diff -u -r -N squid-3.2.2/acinclude/squid-util.m4 squid-3.2.3/acinclude/squid-util.m4
--- squid-3.2.2/acinclude/squid-util.m4	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/acinclude/squid-util.m4	2012-10-21 01:39:49.000000000 +1300
@@ -196,12 +196,12 @@
     yes)
       if test -d "${srcdir}/.bzr"; then
         AC_PATH_PROG(BZR,bzr,$FALSE)
-        squid_bzr_branch_nick=`${BZR} nick 2>/dev/null`
+        squid_bzr_branch_nick=`cd ${srcdir} && ${BZR} nick 2>/dev/null`
         if test $? -eq 0 -a "x$squid_bzr_branch_nick" != "x"; then
-          squid_bzr_branch_revno=`${BZR} revno 2>/dev/null | sed 's/\"//g'`
+          squid_bzr_branch_revno=`cd ${srcdir} && ${BZR} revno 2>/dev/null | sed 's/\"//g'`
         fi
         if test $? -eq 0 -a "x$squid_bzr_branch_revno" != "x"; then
-          ${BZR} diff 2>&1 >/dev/null
+          sh -c "cd ${srcdir} && ${BZR} diff 2>&1 >/dev/null"
           if test $? -eq 1; then
               squid_bzr_branch_revno="$squid_bzr_branch_revno+changes"
           fi
diff -u -r -N squid-3.2.2/ChangeLog squid-3.2.3/ChangeLog
--- squid-3.2.2/ChangeLog	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/ChangeLog	2012-10-21 01:39:49.000000000 +1300
@@ -1,4 +1,15 @@
-Changes to squid-3.2.1 (06 Oct 2012):
+Changes to squid-3.2.3 (21 Oct 2012):
+
+	- Regression: SMP crashes on startup with workers > 1
+	- Bug 3655: pinning failure breaks NTLM and Negotiate authentication
+	- SMP: Allow a UFS cache_dir entry to coexist with a shared memory cache entry
+	- HTTP/1.1: honour Cache-Control before Pragma:no-cache
+	- HTTP/1.1: Cache-Control compliance upgrade
+	- Remove obsoleted refresh_pattern ignore-no-cache option
+	- Fix IPv6 enabled squidclient
+	- ... and several compile fixes
+
+Changes to squid-3.2.2 (06 Oct 2012):
 
 	- Regression: Make login=PASS send no credentials when none available
 	- Regression: Handle dstdomain duplicates and overlapping names better
diff -u -r -N squid-3.2.2/configure squid-3.2.3/configure
--- squid-3.2.2/configure	2012-10-06 15:09:35.000000000 +1200
+++ squid-3.2.3/configure	2012-10-21 01:40:38.000000000 +1300
@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision.
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for Squid Web Proxy 3.2.2.
+# Generated by GNU Autoconf 2.68 for Squid Web Proxy 3.2.3.
 #
 # Report bugs to <http://www.squid-cache.org/bugs/>.
 #
@@ -575,8 +575,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='3.2.2'
-PACKAGE_STRING='Squid Web Proxy 3.2.2'
+PACKAGE_VERSION='3.2.3'
+PACKAGE_STRING='Squid Web Proxy 3.2.3'
 PACKAGE_BUGREPORT='http://www.squid-cache.org/bugs/'
 PACKAGE_URL=''
 
@@ -1571,7 +1571,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 3.2.2 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 3.2.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1641,7 +1641,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 3.2.2:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 3.2.3:";;
    esac
   cat <<\_ACEOF
 
@@ -2019,7 +2019,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 3.2.2
+Squid Web Proxy configure 3.2.3
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -3115,7 +3115,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 3.2.2, which was
+It was created by Squid Web Proxy $as_me 3.2.3, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -3934,7 +3934,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='3.2.2'
+ VERSION='3.2.3'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -18544,12 +18544,12 @@
 fi
 
 
-        squid_bzr_branch_nick=`${BZR} nick 2>/dev/null`
+        squid_bzr_branch_nick=`cd ${srcdir} && ${BZR} nick 2>/dev/null`
         if test $? -eq 0 -a "x$squid_bzr_branch_nick" != "x"; then
-          squid_bzr_branch_revno=`${BZR} revno 2>/dev/null | sed 's/\"//g'`
+          squid_bzr_branch_revno=`cd ${srcdir} && ${BZR} revno 2>/dev/null | sed 's/\"//g'`
         fi
         if test $? -eq 0 -a "x$squid_bzr_branch_revno" != "x"; then
-          ${BZR} diff 2>&1 >/dev/null
+          sh -c "cd ${srcdir} && ${BZR} diff 2>&1 >/dev/null"
           if test $? -eq 1; then
               squid_bzr_branch_revno="$squid_bzr_branch_revno+changes"
           fi
@@ -20454,7 +20454,6 @@
   esac
   #Iphlpapi.h check delayed after winsock2.h
   for ac_header in \
-    net/if_dl.h \
     sys/sockio.h \
     sys/param.h
 
@@ -20490,17 +20489,21 @@
 done
 
 
-  # openbsd requires sys/param.h to be included before sysctl.h
-  for ac_header in sys/sysctl.h
+  # OpenBSD, FreeBSD and NetBSD requires sys/param.h to be included before sysctl.h and net/if_dl.h
+  for ac_header in \
+    net/if_dl.h \
+    sys/sysctl.h
 do :
-  ac_fn_cxx_check_header_compile "$LINENO" "sys/sysctl.h" "ac_cv_header_sys_sysctl_h" "#if HAVE_SYS_PARAM_H
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_cxx_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "
+#if HAVE_SYS_PARAM_H
 #include <sys/param.h>
 #endif
 
 "
-if test "x$ac_cv_header_sys_sysctl_h" = xyes; then :
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
   cat >>confdefs.h <<_ACEOF
-#define HAVE_SYS_SYSCTL_H 1
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
 _ACEOF
 
 fi
@@ -30891,7 +30894,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 3.2.2, which was
+This file was extended by Squid Web Proxy $as_me 3.2.3, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -30957,7 +30960,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-Squid Web Proxy config.status 3.2.2
+Squid Web Proxy config.status 3.2.3
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 
diff -u -r -N squid-3.2.2/configure.ac squid-3.2.3/configure.ac
--- squid-3.2.2/configure.ac	2012-10-06 15:09:35.000000000 +1200
+++ squid-3.2.3/configure.ac	2012-10-21 01:40:38.000000000 +1300
@@ -3,7 +3,7 @@
 dnl
 dnl
 dnl
-AC_INIT([Squid Web Proxy],[3.2.2],[http://www.squid-cache.org/bugs/],[squid])
+AC_INIT([Squid Web Proxy],[3.2.3],[http://www.squid-cache.org/bugs/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
@@ -1115,7 +1115,6 @@
   esac
   #Iphlpapi.h check delayed after winsock2.h
   AC_CHECK_HEADERS( \
-    net/if_dl.h \
     sys/sockio.h \
     sys/param.h
   )
@@ -1127,9 +1126,12 @@
 #include <sys/socket.h>
 ]])
 
