43 changed files with 4184 additions and 2129 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1 @@
-SOURCES/pgp.asc
+SOURCES/squid-4.15.tar.xz
 SOURCES/squid-5.5.tar.xz
--- a/.squid.metadata
+++ b/.squid.metadata
@ -1,2 +1 @@
-8e3de63f3bef0c9c4edbcfe000c567119f687143 SOURCES/pgp.asc
+60bda34ba39657e2d870c8c1d2acece8a69c3075 SOURCES/squid-4.15.tar.xz
 42302bd9b8feff851a41420334cb8eaeab2806ab SOURCES/squid-5.5.tar.xz
--- a/SOURCES/cache_swap.sh
+++ b/SOURCES/cache_swap.sh
@ -5,17 +5,12 @@ fi
 SQUID_CONF=${SQUID_CONF:-"/etc/squid/squid.conf"}
-CACHE_SWAP=`awk '/^[[:blank:]]*cache_dir/ { print $3 }' "$SQUID_CONF"`
+CACHE_SWAP=`sed -e 's/#.*//g' $SQUID_CONF | \
 	grep cache_dir | awk '{ print $3 }'`
 init_cache_dirs=0
 for adir in $CACHE_SWAP; do
 	if [ ! -d $adir/00 ]; then
 		echo -n "init_cache_dir $adir... "
-		init_cache_dirs=1
+		squid -N -z -F -f $SQUID_CONF >> /var/log/squid/squid.out 2>&1
 	fi
 done
 if [ $init_cache_dirs -ne 0 ]; then
 	echo ""
 	squid --foreground -z -f "$SQUID_CONF" >> /var/log/squid/squid.out 2>&1
 fi
--- a/SOURCES/squid-3.5.9-include-guards.patch
+++ b/SOURCES/squid-3.5.9-include-guards.patch
@ -1,95 +0,0 @@
 ------------------------------------------------------------
 revno: 14311
 revision-id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4
 parent: squid3@treenet.co.nz-20150924032241-6cx3g6hwz9xfoybr
 ------------------------------------------------------------
 revno: 14311
 revision-id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4
 parent: squid3@treenet.co.nz-20150924032241-6cx3g6hwz9xfoybr
 fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4323
 author: Francesco Chemolli <kinkie@squid-cache.org>
 committer: Amos Jeffries <squid3@treenet.co.nz>
 branch nick: trunk
 timestamp: Thu 2015-09-24 06:05:37 -0700
 message:
  Bug 4323: Netfilter broken cross-includes with Linux 4.2
 ------------------------------------------------------------
 # Bazaar merge directive format 2 (Bazaar 0.90)
 # revision_id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4
 # target_branch: http://bzr.squid-cache.org/bzr/squid3/trunk/
 # testament_sha1: c67cfca81040f3845d7c4caf2f40518511f14d0b
 # timestamp: 2015-09-24 13:06:33 +0000
 # source_branch: http://bzr.squid-cache.org/bzr/squid3/trunk
 # base_revision_id: squid3@treenet.co.nz-20150924032241-\
 #   6cx3g6hwz9xfoybr
 # 
 # Begin patch
 === modified file 'compat/os/linux.h'
 --- compat/os/linux.h	2015-01-13 07:25:36 +0000
 +++ compat/os/linux.h	2015-09-24 13:05:37 +0000
@@ -30,6 +30,21 @@
 #endif
 /*
 + * Netfilter header madness. (see Bug 4323)
 + *
 + * Netfilter have a history of defining their own versions of network protocol
 + * primitives without sufficient protection against the POSIX defines which are
 + * aways present in Linux.
 + *
 + * netinet/in.h must be included before any other sys header in order to properly
 + * activate include guards in <linux/libc-compat.h> the kernel maintainers added
 + * to workaround it.
 + */
 +#if HAVE_NETINET_IN_H
 +#include <netinet/in.h>
 +#endif
 +
 +/*
  * sys/capability.h is only needed in Linux apparently.
  *
  * HACK: LIBCAP_BROKEN Ugly glue to get around linux header madness colliding with glibc
 fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4323
 author: Francesco Chemolli <kinkie@squid-cache.org>
 committer: Amos Jeffries <squid3@treenet.co.nz>
 branch nick: trunk
 timestamp: Thu 2015-09-24 06:05:37 -0700
 message:
  Bug 4323: Netfilter broken cross-includes with Linux 4.2
 ------------------------------------------------------------
 # Bazaar merge directive format 2 (Bazaar 0.90)
 # revision_id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4
 # target_branch: http://bzr.squid-cache.org/bzr/squid3/trunk/
 # testament_sha1: c67cfca81040f3845d7c4caf2f40518511f14d0b
 # timestamp: 2015-09-24 13:06:33 +0000
 # source_branch: http://bzr.squid-cache.org/bzr/squid3/trunk
 # base_revision_id: squid3@treenet.co.nz-20150924032241-\
 #   6cx3g6hwz9xfoybr
 # 
 # Begin patch
 === modified file 'compat/os/linux.h'
 --- compat/os/linux.h	2015-01-13 07:25:36 +0000
 +++ compat/os/linux.h	2015-09-24 13:05:37 +0000
@@ -30,6 +30,21 @@
 #endif
 /*
 + * Netfilter header madness. (see Bug 4323)
 + *
 + * Netfilter have a history of defining their own versions of network protocol
 + * primitives without sufficient protection against the POSIX defines which are
 + * aways present in Linux.
 + *
 + * netinet/in.h must be included before any other sys header in order to properly
 + * activate include guards in <linux/libc-compat.h> the kernel maintainers added
 + * to workaround it.
 + */
 +#if HAVE_NETINET_IN_H
 +#include <netinet/in.h>
 +#endif
 +
 +/*
  * sys/capability.h is only needed in Linux apparently.
  *
  * HACK: LIBCAP_BROKEN Ugly glue to get around linux header madness colliding with glibc
--- a/SOURCES/squid-5.0.6-active-ftp.patch
+++ b/SOURCES/squid-5.0.6-active-ftp.patch
@ -1,8 +1,8 @@
 diff --git a/src/clients/FtpClient.cc b/src/clients/FtpClient.cc
-index 747ed35..f2b7126 100644
+index b665bcf..d287e55 100644
 --- a/src/clients/FtpClient.cc
 +++ b/src/clients/FtpClient.cc
-@@ -795,7 +795,8 @@ Ftp::Client::connectDataChannel()
+@@ -778,7 +778,8 @@ Ftp::Client::connectDataChannel()
 bool
 Ftp::Client::openListenSocket()
 {
@ -13,10 +13,10 @@ index 747ed35..f2b7126 100644
 /// creates a data channel Comm close callback
 diff --git a/src/clients/FtpClient.h b/src/clients/FtpClient.h
-index eb5ea1b..e92c007 100644
+index a76a5a0..218d696 100644
 --- a/src/clients/FtpClient.h
 +++ b/src/clients/FtpClient.h
-@@ -137,7 +137,7 @@ public:
+@@ -118,7 +118,7 @@ public:
     bool sendPort();
     bool sendPassive();
     void connectDataChannel();
@ -26,10 +26,10 @@ index eb5ea1b..e92c007 100644
     CtrlChannel ctrl; ///< FTP control channel state
 diff --git a/src/clients/FtpGateway.cc b/src/clients/FtpGateway.cc
-index 05db817..2989cd2 100644
+index 411bce9..31d3e36 100644
 --- a/src/clients/FtpGateway.cc
 +++ b/src/clients/FtpGateway.cc
-@@ -86,6 +86,13 @@ struct GatewayFlags {
+@@ -87,6 +87,13 @@ struct GatewayFlags {
 class Gateway;
 typedef void (StateMethod)(Ftp::Gateway *);
@ -43,7 +43,7 @@ index 05db817..2989cd2 100644
 /// FTP Gateway: An FTP client that takes an HTTP request with an ftp:// URI,
 /// converts it into one or more FTP commands, and then
 /// converts one or more FTP responses into the final HTTP response.
-@@ -136,7 +143,11 @@ public:
+@@ -137,7 +144,11 @@ public:
     /// create a data channel acceptor and start listening.
     void listenForDataChannel(const Comm::ConnectionPointer &conn);
@ -56,7 +56,7 @@ index 05db817..2989cd2 100644
     int checkAuth(const HttpHeader * req_hdr);
     void checkUrlpath();
     void buildTitleUrl();
-@@ -1786,6 +1797,7 @@ ftpOpenListenSocket(Ftp::Gateway * ftpState, int fallback)
+@@ -1787,6 +1798,7 @@ ftpOpenListenSocket(Ftp::Gateway * ftpState, int fallback)
     }
     ftpState->listenForDataChannel(temp);
@ -64,7 +64,7 @@ index 05db817..2989cd2 100644
 }
 static void
-@@ -1821,13 +1833,19 @@ ftpSendPORT(Ftp::Gateway * ftpState)
+@@ -1822,13 +1834,19 @@ ftpSendPORT(Ftp::Gateway * ftpState)
     // pull out the internal IP address bytes to send in PORT command...
     // source them from the listen_conn->local
@ -86,7 +86,7 @@ index 05db817..2989cd2 100644
     ftpState->writeCommand(cbuf);
     ftpState->state = Ftp::Client::SENT_PORT;
-@@ -1880,14 +1898,27 @@ ftpSendEPRT(Ftp::Gateway * ftpState)
+@@ -1881,14 +1899,27 @@ ftpSendEPRT(Ftp::Gateway * ftpState)
         return;
     }
@ -116,7 +116,7 @@ index 05db817..2989cd2 100644
     ftpState->writeCommand(cbuf);
     ftpState->state = Ftp::Client::SENT_EPRT;
-@@ -1906,7 +1937,7 @@ ftpReadEPRT(Ftp::Gateway * ftpState)
+@@ -1907,7 +1938,7 @@ ftpReadEPRT(Ftp::Gateway * ftpState)
         ftpSendPORT(ftpState);
         return;
     }
--- a/SOURCES/squid-4.0.11-config.patch
+++ b/SOURCES/squid-4.0.11-config.patch
@ -1,7 +1,8 @@
-diff -up squid-4.0.11/src/cf.data.pre.config squid-4.0.11/src/cf.data.pre
+diff --git a/src/cf.data.pre b/src/cf.data.pre
--- squid-4.0.11/src/cf.data.pre.config	2016-06-09 22:32:57.000000000 +0200
+index 26ef576..30d5509 100644
-+++ squid-4.0.11/src/cf.data.pre	2016-07-11 21:08:35.090976840 +0200
+--- a/src/cf.data.pre
-@@ -4658,7 +4658,7 @@ DOC_END
+++ b/src/cf.data.pre
@@ -5006,7 +5006,7 @@ DOC_END
 NAME: logfile_rotate
 TYPE: int
@ -10,7 +11,7 @@ diff -up squid-4.0.11/src/cf.data.pre.config squid-4.0.11/src/cf.data.pre
 LOC: Config.Log.rotateNumber
 DOC_START
 	Specifies the default number of logfile rotations to make when you
-@@ -6444,11 +6444,11 @@ COMMENT_END
+@@ -6857,11 +6857,11 @@ COMMENT_END
 NAME: cache_mgr
 TYPE: string
--- a/SOURCES/squid-4.11-convert-ipv4.patch
+++ b/SOURCES/squid-4.11-convert-ipv4.patch
@ -0,0 +1,143 @@
 From 771908d313ee9c255adfb5e4fdba4d6797c18409 Mon Sep 17 00:00:00 2001
 From: Amos Jeffries <yadij@users.noreply.github.com>
 Date: Thu, 7 Mar 2019 13:50:38 +0000
 Subject: [PATCH] Bug 4928: Cannot convert non-IPv4 to IPv4 (#379)
 ... when reaching client_ip_max_connections
 The client_ip_max_connections limit is checked before the TCP dst-IP is located for the newly received TCP connection. This leaves Squid unable to fetch the NFMARK or similar
 details later on (they do not exist for [::]).
 Move client_ip_max_connections test later in the TCP accept process to ensure dst-IP is known when the error is produced.
 ---
 src/comm/TcpAcceptor.cc | 82 ++++++++++++++++++++---------------------
 1 file changed, 39 insertions(+), 43 deletions(-)
 diff --git a/src/comm/TcpAcceptor.cc b/src/comm/TcpAcceptor.cc
 index d4b576d..936aa30 100644
 --- a/src/comm/TcpAcceptor.cc
 +++ b/src/comm/TcpAcceptor.cc
@@ -282,7 +282,16 @@ Comm::TcpAcceptor::acceptOne()
     ConnectionPointer newConnDetails = new Connection();
     const Comm::Flag flag = oldAccept(newConnDetails);
 -    if (flag == Comm::COMM_ERROR) {
 +    /* Check for errors */
 +    if (!newConnDetails->isOpen()) {
 +
 +        if (flag == Comm::NOMESSAGE) {
 +            /* register interest again */
 +            debugs(5, 5, HERE << "try later: " << conn << " handler Subscription: " << theCallSub);
 +            SetSelect(conn->fd, COMM_SELECT_READ, doAccept, this, 0);
 +            return;
 +        }
 +
         // A non-recoverable error; notify the caller */
         debugs(5, 5, HERE << "non-recoverable error:" << status() << " handler Subscription: " << theCallSub);
         if (intendedForUserConnections())
@@ -292,16 +301,12 @@ Comm::TcpAcceptor::acceptOne()
         return;
     }
 -    if (flag == Comm::NOMESSAGE) {
 -        /* register interest again */
 -        debugs(5, 5, "try later: " << conn << " handler Subscription: " << theCallSub);
 -    } else {
 -        debugs(5, 5, "Listener: " << conn <<
 -               " accepted new connection " << newConnDetails <<
 -               " handler Subscription: " << theCallSub);
 -        notify(flag, newConnDetails);
 -    }
 +    newConnDetails->nfmark = Ip::Qos::getNfmarkFromConnection(newConnDetails, Ip::Qos::dirAccepted);
 +    debugs(5, 5, HERE << "Listener: " << conn <<
 +           " accepted new connection " << newConnDetails <<
 +           " handler Subscription: " << theCallSub);
 +    notify(flag, newConnDetails);
     SetSelect(conn->fd, COMM_SELECT_READ, doAccept, this, 0);
 }
@@ -341,8 +346,8 @@ Comm::TcpAcceptor::notify(const Comm::Flag flag, const Comm::ConnectionPointer &
  *
  * \retval Comm::OK          success. details parameter filled.
  * \retval Comm::NOMESSAGE   attempted accept() but nothing useful came in.
 - *                           Or this client has too many connections already.
  * \retval Comm::COMM_ERROR  an outright failure occurred.
 + *                           Or this client has too many connections already.
  */
 Comm::Flag
 Comm::TcpAcceptor::oldAccept(Comm::ConnectionPointer &details)
@@ -383,6 +388,15 @@ Comm::TcpAcceptor::oldAccept(Comm::ConnectionPointer &details)
     details->remote = *gai;
 +    if ( Config.client_ip_max_connections >= 0) {
 +        if (clientdbEstablished(details->remote, 0) > Config.client_ip_max_connections) {
 +            debugs(50, DBG_IMPORTANT, "WARNING: " << details->remote << " attempting more than " << Config.client_ip_max_connections << " connections.");
 +            Ip::Address::FreeAddr(gai);
 +            PROF_stop(comm_accept);
 +            return Comm::COMM_ERROR;
 +        }
 +    }
 +
     // lookup the local-end details of this new connection
     Ip::Address::InitAddr(gai);
     details->local.setEmpty();
@@ -396,6 +410,23 @@ Comm::TcpAcceptor::oldAccept(Comm::ConnectionPointer &details)
     details->local = *gai;
     Ip::Address::FreeAddr(gai);
 +    /* fdstat update */
 +    fdd_table[sock].close_file = NULL;
 +    fdd_table[sock].close_line = 0;
 +
 +    fde *F = &fd_table[sock];
 +    details->remote.toStr(F->ipaddr,MAX_IPSTRLEN);
 +    F->remote_port = details->remote.port();
 +    F->local_addr = details->local;
 +    F->sock_family = details->local.isIPv6()?AF_INET6:AF_INET;
 +
 +    // set socket flags
 +    commSetCloseOnExec(sock);
 +    commSetNonBlocking(sock);
 +
 +    /* IFF the socket is (tproxy) transparent, pass the flag down to allow spoofing */
 +    F->flags.transparent = fd_table[conn->fd].flags.transparent; // XXX: can we remove this line yet?
 +
     // Perform NAT or TPROXY operations to retrieve the real client/dest IP addresses
     if (conn->flags&(COMM_TRANSPARENT|COMM_INTERCEPTION) && !Ip::Interceptor.Lookup(details, conn)) {
         debugs(50, DBG_IMPORTANT, "ERROR: NAT/TPROXY lookup failed to locate original IPs on " << details);
@@ -414,33 +445,6 @@ Comm::TcpAcceptor::oldAccept(Comm::ConnectionPointer &details)
     }
 #endif
 -    details->nfmark = Ip::Qos::getNfmarkFromConnection(details, Ip::Qos::dirAccepted);
 -
 -    if (Config.client_ip_max_connections >= 0) {
 -        if (clientdbEstablished(details->remote, 0) > Config.client_ip_max_connections) {
 -            debugs(50, DBG_IMPORTANT, "WARNING: " << details->remote << " attempting more than " << Config.client_ip_max_connections << " connections.");
 -            PROF_stop(comm_accept);
 -            return Comm::NOMESSAGE;
 -        }
 -    }
 -
 -    /* fdstat update */
 -    fdd_table[sock].close_file = NULL;
 -    fdd_table[sock].close_line = 0;
 -
 -    fde *F = &fd_table[sock];
 -    details->remote.toStr(F->ipaddr,MAX_IPSTRLEN);
 -    F->remote_port = details->remote.port();
 -    F->local_addr = details->local;
 -    F->sock_family = details->local.isIPv6()?AF_INET6:AF_INET;
 -
 -    // set socket flags
 -    commSetCloseOnExec(sock);
 -    commSetNonBlocking(sock);
 -
 -    /* IFF the socket is (tproxy) transparent, pass the flag down to allow spoofing */
 -    F->flags.transparent = fd_table[conn->fd].flags.transparent; // XXX: can we remove this line yet?
 -
     PROF_stop(comm_accept);
     return Comm::OK;
 }
--- a/SOURCES/squid-4.11-include-guards.patch
+++ b/SOURCES/squid-4.11-include-guards.patch
@ -0,0 +1,41 @@
 diff --git a/compat/os/linux.h b/compat/os/linux.h
 index 0ff05c6..d51389b 100644
 --- a/compat/os/linux.h
 +++ b/compat/os/linux.h
@@ -44,6 +44,36 @@
 #include <netinet/in.h>
 #endif
 +/*
 + * Netfilter header madness. (see Bug 4323)
 + *
 + * Netfilter have a history of defining their own versions of network protocol
 + * primitives without sufficient protection against the POSIX defines which are
 + * aways present in Linux.
 + *
 + * netinet/in.h must be included before any other sys header in order to properly
 + * activate include guards in <linux/libc-compat.h> the kernel maintainers added
 + * to workaround it.
 + */
 +#if HAVE_NETINET_IN_H
 +#include <netinet/in.h>
 +#endif
 +
 +/*
 + * Netfilter header madness. (see Bug 4323)
 + *
 + * Netfilter have a history of defining their own versions of network protocol
 + * primitives without sufficient protection against the POSIX defines which are
 + * aways present in Linux.
 + *
 + * netinet/in.h must be included before any other sys header in order to properly
 + * activate include guards in <linux/libc-compat.h> the kernel maintainers added
 + * to workaround it.
 + */
 +#if HAVE_NETINET_IN_H
 +#include <netinet/in.h>
 +#endif
 +
 /*
  * sys/capability.h is only needed in Linux apparently.
  *
--- a/SOURCES/squid-4.11-large-acl.patch
+++ b/SOURCES/squid-4.11-large-acl.patch
@ -0,0 +1,178 @@
 diff --git a/src/acl/RegexData.cc b/src/acl/RegexData.cc
 index 01a4c12..b5c1679 100644
 --- a/src/acl/RegexData.cc
 +++ b/src/acl/RegexData.cc
@@ -22,6 +22,7 @@
 #include "ConfigParser.h"
 #include "Debug.h"
 #include "sbuf/List.h"
 +#include "sbuf/Algorithms.h"
 ACLRegexData::~ACLRegexData()
 {
@@ -129,6 +130,18 @@ compileRE(std::list<RegexPattern> &curlist, const char * RE, int flags)
     return true;
 }
 +static bool
 +compileRE(std::list<RegexPattern> &curlist, const SBufList &RE, int flags)
 +{
 +	if (RE.empty())
 +		return curlist.empty(); // XXX: old code did this. It looks wrong.
 +	SBuf regexp;
 +	static const SBuf openparen("("), closeparen(")"), separator(")|(");
 +	JoinContainerIntoSBuf(regexp, RE.begin(), RE.end(), separator, openparen,
 +			closeparen);
 +	return compileRE(curlist, regexp.c_str(), flags);
 +}
 +
 /** Compose and compile one large RE from a set of (small) REs.
