Merge ~ahasenack/ubuntu/+source/squid:disco-squid-merge into ubuntu/+source/squid:debian/sid

[Andreas Hasenack]

Merge from debian's latest squid.

Dropped a good portion of the delta that was pushed to Debian during the squid3->squid4 work from the previous cycle.

Of the 3 added changes, two (d/rules -latomic, and d/NEWS) were submitted to Debian:
- d/rules -latomic: https://salsa.debian.org/squid-team/squid/merge_requests/6
- d/NEWS: https://salsa.debian.org/squid-team/squid/merge_requests/7

The third one is about apparmor which Debian isn't using.

The work to push our apparmor profile upstream still needs to be done, but I left that for another time.

Bileto ticket and related ppa: https://bileto.ubuntu.com/#/ticket/3524

The armhf dep8 always-failed error I believe might be related to the use of lxd on arm, as the other tests run in a VM via ssh. I tried locally on amd64 with lxd and the test passed, though.

[Robie Basak (racb)]

merge-changelogs run, update-maintainer run. A study of "git range-diff" output indicates that the changelog accurately describes the set of changes made. All delta dropped verified now present in Debian.

Review of new changes:

-latomic change looks correct. NEWS rename seems reasonable. AppArmor profile change looks reasonable and verified by jdstrand in the bug.

New changelog version string and target release are correct. There is no merge bug reference to close.

lgtm. Nice job getting the delta down!

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, upload tag pushed and package uploaded. I'll watch over migration.

[Andreas Hasenack (ahasenack)]

I migrated, marking as merged.

diff --git a/debian/NEWS.debian b/debian/NEWS
similarity index 100%
rename from debian/NEWS.debian
rename to debian/NEWS
diff --git a/debian/changelog b/debian/changelog
index 275f795..01aab06 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,47 @@
+squid (4.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - Add disabled by default AppArmor profile.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+  * Drop:
+    - d/rules: enable cdbs parallel build
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix apparmor profile filename
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+      [Fixed in 4.2-1]
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+      [Fixed in 4.2-1]
+  * Added changes:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - d/usr.sbin.squid: fix the apparmor profile (LP: #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 19 Nov 2018 10:51:18 -0200
+
 squid (4.4-1) unstable; urgency=high
 
   * Urgency high due to security fixes
@@ -62,6 +106,85 @@ squid (4.2-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed, 22 Aug 2018 13:57:15 +0200
 
+squid (4.1-1ubuntu3) cosmic; urgency=medium
+
+  * d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+    Thanks to Vitaly Lavrov <[e-mail]>. (LP: #1794553)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 09 Oct 2018 14:00:36 -0300
+
+squid (4.1-1ubuntu2) cosmic; urgency=medium
+
+  * d/usr.sbin.squid: Update apparmor profile to grant read access to squid
+    binary (LP: #1792728)
+
+ -- Simon Deziel <[e-mail]>  Sat, 15 Sep 2018 13:55:32 -0400
+
+squid (4.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merged with Debian unstable (LP: #1780944, LP: #1097032, LP: #16669).
+    Remaining changes:
+    - Use snakeoil certificates.
+      [Updated to use the correct config setting names]
+    - Add an example refresh pattern for debs.
+      [Improved the refresh patterns based on the configuration from
+       squid-deb-proxy package]
+    - Add disabled by default AppArmor profile.
+      [Updated to include the ssl_certs abstraction and suggestions on how to
+       deal with the snakeoil private key and other keys in /etc/ssl.]
+  * Dropped changes:
+    - Add additional dep8 tests.
+      [Adopted in 4.0.21-1~exp5, albeit a stripped down version]
+    - Correct attribution and add explanatory note in d/NEWS.debian.
+      [That particular upgrade path has happened long ago.]
+    - Drop wrong short-circuiting of various invocations; we always want to
+      call the debhelper block.
+      [This was for the transitional squid3 package, and that transition has
+       already happened.]
+    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
+      [Not needed anymore since we have a native systemd service file
+       and no longer rely on the generator.]
+    - Enable autoreconf. This is no longer required for the security updates,
+      but is needed for the seddery of test-suite/Makefile.am in
+      d/t/upstream-test-suite.
+      [Replaced by patch 0003-installed-binary-for-debian-ci.patch]
+    - Adjust seddery for upstream test squid binary location.
+      [sed no longer necessary since patch,
+       0003-installed-binary-for-debian-ci.patch, will be dropped
+       entirely.]
+    - Drop Conflicts/Replaces of squid against squid3. In Ubuntu, the migration
+      happened in Xenial, so no upgrade path still requires this code. This
+      reduces upgrade ordering difficulty.
+      [Again we have a migration, but this time from squid3 to squid, so we
+      need this].
+    - GCC7 FTBFS fixes (LP: #1712668):
+      + d/rules: don't error when hitting the "deprecated" and
+      "format-truncation" gcc7 warnings. Upstream 3.5.27 has fixes for these,
+      but one in Format.cc that affects 32bit builds was deemed too intrusive
+      for the 3.5 stable series and is only in squid 4.x
+      [No longer needed with squid 4.x]
+    - Do not force gcc-6
+      [It was a temporary workaround in Debian that got dropped]
+  * Added changes:
+    - d/rules: enable cdbs parallel build
+    - d/t/test-squid.py: fix apparmor profile filename
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 16 Aug 2018 12:33:17 -0300
+
 squid (4.1-1) unstable; urgency=high
 
