diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index 26b2e8e..50fa4b0 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,29 @@ /openldap-2.4.43.tgz /openldap-2.4.44.tgz /openldap-2.4.45.tgz +/openldap-2.4.46.tgz +/openldap-2.4.47.tgz +/openldap-2.4.50.tgz +/openldap-2.4.52.tgz +/openldap-2.4.53.tgz +/openldap-2.4.54.tgz +/openldap-2.4.55.tgz +/openldap-2.4.56.tgz +/openldap-2.4.57.tgz +/openldap-2.4.58.tgz +/openldap-2.4.59.tgz +/openldap-2.5.4.tgz +/openldap-ppolicy-check-password-1.1.tar.gz +/openldap-2.5.5.tgz +/openldap-2.5.7.tgz +/openldap-2.5.8.tgz +/openldap-2.6.1.tgz +/openldap-2.6.2.tgz +/openldap-2.6.3.tgz +/openldap-2.6.4.tgz +/openldap-2.6.5.tgz +/openldap-2.6.6.tgz +/openldap-2.6.7.tgz +/openldap-2.6.8.tgz +/openldap-2.6.9.tgz +/openldap-2.6.10.tgz diff --git a/UPGRADE_INSTRUCTIONS b/UPGRADE_INSTRUCTIONS new file mode 100644 index 0000000..14c051f --- /dev/null +++ b/UPGRADE_INSTRUCTIONS @@ -0,0 +1,30 @@ +You have upgraded your openldap-servers package. +Any major version upgrade can cause database corruption or loss. +Please, make sure that you have up-to-date back up and read this document carefully. + +It's still recommended to do the backup even on the minor version upgrade. + +Please, review the next links before performing any action: + +Upgrading from 2.4.x - https://www.openldap.org/doc/admin25/appendix-upgrading.html +Upgrading from 2.5.x - https://www.openldap.org/doc/admin26/appendix-upgrading.html +The normal upgrade procedure - https://www.openldap.org/doc/admin26/maintenance.html + +Additionally, please, review and perform the following steps that can help you with the upgrade: + + 1. Back up both data and configuration directories into a safe place; + 2. Export data to an LDIF file using slapcat; +a. If you have the deprecated DB type and you haven't performed the slapcat command, you need to move your data and configuration to the system with OpenLDAP 2.4 version and run slapcat command there; + 3. Change the server's configuration according to the changes in the above documents; + a. If you are replacing the BDB/HDB with MDB, make sure to replace the BDB/HDB sections with their MDB counterparts; +4. Clear out the current data directory; + 5. Import data to a new database from the LDIF file using slapadd; + 6. Make sure that your data is intact. + +After you have completed the above operations, you can remove this file (/usr/share/openldap-servers/UPGRADE_INSTRUCTIONS) and start the server: + + systemctl start slapd.service + +Be careful with this document's procedure, make sure you understand it, and test it in a non-production environment first. Always make sure that all backups are in place. + +You have been warned about the possibility of data corruption or loss. diff --git a/check-password-makefile.patch b/check-password-makefile.patch index f39ba81..048ee2e 100644 --- a/check-password-makefile.patch +++ b/check-password-makefile.patch @@ -1,32 +1,45 @@ ---- a/Makefile 2009-10-31 18:59:06.000000000 +0100 -+++ b/Makefile 2014-12-17 09:42:37.586079225 +0100 -@@ -13,22 +13,11 @@ +diff --git a/Makefile b/Makefile +index 4457bad..91de40b 100644 +--- a/Makefile ++++ b/Makefile +@@ -13,17 +13,10 @@ CRACKLIB=/usr/share/cracklib/pw_dict # CONFIG=/etc/openldap/check_password.conf --OPT=-g -O2 -Wall -fpic \ -- -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ -- -DCONFIG_FILE="\"$(CONFIG)\"" \ -+CFLAGS+=-fpic \ -+ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ -+ -DCONFIG_FILE="\"$(CONFIG)\"" \ - -DDEBUG - +- -# Where to find the OpenLDAP headers. -# --LDAP_INC=-I/home/pyb/tmp/openldap-2.3.39/include \ -- -I/home/pyb/tmp/openldap-2.3.39/servers/slapd +-LDAP_INC=-I/usr/include/openldap/include \ +- -I/usr/include/openldap/servers/slapd - -# Where to find the CrackLib headers. -# -CRACK_INC= - -INCS=$(LDAP_INC) $(CRACK_INC) -- ++CFLAGS+=-fpic \ ++ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ ++ -DCONFIG_FILE="\"$(CONFIG)\"" \ ++ -DDEBUG + LDAP_LIB=-lldap_r -llber - # Comment out this line if you do NOT want to use the cracklib. -@@ -45,10 +34,10 @@ +@@ -33,27 +26,21 @@ LDAP_LIB=-lldap_r -llber + # + CRACKLIB_LIB=-lcrack + +-CC_FLAGS=-g -O2 -Wall -fpic +-CRACKLIB_OPT=-DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" +-DEBUG_OPT=-DDEBUG +-CONFIG_OPT=-DCONFIG_FILE="\"$(CONFIG)\"" +- +-OPT=$(CC_FLAGS) $(CRACKLIB_OPT) $(CONFIG_OPT) $(DEBUG_OPT) +- + LIBS=$(LDAP_LIB) $(CRACKLIB_LIB) + + LIBDIR=/usr/lib/openldap/ + ++ all: check_password check_password.o: @@ -38,4 +51,8 @@ + $(CC) $(LDFLAGS) -shared -o check_password.so check_password.o $(CRACKLIB_LIB) install: check_password - cp -f check_password.so ../../../usr/lib/openldap/modules/ +- cp -f check_password.so $(LIBDIR) ++ cp -f check_password.so ../../../usr/lib/openldap/modules/ + + clean: + $(RM) check_password.o check_password.so check_password.lo diff --git a/ldap.conf b/ldap.conf index 84bddc1..02c595f 100644 --- a/ldap.conf +++ b/ldap.conf @@ -12,7 +12,16 @@ #TIMELIMIT 15 #DEREF never -TLS_CACERTDIR /etc/openldap/certs +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by TLS_CACERTDIR one has to include them explicitly: +#TLS_CACERT /etc/pki/tls/cert.pem + +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#TLS_CIPHER_SUITE PROFILE=SYSTEM # Turning this off breaks GSSAPI used with krb5 when rdns = false SASL_NOCANON on diff --git a/libexec-check-config.sh b/libexec-check-config.sh index 87e377f..16f43ea 100755 --- a/libexec-check-config.sh +++ b/libexec-check-config.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#! /usr/bin/sh # Author: Jan Vcelak . /usr/libexec/openldap/functions @@ -41,7 +41,7 @@ function check_db_perms() retcode=0 for dbdir in `databases`; do [ -d "$dbdir" ] || continue - for dbfile in `find ${dbdir} -maxdepth 1 -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" -or -name "log.*" -or -name "alock"`; do + for dbfile in `find ${dbdir} -maxdepth 1 -name "*.mdb"` ; do run_as_ldap "/usr/bin/test -r \"$dbfile\" -a -w \"$dbfile\"" if [ $? -ne 0 ]; then error "Read/write permissions for DB file '%s' are required." "$dbfile" @@ -56,8 +56,7 @@ function check_everything() { retcode=0 check_config_syntax || retcode=1 - # TODO: need support for Mozilla NSS, disabling temporarily - #check_certs_perms || retcode=1 + check_certs_perms || retcode=1 check_db_perms || retcode=1 return $retcode } diff --git a/libexec-functions b/libexec-functions index 990d2b8..8ee7500 100644 --- a/libexec-functions +++ b/libexec-functions @@ -84,14 +84,6 @@ function databases_new() ldif_value } -function databases_old() -{ - awk 'begin { database="" } - $1 == "database" { database=$2 } - $1 == "directory" { if (database == "bdb" || database == "hdb") print $2}' \ - "$SLAPD_CONFIG_FILE" -} - function certificates_new() { slapcat $SLAPD_GLOBAL_OPTIONS -c -H 'ldap:///cn=config???(cn=config)' 2>/dev/null | \ @@ -100,20 +92,14 @@ function certificates_new() ldif_value } -function certificates_old() -{ - awk '$1 ~ "^TLS(CACertificate(File|Path)|CertificateFile|CertificateKeyFile)$" { print $2 } ' \ - "$SLAPD_CONFIG_FILE" -} - function certificates() { - uses_new_config && certificates_new || certificates_old + uses_new_config && certificates_new } function databases() { - uses_new_config && databases_new || databases_old + uses_new_config && databases_new } diff --git a/libexec-upgrade-db.sh b/libexec-upgrade-db.sh deleted file mode 100755 index 1543c80..0000000 --- a/libexec-upgrade-db.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/sh -# Author: Jan Vcelak - -. /usr/libexec/openldap/functions - -if [ `id -u` -ne 0 ]; then - error "You have to be root to run this command." - exit 4 -fi - -load_sysconfig -retcode=0 - -for dbdir in `databases`; do - upgrade_log="$dbdir/db_upgrade.`date +%Y%m%d%H%M%S`.log" - bdb_files=`find "$dbdir" -maxdepth 1 -name "*.bdb" -printf '"%f" '` - - # skip uninitialized database - [ -z "$bdb_files"] || continue - - printf "Updating '%s', logging into '%s'\n" "$dbdir" "$upgrade_log" - - # perform the update - for command in \ - "/usr/bin/db_recover -v -h \"$dbdir\"" \ - "/usr/bin/db_upgrade -v -h \"$dbdir\" $bdb_files" \ - "/usr/bin/db_checkpoint -v -h \"$dbdir\" -1" \ - ; do - printf "Executing: %s\n" "$command" &>>$upgrade_log - run_as_ldap "$command" &>>$upgrade_log - result=$? - printf "Exit code: %d\n" $result >>"$upgrade_log" - if [ $result -ne 0 ]; then - printf "Upgrade failed: %d\n" $result - retcode=1 - fi - done -done - -exit $retcode diff --git a/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch new file mode 100644 index 0000000..62f85f4 --- /dev/null +++ b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch @@ -0,0 +1,120 @@ +From 606349836109cfb201bc5b5b424dffb749150a68 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Mon, 28 Apr 2025 14:36:24 +0100 +Subject: [PATCH] ITS#10297 Defer hostname resolution til first use + +--- + libraries/libldap/init.c | 33 +++++++++++++++++++-------------- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/os-ip.c | 2 ++ + libraries/libldap/tls_g.c | 3 +++ + libraries/libldap/tls_o.c | 3 +++ + 6 files changed, 28 insertions(+), 14 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..90fc34c5a6 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -631,6 +631,25 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + char * ldap_int_hostname = NULL; ++ ++void ++ldap_int_resolve_hostname(void) ++{ ++ static int resolved = 0; ++ ++ LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); ++ if ( !resolved ) { ++ char *name = ldap_int_hostname; ++ ++ ldap_int_hostname = ldap_pvt_get_fqdn( name ); ++ ++ if ( name != NULL && name != ldap_int_hostname ) { ++ LDAP_FREE( name ); ++ } ++ resolved = 1; ++ } ++ LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); ++} + #endif + + #ifdef LDAP_R_COMPILE +@@ -688,20 +707,6 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl ) + } + #endif + +-#if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) +- LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); +- { +- char *name = ldap_int_hostname; +- +- ldap_int_hostname = ldap_pvt_get_fqdn( name ); +- +- if ( name != NULL && name != ldap_int_hostname ) { +- LDAP_FREE( name ); +- } +- } +- LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); +-#endif +- + #ifndef HAVE_POLL + if ( ldap_int_tblsize == 0 ) ldap_int_ip_init(); + #endif +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..435b859066 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -743,6 +743,7 @@ LDAP_F (int) ldap_int_poll( LDAP *ld, ber_socket_t s, + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + LDAP_V (char *) ldap_int_hostname; ++LDAP_F (void) ldap_int_resolve_hostname(void); + LDAP_F (char *) ldap_host_connected_to( Sockbuf *sb, + const char *host ); + #endif +diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c +index 6c86edd055..629b540352 100644 +--- a/libraries/libldap/os-ip.c ++++ b/libraries/libldap/os-ip.c +@@ -890,6 +890,8 @@ ldap_host_connected_to( Sockbuf *sb, const char *host ) + * this is necessary for kerberos to work right, since the official + * hostname is used as the kerberos instance. + */ ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); + + switch (sa->sa_family) { + #ifdef LDAP_PF_LOCAL +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index de5b7f7c84..d4e7ee0bf7 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -597,6 +597,9 @@ tlsg_session_chkhost( LDAP *ld, tls_session *session, const char *name_in ) + int len1 = 0, len2 = 0; + int ntype = IS_DNS; + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 71677847a9..155f685c99 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -830,6 +830,9 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) + struct in_addr addr; + #endif + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +-- +GitLab + diff --git a/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch b/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch new file mode 100644 index 0000000..0c1b3bb --- /dev/null +++ b/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch @@ -0,0 +1,37 @@ +From 6779e56fafb0aa8ae5efa7068da34a630b51b530 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Fri, 5 Aug 2022 13:23:52 -0700 +Subject: [PATCH] Add export symbols related to LDAP_CONNECTIONLESS + +--- + libraries/liblber/lber.map | 1 + + libraries/libldap/ldap.map | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/libraries/liblber/lber.map b/libraries/liblber/lber.map +index 9a4094b0f..083cd1f32 100644 +--- a/libraries/liblber/lber.map ++++ b/libraries/liblber/lber.map +@@ -121,6 +121,7 @@ OPENLDAP_2.200 + ber_sockbuf_io_fd; + ber_sockbuf_io_readahead; + ber_sockbuf_io_tcp; ++ ber_sockbuf_io_udp; + ber_sockbuf_remove_io; + ber_sos_dump; + ber_start; +diff --git a/libraries/libldap/ldap.map b/libraries/libldap/ldap.map +index b28c9c21e..021aaba63 100644 +--- a/libraries/libldap/ldap.map ++++ b/libraries/libldap/ldap.map +@@ -200,6 +200,7 @@ OPENLDAP_2.200 + ldap_is_ldap_url; + ldap_is_ldapi_url; + ldap_is_ldaps_url; ++ ldap_is_ldapc_url; + ldap_is_read_ready; + ldap_is_write_ready; + ldap_ld_free; +-- +2.37.1 + diff --git a/openldap-add-tls-sni-support-to-libldap.patch b/openldap-add-tls-sni-support-to-libldap.patch new file mode 100644 index 0000000..ee7e814 --- /dev/null +++ b/openldap-add-tls-sni-support-to-libldap.patch @@ -0,0 +1,197 @@ +From 19e631e977c4f57905b2380cf79ccaf8e6d99e9d Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 03:41:12 +0100 +Subject: [PATCH 1/4] ITS#9176 Add TLS SNI support to libldap + +Implemented for OpenSSL, GnuTLS just stubbed +--- + libraries/libldap/ldap-tls.h | 2 +- + libraries/libldap/tls2.c | 2 +- + libraries/libldap/tls_g.c | 2 +- + libraries/libldap/tls_o.c | 8 ++++++-- + 4 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index c8a27112f1..c149b1867c 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -34,7 +34,7 @@ typedef void (TI_ctx_free)(tls_ctx *ctx); + typedef int (TI_ctx_init)(struct ldapoptions *lo, struct ldaptls *lt, int is_server); + + typedef tls_session *(TI_session_new)(tls_ctx *ctx, int is_server); +-typedef int (TI_session_connect)(LDAP *ld, tls_session *s); ++typedef int (TI_session_connect)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_accept)(tls_session *s); + typedef int (TI_session_upflags)(Sockbuf *sb, tls_session *s, int rc); + typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len ); +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 82ca5272cc..cbeea8c6c4 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -368,7 +368,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + } + +- err = tls_imp->ti_session_connect( ld, ssl ); ++ err = tls_imp->ti_session_connect( ld, ssl, host ); + + #ifdef HAVE_WINSOCK + errno = WSAGetLastError(); +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 3b72cd2a1f..5468ed3f05 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -336,7 +336,7 @@ tlsg_session_accept( tls_session *session ) + } + + static int +-tlsg_session_connect( LDAP *ld, tls_session *session ) ++tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in ) + { + return tlsg_session_accept( session); + } +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 498f805fa1..455b23c0e9 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -548,12 +548,16 @@ tlso_session_new( tls_ctx *ctx, int is_server ) + } + + static int +-tlso_session_connect( LDAP *ld, tls_session *sess ) ++tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + { + tlso_session *s = (tlso_session *)sess; ++ int rc; + ++#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME ++ SSL_set_tlsext_host_name( s, name_in ); ++#endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ +- int rc = SSL_connect( s ) - 1; ++ rc = SSL_connect( s ) - 1; + #ifdef LDAP_USE_NON_BLOCKING_TLS + if ( rc < 0 ) { + int sockerr = sock_errno(); + +From 421c2021c7209bd7cd947ccb8b989bddab7b63cb Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 18:25:10 +0100 +Subject: [PATCH 2/4] ITS#9176 check for numeric addrs before passing SNI + +--- + libraries/libldap/tls2.c | 22 +++++++++++++++++++++- + libraries/libldap/tls_o.c | 4 +++- + 2 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index cbeea8c6c4..85628bc3b3 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -334,6 +334,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + Sockbuf *sb = conn->lconn_sb; + int err; + tls_session *ssl = NULL; ++ char *sni = host; + + if ( HAS_TLS( sb )) { + ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); +@@ -368,7 +369,26 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + } + +- err = tls_imp->ti_session_connect( ld, ssl, host ); ++ /* pass hostname for SNI, but only if it's an actual name ++ * and not a numeric address ++ */ ++ { ++ int numeric = 1; ++ char *c; ++ for ( c = sni; *c; c++ ) { ++ if ( *c == ':' ) /* IPv6 address */ ++ break; ++ if ( *c == '.' ) ++ continue; ++ if ( !isdigit( *c )) { ++ numeric = 0; ++ break; ++ } ++ } ++ if ( numeric ) ++ sni = NULL; ++ } ++ err = tls_imp->ti_session_connect( ld, ssl, sni ); + + #ifdef HAVE_WINSOCK + errno = WSAGetLastError(); +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 455b23c0e9..45948dbc64 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -554,7 +554,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + int rc; + + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME +- SSL_set_tlsext_host_name( s, name_in ); ++ if ( name_in ) { ++ SSL_set_tlsext_host_name( s, name_in ); ++ } + #endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ + rc = SSL_connect( s ) - 1; + +From 05a65a46c684031a841bcc39cf01a82e8cc713a0 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 18:54:02 +0100 +Subject: [PATCH 3/4] ITS#9176 check for failure setting SNI + +--- + libraries/libldap/tls_o.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 45948dbc64..86e86db3b6 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -555,7 +555,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + if ( name_in ) { +- SSL_set_tlsext_host_name( s, name_in ); ++ rc = SSL_set_tlsext_host_name( s, name_in ); ++ if ( !rc ) /* can fail to strdup the name */ ++ return -1; + } + #endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ + +From d059488fa86b58744ad70819516d3bf4a37dbb8e Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Mon, 27 Apr 2020 11:01:01 -0700 +Subject: [PATCH 4/4] ITS#9176 Implement SNI for GnuTLS + +--- + libraries/libldap/tls_g.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 5468ed3f05..5fceb3e935 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -338,6 +338,16 @@ tlsg_session_accept( tls_session *session ) + static int + tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in ) + { ++ tlsg_session *s = (tlsg_session *)session; ++ int rc; ++ ++ if ( name_in ) { ++ rc = gnutls_server_name_set( s->session, GNUTLS_NAME_DNS, name_in, strlen(name_in) ); ++ if ( rc != GNUTLS_E_SUCCESS ) { ++ return rc; ++ } ++ } ++ + return tlsg_session_accept( session); + } + diff --git a/openldap-ai-addrconfig.patch b/openldap-ai-addrconfig.patch index 0858fac..f9a7333 100644 --- a/openldap-ai-addrconfig.patch +++ b/openldap-ai-addrconfig.patch @@ -5,10 +5,10 @@ Upstream ITS: #7326 Resolves: #835013 diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c -index b31e05d..fa361ab 100644 +index 14899cc..b25e750 100644 --- a/libraries/libldap/os-ip.c +++ b/libraries/libldap/os-ip.c -@@ -594,8 +594,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, +@@ -620,8 +620,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, #if defined( HAVE_GETADDRINFO ) && defined( HAVE_INET_NTOP ) memset( &hints, '\0', sizeof(hints) ); diff --git a/openldap-allop-overlay.patch b/openldap-allop-overlay.patch index 608ee44..05a4c6e 100644 --- a/openldap-allop-overlay.patch +++ b/openldap-allop-overlay.patch @@ -4,9 +4,10 @@ Author: Matus Honek Resolves: #1319782 diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in +index b5c3fc8..9aa8a4f 100644 --- a/servers/slapd/overlays/Makefile.in +++ b/servers/slapd/overlays/Makefile.in -@@ -33,7 +33,8 @@ SRCS = overlays.c \ +@@ -38,7 +38,8 @@ SRCS = overlays.c \ translucent.c \ unique.c \ valsort.c \ @@ -16,7 +17,7 @@ diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefil OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ overlays.o -@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) +@@ -58,7 +59,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a @@ -25,7 +26,7 @@ diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefil XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) -@@ -125,6 +126,12 @@ unique.la : unique.lo +@@ -148,6 +149,12 @@ smbk5pwd.lo : smbk5pwd.c smbk5pwd.la : smbk5pwd.lo $(LTLINK_MOD) -module -o $@ smbk5pwd.