diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index a31ea14..50fa4b0 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,28 @@ /openldap-2.4.44.tgz /openldap-2.4.45.tgz /openldap-2.4.46.tgz +/openldap-2.4.47.tgz +/openldap-2.4.50.tgz +/openldap-2.4.52.tgz +/openldap-2.4.53.tgz +/openldap-2.4.54.tgz +/openldap-2.4.55.tgz +/openldap-2.4.56.tgz +/openldap-2.4.57.tgz +/openldap-2.4.58.tgz +/openldap-2.4.59.tgz +/openldap-2.5.4.tgz +/openldap-ppolicy-check-password-1.1.tar.gz +/openldap-2.5.5.tgz +/openldap-2.5.7.tgz +/openldap-2.5.8.tgz +/openldap-2.6.1.tgz +/openldap-2.6.2.tgz +/openldap-2.6.3.tgz +/openldap-2.6.4.tgz +/openldap-2.6.5.tgz +/openldap-2.6.6.tgz +/openldap-2.6.7.tgz +/openldap-2.6.8.tgz +/openldap-2.6.9.tgz +/openldap-2.6.10.tgz diff --git a/UPGRADE_INSTRUCTIONS b/UPGRADE_INSTRUCTIONS new file mode 100644 index 0000000..14c051f --- /dev/null +++ b/UPGRADE_INSTRUCTIONS @@ -0,0 +1,30 @@ +You have upgraded your openldap-servers package. +Any major version upgrade can cause database corruption or loss. +Please, make sure that you have up-to-date back up and read this document carefully. + +It's still recommended to do the backup even on the minor version upgrade. + +Please, review the next links before performing any action: + +Upgrading from 2.4.x - https://www.openldap.org/doc/admin25/appendix-upgrading.html +Upgrading from 2.5.x - https://www.openldap.org/doc/admin26/appendix-upgrading.html +The normal upgrade procedure - https://www.openldap.org/doc/admin26/maintenance.html + +Additionally, please, review and perform the following steps that can help you with the upgrade: + + 1. Back up both data and configuration directories into a safe place; + 2. Export data to an LDIF file using slapcat; +a. If you have the deprecated DB type and you haven't performed the slapcat command, you need to move your data and configuration to the system with OpenLDAP 2.4 version and run slapcat command there; + 3. Change the server's configuration according to the changes in the above documents; + a. If you are replacing the BDB/HDB with MDB, make sure to replace the BDB/HDB sections with their MDB counterparts; +4. Clear out the current data directory; + 5. Import data to a new database from the LDIF file using slapadd; + 6. Make sure that your data is intact. + +After you have completed the above operations, you can remove this file (/usr/share/openldap-servers/UPGRADE_INSTRUCTIONS) and start the server: + + systemctl start slapd.service + +Be careful with this document's procedure, make sure you understand it, and test it in a non-production environment first. Always make sure that all backups are in place. + +You have been warned about the possibility of data corruption or loss. diff --git a/check-password-makefile.patch b/check-password-makefile.patch index f39ba81..048ee2e 100644 --- a/check-password-makefile.patch +++ b/check-password-makefile.patch @@ -1,32 +1,45 @@ ---- a/Makefile 2009-10-31 18:59:06.000000000 +0100 -+++ b/Makefile 2014-12-17 09:42:37.586079225 +0100 -@@ -13,22 +13,11 @@ +diff --git a/Makefile b/Makefile +index 4457bad..91de40b 100644 +--- a/Makefile ++++ b/Makefile +@@ -13,17 +13,10 @@ CRACKLIB=/usr/share/cracklib/pw_dict # CONFIG=/etc/openldap/check_password.conf --OPT=-g -O2 -Wall -fpic \ -- -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ -- -DCONFIG_FILE="\"$(CONFIG)\"" \ -+CFLAGS+=-fpic \ -+ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ -+ -DCONFIG_FILE="\"$(CONFIG)\"" \ - -DDEBUG - +- -# Where to find the OpenLDAP headers. -# --LDAP_INC=-I/home/pyb/tmp/openldap-2.3.39/include \ -- -I/home/pyb/tmp/openldap-2.3.39/servers/slapd +-LDAP_INC=-I/usr/include/openldap/include \ +- -I/usr/include/openldap/servers/slapd - -# Where to find the CrackLib headers. -# -CRACK_INC= - -INCS=$(LDAP_INC) $(CRACK_INC) -- ++CFLAGS+=-fpic \ ++ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ ++ -DCONFIG_FILE="\"$(CONFIG)\"" \ ++ -DDEBUG + LDAP_LIB=-lldap_r -llber - # Comment out this line if you do NOT want to use the cracklib. -@@ -45,10 +34,10 @@ +@@ -33,27 +26,21 @@ LDAP_LIB=-lldap_r -llber + # + CRACKLIB_LIB=-lcrack + +-CC_FLAGS=-g -O2 -Wall -fpic +-CRACKLIB_OPT=-DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" +-DEBUG_OPT=-DDEBUG +-CONFIG_OPT=-DCONFIG_FILE="\"$(CONFIG)\"" +- +-OPT=$(CC_FLAGS) $(CRACKLIB_OPT) $(CONFIG_OPT) $(DEBUG_OPT) +- + LIBS=$(LDAP_LIB) $(CRACKLIB_LIB) + + LIBDIR=/usr/lib/openldap/ + ++ all: check_password check_password.o: @@ -38,4 +51,8 @@ + $(CC) $(LDFLAGS) -shared -o check_password.so check_password.o $(CRACKLIB_LIB) install: check_password - cp -f check_password.so ../../../usr/lib/openldap/modules/ +- cp -f check_password.so $(LIBDIR) ++ cp -f check_password.so ../../../usr/lib/openldap/modules/ + + clean: + $(RM) check_password.o check_password.so check_password.lo diff --git a/libexec-check-config.sh b/libexec-check-config.sh index 87e377f..16f43ea 100755 --- a/libexec-check-config.sh +++ b/libexec-check-config.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#! /usr/bin/sh # Author: Jan Vcelak . /usr/libexec/openldap/functions @@ -41,7 +41,7 @@ function check_db_perms() retcode=0 for dbdir in `databases`; do [ -d "$dbdir" ] || continue - for dbfile in `find ${dbdir} -maxdepth 1 -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" -or -name "log.*" -or -name "alock"`; do + for dbfile in `find ${dbdir} -maxdepth 1 -name "*.mdb"` ; do run_as_ldap "/usr/bin/test -r \"$dbfile\" -a -w \"$dbfile\"" if [ $? -ne 0 ]; then error "Read/write permissions for DB file '%s' are required." "$dbfile" @@ -56,8 +56,7 @@ function check_everything() { retcode=0 check_config_syntax || retcode=1 - # TODO: need support for Mozilla NSS, disabling temporarily - #check_certs_perms || retcode=1 + check_certs_perms || retcode=1 check_db_perms || retcode=1 return $retcode } diff --git a/libexec-functions b/libexec-functions index 990d2b8..8ee7500 100644 --- a/libexec-functions +++ b/libexec-functions @@ -84,14 +84,6 @@ function databases_new() ldif_value } -function databases_old() -{ - awk 'begin { database="" } - $1 == "database" { database=$2 } - $1 == "directory" { if (database == "bdb" || database == "hdb") print $2}' \ - "$SLAPD_CONFIG_FILE" -} - function certificates_new() { slapcat $SLAPD_GLOBAL_OPTIONS -c -H 'ldap:///cn=config???(cn=config)' 2>/dev/null | \ @@ -100,20 +92,14 @@ function certificates_new() ldif_value } -function certificates_old() -{ - awk '$1 ~ "^TLS(CACertificate(File|Path)|CertificateFile|CertificateKeyFile)$" { print $2 } ' \ - "$SLAPD_CONFIG_FILE" -} - function certificates() { - uses_new_config && certificates_new || certificates_old + uses_new_config && certificates_new } function databases() { - uses_new_config && databases_new || databases_old + uses_new_config && databases_new } diff --git a/libexec-upgrade-db.sh b/libexec-upgrade-db.sh deleted file mode 100755 index 1543c80..0000000 --- a/libexec-upgrade-db.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/sh -# Author: Jan Vcelak - -. /usr/libexec/openldap/functions - -if [ `id -u` -ne 0 ]; then - error "You have to be root to run this command." - exit 4 -fi - -load_sysconfig -retcode=0 - -for dbdir in `databases`; do - upgrade_log="$dbdir/db_upgrade.`date +%Y%m%d%H%M%S`.log" - bdb_files=`find "$dbdir" -maxdepth 1 -name "*.bdb" -printf '"%f" '` - - # skip uninitialized database - [ -z "$bdb_files"] || continue - - printf "Updating '%s', logging into '%s'\n" "$dbdir" "$upgrade_log" - - # perform the update - for command in \ - "/usr/bin/db_recover -v -h \"$dbdir\"" \ - "/usr/bin/db_upgrade -v -h \"$dbdir\" $bdb_files" \ - "/usr/bin/db_checkpoint -v -h \"$dbdir\" -1" \ - ; do - printf "Executing: %s\n" "$command" &>>$upgrade_log - run_as_ldap "$command" &>>$upgrade_log - result=$? - printf "Exit code: %d\n" $result >>"$upgrade_log" - if [ $result -ne 0 ]; then - printf "Upgrade failed: %d\n" $result - retcode=1 - fi - done -done - -exit $retcode diff --git a/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch new file mode 100644 index 0000000..62f85f4 --- /dev/null +++ b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch @@ -0,0 +1,120 @@ +From 606349836109cfb201bc5b5b424dffb749150a68 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Mon, 28 Apr 2025 14:36:24 +0100 +Subject: [PATCH] ITS#10297 Defer hostname resolution til first use + +--- + libraries/libldap/init.c | 33 +++++++++++++++++++-------------- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/os-ip.c | 2 ++ + libraries/libldap/tls_g.c | 3 +++ + libraries/libldap/tls_o.c | 3 +++ + 6 files changed, 28 insertions(+), 14 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..90fc34c5a6 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -631,6 +631,25 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + char * ldap_int_hostname = NULL; ++ ++void ++ldap_int_resolve_hostname(void) ++{ ++ static int resolved = 0; ++ ++ LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); ++ if ( !resolved ) { ++ char *name = ldap_int_hostname; ++ ++ ldap_int_hostname = ldap_pvt_get_fqdn( name ); ++ ++ if ( name != NULL && name != ldap_int_hostname ) { ++ LDAP_FREE( name ); ++ } ++ resolved = 1; ++ } ++ LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); ++} + #endif + + #ifdef LDAP_R_COMPILE +@@ -688,20 +707,6 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl ) + } + #endif + +-#if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) +- LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); +- { +- char *name = ldap_int_hostname; +- +- ldap_int_hostname = ldap_pvt_get_fqdn( name ); +- +- if ( name != NULL && name != ldap_int_hostname ) { +- LDAP_FREE( name ); +- } +- } +- LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); +-#endif +- + #ifndef HAVE_POLL + if ( ldap_int_tblsize == 0 ) ldap_int_ip_init(); + #endif +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..435b859066 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -743,6 +743,7 @@ LDAP_F (int) ldap_int_poll( LDAP *ld, ber_socket_t s, + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + LDAP_V (char *) ldap_int_hostname; ++LDAP_F (void) ldap_int_resolve_hostname(void); + LDAP_F (char *) ldap_host_connected_to( Sockbuf *sb, + const char *host ); + #endif +diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c +index 6c86edd055..629b540352 100644 +--- a/libraries/libldap/os-ip.c ++++ b/libraries/libldap/os-ip.c +@@ -890,6 +890,8 @@ ldap_host_connected_to( Sockbuf *sb, const char *host ) + * this is necessary for kerberos to work right, since the official + * hostname is used as the kerberos instance. + */ ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); + + switch (sa->sa_family) { + #ifdef LDAP_PF_LOCAL +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index de5b7f7c84..d4e7ee0bf7 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -597,6 +597,9 @@ tlsg_session_chkhost( LDAP *ld, tls_session *session, const char *name_in ) + int len1 = 0, len2 = 0; + int ntype = IS_DNS; + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 71677847a9..155f685c99 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -830,6 +830,9 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) + struct in_addr addr; + #endif + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +-- +GitLab + diff --git a/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch b/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch new file mode 100644 index 0000000..0c1b3bb --- /dev/null +++ b/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch @@ -0,0 +1,37 @@ +From 6779e56fafb0aa8ae5efa7068da34a630b51b530 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Fri, 5 Aug 2022 13:23:52 -0700 +Subject: [PATCH] Add export symbols related to LDAP_CONNECTIONLESS + +--- + libraries/liblber/lber.map | 1 + + libraries/libldap/ldap.map | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/libraries/liblber/lber.map b/libraries/liblber/lber.map +index 9a4094b0f..083cd1f32 100644 +--- a/libraries/liblber/lber.map ++++ b/libraries/liblber/lber.map +@@ -121,6 +121,7 @@ OPENLDAP_2.200 + ber_sockbuf_io_fd; + ber_sockbuf_io_readahead; + ber_sockbuf_io_tcp; ++ ber_sockbuf_io_udp; + ber_sockbuf_remove_io; + ber_sos_dump; + ber_start; +diff --git a/libraries/libldap/ldap.map b/libraries/libldap/ldap.map +index b28c9c21e..021aaba63 100644 +--- a/libraries/libldap/ldap.map ++++ b/libraries/libldap/ldap.map +@@ -200,6 +200,7 @@ OPENLDAP_2.200 + ldap_is_ldap_url; + ldap_is_ldapi_url; + ldap_is_ldaps_url; ++ ldap_is_ldapc_url; + ldap_is_read_ready; + ldap_is_write_ready; + ldap_ld_free; +-- +2.37.1 + diff --git a/openldap-add-tls-sni-support-to-libldap.patch b/openldap-add-tls-sni-support-to-libldap.patch new file mode 100644 index 0000000..ee7e814 --- /dev/null +++ b/openldap-add-tls-sni-support-to-libldap.patch @@ -0,0 +1,197 @@ +From 19e631e977c4f57905b2380cf79ccaf8e6d99e9d Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 03:41:12 +0100 +Subject: [PATCH 1/4] ITS#9176 Add TLS SNI support to libldap + +Implemented for OpenSSL, GnuTLS just stubbed +--- + libraries/libldap/ldap-tls.h | 2 +- + libraries/libldap/tls2.c | 2 +- + libraries/libldap/tls_g.c | 2 +- + libraries/libldap/tls_o.c | 8 ++++++-- + 4 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index c8a27112f1..c149b1867c 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -34,7 +34,7 @@ typedef void (TI_ctx_free)(tls_ctx *ctx); + typedef int (TI_ctx_init)(struct ldapoptions *lo, struct ldaptls *lt, int is_server); + + typedef tls_session *(TI_session_new)(tls_ctx *ctx, int is_server); +-typedef int (TI_session_connect)(LDAP *ld, tls_session *s); ++typedef int (TI_session_connect)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_accept)(tls_session *s); + typedef int (TI_session_upflags)(Sockbuf *sb, tls_session *s, int rc); + typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len ); +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 82ca5272cc..cbeea8c6c4 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -368,7 +368,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + } + +- err = tls_imp->ti_session_connect( ld, ssl ); ++ err = tls_imp->ti_session_connect( ld, ssl, host ); + + #ifdef HAVE_WINSOCK + errno = WSAGetLastError(); +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 3b72cd2a1f..5468ed3f05 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -336,7 +336,7 @@ tlsg_session_accept( tls_session *session ) + } + + static int +-tlsg_session_connect( LDAP *ld, tls_session *session ) ++tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in ) + { + return tlsg_session_accept( session); + } +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 498f805fa1..455b23c0e9 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -548,12 +548,16 @@ tlso_session_new( tls_ctx *ctx, int is_server ) + } + + static int +-tlso_session_connect( LDAP *ld, tls_session *sess ) ++tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + { + tlso_session *s = (tlso_session *)sess; ++ int rc; + ++#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME ++ SSL_set_tlsext_host_name( s, name_in ); ++#endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ +- int rc = SSL_connect( s ) - 1; ++ rc = SSL_connect( s ) - 1; + #ifdef LDAP_USE_NON_BLOCKING_TLS + if ( rc < 0 ) { + int sockerr = sock_errno(); + +From 421c2021c7209bd7cd947ccb8b989bddab7b63cb Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 18:25:10 +0100 +Subject: [PATCH 2/4] ITS#9176 check for numeric addrs before passing SNI + +--- + libraries/libldap/tls2.c | 22 +++++++++++++++++++++- + libraries/libldap/tls_o.c | 4 +++- + 2 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index cbeea8c6c4..85628bc3b3 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -334,6 +334,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + Sockbuf *sb = conn->lconn_sb; + int err; + tls_session *ssl = NULL; ++ char *sni = host; + + if ( HAS_TLS( sb )) { + ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); +@@ -368,7 +369,26 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + } + +- err = tls_imp->ti_session_connect( ld, ssl, host ); ++ /* pass hostname for SNI, but only if it's an actual name ++ * and not a numeric address ++ */ ++ { ++ int numeric = 1; ++ char *c; ++ for ( c = sni; *c; c++ ) { ++ if ( *c == ':' ) /* IPv6 address */ ++ break; ++ if ( *c == '.' ) ++ continue; ++ if ( !isdigit( *c )) { ++ numeric = 0; ++ break; ++ } ++ } ++ if ( numeric ) ++ sni = NULL; ++ } ++ err = tls_imp->ti_session_connect( ld, ssl, sni ); + + #ifdef HAVE_WINSOCK + errno = WSAGetLastError(); +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 455b23c0e9..45948dbc64 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -554,7 +554,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + int rc; + + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME +- SSL_set_tlsext_host_name( s, name_in ); ++ if ( name_in ) { ++ SSL_set_tlsext_host_name( s, name_in ); ++ } + #endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ + rc = SSL_connect( s ) - 1; + +From 05a65a46c684031a841bcc39cf01a82e8cc713a0 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 18:54:02 +0100 +Subject: [PATCH 3/4] ITS#9176 check for failure setting SNI + +--- + libraries/libldap/tls_o.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 45948dbc64..86e86db3b6 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -555,7 +555,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + if ( name_in ) { +- SSL_set_tlsext_host_name( s, name_in ); ++ rc = SSL_set_tlsext_host_name( s, name_in ); ++ if ( !rc ) /* can fail to strdup the name */ ++ return -1; + } + #endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ + +From d059488fa86b58744ad70819516d3bf4a37dbb8e Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Mon, 27 Apr 2020 11:01:01 -0700 +Subject: [PATCH 4/4] ITS#9176 Implement SNI for GnuTLS + +--- + libraries/libldap/tls_g.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 5468ed3f05..5fceb3e935 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -338,6 +338,16 @@ tlsg_session_accept( tls_session *session ) + static int + tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in ) + { ++ tlsg_session *s = (tlsg_session *)session; ++ int rc; ++ ++ if ( name_in ) { ++ rc = gnutls_server_name_set( s->session, GNUTLS_NAME_DNS, name_in, strlen(name_in) ); ++ if ( rc != GNUTLS_E_SUCCESS ) { ++ return rc; ++ } ++ } ++ + return tlsg_session_accept( session); + } + diff --git a/openldap-ai-addrconfig.patch b/openldap-ai-addrconfig.patch index 0858fac..f9a7333 100644 --- a/openldap-ai-addrconfig.patch +++ b/openldap-ai-addrconfig.patch @@ -5,10 +5,10 @@ Upstream ITS: #7326 Resolves: #835013 diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c -index b31e05d..fa361ab 100644 +index 14899cc..b25e750 100644 --- a/libraries/libldap/os-ip.c +++ b/libraries/libldap/os-ip.c -@@ -594,8 +594,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, +@@ -620,8 +620,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, #if defined( HAVE_GETADDRINFO ) && defined( HAVE_INET_NTOP ) memset( &hints, '\0', sizeof(hints) ); diff --git a/openldap-allop-overlay.patch b/openldap-allop-overlay.patch index 608ee44..05a4c6e 100644 --- a/openldap-allop-overlay.patch +++ b/openldap-allop-overlay.patch @@ -4,9 +4,10 @@ Author: Matus Honek Resolves: #1319782 diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in +index b5c3fc8..9aa8a4f 100644 --- a/servers/slapd/overlays/Makefile.in +++ b/servers/slapd/overlays/Makefile.in -@@ -33,7 +33,8 @@ SRCS = overlays.c \ +@@ -38,7 +38,8 @@ SRCS = overlays.c \ translucent.c \ unique.c \ valsort.c \ @@ -16,7 +17,7 @@ diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefil OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ overlays.o -@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) +@@ -58,7 +59,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a @@ -25,7 +26,7 @@ diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefil XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) -@@ -125,6 +126,12 @@ unique.la : unique.lo +@@ -148,6 +149,12 @@ smbk5pwd.lo : smbk5pwd.c smbk5pwd.la : smbk5pwd.lo $(LTLINK_MOD) -module -o $@ smbk5pwd.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) diff --git a/openldap-configure-c99.patch b/openldap-configure-c99.patch new file mode 100644 index 0000000..1a0931a --- /dev/null +++ b/openldap-configure-c99.patch @@ -0,0 +1,906 @@ +commit 14f81bc47a4c462ccc609fce74feb014185e2bf9 +Author: Sam James +Date: Thu Feb 9 23:17:53 2023 +0000 + + ITS#10011 build: fix compatibility with stricter C99 compilers + + Fix the following warnings: + - -Wimplicit-int (fatal with Clang 16) + - -Wimplicit-function-declaration (fatal with Clang 16) + - -Wincompatible-function-pointer-types (fatal with Clang 16) + - -Wint-conversion (fatal with Clang 15) + - Old style prototypes (K&R, removed from C23) + + These warnings-now-error led to misconfigurations and failure to build + OpenLDAP, as the tests used during configure caused the wrong results + to be emitted. + + For more information, see LWN.net [0] or LLVM's Discourse [1], the Gentoo wiki [2], + or the (new) c-std-porting mailing list [3]. + + [0] https://lwn.net/Articles/913505/ + [1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213 + [2] https://wiki.gentoo.org/wiki/Modern_C_porting + [3] hosted at lists.linux.dev. + + Bug: https://bugs.gentoo.org/871288 + Signed-off-by: Sam James + +diff -ur openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 openldap-2.6.4/openldap-2.6.4/build/openldap.m4 +--- openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/build/openldap.m4 2023-04-15 19:21:07.377380382 +0200 +@@ -154,6 +154,7 @@ + if test $ol_cv_header_stdc = yes; then + # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. + AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -303,8 +304,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -360,9 +365,13 @@ + AC_DEFUN([OL_PTHREAD_TEST_PROGRAM], + [AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + OL_PTHREAD_TEST_FUNCTION + } +@@ -484,7 +493,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -511,7 +520,8 @@ + [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +@@ -569,7 +579,7 @@ + ]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no]) + else + AC_RUN_IFELSE([AC_LANG_SOURCE([[ +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure openldap-2.6.4/openldap-2.6.4/configure +--- openldap-2.6.4.orig/openldap-2.6.4/configure 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure 2023-04-15 19:23:17.437078213 +0200 +@@ -14978,6 +14966,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + #include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -15946,6 +15935,10 @@ + else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ ++#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif + int main(int argc, char **argv) + { + int epfd = epoll_create(256); +@@ -16126,7 +16119,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +@@ -16326,7 +16319,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -17559,16 +17552,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17664,8 +17665,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17744,16 +17749,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17854,8 +17867,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17934,16 +17951,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18044,8 +18069,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18124,16 +18153,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18234,8 +18271,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18314,16 +18355,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18424,8 +18473,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18504,16 +18557,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18615,8 +18676,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18695,16 +18760,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18805,8 +18878,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18885,16 +18962,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18996,8 +19081,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19076,16 +19165,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19187,8 +19284,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19267,16 +19368,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19377,8 +19486,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19457,16 +19570,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19568,8 +19689,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19648,16 +19773,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19759,8 +19892,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19839,16 +19976,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19949,8 +20094,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20029,16 +20178,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20139,8 +20296,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20219,16 +20380,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20330,8 +20499,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20410,16 +20583,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20631,14 +20812,12 @@ + /* end confdefs.h. */ + + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif ++pthread_t thread; + + int + main () + { +-pthread_detach(NULL); ++pthread_detach(thread); + ; + return 0; + } +@@ -20752,16 +20931,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20851,6 +21038,9 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -20861,8 +21051,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -20886,9 +21080,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + +@@ -23241,7 +23439,8 @@ + /* end confdefs.h. */ + + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure.ac openldap-2.6.4/openldap-2.6.4/configure.ac +--- openldap-2.6.4.orig/openldap-2.6.4/configure.ac 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure.ac 2023-04-15 19:21:07.377380382 +0200 +@@ -1003,7 +1003,11 @@ + AC_CHECK_HEADERS( sys/epoll.h ) + if test "${ac_cv_header_sys_epoll_h}" = yes; then + AC_MSG_CHECKING(for epoll system call) +- AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv) ++ AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif ++int main(int argc, char **argv) + { + int epfd = epoll_create(256); + exit (epfd == -1 ? 1 : 0); +@@ -1356,10 +1360,10 @@ + dnl pthread_create() in -lpthread (many) + dnl pthread_create() in -lc_r (FreeBSD) + dnl +- dnl Check pthread (draft4) flags (depreciated) ++ dnl Check pthread (draft4) flags (deprecated) + dnl pthread_create() with -threads (OSF/1) + dnl +- dnl Check pthread (draft4) libraries (depreciated) ++ dnl Check pthread (draft4) libraries (deprecated) + dnl pthread_mutex_unlock() in -lpthreads -lmach -lexc -lc_r (OSF/1) + dnl pthread_mutex_lock() in -lpthreads -lmach -lexc (OSF/1) + dnl pthread_mutex_trylock() in -lpthreads -lexc (OSF/1) +@@ -1378,7 +1382,7 @@ + ol_link_threads=posix + ol_link_pthreads="" + fi +- ++ + dnl OL_PTHREAD_TRY([-mt], [ol_cv_pthread_mt]) + OL_PTHREAD_TRY([-kthread], [ol_cv_pthread_kthread]) + OL_PTHREAD_TRY([-pthread], [ol_cv_pthread_pthread]) +@@ -1465,10 +1469,8 @@ + dnl save the flags + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif +-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) ++pthread_t thread; ++]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) + ]) + + if test $ol_cv_func_pthread_detach = no ; then +@@ -1523,6 +1525,9 @@ + AC_CACHE_CHECK([if select yields when using pthreads], + ol_cv_pthread_select_yields,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -1533,8 +1538,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -1558,9 +1567,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + diff --git a/openldap-explicitly-cast-private-values.patch b/openldap-explicitly-cast-private-values.patch new file mode 100644 index 0000000..80daad6 --- /dev/null +++ b/openldap-explicitly-cast-private-values.patch @@ -0,0 +1,70 @@ +From fb9e6a81bbee880549e7ec18f0a74ddddbd2d1ab Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 6 Feb 2024 21:38:24 -0500 +Subject: [PATCH] ITS#10171 - Explicitly cast private values + +Fixes issues with -Werror=incompatible-pointer-types + +Signed-off-by: Stephen Gallagher +--- + servers/slapd/config.c | 2 +- + servers/slapd/overlays/constraint.c | 2 +- + servers/slapd/overlays/dyngroup.c | 2 +- + servers/slapd/overlays/valsort.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index 80333f359c..987c862d91 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -151,7 +151,7 @@ int config_check_vals(ConfigTable *Conf, ConfigArgs *c, int check_only ) { + int rc, arg_user, arg_type, arg_syn, iarg; + unsigned uiarg; + long larg; +- size_t ularg; ++ unsigned long ularg; + ber_len_t barg; + + if(Conf->arg_type == ARG_IGNORED) { +diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c +index f939b37762..0d6156af4d 100644 +--- a/servers/slapd/overlays/constraint.c ++++ b/servers/slapd/overlays/constraint.c +@@ -557,7 +557,7 @@ done:; + a2->restrict_filter = ap.restrict_filter; + a2->restrict_val = ap.restrict_val; + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (constraint **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_next = *app; +diff --git a/servers/slapd/overlays/dyngroup.c b/servers/slapd/overlays/dyngroup.c +index 5d890d6650..e0e70af2d9 100644 +--- a/servers/slapd/overlays/dyngroup.c ++++ b/servers/slapd/overlays/dyngroup.c +@@ -111,7 +111,7 @@ static int dgroup_cf( ConfigArgs *c ) + */ + a2 = ch_malloc( sizeof(adpair) ); + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (adpair **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_mem = ap.ap_mem; +diff --git a/servers/slapd/overlays/valsort.c b/servers/slapd/overlays/valsort.c +index 3d998e2fcb..e251500d0b 100644 +--- a/servers/slapd/overlays/valsort.c ++++ b/servers/slapd/overlays/valsort.c +@@ -201,7 +201,7 @@ valsort_cf_func(ConfigArgs *c) { + return(1); + } + +- for ( vip = &on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) ++ for ( vip = (valsort_info **)&on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) + /* Get to the end */ ; + + vi = ch_malloc( sizeof(valsort_info) ); +-- +GitLab + diff --git a/openldap-ldapi-sasl.patch b/openldap-ldapi-sasl.patch deleted file mode 100644 index 058cc1c..0000000 --- a/openldap-ldapi-sasl.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Tue, 7 May 2013 17:02:57 +0200 -Subject: [PATCH] LDAPI SASL fix - -Resolves: #960222 ---- - libraries/libldap/cyrus.c | 19 ++++++++++++++++--- - 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-) - -diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c -index 28c241b..a9acf36 100644 ---- a/libraries/libldap/cyrus.c -+++ b/libraries/libldap/cyrus.c -@@ -394,6 +394,8 @@ ldap_int_sasl_bind( - struct berval ccred = BER_BVNULL; - int saslrc, rc; - unsigned credlen; -+ char my_hostname[HOST_NAME_MAX + 1]; -+ int free_saslhost = 0; - - Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n", - mechs ? mechs : "", 0, 0 ); -@@ -454,14 +456,25 @@ ldap_int_sasl_bind( - - /* If we don't need to canonicalize just use the host - * from the LDAP URI. -+ * Always use the result of gethostname() for LDAPI. - */ -- if ( nocanon ) -+ if (ld->ld_defconn->lconn_server->lud_scheme != NULL && -+ strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) { -+ rc = gethostname(my_hostname, HOST_NAME_MAX + 1); -+ if (rc == 0) { -+ saslhost = my_hostname; -+ } else { -+ saslhost = "localhost"; -+ } -+ } else if ( nocanon ) - saslhost = ld->ld_defconn->lconn_server->lud_host; -- else -+ else { - saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb, - "localhost" ); -+ free_saslhost = 1; -+ } - rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost ); -- if ( !nocanon ) -+ if ( free_saslhost ) - LDAP_FREE( saslhost ); - } - --- -1.7.11.7 - diff --git a/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch new file mode 100644 index 0000000..3663f3f --- /dev/null +++ b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch @@ -0,0 +1,92 @@ +From 5f4569f0605a73eb1a282ee5251ead073ed3b26e Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Tue, 26 Nov 2024 12:32:07 -0800 +Subject: [PATCH] libldap: avoid SSL context cleanup during library destruction + +Given that libldap can be pulled into random applications and applications +are allowed to call OPENSSL_cleanup() before exiting, the only sane thing +to do is to avoid trying to touch SSL context in ldap destructors, and just +let them leak if the application does not explicitly free the ldap context. + +Add ldap_int_tls_destroy_safe() which skips SSL context cleanup while +maintaining all other cleanup operations, and use it in the library +destructor path. + +Fixes: https://bugs.openldap.org/show_bug.cgi?id=9952 +--- + libraries/libldap/init.c | 2 +- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/tls2.c | 25 +++++++++++++++++++++---- + 3 files changed, 23 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..aa017f4128 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -545,7 +545,7 @@ ldap_int_destroy_global_options(void) + } + #endif + #ifdef HAVE_TLS +- ldap_int_tls_destroy( gopts ); ++ ldap_int_tls_destroy_safe( gopts ); + #endif + } + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..b73097ccc7 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -914,6 +914,7 @@ LDAP_F (int) ldap_int_tls_start LDAP_P(( LDAP *ld, + LDAPConn *conn, LDAPURLDesc *srv )); + + LDAP_F (void) ldap_int_tls_destroy LDAP_P(( struct ldapoptions *lo )); ++LDAP_F (void) ldap_int_tls_destroy_safe LDAP_P(( struct ldapoptions *lo )); + + /* + * in getvalues.c +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 0841005a59..82f8573602 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -97,10 +97,14 @@ tls_ctx_ref( tls_ctx *ctx ) + static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; + #endif + +-void +-ldap_int_tls_destroy( struct ldapoptions *lo ) +-{ +- if ( lo->ldo_tls_ctx ) { ++/* ++ * Implementation function that handles all cleanup. ++ * skip_ctx_cleanup: 1 when called from destructor, 0 for normal operation ++ */ ++static void ++ldap_int_tls_destroy_impl( struct ldapoptions *lo, int skip_ctx_cleanup ) ++ { ++ if ( lo->ldo_tls_ctx && !skip_ctx_cleanup ) { + ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); + lo->ldo_tls_ctx = NULL; + } +@@ -147,6 +151,19 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) + BER_BVZERO( &lo->ldo_tls_pin ); + } + ++ ++void ++ldap_int_tls_destroy( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 0); ++} ++ ++/* Safe version for destructor use */ ++void ldap_int_tls_destroy_safe( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 1); ++} ++ + /* + * Tear down the TLS subsystem. Should only be called once. + */ +-- +2.47.0 + diff --git a/openldap-manpages.patch b/openldap-manpages.patch index b69a391..2303570 100644 --- a/openldap-manpages.patch +++ b/openldap-manpages.patch @@ -1,35 +1,20 @@ Various manual pages changes: * removes LIBEXECDIR from slapd.8 -* removes references to non-existing manpages (bz 624616) -diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 -index 3def6da..466c772 100644 ---- a/doc/man/man1/ldapmodify.1 -+++ b/doc/man/man1/ldapmodify.1 -@@ -397,8 +397,7 @@ exit status and a diagnostic message being written to standard error. - .BR ldap_add_ext (3), - .BR ldap_delete_ext (3), - .BR ldap_modify_ext (3), --.BR ldap_modrdn_ext (3), --.BR ldif (5). -+.BR ldif (5) - .SH AUTHOR - The OpenLDAP Project - .SH ACKNOWLEDGEMENTS diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index cfde143..63592cb 100644 +index d47481d6ed..ff86fc52ca 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -317,6 +317,7 @@ certificates in separate individual files. The +@@ -341,6 +341,7 @@ be specified, separated by a semi-colon. The .B TLS_CACERT is always used before - .B TLS_CACERTDIR. + .BR TLS_CACERTDIR . +The specified directory must be managed with the OpenSSL c_rehash utility. - This parameter is ignored with GnuTLS. - - When using Mozilla NSS, may contain a Mozilla NSS cert/key + .TP + .B TLS_CERT + Specifies the file that contains the client certificate. diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 -index b739f4d..e2a1a00 100644 +index 807634e52d..a06110687b 100644 --- a/doc/man/man8/slapd.8 +++ b/doc/man/man8/slapd.8 @@ -5,7 +5,7 @@ @@ -39,18 +24,18 @@ index b739f4d..e2a1a00 100644 -.B LIBEXECDIR/slapd +.B slapd [\c - .BR \-4 | \-6 ] + .BR \-V [ V [ V ]] [\c -@@ -317,7 +317,7 @@ the LDAP databases defined in the default config file, just type: +@@ -333,7 +333,7 @@ the LDAP databases defined in the default config file, just type: .LP .nf .ft tt - LIBEXECDIR/slapd -+ slapd ++ slapd .ft .fi .LP -@@ -328,7 +328,7 @@ on voluminous debugging which will be printed on standard error, type: +@@ -344,7 +344,7 @@ on voluminous debugging which will be printed on standard error, type: .LP .nf .ft tt @@ -59,7 +44,7 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP -@@ -336,7 +336,7 @@ To test whether the configuration file is correct or not, type: +@@ -352,7 +352,7 @@ To test whether the configuration file is correct or not, type: .LP .nf .ft tt @@ -68,6 +53,3 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP --- -1.8.1.4 - diff --git a/openldap-openssl-ITS7595-Add-EC-support-1.patch b/openldap-openssl-ITS7595-Add-EC-support-1.patch deleted file mode 100644 index 165200d..0000000 --- a/openldap-openssl-ITS7595-Add-EC-support-1.patch +++ /dev/null @@ -1,227 +0,0 @@ -ITS#7595 Add Elliptic Curve support for OpenSSL - -Cherry-picked upstream e631ce808ed56119e61321463d06db7999ba5a08 -Author: Howard Chu -Date: Sat Sep 7 09:47:19 2013 -0700 - -diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 -index 9c72e8296..2311c3096 100644 ---- a/doc/man/man5/slapd-config.5 -+++ b/doc/man/man5/slapd-config.5 -@@ -922,6 +922,13 @@ are not used. - When using Mozilla NSS these parameters are always generated randomly - so this directive is ignored. - .TP -+.B olcTLSECName: -+Specify the name of a curve to use for Elliptic curve Diffie-Hellman -+ephemeral key exchange. This is required to enable ECDHE algorithms in -+OpenSSL. This option is not used with GnuTLS; the curves may be -+chosen in the GnuTLS ciphersuite specification. This option is also -+ignored for Mozilla NSS. -+.TP - .B olcTLSProtocolMin: [.] - Specifies minimum SSL/TLS protocol version that will be negotiated. - If the server doesn't support at least that version, -diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 -index f504adcf9..ef03e0ad8 100644 ---- a/doc/man/man5/slapd.conf.5 -+++ b/doc/man/man5/slapd.conf.5 -@@ -1153,6 +1153,13 @@ are not used. - When using Mozilla NSS these parameters are always generated randomly - so this directive is ignored. - .TP -+.B TLSECName -+Specify the name of a curve to use for Elliptic curve Diffie-Hellman -+ephemeral key exchange. This is required to enable ECDHE algorithms in -+OpenSSL. This option is not used with GnuTLS; the curves may be -+chosen in the GnuTLS ciphersuite specification. This option is also -+ignored for Mozilla NSS. -+.TP - .B TLSProtocolMin [.] - Specifies minimum SSL/TLS protocol version that will be negotiated. - If the server doesn't support at least that version, -diff --git a/include/ldap.h b/include/ldap.h -index c245651c2..0964a193e 100644 ---- a/include/ldap.h -+++ b/include/ldap.h -@@ -158,6 +158,7 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_NEWCTX 0x600f - #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ - #define LDAP_OPT_X_TLS_PACKAGE 0x6011 -+#define LDAP_OPT_X_TLS_ECNAME 0x6012 - #define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY 0x6050 - - #define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED 0 -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h -index 66e04ae80..db7193f4f 100644 ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -165,6 +165,7 @@ struct ldaptls { - char *lt_ciphersuite; - char *lt_crlfile; - char *lt_randfile; /* OpenSSL only */ -+ char *lt_ecname; /* OpenSSL only */ - int lt_protocol_min; - }; - #endif -@@ -250,6 +251,7 @@ struct ldapoptions { - #define ldo_tls_certfile ldo_tls_info.lt_certfile - #define ldo_tls_keyfile ldo_tls_info.lt_keyfile - #define ldo_tls_dhfile ldo_tls_info.lt_dhfile -+#define ldo_tls_ecname ldo_tls_info.lt_ecname - #define ldo_tls_cacertfile ldo_tls_info.lt_cacertfile - #define ldo_tls_cacertdir ldo_tls_info.lt_cacertdir - #define ldo_tls_ciphersuite ldo_tls_info.lt_ciphersuite -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index d25c190ea..0451b01af 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -118,6 +118,10 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) - LDAP_FREE( lo->ldo_tls_dhfile ); - lo->ldo_tls_dhfile = NULL; - } -+ if ( lo->ldo_tls_ecname ) { -+ LDAP_FREE( lo->ldo_tls_ecname ); -+ lo->ldo_tls_ecname = NULL; -+ } - if ( lo->ldo_tls_cacertfile ) { - LDAP_FREE( lo->ldo_tls_cacertfile ); - lo->ldo_tls_cacertfile = NULL; -@@ -232,6 +236,10 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) - lts.lt_dhfile = LDAP_STRDUP( lts.lt_dhfile ); - __atoe( lts.lt_dhfile ); - } -+ if ( lts.lt_ecname ) { -+ lts.lt_ecname = LDAP_STRDUP( lts.lt_ecname ); -+ __atoe( lts.lt_ecname ); -+ } - #endif - lo->ldo_tls_ctx = ti->ti_ctx_new( lo ); - if ( lo->ldo_tls_ctx == NULL ) { -@@ -257,6 +265,7 @@ error_exit: - LDAP_FREE( lts.lt_crlfile ); - LDAP_FREE( lts.lt_cacertdir ); - LDAP_FREE( lts.lt_dhfile ); -+ LDAP_FREE( lts.lt_ecname ); - #endif - return rc; - } -@@ -646,6 +655,10 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) - *(char **)arg = lo->ldo_tls_dhfile ? - LDAP_STRDUP( lo->ldo_tls_dhfile ) : NULL; - break; -+ case LDAP_OPT_X_TLS_ECNAME: -+ *(char **)arg = lo->ldo_tls_ecname ? -+ LDAP_STRDUP( lo->ldo_tls_ecname ) : NULL; -+ break; - case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ - *(char **)arg = lo->ldo_tls_crlfile ? - LDAP_STRDUP( lo->ldo_tls_crlfile ) : NULL; -@@ -765,6 +778,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) - if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile ); - lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; - return 0; -+ case LDAP_OPT_X_TLS_ECNAME: -+ if ( lo->ldo_tls_ecname ) LDAP_FREE( lo->ldo_tls_ecname ); -+ lo->ldo_tls_ecname = arg ? LDAP_STRDUP( (char *) arg ) : NULL; -+ return 0; - case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ - if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile ); - lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index f24060b7e..1370923af 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -373,10 +373,9 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - return -1; - } - -- if ( lo->ldo_tls_dhfile ) { -- DH *dh = NULL; -+ if ( is_server && lo->ldo_tls_dhfile ) { -+ DH *dh; - BIO *bio; -- SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); - - if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) { - Debug( LDAP_DEBUG_ANY, -@@ -395,7 +394,35 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - } - BIO_free( bio ); - SSL_CTX_set_tmp_dh( ctx, dh ); -+ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); -+ DH_free( dh ); -+ } -+ -+#ifdef SSL_OP_SINGLE_ECDH_USE -+ if ( is_server && lo->ldo_tls_ecname ) { -+ EC_KEY *ecdh; -+ -+ int nid = OBJ_sn2nid( lt->lt_ecname ); -+ if ( nid == NID_undef ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not use EC name `%s'.\n", -+ lo->ldo_tls_ecname,0,0); -+ tlso_report_error(); -+ return -1; -+ } -+ ecdh = EC_KEY_new_by_curve_name( nid ); -+ if ( ecdh == NULL ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not generate key for EC name `%s'.\n", -+ lo->ldo_tls_ecname,0,0); -+ tlso_report_error(); -+ return -1; -+ } -+ SSL_CTX_set_tmp_ecdh( ctx, ecdh ); -+ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); -+ EC_KEY_free( ecdh ); - } -+#endif - - if ( tlso_opt_trace ) { - SSL_CTX_set_info_callback( ctx, tlso_info_cb ); -diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c -index 250f14100..8b1e4e582 100644 ---- a/servers/slapd/bconfig.c -+++ b/servers/slapd/bconfig.c -@@ -194,6 +194,7 @@ enum { - CFG_ACL_ADD, - CFG_SYNC_SUBENTRY, - CFG_LTHREADS, -+ CFG_TLS_ECNAME, - - CFG_LAST - }; -@@ -738,6 +739,14 @@ static ConfigTable config_back_cf_table[] = { - #endif - "( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' " - "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, -+ { "TLSECName", NULL, 2, 2, 0, -+#ifdef HAVE_TLS -+ CFG_TLS_ECNAME|ARG_STRING|ARG_MAGIC, &config_tls_option, -+#else -+ ARG_IGNORED, NULL, -+#endif -+ "( OLcfgGlAt:96 NAME 'olcTLSECName' " -+ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, - { "TLSProtocolMin", NULL, 2, 2, 0, - #ifdef HAVE_TLS - CFG_TLS_PROTOCOL_MIN|ARG_STRING|ARG_MAGIC, &config_tls_config, -@@ -819,7 +828,7 @@ static ConfigOCs cf_ocs[] = { - "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ " - "olcTLSCACertificatePath $ olcTLSCertificateFile $ " - "olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ " -- "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ " -+ "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSECName $ " - "olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ " - "olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ " - "olcDitContentRules $ olcLdapSyntaxes ) )", Cft_Global }, -@@ -3824,6 +3833,7 @@ config_tls_option(ConfigArgs *c) { - case CFG_TLS_CA_PATH: flag = LDAP_OPT_X_TLS_CACERTDIR; break; - case CFG_TLS_CA_FILE: flag = LDAP_OPT_X_TLS_CACERTFILE; break; - case CFG_TLS_DH_FILE: flag = LDAP_OPT_X_TLS_DHFILE; break; -+ case CFG_TLS_ECNAME: flag = LDAP_OPT_X_TLS_ECNAME; break; - #ifdef HAVE_GNUTLS - case CFG_TLS_CRL_FILE: flag = LDAP_OPT_X_TLS_CRLFILE; break; - #endif diff --git a/openldap-openssl-ITS7595-Add-EC-support-2.patch b/openldap-openssl-ITS7595-Add-EC-support-2.patch deleted file mode 100644 index 6c28f3f..0000000 --- a/openldap-openssl-ITS7595-Add-EC-support-2.patch +++ /dev/null @@ -1,34 +0,0 @@ -ITS#7595 don't try to use EC if OpenSSL lacks it - -Cherry-picked upstream 721e46fe6695077d63a3df6ea2e397920a72308d -Author: Howard Chu -Date: Sun Sep 8 06:32:23 2013 -0700 - -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index 1a81bc625..71c2b055c 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -321,8 +321,12 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - DH_free( dh ); - } - --#ifdef SSL_OP_SINGLE_ECDH_USE - if ( is_server && lo->ldo_tls_ecname ) { -+#ifdef OPENSSL_NO_EC -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: Elliptic Curves not supported.\n", 0,0,0 ); -+ return -1; -+#else - EC_KEY *ecdh; - - int nid = OBJ_sn2nid( lt->lt_ecname ); -@@ -344,8 +348,8 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - SSL_CTX_set_tmp_ecdh( ctx, ecdh ); - SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); - EC_KEY_free( ecdh ); -- } - #endif -+ } - - if ( tlso_opt_trace ) { - SSL_CTX_set_info_callback( ctx, tlso_info_cb ); diff --git a/openldap-openssl-allow-ssl3.patch b/openldap-openssl-allow-ssl3.patch deleted file mode 100644 index 2a8e56d..0000000 --- a/openldap-openssl-allow-ssl3.patch +++ /dev/null @@ -1,24 +0,0 @@ -Ensure SSLv3 is enabled when necessary - -Either at compilation time, or as a system-wide configuration, OpenSSL -may have disabled SSLv3 protocol by default. This change ensures the -protocol NO flag is cleared when necessary, hence allowing for the -protocol to be used. - -Author: Matus Honek - -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -297,8 +297,10 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - #endif - if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL3 ) - SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 ); -- else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) -+ else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) { - SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 ); -+ SSL_CTX_clear_options( ctx, SSL_OP_NO_SSLv3 ); -+ } - - if ( lo->ldo_tls_ciphersuite && - !SSL_CTX_set_cipher_list( ctx, lt->lt_ciphersuite ) ) diff --git a/openldap-openssl-manpage-defaultCA.patch b/openldap-openssl-manpage-defaultCA.patch index 7ec2caa..e0c7cb7 100644 --- a/openldap-openssl-manpage-defaultCA.patch +++ b/openldap-openssl-manpage-defaultCA.patch @@ -6,9 +6,10 @@ certificates. Author: Matus Honek diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index 6084298..3070bb4 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -307,6 +307,9 @@ are more options you can specify. These options are used when an +@@ -327,6 +327,9 @@ are more options you can specify. These options are used when an .B ldaps:// URI is selected (by default or otherwise) or when the application negotiates TLS by issuing the LDAP StartTLS operation. @@ -19,9 +20,10 @@ diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 .B TLS_CACERT Specifies the file that contains certificates for all of the Certificate diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index a559b0c..adda87a 100644 --- a/doc/man/man5/slapd-config.5 +++ b/doc/man/man5/slapd-config.5 -@@ -801,6 +801,10 @@ If +@@ -878,6 +878,10 @@ If .B slapd is built with support for Transport Layer Security, there are more options you can specify. @@ -33,9 +35,10 @@ diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 .B olcTLSCipherSuite: Permits configuring what ciphers will be accepted and the preference order. diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index b6e9250..1653a1b 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 -@@ -1032,6 +1032,10 @@ If +@@ -1108,6 +1108,10 @@ If .B slapd is built with support for Transport Layer Security, there are more options you can specify. diff --git a/openldap-reentrant-gethostby.patch b/openldap-reentrant-gethostby.patch index 140b6e3..dcb3b73 100644 --- a/openldap-reentrant-gethostby.patch +++ b/openldap-reentrant-gethostby.patch @@ -8,7 +8,7 @@ Resolves: #179730 Author: Jeffery Layton diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c -index 373c81c..a012062 100644 +index aa69f70..4461bf2 100644 --- a/libraries/libldap/util-int.c +++ b/libraries/libldap/util-int.c @@ -52,8 +52,8 @@ extern int h_errno; @@ -22,7 +22,7 @@ index 373c81c..a012062 100644 #else # include -@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) +@@ -442,7 +442,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) #define BUFSTART (1024-32) #define BUFMAX (32*1024-32) diff --git a/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch new file mode 100644 index 0000000..dda0f52 --- /dev/null +++ b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch @@ -0,0 +1,23 @@ +From c7a4bd27f5dcf93806972aab236001f1d4801e80 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Wed, 31 Jan 2024 16:00:30 +0000 +Subject: [PATCH] ITS#10166 slapi: fix plugin.c plugin_pblock_new() usage + +Broken in 9142da8eaf691720f7d6288954250ef085bd3da0 +--- + servers/slapd/slapi/plugin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/servers/slapd/slapi/plugin.c b/servers/slapd/slapi/plugin.c +index ca5dbead59..bfa5c10344 100644 +--- a/servers/slapd/slapi/plugin.c ++++ b/servers/slapd/slapi/plugin.c +@@ -694,7 +694,7 @@ slapi_int_read_config( + int rc; + Slapi_PBlock *pPlugin; + +- pPlugin = plugin_pblock_new( iType, numPluginArgc, c->argv ); ++ pPlugin = plugin_pblock_new( iType, numPluginArgc, c ); + if (pPlugin == NULL) { + return 1; + } diff --git a/openldap-smbk5pwd-overlay.patch b/openldap-smbk5pwd-overlay.patch index 38936cf..e5aaa57 100644 --- a/openldap-smbk5pwd-overlay.patch +++ b/openldap-smbk5pwd-overlay.patch @@ -9,7 +9,7 @@ Author: Jan Vcelak Resolves: #841560 diff --git a/contrib/slapd-modules/smbk5pwd/README b/contrib/slapd-modules/smbk5pwd/README -index f20ad94..b6433ff 100644 +index 4a710a7..0cd4e9e 100644 --- a/contrib/slapd-modules/smbk5pwd/README +++ b/contrib/slapd-modules/smbk5pwd/README @@ -1,3 +1,8 @@ @@ -22,10 +22,10 @@ index f20ad94..b6433ff 100644 PasswordModify Extended Operation to update Kerberos keys and Samba password hashes for an LDAP user. diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in -index 3af20e8..ef73663 100644 +index b84bc54..b5c3fc8 100644 --- a/servers/slapd/overlays/Makefile.in +++ b/servers/slapd/overlays/Makefile.in -@@ -33,7 +33,8 @@ SRCS = overlays.c \ +@@ -37,7 +37,8 @@ SRCS = overlays.c \ syncprov.c \ translucent.c \ unique.c \ @@ -35,7 +35,7 @@ index 3af20e8..ef73663 100644 OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ overlays.o -@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) +@@ -57,7 +58,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a @@ -44,7 +44,7 @@ index 3af20e8..ef73663 100644 XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) -@@ -125,6 +126,12 @@ unique.la : unique.lo +@@ -141,6 +142,12 @@ unique.la : unique.lo valsort.la : valsort.lo $(LTLINK_MOD) -module -o $@ valsort.lo version.lo $(LINK_LIBS) @@ -57,6 +57,3 @@ index 3af20e8..ef73663 100644 install-local: $(PROGRAMS) @if test -n "$?" ; then \ $(MKDIR) $(DESTDIR)$(moduledir); \ --- -1.7.10.4 - diff --git a/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch b/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch index ed4f2ad..0605304 100644 --- a/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch +++ b/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch @@ -6,10 +6,12 @@ Proof of concept for fixing http://bugs.debian.org/327585 (patch ported from freeradius bug http://bugs.debian.org/416266) Resolves: #960048 ---- ---- openldap/servers/slapd/module.c.orig 2010-05-18 17:42:04.000000000 +0200 -+++ openldap/servers/slapd/module.c 2010-05-18 17:45:46.000000000 +0200 -@@ -117,6 +117,20 @@ + +diff --git a/servers/slapd/module.c b/servers/slapd/module.c +index e616f1d..52bacff 100644 +--- a/servers/slapd/module.c ++++ b/servers/slapd/module.c +@@ -117,6 +117,20 @@ int module_unload( const char *file_name ) return -1; /* not found */ } @@ -30,7 +32,7 @@ Resolves: #960048 int module_load(const char* file_name, int argc, char *argv[]) { module_loaded_t *module; -@@ -180,7 +194,7 @@ +@@ -179,7 +193,7 @@ int module_load(const char* file_name, int argc, char *argv[]) * to calling Debug. This is because Debug is a macro that expands * into multiple function calls. */ diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch deleted file mode 100644 index 0987413..0000000 --- a/openldap-tlsmc.patch +++ /dev/null @@ -1,1816 +0,0 @@ -MozNSS Interception Code - -Author: Matus Honek -Date: Wed Jul 4 10:35:04 CEST 2018 -diff --git a/configure.in b/configure.in ---- a/configure.in -+++ b/configure.in -@@ -237,6 +237,7 @@ dnl OL_ARG_ENABLE(referrals,[ --enable-referrals enable LDAPv2+ Referrals (ex - ol_enable_referrals=${ol_enable_referrals-no} - OL_ARG_ENABLE(ipv6,[ --enable-ipv6 enable IPv6 support], auto)dnl - OL_ARG_ENABLE(local,[ --enable-local enable AF_LOCAL (AF_UNIX) socket support], auto)dnl -+OL_ARG_ENABLE(moznss_compatibility,[ --enable-moznss-compatibility enable MozNSS compatibility], no)dnl - - dnl ---------------------------------------------------------------- - dnl General "with" options -@@ -1256,6 +1257,26 @@ if test $ol_link_tls = no ; then - fi - fi - -+if test $ol_enable_moznss_compatibility = yes ; then -+ if test $have_openssl = yes ; then -+ if test $ol_with_tls = openssl ; then -+ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss_libs=yes], [have_moznss_libs=no]) -+ if test $have_moznss_libs = yes ; then -+ AC_DEFINE(HAVE_MOZNSS_COMPATIBILITY, 1, -+ [define if you want to support MozNSS databases when compiled with OpenSSL]) -+ TLS_LIBS="$TLS_LIBS $MOZNSS_LIBS" -+ CFLAGS="$CFLAGS $MOZNSS_CFLAGS" -+ else -+ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have MozNSS present.]) -+ fi -+ else -+ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to compile with OpenSSL for crypto. (see --with-tls flag)]) -+ fi -+ else -+ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have OpenSSL devel available. (unable to build with OpenSSL)]) -+ fi -+fi -+ - WITH_TLS=no - if test $ol_link_tls = yes ; then - AC_DEFINE(HAVE_TLS, 1, [define if you have TLS]) -diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 ---- a/doc/man/man3/ldap_get_option.3 -+++ b/doc/man/man3/ldap_get_option.3 -@@ -772,6 +772,19 @@ must be - When using the OpenSSL library this is an SSL*. When using other - crypto libraries this is a pointer to an OpenLDAP private structure. - Applications generally should not use this option. -+.TP -+.B LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY -+Sets/gets the status of the MozNSS database compatibility layer for TLS options. This options is available only if OpenLDAP is compiled with OpenSSL. This has effect only before the TLS context is established. -+This option defaults to be on. -+.BR invalue -+should either be -+.BR LDAP_OPT_OFF -+or -+.BR LDAP_OPT_ON ; -+.BR outvalue -+must be -+.BR "int *" . -+When set, just before TLS context initialization the library will first check if TLS settings are MozNSS-specific and if so it will export certificates from a preconfigured database and set other TLS settings so that OpenSSL can continue without issues. - .SH ERRORS - On success, the functions return - .BR LDAP_OPT_SUCCESS , -diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 ---- a/doc/man/man5/ldap.conf.5 -+++ b/doc/man/man5/ldap.conf.5 -@@ -483,6 +483,11 @@ Check the CRL for a whole certificate chain - Specifies the file containing a Certificate Revocation List to be used - to verify if the server certificates have not been revoked. This - parameter is only supported with GnuTLS and Mozilla NSS. -+.RE -+.TP -+.B TLS_MOZNSS_COMPATIBILITY -+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. -+This option defaults to be on. - .SH "ENVIRONMENT VARIABLES" - .TP - LDAPNOINIT -diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 ---- a/doc/man/man5/slapd-config.5 -+++ b/doc/man/man5/slapd-config.5 -@@ -1004,6 +1004,11 @@ Check the CRL for a whole certificate chain - Specifies a file containing a Certificate Revocation List to be used - for verifying that certificates have not been revoked. This parameter - is only valid when using GnuTLS or Mozilla NSS. -+.RE -+.TP -+.B olcTLSMozNSSCompatibility -+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. -+This option defaults to be on. - .SH DYNAMIC MODULE OPTIONS - If - .B slapd -diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 ---- a/doc/man/man5/slapd.conf.5 -+++ b/doc/man/man5/slapd.conf.5 -@@ -1235,6 +1235,11 @@ Check the CRL for a whole certificate chain - Specifies a file containing a Certificate Revocation List to be used - for verifying that certificates have not been revoked. This directive is - only valid when using GnuTLS and Mozilla NSS. -+.RE -+.TP -+.B TLSMozNSSCompatibility -+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. -+This option defaults to be on. - .SH GENERAL BACKEND OPTIONS - Options in this section only apply to the configuration file section - for the specified backend. They are supported by every -diff --git a/include/ldap.h b/include/ldap.h ---- a/include/ldap.h -+++ b/include/ldap.h -@@ -158,6 +158,10 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_NEWCTX 0x600f - #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ - #define LDAP_OPT_X_TLS_PACKAGE 0x6011 -+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY 0x6050 -+ -+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED 0 -+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED 1 - - #define LDAP_OPT_X_TLS_NEVER 0 - #define LDAP_OPT_X_TLS_HARD 1 -diff --git a/libraries/libldap/Makefile.in b/libraries/libldap/Makefile.in ---- a/libraries/libldap/Makefile.in -+++ b/libraries/libldap/Makefile.in -@@ -26,7 +26,7 @@ SRCS = bind.c open.c result.c error.c compare.c search.c \ - request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \ - init.c options.c print.c string.c util-int.c schema.c \ - charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ -- tls2.c tls_o.c tls_g.c tls_m.c \ -+ tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \ - turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ - assertion.c deref.c ldif.c fetch.c - -@@ -39,7 +39,7 @@ OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \ - request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \ - init.lo options.lo print.lo string.lo util-int.lo schema.lo \ - charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ -- tls2.lo tls_o.lo tls_g.lo tls_m.lo \ -+ tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \ - turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ - assertion.lo deref.lo ldif.lo fetch.lo - -diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c ---- a/libraries/libldap/init.c -+++ b/libraries/libldap/init.c -@@ -137,7 +137,9 @@ static const struct ol_attribute { - #ifdef HAVE_GNUTLS - {0, ATTR_TLS, "TLS_CRLFILE", NULL, LDAP_OPT_X_TLS_CRLFILE}, - #endif -- -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ {0, ATTR_TLS, "TLS_MOZNSS_COMPATIBILITY", NULL, LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY}, -+#endif - #endif - - {0, ATTR_NONE, NULL, NULL, 0} -@@ -582,6 +584,9 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl - gopts->ldo_tls_connect_cb = NULL; - gopts->ldo_tls_connect_arg = NULL; - gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND; -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ gopts->ldo_tls_moznss_compatibility = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED; -+#endif - #endif - gopts->ldo_keepalive_probes = 0; - gopts->ldo_keepalive_interval = 0; -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -260,7 +260,8 @@ struct ldapoptions { - int ldo_tls_require_cert; - int ldo_tls_impl; - int ldo_tls_crlcheck; --#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0 -+ int ldo_tls_moznss_compatibility; -+#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0,0 - #else - #define LDAP_LDO_TLS_NULLARG - #endif -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -37,6 +37,8 @@ - - #include "ldap-tls.h" - -+#include "tls_mc.h" -+ - static tls_impl *tls_imp = &ldap_int_tls_impl; - #define HAS_TLS( sb ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \ - (void *)tls_imp->ti_sbio ) -@@ -96,6 +98,7 @@ tls_ctx_ref( tls_ctx *ctx ) - * an extra mutex for the default ctx. - */ - static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; -+ldap_pvt_thread_mutex_t tlsmc_mutex; - #endif - - void -@@ -161,6 +164,7 @@ tls_init(tls_impl *impl ) - if ( !tls_initialized++ ) { - #ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_init( &tls_def_ctx_mutex ); -+ ldap_pvt_thread_mutex_init( &tlsmc_mutex ); - #endif - } - -@@ -196,6 +200,27 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) - - tls_init( ti ); - -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ if ( LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED == lo->ldo_tls_moznss_compatibility ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLSMC: MozNSS compatibility interception begins.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_intercept_initialization( lo, is_server ) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "TLSMC: ERROR: MozNSS compatibility layer failed.\n", -+ 0, 0, 0 ); -+ } -+ lts = lo->ldo_tls_info; -+ Debug( LDAP_DEBUG_ANY, -+ "TLSMC: MozNSS compatibility interception ends.\n", -+ 0, 0, 0 ); -+ } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "TLS: MozNSS compatibility layer disabled.\n", -+ 0, 0, 0 ); -+ } -+#endif -+ - if ( is_server && !lts.lt_certfile && !lts.lt_keyfile && - !lts.lt_cacertfile && !lts.lt_cacertdir ) { - /* minimum configuration not provided */ -@@ -572,6 +597,21 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) - return ldap_pvt_tls_set_option( ld, option, &i ); - } - return -1; -+#endif -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: -+ i = -1; -+ if ( (strcasecmp( arg, "yes" ) == 0) || -+ (strcasecmp( arg, "true" ) == 0) || -+ (strcasecmp( arg, "on" ) == 0) ) { -+ i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED; -+ } -+ if ( (strcasecmp( arg, "no" ) == 0) || -+ (strcasecmp( arg, "false" ) == 0) || -+ (strcasecmp( arg, "off" ) == 0) ) { -+ i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED; -+ } -+ return ldap_pvt_tls_set_option( ld, option, &i ); - #endif - } - return -1; -@@ -675,6 +715,9 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) - case LDAP_OPT_X_TLS_CONNECT_ARG: - *(void **)arg = lo->ldo_tls_connect_arg; - break; -+ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: -+ *(int *)arg = lo->ldo_tls_moznss_compatibility; -+ break; - default: - return -1; - } -@@ -802,6 +845,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) - ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); - lo->ldo_tls_ctx = NULL; - return ldap_int_tls_init_ctx( lo, *(int *)arg ); -+ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: -+ if ( !arg ) return -1; -+ lo->ldo_tls_moznss_compatibility = *(int *)arg; -+ break; - default: - return -1; - } -diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1369 @@ -+#include "portable.h" -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+ -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "ldap-int.h" -+#include "ldap-tls.h" -+#include "ldap_pvt_thread.h" -+ -+#include "tls_mc.h" -+#include "tls_mc_ossl.h" -+ -+#define TLSMC_CHECKSUM_LEN 32 -+ -+#define TLSMC_CACERTS_DIR_NAME "cacerts" -+#define TLSMC_CERT_FILE_NAME "cert.pem" -+#define TLSMC_KEY_FILE_NAME "key.pem" -+#define TLSMC_README_FILE_NAME "README" -+ -+#define TLSM_CERTDB_DESC "ldap" -+#define DEFAULT_TOKEN_NAME "default" -+ -+#define TLSMC_IS_INPLACE 1 -+#define TLSMC_IS_TEMPORARY 2 -+ -+#define DONOTEDIT \ -+ "This file is auto-generated by the MozNSS Compatibility Layer of OpenLDAP software.\n" \ -+ "This layer is not part of the OpenLDAP software distributed in upstream.\n" \ -+ "Please file any related bugs with your GNU/Linux distribution.\n" \ -+ "Do not edit contents of this directory structure directly. Rather, change your configuration to use the OpenSSL-style TLS options, so that this directory structure does not need to be generated anymore.\n" \ -+ "Please refer to the slapd.conf(5), slapd-config(5), and ldap.conf(5) man pages for more information." -+#define PEM_CERT_HEADER "-----BEGIN CERTIFICATE-----" -+#define PEM_CERT_FOOTER "-----END CERTIFICATE-----" -+#define PEM_KEY_HEADER "-----BEGIN PRIVATE KEY-----" -+#define PEM_KEY_FOOTER "-----END PRIVATE KEY-----" -+#define README_HEADER "The contents of this file are hashed and used as part of the name of the parent directory.\n" -+ -+#ifdef LDAP_R_COMPILE -+ldap_pvt_thread_mutex_t tlsmc_mutex; -+#endif -+/*******************************************************************/ -+ -+ -+char * -+tlsmc_path2name( char *path ) -+{ -+ if ( NULL == path ) return NULL; -+ char *last_slash = strrchr( path, '/' ); -+ if ( NULL == last_slash ) -+ return path; -+ else -+ return last_slash + 1; -+} -+ -+ -+int -+tlsmc_write_file( char *filename, char *buf, mode_t final_mode ) -+{ -+ int rv = 0; -+ int fd = -1; -+ if ( 0 > ( fd = open( filename, O_WRONLY | O_CREAT | O_EXCL, S_IWUSR ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not open file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( -1 >= write( fd, buf, strlen(buf) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not write file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( -1 >= fchmod( fd, final_mode ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not set file mode: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( -1 >= fsync( fd ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not fsync file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( 0 > close( fd ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not close file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ fd = -1; -+ goto bail; -+ } -+ fd = -1; -+ rv = 1; -+bail: -+ if ( fd > -1 ) close( fd ); -+ return rv; -+} -+ -+ -+static int -+tlsmc_remove_dir_recursively( const char *dir_name ) -+{ -+ int rv = 0; -+ DIR *dir = NULL; -+ struct dirent *entry = NULL; -+ char *full_path = NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: starting recursively removing directory `%s'.\n", -+ dir_name, 0, 0 ); -+ if ( NULL == ( dir = opendir( dir_name ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not open the directory (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail; -+ } -+ -+ while ( NULL != ( entry = readdir( dir ) ) ) { -+ struct stat info; -+ -+ full_path = NULL; -+ full_path = PR_smprintf( "%s/%s", dir_name, entry->d_name ); -+ -+ if ( 0 != strcmp( entry->d_name, "." ) && 0 != strcmp( entry->d_name, ".." ) ) { -+ if ( 0 == lstat( full_path, &info ) ) { -+ if ( S_ISDIR( info.st_mode ) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: stepping into directory `%s'.\n", -+ entry->d_name, 0, 0 ); -+ if ( 0 == tlsmc_remove_dir_recursively( full_path ) ) { -+ goto bail_and_close_dir; -+ } -+ } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: removing file `%s'.\n", -+ entry->d_name, 0, 0 ); -+ if ( 0 != remove( full_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not remove the file (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail_and_close_dir; -+ } -+ } -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not stat `%s', (errno %d: %s).\n", -+ full_path, errno, strerror( errno ) ); -+ goto bail_and_close_dir; -+ } -+ } -+ -+ if ( full_path ) { -+ PR_smprintf_free( full_path ); -+ full_path = NULL; -+ } -+ -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: stepping out of the directory.\n", -+ 0, 0, 0 ); -+ if ( 0 != closedir( dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: WARN: could not close the directory (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: removing the directory itself.\n", -+ 0, 0, 0 ); -+ if ( 0 != remove( dir_name ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not remove the directory (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+ goto bail; -+bail_and_close_dir: -+ closedir( dir ); -+bail: -+ if ( full_path ) PR_smprintf_free( full_path ); -+ return rv; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+static void -+tlsmc_get_certdb_prefix( const char *certdir, char **nsscertdir, char **realcertdir, char **prefix ) -+{ -+ char sep = PR_GetDirectorySeparator(); -+ char *ptr = NULL; -+ char *chkpath = NULL; -+ struct PRFileInfo prfi; -+ PRStatus prc; -+ -+ *realcertdir = (char *)certdir; /* default is the one passed in */ -+ -+ /* if certdir is not given, just return */ -+ if ( !certdir ) return; -+ -+ *nsscertdir = certdir; -+ -+ /* ignore database type prefix (e.g. sql:, dbm:) if provided */ -+ if ( NULL != ( chkpath = strchr( certdir, ':' ) ) ) { -+ *realcertdir = chkpath + 1; -+ } -+ -+ /* if certdir exists (file or directory) then it cannot specify a prefix */ -+ prc = PR_GetFileInfo( *realcertdir, &prfi ); -+ if ( prc == PR_SUCCESS ) { -+ goto finish; -+ } -+ -+ /* if certdir was given, and there is a '/' in certdir, see if there -+ is anything after the last '/' - if so, assume it is the prefix */ -+ /* if ( ( ( ptr = strrchr( *realcertdir, sep ) ) ) && *(ptr + 1) ) { */ -+ /* *realcertdir = PL_strndup( *realcertdir, ptr - (*realcertdir) ); */ -+ /* *prefix = PL_strdup( ptr + 1 ); */ -+ /* } */ -+ -+ -+ if ( ptr = strrchr( *realcertdir, sep ) ) { -+ if ( *(ptr + 1) ) { -+ *ptr = '\0'; -+ *prefix = ptr + 1; -+ } else { -+ *prefix = *realcertdir + strlen( *realcertdir ); // empty string -+ } -+ } else { -+ *prefix = *realcertdir; -+ *realcertdir = *prefix + strlen( *prefix ); // empty string -+ } -+finish: -+ /* drop potential last '/' from realcertdir */ -+ do { -+ ptr = strrchr( *realcertdir, sep ); -+ if ( ptr && (! *(ptr+1) ) ) { -+ *ptr = '\0'; -+ } else { -+ break; -+ } -+ } while (1); -+ -+ return; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+static char * -+tlsmc_get_pin_from_file(const char *token_name, char *filename) -+{ -+ char *pwdstr = NULL; -+ char *contents = NULL; -+ char *lasts = NULL; -+ char *line = NULL; -+ char *candidate = NULL; -+ PRFileInfo file_info; -+ PRFileDesc *pwd_fileptr = NULL; -+ pwd_fileptr = PR_Open( filename, PR_RDONLY, 00400 ); -+ -+ /* open the password file */ -+ if ( !pwd_fileptr ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not open security pin file %s - error %d:%s.\n", -+ filename, errcode, -+ PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* get the file size */ -+ if ( PR_SUCCESS != PR_GetFileInfo( filename, &file_info ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not get file info from pin file %s - error %d:%s.\n", -+ filename, errcode, -+ PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* create a buffer to hold the file contents */ -+ if ( !