From 50d73564a7582613ece68f42e2bcc706ce7b627c Mon Sep 17 00:00:00 2001 From: Bruno Goncalves Date: Mon, 16 Oct 2017 10:49:32 +0200 Subject: [PATCH 001/118] Add CI tests using the standard test interface --- tests/smoke-test/Makefile | 85 ++++++++++++++++++++++++ tests/smoke-test/PURPOSE | 3 + tests/smoke-test/runtest.sh | 126 ++++++++++++++++++++++++++++++++++++ tests/tests.yml | 34 ++++++++++ 4 files changed, 248 insertions(+) create mode 100644 tests/smoke-test/Makefile create mode 100644 tests/smoke-test/PURPOSE create mode 100755 tests/smoke-test/runtest.sh create mode 100644 tests/tests.yml diff --git a/tests/smoke-test/Makefile b/tests/smoke-test/Makefile new file mode 100644 index 0000000..5a549be --- /dev/null +++ b/tests/smoke-test/Makefile @@ -0,0 +1,85 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/openldap/Sanity/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/openldap/Sanity/smoke-test +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Ondrej Moris " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test calls upstream test suite." >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 3h" >> $(METADATA) + @echo "RunFor: openldap" >> $(METADATA) + @echo "Requires: openldap" >> $(METADATA) + @echo "Requires: openldap-clients" >> $(METADATA) + @echo "Requires: openldap-servers" >> $(METADATA) + @echo "Requires: cyrus-sasl-devel" >> $(METADATA) + @echo "Requires: gdbm-devel" >> $(METADATA) + @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: krb5-devel" >> $(METADATA) + @echo "Requires: openssl-devel" >> $(METADATA) + @echo "Requires: pam-devel" >> $(METADATA) + @echo "Requires: perl" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Requires: tcp_wrappers-devel" >> $(METADATA) + @echo "Requires: bind-libbind-devel" >> $(METADATA) + @echo "Requires: unixODBC-devel" >> $(METADATA) + @echo "Requires: libtool-ltdl-devel" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) + @echo "Requires: rpm-build" >> $(METADATA) + @echo "Requires: nss-devel" >> $(METADATA) + @echo "Requires: libdb-devel" >> $(METADATA) + @echo "Requires: groff" >> $(METADATA) + @echo "Requires: cracklib-devel" >> $(METADATA) + @echo "Requires: perl-ExtUtils-Embed" >> $(METADATA) + @echo "Requires: yum-utils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/smoke-test/PURPOSE b/tests/smoke-test/PURPOSE new file mode 100644 index 0000000..1571314 --- /dev/null +++ b/tests/smoke-test/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/openldap/Sanity/smoke-test +Description: Test calls upstream test suite. +Author: Ondrej Moris diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh new file mode 100755 index 0000000..63c8ccc --- /dev/null +++ b/tests/smoke-test/runtest.sh @@ -0,0 +1,126 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openldap/Sanity/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="openldap" + +PACKAGES=("openldap" \ + "openldap-clients" \ + "openldap-servers" \ + "cyrus-sasl-devel" \ + "gdbm-devel" \ + "libtool" \ + "krb5-devel" \ + "openssl-devel" \ + "pam-devel" \ + "perl" \ + "unixODBC-devel" \ + "libtool-ltdl-devel" \ + "nfs-utils" \ + "rpm-build" ) + +if rlIsRHEL 5; then + PACKAGES=( ${PACKAGES[@]} "bind-libbind-devel" ) +elif rlIsRHEL 6; then + PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" ) +else + PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" "nss-devel" "libdb-devel" "groff" "cracklib-devel" "perl-ExtUtils-Embed" ) +fi +if rlIsFedora; then + PACKAGES=( ${PACKAGES[@]} "pkgconf-pkg-config" ) +else + PACKAGES=( ${PACKAGES[@]} "pkgconfig" ) +fi + +if rlIsRHEL 5; then + LDAP_SERVICE='ldap' +else + LDAP_SERVICE='slapd' +fi + +rlJournalStart + + rlPhaseStartSetup "General Setup" + + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + + for P in "${PACKAGES[@]}"; do rlCheckRpm $P || rlDie; done + + rlFetchSrcForInstalled $PACKAGE + rlRun "yum-builddep -y openldap*src.rpm" 0 + rlRun "rpm -ihv *.rpm" 0 + + rlServiceStop $LDAP_SERVICE + + rlPhaseEnd + + rlPhaseStartTest + + TOPDIR=`rpm --eval %_topdir` + rlRun "pushd $TOPDIR" 0 + + rlRun "rpmbuild -vv -bc SPECS/openldap.spec >build.log 2>&1" 0 + [[ $? -ne 0 ]] && cat build.log + VERSION=`rpm -q --qf "%{VERSION}\n" openldap | tail -1` + rlRun "pushd BUILD/openldap-${VERSION}/openldap-${VERSION}" 0 + # workaround for failing test, it tests unsupported configuration + # see http://www.openldap.org/lists/openldap-technical/201204/msg00080.html for upstream reply + # change of check after test is not enough because run of all tests with hdb is skipped if test058 fails with bdb + rm -f tests/scripts/test058-syncrepl-asymmetric + rlIsRHEL 5 6 && rlRun "pushd build-servers" 0 + + rlRun "make check > make_check.out 2>&1" 0 + + grep ">>>>" make_check.out > make_check.results + cat make_check.out + echo -e "\n\nResults:\n\n" + cat make_check.results + + rlAssertNotGrep "failed" make_check.results + + rlIsRHEL 5 6 && rlRun "popd" 0 + rlRun "popd" 0 + rlRun "popd" 0 + rlPhaseEnd + + rlPhaseStartCleanup + + rlServiceRestore $LDAP_SERVICE + rlRun "rm -rf BUILD/opendap-`rpm -q --qf "%{VERSION}" openldap`" 0 + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + + rlPhaseEnd + +rlJournalPrintText + +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..b1b1905 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,34 @@ +--- +# Tests that run in all contexts +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - smoke-test + required_packages: + - openldap # Required for smoke-test + - openldap-clients # Required for smoke-test + - openldap-servers # Required for smoke-test + - cyrus-sasl-devel # Required for smoke-test + - gdbm-devel # Required for smoke-test + - libtool # Required for smoke-test + - krb5-devel # Required for smoke-test + - openssl-devel # Required for smoke-test + - pam-devel # Required for smoke-test + - perl # Required for smoke-test + - pkgconfig # Required for smoke-test + - tcp_wrappers-devel # Required for smoke-test + - bind-libbind-devel # Required for smoke-test + - unixODBC-devel # Required for smoke-test + - nfs-utils # Required for smoke-test + - rpm-build # Required for smoke-test + - nss-devel # Required for smoke-test + - libdb-devel # Required for smoke-test + - groff # Required for smoke-test + - cracklib-devel # Required for smoke-test + - perl-ExtUtils-Embed # Required for smoke-test + - yum-utils # Required for smoke-test + - libtool-ltdl-devel # Required for smoke-test + - wget # Required for smoke-test From 031e2b95cc7ebc4a78821001b16ad3c06de08204 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Tue, 31 Oct 2017 23:21:05 +0100 Subject: [PATCH 002/118] Do not call deleted script from %post section Commit b730f13ce0e8d13d2f0b94b3bee19e4457da5576 deleted certificate generation scripts, but create_certdb.sh was still called from %post section. --- openldap.spec | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/openldap.spec b/openldap.spec index 12df3b8..238c8a6 100644 --- a/openldap.spec +++ b/openldap.spec @@ -342,12 +342,7 @@ rm -f %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ rm -f %{buildroot}%{_localstatedir}/openldap-data/DB_CONFIG.example rmdir %{buildroot}%{_localstatedir}/openldap-data -%post - -/sbin/ldconfig - -# create certificate database -%{_libexecdir}/openldap/create-certdb.sh >&/dev/null || : +%post -p /sbin/ldconfig %postun -p /sbin/ldconfig From a33df4e168cf648692d9fb164170c438f6cbec46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Thu, 2 Feb 2017 15:27:22 +0100 Subject: [PATCH 003/118] Build with OpenSSL with MozNSS compatibility layer Resolves: #1400570 --- openldap-autoconf-pkgconfig-nss.patch | 49 - openldap-doc1.patch | 36 - openldap-doc2.patch | 27 - openldap-loglevel2bvarray.patch | 27 - ...p-nss-allow-certname-with-token-name.patch | 47 - ...p-nss-certs-from-certdb-fallback-pem.patch | 86 - openldap-nss-cipher-attributes.patch | 95 - openldap-nss-ciphers-definitions.patch | 139 -- openldap-nss-ciphers-parsing.patch | 196 -- openldap-nss-ciphers-use-nss-defaults.patch | 27 - ...default-cipher-suite-always-selected.patch | 34 - openldap-nss-ignore-certdb-type-prefix.patch | 47 - openldap-nss-multiple-tls-contexts.patch | 1029 ---------- openldap-nss-pk11-freeslot.patch | 23 - openldap-nss-protocol-version-new-api.patch | 71 - ...p-nss-regex-search-hashed-cacert-dir.patch | 91 - openldap-tls-no-reuse-of-tls_session.patch | 92 - openldap-tlsmc.patch | 1776 +++++++++++++++++ openldap.spec | 44 +- 19 files changed, 1787 insertions(+), 2149 deletions(-) delete mode 100644 openldap-autoconf-pkgconfig-nss.patch delete mode 100644 openldap-doc1.patch delete mode 100644 openldap-doc2.patch delete mode 100644 openldap-loglevel2bvarray.patch delete mode 100644 openldap-nss-allow-certname-with-token-name.patch delete mode 100644 openldap-nss-certs-from-certdb-fallback-pem.patch delete mode 100644 openldap-nss-cipher-attributes.patch delete mode 100644 openldap-nss-ciphers-definitions.patch delete mode 100644 openldap-nss-ciphers-parsing.patch delete mode 100644 openldap-nss-ciphers-use-nss-defaults.patch delete mode 100644 openldap-nss-default-cipher-suite-always-selected.patch delete mode 100644 openldap-nss-ignore-certdb-type-prefix.patch delete mode 100644 openldap-nss-multiple-tls-contexts.patch delete mode 100644 openldap-nss-pk11-freeslot.patch delete mode 100644 openldap-nss-protocol-version-new-api.patch delete mode 100644 openldap-nss-regex-search-hashed-cacert-dir.patch delete mode 100644 openldap-tls-no-reuse-of-tls_session.patch create mode 100644 openldap-tlsmc.patch diff --git a/openldap-autoconf-pkgconfig-nss.patch b/openldap-autoconf-pkgconfig-nss.patch deleted file mode 100644 index 8b4bb19..0000000 --- a/openldap-autoconf-pkgconfig-nss.patch +++ /dev/null @@ -1,49 +0,0 @@ -Use pkg-config for Mozilla NSS library detection - -Author: Jan Vcelak - ---- - configure.in | 22 +++++----------------- - 1 file changed, 5 insertions(+), 17 deletions(-) - -diff --git a/configure.in b/configure.in -index ecffe30..2a9cfb4 100644 ---- a/configure.in -+++ b/configure.in -@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then - fi - fi - --dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3 --dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs --dnl are not in the default system location - if test $ol_link_tls = no ; then - if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then -- have_moznss=no -- AC_CHECK_HEADERS([nssutil.h]) -- if test "$ac_cv_header_nssutil_h" = yes ; then -- AC_CHECK_LIB([nss3], [NSS_Initialize], -- [ have_moznss=yes ], [ have_moznss=no ]) -- fi -+ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no]) - -- if test "$have_moznss" = yes ; then -+ if test $have_moznss = yes ; then - ol_with_tls=moznss - ol_link_tls=yes -- AC_DEFINE(HAVE_MOZNSS, 1, -- [define if you have MozNSS]) -- TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4" -- else -- if test $ol_with_tls = moznss ; then -- AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)]) -- fi -+ AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS]) -+ TLS_LIBS="$MOZNSS_LIBS" -+ CFLAGS="$CFLAGS $MOZNSS_CFLAGS" - fi - fi - fi --- -1.7.11.7 - diff --git a/openldap-doc1.patch b/openldap-doc1.patch deleted file mode 100644 index 13c4c41..0000000 --- a/openldap-doc1.patch +++ /dev/null @@ -1,36 +0,0 @@ -Upstream ITS: #7568 - -From 6be982c000133ccf9da949d39eed23a93bc7bfc5 Mon Sep 17 00:00:00 2001 -From: Jan Synacek -Date: Tue, 9 Apr 2013 12:41:38 +0200 -Subject: [PATCH 1/2] Fix typos in ldap.conf.5 - ---- - doc/man/man5/ldap.conf.5 | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index cfde143..8f7fecd 100644 ---- a/doc/man/man5/ldap.conf.5 -+++ b/doc/man/man5/ldap.conf.5 -@@ -297,7 +297,7 @@ Specifies if GSSAPI encryption (GSS_C_INTEG_FLAG and GSS_C_CONF_FLAG) - should be used. The default is off. - .TP - .B GSSAPI_ALLOW_REMOTE_PRINCIPAL --Specifies if GSSAPI based authentification should try to form the -+Specifies if GSSAPI based authentication should try to form the - target principal name out of the ldapServiceName or dnsHostName - attribute of the targets RootDSE entry. The default is off. - .SH TLS OPTIONS -@@ -354,7 +354,7 @@ it is of critical importance that the key file is protected carefully. - When using Mozilla NSS, TLS_KEY specifies the name of a file that contains - the password for the key for the certificate specified with TLS_CERT. The - modutil command can be used to turn off password protection for the cert/key --database. For example, if TLS_CACERTDIR specifes /home/scarter/.moznss as -+database. For example, if TLS_CACERTDIR specifies /home/scarter/.moznss as - the location of the cert/key database, use modutil to change the password - to the empty string: - .nf --- -1.8.1.4 - diff --git a/openldap-doc2.patch b/openldap-doc2.patch deleted file mode 100644 index 47b1c13..0000000 --- a/openldap-doc2.patch +++ /dev/null @@ -1,27 +0,0 @@ -Upstream ITS: #7568 - -From 05c726c62785b2c307f9c5343a253d43ec7322c6 Mon Sep 17 00:00:00 2001 -From: Jan Synacek -Date: Tue, 9 Apr 2013 12:42:31 +0200 -Subject: [PATCH 2/2] Add -Q to slaptest's help - ---- - servers/slapd/slapcommon.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/servers/slapd/slapcommon.c b/servers/slapd/slapcommon.c -index 714e2bc..153310f 100644 ---- a/servers/slapd/slapcommon.c -+++ b/servers/slapd/slapcommon.c -@@ -92,7 +92,7 @@ usage( int tool, const char *progname ) - break; - - case SLAPTEST: -- options = " [-n databasenumber] [-u]\n"; -+ options = " [-n databasenumber] [-u] [-Q]\n"; - break; - - case SLAPSCHEMA: --- -1.8.1.4 - diff --git a/openldap-loglevel2bvarray.patch b/openldap-loglevel2bvarray.patch deleted file mode 100644 index 1a0e766..0000000 --- a/openldap-loglevel2bvarray.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 4313b91b0bc2fe6585656cd69a03f9755b5af3c4 Mon Sep 17 00:00:00 2001 -From: Jan Synacek -Date: Wed, 29 May 2013 10:21:40 +0200 -Subject: [PATCH] Fix loglevel2bvarray - ---- - servers/slapd/bconfig.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c -index 4e1f1b5..def6daf 100644 ---- a/servers/slapd/bconfig.c -+++ b/servers/slapd/bconfig.c -@@ -3622,6 +3622,10 @@ loglevel2bvarray( int l, BerVarray *bva ) - loglevel_init(); - } - -+ if ( l == 0 ) { -+ return value_add_one( bva, ber_bvstr( "0" ) ); -+ } -+ - return mask_to_verbs( loglevel_ops, l, bva ); - } - --- -1.8.1.4 - diff --git a/openldap-nss-allow-certname-with-token-name.patch b/openldap-nss-allow-certname-with-token-name.patch deleted file mode 100644 index a75e84f..0000000 --- a/openldap-nss-allow-certname-with-token-name.patch +++ /dev/null @@ -1,47 +0,0 @@ -Accept nss certificate name in the form of tokenname:certnickname - -Author: Rich Megginson -Upstream ITS: #7360 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 5022efb..7377bb1 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2102,6 +2102,22 @@ tlsm_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - return 0; - } - -+/* returns true if the given string looks like -+ "tokenname" ":" "certnickname" -+ This is true if there is a ':' colon character -+ in the string and the colon is not the first -+ or the last character in the string -+*/ -+static int -+tlsm_is_tokenname_certnick( const char *certfile ) -+{ -+ if ( certfile ) { -+ const char *ptr = PL_strchr( certfile, ':' ); -+ return ptr && (ptr != certfile) && (*(ptr+1)); -+ } -+ return 0; -+} -+ - static int - tlsm_deferred_ctx_init( void *arg ) - { -@@ -2268,7 +2284,10 @@ tlsm_deferred_ctx_init( void *arg ) - } else { - char *tmp_certname; - -- if (ctx->tc_certdb_slot) { -+ if (tlsm_is_tokenname_certnick(lt->lt_certfile)) { -+ /* assume already in form tokenname:certnickname */ -+ tmp_certname = PL_strdup(lt->lt_certfile); -+ } else if (ctx->tc_certdb_slot) { - tmp_certname = PR_smprintf(TLSM_CERTDB_DESC_FMT ":%s", ctx->tc_unique, lt->lt_certfile); - } else { - tmp_certname = PR_smprintf("%s", lt->lt_certfile); --- -1.7.11.4 - diff --git a/openldap-nss-certs-from-certdb-fallback-pem.patch b/openldap-nss-certs-from-certdb-fallback-pem.patch deleted file mode 100644 index d20e48a..0000000 --- a/openldap-nss-certs-from-certdb-fallback-pem.patch +++ /dev/null @@ -1,86 +0,0 @@ -MozNSS: load certificates from certdb, fallback to PEM - -If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS -certificate database, the backend assumed that the certificate is always -located in the certificate database. This assumption might be wrong. - -This patch makes the library to try to load the certificate from NSS -database and fallback to PEM file if unsuccessfull. - -Author: Jan Vcelak -Upstream ITS: #7389 -Resolves: #857455 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 6847bea..8339391 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx ) - /* prefer unlocked key, then key from opened certdb, then any other */ - if ( unlocked_key ) - ctx->tc_private_key = unlocked_key; -- else if ( ctx->tc_certdb_slot ) -+ else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem ) - ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg ); - else - ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg ); -@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg ) - } - return -1; - } -- -- ctx->tc_using_pem = PR_TRUE; - } - - NSS_SetDomesticPolicy(); -@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg ) - - /* set up our cert and key, if any */ - if ( lt->lt_certfile ) { -- /* if using the PEM module, load the PEM file specified by lt_certfile */ -- /* otherwise, assume this is the name of a cert already in the db */ -- if ( ctx->tc_using_pem ) { -- /* this sets ctx->tc_certificate to the correct value */ -- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ); -- if ( rc ) { -- return rc; -- } -- } else { -+ -+ /* first search in certdb (lt_certfile is nickname) */ -+ if ( ctx->tc_certdb ) { - char *tmp_certname; - - if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) { -@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg ) - Debug( LDAP_DEBUG_ANY, - "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n", - lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ } -+ } -+ -+ /* fallback to PEM module (lt_certfile is filename) */ -+ if ( !ctx->tc_certificate ) { -+ if ( !pem_module && tlsm_init_pem_module() ) { -+ int pem_errcode = PORT_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n", -+ pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - return -1; - } -+ -+ /* this sets ctx->tc_certificate to the correct value */ -+ if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) { -+ ctx->tc_using_pem = PR_TRUE; -+ } -+ } -+ -+ if ( ctx->tc_certificate ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile, -+ ctx->tc_using_pem ? "PEM file" : "moznss database", 0); -+ } else { -+ return -1; - } - } - diff --git a/openldap-nss-cipher-attributes.patch b/openldap-nss-cipher-attributes.patch deleted file mode 100644 index ad15aea..0000000 --- a/openldap-nss-cipher-attributes.patch +++ /dev/null @@ -1,95 +0,0 @@ -Update MozNSS cipher attributes definitions - -Author: Matus Honek -PreviousAuthor: Jan Vcelak - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -210,27 +210,44 @@ typedef struct { - int num; /* The cipher id */ - int attr; /* cipher attributes: algorithms, etc */ - int version; /* protocol version valid for this cipher */ -- int bits; /* bits of strength */ -- int alg_bits; /* bits of the algorithm */ - int strength; /* LOW, MEDIUM, HIGH */ - int enabled; /* Enabled by default? */ - } cipher_properties; - - /* cipher attributes */ --#define SSL_kRSA 0x00000001L --#define SSL_aRSA 0x00000002L --#define SSL_aDSS 0x00000004L --#define SSL_DSS SSL_aDSS --#define SSL_eNULL 0x00000008L --#define SSL_DES 0x00000010L --#define SSL_3DES 0x00000020L --#define SSL_RC4 0x00000040L --#define SSL_RC2 0x00000080L --#define SSL_AES 0x00000100L --#define SSL_MD5 0x00000200L --#define SSL_SHA1 0x00000400L --#define SSL_SHA SSL_SHA1 --#define SSL_RSA (SSL_kRSA|SSL_aRSA) -+#define SSL_kRSA 0x00000001L -+#define SSL_aRSA 0x00000002L -+#define SSL_aDSA 0x00000004L -+#define SSL_DSA SSL_aDSA -+#define SSL_eNULL 0x00000008L -+#define SSL_DES 0x00000010L -+#define SSL_3DES 0x00000020L -+#define SSL_RC4 0x00000040L -+#define SSL_RC2 0x00000080L -+#define SSL_AES128 0x00000100L -+#define SSL_AES256 0x00000200L -+#define SSL_MD5 0x00000400L -+#define SSL_SHA1 0x00000800L -+#define SSL_kEDH 0x00001000L -+#define SSL_CAMELLIA128 0x00002000L -+#define SSL_CAMELLIA256 0x00004000L -+#define SSL_SEED 0x00008000L -+#define SSL_kECDH 0x00010000L -+#define SSL_kECDHE 0x00020000L -+#define SSL_aECDSA 0x00040000L -+#define SSL_SHA256 0x00080000L -+#define SSL_SHA384 0x00100000L -+#define SSL_kEECDH 0x00200000L -+#define SSL_AESGCM 0x00400000L -+#define SSL_AEAD 0x00800000L -+#define SSL_aPSK 0x01000000L -+#define SSL_CHACHA20POLY1305 0x02000000L -+ -+/* cipher attributes non-unique - do not use for definitions */ -+#define SSL_RSA 0x00000001L -+#define SSL_AES 0x00000002L -+#define SSL_CAMELLIA 0x00000004L -+#define SSL_ECDH 0x00000008L - - /* cipher strength */ - #define SSL_NULL 0x00000001L -@@ -240,10 +257,15 @@ typedef struct { - #define SSL_MEDIUM 0x00000010L - #define SSL_HIGH 0x00000020L - -+/* cipher strengths non-unique - do not use for definitions */ -+#define SSL_EXPORT 0x00000001L -+ - #define SSL2 0x00000001L - #define SSL3 0x00000002L - /* OpenSSL treats SSL3 and TLSv1 the same */ - #define TLS1 SSL3 -+#define TLS1_2 0x00000004L -+#define TLS1_3 0x00000008L - - /* Cipher translation */ - static cipher_properties ciphers_def[] = { ---- openldap-2.4.40/include/ldap.h 2014-09-19 03:48:49.000000000 +0200 -+++ openldap-2.4.40/include/ldap.h 2014-11-14 09:25:54.560801030 +0100 -@@ -176,6 +176,7 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_0 ((3 << 8) + 1) - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_1 ((3 << 8) + 2) - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 ((3 << 8) + 3) -+#define LDAP_OPT_X_TLS_PROTOCOL_TLS1_3 ((3 << 8) + 4) - - /* OpenLDAP SASL options */ - #define LDAP_OPT_X_SASL_MECH 0x6100 diff --git a/openldap-nss-ciphers-definitions.patch b/openldap-nss-ciphers-definitions.patch deleted file mode 100644 index 6de142c..0000000 --- a/openldap-nss-ciphers-definitions.patch +++ /dev/null @@ -1,139 +0,0 @@ -Update MozNSS definitions of ciphers - -Author: Matus Honek -PreviousAuthor: Jan Vcelak - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -268,29 +268,109 @@ typedef struct { - - /* Cipher translation */ - static cipher_properties ciphers_def[] = { -- /* SSL 2 ciphers */ -- {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED}, -- {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED}, -- {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, -- {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, -- -- /* SSL3 ciphers */ -- {"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, -- {"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED}, -- {"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED}, -- {"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, -- {"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED}, -- {"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED}, -- {"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED}, -+ -+ /* SSLv2 ciphers */ -+ {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, SSL_LOW}, -+ {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH}, -+ {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_MEDIUM}, -+ {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_MEDIUM}, -+ {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_EXPORT40}, -+ {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_EXPORT40}, -+ -+ /* SSLv3 ciphers */ -+ {"NULL-MD5", TLS_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, SSL_NULL}, /* SSL_RSA_WITH_NULL_MD5 */ -+ {"NULL-SHA", TLS_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL}, /* SSL_RSA_WITH_NULL_SHA */ -+ {"DES-CBC-SHA", TLS_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW}, /* SSL_RSA_WITH_DES_CBC_SHA */ -+ {"DES-CBC3-SHA", TLS_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH}, /* SSL_RSA_WITH_3DES_EDE_CBC_SHA */ -+ {"RC4-MD5", TLS_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_MEDIUM}, /* SSL_RSA_WITH_RC4_128_MD5 */ -+ {"RC4-SHA", TLS_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, SSL_MEDIUM}, /* SSL_RSA_WITH_RC4_128_SHA */ -+ {"EXP-RC2-CBC-MD5", TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, SSL_EXPORT40}, /* SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 */ -+ {"EXP-RC4-MD5", TLS_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_EXPORT40}, /* SSL_RSA_EXPORT_WITH_RC4_40_MD5 */ -+ {"EDH-RSA-DES-CBC-SHA", TLS_DHE_RSA_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW}, /* SSL_DHE_RSA_WITH_DES_CBC_SHA */ -+ {"EDH-RSA-DES-CBC3-SHA", TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH}, /* SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA */ -+ {"EDH-DSS-DES-CBC-SHA", TLS_DHE_DSS_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW}, /* SSL_DHE_DSS_WITH_DES_CBC_SHA */ -+ {"EDH-DSS-DES-CBC3-SHA", TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH}, /* SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA */ - - /* TLSv1 ciphers */ -- {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED}, -- {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED}, -- {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED}, -- {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED}, -+ {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, TLS1, SSL_EXPORT56}, -+ {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_EXPORT56}, -+ {"SEED-SHA", TLS_RSA_WITH_SEED_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"CAMELLIA256-SHA", TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"CAMELLIA128-SHA", TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-AES128-SHA", TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-AES256-SHA", TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-CAMELLIA128-SHA", TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-RSA-CAMELLIA256-SHA", TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-RC4-SHA", TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"DHE-DSS-AES128-SHA", TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-AES256-SHA", TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-CAMELLIA128-SHA", TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"DHE-DSS-CAMELLIA256-SHA", TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-RSA-NULL-SHA", TLS_ECDH_RSA_WITH_NULL_SHA, SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDH-RSA-RC4-SHA", TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDH-RSA-DES-CBC3-SHA", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-RSA-AES128-SHA", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-RSA-AES256-SHA", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-ECDSA-NULL-SHA", TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDH-ECDSA-RC4-SHA", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDH-ECDSA-DES-CBC3-SHA", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-ECDSA-AES128-SHA", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDH-ECDSA-AES256-SHA", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-RSA-NULL-SHA", TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDHE-RSA-RC4-SHA", TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDHE-RSA-DES-CBC3-SHA", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-RSA-AES128-SHA", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-RSA-AES256-SHA", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-ECDSA-NULL-SHA", TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL}, -+ {"ECDHE-ECDSA-RC4-SHA", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM}, -+ {"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES128-SHA", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES256-SHA", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH}, -+ -+ // Ciphers commented out are not in NSS yet. -+ -+ {"NULL-SHA256", TLS_RSA_WITH_NULL_SHA256, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA256, TLS1_2, SSL_NULL}, -+ {"AES128-SHA256", TLS_RSA_WITH_AES_128_CBC_SHA256, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"AES256-SHA256", TLS_RSA_WITH_AES_256_CBC_SHA256, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"AES128-GCM-SHA256", TLS_RSA_WITH_AES_128_GCM_SHA256, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"AES256-GCM-SHA384", 0x009d /* TLS_RSA_WITH_AES_256_GCM_SHA384 */, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ {"DHE-RSA-AES256-SHA256", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-RSA-AES128-SHA256", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-RSA-AES128-GCM-SHA256", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"DHE-RSA-AES256-GCM-SHA384", 0x009f /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 */, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ {"DHE-DSS-AES128-SHA256", TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-DSS-AES256-SHA256", TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"DHE-DSS-AES128-GCM-SHA256", TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"DHE-DSS-AES128-GCM-SHA256", 0x00a3 /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 */, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"DHE-DSS-AES128-GCM-SHA384", TLS_DHE_DSS_WITH_AES_128_GCM_SHA384, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ {"ECDHE-ECDSA-AES128-SHA256", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES128-SHA256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA256, TLS1_2, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES128-GCM-SHA256", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES128-GCM-SHA256", TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES256-GCM-SHA384", 0xc02c /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES256-GCM-SHA384", 0xc030 /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 */, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-ECDSA-AES256-SHA384", 0xc024 /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA384, TLS1_2, SSL_HIGH}, -+ {"ECDHE-RSA-AES256-SHA384", 0xc028 /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 */, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA384, TLS1_2, SSL_HIGH}, -+ -+ {"ECDHE-PSK-AES128-GCM-SHA256", 0xd001 /* TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 */, SSL_kECDHE|SSL_aPSK|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-PSK-CHACHA20-POLY1305", 0xccac /* TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kECDHE|SSL_aPSK|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"ECDHE-PSK-AES256-GCM-SHA384", 0xd002 /* TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 */, SSL_kECDHE|SSL_aPSK|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"", 0x00aa /* TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 */, SSL_kEDH|SSL_aPSK|SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"", 0xccad /* TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kEDH|SSL_aPSK|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ {"", 0x00ab /* TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 */, SSL_kEDH|SSL_aPSK|SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"ECDHE-ECDSA-CHACHA20-POLY1305", 0xcca9 /* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kECDHE|SSL_aECDSA|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"ECDHE-RSA-CHACHA20-POLY1305", 0xcca8 /* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kECDHE|SSL_aRSA|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ //{"DHE-RSA-CHACHA20-POLY1305", 0xccaa /* TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */, SSL_kEDH|SSL_aRSA|SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_2, SSL_HIGH}, -+ -+ // TLSv1.3 -+ {"TLS13-AES-128-GCM-SHA256", 0x1301 /* TLS_AES_128_GCM_SHA256 */, SSL_AES128|SSL_AESGCM|SSL_AEAD, TLS1_3, SSL_HIGH}, -+ {"TLS13-AES-256-GCM-SHA384", 0x1302 /* TLS_AES_256_GCM_SHA384 */, SSL_AES256|SSL_AESGCM|SSL_AEAD, TLS1_3, SSL_HIGH}, -+ {"TLS13-CHACHA20-POLY1305-SHA256", 0x1303 /* TLS_CHACHA20_POLY1305_SHA256 */, SSL_CHACHA20POLY1305|SSL_AEAD, TLS1_3, SSL_HIGH}, - }; - - #define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties)) diff --git a/openldap-nss-ciphers-parsing.patch b/openldap-nss-ciphers-parsing.patch deleted file mode 100644 index dd0407b..0000000 --- a/openldap-nss-ciphers-parsing.patch +++ /dev/null @@ -1,196 +0,0 @@ -Update MozNSS OpenSSL-like parsing code - -Author: Matus Honek -PreviousAuthor: Jan Vcelak - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -617,10 +617,12 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - while ((*cipher) && (isspace(*cipher))) - ++cipher; - -- action = 1; - switch(*cipher) { -- case '+': /* Add something */ -- action = 1; -+ case '+': /* Do nothig. NSS does not support ordering. */ -+ Debug( LDAP_DEBUG_ARGS, -+ "TLS: warning: parsing cipher string: ordering is not supported by NSS.\n", -+ 0, 0, 0 ); -+ action = 2; - cipher++; - break; - case '-': /* Subtract something */ -@@ -631,8 +633,8 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - action = -1; - cipher++; - break; -- default: -- /* do nothing */ -+ default: /* Add something */ -+ action = 1; - break; - } - -@@ -666,7 +668,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - } - } else { - int mask = 0; -+ int multi_mask = 0; -+ int negative_mask = 0; - int strength = 0; -+ int multi_strength = 0; - int protocol = 0; - char *c; - -@@ -677,12 +682,21 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - *c++ = '\0'; - } - -- if (!strcmp(cipher, "RSA")) { -- mask |= SSL_RSA; -+ if ((!strcmp(cipher, "RSA")) || (!strcmp(cipher, "kRSA"))) { -+ mask |= SSL_kRSA; -+ } else if (!strcmp(cipher, "aRSA")) { -+ mask |= SSL_aRSA; -+ negative_mask |= SSL_kECDH; - } else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) { - mask |= SSL_eNULL; -+ } else if (!strcmp(cipher, "AES128")) { -+ mask |= SSL_AES128; -+ } else if (!strcmp(cipher, "AES256")) { -+ mask |= SSL_AES256; -+ } else if (!strcmp(cipher, "AESGCM")) { -+ mask |= SSL_AESGCM; - } else if (!strcmp(cipher, "AES")) { -- mask |= SSL_AES; -+ multi_mask |= SSL_AES; - } else if (!strcmp(cipher, "3DES")) { - mask |= SSL_3DES; - } else if (!strcmp(cipher, "DES")) { -@@ -693,26 +707,69 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - mask |= SSL_RC2; - } else if (!strcmp(cipher, "MD5")) { - mask |= SSL_MD5; -+ } else if (!strcmp(cipher, "SHA256")) { -+ mask |= SSL_SHA256; -+ } else if (!strcmp(cipher, "SHA384")) { -+ mask |= SSL_SHA384; - } else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) { - mask |= SSL_SHA1; -+ } else if ((!strcmp(cipher, "EDH")) || (!strcmp(cipher, "DH"))) { -+ mask |= SSL_kEDH; -+ } else if ((!strcmp(cipher, "DSS")) || (!strcmp(cipher, "aDSS"))) { -+ mask |= SSL_aDSA; -+ } else if (!strcmp(cipher, "CAMELLIA128")) { -+ mask |= SSL_CAMELLIA128; -+ } else if (!strcmp(cipher, "CAMELLIA256")) { -+ mask |= SSL_CAMELLIA256; -+ } else if (!strcmp(cipher, "CAMELLIA")) { -+ multi_mask |= SSL_CAMELLIA; -+ } else if (!strcmp(cipher, "SEED")) { -+ mask |= SSL_SEED; -+ } else if (!strcmp(cipher, "kECDHe")) { -+ mask |= SSL_kECDH|SSL_aECDSA; -+ } else if (!strcmp(cipher, "kECDHr")) { -+ mask |= SSL_kECDH|SSL_aRSA; -+ } else if (!strcmp(cipher, "kECDH")) { -+ mask |= SSL_kECDH; -+ } else if (!strcmp(cipher, "aECDH")) { -+ mask |= SSL_kECDH; -+ } else if (!strcmp(cipher, "EECDH")) { -+ mask |= SSL_kECDHE; -+ } else if (!strcmp(cipher, "kEECDH")) { -+ mask |= SSL_kECDHE; -+ } else if (!strcmp(cipher, "ECDHE")) { -+ mask |= SSL_kECDHE; -+ } else if (!strcmp(cipher, "ECDH")) { -+ multi_mask |= SSL_ECDH; -+ } else if ((!strcmp(cipher, "ECDSA")) || (!strcmp(cipher, "aECDSA"))) { -+ mask |= SSL_aECDSA; -+ negative_mask |= SSL_kECDH; -+ } else if (!strcmp(cipher, "PSK")) { -+ mask |= SSL_aPSK; -+ } else if (!strcmp(cipher, "CHACHA20POLY1305")) { -+ mask |= SSL_CHACHA20POLY1305; - } else if (!strcmp(cipher, "SSLv2")) { - protocol |= SSL2; - } else if (!strcmp(cipher, "SSLv3")) { - protocol |= SSL3; - } else if (!strcmp(cipher, "TLSv1")) { - protocol |= TLS1; -+ } else if (!strcmp(cipher, "TLSv1.2")) { -+ protocol |= TLS1_2; -+ } else if (!strcmp(cipher, "TLSv1.3")) { -+ protocol |= TLS1_3; - } else if (!strcmp(cipher, "HIGH")) { - strength |= SSL_HIGH; - } else if (!strcmp(cipher, "MEDIUM")) { - strength |= SSL_MEDIUM; - } else if (!strcmp(cipher, "LOW")) { - strength |= SSL_LOW; -- } else if ((!strcmp(cipher, "EXPORT")) || (!strcmp(cipher, "EXP"))) { -- strength |= SSL_EXPORT40|SSL_EXPORT56; - } else if (!strcmp(cipher, "EXPORT40")) { - strength |= SSL_EXPORT40; - } else if (!strcmp(cipher, "EXPORT56")) { - strength |= SSL_EXPORT56; -+ } else if ((!strcmp(cipher, "EXPORT")) || (!strcmp(cipher, "EXP"))) { -+ multi_strength |= SSL_EXPORT; - } - - if (c) -@@ -720,23 +775,39 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - - } /* while */ - -+ /* NSS does not support ordering */ -+ if (action == 2) -+ continue; -+ - /* If we have a mask, apply it. If not then perhaps they provided - * a specific cipher to enable. -+ * if more than one mask is provided then AND logic applies (to match openssl) - */ -- if (mask || strength || protocol) { -+ if (mask || negative_mask || multi_mask || strength || multi_strength || protocol) { - for (i=0; i -Resolves: #1387868 -Backports: #1245279 #1300701 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -645,7 +645,16 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) - } - } else if (!strcmp(cipher, "DEFAULT")) { - for (i=0; i -Upstream ITS: #7285 -Upstream commit: 2c2bb2e7aee1b2167f383a8344985a1cf66aff3f -Resolves: #828790 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 23d843c..b608551 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2218,12 +2218,13 @@ tlsm_deferred_ctx_init( void *arg ) - return -1; - } - -- if ( lt->lt_ciphersuite && -- tlsm_parse_ciphers( ctx, lt->lt_ciphersuite )) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not set cipher list %s.\n", -- lt->lt_ciphersuite, 0, 0 ); -- return -1; -+ if ( lt->lt_ciphersuite ) { -+ if ( tlsm_parse_ciphers( ctx, lt->lt_ciphersuite ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not set cipher list %s.\n", -+ lt->lt_ciphersuite, 0, 0 ); -+ return -1; -+ } - } else if ( tlsm_parse_ciphers( ctx, "DEFAULT" ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not set cipher list DEFAULT.\n", --- -1.7.10.4 - diff --git a/openldap-nss-ignore-certdb-type-prefix.patch b/openldap-nss-ignore-certdb-type-prefix.patch deleted file mode 100644 index 2fab916..0000000 --- a/openldap-nss-ignore-certdb-type-prefix.patch +++ /dev/null @@ -1,47 +0,0 @@ -MozNSS: ignore certdb database type prefix when checking existence of the directory - -If the certdb is specified including the database type prefix (e.g. -sql:, dbm:), the prefix has to be ignored when checking the -certificate directory existence. - -Author: Jan Vcelak -Upstream ITS: #7388 -Resolves: #857373 - ---- - libraries/libldap/tls_m.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 49a3f8f..5ee21a2 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) - { - char sep = PR_GetDirectorySeparator(); - char *ptr = NULL; -+ char *chkpath = NULL; - struct PRFileInfo prfi; - PRStatus prc; - -@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) - return; - } - -- prc = PR_GetFileInfo( certdir, &prfi ); -+ /* ignore database type prefix (e.g. sql:, dbm:) if provided */ -+ chkpath = strchr( certdir, ':' ); -+ if ( chkpath != NULL ) { -+ chkpath += 1; -+ } else { -+ chkpath = certdir; -+ } -+ - /* if certdir exists (file or directory) then it cannot specify a prefix */ -+ prc = PR_GetFileInfo( chkpath, &prfi ); - if ( prc == PR_SUCCESS ) { - return; - } --- -1.7.11.7 - diff --git a/openldap-nss-multiple-tls-contexts.patch b/openldap-nss-multiple-tls-contexts.patch deleted file mode 100644 index bf008f4..0000000 --- a/openldap-nss-multiple-tls-contexts.patch +++ /dev/null @@ -1,1029 +0,0 @@ -MozNSS: TLS fixes which should resolve problems with applications using multiple TLS contexts - - - context specific token description for certdb - - store certificate object instead of nickname in in ctx - - lock whole init and clenaup process - - do not authenticate to a slot manually - - do not retry when reading the pin from file - -Author: Jan Vcelak -Upstream ITS: #7312 #7313 #7314 #7315 #7316 -Upstream commit: 87132b8 d07779e 3531c34 a171237 2db5195 -Resolves: #795763 (and possibly other) - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 2e755eb..4b5727b 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -81,16 +81,18 @@ - typedef struct tlsm_ctx { - PRFileDesc *tc_model; - int tc_refcnt; -+ int tc_unique; /* unique number associated with this ctx */ - PRBool tc_verify_cert; - CERTCertDBHandle *tc_certdb; -- char *tc_certname; -+ PK11SlotInfo *tc_certdb_slot; -+ CERTCertificate *tc_certificate; -+ SECKEYPrivateKey *tc_private_key; - char *tc_pin_file; - struct ldaptls *tc_config; - int tc_is_server; - int tc_require_cert; - PRCallOnceType tc_callonce; - PRBool tc_using_pem; -- char *tc_slotname; /* if using pem */ - #ifdef HAVE_NSS_INITCONTEXT - NSSInitContext *tc_initctx; /* the NSS context */ - #endif -@@ -104,10 +106,16 @@ typedef struct tlsm_ctx { - - typedef PRFileDesc tlsm_session; - -+static int tlsm_ctx_count; -+#define TLSM_CERTDB_DESC_FMT "ldap(%d)" -+ - static PRDescIdentity tlsm_layer_id; - - static const PRIOMethods tlsm_PR_methods; - -+#define CERTDB_NONE NULL -+#define PREFIX_NONE NULL -+ - #define PEM_LIBRARY "nsspem" - #define PEM_MODULE "PEM" - /* hash files for use with cacertdir have this file name suffix */ -@@ -117,13 +125,11 @@ static const PRIOMethods tlsm_PR_methods; - static SECMODModule *pem_module; - - #define DEFAULT_TOKEN_NAME "default" --/* sprintf format used to create token name */ --#define TLSM_PEM_TOKEN_FMT "PEM Token #%ld" -+#define TLSM_PEM_SLOT_CACERTS "PEM Token #0" -+#define TLSM_PEM_SLOT_CERTS "PEM Token #1" - --static int tlsm_slot_count; -- --#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \ -- (x)->pValue=(v); (x)->ulValueLen = (l); -+#define PK11_SETATTRS(x,id,v,l) (x).type = (id); \ -+ (x).pValue=(v); (x).ulValueLen = (l); - - /* forward declaration */ - static int tlsm_init( void ); -@@ -134,6 +140,7 @@ static int tlsm_init( void ); - tlsm_thr_init in a non-threaded context - so we have - to wrap the mutex creation in a prcallonce - */ -+static ldap_pvt_thread_mutex_t tlsm_ctx_count_mutex; - static ldap_pvt_thread_mutex_t tlsm_init_mutex; - static ldap_pvt_thread_mutex_t tlsm_pem_mutex; - static PRCallOnceType tlsm_init_mutex_callonce = {0,0}; -@@ -141,6 +148,12 @@ static PRCallOnceType tlsm_init_mutex_callonce = {0,0}; - static PRStatus PR_CALLBACK - tlsm_thr_init_callonce( void ) - { -+ if ( ldap_pvt_thread_mutex_init( &tlsm_ctx_count_mutex ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not create mutex for context counter: %d\n", errno, 0, 0 ); -+ return PR_FAILURE; -+ } -+ - if ( ldap_pvt_thread_mutex_init( &tlsm_init_mutex ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not create mutex for moznss initialization: %d\n", errno, 0, 0 ); -@@ -890,6 +903,8 @@ tlsm_get_pin(PK11SlotInfo *slot, PRBool retry, tlsm_ctx *ctx) - */ - if ( ctx->tc_pin_file ) { - pwdstr = tlsm_get_pin_from_file( token_name, ctx ); -+ if (retry && pwdstr != NULL) -+ return NULL; - } - #endif /* RETRIEVE_PASSWORD_FROM_FILE */ - #ifdef READ_PASSWORD_FROM_STDIN -@@ -932,6 +947,15 @@ tlsm_pin_prompt(PK11SlotInfo *slot, PRBool retry, void *arg) - return tlsm_get_pin( slot, retry, ctx ); - } - -+static char * -+tlsm_ctx_subject_name(tlsm_ctx *ctx) -+{ -+ if (!ctx || !ctx->tc_certificate) -+ return "(unknown)"; -+ -+ return ctx->tc_certificate->subjectName; -+} -+ - static SECStatus - tlsm_get_basic_constraint_extension( CERTCertificate *cert, - CERTBasicConstraints *cbcval ) -@@ -1088,25 +1112,6 @@ tlsm_auth_cert_handler(void *arg, PRFileDesc *fd, - return ret; - } - --static int --tlsm_authenticate_to_slot( tlsm_ctx *ctx, PK11SlotInfo *slot ) --{ -- int rc = -1; -- -- if ( SECSuccess != PK11_Authenticate( slot, PR_FALSE, ctx ) ) { -- char *token_name = PK11_GetTokenName( slot ); -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not authenticate to the security token %s - error %d:%s.\n", -- token_name ? token_name : DEFAULT_TOKEN_NAME, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- } else { -- rc = 0; /* success */ -- } -- -- return rc; --} -- - static SECStatus - tlsm_nss_shutdown_cb( void *appData, void *nssData ) - { -@@ -1196,22 +1201,18 @@ tlsm_free_pem_objs( tlsm_ctx *ctx ) - } - - static int --tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca, PRBool istrusted ) -+tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca ) - { -- CK_SLOT_ID slotID; -- PK11SlotInfo *slot = NULL; -- PK11GenericObject *rv; -- CK_ATTRIBUTE *attrs; -- CK_ATTRIBUTE theTemplate[20]; -+ PK11SlotInfo *slot; -+ PK11GenericObject *cert; -+ CK_ATTRIBUTE attrs[4]; - CK_BBOOL cktrue = CK_TRUE; - CK_BBOOL ckfalse = CK_FALSE; - CK_OBJECT_CLASS objClass = CKO_CERTIFICATE; -- char tmpslotname[64]; -- char *slotname = NULL; -- const char *ptr = NULL; -- char sep = PR_GetDirectorySeparator(); -+ char *slotname; - PRFileInfo fi; - PRStatus status; -+ SECItem certDER = { 0, NULL, 0 }; - - memset( &fi, 0, sizeof(fi) ); - status = PR_GetFileInfo( filename, &fi ); -@@ -1232,87 +1233,96 @@ tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca, PRBoo - return -1; - } - -- attrs = theTemplate; -+ slotname = isca ? TLSM_PEM_SLOT_CACERTS : TLSM_PEM_SLOT_CERTS; -+ slot = PK11_FindSlotByName( slotname ); - -- if ( isca ) { -- slotID = 0; /* CA and trust objects use slot 0 */ -- PR_snprintf( tmpslotname, sizeof(tmpslotname), TLSM_PEM_TOKEN_FMT, slotID ); -- slotname = tmpslotname; -- istrusted = PR_TRUE; -- } else { -- if ( ctx->tc_slotname == NULL ) { /* need new slot */ -- if ( istrusted ) { -- slotID = 0; -- } else { -- slotID = ++tlsm_slot_count; -- } -- ctx->tc_slotname = PR_smprintf( TLSM_PEM_TOKEN_FMT, slotID ); -- } -- slotname = ctx->tc_slotname; -- -- if ( ( ptr = PL_strrchr( filename, sep ) ) ) { -- PL_strfree( ctx->tc_certname ); -- ++ptr; -- if ( istrusted ) { -- /* pemnss conflates trusted certs with CA certs - since there can -- be more than one CA cert in a file (e.g. ca-bundle.crt) pemnss -- numbers each trusted cert - in the case of a server cert, there will be -- only one, so it will be number 0 */ -- ctx->tc_certname = PR_smprintf( "%s:%s - 0", slotname, ptr ); -- } else { -- ctx->tc_certname = PR_smprintf( "%s:%s", slotname, ptr ); -- } -- } -+ if ( !slot ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not find the slot for the certificate '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ return -1; - } - -- slot = PK11_FindSlotByName( slotname ); -+ PK11_SETATTRS( attrs[0], CKA_CLASS, &objClass, sizeof(objClass) ); -+ PK11_SETATTRS( attrs[1], CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); -+ PK11_SETATTRS( attrs[2], CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); -+ PK11_SETATTRS( attrs[3], CKA_TRUST, isca ? &cktrue : &ckfalse, sizeof(CK_BBOOL) ); - -- if ( !slot ) { -+ cert = PK11_CreateGenericObject( slot, attrs, 4, PR_FALSE /* isPerm */ ); -+ -+ if ( !cert ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: could not find the slot for certificate %s - error %d:%s.\n", -- ctx->tc_certname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: could not add the certificate '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ PK11_FreeSlot( slot ); - return -1; - } - -- PK11_SETATTRS( attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++; -- PK11_SETATTRS( attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++; -- PK11_SETATTRS( attrs, CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); attrs++; -- if ( istrusted ) { -- PK11_SETATTRS( attrs, CKA_TRUST, &cktrue, sizeof(CK_BBOOL) ); attrs++; -- } else { -- PK11_SETATTRS( attrs, CKA_TRUST, &ckfalse, sizeof(CK_BBOOL) ); attrs++; -+ /* if not CA, we store the certificate in ctx->tc_certificate */ -+ if ( !isca ) { -+ if ( PK11_ReadRawAttribute( PK11_TypeGeneric, cert, CKA_VALUE, &certDER ) != SECSuccess ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not get DER of the '%s' certificate - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ PK11_DestroyGenericObject( cert ); -+ PK11_FreeSlot( slot ); -+ return -1; -+ } -+ -+ ctx->tc_certificate = PK11_FindCertFromDERCertItem( slot, &certDER, NULL ); -+ SECITEM_FreeItem( &certDER, PR_FALSE ); -+ -+ if ( !ctx->tc_certificate ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not get certificate '%s' using DER - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ PK11_DestroyGenericObject( cert ); -+ PK11_FreeSlot( slot ); -+ return -1; -+ } - } -- /* This loads the certificate in our PEM module into the appropriate -- * slot. -- */ -- rv = PK11_CreateGenericObject( slot, theTemplate, 4, PR_FALSE /* isPerm */ ); -+ -+ tlsm_add_pem_obj( ctx, cert ); - - PK11_FreeSlot( slot ); - -- if ( !rv ) { -+ return 0; -+} -+ -+static int -+tlsm_ctx_load_private_key(tlsm_ctx *ctx) -+{ -+ if (!ctx->tc_certificate) -+ return -1; -+ -+ if (ctx->tc_private_key) -+ return 0; -+ -+ void *pin_arg = SSL_RevealPinArg(ctx->tc_model); -+ -+ ctx->tc_private_key = PK11_FindKeyByAnyCert(ctx->tc_certificate, pin_arg); -+ if (!ctx->tc_private_key) { - PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not add the certificate %s - error %d:%s.\n", -- ctx->tc_certname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ Debug(LDAP_DEBUG_ANY, -+ "TLS: cannot find private key for certificate '%s' (error %d: %s)", -+ tlsm_ctx_subject_name(ctx), errcode, -+ PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT)); - return -1; - } - -- tlsm_add_pem_obj( ctx, rv ); -- - return 0; - } - - static int - tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename ) - { -- CK_SLOT_ID slotID; - PK11SlotInfo * slot = NULL; -- PK11GenericObject *rv; -- CK_ATTRIBUTE *attrs; -- CK_ATTRIBUTE theTemplate[20]; -+ PK11GenericObject *key; -+ CK_ATTRIBUTE attrs[3]; - CK_BBOOL cktrue = CK_TRUE; - CK_OBJECT_CLASS objClass = CKO_PRIVATE_KEY; - int retcode = 0; -@@ -1338,48 +1348,40 @@ tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename ) - return -1; - } - -- attrs = theTemplate; -- -- if ( ctx->tc_slotname == NULL ) { /* need new slot */ -- slotID = ++tlsm_slot_count; -- ctx->tc_slotname = PR_smprintf( TLSM_PEM_TOKEN_FMT, slotID ); -- } -- slot = PK11_FindSlotByName( ctx->tc_slotname ); -+ slot = PK11_FindSlotByName( TLSM_PEM_SLOT_CERTS ); - - if ( !slot ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: could not find the slot %s for the private key - error %d:%s.\n", -- ctx->tc_slotname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: could not find the slot for the private key '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); - return -1; - } - -- PK11_SETATTRS( attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++; -- PK11_SETATTRS( attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++; -- PK11_SETATTRS( attrs, CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); attrs++; -- rv = PK11_CreateGenericObject( slot, theTemplate, 3, PR_FALSE /* isPerm */ ); -+ PK11_SETATTRS( attrs[0], CKA_CLASS, &objClass, sizeof(objClass) ); -+ PK11_SETATTRS( attrs[1], CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); -+ PK11_SETATTRS( attrs[2], CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); -+ -+ key = PK11_CreateGenericObject( slot, attrs, 3, PR_FALSE /* isPerm */ ); - -- if ( !rv ) { -+ if ( !key ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: could not add the certificate %s - error %d:%s.\n", -- ctx->tc_certname, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: could not add the private key '%s' - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); - retcode = -1; - } else { -+ tlsm_add_pem_obj( ctx, key ); -+ retcode = 0; -+ - /* When adding an encrypted key the PKCS#11 will be set as removed */ - /* This will force the token to be seen as re-inserted */ - SECMOD_WaitForAnyTokenEvent( pem_module, 0, 0 ); - PK11_IsPresent( slot ); -- retcode = 0; - } - - PK11_FreeSlot( slot ); - -- if ( !retcode ) { -- tlsm_add_pem_obj( ctx, rv ); -- } - return retcode; - } - -@@ -1396,7 +1398,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - } - - if ( cacertfile ) { -- int rc = tlsm_add_cert_from_file( ctx, cacertfile, isca, PR_TRUE ); -+ int rc = tlsm_add_cert_from_file( ctx, cacertfile, isca ); - if ( rc ) { - errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -@@ -1470,7 +1472,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - continue; - } - fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name ); -- if ( !tlsm_add_cert_from_file( ctx, fullpath, isca, PR_TRUE ) ) { -+ if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) { - Debug( LDAP_DEBUG_TRACE, - "TLS: loaded CA certificate file %s from CA certificate directory %s.\n", - fullpath, cacertdir, 0 ); -@@ -1534,6 +1536,45 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) - } - - /* -+ * Currently mutiple MozNSS contexts share one certificate storage. When the -+ * certdb is being opened, only new certificates are added to the storage. -+ * When different databases are used, conflicting nicknames make the -+ * certificate lookup by the nickname impossible. In addition a token -+ * description might be prepended in certain conditions. -+ * -+ * In order to make the certificate lookup by nickname possible, we explicitly -+ * open each database using SECMOD_OpenUserDB and assign it the token -+ * description. The token description is generated using ctx->tc_unique value, -+ * which is unique for each context. -+ */ -+static PK11SlotInfo * -+tlsm_init_open_certdb(tlsm_ctx *ctx, const char *dbdir, const char *prefix) -+{ -+ PK11SlotInfo *slot = NULL; -+ char *token_desc = NULL; -+ char *config = NULL; -+ -+ token_desc = PR_smprintf(TLSM_CERTDB_DESC_FMT, ctx->tc_unique); -+ config = PR_smprintf("configDir='%s' tokenDescription='%s' certPrefix='%s' keyPrefix='%s' flags=readOnly", -+ dbdir, token_desc, prefix, prefix); -+ Debug(LDAP_DEBUG_TRACE, "TLS: certdb config: %s\n", config, 0, 0); -+ -+ slot = SECMOD_OpenUserDB(config); -+ if (!slot) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug(LDAP_DEBUG_TRACE, "TLS: cannot open certdb '%s', error %d:%s\n", dbdir, errcode, -+ PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT)); -+ } -+ -+ if (token_desc) -+ PR_smprintf_free(token_desc); -+ if (config) -+ PR_smprintf_free(config); -+ -+ return slot; -+} -+ -+/* - * This is the part of the init we defer until we get the - * actual security configuration information. This is - * only called once, protected by a PRCallOnce -@@ -1553,6 +1594,7 @@ tlsm_deferred_init( void *arg ) - #ifdef HAVE_NSS_INITCONTEXT - NSSInitParameters initParams; - NSSInitContext *initctx = NULL; -+ PK11SlotInfo *certdb_slot = NULL; - #endif - SECStatus rc; - int done = 0; -@@ -1613,28 +1655,37 @@ tlsm_deferred_init( void *arg ) - } - - tlsm_get_certdb_prefix( securitydir, &realcertdir, &prefix ); -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - -+ /* initialize only moddb; certdb will be initialized explicitly */ - #ifdef HAVE_NSS_INITCONTEXT - #ifdef INITCONTEXT_HACK - if ( !NSS_IsInitialized() && ctx->tc_is_server ) { - rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY ); - } else { - initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB, -- &initParams, NSS_INIT_READONLY ); -- rc = (initctx == NULL) ? SECFailure : SECSuccess; -+ &initParams, NSS_INIT_READONLY|NSS_INIT_NOCERTDB ); - } - #else - initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB, -- &initParams, NSS_INIT_READONLY ); -- rc = (initctx == NULL) ? SECFailure : SECSuccess; -+ &initParams, NSS_INIT_READONLY|NSS_INIT_NOCERTDB ); - #endif -+ rc = SECFailure; -+ -+ if (initctx != NULL) { -+ certdb_slot = tlsm_init_open_certdb(ctx, realcertdir, prefix); -+ if (certdb_slot) { -+ rc = SECSuccess; -+ ctx->tc_initctx = initctx; -+ ctx->tc_certdb_slot = certdb_slot; -+ } else { -+ NSS_ShutdownContext(initctx); -+ initctx = NULL; -+ } -+ } - #else - rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY ); - #endif - -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); -- - if ( rc != SECSuccess ) { - errcode = PORT_GetError(); - if ( securitydirs[ii] != lt->lt_cacertdir) { -@@ -1658,26 +1709,29 @@ tlsm_deferred_init( void *arg ) - } - - if ( errcode ) { /* no moznss db found, or not using moznss db */ -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - #ifdef HAVE_NSS_INITCONTEXT - int flags = NSS_INIT_READONLY|NSS_INIT_NOCERTDB|NSS_INIT_NOMODDB; - #ifdef INITCONTEXT_HACK - if ( !NSS_IsInitialized() && ctx->tc_is_server ) { - rc = NSS_NoDB_Init( NULL ); - } else { -- initctx = NSS_InitContext( "", "", "", SECMOD_DB, -+ initctx = NSS_InitContext( CERTDB_NONE, PREFIX_NONE, PREFIX_NONE, SECMOD_DB, - &initParams, flags ); - rc = (initctx == NULL) ? SECFailure : SECSuccess; - } - #else -- initctx = NSS_InitContext( "", "", "", SECMOD_DB, -+ initctx = NSS_InitContext( CERTDB_NONE, PREFIX_NONE, PREFIX_NONE, SECMOD_DB, - &initParams, flags ); -- rc = (initctx == NULL) ? SECFailure : SECSuccess; -+ if (initctx) { -+ ctx->tc_initctx = initctx; -+ rc = SECSuccess; -+ } else { -+ rc = SECFailure; -+ } - #endif - #else - rc = NSS_NoDB_Init( NULL ); - #endif -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - if ( rc != SECSuccess ) { - errcode = PORT_GetError(); - Debug( LDAP_DEBUG_ANY, -@@ -1685,18 +1739,11 @@ tlsm_deferred_init( void *arg ) - errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - return -1; - } -- --#ifdef HAVE_NSS_INITCONTEXT -- ctx->tc_initctx = initctx; --#endif -- - } - - if ( errcode || lt->lt_cacertfile ) { - /* initialize the PEM module */ -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - if ( tlsm_init_pem_module() ) { -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - int pem_errcode = PORT_GetError(); - Debug( LDAP_DEBUG_ANY, - "TLS: could not initialize moznss PEM module - error %d:%s.