diff -u -r -N squid-4.0.15/ChangeLog squid-4.0.16/ChangeLog
--- squid-4.0.15/ChangeLog	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/ChangeLog	2016-10-31 01:24:50.000000000 +1300
@@ -1,3 +1,11 @@
+Changes to squid-4.0.16 (30 Oct 2016):
+
+	- Avoid segfaults when lacking the server name for certificate validator
+	- HTTP: initial support for Cache-Control:immutable
+	- Fix ssl::server_name ACL
+	- ... and many code polishing updates
+	- ... and some fixes from 3.5.23
+
 Changes to squid-4.0.15 (09 Oct 2016):
 
 	- Regression fix crash on reconfigure with TOS/DiffServ/MARK configured
diff -u -r -N squid-4.0.15/configure squid-4.0.16/configure
--- squid-4.0.15/configure	2016-10-10 08:20:15.000000000 +1300
+++ squid-4.0.16/configure	2016-10-31 01:28:43.000000000 +1300
@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision.
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for Squid Web Proxy 4.0.15.
+# Generated by GNU Autoconf 2.69 for Squid Web Proxy 4.0.16.
 #
 # Report bugs to <http://bugs.squid-cache.org/>.
 #
@@ -595,8 +595,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='4.0.15'
-PACKAGE_STRING='Squid Web Proxy 4.0.15'
+PACKAGE_VERSION='4.0.16'
+PACKAGE_STRING='Squid Web Proxy 4.0.16'
 PACKAGE_BUGREPORT='http://bugs.squid-cache.org/'
 PACKAGE_URL=''
 
@@ -1648,7 +1648,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 4.0.15 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 4.0.16 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1719,7 +1719,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 4.0.15:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 4.0.16:";;
    esac
   cat <<\_ACEOF
 
@@ -2148,7 +2148,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 4.0.15
+Squid Web Proxy configure 4.0.16
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -3252,7 +3252,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 4.0.15, which was
+It was created by Squid Web Proxy $as_me 4.0.16, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4119,7 +4119,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='4.0.15'
+ VERSION='4.0.16'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -42599,7 +42599,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 4.0.15, which was
+This file was extended by Squid Web Proxy $as_me 4.0.16, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -42665,7 +42665,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-Squid Web Proxy config.status 4.0.15
+Squid Web Proxy config.status 4.0.16
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff -u -r -N squid-4.0.15/configure.ac squid-4.0.16/configure.ac
--- squid-4.0.15/configure.ac	2016-10-10 08:20:13.000000000 +1300
+++ squid-4.0.16/configure.ac	2016-10-31 01:28:42.000000000 +1300
@@ -5,7 +5,7 @@
 ## Please see the COPYING and CONTRIBUTORS files for details.
 ##
 
-AC_INIT([Squid Web Proxy],[4.0.15],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[4.0.16],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
diff -u -r -N squid-4.0.15/contrib/url-normalizer.pl squid-4.0.16/contrib/url-normalizer.pl
--- squid-4.0.15/contrib/url-normalizer.pl	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/contrib/url-normalizer.pl	2016-10-31 01:24:50.000000000 +1300
@@ -1,4 +1,11 @@
 #!/usr/local/bin/perl -Tw
+#
+# * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
+# *
+# * Squid software is distributed under GPLv2+ license and includes
+# * contributions from numerous individuals and organizations.
+# * Please see the COPYING and CONTRIBUTORS files for details.
+#
 
 # From:    Markus Gyger <mgyger@itr.ch>
 #
diff -u -r -N squid-4.0.15/contrib/user-agents.pl squid-4.0.16/contrib/user-agents.pl
--- squid-4.0.15/contrib/user-agents.pl	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/contrib/user-agents.pl	2016-10-31 01:24:50.000000000 +1300
@@ -1,5 +1,13 @@
 #!/usr/bin/perl
 #
+# * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
+# *
+# * Squid software is distributed under GPLv2+ license and includes
+# * contributions from numerous individuals and organizations.
+# * Please see the COPYING and CONTRIBUTORS files for details.
+#
+
+#
 # John@MCC.ac.uk
 # John@Pharmweb.NET
 
diff -u -r -N squid-4.0.15/CONTRIBUTORS squid-4.0.16/CONTRIBUTORS
--- squid-4.0.15/CONTRIBUTORS	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/CONTRIBUTORS	2016-10-31 01:24:50.000000000 +1300
@@ -205,6 +205,8 @@
     Joe Ramey <ramey@jello.csc.ti.com>
     Joerg Lehrke <jlehrke@noc.de>
     Johnathan Conley <johnathan.conley@gmail.com>
+    John@MCC.ac.uk
+    John@Pharmweb.NET
     John Dilley <jad@hpl.hp.com>
     John Saunders <johns@rd.scitec.com.au>
     John Xue <xgxjohn@gmail.com>
diff -u -r -N squid-4.0.15/doc/release-notes/release-4.html squid-4.0.16/doc/release-notes/release-4.html
--- squid-4.0.15/doc/release-notes/release-4.html	2016-10-10 11:51:35.000000000 +1300
+++ squid-4.0.16/doc/release-notes/release-4.html	2016-10-31 03:14:55.000000000 +1300
@@ -2,10 +2,10 @@
 <HTML>
 <HEAD>
  <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.72">
- <TITLE>Squid 4.0.15 release notes</TITLE>
+ <TITLE>Squid 4.0.16 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 4.0.15 release notes</H1>
+<H1>Squid 4.0.16 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -61,7 +61,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-4.0.15 for testing.</P>
+<P>The Squid Team are pleased to announce the release of Squid-4.0.16 for testing.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v4/">http://www.squid-cache.org/Versions/v4/</A> or the
 <A HREF="http://www.squid-cache.org/Download/http-mirrors.html">mirrors</A>.</P>
diff -u -r -N squid-4.0.15/include/version.h squid-4.0.16/include/version.h
--- squid-4.0.15/include/version.h	2016-10-10 08:20:15.000000000 +1300
+++ squid-4.0.16/include/version.h	2016-10-31 01:28:44.000000000 +1300
@@ -7,7 +7,7 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1476039939
+#define SQUID_RELEASE_TIME 1477830283
 #endif
 
 /*
diff -u -r -N squid-4.0.15/RELEASENOTES.html squid-4.0.16/RELEASENOTES.html
--- squid-4.0.15/RELEASENOTES.html	2016-10-10 11:51:35.000000000 +1300
+++ squid-4.0.16/RELEASENOTES.html	2016-10-31 03:14:55.000000000 +1300
@@ -2,10 +2,10 @@
 <HTML>
 <HEAD>
  <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.72">
- <TITLE>Squid 4.0.15 release notes</TITLE>
+ <TITLE>Squid 4.0.16 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 4.0.15 release notes</H1>
+<H1>Squid 4.0.16 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -61,7 +61,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-4.0.15 for testing.</P>
+<P>The Squid Team are pleased to announce the release of Squid-4.0.16 for testing.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v4/">http://www.squid-cache.org/Versions/v4/</A> or the
 <A HREF="http://www.squid-cache.org/Download/http-mirrors.html">mirrors</A>.</P>
diff -u -r -N squid-4.0.15/src/AccessLogEntry.cc squid-4.0.16/src/AccessLogEntry.cc
--- squid-4.0.15/src/AccessLogEntry.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/AccessLogEntry.cc	2016-10-31 01:24:50.000000000 +1300
@@ -30,14 +30,17 @@
         log_ip = request->indirect_client_addr;
     else
 #endif
-        if (tcpClient != NULL)
+        if (tcpClient)
             log_ip = tcpClient->remote;
-        else if (cache.caddr.isNoAddr()) { // e.g., ICAP OPTIONS lack client
-            strncpy(buf, "-", bufsz);
-            return;
-        } else
+        else
             log_ip = cache.caddr;
 
+    // internally generated requests (and some ICAP) lack client IP
+    if (log_ip.isNoAddr()) {
+        strncpy(buf, "-", bufsz);
+        return;
+    }
+
     // Apply so-called 'privacy masking' to IPv4 clients
     // - localhost IP is always shown in full
     // - IPv4 clients masked with client_netmask
diff -u -r -N squid-4.0.15/src/acl/AclDenyInfoList.h squid-4.0.16/src/acl/AclDenyInfoList.h
--- squid-4.0.15/src/acl/AclDenyInfoList.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/acl/AclDenyInfoList.h	2016-10-31 01:24:50.000000000 +1300
@@ -9,18 +9,35 @@
 #ifndef SQUID_ACLDENYINFOLIST_H_
 #define SQUID_ACLDENYINFOLIST_H_
 
+#include "acl/AclNameList.h"
 #include "err_type.h"
-
-class AclNameList;
+#include "errorpage.h"
+#include "mem/forward.h"
 
 /// deny_info representation. Currently a POD.
 class AclDenyInfoList
 {
+    MEMPROXY_CLASS(AclDenyInfoList);
+
 public:
-    err_type err_page_id;
-    char *err_page_name;
-    AclNameList *acl_list;
-    AclDenyInfoList *next;
+    AclDenyInfoList(const char *t) {
+        err_page_name = xstrdup(t);
+        err_page_id = errorReservePageId(t);
+    }
+    ~AclDenyInfoList() {
+        xfree(err_page_name);
+        delete acl_list;
+        while (next) {
+            auto *a = next;
+            next = a->next;
+            a->next = nullptr;
+            delete a;
+        }
+    }
+    err_type err_page_id = ERR_NONE;
+    char *err_page_name = nullptr;
+    AclNameList *acl_list = nullptr;
+    AclDenyInfoList *next = nullptr;
 };
 
 #endif /* SQUID_ACLDENYINFOLIST_H_ */
diff -u -r -N squid-4.0.15/src/acl/AclNameList.h squid-4.0.16/src/acl/AclNameList.h
--- squid-4.0.15/src/acl/AclNameList.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/acl/AclNameList.h	2016-10-31 01:24:50.000000000 +1300
@@ -10,13 +10,24 @@
 #define SQUID_ACL_ACLNAMELIST_H_
 
 #include "acl/forward.h"
+#include "mem/forward.h"
 
-/// list of name-based ACLs. Currently a POD.
+/// list of name-based ACLs
 class AclNameList
 {
+    MEMPROXY_CLASS(AclNameList);
+
 public:
+    AclNameList(const char *t) {
+        xstrncpy(name, t, ACL_NAME_SZ-1);
+    }
+    ~AclNameList() {
+        // recursion is okay, these lists are short
+        delete next;
+    }
+
     char name[ACL_NAME_SZ];
-    AclNameList *next;
+    AclNameList *next = nullptr;
 };
 // TODO: convert to a std::list<string>
 
diff -u -r -N squid-4.0.15/src/acl/Checklist.cc squid-4.0.16/src/acl/Checklist.cc
--- squid-4.0.15/src/acl/Checklist.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/acl/Checklist.cc	2016-10-31 01:24:50.000000000 +1300
@@ -394,7 +394,7 @@
 ACLChecklist::bannedAction(const allow_t &action) const
 {
     const bool found = std::find(bannedActions_.begin(), bannedActions_.end(), action) != bannedActions_.end();
-    debugs(28, 5, "Action '" << action << "/" << action.kind << (found ? " is " : "is not") << " banned");
+    debugs(28, 5, "Action '" << action << "/" << action.kind << (found ? "' is " : "' is not") << " banned");
     return found;
 }
 
diff -u -r -N squid-4.0.15/src/acl/external/delayer/ext_delayer_acl.8 squid-4.0.16/src/acl/external/delayer/ext_delayer_acl.8
--- squid-4.0.15/src/acl/external/delayer/ext_delayer_acl.8	2016-10-10 11:54:25.000000000 +1300
+++ squid-4.0.16/src/acl/external/delayer/ext_delayer_acl.8	2016-10-31 03:17:46.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_DELAYER_ACL 8"
-.TH EXT_DELAYER_ACL 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH EXT_DELAYER_ACL 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/acl/external/SQL_session/ext_sql_session_acl.8 squid-4.0.16/src/acl/external/SQL_session/ext_sql_session_acl.8
--- squid-4.0.15/src/acl/external/SQL_session/ext_sql_session_acl.8	2016-10-10 11:55:00.000000000 +1300
+++ squid-4.0.16/src/acl/external/SQL_session/ext_sql_session_acl.8	2016-10-31 03:18:16.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_SQL_SESSION_ACL 8"
-.TH EXT_SQL_SESSION_ACL 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH EXT_SQL_SESSION_ACL 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8 squid-4.0.16/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8
--- squid-4.0.15/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8	2016-10-10 11:55:22.000000000 +1300
+++ squid-4.0.16/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8	2016-10-31 03:18:28.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_WBINFO_GROUP_ACL 8"
-.TH EXT_WBINFO_GROUP_ACL 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH EXT_WBINFO_GROUP_ACL 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/acl/Gadgets.cc squid-4.0.16/src/acl/Gadgets.cc
--- squid-4.0.15/src/acl/Gadgets.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/acl/Gadgets.cc	2016-10-31 01:24:50.000000000 +1300
@@ -19,7 +19,6 @@
 #include "squid.h"
 #include "acl/Acl.h"
 #include "acl/AclDenyInfoList.h"
-#include "acl/AclNameList.h"
 #include "acl/Checklist.h"
 #include "acl/Gadgets.h"
 #include "acl/Strategised.h"
@@ -105,9 +104,8 @@
 aclParseDenyInfoLine(AclDenyInfoList ** head)
 {
     char *t = NULL;
-    AclDenyInfoList *A = NULL;
-    AclDenyInfoList *B = NULL;
-    AclDenyInfoList **T = NULL;
+    AclDenyInfoList *B;
+    AclDenyInfoList **T;
     AclNameList *L = NULL;
     AclNameList **Tail = NULL;
 
@@ -119,16 +117,13 @@
         return;
     }
 
-    A = (AclDenyInfoList *)memAllocate(MEM_ACL_DENY_INFO_LIST);
-    A->err_page_id = errorReservePageId(t);
-    A->err_page_name = xstrdup(t);
-    A->next = (AclDenyInfoList *) NULL;
+    AclDenyInfoList *A = new AclDenyInfoList(t);
+
     /* next expect a list of ACL names */
     Tail = &A->acl_list;
 
     while ((t = ConfigParser::NextToken())) {
-        L = (AclNameList *)memAllocate(MEM_ACL_NAME_LIST);
-        xstrncpy(L->name, t, ACL_NAME_SZ-1);
+        L = new AclNameList(t);
         *Tail = L;
         Tail = &L->next;
     }
@@ -136,7 +131,7 @@
     if (A->acl_list == NULL) {
         debugs(28, DBG_CRITICAL, "aclParseDenyInfoLine: " << cfg_filename << " line " << config_lineno << ": " << config_input_line);
         debugs(28, DBG_CRITICAL, "aclParseDenyInfoLine: deny_info line contains no ACL's, skipping");
-        memFree(A, MEM_ACL_DENY_INFO_LIST);
+        delete A;
         return;
     }
 
@@ -315,8 +310,7 @@
         }
 
         a_next = a->next;
-        xfree(a->err_page_name);
-        memFree(a, MEM_ACL_DENY_INFO_LIST);
+        delete a;
     }
 
     *list = NULL;
diff -u -r -N squid-4.0.15/src/acl/RegexData.cc squid-4.0.16/src/acl/RegexData.cc
--- squid-4.0.15/src/acl/RegexData.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/acl/RegexData.cc	2016-10-31 01:24:50.000000000 +1300
@@ -21,7 +21,7 @@
 #include "base/RegexPattern.h"
 #include "ConfigParser.h"
 #include "Debug.h"
-#include "wordlist.h"
+#include "sbuf/List.h"
 
 ACLRegexData::~ACLRegexData()
 {
@@ -38,7 +38,7 @@
     // walk the list of patterns to see if one matches
     for (auto &i : data) {
         if (i.match(word)) {
-            debugs(28, 2, "'" << i.c_str() << "' found in '" << word << "'");
+            debugs(28, 2, '\'' << i.c_str() << "' found in '" << word << '\'');
             // TODO: old code also popped the pattern to second place of the list
             // in order to reduce patterns search times.
             return 1;
@@ -59,14 +59,14 @@
     for (auto &i : data) {
         if (i.flags != flags) {
             if ((i.flags&REG_ICASE) != 0) {
-                sl.push_back(SBuf("-i"));
+                sl.emplace_back("-i");
             } else {
-                sl.push_back(SBuf("+i"));
+                sl.emplace_back("+i");
             }
             flags = i.flags;
         }
 
-        sl.push_back(SBuf(i.c_str()));
+        sl.emplace_back(i.c_str());
     }
 
     return sl;
@@ -88,12 +88,12 @@
     }
 
     if (*t == '\0') {
-        debugs(28, DBG_IMPORTANT, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_IMPORTANT, cfg_filename << " line " << config_lineno << ": " << config_input_line);
         debugs(28, DBG_IMPORTANT, "WARNING: regular expression '" << orig << "' has only wildcards and matches all strings. Using '.*' instead.");
         return ".*";
     }
     if (t != orig) {
-        debugs(28, DBG_IMPORTANT, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_IMPORTANT, cfg_filename << " line " << config_lineno << ": " << config_input_line);
         debugs(28, DBG_IMPORTANT, "WARNING: regular expression '" << orig << "' has unnecessary wildcard(s). Using '" << t << "' instead.");
     }
 
@@ -101,7 +101,7 @@
 }
 
 static bool
-compileRE(std::list<RegexPattern> &curlist, char * RE, int flags)
+compileRE(std::list<RegexPattern> &curlist, const char * RE, int flags)
 {
     if (RE == NULL || *RE == '\0')
         return curlist.empty(); // XXX: old code did this. It looks wrong.
@@ -110,7 +110,7 @@
     if (int errcode = regcomp(&comp, RE, flags)) {
         char errbuf[256];
         regerror(errcode, &comp, errbuf, sizeof errbuf);
-        debugs(28, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, DBG_CRITICAL, cfg_filename << " line " << config_lineno << ": " << config_input_line);
         debugs(28, DBG_CRITICAL, "ERROR: invalid regular expression: '" << RE << "': " << errbuf);
         return false;
     }
@@ -127,7 +127,7 @@
  * called only once per ACL.
  */
 static int
-compileOptimisedREs(std::list<RegexPattern> &curlist, wordlist * wl)
+compileOptimisedREs(std::list<RegexPattern> &curlist, const SBufList &sl)
 {
     std::list<RegexPattern> newlist;
     int numREs = 0;
@@ -136,56 +136,55 @@
     char largeRE[BUFSIZ];
     *largeRE = 0;
 
