.gitignore

@@ -1,2 +1,2 @@
-SOURCES/pkg-varnish-cache-ec7ad9e.tar.gz
+SOURCES/pkg-varnish-cache-7d90347.tar.gz
-SOURCES/varnish-6.6.2.tgz
+SOURCES/varnish-7.6.0.tgz

.varnish.metadata

@@ -1,2 +1,2 @@
-d15a2afe52d546c45b46875b656ec3542c69e2f2 SOURCES/pkg-varnish-cache-ec7ad9e.tar.gz
+64bc4417a97c4c14b7b665884059b53ec940c14c SOURCES/pkg-varnish-cache-7d90347.tar.gz
-d2423c88186f5d409c72870199c8b46d489fdb48 SOURCES/varnish-6.6.2.tgz
+9d614ab035e752c26f617ab8c1b75bd888af551e SOURCES/varnish-7.6.0.tgz

SOURCES/varnish-6.6.2-CVE-2022-45060.patch

@@ -1,76 +0,0 @@
-diff --git a/bin/varnishd/http2/cache_http2_hpack.c b/bin/varnishd/http2/cache_http2_hpack.c
-index 6bc062e..570b871 100644
---- a/bin/varnishd/http2/cache_http2_hpack.c
-+++ b/bin/varnishd/http2/cache_http2_hpack.c
-@@ -97,11 +97,16 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 	/* XXX: This might belong in cache/cache_http.c */
- 	const char *b0;
- 	unsigned n;
-+	int disallow_empty;
-+	char *p;
-+	int i;
- 
- 	CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
- 	AN(b);
- 	assert(namelen >= 2);	/* 2 chars from the ': ' that we added */
- 	assert(namelen <= len);
-+	
-+	disallow_empty = 0;
- 
- 	if (len > UINT_MAX) {	/* XXX: cache_param max header size */
- 		VSLb(hp->vsl, SLT_BogoHeader, "Header too large: %.20s", b);
-@@ -117,10 +122,24 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 			b += namelen;
- 			len -= namelen;
- 			n = HTTP_HDR_METHOD;
-+			disallow_empty = 1;
-+
-+			/* First field cannot contain SP or CTL */
-+			for (p = b, i = 0; i < len; p++, i++) {
-+				if (vct_issp(*p) || vct_isctl(*p))
-+					return (H2SE_PROTOCOL_ERROR);
-+			}
- 		} else if (!strncmp(b, ":path: ", namelen)) {
- 			b += namelen;
- 			len -= namelen;
- 			n = HTTP_HDR_URL;
-+			disallow_empty = 1;
-+
-+			/* Second field cannot contain LWS or CTL */
-+			for (p = b, i = 0; i < len; p++, i++) {
-+				if (vct_islws(*p) || vct_isctl(*p))
-+					return (H2SE_PROTOCOL_ERROR);
-+			}
- 		} else if (!strncmp(b, ":scheme: ", namelen)) {
- 			/* XXX: What to do about this one? (typically
- 			   "http" or "https"). For now set it as a normal
-@@ -128,6 +147,15 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 			b++;
- 			len-=1;
- 			n = hp->nhd;
-+
-+			for (p = b + namelen, i = 0; i < len-namelen;
-+			    p++, i++) {
-+				if (vct_issp(*p) || vct_isctl(*p))
-+					return (H2SE_PROTOCOL_ERROR);
-+			}
-+
-+			if (!i)
-+				return (H2SE_PROTOCOL_ERROR);
- 		} else if (!strncmp(b, ":authority: ", namelen)) {
- 			b+=6;
- 			len-=6;
-@@ -164,6 +192,13 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 	hp->hd[n].b = b;
- 	hp->hd[n].e = b + len;
- 
-+	if (disallow_empty && !Tlen(hp->hd[n])) {
-+		VSLb(hp->vsl, SLT_BogoHeader,
-+		    "Empty pseudo-header %.*s",
-+		    (int)namelen, b0);
-+		return (H2SE_PROTOCOL_ERROR);
-+	}
-+
- 	return (0);
- }
- 

SOURCES/varnish-6.6.2-CVE-2023-44487-rate_limit.patch

@@ -1,319 +0,0 @@
-commit bb3f607590a102321a15a8a17474d87da8bec32c
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Tue Oct 17 16:52:32 2023 +0200
-
-    Upstream #3997 PR
-    
-    Fix CVE-2023-44487
-
-diff --git a/bin/varnishd/VSC_main.vsc b/bin/varnishd/VSC_main.vsc
-index 7b32584..d55b9df 100644
---- a/bin/varnishd/VSC_main.vsc
-+++ b/bin/varnishd/VSC_main.vsc
-@@ -631,6 +631,14 @@
- 
- 	Number of session closes with Error VCL_FAILURE (VCL failure)
- 
-+.. varnish_vsc:: sc_rapid_reset
-+       :level: diag
-+       :oneliner:      Session Err RAPID_RESET
-+
-+       Number of times we failed an http/2 session because it hit its
-+       configured limits for the number of permitted rapid stream
-+       resets.
