diff -u -r -N squid-3.5.19/ChangeLog squid-3.5.20/ChangeLog
--- squid-3.5.19/ChangeLog	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/ChangeLog	2016-07-01 23:37:50.000000000 +1200
@@ -1,3 +1,18 @@
+Changes to squid-3.5.20 (01 Jul 2016):
+
+	- Bug 4523: smblib compile fails on NetBSD
+	- Bug 4485: off-by-one out-of-bounds Parser::Tokenizer::int64() read errors
+	- Bug 3579: assertion failed 'MemPools[type]' from dst_as ACL
+	- Fix icons loading speed
+	- Fix OpenSSL detection on FreeBSD
+	- Fix assertion failed: Write.cc:38: 'fd_table[conn->fd].flags.open'
+	- Fix SEGFAULT parsing malformed adaptation service configuration
+	- Fix ConnStateData::In::maybeMakeSpaceAvailable() logic
+	- Do not override user defined -std option
+	- Do not allow low-level debugging to hide important/critical messages
+	- Do not make bogus recvmsg(2) calls when closing UDS sockets
+	- Support unified EUI format code in external_acl_type
+
 Changes to squid-3.5.19 (09 May 2016):
 
 	- Regression Bug 4515: interception proxy hangs
diff -u -r -N squid-3.5.19/configure squid-3.5.20/configure
--- squid-3.5.19/configure	2016-05-09 00:48:31.000000000 +1200
+++ squid-3.5.20/configure	2016-07-01 23:40:16.000000000 +1200
@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision.
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for Squid Web Proxy 3.5.19.
+# Generated by GNU Autoconf 2.69 for Squid Web Proxy 3.5.20.
 #
 # Report bugs to <http://bugs.squid-cache.org/>.
 #
@@ -595,8 +595,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='3.5.19'
-PACKAGE_STRING='Squid Web Proxy 3.5.19'
+PACKAGE_VERSION='3.5.20'
+PACKAGE_STRING='Squid Web Proxy 3.5.20'
 PACKAGE_BUGREPORT='http://bugs.squid-cache.org/'
 PACKAGE_URL=''
 
@@ -1636,7 +1636,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 3.5.19 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 3.5.20 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1707,7 +1707,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 3.5.19:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 3.5.20:";;
    esac
   cat <<\_ACEOF
 
@@ -2119,7 +2119,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 3.5.19
+Squid Web Proxy configure 3.5.20
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -3223,7 +3223,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 3.5.19, which was
+It was created by Squid Web Proxy $as_me 3.5.20, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4090,7 +4090,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='3.5.19'
+ VERSION='3.5.20'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -6900,6 +6900,9 @@
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $squid_cv_compiler" >&5
 $as_echo "$squid_cv_compiler" >&6; }
 
+# If the user did not specify a C++ version.
+user_cxx=`echo "$PRESET_CXXFLAGS" | grep -o -E "\-std="`
+if test "x$user_cxx" = "x"; then
 # Check for C++11 compiler support
 #
 # BUG 3613: when clang -std=c++0x is used, it activates a "strict mode"
@@ -6908,8 +6911,8 @@
 #
 # Similar POSIX issues on MinGW 32-bit and Cygwin
 #
-if ! test "x$squid_host_os" = "xmingw" -o "x$squid_host_os" = "xcygwin" -o "x$squid_cv_compiler" = "xclang"; then
-      ax_cxx_compile_cxx11_required=false
+  if ! test "x$squid_host_os" = "xmingw" -o "x$squid_host_os" = "xcygwin" -o "x$squid_cv_compiler" = "xclang"; then
+        ax_cxx_compile_cxx11_required=false
   ac_ext=cpp
 ac_cpp='$CXXCPP $CPPFLAGS'
 ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -7047,6 +7050,7 @@
 
   fi
 
+  fi
 fi
 
 # test for programs
@@ -23422,7 +23426,7 @@
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-lcrypto  $LIBS"
+LIBS="-lcrypto $LIBOPENSSL_LIBS $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -23466,7 +23470,7 @@
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-lssl  $LIBS"
+LIBS="-lssl $LIBOPENSSL_LIBS $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -23525,7 +23529,7 @@
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-lcrypto  $LIBS"
+LIBS="-lcrypto $LIBOPENSSL_LIBS $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -23569,7 +23573,7 @@
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-lssl  $LIBS"
+LIBS="-lssl $LIBOPENSSL_LIBS $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -41872,7 +41876,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 3.5.19, which was
+This file was extended by Squid Web Proxy $as_me 3.5.20, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -41938,7 +41942,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-Squid Web Proxy config.status 3.5.19
+Squid Web Proxy config.status 3.5.20
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff -u -r -N squid-3.5.19/configure.ac squid-3.5.20/configure.ac
--- squid-3.5.19/configure.ac	2016-05-09 00:48:30.000000000 +1200
+++ squid-3.5.20/configure.ac	2016-07-01 23:40:16.000000000 +1200
@@ -5,7 +5,7 @@
 ## Please see the COPYING and CONTRIBUTORS files for details.
 ##
 
-AC_INIT([Squid Web Proxy],[3.5.19],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[3.5.20],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
@@ -95,6 +95,9 @@
 # Guess the compiler type (sets squid_cv_compiler)
 SQUID_CC_GUESS_VARIANT
 
+# If the user did not specify a C++ version.
+user_cxx=`echo "$PRESET_CXXFLAGS" | grep -o -E "\-std="`
+if test "x$user_cxx" = "x"; then
 # Check for C++11 compiler support
 #
 # BUG 3613: when clang -std=c++0x is used, it activates a "strict mode"
@@ -103,8 +106,9 @@
 #
 # Similar POSIX issues on MinGW 32-bit and Cygwin
 #
-if ! test "x$squid_host_os" = "xmingw" -o "x$squid_host_os" = "xcygwin" -o "x$squid_cv_compiler" = "xclang"; then
-  AX_CXX_COMPILE_STDCXX_11([noext],[optional])
+  if ! test "x$squid_host_os" = "xmingw" -o "x$squid_host_os" = "xcygwin" -o "x$squid_cv_compiler" = "xclang"; then
+    AX_CXX_COMPILE_STDCXX_11([noext],[optional])
+  fi
 fi
 
 # test for programs
@@ -1344,10 +1348,10 @@
 
     AC_CHECK_LIB(crypto,[CRYPTO_new_ex_data],[LIBOPENSSL_LIBS="-lcrypto $LIBOPENSSL_LIBS"],[
       AC_MSG_ERROR([library 'crypto' is required for OpenSSL])
-    ])
+    ],$LIBOPENSSL_LIBS)
     AC_CHECK_LIB(ssl,[SSL_library_init],[LIBOPENSSL_LIBS="-lssl $LIBOPENSSL_LIBS"],[
       AC_MSG_ERROR([library 'ssl' is required for OpenSSL])
-    ])
+    ],$LIBOPENSSL_LIBS)
   ])
 
   # This is a workaround for RedHat 9 brain damage..
diff -u -r -N squid-3.5.19/doc/release-notes/release-3.5.html squid-3.5.20/doc/release-notes/release-3.5.html
--- squid-3.5.19/doc/release-notes/release-3.5.html	2016-05-09 01:38:07.000000000 +1200
+++ squid-3.5.20/doc/release-notes/release-3.5.html	2016-07-02 00:30:54.000000000 +1200
@@ -1,11 +1,11 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
 <HTML>
 <HEAD>
- <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.71">
- <TITLE>Squid 3.5.19 release notes</TITLE>
+ <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.72">
+ <TITLE>Squid 3.5.20 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 3.5.19 release notes</H1>
+<H1>Squid 3.5.20 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -64,7 +64,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-3.5.19.</P>
+<P>The Squid Team are pleased to announce the release of Squid-3.5.20.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v3/3.5/">http://www.squid-cache.org/Versions/v3/3.5/</A> or the
 <A HREF="http://www.squid-cache.org/Download/http-mirrors.html">mirrors</A>.</P>
@@ -559,6 +559,7 @@
 <P>New format code <EM>%ssl::&lt;cert_subject</EM> to send SSL server certificate DN.</P>
 <P>New format code <EM>%ssl::&lt;cert_issuer</EM> to send SSL server certificate issuer DN.</P>
 <P>New format code <EM>%un</EM> to send any available user name (requires 3.5.7 or later).</P>
+<P>New format code <EM>%&gt;eui</EM> to send either EUI-48 or EUI-64 (requires 3.5.20 or later).</P>
 <P>New response kv-pair <EM>clt_conn_tag=</EM> to associates a given tag with the client TCP connection.</P>
 