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) diff --git a/openldap-autoconf-pkgconfig-nss.patch b/openldap-autoconf-pkgconfig-nss.patch deleted file mode 100644 index 8b4bb19..0000000 --- a/openldap-autoconf-pkgconfig-nss.patch +++ /dev/null @@ -1,49 +0,0 @@ -Use pkg-config for Mozilla NSS library detection - -Author: Jan Vcelak - ---- - configure.in | 22 +++++----------------- - 1 file changed, 5 insertions(+), 17 deletions(-) - -diff --git a/configure.in b/configure.in -index ecffe30..2a9cfb4 100644 ---- a/configure.in -+++ b/configure.in -@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then - fi - fi - --dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3 --dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs --dnl are not in the default system location - if test $ol_link_tls = no ; then - if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then -- have_moznss=no -- AC_CHECK_HEADERS([nssutil.h]) -- if test "$ac_cv_header_nssutil_h" = yes ; then -- AC_CHECK_LIB([nss3], [NSS_Initialize], -- [ have_moznss=yes ], [ have_moznss=no ]) -- fi -+ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no]) - -- if test "$have_moznss" = yes ; then -+ if test $have_moznss = yes ; then - ol_with_tls=moznss - ol_link_tls=yes -- AC_DEFINE(HAVE_MOZNSS, 1, -- [define if you have MozNSS]) -- TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4" -- else -- if test $ol_with_tls = moznss ; then -- AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)]) -- fi -+ AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS]) -+ TLS_LIBS="$MOZNSS_LIBS" -+ CFLAGS="$CFLAGS $MOZNSS_CFLAGS" - fi - fi - fi --- -1.7.11.7 - diff --git a/openldap-configure-c99.patch b/openldap-configure-c99.patch new file mode 100644 index 0000000..1a0931a --- /dev/null +++ b/openldap-configure-c99.patch @@ -0,0 +1,906 @@ +commit 14f81bc47a4c462ccc609fce74feb014185e2bf9 +Author: Sam James +Date: Thu Feb 9 23:17:53 2023 +0000 + + ITS#10011 build: fix compatibility with stricter C99 compilers + + Fix the following warnings: + - -Wimplicit-int (fatal with Clang 16) + - -Wimplicit-function-declaration (fatal with Clang 16) + - -Wincompatible-function-pointer-types (fatal with Clang 16) + - -Wint-conversion (fatal with Clang 15) + - Old style prototypes (K&R, removed from C23) + + These warnings-now-error led to misconfigurations and failure to build + OpenLDAP, as the tests used during configure caused the wrong results + to be emitted. + + For more information, see LWN.net [0] or LLVM's Discourse [1], the Gentoo wiki [2], + or the (new) c-std-porting mailing list [3]. + + [0] https://lwn.net/Articles/913505/ + [1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213 + [2] https://wiki.gentoo.org/wiki/Modern_C_porting + [3] hosted at lists.linux.dev. + + Bug: https://bugs.gentoo.org/871288 + Signed-off-by: Sam James + +diff -ur openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 openldap-2.6.4/openldap-2.6.4/build/openldap.m4 +--- openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/build/openldap.m4 2023-04-15 19:21:07.377380382 +0200 +@@ -154,6 +154,7 @@ + if test $ol_cv_header_stdc = yes; then + # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. + AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -303,8 +304,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -360,9 +365,13 @@ + AC_DEFUN([OL_PTHREAD_TEST_PROGRAM], + [AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + OL_PTHREAD_TEST_FUNCTION + } +@@ -484,7 +493,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -511,7 +520,8 @@ + [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +@@ -569,7 +579,7 @@ + ]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no]) + else + AC_RUN_IFELSE([AC_LANG_SOURCE([[ +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure openldap-2.6.4/openldap-2.6.4/configure +--- openldap-2.6.4.orig/openldap-2.6.4/configure 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure 2023-04-15 19:23:17.437078213 +0200 +@@ -14978,6 +14966,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + #include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -15946,6 +15935,10 @@ + else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ ++#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif + int main(int argc, char **argv) + { + int epfd = epoll_create(256); +@@ -16126,7 +16119,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +@@ -16326,7 +16319,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -17559,16 +17552,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17664,8 +17665,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17744,16 +17749,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17854,8 +17867,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17934,16 +17951,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18044,8 +18069,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18124,16 +18153,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18234,8 +18271,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18314,16 +18355,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18424,8 +18473,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18504,16 +18557,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18615,8 +18676,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18695,16 +18760,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18805,8 +18878,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18885,16 +18962,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18996,8 +19081,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19076,16 +19165,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19187,8 +19284,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19267,16 +19368,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19377,8 +19486,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19457,16 +19570,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19568,8 +19689,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19648,16 +19773,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19759,8 +19892,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19839,16 +19976,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19949,8 +20094,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20029,16 +20178,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20139,8 +20296,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20219,16 +20380,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20330,8 +20499,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20410,16 +20583,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20631,14 +20812,12 @@ + /* end confdefs.h. */ + + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif ++pthread_t thread; + + int + main () + { +-pthread_detach(NULL); ++pthread_detach(thread); + ; + return 0; + } +@@ -20752,16 +20931,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20851,6 +21038,9 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -20861,8 +21051,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -20886,9 +21080,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + +@@ -23241,7 +23439,8 @@ + /* end confdefs.h. */ + + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure.ac openldap-2.6.4/openldap-2.6.4/configure.ac +--- openldap-2.6.4.orig/openldap-2.6.4/configure.ac 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure.ac 2023-04-15 19:21:07.377380382 +0200 +@@ -1003,7 +1003,11 @@ + AC_CHECK_HEADERS( sys/epoll.h ) + if test "${ac_cv_header_sys_epoll_h}" = yes; then + AC_MSG_CHECKING(for epoll system call) +- AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv) ++ AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif ++int main(int argc, char **argv) + { + int epfd = epoll_create(256); + exit (epfd == -1 ? 1 : 0); +@@ -1356,10 +1360,10 @@ + dnl pthread_create() in -lpthread (many) + dnl pthread_create() in -lc_r (FreeBSD) + dnl +- dnl Check pthread (draft4) flags (depreciated) ++ dnl Check pthread (draft4) flags (deprecated) + dnl pthread_create() with -threads (OSF/1) + dnl +- dnl Check pthread (draft4) libraries (depreciated) ++ dnl Check pthread (draft4) libraries (deprecated) + dnl pthread_mutex_unlock() in -lpthreads -lmach -lexc -lc_r (OSF/1) + dnl pthread_mutex_lock() in -lpthreads -lmach -lexc (OSF/1) + dnl pthread_mutex_trylock() in -lpthreads -lexc (OSF/1) +@@ -1378,7 +1382,7 @@ + ol_link_threads=posix + ol_link_pthreads="" + fi +- ++ + dnl OL_PTHREAD_TRY([-mt], [ol_cv_pthread_mt]) + OL_PTHREAD_TRY([-kthread], [ol_cv_pthread_kthread]) + OL_PTHREAD_TRY([-pthread], [ol_cv_pthread_pthread]) +@@ -1465,10 +1469,8 @@ + dnl save the flags + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif +-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) ++pthread_t thread; ++]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) + ]) + + if test $ol_cv_func_pthread_detach = no ; then +@@ -1523,6 +1525,9 @@ + AC_CACHE_CHECK([if select yields when using pthreads], + ol_cv_pthread_select_yields,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -1533,8 +1538,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -1558,9 +1567,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + diff --git a/openldap-doc1.patch b/openldap-doc1.patch deleted file mode 100644 index 13c4c41..0000000 --- a/openldap-doc1.patch +++ /dev/null @@ -1,36 +0,0 @@ -Upstream ITS: #7568 - -From 6be982c000133ccf9da949d39eed23a93bc7bfc5 Mon Sep 17 00:00:00 2001 -From: Jan Synacek -Date: Tue, 9 Apr 2013 12:41:38 +0200 -Subject: [PATCH 1/2] Fix typos in ldap.conf.5 - ---- - doc/man/man5/ldap.conf.5 | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index cfde143..8f7fecd 100644 ---- a/doc/man/man5/ldap.conf.5 -+++ b/doc/man/man5/ldap.conf.5 -@@ -297,7 +297,7 @@ Specifies if GSSAPI encryption (GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG) - should be used. The default is off. - .TP - .B GSSAPI_ALLOW_REMOTE_PRINCIPAL --Specifies if GSSAPI based authentification should try to form the -+Specifies if GSSAPI based authentication should try to form the - target principal name out of the ldapServiceName or dnsHostName - attribute of the targets RootDSE entry. The default is off. - .SH TLS OPTIONS -@@ -354,7 +354,7 @@ it is of critical importance that the key file is protected carefully. - When using Mozilla NSS, TLS_KEY specifies the name of a file that contains - the password for the key for the certificate specified with TLS_CERT. The - modutil command can be used to turn off password protection for the cert/key --database. For example, if TLS_CACERTDIR specifes /home/scarter/.moznss as -+database. For example, if TLS_CACERTDIR specifies /home/scarter/.moznss as - the location of the cert/key database, use modutil to change the password - to the empty string: - .nf --- -1.8.1.4 - diff --git a/openldap-doc2.patch b/openldap-doc2.patch deleted file mode 100644 index 47b1c13..0000000 --- a/openldap-doc2.patch +++ /dev/null @@ -1,27 +0,0 @@ -Upstream ITS: #7568 - -From 05c726c62785b2c307f9c5343a253d43ec7322c6 Mon Sep 17 00:00:00 2001 -From: Jan Synacek -Date: Tue, 9 Apr 2013 12:42:31 +0200 -Subject: [PATCH 2/2] Add -Q to slaptest's help - ---- - servers/slapd/slapcommon.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/servers/slapd/slapcommon.c b/servers/slapd/slapcommon.c -index 714e2bc..153310f 100644 ---- a/servers/slapd/slapcommon.c -+++ b/servers/slapd/slapcommon.c -@@ -92,7 +92,7 @@ usage( int tool, const char *progname ) - break; - - case SLAPTEST: -- options = " [-n databasenumber] [-u]\n"; -+ options = " [-n databasenumber] [-u] [-Q]\n"; - break; - - case SLAPSCHEMA: --- -1.8.1.4 - diff --git a/openldap-explicitly-cast-private-values.patch b/openldap-explicitly-cast-private-values.patch new file mode 100644 index 0000000..80daad6 --- /dev/null +++ b/openldap-explicitly-cast-private-values.patch @@ -0,0 +1,70 @@ +From fb9e6a81bbee880549e7ec18f0a74ddddbd2d1ab Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 6 Feb 2024 21:38:24 -0500 +Subject: [PATCH] ITS#10171 - Explicitly cast private values + +Fixes issues with -Werror=incompatible-pointer-types + +Signed-off-by: Stephen Gallagher +--- + servers/slapd/config.c | 2 +- + servers/slapd/overlays/constraint.c | 2 +- + servers/slapd/overlays/dyngroup.c | 2 +- + servers/slapd/overlays/valsort.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index 80333f359c..987c862d91 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -151,7 +151,7 @@ int config_check_vals(ConfigTable *Conf, ConfigArgs *c, int check_only ) { + int rc, arg_user, arg_type, arg_syn, iarg; + unsigned uiarg; + long larg; +- size_t ularg; ++ unsigned long ularg; + ber_len_t barg; + + if(Conf->arg_type == ARG_IGNORED) { +diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c +index f939b37762..0d6156af4d 100644 +--- a/servers/slapd/overlays/constraint.c ++++ b/servers/slapd/overlays/constraint.c +@@ -557,7 +557,7 @@ done:; + a2->restrict_filter = ap.restrict_filter; + a2->restrict_val = ap.restrict_val; + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (constraint **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_next = *app; +diff --git a/servers/slapd/overlays/dyngroup.c b/servers/slapd/overlays/dyngroup.c +index 5d890d6650..e0e70af2d9 100644 +--- a/servers/slapd/overlays/dyngroup.c ++++ b/servers/slapd/overlays/dyngroup.c +@@ -111,7 +111,7 @@ static int dgroup_cf( ConfigArgs *c ) + */ + a2 = ch_malloc( sizeof(adpair) ); + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (adpair **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_mem = ap.ap_mem; +diff --git a/servers/slapd/overlays/valsort.c b/servers/slapd/overlays/valsort.c +index 3d998e2fcb..e251500d0b 100644 +--- a/servers/slapd/overlays/valsort.c ++++ b/servers/slapd/overlays/valsort.c +@@ -201,7 +201,7 @@ valsort_cf_func(ConfigArgs *c) { + return(1); + } + +- for ( vip = &on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) ++ for ( vip = (valsort_info **)&on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) + /* Get to the end */ ; + + vi = ch_malloc( sizeof(valsort_info) ); +-- +GitLab + diff --git a/openldap-ldapi-sasl.patch b/openldap-ldapi-sasl.patch deleted file mode 100644 index 058cc1c..0000000 --- a/openldap-ldapi-sasl.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Tue, 7 May 2013 17:02:57 +0200 -Subject: [PATCH] LDAPI SASL fix - -Resolves: #960222 ---- - libraries/libldap/cyrus.c | 19 ++++++++++++++++--- - 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-) - -diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c -index 28c241b..a9acf36 100644 ---- a/libraries/libldap/cyrus.c -+++ b/libraries/libldap/cyrus.c -@@ -394,6 +394,8 @@ ldap_int_sasl_bind( - struct berval ccred = BER_BVNULL; - int saslrc, rc; - unsigned credlen; -+ char my_hostname[HOST_NAME_MAX + 1]; -+ int free_saslhost = 0; - - Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n", - mechs ? mechs : "", 0, 0 ); -@@ -454,14 +456,25 @@ ldap_int_sasl_bind( - - /* If we don't need to canonicalize just use the host - * from the LDAP URI. -+ * Always use the result of gethostname() for LDAPI. - */ -- if ( nocanon ) -+ if (ld->ld_defconn->lconn_server->lud_scheme != NULL && -+ strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) { -+ rc = gethostname(my_hostname, HOST_NAME_MAX + 1); -+ if (rc == 0) { -+ saslhost = my_hostname; -+ } else { -+ saslhost = "localhost"; -+ } -+ } else if ( nocanon ) - saslhost = ld->ld_defconn->lconn_server->lud_host; -- else -+ else { - saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb, - "localhost" ); -+ free_saslhost = 1; -+ } - rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost ); -- if ( !nocanon ) -+ if ( free_saslhost ) - LDAP_FREE( saslhost ); - } - --- -1.7.11.7 - diff --git a/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch new file mode 100644 index 0000000..3663f3f --- /dev/null +++ b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch @@ -0,0 +1,92 @@ +From 5f4569f0605a73eb1a282ee5251ead073ed3b26e Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Tue, 26 Nov 2024 12:32:07 -0800 +Subject: [PATCH] libldap: avoid SSL context cleanup during library destruction + +Given that libldap can be pulled into random applications and applications +are allowed to call OPENSSL_cleanup() before exiting, the only sane thing +to do is to avoid trying to touch SSL context in ldap destructors, and just +let them leak if the application does not explicitly free the ldap context. + +Add ldap_int_tls_destroy_safe() which skips SSL context cleanup while +maintaining all other cleanup operations, and use it in the library +destructor path. + +Fixes: https://bugs.openldap.org/show_bug.cgi?id=9952 +--- + libraries/libldap/init.c | 2 +- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/tls2.c | 25 +++++++++++++++++++++---- + 3 files changed, 23 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..aa017f4128 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -545,7 +545,7 @@ ldap_int_destroy_global_options(void) + } + #endif + #ifdef HAVE_TLS +- ldap_int_tls_destroy( gopts ); ++ ldap_int_tls_destroy_safe( gopts ); + #endif + } + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..b73097ccc7 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -914,6 +914,7 @@ LDAP_F (int) ldap_int_tls_start LDAP_P(( LDAP *ld, + LDAPConn *conn, LDAPURLDesc *srv )); + + LDAP_F (void) ldap_int_tls_destroy LDAP_P(( struct ldapoptions *lo )); ++LDAP_F (void) ldap_int_tls_destroy_safe LDAP_P(( struct ldapoptions *lo )); + + /* + * in getvalues.c +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 0841005a59..82f8573602 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -97,10 +97,14 @@ tls_ctx_ref( tls_ctx *ctx ) + static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; + #endif + +-void +-ldap_int_tls_destroy( struct ldapoptions *lo ) +-{ +- if ( lo->ldo_tls_ctx ) { ++/* ++ * Implementation function that handles all cleanup. ++ * skip_ctx_cleanup: 1 when called from destructor, 0 for normal operation ++ */ ++static void ++ldap_int_tls_destroy_impl( struct ldapoptions *lo, int skip_ctx_cleanup ) ++ { ++ if ( lo->ldo_tls_ctx && !skip_ctx_cleanup ) { + ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); + lo->ldo_tls_ctx = NULL; + } +@@ -147,6 +151,19 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) + BER_BVZERO( &lo->ldo_tls_pin ); + } + ++ ++void ++ldap_int_tls_destroy( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 0); ++} ++ ++/* Safe version for destructor use */ ++void ldap_int_tls_destroy_safe( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 1); ++} ++ + /* + * Tear down the TLS subsystem. Should only be called once. + */ +-- +2.47.0 + diff --git a/openldap-loglevel2bvarray.patch b/openldap-loglevel2bvarray.patch deleted file mode 100644 index 1a0e766..0000000 --- a/openldap-loglevel2bvarray.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 4313b91b0bc2fe6585656cd69a03f9755b5af3c4 Mon Sep 17 00:00:00 2001 -From: Jan Synacek -Date: Wed, 29 May 2013 10:21:40 +0200 -Subject: [PATCH] Fix loglevel2bvarray - ---- - servers/slapd/bconfig.