Security bump

Package-Manager: portage-2.2.15/cvs/Linux x86_64
Manifest-Sign-Key: 0x77F1F175586A3B1F

6 files changed, 613 insertions, 16 deletions

diff --git a/net-proxy/squid/ChangeLog b/net-proxy/squid/ChangeLog
index 6869b330d5f2..7d4a34509722 100644
--- a/net-proxy/squid/ChangeLog
+++ b/net-proxy/squid/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for net-proxy/squid
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-proxy/squid/ChangeLog,v 1.507 2015/02/02 07:36:58 eras Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-proxy/squid/ChangeLog,v 1.508 2015/02/04 16:10:18 eras Exp $
+
+*squid-3.4.11-r1 (04 Feb 2015)
+*squid-3.5.1-r1 (04 Feb 2015)
+
+  04 Feb 2015; Eray Aslan <eras@gentoo.org> +files/squid-13211_13210.patch,
+  +files/squid-13735_13734.patch, +squid-3.4.11-r1.ebuild,
+  +squid-3.5.1-r1.ebuild:
+  Security bump
 
   02 Feb 2015; Eray Aslan <eras@gentoo.org> squid-3.4.11.ebuild,
   squid-3.5.1.ebuild:
diff --git a/net-proxy/squid/Manifest b/net-proxy/squid/Manifest
index 4db05556c69b..3a591ab6e678 100644
--- a/net-proxy/squid/Manifest
+++ b/net-proxy/squid/Manifest
@@ -2,6 +2,8 @@
 Hash: SHA256
 
 AUX squid-12683_12681.patch 8985 SHA256 bef94f856ecbdfb88630bf75b8f1177a1efcba40b32b8ccd61ac2414daf40d75 SHA512 7e148cc62fbe0e3efea8731154b762c40d9e97a12978ff521aa0a90c225ff5b09d54388da671b05495c5c4eb9bf30ef492ad659d293f99a73ee2a0230a9c2f91 WHIRLPOOL 9af1913ab70a889d8fd7937910f5670a0f5b4678ed30df37f34b2bcf7a96640241419f43667f24d82ce7fffd0efa59b31e973658ba9bd4662e4581ca8f68dfaf
+AUX squid-13211_13210.patch 1719 SHA256 2e1e45f4800cb17a5e35fdc5a8add7581e08cb7c0bb39852be63fe84127f3d85 SHA512 764359afa7aa1ccd80b8349a01a6c92eb4c32ca1106776fde5f59b5af71cfeb63cf6d9afc777d12a8e13db46a92ee2d4cd1dc1b79a48fb06c92f433c66b7fb64 WHIRLPOOL 3f9c95888f82d499a9e95de0f49474a06727916d7928e8f8c7ff2ad3bdf14213b60f97d0a4547e8e81f88c16c41c8bc404c04dd93d6788c2bf33b2687d495a7f
+AUX squid-13735_13734.patch 1704 SHA256 895f83d35c438e07c14d1780fcb25ede604ab4ed096cf72bea424396acf82735 SHA512 2bddcbf34413b20c03c0cbc2760cbbb53cf52ef00cefcb02200f74ca7d0f1621ae2c35d37a47bdff6ee705c1c22ad885f94b0c86c719565dfa794447d2719a26 WHIRLPOOL 782c92e8ae83bc3231a6eaf982af6467a386d5751664ae60f1ce1482e740f0d8811617c59963995e2b78382a49a42f6a6f3cee50cecbdfedfb4fe9c827cdc42a
 AUX squid-3.3.4-gentoo.patch 4358 SHA256 d52c1c89c81540dfd6c464f7c4245857fdd6cc9e45568a03d4f028fe5feb8bb0 SHA512 b1bfb0a1298e30ce30681b8bcaed292a883f8153e3df61861d1dfd691c5f4d5bc4651531ac69932fcbdc74c5896ed4495d54810203d4c0674ceb49b33454f297 WHIRLPOOL 3b98a43c1cc98d20f28dd5eb096344ff80ec5de1e4e17c4a3b8fb5d89044b6090466bfd3a7e24dfb975d9e02009af900372ee8c791991921def12820a191da97
 AUX squid.confd-r1 493 SHA256 214a184495a3384eb452caef435256043bc51e35140a61b1f5fdff32603c8f7e SHA512 3f92645275e077bcf36e4cd2ccb56812540276d9456bc6f68268010aac57214f0d96b0aff74dc57cbc3446705a9fae8a5bb7a07304afeea45615ebf2cf2b7ab0 WHIRLPOOL 080cfb797ddb49f7c59463eaef0db8c3a6ec5e5da949884e9ccdf54d608b22fb81971aec21fab704c832c86a8c8e3d4795a7b09456c273d7c4bbb65692a68870
 AUX squid.cron 143 SHA256 4c9e2afe5b0bba583ce896233ea1f9262beeb1b6cf51b4adb48d5f5c03933b2f SHA512 cec563c20799ffea8b4fb418d5015d6dc437bd38c35e7150ed01bc298dab5214132e10f4e7b8176da1966e16a7f53f423c36e8419642cb16716f5c346c30d749 WHIRLPOOL 029c94d4e4826ee612c7dc12acc088e3100c9d1737baebb74b25b6e7ac2ba78d0bab9f744c12b5de4113c9727892c9a30dd17067409ac8da62afeee552de391e
@@ -14,26 +16,28 @@ DIST squid-3.4.11.tar.xz 2162148 SHA256 b4ede14221d043bbde94655aee195b090fe33a9a
