Merge ~ahasenack/ubuntu/+source/realmd:jammy-realmd-merge into ubuntu/+source/realmd:debian/sid

[Andreas Hasenack]

Merge from debian, which updated to the latest upstream release. Upstream has all the patches but one that is ubuntu/debian specific. I'll try to send that to debian again after this.

I also grabbed two more simple fixes from upstream's git repo which I thought were useful. I'll also submit them to debian, but they will be in the next upstream release anyway, so this added delta is not indefinite anyway.

Testing. Well, that requires an AD server. I'm working on getting one up and running again in a VM, but that will take a bit of time. But will be useful for another realmd bug I plan to tackle next, #1905000.

[Andreas Hasenack (ahasenack)]

While testing, I found a cyrus-sasl2 bug (#1956833), for which I have an MP up as well.

[Utkarsh Gupta (utkarsh)]

Hello,

I'll take a stab at this.

[Utkarsh Gupta (utkarsh)]

Looks good, thank you, Andreas. Few pointers though:

-> You could use `quilt refresh` after applying the patch, that'll remove unnecessary details. Completely optional but we generally want to do that, I think.

-> I think we can really make this a sync at some point and that'd be great! The two newly added changes will already be merged in Debian so I don't think you need to send that but brownie points if you do. As for the Debian/Ubuntu specific one, I think we should so the next merge can be a sync. I know it's already on your radar to send this (as noted in the description) but I feel if you can do this before uploading, then you can also add those DEP3 headers (Forwarded one) and also add a link to the MR in the git commit but I know you have this thought out.

-> Since all of them are minor, I am approving this with two additional comments below. \o/

review: Approve

[Andreas Hasenack (ahasenack)]

I'm recently taking the approach of only submitting to debian after it passed our review, to avoid going back and forth with updates here in LP and also in salsa or the debian bug. And then when debian makes comments, I have to update the MP here in LP with them. Keeping both proposals up at the same time can be difficult because of that.

b85f911... by Andreas Hasenack on 2022-01-12

DEP3 update for dont-add-services-line.patch

5858754... by Andreas Hasenack on 2022-01-12

Drop "ubuntu specific" comment from d/p/series

7222508... by Andreas Hasenack on 2022-01-12

Rename the patch to follow the pattern

22c110e... by Andreas Hasenack on 2022-01-12

Changelog update about the patch rename

[Andreas Hasenack (ahasenack)]

The other two new added patches I submitted to debian via salsa PRs:

https://salsa.debian.org/utopia-team/realmd/-/merge_requests/2

[Christian Ehrhardt  (paelzer)]

On Wed, Jan 12, 2022 at 1:27 PM Utkarsh Gupta
<email address hidden> wrote:
>
> -> You could use `quilt refresh` after applying the patch, that'll remove unnecessary details. Completely optional but we generally want to do that, I think.

Umm, IIRC in case a patch from a remote source applies as-is we
usually do not refresh it so everyone can easily spot it is "the same"
(other than adding headers).
If we touch it anyway, then yes refreshing to the common format is helpful.
But anyway - all of that is somewhat soft and not a hard rule either way.

[Utkarsh Gupta (utkarsh)]

Hello,

This looks good, thanks, Andreas.

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded (after another quick test of this, to avoid a brown paper bag bug ;).