-  # openbsd requires sys/param.h to be included before sysctl.h
-  AC_CHECK_HEADERS(sys/sysctl.h, [], [],
-  [[#if HAVE_SYS_PARAM_H
+  # OpenBSD, FreeBSD and NetBSD requires sys/param.h to be included before sysctl.h and net/if_dl.h
+  AC_CHECK_HEADERS( \
+    net/if_dl.h \
+    sys/sysctl.h,
+  [], [], [[
+#if HAVE_SYS_PARAM_H
 #include <sys/param.h>
 #endif
   ]])
diff -u -r -N squid-3.2.2/helpers/basic_auth/DB/basic_db_auth.8 squid-3.2.3/helpers/basic_auth/DB/basic_db_auth.8
--- squid-3.2.2/helpers/basic_auth/DB/basic_db_auth.8	2012-10-06 15:31:39.000000000 +1200
+++ squid-3.2.3/helpers/basic_auth/DB/basic_db_auth.8	2012-10-21 01:58:57.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_DB_AUTH 1"
-.TH BASIC_DB_AUTH 1 "2012-10-05" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH BASIC_DB_AUTH 1 "2012-10-20" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.2.2/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8 squid-3.2.3/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8
--- squid-3.2.2/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2012-10-06 15:31:41.000000000 +1200
+++ squid-3.2.3/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2012-10-21 01:58:59.000000000 +1300
@@ -124,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_WBINFO_GROUP_ACL.PL.IN 1"
-.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2012-10-05" "perl v5.10.1" "User Contributed Perl Documentation"
+.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2012-10-20" "perl v5.10.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.2.2/include/version.h squid-3.2.3/include/version.h
--- squid-3.2.2/include/version.h	2012-10-06 15:09:35.000000000 +1200
+++ squid-3.2.3/include/version.h	2012-10-21 01:40:38.000000000 +1300
@@ -9,7 +9,7 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1349492914
+#define SQUID_RELEASE_TIME 1350736787
 #endif
 
 #ifndef APP_SHORTNAME
diff -u -r -N squid-3.2.2/src/cache_cf.cc squid-3.2.3/src/cache_cf.cc
--- squid-3.2.2/src/cache_cf.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/cache_cf.cc	2012-10-21 01:39:49.000000000 +1300
@@ -754,15 +754,6 @@
         }
 
         for (R = Config.Refresh; R; R = R->next) {
-            if (!R->flags.ignore_no_cache)
-                continue;
-
-            debugs(22, 1, "WARNING: use of 'ignore-no-cache' in 'refresh_pattern' violates HTTP");
-
-            break;
-        }
-
-        for (R = Config.Refresh; R; R = R->next) {
             if (!R->flags.ignore_no_store)
                 continue;
 
@@ -2640,9 +2631,6 @@
         if (head->flags.ignore_reload)
             storeAppendPrintf(entry, " ignore-reload");
 
-        if (head->flags.ignore_no_cache)
-            storeAppendPrintf(entry, " ignore-no-cache");
-
         if (head->flags.ignore_no_store)
             storeAppendPrintf(entry, " ignore-no-store");
 
@@ -2681,7 +2669,6 @@
     int override_lastmod = 0;
     int reload_into_ims = 0;
     int ignore_reload = 0;
-    int ignore_no_cache = 0;
     int ignore_no_store = 0;
     int ignore_must_revalidate = 0;
     int ignore_private = 0;
@@ -2760,8 +2747,6 @@
             override_expire = 1;
         else if (!strcmp(token, "override-lastmod"))
             override_lastmod = 1;
-        else if (!strcmp(token, "ignore-no-cache"))
-            ignore_no_cache = 1;
         else if (!strcmp(token, "ignore-no-store"))
             ignore_no_store = 1;
         else if (!strcmp(token, "ignore-must-revalidate"))
@@ -2780,6 +2765,8 @@
             /* tell client_side.c that this is used */
 #endif
 
+        } else if (!strcmp(token, "ignore-no-cache")) {
+            debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.");
         } else
             debugs(22, 0, "refreshAddToList: Unknown option '" << pattern << "': " << token);
     }
@@ -2826,9 +2813,6 @@
     if (ignore_reload)
         t->flags.ignore_reload = 1;
 
-    if (ignore_no_cache)
-        t->flags.ignore_no_cache = 1;
-
     if (ignore_no_store)
         t->flags.ignore_no_store = 1;
 
@@ -3636,7 +3620,7 @@
         if (t) {
             ++t;
             s->tcp_keepalive.timeout = atoi(t);
-            t = strchr(t, ',');
+            // t = strchr(t, ','); // not really needed, left in as documentation
         }
 #if USE_SSL
     } else if (strcasecmp(token, "sslBump") == 0) {
diff -u -r -N squid-3.2.2/src/cf.data.pre squid-3.2.3/src/cf.data.pre
--- squid-3.2.2/src/cf.data.pre	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/cf.data.pre	2012-10-21 01:39:49.000000000 +1300
@@ -3943,7 +3943,6 @@
 		 override-lastmod
 		 reload-into-ims
 		 ignore-reload
-		 ignore-no-cache
 		 ignore-no-store
 		 ignore-must-revalidate
 		 ignore-private
@@ -3976,12 +3975,6 @@
 		this feature could make you liable for problems which
 		it causes.
 
-		ignore-no-cache ignores any ``Pragma: no-cache'' and
-		``Cache-control: no-cache'' headers received from a server.
-		The HTTP RFC never allows the use of this (Pragma) header
-		from a server, only a client, though plenty of servers
-		send it anyway.
-
 		ignore-no-store ignores any ``Cache-control: no-store''
 		headers received from a server. Doing this VIOLATES
 		the HTTP standard. Enabling this feature could make you
diff -u -r -N squid-3.2.2/src/client_side.cc squid-3.2.3/src/client_side.cc
--- squid-3.2.2/src/client_side.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/client_side.cc	2012-10-21 01:39:49.000000000 +1300
@@ -4034,11 +4034,8 @@
     if (Comm::IsConnOpen(pinning.serverConnection)) {
         if (pinning.serverConnection->fd == pinServer->fd)
             return;
-
-        unpinConnection(); // clears fields ready for re-use. Prevent close() scheduling our close handler.
-        pinning.serverConnection->close();
-    } else
-        unpinConnection(); // clears fields ready for re-use.
+    }
+    unpinConnection(); // clears fields ready for re-use. Prevent close() scheduling our close handler.
 