 <DT><B>forward_max_tries</B><DD>
diff -u -r -N squid-3.5.19/helpers/basic_auth/DB/basic_db_auth.8 squid-3.5.20/helpers/basic_auth/DB/basic_db_auth.8
--- squid-3.5.19/helpers/basic_auth/DB/basic_db_auth.8	2016-05-09 01:38:12.000000000 +1200
+++ squid-3.5.20/helpers/basic_auth/DB/basic_db_auth.8	2016-07-02 00:30:59.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_DB_AUTH 8"
-.TH BASIC_DB_AUTH 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH BASIC_DB_AUTH 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/basic_auth/MSNT-multi-domain/basic_msnt_multi_domain_auth.8 squid-3.5.20/helpers/basic_auth/MSNT-multi-domain/basic_msnt_multi_domain_auth.8
--- squid-3.5.19/helpers/basic_auth/MSNT-multi-domain/basic_msnt_multi_domain_auth.8	2016-05-09 01:38:19.000000000 +1200
+++ squid-3.5.20/helpers/basic_auth/MSNT-multi-domain/basic_msnt_multi_domain_auth.8	2016-07-02 00:31:06.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_MSNT_MULTI_DOMAIN_AUTH 1"
-.TH BASIC_MSNT_MULTI_DOMAIN_AUTH 1 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH BASIC_MSNT_MULTI_DOMAIN_AUTH 1 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/basic_auth/POP3/basic_pop3_auth.8 squid-3.5.20/helpers/basic_auth/POP3/basic_pop3_auth.8
--- squid-3.5.19/helpers/basic_auth/POP3/basic_pop3_auth.8	2016-05-09 01:38:26.000000000 +1200
+++ squid-3.5.20/helpers/basic_auth/POP3/basic_pop3_auth.8	2016-07-02 00:31:13.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_POP3_AUTH 8"
-.TH BASIC_POP3_AUTH 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH BASIC_POP3_AUTH 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/external_acl/delayer/ext_delayer_acl.8 squid-3.5.20/helpers/external_acl/delayer/ext_delayer_acl.8
--- squid-3.5.19/helpers/external_acl/delayer/ext_delayer_acl.8	2016-05-09 01:38:45.000000000 +1200
+++ squid-3.5.20/helpers/external_acl/delayer/ext_delayer_acl.8	2016-07-02 00:31:28.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_DELAYER_ACL 8"
-.TH EXT_DELAYER_ACL 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH EXT_DELAYER_ACL 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/external_acl/SQL_session/ext_sql_session_acl.8 squid-3.5.20/helpers/external_acl/SQL_session/ext_sql_session_acl.8
--- squid-3.5.19/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2016-05-09 01:38:56.000000000 +1200
+++ squid-3.5.20/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2016-07-02 00:31:36.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_SQL_SESSION_ACL 8"
-.TH EXT_SQL_SESSION_ACL 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH EXT_SQL_SESSION_ACL 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8 squid-3.5.20/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8
--- squid-3.5.19/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2016-05-09 01:39:01.000000000 +1200
+++ squid-3.5.20/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2016-07-02 00:31:40.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_WBINFO_GROUP_ACL 8"
-.TH EXT_WBINFO_GROUP_ACL 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH EXT_WBINFO_GROUP_ACL 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/log_daemon/DB/log_db_daemon.8 squid-3.5.20/helpers/log_daemon/DB/log_db_daemon.8
--- squid-3.5.19/helpers/log_daemon/DB/log_db_daemon.8	2016-05-09 01:39:05.000000000 +1200
+++ squid-3.5.20/helpers/log_daemon/DB/log_db_daemon.8	2016-07-02 00:31:43.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "LOG_DB_DAEMON 8"
-.TH LOG_DB_DAEMON 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH LOG_DB_DAEMON 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/helpers/storeid_rewrite/file/storeid_file_rewrite.8 squid-3.5.20/helpers/storeid_rewrite/file/storeid_file_rewrite.8
--- squid-3.5.19/helpers/storeid_rewrite/file/storeid_file_rewrite.8	2016-05-09 01:39:24.000000000 +1200
+++ squid-3.5.20/helpers/storeid_rewrite/file/storeid_file_rewrite.8	2016-07-02 00:31:58.000000000 +1200
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "STOREID_FILE_REWRITE 8"
-.TH STOREID_FILE_REWRITE 8 "2016-05-08" "perl v5.22.2" "User Contributed Perl Documentation"
+.TH STOREID_FILE_REWRITE 8 "2016-07-01" "perl v5.22.2" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.5.19/include/version.h squid-3.5.20/include/version.h
--- squid-3.5.19/include/version.h	2016-05-09 00:48:31.000000000 +1200
+++ squid-3.5.20/include/version.h	2016-07-01 23:40:17.000000000 +1200
@@ -7,7 +7,7 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1462711587
+#define SQUID_RELEASE_TIME 1467373063
 #endif
 
 /*
diff -u -r -N squid-3.5.19/lib/smblib/smblib.c squid-3.5.20/lib/smblib/smblib.c
--- squid-3.5.19/lib/smblib/smblib.c	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/lib/smblib/smblib.c	2016-07-01 23:37:50.000000000 +1200
@@ -150,12 +150,12 @@
        service we are going to call, sine some servers want it in uppercase */
 
     for (i=0; i < strlen(server); i++)
-        called[i] = toupper(server[i]);
+        called[i] = xtoupper(server[i]);
 
     called[strlen(server)] = 0;    /* Make it a string */
 
     for (i=0; i < strlen(con -> myname); i++)
-        calling[i] = toupper(con -> myname[i]);
+        calling[i] = xtoupper(con -> myname[i]);
 
     calling[strlen(con -> myname)] = 0;    /* Make it a string */
 
@@ -266,12 +266,12 @@
        service we are going to call, sine some servers want it in uppercase */
 
     for (i=0; i < strlen(host); i++)
-        called[i] = toupper(host[i]);
+        called[i] = xtoupper(host[i]);
 
     called[strlen(host)] = 0;    /* Make it a string */
 
     for (i=0; i < strlen(con -> myname); i++)
-        calling[i] = toupper(con -> myname[i]);
+        calling[i] = xtoupper(con -> myname[i]);
 
     calling[strlen(con -> myname)] = 0;    /* Make it a string */
 
diff -u -r -N squid-3.5.19/RELEASENOTES.html squid-3.5.20/RELEASENOTES.html
--- squid-3.5.19/RELEASENOTES.html	2016-05-09 01:38:07.000000000 +1200
+++ squid-3.5.20/RELEASENOTES.html	2016-07-02 00:30:54.000000000 +1200
@@ -1,11 +1,11 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
 <HTML>
 <HEAD>
- <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.71">
- <TITLE>Squid 3.5.19 release notes</TITLE>
+ <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.72">
+ <TITLE>Squid 3.5.20 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 3.5.19 release notes</H1>
+<H1>Squid 3.5.20 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -64,7 +64,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-3.5.19.</P>
+<P>The Squid Team are pleased to announce the release of Squid-3.5.20.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v3/3.5/">http://www.squid-cache.org/Versions/v3/3.5/</A> or the
 <A HREF="http://www.squid-cache.org/Download/http-mirrors.html">mirrors</A>.</P>
@@ -559,6 +559,7 @@
 <P>New format code <EM>%ssl::&lt;cert_subject</EM> to send SSL server certificate DN.</P>
 <P>New format code <EM>%ssl::&lt;cert_issuer</EM> to send SSL server certificate issuer DN.</P>
 <P>New format code <EM>%un</EM> to send any available user name (requires 3.5.7 or later).</P>
+<P>New format code <EM>%&gt;eui</EM> to send either EUI-48 or EUI-64 (requires 3.5.20 or later).</P>
 <P>New response kv-pair <EM>clt_conn_tag=</EM> to associates a given tag with the client TCP connection.</P>
 
 <DT><B>forward_max_tries</B><DD>
diff -u -r -N squid-3.5.19/src/adaptation/ecap/Host.cc squid-3.5.20/src/adaptation/ecap/Host.cc
--- squid-3.5.19/src/adaptation/ecap/Host.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/adaptation/ecap/Host.cc	2016-07-01 23:37:50.000000000 +1200
@@ -147,18 +147,16 @@
 {
     const int squidLevel = SquidLogLevel(lv);
     const int squidSection = 93; // XXX: this should be a global constant
-    // XXX: Debug.h should provide this to us
-    if ((Debug::level = squidLevel) <= Debug::Levels[squidSection])
-        return &Debug::getDebugOut();
-    else
-        return NULL;
+    return Debug::Enabled(squidSection, squidLevel) ?
+           &Debug::Start(squidSection, squidLevel) :
+           NULL;
 }
 
 void
 Adaptation::Ecap::Host::closeDebug(std::ostream *debug)
 {
     if (debug)
-        Debug::finishDebug();
+        Debug::Finish();
 }
 
 Adaptation::Ecap::Host::MessagePtr
diff -u -r -N squid-3.5.19/src/adaptation/ServiceConfig.cc squid-3.5.20/src/adaptation/ServiceConfig.cc
--- squid-3.5.19/src/adaptation/ServiceConfig.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/adaptation/ServiceConfig.cc	2016-07-01 23:37:50.000000000 +1200
@@ -69,8 +69,19 @@
 {
     key = ConfigParser::NextToken();
     String method_point = ConfigParser::NextToken();
+    if (!method_point.size()) {
+        debugs(3, DBG_CRITICAL, "ERROR: " << cfg_filename << ':' << config_lineno << ": " <<
+               "Missing vectoring point in adaptation service definition");
+        return false;
+    }
+
     method = parseMethod(method_point.termedBuf());
     point = parseVectPoint(method_point.termedBuf());
+    if (method == Adaptation::methodNone && point == Adaptation::pointNone) {
+        debugs(3, DBG_CRITICAL, "ERROR: " << cfg_filename << ':' << config_lineno << ": " <<
+               "Unknown vectoring point '" << method_point << "' in adaptation service definition");
+        return false;
+    }
 