( contents = PR_CALLOC( file_info.size + 1 ) ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not alloc a buffer for contents of pin file %s - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* read file into the buffer */ -+ if( PR_Read( pwd_fileptr, contents, file_info.size ) <= 0 ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not read the file contents from pin file %s - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* format is [tokenname:]password EOL [tokenname:]password EOL ... */ -+ /* if you want to use a password containing a colon character, use -+ the special tokenname "default" */ -+ for ( line = PL_strtok_r( contents, "\r\n", &lasts ); line; -+ line = PL_strtok_r( NULL, "\r\n", &lasts ) ) { -+ char *colon; -+ -+ if ( !*line ) { -+ continue; /* skip blank lines */ -+ } -+ colon = PL_strchr( line, ':' ); -+ if ( colon ) { -+ if ( *(colon + 1) && token_name && -+ !PL_strncmp( token_name, line, colon-line ) ) { -+ candidate = colon + 1; /* found a definite match */ -+ break; -+ } else if ( !PL_strncmp( DEFAULT_TOKEN_NAME, line, colon-line ) ) { -+ candidate = colon + 1; /* found possible match */ -+ } -+ } else { /* no token name */ -+ candidate = line; -+ } -+ } -+done: -+ if ( pwd_fileptr ) { -+ PR_Close( pwd_fileptr ); -+ } -+ if ( candidate ) { -+ pwdstr = PL_strdup( candidate ); -+ } -+ PL_strfree( contents ); -+ -+ return pwdstr; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+/* -+ * Turn the echoing off on a tty. -+ */ -+static void -+echoOff(int fd) -+{ -+ if ( isatty( fd ) ) { -+ struct termios tio; -+ tcgetattr( fd, &tio ); -+ tio.c_lflag &= ~ECHO; -+ tcsetattr( fd, TCSAFLUSH, &tio ); -+ } -+} -+ -+/* BORROWED FROM tls_m.c */ -+/* -+ * Turn the echoing on on a tty. -+ */ -+static void -+echoOn(int fd) -+{ -+ if ( isatty( fd ) ) { -+ struct termios tio; -+ tcgetattr( fd, &tio ); -+ tio.c_lflag |= ECHO; -+ tcsetattr( fd, TCSAFLUSH, &tio ); -+ tcsetattr( fd, TCSAFLUSH, &tio ); -+ } -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+char * -+tlsmc_get_pin( PK11SlotInfo *slot, PRBool retry, void * filename) -+{ -+ char *token_name = NULL; -+ char *pwdstr = NULL; -+ -+ token_name = PK11_GetTokenName( slot ); -+ /* Try to get the passwords from the password file if it exists. -+ * THIS IS UNSAFE and is provided for convenience only. Without this -+ * capability the server would have to be started in foreground mode -+ * if using an encrypted key. -+ */ -+ if ( filename ) { -+ fprintf( stderr, -+ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n"); -+ pwdstr = tlsmc_get_pin_from_file( token_name, (char *)filename ); -+ if ( retry && pwdstr != NULL ) -+ return NULL; -+ } -+ if ( !pwdstr ) { -+ int infd = PR_FileDesc2NativeHandle( PR_STDIN ); -+ int isTTY = isatty( infd ); -+ unsigned char phrase[200]; -+ /* Prompt for password */ -+ if ( isTTY ) { -+ fprintf( stderr, -+ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n"); -+ fprintf( stdout, -+ "Please enter pin, password, or pass phrase for security token '%s': ", -+ token_name ? token_name : DEFAULT_TOKEN_NAME ); -+ echoOff( infd ); -+ } -+ fgets( (char*)phrase, sizeof(phrase), stdin ); -+ if ( isTTY ) { -+ fprintf( stdout, "\n" ); -+ echoOn( infd ); -+ } -+ /* stomp on newline */ -+ phrase[strlen((char*)phrase)-1] = 0; -+ -+ pwdstr = PL_strdup( (char*)phrase ); -+ } -+ -+ return pwdstr; -+} -+ -+ -+int -+tlsmc_hash( char **dest, const char *src ) -+{ -+ int rv = 0; -+ unsigned char fp[SHA256_LENGTH]; -+ SECItem fpItem; -+ -+ if ( SECSuccess != ( rv = PK11_HashBuf( SEC_OID_SHA256, fp, src, strlen(src) ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_hash: could not hash a buffer", -+ NULL, NULL, NULL ); -+ goto bail; -+ } -+ fpItem.data = fp; -+ fpItem.len = SHA256_LENGTH; -+ if ( NULL == ( *dest = CERT_Hexify( &fpItem, 0 ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_hash: could not hexify the hash", -+ NULL, NULL, NULL ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ return rv; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+int -+tlsmc_open_nssdb( char *ld_cacertdir, NSSInitContext **out_initctx, char **out_nssdb_dir, char **out_nssdb_prefix ) -+{ -+#define SECURITYDIRS_COUNT 3 -+ int rc = 0; -+ PRErrorCode errcode = 1; -+ -+ /* restart secmod modules */ -+#ifdef HAVE_SECMOD_RESTARTMODULES -+ /* NSS enforces the pkcs11 requirement that modules should be unloaded after -+ a fork() - since there is no portable way to determine if NSS has been -+ already initialized in a parent process, we just call SECMOD_RestartModules -+ with force == FALSE - if the module has been unloaded due to a fork, it will -+ be reloaded, otherwise, it is a no-op */ -+ if ( 0 == ( rc = SECMOD_RestartModules(PR_FALSE /* do not force */) ) ) { -+ errcode = PORT_GetError(); -+ if ( errcode != SEC_ERROR_NOT_INITIALIZED ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_open_nssdb: WARN: could not restart the security modules: %d:%s.\n", -+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); -+ } else { -+ errcode = 1; -+ } -+ } -+#endif -+ -+ -+ /* context and certdb */ -+ char *dir_moznss = PR_GetEnv( "MOZNSS_DIR" ); -+ char *dir_default_moznss = PR_GetEnv( "DEFAULT_MOZNSS_DIR" ); -+ const char *securitydirs[SECURITYDIRS_COUNT] = { dir_moznss, ld_cacertdir, dir_default_moznss }; -+ int done = 0; -+ int ii = 0; -+ for ( ii = 0; !done && ( ii < SECURITYDIRS_COUNT ); ++ii ) { -+ // get certdb prefix -+ const char *securitydir = securitydirs[ii]; -+ char *nsscertdir = NULL; -+ char *realcertdir = NULL; -+ const char *defprefix = ""; -+ char *prefix = (char *)defprefix; -+ if ( securitydir == NULL ) continue; -+ tlsmc_get_certdb_prefix( securitydir, &nsscertdir, &realcertdir, &prefix ); -+ *out_nssdb_dir = strdup( realcertdir ); -+ *out_nssdb_prefix = strdup( prefix ); -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_open_nssdb: INFO: trying to initialize moznss using security dir `%s` prefix `%s`.\n", -+ nsscertdir, prefix, NULL); -+ -+ // init context -+ NSSInitContext *initctx = NULL; -+ NSSInitParameters initparams; -+ memset( &initparams, 0, sizeof( initparams ) ); -+ initparams.length = sizeof( initparams ); -+ -+ initctx = NSS_InitContext( nsscertdir, -+ prefix, -+ prefix, -+ SECMOD_DB, -+ &initparams, -+ NSS_INIT_READONLY // | NSS_INIT_NOCERTDB -+ ); -+ rc = initctx ? 1 : 0; -+ -+ *out_initctx = initctx; -+ -+ if ( rc != 1 ) { -+ errcode = PORT_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_open_nssdb: WARN: could not initialize MozNSS context - error %d.\n", -+ errcode, 0, 0 ); -+ } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_open_nssdb: INFO: initialized MozNSS context.\n", -+ 0, 0, 0 ); -+ errcode = 0; -+ done = 1; -+ } -+ } -+ -+ PR_Free( dir_moznss ); -+ PR_Free( dir_default_moznss ); -+ -+ PK11_SetPasswordFunc( tlsmc_get_pin ); -+ -+ if ( done && (errcode == 0) && out_initctx ) { -+ return 1; -+ } else { -+ return 0; -+ } -+} -+ -+ -+int -+tlsmc_filestamp( char **filestamp, char *path ) -+{ -+ int rv = 0; -+ struct stat attr; -+ char stime[20]; -+ -+ if ( 0 != stat( path, &attr ) ) { -+ rv = -1; -+ goto bail; -+ } -+ if ( 0 == strftime(stime, sizeof(stime), "%FT%T", localtime(&attr.st_mtime)) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_filestamp: ERROR: could not format mtime: %s.\n", -+ strerror(errno), 0, 0 ); -+ goto bail; -+ } -+ -+ *filestamp = PR_smprintf("mtime %s.%d, size %lld", -+ stime, attr.st_mtim.tv_nsec, (long long) attr.st_size); -+ -+ rv = 1; -+bail: -+ return rv; -+} -+ -+ -+char * -+tlsmc_compute_checksum( char *nssdb_dir, char *nssdb_prefix, -+ char *ld_cacertdir, char *ld_cert, char *ld_key, -+ char **out_data) -+{ -+ int rv = 0; -+ char *data = NULL; -+ char *checksum = NULL; -+ -+ /* gather data */ -+ data = PR_sprintf_append( data, -+ DONOTEDIT "\n" -+ README_HEADER "\n" -+ "PARAMETERS:\n" -+ "nssdb_dir: %s\n" -+ "nssdb_prefix: %s\n" -+ "ld_cacertdir: %s\n" -+ "ld_cert: %s\n" -+ "ld_key: %s\n" -+ "euid: %d\n\n" -+ "FILES:\n", -+ nssdb_dir, nssdb_prefix, ld_cacertdir, ld_cert, ld_key, geteuid() ); -+ -+ char *files[] = { "cert8.db", "cert9.db", "key3.db", "key4.db", "secmod.db", NULL }; -+ char **filep = NULL; -+ for ( filep = files; NULL != *filep; filep++ ) { -+ char *filestamp = NULL; -+ char *path = NULL; -+ path = PR_smprintf( "%s/%s%s", nssdb_dir, nssdb_prefix, *filep ); -+ if ( 0 == tlsmc_filestamp( &filestamp, path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_compute_checksum: INFO: could not check file `%s'.\n", -+ path, 0, 0 ); -+ rv = -1; -+ } else { -+ data = PR_sprintf_append( data, "%s: %s\n", *filep, filestamp ); -+ } -+ if ( filestamp ) PR_smprintf_free( filestamp ); -+ if ( path ) PR_smprintf_free( path ); -+ if ( -1 == rv ) goto bail; -+ } -+ -+ /* compute data checksum */ -+ if ( 1 != tlsmc_hash( &checksum, (const char*) data ) ) { -+ checksum = NULL; -+ goto bail; -+ } -+ -+ /* possibly supply data */ -+ if ( out_data ) { -+ *out_data = strdup( data ); -+ } -+ -+ /* return checksum */ -+bail: -+ if ( data ) PR_smprintf_free( data ); -+ return checksum; -+} -+ -+ -+int -+tlsmc_prepare_dir( char *dir ) -+{ -+ int rv = 0; -+ char *cacerts_dir = NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_prepare_dir: INFO: preparing PEM directory `%s'.\n", -+ dir, 0, 0 ); -+ -+ if ( 0 != mkdir( dir, S_IRWXU /* u+rwx */ ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_prepare_dir: WARN: could not create the PEM directory.\n", -+ 0, 0, 0 ); -+ rv = 0; -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_prepare_dir: INFO: creating a subdirectory `%s'.\n", -+ TLSMC_CACERTS_DIR_NAME, 0, 0 ); -+ cacerts_dir = PR_smprintf( "%s/%s", dir, TLSMC_CACERTS_DIR_NAME ); -+ if ( 0 != mkdir( cacerts_dir, S_IRWXU /* u+rwx */ ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_prepare_dir: WARN: could not create the subdirectory.\n", -+ 0, 0, 0 ); -+ rv = 0; -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_prepare_dir: INFO: successfully created PEM directory structure.\n", -+ TLSMC_CACERTS_DIR_NAME, 0, 0 ); -+ rv = 1; -+ -+bail: -+ if ( cacerts_dir ) PR_smprintf_free( cacerts_dir ); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_cert_to_file(CERTCertDBHandle *certdb_handle, CERTCertificate *cert, char *file_path) -+{ -+ int rv = 0; -+ SECItem data; -+ char *b64 = NULL; -+ char *output = NULL; -+ -+ if ( ! cert ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_to_file: ERROR: cert empty.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ data.data = cert->derCert.data; -+ data.len = cert->derCert.len; -+ b64 = BTOA_DataToAscii(data.data, data.len); -+ if ( ! b64 ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_to_file: ERROR: could not base64 encode.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ output = PR_smprintf( DONOTEDIT "\n\n" -+ "NSS nickname: %s\n" -+ "Issuer: %s\n" -+ "Subject: %s\n" -+ PEM_CERT_HEADER "\n" -+ "%s\n" -+ PEM_CERT_FOOTER "\n", -+ cert->nickname, -+ cert->issuerName, -+ cert->subjectName, -+ b64 ); -+ -+ if ( 0 == tlsmc_write_file( file_path, output, S_IRUSR ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_to_file: ERROR: could not write certificate.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ if ( output ) PR_smprintf_free( output ); -+ if ( b64 ) PORT_Free( b64 ); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_decrypt_key(SECKEYEncryptedPrivateKeyInfo *epki, -+ SECOidTag algTag, -+ SECItem *pwitem, -+ void *pin_arg, -+ SECItem *derPKI) -+{ -+ SECItem *cryptoParam = NULL; -+ PK11SymKey *symKey = NULL; -+ PK11Context *ctx = NULL; -+ int rv = 0; -+ -+ if (!pwitem) return rv; -+ -+ do { -+ SECAlgorithmID algid = epki->algorithm; -+ CK_MECHANISM_TYPE cryptoMechType; -+ CK_ATTRIBUTE_TYPE operation = CKA_DECRYPT; -+ PK11SlotInfo *slot = NULL; -+ -+ cryptoMechType = PK11_GetPBECryptoMechanism(&algid, &cryptoParam, pwitem); -+ if (cryptoMechType == CKM_INVALID_MECHANISM) { -+ goto bail; -+ } -+ -+ if ( NULL == ( slot = PK11_GetBestSlot(cryptoMechType, NULL) ) ) { -+ goto bail; -+ } -+ -+ if ( NULL == ( symKey = PK11_PBEKeyGen(slot, &algid, pwitem, PR_FALSE, pin_arg) ) ) { -+ rv = -1; -+ goto bail_one; -+ } -+ -+ if ( NULL == ( ctx = PK11_CreateContextBySymKey( -+ cryptoMechType, operation, symKey, cryptoParam) ) ) { -+ rv = -1; -+ goto bail_one; -+ } -+ -+ if ( SECSuccess != PK11_CipherOp(ctx, -+ derPKI->data, /* out */ -+ (int *)(&derPKI->len), /* out len */ -+ (int)epki->encryptedData.len, /* max out */ -+ epki->encryptedData.data, /* in */ -+ (int)epki->encryptedData.len /* in len */ ) ) { -+ rv = -1; -+ goto bail_one; -+ } -+ -+ if ( derPKI->len != epki->encryptedData.len ) goto bail_one; -+ if ( SECSuccess != PK11_Finalize(ctx) ) goto bail_one; -+ bail_one: -+ if (slot) PK11_FreeSlot(slot); -+ } while (0); -+ -+ rv = ((rv == 0) ? 1 : 0); -+bail: -+ if (symKey) PK11_FreeSymKey(symKey); -+ if (cryptoParam) { -+ SECITEM_ZfreeItem(cryptoParam, PR_TRUE); -+ cryptoParam = NULL; -+ } -+ if (ctx) PK11_DestroyContext(ctx, PR_TRUE); -+ -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_key_of_cert_to_file(CERTCertificate *cert, -+ char *pin_filename, -+ char *filename) -+{ -+ int rv = 0; -+ SECKEYPrivateKey *key = NULL; -+ SECItem pwitem; -+ SECKEYEncryptedPrivateKeyInfo *epki = NULL; -+ PLArenaPool *arenaForPKI = NULL; -+ SECItem clearKeyDER; -+ char *b64 = NULL; -+ char *output = NULL; -+ -+ // establish password -+ pwitem.data = "secretpw"; // FIXME use pin_filename -+ pwitem.len = strlen(pwitem.data); -+ pwitem.type = siBuffer; -+ -+ // get key -+ if ( NULL == ( key = PK11_FindKeyByAnyCert(cert, (void *)pin_filename) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: PK11_FindKeyByAnyCert failed.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // get key info -+ if ( NULL == ( epki = PK11_ExportEncryptedPrivKeyInfo( -+ NULL, SEC_OID_DES_EDE3_CBC, &pwitem, key, 1000, (void *)pin_filename) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: PK11_ExportEncryptedPrivKeyInfo returned NULL.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // get clear DER -+ if ( NULL == ( arenaForPKI = PORT_NewArena(2048) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: PORT_NewArena failed.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ clearKeyDER.data = PORT_ArenaAlloc(arenaForPKI, epki->encryptedData.len); -+ clearKeyDER.len = epki->encryptedData.len; -+ clearKeyDER.type = siBuffer; -+ -+ if ( 0 == tlsmc_decrypt_key(epki, SEC_OID_DES_EDE3_CBC, &pwitem, -+ (void *)pin_filename, &clearKeyDER) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: could not decrypt the key.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // base64 encode -+ if ( NULL == ( b64 = BTOA_ConvertItemToAscii(&clearKeyDER) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: could not base64 encode.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // print out -+ output = PR_smprintf( DONOTEDIT "\n" -+ PEM_KEY_HEADER "\n" -+ "%s\n" -+ PEM_KEY_FOOTER "\n", -+ b64 ); -+ -+ if ( 0 == tlsmc_write_file( filename, output, S_IRUSR ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: could not write PK.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+ -+bail: -+ if (b64) PORT_Free(b64); -+ if (arenaForPKI) PORT_FreeArena(arenaForPKI, PR_FALSE); -+ if (epki) SECKEY_DestroyEncryptedPrivateKeyInfo(epki, PR_TRUE); -+ if (key) SECKEY_DestroyPrivateKey(key); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_cert_key_pair(char *nickname, char *pin_filename, char *dir_name) -+{ -+ int rv = 0; -+ CERTCertDBHandle *certHandle = NULL; -+ CERTCertificate *cert = NULL; -+ char *cert_file_path = NULL; -+ char *key_file_path = NULL; -+ char *file_realpath = NULL; -+ -+ -+ cert_file_path = PR_smprintf( "%s/cert.pem", dir_name ); -+ key_file_path = PR_smprintf( "%s/key.pem", dir_name ); -+ -+ if ( NULL == nickname ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: WARN: supplied nickname is empty (NULL).\n", -+ 0, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ if ( NULL == ( certHandle = CERT_GetDefaultCertDB() ) ) { -+ // FIXME see same in tlsmc_extract_cacerts() -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not get certificate handle.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( NULL != ( cert = PK11_FindCertFromNickname(nickname, NULL) ) ) { -+ /* extract cert/key from NSS db */ -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: extracting certificate `%s' to file `%s'.\n", -+ nickname, cert_file_path, 0 ); -+ if ( 0 == tlsmc_extract_cert_to_file(certHandle, cert, cert_file_path) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not extract certificate.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: extracting associated PK to file `%s'.\n", -+ key_file_path, 0, 0 ); -+ if ( 0 == tlsmc_extract_key_of_cert_to_file( cert, pin_filename, key_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not extract PK.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ } else { -+ /* symlink PEM cert/key PEM files */ -+ -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: INFO: could not find certificate with nickname `%s', expecting a PEM file.\n", -+ nickname, 0, 0 ); -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: symlinking certificate file `%s' to file `%s'.\n", -+ nickname, cert_file_path, 0 ); -+ if ( NULL == ( file_realpath = realpath( nickname, NULL ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not get realpath of certificate file `%s'.\n", -+ nickname, 0, 0 ); -+ goto bail; -+ } -+ if ( -1 == symlink( file_realpath, cert_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not create a symlink of `%s' to `%s'.\n", -+ file_realpath, cert_file_path, 0 ); -+ goto bail; -+ } -+ if ( file_realpath ) free( file_realpath ); -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: symlinking PK file `%s' to file `%s'.\n", -+ pin_filename, key_file_path, 0 ); -+ if ( NULL == ( file_realpath = realpath( pin_filename, NULL ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not get realpath of PK file `%s'.\n", -+ pin_filename, 0, 0 ); -+ goto bail; -+ } -+ if ( -1 == symlink( file_realpath, key_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not create a symlink of `%s' to `%s'.