     pinning.serverConnection = pinServer;
     pinning.host = xstrdup(request->GetHost());
@@ -4096,7 +4093,8 @@
         pinning.closeHandler = NULL;
     }
     /// also close the server side socket, we should not use it for any future requests...
-    pinning.serverConnection->close();
+    if (Comm::IsConnOpen(pinning.serverConnection))
+        pinning.serverConnection->close();
     safe_free(pinning.host);
 
     /* NOTE: pinning.pinned should be kept. This combined with fd == -1 at the end of a request indicates that the host
diff -u -r -N squid-3.2.2/src/client_side_request.cc squid-3.2.3/src/client_side_request.cc
--- squid-3.2.2/src/client_side_request.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/client_side_request.cc	2012-10-21 01:39:49.000000000 +1300
@@ -1030,19 +1030,14 @@
         request->flags.ims = 1;
 
     if (!request->flags.ignore_cc) {
-        if (req_hdr->has(HDR_PRAGMA)) {
-            String s = req_hdr->getList(HDR_PRAGMA);
-
-            if (strListIsMember(&s, "no-cache", ','))
-                no_cache=true;
-
-            s.clean();
-        }
-
-        if (request->cache_control)
+        if (request->cache_control) {
             if (request->cache_control->noCache())
                 no_cache=true;
 
+            // RFC 2616: treat Pragma:no-cache as if it was Cache-Control:no-cache when Cache-Control is missing
+        } else if (req_hdr->has(HDR_PRAGMA))
+            no_cache = req_hdr->hasListMember(HDR_PRAGMA,"no-cache",',');
+
         /*
         * Work around for supporting the Reload button in IE browsers when Squid
         * is used as an accelerator or transparent proxy, by turning accelerated
diff -u -r -N squid-3.2.2/src/fs/rock/RockSwapDir.cc squid-3.2.3/src/fs/rock/RockSwapDir.cc
--- squid-3.2.2/src/fs/rock/RockSwapDir.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/fs/rock/RockSwapDir.cc	2012-10-21 01:39:49.000000000 +1300
@@ -739,7 +739,7 @@
 }
 
 bool
-Rock::SwapDir::dereference(StoreEntry &e)
+Rock::SwapDir::dereference(StoreEntry &e, bool)
 {
     debugs(47, 5, HERE << &e << ' ' << e.swap_dirn << ' ' << e.swap_filen);
     if (repl && repl->Dereferenced)
diff -u -r -N squid-3.2.2/src/fs/rock/RockSwapDir.h squid-3.2.3/src/fs/rock/RockSwapDir.h
--- squid-3.2.2/src/fs/rock/RockSwapDir.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/fs/rock/RockSwapDir.h	2012-10-21 01:39:49.000000000 +1300
@@ -53,7 +53,7 @@
     virtual void maintain();
     virtual void diskFull();
     virtual void reference(StoreEntry &e);
-    virtual bool dereference(StoreEntry &e);
+    virtual bool dereference(StoreEntry &e, bool);
     virtual bool unlinkdUseful() const;
     virtual void unlink(StoreEntry &e);
     virtual void statfs(StoreEntry &e) const;
diff -u -r -N squid-3.2.2/src/fs/ufs/store_dir_ufs.cc squid-3.2.3/src/fs/ufs/store_dir_ufs.cc
--- squid-3.2.2/src/fs/ufs/store_dir_ufs.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/fs/ufs/store_dir_ufs.cc	2012-10-21 01:39:49.000000000 +1300
@@ -427,7 +427,7 @@
  * removed, to maintain replacement information within the storage fs.
  */
 bool
-UFSSwapDir::dereference(StoreEntry & e)
+UFSSwapDir::dereference(StoreEntry & e, bool)
 {
     debugs(47, 3, "UFSSwapDir::dereference: referencing " << &e << " " << e.swap_dirn << "/" << e.swap_filen);
 
diff -u -r -N squid-3.2.2/src/fs/ufs/ufscommon.cc squid-3.2.3/src/fs/ufs/ufscommon.cc
--- squid-3.2.2/src/fs/ufs/ufscommon.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/fs/ufs/ufscommon.cc	2012-10-21 01:39:49.000000000 +1300
@@ -628,7 +628,7 @@
             currentEntry()->lastmod = swapData.lastmod;
             currentEntry()->flags = swapData.flags;
             currentEntry()->refcount += swapData.refcount;
-            sd->dereference(*currentEntry());
+            sd->dereference(*currentEntry(), false);
         } else {
             debug_trap("commonUfsDirRebuildFromSwapLog: bad condition");
             debugs(47, 1, "\tSee " << __FILE__ << ":" << __LINE__);
diff -u -r -N squid-3.2.2/src/fs/ufs/ufscommon.h squid-3.2.3/src/fs/ufs/ufscommon.h
--- squid-3.2.2/src/fs/ufs/ufscommon.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/fs/ufs/ufscommon.h	2012-10-21 01:39:49.000000000 +1300
@@ -66,7 +66,7 @@
     virtual void maintain();
     virtual bool canStore(const StoreEntry &e, int64_t diskSpaceNeeded, int &load) const;
     virtual void reference(StoreEntry &);
-    virtual bool dereference(StoreEntry &);
+    virtual bool dereference(StoreEntry &, bool);
     virtual StoreIOState::Pointer createStoreIO(StoreEntry &, StoreIOState::STFNCB *, StoreIOState::STIOCB *, void *);
     virtual StoreIOState::Pointer openStoreIO(StoreEntry &, StoreIOState::STFNCB *, StoreIOState::STIOCB *, void *);
     virtual void openLog();
diff -u -r -N squid-3.2.2/src/ftp.cc squid-3.2.3/src/ftp.cc
--- squid-3.2.2/src/ftp.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ftp.cc	2012-10-21 01:39:49.000000000 +1300
@@ -3768,6 +3768,7 @@
     buf[0] = '\0';
     vsnprintf(buf, 4096, fmt, args);
     writeReplyBody(buf, strlen(buf));
+    va_end(args);
 }
 
 /**
diff -u -r -N squid-3.2.2/src/http.cc squid-3.2.3/src/http.cc
--- squid-3.2.2/src/http.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/http.cc	2012-10-21 01:39:49.000000000 +1300
@@ -340,67 +340,103 @@
 #define REFRESH_OVERRIDE(flag) 0
 #endif
 
