Merge ~ahasenack/ubuntu/+source/autofs:mantic-autofs-merge-2 into ubuntu/+source/autofs:debian/sid

[Andreas Hasenack]

Second autofs merge from debian.

Dropped one patch, and squashed our delta in logical. The noise in range-diff is d/p/series and changes in commit messages:

  git range-diff old/debian..logical/5.1.8-2ubuntu2 new/debian..mantic-autofs-merge-2

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/autofs-merge/

DEP8: green (note all-proposed=1 had to be used, due to the current glibc migration in mantic)

[Robie Basak (racb)]

I'll take a look.

[Robie Basak (racb)]

Everything looks rebased exactly with commit message improvements apart from the one commit correctly dropped. Commit messages and changelog messages are accurate. I wondered if b0027d6 had been sent to Debian as I could find no trace of this, but perhaps this is because it's associated with fbbcde8 and you're waiting for both together? Apart from that, everything looks appropriate to remain in our delta and upstreaming status all seems appropriate.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, racb
Uploaders: ahasenack, racb
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded with rich history:

Uploading autofs_5.1.8-3.1ubuntu1.dsc
Uploading autofs_5.1.8-3.1ubuntu1.debian.tar.xz
Uploading autofs_5.1.8-3.1ubuntu1_source.buildinfo
Uploading autofs_5.1.8-3.1ubuntu1_source.changes

I'll see about that echo;echo|smbpasswd delta.

diff --git a/debian/changelog b/debian/changelog
index 5394e61..5dcc727 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,33 @@
+autofs (5.1.8-3.1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2031241). Remaining changes:
+    - Fix authenticated cifs mount failure caught by DEP8  (LP #1955851):
+      + d/t/smb-mount: fix setting the password of the smb test user
+      + d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+        on s390x
+    - d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: Support
+      SASL SCRAM authentication (LP #1987992):
+    - Switch to OpenLDAP for SASL binds (LP #1984073):
+      + d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+        changes
+      + d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+        OpenLDAP for SASL binds
+      + d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+        fix auto-detection case
+      + d/p/support-external-cc-for-gssapi-bind.patch: fix external
+        credentials cache case when using openldap for sasl binds
+    - d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+      authentication mechanisms in LDAP maps, including shared secret
+      mechanisms and GSSAPI ones
+    - d/p/ntlm-crammd5-require-credentials.patch: fix NTLM and CRAM-MD5
+      authentication (LP #2023595)
+  * Dropped:
+    - d/p/autofs-5.1.8-ldap-kerberos-leads-to-automount-hang-p.patch: fix lock
+      imbalance (LP #1982219)
+      [In 5.1.8-3]
+
+ -- Andreas Hasenack <[e-mail]>  Sun, 13 Aug 2023 11:04:40 -0300
+
 autofs (5.1.8-3.1) unstable; urgency=medium
 
   * Non-maintainer upload (with approval by maintainer).
@@ -14,6 +44,49 @@ autofs (5.1.8-3) unstable; urgency=medium
 
  -- Mike Gabriel <[e-mail]>  Wed, 05 Jul 2023 11:50:21 +0200
 
+autofs (5.1.8-2ubuntu2) mantic; urgency=medium
+
+  * Fix NTLM and CRAM-MD5 SASL authentication (LP: #2023595):
+    - d/p/ntlm-crammd5-require-credentials.patch: fix NTLM and CRAM-MD5
+    - d/t/ldap-map-sasl-auth: add NTLM and CRAM-MD5 to the test
+  * d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: fix typo in
+    the "Origin" DEP3 header
+  * d/t/ldap-map-sasl-auth, d/t/control: add a missing 2>&1 to the test,
+    which allows us to drop the allow-stderr flag from the control file
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Jul 2023 11:29:10 -0300
+
+autofs (5.1.8-2ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2018059). Remaining changes:
+    - Fix authenticated cifs mount failure caught by DEP8  (LP #1955851):
+      + d/t/smb-mount: fix setting the password of the smb test user
+      + d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+        on s390x
+    - d/p/autofs-5.1.8-ldap-kerberos-leads-to-automount-hang-p.patch: fix lock
+      imbalance (LP #1982219)
+    - Support SASL SCRAM authentication (LP #1987992):
+      + d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: allow
+        SCRAM-SHA-*
+    - Switch to OpenLDAP for SASL binds (LP #1984073):
+      + d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+        changes
+      + d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+        OpenLDAP for SASL binds
+      + d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+        fix auto-detection case
+      + d/p/support-external-cc-for-gssapi-bind.patch: fix external
+        credentials cache case when using openldap for sasl binds
+    - d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+      authentication mechanisms in LDAP maps, including shared secret
+      mechanisms and GSSAPI ones
+  * Dropped:
+    - d/p/fix-nfsv4-only-mounts-should-not-use-rpcbind.patch:
+      Make NFSv4-only mounts not depend on rpcbind.  (LP #1970264)
+      [In 5.1.8-2]
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 12 Jun 2023 17:06:05 -0300
+
 autofs (5.1.8-2) unstable; urgency=medium
 