-    while (wl != NULL) {
+    for (const SBuf & configurationLineWord : sl) {
         int RElen;
-        RElen = strlen( wl->key );
+        RElen = configurationLineWord.length();
 
-        if (strcmp(wl->key, "-i") == 0) {
+        static const SBuf minus_i("-i");
+        static const SBuf plus_i("+i");
+        if (configurationLineWord == minus_i) {
             if (flags & REG_ICASE) {
                 /* optimisation of  -i ... -i */
-                debugs(28, 2, "compileOptimisedREs: optimisation of -i ... -i" );
+                debugs(28, 2, "optimisation of -i ... -i" );
             } else {
-                debugs(28, 2, "compileOptimisedREs: -i" );
+                debugs(28, 2, "-i" );
                 if (!compileRE(newlist, largeRE, flags))
                     return 0;
                 flags |= REG_ICASE;
                 largeRE[largeREindex=0] = '\0';
             }
-        } else if (strcmp(wl->key, "+i") == 0) {
+        } else if (configurationLineWord == plus_i) {
             if ((flags & REG_ICASE) == 0) {
                 /* optimisation of  +i ... +i */
-                debugs(28, 2, "compileOptimisedREs: optimisation of +i ... +i");
+                debugs(28, 2, "optimisation of +i ... +i");
             } else {
-                debugs(28, 2, "compileOptimisedREs: +i");
+                debugs(28, 2, "+i");
                 if (!compileRE(newlist, largeRE, flags))
                     return 0;
                 flags &= ~REG_ICASE;
                 largeRE[largeREindex=0] = '\0';
             }
         } else if (RElen + largeREindex + 3 < BUFSIZ-1) {
-            debugs(28, 2, "compileOptimisedREs: adding RE '" << wl->key << "'");
+            debugs(28, 2, "adding RE '" << configurationLineWord << "'");
             if (largeREindex > 0) {
                 largeRE[largeREindex] = '|';
                 ++largeREindex;
             }
             largeRE[largeREindex] = '(';
             ++largeREindex;
-            for (char * t = wl->key; *t != '\0'; ++t) {
-                largeRE[largeREindex] = *t;
-                ++largeREindex;
-            }
+            configurationLineWord.copy(largeRE+largeREindex, BUFSIZ-largeREindex);
+            largeREindex += configurationLineWord.length();
             largeRE[largeREindex] = ')';
             ++largeREindex;
             largeRE[largeREindex] = '\0';
             ++numREs;
         } else {
-            debugs(28, 2, "compileOptimisedREs: buffer full, generating new optimised RE..." );
+            debugs(28, 2, "buffer full, generating new optimised RE..." );
             if (!compileRE(newlist, largeRE, flags))
                 return 0;
             largeRE[largeREindex=0] = '\0';
             continue;    /* do the loop again to add the RE to largeRE */
         }
-        wl = wl->next;
     }
 
     if (!compileRE(newlist, largeRE, flags))
@@ -194,9 +193,9 @@
     /* all was successful, so put the new list at the tail */
     curlist.splice(curlist.end(), newlist);
 
-    debugs(28, 2, "compileOptimisedREs: " << numREs << " REs are optimised into one RE.");
+    debugs(28, 2, numREs << " REs are optimised into one RE.");
     if (numREs > 100) {
-        debugs(28, (opt_parse_cfg_only?DBG_IMPORTANT:2), "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+        debugs(28, (opt_parse_cfg_only?DBG_IMPORTANT:2), cfg_filename << " line " << config_lineno << ": " << config_input_line);
         debugs(28, (opt_parse_cfg_only?DBG_IMPORTANT:2), "WARNING: there are more than 100 regular expressions. " <<
                "Consider using less REs or use rules without expressions like 'dstdomain'.");
     }
@@ -205,20 +204,21 @@
 }
 
 static void
-compileUnoptimisedREs(std::list<RegexPattern> &curlist, wordlist * wl)
+compileUnoptimisedREs(std::list<RegexPattern> &curlist, const SBufList &sl)
 {
     int flags = REG_EXTENDED | REG_NOSUB;
 
-    while (wl != NULL) {
-        if (strcmp(wl->key, "-i") == 0) {
+    static const SBuf minus_i("-i"), plus_i("+i");
+    for (auto configurationLineWord : sl) {
+        if (configurationLineWord == minus_i) {
             flags |= REG_ICASE;
-        } else if (strcmp(wl->key, "+i") == 0) {
+        } else if (configurationLineWord == plus_i) {
             flags &= ~REG_ICASE;
         } else {
-            if (!compileRE(curlist, wl->key , flags))
-                debugs(28, DBG_CRITICAL, "ERROR: Skipping regular expression. Compile failed: '" << wl->key << "'");
+            if (!compileRE(curlist, configurationLineWord.c_str() , flags))
+                debugs(28, DBG_CRITICAL, "ERROR: Skipping regular expression. "
+                       "Compile failed: '" << configurationLineWord << "'");
         }
-        wl = wl->next;
     }
 }
 
@@ -227,24 +227,22 @@
 {
     debugs(28, 2, "new Regex line or file");
 
-    wordlist *wl = NULL;
+    SBufList sl;
     while (char *t = ConfigParser::RegexStrtokFile()) {
         const char *clean = removeUnnecessaryWildcards(t);
         if (strlen(clean) > BUFSIZ-1) {
-            debugs(28, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
+            debugs(28, DBG_CRITICAL, cfg_filename << " line " << config_lineno << ": " << config_input_line);
             debugs(28, DBG_CRITICAL, "ERROR: Skipping regular expression. Larger than " << BUFSIZ-1 << " characters: '" << clean << "'");
         } else {
             debugs(28, 3, "buffering RE '" << clean << "'");
-            wordlistAdd(&wl, clean);
+            sl.emplace_back(clean);
         }
     }
 
-    if (!compileOptimisedREs(data, wl)) {
+    if (!compileOptimisedREs(data, sl)) {
         debugs(28, DBG_IMPORTANT, "WARNING: optimisation of regular expressions failed; using fallback method without optimisation");
-        compileUnoptimisedREs(data, wl);
+        compileUnoptimisedREs(data, sl);
     }
-
-    wordlistDestroy(&wl);
 }
 
 bool
diff -u -r -N squid-4.0.15/src/acl/ServerName.cc squid-4.0.16/src/acl/ServerName.cc
--- squid-4.0.15/src/acl/ServerName.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/acl/ServerName.cc	2016-10-31 01:24:50.000000000 +1300
@@ -91,27 +91,29 @@
 {
     assert(checklist != NULL && checklist->request != NULL);
 
-    if (checklist->conn() && checklist->conn()->serverBump()) {
-        if (X509 *peer_cert = checklist->conn()->serverBump()->serverCert.get()) {
-            if (Ssl::matchX509CommonNames(peer_cert, (void *)data, check_cert_domain<MatchType>))
-                return 1;
+    const char *serverName = nullptr;
+    SBuf serverNameKeeper; // because c_str() is not constant
+    if (ConnStateData *conn = checklist->conn()) {
+
+        if (conn->serverBump()) {
+            if (X509 *peer_cert = conn->serverBump()->serverCert.get())
+                return Ssl::matchX509CommonNames(peer_cert, (void *)data, check_cert_domain<MatchType>);
         }
-    }
 
-    const char *serverName = NULL;
-    if (checklist->conn() && !checklist->conn()->sslCommonName().isEmpty()) {
-        SBuf scn = checklist->conn()->sslCommonName();
-        serverName = scn.c_str();
+        if (conn->sslCommonName().isEmpty()) {
+            const char *host = checklist->request->url.host();
+            if (host && *host) // paranoid first condition: host() is never nil
+                serverName = host;
+        } else {
+            serverNameKeeper = conn->sslCommonName();
+            serverName = serverNameKeeper.c_str();
+        }
     }
 
-    if (serverName == NULL)
-        serverName = checklist->request->url.host();
-
-    if (serverName && data->match(serverName)) {
-        return 1;
-    }
+    if (!serverName)
+        serverName = "none";
 
-    return data->match("none");
+    return data->match(serverName);
 }
 
 ACLServerNameStrategy *
diff -u -r -N squid-4.0.15/src/adaptation/icap/ModXact.cc squid-4.0.16/src/adaptation/icap/ModXact.cc
--- squid-4.0.15/src/adaptation/icap/ModXact.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/adaptation/icap/ModXact.cc	2016-10-31 01:24:50.000000000 +1300
@@ -1309,7 +1309,8 @@
         virgin_msg = virgin_request_;
     assert(virgin_msg != virgin.cause);
     al.http.clientRequestSz.header = virgin_msg->hdr_sz;
-    al.http.clientRequestSz.payloadData = virgin_msg->body_pipe->producedSize();
+    if (virgin_msg->body_pipe != NULL)
+        al.http.clientRequestSz.payloadData = virgin_msg->body_pipe->producedSize();
 
     // leave al.icap.bodyBytesRead negative if no body
     if (replyHttpHeaderSize >= 0 || replyHttpBodySize >= 0) {
diff -u -r -N squid-4.0.15/src/anyp/PortCfg.cc squid-4.0.16/src/anyp/PortCfg.cc
--- squid-4.0.15/src/anyp/PortCfg.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/anyp/PortCfg.cc	2016-10-31 01:24:50.000000000 +1300
@@ -44,8 +44,8 @@
     ,
     clientca(NULL),
     sslContextSessionId(NULL),
-    generateHostCertificates(false),
-    dynamicCertMemCacheSize(std::numeric_limits<size_t>::max()),
+    generateHostCertificates(true),
+    dynamicCertMemCacheSize(4*1024*1024), // 4 MB
     signingCert(),
     signPkey(),
     certsToChain(),
diff -u -r -N squid-4.0.15/src/auth/basic/DB/basic_db_auth.8 squid-4.0.16/src/auth/basic/DB/basic_db_auth.8
--- squid-4.0.15/src/auth/basic/DB/basic_db_auth.8	2016-10-10 11:57:47.000000000 +1300
+++ squid-4.0.16/src/auth/basic/DB/basic_db_auth.8	2016-10-31 03:20:15.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_DB_AUTH 8"
-.TH BASIC_DB_AUTH 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH BASIC_DB_AUTH 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/auth/basic/POP3/basic_pop3_auth.8 squid-4.0.16/src/auth/basic/POP3/basic_pop3_auth.8
--- squid-4.0.15/src/auth/basic/POP3/basic_pop3_auth.8	2016-10-10 11:58:16.000000000 +1300
+++ squid-4.0.16/src/auth/basic/POP3/basic_pop3_auth.8	2016-10-31 03:20:41.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_POP3_AUTH 8"
-.TH BASIC_POP3_AUTH 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH BASIC_POP3_AUTH 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/cache_cf.cc squid-4.0.16/src/cache_cf.cc
--- squid-4.0.15/src/cache_cf.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/cache_cf.cc	2016-10-31 01:24:50.000000000 +1300
@@ -11,7 +11,6 @@
 #include "squid.h"
 #include "acl/Acl.h"
 #include "acl/AclDenyInfoList.h"
-#include "acl/AclNameList.h"
 #include "acl/AclSizeLimit.h"
 #include "acl/Address.h"
 #include "acl/Gadgets.h"
@@ -2363,12 +2362,10 @@
 static void
 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
 {
-    AclNameList *a;
-
     while (var != NULL) {
         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
 
-        for (a = var->acl_list; a != NULL; a = a->next)
+        for (auto *a = var->acl_list; a != NULL; a = a->next)
             storeAppendPrintf(entry, " %s", a->name);
 
         storeAppendPrintf(entry, "\n");
@@ -2386,24 +2383,8 @@
 void
 free_denyinfo(AclDenyInfoList ** list)
 {
-    AclDenyInfoList *a = NULL;
-    AclDenyInfoList *a_next = NULL;
-    AclNameList *l = NULL;
-    AclNameList *l_next = NULL;
-
-    for (a = *list; a; a = a_next) {
-        for (l = a->acl_list; l; l = l_next) {
-            l_next = l->next;
-            memFree(l, MEM_ACL_NAME_LIST);
-            l = NULL;
-        }
-
-        a_next = a->next;
-        memFree(a, MEM_ACL_DENY_INFO_LIST);
-        a = NULL;
-    }
-
-    *list = NULL;
+    delete *list;
+    *list = nullptr;
 }
 
 static void
@@ -3882,11 +3863,11 @@
     if (s->sslContextSessionId)
         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
 
-    if (s->generateHostCertificates)
-        storeAppendPrintf(e, " generate-host-certificates");
+    if (!s->generateHostCertificates)
+        storeAppendPrintf(e, " generate-host-certificates=off");
 
-    if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
-        storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
+    if (s->dynamicCertMemCacheSize != 4*1024*1024) // 4MB default
+        storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%" PRIuSIZE "%s\n", s->dynamicCertMemCacheSize, B_BYTES_STR);
 #endif
 }
 
diff -u -r -N squid-4.0.15/src/cf.data.pre squid-4.0.16/src/cf.data.pre
--- squid-4.0.15/src/cf.data.pre	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/cf.data.pre	2016-10-31 01:24:50.000000000 +1300
@@ -810,7 +810,7 @@
 
 	  children-max=n
 			Maximum number of acl helper processes spawned to service
-			external acl lookups of this type. (default 20)
+			external acl lookups of this type. (default 5)
 
 	  children-startup=n
 			Minimum number of acl helper processes to spawn during
@@ -1292,6 +1292,9 @@
 	  # During each Ssl-Bump step, Squid may improve its understanding of a
 	  # "true server name". Unlike dstdomain, this ACL does not perform
 	  # DNS lookups.
+	  # The "none" name can be used to match transactions where Squid
+	  # could not compute the server name using any information source
+	  # already available at the ACL evaluation time.
 
 	acl aclname ssl::server_name_regex [-i] \.foo\.com ...
 	  # regex matches server name obtained from various sources [fast]
diff -u -r -N squid-4.0.15/src/client_side.cc squid-4.0.16/src/client_side.cc
--- squid-4.0.15/src/client_side.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/client_side.cc	2016-10-31 01:24:50.000000000 +1300
@@ -2719,14 +2719,6 @@
         debugs(83, 5, "FD " << fd << " has no certificate.");
     }
 
-#if defined(TLSEXT_NAMETYPE_host_name)
-    if (!conn->serverBump()) {
-        // when in bumpClientFirst mode, get the server name from SNI
-        if (const char *server = SSL_get_servername(session.get(), TLSEXT_NAMETYPE_host_name))
-            conn->resetSslCommonName(server);
-    }
-#endif
-
     conn->readSomeData();
 }
 
@@ -3186,7 +3178,13 @@
 
     // Even if the parser failed, each TLS detail should either be set
     // correctly or still be "unknown"; copying unknown detail is a no-op.
-    clientConnection->tlsNegotiations()->retrieveParsedInfo(tlsParser.details);
+    Security::TlsDetails::Pointer const &details = tlsParser.details;
+    clientConnection->tlsNegotiations()->retrieveParsedInfo(details);
+    if (details && !details->serverName.isEmpty()) {
+        resetSslCommonName(details->serverName.c_str());
+        if (sslServerBump)
+            sslServerBump->clientSni = details->serverName;
+    }
 
     // We should disable read/write handlers
     Comm::SetSelect(clientConnection->fd, COMM_SELECT_READ, NULL, NULL, 0);
@@ -3229,14 +3227,6 @@
         return;
     }
 
-    if (serverBump()) {
-        Security::TlsDetails::Pointer const &details = tlsParser.details;
-        if (details && !details->serverName.isEmpty()) {
-            serverBump()->clientSni = details->serverName;
-            resetSslCommonName(details->serverName.c_str());
-        }
-    }
-
     startPeekAndSpliceDone();
 }
 
diff -u -r -N squid-4.0.15/src/Debug.h squid-4.0.16/src/Debug.h
--- squid-4.0.15/src/Debug.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/Debug.h	2016-10-31 01:24:50.000000000 +1300
@@ -206,5 +206,35 @@
     return raw.print(os);
 }
 
+/// debugs objects pointed by possibly nil pointers: label=object
+template <class Pointer>
+class RawPointerT {
+public:
+    RawPointerT(const char *aLabel, const Pointer &aPtr):
+        label(aLabel), ptr(aPtr) {}
+    const char *label; /// the name or description of the being-debugged object
+    const Pointer &ptr; /// a possibly nil pointer to the being-debugged object
+};
+
+/// convenience wrapper for creating  RawPointerT<> objects
+template <class Pointer>
+inline RawPointerT<Pointer>
+RawPointer(const char *label, const Pointer &ptr)
+{
+    return RawPointerT<Pointer>(label, ptr);
+}
+
+/// prints RawPointerT<>, dereferencing the raw pointer if possible
+template <class Pointer>
+inline std::ostream &
+operator <<(std::ostream &os, const RawPointerT<Pointer> &pd)
+{
+    os << pd.label << '=';
+    if (pd.ptr)
+        return os << *pd.ptr;
+    else
+        return os << "[nil]";
+}
+
 #endif /* SQUID_DEBUG_H */
 
diff -u -r -N squid-4.0.15/src/DiskIO/DiskThreads/async_io.cc squid-4.0.16/src/DiskIO/DiskThreads/async_io.cc
--- squid-4.0.15/src/DiskIO/DiskThreads/async_io.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/DiskIO/DiskThreads/async_io.cc	2016-10-31 01:24:50.000000000 +1300
@@ -15,12 +15,6 @@
 #include "Generic.h"
 #include "Store.h"
 
-/*
- * squidaio_ctrl_t uses explicit alloc()/freeOne() allocators
- * XXX: convert to MEMPROXY_CLASS() API
- */
-#include "mem/Pool.h"
-
 AIOCounts squidaio_counts;
 
 typedef struct squidaio_unlinkq_t {
diff -u -r -N squid-4.0.15/src/DiskIO/DiskThreads/DiskThreads.h squid-4.0.16/src/DiskIO/DiskThreads/DiskThreads.h
--- squid-4.0.15/src/DiskIO/DiskThreads/DiskThreads.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/DiskIO/DiskThreads/DiskThreads.h	2016-10-31 01:24:50.000000000 +1300
@@ -56,28 +56,30 @@
 
 typedef void AIOCB(int fd, void *cbdata, const char *buf, int aio_return, int aio_errno);
 
-class squidaio_result_t {
+class squidaio_result_t
+{
 public:
-    squidaio_result_t() : aio_return(0), aio_errno(0), result_type(_AIO_OP_NONE), _data(nullptr), data(nullptr) {}
-    int aio_return;
-    int aio_errno;
-    enum _squidaio_request_type result_type;
-    void *_data;        /* Internal housekeeping */
-    void *data;         /* Available to the caller */
+    int aio_return = 0;
+    int aio_errno = 0;
+    enum _squidaio_request_type result_type = _AIO_OP_NONE;
+    void *_data = nullptr;        /* Internal housekeeping */
+    void *data = nullptr;         /* Available to the caller */
 };
 
