Security: Added patch for VSV00016 AKA CVE-2025-47905

.gitignore

@@ -63,16 +63,3 @@ varnish-2.1.3.tar.gz
 /varnish-7.4.1.tgz
 /varnish-7.4.2.tgz
 /varnish-7.5.0.tgz
-/varnish-7.6.0.tgz
-/pkg-varnish-cache-7d90347.tar.gz
-/varnish-7.6.1.tgz
-/varnish-7.7.0.tgz
-/varnish-7.7.1.tgz
-/jemalloc-5.3.0.tar.bz2
-/varnish-7.7.3.tgz
-/varnish-8.0.0.tgz
-/pkg-varnish-cache-1f0d212.tar.gz
-/varnish-9.0.0.tar.gz
-/varnish-9.0.1.tar.gz
-/varnish-9.0.2.tar.gz
-/varnish-9.0.3.tar.gz

VSV00015.patch

@@ -0,0 +1,46 @@
+commit 8ef69a03b36aeac5f364c01eb20f821860e47f14
+Author: Dag Haavi Finstad <daghf@varnish-software.com>
+Date:   Fri Jan 10 13:07:54 2025 +0100
+
+    req_fsm: Close the connection on a malformed request
+
+diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
+index 1004cbc5f..803810210 100644
+--- a/bin/varnishd/cache/cache_req_fsm.c
++++ b/bin/varnishd/cache/cache_req_fsm.c
+@@ -962,6 +962,7 @@ cnt_recv(struct worker *wrk, struct req *req)
+ 	if (http_CountHdr(req->http0, H_Host) > 1) {
+ 		VSLb(req->vsl, SLT_BogoHeader, "Multiple Host: headers");
+ 		wrk->stats->client_req_400++;
++		req->doclose = SC_RX_BAD;
+ 		(void)req->transport->minimal_response(req, 400);
+ 		return (REQ_FSM_DONE);
+ 	}
+@@ -969,6 +970,7 @@ cnt_recv(struct worker *wrk, struct req *req)
+ 	if (http_CountHdr(req->http0, H_Content_Length) > 1) {
+ 		VSLb(req->vsl, SLT_BogoHeader, "Multiple Content-Length: headers");
+ 		wrk->stats->client_req_400++;
++		req->doclose = SC_RX_BAD;
+ 		(void)req->transport->minimal_response(req, 400);
+ 		return (REQ_FSM_DONE);
+ 	}
+diff --git a/bin/varnishtest/tests/b00037.vtc b/bin/varnishtest/tests/b00037.vtc
+index ce0e84112..e6185bd07 100644
+--- a/bin/varnishtest/tests/b00037.vtc
++++ b/bin/varnishtest/tests/b00037.vtc
+@@ -11,6 +11,7 @@ client c1 {
+ 
+ varnish v1 -vsl_catchup
+ varnish v1 -expect client_req_400 == 1
++varnish v1 -expect sc_rx_bad == 1
+ 
+ client c1 {
+ 	txreq -method POST -hdr "Content-Length: 12" -hdr "Content-Length: 12" -bodylen 12
+@@ -20,6 +21,7 @@ client c1 {
+ 
+ varnish v1 -vsl_catchup
+ varnish v1 -expect client_req_400 == 2
++varnish v1 -expect sc_rx_bad == 2
+ 
+ varnish v1 -cliok "param.set feature +http2"
+ 

