## % define _use_internal_dependency_generator 0

%define __perl_requires %{SOURCE98}

## % define __find_requires %{SOURCE99}

Name:     squid

Version:  3.5.20

Release:  17%{?dist}.7

Summary:  The Squid proxy caching server

Epoch:    7

# See CREDITS for breakdown of non GPLv2+ code

License:  GPLv2+ and (LGPLv2+ and MIT and BSD and Public Domain)

Group:    System Environment/Daemons

URL:      http://www.squid-cache.org

Source0:  http://www.squid-cache.org/Versions/v3/3.5/squid-%{version}.tar.xz

Source1:  http://www.squid-cache.org/Versions/v3/3.5/squid-%{version}.tar.xz.asc

Source2:  squid.init

Source3:  squid.logrotate

Source4:  squid.sysconfig

Source5:  squid.pam

Source6:  squid.nm

Source7:  squid.service

Source8:  cache_swap.sh

Source98: perl-requires-squid.sh

Source99: squid-migrate-conf.py

# Local patches

# Applying upstream patches first makes it less likely that local patches

# will break upstream ones.

Patch201: squid-3.1.0.9-config.patch

Patch202: squid-3.1.0.9-location.patch

Patch203: squid-3.0.STABLE1-perlpath.patch

Patch204: squid-3.2.0.9-fpic.patch

Patch205: squid-3.1.9-ltdl.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=980511

Patch206: squid-3.3.8-active-ftp-1.patch

Patch207: squid-3.3.8-active-ftp-2.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1265328#c23

Patch208: squid-3.5.10-ssl-helper.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1378025

# http://bazaar.launchpad.net/~squid/squid/3.4/revision/12713

Patch209: squid-3.5.20-conf-casecmp.patch

# http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_11.patch

Patch210: squid-CVE-2016-10002.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1404817

Patch211: squid-3.5.20-tunnel-sigsegv.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1414853

Patch212: squid-3.5.20-man-typos.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1290404

Patch213: squid-3.5.20-man-see-also.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1620546

Patch214: squid-3.5.20-empty-cname.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1690551

Patch215: squid-3.5.20-cache-peer-tolower.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1680022

Patch216: squid-3.5.20-https-packet-size.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1717430

Patch217: squid-3.5.20-mem-usage-out-of-fd.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1676420

Patch218: squid-3.5.20-cache-siblings-gw.patch

# Security Fixes:

# https://bugzilla.redhat.com/show_bug.cgi?id=1727744

# Regression caused by original patch fixed -

# https://bugzilla.redhat.com/show_bug.cgi?id=1890581

Patch500: squid-3.5.20-CVE-2019-13345.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1582301

Patch501: squid-3.5.20-CVE-2018-1000024.patch

Patch502: squid-3.5.20-CVE-2018-1000027.patch

Patch503: squid-3.5.20-CVE-2019-12525.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1828361

Patch504: squid-3.5.20-CVE-2020-11945.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1828362

Patch505: squid-3.5.20-CVE-2019-12519.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1798540

# https://bugzilla.redhat.com/show_bug.cgi?id=1798552

Patch506: squid-3.5.20-CVE-2020-8449-and-8450.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1852550

Patch507: squid-3.5.20-CVE-2020-15049.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1802517

Patch508: squid-3.5.20-CVE-2019-12528.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1871705

Patch509: squid-3.5.20-CVE-2020-24606.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1871700

Patch510: squid-3.5.20-CVE-2020-15810.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1871702

Patch511: squid-3.5.20-CVE-2020-15811.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1939925

Patch512: squid-3.5.20-CVE-2020-25097.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=2100721

