H
+#include <math.h>
+#endif
+
 /* The list of event processes */
 
 static OBJH eventDump;
@@ -219,39 +223,37 @@
         debug_trap("eventDelete: event not found");
 }
 
+// The event API does not guarantee exact timing, but guarantees that no event
+// is fired before it is due. We may delay firing, but never fire too early.
 int
-EventScheduler::checkDelay()
+EventScheduler::timeRemaining() const
 {
     if (!tasks)
         return EVENT_IDLE;
 
-    int result = (int) ((tasks->when - current_dtime) * 1000);
-
-    if (result < 0)
-        return 0;
+    if (tasks->when <= current_dtime) // we are on time or late
+        return 0; // fire the event ASAP
 
-    return result;
+    const double diff = tasks->when - current_dtime; // microseconds
+    // Round UP: If we come back a nanosecond earlier, we will wait again!
+    const int timeLeft = static_cast<int>(ceil(1000*diff)); // milliseconds
+    // Avoid hot idle: A series of rapid select() calls with zero timeout.
+    const int minDelay = 1; // millisecond
+    return max(minDelay, timeLeft);
 }
 
 int
 EventScheduler::checkEvents(int timeout)
 {
-
-    ev_entry *event = NULL;
-
-    if (NULL == tasks)
-        return checkDelay();
-
-    if (tasks->when > current_dtime)
-        return checkDelay();
+    int result = timeRemaining();
+    if (result != 0)
+        return result;
 
     PROF_start(eventRun);
 
-    debugs(41, 5, HERE << "checkEvents");
-
-    while ((event = tasks)) {
-        if (event->when > current_dtime)
-            break;
+    do {
+        ev_entry *event = tasks;
+        assert(event);
 
         /* XXX assumes event->name is static memory! */
         AsyncCall::Pointer call = asyncCall(41,5, event->name,
@@ -265,14 +267,16 @@
         tasks = event->next;
         delete event;
 
+        result = timeRemaining();
+
         // XXX: We may be called again during the same event loop iteration.
         // Is there a point in breaking now?
         if (heavy)
             break; // do not dequeue events following a heavy event
-    }
+    } while (result == 0);
 
     PROF_stop(eventRun);
-    return checkDelay();
+    return result;
 }
 
 void
diff -u -r -N squid-3.3.9/src/event.h squid-3.3.10/src/event.h
--- squid-3.3.9/src/event.h	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/event.h	2013-11-04 00:06:37.000000000 +1300
@@ -80,8 +80,8 @@
     void cancel(EVH * func, void * arg);
     /* clean up the used memory in the scheduler */
     void clean();
-    /* how long until the next event ? */
-    int checkDelay();
+    /* either EVENT_IDLE or milliseconds remaining until the next event */
+    int timeRemaining() const;
     /* cache manager output for the event queue */
     void dump(StoreEntry *);
     /* find a scheduled event */
diff -u -r -N squid-3.3.9/src/forward.cc squid-3.3.10/src/forward.cc
--- squid-3.3.9/src/forward.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/forward.cc	2013-11-04 00:06:37.000000000 +1300
@@ -975,6 +975,7 @@
         else
             serverConn = NULL;
         if (Comm::IsConnOpen(serverConn)) {
+            pinned_connection->stopPinnedConnectionMonitoring();
             flags.connected_okay = true;
 #if 0
             if (!serverConn->getPeer())
@@ -982,6 +983,7 @@
 #endif
             ++n_tries;
             request->flags.pinned = 1;
+            request->hier.note(serverConn, pinned_connection->pinning.host);
             if (pinned_connection->pinnedAuth())
                 request->flags.auth = 1;
             comm_add_close_handler(serverConn->fd, fwdServerClosedWrapper, this);
diff -u -r -N squid-3.3.9/src/http.cc squid-3.3.10/src/http.cc
--- squid-3.3.9/src/http.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/http.cc	2013-11-04 00:06:37.000000000 +1300
@@ -1978,12 +1978,30 @@
 
