Added a sleep 0.5 to ExecStartPost, working around a race in

systemd, fixing bz#1478278
Added mitigation instructions for VSV00008 aka CVE-2022-23959
2022-02-22 08:32:37 +01:00 · 2022-02-16 17:54:37 +01:00 · 2017-08-02 22:22:28 +02:00 · 2016-12-13 01:10:51 +01:00 · 2016-12-05 23:11:35 +01:00 · 2016-12-02 13:00:21 +01:00
7 changed files with 388 additions and 102 deletions
--- a/.gitignore
+++ b/.gitignore
@ -11,3 +11,7 @@ varnish-2.1.3.tar.gz
 /varnish-4.0.1.tar.gz
 /varnish-4.0.2.tar.gz
 /varnish-4.0.3.tar.gz
+/varnish-4.0.4.tar.gz
+/pkg-varnish-cache-c4ae063.tar.gz
+/pkg-varnish-cache-29aa295.tar.gz
+/varnish-4.0.5.tar.gz
--- a/3
+++ b/3
@ -1 +1,2 @@
-16a683f2e41f7d80219cec5d4649380c  varnish-4.0.3.tar.gz
+SHA512 (varnish-4.0.5.tar.gz) = a08259f6f9c6fffa188b26c1f8c630de5e6d2f6d52f6efa9d5d8239cdd8721c53e2be3379f8100efb537e74416eadd6c865f4cc687db1c5a9f757bb3f73abeda
+SHA512 (pkg-varnish-cache-29aa295.tar.gz) = 5fec8b555a643e5ca8518ab9103d5108dabc0180911015dd26bb6b5e98668a9d0ee2dc7f2c3bd0e0dc80f6d8490b1365f56221cef39c01d55bfeb3059d04f8a7
--- a/varnish-4.0.4_fix_Werror_el6.patch
+++ b/varnish-4.0.4_fix_Werror_el6.patch
@ -0,0 +1,11 @@
+--- configure.orig	2016-11-30 13:07:13.000000000 +0100
+++ configure	2016-12-02 11:28:49.176227489 +0100
+@@ -17067,7 +17067,7 @@
+ # The reason for -Wno-error=unused-result is a glibc/gcc interaction
+ # idiocy where write is marked as warn_unused_result, causing build
+ # failures.
+-CFLAGS="${CFLAGS} -Wall -Werror"
+#CFLAGS="${CFLAGS} -Wall -Werror"
+ OCFLAGS="${OCFLAGS} -Wall -Werror"
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Werror=unused-result" >&5
+ $as_echo_n "checking whether C compiler accepts -Werror=unused-result... " >&6; }
--- a/varnish-4.0.4_fix_systemd_el7.patch
+++ b/varnish-4.0.4_fix_systemd_el7.patch
@ -0,0 +1,42 @@
+diff -Naur ../varnish-4.0.4.orig/redhat/varnishlog.service redhat/varnishlog.service
+--- ../varnish-4.0.4.orig/redhat/varnishlog.service	1970-01-01 01:00:00.000000000 +0100
+++ redhat/varnishlog.service	2016-12-05 20:44:01.579083538 +0100
+@@ -0,0 +1,15 @@
+[Unit]
+Description=Varnish Cache HTTP accelerator logging daemon
+After=varnish.service
+
+[Service]
+RuntimeDirectory=varnishlog
+Type=forking
+PIDFile=/run/varnishlog/varnishlog.pid
+User=varnish
+Group=varnish
+ExecStart=/usr/bin/varnishlog -a -w /var/log/varnish/varnish.log -D -P /run/varnishlog/varnishlog.pid
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target
+diff -Naur ../varnish-4.0.4.orig/redhat/varnishncsa.service redhat/varnishncsa.service
+--- ../varnish-4.0.4.orig/redhat/varnishncsa.service	2016-11-29 10:45:14.000000000 +0100
+++ redhat/varnishncsa.service	2016-12-05 20:25:01.878729560 +0100
+@@ -6,7 +6,7 @@
+ RuntimeDirectory=varnishncsa
+ Type=forking
+ PIDFile=/run/varnishncsa/varnishncsa.pid
+-User=varnishlog
+User=varnish
+ Group=varnish
+ ExecStart=/usr/bin/varnishncsa -a -w /var/log/varnish/varnishncsa.log -D -P /run/varnishncsa/varnishncsa.pid
+ ExecReload=/bin/kill -HUP $MAINPID
+diff -Naurw ../varnish-4.0.4.orig/redhat/varnish.service redhat/varnish.service
+--- ../varnish-4.0.4.orig/redhat/varnish.service	2016-11-29 10:45:14.000000000 +0100
+++ redhat/varnish.service	2016-12-13 01:04:43.853627382 +0100
+@@ -34,6 +34,7 @@
+ 	-a ${VARNISH_LISTEN_ADDRESS}:${VARNISH_LISTEN_PORT} \
+ 	-T ${VARNISH_ADMIN_LISTEN_ADDRESS}:${VARNISH_ADMIN_LISTEN_PORT} \
+ 	-S $VARNISH_SECRET_FILE \
+	-u $VARNISH_USER -g $VARNISH_GROUP \
+ 	-s $VARNISH_STORAGE \
+ 	$DAEMON_OPTS
+ 
--- a/varnish-4.0.4_missing_varnishlog_initrc.patch
+++ b/varnish-4.0.4_missing_varnishlog_initrc.patch
