Merge version 8.1.6+ds-1~deb10u1+rpi1 and 8.1.7-0+deb10u1 to produce 8.1.7-0+deb10u1+rpi1

Merge trafficserver (8.1.7-0+deb10u1) import into refs/heads/workingbranch

Fix test for python 3.8

Reviewed-by: Jean Baptiste Favre <jbfavre@debian.org>
Last-Update: 2020-02-03

Last-Update: 2020-02-03
Gbp-Pq: Name 0016-fix_python_3.8.patch

Update compilation chain after embedded libyamlcpp removal

Origin: other
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-30

Last-Update: 2019-01-30
Gbp-Pq: Name 0014-use_system_yaml-cpp.patch

Fix Perl interpreter path

Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0013-fix-perl-interpreter-path.patch

Fix various speeling issues

Forwarded: https://github.com/apache/trafficserver/pull/4750
Applied-Upstream: https://github.com/apache/trafficserver/commit/af0ad4a1880a21743e98331855bb78e15d5406ef
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0012-fix-spelling-checks.patch

Fix Segmentation fault in ShowCache::handleCacheEvent

Origin: upstream
Bug: https://github.com/apache/trafficserver/issues/4328
Applied-Upstream: https://github.com/apache/trafficserver/commit/616eb10bfc35599a2c93ff30879d584a05ddf83e
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-17

Last-Update: 2018-10-17
Gbp-Pq: Name 0011-fix-segfault.patch

Fix build issue with MySQL 8

Origin: other, https://bugs.launchpad.net/ubuntu/+source/trafficserver/+bug/1795362
Forwarded: https://github.com/apache/trafficserver/pull/4360
Applied-Upstream: https://github.com/apache/trafficserver/commit/05b30527974416768515506f69da338652c23260
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-06

The my_bool type is no longer used in MySQL source code.
Any third-party code that used this type to represent C
boolean variables should use the bool or int C type instead.
Last-Update: 2018-10-06
Gbp-Pq: Name 0009-fix-mysql-8-build.patch

Force python3 usage, add libfakeroot-sysv to blacklist

Origin: other
Last-Update: 2018-09-24

Last-Update: 2018-09-24
Gbp-Pq: Name 0008-fix-python-check-unused-dependencies.patch

Make documentation build works outside of git repository

Origin: other
Last-Update: 2019-01-03

Current documentation build requires git and curl to get some stuff from the internet
This patch aims to delete those dependencies, forcing git branch to master,
and using Debian provided plantuml instead of downloading it from apache mirror
Last-Update: 2019-01-03
Gbp-Pq: Name 0006-fix-doc-build.patch

make the build reproducible

Origin: other, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833176
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2016-11-18

Last-Update: 2016-11-18
Gbp-Pq: Name 0003-reproductible-build.patch

Use -mcx16 on x86 platforms only

Gbp-Pq: Name 0001-Use-mcx16-on-x86-platforms-only.patch

trafficserver (8.1.7-0+deb10u1) buster-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * New upstream release.
    - CVE-2022-47184: The TRACE method can be used to disclose
      network information.
    - CVE-2023-30631: Configuration option to block the PUSH method
      in ATS didn't work.
    - CVE-2023-33933: s3_auth plugin problem with hash calculation.

[dgit import unpatched trafficserver 8.1.7-0+deb10u1]

Import trafficserver_8.1.7.orig.tar.xz

[dgit import orig trafficserver_8.1.7.orig.tar.xz]

Import trafficserver_8.1.7-0+deb10u1.debian.tar.xz

[dgit import tarball trafficserver 8.1.7-0+deb10u1 trafficserver_8.1.7-0+deb10u1.debian.tar.xz]

Merge version 8.0.2+ds-1+rpi1+deb10u7 and 8.1.6+ds-1~deb10u1 to produce 8.1.6+ds-1~deb10u1+rpi1