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c -index 4e1f1b5..def6daf 100644 ---- a/servers/slapd/bconfig.c -+++ b/servers/slapd/bconfig.c -@@ -3622,6 +3622,10 @@ loglevel2bvarray( int l, BerVarray *bva ) - loglevel_init(); - } - -+ if ( l == 0 ) { -+ return value_add_one( bva, ber_bvstr( "0" ) ); -+ } -+ - return mask_to_verbs( loglevel_ops, l, bva ); - } - --- -1.8.1.4 - diff --git a/openldap-manpages.patch b/openldap-manpages.patch index b69a391..2303570 100644 --- a/openldap-manpages.patch +++ b/openldap-manpages.patch @@ -1,35 +1,20 @@ Various manual pages changes: * removes LIBEXECDIR from slapd.8 -* removes references to non-existing manpages (bz 624616) -diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 -index 3def6da..466c772 100644 ---- a/doc/man/man1/ldapmodify.1 -+++ b/doc/man/man1/ldapmodify.1 -@@ -397,8 +397,7 @@ exit status and a diagnostic message being written to standard error. - .BR ldap_add_ext (3), - .BR ldap_delete_ext (3), - .BR ldap_modify_ext (3), --.BR ldap_modrdn_ext (3), --.BR ldif (5). -+.BR ldif (5) - .SH AUTHOR - The OpenLDAP Project - .SH ACKNOWLEDGEMENTS diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index cfde143..63592cb 100644 +index d47481d6ed..ff86fc52ca 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -317,6 +317,7 @@ certificates in separate individual files. The +@@ -341,6 +341,7 @@ be specified, separated by a semi-colon. The .B TLS_CACERT is always used before - .B TLS_CACERTDIR. + .BR TLS_CACERTDIR . +The specified directory must be managed with the OpenSSL c_rehash utility. - This parameter is ignored with GnuTLS. - - When using Mozilla NSS, may contain a Mozilla NSS cert/key + .TP + .B TLS_CERT + Specifies the file that contains the client certificate. diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 -index b739f4d..e2a1a00 100644 +index 807634e52d..a06110687b 100644 --- a/doc/man/man8/slapd.8 +++ b/doc/man/man8/slapd.8 @@ -5,7 +5,7 @@ @@ -39,18 +24,18 @@ index b739f4d..e2a1a00 100644 -.B LIBEXECDIR/slapd +.B slapd [\c - .BR \-4 | \-6 ] + .BR \-V [ V [ V ]] [\c -@@ -317,7 +317,7 @@ the LDAP databases defined in the default config file, just type: +@@ -333,7 +333,7 @@ the LDAP databases defined in the default config file, just type: .LP .nf .ft tt - LIBEXECDIR/slapd -+ slapd ++ slapd .ft .fi .LP -@@ -328,7 +328,7 @@ on voluminous debugging which will be printed on standard error, type: +@@ -344,7 +344,7 @@ on voluminous debugging which will be printed on standard error, type: .LP .nf .ft tt @@ -59,7 +44,7 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP -@@ -336,7 +336,7 @@ To test whether the configuration file is correct or not, type: +@@ -352,7 +352,7 @@ To test whether the configuration file is correct or not, type: .LP .nf .ft tt @@ -68,6 +53,3 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP --- -1.8.1.4 - diff --git a/openldap-nss-allow-certname-with-token-name.patch b/openldap-nss-allow-certname-with-token-name.patch deleted file mode 100644 index a75e84f..0000000 --- a/openldap-nss-allow-certname-with-token-name.patch +++ /dev/null @@ -1,47 +0,0 @@ -Accept nss certificate name in the form of tokenname:certnickname - -Author: Rich Megginson -Upstream ITS: #7360 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 5022efb..7377bb1 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2102,6 +2102,22 @@ tlsm_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - return 0; - } - -+/* returns true if the given string looks like -+ "tokenname" ":" "certnickname" -+ This is true if there is a ':' colon character -+ in the string and the colon is not the first -+ or the last character in the string -+*/ -+static int -+tlsm_is_tokenname_certnick( const char *certfile ) -+{ -+ if ( certfile ) { -+ const char *ptr = PL_strchr( certfile, ':' ); -+ return ptr && (ptr != certfile) && (*(ptr+1)); -+ } -+ return 0; -+} -+ - static int - tlsm_deferred_ctx_init( void *arg ) - { -@@ -2268,7 +2284,10 @@ tlsm_deferred_ctx_init( void *arg ) - } else { - char *tmp_certname; - -- if (ctx->tc_certdb_slot) { -+ if (tlsm_is_tokenname_certnick(lt->lt_certfile)) { -+ /* assume already in form tokenname:certnickname */ -+ tmp_certname = PL_strdup(lt->lt_certfile); -+ } else if (ctx->tc_certdb_slot) { - tmp_certname = PR_smprintf(TLSM_CERTDB_DESC_FMT ":%s", ctx->tc_unique, lt->lt_certfile); - } else { - tmp_certname = PR_smprintf("%s", lt->lt_certfile); --- -1.7.11.4 - diff --git a/openldap-nss-certs-from-certdb-fallback-pem.patch b/openldap-nss-certs-from-certdb-fallback-pem.patch deleted file mode 100644 index d20e48a..0000000 --- a/openldap-nss-certs-from-certdb-fallback-pem.patch +++ /dev/null @@ -1,86 +0,0 @@ -MozNSS: load certificates from certdb, fallback to PEM - -If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS -certificate database, the backend assumed that the certificate is always -located in the certificate database. This assumption might be wrong. - -This patch makes the library to try to load the certificate from NSS -database and fallback to PEM file if unsuccessfull. - -Author: Jan Vcelak -Upstream ITS: #7389 -Resolves: #857455 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 6847bea..8339391 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx ) - /* prefer unlocked key, then key from opened certdb, then any other */ - if ( unlocked_key ) - ctx->tc_private_key = unlocked_key; -- else if ( ctx->tc_certdb_slot ) -+ else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem ) - ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg ); - else - ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg ); -@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg ) - } - return -1; - } -- -- ctx->tc_using_pem = PR_TRUE; - } - - NSS_SetDomesticPolicy(); -@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg ) - - /* set up our cert and key, if any */ - if ( lt->lt_certfile ) { -- /* if using the PEM module, load the PEM file specified by lt_certfile */ -- /* otherwise, assume this is the name of a cert already in the db */ -- if ( ctx->tc_using_pem ) { -- /* this sets ctx->tc_certificate to the correct value */ -- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ); -- if ( rc ) { -- return rc; -- } -- } else { -+ -+ /* first search in certdb (lt_certfile is nickname) */ -+ if ( ctx->tc_certdb ) { - char *tmp_certname; - - if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) { -@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg ) - Debug( LDAP_DEBUG_ANY, - "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n", - lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ } -+ } -+ -+ /* fallback to PEM module (lt_certfile is filename) */ -+ if ( !ctx->tc_certificate ) { -+ if ( !pem_module && tlsm_init_pem_module() ) { -+ int pem_errcode = PORT_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n", -+ pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - return -1; - } -+ -+ /* this sets ctx->tc_certificate to the correct value */ -+ if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) { -+ ctx->tc_using_pem = PR_TRUE; -+ } -+ } -+ -+ if ( ctx->tc_certificate ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile, -+ ctx->tc_using_pem ? "PEM file" : "moznss database", 0); -+ } else { -+ return -1; - } - } - diff --git a/openldap-nss-cipher-attributes.patch b/openldap-nss-cipher-attributes.patch deleted file mode 100644 index ad15aea..0000000 --- a/openldap-nss-cipher-attributes.patch +++ /dev/null @@ -1,95 +0,0 @@ -Update MozNSS cipher attributes definitions - -Author: Matus Honek -PreviousAuthor: Jan Vcelak - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -210,27 +210,44 @@ typedef struct { - int num; /* The cipher id */ - int attr; /* cipher attributes: algorithms, etc */ - int version; /* protocol version valid for this cipher */ -- int bits; /* bits of strength */ -- int alg_bits; /* bits of the algorithm */ - int strength; /* LOW, MEDIUM, HIGH */ - int enabled; /* Enabled by default? */ - } cipher_properties; - - /* cipher attributes */ --#define SSL_kRSA 0x00000001L --#define SSL_aRSA 0x00000002L --#define SSL_aDSS 0x00000004L --#define SSL_DSS SSL_aDSS --#define SSL_eNULL 0x00000008L --#define SSL_DES 0x00000010L --#define SSL_3DES 0x00000020L --#define SSL_RC4 0x00000040L --#define SSL_RC2 0x00000080L --#define SSL_AES 0x00000100L --#define SSL_MD5 0x00000200L --#define SSL_SHA1 0x00000400L --#define SSL_SHA SSL_SHA1 --#define SSL_RSA (SSL_kRSA|SSL_aRSA) -+#define SSL_kRSA 0x00000001L -+#define SSL_aRSA 0x00000002L -+#define SSL_aDSA 0x00000004L -+#define SSL_DSA SSL_aDSA -+#define SSL_eNULL 0x00000008L -+#define SSL_DES 0x00000010L -+#define SSL_3DES 0x00000020L -+#define SSL_RC4 0x00000040L -+#define SSL_RC2 0x00000080L -+#define SSL_AES128 0x00000100L -+#define SSL_AES256 0x00000200L -+#define SSL_MD5 0x00000400L -+#define SSL_SHA1 0x00000800L -+#define SSL_kEDH 0x00001000L -+#define SSL_CAMELLIA128 0x00002000L -+#define SSL_CAMELLIA256 0x00004000L -+#define SSL_SEED 0x00008000L -+#define SSL_kECDH 0x00010000L -+#define SSL_kECDHE 0x00020000L -+#define SSL_aECDSA 0x00040000L -+#define SSL_SHA256 0x00080000L -+#define SSL_SHA384 0x00100000L -+#define SSL_kEECDH 0x00200000L -+#define SSL_AESGCM 0x00400000L -+#define SSL_AEAD 0x00800000L -+#define SSL_aPSK 0x01000000L -+#define SSL_CHACHA20POLY1305 0x02000000L -+ -+/* cipher attributes non-unique - do not use for definitions */ -+#define SSL_RSA 0x00000001L -+#define SSL_AES 0x00000002L -+#define SSL_CAMELLIA 0x00000004L -+#define SSL_ECDH 0x00000008L - - /* cipher strength */ - #define SSL_NULL 0x00000001L -@@ -240,10 +257,15 @@ typedef struct { - #define SSL_MEDIUM 0x00000010L - #define SSL_HIGH 0x00000020L - -+/* cipher strengths non-unique - do not use for definitions */ -+#define SSL_EXPORT 0x00000001L -+ - #define SSL2 0x00000001L - #define SSL3 0x00000002L - /* OpenSSL treats SSL3 and TLSv1 the same */ - #define TLS1 SSL3 -+#define TLS1_2 0x00000004L -+#define TLS1_3 0x00000008L - - /* Cipher translation */ - static cipher_properties ciphers_def[] = { ---- openldap-2.4.40/include/ldap.h 2014-09-19 03:48:49.000000000 +0200 -+++ openldap-2.4.40/include/ldap.h 2014-11-14 09:25:54.560801030 +0100 -@@ -176,6 +176,7 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_0 ((3 << 8) + 1) - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_1 ((3 << 8) + 2) - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 ((3 << 8) + 3) -+#define LDAP_OPT_X_TLS_PROTOCOL_TLS1_3 ((3 << 8) + 4) - - /* OpenLDAP SASL options */ - #define LDAP_OPT_X_SASL_MECH 0x6100 diff --git a/openldap-nss-ciphers-definitions.patch b/openldap-nss-ciphers-definitions.patch deleted file mode 100644 index 6de142c..0000000 --- a/openldap-nss-ciphers-definitions.patch +++ /dev/null @@ -1,139 +0,0 @@ -Update MozNSS definitions of ciphers - -Author: Matus Honek -PreviousAuthor: Jan Vcelak - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -268,29 +268,109 @@ typedef struct { - - /* Cipher translation */ - static cipher_properties ciphers_def[] = { -- /* SSL 2 ciphers */ -- {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED}, -- {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED}, -- {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, -- {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, -- -- /* SSL3 ciphers */ -- {"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED}, -- {"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED}, -- {"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, -- {"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED}, -- {"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED}, -- {"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED}, -+ -+ /* SSLv2 ciphers */ -+ {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, SSL_LOW}, -+ {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH}, -+ {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_MEDIUM}, -+ {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_MEDIUM}, -+ {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_EXPORT40}, -+ {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_EXPORT40}, -+ -+ /* SSLv3 ciphers */ -+ {"NULL-MD5", TLS_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, SSL_NULL}, /* SSL_RSA_WITH_NULL_MD5 */ -+ {"NULL-SHA", TLS_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL}, /* SSL_RSA_WITH_NULL_SHA */ -+ {"DES-CBC-SHA", TLS_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW}, /* SSL_RSA_WITH_DES_CBC_SHA */ -+ {"DES-CBC3-SHA", TLS_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH}, /* SSL_RSA_WITH_3DES_EDE_CBC_SHA */ -+ {"RC4-MD5", TLS_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_MEDIUM}, /* SSL_RSA_WITH_RC4_128_MD5 */ -+ {"RC4-SHA", TLS_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, SSL_MEDIUM}, /* SSL_RSA_WITH_RC4_128_SHA */ -+ {"EXP-RC2-CBC-MD5", TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, SSL_EXPORT40}, /* SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */ -+ {"EXP-RC4-MD5", TLS_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_EXPORT40}, /* SSL_RSA_EXPORT_WITH_RC4_40_MD5 */ -+ {"EDH-RSA-DES-CBC-SHA", TLS_DHE_RSA_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW}, /* SSL_DHE_RSA_WITH_DES_CBC_SHA */ -+ {"EDH-RSA-DES-CBC3-SHA", TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH}, /* SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA */ -+ {"EDH-DSS-DES-CBC-SHA", TLS_DHE_DSS_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW}, /* SSL_DHE_DSS_WITH_DES_CBC_SHA */ -+ {"EDH-DSS-DES-CBC3-SHA", TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH}, /* SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA */ - - /* TLSv1 ciphers */ -- {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED}, -- {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED}, -- {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED}, -- {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED}, -+ {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, TLS1, SSL_EXPORT56}, -+ {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_EXPORT56}, -+ {"SEED-SHA", TLS_RSA_WITH_SEED_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"CAMELLIA256-SHA", TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"CAMELLIA128-SHA", TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-AES128-SHA", TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-AES256-SHA", TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-CAMELLIA128-SHA", TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-CAMELLIA256-SHA", TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-RC4-SHA", TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"DHE-DSS-AES128-SHA", TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-AES256-SHA", TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-CAMELLIA128-SHA", TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-CAMELLIA256-SHA", TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-RSA-NULL-SHA", TLS_ECDH_RSA_WITH_NULL_SHA, SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDH-RSA-RC4-SHA", TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDH-RSA-DES-CBC3-SHA", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-RSA-AES128-SHA", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-RSA-AES256-SHA", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-ECDSA-NULL-SHA", TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDH-ECDSA-RC4-SHA", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDH-ECDSA-DES-CBC3-SHA", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-ECDSA-AES128-SHA", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-ECDSA-AES256-SHA", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-RSA-NULL-SHA", TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDHE-RSA-RC4-SHA", TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDHE-RSA-DES-CBC3-SHA", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-RSA-AES128-SHA", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-RSA-AES256-SHA", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-ECDSA-NULL-SHA", TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDHE-ECDSA-RC4-SHA", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES128-SHA", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES256-SHA", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ -+ // Ciphers commented out are not in NSS yet. -+ -+ {"NULL-SHA256", TLS_RSA_WITH_NULL_SHA256, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA256, TLS1_2, SSL_NULL}, -+ {"AES128-SHA256", TLS_RSA_WITH_AES_128_CBC_SHA256, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"AES256-SHA256", TLS_RSA_WITH_AES_256_CBC_SHA256, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"AES128-GCM-SHA256", TLS_RSA_WITH_AES_128_GCM_SHA256, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"AES256-GCM-SHA384", 0x009d /* TLS_RSA_WITH_AES_256_GCM_SHA384 */, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ {"DHE-RSA-AES256-SHA256", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-RSA-AES128-SHA256", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-RSA-AES128-GCM-SHA256", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"DHE-RSA-AES256-GCM-SHA384", 0x009f /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ {"DHE-DSS-AES128-SHA256", TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-DSS-AES256-SHA256", TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-DSS-AES128-GCM-SHA256", TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"DHE-DSS-AES128-GCM-SHA256", 0x00a3 /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"DHE-DSS-AES128-GCM-SHA384", TLS_DHE_DSS_WITH_AES_128_GCM_SHA384, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ {"ECDHE-ECDSA-AES128-SHA256", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES128-SHA256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES128-GCM-SHA256", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES128-GCM-SHA256", TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES256-GCM-SHA384", 0xc02c /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES256-GCM-SHA384", 0xc030 /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES256-SHA384", 0xc024 /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA384, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES256-SHA384", 0xc028 /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA384, TLS1_2, SSL_HIGH}, -+ -+ {"ECDHE-PSK-AES128-GCM-SHA256", 0xd001 /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */, SSL_kECDHE|SSL_aPSK|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-PSK-CHACHA20-POLY1305", 0xccac /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kECDHE|SSL_aPSK|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-PSK-AES256-GCM-SHA384", 0xd002 /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */, SSL_kECDHE|SSL_aPSK|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"", 0x00aa /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */, SSL_kEDH|SSL_aPSK|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"", 0xccad /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kEDH|SSL_aPSK|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"", 0x00ab /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */, SSL_kEDH|SSL_aPSK|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"ECDHE-ECDSA-CHACHA20-POLY1305", 0xcca9 /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kECDHE|SSL_aECDSA|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"ECDHE-RSA-CHACHA20-POLY1305", 0xcca8 /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kECDHE|SSL_aRSA|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"DHE-RSA-CHACHA20-POLY1305", 0xccaa /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kEDH|SSL_aRSA|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ // TLSv1.3 -+ {"TLS13-AES-128-GCM-SHA256", 0x1301 /* TLS_AES_128_GCM_SHA256 */, SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_3, SSL_HIGH}, -+ {"TLS13-AES-256-GCM-SHA384", 0x1302 /* TLS_AES_256_GCM_SHA384 */, SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_3, SSL_HIGH}, -+ {"TLS13-CHACHA20-POLY1305-SHA256", 0x1303 /* TLS_CHACHA20_POLY1305_SHA256 */, SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_3, SSL_HIGH}, - }; - - #define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties)) diff --git a/openldap-nss-ciphers-parsing.patch b/openldap-nss-ciphers-parsing.patch deleted file mode 100644 index dd0407b..0000000 --- a/openldap-nss-ciphers-parsing.patch +++ /dev/null @@ -1,196 +0,0 @@ -Update MozNSS OpenSSL-like parsing code - -Author: Matus Honek -PreviousAuthor: Jan Vcelak - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -617,10 +617,12 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - while ((*cipher) && (isspace(*cipher))) - ++cipher; - -- action = 1; - switch(*cipher) { -- case '+': /* Add something */ -- action = 1; -+ case '+': /* Do nothig. NSS does not support ordering. */ -+ Debug( LDAP_DEBUG_ARGS, -+ "TLS: warning: parsing cipher string: ordering is not supported by NSS.