-class squidaio_ctrl_t {
+class squidaio_ctrl_t
+{
     MEMPROXY_CLASS(squidaio_ctrl_t);
 public:
-    squidaio_ctrl_t() : next(nullptr), fd(0), operation(0), done_handler(nullptr), done_handler_data(nullptr), len(0), bufp(0), free_func(nullptr) {}
-    struct squidaio_ctrl_t *next;
-    int fd;
-    int operation;
+    squidaio_ctrl_t() : done_handler(NULL), free_func(NULL) {}
+
+    squidaio_ctrl_t *next = nullptr;
+    int fd = 0;
+    int operation = 0;
     AIOCB *done_handler;
-    void *done_handler_data;
+    void *done_handler_data = nullptr;
     squidaio_result_t result;
-    int len;
-    char *bufp;
+    int len = 0;
+    char *bufp = nullptr;
     FREE *free_func;
     dlink_node node;
 };
@@ -117,21 +119,23 @@
 
 class DiskThreadsIOStrategy;
 
-struct AIOCounts {
-    uint64_t open_start;
-    uint64_t open_finish;
-    uint64_t close_start;
-    uint64_t close_finish;
-    uint64_t cancel;
-    uint64_t write_start;
-    uint64_t write_finish;
-    uint64_t read_start;
-    uint64_t read_finish;
-    uint64_t stat_start;
-    uint64_t stat_finish;
-    uint64_t unlink_start;
-    uint64_t unlink_finish;
-    uint64_t check_callback;
+class AIOCounts
+{
+public:
+    uint64_t open_start = 0;
+    uint64_t open_finish = 0;
+    uint64_t close_start = 0;
+    uint64_t close_finish = 0;
+    uint64_t cancel = 0;
+    uint64_t write_start = 0;
+    uint64_t write_finish = 0;
+    uint64_t read_start = 0;
+    uint64_t read_finish = 0;
+    uint64_t stat_start = 0;
+    uint64_t stat_finish = 0;
+    uint64_t unlink_start = 0;
+    uint64_t unlink_finish = 0;
+    uint64_t check_callback = 0;
 };
 
 extern AIOCounts squidaio_counts;
diff -u -r -N squid-4.0.15/src/external_acl.cc squid-4.0.16/src/external_acl.cc
--- squid-4.0.15/src/external_acl.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/external_acl.cc	2016-10-31 01:24:50.000000000 +1300
@@ -378,13 +378,13 @@
         if (node->children.n_max != DEFAULT_EXTERNAL_ACL_CHILDREN)
             storeAppendPrintf(sentry, " children-max=%d", node->children.n_max);
 
-        if (node->children.n_startup != 1)
+        if (node->children.n_startup != 0) // sync with helper/ChildConfig.cc default
             storeAppendPrintf(sentry, " children-startup=%d", node->children.n_startup);
 
-        if (node->children.n_idle != (node->children.n_max + node->children.n_startup) )
+        if (node->children.n_idle != 1) // sync with helper/ChildConfig.cc default
             storeAppendPrintf(sentry, " children-idle=%d", node->children.n_idle);
 
-        if (node->children.concurrency)
+        if (node->children.concurrency != 0)
             storeAppendPrintf(sentry, " concurrency=%d", node->children.concurrency);
 
         if (node->cache)
diff -u -r -N squid-4.0.15/src/format/Format.cc squid-4.0.16/src/format/Format.cc
--- squid-4.0.15/src/format/Format.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/format/Format.cc	2016-10-31 01:24:50.000000000 +1300
@@ -339,7 +339,7 @@
 actualReplyHeader(const AccessLogEntry::Pointer &al)
 {
     const HttpMsg *msg = al->reply;
-#if USE_ADAPTATION
+#if ICAP_CLIENT
     // al->icap.reqMethod is methodNone in access.log context
     if (!msg && al->icap.reqMethod == Adaptation::methodReqmod)
         msg = al->adapted_request;
@@ -352,7 +352,7 @@
 static const HttpMsg *
 actualRequestHeader(const AccessLogEntry::Pointer &al)
 {
-#if USE_ADAPTATION
+#if ICAP_CLIENT
     // al->icap.reqMethod is methodNone in access.log context
     if (al->icap.reqMethod == Adaptation::methodRespmod) {
         // XXX: for now AccessLogEntry lacks virgin response headers
@@ -868,7 +868,7 @@
         break;
 
         case LFT_REQUEST_ALL_HEADERS:
-#if USE_ADAPTATION
+#if ICAP_CLIENT
             if (al->icap.reqMethod == Adaptation::methodRespmod) {
                 // XXX: since AccessLogEntry::Headers lacks virgin response
                 // headers, do nothing for now
@@ -892,7 +892,7 @@
 
         case LFT_REPLY_ALL_HEADERS:
             out = al->headers.reply;
-#if USE_ADAPTATION
+#if ICAP_CLIENT
             if (!out && al->icap.reqMethod == Adaptation::methodReqmod)
                 out = al->headers.adapted_request;
 #endif
diff -u -r -N squid-4.0.15/src/globals.h squid-4.0.16/src/globals.h
--- squid-4.0.15/src/globals.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/globals.h	2016-10-31 01:24:50.000000000 +1300
@@ -9,7 +9,6 @@
 #ifndef SQUID_GLOBALS_H
 #define SQUID_GLOBALS_H
 
-#include "acl/AclDenyInfoList.h"
 #include "CacheDigest.h"
 #include "defines.h"
 #include "hash.h"
@@ -62,8 +61,6 @@
 extern int n_disk_objects;  /* 0 */
 extern IoStats IOStats;
 
-extern AclDenyInfoList *DenyInfoList;   /* NULL */
-
 extern struct timeval squid_start;
 extern int starting_up; /* 1 */
 extern int shutting_down;   /* 0 */
diff -u -r -N squid-4.0.15/src/htcp.cc squid-4.0.16/src/htcp.cc
--- squid-4.0.15/src/htcp.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/htcp.cc	2016-10-31 01:24:50.000000000 +1300
@@ -120,41 +120,37 @@
     Countstr signature;
 };
 
-class htcpSpecifier : public StoreClient
+class htcpSpecifier : public RefCountable, public StoreClient
 {
     MEMPROXY_CLASS(htcpSpecifier);
 
 public:
-    htcpSpecifier() :
-        method(NULL),
-        uri(NULL),
-        version(NULL),
-        req_hdrs(NULL),
-        reqHdrsSz(0),
-        request(NULL),
-        checkHitRequest(NULL),
-        dhdr(NULL)
-    {}
-    // XXX: destructor?
+    typedef RefCount<htcpSpecifier> Pointer;
 
-    void created (StoreEntry *newEntry);
     void checkHit();
-    void checkedHit(StoreEntry *e);
+    void checkedHit(StoreEntry *);
 
-    void setFrom(Ip::Address &from);
-    void setDataHeader(htcpDataHeader *);
-    const char *method;
-    char *uri;
-    char *version;
-    char *req_hdrs;
-    size_t reqHdrsSz; ///< size of the req_hdrs content
-    HttpRequest *request;
+    void setFrom(Ip::Address &anIp) { from = anIp; }
+    void setDataHeader(htcpDataHeader *aDataHeader) {
+        dhdr = aDataHeader;
+    }
+
+    /* StoreClient API */
+    void created(StoreEntry *);
+
+public:
+    const char *method = nullptr;
+    char *uri = nullptr;
+    char *version = nullptr;
+    char *req_hdrs = nullptr;
+    size_t reqHdrsSz = 0; ///< size of the req_hdrs content
+    HttpRequest::Pointer request;
 
 private:
-    HttpRequest *checkHitRequest;
+    HttpRequest::Pointer checkHitRequest;
 
-    Ip::Address from; // was a ptr. return to such IFF needed. otherwise copy should do.
-    htcpDataHeader *dhdr;
+    Ip::Address from;
+    htcpDataHeader *dhdr = nullptr;
 };
 
 class htcpDetail {
@@ -247,7 +243,6 @@
 static int old_squid_format = 0;
 
 static ssize_t htcpBuildPacket(char *buf, size_t buflen, htcpStuff * stuff);
-static htcpSpecifier *htcpUnpackSpecifier(char *buf, int sz);
 static htcpDetail *htcpUnpackDetail(char *buf, int sz);
 static ssize_t htcpBuildAuth(char *buf, size_t buflen);
 static ssize_t htcpBuildCountstr(char *buf, size_t buflen, const char *s, size_t len);
@@ -256,7 +251,6 @@
 static ssize_t htcpBuildOpData(char *buf, size_t buflen, htcpStuff * stuff);
 static ssize_t htcpBuildSpecifier(char *buf, size_t buflen, htcpStuff * stuff);
 static ssize_t htcpBuildTstOpData(char *buf, size_t buflen, htcpStuff * stuff);
-static void htcpFreeSpecifier(htcpSpecifier * s);
 
 static void htcpHandleMsg(char *buf, int sz, Ip::Address &from);
 
@@ -587,39 +581,16 @@
 }
 
 /*
- * STUFF FOR RECEIVING HTCP MESSAGES
- */
-
-void
-htcpSpecifier::setFrom(Ip::Address &aSocket)
-{
-    from = aSocket;
-}
-
-void
-htcpSpecifier::setDataHeader(htcpDataHeader *aDataHeader)
-{
-    dhdr = aDataHeader;
-}
-
-static void
-htcpFreeSpecifier(htcpSpecifier * s)
-{
-    HTTPMSGUNLOCK(s->request);
-
-    delete s;
-}
-
-/*
  * Unpack an HTCP SPECIFIER in place
  * This will overwrite any following AUTH block
  */
 // XXX: this needs to be turned into an Htcp1::Parser inheriting from Http1::RequestParser
 //   but with different first-line and block unpacking logic.
-static htcpSpecifier *
+static htcpSpecifier::Pointer
 htcpUnpackSpecifier(char *buf, int sz)
 {
-    htcpSpecifier *s = new htcpSpecifier;
+    static const htcpSpecifier::Pointer nil;
+    htcpSpecifier::Pointer s(new htcpSpecifier);
     HttpRequestMethod method;
 
     /* Find length of METHOD */
@@ -629,8 +600,7 @@
 
     if (l > sz) {
         debugs(31, 3, "htcpUnpackSpecifier: failed to unpack METHOD");
-        htcpFreeSpecifier(s);
-        return NULL;
+        return nil;
     }
 
     /* Set METHOD */
@@ -645,8 +615,7 @@
 
     if (l > sz) {
         debugs(31, 3, "htcpUnpackSpecifier: failed to unpack URI");
-        htcpFreeSpecifier(s);
-        return NULL;
+        return nil;
     }
 
     /* Add terminating null to METHOD */
@@ -665,8 +634,7 @@
 
     if (l > sz) {
         debugs(31, 3, "htcpUnpackSpecifier: failed to unpack VERSION");
-        htcpFreeSpecifier(s);
-        return NULL;
+        return nil;
     }
 
     /* Add terminating null to URI */
@@ -685,8 +653,7 @@
 
     if (l > sz) {
         debugs(31, 3, "htcpUnpackSpecifier: failed to unpack REQ-HDRS");
-        htcpFreeSpecifier(s);
-        return NULL;
+        return nil;
     }
 
     /* Add terminating null to URI */
@@ -713,10 +680,6 @@
     method.HttpRequestMethodXXX(s->method);
 
     s->request = HttpRequest::CreateFromUrl(s->uri, method == Http::METHOD_NONE ? HttpRequestMethod(Http::METHOD_GET) : method);
-
-    if (s->request)
-        HTTPMSGLOCK(s->request);
-
     return s;
 }
 
@@ -803,13 +766,13 @@
 }
 
 static bool
-htcpAccessAllowed(acl_access * acl, htcpSpecifier * s, Ip::Address &from)
+htcpAccessAllowed(acl_access * acl, const htcpSpecifier::Pointer &s, Ip::Address &from)
 {
     /* default deny if no access list present */
     if (!acl)
         return false;
 
-    ACLFilledChecklist checklist(acl, s->request, NULL);
+    ACLFilledChecklist checklist(acl, s->request.getRaw(), nullptr);
     checklist.src_addr = from;
     checklist.my_addr.setNoAddr();
     return (checklist.fastCheck() == ACCESS_ALLOWED);
@@ -935,7 +898,7 @@
 {
     checkHitRequest = request;
 
-    if (NULL == checkHitRequest) {
+    if (!checkHitRequest) {
         debugs(31, 3, "htcpCheckHit: NO; failed to parse URL");
         checkedHit(NullStoreEntry::getInstance());
         return;
@@ -943,33 +906,31 @@
 
     if (!checkHitRequest->header.parse(req_hdrs, reqHdrsSz)) {
         debugs(31, 3, "htcpCheckHit: NO; failed to parse request headers");
-        delete checkHitRequest;
-        checkHitRequest = NULL;
+        checkHitRequest = nullptr;
         checkedHit(NullStoreEntry::getInstance());
         return;
     }
 
-    StoreEntry::getPublicByRequest(this, checkHitRequest);
+    StoreEntry::getPublicByRequest(this, checkHitRequest.getRaw());
 }
 
 void
-htcpSpecifier::created (StoreEntry *e)
+htcpSpecifier::created(StoreEntry *e)
 {
-    StoreEntry *hit=NULL;
-    assert (e);
+    StoreEntry *hit = nullptr;
 
-    if (e->isNull()) {
+    if (!e || e->isNull()) {
         debugs(31, 3, "htcpCheckHit: NO; public object not found");
     } else if (!e->validToSend()) {
         debugs(31, 3, "htcpCheckHit: NO; entry not valid to send" );
-    } else if (refreshCheckHTCP(e, checkHitRequest)) {
+    } else if (refreshCheckHTCP(e, checkHitRequest.getRaw())) {
         debugs(31, 3, "htcpCheckHit: NO; cached response is stale");
     } else {
         debugs(31, 3, "htcpCheckHit: YES!?");
         hit = e;
     }
 
-    checkedHit (hit);
+    checkedHit(hit);
 }
 
 static void
@@ -980,13 +941,10 @@
 }
 
 static int
-htcpClrStore(const htcpSpecifier * s)
+htcpClrStore(const htcpSpecifier::Pointer &s)
 {
-    HttpRequest *request = s->request;
-    StoreEntry *e = NULL;
-    int released = 0;
-
-    if (request == NULL) {
+    HttpRequestPointer request(s->request);
+    if (!request) {
         debugs(31, 3, "htcpClrStore: failed to parse URL");
         return -1;
     }
@@ -997,12 +955,12 @@
         return -1;
     }
 
+    StoreEntry *e = nullptr;
+    int released = 0;
     /* Lookup matching entries. This matches both GET and HEAD */
-    while ((e = storeGetPublicByRequest(request)) != NULL) {
-        if (e != NULL) {
-            htcpClrStoreEntry(e);
-            ++released;
-        }
+    while ((e = storeGetPublicByRequest(request.getRaw()))) {
+        htcpClrStoreEntry(e);
+        ++released;
     }
 
     if (released) {
@@ -1106,9 +1064,6 @@
 static void
 htcpHandleTstRequest(htcpDataHeader * dhdr, char *buf, int sz, Ip::Address &from)
 {
-    /* buf should be a SPECIFIER */
-    htcpSpecifier *s;
-
     if (sz == 0) {
         debugs(31, 3, "htcpHandleTst: nothing to do");
         return;
@@ -1117,10 +1072,10 @@
     if (dhdr->F1 == 0)
         return;
 
-    /* s is a new object */
-    s = htcpUnpackSpecifier(buf, sz);
+    /* buf should be a SPECIFIER */
+    htcpSpecifier::Pointer s(htcpUnpackSpecifier(buf, sz));
 
-    if (s == NULL) {
+    if (!s) {
         debugs(31, 3, "htcpHandleTstRequest: htcpUnpackSpecifier failed");
         htcpLogHtcp(from, dhdr->opcode, LOG_UDP_INVALID, dash_str);
         return;
@@ -1132,14 +1087,12 @@
     if (!s->request) {
         debugs(31, 3, "htcpHandleTstRequest: failed to parse request");
         htcpLogHtcp(from, dhdr->opcode, LOG_UDP_INVALID, dash_str);
-        htcpFreeSpecifier(s);
         return;
     }
 
     if (!htcpAccessAllowed(Config.accessList.htcp, s, from)) {
         debugs(31, 3, "htcpHandleTstRequest: Access denied");
         htcpLogHtcp(from, dhdr->opcode, LOG_UDP_DENIED, s->uri);
-        htcpFreeSpecifier(s);
         return;
     }
 
@@ -1158,14 +1111,11 @@
         htcpTstReply(dhdr, NULL, NULL, from);   /* cache miss */
         htcpLogHtcp(from, dhdr->opcode, LOG_UDP_MISS, uri);
     }
-
-    htcpFreeSpecifier(this);
 }
 
 static void
 htcpHandleClr(htcpDataHeader * hdr, char *buf, int sz, Ip::Address &from)
 {
-    htcpSpecifier *s;
     /* buf[0/1] is reserved and reason */
     int reason = buf[1] << 4;
     debugs(31, 2, "HTCP CLR reason: " << reason);
@@ -1180,9 +1130,9 @@
         return;
     }
 
-    s = htcpUnpackSpecifier(buf, sz);
+    htcpSpecifier::Pointer s(htcpUnpackSpecifier(buf, sz));
 
-    if (NULL == s) {
+    if (!s) {
         debugs(31, 3, "htcpHandleClr: htcpUnpackSpecifier failed");
         htcpLogHtcp(from, hdr->opcode, LOG_UDP_INVALID, dash_str);
         return;
@@ -1191,14 +1141,12 @@
     if (!s->request) {
         debugs(31, 3, "htcpHandleTstRequest: failed to parse request");
         htcpLogHtcp(from, hdr->opcode, LOG_UDP_INVALID, dash_str);
-        htcpFreeSpecifier(s);
         return;
     }
 
     if (!htcpAccessAllowed(Config.accessList.htcp_clr, s, from)) {
         debugs(31, 3, "htcpHandleClr: Access denied");
         htcpLogHtcp(from, hdr->opcode, LOG_UDP_DENIED, s->uri);
-        htcpFreeSpecifier(s);
         return;
     }
 
@@ -1224,8 +1172,6 @@
     default:
         break;
     }
-
-    htcpFreeSpecifier(s);
 }
 