@ -0,0 +1,120 @@
+diff -Naur redhat.orig/varnishlog.initrc redhat/varnishlog.initrc
+--- redhat.orig/varnishlog.initrc	1970-01-01 01:00:00.000000000 +0100
+++ redhat/varnishlog.initrc	2016-12-09 14:54:38.721554162 +0100
+@@ -0,0 +1,116 @@
+#! /bin/sh
+#
+# varnishlog Control the Varnish logging daemon
+#
+# chkconfig: - 90 10
+# description: Varnish Cache logging daemon
+# processname: varnishlog
+# config: 
+# pidfile: /var/run/varnishlog.pid
+
+### BEGIN INIT INFO
+# Provides: varnishlog
+# Required-Start: $network $local_fs $remote_fs
+# Required-Stop: $network $local_fs $remote_fs
+# Default-Start:
+# Default-Stop:
+# Short-Description: start and stop varnishlog
+# Description: Varnish Cache logging daemon
+### END INIT INFO
+
+# Source function library.
+. /etc/init.d/functions
+
+retval=0
+pidfile="/var/run/varnishlog.pid"
+lockfile="/var/lock/subsys/varnishlog"
+logfile="/var/log/varnish/varnish.log"
+
+exec="/usr/bin/varnishlog"
+prog="varnishlog"
+
+DAEMON_OPTS="-a -w $logfile -D -P $pidfile"
+
+# Include varnishlog defaults
+[ -e /etc/sysconfig/varnishlog ] && . /etc/sysconfig/varnishlog
+
+start() {
+
+	if [ ! -x $exec ]
+	then
+		echo $exec not found
+		exit 5
+	fi
+
+	echo -n "Starting varnish logging daemon: "
+
+	daemon --pidfile $pidfile $exec "$DAEMON_OPTS" 
+	echo
+	return $retval
+}
+
+stop() {
+	echo -n "Stopping varnish logging daemon: "
+	killproc -p $pidfile $prog
+	retval=$?
+	echo
+	[ $retval -eq 0 ] && rm -f $lockfile
+	return $retval
+}
+
+restart() {
+	stop
+	start
+}
+
+reload() {
+	restart
+}
+
+force_reload() {
+	restart
+}
+
+rh_status() {
+	status -p $pidfile $prog
+}
+
+rh_status_q() {
+	rh_status >/dev/null 2>&1
+}
+
+# See how we were called.
+case "$1" in
+	start)
+		rh_status_q && exit 0
+		$1
+		;;
+	stop)
+		rh_status_q || exit 0
+		$1
+		;;
+	restart)
+		$1
+		;;
+	reload)
+		rh_status_q || exit 7
+		$1
+		;;
+	force-reload)
+		force_reload
+		;;
+	status)
+		rh_status
+		;;
+	condrestart|try-restart)
+		rh_status_q || exit 0
+		restart
+		;;
+	*)
+	echo "Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+
+	exit 2
+esac
+
+exit $?
+
--- a/varnish-4.0.5-CVE-2022-23959.patch
+++ b/varnish-4.0.5-CVE-2022-23959.patch
@ -0,0 +1,141 @@
+diff -Naur ../varnish-4.0.5.pre/README ./README
+--- ../varnish-4.0.5.pre/README	2017-08-01 11:53:28.000000000 +0200
+++ ./README	2022-02-22 07:58:56.821702441 +0100
+@@ -1,5 +1,15 @@
+ This is Varnish Cache, the high-performance HTTP accelerator.
+ 
+SECURITY: The varnish-4.0.x branch is marked END OF LIFE by the Varnish Cache
+upstream project. Please consider upgrading to varnish-6.0 LTS or newer.
+Links to packages compatible with VCL 4.0 and EPEL7 may be found at 
+http://varnish-cache.org/releases/
+
+varnish-4.0.5 is vulnerable to CVE-2022-23959.
+If you are unable to upgrade to a current version of varnish, consider
+mitigating against this attack, see instructions in the included file
+vsv8_epel7_varnish405.vcl
+
+ Documentation and additional information about Varnish is available on
+ https://www.varnish-cache.org/
+ 
+diff -Naur ../varnish-4.0.5.pre/redhat/varnishlog.service ./redhat/varnishlog.service
+--- ../varnish-4.0.5.pre/redhat/varnishlog.service	2022-02-16 17:36:32.395888407 +0100
+++ ./redhat/varnishlog.service	2022-02-22 08:00:31.199123798 +0100
+@@ -9,6 +9,7 @@
+ User=varnish
+ Group=varnish
+ ExecStart=/usr/bin/varnishlog -a -w /var/log/varnish/varnish.log -D -P /run/varnishlog/varnishlog.pid
+ExecStartPost=/bin/sleep 0.5
+ ExecReload=/bin/kill -HUP $MAINPID
+
+ [Install]
