Merge ~kstenerud/ubuntu/+source/bind9:bind9-rtld-deepbind-1769440 into ubuntu/+source/bind9:ubuntu/cosmic-devel

[Karl Stenerud]

Also in:

https://src.fedoraproject.org/rpms/bind/c/3d5ea105bd877f0069452e450320f8877b01cb52?branch=master
https://salsa.debian.org/dns-team/bind9/commit/afc6b5fe2e359e4e7eadc256cd94481965418b4b

 * RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb
    (LP: #1769440)

PPA: ppa:kstenerud/bind9-rtld-deepbind-1769440

Steps to test:

Failing Case:

# uvt-kvm create --memory 2048 cosmic-freeipa release=cosmic label=daily
# uvt-kvm wait cosmic-freeipa
# uvt-kvm ssh cosmic-freeipa

Inside vm:

# sudo su
# apt purge -y cloud-init
# echo "cosmic-freeipa.example.com" >/etc/hostname
# sed -i 's/127.0.1.1.*cosmic.*//g' /etc/hosts
# echo "$(ip addr | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/') cosmic-freeipa.example.com" >>/etc/hosts
# apt update
# apt dist-upgrade -y
# reboot
# apt install -y freeipa-server

* Default Kerberos realm: EXAMPLE.COM
* Kerberos servers: cosmic-freeipa.example.com
* Administrative server: cosmic-freeipa.example.com

Get machine's ip address. You'll be using the x.x.x.1 address for the DNS forwarder
# ip addr

# ipa-server-install --allow-zone-overlap

* Do you want to configure integrated DNS (BIND): YES
* Server host name: cosmic-freeipa.example.com
* Please confirm the domain name: example.com
* Please provide a realm name: EXAMPLE.COM
* Directory Manager password: (anything)
* IPA admin password: (anything)
* Do you want to configure DNS forwarders: yes
* Do you want to configure these servers as DNS forwarders?: no
* Enter an IP address for a DNS forwarder, or press Enter to skip: (x.x.x.1 address from before)
* Do you want to search for missing reverse zones?: yes

Installation should fail.

Passing case:

(Same instructions, except added the PPA with fix)

# uvt-kvm create --memory 2048 cosmic-freeipa release=cosmic label=daily
# uvt-kvm wait cosmic-freeipa
# uvt-kvm ssh cosmic-freeipa

Inside vm:

# sudo su
# apt purge -y cloud-init
# echo "cosmic-freeipa.example.com" >/etc/hostname
# sed -i 's/127.0.1.1.*cosmic.*//g' /etc/hosts
# echo "$(ip addr | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/') cosmic-freeipa.example.com" >>/etc/hosts
# add-apt-repository -y ppa:kstenerud/bind9-rtld-deepbind-1769440
# apt update
# apt dist-upgrade -y
# reboot
# apt install -y freeipa-server

* Default Kerberos realm: EXAMPLE.COM
* Kerberos servers: cosmic-freeipa.example.com
* Administrative server: cosmic-freeipa.example.com

Get machine's ip address. You'll be using the x.x.x.1 address for the DNS forwarder
# ip addr

# ipa-server-install --allow-zone-overlap

* Do you want to configure integrated DNS (BIND): YES
* Server host name: cosmic-freeipa.example.com
* Please confirm the domain name: example.com
* Please provide a realm name: EXAMPLE.COM
* Directory Manager password: (anything)
* IPA admin password: (anything)
* Do you want to configure DNS forwarders: yes
* Do you want to configure these servers as DNS forwarders?: no
* Enter an IP address for a DNS forwarder, or press Enter to skip: (x.x.x.1 address from before)
* Do you want to search for missing reverse zones?: yes

Installation should succeed.

Package Test Results:

debian/tests doesn't exist in bind9.

[Christian Ehrhardt  (paelzer)]

Hi Karl,
nothing totally critical but a lot of medium things that I'd want you to either change or explain in detail why they were don that way. See inline commends below ...

review: Needs Fixing

[Karl Stenerud (kstenerud)]

OK, so in this case what do I put in the description?

On Thu, Aug 30, 2018 at 10:08 AM, Andreas Hasenack <email address hidden>
wrote:

>
>
> Diff comments:
>
> > diff --git a/debian/patches/rtld-deepbind.patch b/debian/patches/rtld-
> deepbind.patch
> > new file mode 100644
> > index 0000000..8074431
> > --- /dev/null
> > +++ b/debian/patches/rtld-deepbind.patch
> > @@ -0,0 +1,21 @@
> > +Description: RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for
> dyndb
> > +Author: Karl Stenerud <email address hidden>
> > +Origin: https://pagure.io/fedora-bind/c/3d5ea105bd877f0069452e450320f8
> 877b01cb52?branch=master
>
> In this particular case, though, I don't think the patch is in any
> released debian package yet (at the time I write this)
>
> > +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/
> 1769440
> > +Last-Update: 2018-08-22
> > +---
> > +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
> > +diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
> > +index e21a84c7..ac18162c 100644
> > +--- a/lib/dns/dyndb.c
> > ++++ b/lib/dns/dyndb.c
> > +@@ -133,9 +133,6 @@ load_library(isc_mem_t *mctx, const char *filename,
> const char *instname,
> > + instname, filename);
> > +
> > + flags = RTLD_NOW|RTLD_LOCAL;
> > +-#ifdef RTLD_DEEPBIND
> > +- flags |= RTLD_DEEPBIND;
> > +-#endif
> > +
> > + handle = dlopen(filename, flags);
> > + if (handle == NULL)
>
>
> --
> https://code.launchpad.net/~kstenerud/ubuntu/+source/
> bind9/+git/bind9/+merge/354002
> You are the owner of ~kstenerud/ubuntu/+source/bind9:bind9-rtld-deepbind-
> 1769440.
>

[Andreas Hasenack (ahasenack)]

Say it's committed in Debian, and give the url.

bd16d30... by Karl Stenerud on 2018-08-30

  * Add a patch to fix named-pkcs11 crashing on startup. (LP: #1769440)

[Christian Ehrhardt  (paelzer)]

On Thu, Aug 30, 2018 at 9:25 PM Andreas Hasenack <email address hidden>
wrote:

> Say it's committed in Debian, and give the url.

The URL into salsa is particularly useful as the hash of the commit can be
used with branch/tag --contains.

BTW also if a file is already released (not in this case) by Debian you
could as well just do "git log -- <path>" which will show you just the
importer tags touching it (easier than reading changelogs, especially since
there is no guarantee how they have mentioned it in there).

[Christian Ehrhardt  (paelzer)]

All my former feedback is implemented (thanks!) except one:

A patch referring prefix in changelog like:

* d/p/rtld-deepbind.patch: RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb (LP: #1769440

This is close to being "style" and therefore optional in case you request me to accept it as-is, but usually we'd do it that way so would you mind adapting that or explain why not?

review: Needs Information

7369344... by Karl Stenerud on 2018-08-31

changelog

[Karl Stenerud (kstenerud)]

OK, changelog should be correct I think

[Christian Ehrhardt  (paelzer)]

Yep, things looking good now.
+1

review: Approve

[Christian Ehrhardt  (paelzer)]

tag pushed so anyone can upload.
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/bind9
 * [new tag] upload/1%9.11.4+dfsg-3ubuntu2 -> upload/1%9.11.4+dfsg-3ubuntu2

Waiting for the sponsoring itself for a confirming ping (or to anybody else who can sponsor as it is ready as-is).

[Karl Stenerud (kstenerud)]

Go ahead

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading bind9_9.11.4+dfsg-3ubuntu2.dsc: done.
  Uploading bind9_9.11.4+dfsg-3ubuntu2.debian.tar.xz: done.
  Uploading bind9_9.11.4+dfsg-3ubuntu2_source.buildinfo: done.
  Uploading bind9_9.11.4+dfsg-3ubuntu2_source.changes: done.
Successfully uploaded packages.

Since -dev is instant accepted I'm setting merged, please track proposed migration

diff --git a/debian/changelog b/debian/changelog
index ee9789e..a39e52f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+bind9 (1:9.11.4+dfsg-3ubuntu2) cosmic; urgency=medium
+
+  * d/p/skip-rtld-deepbind-for-dyndb.diff: Add a patch to fix named-pkcs11
+    crashing on startup. (LP: #1769440)
+
+ -- Karl Stenerud <[e-mail]>  Thu, 30 Aug 2018 07:11:39 -0700
+
 bind9 (1:9.11.4+dfsg-3ubuntu1) cosmic; urgency=medium
 
   * Merge with Debian unstable. Remaining changes:
diff --git a/debian/patches/series b/debian/patches/series
index 9e7ba15..74a3926 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@
 75_ctxstart_no_sighandling.diff
 80_reproducible_build.diff
 Add_--install-layout=deb_to_setup.py_call.patch
+skip-rtld-deepbind-for-dyndb.diff
diff --git a/debian/patches/skip-rtld-deepbind-for-dyndb.diff b/debian/patches/skip-rtld-deepbind-for-dyndb.diff
new file mode 100644
index 0000000..f9e2b0e
--- /dev/null
+++ b/debian/patches/skip-rtld-deepbind-for-dyndb.diff
@@ -0,0 +1,23 @@
+Description: RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb
+Author: Karl Stenerud <[e-mail]>
+Origin: https://salsa.debian.org/dns-team/bind9/commit/afc6b5fe2e359e4e7eadc256cd94481965418b4b
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/1769440
+Forwarded: no
+Description: This is a Distro only patch that won't be forwarded and is in Debian.
+Last-Update: 2018-08-30
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
+index e21a84c7..ac18162c 100644
+--- a/lib/dns/dyndb.c
++++ b/lib/dns/dyndb.c
+@@ -133,9 +133,6 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
+ 		      instname, filename);
+ 
+ 	flags = RTLD_NOW|RTLD_LOCAL;
+-#ifdef RTLD_DEEPBIND
+-	flags |= RTLD_DEEPBIND;
+-#endif
+ 
+ 	handle = dlopen(filename, flags);
+ 	if (handle == NULL)