diff -u -r -N squid-3.4.10/acinclude/compiler-flags.m4 squid-3.4.11/acinclude/compiler-flags.m4
--- squid-3.4.10/acinclude/compiler-flags.m4	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/acinclude/compiler-flags.m4	2015-01-13 03:53:17.000000000 -0800
@@ -63,15 +63,14 @@
     SAVED_FLAGS="$CFLAGS"
     SAVED_CXXFLAGS="$CXXFLAGS"
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM($3,$4)],[$1=no],[],[$1=no])
-    if test "$1" != "no" ; then
-      CFLAGS="$CXXFLAGS $2"
+    if test "x$1" != "xno" ; then
+      CFLAGS="$CFLAGS $2"
       CXXFLAGS="$CXXFLAGS $2"
       AC_COMPILE_IFELSE([AC_LANG_PROGRAM($3,$4)],[$1=yes],[$1=no],[$1=no])
     fi
     CFLAGS="$SAVED_CFLAGS"
     CXXFLAGS="$SAVED_CXXFLAGS"
   }])
-  AC_MSG_RESULT([$1])
 ])
 
 # detect what kind of compiler we're using, either by using hints from
diff -u -r -N squid-3.4.10/acinclude/os-deps.m4 squid-3.4.11/acinclude/os-deps.m4
--- squid-3.4.10/acinclude/os-deps.m4	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/acinclude/os-deps.m4	2015-01-13 03:53:17.000000000 -0800
@@ -902,3 +902,86 @@
   AC_DEFINE_UNQUOTED(RECV_ARG_TYPE,$squid_cv_recv_second_arg_type,
     [Base type of the second argument to recv(2)])
 ])
+
+
+dnl check whether Solaris has broken IPFilter headers (Solaris 10 at least does)
+AC_DEFUN([SQUID_CHECK_BROKEN_SOLARIS_IPFILTER],[
+  if test "x$squid_cv_broken_ipfilter_minor_t" = "x"; then
+    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#     include <sys/types.h>
+#     include <sys/ioccom.h>
+#     include <netinet/in.h>
+
+#     include <netinet/ip_compat.h>
+#     include <netinet/ip_fil.h>
+#     include <netinet/ip_nat.h>
+    ]])],[
+      AC_MSG_RESULT(no)
+      squid_cv_broken_ipfilter_minor_t=0
+    ],[
+      ## on fail, test the hack
+      AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#define minor_t fubaar
+#       include <sys/types.h>
+#       include <sys/ioccom.h>
+#       include <netinet/in.h>
+#undef minor_t
+#       include <netinet/ip_compat.h>
+#       include <netinet/ip_fil.h>
+#       include <netinet/ip_nat.h>
+      ]])],[
+        AC_MSG_RESULT(yes)
+        squid_cv_broken_ipfilter_minor_t=1
+      ],[
+        AC_MSG_RESULT(unable to make IPFilter work with netinet/ headers)
+      ])
+    ])
+  fi
+
+  AC_DEFINE_UNQUOTED(USE_SOLARIS_IPFILTER_MINOR_T_HACK,$squid_cv_broken_ipfilter_minor_t,
+    [Workaround IPFilter minor_t breakage])
+
+## check for IPFilter headers that require this hack
+## (but first netinet/in.h and sys/ioccom.h which they depend on)
+  AC_CHECK_HEADERS( \
+	netinet/in.h \
+	sys/ioccom.h \
+	ip_compat.h \
+	ip_fil_compat.h \
+	ip_fil.h \
+	ip_nat.h \
+	netinet/ip_compat.h \
+	netinet/ip_fil_compat.h \
+	netinet/ip_fil.h \
+	netinet/ip_nat.h \
+  ,,,[
+#if USE_SOLARIS_IPFILTER_MINOR_T_HACK
+#define minor_t fubar
+#endif
+#if HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#if HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#if HAVE_SYS_IOCCOM_H
+#include <sys/ioccom.h>
+#endif
+#if USE_SOLARIS_IPFILTER_MINOR_T_HACK
+#undef minor_t
+#endif
+#if HAVE_IP_COMPAT_H
+#include <ip_compat.h>
+#elif HAVE_NETINET_IP_COMPAT_H
+#include <netinet/ip_compat.h>
+#endif
+#if HAVE_IP_FIL_H
+#include <ip_fil.h>
+#elif HAVE_NETINET_IP_FIL_H
+#include <netinet/ip_fil.h>
+#endif
+#if !defined(IPFILTER_VERSION)
+#define IPFILTER_VERSION        5000004
+#endif
+  ])
+])
diff -u -r -N squid-3.4.10/ChangeLog squid-3.4.11/ChangeLog
--- squid-3.4.10/ChangeLog	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/ChangeLog	2015-01-13 03:53:17.000000000 -0800
@@ -1,3 +1,14 @@
+Changes to squid-3.4.11 (13 Jan 2015):
+
+	- Bug 4164: SEGFAULT when %W formating code used in errorpages
+	- Bug 4057: Avoid on-exit crashes when adaptation is enabled.
+	- Bug 3760: squidclient ignores --disable-ipv6
+	- Bug 3754: configure doesnt detect IPFilter 5.1.2 system headers
+	- Bug 3664: ssl_crtd fails to build on OpenSolaris/OpenIndiana/Solaris 11
+	- cachemgr.cgi: memory leak in request parser
+	- Deleting first fs left psstate->servers pointing to uninitialized memory
+	- ... and some build issues
+
 Changes to squid-3.4.10 (09 Dec 2014):
 