 DIST squid-3.5.1.tar.xz 2281248 SHA256 3a3bc6b424149da5a4816786100f32e47b45e139144726722df3a87a6414d6f4 SHA512 eec2e3c364fe4f6f6b62ede0af8f62d09fe53db0bcd4d302b75470ef2880844ab398b1f8e05473971bb052eb72347078329c0598ccbb5ea7ebf6cb8df34cc858 WHIRLPOOL d6e91e2b3ec3f647f15720037b0016ed5deee0d51a116b5e4ec3a9b79b04a8c301473778f3ea0cbe8e1c75b054b9b9932b6534cd8d5dba11cc8bb9d763e1ca5a
 EBUILD squid-3.3.13-r1.ebuild 7748 SHA256 04777bfe1e7b0d67d76ace831ce39837c62552bb3c6cfcace7cb3d7454f63306 SHA512 c989367c920025b3592278c237658255d9d4c5f3ddff3732662d0fdb6833ebb55ddd44a1e966965f5cc0c5b5d8113016b1239aabbd6d459adf8fd5a00a636aa2 WHIRLPOOL dd3e5c63ba327ec9af37fd84ae8913e751dc20af51ddea77707742268a13c61d818734cc02389b09e5b39f91cba056515329892ecb9cddc62a24dd8f12eb7cec
 EBUILD squid-3.4.10.ebuild 7957 SHA256 ae31160052f47cfc0586a54eb5ed6f4122ee000cc61fac25d800d2a30ed27985 SHA512 0fd413cf062d7a20b16d890137188c6f3ebfa5349ccc6d0e60730a7ea0d01bd0ab8cafd35795b7a48c918fa0fdd52ac59f033a48b3c2dbb68349e3a8c57463e7 WHIRLPOOL 102cb4b3ec0c311bbe464718f1a6149177f3b360d03379e96dc7615254d8f6c497230d7450ddd174570a451061f901e66ce9e400f4f57c13d44b4c986c4cc00c
+EBUILD squid-3.4.11-r1.ebuild 7986 SHA256 a759ca464a5ba5fe87609c922ee71a458752bc824c47a8248d10685b224c1fc7 SHA512 6cbc90cdc0aead37322c5782b8a6857769bed6ae10d74c2e81055a69525b8aa3d337f5023e9bdea8be66d743478c10a86dc8663b9440133ab3646967ea112c27 WHIRLPOOL 7cb3c5291f59a986cfe137a83c01500bb0ed574f847b7ae70fa272d22ac27720b2ca8e7395dcc0fe5b50990c72674e5aa2ef120b2d953a294204f12bdae366c5
 EBUILD squid-3.4.11.ebuild 7937 SHA256 b3d10277e14ceb288d9086ff7c424b4312112960a884ec0e163420e72fe35bad SHA512 0165fc2fe6074d66e5bc251d8621385cff4fdcc63f424e2fa9c51e42f98498a5bfd4513949ed8ab25e27457e0ad8399013415d963a2fe2318c5bfcb07192770d WHIRLPOOL 84a531d225397db900a2aa0c48d98090bce7190587d288394ecbcdf472f61f04b87044cf324e52980c998c5c4df64c0402a8d59d6325a418d1661bd7567cee07
+EBUILD squid-3.5.1-r1.ebuild 7671 SHA256 76942f30c8a5bc4412c703619da01854bba5632ab037a6a58188b122a501e62f SHA512 680691fc99af72fb0315d8d26730413f4ba441500df7e50a6970194097f98b85e1ca03070786c177567ddaf29e9c27e142ed524c815932a852b941e1deaeb75f WHIRLPOOL 6495e6c073e289a454d4fb210ea48c73ca8714dbba937d67f5907b69779509bfbf2a0aa66a37051d0cb169eb66a1c279a0d84f13094aff0f98f442afe06a44a7
 EBUILD squid-3.5.1.ebuild 7622 SHA256 f8905b18292eb4cb70924561f93c5e62b96fd334b9e0f077991fec936cbe91e7 SHA512 18c9297e9badcb97f8d404473b9239c115b214b6bf1dcc56ce9a7ca359226a01373d6c408c12415b944c72343d1a4ba0c7aa7497d30944ed6cb4544211fcf177 WHIRLPOOL 7164515065e5370345197701044590e3982a58e3aad3fb4d16ae6890588eb05894020915e829ee7e357e1b8e98a94d45d89491526526bdb1b94c4012614a3f69
-MISC ChangeLog 92848 SHA256 50259e8bfeb3844fa7f5df32ca3f5a8f8ab81ae80cb960be185a02d3209912b8 SHA512 40c41ca85993c6a4f14d6ba53e00ed7dcaf6777ecde45959685b2e9ef8f9d0186cdd117bbc5d020ff3c5b25126d8b963dd39e442be5e6c1c3afb0eb649fd2c48 WHIRLPOOL 0b9af64f86da87ea03874e4a23223930b780d14a92d05bebff3e8617cca53ac71ad361b7d949e785da0b54905f27ad573e299c09df8cfabdd769dfe182e03a3b
+MISC ChangeLog 93088 SHA256 626d287d7dab69e9eea8e66f3a78215df06d37a487ede0b4db16197b6700fe4d SHA512 40ecc85f241495bc3c620cfd52a4ad80708f7a68d71cc6a2c8ea0155df3fbde89008e582a0f6b0e40016d5e2c729a2e61f87bf7c5966dd6b92fffaab7dc1c3b6 WHIRLPOOL 56fb5c4db6c7325a242bbdd655ac09f1a4c6ca6dab27de2bb039d13a6bdd2591f1c8a1c3d43107378d2b77fcb53094d82e7ada811cc3eefde96e0d7bee6a315e
 MISC metadata.xml 1545 SHA256 72b1cd3b3476500f50f936459a522eca2fabcad046cc2647662bf18b75d57edf SHA512 20c78e621a6a58697108ae3e0a543a3ead301ccb50ba54266fa9775ef66fc24590ccc7a24d20883af656b8a295fac26527c65d236d4d46ae0e0df0c2d15c993d WHIRLPOOL 90a2470ab97b9d56e0b73410741194f30b1bed09f99ab71940ded398d3796ff8d87250ccfe419c544b2e85cebd8706d0c4beed926870f290694074c34317be90
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0
 
-iQJ8BAEBCABmBQJUzykcXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
+iQJ8BAEBCABmBQJU0kR1XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
 ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBQjk1NkM0NUMxNzFCRTY4Rjk4NENDMDk3
-N0YxRjE3NTU4NkEzQjFGAAoJEHfx8XVYajsfuS4P/3W+hFW4q9//eefLz80L9bVM
-YE6C1SRNPNC2aurKjyjtD5LTI4ep+6CYl7KfPGroPMOYpcMQjBw6T554cFqwZcXT
-HJwuGmzKo0Ls/70baJdWm93XNNvRyX1b7xALMSuBTCKfWQUcKopZzscQvzh5TQCS
-Z3B5jCP76nLbenbMdLQB4r91CdivLmmkYbzbf9iW73sE+BCN5ZXHM1VuJu0QK1XQ
-LQ4wicZWh4/blhnHnCtB31EDYfqCV63EJaCaCysn+pL8VTYObD6lQDvz/MdbPCcV
-Ny7hnhBWbVD56/8K4g4IRJ+isl5PFjfpAMiNNbxAplaBPeeSGZaSoEIGO+P8xHg/
-PbeOuyMIfndCrLOdgjCbXOr/wFsTDKKIdINaVJ0g3dC/DkkbfikR1G809xVF43ow
-PSPuymMz4mQEsL71aCqV7h2VGum9CzbsEAtFZphjjw7sG4BrhZyvEZp6nfpmqFls
-vmETq2uXwoxDv/0W5kGLsprpSkh08jNZJb23EwSk8uLA8dmFQipNl9frSEC/F1GC
-q7mvmqVz22GMrOJMX183otTcKkpplT3w7ejy34SfY1r4Cfaz+sPg6NO7nrNS+GLW
-V3T/rQD0cH5EBtA8UPF90EGpBKKNldhMrYelAVwfDXNZXtUhat6tYd0JnKHPbQa8
-w4M1EFxrUDl2vaVJuiRC
-=ojtH
+N0YxRjE3NTU4NkEzQjFGAAoJEHfx8XVYajsfLPoP/2zHpMGwFqo8E0e7yBiRRQhG
+oaKe8+ORR1s0HtoNtps7eSMSnV255qewwOebG9HjQWbt+M+uiPS9JXf1qnjsgS1I
+sWJapbtMti7Ibzm1iNZ3oKCwk1hneEgxYZGgKe8iRB9yDFf57Wh0DUnjZS7eYHep
+N2yAqpCF9/NlSnsvqLivlrJW97WuuezExgALUJNgIgTnBzaDkFOmO5kJVRW1260c
+IwFTLSMwUiquZ9JdtQwCxQ3kW99KlVIggy3eF2wYDyZb3RqKT9Q1iwIyBd+3pI8I
+cfDXTskvg3fHpQsbirdPC6qWQLq9oXe7QTEJoeD92oxFWMCreZVbYbNthT3jdG8l
+9fJPr8r8i4i1YefJ9LVqBRjp/9LfbMD+ZizmVlyRb2+MK16qPJUNHV0YRr4JqD/b
+Kls9NAHn/otW9bTgYTVlFMApy6YqnysMhVBK/KSmetMRbrU/NU1Yqn9qqEk5jzXG
+Z0dMzi7uESn0LyB6feVJslZ5bWBwMXpmJvgpliSh0F/AQIwerT2/VoflTge+3b1Q
+skmme5eaHR8TV9jaNK+f6+bdpTXzskur4Xvs+5mndqT1bu6xnXafxtL5lCQ1QsYF
+qea7lmOX4fhdKAlDp2LgJ1PBRI3AyXFblI98XWAU64TN+7m+QcqDYg5uKnnwT8gj
+4x2L7HpImbn9S48UwIaU
+=xlTt
 -----END PGP SIGNATURE-----
diff --git a/net-proxy/squid/files/squid-13211_13210.patch b/net-proxy/squid/files/squid-13211_13210.patch
new file mode 100644
index 000000000000..3e747958d8d9
--- /dev/null
+++ b/net-proxy/squid/files/squid-13211_13210.patch
@@ -0,0 +1,41 @@
+=== modified file 'src/auth/digest/UserRequest.cc'
+--- src/auth/digest/UserRequest.cc	2015-01-18 11:02:13 +0000
++++ src/auth/digest/UserRequest.cc	2015-01-19 16:42:41 +0000
+@@ -152,10 +152,14 @@
+     }
+ 
+     /* check for stale nonce */
+-    if (!authDigestNonceIsValid(digest_request->nonce, digest_request->nc)) {
+-        debugs(29, 3, "user '" << auth_user->username() << "' validated OK but nonce stale");
+-        auth_user->credentials(Auth::Handshake);
+-        digest_request->setDenyMessage("Stale nonce");
++    /* check Auth::Pending to avoid loop */
++
++    if (!authDigestNonceIsValid(digest_request->nonce, digest_request->nc) && user()->credentials() != Auth::Pending) {
++        debugs(29, 3, auth_user->username() << "' validated OK but nonce stale: " << digest_request->nonceb64);
++        /* Pending prevent banner and makes a ldap control */
++        auth_user->credentials(Auth::Pending);
++        nonce->flags.valid = false;
++        authDigestNoncePurge(nonce);
+         return;
+     }
+ 
+
+=== modified file 'src/auth/digest/auth_digest.cc'
+--- src/auth/digest/auth_digest.cc	2014-03-05 02:48:25 +0000
++++ src/auth/digest/auth_digest.cc	2015-01-19 16:42:41 +0000
+@@ -1038,12 +1038,7 @@
+         debugs(29, 2, "Username for the nonce does not equal the username for the request");
+         nonce = NULL;
+     }
+-    /* check for stale nonce */
+-    if (authDigestNonceIsStale(nonce)) {
+-        debugs(29, 3, "The received nonce is stale from " << username);
+-        digest_request->setDenyMessage("Stale nonce");
+-        nonce = NULL;
+-    }
++
+     if (!nonce) {