\n", -+ 0, 0, 0 ); -+ action = 2; - cipher++; - break; - case '-': /* Subtract something */ -@@ -631,8 +633,8 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - action = -1; - cipher++; - break; -- default: -- /* do nothing */ -+ default: /* Add something */ -+ action = 1; - break; - } - -@@ -666,7 +668,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - } - } else { - int mask = 0; -+ int multi_mask = 0; -+ int negative_mask = 0; - int strength = 0; -+ int multi_strength = 0; - int protocol = 0; - char *c; - -@@ -677,12 +682,21 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - *c++ = '\0'; - } - -- if (!strcmp(cipher, "RSA")) { -- mask |= SSL_RSA; -+ if ((!strcmp(cipher, "RSA")) || (!strcmp(cipher, "kRSA"))) { -+ mask |= SSL_kRSA; -+ } else if (!strcmp(cipher, "aRSA")) { -+ mask |= SSL_aRSA; -+ negative_mask |= SSL_kECDH; - } else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) { - mask |= SSL_eNULL; -+ } else if (!strcmp(cipher, "AES128")) { -+ mask |= SSL_AES128; -+ } else if (!strcmp(cipher, "AES256")) { -+ mask |= SSL_AES256; -+ } else if (!strcmp(cipher, "AESGCM")) { -+ mask |= SSL_AESGCM; - } else if (!strcmp(cipher, "AES")) { -- mask |= SSL_AES; -+ multi_mask |= SSL_AES; - } else if (!strcmp(cipher, "3DES")) { - mask |= SSL_3DES; - } else if (!strcmp(cipher, "DES")) { -@@ -693,26 +707,69 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - mask |= SSL_RC2; - } else if (!strcmp(cipher, "MD5")) { - mask |= SSL_MD5; -+ } else if (!strcmp(cipher, "SHA256")) { -+ mask |= SSL_SHA256; -+ } else if (!strcmp(cipher, "SHA384")) { -+ mask |= SSL_SHA384; - } else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) { - mask |= SSL_SHA1; -+ } else if ((!strcmp(cipher, "EDH")) || (!strcmp(cipher, "DH"))) { -+ mask |= SSL_kEDH; -+ } else if ((!strcmp(cipher, "DSS")) || (!strcmp(cipher, "aDSS"))) { -+ mask |= SSL_aDSA; -+ } else if (!strcmp(cipher, "CAMELLIA128")) { -+ mask |= SSL_CAMELLIA128; -+ } else if (!strcmp(cipher, "CAMELLIA256")) { -+ mask |= SSL_CAMELLIA256; -+ } else if (!strcmp(cipher, "CAMELLIA")) { -+ multi_mask |= SSL_CAMELLIA; -+ } else if (!strcmp(cipher, "SEED")) { -+ mask |= SSL_SEED; -+ } else if (!strcmp(cipher, "kECDHe")) { -+ mask |= SSL_kECDH|SSL_aECDSA; -+ } else if (!strcmp(cipher, "kECDHr")) { -+ mask |= SSL_kECDH|SSL_aRSA; -+ } else if (!strcmp(cipher, "kECDH")) { -+ mask |= SSL_kECDH; -+ } else if (!strcmp(cipher, "aECDH")) { -+ mask |= SSL_kECDH; -+ } else if (!strcmp(cipher, "EECDH")) { -+ mask |= SSL_kECDHE; -+ } else if (!strcmp(cipher, "kEECDH")) { -+ mask |= SSL_kECDHE; -+ } else if (!strcmp(cipher, "ECDHE")) { -+ mask |= SSL_kECDHE; -+ } else if (!strcmp(cipher, "ECDH")) { -+ multi_mask |= SSL_ECDH; -+ } else if ((!strcmp(cipher, "ECDSA")) || (!strcmp(cipher, "aECDSA"))) { -+ mask |= SSL_aECDSA; -+ negative_mask |= SSL_kECDH; -+ } else if (!strcmp(cipher, "PSK")) { -+ mask |= SSL_aPSK; -+ } else if (!strcmp(cipher, "CHACHA20POLY1305")) { -+ mask |= SSL_CHACHA20POLY1305; - } else if (!strcmp(cipher, "SSLv2")) { - protocol |= SSL2; - } else if (!strcmp(cipher, "SSLv3")) { - protocol |= SSL3; - } else if (!strcmp(cipher, "TLSv1")) { - protocol |= TLS1; -+ } else if (!strcmp(cipher, "TLSv1.2")) { -+ protocol |= TLS1_2; -+ } else if (!strcmp(cipher, "TLSv1.3")) { -+ protocol |= TLS1_3; - } else if (!strcmp(cipher, "HIGH")) { - strength |= SSL_HIGH; - } else if (!strcmp(cipher, "MEDIUM")) { - strength |= SSL_MEDIUM; - } else if (!strcmp(cipher, "LOW")) { - strength |= SSL_LOW; -- } else if ((!strcmp(cipher, "EXPORT")) || (!strcmp(cipher, "EXP"))) { -- strength |= SSL_EXPORT40|SSL_EXPORT56; - } else if (!strcmp(cipher, "EXPORT40")) { - strength |= SSL_EXPORT40; - } else if (!strcmp(cipher, "EXPORT56")) { - strength |= SSL_EXPORT56; -+ } else if ((!strcmp(cipher, "EXPORT")) || (!strcmp(cipher, "EXP"))) { -+ multi_strength |= SSL_EXPORT; - } - - if (c) -@@ -720,23 +775,39 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - - } /* while */ - -+ /* NSS does not support ordering */ -+ if (action == 2) -+ continue; -+ - /* If we have a mask, apply it. If not then perhaps they provided - * a specific cipher to enable. -+ * if more than one mask is provided then AND logic applies (to match openssl) - */ -- if (mask || strength || protocol) { -+ if (mask || negative_mask || multi_mask || strength || multi_strength || protocol) { - for (i=0; i -Resolves: #1387868 -Backports: #1245279 #1300701 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -645,7 +645,16 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - } - } else if (!strcmp(cipher, "DEFAULT")) { - for (i=0; i -Upstream ITS: #7285 -Upstream commit: 2c2bb2e7aee1b2167f383a8344985a1cf66aff3f -Resolves: #828790 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 23d843c..b608551 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2218,12 +2218,13 @@ tlsm_deferred_ctx_init( void *arg ) - return -1; - } - -- if ( lt->lt_ciphersuite && -- tlsm_parse_ciphers( ctx, lt->lt_ciphersuite )) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not set cipher list %s.\n", -- lt->lt_ciphersuite, 0, 0 ); -- return -1; -+ if ( lt->lt_ciphersuite ) { -+ if ( tlsm_parse_ciphers( ctx, lt->lt_ciphersuite ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not set cipher list %s.\n", -+ lt->lt_ciphersuite, 0, 0 ); -+ return -1; -+ } - } else if ( tlsm_parse_ciphers( ctx, "DEFAULT" ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not set cipher list DEFAULT.\n", --- -1.7.10.4 - diff --git a/openldap-nss-ignore-certdb-type-prefix.patch b/openldap-nss-ignore-certdb-type-prefix.patch deleted file mode 100644 index 2fab916..0000000 --- a/openldap-nss-ignore-certdb-type-prefix.patch +++ /dev/null @@ -1,47 +0,0 @@ -MozNSS: ignore certdb database type prefix when checking existence of the directory - -If the certdb is specified including the database type prefix (e.g. -sql:, dbm:), the prefix has to be ignored when checking the -certificate directory existence. - -Author: Jan Vcelak -Upstream ITS: #7388 -Resolves: #857373 - ---- - libraries/libldap/tls_m.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 49a3f8f..5ee21a2 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) - { - char sep = PR_GetDirectorySeparator(); - char *ptr = NULL; -+ char *chkpath = NULL; - struct PRFileInfo prfi; - PRStatus prc; - -@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) - return; - } - -- prc = PR_GetFileInfo( certdir, &prfi ); -+ /* ignore database type prefix (e.g. sql:, dbm:) if provided */ -+ chkpath = strchr( certdir, ':' ); -+ if ( chkpath != NULL ) { -+ chkpath += 1; -+ } else { -+ chkpath = certdir; -+ } -+ - /* if certdir exists (file or directory) then it cannot specify a prefix */ -+ prc = PR_GetFileInfo( chkpath, &prfi ); - if ( prc == PR_SUCCESS ) { - return; - } --- -1.7.11.7 - diff --git a/openldap-nss-multiple-tls-contexts.patch b/openldap-nss-multiple-tls-contexts.patch deleted file mode 100644 index bf008f4..0000000 --- a/openldap-nss-multiple-tls-contexts.patch +++ /dev/null @@ -1,1029 +0,0 @@ -MozNSS: TLS fixes which should resolve problems with applications using multiple TLS contexts - - - context specific token description for certdb - - store certificate object instead of nickname in in ctx - - lock whole init and clenaup process - - do not authenticate to a slot manually - - do not retry when reading the pin from file - -Author: Jan Vcelak -Upstream ITS: #7312 #7313 #7314 #7315 #7316 -Upstream commit: 87132b8 d07779e 3531c34 a171237 2db5195 -Resolves: #795763 (and possibly other) - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 2e755eb..4b5727b 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -81,16 +81,18 @@ - typedef struct tlsm_ctx { - PRFileDesc *tc_model; - int tc_refcnt; -+ int tc_unique; /* unique number associated with this ctx */ - PRBool tc_verify_cert; - CERTCertDBHandle *tc_certdb; -- char *tc_certname; -+ PK11SlotInfo *tc_certdb_slot; -+ CERTCertificate *tc_certificate; -+ SECKEYPrivateKey *tc_private_key; - char *tc_pin_file; - struct ldaptls *tc_config; - int tc_is_server; - int tc_require_cert; - PRCallOnceType tc_callonce; - PRBool tc_using_pem; -- char *tc_slotname; /* if using pem */ - #ifdef HAVE_NSS_INITCONTEXT - NSSInitContext *tc_initctx; /* the NSS context */ - #endif -@@ -104,10 +106,16 @@ typedef struct tlsm_ctx { - - typedef PRFileDesc tlsm_session; - -+static int tlsm_ctx_count; -+#define TLSM_CERTDB_DESC_FMT "ldap(%d)" -+ - static PRDescIdentity tlsm_layer_id; - - static const PRIOMethods tlsm_PR_methods; - -+#define CERTDB_NONE NULL -+#define PREFIX_NONE NULL -+ - #define PEM_LIBRARY "nsspem" - #define PEM_MODULE "PEM" - /* hash files for use with cacertdir have this file name suffix */ -@@ -117,13 +125,11 @@ static const PRIOMethods tlsm_PR_methods; - static SECMODModule *pem_module; - - #define DEFAULT_TOKEN_NAME "default" --/* sprintf format used to create token name */ --#define TLSM_PEM_TOKEN_FMT "PEM Token #%ld" -+#define TLSM_PEM_SLOT_CACERTS "PEM Token #0" -+#define TLSM_PEM_SLOT_CERTS "PEM Token #1" - --static int tlsm_slot_count; -- --#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \ -- (x)->pValue=(v); (x)->ulValueLen = (l); -+#define PK11_SETATTRS(x,id,v,l) (x).type = (id); \ -+ (x).pValue=(v); (x).ulValueLen = (l); - - /* forward declaration */ - static int tlsm_init( void ); -@@ -134,6 +140,7 @@ static int tlsm_init( void ); - tlsm_thr_init in a non-threaded context - so we have - to wrap the mutex creation in a prcallonce - */ -+static ldap_pvt_thread_mutex_t tlsm_ctx_count_mutex; - static ldap_pvt_thread_mutex_t tlsm_init_mutex; - static ldap_pvt_thread_mutex_t tlsm_pem_mutex; - static PRCallOnceType tlsm_init_mutex_callonce = {0,0}; -@@ -141,6 +148,12 @@ static PRCallOnceType tlsm_init_mutex_callonce = {0,0}; - static PRStatus PR_CALLBACK - tlsm_thr_init_callonce( void ) - { -+ if ( ldap_pvt_thread_mutex_init( &tlsm_ctx_count_mutex ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not create mutex for context counter: %d\n", errno, 0, 0 ); -+ return PR_FAILURE; -+ } -+ - if ( ldap_pvt_thread_mutex_init( &tlsm_init_mutex ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not create mutex for moznss initialization: %d\n", errno, 0, 0 ); -@@ -890,6 +903,8 @@ tlsm_get_pin(PK11SlotInfo *slot, PRBool retry, tlsm_ctx *ctx) - */ - if ( ctx->tc_pin_file ) { - pwdstr = tlsm_get_pin_from_file( token_name, ctx ); -+ if (retry && pwdstr != NULL) -+ return NULL; - } - #endif /* RETRIEVE_PASSWORD_FROM_FILE */ - #ifdef READ_PASSWORD_FROM_STDIN -@@ -932,6 +947,15 @@ tlsm_pin_prompt(PK11SlotInfo *slot, PRBool retry, void *arg) - return tlsm_get_pin( slot, retry, ctx ); - } - -+static char * -+tlsm_ctx_subject_name(tlsm_ctx *ctx) -+{ -+ if (!ctx || !ctx->tc_certificate) -+ return "(unknown)"; -+ -+ return ctx->tc_certificate->subjectName; -+} -+ - static SECStatus - tlsm_get_basic_constraint_extension( CERTCertificate *cert, - CERTBasicConstraints *cbcval ) -@@ -1088,25 +1112,6 @@ tlsm_auth_cert_handler(void *arg, PRFileDesc *fd, - return ret; - } - --static int --tlsm_authenticate_to_slot( tlsm_ctx *ctx, PK11SlotInfo *slot ) --{ -- int rc = -1; -- -- if ( SECSuccess != PK11_Authenticate( slot, PR_FALSE, ctx ) ) { -- char *token_name = PK11_GetTokenName( slot ); -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not authenticate to the security token %s - error %d:%s.\n", -- token_name ? token_name : DEFAULT_TOKEN_NAME, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- } else { -- rc = 0; /* success */ -- } -- -- return rc; --} -- - static SECStatus - tlsm_nss_shutdown_cb( void *appData, void *nssData ) - { -@@ -1196,22 +1201,18 @@ tlsm_free_pem_objs( tlsm_ctx *ctx ) - } - - static int --tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca, PRBool istrusted ) -+tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca ) - { -- CK_SLOT_ID slotID; -- PK11SlotInfo *slot = NULL; -- PK11GenericObject *rv; -- CK_ATTRIBUTE *attrs; -- CK_ATTRIBUTE theTemplate[20]; -+ PK11SlotInfo *slot; -+ PK11GenericObject *cert; -+ CK_ATTRIBUTE attrs[4]; - CK_BBOOL cktrue = CK_TRUE; - CK_BBOOL ckfalse = CK_FALSE; - CK_OBJECT_CLASS objClass = CKO_CERTIFICATE; -- char tmpslotname[64]; -- char *slotname = NULL; -- const char *ptr = NULL; -- char sep = PR_GetDirectorySeparator(); -+ char *slotname; - PRFileInfo fi; - PRStatus status; -+ SECItem certDER = { 0, NULL, 0 }; - - memset( &fi, 0, sizeof(fi) ); - status = PR_GetFileInfo( filename, &fi ); -@@ -1232,87 +1233,96 @@ tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca, PRBoo - return -1; - } - -- attrs = theTemplate; -+ slotname = isca ? TLSM_PEM_SLOT_CACERTS : TLSM_PEM_SLOT_CERTS; -+ slot = PK11_FindSlotByName( slotname ); - -- if ( isca ) { -- slotID = 0; /* CA and trust objects use slot 0 */ -- PR_snprintf( tmpslotname, sizeof(tmpslotname), TLSM_PEM_TOKEN_FMT, slotID ); -- slotname = tmpslotname; -- istrusted = PR_TRUE; -- } else { -- if ( ctx->tc_slotname == NULL ) { /* need new slot */ -- if ( istrusted ) { -- slotID = 0; -- } else { -- slotID = ++tlsm_slot_count; -- } -- ctx->tc_slotname = PR_smprintf( TLSM_PEM_TOKEN_FMT, slotID ); -- } -- slotname = ctx->tc_slotname; -- -- if ( ( ptr = PL_strrchr( filename, sep ) ) ) { -- PL_strfree( ctx->tc_certname ); -- ++ptr; -- if ( istrusted ) { -- /* pemnss conflates trusted certs with CA certs - since there can -- be more than one CA cert in a file (e.g. ca-bundle.crt) pemnss -- numbers each trusted cert - in the case of a server cert, there will be -- only one, so it will be number 0 */ -- ctx->tc_certname = PR_smprintf( "%s:%s - 0", slotname, ptr ); -- } else { -- ctx->tc_certname = PR_smprintf( "%s:%s", slotname, ptr ); -- } -- } -+ if ( !slot ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not find the slot for the certificate '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ return -1; - } - -- slot = PK11_FindSlotByName( slotname ); -+ PK11_SETATTRS( attrs[0], CKA_CLASS, &objClass, sizeof(objClass) ); -+ PK11_SETATTRS( attrs[1], CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); -+ PK11_SETATTRS( attrs[2], CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); -+ PK11_SETATTRS( attrs[3], CKA_TRUST, isca ? &cktrue : &ckfalse, sizeof(CK_BBOOL) ); - -- if ( !slot ) { -+ cert = PK11_CreateGenericObject( slot, attrs, 4, PR_FALSE /* isPerm */ ); -+ -+ if ( !cert ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: could not find the slot for certificate %s - error %d:%s.\n", -- ctx->tc_certname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: could not add the certificate '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ PK11_FreeSlot( slot ); - return -1; - } - -- PK11_SETATTRS( attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++; -- PK11_SETATTRS( attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++; -- PK11_SETATTRS( attrs, CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); attrs++; -- if ( istrusted ) { -- PK11_SETATTRS( attrs, CKA_TRUST, &cktrue, sizeof(CK_BBOOL) ); attrs++; -- } else { -- PK11_SETATTRS( attrs, CKA_TRUST, &ckfalse, sizeof(CK_BBOOL) ); attrs++; -+ /* if not CA, we store the certificate in ctx->tc_certificate */ -+ if ( !isca ) { -+ if ( PK11_ReadRawAttribute( PK11_TypeGeneric, cert, CKA_VALUE, &certDER ) != SECSuccess ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not get DER of the '%s' certificate - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ PK11_DestroyGenericObject( cert ); -+ PK11_FreeSlot( slot ); -+ return -1; -+ } -+ -+ ctx->tc_certificate = PK11_FindCertFromDERCertItem( slot, &certDER, NULL ); -+ SECITEM_FreeItem( &certDER, PR_FALSE ); -+ -+ if ( !ctx->tc_certificate ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not get certificate '%s' using DER - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ PK11_DestroyGenericObject( cert ); -+ PK11_FreeSlot( slot ); -+ return -1; -+ } - } -- /* This loads the certificate in our PEM module into the appropriate -- * slot. -- */ -- rv = PK11_CreateGenericObject( slot, theTemplate, 4, PR_FALSE /* isPerm */ ); -+ -+ tlsm_add_pem_obj( ctx, cert ); - - PK11_FreeSlot( slot ); - -- if ( !rv ) { -+ return 0; -+} -+ -+static int -+tlsm_ctx_load_private_key(tlsm_ctx *ctx) -+{ -+ if (!ctx->tc_certificate) -+ return -1; -+ -+ if (ctx->tc_private_key) -+ return 0; -+ -+ void *pin_arg = SSL_RevealPinArg(ctx->tc_model); -+ -+ ctx->tc_private_key = PK11_FindKeyByAnyCert(ctx->tc_certificate, pin_arg); -+ if (!ctx->tc_private_key) { - PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not add the certificate %s - error %d:%s.\n", -- ctx->tc_certname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ Debug(LDAP_DEBUG_ANY, -+ "TLS: cannot find private key for certificate '%s' (error %d: %s)", -+ tlsm_ctx_subject_name(ctx), errcode, -+ PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT)); - return -1; - } - -- tlsm_add_pem_obj( ctx, rv ); -- - return 0; - } - - static int - tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename ) - { -- CK_SLOT_ID slotID; - PK11SlotInfo * slot = NULL; -- PK11GenericObject *rv; -- CK_ATTRIBUTE *attrs; -- CK_ATTRIBUTE theTemplate[20]; -+ PK11GenericObject *key; -+ CK_ATTRIBUTE attrs[3]; - CK_BBOOL cktrue = CK_TRUE; - CK_OBJECT_CLASS objClass = CKO_PRIVATE_KEY; - int retcode = 0; -@@ -1338,48 +1348,40 @@ tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename ) - return -1; - } - -- attrs = theTemplate; -- -- if ( ctx->tc_slotname == NULL ) { /* need new slot */ -- slotID = ++tlsm_slot_count; -- ctx->tc_slotname = PR_smprintf( TLSM_PEM_TOKEN_FMT, slotID ); -- } -- slot = PK11_FindSlotByName( ctx->tc_slotname ); -+ slot = PK11_FindSlotByName( TLSM_PEM_SLOT_CERTS ); - - if ( !slot ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: could not find the slot %s for the private key - error %d:%s.\n", -- ctx->tc_slotname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: could not find the slot for the private key '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); - return -1; - } - -- PK11_SETATTRS( attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++; -- PK11_SETATTRS( attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++; -- PK11_SETATTRS( attrs, CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); attrs++; -- rv = PK11_CreateGenericObject( slot, theTemplate, 3, PR_FALSE /* isPerm */ ); -+ PK11_SETATTRS( attrs[0], CKA_CLASS, &objClass, sizeof(objClass) ); -+ PK11_SETATTRS( attrs[1], CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); -+ PK11_SETATTRS( attrs[2], CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); -+ -+ key = PK11_CreateGenericObject( slot, attrs, 3, PR_FALSE /* isPerm */ ); - -- if ( !rv ) { -+ if ( !key ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: could not add the certificate %s - error %d:%s.