Merge trafficserver (8.1.6+ds-1~deb10u1) import into refs/heads/workingbranch

Fix test for python 3.8

Reviewed-by: Jean Baptiste Favre <jbfavre@debian.org>
Last-Update: 2020-02-03

Last-Update: 2020-02-03
Gbp-Pq: Name 0016-fix_python_3.8.patch

Update compilation chain after embedded libyamlcpp removal

Origin: other
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-30

Last-Update: 2019-01-30
Gbp-Pq: Name 0014-use_system_yaml-cpp.patch

Fix Perl interpreter path

Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0013-fix-perl-interpreter-path.patch

Fix various speeling issues

Forwarded: https://github.com/apache/trafficserver/pull/4750
Applied-Upstream: https://github.com/apache/trafficserver/commit/af0ad4a1880a21743e98331855bb78e15d5406ef
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0012-fix-spelling-checks.patch

Fix Segmentation fault in ShowCache::handleCacheEvent

Origin: upstream
Bug: https://github.com/apache/trafficserver/issues/4328
Applied-Upstream: https://github.com/apache/trafficserver/commit/616eb10bfc35599a2c93ff30879d584a05ddf83e
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-17

Last-Update: 2018-10-17
Gbp-Pq: Name 0011-fix-segfault.patch

Fix build issue with MySQL 8

Origin: other, https://bugs.launchpad.net/ubuntu/+source/trafficserver/+bug/1795362
Forwarded: https://github.com/apache/trafficserver/pull/4360
Applied-Upstream: https://github.com/apache/trafficserver/commit/05b30527974416768515506f69da338652c23260
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-06

The my_bool type is no longer used in MySQL source code.
Any third-party code that used this type to represent C
boolean variables should use the bool or int C type instead.
Last-Update: 2018-10-06
Gbp-Pq: Name 0009-fix-mysql-8-build.patch

Force python3 usage, add libfakeroot-sysv to blacklist

Origin: other
Last-Update: 2018-09-24

Last-Update: 2018-09-24
Gbp-Pq: Name 0008-fix-python-check-unused-dependencies.patch

Make documentation build works outside of git repository

Origin: other
Last-Update: 2019-01-03

Current documentation build requires git and curl to get some stuff from the internet
This patch aims to delete those dependencies, forcing git branch to master,
and using Debian provided plantuml instead of downloading it from apache mirror
Last-Update: 2019-01-03
Gbp-Pq: Name 0006-fix-doc-build.patch

make the build reproducible

Origin: other, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833176
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2016-11-18

Last-Update: 2016-11-18
Gbp-Pq: Name 0003-reproductible-build.patch

Use -mcx16 on x86 platforms only

Gbp-Pq: Name 0001-Use-mcx16-on-x86-platforms-only.patch

trafficserver (8.1.6+ds-1~deb10u1) buster-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Backport upstream version 8.1.6 to Buster.
  * Fix CVE-2022-31778, CVE-2022-31779, CVE-2022-32749, CVE-2022-37392.
    Several vulnerabilities were discovered in Apache Traffic Server, a reverse
    and forward proxy server, which could result in HTTP request smuggling,
    cache poisoning or information disclosure.

[dgit import unpatched trafficserver 8.1.6+ds-1~deb10u1]

Import trafficserver_8.1.6+ds-1~deb10u1.debian.tar.xz

[dgit import tarball trafficserver 8.1.6+ds-1~deb10u1 trafficserver_8.1.6+ds-1~deb10u1.debian.tar.xz]

Merge version 8.0.2+ds-1+rpi1+deb10u6 and 8.0.2+ds-1+deb10u7 to produce 8.0.2+ds-1+rpi1+deb10u7

Merge trafficserver (8.1.6+ds-1~deb11u1) import into refs/heads/workingbranch

Import trafficserver_8.1.6+ds.orig.tar.xz

[dgit import orig trafficserver_8.1.6+ds.orig.tar.xz]