 	- Bug 4148: external_acl_type header format does not accept the new libformat syntax
diff -u -r -N squid-3.4.10/compat/compat.h squid-3.4.11/compat/compat.h
--- squid-3.4.10/compat/compat.h	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/compat/compat.h	2015-01-13 03:53:17.000000000 -0800
@@ -34,6 +34,17 @@
 #endif
 #endif
 
+/* Solaris 10 has a broken definition for minor_t in IPFilter compat.
+ * We must pre-define before doing anything with OS headers so the OS
+ * do not. Then un-define it before using the IPFilter *_compat.h headers.
+ */
+#if IPF_TRANSPARENT && USE_SOLARIS_IPFILTER_MINOR_T_HACK
+/* But we only need do this nasty thing for src/ip/Intercept.cc */
+#if BUILDING_SQUID_IP_INTERCEPT_CC
+#define minor_t solaris_minor_t_fubar
+#endif
+#endif
+
 /*****************************************************/
 /* FDSETSIZE is messy and needs to be done before    */
 /* sys/types.h are defined.                          */
diff -u -r -N squid-3.4.10/compat/Makefile.in squid-3.4.11/compat/Makefile.in
--- squid-3.4.10/compat/Makefile.in	2014-12-09 08:28:06.000000000 -0800
+++ squid-3.4.11/compat/Makefile.in	2015-01-13 03:54:03.000000000 -0800
@@ -83,9 +83,9 @@
 build_triplet = @build@
 host_triplet = @host@
 DIST_COMMON = $(top_srcdir)/src/Common.am $(srcdir)/Makefile.in \
-	$(srcdir)/Makefile.am inet_pton.c strerror.c getnameinfo.c \
-	inet_ntop.c strtoll.c initgroups.c tempnam.c drand48.c \
-	getaddrinfo.c psignal.c $(top_srcdir)/cfgaux/depcomp \
+	$(srcdir)/Makefile.am initgroups.c inet_pton.c drand48.c \
+	inet_ntop.c getnameinfo.c psignal.c strtoll.c tempnam.c \
+	strerror.c getaddrinfo.c $(top_srcdir)/cfgaux/depcomp \
 	$(top_srcdir)/cfgaux/test-driver
 check_PROGRAMS = testPreCompiler$(EXEEXT)
 TESTS = testPreCompiler$(EXEEXT) testHeaders
diff -u -r -N squid-3.4.10/configure squid-3.4.11/configure
--- squid-3.4.10/configure	2014-12-09 08:28:58.000000000 -0800
+++ squid-3.4.11/configure	2015-01-13 03:54:50.000000000 -0800
@@ -1,7 +1,7 @@
 #! /bin/sh
 # From configure.ac Revision.
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for Squid Web Proxy 3.4.10.
+# Generated by GNU Autoconf 2.69 for Squid Web Proxy 3.4.11.
 #
 # Report bugs to <http://bugs.squid-cache.org/>.
 #
@@ -595,8 +595,8 @@
 # Identity of this package.
 PACKAGE_NAME='Squid Web Proxy'
 PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='3.4.10'
-PACKAGE_STRING='Squid Web Proxy 3.4.10'
+PACKAGE_VERSION='3.4.11'
+PACKAGE_STRING='Squid Web Proxy 3.4.11'
 PACKAGE_BUGREPORT='http://bugs.squid-cache.org/'
 PACKAGE_URL=''
 
@@ -1605,7 +1605,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures Squid Web Proxy 3.4.10 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 3.4.11 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1675,7 +1675,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of Squid Web Proxy 3.4.10:";;
+     short | recursive ) echo "Configuration of Squid Web Proxy 3.4.11:";;
    esac
   cat <<\_ACEOF
 