VSV00016.patch

@@ -0,0 +1,215 @@
+based on commit 6dd6607c93af5a9cc663a174aefc3a0aeff8f26c Mon Sep 17 00:00:00 2001
+
+From: Nils Goroll <nils.goroll@uplex.de>
+Date: Mon, 30 May 2022 13:09:11 +0200
+Subject: [PATCH] v1f: Read end-of-chunk as part of the chunk
+
+Until now, we read the (CR)?LF at the end of a chunk as part of the
+next chunk header (see: /* Skip leading whitespace */).
+
+For a follow up commit, we are going to want to know if the next chunk
+header is available for read, so we now consume the chunk end as part
+of the chunk itself.
+
+This also fixes a corner case: We previously accepted chunks with a
+missing end-of-chunk (see fix of r01729.vtc).
+
+Ref: https://datatracker.ietf.org/doc/html/rfc7230#section-4.1
+---
+ bin/varnishtest/tests/r01184.vtc     |  2 ++
+ bin/varnishtest/tests/r01506.vtc     | 16 ++++++++--------
+ bin/varnishtest/tests/r01729.vtc     |  6 +++---
+ 4 files changed, 39 insertions(+), 21 deletions(-)
+
+--- bin/varnishd/http1/cache_http1_vfp.c.orig	2024-11-08 11:47:35.000000000 +0100
++++ bin/varnishd/http1/cache_http1_vfp.c	2025-07-30 00:09:27.239254185 +0200
+@@ -88,77 +88,116 @@
+ 	return (i + l);
+ }
+ 
++/*--------------------------------------------------------------------
++ * read (CR)?LF at the end of a chunk
++ */
++static enum vfp_status
++v1f_chunk_end(struct vfp_ctx *vc, struct http_conn *htc)
++{
++	char c;
++
++	if (v1f_read(vc, htc, &c, 1) <= 0)
++		return (VFP_Error(vc, "chunked read err"));
++	if (c == '\r' && v1f_read(vc, htc, &c, 1) <= 0)
++		return (VFP_Error(vc, "chunked read err"));
++	if (c != '\n')
++		return (VFP_Error(vc, "chunked tail no NL"));
++	return (VFP_OK);
++}
++
+ 
+ /*--------------------------------------------------------------------
+- * Read a chunked HTTP object.
++ * Parse a chunk header and, for VFP_OK, return size in a pointer
+  *
+  * XXX: Reading one byte at a time is pretty pessimal.
+  */
+ 
+-static enum vfp_status v_matchproto_(vfp_pull_f)
+-v1f_chunked_pull(struct vfp_ctx *vc, struct vfp_entry *vfe, void *ptr,
+-    ssize_t *lp)
++static enum vfp_status
++v1f_chunked_hdr(struct vfp_ctx *vc, struct http_conn *htc, ssize_t *szp)
+ {
+-	struct http_conn *htc;
+ 	char buf[20];		/* XXX: 20 is arbitrary */
+-	char *q;
+ 	unsigned u;
+ 	uintmax_t cll;
+-	ssize_t cl, l, lr;
++	ssize_t cl, lr;
++	char *q;
+ 
+ 	CHECK_OBJ_NOTNULL(vc, VFP_CTX_MAGIC);
+-	CHECK_OBJ_NOTNULL(vfe, VFP_ENTRY_MAGIC);
+-	CAST_OBJ_NOTNULL(htc, vfe->priv1, HTTP_CONN_MAGIC);
+-	AN(ptr);
+-	AN(lp);
++	CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
++	AN(szp);
++	assert(*szp == -1);
++
++	/* Skip leading whitespace */
++	do {
++		lr = v1f_read(vc, htc, buf, 1);
++		if (lr <= 0)
++			return (VFP_Error(vc, "chunked read err"));
++	} while (vct_isows(buf[0]));
+ 
+-	l = *lp;
+-	*lp = 0;
+-	if (vfe->priv2 == -1) {
+-		/* Skip leading whitespace */
++	if (!vct_ishex(buf[0]))
++		return (VFP_Error(vc, "chunked header non-hex"));
++
++		/* Collect hex digits, skipping leading zeros */
++	for (u = 1; u < sizeof buf; u++) {
+ 		do {
+-			lr = v1f_read(vc, htc, buf, 1);
++			lr = v1f_read(vc, htc, buf + u, 1);
+ 			if (lr <= 0)
+ 				return (VFP_Error(vc, "chunked read err"));
+-		} while (vct_islws(buf[0]));
++		} while (u == 1 && buf[0] == '0' && buf[u] == '0');
++		if (!vct_ishex(buf[u]))
++			break;
++	}
++	if (u >= sizeof buf)
++		return (VFP_Error(vc, "chunked header too long"));
+ 
+-		if (!vct_ishex(buf[0]))
+-			 return (VFP_Error(vc, "chunked header non-hex"));
++	/* Skip trailing white space */
++	while (vct_isows(buf[u])) {
++		lr = v1f_read(vc, htc, buf + u, 1);
++		if (lr <= 0)
++			return (VFP_Error(vc, "chunked read err"));
++	}
++	if (buf[u] == '\r' && v1f_read(vc, htc, buf + u, 1) <= 0)
++		return (VFP_Error(vc, "chunked read err"));
++	if (buf[u] != '\n')
++		return (VFP_Error(vc, "chunked header no NL"));
+ 
+-		/* Collect hex digits, skipping leading zeros */
+-		for (u = 1; u < sizeof buf; u++) {
+-			do {
+-				lr = v1f_read(vc, htc, buf + u, 1);
+-				if (lr <= 0)
+-					return (VFP_Error(vc, "chunked read err"));
+-			} while (u == 1 && buf[0] == '0' && buf[u] == '0');
+-			if (!vct_ishex(buf[u]))
+-				break;
+-		}
++	buf[u] = '\0';
++		cll = strtoumax(buf, &q, 16);
++	if (q == NULL || *q != '\0')
++		return (VFP_Error(vc, "chunked header number syntax"));
++	cl = (ssize_t)cll;
++	if (cl < 0 || (uintmax_t)cl != cll)
++		return (VFP_Error(vc, "bogusly large chunk size"));
+ 
+-		if (u >= sizeof buf)
+-			return (VFP_Error(vc, "chunked header too long"));
++	*szp = cl;
++	return (VFP_OK);
++}
+ 
+-		/* Skip trailing white space */
+-		while (vct_islws(buf[u]) && buf[u] != '\n') {
+-			lr = v1f_read(vc, htc, buf + u, 1);
+-			if (lr <= 0)
+-				return (VFP_Error(vc, "chunked read err"));
+-		}
+ 
+-		if (buf[u] != '\n')
+-			return (VFP_Error(vc, "chunked header no NL"));
++/*--------------------------------------------------------------------
++ * Read a chunked HTTP object.
++ *
++ */
+ 
+-		buf[u] = '\0';
++static enum vfp_status v_matchproto_(vfp_pull_f)
++v1f_chunked_pull(struct vfp_ctx *vc, struct vfp_entry *vfe, void *ptr,
++    ssize_t *lp)
++{
++	static enum vfp_status vfps;
++	struct http_conn *htc;
++	ssize_t l, lr;
+ 
+-		cll = strtoumax(buf, &q, 16);
+-		if (q == NULL || *q != '\0')
+-			return (VFP_Error(vc, "chunked header number syntax"));
+-		cl = (ssize_t)cll;
+-		if (cl < 0 || (uintmax_t)cl != cll)
+-			return (VFP_Error(vc, "bogusly large chunk size"));
++	CHECK_OBJ_NOTNULL(vc, VFP_CTX_MAGIC);
++	CHECK_OBJ_NOTNULL(vfe, VFP_ENTRY_MAGIC);
++	CAST_OBJ_NOTNULL(htc, vfe->priv1, HTTP_CONN_MAGIC);
++	AN(ptr);
++	AN(lp);
+ 
+-		vfe->priv2 = cl;
++	l = *lp;
++	*lp = 0;
++	if (vfe->priv2 == -1) {
++		vfps = v1f_chunked_hdr(vc, htc, &vfe->priv2);
++		if (vfps != VFP_OK)
++			return (vfps);
+ 	}
+ 	if (vfe->priv2 > 0) {
+ 		if (vfe->priv2 < l)
+@@ -168,18 +207,15 @@
+ 			return (VFP_Error(vc, "chunked insufficient bytes"));
+ 		*lp = lr;
+ 		vfe->priv2 -= lr;
+-		if (vfe->priv2 == 0)
+-			vfe->priv2 = -1;
+-		return (VFP_OK);
++		if (vfe->priv2 != 0)
++			return (VFP_OK);
++
++		vfe->priv2 = -1;
++		return (v1f_chunk_end(vc, htc));
+ 	}
+ 	AZ(vfe->priv2);
+-	if (v1f_read(vc, htc, buf, 1) <= 0)
+-		return (VFP_Error(vc, "chunked read err"));
+-	if (buf[0] == '\r' && v1f_read(vc, htc, buf, 1) <= 0)
+-		return (VFP_Error(vc, "chunked read err"));
+-	if (buf[0] != '\n')
+-		return (VFP_Error(vc, "chunked tail no NL"));
+-	return (VFP_END);
++	vfps = v1f_chunk_end(vc, htc);
++	return (vfps == VFP_OK ? VFP_END : vfps);
+ }
+ 
+ static const struct vfp v1f_chunked = {