-+
- .. varnish_vsc:: client_resp_500
- 	:level: diag
- 	:group: wrk
-diff --git a/bin/varnishd/http2/cache_http2.h b/bin/varnishd/http2/cache_http2.h
-index ea5eb52..9088e21 100644
---- a/bin/varnishd/http2/cache_http2.h
-+++ b/bin/varnishd/http2/cache_http2.h
-@@ -184,6 +184,8 @@ struct h2_sess {
- 	VTAILQ_HEAD(,h2_req)		txqueue;
- 
- 	h2_error			error;
-+	double				rst_budget;
-+	vtim_real			last_rst;
- };
- 
- #define ASSERT_RXTHR(h2) do {assert(h2->rxthr == pthread_self());} while(0)
-diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
-index 3597ec1..408acad 100644
---- a/bin/varnishd/http2/cache_http2_proto.c
-+++ b/bin/varnishd/http2/cache_http2_proto.c
-@@ -45,6 +45,7 @@
- #include "vtcp.h"
- #include "vtim.h"
- 
-+#define H2_CUSTOM_ERRORS
- #define H2EC1(U,v,r,d) const struct h2_error_s H2CE_##U[1] = {{#U,d,v,0,1,r}};
- #define H2EC2(U,v,r,d) const struct h2_error_s H2SE_##U[1] = {{#U,d,v,1,0,r}};
- #define H2EC3(U,v,r,d) H2EC1(U,v,r,d) H2EC2(U,v,r,d)
-@@ -304,9 +305,46 @@ h2_rx_push_promise(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
- /**********************************************************************
-  */
- 
-+static h2_error
-+h2_rapid_reset(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
-+{
-+	vtim_real now;
-+	vtim_dur d;
-+
-+	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
-+	ASSERT_RXTHR(h2);
-+	CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
-+
-+	if (cache_param->h2_rapid_reset_limit == 0)
-+		return (0);
-+
-+	now = VTIM_real();
-+	CHECK_OBJ_NOTNULL(r2->req, REQ_MAGIC);
-+	AN(r2->req->t_first);
-+	if (now - r2->req->t_first > cache_param->h2_rapid_reset)
-+		return (0);
-+
-+	d = now - h2->last_rst;
-+	h2->rst_budget += cache_param->h2_rapid_reset_limit * d /
-+	    cache_param->h2_rapid_reset_period;
-+	h2->rst_budget = vmin_t(double, h2->rst_budget,
-+	    cache_param->h2_rapid_reset_limit);
-+	h2->last_rst = now;
-+
-+	if (h2->rst_budget < 1.0) {
-+		Lck_Lock(&h2->sess->mtx);
-+		VSLb(h2->vsl, SLT_Error, "H2: Hit RST limit. Closing session.");
-+		Lck_Unlock(&h2->sess->mtx);
-+		return (H2CE_RAPID_RESET);
-+	}
-+	h2->rst_budget -= 1.0;
-+	return (0);
-+}
-+
- static h2_error v_matchproto_(h2_rxframe_f)
- h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
- {
-+	h2_error h2e;
- 
- 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
- 	ASSERT_RXTHR(h2);
-@@ -316,8 +354,9 @@ h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
- 		return (H2CE_FRAME_SIZE_ERROR);
- 	if (r2 == NULL)
- 		return (0);
-+	h2e = h2_rapid_reset(wrk, h2, r2);
- 	h2_kill_req(wrk, h2, r2, h2_streamerror(vbe32dec(h2->rxf_data)));
--	return (0);
-+	return (h2e);
- }
- 
- /**********************************************************************
-diff --git a/bin/varnishd/http2/cache_http2_session.c b/bin/varnishd/http2/cache_http2_session.c
-index 36d4a1c..f81c94a 100644
---- a/bin/varnishd/http2/cache_http2_session.c
-+++ b/bin/varnishd/http2/cache_http2_session.c
-@@ -128,6 +128,9 @@ h2_init_sess(const struct worker *wrk, struct sess *sp,
- 	h2_local_settings(&h2->local_settings);
- 	h2->remote_settings = H2_proto_settings;
- 	h2->decode = decode;
-+	h2->rst_budget = cache_param->h2_rapid_reset_limit;
-+	h2->last_rst = sp->t_open;
-+	AZ(isnan(h2->last_rst));
- 
- 	AZ(VHT_Init(h2->dectbl, h2->local_settings.header_table_size));
- 
-diff --git a/bin/varnishtest/tests/r03996.vtc b/bin/varnishtest/tests/r03996.vtc
-new file mode 100644
-index 0000000..3fee370
---- /dev/null
-+++ b/bin/varnishtest/tests/r03996.vtc
-@@ -0,0 +1,51 @@
-+varnishtest "h2 rapid reset"
-+
-+barrier b1 sock 5
-+
-+server s1 {
-+	rxreq
-+	txresp
-+} -start
-+
-+varnish v1 -cliok "param.set feature +http2"
-+varnish v1 -cliok "param.set debug +syncvsl"
-+varnish v1 -cliok "param.set h2_rapid_reset_limit 3"
-+varnish v1 -cliok "param.set h2_rapid_reset 5"
-+
-+varnish v1 -vcl+backend {
-+	import vtc;
-+
-+	sub vcl_recv {
-+		vtc.barrier_sync("${b1_sock}");
-+	}
-+
-+} -start
-+
-+client c1 {
-+	stream 0 {
-+		rxgoaway
-+		expect goaway.err == ENHANCE_YOUR_CALM
-+	} -start
-+
-+	stream 1 {
-+		txreq
-+		txrst
-+	} -run
-+	stream 3 {
-+		txreq
-+		txrst
-+	} -run
-+	stream 5 {
-+		txreq
-+		txrst
-+	} -run
-+	stream 7 {
-+		txreq
-+		txrst
-+	} -run
-+
-+	barrier b1 sync
-+	stream 0 -wait
-+} -run
-+
-+varnish v1 -expect sc_rapid_reset == 1
-diff --git a/include/tbl/h2_error.h b/include/tbl/h2_error.h
-index e8104f8..11051de 100644
---- a/include/tbl/h2_error.h
-+++ b/include/tbl/h2_error.h
-@@ -147,5 +147,17 @@ H2_ERROR(
- 	/* descr */	"Use HTTP/1.1 for the request"
- )
- 
-+#ifdef H2_CUSTOM_ERRORS
-+H2_ERROR(
-+       /* name */      RAPID_RESET,
-+       /* val */       11, /* ENHANCE_YOUR_CALM */
-+       /* types */     1,
-+       /* reason */    SC_RAPID_RESET,
-+       /* descr */     "http/2 rapid reset detected"
-+)
-+
-+#  undef H2_CUSTOM_ERRORS
-+#endif
-+
- #undef H2_ERROR
- /*lint -restore */
-diff --git a/include/tbl/params.h b/include/tbl/params.h
-index cca420c..4014dd6 100644
---- a/include/tbl/params.h
-+++ b/include/tbl/params.h
-@@ -1217,6 +1217,47 @@ PARAM_SIMPLE(
- 	"HTTP2 maximum size of an uncompressed header list."