+diff -Naur ../varnish-4.0.5.pre/redhat/varnishncsa.service ./redhat/varnishncsa.service
+--- ../varnish-4.0.5.pre/redhat/varnishncsa.service	2022-02-16 17:36:32.395888407 +0100
+++ ./redhat/varnishncsa.service	2022-02-22 08:00:20.845858003 +0100
+@@ -9,6 +9,7 @@
+ User=varnish
+ Group=varnish
+ ExecStart=/usr/bin/varnishncsa -a -w /var/log/varnish/varnishncsa.log -D -P /run/varnishncsa/varnishncsa.pid
+ExecStartPost=/bin/sleep 0.5
+ ExecReload=/bin/kill -HUP $MAINPID
+
+ [Install]
+diff -Naur ../varnish-4.0.5.pre/redhat/varnish_pre ./redhat/varnish_pre
+--- ../varnish-4.0.5.pre/redhat/varnish_pre	1970-01-01 01:00:00.000000000 +0100
+++ ./redhat/varnish_pre	2022-02-22 07:58:56.821702441 +0100
+@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if /usr/sbin/varnishd -V 2>&1 | head -1 | grep -q 'varnish-4\.0\.'; then
+        if [ -f /etc/varnish/vsv8_epel7_varnish405.vcl ]; then true
+        else
+		echo ""
+                echo "WARNING: CVE-2022-23959 MITIGATION NOT FOUND!"
+		echo "Upgrade to varnish-6.0 LTS or add mitigation"
+                echo "See instructions in /usr/share/doc/varnish-4.0.5/vsv8_epel7_varnish405.vcl"
+		echo ""
+        fi
+fi
+
+diff -Naur ../varnish-4.0.5.pre/redhat/varnish_reload_vcl ./redhat/varnish_reload_vcl
+--- ../varnish-4.0.5.pre/redhat/varnish_reload_vcl	2022-02-16 17:37:15.285507970 +0100
+++ ./redhat/varnish_reload_vcl	2022-02-22 07:58:56.821702441 +0100
+@@ -86,12 +86,12 @@
+ 	exit 1
+ fi
+ 
+-if $VARNISHADM vcl.list | awk ' { print $4 } ' | grep -q $new_config; then
+if $VARNISHADM vcl.list | awk ' { print $3 } ' | grep -q $new_config; then
+ 	echo Trying to use new config $new_config, but that is already in use
+ 	exit 2
+ fi
+ 
+-current_config=$( $VARNISHADM vcl.list | awk ' /^active/ { print $4 } ' )
+current_config=$( $VARNISHADM vcl.list | awk ' /^active/ { print $3 } ' )
+ 
+ echo "Loading vcl from $VARNISH_VCL_CONF"
+ echo "Current running config name is $current_config"
+@@ -112,5 +112,6 @@
+ fi
+ $VARNISHADM vcl.list
+ echo Done
+/usr/sbin/varnish_pre
+ exit 0
+ 
+diff -Naur ../varnish-4.0.5.pre/redhat/varnish.service ./redhat/varnish.service
+--- ../varnish-4.0.5.pre/redhat/varnish.service	2022-02-16 17:37:15.285507970 +0100
+++ ./redhat/varnish.service	2022-02-22 08:00:06.888499689 +0100
+@@ -28,6 +28,7 @@
+ Type=forking
+ PIDFile=/var/run/varnish.pid
+ PrivateTmp=true
+ExecStartPre=/usr/sbin/varnish_pre
+ ExecStart=/usr/sbin/varnishd \
+ 	-P /var/run/varnish.pid \
+ 	-f $VARNISH_VCL_CONF \
+@@ -38,6 +39,7 @@
+ 	-s $VARNISH_STORAGE \
+ 	$DAEMON_OPTS
+
+ExecStartPost=/bin/sleep 0.5
+ ExecReload=/usr/sbin/varnish_reload_vcl
+
+ [Install]
+diff -Naur ../varnish-4.0.5.pre/redhat/vsv8_epel7_varnish405.vcl ./redhat/vsv8_epel7_varnish405.vcl
+--- ../varnish-4.0.5.pre/redhat/vsv8_epel7_varnish405.vcl	1970-01-01 01:00:00.000000000 +0100
+++ ./redhat/vsv8_epel7_varnish405.vcl	2022-02-22 07:58:56.821702441 +0100
+@@ -0,0 +1,35 @@
+# VSV00008 Varnish HTTP/1 Request Smuggling Vulnerability
+# also known as CVE-2022-23959
+#
+# Full details on this CVE at http://varnish-cache.org/security/VSV00008.html
+#
+# SECURITY: The varnish-4.0.x branch is marked END OF LIFE by the Varnish Cache
+# upstream project. Please consider upgrading to varnish-6.0 LTS or newer.
+# Links to packages compatible with VCL 4.0 and EPEL7 may be found at 
+# http://varnish-cache.org/releases/
+#
+# varnish-4.0.5 is vulnerable to CVE-2022-23959.
+# If you are unable to upgrade to a current version of varnish, consider
+# mitigating against this attack, by copying this file to