   * New Upstream Release (Closes: #896120)
diff --git a/debian/control b/debian/control
index 2c6a5b4..8d7e6b5 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: squid
 Section: web
 Priority: optional
-Maintainer: Luigi Gangitano <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Luigi Gangitano <[e-mail]>
 Uploaders: Santiago Garcia Mantinan <[e-mail]>
 Homepage: http://www.squid-cache.org
 Standards-Version: 4.2.1
@@ -24,6 +25,7 @@ Build-Depends: ed, libltdl-dev, pkg-config
 	, libsasl2-dev
 	, libxml2-dev
 	, nettle-dev
+	, dh-apparmor
 
 Package: squid3
 Architecture: all
@@ -40,8 +42,8 @@ Description: Transitional package
 Package: squid
 Architecture: any
 Pre-Depends: adduser
-Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl
-Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbindd
+Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl, ssl-cert
+Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbindd, apparmor
 Recommends: libcap2-bin [linux-any], ca-certificates
 Conflicts: squid3 (<< ${binary:Version})
 Replaces: squid3
diff --git a/debian/patches/90-cf.data.ubuntu.patch b/debian/patches/90-cf.data.ubuntu.patch
new file mode 100644
index 0000000..9dfa5b4
--- /dev/null
+++ b/debian/patches/90-cf.data.ubuntu.patch
@@ -0,0 +1,16 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -5859,6 +5862,12 @@ NOCOMMENT_START
+ refresh_pattern ^ftp:		1440	20%	10080
+ refresh_pattern ^gopher:	1440	0%	1440
+ refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
++refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
++refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
++refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++# example pattern for deb packages
++#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
+ refresh_pattern .		0	20%	4320
+ NOCOMMENT_END
+ DOC_END
+
diff --git a/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
new file mode 100644
index 0000000..40b5306
--- /dev/null
+++ b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
@@ -0,0 +1,22 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -3516,6 +3516,19 @@
+ 			reference a PEM file containing both the certificate
+ 			and private key.
+ 	
++	Notes:
++
++	On Debian/Ubuntu systems a default snakeoil certificate is
++	available in /etc/ssl and users can set:
++
++		sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem
++
++	and
++
++		sslkey=/etc/ssl/private/ssl-cert-snakeoil.key
++
++	for testing.
++
+ 	sslcipher=...	The list of valid SSL ciphers to use when connecting
+ 			to this peer.
+ 
diff --git a/debian/patches/fix-rotate-assertion.patch b/debian/patches/fix-rotate-assertion.patch
new file mode 100644
index 0000000..820cf0e
--- /dev/null
+++ b/debian/patches/fix-rotate-assertion.patch
@@ -0,0 +1,26 @@
+Description: Fix assertion error when rotating logs
+ Upstream is still discussing
+ (https://github.com/squid-cache/squid/pull/257#issuecomment-428250856)
+ the details of the patch, but there are no big cons for now. The PR will be
+ monitored and the squid package updated accordingly when needed.
+Author: Vitaly Lavrov <[e-mail]>
+Origin: other, https://github.com/squid-cache/squid/pull/257#issuecomment-427271426
+Bug: https://bugs.squid-cache.org/show_bug.cgi?id=4796
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910337
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/squid/+bug/1794553
+Last-Update: 2018-10-09
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/src/main.cc b/src/main.cc
+index 2a7269ed..9dc0d195 100644
+--- a/src/main.cc
++++ b/src/main.cc
+@@ -1152,8 +1152,6 @@ mainInitialize(void)
+ 
+     _db_init(Debug::cache_log, Debug::debugOptions);
+ 
+-    fd_open(fileno(debug_log), FD_LOG, Debug::cache_log);
+-
+     debugs(1, DBG_CRITICAL, "Starting Squid Cache version " << version_string << " for " << CONFIG_HOST_TYPE << "...");
+     debugs(1, DBG_CRITICAL, "Service Name: " << service_name);
+ 
diff --git a/debian/patches/fix-uninitialized-var.patch b/debian/patches/fix-uninitialized-var.patch
new file mode 100644
index 0000000..a682703
--- /dev/null
+++ b/debian/patches/fix-uninitialized-var.patch
@@ -0,0 +1,25 @@
+Description: Workaround gcc's maybe-uninitialized error in parse_time_t
+ Function parse_time_t() passes an unitialized variable to parseTimeLine(),
+ which will fill it in as the return value. gcc's -Wmaybe-unitialized setting
+ trips over this when the build is done with -O3, as is the case in ppc64el.
+ This fix is suggested in https://github.com/squid-cache/squid/pull/270, but
+ not accepted yet. It was remarked that a better fix can be done, instead of
+ just working around the gcc misfire.
+Origin: other, https://github.com/squid-cache/squid/pull/270
+Bug: https://bugs.squid-cache.org/show_bug.cgi?id=4875
+Last-Update: 2018-08-14
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/src/cache_cf.cc b/src/cache_cf.cc
+index 006a42d..96fe36f 100644
+--- a/src/cache_cf.cc
++++ b/src/cache_cf.cc
+@@ -2925,7 +2925,7 @@ dump_time_t(StoreEntry * entry, const char *name, time_t var)
+ void
+ parse_time_t(time_t * var)
+ {
+-    time_msec_t tval;
++    time_msec_t tval = 0;
+     parseTimeLine(&tval, T_SECOND_STR, false);
+     *var = static_cast<time_t>(tval/1000);
+ }
diff --git a/debian/patches/series b/debian/patches/series
index 6bff1ed..4c80674 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,7 @@
 0001-Default-configuration-file-for-debian.patch
 0002-Change-default-file-locations-for-debian.patch
 0003-installed-binary-for-debian-ci.patch
+90-cf.data.ubuntu.patch
+99-ubuntu-ssl-cert-snakeoil.patch
+fix-uninitialized-var.patch
+fix-rotate-assertion.patch
diff --git a/debian/rules b/debian/rules
index 9b2b1ed..3923dac 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,12 +3,17 @@
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export DEB_CFLAGS_MAINT_APPEND = -Wall
 
-DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed -latomic
+DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
 ifneq (,$(filter $(DEB_HOST_ARCH), armel m68k mips mipsel powerpc powerpcspe sh4))
 	DEB_LDFLAGS_MAINT_APPEND += -latomic
 endif
 export DEB_LDFLAGS_MAINT_APPEND
-
+# On ppc64el, dpkg-buildflags sets -O3 instead of the usual
+# -O2. This makes gcc emit a format-truncation error on
+# pconn.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH),ppc64el)
+  export DEB_CXXFLAGS_MAINT_APPEND = -Wno-format-truncation
+endif
 export DEB_BUILD_PARALLEL = yes
 include /usr/share/dpkg/buildflags.mk
 
@@ -95,3 +100,7 @@ install/squid::
 	install -m 755 -g root -d $(INSTALLDIR)/usr/share/man/man1
 	mv $(INSTALLDIR)/usr/bin/purge $(INSTALLDIR)/usr/bin/squid-purge
 	mv $(INSTALLDIR)/usr/share/man/man1/purge.1 $(INSTALLDIR)/usr/share/man/man1/squid-purge.1
+	install -m 755 -g root -d $(INSTALLDIR)/etc/apparmor.d/force-complain
+	install -m 755 -g root -d $(INSTALLDIR)/etc/apparmor.d/disable
+	install -m 644 -g root debian/usr.sbin.squid $(INSTALLDIR)/etc/apparmor.d
+	dh_apparmor --profile-name=usr.sbin.squid -psquid
diff --git a/debian/squid.install b/debian/squid.install
index 95ebe1a..d13050d 100644
--- a/debian/squid.install
+++ b/debian/squid.install
@@ -28,3 +28,6 @@ usr/share/man/man8/negotiate_kerberos_auth.8
 usr/share/man/man8/security_fake_certverify.8
 usr/share/man/man8/storeid_file_rewrite.8
 usr/share/man/man8/squid.8
+etc/apparmor.d/disable
+etc/apparmor.d/force-complain
+etc/apparmor.d/usr.sbin.squid
diff --git a/debian/squid.preinst b/debian/squid.preinst
index 941d4f2..65f81c4 100644
--- a/debian/squid.preinst
+++ b/debian/squid.preinst
@@ -63,6 +63,21 @@ then
 	chsh -s /bin/sh proxy
 fi
 
