Merge ~sergiodj/ubuntu/+source/bind9:bind9-eddsa-dnssec-bug1825712 into ubuntu/+source/bind9:ubuntu/bionic-devel

[Sergio Durigan Junior]

This is the fix of https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1825712 for bionic (the last missing Ubuntu release).

The rationale is the same as for the other releases. Also, there was a lot of discussion happening between Andreas and Christian in the other two MPs, so I'm linking them here:

https://code.launchpad.net/~ahasenack/ubuntu/+source/bind9/+git/bind9/+merge/366414

https://code.launchpad.net/~ahasenack/ubuntu/+source/bind9/+git/bind9/+merge/366410

In the bug, comment #14, Andreas mentioned:

"It's a valid request, I'm just not sure if the version of bind in bionic is good enough for this support. I vaguely remember reading somewhere that certain encryption types were not working well in certain versions of bind9 (sorry, very vague, I know). Because of that I'm confirming the bug, but this would have to be investigated."

After investigating whether there is indeed such a problem with bind9 on bionic, I could not find anything that might prevent us from enabling EdDSA support there. I did find something interesting that Debian did, though: they decided to enable EdDSA, but disable Ed448. I'm choosing not to do that for now, because I think that would be somewhat orthogonal to this change, but I am getting in touch with Ondřej Surý to make sure that this won't bite us down the road.

The package doesn't have dep8 tests, but I did a PPA build:

https://launchpad.net/~sergiodj/+archive/ubuntu/bind9-bug1825712

installed it in a bionic lxd, and performed the "Test Case" instructions from the original bug. Everything is working OK.

[Sergio Durigan Junior (sergiodj)]

I'm leaving this as a WIP until I decide what to do with the Ed448 support.

Unmerged commits

4ec6403... by Sergio Durigan Junior on 2020-09-03

changelog for 1:9.11.3+dfsg-1ubuntu1.14

5d12d7f... by Sergio Durigan Junior on 2020-09-03

  * d/libdns1100.symbols: Add dst__openssleddsa_init@Base.
  * d/rules: add back EdDSA support (LP: #1825712)
    [ Thanks to Andreas Hasenack for the original commit on Eoan and
      Disco. ]

diff --git a/debian/changelog b/debian/changelog
index 0f34694..dbd16d2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+bind9 (1:9.11.3+dfsg-1ubuntu1.14) bionic; urgency=medium
+
+  * d/libdns1100.symbols: Add dst__openssleddsa_init@Base.
+  * d/rules: add back EdDSA support (LP: #1825712)
+    [ Thanks to Andreas Hasenack for the original commit on Eoan and
+      Disco. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 03 Sep 2020 17:31:51 -0400
+
 bind9 (1:9.11.3+dfsg-1ubuntu1.13) bionic-security; urgency=medium
 
   * SECURITY UPDATE: A truncated TSIG response can lead to an assertion
diff --git a/debian/libdns1100.symbols b/debian/libdns1100.symbols
index 62f8991..f5c9fbb 100644
--- a/debian/libdns1100.symbols
+++ b/debian/libdns1100.symbols
@@ -2983,6 +2983,7 @@ libdns.so.1100 libdns1100 #MINVER#
  dst__openssldh_init@Base 1:9.11.3+dfsg
  dst__openssldsa_init@Base 1:9.11.3+dfsg
  dst__opensslecdsa_init@Base 1:9.11.3+dfsg
+ dst__openssleddsa_init@Base 1:9.11.3+dfsg
  dst__opensslrsa_init@Base 1:9.11.3+dfsg
  dst__privstruct_free@Base 1:9.11.3+dfsg
  dst__privstruct_parse@Base 1:9.11.3+dfsg
diff --git a/debian/rules b/debian/rules
index 7a96e56..efea2fc 100755
--- a/debian/rules
+++ b/debian/rules
@@ -65,6 +65,13 @@ clean_native_pkcs11:
 override_dh_autoreconf: prepare_native_pkcs11
 	dh_autoreconf
 
+# Behavior of --with-eddsa:
+#  yes: enables it for openssl and pkcs11
+#  no: disables it for openssl and pkcs11
+#  auto, or absent: enables it for openssl if supported, disables
+#  it for pkcs11
+# EDDSA requires openssl 1.1.1 or later.
+# If EDDSA is enabled, extra symbols will appear in libdns110x.
 override_dh_auto_configure:
 	dh_auto_configure -B build -- \
 		--libdir=/usr/lib/$(DEB_HOST_MULTIARCH) \
@@ -90,7 +97,6 @@ override_dh_auto_configure:
 		--enable-native-pkcs11 \
 		--with-pkcs11=\$${prefix}/lib/softhsm/libsofthsm2.so \
 		--with-randomdev=/dev/urandom \
-		--with-eddsa=no \
 		$(EXTRA_FEATURES)
 	dh_auto_configure -B build-udeb -- \
 		--sysconfdir=/etc/bind \
@@ -109,7 +115,6 @@ override_dh_auto_configure:
 		--enable-shared \
 		--with-libtool \
 		--with-gssapi=no \
-		--with-eddsa=no \
 		--libdir=/lib/$(DEB_HOST_MULTIARCH) \
 		--includedir=/usr/include/bind-export
 	sh debian/apply-export-patch