Fix test for python 3.8

Reviewed-by: Jean Baptiste Favre <jbfavre@debian.org>
Last-Update: 2020-02-03

Last-Update: 2020-02-03
Gbp-Pq: Name 0016-fix_python_3.8.patch

Update compilation chain after embedded libyamlcpp removal

Origin: other
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-30

Last-Update: 2019-01-30
Gbp-Pq: Name 0014-use_system_yaml-cpp.patch

Fix Perl interpreter path

Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0013-fix-perl-interpreter-path.patch

Fix various speeling issues

Forwarded: https://github.com/apache/trafficserver/pull/4750
Applied-Upstream: https://github.com/apache/trafficserver/commit/af0ad4a1880a21743e98331855bb78e15d5406ef
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0012-fix-spelling-checks.patch

Fix Segmentation fault in ShowCache::handleCacheEvent

Origin: upstream
Bug: https://github.com/apache/trafficserver/issues/4328
Applied-Upstream: https://github.com/apache/trafficserver/commit/616eb10bfc35599a2c93ff30879d584a05ddf83e
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-17

Last-Update: 2018-10-17
Gbp-Pq: Name 0011-fix-segfault.patch

Fix build issue with MySQL 8

Origin: other, https://bugs.launchpad.net/ubuntu/+source/trafficserver/+bug/1795362
Forwarded: https://github.com/apache/trafficserver/pull/4360
Applied-Upstream: https://github.com/apache/trafficserver/commit/05b30527974416768515506f69da338652c23260
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-06

The my_bool type is no longer used in MySQL source code.
Any third-party code that used this type to represent C
boolean variables should use the bool or int C type instead.
Last-Update: 2018-10-06
Gbp-Pq: Name 0009-fix-mysql-8-build.patch

Force python3 usage, add libfakeroot-sysv to blacklist

Origin: other
Last-Update: 2018-09-24

Last-Update: 2018-09-24
Gbp-Pq: Name 0008-fix-python-check-unused-dependencies.patch

Make documentation build works outside of git repository

Origin: other
Last-Update: 2019-01-03

Current documentation build requires git and curl to get some stuff from the internet
This patch aims to delete those dependencies, forcing git branch to master,
and using Debian provided plantuml instead of downloading it from apache mirror
Last-Update: 2019-01-03
Gbp-Pq: Name 0006-fix-doc-build.patch

make the build reproducible

Origin: other, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833176
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2016-11-18

Last-Update: 2016-11-18
Gbp-Pq: Name 0003-reproductible-build.patch

Use -mcx16 on x86 platforms only

Gbp-Pq: Name 0001-Use-mcx16-on-x86-platforms-only.patch

trafficserver (8.1.6+ds-1~deb11u1) bullseye-security; urgency=high

  * Update d/u/signing-key for 8.1.x serie
  * New upstream version 8.1.6+ds
  * Multiple CVE fixes for 8.1.x
    + CVE-2022-32749: Improper Check for Unusual or Exceptional Conditions vulnerability
    + CVE-2022-37392: Improper Check for Unusual or Exceptional Conditions vulnerability

[dgit import unpatched trafficserver 8.1.6+ds-1~deb11u1]

Import trafficserver_8.1.6+ds-1~deb11u1.debian.tar.xz

[dgit import tarball trafficserver 8.1.6+ds-1~deb11u1 trafficserver_8.1.6+ds-1~deb11u1.debian.tar.xz]

Merge trafficserver (8.0.2+ds-1+deb10u7) import into refs/heads/workingbranch

[PATCH] Add back validatation that the scheme matches the wire protocol (#9007)

This adds back in the scheme and wire protocol check (see #8465) along
with a configuration to be able to disable the check if the verification
is not desired.