 /*
diff -u -r -N squid-4.0.15/src/http/url_rewriters/LFS/url_lfs_rewrite.8 squid-4.0.16/src/http/url_rewriters/LFS/url_lfs_rewrite.8
--- squid-4.0.15/src/http/url_rewriters/LFS/url_lfs_rewrite.8	2016-10-10 12:00:01.000000000 +1300
+++ squid-4.0.16/src/http/url_rewriters/LFS/url_lfs_rewrite.8	2016-10-31 03:22:00.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "URL_LFS_REWRITE 8"
-.TH URL_LFS_REWRITE 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH URL_LFS_REWRITE 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/http.cc squid-4.0.16/src/http.cc
--- squid-4.0.15/src/http.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/http.cc	2016-10-31 01:24:50.000000000 +1300
@@ -593,7 +593,7 @@
     while (strListGetItem(&vary, ',', &item, &ilen, &pos)) {
         SBuf name(item, ilen);
         if (name == asterisk) {
-            vstr.clear();
+            vstr = asterisk;
             break;
         }
         name.toLower();
@@ -947,6 +947,12 @@
             varyFailure = true;
         } else {
             entry->mem_obj->vary_headers = vary;
+
+            // RFC 7231 section 7.1.4
+            // Vary:* can be cached, but has mandatory revalidation
+            static const SBuf asterisk("*");
+            if (vary == asterisk)
+                EBIT_SET(entry->flags, ENTRY_REVALIDATE_ALWAYS);
         }
     }
 
diff -u -r -N squid-4.0.15/src/HttpHdrCc.cc squid-4.0.16/src/HttpHdrCc.cc
--- squid-4.0.15/src/HttpHdrCc.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/HttpHdrCc.cc	2016-10-31 01:24:50.000000000 +1300
@@ -40,6 +40,7 @@
     {"min-fresh", HttpHdrCcType::CC_MIN_FRESH},
     {"only-if-cached", HttpHdrCcType::CC_ONLY_IF_CACHED},
     {"stale-if-error", HttpHdrCcType::CC_STALE_IF_ERROR},
+    {"immutable", HttpHdrCcType::CC_IMMUTABLE},
     {"Other,", HttpHdrCcType::CC_OTHER}, /* ',' will protect from matches */
     {nullptr, HttpHdrCcType::CC_ENUM_END}
 };
@@ -202,6 +203,9 @@
         case HttpHdrCcType::CC_ONLY_IF_CACHED:
             onlyIfCached(true);
             break;
+        case HttpHdrCcType::CC_IMMUTABLE:
+            Immutable(true);
+            break;
 
         case HttpHdrCcType::CC_OTHER:
             if (other.size())
@@ -277,6 +281,8 @@
             case HttpHdrCcType::CC_STALE_IF_ERROR:
                 p->appendf("=%d", staleIfError());
                 break;
+            case HttpHdrCcType::CC_IMMUTABLE:
+                break;
             case HttpHdrCcType::CC_OTHER:
             case HttpHdrCcType::CC_ENUM_END:
                 // done below after the loop
diff -u -r -N squid-4.0.15/src/HttpHdrCc.h squid-4.0.16/src/HttpHdrCc.h
--- squid-4.0.15/src/HttpHdrCc.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/HttpHdrCc.h	2016-10-31 01:24:50.000000000 +1300
@@ -30,6 +30,7 @@
     CC_MIN_FRESH,
     CC_ONLY_IF_CACHED,
     CC_STALE_IF_ERROR,
+    CC_IMMUTABLE, /* draft-mcmanus-immutable-00 */
     CC_OTHER,
     CC_ENUM_END /* also used to mean "invalid" */
 };
@@ -160,6 +161,11 @@
     void staleIfError(int32_t v) {setValue(stale_if_error,v,HttpHdrCcType::CC_STALE_IF_ERROR); }
     void clearStaleIfError() {setValue(stale_if_error,STALE_IF_ERROR_UNKNOWN,HttpHdrCcType::CC_STALE_IF_ERROR,false);}
 
+    //manipulation for Cache-Control: immutable header
+    bool Immutable() const {return isSet(HttpHdrCcType::CC_IMMUTABLE);}
+    void Immutable(bool v) {setMask(HttpHdrCcType::CC_IMMUTABLE,v);}
+    void clearImmutable() {setMask(HttpHdrCcType::CC_IMMUTABLE,false);}
+
     /// check whether the attribute value supplied by id is set
     _SQUID_INLINE_ bool isSet(HttpHdrCcType id) const;
 
diff -u -r -N squid-4.0.15/src/icmp/net_db.cc squid-4.0.16/src/icmp/net_db.cc
--- squid-4.0.15/src/icmp/net_db.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/icmp/net_db.cc	2016-10-31 01:24:50.000000000 +1300
@@ -215,7 +215,7 @@
 
     if (n->link_count == 0) {
         netdbHashDelete(n->network);
-        memFree(n, MEM_NETDBENTRY);
+        delete n;
     }
 }
 
@@ -242,11 +242,11 @@
     int k = 0;
     int list_count = 0;
     int removed = 0;
-    list = (netdbEntry **)xcalloc(memInUse(MEM_NETDBENTRY), sizeof(netdbEntry *));
+    list = (netdbEntry **)xcalloc(netdbEntry::UseCount(), sizeof(netdbEntry *));
     hash_first(addr_table);
 
     while ((n = (netdbEntry *) hash_next(addr_table))) {
-        assert(list_count < memInUse(MEM_NETDBENTRY));
+        assert(list_count < netdbEntry::UseCount());
         *(list + list_count) = n;
         ++list_count;
     }
@@ -257,7 +257,7 @@
           netdbLRU);
 
     for (k = 0; k < list_count; ++k) {
-        if (memInUse(MEM_NETDBENTRY) < Config.Netdb.low)
+        if (netdbEntry::UseCount() < Config.Netdb.low)
             break;
 
         netdbRelease(*(list + k));
@@ -284,11 +284,11 @@
 {
     netdbEntry *n;
 
-    if (memInUse(MEM_NETDBENTRY) > Config.Netdb.high)
+    if (netdbEntry::UseCount() > Config.Netdb.high)
         netdbPurgeLRU();
 
     if ((n = netdbLookupAddr(addr)) == NULL) {
-        n = (netdbEntry *)memAllocate(MEM_NETDBENTRY);
+        n = new netdbEntry;
         netdbHashInsert(n, addr);
     }
 
@@ -642,7 +642,7 @@
 
         N.last_use_time = (time_t) atoi(q);
 
-        n = (netdbEntry *)memAllocate(MEM_NETDBENTRY);
+        n = new netdbEntry;
 
         memcpy(n, &N, sizeof(netdbEntry));
 
@@ -683,7 +683,7 @@
 {
     netdbEntry *n = (netdbEntry *)data;
     safe_free(n->peers);
-    memFree(n, MEM_NETDBENTRY);
+    delete n;
 }
 
 static void
@@ -888,12 +888,6 @@
     }
 }
 
-static void
-netdbRegisterWithCacheManager(void)
-{
-    Mgr::RegisterAction("netdb", "Network Measurement Database", netdbDump, 0, 1);
-}
-
 #endif /* USE_ICMP */
 
 /* PUBLIC FUNCTIONS */
@@ -902,14 +896,12 @@
 netdbInit(void)
 {
 #if USE_ICMP
-    int n;
-
-    netdbRegisterWithCacheManager();
+    Mgr::RegisterAction("netdb", "Network Measurement Database", netdbDump, 0, 1);
 
     if (addr_table)
         return;
 
-    n = hashPrime(Config.Netdb.high / 4);
+    int n = hashPrime(Config.Netdb.high / 4);
 
     addr_table = hash_create((HASHCMP *) strcmp, n, hash_string);
 
@@ -1003,7 +995,7 @@
                       "RTT",
                       "Hops",
                       "Hostnames");
-    list = (netdbEntry **)xcalloc(memInUse(MEM_NETDBENTRY), sizeof(netdbEntry *));
+    list = (netdbEntry **)xcalloc(netdbEntry::UseCount(), sizeof(netdbEntry *));
     i = 0;
     hash_first(addr_table);
 
@@ -1012,9 +1004,9 @@
         ++i;
     }
 
-    if (i != memInUse(MEM_NETDBENTRY))
+    if (i != netdbEntry::UseCount())
         debugs(38, DBG_CRITICAL, "WARNING: netdb_addrs count off, found " << i <<
-               ", expected " << memInUse(MEM_NETDBENTRY));
+               ", expected " << netdbEntry::UseCount());
 
     qsort((char *) list,
           i,
diff -u -r -N squid-4.0.15/src/icmp/net_db.h squid-4.0.16/src/icmp/net_db.h
--- squid-4.0.15/src/icmp/net_db.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/icmp/net_db.h	2016-10-31 01:24:50.000000000 +1300
@@ -42,23 +42,26 @@
     time_t expires;
 };
 
-// POD
 class netdbEntry
 {
+    MEMPROXY_CLASS(netdbEntry);
+
 public:
+    netdbEntry() { *network = 0; }
+
     hash_link hash;     /* must be first */
     char network[MAX_IPSTRLEN];
-    int pings_sent;
-    int pings_recv;
-    double hops;
-    double rtt;
-    time_t next_ping_time;
-    time_t last_use_time;
-    int link_count;
-    net_db_name *hosts;
-    net_db_peer *peers;
-    int n_peers_alloc;
-    int n_peers;
+    int pings_sent = 0;
+    int pings_recv = 0;
+    double hops = 0;
+    double rtt = 1.0;
+    time_t next_ping_time = 0;
+    time_t last_use_time = 0;
+    int link_count = 0;
+    net_db_name *hosts = nullptr;
+    net_db_peer *peers = nullptr;
+    int n_peers_alloc = 0;
+    int n_peers = 0;
 };
 
 void netdbInit(void);
diff -u -r -N squid-4.0.15/src/ip/Address.h squid-4.0.16/src/ip/Address.h
--- squid-4.0.15/src/ip/Address.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/ip/Address.h	2016-10-31 01:24:50.000000000 +1300
@@ -11,6 +11,8 @@
 #ifndef _SQUID_SRC_IP_ADDRESS_H
 #define _SQUID_SRC_IP_ADDRESS_H
 
+#include "ip/forward.h"
+
 #include <iosfwd>
 #include <ostream>
 #if HAVE_SYS_SOCKET_H
@@ -32,10 +34,6 @@
 namespace Ip
 {
 
-/// Length of buffer that needs to be allocated to old a null-terminated IP-string
-// Yuck. But there are still structures that need it to be an 'integer constant'.
-#define MAX_IPSTRLEN  75
-
 /**
  * Holds and manipulates IPv4, IPv6, and Socket Addresses.
  */
diff -u -r -N squid-4.0.15/src/ip/forward.h squid-4.0.16/src/ip/forward.h
--- squid-4.0.15/src/ip/forward.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/ip/forward.h	2016-10-31 01:24:50.000000000 +1300
@@ -18,6 +18,10 @@
 class Address;
 }
 
+/// Length of buffer that needs to be allocated to old a null-terminated IP-string
+// Yuck. But there are still structures that need it to be an 'integer constant'.
+#define MAX_IPSTRLEN  75
+
 typedef uint32_t nfmark_t;
 typedef unsigned char tos_t;
 
diff -u -r -N squid-4.0.15/src/ip/Intercept.cc squid-4.0.16/src/ip/Intercept.cc
--- squid-4.0.15/src/ip/Intercept.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/ip/Intercept.cc	2016-10-31 01:24:50.000000000 +1300
@@ -25,6 +25,9 @@
 #define IPFILTER_VERSION        5000004
 #endif
 
+#if HAVE_SYS_PARAM_H
+#include <sys/param.h>
+#endif
 #if HAVE_SYS_IOCCOM_H
 #include <sys/ioccom.h>
 #endif
diff -u -r -N squid-4.0.15/src/log/DB/log_db_daemon.8 squid-4.0.16/src/log/DB/log_db_daemon.8
--- squid-4.0.15/src/log/DB/log_db_daemon.8	2016-10-10 12:00:28.000000000 +1300
+++ squid-4.0.16/src/log/DB/log_db_daemon.8	2016-10-31 03:22:14.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "LOG_DB_DAEMON 8"
-.TH LOG_DB_DAEMON 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH LOG_DB_DAEMON 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/Makefile.am squid-4.0.16/src/Makefile.am
--- squid-4.0.15/src/Makefile.am	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/Makefile.am	2016-10-31 01:24:50.000000000 +1300
@@ -358,8 +358,6 @@
 	ipcache.cc \
 	ipcache.h \
 	$(LEAKFINDERSOURCE) \
-	SquidList.h \
-	SquidList.cc \
 	LogTags.cc \
 	LogTags.h \
 	lookup_t.h \
@@ -879,6 +877,7 @@
 	tests/testHttpRequest \
 	tests/testIcmp \
 	tests/testIpAddress \
+	tests/testNetDb \
 	tests/testStore \
 	tests/testString \
 	tests/testURL \
@@ -1058,8 +1057,6 @@
 	MasterXaction.h \
 	Notes.cc \
 	Notes.h \
-	SquidList.h \
-	SquidList.cc \
 	mem_node.cc \
 	Parsing.cc \
 	tests/stub_libsecurity.cc \
@@ -1295,8 +1292,6 @@
 	internal.cc \
 	LogTags.cc \
 	tests/stub_libsecurity.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	multicast.h \
@@ -1478,8 +1473,6 @@
 	HttpReply.cc \
 	int.h \
 	int.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -1724,8 +1717,6 @@
 	internal.cc \
 	LogTags.cc \
 	tests/stub_libsecurity.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	tests/stub_libmem.cc \
@@ -1962,8 +1953,6 @@
 	internal.h \
 	internal.cc \
 	LogTags.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -2196,8 +2185,6 @@
 	$(IPC_SOURCE) \
 	ipcache.cc \
 	LogTags.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -2510,8 +2497,6 @@
 	internal.cc \
 	LogTags.cc \
 	tests/stub_libsecurity.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	multicast.h \
@@ -2666,6 +2651,25 @@
 	$(COMPAT_LIB) \
 	$(XTRA_LIBS)
 
