Merge ~ahasenack/ubuntu/+source/bind-dyndb-ldap:lunar-dyndb-ldap-dep8 into ubuntu/+source/bind-dyndb-ldap:ubuntu/lunar-devel

[Andreas Hasenack]

Rebuild bind-dyndb-ldap with current bind9-libs, and add a DEP8 test to catch future regressions like this one.

This includes the fix for #2034250, but it's not mentioned explicitly because this DEP8 test doesn't exist in lunar yet.

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/bind9-dyndb-ldap/+packages

DEP8: green locally

See https://bugs.launchpad.net/ubuntu/lunar/+source/bind-dyndb-ldap/+bug/1978849/comments/10 and https://bugs.launchpad.net/ubuntu/lunar/+source/bind-dyndb-ldap/+bug/1978849/comments/12 for details, but src:bind-dyndb-ldap really needs a rebuild everytime bind9 is updated, even if it's just a no-change rebuild. This is not because of the strict "Depends", but the actual soname of the bind9 libraries *change* with a simple rebuild as they incorporate the ubuntu version suffix.

As an example of what it looks like when the test fails, I left the focal[1] run up:

(...)
112s ## Configuring bind9 to use bind9-dyndb-ldap
112s ## Restarting bind9
112s
112s ## Checking DNS records
112s Using domain server:
112s Name: 127.0.0.1
112s Address: 127.0.0.1#53
112s Aliases:
112s
112s Host somehost.example.internal not found: 5(REFUSED)
112s ## Something failed, gathering logs
(...)
112s Sep 1 17:48:26 adt-focal-amd64-bind-dyndb-ldap-20230901-174634-juju-4d1272-pro named[2187]: loading DynDB instance 'ldap_zone' driver '/usr/lib/bind/ldap.so'
112s Sep 1 17:48:26 adt-focal-amd64-bind-dyndb-ldap-20230901-174634-juju-4d1272-pro named[2187]: failed to dynamically load instance 'ldap_zone' driver '/usr/lib/bind/ldap.so': /usr/lib/bind/ldap.so: undefined symbol: cfg_parse_buffer2 (failure)

1. https://autopkgtest.ubuntu.com/results/autopkgtest-focal-ahasenack-bind9-dyndb-ldap/focal/amd64/b/bind-dyndb-ldap/20230901_174839_8c68a@/log.gz

[Lucas Kanashiro (lucaskanashiro)]

LGTM, +1.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, lucaskanashiro
Uploaders: ahasenack, lucaskanashiro
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded with rich history, and I also updated the bugs with the SRU template:

Uploading bind-dyndb-ldap_11.10-4ubuntu0.1.dsc
Uploading bind-dyndb-ldap_11.10-4ubuntu0.1.debian.tar.xz
Uploading bind-dyndb-ldap_11.10-4ubuntu0.1_source.buildinfo
Uploading bind-dyndb-ldap_11.10-4ubuntu0.1_source.changes

diff --git a/debian/changelog b/debian/changelog
index 9f8fa4c..86ca043 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+bind-dyndb-ldap (11.10-4ubuntu0.1) lunar; urgency=medium
+
+  * d/t/control, d/t/dyndb-ldap: add DEP8 test (LP: #2032650)
+  * No-change rebuild with current bind9-libs (LP: #1978849)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 04 Sep 2023 10:40:25 -0300
+
 bind-dyndb-ldap (11.10-4) unstable; urgency=medium
 