\n", -@@ -1708,7 +1755,6 @@ tlsm_deferred_init( void *arg ) - } else if ( !errcode ) { - tlsm_init_ca_certs( ctx, lt->lt_cacertfile, NULL ); - } -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - } - - if ( errcode ) { -@@ -1734,12 +1780,6 @@ tlsm_deferred_init( void *arg ) - ctx->tc_using_pem = PR_TRUE; - } - --#ifdef HAVE_NSS_INITCONTEXT -- if ( !ctx->tc_initctx ) { -- ctx->tc_initctx = initctx; -- } --#endif -- - NSS_SetDomesticPolicy(); - - PK11_SetPasswordFunc( tlsm_pin_prompt ); -@@ -1754,10 +1794,8 @@ tlsm_deferred_init( void *arg ) - } - - if ( ctx->tc_is_server ) { -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - /* 0 means use the defaults here */ - SSL_ConfigServerSessionIDCache( 0, 0, 0, NULL ); -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - } - - #ifndef HAVE_NSS_INITCONTEXT -@@ -1767,137 +1805,34 @@ tlsm_deferred_init( void *arg ) - return 0; - } - --static int --tlsm_authenticate( tlsm_ctx *ctx, const char *certname, const char *pininfo ) --{ -- const char *colon = NULL; -- char *token_name = NULL; -- PK11SlotInfo *slot = NULL; -- int rc = -1; -- -- if ( !certname || !*certname ) { -- return 0; -- } -- -- if ( ( colon = PL_strchr( certname, ':' ) ) ) { -- token_name = PL_strndup( certname, colon-certname ); -- } -- -- if ( token_name ) { -- slot = PK11_FindSlotByName( token_name ); -- } else { -- slot = PK11_GetInternalKeySlot(); -- } -- -- if ( !slot ) { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: could not find the slot for security token %s - error %d:%s.\n", -- token_name ? token_name : DEFAULT_TOKEN_NAME, errcode, -- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- goto done; -- } -- -- rc = tlsm_authenticate_to_slot( ctx, slot ); -- --done: -- PL_strfree( token_name ); -- if ( slot ) { -- PK11_FreeSlot( slot ); -- } -- -- return rc; --} -- - /* - * Find and verify the certificate. -- * Either fd is given, in which case the cert will be taken from it via SSL_PeerCertificate -- * or certname is given, and it will be searched for by name -+ * The key is loaded and stored in ctx->tc_private_key - */ - static int --tlsm_find_and_verify_cert_key(tlsm_ctx *ctx, PRFileDesc *fd, const char *certname, int isServer, CERTCertificate **pRetCert, SECKEYPrivateKey **pRetKey) -+tlsm_find_and_verify_cert_key(tlsm_ctx *ctx) - { -- CERTCertificate *cert = NULL; -- int rc = -1; -- void *pin_arg = NULL; -- SECKEYPrivateKey *key = NULL; -+ SECCertificateUsage certUsage; -+ PRBool checkSig; -+ SECStatus status; -+ int errorToIgnore; -+ void *pin_arg; - -- pin_arg = SSL_RevealPinArg( fd ); -- if ( certname ) { -- cert = PK11_FindCertFromNickname( certname, pin_arg ); -- if ( !cert ) { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: the certificate %s could not be found in the database - error %d:%s\n", -- certname, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- return -1; -- } -- } else { -- /* we are verifying the peer cert -- we also need to swap the isServer meaning */ -- cert = SSL_PeerCertificate( fd ); -- if ( !cert ) { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: could not get the certificate from the peer connection - error %d:%s\n", -- errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), NULL ); -- return -1; -- } -- isServer = !isServer; /* verify the peer's cert instead */ -- } -- -- if ( ctx->tc_slotname ) { -- PK11SlotInfo *slot = PK11_FindSlotByName( ctx->tc_slotname ); -- key = PK11_FindPrivateKeyFromCert( slot, cert, NULL ); -- PK11_FreeSlot( slot ); -- } else { -- key = PK11_FindKeyByAnyCert( cert, pin_arg ); -- } -- -- if (key) { -- SECCertificateUsage certUsage; -- PRBool checkSig = PR_TRUE; -- SECStatus status; -- /* may not have a CA cert - ok - ignore SEC_ERROR_UNKNOWN_ISSUER */ -- int errorToIgnore = SEC_ERROR_UNKNOWN_ISSUER; -+ if (tlsm_ctx_load_private_key(ctx)) -+ return -1; - -- if ( pRetKey ) { -- *pRetKey = key; /* caller will deal with this */ -- } else { -- SECKEY_DestroyPrivateKey( key ); -- } -- if ( isServer ) { -- certUsage = certificateUsageSSLServer; -- } else { -- certUsage = certificateUsageSSLClient; -- } -- if ( ctx->tc_verify_cert ) { -- checkSig = PR_TRUE; -- } else { -- checkSig = PR_FALSE; -- } -- if ( ctx->tc_warn_only ) { -- errorToIgnore = -1; -- } -- status = tlsm_verify_cert( ctx->tc_certdb, cert, pin_arg, -- checkSig, certUsage, errorToIgnore ); -- if ( status == SECSuccess ) { -- rc = 0; -- } -- } else { -- PRErrorCode errcode = PR_GetError(); -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: could not find the private key for certificate %s - error %d:%s\n", -- certname, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -- } -+ pin_arg = SSL_RevealPinArg(ctx->tc_model); -+ certUsage = ctx->tc_is_server ? certificateUsageSSLServer : certificateUsageSSLClient; -+ checkSig = ctx->tc_verify_cert ? PR_TRUE : PR_FALSE; -+ if ( ctx->tc_warn_only ) -+ errorToIgnore = -1; -+ else -+ errorToIgnore = SEC_ERROR_UNKNOWN_ISSUER; /* may not have a CA cert */ - -- if ( pRetCert ) { -- *pRetCert = cert; /* caller will deal with this */ -- } else { -- CERT_DestroyCertificate( cert ); -- } -+ status = tlsm_verify_cert( ctx->tc_certdb, ctx->tc_certificate, pin_arg, -+ checkSig, certUsage, errorToIgnore ); - -- return rc; -+ return status == SECSuccess ? 0 : -1; - } - - static int -@@ -1906,39 +1841,18 @@ tlsm_get_client_auth_data( void *arg, PRFileDesc *fd, - SECKEYPrivateKey **pRetKey ) - { - tlsm_ctx *ctx = (tlsm_ctx *)arg; -- int rc; -- PRBool saveval; - -- /* don't need caNames - this function will call CERT_VerifyCertificateNow -- which will verify the cert against the known CAs */ -- saveval = ctx->tc_warn_only; -- ctx->tc_warn_only = PR_TRUE; -- rc = tlsm_find_and_verify_cert_key( ctx, fd, ctx->tc_certname, 0, pRetCert, pRetKey ); -- ctx->tc_warn_only = saveval; -- if ( rc ) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to perform client certificate authentication for " -- "certificate named %s\n", ctx->tc_certname, 0, 0 ); -- if ( pRetKey && *pRetKey ) { -- SECKEY_DestroyPrivateKey( *pRetKey ); -- *pRetKey = NULL; -- } -- if ( pRetCert && *pRetCert ) { -- CERT_DestroyCertificate( *pRetCert ); -- *pRetCert = NULL; -- } -- return SECFailure; -- } -+ if (pRetCert) -+ *pRetCert = CERT_DupCertificate(ctx->tc_certificate); -+ -+ if (pRetKey) -+ *pRetKey = SECKEY_CopyPrivateKey(ctx->tc_private_key); - - return SECSuccess; - } - - /* - * ctx must have a tc_model that is valid -- * certname is in the form [:] -- * where is the name of the PKCS11 token -- * and is the nickname of the cert/key in -- * the database - */ - static int - tlsm_clientauth_init( tlsm_ctx *ctx ) -@@ -1949,12 +1863,12 @@ tlsm_clientauth_init( tlsm_ctx *ctx ) - - saveval = ctx->tc_warn_only; - ctx->tc_warn_only = PR_TRUE; -- rc = tlsm_find_and_verify_cert_key( ctx, ctx->tc_model, ctx->tc_certname, 0, NULL, NULL ); -+ rc = tlsm_find_and_verify_cert_key(ctx); - ctx->tc_warn_only = saveval; - if ( rc ) { - Debug( LDAP_DEBUG_ANY, - "TLS: error: unable to set up client certificate authentication for " -- "certificate named %s\n", ctx->tc_certname, 0, 0 ); -+ "certificate named %s\n", tlsm_ctx_subject_name(ctx), 0, 0 ); - return -1; - } - -@@ -1972,6 +1886,7 @@ static void - tlsm_destroy( void ) - { - #ifdef LDAP_R_COMPILE -+ ldap_pvt_thread_mutex_destroy( &tlsm_ctx_count_mutex ); - ldap_pvt_thread_mutex_destroy( &tlsm_init_mutex ); - ldap_pvt_thread_mutex_destroy( &tlsm_pem_mutex ); - #endif -@@ -2048,16 +1963,20 @@ tlsm_ctx_new ( struct ldapoptions *lo ) - #ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_init( &ctx->tc_refmutex ); - #endif -+ LDAP_MUTEX_LOCK( &tlsm_ctx_count_mutex ); -+ ctx->tc_unique = tlsm_ctx_count++; -+ LDAP_MUTEX_UNLOCK( &tlsm_ctx_count_mutex ); - ctx->tc_config = NULL; /* populated later by tlsm_ctx_init */ - ctx->tc_certdb = NULL; -- ctx->tc_certname = NULL; -+ ctx->tc_certdb_slot = NULL; -+ ctx->tc_certificate = NULL; -+ ctx->tc_private_key = NULL; - ctx->tc_pin_file = NULL; - ctx->tc_model = NULL; - memset(&ctx->tc_callonce, 0, sizeof(ctx->tc_callonce)); - ctx->tc_require_cert = lo->ldo_tls_require_cert; - ctx->tc_verify_cert = PR_FALSE; - ctx->tc_using_pem = PR_FALSE; -- ctx->tc_slotname = NULL; - #ifdef HAVE_NSS_INITCONTEXT - ctx->tc_initctx = NULL; - #endif /* HAVE_NSS_INITCONTEXT */ -@@ -2090,28 +2009,38 @@ tlsm_ctx_free ( tls_ctx *ctx ) - LDAP_MUTEX_UNLOCK( &c->tc_refmutex ); - if ( refcount ) - return; -+ -+ LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - if ( c->tc_model ) - PR_Close( c->tc_model ); -+ if (c->tc_certificate) -+ CERT_DestroyCertificate(c->tc_certificate); -+ if (c->tc_private_key) -+ SECKEY_DestroyPrivateKey(c->tc_private_key); - c->tc_certdb = NULL; /* if not the default, may have to clean up */ -- PL_strfree( c->tc_certname ); -- c->tc_certname = NULL; -+ if ( c->tc_certdb_slot ) { -+ if ( SECMOD_CloseUserDB( c->tc_certdb_slot ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not close certdb slot - error %d:%s.\n", -+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); -+ } -+ } - PL_strfree( c->tc_pin_file ); - c->tc_pin_file = NULL; -- PL_strfree( c->tc_slotname ); - tlsm_free_pem_objs( c ); - #ifdef HAVE_NSS_INITCONTEXT - if ( c->tc_initctx ) { -- LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - if ( NSS_ShutdownContext( c->tc_initctx ) ) { - PRErrorCode errcode = PR_GetError(); - Debug( LDAP_DEBUG_ANY, - "TLS: could not shutdown NSS - error %d:%s.\n", - errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - } -- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - } - c->tc_initctx = NULL; - #endif /* HAVE_NSS_INITCONTEXT */ -+ LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - #ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_destroy( &c->tc_refmutex ); - #endif -@@ -2173,6 +2102,12 @@ tlsm_deferred_ctx_init( void *arg ) - return -1; - } - -+ if ( SSL_SetPKCS11PinArg(ctx->tc_model, ctx) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not set pin prompt argument\n", 0, 0, 0); -+ return -1; -+ } -+ - if ( SECSuccess != SSL_OptionSet( ctx->tc_model, SSL_SECURITY, PR_TRUE ) ) { - Debug( LDAP_DEBUG_ANY, - "TLS: could not set secure mode on.\n", -@@ -2287,14 +2222,30 @@ tlsm_deferred_ctx_init( void *arg ) - /* if using the PEM module, load the PEM file specified by lt_certfile */ - /* otherwise, assume this is the name of a cert already in the db */ - if ( ctx->tc_using_pem ) { -- /* this sets ctx->tc_certname to the correct value */ -- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE, PR_TRUE ); -+ /* this sets ctx->tc_certificate to the correct value */ -+ int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ); - if ( rc ) { - return rc; - } - } else { -- PL_strfree( ctx->tc_certname ); -- ctx->tc_certname = PL_strdup( lt->lt_certfile ); -+ char *tmp_certname; -+ -+ if (ctx->tc_certdb_slot) { -+ tmp_certname = PR_smprintf(TLSM_CERTDB_DESC_FMT ":%s", ctx->tc_unique, lt->lt_certfile); -+ } else { -+ tmp_certname = PR_smprintf("%s", lt->lt_certfile); -+ } -+ -+ ctx->tc_certificate = PK11_FindCertFromNickname(tmp_certname, SSL_RevealPinArg(ctx->tc_model)); -+ PR_smprintf_free(tmp_certname); -+ -+ if (!ctx->tc_certificate) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n", -+ lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ return -1; -+ } - } - } - -@@ -2302,7 +2253,6 @@ tlsm_deferred_ctx_init( void *arg ) - /* if using the PEM module, load the PEM file specified by lt_keyfile */ - /* otherwise, assume this is the pininfo for the key */ - if ( ctx->tc_using_pem ) { -- /* this sets ctx->tc_certname to the correct value */ - int rc = tlsm_add_key_from_file( ctx, lt->lt_keyfile ); - if ( rc ) { - return rc; -@@ -2334,66 +2284,42 @@ tlsm_deferred_ctx_init( void *arg ) - /* - since a cert has been specified, assume the client wants to do cert auth - */ -- if ( ctx->tc_certname ) { -- if ( tlsm_authenticate( ctx, ctx->tc_certname, ctx->tc_pin_file ) ) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to authenticate to the security device for certificate %s\n", -- ctx->tc_certname, 0, 0 ); -- return -1; -- } -+ if ( ctx->tc_certificate ) { - if ( tlsm_clientauth_init( ctx ) ) { - Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to set up client certificate authentication using %s\n", -- ctx->tc_certname, 0, 0 ); -+ "TLS: error: unable to set up client certificate authentication using '%s'\n", -+ tlsm_ctx_subject_name(ctx), 0, 0 ); - return -1; - } - } - } else { /* set up secure server */ - SSLKEAType certKEA; -- CERTCertificate *serverCert = NULL; -- SECKEYPrivateKey *serverKey = NULL; - SECStatus status; - - /* must have a certificate for the server to use */ -- if ( !ctx->tc_certname ) { -+ if ( !ctx->tc_certificate ) { - Debug( LDAP_DEBUG_ANY, - "TLS: error: no server certificate: must specify a certificate for the server to use\n", - 0, 0, 0 ); - return -1; - } - -- /* authenticate to the server's token - this will do nothing -- if the key/cert db is not password protected */ -- if ( tlsm_authenticate( ctx, ctx->tc_certname, ctx->tc_pin_file ) ) { -- Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to authenticate to the security device for certificate %s\n", -- ctx->tc_certname, 0, 0 ); -- return -1; -- } -- -- /* get the server's key and cert */ -- if ( tlsm_find_and_verify_cert_key( ctx, ctx->tc_model, ctx->tc_certname, ctx->tc_is_server, -- &serverCert, &serverKey ) ) { -+ if (tlsm_find_and_verify_cert_key(ctx)) { - Debug( LDAP_DEBUG_ANY, - "TLS: error: unable to find and verify server's cert and key for certificate %s\n", -- ctx->tc_certname, 0, 0 ); -- CERT_DestroyCertificate( serverCert ); -- SECKEY_DestroyPrivateKey( serverKey ); -+ tlsm_ctx_subject_name(ctx), 0, 0 ); - return -1; - } - -- certKEA = NSS_FindCertKEAType( serverCert ); - /* configure the socket to be a secure server socket */ -- status = SSL_ConfigSecureServer( ctx->tc_model, serverCert, serverKey, certKEA ); -- /* SSL_ConfigSecureServer copies these */ -- CERT_DestroyCertificate( serverCert ); -- SECKEY_DestroyPrivateKey( serverKey ); -+ certKEA = NSS_FindCertKEAType( ctx->tc_certificate ); -+ status = SSL_ConfigSecureServer( ctx->tc_model, ctx->tc_certificate, ctx->tc_private_key, certKEA ); - - if ( SECSuccess != status ) { - PRErrorCode err = PR_GetError(); - Debug( LDAP_DEBUG_ANY, -- "TLS: error: unable to configure secure server using certificate %s - error %d:%s\n", -- ctx->tc_certname, err, PR_ErrorToString( err, PR_LANGUAGE_I_DEFAULT ) ); -+ "TLS: error: unable to configure secure server using certificate '%s' - error %d:%s\n", -+ tlsm_ctx_subject_name(ctx), err, PR_ErrorToString( err, PR_LANGUAGE_I_DEFAULT ) ); - return -1; - } - } -@@ -2515,7 +2441,9 @@ tlsm_session_new ( tls_ctx * ctx, int is_server ) - int rc; - - c->tc_is_server = is_server; -+ LDAP_MUTEX_LOCK( &tlsm_init_mutex ); - status = PR_CallOnceWithArg( &c->tc_callonce, tlsm_deferred_ctx_init, c ); -+ LDAP_MUTEX_UNLOCK( &tlsm_init_mutex ); - if ( PR_SUCCESS != status ) { - PRErrorCode err = PR_GetError(); - Debug( LDAP_DEBUG_ANY, diff --git a/openldap-nss-pk11-freeslot.patch b/openldap-nss-pk11-freeslot.patch deleted file mode 100644 index ca657c8..0000000 --- a/openldap-nss-pk11-freeslot.patch +++ /dev/null @@ -1,23 +0,0 @@ -Resolves: #929357 - -Upstream commit: 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec -Author: Rich Megginson -Date: Thu, 28 Mar 2013 19:05:02 -0600 -Modified by: Jan Synacek - -This patch has been re-diffed so it clearly applies to OpenLDAP 2.4.39. - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 072d41d..c59d303 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2151,6 +2151,8 @@ - "TLS: could not close certdb slot - error %d:%s.\n", - errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); - } -+ PK11_FreeSlot( c->tc_certdb_slot ); -+ c->tc_certdb_slot = NULL; - } - if ( c->tc_pin_file ) { - PL_strfree( c->tc_pin_file ); - diff --git a/openldap-nss-protocol-version-new-api.patch b/openldap-nss-protocol-version-new-api.patch deleted file mode 100644 index 8a5efa7..0000000 --- a/openldap-nss-protocol-version-new-api.patch +++ /dev/null @@ -1,71 +0,0 @@ -Implement new API for setting TLS protocol version. - -The code being deleted has been misplaced and it's effect has been -mangled by a code later on. This patch puts the code at the correct -place and introduces some more logging and error checking. - -Author: Matus Honek -RHBZ: #1375432 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2421,6 +2411,58 @@ tlsm_deferred_ctx_init( void *arg ) - 0, 0, 0 ); - return -1; - } -+ if ( lt->lt_protocol_min >= LDAP_OPT_X_TLS_PROTOCOL_SSL3 ) { -+ SSLVersionRange supported_range, default_range, selected_range; -+ if ( SECSuccess != SSL_VersionRangeGetSupported(ssl_variant_stream, &supported_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not get SSL supported version range (SSL_VersionRangeGetSupported).\n", -+ 0, 0, 0 ); -+ return -1; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: SSL supported protocol version range is (%#04x, %#04x) (SSL_VersionRangeGetSupported).\n", -+ supported_range.min, supported_range.max, 0); -+ } -+ if ( SECSuccess != SSL_VersionRangeGetDefault(ssl_variant_stream, &default_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not get SSL default protocol version range (SSL_VersionRangeGetDefault).\n", -+ 0, 0, 0 ); -+ return -1; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: SSL default protocol version range is (%#04x, %#04x) (SSL_VersionRangeGetDefault).\n", -+ default_range.min, default_range.max, 0); -+ } -+ selected_range.min = lt->lt_protocol_min; -+ selected_range.max = default_range.max; -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: TLS configured protocol minimal version is %#04x, the maximal version (the NSS default) is %#04x.\n", -+ selected_range.min, selected_range.max, 0); -+ if ( (selected_range.min > supported_range.max) || -+ (selected_range.max < supported_range.min) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: selected protocol version range out of NSS-supported version range.\n", -+ 0, 0, 0); -+ return -1; -+ } else { -+ if ( SECSuccess != SSL_VersionRangeSet(ctx->tc_model, &selected_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not set protocol version range (SSL_VersionRangeSet).\n", -+ 0, 0, 0); -+ return -1; -+ } -+ if ( SECSuccess != SSL_VersionRangeGet(ctx->tc_model, &selected_range) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: error: could not get protocol version range (SSL_VersionRangeGet).\n", -+ 0, 0, 0); -+ return -1; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: info: SSL set protocol version range is (%#04x, %#04x) (SSL_VersionRangeGet).\n", -+ selected_range.min, selected_range.max, 0); -+ } -+ } -+ } - - if ( SECSuccess != SSL_OptionSet( ctx->tc_model, SSL_HANDSHAKE_AS_CLIENT, !ctx->tc_is_server ) ) { - Debug( LDAP_DEBUG_ANY, diff --git a/openldap-nss-regex-search-hashed-cacert-dir.patch b/openldap-nss-regex-search-hashed-cacert-dir.patch deleted file mode 100644 index 03493db..0000000 --- a/openldap-nss-regex-search-hashed-cacert-dir.patch +++ /dev/null @@ -1,91 +0,0 @@ -MozNSS: better file name matching for hashed CA certificate directory - -CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name -should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used -to differentiate between two certificates with the same subject name. - -Wit this patch, certificate file names are matched correctly (using regular expressions). - -Author: Jan Vcelak -Upstream ITS: #7374 -Resolves: #852786 - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 5e49fc5..61d71d4 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -38,6 +38,7 @@ - #include - #include - #include -+#include - - #include "ldap-int.h" - #include "ldap-tls.h" -@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods; - - #define PEM_LIBRARY "nsspem" - #define PEM_MODULE "PEM" --/* hash files for use with cacertdir have this file name suffix */ --#define PEM_CA_HASH_FILE_SUFFIX ".0" --#define PEM_CA_HASH_FILE_SUFFIX_LEN 2 -+#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$" - - static SECMODModule *pem_module; - -@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - PRDir *dir; - PRDirEntry *entry; - PRStatus fistatus = PR_FAILURE; -+ regex_t hashfile_re; - - memset( &fi, 0, sizeof(fi) ); - fistatus = PR_GetFileInfo( cacertdir, &fi ); -@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - goto done; - } - -+ if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) { -+ Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 ); -+ goto done; -+ } -+ - do { - entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN ); - if ( ( NULL != entry ) && ( NULL != entry->name ) ) { - char *fullpath = NULL; -- char *ptr; -+ int match; - -- ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX ); -- if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) { -+ match = regexec( &hashfile_re, entry->name, 0, NULL, 0 ); -+ if ( match == REG_NOMATCH ) { - Debug( LDAP_DEBUG_TRACE, -- "TLS: file %s does not end in [%s] - does not appear to be a CA certificate " -- "directory file with a properly hashed file name - skipping.\n", -- entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 ); -+ "TLS: skipping '%s' - filename does not have expected format " -+ "(certificate hash with numeric suffix)\n", entry->name, 0, 0 ); -+ continue; -+ } else if ( match != 0 ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: cannot execute regex for CA hash file matching (%d).\n", -+ match, 0, 0 ); - continue; - } -+ - fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name ); - if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) { - Debug( LDAP_DEBUG_TRACE, -@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir - PR_smprintf_free( fullpath ); - } - } while ( NULL != entry ); -+ regfree ( &hashfile_re ); - PR_CloseDir( dir ); - } - done: --- -1.7.11.4 - diff --git a/openldap-tls-no-reuse-of-tls_session.patch b/openldap-tls-no-reuse-of-tls_session.patch deleted file mode 100644 index 5c397d1..0000000 --- a/openldap-tls-no-reuse-of-tls_session.patch +++ /dev/null @@ -1,92 +0,0 @@ -TLS: do not reuse tls_session if hostname check fails - -If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails, -*tls_session is not dropped, but reused when connecting to the second server. - -This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor. -From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling. - -Author: Jan Vcelak -Upstream ITS: #7373 -Resolves: #852476 - -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index 10b993b..a3cd590 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc ) - */ - - static int --ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) -+ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) - { - Sockbuf *sb = conn->lconn_sb; - int err; -@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) - errno = WSAGetLastError(); - #endif - -+ if ( err == 0 ) { -+ err = ldap_pvt_tls_check_hostname( ld, ssl, host ); -+ } -+ - if ( err < 0 ) - { - char buf[256], *msg; -@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) - { - tls_session *session = s; - -- return tls_imp->ti_session_chkhost( ld, session, name_in ); -+ if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER && -+ ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) { -+ ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in ); -+ if (ld->ld_errno != LDAP_SUCCESS) { -+ return ld->ld_errno; -+ } -+ } -+ -+ return LDAP_SUCCESS; - } - - int -@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - #endif /* LDAP_USE_NON_BLOCKING_TLS */ - - ld->ld_errno = LDAP_SUCCESS; -- ret = ldap_int_tls_connect( ld, conn ); -+ ret = ldap_int_tls_connect( ld, conn, host ); - - #ifdef LDAP_USE_NON_BLOCKING_TLS - while ( ret > 0 ) { /* this should only happen for non-blocking io */ -@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - } else { - /* ldap_int_poll called ldap_pvt_ndelay_off */ - ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb ); -- ret = ldap_int_tls_connect( ld, conn ); -+ ret = ldap_int_tls_connect( ld, conn, host ); - if ( ret > 0 ) { /* need to call tls_connect once more */ - struct timeval curr_time_tv, delta_tv; - -@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - return (ld->ld_errno); - } - -- ssl = ldap_pvt_tls_sb_ctx( sb ); -- assert( ssl != NULL ); -- -- /* -- * compare host with name(s) in certificate -- */ -- if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER && -- ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) { -- ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host ); -- if (ld->ld_errno != LDAP_SUCCESS) { -- return ld->ld_errno; -- } -- } -- - return LDAP_SUCCESS; - } - diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch new file mode 100644 index 0000000..2bc514f --- /dev/null +++ b/openldap-tlsmc.patch @@ -0,0 +1,1776 @@ +diff --git a/configure.in b/configure.in +index b251b6b06..8a836eabb 100644 +--- a/configure.in ++++ b/configure.in +@@ -237,6 +237,7 @@ dnl OL_ARG_ENABLE(referrals,[ --enable-referrals enable LDAPv2+ Referrals (ex + ol_enable_referrals=${ol_enable_referrals-no} + OL_ARG_ENABLE(ipv6,[ --enable-ipv6 enable IPv6 support], auto)dnl + OL_ARG_ENABLE(local,[ --enable-local enable AF_LOCAL (AF_UNIX) socket support], auto)dnl ++OL_ARG_ENABLE(moznss_compatibility,[ --enable-moznss-compatibility enable MozNSS compatibility], no)dnl + + dnl ---------------------------------------------------------------- + dnl General "with" options +@@ -1256,6 +1257,26 @@ if test $ol_link_tls = no ; then + fi + fi + ++if test $ol_enable_moznss_compatibility = yes ; then ++ if test $have_openssl = yes ; then ++ if test $ol_with_tls = openssl ; then ++ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss_libs=yes], [have_moznss_libs=no]) ++ if test $have_moznss_libs = yes ; then ++ AC_DEFINE(HAVE_MOZNSS_COMPATIBILITY, 1, ++ [define if you want to support MozNSS databases when compiled with OpenSSL]) ++ TLS_LIBS="$TLS_LIBS $MOZNSS_LIBS" ++ CFLAGS="$CFLAGS $MOZNSS_CFLAGS" ++ else ++ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have MozNSS present.]) ++ fi ++ else ++ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to compile with OpenSSL for crypto. (see --with-tls flag)]) ++ fi ++ else ++ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have OpenSSL devel available. (unable to build with OpenSSL)]) ++ fi ++fi ++ + WITH_TLS=no + if test $ol_link_tls = yes ; then + AC_DEFINE(HAVE_TLS, 1, [define if you have TLS]) +diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 +index 389e1c4fd..60c7d05a5 100644 +--- a/doc/man/man3/ldap_get_option.3 ++++ b/doc/man/man3/ldap_get_option.3 +@@ -772,6 +772,19 @@ must be + When using the OpenSSL library this is an SSL*. When using other + crypto libraries this is a pointer to an OpenLDAP private structure. + Applications generally should not use this option. ++.TP ++.B LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY ++Sets/gets the status of the MozNSS database compatibility layer for TLS options. This options is available only if OpenLDAP is compiled with OpenSSL. This has effect only before the TLS context is established. ++This option defaults to be on. ++.BR invalue ++should either be ++.BR LDAP_OPT_OFF ++or ++.BR LDAP_OPT_ON ; ++.BR outvalue ++must be ++.BR "int *" . ++When set, just before TLS context initialization the library will first check if TLS settings are MozNSS-specific and if so it will export certificates from a preconfigured database and set other TLS settings so that OpenSSL can continue without issues. + .SH ERRORS + On success, the functions return + .BR LDAP_OPT_SUCCESS , +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index b6735bab5..612b63a2b 100644 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -483,6 +483,11 @@ Check the CRL for a whole certificate chain + Specifies the file containing a Certificate Revocation List to be used + to verify if the server certificates have not been revoked. This + parameter is only supported with GnuTLS and Mozilla NSS. ++.RE ++.TP ++.B TLS_MOZNSS_COMPATIBILITY ++Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. ++This option defaults to be on. + .SH "ENVIRONMENT VARIABLES" + .TP + LDAPNOINIT +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index 6afbd7d6b..2893cd4a5 100644 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -1004,6 +1004,11 @@ Check the CRL for a whole certificate chain + Specifies a file containing a Certificate Revocation List to be used + for verifying that certificates have not been revoked. This parameter + is only valid when using GnuTLS or Mozilla NSS. ++.RE ++.TP ++.B olcTLSMozNSSCompatibility ++Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. ++This option defaults to be on. + .SH DYNAMIC MODULE OPTIONS + If + .B slapd +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index 86abeca80..742568393 100644 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -1235,6 +1235,11 @@ Check the CRL for a whole certificate chain + Specifies a file containing a Certificate Revocation List to be used + for verifying that certificates have not been revoked. This directive is + only valid when using GnuTLS and Mozilla NSS. ++.RE ++.TP ++.B TLSMozNSSCompatibility ++Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. ++This option defaults to be on. + .SH GENERAL BACKEND OPTIONS + Options in this section only apply to the configuration file section + for the specified backend. They are supported by every +diff --git a/include/ldap.h b/include/ldap.h +index db6869da8..aae8bebd8 100644 +--- a/include/ldap.h ++++ b/include/ldap.h +@@ -158,6 +158,10 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_TLS_NEWCTX 0x600f + #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ + #define LDAP_OPT_X_TLS_PACKAGE 0x6011 ++#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY 0x6050 ++ ++#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED 0 ++#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED 1 + + #define LDAP_OPT_X_TLS_NEVER 0 + #define LDAP_OPT_X_TLS_HARD 1 +diff --git a/libraries/libldap/Makefile.in b/libraries/libldap/Makefile.in +index 636b15506..a1445312f 100644 +--- a/libraries/libldap/Makefile.in ++++ b/libraries/libldap/Makefile.in +@@ -26,7 +26,7 @@ SRCS = bind.c open.c result.c error.c compare.c search.c \ + request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \ + init.c options.c print.c string.c util-int.c schema.c \ + charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ +- tls2.c tls_o.c tls_g.c tls_m.c \ ++ tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \ + turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ + assertion.c deref.c ldif.c fetch.c + +@@ -39,7 +39,7 @@ OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \ + request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \ + init.lo options.lo print.lo string.lo util-int.lo schema.lo \ + charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ +- tls2.lo tls_o.lo tls_g.lo tls_m.lo \ ++ tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \ + turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ + assertion.lo deref.lo ldif.lo fetch.lo + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 39ad7ce7c..689144ca3 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -137,7 +137,9 @@ static const struct ol_attribute { + #ifdef HAVE_GNUTLS + {0, ATTR_TLS, "TLS_CRLFILE", NULL, LDAP_OPT_X_TLS_CRLFILE}, + #endif +- ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ {0, ATTR_TLS, "TLS_MOZNSS_COMPATIBILITY", NULL, LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY}, ++#endif + #endif + + {0, ATTR_NONE, NULL, NULL, 0} +@@ -582,6 +584,9 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl + gopts->ldo_tls_connect_cb = NULL; + gopts->ldo_tls_connect_arg = NULL; + gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND; ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ gopts->ldo_tls_moznss_compatibility = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED; ++#endif + #endif + gopts->ldo_keepalive_probes = 0; + gopts->ldo_keepalive_interval = 0; +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index bcc58f367..d42b82627 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -260,7 +260,8 @@ struct ldapoptions { + int ldo_tls_require_cert; + int ldo_tls_impl; + int ldo_tls_crlcheck; +-#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0 ++ int ldo_tls_moznss_compatibility; ++#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0,0 + #else + #define LDAP_LDO_TLS_NULLARG + #endif +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 8f842278a..878e1a0a8 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -37,6 +37,8 @@ + + #include "ldap-tls.h" + ++#include "tls_mc.h" ++ + static tls_impl *tls_imp = &ldap_int_tls_impl; + #define HAS_TLS( sb ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \ + (void *)tls_imp->ti_sbio ) +@@ -96,6 +98,7 @@ tls_ctx_ref( tls_ctx *ctx ) + * an extra mutex for the default ctx. + */ + static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; ++ldap_pvt_thread_mutex_t tlsmc_mutex; + #endif + + void +@@ -161,6 +164,7 @@ tls_init(tls_impl *impl ) + if ( !tls_initialized++ ) { + #ifdef LDAP_R_COMPILE + ldap_pvt_thread_mutex_init( &tls_def_ctx_mutex ); ++ ldap_pvt_thread_mutex_init( &tlsmc_mutex ); + #endif + } + +@@ -196,6 +200,27 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) + + tls_init( ti ); + ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ if ( LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED == lo->ldo_tls_moznss_compatibility ) { ++ Debug( LDAP_DEBUG_ANY, ++ "TLSMC: MozNSS compatibility interception begins.\n", ++ 0, 0, 0 ); ++ if ( 0 == tlsmc_intercept_initialization( lo, is_server ) ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "TLSMC: ERROR: MozNSS compatibility layer failed.\n", ++ 0, 0, 0 ); ++ } ++ lts = lo->ldo_tls_info; ++ Debug( LDAP_DEBUG_ANY, ++ "TLSMC: MozNSS compatibility interception ends.\n", ++ 0, 0, 0 ); ++ } else { ++ Debug( LDAP_DEBUG_TRACE, ++ "TLS: MozNSS compatibility layer disabled.\n", ++ 0, 0, 0 ); ++ } ++#endif ++ + if ( is_server && !lts.lt_certfile && !lts.lt_keyfile && + !lts.lt_cacertfile && !lts.lt_cacertdir ) { + /* minimum configuration not provided */ +@@ -573,6 +598,21 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) + } + return -1; + #endif ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: ++ i = -1; ++ if ( (strcasecmp( arg, "yes" ) == 0) || ++ (strcasecmp( arg, "true" ) == 0) || ++ (strcasecmp( arg, "on" ) == 0) ) { ++ i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED; ++ } ++ if ( (strcasecmp( arg, "no" ) == 0) || ++ (strcasecmp( arg, "false" ) == 0) || ++ (strcasecmp( arg, "off" ) == 0) ) { ++ i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED; ++ } ++ return ldap_pvt_tls_set_option( ld, option, &i ); ++#endif + } + return -1; + } +@@ -675,6 +715,9 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) + case LDAP_OPT_X_TLS_CONNECT_ARG: + *(void **)arg = lo->ldo_tls_connect_arg; + break; ++ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: ++ *(int *)arg = lo->ldo_tls_moznss_compatibility; ++ break; + default: + return -1; + } +@@ -802,6 +845,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) + ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); + lo->ldo_tls_ctx = NULL; + return ldap_int_tls_init_ctx( lo, *(int *)arg ); ++ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: ++ if ( !arg ) return -1; ++ lo->ldo_tls_moznss_compatibility = *(int *)arg; ++ break; + default: + return -1; + } +diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c +new file mode 100644 +index 000000000..8383cb4ec +--- /dev/null ++++ b/libraries/libldap/tls_mc.c +@@ -0,0 +1,1323 @@ ++#include "portable.h" ++ ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++ ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "ldap-int.h" ++#include "ldap-tls.h" ++#include "ldap_pvt_thread.h" ++ ++#include "tls_mc.h" ++#include "tls_mc_ossl.h" ++ ++#define TLSMC_CHECKSUM_LEN 32 ++ ++#define TLSMC_CACERTS_DIR_NAME "cacerts" ++#define TLSMC_CERT_FILE_NAME "cert.pem" ++#define TLSMC_KEY_FILE_NAME "key.pem" ++#define TLSMC_README_FILE_NAME "README" ++ ++#define TLSM_CERTDB_DESC "ldap" ++#define DEFAULT_TOKEN_NAME "default" ++ ++#define TLSMC_IS_INPLACE 1 ++#define TLSMC_IS_TEMPORARY 2 ++ ++#define DONOTEDIT \ ++ "This file is auto-generated by MOZNSS Compatibility Layer of OpenLDAP software.\n" \ ++ "This layer is not a part of upstream distributed OpenLDAP software.\n" \ ++ "Please, file any related bugs with your GNU/Linux distribution.\n" \ ++ "Do not edit directly. Rather, change your configuration to use OpenSSL-style TLS options, so that this does not need to be generated anymore.\n" \ ++ "Please, refer to man (5) of slapd.conf, slapd-config, and ldap.conf for more information." ++#define PEM_CERT_HEADER "-----BEGIN CERTIFICATE-----" ++#define PEM_CERT_FOOTER "-----END CERTIFICATE-----" ++#define PEM_KEY_HEADER "-----BEGIN PRIVATE KEY-----" ++#define PEM_KEY_FOOTER "-----END PRIVATE KEY-----" ++#define README_HEADER "Contents of this file are hashed and used as a part of a name of the parent directory.\n" ++ ++#ifdef LDAP_R_COMPILE ++ldap_pvt_thread_mutex_t tlsmc_mutex; ++#endif ++/*******************************************************************/ ++ ++ ++char * ++tlsmc_path2name( char *path ) ++{ ++ if ( NULL == path ) return NULL; ++ char *last_slash = strrchr( path, '/' ); ++ if ( NULL == last_slash ) ++ return path; ++ else ++ return last_slash + 1; ++} ++ ++ ++int ++tlsmc_write_file( char *filename, char *buf, mode_t final_mode ) ++{ ++ int rv = 0; ++ int fd = -1; ++ if ( 0 > ( fd = open( filename, O_WRONLY | O_CREAT | O_EXCL, S_IWUSR ) ) ) { ++ perror("IO ERROR: could not open file"); ++ goto bail; ++ } ++ if ( -1 >= write( fd, buf, strlen(buf) ) ) { ++ perror("IO ERROR: could not write file"); ++ goto bail; ++ } ++ if ( -1 >= fchmod( fd, final_mode ) ) { ++ perror("IO ERROR: could not set file mode"); ++ goto bail; ++ } ++ if ( 0 > close( fd ) ) { ++ perror("IO ERROR: could not close file"); ++ goto bail; ++ } ++ rv = 1; ++bail: ++ if ( fd > -1 ) close( fd ); ++ return rv; ++} ++ ++ ++void ++tlsmc_debug_nspr_msg() ++{ ++ int _errno = errno; ++ PRInt32 oserror = PR_GetOSError(); ++ char *errno_str = strerror(_errno); ++ char *errstr = PR_Malloc( PR_GetErrorTextLength() + 1 ); ++ PR_GetErrorText( errstr ); ++ Debug( LDAP_DEBUG_ANY, ++ "... NSPR error %d:`%s'\n", ++ PR_GetError(), errstr, 0 ); ++ Debug( LDAP_DEBUG_ANY, ++ "... NSPR OS-error %d, errno %d:%s\n", ++ oserror, _errno, errno_str ); ++ PR_Free( errstr ); ++} ++ ++/* BORROWED FROM tls_m.c */ ++static void ++tlsmc_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) ++{ ++ char sep = PR_GetDirectorySeparator(); ++ char *ptr = NULL; ++ struct PRFileInfo prfi; ++ PRStatus prc; ++ ++ *realcertdir = (char *)certdir; /* default is the one passed in */ ++ if ( !certdir ) return; ++ ++ prc = PR_GetFileInfo( certdir, &prfi ); ++ /* if certdir exists (file or directory) then it cannot specify a prefix */ ++ if ( prc == PR_SUCCESS ) { ++ /* and drop potential last '/' */ ++ ptr = strrchr( *realcertdir, sep ); ++ if ( ptr && (! *(ptr+1) ) ) { ++ *ptr = '\0'; ++ } ++ return; ++ } ++ ++ /* if certdir was given, and there is a '/' in certdir, see if there ++ is anything after the last '/' - if so, assume it is the prefix */ ++ if ( ( ( ptr = strrchr( certdir, sep ) ) ) && *(ptr+1) ) { ++ *realcertdir = PL_strndup( certdir, ptr-certdir ); ++ *prefix = PL_strdup( ptr+1 ); ++ } ++ ++ return; ++} ++ ++ ++static char * ++tlsmc_get_pin_from_file(const char *token_name, char *filename) ++{ ++ char *pwdstr = NULL; ++ char *contents = NULL; ++ char *lasts = NULL; ++ char *line = NULL; ++ char *candidate = NULL; ++ PRFileInfo file_info; ++ PRFileDesc *pwd_fileptr = NULL; ++ pwd_fileptr = PR_Open( filename, PR_RDONLY, 00400 ); ++ ++ /* open the password file */ ++ if ( !pwd_fileptr ) { ++ PRErrorCode errcode = PR_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_get_pin_from_file: could not open security pin file %s - error %d:%s.\n", ++ filename, errcode, ++ PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); ++ goto done; ++ } ++ ++ /* get the file size */ ++ if ( PR_SUCCESS != PR_GetFileInfo( filename, &file_info ) ) { ++ PRErrorCode errcode = PR_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_get_pin_from_file: could not get file info from pin file %s - error %d:%s.\n", ++ filename, errcode, ++ PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); ++ goto done; ++ } ++ ++ /* create a buffer to hold the file contents */ ++ if ( !( contents = PR_CALLOC( file_info.size + 1 ) ) ) { ++ PRErrorCode errcode = PR_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_get_pin_from_file: could not alloc a buffer for contents of pin file %s - error %d:%s.\n", ++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); ++ goto done; ++ } ++ ++ /* read file into the buffer */ ++ if( PR_Read( pwd_fileptr, contents, file_info.size ) <= 0 ) { ++ PRErrorCode errcode = PR_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_get_pin_from_file: could not read the file contents from pin file %s - error %d:%s.\n", ++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); ++ goto done; ++ } ++ ++ /* format is [tokenname:]password EOL [tokenname:]password EOL ... */ ++ /* if you want to use a password containing a colon character, use ++ the special tokenname "default" */ ++ for ( line = PL_strtok_r( contents, "\r\n", &lasts ); line; ++ line = PL_strtok_r( NULL, "\r\n", &lasts ) ) { ++ char *colon; ++ ++ if ( !*line ) { ++ continue; /* skip blank lines */ ++ } ++ colon = PL_strchr( line, ':' ); ++ if ( colon ) { ++ if ( *(colon + 1) && token_name && ++ !PL_strncmp( token_name, line, colon-line ) ) { ++ candidate = colon + 1; /* found a definite match */ ++ break; ++ } else if ( !PL_strncmp( DEFAULT_TOKEN_NAME, line, colon-line ) ) { ++ candidate = colon + 1; /* found possible match */ ++ } ++ } else { /* no token name */ ++ candidate = line; ++ } ++ } ++done: ++ if ( pwd_fileptr ) { ++ PR_Close( pwd_fileptr ); ++ } ++ if ( candidate ) { ++ pwdstr = PL_strdup( candidate ); ++ } ++ PL_strfree( contents ); ++ ++ return pwdstr; ++} ++ ++ ++/* ++ * Turn the echoing off on a tty. ++ */ ++static void ++echoOff(int fd) ++{ ++ if ( isatty( fd ) ) { ++ struct termios tio; ++ tcgetattr( fd, &tio ); ++ tio.c_lflag &= ~ECHO; ++ tcsetattr( fd, TCSAFLUSH, &tio ); ++ } ++} ++ ++/* ++ * Turn the echoing on on a tty. ++ */ ++static void ++echoOn(int fd) ++{ ++ if ( isatty( fd ) ) { ++ struct termios tio; ++ tcgetattr( fd, &tio ); ++ tio.c_lflag |= ECHO; ++ tcsetattr( fd, TCSAFLUSH, &tio ); ++ tcsetattr( fd, TCSAFLUSH, &tio ); ++ } ++} ++ ++ ++/* Borrowed from tlsm_get_pin() */ ++char * ++tlsmc_get_pin( PK11SlotInfo *slot, PRBool retry, void * filename) ++{ ++ char *token_name = NULL; ++ char *pwdstr = NULL; ++ ++ token_name = PK11_GetTokenName( slot ); ++ /* Try to get the passwords from the password file if it exists. ++ * THIS IS UNSAFE and is provided for convenience only. Without this ++ * capability the server would have to be started in foreground mode ++ * if using an encrypted key. ++ */ ++ if ( filename ) { ++ pwdstr = tlsmc_get_pin_from_file( token_name, (char *)filename ); ++ if ( retry && pwdstr != NULL ) ++ return NULL; ++ } ++ if ( !pwdstr ) { ++ int infd = PR_FileDesc2NativeHandle( PR_STDIN ); ++ int isTTY = isatty( infd ); ++ unsigned char phrase[200]; ++ /* Prompt for password */ ++ if ( isTTY ) { ++ fprintf( stdout, ++ "Please enter pin, password, or pass phrase for security token '%s': ", ++ token_name ? token_name : DEFAULT_TOKEN_NAME ); ++ echoOff( infd ); ++ } ++ fgets( (char*)phrase, sizeof(phrase), stdin ); ++ if ( isTTY ) { ++ fprintf( stdout, "\n" ); ++ echoOn( infd ); ++ } ++ /* stomp on newline */ ++ phrase[strlen((char*)phrase)-1] = 0; ++ ++ pwdstr = PL_strdup( (char*)phrase ); ++ } ++ ++ return pwdstr; ++} ++ ++ ++int ++tlsmc_hash( unsigned char **dest, char *src ) ++{ ++ int rv = 0; ++ unsigned char fp[SHA256_LENGTH]; ++ SECItem fpItem; ++ ++ if ( SECSuccess != ( rv = PK11_HashBuf( SEC_OID_SHA256, fp, src, strlen(src) ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_hash: could not hash a buffer", ++ NULL, NULL, NULL ); ++ goto bail; ++ } ++ fpItem.data = fp; ++ fpItem.len = SHA256_LENGTH; ++ if ( NULL == ( *dest = CERT_Hexify( &fpItem, 0 ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_hash: could not hexify the hash", ++ NULL, NULL, NULL ); ++ goto bail; ++ } ++ ++ rv = 1; ++bail: ++ return rv; ++} ++ ++ ++/* BORROWED FROM tls_m.c */ ++static PK11SlotInfo * ++tlsmc_init_open_certdb( const char *nssdb_dir, const char *prefix ) ++{ ++ PK11SlotInfo *slot = NULL; ++ char *config = NULL; ++ ++ config = PR_smprintf( "configDir='%s' tokenDescription='%s' " ++ "certPrefix='%s' keyPrefix='%s' flags=readOnly", ++ nssdb_dir, TLSM_CERTDB_DESC, ++ prefix, prefix ); ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_init_open_certdb: INFO: certdb config: `%s`.\n", ++ config, 0, 0 ); ++ ++ slot = SECMOD_OpenUserDB( config ); ++ if ( !slot ) { ++ PRErrorCode errcode = PR_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_init_open_certdb: ERROR: cannot open certdb `%s`, error `%d:%s`.\n", ++ nssdb_dir, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); ++ } ++ ++ if ( config ) PR_smprintf_free( config ); ++ ++ return slot; ++} ++ ++ ++/* Borrowed from tlsm_deferred_init */ ++int ++tlsmc_open_nssdb( char *ld_cacertdir, NSSInitContext **out_initctx, char **out_nssdb_dir, char **out_nssdb_prefix ) ++{ ++#define SECURITYDIRS_COUNT 3 ++ int rc = 0; ++ PRErrorCode errcode = 1; ++ ++ /* restart secmod modules */ ++#ifdef HAVE_SECMOD_RESTARTMODULES ++ /* NSS enforces the pkcs11 requirement that modules should be unloaded after ++ a fork() - since there is no portable way to determine if NSS has been ++ already initialized in a parent process, we just call SECMOD_RestartModules ++ with force == FALSE - if the module has been unloaded due to a fork, it will ++ be reloaded, otherwise, it is a no-op */ ++ if ( 0 == ( rc = SECMOD_RestartModules(PR_FALSE /* do not force */) ) ) { ++ errcode = PORT_GetError(); ++ if ( errcode != SEC_ERROR_NOT_INITIALIZED ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_open_nssdb: WARN: could not restart the security modules: %d:%s.\n", ++ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); ++ } else { ++ errcode = 1; ++ } ++ } ++#endif ++ ++ ++ /* context and certdb */ ++ char *dir_moznss = PR_GetEnv( "MOZNSS_DIR" ); ++ char *dir_default_moznss = PR_GetEnv( "DEFAULT_MOZNSS_DIR" ); ++ const char *securitydirs[SECURITYDIRS_COUNT] = { dir_moznss, ld_cacertdir, dir_default_moznss }; ++ int done = 0; ++ int ii = 0; ++ for ( ii = 0; !done && ( ii < SECURITYDIRS_COUNT ); ++ii ) { ++ // get certdb prefix ++ const char *securitydir = securitydirs[ii]; ++ char *realcertdir = NULL; ++ const char *defprefix = ""; ++ char *prefix = (char *)defprefix; ++ if ( securitydir == NULL ) continue; ++ tlsmc_get_certdb_prefix( securitydir, &realcertdir, &prefix ); //FIXME ++ *out_nssdb_dir = strdup( realcertdir ); ++ *out_nssdb_prefix = strdup( prefix ); ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_open_nssdb: INFO: trying to initialize moznss using security dir `%s` prefix `%s`.\n", ++ realcertdir, prefix, NULL); ++ ++ // init context ++ NSSInitContext *initctx = NULL; ++ NSSInitParameters initparams; ++ memset( &initparams, 0, sizeof( initparams ) ); ++ initparams.length = sizeof( initparams ); ++ ++ initctx = NSS_InitContext( realcertdir, ++ prefix, ++ prefix, ++ SECMOD_DB, ++ &initparams, ++ NSS_INIT_READONLY // | NSS_INIT_NOCERTDB ++ ); ++ rc = initctx ? 1 : 0; ++ ++ *out_initctx = initctx; ++ ++ if ( rc != 1 ) { ++ errcode = PORT_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_open_nssdb: WARN: could not initialize MozNSS context - error %d.\n", ++ errcode, 0, 0 ); ++ } else { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_open_nssdb: INFO: initialized MozNSS context.\n", ++ 0, 0, 0 ); ++ errcode = 0; ++ done = 1; ++ } ++ } ++ ++ PR_Free( dir_moznss ); ++ PR_Free( dir_default_moznss ); ++ ++ PK11_SetPasswordFunc( tlsmc_get_pin ); ++ ++ if ( done && (errcode == 0) && out_initctx ) { ++ return 1; ++ } else { ++ return 0; ++ } ++} ++ ++ ++static int ++tlsmc_is_sql_nssdb( const char *ld_cacertdir ) ++{ ++ if ( 0 == strncmp( "sql:", ld_cacertdir, 4 ) ) { ++ return 1; ++ } else { ++ return 0; ++ } ++} ++ ++ ++int ++tlsmc_filestamp( char **filestamp, char *path ) ++{ ++ int rv = 0; ++ struct stat attr; ++ char stime[20]; ++ ++ if ( 0 != stat( path, &attr ) ) { ++ perror("IO ERROR: could not stat file"); ++ goto bail; ++ } ++ if ( 0 == strftime(stime, sizeof(stime), "%FT%T", localtime(&attr.st_mtime)) ) { ++ perror("IO ERROR: could not format mtime"); ++ goto bail; ++ } ++ ++ *filestamp = PR_smprintf("mtime %s.%d, size %lld", ++ stime, attr.st_mtim.tv_nsec, (long long) attr.st_size); ++ ++ rv = 1; ++bail: ++ return rv; ++} ++ ++ ++char * ++tlsmc_compute_checksum( char *nssdb_dir, char *nssdb_prefix, ++ char *ld_cacertdir, char *ld_cert, char *ld_key, ++ char **out_data) ++{ ++ int rv = 0; ++ char *data = NULL; ++ ++ /* gather data */ ++ data = PR_sprintf_append( data, ++ DONOTEDIT "\n" ++ README_HEADER "\n" ++ "PARAMETERS:\n" ++ "nssdb_dir: %s\n" ++ "nssdb_prefix: %s\n" ++ "ld_cacertdir: %s\n" ++ "ld_cert: %s\n" ++ "ld_key: %s\n" ++ "euid: %d\n\n" ++ "FILES:\n", ++ nssdb_dir, nssdb_prefix, ld_cacertdir, ld_cert, ld_key, geteuid() ); ++ ++ char *bdb_files[] = { "cert8.db", "key3.db", "secmod.db", NULL }; ++ char *sql_files[] = { "cert9.db", "key4.db", "secmod.db", NULL }; ++ char **files = ( 1 == tlsmc_is_sql_nssdb( ld_cacertdir ) ) ? sql_files : bdb_files; // FIXME we should do all files as default prefix may (and will) change and thus change the semantics of the ld_cacertdir ++ char *file = *files; ++ while ( NULL != ( file = *(files++) ) ) { ++ char *filestamp = NULL; ++ char *path = NULL; ++ path = PR_smprintf( "%s/%s%s", nssdb_dir, nssdb_prefix, file ); ++ if ( 0 == tlsmc_filestamp( &filestamp, path ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_compute_checksum: ERROR: could not stat file `%s'.\n", ++ path, 0, 0 ); ++ rv = -1; ++ } else { ++ data = PR_sprintf_append( data, "%s: %s\n", file, filestamp ); ++ } ++ bail_one: ++ if ( filestamp ) PR_smprintf_free( filestamp ); ++ if ( path ) PR_smprintf_free( path ); ++ if ( -1 == rv ) goto bail; ++ } ++ ++ /* compute data checksum */ ++ unsigned char *checksum = NULL; ++ if ( 1 != tlsmc_hash( &checksum, data ) ) { ++ checksum = NULL; ++ goto bail; ++ } ++ ++ /* possibly supply data */ ++ if ( out_data ) { ++ *out_data = strdup( data ); ++ } ++ ++ /* return checksum */ ++bail: ++ if ( data ) PR_smprintf_free( data ); ++ return checksum; ++} ++ ++ ++int ++tlsmc_prepare_dir( char *dir ) ++{ ++ int rv = 0; ++ PRFileInfo info; ++ PRStatus prv; ++ char *cacerts_dir = NULL; ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_prepare_dir: INFO: preparing PEM directory `%s'.\n", ++ dir, 0, 0 ); ++ ++ if ( 0 != mkdir( dir, S_IRWXU /* u+rwx */ ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_prepare_dir: WARN: cound not create the PEM directory.\n", ++ 0, 0, 0 ); ++ perror( "tlsmc_prepare_dir: WARN: cound not create the PEM directory" ); ++ rv = 0; ++ goto bail; ++ } ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_prepare_dir: INFO: creating a subdirectory `%s'.\n", ++ TLSMC_CACERTS_DIR_NAME, 0, 0 ); ++ cacerts_dir = PR_smprintf( "%s/%s", dir, TLSMC_CACERTS_DIR_NAME ); ++ if ( 0 != mkdir( cacerts_dir, S_IRWXU /* u+rwx */ ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_prepare_dir: WARN: cound not create the subdirectory.\n", ++ 0, 0, 0 ); ++ perror( "tlsmc_prepare_dir: WARN: cound not create the subdirectory" ); ++ rv = 0; ++ goto bail; ++ } ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_prepare_dir: INFO: successfully created PEM directory structure.\n", ++ TLSMC_CACERTS_DIR_NAME, 0, 0 ); ++ rv = 1; ++ ++bail: ++ if ( cacerts_dir ) PR_smprintf_free( cacerts_dir ); ++ return rv; ++} ++ ++int ++tlsmc_extract_cert_to_file(CERTCertDBHandle *certdb_handle, CERTCertificate *cert, char *file_path) ++{ ++ int rv = 0; ++ SECItem data; ++ char *b64 = NULL; ++ char *output = NULL; ++ ++ if ( ! cert ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_to_file: ERROR: cert empty.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ data.data = cert->derCert.data; ++ data.len = cert->derCert.len; ++ b64 = BTOA_DataToAscii(data.data, data.len); ++ if ( ! b64 ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_to_file: ERROR: could not base64 encode.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ output = PR_smprintf( DONOTEDIT "\n\n" ++ "NSS nickname: %s\n" ++ "Issuer: %s\n" ++ "Subject: %s\n" ++ PEM_CERT_HEADER "\n" ++ "%s\n" ++ PEM_CERT_FOOTER "\n", ++ cert->nickname, ++ cert->issuerName, ++ cert->subjectName, ++ b64 ); ++ ++ if ( 0 == tlsmc_write_file( file_path, output, S_IRUSR ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_to_file: ERROR: could not write certificate.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ rv = 1; ++bail: ++ if ( output ) PR_smprintf_free( output ); ++ if ( b64 ) PORT_Free( b64 ); ++ return rv; ++} ++ ++ ++ ++/* borrowed from 389-ds-base, ssl.c, DecryptKey */ ++int ++tlsmc_decrypt_key(SECKEYEncryptedPrivateKeyInfo *epki, ++ SECOidTag algTag, ++ SECItem *pwitem, ++ void *pin_arg, ++ SECItem *derPKI) ++{ ++ SECItem *cryptoParam = NULL; ++ PK11SymKey *symKey = NULL; ++ PK11Context *ctx = NULL; ++ int rv = 0; ++ ++ if (!pwitem) return rv; ++ ++ do { ++ SECAlgorithmID algid = epki->algorithm; ++ CK_MECHANISM_TYPE cryptoMechType; ++ CK_ATTRIBUTE_TYPE operation = CKA_DECRYPT; ++ PK11SlotInfo *slot = NULL; ++ ++ cryptoMechType = PK11_GetPBECryptoMechanism(&algid, &cryptoParam, pwitem); ++ if (cryptoMechType == CKM_INVALID_MECHANISM) { ++ goto bail; ++ } ++ ++ if ( NULL == ( slot = PK11_GetBestSlot(cryptoMechType, NULL) ) ) { ++ goto bail; ++ } ++ ++ if ( NULL == ( symKey = PK11_PBEKeyGen(slot, &algid, pwitem, PR_FALSE, pin_arg) ) ) { ++ rv = -1; ++ goto bail_one; ++ } ++ ++ if ( NULL == ( ctx = PK11_CreateContextBySymKey( ++ cryptoMechType, operation, symKey, cryptoParam) ) ) { ++ rv = -1; ++ goto bail_one; ++ } ++ ++ if ( SECSuccess != PK11_CipherOp(ctx, ++ derPKI->data, /* out */ ++ (int *)(&derPKI->len), /* out len */ ++ (int)epki->encryptedData.len, /* max out */ ++ epki->encryptedData.data, /* in */ ++ (int)epki->encryptedData.len /* in len */ ) ) { ++ rv = -1; ++ goto bail_one; ++ } ++ ++ if ( derPKI->len != epki->encryptedData.len ) goto bail_one; ++ if ( SECSuccess != PK11_Finalize(ctx) ) goto bail_one; ++ bail_one: ++ if (slot) PK11_FreeSlot(slot); ++ } while (0); ++ ++ rv = ((rv == 0) ? 