+# /etc/varnish/vsv8_epel7_varnish405.vcl
+# Then near the top of your default.vcl or similar, just below the
+# vcl 4.0; marker, add 
+#
+#    include "vsv8_epel7_varnish405.vcl";
+#
+# The systemd service unit will warn about this vulnerability in the log until
+# that file exists. If you know that your site is not vulnerable to this 
+# attack, you may silence the warning in the log by dropping an empty file at
+# the same location.
+#
+
+sub vsv8_epel7_varnish405 {
+    if ((req.http.Content-Length || req.http.Transfer-Encoding) &&
+      req.proto != "HTTP/2.0") {
+        set resp.http.Connection = "close";
+    }
+}
+
+sub vcl_synth { call vsv8_epel7_varnish405; }
+sub vcl_deliver { call vsv8_epel7_varnish405; }
+
--- a/varnish.spec
+++ b/varnish.spec
@ -3,30 +3,30 @@
 %define vd_rc %{?v_rc:-%{?v_rc}}
 %define    _use_internal_dependency_generator 0
 %define __find_provides %{_builddir}/%{name}-%{version}%{?v_rc:-%{?v_rc}}/redhat/find-provides
+
+# A bug in the rhel7 builders? Looks like they set _pkgdocdir fedora style
+# without version...?
+%{?rhel: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
+
+# Package scripts are now external
+# https://github.com/varnishcache/pkg-varnish-cache
+%define commit1 29aa2950d244c9d1efcbefeec038666db53fa4f0
+%global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
+
 Summary: High-performance HTTP accelerator
 Name: varnish
-Version: 4.0.3
+Version: 4.0.5
 Release: 3%{?v_rc}%{?dist}
 License: BSD
 Group: System Environment/Daemons
 URL: http://www.varnish-cache.org/
 Source0: http://repo.varnish-cache.org/source/%{name}-%{version}.tar.gz
-#Source0: %{name}-%{version}%{?vd_rc}.tar.gz
-#Source0: %{name}-trunk.tar.gz
-#Source0: http://repo.varnish-cache.org/snapshots/%{name}-%{version}%{?vd_rc}.tar.gz
+Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
 Patch1:  varnish-4.0.2.fix_ld_library_path_in_sphinx_build.patch
-Patch2:  varnish-4.0.3_fix_Werror_el6.patch
-Patch3:  varnish-4.0.3_fix_python24.el5.patch
-Patch4:  varnish-4.0.3_fix_varnish4_selinux.el6.patch
-Patch5:  varnish-4.0.3_fix_content_length_bug.patch
+Patch5:  varnish-4.0.4_fix_systemd_el7.patch
+Patch7:  varnish-4.0.5-CVE-2022-23959.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-# To build from git, start with a make dist, see redhat/README.redhat 
-# You will need at least automake autoconf libtool python-docutils
-#BuildRequires: automake autoconf libtool python-docutils
 BuildRequires: ncurses-devel groff pcre-devel pkgconfig python-docutils libedit-devel jemalloc-devel
-%if 0%{?rhel} == 6
-BuildRequires: selinux-policy
-%endif
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Requires: logrotate
 Requires: ncurses
@ -37,24 +37,12 @@ Requires(pre): shadow-utils
 Requires(post): /sbin/chkconfig, /usr/bin/uuidgen
 Requires(preun): /sbin/chkconfig
 Requires(preun): /sbin/service
-#Provides: varnishabi-4.0.0-2acedeb
-%if %{undefined suse_version}
 Requires(preun): initscripts
-%endif
-%if 0%{?fedora} >= 17 || 0%{?rhel} >= 7
 Requires(post): systemd-units
 Requires(post): systemd-sysv
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 BuildRequires: systemd-units
-%endif
-%if 0%{?rhel} == 6
-Requires: %{name}-selinux
-Requires(post): policycoreutils, 
-Requires(preun): policycoreutils
-Requires(postun): policycoreutils
-%endif
-
 # Varnish actually needs gcc installed to work. It uses the C compiler 
 # at runtime to compile the VCL configuration files. This is by design.
 Requires: gcc
@ -90,49 +78,21 @@ Group: Documentation
 %description docs
 Documentation files for %name