VSV00016.test.patch

@@ -0,0 +1,168 @@
+From c1e6774ae5b7e5fdd7aef7352170b1d6e7613070 Mon Sep 17 00:00:00 2001
+From: Dridi Boukelmoune <dridi.boukelmoune@gmail.com>
+Date: Thu, 3 Apr 2025 15:52:56 +0200
+Subject: [PATCH] vtc: Test coverage for VSV16
+
+---
+ bin/varnishtest/tests/f00016.vtc | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 69 insertions(+)
+ create mode 100644 bin/varnishtest/tests/f00016.vtc
+
+diff --git a/bin/varnishtest/tests/f00016.vtc b/bin/varnishtest/tests/f00016.vtc
+new file mode 100644
+index 0000000..a38b8b1
+--- /dev/null
++++ b/bin/varnishtest/tests/f00016.vtc
+@@ -0,0 +1,69 @@
++varnishtest "Do not tolerate anything else than CRLF as chunked ending"
++
++server s0 {
++	rxreq
++	expect_close
++} -dispatch
++
++varnish v1 -vcl+backend {} -start
++
++logexpect l1 -v v1 {
++	expect * 1001 FetchError "chunked tail no NL"
++	expect * 1004 FetchError "chunked tail no NL"
++	expect * 1007 FetchError "chunked header non-hex"
++	expect * 1010 FetchError "chunked header non-hex"
++} -start
++
++client c1 {
++	non_fatal
++	txreq -req POST -hdr "Transfer-encoding: chunked"
++	send "1\r\n"
++	send "This is more than one byte of data\r\n"
++	send "0\r\n"
++	send "\r\n"
++	fatal
++	rxresp
++	expect resp.status == 503
++	expect_close
++} -run
++
++client c2 {
++	non_fatal
++	txreq -req POST -hdr "Transfer-encoding: chunked"
++	send "1\r\n"
++	send "Z  2\r\n"
++	send "3d\r\n"
++	send "0\r\n\r\nPOST /evil HTTP/1.1\r\nHost: whatever\r\nContent-Length: 5\r\n\r\n"
++	send "0\r\n"
++	send "\r\n"
++	fatal
++	rxresp
++	expect resp.status == 503
++	expect_close
++} -run
++
++client c3 {
++	non_fatal
++	txreq -req POST -hdr "Transfer-encoding: chunked"
++	send "d\r\n"
++	send "Spurious CRLF\r\n\r\n"
++	send "0\r\n"
++	send "\r\n"
++	fatal
++	rxresp
++	expect resp.status == 503
++	expect_close
++} -run
++
++client c4 {
++	non_fatal
++	txreq -req POST -hdr "Transfer-encoding: chunked"
++	send "\n0\r\n"
++	send "\r\n"
++	fatal
++	rxresp
++	expect resp.status == 503
++	expect_close
++} -run
++
++logexpect l1 -wait
+--
+diff --git a/bin/varnishtest/tests/r01184.vtc b/bin/varnishtest/tests/r01184.vtc
+index 0988e65..94ecd3c 100644
+--- a/bin/varnishtest/tests/r01184.vtc
++++ b/bin/varnishtest/tests/r01184.vtc
+@@ -62,6 +62,7 @@ server s1 {
+ 		sendhex " 10 45 f3 a9 83 b8 18 1c  7b c2 30 55 04 17 13 c4"
+ 		sendhex " 0f 07 5f 7a 38 f4 8e 50  b3 37 d4 3a 32 4a 34 07"
+ 		sendhex " FF FF FF FF FF FF FF FF  72 ea 06 5f b3 1c fa dd"
++	send "\n"
+ 	expect_close
+ } -start
+ 
+@@ -93,6 +94,7 @@ server s1 {
+ 		sendhex " 10 45 f3 a9 83 b8 18 1c  7b c2 30 55 04 17 13 c4"
+ 		sendhex " 0f 07 5f 7a 38 f4 8e 50  b3 37 d4 3a 32 4a 34 07"
+ 		sendhex " FF FF FF FF FF FF FF FF  72 ea 06 5f b3 1c fa dd"
++	send "\n"
+ 	expect_close
+ } -start
+ 
+diff --git a/bin/varnishtest/tests/r01506.vtc b/bin/varnishtest/tests/r01506.vtc
+index 96b7b54..f7f89a7 100644
+--- a/bin/varnishtest/tests/r01506.vtc
++++ b/bin/varnishtest/tests/r01506.vtc
+@@ -7,15 +7,15 @@ server s0 {
+ 	txresp -nolen \
+ 	    -hdr "Transfer-Encoding: chunked" \
+ 	    -hdr "Connection: close"
+-	send "11\r\n0_23456789abcdef\n"
+-	send "11\r\n1_23456789abcdef\n"
+-	send "11\r\n2_23456789abcdef\n"
+-	send "11\r\n3_23456789abcdef\n"
++	send "11\r\n0_23456789abcdef\n\n"
++	send "11\r\n1_23456789abcdef\n\n"
++	send "11\r\n2_23456789abcdef\n\n"
++	send "11\r\n3_23456789abcdef\n\n"
+ 	barrier b1 sync
+-	send "11\r\n4_23456789abcdef\n"
+-	send "11\r\n5_23456789abcdef\n"
+-	send "11\r\n6_23456789abcdef\n"
+-	send "11\r\n7_23456789abcdef\n"
++	send "11\r\n4_23456789abcdef\n\n"
++	send "11\r\n5_23456789abcdef\n\n"
++	send "11\r\n6_23456789abcdef\n\n"
++	send "11\r\n7_23456789abcdef\n\n"
+ 	chunkedlen 0
+ 
+ } -dispatch
+diff --git a/bin/varnishtest/tests/r01729.vtc b/bin/varnishtest/tests/r01729.vtc
+index 883a60c..f6a01e9 100644
+--- a/bin/varnishtest/tests/r01729.vtc
++++ b/bin/varnishtest/tests/r01729.vtc
+@@ -11,7 +11,7 @@ server s1 {
+ 	send "\r\n"
+ 	send "14\r\n"
+ 	send "0123456789"
+-	send "0123456789"
++	send "0123456789\n"
+ 	send "0\r\n"
+ 	send "\r\n"
+ 
+@@ -29,7 +29,7 @@ client c1 {
+ 	send "\r\n"
+ 	send "14\r\n"
+ 	send "0123456789"
+-	send "0123456789"
++	send "0123456789\n"
+ 	send "0\r\n"
+ 	send "\r\n"
+ 
+@@ -45,7 +45,7 @@ client c1 {
+ 	send "\r\n"
+ 	send "14\r\n"
+ 	send "0123456789"
+-	send "0123456789"
++	send "0123456789\n"
+ 	send "0\r\n"
+ 	send "\r\n"
+ 
+--
+libgit2 1.9.0
+