-    if (surrogateNoStore)
-        return 0;
-
-    // RFC 2616: do not cache replies to responses with no-store CC directive
-    if (request && request->cache_control &&
-            request->cache_control->noStore() &&
-            !REFRESH_OVERRIDE(ignore_no_store))
+    // Check for Surrogate/1.0 protocol conditions
+    // NP: reverse-proxy traffic our parent server has instructed us never to cache
+    if (surrogateNoStore) {
+        debugs(22, 3, HERE << "NO because Surrogate-Control:no-store");
         return 0;
+    }
 
-    if (!ignoreCacheControl && request->cache_control != NULL) {
-        const HttpHdrCc* cc=request->cache_control;
-        if (cc->Private()) {
-            if (!REFRESH_OVERRIDE(ignore_private))
-                return 0;
+    // RFC 2616: HTTP/1.1 Cache-Control conditions
+    if (!ignoreCacheControl) {
+        // XXX: check to see if the request headers alone were enough to prevent caching earlier
+        // (ie no-store request header) no need to check those all again here if so.
+        // for now we are not reliably doing that so we waste CPU re-checking request CC
+
+        // RFC 2616 section 14.9.2 - MUST NOT cache any response with request CC:no-store
+        if (request && request->cache_control && request->cache_control->noStore() &&
+                !REFRESH_OVERRIDE(ignore_no_store)) {
+            debugs(22, 3, HERE << "NO because client request Cache-Control:no-store");
+            return 0;
         }
 
-        if (cc->noCache()) {
-            if (!REFRESH_OVERRIDE(ignore_no_cache))
-                return 0;
+        // NP: request CC:no-cache only means cache READ is forbidden. STORE is permitted.
+        // NP: request CC:private is undefined. We ignore.
+        // NP: other request CC flags are limiters on HIT/MISS. We don't care about here.
+
+        // RFC 2616 section 14.9.2 - MUST NOT cache any response with CC:no-store
+        if (rep->cache_control && rep->cache_control->noStore() &&
+                !REFRESH_OVERRIDE(ignore_no_store)) {
+            debugs(22, 3, HERE << "NO because server reply Cache-Control:no-store");
+            return 0;
         }
 
-        if (cc->noStore()) {
-            if (!REFRESH_OVERRIDE(ignore_no_store))
-                return 0;
+        // RFC 2616 section 14.9.1 - MUST NOT cache any response with CC:private in a shared cache like Squid.
+        // TODO: add a shared/private cache configuration possibility.
+        if (rep->cache_control &&
+                rep->cache_control->Private() &&
+                !REFRESH_OVERRIDE(ignore_private)) {
+            debugs(22, 3, HERE << "NO because server reply Cache-Control:private");
+            return 0;
         }
+        // NP: being conservative; CC:private overrides CC:public when both are present in a response.
+
     }
+    // RFC 2068, sec 14.9.4 - MUST NOT cache any response with Authentication UNLESS certain CC controls are present
+    // allow HTTP violations to IGNORE those controls (ie re-block caching Auth)
+    if (request && (request->flags.auth || request->flags.auth_sent) && !REFRESH_OVERRIDE(ignore_auth)) {
+        if (!rep->cache_control) {
+            debugs(22, 3, HERE << "NO because Authenticated and server reply missing Cache-Control");
+            return 0;
+        }
 
-    if (request->flags.auth || request->flags.auth_sent) {
-        /*
-         * Responses to requests with authorization may be cached
-         * only if a Cache-Control: public reply header is present.
-         * RFC 2068, sec 14.9.4
-         */
+        if (ignoreCacheControl) {
+            debugs(22, 3, HERE << "NO because Authenticated and ignoring Cache-Control");
+            return 0;
+        }
 
-        if (!request->cache_control || !request->cache_control->Public()) {
-            if (!REFRESH_OVERRIDE(ignore_auth))
-                return 0;
+        // HTTPbis pt7 section 4.1 clause 3: a response CC:public is present
+        bool mayStore = false;
+        if (rep->cache_control->Public()) {
+            debugs(22, 3, HERE << "Authenticated but server reply Cache-Control:public");
+            mayStore = true;
+
+            // HTTPbis pt7 section 4.1 clause 2: a response CC:must-revalidate is present
+        } else if (rep->cache_control->mustRevalidate() && !REFRESH_OVERRIDE(ignore_must_revalidate)) {
+            debugs(22, 3, HERE << "Authenticated but server reply Cache-Control:public");
+            mayStore = true;
+
+#if 0 // waiting on HTTPbis WG agreement before we do this
+            // NP: given the must-revalidate exception we should also be able to exempt no-cache.
+        } else if (rep->cache_control->noCache()) {
+            debugs(22, 3, HERE << "Authenticated but server reply Cache-Control:no-cache");
+            mayStore = true;
+#endif
+
+            // HTTPbis pt7 section 4.1 clause 1: a response CC:s-maxage is present
+        } else if (rep->cache_control->sMaxAge()) {
+            debugs(22, 3, HERE << " Authenticated but server reply Cache-Control:s-maxage");
+            mayStore = true;
         }
-    }
 
-    /* Pragma: no-cache in _replies_ is not documented in HTTP,
-     * but servers like "Active Imaging Webcast/2.0" sure do use it */
-    if (hdr->has(HDR_PRAGMA)) {
-        String s = hdr->getList(HDR_PRAGMA);
-        const int no_cache = strListIsMember(&s, "no-cache", ',');
-        s.clean();
-
-        if (no_cache) {
-            if (!REFRESH_OVERRIDE(ignore_no_cache))
-                return 0;
+        if (!mayStore) {
+            debugs(22, 3, HERE << "NO because Authenticated transaction");
+            return 0;
         }
+
+        // NP: response CC:no-cache is equivalent to CC:must-revalidate,max-age=0. We MAY cache, and do so.
+        // NP: other request CC flags are limiters on HIT/MISS/REFRESH. We don't care about here.
     }
 
-    /*
-     * The "multipart/x-mixed-replace" content type is used for
+    /* HACK: The "multipart/x-mixed-replace" content type is used for
      * continuous push replies.  These are generally dynamic and
      * probably should not be cachable
      */
     if ((v = hdr->getStr(HDR_CONTENT_TYPE)))
-        if (!strncasecmp(v, "multipart/x-mixed-replace", 25))
+        if (!strncasecmp(v, "multipart/x-mixed-replace", 25)) {
+            debugs(22, 3, HERE << "NO because Content-Type:multipart/x-mixed-replace");
             return 0;
+        }
 
     switch (rep->sline.status) {
         /* Responses that are cacheable */
@@ -421,11 +457,12 @@
          */
 
         if (!refreshIsCachable(entry) && !REFRESH_OVERRIDE(store_stale)) {
-            debugs(22, 3, "refreshIsCachable() returned non-cacheable..");
+            debugs(22, 3, "NO because refreshIsCachable() returned non-cacheable..");
             return 0;
-        } else
+        } else {
+            debugs(22, 3, HERE << "YES because HTTP status " << rep->sline.status);
             return 1;
-
+        }
         /* NOTREACHED */
         break;
 
