Merge ~lvoytek/ubuntu/+source/open-isns:open-isns-101-update-jammy into ubuntu/+source/open-isns:ubuntu/devel

[Lena Voytek]

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/open-isns-101-update-jammy

Updating to version 0.101 through a patch file until the version bump is approved in Debian, then this will become a sync. https://salsa.debian.org/linux-blocks-team/open-isns/-/merge_requests/2

Package test result:

autopkgtest [13:31:11]: @@@@@@@@@@@@@@@@@@@@ summary
server PASS
discoveryd PASS
auth PASS

[Christian Ehrhardt  (paelzer)]

Hmm, maybe I'm just blind to see the reason for "through a patch file until the version bump is approved in Debian", but could you explain why this can't just be 0.101-0ubuntu1 with proper orig tarball based on 0.101?

In the past Debian was rather slow at acting on that package, so I'd not expect things soon.
Which would make a "0.100-but-actually-0.101-we-are-not-tellng-you" version to stay around rather long.

Did you had a chance to check if the 0.101 version could work without my debian/patches/no-werror.patch? If it does, please drop it.

Oh and if you agree, just start the CL with "Merge 0.101 from upstream, remaining changes:"

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Arr, I consumed the canonical-server slot, could you please re-add one?

[Lena Voytek (lvoytek)]

Ah that's fair, I can use a 0.101 tarball and update the version for this then. The new version does work without the no-werror patch. It even contains the other three patches too so they can all be removed with the version bump

[Christian Ehrhardt  (paelzer)]

Sounds good, ping back here once that is ready for re-review then.

[Lena Voytek (lvoytek)]

I reuploaded using uscan and extraction of the 0.101 tar alongside adding the new version in the changelog. Confirmed dep-8 tests still work and builds succeeded in the ppa

[Christian Ehrhardt  (paelzer)]

This will have some bonus-fun with the coming openssl3.1 but is ok for now:

pki.c:184:9: warning: ‘EVP_PKEY_get0_DSA’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]

[Christian Ehrhardt  (paelzer)]

Double checked the git with upstream tar content, matches

[Christian Ehrhardt  (paelzer)]

One finding, "bf3ff8a Merge 0.101 from upstream" pretends to be just upstream 0.101
But I found that it also adds the same content twice via debian/patches/version-101-update.patch
Only to remove it later via "2641a04 Remove patches fixed in version 0.101"

This is some useless back and forth that for clarity should be removed from "bf3ff8a Merge 0.101 from upstream".

If it is just that I can clean it up while sponsoring, let us see if I find more ...

[Christian Ehrhardt  (paelzer)]

Tests, Builds, Bug references, Changelog, ... all that LGTM.

I checked (a common case on new upstream versions) if we'd need to bump d/copyright.
But interestingly there was no bump in the upstream source v0.100->v0.101, so that should be fine as is.

One thing that I saw was that upstream added a man-page and that is great, but we usually want to ensure it is installed. The new file is doc/isnssetup.8.
I see the build does
  /usr/bin/install -c -m 644 ./doc/isnssetup.8 /<<PKGBUILDDIR>>/debian/tmp/usr/share/man/man8

But it isn't picked up by the packaging and not in the binary package.
But that led me to this trail - and after a check I found a few things to be missing:

1. the isnssetup helpe rscript, directly available in the source probably a good candidate for either open-isns-utils in /usr/sbin/ along the other admin tools, or at least as example in /usr/share/doc/open-isns-utils/. I guess /usr/sbin along the others is more expected.
2. along that script the man page ./doc/isnssetup.8

3. There also is isnsd.socket which could be installed along the .service
   Looking at the .service made me shiver as a lot of things might be discussed, but right now we
   only want to package 0.101 as-is.

[Christian Ehrhardt  (paelzer)]

So to sum it up, the rebase to upload an 0.101-0ubuntu1 looks mostly good - thanks!

The following things I'd ask for:
1. do not add and later remove debian/patches/version-101-update.patch
2. please let us install the new script, man page and .socket file
3. We are not in a hurry, maybe once we have that ready and team-reviewed have a look at sending a PR of the same to Debian?

If in January Debian did reply and upload it, we can make it a sync.
If not we can upload it to Ubuntu for now.

review: Needs Fixing

[Lena Voytek (lvoytek)]

Removed version-101-update.patch from all commits, thanks for spotting that. Working on the script, man page and socket file now

[Lena Voytek (lvoytek)]

Added script, doc, and socket to install

[Christian Ehrhardt  (paelzer)]

Checked upgrade installs (had the service, but not the socket)

root@j-proposed:~# systemctl status isnsd
● isnsd.service - iSNS server
     Loaded: loaded (/lib/systemd/system/isnsd.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2021-12-16 06:30:24 UTC; 24s ago
TriggeredBy: ○ isnsd.socket
       Docs: man:isnsd(8)
             man:isnsd.conf(5)
   Main PID: 106675 (isnsd)
      Tasks: 1 (limit: 38266)
     Memory: 1.0M
     CGroup: /system.slice/isnsd.service
             └─106675 /usr/sbin/isnsd

Dec 16 06:30:24 j-proposed systemd[1]: Starting iSNS server...
Dec 16 06:30:24 j-proposed systemd[1]: Started iSNS server.
Dec 16 06:30:24 j-proposed isnsd[106675]: SLP support disabled in this build
root@j-proposed:~# systemctl status isnsd.socket
○ isnsd.socket
     Loaded: loaded (/lib/systemd/system/isnsd.socket; enabled; vendor preset: enabled)
     Active: inactive (dead)
   Triggers: ● isnsd.service
     Listen: /run/isnsctl (Stream)
             [::]:3205 (Stream)

Service stays running (good), socket stays off (good as it would be a crash otherwise).