     case HDR_IF_MODIFIED_SINCE:
         /** \par If-Modified-Since:
-        * append unless we added our own;
-         * \note at most one client's ims header can pass through */
-
-        if (!hdr_out->has(HDR_IF_MODIFIED_SINCE))
+         * append unless we added our own,
+         * but only if cache_miss_revalidate is enabled, or
+         *  the request is not cacheable, or
+         *  the request contains authentication credentials.
+         * \note at most one client's If-Modified-Since header can pass through
+         */
+        // XXX: need to check and cleanup the auth case so cacheable auth requests get cached.
+        if (hdr_out->has(HDR_IF_MODIFIED_SINCE))
+            break;
+        else if (Config.onoff.cache_miss_revalidate || !request->flags.cachable || request->flags.auth)
             hdr_out->addEntry(e->clone());
+        break;
 
+    case HDR_IF_NONE_MATCH:
+        /** \par If-None-Match:
+         * append if the wildcard '*' special case value is present, or
+         *   cache_miss_revalidate is disabled, or
+         *   the request is not cacheable in this proxy, or
+         *   the request contains authentication credentials.
+         * \note this header lists a set of responses for the server to elide sending. Squid added values are extending that set.
+         */
+        // XXX: need to check and cleanup the auth case so cacheable auth requests get cached.
+        if (hdr_out->hasListMember(HDR_IF_MATCH, "*", ',') || Config.onoff.cache_miss_revalidate || !request->flags.cachable || request->flags.auth)
+            hdr_out->addEntry(e->clone());
         break;
 
     case HDR_MAX_FORWARDS:
diff -u -r -N squid-3.3.9/src/ip/Qos.cci squid-3.3.10/src/ip/Qos.cci
--- squid-3.3.9/src/ip/Qos.cci	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/ip/Qos.cci	2013-11-04 00:06:37.000000000 +1300
@@ -5,20 +5,40 @@
 int
 Ip::Qos::setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
 {
-#if defined(IP_TOS)
     // Bug 3731: FreeBSD produces 'invalid option'
     // unless we pass it a 32-bit variable storing 8-bits of data.
     // NP: it is documented as 'int' for all systems, even those like Linux which accept 8-bit char
     //     so we convert to a int before setting.
     int bTos = tos;
-    int x = setsockopt(conn->fd, IPPROTO_IP, IP_TOS, &bTos, sizeof(bTos));
-    if (x < 0)
-        debugs(50, 2, "Ip::Qos::setSockTos: setsockopt(IP_TOS) on " << conn << ": " << xstrerror());
-    return x;
+
+    if (conn->remote.IsIPv4()) {
+#if defined(IP_TOS)
+        int x = setsockopt(conn->fd, IPPROTO_IP, IP_TOS, &bTos, sizeof(bTos));
+        if (x < 0)
+            debugs(50, 2, "Ip::Qos::setSockTos: setsockopt(IP_TOS) on " << conn << ": " << xstrerror());
+        else
+            conn->tos = tos;
+        return x;
 #else
-    debugs(50, DBG_IMPORTANT, "WARNING: setsockopt(IP_TOS) not supported on this platform");
-    return -1;
+        debugs(50, DBG_IMPORTANT, "WARNING: setsockopt(IP_TOS) not supported on this platform");
+        return -1;
 #endif
+
+    } else { // if (conn->remote.IsIPv6()) {
+#if defined(IPV6_TCLASS)
+        int x = setsockopt(conn->fd, IPPROTO_IPV6, IPV6_TCLASS, &bTos, sizeof(bTos));
+        if (x < 0)
+            debugs(50, 2, "Ip::Qos::setSockTos: setsockopt(IPV6_TCLASS) on " << conn << ": " << xstrerror());
+        else
+            conn->tos = tos;
+        return x;
+#else
+        debugs(50, DBG_IMPORTANT, "WARNING: setsockopt(IPV6_TCLASS) not supported on this platform");
+        return -1;
+#endif
+    }
+
+    /* CANNOT REACH HERE */
 }
 