-#%package libs-static
-#Summary: Files for static linking of %{name} library functions
-#Group: Development/Libraries
-#BuildRequires: ncurses-devel
-#Requires: varnish-libs-devel = %{version}-%{release}
-#
-#%description libs-static
-#Files for static linking of varnish library functions
-#Varnish Cache is a high-performance HTTP accelerator
-
-%if 0%{?rhel} == 6
-%package selinux
-Summary: Minimal selinux policy for running varnish4
-Group:   System Environment/Daemons
-
-%description selinux
-Minimal selinux policy for running varnish4
-%endif
-
 %prep
 %setup -q -n varnish-%{version}%{?vd_rc}
-#%setup -q -n varnish-trunk
+tar xzf %SOURCE1
+ln -s pkg-varnish-cache-%{commit1}/redhat redhat
+ln -s pkg-varnish-cache-%{commit1}/debian debian

 %patch1 -p0
-%if 0%{?rhel} <= 6 && 0%{?fedora} <= 12
-%patch2 -p0
-%endif
-%if 0%{?rhel} <= 5 && 0%{?fedora} <= 12
-%patch3 -p0
-%endif
-%if 0%{?rhel} == 6
-%patch4 -p0
-%endif
-%patch5 -p1
+%patch5 -p0
+%patch7 -p0

 %build
 #export CFLAGS="$CFLAGS -Wp,-D_FORTIFY_SOURCE=0"