@@ -433,11 +470,17 @@
 
     case HTTP_MOVED_TEMPORARILY:
     case HTTP_TEMPORARY_REDIRECT:
-        if (rep->expires > rep->date && rep->date > 0)
+        if (rep->date <= 0) {
+            debugs(22, 3, HERE << "NO because HTTP status " << rep->sline.status << " and Date missing/invalid");
+            return 0;
+        }
+        if (rep->expires > rep->date) {
+            debugs(22, 3, HERE << "YES because HTTP status " << rep->sline.status << " and Expires > Date");
             return 1;
-        else
+        } else {
+            debugs(22, 3, HERE << "NO because HTTP status " << rep->sline.status << " and Expires <= Date");
             return 0;
-
+        }
         /* NOTREACHED */
         break;
 
@@ -466,6 +509,7 @@
     case HTTP_SERVICE_UNAVAILABLE:
 
     case HTTP_GATEWAY_TIMEOUT:
+        debugs(22, 3, HERE << "MAYBE because HTTP status " << rep->sline.status);
         return -1;
 
         /* NOTREACHED */
@@ -502,12 +546,12 @@
     case HTTP_REQUESTED_RANGE_NOT_SATISFIABLE:
     case HTTP_EXPECTATION_FAILED:
 
+        debugs(22, 3, HERE << "NO because HTTP status " << rep->sline.status);
         return 0;
 
     default:
         /* RFC 2616 section 6.1.1: an unrecognized response MUST NOT be cached. */
-        debugs (11, 3, HERE << "Unknown HTTP status code " << rep->sline.status << ". Not cacheable.");
-
+        debugs (11, 3, HERE << "NO because unknown HTTP status code " << rep->sline.status);
         return 0;
 
         /* NOTREACHED */
@@ -918,12 +962,25 @@
 
 no_cache:
 
-    if (!ignoreCacheControl && rep->cache_control) {
-        if (rep->cache_control->proxyRevalidate() ||
-                rep->cache_control->mustRevalidate() ||
-                rep->cache_control->hasSMaxAge()
-           )
-            EBIT_SET(entry->flags, ENTRY_REVALIDATE);
+    if (!ignoreCacheControl) {
+        if (rep->cache_control) {
+            if (rep->cache_control->proxyRevalidate() ||
+                    rep->cache_control->mustRevalidate() ||
+                    rep->cache_control->noCache() ||
+                    rep->cache_control->hasSMaxAge())
+                EBIT_SET(entry->flags, ENTRY_REVALIDATE);
+        }
+#if USE_HTTP_VIOLATIONS // response header Pragma::no-cache is undefined in HTTP
+        else {
+            // Expensive calculation. So only do it IF the CC: header is not present.
+
+            /* HACK: Pragma: no-cache in _replies_ is not documented in HTTP,
+             * but servers like "Active Imaging Webcast/2.0" sure do use it */
+            if (rep->header.has(HDR_PRAGMA) &&
+                    rep->header.hasListMember(HDR_PRAGMA,"no-cache",','))
+                EBIT_SET(entry->flags, ENTRY_REVALIDATE);
+        }
+#endif
     }
 
 #if HEADERS_LOG
@@ -1385,8 +1442,8 @@
                 ispinned = true;
             }
 
-            if (request->pinnedConnection() && ispinned) {
-                request->pinnedConnection()->pinConnection(serverConnection, request, _peer,
+            if (ispinned && request->clientConnectionManager.valid()) {
+                request->clientConnectionManager->pinConnection(serverConnection, request, _peer,
                         (request->flags.connection_auth != 0));
             } else {
                 fwd->pconnPush(serverConnection, request->peer_host ? request->peer_host : request->GetHost());
diff -u -r -N squid-3.2.2/src/http.h squid-3.2.3/src/http.h
--- squid-3.2.2/src/http.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/http.h	2012-10-21 01:39:49.000000000 +1300
@@ -61,6 +61,8 @@
     void processReplyBody();
     void readReply(const CommIoCbParams &io);
     virtual void maybeReadVirginBody(); // read response data from the network
+
+    // Determine whether the response is a cacheable representation
     int cacheableReply();
 
     peer *_peer;		/* peer request made to */
diff -u -r -N squid-3.2.2/src/ipc/Makefile.am squid-3.2.3/src/ipc/Makefile.am
--- squid-3.2.2/src/ipc/Makefile.am	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/Makefile.am	2012-10-21 01:39:49.000000000 +1300
@@ -46,6 +46,7 @@
 	Request.h \
 	Response.h \
 	\
+	mem/FlexibleArray.h \
 	mem/Page.cc \
 	mem/Page.h \
 	mem/PagePool.cc \
diff -u -r -N squid-3.2.2/src/ipc/Makefile.in squid-3.2.3/src/ipc/Makefile.in
--- squid-3.2.2/src/ipc/Makefile.in	2012-10-06 15:09:15.000000000 +1200
+++ squid-3.2.3/src/ipc/Makefile.in	2012-10-21 01:40:22.000000000 +1300
@@ -357,6 +357,7 @@
 	Request.h \
 	Response.h \
 	\
+	mem/FlexibleArray.h \
 	mem/Page.cc \
 	mem/Page.h \
 	mem/PagePool.cc \
diff -u -r -N squid-3.2.2/src/ipc/mem/FlexibleArray.h squid-3.2.3/src/ipc/mem/FlexibleArray.h
--- squid-3.2.2/src/ipc/mem/FlexibleArray.h	1970-01-01 12:00:00.000000000 +1200
+++ squid-3.2.3/src/ipc/mem/FlexibleArray.h	2012-10-21 01:39:49.000000000 +1300
@@ -0,0 +1,45 @@
+/*
+ */
+
+#ifndef SQUID_IPC_MEM_FLEXIBLE_ARRAY_H
+#define SQUID_IPC_MEM_FLEXIBLE_ARRAY_H
+
+// sometimes required for placement-new operator to be declared
+#include <new>
+
+namespace Ipc
+{
+
+namespace Mem
+{
+
+/// A "flexible array" of Items inside some shared memory space.
+/// A portable equivalent of a "Item items[];" data member.
+/// Some compilers such as Clang can only handle flexible arrays of PODs,
+/// and the current C++ standard does not allow flexible arrays at all.
+template <class Item>
+class FlexibleArray
+{
+public:
+    explicit FlexibleArray(const int capacity) {
+        if (capacity > 1) // the first item is initialized automatically
+            new (items+1) Item[capacity-1];
+    }
+
+    Item &operator [](const int idx) { return items[idx]; }
+    const Item &operator [](const int idx) const { return items[idx]; }
+
+    //const Item *operator ()() const { return items; }
+    //Item *operator ()() { return items; }
+
+    Item *raw() { return items; }
+
+private:
+    Item items[1]; // ensures proper alignment of array elements
+};
+
+} // namespace Mem
+
+} // namespace Ipc
+
+#endif /* SQUID_IPC_MEM_FLEXIBLE_ARRAY_H */
diff -u -r -N squid-3.2.2/src/ipc/mem/PageStack.cc squid-3.2.3/src/ipc/mem/PageStack.cc
--- squid-3.2.2/src/ipc/mem/PageStack.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/mem/PageStack.cc	2012-10-21 01:39:49.000000000 +1300
@@ -18,19 +18,14 @@
 Ipc::Mem::PageStack::PageStack(const uint32_t aPoolId, const unsigned int aCapacity, const size_t aPageSize):
         thePoolId(aPoolId), theCapacity(aCapacity), thePageSize(aPageSize),
         theSize(theCapacity),
-        theLastReadable(prev(theSize)), theFirstWritable(next(theLastReadable))
+        theLastReadable(prev(theSize)), theFirstWritable(next(theLastReadable)),
+        theItems(aCapacity)
 {
-    theItems=new Item[theSize];
     // initially, all pages are free
     for (Offset i = 0; i < theSize; ++i)
         theItems[i] = i + 1; // skip page number zero to keep numbers positive
 }
 