jemalloc-5.3.0-aarch64-ts-segfault.patch

@@ -1,140 +0,0 @@
-diff --git a/test/unit/psset.c b/test/unit/psset.c
-index 6ff7201..58b4a88 100644
---- a/test/unit/psset.c
-+++ b/test/unit/psset.c
-@@ -124,7 +124,7 @@ TEST_BEGIN(test_fill) {
- 	hpdata_t pageslab;
- 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
- 
--	edata_t alloc[HUGEPAGE_PAGES];
-+	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
- 
- 	psset_t psset;
- 	psset_init(&psset);
-@@ -147,6 +147,8 @@ TEST_BEGIN(test_fill) {
- 	edata_init_test(&extra_alloc);
- 	err = test_psset_alloc_reuse(&psset, &extra_alloc, PAGE);
- 	expect_true(err, "Alloc succeeded even though psset should be empty");
-+	
-+	free(alloc);
- }
- TEST_END
- 
-@@ -157,7 +159,7 @@ TEST_BEGIN(test_reuse) {
- 	hpdata_t pageslab;
- 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
- 
--	edata_t alloc[HUGEPAGE_PAGES];
-+	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
- 
- 	psset_t psset;
- 	psset_init(&psset);
-@@ -239,6 +241,8 @@ TEST_BEGIN(test_reuse) {
- 	err = test_psset_alloc_reuse(&psset, &alloc[index_of_4], 4 * PAGE);
- 	expect_false(err, "Should have been able to find alloc.");
- 	edata_expect(&alloc[index_of_4], index_of_4, 4);
-+	
-+	free(alloc);
- }
- TEST_END
- 
-@@ -249,7 +253,7 @@ TEST_BEGIN(test_evict) {
- 	hpdata_t pageslab;
- 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
- 
--	edata_t alloc[HUGEPAGE_PAGES];
-+	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
- 
- 	psset_t psset;
- 	psset_init(&psset);
-@@ -273,6 +277,8 @@ TEST_BEGIN(test_evict) {
- 
- 	err = test_psset_alloc_reuse(&psset, &alloc[0], PAGE);
- 	expect_true(err, "psset should be empty.");
-+	
-+	free(alloc);
- }
- TEST_END
- 
-@@ -286,7 +292,9 @@ TEST_BEGIN(test_multi_pageslab) {
- 	    (void *)((uintptr_t)PAGESLAB_ADDR + HUGEPAGE),
- 	    PAGESLAB_AGE + 1);
- 
--	edata_t alloc[2][HUGEPAGE_PAGES];
-+	edata_t* alloc[2];
-+	alloc[0] = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
-+	alloc[1] = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
- 
- 	psset_t psset;
- 	psset_init(&psset);
-@@ -336,6 +344,9 @@ TEST_BEGIN(test_multi_pageslab) {
- 	 */
- 	err = test_psset_alloc_reuse(&psset, &alloc[1][0], 2 * PAGE);
- 	expect_false(err, "Allocation should have succeeded");
-+	
-+	free(alloc[0]);
-+	free(alloc[1]);
- }
- TEST_END
- 
-@@ -385,7 +396,7 @@ TEST_BEGIN(test_stats) {
- 	hpdata_t pageslab;
- 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
- 
--	edata_t alloc[HUGEPAGE_PAGES];
-+	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
- 
- 	psset_t psset;
- 	psset_init(&psset);
-@@ -415,6 +426,8 @@ TEST_BEGIN(test_stats) {
- 	stats_expect(&psset, 0);
- 	psset_update_end(&psset, &pageslab);
- 	stats_expect(&psset, 1);
-+	
-+	free(alloc);
- }
- TEST_END
- 
-@@ -475,8 +488,8 @@ init_test_pageslabs(psset_t *psset, hpdata_t *pageslab,
- 
- TEST_BEGIN(test_oldest_fit) {
- 	bool err;
--	edata_t alloc[HUGEPAGE_PAGES];
--	edata_t worse_alloc[HUGEPAGE_PAGES];
-+	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
-+	edata_t *worse_alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
- 
- 	hpdata_t pageslab;
- 	hpdata_t worse_pageslab;
-@@ -493,14 +506,19 @@ TEST_BEGIN(test_oldest_fit) {
- 	expect_false(err, "Nonempty psset failed page allocation");
- 	expect_ptr_eq(&pageslab, edata_ps_get(&test_edata),
- 	    "Allocated from the wrong pageslab");
-+
-+	free(alloc);
-+	free(worse_alloc);
- }
- TEST_END
- 
- TEST_BEGIN(test_insert_remove) {
- 	bool err;
- 	hpdata_t *ps;
--	edata_t alloc[HUGEPAGE_PAGES];
--	edata_t worse_alloc[HUGEPAGE_PAGES];
-+
-+	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
-+	edata_t *worse_alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
-+
- 
- 	hpdata_t pageslab;
- 	hpdata_t worse_pageslab;
-@@ -539,6 +557,9 @@ TEST_BEGIN(test_insert_remove) {
- 	psset_update_begin(&psset, &worse_pageslab);
- 	err = test_psset_alloc_reuse(&psset, &alloc[HUGEPAGE_PAGES - 1], PAGE);
- 	expect_true(err, "psset should be empty, but an alloc succeeded");
-+
-+	free(alloc);
-+	free(worse_alloc);
- }
- TEST_END
- 

jemalloc-5.3.0_fno-builtin.patch

@@ -1,29 +0,0 @@
-commit 3de0c24859f4413bf03448249078169bb50bda0f
-Author: divanorama <divanorama@gmail.com>
-Date:   Thu Sep 29 23:35:59 2022 +0200
-
-    Disable builtin malloc in tests
-    
-    With `--with-jemalloc-prefix=` and without `-fno-builtin` or `-O1` both clang and gcc may optimize out `malloc` calls
-    whose result is unused. Comparing result to NULL also doesn't necessarily count as being used.
-    
-    This won't be a problem in most client programs as this only concerns really unused pointers, but in
-    tests it's important to actually execute allocations.
-    `-fno-builtin` should disable this optimization for both gcc and clang, and applying it only to tests code shouldn't hopefully be an issue.
-    Another alternative is to force "use" of result but that'd require more changes and may miss some other optimization-related issues.
-    
-    This should resolve https://github.com/jemalloc/jemalloc/issues/2091
-
-diff --git a/Makefile.in b/Makefile.in
-index 6809fb29..a964f07e 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -458,6 +458,8 @@ $(TESTS_OBJS): $(objroot)test/%.$(O): $(srcroot)test/%.c
- $(TESTS_CPP_OBJS): $(objroot)test/%.$(O): $(srcroot)test/%.cpp
- $(TESTS_OBJS): CPPFLAGS += -I$(srcroot)test/include -I$(objroot)test/include
- $(TESTS_CPP_OBJS): CPPFLAGS += -I$(srcroot)test/include -I$(objroot)test/include
-+$(TESTS_OBJS): CFLAGS += -fno-builtin
-+$(TESTS_CPP_OBJS): CPPFLAGS += -fno-builtin
- ifneq ($(IMPORTLIB),$(SO))
- $(CPP_OBJS) $(C_SYM_OBJS) $(C_OBJS) $(C_JET_SYM_OBJS) $(C_JET_OBJS): CPPFLAGS += -DDLLEXPORT
- endif