   [ Mike Gabriel ]
@@ -27,6 +100,61 @@ autofs (5.1.8-2) unstable; urgency=medium
 
  -- Mike Gabriel <[e-mail]>  Fri, 19 May 2023 10:25:31 +0200
 
+autofs (5.1.8-1ubuntu6) mantic; urgency=medium
+
+  * d/t/ldap-map-sasl-auth: wait for slapd to be ready (LP: #2023232)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 08 Jun 2023 14:02:00 -0300
+
+autofs (5.1.8-1ubuntu5) mantic; urgency=medium
+
+  * Support SASL SCRAM authentication (LP: #1987992):
+    - d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: allow
+      SCRAM-SHA-*
+  * Switch to OpenLDAP for SASL binds (LP: #1984073):
+    - d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+      changes
+    - d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+      OpenLDAP for SASL binds
+    - d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+      fix auto-detection case
+    - d/p/support-external-cc-for-gssapi-bind.patch: fix external
+      credentials cache case when using openldap for sasl binds
+  * d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+    authentication mechanisms in LDAP maps, including shared secret
+    mechanisms and GSSAPI ones
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 31 May 2023 14:32:36 -0300
+
+autofs (5.1.8-1ubuntu4) lunar; urgency=medium
+
+  * No-change rebuild against libldap-2
+
+ -- Steve Langasek <[e-mail]>  Thu, 15 Dec 2022 19:43:08 +0000
+
+autofs (5.1.8-1ubuntu3) kinetic; urgency=medium
+
+  * d/p/autofs-5.1.8-ldap-kerberos-leads-to-automount-hang-p.patch: fix
+    lock imbalance (LP: #1982219)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 28 Jul 2022 07:27:10 +0200
+
+autofs (5.1.8-1ubuntu2) kinetic; urgency=medium
+
+  * d/p/fix-nfsv4-only-mounts-should-not-use-rpcbind.patch:
+    Make NFSv4-only mounts not depend on rpcbind.  (LP: #1970264)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 28 Apr 2022 23:05:15 -0400
+
+autofs (5.1.8-1ubuntu1) jammy; urgency=medium
+
+  * Fix authenticated cifs mount failure caught by DEP8  (LP: #1955851):
+    - d/t/smb-mount: fix setting the password of the smb test user
+    - d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+      on s390x
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 20 Jan 2022 15:16:09 -0300
+
 autofs (5.1.8-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index e4b2040..5f0a752 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: autofs
 Section: utils
 Priority: optional
-Maintainer: Mike Gabriel <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Mike Gabriel <[e-mail]>
 Uploaders:
  Debian Edu Packaging Team <[e-mail]>,
 Build-Depends:
diff --git a/debian/patches/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch b/debian/patches/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch
new file mode 100644
index 0000000..c32d4dd
--- /dev/null
+++ b/debian/patches/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch
@@ -0,0 +1,118 @@
+autofs-5.1.8 - ldap_sasl_interactive_bind() needs credentials for auto-detection
+
+From: Thomas Reim <[e-mail]>
+
+SASL mechanism auto-selection using ldap_sasl_interactive_bind() is tricky.
+The behaviour and the required information depend not only on the capabilities
+of Cyrus SASL on the client machine but also on supportedSASLmechanisms on the
+LDAP server. The latter information will be requested by libldap during SASL
+mechanism negotiation. Current OpenLDAP libldap implementation is to prefer
+user credential based SCRAM-* mechanisms on token based GSSAPI. Only exception
+are SASL bind requests to servers, e. g. Active Directory domain controllers,
+that have disabled all SASL mechanisms, which rely on user credential transfer
+between client and directory server.
+
+Current autofs implementation fetches user credential information from LDAP
+authentication configuration file for LDAP simple binds or if users explicitly
+specify a user credential based authentication mechanism (authtype).
+
+This patch makes specification of user credentials mandatory for SASL mechanism
+auto-detection using ldap_sasl_interactive_bind(). Users can then omit SASL
+authtype specification and automount will auto-select the best suited user
+credential based SASL mechanism supported by client and LDAP server.
+If authtype="GSSAPI" is specified together with authrequired="autodetect"
+automount will obtain a Kerberos ticket-granting ticket and bind to all Active
+Directory servers or use the specified user credentials to bind to all other
+LDAP servers that also support user credential based SASL mechanisms.
+
+The patch is backward compatible to implementations that use autofs function
+sasl_choose_mech(). The strategy of this function is to force users to specify
+the SASL mechanism (authtype) if user credentials shall be used for SASL binding
+and only perform auto-selection for server supported mechanisms, which are not
+based on user credentials.
+
+Signed-off-by: Thomas Reim <[e-mail]>
+---
+ CHANGELOG             |    1 +
+ modules/lookup_ldap.c |   45 ++++++++++++++++++++++++++++++++++++---------
+ 2 files changed, 37 insertions(+), 9 deletions(-)
+
+Origin: upstream, https://git.kernel.org/pub/scm/linux/storage/autofs/autofs.git/commit/?id=2c7b64c2f8dc79cf57855541bc933dca015886aa
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073
+Last-Update: 2023-05-31
+diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c
+index 0803e09b..6b93a389 100644
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -644,14 +644,14 @@ static int do_bind(unsigned logopt, struct ldap_conn *conn,
+ 			sasl_flags = LDAP_SASL_QUIET;
+ 		}
+ 
+-		debug(logopt, "Attempting sasl bind with mechanism %s", ctxt->sasl_mech);
+-
+ 		if (ctxt->auth_required & LDAP_AUTH_AUTODETECT) {
+ 			if (ctxt->sasl_mech) {
+ 				free(ctxt->sasl_mech);
+ 				ctxt->sasl_mech = NULL;
+ 			}
+-		}
++			debug(logopt, "Attempting sasl bind with mechanism auto-select");
++		} else
++			debug(logopt, "Attempting sasl bind with mechanism %s", ctxt->sasl_mech);
+ 
+ 		/*
+ 		 *  If LDAP_AUTH_AUTODETECT is set, it means that there was no
+@@ -1445,20 +1445,47 @@ int parse_ldap_config(unsigned logopt, struct lookup_context *ctxt)
+ 		goto out;
+ 	}
+ 
++#ifndef WITH_LDAP_CYRUS_SASL
+ 	if (auth_required == LDAP_AUTH_USESIMPLE ||
+ 	   (authtype && authtype_requires_creds(authtype))) {
++#else
++	/*
++	 * OpenLDAP with Cyrus SASL needs user credentials for
++	 * SASL mechanism auto-selection in following cases:
++	 * (a) LDAP_AUTH_AUTODETECT
++	 * (b) LDAP_AUTH_REQUIRED but no SASL mechanism specified
++	 */
++	if (auth_required == LDAP_AUTH_USESIMPLE ||
++	   (authtype && authtype_requires_creds(authtype)) ||
++	   (!authtype && (auth_required & LDAP_AUTH_REQUIRED)) ||
++	   (auth_required & LDAP_AUTH_AUTODETECT)) {
++#endif
+ 		char *s1 = NULL, *s2 = NULL;
+ 		ret = get_property(logopt, root, "user",  &user);
+ 		ret |= get_property(logopt, root, "secret", &s1);
+ 		ret |= get_property(logopt, root, "encoded_secret", &s2);