 # Remove "--disable static" if you want to build static libraries 
 %configure --disable-static \
-%if 0%{?rhel} <= 5 && 0%{?fedora} <= 12
-  --with-rst2man=/bin/true  \
-%endif
  --localstatedir=/var/lib  \
  --docdir=%{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}

@ -191,16 +151,10 @@ install -D -m 0755 redhat/varnishlog.initrc %{buildroot}%{_initrddir}/varnishlog
 install -D -m 0755 redhat/varnishncsa.initrc %{buildroot}%{_initrddir}/varnishncsa
 %endif
 install -D -m 0755 redhat/varnish_reload_vcl %{buildroot}%{_sbindir}/varnish_reload_vcl
+install -D -m 0755 redhat/varnish_pre %{buildroot}%{_sbindir}/varnish_pre

 echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/varnish-%{_arch}.conf

-# selinux module for el6
-%if 0%{?rhel} == 6
-cd selinux
-make -f %{_datadir}/selinux/devel/Makefile
-install -p -m 644 -D varnish4.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/varnish4.pp
-%endif
-
 %clean
 rm -rf %{buildroot}

@ -209,12 +163,13 @@ rm -rf %{buildroot}
 %{_sbindir}/*
 %{_bindir}/*
 %{_var}/lib/varnish
-%attr(0700,root,root) %dir %{_var}/log/varnish
+%attr(0700,varnish,varnish) %dir %{_var}/log/varnish
 %{_mandir}/man1/*.1*
 %{_mandir}/man3/*.3*
 %{_mandir}/man7/*.7*
-%doc LICENSE README redhat/README.redhat ChangeLog
-#% doc etc
+%doc LICENSE README doc/changes.rst
+%doc etc/builtin.vcl etc/example.vcl
+%doc redhat/vsv8_epel7_varnish405.vcl
 %dir %{_sysconfdir}/varnish/
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
 %config(noreplace) %{_sysconfdir}/logrotate.d/varnish
@ -225,6 +180,7 @@ rm -rf %{buildroot}
 %{_unitdir}/varnishncsa.service
 %{_unitdir}/varnishlog.service
 %config(noreplace)%{_sysconfdir}/varnish/varnish.params
+%ghost %verify(not md5 size mtime)  /run/varnish.pid

 # default is standard sysvinit
 %else
@ -258,19 +214,6 @@ rm -rf %{buildroot}
 %doc doc/html
 %doc doc/changes*.html

-#%files libs-static
-#%{_libdir}/libvarnish.a
-#%{_libdir}/libvarnishapi.a
-#%{_libdir}/libvarnishcompat.a
-#%{_libdir}/libvcc.a
-#%doc LICENSE
-
-%if 0%{?rhel} == 6
-%files selinux
-%defattr(-,root,root,-)
-%{_datadir}/selinux/packages/%{name}/varnish4.pp
-%endif
-
 %pre
 getent group varnish >/dev/null || groupadd -r varnish
 getent passwd varnish >/dev/null || \
@ -300,6 +243,10 @@ fi
 /sbin/chkconfig --add varnishncsa 
 %endif

+# Previous versions had varnishlog and varnishncsa running as root
+chown varnish:varnish /var/log/varnish/varnishncsa.log 2>/dev/null || true
+chown varnish:varnish /var/log/varnish/varnish.log 2>/dev/null || true
+
 test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc/varnish/secret)

 %triggerun -- varnish < 3.0.2-1
@ -315,25 +262,6 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 /sbin/chkconfig --del varnish >/dev/null 2>&1 || :
 #/bin/systemctl try-restart varnish.service >/dev/null 2>&1 || :

-# selinux module for el6
-%if 0%{?rhel} == 6
-%post selinux
-if [ "$1" -le "1" ] ; then # First install
-semodule -i %{_datadir}/selinux/packages/%{name}/varnish4.pp 2>/dev/null || :
-fi
-
-%preun selinux
-if [ "$1" -lt "1" ] ; then # Final removal
-semodule -r varnish4 2>/dev/null || :
-fi
-
-%postun selinux
-if [ "$1" -ge "1" ] ; then # Upgrade
-semodule -i %{_datadir}/selinux/packages/%{name}/varnish4.pp 2>/dev/null || :
-fi
-
-%endif
-
 %preun