Gbp-Pq: Name CVE-2021-37150.patch

[PATCH] [8.1.x] Backport HTTP Validations (#9015)

Gbp-Pq: Name CVE-2022-25763.patch

Bug fix in origin connection handling

Origin: upstream
Applied-Upstream: https://github.com/apache/trafficserver/commit/d3f36f79820ea10c26573c742b1bbc370c351716
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2022-05-21

Last-Update: 2022-05-21
Gbp-Pq: Name 0021-CVE_2021_44759.patch

Improper Input Validation vulnerability in request line parsing

Origin: upstream
Applied-Upstream: 85c319a7f7c0537bee408ea25df6f1a5ed0a4071, c4e6661a5a205b1f60279f0e66aa496023185967, 8c6f2ed84ba0d8e6255baceb99ee891ebe1ce473
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2022-05-21

Last-Update: 2022-05-21
Gbp-Pq: Name 0021-CVE_2021_44040.patch

CVE-2021-38161

commit feefc5e4abc5011dfad5dcfef3f22998faf6e2d4
Author: Alan M. Carroll <amc@apache.org>
Date:   Wed Oct 27 13:41:47 2021 -0500

    Add some checking to validate the scheme matches the wire protocol. (#8464)

Gbp-Pq: Name 0020-CVE-2021-38161.patch

CVE-2021-37149

commit 2addc8ca71449ceac0d5b80172460ee09c938f5e
Author: Brian Neradt <brian.neradt@gmail.com>
Date:   Wed Oct 27 11:30:07 2021 -0500

    Detect and handle chunk header size truncation (#8458)

    This detects if a chunk header size is too large and, if so, closes the
    connection.

Gbp-Pq: Name 0020-CVE-2021-37149.patch

CVE-2021-37148

commit e2c9ac217f24dc3e91ff2c9f52b52093e8fb32d5
Author: Brian Neradt <brian.neradt@verizonmedia.com>
Date:   Wed Oct 27 11:30:32 2021 -0500

    8.1.x: Reject Transfer-Encoding in pre-HTTP/1.1 requests (#8457)

    Per spec, Transfer-Encoding is only supported in HTTP/1.1. For earlier
    versions, we must reject Transfer-Encoding rather than interpret it
    since downstream proxies may ignore the chunk header and rely upon the
    Content-Length, or interpret the body some other way.  These differences
    in interpretation may open up the door to compatibility issues. To
    protect against this, we reply with a 4xx if the client uses
    Transfer-Encoding with HTTP versions that do not support it.

Gbp-Pq: Name 0020-CVE-2021-37148.patch

CVE-2021-37147

commit 5cad961c87cb07fbb8fa6890685d9878a169378d
Author: Brian Neradt <brian.neradt@gmail.com>
Date:   Wed Oct 27 11:29:43 2021 -0500

    Fix output '\n' HTTP field line endings (#8460)

    This is another attempt to fix what was initially addressed in #8096 but
    got backed out via #8305. That more extensive patch was considered too
    invasive and potentially risky.  This more targeted patch will fix
    clients that only send the \n endings but it will force the \r\n line
    ending on output.

    This was mostly in place except for header lines that get
    m_n_v_raw_printable set, which seems to be most header lines. The
    addition checks to see if the header line ends in \r\n. If it does not
    the m_n_v_raw_printable flag gets cleared and the logic that explicitly
    adds the line endings while be invoked on output.

Gbp-Pq: Name 0020-CVE-2021-37147.patch

[PATCH] Fixes (#7971)

* String the url fragment for outgoing requests (#7966)

Co-authored-by: Susan Hinrichs <shinrich@verizonmedia.com>
(cherry picked from commit 2b13eb33794574e62249997b4ba654d943a10f2d)

* Ensure that the content-length value is only digits (#7964)

Co-authored-by: Susan Hinrichs <shinrich@verizonmedia.com>
(cherry picked from commit 668d0f8668fec1cd350b0ceba3f7f8e4020ae3ca)

* Schedule H2 reenable event only if it's necessary

Co-authored-by: Katsutoshi Ikenoya <kikenoya@yahoo-corp.jp>
* Fix dynamic-stack-buffer-overflow of cachekey plugin (#7945)

* Fix dynamic-stack-buffer-overflow of cachekey plugin

* Check dst_size include null termination

(cherry picked from commit 5a9339d7bc65e1c2d8d2a0fc80bb051daf3cdb0b)