  * The ultimate goal is to have only one RE per ACL so that match() is
  * called only once per ACL.
@@ -137,16 +150,11 @@ static int
 compileOptimisedREs(std::list<RegexPattern> &curlist, const SBufList &sl)
 {
     std::list<RegexPattern> newlist;
 -    int numREs = 0;
 +    SBufList accumulatedRE;
 +    int numREs = 0, reSize = 0;
     int flags = REG_EXTENDED | REG_NOSUB;
 -    int largeREindex = 0;
 -    char largeRE[BUFSIZ];
 -    *largeRE = 0;
     for (const SBuf & configurationLineWord : sl) {
 -        int RElen;
 -        RElen = configurationLineWord.length();
 -
         static const SBuf minus_i("-i");
         static const SBuf plus_i("+i");
         if (configurationLineWord == minus_i) {
@@ -155,10 +163,11 @@ compileOptimisedREs(std::list<RegexPattern> &curlist, const SBufList &sl)
                 debugs(28, 2, "optimisation of -i ... -i" );
             } else {
                 debugs(28, 2, "-i" );
 -                if (!compileRE(newlist, largeRE, flags))
 +                if (!compileRE(newlist, accumulatedRE, flags))
                     return 0;
                 flags |= REG_ICASE;
 -                largeRE[largeREindex=0] = '\0';
 +                accumulatedRE.clear();
 +                reSize = 0;
             }
         } else if (configurationLineWord == plus_i) {
             if ((flags & REG_ICASE) == 0) {
@@ -166,37 +175,34 @@ compileOptimisedREs(std::list<RegexPattern> &curlist, const SBufList &sl)
                 debugs(28, 2, "optimisation of +i ... +i");
             } else {
                 debugs(28, 2, "+i");
 -                if (!compileRE(newlist, largeRE, flags))
 +                if (!compileRE(newlist, accumulatedRE, flags))
                     return 0;
                 flags &= ~REG_ICASE;
 -                largeRE[largeREindex=0] = '\0';
 +                accumulatedRE.clear();
 +                reSize = 0;
             }
 -        } else if (RElen + largeREindex + 3 < BUFSIZ-1) {
 +        } else if (reSize < 1024) {
             debugs(28, 2, "adding RE '" << configurationLineWord << "'");
 -            if (largeREindex > 0) {
 -                largeRE[largeREindex] = '|';
 -                ++largeREindex;
 -            }
 -            largeRE[largeREindex] = '(';
 -            ++largeREindex;
 -            configurationLineWord.copy(largeRE+largeREindex, BUFSIZ-largeREindex);
 -            largeREindex += configurationLineWord.length();
 -            largeRE[largeREindex] = ')';
 -            ++largeREindex;
 -            largeRE[largeREindex] = '\0';
 +            accumulatedRE.push_back(configurationLineWord);
             ++numREs;
 +            reSize += configurationLineWord.length();
         } else {
             debugs(28, 2, "buffer full, generating new optimised RE..." );
 -            if (!compileRE(newlist, largeRE, flags))
 +            accumulatedRE.push_back(configurationLineWord);
 +            if (!compileRE(newlist, accumulatedRE, flags))
                 return 0;
 -            largeRE[largeREindex=0] = '\0';
 +            accumulatedRE.clear();
 +            reSize = 0;
             continue;    /* do the loop again to add the RE to largeRE */
         }
     }
 -    if (!compileRE(newlist, largeRE, flags))
 +    if (!compileRE(newlist, accumulatedRE, flags))
         return 0;
 +    accumulatedRE.clear();
 +    reSize = 0;
 +
     /* all was successful, so put the new list at the tail */
     curlist.splice(curlist.end(), newlist);
 diff --git a/src/sbuf/Algorithms.h b/src/sbuf/Algorithms.h
 index 21ee889..338e9c0 100644
 --- a/src/sbuf/Algorithms.h
 +++ b/src/sbuf/Algorithms.h
@@ -81,6 +81,57 @@ SBufContainerJoin(const Container &items, const SBuf& separator)
     return rv;
 }
 +/** Join container of SBufs and append to supplied target
 + *
 + * append to the target SBuf all elements in the [begin,end) range from
 + * an iterable container, prefixed by prefix, separated by separator and
 + * followed by suffix. Prefix and suffix are added also in case of empty
 + * iterable
 + *
 + * \return the modified dest
 + */
 +template <class ContainerIterator>
 +SBuf&
 +JoinContainerIntoSBuf(SBuf &dest, const ContainerIterator &begin,
 +                      const ContainerIterator &end, const SBuf& separator,
 +                      const SBuf& prefix = SBuf(), const SBuf& suffix = SBuf())
 +{
 +    if (begin == end) {
 +        dest.append(prefix).append(suffix);
 +        return dest;
 +    }
 +
 +    // optimization: pre-calculate needed storage
 +    const SBuf::size_type totalContainerSize =
 +        std::accumulate(begin, end, 0, SBufAddLength(separator)) +
 +        dest.length() + prefix.length() + suffix.length();
 +    SBufReservationRequirements req;
 +    req.minSpace = totalContainerSize;
 +    dest.reserve(req);
 +
 +    auto i = begin;
 +    dest.append(prefix);
 +    dest.append(*i);
 +    ++i;
 +    for (; i != end; ++i)
 +        dest.append(separator).append(*i);
 +    dest.append(suffix);
 +    return dest;
 +}
 +
 +
 +/// convenience wrapper of JoinContainerIntoSBuf with no caller-supplied SBuf
 +template <class ContainerIterator>
 +SBuf
 +JoinContainerToSBuf(const ContainerIterator &begin,
 +                    const ContainerIterator &end, const SBuf& separator,
 +                    const SBuf& prefix = SBuf(), const SBuf& suffix = SBuf())
 +{
 +    SBuf rv;
 +    return JoinContainerIntoSBuf(rv, begin, end, separator, prefix, suffix);
 +}
 +
 +
 namespace std {
 /// default hash functor to support std::unordered_map<SBuf,*>
 template <>
--- a/SOURCES/squid-3.1.0.9-location.patch
+++ b/SOURCES/squid-3.1.0.9-location.patch
@ -1,7 +1,8 @@
-diff -up squid-3.1.0.9/QUICKSTART.location squid-3.1.0.9/QUICKSTART
+diff --git a/QUICKSTART b/QUICKSTART
--- squid-3.1.0.9/QUICKSTART.location	2009-06-26 12:35:27.000000000 +0200
+index e5299b4..a243437 100644
-+++ squid-3.1.0.9/QUICKSTART	2009-07-17 14:03:10.000000000 +0200
+--- a/QUICKSTART
-@@ -10,10 +10,9 @@ After you retrieved, compiled and instal
+++ b/QUICKSTART
@@ -10,10 +10,9 @@ After you retrieved, compiled and installed the Squid software (see
 INSTALL in the same directory), you have to configure the squid.conf
 file. This is the list of the values you *need* to change, because no
 sensible defaults could be defined. Do not touch the other variables
@ -14,7 +15,7 @@ diff -up squid-3.1.0.9/QUICKSTART.location squid-3.1.0.9/QUICKSTART
 ==============================================================================
-@@ -82,12 +81,12 @@ After editing squid.conf to your liking,
+@@ -80,12 +79,12 @@ After editing squid.conf to your liking, run Squid from the command
 line TWICE:
 To create any disk cache_dir configured:
--- a/SOURCES/squid-3.0.STABLE1-perlpath.patch
+++ b/SOURCES/squid-3.0.STABLE1-perlpath.patch
@ -1,10 +1,10 @@
 diff --git a/contrib/url-normalizer.pl b/contrib/url-normalizer.pl
-index 4cb0480..4b89910 100755
+index 90ac6a4..8dbed90 100755
 --- a/contrib/url-normalizer.pl
 +++ b/contrib/url-normalizer.pl
@@ -1,4 +1,4 @@
 -#!/usr/local/bin/perl -Tw
 +#!/usr/bin/perl -Tw
 #
- # * Copyright (C) 1996-2022 The Squid Software Foundation and contributors
+ # * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
 # *
--- a/SOURCES/squid-4.15-CVE-2021-28116.patch
+++ b/SOURCES/squid-4.15-CVE-2021-28116.patch
@ -0,0 +1,424 @@
 commit b003a0da7865caa25b5d1e70c79329b32409b02a (HEAD -> refs/heads/v4, refs/remotes/origin/v4)
 Author: Amos Jeffries <yadij@users.noreply.github.com>
 Date:   2021-09-24 21:53:11 +0000
    WCCP: Validate packets better (#899)
    Update WCCP to support exception based error handling for
    parsing and processing we are moving Squid to for protocol
    handling.
    Update the main WCCPv2 parsing checks to throw meaningful
    exceptions when detected.
 diff --git a/src/wccp2.cc b/src/wccp2.cc
 index ee592449c..6ef469e91 100644
 --- a/src/wccp2.cc
 +++ b/src/wccp2.cc
@@ -1108,6 +1108,59 @@ wccp2ConnectionClose(void)
  * Functions for handling the requests.
  */
 +/// Checks that the given area section ends inside the given (whole) area.
 +/// \param error the message to throw when the section does not fit
 +static void
 +CheckSectionLength(const void *sectionStart, const size_t sectionLength, const void *wholeStart, const size_t wholeSize, const char *error)
 +{
 +    assert(sectionStart);
 +    assert(wholeStart);
 +
 +    const auto wholeEnd = static_cast<const char*>(wholeStart) + wholeSize;
 +    assert(sectionStart >= wholeStart && "we never go backwards");
 +    assert(sectionStart <= wholeEnd && "we never go beyond our whole (but zero-sized fields are OK)");
 +    static_assert(sizeof(wccp2_i_see_you_t) <= PTRDIFF_MAX, "paranoid: no UB when subtracting in-whole pointers");
 +    // subtraction safe due to the three assertions above
 +    const auto remainderDiff = wholeEnd - static_cast<const char*>(sectionStart);
 +
 +    // casting safe due to the assertions above (and size_t definition)
 +    assert(remainderDiff >= 0);
 +    const auto remainderSize = static_cast<size_t>(remainderDiff);
 +
 +    if (sectionLength <= remainderSize)
 +        return;
 +
 +    throw TextException(error, Here());
 +}
 +
 +/// Checks that the area contains at least dataLength bytes after the header.
 +/// The size of the field header itself is not included in dataLength.
 +/// \returns the total field size -- the field header and field data combined
 +template<class FieldHeader>
 +static size_t
 +CheckFieldDataLength(const FieldHeader *header, const size_t dataLength, const void *areaStart, const size_t areaSize, const char *error)
 +{
 +    assert(header);
 +    const auto dataStart = reinterpret_cast<const char*>(header) + sizeof(header);
 +    CheckSectionLength(dataStart, dataLength, areaStart, areaSize, error);
 +    return sizeof(header) + dataLength; // no overflow after CheckSectionLength()
 +}
 +
 +/// Positions the given field at a given start within a given packet area.
 +/// The Field type determines the correct field size (used for bounds checking).
 +/// \param field the field pointer the function should set
 +/// \param areaStart the start of a packet (sub)structure containing the field
 +/// \param areaSize the size of the packet (sub)structure starting at areaStart
 +/// \param fieldStart the start of a field within the given area
 +/// \param error the message to throw when the field does not fit the area
 +template<class Field>
 +static void
 +SetField(Field *&field, const void *fieldStart, const void *areaStart, const size_t areaSize, const char *error)
 +{
 +    CheckSectionLength(fieldStart, sizeof(Field), areaStart, areaSize, error);
 +    field = static_cast<Field*>(const_cast<void*>(fieldStart));
 +}
 +
 /*
  * Accept the UDP packet
  */
@@ -1124,8 +1177,6 @@ wccp2HandleUdp(int sock, void *)
     /* These structs form the parts of the packet */
 -    struct wccp2_item_header_t *header = NULL;
 -
     struct wccp2_security_none_t *security_info = NULL;
     struct wccp2_service_info_t *service_info = NULL;
@@ -1141,14 +1192,13 @@ wccp2HandleUdp(int sock, void *)
     struct wccp2_cache_identity_info_t *cache_identity = NULL;
     struct wccp2_capability_info_header_t *router_capability_header = NULL;
 +    char *router_capability_data_start = nullptr;
     struct wccp2_capability_element_t *router_capability_element;
     struct sockaddr_in from;
     struct in_addr cache_address;
 -    int len, found;
 -    short int data_length, offset;
     uint32_t tmp;
     char *ptr;
     int num_caches;
@@ -1161,20 +1211,18 @@ wccp2HandleUdp(int sock, void *)
     Ip::Address from_tmp;
     from_tmp.setIPv4();
 -    len = comm_udp_recvfrom(sock,
 -                            &wccp2_i_see_you,
 -                            WCCP_RESPONSE_SIZE,
 -                            0,
 -                            from_tmp);
 +    const auto lenOrError = comm_udp_recvfrom(sock, &wccp2_i_see_you, WCCP_RESPONSE_SIZE, 0, from_tmp);
 -    if (len < 0)
 +    if (lenOrError < 0)
         return;
 +    const auto len = static_cast<size_t>(lenOrError);
 -    if (ntohs(wccp2_i_see_you.version) != WCCP2_VERSION)
 -        return;
 -
 -    if (ntohl(wccp2_i_see_you.type) != WCCP2_I_SEE_YOU)
 -        return;
 +    try {
 +        // TODO: Remove wccp2_i_see_you.data and use a buffer to read messages.
 +        const auto message_header_size = sizeof(wccp2_i_see_you) - sizeof(wccp2_i_see_you.data);
 +        Must2(len >= message_header_size, "incomplete WCCP message header");
 +        Must2(ntohs(wccp2_i_see_you.version) == WCCP2_VERSION, "WCCP version unsupported");
 +        Must2(ntohl(wccp2_i_see_you.type) == WCCP2_I_SEE_YOU, "WCCP packet type unsupported");
     /* FIXME INET6 : drop conversion boundary */
     from_tmp.getSockAddr(from);
@@ -1182,73 +1230,60 @@ wccp2HandleUdp(int sock, void *)
     debugs(80, 3, "Incoming WCCPv2 I_SEE_YOU length " << ntohs(wccp2_i_see_you.length) << ".");
     /* Record the total data length */
 -    data_length = ntohs(wccp2_i_see_you.length);
 +    const auto data_length = ntohs(wccp2_i_see_you.length);
 +    Must2(data_length <= len - message_header_size,
 +          "malformed packet claiming it's bigger than received data");
 -    offset = 0;
 -
 -    if (data_length > len) {
 -        debugs(80, DBG_IMPORTANT, "ERROR: Malformed WCCPv2 packet claiming it's bigger than received data");
 -        return;
 -    }
 +    size_t offset = 0;
     /* Go through the data structure */
 -    while (data_length > offset) {
 +    while (offset + sizeof(struct wccp2_item_header_t) <= data_length) {
         char *data = wccp2_i_see_you.data;
 -        header = (struct wccp2_item_header_t *) &data[offset];
 +        const auto itemHeader = reinterpret_cast<const wccp2_item_header_t*>(&data[offset]);
 +        const auto itemSize = CheckFieldDataLength(itemHeader, ntohs(itemHeader->length),
 +                              data, data_length, "truncated record");
 +        // XXX: Check "The specified length must be a multiple of 4 octets"
 +        // requirement to avoid unaligned memory reads after the first item.
 -        switch (ntohs(header->type)) {
 +        switch (ntohs(itemHeader->type)) {
         case WCCP2_SECURITY_INFO:
 -
 -            if (security_info != NULL) {
 -                debugs(80, DBG_IMPORTANT, "Duplicate security definition");
 -                return;
 -            }
 -
 -            security_info = (struct wccp2_security_none_t *) &wccp2_i_see_you.data[offset];
 +            Must2(!security_info, "duplicate security definition");
 +            SetField(security_info, itemHeader, itemHeader, itemSize,
 +                     "security definition truncated");
             break;
         case WCCP2_SERVICE_INFO:
 -
 -            if (service_info != NULL) {
 -                debugs(80, DBG_IMPORTANT, "Duplicate service_info definition");
 -                return;
 -            }
 -
 -            service_info = (struct wccp2_service_info_t *) &wccp2_i_see_you.data[offset];
 +            Must2(!service_info, "duplicate service_info definition");
 +            SetField(service_info, itemHeader, itemHeader, itemSize,
 +                     "service_info definition truncated");
             break;
         case WCCP2_ROUTER_ID_INFO:
 -
 -            if (router_identity_info != NULL) {
 -                debugs(80, DBG_IMPORTANT, "Duplicate router_identity_info definition");
 -                return;
 -            }
 -
 -            router_identity_info = (struct router_identity_info_t *) &wccp2_i_see_you.data[offset];
 +            Must2(!router_identity_info, "duplicate router_identity_info definition");
 +            SetField(router_identity_info, itemHeader, itemHeader, itemSize,
 +                     "router_identity_info definition truncated");
             break;
         case WCCP2_RTR_VIEW_INFO:
 -
 -            if (router_view_header != NULL) {
 -                debugs(80, DBG_IMPORTANT, "Duplicate router_view definition");
 -                return;
 -            }
 -
 -            router_view_header = (struct router_view_t *) &wccp2_i_see_you.data[offset];
 +            Must2(!router_view_header, "duplicate router_view definition");
 +            SetField(router_view_header, itemHeader, itemHeader, itemSize,
 +                     "router_view definition truncated");
             break;
 -        case WCCP2_CAPABILITY_INFO:
 -
 -            if (router_capability_header != NULL) {
 -                debugs(80, DBG_IMPORTANT, "Duplicate router_capability definition");
 -                return;
 -            }
 +        case WCCP2_CAPABILITY_INFO: {
 +            Must2(!router_capability_header, "duplicate router_capability definition");
 +            SetField(router_capability_header, itemHeader, itemHeader, itemSize,
 +                     "router_capability definition truncated");
 -            router_capability_header = (struct wccp2_capability_info_header_t *) &wccp2_i_see_you.data[offset];
 +            CheckFieldDataLength(router_capability_header, ntohs(router_capability_header->capability_info_length),
 +                                 itemHeader, itemSize, "capability info truncated");
 +            router_capability_data_start = reinterpret_cast<char*>(router_capability_header) +
 +                                           sizeof(*router_capability_header);
             break;
 +        }
         /* Nothing to do for the types below */
@@ -1257,22 +1292,17 @@ wccp2HandleUdp(int sock, void *)
             break;
         default:
 -            debugs(80, DBG_IMPORTANT, "Unknown record type in WCCPv2 Packet (" << ntohs(header->type) << ").");
 +            debugs(80, DBG_IMPORTANT, "Unknown record type in WCCPv2 Packet (" << ntohs(itemHeader->type) << ").");
         }
 -        offset += sizeof(struct wccp2_item_header_t);
 -        offset += ntohs(header->length);
 -
 -        if (offset > data_length) {
 -            debugs(80, DBG_IMPORTANT, "Error: WCCPv2 packet tried to tell us there is data beyond the end of the packet");
 -            return;
 -        }
 +        offset += itemSize;
 +        assert(offset <= data_length && "CheckFieldDataLength(itemHeader...) established that");
     }
 -    if ((security_info == NULL) || (service_info == NULL) || (router_identity_info == NULL) || (router_view_header == NULL)) {
 -        debugs(80, DBG_IMPORTANT, "Incomplete WCCPv2 Packet");
 -        return;
 -    }
 +    Must2(security_info, "packet missing security definition");
 +    Must2(service_info, "packet missing service_info definition");
 +    Must2(router_identity_info, "packet missing router_identity_info definition");
 +    Must2(router_view_header, "packet missing router_view definition");
     debugs(80, 5, "Complete packet received");
@@ -1308,10 +1338,7 @@ wccp2HandleUdp(int sock, void *)
             break;
     }
 -    if (router_list_ptr->next == NULL) {
 -        debugs(80, DBG_IMPORTANT, "WCCPv2 Packet received from unknown router");
 -        return;
 -    }
 +    Must2(router_list_ptr->next, "packet received from unknown router");
     /* Set the router id */
     router_list_ptr->info->router_address = router_identity_info->router_id_element.router_address;
@@ -1331,11 +1358,20 @@ wccp2HandleUdp(int sock, void *)
         }
     } else {
 -        char *end = ((char *) router_capability_header) + sizeof(*router_capability_header) + ntohs(router_capability_header->capability_info_length) - sizeof(struct wccp2_capability_info_header_t);
 -
 -        router_capability_element = (struct wccp2_capability_element_t *) (((char *) router_capability_header) + sizeof(*router_capability_header));
 -
 -        while ((char *) router_capability_element <= end) {
 +        const auto router_capability_data_length = ntohs(router_capability_header->capability_info_length);
 +        assert(router_capability_data_start);
 +        const auto router_capability_data_end = router_capability_data_start +
 +                                                router_capability_data_length;
 +        for (auto router_capability_data_current = router_capability_data_start;
 +                router_capability_data_current < router_capability_data_end;) {
 +
 +            SetField(router_capability_element, router_capability_data_current,
 +                     router_capability_data_start, router_capability_data_length,
 +                     "capability element header truncated");
 +            const auto elementSize = CheckFieldDataLength(
 +                                         router_capability_element, ntohs(router_capability_element->capability_length),
 +                                         router_capability_data_start, router_capability_data_length,
 +                                         "capability element truncated");
             switch (ntohs(router_capability_element->capability_type)) {
@@ -1377,7 +1413,7 @@ wccp2HandleUdp(int sock, void *)
                 debugs(80, DBG_IMPORTANT, "Unknown capability type in WCCPv2 Packet (" << ntohs(router_capability_element->capability_type) << ").");
             }
 -            router_capability_element = (struct wccp2_capability_element_t *) (((char *) router_capability_element) + sizeof(struct wccp2_item_header_t) + ntohs(router_capability_element->capability_length));
 +            router_capability_data_current += elementSize;
         }
     }
@@ -1396,23 +1432,34 @@ wccp2HandleUdp(int sock, void *)
     num_caches = 0;
     /* Check to see if we're the master cache and update the cache list */
 -    found = 0;
 +    bool found = false;
     service_list_ptr->lowest_ip = 1;
     cache_list_ptr = &router_list_ptr->cache_list_head;
     /* to find the list of caches, we start at the end of the router view header */
     ptr = (char *) (router_view_header) + sizeof(struct router_view_t);
 +    const auto router_view_size = sizeof(struct router_view_t) +
 +                                  ntohs(router_view_header->header.length);
     /* Then we read the number of routers */
 -    memcpy(&tmp, ptr, sizeof(tmp));
 +    const uint32_t *routerCountRaw = nullptr;
 +    SetField(routerCountRaw, ptr, router_view_header, router_view_size,
 +             "malformed packet (truncated router view info w/o number of routers)");
     /* skip the number plus all the ip's */
 -
 -    ptr += sizeof(tmp) + (ntohl(tmp) * sizeof(struct in_addr));
 +    ptr += sizeof(*routerCountRaw);
 +    const auto ipCount = ntohl(*routerCountRaw);
 +    const auto ipsSize = ipCount * sizeof(struct in_addr); // we check for unsigned overflow below
 +    Must2(ipsSize / sizeof(struct in_addr) != ipCount, "huge IP address count");
 +    CheckSectionLength(ptr, ipsSize, router_view_header, router_view_size, "invalid IP address count");
 +    ptr += ipsSize;
     /* Then read the number of caches */
 -    memcpy(&tmp, ptr, sizeof(tmp));
 +    const uint32_t *cacheCountRaw = nullptr;
 +    SetField(cacheCountRaw, ptr, router_view_header, router_view_size,
 +             "malformed packet (truncated router view info w/o cache count)");
 +    memcpy(&tmp, cacheCountRaw, sizeof(tmp)); // TODO: Replace tmp with cacheCount
     ptr += sizeof(tmp);
     if (ntohl(tmp) != 0) {
@@ -1426,7 +1473,8 @@ wccp2HandleUdp(int sock, void *)
             case WCCP2_ASSIGNMENT_METHOD_HASH:
 -                cache_identity = (struct wccp2_cache_identity_info_t *) ptr;
 +                SetField(cache_identity, ptr, router_view_header, router_view_size,
 +                         "malformed packet (truncated router view info cache w/o assignment hash)");
                 ptr += sizeof(struct wccp2_cache_identity_info_t);
@@ -1437,13 +1485,15 @@ wccp2HandleUdp(int sock, void *)
             case WCCP2_ASSIGNMENT_METHOD_MASK:
 -                cache_mask_info = (struct cache_mask_info_t *) ptr;
 +                SetField(cache_mask_info, ptr, router_view_header, router_view_size,
 +                         "malformed packet (truncated router view info cache w/o assignment mask)");
                 /* The mask assignment has an undocumented variable length entry here */
                 if (ntohl(cache_mask_info->num1) == 3) {
 -                    cache_mask_identity = (struct wccp2_cache_mask_identity_info_t *) ptr;
 +                    SetField(cache_mask_identity, ptr, router_view_header, router_view_size,
 +                             "malformed packet (truncated router view info cache w/o assignment mask identity)");
                     ptr += sizeof(struct wccp2_cache_mask_identity_info_t);
@@ -1474,10 +1524,7 @@ wccp2HandleUdp(int sock, void *)
             debugs (80, 5,  "checking cache list: (" << std::hex << cache_address.s_addr << ":" <<  router_list_ptr->local_ip.s_addr << ")");
             /* Check to see if it's the master, or us */
 -
 -            if (cache_address.s_addr == router_list_ptr->local_ip.s_addr) {
 -                found = 1;
 -            }
 +            found = found || (cache_address.s_addr == router_list_ptr->local_ip.s_addr);
             if (cache_address.s_addr < router_list_ptr->local_ip.s_addr) {
                 service_list_ptr->lowest_ip = 0;
@@ -1494,7 +1541,7 @@ wccp2HandleUdp(int sock, void *)
         cache_list_ptr->next = NULL;
         service_list_ptr->lowest_ip = 1;
 -        found = 1;
 +        found = true;
         num_caches = 1;
     }
@@ -1502,7 +1549,7 @@ wccp2HandleUdp(int sock, void *)
     router_list_ptr->num_caches = htonl(num_caches);
 -    if ((found == 1) && (service_list_ptr->lowest_ip == 1)) {
 +    if (found && (service_list_ptr->lowest_ip == 1)) {
         if (ntohl(router_view_header->change_number) != router_list_ptr->member_change) {
             debugs(80, 4, "Change detected - queueing up new assignment");
             router_list_ptr->member_change = ntohl(router_view_header->change_number);
@@ -1515,6 +1562,10 @@ wccp2HandleUdp(int sock, void *)
         eventDelete(wccp2AssignBuckets, NULL);
         debugs(80, 5, "I am not the lowest ip cache - not assigning buckets");
     }
 +
 +    } catch (...) {
 +        debugs(80, DBG_IMPORTANT, "ERROR: Ignoring WCCPv2 message: " << CurrentException);
 +    }
 }
 static void
--- a/SOURCES/squid-4.15-CVE-2021-46784.patch
+++ b/SOURCES/squid-4.15-CVE-2021-46784.patch
@ -1,8 +1,17 @@
 From 780c4ea1b4c9d2fb41f6962aa6ed73ae57f74b2b Mon Sep 17 00:00:00 2001
 From: Joshua Rogers <MegaManSec@users.noreply.github.com>
 Date: Mon, 18 Apr 2022 13:42:36 +0000
 Subject: [PATCH] Improve handling of Gopher responses (#1022)
 ---
 src/gopher.cc | 45 ++++++++++++++++++++-------------------------
 1 file changed, 20 insertions(+), 25 deletions(-)
 diff --git a/src/gopher.cc b/src/gopher.cc
-index 576a3f7..2645b6b 100644
+index 169b0e18299..6187da18bcd 100644
 --- a/src/gopher.cc
 +++ b/src/gopher.cc
-@@ -364,7 +364,6 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -371,7 +371,6 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
     char *lpos = NULL;
     char *tline = NULL;
     LOCAL_ARRAY(char, line, TEMP_BUF_SIZE);
@ -10,7 +19,7 @@ index 576a3f7..2645b6b 100644
     char *name = NULL;
     char *selector = NULL;
     char *host = NULL;
-@@ -374,7 +373,6 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -381,7 +380,6 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
     char gtype;
     StoreEntry *entry = NULL;
@ -18,7 +27,7 @@ index 576a3f7..2645b6b 100644
     memset(line, '\0', TEMP_BUF_SIZE);
     entry = gopherState->entry;
-@@ -409,7 +407,7 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -416,7 +414,7 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
         return;
     }
@ -27,7 +36,7 @@ index 576a3f7..2645b6b 100644
     if (!gopherState->HTML_header_added) {
         if (gopherState->conversion == GopherStateData::HTML_CSO_RESULT)
-@@ -577,34 +575,34 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -583,34 +581,34 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
                         break;
                     }
@ -76,7 +85,7 @@ index 576a3f7..2645b6b 100644
                 } else {
                     memset(line, '\0', TEMP_BUF_SIZE);
                     continue;
-@@ -637,13 +635,12 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -643,13 +641,12 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
                     break;
                 if (gopherState->cso_recno != recno) {
@ -92,7 +101,7 @@ index 576a3f7..2645b6b 100644
                 break;
             } else {
                 int code;
-@@ -671,8 +668,7 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -677,8 +674,7 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
                 case 502: { /* Too Many Matches */
                     /* Print the message the server returns */
@ -102,7 +111,7 @@ index 576a3f7..2645b6b 100644
                     break;
                 }
-@@ -688,13 +684,12 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
+@@ -694,13 +690,12 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
     }               /* while loop */
--- a/SOURCES/squid-4.15-CVE-2022-41318.patch
+++ b/SOURCES/squid-4.15-CVE-2022-41318.patch
--- a/SOURCES/squid-4.15-CVE-2023-46724.patch
+++ b/SOURCES/squid-4.15-CVE-2023-46724.patch
--- a/SOURCES/squid-4.15-CVE-2023-46728.patch
+++ b/SOURCES/squid-4.15-CVE-2023-46728.patch
--- a/SOURCES/squid-4.15-CVE-2023-46846.patch
+++ b/SOURCES/squid-4.15-CVE-2023-46846.patch
--- a/SOURCES/squid-4.15-CVE-2023-46847.patch
+++ b/SOURCES/squid-4.15-CVE-2023-46847.patch
@ -1,26 +1,8 @@
 From 052cf082b0faaef4eaaa4e94119d7a1437aac4a3 Mon Sep 17 00:00:00 2001
 From: squidadm <squidadm@users.noreply.github.com>
 Date: Wed, 18 Oct 2023 04:50:56 +1300
 Subject: [PATCH] Fix stack buffer overflow when parsing Digest Authorization
 (#1517)
 The bug was discovered and detailed by Joshua Rogers at
 https://megamansec.github.io/Squid-Security-Audit/digest-overflow.html
 where it was filed as "Stack Buffer Overflow in Digest Authentication".
 ---------
 Co-authored-by: Alex Bason <nonsleepr@gmail.com>
 Co-authored-by: Amos Jeffries <yadij@users.noreply.github.com>
 ---
 src/auth/digest/Config.cc | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
 diff --git a/src/auth/digest/Config.cc b/src/auth/digest/Config.cc
-index d42831a55..be9f3c433 100644
+index 6a9736f..0a883fa 100644
 --- a/src/auth/digest/Config.cc
 +++ b/src/auth/digest/Config.cc
-@@ -844,11 +844,15 @@ Auth::Digest::Config::decode(char const *proxy_auth, const HttpRequest *request,
+@@ -847,11 +847,15 @@ Auth::Digest::Config::decode(char const *proxy_auth, const char *aRequestRealm)
             break;
         case DIGEST_NC:
@ -39,5 +21,3 @@ index d42831a55..be9f3c433 100644
             break;
         case DIGEST_CNONCE:
 -- 
 2.25.1
--- a/SOURCES/squid-4.15-CVE-2023-49285.patch
+++ b/SOURCES/squid-4.15-CVE-2023-49285.patch
--- a/SOURCES/squid-4.15-CVE-2023-49286.patch
+++ b/SOURCES/squid-4.15-CVE-2023-49286.patch
--- a/SOURCES/squid-4.15-CVE-2023-50269.patch
+++ b/SOURCES/squid-4.15-CVE-2023-50269.patch
@ -1,8 +1,8 @@
 diff --git a/src/ClientRequestContext.h b/src/ClientRequestContext.h
-index 55a7a43..94a8700 100644
+index fe2edf6..47aa935 100644
 --- a/src/ClientRequestContext.h
 +++ b/src/ClientRequestContext.h
-@@ -80,6 +80,10 @@ public:
+@@ -81,6 +81,10 @@ public:
 #endif
     ErrorState *error; ///< saved error page for centralized/delayed processing
     bool readNextRequest; ///< whether Squid should read after error handling
@ -14,10 +14,10 @@ index 55a7a43..94a8700 100644
 #endif /* SQUID_CLIENTREQUESTCONTEXT_H */
 diff --git a/src/client_side_request.cc b/src/client_side_request.cc
-index f44849e..c7c09d4 100644
+index 1c6ff62..b758f6f 100644
 --- a/src/client_side_request.cc
 +++ b/src/client_side_request.cc
-@@ -80,6 +80,11 @@
+@@ -78,6 +78,11 @@
 static const char *const crlf = "\r\n";
 #if FOLLOW_X_FORWARDED_FOR
@ -26,10 +26,10 @@ index f44849e..c7c09d4 100644
 +#define SQUID_X_FORWARDED_FOR_HOP_MAX 64
 +#endif
 +
- static void clientFollowXForwardedForCheck(Acl::Answer answer, void *data);
+ static void clientFollowXForwardedForCheck(allow_t answer, void *data);
 #endif /* FOLLOW_X_FORWARDED_FOR */
-@@ -485,8 +490,16 @@ clientFollowXForwardedForCheck(Acl::Answer answer, void *data)
+@@ -485,8 +490,16 @@ clientFollowXForwardedForCheck(allow_t answer, void *data)
                 /* override the default src_addr tested if we have to go deeper than one level into XFF */
                 Filled(calloutContext->acl_checklist)->src_addr = request->indirect_client_addr;
             }
--- a/SOURCES/squid-4.15-CVE-2023-5824.patch
+++ b/SOURCES/squid-4.15-CVE-2023-5824.patch
--- a/SOURCES/squid-4.15-CVE-2024-23638.patch
+++ b/SOURCES/squid-4.15-CVE-2024-23638.patch
@ -16,13 +16,14 @@ Date:   Sun Nov 12 09:33:20 2023 +0000
    responsible for the disappearance of the properly locked StoreEntry in
    this (and probably other) contexts.
 diff --git a/src/cache_manager.cc b/src/cache_manager.cc
-index 61c7f65be..65bf22dd0 100644
+index 8055ece..fdcc9cf 100644
 --- a/src/cache_manager.cc
 +++ b/src/cache_manager.cc
-@@ -326,7 +326,6 @@ CacheManager::start(const Comm::ConnectionPointer &client, HttpRequest *request,
+@@ -323,7 +323,6 @@ CacheManager::Start(const Comm::ConnectionPointer &client, HttpRequest * request
         const auto err = new ErrorState(ERR_INVALID_URL, Http::scNotFound, request);
         err->url = xstrdup(entry->url());
         err->detailError(new ExceptionErrorDetail(Here().id()));
         errorAppendEntry(entry, err);
 -        entry->expires = squid_curtime;
         return;
--- a/SOURCES/squid-4.15-CVE-2024-25111.patch
+++ b/SOURCES/squid-4.15-CVE-2024-25111.patch
@ -1,8 +1,8 @@
 diff --git a/src/http.cc b/src/http.cc
-index 98e3969..8b55bf3 100644
+index b006300..023e411 100644
 --- a/src/http.cc
 +++ b/src/http.cc
-@@ -54,6 +54,7 @@
+@@ -52,6 +52,7 @@
 #include "rfc1738.h"
 #include "SquidConfig.h"
 #include "SquidTime.h"
@ -10,7 +10,7 @@ index 98e3969..8b55bf3 100644
 #include "StatCounters.h"
 #include "Store.h"
 #include "StrList.h"
-@@ -1235,18 +1236,26 @@ HttpStateData::readReply(const CommIoCbParams &io)
+@@ -1150,18 +1151,26 @@ HttpStateData::readReply(const CommIoCbParams &io)
      * Plus, it breaks our lame *HalfClosed() detection
      */
@ -18,13 +18,13 @@ index 98e3969..8b55bf3 100644
 -    CommIoCbParams rd(this); // will be expanded with ReadNow results
 -    rd.conn = io.conn;
 -    rd.size = entry->bytesWanted(Range<size_t>(0, inBuf.spaceSize()));
-+    const auto moreDataPermission = canBufferMoreReplyBytes();
+    size_t moreDataPermission = 0;
-+    if (!moreDataPermission) {
+    if ((!canBufferMoreReplyBytes(&moreDataPermission) || !moreDataPermission)) {
 +        abortTransaction("ready to read required data, but the read buffer is full and cannot be drained");
 +        return;
 +    }
 +
-+    const auto readSizeMax = maybeMakeSpaceAvailable(moreDataPermission.value());
+    const auto readSizeMax = maybeMakeSpaceAvailable(moreDataPermission);
 +    // TODO: Move this logic inside maybeMakeSpaceAvailable():
 +    const auto readSizeWanted = readSizeMax ? entry->bytesWanted(Range<size_t>(0, readSizeMax)) : 0;
@ -42,24 +42,23 @@ index 98e3969..8b55bf3 100644
     switch (Comm::ReadNow(rd, inBuf)) {
     case Comm::INPROGRESS:
         if (inBuf.isEmpty())
-@@ -1617,8 +1626,10 @@ HttpStateData::maybeReadVirginBody()
+@@ -1520,8 +1529,11 @@ HttpStateData::maybeReadVirginBody()
     if (!Comm::IsConnOpen(serverConnection) || fd_table[serverConnection->fd].closing())
         return;
 -    if (!maybeMakeSpaceAvailable(false))
-+    if (!canBufferMoreReplyBytes()) {
+    size_t moreDataPermission = 0;
 +    if ((!canBufferMoreReplyBytes(&moreDataPermission)) || !moreDataPermission) {
 +        abortTransaction("more response bytes required, but the read buffer is full and cannot be drained");
         return;
 +    }
     // XXX: get rid of the do_next_read flag
     // check for the proper reasons preventing read(2)
-@@ -1636,40 +1647,78 @@ HttpStateData::maybeReadVirginBody()
+@@ -1539,40 +1551,79 @@ HttpStateData::maybeReadVirginBody()
     Comm::Read(serverConnection, call);
 }
 -bool
 -HttpStateData::maybeMakeSpaceAvailable(bool doGrow)
 +/// Desired inBuf capacity based on various capacity preferences/limits:
 +/// * a smaller buffer may not hold enough for look-ahead header/body parsers;
 +/// * a smaller buffer may result in inefficient tiny network reads;
@ -67,17 +66,7 @@ index 98e3969..8b55bf3 100644
 +/// * a bigger buffer may exceed SBuf storage capabilities (SBuf::maxSize);
 +size_t
 +HttpStateData::calcReadBufferCapacityLimit() const
- {
+{
 -    // how much we are allowed to buffer
 -    const int limitBuffer = (flags.headers_parsed ? Config.readAheadGap : Config.maxReplyHeaderSize);
 -
 -    if (limitBuffer < 0 || inBuf.length() >= (SBuf::size_type)limitBuffer) {
 -        // when buffer is at or over limit already
 -        debugs(11, 7, "will not read up to " << limitBuffer << ". buffer has (" << inBuf.length() << "/" << inBuf.spaceSize() << ") from " << serverConnection);
 -        debugs(11, DBG_DATA, "buffer has {" << inBuf << "}");
 -        // Process next response from buffer
 -        processReply();
 -        return false;
 +    if (!flags.headers_parsed)
 +        return Config.maxReplyHeaderSize;
 +
@ -88,7 +77,7 @@ index 98e3969..8b55bf3 100644
 +    //
 +    // TODO: Cannot reuse throwing NaturalCast() here. Consider removing
 +    // .value() dereference in NaturalCast() or add/use NaturalCastOrMax().
-+    const auto configurationPreferences = NaturalSum<size_t>(Config.readAheadGap).value_or(SBuf::maxSize);
+    const auto configurationPreferences = NaturalSum<size_t>(Config.readAheadGap).second ? NaturalSum<size_t>(Config.readAheadGap).first : SBuf::maxSize;
 +
 +    // TODO: Honor TeChunkedParser look-ahead and trailer parsing requirements
 +    // (when explicit configurationPreferences are set too low).
@ -101,27 +90,39 @@ index 98e3969..8b55bf3 100644
 +/// \retval std::nullopt means that no more virgin response bytes can be read
 +/// \retval 0 means that more virgin response bytes may be read later
 +/// \retval >0 is the number of bytes that can be read now (subject to other constraints)
-+std::optional<size_t>
+ bool
-+HttpStateData::canBufferMoreReplyBytes() const
+-HttpStateData::maybeMakeSpaceAvailable(bool doGrow)
-+{
+HttpStateData::canBufferMoreReplyBytes(size_t *maxReadSize) const
 {
 -    // how much we are allowed to buffer
 -    const int limitBuffer = (flags.headers_parsed ? Config.readAheadGap : Config.maxReplyHeaderSize);
 -
 -    if (limitBuffer < 0 || inBuf.length() >= (SBuf::size_type)limitBuffer) {
 -        // when buffer is at or over limit already
 -        debugs(11, 7, "will not read up to " << limitBuffer << ". buffer has (" << inBuf.length() << "/" << inBuf.spaceSize() << ") from " << serverConnection);
 -        debugs(11, DBG_DATA, "buffer has {" << inBuf << "}");
 -        // Process next response from buffer
 -        processReply();
 -        return false;
 +#if USE_ADAPTATION
 +    // If we do not check this now, we may say the final "no" prematurely below
 +    // because inBuf.length() will decrease as adaptation drains buffered bytes.
 +    if (responseBodyBuffer) {
 +        debugs(11, 3, "yes, but waiting for adaptation to drain read buffer");
-+        return 0; // yes, we may be able to buffer more (but later)
+        *maxReadSize = 0; // yes, we may be able to buffer more (but later)
 +        return true;
 +    }
 +#endif
 +
 +    const auto maxCapacity = calcReadBufferCapacityLimit();
 +    if (inBuf.length() >= maxCapacity) {
 +        debugs(11, 3, "no, due to a full buffer: " << inBuf.length() << '/' << inBuf.spaceSize() << "; limit: " << maxCapacity);
-+        return std::nullopt; // no, configuration prohibits buffering more
+        return false; // no, configuration prohibits buffering more
     }
-+    const auto maxReadSize = maxCapacity - inBuf.length(); // positive
+    *maxReadSize = (maxCapacity - inBuf.length()); // positive
-+    debugs(11, 7, "yes, may read up to " << maxReadSize << " into " << inBuf.length() << '/' << inBuf.spaceSize());
+    debugs(11, 7, "yes, may read up to " << *maxReadSize << " into " << inBuf.length() << '/' << inBuf.spaceSize());
-+    return maxReadSize; // yes, can read up to this many bytes (subject to other constraints)
+    return true; // yes, can read up to this many bytes (subject to other constraints)
 +}
 +
 +/// prepare read buffer for reading
@ -158,7 +159,7 @@ index 98e3969..8b55bf3 100644
 /// called after writing the very last request byte (body, last-chunk, etc)
 diff --git a/src/http.h b/src/http.h
-index e70cd7e..f7ed40d 100644
+index 8965b77..007d2e6 100644
 --- a/src/http.h
 +++ b/src/http.h
@@ -15,6 +15,8 @@
@ -169,8 +170,8 @@ index e70cd7e..f7ed40d 100644
 +
 class FwdState;
 class HttpHeader;
- class String;
+ 
-@@ -112,16 +114,9 @@ private:
+@@ -107,16 +109,9 @@ private:
     void abortTransaction(const char *reason) { abortAll(reason); } // abnormal termination
@ -185,7 +186,7 @@ index e70cd7e..f7ed40d 100644
 -     */
 -    bool maybeMakeSpaceAvailable(bool grow);
 +    size_t calcReadBufferCapacityLimit() const;
-+    std::optional<size_t> canBufferMoreReplyBytes() const;
+    bool canBufferMoreReplyBytes(size_t *maxReadSize) const;
 +    size_t maybeMakeSpaceAvailable(size_t maxReadSize);
     // consuming request body
--- a/SOURCES/squid-4.15-CVE-2024-25617.patch
+++ b/SOURCES/squid-4.15-CVE-2024-25617.patch
@ -1,10 +1,10 @@
 diff --git a/src/SquidString.h b/src/SquidString.h
-index e36cd27..ea613ad 100644
+index a791885..b9aef38 100644
 --- a/src/SquidString.h
 +++ b/src/SquidString.h
-@@ -140,7 +140,16 @@ private:
+@@ -114,7 +114,16 @@ private:
-     size_type len_ = 0;  /* current length  */
+     size_type len_;  /* current length  */
 -    static const size_type SizeMax_ = 65535; ///< 64K limit protects some fixed-size buffers
 +    /// An earlier 64KB limit was meant to protect some fixed-size buffers, but
@ -21,10 +21,10 @@ index e36cd27..ea613ad 100644
     static bool SafeAdd(size_type &base, size_type extra) { if (extra <= SizeMax_ && base <= SizeMax_ - extra) { base += extra; return true; } return false; }
 diff --git a/src/cache_cf.cc b/src/cache_cf.cc
-index cb746dc..c4ade96 100644
+index a9c1b7e..46f07bb 100644
 --- a/src/cache_cf.cc
 +++ b/src/cache_cf.cc
-@@ -950,6 +950,18 @@ configDoConfigure(void)
+@@ -935,6 +935,18 @@ configDoConfigure(void)
                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
     }
@ -44,10 +44,10 @@ index cb746dc..c4ade96 100644
      * Disable client side request pipelining if client_persistent_connections OFF.
      * Waste of resources queueing any pipelined requests when the first will close the connection.
 diff --git a/src/cf.data.pre b/src/cf.data.pre
-index 67a66b0..61a66f1 100644
+index bc2ddcd..d55b870 100644
 --- a/src/cf.data.pre
 +++ b/src/cf.data.pre
-@@ -6489,11 +6489,14 @@ TYPE: b_size_t
+@@ -6196,11 +6196,14 @@ TYPE: b_size_t
 DEFAULT: 64 KB
 LOC: Config.maxRequestHeaderSize
 DOC_START
@ -67,7 +67,7 @@ index 67a66b0..61a66f1 100644
 DOC_END
 NAME: reply_header_max_size
-@@ -6502,11 +6505,14 @@ TYPE: b_size_t
+@@ -6209,11 +6212,14 @@ TYPE: b_size_t
 DEFAULT: 64 KB
 LOC: Config.maxReplyHeaderSize
 DOC_START
@ -88,10 +88,10 @@ index 67a66b0..61a66f1 100644
 NAME: request_body_max_size
 diff --git a/src/http.cc b/src/http.cc
-index 7c9ae70..98e3969 100644
+index 877172d..b006300 100644
 --- a/src/http.cc
 +++ b/src/http.cc
-@@ -1926,8 +1926,9 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
+@@ -1820,8 +1820,9 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
         String strFwd = hdr_in->getList(Http::HdrType::X_FORWARDED_FOR);
--- a/SOURCES/squid-4.15-ftp-filename-extraction.patch
+++ b/SOURCES/squid-4.15-ftp-filename-extraction.patch
@ -0,0 +1,32 @@
 diff --git a/src/clients/FtpGateway.cc b/src/clients/FtpGateway.cc
 index da9867f..e992638 100644
 --- a/src/clients/FtpGateway.cc
 +++ b/src/clients/FtpGateway.cc
@@ -1084,16 +1084,17 @@ Ftp::Gateway::checkAuth(const HttpHeader * req_hdr)
 void
 Ftp::Gateway::checkUrlpath()
 {
 -    static SBuf str_type_eq("type=");
 -    auto t = request->url.path().rfind(';');
 -
 -    if (t != SBuf::npos) {
 -        auto filenameEnd = t-1;
 -        if (request->url.path().substr(++t).cmp(str_type_eq, str_type_eq.length()) == 0) {
 -            t += str_type_eq.length();
 -            typecode = (char)xtoupper(request->url.path()[t]);
 -            request->url.path(request->url.path().substr(0,filenameEnd));
 -        }
 +    // If typecode was specified, extract it and leave just the filename in
 +    // url.path. Tolerate trailing garbage or missing typecode value. Roughly:
 +    // [filename] ;type=[typecode char] [trailing garbage]
 +    static const SBuf middle(";type=");
 +    const auto typeSpecStart = request->url.path().find(middle);
 +    if (typeSpecStart != SBuf::npos) {
 +        const auto fullPath = request->url.path();
 +        const auto typecodePos = typeSpecStart + middle.length();
 +        typecode = (typecodePos < fullPath.length()) ?
 +            static_cast<char>(xtoupper(fullPath[typecodePos])) : '\0';
 +        request->url.path(fullPath.substr(0, typeSpecStart));
     }
     int l = request->url.path().length();
--- a/SOURCES/squid-4.15-halfclosed.patch
+++ b/SOURCES/squid-4.15-halfclosed.patch
@ -1,8 +1,8 @@
 diff --git a/src/client_side.cc b/src/client_side.cc
-index 4eb6976..63f1b66 100644
+index f57f3f7..ab393e4 100644
 --- a/src/client_side.cc
 +++ b/src/client_side.cc
-@@ -957,7 +957,7 @@ ConnStateData::kick()
+@@ -906,7 +906,7 @@ ConnStateData::kick()
      * We are done with the response, and we are either still receiving request
      * body (early response!) or have already stopped receiving anything.
      *
@ -11,7 +11,7 @@ index 4eb6976..63f1b66 100644
      * (XXX: but then we will call readNextRequest() which may succeed and
      * execute a smuggled request as we are not done with the current request).
      *
-@@ -977,28 +977,12 @@ ConnStateData::kick()
+@@ -926,28 +926,12 @@ ConnStateData::kick()
      * Attempt to parse a request from the request buffer.
      * If we've been fed a pipelined request it may already
      * be in our read buffer.
@ -42,8 +42,8 @@ index 4eb6976..63f1b66 100644
     /** \par
      * At this point we either have a parsed request (which we've
-@@ -1935,16 +1919,11 @@ ConnStateData::receivedFirstByte()
+@@ -2058,16 +2042,11 @@ ConnStateData::receivedFirstByte()
-     resetReadTimeout(Config.Timeout.request);
+     commSetConnTimeout(clientConnection, Config.Timeout.request, timeoutCall);
 }
 -/**
@ -63,7 +63,7 @@ index 4eb6976..63f1b66 100644
     debugs(33, 5, HERE << clientConnection << ": attempting to parse");
     // Loop while we have read bytes that are not needed for producing the body
-@@ -1989,8 +1968,6 @@ ConnStateData::clientParseRequests()
+@@ -2116,8 +2095,6 @@ ConnStateData::clientParseRequests()
             processParsedRequest(context);
@ -72,7 +72,7 @@ index 4eb6976..63f1b66 100644
             if (context->mayUseConnection()) {
                 debugs(33, 3, HERE << "Not parsing new requests, as this request may need the connection");
                 break;
-@@ -2003,8 +1980,19 @@ ConnStateData::clientParseRequests()
+@@ -2130,8 +2107,19 @@ ConnStateData::clientParseRequests()
         }
     }
@ -94,16 +94,21 @@ index 4eb6976..63f1b66 100644
 }
 void
-@@ -2021,18 +2009,7 @@ ConnStateData::afterClientRead()
+@@ -2148,23 +2136,7 @@ ConnStateData::afterClientRead()
     if (pipeline.empty())
         fd_note(clientConnection->fd, "Reading next request");
 -    if (!clientParseRequests()) {
 -        if (!isOpen())
 -            return;
-        // We may get here if the client half-closed after sending a partial
+-        /*
-        // request. See doClientRead() and shouldCloseOnEof().
+-         * If the client here is half closed and we failed
-        // XXX: This partially duplicates ConnStateData::kick().
+-         * to parse a request, close the connection.
 -         * The above check with connFinishedWithConn() only
 -         * succeeds _if_ the buffer is empty which it won't
 -         * be if we have an incomplete request.
 -         * XXX: This duplicates ConnStateData::kick
 -         */
 -        if (pipeline.empty() && commIsHalfClosed(clientConnection->fd)) {
 -            debugs(33, 5, clientConnection << ": half-closed connection, no completed request parsed, connection closing.");
 -            clientConnection->close();
@ -114,7 +119,7 @@ index 4eb6976..63f1b66 100644
     if (!isOpen())
         return;
-@@ -3789,7 +3766,7 @@ ConnStateData::notePinnedConnectionBecameIdle(PinnedIdleContext pic)
+@@ -3945,7 +3917,7 @@ ConnStateData::notePinnedConnectionBecameIdle(PinnedIdleContext pic)
     startPinnedConnectionMonitoring();
     if (pipeline.empty())
@ -124,10 +129,10 @@ index 4eb6976..63f1b66 100644
 /// Forward future client requests using the given server connection.
 diff --git a/src/client_side.h b/src/client_side.h
-index 2793673..7c8d86b 100644
+index 9fe8463..dfb4d8e 100644
 --- a/src/client_side.h
 +++ b/src/client_side.h
-@@ -93,7 +93,6 @@ public:
+@@ -85,7 +85,6 @@ public:
     virtual void doneWithControlMsg();
     /// Traffic parsing
@ -135,16 +140,16 @@ index 2793673..7c8d86b 100644
     void readNextRequest();
     /// try to make progress on a transaction or read more I/O
-@@ -422,6 +421,7 @@ private:
+@@ -373,6 +372,7 @@ private:
- 
+     virtual bool connFinishedWithConn(int size);
-     void checkLogging();
+     virtual void checkLogging();
 +    void parseRequests();
     void clientAfterReadingRequests();
     bool concurrentRequestQueueFilled() const;
 diff --git a/src/tests/stub_client_side.cc b/src/tests/stub_client_side.cc
-index acf61c4..b1d82bf 100644
+index d7efb0f..655ed83 100644
 --- a/src/tests/stub_client_side.cc
 +++ b/src/tests/stub_client_side.cc
@@ -14,7 +14,7 @@
--- a/SOURCES/squid-4.15-ignore-wsp-after-chunk-size.patch
+++ b/SOURCES/squid-4.15-ignore-wsp-after-chunk-size.patch
@ -0,0 +1,367 @@
 From 8d0ee420a4d91ac7fd97316338f1e28b4b060cbf Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
 Date: Thu, 10 Oct 2024 19:26:27 +0200
 Subject: [PATCH 1/6] Ignore whitespace chars after chunk-size
 Previously (before #1498 change), squid was accepting TE-chunked replies
 with whitespaces after chunk-size and missing chunk-ext data. After
 It turned out that replies with such whitespace chars are pretty
 common and other webservers which can act as forward proxies (e.g.
 nginx, httpd...) are accepting them.
 This change will allow to proxy chunked responses from origin server,
 which had whitespaces inbetween chunk-size and CRLF.
 ---
 src/http/one/TeChunkedParser.cc | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/http/one/TeChunkedParser.cc b/src/http/one/TeChunkedParser.cc
 index 9cce10fdc91..04753395e16 100644
 --- a/src/http/one/TeChunkedParser.cc
 +++ b/src/http/one/TeChunkedParser.cc
@@ -125,6 +125,7 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
     // Code becomes much simpler when incremental parsing functions throw on
     // bad or insufficient input, like in the code below. TODO: Expand up.
     try {
 +        tok.skipAll(CharacterSet::WSP); // Some servers send SP/TAB after chunk-size
         parseChunkExtensions(tok); // a possibly empty chunk-ext list
         tok.skipRequired("CRLF after [chunk-ext]", Http1::CrLf());
         buf_ = tok.remaining();
 From 9c8d35f899035fa06021ab3fe6919f892c2f0c6b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
 Date: Fri, 11 Oct 2024 02:06:31 +0200
 Subject: [PATCH 2/6] Added new argument to Http::One::ParseBws()
 Depending on new wsp_only argument in ParseBws() it will be decided
 which set of whitespaces characters will be parsed. If wsp_only is set
 to true, only SP and HTAB chars will be parsed.
 Also optimized number of ParseBws calls.
 ---
 src/http/one/Parser.cc          |  4 ++--
 src/http/one/Parser.h           |  3 ++-
 src/http/one/TeChunkedParser.cc | 13 +++++++++----
 src/http/one/TeChunkedParser.h  |  2 +-
 4 files changed, 14 insertions(+), 8 deletions(-)
 diff --git a/src/http/one/Parser.cc b/src/http/one/Parser.cc
 index b1908316a0b..01d7e3bc0e8 100644
 --- a/src/http/one/Parser.cc
 +++ b/src/http/one/Parser.cc
@@ -273,9 +273,9 @@ Http::One::ErrorLevel()
 // BWS = *( SP / HTAB ) ; WhitespaceCharacters() may relax this RFC 7230 rule
 void
 -Http::One::ParseBws(Parser::Tokenizer &tok)
 +Http::One::ParseBws(Parser::Tokenizer &tok, const bool wsp_only)
 {
 -    const auto count = tok.skipAll(Parser::WhitespaceCharacters());
 +    const auto count = tok.skipAll(wsp_only ? CharacterSet::WSP : Parser::WhitespaceCharacters());
     if (tok.atEnd())
         throw InsufficientInput(); // even if count is positive
 diff --git a/src/http/one/Parser.h b/src/http/one/Parser.h
 index d9a0ac8c273..08200371cd6 100644
 --- a/src/http/one/Parser.h
 +++ b/src/http/one/Parser.h
@@ -163,8 +163,9 @@ class Parser : public RefCountable
 };
 /// skips and, if needed, warns about RFC 7230 BWS ("bad" whitespace)
 +/// \param wsp_only force skipping of whitespaces only, don't consider skipping relaxed delimeter chars
 /// \throws InsufficientInput when the end of BWS cannot be confirmed
 -void ParseBws(Parser::Tokenizer &);
 +void ParseBws(Parser::Tokenizer &, const bool wsp_only = false);
 /// the right debugs() level for logging HTTP violation messages
 int ErrorLevel();
 diff --git a/src/http/one/TeChunkedParser.cc b/src/http/one/TeChunkedParser.cc
 index 04753395e16..41e1e5ddaea 100644
 --- a/src/http/one/TeChunkedParser.cc
 +++ b/src/http/one/TeChunkedParser.cc
@@ -125,8 +125,11 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
     // Code becomes much simpler when incremental parsing functions throw on
     // bad or insufficient input, like in the code below. TODO: Expand up.
     try {
 -        tok.skipAll(CharacterSet::WSP); // Some servers send SP/TAB after chunk-size
 -        parseChunkExtensions(tok); // a possibly empty chunk-ext list
 +        // A possibly empty chunk-ext list. If no chunk-ext has been found,
 +        // try to skip trailing BWS, because some servers send "chunk-size BWS CRLF".
 +        if (!parseChunkExtensions(tok))
 +            ParseBws(tok, true);
 +
         tok.skipRequired("CRLF after [chunk-ext]", Http1::CrLf());
         buf_ = tok.remaining();
         parsingStage_ = theChunkSize ? Http1::HTTP_PARSE_CHUNK : Http1::HTTP_PARSE_MIME;
@@ -140,20 +143,22 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
 /// Parses the chunk-ext list (RFC 9112 section 7.1.1:
 /// chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] )
 -void
 +bool
 Http::One::TeChunkedParser::parseChunkExtensions(Tokenizer &callerTok)
 {
 +    bool foundChunkExt = false;
     do {
         auto tok = callerTok;
         ParseBws(tok); // Bug 4492: IBM_HTTP_Server sends SP after chunk-size
         if (!tok.skip(';'))
 -            return; // reached the end of extensions (if any)
 +            return foundChunkExt; // reached the end of extensions (if any)
         parseOneChunkExtension(tok);
         buf_ = tok.remaining(); // got one extension
         callerTok = tok;
 +        foundChunkExt = true;
     } while (true);
 }
 diff --git a/src/http/one/TeChunkedParser.h b/src/http/one/TeChunkedParser.h
 index 02eacd1bb89..8c5d4bb4cba 100644
 --- a/src/http/one/TeChunkedParser.h
 +++ b/src/http/one/TeChunkedParser.h
@@ -71,7 +71,7 @@ class TeChunkedParser : public Http1::Parser
 private:
     bool parseChunkSize(Tokenizer &tok);
     bool parseChunkMetadataSuffix(Tokenizer &);
 -    void parseChunkExtensions(Tokenizer &);
 +    bool parseChunkExtensions(Tokenizer &);
     void parseOneChunkExtension(Tokenizer &);
     bool parseChunkBody(Tokenizer &tok);
     bool parseChunkEnd(Tokenizer &tok);
 From 81e67f97f9c386bdd0bb4a5e182395c46adb70ad Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
 Date: Fri, 11 Oct 2024 02:44:33 +0200
 Subject: [PATCH 3/6] Fix typo in Parser.h
 ---
 src/http/one/Parser.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/http/one/Parser.h b/src/http/one/Parser.h
 index 08200371cd6..3ef4c5f7752 100644
 --- a/src/http/one/Parser.h
 +++ b/src/http/one/Parser.h
@@ -163,7 +163,7 @@ class Parser : public RefCountable
 };
 /// skips and, if needed, warns about RFC 7230 BWS ("bad" whitespace)
 -/// \param wsp_only force skipping of whitespaces only, don't consider skipping relaxed delimeter chars
 +/// \param wsp_only force skipping of whitespaces only, don't consider skipping relaxed delimiter chars
 /// \throws InsufficientInput when the end of BWS cannot be confirmed
 void ParseBws(Parser::Tokenizer &, const bool wsp_only = false);
 From a0d4fe1794e605f8299a5c118c758a807453f016 Mon Sep 17 00:00:00 2001
 From: Alex Rousskov <rousskov@measurement-factory.com>
 Date: Thu, 10 Oct 2024 22:39:42 -0400
 Subject: [PATCH 4/6] Bug 5449 is a regression of Bug 4492!
 Both bugs deal with "chunk-size SP+ CRLF" use cases. Bug 4492 had _two_
 spaces after chunk-size, which answers one of the PR review questions:
 Should we skip just one space? No, we should not.
 The lines moved around in many commits, but I believe this regression
 was introduced in commit 951013d0 because that commit stopped consuming
 partially parsed chunk-ext sequences. That consumption was wrong, but it
 had a positive side effect -- fixing Bug 4492...