\n", -+ file_realpath, key_file_path, 0 ); -+ goto bail; -+ } -+ } -+ -+ rv = 1; -+ -+bail: -+ if (file_realpath) free(file_realpath); -+ if (key_file_path) PR_smprintf_free(key_file_path); -+ if (cert_file_path) PR_smprintf_free(cert_file_path); -+ if (cert) CERT_DestroyCertificate(cert); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_cacerts( char *dir_name ) -+{ -+ int rv = 0; -+ CERTCertDBHandle *certHandle = NULL; -+ CERTCertListNode *node = NULL; -+ CERTCertList *list = NULL; -+ char *cacerts_dir = NULL; -+ int cert_cnt = 0; -+ -+ cacerts_dir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, dir_name ); -+ -+ certHandle = CERT_GetDefaultCertDB(); // FIXME maybe we should really use certdb_slot? -+ if ( ! certHandle ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: could not get certificate database handle.\n", -+ 0, 0, 0); -+ goto bail; -+ } -+ -+ list = PK11_ListCerts(PK11CertListAll, NULL); -+ if ( ! list ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: could not get list of certificates.\n", -+ 0, 0, 0); -+ goto bail; -+ } -+ for ( node = CERT_LIST_HEAD(list); -+ !CERT_LIST_END(node, list); -+ node = CERT_LIST_NEXT(node)) { -+ -+ CERTCertificate *cert = NULL; -+ CERTCertTrust trust; -+ char *cert_file_path = NULL; -+ int is_ca = 0; -+ -+ cert = node->cert; -+ if ( SECFailure == CERT_GetCertTrust( cert, &trust ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cacerts: ERROR: could not get trust flags of certificate nick=`%s'.\n", -+ cert->nickname, 0, 0); -+ goto bail; -+ } -+ if (trust.sslFlags & -+ (CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA)) { -+ is_ca = 1; -+ } -+ -+ Debug(LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: INFO: found cert nick=`%s'%s.\n", -+ cert->nickname, is_ca ? ", a trusted CA" : ", _not_ a trusted CA, skipping", 0); -+ if ( ! is_ca ) continue; -+ -+ cert_file_path = PR_smprintf( "%s/cert%d.pem", cacerts_dir, cert_cnt ); -+ cert_cnt++; -+ Debug(LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: INFO: extracting cert nick=`%s' to file `%s'.\n", -+ cert->nickname, cert_file_path, 0); -+ if ( 0 == tlsmc_extract_cert_to_file( certHandle, cert, cert_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cacerts: ERROR: could not extract the certificate.\n", -+ 0, 0, 0); -+ goto bail_one; -+ } -+ if ( 0 == tlsmc_cert_create_hash_symlink( cert_file_path, cacerts_dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cacerts: ERROR: could not rehash the certificate.\n", -+ 0, 0, 0); -+ goto bail_one; -+ } -+ if ( cert_file_path ) PR_smprintf_free( cert_file_path ); -+ continue; -+ bail_one: -+ if ( cert_file_path ) PR_smprintf_free( cert_file_path ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ if ( cacerts_dir ) PR_smprintf_free( cacerts_dir ); -+ if ( list ) CERT_DestroyCertList( list ); -+ return rv; -+} -+ -+ -+/* returns 1 if successfull; -+ returns -1 if only cert-key pair is NULL or could not be extracted; -+ returns 0 if any other error -+*/ -+int -+tlsmc_extract_nssdb( char *dir_name, char **ld_cacertdir, char **ld_cert, char **ld_key ) -+{ -+ int rv = 0; -+ -+ if ( ! dir_name ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: FATAL: target dir name empty.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( 0 == tlsmc_extract_cacerts( dir_name ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: ERROR: could not export CA certificates.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( 0 == tlsmc_extract_cert_key_pair( *ld_cert, *ld_key, dir_name ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: ERROR: could not export user cert and/or key.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ return rv; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+int -+tlsmc_close_nssdb(NSSInitContext **initctx) -+{ -+ if ( *initctx && NSS_ShutdownContext( *initctx ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_close_nssdb: ERROR: could not shutdown NSS - error %d:%s.\n", -+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); -+ return 0; -+ } else { -+ return 1; -+ } -+} -+ -+ -+int -+tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ) -+{ -+ -+ int rv = 0; -+ -+ NSSInitContext *nss_ctx = NULL; -+ char *nssdb_dir_path = NULL; -+ char *nssdb_prefix = NULL; -+ char *pem_dir = NULL; -+ char *readme_path = NULL; -+ char *data = NULL; // data before checksum -+ char *checksum = NULL; // checksummed data -+ struct stat stat_buf; -+ -+#ifdef LDAP_R_COMPILE -+ ldap_pvt_thread_mutex_lock( &tlsmc_mutex ); -+#endif -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: trying to open NSS DB with CACertDir = `%s'.\n", -+ *ld_cacertdir, 0, 0 ); -+ if ( NULL == ld_cacertdir || NULL == ld_cert || NULL == ld_key ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: cannot proceed, some of the arguments are NULL.\n", -+ 0, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ if ( 0 == tlsmc_open_nssdb( *ld_cacertdir, &nss_ctx, &nssdb_dir_path, &nssdb_prefix ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.\n", -+ 0, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ -+ if ( NULL == ( checksum = tlsmc_compute_checksum( nssdb_dir_path, nssdb_prefix, -+ *ld_cacertdir, *ld_cert, *ld_key, -+ &data ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: could not compute checksum.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( NULL == ( pem_dir = PR_smprintf( "/tmp/openldap-tlsmc-%s-%s-%s", -+ tlsmc_path2name( nssdb_dir_path ), -+ nssdb_prefix, -+ checksum) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not allocate memory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( NULL == ( readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, pem_dir ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not allocate memory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: trying with PEM dir = `%s'.\n", -+ pem_dir, 0, 0 ); -+ if ( 0 == stat( pem_dir, &stat_buf ) ) { -+ if ( S_ISDIR(stat_buf.st_mode) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: using the existing PEM dir.\n", -+ 0, 0, 0 ); -+ if ( 0 == stat( readme_path, &stat_buf ) ) { -+ goto pem_dir_exists; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: the PEM dir found does not contain README file. Will remove the PEM dir and try to recreate it.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_remove_dir_recursively( pem_dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not remove the PEM dir. Cannot properly set TLS.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ } -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: tried to stat the PEM dir but it is not a directory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: WARN: will try to create PEM dir.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_prepare_dir( pem_dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: cannot prepare the PEM dir.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( 0 == tlsmc_extract_nssdb( pem_dir, ld_cacertdir, ld_cert, ld_key ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not extract from the NSS DB.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( 0 == tlsmc_write_file( readme_path, data, S_IRUSR ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: could not create README file.\n", -+ 0, 0, 0 ); -+ } -+ -+pem_dir_exists: -+ if (*ld_cacertdir) free(*ld_cacertdir); -+ *ld_cacertdir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, pem_dir ); -+ if ( ! ( ( 0 == stat( *ld_cacertdir, &stat_buf ) ) -+ && S_ISDIR(stat_buf.st_mode) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: extracted cacerts dir is not present.\n", -+ 0, 0, 0 ); -+ if ( *ld_cacertdir ) PR_smprintf_free( *ld_cacertdir ); -+ *ld_cacertdir = NULL; -+ } -+ -+ if (*ld_cert) free(*ld_cert); -+ *ld_cert = PR_smprintf( "%s/" TLSMC_CERT_FILE_NAME, pem_dir ); -+ if ( ! ( ( 0 == stat( *ld_cert, &stat_buf ) ) -+ && ( S_ISREG(stat_buf.st_mode) -+ || S_ISLNK(stat_buf.st_mode) ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: extracted cert file is not present.\n", -+ 0, 0, 0 ); -+ if ( *ld_cert ) PR_smprintf_free( *ld_cert ); -+ *ld_cert = NULL; -+ } -+ -+ if (*ld_key) free(*ld_key); -+ *ld_key = PR_smprintf( "%s/" TLSMC_KEY_FILE_NAME, pem_dir ); -+ if ( ! ( ( 0 == stat( *ld_key, &stat_buf ) ) -+ && ( S_ISREG(stat_buf.st_mode) -+ || S_ISLNK(stat_buf.st_mode) ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: extracted key file is not present.\n", -+ 0, 0, 0 ); -+ if ( *ld_key ) PR_smprintf_free( *ld_key ); -+ *ld_key = NULL; -+ } -+ -+ rv = 1; -+ -+bail: -+ if ( checksum ) free( checksum ); -+ if ( pem_dir ) PR_smprintf_free( pem_dir ); -+ if ( readme_path ) PR_smprintf_free( readme_path ); -+ if ( data ) free( data ); -+ if ( nssdb_prefix ) free( nssdb_prefix ); -+ if ( nssdb_dir_path ) free( nssdb_dir_path ); -+ if ( nss_ctx ) tlsmc_close_nssdb( &nss_ctx ); -+ -+#ifdef LDAP_R_COMPILE -+ ldap_pvt_thread_mutex_unlock( &tlsmc_mutex ); -+#endif -+ -+ return rv; -+} -+ -+ -+// returns 0 when successful -+int -+tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ) -+{ -+ int rv = 0; -+ char *ld_cacertdir = NULL; -+ char *ld_cert = NULL; -+ char *ld_key = NULL; -+ -+ ld_cacertdir = lo->ldo_tls_cacertdir ? LDAP_STRDUP( (char *) lo->ldo_tls_cacertdir ) : NULL; -+ ld_cert = lo->ldo_tls_certfile ? LDAP_STRDUP( (char *) lo->ldo_tls_certfile ) : NULL; -+ ld_key = lo->ldo_tls_keyfile ? LDAP_STRDUP( (char *) lo->ldo_tls_keyfile ) : NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_intercept_initialization: INFO: entry options follow:\n" -+ "tlsmc_intercept_initialization: INFO: cacertdir = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: certfile = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: keyfile = `%s'\n", -+ lo->ldo_tls_cacertdir, lo->ldo_tls_certfile, lo->ldo_tls_keyfile ); -+ -+ if ( 0 == tlsmc_convert( &ld_cacertdir, &ld_cert, &ld_key ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_intercept_initialization: FATAL: could not intercept TLS initialization. TLS will not work!\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir ); -+ lo->ldo_tls_cacertdir = ld_cacertdir ? LDAP_STRDUP( (char *) ld_cacertdir ) : NULL; -+ -+ if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile ); -+ lo->ldo_tls_certfile = ld_cert ? LDAP_STRDUP( (char *) ld_cert ) : NULL; -+ -+ if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile ); -+ lo->ldo_tls_keyfile = ld_key ? LDAP_STRDUP( (char *) ld_key ) : NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_intercept_initialization: INFO: altered options follow:\n" -+ "tlsmc_intercept_initialization: INFO: cacertdir = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: certfile = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: keyfile = `%s'\n", -+ lo->ldo_tls_cacertdir, lo->ldo_tls_certfile, lo->ldo_tls_keyfile ); -+ -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only.\n", -+ 0, 0, 0 ); -+ rv = 1; -+bail: -+ if ( ld_cacertdir ) LDAP_FREE( ld_cacertdir ); -+ if ( ld_cert ) LDAP_FREE( ld_cert ); -+ if ( ld_key ) LDAP_FREE( ld_key ); -+ return rv; -+} -+ -+ -+#endif /* HAVE_MOZNSS_COMPATIBILITY */ -+/* -+ emacs settings -+ Local Variables: -+ indent-tabs-mode: t -+ tab-width: 4 -+ End: -+*/ -diff --git a/libraries/libldap/tls_mc.h b/libraries/libldap/tls_mc.h -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc.h -@@ -0,0 +1,18 @@ -+#ifndef _LDAP_TLSMC_H -+#define _LDAP_TLSMC_H -+ -+#include "portable.h" -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+#include "ldap-int.h" -+ -+int -+tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ); -+ -+int -+tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ); -+ -+ -+#endif /* HAVE_MOZNSS_COMPATIBILITY */ -+#endif /* _LDAP_TLSMC_H */ -diff --git a/libraries/libldap/tls_mc_ossl.c b/libraries/libldap/tls_mc_ossl.c -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc_ossl.c -@@ -0,0 +1,95 @@ -+#include "portable.h" -+ -+/* This file contains functions that require OpenSSL headers due to some -+ conflicts with what MozNSS defines. -+*/ -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+#include -+#include -+#include "ldap-int.h" -+#include -+#include -+#include -+ -+ -+int -+tlsmc_cert_create_hash_symlink( char *cert_path, char *cacerts_dir ) -+{ -+ int rv = 0; -+ X509 *cert = NULL; -+ FILE *fp = NULL; -+ unsigned long hash = 0; -+ char *cert_filename_p = NULL; -+ char *last_slash_p = NULL; -+ char *symlink_path = NULL; -+ int cnt = 0; -+ -+ if ( NULL == ( fp = fopen( cert_path, "r" ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not open the cert file.\n", -+ 0, 0, 0 ); -+ perror( "tlsmc_cert_create_hash_symlink: ERROR: OS error" ); -+ goto bail; -+ } -+ if ( NULL == PEM_read_X509( fp, &cert, NULL, NULL ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not read PEM data.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( 0 == ( hash = X509_subject_name_hash( cert ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not hash subject.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ last_slash_p = strrchr( cert_path, '/' ); -+ cert_filename_p = last_slash_p ? last_slash_p + 1 : cert_path; -+ for ( cnt = 0; cnt < 10; cnt++ ) { -+ if ( NULL == ( symlink_path = PR_smprintf( "%s/%08lx.%d", cacerts_dir, hash, cnt ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: memory allocation error.\n", -+ 0, 0, 0 ); -+ continue; -+ } -+ if ( 0 != symlink( cert_filename_p, symlink_path ) ) { -+ if ( errno == EEXIST ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: INFO: symlink `%s' already exists.\n", -+ symlink_path, 0, 0 ); -+ if ( symlink_path ) PR_smprintf( symlink_path ); -+ continue; -+ } -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not create symlink.\n", -+ 0, 0, 0 ); -+ perror( "tlsmc_cert_create_hash_symlink: ERROR: OS error" ); -+ goto bail; -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_cert_create_hash_symlink: INFO: the cert is now symlinked to %s.\n", -+ symlink_path, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: INFO: could not create symlink (all possible file names taken).\n", -+ 0, 0, 0 ); -+bail: -+ if ( symlink_path ) PR_smprintf_free( symlink_path ); -+ if ( cert ) X509_free( cert ); -+ if ( fp ) fclose( fp ); -+ return rv; -+} -+ -+#endif /* HAVE_MOZNSS_COMPATIBILITY */ -+/* -+ emacs settings -+ Local Variables: -+ indent-tabs-mode: t -+ tab-width: 4 -+ End: -+*/ -diff --git a/libraries/libldap/tls_mc_ossl.h b/libraries/libldap/tls_mc_ossl.h -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc_ossl.h -@@ -0,0 +1,12 @@ -+#ifndef _LDAP_TLSMC_OSSL_H -+#define _LDAP_TLSMC_OSSL_H -+ -+#include "portable.h" -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+int -+tlsmc_cert_create_hash_symlink( char *cert_path, char *cacerts_dir ); -+ -+#endif -+#endif -diff --git a/libraries/libldap_r/Makefile.in b/libraries/libldap_r/Makefile.in ---- a/libraries/libldap_r/Makefile.in -+++ b/libraries/libldap_r/Makefile.in -@@ -28,7 +28,7 @@ XXSRCS = apitest.c test.c \ - request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \ - init.c options.c print.c string.c util-int.c schema.c \ - charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ -- tls2.c tls_o.c tls_g.c tls_m.c \ -+ tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \ - turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ - assertion.c deref.c ldif.c fetch.c - SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \ -@@ -46,7 +46,7 @@ OBJS = threads.lo rdwr.lo rmutex.lo tpool.lo rq.lo \ - request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \ - init.lo options.lo print.lo string.lo util-int.lo schema.lo \ - charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ -- tls2.lo tls_o.lo tls_g.lo tls_m.lo \ -+ tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \ - turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ - assertion.lo deref.lo ldif.lo fetch.lo - diff --git a/openldap.spec b/openldap.spec index 88fd3eb..b8d3d66 100644 --- a/openldap.spec +++ b/openldap.spec @@ -1,66 +1,86 @@ -# TLSMC is MozNSS compatibility layer and should be disabled in F29+ -%if 0%{?fedora} && 0%{?fedora} <= 28 -%bcond_without tlsmc -%else -%bcond_with tlsmc -%endif - %global _hardened_build 1 %global systemctl_bin /usr/bin/systemctl %global check_password_version 1.1 +%global so_ver 2 +%global so_ver_compat 2 + +# Build openldap-servers package and its libslapi in openldap-devel and openldap-compat +%bcond servers 1 + +# Build with argon2 support +%bcond argon2 %{undefined rhel} + +# When you change "Version: " to the new major version, remember to change this value too +%global major_version 2.6 + +# Disable automatic .la file removal +%global __brp_remove_la_files %nil + Name: openldap -Version: 2.4.46 -Release: 5%{?dist} +Version: 2.6.10 +Release: 6%{?dist} Summary: LDAP support libraries -License: OpenLDAP +License: OLDAP-2.8 URL: http://www.openldap.org/ -Source0: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version}.tgz +Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-%{version}.tgz Source1: slapd.service Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf -Source10: ltb-project-openldap-ppolicy-check-password-%{check_password_version}.tar.gz +Source6: openldap.sysusers +Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions Source52: libexec-check-config.sh -Source53: libexec-upgrade-db.sh -# patches for 2.4 +# Patches for 2.6 Patch0: openldap-manpages.patch -Patch2: openldap-reentrant-gethostby.patch +Patch1: openldap-reentrant-gethostby.patch + Patch3: openldap-smbk5pwd-overlay.patch -Patch5: openldap-ai-addrconfig.patch -Patch17: openldap-allop-overlay.patch +Patch4: openldap-ai-addrconfig.patch +Patch5: openldap-allop-overlay.patch # fix back_perl problems with lt_dlopen() # might cause crashes because of symbol collisions # the proper fix is to link all perl modules against libperl # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327585 -Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch -# ldapi sasl fix pending upstream inclusion -Patch20: openldap-ldapi-sasl.patch -Patch21: openldap-openssl-allow-ssl3.patch -Patch22: openldap-openssl-ITS7595-Add-EC-support-1.patch -Patch23: openldap-openssl-ITS7595-Add-EC-support-2.patch -Patch24: openldap-openssl-manpage-defaultCA.patch +Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch + +# System-wide default for CA certs +Patch7: openldap-openssl-manpage-defaultCA.patch +Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch +Patch10: openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch # check-password module specific patches Patch90: check-password-makefile.patch Patch91: check-password.patch -# MozNSS compatibility layer -Patch100: openldap-tlsmc.patch - -%if %{with tlsmc} -BuildRequires: nss-devel -Recommends: nss-tools +BuildRequires: cyrus-sasl-devel +BuildRequires: gcc +BuildRequires: glibc-devel +BuildRequires: groff +BuildRequires: krb5-devel +BuildRequires: libtool-ltdl-devel +BuildRequires: libevent-devel +BuildRequires: libxcrypt-devel +BuildRequires: make +BuildRequires: openssl-devel +BuildRequires: perl(ExtUtils::Embed) +BuildRequires: perl-devel +BuildRequires: perl-generators +BuildRequires: perl-interpreter +BuildRequires: unixODBC-devel +BuildRequires: cracklib-devel +BuildRequires: systemd +BuildRequires: systemd-rpm-macros +%if %{with argon2} +BuildRequires: libsodium-devel %endif -BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel -BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) - %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of @@ -72,7 +92,8 @@ libraries, and documentation for OpenLDAP. %package devel Summary: LDAP development libraries and header files -Requires: openldap%{?