diff --git a/debian/changelog b/debian/changelog
index c8e4a0a..b775d0d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,73 @@
+realmd (0.17.0-1ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946896). Remaining changes:
+    - d/p/dont-add-services-line.patch: in Ubuntu and Debian, the sssd_*
+      services are socket activated and don't need a "services" line in
+      sssd.conf (LP #1880157)
+  * Dropped (all applied upstream):
+    - d/p/0001-LDAP-don-t-close-LDAP-socket-twice.patch: don't close LDAP
+      socket twice.
+    - d/p/0001-Fix-man-page-reference-in-systemd-service-file.patch: the
+      manpage is realm(8), not realmd(8)
+    - d/p/0001-Use-current-idmap-options-for-smb.conf.patch: use the
+      idmap options in smb.conf for modern versions of samba (LP #1894153)
+    - d/p/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch: find
+      NetBIOS name in keytab while leaving the domain (LP #1894340)
+    - d/p/0001-Fix-issues-found-by-Coverity.patch: fix issues found by
+      Coverity
+    - d/p/0002-Change-qualified-names-default-for-IPA.patch: change
+      qualified names default for IPA
+    - d/p/0003-discover-try-to-get-domain-name-from-hostname.patch: if
+      there is no domain name returned by DHCP check if the hostname
+      contains a domain part and use this to discover a realm.
+    - d/p/0001-IPA-do-not-call-sssd-enable-logins.patch: IPA: do not call
+      sssd-enable-logins
+    - d/p/0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch:
+      install the latest version of a package when resolving packages with
+      PackageKit
+    - d/p/0001-doc-make-sure-cross-reference-ids-are-predictable.patch: make
+      sure cross-reference ids are predictable
+    - d/p/0002-tools-remove-duplicated-va_start.patch: remove duplicated
+      va_start()
+    - d/p/0003-service-remove-dead-code.patch: remove unused code
+    - d/p/0004-service-check-return-value-of-fcntl.patch: check return
+      value of fcntl()
+    - d/p/0005-service-avoid-dereference-of-a-null-pointer.patch: avoid
+      dereference of a null pointer
+    - d/p/0006-service-avoid-dereferencing-a-NULL-pointer.patch: avoid
+      dereferencing a NULL pointer
+    - d/p/0001-Add-missing-xsl-file-to-Makefile.am.patch: add missing xsl
+      file to Makefile.am
+    - d/p/0002-configure-do-not-inherit-DISTRO-from-the-environment.patch:
+      do not inherit DISTRO from the environment
+    - d/p/0003-doc-extend-user-principal-section.patch: doc: extend
+      user-principal section
+    - d/p/0004-doc-fix-discover-name-only.patch: doc: fix discover
+      name-only parameter
+    - d/p/0005-doc-add-see-also-to-man-pages.patch: doc: add see also to
+      man pages
+    - d/p/0006-doc-extend-description-of-config-handling.patch: doc: extend
+      description of config handling
+    - d/p/0007-service-use-kerberos-method-secrets-and-keytab.patch: when
+      using Samba with Winbind, set "kerberos method" to "secrets and keytab"
+    - d/p/install-libnss-winbind.patch: install libnss-winbind when needed
+      (LP #1894150)
+    - d/p/0002-Use-startTLS-with-FreeIPA.patch: attempt StartTLS first
+      when talking to FreeIPA
+    - d/p/0004-service-use-additional-dns-hostnames-with-net-ads-jo.patch:
+      when using samba to join a domain, and the client is from a different
+      domain, also set "additional dns hostnames"
+    - d/p/0003-service-use-net-ads-join-with-k-for-user-join-as-wel.patch:
+      when joining using samba, try kerberos auth first and fallback to
+      ntlm as before
+  * Added changes:
+    - d/p/03_ldap-discovery-socket-timeout.patch: use a shorter timeout
+      for the unbind request sent when finishing up the discovery phase
+    - d/p/04_add-computer-name-to-manpage.patch: document the existing
+      --computer-name command line option
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 06 Jan 2022 17:39:36 +0000
+
 realmd (0.17.0-1) unstable; urgency=medium
 
   * debian/watch: Update the URL and point to the git releases
@@ -8,6 +78,75 @@ realmd (0.17.0-1) unstable; urgency=medium
 