+         /* we couldn't find a matching nonce! */
+         debugs(29, 2, "Unexpected or invalid nonce received from " << username);
+
diff --git a/net-proxy/squid/files/squid-13735_13734.patch b/net-proxy/squid/files/squid-13735_13734.patch
new file mode 100644
index 000000000000..5d76192acd51
--- /dev/null
+++ b/net-proxy/squid/files/squid-13735_13734.patch
@@ -0,0 +1,41 @@
+=== modified file 'src/auth/digest/Config.cc'
+--- src/auth/digest/Config.cc	2015-01-13 09:13:49 +0000
++++ src/auth/digest/Config.cc	2015-01-20 10:36:06 +0000
+@@ -1006,12 +1006,7 @@
+         debugs(29, 2, "Username for the nonce does not equal the username for the request");
+         nonce = NULL;
+     }
+-    /* check for stale nonce */
+-    if (authDigestNonceIsStale(nonce)) {
+-        debugs(29, 3, "The received nonce is stale from " << username);
+-        digest_request->setDenyMessage("Stale nonce");
+-        nonce = NULL;
+-    }
++
+     if (!nonce) {
+         /* we couldn't find a matching nonce! */
+         debugs(29, 2, "Unexpected or invalid nonce received from " << username);
+
+=== modified file 'src/auth/digest/UserRequest.cc'
+--- src/auth/digest/UserRequest.cc	2015-01-18 04:24:51 +0000
++++ src/auth/digest/UserRequest.cc	2015-01-20 10:36:06 +0000
+@@ -173,10 +173,14 @@
+     }
+ 
+     /* check for stale nonce */
+-    if (!authDigestNonceIsValid(digest_request->nonce, digest_request->nc)) {
+-        debugs(29, 3, "user '" << auth_user->username() << "' validated OK but nonce stale");
+-        auth_user->credentials(Auth::Handshake);
+-        digest_request->setDenyMessage("Stale nonce");
++    /* check Auth::Pending to avoid loop */
++
++    if (!authDigestNonceIsValid(digest_request->nonce, digest_request->nc) && user()->credentials() != Auth::Pending) {
++        debugs(29, 3, auth_user->username() << "' validated OK but nonce stale: " << digest_request->nonceb64);
++        /* Pending prevent banner and makes a ldap control */
++        auth_user->credentials(Auth::Pending);
++        nonce->flags.valid = false;
++        authDigestNoncePurge(nonce);
+         return;
+     }
+ 
+
diff --git a/net-proxy/squid/squid-3.4.11-r1.ebuild b/net-proxy/squid/squid-3.4.11-r1.ebuild
new file mode 100644
index 000000000000..262dfcab980e
--- /dev/null
+++ b/net-proxy/squid/squid-3.4.11-r1.ebuild
@@ -0,0 +1,255 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-proxy/squid/squid-3.4.11-r1.ebuild,v 1.1 2015/02/04 16:10:18 eras Exp $
+
+EAPI=5
+inherit autotools eutils linux-info pam toolchain-funcs user versionator
+
+DESCRIPTION="A full-featured web proxy cache"
+HOMEPAGE="http://www.squid-cache.org/"
+SRC_URI="http://www.squid-cache.org/Versions/v3/3.4/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="caps ipv6 pam ldap samba sasl kerberos nis radius ssl snmp selinux logrotate test \
+	ecap esi icap-client ssl-crtd \
+	mysql postgres sqlite \
+	qos tproxy \
+	+htcp +wccp +wccpv2 \
+	pf-transparent ipf-transparent kqueue \
+	elibc_uclibc kernel_linux"
+
+COMMON_DEPEND="caps? ( >=sys-libs/libcap-2.16 )
+	pam? ( virtual/pam )
+	ldap? ( net-nds/openldap )
+	kerberos? ( virtual/krb5 )
+	qos? ( net-libs/libnetfilter_conntrack )
+	ssl? ( dev-libs/openssl dev-libs/nettle )
+	sasl? ( dev-libs/cyrus-sasl )
+	ecap? ( net-libs/libecap:0.2 )
+	esi? ( dev-libs/expat dev-libs/libxml2 )
+	!x86-fbsd? ( logrotate? ( app-admin/logrotate ) )
+	>=sys-libs/db-4
+	dev-lang/perl
+	dev-libs/libltdl"
+DEPEND="${COMMON_DEPEND}
+	ecap? ( virtual/pkgconfig )
+	sys-apps/ed
+	test? ( dev-util/cppunit )"
+RDEPEND="${COMMON_DEPEND}
+	samba? ( net-fs/samba )
+	mysql? ( dev-perl/DBD-mysql )
+	postgres? ( dev-perl/DBD-Pg )
+	selinux? ( sec-policy/selinux-squid )