+tests_testNetDb_SOURCES = \
+	tests/testNetDb.cc \
+	tests/testNetDb.h
+nodist_tests_testNetDb_SOURCES = \
+	SquidTime.h \
+	tests/stub_debug.cc \
+	tests/stub_libmem.cc \
+	time.cc \
+	globals.cc
+tests_testNetDb_LDFLAGS = $(LIBADD_DL)
+tests_testNetDb_LDADD = \
+	icmp/libicmp.la \
+	ip/libip.la \
+	base/libbase.la \
+	$(top_builddir)/lib/libmisccontainers.la \
+	$(LIBCPPUNIT_LIBS) \
+	$(COMPAT_LIB) \
+	$(XTRA_LIBS)
+
 ## Tests for ip/* objects
 tests_testIpAddress_SOURCES= \
 	tests/testAddress.cc \
@@ -2721,8 +2725,6 @@
 	RequestFlags.h \
 	int.h \
 	int.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	mem_node.cc \
@@ -2947,8 +2949,6 @@
 	int.cc \
 	RequestFlags.h \
 	RequestFlags.cc \
-	SquidList.h \
-	SquidList.cc \
 	Transients.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
@@ -3132,8 +3132,6 @@
 	HttpReply.cc \
 	int.h \
 	int.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -3347,8 +3345,6 @@
 	internal.cc \
 	tests/stub_libeui.cc \
 	LogTags.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	multicast.h \
diff -u -r -N squid-4.0.15/src/Makefile.in squid-4.0.16/src/Makefile.in
--- squid-4.0.15/src/Makefile.in	2016-10-10 08:11:22.000000000 +1300
+++ squid-4.0.16/src/Makefile.in	2016-10-31 01:26:51.000000000 +1300
@@ -99,12 +99,13 @@
 	tests/test_http_range$(EXEEXT) tests/testTokenizer$(EXEEXT) \
 	tests/testHttp1Parser$(EXEEXT) tests/testHttpReply$(EXEEXT) \
 	tests/testHttpRequest$(EXEEXT) tests/testIcmp$(EXEEXT) \
-	tests/testIpAddress$(EXEEXT) tests/testStore$(EXEEXT) \
-	tests/testString$(EXEEXT) tests/testURL$(EXEEXT) \
-	tests/testSBuf$(EXEEXT) tests/testSBufList$(EXEEXT) \
-	tests/testConfigParser$(EXEEXT) tests/testStatHist$(EXEEXT) \
-	tests/testLookupTable$(EXEEXT) tests/testYesNoNone$(EXEEXT) \
-	$(am__EXEEXT_2) $(am__EXEEXT_3) testRefCount$(EXEEXT)
+	tests/testIpAddress$(EXEEXT) tests/testNetDb$(EXEEXT) \
+	tests/testStore$(EXEEXT) tests/testString$(EXEEXT) \
+	tests/testURL$(EXEEXT) tests/testSBuf$(EXEEXT) \
+	tests/testSBufList$(EXEEXT) tests/testConfigParser$(EXEEXT) \
+	tests/testStatHist$(EXEEXT) tests/testLookupTable$(EXEEXT) \
+	tests/testYesNoNone$(EXEEXT) $(am__EXEEXT_2) $(am__EXEEXT_3) \
+	testRefCount$(EXEEXT)
 @ENABLE_LOADABLE_MODULES_TRUE@am__append_1 = $(INCLTDL)
 @ENABLE_AUTH_TRUE@am__append_2 = auth
 @ENABLE_AUTH_TRUE@am__append_3 = tests/testACLMaxUserIP
@@ -275,12 +276,12 @@
 	RequestFlags.cc HttpRequest.cc HttpRequest.h ICP.h \
 	icp_opcode.h icp_v2.cc icp_v3.cc int.h int.cc internal.h \
 	internal.cc SquidIpc.h ipc.cc ipc_win32.cc ipcache.cc \
-	ipcache.h LeakFinder.cc SquidList.h SquidList.cc LogTags.cc \
-	LogTags.h lookup_t.h main.cc MasterXaction.cc MasterXaction.h \
-	mem_node.cc mem_node.h MemBuf.cc MemObject.cc MemObject.h \
-	MessageSizes.h mime.h mime.cc mime_header.h mime_header.cc \
-	multicast.h multicast.cc neighbors.h neighbors.cc Notes.h \
-	Notes.cc Parsing.cc Parsing.h ProfStats.cc pconn.cc pconn.h \
+	ipcache.h LeakFinder.cc LogTags.cc LogTags.h lookup_t.h \
+	main.cc MasterXaction.cc MasterXaction.h mem_node.cc \
+	mem_node.h MemBuf.cc MemObject.cc MemObject.h MessageSizes.h \
+	mime.h mime.cc mime_header.h mime_header.cc multicast.h \
+	multicast.cc neighbors.h neighbors.cc Notes.h Notes.cc \
+	Parsing.cc Parsing.h ProfStats.cc pconn.cc pconn.h \
 	PeerDigest.h peer_digest.cc peer_proxy_negotiate_auth.h \
 	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
 	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
@@ -358,12 +359,12 @@
 	HttpReply.$(OBJEXT) RequestFlags.$(OBJEXT) \
 	HttpRequest.$(OBJEXT) icp_v2.$(OBJEXT) icp_v3.$(OBJEXT) \
 	int.$(OBJEXT) internal.$(OBJEXT) $(am__objects_6) \
-	ipcache.$(OBJEXT) $(am__objects_7) SquidList.$(OBJEXT) \
-	LogTags.$(OBJEXT) main.$(OBJEXT) MasterXaction.$(OBJEXT) \
-	mem_node.$(OBJEXT) MemBuf.$(OBJEXT) MemObject.$(OBJEXT) \
-	mime.$(OBJEXT) mime_header.$(OBJEXT) multicast.$(OBJEXT) \
-	neighbors.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
-	$(am__objects_8) pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
+	ipcache.$(OBJEXT) $(am__objects_7) LogTags.$(OBJEXT) \
+	main.$(OBJEXT) MasterXaction.$(OBJEXT) mem_node.$(OBJEXT) \
+	MemBuf.$(OBJEXT) MemObject.$(OBJEXT) mime.$(OBJEXT) \
+	mime_header.$(OBJEXT) multicast.$(OBJEXT) neighbors.$(OBJEXT) \
+	Notes.$(OBJEXT) Parsing.$(OBJEXT) $(am__objects_8) \
+	pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
 	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
 	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
 	PeerPoolMgr.$(OBJEXT) Pipeline.$(OBJEXT) redirect.$(OBJEXT) \
@@ -451,10 +452,9 @@
 	HttpHeaderTools.$(OBJEXT) HttpHdrContRange.$(OBJEXT) \
 	HttpHdrRange.$(OBJEXT) HttpHdrCc.$(OBJEXT) HttpHdrSc.$(OBJEXT) \
 	HttpHdrScTarget.$(OBJEXT) HttpMsg.$(OBJEXT) int.$(OBJEXT) \
-	MasterXaction.$(OBJEXT) Notes.$(OBJEXT) SquidList.$(OBJEXT) \
-	mem_node.$(OBJEXT) Parsing.$(OBJEXT) \
-	tests/stub_libsecurity.$(OBJEXT) SquidMath.$(OBJEXT) \
-	StatCounters.$(OBJEXT) StrList.$(OBJEXT) \
+	MasterXaction.$(OBJEXT) Notes.$(OBJEXT) mem_node.$(OBJEXT) \
+	Parsing.$(OBJEXT) tests/stub_libsecurity.$(OBJEXT) \
+	SquidMath.$(OBJEXT) StatCounters.$(OBJEXT) StrList.$(OBJEXT) \
 	tests/stub_StatHist.$(OBJEXT) stmem.$(OBJEXT) \
 	tests/stub_SBufDetailedStats.$(OBJEXT) String.$(OBJEXT) \
 	StoreIOState.$(OBJEXT) tests/stub_StoreMeta.$(OBJEXT) \
@@ -546,16 +546,15 @@
 	HttpHdrSc.cc HttpHdrScTarget.cc HttpMsg.cc HttpReply.cc \
 	icp_v2.cc icp_v3.cc SquidIpc.h ipc.cc ipc_win32.cc ipcache.cc \
 	int.h int.cc internal.h internal.cc LogTags.cc \
-	tests/stub_libsecurity.cc SquidList.h SquidList.cc \
-	MasterXaction.cc MasterXaction.h multicast.h multicast.cc \
-	mem_node.cc MemBuf.cc MemObject.cc mime.h mime.cc \
-	mime_header.h mime_header.cc neighbors.h neighbors.cc Notes.cc \
-	Notes.h Parsing.cc pconn.cc peer_digest.cc \
-	peer_proxy_negotiate_auth.h peer_proxy_negotiate_auth.cc \
-	peer_select.cc peer_sourcehash.h peer_sourcehash.cc \
-	peer_userhash.h peer_userhash.cc PeerPoolMgr.h PeerPoolMgr.cc \
-	Pipeline.cc Pipeline.h redirect.h tests/stub_redirect.cc \
-	refresh.h refresh.cc RemovalPolicy.cc \
+	tests/stub_libsecurity.cc MasterXaction.cc MasterXaction.h \
+	multicast.h multicast.cc mem_node.cc MemBuf.cc MemObject.cc \
+	mime.h mime.cc mime_header.h mime_header.cc neighbors.h \
+	neighbors.cc Notes.cc Notes.h Parsing.cc pconn.cc \
+	peer_digest.cc peer_proxy_negotiate_auth.h \
+	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
+	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
+	PeerPoolMgr.h PeerPoolMgr.cc Pipeline.cc Pipeline.h redirect.h \
+	tests/stub_redirect.cc refresh.h refresh.cc RemovalPolicy.cc \
 	tests/stub_SBufDetailedStats.cc SnmpRequest.h snmp_core.h \
 	snmp_core.cc snmp_agent.h snmp_agent.cc SquidMath.h \
 	SquidMath.cc IoStats.h stat.h stat.cc StatCounters.h \
@@ -603,11 +602,11 @@
 	HttpMsg.$(OBJEXT) HttpReply.$(OBJEXT) icp_v2.$(OBJEXT) \
 	icp_v3.$(OBJEXT) $(am__objects_6) ipcache.$(OBJEXT) \
 	int.$(OBJEXT) internal.$(OBJEXT) LogTags.$(OBJEXT) \
-	tests/stub_libsecurity.$(OBJEXT) SquidList.$(OBJEXT) \
-	MasterXaction.$(OBJEXT) multicast.$(OBJEXT) mem_node.$(OBJEXT) \
-	MemBuf.$(OBJEXT) MemObject.$(OBJEXT) mime.$(OBJEXT) \
-	mime_header.$(OBJEXT) neighbors.$(OBJEXT) Notes.$(OBJEXT) \
-	Parsing.$(OBJEXT) pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
+	tests/stub_libsecurity.$(OBJEXT) MasterXaction.$(OBJEXT) \
+	multicast.$(OBJEXT) mem_node.$(OBJEXT) MemBuf.$(OBJEXT) \
+	MemObject.$(OBJEXT) mime.$(OBJEXT) mime_header.$(OBJEXT) \
+	neighbors.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
+	pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
 	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
 	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
 	PeerPoolMgr.$(OBJEXT) Pipeline.$(OBJEXT) \
@@ -704,12 +703,11 @@
 	HttpHdrSc.cc HttpHdrScTarget.cc HttpHdrRange.cc \
 	HttpHeaderFieldInfo.h HttpHeaderTools.h HttpHeaderTools.cc \
 	HttpHeader.h HttpHeader.cc HttpMsg.cc HttpReply.cc int.h \
-	int.cc SquidList.h SquidList.cc MasterXaction.cc \
-	MasterXaction.h MemBuf.cc MemObject.cc mem_node.cc Notes.h \
-	Notes.cc Parsing.cc refresh.h refresh.cc RemovalPolicy.cc \
-	RequestFlags.h RequestFlags.cc tests/stub_libsecurity.cc \
-	StatCounters.h StatCounters.cc StatHist.h \
-	tests/stub_StatHist.cc stmem.cc \
+	int.cc MasterXaction.cc MasterXaction.h MemBuf.cc MemObject.cc \
+	mem_node.cc Notes.h Notes.cc Parsing.cc refresh.h refresh.cc \
+	RemovalPolicy.cc RequestFlags.h RequestFlags.cc \
+	tests/stub_libsecurity.cc StatCounters.h StatCounters.cc \
+	StatHist.h tests/stub_StatHist.cc stmem.cc \
 	tests/stub_SBufDetailedStats.cc StoreFileSystem.cc \
 	StoreIOState.cc tests/stub_StoreMeta.cc StoreMetaUnpacker.cc \
 	StoreSwapLogData.cc store_io.cc store_key_md5.h \
@@ -747,13 +745,12 @@
 	HttpHdrSc.$(OBJEXT) HttpHdrScTarget.$(OBJEXT) \
 	HttpHdrRange.$(OBJEXT) HttpHeaderTools.$(OBJEXT) \
 	HttpHeader.$(OBJEXT) HttpMsg.$(OBJEXT) HttpReply.$(OBJEXT) \
-	int.$(OBJEXT) SquidList.$(OBJEXT) MasterXaction.$(OBJEXT) \
-	MemBuf.$(OBJEXT) MemObject.$(OBJEXT) mem_node.$(OBJEXT) \
-	Notes.$(OBJEXT) Parsing.$(OBJEXT) refresh.$(OBJEXT) \
-	RemovalPolicy.$(OBJEXT) RequestFlags.$(OBJEXT) \
-	tests/stub_libsecurity.$(OBJEXT) StatCounters.$(OBJEXT) \
-	tests/stub_StatHist.$(OBJEXT) stmem.$(OBJEXT) \
-	tests/stub_SBufDetailedStats.$(OBJEXT) \
+	int.$(OBJEXT) MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) \
+	MemObject.$(OBJEXT) mem_node.$(OBJEXT) Notes.$(OBJEXT) \
+	Parsing.$(OBJEXT) refresh.$(OBJEXT) RemovalPolicy.$(OBJEXT) \
+	RequestFlags.$(OBJEXT) tests/stub_libsecurity.$(OBJEXT) \
+	StatCounters.$(OBJEXT) tests/stub_StatHist.$(OBJEXT) \
+	stmem.$(OBJEXT) tests/stub_SBufDetailedStats.$(OBJEXT) \
 	StoreFileSystem.$(OBJEXT) StoreIOState.$(OBJEXT) \
 	tests/stub_StoreMeta.$(OBJEXT) StoreMetaUnpacker.$(OBJEXT) \
 	StoreSwapLogData.$(OBJEXT) store_io.$(OBJEXT) \
@@ -847,10 +844,10 @@
 	HttpReply.cc PeerPoolMgr.h PeerPoolMgr.cc RequestFlags.h \
 	RequestFlags.cc HttpRequest.cc icp_v2.cc icp_v3.cc SquidIpc.h \
 	ipc.cc ipc_win32.cc ipcache.cc int.h int.cc internal.h \
-	internal.cc LogTags.cc tests/stub_libsecurity.cc SquidList.h \
-	SquidList.cc MasterXaction.cc MasterXaction.h \
-	tests/stub_libmem.cc mem_node.cc MemBuf.cc MemObject.cc mime.h \
-	mime.cc mime_header.h mime_header.cc multicast.h multicast.cc \
+	internal.cc LogTags.cc tests/stub_libsecurity.cc \
+	MasterXaction.cc MasterXaction.h tests/stub_libmem.cc \
+	mem_node.cc MemBuf.cc MemObject.cc mime.h mime.cc \
+	mime_header.h mime_header.cc multicast.h multicast.cc \
 	neighbors.h neighbors.cc Notes.cc Notes.h Parsing.cc pconn.cc \
 	peer_digest.cc peer_proxy_negotiate_auth.h \
 	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
@@ -903,16 +900,16 @@
 	RequestFlags.$(OBJEXT) HttpRequest.$(OBJEXT) icp_v2.$(OBJEXT) \
 	icp_v3.$(OBJEXT) $(am__objects_6) ipcache.$(OBJEXT) \
 	int.$(OBJEXT) internal.$(OBJEXT) LogTags.$(OBJEXT) \
-	tests/stub_libsecurity.$(OBJEXT) SquidList.$(OBJEXT) \
-	MasterXaction.$(OBJEXT) tests/stub_libmem.$(OBJEXT) \
-	mem_node.$(OBJEXT) MemBuf.$(OBJEXT) MemObject.$(OBJEXT) \
-	mime.$(OBJEXT) mime_header.$(OBJEXT) multicast.$(OBJEXT) \
-	neighbors.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
-	pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
-	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
-	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
-	Pipeline.$(OBJEXT) tests/stub_redirect.$(OBJEXT) \
-	refresh.$(OBJEXT) RemovalPolicy.$(OBJEXT) StrList.$(OBJEXT) \
+	tests/stub_libsecurity.$(OBJEXT) MasterXaction.$(OBJEXT) \
+	tests/stub_libmem.$(OBJEXT) mem_node.$(OBJEXT) \
+	MemBuf.$(OBJEXT) MemObject.$(OBJEXT) mime.$(OBJEXT) \
+	mime_header.$(OBJEXT) multicast.$(OBJEXT) neighbors.$(OBJEXT) \
+	Notes.$(OBJEXT) Parsing.$(OBJEXT) pconn.$(OBJEXT) \
+	peer_digest.$(OBJEXT) peer_proxy_negotiate_auth.$(OBJEXT) \
+	peer_select.$(OBJEXT) peer_sourcehash.$(OBJEXT) \
+	peer_userhash.$(OBJEXT) Pipeline.$(OBJEXT) \
+	tests/stub_redirect.$(OBJEXT) refresh.$(OBJEXT) \
+	RemovalPolicy.$(OBJEXT) StrList.$(OBJEXT) \
 	tests/stub_SBufDetailedStats.$(OBJEXT) $(am__objects_10) \
 	SquidMath.$(OBJEXT) stat.$(OBJEXT) StatCounters.$(OBJEXT) \
 	StatHist.$(OBJEXT) stmem.$(OBJEXT) store.$(OBJEXT) \
@@ -986,11 +983,11 @@
 	HttpHdrScTarget.cc HttpMsg.cc HttpReply.cc PeerPoolMgr.h \
 	PeerPoolMgr.cc RequestFlags.h RequestFlags.cc HttpRequest.cc \
 	icp_v2.cc icp_v3.cc SquidIpc.h ipc.cc ipc_win32.cc ipcache.cc \
-	int.h int.cc internal.h internal.cc LogTags.cc SquidList.h \
-	SquidList.cc MasterXaction.cc MasterXaction.h MemBuf.cc \
-	MemObject.cc tests/stub_libmem.cc mem_node.cc mime.h mime.cc \
-	mime_header.h mime_header.cc multicast.h multicast.cc \
-	neighbors.h neighbors.cc Notes.cc Notes.h Parsing.cc pconn.cc \
+	int.h int.cc internal.h internal.cc LogTags.cc \
+	MasterXaction.cc MasterXaction.h MemBuf.cc MemObject.cc \
+	tests/stub_libmem.cc mem_node.cc mime.h mime.cc mime_header.h \
+	mime_header.cc multicast.h multicast.cc neighbors.h \
+	neighbors.cc Notes.cc Notes.h Parsing.cc pconn.cc \
 	peer_digest.cc peer_proxy_negotiate_auth.h \
 	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
 	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
@@ -1042,20 +1039,20 @@
 	RequestFlags.$(OBJEXT) HttpRequest.$(OBJEXT) icp_v2.$(OBJEXT) \
 	icp_v3.$(OBJEXT) $(am__objects_6) ipcache.$(OBJEXT) \
 	int.$(OBJEXT) internal.$(OBJEXT) LogTags.$(OBJEXT) \
-	SquidList.$(OBJEXT) MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) \
-	MemObject.$(OBJEXT) tests/stub_libmem.$(OBJEXT) \
-	mem_node.$(OBJEXT) mime.$(OBJEXT) mime_header.$(OBJEXT) \
-	multicast.$(OBJEXT) neighbors.$(OBJEXT) Notes.$(OBJEXT) \
-	Parsing.$(OBJEXT) pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
-	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
-	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
-	Pipeline.$(OBJEXT) RemovalPolicy.$(OBJEXT) \
-	tests/stub_redirect.$(OBJEXT) refresh.$(OBJEXT) \
-	tests/stub_SBufDetailedStats.$(OBJEXT) $(am__objects_10) \
-	SquidMath.$(OBJEXT) stat.$(OBJEXT) StatCounters.$(OBJEXT) \
-	StatHist.$(OBJEXT) stmem.$(OBJEXT) store.$(OBJEXT) \
-	store_client.$(OBJEXT) tests/stub_store_digest.$(OBJEXT) \
-	store_io.$(OBJEXT) store_key_md5.$(OBJEXT) store_log.$(OBJEXT) \
+	MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) MemObject.$(OBJEXT) \
+	tests/stub_libmem.$(OBJEXT) mem_node.$(OBJEXT) mime.$(OBJEXT) \
+	mime_header.$(OBJEXT) multicast.$(OBJEXT) neighbors.$(OBJEXT) \
+	Notes.$(OBJEXT) Parsing.$(OBJEXT) pconn.$(OBJEXT) \
+	peer_digest.$(OBJEXT) peer_proxy_negotiate_auth.$(OBJEXT) \
+	peer_select.$(OBJEXT) peer_sourcehash.$(OBJEXT) \
+	peer_userhash.$(OBJEXT) Pipeline.$(OBJEXT) \
+	RemovalPolicy.$(OBJEXT) tests/stub_redirect.$(OBJEXT) \
+	refresh.$(OBJEXT) tests/stub_SBufDetailedStats.$(OBJEXT) \
+	$(am__objects_10) SquidMath.$(OBJEXT) stat.$(OBJEXT) \
+	StatCounters.$(OBJEXT) StatHist.$(OBJEXT) stmem.$(OBJEXT) \
+	store.$(OBJEXT) store_client.$(OBJEXT) \
+	tests/stub_store_digest.$(OBJEXT) store_io.$(OBJEXT) \
+	store_key_md5.$(OBJEXT) store_log.$(OBJEXT) \
 	store_rebuild.$(OBJEXT) store_swapin.$(OBJEXT) \
 	store_swapmeta.$(OBJEXT) store_swapout.$(OBJEXT) \
 	StoreFileSystem.$(OBJEXT) StoreIOState.$(OBJEXT) \
@@ -1198,27 +1195,27 @@
 	HttpHdrScTarget.cc HttpMsg.cc HttpReply.cc icp_v2.cc icp_v3.cc \
 	SquidIpc.h ipc.cc ipc_win32.cc ipcache.cc int.h int.cc \
 	internal.h internal.cc LogTags.cc tests/stub_libsecurity.cc \
-	SquidList.h SquidList.cc MasterXaction.cc MasterXaction.h \
-	multicast.h multicast.cc mem_node.cc MemBuf.cc MemObject.cc \
-	mime.h mime.cc mime_header.h mime_header.cc neighbors.h \
-	neighbors.cc Notes.cc Notes.h Parsing.cc pconn.cc \
-	peer_digest.cc peer_proxy_negotiate_auth.h \
-	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
-	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
-	PeerPoolMgr.h PeerPoolMgr.cc Pipeline.cc Pipeline.h redirect.h \
-	tests/stub_libauth_acls.cc tests/stub_redirect.cc refresh.h \
-	refresh.cc RemovalPolicy.cc tests/stub_SBufDetailedStats.cc \
-	SnmpRequest.h snmp_core.h snmp_core.cc snmp_agent.h \
-	snmp_agent.cc SquidMath.h SquidMath.cc IoStats.h stat.h \
-	stat.cc StatCounters.h StatCounters.cc StatHist.h StatHist.cc \
-	stmem.cc repl_modules.h store.cc store_client.cc \
-	store_digest.h tests/stub_store_digest.cc store_io.cc \
-	store_key_md5.h store_key_md5.cc store_log.h store_log.cc \
-	store_rebuild.h store_rebuild.cc store_swapin.h \
-	store_swapin.cc store_swapmeta.cc store_swapout.cc \
-	StoreFileSystem.cc StoreIOState.cc tests/stub_StoreMeta.cc \
-	StoreMetaUnpacker.cc StoreSwapLogData.cc StrList.h StrList.cc \
-	event.cc tools.h tools.cc Transients.cc tests/stub_tunnel.cc \
+	MasterXaction.cc MasterXaction.h multicast.h multicast.cc \
+	mem_node.cc MemBuf.cc MemObject.cc mime.h mime.cc \
+	mime_header.h mime_header.cc neighbors.h neighbors.cc Notes.cc \
+	Notes.h Parsing.cc pconn.cc peer_digest.cc \
+	peer_proxy_negotiate_auth.h peer_proxy_negotiate_auth.cc \
+	peer_select.cc peer_sourcehash.h peer_sourcehash.cc \
+	peer_userhash.h peer_userhash.cc PeerPoolMgr.h PeerPoolMgr.cc \
+	Pipeline.cc Pipeline.h redirect.h tests/stub_libauth_acls.cc \
+	tests/stub_redirect.cc refresh.h refresh.cc RemovalPolicy.cc \
+	tests/stub_SBufDetailedStats.cc SnmpRequest.h snmp_core.h \
+	snmp_core.cc snmp_agent.h snmp_agent.cc SquidMath.h \
+	SquidMath.cc IoStats.h stat.h stat.cc StatCounters.h \
+	StatCounters.cc StatHist.h StatHist.cc stmem.cc repl_modules.h \
+	store.cc store_client.cc store_digest.h \
+	tests/stub_store_digest.cc store_io.cc store_key_md5.h \
+	store_key_md5.cc store_log.h store_log.cc store_rebuild.h \
+	store_rebuild.cc store_swapin.h store_swapin.cc \
+	store_swapmeta.cc store_swapout.cc StoreFileSystem.cc \
+	StoreIOState.cc tests/stub_StoreMeta.cc StoreMetaUnpacker.cc \
+	StoreSwapLogData.cc StrList.h StrList.cc event.cc tools.h \
+	tools.cc Transients.cc tests/stub_tunnel.cc \
 	tests/stub_SwapDir.cc MemStore.cc url.cc urn.h urn.cc wccp2.h \
 	tests/stub_wccp2.cc whois.h tests/stub_whois.cc \
 	FadingCounter.cc win32.cc wordlist.h wordlist.cc
@@ -1255,11 +1252,11 @@
 	HttpReply.$(OBJEXT) icp_v2.$(OBJEXT) icp_v3.$(OBJEXT) \
 	$(am__objects_6) ipcache.$(OBJEXT) int.$(OBJEXT) \
 	internal.$(OBJEXT) LogTags.$(OBJEXT) \
-	tests/stub_libsecurity.$(OBJEXT) SquidList.$(OBJEXT) \
-	MasterXaction.$(OBJEXT) multicast.$(OBJEXT) mem_node.$(OBJEXT) \
-	MemBuf.$(OBJEXT) MemObject.$(OBJEXT) mime.$(OBJEXT) \
-	mime_header.$(OBJEXT) neighbors.$(OBJEXT) Notes.$(OBJEXT) \
-	Parsing.$(OBJEXT) pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
+	tests/stub_libsecurity.$(OBJEXT) MasterXaction.$(OBJEXT) \
+	multicast.$(OBJEXT) mem_node.$(OBJEXT) MemBuf.$(OBJEXT) \
+	MemObject.$(OBJEXT) mime.$(OBJEXT) mime_header.$(OBJEXT) \
+	neighbors.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
+	pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
 	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
 	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
 	PeerPoolMgr.$(OBJEXT) Pipeline.$(OBJEXT) \
@@ -1340,6 +1337,19 @@
 	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CXXLD) \
 	$(AM_CXXFLAGS) $(CXXFLAGS) $(tests_testLookupTable_LDFLAGS) \
 	$(LDFLAGS) -o $@
+am_tests_testNetDb_OBJECTS = tests/testNetDb.$(OBJEXT)
+nodist_tests_testNetDb_OBJECTS = tests/stub_debug.$(OBJEXT) \
+	tests/stub_libmem.$(OBJEXT) time.$(OBJEXT) globals.$(OBJEXT)
+tests_testNetDb_OBJECTS = $(am_tests_testNetDb_OBJECTS) \
+	$(nodist_tests_testNetDb_OBJECTS)
+tests_testNetDb_DEPENDENCIES = icmp/libicmp.la ip/libip.la \
+	base/libbase.la $(top_builddir)/lib/libmisccontainers.la \
+	$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_3) \
+	$(am__DEPENDENCIES_1)
+tests_testNetDb_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CXX \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CXXLD) \
+	$(AM_CXXFLAGS) $(CXXFLAGS) $(tests_testNetDb_LDFLAGS) \
+	$(LDFLAGS) -o $@
 am__tests_testRock_SOURCES_DIST = AccessLogEntry.cc AccessLogEntry.h \
 	cbdata.cc CacheDigest.h CollapsedForwarding.h \
 	CollapsedForwarding.cc tests/stub_CacheDigest.cc \
@@ -1349,11 +1359,11 @@
 	HttpBody.cc HttpHdrCc.cc HttpHdrContRange.cc HttpHdrRange.cc \
 	HttpHdrSc.cc HttpHdrScTarget.cc HttpHeader.h HttpHeader.cc \
 	HttpHeaderFieldInfo.h HttpHeaderTools.h HttpHeaderTools.cc \
-	HttpMsg.cc HttpReply.cc int.h int.cc SquidList.h SquidList.cc \
-	MasterXaction.cc MasterXaction.h MemBuf.cc MemObject.cc \
-	mem_node.cc Notes.h Notes.cc Parsing.cc RemovalPolicy.cc \
-	RequestFlags.cc RequestFlags.h StatCounters.h StatCounters.cc \
-	StatHist.h tests/stub_StatHist.cc stmem.cc repl_modules.h \
+	HttpMsg.cc HttpReply.cc int.h int.cc MasterXaction.cc \
+	MasterXaction.h MemBuf.cc MemObject.cc mem_node.cc Notes.h \
+	Notes.cc Parsing.cc RemovalPolicy.cc RequestFlags.cc \
+	RequestFlags.h StatCounters.h StatCounters.cc StatHist.h \
+	tests/stub_StatHist.cc stmem.cc repl_modules.h \
 	tests/stub_stat.cc store.cc StoreFileSystem.cc StoreIOState.cc \
 	StoreMetaUnpacker.cc StoreMeta.cc StoreMeta.h StoreMetaMD5.cc \
 	StoreMetaMD5.h StoreMetaSTD.cc StoreMetaSTD.h \
@@ -1397,12 +1407,11 @@
 	HttpHdrSc.$(OBJEXT) HttpHdrScTarget.$(OBJEXT) \
 	HttpHeader.$(OBJEXT) HttpHeaderTools.$(OBJEXT) \
 	HttpMsg.$(OBJEXT) HttpReply.$(OBJEXT) int.$(OBJEXT) \
-	SquidList.$(OBJEXT) MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) \
-	MemObject.$(OBJEXT) mem_node.$(OBJEXT) Notes.$(OBJEXT) \
-	Parsing.$(OBJEXT) RemovalPolicy.$(OBJEXT) \
-	RequestFlags.$(OBJEXT) StatCounters.$(OBJEXT) \
-	tests/stub_StatHist.$(OBJEXT) stmem.$(OBJEXT) \
-	tests/stub_stat.$(OBJEXT) store.$(OBJEXT) \
+	MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) MemObject.$(OBJEXT) \
+	mem_node.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
+	RemovalPolicy.$(OBJEXT) RequestFlags.$(OBJEXT) \
+	StatCounters.$(OBJEXT) tests/stub_StatHist.$(OBJEXT) \
+	stmem.$(OBJEXT) tests/stub_stat.$(OBJEXT) store.$(OBJEXT) \
 	StoreFileSystem.$(OBJEXT) StoreIOState.$(OBJEXT) \
 	StoreMetaUnpacker.$(OBJEXT) $(am__objects_11) \
 	StoreSwapLogData.$(OBJEXT) store_io.$(OBJEXT) \
@@ -1505,17 +1514,16 @@
 	HttpHdrSc.cc HttpHdrScTarget.cc HttpHeaderFieldInfo.h \
 	HttpHeaderTools.h HttpHeaderTools.cc HttpHeader.h \
 	HttpHeader.cc HttpMsg.cc RequestFlags.cc RequestFlags.h int.h \
-	int.cc SquidList.h SquidList.cc MasterXaction.cc \
-	MasterXaction.h mem_node.cc MemBuf.cc MemObject.cc Notes.h \
-	Notes.cc Parsing.cc RemovalPolicy.cc refresh.h refresh.cc \
-	StatCounters.h StatCounters.cc StatHist.h StatHist.cc stmem.cc \
-	repl_modules.h store.cc store_io.cc store_swapout.cc \
-	StoreIOState.cc tests/stub_StoreMeta.cc StoreMetaUnpacker.cc \
-	StoreSwapLogData.cc store_key_md5.h store_key_md5.cc \
-	tests/stub_SBufDetailedStats.cc String.cc StrList.h StrList.cc \
-	tests/CapturingStoreEntry.h log/access_log.h \
-	tests/stub_access_log.cc tests/stub_acl.cc cache_cf.h \
-	tests/stub_cache_cf.cc tests/stub_cache_manager.cc \
+	int.cc MasterXaction.cc MasterXaction.h mem_node.cc MemBuf.cc \
+	MemObject.cc Notes.h Notes.cc Parsing.cc RemovalPolicy.cc \
+	refresh.h refresh.cc StatCounters.h StatCounters.cc StatHist.h \
+	StatHist.cc stmem.cc repl_modules.h store.cc store_io.cc \
+	store_swapout.cc StoreIOState.cc tests/stub_StoreMeta.cc \
+	StoreMetaUnpacker.cc StoreSwapLogData.cc store_key_md5.h \
+	store_key_md5.cc tests/stub_SBufDetailedStats.cc String.cc \
+	StrList.h StrList.cc tests/CapturingStoreEntry.h \
+	log/access_log.h tests/stub_access_log.cc tests/stub_acl.cc \
+	cache_cf.h tests/stub_cache_cf.cc tests/stub_cache_manager.cc \
 	tests/stub_client_side_request.cc tests/stub_comm.cc \
 	tests/stub_debug.cc tests/stub_errorpage.cc fd.h fde.h \
 	tests/stub_fd.cc tests/stub_helper.cc \
@@ -1547,9 +1555,9 @@
 	HttpHdrSc.$(OBJEXT) HttpHdrScTarget.$(OBJEXT) \
 	HttpHeaderTools.$(OBJEXT) HttpHeader.$(OBJEXT) \
 	HttpMsg.$(OBJEXT) RequestFlags.$(OBJEXT) int.$(OBJEXT) \
-	SquidList.$(OBJEXT) MasterXaction.$(OBJEXT) mem_node.$(OBJEXT) \
-	MemBuf.$(OBJEXT) MemObject.$(OBJEXT) Notes.$(OBJEXT) \
-	Parsing.$(OBJEXT) RemovalPolicy.$(OBJEXT) refresh.$(OBJEXT) \
+	MasterXaction.$(OBJEXT) mem_node.$(OBJEXT) MemBuf.$(OBJEXT) \
+	MemObject.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
+	RemovalPolicy.$(OBJEXT) refresh.$(OBJEXT) \
 	StatCounters.$(OBJEXT) StatHist.$(OBJEXT) stmem.$(OBJEXT) \
 	store.$(OBJEXT) store_io.$(OBJEXT) store_swapout.$(OBJEXT) \
 	StoreIOState.$(OBJEXT) tests/stub_StoreMeta.$(OBJEXT) \
@@ -1668,27 +1676,26 @@
 	RequestFlags.h RequestFlags.cc HttpRequest.cc icp_v2.cc \
 	icp_v3.cc SquidIpc.h ipc.cc ipc_win32.cc ipcache.cc int.h \
 	int.cc internal.h internal.cc tests/stub_libeui.cc LogTags.cc \
-	SquidList.h SquidList.cc MasterXaction.cc MasterXaction.h \
-	multicast.h multicast.cc mem_node.cc MemBuf.cc MemObject.cc \
-	mime.h mime.cc mime_header.h mime_header.cc neighbors.h \
-	neighbors.cc Notes.h Notes.cc Parsing.cc pconn.cc \
-	peer_digest.cc peer_proxy_negotiate_auth.h \
-	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
-	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
-	Pipeline.cc Pipeline.h redirect.h tests/stub_redirect.cc \
-	refresh.h refresh.cc RemovalPolicy.cc \
-	tests/stub_SBufDetailedStats.cc SnmpRequest.h snmp_core.h \
-	snmp_core.cc snmp_agent.h snmp_agent.cc SquidMath.h \
-	SquidMath.cc IoStats.h stat.h stat.cc StatCounters.h \
-	StatCounters.cc StatHist.h tests/stub_StatHist.cc stmem.cc \
-	repl_modules.h store.cc store_client.cc store_digest.h \
-	tests/stub_store_digest.cc store_io.cc store_key_md5.h \
-	store_key_md5.cc store_log.h store_log.cc store_rebuild.h \
-	store_rebuild.cc store_swapin.h store_swapin.cc \
-	store_swapmeta.cc store_swapout.cc StoreFileSystem.cc \
-	StoreIOState.cc tests/stub_StoreMeta.cc StoreMetaUnpacker.cc \
-	StoreSwapLogData.cc String.cc StrList.h StrList.cc \
-	Transients.cc tests/stub_SwapDir.cc MemStore.cc \
+	MasterXaction.cc MasterXaction.h multicast.h multicast.cc \
+	mem_node.cc MemBuf.cc MemObject.cc mime.h mime.cc \
+	mime_header.h mime_header.cc neighbors.h neighbors.cc Notes.h \
+	Notes.cc Parsing.cc pconn.cc peer_digest.cc \
+	peer_proxy_negotiate_auth.h peer_proxy_negotiate_auth.cc \
+	peer_select.cc peer_sourcehash.h peer_sourcehash.cc \
+	peer_userhash.h peer_userhash.cc Pipeline.cc Pipeline.h \
+	redirect.h tests/stub_redirect.cc refresh.h refresh.cc \
+	RemovalPolicy.cc tests/stub_SBufDetailedStats.cc SnmpRequest.h \
+	snmp_core.h snmp_core.cc snmp_agent.h snmp_agent.cc \
+	SquidMath.h SquidMath.cc IoStats.h stat.h stat.cc \
+	StatCounters.h StatCounters.cc StatHist.h \
+	tests/stub_StatHist.cc stmem.cc repl_modules.h store.cc \
+	store_client.cc store_digest.h tests/stub_store_digest.cc \
+	store_io.cc store_key_md5.h store_key_md5.cc store_log.h \
+	store_log.cc store_rebuild.h store_rebuild.cc store_swapin.h \
+	store_swapin.cc store_swapmeta.cc store_swapout.cc \
+	StoreFileSystem.cc StoreIOState.cc tests/stub_StoreMeta.cc \
+	StoreMetaUnpacker.cc StoreSwapLogData.cc String.cc StrList.h \
+	StrList.cc Transients.cc tests/stub_SwapDir.cc MemStore.cc \
 	tests/stub_debug.cc tests/stub_libauth_acls.cc \
 	tests/stub_libauth.cc tests/stub_libdiskio.cc \
 	tests/stub_libmem.cc tests/stub_libsecurity.cc \
@@ -1724,20 +1731,20 @@
 	RequestFlags.$(OBJEXT) HttpRequest.$(OBJEXT) icp_v2.$(OBJEXT) \
 	icp_v3.$(OBJEXT) $(am__objects_6) ipcache.$(OBJEXT) \
 	int.$(OBJEXT) internal.$(OBJEXT) tests/stub_libeui.$(OBJEXT) \
-	LogTags.$(OBJEXT) SquidList.$(OBJEXT) MasterXaction.$(OBJEXT) \
-	multicast.$(OBJEXT) mem_node.$(OBJEXT) MemBuf.$(OBJEXT) \
-	MemObject.$(OBJEXT) mime.$(OBJEXT) mime_header.$(OBJEXT) \
-	neighbors.$(OBJEXT) Notes.$(OBJEXT) Parsing.$(OBJEXT) \
-	pconn.$(OBJEXT) peer_digest.$(OBJEXT) \
-	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
-	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
-	Pipeline.$(OBJEXT) tests/stub_redirect.$(OBJEXT) \
-	refresh.$(OBJEXT) RemovalPolicy.$(OBJEXT) \
-	tests/stub_SBufDetailedStats.$(OBJEXT) $(am__objects_10) \
-	SquidMath.$(OBJEXT) stat.$(OBJEXT) StatCounters.$(OBJEXT) \
-	tests/stub_StatHist.$(OBJEXT) stmem.$(OBJEXT) store.$(OBJEXT) \
-	store_client.$(OBJEXT) tests/stub_store_digest.$(OBJEXT) \
-	store_io.$(OBJEXT) store_key_md5.$(OBJEXT) store_log.$(OBJEXT) \
+	LogTags.$(OBJEXT) MasterXaction.$(OBJEXT) multicast.$(OBJEXT) \
+	mem_node.$(OBJEXT) MemBuf.$(OBJEXT) MemObject.$(OBJEXT) \
+	mime.$(OBJEXT) mime_header.$(OBJEXT) neighbors.$(OBJEXT) \
+	Notes.$(OBJEXT) Parsing.$(OBJEXT) pconn.$(OBJEXT) \
+	peer_digest.$(OBJEXT) peer_proxy_negotiate_auth.$(OBJEXT) \
+	peer_select.$(OBJEXT) peer_sourcehash.$(OBJEXT) \
+	peer_userhash.$(OBJEXT) Pipeline.$(OBJEXT) \
+	tests/stub_redirect.$(OBJEXT) refresh.$(OBJEXT) \
+	RemovalPolicy.$(OBJEXT) tests/stub_SBufDetailedStats.$(OBJEXT) \
+	$(am__objects_10) SquidMath.$(OBJEXT) stat.$(OBJEXT) \
+	StatCounters.$(OBJEXT) tests/stub_StatHist.$(OBJEXT) \
+	stmem.$(OBJEXT) store.$(OBJEXT) store_client.$(OBJEXT) \
+	tests/stub_store_digest.$(OBJEXT) store_io.$(OBJEXT) \
+	store_key_md5.$(OBJEXT) store_log.$(OBJEXT) \
 	store_rebuild.$(OBJEXT) store_swapin.$(OBJEXT) \
 	store_swapmeta.$(OBJEXT) store_swapout.$(OBJEXT) \
 	StoreFileSystem.$(OBJEXT) StoreIOState.$(OBJEXT) \
@@ -1792,21 +1799,20 @@
 	tests/stub_fatal.cc fd.h fd.cc fde.h fde.cc client_db.h \
 	fs_io.h fs_io.cc FileMap.h filemap.cc HttpBody.h HttpBody.cc \
 	HttpReply.cc int.h int.cc RequestFlags.h RequestFlags.cc \
-	SquidList.h SquidList.cc Transients.cc MasterXaction.cc \
-	MasterXaction.h MemObject.cc Notes.h Notes.cc \
-	StoreSwapLogData.cc StoreIOState.cc StoreMetaUnpacker.cc \
-	StoreMeta.cc StoreMeta.h StoreMetaMD5.cc StoreMetaMD5.h \
-	StoreMetaSTD.cc StoreMetaSTD.h StoreMetaSTDLFS.cc \
-	StoreMetaSTDLFS.h StoreMetaObjSize.h StoreMetaURL.cc \
-	StoreMetaURL.h StoreMetaVary.cc StoreMetaVary.h \
-	StoreFileSystem.cc store_io.cc store_swapout.cc \
-	store_swapmeta.cc unlinkd.h unlinkd.cc win32.cc event.cc \
-	CommonPool.h CompositePoolNode.h delay_pools.cc DelayId.cc \
-	DelayId.h DelayIdComposite.h DelayBucket.cc DelayBucket.h \
-	DelayConfig.cc DelayConfig.h DelayPool.cc DelayPool.h \
-	DelayPools.h DelaySpec.cc DelaySpec.h DelayTagged.cc \
-	DelayTagged.h DelayUser.cc DelayUser.h DelayVector.cc \
-	DelayVector.h NullDelayId.cc NullDelayId.h \
+	Transients.cc MasterXaction.cc MasterXaction.h MemObject.cc \
+	Notes.h Notes.cc StoreSwapLogData.cc StoreIOState.cc \
+	StoreMetaUnpacker.cc StoreMeta.cc StoreMeta.h StoreMetaMD5.cc \
+	StoreMetaMD5.h StoreMetaSTD.cc StoreMetaSTD.h \
+	StoreMetaSTDLFS.cc StoreMetaSTDLFS.h StoreMetaObjSize.h \
+	StoreMetaURL.cc StoreMetaURL.h StoreMetaVary.cc \
+	StoreMetaVary.h StoreFileSystem.cc store_io.cc \
+	store_swapout.cc store_swapmeta.cc unlinkd.h unlinkd.cc \
+	win32.cc event.cc CommonPool.h CompositePoolNode.h \
+	delay_pools.cc DelayId.cc DelayId.h DelayIdComposite.h \
+	DelayBucket.cc DelayBucket.h DelayConfig.cc DelayConfig.h \
+	DelayPool.cc DelayPool.h DelayPools.h DelaySpec.cc DelaySpec.h \
+	DelayTagged.cc DelayTagged.h DelayUser.cc DelayUser.h \
+	DelayVector.cc DelayVector.h NullDelayId.cc NullDelayId.h \
 	ClientDelayConfig.cc ClientDelayConfig.h CacheDigest.h \
 	tests/stub_CacheDigest.cc ConfigParser.cc EventLoop.cc \
 	HttpMsg.cc RemovalPolicy.cc repl_modules.h store.cc \
@@ -1844,11 +1850,11 @@
 	tests/stub_store_stats.$(OBJEXT) tests/stub_fatal.$(OBJEXT) \
 	fd.$(OBJEXT) fde.$(OBJEXT) fs_io.$(OBJEXT) filemap.$(OBJEXT) \
 	HttpBody.$(OBJEXT) HttpReply.$(OBJEXT) int.$(OBJEXT) \
-	RequestFlags.$(OBJEXT) SquidList.$(OBJEXT) \
-	Transients.$(OBJEXT) MasterXaction.$(OBJEXT) \
-	MemObject.$(OBJEXT) Notes.$(OBJEXT) StoreSwapLogData.$(OBJEXT) \
-	StoreIOState.$(OBJEXT) StoreMetaUnpacker.$(OBJEXT) \
-	$(am__objects_11) StoreFileSystem.$(OBJEXT) store_io.$(OBJEXT) \
+	RequestFlags.$(OBJEXT) Transients.$(OBJEXT) \
+	MasterXaction.$(OBJEXT) MemObject.$(OBJEXT) Notes.$(OBJEXT) \
+	StoreSwapLogData.$(OBJEXT) StoreIOState.$(OBJEXT) \
+	StoreMetaUnpacker.$(OBJEXT) $(am__objects_11) \
+	StoreFileSystem.$(OBJEXT) store_io.$(OBJEXT) \
 	store_swapout.$(OBJEXT) store_swapmeta.$(OBJEXT) \
 	$(am__objects_12) $(am__objects_13) event.$(OBJEXT) \
 	$(am__objects_3) tests/stub_CacheDigest.$(OBJEXT) \
@@ -1922,12 +1928,11 @@
 	HttpMsg.cc HttpReply.cc PeerPoolMgr.h PeerPoolMgr.cc \
 	RequestFlags.h RequestFlags.cc HttpRequest.cc icp_v2.cc \
 	icp_v3.cc int.h int.cc internal.h internal.cc SquidIpc.h \
-	ipc.cc ipc_win32.cc ipcache.cc LogTags.cc SquidList.h \
-	SquidList.cc MasterXaction.cc MasterXaction.h MemBuf.cc \
-	MemObject.cc tests/stub_libmem.cc mem_node.cc mime.h mime.cc \
-	mime_header.h mime_header.cc multicast.h multicast.cc \
-	neighbors.h neighbors.cc Notes.cc Notes.h Parsing.cc \
-	peer_digest.cc peer_proxy_negotiate_auth.h \
+	ipc.cc ipc_win32.cc ipcache.cc LogTags.cc MasterXaction.cc \
+	MasterXaction.h MemBuf.cc MemObject.cc tests/stub_libmem.cc \
+	mem_node.cc mime.h mime.cc mime_header.h mime_header.cc \
+	multicast.h multicast.cc neighbors.h neighbors.cc Notes.cc \
+	Notes.h Parsing.cc peer_digest.cc peer_proxy_negotiate_auth.h \
 	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
 	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
 	Pipeline.cc Pipeline.h pconn.cc redirect.h \
@@ -1977,11 +1982,10 @@
 	RequestFlags.$(OBJEXT) HttpRequest.$(OBJEXT) icp_v2.$(OBJEXT) \
 	icp_v3.$(OBJEXT) int.$(OBJEXT) internal.$(OBJEXT) \
 	$(am__objects_6) ipcache.$(OBJEXT) LogTags.$(OBJEXT) \
-	SquidList.$(OBJEXT) MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) \
-	MemObject.$(OBJEXT) tests/stub_libmem.$(OBJEXT) \
-	mem_node.$(OBJEXT) mime.$(OBJEXT) mime_header.$(OBJEXT) \
-	multicast.$(OBJEXT) neighbors.$(OBJEXT) Notes.$(OBJEXT) \
-	Parsing.$(OBJEXT) peer_digest.$(OBJEXT) \
+	MasterXaction.$(OBJEXT) MemBuf.$(OBJEXT) MemObject.$(OBJEXT) \
+	tests/stub_libmem.$(OBJEXT) mem_node.$(OBJEXT) mime.$(OBJEXT) \
+	mime_header.$(OBJEXT) multicast.$(OBJEXT) neighbors.$(OBJEXT) \
+	Notes.$(OBJEXT) Parsing.$(OBJEXT) peer_digest.$(OBJEXT) \
 	peer_proxy_negotiate_auth.$(OBJEXT) peer_select.$(OBJEXT) \
 	peer_sourcehash.$(OBJEXT) peer_userhash.$(OBJEXT) \
 	Pipeline.$(OBJEXT) pconn.$(OBJEXT) \
@@ -2134,6 +2138,7 @@
 	$(nodist_tests_testIpAddress_SOURCES) \
 	$(tests_testLookupTable_SOURCES) \
 	$(nodist_tests_testLookupTable_SOURCES) \
+	$(tests_testNetDb_SOURCES) $(nodist_tests_testNetDb_SOURCES) \
 	$(tests_testRock_SOURCES) $(nodist_tests_testRock_SOURCES) \
 	$(tests_testSBuf_SOURCES) $(nodist_tests_testSBuf_SOURCES) \
 	$(tests_testSBufList_SOURCES) \
@@ -2166,7 +2171,7 @@
 	$(tests_testHttpReply_SOURCES) \
 	$(am__tests_testHttpRequest_SOURCES_DIST) \
 	$(tests_testIcmp_SOURCES) $(tests_testIpAddress_SOURCES) \
-	$(tests_testLookupTable_SOURCES) \
+	$(tests_testLookupTable_SOURCES) $(tests_testNetDb_SOURCES) \
 	$(am__tests_testRock_SOURCES_DIST) $(tests_testSBuf_SOURCES) \
 	$(tests_testSBufList_SOURCES) $(tests_testStatHist_SOURCES) \
 	$(am__tests_testStore_SOURCES_DIST) \
@@ -2873,28 +2878,28 @@
 	RequestFlags.h RequestFlags.cc HttpRequest.cc HttpRequest.h \
 	ICP.h icp_opcode.h icp_v2.cc icp_v3.cc int.h int.cc internal.h \
 	internal.cc $(IPC_SOURCE) ipcache.cc ipcache.h \
-	$(LEAKFINDERSOURCE) SquidList.h SquidList.cc LogTags.cc \
-	LogTags.h lookup_t.h main.cc MasterXaction.cc MasterXaction.h \
-	mem_node.cc mem_node.h MemBuf.cc MemObject.cc MemObject.h \
-	MessageSizes.h mime.h mime.cc mime_header.h mime_header.cc \
-	multicast.h multicast.cc neighbors.h neighbors.cc Notes.h \
-	Notes.cc Parsing.cc Parsing.h $(XPROF_STATS_SOURCE) pconn.cc \
-	pconn.h PeerDigest.h peer_digest.cc \
-	peer_proxy_negotiate_auth.h peer_proxy_negotiate_auth.cc \
-	peer_select.cc peer_sourcehash.h peer_sourcehash.cc \
-	peer_userhash.h peer_userhash.cc PeerPoolMgr.h PeerPoolMgr.cc \
-	PeerSelectState.h PingData.h Pipeline.cc Pipeline.h protos.h \
-	redirect.h redirect.cc refresh.h refresh.cc RemovalPolicy.cc \
-	RemovalPolicy.h send-announce.h send-announce.cc \
-	SBufStatsAction.h SBufStatsAction.cc sbuf/StringConvert.h \
-	$(SNMP_SOURCE) SquidMath.h SquidMath.cc SquidNew.cc IoStats.h \
-	stat.h stat.cc StatCounters.h StatCounters.cc StatHist.h \
-	StatHist.cc String.cc StrList.h StrList.cc stmem.cc stmem.h \
-	repl_modules.h store.cc Store.h StoreFileSystem.cc \
-	StoreFileSystem.h store_io.cc StoreIOBuffer.h StoreIOState.cc \
-	StoreIOState.h store_client.cc StoreClient.h store_digest.h \
-	store_digest.cc store_key_md5.h store_key_md5.cc store_log.h \
-	store_log.cc store_rebuild.h store_rebuild.cc store_swapin.h \
+	$(LEAKFINDERSOURCE) LogTags.cc LogTags.h lookup_t.h main.cc \
+	MasterXaction.cc MasterXaction.h mem_node.cc mem_node.h \
+	MemBuf.cc MemObject.cc MemObject.h MessageSizes.h mime.h \
+	mime.cc mime_header.h mime_header.cc multicast.h multicast.cc \
+	neighbors.h neighbors.cc Notes.h Notes.cc Parsing.cc Parsing.h \
+	$(XPROF_STATS_SOURCE) pconn.cc pconn.h PeerDigest.h \
+	peer_digest.cc peer_proxy_negotiate_auth.h \
+	peer_proxy_negotiate_auth.cc peer_select.cc peer_sourcehash.h \
+	peer_sourcehash.cc peer_userhash.h peer_userhash.cc \
+	PeerPoolMgr.h PeerPoolMgr.cc PeerSelectState.h PingData.h \
+	Pipeline.cc Pipeline.h protos.h redirect.h redirect.cc \
+	refresh.h refresh.cc RemovalPolicy.cc RemovalPolicy.h \
+	send-announce.h send-announce.cc SBufStatsAction.h \
+	SBufStatsAction.cc sbuf/StringConvert.h $(SNMP_SOURCE) \
+	SquidMath.h SquidMath.cc SquidNew.cc IoStats.h stat.h stat.cc \
+	StatCounters.h StatCounters.cc StatHist.h StatHist.cc \
+	String.cc StrList.h StrList.cc stmem.cc stmem.h repl_modules.h \
+	store.cc Store.h StoreFileSystem.cc StoreFileSystem.h \
+	store_io.cc StoreIOBuffer.h StoreIOState.cc StoreIOState.h \
+	store_client.cc StoreClient.h store_digest.h store_digest.cc \
+	store_key_md5.h store_key_md5.cc store_log.h store_log.cc \
+	store_rebuild.h store_rebuild.cc store_swapin.h \
 	store_swapin.cc store_swapmeta.cc store_swapout.cc \
 	StoreMetaUnpacker.cc StoreMetaUnpacker.h $(STOREMETA_SOURCE) \
 	StoreSearch.h StoreStats.cc StoreStats.h StoreSwapLogData.cc \
@@ -3319,8 +3324,6 @@
 	MasterXaction.h \
 	Notes.cc \
 	Notes.h \
-	SquidList.h \
-	SquidList.cc \
 	mem_node.cc \
 	Parsing.cc \
 	tests/stub_libsecurity.cc \
@@ -3558,8 +3561,6 @@
 	internal.cc \
 	LogTags.cc \
 	tests/stub_libsecurity.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	multicast.h \
@@ -3743,8 +3744,6 @@
 	HttpReply.cc \
 	int.h \
 	int.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -3994,8 +3993,6 @@
 	internal.cc \
 	LogTags.cc \
 	tests/stub_libsecurity.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	tests/stub_libmem.cc \
@@ -4233,8 +4230,6 @@
 	internal.h \
 	internal.cc \
 	LogTags.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -4469,8 +4464,6 @@
 	$(IPC_SOURCE) \
 	ipcache.cc \
 	LogTags.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -4787,8 +4780,6 @@
 	internal.cc \
 	LogTags.cc \
 	tests/stub_libsecurity.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	multicast.h \
@@ -4947,6 +4938,27 @@
 	$(COMPAT_LIB) \
 	$(XTRA_LIBS)
 