@@ -2071,7 +2071,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-Squid Web Proxy configure 3.4.10
+Squid Web Proxy configure 3.4.11
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -3175,7 +3175,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by Squid Web Proxy $as_me 3.4.10, which was
+It was created by Squid Web Proxy $as_me 3.4.11, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4042,7 +4042,7 @@
 
 # Define the identity of the package.
  PACKAGE='squid'
- VERSION='3.4.10'
+ VERSION='3.4.11'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -4461,6 +4461,9 @@
 
 
 
+
+
+
 # pkg.m4 - Macros to locate and utilise pkg-config.            -*- Autoconf -*-
 # serial 1 (pkg-config-0.24)
 #
@@ -27258,10 +27261,6 @@
   iostream \
   fstream \
   climits \
-  ip_compat.h \
-  ip_fil_compat.h \
-  ip_fil.h \
-  ip_nat.h \
   ipl.h \
   lber.h \
   ldap.h \
@@ -27279,7 +27278,6 @@
   netdb.h \
   netinet/in.h \
   netinet/in_systm.h \
-  netinet/ip_fil_compat.h \
   openssl/err.h \
   openssl/md5.h \
   openssl/opensslv.h \
@@ -27419,12 +27417,8 @@
   netinet/in.h \
   netinet/ip.h \
   netinet/ip6.h \
-  netinet/ip_compat.h\
-  netinet/ip_fil_compat.h\
-  netinet/ip_fil.h\
   netinet/ip_icmp.h \
   netinet/ipl.h \
-  netinet/ip_nat.h\
   net/pf/pfvar.h \
   net/pfvar.h \
   sys/mount.h\
@@ -31414,8 +31408,8 @@
   ac_cv_require_rtti=no
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-    if test "ac_cv_require_rtti" != "no" ; then
-      CFLAGS="$CXXFLAGS -rtti"
+    if test "xac_cv_require_rtti" != "xno" ; then
+      CFLAGS="$CFLAGS -rtti"
       CXXFLAGS="$CXXFLAGS -rtti"
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -31456,8 +31450,6 @@
 fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_require_rtti" >&5
 $as_echo "$ac_cv_require_rtti" >&6; }
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: ac_cv_require_rtti" >&5
-$as_echo "ac_cv_require_rtti" >&6; }
 
     if test "$ac_cv_require_rtti" = "yes"; then
       SQUID_CFLAGS="-rtti $SQUID_CFLAGS"
@@ -31495,8 +31487,8 @@
   ac_cv_require_qcpluscmt=no
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-    if test "ac_cv_require_qcpluscmt" != "no" ; then
-      CFLAGS="$CXXFLAGS -qcpluscmt"
+    if test "xac_cv_require_qcpluscmt" != "xno" ; then
+      CFLAGS="$CFLAGS -qcpluscmt"
       CXXFLAGS="$CXXFLAGS -qcpluscmt"
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -31522,8 +31514,6 @@
 fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_require_qcpluscmt" >&5
 $as_echo "$ac_cv_require_qcpluscmt" >&6; }
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: ac_cv_require_qcpluscmt" >&5
-$as_echo "ac_cv_require_qcpluscmt" >&6; }
 