Co-authored-by: Bryan Call <bcall@apache.org>
Co-authored-by: Masakazu Kitajo <maskit@apache.org>
Co-authored-by: Katsutoshi Ikenoya <kikenoya@yahoo-corp.jp>
Co-authored-by: Masaori Koshiba <masaori@apache.org>
Gbp-Pq: Name 0019-CVE-2021-35474_32567_32566_32565_27577.patch

CVE-2020-17509

Origin: backport
Applied-upstream: https://github.com/apache/trafficserver/pull/7359
Last-Update: 2020-06-25

Last-Update: 2020-06-25
Gbp-Pq: Name 0018-CVE-2020-17509.patch

CVE-2020-17508

Origin: backport
Applied-upstream: https://github.com/apache/trafficserver/pull/7358
Last-Update: 2020-12-06

Last-Update: 2020-12-06
Gbp-Pq: Name 0018-CVE-2020-17508.patch

CVE-2020-9494

Origin: backport
Applied-Upstream: https://github.com/apache/trafficserver/pull/6922
Last-Update: 2020-06-25

Last-Update: 2020-06-25
Gbp-Pq: Name 0017-CVE-2020-9494.patch

CVE-2020-9481

===================================================================

Gbp-Pq: Name 0016-CVE-2020-9481.patch

Fix for CVE-2020-1944

Origin: backport
Applied-Upstream: https://github.com/apache/trafficserver/pull/6390
Last-Update: 2020-04-16

Last-Update: 2020-04-16
Gbp-Pq: Name 0016-CVE-2020-1944.patch

Fix for CVE-2019-17565

Origin: backport
Applied-Upstream: https://github.com/apache/trafficserver/pull/6398
Last-Update: 2020-04-16

Last-Update: 2020-04-16
Gbp-Pq: Name 0016-CVE-2019-17565.patch

Fix for CVE-2019-17559

Origin: backport
Applied-Upstream: https://github.com/apache/trafficserver/pull/6389
Last-Update: 2020-04-16

Last-Update: 2020-04-16
Gbp-Pq: Name 0016-CVE-2019-17559.patch

HTTP/2 fix with realloc (CVE-2019-9518)

Origin: backport, https://github.com/apache/trafficserver/pull/5850
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-08-26

Last-Update: 2019-08-26
Gbp-Pq: Name 0015-8.0.5-CVE-backport.patch

HTTP/2 rate limiting

Origin: backport, https://github.com/apache/trafficserver/pull/5822
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-08-26

 Fix for CVE-2019-9512, CVE-2019-9514, CVE-2019-9515, CVE-2019-10079
Last-Update: 2019-08-26
Gbp-Pq: Name 0015-8.0.4-CVE-backport.patch

Update compilation chain after embedded libyamlcpp removal

Origin: other
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-30

Last-Update: 2019-01-30
Gbp-Pq: Name 0014-use_system_yaml-cpp.patch

Fix Perl interpreter path

Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0013-fix-perl-interpreter-path.patch

Fix various speeling issues

Forwarded: https://github.com/apache/trafficserver/pull/4750
Applied-Upstream: https://github.com/apache/trafficserver/commit/af0ad4a1880a21743e98331855bb78e15d5406ef
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0012-fix-spelling-checks.patch

Fix Segmentation fault in ShowCache::handleCacheEvent

Origin: upstream
Bug: https://github.com/apache/trafficserver/issues/4328
Applied-Upstream: https://github.com/apache/trafficserver/commit/616eb10bfc35599a2c93ff30879d584a05ddf83e
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-17

Last-Update: 2018-10-17
Gbp-Pq: Name 0011-fix-segfault.patch

Fix build issue with MySQL 8

Origin: other, https://bugs.launchpad.net/ubuntu/+source/trafficserver/+bug/1795362
Forwarded: https://github.com/apache/trafficserver/pull/4360
Applied-Upstream: https://github.com/apache/trafficserver/commit/05b30527974416768515506f69da338652c23260
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-06

