From 5bb2694408e7a42897e9efe775361579d8864de8 Mon Sep 17 00:00:00 2001
From: squidadm <squidadm@users.noreply.github.com>
Date: Mon, 5 Sep 2022 16:06:48 +1200
Subject: [PATCH] 5.7 (#1133)

---
 ChangeLog                        | 11 +++++++++++
 configure.ac                     |  2 +-
 doc/release-notes/release-5.sgml | 22 ++++++++++++++++++++--
 src/cf.data.pre                  |  2 +-
 src/security/ServerOptions.cc    |  6 ++++--
 src/ssl/support.cc               |  8 ++++----
 6 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f42c6d1089..49174d44b8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+Changes in squid-5.7 (05 Sep 2022):
+
+	- Regression Fix: Typo in manager ACL
+	- Bug 5186: noteDestinationsEnd check failed: transportWait
+	- Bug 5160: Test suite fails with -flto=auto
+	- Bug 3193 pt2: NTLM decoder truncating strings
+	- Bug 5133: OpenSSL 3.0 support
+	- ext_session_acl: fix TDB key lookup
+	- forward_max_tries: Do not count discarded connections
+	- ... and many compile and debugging fixes
+
 Changes in squid-5.6 (06 Jun 2022):
 
 	- Bug 5208: Part 1: Restart kids killed by SIGKILL
diff --git a/configure.ac b/configure.ac
index dcfb59043b..2087a8d9be 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5,7 +5,7 @@
 ## Please see the COPYING and CONTRIBUTORS files for details.
 ##
 
-AC_INIT([Squid Web Proxy],[5.6-VCS],[http://bugs.squid-cache.org/],[squid])
+AC_INIT([Squid Web Proxy],[5.7-VCS],[http://bugs.squid-cache.org/],[squid])
 AC_PREREQ(2.61)
 AC_CONFIG_HEADERS([include/autoconf.h])
 AC_CONFIG_AUX_DIR(cfgaux)
diff --git a/doc/release-notes/release-5.sgml b/doc/release-notes/release-5.sgml
index 2dd410f475..940449fe50 100644
--- a/doc/release-notes/release-5.sgml
+++ b/doc/release-notes/release-5.sgml
@@ -1,6 +1,6 @@
 <!doctype linuxdoc system>
 <article>
-<title>Squid 5.6 release notes</title>
+<title>Squid 5.7 release notes</title>
 <author>Squid Developers</author>
 
 <abstract>
@@ -12,7 +12,7 @@ for Applied Network Research and members of the Web Caching community.
 <toc>
 
 <sect>Notice
-<p>The Squid Team are pleased to announce the release of Squid-5.6.
+<p>The Squid Team are pleased to announce the release of Squid-5.7.
 
 This new release is available for download from <url url="http://www.squid-cache.org/Versions/v5/"> or the
  <url url="http://www.squid-cache.org/Download/http-mirrors.html" name="mirrors">.
@@ -40,6 +40,7 @@ The Squid-5 change history can be <url url="http://www.squid-cache.org/Versions/
 	<item>TrivialDB Support
 	<item>RFC 8586: Loop Detection in Content Delivery Networks
 	<item>Peering support for SSL-Bump
+	<item>OpenSSL 3.0 Support
 </itemize>
 
 Most user-facing changes are reflected in squid.conf (see below).
@@ -151,6 +152,19 @@ Most user-facing changes are reflected in squid.conf (see below).
    yet do TLS-in-TLS.
 
 
+<sect1>OpenSSL 3.0 Support
+<p>Squid-5.7 adds OpenSSL 3.0 support.
+
+<p>This version of Squid does not add any of the new features provided by
+   OpenSSL 3.0. It only contains support for features already supported by prior
+   versions of Squid using new APIs provided by OpenSSL 3.0.
+
+<p>Notably the libssl custom Engine feature has been deprecated by OpenSSL 3.0
+   and new Providers replacement is not supported by this Squid.
+
+<p>OpenSSL 3.0 uses new licensing terms.
+
+
 <sect>Changes to squid.conf since Squid-4
 <p>
 There have been changes to Squid's configuration file since Squid-4.
@@ -287,6 +301,10 @@ This section gives a thorough account of those changes in three categories:
 	<p>Codes <em>rm</em>, <em>&lt;rm</em> and <em>&gt;rm</em> display "-"
 	   instead of the made-up method NONE.
 
+	<tag>ssl_engine</tag>
+	<p>OpenSSL 3.0 deprecates the Engine feature. This directive is
+	   only supported when Squid is built for older OpenSSL versions.
+
 </descrip>
 
 <sect1>Removed directives<label id="removeddirectives">
diff --git a/src/cf.data.pre b/src/cf.data.pre
index 9b744715b3..ee8c7206ce 100644
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -3050,7 +3050,7 @@ DOC_START
 	The OpenSSL engine to use. You will need to set this if you
 	would like to use hardware SSL acceleration for example.
 
-	Not supported in builds with OpenSSL v3 or newer.
+	Not supported in builds with OpenSSL 3.0 or newer.
 DOC_END
 
 NAME: sslproxy_session_ttl
diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc
index 4897692bb3..a5ddb43acb 100644
--- a/src/security/ServerOptions.cc
+++ b/src/security/ServerOptions.cc
@@ -424,11 +424,13 @@ Security::ServerOptions::loadDhParams()
                     case -2: {
                         auto ssl_error = ERR_get_error();
                         debugs(83, DBG_PARSE_NOTE(2), "WARNING: OpenSSL does not support " << type << " parameters check: " << dhParamsFile << ". " << Security::ErrorString(ssl_error));
-                        } break;
+                    }
+                    break;
                     default: {
                         auto ssl_error = ERR_get_error();
                         debugs(83, DBG_IMPORTANT, "ERROR: Failed to verify " << type << " parameters in " << dhParamsFile << ". " << Security::ErrorString(ssl_error));
-                        } break;
+                    }
+                    break;
                     }
                 } else {
                     // TODO: Reduce error reporting code duplication.
diff --git a/src/ssl/support.cc b/src/ssl/support.cc
index 2cfb8b3ba8..40c1e324e3 100644
--- a/src/ssl/support.cc
+++ b/src/ssl/support.cc
@@ -660,9 +660,9 @@ Ssl::Initialize(void)
 
     if (::Config.SSL.ssl_engine) {
 #if OPENSSL_VERSION_MAJOR < 3
-    debugs(83, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Support for ssl_engine is deprecated " <<
-           "in Squids built with OpenSSL v1 (like this Squid). " <<
-           "It is removed in Squids built with OpenSSL v3+.");
+        debugs(83, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Support for ssl_engine is deprecated " <<
+               "in Squids built with OpenSSL 1.x (like this Squid). " <<
+               "It is removed in Squids built with OpenSSL 3.0 or newer.");
 #if !defined(OPENSSL_NO_ENGINE)
         ENGINE_load_builtin_engines();
         ENGINE *e;
@@ -678,7 +678,7 @@ Ssl::Initialize(void)
 #endif
 
 #else /* OPENSSL_VERSION_MAJOR */
-        throw TextException("Cannot use ssl_engine in Squid built with OpenSSL v3+", Here());
+        throw TextException("Cannot use ssl_engine in Squid built with OpenSSL 3.0 or newer", Here());
 #endif
     }
 
-- 
2.47.2