Patch513: squid-3.5.20-CVE-2021-46784.patch

Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Requires: bash >= 2.0

Requires: squid-migration-script

Requires(pre): shadow-utils

Requires(post): /sbin/chkconfig

Requires(preun): /sbin/chkconfig

Requires(post): systemd

Requires(preun): systemd

Requires(postun): systemd

# squid_ldap_auth and other LDAP helpers require OpenLDAP

BuildRequires: openldap-devel

# squid_pam_auth requires PAM development libs

BuildRequires: pam-devel

# SSL support requires OpenSSL

BuildRequires: openssl-devel

# squid_kerb_aut requires Kerberos development libs

BuildRequires: krb5-devel

# ESI support requires Expat & libxml2

BuildRequires: expat-devel libxml2-devel

# TPROXY requires libcap, and also increases security somewhat

BuildRequires: libcap-devel

# eCAP support

BuildRequires: libecap-devel >= 1.0.0

# 

BuildRequires: libtool libtool-ltdl-devel

# For test suite

BuildRequires: cppunit-devel

# DB helper requires

BuildRequires: perl-podlators libdb-devel

# c++ source files

BuildRequires: gcc-c++

%description

Squid is a high-performance proxy caching server for Web clients,

supporting FTP, gopher, and HTTP data objects. Unlike traditional

caching software, Squid handles all requests in a single,

non-blocking, I/O-driven process. Squid keeps meta data and especially

hot objects cached in RAM, caches DNS lookups, supports non-blocking

DNS lookups, and implements negative caching of failed requests.

Squid consists of a main server program squid, a Domain Name System

lookup program (dnsserver), a program for retrieving FTP data

(ftpget), and some management and client tools.

%package sysvinit

Group: System Environment/Daemons

Summary: SysV initscript for squid caching proxy

Requires: %{name} = %{epoch}:%{version}-%{release}

Requires(preun): /sbin/service

Requires(postun): /sbin/service

%description sysvinit

The squid-sysvinit contains SysV initscritps support.

%package migration-script

Group: System Environment/Daemons

Summary: Migration script for squid caching proxy

%description migration-script

The squid-migration-script contains scripts for squid configuration

migration and script which prepares squid for downgrade operation.

%prep

%setup -q

# Local patches

%patch201 -p1 -b .config

%patch202 -p1 -b .location

%patch203 -p1 -b .perlpath

%patch204 -p1 -b .fpic

%patch205 -p1 -b .ltdl

%patch206 -p1 -b .active-ftp-1

%patch207 -p1 -b .active-ftp-2

%patch208 -p1 -b .ssl-helper

%patch209 -p1 -b .conf-casecmp

%patch210 -p0 -b .CVE-2016-10002

%patch211 -p1 -b .tunnel-sigsegv

%patch212 -p1 -b .man-see-also

%patch213 -p1 -b .man-typos

%patch214 -p1 -b .empty-cname

%patch215 -p1 -b .cache-peer-tolower

%patch216 -p1 -b .https-packet-size

%patch217 -p1 -b .mem-usage-out-of-fd

%patch218 -p1 -b .cache-siblings-gw

# security fixes

%patch500 -p1 -b .CVE-2019-13345

%patch501 -p1 -b .CVE-2018-1000024

%patch502 -p1 -b .CVE-2018-1000027

%patch503 -p1 -b .CVE-2019-12525

%patch504 -p1 -b .CVE-2020-11945

%patch505 -p1 -b .CVE-2019-12519

%patch506 -p1 -b .CVE-2020-8449-and-8450

%patch507 -p1 -b .CVE-2020-15049

%patch508 -p1 -b .CVE-2019-12528

%patch509 -p1 -b .CVE-2020-24606

%patch510 -p1 -b .CVE-2020-15810

%patch511 -p1 -b .CVE-2020-15811

%patch512 -p1 -b .CVE-2020-25097

%patch513 -p1 -b .CVE-2021-46784

# https://bugzilla.redhat.com/show_bug.cgi?id=1471140

# Patch in the vendor documentation and used different location for documentation

sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_docdir}/squid-%{version}/squid.conf.documented|' src/squid.8.in

%build

%ifarch sparcv9 sparc64 s390 s390x

   CXXFLAGS="$RPM_OPT_FLAGS -fPIE" \

   CFLAGS="$RPM_OPT_FLAGS -fPIE" \

%else

   CXXFLAGS="$RPM_OPT_FLAGS -fpie" \

   CFLAGS="$RPM_OPT_FLAGS -fpie" \

%endif

LDFLAGS="$RPM_LD_FLAGS -pie -Wl,-z,relro -Wl,-z,now"