+	sqlite? ( dev-perl/DBD-SQLite )
+	!<=sci-biology/meme-4.8.1-r1"
+
+REQUIRED_USE="tproxy? ( caps )
+			qos? ( caps )"
+
+pkg_pretend() {
+	if use tproxy; then
+		local CONFIG_CHECK="~NF_CONNTRACK ~NETFILTER_TPROXY ~NETFILTER_XT_MATCH_SOCKET ~NETFILTER_XT_TARGET_TPROXY"
+		linux-info_pkg_setup
+	fi
+}
+
+pkg_setup() {
+	enewgroup squid 31
+	enewuser squid 31 -1 /var/cache/squid squid
+}
+
+src_prepare() {
+	epatch "${FILESDIR}/${PN}-3.3.4-gentoo.patch"
+	epatch "${FILESDIR}/${PN}-13211_13210.patch"
+	sed -i -e 's:/usr/local/squid/etc:/etc/squid:' \
+		INSTALL QUICKSTART \
+		helpers/basic_auth/MSNT/README.html \
+		helpers/basic_auth/MSNT/confload.cc \
+		helpers/basic_auth/MSNT/msntauth.conf.default \
+		scripts/fileno-to-pathname.pl \
+		scripts/check_cache.pl \
+		tools/cachemgr.cgi.8 \
+		tools/purge/conffile.hh \
+		tools/purge/README  || die
+	sed -i -e 's:/usr/local/squid/sbin:/usr/sbin:' \
+		INSTALL QUICKSTART || die
+	sed -i -e 's:/usr/local/squid/var/cache:/var/cache/squid:' \
+		QUICKSTART || die
+	sed -i -e 's:/usr/local/squid/var/logs:/var/log/squid:' \
+		QUICKSTART \
+		src/log/access_log.cc || die
+	sed -i -e 's:/usr/local/squid/logs:/var/log/squid:' \
+		src/log/access_log.cc || die
+	sed -i -e 's:/usr/local/squid/bin:/usr/bin:' \
+		helpers/basic_auth/MSNT/README.html || die
+	sed -i -e 's:/usr/local/squid/libexec:/usr/libexec/squid:' \
+		helpers/external_acl/unix_group/ext_unix_group_acl.8 \
+		helpers/external_acl/session/ext_session_acl.8 \
+		src/ssl/ssl_crtd.8 || die
+	sed -i -e 's:/usr/local/squid/cache:/var/cache/squid:' \
+		scripts/check_cache.pl || die
+	sed -i -e 's:/usr/local/squid/ssl_cert:/etc/ssl/squid:' \
+		src/ssl/ssl_crtd.8 || die
+	sed -i -e 's:/usr/local/squid/var/lib/ssl_db:/var/lib/squid/ssl_db:' \
+		src/ssl/ssl_crtd.8 || die
+	sed -i -e 's:/var/lib/ssl_db:/var/lib/squid/ssl_db:' \
+		src/ssl/ssl_crtd.8 || die
+	# /var/run/squid to /run/squid
+	sed -i -e 's:$(localstatedir)::' \
+		src/ipc/Makefile.am || die
+	sed -i -e 's:_LTDL_SETUP:LTDL_INIT([installable]):' \
+		libltdl/configure.ac || die
+
+	epatch_user
+
+	eautoreconf
+}
+
+src_configure() {
+	local basic_modules="MSNT,MSNT-multi-domain,NCSA,POP3,getpwnam"
+	use samba && basic_modules+=",SMB"
+	use ldap && basic_modules+=",LDAP"
+	use pam && basic_modules+=",PAM"
+	use sasl && basic_modules+=",SASL"
+	use nis && ! use elibc_uclibc && basic_modules+=",NIS"
+	use radius && basic_modules+=",RADIUS"
+	if use mysql || use postgres || use sqlite ; then
+		basic_modules+=",DB"
+	fi
+
+	local digest_modules="file"
+	use ldap && digest_modules+=",LDAP,eDirectory"
+
+	local negotiate_modules myconf
+	if use kerberos ; then
+		negotiate_modules="kerberos,wrapper"
+		myconf="--with-krb5-config=yes"
+	else
+		negotiate_modules="none"
+		myconf="--with-krb5-config=no"
+	fi
+
+	local ntlm_modules="none"
+	use samba && ntlm_modules="smb_lm"
+
+	local ext_helpers="file_userip,session,unix_group"
+	use samba && ext_helpers+=",wbinfo_group"
+	use ldap && ext_helpers+=",LDAP_group,eDirectory_userip"
+	use ldap && use kerberos && ext_helpers+=",kerberos_ldap_group"
+
+	# uclibc does not have aio support - needed for coss (#61175)
+	local storeio_modules="aufs,diskd,rock,ufs"
+
+	local transparent
+	if use kernel_linux ; then
+		transparent+=" --enable-linux-netfilter"
+		use qos && transparent+=" --enable-zph-qos --with-netfilter-conntrack"
+	fi
+
+	if use kernel_FreeBSD || use kernel_OpenBSD || use kernel_NetBSD ; then
+		transparent+=" $(use_enable kqueue)"
+		if use pf-transparent; then
+			transparent+=" --enable-pf-transparent"
+		elif use ipf-transparent; then
+			transparent+=" --enable-ipf-transparent"
+		fi
+	fi