The my_bool type is no longer used in MySQL source code.
Any third-party code that used this type to represent C
boolean variables should use the bool or int C type instead.
Last-Update: 2018-10-06
Gbp-Pq: Name 0009-fix-mysql-8-build.patch

Force python3 usage, add libfakeroot-sysv to blacklist

Origin: other
Last-Update: 2018-09-24

Last-Update: 2018-09-24
Gbp-Pq: Name 0008-fix-python-check-unused-dependencies.patch

Make documentation build works outside of git repository

Origin: other
Last-Update: 2019-01-03

Current documentation build requires git and curl to get some stuff from the internet
This patch aims to delete those dependencies, forcing git branch to master,
and using Debian provided plantuml instead of downloading it from apache mirror
Last-Update: 2019-01-03
Gbp-Pq: Name 0006-fix-doc-build.patch

make the build reproducible

Origin: other, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833176
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2016-11-18

Last-Update: 2016-11-18
Gbp-Pq: Name 0003-reproductible-build.patch

Use -mcx16 on x86 platforms only

Gbp-Pq: Name 0001-Use-mcx16-on-x86-platforms-only.patch

trafficserver (8.0.2+ds-1+deb10u7) buster-security; urgency=medium

  * Non-maintainer upload by the Debian LTS Team.
  * Multiple CVE fixes
    + CVE-2021-37150: Protocol vs scheme mismatch
    + CVE-2022-25763 Improper input validation on HTTP/2 headers
    + CVE-2022-28129  Insufficient Validation of HTTP/1.x Headers
    + CVE-2022-31780 HTTP/2 framing vulnerabilities

[dgit import unpatched trafficserver 8.0.2+ds-1+deb10u7]

Import trafficserver_8.0.2+ds-1+deb10u7.debian.tar.xz

[dgit import tarball trafficserver 8.0.2+ds-1+deb10u7 trafficserver_8.0.2+ds-1+deb10u7.debian.tar.xz]

Merge trafficserver (8.1.5+ds-1~deb11u1) import into refs/heads/workingbranch

Fix test for python 3.8

Reviewed-by: Jean Baptiste Favre <jbfavre@debian.org>
Last-Update: 2020-02-03

Last-Update: 2020-02-03
Gbp-Pq: Name 0016-fix_python_3.8.patch

Update compilation chain after embedded libyamlcpp removal

Origin: other
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-30

Last-Update: 2019-01-30
Gbp-Pq: Name 0014-use_system_yaml-cpp.patch

Fix Perl interpreter path

Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0013-fix-perl-interpreter-path.patch

Fix various speeling issues

Forwarded: https://github.com/apache/trafficserver/pull/4750
Applied-Upstream: https://github.com/apache/trafficserver/commit/af0ad4a1880a21743e98331855bb78e15d5406ef
Last-Update: 2019-01-03

Last-Update: 2019-01-03
Gbp-Pq: Name 0012-fix-spelling-checks.patch

Fix Segmentation fault in ShowCache::handleCacheEvent

Origin: upstream
Bug: https://github.com/apache/trafficserver/issues/4328
Applied-Upstream: https://github.com/apache/trafficserver/commit/616eb10bfc35599a2c93ff30879d584a05ddf83e
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-17

Last-Update: 2018-10-17
Gbp-Pq: Name 0011-fix-segfault.patch

Fix build issue with MySQL 8

Origin: other, https://bugs.launchpad.net/ubuntu/+source/trafficserver/+bug/1795362
Forwarded: https://github.com/apache/trafficserver/pull/4360
Applied-Upstream: https://github.com/apache/trafficserver/commit/05b30527974416768515506f69da338652c23260
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2018-10-06

The my_bool type is no longer used in MySQL source code.
Any third-party code that used this type to represent C
boolean variables should use the bool or int C type instead.
Last-Update: 2018-10-06
Gbp-Pq: Name 0009-fix-mysql-8-build.patch