%configure \

   --disable-strict-error-checking \

   --exec_prefix=/usr \

   --libexecdir=%{_libdir}/squid \

   --localstatedir=%{_var} \

   --datadir=%{_datadir}/squid \

   --sysconfdir=%{_sysconfdir}/squid \

   --with-logdir='$(localstatedir)/log/squid' \

   --with-pidfile='$(localstatedir)/run/squid.pid' \

   --disable-dependency-tracking \

   --enable-eui \

   --enable-follow-x-forwarded-for \

   --enable-auth \

   --enable-auth-basic="DB,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,SMB_LM,getpwnam" \

   --enable-auth-ntlm="smb_lm,fake" \

   --enable-auth-digest="file,LDAP,eDirectory" \

   --enable-auth-negotiate="kerberos" \

   --enable-external-acl-helpers="file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group" \

   --enable-cache-digests \

   --enable-cachemgr-hostname=localhost \

   --enable-delay-pools \

   --enable-epoll \

   --enable-ident-lookups \

   %ifnarch ppc64 ia64 x86_64 s390x aarch64

   --with-large-files \

   %endif

   --enable-linux-netfilter \

   --enable-removal-policies="heap,lru" \

   --enable-snmp \

   --enable-ssl-crtd \

   --enable-storeio="aufs,diskd,rock,ufs" \

   --enable-wccpv2 \

   --enable-esi \

   --enable-ecap \

   --with-aio \

   --with-default-user="squid" \

   --with-dl \

   --with-openssl \

   --with-pthreads \

   --disable-arch-native

make \

	DEFAULT_SWAP_DIR='$(localstatedir)/spool/squid' \

	%{?_smp_mflags}

%check

make check

%install

rm -rf $RPM_BUILD_ROOT

make \

	DESTDIR=$RPM_BUILD_ROOT \

	install

echo "

#

# This is %{_sysconfdir}/httpd/conf.d/squid.conf

#

ScriptAlias /Squid/cgi-bin/cachemgr.cgi %{_libdir}/squid/cachemgr.cgi

# Only allow access from localhost by default

<Location /Squid/cgi-bin/cachemgr.cgi>

 Require local

 # Add additional allowed hosts as needed

 # Require host example.com

</Location>" > $RPM_BUILD_ROOT/squid.httpd.tmp

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d

mkdir -p $RPM_BUILD_ROOT%{_unitdir}

mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/squid

mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/firewalld/services

install -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/rc.d/init.d/squid

install -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/squid

install -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/squid

install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/squid

install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_unitdir}

install -m 755 %{SOURCE8} $RPM_BUILD_ROOT%{_libexecdir}/squid

install -m 644 $RPM_BUILD_ROOT/squid.httpd.tmp $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/squid.conf

install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d/20-squid

mkdir -p $RPM_BUILD_ROOT%{_var}/log/squid

mkdir -p $RPM_BUILD_ROOT%{_var}/spool/squid

mkdir -p $RPM_BUILD_ROOT%{_var}/run/squid

chmod 644 contrib/url-normalizer.pl contrib/rredir.* contrib/user-agents.pl

iconv -f ISO88591 -t UTF8 ChangeLog -o ChangeLog.tmp

mv -f ChangeLog.tmp ChangeLog

# install /usr/lib/tmpfiles.d/squid.conf

mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}

cat > ${RPM_BUILD_ROOT}%{_tmpfilesdir}/squid.conf <

# See tmpfiles.d(5) for details

d /run/squid 0755 squid squid - -

EOF

# Move the MIB definition to the proper place (and name)

mkdir -p $RPM_BUILD_ROOT/usr/share/snmp/mibs

mv $RPM_BUILD_ROOT/usr/share/squid/mib.txt $RPM_BUILD_ROOT/usr/share/snmp/mibs/SQUID-MIB.txt