Also no complains on the install
Setting up open-isns-server (0.101-0ubuntu1~ppa4) ...
Created symlink /etc/systemd/system/sockets.target.wants/isnsd.socket → /lib/systemd/system/isnsd.socket.
Setting up open-isns-discoveryd (0.101-0ubuntu1~ppa4) ...

[Christian Ehrhardt  (paelzer)]

Checked new installs of the new version:

...

Unpacking open-isns-server (0.101-0ubuntu1~ppa4) ...
Setting up open-isns-server (0.101-0ubuntu1~ppa4) ...
Generating DSA parameters; this may take a while
+++++++++++++.++.+++++++++++++++++++++.+++++.++.++++++.+.+++.+++.++++.++++++++++.++++++++++.++++.+++++++++++++++.+++.++++++.++++.+++++++++++++.+++++++++.+.++.++.++.+.++.......................
........................................../++++.+.+.+++++++++++++++.+.+++.++++++++++++.+++++++.++++++++++++.+.++.+++.++++++++++++.+++++++++++++.++++++.++.+.++.+.+++++++++++++.++++++.+++++++.+
.++.++++++++++.+.+.++++++.+.++++.+.+++.++++.+++++++.+.+++.+.++++++++++.++.++.++.+++.+++.+++++++++.+++++++++++.+++++++.+.+++++................................................................./
Stored private key in /etc/isns/auth_key
Stored private key in /etc/isns/auth_key.pub
Created symlink /etc/systemd/system/multi-user.target.wants/isnsd.service → /lib/systemd/system/isnsd.service.
Created symlink /etc/systemd/system/sockets.target.wants/isnsd.socket → /lib/systemd/system/isnsd.socket.
...

root@j-proposed:~# systemctl status isnsd.socket isnsd.service
○ isnsd.socket
     Loaded: loaded (/lib/systemd/system/isnsd.socket; enabled; vendor preset: enabled)
     Active: inactive (dead)
   Triggers: ● isnsd.service
     Listen: /run/isnsctl (Stream)
             [::]:3205 (Stream)

● isnsd.service - iSNS server
     Loaded: loaded (/lib/systemd/system/isnsd.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2021-12-16 06:31:35 UTC; 11s ago
TriggeredBy: ○ isnsd.socket
       Docs: man:isnsd(8)
             man:isnsd.conf(5)
    Process: 108263 ExecStart=/usr/sbin/isnsd (code=exited, status=0/SUCCESS)
   Main PID: 108264 (isnsd)
      Tasks: 1 (limit: 38266)
     Memory: 952.0K
     CGroup: /system.slice/isnsd.service
             └─108264 /usr/sbin/isnsd

The state I'd have expected it in after install would be more like:

root@j-proposed:~# systemctl stop isnsd.service
root@j-proposed:~# systemctl start isnsd.socket
root@j-proposed:~# systemctl status isnsd.socket isnsd.service
● isnsd.socket
     Loaded: loaded (/lib/systemd/system/isnsd.socket; enabled; vendor preset: enabled)
     Active: active (listening) since Thu 2021-12-16 06:45:07 UTC; 2s ago
   Triggers: ● isnsd.service
     Listen: /run/isnsctl (Stream)
             [::]:3205 (Stream)
     CGroup: /system.slice/isnsd.socket

Dec 16 06:45:07 j-proposed systemd[1]: Listening on isnsd.socket.

○ isnsd.service - iSNS server
     Loaded: loaded (/lib/systemd/system/isnsd.service; enabled; vendor preset: enabled)
     Active: inactive (dead) since Thu 2021-12-16 06:45:01 UTC; 8s ago
TriggeredBy: ● isnsd.socket
       Docs: man:isnsd(8)
             man:isnsd.conf(5)
    Process: 108263 ExecStart=/usr/sbin/isnsd (code=exited, status=0/SUCCESS)
   Main PID: 108264 (code=exited, status=0/SUCCESS)

Dec 16 06:31:35 j-proposed systemd[1]: Starting iSNS server...
Dec 16 06:31:35 j-proposed systemd[1]: Started iSNS server.
Dec 16 06:31:35 j-proposed isnsd[108264]: SLP support disabled in this build
Dec 16 06:45:01 j-proposed isnsd[108264]: SLP support disabled in this build
Dec 16 06:45:...

[Christian Ehrhardt  (paelzer)]

Hmm,
I've found that the socket integration of open-isnsd isn't perfect.
For example the following common init phase (from the man page of isnsadm) breaks it.

root@j-proposed:~# isnsd --init
root@j-proposed:~# isnsadm --local --keyfile=control.key --enroll isns.control node-type=ALL functions=ALL object-type=ALL
No key given, generating one
Stored DSA private key in control.key
socket disconnect, killing socket
Warning: Timed out while waiting for reply
Warning: Failed to register object(s): Internal error

If we now look at the service/socket we see

root@j-proposed:~# systemctl status isnsd.socket isnsd.service
× isnsd.socket
     Loaded: loaded (/lib/systemd/system/isnsd.socket; enabled; vendor preset: enabled)
     Active: failed (Result: service-start-limit-hit) since Thu 2021-12-16 06:50:15 UTC; 4s ago
   Triggers: ● isnsd.service
     Listen: /run/isnsctl (Stream)
             [::]:3205 (Stream)

Dec 16 06:45:07 j-proposed systemd[1]: Listening on isnsd.socket.
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.socket: Failed with result 'service-start-limit-hit'.

