FreeBSD Bugzilla – Attachment 217500 Details for
Bug 248856
www/squid: Update to 4.13
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
port patch new
squid-4.13.patch (text/plain), 8.86 KB, created by
Pavel Timofeev
on 2020-08-24 19:15:44 UTC
(
hide
)
Description:
port patch new
Filename:
MIME Type:
Creator:
Pavel Timofeev
Created:
2020-08-24 19:15:44 UTC
Size:
8.86 KB
patch
obsolete
>Index: Makefile >=================================================================== >--- Makefile (revision 545830) >+++ Makefile (working copy) >@@ -1,20 +1,23 @@ > # $FreeBSD$ > > PORTNAME= squid >-PORTVERSION= 4.12 >+PORTVERSION= 4.13 > CATEGORIES= www >-MASTER_SITES= http://www.squid-cache.org/Versions/v4/ \ >- http://www2.us.squid-cache.org/Versions/v4/ \ >- http://www1.at.squid-cache.org/Versions/v4/ \ >- http://www.eu.squid-cache.org/Versions/v4/ \ >- http://www1.jp.squid-cache.org/Versions/v4/ >+MASTER_SITES= http://www2.pl.squid-cache.org/Versions/v4/ \ >+ http://ca.squid-cache.org/Versions/v4/ \ >+ http://www1.il.squid-cache.org/Versions/v4/ \ >+ http://www1.jp.squid-cache.org/Versions/v4/ \ >+ http://www2.gr.squid-cache.org/Versions/v4/ \ >+ http://ca2.squid-cache.org/Versions/v4/ \ >+ http://www.squid-cache.org/Versions/v4/ > >-PATCH_SITES= http://www.squid-cache.org/%SUBDIR%/ \ >- http://www2.us.squid-cache.org/%SUBDIR%/ \ >- http://www1.at.squid-cache.org/%SUBDIR%/ \ >- http://www.eu.squid-cache.org/%SUBDIR%/ \ >+PATCH_SITES= http://www2.pl.squid-cache.org/%SUBDIR%/ \ >+ http://ca.squid-cache.org/%SUBDIR%/ \ >+ http://www1.il.squid-cache.org/%SUBDIR%/ \ > http://www1.jp.squid-cache.org/%SUBDIR%/ \ >- http://master.squid-cache.org/~amosjeffries/patches/:nosid >+ http://www2.gr.squid-cache.org/%SUBDIR%/ \ >+ http://ca2.squid-cache.org/%SUBDIR%/ \ >+ http://www.squid-cache.org/%SUBDIR%/ > PATCH_SITE_SUBDIR= Versions/v4/changesets > > MAINTAINER= timp87@gmail.com >Index: distinfo >=================================================================== >--- distinfo (revision 545830) >+++ distinfo (working copy) >@@ -1,3 +1,3 @@ >-TIMESTAMP = 1592288810 >-SHA256 (squid-4.12.tar.xz) = f42a03c8b3dc020722c88bf1a87da8cb0c087b2f66b41d8256c77ee1b527e317 >-SIZE (squid-4.12.tar.xz) = 2450564 >+TIMESTAMP = 1598206369 >+SHA256 (squid-4.13.tar.xz) = 6891a0f540e60779b4f24f1802a302f813c6f473ec7336a474ed68c3e2e53ee0 >+SIZE (squid-4.13.tar.xz) = 2452752 >Index: files/patch-src_security_Handshake.cc >=================================================================== >--- files/patch-src_security_Handshake.cc (revision 545830) >+++ files/patch-src_security_Handshake.cc (nonexistent) >@@ -1,147 +0,0 @@ >---- src/security/Handshake.cc.orig 2020-06-07 15:42:16 UTC >-+++ src/security/Handshake.cc >-@@ -9,6 +9,7 @@ >- /* DEBUG: section 83 SSL-Bump Server/Peer negotiation */ >- >- #include "squid.h" >-+#include "sbuf/Stream.h" >- #include "security/Handshake.h" >- #if USE_OPENSSL >- #include "ssl/support.h" >-@@ -104,25 +105,52 @@ class Extension (public) >- typedef std::unordered_set<Extension::Type> Extensions; >- static Extensions SupportedExtensions(); >- >--} // namespace Security >-- >- /// parse TLS ProtocolVersion (uint16) and convert it to AnyP::ProtocolVersion >-+/// \retval PROTO_NONE for unsupported values (in relaxed mode) >- static AnyP::ProtocolVersion >--ParseProtocolVersion(Parser::BinaryTokenizer &tk, const char *contextLabel = ".version") >-+ParseProtocolVersionBase(Parser::BinaryTokenizer &tk, const char *contextLabel, const bool beStrict) >- { >- Parser::BinaryTokenizerContext context(tk, contextLabel); >- uint8_t vMajor = tk.uint8(".major"); >- uint8_t vMinor = tk.uint8(".minor"); >-+ >- if (vMajor == 0 && vMinor == 2) >- return AnyP::ProtocolVersion(AnyP::PROTO_SSL, 2, 0); >- >-- Must(vMajor == 3); >-- if (vMinor == 0) >-- return AnyP::ProtocolVersion(AnyP::PROTO_SSL, 3, 0); >-+ if (vMajor == 3) { >-+ if (vMinor == 0) >-+ return AnyP::ProtocolVersion(AnyP::PROTO_SSL, 3, 0); >-+ return AnyP::ProtocolVersion(AnyP::PROTO_TLS, 1, (vMinor - 1)); >-+ } >- >-- return AnyP::ProtocolVersion(AnyP::PROTO_TLS, 1, (vMinor - 1)); >-+ /* handle unsupported versions */ >-+ >-+ const uint16_t vRaw = (vMajor << 8) | vMinor; >-+ debugs(83, 7, "unsupported: " << asHex(vRaw)); >-+ if (beStrict) >-+ throw TextException(ToSBuf("unsupported TLS version: ", asHex(vRaw)), Here()); >-+ // else hide unsupported version details from the caller behind PROTO_NONE >-+ return AnyP::ProtocolVersion(); >- } >- >-+/// parse a framing-related TLS ProtocolVersion >-+/// \returns a supported SSL or TLS Anyp::ProtocolVersion, never PROTO_NONE >-+static AnyP::ProtocolVersion >-+ParseProtocolVersion(Parser::BinaryTokenizer &tk) >-+{ >-+ return ParseProtocolVersionBase(tk, ".version", true); >-+} >-+ >-+/// parse a framing-unrelated TLS ProtocolVersion >-+/// \retval PROTO_NONE for unsupported values >-+static AnyP::ProtocolVersion >-+ParseOptionalProtocolVersion(Parser::BinaryTokenizer &tk, const char *contextLabel) >-+{ >-+ return ParseProtocolVersionBase(tk, contextLabel, false); >-+} >-+ >-+} // namespace Security >-+ >- Security::TLSPlaintext::TLSPlaintext(Parser::BinaryTokenizer &tk) >- { >- Parser::BinaryTokenizerContext context(tk, "TLSPlaintext"); >-@@ -431,6 +459,8 @@ Security::HandshakeParser::parseExtensions(const SBuf >- break; >- case 16: { // Application-Layer Protocol Negotiation Extension, RFC 7301 >- Parser::BinaryTokenizer tkAPN(extension.data); >-+ // Store the entire protocol list, including unsupported-by-Squid >-+ // values (if any). We have to use all when peeking at the server. >- details->tlsAppLayerProtoNeg = tkAPN.pstring16("APN"); >- break; >- } >-@@ -441,8 +471,9 @@ Security::HandshakeParser::parseExtensions(const SBuf >- case 43: // supported_versions extension; RFC 8446 >- parseSupportedVersionsExtension(extension.data); >- break; >-- case 13172: // Next Protocol Negotiation Extension (expired draft?) >- default: >-+ // other extensions, including those that Squid does not support, do >-+ // not require special handling here, but see unsupportedExtensions >- break; >- } >- } >-@@ -455,7 +486,7 @@ Security::HandshakeParser::parseCiphers(const SBuf &ra >- Parser::BinaryTokenizer tk(raw); >- while (!tk.atEnd()) { >- const uint16_t cipher = tk.uint16("cipher"); >-- details->ciphers.insert(cipher); >-+ details->ciphers.insert(cipher); // including Squid-unsupported ones >- } >- } >- >-@@ -473,7 +504,7 @@ Security::HandshakeParser::parseV23Ciphers(const SBuf >- const uint8_t prefix = tk.uint8("prefix"); >- const uint16_t cipher = tk.uint16("cipher"); >- if (prefix == 0) >-- details->ciphers.insert(cipher); >-+ details->ciphers.insert(cipher); // including Squid-unsupported ones >- } >- } >- >-@@ -486,6 +517,7 @@ Security::HandshakeParser::parseServerHelloHandshakeMe >- details->tlsSupportedVersion = ParseProtocolVersion(tk); >- tk.skip(HelloRandomSize, ".random"); >- details->sessionId = tk.pstring8(".session_id"); >-+ // cipherSuite may be unsupported by a peeking Squid >- details->ciphers.insert(tk.uint16(".cipher_suite")); >- details->compressionSupported = tk.uint8(".compression_method") != 0; // not null >- if (!tk.atEnd()) // extensions present >-@@ -554,12 +586,15 @@ Security::HandshakeParser::parseSupportedVersionsExten >- Parser::BinaryTokenizer tkList(extensionData); >- Parser::BinaryTokenizer tkVersions(tkList.pstring8("SupportedVersions")); >- while (!tkVersions.atEnd()) { >-- const auto version = ParseProtocolVersion(tkVersions, "supported_version"); >-+ const auto version = ParseOptionalProtocolVersion(tkVersions, "supported_version"); >-+ // ignore values unsupported by Squid,represented by a falsy version >-+ if (!version) >-+ continue; >- if (!supportedVersionMax || TlsVersionEarlierThan(supportedVersionMax, version)) >- supportedVersionMax = version; >- } >- >-- // ignore empty supported_versions >-+ // ignore empty and ignored-values-only supported_versions >- if (!supportedVersionMax) >- return; >- >-@@ -569,7 +604,11 @@ Security::HandshakeParser::parseSupportedVersionsExten >- } else { >- assert(messageSource == fromServer); >- Parser::BinaryTokenizer tkVersion(extensionData); >-- const auto version = ParseProtocolVersion(tkVersion, "selected_version"); >-+ const auto version = ParseOptionalProtocolVersion(tkVersion, "selected_version"); >-+ // Ignore values unsupported by Squid. There should not be any until we >-+ // start seeing TLS v2+, but they do not affect TLS framing anyway. >-+ if (!version) >-+ return; >- // RFC 8446 Section 4.2.1: >- // A server which negotiates a version of TLS prior to TLS 1.3 [...] >- // MUST NOT send the "supported_versions" extension. > >Property changes on: files/patch-src_security_Handshake.cc >___________________________________________________________________ >Deleted: fbsd:nokeywords >## -1 +0,0 ## >-yes >\ No newline at end of property >Deleted: svn:eol-style >## -1 +0,0 ## >-native >\ No newline at end of property >Deleted: svn:mime-type >## -1 +0,0 ## >-text/plain >\ No newline at end of property
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=217500">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Flags:
timp87
:
maintainer-approval+
Actions:
View
|
Diff
Attachments on
bug 248856
:
217461
| 217500