+
+	tc-export CC AR
+
+	econf \
+		--sysconfdir=/etc/squid \
+		--libexecdir=/usr/libexec/squid \
+		--localstatedir=/var \
+		--with-pidfile=/run/squid.pid \
+		--datadir=/usr/share/squid \
+		--with-logdir=/var/log/squid \
+		--with-default-user=squid \
+		--enable-removal-policies="lru,heap" \
+		--enable-storeio="${storeio_modules}" \
+		--enable-disk-io \
+		--enable-auth \
+		--enable-auth-basic="${basic_modules}" \
+		--enable-auth-digest="${digest_modules}" \
+		--enable-auth-ntlm="${ntlm_modules}" \
+		--enable-auth-negotiate="${negotiate_modules}" \
+		--enable-external-acl-helpers="${ext_helpers}" \
+		--enable-log-daemon-helpers \
+		--enable-url-rewrite-helpers \
+		--enable-cache-digests \
+		--enable-delay-pools \
+		--enable-eui \
+		--enable-icmp \
+		--enable-follow-x-forwarded-for \
+		--with-large-files \
+		--disable-strict-error-checking \
+		--disable-arch-native \
+		$(use_with caps libcap) \
+		$(use_enable ipv6) \
+		$(use_enable snmp) \
+		$(use_enable ssl) \
+		$(use_with ssl nettle) \
+		$(use_enable ssl-crtd) \
+		$(use_enable icap-client) \
+		$(use_enable ecap) \
+		$(use_enable esi) \
+		$(use_enable htcp) \
+		$(use_enable wccp) \
+		$(use_enable wccpv2) \
+		${transparent} \
+		${myconf}
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	# need suid root for looking into /etc/shadow
+	fowners root:squid /usr/libexec/squid/basic_ncsa_auth
+	fperms 4750 /usr/libexec/squid/basic_ncsa_auth
+	if use pam; then
+		fowners root:squid /usr/libexec/squid/basic_pam_auth
+		fperms 4750 /usr/libexec/squid/basic_pam_auth
+	fi
+	# pinger needs suid as well
+	fowners root:squid /usr/libexec/squid/pinger
+	fperms 4750 /usr/libexec/squid/pinger
+
+	# cleanup
+	rm -f "${D}"/usr/bin/Run*
+	rm -rf "${D}"/run/squid "${D}"/var/cache/squid
+
+	dodoc CONTRIBUTORS CREDITS ChangeLog INSTALL QUICKSTART README SPONSORS doc/*.txt
+	newdoc helpers/negotiate_auth/kerberos/README README.kerberos
+	newdoc helpers/basic_auth/MSNT-multi-domain/README.txt README.MSNT-multi-domain
+	newdoc helpers/basic_auth/LDAP/README README.LDAP
+	newdoc helpers/basic_auth/RADIUS/README README.RADIUS
+	newdoc helpers/external_acl/kerberos_ldap_group/README README.kerberos_ldap_group
+	newdoc tools/purge/README README.purge
+	newdoc tools/helper-mux.README README.helper-mux
+	dohtml RELEASENOTES.html
+
+	newpamd "${FILESDIR}/squid.pam" squid
+	newconfd "${FILESDIR}/squid.confd-r1" squid
+	newinitd "${FILESDIR}/squid.initd-r4" squid
+	if use logrotate; then
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/squid.logrotate" squid
+	else
+		exeinto /etc/cron.weekly
+		newexe "${FILESDIR}/squid.cron" squid.cron
+	fi
+
+	diropts -m0750 -o squid -g squid
+	keepdir /var/log/squid /etc/ssl/squid /var/lib/squid
+}
+
+pkg_postinst() {
+	if [[ $(get_version_component_range 1 ${REPLACING_VERSIONS}) -lt 3 ]] || \
+		[[ $(get_version_component_range 2 ${REPLACING_VERSIONS}) -lt 4 ]]; then
+		elog "Please read the release notes at:"
+		elog "  http://www.squid-cache.org/Versions/v3/3.4/RELEASENOTES.html"
+		echo
+	fi
+}
diff --git a/net-proxy/squid/squid-3.5.1-r1.ebuild b/net-proxy/squid/squid-3.5.1-r1.ebuild
new file mode 100644
index 000000000000..3dd80f436099
--- /dev/null
+++ b/net-proxy/squid/squid-3.5.1-r1.ebuild
@@ -0,0 +1,248 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-proxy/squid/squid-3.5.1-r1.ebuild,v 1.1 2015/02/04 16:10:18 eras Exp $
+
+EAPI=5
+inherit autotools eutils linux-info pam toolchain-funcs user versionator
+
+DESCRIPTION="A full-featured web proxy cache"
+HOMEPAGE="http://www.squid-cache.org/"
+SRC_URI="http://www.squid-cache.org/Versions/v3/3.5/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="caps ipv6 pam ldap samba sasl kerberos nis radius ssl snmp selinux logrotate test \