 int
diff -u -r -N squid-3.3.9/src/main.cc squid-3.3.10/src/main.cc
--- squid-3.3.9/src/main.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/main.cc	2013-11-04 00:06:37.000000000 +1300
@@ -808,7 +808,7 @@
     if (oldWorkers != Config.workers) {
         debugs(1, DBG_CRITICAL, "WARNING: Changing 'workers' (from " <<
                oldWorkers << " to " << Config.workers <<
-               ") is not supported and ignored");
+               ") requires a full restart. It has been ignored by reconfigure.");
         Config.workers = oldWorkers;
     }
 
diff -u -r -N squid-3.3.9/src/Makefile.am squid-3.3.10/src/Makefile.am
--- squid-3.3.9/src/Makefile.am	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/Makefile.am	2013-11-04 00:06:37.000000000 +1300
@@ -1089,6 +1089,13 @@
 	tests/testStatHist \
 	$(STORE_TESTS)
 
+if HAVE_FS_ROCK
+check_PROGRAMS += tests/testRock
+endif
+if HAVE_FS_UFS
+check_PROGRAMS += tests/testUfs
+endif
+
 ## NP: required to run the above list. check_PROGRAMS only builds the binaries...
 TESTS += $(check_PROGRAMS)
 
@@ -3268,8 +3275,8 @@
 	cache_cf.h \
 	YesNoNone.h \
 	tests/stub_cache_cf.cc \
-	tests/stub_cache_manager.cc \
 	client_db.h \
+	tests/stub_cache_manager.cc \
 	tests/stub_client_db.cc \
 	tests/stub_client_side_request.cc \
 	tests/stub_debug.cc \
@@ -3282,6 +3289,7 @@
 	tests/stub_ipcache.cc \
 	tests/stub_libformat.cc \
 	tests/stub_libicmp.cc \
+	tests/stub_libmgr.cc \
 	tests/stub_MemStore.cc \
 	mime.h \
 	tests/stub_mime.cc \
@@ -3323,7 +3331,6 @@
 	acl/libstate.la \
 	eui/libeui.la \
 	ipc/libipc.la \
-	mgr/libmgr.la \
 	base/libbase.la \
 	$(SSL_LIBS) \
 	$(top_builddir)/lib/libmisccontainers.la \
diff -u -r -N squid-3.3.9/src/Makefile.in squid-3.3.10/src/Makefile.in
--- squid-3.3.9/src/Makefile.in	2013-09-11 16:09:23.000000000 +1200
+++ squid-3.3.10/src/Makefile.in	2013-11-04 00:07:53.000000000 +1300
@@ -55,7 +55,8 @@
 	tests/testHttpReply$(EXEEXT) tests/testHttpRequest$(EXEEXT) \
 	tests/testStore$(EXEEXT) tests/testString$(EXEEXT) \
 	tests/testURL$(EXEEXT) tests/testConfigParser$(EXEEXT) \
-	tests/testStatHist$(EXEEXT) $(STORE_TESTS)
+	tests/testStatHist$(EXEEXT) $(STORE_TESTS) $(am__EXEEXT_2) \
+	$(am__EXEEXT_3)
 @USE_LOADABLE_MODULES_TRUE@am__append_1 = $(INCLTDL)
 @ENABLE_AUTH_TRUE@am__append_2 = auth
 @ENABLE_AUTH_TRUE@am__append_3 = tests/testACLMaxUserIP
@@ -71,10 +72,12 @@
 noinst_PROGRAMS = cf_gen$(EXEEXT)
 sbin_PROGRAMS = squid$(EXEEXT)
 bin_PROGRAMS =
-libexec_PROGRAMS = $(am__EXEEXT_2) $(DISK_PROGRAMS) $(am__EXEEXT_3)
+libexec_PROGRAMS = $(am__EXEEXT_4) $(DISK_PROGRAMS) $(am__EXEEXT_5)
 @USE_LOADABLE_MODULES_TRUE@am__append_8 = $(LOADABLE_MODULES_SOURCES)