 ---
 src/http/one/TeChunkedParser.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/src/http/one/TeChunkedParser.cc b/src/http/one/TeChunkedParser.cc
 index 41e1e5ddaea..aa4a840fdcf 100644
 --- a/src/http/one/TeChunkedParser.cc
 +++ b/src/http/one/TeChunkedParser.cc
@@ -125,10 +125,10 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
     // Code becomes much simpler when incremental parsing functions throw on
     // bad or insufficient input, like in the code below. TODO: Expand up.
     try {
 -        // A possibly empty chunk-ext list. If no chunk-ext has been found,
 -        // try to skip trailing BWS, because some servers send "chunk-size BWS CRLF".
 -        if (!parseChunkExtensions(tok))
 -            ParseBws(tok, true);
 +        // Bug 4492: IBM_HTTP_Server sends SP after chunk-size
 +        ParseBws(tok, true);
 +
 +        parseChunkExtensions(tok);
         tok.skipRequired("CRLF after [chunk-ext]", Http1::CrLf());
         buf_ = tok.remaining();
@@ -150,7 +150,7 @@ Http::One::TeChunkedParser::parseChunkExtensions(Tokenizer &callerTok)
     do {
         auto tok = callerTok;
 -        ParseBws(tok); // Bug 4492: IBM_HTTP_Server sends SP after chunk-size
 +        ParseBws(tok);
         if (!tok.skip(';'))
             return foundChunkExt; // reached the end of extensions (if any)
 From f837f5ff61301a17008f16ce1fb793c2abf19786 Mon Sep 17 00:00:00 2001
 From: Alex Rousskov <rousskov@measurement-factory.com>
 Date: Thu, 10 Oct 2024 23:06:42 -0400
 Subject: [PATCH 5/6] fixup: Fewer conditionals/ifs and more explicit spelling
 ... to draw code reader attention when something unusual is going on.
 ---
 src/http/one/Parser.cc          | 22 ++++++++++++++++++----
 src/http/one/Parser.h           | 10 ++++++++--
 src/http/one/TeChunkedParser.cc | 14 ++++++--------
 src/http/one/TeChunkedParser.h  |  2 +-
 4 files changed, 33 insertions(+), 15 deletions(-)
 diff --git a/src/http/one/Parser.cc b/src/http/one/Parser.cc
 index 01d7e3bc0e8..d3937e5e96b 100644
 --- a/src/http/one/Parser.cc
 +++ b/src/http/one/Parser.cc
@@ -271,11 +271,12 @@ Http::One::ErrorLevel()
     return Config.onoff.relaxed_header_parser < 0 ? DBG_IMPORTANT : 5;
 }
 -// BWS = *( SP / HTAB ) ; WhitespaceCharacters() may relax this RFC 7230 rule
 -void
 -Http::One::ParseBws(Parser::Tokenizer &tok, const bool wsp_only)
 +/// common part of ParseBws() and ParseStrctBws()
 +namespace Http::One {
 +static void
 +ParseBws_(Parser::Tokenizer &tok, const CharacterSet &bwsChars)
 {
 -    const auto count = tok.skipAll(wsp_only ? CharacterSet::WSP : Parser::WhitespaceCharacters());
 +    const auto count = tok.skipAll(bwsChars);
     if (tok.atEnd())
         throw InsufficientInput(); // even if count is positive
@@ -290,4 +291,17 @@ Http::One::ParseBws(Parser::Tokenizer &tok, const bool wsp_only)
     // success: no more BWS characters expected
 }
 +} // namespace Http::One
 +
 +void
 +Http::One::ParseBws(Parser::Tokenizer &tok)
 +{
 +    ParseBws_(tok, CharacterSet::WSP);
 +}
 +
 +void
 +Http::One::ParseStrictBws(Parser::Tokenizer &tok)
 +{
 +    ParseBws_(tok, Parser::WhitespaceCharacters());
 +}
 diff --git a/src/http/one/Parser.h b/src/http/one/Parser.h
 index 3ef4c5f7752..49e399de546 100644
 --- a/src/http/one/Parser.h
 +++ b/src/http/one/Parser.h
@@ -163,9 +163,15 @@ class Parser : public RefCountable
 };
 /// skips and, if needed, warns about RFC 7230 BWS ("bad" whitespace)
 -/// \param wsp_only force skipping of whitespaces only, don't consider skipping relaxed delimiter chars
 /// \throws InsufficientInput when the end of BWS cannot be confirmed
 -void ParseBws(Parser::Tokenizer &, const bool wsp_only = false);
 +/// \sa WhitespaceCharacters() for the definition of BWS characters
 +/// \sa ParseStrictBws() that avoids WhitespaceCharacters() uncertainties
 +void ParseBws(Parser::Tokenizer &);
 +
 +/// Like ParseBws() but only skips CharacterSet::WSP characters. This variation
 +/// must be used if the next element may start with CR or any other character
 +/// from RelaxedDelimiterCharacters().
 +void ParseStrictBws(Parser::Tokenizer &);
 /// the right debugs() level for logging HTTP violation messages
 int ErrorLevel();
 diff --git a/src/http/one/TeChunkedParser.cc b/src/http/one/TeChunkedParser.cc
 index aa4a840fdcf..859471b8c77 100644
 --- a/src/http/one/TeChunkedParser.cc
 +++ b/src/http/one/TeChunkedParser.cc
@@ -125,11 +125,11 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
     // Code becomes much simpler when incremental parsing functions throw on
     // bad or insufficient input, like in the code below. TODO: Expand up.
     try {
 -        // Bug 4492: IBM_HTTP_Server sends SP after chunk-size
 -        ParseBws(tok, true);
 -
 -        parseChunkExtensions(tok);
 +        // Bug 4492: IBM_HTTP_Server sends SP after chunk-size.
 +        // No ParseBws() here because it may consume CR required further below.
 +        ParseStrictBws(tok);
 +        parseChunkExtensions(tok); // a possibly empty chunk-ext list
         tok.skipRequired("CRLF after [chunk-ext]", Http1::CrLf());
         buf_ = tok.remaining();
         parsingStage_ = theChunkSize ? Http1::HTTP_PARSE_CHUNK : Http1::HTTP_PARSE_MIME;
@@ -143,22 +143,20 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
 /// Parses the chunk-ext list (RFC 9112 section 7.1.1:
 /// chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] )
 -bool
 +void
 Http::One::TeChunkedParser::parseChunkExtensions(Tokenizer &callerTok)
 {
 -    bool foundChunkExt = false;
     do {
         auto tok = callerTok;
         ParseBws(tok);
         if (!tok.skip(';'))
 -            return foundChunkExt; // reached the end of extensions (if any)
 +            return; // reached the end of extensions (if any)
         parseOneChunkExtension(tok);
         buf_ = tok.remaining(); // got one extension
         callerTok = tok;
 -        foundChunkExt = true;
     } while (true);
 }
 diff --git a/src/http/one/TeChunkedParser.h b/src/http/one/TeChunkedParser.h
 index 8c5d4bb4cba..02eacd1bb89 100644
 --- a/src/http/one/TeChunkedParser.h
 +++ b/src/http/one/TeChunkedParser.h
@@ -71,7 +71,7 @@ class TeChunkedParser : public Http1::Parser
 private:
     bool parseChunkSize(Tokenizer &tok);
     bool parseChunkMetadataSuffix(Tokenizer &);
 -    bool parseChunkExtensions(Tokenizer &);
 +    void parseChunkExtensions(Tokenizer &);
     void parseOneChunkExtension(Tokenizer &);
     bool parseChunkBody(Tokenizer &tok);
     bool parseChunkEnd(Tokenizer &tok);
 From f79936a234e722adb2dd08f31cf6019d81ee712c Mon Sep 17 00:00:00 2001
 From: Alex Rousskov <rousskov@measurement-factory.com>
 Date: Thu, 10 Oct 2024 23:31:08 -0400
 Subject: [PATCH 6/6] fixup: Deadly typo
 ---
 src/http/one/Parser.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/http/one/Parser.cc b/src/http/one/Parser.cc
 index d3937e5e96b..7403a9163a2 100644
 --- a/src/http/one/Parser.cc
 +++ b/src/http/one/Parser.cc
@@ -296,12 +296,12 @@ ParseBws_(Parser::Tokenizer &tok, const CharacterSet &bwsChars)
 void
 Http::One::ParseBws(Parser::Tokenizer &tok)
 {
 -    ParseBws_(tok, CharacterSet::WSP);
 +    ParseBws_(tok, Parser::WhitespaceCharacters());
 }
 void
 Http::One::ParseStrictBws(Parser::Tokenizer &tok)
 {
 -    ParseBws_(tok, Parser::WhitespaceCharacters());
 +    ParseBws_(tok, CharacterSet::WSP);
 }
--- a/SOURCES/squid-4.15-ip-bind-address-no-port.patch
+++ b/SOURCES/squid-4.15-ip-bind-address-no-port.patch
@ -1,14 +1,14 @@
-commit c54122584d175cf1d292b239a5b70f2d1aa77c3a
+commit c08948c8b831a2ba73c676b48aa11ba1b58cc542
 Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Mon Dec 5 15:03:07 2022 +0100
+Date:   Thu Dec 8 11:03:08 2022 +0100
    Backport adding IP_BIND_ADDRESS_NO_PORT flag to outgoing connections
 diff --git a/src/comm.cc b/src/comm.cc
-index b4818f3..b18d175 100644
+index 0d5f34d..6811b54 100644
 --- a/src/comm.cc
 +++ b/src/comm.cc
-@@ -59,6 +59,7 @@
+@@ -58,6 +58,7 @@
  */
 static IOCB commHalfClosedReader;
@ -16,7 +16,7 @@ index b4818f3..b18d175 100644
 static void comm_init_opened(const Comm::ConnectionPointer &conn, const char *note, struct addrinfo *AI);
 static int comm_apply_flags(int new_socket, Ip::Address &addr, int flags, struct addrinfo *AI);
-@@ -76,6 +77,7 @@ static EVH commHalfClosedCheck;
+@@ -75,6 +76,7 @@ static EVH commHalfClosedCheck;
 static void commPlanHalfClosedCheck();
 static Comm::Flag commBind(int s, struct addrinfo &);
@ -24,7 +24,7 @@ index b4818f3..b18d175 100644
 static void commSetReuseAddr(int);
 static void commSetNoLinger(int);
 #ifdef TCP_NODELAY
-@@ -202,6 +204,22 @@ comm_local_port(int fd)
+@@ -201,6 +203,22 @@ comm_local_port(int fd)
     return F->local_addr.port();
 }
@ -47,7 +47,7 @@ index b4818f3..b18d175 100644
 static Comm::Flag
 commBind(int s, struct addrinfo &inaddr)
 {
-@@ -228,6 +246,10 @@ comm_open(int sock_type,
+@@ -227,6 +245,10 @@ comm_open(int sock_type,
           int flags,
           const char *note)
 {
@ -58,7 +58,7 @@ index b4818f3..b18d175 100644
     return comm_openex(sock_type, proto, addr, flags, note);
 }
-@@ -329,7 +351,7 @@ comm_set_transparent(int fd)
+@@ -328,7 +350,7 @@ comm_set_transparent(int fd)
  * Create a socket. Default is blocking, stream (TCP) socket.  IO_TYPE
  * is OR of flags specified in defines.h:COMM_*
  */
@ -67,10 +67,10 @@ index b4818f3..b18d175 100644
 comm_openex(int sock_type,
             int proto,
             Ip::Address &addr,
-@@ -488,6 +510,9 @@ comm_apply_flags(int new_socket,
+@@ -476,6 +498,9 @@ comm_apply_flags(int new_socket,
-             }
+         if ( addr.isNoAddr() )
-         }
+             debugs(5,0,"CRITICAL: Squid is attempting to bind() port " << addr << "!!");
- #endif
+ 
 +        if ((flags & COMM_DOBIND_PORT_LATER))
 +            commSetBindAddressNoPort(new_socket);
 +
@ -78,7 +78,7 @@ index b4818f3..b18d175 100644
             comm_close(new_socket);
             return -1;
 diff --git a/src/comm.h b/src/comm.h
-index 5a1a7c2..a9f33db 100644
+index c963e1c..9ff201d 100644
 --- a/src/comm.h
 +++ b/src/comm.h
@@ -43,7 +43,6 @@ void comm_import_opened(const Comm::ConnectionPointer &, const char *note, struc
@ -98,10 +98,10 @@ index 5a1a7c2..a9f33db 100644
 int comm_udp_sendto(int sock, const Ip::Address &to, const void *buf, int buflen);
 diff --git a/src/comm/ConnOpener.cc b/src/comm/ConnOpener.cc
-index 19c1237..79fa2ed 100644
+index 25a30e4..2082214 100644
 --- a/src/comm/ConnOpener.cc
 +++ b/src/comm/ConnOpener.cc
-@@ -285,7 +285,7 @@ Comm::ConnOpener::createFd()
+@@ -263,7 +263,7 @@ Comm::ConnOpener::createFd()
     if (callback_ == NULL || callback_->canceled())
         return false;
@ -111,20 +111,20 @@ index 19c1237..79fa2ed 100644
         sendAnswer(Comm::ERR_CONNECT, 0, "Comm::ConnOpener::createFd");
         return false;
 diff --git a/src/comm/Connection.h b/src/comm/Connection.h
-index 40c2249..2641f4e 100644
+index 4f2f23a..1e32c22 100644
 --- a/src/comm/Connection.h
 +++ b/src/comm/Connection.h
-@@ -52,6 +52,8 @@ namespace Comm
+@@ -47,6 +47,8 @@ namespace Comm
- #define COMM_REUSEPORT          0x40 //< needs SO_REUSEPORT
+ #define COMM_DOBIND             0x08  // requires a bind()
- /// not registered with Comm and not owned by any connection-closing code
+ #define COMM_TRANSPARENT        0x10  // arrived via TPROXY
- #define COMM_ORPHANED           0x40
+ #define COMM_INTERCEPTION       0x20  // arrived via NAT
 +/// Internal Comm optimization: Keep the source port unassigned until connect(2)
 +#define COMM_DOBIND_PORT_LATER 0x100
 /**
  * Store data about the physical and logical attributes of a connection.
 diff --git a/src/ipc.cc b/src/ipc.cc
-index 45cab52..42e11e6 100644
+index e1d48fc..e92a27f 100644
 --- a/src/ipc.cc
 +++ b/src/ipc.cc
@@ -95,12 +95,12 @@ ipcCreate(int type, const char *prog, const char *const args[], const char *name
@ -143,10 +143,10 @@ index 45cab52..42e11e6 100644
                                 local_addr,
                                 0,          /* blocking */
 diff --git a/src/tests/stub_comm.cc b/src/tests/stub_comm.cc
-index a1d33d6..bf4bea6 100644
+index 58f85e4..5381ab2 100644
 --- a/src/tests/stub_comm.cc
 +++ b/src/tests/stub_comm.cc
-@@ -48,7 +48,6 @@ int comm_open_uds(int sock_type, int proto, struct sockaddr_un* addr, int flags)
+@@ -46,7 +46,6 @@ int comm_open_uds(int sock_type, int proto, struct sockaddr_un* addr, int flags)
 void comm_import_opened(const Comm::ConnectionPointer &, const char *note, struct addrinfo *AI) STUB
 int comm_open_listener(int sock_type, int proto, Ip::Address &addr, int flags, const char *note) STUB_RETVAL(-1)
 void comm_open_listener(int sock_type, int proto, Comm::ConnectionPointer &conn, const char *note) STUB
--- a/SOURCES/squid-4.15.tar.xz.asc
+++ b/SOURCES/squid-4.15.tar.xz.asc
@ -0,0 +1,25 @@
 File: squid-4.15.tar.xz
 Date: Mon 10 May 2021 10:50:22 UTC
 Size: 2454176
 MD5 : a593de9dc888dfeca4f1f7db2cd7d3b9
 SHA1: 60bda34ba39657e2d870c8c1d2acece8a69c3075
 Key : CD6DBF8EF3B17D3E <squid3@treenet.co.nz>
            B068 84ED B779 C89B 044E  64E3 CD6D BF8E F3B1 7D3E
      keyring = http://www.squid-cache.org/pgp.asc
      keyserver = pool.sks-keyservers.net
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCgAdFiEEsGiE7bd5yJsETmTjzW2/jvOxfT4FAmCZD/UACgkQzW2/jvOx
 fT6zZg/+N8JMIYpmVJ7jm4lF0Ub2kEHGTOrc+tnlA3LGnlMQuTm61+BYk58g0SKW
 96NbJ0cycW215Q34L+Y0tWuxEbIU01vIc3AA7rQd0LKy+fQU0OtBuhk5Vf4bKilW
 uHEVIQZs9HmY6bqC+kgtCf49tVZvR8FZYNuilg/68+i/pQdwaDDmVb+j2oF7w+y2
 dgkTFWtM5NTL6bqUVC0E7lLFPjzMefKfxkkpWFdV/VrAhU25jN24kpnjcfotQhdW
 LDFy5okduz3ljso9pBYJfLeMXM1FZPpceC91zj32x3tcUyrD3yIoXob58rEKvfe4
 RDXN4SuClsNe4UQ4oNoGIES9XtaYlOzPR1PlbqPUrdp1cDnhgLJ+1fkAixlMqCml
 wuI1VIKSEY+nvRzQzFHnXJK9otV8QwMF76AHaytO9y+X6JuZmu/CcV1pq61qY9qv
 t1/8z99wWSxpu17zthZgq64J225GF/hkBedaFlYoS5k5YUMDLPlRSCC0yPmb8JBF
 Cns5i/aq2PmOx2ZhQ2RQIF416J3HK8Galw8ytFOjnEcn4ux9yzKNjL38p4+PJJA0
 7GCMAqYYNjok3LSkGbiR7cPgbHnkqRfYbPFLMj4FtruoFlZ9L5MIU3oFvqA3ZR6l
 Az6LaKLsAYPUmukAOPUSIrqpKXZHc7hdBWkT+7RYA4qaoU+9oIo=
 =1Re1
 -----END PGP SIGNATURE-----
--- a/SOURCES/squid-5.0.5-symlink-lang-err.patch
+++ b/SOURCES/squid-5.0.5-symlink-lang-err.patch
@ -1,68 +0,0 @@
 From fc01451000eaa5592cd5afbd6aee14e53f7dd2c3 Mon Sep 17 00:00:00 2001
 From: Amos Jeffries <amosjeffries@squid-cache.org>
 Date: Sun, 18 Oct 2020 20:23:10 +1300
 Subject: [PATCH] Update translations integration
 * Add credits for es-mx translation moderator
 * Use es-mx for default of all Spanish (Central America) texts
 * Update translation related .am files
 ---
 doc/manuals/language.am | 2 +-
 errors/TRANSLATORS      | 1 +
 errors/aliases          | 3 ++-
 errors/language.am      | 3 ++-
 errors/template.am      | 2 +-
 5 files changed, 7 insertions(+), 4 deletions(-)
 diff --git a/doc/manuals/language.am b/doc/manuals/language.am
 index 7670c88380c..f03c4cf71b4 100644
 --- a/doc/manuals/language.am
 +++ b/doc/manuals/language.am
@@ -18,4 +18,4 @@ TRANSLATE_LANGUAGES = \
     oc.lang \
     pt.lang \
     ro.lang \
 -    ru.lang 
 +    ru.lang
 diff --git a/errors/aliases b/errors/aliases
 index 36f17f4b80f..cf0116f297d 100644
 --- a/errors/aliases
 +++ b/errors/aliases
@@ -14,7 +14,8 @@ da	da-dk
 de	de-at de-ch de-de de-li de-lu
 el	el-gr
 en	en-au en-bz en-ca en-cn en-gb en-ie en-in en-jm en-nz en-ph en-sg en-tt en-uk en-us en-za en-zw
 -es	es-ar es-bo es-cl es-co es-cr es-do es-ec es-es es-gt es-hn es-mx es-ni es-pa es-pe es-pr es-py es-sv es-us es-uy es-ve es-xl
 +es	es-ar es-bo es-cl es-cu es-co es-do es-ec es-es es-pe es-pr es-py es-us es-uy es-ve es-xl spq
 +es-mx	es-bz es-cr es-gt es-hn es-ni es-pa es-sv
 et	et-ee
 fa	fa-fa fa-ir
 fi	fi-fi
 diff --git a/errors/language.am b/errors/language.am
 index 12b1b2b3b43..029e8c1eb2f 100644
 --- a/errors/language.am
 +++ b/errors/language.am
@@ -17,6 +17,7 @@ TRANSLATE_LANGUAGES = \
     de.lang \
     el.lang \
     en.lang \
 +    es-mx.lang \
     es.lang \
     et.lang \
     fa.lang \
@@ -51,4 +52,4 @@ TRANSLATE_LANGUAGES = \
     uz.lang \
     vi.lang \
     zh-hans.lang \
 -    zh-hant.lang 
 +    zh-hant.lang
 diff --git a/errors/template.am b/errors/template.am
 index 6c12781e6f4..715c65aa22b 100644
 --- a/errors/template.am
 +++ b/errors/template.am
@@ -48,4 +48,4 @@ ERROR_TEMPLATES = \
     templates/ERR_UNSUP_REQ \
     templates/ERR_URN_RESOLVE \
     templates/ERR_WRITE_ERROR \
 -    templates/ERR_ZERO_SIZE_OBJECT 
 +    templates/ERR_ZERO_SIZE_OBJECT
--- a/SOURCES/squid-5.0.6-openssl3.patch
+++ b/SOURCES/squid-5.0.6-openssl3.patch
@ -1,185 +0,0 @@
 diff --git a/src/ssl/support.cc b/src/ssl/support.cc
 index 3ad135d..73912ce 100644
 --- a/src/ssl/support.cc
 +++ b/src/ssl/support.cc
@@ -557,7 +557,11 @@ Ssl::VerifyCallbackParameters::At(Security::Connection &sconn)