     // reset optional parameters in case we are reconfiguring
     bypass = routing = false;
@@ -105,7 +116,7 @@
 
         // Check if option is set twice
         if (options.find(name) != options.end()) {
-            debugs(3, DBG_CRITICAL, cfg_filename << ':' << config_lineno << ": " <<
+            debugs(3, DBG_CRITICAL, "ERROR: " << cfg_filename << ':' << config_lineno << ": " <<
                    "Duplicate option \"" << name << "\" in adaptation service definition");
             return false;
         }
@@ -140,7 +151,7 @@
 
     // is the service URI set?
     if (!grokkedUri) {
-        debugs(3, DBG_CRITICAL, cfg_filename << ':' << config_lineno << ": " <<
+        debugs(3, DBG_CRITICAL, "ERROR: " << cfg_filename << ':' << config_lineno << ": " <<
                "No \"uri\" option in adaptation service definition");
         return false;
     }
diff -u -r -N squid-3.5.19/src/base/Lock.h squid-3.5.20/src/base/Lock.h
--- squid-3.5.19/src/base/Lock.h	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/base/Lock.h	2016-07-01 23:37:50.000000000 +1200
@@ -33,7 +33,7 @@
     /// All locks must be cleared before it may be destroyed.
     void lock() const {
 #if defined(LOCKCOUNT_DEBUG)
-        old_debug(0,1)("Incrementing this %p from count %u\n",this,count_);
+        debugs(0,1, "Incrementing this " << static_cast<void*>(this) << " from count " << count_);
 #endif
         assert(count_ < UINT32_MAX);
         ++count_;
@@ -43,7 +43,7 @@
     /// All locks must be cleared before it may be destroyed.
     uint32_t unlock() const {
 #if defined(LOCKCOUNT_DEBUG)
-        old_debug(0,1)("Decrementing this %p from count %u\n",this,count_);
+        debugs(0,1, "Decrementing this " << static_cast<void*>(this) << " from count " << count_);
 #endif
         assert(count_ > 0);
         return --count_;
diff -u -r -N squid-3.5.19/src/client_side.cc squid-3.5.20/src/client_side.cc
--- squid-3.5.19/src/client_side.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/client_side.cc	2016-07-01 23:37:50.000000000 +1200
@@ -2351,26 +2351,24 @@
     return result;
 }
 
-bool
+/// Prepare inBuf for I/O. This method balances several conflicting desires:
+/// 1. Do not read too few bytes at a time.
+/// 2. Do not waste too much buffer space.
+/// 3. Do not [re]allocate or memmove the buffer too much.
+/// 4. Obey Config.maxRequestBufferSize limit.
+void
 ConnStateData::In::maybeMakeSpaceAvailable()
 {
-    if (buf.spaceSize() < 2) {
-        const SBuf::size_type haveCapacity = buf.length() + buf.spaceSize();
-        if (haveCapacity >= Config.maxRequestBufferSize) {
-            debugs(33, 4, "request buffer full: client_request_buffer_max_size=" << Config.maxRequestBufferSize);
-            return false;
-        }
-        if (haveCapacity == 0) {
-            // haveCapacity is based on the SBuf visible window of the MemBlob buffer, which may fill up.
-            // at which point bump the buffer back to default. This allocates a new MemBlob with any un-parsed bytes.
-            buf.reserveCapacity(CLIENT_REQ_BUF_SZ);
-        } else {
-            const SBuf::size_type wantCapacity = min(static_cast<SBuf::size_type>(Config.maxRequestBufferSize), haveCapacity*2);
-            buf.reserveCapacity(wantCapacity);
-        }
-        debugs(33, 2, "growing request buffer: available=" << buf.spaceSize() << " used=" << buf.length());
-    }
-    return (buf.spaceSize() >= 2);
+    // The hard-coded parameters are arbitrary but seem reasonable.
+    // A careful study of Squid I/O and parsing patterns is needed to tune them.
+    SBufReservationRequirements requirements;
+    requirements.minSpace = 1024; // smaller I/Os are not worth their overhead
+    requirements.idealSpace = CLIENT_REQ_BUF_SZ; // we expect few larger I/Os
+    requirements.maxCapacity = Config.maxRequestBufferSize;
+    requirements.allowShared = true; // allow because inBuf is used immediately
+    buf.reserve(requirements);
+    if (!buf.spaceSize())
+        debugs(33, 4, "request buffer full: client_request_buffer_max_size=" << Config.maxRequestBufferSize);
 }
 
 void
@@ -3778,7 +3776,7 @@
         debugs(83, 2, "clientNegotiateSSL: Session " << SSL_get_session(ssl) <<
                " reused on FD " << fd << " (" << fd_table[fd].ipaddr << ":" << (int)fd_table[fd].remote_port << ")");
     } else {
-        if (do_debug(83, 4)) {
+        if (Debug::Enabled(83, 4)) {
             /* Write out the SSL session details.. actually the call below, but
              * OpenSSL headers do strange typecasts confusing GCC.. */
             /* PEM_write_SSL_SESSION(debug_log, SSL_get_session(ssl)); */
diff -u -r -N squid-3.5.19/src/client_side.h squid-3.5.20/src/client_side.h
--- squid-3.5.19/src/client_side.h	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/client_side.h	2016-07-01 23:37:50.000000000 +1200
@@ -195,10 +195,11 @@
     // Client TCP connection details from comm layer.
     Comm::ConnectionPointer clientConnection;
 
-    struct In {
+    class In {
+    public:
         In();
         ~In();
-        bool maybeMakeSpaceAvailable();
+        void maybeMakeSpaceAvailable();
 
         ChunkedCodingParser *bodyParser; ///< parses chunked request body
         SBuf buf;
diff -u -r -N squid-3.5.19/src/comm.cc squid-3.5.20/src/comm.cc
--- squid-3.5.19/src/comm.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/comm.cc	2016-07-01 23:37:50.000000000 +1200
@@ -110,7 +110,7 @@
 
     /* prevent those nasty RST packets */
     char buf[SQUID_TCP_SO_RCVBUF];
-    if (fd_table[fd].flags.nonblocking) {
+    if (fd_table[fd].flags.nonblocking && fd_table[fd].type != FD_MSGHDR) {
         while (FD_READ_METHOD(fd, buf, SQUID_TCP_SO_RCVBUF) > 0) {};
     }
 #endif
diff -u -r -N squid-3.5.19/src/debug.cc squid-3.5.20/src/debug.cc
--- squid-3.5.19/src/debug.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/debug.cc	2016-07-01 23:37:50.000000000 +1200
@@ -22,8 +22,6 @@
 int Debug::log_stderr = -1;
 bool Debug::log_syslog = false;
 int Debug::Levels[MAX_DEBUG_SECTIONS];
-int Debug::level;
-int Debug::sectionLevel;
 char *Debug::cache_log = NULL;
 int Debug::rotateNumber = -1;
 FILE *debug_log = NULL;
@@ -134,7 +132,7 @@
 static void
 _db_print_stderr(const char *format, va_list args)
 {
-    if (Debug::log_stderr < Debug::level)
+    if (Debug::log_stderr < Debug::Level())
         return;
 
     if (debug_log == stderr)
@@ -149,7 +147,7 @@
 {
     /* level 0,1 go to syslog */
 
-    if (Debug::level > 1)
+    if (Debug::Level() > 1)
         return;
 
     if (!Debug::log_syslog)
@@ -162,7 +160,7 @@
 
     tmpbuf[BUFSIZ - 1] = '\0';
 
-    syslog(Debug::level == 0 ? LOG_WARNING : LOG_NOTICE, "%s", tmpbuf);
+    syslog(Debug::Level() == 0 ? LOG_WARNING : LOG_NOTICE, "%s", tmpbuf);
 }
 #endif /* HAVE_SYSLOG */
 
@@ -512,7 +510,7 @@
     static char buf[128];
     static time_t last_t = 0;
 
-    if (Debug::level > 1) {
+    if (Debug::Level() > 1) {
         char buf2[128];
         tm = localtime(&t);
         strftime(buf2, 127, "%Y/%m/%d %H:%M:%S", tm);
@@ -714,55 +712,75 @@
     return Ctx_Descrs[ctx] ? Ctx_Descrs[ctx] : "<null>";
 }
 
-int Debug::TheDepth = 0;
+Debug::Context *Debug::Current = NULL;
 
-Debug::OutStream *Debug::CurrentDebug(NULL);
+Debug::Context::Context(const int aSection, const int aLevel):
+    level(aLevel),
+    sectionLevel(Levels[aSection]),
+    upper(Current)
+{
+    formatStream();
+}
 
-std::ostream &
-Debug::getDebugOut()
+/// Optimization: avoids new Context creation for every debugs().
+void
+Debug::Context::rewind(const int aSection, const int aLevel)
 {
-    assert(TheDepth >= 0);
-    ++TheDepth;
-    if (TheDepth > 1) {
-        assert(CurrentDebug);
-        *CurrentDebug << std::endl << "reentrant debuging " << TheDepth << "-{";
-    } else {
-        assert(!CurrentDebug);
-        CurrentDebug = new Debug::OutStream;
-        // set default formatting flags
-        CurrentDebug->setf(std::ios::fixed);
-        CurrentDebug->precision(2);
-    }
-    return *CurrentDebug;
+    level = aLevel;
+    sectionLevel = Levels[aSection];
+    assert(upper == Current);
+
+    buf.str(std::string());
+    buf.clear();
+    // debugs() users are supposed to preserve format, but
+    // some do not, so we have to waste cycles resetting it for all.
+    formatStream();
 }
 