     ac_ext=cpp
 ac_cpp='$CXXCPP $CPPFLAGS'
@@ -32220,8 +32210,138 @@
 fi
 
 
-
 if test "x$enable_ipf_transparent" != "xno" ; then
+
+  if test "x$squid_cv_broken_ipfilter_minor_t" = "x"; then
+    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#     include <sys/types.h>
+#     include <sys/ioccom.h>
+#     include <netinet/in.h>
+
+#     include <netinet/ip_compat.h>
+#     include <netinet/ip_fil.h>
+#     include <netinet/ip_nat.h>
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_cxx_try_compile "$LINENO"; then :
+
+      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+      squid_cv_broken_ipfilter_minor_t=0
+
+else
+
+      ## on fail, test the hack
+      cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#define minor_t fubaar
+#       include <sys/types.h>
+#       include <sys/ioccom.h>
+#       include <netinet/in.h>
+#undef minor_t
+#       include <netinet/ip_compat.h>
+#       include <netinet/ip_fil.h>
+#       include <netinet/ip_nat.h>
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_cxx_try_compile "$LINENO"; then :
+
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+        squid_cv_broken_ipfilter_minor_t=1
+
+else
+
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: unable to make IPFilter work with netinet/ headers" >&5
+$as_echo "unable to make IPFilter work with netinet/ headers" >&6; }
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  fi
+
+
+cat >>confdefs.h <<_ACEOF
+#define USE_SOLARIS_IPFILTER_MINOR_T_HACK $squid_cv_broken_ipfilter_minor_t
+_ACEOF
+
+
+## check for IPFilter headers that require this hack
+## (but first netinet/in.h and sys/ioccom.h which they depend on)
+  for ac_header in \
+	netinet/in.h \
+	sys/ioccom.h \
+	ip_compat.h \
+	ip_fil_compat.h \
+	ip_fil.h \
+	ip_nat.h \
+	netinet/ip_compat.h \
+	netinet/ip_fil_compat.h \
+	netinet/ip_fil.h \
+	netinet/ip_nat.h \
+
+do :
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_cxx_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "
+#if USE_SOLARIS_IPFILTER_MINOR_T_HACK
+#define minor_t fubar
+#endif
+#if HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#if HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+#if HAVE_SYS_IOCCOM_H
+#include <sys/ioccom.h>
+#endif
+#if USE_SOLARIS_IPFILTER_MINOR_T_HACK
+#undef minor_t
+#endif
+#if HAVE_IP_COMPAT_H
+#include <ip_compat.h>
+#elif HAVE_NETINET_IP_COMPAT_H
+#include <netinet/ip_compat.h>
+#endif
+#if HAVE_IP_FIL_H
+#include <ip_fil.h>
+#elif HAVE_NETINET_IP_FIL_H
+#include <netinet/ip_fil.h>
+#endif
+#if !defined(IPFILTER_VERSION)
+#define IPFILTER_VERSION        5000004
+#endif
+
+"
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking for availability of IP-Filter header files" >&5
 $as_echo_n "checking for availability of IP-Filter header files... " >&6; }
     # hold on to your hats...
@@ -32230,8 +32350,8 @@
         "x$ac_cv_header_netinet_ip_compat_h" = "xyes" -o \
         "x$ac_cv_header_netinet_ip_fil_compat_h" = "xyes" ; then
         have_ipfilter_compat_header="yes"
-     fi
-     if test "x$have_ipfilter_compat_header" = "xyes" -a \
+    fi
+    if test "x$have_ipfilter_compat_header" = "xyes" -a \
        "x$ac_cv_header_ip_fil_h" = "xyes" -a \
        "x$ac_cv_header_ip_nat_h" = "xyes" ; then
         enable_ipf_transparent="yes"
@@ -32244,6 +32364,15 @@
     fi
     { $as_echo "$as_me:${as_lineno-$LINENO}: result: $IPF_TRANSPARENT" >&5
 $as_echo "$IPF_TRANSPARENT" >&6; }
+
+## On Solaris Ipfilter includes expect that SOLARIS2 is defined with the
+## Solaris minor version (8, 9, 10, ...)
+  if test "x$enable_ipf_transparent" = "xyes" -a "x$squid_host_os" = "xsolaris" ; then
+    solrev=`uname -r | sh -c 'IFS=. read j n x; echo $n'`
+    CFLAGS="-DSOLARIS2=$solrev $CFLAGS"
+    CXXFLAGS="-DSOLARIS2=$solrev $CXXFLAGS"
+  fi
+
 fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: IPF-based transparent proxying enabled: $enable_ipf_transparent" >&5
 $as_echo "$as_me: IPF-based transparent proxying enabled: $enable_ipf_transparent" >&6;}
@@ -32262,12 +32391,6 @@
 unset squid_tmp_define
 
 
-if test "x$enable_ipf_transparent" = "xyes" -a "x$squid_host_os" = "xsolaris" ; then
-  solrev=`uname -r | sh -c 'IFS=. read j n x; echo $n'`
-  CFLAGS="-DSOLARIS2=$solrev $CFLAGS"
-  CXXFLAGS="-DSOLARIS2=$solrev $CXXFLAGS"
-fi
-
 if test "x$with_nat_devpf" != "xno" ; then
   if test "x$ac_cv_header_net_pfvar_h" = "xyes" -o \
     "x$ac_cv_header_net_pf_pfvar_h" = "xyes"; then
@@ -34255,7 +34378,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by Squid Web Proxy $as_me 3.4.10, which was
+This file was extended by Squid Web Proxy $as_me 3.4.11, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -34321,7 +34444,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-Squid Web Proxy config.status 3.4.10
+Squid Web Proxy config.status 3.4.11
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff -u -r -N squid-3.4.10/configure.ac squid-3.4.11/configure.ac
--- squid-3.4.10/configure.ac	2014-12-09 08:28:58.000000000 -0800
+++ squid-3.4.11/configure.ac	2015-01-13 03:54:50.000000000 -0800
@@ -1,4 +1,4 @@
-AC_INIT([Squid Web Proxy],[3.4.10],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[3.4.11],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
@@ -2239,10 +2239,6 @@
   iostream \
   fstream \
   climits \
-  ip_compat.h \
-  ip_fil_compat.h \
-  ip_fil.h \
-  ip_nat.h \
   ipl.h \
   lber.h \
   ldap.h \
@@ -2260,7 +2256,6 @@
   netdb.h \
   netinet/in.h \
   netinet/in_systm.h \
-  netinet/ip_fil_compat.h \
   openssl/err.h \
   openssl/md5.h \
   openssl/opensslv.h \
@@ -2348,12 +2343,8 @@
   netinet/in.h \
   netinet/ip.h \
   netinet/ip6.h \
-  netinet/ip_compat.h\
-  netinet/ip_fil_compat.h\
-  netinet/ip_fil.h\
   netinet/ip_icmp.h \
   netinet/ipl.h \
-  netinet/ip_nat.h\
   net/pf/pfvar.h \
   net/pfvar.h \
   sys/mount.h\
@@ -3238,10 +3229,10 @@
 SQUID_CHECK_FUNC_VACOPY
 SQUID_CHECK_FUNC___VACOPY
 