# squid.conf.documented is documentation. We ship that in doc/

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/squid/squid.conf.documented

# remove unpackaged files from the buildroot

rm -f $RPM_BUILD_ROOT%{_bindir}/{RunAccel,RunCache}

rm -f $RPM_BUILD_ROOT/squid.httpd.tmp

# bug #447156

# /usr/share/squid/errors/zh-cn and /usr/share/squid/errors/zh-tw were

# substituted directories substituted by symlinks and RPM, can't handle

# this change

rm -f $RPM_BUILD_ROOT%{_prefix}/share/squid/errors/zh-tw

rm -f $RPM_BUILD_ROOT%{_prefix}/share/squid/errors/zh-cn

cp -R --preserve=all $RPM_BUILD_ROOT%{_prefix}/share/squid/errors/zh-hant $RPM_BUILD_ROOT%{_prefix}/share/squid/errors/zh-tw

cp -R --preserve=all $RPM_BUILD_ROOT%{_prefix}/share/squid/errors/zh-hans $RPM_BUILD_ROOT%{_prefix}/share/squid/errors/zh-cn

# squid-migration-script

mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/squid

install -m 755 %{SOURCE99} $RPM_BUILD_ROOT%{_bindir}

%clean

rm -rf $RPM_BUILD_ROOT

%files

%defattr(-,root,root,-)

%doc COPYING README ChangeLog QUICKSTART src/squid.conf.documented

%doc contrib/url-normalizer.pl contrib/rredir.* contrib/user-agents.pl

%{_unitdir}/squid.service

%attr(755,root,root) %dir %{_libexecdir}/squid

%attr(755,root,root) %{_libexecdir}/squid/cache_swap.sh

%attr(755,root,root) %dir %{_sysconfdir}/squid

%attr(755,root,root) %dir %{_libdir}/squid

%attr(750,squid,squid) %dir %{_var}/log/squid

%attr(750,squid,squid) %dir %{_var}/spool/squid

%attr(755,squid,squid) %dir %{_var}/run/squid

%config(noreplace) %attr(644,root,root) %{_sysconfdir}/httpd/conf.d/squid.conf

%config(noreplace) %attr(640,root,squid) %{_sysconfdir}/squid/squid.conf

%config(noreplace) %attr(644,root,squid) %{_sysconfdir}/squid/cachemgr.conf

%config(noreplace) %{_sysconfdir}/squid/mime.conf

%config(noreplace) %{_sysconfdir}/squid/errorpage.css

%config(noreplace) %{_sysconfdir}/sysconfig/squid

# These are not noreplace because they are just sample config files

%config %{_sysconfdir}/squid/squid.conf.default

%config %{_sysconfdir}/squid/mime.conf.default

%config %{_sysconfdir}/squid/errorpage.css.default

%config %{_sysconfdir}/squid/cachemgr.conf.default

%config(noreplace) %{_sysconfdir}/pam.d/squid

%config(noreplace) %{_sysconfdir}/logrotate.d/squid

%dir %{_datadir}/squid

%attr(-,root,root) %{_datadir}/squid/errors

%attr(755,root,root) %{_sysconfdir}/NetworkManager/dispatcher.d/20-squid

%{_datadir}/squid/icons

%{_sbindir}/squid

%{_bindir}/squidclient

%{_bindir}/purge

%{_mandir}/man8/*

%{_mandir}/man1/*

%{_libdir}/squid/*

%{_datadir}/snmp/mibs/SQUID-MIB.txt

%{_tmpfilesdir}/squid.conf

%files sysvinit

%attr(755,root,root) %{_sysconfdir}/rc.d/init.d/squid

%files migration-script

%defattr(-,root,root,-)