× isnsd.service - iSNS server
     Loaded: loaded (/lib/systemd/system/isnsd.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Thu 2021-12-16 06:50:15 UTC; 4s ago
TriggeredBy: × isnsd.socket
       Docs: man:isnsd(8)
             man:isnsd.conf(5)
    Process: 108821 ExecStart=/usr/sbin/isnsd (code=exited, status=0/SUCCESS)
   Main PID: 108822 (code=exited, status=1/FAILURE)

Dec 16 06:50:15 j-proposed systemd[1]: Starting iSNS server...
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.service: New main PID 108821 does not exist or is a zombie.
Dec 16 06:50:15 j-proposed isnsd[108822]: Unable to bind socket: Address already in use
Dec 16 06:50:15 j-proposed isnsd[108822]: Unable to create server socket
Dec 16 06:50:15 j-proposed systemd[1]: Started iSNS server.
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.service: Main process exited, code=exited, status=1/FAILURE
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.service: Failed with result 'exit-code'.
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.service: Start request repeated too quickly.
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.service: Failed with result 'exit-code'.
Dec 16 06:50:15 j-proposed systemd[1]: Failed to start iSNS server.

That means isnsadm reaches the socket in a way to start it, but then the service is blocked by the socket itself. As if there are multiple paths to start it and only one is transitioning, but the other one is blocking it.

A later start gets it running:
root@j-proposed:~# systemctl start isnsd.service
root@j-proposed:~# systemctl status isnsd.socket isnsd.service
× isnsd.socket
     Loaded: loaded (/lib/systemd/system/isnsd.socket; enabled; vendor preset: enabled)
     Active: failed (Result: service-start-limit-hit) since Thu 2021-12-16 06:50:15 UTC; 5min ago
   Triggers: ● isnsd.service
     Listen: /run/isnsctl (Stream)
             [::]:3205 (Stream)

Dec 16 06:45:07 j-proposed systemd[1]: Listening on isnsd.socket.
Dec 16 06:50:15 j-proposed systemd[1]: isnsd.socket: Failed with result 'service-start-limit-hit'.

● isnsd.service - iSNS server
     Loaded...

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

BTW isnssetup works at least to the extend I understand what it is supposed to do.
It creates a working base setup AFAICS:

root@j-proposed:~# isnssetup
*** Initializing server security ***
*** Registering control node policy ***
No key given, generating one
Stored DSA private key in /etc/isns/control.key
Successfully registered object(s)
*** Registering control node ***
Successfully registered object(s)
*** Registering policy for server ***
Successfully registered object(s)

root@j-proposed:~# isnsadm --control --query dd-name=mydomain
(Object list empty)

root@j-proposed:~# isnsadm --control --register entity=client.bozo.org initiator=iqn.org.bozo.client portal=191.168.7.1:860
Successfully registered object(s)

root@j-proposed:~# isnsadm --control --query entity-id=client.bozo.org
object[0] = <Network Entity>
  0001 string : Entity identifier = "client.bozo.org"
  0002 uint32 : Entity protocol = iSCSI (2)
  0006 uint32 : Registration Period = 600
  0004 uint64 : Timestamp = Thu Dec 16 06:59:25 2021
  0007 uint32 : Entity index = 5

[Lena Voytek (lvoytek)]

Removed the socket file inclusion. Confirmed autopkgtest still passing and ppa builds

[Christian Ehrhardt  (paelzer)]

Ok, IMHO it is ready to upload as-is for Ubuntu now to resolve things here.

Please - before considering all of this fully done - submit the same to Debian please (https://salsa.debian.org/linux-blocks-team/open-isns)

I guess there you need to replace your former https://salsa.debian.org/linux-blocks-team/open-isns/-/merge_requests/2
And probably to get it right adapt it to match the gbp workflow as I see upstream/master and pristine-tar there.

Would be something like:
gbp import-orig ../open-isns_0.101.orig.tar.xz --pristine-tar -u 0.101 --debian-branch debian/master --upstream-branch upstream/master
Then add your .install change and submit all three branches there (three PRs).

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading open-isns_0.101-0ubuntu1.dsc: done.
  Uploading open-isns_0.101.orig.tar.gz: done.
  Uploading open-isns_0.101-0ubuntu1.debian.tar.xz: done.
  Uploading open-isns_0.101-0ubuntu1_source.buildinfo: done.
  Uploading open-isns_0.101-0ubuntu1_source.changes: done.
Successfully uploaded packages.

review: Approve

[Lena Voytek (lvoytek)]

The three merge requests are now up in Debian:
https://salsa.debian.org/linux-blocks-team/open-isns/-/merge_requests

diff --git a/.gitignore b/.gitignore
index 5da7a8b..2a0f55d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,8 @@ isnsd
 isnsdd
 libisns.a
 libisns*.so.?
+Makefile
+config.h
+config.log
+config.status
+autom4te.cache
diff --git a/ChangeLog b/ChangeLog
index 34c1638..c379a74 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,28 @@
+* Changes v0.100 to v0.101:
+
+Dmitry Bogdanov (1):
+      Fix parsing of GetNextRsp
+
+Lee Duncan (10):
+      Ignore common build files
+      Fix compiler issue when not in security mode
+      Do not ignore write() return value.
+      Fix 586 compile issue and remove -Werror
+      Added a TODO: 'make depend' not worrking
+      Update version string to "0.100".
+      Fix broken server authentication initialization.
+      Add man page for isnssetup.
+      Added TODO to test "isnsd --init"
+      Preparing for version 0.101
+
+Leo (1):
+      socket.c: include poll.h instead of sys/poll.h for POSIX compatibility
+
+Rosen Penev (2):
+      fix compilation without deprecated OpenSSL APIs
+      libisns: remove sighold and sigrelse
+
+
 * Changes v0.99 to v0.100:
 