1 : 0); ++bail: ++ if (symKey) PK11_FreeSymKey(symKey); ++ if (cryptoParam) { ++ SECITEM_ZfreeItem(cryptoParam, PR_TRUE); ++ cryptoParam = NULL; ++ } ++ if (ctx) PK11_DestroyContext(ctx, PR_TRUE); ++ ++ return rv; ++} ++ ++ ++ ++int ++tlsmc_extract_key_of_cert_to_file(CERTCertificate *cert, ++ char *pin_filename, ++ char *filename) ++{ ++ int rv = 0; ++ SECKEYPrivateKey *key = NULL; ++ SECItem pwitem; ++ SECKEYEncryptedPrivateKeyInfo *epki = NULL; ++ PLArenaPool *arenaForPKI = NULL; ++ SECItem clearKeyDER; ++ char *b64 = NULL; ++ char *output = NULL; ++ //SECItem *data = PK11_ExportDERPrivateKeyInfo(key, (void *)pin_filename); // FIXME NULL? // probably won't work ++ ++ // establish password ++ pwitem.data = "secretpw"; // FIXME use pin_filename ++ pwitem.len = strlen(pwitem.data); ++ pwitem.type = siBuffer; ++ ++ // get key ++ if ( NULL == ( key = PK11_FindKeyByAnyCert(cert, (void *)pin_filename) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_key_of_cert_to_file: ERROR: PK11_FindKeyByAnyCert failed.\n", ++ 0,0,0); ++ goto bail; ++ } ++ ++ // get key info ++ if ( NULL == ( epki = PK11_ExportEncryptedPrivKeyInfo( ++ NULL, SEC_OID_DES_EDE3_CBC, &pwitem, key, 1000, (void *)pin_filename) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_key_of_cert_to_file: ERROR: PK11_ExportEncryptedPrivKeyInfo returned NULL.\n", ++ 0,0,0); ++ goto bail; ++ } ++ ++ // get clear DER ++ if ( NULL == ( arenaForPKI = PORT_NewArena(2048) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_key_of_cert_to_file: ERROR: PORT_NewArena failed.\n", ++ 0,0,0); ++ goto bail; ++ } ++ ++ clearKeyDER.data = PORT_ArenaAlloc(arenaForPKI, epki->encryptedData.len); ++ clearKeyDER.len = epki->encryptedData.len; ++ clearKeyDER.type = siBuffer; ++ ++ if ( 0 == tlsmc_decrypt_key(epki, SEC_OID_DES_EDE3_CBC, &pwitem, ++ (void *)pin_filename, &clearKeyDER) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_key_of_cert_to_file: ERROR: could not decrypt the key.\n", ++ 0,0,0); ++ goto bail; ++ } ++ ++ // base64 encode ++ if ( NULL == ( b64 = BTOA_ConvertItemToAscii(&clearKeyDER) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_key_of_cert_to_file: ERROR: could not base64 encode.\n", ++ 0,0,0); ++ goto bail; ++ } ++ ++ // print out ++ output = PR_smprintf( DONOTEDIT "\n" ++ PEM_KEY_HEADER "\n" ++ "%s\n" ++ PEM_KEY_FOOTER "\n", ++ b64 ); ++ ++ if ( 0 == tlsmc_write_file( filename, output, S_IRUSR ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_key_of_cert_to_file: ERROR: could not write PK.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ rv = 1; ++ ++bail: ++ if (b64) PORT_Free(b64); ++ if (arenaForPKI) PORT_FreeArena(arenaForPKI, PR_FALSE); ++ if (epki) SECKEY_DestroyEncryptedPrivateKeyInfo(epki, PR_TRUE); ++ if (key) SECKEY_DestroyPrivateKey(key); ++ return rv; ++} ++ ++//TODO drop? ++int ++tlsmc_extract_cert_key_pair(char *nickname, char *pin_filename, char *dir_name) ++{ ++ int rv = 0; ++ int fd = -1; ++ CERTCertDBHandle *certHandle = NULL; ++ CERTCertificate *cert = NULL; ++ char *cert_file_path = NULL; ++ char *key_file_path = NULL; ++ ++ if ( NULL == ( certHandle = CERT_GetDefaultCertDB() ) ) { ++ // FIXME see same in tlsmc_extract_cacerts() ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not get certificate handle.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ if ( NULL == ( cert = PK11_FindCertFromNickname(nickname, NULL) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not find certificate with nickname `%s'.\n", ++ nickname, 0, 0 ); ++ goto bail; ++ } ++ ++ /* cert */ ++ cert_file_path = PR_smprintf( "%s/cert.pem", dir_name ); ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cert_key_pair: INFO: extracting certificate `%s' to file `%s'.\n", ++ nickname, cert_file_path, 0 ); ++ if ( 0 == tlsmc_extract_cert_to_file(certHandle, cert, cert_file_path) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not extract certificate.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ /* key */ ++ key_file_path = PR_smprintf( "%s/key.pem", dir_name ); ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cert_key_pair: INFO: extracting associated PK to file `%s'.\n", ++ key_file_path, 0, 0 ); ++ if ( 0 == tlsmc_extract_key_of_cert_to_file( cert, pin_filename, key_file_path ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not extract PK.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ rv = 1; ++ ++bail: ++ if (key_file_path) PR_smprintf_free(key_file_path); ++ if (cert_file_path) PR_smprintf_free(cert_file_path); ++ if (cert) CERT_DestroyCertificate(cert); ++ return rv; ++} ++ ++ ++/* Adopted from 389DS. */ ++static int ++tlsmc_list_certs(CERTCertDBHandle *handle, ++ CERTCertificate *cert, ++ PK11SlotInfo *slot, ++ PRFileDesc *outfile, ++ void *pwarg) ++{ ++ SECItem data; ++ int rv = 0; ++ CERTCertList *certs; ++ CERTCertListNode *node; ++ CERTCertificate *the_cert = NULL; ++ char *name = NULL; ++ ++ if (!cert) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_list_certs: WARN: no cert given.\n", ++ 0, 0, 0 ); ++ return rv; ++ } ++ name = cert->nickname; ++ ++ if (!name) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_list_certs: WARN: no cert nickname.\n", ++ 0, 0, 0 ); ++ return rv; ++ } ++ the_cert = CERT_FindCertByNicknameOrEmailAddr(handle, name); ++ if (!the_cert) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_list_certs: WARN: could not find cert: %s.\n", ++ name, 0, 0 ); ++ return 0; ++ } ++ ++ PR_fprintf(outfile, "%s\n", DONOTEDIT); ++ /* Here, we have one cert with the desired nickname or email ++ * address. Now, we will attempt to get a list of ALL certs ++ * with the same subject name as the cert we have. That list ++ * should contain, at a minimum, the one cert we have already found. ++ * If the list of certs is empty (NULL), the libraries have failed. ++ */ ++ certs = CERT_CreateSubjectCertList(NULL, handle, &the_cert->derSubject, ++ PR_Now(), PR_FALSE); ++ CERT_DestroyCertificate(the_cert); ++ if (!certs) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_list_certs: WARN: problem printing certificates.\n", ++ 0, 0, 0 ); ++ return 0; ++ } ++ for (node = CERT_LIST_HEAD(certs); !CERT_LIST_END(node,certs); node = CERT_LIST_NEXT(node)) { ++ the_cert = node->cert; ++ PR_fprintf(outfile, "Issuer: %s\n", the_cert->issuerName); ++ PR_fprintf(outfile, "Subject: %s\n", the_cert->subjectName); ++ /* now get the subjectList that matches this cert */ ++ data.data = the_cert->derCert.data; ++ data.len = the_cert->derCert.len; ++ PR_fprintf(outfile, "\n%s\n%s\n%s\n", ++ PEM_CERT_HEADER, ++ BTOA_DataToAscii(data.data, data.len), ++ PEM_CERT_FOOTER); ++ rv = 1; ++ } ++ if (certs) { ++ CERT_DestroyCertList(certs); ++ } ++ if (rv) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_list_certs: WARN: problem printing certificate nicknames.\n", ++ 0, 0, 0 ); ++ return 0; ++ } ++ ++ return rv; ++} ++ ++static char* ++tlsmc_extract_key() ++{ ++ return NULL; ++} ++ ++/* Adopted from 389DS. */ ++static int ++tlsmc_extract_cert(char *token_colon_name, char *filename) ++{ ++ CERTCertListNode *node; ++ CERTCertList *list = PK11_ListCerts(PK11CertListAll, NULL); ++ for (node = CERT_LIST_HEAD(list); ++ !CERT_LIST_END(node, list); ++ node = CERT_LIST_NEXT(node)) { ++ CERTCertificate *cert = node->cert; ++ CERTCertTrust trust; ++ } ++ return 0; ++} ++ ++int ++tlsmc_extract_cacerts( char *dir_name ) ++{ ++ int rv = 0; ++ CERTCertDBHandle *certHandle = NULL; ++ CERTCertListNode *node = NULL; ++ CERTCertList *list = NULL; ++ char *cacerts_dir = NULL; ++ int cert_cnt = 0; ++ ++ cacerts_dir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, dir_name ); ++ ++ certHandle = CERT_GetDefaultCertDB(); // FIXME maybe we should really use certdb_slot? ++ if ( ! certHandle ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cacerts: could not get certificate database handle.\n", ++ 0, 0, 0); ++ goto bail; ++ } ++ ++ list = PK11_ListCerts(PK11CertListAll, NULL); ++ if ( ! list ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cacerts: could not get list of certificates.\n", ++ 0, 0, 0); ++ goto bail; ++ } ++ for ( node = CERT_LIST_HEAD(list); ++ !CERT_LIST_END(node, list); ++ node = CERT_LIST_NEXT(node)) { ++ ++ CERTCertificate *cert = NULL; ++ CERTCertTrust trust; ++ char *cert_file_path = NULL; ++ int is_ca = 0; ++ ++ cert = node->cert; ++ if ( SECFailure == CERT_GetCertTrust( cert, &trust ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cacerts: ERROR: could not get trust flags of certificate nick=`%s'.\n", ++ cert->nickname, 0, 0); ++ goto bail; ++ } ++ if (trust.sslFlags & ++ (CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA)) { ++ is_ca = 1; ++ } ++ ++ Debug(LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cacerts: INFO: found cert nick=`%s'%s.\n", ++ cert->nickname, is_ca ? ", a trusted CA" : ", _not_ a trusted CA, skipping", 0); ++ if ( ! is_ca ) continue; ++ ++ cert_file_path = PR_smprintf( "%s/cert%d.pem", cacerts_dir, cert_cnt ); ++ cert_cnt++; ++ Debug(LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cacerts: INFO: extracting cert nick=`%s' to file `%s'.\n", ++ cert->nickname, cert_file_path, 0); ++ if ( 0 == tlsmc_extract_cert_to_file( certHandle, cert, cert_file_path ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cacerts: ERROR: could not extract the certificate.\n", ++ 0, 0, 0); ++ goto bail_one; ++ } ++ if ( 0 == tlsmc_cert_create_hash_symlink( cert_file_path, cacerts_dir ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cacerts: ERROR: could not rehash the certificate.\n", ++ 0, 0, 0); ++ goto bail_one; ++ } ++ if ( cert_file_path ) PR_smprintf_free( cert_file_path ); ++ continue; ++ bail_one: ++ if ( cert_file_path ) PR_smprintf_free( cert_file_path ); ++ goto bail; ++ } ++ ++ rv = 1; ++bail: ++ if ( cacerts_dir ) PR_smprintf_free( cacerts_dir ); ++ if ( list ) CERT_DestroyCertList( list ); ++ return rv; ++} ++ ++ ++/* returns 1 if successfull; ++ returns -1 if only cert-key pair is NULL or could not be extracted; ++ returns 0 if any other error ++*/ ++int ++tlsmc_extract_nssdb( char *dir_name, char **ld_cacertdir, char **ld_cert, char **ld_key ) ++{ ++ int rv = 0; ++ ++ if ( ! dir_name ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_nssdb: FATAL: target dir name empty.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ if ( 0 == tlsmc_extract_cacerts( dir_name ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_nssdb: ERROR: could not export CA certificates.\n", ++ 0, 0, 0 ); ++ } ++ ++ if ( ( ! *ld_cert ) || ( ! *ld_key ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_nssdb: ERROR: cert or key empty.\n", ++ 0, 0, 0 ); ++ rv = -1; ++ goto bail; ++ } ++ ++ if ( 0 == tlsmc_extract_cert_key_pair( *ld_cert, *ld_key, dir_name ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_nssdb: ERROR: could not export user cert and/or key.\n", ++ 0, 0, 0 ); ++ rv = -1; ++ goto bail; ++ } ++ ++ rv = 1; ++bail: ++ return rv; ++} ++ ++int ++tlsmc_close_nssdb(NSSInitContext **initctx) ++{ ++ if ( *initctx && NSS_ShutdownContext( *initctx ) ) { ++ PRErrorCode errcode = PR_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_close_nssdb: ERROR: could not shutdown NSS - error %d:%s.\n", ++ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); ++ return 0; ++ } else { ++ return 1; ++ } ++} ++ ++int ++tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ) ++{ ++ ++ int rv = 0; ++ ++ NSSInitContext *nss_ctx = NULL; ++ char *nssdb_dir_path = NULL; ++ char *nssdb_dir_name = NULL; ++ char *nssdb_prefix = NULL; ++ char *pem_dirs[] = { NULL, NULL, NULL }; ++ char *readme_path = NULL; ++ char *data = NULL; // data before checksum ++ char *checksum = NULL; // checksummed data ++ char **dirs = pem_dirs; ++ char *dir = *dirs; ++ struct stat stat_buf; ++ ++#ifdef LDAP_R_COMPILE ++ ldap_pvt_thread_mutex_lock( &tlsmc_mutex ); ++#endif ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: INFO: trying to open NSS DB with CACertDir = `%s'.\n", ++ *ld_cacertdir, 0, 0 ); ++ if ( 0 == tlsmc_open_nssdb( *ld_cacertdir, &nss_ctx, &nssdb_dir_path, &nssdb_prefix ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.\n", ++ 0, 0, 0 ); ++ rv = 1; ++ goto bail; ++ } ++ ++ if ( NULL == ( checksum = tlsmc_compute_checksum( nssdb_dir_path, nssdb_prefix, ++ *ld_cacertdir, *ld_cert, *ld_key, ++ &data ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: ERROR: could not compute checksum.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ pem_dirs[0] = PR_smprintf( "%s-%s-tlsmc-%s", nssdb_dir_path, nssdb_prefix, checksum ); ++ pem_dirs[1] = PR_smprintf( "/tmp/%s", tlsmc_path2name( pem_dirs[0] ) ); ++ ++ int i=0; ++ while ( NULL != ( dir = *(dirs++) ) ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: INFO: trying with PEM dir = `%s'.\n", ++ dir, 0, 0 ); ++ if ( 0 == stat( dir, &stat_buf ) ) { ++ if ( S_ISDIR(stat_buf.st_mode) ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: INFO: using the existing PEM dir.\n", ++ 0, 0, 0 ); ++ break; ++ } else { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: WARN: tried to stat the PEM dir but it is not a directory, will try another one.\n", ++ 0, 0, 0 ); ++ continue; ++ } ++ } ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: WARN: could not stat PEM dir, will try to create it.\n", ++ 0, 0, 0 ); ++ if ( 0 == tlsmc_prepare_dir( dir ) ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: WARN: cannot prepare the PEM dir, will try another one.\n", ++ 0, 0, 0 ); ++ continue; ++ } ++ if ( 0 == tlsmc_extract_nssdb( dir, ld_cacertdir, ld_cert, ld_key ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: could not extract from the NSS DB.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, dir ); ++ tlsmc_write_file( readme_path, data, S_IRUSR ); ++ rv = 1; ++ break; ++ } ++ ++ if ( dir == NULL ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: no usable PEM dir.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ if (*ld_cacertdir) free(*ld_cacertdir); ++ *ld_cacertdir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, dir ); ++ if ( ! ( ( 0 == stat( *ld_cacertdir, &stat_buf ) ) ++ && S_ISDIR(stat_buf.st_mode) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: WARN: extracted cacerts dir is not present.\n", ++ 0, 0, 0 ); ++ *ld_cacertdir = NULL; ++ } ++ ++ if (*ld_cert) free(*ld_cert); ++ *ld_cert = PR_smprintf( "%s/" TLSMC_CERT_FILE_NAME, dir ); ++ if ( ! ( ( 0 == stat( *ld_cert, &stat_buf ) ) ++ && S_ISREG(stat_buf.st_mode) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: WARN: extracted cert file is not present.\n", ++ 0, 0, 0 ); ++ *ld_cert = NULL; ++ } ++ ++ if (*ld_key) free(*ld_key); ++ *ld_key = PR_smprintf( "%s/" TLSMC_KEY_FILE_NAME, dir ); ++ if ( ! ( ( 0 == stat( *ld_key, &stat_buf ) ) ++ && S_ISREG(stat_buf.st_mode) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: WARN: extracted key file is not present.\n", ++ 0, 0, 0 ); ++ *ld_key = NULL; ++ } ++ ++ rv = 1; ++ ++bail: ++ if ( pem_dirs[0] ) PR_smprintf_free( pem_dirs[0] ); ++ if ( pem_dirs[1] ) PR_smprintf_free( pem_dirs[1] ); ++ if ( nssdb_prefix ) free( nssdb_prefix ); ++ if ( nssdb_dir_path ) free( nssdb_dir_path ); ++ if ( nss_ctx ) tlsmc_close_nssdb( &nss_ctx ); ++ ++#ifdef LDAP_R_COMPILE ++ ldap_pvt_thread_mutex_unlock( &tlsmc_mutex ); ++#endif ++ ++ return rv; ++} ++ ++ ++ ++ ++// returns 0 when successful ++int ++tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ) ++{ ++ int rv = 0; ++ char *ld_cacertdir = NULL; ++ char *ld_cert = NULL; ++ char *ld_key = NULL; ++ ++ ld_cacertdir = lo->ldo_tls_cacertdir ? LDAP_STRDUP( (char *) lo->ldo_tls_cacertdir ) : NULL; ++ ld_cert = lo->ldo_tls_certfile ? LDAP_STRDUP( (char *) lo->ldo_tls_certfile ) : NULL; ++ ld_key = lo->ldo_tls_keyfile ? LDAP_STRDUP( (char *) lo->ldo_tls_keyfile ) : NULL; ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_intercept_initialization: INFO: entry options follow:\n" ++ "tlsmc_intercept_initialization: INFO: cacertdir = `%s'\n" ++ "tlsmc_intercept_initialization: INFO: certfile = `%s'\n" ++ "tlsmc_intercept_initialization: INFO: keyfile = `%s'\n", ++ lo->ldo_tls_cacertdir, lo->ldo_tls_certfile, lo->ldo_tls_keyfile ); ++ ++ if ( 0 == tlsmc_convert( &ld_cacertdir, &ld_cert, &ld_key ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_intercept_initialization: FATAL: could not intercept TLS initialization. TLS will not work!\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir ); ++ lo->ldo_tls_cacertdir = ld_cacertdir ? LDAP_STRDUP( (char *) ld_cacertdir ) : NULL; ++ ++ if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile ); ++ lo->ldo_tls_certfile = ld_cert ? LDAP_STRDUP( (char *) ld_cert ) : NULL; ++ ++ if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile ); ++ lo->ldo_tls_keyfile = ld_key ? LDAP_STRDUP( (char *) ld_key ) : NULL; ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_intercept_initialization: INFO: altered options follow:\n" ++ "tlsmc_intercept_initialization: INFO: cacertdir = `%s'\n" ++ "tlsmc_intercept_initialization: INFO: certfile = `%s'\n" ++ "tlsmc_intercept_initialization: INFO: keyfile = `%s'\n", ++ lo->ldo_tls_cacertdir, lo->ldo_tls_certfile, lo->ldo_tls_keyfile ); ++ ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only.\n", ++ 0, 0, 0 ); ++ rv = 1; ++bail: ++ if ( ld_cacertdir ) LDAP_FREE( ld_cacertdir ); ++ if ( ld_cert ) LDAP_FREE( ld_cert ); ++ if ( ld_key ) LDAP_FREE( ld_key ); ++ return rv; ++} ++ ++#endif /* HAVE_MOZNSS_COMPATIBILITY */ ++/* ++ emacs settings ++ Local Variables: ++ indent-tabs-mode: t ++ tab-width: 4 ++ End: ++*/ +diff --git a/libraries/libldap/tls_mc.h b/libraries/libldap/tls_mc.h +new file mode 100644 +index 000000000..2e6e567dc +--- /dev/null ++++ b/libraries/libldap/tls_mc.h +@@ -0,0 +1,18 @@ ++#ifndef _LDAP_TLSMC_H ++#define _LDAP_TLSMC_H ++ ++#include "portable.h" ++ ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ ++#include "ldap-int.h" ++ ++int ++tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ); ++ ++int ++tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ); ++ ++ ++#endif /* HAVE_MOZNSS_COMPATIBILITY */ ++#endif /* _LDAP_TLSMC_H */ +diff --git a/libraries/libldap/tls_mc_ossl.c b/libraries/libldap/tls_mc_ossl.c +new file mode 100644 +index 000000000..d61ec207c +--- /dev/null ++++ b/libraries/libldap/tls_mc_ossl.c +@@ -0,0 +1,90 @@ ++#include "portable.h" ++ ++/* This file contains functions that require OpenSSL headers due to some ++ conflicts with what MozNSS defines. ++*/ ++ ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ ++#include ++#include ++#include "ldap-int.h" ++#include ++#include ++#include ++ ++ ++int ++tlsmc_cert_create_hash_symlink( char *cert_path, char *cacerts_dir ) ++{ ++ int rv = 0; ++ X509 *cert = NULL; ++ FILE *fp = NULL; ++ unsigned long hash = 0; ++ char *cert_filename_p = NULL; ++ char *last_slash_p = NULL; ++ char *symlink_path = NULL; ++ int cnt = 0; ++ ++ if ( NULL == ( fp = fopen( cert_path, "r" ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: ERROR: could not open the cert file.\n", ++ 0, 0, 0 ); ++ perror( "tlsmc_cert_create_hash_symlink: ERROR: OS error" ); ++ goto bail; ++ } ++ if ( NULL == PEM_read_X509( fp, &cert, NULL, NULL ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: ERROR: could not read PEM data.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ if ( 0 == ( hash = X509_subject_name_hash( cert ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: ERROR: could not hash subject.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ last_slash_p = strrchr( cert_path, '/' ); ++ cert_filename_p = last_slash_p ? last_slash_p + 1 : cert_path; ++ for ( cnt = 0; cnt < 10; cnt++ ) { ++ symlink_path = PR_smprintf( "%s/%08lx.%d", cacerts_dir, hash, cnt ); ++ if ( 0 != symlink( cert_filename_p, symlink_path ) ) { ++ if ( errno == EEXIST ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: INFO: symlink `%s' already exists.\n", ++ 0, 0, 0 ); ++ if ( symlink_path ) PR_smprintf( symlink_path ); ++ continue; ++ } ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: ERROR: could not create symlink.\n", ++ 0, 0, 0 ); ++ perror( "tlsmc_cert_create_hash_symlink: ERROR: OS error" ); ++ goto bail; ++ } ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_cert_create_hash_symlink: INFO: the cert is now symlinked to %s.\n", ++ symlink_path, 0, 0 ); ++ rv = 1; ++ goto bail; ++ } ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: INFO: could not create symlink (all possible file names taken).\n", ++ 0, 0, 0 ); ++bail: ++ if ( symlink_path ) PR_smprintf_free( symlink_path ); ++ if ( cert ) X509_free( cert ); ++ if ( fp ) fclose( fp ); ++ return rv; ++} ++ ++#endif /* HAVE_MOZNSS_COMPATIBILITY */ ++/* ++ emacs settings ++ Local Variables: ++ indent-tabs-mode: t ++ tab-width: 4 ++ End: ++*/ +diff --git a/libraries/libldap/tls_mc_ossl.h b/libraries/libldap/tls_mc_ossl.h +new file mode 100644 +index 000000000..1b4284576 +--- /dev/null ++++ b/libraries/libldap/tls_mc_ossl.h +@@ -0,0 +1,12 @@ ++#ifndef _LDAP_TLSMC_OSSL_H ++#define _LDAP_TLSMC_OSSL_H ++ ++#include "portable.h" ++ ++#ifdef HAVE_MOZNSS_COMPATIBILITY ++ ++int ++tlsmc_cert_create_hash_symlink( char *cert_path, char *cacerts_dir ); ++ ++#endif ++#endif +diff --git a/libraries/libldap_r/Makefile.in b/libraries/libldap_r/Makefile.in +index cdf4070dd..c7a86c95f 100644 +--- a/libraries/libldap_r/Makefile.in ++++ b/libraries/libldap_r/Makefile.in +@@ -28,7 +28,7 @@ XXSRCS = apitest.c test.c \ + request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \ + init.c options.c print.c string.c util-int.c schema.c \ + charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ +- tls2.c tls_o.c tls_g.c tls_m.c \ ++ tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \ + turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ + assertion.c deref.c ldif.c fetch.c + SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \ +@@ -46,7 +46,7 @@ OBJS = threads.lo rdwr.lo rmutex.lo tpool.lo rq.lo \ + request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \ + init.lo options.lo print.lo string.lo util-int.lo schema.lo \ + charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ +- tls2.lo tls_o.lo tls_g.lo tls_m.lo \ ++ tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \ + turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ + assertion.lo deref.lo ldif.lo fetch.lo + diff --git a/openldap.spec b/openldap.spec index 12df3b8..4e996c4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -27,12 +27,6 @@ Patch1: openldap-sql-linking.patch Patch2: openldap-reentrant-gethostby.patch Patch3: openldap-smbk5pwd-overlay.patch Patch5: openldap-ai-addrconfig.patch -# nss patches, unlikely to ever get upstreamed -Patch12: openldap-tls-no-reuse-of-tls_session.patch -Patch13: openldap-nss-regex-search-hashed-cacert-dir.patch -Patch14: openldap-nss-ignore-certdb-type-prefix.patch -Patch15: openldap-nss-certs-from-certdb-fallback-pem.patch -Patch16: openldap-nss-pk11-freeslot.patch Patch17: openldap-allop-overlay.patch # fix back_perl problems with lt_dlopen() @@ -42,24 +36,16 @@ Patch17: openldap-allop-overlay.patch Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # ldapi sasl fix pending upstream inclusion Patch20: openldap-ldapi-sasl.patch -Patch22: openldap-nss-protocol-version-new-api.patch - -Patch50: openldap-nss-cipher-attributes.patch -Patch51: openldap-nss-ciphers-parsing.patch -Patch52: openldap-nss-ciphers-use-nss-defaults.patch -Patch53: openldap-nss-ciphers-definitions.patch # check-password module specific patches Patch90: check-password-makefile.patch Patch91: check-password.patch -# Fedora specific patches -Patch100: openldap-autoconf-pkgconfig-nss.patch +# MozNSS compatibility layer +Patch100: openldap-tlsmc.patch -BuildRequires: cyrus-sasl-devel, nss-devel, krb5-devel, tcp_wrappers-devel, unixODBC-devel +BuildRequires: cyrus-sasl-devel, nss-devel, openssl-devel, krb5-devel, tcp_wrappers-devel, unixODBC-devel BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) -# smbk5pwd overlay: -BuildRequires: openssl-devel Recommends: nss-tools %description @@ -126,13 +112,12 @@ programs needed for accessing and modifying OpenLDAP directories. pushd openldap-%{version} -# use pkg-config for Mozilla NSS library -%patch100 -p1 - # alternative include paths for Mozilla NSS ln -s %{_includedir}/nss3 include/nss ln -s %{_includedir}/nspr4 include/nspr +%patch100 -p1 + AUTOMAKE=%{_bindir}/true autoreconf -fi %patch0 -p1 @@ -140,20 +125,9 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch2 -p1 %patch3 -p1 %patch5 -p1 -%patch12 -p1 -%patch13 -p1 -%patch14 -p1 -%patch15 -p1 -%patch16 -p1 %patch17 -p1 %patch19 -p1 %patch20 -p1 -%patch22 -p1 - -%patch50 -p1 -%patch51 -p1 -%patch52 -p1 -%patch53 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -219,11 +193,12 @@ pushd openldap-%{version} \ --disable-static \ \ + --enable-moznss-compatibility=yes \ + \ --with-cyrus-sasl \ --without-fetch \ --with-threads \ --with-pic \ - --with-tls=moznss \ --with-gnu-ld \ \ --libexecdir=%{_libdir} @@ -546,6 +521,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Fri Nov 3 2017 Matus Honek - 2.4.45-4 +- Build with OpenSSL with MozNSS compatibility layer (#1400570) + * Thu Aug 03 2017 Fedora Release Engineering - 2.4.45-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild From 9e4e33d81af043e8c50fa51c81c240fc37d2540c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Tue, 5 Dec 2017 16:22:10 +0100 Subject: [PATCH 004/118] fix: openldap does not re-register nss shutdown callbacks after nss_Shutdown is called Resolves: #1520990 --- ...nss-reregister-nss-shutdown-callback.patch | 50 +++++++++++++++++++ openldap.spec | 7 ++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 openldap-nss-reregister-nss-shutdown-callback.patch diff --git a/openldap-nss-reregister-nss-shutdown-callback.patch b/openldap-nss-reregister-nss-shutdown-callback.patch new file mode 100644 index 0000000..03b8611 --- /dev/null +++ b/openldap-nss-reregister-nss-shutdown-callback.patch @@ -0,0 +1,50 @@ +NSS: re-register NSS_Shutdown callback + +Original upstream comment: +""" +When there's a persistent daemon for auth and it sets LDAP_OPT_X_TLS_NEWCTX, it +fails to auth at third login. + +1. everything is good and destroyed after use but +tlsm_register_shutdown_callonce.initialized=1. +2. still good but because tlsm_register_shutdown_callonce.initialized==1, it +fails to register shutdown function. + so pem_module is not destroyed at the end. +3. pem_module is not NULL so it's not initialized again and not added to modules +list. And Login fails. +""" + +Sent-By: soohoon.lee@f5.com +Original-Name: soohoon-lee-160823.patch +Upstream-ITS: 8484 + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index cdf7f8e..cf05914 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -1145,6 +1145,8 @@ tlsm_auth_cert_handler(void *arg, PRFileDesc *fd, + return ret; + } + ++static PRCallOnceType tlsm_register_shutdown_callonce = {0,0}; ++ + static SECStatus + tlsm_nss_shutdown_cb( void *appData, void *nssData ) + { +@@ -1157,10 +1159,15 @@ tlsm_nss_shutdown_cb( void *appData, void *nssData ) + SECMOD_DestroyModule( pem_module ); + pem_module = NULL; + } ++ ++ /* init callonce so it can be armed again for cases like persistent daemon with LDAP_OPT_X_TLS_NEWCTX */ ++ tlsm_register_shutdown_callonce.initialized = 0; ++ tlsm_register_shutdown_callonce.inProgress = 0; ++ tlsm_register_shutdown_callonce.status = 0; ++ + return rc; + } + +-static PRCallOnceType tlsm_register_shutdown_callonce = {0,0}; + static PRStatus PR_CALLBACK + tlsm_register_nss_shutdown_cb( void ) + { diff --git a/openldap.spec b/openldap.spec index 2635fbd..22e7881 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -34,6 +34,7 @@ Patch14: openldap-nss-ignore-certdb-type-prefix.patch Patch15: openldap-nss-certs-from-certdb-fallback-pem.patch Patch16: openldap-nss-pk11-freeslot.patch Patch17: openldap-allop-overlay.patch +Patch18: openldap-nss-reregister-nss-shutdown-callback.patch # fix back_perl problems with lt_dlopen() # might cause crashes because of symbol collisions @@ -146,6 +147,7 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch15 -p1 %patch16 -p1 %patch17 -p1 +%patch18 -p1 %patch19 -p1 %patch20 -p1 %patch22 -p1 @@ -546,6 +548,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Tue Dec 5 2017 Matus Honek - 2.4.45-2 +- fix: openldap does not re-register nss shutdown callbacks after nss_Shutdown is called (#1520990) + * Fri Jul 7 2017 Matus Honek - 2.4.45-1 - Rebase to version 2.4.45 (#1458081) * fixes CVE-2017-9287 (#1456712, #1456713) From d181b0472d2d1e3a5204a91a199229a03ca9b413 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 6 Dec 2017 15:13:49 +0100 Subject: [PATCH 005/118] Fix various MozNSS compatibility layer issues + Force write file with fsync to avoid race conditions + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix + Allow missing cert and key which is a valid usecase + Create extraction folder only in /tmp to simplify selinux rules + Fix Covscan issues Related: #1400570 --- openldap-tlsmc.patch | 378 +++++++++++++------------------------------ openldap.spec | 10 +- 2 files changed, 123 insertions(+), 265 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index 2bc514f..d781817 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,5 +1,8 @@ +MozNSS Interception Code + +Author: Matus Honek +Date: Mon Nov 27 16:03:42 CET 2017 diff --git a/configure.in b/configure.in -index b251b6b06..8a836eabb 100644 --- a/configure.in +++ b/configure.in @@ -237,6 +237,7 @@ dnl OL_ARG_ENABLE(referrals,[ --enable-referrals enable LDAPv2+ Referrals (ex @@ -38,7 +41,6 @@ index b251b6b06..8a836eabb 100644 if test $ol_link_tls = yes ; then AC_DEFINE(HAVE_TLS, 1, [define if you have TLS]) diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 -index 389e1c4fd..60c7d05a5 100644 --- a/doc/man/man3/ldap_get_option.3 +++ b/doc/man/man3/ldap_get_option.3 @@ -772,6 +772,19 @@ must be @@ -62,7 +64,6 @@ index 389e1c4fd..60c7d05a5 100644 On success, the functions return .BR LDAP_OPT_SUCCESS , diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index b6735bab5..612b63a2b 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 @@ -483,6 +483,11 @@ Check the CRL for a whole certificate chain @@ -78,7 +79,6 @@ index b6735bab5..612b63a2b 100644 .TP LDAPNOINIT diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 -index 6afbd7d6b..2893cd4a5 100644 --- a/doc/man/man5/slapd-config.5 +++ b/doc/man/man5/slapd-config.5 @@ -1004,6 +1004,11 @@ Check the CRL for a whole certificate chain @@ -94,7 +94,6 @@ index 6afbd7d6b..2893cd4a5 100644 If .B slapd diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 -index 86abeca80..742568393 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 @@ -1235,6 +1235,11 @@ Check the CRL for a whole certificate chain @@ -110,7 +109,6 @@ index 86abeca80..742568393 100644 Options in this section only apply to the configuration file section for the specified backend. They are supported by every diff --git a/include/ldap.h b/include/ldap.h -index db6869da8..aae8bebd8 100644 --- a/include/ldap.h +++ b/include/ldap.h @@ -158,6 +158,10 @@ LDAP_BEGIN_DECL @@ -125,7 +123,6 @@ index db6869da8..aae8bebd8 100644 #define LDAP_OPT_X_TLS_NEVER 0 #define LDAP_OPT_X_TLS_HARD 1 diff --git a/libraries/libldap/Makefile.in b/libraries/libldap/Makefile.in -index 636b15506..a1445312f 100644 --- a/libraries/libldap/Makefile.in +++ b/libraries/libldap/Makefile.in @@ -26,7 +26,7 @@ SRCS = bind.c open.c result.c error.c compare.c search.c \ @@ -147,7 +144,6 @@ index 636b15506..a1445312f 100644 assertion.lo deref.lo ldif.lo fetch.lo diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c -index 39ad7ce7c..689144ca3 100644 --- a/libraries/libldap/init.c +++ b/libraries/libldap/init.c @@ -137,7 +137,9 @@ static const struct ol_attribute { @@ -172,7 +168,6 @@ index 39ad7ce7c..689144ca3 100644 gopts->ldo_keepalive_probes = 0; gopts->ldo_keepalive_interval = 0; diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h -index bcc58f367..d42b82627 100644 --- a/libraries/libldap/ldap-int.h +++ b/libraries/libldap/ldap-int.h @@ -260,7 +260,8 @@ struct ldapoptions { @@ -186,7 +181,6 @@ index bcc58f367..d42b82627 100644 #define LDAP_LDO_TLS_NULLARG #endif diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index 8f842278a..878e1a0a8 100644 --- a/libraries/libldap/tls2.c +++ b/libraries/libldap/tls2.c @@ -37,6 +37,8 @@ @@ -287,10 +281,9 @@ index 8f842278a..878e1a0a8 100644 } diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 -index 000000000..8383cb4ec --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1323 @@ +@@ -0,0 +1,1179 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -382,10 +375,16 @@ index 000000000..8383cb4ec + perror("IO ERROR: could not set file mode"); + goto bail; + } -+ if ( 0 > close( fd ) ) { -+ perror("IO ERROR: could not close file"); ++ if ( -1 >= fsync( fd ) ) { ++ perror("IO ERROR: could not fsync the file"); + goto bail; + } ++ if ( 0 > close( fd ) ) { ++ perror("IO ERROR: could not close file"); ++ fd = -1; ++ goto bail; ++ } ++ fd = -1; + rv = 1; +bail: + if ( fd > -1 ) close( fd ); @@ -393,23 +392,6 @@ index 000000000..8383cb4ec +} + + -+void -+tlsmc_debug_nspr_msg() -+{ -+ int _errno = errno; -+ PRInt32 oserror = PR_GetOSError(); -+ char *errno_str = strerror(_errno); -+ char *errstr = PR_Malloc( PR_GetErrorTextLength() + 1 ); -+ PR_GetErrorText( errstr ); -+ Debug( LDAP_DEBUG_ANY, -+ "... NSPR error %d:`%s'\n", -+ PR_GetError(), errstr, 0 ); -+ Debug( LDAP_DEBUG_ANY, -+ "... NSPR OS-error %d, errno %d:%s\n", -+ oserror, _errno, errno_str ); -+ PR_Free( errstr ); -+} -+ +/* BORROWED FROM tls_m.c */ +static void +tlsmc_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) @@ -444,6 +426,7 @@ index 000000000..8383cb4ec +} + + ++/* BORROWED FROM tls_m.c */ +static char * +tlsmc_get_pin_from_file(const char *token_name, char *filename) +{ @@ -530,6 +513,7 @@ index 000000000..8383cb4ec +} + + ++/* BORROWED FROM tls_m.c */ +/* + * Turn the echoing off on a tty. + */ @@ -544,6 +528,7 @@ index 000000000..8383cb4ec + } +} + ++/* BORROWED FROM tls_m.c */ +/* + * Turn the echoing on on a tty. + */ @@ -560,7 +545,7 @@ index 000000000..8383cb4ec +} + + -+/* Borrowed from tlsm_get_pin() */ ++/* BORROWED FROM tls_m.c */ +char * +tlsmc_get_pin( PK11SlotInfo *slot, PRBool retry, void * filename) +{ @@ -605,7 +590,7 @@ index 000000000..8383cb4ec + + +int -+tlsmc_hash( unsigned char **dest, char *src ) ++tlsmc_hash( char **dest, const char *src ) +{ + int rv = 0; + unsigned char fp[SHA256_LENGTH]; @@ -633,35 +618,6 @@ index 000000000..8383cb4ec + + +/* BORROWED FROM tls_m.c */ -+static PK11SlotInfo * -+tlsmc_init_open_certdb( const char *nssdb_dir, const char *prefix ) -+{ -+ PK11SlotInfo *slot = NULL; -+ char *config = NULL; -+ -+ config = PR_smprintf( "configDir='%s' tokenDescription='%s' " -+ "certPrefix='%s' keyPrefix='%s' flags=readOnly", -+ nssdb_dir, TLSM_CERTDB_DESC, -+ prefix, prefix ); -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_init_open_certdb: INFO: certdb config: `%s`.\n", -+ config, 0, 0 ); -+ -+ slot = SECMOD_OpenUserDB( config ); -+ if ( !slot ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_init_open_certdb: ERROR: cannot open certdb `%s`, error `%d:%s`.\n", -+ nssdb_dir, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ } -+ -+ if ( config ) PR_smprintf_free( config ); -+ -+ return slot; -+} -+ -+ -+/* Borrowed from tlsm_deferred_init */ +int +tlsmc_open_nssdb( char *ld_cacertdir, NSSInitContext **out_initctx, char **out_nssdb_dir, char **out_nssdb_prefix ) +{ @@ -754,17 +710,6 @@ index 000000000..8383cb4ec +} + + -+static int -+tlsmc_is_sql_nssdb( const char *ld_cacertdir ) -+{ -+ if ( 0 == strncmp( "sql:", ld_cacertdir, 4 ) ) { -+ return 1; -+ } else { -+ return 0; -+ } -+} -+ -+ +int +tlsmc_filestamp( char **filestamp, char *path ) +{ @@ -773,7 +718,7 @@ index 000000000..8383cb4ec + char stime[20]; + + if ( 0 != stat( path, &attr ) ) { -+ perror("IO ERROR: could not stat file"); ++ rv = -1; + goto bail; + } + if ( 0 == strftime(stime, sizeof(stime), "%FT%T", localtime(&attr.st_mtime)) ) { @@ -812,31 +757,28 @@ index 000000000..8383cb4ec + "FILES:\n", + nssdb_dir, nssdb_prefix, ld_cacertdir, ld_cert, ld_key, geteuid() ); + -+ char *bdb_files[] = { "cert8.db", "key3.db", "secmod.db", NULL }; -+ char *sql_files[] = { "cert9.db", "key4.db", "secmod.db", NULL }; -+ char **files = ( 1 == tlsmc_is_sql_nssdb( ld_cacertdir ) ) ? sql_files : bdb_files; // FIXME we should do all files as default prefix may (and will) change and thus change the semantics of the ld_cacertdir -+ char *file = *files; -+ while ( NULL != ( file = *(files++) ) ) { ++ char *files[] = { "cert8.db", "cert9.db", "key3.db", "key4.db", "secmod.db", NULL }; ++ char **filep = NULL; ++ for ( filep = files; NULL != *filep; filep++ ) { + char *filestamp = NULL; + char *path = NULL; -+ path = PR_smprintf( "%s/%s%s", nssdb_dir, nssdb_prefix, file ); ++ path = PR_smprintf( "%s/%s%s", nssdb_dir, nssdb_prefix, *filep ); + if ( 0 == tlsmc_filestamp( &filestamp, path ) ) { + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_compute_checksum: ERROR: could not stat file `%s'.\n", ++ "tlsmc_compute_checksum: INFO: could not check file `%s'.\n", + path, 0, 0 ); + rv = -1; + } else { -+ data = PR_sprintf_append( data, "%s: %s\n", file, filestamp ); ++ data = PR_sprintf_append( data, "%s: %s\n", *filep, filestamp ); + } -+ bail_one: + if ( filestamp ) PR_smprintf_free( filestamp ); + if ( path ) PR_smprintf_free( path ); + if ( -1 == rv ) goto bail; + } + + /* compute data checksum */ -+ unsigned char *checksum = NULL; -+ if ( 1 != tlsmc_hash( &checksum, data ) ) { ++ char *checksum = NULL; ++ if ( 1 != tlsmc_hash( &checksum, (const char*) data ) ) { + checksum = NULL; + goto bail; + } @@ -857,8 +799,6 @@ index 000000000..8383cb4ec +tlsmc_prepare_dir( char *dir ) +{ + int rv = 0; -+ PRFileInfo info; -+ PRStatus prv; + char *cacerts_dir = NULL; + + Debug( LDAP_DEBUG_TRACE, @@ -897,6 +837,8 @@ index 000000000..8383cb4ec + return rv; +} + ++ ++/* BORROWED FROM 389ds: ssl.c */ +int +tlsmc_extract_cert_to_file(CERTCertDBHandle *certdb_handle, CERTCertificate *cert, char *file_path) +{ @@ -949,8 +891,7 @@ index 000000000..8383cb4ec +} + + -+ -+/* borrowed from 389-ds-base, ssl.c, DecryptKey */ ++/* BORROWED FROM 389ds: ssl.c */ +int +tlsmc_decrypt_key(SECKEYEncryptedPrivateKeyInfo *epki, + SECOidTag algTag, @@ -1020,7 +961,7 @@ index 000000000..8383cb4ec +} + + -+ ++/* BORROWED FROM 389ds: ssl.c */ +int +tlsmc_extract_key_of_cert_to_file(CERTCertificate *cert, + char *pin_filename, @@ -1034,7 +975,6 @@ index 000000000..8383cb4ec + SECItem clearKeyDER; + char *b64 = NULL; + char *output = NULL; -+ //SECItem *data = PK11_ExportDERPrivateKeyInfo(key, (void *)pin_filename); // FIXME NULL? // probably won't work + + // establish password + pwitem.data = "secretpw"; // FIXME use pin_filename @@ -1110,17 +1050,24 @@ index 000000000..8383cb4ec + return rv; +} + -+//TODO drop? ++ ++/* BORROWED FROM 389ds: ssl.c */ +int +tlsmc_extract_cert_key_pair(char *nickname, char *pin_filename, char *dir_name) +{ + int rv = 0; -+ int fd = -1; + CERTCertDBHandle *certHandle = NULL; + CERTCertificate *cert = NULL; + char *cert_file_path = NULL; + char *key_file_path = NULL; + ++ if ( NULL == nickname ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: WARN: supplied nickname is empty (NULL).\n", ++ 0, 0, 0 ); ++ rv = 1; ++ goto bail; ++ } + if ( NULL == ( certHandle = CERT_GetDefaultCertDB() ) ) { + // FIXME see same in tlsmc_extract_cacerts() + Debug( LDAP_DEBUG_ANY, @@ -1169,106 +1116,7 @@ index 000000000..8383cb4ec +} + + -+/* Adopted from 389DS. */ -+static int -+tlsmc_list_certs(CERTCertDBHandle *handle, -+ CERTCertificate *cert, -+ PK11SlotInfo *slot, -+ PRFileDesc *outfile, -+ void *pwarg) -+{ -+ SECItem data; -+ int rv = 0; -+ CERTCertList *certs; -+ CERTCertListNode *node; -+ CERTCertificate *the_cert = NULL; -+ char *name = NULL; -+ -+ if (!cert) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_list_certs: WARN: no cert given.\n", -+ 0, 0, 0 ); -+ return rv; -+ } -+ name = cert->nickname; -+ -+ if (!name) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_list_certs: WARN: no cert nickname.\n", -+ 0, 0, 0 ); -+ return rv; -+ } -+ the_cert = CERT_FindCertByNicknameOrEmailAddr(handle, name); -+ if (!the_cert) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_list_certs: WARN: could not find cert: %s.\n", -+ name, 0, 0 ); -+ return 0; -+ } -+ -+ PR_fprintf(outfile, "%s\n", DONOTEDIT); -+ /* Here, we have one cert with the desired nickname or email -+ * address. Now, we will attempt to get a list of ALL certs -+ * with the same subject name as the cert we have. That list -+ * should contain, at a minimum, the one cert we have already found. -+ * If the list of certs is empty (NULL), the libraries have failed. -+ */ -+ certs = CERT_CreateSubjectCertList(NULL, handle, &the_cert->derSubject, -+ PR_Now(), PR_FALSE); -+ CERT_DestroyCertificate(the_cert); -+ if (!certs) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_list_certs: WARN: problem printing certificates.\n", -+ 0, 0, 0 ); -+ return 0; -+ } -+ for (node = CERT_LIST_HEAD(certs); !CERT_LIST_END(node,certs); node = CERT_LIST_NEXT(node)) { -+ the_cert = node->cert; -+ PR_fprintf(outfile, "Issuer: %s\n", the_cert->issuerName); -+ PR_fprintf(outfile, "Subject: %s\n", the_cert->subjectName); -+ /* now get the subjectList that matches this cert */ -+ data.data = the_cert->derCert.data; -+ data.len = the_cert->derCert.len; -+ PR_fprintf(outfile, "\n%s\n%s\n%s\n", -+ PEM_CERT_HEADER, -+ BTOA_DataToAscii(data.data, data.len), -+ PEM_CERT_FOOTER); -+ rv = 1; -+ } -+ if (certs) { -+ CERT_DestroyCertList(certs); -+ } -+ if (rv) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_list_certs: WARN: problem printing certificate nicknames.\n", -+ 0, 0, 0 ); -+ return 0; -+ } -+ -+ return rv; -+} -+ -+static char* -+tlsmc_extract_key() -+{ -+ return NULL; -+} -+ -+/* Adopted from 389DS. */ -+static int -+tlsmc_extract_cert(char *token_colon_name, char *filename) -+{ -+ CERTCertListNode *node; -+ CERTCertList *list = PK11_ListCerts(PK11CertListAll, NULL); -+ for (node = CERT_LIST_HEAD(list); -+ !CERT_LIST_END(node, list); -+ node = CERT_LIST_NEXT(node)) { -+ CERTCertificate *cert = node->cert; -+ CERTCertTrust trust; -+ } -+ return 0; -+} -+ ++/* BORROWED FROM 389ds: ssl.c */ +int +tlsmc_extract_cacerts( char *dir_name ) +{ @@ -1376,14 +1224,6 @@ index 000000000..8383cb4ec + 0, 0, 0 ); + } + -+ if ( ( ! *ld_cert ) || ( ! *ld_key ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: ERROR: cert or key empty.\n", -+ 0, 0, 0 ); -+ rv = -1; -+ goto bail; -+ } -+ + if ( 0 == tlsmc_extract_cert_key_pair( *ld_cert, *ld_key, dir_name ) ) { + Debug( LDAP_DEBUG_ANY, + "tlsmc_extract_nssdb: ERROR: could not export user cert and/or key.\n", @@ -1397,6 +1237,8 @@ index 000000000..8383cb4ec + return rv; +} + ++ ++/* BORROWED FROM tls_m.c */ +int +tlsmc_close_nssdb(NSSInitContext **initctx) +{ @@ -1411,6 +1253,7 @@ index 000000000..8383cb4ec + } +} + ++ +int +tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ) +{ @@ -1419,14 +1262,11 @@ index 000000000..8383cb4ec + + NSSInitContext *nss_ctx = NULL; + char *nssdb_dir_path = NULL; -+ char *nssdb_dir_name = NULL; + char *nssdb_prefix = NULL; -+ char *pem_dirs[] = { NULL, NULL, NULL }; ++ char *pem_dir = NULL; + char *readme_path = NULL; + char *data = NULL; // data before checksum + char *checksum = NULL; // checksummed data -+ char **dirs = pem_dirs; -+ char *dir = *dirs; + struct stat stat_buf; + +#ifdef LDAP_R_COMPILE @@ -1436,6 +1276,13 @@ index 000000000..8383cb4ec + Debug( LDAP_DEBUG_TRACE, + "tlsmc_convert: INFO: trying to open NSS DB with CACertDir = `%s'.\n", + *ld_cacertdir, 0, 0 ); ++ if ( NULL == ld_cacertdir || NULL == ld_cert || NULL == ld_key ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: ERROR: cannot proceed, some of the arguments are NULL.\n", ++ 0, 0, 0 ); ++ rv = 1; ++ goto bail; ++ } + if ( 0 == tlsmc_open_nssdb( *ld_cacertdir, &nss_ctx, &nssdb_dir_path, &nssdb_prefix ) ) { + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.\n", @@ -1453,58 +1300,61 @@ index 000000000..8383cb4ec + goto bail; + } + -+ pem_dirs[0] = PR_smprintf( "%s-%s-tlsmc-%s", nssdb_dir_path, nssdb_prefix, checksum ); -+ pem_dirs[1] = PR_smprintf( "/tmp/%s", tlsmc_path2name( pem_dirs[0] ) ); -+ -+ int i=0; -+ while ( NULL != ( dir = *(dirs++) ) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: trying with PEM dir = `%s'.\n", -+ dir, 0, 0 ); -+ if ( 0 == stat( dir, &stat_buf ) ) { -+ if ( S_ISDIR(stat_buf.st_mode) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: using the existing PEM dir.\n", -+ 0, 0, 0 ); -+ break; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: tried to stat the PEM dir but it is not a directory, will try another one.\n", -+ 0, 0, 0 ); -+ continue; -+ } -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: WARN: could not stat PEM dir, will try to create it.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_prepare_dir( dir ) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: WARN: cannot prepare the PEM dir, will try another one.\n", -+ 0, 0, 0 ); -+ continue; -+ } -+ if ( 0 == tlsmc_extract_nssdb( dir, ld_cacertdir, ld_cert, ld_key ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not extract from the NSS DB.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, dir ); -+ tlsmc_write_file( readme_path, data, S_IRUSR ); -+ rv = 1; -+ break; -+ } -+ -+ if ( dir == NULL ) { ++ if ( NULL == ( pem_dir = PR_smprintf( "/tmp/openldap-tlsmc-%s-%s-%s", ++ tlsmc_path2name( nssdb_dir_path ), ++ nssdb_prefix, ++ checksum) ) ) { + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: no usable PEM dir.\n", ++ "tlsmc_convert: FATAL: could not allocate memory.\n", + 0, 0, 0 ); + goto bail; + } ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: INFO: trying with PEM dir = `%s'.\n", ++ pem_dir, 0, 0 ); ++ if ( 0 == stat( pem_dir, &stat_buf ) ) { ++ if ( S_ISDIR(stat_buf.st_mode) ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: INFO: using the existing PEM dir.\n", ++ 0, 0, 0 ); ++ goto pem_dir_exists; ++ } else { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: tried to stat the PEM dir but it is not a directory.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ } ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_convert: WARN: could not find the PEM dir, will try to create it.\n", ++ 0, 0, 0 ); ++ if ( 0 == tlsmc_prepare_dir( pem_dir ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: cannot prepare the PEM dir.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ if ( 0 == tlsmc_extract_nssdb( pem_dir, ld_cacertdir, ld_cert, ld_key ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: could not extract from the NSS DB.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ if ( NULL == ( readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, pem_dir ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: could not allocate memory.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ if ( 0 == tlsmc_write_file( readme_path, data, S_IRUSR ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: ERROR: could not create README file.\n", ++ 0, 0, 0 ); ++ } + ++pem_dir_exists: + if (*ld_cacertdir) free(*ld_cacertdir); -+ *ld_cacertdir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, dir ); ++ *ld_cacertdir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, pem_dir ); + if ( ! ( ( 0 == stat( *ld_cacertdir, &stat_buf ) ) + && S_ISDIR(stat_buf.st_mode) ) ) { + Debug( LDAP_DEBUG_ANY, @@ -1514,7 +1364,7 @@ index 000000000..8383cb4ec + } + + if (*ld_cert) free(*ld_cert); -+ *ld_cert = PR_smprintf( "%s/" TLSMC_CERT_FILE_NAME, dir ); ++ *ld_cert = PR_smprintf( "%s/" TLSMC_CERT_FILE_NAME, pem_dir ); + if ( ! ( ( 0 == stat( *ld_cert, &stat_buf ) ) + && S_ISREG(stat_buf.st_mode) ) ) { + Debug( LDAP_DEBUG_ANY, @@ -1524,7 +1374,7 @@ index 000000000..8383cb4ec + } + + if (*ld_key) free(*ld_key); -+ *ld_key = PR_smprintf( "%s/" TLSMC_KEY_FILE_NAME, dir ); ++ *ld_key = PR_smprintf( "%s/" TLSMC_KEY_FILE_NAME, pem_dir ); + if ( ! ( ( 0 == stat( *ld_key, &stat_buf ) ) + && S_ISREG(stat_buf.st_mode) ) ) { + Debug( LDAP_DEBUG_ANY, @@ -1536,8 +1386,8 @@ index 000000000..8383cb4ec + rv = 1; + +bail: -+ if ( pem_dirs[0] ) PR_smprintf_free( pem_dirs[0] ); -+ if ( pem_dirs[1] ) PR_smprintf_free( pem_dirs[1] ); ++ if ( pem_dir ) PR_smprintf_free( pem_dir ); ++ if ( data ) free( data ); + if ( nssdb_prefix ) free( nssdb_prefix ); + if ( nssdb_dir_path ) free( nssdb_dir_path ); + if ( nss_ctx ) tlsmc_close_nssdb( &nss_ctx ); @@ -1550,8 +1400,6 @@ index 000000000..8383cb4ec +} + + -+ -+ +// returns 0 when successful +int +tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ) @@ -1606,6 +1454,7 @@ index 000000000..8383cb4ec + return rv; +} + ++ +#endif /* HAVE_MOZNSS_COMPATIBILITY */ +/* + emacs settings @@ -1616,7 +1465,6 @@ index 000000000..8383cb4ec +*/ diff --git a/libraries/libldap/tls_mc.h b/libraries/libldap/tls_mc.h new file mode 100644 -index 000000000..2e6e567dc --- /dev/null +++ b/libraries/libldap/tls_mc.h @@ -0,0 +1,18 @@ @@ -1640,10 +1488,9 @@ index 000000000..2e6e567dc +#endif /* _LDAP_TLSMC_H */ diff --git a/libraries/libldap/tls_mc_ossl.c b/libraries/libldap/tls_mc_ossl.c new file mode 100644 -index 000000000..d61ec207c --- /dev/null +++ b/libraries/libldap/tls_mc_ossl.c -@@ -0,0 +1,90 @@ +@@ -0,0 +1,95 @@ +#include "portable.h" + +/* This file contains functions that require OpenSSL headers due to some @@ -1695,12 +1542,17 @@ index 000000000..d61ec207c + last_slash_p = strrchr( cert_path, '/' ); + cert_filename_p = last_slash_p ? last_slash_p + 1 : cert_path; + for ( cnt = 0; cnt < 10; cnt++ ) { -+ symlink_path = PR_smprintf( "%s/%08lx.%d", cacerts_dir, hash, cnt ); ++ if ( NULL == ( symlink_path = PR_smprintf( "%s/%08lx.%d", cacerts_dir, hash, cnt ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_cert_create_hash_symlink: ERROR: memory allocation error.\n", ++ 0, 0, 0 ); ++ continue; ++ } + if ( 0 != symlink( cert_filename_p, symlink_path ) ) { + if ( errno == EEXIST ) { + Debug( LDAP_DEBUG_ANY, + "tlsmc_cert_create_hash_symlink: INFO: symlink `%s' already exists.\n", -+ 0, 0, 0 ); ++ symlink_path, 0, 0 ); + if ( symlink_path ) PR_smprintf( symlink_path ); + continue; + } @@ -1736,7 +1588,6 @@ index 000000000..d61ec207c +*/ diff --git a/libraries/libldap/tls_mc_ossl.h b/libraries/libldap/tls_mc_ossl.h new file mode 100644 -index 000000000..1b4284576 --- /dev/null +++ b/libraries/libldap/tls_mc_ossl.h @@ -0,0 +1,12 @@ @@ -1753,7 +1604,6 @@ index 000000000..1b4284576 +#endif +#endif diff --git a/libraries/libldap_r/Makefile.in b/libraries/libldap_r/Makefile.in -index cdf4070dd..c7a86c95f 100644 --- a/libraries/libldap_r/Makefile.in +++ b/libraries/libldap_r/Makefile.in @@ -28,7 +28,7 @@ XXSRCS = apitest.c test.c \ diff --git a/openldap.spec b/openldap.spec index 0a065dc..d4cddc5 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -516,6 +516,14 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Dec 6 2017 Matus Honek - 2.4.45-5 +- Fix issues in MozNSS compatibility layer (#1400570) + + Force write file with fsync to avoid race conditions + + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix + + Allow missing cert and key which is a valid usecase + + Create extraction folder only in /tmp to simplify selinux rules + + Fix Covscan issues + * Fri Nov 3 2017 Matus Honek - 2.4.45-4 - Build with OpenSSL with MozNSS compatibility layer (#1400570) From 1a23456530afd930f8d5b5a42c5a5fd8d6a36fd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 20 Jan 2018 23:07:22 +0100 Subject: [PATCH 006/118] Rebuilt for switch to libxcrypt --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index d4cddc5..fc87060 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -516,6 +516,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Sat Jan 20 2018 Björn Esser - 2.4.45-6 +- Rebuilt for switch to libxcrypt + * Wed Dec 6 2017 Matus Honek - 2.4.45-5 - Fix issues in MozNSS compatibility layer (#1400570) + Force write file with fsync to avoid race conditions From 68ef0e0238942a3b3b752ac7877be80a7abbde7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 10 Jan 2018 23:36:58 +0100 Subject: [PATCH 007/118] MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key + Fix a possible invalid dereference (covscan) (cherry picked from commit 7abf6fbae6df9bc7cfdd9d28cc52f7676a123d9b) (originally #1525485) Related: #1400570 --- openldap-tlsmc.patch | 100 ++++++++++++++++++++++++++++--------------- openldap.spec | 7 ++- 2 files changed, 72 insertions(+), 35 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index d781817..c6957d8 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Mon Nov 27 16:03:42 CET 2017 +Date: Wed Jan 10 23:30:56 CET 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -236,10 +236,11 @@ diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c if ( is_server && !lts.lt_certfile && !lts.lt_keyfile && !lts.lt_cacertfile && !lts.lt_cacertdir ) { /* minimum configuration not provided */ -@@ -573,6 +598,21 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) +@@ -572,6 +597,21 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) + return ldap_pvt_tls_set_option( ld, option, &i ); } return -1; - #endif ++#endif +#ifdef HAVE_MOZNSS_COMPATIBILITY + case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: + i = -1; @@ -254,10 +255,9 @@ diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c + i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED; + } + return ldap_pvt_tls_set_option( ld, option, &i ); -+#endif + #endif } return -1; - } @@ -675,6 +715,9 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) case LDAP_OPT_X_TLS_CONNECT_ARG: *(void **)arg = lo->ldo_tls_connect_arg; @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1179 @@ +@@ -0,0 +1,1211 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -742,6 +742,7 @@ new file mode 100644 +{ + int rv = 0; + char *data = NULL; ++ char *checksum = NULL; + + /* gather data */ + data = PR_sprintf_append( data, @@ -777,7 +778,6 @@ new file mode 100644 + } + + /* compute data checksum */ -+ char *checksum = NULL; + if ( 1 != tlsmc_hash( &checksum, (const char*) data ) ) { + checksum = NULL; + goto bail; @@ -1060,6 +1060,11 @@ new file mode 100644 + CERTCertificate *cert = NULL; + char *cert_file_path = NULL; + char *key_file_path = NULL; ++ char *file_realpath = NULL; ++ ++ ++ cert_file_path = PR_smprintf( "%s/cert.pem", dir_name ); ++ key_file_path = PR_smprintf( "%s/key.pem", dir_name ); + + if ( NULL == nickname ) { + Debug( LDAP_DEBUG_ANY, @@ -1075,40 +1080,65 @@ new file mode 100644 + 0, 0, 0 ); + goto bail; + } -+ if ( NULL == ( cert = PK11_FindCertFromNickname(nickname, NULL) ) ) { ++ if ( NULL != ( cert = PK11_FindCertFromNickname(nickname, NULL) ) ) { ++ /* extract cert/key from NSS db */ ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cert_key_pair: INFO: extracting certificate `%s' to file `%s'.\n", ++ nickname, cert_file_path, 0 ); ++ if ( 0 == tlsmc_extract_cert_to_file(certHandle, cert, cert_file_path) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not extract certificate.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cert_key_pair: INFO: extracting associated PK to file `%s'.