\n", -- ctx->tc_certname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: could not add the private key '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); - retcode = -1; - } else { -+ tlsm_add_pem_obj( ctx, key ); -+ retcode = 0; -+ - /* When adding an encrypted key the PKCS#11 will be set as removed */ - /* This will force the token to be seen as re-inserted */ - SECMOD_WaitForAnyTokenEvent( pem_module, 0, 0 ); - PK11_IsPresent( slot ); -- retcode = 0; - } - - PK11_FreeSlot( slot ); - -- if ( !retcode ) { -- tlsm_add_pem_obj( ctx, rv ); -- } - return retcode; - } - -@@ -1396,7 +1398,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - } - - if ( cacertfile ) { -- int rc = tlsm_add_cert_from_file( ctx, cacertfile, isca, PR_TRUE ); -+ int rc = tlsm_add_cert_from_file( ctx, cacertfile, isca ); - if ( rc ) { - errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -@@ -1470,7 +1472,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - continue; - } - fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name ); -- if ( !tlsm_add_cert_from_file( ctx, fullpath, isca, PR_TRUE ) ) { -+ if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) { - Debug( LDAP_DEBUG_TRACE, - "TLS: loaded CA certificate file %s from CA certificate directory %s.\n", - fullpath, cacertdir, 0 ); -@@ -1534,6 +1536,45 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) - } - - /* -+ * Currently mutiple MozNSS contexts share one certificate storage. When the -+ * certdb is being opened, only new certificates are added to the storage. -+ * When different databases are used, conflicting nicknames make the -+ * certificate lookup by the nickname impossible. In addition a token -+ * description might be prepended in certain conditions. -+ * -+ * In order to make the certificate lookup by nickname possible, we explicitly -+ * open each database using SECMOD_OpenUserDB and assign it the token -+ * description. The token description is generated using ctx->tc_unique value, -+ * which is unique for each context. -+ */ -+static PK11SlotInfo * -+tlsm_init_open_certdb(tlsm_ctx *ctx, const char *dbdir, const char *prefix) -+{ -+ PK11SlotInfo *slot = NULL; -+ char *token_desc = NULL; -+ char *config = NULL; -+ -+ token_desc = PR_smprintf(TLSM_CERTDB_DESC_FMT, ctx->tc_unique); -+ config = PR_smprintf("configDir='%s' tokenDescription='%s' certPrefix='%s' keyPrefix='%s' flags=readOnly", -+ dbdir, token_desc, prefix, prefix); -+ Debug(LDAP_DEBUG_TRACE, "TLS: certdb config: %s\n", config, 0, 0); -+ -+ slot = SECMOD_OpenUserDB(config); -+ if (!slot) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug(LDAP_DEBUG_TRACE, "TLS: cannot open certdb '%s', error %d:%s\n", dbdir, errcode, -+ PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT)); -+ } -+ -+ if (token_desc) -+ PR_smprintf_free(token_desc); -+ if (config) -+ PR_smprintf_free(config); -+ -+ return slot; -+} -+ -+/* - * This is the part of the init we defer until we get the - * actual security configuration information. This is - * only called once, protected by a PRCallOnce -@@ -1553,6 +1594,7 @@ tlsm_deferred_init( void *arg ) - #ifdef HAVE_NSS_INITCONTEXT - NSSInitParameters initParams; - NSSInitContext *initctx = NULL; -+ PK11SlotInfo *certdb_slot = NULL; - #endif - SECStatus rc; - int done = 0; -@@ -1613,28 +1655,37 @@ tlsm_deferred_init( void *arg ) - } - - tlsm_get_certdb_prefix( securitydir, &realcertdir, &prefix ); -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - -+ /* initialize only moddb; certdb will be initialized explicitly */ - #ifdef HAVE_NSS_INITCONTEXT - #ifdef INITCONTEXT_HACK - if ( !NSS_IsInitialized() && ctx->tc_is_server ) { - rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY ); - } else { - initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB, -- &initParams, NSS_INIT_READONLY ); -- rc = (initctx == NULL) ? SECFailure : SECSuccess; -+ &initParams, NSS_INIT_READONLY|NSS_INIT_NOCERTDB ); - } - #else - initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB, -- &initParams, NSS_INIT_READONLY ); -- rc = (initctx == NULL) ? SECFailure : SECSuccess; -+ &initParams, NSS_INIT_READONLY|NSS_INIT_NOCERTDB ); - #endif -+ rc = SECFailure; -+ -+ if (initctx != NULL) { -+ certdb_slot = tlsm_init_open_certdb(ctx, realcertdir, prefix); -+ if (certdb_slot) { -+ rc = SECSuccess; -+ ctx->tc_initctx = initctx; -+ ctx->tc_certdb_slot = certdb_slot; -+ } else { -+ NSS_ShutdownContext(initctx); -+ initctx = NULL; -+ } -+ } - #else - rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY ); - #endif - -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); -- - if ( rc != SECSuccess ) { - errcode = PORT_GetError(); - if ( securitydirs[ii] != lt->lt_cacertdir) { -@@ -1658,26 +1709,29 @@ tlsm_deferred_init( void *arg ) - } - - if ( errcode ) { /* no moznss db found, or not using moznss db */ -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - #ifdef HAVE_NSS_INITCONTEXT - int flags = NSS_INIT_READONLY|NSS_INIT_NOCERTDB|NSS_INIT_NOMODDB; - #ifdef INITCONTEXT_HACK - if ( !NSS_IsInitialized() && ctx->tc_is_server ) { - rc = NSS_NoDB_Init( NULL ); - } else { -- initctx = NSS_InitContext( "", "", "", SECMOD_DB, -+ initctx = NSS_InitContext( CERTDB_NONE, PREFIX_NONE, PREFIX_NONE, SECMOD_DB, - &initParams, flags ); - rc = (initctx == NULL) ? SECFailure : SECSuccess; - } - #else -- initctx = NSS_InitContext( "", "", "", SECMOD_DB, -+ initctx = NSS_InitContext( CERTDB_NONE, PREFIX_NONE, PREFIX_NONE, SECMOD_DB, - &initParams, flags ); -- rc = (initctx == NULL) ? SECFailure : SECSuccess; -+ if (initctx) { -+ ctx->tc_initctx = initctx; -+ rc = SECSuccess; -+ } else { -+ rc = SECFailure; -+ } - #endif - #else - rc = NSS_NoDB_Init( NULL ); - #endif -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - if ( rc != SECSuccess ) { - errcode = PORT_GetError(); - Debug( LDAP_DEBUG_ANY, -@@ -1685,18 +1739,11 @@ tlsm_deferred_init( void *arg ) - errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - return -1; - } -- --#ifdef HAVE_NSS_INITCONTEXT -- ctx->tc_initctx = initctx; --#endif -- - } - - if ( errcode || lt->lt_cacertfile ) { - /* initialize the PEM module */ -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - if ( tlsm_init_pem_module() ) { -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - int pem_errcode = PORT_GetError(); - Debug( LDAP_DEBUG_ANY, - "TLS: could not initialize moznss PEM module - error %d:%s.\n", -@@ -1708,7 +1755,6 @@ tlsm_deferred_init( void *arg ) - } else if ( !errcode ) { - tlsm_init_ca_certs( ctx, lt->lt_cacertfile, NULL ); - } -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - } - - if ( errcode ) { -@@ -1734,12 +1780,6 @@ tlsm_deferred_init( void *arg ) - ctx->tc_using_pem = PR_TRUE; - } - --#ifdef HAVE_NSS_INITCONTEXT -- if ( !ctx->tc_initctx ) { -- ctx->tc_initctx = initctx; -- } --#endif -- - NSS_SetDomesticPolicy(); - - PK11_SetPasswordFunc( tlsm_pin_prompt ); -@@ -1754,10 +1794,8 @@ tlsm_deferred_init( void *arg ) - } - - if ( ctx->tc_is_server ) { -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - /* 0 means use the defaults here */ - SSL_ConfigServerSessionIDCache( 0, 0, 0, NULL ); -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - } - - #ifndef HAVE_NSS_INITCONTEXT -@@ -1767,137 +1805,34 @@ tlsm_deferred_init( void *arg ) - return 0; - } - --static int --tlsm_authenticate( tlsm_ctx *ctx, const char *certname, const char *pininfo ) --{ -- const char *colon = NULL; -- char *token_name = NULL; -- PK11SlotInfo *slot = NULL; -- int rc = -1; -- -- if ( !certname || !*certname ) { -- return 0; -- } -- -- if ( ( colon = PL_strchr( certname, ':' ) ) ) { -- token_name = PL_strndup( certname, colon-certname ); -- } -- -- if ( token_name ) { -- slot = PK11_FindSlotByName( token_name ); -- } else { -- slot = PK11_GetInternalKeySlot(); -- } -- -- if ( !slot ) { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not find the slot for security token %s - error %d:%s.\n", -- token_name ? token_name : DEFAULT_TOKEN_NAME, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- goto done; -- } -- -- rc = tlsm_authenticate_to_slot( ctx, slot ); -- --done: -- PL_strfree( token_name ); -- if ( slot ) { -- PK11_FreeSlot( slot ); -- } -- -- return rc; --} -- - /* - * Find and verify the certificate. -- * Either fd is given, in which case the cert will be taken from it via SSL_PeerCertificate -- * or certname is given, and it will be searched for by name -+ * The key is loaded and stored in ctx->tc_private_key - */ - static int --tlsm_find_and_verify_cert_key(tlsm_ctx *ctx, PRFileDesc *fd, const char *certname, int isServer, CERTCertificate **pRetCert, SECKEYPrivateKey **pRetKey) -+tlsm_find_and_verify_cert_key(tlsm_ctx *ctx) - { -- CERTCertificate *cert = NULL; -- int rc = -1; -- void *pin_arg = NULL; -- SECKEYPrivateKey *key = NULL; -+ SECCertificateUsage certUsage; -+ PRBool checkSig; -+ SECStatus status; -+ int errorToIgnore; -+ void *pin_arg; - -- pin_arg = SSL_RevealPinArg( fd ); -- if ( certname ) { -- cert = PK11_FindCertFromNickname( certname, pin_arg ); -- if ( !cert ) { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: the certificate %s could not be found in the database - error %d:%s\n", -- certname, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- return -1; -- } -- } else { -- /* we are verifying the peer cert -- we also need to swap the isServer meaning */ -- cert = SSL_PeerCertificate( fd ); -- if ( !cert ) { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: could not get the certificate from the peer connection - error %d:%s\n", -- errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), NULL ); -- return -1; -- } -- isServer = !isServer; /* verify the peer's cert instead */ -- } -- -- if ( ctx->tc_slotname ) { -- PK11SlotInfo *slot = PK11_FindSlotByName( ctx->tc_slotname ); -- key = PK11_FindPrivateKeyFromCert( slot, cert, NULL ); -- PK11_FreeSlot( slot ); -- } else { -- key = PK11_FindKeyByAnyCert( cert, pin_arg ); -- } -- -- if (key) { -- SECCertificateUsage certUsage; -- PRBool checkSig = PR_TRUE; -- SECStatus status; -- /* may not have a CA cert - ok - ignore SEC_ERROR_UNKNOWN_ISSUER */ -- int errorToIgnore = SEC_ERROR_UNKNOWN_ISSUER; -+ if (tlsm_ctx_load_private_key(ctx)) -+ return -1; - -- if ( pRetKey ) { -- *pRetKey = key; /* caller will deal with this */ -- } else { -- SECKEY_DestroyPrivateKey( key ); -- } -- if ( isServer ) { -- certUsage = certificateUsageSSLServer; -- } else { -- certUsage = certificateUsageSSLClient; -- } -- if ( ctx->tc_verify_cert ) { -- checkSig = PR_TRUE; -- } else { -- checkSig = PR_FALSE; -- } -- if ( ctx->tc_warn_only ) { -- errorToIgnore = -1; -- } -- status = tlsm_verify_cert( ctx->tc_certdb, cert, pin_arg, -- checkSig, certUsage, errorToIgnore ); -- if ( status == SECSuccess ) { -- rc = 0; -- } -- } else { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: could not find the private key for certificate %s - error %d:%s\n", -- certname, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- } -+ pin_arg = SSL_RevealPinArg(ctx->tc_model); -+ certUsage = ctx->tc_is_server ? certificateUsageSSLServer : certificateUsageSSLClient; -+ checkSig = ctx->tc_verify_cert ? PR_TRUE : PR_FALSE; -+ if ( ctx->tc_warn_only ) -+ errorToIgnore = -1; -+ else -+ errorToIgnore = SEC_ERROR_UNKNOWN_ISSUER; /* may not have a CA cert */ - -- if ( pRetCert ) { -- *pRetCert = cert; /* caller will deal with this */ -- } else { -- CERT_DestroyCertificate( cert ); -- } -+ status = tlsm_verify_cert( ctx->tc_certdb, ctx->tc_certificate, pin_arg, -+ checkSig, certUsage, errorToIgnore ); - -- return rc; -+ return status == SECSuccess ? 0 : -1; - } - - static int -@@ -1906,39 +1841,18 @@ tlsm_get_client_auth_data( void *arg, PRFileDesc *fd, - SECKEYPrivateKey **pRetKey ) - { - tlsm_ctx *ctx = (tlsm_ctx *)arg; -- int rc; -- PRBool saveval; - -- /* don't need caNames - this function will call CERT_VerifyCertificateNow -- which will verify the cert against the known CAs */ -- saveval = ctx->tc_warn_only; -- ctx->tc_warn_only = PR_TRUE; -- rc = tlsm_find_and_verify_cert_key( ctx, fd, ctx->tc_certname, 0, pRetCert, pRetKey ); -- ctx->tc_warn_only = saveval; -- if ( rc ) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to perform client certificate authentication for " -- "certificate named %s\n", ctx->tc_certname, 0, 0 ); -- if ( pRetKey && *pRetKey ) { -- SECKEY_DestroyPrivateKey( *pRetKey ); -- *pRetKey = NULL; -- } -- if ( pRetCert && *pRetCert ) { -- CERT_DestroyCertificate( *pRetCert ); -- *pRetCert = NULL; -- } -- return SECFailure; -- } -+ if (pRetCert) -+ *pRetCert = CERT_DupCertificate(ctx->tc_certificate); -+ -+ if (pRetKey) -+ *pRetKey = SECKEY_CopyPrivateKey(ctx->tc_private_key); - - return SECSuccess; - } - - /* - * ctx must have a tc_model that is valid -- * certname is in the form [:] -- * where is the name of the PKCS11 token -- * and is the nickname of the cert/key in -- * the database - */ - static int - tlsm_clientauth_init( tlsm_ctx *ctx ) -@@ -1949,12 +1863,12 @@ tlsm_clientauth_init( tlsm_ctx *ctx ) - - saveval = ctx->tc_warn_only; - ctx->tc_warn_only = PR_TRUE; -- rc = tlsm_find_and_verify_cert_key( ctx, ctx->tc_model, ctx->tc_certname, 0, NULL, NULL ); -+ rc = tlsm_find_and_verify_cert_key(ctx); - ctx->tc_warn_only = saveval; - if ( rc ) { - Debug( LDAP_DEBUG_ANY, - "TLS: error: unable to set up client certificate authentication for " -- "certificate named %s\n", ctx->tc_certname, 0, 0 ); -+ "certificate named %s\n", tlsm_ctx_subject_name(ctx), 0, 0 ); - return -1; - } - -@@ -1972,6 +1886,7 @@ static void - tlsm_destroy( void ) - { - #ifdef LDAP_R_COMPILE -+ ldap_pvt_thread_mutex_destroy( &tlsm_ctx_count_mutex ); - ldap_pvt_thread_mutex_destroy( &tlsm_init_mutex ); - ldap_pvt_thread_mutex_destroy( &tlsm_pem_mutex ); - #endif -@@ -2048,16 +1963,20 @@ tlsm_ctx_new ( struct ldapoptions *lo ) - #ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_init( &ctx->tc_refmutex ); - #endif -+ LDAP_MUTEX_LOCK( &tlsm_ctx_count_mutex ); -+ ctx->tc_unique = tlsm_ctx_count++; -+ LDAP_MUTEX_UNLOCK( &tlsm_ctx_count_mutex ); - ctx->tc_config = NULL; /* populated later by tlsm_ctx_init */ - ctx->tc_certdb = NULL; -- ctx->tc_certname = NULL; -+ ctx->tc_certdb_slot = NULL; -+ ctx->tc_certificate = NULL; -+ ctx->tc_private_key = NULL; - ctx->tc_pin_file = NULL; - ctx->tc_model = NULL; - memset(&ctx->tc_callonce, 0, sizeof(ctx->tc_callonce)); - ctx->tc_require_cert = lo->ldo_tls_require_cert; - ctx->tc_verify_cert = PR_FALSE; - ctx->tc_using_pem = PR_FALSE; -- ctx->tc_slotname = NULL; - #ifdef HAVE_NSS_INITCONTEXT - ctx->tc_initctx = NULL; - #endif /* HAVE_NSS_INITCONTEXT */ -@@ -2090,28 +2009,38 @@ tlsm_ctx_free ( tls_ctx *ctx ) - LDAP_MUTEX_UNLOCK( &c->tc_refmutex ); - if ( refcount ) - return; -+ -+ LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - if ( c->tc_model ) - PR_Close( c->tc_model ); -+ if (c->tc_certificate) -+ CERT_DestroyCertificate(c->tc_certificate); -+ if (c->tc_private_key) -+ SECKEY_DestroyPrivateKey(c->tc_private_key); - c->tc_certdb = NULL; /* if not the default, may have to clean up */ -- PL_strfree( c->tc_certname ); -- c->tc_certname = NULL; -+ if ( c->tc_certdb_slot ) { -+ if ( SECMOD_CloseUserDB( c->tc_certdb_slot ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not close certdb slot - error %d:%s.\n", -+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); -+ } -+ } - PL_strfree( c->tc_pin_file ); - c->tc_pin_file = NULL; -- PL_strfree( c->tc_slotname ); - tlsm_free_pem_objs( c ); - #ifdef HAVE_NSS_INITCONTEXT - if ( c->tc_initctx ) { -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - if ( NSS_ShutdownContext( c->tc_initctx ) ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, - "TLS: could not shutdown NSS - error %d:%s.\n", - errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - } -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - } - c->tc_initctx = NULL; - #endif /* HAVE_NSS_INITCONTEXT */ -+ LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - #ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_destroy( &c->tc_refmutex ); - #endif -@@ -2173,6 +2102,12 @@ tlsm_deferred_ctx_init( void *arg ) - return -1; - } - -+ if ( SSL_SetPKCS11PinArg(ctx->tc_model, ctx) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not set pin prompt argument\n", 0, 0, 0); -+ return -1; -+ } -+ - if ( SECSuccess != SSL_OptionSet( ctx->tc_model, SSL_SECURITY, PR_TRUE ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not set secure mode on.\n", -@@ -2287,14 +2222,30 @@ tlsm_deferred_ctx_init( void *arg ) - /* if using the PEM module, load the PEM file specified by lt_certfile */ - /* otherwise, assume this is the name of a cert already in the db */ - if ( ctx->tc_using_pem ) { -- /* this sets ctx->tc_certname to the correct value */ -- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE, PR_TRUE ); -+ /* this sets ctx->tc_certificate to the correct value */ -+ int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ); - if ( rc ) { - return rc; - } - } else { -- PL_strfree( ctx->tc_certname ); -- ctx->tc_certname = PL_strdup( lt->lt_certfile ); -+ char *tmp_certname; -+ -+ if (ctx->tc_certdb_slot) { -+ tmp_certname = PR_smprintf(TLSM_CERTDB_DESC_FMT ":%s", ctx->tc_unique, lt->lt_certfile); -+ } else { -+ tmp_certname = PR_smprintf("%s", lt->lt_certfile); -+ } -+ -+ ctx->tc_certificate = PK11_FindCertFromNickname(tmp_certname, SSL_RevealPinArg(ctx->tc_model)); -+ PR_smprintf_free(tmp_certname); -+ -+ if (!ctx->tc_certificate) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n", -+ lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ return -1; -+ } - } - } - -@@ -2302,7 +2253,6 @@ tlsm_deferred_ctx_init( void *arg ) - /* if using the PEM module, load the PEM file specified by lt_keyfile */ - /* otherwise, assume this is the pininfo for the key */ - if ( ctx->tc_using_pem ) { -- /* this sets ctx->tc_certname to the correct value */ - int rc = tlsm_add_key_from_file( ctx, lt->lt_keyfile ); - if ( rc ) { - return rc; -@@ -2334,66 +2284,42 @@ tlsm_deferred_ctx_init( void *arg ) - /* - since a cert has been specified, assume the client wants to do cert auth - */ -- if ( ctx->tc_certname ) { -- if ( tlsm_authenticate( ctx, ctx->tc_certname, ctx->tc_pin_file ) ) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to authenticate to the security device for certificate %s\n", -- ctx->tc_certname, 0, 0 ); -- return -1; -- } -+ if ( ctx->tc_certificate ) { - if ( tlsm_clientauth_init( ctx ) ) { - Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to set up client certificate authentication using %s\n", -- ctx->tc_certname, 0, 0 ); -+ "TLS: error: unable to set up client certificate authentication using '%s'\n", -+ tlsm_ctx_subject_name(ctx), 0, 0 ); - return -1; - } - } - } else { /* set up secure server */ - SSLKEAType certKEA; -- CERTCertificate *serverCert = NULL; -- SECKEYPrivateKey *serverKey = NULL; - SECStatus status; - - /* must have a certificate for the server to use */ -- if ( !ctx->tc_certname ) { -+ if ( !ctx->tc_certificate ) { - Debug( LDAP_DEBUG_ANY, - "TLS: error: no server certificate: must specify a certificate for the server to use\n", - 0, 0, 0 ); - return -1; - } - -- /* authenticate to the server's token - this will do nothing -- if the key/cert db is not password protected */ -- if ( tlsm_authenticate( ctx, ctx->tc_certname, ctx->tc_pin_file ) ) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to authenticate to the security device for certificate %s\n", -- ctx->tc_certname, 0, 0 ); -- return -1; -- } -- -- /* get the server's key and cert */ -- if ( tlsm_find_and_verify_cert_key( ctx, ctx->tc_model, ctx->tc_certname, ctx->tc_is_server, -- &serverCert, &serverKey ) ) { -+ if (tlsm_find_and_verify_cert_key(ctx)) { - Debug( LDAP_DEBUG_ANY, - "TLS: error: unable to find and verify server's cert and key for certificate %s\n", -- ctx->tc_certname, 0, 0 ); -- CERT_DestroyCertificate( serverCert ); -- SECKEY_DestroyPrivateKey( serverKey ); -+ tlsm_ctx_subject_name(ctx), 0, 0 ); - return -1; - } - -- certKEA = NSS_FindCertKEAType( serverCert ); - /* configure the socket to be a secure server socket */ -- status = SSL_ConfigSecureServer( ctx->tc_model, serverCert, serverKey, certKEA ); -- /* SSL_ConfigSecureServer copies these */ -- CERT_DestroyCertificate( serverCert ); -- SECKEY_DestroyPrivateKey( serverKey ); -+ certKEA = NSS_FindCertKEAType( ctx->tc_certificate ); -+ status = SSL_ConfigSecureServer( ctx->tc_model, ctx->tc_certificate, ctx->tc_private_key, certKEA ); - - if ( SECSuccess != status ) { - PRErrorCode err = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to configure secure server using certificate %s - error %d:%s\n", -- ctx->tc_certname, err, PR_ErrorToString( err, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: error: unable to configure secure server using certificate '%s' - error %d:%s\n", -+ tlsm_ctx_subject_name(ctx), err, PR_ErrorToString( err, PR_LANGUAGE_I_DEFAULT ) ); - return -1; - } - } -@@ -2515,7 +2441,9 @@ tlsm_session_new ( tls_ctx * ctx, int is_server ) - int rc; - - c->tc_is_server = is_server; -+ LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - status = PR_CallOnceWithArg( &c->tc_callonce, tlsm_deferred_ctx_init, c ); -+ LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - if ( PR_SUCCESS != status ) { - PRErrorCode err = PR_GetError(); - Debug( LDAP_DEBUG_ANY, diff --git a/openldap-nss-pk11-freeslot.patch b/openldap-nss-pk11-freeslot.patch deleted file mode 100644 index ca657c8..0000000 --- a/openldap-nss-pk11-freeslot.patch +++ /dev/null @@ -1,23 +0,0 @@ -Resolves: #929357 - -Upstream commit: 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec -Author: Rich Megginson -Date: Thu, 28 Mar 2013 19:05:02 -0600 -Modified by: Jan Synacek - -This patch has been re-diffed so it clearly applies to OpenLDAP 2.4.39. - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 072d41d..c59d303 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2151,6 +2151,8 @@ - "TLS: could not close certdb slot - error %d:%s.\n", - errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - } -+ PK11_FreeSlot( c->tc_certdb_slot ); -+ c->tc_certdb_slot = NULL; - } - if ( c->tc_pin_file ) { - PL_strfree( c->tc_pin_file ); - diff --git a/openldap-nss-protocol-version-new-api.patch b/openldap-nss-protocol-version-new-api.patch deleted file mode 100644 index 8a5efa7..0000000 --- a/openldap-nss-protocol-version-new-api.patch +++ /dev/null @@ -1,71 +0,0 @@ -Implement new API for setting TLS protocol version. - -The code being deleted has been misplaced and it's effect has been -mangled by a code later on. This patch puts the code at the correct -place and introduces some more logging and error checking. - -Author: Matus Honek -RHBZ: #1375432 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2421,6 +2411,58 @@ tlsm_deferred_ctx_init( void *arg ) - 0, 0, 0 ); - return -1; - } -+ if ( lt->lt_protocol_min >= LDAP_OPT_X_TLS_PROTOCOL_SSL3 ) { -+ SSLVersionRange supported_range, default_range, selected_range; -+ if ( SECSuccess != SSL_VersionRangeGetSupported(ssl_variant_stream, &supported_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not get SSL supported version range (SSL_VersionRangeGetSupported).\n", -+ 0, 0, 0 ); -+ return -1; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: SSL supported protocol version range is (%#04x, %#04x) (SSL_VersionRangeGetSupported).\n", -+ supported_range.min, supported_range.max, 0); -+ } -+ if ( SECSuccess != SSL_VersionRangeGetDefault(ssl_variant_stream, &default_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not get SSL default protocol version range (SSL_VersionRangeGetDefault).\n", -+ 0, 0, 0 ); -+ return -1; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: SSL default protocol version range is (%#04x, %#04x) (SSL_VersionRangeGetDefault).\n", -+ default_range.min, default_range.max, 0); -+ } -+ selected_range.min = lt->lt_protocol_min; -+ selected_range.max = default_range.max; -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: TLS configured protocol minimal version is %#04x, the maximal version (the NSS default) is %#04x.\n", -+ selected_range.min, selected_range.max, 0); -+ if ( (selected_range.min > supported_range.max) || -+ (selected_range.max < supported_range.min) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: selected protocol version range out of NSS-supported version range.\n", -+ 0, 0, 0); -+ return -1; -+ } else { -+ if ( SECSuccess != SSL_VersionRangeSet(ctx->tc_model, &selected_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not set protocol version range (SSL_VersionRangeSet).\n", -+ 0, 0, 0); -+ return -1; -+ } -+ if ( SECSuccess != SSL_VersionRangeGet(ctx->tc_model, &selected_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not get protocol version range (SSL_VersionRangeGet).\n", -+ 0, 0, 0); -+ return -1; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: SSL set protocol version range is (%#04x, %#04x) (SSL_VersionRangeGet).\n", -+ selected_range.min, selected_range.max, 0); -+ } -+ } -+ } - - if ( SECSuccess != SSL_OptionSet( ctx->tc_model, SSL_HANDSHAKE_AS_CLIENT, !ctx->tc_is_server ) ) { - Debug( LDAP_DEBUG_ANY, diff --git a/openldap-nss-regex-search-hashed-cacert-dir.patch b/openldap-nss-regex-search-hashed-cacert-dir.patch deleted file mode 100644 index 03493db..0000000 --- a/openldap-nss-regex-search-hashed-cacert-dir.patch +++ /dev/null @@ -1,91 +0,0 @@ -MozNSS: better file name matching for hashed CA certificate directory - -CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name -should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used -to differentiate between two certificates with the same subject name. - -Wit this patch, certificate file names are matched correctly (using regular expressions). - -Author: Jan Vcelak -Upstream ITS: #7374 -Resolves: #852786 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 5e49fc5..61d71d4 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -38,6 +38,7 @@ - #include - #include - #include -+#include - - #include "ldap-int.h" - #include "ldap-tls.h" -@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods; - - #define PEM_LIBRARY "nsspem" - #define PEM_MODULE "PEM" --/* hash files for use with cacertdir have this file name suffix */ --#define PEM_CA_HASH_FILE_SUFFIX ".0" --#define PEM_CA_HASH_FILE_SUFFIX_LEN 2 -+#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$" - - static SECMODModule *pem_module; - -@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - PRDir *dir; - PRDirEntry *entry; - PRStatus fistatus = PR_FAILURE; -+ regex_t hashfile_re; - - memset( &fi, 0, sizeof(fi) ); - fistatus = PR_GetFileInfo( cacertdir, &fi ); -@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - goto done; - } - -+ if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) { -+ Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 ); -+ goto done; -+ } -+ - do { - entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN ); - if ( ( NULL != entry ) && ( NULL != entry->name ) ) { - char *fullpath = NULL; -- char *ptr; -+ int match; - -- ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX ); -- if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) { -+ match = regexec( &hashfile_re, entry->name, 0, NULL, 0 ); -+ if ( match == REG_NOMATCH ) { - Debug( LDAP_DEBUG_TRACE, -- "TLS: file %s does not end in [%s] - does not appear to be a CA certificate " -- "directory file with a properly hashed file name - skipping.\n", -- entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 ); -+ "TLS: skipping '%s' - filename does not have expected format " -+ "(certificate hash with numeric suffix)\n", entry->name, 0, 0 ); -+ continue; -+ } else if ( match != 0 ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: cannot execute regex for CA hash file matching (%d).\n", -+ match, 0, 0 ); - continue; - } -+ - fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name ); - if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) { - Debug( LDAP_DEBUG_TRACE, -@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - PR_smprintf_free( fullpath ); - } - } while ( NULL != entry ); -+ regfree ( &hashfile_re ); - PR_CloseDir( dir ); - } - done: --- -1.7.11.4 - diff --git a/openldap-openssl-manpage-defaultCA.patch b/openldap-openssl-manpage-defaultCA.patch new file mode 100644 index 0000000..e0c7cb7 --- /dev/null +++ b/openldap-openssl-manpage-defaultCA.patch @@ -0,0 +1,51 @@ +Reference default system-wide CA certificates in manpages + +OpenSSL, unless explicitly configured, uses system-wide default set of CA +certificates. + +Author: Matus Honek + +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index 6084298..3070bb4 100644 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -327,6 +327,9 @@ are more options you can specify. These options are used when an + .B ldaps:// URI + is selected (by default or otherwise) or when the application + negotiates TLS by issuing the LDAP StartTLS operation. ++.LP ++When using OpenSSL, if neither \fBTLS_CACERT\fP nor \fBTLS_CACERTDIR\fP ++is set, the system-wide default set of CA certificates is used. + .TP + .B TLS_CACERT + Specifies the file that contains certificates for all of the Certificate +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index a559b0c..adda87a 100644 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -878,6 +878,10 @@ If + .B slapd + is built with support for Transport Layer Security, there are more options + you can specify. ++.LP ++When using OpenSSL, if neither \fBolcTLSCACertificateFile\fP nor ++\fBolcTLSCACertificatePath\fP is set, the system-wide default set of CA ++certificates is used. + .TP + .B olcTLSCipherSuite: + Permits configuring what ciphers will be accepted and the preference order. +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index b6e9250..1653a1b 100644 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -1108,6 +1108,10 @@ If + .B slapd + is built with support for Transport Layer Security, there are more options + you can specify. ++.LP ++When using OpenSSL, if neither \fBTLSCACertificateFile\fP nor ++\fBTLSCACertificatePath\fP is set, the system-wide default set of CA ++certificates is used. + .TP + .B TLSCipherSuite + Permits configuring what ciphers will be accepted and the preference order. diff --git a/openldap-reentrant-gethostby.patch b/openldap-reentrant-gethostby.patch index 140b6e3..dcb3b73 100644 --- a/openldap-reentrant-gethostby.patch +++ b/openldap-reentrant-gethostby.patch @@ -8,7 +8,7 @@ Resolves: #179730 Author: Jeffery Layton diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c -index 373c81c..a012062 100644 +index aa69f70..4461bf2 100644 --- a/libraries/libldap/util-int.c +++ b/libraries/libldap/util-int.c @@ -52,8 +52,8 @@ extern int h_errno; @@ -22,7 +22,7 @@ index 373c81c..a012062 100644 #else # include -@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) +@@ -442,7 +442,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) #define BUFSTART (1024-32) #define BUFMAX (32*1024-32) diff --git a/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch new file mode 100644 index 0000000..dda0f52 --- /dev/null +++ b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch @@ -0,0 +1,23 @@ +From c7a4bd27f5dcf93806972aab236001f1d4801e80 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Wed, 31 Jan 2024 16:00:30 +0000 +Subject: [PATCH] ITS#10166 slapi: fix plugin.c plugin_pblock_new() usage + +Broken in 9142da8eaf691720f7d6288954250ef085bd3da0 +--- + servers/slapd/slapi/plugin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/servers/slapd/slapi/plugin.c b/servers/slapd/slapi/plugin.c +index ca5dbead59..bfa5c10344 100644 +--- a/servers/slapd/slapi/plugin.c ++++ b/servers/slapd/slapi/plugin.c +@@ -694,7 +694,7 @@ slapi_int_read_config( + int rc; + Slapi_PBlock *pPlugin; + +- pPlugin = plugin_pblock_new( iType, numPluginArgc, c->argv ); ++ pPlugin = plugin_pblock_new( iType, numPluginArgc, c ); + if (pPlugin == NULL) { + return 1; + } diff --git a/openldap-smbk5pwd-overlay.patch b/openldap-smbk5pwd-overlay.patch index 38936cf..e5aaa57 100644 --- a/openldap-smbk5pwd-overlay.patch +++ b/openldap-smbk5pwd-overlay.patch @@ -9,7 +9,7 @@ Author: Jan Vcelak Resolves: #841560 diff --git a/contrib/slapd-modules/smbk5pwd/README b/contrib/slapd-modules/smbk5pwd/README -index f20ad94..b6433ff 100644 +index 4a710a7..0cd4e9e 100644 --- a/contrib/slapd-modules/smbk5pwd/README +++ b/contrib/slapd-modules/smbk5pwd/README @@ -1,3 +1,8 @@ @@ -22,10 +22,10 @@ index f20ad94..b6433ff 100644 PasswordModify Extended Operation to update Kerberos keys and Samba password hashes for an LDAP user. diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in -index 3af20e8..ef73663 100644 +index b84bc54..b5c3fc8 100644 --- a/servers/slapd/overlays/Makefile.in +++ b/servers/slapd/overlays/Makefile.in -@@ -33,7 +33,8 @@ SRCS = overlays.c \ +@@ -37,7 +37,8 @@ SRCS = overlays.c \ syncprov.c \ translucent.c \ unique.c \ @@ -35,7 +35,7 @@ index 3af20e8..ef73663 100644 OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ overlays.o -@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) +@@ -57,7 +58,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a @@ -44,7 +44,7 @@ index 3af20e8..ef73663 100644 XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) -@@ -125,6 +126,12 @@ unique.la : unique.lo +@@ -141,6 +142,12 @@ unique.la : unique.lo valsort.la : valsort.lo $(LTLINK_MOD) -module -o $@ valsort.lo version.lo $(LINK_LIBS) @@ -57,6 +57,3 @@ index 3af20e8..ef73663 100644 install-local: $(PROGRAMS) @if test -n "$?" ; then \ $(MKDIR) $(DESTDIR)$(moduledir); \ --- -1.7.10.4 - diff --git a/openldap-sql-linking.patch b/openldap-sql-linking.patch deleted file mode 100644 index c7edf8c..0000000 --- a/openldap-sql-linking.patch +++ /dev/null @@ -1,14 +0,0 @@ -Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package -independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.) - ---- openldap-2.4.24.orig/build/top.mk -+++ openldap-2.4.24/build/top.mk -@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@ - SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@ - SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@ - --SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS) -+SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS) - - # Our Defaults - CC = $(AC_CC) diff --git a/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch b/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch index ed4f2ad..0605304 100644 --- a/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch +++ b/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch @@ -6,10 +6,12 @@ Proof of concept for fixing http://bugs.debian.org/327585 (patch ported from freeradius bug http://bugs.debian.org/416266) Resolves: #960048 ---- ---- openldap/servers/slapd/module.c.orig 2010-05-18 17:42:04.000000000 +0200 -+++ openldap/servers/slapd/module.c 2010-05-18 17:45:46.000000000 +0200 -@@ -117,6 +117,20 @@ + +diff --git a/servers/slapd/module.c b/servers/slapd/module.c +index e616f1d..52bacff 100644 +--- a/servers/slapd/module.c ++++ b/servers/slapd/module.c +@@ -117,6 +117,20 @@ int module_unload( const char *file_name ) return -1; /* not found */ } @@ -30,7 +32,7 @@ Resolves: #960048 int module_load(const char* file_name, int argc, char *argv[]) { module_loaded_t *module; -@@ -180,7 +194,7 @@ +@@ -179,7 +193,7 @@ int module_load(const char* file_name, int argc, char *argv[]) * to calling Debug. This is because Debug is a macro that expands * into multiple function calls. */ diff --git a/openldap-tls-no-reuse-of-tls_session.patch b/openldap-tls-no-reuse-of-tls_session.patch deleted file mode 100644 index 5c397d1..0000000 --- a/openldap-tls-no-reuse-of-tls_session.patch +++ /dev/null @@ -1,92 +0,0 @@ -TLS: do not reuse tls_session if hostname check fails - -If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails, -*tls_session is not dropped, but reused when connecting to the second server. - -This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor. -From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling. - -Author: Jan Vcelak -Upstream ITS: #7373 -Resolves: #852476 - -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index 10b993b..a3cd590 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc ) - */ - - static int --ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) -+ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) - { - Sockbuf *sb = conn->lconn_sb; - int err; -@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) - errno = WSAGetLastError(); - #endif - -+ if ( err == 0 ) { -+ err = ldap_pvt_tls_check_hostname( ld, ssl, host ); -+ } -+ - if ( err < 0 ) - { - char buf[256], *msg; -@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) - { - tls_session *session = s; - -- return tls_imp->ti_session_chkhost( ld, session, name_in ); -+ if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER && -+ ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) { -+ ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in ); -+ if (ld->ld_errno != LDAP_SUCCESS) { -+ return ld->ld_errno; -+ } -+ } -+ -+ return LDAP_SUCCESS; - } - - int -@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - #endif /* LDAP_USE_NON_BLOCKING_TLS */ - - ld->ld_errno = LDAP_SUCCESS; -- ret = ldap_int_tls_connect( ld, conn ); -+ ret = ldap_int_tls_connect( ld, conn, host ); - - #ifdef LDAP_USE_NON_BLOCKING_TLS - while ( ret > 0 ) { /* this should only happen for non-blocking io */ -@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - } else { - /* ldap_int_poll called ldap_pvt_ndelay_off */ - ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb ); -- ret = ldap_int_tls_connect( ld, conn ); -+ ret = ldap_int_tls_connect( ld, conn, host ); - if ( ret > 0 ) { /* need to call tls_connect once more */ - struct timeval curr_time_tv, delta_tv; - -@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - return (ld->ld_errno); - } - -- ssl = ldap_pvt_tls_sb_ctx( sb ); -- assert( ssl != NULL ); -- -- /* -- * compare host with name(s) in certificate -- */ -- if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER && -- ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) { -- ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host ); -- if (ld->ld_errno != LDAP_SUCCESS) { -- return ld->ld_errno; -- } -- } -- - return LDAP_SUCCESS; - } - diff --git a/openldap.spec b/openldap.spec index 2635fbd..b8d3d66 100644 --- a/openldap.spec +++ b/openldap.spec @@ -3,64 +3,83 @@ %global systemctl_bin /usr/bin/systemctl %global check_password_version 1.1 +%global so_ver 2 +%global so_ver_compat 2 + +# Build openldap-servers package and its libslapi in openldap-devel and openldap-compat +%bcond servers 1 + +# Build with argon2 support +%bcond argon2 %{undefined rhel} + +# When you change "Version: " to the new major version, remember to change this value too +%global major_version 2.6 + +# Disable automatic .la file removal +%global __brp_remove_la_files %nil + Name: openldap -Version: 2.4.45 -Release: 1%{?dist} +Version: 2.6.10 +Release: 6%{?dist} Summary: LDAP support libraries -Group: System Environment/Daemons -License: OpenLDAP +License: OLDAP-2.8 URL: http://www.openldap.org/ -Source0: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version}.tgz +Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-%{version}.tgz Source1: slapd.service Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf -Source10: ltb-project-openldap-ppolicy-check-password-%{check_password_version}.tar.gz +Source6: openldap.sysusers +Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions Source52: libexec-check-config.sh -Source53: libexec-upgrade-db.sh -# patches for 2.4 +# Patches for 2.6 Patch0: openldap-manpages.patch -Patch1: openldap-sql-linking.patch -Patch2: openldap-reentrant-gethostby.patch +Patch1: openldap-reentrant-gethostby.patch + Patch3: openldap-smbk5pwd-overlay.patch -Patch5: openldap-ai-addrconfig.patch -# nss patches, unlikely to ever get upstreamed -Patch12: openldap-tls-no-reuse-of-tls_session.patch -Patch13: openldap-nss-regex-search-hashed-cacert-dir.patch -Patch14: openldap-nss-ignore-certdb-type-prefix.patch -Patch15: openldap-nss-certs-from-certdb-fallback-pem.patch -Patch16: openldap-nss-pk11-freeslot.patch -Patch17: openldap-allop-overlay.patch +Patch4: openldap-ai-addrconfig.patch +Patch5: openldap-allop-overlay.patch # fix back_perl problems with lt_dlopen() # might cause crashes because of symbol collisions # the proper fix is to link all perl modules against libperl # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327585 -Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch -# ldapi sasl fix pending upstream inclusion -Patch20: openldap-ldapi-sasl.patch -Patch22: openldap-nss-protocol-version-new-api.patch +Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch -Patch50: openldap-nss-cipher-attributes.patch -Patch51: openldap-nss-ciphers-parsing.patch -Patch52: openldap-nss-ciphers-use-nss-defaults.patch -Patch53: openldap-nss-ciphers-definitions.patch +# System-wide default for CA certs +Patch7: openldap-openssl-manpage-defaultCA.patch +Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch +Patch10: openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch # check-password module specific patches Patch90: check-password-makefile.patch Patch91: check-password.patch -# Fedora specific patches -Patch100: openldap-autoconf-pkgconfig-nss.patch - -BuildRequires: cyrus-sasl-devel, nss-devel, krb5-devel, tcp_wrappers-devel, unixODBC-devel -BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl, perl-devel, perl-generators, perl(ExtUtils::Embed) -# smbk5pwd overlay: +BuildRequires: cyrus-sasl-devel +BuildRequires: gcc +BuildRequires: glibc-devel +BuildRequires: groff +BuildRequires: krb5-devel +BuildRequires: libtool-ltdl-devel +BuildRequires: libevent-devel +BuildRequires: libxcrypt-devel +BuildRequires: make BuildRequires: openssl-devel -Requires: nss-tools +BuildRequires: perl(ExtUtils::Embed) +BuildRequires: perl-devel +BuildRequires: perl-generators +BuildRequires: perl-interpreter +BuildRequires: unixODBC-devel +BuildRequires: cracklib-devel +BuildRequires: systemd +BuildRequires: systemd-rpm-macros +%if %{with argon2} +BuildRequires: libsodium-devel +%endif %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -73,8 +92,8 @@ libraries, and documentation for OpenLDAP. %package devel Summary: LDAP development libraries and header files -Group: Development/Libraries -Requires: openldap%{?_isa} = %{version}-%{release}, cyrus-sasl-devel%{?_isa} +Requires: openldap%{?_isa} = %{version}-%{release} +Requires: cyrus-sasl-devel%{?_isa} %description devel The openldap-devel package includes the development libraries and @@ -84,18 +103,41 @@ protocols for enabling directory services over the Internet. Install this package only if you plan to develop or will need to compile customized LDAP clients. +%package compat +Summary: Package providing legacy non-threaded libldap +Requires: openldap%{?_isa} = %{version}-%{release} +# since libldap is manually linked from libldap_r, the provides is not generated automatically +%ifarch armv7hl i686 +Provides: libldap-2.4.so.%{so_ver_compat} +Provides: libldap_r-2.4.so.%{so_ver_compat} +Provides: liblber-2.4.so.%{so_ver_compat} +%if %{with servers} +Provides: libslapi-2.4.so.%{so_ver_compat} +%endif +%else +Provides: libldap-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: libldap_r-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: liblber-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +%if %{with servers} +Provides: libslapi-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +%endif +%endif + +%description compat +The openldap-compat package contains shared libraries named as libldap-2.4.so, +%if %{with servers} +libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. +%else +libldap_r-2.4.so and liblber-2.4.so +%endif +The libraries are just links to the current version shared libraries, +and are available for compatibility reasons. + +%if %{with servers} %package servers Summary: LDAP server -License: OpenLDAP -Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils -Requires(pre): shadow-utils -Requires(post): systemd, systemd-sysv, chkconfig -Requires(preun): systemd -Requires(postun): systemd -BuildRequires: libdb-devel -BuildRequires: systemd-units -BuildRequires: cracklib-devel -Group: System Environment/Daemons +Requires: openldap%{?_isa} = %{version}-%{release} +%{?systemd_requires} # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -106,11 +148,12 @@ protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. This package contains the slapd server and related files. +# endif servers +%endif %package clients Summary: LDAP client utilities Requires: openldap%{?_isa} = %{version}-%{release} -Group: Applications/Internet %description clients OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access @@ -125,35 +168,16 @@ programs needed for accessing and modifying OpenLDAP directories. %setup -q -c -a 0 -a 10 pushd openldap-%{version} - -# use pkg-config for Mozilla NSS library -%patch100 -p1 - -# alternative include paths for Mozilla NSS -ln -s %{_includedir}/nss3 include/nss -ln -s %{_includedir}/nspr4 include/nspr - -AUTOMAKE=%{_bindir}/true autoreconf -fi - -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch5 -p1 -%patch12 -p1 -%patch13 -p1 -%patch14 -p1 -%patch15 -p1 -%patch16 -p1 -%patch17 -p1 -%patch19 -p1 -%patch20 -p1 -%patch22 -p1 - -%patch50 -p1 -%patch51 -p1 -%patch52 -p1 -%patch53 -p1 +%patch -P0 -p1 +%patch -P1 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 +%patch -P9 -p1 +%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -167,33 +191,30 @@ mv servers/slapd/back-perl/README{,.back_perl} # fix documentation encoding for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do - iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" - mv "$filename.utf8" "$filename" + iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" + mv "$filename.utf8" "$filename" done popd -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} -%patch90 -p1 -%patch91 -p1 +pushd openldap-ppolicy-check-password-%{check_password_version} +%patch -P90 -p1 +%patch -P91 -p1 popd %build -%ifarch s390 s390x - export CFLAGS="-fPIE" -%else - export CFLAGS="-fpie" -%endif -export LDFLAGS="-pie" -# avoid stray dependencies (linker flag --as-needed) +%set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} %{optflags} -Wl,--as-needed,-z,relro,-z,now -DLDAP_CONNECTIONLESS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS" +# disable legacy hash algorithm +export CFLAGS="${CFLAGS} -DOPENSSL_NO_MD2" pushd openldap-%{version} %configure \ --enable-debug \ --enable-dynamic \ + --enable-versioning \ \ --enable-dynacl \ --enable-cleartext \ @@ -201,11 +222,16 @@ pushd openldap-%{version} --enable-lmpasswd \ --enable-spasswd \ --enable-modules \ + --enable-perl \ --enable-rewrite \ --enable-rlookups \ +%if %{with servers} --enable-slapi \ +%if %{with argon2} + --enable-argon2 \ +%endif +%endif --disable-slp \ - --enable-wrappers \ \ --enable-backends=mod \ --enable-bdb=yes \ @@ -214,25 +240,27 @@ pushd openldap-%{version} --enable-monitor=yes \ --disable-ndb \ --disable-sql \ + --disable-wt \ \ --enable-overlays=mod \ \ --disable-static \ \ + --enable-balancer=mod \ + \ --with-cyrus-sasl \ --without-fetch \ --with-threads \ --with-pic \ - --with-tls=moznss \ --with-gnu-ld \ \ --libexecdir=%{_libdir} -make %{_smp_mflags} +%make_build popd -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} -make LDAP_INC="-I../openldap-%{version}/include \ +pushd openldap-ppolicy-check-password-%{check_password_version} +%make_build LDAP_INC="-I../openldap-%{version}/include \ -I../openldap-%{version}/servers/slapd \ -I../openldap-%{version}/build-servers/include" popd @@ -240,13 +268,16 @@ popd %install mkdir -p %{buildroot}%{_libdir}/ +%if %{with servers} +install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/openldap.conf +%endif pushd openldap-%{version} -make install DESTDIR=%{buildroot} STRIP="" +%make_install STRIP_OPTS="" popd # install check_password module -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +pushd openldap-ppolicy-check-password-%{check_password_version} mv check_password.so check_password.so.%{check_password_version} ln -s check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/check_password.so install -m 755 check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/ @@ -279,7 +310,7 @@ mkdir -p %{buildroot}%{_tmpfilesdir} install -m 0644 %SOURCE2 %{buildroot}%{_tmpfilesdir}/slapd.conf # install default ldap.conf (customized) -rm -f %{buildroot}%{_sysconfdir}/openldap/ldap.conf +rm %{buildroot}%{_sysconfdir}/openldap/ldap.conf install -m 0644 %SOURCE4 %{buildroot}%{_sysconfdir}/openldap/ldap.conf # setup maintainance scripts @@ -287,15 +318,13 @@ mkdir -p %{buildroot}%{_libexecdir} install -m 0755 -d %{buildroot}%{_libexecdir}/openldap install -m 0644 %SOURCE50 %{buildroot}%{_libexecdir}/openldap/functions install -m 0755 %SOURCE52 %{buildroot}%{_libexecdir}/openldap/check-config.sh -install -m 0755 %SOURCE53 %{buildroot}%{_libexecdir}/openldap/upgrade-db.sh # remove build root from config files and manual pages perl -pi -e "s|%{buildroot}||g" %{buildroot}%{_sysconfdir}/openldap/*.conf perl -pi -e "s|%{buildroot}||g" %{buildroot}%{_mandir}/*/*.* # we don't need the default files -- RPM handles changes -rm -f %{buildroot}%{_sysconfdir}/openldap/*.default -rm -f %{buildroot}%{_sysconfdir}/openldap/schema/*.default +rm %{buildroot}%{_sysconfdir}/openldap/*.default # install an init script for the servers mkdir -p %{buildroot}%{_unitdir} @@ -305,76 +334,76 @@ install -m 0644 %SOURCE1 %{buildroot}%{_unitdir}/slapd.service mv %{buildroot}%{_libdir}/slapd %{buildroot}%{_sbindir}/ # setup tools as symlinks to slapd -rm -f %{buildroot}%{_sbindir}/slap{acl,add,auth,cat,dn,index,passwd,test,schema} -rm -f %{buildroot}%{_libdir}/slap{acl,add,auth,cat,dn,index,passwd,test,schema} -for X in acl add auth cat dn index passwd test schema; do ln -s slapd %{buildroot}%{_sbindir}/slap$X ; done +for X in acl add auth cat dn index modify passwd test schema ; do + rm %{buildroot}%{_sbindir}/slap$X + ln -s slapd %{buildroot}%{_sbindir}/slap$X +done # re-symlink unversioned libraries, so ldconfig is not confused pushd %{buildroot}%{_libdir} v=%{version} version=$(echo ${v%.[0-9]*}) -for lib in liblber libldap libldap_r libslapi; do - rm -f ${lib}.so - ln -s ${lib}-${version}.so.2 ${lib}.so +for lib in liblber libldap %{?with_servers:libslapi}; do + rm -f ${lib}.so + ln -s ${lib}.so.%{so_ver} ${lib}.so done + +for lib in $(ls | grep libldap); do + IFS='.' + read -r -a libsplit <<< "$lib" + if [[ -z "${libsplit[3]}" && -n "${libsplit[2]}" ]] + then + so_ver_short_2_4="%{so_ver_compat}" + elif [ -n "${libsplit[3]}" ] + then + so_ver_full_2_4="%{so_ver_compat}.${libsplit[3]}.${libsplit[4]}" + fi + unset IFS +done + +# Provide only libldap and copy it to libldap_r for both 2.4 and 2.6+ versions, make a versioned lib link +# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOL) +gcc -shared -o "%{buildroot}%{_libdir}/libldap-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap +gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap +gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -llber +%if %{with servers} +gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lslapi +ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +%endif +ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s libldap_r-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s liblber-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} + popd # tweak permissions on the libraries to make sure they're correct chmod 0755 %{buildroot}%{_libdir}/lib*.so* chmod 0644 %{buildroot}%{_libdir}/lib*.*a +chmod 0644 %{buildroot}%{_libdir}/openldap/*.la # slapd.conf(5) is obsoleted since 2.3, see slapd-config(5) mkdir -p %{buildroot}%{_datadir} install -m 0755 -d %{buildroot}%{_datadir}/openldap-servers install -m 0644 %SOURCE3 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif install -m 0700 -d %{buildroot}%{_sysconfdir}/openldap/slapd.d -rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.conf -rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.ldif +rm %{buildroot}%{_sysconfdir}/openldap/slapd.conf +rm %{buildroot}%{_sysconfdir}/openldap/slapd.ldif # move doc files out of _sysconfdir mv %{buildroot}%{_sysconfdir}/openldap/schema/README README.schema -mv %{buildroot}%{_sysconfdir}/openldap/DB_CONFIG.example %{buildroot}%{_datadir}/openldap-servers/DB_CONFIG.example -chmod 0644 %{buildroot}%{_datadir}/openldap-servers/DB_CONFIG.example # remove files which we don't want packaged -rm -f %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/openldap/ removed, yet +rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/openldap/ removed, yet -rm -f %{buildroot}%{_localstatedir}/openldap-data/DB_CONFIG.example -rmdir %{buildroot}%{_localstatedir}/openldap-data - -%post - -/sbin/ldconfig - -# create certificate database -%{_libexecdir}/openldap/create-certdb.sh >&/dev/null || : - -%postun -p /sbin/ldconfig - -%pre servers - -# create ldap user and group -getent group ldap &>/dev/null || groupadd -r -g 55 ldap -getent passwd ldap &>/dev/null || \ - useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap - -if [ $1 -eq 2 ]; then - # package upgrade - - old_version=$(rpm -q --qf=%%{version} openldap-servers) - new_version=%{version} - - if [ "$old_version" != "$new_version" ]; then - touch %{_sharedstatedir}/ldap/rpm_upgrade_openldap &>/dev/null - fi -fi - -exit 0 +%ldconfig_scriptlets +%if %{with servers} %post servers - -/sbin/ldconfig %systemd_post slapd.service # generate configuration if necessary @@ -388,80 +417,24 @@ if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ %{systemctl_bin} try-restart slapd.service &>/dev/null fi -start_slapd=0 - -# upgrade the database -if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap ]; then - if %{systemctl_bin} --quiet is-active slapd.service; then - %{systemctl_bin} stop slapd.service - start_slapd=1 - fi - - %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap -fi - # restart after upgrade if [ $1 -ge 1 ]; then - if [ $start_slapd -eq 1 ]; then - %{systemctl_bin} start slapd.service &>/dev/null || : - else - %{systemctl_bin} condrestart slapd.service &>/dev/null || : - fi + %{systemctl_bin} condrestart slapd.service &>/dev/null || : fi exit 0 %preun servers - %systemd_preun slapd.service - %postun servers - -/sbin/ldconfig %systemd_postun_with_restart slapd.service - - -%triggerin servers -- libdb - -# libdb upgrade (setup for %%triggerun) -if [ $2 -eq 2 ]; then - # we are interested in minor version changes (both versions of libdb are installed at this moment) - if [ "$(rpm -q --qf="%%{version}\n" libdb | sed 's/\.[0-9]*$//' | sort -u | wc -l)" != "1" ]; then - touch %{_sharedstatedir}/ldap/rpm_upgrade_libdb - else - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb - fi -fi - -exit 0 - - -%triggerun servers -- libdb - -# libdb upgrade (finish %%triggerin) -if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb ]; then - if %{systemctl_bin} --quiet is-active slapd.service; then - %{systemctl_bin} stop slapd.service - start=1 - else - start=0 - fi - - %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb - - [ $start -eq 1 ] && %{systemctl_bin} start slapd.service &>/dev/null -fi - -exit 0 - +%endif +# endif servers %files %doc openldap-%{version}/ANNOUNCEMENT %doc openldap-%{version}/CHANGES -%{!?_licensedir:%global license %%doc} %license openldap-%{version}/COPYRIGHT %license openldap-%{version}/LICENSE %doc openldap-%{version}/README @@ -469,21 +442,22 @@ exit 0 %dir %{_sysconfdir}/openldap/certs %config(noreplace) %{_sysconfdir}/openldap/ldap.conf %dir %{_libexecdir}/openldap/ -%{_libdir}/liblber-2.4*.so.* -%{_libdir}/libldap-2.4*.so.* -%{_libdir}/libldap_r-2.4*.so.* -%{_libdir}/libslapi-2.4*.so.* +%{_libdir}/liblber.so.* +%{_libdir}/libldap.so.* +%if %{with servers} +%{_libdir}/libslapi.so.* +%endif %{_mandir}/man5/ldif.5* %{_mandir}/man5/ldap.conf.5* +%if %{with servers} %files servers %doc openldap-%{version}/contrib/slapd-modules/smbk5pwd/README.smbk5pwd %doc openldap-%{version}/doc/guide/admin/*.html %doc openldap-%{version}/doc/guide/admin/*.png %doc openldap-%{version}/servers/slapd/back-perl/SampleLDAP.pm %doc openldap-%{version}/servers/slapd/back-perl/README.back_perl -%doc openldap-%{version}/servers/slapd/back-perl/README.back_perl -%doc ltb-project-openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd +%doc openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd %doc README.schema %config(noreplace) %dir %attr(0750,ldap,ldap) %{_sysconfdir}/openldap/slapd.d %config(noreplace) %{_sysconfdir}/openldap/schema @@ -494,27 +468,39 @@ exit 0 %{_unitdir}/slapd.service %{_datadir}/openldap-servers/ %{_libdir}/openldap/accesslog* -%{_libdir}/openldap/auditlog* %{_libdir}/openldap/allop* +%if %{with argon2} +%{_libdir}/openldap/argon2* +%{_mandir}/man5/slappw-argon2.5* +%else +%exclude %{_mandir}/man5/slappw-argon2.5* +%endif +%{_libdir}/openldap/auditlog* +%{_libdir}/openldap/autoca* +%{_libdir}/openldap/back_asyncmeta* %{_libdir}/openldap/back_dnssrv* %{_libdir}/openldap/back_ldap* %{_libdir}/openldap/back_meta* %{_libdir}/openldap/back_null* %{_libdir}/openldap/back_passwd* %{_libdir}/openldap/back_relay* -%{_libdir}/openldap/back_shell* %{_libdir}/openldap/back_sock* -%{_libdir}/openldap/back_perl* +%{_libdir}/openldap/check_password* %{_libdir}/openldap/collect* %{_libdir}/openldap/constraint* %{_libdir}/openldap/dds* %{_libdir}/openldap/deref* %{_libdir}/openldap/dyngroup* %{_libdir}/openldap/dynlist* +%{_libdir}/openldap/home* +%{_libdir}/openldap/lloadd* %{_libdir}/openldap/memberof* +%{_libdir}/openldap/nestgroup* +%{_libdir}/openldap/otp* %{_libdir}/openldap/pcache* %{_libdir}/openldap/ppolicy* %{_libdir}/openldap/refint* +%{_libdir}/openldap/remoteauth* %{_libdir}/openldap/retcode* %{_libdir}/openldap/rwm* %{_libdir}/openldap/seqmod* @@ -524,33 +510,412 @@ exit 0 %{_libdir}/openldap/translucent* %{_libdir}/openldap/unique* %{_libdir}/openldap/valsort* -%{_libdir}/openldap/check_password* %{_libexecdir}/openldap/functions %{_libexecdir}/openldap/check-config.sh -%{_libexecdir}/openldap/upgrade-db.sh -%{_sbindir}/sl* -%{_mandir}/man8/* +%{_sbindir}/slap* +%{_mandir}/man5/lloadd.conf.5* +%{_mandir}/man8/lloadd.8* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* +%{_mandir}/man8/slap*.8* +%{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf +%else +%exclude %{_datadir}/openldap-servers/ +%exclude %{_libdir}/openldap/ +%exclude %{_libexecdir}/openldap/check-config.sh +%exclude %{_libexecdir}/openldap/functions +%exclude %{_mandir}/man5/slapd*.5* +%exclude %{_mandir}/man5/slapo-*.5* +%exclude %{_mandir}/man5/lloadd.conf.5* +%exclude %{_mandir}/man5/slappw-argon2.5* +%exclude %{_mandir}/man8/* +%exclude %{_sbindir}/slap* +%exclude %{_sysconfdir}/openldap/check_password.conf +%exclude %{_sysconfdir}/openldap/schema +%exclude %{_tmpfilesdir}/slapd.conf +%exclude %{_unitdir}/slapd.service +%endif +# endif servers + %files clients -%{_bindir}/* -%{_mandir}/man1/* +%{_bindir}/ldap* +%{_mandir}/man1/ldap*.1* %files devel %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc -%{_libdir}/lib*.so +%{_libdir}/liblber.so +%{_libdir}/libldap.so +%if %{with servers} +%{_libdir}/libslapi.so +%endif %{_includedir}/* +%{_libdir}/pkgconfig/lber.pc +%{_libdir}/pkgconfig/ldap.pc %{_mandir}/man3/* +%files compat +%{_libdir}/libldap-2.4*.so.* +%{_libdir}/libldap_r-2.4*.so.* +%{_libdir}/liblber-2.4*.so.* +%if %{with servers} +%{_libdir}/libslapi-2.4*.so.* +%endif + %changelog +* Wed Jan 14 2026 Yaakov Selkowitz - 2.6.10-6 +- Enable argon2 only in Fedora + +* Tue Jan 13 2026 Simon Pichugin - 2.6.10-5 +- Add support for argon2 (rhbz#2229405) +- Bump version 2.6.10-5 + +* Fri Aug 29 2025 Simon Pichugin - 2.6.10-4 +- Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728) +- Convert STI tests to FMF (rhbz#2382998) + +* Thu Jul 24 2025 Fedora Release Engineering - 2.6.