  -- Laurent Bigonville <[e-mail]>  Mon, 16 Aug 2021 15:35:48 +0200
 
+realmd (0.16.3-3ubuntu2) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 18:08:26 -0400
+
+realmd (0.16.3-3ubuntu1) groovy; urgency=medium
+
+  * d/p/0001-LDAP-don-t-close-LDAP-socket-twice.patch: don't close LDAP
+    socket twice.
+  * d/p/0001-Fix-man-page-reference-in-systemd-service-file.patch: the
+    manpage is realm(8), not realmd(8)
+  * d/p/0001-Use-current-idmap-options-for-smb.conf.patch: use the
+    idmap options in smb.conf for modern versions of samba (LP: #1894153)
+  * d/p/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch: find
+    NetBIOS name in keytab while leaving the domain (LP: #1894340)
+  * d/p/0001-Fix-issues-found-by-Coverity.patch: fix issues found by
+    Coverity
+  * d/p/0002-Change-qualified-names-default-for-IPA.patch: change
+    qualified names default for IPA
+  * d/p/0003-discover-try-to-get-domain-name-from-hostname.patch: if
+    there is no domain name returned by DHCP check if the hostname
+    contains a domain part and use this to discover a realm.
+  * d/p/0001-IPA-do-not-call-sssd-enable-logins.patch: IPA: do not call
+    sssd-enable-logins
+  * d/p/0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch:
+    install the latest version of a package when resolving packages with
+    PackageKit
+  * d/p/0001-doc-make-sure-cross-reference-ids-are-predictable.patch: make
+    sure cross-reference ids are predictable
+  * d/p/0002-tools-remove-duplicated-va_start.patch: remove duplicated
+    va_start()
+  * d/p/0003-service-remove-dead-code.patch: remove unused code
+  * d/p/0004-service-check-return-value-of-fcntl.patch: check return
+    value of fcntl()
+  * d/p/0005-service-avoid-dereference-of-a-null-pointer.patch: avoid
+    dereference of a null pointer
+  * d/p/0006-service-avoid-dereferencing-a-NULL-pointer.patch: avoid
+    dereferencing a NULL pointer
+  * d/p/0001-Add-missing-xsl-file-to-Makefile.am.patch: add missing xsl
+    file to Makefile.am
+  * d/p/0002-configure-do-not-inherit-DISTRO-from-the-environment.patch:
+    do not inherit DISTRO from the environment
+  * d/p/0003-doc-extend-user-principal-section.patch: doc: extend
+    user-principal section
+  * d/p/0004-doc-fix-discover-name-only.patch: doc: fix discover
+    name-only parameter
+  * d/p/0005-doc-add-see-also-to-man-pages.patch: doc: add see also to
+    man pages
+  * d/p/0006-doc-extend-description-of-config-handling.patch: doc: extend
+    description of config handling
+  * d/p/0007-service-use-kerberos-method-secrets-and-keytab.patch: when
+    using Samba with Winbind, set "kerberos method" to "secrets and keytab"
+  * d/p/install-libnss-winbind.patch: install libnss-winbind when needed
+    (LP: #1894150)
+  * d/p/05_dont-add-services-line.patch: in Ubuntu and Debian, the sssd_*
+    services are socket activated and don't need a "services" line in
+    sssd.conf (LP: #1880157)
+  * d/p/0004-service-use-additional-dns-hostnames-with-net-ads-jo.patch:
+    when using samba to join a domain, and the client is from a different
+    domain, also set "additional dns hostnames"
+  * d/p/0002-Use-startTLS-with-FreeIPA.patch: attempt StartTLS first
+    when talking to FreeIPA
+  * d/p/0003-service-use-net-ads-join-with-k-for-user-join-as-wel.patch:
+    when joining using samba, try kerberos auth first and fallback to
+    ntlm as before
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 08 Sep 2020 15:15:12 -0300
+
 realmd (0.16.3-3) unstable; urgency=medium
 