 @USE_LOADABLE_MODULES_TRUE@am__append_9 = -L$(top_builddir) $(LIBLTDL)
 @USE_LOADABLE_MODULES_TRUE@am__append_10 = $(INCLTDL)
+@HAVE_FS_ROCK_TRUE@am__append_11 = tests/testRock
+@HAVE_FS_UFS_TRUE@am__append_12 = tests/testUfs
 subdir = src
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/acinclude/init.m4 \
@@ -168,8 +171,10 @@
 	"$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)" \
 	"$(DESTDIR)$(datadir)" "$(DESTDIR)$(sysconfdir)"
 @ENABLE_AUTH_TRUE@am__EXEEXT_1 = tests/testACLMaxUserIP$(EXEEXT)
-@ENABLE_DNSHELPER_TRUE@am__EXEEXT_2 = dnsserver$(EXEEXT)
-@ENABLE_UNLINKD_TRUE@am__EXEEXT_3 = unlinkd$(EXEEXT)
+@HAVE_FS_ROCK_TRUE@am__EXEEXT_2 = tests/testRock$(EXEEXT)
+@HAVE_FS_UFS_TRUE@am__EXEEXT_3 = tests/testUfs$(EXEEXT)
+@ENABLE_DNSHELPER_TRUE@am__EXEEXT_4 = dnsserver$(EXEEXT)
+@ENABLE_UNLINKD_TRUE@am__EXEEXT_5 = unlinkd$(EXEEXT)
 PROGRAMS = $(bin_PROGRAMS) $(libexec_PROGRAMS) $(noinst_PROGRAMS) \
 	$(sbin_PROGRAMS)
 am_DiskIO_DiskDaemon_diskd_OBJECTS =  \
@@ -1298,14 +1303,15 @@
 	tests/testMain.cc tests/testRock.h tests/testStoreSupport.cc \
 	tests/testStoreSupport.h log/access_log.h \
 	tests/stub_access_log.cc cache_cf.h YesNoNone.h \
-	tests/stub_cache_cf.cc tests/stub_cache_manager.cc client_db.h \
+	tests/stub_cache_cf.cc client_db.h tests/stub_cache_manager.cc \
 	tests/stub_client_db.cc tests/stub_client_side_request.cc \
 	tests/stub_debug.cc tests/stub_errorpage.cc \
 	tests/stub_HelperChildConfig.cc tests/stub_http.cc \
 	tests/stub_HttpRequest.cc tests/stub_icp.cc tests/stub_ipc.cc \
 	tests/stub_ipcache.cc tests/stub_libformat.cc \
-	tests/stub_libicmp.cc tests/stub_MemStore.cc mime.h \
-	tests/stub_mime.cc tests/stub_Port.cc tests/stub_pconn.cc \
+	tests/stub_libicmp.cc tests/stub_libmgr.cc \
+	tests/stub_MemStore.cc mime.h tests/stub_mime.cc \
+	tests/stub_Port.cc tests/stub_pconn.cc \
 	tests/stub_store_client.cc store_rebuild.h \
 	tests/stub_store_rebuild.cc tests/stub_store_stats.cc tools.h \
 	tests/stub_tools.cc time.cc url.cc URLScheme.cc wordlist.h \
@@ -1355,9 +1361,10 @@
 	tests/stub_http.$(OBJEXT) tests/stub_HttpRequest.$(OBJEXT) \
 	tests/stub_icp.$(OBJEXT) tests/stub_ipc.$(OBJEXT) \
 	tests/stub_ipcache.$(OBJEXT) tests/stub_libformat.$(OBJEXT) \
-	tests/stub_libicmp.$(OBJEXT) tests/stub_MemStore.$(OBJEXT) \
-	tests/stub_mime.$(OBJEXT) tests/stub_Port.$(OBJEXT) \
-	tests/stub_pconn.$(OBJEXT) tests/stub_store_client.$(OBJEXT) \
+	tests/stub_libicmp.$(OBJEXT) tests/stub_libmgr.$(OBJEXT) \
+	tests/stub_MemStore.$(OBJEXT) tests/stub_mime.$(OBJEXT) \
+	tests/stub_Port.$(OBJEXT) tests/stub_pconn.$(OBJEXT) \
+	tests/stub_store_client.$(OBJEXT) \
 	tests/stub_store_rebuild.$(OBJEXT) \
 	tests/stub_store_stats.$(OBJEXT) tests/stub_tools.$(OBJEXT) \