sources

@@ -1,3 +1,2 @@
-SHA512 (varnish-9.0.3.tar.gz) = 2789cff88632c2279062a109513cc00cab7690785f8f77e90b9968098c71ddcdc6403d6a9edc755b8f4055f0d32d9e330b0bc20fbab92ba80232955942dc912a
-SHA512 (jemalloc-5.3.0.tar.bz2) = 22907bb052096e2caffb6e4e23548aecc5cc9283dce476896a2b1127eee64170e3562fa2e7db9571298814a7a2c7df6e8d1fbe152bd3f3b0c1abec22a2de34b1
-SHA512 (pkg-varnish-cache-1f0d212.tar.gz) = 9f05978c99f292e64e71ba24ef2de791a33640e40fbad66d47889837fb0d4ced203873f5a17716edf757b5ad48098289882c2df196ce1fb457f279bf7f35bec3
+SHA512 (varnish-7.5.0.tgz) = ca77abcb21299942b2bfd433e5f964d2e974cdae92d6a8889217fcd81933a3b7bc1e70ba87d7e842a4f90b59d7948242155380054d67ad49aab8dcea343055a2
+SHA512 (pkg-varnish-cache-cfa8cb3.tar.gz) = 058e689186d1b01bb4a256ff3a5a373337e380a0a87128d4b2adbcff41210189e7f4b3d56e8451f06120449c04aaa4ddc61f934a1fda9c5336dfe2020c66a569

varnish-7.7.0_fix_4298.patch

@@ -1,178 +0,0 @@
-commit 95e41dfa584d108e444949534c7ce5801cffeacc
-Author: Poul-Henning Kamp <phk@FreeBSD.org>
-Date:   Wed Mar 26 09:25:43 2025 +0000
-
-    If the client sends NO_RFC7540_PRIORITIES, "rxprio" verbs become no-ops.
-    
-    Fixes: #4298
-    Tested by: @ingvarha
-
-
-
-commit 3a1eb57d8bd57205db7d2c766aed39cf73c4f578
-Author: Poul-Henning Kamp <phk@FreeBSD.org>
-Date:   Wed Mar 26 09:24:17 2025 +0000
-
-    Add more HTTP2 Settings to the table
-
-
-diff --git a/bin/varnishtest/vtc.h b/bin/varnishtest/vtc.h
-index 2e5d4161a..b765fe60a 100644
---- a/bin/varnishtest/vtc.h
-+++ b/bin/varnishtest/vtc.h
-@@ -148,7 +148,7 @@ struct http;
- void cmd_stream(CMD_ARGS);
- void start_h2(struct http *hp);
- void stop_h2(struct http *hp);
--void b64_settings(const struct http *hp, const char *s);
-+void b64_settings(struct http *hp, const char *s);
- 
- /* vtc_gzip.c */
- void vtc_gunzip(struct http *, char *, long *);
-diff --git a/bin/varnishtest/vtc_http.h b/bin/varnishtest/vtc_http.h
-index 7a86de8da..62c598a55 100644
---- a/bin/varnishtest/vtc_http.h
-+++ b/bin/varnishtest/vtc_http.h
-@@ -83,6 +83,7 @@ struct http {
- 	/* H/2 */
- 	unsigned		h2;
- 	int			wf;
-+	int			no_rfc7540_priorities;
- 
- 	pthread_t		tp;
- 	VTAILQ_HEAD(, stream)   streams;
-diff --git a/bin/varnishtest/vtc_http2.c b/bin/varnishtest/vtc_http2.c
-index 822abbae1..7feeb42b0 100644
---- a/bin/varnishtest/vtc_http2.c
-+++ b/bin/varnishtest/vtc_http2.c
-@@ -629,7 +629,7 @@ parse_settings(const struct stream *s, struct frame *f)
- 			buf = "unknown";
- 		u += 4;
- 
--		if (t == 1) {
-+		if (t == SETTINGS_HEADER_TABLE_SIZE) {
- 			r = HPK_ResizeTbl(s->hp->encctx, v);
- 			assert(r == hpk_done);
- 		}
-@@ -2460,28 +2460,47 @@ cmd_rxsettings(CMD_ARGS)
- 		hp->h2_win_peer->init = val;
- 	}
- }
-+/* SECTION: stream.spec.prio_rxprio rxprio
-+ *
-+ * Receive a PRIORITY frame.
-+ */
-+static void
-+cmd_rxprio (CMD_ARGS)
-+{
-+	struct stream *s;
-+	(void)av;
-+	CAST_OBJ_NOTNULL(s, priv, STREAM_MAGIC);
-+        if (s->hp->no_rfc7540_priorities) {
-+		vtc_log(vl, 4, "skipping rxprio: no_rfc7540_priorities is set");
-+		return;
-+	}
-+	s->frame = rxstuff(s);
-+	if (s->frame != NULL && s->frame->type != TYPE_PRIORITY) {
-+		vtc_fatal(vl,
-+		    "Wrong frame type %s (%d) wanted %s",
-+		    s->frame->type < TYPE_MAX ?
-+		    h2_types[s->frame->type] : "?",
-+		    s->frame->type, "PRIORITY");
-+	}
-+}
- 
- #define RXFUNC(lctype, upctype) \
- 	static void \
--	cmd_rx ## lctype(CMD_ARGS) { \
-+	cmd_rx ## lctype(CMD_ARGS) \
-+	{ \
- 		struct stream *s; \
- 		(void)av; \
- 		CAST_OBJ_NOTNULL(s, priv, STREAM_MAGIC); \
- 		s->frame = rxstuff(s); \
--		if (s->frame != NULL && s->frame->type != TYPE_ ## upctype) \
-+		if (s->frame != NULL && s->frame->type != TYPE_ ## upctype) { \
- 			vtc_fatal(vl, \
- 			    "Wrong frame type %s (%d) wanted %s", \
- 			    s->frame->type < TYPE_MAX ? \
- 			    h2_types[s->frame->type] : "?", \
- 			    s->frame->type, #upctype); \
-+		} \
- 	}
- 
--/* SECTION: stream.spec.prio_rxprio rxprio
-- *
-- * Receive a PRIORITY frame.
-- */
--RXFUNC(prio,	PRIORITY)
--
- /* SECTION: stream.spec.reset_rxrst rxrst
-  *
-  * Receive a RST_STREAM frame.
-@@ -2857,7 +2876,7 @@ cmd_stream(CMD_ARGS)
- }
- 
- void
--b64_settings(const struct http *hp, const char *s)
-+b64_settings(struct http *hp, const char *s)
- {
- 	uint16_t i;
- 	uint64_t v, vv;
-@@ -2891,7 +2910,10 @@ b64_settings(const struct http *hp, const char *s)
- 		else
- 			buf = "unknown";
- 
--		if (v == 1) {
-+		if (i == SETTINGS_NO_RFC7540_PRIORITIES) {
-+			hp->no_rfc7540_priorities = v;
-+		}
-+		if (i == SETTINGS_HEADER_TABLE_SIZE) {
- 			enum hpk_result hrs;
- 			if (hp->sfd) {
- 				AN(hp->encctx);
-diff --git a/include/tbl/h2_settings.h b/include/tbl/h2_settings.h
-index 2dbac671f..273f157fe 100644
---- a/include/tbl/h2_settings.h
-+++ b/include/tbl/h2_settings.h
-@@ -102,7 +102,39 @@ H2_SETTING(					// rfc7540,l,2159,2167
- 	0xffffffff,
- 	0
- )
--#endif
-+
-+H2_SETTING(					// rfc8441
-+	ENABLE_CONNECT_PROTOCOL,
-+	enable_connect_protocol,
-+	0x8,
-+	0,
-+	0,
-+	1,
-+	H2CE_PROTOCOL_ERROR
-+)
-+
-+H2_SETTING(					// rfc9218
-+	NO_RFC7540_PRIORITIES,
-+	no_rfc7540_priorities,
-+	0x9,
-+	0,
-+	0,
-+	1,
-+	H2CE_PROTOCOL_ERROR
-+)
-+
-+H2_SETTING(					// [MS-HTTP2E]
-+						// [Gabriel_Montenegro]
-+	TLS_RENEG_PERMITTED,
-+	tls_reneg_permitted,
-+	0x10,
-+	0,
-+	0,
-+	3,
-+	H2CE_PROTOCOL_ERROR
-+)
-+#endif /* !H2_SETTINGS_PARAM_ONLY */
-+
- #undef H2_SETTING
- 
- /*lint -restore */