+ 		if (ret != 0 || (!user || (!s1 && !s2))) {
+ auth_fail:
+-			error(logopt,
+-			      MODPREFIX
+-			      "%s authentication type requires a username "
+-			      "and a secret.  Please fix your configuration "
+-			      "in %s.", authtype, auth_conf);
+-			free(authtype);
++			if (auth_required == LDAP_AUTH_USESIMPLE)
++				error(logopt,
++				      MODPREFIX
++				      "Simple authentication requires a username "
++				      "and a secret.  Please fix your configuration "
++				      "in %s.", auth_conf);
++			else if (authtype && authtype_requires_creds(authtype))
++				error(logopt,
++				      MODPREFIX
++				      "%s authentication requires a username and "
++				      "a secret.  Please fix your configuration "
++				      "in %s.", authtype, auth_conf);
++			else
++				error(logopt,
++				      MODPREFIX
++				      "SASL authentication auto-selection requires "
++				      "a username and a secret.  Please fix your "
++				      "configuration in %s.", auth_conf);
++			if (authtype)
++				free(authtype);
+ 			if (user)
+ 				free(user);
+ 			if (s1)
diff --git a/debian/patches/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch b/debian/patches/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch
new file mode 100644
index 0000000..6bd2138
--- /dev/null
+++ b/debian/patches/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch
@@ -0,0 +1,422 @@
+autofs-5.1.8 - let OpenLDAP handle SASL binding
+
+From: Thomas Reim <[e-mail]>
+
+From: Thomas Reim <[e-mail]>
+
+Cyrus SASL supports data encryption in GSSAPI (with Kerberos V) mode using an
+SASL data security layer according to IETF RFC 2078. This security layer
+provides for traffic encryption during authentication and authorization towards
+an OpenLDAP based server and for subsequent encryption of data traffic for the
+LDAP session. Current automounter does not implement SASL security layer
+encryption and only relies on TLS to protect LDAP communication.
+
+OpenLDAP libldap if compiled with Cyrus SASL supports negotiation of an SASL
+data security layer based encryption of LDAP traffic. libldap also provides
+automatic negotiation of the best suited SASL mechanism taking into account
+application required defaults.
+
+Since version 4.4 Samba AD domain controllers default settings only allow for
+simple SASL binds over TLS encrypted connections or SASL binds with sign or
+seal, i. e. data security layer encryption, over unencrypted connections.
+Therefore, current automounter cannot fetch autofs maps from Samba AD DCs
+using SASL anymore without setting Samba configuration parameter "ldap server
+require strong auth" to "no" or "allow_sasl_over_tls".
+
+This patch updates automounter to let OpenLDAP and Cyrus SASL handle SASL
+binding and traffic security configuration. Proposed changes are backward
+compatible for clients that use LDAP libaries different from LDAP. When using
+SASL mechanism GSSAPI or simple authentication with TLS encryption automounter
+seamlessly interworks with latest Samba AD DCs.
+
+Signed-off-by: Thomas Reim <[e-mail]>
+Signed-off-by: Ian Kent <[e-mail]>
+---
+ CHANGELOG             |    1 
+ include/lookup_ldap.h |    6 ++
+ modules/cyrus-sasl.c  |  150 +++++++++++++++++++++++++++++++++++++++++++++++++
+ modules/lookup_ldap.c |  137 ++++++++++++++++++++++++++++++++++++++++++++-
+ 4 files changed, 292 insertions(+), 2 deletions(-)
+
+Origin: upstream, https://git.kernel.org/pub/scm/linux/storage/autofs/autofs.git/commit/?id=d692f7addabc539dbc00c3bff8538afea983fc52
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073
+Last-Update: 2023-05-31
+diff --git a/include/lookup_ldap.h b/include/lookup_ldap.h
+index 3a107782..9c3e8627 100644
+--- a/include/lookup_ldap.h
++++ b/include/lookup_ldap.h
+@@ -129,6 +129,12 @@ int autofs_sasl_bind(unsigned logopt, struct ldap_conn *conn, struct lookup_cont
+ void autofs_sasl_unbind(struct ldap_conn *conn, struct lookup_context *ctxt);
+ void autofs_sasl_dispose(struct ldap_conn *conn, struct lookup_context *ctxt);
+ void autofs_sasl_done(void);
++int sasl_do_kinit(unsigned logopt, struct lookup_context *ctxt);
++#ifdef WITH_LDAP_CYRUS_SASL
++void autofs_ldap_sasl_freedefs(void *defaults);
++void *autofs_ldap_sasl_defaults(LDAP *ld, char *mech, char *realm, char *authcid, char *passwd, char *authzid );
++int autofs_ldap_sasl_interact(LDAP *ld, unsigned flags, void *defaults, void *in );
++#endif
+ /* cyrus-sasl-extern */
+ int do_sasl_extern(LDAP *ldap, struct lookup_context *ctxt);
+ #endif
+diff --git a/modules/cyrus-sasl.c b/modules/cyrus-sasl.c
+index 738e363f..11e3f76a 100644
+--- a/modules/cyrus-sasl.c
++++ b/modules/cyrus-sasl.c
+@@ -233,6 +233,151 @@ get_server_SASL_mechanisms(unsigned logopt, LDAP *ld)
+ 	return mechanisms;
+ }
+ 
++#ifdef WITH_LDAP_CYRUS_SASL
++typedef struct autofs_ldap_sasl_defaults_s {
++	char *mech;
++	char *realm;
++	char *authcid;
++	char *passwd;
++	char *authzid;
++} ldapSASLdefaults;
++
++
++void autofs_ldap_sasl_freedefs(void *defaults)
++{
++	ldapSASLdefaults *defs = defaults;
++
++	assert(defs != NULL);
++
++	if (defs->mech)
++		ber_memfree(defs->mech);
++	if (defs->realm)
++		ber_memfree(defs->realm);
++	if (defs->authcid)
++		ber_memfree(defs->authcid);
++	if (defs->passwd)
++		ber_memfree(defs->passwd);
++	if (defs->authzid)
++		ber_memfree(defs->authzid);
++
++	ber_memfree(defs);
++}
++
++void *
++autofs_ldap_sasl_defaults(LDAP *ld,
++			  char *mech,
++			  char *realm,
++			  char *authcid,
++			  char *passwd,
++			  char *authzid)
++{
++	ldapSASLdefaults *defaults;
++
++	defaults = ber_memalloc(sizeof(ldapSASLdefaults));
++
++	if (defaults == NULL)
++		return NULL;
++
++	defaults->mech = mech ? ber_strdup(mech) : NULL;
++	defaults->realm = realm ? ber_strdup(realm) : NULL;
++	defaults->authcid = authcid ? ber_strdup(authcid) : NULL;
++	defaults->passwd = passwd ? ber_strdup(passwd) : NULL;
++	defaults->authzid = authzid ? ber_strdup(authzid) : NULL;
++
++	if (defaults->mech == NULL)
++		ldap_get_option(ld, LDAP_OPT_X_SASL_MECH, &defaults->mech);
++	if (defaults->realm == NULL)
++		ldap_get_option(ld, LDAP_OPT_X_SASL_REALM, &defaults->realm);
++	if (defaults->authcid == NULL)
++		ldap_get_option(ld, LDAP_OPT_X_SASL_AUTHCID, &defaults->authcid);
++	if (defaults->authzid == NULL)
++		ldap_get_option(ld, LDAP_OPT_X_SASL_AUTHZID, &defaults->authzid);
++
++	return defaults;
++}
++
++static int
++interaction(unsigned flags,
++	    sasl_interact_t *interact,
++	    ldapSASLdefaults *defaults)
++{
++	switch (interact->id) {
++	case SASL_CB_GETREALM:
++		if (defaults->realm)
++			interact->result = defaults->realm;
++		else if (interact->defresult)
++			interact->result = interact->defresult;
++		else
++			interact->result = "";
++		interact->len = strlen(interact->result);
++		break;
++
++	case SASL_CB_USER:
++		if (defaults->authzid)
++			interact->result = defaults->authzid;
++		else if (interact->defresult)