-  
 dnl IP-Filter support requires ipf header files. These aren't
 dnl installed by default, so we need to check for them
 if test "x$enable_ipf_transparent" != "xno" ; then
+    SQUID_CHECK_BROKEN_SOLARIS_IPFILTER
     AC_MSG_CHECKING(for availability of IP-Filter header files)
     # hold on to your hats...
     if test "x$ac_cv_header_ip_compat_h" = "xyes" -o \
@@ -3249,8 +3240,8 @@
         "x$ac_cv_header_netinet_ip_compat_h" = "xyes" -o \
         "x$ac_cv_header_netinet_ip_fil_compat_h" = "xyes" ; then
         have_ipfilter_compat_header="yes"
-     fi
-     if test "x$have_ipfilter_compat_header" = "xyes" -a \
+    fi
+    if test "x$have_ipfilter_compat_header" = "xyes" -a \
        "x$ac_cv_header_ip_fil_h" = "xyes" -a \
        "x$ac_cv_header_ip_nat_h" = "xyes" ; then
         enable_ipf_transparent="yes"
@@ -3262,19 +3253,20 @@
         enable_ipf_transparent="no"
     fi
     AC_MSG_RESULT($IPF_TRANSPARENT)
+
+## On Solaris Ipfilter includes expect that SOLARIS2 is defined with the
+## Solaris minor version (8, 9, 10, ...)
+  if test "x$enable_ipf_transparent" = "xyes" -a "x$squid_host_os" = "xsolaris" ; then
+    solrev=`uname -r | sh -c 'IFS=. read j n x; echo $n'`
+    CFLAGS="-DSOLARIS2=$solrev $CFLAGS"
+    CXXFLAGS="-DSOLARIS2=$solrev $CXXFLAGS"
+  fi
+
 fi
 AC_MSG_NOTICE([IPF-based transparent proxying enabled: $enable_ipf_transparent])
 SQUID_DEFINE_BOOL(IPF_TRANSPARENT,$enable_ipf_transparent,
     [Enable support for IPF-style transparent proxying])
 