- )
- 
-+PARAM_SIMPLE(
-+	/* name */	h2_rapid_reset,
-+	/* typ */	timeout,
-+	/* min */	"0.000",
-+	/* max */	NULL,
-+	/* def */	"1.000",
-+	/* units */	"seconds",
-+	/* descr */
-+       "The upper threshold for how rapid an http/2 RST has to come for "
-+       "it to be treated as suspect and subjected to the rate limits "
-+       "specified by h2_rapid_reset_limit and h2_rapid_reset_period.",
-+	/* flags */	EXPERIMENTAL,
-+)
-+
-+PARAM_SIMPLE(
-+	/* name */	h2_rapid_reset_limit,
-+	/* typ */	uint,
-+	/* min */	"0",
-+	/* max */	NULL,
-+	/* def */	"3600",
-+	/* units */	NULL,
-+	/* descr */
-+	"HTTP2 RST Allowance.\n"
-+	"Specifies the maximum number of allowed stream resets issued by\n"
-+	"a client over a time period before the connection is closed.\n"
-+	"Setting this parameter to 0 disables the limit.",
-+	/* flags */	EXPERIMENTAL,
-+)
-+
-+PARAM_SIMPLE(
-+	/* name */	h2_rapid_reset_period,
-+	/* typ */	timeout,
-+	/* min */	"1.000",
-+	/* max */	NULL,
-+	/* def */	"60.000",
-+	/* units */	"seconds",
-+	/* descr */
-+	"HTTP2 sliding window duration for h2_rapid_reset_limit.",
-+	/* flags */	EXPERIMENTAL|WIZARD,
-+)
-+
- /*--------------------------------------------------------------------
-  * Memory pool parameters
-  */
-diff --git a/include/tbl/sess_close.h b/include/tbl/sess_close.h
-index 9748314..6d2f635 100644
---- a/include/tbl/sess_close.h
-+++ b/include/tbl/sess_close.h
-@@ -50,6 +50,7 @@ SESS_CLOSE(PIPE_OVERFLOW, pipe_overflow,1,	"Session pipe overflow")
- SESS_CLOSE(RANGE_SHORT,   range_short,	1,	"Insufficient data for range")
- SESS_CLOSE(REQ_HTTP20,	  req_http20,	1,	"HTTP2 not accepted")
- SESS_CLOSE(VCL_FAILURE,	  vcl_failure,	1,	"VCL failure")
-+SESS_CLOSE(RAPID_RESET,	  rapid_reset,  1,      "HTTP2 rapid reset")
- #undef SESS_CLOSE
- 
- /*lint -restore */
-diff --git a/include/vdef.h b/include/vdef.h
-index a9111fe..c85bea8 100644
---- a/include/vdef.h
-+++ b/include/vdef.h
-@@ -106,6 +106,47 @@
- #  define v_dont_optimize
- #endif
- 
-+/**********************************************************************
-+ * Find the minimum or maximum values.
-+ * Only evaluate the expression once and perform type checking.
-+ */
-+
-+/* ref: https://stackoverflow.com/a/17624752 */
-+
-+#define VINDIRECT(a, b, c)	a ## b ## c
-+#define VCOMBINE(a, b, c)	VINDIRECT(a, b, c)
-+
-+#if defined(__COUNTER__)
-+#	define VUNIQ_NAME(base)	VCOMBINE(base, __LINE__, __COUNTER__)
-+#else
-+#	define VUNIQ_NAME(base)	VCOMBINE(base, __LINE__, 0)
-+#endif
-+
-+#ifdef _lint
-+#define typeof(x) __typeof__(x)
-+#endif
-+
-+/* ref: https://gcc.gnu.org/onlinedocs/gcc/Typeof.html */
-+
-+#define _vtake(op, ta, tb, a, b, _va, _vb)				\
-+	({								\
-+	ta _va = (a);							\
-+	tb _vb = (b);							\
-+	(void)(&_va == &_vb);						\
-+	_va op _vb ? _va : _vb;						\
-+})
-+
-+#define opmin <
-+#define opmax >
-+#define vtake(n, ta, tb, a, b)	_vtake(op ## n, ta, tb, a, b,		\
-+    VUNIQ_NAME(_v ## n ## A), VUNIQ_NAME(_v ## n ## B))
-+
-+#define vmin(a, b)		vtake(min, typeof(a), typeof(b), a, b)
-+#define vmax(a, b)		vtake(max, typeof(a), typeof(b), a, b)
-+
-+#define vmin_t(type, a, b)	vtake(min, type, type, a, b)
-+#define vmax_t(type, a, b)	vtake(max, type, type, a, b)
-+
- /*********************************************************************
-  * Pointer alignment magic
-  */

SOURCES/varnish-6.6.2-CVE-2023-44487-vcl_vrt.patch

@@ -1,328 +0,0 @@
-commit bb44b34d5e9078ede3769ef519badb65d340351a
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Wed Oct 18 12:32:24 2023 +0200
-
-    vcl_vrt: Skip VCL execution if the client is gone
-    
-    Upstream PR #3998
-    and 4991d9f6e40f381d058a83fc21ceed90e34a822e for r03996.vtc
-
-diff --git a/bin/varnishd/VSC_main.vsc b/bin/varnishd/VSC_main.vsc
-index d55b9df..0978c2f 100644
---- a/bin/varnishd/VSC_main.vsc
-+++ b/bin/varnishd/VSC_main.vsc
-@@ -342,6 +342,15 @@
- 	Number of times an HTTP/2 stream was refused because the queue was
- 	too long already. See also parameter thread_queue_limit.