Force python3 usage, add libfakeroot-sysv to blacklist

Origin: other
Last-Update: 2018-09-24

Last-Update: 2018-09-24
Gbp-Pq: Name 0008-fix-python-check-unused-dependencies.patch

Make documentation build works outside of git repository

Origin: other
Last-Update: 2019-01-03

Current documentation build requires git and curl to get some stuff from the internet
This patch aims to delete those dependencies, forcing git branch to master,
and using Debian provided plantuml instead of downloading it from apache mirror
Last-Update: 2019-01-03
Gbp-Pq: Name 0006-fix-doc-build.patch

make the build reproducible

Origin: other, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833176
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2016-11-18

Last-Update: 2016-11-18
Gbp-Pq: Name 0003-reproductible-build.patch

Use -mcx16 on x86 platforms only

Gbp-Pq: Name 0001-Use-mcx16-on-x86-platforms-only.patch

trafficserver (8.1.5+ds-1~deb11u1) bullseye-security; urgency=high

  * Update d/watch to stick to 8.1.X serie
  * Update upstream gpg keys
  * UPdate d/salsa-ci.yaml
  * New upstream version 8.1.5+ds
  * Patches refresh for 8.1.5
  * Update experimental plugins list
  * Multiple CVE fixes for 8.1.x
    + CVE-2021-37150: Protocol vs scheme mismatch
    + CVE-2022-25763: Improper input validation on HTTP/2 headers
    + CVE-2022-28129: Insufficient Validation of HTTP/1.x Headers
    + CVE-2022-31778: Transfer-Encoding not treated as hop-by-hop
    + CVE-2022-31779: Improper HTTP/2 scheme and method validation
    + CVE-2022-31780: HTTP/2 framing vulnerabilities

[dgit import unpatched trafficserver 8.1.5+ds-1~deb11u1]

Import trafficserver_8.1.5+ds.orig.tar.xz

[dgit import orig trafficserver_8.1.5+ds.orig.tar.xz]

Import trafficserver_8.1.5+ds-1~deb11u1.debian.tar.xz

[dgit import tarball trafficserver 8.1.5+ds-1~deb11u1 trafficserver_8.1.5+ds-1~deb11u1.debian.tar.xz]

Merge version 8.0.2+ds-1+rpi1+deb10u5 and 8.0.2+ds-1+deb10u6 to produce 8.0.2+ds-1+rpi1+deb10u6

Merge trafficserver (8.0.2+ds-1+deb10u6) import into refs/heads/workingbranch

Bug fix in origin connection handling

Origin: upstream
Applied-Upstream: https://github.com/apache/trafficserver/commit/d3f36f79820ea10c26573c742b1bbc370c351716
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2022-05-21

Last-Update: 2022-05-21
Gbp-Pq: Name 0021-CVE_2021_44759.patch

Improper Input Validation vulnerability in request line parsing

Origin: upstream
Applied-Upstream: 85c319a7f7c0537bee408ea25df6f1a5ed0a4071, c4e6661a5a205b1f60279f0e66aa496023185967, 8c6f2ed84ba0d8e6255baceb99ee891ebe1ce473
Reviewed-by: Jean Baptiste Favre <debian@jbfavre.org>
Last-Update: 2022-05-21

Last-Update: 2022-05-21
Gbp-Pq: Name 0021-CVE_2021_44040.patch

CVE-2021-38161

commit feefc5e4abc5011dfad5dcfef3f22998faf6e2d4
Author: Alan M. Carroll <amc@apache.org>
Date:   Wed Oct 27 13:41:47 2021 -0500

    Add some checking to validate the scheme matches the wire protocol. (#8464)

Gbp-Pq: Name 0020-CVE-2021-38161.patch

CVE-2021-37149

commit 2addc8ca71449ceac0d5b80172460ee09c938f5e
Author: Brian Neradt <brian.neradt@gmail.com>
Date:   Wed Oct 27 11:30:07 2021 -0500

    Detect and handle chunk header size truncation (#8458)

    This detects if a chunk header size is too large and, if so, closes the
    connection.