-if test "x$enable_ipf_transparent" = "xyes" -a "x$squid_host_os" = "xsolaris" ; then
-dnl On Solaris Ipfilter includes expect that SOLARIS2 is defined with the
-dnl Solaris minor version (8, 9, 10, ...)
-  solrev=`uname -r | sh -c 'IFS=. read j n x; echo $n'`
-  CFLAGS="-DSOLARIS2=$solrev $CFLAGS" 
-  CXXFLAGS="-DSOLARIS2=$solrev $CXXFLAGS" 
-fi
-
 dnl PF /dev/pf support requires a header file.
 if test "x$with_nat_devpf" != "xno" ; then
   if test "x$ac_cv_header_net_pfvar_h" = "xyes" -o \
diff -u -r -N squid-3.4.10/helpers/basic_auth/DB/basic_db_auth.8 squid-3.4.11/helpers/basic_auth/DB/basic_db_auth.8
--- squid-3.4.10/helpers/basic_auth/DB/basic_db_auth.8	2014-12-09 09:21:20.000000000 -0800
+++ squid-3.4.11/helpers/basic_auth/DB/basic_db_auth.8	2015-01-13 04:33:24.000000000 -0800
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "BASIC_DB_AUTH 1"
-.TH BASIC_DB_AUTH 1 "2014-12-09" "perl v5.20.1" "User Contributed Perl Documentation"
+.TH BASIC_DB_AUTH 1 "2015-01-13" "perl v5.20.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.10/helpers/external_acl/SQL_session/ext_sql_session_acl.8 squid-3.4.11/helpers/external_acl/SQL_session/ext_sql_session_acl.8
--- squid-3.4.10/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2014-12-09 09:21:44.000000000 -0800
+++ squid-3.4.11/helpers/external_acl/SQL_session/ext_sql_session_acl.8	2015-01-13 04:33:57.000000000 -0800
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_SQL_SESSION_ACL 1"
-.TH EXT_SQL_SESSION_ACL 1 "2014-12-09" "perl v5.20.1" "User Contributed Perl Documentation"
+.TH EXT_SQL_SESSION_ACL 1 "2015-01-13" "perl v5.20.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.10/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8 squid-3.4.11/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8
--- squid-3.4.10/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2014-12-09 09:21:54.000000000 -0800
+++ squid-3.4.11/helpers/external_acl/wbinfo_group/ext_wbinfo_group_acl.8	2015-01-13 04:34:01.000000000 -0800
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXT_WBINFO_GROUP_ACL.PL.IN 1"
-.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2014-12-09" "perl v5.20.1" "User Contributed Perl Documentation"
+.TH EXT_WBINFO_GROUP_ACL.PL.IN 1 "2015-01-13" "perl v5.20.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.10/helpers/log_daemon/DB/log_db_daemon.8 squid-3.4.11/helpers/log_daemon/DB/log_db_daemon.8
--- squid-3.4.10/helpers/log_daemon/DB/log_db_daemon.8	2014-12-09 09:21:56.000000000 -0800
+++ squid-3.4.11/helpers/log_daemon/DB/log_db_daemon.8	2015-01-13 04:34:03.000000000 -0800
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "LOG_DB_DAEMON 1"
-.TH LOG_DB_DAEMON 1 "2014-12-09" "perl v5.20.1" "User Contributed Perl Documentation"
+.TH LOG_DB_DAEMON 1 "2015-01-13" "perl v5.20.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.10/helpers/storeid_rewrite/file/storeid_file_rewrite.8 squid-3.4.11/helpers/storeid_rewrite/file/storeid_file_rewrite.8
--- squid-3.4.10/helpers/storeid_rewrite/file/storeid_file_rewrite.8	2014-12-09 09:22:09.000000000 -0800
+++ squid-3.4.11/helpers/storeid_rewrite/file/storeid_file_rewrite.8	2015-01-13 04:34:15.000000000 -0800
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "STOREID_FILE_REWRITE 1"
-.TH STOREID_FILE_REWRITE 1 "2014-12-09" "perl v5.20.1" "User Contributed Perl Documentation"
+.TH STOREID_FILE_REWRITE 1 "2015-01-13" "perl v5.20.1" "User Contributed Perl Documentation"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
diff -u -r -N squid-3.4.10/include/autoconf.h.in squid-3.4.11/include/autoconf.h.in
--- squid-3.4.10/include/autoconf.h.in	2014-12-09 08:27:45.000000000 -0800
+++ squid-3.4.11/include/autoconf.h.in	2015-01-13 03:53:42.000000000 -0800
@@ -1017,6 +1017,9 @@
 /* Define to 1 if you have the <sys/file.h> header file. */
 #undef HAVE_SYS_FILE_H
 
+/* Define to 1 if you have the <sys/ioccom.h> header file. */
+#undef HAVE_SYS_IOCCOM_H
+
 /* Define to 1 if you have the <sys/ioctl.h> header file. */
 #undef HAVE_SYS_IOCTL_H
 
@@ -1446,6 +1449,9 @@
 /* Use Winsock select() for the IO loop */
 #undef USE_SELECT_WIN32
 
+/* Workaround IPFilter minor_t breakage */
+#undef USE_SOLARIS_IPFILTER_MINOR_T_HACK
+
 /* Compile the ESI processor and Surrogate header support */
 #undef USE_SQUID_ESI
 
diff -u -r -N squid-3.4.10/include/version.h squid-3.4.11/include/version.h
--- squid-3.4.10/include/version.h	2014-12-09 08:28:58.000000000 -0800
+++ squid-3.4.11/include/version.h	2015-01-13 03:54:50.000000000 -0800
@@ -7,7 +7,7 @@
  */
 
 #ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1418142434
+#define SQUID_RELEASE_TIME 1421149989
 #endif
 
 #ifndef APP_SHORTNAME
diff -u -r -N squid-3.4.10/RELEASENOTES.html squid-3.4.11/RELEASENOTES.html
--- squid-3.4.10/RELEASENOTES.html	2014-12-09 09:23:17.000000000 -0800
+++ squid-3.4.11/RELEASENOTES.html	2015-01-13 04:35:19.000000000 -0800
@@ -2,10 +2,10 @@
 <HTML>
 <HEAD>
  <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.69">
- <TITLE>Squid 3.4.10 release notes</TITLE>
+ <TITLE>Squid 3.4.11 release notes</TITLE>
 </HEAD>
 <BODY>
-<H1>Squid 3.4.10 release notes</H1>
+<H1>Squid 3.4.11 release notes</H1>
 