- 
-+.. varnish_vsc:: req_reset
-+	:group: wrk
-+	:oneliner:	Requests reset
-+
-+	Number of times a client left before the VCL processing of its
-+	requests completed. For HTTP/2 sessions, either the stream was
-+	reset by an RST_STREAM frame from the client, or a stream or
-+	connection error occurred.
-+
- .. varnish_vsc:: n_object
- 	:type:	gauge
- 	:group: wrk
-diff --git a/bin/varnishd/cache/cache_transport.h b/bin/varnishd/cache/cache_transport.h
-index 3650291..be396b9 100644
---- a/bin/varnishd/cache/cache_transport.h
-+++ b/bin/varnishd/cache/cache_transport.h
-@@ -44,6 +44,7 @@ typedef void vtr_sess_panic_f (struct vsb *, const struct sess *);
- typedef void vtr_req_panic_f (struct vsb *, const struct req *);
- typedef void vtr_req_fail_f (struct req *, enum sess_close);
- typedef void vtr_reembark_f (struct worker *, struct req *);
-+typedef int vtr_poll_f (struct req *);
- typedef int vtr_minimal_response_f (struct req *, uint16_t status);
- 
- struct transport {
-@@ -64,6 +65,7 @@ struct transport {
- 	vtr_sess_panic_f		*sess_panic;
- 	vtr_req_panic_f			*req_panic;
- 	vtr_reembark_f			*reembark;
-+	vtr_poll_f			*poll;
- 	vtr_minimal_response_f		*minimal_response;
- 
- 	VTAILQ_ENTRY(transport)		list;
-diff --git a/bin/varnishd/cache/cache_vrt_vcl.c b/bin/varnishd/cache/cache_vrt_vcl.c
-index 023ba00..2fbaff6 100644
---- a/bin/varnishd/cache/cache_vrt_vcl.c
-+++ b/bin/varnishd/cache/cache_vrt_vcl.c
-@@ -42,6 +42,7 @@
- #include "vbm.h"
- 
- #include "cache_director.h"
-+#include "cache_transport.h"
- #include "cache_vcl.h"
- #include "vcc_interface.h"
- 
-@@ -437,6 +438,40 @@ VRT_VCL_Allow_Discard(struct vclref **refp)
- 	FREE_OBJ(ref);
- }
- 
-+/*--------------------------------------------------------------------
-+ */
-+
-+static int
-+req_poll(struct worker *wrk, struct req *req)
-+{
-+	struct req *top;
-+
-+	/* NB: Since a fail transition leads to vcl_synth, the request may be
-+	 * short-circuited twice.
-+	 */
-+	if (req->req_reset) {
-+		wrk->handling = VCL_RET_FAIL;
-+		return (-1);
-+	}
-+
-+	top = req->top->topreq;
-+	CHECK_OBJ_NOTNULL(top, REQ_MAGIC);
-+	CHECK_OBJ_NOTNULL(top->transport, TRANSPORT_MAGIC);
-+
-+	if (!FEATURE(FEATURE_VCL_REQ_RESET))
-+		return (0);
-+	if (top->transport->poll == NULL)
-+		return (0);
-+	if (top->transport->poll(top) >= 0)
-+		return (0);
-+
-+	VSLb_ts_req(req, "Reset", W_TIM_real(wrk));
-+	wrk->stats->req_reset++;
-+	wrk->handling = VCL_RET_FAIL;
-+	req->req_reset = 1;
-+	return (-1);
-+}
-+
- /*--------------------------------------------------------------------
-  * Method functions to call into VCL programs.
-  *
-@@ -468,6 +503,8 @@ vcl_call_method(struct worker *wrk, struct req *req, struct busyobj *bo,
- 		CHECK_OBJ_NOTNULL(req->sp, SESS_MAGIC);
- 		CHECK_OBJ_NOTNULL(req->vcl, VCL_MAGIC);
- 		CHECK_OBJ_NOTNULL(req->top, REQTOP_MAGIC);
-+		if (req_poll(wrk, req))
-+			return;
- 		VCL_Req2Ctx(&ctx, req);
- 	}
- 	assert(ctx.now != 0);
-diff --git a/bin/varnishd/http2/cache_http2_session.c b/bin/varnishd/http2/cache_http2_session.c
-index f81c94a..f978763 100644
---- a/bin/varnishd/http2/cache_http2_session.c
-+++ b/bin/varnishd/http2/cache_http2_session.c
-@@ -439,6 +439,16 @@ h2_new_session(struct worker *wrk, void *arg)
- 	h2_del_sess(wrk, h2, h2->error->reason);
- }
- 
-+static int v_matchproto_(vtr_poll_f)
-+h2_poll(struct req *req)
-+{
-+	struct h2_req *r2;
-+
-+	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
-+	CAST_OBJ_NOTNULL(r2, req->transport_priv, H2_REQ_MAGIC);
-+	return (r2->error ? -1 : 1);
-+}
-+
- struct transport H2_transport = {
- 	.name =			"H2",
- 	.magic =		TRANSPORT_MAGIC,
-@@ -448,4 +458,5 @@ struct transport H2_transport = {
- 	.req_body =		h2_req_body,
- 	.req_fail =		h2_req_fail,
- 	.sess_panic =		h2_sess_panic,
-+	.poll =			h2_poll,
- };
-diff --git a/bin/varnishd/mgt/mgt_param_bits.c b/bin/varnishd/mgt/mgt_param_bits.c
-index d6a9c3f..6d9b32a 100644
---- a/bin/varnishd/mgt/mgt_param_bits.c
-+++ b/bin/varnishd/mgt/mgt_param_bits.c
-@@ -276,7 +276,7 @@ struct parspec VSL_parspec[] = {
- #undef DEBUG_BIT
- 		},
- 	{ "feature", tweak_feature, NULL,