 	time.$(OBJEXT) url.$(OBJEXT) URLScheme.$(OBJEXT) \
@@ -5025,8 +5032,8 @@
 	cache_cf.h \
 	YesNoNone.h \
 	tests/stub_cache_cf.cc \
-	tests/stub_cache_manager.cc \
 	client_db.h \
+	tests/stub_cache_manager.cc \
 	tests/stub_client_db.cc \
 	tests/stub_client_side_request.cc \
 	tests/stub_debug.cc \
@@ -5039,6 +5046,7 @@
 	tests/stub_ipcache.cc \
 	tests/stub_libformat.cc \
 	tests/stub_libicmp.cc \
+	tests/stub_libmgr.cc \
 	tests/stub_MemStore.cc \
 	mime.h \
 	tests/stub_mime.cc \
@@ -5082,7 +5090,6 @@
 	acl/libstate.la \
 	eui/libeui.la \
 	ipc/libipc.la \
-	mgr/libmgr.la \
 	base/libbase.la \
 	$(SSL_LIBS) \
 	$(top_builddir)/lib/libmisccontainers.la \
@@ -6248,6 +6255,8 @@
 	$(tests_testNull_LINK) $(tests_testNull_OBJECTS) $(tests_testNull_LDADD) $(LIBS)
 tests/testRock.$(OBJEXT): tests/$(am__dirstamp) \
 	tests/$(DEPDIR)/$(am__dirstamp)
+tests/stub_libmgr.$(OBJEXT): tests/$(am__dirstamp) \
+	tests/$(DEPDIR)/$(am__dirstamp)
 tests/testRock$(EXEEXT): $(tests_testRock_OBJECTS) $(tests_testRock_DEPENDENCIES) tests/$(am__dirstamp)
 	@rm -f tests/testRock$(EXEEXT)
 	$(tests_testRock_LINK) $(tests_testRock_OBJECTS) $(tests_testRock_LDADD) $(LIBS)
@@ -6367,6 +6376,7 @@
 	-rm -f tests/stub_libcomm.$(OBJEXT)
 	-rm -f tests/stub_libformat.$(OBJEXT)
 	-rm -f tests/stub_libicmp.$(OBJEXT)
+	-rm -f tests/stub_libmgr.$(OBJEXT)
 	-rm -f tests/stub_libsslsquid.$(OBJEXT)
 	-rm -f tests/stub_main_cc.$(OBJEXT)
 	-rm -f tests/stub_mem.$(OBJEXT)
@@ -6647,6 +6657,7 @@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_libcomm.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_libformat.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_libicmp.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_libmgr.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_libsslsquid.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_main_cc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/stub_mem.Po@am__quote@
diff -u -r -N squid-3.3.9/src/SquidConfig.h squid-3.3.10/src/SquidConfig.h
--- squid-3.3.9/src/SquidConfig.h	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/SquidConfig.h	2013-11-04 00:06:37.000000000 +1300
@@ -337,6 +337,7 @@
         int check_hostnames;
         int allow_underscore;
         int via;
+        int cache_miss_revalidate;
         int emailErrData;
         int httpd_suppress_version_string;
         int global_internal_static;
diff -u -r -N squid-3.3.9/src/store_client.cc squid-3.3.10/src/store_client.cc
--- squid-3.3.9/src/store_client.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/store_client.cc	2013-11-04 00:06:37.000000000 +1300
@@ -264,12 +264,20 @@
     PROF_stop(storeClient_kickReads);
     copying = false;
 