   [ Andreas Henriksson ]
diff --git a/debian/control b/debian/control
index a2446b1..6d16592 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: realmd
 Section: admin
 Priority: optional
-Maintainer: Utopia Maintenance Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Utopia Maintenance Team <[e-mail]>
 Uploaders: Laurent Bigonville <[e-mail]>
 Build-Depends: debhelper (>= 12),
                intltool (>= 0.35.0),
diff --git a/debian/patches/03_ldap-discovery-socket-timeout.patch b/debian/patches/03_ldap-discovery-socket-timeout.patch
new file mode 100644
index 0000000..aec5668
--- /dev/null
+++ b/debian/patches/03_ldap-discovery-socket-timeout.patch
@@ -0,0 +1,76 @@
+commit 370bf84857d5674a092f46fa5932a0c92ad5bbf5
+Author: Sumit Bose <[e-mail]>
+Date:   Wed Nov 24 17:25:18 2021 +0100
+
+    ldap: add socket timeout
+    
+    During the discovery phase realmd tries to open LDAP connections to
+    multiple DC addresses returned by DNS. When cleaning up we have to call
+    ldap_destroy() to release the resources allocated for the LDAP context.
+    ldap_destroy() tries to send a LDAP unbind request independent of the
+    connection state. If the related address is block by a firewall or a not
+    properly routed IPv6 address there might be no reply on the TCP level
+    and the request might be stuck for quite some tome in the kernel.
+    
+    To avoid the unexpected long delays will block realmd this patch lowers
+    the timeout considerably to 5s. As multiple other timeouts this value is
+    currently hardcoded.
+    
+    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1817869
+
+Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1817869
+Origin: upstream, https://gitlab.freedesktop.org/realmd/realmd/-/commit/370bf84857d5674a092f46fa5932a0c92ad5bbf5
+Last-Update: 2022-01-06
+diff --git a/service/realm-ldap.c b/service/realm-ldap.c
+index bdfb96c..f7b6d13 100644
+--- a/service/realm-ldap.c
++++ b/service/realm-ldap.c
+@@ -22,6 +22,7 @@
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <netinet/in.h>
++#include <netinet/tcp.h>
+ 
+ #include <errno.h>
+ 
+@@ -179,6 +180,7 @@ static GSourceFuncs socket_source_funcs = {
+ 
+ /* Not included in ldap.h but documented */
+ int ldap_init_fd (ber_socket_t fd, int proto, LDAP_CONST char *url, struct ldap **ldp);
++#define LDAP_SOCKET_TIMEOUT 5
+ 
+ GSource *
+ realm_ldap_connect_anonymous (GSocketAddress *address,
+@@ -202,6 +204,8 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
+ 	int opt_rc;
+ 	int ldap_opt_val;
+ 	const char *errmsg = NULL;
++	struct timeval tv = {LDAP_SOCKET_TIMEOUT, 0};
++	unsigned int milli = LDAP_SOCKET_TIMEOUT * 1000;
+ 
+ 	g_return_val_if_fail (G_IS_INET_SOCKET_ADDRESS (address), NULL);
+ 
+@@ -244,6 +248,23 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
+ 		if (!g_unix_set_fd_nonblocking (ls->sock, FALSE, NULL))
+ 			g_warning ("couldn't set to blocking");
+ 
++		/* Lower the kernel defaults which might be minutes to hours */
++		rc = setsockopt (ls->sock, SOL_SOCKET, SO_RCVTIMEO,
++		                 &tv, sizeof (tv));
++		if (rc != 0) {
++			g_warning ("couldn't set SO_RCVTIMEO");
++		}
++		rc = setsockopt (ls->sock, SOL_SOCKET, SO_SNDTIMEO,
++		                 &tv, sizeof (tv));
++		if (rc != 0) {
++			g_warning ("couldn't set SO_SNDTIMEO");
++		}
++		rc = setsockopt (ls->sock, IPPROTO_TCP, TCP_USER_TIMEOUT,
++		                 &milli, sizeof (milli));
++		if (rc != 0) {
++			g_warning ("couldn't set TCP_USER_TIMEOUT");
++		}
++
+ 		if (family == G_SOCKET_FAMILY_IPV4) {
+ 			url = g_strdup_printf ("%s://%s:%d",
+ 			                       use_ldaps ? "ldaps" : "ldap",
diff --git a/debian/patches/04_add-computer-name-to-manpage.patch b/debian/patches/04_add-computer-name-to-manpage.patch
new file mode 100644
index 0000000..539cb32
--- /dev/null
+++ b/debian/patches/04_add-computer-name-to-manpage.patch
@@ -0,0 +1,32 @@