--		NULL, NULL, "default",
-+		NULL, NULL, "+validate_headers +vcl_req_reset",
- 		NULL,
- 		"Enable/Disable various minor features.\n"
- 		"\tdefault\tSet default value\n"
-diff --git a/bin/varnishtest/tests/r03996.vtc b/bin/varnishtest/tests/r03996.vtc
-index 3fee370..7faf783 100644
---- a/bin/varnishtest/tests/r03996.vtc
-+++ b/bin/varnishtest/tests/r03996.vtc
-@@ -1,6 +1,7 @@
- varnishtest "h2 rapid reset"
- 
--barrier b1 sock 5
-+barrier b1 sock 2 -cyclic
-+barrier b2 sock 5 -cyclic
- 
- server s1 {
- 	rxreq
-@@ -16,7 +17,10 @@ varnish v1 -vcl+backend {
- 	import vtc;
- 
- 	sub vcl_recv {
--		vtc.barrier_sync("${b1_sock}");
-+		if (req.http.barrier) {
-+			vtc.barrier_sync(req.http.barrier);
-+		}
-+		vtc.barrier_sync("${b2_sock}");
- 	}
- 
- } -start
-@@ -27,6 +31,41 @@ client c1 {
- 		expect goaway.err == ENHANCE_YOUR_CALM
- 	} -start
- 
-+	stream 1 {
-+		txreq -hdr barrier ${b1_sock}
-+		barrier b1 sync
-+		txrst
-+	} -run
-+	stream 3 {
-+		txreq -hdr barrier ${b1_sock}
-+		barrier b1 sync
-+		txrst
-+	} -run
-+	stream 5 {
-+		txreq -hdr barrier ${b1_sock}
-+		barrier b1 sync
-+		txrst
-+	} -run
-+	stream 7 {
-+		txreq -hdr barrier ${b1_sock}
-+		barrier b1 sync
-+		txrst
-+	} -run
-+
-+	barrier b2 sync
-+	stream 0 -wait
-+} -run
-+
-+varnish v1 -expect sc_rapid_reset == 1
-+
-+varnish v1 -cliok "param.set feature -vcl_req_reset"
-+
-+client c2 {
-+	stream 0 {
-+		rxgoaway
-+		expect goaway.err == ENHANCE_YOUR_CALM
-+	} -start
-+
- 	stream 1 {
- 		txreq
- 		txrst
-@@ -44,8 +83,8 @@ client c1 {
- 		txrst
- 	} -run
- 
--	barrier b1 sync
-+	barrier b2 sync
- 	stream 0 -wait
- } -run
- 
--varnish v1 -expect sc_rapid_reset == 1
-+varnish v1 -expect sc_rapid_reset == 2
-diff --git a/bin/varnishtest/tests/t02025.vtc b/bin/varnishtest/tests/t02025.vtc
-new file mode 100644
-index 0000000..3b7e90e
---- /dev/null
-+++ b/bin/varnishtest/tests/t02025.vtc
-@@ -0,0 +1,49 @@
-+varnishtest "h2 reset interrupt"
-+
-+barrier b1 sock 2
-+barrier b2 sock 2
-+
-+varnish v1 -cliok "param.set feature +http2"
-+varnish v1 -cliok "param.set debug +syncvsl"
-+varnish v1 -vcl {
-+	import vtc;
-+
-+	backend be none;
-+
-+	sub vcl_recv {
-+		vtc.barrier_sync("${b1_sock}");
-+		vtc.barrier_sync("${b2_sock}");
-+	}
-+
-+	sub vcl_miss {
-+		vtc.panic("unreachable");
-+	}
-+} -start
-+
-+logexpect l1 -v v1 -g raw -i Debug {
-+	expect * * Debug "^H2RXF RST_STREAM"
-+} -start
-+
-+client c1 {
-+	stream 1 {
-+		txreq
-+		barrier b1 sync
-+		txrst
-+	} -run
-+} -start
-+
-+logexpect l1 -wait
-+barrier b2 sync
-+
-+varnish v1 -vsl_catchup
-+varnish v1 -expect req_reset == 1
-+
-+# NB: The varnishncsa command below shows a minimal pattern to collect
-+# "rapid reset" suspects per session, with the IP address. Here rapid
-+# is interpreted as before a second elapsed. Session VXIDs showing up
-+# numerous times become increasingly more suspicious. The format can of
-+# course be extended to add anything else useful for data mining.
-+shell -expect "1000 ${localhost}" {
-+	varnishncsa -n ${v1_name} -d \
-+		-q 'Timestamp:Reset[2] < 1.0' -F '%{VSL:Begin[2]}x %h'
-+}
-diff --git a/doc/sphinx/reference/vsl.rst b/doc/sphinx/reference/vsl.rst
-index cf63089..f1ed987 100644
---- a/doc/sphinx/reference/vsl.rst
-+++ b/doc/sphinx/reference/vsl.rst
-@@ -76,6 +76,11 @@ Resp
- Restart
- 	Client request is being restarted.
- 
-+Reset
-+        The client closed its connection, reset its stream or caused
-+        a stream error that forced Varnish to reset the stream. Request
-+        processing is interrupted and considered failed.
-+
- Pipe handling timestamps
- ~~~~~~~~~~~~~~~~~~~~~~~~
- 
-diff --git a/include/tbl/feature_bits.h b/include/tbl/feature_bits.h
-index d51b22c..3d6ac35 100644
---- a/include/tbl/feature_bits.h
-+++ b/include/tbl/feature_bits.h
-@@ -82,6 +82,11 @@ FEATURE_BIT(BUSY_STATS_RATE,	busy_stats_rate,
-     "Make busy workers comply with thread_stats_rate."
- )
- 
-+FEATURE_BIT(VCL_REQ_RESET,			vcl_req_reset,
-+    "Stop processing client VCL once the client is gone. "
-+    "When this happens MAIN.req_reset is incremented."