++			interact->result = interact->defresult;
++		else
++			interact->result = "";
++		interact->len = strlen(interact->result);
++		break;
++
++	case SASL_CB_PASS:
++		if (defaults->passwd)
++			interact->result = defaults->passwd;
++		else if (interact->defresult)
++			interact->result = interact->defresult;
++		else
++			interact->result = "";
++		interact->len = strlen(interact->result);
++		break;
++
++	case SASL_CB_AUTHNAME:
++		if (defaults->authcid)
++			interact->result = defaults->authcid;
++		else if (interact->defresult)
++			interact->result = interact->defresult;
++		else
++			interact->result = "";
++		interact->len = strlen(interact->result);
++		break;
++	}
++
++	return LDAP_SUCCESS;
++}
++
++int
++autofs_ldap_sasl_interact(LDAP *ld,
++			  unsigned flags,
++			  void *defaults,
++			  void *interact)
++{
++	ldapSASLdefaults *deflts = (ldapSASLdefaults*) defaults;
++	sasl_interact_t *in = (sasl_interact_t*) interact;
++	int rc = LDAP_SUCCESS;
++
++	if (!ld)
++		return LDAP_PARAM_ERROR;
++
++	while (in->id != SASL_CB_LIST_END) {
++		switch (in->id) {
++		case SASL_CB_NOECHOPROMPT:
++		case SASL_CB_ECHOPROMPT:
++			return LDAP_UNAVAILABLE;
++
++		default:
++			rc = interaction(flags, in, deflts);
++			if (rc)
++				return rc;
++			break;
++		}
++		in++;
++	}
++
++	return rc;
++}
++#endif
++
+ /*
+  *  Returns 0 upon successful connect, -1 on failure.
+  */
+@@ -994,11 +1139,12 @@ void autofs_sasl_dispose(struct ldap_conn *conn, struct lookup_context *ctxt)
+ 		return;
+ 	}
+ 
++#ifndef WITH_LDAP_CYRUS_SASL
+ 	if (conn && conn->sasl_conn) {
+ 		sasl_dispose(&conn->sasl_conn);
+ 		conn->sasl_conn = NULL;
+ 	}
+-
++#endif
+ 	if (ctxt->kinit_successful) {
+ 		if (--krb5cc_in_use || ctxt->client_cc)
+ 			ret = krb5_cc_close(ctxt->krb5ctxt, ctxt->krb5_ccache);
+@@ -1099,7 +1245,9 @@ int autofs_sasl_client_init(unsigned logopt)
+  */
+ void autofs_sasl_done(void)
+ {
++#ifndef WITH_LDAP_CYRUS_SASL
+ 	sasl_done();
++#endif
+ 	return;
+ }
+ 
+diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c
+index 3e43fc01..d08f648d 100644
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -223,11 +223,13 @@ int __unbind_ldap_connection(unsigned logopt,
+ 	if (ctxt->use_tls == LDAP_TLS_RELEASE)
+ 		ctxt->use_tls = LDAP_TLS_INIT;
+ #ifdef WITH_SASL
++#ifndef WITH_LDAP_CYRUS_SASL
+ 	if (ctxt->auth_required & LDAP_NEED_AUTH)
+ 		autofs_sasl_unbind(conn, ctxt);
+ 	/* No, sasl_dispose does not release the ldap connection
+ 	 * unless it's using sasl EXTERNAL
+ 	 */
++#endif
+ #endif
+ 	if (conn->ldap) {
+ 		rv = ldap_unbind_ext(conn->ldap, NULL, NULL);
+@@ -574,15 +576,146 @@ static int do_bind(unsigned logopt, struct ldap_conn *conn,
+ 		   const char *uri, struct lookup_context *ctxt)
+ {
+ 	char *host = NULL, *nhost;
+-	int rv;
++	int rv, result;
+ 
+ #ifdef WITH_SASL
++#ifdef WITH_LDAP_CYRUS_SASL
++	unsigned int sasl_flags = LDAP_SASL_AUTOMATIC;
++	LDAPMessage *ldap_res = NULL;
++	const char *chosen_mech = NULL;
++	const char *rmech = NULL;
++	char *part_dn = NULL;
++	char *info = NULL;
++	int msgid, err;
++	void *defaults;
++	char *data;
++	ber_len_t *ssf;
++
++#endif
+ 	debug(logopt, MODPREFIX "auth_required: %d, sasl_mech %s",
+ 	      ctxt->auth_required, ctxt->sasl_mech);
+ 
+ 	if (ctxt->auth_required & LDAP_NEED_AUTH) {
++#ifndef WITH_LDAP_CYRUS_SASL
+ 		rv = autofs_sasl_bind(logopt, conn, ctxt);
+ 		debug(logopt, MODPREFIX "autofs_sasl_bind returned %d", rv);
++#else
++		if (ctxt->sasl_mech && !strncmp(ctxt->sasl_mech, "GSSAPI", 6)) {
++			rv = sasl_do_kinit(logopt, ctxt);
++			if (rv != 0)
++				return 0;
++			sasl_flags = LDAP_SASL_QUIET;
++		}
++
++		debug(logopt, "Attempting sasl bind with mechanism %s", ctxt->sasl_mech);
++
++		if (ctxt->auth_required & LDAP_AUTH_AUTODETECT) {
++			if (ctxt->sasl_mech) {
++				free(ctxt->sasl_mech);
++				ctxt->sasl_mech = NULL;
++			}
++		}
++
++		/*
++		 *  If LDAP_AUTH_AUTODETECT is set, it means that there was no
++		 *  mechanism specified in the configuration file or auto
++		 *  selection has been requested, so try to auto-select an
++		 *  auth mechanism.
++		 */
++
++		defaults = autofs_ldap_sasl_defaults(conn->ldap, ctxt->sasl_mech, NULL,
++						     ctxt->user, ctxt->secret, NULL);
++		do {
++			rv = ldap_sasl_interactive_bind(conn->ldap, NULL,
++							ctxt->sasl_mech, NULL, NULL,
++							sasl_flags,
++							autofs_ldap_sasl_interact,
++							defaults, ldap_res,
++							&rmech, &msgid);
++
++			if (rmech)
++				chosen_mech = rmech;
++
++			if (rv != LDAP_SASL_BIND_IN_PROGRESS)
++				break;
++
++			if (ldap_res) {
++				ldap_msgfree(ldap_res);
++				ldap_res = NULL;
++			}
++
++			if (ldap_result(conn->ldap, msgid, LDAP_MSG_ALL, NULL, &ldap_res) == -1 || !ldap_res) {
++				ldap_get_option(conn->ldap, LDAP_OPT_RESULT_CODE, (void*) &err);
++				ldap_get_option(conn->ldap, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &info);
++				error(logopt, MODPREFIX "ldap_sasl_interactive_bind failed with error %d",
++				      err);
++				debug(logopt, "ldap_sasl_interactive_bind: %s", info);
++				ldap_memfree(info);
++				if (ldap_res)
++					ldap_msgfree(ldap_res);
++				return 0;
++			}
++		} while (rv == LDAP_SASL_BIND_IN_PROGRESS);
++
++		autofs_ldap_sasl_freedefs(defaults);
++
++		if (rv != LDAP_SUCCESS) {
++			ldap_get_option(conn->ldap, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &info);
++			error(logopt, MODPREFIX "ldap_sasl_interactive_bind failed with error %d",
++			      rv);
++			debug(logopt, "ldap_sasl_interactive_bind: %s", info);
++			ldap_memfree(info);
++			if (ldap_res)
++				ldap_msgfree(ldap_res);
++			return 0;
++		}
++
++		/* Parse the result and check for errors */
++		if (ldap_res) {
++			rv = ldap_parse_result(conn->ldap, ldap_res, &err, &part_dn, &info, NULL, NULL, 0);
++			if (rv != LDAP_SUCCESS) {
++				error(logopt,
++				      MODPREFIX "ldap_sasl_interactive_bind parse result failed with error %d",
++				      err);
++				debug(logopt, "ldap_sasl_interactive_bind matched DN: %s", part_dn);
++				debug(logopt, "ldap_sasl_interactive_bind parse result: %s", info);
++				ldap_memfree(info);
++				ldap_memfree(part_dn);
++				ldap_msgfree(ldap_res);
++				return 0;
++			}
++		}
++
++		if (info)
++			ldap_memfree(info);
++		if (part_dn)
++			ldap_memfree(part_dn);
++		if (ldap_res)
++			ldap_msgfree(ldap_res);
++
++		/* Conversation was completed successfully by now */
++		result = ldap_get_option(conn->ldap, LDAP_OPT_X_SASL_USERNAME, &data);
++		if (result == LDAP_OPT_SUCCESS && data && *data)
++			debug(logopt, "SASL username: %s", data );
++
++		data = NULL;
++		result = ldap_get_option(conn->ldap, LDAP_OPT_X_SASL_AUTHCID, &data);
++		if (result == LDAP_OPT_SUCCESS && data && *data)
++			debug(logopt, "SASL authcid: %s", data);
++
++		data = NULL;
++		result = ldap_get_option(conn->ldap, LDAP_OPT_X_SASL_AUTHZID, &data);
++		if (result == LDAP_OPT_SUCCESS && data && *data)
++			debug(logopt, "SASL authzid: %s", data);
++