\n", ++ key_file_path, 0, 0 ); ++ if ( 0 == tlsmc_extract_key_of_cert_to_file( cert, pin_filename, key_file_path ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not extract PK.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ } else { ++ /* symlink PEM cert/key PEM files */ ++ + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not find certificate with nickname `%s'.\n", ++ "tlsmc_extract_cert_key_pair: INFO: could not find certificate with nickname `%s', expecting a PEM file.\n", + nickname, 0, 0 ); -+ goto bail; -+ } + -+ /* cert */ -+ cert_file_path = PR_smprintf( "%s/cert.pem", dir_name ); -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: extracting certificate `%s' to file `%s'.\n", -+ nickname, cert_file_path, 0 ); -+ if ( 0 == tlsmc_extract_cert_to_file(certHandle, cert, cert_file_path) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not extract certificate.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cert_key_pair: INFO: symlinking certificate file `%s' to file `%s'.\n", ++ nickname, cert_file_path, 0 ); ++ if ( NULL == ( file_realpath = realpath( nickname, NULL ) ) ) { ++ perror( "Could not get the realpath" ); ++ goto bail; ++ } ++ if ( -1 == symlink( file_realpath, cert_file_path ) ) { ++ perror( "Could not create a symlink" ); ++ goto bail; ++ } ++ if ( file_realpath ) free( file_realpath ); + -+ /* key */ -+ key_file_path = PR_smprintf( "%s/key.pem", dir_name ); -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: extracting associated PK to file `%s'.\n", -+ key_file_path, 0, 0 ); -+ if ( 0 == tlsmc_extract_key_of_cert_to_file( cert, pin_filename, key_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not extract PK.\n", -+ 0, 0, 0 ); -+ goto bail; ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_extract_cert_key_pair: INFO: symlinking PK file `%s' to file `%s'.\n", ++ pin_filename, key_file_path, 0 ); ++ if ( NULL == ( file_realpath = realpath( pin_filename, NULL ) ) ) { ++ perror( "Could not get the realpath" ); ++ goto bail; ++ } ++ if ( -1 == symlink( file_realpath, key_file_path ) ) { ++ perror( "Could not create a symlink" ); ++ goto bail; ++ } + } + + rv = 1; + +bail: ++ if (file_realpath) free(file_realpath); + if (key_file_path) PR_smprintf_free(key_file_path); + if (cert_file_path) PR_smprintf_free(cert_file_path); + if (cert) CERT_DestroyCertificate(cert); @@ -1366,7 +1396,8 @@ new file mode 100644 + if (*ld_cert) free(*ld_cert); + *ld_cert = PR_smprintf( "%s/" TLSMC_CERT_FILE_NAME, pem_dir ); + if ( ! ( ( 0 == stat( *ld_cert, &stat_buf ) ) -+ && S_ISREG(stat_buf.st_mode) ) ) { ++ && ( S_ISREG(stat_buf.st_mode) ++ || S_ISLNK(stat_buf.st_mode) ) ) ) { + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: WARN: extracted cert file is not present.\n", + 0, 0, 0 ); @@ -1376,7 +1407,8 @@ new file mode 100644 + if (*ld_key) free(*ld_key); + *ld_key = PR_smprintf( "%s/" TLSMC_KEY_FILE_NAME, pem_dir ); + if ( ! ( ( 0 == stat( *ld_key, &stat_buf ) ) -+ && S_ISREG(stat_buf.st_mode) ) ) { ++ && ( S_ISREG(stat_buf.st_mode) ++ || S_ISLNK(stat_buf.st_mode) ) ) ) { + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: WARN: extracted key file is not present.\n", + 0, 0, 0 ); diff --git a/openldap.spec b/openldap.spec index fc87060..86a6c9a 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 6%{?dist} +Release: 7%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -516,6 +516,11 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Feb 7 2018 Matus Honek - 2.4.45-7 +- MozNSS Compat. Layer fixes (#1400570) + - Enable usage of NSS DB with PEM cert/key (orig. #1525485) + + Fix a possible invalid dereference (covscan) + * Sat Jan 20 2018 Björn Esser - 2.4.45-6 - Rebuilt for switch to libxcrypt From 716f3439ac316da68943eb3b2192f84932cd35e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Thu, 11 Jan 2018 01:11:09 +0100 Subject: [PATCH 008/118] MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage + Warn just before use of a PIN about key file extraction (cherry picked from commit 856ec5d38c45ffe71774a4d86a36177d3c4ca372) (originally #1516409) Related: #1400570 --- openldap-tlsmc.patch | 119 +++++++++++++++++++++++++++++++++++++++---- openldap.spec | 2 + 2 files changed, 110 insertions(+), 11 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index c6957d8..8261e6b 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Wed Jan 10 23:30:56 CET 2018 +Date: Thu Jan 11 01:00:55 CET 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1211 @@ +@@ -0,0 +1,1308 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -392,6 +392,88 @@ new file mode 100644 +} + + ++int ++tlsmc_remove_dir_recursively( char *dir_name ) ++{ ++ int rv = 0; ++ PRDir *dir = NULL; ++ PRDirEntry *entry = NULL; ++ char *full_path = NULL; ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: starting recursively removing directory `%s'.\n", ++ dir_name, 0, 0 ); ++ if ( NULL == ( dir = PR_OpenDir( dir_name ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_remove_dir_recursively: WARN: could not open directory `%s'.\n", ++ dir_name, 0, 0 ); ++ rv = 0; ++ goto bail; ++ } ++ ++ while ( NULL != ( entry = PR_ReadDir( dir, PR_SKIP_BOTH ) ) ) { ++ PRFileInfo info; ++ PRStatus prv; ++ ++ full_path = NULL; ++ full_path = PR_smprintf( "%s/%s", dir_name, entry->name ); ++ ++ if ( ( PR_SUCCESS == ( prv = PR_GetFileInfo( full_path, &info ) ) ) ) { ++ if ( PR_FILE_DIRECTORY == info.type ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: stepping in directory `%s'.\n", ++ full_path, 0, 0 ); ++ if ( 0 == tlsmc_remove_dir_recursively( full_path ) ) { ++ rv = 0; ++ goto bail; ++ } ++ } else { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: removing file `%s'.\n", ++ full_path, 0, 0 ); ++ if ( PR_FAILURE == PR_Delete( full_path ) ) { ++ rv = 0; ++ goto bail; ++ } ++ } ++ } ++ ++ if ( full_path ) { ++ PR_smprintf_free( full_path ); ++ full_path = NULL; ++ } ++ ++ } ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: stepping out of directory `%s'.\n", ++ dir_name, 0, 0 ); ++ if ( PR_FAILURE == PR_CloseDir( dir ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_remove_dir_recursively: WARN: could not close directory `%s'.\n", ++ dir_name, 0, 0 ); ++ rv = 0; ++ goto bail; ++ } ++ ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: removing the directory `%s'.\n", ++ dir_name, 0, 0 ); ++ if ( PR_FAILURE == PR_RmDir( dir_name ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_remove_dir_recursively: WARN: could not remove the directory `%s'.\n", ++ dir_name, 0, 0 ); ++ rv = 0; ++ goto bail; ++ } ++ ++ rv = 1; ++ ++bail: ++ if ( full_path ) PR_smprintf_free( full_path ); ++ return rv; ++} ++ ++ +/* BORROWED FROM tls_m.c */ +static void +tlsmc_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) @@ -552,6 +634,10 @@ new file mode 100644 + char *token_name = NULL; + char *pwdstr = NULL; + ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n", ++ 0, 0, 0 ); ++ + token_name = PK11_GetTokenName( slot ); + /* Try to get the passwords from the password file if it exists. + * THIS IS UNSAFE and is provided for convenience only. Without this @@ -1258,7 +1344,6 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_extract_nssdb: ERROR: could not export user cert and/or key.\n", + 0, 0, 0 ); -+ rv = -1; + goto bail; + } + @@ -1339,6 +1424,12 @@ new file mode 100644 + 0, 0, 0 ); + goto bail; + } ++ if ( NULL == ( readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, pem_dir ) ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: could not allocate memory.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } + Debug( LDAP_DEBUG_TRACE, + "tlsmc_convert: INFO: trying with PEM dir = `%s'.\n", + pem_dir, 0, 0 ); @@ -1347,7 +1438,19 @@ new file mode 100644 + Debug( LDAP_DEBUG_TRACE, + "tlsmc_convert: INFO: using the existing PEM dir.\n", + 0, 0, 0 ); -+ goto pem_dir_exists; ++ if ( 0 == stat( readme_path, &stat_buf ) ) { ++ goto pem_dir_exists; ++ } else { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: ERROR: the PEM dir found does not contain README file. Will remove the PEM dir and try to recreate it.\n", ++ 0, 0, 0 ); ++ if ( 0 == tlsmc_remove_dir_recursively( pem_dir ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_convert: FATAL: could not remove the PEM dir. Cannot properly set TLS.\n", ++ 0, 0, 0 ); ++ goto bail; ++ } ++ } + } else { + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: FATAL: tried to stat the PEM dir but it is not a directory.\n", @@ -1356,7 +1459,7 @@ new file mode 100644 + } + } + Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: WARN: could not find the PEM dir, will try to create it.\n", ++ "tlsmc_convert: WARN: will try to create PEM dir.\n", + 0, 0, 0 ); + if ( 0 == tlsmc_prepare_dir( pem_dir ) ) { + Debug( LDAP_DEBUG_ANY, @@ -1370,12 +1473,6 @@ new file mode 100644 + 0, 0, 0 ); + goto bail; + } -+ if ( NULL == ( readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, pem_dir ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not allocate memory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } + if ( 0 == tlsmc_write_file( readme_path, data, S_IRUSR ) ) { + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: ERROR: could not create README file.\n", diff --git a/openldap.spec b/openldap.spec index 86a6c9a..8fdf626 100644 --- a/openldap.spec +++ b/openldap.spec @@ -518,6 +518,8 @@ exit 0 %changelog * Wed Feb 7 2018 Matus Honek - 2.4.45-7 - MozNSS Compat. Layer fixes (#1400570) + - Ensure consistency of a PEM dir before usage (orig. #1516409) + + Warn just before use of a PIN about key file extraction - Enable usage of NSS DB with PEM cert/key (orig. #1525485) + Fix a possible invalid dereference (covscan) From e6c4c7215326aff37db5f12cf7724bde123a6189 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 31 Jan 2018 21:27:38 +0100 Subject: [PATCH 009/118] MozNSS Compat. Layer: fix recursive directory deletion - ad #1516409#c7 case 2 (cherry picked from commit c66191c12b1bf372204cf3bf0b31759e7b0bd133) (originally #1516409) Related: #1400570 --- openldap-tlsmc.patch | 92 ++++++++++++++++++++++++-------------------- openldap.spec | 1 + 2 files changed, 51 insertions(+), 42 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index 8261e6b..b05847a 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Thu Jan 11 01:00:55 CET 2018 +Date: Tue Jan 30 17:46:02 CET 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1308 @@ +@@ -0,0 +1,1316 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -294,6 +294,7 @@ new file mode 100644 +#include +#include +#include ++#include + +#include +#include @@ -392,49 +393,55 @@ new file mode 100644 +} + + -+int -+tlsmc_remove_dir_recursively( char *dir_name ) ++static int ++tlsmc_remove_dir_recursively( const char *dir_name ) +{ + int rv = 0; -+ PRDir *dir = NULL; -+ PRDirEntry *entry = NULL; ++ DIR *dir = NULL; ++ struct dirent *entry = NULL; + char *full_path = NULL; + + Debug( LDAP_DEBUG_TRACE, + "tlsmc_remove_dir_recursively: INFO: starting recursively removing directory `%s'.\n", + dir_name, 0, 0 ); -+ if ( NULL == ( dir = PR_OpenDir( dir_name ) ) ) { ++ if ( NULL == ( dir = opendir( dir_name ) ) ) { + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: WARN: could not open directory `%s'.\n", -+ dir_name, 0, 0 ); -+ rv = 0; ++ "tlsmc_remove_dir_recursively: ERROR: could not open the directory (errno %d: %s).\n", ++ errno, strerror( errno ), 0 ); + goto bail; + } + -+ while ( NULL != ( entry = PR_ReadDir( dir, PR_SKIP_BOTH ) ) ) { -+ PRFileInfo info; -+ PRStatus prv; ++ while ( NULL != ( entry = readdir( dir ) ) ) { ++ struct stat info; + + full_path = NULL; -+ full_path = PR_smprintf( "%s/%s", dir_name, entry->name ); ++ full_path = PR_smprintf( "%s/%s", dir_name, entry->d_name ); + -+ if ( ( PR_SUCCESS == ( prv = PR_GetFileInfo( full_path, &info ) ) ) ) { -+ if ( PR_FILE_DIRECTORY == info.type ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: stepping in directory `%s'.\n", -+ full_path, 0, 0 ); -+ if ( 0 == tlsmc_remove_dir_recursively( full_path ) ) { -+ rv = 0; -+ goto bail; ++ if ( 0 != strcmp( entry->d_name, "." ) && 0 != strcmp( entry->d_name, ".." ) ) { ++ if ( 0 == lstat( full_path, &info ) ) { ++ if ( S_ISDIR( info.st_mode ) ) { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: stepping into directory `%s'.\n", ++ entry->d_name, 0, 0 ); ++ if ( 0 == tlsmc_remove_dir_recursively( full_path ) ) { ++ goto bail_and_close_dir; ++ } ++ } else { ++ Debug( LDAP_DEBUG_TRACE, ++ "tlsmc_remove_dir_recursively: INFO: removing file `%s'.\n", ++ entry->d_name, 0, 0 ); ++ if ( 0 != remove( full_path ) ) { ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_remove_dir_recursively: ERROR: could not remove the file (errno %d: %s).\n", ++ errno, strerror( errno ), 0 ); ++ goto bail_and_close_dir; ++ } + } + } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: removing file `%s'.\n", -+ full_path, 0, 0 ); -+ if ( PR_FAILURE == PR_Delete( full_path ) ) { -+ rv = 0; -+ goto bail; -+ } ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_remove_dir_recursively: ERROR: could not stat `%s', (errno %d: %s).\n", ++ full_path, errno, strerror( errno ) ); ++ goto bail_and_close_dir; + } + } + @@ -445,29 +452,30 @@ new file mode 100644 + + } + Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: stepping out of directory `%s'.\n", -+ dir_name, 0, 0 ); -+ if ( PR_FAILURE == PR_CloseDir( dir ) ) { ++ "tlsmc_remove_dir_recursively: INFO: stepping out of the directory.\n", ++ 0, 0, 0 ); ++ if ( 0 != closedir( dir ) ) { + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: WARN: could not close directory `%s'.\n", -+ dir_name, 0, 0 ); -+ rv = 0; ++ "tlsmc_remove_dir_recursively: WARN: could not close the directory (errno %d: %s).\n", ++ errno, strerror( errno ), 0 ); + goto bail; + } + + Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: removing the directory `%s'.\n", -+ dir_name, 0, 0 ); -+ if ( PR_FAILURE == PR_RmDir( dir_name ) ) { ++ "tlsmc_remove_dir_recursively: INFO: removing the directory itself.\n", ++ 0, 0, 0 ); ++ if ( 0 != remove( dir_name ) ) { ++ PRErrorCode errcode = PR_GetError(); + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: WARN: could not remove the directory `%s'.\n", -+ dir_name, 0, 0 ); -+ rv = 0; ++ "tlsmc_remove_dir_recursively: ERROR: could not remove the directory (errno %d: %s).\n", ++ errno, strerror( errno ), 0 ); + goto bail; + } + + rv = 1; -+ ++ goto bail; ++bail_and_close_dir: ++ closedir( dir ); +bail: + if ( full_path ) PR_smprintf_free( full_path ); + return rv; diff --git a/openldap.spec b/openldap.spec index 8fdf626..1de9d70 100644 --- a/openldap.spec +++ b/openldap.spec @@ -518,6 +518,7 @@ exit 0 %changelog * Wed Feb 7 2018 Matus Honek - 2.4.45-7 - MozNSS Compat. Layer fixes (#1400570) + - fix recursive directory deletion (orig. #1516409) - Ensure consistency of a PEM dir before usage (orig. #1516409) + Warn just before use of a PIN about key file extraction - Enable usage of NSS DB with PEM cert/key (orig. #1525485) From 8c29eeec6a07699a7d611b7b5b0a17c1758f2d05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 31 Jan 2018 21:47:33 +0100 Subject: [PATCH 010/118] MozNSS Compat. Layer: fix PIN disclaimer not always shown - ad #1516409#c7 case 1 (cherry picked from commit 6e2bfcadc598ed202cc77e34d5bfdea3d6ed8fbe) (orginally #1516409) Related: #1400570 --- openldap-tlsmc.patch | 10 +++++----- openldap.spec | 1 + 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index b05847a..dc5ce33 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Tue Jan 30 17:46:02 CET 2018 +Date: Wed Jan 31 21:44:47 CET 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -642,10 +642,6 @@ new file mode 100644 + char *token_name = NULL; + char *pwdstr = NULL; + -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n", -+ 0, 0, 0 ); -+ + token_name = PK11_GetTokenName( slot ); + /* Try to get the passwords from the password file if it exists. + * THIS IS UNSAFE and is provided for convenience only. Without this @@ -653,6 +649,8 @@ new file mode 100644 + * if using an encrypted key. + */ + if ( filename ) { ++ fprintf( stderr, ++ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n"); + pwdstr = tlsmc_get_pin_from_file( token_name, (char *)filename ); + if ( retry && pwdstr != NULL ) + return NULL; @@ -663,6 +661,8 @@ new file mode 100644 + unsigned char phrase[200]; + /* Prompt for password */ + if ( isTTY ) { ++ fprintf( stderr, ++ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n"); + fprintf( stdout, + "Please enter pin, password, or pass phrase for security token '%s': ", + token_name ? token_name : DEFAULT_TOKEN_NAME ); diff --git a/openldap.spec b/openldap.spec index 1de9d70..449b06f 100644 --- a/openldap.spec +++ b/openldap.spec @@ -518,6 +518,7 @@ exit 0 %changelog * Wed Feb 7 2018 Matus Honek - 2.4.45-7 - MozNSS Compat. Layer fixes (#1400570) + - fix PIN disclaimer not always shown (orig. #1516409) - fix recursive directory deletion (orig. #1516409) - Ensure consistency of a PEM dir before usage (orig. #1516409) + Warn just before use of a PIN about key file extraction From 72648118471c4848f11212d85d0f57da800321d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 31 Jan 2018 22:11:45 +0100 Subject: [PATCH 011/118] MozNSS Compat. Layer: fix incorrect parsing of CACertDir NSS DB type prefix was not taken into account at all. Due to this the path might not have been stat-ed. Thus, last part of the path would have been considered an NSS DB name prefix which would be incorrect. (cherry picked from commit 7f41b4a1ffe61c03d65896d82fc6b72a2710c492) (originally #1533955) Related: #1400570 --- openldap-tlsmc.patch | 61 ++++++++++++++++++++++++++++++++------------ openldap.spec | 1 + 2 files changed, 46 insertions(+), 16 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index dc5ce33..b498a41 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Wed Jan 31 21:44:47 CET 2018 +Date: Wed Jan 31 22:08:28 CET 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1316 @@ +@@ -0,0 +1,1345 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -484,33 +484,61 @@ new file mode 100644 + +/* BORROWED FROM tls_m.c */ +static void -+tlsmc_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) ++tlsmc_get_certdb_prefix( const char *certdir, char **nsscertdir, char **realcertdir, char **prefix ) +{ + char sep = PR_GetDirectorySeparator(); + char *ptr = NULL; ++ char *chkpath = NULL; + struct PRFileInfo prfi; + PRStatus prc; + + *realcertdir = (char *)certdir; /* default is the one passed in */ ++ ++ /* if certdir is not given, just return */ + if ( !certdir ) return; + -+ prc = PR_GetFileInfo( certdir, &prfi ); ++ *nsscertdir = certdir; ++ ++ /* ignore database type prefix (e.g. sql:, dbm:) if provided */ ++ if ( NULL != ( chkpath = strchr( certdir, ':' ) ) ) { ++ *realcertdir = chkpath + 1; ++ } ++ + /* if certdir exists (file or directory) then it cannot specify a prefix */ ++ prc = PR_GetFileInfo( *realcertdir, &prfi ); + if ( prc == PR_SUCCESS ) { -+ /* and drop potential last '/' */ -+ ptr = strrchr( *realcertdir, sep ); -+ if ( ptr && (! *(ptr+1) ) ) { -+ *ptr = '\0'; -+ } -+ return; ++ goto finish; + } + + /* if certdir was given, and there is a '/' in certdir, see if there + is anything after the last '/' - if so, assume it is the prefix */ -+ if ( ( ( ptr = strrchr( certdir, sep ) ) ) && *(ptr+1) ) { -+ *realcertdir = PL_strndup( certdir, ptr-certdir ); -+ *prefix = PL_strdup( ptr+1 ); ++ /* if ( ( ( ptr = strrchr( *realcertdir, sep ) ) ) && *(ptr + 1) ) { */ ++ /* *realcertdir = PL_strndup( *realcertdir, ptr - (*realcertdir) ); */ ++ /* *prefix = PL_strdup( ptr + 1 ); */ ++ /* } */ ++ ++ ++ if ( ptr = strrchr( *realcertdir, sep ) ) { ++ if ( *(ptr + 1) ) { ++ *ptr = '\0'; ++ *prefix = ptr + 1; ++ } else { ++ *prefix = *realcertdir + strlen( *realcertdir ); // empty string ++ } ++ } else { ++ *prefix = *realcertdir; ++ *realcertdir = *prefix + strlen( *prefix ); // empty string + } ++finish: ++ /* drop potential last '/' from realcertdir */ ++ do { ++ ptr = strrchr( *realcertdir, sep ); ++ if ( ptr && (! *(ptr+1) ) ) { ++ *ptr = '\0'; ++ } else { ++ break; ++ } ++ } while (1); + + return; +} @@ -748,17 +776,18 @@ new file mode 100644 + for ( ii = 0; !done && ( ii < SECURITYDIRS_COUNT ); ++ii ) { + // get certdb prefix + const char *securitydir = securitydirs[ii]; ++ char *nsscertdir = NULL; + char *realcertdir = NULL; + const char *defprefix = ""; + char *prefix = (char *)defprefix; + if ( securitydir == NULL ) continue; -+ tlsmc_get_certdb_prefix( securitydir, &realcertdir, &prefix ); //FIXME ++ tlsmc_get_certdb_prefix( securitydir, &nsscertdir, &realcertdir, &prefix ); + *out_nssdb_dir = strdup( realcertdir ); + *out_nssdb_prefix = strdup( prefix ); + + Debug( LDAP_DEBUG_TRACE, + "tlsmc_open_nssdb: INFO: trying to initialize moznss using security dir `%s` prefix `%s`.\n", -+ realcertdir, prefix, NULL); ++ nsscertdir, prefix, NULL); + + // init context + NSSInitContext *initctx = NULL; @@ -766,7 +795,7 @@ new file mode 100644 + memset( &initparams, 0, sizeof( initparams ) ); + initparams.length = sizeof( initparams ); + -+ initctx = NSS_InitContext( realcertdir, ++ initctx = NSS_InitContext( nsscertdir, + prefix, + prefix, + SECMOD_DB, diff --git a/openldap.spec b/openldap.spec index 449b06f..4dc831e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -518,6 +518,7 @@ exit 0 %changelog * Wed Feb 7 2018 Matus Honek - 2.4.45-7 - MozNSS Compat. Layer fixes (#1400570) + - fix incorrect parsing of CACertDir (orig. #1533955) - fix PIN disclaimer not always shown (orig. #1516409) - fix recursive directory deletion (orig. #1516409) - Ensure consistency of a PEM dir before usage (orig. #1516409) From eff4749dd8a6873703034e296003dc8b1f93d9dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 7 Feb 2018 18:20:41 +0100 Subject: [PATCH 012/118] Drop TCP wrappers support Resolves: #1531487 --- openldap.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/openldap.spec b/openldap.spec index 4dc831e..5925641 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 7%{?dist} +Release: 8%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -44,7 +44,7 @@ Patch91: check-password.patch # MozNSS compatibility layer Patch100: openldap-tlsmc.patch -BuildRequires: cyrus-sasl-devel, nss-devel, openssl-devel, krb5-devel, tcp_wrappers-devel, unixODBC-devel +BuildRequires: cyrus-sasl-devel, nss-devel, openssl-devel, krb5-devel, unixODBC-devel BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) Recommends: nss-tools @@ -179,7 +179,6 @@ pushd openldap-%{version} --enable-rlookups \ --enable-slapi \ --disable-slp \ - --enable-wrappers \ \ --enable-backends=mod \ --enable-bdb=yes \ @@ -516,6 +515,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Feb 7 2018 Matus Honek - 2.4.45-8 +- Drop TCP wrappers support (#1531487) + * Wed Feb 7 2018 Matus Honek - 2.4.45-7 - MozNSS Compat. Layer fixes (#1400570) - fix incorrect parsing of CACertDir (orig. #1533955) From e3677af8bb1662521f6054764d08be51f92810fd Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Fri, 9 Feb 2018 09:05:20 +0100 Subject: [PATCH 013/118] Escape macros in %changelog Reference: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/Y2ZUKK2B7T2IKXPMODNF6HB2O5T5TS6H/ Signed-off-by: Igor Gnatenko --- openldap.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/openldap.spec b/openldap.spec index 5925641..26dc918 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.45 -Release: 8%{?dist} +Release: 9%{?dist} Summary: LDAP support libraries Group: System Environment/Daemons License: OpenLDAP @@ -515,6 +515,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Fri Feb 09 2018 Igor Gnatenko - 2.4.45-9 +- Escape macros in %%changelog + * Wed Feb 7 2018 Matus Honek - 2.4.45-8 - Drop TCP wrappers support (#1531487) @@ -592,10 +595,10 @@ exit 0 - Update to 2.4.44 (#1305191) * Tue May 3 2016 Matus Honek - 2.4.43-5 -- Bring back *.la files in %{_libdir}/openldap/ (#1331484) +- Bring back *.la files in %%{_libdir}/openldap/ (#1331484) * Wed Apr 27 2016 Matus Honek - 2.4.43-4 -- Keep *.so libraries in %{_libdir}/openldap/ (#1331484) +- Keep *.so libraries in %%{_libdir}/openldap/ (#1331484) - Include AllOp overlay (#1319782) * Sun Apr 10 2016 Peter Robinson 2.4.43-3 From 60f1a0883e5a9be55d4dedd12fd7c19442259186 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 11:18:21 +0100 Subject: [PATCH 014/118] disable TLSMC in F29+ It should not affect any active Fedora branches, but will save time in future. Signed-off-by: Igor Gnatenko --- openldap.spec | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/openldap.spec b/openldap.spec index 26dc918..958def2 100644 --- a/openldap.spec +++ b/openldap.spec @@ -1,3 +1,10 @@ +# TLSMC is MozNSS compatibility layer and should be disabled in F29+ +%if 0%{?fedora} && 0%{?fedora} <= 28 +%bcond_without tlsmc +%else +%bcond_with tlsmc +%endif + %global _hardened_build 1 %global systemctl_bin /usr/bin/systemctl @@ -44,9 +51,13 @@ Patch91: check-password.patch # MozNSS compatibility layer Patch100: openldap-tlsmc.patch -BuildRequires: cyrus-sasl-devel, nss-devel, openssl-devel, krb5-devel, unixODBC-devel +%if %{with tlsmc} +BuildRequires: nss-devel +Recommends: nss-tools +%endif + +BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) -Recommends: nss-tools %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -192,7 +203,7 @@ pushd openldap-%{version} \ --disable-static \ \ - --enable-moznss-compatibility=yes \ + --enable-moznss-compatibility=%{?with_tlsmc:yes}%{!?with_tlsmc:no} \ \ --with-cyrus-sasl \ --without-fetch \ From 7472792967caa0c5b35cd2cbc1beb34ee4f082ac Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 18:42:09 +0100 Subject: [PATCH 015/118] remove obsolete Group tag Signed-off-by: Igor Gnatenko --- openldap.spec | 4 ---- 1 file changed, 4 deletions(-) diff --git a/openldap.spec b/openldap.spec index 958def2..abf3ee4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,6 @@ Name: openldap Version: 2.4.45 Release: 9%{?dist} Summary: LDAP support libraries -Group: System Environment/Daemons License: OpenLDAP URL: http://www.openldap.org/ @@ -70,7 +69,6 @@ libraries, and documentation for OpenLDAP. %package devel Summary: LDAP development libraries and header files -Group: Development/Libraries Requires: openldap%{?_isa} = %{version}-%{release}, cyrus-sasl-devel%{?_isa} %description devel @@ -92,7 +90,6 @@ Requires(postun): systemd BuildRequires: libdb-devel BuildRequires: systemd-units BuildRequires: cracklib-devel -Group: System Environment/Daemons # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -107,7 +104,6 @@ over the Internet. This package contains the slapd server and related files. %package clients Summary: LDAP client utilities Requires: openldap%{?_isa} = %{version}-%{release} -Group: Applications/Internet %description clients OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access From f08cb7ec48943d54c4758b3afeb03213487b437f Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 18:44:53 +0100 Subject: [PATCH 016/118] don't call ldconfig in servers subacpakge servers subpkg installs everything into private libdir, so no need to call ldconfig (since there is no ld.so.conf for it). Signed-off-by: Igor Gnatenko --- openldap.spec | 7 ------- 1 file changed, 7 deletions(-) diff --git a/openldap.spec b/openldap.spec index abf3ee4..9f518a4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -349,8 +349,6 @@ exit 0 %post servers - -/sbin/ldconfig %systemd_post slapd.service # generate configuration if necessary @@ -389,16 +387,11 @@ fi exit 0 %preun servers - %systemd_preun slapd.service - %postun servers - -/sbin/ldconfig %systemd_postun_with_restart slapd.service - %triggerin servers -- libdb # libdb upgrade (setup for %%triggerun) From 96650fcc567fef36e76ce7ecd5ac3e2843e63ff1 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 18:45:53 +0100 Subject: [PATCH 017/118] Switch to %ldconfig_scriptlets Reference: https://fedoraproject.org/wiki/Changes/Removing_ldconfig_scriptlets Signed-off-by: Igor Gnatenko --- openldap.spec | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/openldap.spec b/openldap.spec index 9f518a4..a439c19 100644 --- a/openldap.spec +++ b/openldap.spec @@ -323,9 +323,7 @@ rm -f %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ rm -f %{buildroot}%{_localstatedir}/openldap-data/DB_CONFIG.example rmdir %{buildroot}%{_localstatedir}/openldap-data -%post -p /sbin/ldconfig - -%postun -p /sbin/ldconfig +%ldconfig_scriptlets %pre servers @@ -430,7 +428,6 @@ exit 0 %files %doc openldap-%{version}/ANNOUNCEMENT %doc openldap-%{version}/CHANGES -%{!?