-Ipc::Mem::PageStack::~PageStack()
-{
-    delete[] theItems;
-}
-
 /*
  * TODO: We currently rely on the theLastReadable hint during each
  * loop iteration. We could also use hint just for the start position:
diff -u -r -N squid-3.2.2/src/ipc/mem/PageStack.h squid-3.2.3/src/ipc/mem/PageStack.h
--- squid-3.2.2/src/ipc/mem/PageStack.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/mem/PageStack.h	2012-10-21 01:39:49.000000000 +1300
@@ -7,6 +7,7 @@
 #define SQUID_IPC_MEM_PAGE_STACK_H
 
 #include "ipc/AtomicWord.h"
+#include "ipc/mem/FlexibleArray.h"
 
 namespace Ipc
 {
@@ -25,7 +26,6 @@
     typedef uint32_t Value; ///< stack item type (a free page number)
 
     PageStack(const uint32_t aPoolId, const unsigned int aCapacity, const size_t aPageSize);
-    ~PageStack();
 
     unsigned int capacity() const { return theCapacity; }
     size_t pageSize() const { return thePageSize; }
@@ -68,7 +68,7 @@
     Atomic::WordT<Offset> theFirstWritable;
 
     typedef Atomic::WordT<Value> Item;
-    Item *theItems; ///< page number storage
+    Ipc::Mem::FlexibleArray<Item> theItems; ///< page number storage
 };
 
 } // namespace Mem
diff -u -r -N squid-3.2.2/src/ipc/Queue.cc squid-3.2.3/src/ipc/Queue.cc
--- squid-3.2.2/src/ipc/Queue.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/Queue.cc	2012-10-21 01:39:49.000000000 +1300
@@ -48,15 +48,10 @@
 
 /* QueueReaders */
 
-Ipc::QueueReaders::QueueReaders(const int aCapacity): theCapacity(aCapacity)
+Ipc::QueueReaders::QueueReaders(const int aCapacity): theCapacity(aCapacity),
+        theReaders(theCapacity)
 {
     Must(theCapacity > 0);
-    theReaders=new QueueReader[theCapacity];
-}
-
-Ipc::QueueReaders::~QueueReaders()
-{
-    delete[] theReaders;
 }
 
 size_t
diff -u -r -N squid-3.2.2/src/ipc/Queue.h squid-3.2.3/src/ipc/Queue.h
--- squid-3.2.2/src/ipc/Queue.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/Queue.h	2012-10-21 01:39:49.000000000 +1300
@@ -10,6 +10,7 @@
 #include "Debug.h"
 #include "base/InstanceId.h"
 #include "ipc/AtomicWord.h"
+#include "ipc/mem/FlexibleArray.h"
 #include "ipc/mem/Pointer.h"
 #include "util.h"
 
@@ -64,16 +65,11 @@
 {
 public:
     QueueReaders(const int aCapacity);
-    ~QueueReaders();
     size_t sharedMemorySize() const;
     static size_t SharedMemorySize(const int capacity);
 
     const int theCapacity; /// number of readers
-    QueueReader *theReaders; /// readers
-private:
-    QueueReaders(); //not implemented
-    QueueReaders& operator =(const QueueReaders&); //not implemented
-    QueueReaders(const QueueReaders&); //not implemented
+    Ipc::Mem::FlexibleArray<QueueReader> theReaders; /// readers
 };
 
 /**
diff -u -r -N squid-3.2.2/src/ipc/StoreMap.cc squid-3.2.3/src/ipc/StoreMap.cc
--- squid-3.2.2/src/ipc/StoreMap.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/StoreMap.cc	2012-10-21 01:39:49.000000000 +1300
@@ -256,14 +256,14 @@
 Ipc::StoreMap::freeLocked(Slot &s, bool keepLocked)
 {
     if (s.state == Slot::Readable && cleaner)
-        cleaner->cleanReadable(&s - shared->slots);
+        cleaner->cleanReadable(&s - shared->slots.raw());
 
     s.waitingToBeFreed = false;
     s.state = Slot::Empty;
     if (!keepLocked)
         s.lock.unlockExclusive();
     --shared->count;
-    debugs(54, 5, HERE << " freed slot at " << (&s - shared->slots) <<
+    debugs(54, 5, HERE << " freed slot at " << (&s - shared->slots.raw()) <<
            " in map [" << path << ']');
 }
 
@@ -306,14 +306,8 @@
 /* Ipc::StoreMap::Shared */
 
 Ipc::StoreMap::Shared::Shared(const int aLimit, const size_t anExtrasSize):
-        limit(aLimit), extrasSize(anExtrasSize), count(0)
+        limit(aLimit), extrasSize(anExtrasSize), count(0), slots(aLimit)
 {
-    slots=new Slot[limit];
-}
-
-Ipc::StoreMap::Shared::~Shared()
-{
-    delete[] slots;
 }
 
 size_t
diff -u -r -N squid-3.2.2/src/ipc/StoreMap.h squid-3.2.3/src/ipc/StoreMap.h
--- squid-3.2.2/src/ipc/StoreMap.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipc/StoreMap.h	2012-10-21 01:39:49.000000000 +1300
@@ -2,6 +2,7 @@
 #define SQUID_IPC_STORE_MAP_H
 
 #include "ipc/ReadWriteLock.h"
+#include "ipc/mem/FlexibleArray.h"
 #include "ipc/mem/Pointer.h"
 #include "typedefs.h"
 