+tests_testNetDb_SOURCES = \
+	tests/testNetDb.cc \
+	tests/testNetDb.h
+
+nodist_tests_testNetDb_SOURCES = \
+	SquidTime.h \
+	tests/stub_debug.cc \
+	tests/stub_libmem.cc \
+	time.cc \
+	globals.cc
+
+tests_testNetDb_LDFLAGS = $(LIBADD_DL)
+tests_testNetDb_LDADD = \
+	icmp/libicmp.la \
+	ip/libip.la \
+	base/libbase.la \
+	$(top_builddir)/lib/libmisccontainers.la \
+	$(LIBCPPUNIT_LIBS) \
+	$(COMPAT_LIB) \
+	$(XTRA_LIBS)
+
 tests_testIpAddress_SOURCES = \
 	tests/testAddress.cc \
 	tests/testAddress.h
@@ -5001,8 +5013,6 @@
 	RequestFlags.h \
 	int.h \
 	int.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	mem_node.cc \
@@ -5226,8 +5236,6 @@
 	int.cc \
 	RequestFlags.h \
 	RequestFlags.cc \
-	SquidList.h \
-	SquidList.cc \
 	Transients.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
@@ -5413,8 +5421,6 @@
 	HttpReply.cc \
 	int.h \
 	int.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	MemBuf.cc \
@@ -5629,8 +5635,6 @@
 	internal.cc \
 	tests/stub_libeui.cc \
 	LogTags.cc \
-	SquidList.h \
-	SquidList.cc \
 	MasterXaction.cc \
 	MasterXaction.h \
 	multicast.h \
@@ -6424,6 +6428,12 @@
 tests/testLookupTable$(EXEEXT): $(tests_testLookupTable_OBJECTS) $(tests_testLookupTable_DEPENDENCIES) $(EXTRA_tests_testLookupTable_DEPENDENCIES) tests/$(am__dirstamp)
 	@rm -f tests/testLookupTable$(EXEEXT)
 	$(AM_V_CXXLD)$(tests_testLookupTable_LINK) $(tests_testLookupTable_OBJECTS) $(tests_testLookupTable_LDADD) $(LIBS)
+tests/testNetDb.$(OBJEXT): tests/$(am__dirstamp) \
+	tests/$(DEPDIR)/$(am__dirstamp)
+
+tests/testNetDb$(EXEEXT): $(tests_testNetDb_OBJECTS) $(tests_testNetDb_DEPENDENCIES) $(EXTRA_tests_testNetDb_DEPENDENCIES) tests/$(am__dirstamp)
+	@rm -f tests/testNetDb$(EXEEXT)
+	$(AM_V_CXXLD)$(tests_testNetDb_LINK) $(tests_testNetDb_OBJECTS) $(tests_testNetDb_LDADD) $(LIBS)
 tests/testRock.$(OBJEXT): tests/$(am__dirstamp) \
 	tests/$(DEPDIR)/$(am__dirstamp)
 