 <H2>Squid Developers</H2>
 <HR>
@@ -57,7 +57,7 @@
 <HR>
 <H2><A NAME="s1">1.</A> <A HREF="#toc1">Notice</A></H2>
 
-<P>The Squid Team are pleased to announce the release of Squid-3.4.10 for testing.</P>
+<P>The Squid Team are pleased to announce the release of Squid-3.4.11 for testing.</P>
 <P>This new release is available for download from 
 <A HREF="http://www.squid-cache.org/Versions/v3/3.4/">http://www.squid-cache.org/Versions/v3/3.4/</A> or the
 <A HREF="http://www.squid-cache.org/Mirrors/http-mirrors.html">mirrors</A>.</P>
diff -u -r -N squid-3.4.10/src/adaptation/AccessRule.cc squid-3.4.11/src/adaptation/AccessRule.cc
--- squid-3.4.10/src/adaptation/AccessRule.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/adaptation/AccessRule.cc	2015-01-13 03:53:17.000000000 -0800
@@ -52,8 +52,8 @@
 Adaptation::AccessRules &
 Adaptation::AllRules()
 {
-    static AccessRules TheRules;
-    return TheRules;
+    static AccessRules *TheRules = new AccessRules;
+    return *TheRules;
 }
 
 // TODO: make AccessRules::find work
diff -u -r -N squid-3.4.10/src/adaptation/Service.cc squid-3.4.11/src/adaptation/Service.cc
--- squid-3.4.10/src/adaptation/Service.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/adaptation/Service.cc	2015-01-13 03:53:17.000000000 -0800
@@ -54,8 +54,8 @@
 Adaptation::Services &
 Adaptation::AllServices()
 {
-    static Services TheServices;
-    return TheServices;
+    static Services *TheServices = new Services;
+    return *TheServices;
 }
 
 Adaptation::ServicePointer
diff -u -r -N squid-3.4.10/src/adaptation/ServiceGroups.cc squid-3.4.11/src/adaptation/ServiceGroups.cc
--- squid-3.4.10/src/adaptation/ServiceGroups.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/adaptation/ServiceGroups.cc	2015-01-13 03:53:17.000000000 -0800
@@ -315,8 +315,8 @@
 Adaptation::Groups &
 Adaptation::AllGroups()
 {
-    static Groups TheGroups;
-    return TheGroups;
+    static Groups *TheGroups = new Groups;
+    return *TheGroups;
 }
 
 Adaptation::ServiceGroupPointer
diff -u -r -N squid-3.4.10/src/comm.cc squid-3.4.11/src/comm.cc
--- squid-3.4.10/src/comm.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/comm.cc	2015-01-13 03:53:17.000000000 -0800
@@ -1034,7 +1034,7 @@
 void
 commStartSslClose(const FdeCbParams &params)
 {
-    assert(&fd_table[params.fd].ssl);
+    assert(fd_table[params.fd].ssl != NULL);
     ssl_shutdown_method(fd_table[params.fd].ssl);
 }
 #endif
diff -u -r -N squid-3.4.10/src/errorpage.cc squid-3.4.11/src/errorpage.cc
--- squid-3.4.10/src/errorpage.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/errorpage.cc	2015-01-13 03:53:17.000000000 -0800
@@ -736,7 +736,7 @@
         str.Printf("Err: [none]\r\n");
     }
 #if USE_AUTH
-    if (auth_user_request->denyMessage())
+    if (auth_user_request.getRaw() && auth_user_request->denyMessage())
         str.Printf("Auth ErrMsg: %s\r\n", auth_user_request->denyMessage());
 #endif
     if (dnsError.size() > 0)
diff -u -r -N squid-3.4.10/src/ip/Address.cc squid-3.4.11/src/ip/Address.cc
--- squid-3.4.10/src/ip/Address.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/ip/Address.cc	2015-01-13 03:53:17.000000000 -0800
@@ -382,6 +382,20 @@
         return false;
     }
 
+    struct addrinfo *resHead = res; // we need to free the whole list later
+    if (!Ip::EnableIpv6) {
+        // if we are IPv6-disabled, use first-IPv4 instead of first-IP.
+        struct addrinfo *maybeIpv4 = res;
+        while (maybeIpv4) {
+            if (maybeIpv4->ai_family == AF_INET)
+                break;
+            maybeIpv4 = maybeIpv4->ai_next;
+        }
+        if (maybeIpv4 != NULL)
+            res = maybeIpv4;
+        // else IPv6-only host, let the caller deal with first-IP anyway.
+    }
+
     /*
      *  NP: =(sockaddr_*) may alter the port. we don't want that.
      *      all we have been given as input was an IPA.
@@ -391,7 +405,7 @@
     port(portSaved);
 