 Chris Leech (1):
diff --git a/Makefile.in b/Makefile.in
index f76880a..f001a87 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -118,6 +118,7 @@ install:
 	$(INSTALL) -m 644 $(srcdir)/doc/isnsd.8 $(MANDIR)/man8
 	$(INSTALL) -m 644 $(srcdir)/doc/isnsdd.8 $(MANDIR)/man8
 	$(INSTALL) -m 644 $(srcdir)/doc/isnsadm.8 $(MANDIR)/man8
+	$(INSTALL) -m 644 $(srcdir)/doc/isnssetup.8 $(MANDIR)/man8
 	$(INSTALL) -m 644 $(srcdir)/doc/isns_config.5 $(MANDIR)/man5
 	$(INSTALL) -m 644 $(srcdir)/isnsd.service $(SYSTEMDDIR)
 	$(INSTALL) -m 644 $(srcdir)/isnsd.socket $(SYSTEMDDIR)
diff --git a/TODO b/TODO
index 2ddf008..5e23667 100644
--- a/TODO
+++ b/TODO
@@ -7,6 +7,7 @@ isnsd:
  -	make PGs children of the iSCSI storage node they're associated
  	with?
  -	Implement missing functions
+ -	Add test for "isnsd --init", to make sure it works correctly.
 
 isnsadm:
  -	support iSNS server discovery through DNS SRV
@@ -27,6 +28,10 @@ isnsdd:
  	we registered for ESI are seeing the server's
 	ESI messages.
 
+isnssetup:
+-	Update to support systemd, and perhaps have
+	a few options?
+
 DevAttrReg:
  -	Refuse registration of nodes inside the CONTROL
  	entity, unless it's a control node.
@@ -98,3 +103,6 @@ Renaming
 
 Socket code:
  -	impose upper limit on the reassembly buffer
+
+Compilation:
+ -      'make depend' does not work
diff --git a/client.c b/client.c
index 8487877..fda26be 100644
--- a/client.c
+++ b/client.c
@@ -122,22 +122,17 @@ isns_client_get_local_address(const isns_client_t *clnt,
 /*
  * Create a security context
  */
+#ifdef WITH_SECURITY
 static isns_security_t *
 __create_security_context(const char *name, const char *auth_key,
 		const char *server_key)
 {
-#ifdef WITH_SECURITY
 	isns_security_t 	*ctx;
 	isns_principal_t	*princ;
-#endif /* WITH_SECURITY */
 
 	if (!isns_config.ic_security)
 		return NULL;
 
-#ifndef WITH_SECURITY
-	isns_error("Cannot create security context: security disabled at build time\n");
-	return NULL;
-#else /* WITH_SECURITY */
 	ctx = isns_create_dsa_context();
 	if (ctx == NULL)
 		isns_fatal("Unable to create security context\n");
@@ -174,8 +169,19 @@ __create_security_context(const char *name, const char *auth_key,
 	}
 
 	return ctx;
-#endif /* WITH_SECURITY */
 }
+#else	/* WITH_SECURITY */
+static isns_security_t *
+__create_security_context(__attribute__((unused))const char *name,
+			  __attribute__((unused))const char *auth_key,
+			  __attribute__((unused))const char *server_key)
+{
+	if (!isns_config.ic_security)
+		return NULL;
+	isns_error("Cannot create security context: security disabled at build time\n");
+	return NULL;
+}
+#endif	/* WITH_SECURITY */
 
 /*
  * Create the default security context
diff --git a/configure b/configure
index 8579a02..1559ab6 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for open-isns 0.100.
+# Generated by GNU Autoconf 2.69 for open-isns 0.101.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -577,8 +577,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='open-isns'
 PACKAGE_TARNAME='open-isns'
-PACKAGE_VERSION='0.100'
-PACKAGE_STRING='open-isns 0.100'
+PACKAGE_VERSION='0.101'
+PACKAGE_STRING='open-isns 0.101'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -1250,7 +1250,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures open-isns 0.100 to adapt to many kinds of systems.
+\`configure' configures open-isns 0.101 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1315,7 +1315,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of open-isns 0.100:";;
+     short | recursive ) echo "Configuration of open-isns 0.101:";;
    esac
   cat <<\_ACEOF
 
@@ -1410,7 +1410,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-open-isns configure 0.100
+open-isns configure 0.101
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1775,7 +1775,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by open-isns $as_me 0.100, which was
+It was created by open-isns $as_me 0.101, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3996,7 +3996,7 @@ _ACEOF
 esac
 
 if test "$GCC" = "yes"; then
-        CFLAGS="-Wall -Werror -Wextra $CFLAGS"
+        CFLAGS="-Wall -Wextra $CFLAGS"
 	CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
 fi
 
@@ -4985,7 +4985,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by open-isns $as_me 0.100, which was
+This file was extended by open-isns $as_me 0.101, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -5047,7 +5047,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-open-isns config.status 0.100
+open-isns config.status 0.101
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index e4f3995..63ec143 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT(open-isns, [0.100])
+AC_INIT(open-isns, [0.101])
 AC_CONFIG_SRCDIR([isnsd.c])
 AC_CONFIG_AUX_DIR([aclocal])
 
@@ -17,7 +17,7 @@ AC_PATH_PROG(SH, sh)
 dnl C Compiler features
 AC_C_INLINE
 if test "$GCC" = "yes"; then
-        CFLAGS="-Wall -Werror -Wextra $CFLAGS"
+        CFLAGS="-Wall -Wextra $CFLAGS"
 	CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
 fi
 
diff --git a/db-policy.c b/db-policy.c
index b1c46e2..d4a0cba 100644
--- a/db-policy.c
+++ b/db-policy.c
@@ -52,11 +52,11 @@ __isns_db_keystore_lookup(isns_db_keystore_t *store,
 /*
  * Load a DSA key from the DB store
  */
+#ifdef WITH_SECURITY
 static EVP_PKEY *
 __isns_db_keystore_find(isns_keystore_t *store_base,
 		const char *name, size_t namelen)
 {
-#ifdef WITH_SECURITY
 	isns_db_keystore_t *store = (isns_db_keystore_t *) store_base;
 	isns_object_t	*obj;
 	const void	*key_data;
@@ -71,10 +71,16 @@ __isns_db_keystore_find(isns_keystore_t *store_base,
 		return NULL;
 
 	return isns_dsa_decode_public(key_data, key_size);
-#else
+}
+#else	/* WITH_SECURITY */
+static EVP_PKEY *
+__isns_db_keystore_find(__attribute__((unused))isns_keystore_t *store_base,
+			__attribute__((unused))const char *name,
+			__attribute__((unused))size_t namelen)
+{
 	return NULL;
-#endif
 }
+#endif	/* WITH_SECURITY */
 
 /*
  * Retrieve policy from database
diff --git a/debian/changelog b/debian/changelog
index 6e00fbe..745a31f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+open-isns (0.101-0ubuntu1) jammy; urgency=medium
+
+  * Merge 0.101 from upstream (LP: #1946882), remaining changes
+    - d/open-isns-utils.install: Include isnssetup script in /usr/sbin along with
+      its man documentation
+  * Dropped changes:
+    - d/p/0001-Do-not-ignore-write-return-value.patch: Avoid warn_unused_result error
+      [Fixed in 0.101]
+    - d/p/0002-Fix-different-signedness-integer-expression-comparis.patch: Fix sign error
+      [Fixed in 0.101]
+    - d/p/0003-Fix-broken-server-authentication-initialization.patch: Fix broken server
+      authorization initialization
+      [Fixed in 0.101]
+    - d/p/no-werror.patch: Build without werror enabled
+      [Fixed in 0.101]
+
+ -- Lena Voytek <[e-mail]>  Wed, 16 Dec 2021 07:15:31 -0700
+
 open-isns (0.100-3ubuntu5) jammy; urgency=medium
 
   * No-change rebuild against openssl3
diff --git a/debian/open-isns-utils.install b/debian/open-isns-utils.install
index 89212a5..867a5fc 100644
--- a/debian/open-isns-utils.install
+++ b/debian/open-isns-utils.install
@@ -1,5 +1,7 @@
 debian/extra/isnsadm.conf.5 /usr/share/man/man5
 etc/isns/isnsadm.conf
 usr/sbin/isnsadm
+isnssetup usr/sbin/
 usr/share/man/man5/isns_config.5
 usr/share/man/man8/isnsadm.8
+usr/share/man/man8/isnssetup.8
diff --git a/debian/patches/0001-Do-not-ignore-write-return-value.patch b/debian/patches/0001-Do-not-ignore-write-return-value.patch
deleted file mode 100644
index dcc48c2..0000000
--- a/debian/patches/0001-Do-not-ignore-write-return-value.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From: Ritesh Raj Sarraf <[e-mail]>
-Date: Thu, 19 Nov 2020 15:13:32 +0530
-Subject: Do not ignore write() return value
-
-Some distros set the warn_unused_result attribute for the write()
-system call, so check the return value
-
-Patch cherry-picked from upstream commit: 4c39cb09735a494099fba0474d25ff26800de952
----
- pki.c | 37 ++++++++++++++++++++++++++++++++-----
- 1 file changed, 32 insertions(+), 5 deletions(-)
-
-diff --git a/pki.c b/pki.c
-index 486d9bb..57ea664 100644
---- a/pki.c
-+++ b/pki.c
-@@ -9,12 +9,13 @@
- #include <unistd.h>
- #include <limits.h>
- #include "config.h"
-+#include <fcntl.h>
-+#include <assert.h>
- #ifdef	WITH_SECURITY
- #include <openssl/pem.h>
- #include <openssl/err.h>
- #include <openssl/evp.h>
- #endif
--#include <fcntl.h>
- #include <libisns/isns.h>
- #include "security.h"
- #include <libisns/util.h>
-@@ -431,17 +432,43 @@ isns_dsa_load_params(const char *filename)
- 	return dsa;
- }
- 
-+/*
-+ * write one 'status' character to stdout
-+ */
-+static void
-+write_status_byte(int ch)
-+{
-+	static int	stdout_fd = 1;	/* fileno(stdout) */
-+	char		buf[2];
-+	int		res;
-+
-+	/*
-+	 * We don't actually care about the return value here, since
-+	 * we are just dumping a status byte to stdout, but
-+	 * some linux distrubutions set the warn_unused_result attribute
-+	 * for the write() API, so we might as well use the return value
-+	 * to make sure the write command isn't broken.
-+	 */
-+	assert(ch);
-+	buf[0] = ch;
-+	buf[1] = '\0';
-+	res = write(stdout_fd, buf, 1);
-+	assert(res == 1);
-+}
-+
- static int
- isns_dsa_param_gen_callback(int stage,
- 		__attribute__((unused))int index,
- 		__attribute__((unused))void *dummy)
- {
- 	if (stage == 0)
--		write(1, "+", 1);
-+		write_status_byte('+');
- 	else if (stage == 1)
--		write(1, ".", 1);
-+		write_status_byte('.');
- 	else if (stage == 2)
--		write(1, "/", 1);
-+		write_status_byte('/');
-+
-+	/* as a callback, we must return a value, so just return success */
- 	return 0;
- }
- 
-@@ -478,7 +505,7 @@ isns_dsa_init_params(const char *filename)
- 	dsa = DSA_generate_parameters(dsa_key_bits, NULL, 0,
- 			NULL, NULL, isns_dsa_param_gen_callback, NULL);
- #endif
--	write(1, "\n", 1);
-+	write_status_byte('\n');
- 
- 	if (dsa == NULL) {
- 		isns_dsasig_report_errors("Error generating DSA parameters",
diff --git a/debian/patches/0002-Fix-different-signedness-integer-expression-comparis.patch b/debian/patches/0002-Fix-different-signedness-integer-expression-comparis.patch
deleted file mode 100644
index 31c6cfb..0000000
--- a/debian/patches/0002-Fix-different-signedness-integer-expression-comparis.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Ritesh Raj Sarraf <[e-mail]>
-Date: Mon, 23 Nov 2020 22:35:57 +0530
-Subject: Fix different signedness integer expression comparison error
-
-Issue commonly seen on 32 bit systems
----
- isnsdd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/isnsdd.c b/isnsdd.c
-index 58825cc..9cedb9f 100644
---- a/isnsdd.c
-+++ b/isnsdd.c
-@@ -401,7 +401,7 @@ check_portal_registration(__attribute__((unused))void *ptr)
- 			continue;
- 
- 		last_modified = isns_object_last_modified(obj);
--		if (last_modified + 2 * interval > now) {
-+		if ((time_t)(last_modified + 2 * interval) > now) {
- 			good_portals++;
- 			continue;
- 		}
diff --git a/debian/patches/0003-Fix-broken-server-authentication-initialization.patch b/debian/patches/0003-Fix-broken-server-authentication-initialization.patch
deleted file mode 100644
index eb6afa7..0000000
--- a/debian/patches/0003-Fix-broken-server-authentication-initialization.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From: Lee Duncan <[e-mail]>
-Date: Fri, 4 Dec 2020 09:14:18 -0800
-Subject: Fix broken server authentication initialization.
-
-Commit 86bf736873ed cleaned up a bunch of compiler complaints,
-and was supposed to have no effect on functionality. But the change
-to isns_dsa_param_gen_callback() from void to returning an
-integer (zero) broke "isnsd --init", causing the error message:
-
-> Generating DSA parameters; this may take a while
-> +
-> Warning: Error generating DSA parameters - OpenSSL errors follow:
-
-This commit changes isns_dsa_param_gen_callback() back to a void
-function, and fixes the compiler problem by properly declaring
-the callback, and using the proper openssl macro to set the
-callback.
-
-Fixes: 86bf736873ed General cleanup for the compiler.
----
- pki.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
-diff --git a/pki.c b/pki.c
-index 57ea664..315b56b 100644
---- a/pki.c
-+++ b/pki.c
-@@ -456,7 +456,7 @@ write_status_byte(int ch)
- 	assert(res == 1);
- }
- 
--static int
-+static void
- isns_dsa_param_gen_callback(int stage,
- 		__attribute__((unused))int index,
- 		__attribute__((unused))void *dummy)
-@@ -467,9 +467,6 @@ isns_dsa_param_gen_callback(int stage,
- 		write_status_byte('.');
- 	else if (stage == 2)
- 		write_status_byte('/');
--
--	/* as a callback, we must return a value, so just return success */
--	return 0;
- }
- 
- int
-@@ -494,7 +491,7 @@ isns_dsa_init_params(const char *filename)
- 	isns_notice("Generating DSA parameters; this may take a while\n");
- #if OPENSSL_VERSION_NUMBER >= 0x10002000L
- 	cb = BN_GENCB_new();
--	BN_GENCB_set(cb, (int (*)(int, int, BN_GENCB *)) isns_dsa_param_gen_callback, NULL);
-+	BN_GENCB_set_old(cb, (void (*)(int, int, void *)) isns_dsa_param_gen_callback, NULL);
- 	dsa = DSA_new();
- 	if (!DSA_generate_parameters_ex(dsa, dsa_key_bits, NULL, 0, NULL, NULL, cb)) {
- 		DSA_free(dsa);
diff --git a/debian/patches/no-werror.patch b/debian/patches/no-werror.patch
deleted file mode 100644
index 0ab8c07..0000000
--- a/debian/patches/no-werror.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Description: Build without -Werror to fix FTBFS.
-Author: Dimitri John Ledkov <[e-mail]>
-
-
---- open-isns-0.100.orig/configure.ac
-+++ open-isns-0.100/configure.ac
-@@ -17,7 +17,7 @@ AC_PATH_PROG(SH, sh)
- dnl C Compiler features
- AC_C_INLINE
- if test "$GCC" = "yes"; then
--        CFLAGS="-Wall -Werror -Wextra $CFLAGS"
-+        CFLAGS="-Wall -Wextra $CFLAGS"
- 	CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
- fi
- 
diff --git a/debian/patches/series b/debian/patches/series
deleted file mode 100644
index 27bb459..0000000
--- a/debian/patches/series
+++ /dev/null
@@ -1,4 +0,0 @@
-0001-Do-not-ignore-write-return-value.patch
-0002-Fix-different-signedness-integer-expression-comparis.patch
-0003-Fix-broken-server-authentication-initialization.patch
-no-werror.patch
diff --git a/doc/isnssetup.8 b/doc/isnssetup.8
new file mode 100644
index 0000000..3076af5
--- /dev/null
+++ b/doc/isnssetup.8
@@ -0,0 +1,64 @@
+'\" t
+.TH ISNSSETUP 8 "4 Dec 2020"
+.SH NAME
+isnssetup \- a simple script to bootstrap an iSNS server, including security
+.SH SYNOPSIS
+.B isnssetup
+.SH DESCRIPTION
+.B isnssetup
+is a command line utility for for bootstrapping your iSNS
+installation. It sets up the authentication credentials,
+sets up the
+.B ServerAddress
+to be
+.IR localhost ,
+and registers the appropriate values in the
+.B iSNS
+database. The
+.B isnssetup
+script does not take any options.
+.PP
+Running this script performs the following steps:
+.TP
+.B \(bu
+Set
+.B ServerAddress
+to
+.I localhost
+and
+.B Security
+to
+.I 1
+for
+.B isnsadmin.conf
+and
+.BR isnsdd.conf .
+.TP
+.B \(bu
+Initialize security files by running
+.BR "isnsd --init" ,
+copying the public key to the server key, then restarting
+the
+.B isnsd
+daemon, so that it sees the new authorization files.
+.TP
+.B \(bu
+Registering the control node policy, the control node itself, and
+lastly registering the server policy.
+.PP
+Note that this script is supplied as an example, although you should
+be able to use it directly if you wish. You have to be
+.B root
+to run this script successfully.
+.SH BUGS
+This script does not take
+.B systemd
+into account, so you may have to modify it to get it to work on
+a modern system.
+.SH SEE ALSO
+RFC 4171,
+.BR isnsadm (8),
+.BR isnsd (8),
+.BR isns_config (5).
+.SH AUTHORS
+Olaf Kirch <[e-mail]>
diff --git a/getnext.c b/getnext.c
index 2b3b3fe..9e39a5d 100644
--- a/getnext.c
+++ b/getnext.c
@@ -244,7 +244,7 @@ isns_getnext_response_get_object(isns_simple_t *qry,
 {
 	isns_object_template_t *tmpl;
 
-	tmpl = isns_object_template_for_key_attrs(&qry->is_operating_attrs);
+	tmpl = isns_object_template_for_key_attrs(&qry->is_message_attrs);
 	if (tmpl == NULL) {
 		isns_error("Cannot determine object type in GetNext response\n");
 		return ISNS_ATTRIBUTE_NOT_IMPLEMENTED;
diff --git a/include/libisns/.gitignore b/include/libisns/.gitignore
new file mode 100644
index 0000000..a3757fd
--- /dev/null
+++ b/include/libisns/.gitignore
@@ -0,0 +1 @@
+paths.h
diff --git a/include/libisns/paths.h.in b/include/libisns/paths.h.in
index 1e96e70..4d17adb 100644
--- a/include/libisns/paths.h.in
+++ b/include/libisns/paths.h.in
@@ -9,8 +9,8 @@
 #define ISNS_CONFIG_H
 
 #define __OPENISNS_MKVERSION(maj, min)	(((maj) << 8) + (min))
-#define OPENISNS_VERSION		__OPENISNS_MKVERSION(0, 99);
-#define OPENISNS_VERSION_STRING		"0.99"
+#define OPENISNS_VERSION		__OPENISNS_MKVERSION(0, 101);
+#define OPENISNS_VERSION_STRING		"0.101"
 
 #define ISNS_ETCDIR			"/etc/isns"
 #define ISNS_RUNDIR			"@RUNDIR@"
diff --git a/include/libisns/util.h b/include/libisns/util.h
index 4174480..f1b97f0 100644
--- a/include/libisns/util.h
+++ b/include/libisns/util.h
@@ -14,6 +14,7 @@
 #include <string.h>	// for strdup
 #include <signal.h>
 #include <libisns/types.h>
+#include <stdlib.h>
 
 #define array_num_elements(a) (sizeof(a) / sizeof((a)[0]))
 
@@ -40,14 +41,22 @@ char *		print_size(unsigned long);
  */
 static inline void signals_hold(void)
 {
-	sighold(SIGTERM);
-	sighold(SIGINT);
+	sigset_t s;
+
+	sigemptyset(&s);
+	sigaddset(&s, SIGTERM);
+	sigaddset(&s, SIGINT);
+	sigprocmask(SIG_BLOCK, &s, 0);
 }
 
 static inline void signals_release(void)
 {
-	sigrelse(SIGTERM);
-	sigrelse(SIGINT);
+	sigset_t s;
+
+	sigemptyset(&s);
+	sigaddset(&s, SIGTERM);
+	sigaddset(&s, SIGINT);
+	sigprocmask(SIG_UNBLOCK, &s, 0);
 }
 
 /*
diff --git a/isnsadm.c b/isnsadm.c
index 7a96007..94c705e 100644
--- a/isnsadm.c
+++ b/isnsadm.c
@@ -1162,7 +1162,7 @@ generate_key_callback(void)
 }
 
 isns_attr_t *
-load_key_callback(const char *pathname)
+load_key_callback(__attribute__((unused))const char *pathname)
 {
 	isns_fatal("Authentication disabled in this build\n");
 	return NULL;
diff --git a/isnsdd.c b/isnsdd.c
index 58825cc..9cedb9f 100644
--- a/isnsdd.c
+++ b/isnsdd.c
@@ -401,7 +401,7 @@ check_portal_registration(__attribute__((unused))void *ptr)
 			continue;
 
 		last_modified = isns_object_last_modified(obj);
-		if (last_modified + 2 * interval > now) {
+		if ((time_t)(last_modified + 2 * interval) > now) {
 			good_portals++;
 			continue;
 		}
diff --git a/pki.c b/pki.c
index 486d9bb..6617b8a 100644
--- a/pki.c
+++ b/pki.c
@@ -9,12 +9,15 @@
 #include <unistd.h>
 #include <limits.h>
 #include "config.h"
+#include <fcntl.h>
+#include <assert.h>
 #ifdef	WITH_SECURITY
 #include <openssl/pem.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
+#include <openssl/dsa.h>
+#include <openssl/bn.h>
 #endif
-#include <fcntl.h>
 #include <libisns/isns.h>
 #include "security.h"
 #include <libisns/util.h>
@@ -96,13 +99,11 @@ isns_create_dsa_context(void)
 	isns_security_t	*ctx;
 
 	if (!isns_openssl_init) {
-		ERR_load_crypto_strings();
 #if OPENSSL_API_COMPAT < 0x10100000L
+		ERR_load_crypto_strings();
 		OpenSSL_add_all_algorithms();
 		OpenSSL_add_all_ciphers();
 		OpenSSL_add_all_digests();
-#else
-		OPENSSL_init_crypto();
 #endif
 		isns_openssl_init = 1;
 	}
@@ -431,18 +432,41 @@ isns_dsa_load_params(const char *filename)
 	return dsa;
 }
 
-static int
+/*
+ * write one 'status' character to stdout
+ */
+static void
+write_status_byte(int ch)
+{
+	static int	stdout_fd = 1;	/* fileno(stdout) */
+	char		buf[2];
+	int		res;
+
+	/*
+	 * We don't actually care about the return value here, since
+	 * we are just dumping a status byte to stdout, but
+	 * some linux distrubutions set the warn_unused_result attribute
+	 * for the write() API, so we might as well use the return value
+	 * to make sure the write command isn't broken.
+	 */
+	assert(ch);
+	buf[0] = ch;
+	buf[1] = '\0';
+	res = write(stdout_fd, buf, 1);
+	assert(res == 1);
+}
+
+static void
 isns_dsa_param_gen_callback(int stage,
 		__attribute__((unused))int index,
 		__attribute__((unused))void *dummy)
 {
 	if (stage == 0)
-		write(1, "+", 1);
+		write_status_byte('+');
 	else if (stage == 1)
-		write(1, ".", 1);
+		write_status_byte('.');
 	else if (stage == 2)
-		write(1, "/", 1);
-	return 0;
+		write_status_byte('/');
 }
 
 int
@@ -467,7 +491,7 @@ isns_dsa_init_params(const char *filename)
 	isns_notice("Generating DSA parameters; this may take a while\n");
 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	cb = BN_GENCB_new();
-	BN_GENCB_set(cb, (int (*)(int, int, BN_GENCB *)) isns_dsa_param_gen_callback, NULL);
+	BN_GENCB_set_old(cb, (void (*)(int, int, void *)) isns_dsa_param_gen_callback, NULL);
 	dsa = DSA_new();
 	if (!DSA_generate_parameters_ex(dsa, dsa_key_bits, NULL, 0, NULL, NULL, cb)) {
 		DSA_free(dsa);
@@ -478,7 +502,7 @@ isns_dsa_init_params(const char *filename)
 	dsa = DSA_generate_parameters(dsa_key_bits, NULL, 0,
 			NULL, NULL, isns_dsa_param_gen_callback, NULL);
 #endif
-	write(1, "\n", 1);
+	write_status_byte('\n');
 
 	if (dsa == NULL) {
 		isns_dsasig_report_errors("Error generating DSA parameters",
diff --git a/security.c b/security.c
index 673a26e..68eb779 100644
--- a/security.c
+++ b/security.c
@@ -408,32 +408,34 @@ isns_security_init(void)
 }
 
 isns_keystore_t *
-isns_create_keystore(const char *spec)
+isns_create_keystore(__attribute__((unused))const char *spec)
 {
 	isns_no_security();
 	return NULL;
 }
 
 void
-isns_security_set_keystore(isns_security_t *ctx,
-			isns_keystore_t *ks)
+isns_security_set_keystore(__attribute__((unused))isns_security_t *ctx,
+			   __attribute__((unused))isns_keystore_t *ks)
 {
 	isns_no_security();
 }
 
 void
-isns_principal_free(isns_principal_t *peer)
+isns_principal_free(__attribute__((unused))isns_principal_t *peer)
 {
 }
 
 isns_principal_t *
-isns_get_principal(isns_security_t *ctx, const char *spi, size_t spi_len)
+isns_get_principal(__attribute__((unused))isns_security_t *ctx,
+		   __attribute__((unused))const char *spi,
+		   __attribute__((unused))size_t spi_len)
 {
 	return NULL;
 }
 
 const char *
-isns_principal_name(const isns_principal_t *princ)
+isns_principal_name(__attribute__((unused))const isns_principal_t *princ)
 {
 	return NULL;
 }
diff --git a/socket.c b/socket.c
index da9f5dc..432a9bd 100644
--- a/socket.c
+++ b/socket.c
@@ -5,7 +5,7 @@
  */
 
 #include <sys/socket.h>
-#include <sys/poll.h>
+#include <poll.h>
 #include <sys/time.h>
 #include <sys/un.h>
 #include <string.h>
@@ -322,8 +322,9 @@ failed:
 }
 #else /* WITH_SECURITY */
 static int
-isns_pdu_authenticate(isns_security_t *sec,
-		struct isns_partial_msg *msg, buf_t *bp)
+isns_pdu_authenticate(__attribute__((unused))isns_security_t *sec,
+		      __attribute__((unused))struct isns_partial_msg *msg,
+		      __attribute__((unused))buf_t *bp)
 {
 	return 0;
 }