   [ Debian Janitor ]
diff --git a/debian/control b/debian/control
index 26a5763..0f59a7e 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: bind-dyndb-ldap
 Section: net
 Priority: optional
-Maintainer: Debian FreeIPA Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian FreeIPA Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>
 Build-Depends:
  debhelper-compat (= 13),
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..f82c494
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,7 @@
+Tests: dyndb-ldap
+Restrictions: isolation-container, needs-root
+Depends: bind9,
+         bind9-dyndb-ldap,
+         slapd,
+         ldap-utils,
+         dpkg-dev
diff --git a/debian/tests/dyndb-ldap b/debian/tests/dyndb-ldap
new file mode 100644
index 0000000..ac583bc
--- /dev/null
+++ b/debian/tests/dyndb-ldap
@@ -0,0 +1,280 @@
+#!/bin/bash
+
+set -e
+
+ldap_suffix="dc=example,dc=internal"
+mydomain="example.internal"
+myhostname="dep8"
+ldap_admin_dn="cn=admin,${ldap_suffix}"
+ldap_admin_pw="secret"
+ldap_bind9_dn="uid=bind9,${ldap_suffix}"
+ldap_bind9_rdn="uid: bind9" # match ldap_bind9_dn
+ldap_bind9_pw="secretagain"
+
+cleanup() {
+    result=$?
+    set +e
+    if [ ${result} -ne 0 ]; then
+        echo "## Something failed, gathering logs"
+        echo
+        echo "## /var/log/syslog:"
+        tail -n 200 /var/log/syslog
+        echo
+        echo "## slapd journal"
+        journalctl -u slapd
+        echo
+        echo "## bind journal"
+        journalctl -u bind
+    fi
+    sed -i '/include.*ldap_zone/d' /etc/bind/named.conf.local
+    rm -f /etc/bind/named.conf.ldap_zone
+}
+
+trap cleanup EXIT
+
+try_reload_apparmor_profile() {
+    local apparmor_profile="${1}"
+    local -i rc=0
+    local arch
+    local vendor
+
+    apparmor_parser -r -W -T "${apparmor_profile}" 2>&1 || rc=$?
+    if [ ${rc} -ne 0 ]; then
+        # This can fail on armhf in the Ubuntu DEP8 infrastructure
+        # because that environment restricts changing apparmor profiles.
+        # (See LP: #2008393)
+        arch=$(dpkg --print-architecture)
+        vendor=$(dpkg-vendor --query Vendor)
+        if [ "${arch}" = "armhf" ] && [ "${vendor}" = "Ubuntu" ]; then
+            echo "WARNING: failed to enforce apparmor profile."
+            echo "On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error."
+            echo "See #2008393 for details."
+            rc=0
+        else
+            echo "ERROR: failed to adjust the slapd apparmor profile for this test."
+        fi
+    fi
+    return ${rc}
+}
+
+adjust_apparmor_profile() {
+    local profile_name="usr.sbin.named"
+    local profile_path="/etc/apparmor.d/${profile_name}"
+
+    if [ -f "${profile_path}" ]; then
+        if aa-status --enabled 2>/dev/null; then
+            # Adjust apparmor so bind9 can connect to slapd's unix socket
+            echo " /run/slapd/ldapi rw," >> "/etc/apparmor.d/local/${profile_name}"
+            try_reload_apparmor_profile "${profile_path}"
+        fi
+    fi
+}
+
+check_slapd_ready() {
+    ldapwhoami -Q -Y EXTERNAL -H ldapi:/// > /dev/null 2>&1
+}
+
+wait_service_ready() {
+    local service="${1}"
+    local check_function="${2}"
+    local -i tries=5
+    echo -n "Waiting for ${service} to be ready "
+    while [ ${tries} -ne 0 ]; do
+        echo -n "."
+        if "${check_function}"; then
+            echo
+            break
+        fi
+        tries=$((tries-1))
+        sleep 1s
+    done
+    if [ ${tries} -eq 0 ]; then
+        echo "ERROR: ${service} is not ready"
+        return 1
+    fi
+}
+
+setup_slapd() {
+    local domain="$1"
+    local password="$2"
+    # MUST use REAL TABS as delimiters below!
+    debconf-set-selections << EOF
+slapd	slapd/domain	string	${domain}
+slapd	shared/organization	string	${domain}
+slapd	slapd/password1	password	${password}
+slapd	slapd/password2	password	${password}
+EOF
+    rm -rf /var/backups/*slapd* /var/backups/unknown*ldapdb
+    dpkg-reconfigure -fnoninteractive -pcritical slapd 2>&1
+    systemctl restart slapd # http://bugs.debian.org/1010678
+    wait_service_ready slapd check_slapd_ready
+}
+
+configure_slapd_logging() {
+    ldapmodify -Y EXTERNAL -H ldapi:/// 2>&1 <<EOF