+/// configures default formatting for the debugging stream
 void
-Debug::finishDebug()
+Debug::Context::formatStream()
 {
-    assert(TheDepth >= 0);
-    assert(CurrentDebug);
-    if (TheDepth > 1) {
-        *CurrentDebug << "}-" << TheDepth << std::endl;
+    const static std::ostringstream cleanStream;
+    buf.flags(cleanStream.flags() | std::ios::fixed);
+    buf.width(cleanStream.width());
+    buf.precision(2);
+    buf.fill(' ');
+    // If this is not enough, use copyfmt(cleanStream) which is ~10% slower.
+}
+
+std::ostringstream &
+Debug::Start(const int section, const int level)
+{
+    Context *future = NULL;
+
+    // prepare future context
+    if (Current) {
+        // all reentrant debugs() calls get here; create a dedicated context
+        future = new Context(section, level);
     } else {
-        assert(TheDepth == 1);
-        _db_print("%s\n", CurrentDebug->str().c_str());
-        delete CurrentDebug;
-        CurrentDebug = NULL;
+        // Optimization: Nearly all debugs() calls get here; avoid allocations
+        static Context *topContext = new Context(1, 1);
+        topContext->rewind(section, level);
+        future = topContext;
     }
-    --TheDepth;
+
+    Current = future;
+
+    return future->buf;
 }
 
-// Hack: replaces global ::xassert() to debug debugging assertions
-// Relies on assert macro calling xassert() without a specific scope.
 void
-Debug::xassert(const char *msg, const char *file, int line)
+Debug::Finish()
 {
+    // TODO: Optimize to remove at least one extra copy.
+    _db_print("%s\n", Current->buf.str().c_str());
 
-    if (CurrentDebug) {
-        *CurrentDebug << "assertion failed: " << file << ":" << line <<
-                      ": \"" << msg << "\"";
-    }
-    abort();
+    Context *past = Current;
+    Current = past->upper;
+    if (Current)
+        delete past;
+    // else it was a static topContext from Debug::Start()
 }
 
 size_t
@@ -799,8 +817,8 @@
 
     // finalize debugging level if no level was set explicitly via minLevel()
     const int finalLevel = (level >= 0) ? level :
-                           (size_ > 40 ? DBG_DATA : Debug::sectionLevel);
-    if (finalLevel <= Debug::sectionLevel) {
+                           (size_ > 40 ? DBG_DATA : Debug::SectionLevel());
+    if (finalLevel <= Debug::SectionLevel()) {
         os << (label_ ? '=' : ' ');
         if (data_)
             os.write(data_, size_);
diff -u -r -N squid-3.5.19/src/Debug.h squid-3.5.20/src/Debug.h
--- squid-3.5.19/src/Debug.h	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/Debug.h	2016-07-01 23:37:50.000000000 +1200
@@ -49,38 +49,51 @@
 {
 
 public:
+    /// meta-information for debugs() or a similar debugging call
+    class Context
+    {
+    public:
+        Context(const int aSectionLevel, const int aLevel);
+
+        int level; ///< minimum debugging level required by the debugs() call
+        int sectionLevel; ///< maximum debugging level allowed during the call
+
+    private:
+        friend class Debug;
+        void rewind(const int aSection, const int aLevel);
+        void formatStream();
+        Context *upper; ///< previous or parent record in nested debugging calls
+        std::ostringstream buf; ///< debugs() output sink
+    };
+
+    /// whether debugging the given section and the given level produces output
+    static bool Enabled(const int section, const int level)
+    {
+        return level <= Debug::Levels[section];
+    }
+
     static char *debugOptions;
     static char *cache_log;
     static int rotateNumber;
     static int Levels[MAX_DEBUG_SECTIONS];
-    static int level; ///< minimum debugging level required by debugs() call
-    static int sectionLevel; ///< maximum debugging level allowed now
     static int override_X;
     static int log_stderr;
     static bool log_syslog;
 
-    static std::ostream &getDebugOut();
-    static void finishDebug();
     static void parseOptions(char const *);
 
-private:
-    // Hack: replaces global ::xassert() to debug debugging assertions
-    static void xassert(const char *msg, const char *file, int line);
+    /// minimum level required by the current debugs() call
+    static int Level() { return Current ? Current->level : 1; }
+    /// maximum level currently allowed
+    static int SectionLevel() { return Current ? Current->sectionLevel : 1; }
+
+    /// opens debugging context and returns output buffer
+    static std::ostringstream &Start(const int section, const int level);
+    /// logs output buffer created in Start() and closes debugging context
+    static void Finish();
 
-    /// Wrapper class to prevent SquidNew.h overrides getting confused
-    /// with the libc++6 std::ostringstream definitions
-    class OutStream : public std::ostringstream
-    {
-        // XXX: use MEMPROXY_CLASS() once that no longer pulls in typedefs.h and enums.h and globals.h
-    public:
-        void *operator new(size_t size) throw(std::bad_alloc) {return xmalloc(size);}
-        void operator delete(void *address) throw() {xfree(address);}
-        void *operator new[] (size_t size) throw(std::bad_alloc) ; //{return xmalloc(size);}
-        void operator delete[] (void *address) throw() ; // {xfree(address);}
-    };
-
-    static OutStream *CurrentDebug;
-    static int TheDepth; // level of nested debugging calls
+private:
+    static Context *Current; ///< deepest active context; nil outside debugs()
 };
 
 extern FILE *debug_log;
@@ -91,15 +104,15 @@
 /* Debug stream */
 #define debugs(SECTION, LEVEL, CONTENT) \
    do { \
-        if ((Debug::level = (LEVEL)) <= Debug::Levels[SECTION]) { \
-            Debug::sectionLevel = Debug::Levels[SECTION]; \
-            std::ostream &_dbo=Debug::getDebugOut(); \
-            if (Debug::level > DBG_IMPORTANT) { \
-                _dbo << (SECTION) << ',' << (LEVEL) << "| " \
+        const int _dbg_level = (LEVEL); \
+        if (Debug::Enabled((SECTION), _dbg_level)) { \
+            std::ostream &_dbo = Debug::Start((SECTION), _dbg_level); \
+            if (_dbg_level > DBG_IMPORTANT) { \
+                _dbo << (SECTION) << ',' << _dbg_level << "| " \
                      << SkipBuildPrefix(__FILE__)<<"("<<__LINE__<<") "<<__FUNCTION__<<": "; \
             } \
             _dbo << CONTENT; \
-            Debug::finishDebug(); \
+            Debug::Finish(); \
         } \
    } while (/*CONSTCOND*/ 0)
 
@@ -135,10 +148,6 @@
     return (os << (int)d);
 }
 
-/* Legacy debug style. Still used in some places. needs to die... */
-#define do_debug(SECTION, LEVEL)   ((Debug::level = (LEVEL)) <= Debug::Levels[SECTION])
-#define old_debug(SECTION, LEVEL)  if do_debug((SECTION), (LEVEL)) _db_print
-
 /* Legacy debug function definitions */
 void _db_init(const char *logfile, const char *options);
 void _db_print(const char *,...) PRINTF_FORMAT_ARG1;
diff -u -r -N squid-3.5.19/src/enums.h squid-3.5.20/src/enums.h
--- squid-3.5.19/src/enums.h	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/enums.h	2016-07-01 23:37:50.000000000 +1200
@@ -170,7 +170,6 @@
     MEM_DONTFREE,
     // following pools are initialized late by their component if needed (or never)
     MEM_FQDNCACHE_ENTRY,
-    MEM_FWD_SERVER,
     MEM_IDNS_QUERY,
     MEM_IPCACHE_ENTRY,
     MEM_MAX
diff -u -r -N squid-3.5.19/src/esi/Expression.cc squid-3.5.20/src/esi/Expression.cc
--- squid-3.5.19/src/esi/Expression.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/esi/Expression.cc	2016-07-01 23:37:50.000000000 +1200
@@ -116,8 +116,6 @@
 static int membercompare(stackmember a, stackmember b);
 static char const *trim(char const *s);
 static stackmember getsymbol(const char *s, char const **endptr);
-static void printliteral(stackmember s);
-static void printmember(stackmember s);
 
 /* -2 = failed to compate
  * -1 = a less than b
@@ -846,105 +844,106 @@
     return rv;
 }
 
-void
-printliteral(stackmember s)
+static void
+printLiteral(std::ostream &os, const stackmember &s)
 {
     switch (s.valuestored) {
 
     case ESI_LITERAL_INVALID:
-        old_debug(86, 1)( " Invalid " );
+        os << " Invalid ";
         break;
 
     case ESI_LITERAL_FLOAT:
-        old_debug(86,1)("%f", s.value.floating);
+        os << s.value.floating;
         break;
 
     case ESI_LITERAL_STRING:
-        old_debug(86,1)("'%s'", s.value.string);
+        os << '\'' << s.value.string << '\'';
         break;
 
     case ESI_LITERAL_INT:
-        old_debug(86,1)("%d", s.value.integral);
+        os << s.value.integral;
         break;
 
     case ESI_LITERAL_BOOL:
-        old_debug(86,1)("%s",s.value.integral ? "true" : "false");
+        os << (s.value.integral ? "true" : "false");
     }
 }
 