Gbp-Pq: Name 0020-CVE-2021-37149.patch

CVE-2021-37148

commit e2c9ac217f24dc3e91ff2c9f52b52093e8fb32d5
Author: Brian Neradt <brian.neradt@verizonmedia.com>
Date:   Wed Oct 27 11:30:32 2021 -0500

    8.1.x: Reject Transfer-Encoding in pre-HTTP/1.1 requests (#8457)

    Per spec, Transfer-Encoding is only supported in HTTP/1.1. For earlier
    versions, we must reject Transfer-Encoding rather than interpret it
    since downstream proxies may ignore the chunk header and rely upon the
    Content-Length, or interpret the body some other way.  These differences
    in interpretation may open up the door to compatibility issues. To
    protect against this, we reply with a 4xx if the client uses
    Transfer-Encoding with HTTP versions that do not support it.

Gbp-Pq: Name 0020-CVE-2021-37148.patch

CVE-2021-37147

commit 5cad961c87cb07fbb8fa6890685d9878a169378d
Author: Brian Neradt <brian.neradt@gmail.com>
Date:   Wed Oct 27 11:29:43 2021 -0500

    Fix output '\n' HTTP field line endings (#8460)

    This is another attempt to fix what was initially addressed in #8096 but
    got backed out via #8305. That more extensive patch was considered too
    invasive and potentially risky.  This more targeted patch will fix
    clients that only send the \n endings but it will force the \r\n line
    ending on output.

    This was mostly in place except for header lines that get
    m_n_v_raw_printable set, which seems to be most header lines. The
    addition checks to see if the header line ends in \r\n. If it does not
    the m_n_v_raw_printable flag gets cleared and the logic that explicitly
    adds the line endings while be invoked on output.

Gbp-Pq: Name 0020-CVE-2021-37147.patch

[PATCH] Fixes (#7971)

* String the url fragment for outgoing requests (#7966)

Co-authored-by: Susan Hinrichs <shinrich@verizonmedia.com>
(cherry picked from commit 2b13eb33794574e62249997b4ba654d943a10f2d)

* Ensure that the content-length value is only digits (#7964)

Co-authored-by: Susan Hinrichs <shinrich@verizonmedia.com>
(cherry picked from commit 668d0f8668fec1cd350b0ceba3f7f8e4020ae3ca)

* Schedule H2 reenable event only if it's necessary

Co-authored-by: Katsutoshi Ikenoya <kikenoya@yahoo-corp.jp>
* Fix dynamic-stack-buffer-overflow of cachekey plugin (#7945)

* Fix dynamic-stack-buffer-overflow of cachekey plugin

* Check dst_size include null termination

(cherry picked from commit 5a9339d7bc65e1c2d8d2a0fc80bb051daf3cdb0b)

Co-authored-by: Bryan Call <bcall@apache.org>
Co-authored-by: Masakazu Kitajo <maskit@apache.org>
Co-authored-by: Katsutoshi Ikenoya <kikenoya@yahoo-corp.jp>
Co-authored-by: Masaori Koshiba <masaori@apache.org>
Gbp-Pq: Name 0019-CVE-2021-35474_32567_32566_32565_27577.patch

CVE-2020-17509

Origin: backport
Applied-upstream: https://github.com/apache/trafficserver/pull/7359
Last-Update: 2020-06-25

Last-Update: 2020-06-25
Gbp-Pq: Name 0018-CVE-2020-17509.patch

CVE-2020-17508

Origin: backport
Applied-upstream: https://github.com/apache/trafficserver/pull/7358
Last-Update: 2020-12-06

Last-Update: 2020-12-06
Gbp-Pq: Name 0018-CVE-2020-17508.patch

CVE-2020-9494

Origin: backport
Applied-Upstream: https://github.com/apache/trafficserver/pull/6922
Last-Update: 2020-06-25

Last-Update: 2020-06-25
Gbp-Pq: Name 0017-CVE-2020-9494.patch