+dn: cn=config
+changetype: modify
+replace: olcLogLevel
+olcLogLevel: stats
+
+EOF
+}
+
+create_bind9_uid() {
+    ldapadd -x -D "${ldap_admin_dn}" -w "${ldap_admin_pw}" <<EOF
+dn: ${ldap_bind9_dn}
+${ldap_bind9_rdn}
+objectClass: simpleSecurityObject
+objectClass: account
+userPassword: {CRYPT}x
+
+EOF
+    # this sets the password
+    ldappasswd -x -D "${ldap_admin_dn}" -w "${ldap_admin_pw}" -s "${ldap_bind9_pw}" "${ldap_bind9_dn}"
+
+    # The plugin can change some attributes, like SOA records. For this test,
+    # it's simpler to just allow it to write to the whole dns tree.
+    ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: {1}to dn.subtree="ou=dns,${ldap_suffix}" by dn.exact="${ldap_bind9_dn}" write by * none
+
+EOF
+}
+
+
+load_dyndb_schema() {
+    local schema_file="/usr/share/doc/bind9-dyndb-ldap/schema.ldif.gz"
+
+    # https://wiki.debian.org/LDAP/OpenLDAPSetup#DNS.2FBind9
+	zcat "${schema_file}" |
+        sed 's/^attributeTypes:/olcAttributeTypes:/;
+		     s/^objectClasses:/olcObjectClasses:/;
+		     1,/1.3.6.1.4.1.2428.20.0.0/ {/1.3.6.1.4.1.2428.20.0.0/!s/^/#/};
+		     1idn: cn=dns,cn=schema,cn=config\nobjectClass: olcSchemaConfig' |
+        ldapadd -Q -Y EXTERNAL -H ldapi:/// 
+}
+
+load_syncprov() {
+	ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
+dn: cn=module{0},cn=config
+changetype: modify
+add: olcModuleLoad
+olcModuleLoad: syncprov
+
+EOF
+
+	ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
+dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
+changeType: add
+objectClass: olcOverlayConfig
+objectClass: olcSyncProvConfig
+olcOverlay: syncprov
+olcSpCheckpoint: 100 10
+olcSpSessionLog: 100
+
+EOF
+}
+
+load_dns_data() {
+    ldapadd -x -D "${ldap_admin_dn}" -w "${ldap_admin_pw}" <<EOF
+dn: ou=dns,${ldap_suffix}
+objectClass: organizationalUnit
+objectClass: top
+ou: dns
+
+dn: idnsName=${mydomain},ou=dns,${ldap_suffix}
+objectClass: top
+objectClass: idnsZone
+objectClass: idnsRecord
+idnsName: ${mydomain}
+idnsZoneActive: TRUE
+idnsSOAmName: ${myhostname}.${mydomain}
+idnsSOArName: root.${myhostname}.${mydomain}
+idnsSOAserial: 1
+idnsSOArefresh: 10800
+idnsSOAretry: 900
+idnsSOAexpire: 604800
+idnsSOAminimum: 86400
+NSRecord: ${mydomain}.
+ARecord: 192.168.141.5
+
+dn: idnsName=${myhostname},idnsName=${mydomain},ou=dns,${ldap_suffix}
+objectClass: idnsRecord
+objectClass: top
+idnsName: ${myhostname}
+CNAMERecord: ${mydomain}.
+
+dn: idnsName=_ldap._tcp,idnsName=${mydomain},ou=dns,${ldap_suffix}
+objectClass: idnsRecord
+objectClass: top
+idnsName: _ldap._tcp
+SRVRecord: 0 100 389 ${myhostname}
+
+dn: idnsName=somehost,idnsName=${mydomain},ou=dns,${ldap_suffix}
+objectClass: idnsRecord
+objectClass: top
+ARecord: 192.168.141.6
+
+EOF
+}
+
+configure_dyndb() {
+    if ! grep -qE "ldap_zone" /etc/bind/named.conf.local; then
+        echo "include \"/etc/bind/named.conf.ldap_zone\";" >> /etc/bind/named.conf.local
+    fi
+    cat > /etc/bind/named.conf.ldap_zone <<EOF
+dyndb "ldap_zone" "/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null)/bind/ldap.so" {
+    uri "ldapi:///";
+    base "ou=dns,${ldap_suffix}";
+    auth_method "simple";
+    bind_dn "${ldap_bind9_dn}";
+    password "${ldap_bind9_pw}";
+};
+EOF
+    chmod 0640 /etc/bind/named.conf.ldap_zone
+    chgrp bind /etc/bind/named.conf.ldap_zone
+    echo "## Restarting bind9"
+    systemctl restart bind9.service
+}
+
+echo "## Adjust bind9's apparmor profile if needed"
+adjust_apparmor_profile
+
+echo "## Setting up slapd"
+setup_slapd "${mydomain}" "${ldap_admin_pw}"
+echo
+
+echo "## Configuring slapd logging"
+configure_slapd_logging
+echo
+
+echo "## Creating bind9 ldap uid"
+create_bind9_uid
+echo
+
+echo "## Loading bind9-dyndb-ldap schema"
+load_dyndb_schema
+echo
+
+echo "## Loading syncproc module"
+load_syncprov
+echo
+
+echo "## Loading DNS sample data"
+load_dns_data
+echo
+
+echo "## Configuring bind9 to use bind9-dyndb-ldap"
+configure_dyndb
+echo
+
+echo "## Checking DNS records"
+host "somehost.${mydomain}" 127.0.0.1
+echo
+host "${myhostname}.${mydomain}" 127.0.0.1
+echo
+host -t srv "_ldap._tcp.${mydomain}" 127.0.0.1
+echo
+host -t soa "${mydomain}" 127.0.0.1