squid3 helper basic_pop3_auth crashes

[PAJ]

[Impact]

The basic_pop3_auth command immediately fails when run in Bionic.

Backporting this fix will allow users to authenticate user credentials against a POP3 server as intended.

This is fixed by patching in an upstream commit that properly declares variables in the authentication script.

[Test Plan]

# lxc launch images:ubuntu/bionic test
# lxc exec test bash

# apt update && apt dist-upgrade
# apt install -y squid3

# /usr/lib/squid/basic_pop3_auth

Global symbol "$server" requires explicit package name (did you forget to declare "my $server"?) at /usr/lib/squid/basic_pop3_auth line 92.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at /usr/lib/squid/basic_pop3_auth line 99.
Global symbol "$server" requires explicit package name (did you forget to declare "my $server"?) at /usr/lib/squid/basic_pop3_auth line 99.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at /usr/lib/squid/basic_pop3_auth line 100.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at /usr/lib/squid/basic_pop3_auth line 106.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at /usr/lib/squid/basic_pop3_auth line 111.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at /usr/lib/squid/basic_pop3_auth line 112.
Execution of /usr/lib/squid/basic_pop3_auth aborted due to compilation errors.

[Where problems could occur]

Since the authentication is now able to continue without crashing, problems could occour further down in the script. This could include modifications to the POP3 server used for authentication.

The behavior should now match that of the other currently supported distributions, and the script is external to the rest of squid3, but up until now this script has not successfully run on Bionic.

[Original Description]

Ubuntu Xenial
perl is v5.22.1
squid3 version 3.5.12-1ubuntu7.5
Running basic_pop3_auth pop3_server gives :

Global symbol "$server" requires explicit package name (did you forget to declare "my $server"?) at ./basic_pop3_auth line 92.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at ./basic_pop3_auth line 99.
Global symbol "$server" requires explicit package name (did you forget to declare "my $server"?) at ./basic_pop3_auth line 99.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at ./basic_pop3_auth line 100.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at ./basic_pop3_auth line 106.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at ./basic_pop3_auth line 111.
Global symbol "$pop" requires explicit package name (did you forget to declare "my $pop"?) at ./basic_pop3_auth line 112.
./basic_pop3_auth had compilation errors.

adding my before $server on line 92 and before $pop on line 99 solves the problem.

[Andreas Hasenack (ahasenack)]

Confirmed, and it's still a problem in git upstream even. Looks like not many people use this script, or maybe a more recent perl is enforcing something that it wasn't before.

[Andreas Hasenack (ahasenack)]

Still valid.

[Andreas Hasenack (ahasenack)]

PR: https://github.com/squid-cache/squid/pull/284

[Andreas Hasenack (ahasenack)]

This is fixed in disco, which ships squid 4.

[Andreas Hasenack (ahasenack)]

Hm, this is complicated to manage in lp. Cosmic has the package "squid" (not squid3), and is affected. Disco has "squid" but is NOT affected.

Xenial and Bionic have "squid3", and are affected.

[Sergio Durigan Junior (sergiodj)]

Cosmic has reached EOL in 2019; Xenial has entered ESM last year. Therefore, making this bug as Won't Fix for both.

[Robie Basak (racb)]

Thank you for working on this!

I agree this is a trivial fix that is unlikely to impact anything outside of the feature that is already broken.

However, I think it's fair to say that this is fixing a feature that is in a really obscure corner of use cases. Is there even a single user who will benefit from this SRU today? If yes, then I'm happy to accept this upload. But if no then I'm reluctant. Every SRU comes at a cost. There is some regression risk in the act of rebuilding itself. But there is also cost in that it is frustrating for users to receive a deluge of updates every week - in download size and time, in local risk and downtime during service restarts, and so on.

> [Where problems could occur]

> Since the authentication is now able to continue without crashing, problems could occour further down in the script. This could include modifications to the POP3 server used for authentication.

This was also my thought on reading your Test Plan. I appreciate you identifying this limitation!

Due to the cost to users, if we are going to fix this obscure use case, I would like at a minimum to confirm that we are actually fixing this feature all the way through such that the feature actually works. I want to avoid fixing this now, forcing unaffected users to update, and later finding that the actual feature doesn't fully work and forcing them to update again to fix that again.

Conclusions:

1) Please figure out a Test Plan that fully tests the feature, rather than just getting past this single failure. This requirement might mean that it's not worth the work effort in continuing until we have at least one user confirming they would benefit from landing this fix. In that case I think it would be fine to wait until that happens.

2) I'm going to mark this bug block-proposed-bionic so that it doesn't land until/unless at least one real user is confirmed still affected, or if there's a case made for a practical chance that a user will be affected in the future (seems unlikely on Bionic with Jammy just round the corner now). SRU verification can continue as normal, and after that if there's a security or other update necessary then the fix can be bundled with that so as not to cause any additional unaffected user impact.

[Robie Basak (racb)]

If any user is still affected by this bug in 18.04 and would benefit from it being fixed, then your feedback would be appreciated. Please speak up!

[Brian Murray (brian-murray)]

An upload of squid3 to bionic-proposed has been rejected from the upload queue for the following reason: "There don't seem to be any users affected by this bug. If they turn up we can always accept the package from the rejected queue.".