 }
 // "dup" function for SSL_get_ex_new_index("cert_err_check")
 -#if SQUID_USE_CONST_CRYPTO_EX_DATA_DUP
 +#if OPENSSL_VERSION_MAJOR >= 3
 +static int
 +ssl_dupAclChecklist(CRYPTO_EX_DATA *, const CRYPTO_EX_DATA *, void **,
 +                    int, long, void *)
 +#elif SQUID_USE_CONST_CRYPTO_EX_DATA_DUP
 static int
 ssl_dupAclChecklist(CRYPTO_EX_DATA *, const CRYPTO_EX_DATA *, void *,
                     int, long, void *)
 diff --git a/src/security/PeerOptions.cc b/src/security/PeerOptions.cc
 index cf1d4ba..4346ba5 100644
 --- a/src/security/PeerOptions.cc
 +++ b/src/security/PeerOptions.cc
@@ -297,130 +297,130 @@ static struct ssl_option {
 } ssl_options[] = {
 -#if SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
 +#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
     {
         "NETSCAPE_REUSE_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
     },
 #endif
 -#if SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
 +#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
     {
         "SSLREF2_REUSE_CERT_TYPE_BUG", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
     },
 #endif
 -#if SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
 +#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
     {
         "MICROSOFT_BIG_SSLV3_BUFFER", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
     },
 #endif
 -#if SSL_OP_SSLEAY_080_CLIENT_DH_BUG
 +#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
     {
         "SSLEAY_080_CLIENT_DH_BUG", SSL_OP_SSLEAY_080_CLIENT_DH_BUG
     },
 #endif
 -#if SSL_OP_TLS_D5_BUG
 +#ifdef SSL_OP_TLS_D5_BUG
     {
         "TLS_D5_BUG", SSL_OP_TLS_D5_BUG
     },
 #endif
 -#if SSL_OP_TLS_BLOCK_PADDING_BUG
 +#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
     {
         "TLS_BLOCK_PADDING_BUG", SSL_OP_TLS_BLOCK_PADDING_BUG
     },
 #endif
 -#if SSL_OP_TLS_ROLLBACK_BUG
 +#ifdef SSL_OP_TLS_ROLLBACK_BUG
     {
         "TLS_ROLLBACK_BUG", SSL_OP_TLS_ROLLBACK_BUG
     },
 #endif
 -#if SSL_OP_ALL
 +#ifdef SSL_OP_ALL
     {
         "ALL", (long)SSL_OP_ALL
     },
 #endif
 -#if SSL_OP_SINGLE_DH_USE
 +#ifdef SSL_OP_SINGLE_DH_USE
     {
         "SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE
     },
 #endif
 -#if SSL_OP_EPHEMERAL_RSA
 +#ifdef SSL_OP_EPHEMERAL_RSA
     {
         "EPHEMERAL_RSA", SSL_OP_EPHEMERAL_RSA
     },
 #endif
 -#if SSL_OP_PKCS1_CHECK_1
 +#ifdef SSL_OP_PKCS1_CHECK_1
     {
         "PKCS1_CHECK_1", SSL_OP_PKCS1_CHECK_1
     },
 #endif
 -#if SSL_OP_PKCS1_CHECK_2
 +#ifdef SSL_OP_PKCS1_CHECK_2
     {
         "PKCS1_CHECK_2", SSL_OP_PKCS1_CHECK_2
     },
 #endif
 -#if SSL_OP_NETSCAPE_CA_DN_BUG
 +#ifdef SSL_OP_NETSCAPE_CA_DN_BUG
     {
         "NETSCAPE_CA_DN_BUG", SSL_OP_NETSCAPE_CA_DN_BUG
     },
 #endif
 -#if SSL_OP_NON_EXPORT_FIRST
 +#ifdef SSL_OP_NON_EXPORT_FIRST
     {
         "NON_EXPORT_FIRST", SSL_OP_NON_EXPORT_FIRST
     },
 #endif
 -#if SSL_OP_CIPHER_SERVER_PREFERENCE
 +#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
     {
         "CIPHER_SERVER_PREFERENCE", SSL_OP_CIPHER_SERVER_PREFERENCE
     },
 #endif
 -#if SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG
 +#ifdef SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG
     {
         "NETSCAPE_DEMO_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG
     },
 #endif
 -#if SSL_OP_NO_SSLv3
 +#ifdef SSL_OP_NO_SSLv3
     {
         "NO_SSLv3", SSL_OP_NO_SSLv3
     },
 #endif
 -#if SSL_OP_NO_TLSv1
 +#ifdef SSL_OP_NO_TLSv1
     {
         "NO_TLSv1", SSL_OP_NO_TLSv1
     },
 #else
     { "NO_TLSv1", 0 },
 #endif
 -#if SSL_OP_NO_TLSv1_1
 +#ifdef SSL_OP_NO_TLSv1_1
     {
         "NO_TLSv1_1", SSL_OP_NO_TLSv1_1
     },
 #else
     { "NO_TLSv1_1", 0 },
 #endif
 -#if SSL_OP_NO_TLSv1_2
 +#ifdef SSL_OP_NO_TLSv1_2
     {
         "NO_TLSv1_2", SSL_OP_NO_TLSv1_2
     },
 #else
     { "NO_TLSv1_2", 0 },
 #endif
 -#if SSL_OP_NO_TLSv1_3
 +#ifdef SSL_OP_NO_TLSv1_3
     {
         "NO_TLSv1_3", SSL_OP_NO_TLSv1_3
     },
 #else
     { "NO_TLSv1_3", 0 },
 #endif
 -#if SSL_OP_NO_COMPRESSION
 +#ifdef SSL_OP_NO_COMPRESSION
     {
         "No_Compression", SSL_OP_NO_COMPRESSION
     },
 #endif
 -#if SSL_OP_NO_TICKET
 +#ifdef SSL_OP_NO_TICKET
     {
         "NO_TICKET", SSL_OP_NO_TICKET
     },
 #endif
 -#if SSL_OP_SINGLE_ECDH_USE
 +#ifdef SSL_OP_SINGLE_ECDH_USE
     {
         "SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE
     },
@@ -512,7 +512,7 @@ Security::PeerOptions::parseOptions()
     }
 -#if SSL_OP_NO_SSLv2
 +#ifdef SSL_OP_NO_SSLv2
     // compliance with RFC 6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0
     op = op | SSL_OP_NO_SSLv2;
 #endif
--- a/SOURCES/squid-5.1-test-store-cppsuite.patch
+++ b/SOURCES/squid-5.1-test-store-cppsuite.patch
@ -1,24 +0,0 @@
 diff --git a/src/tests/testStoreHashIndex.cc b/src/tests/testStoreHashIndex.cc
 index 0564380..fcd60b9 100644
 --- a/src/tests/testStoreHashIndex.cc
 +++ b/src/tests/testStoreHashIndex.cc
@@ -102,6 +102,8 @@ void commonInit()
     if (inited)
         return;
 +    inited = true;
 +
     Mem::Init();
     Config.Store.avgObjectSize = 1024;
@@ -109,6 +111,10 @@ void commonInit()
     Config.Store.objectsPerBucket = 20;
     Config.Store.maxObjectSize = 2048;
 +
 +    Config.memShared.defaultTo(false);
 +
 +    Config.store_dir_select_algorithm = xstrdup("round-robin");
 }
 /* TODO make this a cbdata class */
--- a/SOURCES/squid-5.5-CVE-2023-46846.patch
+++ b/SOURCES/squid-5.5-CVE-2023-46846.patch
@ -1,178 +0,0 @@
 From 05f6af2f4c85cc99323cfff6149c3d74af661b6d Mon Sep 17 00:00:00 2001
 From: Amos Jeffries <yadij@users.noreply.github.com>
 Date: Fri, 13 Oct 2023 08:44:16 +0000
 Subject: [PATCH] RFC 9112: Improve HTTP chunked encoding compliance (#1498)
 ---
 src/http/one/Parser.cc          |  8 +-------
 src/http/one/Parser.h           |  4 +---
 src/http/one/TeChunkedParser.cc | 23 ++++++++++++++++++-----
 src/parser/Tokenizer.cc         | 12 ++++++++++++
 src/parser/Tokenizer.h          |  7 +++++++
 5 files changed, 39 insertions(+), 15 deletions(-)
 diff --git a/src/http/one/Parser.cc b/src/http/one/Parser.cc
 index c78ddd7f0..291ae39f0 100644
 --- a/src/http/one/Parser.cc
 +++ b/src/http/one/Parser.cc
@@ -65,16 +65,10 @@ Http::One::Parser::DelimiterCharacters()
 void
 Http::One::Parser::skipLineTerminator(Tokenizer &tok) const
 {
 -    if (tok.skip(Http1::CrLf()))
 -        return;
 -
     if (Config.onoff.relaxed_header_parser && tok.skipOne(CharacterSet::LF))
         return;
 -    if (tok.atEnd() || (tok.remaining().length() == 1 && tok.remaining().at(0) == '\r'))
 -        throw InsufficientInput();
 -
 -    throw TexcHere("garbage instead of CRLF line terminator");
 +    tok.skipRequired("line-terminating CRLF", Http1::CrLf());
 }
 /// all characters except the LF line terminator
 diff --git a/src/http/one/Parser.h b/src/http/one/Parser.h
 index f83c01a9a..aab895583 100644
 --- a/src/http/one/Parser.h
 +++ b/src/http/one/Parser.h
@@ -124,9 +124,7 @@ protected:
      * detect and skip the CRLF or (if tolerant) LF line terminator
      * consume from the tokenizer.
      *
 -     * \throws exception on bad or InsuffientInput.
 -     * \retval true only if line terminator found.
 -     * \retval false incomplete or missing line terminator, need more data.
 +     * \throws exception on bad or InsufficientInput
      */
     void skipLineTerminator(Tokenizer &) const;
 diff --git a/src/http/one/TeChunkedParser.cc b/src/http/one/TeChunkedParser.cc
 index 1434100b6..8bdb65abb 100644
 --- a/src/http/one/TeChunkedParser.cc
 +++ b/src/http/one/TeChunkedParser.cc
@@ -91,6 +91,11 @@ Http::One::TeChunkedParser::parseChunkSize(Tokenizer &tok)
 {
     Must(theChunkSize <= 0); // Should(), really
 +    static const SBuf bannedHexPrefixLower("0x");
 +    static const SBuf bannedHexPrefixUpper("0X");
 +    if (tok.skip(bannedHexPrefixLower) || tok.skip(bannedHexPrefixUpper))
 +        throw TextException("chunk starts with 0x", Here());
 +
     int64_t size = -1;
     if (tok.int64(size, 16, false) && !tok.atEnd()) {
         if (size < 0)
@@ -121,7 +126,7 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
     // bad or insufficient input, like in the code below. TODO: Expand up.
     try {
         parseChunkExtensions(tok); // a possibly empty chunk-ext list
 -        skipLineTerminator(tok);
 +        tok.skipRequired("CRLF after [chunk-ext]", Http1::CrLf());
         buf_ = tok.remaining();
         parsingStage_ = theChunkSize ? Http1::HTTP_PARSE_CHUNK : Http1::HTTP_PARSE_MIME;
         return true;
@@ -132,12 +137,14 @@ Http::One::TeChunkedParser::parseChunkMetadataSuffix(Tokenizer &tok)
     // other exceptions bubble up to kill message parsing
 }
 -/// Parses the chunk-ext list (RFC 7230 section 4.1.1 and its Errata #4667):
 +/// Parses the chunk-ext list (RFC 9112 section 7.1.1:
 /// chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] )
 void
 -Http::One::TeChunkedParser::parseChunkExtensions(Tokenizer &tok)
 +Http::One::TeChunkedParser::parseChunkExtensions(Tokenizer &callerTok)
 {
     do {
 +        auto tok = callerTok;
 +
         ParseBws(tok); // Bug 4492: IBM_HTTP_Server sends SP after chunk-size
         if (!tok.skip(';'))
@@ -145,6 +152,7 @@ Http::One::TeChunkedParser::parseChunkExtensions(Tokenizer &tok)
         parseOneChunkExtension(tok);
         buf_ = tok.remaining(); // got one extension
 +        callerTok = tok;
     } while (true);
 }
@@ -158,11 +166,14 @@ Http::One::ChunkExtensionValueParser::Ignore(Tokenizer &tok, const SBuf &extName
 /// Parses a single chunk-ext list element:
 /// chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] )
 void
 -Http::One::TeChunkedParser::parseOneChunkExtension(Tokenizer &tok)
 +Http::One::TeChunkedParser::parseOneChunkExtension(Tokenizer &callerTok)
 {
 +    auto tok = callerTok;
 +
     ParseBws(tok); // Bug 4492: ICAP servers send SP before chunk-ext-name
     const auto extName = tok.prefix("chunk-ext-name", CharacterSet::TCHAR);
 +    callerTok = tok; // in case we determine that this is a valueless chunk-ext
     ParseBws(tok);
@@ -176,6 +187,8 @@ Http::One::TeChunkedParser::parseOneChunkExtension(Tokenizer &tok)
         customExtensionValueParser->parse(tok, extName);
     else
         ChunkExtensionValueParser::Ignore(tok, extName);
 +
 +    callerTok = tok;
 }
 bool
@@ -209,7 +222,7 @@ Http::One::TeChunkedParser::parseChunkEnd(Tokenizer &tok)
     Must(theLeftBodySize == 0); // Should(), really
     try {
 -        skipLineTerminator(tok);
 +        tok.skipRequired("chunk CRLF", Http1::CrLf());
         buf_ = tok.remaining(); // parse checkpoint
         theChunkSize = 0; // done with the current chunk
         parsingStage_ = Http1::HTTP_PARSE_CHUNK_SZ;
 diff --git a/src/parser/Tokenizer.cc b/src/parser/Tokenizer.cc
 index edaffd8d3..15df793b8 100644
 --- a/src/parser/Tokenizer.cc
 +++ b/src/parser/Tokenizer.cc
@@ -147,6 +147,18 @@ Parser::Tokenizer::skipAll(const CharacterSet &tokenChars)
     return success(prefixLen);
 }
 +void
 +Parser::Tokenizer::skipRequired(const char *description, const SBuf &tokenToSkip)
 +{
 +    if (skip(tokenToSkip) || tokenToSkip.isEmpty())
 +        return;
 +
 +    if (tokenToSkip.startsWith(buf_))
 +        throw InsufficientInput();
 +
 +    throw TextException(ToSBuf("cannot skip ", description), Here());
 +}
 +
 bool
 Parser::Tokenizer::skipOne(const CharacterSet &chars)
 {
 diff --git a/src/parser/Tokenizer.h b/src/parser/Tokenizer.h
 index 7bae1ccbb..3cfa7dd6c 100644
 --- a/src/parser/Tokenizer.h
 +++ b/src/parser/Tokenizer.h
@@ -115,6 +115,13 @@ public:
      */
     SBuf::size_type skipAll(const CharacterSet &discardables);
 +    /** skips a given character sequence (string);
 +     * does nothing if the sequence is empty
 +     *
 +     * \throws exception on mismatching prefix or InsufficientInput
 +     */
 +    void skipRequired(const char *description, const SBuf &tokenToSkip);
 +
     /** Removes a single trailing character from the set.
      *
      * \return whether a character was removed
 -- 
 2.25.1
--- a/SOURCES/squid-5.5-CVE-2023-46848.patch
+++ b/SOURCES/squid-5.5-CVE-2023-46848.patch
@ -1,46 +0,0 @@
 From c67bf049871a49e9871efe50b230a7f37b7039f6 Mon Sep 17 00:00:00 2001
 From: Alex Rousskov <rousskov@measurement-factory.com>
 Date: Thu, 25 May 2023 02:10:28 +0000
 Subject: [PATCH] Fix userinfo percent-encoding (#1367)
 %X expects an unsigned int, and that is what we were giving it. However,
 to get to the correct unsigned int value from a (signed) char, one has
 to cast to an unsigned char (or equivalent) first.
 Broken since inception in commit 7b75100.
 Also adjusted similar (commented out) ext_edirectory_userip_acl code.
 ---
 src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc | 2 +-
 src/anyp/Uri.cc                                                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc b/src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc
 index dbc20ae54..9028d1562 100644
 --- a/src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc
 +++ b/src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc
@@ -1612,7 +1612,7 @@ MainSafe(int argc, char **argv)
         /* BINARY DEBUGGING *
                     local_printfx("while() -> bufa[%" PRIuSIZE "]: %s", k, bufa);
                     for (i = 0; i < k; ++i)
 -                      local_printfx("%02X", bufa[i]);
 +                      local_printfx("%02X", static_cast<unsigned int>(static_cast<unsigned char>(bufa[i])));
                     local_printfx("\n");
         * BINARY DEBUGGING */
         /* Check for CRLF */
 diff --git a/src/anyp/Uri.cc b/src/anyp/Uri.cc
 index a6a5d5d9e..3d19188e9 100644
 --- a/src/anyp/Uri.cc
 +++ b/src/anyp/Uri.cc
@@ -70,7 +70,7 @@ AnyP::Uri::Encode(const SBuf &buf, const CharacterSet &ignore)
     while (!tk.atEnd()) {
         // TODO: Add Tokenizer::parseOne(void).
         const auto ch = tk.remaining()[0];
 -        output.appendf("%%%02X", static_cast<unsigned int>(ch)); // TODO: Optimize using a table
 +        output.appendf("%%%02X", static_cast<unsigned int>(static_cast<unsigned char>(ch))); // TODO: Optimize using a table
         (void)tk.skip(ch);
         if (tk.prefix(goodSection, ignore))
 -- 
 2.25.1
--- a/SOURCES/squid-5.5-CVE-2024-37894.patch
+++ b/SOURCES/squid-5.5-CVE-2024-37894.patch
@ -1,13 +0,0 @@
 diff --git a/lib/libTrie/TrieNode.cc b/lib/libTrie/TrieNode.cc
 index b379856..5d87279 100644
 --- a/lib/libTrie/TrieNode.cc
 +++ b/lib/libTrie/TrieNode.cc
@@ -32,7 +32,7 @@ TrieNode::add(char const *aString, size_t theLength, void *privatedata, TrieChar
     /* We trust that privatedata and existant keys have already been checked */
     if (theLength) {
 -        int index = transform ? (*transform)(*aString): *aString;
 +        const unsigned char index = transform ? (*transform)(*aString): *aString;
         if (!internal[index])
             internal[index] = new TrieNode;
--- a/SOURCES/squid-5.5-ipv6-crash.patch
+++ b/SOURCES/squid-5.5-ipv6-crash.patch
@ -1,113 +0,0 @@
 From a0a9e6dc69d0c7b9ba237702b4c5020abc7ad1f8 Mon Sep 17 00:00:00 2001
 From: Alex Rousskov <rousskov@measurement-factory.com>
 Date: Sat, 4 Nov 2023 00:30:42 +0000
 Subject: [PATCH] Bug 5154: Do not open IPv6 sockets when IPv6 is disabled
 (#1567)
 ... but allow basic IPv6 manipulations like getSockAddr().
    Address.cc:663 getAddrInfo() assertion failed: false
 Squids receives IPv6 addresses from traffic, configuration, or
 hard-coded constants even when ./configured with --disable-ipv6 or when
 IPv6 support was automatically disabled at startup after failing IPv6
 tests. To handle IPv6 correctly, such Squids must support basic IPv6
 operations like recognizing an IPv6 address in a request-target or
 reporting an unsolicited IPv6 DNS record. At least for now, such Squids
 must also correctly parse configuration-related IPv6 addresses.
 All those activities rely on various low-level operations like filling
 addrinfo structure with IP address information. Since 2012 commit
 c5fbbc7, Ip::Address::getAddrInfo() was failing for IPv6 addresses when
 Ip::EnableIpv6 was falsy. That change correctly recognized[^1] the need
 for such Squids to handle IPv6, but to support basic operations, we need
 to reject IPv6 addresses at a higher level and without asserting.
 That high-level rejection work is ongoing, but initial attempts have
 exposed difficult problems that will take time to address. For now, we
 just avoid the assertion while protecting IPv6-disabled Squid from
 listening on or opening connections to IPv6 addresses. Since Squid
 already expects (and usually correctly handles) socket opening failures,
 disabling those operations is better than failing in low-level IP
 manipulation code.