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Mon Jul 07 2025 Jitka Plesnikova - 2.6.10-2 +- Perl 5.42 rebuild + +* Tue Jun 10 2025 Simon Pichugin - 2.6.10-1 +- Rebase to version 2.6.10 (rhbz#2368103) + +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-5 +- Drop call to %sysusers_create_compat + +* Sat Feb 01 2025 Björn Esser - 2.6.9-4 +- Add explicit BR: libxcrypt-devel + +* Fri Jan 24 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-3 +- Adjust file patterns for the sbin merge + +* Thu Jan 16 2025 Simon Pichugin - 2.6.9-2 +- Disable MD2 hash algorithm (rhbz#2338556) + +* Thu Jan 9 2025 Simon Pichugin - 2.6.9-1 +- Rebase to version 2.6.9 (rhbz#2329002) + +* Tue Dec 3 2024 Simon Pichugin - 2.6.8-6 +- Avoid SSL context cleanup during library destruction + +* Tue Jul 23 2024 Simon Pichugin - 2.6.8-5 +- Clean up spec file so it's aligned with c10s +- Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526) + +* Thu Jul 18 2024 Fedora Release Engineering - 2.6.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon Jun 24 2024 Yaakov Selkowitz - 2.6.8-3 +- Disable libslapi and servers in RHEL builds + +* Tue Jun 11 2024 Jitka Plesnikova - 2.6.8-2 +- Perl 5.40 rebuild + +* Wed May 22 2024 Simon Pichugin - 2.6.8-1 +- Rebase to version 2.6.8 (rhbz#2282258) + +* Fri Feb 9 2024 Simon Pichugin - 2.6.7-1 +- Rebase to version 2.6.7 (rhbz#2261163) +- Use systemd-sysusers for ldap user and group (rhbz#2173965) +- Fix compiler errors (rhbz#2261427) +- Replace License with SPDX identifier + +* Thu Jan 25 2024 Fedora Release Engineering - 2.6.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2.6.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jul 31 2023 Simon Pichugin - 2.6.6-1 +- Rebase to version 2.6.6 + Related: rhbz#2227948 + +* Wed Jul 26 2023 Simon Pichugin - 2.6.5-1 +- Rebase to version 2.6.5 + Related: rhbz#2221798 + +* Thu Jul 20 2023 Fedora Release Engineering - 2.6.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 2.6.4-3 +- Perl 5.38 rebuild + +* Sat Apr 15 2023 Florian Weimer - 2.6.4-2 +- Apply upstream patch to fix C99 compatibility issues + +* Mon Feb 27 2023 Simon Pichugin - 2.6.4-1 +- Rebase to version 2.6.4 + Related: rhbz#2168351 + +* Thu Jan 19 2023 Fedora Release Engineering - 2.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Wed Aug 17 2022 Simon Pichugin - 2.6.3-1 +- Rebase to version 2.6.3 + Related: rhbz#2107382 + +* Thu Aug 11 2022 Simon Pichugin - 2.6.2-5 +- Add export symbols related to LDAP_CONNECTIONLESS + Related: rhbz#2117825 + +* Fri Jul 22 2022 Fedora Release Engineering - 2.6.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jun 27 2022 Simon Pichugin - 2.6.2-3 +- Fix debuginfo missing issue (#2101615) + +* Mon May 30 2022 Jitka Plesnikova - 2.6.2-2 +- Perl 5.36 rebuild + +* Wed May 25 2022 Simon Pichugin - 2.6.2-1 +- Rebase to version 2.6.2 (#2090447) + +* Wed Feb 2 2022 Simon Pichugin - 2.6.1-2 +- Fix twice packaged compat libraries issue (#2049085) + +* Mon Jan 31 2022 Simon Pichugin - 2.6.1-1 +- Update to new major release OpenLDAP 2.6.1 (#1955293) + + rediff all patches and remove patches now upstream + + use upstream source location for check password module + + and rediff patch due to this + + add patch to fix build issue in 2.5.4 (from upstream) + + clean and sort buildreqs + + remove various refs to bdb + + remove now default -DLDAP_USE_NON_BLOCKING_TLS + + add new modules and enable load balancer as module + + disable wiredtired backend due to missing build deps + + don't remove files that don't exist + + let check-config work on *.mdb over legacy files + + remove refs to old-style config + + new soname names + + remove libldap_r link as the library was merged with libldap + + refactor openldap-compat package to support the transition from 2.4 + + add UPGRADE_INSTRUCTIONS for openldap-server upgrade +- The original patch was submitted by Fedora user - terjeros + https://src.fedoraproject.org/rpms/openldap/pull-request/6 + +* Mon Jan 24 2022 Timm Bäder - 2.4.59-6 +- Disable automatic .la file removal +- https://fedoraproject.org/wiki/Changes/RemoveLaFiles + +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.59-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Sep 30 2021 Simon Pichugin - 2.4.59-4 +- Backport TLS SNI feature from OpenLDAP 2.5 (#2009534) + +* Tue Sep 14 2021 Sahana Prasad - 2.4.59-3 +- Rebuilt with OpenSSL 3.0.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 2.4.59-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Jul 7 2021 Simon Pichugin - 2.4.59-1 +- Rebase to version 2.4.59 (#1980015) +- Update the spec file for upcoming autoconf-2.71 (#1943079) + +* Tue Jun 15 2021 Simon Pichugin - 2.4.58-5 +- Fix slapd.tmpfiles complaints (#1972147) +- Use https:// for source (#1972141) + +* Thu Jun 3 2021 Simon Pichugin - 2.4.58-4 +- Rebuild without MP_2 support (#1967136) +- Fix coverity issues + +* Fri May 21 2021 Jitka Plesnikova - 2.4.58-3 +- Perl 5.34 rebuild + +* Thu Apr 8 2021 Simon Pichugin - 2.4.58-2 +- Backport Channel Binding support (#1822904, #1822737) + +* Tue Mar 23 2021 Simon Pichugin - 2.4.58-1 +- Rebase to version 2.4.58 (#1939663) + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.4.57-3 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.57-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jan 19 2021 Simon Pichugin - 2.4.57-1 +- Rebase to version 2.4.57 (#1917583) + +* Thu Nov 26 2020 Simon Pichugin - 2.4.56-4 +- Use gcc to link libldap_r to libldap (#1537260) + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-3 +- Fix 32-bit libraries build (#1537260) + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-2 +- Drop non-threaded libldap (#1537260) + +* Wed Nov 18 2020 Simon Pichugin - 2.4.56-1 +- Rebase to version 2.4.56 (#1896508) + +* Mon Nov 02 2020 Simon Pichugin - 2.4.55-1 +- Rebase to version 2.4.55 (#1891622) + +* Tue Oct 13 2020 Simon Pichugin - 2.4.54-1 +- Rebase to version 2.4.54 (#1887581) + +* Thu Sep 10 2020 Simon Pichugin - 2.4.53-1 +- Rebase to version 2.4.53 (#1868240) + +* Thu Sep 03 2020 Simon Pichugin - 2.4.52-1 +- Rebase to version 2.4.52 (#1868240) + +* Sat Aug 01 2020 Fedora Release Engineering - 2.4.50-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.50-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jun 22 2020 Jitka Plesnikova - 2.4.50-2 +- Perl 5.32 rebuild + +* Wed Jun 17 2020 Matus Honek - 2.4.50-1 +- Rebase to version 2.4.50 (#1742285) + +* Tue Jun 16 2020 Tom Stellard - 2.4.47-5 +- Spec file cleanups +- Add BuildRequres: gcc [1] +- make_build [2] and make_install [3] +- [1] https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_buildrequires_and_requires +- [2] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make +- [3] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_why_the_makeinstall_macro_should_not_be_used + +* Wed Jan 29 2020 Fedora Release Engineering - 2.4.47-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jul 25 2019 Fedora Release Engineering - 2.4.47-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu May 30 2019 Jitka Plesnikova - 2.4.47-2 +- Perl 5.30 rebuild + +* Wed Feb 13 2019 Matus Honek - 2.4.47-1 +- Rebase to upstream version 2.4.47 + +* Fri Feb 01 2019 Fedora Release Engineering - 2.4.46-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 2.4.46-12 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Mon Dec 17 2018 Matus Honek - 2.4.46-11 +- Reference default system-wide CA certificates in manpages (#1611591) + +* Tue Oct 16 2018 Matus Honek - 2.4.46-10 +- Revert "Fix: Cannot use SSL3 anymore" + +* Mon Oct 08 2018 Matus Honek - 2.4.46-9 +- Backport upstream fixes for ITS 7595 - add OpenSSL EC support (#1623495) + +* Tue Aug 14 2018 Matus Honek - 2.4.46-8 +- Fix: Cannot use SSL3 anymore (#1592431) + +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.46-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jul 6 2018 Matus Honek - 2.4.46-6 +- Build with LDAP_USE_NON_BLOCKING_TLS (#1594928) +- Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967) + +* Fri Jul 06 2018 Petr Pisar - 2.4.46-5 +- Perl 5.28 rebuild + +* Wed Jul 4 2018 Matus Honek - 2.4.46-4 +- Remove unused leftover MozNSS Compat. Layer references (#1557967) + +* Wed Jul 4 2018 Matus Honek - 2.4.46-3 +- MozNSS Compat. Layer: Make log messages more clear (#1598103) +- MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203) + +* Wed Jun 27 2018 Jitka Plesnikova - 2.4.46-2 +- Perl 5.28 rebuild +- MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161) + +* Tue Mar 27 2018 Matus Honek - 2.4.46-1 +- Rebase to version OpenLDAP 2.4.46 (#1559652) + +* Mon Mar 5 2018 Matus Honek - 2.4.45-14 +- Utilize system-wide crypto-policies (#1483979) + +* Thu Mar 1 2018 Matus Honek - 2.4.45-13 +- fix: openldap does not use Fedora build flags + + makes use of redhat-rpm-config package +- Drop superfluous back-sql linking patch + +* Wed Feb 28 2018 Matus Honek - 2.4.45-12 +- MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110) + +* Wed Feb 21 2018 Matus Honek - 2.4.45-11 +- TLS: Use system trusted CA store by default (#1270678, #1537259) + +* Sun Feb 11 2018 Matus Honek - 2.4.45-10 +- Complete change: Disable TLSMC in F29+ + +* Fri Feb 09 2018 Igor Gnatenko - 2.4.45-9 +- Escape macros in %%changelog +- Disable TLSMC in F29+ +- Remove obsolete Group tag +- Don't call ldconfig in servers subpackage +- Switch to %%ldconfig_scriptlets +- Remove unneeded Requires(post): systemd-sysv, chkconfig +- Switch to %%systemd_requires +- Change BuildRequires: systemd-units to systemd + +* Wed Feb 7 2018 Matus Honek - 2.4.45-8 +- Drop TCP wrappers support (#1531487) + +* Wed Feb 7 2018 Matus Honek - 2.4.45-7 +- MozNSS Compat. Layer fixes (#1400570) + - fix incorrect parsing of CACertDir (orig. #1533955) + - fix PIN disclaimer not always shown (orig. #1516409) + - fix recursive directory deletion (orig. #1516409) + - Ensure consistency of a PEM dir before usage (orig. #1516409) + + Warn just before use of a PIN about key file extraction + - Enable usage of NSS DB with PEM cert/key (orig. #1525485) + + Fix a possible invalid dereference (covscan) + +* Sat Jan 20 2018 Björn Esser - 2.4.45-6 +- Rebuilt for switch to libxcrypt + +* Wed Dec 6 2017 Matus Honek - 2.4.45-5 +- Fix issues in MozNSS compatibility layer (#1400570) + + Force write file with fsync to avoid race conditions + + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix + + Allow missing cert and key which is a valid usecase + + Create extraction folder only in /tmp to simplify selinux rules + + Fix Covscan issues + +* Fri Nov 3 2017 Matus Honek - 2.4.45-4 +- Build with OpenSSL with MozNSS compatibility layer (#1400570) + +* Thu Aug 03 2017 Fedora Release Engineering - 2.4.45-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 2.4.45-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Fri Jul 7 2017 Matus Honek - 2.4.45-1 - Rebase to version 2.4.45 (#1458081) * fixes CVE-2017-9287 (#1456712, #1456713) - Update the 'sources' file with new SHA512 hashes +* Fri Jul 7 2017 Matus Honek - 2.4.44-12 +- Change Requires to Recommends for nss-tools (#1415086) + +* Sun Jun 04 2017 Jitka Plesnikova - 2.4.44-11 +- Perl 5.26 rebuild + * Fri Mar 31 2017 Matus Honek - 2.4.44-10 - NSS: Maximal TLS protocol version should be equal to NSS default (#1435692) @@ -584,10 +949,10 @@ exit 0 - Update to 2.4.44 (#1305191) * Tue May 3 2016 Matus Honek - 2.4.43-5 -- Bring back *.la files in %{_libdir}/openldap/ (#1331484) +- Bring back *.la files in %%{_libdir}/openldap/ (#1331484) * Wed Apr 27 2016 Matus Honek - 2.4.43-4 -- Keep *.so libraries in %{_libdir}/openldap/ (#1331484) +- Keep *.so libraries in %%{_libdir}/openldap/ (#1331484) - Include AllOp overlay (#1319782) * Sun Apr 10 2016 Peter Robinson 2.4.43-3 diff --git a/openldap.sysusers b/openldap.sysusers new file mode 100644 index 0000000..37ef083 --- /dev/null +++ b/openldap.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +g ldap 55 +u ldap 55:55 "OpenLDAP server" /var/lib/ldap /sbin/nologin diff --git a/plans/gating.fmf b/plans/gating.fmf new file mode 100644 index 0000000..387b7bf --- /dev/null +++ b/plans/gating.fmf @@ -0,0 +1,8 @@ +summary: Test plan for openldap + +discover: + how: fmf + +execute: + how: tmt + diff --git a/slapd.ldif b/slapd.ldif index 4105131..e7449c1 100644 --- a/slapd.ldif +++ b/slapd.ldif @@ -9,9 +9,21 @@ cn: config # # TLS settings # -olcTLSCACertificatePath: /etc/openldap/certs -olcTLSCertificateFile: "OpenLDAP Server" -olcTLSCertificateKeyFile: /etc/openldap/certs/password +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by oclTLSCACertificatePath one has to include them explicitly: +#olcTLSCACertificateFile: /etc/pki/tls/cert.pem +# +# Private cert and key are not pregenerated. +#olcTLSCertificateFile: +#olcTLSCertificateKeyFile: +# +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#olcTLSCipherSuite: PROFILE=SYSTEM + # # Do not enable referrals until AFTER you have a working directory @@ -30,36 +42,41 @@ olcTLSCertificateKeyFile: /etc/openldap/certs/password # # Load dynamic backend modules: # - modulepath is architecture dependent value (32/64-bit system) -# - back_sql.la backend requires openldap-servers-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # #dn: cn=module,cn=config #objectClass: olcModuleList #cn: module -#olcModulepath: /usr/lib/openldap -#olcModulepath: /usr/lib64/openldap +#olcModulepath: /usr/lib/openldap +#olcModulepath: /usr/lib64/openldap #olcModuleload: accesslog.la +#olcModuleload: allop.la #olcModuleload: auditlog.la +#olcModuleload: autoca.la +#olcModuleload: back_asyncmeta.la #olcModuleload: back_dnssrv.la #olcModuleload: back_ldap.la -#olcModuleload: back_mdb.la #olcModuleload: back_meta.la #olcModuleload: back_null.la #olcModuleload: back_passwd.la #olcModuleload: back_relay.la -#olcModuleload: back_shell.la #olcModuleload: back_sock.la +#olcModuleload: check_password.la #olcModuleload: collect.la #olcModuleload: constraint.la #olcModuleload: dds.la #olcModuleload: deref.la #olcModuleload: dyngroup.la #olcModuleload: dynlist.la +#olcModuleload: home.la +#olcModuleload: lloadd.la #olcModuleload: memberof.la +#olcModuleload: otp.la #olcModuleload: pcache.la #olcModuleload: ppolicy.la #olcModuleload: refint.la +#olcModuleload: remoteauth.la #olcModuleload: retcode.la #olcModuleload: rwm.la #olcModuleload: seqmod.la diff --git a/slapd.service b/slapd.service index 30821fd..02fab7f 100644 --- a/slapd.service +++ b/slapd.service @@ -3,7 +3,6 @@ Description=OpenLDAP Server Daemon After=syslog.target network-online.target Documentation=man:slapd Documentation=man:slapd-config -Documentation=man:slapd-hdb Documentation=man:slapd-mdb Documentation=file:///usr/share/doc/openldap-servers/guide.html diff --git a/slapd.tmpfiles b/slapd.tmpfiles index 56aa32e..634cea1 100644 --- a/slapd.tmpfiles +++ b/slapd.tmpfiles @@ -1,2 +1,2 @@ # openldap runtime directory for slapd.arg and slapd.pid -d /var/run/openldap 0755 ldap ldap - +d /run/openldap 0755 ldap ldap - diff --git a/sources b/sources index 0faa962..0b0bd67 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.45.tgz) = 1c9fc84efed8998f107ce6e1c6be3f5466388241afdca0cb3847720c9def0bc263a2dbc15bf0f9112d1b4c391fd01e8531a4fb08c5532c30fb86924c08daedab +SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc +SHA512 (openldap-2.6.10.tgz) = 18129ad9a385457941e3203de5f130fe2571701abf24592c5beffb01361aae3182c196b2cd48ffeecb792b9b0e5f82c8d92445a7ec63819084757bdedba63b20 diff --git a/tests/smoke-test/Makefile b/tests/smoke-test/Makefile new file mode 100644 index 0000000..322f5a5 --- /dev/null +++ b/tests/smoke-test/Makefile @@ -0,0 +1,83 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/openldap/Sanity/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/openldap/Sanity/smoke-test +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Viktor Ashirov " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test calls upstream test suite." >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 3h" >> $(METADATA) + @echo "RunFor: openldap" >> $(METADATA) + @echo "Requires: openldap" >> $(METADATA) + @echo "Requires: openldap-clients" >> $(METADATA) + @echo "Requires: openldap-servers" >> $(METADATA) + @echo "Requires: nss-devel" >> $(METADATA) + @echo "Requires: cracklib-devel" >> $(METADATA) + @echo "Requires: cyrus-sasl-devel" >> $(METADATA) + @echo "Requires: gdbm-devel" >> $(METADATA) + @echo "Requires: groff" >> $(METADATA) + @echo "Requires: krb5-devel" >> $(METADATA) + @echo "Requires: libdb-devel" >> $(METADATA) + @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: libtool-ltdl-devel" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) + @echo "Requires: openssl-devel" >> $(METADATA) + @echo "Requires: pam-devel" >> $(METADATA) + @echo "Requires: perl" >> $(METADATA) + @echo "Requires: perl-ExtUtils-Embed" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Requires: rpm-build" >> $(METADATA) + @echo "Requires: unixODBC-devel" >> $(METADATA) + @echo "Requires: yum-utils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/smoke-test/PURPOSE b/tests/smoke-test/PURPOSE new file mode 100644 index 0000000..1571314 --- /dev/null +++ b/tests/smoke-test/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/openldap/Sanity/smoke-test +Description: Test calls upstream test suite. +Author: Ondrej Moris diff --git a/tests/smoke-test/main.fmf b/tests/smoke-test/main.fmf new file mode 100644 index 0000000..cc59f6b --- /dev/null +++ b/tests/smoke-test/main.fmf @@ -0,0 +1,31 @@ +summary: Test calls upstream test suite +description: Test calls upstream test suite +contact: Viktor Ashirov +component: + - openldap +test: ./runtest.sh +framework: beakerlib +recommend: + - openldap + - openldap-clients + - openldap-servers + - cracklib-devel + - cyrus-sasl-devel + - gdbm-devel + - groff + - krb5-devel + - libdb-devel + - libtool + - libtool-ltdl-devel + - nfs-utils + - nss-devel + - openssl-devel + - pam-devel + - perl + - perl-ExtUtils-Embed + - pkgconf-pkg-config + - pkgconfig + - rpm-build + - unixODBC-devel + - yum-utils +duration: 3h diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh new file mode 100755 index 0000000..bd1ebe6 --- /dev/null +++ b/tests/smoke-test/runtest.sh @@ -0,0 +1,112 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openldap/Sanity/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="openldap" + +PACKAGES=("openldap" \ + "openldap-clients" \ + "openldap-servers" \ + "cyrus-sasl-devel" \ + "gdbm-devel" \ + "libtool" \ + "krb5-devel" \ + "openssl-devel" \ + "pam-devel" \ + "perl" \ + "unixODBC-devel" \ + "libtool-ltdl-devel" \ + "nfs-utils" \ + "rpm-build" \ + "nss-devel" \ + "libdb-devel" \ + "groff" \ + "cracklib-devel" \ + "perl-ExtUtils-Embed"\ + "pkgconf-pkg-config" ) + +LDAP_SERVICE='slapd' + +rlJournalStart + + rlPhaseStartSetup "General Setup" + + rlRun "TmpDir=$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + + for P in "${PACKAGES[@]}"; do rlCheckRpm $P || rlDie; done + + rlFetchSrcForInstalled $PACKAGE + rlRun "yum-builddep -y openldap*src.rpm" 0 + rlRun "rpm -ihv *.rpm" 0 + + rlServiceStop $LDAP_SERVICE + + rlPhaseEnd + + rlPhaseStartTest + + TOPDIR=$(rpm --eval %_topdir) + rlRun "pushd $TOPDIR" 0 + + rlRun "rpmbuild -vv -bc SPECS/openldap.spec >build.log 2>&1" 0 + [[ $? -ne 0 ]] && cat build.log + VERSION=$(rpm -q --qf "%{VERSION}\n" openldap | tail -1) + rlRun "pushd BUILD/openldap-${VERSION}-build/openldap-${VERSION}/openldap-${VERSION}" 0 + # workaround for failing test, it tests unsupported configuration + # see http://www.openldap.org/lists/openldap-technical/201204/msg00080.html for upstream reply + # change of check after test is not enough because run of all tests with hdb is skipped if test058 fails with bdb + #rm -f tests/scripts/test058-syncrepl-asymmetric + + rlRun "make check > make_check.out 2>&1" 0 + + grep ">>>>" make_check.out > make_check.results + cat make_check.out + echo -e "\n\nResults:\n\n" + cat make_check.results + + rlAssertNotGrep "failed" make_check.results + + rlRun "popd" 0 + rlRun "popd" 0 + rlPhaseEnd + + rlPhaseStartCleanup + + rlServiceRestore $LDAP_SERVICE + rlRun "rm -rf BUILD/opendap-$(rpm -q --qf "%{VERSION}" openldap)" 0 + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + + rlPhaseEnd + +rlJournalPrintText + +rlJournalEnd