%attr(755,root,root) %{_bindir}/squid-migrate-conf.py*

%pre

if ! getent group squid >/dev/null 2>&1; then

  /usr/sbin/groupadd -g 23 squid

fi

if ! getent passwd squid >/dev/null 2>&1 ; then

  /usr/sbin/useradd -g 23 -u 23 -d /var/spool/squid -r -s /sbin/nologin squid >/dev/null 2>&1 || exit 1 

fi

for i in /var/log/squid /var/spool/squid ; do

        if [ -d $i ] ; then

                for adir in `find $i -maxdepth 0 \! -user squid`; do

                        chown -R squid:squid $adir

                done

        fi

done

exit 0

%post

/usr/bin/squid-migrate-conf.py --write-changes --conf %{_sysconfdir}/squid/squid.conf &>/dev/null

%systemd_post squid.service

%preun

%systemd_preun squid.service

%postun

%systemd_postun_with_restart squid.service

%triggerin -- samba-common

if ! getent group wbpriv >/dev/null 2>&1 ; then

  /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || :

fi

/usr/sbin/usermod -a -G wbpriv squid >/dev/null 2>&1 || \

    chgrp squid /var/cache/samba/winbindd_privileged >/dev/null 2>&1 || :

%changelog

* Tue Jun 28 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.7

- Resolves: #2100778 - CVE-2021-46784 squid: DoS when processing gopher server

  responses

* Wed Mar 31 2021 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6

- Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow

  a trusted client to perform HTTP Request Smuggling

* Mon Oct 26 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.5

- Resolves: #1890581 - Fix for CVE 2019-13345 breaks authentication in

  cachemgr.cgi

* Fri Aug 28 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4

- Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could

  result in a DoS

- Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could

  result in cache poisoning

- Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could

  result in cache poisoning

* Fri Jul 31 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2

- Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues

  in HTTP Request processing

- Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting

  as reverse-proxy

- Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning

  attack against the HTTP cache

- Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in

  FTP Gateway

* Tue Apr 28 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17

- Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon

  Digest Authentication nonce replay could lead to remote code execution

- Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in

  ESIExpression::Evaluate allows for stack buffer overflow [rhel

* Fri Mar 27 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16

- Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 

  Proxy-Authentication leads to memory corruption

* Thu Jul 25 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15

- Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower

  case

- Resolves: #1680022 - squid can't display download/upload packet size for HTTPS

  sites

- Resolves: #1717430 - Excessive memory usage when running out of descriptors

- Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts

- Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter

  in cachemgr.cgi

- Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws

* Thu Dec 06 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-13

- Resolves: #1620546 - migration of upstream squid

* Mon Oct 02 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-12

- Resolves: #1471140 - Missing detailed configuration file

* Mon Oct 02 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-11

- Resolves: #1452200 - Include kerberos_ldap_group helper in squid

* Tue Apr 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-10

- Resolves: #1445219 - [RFE] Add rock cache directive to squid

* Thu Mar 23 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-9

- Resolves: #1290404 - wrong names of components in man page, section SEE ALSO

* Thu Mar 23 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-8

- Resolves: #1414853 - typo error(s) in man page(s)

* Mon Mar 20 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-7

- Related: #1347096 - squid: ERROR: No running copy

* Mon Mar 20 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-6

- Resolves: #1347096 - squid: ERROR: No running copy

* Thu Mar 02 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-5

- Resolves: #1404817 - SIGSEV in TunnelStateData::handleConnectResponse()

  during squid reconfigure and restart

* Fri Jan 13 2017 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-4

- Resolves: #1412736 - CVE-2016-10002 squid: Information disclosure in HTTP

  request processing

* Thu Dec 15 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-3

- Resolves: #1404894 - icap support has been disabled on squid 3.5.20-2.el7

* Wed Sep 21 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-2

- Resolves: #1378025 - host_verify_strict only accepts lowercase arguments

* Tue Aug 09 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-1

- Resolves: #1273942 - Rebase squid to latest mature 3.5 version (3.5.20)