-void
-printmember(stackmember s)
+static std::ostream &
+operator <<(std::ostream &os, const stackmember &s)
 {
     switch (s.valuetype) {
 
     case ESI_EXPR_INVALID:
-        old_debug(86,1)(" Invalid ");
+        os << " Invalid ";
         break;
 
     case ESI_EXPR_LITERAL:
-        printliteral(s);
+        printLiteral(os, s);
         break;
 
     case ESI_EXPR_EXPR:
-        old_debug(86,1)("%s", s.value.integral ? "true" : "false");
+        os << (s.value.integral ? "true" : "false");
         break;
 
     case ESI_EXPR_OR:
-        old_debug(86,1)("|");
+        os << "|";
         break;
 
     case ESI_EXPR_AND:
-        old_debug(86,1)("&");
+        os << "&";
         break;
 
     case ESI_EXPR_NOT:
-        old_debug(86,1)("!");
+        os << "!";
         break;
 
     case ESI_EXPR_START:
-        old_debug(86,1)("(");
+        os << "(";
         break;
 
     case ESI_EXPR_END:
-        old_debug(86,1)(")");
+        os << ")";
         break;
 
     case ESI_EXPR_EQ:
-        old_debug(86,1)("==");
+        os << "==";
         break;
 
     case ESI_EXPR_NOTEQ:
-        old_debug(86,1)("!=");
+        os << "!=";
         break;
 
     case ESI_EXPR_LESS:
-        old_debug(86,1)("<");
+        os << "<";
         break;
 
     case ESI_EXPR_LESSEQ:
-        old_debug(86,1)("<=");
+        os << "<=";
         break;
 
     case ESI_EXPR_MORE:
-        old_debug(86,1)(">");
+        os << ">";
         break;
 
     case ESI_EXPR_MOREEQ:
-        old_debug(86,1)(">=");
+        os << ">=";
         break;
     }
+
+    return os;
 }
 
 void
 dumpstack(stackmember * stack, int depth)
 {
-    int i;
-
-    for (i = 0; i < depth; ++i)
-        printmember(stack[i]);
-
-    if (depth)
-        old_debug(86,1)("\n");
+    if (depth) {
+        std::ostringstream buf;
+        for (int i = 0; i < depth; ++i)
+            buf << stack[i];
+        debugs(86,1, buf.str());
+    }
 }
 
 int
diff -u -r -N squid-3.5.19/src/external_acl.cc squid-3.5.20/src/external_acl.cc
--- squid-3.5.19/src/external_acl.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/external_acl.cc	2016-07-01 23:37:50.000000000 +1200
@@ -356,6 +356,8 @@
         else if (strcmp(token, "%SRCPORT") == 0 || strcmp(token, "%>p") == 0)
             format->type = Format::LFT_CLIENT_PORT;
 #if USE_SQUID_EUI
+        else if (strcmp(token, "%>eui") == 0)
+            format->type = Format::LFT_CLIENT_EUI;
         else if (strcmp(token, "%SRCEUI48") == 0)
             format->type = Format::LFT_EXT_ACL_CLIENT_EUI48;
         else if (strcmp(token, "%SRCEUI64") == 0)
@@ -944,6 +946,18 @@
             break;
 
 #if USE_SQUID_EUI
+        case Format::LFT_CLIENT_EUI:
+            // TODO make the ACL checklist have a direct link to any TCP details.
+            if (request->clientConnectionManager.valid() && request->clientConnectionManager->clientConnection != NULL)
+            {
+                if (request->clientConnectionManager->clientConnection->remote.isIPv4())
+                    request->clientConnectionManager->clientConnection->remoteEui48.encode(buf, sizeof(buf));
+                else
+                    request->clientConnectionManager->clientConnection->remoteEui64.encode(buf, sizeof(buf));
+                str = buf;
+            }
+            break;
+
         case Format::LFT_EXT_ACL_CLIENT_EUI48:
             if (request->clientConnectionManager.valid() && request->clientConnectionManager->clientConnection != NULL &&
                     request->clientConnectionManager->clientConnection->remoteEui48.encode(buf, sizeof(buf)))
diff -u -r -N squid-3.5.19/src/mime.cc squid-3.5.20/src/mime.cc
--- squid-3.5.19/src/mime.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/mime.cc	2016-07-01 23:37:50.000000000 +1200
@@ -430,7 +430,7 @@
         /* read the file into the buffer and append it to store */
         int n;
         char *buf = (char *)memAllocate(MEM_4K_BUF);
-        while ((n = FD_READ_METHOD(fd, buf, sizeof(*buf))) > 0)
+        while ((n = FD_READ_METHOD(fd, buf, 4096)) > 0)
             e->append(buf, n);
 
         file_close(fd);
diff -u -r -N squid-3.5.19/src/parser/Tokenizer.cc squid-3.5.20/src/parser/Tokenizer.cc
--- squid-3.5.19/src/parser/Tokenizer.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/parser/Tokenizer.cc	2016-07-01 23:37:50.000000000 +1200
@@ -111,8 +111,9 @@
     } else if (*s == '+') {
         ++s;
     }
+
     if (s >= end) return false;
-    if (( base == 0 || base == 16) && *s == '0' && (s+1 <= end ) &&
+    if (( base == 0 || base == 16) && *s == '0' && (s+1 < end ) &&
             tolower(*(s+1)) == 'x') {
         s += 2;
         base = 16;
@@ -135,7 +136,8 @@
 
     int any = 0, c;
     int64_t acc = 0;
-    for (c = *s++; s <= end; c = *s++) {
+    do {
+        c = *s;
         if (xisdigit(c)) {
             c -= '0';
         } else if (xisalpha(c)) {
@@ -152,7 +154,7 @@
             acc *= base;
             acc += c;
         }
-    }
+    } while (++s < end);
 
     if (any == 0) // nothing was parsed
         return false;
@@ -164,6 +166,6 @@
         acc = -acc;
 
     result = acc;
-    return success(s - buf_.rawContent() - 1);
+    return success(s - buf_.rawContent());
 }
 
diff -u -r -N squid-3.5.19/src/peer_select.cc squid-3.5.20/src/peer_select.cc
--- squid-3.5.19/src/peer_select.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/peer_select.cc	2016-07-01 23:37:50.000000000 +1200
@@ -71,7 +71,7 @@
     while (servers) {
         FwdServer *next = servers->next;
         cbdataReferenceDone(servers->_peer);
-        memFree(servers, MEM_FWD_SERVER);
+        delete servers;
         servers = next;
     }
 
@@ -246,7 +246,7 @@
         // clear the used fs and continue
         psstate->servers = fs->next;
         cbdataReferenceDone(fs->_peer);
-        memFree(fs, MEM_FWD_SERVER);
+        delete fs;
         peerSelectDnsPaths(psstate);
         return;
     }
@@ -268,7 +268,7 @@
         while (fs) {
             psstate->servers = fs->next;
             cbdataReferenceDone(fs->_peer);
-            memFree(fs, MEM_FWD_SERVER);
+            delete fs;
             fs = psstate->servers;
         }
     }
@@ -377,7 +377,7 @@
 
     psstate->servers = fs->next;
     cbdataReferenceDone(fs->_peer);
-    memFree(fs, MEM_FWD_SERVER);
+    delete fs;
 
     // see if more paths can be found
     peerSelectDnsPaths(psstate);
@@ -772,7 +772,6 @@
 peerSelectInit(void)
 {
     memset(&PeerStats, '\0', sizeof(PeerStats));
-    memDataInit(MEM_FWD_SERVER, "FwdServer", sizeof(FwdServer), 0);
 }
 
 static void
@@ -934,12 +933,10 @@
 static void
 peerAddFwdServer(FwdServer ** FSVR, CachePeer * p, hier_code code)
 {
-    FwdServer *fs = (FwdServer *)memAllocate(MEM_FWD_SERVER);
     debugs(44, 5, "peerAddFwdServer: adding " <<
            (p ? p->host : "DIRECT")  << " " <<
            hier_code_str[code]  );
-    fs->_peer = cbdataReference(p);
-    fs->code = code;
+    FwdServer *fs = new FwdServer(p, code);
 
     while (*FSVR)
         FSVR = &(*FSVR)->next;
diff -u -r -N squid-3.5.19/src/PeerSelectState.h squid-3.5.20/src/PeerSelectState.h
--- squid-3.5.19/src/PeerSelectState.h	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/PeerSelectState.h	2016-07-01 23:37:50.000000000 +1200
@@ -38,11 +38,17 @@
 class FwdServer
 {
 public:
+    MEMPROXY_CLASS(FwdServer);
+    FwdServer(CachePeer *p, hier_code c) : _peer(cbdataReference(p)), code(c), next(NULL) {}
+    ~FwdServer() {cbdataReferenceDone(_peer);}
+
     CachePeer *_peer;                /* NULL --> origin server */
     hier_code code;
     FwdServer *next;
 };
 
+MEMPROXY_CLASS_INLINE(FwdServer);
+
 class ps_state
 {
 
diff -u -r -N squid-3.5.19/src/SBuf.cc squid-3.5.20/src/SBuf.cc
--- squid-3.5.19/src/SBuf.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/SBuf.cc	2016-07-01 23:37:50.000000000 +1200
@@ -162,6 +162,29 @@
     cow(minCapacity);
 }
 