-+)
-+
- #undef FEATURE_BIT
- 
- /*lint -restore */
-diff --git a/include/tbl/req_flags.h b/include/tbl/req_flags.h
-index 2e82660..9e72312 100644
---- a/include/tbl/req_flags.h
-+++ b/include/tbl/req_flags.h
-@@ -41,6 +41,7 @@ REQ_FLAG(is_hitpass,		1, 0, "")
- REQ_FLAG(waitinglist,		0, 0, "")
- REQ_FLAG(want100cont,		0, 0, "")
- REQ_FLAG(late100cont,		0, 0, "")
-+REQ_FLAG(req_reset,		0, 0, "")
- #undef REQ_FLAG
- 
- /*lint -restore */

SPECS/varnish.spec

@@ -12,77 +12,47 @@
 
 %global __provides_exclude_from ^%{_libdir}/varnish/vmods
 
-%global abi 17c51b08e037fc8533fb3687a042a867235fc72f
+%global abi ed1243ca162a7b1d975bc0332f0d66d33f0bc78e
-%global vrt 13.0
+%global vrt 20.0
 
 # Package scripts are now external
 # https://github.com/varnishcache/pkg-varnish-cache
-%global commit1 ec7ad9e6c6dd7c9b4f4ba60c5b223376908c3ca6
+%global commit1 7d90347be31891b338dededb318594cebb668ba7
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
+# Default: Use jemalloc, as adviced by upstream project
+# Change to 1 to use system allocator (ie. glibc)
+%if 0%{?rhel}
+%bcond_without system_allocator
+%else
+%bcond_with system_allocator
+%endif
+
+%if %{with system_allocator}
+# use _lto_cflags if present
+%else
+%global _lto_cflags %{nil}
+%endif
+
 Summary: High-performance HTTP accelerator
 Name: varnish
-Version: 6.6.2
+Version: 7.6.0
-Release: 4%{?dist}.1
+Release: 3%{?dist}
-License: BSD
+License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
 Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
 Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
 
-# Patches:
+%if 0%{?fedora} > 29 || 0%{?rhel} > 7
-# Patch  001: Because of Fedora's libtool no-rpath requirement, it is still
-#             necessary to add LD_LIBRARY_PATH when building the documentation
-#             (Fixed by using LT_SYS_LIBRARY_PATH)
-#Patch1:  varnish-6.1.1_fix_ld_library_path_in_doc_build.patch
-
-# Patch  004: varnish selinux support for el6
-#Patch4:  varnish-4.0.3_fix_varnish4_selinux.el6.patch
-
-# Patch  009: Hard code older python support in configure for older el releases
-#Patch9:  varnish-5.1.1.fix_python_version.patch
-
-# Patch  012: Fix test for variants of ncurses, based on upstream commit 9bdc5f75, upstream issue #2668
-#Patch12: varnish-6.0.1_fix_bug2668.patch
-
-# Patch  013: Just a simple format error
-#Patch13: varnish-6.1.0_fix_testu00008.patch
-
-# Patch  014: Another formatting error fixed upstream, issue 2879
-#Patch14: varnish-6.1.1_fix_upstrbug_2879.patch
-
-# Patch  015: pcre-jit fixed upstream, issue #2912
-#Patch15: varnish-6.1.1_fix_issue_2912.patch
-
-# Patch  016: Fix some warnings that prohibited clean -Werror compilation
-#             on el6. Will not be fixed upstream. Patch grows more stupid
-#             for each iteration :-(
-#Patch16: varnish-6.5.0_el6_fix_warning_from_old_gcc.patch
-
-# Patch  017: Fix stack size on ppc64 in test c_00057, upstream commit 88948d9
-#Patch17: varnish-6.2.0_fix_ppc64_for_test_c00057.patch
-
-# Patch 018: gcc-10.0.1/s390x compilation fix, upstream commit b0af060
-#Patch18: varnish-6.3.2_fix_s390x.patch
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=2141844
-Patch100: varnish-6.6.2-CVE-2022-45060.patch
-
-# https://issues.redhat.com/browse/RHEL-12817
-Patch101: varnish-6.6.2-CVE-2023-44487-rate_limit.patch
-
-# https://issues.redhat.com/browse/RHEL-12817
-Patch102: varnish-6.6.2-CVE-2023-44487-vcl_vrt.patch
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=2271486
-Patch103: varnish-6.6.2-CVE-2024-30156.patch
-
-%if 0%{?fedora} > 29
 Provides: varnish%{_isa} = %{version}-%{release}
 Provides: varnishd(abi)%{_isa} = %{abi}
 Provides: varnishd(vrt)%{_isa} = %{vrt}
 
 Provides: vmod(blob)%{_isa} = %{version}-%{release}
+Provides: vmod(cookie)%{_isa} = %{version}-%{release}
+Provides: vmod(debug)%{_isa} = %{version}-%{release}
 Provides: vmod(directors)%{_isa} = %{version}-%{release}
+Provides: vmod(h2)%{_isa} = %{version}-%{release}
 Provides: vmod(proxy)%{_isa} = %{version}-%{release}
 Provides: vmod(purge)%{_isa} = %{version}-%{release}
 Provides: vmod(std)%{_isa} = %{version}-%{release}
@@ -90,46 +60,53 @@ Provides: vmod(unix)%{_isa} = %{version}-%{release}
 Provides: vmod(vtc)%{_isa} = %{version}-%{release}
 %endif
 
-Obsoletes: varnish-libs < %{version}-%{release}
 
 %if 0%{?rhel} == 7
 BuildRequires: python34 python34-sphinx python34-docutils
 %else
 BuildRequires: python3, python3-sphinx, python3-docutils
 %endif
-# Drop jemalloc dependency in RHEL-9
+BuildRequires: gcc
-# BuildRequires: jemalloc-devel
+%if %{with system_allocator}
+# use glibc
+%else
+%ifnarch aarch64
+BuildRequires: jemalloc-devel
+%endif
+%endif
+
 BuildRequires: libedit-devel
+BuildRequires: make
 BuildRequires: ncurses-devel
-BuildRequires: pcre-devel
+BuildRequires: pcre2-devel
 BuildRequires: pkgconfig
-BuildRequires: gcc
+BuildRequires: systemd-units
-BuildRequires: make
 
 # Extra requirements for the build suite
+#   needs haproxy2
+%if 0%{?fedora} > 30 || 0%{?rhel} > 8
+BuildRequires: haproxy
+%endif
 BuildRequires: nghttp2
 
-# haproxy is broken in rawhide now
+# Varnish actually needs gcc installed to work. It uses the C compiler
-#if 0#{?fedora} || 0#{?rhel} >= 8
+# at runtime to compile the VCL configuration files. This is by design.