     /* free the memory getaddrinfo() dynamically allocated. */
-    freeaddrinfo(res);
+    freeaddrinfo(resHead);
     return true;
 }
 
diff -u -r -N squid-3.4.10/src/ip/Intercept.cc squid-3.4.11/src/ip/Intercept.cc
--- squid-3.4.10/src/ip/Intercept.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/ip/Intercept.cc	2015-01-13 03:53:17.000000000 -0800
@@ -30,6 +30,10 @@
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  *
  */
+
+// Enable hack to workaround Solaris 10 IPFilter breakage
+#define BUILDING_SQUID_IP_INTERCEPT_CC 1
+
 #include "squid.h"
 #include "comm/Connection.h"
 #include "ip/Intercept.h"
@@ -38,9 +42,19 @@
 
 #if IPF_TRANSPARENT
 
+#if !defined(IPFILTER_VERSION)
+#define IPFILTER_VERSION        5000004
+#endif
+
+#if HAVE_SYS_IOCCOM_H
+#include <sys/ioccom.h>
+#endif
 #if HAVE_SYS_IOCTL_H
 #include <sys/ioctl.h>
 #endif
+#if HAVE_NETINET_IP6_H
+#include <netinet/ip6.h>
+#endif
 #if HAVE_NETINET_TCP_H
 #include <netinet/tcp.h>
 #endif
@@ -52,6 +66,9 @@
 #elif HAVE_NETINET_IPL_H
 #include <netinet/ipl.h>
 #endif
+#if USE_SOLARIS_IPFILTER_MINOR_T_HACK
+#undef minor_t
+#endif
 #if HAVE_IP_FIL_COMPAT_H
 #include <ip_fil_compat.h>
 #elif HAVE_NETINET_IP_FIL_COMPAT_H
diff -u -r -N squid-3.4.10/src/peer_select.cc squid-3.4.11/src/peer_select.cc
--- squid-3.4.10/src/peer_select.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/peer_select.cc	2015-01-13 03:53:17.000000000 -0800
@@ -271,11 +271,12 @@
     // due to the allocation method of fs, we must deallocate each manually.
     // TODO: use a std::list so we can get the size and abort adding whenever the selection loops reach Config.forward_max_tries
     if (fs && psstate->paths->size() >= (unsigned int)Config.forward_max_tries) {
+        assert(fs == psstate->servers);
         while (fs) {
-            FwdServer *next = fs->next;
+            psstate->servers = fs->next;
             cbdataReferenceDone(fs->_peer);
             memFree(fs, MEM_FWD_SERVER);
-            fs = next;
+            fs = psstate->servers;
         }
     }
 
diff -u -r -N squid-3.4.10/src/ssl/certificate_db.cc squid-3.4.11/src/ssl/certificate_db.cc
--- squid-3.4.10/src/ssl/certificate_db.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/src/ssl/certificate_db.cc	2015-01-13 03:53:17.000000000 -0800
@@ -47,7 +47,7 @@
     hFile = CreateFile(TEXT(filename.c_str()), GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
     if (hFile == INVALID_HANDLE_VALUE)
 #else
-    fd = open(filename.c_str(), 0);
+    fd = open(filename.c_str(), O_RDWR);
     if (fd == -1)
 #endif
         throw std::runtime_error("Failed to open file " + filename);
@@ -55,7 +55,7 @@
 #if _SQUID_WINDOWS_
     if (!LockFile(hFile, 0, 0, 1, 0))
 #else
-    if (flock(fd, LOCK_EX) != 0)
+    if (lockf(fd, F_LOCK, 0) != 0)
 #endif
         throw std::runtime_error("Failed to get a lock of " + filename);
 }
@@ -70,7 +70,7 @@
     }
 #else
     if (fd != -1) {
-        flock(fd, LOCK_UN);
+        lockf(fd, F_ULOCK, 0);
         close(fd);
         fd = -1;
     }
diff -u -r -N squid-3.4.10/tools/cachemgr.cc squid-3.4.11/tools/cachemgr.cc
--- squid-3.4.10/tools/cachemgr.cc	2014-12-09 08:27:21.000000000 -0800
+++ squid-3.4.11/tools/cachemgr.cc	2015-01-13 03:53:17.000000000 -0800
@@ -1072,6 +1072,7 @@
             req->workers = xstrdup(q);
         else if (0 == strcmp(t, "processes") && strlen(q))
             req->processes = xstrdup(q);
+        safe_free(t);
     }
 
     if (req->server && !req->hostname) {