+SBuf::size_type
+SBuf::reserve(const SBufReservationRequirements &req)
+{
+    debugs(24, 8, id << " was: " << off_ << '+' << len_ << '+' << spaceSize() <<
+           '=' << store_->capacity);
+
+    const bool mustRealloc = !req.allowShared && store_->LockCount() > 1;
+
+    if (!mustRealloc && spaceSize() >= req.minSpace)
+        return spaceSize(); // the caller is content with what we have
+
+    /* only reallocation can make the caller happy */
+
+    if (!mustRealloc && len_ >= req.maxCapacity)
+        return spaceSize(); // but we cannot reallocate
+
+    const size_type newSpace = std::min(req.idealSpace, maxSize - len_);
+    reserveCapacity(std::min(len_ + newSpace, req.maxCapacity));
+    debugs(24, 7, id << " now: " << off_ << '+' << len_ << '+' << spaceSize() <<
+           '=' << store_->capacity);
+    return spaceSize(); // reallocated and probably reserved enough space
+}
+
 char *
 SBuf::rawSpace(size_type minSpace)
 {
diff -u -r -N squid-3.5.19/src/SBuf.h squid-3.5.20/src/SBuf.h
--- squid-3.5.19/src/SBuf.h	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/SBuf.h	2016-07-01 23:37:50.000000000 +1200
@@ -75,6 +75,7 @@
 };
 
 class CharacterSet;
+class SBufReservationRequirements;
 
 /**
  * A String or Buffer.
@@ -424,6 +425,12 @@
      */
     void reserveCapacity(size_type minCapacity);
 
+    /** Accommodate caller's requirements regarding SBuf's storage if possible.
+     *
+     * \return spaceSize(), which may be zero
+     */
+    size_type reserve(const SBufReservationRequirements &requirements);
+
     /** slicing method
      *
      * Removes SBuf prefix and suffix, leaving a sequence of 'n'
@@ -617,6 +624,24 @@
     SBuf& lowAppend(const char * memArea, size_type areaSize);
 };
 
+/// Named SBuf::reserve() parameters. Defaults ask for and restrict nothing.
+class SBufReservationRequirements
+{
+public:
+    typedef SBuf::size_type size_type;
+
+    SBufReservationRequirements() : idealSpace(0), minSpace(0), maxCapacity(SBuf::maxSize), allowShared(true) {}
+
+    /*
+     * Parameters are listed in the reverse order of importance: Satisfaction of
+     * the lower-listed requirements may violate the higher-listed requirements.
+     */
+    size_type idealSpace; ///< if allocating anyway, provide this much space
+    size_type minSpace; ///< allocate if spaceSize() is smaller
+    size_type maxCapacity; ///< do not allocate more than this
+    bool allowShared; ///< whether sharing our storage with others is OK
+};
+
 /// ostream output operator
 inline std::ostream &
 operator <<(std::ostream& os, const SBuf& S)
diff -u -r -N squid-3.5.19/src/servers/FtpServer.cc squid-3.5.20/src/servers/FtpServer.cc
--- squid-3.5.19/src/servers/FtpServer.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/servers/FtpServer.cc	2016-07-01 23:37:50.000000000 +1200
@@ -218,12 +218,18 @@
 void
 Ftp::Server::noteMoreBodySpaceAvailable(BodyPipe::Pointer)
 {
+    if (!isOpen()) // if we are closing, nothing to do
+        return;
+
     shovelUploadData();
 }
 
 void
 Ftp::Server::noteBodyConsumerAborted(BodyPipe::Pointer ptr)
 {
+    if (!isOpen()) // if we are closing, nothing to do
+        return;
+
     ConnStateData::noteBodyConsumerAborted(ptr);
     closeDataConnection();
 }
@@ -1303,7 +1309,7 @@
     Must(header.has(HDR_FTP_ARGUMENTS));
     String &params = header.findEntry(HDR_FTP_ARGUMENTS)->value;
 
-    if (do_debug(9, 2)) {
+    if (Debug::Enabled(9, 2)) {
         MemBuf mb;
         Packer p;
         mb.init();
@@ -1712,6 +1718,9 @@
 void
 Ftp::Server::startWaitingForOrigin()
 {
+    if (!isOpen()) // if we are closing, nothing to do
+        return;
+
     debugs(33, 5, "waiting for Ftp::Client data transfer to end");
     waitingForOrigin = true;
 }
@@ -1722,6 +1731,9 @@
     Must(waitingForOrigin);
     waitingForOrigin = false;
 
+    if (!isOpen()) // if we are closing, nothing to do
+        return;
+
     // if we have already decided how to respond, respond now
     if (delayedReply != NULL) {
         HttpReply::Pointer reply = delayedReply;
diff -u -r -N squid-3.5.19/src/ssl/PeerConnector.cc squid-3.5.20/src/ssl/PeerConnector.cc
--- squid-3.5.19/src/ssl/PeerConnector.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/ssl/PeerConnector.cc	2016-07-01 23:37:50.000000000 +1200
@@ -598,7 +598,7 @@
 
     case SSL_ERROR_WANT_WRITE:
         if ((srvBio->bumpMode() == Ssl::bumpPeek || srvBio->bumpMode() == Ssl::bumpStare) && srvBio->holdWrite()) {
-            debugs(81, DBG_IMPORTANT, "hold write on SSL connection on FD " << fd);
+            debugs(81, 3, "hold write on SSL connection on FD " << fd);
             checkForPeekAndSplice();
             return;
         }
diff -u -r -N squid-3.5.19/src/ssl/support.cc squid-3.5.20/src/ssl/support.cc
--- squid-3.5.19/src/ssl/support.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/ssl/support.cc	2016-07-01 23:37:50.000000000 +1200
@@ -135,7 +135,7 @@
     }
 
     if (newkey) {
-        if (do_debug(83, 5))
+        if (Debug::Enabled(83, 5))
             PEM_write_RSAPrivateKey(debug_log, rsa, NULL, NULL, 0, NULL, NULL);
 
         debugs(83, DBG_IMPORTANT, "Generated ephemeral RSA key of length " << keylen);
diff -u -r -N squid-3.5.19/src/tests/stub_client_side.cc squid-3.5.20/src/tests/stub_client_side.cc
--- squid-3.5.19/src/tests/stub_client_side.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/tests/stub_client_side.cc	2016-07-01 23:37:50.000000000 +1200
@@ -80,7 +80,7 @@
 bool ConnStateData::serveDelayedError(ClientSocketContext *context) STUB_RETVAL(false)
 #endif
 
-bool ConnStateData::In::maybeMakeSpaceAvailable() STUB_RETVAL(false)
+void ConnStateData::In::maybeMakeSpaceAvailable() STUB
 
 void setLogUri(ClientHttpRequest * http, char const *uri, bool cleanUrl) STUB
 const char *findTrailingHTTPVersion(const char *uriAndHTTPVersion, const char *end) STUB_RETVAL(NULL)
diff -u -r -N squid-3.5.19/src/tests/stub_debug.cc squid-3.5.20/src/tests/stub_debug.cc
--- squid-3.5.19/src/tests/stub_debug.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/tests/stub_debug.cc	2016-07-01 23:37:50.000000000 +1200
@@ -17,14 +17,11 @@
 #include "Debug.h"
 
 FILE *debug_log = NULL;
-int Debug::TheDepth = 0;
 
 char *Debug::debugOptions;
 char *Debug::cache_log= NULL;
 int Debug::rotateNumber = 0;
 int Debug::Levels[MAX_DEBUG_SECTIONS];
-int Debug::level;
-int Debug::sectionLevel;
 int Debug::override_X = 0;
 int Debug::log_stderr = 1;
 bool Debug::log_syslog = false;
@@ -81,69 +78,50 @@
 static void
 _db_print_stderr(const char *format, va_list args)
 {
-    if (1 < Debug::level)
+    if (1 < Debug::Level())
         return;
 
     vfprintf(stderr, format, args);
 }
 
-Debug::OutStream *Debug::CurrentDebug(NULL);
-
-std::ostream &
-Debug::getDebugOut()
-{
-    assert(TheDepth >= 0);
-    ++TheDepth;
-    if (TheDepth > 1) {
-        assert(CurrentDebug);
-        *CurrentDebug << std::endl << "reentrant debuging " << TheDepth << "-{";
-    } else {
-        assert(!CurrentDebug);
-        CurrentDebug = new Debug::OutStream;
-        // set default formatting flags
-        CurrentDebug->setf(std::ios::fixed);
-        CurrentDebug->precision(2);
-    }
-    return *CurrentDebug;
-}
-
 void
 Debug::parseOptions(char const *)
 {
     return;
 }
 
-void
-Debug::finishDebug()
+const char*
+SkipBuildPrefix(const char* path)
 {
-    assert(TheDepth >= 0);
-    assert(CurrentDebug);
-    if (TheDepth > 1) {
-        *CurrentDebug << "}-" << TheDepth << std::endl;
-    } else {
-        assert(TheDepth == 1);
-        _db_print("%s\n", CurrentDebug->str().c_str());
-        delete CurrentDebug;
-        CurrentDebug = NULL;
-    }
-    --TheDepth;
+    return path;
 }
 