@@ -6581,7 +6591,6 @@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/RequestFlags.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/SBufStatsAction.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/SquidConfig.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/SquidList.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/SquidMath.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/SquidNew.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/StatCounters.Po@am__quote@
@@ -6779,6 +6788,7 @@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testHttpRequestMethod.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testIcmp.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testLookupTable.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testNetDb.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testPackableStream.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testRFC1035.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@tests/$(DEPDIR)/testRefCount.Po@am__quote@
@@ -7265,6 +7275,13 @@
 	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
 	--log-file $$b.log --trs-file $$b.trs \
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
+tests/testNetDb.log: tests/testNetDb$(EXEEXT)
+	@p='tests/testNetDb$(EXEEXT)'; \
+	b='tests/testNetDb'; \
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+	--log-file $$b.log --trs-file $$b.trs \
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
 tests/testStore.log: tests/testStore$(EXEEXT)
 	@p='tests/testStore$(EXEEXT)'; \
diff -u -r -N squid-4.0.15/src/mem/forward.h squid-4.0.16/src/mem/forward.h
--- squid-4.0.15/src/mem/forward.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/mem/forward.h	2016-10-31 01:24:50.000000000 +1300
@@ -44,13 +44,9 @@
     MEM_16K_BUF,
     MEM_32K_BUF,
     MEM_64K_BUF,
-    MEM_ACL_DENY_INFO_LIST,
-    MEM_ACL_NAME_LIST,
-    MEM_LINK_LIST,
     MEM_DREAD_CTRL,
     MEM_DWRITE_Q,
     MEM_MD5_DIGEST,
-    MEM_NETDBENTRY,
     MEM_MAX
 } mem_type;
 
diff -u -r -N squid-4.0.15/src/mem/old_api.cc squid-4.0.16/src/mem/old_api.cc
--- squid-4.0.15/src/mem/old_api.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/mem/old_api.cc	2016-10-31 01:24:50.000000000 +1300
@@ -9,8 +9,6 @@
 /* DEBUG: section 13    High Level Memory Pool Management */
 