varnish-9.0.1_openssl_4.0_asn1.patch

@@ -1,38 +0,0 @@
-Author: Ingvar Hagelund <ingvar@redpill-linpro.com>
-Date:   Wed Apr 15 00:17:59 2026 +0200
-
-    Use ASN1_STRING functions for openssl-4.0.0
-
-diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c
---- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-08 18:57:33.000000000 +0200
-+++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-15 00:34:44.788211992 +0200
-@@ -142,10 +142,10 @@
- 	char *a;
- 	int n, i, l, o;
- 
--	if (d->type != V_ASN1_GENERALIZEDTIME)
-+	if (ASN1_STRING_type(d) != V_ASN1_GENERALIZEDTIME)
- 		return (0);
--	l = d->length;
--	a = (char *)d->data;
-+	l = ASN1_STRING_length(d);
-+	a = (char *)ASN1_STRING_get0_data(d);
- 	o = 0;
- 	/*
- 	 * GENERALIZEDTIME is similar to UTCTIME except the year is represented
-diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c
---- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-08 18:57:33.000000000 +0200
-+++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-15 00:35:53.447792774 +0200
-@@ -1060,10 +1060,10 @@
- 
- 			break;
- 		case GEN_IPADD:
--			p = n->d.ip->data;
-+			p = ASN1_STRING_get0_data(n->d.ip);
- 			AN(p);
- 
--			if (inet_ntop(n->d.ip->length == 16 ? AF_INET6 : AF_INET,
-+			if (inet_ntop(ASN1_STRING_length(n->d.ip) == 16 ? AF_INET6 : AF_INET,
- 			    p, b, INET6_ADDRSTRLEN) == 0)
- 				continue;
- 

varnish.spec

@@ -2,26 +2,31 @@
 # https://github.com/varnishcache/varnish-cache/issues/2269
 %global debug_package %{nil}
 
+%if 0%{?rhel} == 7
+%global _use_internal_dependency_generator 0
+%global __find_provides %{_builddir}/%{name}-%{version}/find-provides %__find_provides
+%global __python /usr/bin/python3.4
+%else
+%global __python %{__python3}
+%endif
+
 %global __provides_exclude_from ^%{_libdir}/varnish/vmods
 
-%global abi 0a625649cd40af4b6c10be5e58a2e89a5e275baa
-%global vrt 23.1
+%global abi eef25264e5ca5f96a77129308edb83ccf84cb1b1
+%global vrt 19.0
 
 # Package scripts are now external
 # https://github.com/varnishcache/pkg-varnish-cache
-%global commit1 1f0d212dc45065f38bd80ac57fe22773a20a0595
+%global commit1 cfa8cb3724e4ca6398f60b09157715bcb99d189d
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
 # Default: Use jemalloc, as adviced by upstream project
 # Change to 1 to use system allocator (ie. glibc)
-#
-# for rhel >= 10, use bundled jemalloc
-# for rhel < 10, use system allocator
-%bcond system_allocator %[0%{?rhel} && 0%{?rhel} < 10]
-%bcond bundled_jemalloc %[0%{?rhel} >= 10]
-
-%define jemalloc_version 5.3.0
-%define jemalloc_prefix varnish_
+%if 0%{?rhel}
+%bcond_without system_allocator
+%else
+%bcond_with system_allocator
+%endif
 
 %if %{with system_allocator}
 # use _lto_cflags if present
@@ -31,26 +36,21 @@
 
 Summary: High-performance HTTP accelerator
 Name: varnish
-Version: 9.0.3
-Release: 3%{?dist}
+Version: 7.5.0
+Release: 4%{?dist}
 License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
-Source0: https://github.com/varnish/varnish/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
+Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
 Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
-Source2: varnish.sysusers
-Source3: https://github.com/jemalloc/jemalloc/releases/download/%{jemalloc_version}/jemalloc-%{jemalloc_version}.tar.bz2
-Source4: varnish.tmpfiles
 
-# Compatibility with openssl-4.0.0
-# https://github.com/varnish/varnish/issues/32
-Patch1:   varnish-9.0.1_openssl_4.0_asn1.patch
+# CVE-2025-30346, patch from upstream
+Patch1: VSV00015.patch
 
-%if %{with bundled_jemalloc}
-# bundled jemalloc patch
-Patch100: jemalloc-5.3.0_fno-builtin.patch
-Patch101: jemalloc-5.3.0-aarch64-ts-segfault.patch
-%endif
+# CVE-2025-47905, patches from upstream
+Patch2:   VSV00016.patch
+Patch3:   VSV00016.test.patch
 
+%if 0%{?fedora} > 29 || 0%{?rhel} > 7
 Provides: varnish%{_isa} = %{version}-%{release}
 Provides: varnishd(abi)%{_isa} = %{abi}
 Provides: varnishd(vrt)%{_isa} = %{vrt}
@@ -65,18 +65,15 @@ Provides: vmod(purge)%{_isa} = %{version}-%{release}
 Provides: vmod(std)%{_isa} = %{version}-%{release}
 Provides: vmod(unix)%{_isa} = %{version}-%{release}
 Provides: vmod(vtc)%{_isa} = %{version}-%{release}
-
-%if %{with bundled_jemalloc}
-Provides: bundled(jemalloc)
 %endif
 
