Accepting request 1177317 from server:proxy

- update to 6.9
  - Regression Bug 5349: basic_nis_auth build error: unterminated #ifndef
  - Bug 5069: Keep listening after getsockname() error
  - Bug 5360: FwdState::noteDestinationsEnd() assertion "err"
  - Reduce stale errno usage
  - Plug memory leak in handling cache manager requests
  - Fix error: template-id not allowed for constructor in C++20
  - Improve release packaging automation
- header_fixups.patch: upstreamed, removed
- 9be86d8db5e8f40829374d26334d0bb5272c1afd.patch: upstreamed, removed
- CVE-2024-33427.patch: fixes possible buffer overread leading to
  denial of service (bsc#1225417, CVE-2024-33427)

OBS-URL: https://build.opensuse.org/request/show/1177317
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/squid?expand=0&rev=121

9be86d8db5e8f40829374d26334d0bb5272c1afd.patch

@@ -1,29 +0,0 @@
-commit 9be86d8db5e8f40829374d26334d0bb5272c1afd
-Author: Alex Rousskov <rousskov@measurement-factory.com>
-Date:   Fri Mar 1 22:20:20 2024 +0000
-
-    Bug 5069: Keep listening after getsockname() error (#1713)
-    
-        ERROR: Stopped accepting connections:
-        error: getsockname() failed to locate local-IP on ...
-    
-    In many cases, these failures are intermittent client-triggered errors
-    (e.g., client shut down the accepted socket); Squid will successfully
-    accept other connections and, hence, should keep listening for them.
-
-diff --git a/src/comm/TcpAcceptor.cc b/src/comm/TcpAcceptor.cc
-index dcc52fbaa..aa082df4b 100644
---- a/src/comm/TcpAcceptor.cc
-+++ b/src/comm/TcpAcceptor.cc
-@@ -381,7 +381,10 @@ Comm::TcpAcceptor::acceptInto(Comm::ConnectionPointer &details)
-     if (getsockname(sock, gai->ai_addr, &gai->ai_addrlen) != 0) {
-         int xerrno = errno;
-         Ip::Address::FreeAddr(gai);
--        throw TextException(ToSBuf("getsockname() failed to locate local-IP on ", details, ": ", xstrerr(xerrno)), Here());
-+        debugs(50, DBG_IMPORTANT, "ERROR: Closing accepted TCP connection after failing to obtain its local IP address" <<
-+               Debug::Extra << "accepted connection: " << details <<
-+               Debug::Extra << "getsockname(2) error: " << xstrerr(xerrno));
-+        return false;
-     }
-     details->local = *gai;
-     Ip::Address::FreeAddr(gai);

CVE-2024-33427.patch

@@ -0,0 +1,13 @@
+Index: squid-6.9/src/ConfigParser.cc
+===================================================================
+--- squid-6.9.orig/src/ConfigParser.cc
++++ squid-6.9/src/ConfigParser.cc
+@@ -181,7 +181,7 @@ ConfigParser::UnQuote(const char *token,
+     *d = '\0';
+ 
+     // We are expecting a separator after quoted string, space or one of "()#"
+-    if (*(s + 1) != '\0' && !strchr(w_space "()#", *(s + 1)) && !errorStr) {
++    if (!errorStr && *(s + 1) != '\0' && !strchr(w_space "()#", *(s + 1))) {
+         errorStr = "Expecting space after the end of quoted token";
+         errorPos = token;
+     }

header_fixups.patch

@@ -1,14 +0,0 @@
-Index: squid-6.8/src/auth/basic/NIS/nis_support.h
-===================================================================
---- squid-6.8.orig/src/auth/basic/NIS/nis_support.h
-+++ squid-6.8/src/auth/basic/NIS/nis_support.h
-@@ -8,9 +8,6 @@
- #ifndef SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
- #define SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
- 
--#ifndef SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
--#define SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
--
- extern char * get_nis_password(char *user, char *nisdomain, char *nismap);
- 
- #endif /* SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H */

squid-6.8.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:11cc5650b51809d99483ccfae24744a2e51cd16199f5ff0c917e84fce695870f
-size 2547796