-#BuildRequires: haproxy
+Requires: gcc
-#endif
-
 Requires: logrotate
 Requires: ncurses
-Requires: pcre
+Requires: pcre2
-# Drop jemalloc dependency in RHEL-9
-# Requires: jemalloc
 Requires: redhat-rpm-config
 Requires(pre): shadow-utils
 Requires(post): /usr/bin/uuidgen
-# Varnish actually needs gcc installed to work. It uses the C compiler 
-# at runtime to compile the VCL configuration files. This is by design.
-Requires: gcc
 Requires(post): systemd-units
 Requires(post): systemd-sysv
 Requires(preun): systemd-units
 Requires(postun): systemd-units
-BuildRequires: systemd-units
+%if %{with system_allocator}
+# use glibc
+%else
+Requires: jemalloc
+%endif
 
 %description
 This is Varnish Cache, a high-performance HTTP accelerator.
@@ -154,6 +131,7 @@ Requires: python3
 %description devel
 Development files for %{name}
 Varnish Cache is a high-performance HTTP accelerator
+
 %package docs
 Summary: Documentation files for %name
 
@@ -168,23 +146,29 @@ ln -s pkg-varnish-cache-%{commit1}/debian debian
 cp redhat/find-provides .
 sed -i 's,rst2man-3.6,rst2man-3.4,g; s,rst2html-3.6,rst2html-3.4,g; s,phinx-build-3.6,phinx-build-3.4,g' configure
 
-%patch100 -p1 -b .CVE-2022-45060
-%patch101 -p1 -b .CVE-2023-44487
-%patch102 -p1 -b .CVE-2023-44487-vcl
-%patch103 -p1 -b .CVE-2024-30156
-
 %build
+%if %{with system_allocator}
+export CFLAGS="%{optflags}"
+%else
+# nilled _lto_cflags above because they remove the deps on jemalloc.
+# On the fedoras, _lto_cflags is -flto=auto and -ffat-lto-objects. The latter is OK.
+export CFLAGS="%{optflags} -ffat-lto-objects"
+%endif
+
 # https://gcc.gnu.org/wiki/FAQ#PR323
 %ifarch %ix86
 %if 0%{?fedora} > 21
-export CFLAGS="%{optflags} -ffloat-store -fexcess-precision=standard"
+export CFLAGS="$CFLAGS -ffloat-store -fexcess-precision=standard"
 %endif
 %endif
 
 %ifarch s390x
-export CFLAGS="%{optflags} -Wno-error=free-nonheap-object"
+export CFLAGS="$CFLAGS -Wno-error=free-nonheap-object"
 %endif
 
+# What platform is this
+uname -a
+
 # What gcc version is this?
 gcc --version
 
@@ -199,11 +183,18 @@ export PYTHON=%{__python}
 %configure LT_SYS_LIBRARY_PATH=%_libdir \
  --disable-static \
   --localstatedir=/var/lib  \
+  --with-contrib \
   --docdir=%{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} \
-  --without-jemalloc \
+%ifarch %ix86
-#  --disable-pcre-jit \
+%if 0%{?fedora} <= 37
+  --enable-pcre2-jit=no \
+%endif
+%endif
+%if %{with system_allocator}
+  --with-jemalloc=no \
+%endif
 
-make %{?_smp_mflags} V=1 
+%make_build
 
 # One varnish user is enough
 sed -i 's,User=varnishlog,User=varnish,g;' redhat/varnishncsa.service
@@ -213,16 +204,18 @@ rm -rf doc/html/_sources
 
 %check
 
-# Remove this for now. Hard to get the size and timing right
+# Up the stack size in tests, necessary on secondary arches
-%ifarch s390 s390x aarch64
+sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/varnishtest/tests/*.vtc
-rm bin/varnishtest/tests/o00005.vtc
+sed -i 's/file,2M/file,8M/' bin/varnishtest/tests/r04036.vtc
-%endif
-# disable test because of CVE-2023-44487 fix
-# https://github.com/varnishcache/varnish-cache/pull/3998#issuecomment-1764649216
-rm bin/varnishtest/tests/t02014.vtc
-
-make %{?_smp_mflags} check VERBOSE=1
 
+# Just a hack to avoid too high load on secondary arch builders
+%ifarch s390x ppc64le
+# This works when ran alone, but not in the whole suite. Load and/or timing issues
+rm bin/varnishtest/tests/t02014.vtc
+make -j2 check
+%else
+#make_build check
+%endif
 
 %install
 rm -rf %{buildroot}
@@ -251,7 +244,7 @@ install -D -m 0644 redhat/varnish.service %{buildroot}%{_unitdir}/varnish.servic
 install -D -m 0644 redhat/varnishncsa.service %{buildroot}%{_unitdir}/varnishncsa.service
 install -D -m 0755 redhat/varnishreload %{buildroot}%{_sbindir}/varnishreload
 
-echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/varnish-%{_arch}.conf
+echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 # No idea why these ends up with mode 600 in the debug package
 %if 0%{debug_package}
@@ -259,12 +252,11 @@ chmod 644 lib/libvmod_*/*.c
 chmod 644 lib/libvmod_*/*.h
 %endif
 
-
 %files
 %{_sbindir}/*
 %{_bindir}/*
 %{_libdir}/*.so.*
-%{_libdir}/varnish
+%{_libdir}/%{name}
 %{_var}/lib/varnish
 %attr(0700,varnish,varnish) %dir %{_var}/log/varnish
 %{_mandir}/man1/*.1*
@@ -276,7 +268,7 @@ chmod 644 lib/libvmod_*/*.h
 %dir %{_sysconfdir}/varnish/
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
 %config(noreplace) %{_sysconfdir}/logrotate.d/varnish
-%config %{_sysconfdir}/ld.so.conf.d/varnish-%{_arch}.conf
+%config %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 
 %{_unitdir}/varnish.service
@@ -298,10 +290,11 @@ chmod 644 lib/libvmod_*/*.h
 
 
 %pre
-getent group varnish >/dev/null || groupadd -r varnish
+getent group varnish >/dev/null ||
-getent passwd varnish >/dev/null || \
+groupadd -r varnish
-       useradd -r -g varnish -d /var/lib/varnish -s /sbin/nologin \
+getent passwd varnish >/dev/null ||
-               -c "Varnish Cache" varnish
+useradd -r -g varnish -d /var/lib/varnish -s /sbin/nologin \
+	-c "Varnish Cache" varnish
 exit 0
 
 
@@ -320,36 +313,123 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
-* Sat Mar 30 2024 Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-4.1
+* Tue Nov 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 7.6.0-3
-- Resolves: RHEL-30387 - varnish: HTTP/2 Broken Window Attack may result
+- Resolves: RHEL-59267 - varnish rebase to 7.6.0
-  in denial of service (CVE-2024-30156)
