fixed filename for fix_h00004.vtc.patch

VSV00015.patch

@@ -0,0 +1,46 @@
+commit 8ef69a03b36aeac5f364c01eb20f821860e47f14
+Author: Dag Haavi Finstad <daghf@varnish-software.com>
+Date:   Fri Jan 10 13:07:54 2025 +0100
+
+    req_fsm: Close the connection on a malformed request
+
+diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
+index 1004cbc5f..803810210 100644
+--- a/bin/varnishd/cache/cache_req_fsm.c
++++ b/bin/varnishd/cache/cache_req_fsm.c
+@@ -962,6 +962,7 @@ cnt_recv(struct worker *wrk, struct req *req)
+ 	if (http_CountHdr(req->http0, H_Host) > 1) {
+ 		VSLb(req->vsl, SLT_BogoHeader, "Multiple Host: headers");
+ 		wrk->stats->client_req_400++;
++		req->doclose = SC_RX_BAD;
+ 		(void)req->transport->minimal_response(req, 400);
+ 		return (REQ_FSM_DONE);
+ 	}
+@@ -969,6 +970,7 @@ cnt_recv(struct worker *wrk, struct req *req)
+ 	if (http_CountHdr(req->http0, H_Content_Length) > 1) {
+ 		VSLb(req->vsl, SLT_BogoHeader, "Multiple Content-Length: headers");
+ 		wrk->stats->client_req_400++;
++		req->doclose = SC_RX_BAD;
+ 		(void)req->transport->minimal_response(req, 400);
+ 		return (REQ_FSM_DONE);
+ 	}
+diff --git a/bin/varnishtest/tests/b00037.vtc b/bin/varnishtest/tests/b00037.vtc
+index ce0e84112..e6185bd07 100644
+--- a/bin/varnishtest/tests/b00037.vtc
++++ b/bin/varnishtest/tests/b00037.vtc
+@@ -11,6 +11,7 @@ client c1 {
+ 
+ varnish v1 -vsl_catchup
+ varnish v1 -expect client_req_400 == 1
++varnish v1 -expect sc_rx_bad == 1
+ 
+ client c1 {
+ 	txreq -method POST -hdr "Content-Length: 12" -hdr "Content-Length: 12" -bodylen 12
+@@ -20,6 +21,7 @@ client c1 {
+ 
+ varnish v1 -vsl_catchup
+ varnish v1 -expect client_req_400 == 2
++varnish v1 -expect sc_rx_bad == 2
+ 
+ varnish v1 -cliok "param.set feature +http2"
+ 

varnish-7.4.2-fix_h00004.vtc.patch

@@ -0,0 +1,48 @@
+--- bin/varnishtest/vtc_haproxy.c.orig	2023-11-13 09:41:21.000000000 +0100
++++ bin/varnishtest/vtc_haproxy.c	2025-03-26 16:27:52.525931293 +0100
+@@ -55,7 +55,6 @@
+ #define HAPROXY_OPT_DAEMON	"-D"
+ #define HAPROXY_SIGNAL		SIGINT
+ #define HAPROXY_EXPECT_EXIT	(128 + HAPROXY_SIGNAL)
+-#define HAPROXY_GOOD_CONF	"Configuration file is valid"
+ 
+ struct envar {
+ 	VTAILQ_ENTRY(envar) list;
+@@ -268,7 +267,7 @@
+ 		}
+ 		/* Connection closed. */
+ 		if (ret == 0) {
+-			if (hc->rxbuf[rdz - 1] != '\n')
++			if (rdz > 0 && hc->rxbuf[rdz - 1] != '\n')
+ 				vtc_fatal(hc->vl,
+ 				    "CLI rx timeout (fd: %d %.3fs ret: %zd)",
+ 				    hc->sock, hc->timeout, ret);
+@@ -291,7 +290,7 @@
+  * SECTION: haproxy.cli.expect
+  * expect OP STRING
+  *         Regex match the CLI reception buffer with STRING
+- *         if OP is ~ or, on the contraty, if OP is !~ check that there is
++ *         if OP is ~ or, on the contrary, if OP is !~ check that there is
+  *         no regex match.
+  */
+ static void v_matchproto_(cmd_f)
+@@ -825,7 +824,7 @@
+ 			vtc_log(h->vl, 4,
+ 			    "Kill(%d)=%d: %s", sig, i, strerror(errno));
+ 		}
+-		usleep(100000);
++		VTIM_sleep(0.1);
+ 		if (++n == 20) {
+ 			switch (sig) {
+ 			case SIGINT:	sig = SIGTERM ; break;
+@@ -1077,8 +1076,9 @@
+ 		if (!strcmp(*av, "-conf-OK")) {
+ 			AN(av[1]);
+ 			haproxy_store_conf(h, av[1], 0);
++			h->expect_exit = 0;
++			haproxy_check_conf(h, "");
+ 			av++;
+-			haproxy_check_conf(h, HAPROXY_GOOD_CONF);
+ 			continue;
+ 		}
+ 		if (!strcmp(*av, "-conf-BAD")) {

varnish.spec

@@ -37,11 +37,13 @@
 Summary: High-performance HTTP accelerator
 Name: varnish
 Version: 7.4.2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
 Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
 Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
+Patch1:  VSV00015.patch
+Patch2:  varnish-7.4.2-fix_h00004.vtc.patch
 
 %if 0%{?fedora} > 29 || 0%{?rhel} > 7
 Provides: varnish%{_isa} = %{version}-%{release}
@@ -137,6 +139,8 @@ Documentation files for %name
 
 %prep
 %setup -q
+%patch 1 -p1
+%patch 2 -p0
 tar xzf %SOURCE1
 ln -s pkg-varnish-cache-%{commit1}/redhat redhat
 ln -s pkg-varnish-cache-%{commit1}/debian debian
@@ -304,6 +308,9 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
+* Wed Mar 26 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-3
+- Security: Added patch for VSV00015 aka CVE-2025-30346, BZ#2354008
+
 * Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.4.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild