Debian Jessie 8.8

Hello,

Also affects Debian 9 (stretch).

Thank you,
Demetris Demetriou
deZillium LTD

I can confirm the Issue on Debian 9!

Any Update ?

There are two issues here. One is, as the summary says, "libmariadb3 has no version information available". We need to fix it. Second is, "pureftpd uses internal libmysqlclient/libmariadb symbols". This is Debian bug, pureftpd can be built not to do that, it's a compilation-time setting.

When I was running Debian 8 (jessie), I was using the MariaDB packages as well (10.1). Jessie had MariaDB 10.0 in its packages, so I don't think this is an issue with pureftpd. I believe it's an issue with whatever package offers libmysqlclient.so.18 (libmariadb3).

There is definitely an issue with pureftpd. Or, rather, there was. Here's the full story:

In its early days, say, about 20 years ago, libmysqlclient did not version symbols and did not limit their visibility. Some functions were documented — they were client API, and we promised to keep them stable, working over years. Other functions were not documented, they were internal, no promises. But they were exported and available too.

Later, in MariaDB time, we took a closer look at that. RedHat was versioning libmysqlclient symbols. Old symbols from libmysqlclient.so.16.0.0 had the version libmysqlclient_16, newer symbols had the version libmysqlclient_18. Internal symols was hidden, with few exceptions. One of such exceptions was my_make_scrambled_password, because pureftpd started using it since the old days, when everything was kind of allowed. Debian had a different, simpler (and less correct) approach to versioning, all symbols had libmysqlclient_18 version. In MariaDB we managed to create a library compatible with both approaches. my_make_scrambled_password was not hidden, with the comment "for pureftpd".

Now, a couple of days ago, I wanted to report this bug to pureftpd, to have it finally fixed and not use internal non-public libmysqlclient symbols. And I found that pureftpd source have this:

# ifdef HAVE_MY_MAKE_SCRAMBLED_PASSWORD

        my_make_scrambled_password(scrambled_password, password,

                                   strlen(password));

# elif defined(HAVE_MAKE_SCRAMBLED_PASSWORD)

        make_scrambled_password(scrambled_password, password);

# else

        {

            SHA1_CTX       ctx;

            unsigned char  h0[20], h1[20];

            char          *p;

            SHA1Init(&ctx);

            SHA1Update(&ctx, password, strlen(password));

            SHA1Final(h0, &ctx);

            SHA1Init(&ctx);

            SHA1Update(&ctx, h0, sizeof h0);

            pure_memzero(h0, sizeof h0);

            SHA1Final(h1, &ctx);

            *scrambled_password = '*';

            hexify(scrambled_password + 1U, h1,

                   (sizeof scrambled_password) - 1U, sizeof h1);

            *(p = scrambled_password) = '*';

            while (*p++ != 0) {

                *p = (char) toupper((unsigned char) *p);

            }

        }

# endif

That is, it only uses make_scrambled_password if it's available, otherwise it can perfectly do without. So, now it's Debian bug, because they build pureftpd to use internal libmysqlclient symbols, while they perfectly can avoid that.

Even more, I've found that in the latest pureftpd sources on github, they've removed this ifdef and don't use make_scrambled_password at all anymore. https://github.com/jedisct1/pure-ftpd/commit/27443b29320d85352d8b52c0120836843e10c0f9

So it was pureftpd issue, and they've fixed it.

Missing versioning is our issue and we'll fix it.

commit 65368bc95c95bba5f428033691ab3587083c6859
Author: Georg Richter <georg@mariadb.com>
Date: Sat Jul 1 15:36:47 2017 +0200

Fix for MDEV-12889:
Added version info for shared object:
libmysqlclient_18 node contains all symbols for libmysql compatibiliry
libmariadb_3 node (additionally) contains all mariadb specific symbols which are not supported by libmysql