* Mon Aug 08 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-9

- Related: #1349775 - Provide migration tools needed due to rebase

  to squid 3.5 as a separate sub-package

* Mon Aug 01 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-8

- Related: #1349775 - Provide migration tools needed due to rebase

  to squid 3.5 as a separate sub-package

* Mon Aug 01 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-7

- Related: #1349775 - Provide migration tools needed due to rebase

  to squid 3.5 as a separate sub-package

* Wed Jul 27 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-6

- Related: #1349775 - Provide migration tools needed due to rebase

  to squid 3.5 as a separate sub-package

* Tue Jul 26 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-5

- Related: #1349775 - Provide migration tools needed due to rebase

  to squid 3.5 as a separate sub-package

* Tue Jul 19 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-4

- Resolves: #1349775 - Provide migration tools needed due to rebase

  to squid 3.5 as a separate sub-package

* Tue Jun 14 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-3

- Resolves: #1330186 - digest doesn't properly work with squid 3.3 on CentOS 7

* Tue Jun 14 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-2

- Resolves: #1336387 - Squid send wrong respond for GET-request following

  Range-GET request

* Wed Jun 08 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-1

- Resolves: #1273942 - Rebase squid to latest mature 3.5 version (3.5.10)

- Resolves: #1322770 - CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572

  CVE-2016-3948 squid: various flaws

- Resolves: #1254016 - IPv4 fallback is not working when connecting

  to a dualstack host with non-functional IPv6

- Resolves: #1254018 - should BuildRequire: g++

- Resolves: #1262456 - Squid delays on FQDNs that don't contains AAAA record

- Resolves: #1336940 - Disable squid systemd unit start/stop timeouts

- Resolves: #1344197 - /usr/lib/firewalld/services/squid.xml conflicts between

  attempted installs of squid-7:3.3.8-31.el7.x86_64 and

  firewalld-0.4.2-1.el7.noarch

- Resolves: #1299972 - squid file descriptor limit hardcoded to 16384 via 

  compile option in spec file

* Wed Jun 08 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-31

- Resolves: #1283078 - max_filedescriptors in squid.conf is ignored

* Mon May 09 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-30

- Related: #1334509 - CVE-2016-4553 squid: Cache poisoning issue in

  HTTP Request handling

- Related: #1334492 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 

  squid: various flaws

* Tue May 03 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-29

- Related: #1330577 - CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 squid: multiple

  issues in ESI processing

* Thu Apr 28 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-28

- Related: #1330577 - CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 squid: multiple

  issues in ESI processing

* Thu Apr 28 2016 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-27

- Resolves: #1330577 - CVE-2016-4051 squid: buffer overflow in cachemgr.cgi

* Wed Oct 14 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26

- Related: #1186768 - removing patch, because of missing tests and 

  incorrent patch

* Tue Oct 13 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-25

- Related: #1102842 - squid rpm package misses /var/run/squid needed for

  smp mode. Squid needs write access to /var/run/squid.

* Fri Oct 09 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-24

- Related: #1102842 - squid rpm package misses /var/run/squid needed for

  smp mode. Creation of /var/run/squid was also needed to be in SPEC file.

* Tue Oct 06 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-23

- Related: #1102842 - squid rpm package misses /var/run/squid needed for

  smp mode. Creation of this directory was moved to tmpfiles.d conf file.

* Fri Oct 02 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-22

- Related: #1102842 - squid rpm package misses /var/run/squid needed for

  smp mode. Creation of this directory was moved to service file.

