Merge ~ahasenack/ubuntu/+source/bind9:bind9-nsupdate-gssapi-1755439 into ubuntu/+source/bind9:ubuntu/devel

[Andreas Hasenack]

Grabbed upstream fix for nsupdate when using kerberos/gssapi against a microsoft DNS server in an AD controller. This was first reported in the sssd mailing list (https://<email address hidden>/thread/OHSTI2VHQKDKKDNVITOIHBOT47RFRP5R/) and then a bug report in launchpad (https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1755439).

There is no new upstream bind release with the fix yet, it's just in their git.

Testing this against an actual AD server will be a bit time consuming. I prepared test packages and uploaded them to https://launchpad.net/~ahasenack/+archive/ubuntu/bind9-nsupdate-gssapi-windows-1755439/ and asked the reporter to give them a try in his environment.

I did a simple kerberized nsupdate test with a local bind9 server and that worked:
ubuntu@bionic-bind9-nsupdate:~$ kinit
Password for ubuntu@LXD:

ubuntu@bionic-bind9-nsupdate:~$ nsupdate -g
> server 127.0.0.1
> update add xenial.lxd. 120 TXT "Goodbye from kerberos"
> send

ubuntu@bionic-bind9-nsupdate:~$ dig @127.0.0.1 -t txt xenial.lxd +short
"Goodbye from kerberos"

ubuntu@bionic-bind9-nsupdate:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: ubuntu@LXD

Valid starting Expires Service principal
03/14/18 15:02:21 03/15/18 01:02:21 krbtgt/LXD@LXD
        renew until 03/15/18 15:02:20
03/14/18 15:02:45 03/15/18 01:02:21 DNS/lxd@LXD
        renew until 03/15/18 15:02:20

[Christian Ehrhardt  (paelzer)]

As discussed testing is up to you and the reporter.
Packaging wise this looks good - and I didn't find issues doing some simple tests with it.
Also ran the qa regression suite on it and all were good (16 tests good, except 2 due to ipv6 not avail in my env).
Further ran the integrated unit tests against a rebuild from your source.
    216 R:PASS
      5 R:SKIPPED
      1 R:UNTESTED

I also wanted to mention that this is not entirely new code.
As it is "Restore workaround for Microsoft Windows TSIG ...".
Which makes it slightly better than a random new change.

Presuming the reporter tests it ok from your ppa.

Approve (under the condition that it was tested for the reported issue before upload).

review: Approve

[Andreas Hasenack (ahasenack)]

Rebased on top of 1:9.11.2.P1-1ubuntu4 which was uploaded to the archive yesterday.

[Christian Ehrhardt  (paelzer)]

The reporter has checked the ppa and is ok with it (as we have a hard time testing it).
Did some minor rechecks if versions still are ok and such, but the rebase was good.

As discussed on IRC tagged, pushed and sponsored.

diff --git a/debian/changelog b/debian/changelog
index ddac13c..4e31f03 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+bind9 (1:9.11.2.P1-1ubuntu5) bionic; urgency=medium
+
+  * debian/patches/nsupdate-gssapi-fails-ad-45854.patch: fix updating
+    DNS records in Microsoft AD using GSSAPI.  Thanks to Mark Andrews
+    <[e-mail]>. (LP: #1755439)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 16 Mar 2018 09:38:46 -0300
+
 bind9 (1:9.11.2.P1-1ubuntu4) bionic; urgency=medium
 
   * Fix apparmor profile filename (LP: #1754981)
diff --git a/debian/patches/nsupdate-gssapi-fails-ad-45854.patch b/debian/patches/nsupdate-gssapi-fails-ad-45854.patch
new file mode 100644
index 0000000..50e1ca6
--- /dev/null
+++ b/debian/patches/nsupdate-gssapi-fails-ad-45854.patch
@@ -0,0 +1,21 @@
+Description: fix updating DNS records in Microsoft AD using GSSAPI
+ Restore workaround for Microsoft Windows TSIG hash computation bug.
+Author: Mark Andrews <[e-mail]>
+Origin: upstream, https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=a8a20462b516b0cc39e9b1fb1a8dd514eb1aed29
+Bug: https://bugs.isc.org/Public/Bug/Display.html?id=45854
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1755439
+Last-Update: 2018-03-14
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/lib/dns/rdataset.c
++++ b/lib/dns/rdataset.c
+@@ -467,6 +467,9 @@
+ 	dns_name_copy(owner_name, name, NULL);
+ 	dns_rdataset_getownercase(rdataset, name);
+ 
++	if ((owner_name->attributes & DNS_NAMEATTR_NOCOMPRESS) != 0)
++		name->attributes |= DNS_NAMEATTR_NOCOMPRESS;
++
+ 	do {
+ 		/*
+ 		 * Copy out the name, type, class, ttl.
diff --git a/debian/patches/series b/debian/patches/series
index bddc35c..af40ba4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@ Add_--install-layout=deb_to_setup.py_call.patch
 0012-Use-stdatomic.h-in-acache-code-46085.patch
 0013-Check-if-latomic-is-needed-to-handle-64-bit-stdatomi.patch
 add-ply-dependency-to-python-scripts.patch
+nsupdate-gssapi-fails-ad-45854.patch