++		ssf = NULL;
++		result = ldap_get_option(conn->ldap, LDAP_OPT_X_SASL_SSF, &ssf);
++		if (result == LDAP_OPT_SUCCESS && ssf)
++			debug(logopt, "SASL SSF: %lu", (unsigned long) ssf);
++
++		debug(logopt, "sasl bind with mechanism %s succeeded",
++		      chosen_mech);
++#endif
+ 	} else {
+ 		rv = bind_ldap_simple(logopt, conn->ldap, uri, ctxt);
+ 		debug(logopt, MODPREFIX "ldap simple bind returned %d", rv);
+@@ -1793,6 +1926,7 @@ static int do_init(const char *mapfmt,
+ 	}
+ 
+ #ifdef WITH_SASL
++#ifndef WITH_LDAP_CYRUS_SASL
+ 	/* Init the sasl callbacks */
+ 	ldapinit_mutex_lock();
+ 	if (!autofs_sasl_client_init(LOGOPT_NONE)) {
+@@ -1801,6 +1935,7 @@ static int do_init(const char *mapfmt,
+ 		return 1;
+ 	}
+ 	ldapinit_mutex_unlock();
++#endif
+ #endif
+ 
+ 	if (is_amd_format)
diff --git a/debian/patches/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch b/debian/patches/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch
new file mode 100644
index 0000000..1a0d43f
--- /dev/null
+++ b/debian/patches/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch
@@ -0,0 +1,221 @@
+autofs-5.1.8 - prepare for OpenLDAP SASL binding
+
+From: Thomas Reim <[e-mail]>
+
+autofs prefers OpenLDAP as LDAP client library and Cyrus as SASL library.
+OpenLDAP also uses Cyrus SASL and is fully capable of providing SASL
+authentication and binding to clients. OpenLDAP SASL interface is actively
+maintained and provides latest security features, e. g. SASL data security
+layer.
+
+It does not make much sense to implement and use an own SASL interface in
+autofs if OpenLDAP is used, which already has a powerful SASL implementation.
+
+Prepare conditional compilation for use of OpenLDAP for SASL authentication
+and binding.
+
+Signed-off-by: Thomas Reim <[e-mail]>
+Signed-off-by: Ian Kent <[e-mail]>
+---
+ CHANGELOG           |    1 +
+ aclocal.m4          |   43 ++++++++++++++++++++++++++++++++++++++++
+ configure           |   55 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ configure.in        |    5 ++++-
+ include/config.h.in |    3 +++
+ 5 files changed, 105 insertions(+), 2 deletions(-)
+
+Origin: upstream, https://git.kernel.org/pub/scm/linux/storage/autofs/autofs.git/commit/?id=38de2897606638fa1d600fc205ee4ccedf75ced6
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073
+Last-Update: 2023-05-31
+diff --git a/aclocal.m4 b/aclocal.m4
+index c671b5b0..91b22dae 100644
+--- a/aclocal.m4
++++ b/aclocal.m4
+@@ -325,6 +325,49 @@ AC_TRY_LINK(
+ LIBS="$af_check_hesiod_save_libs"
+ ])
+ 
++dnl --------------------------------------------------------------------------
++dnl AF_CHECK_FUNC_LDAP_SUPPORT_SASL
++dnl
++dnl Check for sasl support in ldap
++dnl --------------------------------------------------------------------------
++AC_DEFUN(
++  [AF_CHECK_FUNC_LDAP_SUPPORT_SASL],
++  [AC_MSG_CHECKING(for cyrus sasl support in openldap)
++    have_openldap_cyrus_sasl=no
++    # save current libs
++    af_check_ldap_support_sasl_save_libs="$LIBS"
++    LIBS="$LIBLDAP"
++
++    AC_RUN_IFELSE(
++      [ AC_LANG_SOURCE(
++        [ #include <stdlib.h>
++          #include <ldap.h>
++          int main (int argc, char **argv) {
++            LDAP *ldap = NULL;
++            int lret = 0;
++
++            lret = ldap_initialize(&ldap, NULL);
++            if (lret != LDAP_OPT_SUCCESS) {
++              exit(1);
++            }
++            lret = ldap_set_option(ldap, LDAP_OPT_X_SASL_NOCANON,
++                                   LDAP_OPT_ON);
++            exit(lret == LDAP_OPT_SUCCESS ? 0 : 1);
++          } ])],
++      have_openldap_sasl=yes,
++      have_openldap_sasl=no,
++      have_openldap_sasl=yes)
++
++    AC_MSG_RESULT($have_openldap_sasl)
++    if test "$have_openldap_sasl" = "yes"; then
++      AC_DEFINE(WITH_LDAP_CYRUS_SASL,1,
++         [Define if OpenLDAP was built with Cyrus SASL])
++    fi
++
++    # restore libs
++    LIBS="$af_check_ldap_parse_page_control_save_libs"
++  ])
++
+ dnl --------------------------------------------------------------------------
+ dnl AF_CHECK_FUNC_LDAP_CREATE_PAGE_CONTROL
+ dnl
+diff --git a/configure b/configure
+index 90ce6e0e..91be1e14 100755
+--- a/configure
++++ b/configure
+@@ -4481,6 +4481,9 @@ _ACEOF
+ fi
+ done
+ 
++
++  CFLAGS="$SAVE_CFLAGS"
++  LIBS="$SAVE_LIBS"
+ fi
+ 
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing versionsort" >&5
+@@ -5347,6 +5350,7 @@ CFLAGS="$af_check_nis_header_save_cflags"
+ # OpenLDAP support?  Expect that this may have a special directory...
+ #
+ AF_tmp_ldflags="$LDFLAGS"
++AF_tmp_libs="$LIBS"
+ LIBLDAP=''
+ HAVE_LDAP=''
+ 
+@@ -5413,7 +5417,54 @@ fi
+ 
+ $as_echo "#define WITH_LDAP 1" >>confdefs.h
+ 
+-	fi
++	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for cyrus sasl support in openldap" >&5
++$as_echo_n "checking for cyrus sasl support in openldap... " >&6; }
++    have_openldap_cyrus_sasl=no
++    # save current libs
++    af_check_ldap_support_sasl_save_libs="$LIBS"
++    LIBS="$LIBLDAP"
++
++    if test "$cross_compiling" = yes; then :
++  have_openldap_sasl=yes
++else
++  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h.  */
++  #include <stdlib.h>
++          #include <ldap.h>
++          int main (int argc, char **argv) {
++            LDAP *ldap = NULL;
++            int lret = 0;
++
++            lret = ldap_initialize(&ldap, NULL);
++            if (lret != LDAP_OPT_SUCCESS) {
++              exit(1);
++            }
++            lret = ldap_set_option(ldap, LDAP_OPT_X_SASL_NOCANON,
++                                   LDAP_OPT_ON);
++            exit(lret == LDAP_OPT_SUCCESS ? 0 : 1);
++          }
++_ACEOF
++if ac_fn_c_try_run "$LINENO"; then :
++  have_openldap_sasl=yes
++else
++  have_openldap_sasl=no
++fi
++rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
++  conftest.$ac_objext conftest.beam conftest.$ac_ext
++fi
++
++
++    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_openldap_sasl" >&5
++$as_echo "$have_openldap_sasl" >&6; }
++    if test "$have_openldap_sasl" = "yes"; then
++
++$as_echo "#define WITH_LDAP_CYRUS_SASL 1" >>confdefs.h
++
++    fi
++
++    # restore libs
++    LIBS="$af_check_ldap_parse_page_control_save_libs"
++
+ 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ldap_create_page_control in -lldap" >&5
+ $as_echo_n "checking for ldap_create_page_control in -lldap... " >&6; }
+ 
+@@ -5500,12 +5551,14 @@ fi
+ # restore libs
+ LIBS="$af_check_ldap_parse_page_control_save_libs"
+ 
++    fi
+ fi
+ 
+ 
+ 
+ 
+ LDFLAGS="${AF_tmp_ldflags}"
++LIBS="${AF_tmp_libs}"
+ 
+ #
+ # SASL support
+diff --git a/configure.in b/configure.in
+index 68cbd44a..45f32340 100644
+--- a/configure.in
++++ b/configure.in
+@@ -279,6 +279,7 @@ AF_CHECK_NIS_HEADER()
+ # OpenLDAP support?  Expect that this may have a special directory...
+ #
+ AF_tmp_ldflags="$LDFLAGS"
++AF_tmp_libs="$LIBS"
+ LIBLDAP=''
+ HAVE_LDAP=''
+ AC_ARG_WITH(openldap,
+@@ -303,15 +304,17 @@ if test -z "$HAVE_LDAP" -o "$HAVE_LDAP" != "0"; then