-void
-Debug::xassert(const char *msg, const char *file, int line)
+Debug::Context *Debug::Current = NULL;
+
+Debug::Context::Context(const int aSection, const int aLevel):
+    level(aLevel),
+    sectionLevel(Levels[aSection]),
+    upper(Current)
 {
+    buf.setf(std::ios::fixed);
+    buf.precision(2);
+}
 
-    if (CurrentDebug) {
-        *CurrentDebug << "assertion failed: " << file << ":" << line <<
-                      ": \"" << msg << "\"";
-    }
-    abort();
+std::ostringstream &
+Debug::Start(const int section, const int level)
+{
+    Current = new Context(section, level);
+    return Current->buf;
 }
 
-const char*
-SkipBuildPrefix(const char* path)
+void
+Debug::Finish()
 {
-    return path;
+    if (Current) {
+        _db_print("%s\n", Current->buf.str().c_str());
+        delete Current;
+        Current = NULL;
+    }
 }
 
 std::ostream &
@@ -157,10 +135,13 @@
 
     // finalize debugging level if no level was set explicitly via minLevel()
     const int finalLevel = (level >= 0) ? level :
-                           (size_ > 40 ? DBG_DATA : Debug::sectionLevel);
-    if (finalLevel <= Debug::sectionLevel) {
+                           (size_ > 40 ? DBG_DATA : Debug::SectionLevel());
+    if (finalLevel <= Debug::SectionLevel()) {
         os << (label_ ? '=' : ' ');
-        os.write(data_, size_);
+        if (data_)
+            os.write(data_, size_);
+        else
+            os << "[null]";
     }
 
     return os;
diff -u -r -N squid-3.5.19/src/tests/stub_SBuf.cc squid-3.5.20/src/tests/stub_SBuf.cc
--- squid-3.5.19/src/tests/stub_SBuf.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/tests/stub_SBuf.cc	2016-07-01 23:37:50.000000000 +1200
@@ -53,6 +53,7 @@
 void SBuf::forceSize(size_type newSize) STUB
 const char* SBuf::c_str() STUB_RETVAL("")
 void SBuf::reserveCapacity(size_type minCapacity) STUB
+SBuf::size_type SBuf::reserve(const SBufReservationRequirements &) STUB_RETVAL(0)
 SBuf& SBuf::chop(size_type pos, size_type n) STUB_RETVAL(*this)
 SBuf& SBuf::trim(const SBuf &toRemove, bool atBeginning, bool atEnd) STUB_RETVAL(*this)
 SBuf SBuf::substr(size_type pos, size_type n) const STUB_RETVAL(*this)
diff -u -r -N squid-3.5.19/src/tests/testTokenizer.cc squid-3.5.20/src/tests/testTokenizer.cc
--- squid-3.5.19/src/tests/testTokenizer.cc	2016-05-09 00:46:35.000000000 +1200
+++ squid-3.5.20/src/tests/testTokenizer.cc	2016-07-01 23:37:50.000000000 +1200
@@ -144,6 +144,7 @@
         const int64_t benchmark = 1234;
         CPPUNIT_ASSERT(t.int64(rv, 10));
         CPPUNIT_ASSERT_EQUAL(benchmark,rv);
+        CPPUNIT_ASSERT(t.buf().isEmpty());
     }
 
     // successful parse, autodetect base
@@ -153,6 +154,7 @@
         const int64_t benchmark = 1234;
         CPPUNIT_ASSERT(t.int64(rv));
         CPPUNIT_ASSERT_EQUAL(benchmark,rv);
+        CPPUNIT_ASSERT(t.buf().isEmpty());
     }
 
     // successful parse, autodetect base
@@ -162,6 +164,7 @@
         const int64_t benchmark = 01234;
         CPPUNIT_ASSERT(t.int64(rv));
         CPPUNIT_ASSERT_EQUAL(benchmark,rv);
+        CPPUNIT_ASSERT(t.buf().isEmpty());
     }
 
     // successful parse, autodetect base
@@ -171,6 +174,7 @@
         const int64_t benchmark = 0x12f4;
         CPPUNIT_ASSERT(t.int64(rv));
         CPPUNIT_ASSERT_EQUAL(benchmark,rv);
+        CPPUNIT_ASSERT(t.buf().isEmpty());
     }
 
     // API mismatch: don't eat leading space
@@ -178,6 +182,7 @@
         int64_t rv;
         Parser::Tokenizer t(SBuf(" 1234"));
         CPPUNIT_ASSERT(!t.int64(rv));
+        CPPUNIT_ASSERT_EQUAL(SBuf(" 1234"), t.buf());
     }
 
     // API mismatch: don't eat multiple leading spaces
@@ -185,6 +190,7 @@
         int64_t rv;
         Parser::Tokenizer t(SBuf("  1234"));
         CPPUNIT_ASSERT(!t.int64(rv));
+        CPPUNIT_ASSERT_EQUAL(SBuf("  1234"), t.buf());
     }
 
     // trailing spaces
@@ -222,6 +228,7 @@
         int64_t rv;
         Parser::Tokenizer t(SBuf("1029397752385698678762234"));
         CPPUNIT_ASSERT(!t.int64(rv));
+        CPPUNIT_ASSERT_EQUAL(SBuf("1029397752385698678762234"), t.buf());
     }
 
     // buffered sub-string parsing
@@ -233,6 +240,7 @@
         CPPUNIT_ASSERT_EQUAL(SBuf("22"),t.buf());
         CPPUNIT_ASSERT(t.int64(rv));
         CPPUNIT_ASSERT_EQUAL(benchmark,rv);
+        CPPUNIT_ASSERT(t.buf().isEmpty());
     }
 
     // base-16, prefix
diff -u -r -N squid-3.5.19/test-suite/stub_debug.cc squid-3.5.20/test-suite/stub_debug.cc
--- squid-3.5.19/test-suite/stub_debug.cc	2016-05-09 01:41:08.000000000 +1200
+++ squid-3.5.20/test-suite/stub_debug.cc	2016-07-02 00:33:19.000000000 +1200
@@ -17,14 +17,11 @@
 #include "Debug.h"
 
 FILE *debug_log = NULL;
-int Debug::TheDepth = 0;
 
 char *Debug::debugOptions;
 char *Debug::cache_log= NULL;
 int Debug::rotateNumber = 0;
 int Debug::Levels[MAX_DEBUG_SECTIONS];
-int Debug::level;
-int Debug::sectionLevel;
 int Debug::override_X = 0;
 int Debug::log_stderr = 1;
 bool Debug::log_syslog = false;
@@ -81,69 +78,50 @@
 static void
 _db_print_stderr(const char *format, va_list args)
 {
-    if (1 < Debug::level)
+    if (1 < Debug::Level())
         return;
 
     vfprintf(stderr, format, args);
 }
 
-Debug::OutStream *Debug::CurrentDebug(NULL);
-
-std::ostream &
-Debug::getDebugOut()
-{
-    assert(TheDepth >= 0);
-    ++TheDepth;
-    if (TheDepth > 1) {
-        assert(CurrentDebug);
-        *CurrentDebug << std::endl << "reentrant debuging " << TheDepth << "-{";
-    } else {
-        assert(!CurrentDebug);
-        CurrentDebug = new Debug::OutStream;
-        // set default formatting flags
-        CurrentDebug->setf(std::ios::fixed);
-        CurrentDebug->precision(2);
-    }
-    return *CurrentDebug;
-}
-
 void
 Debug::parseOptions(char const *)
 {
     return;
 }
 
-void
-Debug::finishDebug()
+const char*
+SkipBuildPrefix(const char* path)
 {
-    assert(TheDepth >= 0);
-    assert(CurrentDebug);
-    if (TheDepth > 1) {
-        *CurrentDebug << "}-" << TheDepth << std::endl;
-    } else {
-        assert(TheDepth == 1);
-        _db_print("%s\n", CurrentDebug->str().c_str());
-        delete CurrentDebug;
-        CurrentDebug = NULL;
-    }
-    --TheDepth;
+    return path;
 }
 
-void
-Debug::xassert(const char *msg, const char *file, int line)
+Debug::Context *Debug::Current = NULL;
+
+Debug::Context::Context(const int aSection, const int aLevel):
+    level(aLevel),
+    sectionLevel(Levels[aSection]),
+    upper(Current)
 {
+    buf.setf(std::ios::fixed);
+    buf.precision(2);
+}
 
-    if (CurrentDebug) {
-        *CurrentDebug << "assertion failed: " << file << ":" << line <<
-                      ": \"" << msg << "\"";
-    }
-    abort();
+std::ostringstream &
+Debug::Start(const int section, const int level)
+{
+    Current = new Context(section, level);
+    return Current->buf;
 }
 
