Merge ~ahasenack/ubuntu/+source/autofs:mantic-autofs-fix-ntlm-crammd5 into ubuntu/+source/autofs:ubuntu/devel

[Andreas Hasenack]

This MP fixes:
- support for NTLM and CRAM-MD5 (bug #2023595): these were initially thought to be working, but closer inspection showed them to also be broken in the release pocket. I still need to fill out the SRU template for this one.

In the previous autofs merge I had opted to not fix this in the devel release, but since I'm SRUing this fix, I changed my mind. Initially I thought we shouldn't fix deprecated mechanisms (which NTLM and CRAM-MD5 are), but that's not the correct way to deprecate something (not fixing a bug). If we really want to deprecate these alrogorithms, then it should be a wider effort and they should be removed from cyrus-sasl2, for example.

Testing these is a bit involved, and I wrote a DEP8 test for that. This test will go over the shared secret mechanisms, as well as the kerberos ones (gssapi/gss-spnego).

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/autofs-sasl-fixes/
DEP8: green

Note: I disabled arm* builds because they were not starting, and I waited over 1h.

[Andreas Hasenack (ahasenack)]

I still have to fill out the sru template for bug #2023595

[Athos Ribeiro (athos-ribeiro)]

Thanks Andreas!

+1 on fixing this even if NTLM and CRAM-MD5 are deprecated.

LGTM. It seems we also got an upstream ack/+1 for the forwarded change :)

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, athos-ribeiro
Uploaders: ahasenack, athos-ribeiro
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

I addressed the same points raised in the lunar and jammy MPs

[Andreas Hasenack (ahasenack)]

Uploaded with rich history:

Uploading autofs_5.1.8-2ubuntu2.dsc
Uploading autofs_5.1.8-2ubuntu2.debian.tar.xz
Uploading autofs_5.1.8-2ubuntu2_source.buildinfo
Uploading autofs_5.1.8-2ubuntu2_source.changes

diff --git a/debian/changelog b/debian/changelog
index 369af9e..f35cdc2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+autofs (5.1.8-2ubuntu2) mantic; urgency=medium
+
+  * Fix NTLM and CRAM-MD5 SASL authentication (LP: #2023595):
+    - d/p/ntlm-crammd5-require-credentials.patch: fix NTLM and CRAM-MD5
+    - d/t/ldap-map-sasl-auth: add NTLM and CRAM-MD5 to the test
+  * d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: fix typo in
+    the "Origin" DEP3 header
+  * d/t/ldap-map-sasl-auth, d/t/control: add a missing 2>&1 to the test,
+    which allows us to drop the allow-stderr flag from the control file
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Jul 2023 11:29:10 -0300
+
 autofs (5.1.8-2ubuntu1) mantic; urgency=medium
 
   * Merge with Debian unstable (LP: #2018059). Remaining changes:
diff --git a/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch b/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch
index 56a588d..d0fd309 100644
--- a/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch
+++ b/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch
@@ -23,7 +23,7 @@ Signed-off-by: Thomas Reim <[e-mail]>
  modules/lookup_ldap.c          |    3 ++-
  4 files changed, 6 insertions(+), 4 deletions(-)
 
-Origin: origin, https://git.kernel.org/pub/scm/linux/storage/autofs/autofs.git/commit/?id=ea826c884a72f53c02ae448a53333a5191d37913
+Origin: upstream, https://git.kernel.org/pub/scm/linux/storage/autofs/autofs.git/commit/?id=ea826c884a72f53c02ae448a53333a5191d37913
 Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073
 Last-Update: 2023-05-31
 diff --git a/man/autofs_ldap_auth.conf.5.in b/man/autofs_ldap_auth.conf.5.in
diff --git a/debian/patches/ntlm-crammd5-require-credentials.patch b/debian/patches/ntlm-crammd5-require-credentials.patch
new file mode 100644
index 0000000..8a92899
--- /dev/null
+++ b/debian/patches/ntlm-crammd5-require-credentials.patch
@@ -0,0 +1,16 @@
+Description: NTLM and CRAM-MD5 also require creds
+ Noticed while writing the DEP8 test for SASL authentication.
+Author: Andreas Hasenack <[e-mail]>
+Forwarded: https://www.spinics.net/lists/autofs/msg02585.html
+Last-Update: 2023-05-24
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -1208,6 +1208,8 @@
+ 	if (!strncmp(authtype, "PLAIN", strlen("PLAIN")) ||
+ 	    !strncmp(authtype, "DIGEST-MD5", strlen("DIGEST-MD5")) ||
+ 	    !strncmp(authtype, "SCRAM-SHA-", strlen("SCRAM-SHA-")) ||
++	    !strncmp(authtype, "NTLM", strlen("NTLM")) ||
++	    !strncmp(authtype, "CRAM-MD5", strlen("CRAM-MD5")) ||
+ 	    !strncmp(authtype, "LOGIN", strlen("LOGIN")))
+ 		return 1;
+ #endif
diff --git a/debian/patches/series b/debian/patches/series
index 9a56d56..70ffec9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -17,3 +17,4 @@ autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch
 autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch
 autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch
 support-external-cc-for-gssapi-bind.patch
+ntlm-crammd5-require-credentials.patch
diff --git a/debian/tests/control b/debian/tests/control
index 6b4ef5d..13c13cd 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -8,4 +8,4 @@ Restrictions: isolation-machine, needs-root, allow-stderr
 
 Tests: ldap-map-sasl-auth
 Depends: @, autofs-ldap, nfs-common, nfs-server, slapd, ldap-utils, schema2ldif, sasl2-bin, libsasl2-modules, libsasl2-modules-db, libsasl2-modules-gssapi-mit, krb5-kdc, krb5-admin-server
-Restrictions: isolation-machine, needs-root, allow-stderr
+Restrictions: isolation-machine, needs-root
diff --git a/debian/tests/ldap-map-sasl-auth b/debian/tests/ldap-map-sasl-auth
index aba9fec..786cb07 100755
--- a/debian/tests/ldap-map-sasl-auth
+++ b/debian/tests/ldap-map-sasl-auth
@@ -11,7 +11,7 @@ myhostname="server.${mydomain}"
 ldap_suffix="dc=example,dc=fake"
 ldap_admin_dn="cn=admin,${ldap_suffix}"
 ldap_service_principal="ldap/${myhostname}"
-shared_secret_mechs="DIGEST-MD5 SCRAM-SHA-1 SCRAM-SHA-224 SCRAM-SHA-256 SCRAM-SHA-384 SCRAM-SHA-512"
+shared_secret_mechs="DIGEST-MD5 SCRAM-SHA-1 SCRAM-SHA-224 SCRAM-SHA-256 SCRAM-SHA-384 SCRAM-SHA-512 NTLM CRAM-MD5"
 gssapi_mechs="GSSAPI GSS-SPNEGO"
 test_file="test_file_$$"
 
@@ -106,7 +106,7 @@ olcAccess: {2}to dn.subtree="ou=auto.indirect,${ldap_suffix}"
 EOF
     echo
     echo "## Adding autofs schema to ldap"
-    ldap-schema-manager -i autofs.schema
+    ldap-schema-manager -i autofs.schema 2>&1
 
     echo
     echo "## Adding automount maps to ldap"