+ 	if test "$HAVE_LDAP" = "1"; then
+ 		AC_DEFINE(WITH_LDAP,1,
+ 			[Define if using LDAP as a source of automount maps])
+-	fi
++	AF_CHECK_FUNC_LDAP_SUPPORT_SASL()
+ 	AF_CHECK_FUNC_LDAP_CREATE_PAGE_CONTROL()
+ 	AF_CHECK_FUNC_LDAP_PARSE_PAGE_CONTROL()
++    fi
+ fi
+ 
+ AC_SUBST(LDAP_FLAGS)
+ AC_SUBST(HAVE_LDAP)
+ AC_SUBST(LIBLDAP)
+ LDFLAGS="${AF_tmp_ldflags}"
++LIBS="${AF_tmp_libs}"
+ 
+ #
+ # SASL support
+diff --git a/include/config.h.in b/include/config.h.in
+index 4f8daa86..7dab82ee 100644
+--- a/include/config.h.in
++++ b/include/config.h.in
+@@ -162,6 +162,9 @@
+ /* Define if using LDAP as a source of automount maps */
+ #undef WITH_LDAP
+ 
++/* Define if OpenLDAP was built with Cyrus SASL */
++#undef WITH_LDAP_CYRUS_SASL
++
+ /* Define to 1 if you have the libtirpc library installed */
+ #undef WITH_LIBTIRPC
+ 
diff --git a/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch b/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch
new file mode 100644
index 0000000..d0fd309
--- /dev/null
+++ b/debian/patches/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch
@@ -0,0 +1,84 @@
+autofs-5.1.8 - support SCRAM for SASL binding
+
+From: Thomas Reim <[e-mail]>
+
+In general, automount users that apply SASL binding for authentication are
+free to use any SASL mechanism supported by the underlying SASL library.
+automounter does not check the specified mechanism and transparently
+forwards the information to SASL or LDAP.
+
+Most directory services now support the more secure Salted Challenge
+Response Authentication Mechanismis (SCRAM) for SASL binding (RFC 5802).
+But automount users cannot request use of SCRAM, as automount does not
+read user and password credentials for SCRAM mechanisms.
+
+This patch enables SCRAM-SHA-1 and other SCRAM-SHA mechanisms
+(if supported by SASL library).
+
+Signed-off-by: Thomas Reim <[e-mail]>
+---
+ CHANGELOG                      |    1 +
+ man/autofs_ldap_auth.conf.5.in |    2 +-
+ modules/cyrus-sasl.c           |    4 ++--
+ modules/lookup_ldap.c          |    3 ++-
+ 4 files changed, 6 insertions(+), 4 deletions(-)
+
+Origin: upstream, https://git.kernel.org/pub/scm/linux/storage/autofs/autofs.git/commit/?id=ea826c884a72f53c02ae448a53333a5191d37913
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073
+Last-Update: 2023-05-31
+diff --git a/man/autofs_ldap_auth.conf.5.in b/man/autofs_ldap_auth.conf.5.in
+index 2357566c..0b3c706b 100644
+--- a/man/autofs_ldap_auth.conf.5.in
++++ b/man/autofs_ldap_auth.conf.5.in
+@@ -60,7 +60,7 @@ authentication mechanism. If no suitable mechanism can be found, connections
+ to the ldap server are made without authentication. Finally, if it is set to
+ simple, then simple authentication will be used instead of SASL.
+ .TP
+-\fBauthtype="GSSAPI"|"LOGIN"|"PLAIN"|"ANONYMOUS"|"DIGEST-MD5|EXTERNAL"\fP
++\fBauthtype="GSSAPI"|"LOGIN"|"PLAIN"|"ANONYMOUS"|"DIGEST-MD5"|"SCRAM-SHA-1"|"EXTERNAL"\fP
+ This attribute can be used to specify a preferred authentication mechanism.
+ In normal operations, the automounter will attempt to authenticate to the
+ ldap server using the list of supportedSASLmechanisms obtained from the
+diff --git a/modules/cyrus-sasl.c b/modules/cyrus-sasl.c
+index c41f2174..fe46f5d7 100644
+--- a/modules/cyrus-sasl.c
++++ b/modules/cyrus-sasl.c
+@@ -35,7 +35,7 @@
+  *
+  *  This file implements SASL authentication to an LDAP server for the
+  *  following mechanisms:
+- *    GSSAPI, EXTERNAL, ANONYMOUS, PLAIN, DIGEST-MD5, KERBEROS_V5, LOGIN
++ *    GSSAPI, EXTERNAL, ANONYMOUS, PLAIN, DIGEST-MD5, SCRAM-SHA-*, KERBEROS_V5, LOGIN
+  *  The mechanism to use is specified in an external file,
+  *  LDAP_AUTH_CONF_FILE.  See the samples directory in the autofs
+  *  distribution for an example configuration file.
+@@ -1028,7 +1028,7 @@ sasl_choose_mech(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt)
+ 		 *  This routine is called if there is no configured
+ 		 *  mechanism.  As such, we can skip over any auth
+ 		 *  mechanisms that require user credentials.  These include
+-		 *  PLAIN, LOGIN, and DIGEST-MD5.
++		 *  PLAIN, LOGIN, SCRAM-SHA-*, and DIGEST-MD5.
+ 		 */
+ 		if (authtype_requires_creds(mechanisms[i]))
+ 			continue;
+diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c
+index b0a28f10..0803e09b 100644
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -1233,7 +1233,7 @@ int get_property(unsigned logopt, xmlNodePtr node, const char *prop, char **valu
+ }
+ 
+ /*
+- *  For plain text, login and digest-md5 authentication types, we need
++ *  For plain text, login, scram-sha-* and digest-md5 authentication types, we need
+  *  user and password credentials.
+  */
+ int authtype_requires_creds(const char *authtype)
+@@ -1241,6 +1241,7 @@ int authtype_requires_creds(const char *authtype)
+ #ifdef WITH_SASL
+ 	if (!strncmp(authtype, "PLAIN", strlen("PLAIN")) ||
+ 	    !strncmp(authtype, "DIGEST-MD5", strlen("DIGEST-MD5")) ||
++	    !strncmp(authtype, "SCRAM-SHA-", strlen("SCRAM-SHA-")) ||
+ 	    !strncmp(authtype, "LOGIN", strlen("LOGIN")))
+ 		return 1;
+ #endif
diff --git a/debian/patches/fix-loop-under-run-in-cache_get_offset_parent.patch b/debian/patches/fix-loop-under-run-in-cache_get_offset_parent.patch
new file mode 100644
index 0000000..744a350
--- /dev/null
+++ b/debian/patches/fix-loop-under-run-in-cache_get_offset_parent.patch
@@ -0,0 +1,30 @@
+Subject: [PATCH 08/19] autofs-5.1.8 - fix loop under run in
+ cache_get_offset_parent()
+From:   Ian Kent <[e-mail]>
+From: Frank Sorenson <[e-mail]>
+
+To avoid reading memory outside of the the string
+allocated for parent, tail needs to stop when it
+reaches or passes parent, even if it doesn't
+actually equal parent.
+
+Signed-off-by: Frank Sorenson <[e-mail]>
+---
+ lib/cache.c |    2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+Origin: upstream, https://www.spinics.net/lists/autofs/msg02432.html
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1955851
+Last-Update: 2022-01-20
+Backport note: dropped the CHANGELOG patch hunk
+--- a/lib/cache.c
++++ b/lib/cache.c
+@@ -710,7 +710,7 @@
+ 		*tail = 0;
+ 
+ 		tail--;
+-		if (tail == parent)
++		if (tail <= parent)
+ 			break;
+ 
+ 		me = cache_lookup_distinct(mc, parent);
diff --git a/debian/patches/ntlm-crammd5-require-credentials.patch b/debian/patches/ntlm-crammd5-require-credentials.patch
new file mode 100644
index 0000000..8a92899
--- /dev/null
+++ b/debian/patches/ntlm-crammd5-require-credentials.patch
@@ -0,0 +1,16 @@
+Description: NTLM and CRAM-MD5 also require creds
+ Noticed while writing the DEP8 test for SASL authentication.
+Author: Andreas Hasenack <[e-mail]>
+Forwarded: https://www.spinics.net/lists/autofs/msg02585.html
+Last-Update: 2023-05-24
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -1208,6 +1208,8 @@
+ 	if (!strncmp(authtype, "PLAIN", strlen("PLAIN")) ||
+ 	    !strncmp(authtype, "DIGEST-MD5", strlen("DIGEST-MD5")) ||