 The overall IPv6 posture of IPv6-disabled Squids that lack http_access
 or other rules to deny IPv6 requests will change: This fix exposes more
 of IPv6-disabled Squid code to IPv6 addresses. It is possible that such
 exposure will make some IPv6 resources inside Squid (e.g., a previously
 cached HTTP response) accessible to external requests. Squids will not
 open or accept IPv6 connections but may forward requests with raw IPv6
 targets to IPv4 cache_peers. Whether these and similar behavior changes
 are going to be permanent is open for debate, but even if they are
 temporary, they are arguably better than the corresponding assertions.
 These changes do not effect IPv6-enabled Squids.
 The assertion in IPv6-disabled Squid was reported by Joshua Rogers at
 https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html where
 it was filed as "Assertion on IPv6 Host Requests with --disable-ipv6".
 [^1]: https://bugs.squid-cache.org/show_bug.cgi?id=3593#c1
 ---
 src/comm.cc         | 6 ++++++
 src/ip/Address.cc   | 2 +-
 src/ip/Intercept.cc | 8 ++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)
 diff --git a/src/comm.cc b/src/comm.cc
 index 4659955b011..271ba04d4da 100644
 --- a/src/comm.cc
 +++ b/src/comm.cc
@@ -344,6 +344,12 @@ comm_openex(int sock_type,
     /* Create socket for accepting new connections. */
     ++ statCounter.syscalls.sock.sockets;
 +    if (!Ip::EnableIpv6 && addr.isIPv6()) {
 +        debugs(50, 2, "refusing to open an IPv6 socket when IPv6 support is disabled: " << addr);
 +        errno = ENOTSUP;
 +        return -1;
 +    }
 +
     /* Setup the socket addrinfo details for use */
     addr.getAddrInfo(AI);
     AI->ai_socktype = sock_type;
 diff --git a/src/ip/Address.cc b/src/ip/Address.cc
 index b6f810bfc25..ae6db37da5e 100644
 --- a/src/ip/Address.cc
 +++ b/src/ip/Address.cc
@@ -623,7 +623,7 @@ Ip::Address::getAddrInfo(struct addrinfo *&dst, int force) const
             && dst->ai_protocol == 0)
         dst->ai_protocol = IPPROTO_UDP;
 -    if (force == AF_INET6 || (force == AF_UNSPEC && Ip::EnableIpv6 && isIPv6()) ) {
 +    if (force == AF_INET6 || (force == AF_UNSPEC && isIPv6()) ) {
         dst->ai_addr = (struct sockaddr*)new sockaddr_in6;
         memset(dst->ai_addr,0,sizeof(struct sockaddr_in6));
 diff --git a/src/ip/Intercept.cc b/src/ip/Intercept.cc
 index 1a5e2d15af1..a8522efaac0 100644
 --- a/src/ip/Intercept.cc
 +++ b/src/ip/Intercept.cc
@@ -15,6 +15,7 @@
 #include "comm/Connection.h"
 #include "fde.h"
 #include "ip/Intercept.h"
 +#include "ip/tools.h"
 #include "src/tools.h"
 #include <cerrno>
@@ -430,6 +431,13 @@ Ip::Intercept::ProbeForTproxy(Ip::Address &test)
     debugs(3, 3, "Detect TPROXY support on port " << test);
 +    if (!Ip::EnableIpv6 && test.isIPv6() && !test.setIPv4()) {
 +        debugs(3, DBG_CRITICAL, "Cannot use TPROXY for " << test << " because IPv6 support is disabled");
 +        if (doneSuid)
 +            leave_suid();
 +        return false;
 +    }
 +
     int tos = 1;
     int tmp_sock = -1;
--- a/SOURCES/squid-5.5.tar.xz.asc
+++ b/SOURCES/squid-5.5.tar.xz.asc
@ -1,25 +0,0 @@
 File: squid-5.5.tar.xz
 Date: Wed 13 Apr 2022 08:45:42 UTC
 Size: 2565732
 MD5 : 83ccc2d86ca0966e3555a3b78f5afd14
 SHA1: 42302bd9b8feff851a41420334cb8eaeab2806ab
 Key : CD6DBF8EF3B17D3E <squid3@treenet.co.nz>
            B068 84ED B779 C89B 044E  64E3 CD6D BF8E F3B1 7D3E
      keyring = http://www.squid-cache.org/pgp.asc
      keyserver = pool.sks-keyservers.net
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCgAdFiEEsGiE7bd5yJsETmTjzW2/jvOxfT4FAmJWjb4ACgkQzW2/jvOx
 fT7t0A/9GjAdINfSP4gQyUr+Uvakz9O6fA9Jo3F30VafYimrSGm+VdGWntTsrOaP
 VcsCdG3/Dvrhnqtu9+hwfKKQ61lmmUC7KVycx3whEUepQbZu5kd05csD7nwQ+AFe
 7eJr0IwbRI4XdUhNW4AB52i/+hpHs/YSrSokumx5NVhwAUvT81TToUNzUjfKuXyy
 U+w6GQ9kJbVW1UgFYZGZdJwCmD5Z7fNdUllKZhLj4I5GZ+5Zz5+lJP3ZBC6qavde
 34hbpHbt+/lqz337eNoxwlyPNKPDiGIUEY9T4cdzA0BiLggTmlukDFErlYuHgCMX
 BmQ9elJtdRaCD2YD+U1H9J+2wqt9O01gdyFU1V3RnNLZphgWur9X808rujuE46+Q
 sxyV6SjeBh6Xs/I7wA9utX0pbVD+nLvna6Be49M1yAghBwTjiYN9fGC3ufj4St3k
 PCvkTkBUOop3m4aBCRtUVO6w4Y/YmF71qAHIiSLe1i6xoztEDTVI0CA+vfrwwu2G
 rFP5wuKsaYfBjkhQw4Jv6X30vnnOVqlxITGXcOnPXrHoD5KuYXv/Xsobqf8XsFdl
 3qyXUe8lSI5idCg+Ajj9m0IqGWA50iFBs28Ca7GDacl9KApGn4O7kPLQY+7nN5cz
 Nv3k8lYPh4KvRI1b2hcuoe3K63rEzty0e2vqG9zqxkpxOt20E/U=
 =9xr/
 -----END PGP SIGNATURE-----
--- a/SOURCES/squid.logrotate
+++ b/SOURCES/squid.logrotate
@ -2,7 +2,6 @@
    weekly
    rotate 5
    compress
    delaycompress
    notifempty
    missingok
    nocreate
@ -11,5 +10,7 @@
      # Asks squid to reopen its logs. (logfile_rotate 0 is set in squid.conf)
      # errors redirected to make it silent if squid is not running
      /usr/sbin/squid -k rotate 2>/dev/null
      # Wait a little to allow Squid to catch up before the logs is compressed
      sleep 1
    endscript
 }
--- a/SOURCES/squid.nm
+++ b/SOURCES/squid.nm
@ -2,6 +2,6 @@
 case "$2" in
        up|down|vpn-up|vpn-down)
-                /usr/bin/systemctl -q reload squid.service || :
+                /bin/systemctl -q reload squid.service || :
                ;;
 esac
--- a/SOURCES/squid.sysconfig
+++ b/SOURCES/squid.sysconfig
@ -1,5 +1,9 @@
 # default squid options
 SQUID_OPTS=""
 # Time to wait for Squid to shut down when asked. Should not be necessary
 # most of the time.
 SQUID_SHUTDOWN_TIMEOUT=100
 # default squid conf file
 SQUID_CONF="/etc/squid/squid.conf"
--- a/SOURCES/squid.sysusers
+++ b/SOURCES/squid.sysusers
@ -1,2 +0,0 @@
 g squid 23 -
 u squid 23 "Squid proxy user" /var/spool/squid /sbin/nologin
--- a/SPECS/squid.spec
+++ b/SPECS/squid.spec
@ -1,93 +1,86 @@
 %define __perl_requires %{SOURCE98}
 Name:     squid
-Version:  5.5
+Version:  4.15
-Release:  14%{?dist}
+Release:  10%{?dist}.3
 Summary:  The Squid proxy caching server
 Epoch:    7
 # See CREDITS for breakdown of non GPLv2+ code
 License:  GPLv2+ and (LGPLv2+ and MIT and BSD and Public Domain)
 URL:      http://www.squid-cache.org
-
+Source0:  http://www.squid-cache.org/Versions/v4/squid-%{version}.tar.xz
-Source0:  http://www.squid-cache.org/Versions/v5/squid-%{version}.tar.xz
+Source1:  http://www.squid-cache.org/Versions/v4/squid-%{version}.tar.xz.asc
-Source1:  http://www.squid-cache.org/Versions/v5/squid-%{version}.tar.xz.asc
+Source2:  squid.logrotate
-Source2:  http://www.squid-cache.org/pgp.asc
+Source3:  squid.sysconfig
-Source3:  squid.logrotate
+Source4:  squid.pam
-Source4:  squid.sysconfig
+Source5:  squid.nm
-Source5:  squid.pam
+Source6:  squid.service
-Source6:  squid.nm
+Source7:  cache_swap.sh
 Source7:  squid.service
 Source8:  cache_swap.sh
 Source9:  squid.sysusers
 Source98: perl-requires-squid.sh
 # Upstream patches
 # Backported patches
-# https://bugzilla.redhat.com/show_bug.cgi?id=2151188
+Patch101: squid-4.15-ip-bind-address-no-port.patch
-Patch101: squid-5.5-ip-bind-address-no-port.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2072988
 # Local patches
 # Applying upstream patches first makes it less likely that local patches
 # will break upstream ones.
-Patch201: squid-4.0.11-config.patch
+Patch201: squid-4.11-config.patch
-Patch202: squid-3.1.0.9-location.patch
+Patch202: squid-4.11-location.patch
-Patch203: squid-3.0.STABLE1-perlpath.patch
+Patch203: squid-4.11-perlpath.patch
-Patch204: squid-3.5.9-include-guards.patch
+Patch204: squid-4.11-include-guards.patch
-# revert this upstream patch - https://bugzilla.redhat.com/show_bug.cgi?id=1936422
+Patch205: squid-4.11-large-acl.patch
-# workaround for #1934919
+# https://bugzilla.redhat.com/show_bug.cgi?id=980511
-Patch205: squid-5.0.5-symlink-lang-err.patch
+Patch206: squid-4.11-active-ftp.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1953505
+Patch208: squid-4.11-convert-ipv4.patch
-Patch206: squid-5.0.6-openssl3.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2006121
-# https://bugzilla.redhat.com/show_bug.cgi?id=1969322
+Patch209: squid-4.15-ftp-filename-extraction.patch
-Patch207: squid-5.0.6-active-ftp.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2076717
-# https://bugzilla.redhat.com/show_bug.cgi?id=1988122
+Patch210: squid-4.15-halfclosed.patch
 Patch208: squid-5.1-test-store-cppsuite.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2231827
 Patch209: squid-5.5-halfclosed.patch
 # https://issues.redhat.com/browse/RHEL-30352
 Patch210: squid-5.5-ipv6-crash.patch
-# Security patches
+# Security fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1941506
 Patch300: squid-4.15-CVE-2021-28116.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2100721
-Patch501: squid-5.5-CVE-2021-46784.patch
+Patch301: squid-4.15-CVE-2021-46784.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2129771
-Patch502: squid-5.5-CVE-2022-41318.patch
+Patch302: squid-4.15-CVE-2022-41318.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2245910
-Patch503: squid-5.5-CVE-2023-46846.patch
+# +backported: https://github.com/squid-cache/squid/commit/417da4006cf5c97d44e74431b816fc58fec9e270
 Patch303: squid-4.15-CVE-2023-46846.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2245916
-Patch504: squid-5.5-CVE-2023-46847.patch
+Patch304: squid-4.15-CVE-2023-46847.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2245919
+# https://issues.redhat.com/browse/RHEL-14792
-Patch505: squid-5.5-CVE-2023-46848.patch
+Patch305: squid-4.15-CVE-2023-5824.patch
 # https://issues.redhat.com/browse/RHEL-14802
 Patch506: squid-5.5-CVE-2023-5824.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2248521
-Patch507: squid-5.5-CVE-2023-46728.patch
+Patch306: squid-4.15-CVE-2023-46728.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2247567
-Patch508: squid-5.5-CVE-2023-46724.patch
+Patch307: squid-4.15-CVE-2023-46724.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2252926
-Patch509: squid-5.5-CVE-2023-49285.patch
+Patch308: squid-4.15-CVE-2023-49285.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2252923
-Patch510: squid-5.5-CVE-2023-49286.patch
+Patch309: squid-4.15-CVE-2023-49286.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2254663
-Patch511: squid-5.5-CVE-2023-50269.patch
+Patch310: squid-4.15-CVE-2023-50269.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2264309
-Patch512: squid-5.5-CVE-2024-25617.patch
+Patch311: squid-4.15-CVE-2024-25617.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2268366
-Patch513: squid-5.5-CVE-2024-25111.patch
+Patch312: squid-4.15-CVE-2024-25111.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2294353
+# Regression caused by squid-4.15-CVE-2023-46846.patch
-Patch514: squid-5.5-CVE-2024-37894.patch
+# Upstream PR: https://github.com/squid-cache/squid/pull/1914
 Patch313: squid-4.15-ignore-wsp-after-chunk-size.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2260051
-Patch515: squid-5.5-CVE-2024-23638.patch
+Patch314: squid-4.15-CVE-2024-23638.patch
 # cache_swap.sh
 Requires: bash gawk
 # for httpd conf file - cachemgr script alias
 Requires: httpd-filesystem
 Requires: bash >= 2.0
 Requires(pre): shadow-utils
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
 # squid_ldap_auth and other LDAP helpers require OpenLDAP
 BuildRequires: make
 BuildRequires: openldap-devel
 # squid_pam_auth requires PAM development libs
 BuildRequires: pam-devel
@ -95,10 +88,8 @@ BuildRequires: pam-devel
 BuildRequires: openssl-devel
 # squid_kerb_aut requires Kerberos development libs
 BuildRequires: krb5-devel
-# time_quota requires TrivialDB
+# time_quota requires DB
-BuildRequires: libtdb-devel
+BuildRequires: libdb-devel
 # ESI support requires Expat & libxml2
 BuildRequires: expat-devel libxml2-devel
 # TPROXY requires libcap, and also increases security somewhat
 BuildRequires: libcap-devel
 # eCAP support
@ -109,20 +100,10 @@ BuildRequires: libtool libtool-ltdl-devel
 BuildRequires: perl-generators
 # For test suite
 BuildRequires: pkgconfig(cppunit)
-# For verifying downloded src tarball
+BuildRequires: autoconf
 BuildRequires: gnupg2
 # for _tmpfilesdir and _unitdir macro
 # see https://docs.fedoraproject.org/en-US/packaging-guidelines/Systemd/#_packaging
 BuildRequires: systemd-rpm-macros
 # systemd notify
 BuildRequires: systemd-devel
 %{?systemd_requires}
 %{?sysusers_requires_compat}
 # Old NetworkManager expects the dispatcher scripts in a different place
 Conflicts: NetworkManager < 1.20
 %description
 Squid is a high-performance proxy caching server for Web clients,
 supporting FTP, gopher, and HTTP data objects. Unlike traditional
@ -136,7 +117,6 @@ lookup program (dnsserver), a program for retrieving FTP data
 (ftpget), and some management and client tools.
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 # Upstream patches
@ -148,36 +128,37 @@ lookup program (dnsserver), a program for retrieving FTP data
 %patch201 -p1 -b .config
 %patch202 -p1 -b .location
 %patch203 -p1 -b .perlpath
-%patch204 -p0 -b .include-guards
+%patch204 -p1 -b .include-guards
-%patch205 -p1 -R -b .symlink-lang-err
+%patch205 -p1 -b .large_acl
-%patch206 -p1 -b .openssl3
+%patch206 -p1 -b .active-ftp
-%patch207 -p1 -b .active-ftp
+%patch208 -p1 -b .convert-ipv4
-%patch208 -p1 -b .test-store-cpp
+%patch209 -p1 -b .ftp-fn-extraction
-%patch209 -p1 -b .halfclosed
+%patch210 -p1 -b .halfclosed
 %patch210 -p1 -b .ipv6-crash
 %patch501 -p1 -b .CVE-2021-46784
 %patch502 -p1 -b .CVE-2022-41318
 %patch503 -p1 -b .CVE-2023-46846
 %patch504 -p1 -b .CVE-2023-46847
 %patch505 -p1 -b .CVE-2023-46848
 %patch506 -p1 -b .CVE-2023-5824
 %patch507 -p1 -b .CVE-2023-46728
 %patch508 -p1 -b .CVE-2023-46724
 %patch509 -p1 -b .CVE-2023-49285
 %patch510 -p1 -b .CVE-2023-49286
 %patch511 -p1 -b .CVE-2023-50269
 %patch512 -p1 -b .CVE-2024-25617
 %patch513 -p1 -b .CVE-2024-25111
 %patch514 -p1 -b .CVE-2024-37894
 %patch515 -p1 -b .CVE-2024-23638
 # Security patches
 %patch300 -p1 -b .CVE-2021-28116
 %patch301 -p1 -b .CVE-2021-46784
 %patch302 -p1 -b .CVE-2022-41318
 %patch303 -p1 -b .CVE-2023-46846
 %patch304 -p1 -b .CVE-2023-46847
 %patch305 -p1 -b .CVE-2023-5824
 %patch306 -p1 -b .CVE-2023-46728
 %patch307 -p1 -b .CVE-2023-46724
 %patch308 -p1 -b .CVE-2023-49285
 %patch309 -p1 -b .CVE-2023-49286
 %patch310 -p1 -b .CVE-2023-50269
 %patch311 -p1 -b .CVE-2024-25617
 %patch312 -p1 -b .CVE-2024-25111
 %patch313 -p1 -b .ignore-wsp-chunk-sz
 %patch314 -p1 -b .CVE-2024-23638
 # https://bugzilla.redhat.com/show_bug.cgi?id=1679526
 # Patch in the vendor documentation and used different location for documentation
 sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented|' src/squid.8.in
 %build
 # cppunit-config patch changes configure.ac
 autoconf
 # NIS helper has been removed because of the following bug
 # https://bugzilla.redhat.com/show_bug.cgi?id=1531540
@ -186,7 +167,7 @@ sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented
   --datadir=%{_datadir}/squid \
   --sysconfdir=%{_sysconfdir}/squid \
   --with-logdir='%{_localstatedir}/log/squid' \
-   --with-pidfile='/run/squid.pid' \
+   --with-pidfile='%{_localstatedir}/run/squid.pid' \
   --disable-dependency-tracking \
   --enable-eui \
   --enable-follow-x-forwarded-for \
@ -214,7 +195,7 @@ sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented
   --enable-storeio="aufs,diskd,ufs,rock" \
   --enable-diskio \
   --enable-wccpv2 \
-   --enable-esi \
+   --disable-esi \
   --enable-ecap \
   --with-aio \
   --with-default-user="squid" \
@ -223,14 +204,8 @@ sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented
   --with-pthreads \
   --disable-arch-native \
   --disable-security-cert-validators \
   --disable-strict-error-checking \
   --with-swapdir=%{_localstatedir}/spool/squid
 # workaround to build squid v5
 mkdir -p src/icmp/tests
 mkdir -p tools/squidclient/tests
 mkdir -p tools/tests
 %make_build
 %check
@ -258,20 +233,22 @@ mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/
-mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/NetworkManager/dispatcher.d
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/squid
-install -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/squid
+install -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/squid
-install -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/squid
+install -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/squid
-install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/squid
+install -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/squid
-install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_unitdir}
+install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_unitdir}
-install -m 755 %{SOURCE8} $RPM_BUILD_ROOT%{_libexecdir}/squid
+install -m 755 %{SOURCE7} $RPM_BUILD_ROOT%{_libexecdir}/squid
 install -m 644 $RPM_BUILD_ROOT/squid.httpd.tmp $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/squid.conf
-install -m 755 %{SOURCE6} $RPM_BUILD_ROOT%{_prefix}/lib/NetworkManager/dispatcher.d/20-squid
+install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d/20-squid
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/squid
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/spool/squid
-mkdir -p $RPM_BUILD_ROOT/run/squid
+mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/run/squid
 chmod 644 contrib/url-normalizer.pl contrib/user-agents.pl
 iconv -f ISO88591 -t UTF8 ChangeLog -o ChangeLog.tmp
 mv -f ChangeLog.tmp ChangeLog
 # install /usr/lib/tmpfiles.d/squid.conf
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
@ -289,12 +266,11 @@ mv $RPM_BUILD_ROOT/usr/share/squid/mib.txt $RPM_BUILD_ROOT/usr/share/snmp/mibs/S
 rm -f $RPM_BUILD_ROOT%{_sysconfdir}/squid/squid.conf.documented
 # remove unpackaged files from the buildroot
 rm -f $RPM_BUILD_ROOT%{_bindir}/{RunAccel,RunCache}
 rm -f $RPM_BUILD_ROOT/squid.httpd.tmp
 # sysusers.d
 install -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/squid.conf
 %files
 %defattr(-,root,root,-)
 %license COPYING 
 %doc CONTRIBUTORS README ChangeLog QUICKSTART src/squid.conf.documented
 %doc contrib/url-normalizer.pl contrib/user-agents.pl
@ -306,7 +282,7 @@ install -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/squid.conf
 %attr(755,root,root) %dir %{_libdir}/squid
 %attr(770,squid,root) %dir %{_localstatedir}/log/squid
 %attr(750,squid,squid) %dir %{_localstatedir}/spool/squid
-%attr(755,squid,squid) %dir /run/squid
+%attr(755,squid,squid) %dir %{_localstatedir}/run/squid
 %config(noreplace) %attr(644,root,root) %{_sysconfdir}/httpd/conf.d/squid.conf
 %config(noreplace) %attr(640,root,squid) %{_sysconfdir}/squid/squid.conf
@ -324,7 +300,7 @@ install -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/squid.conf
 %dir %{_datadir}/squid
 %attr(-,root,root) %{_datadir}/squid/errors
-%{_prefix}/lib/NetworkManager
+%attr(755,root,root) %{_sysconfdir}/NetworkManager/dispatcher.d/20-squid
 %{_datadir}/squid/icons
 %{_sbindir}/squid
 %{_bindir}/squidclient
@ -334,10 +310,15 @@ install -p -D -m 0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/squid.conf
 %{_libdir}/squid/*
 %{_datadir}/snmp/mibs/SQUID-MIB.txt
 %{_tmpfilesdir}/squid.conf
 %{_sysusersdir}/squid.conf
 %pre
-%sysusers_create_compat %{SOURCE9}
+if ! getent group squid >/dev/null 2>&1; then
  /usr/sbin/groupadd -g 23 squid
 fi
 if ! getent passwd squid >/dev/null 2>&1 ; then
  /usr/sbin/useradd -g 23 -u 23 -d /var/spool/squid -r -s /sbin/nologin squid >/dev/null 2>&1 || exit 1 
 fi
 for i in /var/log/squid /var/spool/squid ; do
        if [ -d $i ] ; then
@ -350,18 +331,6 @@ done
 exit 0
 %pretrans -p <lua>
 -- temporarilly commented until https://bugzilla.redhat.com/show_bug.cgi?id=1936422 is resolved
 --
 -- previously /usr/share/squid/errors/es-mx was symlink, now it is directory since squid v5
 -- see https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Replacement/
 -- Define the path to the symlink being replaced below.