* Tue Sep 22 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-21

- Resolves: #1263338 - squid with digest auth on big endian systems 

  start looping

* Mon Aug 10 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-20

- Resolves: #1186768 - security issue: Nonce replay vulnerability 

  in Digest authentication

* Tue Jul 14 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-19

- Resolves: #1225640 - squid crashes by segfault when it reboots

* Thu Jun 25 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-18

- Resolves: #1102842 - squid rpm package misses /var/run/squid needed for 

  smp mode

* Wed Jun 24 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-17

- Resolves: #1233265 - CVE-2015-3455 squid: incorrect X509 server

  certificate validation

* Fri Jun 19 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-16

- Resolves: #1080042 - Supply a firewalld service file with squid

* Wed Jun 17 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-15

- Resolves: #1161600 - Squid does not serve cached responses 

  with Vary headers

* Wed Jun 17 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-14

- Resolves: #1198778 - Filedescriptor leaks on snmp

* Wed Jun 17 2015 Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-13

- Resolves: #1204375 - squid sends incorrect ssl chain breaking newer gnutls 

  using applications

* Fri Aug 29 2014 Michal Luscon <mluscon@redhat.com> - 7:3.3.8-12

- Resolves: #1134934 - CVE-2014-3609 assertion failure in header processing

* Mon Mar 17 2014 Pavel Šimerda <psimerda@redhat.com> - 7:3.3.8-11

- Resolves: #1074873 - CVE-2014-0128 squid: denial of service when using

  SSL-Bump

* Wed Mar 05 2014 Pavel Šimerda <psimerda@redhat.com>' - 7:3.3.8-10

- Resolves: #1072973 - don't depend on libdb4

* Tue Feb 11 2014 Pavel Šimerda <psimerda@redhat.com> - 7:3.3.8-9

- revert: Resolves: #1038160 - avoid running squid's own supervisor process

* Tue Feb 11 2014 Pavel Šimerda <psimerda@redhat.com> - 7:3.3.8-8

- Resolves: #1063248 - missing helpers

* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 7:3.3.8-7

- Mass rebuild 2014-01-24

* Thu Jan 02 2014 Pavel Šimerda <psimerda@redhat.com> - 7:3.3.8-6

- Resolves: #980511 - squid doesn't work with active FTP

* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 7:3.3.8-5

- Mass rebuild 2013-12-27

* Tue Dec 10 2013 Pavel Šimerda <psimerda@redhat.com> - 7:3.3.8-4

- Resolves: #1038160 - avoid running squid's own supervisor process

* Thu Nov 21 2013 Pavel Šimerda <psimerda@redhat.com> - 7:3.3.8-3

- Resolves: #1028588 - fix build on aarch64

* Tue Aug 27 2013 Michal Luscon <mluscon@redhat.com> - 7:3.3.8-2

- Fixed: source code url

* Thu Jul 25 2013 Michal Luscon <mluscon@redhat.com> - 7:3.3.8-1

- Update to latest upstream version 3.3.8

- Fixed: active ftp crashing

- Fix basic auth and log daemon DB helper builds.

- Use xz compressed tarball, fix source URLs.

- Fix bogus dates in %%changelog.

* Fri May 3 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.11-1

- Update to latest upstream version 3.2.11

* Tue Apr 23 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.9-3

- Option '-k' is not stated in squidclient man

- Remove pid from service file(#913262)

* Fri Apr 19 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.9-2

- Enable full RELRO (-Wl,-z,relro -Wl,-z,now)

* Tue Mar 19 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.9-1

- Update to latest upstream version 3.2.9

- Fixed: CVE-2013-1839

- Removed: makefile-patch (+make check)

* Mon Mar 11 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.8-3

- Resolved: /usr move - squid service file

* Sat Mar 09 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.8-2

- Resolved: #896127 - basic_ncsa_auth does not work

* Fri Mar 08 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.8-1

- Update to latest upstream version 3.2.8

- Fixed rawhide build issues (-make check)

* Thu Feb 07 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.7-1

- Update to latest upstream version 3.2.7

* Thu Jan 24 2013 Michal Luscon <mluscon@redhat.com> - 7:3.2.5-2

- CVE-2013-0189: Incomplete fix for the CVE-2012-5643

* Mon Dec 17 2012 Michal Luscon <mluscon@redhat.com> - 7:3.2.5-1

- Update to latest upstream version 3.2.5

* Mon Nov 05 2012 Michal Luscon <mluscon@redhat.com> - 7:3.2.3-3

- Resolved: #71483 - httpd 2.4 requires new configuration directives

* Fri Oct 26 2012 Michal Luscon <mluscon@redhat.com> - 7:3.2.3-2

- Resolved: #854356 - squid.service use PIDFile

- Resolved: #859393 - Improve cache_swap script

- Resolved: #791129 - disk space warning

- Resolved: #862252 - reload on VPN or network up/down

- Resolved: #867531 - run test suite during build

- Resolved: #832684 - missing after dependency nss-lookup.target

- Removed obsolete configure options