+ 	    !strncmp(authtype, "SCRAM-SHA-", strlen("SCRAM-SHA-")) ||
++	    !strncmp(authtype, "NTLM", strlen("NTLM")) ||
++	    !strncmp(authtype, "CRAM-MD5", strlen("CRAM-MD5")) ||
+ 	    !strncmp(authtype, "LOGIN", strlen("LOGIN")))
+ 		return 1;
+ #endif
diff --git a/debian/patches/series b/debian/patches/series
index 3927e42..b7d6599 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,10 @@ fix-nfs4-only-mounts-should-not-use-rpcbind.patch
 fix-missing-unlock-in-sasl-do-kinit-ext-cc.patch
 use-correct-reference-for-IN6-macro-cal.patch
 dont-probe-interface-that-cant-send-pac.patch
+fix-loop-under-run-in-cache_get_offset_parent.patch
+autofs-5.1.8-support-SCRAM-for-SASL-binding.patch
+autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch
+autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch
+autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch
+support-external-cc-for-gssapi-bind.patch
+ntlm-crammd5-require-credentials.patch
diff --git a/debian/patches/support-external-cc-for-gssapi-bind.patch b/debian/patches/support-external-cc-for-gssapi-bind.patch
new file mode 100644
index 0000000..1597ea7
--- /dev/null
+++ b/debian/patches/support-external-cc-for-gssapi-bind.patch
@@ -0,0 +1,20 @@
+Description: add back support for credentialcache option
+ The patchset to let openldap handle SASL authentication accidentally dropped
+ support for the credentialcache option in autofs_ldap_auto.conf.
+Author: Andreas Hasenack <[e-mail]>
+Forwarded: https://www.spinics.net/lists/autofs/msg02582.html
+Last-Update: 2023-05-24
+--- a/modules/lookup_ldap.c	2023-05-16 21:02:41.263345786 +0000
++++ b/modules/lookup_ldap.c	2023-05-16 21:02:47.807520735 +0000
+@@ -601,7 +601,10 @@
+ 		debug(logopt, MODPREFIX "autofs_sasl_bind returned %d", rv);
+ #else
+ 		if (ctxt->sasl_mech && !strncmp(ctxt->sasl_mech, "GSSAPI", 6)) {
+-			rv = sasl_do_kinit(logopt, ctxt);
++            if (ctxt->client_cc)
++                rv = sasl_do_kinit_ext_cc(logopt, ctxt);
++            else
++			    rv = sasl_do_kinit(logopt, ctxt);
+ 			if (rv != 0)
+ 				return 0;
+ 			sasl_flags = LDAP_SASL_QUIET;
diff --git a/debian/tests/control b/debian/tests/control
index 0058590..13c13cd 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -5,3 +5,7 @@ Restrictions: isolation-machine, needs-root, allow-stderr
 Tests: nfs-mount
 Depends: @, nfs-common, nfs-server
 Restrictions: isolation-machine, needs-root, allow-stderr
+
+Tests: ldap-map-sasl-auth
+Depends: @, autofs-ldap, nfs-common, nfs-server, slapd, ldap-utils, schema2ldif, sasl2-bin, libsasl2-modules, libsasl2-modules-db, libsasl2-modules-gssapi-mit, krb5-kdc, krb5-admin-server
+Restrictions: isolation-machine, needs-root
diff --git a/debian/tests/ldap-map-sasl-auth b/debian/tests/ldap-map-sasl-auth
new file mode 100755
index 0000000..786cb07
--- /dev/null
+++ b/debian/tests/ldap-map-sasl-auth
@@ -0,0 +1,385 @@
+#!/bin/bash
+
+set -e
+
+sasluser="user$$"
+saslpass="pass$$"
+ldap_admin_pw="ldapadminpw$$"
+mydomain="example.fake"
+realm="${mydomain^^}" # uppercase
+myhostname="server.${mydomain}"
+ldap_suffix="dc=example,dc=fake"
+ldap_admin_dn="cn=admin,${ldap_suffix}"
+ldap_service_principal="ldap/${myhostname}"
+shared_secret_mechs="DIGEST-MD5 SCRAM-SHA-1 SCRAM-SHA-224 SCRAM-SHA-256 SCRAM-SHA-384 SCRAM-SHA-512 NTLM CRAM-MD5"
+gssapi_mechs="GSSAPI GSS-SPNEGO"
+test_file="test_file_$$"
+
+cleanup() {
+    if [ $? -ne 0 ]; then
+        echo "## Something failed, gathering logs"
+        echo
+        echo "## syslog:"
+        tail -n 300 /var/log/syslog
+        echo
+        echo "## mounts:"
+        mount
+    fi
+    rm -f /etc/sasldb2
+    # This is not meant to fully restore the state, but just don't leave a file
+    # with clear text and easy to guess credentials lying around.
+    # From sasl2-bin's postinst
+    echo '!' | saslpasswd2 -c 'no:such:user'
+    saslpasswd2 -d 'no:such:user'
+    chmod 0640 /etc/sasldb2
+    chown root:sasl /etc/sasldb2
+    rm -rf /storage
+    rm -rf /run/systemd/system/autofs.service.d
+    systemctl daemon-reload
+}
+
+trap cleanup EXIT
+
+check_slapd_ready() {
+    ldapwhoami -Q -Y EXTERNAL -H ldapi:/// > /dev/null 2>&1
+}
+
+wait_service_ready() {
+    local service="${1}"
+    local check_function="${2}"
+	local -i tries=5
+    echo -n "Waiting for ${service} to be ready "
+    while [ ${tries} -ne 0 ]; do
+        echo -n "."
+        if "${check_function}"; then
+            echo
+            break
+        fi
+        tries=$((tries-1))
+        sleep 1s
+    done
+    if [ ${tries} -eq 0 ]; then
+        echo "ERROR: ${service} is not ready"
+        return 1
+    fi
+}
+
+setup_slapd() {
+    local domain="$1"
+    local password="$2"
+    # MUST use REAL TABS as delimiters below!
+    debconf-set-selections << EOF
+slapd	slapd/domain	string	${domain}
+slapd	shared/organization	string	${domain}
+slapd	slapd/password1	password	${password}
+slapd	slapd/password2	password	${password}
+EOF
+    rm -rf /var/backups/*slapd* /var/backups/unknown*ldapdb
+    # so that slapd can read /etc/sasldb2
+    gpasswd -a openldap sasl > /dev/null 2>&1 || :
+    dpkg-reconfigure -fnoninteractive -pcritical slapd 2>&1
+    systemctl restart slapd # http://bugs.debian.org/1010678
+    wait_service_ready slapd check_slapd_ready
+    echo
+    echo "## Configuring slapd"
+    # olcSaslAuxprops: sasldb
+    # Configures openldap to check SASL secrets using the sasldb plugin and
+    # only allows authenticated users to read the ou=auto.indirect subtree.
+    # This removes the chance of any anonymous bind fallback by autofs from
+    # working, so we can be sure we are using an authenticated connection.
+    ldapmodify -Y EXTERNAL -H ldapi:/// 2>&1 <<EOF
+dn: cn=config
+changetype: modify
+replace: olcSaslAuxprops
+olcSaslAuxprops: sasldb
+-
+replace: olcLogLevel
+olcLogLevel: stats
+
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: {2}to dn.subtree="ou=auto.indirect,${ldap_suffix}"
+  by users read
+  by * none
+
+EOF
+    echo
+    echo "## Adding autofs schema to ldap"
+    ldap-schema-manager -i autofs.schema 2>&1
+
+    echo
+    echo "## Adding automount maps to ldap"
+    ldapadd -x -D "${ldap_admin_dn}" -w "${ldap_admin_pw}" <<EOF
+dn: ou=auto.indirect,${ldap_suffix}
+objectClass: top
+objectClass: automountMap
+ou: auto.indirect
+
+dn: cn=/,ou=auto.indirect,${ldap_suffix}
+objectClass: automount
+cn: /
+automountInformation: -fstype=nfs4 ${myhostname}:/&
+
+EOF
+
+}
+
+adjust_sasl_sec_props() {
+    # olcSaslSecProps: minssf=256
+    # Configures openldap to require a minimum strength factor of 256, which is
+    # kind of 256 bit encryption.
+    # This tests that #1984073 is fixed without having to deploy a Samba AD/DC server
+    # After this is done, further ldapmodify commands with -Y EXTERNAL will be blocked
+    # because the EXTERNAL mechanism has an ssf of zero.
+    ldapmodify -Y EXTERNAL -H ldapi:/// 2>&1 <<EOF
+dn: cn=config
+changetype: modify