squid-6.8.tar.xz.asc

@@ -1,17 +0,0 @@
-File: squid-6.8.tar.xz
-Date: Mon Mar  4 06:17:24 AM UTC 2024
-Size: 2547796
-MD5 : d84b0d0ee2b9c1bdb782cb5117a72913
-SHA1: f9092ab57ec1f49720a02589a452e3498c183867
-Key : 29B4B1F7CE03D1B1DED22F3028F85029FEF6E865 <kinkie@squid-cache.org>
-            29B4 B1F7 CE03 D1B1 DED2  2F30 28F8 5029 FEF6 E865
-sub   cv25519 2021-05-15 [E]
-      keyring = http://www.squid-cache.org/pgp.asc
-      keyserver = pool.sks-keyservers.net
------BEGIN PGP SIGNATURE-----
-
-iHUEABYIAB0WIQQptLH3zgPRsd7SLzAo+FAp/vboZQUCZeVnkQAKCRAo+FAp/vbo
-Zc5eAP96D2jk2kcOdMEo1GVpDXwEjZkavTPmYC6k9oKNwDjJ+QD+LH4um4EPsglW
-NedPryEIN/FCWwB5NLriVPwtVe0r7Aw=
-=/X4C
------END PGP SIGNATURE-----

squid-6.9.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1ad72d46e1cb556e9561214f0fb181adb87c7c47927ef69bc8acd68a03f61882
+size 2557992

squid-6.9.tar.xz.asc

@@ -0,0 +1,17 @@
+File: squid-6.9.tar.xz
+Date: Mon Apr  8 06:31:46 AM UTC 2024
+Size: 2557992
+MD5 : 4888e9dc75c0daa0ed526b34c055cb67
+SHA1: 5e73b30116ce7111589cc2b1c9bfe3c17efa2e75
+Key : 29B4B1F7CE03D1B1DED22F3028F85029FEF6E865 <kinkie@squid-cache.org>
+            29B4 B1F7 CE03 D1B1 DED2  2F30 28F8 5029 FEF6 E865
+sub   cv25519 2021-05-15 [E]
+      keyring = http://www.squid-cache.org/pgp.asc
+      keyserver = pool.sks-keyservers.net
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYIAB0WIQQptLH3zgPRsd7SLzAo+FAp/vboZQUCZhOPagAKCRAo+FAp/vbo
+ZcUMAP431ZvxTspTtnGMKRksGqYPkQn8t9e3LF21KIKKMgfSQAEA7lUbYqXSX4Av
+0kdzaQZt83DNc/doQYeEU+S7Xtz1BA8=
+=rcZg
+-----END PGP SIGNATURE-----

squid.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Tue May 28 08:39:49 UTC 2024 - Adam Majer <adam.majer@suse.de>
+
+- update to 6.9
+  - Regression Bug 5349: basic_nis_auth build error: unterminated #ifndef
+  - Bug 5069: Keep listening after getsockname() error
+  - Bug 5360: FwdState::noteDestinationsEnd() assertion "err"
+  - Reduce stale errno usage
+  - Plug memory leak in handling cache manager requests
+  - Fix error: template-id not allowed for constructor in C++20
+  - Improve release packaging automation
+
+- header_fixups.patch: upstreamed, removed
+- 9be86d8db5e8f40829374d26334d0bb5272c1afd.patch: upstreamed, removed
+- CVE-2024-33427.patch: fixes possible buffer overread leading to
+  denial of service (bsc#1225417, CVE-2024-33427)
+
 -------------------------------------------------------------------
 Wed Mar  6 12:02:14 UTC 2024 - Adam Majer <adam.majer@suse.de>
 

squid.spec

@@ -24,7 +24,7 @@
 %define         squidhelperdir %{_sbindir}
 %endif
 Name:           squid
-Version:        6.8
+Version:        6.9
 Release:        0
 Summary:        Caching and forwarding HTTP web proxy
 License:        GPL-2.0-or-later
@@ -51,8 +51,7 @@ Source17:       tmpfilesdir.squid.conf
 Patch1:         missing_installs.patch
 Patch2:         old_nettle_compat.patch
 Patch3:         harden_squid.service.patch
-Patch4:         header_fixups.patch
+Patch4:         CVE-2024-33427.patch
-Patch5:         9be86d8db5e8f40829374d26334d0bb5272c1afd.patch
 BuildRequires:  cppunit-devel
 BuildRequires:  expat
 BuildRequires:  fdupes
@@ -109,8 +108,7 @@ accelerator.
 %setup -q
 cp %{SOURCE10} .
 %patch -P 3 -p1
-%patch -P4 -p1
+%patch -P 4 -p1
-%patch -P5 -p1
 
 # upstream patches after RELEASE
 perl -p -i -e 's|%{_prefix}/local/bin/perl|%{_bindir}/perl|' `find -name "*.pl"`