+	ecap esi ssl-crtd \
+	mysql postgres sqlite \
+	qos tproxy \
+	+htcp +wccp +wccpv2 \
+	pf-transparent ipf-transparent kqueue \
+	elibc_uclibc kernel_linux"
+
+COMMON_DEPEND="caps? ( >=sys-libs/libcap-2.16 )
+	pam? ( virtual/pam )
+	ldap? ( net-nds/openldap )
+	kerberos? ( virtual/krb5 )
+	qos? ( net-libs/libnetfilter_conntrack )
+	ssl? ( dev-libs/openssl dev-libs/nettle >=net-libs/gnutls-3.1.5 )
+	sasl? ( dev-libs/cyrus-sasl )
+	ecap? ( net-libs/libecap:1 )
+	esi? ( dev-libs/expat dev-libs/libxml2 )
+	!x86-fbsd? ( logrotate? ( app-admin/logrotate ) )
+	>=sys-libs/db-4
+	dev-lang/perl
+	dev-libs/libltdl"
+DEPEND="${COMMON_DEPEND}
+	ecap? ( virtual/pkgconfig )
+	sys-apps/ed
+	test? ( dev-util/cppunit )"
+RDEPEND="${COMMON_DEPEND}
+	samba? ( net-fs/samba )
+	mysql? ( dev-perl/DBD-mysql )
+	postgres? ( dev-perl/DBD-Pg )
+	selinux? ( sec-policy/selinux-squid )
+	sqlite? ( dev-perl/DBD-SQLite )
+	!<=sci-biology/meme-4.8.1-r1"
+
+REQUIRED_USE="tproxy? ( caps )
+			qos? ( caps )"
+
+pkg_pretend() {
+	if use tproxy; then
+		local CONFIG_CHECK="~NF_CONNTRACK ~NETFILTER_TPROXY ~NETFILTER_XT_MATCH_SOCKET ~NETFILTER_XT_TARGET_TPROXY"
+		linux-info_pkg_setup
+	fi
+}
+
+pkg_setup() {
+	enewgroup squid 31
+	enewuser squid 31 -1 /var/cache/squid squid
+}
+
+src_prepare() {
+	epatch "${FILESDIR}/${PN}-3.3.4-gentoo.patch"
+	epatch "${FILESDIR}/${PN}-13735_13734.patch"
+	sed -i -e 's:/usr/local/squid/etc:/etc/squid:' \
+		INSTALL QUICKSTART \
+		scripts/fileno-to-pathname.pl \
+		scripts/check_cache.pl \
+		tools/cachemgr.cgi.8 \
+		tools/purge/conffile.hh \
+		tools/purge/README  || die
+	sed -i -e 's:/usr/local/squid/sbin:/usr/sbin:' \
+		INSTALL QUICKSTART || die
+	sed -i -e 's:/usr/local/squid/var/cache:/var/cache/squid:' \
+		QUICKSTART || die
+	sed -i -e 's:/usr/local/squid/var/logs:/var/log/squid:' \
+		QUICKSTART \
+		src/log/access_log.cc || die
+	sed -i -e 's:/usr/local/squid/logs:/var/log/squid:' \
+		src/log/access_log.cc || die
+	sed -i -e 's:/usr/local/squid/libexec:/usr/libexec/squid:' \
+		helpers/external_acl/unix_group/ext_unix_group_acl.8 \
+		helpers/external_acl/session/ext_session_acl.8 \
+		src/ssl/ssl_crtd.8 || die
+	sed -i -e 's:/usr/local/squid/cache:/var/cache/squid:' \
+		scripts/check_cache.pl || die
+	sed -i -e 's:/usr/local/squid/ssl_cert:/etc/ssl/squid:' \
+		src/ssl/ssl_crtd.8 || die
+	sed -i -e 's:/usr/local/squid/var/lib/ssl_db:/var/lib/squid/ssl_db:' \
+		src/ssl/ssl_crtd.8 || die
+	sed -i -e 's:/var/lib/ssl_db:/var/lib/squid/ssl_db:' \
+		src/ssl/ssl_crtd.8 || die
+	# /var/run/squid to /run/squid
+	sed -i -e 's:$(localstatedir)::' \
+		src/ipc/Makefile.am || die
+	sed -i -e 's:_LTDL_SETUP:LTDL_INIT([installable]):' \
+		libltdl/configure.ac || die
+
+	epatch_user
+
+	eautoreconf
+}
+
+src_configure() {
+	local basic_modules="MSNT-multi-domain,NCSA,POP3,getpwnam"
+	use samba && basic_modules+=",SMB"
+	use ldap && basic_modules+=",LDAP"
+	use pam && basic_modules+=",PAM"
+	use sasl && basic_modules+=",SASL"
+	use nis && ! use elibc_uclibc && basic_modules+=",NIS"
+	use radius && basic_modules+=",RADIUS"
+	if use mysql || use postgres || use sqlite ; then
+		basic_modules+=",DB"
+	fi
+
+	local digest_modules="file"
+	use ldap && digest_modules+=",LDAP,eDirectory"
+
+	local negotiate_modules="none"
+	local myconf="--without-mit-krb5 --without-heimdal-krb5"
+	if use kerberos ; then
+		negotiate_modules="kerberos,wrapper"
+		if has_version app-crypt/heimdal ; then
+			myconf="--without-mit-krb5 --with-heimdal-krb5"
+		else
+			myconf="--with-mit-krb5 --without-heimdal-krb5"
+		fi
+	fi
+
+	local ntlm_modules="none"