 %if 0%{?fedora} >= 18 || 0%{?rhel} >= 7
@ -365,6 +293,45 @@ fi
 %endif

 %changelog
+* Tue Feb 22 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.5-3
+- Added a sleep 0.5 to ExecStartPost, working around a race in
+  systemd, fixing bz#1478278
+
+* Wed Feb 16 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.5-2
+- Added mitigation instructions for VSV00008 aka CVE-2022-23959
+  SECURITY, PLEASE NOTE: varnish-4.0.5 is marked END OF LIFE from the
+  Varnish Cache upstream project. Please consider upgrading to varnish-6.0 LTS
+  See /usr/share/doc/varnish-4.0.5/vsv8_epel7_varnish405.vcl for details.
+- Dropped el6 support
+
+* Wed Aug 02 2017 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.5-1
+- New upstream release. Includes patches for security issue VSV00001
+  closes bz #1476784, #1477699
+
+* Mon Dec 12 2016 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.4-4
+- Fixed missing user and group in varnish.service, so varnishd
+  runs as user and group 'varnish' instead of 'nobody'
+- Readded missing varnishlog.initrc
+
+* Mon Dec 05 2016 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.4-3
+- Fixed owner/group for varnishncsa/varnishlog logfiles, #1401272
+- Patched varnishlog.service and varnishncsa.service to run as simple
+  services, without pidfile handling, closes #1401272
+- Patched logrotate script to use systemd reload instead of kill
+- Added package ownership to "ghost" varnish.pid
+
+* Fri Dec 02 2016 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.4-2
+- Replaced long gone ChangeLog with doc/changes.rst
+
+* Fri Dec 02 2016 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.4-1
+- New upstream release
+- Package scripts are now external
+- Removed old stuff about building rpm from source checkout
+- Removed commented stuff about libs-static subpackage
+- Removed patches merged upstream
+- Added the example vcl files to the package
+- red hat epel7 builders set _pkgdocdir fedora style without version
+
 * Fri Mar 13 2015 Ingvar Hagelund <ingvar@redpill-linpro.com> 4.0.3-3
 - Added a patch fixing a crash on bogus content-length header,
  closing #1200034
Author	SHA1	Message	Date
Ingvar Hagelund	3bbdc44053	Added a sleep 0.5 to ExecStartPost, working around a race in systemd, fixing bz#1478278	2022-02-22 08:32:37 +01:00
Ingvar Hagelund	a4fbf7b1a2	Added mitigation instructions for VSV00008 aka CVE-2022-23959 SECURITY, PLEASE NOTE: varnish-4.0.5 is marked END OF LIFE from the Varnish Cache upstream project. Please consider upgrading to varnish-6.0 LTS See /usr/share/doc/varnish-4.0.5/vsv8_epel7_varnish405.vcl for details. Dropped el6 support	2022-02-16 17:54:37 +01:00
Ingvar Hagelund	4f73d9c72d	New upstream release. Includes patches for security issue VSV00001 closes bz #1476784, #1477699	2017-08-02 22:22:28 +02:00
Ingvar Hagelund	8a38af109d	Fixed missing user and group in varnish.service, so varnishd runs as user and group 'varnish' instead of 'nobody' Readded missing varnishlog.initrc	2016-12-13 01:10:51 +01:00
Ingvar Hagelund	527132f87d	Fixed owner/group for varnishncsa/varnishlog logfiles, #1401272 - Patched varnishlog.service and varnishncsa.service to run as simple services, without pidfile handling, closes #1401272 - Patched logrotate script to use systemd reload instead of kill - Added package ownership to "ghost" varnish.pid	2016-12-05 23:11:35 +01:00
Ingvar Hagelund	aef3cb9218	- Replaced long gone ChangeLog with doc/changes.rst	2016-12-02 13:00:21 +01:00
Ingvar Hagelund	c738cdecc8	added missing pkg-varnish tarball for 4.1.4	2016-12-02 12:19:47 +01:00
Ingvar Hagelund	829070ad37	New upstream release - Package scripts are now external - Removed old stuff about building rpm from source checkout - Removed commented stuff about libs-static subpackage - Removed patches merged upstream - Added the example vcl files to the package - red hat epel7 builders set _pkgdocdir fedora style without version	2016-12-02 12:10:40 +01:00