+commit 05100771ea6bd775caae705bb53f76a0816f3b81
+Author: Sumit Bose <[e-mail]>
+Date:   Tue May 11 11:13:06 2021 +0200
+
+    doc: add computer-name to realm man page
+
+Origin: upstream, https://gitlab.freedesktop.org/realmd/realmd/-/commit/05100771ea6bd775caae705bb53f76a0816f3b81
+Last-Update: 2022-01-06
+diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
+index 9160a8a..b4dc27c 100644
+--- a/doc/manual/realm.xml
++++ b/doc/manual/realm.xml
+@@ -222,6 +222,19 @@ $ realm join --user=admin --computer-ou=OU=Special domain.example.com
+ 			supported for all realms. By default the membership software
+ 			is automatically selected.</para></listitem>
+ 		</varlistentry>
++		<varlistentry>
++			<term><option>--computer-name=xxx</option></term>
++			<listitem>
++				<para>This option only applies to Active
++				Directory realms. Specify this option to
++				override the default name used when creating
++				the computer account. The system's FQDN will
++				still be saved in the dNSHostName attribute.</para>
++				<para>Specify the name as a string of 15 or
++				fewer characters that is a valid NetBIOS
++				computer name.</para>
++			</listitem>
++		</varlistentry>
+ 		<varlistentry>
+ 			<term><option>--no-password</option></term>
+ 			<listitem><para>Perform the join automatically without
diff --git a/debian/patches/05_dont-add-services-line.patch b/debian/patches/05_dont-add-services-line.patch
new file mode 100644
index 0000000..2cdc1a5
--- /dev/null
+++ b/debian/patches/05_dont-add-services-line.patch
@@ -0,0 +1,49 @@
+Description: Don't add the services line to sssd.conf
+ In Ubuntu and Debian, the sssd services (like nss, pam, pac, etc) are socket
+ activated and should not be listed in the services line, as they will be
+ started on demand by systemd.
+Author: Andreas Hasenack <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1880157
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003620
+Forwarded: https://lists.fedorahosted.org/archives/list/[e-mail]/thread/JC3N3DBSMHZSA66IPLGAMBSXLCTYXWJR/
+Last-Update: 2022-01-12
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/service/realm-sssd-config.c
++++ b/service/realm-sssd-config.c
+@@ -130,7 +130,6 @@
+ 	gchar **already;
+ 	gboolean ret;
+ 	gchar *section;
+-	const gchar *services[] = { "nss", "pam", NULL };
+ 	va_list va;
+ 	gint i;
+ 
+@@ -155,7 +154,6 @@
+ 	g_strfreev (already);
+ 
+ 	/* Setup a default sssd section */
+-	realm_ini_config_set_list_diff (config, "sssd", "services", ", ", services, NULL);
+ 	if (!realm_ini_config_have (config, "sssd", "config_file_version"))
+ 		realm_ini_config_set (config, "sssd", "config_file_version", "2", NULL);
+ 
+--- a/tests/test-sssd-config.c
++++ b/tests/test-sssd-config.c
+@@ -90,7 +90,7 @@
+                  gconstpointer unused)
+ {
+ 	const gchar *data = "[domain/one]\nval=1\n[sssd]\ndomains=one";
+-	const gchar *check = "[domain/one]\nval=1\n[sssd]\ndomains = one, two\nconfig_file_version = 2\nservices = nss, pam\n\n[domain/two]\ndos = 2\n";
++	const gchar *check = "[domain/one]\nval=1\n[sssd]\ndomains = one, two\nconfig_file_version = 2\n\n[domain/two]\ndos = 2\n";
+ 	GError *error = NULL;
+ 	gchar *output;
+ 	gboolean ret;
+@@ -140,7 +140,7 @@
+ test_add_domain_only (Test *test,
+                       gconstpointer unused)
+ {
+-	const gchar *check = "\n[sssd]\ndomains = two\nconfig_file_version = 2\nservices = nss, pam\n\n[domain/two]\ndos = 2\n";
++	const gchar *check = "\n[sssd]\ndomains = two\nconfig_file_version = 2\n\n[domain/two]\ndos = 2\n";
+ 	GError *error = NULL;
+ 	gchar *output;
+ 	gboolean ret;
diff --git a/debian/patches/series b/debian/patches/series
index 00e862d..ee5278d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,5 @@
 01_freeipa_section.patch
 02_cross.patch
+03_ldap-discovery-socket-timeout.patch
+04_add-computer-name-to-manpage.patch
+05_dont-add-services-line.patch