@@ -62,16 +63,11 @@
         Shared(const int aLimit, const size_t anExtrasSize);
         size_t sharedMemorySize() const;
         static size_t SharedMemorySize(const int limit, const size_t anExtrasSize);
-        ~Shared();
 
         const int limit; ///< maximum number of map slots
         const size_t extrasSize; ///< size of slot extra data
         Atomic::Word count; ///< current number of map slots
-        Slot *slots; ///< slots storage
-    private:
-        Shared(); //disabled
-        Shared &operator=(const Shared&); //disabled
-        Shared(const Shared&); //disabled
+        Ipc::Mem::FlexibleArray<Slot> slots; ///< slots storage
     };
 
 public:
diff -u -r -N squid-3.2.2/src/ipcache.cc squid-3.2.3/src/ipcache.cc
--- squid-3.2.2/src/ipcache.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/ipcache.cc	2012-10-21 01:39:49.000000000 +1300
@@ -429,7 +429,7 @@
         memset(i->addrs.bad_mask, 0, sizeof(unsigned char) * ipcount);
 
         for (j = 0, k = 0; k < ipcount; ++k) {
-            if ( i->addrs.in_addrs[j] = A[k] )
+            if ((i->addrs.in_addrs[j] = A[k]))
                 ++j;
             else
                 debugs(14, 1, "ipcacheParse: Invalid IP address '" << A[k] << "' in response to '" << name << "'");
diff -u -r -N squid-3.2.2/src/MemStore.cc squid-3.2.3/src/MemStore.cc
--- squid-3.2.2/src/MemStore.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/MemStore.cc	2012-10-21 01:39:49.000000000 +1300
@@ -129,7 +129,7 @@
 }
 
 bool
-MemStore::dereference(StoreEntry &)
+MemStore::dereference(StoreEntry &, bool)
 {
     // no need to keep e in the global store_table for us; we have our own map
     return false;
diff -u -r -N squid-3.2.2/src/MemStore.h squid-3.2.3/src/MemStore.h
--- squid-3.2.2/src/MemStore.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/MemStore.h	2012-10-21 01:39:49.000000000 +1300
@@ -44,7 +44,7 @@
     virtual void stat(StoreEntry &) const;
     virtual StoreSearch *search(String const url, HttpRequest *);
     virtual void reference(StoreEntry &);
-    virtual bool dereference(StoreEntry &);
+    virtual bool dereference(StoreEntry &, bool);
     virtual void maintain();
 
     static int64_t EntryLimit();
diff -u -r -N squid-3.2.2/src/snmp_core.cc squid-3.2.3/src/snmp_core.cc
--- squid-3.2.2/src/snmp_core.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/snmp_core.cc	2012-10-21 01:39:49.000000000 +1300
@@ -1036,6 +1036,7 @@
         }
     }
 
+    va_end(args);
     return (entry);
 }
 /* End of tree utility functions */
@@ -1059,6 +1060,7 @@
         }
     }
 
+    va_end(args);
     return (new_oid);
 }
 
diff -u -r -N squid-3.2.2/src/stmem.cc squid-3.2.3/src/stmem.cc
--- squid-3.2.2/src/stmem.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/stmem.cc	2012-10-21 01:39:49.000000000 +1300
@@ -105,8 +105,7 @@
 mem_hdr::freeDataUpto(int64_t target_offset)
 {
     /* keep the last one to avoid change to other part of code */
-
-    SplayNode<mem_node*> const * theStart = nodes.start();
+    SplayNode<mem_node*> const * theStart;
 
     while ((theStart = nodes.start())) {
         if (theStart == nodes.finish())
diff -u -r -N squid-3.2.2/src/store.cc squid-3.2.3/src/store.cc
--- squid-3.2.2/src/store.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/store.cc	2012-10-21 01:39:49.000000000 +1300
@@ -993,9 +993,6 @@
                    mem_obj->endOffset() > Config.Store.maxObjectSize) {
             debugs(20, 2, "StoreEntry::checkCachable: NO: too big");
             ++store_check_cachable_hist.no.too_big;
-        } else if (getReply()->content_length > Config.Store.maxObjectSize) {
-            debugs(20, 2, "StoreEntry::checkCachable: NO: too big");
-            ++store_check_cachable_hist.no.too_big;
         } else if (checkTooSmall()) {
             debugs(20, 2, "StoreEntry::checkCachable: NO: too small");
             ++store_check_cachable_hist.no.too_small;
diff -u -r -N squid-3.2.2/src/store_dir.cc squid-3.2.3/src/store_dir.cc
--- squid-3.2.2/src/store_dir.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/store_dir.cc	2012-10-21 01:39:49.000000000 +1300
@@ -706,27 +706,30 @@
 }
 
 bool
-StoreController::dereference(StoreEntry & e)
+StoreController::dereference(StoreEntry &e, bool wantsLocalMemory)
 {
-    bool keepInStoreTable = true; // keep if there are no objections
-
     // special entries do not belong to any specific Store, but are IN_MEMORY
     if (EBIT_TEST(e.flags, ENTRY_SPECIAL))
-        return keepInStoreTable;
+        return true;
+
+    bool keepInStoreTable = false; // keep only if somebody needs it there
 
     /* Notify the fs that we're not referencing this object any more */
 
     if (e.swap_filen > -1)
-        keepInStoreTable = swapDir->dereference(e) && keepInStoreTable;
+        keepInStoreTable = swapDir->dereference(e, wantsLocalMemory) || keepInStoreTable;
 
     // Notify the memory cache that we're not referencing this object any more
     if (memStore && e.mem_status == IN_MEMORY)
-        keepInStoreTable = memStore->dereference(e) && keepInStoreTable;
+        keepInStoreTable = memStore->dereference(e, wantsLocalMemory) || keepInStoreTable;
 
     // TODO: move this code to a non-shared memory cache class when we have it
     if (e.mem_obj) {
         if (mem_policy->Dereferenced)
             mem_policy->Dereferenced(mem_policy, &e, &e.mem_obj->repl);
+        // non-shared memory cache relies on store_table
+        if (!memStore)
+            keepInStoreTable = wantsLocalMemory || keepInStoreTable;
     }
 
     return keepInStoreTable;
@@ -834,9 +837,9 @@
                             (mem_node::InUseCount() <= store_pages_max);
     }
 