 #include "squid.h"
-#include "acl/AclDenyInfoList.h"
-#include "acl/AclNameList.h"
 #include "base/PackableStream.h"
 #include "ClientInfo.h"
 #include "dlink.h"
@@ -24,7 +22,6 @@
 #include "MemBuf.h"
 #include "mgr/Registration.h"
 #include "SquidConfig.h"
-#include "SquidList.h"
 #include "SquidTime.h"
 #include "Store.h"
 
@@ -442,13 +439,8 @@
     memDataInit(MEM_16K_BUF, "16K Buffer", 16384, 10, false);
     memDataInit(MEM_32K_BUF, "32K Buffer", 32768, 10, false);
     memDataInit(MEM_64K_BUF, "64K Buffer", 65536, 10, false);
-    memDataInit(MEM_ACL_DENY_INFO_LIST, "AclDenyInfoList",
-                sizeof(AclDenyInfoList), 0);
-    memDataInit(MEM_ACL_NAME_LIST, "acl_name_list", sizeof(AclNameList), 0);
-    memDataInit(MEM_LINK_LIST, "link_list", sizeof(link_list), 10);
     memDataInit(MEM_DREAD_CTRL, "dread_ctrl", sizeof(dread_ctrl), 0);
     memDataInit(MEM_DWRITE_Q, "dwrite_q", sizeof(dwrite_q), 0);
-    memDataInit(MEM_NETDBENTRY, "netdbEntry", sizeof(netdbEntry), 0);
     memDataInit(MEM_MD5_DIGEST, "MD5 digest", SQUID_MD5_DIGEST_LENGTH, 0);
     GetPool(MEM_MD5_DIGEST)->setChunkSize(512 * 1024);
 
diff -u -r -N squid-4.0.15/src/refresh.cc squid-4.0.16/src/refresh.cc
--- squid-4.0.15/src/refresh.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/refresh.cc	2016-10-31 01:24:50.000000000 +1300
@@ -327,10 +327,12 @@
 
     debugs(22, 3, "Staleness = " << staleness);
 
+    const auto *reply = (entry->mem_obj && entry->mem_obj->getReply() ? entry->mem_obj->getReply() : nullptr);
+
     // stale-if-error requires any failure be passed thru when its period is over.
-    if (request && entry->mem_obj && entry->mem_obj->getReply() && entry->mem_obj->getReply()->cache_control &&
-            entry->mem_obj->getReply()->cache_control->hasStaleIfError() &&
-            entry->mem_obj->getReply()->cache_control->staleIfError() < staleness) {
+    if (request && reply && reply->cache_control &&
+            reply->cache_control->hasStaleIfError() &&
+            reply->cache_control->staleIfError() < staleness) {
 
         debugs(22, 3, "stale-if-error period expired. Will produce error if validation fails.");
         request->flags.failOnValidationError = true;
@@ -415,18 +417,21 @@
 
             // max-age directive
             if (cc->hasMaxAge()) {
+
+                // draft-mcmanus-immutable-00: reply contains CC:immutable then ignore client CC:max-age=N
+                if (reply && reply->cache_control && reply->cache_control->Immutable()) {
+                    debugs(22, 3, "MAYBE: Ignoring client CC:max-age=" << cc->maxAge() << " request - 'Cache-Control: immutable'");
+
 #if USE_HTTP_VIOLATIONS
-                // Ignore client "Cache-Control: max-age=0" header
-                if (R->flags.ignore_reload && cc->maxAge() == 0) {
+                    // Ignore of client "Cache-Control: max-age=0" header
+                } else if (R->flags.ignore_reload && cc->maxAge() == 0) {
                     debugs(22, 3, "MAYBE: Ignoring client reload request - trying to serve from cache (ignore-reload option)");
-                } else
 #endif
-                {
+
                     // Honour client "Cache-Control: max-age=x" header
-                    if (age > cc->maxAge() || cc->maxAge() == 0) {
-                        debugs(22, 3, "YES: Revalidating object - client 'Cache-Control: max-age=" << cc->maxAge() << "'");
-                        return STALE_EXCEEDS_REQUEST_MAX_AGE_VALUE;
-                    }
+                } else if (age > cc->maxAge() || cc->maxAge() == 0) {
+                    debugs(22, 3, "YES: Revalidating object - client 'Cache-Control: max-age=" << cc->maxAge() << "'");
+                    return STALE_EXCEEDS_REQUEST_MAX_AGE_VALUE;
                 }
             }
 
diff -u -r -N squid-4.0.15/src/repl/heap/store_repl_heap.cc squid-4.0.16/src/repl/heap/store_repl_heap.cc
--- squid-4.0.15/src/repl/heap/store_repl_heap.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/repl/heap/store_repl_heap.cc	2016-10-31 01:24:50.000000000 +1300
@@ -20,11 +20,12 @@
 #include "squid.h"
 #include "heap.h"
 #include "MemObject.h"
-#include "SquidList.h"
 #include "Store.h"
 #include "store_heap_replacement.h"
 #include "wordlist.h"
 
+#include <queue>
+
 REMOVALPOLICYCREATE createRemovalPolicy_heap;
 
 static int nr_heap_policies = 0;
@@ -181,11 +182,11 @@
 
 /** RemovalPurgeWalker **/
 
-typedef struct _HeapPurgeData HeapPurgeData;
-
-struct _HeapPurgeData {
-    link_list *locked_entries;
-    heap_key min_age;
+class HeapPurgeData
+{
+public:
+    std::queue<StoreEntry *> locked_entries;
+    heap_key min_age = 0.0;
 };
 
 static StoreEntry *
@@ -209,7 +210,7 @@
     if (entry->locked()) {
 
         entry->lock("heap_purgeNext");
-        linklistPush(&heap_walker->locked_entries, entry);
+        heap_walker->locked_entries.push(entry);
 
         goto try_again;
     }
@@ -225,7 +226,6 @@
     HeapPurgeData *heap_walker = (HeapPurgeData *)walker->_data;
     RemovalPolicy *policy = walker->_policy;
     HeapPolicyData *h = (HeapPolicyData *)policy->_data;
-    StoreEntry *entry;
     assert(strcmp(policy->_type, "heap") == 0);
     assert(h->nwalkers > 0);
     h->nwalkers -= 1;
@@ -235,16 +235,16 @@
         debugs(81, 3, "Heap age set to " << h->theHeap->age);
     }
 
-    /*
-     * Reinsert the locked entries
-     */
-    while ((entry = (StoreEntry *)linklistShift(&heap_walker->locked_entries))) {
+    // Reinsert the locked entries
+    while (!heap_walker->locked_entries.empty()) {
+        StoreEntry *entry = heap_walker->locked_entries.front();
         heap_node *node = heap_insert(h->theHeap, entry);
         h->setPolicyNode(entry, node);
         entry->unlock("heap_purgeDone");
+        heap_walker->locked_entries.pop();
     }
 
-    safe_free(walker->_data);
+    delete heap_walker;
     delete walker;
 }
 
@@ -256,9 +256,7 @@
     HeapPurgeData *heap_walk;
     h->nwalkers += 1;
     walker = new RemovalPurgeWalker;
-    heap_walk = (HeapPurgeData *)xcalloc(1, sizeof(*heap_walk));
-    heap_walk->min_age = 0.0;
-    heap_walk->locked_entries = NULL;
+    heap_walk = new HeapPurgeData;
     walker->_policy = policy;
     walker->_data = heap_walk;
     walker->max_scan = max_scan;
diff -u -r -N squid-4.0.15/src/security/cert_validators/fake/security_fake_certverify.8 squid-4.0.16/src/security/cert_validators/fake/security_fake_certverify.8
--- squid-4.0.15/src/security/cert_validators/fake/security_fake_certverify.8	2016-10-10 12:01:21.000000000 +1300
+++ squid-4.0.16/src/security/cert_validators/fake/security_fake_certverify.8	2016-10-31 03:22:36.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SECURITY_FAKE_CERTVERIFY 8"
-.TH SECURITY_FAKE_CERTVERIFY 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH SECURITY_FAKE_CERTVERIFY 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/security/PeerConnector.cc squid-4.0.16/src/security/PeerConnector.cc
--- squid-4.0.15/src/security/PeerConnector.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/security/PeerConnector.cc	2016-10-31 01:24:50.000000000 +1300
@@ -208,8 +208,8 @@
         // Ssl::CertValidationRequest object used only to pass data to
         // Ssl::CertValidationHelper::submit method.
         validationRequest.ssl = session.get();
-        SBuf *dName = (SBuf *)SSL_get_ex_data(session.get(), ssl_ex_index_server);
-        validationRequest.domainName = dName->c_str();
+        if (SBuf *dName = (SBuf *)SSL_get_ex_data(session.get(), ssl_ex_index_server))
+            validationRequest.domainName = dName->c_str();
         if (Security::CertErrors *errs = static_cast<Security::CertErrors *>(SSL_get_ex_data(session.get(), ssl_ex_index_ssl_errors)))
             // validationRequest disappears on return so no need to cbdataReference
             validationRequest.errors = errs;
@@ -253,7 +253,7 @@
     if (Debug::Enabled(83, 5)) {
         Security::SessionPointer ssl(fd_table[serverConnection()->fd].ssl);
         SBuf *server = static_cast<SBuf *>(SSL_get_ex_data(ssl.get(), ssl_ex_index_server));
-        debugs(83,5, *server << " cert validation result: " << validationResponse->resultCode);
+        debugs(83,5, RawPointer("host", server) << " cert validation result: " << validationResponse->resultCode);
     }
 
     if (validationResponse->resultCode == ::Helper::Error) {
diff -u -r -N squid-4.0.15/src/SquidList.cc squid-4.0.16/src/SquidList.cc
--- squid-4.0.15/src/SquidList.cc	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/SquidList.cc	1970-01-01 12:00:00.000000000 +1200
@@ -1,49 +0,0 @@
-/*
- * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
- *
- * Squid software is distributed under GPLv2+ license and includes
- * contributions from numerous individuals and organizations.
- * Please see the COPYING and CONTRIBUTORS files for details.
- */
-
-/* DEBUG: none          Linked list functions (deprecated) */
-
-#include "squid.h"
-#include "mem/forward.h"
-#include "SquidList.h"
-
-/* This should go away, in favour of the List template class */
-
-void
-linklistPush(link_list ** L, void *p)
-{
-    link_list *l = (link_list *)memAllocate(MEM_LINK_LIST);
-    l->next = NULL;
-    l->ptr = p;
-
-    while (*L)
-        L = &(*L)->next;
-
-    *L = l;
-}
-
-void *
-linklistShift(link_list ** L)
-{
-    void *p;
-    link_list *l;
-
-    if (NULL == *L)
-        return NULL;
-
-    l = *L;
-
-    p = l->ptr;
-
-    *L = (*L)->next;
-
-    memFree(l, MEM_LINK_LIST);
-
-    return p;
-}
-
diff -u -r -N squid-4.0.15/src/SquidList.h squid-4.0.16/src/SquidList.h
--- squid-4.0.15/src/SquidList.h	2016-10-10 08:05:51.000000000 +1300
+++ squid-4.0.16/src/SquidList.h	1970-01-01 12:00:00.000000000 +1200
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
- *
- * Squid software is distributed under GPLv2+ license and includes
- * contributions from numerous individuals and organizations.
- * Please see the COPYING and CONTRIBUTORS files for details.
- */
-
-/* DEBUG: none          Linked list functions (deprecated) */
-
-#ifndef SQUID_SQUIDLIST_H_
-#define SQUID_SQUIDLIST_H_
-
-class link_list
-{
-public:
-    void *ptr;
-    link_list *next;
-};
-
-void linklistPush(link_list **, void *);
-void *linklistShift(link_list **);
-
-#endif /* SQUID_SQUIDLIST_H_ */
-
diff -u -r -N squid-4.0.15/src/store/id_rewriters/file/storeid_file_rewrite.8 squid-4.0.16/src/store/id_rewriters/file/storeid_file_rewrite.8
--- squid-4.0.15/src/store/id_rewriters/file/storeid_file_rewrite.8	2016-10-10 11:56:34.000000000 +1300
+++ squid-4.0.16/src/store/id_rewriters/file/storeid_file_rewrite.8	2016-10-31 03:19:23.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "STOREID_FILE_REWRITE 8"
-.TH STOREID_FILE_REWRITE 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH STOREID_FILE_REWRITE 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-4.0.15/src/tests/testNetDb.cc squid-4.0.16/src/tests/testNetDb.cc
--- squid-4.0.15/src/tests/testNetDb.cc	1970-01-01 12:00:00.000000000 +1200
+++ squid-4.0.16/src/tests/testNetDb.cc	2016-10-31 01:24:50.000000000 +1300
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#include "squid.h"
+#include "icmp/net_db.h"
+#include "tests/testNetDb.h"
+#include "unitTestMain.h"
+
+#include <stdexcept>
+
+CPPUNIT_TEST_SUITE_REGISTRATION( testNetDb );
+
+void
+testNetDb::testConstruct()
+{
+    // default construct and destruct
+    {
+        netdbEntry T;
+        CPPUNIT_ASSERT_EQUAL(T.network[0], '\0');
+        CPPUNIT_ASSERT_EQUAL(0, T.pings_sent);
+        CPPUNIT_ASSERT_EQUAL(0, T.pings_recv);
+        CPPUNIT_ASSERT_EQUAL(0.0, T.hops);
+        CPPUNIT_ASSERT_EQUAL(1.0, T.rtt);
+        CPPUNIT_ASSERT_EQUAL(static_cast<time_t>(0), T.next_ping_time);
+        CPPUNIT_ASSERT_EQUAL(static_cast<time_t>(0), T.last_use_time);
+        CPPUNIT_ASSERT_EQUAL(0, T.link_count);
+        CPPUNIT_ASSERT_EQUAL(static_cast<net_db_name*>(nullptr), T.hosts);
+        CPPUNIT_ASSERT_EQUAL(static_cast<net_db_peer*>(nullptr), T.peers);
+        CPPUNIT_ASSERT_EQUAL(0, T.n_peers_alloc);
+        CPPUNIT_ASSERT_EQUAL(0, T.n_peers);
+    }
+
+    // new and delete operations
+    {
+        netdbEntry *T = new netdbEntry;
+        CPPUNIT_ASSERT_EQUAL(T->network[0], '\0');
+        CPPUNIT_ASSERT_EQUAL(0, T->pings_sent);
+        CPPUNIT_ASSERT_EQUAL(0, T->pings_recv);
+        CPPUNIT_ASSERT_EQUAL(0.0, T->hops);
+        CPPUNIT_ASSERT_EQUAL(1.0, T->rtt);
+        CPPUNIT_ASSERT_EQUAL(static_cast<time_t>(0), T->next_ping_time);
+        CPPUNIT_ASSERT_EQUAL(static_cast<time_t>(0), T->last_use_time);
+        CPPUNIT_ASSERT_EQUAL(0, T->link_count);
+        CPPUNIT_ASSERT_EQUAL(static_cast<net_db_name*>(nullptr), T->hosts);
+        CPPUNIT_ASSERT_EQUAL(static_cast<net_db_peer*>(nullptr), T->peers);
+        CPPUNIT_ASSERT_EQUAL(0, T->n_peers_alloc);
+        CPPUNIT_ASSERT_EQUAL(0, T->n_peers);
+        delete T;
+    }
+}
+
diff -u -r -N squid-4.0.15/src/tests/testNetDb.h squid-4.0.16/src/tests/testNetDb.h
--- squid-4.0.15/src/tests/testNetDb.h	1970-01-01 12:00:00.000000000 +1200
+++ squid-4.0.16/src/tests/testNetDb.h	2016-10-31 01:24:50.000000000 +1300
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#ifndef SQUID_SRC_TESTS_TESTNETDB_H
+#define SQUID_SRC_TESTS_TESTNETDB_H
+
+#include <cppunit/extensions/HelperMacros.h>
+
+class testNetDb : public CPPUNIT_NS::TestFixture
+{
+    CPPUNIT_TEST_SUITE( testNetDb );
+    /* note the statement here and then the actual prototype below */
+    CPPUNIT_TEST( testConstruct );
+    CPPUNIT_TEST_SUITE_END();
+
+public:
+
+protected:
+    void testConstruct();
+};
+
+#endif /* SQUID_SRC_TESTS_TESTNETDB_H */
+
diff -u -r -N squid-4.0.15/tools/helper-mux/helper-mux.8 squid-4.0.16/tools/helper-mux/helper-mux.8
--- squid-4.0.15/tools/helper-mux/helper-mux.8	2016-10-10 12:02:23.000000000 +1300
+++ squid-4.0.16/tools/helper-mux/helper-mux.8	2016-10-31 03:22:52.000000000 +1300
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "HELPER-MUX 8"
-.TH HELPER-MUX 8 "2016-10-09" "perl v5.24.1" "User Contributed Perl Documentation"
+.TH HELPER-MUX 8 "2016-10-30" "perl v5.24.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