+	use samba && ntlm_modules="smb_lm"
+
+	local ext_helpers="file_userip,session,unix_group"
+	use samba && ext_helpers+=",wbinfo_group"
+	use ldap && ext_helpers+=",LDAP_group,eDirectory_userip"
+	use ldap && use kerberos && ext_helpers+=",kerberos_ldap_group"
+
+	local storeio_modules="aufs,diskd,rock,ufs"
+
+	local transparent
+	if use kernel_linux ; then
+		transparent+=" --enable-linux-netfilter"
+		use qos && transparent+=" --enable-zph-qos --with-netfilter-conntrack"
+	fi
+
+	if use kernel_FreeBSD || use kernel_OpenBSD || use kernel_NetBSD ; then
+		transparent+=" $(use_enable kqueue)"
+		if use pf-transparent; then
+			transparent+=" --enable-pf-transparent"
+		elif use ipf-transparent; then
+			transparent+=" --enable-ipf-transparent"
+		fi
+	fi
+
+	tc-export CC AR
+
+	econf \
+		--sysconfdir=/etc/squid \
+		--libexecdir=/usr/libexec/squid \
+		--localstatedir=/var \
+		--with-pidfile=/run/squid.pid \
+		--datadir=/usr/share/squid \
+		--with-logdir=/var/log/squid \
+		--with-default-user=squid \
+		--enable-removal-policies="lru,heap" \
+		--enable-storeio="${storeio_modules}" \
+		--enable-disk-io \
+		--enable-auth-basic="${basic_modules}" \
+		--enable-auth-digest="${digest_modules}" \
+		--enable-auth-ntlm="${ntlm_modules}" \
+		--enable-auth-negotiate="${negotiate_modules}" \
+		--enable-external-acl-helpers="${ext_helpers}" \
+		--enable-log-daemon-helpers \
+		--enable-url-rewrite-helpers \
+		--enable-cache-digests \
+		--enable-delay-pools \
+		--enable-eui \
+		--enable-icmp \
+		--enable-follow-x-forwarded-for \
+		--with-large-files \
+		--disable-strict-error-checking \
+		--disable-arch-native \
+		$(use_with caps libcap) \
+		$(use_enable ipv6) \
+		$(use_enable snmp) \
+		$(use_with ssl openssl) \
+		$(use_with ssl nettle) \
+		$(use_with ssl gnutls) \
+		$(use_enable ssl-crtd) \
+		$(use_enable ecap) \
+		$(use_enable esi) \
+		$(use_enable htcp) \
+		$(use_enable wccp) \
+		$(use_enable wccpv2) \
+		${transparent} \
+		${myconf}
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	# need suid root for looking into /etc/shadow
+	fowners root:squid /usr/libexec/squid/basic_ncsa_auth
+	fperms 4750 /usr/libexec/squid/basic_ncsa_auth
+	if use pam; then
+		fowners root:squid /usr/libexec/squid/basic_pam_auth
+		fperms 4750 /usr/libexec/squid/basic_pam_auth
+	fi
+	# pinger needs suid as well
+	fowners root:squid /usr/libexec/squid/pinger
+	fperms 4750 /usr/libexec/squid/pinger
+
+	# cleanup
+	rm -f "${D}"/usr/bin/Run*
+	rm -rf "${D}"/run/squid "${D}"/var/cache/squid
+
+	dodoc CONTRIBUTORS CREDITS ChangeLog INSTALL QUICKSTART README SPONSORS doc/*.txt
+	newdoc helpers/negotiate_auth/kerberos/README README.kerberos
+	newdoc helpers/basic_auth/RADIUS/README README.RADIUS
+	newdoc helpers/external_acl/kerberos_ldap_group/README README.kerberos_ldap_group
+	newdoc tools/purge/README README.purge
+	newdoc tools/helper-mux.README README.helper-mux
+	dohtml RELEASENOTES.html
+
+	newpamd "${FILESDIR}/squid.pam" squid
+	newconfd "${FILESDIR}/squid.confd-r1" squid
+	newinitd "${FILESDIR}/squid.initd-r4" squid
+	if use logrotate; then
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/squid.logrotate" squid
+	else
+		exeinto /etc/cron.weekly
+		newexe "${FILESDIR}/squid.cron" squid.cron
+	fi
+
+	diropts -m0750 -o squid -g squid
+	keepdir /var/log/squid /etc/ssl/squid /var/lib/squid
+}
+
+pkg_postinst() {
+	if [[ $(get_version_component_range 1 ${REPLACING_VERSIONS}) -lt 3 ]] || \
+		[[ $(get_version_component_range 2 ${REPLACING_VERSIONS}) -lt 5 ]]; then
+		elog "Please read the release notes at:"
+		elog "  http://www.squid-cache.org/Versions/v3/3.5/RELEASENOTES.html"
+		echo
+	fi
+}