-    // An idle, unlocked entry that belongs to a SwapDir which controls
+    // An idle, unlocked entry that only belongs to a SwapDir which controls
     // its own index, should not stay in the global store_table.
-    if (!dereference(e)) {
+    if (!dereference(e, keepInLocalMemory)) {
         debugs(20, 5, HERE << "destroying unlocked entry: " << &e << ' ' << e);
         destroyStoreEntry(static_cast<hash_link*>(&e));
         return;
@@ -1071,9 +1074,9 @@
 }
 
 bool
-StoreHashIndex::dereference(StoreEntry &e)
+StoreHashIndex::dereference(StoreEntry &e, bool wantsLocalMemory)
 {
-    return e.store()->dereference(e);
+    return e.store()->dereference(e, wantsLocalMemory);
 }
 
 void
diff -u -r -N squid-3.2.2/src/Store.h squid-3.2.3/src/Store.h
--- squid-3.2.2/src/Store.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/Store.h	2012-10-21 01:39:49.000000000 +1300
@@ -342,7 +342,7 @@
     virtual void reference(StoreEntry &) = 0;	/* Reference this object */
 
     /// Undo reference(), returning false iff idle e should be destroyed
-    virtual bool dereference(StoreEntry &e) = 0;
+    virtual bool dereference(StoreEntry &e, bool wantsLocalMemory) = 0;
 
     virtual void maintain() = 0; /* perform regular maintenance should be private and self registered ... */
 
diff -u -r -N squid-3.2.2/src/StoreHashIndex.h squid-3.2.3/src/StoreHashIndex.h
--- squid-3.2.2/src/StoreHashIndex.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/StoreHashIndex.h	2012-10-21 01:39:49.000000000 +1300
@@ -78,7 +78,7 @@
 
     virtual void reference(StoreEntry&);
 
-    virtual bool dereference(StoreEntry&);
+    virtual bool dereference(StoreEntry&, bool);
 
     virtual void maintain();
 
diff -u -r -N squid-3.2.2/src/structs.h squid-3.2.3/src/structs.h
--- squid-3.2.2/src/structs.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/structs.h	2012-10-21 01:39:49.000000000 +1300
@@ -1053,7 +1053,6 @@
         unsigned int override_lastmod:1;
         unsigned int reload_into_ims:1;
         unsigned int ignore_reload:1;
-        unsigned int ignore_no_cache:1;
         unsigned int ignore_no_store:1;
         unsigned int ignore_must_revalidate:1;
         unsigned int ignore_private:1;
diff -u -r -N squid-3.2.2/src/SwapDir.cc squid-3.2.3/src/SwapDir.cc
--- squid-3.2.2/src/SwapDir.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/SwapDir.cc	2012-10-21 01:39:49.000000000 +1300
@@ -115,7 +115,7 @@
 SwapDir::reference(StoreEntry &) {}
 
 bool
-SwapDir::dereference(StoreEntry &)
+SwapDir::dereference(StoreEntry &, bool)
 {
     return true; // keep in global store_table
 }
diff -u -r -N squid-3.2.2/src/SwapDir.h squid-3.2.3/src/SwapDir.h
--- squid-3.2.2/src/SwapDir.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/SwapDir.h	2012-10-21 01:39:49.000000000 +1300
@@ -85,7 +85,7 @@
 
     virtual void reference(StoreEntry &);	/* Reference this object */
 
-    virtual bool dereference(StoreEntry &);	/* Unreference this object */
+    virtual bool dereference(StoreEntry &, bool);	/* Unreference this object */
 
     /* the number of store dirs being rebuilt. */
     static int store_dirs_rebuilding;
@@ -207,7 +207,7 @@
     virtual bool canStore(const StoreEntry &e, int64_t diskSpaceNeeded, int &load) const = 0;
     /* These two are notifications */
     virtual void reference(StoreEntry &);	/* Reference this object */
-    virtual bool dereference(StoreEntry &);	/* Unreference this object */
+    virtual bool dereference(StoreEntry &, bool);	/* Unreference this object */
     virtual int callback();	/* Handle pending callbacks */
     virtual void sync();	/* Sync the store prior to shutdown */
     virtual StoreIOState::Pointer createStoreIO(StoreEntry &, StoreIOState::STFNCB *, StoreIOState::STIOCB *, void *) = 0;
diff -u -r -N squid-3.2.2/src/tests/stub_MemStore.cc squid-3.2.3/src/tests/stub_MemStore.cc
--- squid-3.2.2/src/tests/stub_MemStore.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/tests/stub_MemStore.cc	2012-10-21 01:39:49.000000000 +1300
@@ -30,4 +30,4 @@
 uint64_t MemStore::currentCount() const STUB_RETVAL(0)
 int64_t MemStore::maxObjectSize() const STUB_RETVAL(0)
 StoreSearch *MemStore::search(String const, HttpRequest *) STUB_RETVAL(NULL)
-bool MemStore::dereference(StoreEntry &) STUB_RETVAL(false)
+bool MemStore::dereference(StoreEntry &, bool) STUB_RETVAL(false)
diff -u -r -N squid-3.2.2/src/tests/testStore.h squid-3.2.3/src/tests/testStore.h
--- squid-3.2.2/src/tests/testStore.h	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/tests/testStore.h	2012-10-21 01:39:49.000000000 +1300
@@ -71,7 +71,7 @@
 
     virtual void reference(StoreEntry &) {}	/* Reference this object */
 
-    virtual bool dereference(StoreEntry &) { return true; }
+    virtual bool dereference(StoreEntry &, bool) { return true; }
 
     virtual StoreSearch *search(String const url, HttpRequest *);
 };
diff -u -r -N squid-3.2.2/src/url.cc squid-3.2.3/src/url.cc
--- squid-3.2.2/src/url.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/src/url.cc	2012-10-21 01:39:49.000000000 +1300
@@ -310,7 +310,8 @@
         port = urlDefaultPort(protocol);
 
         /* Is there any login information? (we should eventually parse it above) */
-        if ((t = strrchr(host, '@'))) {
+        t = strrchr(host, '@');
+        if (t != NULL) {
             strcpy((char *) login, (char *) host);
             t = strrchr(login, '@');
             *t = 0;
diff -u -r -N squid-3.2.2/tools/squidclient.cc squid-3.2.3/tools/squidclient.cc
--- squid-3.2.2/tools/squidclient.cc	2012-10-06 15:08:36.000000000 +1200
+++ squid-3.2.3/tools/squidclient.cc	2012-10-21 01:39:49.000000000 +1300
@@ -35,6 +35,7 @@
 #include "squid.h"
 #include "base64.h"
 #include "ip/Address.h"
+#include "ip/tools.h"
 #include "rfc1123.h"
 #include "SquidTime.h"
 
@@ -246,6 +247,7 @@
     pcount = 0;
     ping_int = 1 * 1000;
 
+    Ip::ProbeTransport(); // determine IPv4 or IPv6 capabilities before parsing.
     if (argc < 2) {
         usage(argv[0]);		/* need URL */
     } else if (argc >= 2) {