-BuildRequires: systemd-rpm-macros
-%{?systemd_requires}
-%{?sysusers_requires_compat}
 
+%if 0%{?rhel} == 7
+BuildRequires: python34 python34-sphinx python34-docutils
+%else
 BuildRequires: python3, python3-sphinx, python3-docutils
+%endif
 BuildRequires: gcc
-%if %{without bundled_jemalloc}
 %if %{with system_allocator}
 # use glibc
 %else
@@ -84,23 +81,17 @@ BuildRequires: gcc
 BuildRequires: jemalloc-devel
 %endif
 %endif
-%endif
 
 BuildRequires: libedit-devel
 BuildRequires: make
 BuildRequires: ncurses-devel
 BuildRequires: pcre2-devel
 BuildRequires: pkgconfig
-BuildRequires: openssl-devel
-
-%if %{with bundled_jemalloc}
-BuildRequires:  /usr/bin/xsltproc
-BuildRequires:  perl-generators
-%endif
+BuildRequires: systemd-units
 
 # Extra requirements for the build suite
 #   needs haproxy2
-%if 0%{?fedora} > 30
+%if 0%{?fedora} > 30 || 0%{?rhel} > 8
 BuildRequires: haproxy
 %endif
 BuildRequires: nghttp2
@@ -112,15 +103,17 @@ Requires: logrotate
 Requires: ncurses
 Requires: pcre2
 Requires: redhat-rpm-config
+Requires(pre): shadow-utils
 Requires(post): /usr/bin/uuidgen
-
+Requires(post): systemd-units
+Requires(post): systemd-sysv
+Requires(preun): systemd-units
+Requires(postun): systemd-units
 %if %{with system_allocator}
 # use glibc
 %else
-%if %{without bundled_jemalloc}
 Requires: jemalloc
 %endif
-%endif
 
 %description
 This is Varnish Cache, a high-performance HTTP accelerator.
@@ -154,63 +147,17 @@ Documentation files for %name
 
 %prep
 %setup -q
-%if 0%{?fedora} > 44 || 0%{?rhel} > 10
 %patch 1 -p1
-%endif
+%patch 2 -p0
+%patch 3 -p1
+
 tar xzf %SOURCE1
 ln -s pkg-varnish-cache-%{commit1}/redhat redhat
 ln -s pkg-varnish-cache-%{commit1}/debian debian
 cp redhat/find-provides .
 sed -i 's,rst2man-3.6,rst2man-3.4,g; s,rst2html-3.6,rst2html-3.4,g; s,phinx-build-3.6,phinx-build-3.4,g' configure
 
-# jemalloc
-%if %{with bundled_jemalloc}
-tar xjf %SOURCE3
-sed -i '/^LIBPREFIX/s/@libprefix@/@libprefix@%{jemalloc_prefix}/' jemalloc*/Makefile.in
-pushd jemalloc*
-%patch 100 -p1 -b .jemalloc
-%patch 101 -p1 -b .ts-segfault
-popd
-
-# Override PAGESIZE, bz #1545539
-%ifarch %ix86 %arm x86_64 s390x riscv64
-%define lg_page --with-lg-page=12
-%endif
-
-%ifarch ppc64 ppc64le aarch64
-%define lg_page --with-lg-page=16
-%endif
-
-# Disable thp on systems not supporting this for now
-%ifarch %ix86 %arm aarch64 s390x
-%define disable_thp --disable-thp
-%endif
-%endif
-
 %build
-%if %{with bundled_jemalloc}
-# build bundled jemalloc first
-pushd jemalloc*
-
-echo "For debugging package builders"
-echo "What is the pagesize?"
-getconf PAGESIZE
-
-echo "What mm features are available?"
-ls /sys/kernel/mm
-ls /sys/kernel/mm/transparent_hugepage || true
-cat /sys/kernel/mm/transparent_hugepage/enabled || true
-
-echo "What kernel version and config is this?"
-uname -a
-
-%configure %{?disable_thp} %{?lg_page} --enable-prof
-make %{?_smp_mflags}
-popd
-%endif
-
-
-# varnish
 %if %{with system_allocator}
 export CFLAGS="%{optflags}"
 %else
@@ -226,14 +173,6 @@ export CFLAGS="$CFLAGS -ffloat-store -fexcess-precision=standard"
 %endif
 %endif
 
-%if 0%{?fedora} > 41 || 0%{?rhel} > 10
-export CFLAGS="$CFLAGS -std=gnu17"
-%endif
-
-%if 0%{?fedora} > 42 || 0%{?rhel} > 10
-export CFLAGS="$CFLAGS -Wno-error=discarded-qualifiers"
-%endif
-
 %ifarch s390x
 export CFLAGS="$CFLAGS -Wno-error=free-nonheap-object"
 %endif
@@ -250,15 +189,7 @@ getconf PAGESIZE
 # Man pages are prebuilt. No need to regenerate them.
 export RST2MAN=/bin/true
 # Explicit python, please
-export PYTHON=python3
-
-for f in configure configure.ac; do
-  sed -i 's|ljemalloc|l%{jemalloc_prefix}jemalloc|g' $f
-done
-
-%if %{with bundled_jemalloc}
-export LDFLAGS="$LDFLAGS -L%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib"
-%endif
+export PYTHON=%{__python}
 
 %configure LT_SYS_LIBRARY_PATH=%_libdir \
  --disable-static \
@@ -270,14 +201,10 @@ export LDFLAGS="$LDFLAGS -L%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_v
   --enable-pcre2-jit=no \
 %endif
 %endif
-%if %{with system_allocator} || %{without bundled_jemalloc}
+%if %{with system_allocator}
   --with-jemalloc=no \
 %endif
 
-%if %{with bundled_jemalloc}
-export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib
-%endif
-
 %make_build
 
 # One varnish user is enough
@@ -287,38 +214,16 @@ sed -i 's,User=varnishlog,User=varnish,g;' redhat/varnishncsa.service
 rm -rf doc/html/_sources
 
 %check
-# check jemalloc first
-%if %{with bundled_jemalloc}
-pushd jemalloc*
-make %{?_smp_mflags} check
-popd
-%endif
 