+    // XXX: storeClientCopy2 calls doCopy() whose callback may free 'this'!
+    // We should make store copying asynchronous, to avoid worrying about
+    // 'this' being secretly deleted while we are still inside the object.
+    // For now, lock and use on-stack objects after storeClientCopy2().
+    ++anEntry->lock_count;
+
     storeClientCopy2(entry, this);
 
 #if USE_ADAPTATION
-    if (entry)
-        entry->kickProducer();
+    anEntry->kickProducer();
 #endif
+
+    anEntry->unlock(); // after the "++enEntry->lock_count" above
+    // Add no code here. This object may no longer exist.
 }
 
 /*
@@ -333,6 +341,9 @@
     /* Warning: doCopy may indirectly free itself in callbacks,
      * hence the lock to keep it active for the duration of
      * this function
+     * XXX: Locking does not prevent calling sc destructor (it only prevents
+     * freeing sc memory) so sc may become invalid from C++ p.o.v.
+     *
      */
     cbdataInternalLock(sc);
     assert (sc->flags.store_copying == 0);
@@ -727,7 +738,14 @@
 
     delete sc;
 
+    // This old assert seemed to imply that a locked entry cannot be deleted,
+    // but this entry may be deleted because StoreEntry::abort() unlocks it.
     assert(e->lock_count > 0);
+    // Since lock_count of 1 is not sufficient to prevent entry destruction,
+    // we must lock again so that we can dereference e after CheckQuickAbort().
+    // Do not call expensive StoreEntry::lock() here; e "use" has been counted.
+    // TODO: Separate entry locking from "use" counting to make locking cheap.
+    ++e->lock_count;
 
     if (mem->nclients == 0)
         CheckQuickAbort(e);
@@ -738,6 +756,7 @@
     e->kickProducer();
 #endif
 
+    e->unlock(); // after the "++e->lock_count" above
     return 1;
 }
 
@@ -823,7 +842,7 @@
     }
 
     if (curlen > expectlen) {
-        debugs(90, 3, "quick-abort? YES bad content length");
+        debugs(90, 3, "quick-abort? YES bad content length (" << curlen << " of " << expectlen << " bytes received)");
         return true;
     }
 
diff -u -r -N squid-3.3.9/src/tests/stub_event.cc squid-3.3.10/src/tests/stub_event.cc
--- squid-3.3.9/src/tests/stub_event.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/tests/stub_event.cc	2013-11-04 00:06:37.000000000 +1300
@@ -21,8 +21,8 @@
 EventScheduler::EventScheduler() STUB
 EventScheduler::~EventScheduler() STUB
 void EventScheduler::cancel(EVH * func, void * arg) STUB
+int EventScheduler::timeRemaining() const STUB_RETVAL(1)
 void EventScheduler::clean() STUB
-int EventScheduler::checkDelay() STUB_RETVAL(-1)
 void EventScheduler::dump(StoreEntry *) STUB
 bool EventScheduler::find(EVH * func, void * arg) STUB_RETVAL(false)
 void EventScheduler::schedule(const char *name, EVH * func, void *arg, double when, int weight, bool cbdata) STUB
diff -u -r -N squid-3.3.9/src/tests/stub_libmgr.cc squid-3.3.10/src/tests/stub_libmgr.cc
--- squid-3.3.9/src/tests/stub_libmgr.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/tests/stub_libmgr.cc	2013-11-04 00:06:37.000000000 +1300
@@ -27,8 +27,8 @@
 static Mgr::Action::Pointer dummyAction;
 