+replace: olcSaslSecProps
+olcSaslSecProps: minssf=256
+
+EOF
+}
+
+adjust_hostname() {
+    local myhostname="$1"
+
+    echo "${myhostname}" > /etc/hostname
+    hostname "${myhostname}"
+    if ! grep -qE "${myhostname}" /etc/hosts; then
+        # just so it's resolvable
+        echo "127.0.1.10 ${myhostname}" >> /etc/hosts
+    fi
+}
+
+create_realm() {
+    local realm_name="$1"
+    local kerberos_server="$2"
+
+    # start fresh
+    rm -rf /var/lib/krb5kdc/*
+    rm -rf /etc/krb5kdc/*
+    rm -f /etc/krb5.keytab
+
+    # setup some defaults
+    cat > /etc/krb5kdc/kdc.conf <<EOF
+[kdcdefaults]
+    kdc_ports = 750,88
+[realms]
+    ${realm_name} = {
+	    database_name = /var/lib/krb5kdc/principal
+	    admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
+	    acl_file = /etc/krb5kdc/kadm5.acl
+	    key_stash_file = /etc/krb5kdc/stash
+	    kdc_ports = 750,88
+	    max_life = 10h 0m 0s
+	    max_renewable_life = 7d 0h 0m 0s
+	    default_principal_flags = +preauth
+    }
+EOF
+
+    cat > /etc/krb5.conf <<EOF
+[libdefaults]
+    default_realm = ${realm_name}
+    kdc_timesync = 1
+    ccache_type = 4
+    forwardable = true
+    proxiable = true
+    fcc-mit-ticketflags = true
+[realms]
+	${realm_name} = {
+		kdc = ${kerberos_server}
+		admin_server = ${kerberos_server}
+	}
+EOF
+    echo "# */admin *" > /etc/krb5kdc/kadm5.acl
+
+    # create the realm
+    kdb5_util create -s -P secretpassword
+
+    # restart services
+    systemctl restart krb5-kdc.service krb5-admin-server.service
+}
+
+create_krb_principal() {
+    local principal="$1"
+    local password="$2"
+
+    if [ -n "${password}" ]; then
+        kadmin.local -q "addprinc -pw ${password} ${principal}" 2>&1
+    else
+        kadmin.local -q "addprinc -randkey ${principal}" 2>&1
+    fi
+}
+
+extract_keytab() {
+    local principal="$1"
+
+    kadmin.local -q "ktadd ${principal}"
+}
+
+create_exports() {
+    mkdir -m 0755 -p /storage
+    cat > /etc/exports <<EOF
+/storage *(rw,sync,no_subtree_check)
+EOF
+    date > /storage/${test_file}
+    exportfs -rav
+}
+
+# we restart autofs a lot during this test
+override_systemd_throttling_autofs() {
+    mkdir -p /run/systemd/system/autofs.service.d
+    cat > /run/systemd/system/autofs.service.d/override.conf <<EOF
+[Unit]
+StartLimitIntervalSec=0
+EOF
+    systemctl daemon-reload
+}
+
+configure_autofs_ldap_auth_type() {
+    local authtype="${1}"
+    local -r conf_file="/etc/autofs_ldap_auth.conf"
+
+    if echo "${shared_secret_mechs}" | grep -qw "${authtype}"; then
+        cat > "${conf_file}" <<EOF
+<?xml version="1.0" ?>
+<!--
+This files contains a single entry with multiple attributes tied to it.
+See autofs_ldap_auth.conf(5) for more information.
+-->
+
+<autofs_ldap_sasl_conf
+    usetls="no"
+    tlsrequired="no"
+    authrequired="yes"
+    user="${sasluser}@${mydomain}"
+    authtype="${authtype}"
+    secret="${saslpass}"
+/>
+EOF
+    elif echo "${gssapi_mechs}" | grep -qw "${authtype}"; then
+        cat > "${conf_file}" <<EOF
+<?xml version="1.0" ?>
+<!--
+This files contains a single entry with multiple attributes tied to it.
+See autofs_ldap_auth.conf(5) for more information.
+-->
+
+<autofs_ldap_sasl_conf
+    usetls="no"
+    tlsrequired="no"
+    authrequired="yes"
+    authtype="${authtype}"
+    clientprinc="${sasluser}@${realm}"
+    credentialcache="/tmp/krb5cc_$(id -u)"
+/>
+EOF
+    fi
+    chown root:root "${conf_file}"
+    chmod 0600 "${conf_file}"
+    systemctl restart autofs.service
+}
+
+test_autofs_with_sasl_mech() {
+    local mech="${1}"
+    local output=""
+
+    configure_autofs_ldap_auth_type "${mech}"
+    echo
+
+    echo "## Confirming target is not mounted"
+    # careful to not inadvertently trigger the mount by accessing it,
+    # i.e., don't attempt to list /mnt/storage
+    output=$(ls -la /mnt/)
+    echo "${output}"
+    if echo "${output}" | grep -q storage; then
+        echo "## FAIL, target directory should be clear"
+        exit 1
+    fi
+    echo
+
+    echo "## Triggering a mount, and checking that the mountpoint has the test file"
+    # XXX global var test_file
+    ls -la /mnt/storage/${test_file}
+    echo
+    echo "## Checking that the mountpoint is nfsv4"
+    findmnt -M /mnt/storage -t nfs4
+    echo
+}
+
+
+override_systemd_throttling_autofs
+
+adjust_hostname "${myhostname}"
+
+echo "## Setting up Kerberos"
+create_realm "${realm}" "${myhostname}"
+create_krb_principal "${sasluser}" "${saslpass}"
+create_krb_principal "${ldap_service_principal}"
+extract_keytab "${ldap_service_principal}"
+chgrp sasl /etc/krb5.keytab
+chmod g+r /etc/krb5.keytab
+echo
+
+echo "## Setting up slapd"
+setup_slapd "${mydomain}" "${ldap_admin_pw}"
+echo
+
+echo "## Populating NFS export"
+create_exports
+echo
+
+echo "## Creating test user ${sasluser} in sasldb"
+rm -f /etc/sasldb2
+echo -n "${saslpass}" | saslpasswd2 -c -p "${sasluser}" -u "${mydomain}"
+chown root:sasl /etc/sasldb2
+chmod 0640 /etc/sasldb2
+echo
+
+echo "## Testing shared secret mechanism auth one by one before letting autofs try it"
+echo
+for mech in ${shared_secret_mechs}; do
+    echo "Testing mechanism ${mech}"
+    ldapwhoami -Y "${mech}" -U "${sasluser}"@"${mydomain}" -w "${saslpass}" 2>&1
+    echo
+done
+
+echo "## Testing GSSAPI mechanisms before letting autofs try it"
+echo
+echo "${saslpass}" | timeout --verbose 30 kinit "${sasluser}"
+for mech in ${gssapi_mechs}; do
+    echo "Testing mechanism ${mech}"
+    ldapwhoami -Y "${mech}" 2>&1
+    echo
+done
+
+echo "## Adding automount to nsswitch.conf"
+if ! grep -qE "^automount:" /etc/nsswitch.conf; then
+    echo "automount: files ldap" >> /etc/nsswitch.conf
+else
+    sed -i -r "s,^automount:.*,automount: files ldap," /etc/nsswitch.conf
+fi
+echo
+
+echo "## Setting up autofs"
+# "nobind" tells autofs to not try to bind mount if it detects the mount is
+# from localhost, i.e., we REALLY want to use NFS
+echo "/mnt ldap://${myhostname}/ou=auto.indirect,${ldap_suffix} nobind" > /etc/auto.master
+echo
+
+echo "## Testing autofs with SASL shared secret mechanisms"
+echo
+for mech in ${shared_secret_mechs}; do
+    echo "## Configuring autofs to use mechanism ${mech}"
+    test_autofs_with_sasl_mech "${mech}"
+done
+
+echo "## Testing autofs with SASL GSSAPI mechanisms"
+echo "## Configuring openldap to reject SASL binds with SSF<256"
+adjust_sasl_sec_props
+echo
+for mech in ${gssapi_mechs}; do
+    echo "## Configuring autofs to use mechanism ${mech}"
+    test_autofs_with_sasl_mech "${mech}"
+done
diff --git a/debian/tests/smb-mount b/debian/tests/smb-mount
index b9b685b..ccdde4b 100644
--- a/debian/tests/smb-mount
+++ b/debian/tests/smb-mount
@@ -35,7 +35,7 @@ create_user() {
 
     useradd -m "$username"
     echo "Setting samba password for the ${username} user"
-    echo "${password}\n${password}" | smbpasswd -s -a ${username}
+    (echo "${password}"; echo "${password}") | smbpasswd -s -a ${username}
 }