-const char*
-SkipBuildPrefix(const char* path)
+void
+Debug::Finish()
 {
-    return path;
+    if (Current) {
+        _db_print("%s\n", Current->buf.str().c_str());
+        delete Current;
+        Current = NULL;
+    }
 }
 
 std::ostream &
@@ -157,10 +135,13 @@
 
     // finalize debugging level if no level was set explicitly via minLevel()
     const int finalLevel = (level >= 0) ? level :
-                           (size_ > 40 ? DBG_DATA : Debug::sectionLevel);
-    if (finalLevel <= Debug::sectionLevel) {
+                           (size_ > 40 ? DBG_DATA : Debug::SectionLevel());
+    if (finalLevel <= Debug::SectionLevel()) {
         os << (label_ ? '=' : ' ');
-        os.write(data_, size_);
+        if (data_)
+            os.write(data_, size_);
+        else
+            os << "[null]";
     }
 
     return os;
diff -u -r -N squid-3.5.19/test-suite/stub_SBuf.cc squid-3.5.20/test-suite/stub_SBuf.cc
--- squid-3.5.19/test-suite/stub_SBuf.cc	2016-05-09 01:41:08.000000000 +1200
+++ squid-3.5.20/test-suite/stub_SBuf.cc	2016-07-02 00:33:19.000000000 +1200
@@ -53,6 +53,7 @@
 void SBuf::forceSize(size_type newSize) STUB
 const char* SBuf::c_str() STUB_RETVAL("")
 void SBuf::reserveCapacity(size_type minCapacity) STUB
+SBuf::size_type SBuf::reserve(const SBufReservationRequirements &) STUB_RETVAL(0)
 SBuf& SBuf::chop(size_type pos, size_type n) STUB_RETVAL(*this)
 SBuf& SBuf::trim(const SBuf &toRemove, bool atBeginning, bool atEnd) STUB_RETVAL(*this)
 SBuf SBuf::substr(size_type pos, size_type n) const STUB_RETVAL(*this)
diff -u -r -N squid-3.5.19/tools/squidclient/stub_debug.cc squid-3.5.20/tools/squidclient/stub_debug.cc
--- squid-3.5.19/tools/squidclient/stub_debug.cc	2016-05-09 01:41:15.000000000 +1200
+++ squid-3.5.20/tools/squidclient/stub_debug.cc	2016-07-02 00:33:25.000000000 +1200
@@ -17,14 +17,11 @@
 #include "Debug.h"
 
 FILE *debug_log = NULL;
-int Debug::TheDepth = 0;
 
 char *Debug::debugOptions;
 char *Debug::cache_log= NULL;
 int Debug::rotateNumber = 0;
 int Debug::Levels[MAX_DEBUG_SECTIONS];
-int Debug::level;
-int Debug::sectionLevel;
 int Debug::override_X = 0;
 int Debug::log_stderr = 1;
 bool Debug::log_syslog = false;
@@ -81,69 +78,50 @@
 static void
 _db_print_stderr(const char *format, va_list args)
 {
-    if (1 < Debug::level)
+    if (1 < Debug::Level())
         return;
 
     vfprintf(stderr, format, args);
 }
 
-Debug::OutStream *Debug::CurrentDebug(NULL);
-
-std::ostream &
-Debug::getDebugOut()
-{
-    assert(TheDepth >= 0);
-    ++TheDepth;
-    if (TheDepth > 1) {
-        assert(CurrentDebug);
-        *CurrentDebug << std::endl << "reentrant debuging " << TheDepth << "-{";
-    } else {
-        assert(!CurrentDebug);
-        CurrentDebug = new Debug::OutStream;
-        // set default formatting flags
-        CurrentDebug->setf(std::ios::fixed);
-        CurrentDebug->precision(2);
-    }
-    return *CurrentDebug;
-}
-
 void
 Debug::parseOptions(char const *)
 {
     return;
 }
 
-void
-Debug::finishDebug()
+const char*
+SkipBuildPrefix(const char* path)
 {
-    assert(TheDepth >= 0);
-    assert(CurrentDebug);
-    if (TheDepth > 1) {
-        *CurrentDebug << "}-" << TheDepth << std::endl;
-    } else {
-        assert(TheDepth == 1);
-        _db_print("%s\n", CurrentDebug->str().c_str());
-        delete CurrentDebug;
-        CurrentDebug = NULL;
-    }
-    --TheDepth;
+    return path;
 }
 
-void
-Debug::xassert(const char *msg, const char *file, int line)
+Debug::Context *Debug::Current = NULL;
+
+Debug::Context::Context(const int aSection, const int aLevel):
+    level(aLevel),
+    sectionLevel(Levels[aSection]),
+    upper(Current)
 {
+    buf.setf(std::ios::fixed);
+    buf.precision(2);
+}
 
-    if (CurrentDebug) {
-        *CurrentDebug << "assertion failed: " << file << ":" << line <<
-                      ": \"" << msg << "\"";
-    }
-    abort();
+std::ostringstream &
+Debug::Start(const int section, const int level)
+{
+    Current = new Context(section, level);
+    return Current->buf;
 }
 
-const char*
-SkipBuildPrefix(const char* path)
+void
+Debug::Finish()
 {
-    return path;
+    if (Current) {
+        _db_print("%s\n", Current->buf.str().c_str());
+        delete Current;
+        Current = NULL;
+    }
 }
 
 std::ostream &
@@ -157,10 +135,13 @@
 
     // finalize debugging level if no level was set explicitly via minLevel()
     const int finalLevel = (level >= 0) ? level :
-                           (size_ > 40 ? DBG_DATA : Debug::sectionLevel);
-    if (finalLevel <= Debug::sectionLevel) {
+                           (size_ > 40 ? DBG_DATA : Debug::SectionLevel());
+    if (finalLevel <= Debug::SectionLevel()) {
         os << (label_ ? '=' : ' ');
-        os.write(data_, size_);
+        if (data_)
+            os.write(data_, size_);
+        else
+            os << "[null]";
     }
 
     return os;
diff -u -r -N squid-3.5.19/tools/stub_debug.cc squid-3.5.20/tools/stub_debug.cc
--- squid-3.5.19/tools/stub_debug.cc	2016-05-09 01:41:11.000000000 +1200
+++ squid-3.5.20/tools/stub_debug.cc	2016-07-02 00:33:21.000000000 +1200
@@ -17,14 +17,11 @@
 #include "Debug.h"
 
 FILE *debug_log = NULL;
-int Debug::TheDepth = 0;
 
 char *Debug::debugOptions;
 char *Debug::cache_log= NULL;
 int Debug::rotateNumber = 0;
 int Debug::Levels[MAX_DEBUG_SECTIONS];
-int Debug::level;
-int Debug::sectionLevel;
 int Debug::override_X = 0;
 int Debug::log_stderr = 1;
 bool Debug::log_syslog = false;
@@ -81,69 +78,50 @@
 static void
 _db_print_stderr(const char *format, va_list args)
 {
-    if (1 < Debug::level)
+    if (1 < Debug::Level())
         return;
 
     vfprintf(stderr, format, args);
 }
 
-Debug::OutStream *Debug::CurrentDebug(NULL);
-
-std::ostream &
-Debug::getDebugOut()
-{
-    assert(TheDepth >= 0);
-    ++TheDepth;
-    if (TheDepth > 1) {
-        assert(CurrentDebug);
-        *CurrentDebug << std::endl << "reentrant debuging " << TheDepth << "-{";
-    } else {
-        assert(!CurrentDebug);
-        CurrentDebug = new Debug::OutStream;
-        // set default formatting flags
-        CurrentDebug->setf(std::ios::fixed);
-        CurrentDebug->precision(2);
-    }
-    return *CurrentDebug;
-}
-
 void
 Debug::parseOptions(char const *)
 {
     return;
 }
 
-void
-Debug::finishDebug()
+const char*
+SkipBuildPrefix(const char* path)
 {
-    assert(TheDepth >= 0);
-    assert(CurrentDebug);
-    if (TheDepth > 1) {
-        *CurrentDebug << "}-" << TheDepth << std::endl;
-    } else {
-        assert(TheDepth == 1);
-        _db_print("%s\n", CurrentDebug->str().c_str());
-        delete CurrentDebug;
-        CurrentDebug = NULL;
-    }
-    --TheDepth;
+    return path;
 }
 
-void
-Debug::xassert(const char *msg, const char *file, int line)
+Debug::Context *Debug::Current = NULL;
+
+Debug::Context::Context(const int aSection, const int aLevel):
+    level(aLevel),
+    sectionLevel(Levels[aSection]),
+    upper(Current)
 {
+    buf.setf(std::ios::fixed);
+    buf.precision(2);
+}
 
-    if (CurrentDebug) {
-        *CurrentDebug << "assertion failed: " << file << ":" << line <<
-                      ": \"" << msg << "\"";
-    }
-    abort();
+std::ostringstream &
+Debug::Start(const int section, const int level)
+{
+    Current = new Context(section, level);
+    return Current->buf;
 }
 
-const char*
-SkipBuildPrefix(const char* path)
+void
+Debug::Finish()
 {
-    return path;
+    if (Current) {
+        _db_print("%s\n", Current->buf.str().c_str());
+        delete Current;
+        Current = NULL;
+    }
 }
 
 std::ostream &
@@ -157,10 +135,13 @@
 
     // finalize debugging level if no level was set explicitly via minLevel()
     const int finalLevel = (level >= 0) ? level :
-                           (size_ > 40 ? DBG_DATA : Debug::sectionLevel);
-    if (finalLevel <= Debug::sectionLevel) {
+                           (size_ > 40 ? DBG_DATA : Debug::SectionLevel());
+    if (finalLevel <= Debug::SectionLevel()) {
         os << (label_ ? '=' : ' ');
-        os.write(data_, size_);
+        if (data_)
+            os.write(data_, size_);
+        else
+            os << "[null]";
     }
 
     return os;