 #include "mgr/ActionParams.h"
-Mgr::ActionParams::ActionParams() STUB
-Mgr::ActionParams::ActionParams(const Ipc::TypedMsgHdr &msg) STUB
+Mgr::ActionParams::ActionParams() STUB_NOP
+Mgr::ActionParams::ActionParams(const Ipc::TypedMsgHdr &msg) STUB_NOP
 void Mgr::ActionParams::pack(Ipc::TypedMsgHdr &msg) const STUB
 std::ostream &operator <<(std::ostream &os, const Mgr::ActionParams &params) STUB_RETVAL(os)
 
@@ -174,8 +174,8 @@
 bool Mgr::QueryParams::ParseParam(const String& paramStr, Param& param) STUB_RETVAL(false)
 
 #include "mgr/Registration.h"
-void Mgr::RegisterAction(char const * action, char const * desc, OBJH * handler, int pw_req_flag, int atomic);
-void Mgr::RegisterAction(char const * action, char const * desc, ClassActionCreationHandler *handler, int pw_req_flag, int atomic);
+//void Mgr::RegisterAction(char const * action, char const * desc, OBJH * handler, int pw_req_flag, int atomic);
+//void Mgr::RegisterAction(char const * action, char const * desc, ClassActionCreationHandler *handler, int pw_req_flag, int atomic);
 
 #include "mgr/Request.h"
 //Mgr::Request::Request(int aRequestorId, unsigned int aRequestId, int aFd, const Mgr::ActionParams &aParams) STUB
diff -u -r -N squid-3.3.9/src/tests/testHttpReply.cc squid-3.3.10/src/tests/testHttpReply.cc
--- squid-3.3.9/src/tests/testHttpReply.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/tests/testHttpReply.cc	2013-11-04 00:06:37.000000000 +1300
@@ -194,7 +194,7 @@
     error = HTTP_STATUS_NONE;
 
     // status line with nul-byte
-    input.append("HTTP/1.1\0200 Okay\n\n", 19); /* real case seen */
+    input.append("HTTP/1.1" "\0" "200 Okay\n\n", 19); /* real case seen */
     hdr_len = headersEnd(input.content(),input.contentSize());
     CPPUNIT_ASSERT(!engine.sanityCheckStartLine(&input, hdr_len, &error) );
     CPPUNIT_ASSERT_EQUAL(error, HTTP_INVALID_HEADER);
diff -u -r -N squid-3.3.9/src/tunnel.cc squid-3.3.10/src/tunnel.cc
--- squid-3.3.9/src/tunnel.cc	2013-09-11 16:08:38.000000000 +1200
+++ squid-3.3.10/src/tunnel.cc	2013-11-04 00:06:37.000000000 +1300
@@ -79,6 +79,7 @@
     bool noConnections() const;
     char *url;
     HttpRequest *request;
+    AccessLogEntryPointer al;
     Comm::ConnectionList serverDestinations;
 
     const char * getHost() const {
@@ -645,7 +646,7 @@
 nfmark_t GetNfmarkToServer(HttpRequest * request);
 
 void
-tunnelStart(ClientHttpRequest * http, int64_t * size_ptr, int *status_ptr)
+tunnelStart(ClientHttpRequest * http, int64_t * size_ptr, int *status_ptr, const AccessLogEntryPointer &al)
 {
     debugs(26, 3, HERE);
     /* Create state structure. */
@@ -690,6 +691,7 @@
     tunnelState->server.size_ptr = size_ptr;
     tunnelState->status_ptr = status_ptr;
     tunnelState->client.conn = http->getConn()->clientConnection;
+    tunnelState->al = al;
 
     comm_add_close_handler(tunnelState->client.conn->fd,
                            tunnelClientClosed,
@@ -720,7 +722,7 @@
     mb.Printf("CONNECT %s HTTP/1.1\r\n", tunnelState->url);
     HttpStateData::httpBuildRequestHeader(tunnelState->request,
                                           NULL,			/* StoreEntry */
-                                          NULL,			/* AccessLogEntry */
+                                          tunnelState->al,			/* AccessLogEntry */
                                           &hdr_out,
                                           flags);			/* flags */
     packerToMemInit(&p, &mb);