_isa} = %{version}-%{release}, cyrus-sasl-devel%{?_isa} +Requires: openldap%{?_isa} = %{version}-%{release} +Requires: cyrus-sasl-devel%{?_isa} %description devel The openldap-devel package includes the development libraries and @@ -82,15 +103,41 @@ protocols for enabling directory services over the Internet. Install this package only if you plan to develop or will need to compile customized LDAP clients. +%package compat +Summary: Package providing legacy non-threaded libldap +Requires: openldap%{?_isa} = %{version}-%{release} +# since libldap is manually linked from libldap_r, the provides is not generated automatically +%ifarch armv7hl i686 +Provides: libldap-2.4.so.%{so_ver_compat} +Provides: libldap_r-2.4.so.%{so_ver_compat} +Provides: liblber-2.4.so.%{so_ver_compat} +%if %{with servers} +Provides: libslapi-2.4.so.%{so_ver_compat} +%endif +%else +Provides: libldap-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: libldap_r-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: liblber-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +%if %{with servers} +Provides: libslapi-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +%endif +%endif + +%description compat +The openldap-compat package contains shared libraries named as libldap-2.4.so, +%if %{with servers} +libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. +%else +libldap_r-2.4.so and liblber-2.4.so +%endif +The libraries are just links to the current version shared libraries, +and are available for compatibility reasons. + +%if %{with servers} %package servers Summary: LDAP server -License: OpenLDAP -Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils -Requires(pre): shadow-utils -BuildRequires: systemd +Requires: openldap%{?_isa} = %{version}-%{release} %{?systemd_requires} -BuildRequires: libdb-devel -BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -101,6 +148,8 @@ protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. This package contains the slapd server and related files. +# endif servers +%endif %package clients Summary: LDAP client utilities @@ -119,28 +168,16 @@ programs needed for accessing and modifying OpenLDAP directories. %setup -q -c -a 0 -a 10 pushd openldap-%{version} - -%if %{with tlsmc} -# alternative include paths for Mozilla NSS -ln -s %{_includedir}/nss3 include/nss -ln -s %{_includedir}/nspr4 include/nspr - -%patch100 -p1 -%endif - -AUTOMAKE=%{_bindir}/true autoreconf -fi - -%patch0 -p1 -%patch2 -p1 -%patch3 -p1 -%patch5 -p1 -%patch17 -p1 -%patch19 -p1 -%patch20 -p1 -%patch21 -p1 -%patch22 -p1 -%patch23 -p1 -%patch24 -p1 +%patch -P0 -p1 +%patch -P1 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 +%patch -P9 -p1 +%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -154,27 +191,30 @@ mv servers/slapd/back-perl/README{,.back_perl} # fix documentation encoding for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do - iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" - mv "$filename.utf8" "$filename" + iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" + mv "$filename.utf8" "$filename" done popd -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} -%patch90 -p1 -%patch91 -p1 +pushd openldap-ppolicy-check-password-%{check_password_version} +%patch -P90 -p1 +%patch -P91 -p1 popd %build %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS" +# disable legacy hash algorithm +export CFLAGS="${CFLAGS} -DOPENSSL_NO_MD2" pushd openldap-%{version} %configure \ --enable-debug \ --enable-dynamic \ + --enable-versioning \ \ --enable-dynacl \ --enable-cleartext \ @@ -182,9 +222,15 @@ pushd openldap-%{version} --enable-lmpasswd \ --enable-spasswd \ --enable-modules \ + --enable-perl \ --enable-rewrite \ --enable-rlookups \ +%if %{with servers} --enable-slapi \ +%if %{with argon2} + --enable-argon2 \ +%endif +%endif --disable-slp \ \ --enable-backends=mod \ @@ -194,13 +240,14 @@ pushd openldap-%{version} --enable-monitor=yes \ --disable-ndb \ --disable-sql \ + --disable-wt \ \ --enable-overlays=mod \ \ --disable-static \ \ - --enable-moznss-compatibility=%{?with_tlsmc:yes}%{!?with_tlsmc:no} \ - \ + --enable-balancer=mod \ + \ --with-cyrus-sasl \ --without-fetch \ --with-threads \ @@ -209,11 +256,11 @@ pushd openldap-%{version} \ --libexecdir=%{_libdir} -make %{_smp_mflags} +%make_build popd -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} -make LDAP_INC="-I../openldap-%{version}/include \ +pushd openldap-ppolicy-check-password-%{check_password_version} +%make_build LDAP_INC="-I../openldap-%{version}/include \ -I../openldap-%{version}/servers/slapd \ -I../openldap-%{version}/build-servers/include" popd @@ -221,13 +268,16 @@ popd %install mkdir -p %{buildroot}%{_libdir}/ +%if %{with servers} +install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/openldap.conf +%endif pushd openldap-%{version} -make install DESTDIR=%{buildroot} STRIP="" +%make_install STRIP_OPTS="" popd # install check_password module -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +pushd openldap-ppolicy-check-password-%{check_password_version} mv check_password.so check_password.so.%{check_password_version} ln -s check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/check_password.so install -m 755 check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/ @@ -260,7 +310,7 @@ mkdir -p %{buildroot}%{_tmpfilesdir} install -m 0644 %SOURCE2 %{buildroot}%{_tmpfilesdir}/slapd.conf # install default ldap.conf (customized) -rm -f %{buildroot}%{_sysconfdir}/openldap/ldap.conf +rm %{buildroot}%{_sysconfdir}/openldap/ldap.conf install -m 0644 %SOURCE4 %{buildroot}%{_sysconfdir}/openldap/ldap.conf # setup maintainance scripts @@ -268,15 +318,13 @@ mkdir -p %{buildroot}%{_libexecdir} install -m 0755 -d %{buildroot}%{_libexecdir}/openldap install -m 0644 %SOURCE50 %{buildroot}%{_libexecdir}/openldap/functions install -m 0755 %SOURCE52 %{buildroot}%{_libexecdir}/openldap/check-config.sh -install -m 0755 %SOURCE53 %{buildroot}%{_libexecdir}/openldap/upgrade-db.sh # remove build root from config files and manual pages perl -pi -e "s|%{buildroot}||g" %{buildroot}%{_sysconfdir}/openldap/*.conf perl -pi -e "s|%{buildroot}||g" %{buildroot}%{_mandir}/*/*.* # we don't need the default files -- RPM handles changes -rm -f %{buildroot}%{_sysconfdir}/openldap/*.default -rm -f %{buildroot}%{_sysconfdir}/openldap/schema/*.default +rm %{buildroot}%{_sysconfdir}/openldap/*.default # install an init script for the servers mkdir -p %{buildroot}%{_unitdir} @@ -286,65 +334,74 @@ install -m 0644 %SOURCE1 %{buildroot}%{_unitdir}/slapd.service mv %{buildroot}%{_libdir}/slapd %{buildroot}%{_sbindir}/ # setup tools as symlinks to slapd -rm -f %{buildroot}%{_sbindir}/slap{acl,add,auth,cat,dn,index,passwd,test,schema} -rm -f %{buildroot}%{_libdir}/slap{acl,add,auth,cat,dn,index,passwd,test,schema} -for X in acl add auth cat dn index passwd test schema; do ln -s slapd %{buildroot}%{_sbindir}/slap$X ; done +for X in acl add auth cat dn index modify passwd test schema ; do + rm %{buildroot}%{_sbindir}/slap$X + ln -s slapd %{buildroot}%{_sbindir}/slap$X +done # re-symlink unversioned libraries, so ldconfig is not confused pushd %{buildroot}%{_libdir} v=%{version} version=$(echo ${v%.[0-9]*}) -for lib in liblber libldap libldap_r libslapi; do - rm -f ${lib}.so - ln -s ${lib}-${version}.so.2 ${lib}.so +for lib in liblber libldap %{?with_servers:libslapi}; do + rm -f ${lib}.so + ln -s ${lib}.so.%{so_ver} ${lib}.so done + +for lib in $(ls | grep libldap); do + IFS='.' + read -r -a libsplit <<< "$lib" + if [[ -z "${libsplit[3]}" && -n "${libsplit[2]}" ]] + then + so_ver_short_2_4="%{so_ver_compat}" + elif [ -n "${libsplit[3]}" ] + then + so_ver_full_2_4="%{so_ver_compat}.${libsplit[3]}.${libsplit[4]}" + fi + unset IFS +done + +# Provide only libldap and copy it to libldap_r for both 2.4 and 2.6+ versions, make a versioned lib link +# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOL) +gcc -shared -o "%{buildroot}%{_libdir}/libldap-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap +gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap +gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -llber +%if %{with servers} +gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lslapi +ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +%endif +ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s libldap_r-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s liblber-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} + popd # tweak permissions on the libraries to make sure they're correct chmod 0755 %{buildroot}%{_libdir}/lib*.so* chmod 0644 %{buildroot}%{_libdir}/lib*.*a +chmod 0644 %{buildroot}%{_libdir}/openldap/*.la # slapd.conf(5) is obsoleted since 2.3, see slapd-config(5) mkdir -p %{buildroot}%{_datadir} install -m 0755 -d %{buildroot}%{_datadir}/openldap-servers install -m 0644 %SOURCE3 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif install -m 0700 -d %{buildroot}%{_sysconfdir}/openldap/slapd.d -rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.conf -rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.ldif +rm %{buildroot}%{_sysconfdir}/openldap/slapd.conf +rm %{buildroot}%{_sysconfdir}/openldap/slapd.ldif # move doc files out of _sysconfdir mv %{buildroot}%{_sysconfdir}/openldap/schema/README README.schema -mv %{buildroot}%{_sysconfdir}/openldap/DB_CONFIG.example %{buildroot}%{_datadir}/openldap-servers/DB_CONFIG.example -chmod 0644 %{buildroot}%{_datadir}/openldap-servers/DB_CONFIG.example # remove files which we don't want packaged -rm -f %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/openldap/ removed, yet - -rm -f %{buildroot}%{_localstatedir}/openldap-data/DB_CONFIG.example -rmdir %{buildroot}%{_localstatedir}/openldap-data +rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/openldap/ removed, yet %ldconfig_scriptlets -%pre servers - -# create ldap user and group -getent group ldap &>/dev/null || groupadd -r -g 55 ldap -getent passwd ldap &>/dev/null || \ - useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap - -if [ $1 -eq 2 ]; then - # package upgrade - - old_version=$(rpm -q --qf=%%{version} openldap-servers) - new_version=%{version} - - if [ "$old_version" != "$new_version" ]; then - touch %{_sharedstatedir}/ldap/rpm_upgrade_openldap &>/dev/null - fi -fi - -exit 0 - +%if %{with servers} %post servers %systemd_post slapd.service @@ -360,26 +417,9 @@ if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ %{systemctl_bin} try-restart slapd.service &>/dev/null fi -start_slapd=0 - -# upgrade the database -if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap ]; then - if %{systemctl_bin} --quiet is-active slapd.service; then - %{systemctl_bin} stop slapd.service - start_slapd=1 - fi - - %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap -fi - # restart after upgrade if [ $1 -ge 1 ]; then - if [ $start_slapd -eq 1 ]; then - %{systemctl_bin} start slapd.service &>/dev/null || : - else - %{systemctl_bin} condrestart slapd.service &>/dev/null || : - fi + %{systemctl_bin} condrestart slapd.service &>/dev/null || : fi exit 0 @@ -389,41 +429,8 @@ exit 0 %postun servers %systemd_postun_with_restart slapd.service - -%triggerin servers -- libdb - -# libdb upgrade (setup for %%triggerun) -if [ $2 -eq 2 ]; then - # we are interested in minor version changes (both versions of libdb are installed at this moment) - if [ "$(rpm -q --qf="%%{version}\n" libdb | sed 's/\.[0-9]*$//' | sort -u | wc -l)" != "1" ]; then - touch %{_sharedstatedir}/ldap/rpm_upgrade_libdb - else - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb - fi -fi - -exit 0 - - -%triggerun servers -- libdb - -# libdb upgrade (finish %%triggerin) -if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb ]; then - if %{systemctl_bin} --quiet is-active slapd.service; then - %{systemctl_bin} stop slapd.service - start=1 - else - start=0 - fi - - %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb - - [ $start -eq 1 ] && %{systemctl_bin} start slapd.service &>/dev/null -fi - -exit 0 - +%endif +# endif servers %files %doc openldap-%{version}/ANNOUNCEMENT @@ -435,21 +442,22 @@ exit 0 %dir %{_sysconfdir}/openldap/certs %config(noreplace) %{_sysconfdir}/openldap/ldap.conf %dir %{_libexecdir}/openldap/ -%{_libdir}/liblber-2.4*.so.* -%{_libdir}/libldap-2.4*.so.* -%{_libdir}/libldap_r-2.4*.so.* -%{_libdir}/libslapi-2.4*.so.* +%{_libdir}/liblber.so.* +%{_libdir}/libldap.so.* +%if %{with servers} +%{_libdir}/libslapi.so.* +%endif %{_mandir}/man5/ldif.5* %{_mandir}/man5/ldap.conf.5* +%if %{with servers} %files servers %doc openldap-%{version}/contrib/slapd-modules/smbk5pwd/README.smbk5pwd %doc openldap-%{version}/doc/guide/admin/*.html %doc openldap-%{version}/doc/guide/admin/*.png %doc openldap-%{version}/servers/slapd/back-perl/SampleLDAP.pm %doc openldap-%{version}/servers/slapd/back-perl/README.back_perl -%doc openldap-%{version}/servers/slapd/back-perl/README.back_perl -%doc ltb-project-openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd +%doc openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd %doc README.schema %config(noreplace) %dir %attr(0750,ldap,ldap) %{_sysconfdir}/openldap/slapd.d %config(noreplace) %{_sysconfdir}/openldap/schema @@ -460,27 +468,39 @@ exit 0 %{_unitdir}/slapd.service %{_datadir}/openldap-servers/ %{_libdir}/openldap/accesslog* -%{_libdir}/openldap/auditlog* %{_libdir}/openldap/allop* +%if %{with argon2} +%{_libdir}/openldap/argon2* +%{_mandir}/man5/slappw-argon2.5* +%else +%exclude %{_mandir}/man5/slappw-argon2.5* +%endif +%{_libdir}/openldap/auditlog* +%{_libdir}/openldap/autoca* +%{_libdir}/openldap/back_asyncmeta* %{_libdir}/openldap/back_dnssrv* %{_libdir}/openldap/back_ldap* %{_libdir}/openldap/back_meta* %{_libdir}/openldap/back_null* %{_libdir}/openldap/back_passwd* %{_libdir}/openldap/back_relay* -%{_libdir}/openldap/back_shell* %{_libdir}/openldap/back_sock* -%{_libdir}/openldap/back_perl* +%{_libdir}/openldap/check_password* %{_libdir}/openldap/collect* %{_libdir}/openldap/constraint* %{_libdir}/openldap/dds* %{_libdir}/openldap/deref* %{_libdir}/openldap/dyngroup* %{_libdir}/openldap/dynlist* +%{_libdir}/openldap/home* +%{_libdir}/openldap/lloadd* %{_libdir}/openldap/memberof* +%{_libdir}/openldap/nestgroup* +%{_libdir}/openldap/otp* %{_libdir}/openldap/pcache* %{_libdir}/openldap/ppolicy* %{_libdir}/openldap/refint* +%{_libdir}/openldap/remoteauth* %{_libdir}/openldap/retcode* %{_libdir}/openldap/rwm* %{_libdir}/openldap/seqmod* @@ -490,40 +510,336 @@ exit 0 %{_libdir}/openldap/translucent* %{_libdir}/openldap/unique* %{_libdir}/openldap/valsort* -%{_libdir}/openldap/check_password* %{_libexecdir}/openldap/functions %{_libexecdir}/openldap/check-config.sh -%{_libexecdir}/openldap/upgrade-db.sh -%{_sbindir}/sl* -%{_mandir}/man8/* +%{_sbindir}/slap* +%{_mandir}/man5/lloadd.conf.5* +%{_mandir}/man8/lloadd.8* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* +%{_mandir}/man8/slap*.8* +%{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf +%else +%exclude %{_datadir}/openldap-servers/ +%exclude %{_libdir}/openldap/ +%exclude %{_libexecdir}/openldap/check-config.sh +%exclude %{_libexecdir}/openldap/functions +%exclude %{_mandir}/man5/slapd*.5* +%exclude %{_mandir}/man5/slapo-*.5* +%exclude %{_mandir}/man5/lloadd.conf.5* +%exclude %{_mandir}/man5/slappw-argon2.5* +%exclude %{_mandir}/man8/* +%exclude %{_sbindir}/slap* +%exclude %{_sysconfdir}/openldap/check_password.conf +%exclude %{_sysconfdir}/openldap/schema +%exclude %{_tmpfilesdir}/slapd.conf +%exclude %{_unitdir}/slapd.service +%endif +# endif servers + %files clients -%{_bindir}/* -%{_mandir}/man1/* +%{_bindir}/ldap* +%{_mandir}/man1/ldap*.1* %files devel %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc -%{_libdir}/lib*.so +%{_libdir}/liblber.so +%{_libdir}/libldap.so +%if %{with servers} +%{_libdir}/libslapi.so +%endif %{_includedir}/* +%{_libdir}/pkgconfig/lber.pc +%{_libdir}/pkgconfig/ldap.pc %{_mandir}/man3/* +%files compat +%{_libdir}/libldap-2.4*.so.* +%{_libdir}/libldap_r-2.4*.so.* +%{_libdir}/liblber-2.4*.so.* +%if %{with servers} +%{_libdir}/libslapi-2.4*.so.* +%endif + %changelog -* Mon Dec 17 2018 Matus Honek - 2.4.46-5 +* Wed Jan 14 2026 Yaakov Selkowitz - 2.6.10-6 +- Enable argon2 only in Fedora + +* Tue Jan 13 2026 Simon Pichugin - 2.6.10-5 +- Add support for argon2 (rhbz#2229405) +- Bump version 2.6.10-5 + +* Fri Aug 29 2025 Simon Pichugin - 2.6.10-4 +- Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728) +- Convert STI tests to FMF (rhbz#2382998) + +* Thu Jul 24 2025 Fedora Release Engineering - 2.6.