+disable_profile() {
+    APP_CONFFILE="/etc/apparmor.d/usr.sbin.squid"
+    APP_DISABLE="/etc/apparmor.d/disable/usr.sbin.squid"
+    # Create a symlink to the yet-to-be-unpacked profile
+    if [ ! -e "$APP_CONFFILE" ]; then
+        mkdir -p `dirname $APP_DISABLE` 2>/dev/null || true
+        ln -sf $APP_CONFFILE $APP_DISABLE
+    fi
+}
+
+if [ "$1" = "install" ]; then
+    # Disable AppArmor profile on install
+    disable_profile
+fi
+
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
 
diff --git a/debian/usr.sbin.squid b/debian/usr.sbin.squid
new file mode 100644
index 0000000..df3a9a3
--- /dev/null
+++ b/debian/usr.sbin.squid
@@ -0,0 +1,86 @@
+# Author: Simon Deziel
+#         Jamie Strandboge
+# vim:syntax=apparmor
+#include <tunables/global>
+
+/usr/sbin/squid flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/kerberosclient>
+  #include <abstractions/nameservice>
+  #include <abstractions/ssl_certs>
+
+  # If you are using squid with the default snakeoil certificates, you will
+  # probably have to uncomment the line below so that squid can read the
+  # private key:
+  #/etc/ssl/private/ssl-cert-snakeoil.key r,
+
+  # For a more generous permission, but also less secure, you could
+  # alternatively include the <abstractions/ssl_keys> abstraction, which
+  # gives read access to the entire contents of /etc/ssl
+
+  capability net_admin,
+  capability net_raw,
+  capability setuid,
+  capability setgid,
+  capability sys_chroot,
+
+  # allow child processes to run execvp(argv[0], [kidname, ...])
+  /usr/sbin/squid rix,
+
+  # pinger
+  network inet raw,
+  network inet6 raw,
+
+  /etc/mtab r,
+  @{PROC}/[0-9]*/mounts r,
+  @{PROC}/mounts r,
+
+  # squid3 configuration
+  /etc/squid/** r,
+  /{,var/}run/squid.pid rwk,
+  /var/spool/squid/ r,
+  /var/spool/squid/** rwk,
+  /usr/lib/squid{,3}/* rmix,
+  /usr/share/squid/** r,
+  /var/log/squid/* rw,
+
+  # squid-langpack
+  /usr/share/squid-langpack/** r,
+
+  # maas-proxy
+  /var/lib/maas/maas-proxy.conf r,
+  /var/log/maas/proxy/** rw,
+  /var/spool/maas-proxy/ r,
+  /var/spool/maas-proxy/** rwk,
+
+  # squid-deb-proxy
+  /etc/squid-deb-proxy/** r,
+  /{,var/}run/squid-deb-proxy.pid rwk,
+  /var/cache/squid-deb-proxy/ r,
+  /var/cache/squid-deb-proxy/** rwk,
+  /var/log/squid-deb-proxy/* rw,
+  owner /dev/shm/** rmw,
+
+  # squidguard
+  /usr/bin/squidGuard Cx -> squidguard,
+  profile squidguard {
+    #include <abstractions/base>
+
+    /etc/squid/squidGuard.conf r,
+    /var/log/squid{,3}/squidGuard.log w,
+    /var/lib/squidguard/** rw,
+
+    # squidguard by default uses /var/log/squid as its logdir, however, we
+    # don't want it to access squid's logs, only its own. Explicitly deny
+    # access to squid's files but allow all others since the user may specify
+    # anything for the squidGurad 'log' directive.
+    /var/log/squid{,3}/* rw,
+    audit deny /var/log/squid{,3}/{access,cache,store}.log* rw,
+
+    # Site-specific additions and overrides. See local/README for details.
+    #include <local/usr.sbin.squid>
+  }
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.squid>
+}