+- Resolves: RHEL-30333 CVE-2024-30156 varnish: HTTP/2 Broken Window
+  Attack may result in denial of service
 
-* Thu Oct 19 2023 Tomas Korbar <tkorbar@redhat.com> - 6.6.2-4
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 7.4.2-5
-- Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487
+- Bump release for October 2024 mass rebuild:
-- Resolves: RHEL-12817
+  Resolves: RHEL-64018
 
-* Mon Dec 05 2022 Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-3
+* Tue Jul 16 2024 Joe Orton <jorton@redhat.com> - 7.4.2-4
-- Resolves: #2142096 - CVE-2022-45060 varnish: Request Forgery Vulnerability
+- rebuild
 
-* Thu Feb 17 2022 Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-2
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 7.4.2-3
-- new version 6.6.2
+- Bump release for June 2024 mass rebuild
-- Resolves: #2007641 - rebase Varnish to 6.6.2
 
-* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 6.5.2-2
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.4.2-2
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-  Related: rhbz#1991688
+
+* Wed Nov 08 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
+- New upstream release. A security release
+- Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack
+
+* Thu Oct 12 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.1-1
+- New upstream release. A bugfix release
+
+* Wed Oct 11 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.0-0
+- New upstream release
+
+* Thu Sep 14 2023 Luboš Uhliarik <luhliari@redhat.com> - 7.3.0-5
+- SPDX migration
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Fri Jun 23 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 7.3.0-3
+- Enable system_allocator in RHEL/ELN builds
+
+* Mon Mar 20 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.3.0-2
+- Switched from bcond to bcond_with for compatibility with el8 and el9
+- haproxy builddep on systems with haproxy2
+- Disable pcre2-jit only for fedora <= 37 on 32bit x86
+
+* Thu Mar 16 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.3.0-1
+- New upstream release
+- Added a bcond system_allocator for skipping jemalloc, bz#1917697
+- nil _lto_cflags macro to link to jemalloc again
+- disable pcre2-jit on 32bit x86 for now
 
-* Wed Jul 21 2021 Luboš Uhliarik <luhliari@redhat.com> - 6.5.2-1
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.2.1-2
-- new version 6.5.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-- Resolves: #1984185 - Rebase varnish to 6.5.2
-- Resolves: #1982858 - CVE-2021-36740 varnish: HTTP/2 request smuggling attack
-  via a large Content-Length header for a POST request 
 
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 6.5.1-5
+* Wed Nov 09 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.2.1-1
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+- New upstream release: A security release
+- Includes fix for VSV00011
+
+* Fri Sep 16 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.2.0-1
+- New upstream release. The regular bi-annual "fresh" release
+- Removed list of patches from comments
+- Cosmetical changes to specfile from upstream
+- Now build with --with-contrib
+
+* Fri Aug 12 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.1.1-1
+- New upstream release. A security release
+- Includes fix for VSV00009 aka CVE-2022-38150
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.1.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue Mar 29 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.1.0-1
+- New upstream release
+- Includes updated snapshot of pkg-varnish
+
+* Mon Feb 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 7.0.2-2
+- Fix Provides directive for varnish-devel package
+
+* Wed Jan 26 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.2-1
+- New upstream release. A security release
+- Includes fix for CVE-2022-23959 aka VSV00008, rhbz#2045033
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.0.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jan 13 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.1-2
+- Update ABI string
+
+* Thu Jan 13 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.1-1
+- New upstream release. A maintenance and stability release
+
+* Tue Nov 02 2021 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.0-2
+- upstream switched to pcre2 a while ago
+
+* Thu Sep 16 2021 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.0-1
+- New upstream release
+- Updated pkg-varnish checkout from the 7.0 branch
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 6.6.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Sat Jul 17 2021 Ingvar Hagelund <ingvar@redpill-linpro.com> 6.6.1-2
+- Bumped abi and vrt versions
+
+* Sat Jul 17 2021 Ingvar Hagelund <ingvar@redpill-linpro.com> 6.6.1-1
+- New upstream release
+- Includes fix for CVE-2021-36740 aka VSV00007, bz#1982413
+
+* Tue May 18 2021 Timm Bäder <tbaeder@redhat.com> - 6.6.0-2
+- Use make macros
+
+* Mon Mar 15 2021 Ingvar Hagelund <ingvar@redpill-linpro.com> - 6.6.0-1
+- New upstream release
+- Now provides vmod_purge
+- Uses haproxy in the test suite on el8
+- Skipped obsoleting varnish-libs. That was many years ago now.
 
-* Wed Feb 24 2021 Lubos Uhliarik <luhliari@redhat.com> - 6.5.1-4
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 6.5.1-4
-- Resolves: #1918406 - Drop jemalloc dependency in RHEL 9
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
 
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 6.5.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild