Debian Patches
Status for ocserv/1.6.0-3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| skip-test-gssapi-curl-regression.patch | Skip test-gssapi: curl Negotiate connection-reuse regression test-gssapi drives curl --negotiate (SPNEGO/NTLM via gss-ntlmssp) against ocserv. With sid's curl 8.21.0~rc2 it never completes: curl opens a fresh TCP connection for the credentialed retry instead of reusing the one that received the NTLM Type-2 challenge (observed in the build log as new source ports and a new ocserv worker per round), so the connection-bound handshake restarts indefinitely. The server side issues correct Type-2 challenges, so this is a client-side curl regression, not an ocserv bug. . Empirically a regression introduced after curl 8.20.0: the same test passes with curl 8.20.0-5 (Debian testing) and fails with 8.21.0~rc2. The -opt- gssapi variants pass via password/cert fallback and remain enabled. Re-add test-gssapi once curl restores connection reuse for the credential upgrade. |
Aron Xu <aron@debian.org> | not-needed | 2026-06-16 | ||
| fix-oidc-test-privileges.patch | Respect privilege requirements in OIDC tests Run the invalid-configuration server probes with the same socket and UID wrappers as the normal test server. Without UID emulation, an unprivileged invocation exits at the root check before reaching OIDC configuration validation. . Enable the authorization-code-flow test only with root-tests. Its occtl session queries require root credentials checked by the kernel, which uid_wrapper cannot emulate. This keeps the test in the existing privileged autopkgtest while excluding it from the unprivileged run. =================================================================== |
Aron Xu <aron@debian.org> | no | 2026-11-02 | ||
| skip-32bit-socket-wrapper-time64.patch | Probe socket_wrapper time64 support before two 32-bit tests Time64 clients on affected 32-bit ABIs use __setsockopt64 and __getsockopt64. When socket_wrapper does not intercept these entry points, TCP_NODELAY reaches an emulated Unix-domain socket and fails with EOPNOTSUPP, as observed on armhf. . Probe socket-option handling in 32-bit Python processes before starting haproxy-auth and test-gssapi-opt-pass. Skip only these tests, and only for EOPNOTSUPP. Supported 32-bit interfaces continue to run, as do wrappers which gain the required support. Leave 64-bit processes unchanged and preserve failures for other errors. . The linked Debian report discusses the broader socket_wrapper time64 issue. =================================================================== |
Aron Xu <aron@debian.org> | no | debian | 2026-11-04 |