 # Up the stack size in tests, necessary on secondary arches
-sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/vinyltest/tests/*.vtc
-sed -i 's/file,2M/file,8M/' bin/vinyltest/tests/r04036.vtc
-%ifarch %ix86
-sed -i 's/param.set workspace_thread 0.55k/param.set workspace_thread 0.5k/' bin/vinyltest/tests/b00081.vtc
-%endif
-
-# This is a bug in varnishtest making it incompatible with nghttp2 >= 1.65
-#if 0#{?fedora} > 41 || 0#{?rhel} > 10
-#rm bin/varnishtest/tests/a02022.vtc
-#endif
-
-%if %{with bundled_jemalloc}
-export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib
-%endif
-
-# This runs fine in the emulator, but not on Red Hat's builders
-# Upstream is looking at it, upstream issue #36
-%ifarch s390x
-rm bin/vinyltest/tests/t02033.vtc
-%endif
+sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/varnishtest/tests/*.vtc
+sed -i 's/file,2M/file,8M/' bin/varnishtest/tests/r04036.vtc
 
 # Just a hack to avoid too high load on secondary arch builders
-%ifarch s390x ppc64le %ix86
-make check
+%ifarch s390x ppc64le
+# This works when ran alone, but not in the whole suite. Load and/or timing issues
+rm bin/varnishtest/tests/t02014.vtc
+make -j2 check
 %else
 %make_build check
 %endif
@@ -326,16 +231,9 @@ make check
 %install
 rm -rf %{buildroot}
 
-# jemalloc
-%if %{with bundled_jemalloc}
-pushd jemalloc*
-make DESTDIR=%{buildroot} install_lib %{?_smp_mflags}
-
-find %{buildroot}%{_libdir}/ -name '*.a' -exec rm -vf {} ';'
-
-# we don't need .pc file
-rm  %{buildroot}%{_libdir}/pkgconfig/jemalloc.pc
-popd
+# mock el7 defaults to LANG=C, which makes python3 fail when parsing utf8 text
+%if 0%{?rhel} == 7
+export LANG=en_US.UTF-8
 %endif
 
 %{make_install}
@@ -356,11 +254,6 @@ mkdir -p %{buildroot}%{_unitdir}
 install -D -m 0644 redhat/varnish.service %{buildroot}%{_unitdir}/varnish.service
 install -D -m 0644 redhat/varnishncsa.service %{buildroot}%{_unitdir}/varnishncsa.service
 install -D -m 0755 redhat/varnishreload %{buildroot}%{_sbindir}/varnishreload
-install -p -D -m 0644 %{SOURCE2} %{buildroot}%{_sysusersdir}/varnish.conf
-
-# tmpfiles.d configuration
-mkdir -p %{buildroot}%{_tmpfilesdir}
-install -m 644 -p %{SOURCE4} %{buildroot}%{_tmpfilesdir}/varnish.conf
 
 echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
@@ -370,13 +263,8 @@ chmod 644 lib/libvmod_*/*.c
 chmod 644 lib/libvmod_*/*.h
 %endif
 
-%pre
-%sysusers_create_compat %{SOURCE2}
-
 %files
-%if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/*
-%endif
 %{_bindir}/*
 %{_libdir}/*.so.*
 %{_libdir}/%{name}
@@ -386,21 +274,20 @@ chmod 644 lib/libvmod_*/*.h
 %{_mandir}/man3/*.3*
 %{_mandir}/man7/*.7*
 %license LICENSE
-%doc README.md ChangeLog
+%doc README.rst ChangeLog
 %doc etc/builtin.vcl etc/example.vcl
 %dir %{_sysconfdir}/varnish/
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
 %config(noreplace) %{_sysconfdir}/logrotate.d/varnish
 %config %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
+
 %{_unitdir}/varnish.service
 %{_unitdir}/varnishncsa.service
-%{_sysusersdir}/varnish.conf
-%{_tmpfilesdir}/varnish.conf
 
 %files devel
 %license LICENSE
-%doc README.md
+%doc README.rst
 %{_libdir}/lib*.so
 %{_includedir}/%{name}
 %{_libdir}/pkgconfig/varnishapi.pc
@@ -412,6 +299,16 @@ chmod 644 lib/libvmod_*/*.h
 %doc doc/html
 %doc doc/changes*.html
 
+
+%pre
+getent group varnish >/dev/null ||
+groupadd -r varnish
+getent passwd varnish >/dev/null ||
+useradd -r -g varnish -d /var/lib/varnish -s /sbin/nologin \
+	-c "Varnish Cache" varnish
+exit 0
+
+
 %post
 %systemd_post varnish varnishncsa
 /sbin/ldconfig
@@ -427,74 +324,11 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+* Thu Jul 31 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.5.0-4
+- Security: Added patch for VSV00016 AKA CVE-2025-47905
 
-* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 9.0.3-2
-- Rebuilt for openssl 4.0
-
-* Thu May 21 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.3-1
-- New upstream release: A security relase
-- Includes fix for VSV00019 aka CVE-2026-50052
-
-* Fri May 15 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.2-1
-- New upstream release: A bugfix release
-
-* Fri Apr 10 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.1-1
-- New upstream release
-- Add patch for openssl-4.0.0 in rawhide
-- Includes fix for VEV00002
-
-* Fri Mar 27 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.0-1
-- New upstream release
-- Includes fix for VSV00018
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 8.0.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Thu Dec 11 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 8.0.0-1
-- New upstream release
-- New pkg-varnish-cache checkout
-- Added cflag -Wno-error=discarded-qualifiers to build on fedora while waiting for upstream
-
-* Wed Oct 29 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.3-2
-- Add tmpfiles.d rules for /var directories (bootc compatibility)
-
-* Mon Sep 15 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.3-1
-- New upstream release: A security release
-- Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
-
-* Thu Jul 31 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.1-4
-- bundle jemalloc in RHEL
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.7.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu May 22 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.1-2
-- Correct ABI and VRT versions
-- Pulled el7 support
-- Use systemd setup for users
-
-* Tue May 20 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.1-1
-- new version 7.7.1
-
-* Thu Mar 27 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-2
-- Fix for eln build (merged from yselkowitz)
-- Fix for failing h2 switch check. Enabling full test suite again
-
-* Mon Mar 24 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-1
-- New upstream release
-- fedora now has completed the bin/sbin merge
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.6.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Mon Dec 02 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.1-1
-- New upstream release
-
-* Mon Sep 16 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.0-1
-- New upstream release
-- Updated checkout of pkg-varnish
+* Tue Mar 25 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.5.0-3
+- Security: Added patch for VSV00015 aka CVE-2025-30346
 
 * Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.5.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

varnish.sysusers

@@ -1,3 +0,0 @@
-#Type Name     ID             GECOS                 Home directory Shell
-g varnish -
-u varnish - "Varnish Cache" /var/lib/varnish /sbin/nologin

varnish.tmpfiles

@@ -1,2 +0,0 @@
-d /var/lib/varnish  755 root root -
-d /var/log/varnish  700 varnish varnish -