 --
 -- path = "/usr/share/squid/errors/es-mx"
 -- st = posix.stat(path)
 -- if st and st.type == "link" then
 --   os.remove(path)
 -- end
 -- Due to a bug #447156
 paths = {"/usr/share/squid/errors/zh-cn", "/usr/share/squid/errors/zh-tw"}
 for key,path in ipairs(paths)
@ -398,240 +367,182 @@ fi
 %changelog
-* Mon Jul 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-14
+* Wed Nov 13 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.3
- Resolves: RHEL-45057 - squid: Out-of-bounds write error may lead to Denial of 
+- Resolves: RHEL-22593 - CVE-2024-23638 squid:4/squid: vulnerable to
-  Service (CVE-2024-37894)
+  a Denial of Service attack against Cache Manager error responses
 - Resolves: RHEL-22594 - squid: vulnerable to a Denial of Service attack against
  Cache Manager error responses (CVE-2024-23638)
-* Thu May 09 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-13
+* Thu Nov 07 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.2
- Resolves: RHEL-30352 - squid v5 crashes with SIGABRT when ipv6 is disabled
+- Disable ESI support
-  at kernel level but it is asked to connect to an ipv6 address by a client
+- Resolves: RHEL-65075 - CVE-2024-45802 squid:4/squid: Denial of Service
  processing ESI response content
-* Tue Mar 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-12
+* Mon Oct 14 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.1
- Resolves: RHEL-28530 - squid: Denial of Service in HTTP Chunked
+- Resolves: RHEL-56024 - (Regression) Transfer-encoding:chunked data is not sent
  to the client in its complementary
 * Tue Mar 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10
 - Resolves: RHEL-28529 - squid:4/squid: Denial of Service in HTTP Chunked
  Decoding (CVE-2024-25111)
- Resolves: RHEL-26092 - squid: denial of service in HTTP header
+- Resolves: RHEL-26088 - squid:4/squid: denial of service in HTTP header
  parser (CVE-2024-25617)
-* Fri Feb 02 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-10
+* Fri Feb 02 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-9
- Resolves: RHEL-19556 - squid: denial of service in HTTP request
+- Resolves: RHEL-19552 - squid:4/squid: denial of service in HTTP request 
  parsing (CVE-2023-50269)
-* Thu Feb 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-9
+* Fri Feb 02 2024 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-8
- Resolves: RHEL-18354 - squid: Buffer over-read in the HTTP Message processing
+- Resolves: RHEL-18351 - squid:4/squid: Buffer over-read in the HTTP Message
-  feature (CVE-2023-49285)
+  processing feature (CVE-2023-49285)
- Resolves: RHEL-18345 - squid: Incorrect Check of Function Return Value In
+- Resolves: RHEL-18342 - squid:4/squid: Incorrect Check of Function Return
-  Helper Process management (CVE-2023-49286)
+  Value In Helper Process management (CVE-2023-49286)
- Resolves: RHEL-18146 - squid crashes in assertion when a parent peer exists
+- Resolves: RHEL-18230 - squid:4/squid: Denial of Service in SSL Certificate
- Resolves: RHEL-18231 - squid: Denial of Service in SSL Certificate validation
+  validation (CVE-2023-46724)
-  (CVE-2023-46724)
+- Resolves: RHEL-15911 - squid:4/squid: NULL pointer dereference in the gopher
- Resolves: RHEL-15912 - squid: NULL pointer dereference in the gopher protocol
+  protocol code (CVE-2023-46728)
-  code (CVE-2023-46728)
+- Resolves: RHEL-18251 - squid crashes in assertion when a parent peer exists
 - Resolves: RHEL-14794 - squid: squid multiple issues in HTTP response caching
  (CVE-2023-5824)
 - Resolves: RHEL-14803 - squid: squid: Denial of Service in HTTP Digest
  Authentication (CVE-2023-46847)
 - Resolves: RHEL-14777 - squid: squid: Request/Response smuggling in HTTP/1.1
  and ICAP (CVE-2023-46846)
-* Tue Dec 05 2023 Tomas Korbar <tkorbar@redhat.com> - 7:5.5-8
+* Wed Aug 16 2023 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7
- Resolves: RHEL-14802 - squid: multiple issues in HTTP response caching
+- Resolves: #2076717 - Crash with half_closed_client on
-* Sun Nov 12 2023 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-7
+* Thu Dec 08 2022 Tomas Korbar <tkorbar@redhat.com> - 4.15-6
- Resolves: RHEL-14820 - squid: squid: denial of Servicein FTP
+- Resolves: #2072988 - [RFE] Add the "IP_BIND_ADDRESS_NO_PORT"
 - Resolves: RHEL-14809 - squid: squid: Denial of Service in HTTP Digest
  Authentication
 - Resolves: RHEL-14781 - squid: squid: Request/Response smuggling in HTTP/1.1
  and ICAP
 * Wed Aug 16 2023 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-6
 - Resolves: #2231827 - Crash with half_closed_client on
 * Tue Dec 06 2022 Tomas Korbar <tkorbar@redhat.com> - 7:5.5-5
 - Resolves: #2151188 - [RFE] Add the "IP_BIND_ADDRESS_NO_PORT"
  flag to sockets created for outgoing connections in the squid source code.
-* Mon Nov 07 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-4
+* Wed Sep 28 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-5
- Resolves: #2095468 - [RFE] squid use systemd-sysusers
+- Resolves: #2130260 - CVE-2022-41318 squid:4/squid: buffer-over-read in SSPI and SMB
 * Mon Nov 07 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-3
 - Resolves: #2130253 - CVE-2022-41318 squid: buffer-over-read in SSPI and SMB
  authentication
-* Mon Jul 11 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-2
+* Tue Jun 28 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-4
- Resolves: #2100785 - CVE-2021-46784 squid: DoS when processing gopher server
+- Resolves: #2100783 - CVE-2021-46784 squid:4/squid: DoS when processing gopher
-  responses
+  server responses
-* Tue May 31 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-1
+* Wed Feb 09 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-3
- new version 5.5
+- Resolves: #1941506 - CVE-2021-28116 squid:4/squid: out-of-bounds read in WCCP
- Resolves: #2075727 - The memory usage of the squid process keeps increasing
+  protocol data may lead to information disclosure
-* Thu Oct 07 2021 Luboš Uhliarik <luhliari@redhat.com> - 7:5.2-1
+* Tue Jan 25 2022 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-2
- new version 5.2
+- Resolves: #2006121 - SQUID shortens FTP Link wrong that contains a semi-colon
- Resolves: #1934560 - squid: out-of-bounds read in WCCP protocol
+  and as a result is not able to download zip file.CODE 404 TO CLIENT)
 - Resolves: #2011637 - Rebase squid to 5.2
-* Wed Sep 15 2021 Luboš Uhliarik <luhliari@redhat.com> - 7:5.1-3
+* Fri Jun 18 2021 Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-1
- Resolves: #1988122 - Enable LTO build of squid for RHEL 9
+- new version 4.15
 - Resolves: #1964384 - squid:4 rebase to 4.15
-* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 7:5.1-2
+* Wed Mar 31 2021 Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-5
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+- Resolves: #1944261 - CVE-2020-25097 squid:4/squid: improper input validation
-  Related: rhbz#1991688
+  may allow a trusted client to perform HTTP Request Smuggling
-* Thu Aug 05 2021 Luboš Uhliarik <luhliari@redhat.com> - 7:5.1-1
+* Mon Oct 26 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-4
- new version 5.1
+- Resolves: #1890606 - Fix for CVE 2019-13345 breaks authentication in
- Resolves: #1990517 - Rebase squid to 5.1
+  cachemgr.cgi
 - Resolves: #1985231 - squid: FTBFS because of OpenSSL 3.0 preprocessor macro
  changes
-* Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 7:5.0.6-4
+* Wed Aug 26 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-3
- Rebuilt for RHEL 9 BETA for openssl 3.0
+- Resolves: #1871705 - CVE-2020-24606 squid: Improper Input Validation could
-  Related: rhbz#1971065
+  result in a DoS
 - Resolves: #1871702 - CVE-2020-15811 squid: HTTP Request Splitting could result
  in cache poisoning
 - Resolves: #1871700 - CVE-2020-15810 squid: HTTP Request Smuggling could result
  in cache poisoning
-* Tue Jun 08 2021 Luboš Uhliarik <luhliari@redhat.com> - 7:5.0.6-3
+* Thu Jul 02 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-2
- Resolves: #1969322 - squid doesn't work with active ftp
+- Resolves: #1853130 - CVE-2020-15049 squid:4/squid: request smuggling and
-
+  poisoning attack against the HTTP cache
-* Mon May 17 2021 Lubos Uhliarik <luhliari@redhat.com> - 7:5.0.6-2
+- Resolves: #1853136 - CVE-2020-14058 squid:4/squid: DoS in TLS handshake
 - Resolves: #1953505 - squid: Port to OpenSSL 3.0
 * Mon May 17 2021 Lubos Uhliarik <luhliari@redhat.com> - 7:5.0.6-1
 - new version 5.0.6
 - Resolves: #1961253 - Rebase squid to 5.0.6
 * Fri Apr 23 2021 Lubos Uhliarik <luhliari@redhat.com> - 7:5.0.5-2
 - new version 5.0.5
 - Resolves: #1952896 - Rebase squid to >= 5.0.5
 - Resolves: #1940412 - Remove libdb dependency from squid
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 7:4.14-2
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 * Wed Mar 31 2021 Lubos Uhliarik <luhliari@redhat.com> - 7:4.14-1
 - new version 4.14
 - Resolves: #1939927 - CVE-2020-25097 squid: improper input validation may allow
  a trusted client to perform HTTP Request Smuggling
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.13-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Sat Oct 17 2020 Jeff Law <law@redhat.com> - 7:4.13-2
 - Fix missing #includes for gcc-11
 * Tue Aug 25 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.13-1
 - new version 4.13
 * Fri Aug 07 2020 Jeff law <law@redhat.com> - 7:4.12-4
 - Disable LTO
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.12-3
 - Second attempt - Rebuilt for
  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.12-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Mon Jun 15 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.12-1
 - new version 4.12
 * Thu May 07 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-1
 - new version 4.11
 - libsystemd integration
- Resolves: #1827564 - CVE-2020-11945 squid: improper access restriction upon
+- Resolves: #1829467 - squid:4 rebase
 - Resolves: #1828378 - CVE-2019-12521 squid:4/squid: off-by-one error in
  addStackElement allows for a heap buffer overflow and a crash
 - Resolves: #1828377 - CVE-2019-12520 squid:4/squid: improper input validation
  in request allows for proxy manipulation
 - Resolves: #1828375 - CVE-2019-12524 squid:4/squid: improper access restriction
  in url_regex may lead to security bypass
 - Resolves: #1820664 - CVE-2019-18860 squid: mishandles HTML in the host
  parameter to cachemgr.cgi which could result in squid behaving in unsecure way
 - Resolves: #1802514 - CVE-2020-8449 squid:4/squid: Improper input validation
  issues in HTTP Request processing
 - Resolves: #1802513 - CVE-2020-8450 squid:4/squid: Buffer overflow in a Squid
  acting as reverse-proxy
 - Resolves: #1802512 - CVE-2019-12528 squid:4/squid: Information Disclosure
  issue in FTP Gateway
 - Resolves: #1771288 - CVE-2019-18678 squid:4/squid: HTTP Request Splitting
  issue in HTTP message processing
 - Resolves: #1771283 - CVE-2019-18679 squid:4/squid: Information Disclosure
  issue in HTTP Digest Authentication
 - Resolves: #1771280 - CVE-2019-18677 squid:4/squid: Cross-Site Request Forgery
  issue in HTTP Request processing
 - Resolves: #1771275 - CVE-2019-12523 squid:4/squid: Improper input validation
  in URI processor
 - Resolves: #1771272 - CVE-2019-18676 squid:4/squid: Buffer overflow in URI
  processor
 - Resolves: #1771264 - CVE-2019-12526 squid:4/squid: Heap overflow issue in URN
  processing
 - Resolves: #1738581 - CVE-2019-12529 squid: OOB read in Proxy-Authorization
  header causes DoS
 * Tue Apr 28 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-9
 - Resolves: #1738583 - CVE-2019-12525 squid:4/squid: parsing of header
  Proxy-Authentication leads to memory corruption
 - Resolves: #1828369 - CVE-2020-11945 squid: improper access restriction upon
  Digest Authentication nonce replay could lead to remote code execution
 - Resolves: #1828370 - CVE-2019-12519 squid: improper check for new member in
  ESIExpression::Evaluate allows for stack buffer overflow
-* Thu Mar 26 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.10-4
+* Fri Aug 23 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8
- Resolves: #1817208 - More cache_swap.sh optimizations
+- Resolves: # 1738485 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
  in HttpHeader::getAuth
-* Wed Mar 25 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.10-3
+* Wed Jul 31 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-7
- Resolves: #1786485 - squid.service: use ${SQUID_CONF} rather than $SQUID_CONF
+- Resolves: #1729436 - CVE-2019-13345 squid: XSS via user_name or auth parameter
- Resolves: #1798535 - CVE-2019-12528 squid: Information Disclosure issue in
+  in cachemgr.cgi
  FTP Gateway
 - Resolves: #1798554 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
  as reverse-proxy
 - Resolves: #1798541 - CVE-2020-8449 squid: Improper input validation issues 
  in HTTP Request processing
-* Tue Jan 28 2020 Lubos Uhliarik <luhliari@redhat.com> - 7:4.10-1
+* Fri Jun 21 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-6
- new version 4.10
+- Resolves: #1679526 - Missing detailed configuration file
 - Resolves: #1703117 - RHEL 7 to 8 fails with squid installed because dirs
  changed to symlinks
 - Resolves: #1691741 - Squid cache_peer DNS lookup failed when not all lower
  case
 - Resolves: #1683527 - "Reloading" message on a fresh reboot after enabling
  squid
-* Tue Dec 17 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.9-3
+* Tue Dec 11 2018 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-4
- Resolves: #1784383 - Add BuildRequires: systemd-rpm-macros
+- Resolves: #1612524 - Man page scan results for squid 
 - Resolves: #1783757 - Build with ./configure --with-pidfile=/run/squid.pid
 - Resolves: #1783768 - Optimize cache_swap.sh cache_dir search
-* Mon Nov 11 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.9-2
+* Tue Dec 11 2018 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-3
- new version 4.9
+- Resolves: #1642384 - squid doesn't work with active ftp
 - verify src taball signature by default in prep section
-* Tue Oct 08 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.8-6
+* Tue Dec 11 2018 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-2
- Resolves: #1741342 - Do not call autoconf at build time
+- Resolves: #1657847 - Unable to start Squid in Selinux Enforcing mode
 * Tue Oct 08 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.8-5
 - Resolves: #1716950 - Drop "sleep 1" from logrotate fragment
 * Thu Aug 22 2019 Lubomir Rintel <lkundrak@v3.sk> - 7:4.8-4
 - Move the NetworkManager dispatcher script out of /etc
 * Mon Aug 05 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.8-3
 - Resolves: #1737030 - depend on httpd-filesystem
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Wed Jul 10 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.8-1
 - new version 4.8
 - Resolves: #1727745 - squid: CVe-2019-13345 squid: XSS via user_name or auth
  parameter in cachemgr.cgi
 * Tue Jul 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.7-6
 - fix filepath to squid.conf.documented in squid's manpage
 - fix path to systemctl in nm script
 * Wed May 22 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.7-5
 - Related: #1709299 - Use upstream squid.service
 * Fri May 17 2019 Luboš Uhliarik <luhliari@redhat.com> - 7:4.7-1
 - new version 4.7
 * Fri May 17 2019 Luboš Uhliarik <luhliari@redhat.com> - 7:4.6-3
 - Resolves: #1709299 - Use upstream squid.service
 * Mon Apr 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.6-2
 - Resolves: #1599074 - squid: 3 coredumps every day
 * Wed Apr 24 2019 Lubos Uhliarik <luhliari@redhat.com> - 7:4.6-1
 - new version 4.6
 - disabled strict checking due to gcc warnings
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.4-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 7:4.4-2
 - Rebuilt for libcrypt.so.2 (#1666033)
 * Mon Dec 10 2018 Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-1
- new version 4.4
+- Resolves: #1656871 - squid rebase to 4.4
 - Resolves: #1645148 - CVE-2018-19131 squid: Cross-Site Scripting when
  generating HTTPS response messages about TLS errors
 - Resolves: #1645156 - CVE-2018-19132 squid: Memory leak in SNMP query
  rejection code
-* Sun Oct 14 2018 Peter Robinson <pbrobinson@fedoraproject.org> 7:4.2-3
+* Mon Aug 06 2018 Lubos Uhliarik <luhliari@redhat.com> - 7:4.2-1
 - Drop obsolete legacy sys-v remanents
 * Mon Aug 20 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.2-2
 - Resolves: #1618790 - SELinux 'dac_override' denial for cache_swap.sh
 * Mon Aug 06 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.2-1
 - new version 4.2
 - enable back strict error checking
 * Wed Aug 01 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.1-1
 - new version 4.1
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.0.25-2
+* Mon Jun 04 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+- Resolves: #1585617 - Build against libdb only instead of libdb4
 - disabled strict checking for now (squid can not be built with GCC8)
-* Thu Jun 28 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.25-1
+* Mon Apr 16 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-4
- new version 4.0.25
+- Resolves: #1566055 - module squid cannot be installed due to missing
-
+  perl(Crypt::OpenSSL::X509)
 * Mon Jun 04 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.24-2
 - removed obsolete BuildRequires (libdb4-devel)
 * Thu Mar 08 2018 Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.24-1
 - new version 4.0.24
 - disabled strict checking (removed -Werror)
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 7:4.0.23-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
`@ -1,2 +1 @@`
	`SOURCES/pgp.asc`	`SOURCES/squid-4.15.tar.xz`
	`SOURCES/squid-5.5.tar.xz`
`@ -1,2 +1 @@`
	`8e3de63f3bef0c9c4edbcfe000c567119f687143 SOURCES/pgp.asc`	`60bda34ba39657e2d870c8c1d2acece8a69c3075 SOURCES/squid-4.15.tar.xz`
	`42302bd9b8feff851a41420334cb8eaeab2806ab SOURCES/squid-5.5.tar.xz`
		`@ -1,2 +0,0 @@`
			`g squid 23 -`
			`u squid 23 "Squid proxy user" /var/spool/squid /sbin/nologin`