Merge ~ahasenack/ubuntu/+source/openldap:bionic-openldap-crash-1866303 into ubuntu/+source/openldap:ubuntu/bionic-devel

[Andreas Hasenack]

Previously applied to focal, now it's time to SRU the fix to the other ubuntu releases.

The bug contains the SRU template, and testing instructions. The patch is the same one used for focal.

PPA for testing: https://launchpad.net/~ahasenack/+archive/ubuntu/openldap-crash-1866303

[Christian Ehrhardt  (paelzer)]

Reviewed in more detail in the Eoan MP, same change here and CL difference is ok.
+1

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, tagging and uploading 0479a28d1ecaaa8c6ac86b9e79b78830252f03cd

$ git push pkg upload/2.4.45+dfsg-1ubuntu1.6
Enumerating objects: 16, done.
Counting objects: 100% (16/16), done.
Delta compression using up to 4 threads
Compressing objects: 100% (11/11), done.
Writing objects: 100% (11/11), 2.00 KiB | 120.00 KiB/s, done.
Total 11 (delta 7), reused 1 (delta 0)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/openldap
 * [new tag] upload/2.4.45+dfsg-1ubuntu1.6 -> upload/2.4.45+dfsg-1ubuntu1.6

$ dput ubuntu ../openldap_2.4.45+dfsg-1ubuntu1.6_source.changes
Checking signature on .changes
gpg: ../openldap_2.4.45+dfsg-1ubuntu1.6_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../openldap_2.4.45+dfsg-1ubuntu1.6.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openldap_2.4.45+dfsg-1ubuntu1.6.dsc: done.
  Uploading openldap_2.4.45+dfsg-1ubuntu1.6.debian.tar.xz: done.
  Uploading openldap_2.4.45+dfsg-1ubuntu1.6_source.buildinfo: done.
  Uploading openldap_2.4.45+dfsg-1ubuntu1.6_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

1557157

[Christian Ehrhardt  (paelzer)]

This wasn't accepted in -unapproved yet.
There also are accepted but not yet sponsored MPs for bug 1557157.
Could you combine the SRU cycle for this with an upload combining the two?

[Andreas Hasenack (ahasenack)]

I asked for it to be rejected from unapproved, and I included sergio's fix in a new upload.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index 793fa7b..9e1070f 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -1,5 +1,5 @@
 # vim:syntax=apparmor
-# Last Modified: Fri Jan  4 15:18:13 2008
+# Last Modified: Fri Jun  6 13:51:00 2020
 # Author: Jamie Strandboge <[e-mail]>
 
 #include <tunables/global>
@@ -49,6 +49,7 @@
   /{,var/}run/slapd/* w,
   /{,var/}run/slapd/ldapi rw,
   /{,var/}run/nslcd/socket rw,
+  /{,var/}run/saslauthd/mux rw,
 
   /usr/lib/ldap/ r,
   /usr/lib/ldap/* mr,
diff --git a/debian/changelog b/debian/changelog
index ae9f218..27a22f9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+openldap (2.4.45+dfsg-1ubuntu1.6) bionic; urgency=medium
+
+  [ Andreas Hasenack ]
+  * d/p/ITS-9171-Insert-callback-in-the-right-place.patch: Import upstream
+    patch to fix slapd crashing in certain configurations when a client
+    attempts a login to a locked account. (LP: #1866303)
+
+  [ Sergio Durigan Junior ]
+  * d/apparmor-profile: Update apparmor profile to grant access to
+    the saslauthd socket, so that SASL authentication works.  (LP: #1557157)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 01 Jul 2020 16:38:55 -0300
+
 openldap (2.4.45+dfsg-1ubuntu1.5) bionic-security; urgency=medium
 
   * SECURITY UPDATE: denial of service via nested search filters
diff --git a/debian/patches/ITS-9171-Insert-callback-in-the-right-place.patch b/debian/patches/ITS-9171-Insert-callback-in-the-right-place.patch
 new file mode 100644
index 0000000..deb5418
--- /dev/null
+++ b/debian/patches/ITS-9171-Insert-callback-in-the-right-place.patch
@@ -0,0 +1,38 @@
+From 0f106b550ebc226f788ea1c1a87bc27a84f98e90 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <[e-mail]>
+Date: Fri, 21 Feb 2020 10:26:53 +0000
+Subject: [PATCH] ITS#9171 Insert callback in the right place
+
+---
+ servers/slapd/overlays/ppolicy.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
+index a8f8f3073..3c12024bd 100644
+--- a/servers/slapd/overlays/ppolicy.c
++++ b/servers/slapd/overlays/ppolicy.c
+@@ -1323,9 +1323,8 @@ ppolicy_bind( Operation *op, SlapReply *rs )
+ 		/* Setup a callback so we can munge the result */
+ 
+ 		cb->sc_response = ppolicy_bind_response;
+-		cb->sc_next = op->o_callback->sc_next;
+ 		cb->sc_private = ppb;
+-		op->o_callback->sc_next = cb;
++		overlay_callback_after_backover( op, cb, 1 );
+ 
+ 		/* Did we receive a password policy request control? */
+ 		if ( op->o_ctrlflag[ppolicy_cid] ) {
+@@ -1469,9 +1468,8 @@ ppolicy_compare(
+ 		/* Setup a callback so we can munge the result */
+ 
+ 		cb->sc_response = ppolicy_compare_response;
+-		cb->sc_next = op->o_callback->sc_next;
+ 		cb->sc_private = ppb;
+-		op->o_callback->sc_next = cb;
++		overlay_callback_after_backover( op, cb, 1 );
+ 
+ 		op->o_bd->bd_info = (BackendInfo *)on;
+ 		ppolicy_get( op, e, &ppb->pp );
+-- 
+2.20.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 3e3b889..539e3d3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -34,3 +34,4 @@ CVE-2019-13057-4.patch
 CVE-2019-13565.patch
 rwm-do-not-free-original-filter.patch
 CVE-2020-12243.patch
+ITS-9171-Insert-callback-in-the-right-place.patch