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Mon Jul 07 2025 Jitka Plesnikova - 2.6.10-2 +- Perl 5.42 rebuild + +* Tue Jun 10 2025 Simon Pichugin - 2.6.10-1 +- Rebase to version 2.6.10 (rhbz#2368103) + +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-5 +- Drop call to %sysusers_create_compat + +* Sat Feb 01 2025 Björn Esser - 2.6.9-4 +- Add explicit BR: libxcrypt-devel + +* Fri Jan 24 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-3 +- Adjust file patterns for the sbin merge + +* Thu Jan 16 2025 Simon Pichugin - 2.6.9-2 +- Disable MD2 hash algorithm (rhbz#2338556) + +* Thu Jan 9 2025 Simon Pichugin - 2.6.9-1 +- Rebase to version 2.6.9 (rhbz#2329002) + +* Tue Dec 3 2024 Simon Pichugin - 2.6.8-6 +- Avoid SSL context cleanup during library destruction + +* Tue Jul 23 2024 Simon Pichugin - 2.6.8-5 +- Clean up spec file so it's aligned with c10s +- Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526) + +* Thu Jul 18 2024 Fedora Release Engineering - 2.6.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon Jun 24 2024 Yaakov Selkowitz - 2.6.8-3 +- Disable libslapi and servers in RHEL builds + +* Tue Jun 11 2024 Jitka Plesnikova - 2.6.8-2 +- Perl 5.40 rebuild + +* Wed May 22 2024 Simon Pichugin - 2.6.8-1 +- Rebase to version 2.6.8 (rhbz#2282258) + +* Fri Feb 9 2024 Simon Pichugin - 2.6.7-1 +- Rebase to version 2.6.7 (rhbz#2261163) +- Use systemd-sysusers for ldap user and group (rhbz#2173965) +- Fix compiler errors (rhbz#2261427) +- Replace License with SPDX identifier + +* Thu Jan 25 2024 Fedora Release Engineering - 2.6.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2.6.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jul 31 2023 Simon Pichugin - 2.6.6-1 +- Rebase to version 2.6.6 + Related: rhbz#2227948 + +* Wed Jul 26 2023 Simon Pichugin - 2.6.5-1 +- Rebase to version 2.6.5 + Related: rhbz#2221798 + +* Thu Jul 20 2023 Fedora Release Engineering - 2.6.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 2.6.4-3 +- Perl 5.38 rebuild + +* Sat Apr 15 2023 Florian Weimer - 2.6.4-2 +- Apply upstream patch to fix C99 compatibility issues + +* Mon Feb 27 2023 Simon Pichugin - 2.6.4-1 +- Rebase to version 2.6.4 + Related: rhbz#2168351 + +* Thu Jan 19 2023 Fedora Release Engineering - 2.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Wed Aug 17 2022 Simon Pichugin - 2.6.3-1 +- Rebase to version 2.6.3 + Related: rhbz#2107382 + +* Thu Aug 11 2022 Simon Pichugin - 2.6.2-5 +- Add export symbols related to LDAP_CONNECTIONLESS + Related: rhbz#2117825 + +* Fri Jul 22 2022 Fedora Release Engineering - 2.6.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jun 27 2022 Simon Pichugin - 2.6.2-3 +- Fix debuginfo missing issue (#2101615) + +* Mon May 30 2022 Jitka Plesnikova - 2.6.2-2 +- Perl 5.36 rebuild + +* Wed May 25 2022 Simon Pichugin - 2.6.2-1 +- Rebase to version 2.6.2 (#2090447) + +* Wed Feb 2 2022 Simon Pichugin - 2.6.1-2 +- Fix twice packaged compat libraries issue (#2049085) + +* Mon Jan 31 2022 Simon Pichugin - 2.6.1-1 +- Update to new major release OpenLDAP 2.6.1 (#1955293) + + rediff all patches and remove patches now upstream + + use upstream source location for check password module + + and rediff patch due to this + + add patch to fix build issue in 2.5.4 (from upstream) + + clean and sort buildreqs + + remove various refs to bdb + + remove now default -DLDAP_USE_NON_BLOCKING_TLS + + add new modules and enable load balancer as module + + disable wiredtired backend due to missing build deps + + don't remove files that don't exist + + let check-config work on *.mdb over legacy files + + remove refs to old-style config + + new soname names + + remove libldap_r link as the library was merged with libldap + + refactor openldap-compat package to support the transition from 2.4 + + add UPGRADE_INSTRUCTIONS for openldap-server upgrade +- The original patch was submitted by Fedora user - terjeros + https://src.fedoraproject.org/rpms/openldap/pull-request/6 + +* Mon Jan 24 2022 Timm Bäder - 2.4.59-6 +- Disable automatic .la file removal +- https://fedoraproject.org/wiki/Changes/RemoveLaFiles + +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.59-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Sep 30 2021 Simon Pichugin - 2.4.59-4 +- Backport TLS SNI feature from OpenLDAP 2.5 (#2009534) + +* Tue Sep 14 2021 Sahana Prasad - 2.4.59-3 +- Rebuilt with OpenSSL 3.0.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 2.4.59-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Jul 7 2021 Simon Pichugin - 2.4.59-1 +- Rebase to version 2.4.59 (#1980015) +- Update the spec file for upcoming autoconf-2.71 (#1943079) + +* Tue Jun 15 2021 Simon Pichugin - 2.4.58-5 +- Fix slapd.tmpfiles complaints (#1972147) +- Use https:// for source (#1972141) + +* Thu Jun 3 2021 Simon Pichugin - 2.4.58-4 +- Rebuild without MP_2 support (#1967136) +- Fix coverity issues + +* Fri May 21 2021 Jitka Plesnikova - 2.4.58-3 +- Perl 5.34 rebuild + +* Thu Apr 8 2021 Simon Pichugin - 2.4.58-2 +- Backport Channel Binding support (#1822904, #1822737) + +* Tue Mar 23 2021 Simon Pichugin - 2.4.58-1 +- Rebase to version 2.4.58 (#1939663) + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.4.57-3 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.57-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jan 19 2021 Simon Pichugin - 2.4.57-1 +- Rebase to version 2.4.57 (#1917583) + +* Thu Nov 26 2020 Simon Pichugin - 2.4.56-4 +- Use gcc to link libldap_r to libldap (#1537260) + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-3 +- Fix 32-bit libraries build (#1537260) + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-2 +- Drop non-threaded libldap (#1537260) + +* Wed Nov 18 2020 Simon Pichugin - 2.4.56-1 +- Rebase to version 2.4.56 (#1896508) + +* Mon Nov 02 2020 Simon Pichugin - 2.4.55-1 +- Rebase to version 2.4.55 (#1891622) + +* Tue Oct 13 2020 Simon Pichugin - 2.4.54-1 +- Rebase to version 2.4.54 (#1887581) + +* Thu Sep 10 2020 Simon Pichugin - 2.4.53-1 +- Rebase to version 2.4.53 (#1868240) + +* Thu Sep 03 2020 Simon Pichugin - 2.4.52-1 +- Rebase to version 2.4.52 (#1868240) + +* Sat Aug 01 2020 Fedora Release Engineering - 2.4.50-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.50-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jun 22 2020 Jitka Plesnikova - 2.4.50-2 +- Perl 5.32 rebuild + +* Wed Jun 17 2020 Matus Honek - 2.4.50-1 +- Rebase to version 2.4.50 (#1742285) + +* Tue Jun 16 2020 Tom Stellard - 2.4.47-5 +- Spec file cleanups +- Add BuildRequres: gcc [1] +- make_build [2] and make_install [3] +- [1] https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_buildrequires_and_requires +- [2] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make +- [3] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_why_the_makeinstall_macro_should_not_be_used + +* Wed Jan 29 2020 Fedora Release Engineering - 2.4.47-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jul 25 2019 Fedora Release Engineering - 2.4.47-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu May 30 2019 Jitka Plesnikova - 2.4.47-2 +- Perl 5.30 rebuild + +* Wed Feb 13 2019 Matus Honek - 2.4.47-1 +- Rebase to upstream version 2.4.47 + +* Fri Feb 01 2019 Fedora Release Engineering - 2.4.46-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 2.4.46-12 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Mon Dec 17 2018 Matus Honek - 2.4.46-11 - Reference default system-wide CA certificates in manpages (#1611591) -* Mon Oct 08 2018 Matus Honek - 2.4.46-4 +* Tue Oct 16 2018 Matus Honek - 2.4.46-10 +- Revert "Fix: Cannot use SSL3 anymore" + +* Mon Oct 08 2018 Matus Honek - 2.4.46-9 - Backport upstream fixes for ITS 7595 - add OpenSSL EC support (#1623495) -* Tue Aug 14 2018 Matus Honek - 2.4.46-3 +* Tue Aug 14 2018 Matus Honek - 2.4.46-8 - Fix: Cannot use SSL3 anymore (#1592431) -* Wed Jul 4 2018 Matus Honek - 2.4.46-2 +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.46-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jul 6 2018 Matus Honek - 2.4.46-6 +- Build with LDAP_USE_NON_BLOCKING_TLS (#1594928) +- Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967) + +* Fri Jul 06 2018 Petr Pisar - 2.4.46-5 +- Perl 5.28 rebuild + +* Wed Jul 4 2018 Matus Honek - 2.4.46-4 +- Remove unused leftover MozNSS Compat. Layer references (#1557967) + +* Wed Jul 4 2018 Matus Honek - 2.4.46-3 - MozNSS Compat. Layer: Make log messages more clear (#1598103) - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203) + +* Wed Jun 27 2018 Jitka Plesnikova - 2.4.46-2 +- Perl 5.28 rebuild - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161) * Tue Mar 27 2018 Matus Honek - 2.4.46-1 diff --git a/openldap.sysusers b/openldap.sysusers new file mode 100644 index 0000000..37ef083 --- /dev/null +++ b/openldap.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +g ldap 55 +u ldap 55:55 "OpenLDAP server" /var/lib/ldap /sbin/nologin diff --git a/plans/gating.fmf b/plans/gating.fmf new file mode 100644 index 0000000..387b7bf --- /dev/null +++ b/plans/gating.fmf @@ -0,0 +1,8 @@ +summary: Test plan for openldap + +discover: + how: fmf + +execute: + how: tmt + diff --git a/slapd.ldif b/slapd.ldif index a4ae4c0..e7449c1 100644 --- a/slapd.ldif +++ b/slapd.ldif @@ -42,36 +42,41 @@ cn: config # # Load dynamic backend modules: # - modulepath is architecture dependent value (32/64-bit system) -# - back_sql.la backend requires openldap-servers-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # #dn: cn=module,cn=config #objectClass: olcModuleList #cn: module -#olcModulepath: /usr/lib/openldap -#olcModulepath: /usr/lib64/openldap +#olcModulepath: /usr/lib/openldap +#olcModulepath: /usr/lib64/openldap #olcModuleload: accesslog.la +#olcModuleload: allop.la #olcModuleload: auditlog.la +#olcModuleload: autoca.la +#olcModuleload: back_asyncmeta.la #olcModuleload: back_dnssrv.la #olcModuleload: back_ldap.la -#olcModuleload: back_mdb.la #olcModuleload: back_meta.la #olcModuleload: back_null.la #olcModuleload: back_passwd.la #olcModuleload: back_relay.la -#olcModuleload: back_shell.la #olcModuleload: back_sock.la +#olcModuleload: check_password.la #olcModuleload: collect.la #olcModuleload: constraint.la #olcModuleload: dds.la #olcModuleload: deref.la #olcModuleload: dyngroup.la #olcModuleload: dynlist.la +#olcModuleload: home.la +#olcModuleload: lloadd.la #olcModuleload: memberof.la +#olcModuleload: otp.la #olcModuleload: pcache.la #olcModuleload: ppolicy.la #olcModuleload: refint.la +#olcModuleload: remoteauth.la #olcModuleload: retcode.la #olcModuleload: rwm.la #olcModuleload: seqmod.la diff --git a/slapd.service b/slapd.service index 30821fd..02fab7f 100644 --- a/slapd.service +++ b/slapd.service @@ -3,7 +3,6 @@ Description=OpenLDAP Server Daemon After=syslog.target network-online.target Documentation=man:slapd Documentation=man:slapd-config -Documentation=man:slapd-hdb Documentation=man:slapd-mdb Documentation=file:///usr/share/doc/openldap-servers/guide.html diff --git a/slapd.tmpfiles b/slapd.tmpfiles index 56aa32e..634cea1 100644 --- a/slapd.tmpfiles +++ b/slapd.tmpfiles @@ -1,2 +1,2 @@ # openldap runtime directory for slapd.arg and slapd.pid -d /var/run/openldap 0755 ldap ldap - +d /run/openldap 0755 ldap ldap - diff --git a/sources b/sources index c9ef3a9..0b0bd67 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.46.tgz) = eef39d43f04aa09c657a1422cefef060fe00368559ae40d0d97536c08ebeaaa1ab06207b3f121ba6afcde54abdc550027c3505e5217e5fd47ae6f8c001260186 +SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc +SHA512 (openldap-2.6.10.tgz) = 18129ad9a385457941e3203de5f130fe2571701abf24592c5beffb01361aae3182c196b2cd48ffeecb792b9b0e5f82c8d92445a7ec63819084757bdedba63b20 diff --git a/tests/smoke-test/Makefile b/tests/smoke-test/Makefile index 5a549be..322f5a5 100644 --- a/tests/smoke-test/Makefile +++ b/tests/smoke-test/Makefile @@ -46,7 +46,7 @@ clean: include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile - @echo "Owner: Ondrej Moris " > $(METADATA) + @echo "Owner: Viktor Ashirov " > $(METADATA) @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) @@ -57,25 +57,23 @@ $(METADATA): Makefile @echo "Requires: openldap" >> $(METADATA) @echo "Requires: openldap-clients" >> $(METADATA) @echo "Requires: openldap-servers" >> $(METADATA) + @echo "Requires: nss-devel" >> $(METADATA) + @echo "Requires: cracklib-devel" >> $(METADATA) @echo "Requires: cyrus-sasl-devel" >> $(METADATA) @echo "Requires: gdbm-devel" >> $(METADATA) - @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: groff" >> $(METADATA) @echo "Requires: krb5-devel" >> $(METADATA) + @echo "Requires: libdb-devel" >> $(METADATA) + @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: libtool-ltdl-devel" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) @echo "Requires: openssl-devel" >> $(METADATA) @echo "Requires: pam-devel" >> $(METADATA) @echo "Requires: perl" >> $(METADATA) - @echo "Requires: pkgconfig" >> $(METADATA) - @echo "Requires: tcp_wrappers-devel" >> $(METADATA) - @echo "Requires: bind-libbind-devel" >> $(METADATA) - @echo "Requires: unixODBC-devel" >> $(METADATA) - @echo "Requires: libtool-ltdl-devel" >> $(METADATA) - @echo "Requires: nfs-utils" >> $(METADATA) - @echo "Requires: rpm-build" >> $(METADATA) - @echo "Requires: nss-devel" >> $(METADATA) - @echo "Requires: libdb-devel" >> $(METADATA) - @echo "Requires: groff" >> $(METADATA) - @echo "Requires: cracklib-devel" >> $(METADATA) @echo "Requires: perl-ExtUtils-Embed" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Requires: rpm-build" >> $(METADATA) + @echo "Requires: unixODBC-devel" >> $(METADATA) @echo "Requires: yum-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/tests/smoke-test/main.fmf b/tests/smoke-test/main.fmf new file mode 100644 index 0000000..cc59f6b --- /dev/null +++ b/tests/smoke-test/main.fmf @@ -0,0 +1,31 @@ +summary: Test calls upstream test suite +description: Test calls upstream test suite +contact: Viktor Ashirov +component: + - openldap +test: ./runtest.sh +framework: beakerlib +recommend: + - openldap + - openldap-clients + - openldap-servers + - cracklib-devel + - cyrus-sasl-devel + - gdbm-devel + - groff + - krb5-devel + - libdb-devel + - libtool + - libtool-ltdl-devel + - nfs-utils + - nss-devel + - openssl-devel + - pam-devel + - perl + - perl-ExtUtils-Embed + - pkgconf-pkg-config + - pkgconfig + - rpm-build + - unixODBC-devel + - yum-utils +duration: 3h diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh index 63c8ccc..bd1ebe6 100755 --- a/tests/smoke-test/runtest.sh +++ b/tests/smoke-test/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="openldap" @@ -45,58 +44,46 @@ PACKAGES=("openldap" \ "unixODBC-devel" \ "libtool-ltdl-devel" \ "nfs-utils" \ - "rpm-build" ) + "rpm-build" \ + "nss-devel" \ + "libdb-devel" \ + "groff" \ + "cracklib-devel" \ + "perl-ExtUtils-Embed"\ + "pkgconf-pkg-config" ) -if rlIsRHEL 5; then - PACKAGES=( ${PACKAGES[@]} "bind-libbind-devel" ) -elif rlIsRHEL 6; then - PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" ) -else - PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" "nss-devel" "libdb-devel" "groff" "cracklib-devel" "perl-ExtUtils-Embed" ) -fi -if rlIsFedora; then - PACKAGES=( ${PACKAGES[@]} "pkgconf-pkg-config" ) -else - PACKAGES=( ${PACKAGES[@]} "pkgconfig" ) -fi - -if rlIsRHEL 5; then - LDAP_SERVICE='ldap' -else - LDAP_SERVICE='slapd' -fi +LDAP_SERVICE='slapd' rlJournalStart rlPhaseStartSetup "General Setup" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "TmpDir=$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" - + for P in "${PACKAGES[@]}"; do rlCheckRpm $P || rlDie; done rlFetchSrcForInstalled $PACKAGE rlRun "yum-builddep -y openldap*src.rpm" 0 rlRun "rpm -ihv *.rpm" 0 - rlServiceStop $LDAP_SERVICE + rlServiceStop $LDAP_SERVICE rlPhaseEnd rlPhaseStartTest - TOPDIR=`rpm --eval %_topdir` + TOPDIR=$(rpm --eval %_topdir) rlRun "pushd $TOPDIR" 0 rlRun "rpmbuild -vv -bc SPECS/openldap.spec >build.log 2>&1" 0 [[ $? -ne 0 ]] && cat build.log - VERSION=`rpm -q --qf "%{VERSION}\n" openldap | tail -1` - rlRun "pushd BUILD/openldap-${VERSION}/openldap-${VERSION}" 0 + VERSION=$(rpm -q --qf "%{VERSION}\n" openldap | tail -1) + rlRun "pushd BUILD/openldap-${VERSION}-build/openldap-${VERSION}/openldap-${VERSION}" 0 # workaround for failing test, it tests unsupported configuration # see http://www.openldap.org/lists/openldap-technical/201204/msg00080.html for upstream reply # change of check after test is not enough because run of all tests with hdb is skipped if test058 fails with bdb - rm -f tests/scripts/test058-syncrepl-asymmetric - rlIsRHEL 5 6 && rlRun "pushd build-servers" 0 + #rm -f tests/scripts/test058-syncrepl-asymmetric rlRun "make check > make_check.out 2>&1" 0 @@ -107,15 +94,14 @@ rlJournalStart rlAssertNotGrep "failed" make_check.results - rlIsRHEL 5 6 && rlRun "popd" 0 rlRun "popd" 0 rlRun "popd" 0 rlPhaseEnd rlPhaseStartCleanup - rlServiceRestore $LDAP_SERVICE - rlRun "rm -rf BUILD/opendap-`rpm -q --qf "%{VERSION}" openldap`" 0 + rlServiceRestore $LDAP_SERVICE + rlRun "rm -rf BUILD/opendap-$(rpm -q --qf "%{VERSION}" openldap)" 0 rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index b1b1905..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,34 +0,0 @@ ---- -# Tests that run in all contexts -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - smoke-test - required_packages: - - openldap # Required for smoke-test - - openldap-clients # Required for smoke-test - - openldap-servers # Required for smoke-test - - cyrus-sasl-devel # Required for smoke-test - - gdbm-devel # Required for smoke-test - - libtool # Required for smoke-test - - krb5-devel # Required for smoke-test - - openssl-devel # Required for smoke-test - - pam-devel # Required for smoke-test - - perl # Required for smoke-test - - pkgconfig # Required for smoke-test - - tcp_wrappers-devel # Required for smoke-test - - bind-libbind-devel # Required for smoke-test - - unixODBC-devel # Required for smoke-test - - nfs-utils # Required for smoke-test - - rpm-build # Required for smoke-test - - nss-devel # Required for smoke-test - - libdb-devel # Required for smoke-test - - groff # Required for smoke-test - - cracklib-devel # Required for smoke-test - - perl-ExtUtils-Embed # Required for smoke-test - - yum-utils # Required for smoke-test - - libtool-ltdl-devel # Required for smoke-test - - wget # Required for smoke-test