_licensedir:%global license %%doc} %license openldap-%{version}/COPYRIGHT %license openldap-%{version}/LICENSE %doc openldap-%{version}/README From c358051be4b259820b89bb8da7c05f74006db570 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 18:51:00 +0100 Subject: [PATCH 018/118] remove unneeded Requires(post) Signed-off-by: Igor Gnatenko --- openldap.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index a439c19..25b067a 100644 --- a/openldap.spec +++ b/openldap.spec @@ -84,7 +84,7 @@ Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils Requires(pre): shadow-utils -Requires(post): systemd, systemd-sysv, chkconfig +Requires(post): systemd Requires(preun): systemd Requires(postun): systemd BuildRequires: libdb-devel From 4d3fac9347b590e5e8ab8fc09505cf1e01a27422 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 18:51:55 +0100 Subject: [PATCH 019/118] switch to %systemd_requires Signed-off-by: Igor Gnatenko --- openldap.spec | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/openldap.spec b/openldap.spec index 25b067a..760a649 100644 --- a/openldap.spec +++ b/openldap.spec @@ -84,9 +84,7 @@ Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils Requires(pre): shadow-utils -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd +%{?systemd_requires} BuildRequires: libdb-devel BuildRequires: systemd-units BuildRequires: cracklib-devel From ed8fb8d19b28f0d08ee8803d8851ec5008c4d182 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sat, 10 Feb 2018 18:52:08 +0100 Subject: [PATCH 020/118] =?UTF-8?q?systemd-units=20=E2=86=92=20systemd?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Igor Gnatenko --- openldap.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 760a649..1d53778 100644 --- a/openldap.spec +++ b/openldap.spec @@ -84,9 +84,9 @@ Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils Requires(pre): shadow-utils +BuildRequires: systemd %{?systemd_requires} BuildRequires: libdb-devel -BuildRequires: systemd-units BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm From 44d9f0fe1bc4ae39587cfc80805562fba75b151a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Sun, 11 Feb 2018 21:44:43 +0100 Subject: [PATCH 021/118] Complete change: Disable TLSMC in F29+ - completes commit 60f1a08 --- openldap.spec | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 1d53778..96cef5f 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.45 -Release: 9%{?dist} +Release: 10%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -117,11 +117,13 @@ programs needed for accessing and modifying OpenLDAP directories. pushd openldap-%{version} +%if %{with tlsmc} # alternative include paths for Mozilla NSS ln -s %{_includedir}/nss3 include/nss ln -s %{_includedir}/nspr4 include/nspr %patch100 -p1 +%endif AUTOMAKE=%{_bindir}/true autoreconf -fi @@ -510,8 +512,18 @@ exit 0 %{_mandir}/man3/* %changelog +* Sun Feb 11 2018 Matus Honek - 2.4.45-10 +- Complete change: Disable TLSMC in F29+ + * Fri Feb 09 2018 Igor Gnatenko - 2.4.45-9 - Escape macros in %%changelog +- Disable TLSMC in F29+ +- Remove obsolete Group tag +- Don't call ldconfig in servers subpackage +- Switch to %%ldconfig_scriptlets +- Remove unneeded Requires(post): systemd-sysv, chkconfig +- Switch to %%systemd_requires +- Change BuildRequires: systemd-units to systemd * Wed Feb 7 2018 Matus Honek - 2.4.45-8 - Drop TCP wrappers support (#1531487) From bdec46fdafce949b88f36cb2055e1ec3f2c721f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Sun, 11 Feb 2018 20:01:37 +0100 Subject: [PATCH 022/118] TLS: Use system trusted CA store by default Resolves: #1270678, #1537259 --- ldap.conf | 5 ++++- slapd.ldif | 11 ++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/ldap.conf b/ldap.conf index 84bddc1..3069535 100644 --- a/ldap.conf +++ b/ldap.conf @@ -12,7 +12,10 @@ #TIMELIMIT 15 #DEREF never -TLS_CACERTDIR /etc/openldap/certs +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by TLS_CACERTDIR one has to include them explicitly: +#TLS_CACERT /etc/pki/tls/cert.pem # Turning this off breaks GSSAPI used with krb5 when rdns = false SASL_NOCANON on diff --git a/slapd.ldif b/slapd.ldif index 4105131..b9ba4f9 100644 --- a/slapd.ldif +++ b/slapd.ldif @@ -9,9 +9,14 @@ cn: config # # TLS settings # -olcTLSCACertificatePath: /etc/openldap/certs -olcTLSCertificateFile: "OpenLDAP Server" -olcTLSCertificateKeyFile: /etc/openldap/certs/password +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by oclTLSCACertificatePath one has to include them explicitly: +#olcTLSCACertificateFile: /etc/pki/tls/cert.pem +# +# Private cert and key are not pregenerated. +#olcTLSCertificateFile: +#olcTLSCertificateKeyFile: # # Do not enable referrals until AFTER you have a working directory From cd6ded45883b00b7a24fd66c450724f423d7e5ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 21 Feb 2018 17:36:13 +0100 Subject: [PATCH 023/118] Bump release number Related: #1270678, #1537259 --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 96cef5f..e56ccad 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.45 -Release: 10%{?dist} +Release: 11%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -512,6 +512,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Feb 21 2018 Matus Honek - 2.4.45-11 +- TLS: Use system trusted CA store by default (#1270678, #1537259) + * Sun Feb 11 2018 Matus Honek - 2.4.45-10 - Complete change: Disable TLSMC in F29+ From 54acca337fa2e38b9e872ac07be1e9c2236ad910 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 28 Feb 2018 19:21:31 +0100 Subject: [PATCH 024/118] MozNSS Compat. Layer: CA certs extraction fail should be fatal Resolves: #1550110 --- openldap-tlsmc.patch | 5 +++-- openldap.spec | 5 ++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index b498a41..405e54f 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Wed Jan 31 22:08:28 CET 2018 +Date: Wed Feb 21 20:04:11 CET 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1345 @@ +@@ -0,0 +1,1346 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -1375,6 +1375,7 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_extract_nssdb: ERROR: could not export CA certificates.\n", + 0, 0, 0 ); ++ goto bail; + } + + if ( 0 == tlsmc_extract_cert_key_pair( *ld_cert, *ld_key, dir_name ) ) { diff --git a/openldap.spec b/openldap.spec index e56ccad..72dcf28 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.45 -Release: 11%{?dist} +Release: 12%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -512,6 +512,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Feb 28 2018 Matus Honek - 2.4.45-12 +- MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110) + * Wed Feb 21 2018 Matus Honek - 2.4.45-11 - TLS: Use system trusted CA store by default (#1270678, #1537259) From cd7bdcf821f7ae4c1d97189129cdbbfdfe9d5210 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Mon, 26 Feb 2018 13:20:36 +0100 Subject: [PATCH 025/118] fix: openldap does not use Fedora build flags - %configure introduces the correct flags, however we need* to set our custom CFLAGS before the actual run of ./configure, thus we request the flags explicitly using %set_build_flags - dropping %{optflags} which is just a legacy version of %{build_cflags} which is already included in $set_build_flags set * ./configure plays with the flags, hence customizing the CFLAGS after %configure does not have a desired effect Resolves: #1548676 --- openldap.spec | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/openldap.spec b/openldap.spec index 72dcf28..402f813 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.45 -Release: 12%{?dist} +Release: 13%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -161,15 +161,9 @@ popd %build -%ifarch s390 s390x - export CFLAGS="-fPIE" -%else - export CFLAGS="-fpie" -%endif -export LDFLAGS="-pie" -# avoid stray dependencies (linker flag --as-needed) +%set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} %{optflags} -Wl,--as-needed,-z,relro,-z,now -DLDAP_CONNECTIONLESS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS" pushd openldap-%{version} %configure \ @@ -512,6 +506,10 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu Mar 1 2018 Matus Honek - 2.4.45-13 +- fix: openldap does not use Fedora build flags + + makes use of redhat-rpm-config package + * Wed Feb 28 2018 Matus Honek - 2.4.45-12 - MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110) From 6f8a4c6436709dd6c43c64e8006bc26946cab63f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 28 Feb 2018 14:26:58 +0100 Subject: [PATCH 026/118] Drop superfluous back-sql linking patch This patch is not needed any more as we do not build with back-sql at all. Related: #1548676 --- openldap-sql-linking.patch | 14 -------------- openldap.spec | 3 +-- 2 files changed, 1 insertion(+), 16 deletions(-) delete mode 100644 openldap-sql-linking.patch diff --git a/openldap-sql-linking.patch b/openldap-sql-linking.patch deleted file mode 100644 index c7edf8c..0000000 --- a/openldap-sql-linking.patch +++ /dev/null @@ -1,14 +0,0 @@ -Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package -independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.) - ---- openldap-2.4.24.orig/build/top.mk -+++ openldap-2.4.24/build/top.mk -@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@ - SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@ - SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@ - --SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS) -+SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS) - - # Our Defaults - CC = $(AC_CC) diff --git a/openldap.spec b/openldap.spec index 402f813..d1bdade 100644 --- a/openldap.spec +++ b/openldap.spec @@ -29,7 +29,6 @@ Source53: libexec-upgrade-db.sh # patches for 2.4 Patch0: openldap-manpages.patch -Patch1: openldap-sql-linking.patch Patch2: openldap-reentrant-gethostby.patch Patch3: openldap-smbk5pwd-overlay.patch Patch5: openldap-ai-addrconfig.patch @@ -128,7 +127,6 @@ ln -s %{_includedir}/nspr4 include/nspr AUTOMAKE=%{_bindir}/true autoreconf -fi %patch0 -p1 -%patch1 -p1 %patch2 -p1 %patch3 -p1 %patch5 -p1 @@ -509,6 +507,7 @@ exit 0 * Thu Mar 1 2018 Matus Honek - 2.4.45-13 - fix: openldap does not use Fedora build flags + makes use of redhat-rpm-config package +- Drop superfluous back-sql linking patch * Wed Feb 28 2018 Matus Honek - 2.4.45-12 - MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110) From 81afb5768a29e7c033514860da6e25d3d9242d24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Mon, 5 Mar 2018 09:48:07 +0100 Subject: [PATCH 027/118] Utilize system-wide crypto-policies Resolves: #1483979 --- ldap.conf | 6 ++++++ openldap.spec | 5 ++++- slapd.ldif | 7 +++++++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/ldap.conf b/ldap.conf index 3069535..02c595f 100644 --- a/ldap.conf +++ b/ldap.conf @@ -17,6 +17,12 @@ # by TLS_CACERTDIR one has to include them explicitly: #TLS_CACERT /etc/pki/tls/cert.pem +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#TLS_CIPHER_SUITE PROFILE=SYSTEM + # Turning this off breaks GSSAPI used with krb5 when rdns = false SASL_NOCANON on diff --git a/openldap.spec b/openldap.spec index d1bdade..645f6a6 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.45 -Release: 13%{?dist} +Release: 14%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Mon Mar 5 2018 Matus Honek - 2.4.45-14 +- Utilize system-wide crypto-policies (#1483979) + * Thu Mar 1 2018 Matus Honek - 2.4.45-13 - fix: openldap does not use Fedora build flags + makes use of redhat-rpm-config package diff --git a/slapd.ldif b/slapd.ldif index b9ba4f9..a4ae4c0 100644 --- a/slapd.ldif +++ b/slapd.ldif @@ -17,6 +17,13 @@ cn: config # Private cert and key are not pregenerated. #olcTLSCertificateFile: #olcTLSCertificateKeyFile: +# +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#olcTLSCipherSuite: PROFILE=SYSTEM + # # Do not enable referrals until AFTER you have a working directory From 7150aca3535a4239e1d79ee506bd82c49f89e3aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Tue, 27 Mar 2018 18:46:56 +0200 Subject: [PATCH 028/118] Rebase to version OpenLDAP 2.4.46 Resolves: #1559652 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 26b2e8e..a31ea14 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,4 @@ /openldap-2.4.43.tgz /openldap-2.4.44.tgz /openldap-2.4.45.tgz +/openldap-2.4.46.tgz diff --git a/openldap.spec b/openldap.spec index 645f6a6..8c60e4d 100644 --- a/openldap.spec +++ b/openldap.spec @@ -11,8 +11,8 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.45 -Release: 14%{?dist} +Version: 2.4.46 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Tue Mar 27 2018 Matus Honek - 2.4.46-1 +- Rebase to version OpenLDAP 2.4.46 (#1559652) + * Mon Mar 5 2018 Matus Honek - 2.4.45-14 - Utilize system-wide crypto-policies (#1483979) diff --git a/sources b/sources index 0faa962..c9ef3a9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.45.tgz) = 1c9fc84efed8998f107ce6e1c6be3f5466388241afdca0cb3847720c9def0bc263a2dbc15bf0f9112d1b4c391fd01e8531a4fb08c5532c30fb86924c08daedab +SHA512 (openldap-2.4.46.tgz) = eef39d43f04aa09c657a1422cefef060fe00368559ae40d0d97536c08ebeaaa1ab06207b3f121ba6afcde54abdc550027c3505e5217e5fd47ae6f8c001260186 From 44ef9ba55878551171a3f2c178e808b8d91a96d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Thu, 5 Apr 2018 15:52:27 +0200 Subject: [PATCH 029/118] MozNSS Compat. Layer: Fix typos, and spelling in the README file header Resolves: #1564161 --- openldap-tlsmc.patch | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index 405e54f..ded043d 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Wed Feb 21 20:04:11 CET 2018 +Date: Thu Apr 5 15:47:44 CEST 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -330,16 +330,16 @@ new file mode 100644 +#define TLSMC_IS_TEMPORARY 2 + +#define DONOTEDIT \ -+ "This file is auto-generated by MOZNSS Compatibility Layer of OpenLDAP software.\n" \ -+ "This layer is not a part of upstream distributed OpenLDAP software.\n" \ -+ "Please, file any related bugs with your GNU/Linux distribution.\n" \ -+ "Do not edit directly. Rather, change your configuration to use OpenSSL-style TLS options, so that this does not need to be generated anymore.\n" \ -+ "Please, refer to man (5) of slapd.conf, slapd-config, and ldap.conf for more information." ++ "This file is auto-generated by the MozNSS Compatibility Layer of OpenLDAP software.\n" \ ++ "This layer is not part of the OpenLDAP software distributed in upstream.\n" \ ++ "Please file any related bugs with your GNU/Linux distribution.\n" \ ++ "Do not edit contents of this directory structure directly. Rather, change your configuration to use the OpenSSL-style TLS options, so that this directory structure does not need to be generated anymore.\n" \ ++ "Please refer to the slapd.conf(5), slapd-config(5), and ldap.conf(5) man pages for more information." +#define PEM_CERT_HEADER "-----BEGIN CERTIFICATE-----" +#define PEM_CERT_FOOTER "-----END CERTIFICATE-----" +#define PEM_KEY_HEADER "-----BEGIN PRIVATE KEY-----" +#define PEM_KEY_FOOTER "-----END PRIVATE KEY-----" -+#define README_HEADER "Contents of this file are hashed and used as a part of a name of the parent directory.\n" ++#define README_HEADER "The contents of this file are hashed and used as part of the name of the parent directory.\n" + +#ifdef LDAP_R_COMPILE +ldap_pvt_thread_mutex_t tlsmc_mutex; @@ -930,9 +930,9 @@ new file mode 100644 + + if ( 0 != mkdir( dir, S_IRWXU /* u+rwx */ ) ) { + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_prepare_dir: WARN: cound not create the PEM directory.\n", ++ "tlsmc_prepare_dir: WARN: could not create the PEM directory.\n", + 0, 0, 0 ); -+ perror( "tlsmc_prepare_dir: WARN: cound not create the PEM directory" ); ++ perror( "tlsmc_prepare_dir: WARN: could not create the PEM directory" ); + rv = 0; + goto bail; + } @@ -943,9 +943,9 @@ new file mode 100644 + cacerts_dir = PR_smprintf( "%s/%s", dir, TLSMC_CACERTS_DIR_NAME ); + if ( 0 != mkdir( cacerts_dir, S_IRWXU /* u+rwx */ ) ) { + Debug( LDAP_DEBUG_ANY, -+ "tlsmc_prepare_dir: WARN: cound not create the subdirectory.\n", ++ "tlsmc_prepare_dir: WARN: could not create the subdirectory.\n", + 0, 0, 0 ); -+ perror( "tlsmc_prepare_dir: WARN: cound not create the subdirectory" ); ++ perror( "tlsmc_prepare_dir: WARN: could not create the subdirectory" ); + rv = 0; + goto bail; + } From b7ad18970bb7e3c23765241e307b6d9abd4b1182 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Wed, 27 Jun 2018 21:43:08 +0200 Subject: [PATCH 030/118] Perl 5.28 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 8c60e4d..77f4d14 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.46 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Jun 27 2018 Jitka Plesnikova - 2.4.46-2 +- Perl 5.28 rebuild + * Tue Mar 27 2018 Matus Honek - 2.4.46-1 - Rebase to version OpenLDAP 2.4.46 (#1559652) From ff45e6ac8ef721afcb3a4d6838aa337a9891abb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Fri, 29 Jun 2018 17:35:41 +0200 Subject: [PATCH 031/118] MozNSS Compat. Layer: Fix memleaks reported by valgrind Resolves: #1595203 --- openldap-tlsmc.patch | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index ded043d..234b2ae 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Thu Apr 5 15:47:44 CEST 2018 +Date: Thu Jun 28 14:36:55 CEST 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1346 @@ +@@ -0,0 +1,1351 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -1525,6 +1525,7 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: WARN: extracted cacerts dir is not present.\n", + 0, 0, 0 ); ++ if ( *ld_cacertdir ) PR_smprintf_free( *ld_cacertdir ); + *ld_cacertdir = NULL; + } + @@ -1536,6 +1537,7 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: WARN: extracted cert file is not present.\n", + 0, 0, 0 ); ++ if ( *ld_cert ) PR_smprintf_free( *ld_cert ); + *ld_cert = NULL; + } + @@ -1547,13 +1549,16 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_convert: WARN: extracted key file is not present.\n", + 0, 0, 0 ); ++ if ( *ld_key ) PR_smprintf_free( *ld_key ); + *ld_key = NULL; + } + + rv = 1; + +bail: ++ if ( checksum ) free( checksum ); + if ( pem_dir ) PR_smprintf_free( pem_dir ); ++ if ( readme_path ) PR_smprintf_free( readme_path ); + if ( data ) free( data ); + if ( nssdb_prefix ) free( nssdb_prefix ); + if ( nssdb_dir_path ) free( nssdb_dir_path ); From a9731a320bf360b1ce11455d9e2f0888f2749131 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 4 Jul 2018 10:39:58 +0200 Subject: [PATCH 032/118] MozNSS Compat. Layer: Make log messages more clear Resolves: #1598103 --- openldap-tlsmc.patch | 46 ++++++++++++++++++++++++++++++-------------- openldap.spec | 7 ++++++- 2 files changed, 38 insertions(+), 15 deletions(-) diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch index 234b2ae..0987413 100644 --- a/openldap-tlsmc.patch +++ b/openldap-tlsmc.patch @@ -1,7 +1,7 @@ MozNSS Interception Code Author: Matus Honek -Date: Thu Jun 28 14:36:55 CEST 2018 +Date: Wed Jul 4 10:35:04 CEST 2018 diff --git a/configure.in b/configure.in --- a/configure.in +++ b/configure.in @@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c new file mode 100644 --- /dev/null +++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1351 @@ +@@ -0,0 +1,1369 @@ +#include "portable.h" + +#ifdef HAVE_MOZNSS_COMPATIBILITY @@ -365,23 +365,33 @@ new file mode 100644 + int rv = 0; + int fd = -1; + if ( 0 > ( fd = open( filename, O_WRONLY | O_CREAT | O_EXCL, S_IWUSR ) ) ) { -+ perror("IO ERROR: could not open file"); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_write_file: ERROR: could not open file: `%s': %s.\n", ++ filename, strerror(errno), 0 ); + goto bail; + } + if ( -1 >= write( fd, buf, strlen(buf) ) ) { -+ perror("IO ERROR: could not write file"); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_write_file: ERROR: could not write file: `%s': %s.\n", ++ filename, strerror(errno), 0 ); + goto bail; + } + if ( -1 >= fchmod( fd, final_mode ) ) { -+ perror("IO ERROR: could not set file mode"); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_write_file: ERROR: could not set file mode: `%s': %s.\n", ++ filename, strerror(errno), 0 ); + goto bail; + } + if ( -1 >= fsync( fd ) ) { -+ perror("IO ERROR: could not fsync the file"); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_write_file: ERROR: could not fsync file: `%s': %s.\n", ++ filename, strerror(errno), 0 ); + goto bail; + } + if ( 0 > close( fd ) ) { -+ perror("IO ERROR: could not close file"); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_write_file: ERROR: could not close file: `%s': %s.\n", ++ filename, strerror(errno), 0 ); + fd = -1; + goto bail; + } @@ -845,7 +855,9 @@ new file mode 100644 + goto bail; + } + if ( 0 == strftime(stime, sizeof(stime), "%FT%T", localtime(&attr.st_mtime)) ) { -+ perror("IO ERROR: could not format mtime"); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_filestamp: ERROR: could not format mtime: %s.\n", ++ strerror(errno), 0, 0 ); + goto bail; + } + @@ -932,7 +944,6 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_prepare_dir: WARN: could not create the PEM directory.\n", + 0, 0, 0 ); -+ perror( "tlsmc_prepare_dir: WARN: could not create the PEM directory" ); + rv = 0; + goto bail; + } @@ -945,7 +956,6 @@ new file mode 100644 + Debug( LDAP_DEBUG_ANY, + "tlsmc_prepare_dir: WARN: could not create the subdirectory.\n", + 0, 0, 0 ); -+ perror( "tlsmc_prepare_dir: WARN: could not create the subdirectory" ); + rv = 0; + goto bail; + } @@ -1236,11 +1246,15 @@ new file mode 100644 + "tlsmc_extract_cert_key_pair: INFO: symlinking certificate file `%s' to file `%s'.\n", + nickname, cert_file_path, 0 ); + if ( NULL == ( file_realpath = realpath( nickname, NULL ) ) ) { -+ perror( "Could not get the realpath" ); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not get realpath of certificate file `%s'.\n", ++ nickname, 0, 0 ); + goto bail; + } + if ( -1 == symlink( file_realpath, cert_file_path ) ) { -+ perror( "Could not create a symlink" ); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not create a symlink of `%s' to `%s'.\n", ++ file_realpath, cert_file_path, 0 ); + goto bail; + } + if ( file_realpath ) free( file_realpath ); @@ -1249,11 +1263,15 @@ new file mode 100644 + "tlsmc_extract_cert_key_pair: INFO: symlinking PK file `%s' to file `%s'.\n", + pin_filename, key_file_path, 0 ); + if ( NULL == ( file_realpath = realpath( pin_filename, NULL ) ) ) { -+ perror( "Could not get the realpath" ); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not get realpath of PK file `%s'.\n", ++ pin_filename, 0, 0 ); + goto bail; + } + if ( -1 == symlink( file_realpath, key_file_path ) ) { -+ perror( "Could not create a symlink" ); ++ Debug( LDAP_DEBUG_ANY, ++ "tlsmc_extract_cert_key_pair: ERROR: could not create a symlink of `%s' to `%s'.\n", ++ file_realpath, key_file_path, 0 ); + goto bail; + } + } diff --git a/openldap.spec b/openldap.spec index 8c60e4d..b7879cb 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Name: openldap Version: 2.4.46 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,11 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Jul 4 2018 Matus Honek - 2.4.46-2 +- MozNSS Compat. Layer: Make log messages more clear (#1598103) +- MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203) +- MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161) + * Tue Mar 27 2018 Matus Honek - 2.4.46-1 - Rebase to version OpenLDAP 2.4.46 (#1559652) From 5411c8463a0e092d60913bc22fd6dbe7e987becd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 4 Jul 2018 16:13:06 +0200 Subject: [PATCH 033/118] Remove unused leftover MozNSS Compat. Layer references Related: #1557967 --- openldap-tlsmc.patch | 1816 ------------------------------------------ openldap.spec | 22 +- 2 files changed, 4 insertions(+), 1834 deletions(-) delete mode 100644 openldap-tlsmc.patch diff --git a/openldap-tlsmc.patch b/openldap-tlsmc.patch deleted file mode 100644 index 0987413..0000000 --- a/openldap-tlsmc.patch +++ /dev/null @@ -1,1816 +0,0 @@ -MozNSS Interception Code - -Author: Matus Honek -Date: Wed Jul 4 10:35:04 CEST 2018 -diff --git a/configure.in b/configure.in ---- a/configure.in -+++ b/configure.in -@@ -237,6 +237,7 @@ dnl OL_ARG_ENABLE(referrals,[ --enable-referrals enable LDAPv2+ Referrals (ex - ol_enable_referrals=${ol_enable_referrals-no} - OL_ARG_ENABLE(ipv6,[ --enable-ipv6 enable IPv6 support], auto)dnl - OL_ARG_ENABLE(local,[ --enable-local enable AF_LOCAL (AF_UNIX) socket support], auto)dnl -+OL_ARG_ENABLE(moznss_compatibility,[ --enable-moznss-compatibility enable MozNSS compatibility], no)dnl - - dnl ---------------------------------------------------------------- - dnl General "with" options -@@ -1256,6 +1257,26 @@ if test $ol_link_tls = no ; then - fi - fi - -+if test $ol_enable_moznss_compatibility = yes ; then -+ if test $have_openssl = yes ; then -+ if test $ol_with_tls = openssl ; then -+ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss_libs=yes], [have_moznss_libs=no]) -+ if test $have_moznss_libs = yes ; then -+ AC_DEFINE(HAVE_MOZNSS_COMPATIBILITY, 1, -+ [define if you want to support MozNSS databases when compiled with OpenSSL]) -+ TLS_LIBS="$TLS_LIBS $MOZNSS_LIBS" -+ CFLAGS="$CFLAGS $MOZNSS_CFLAGS" -+ else -+ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have MozNSS present.]) -+ fi -+ else -+ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to compile with OpenSSL for crypto. (see --with-tls flag)]) -+ fi -+ else -+ AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have OpenSSL devel available. (unable to build with OpenSSL)]) -+ fi -+fi -+ - WITH_TLS=no - if test $ol_link_tls = yes ; then - AC_DEFINE(HAVE_TLS, 1, [define if you have TLS]) -diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 ---- a/doc/man/man3/ldap_get_option.3 -+++ b/doc/man/man3/ldap_get_option.3 -@@ -772,6 +772,19 @@ must be - When using the OpenSSL library this is an SSL*. When using other - crypto libraries this is a pointer to an OpenLDAP private structure. - Applications generally should not use this option. -+.TP -+.B LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY -+Sets/gets the status of the MozNSS database compatibility layer for TLS options. This options is available only if OpenLDAP is compiled with OpenSSL. This has effect only before the TLS context is established. -+This option defaults to be on. -+.BR invalue -+should either be -+.BR LDAP_OPT_OFF -+or -+.BR LDAP_OPT_ON ; -+.BR outvalue -+must be -+.BR "int *" . -+When set, just before TLS context initialization the library will first check if TLS settings are MozNSS-specific and if so it will export certificates from a preconfigured database and set other TLS settings so that OpenSSL can continue without issues. - .SH ERRORS - On success, the functions return - .BR LDAP_OPT_SUCCESS , -diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 ---- a/doc/man/man5/ldap.conf.5 -+++ b/doc/man/man5/ldap.conf.5 -@@ -483,6 +483,11 @@ Check the CRL for a whole certificate chain - Specifies the file containing a Certificate Revocation List to be used - to verify if the server certificates have not been revoked. This - parameter is only supported with GnuTLS and Mozilla NSS. -+.RE -+.TP -+.B TLS_MOZNSS_COMPATIBILITY -+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. -+This option defaults to be on. - .SH "ENVIRONMENT VARIABLES" - .TP - LDAPNOINIT -diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 ---- a/doc/man/man5/slapd-config.5 -+++ b/doc/man/man5/slapd-config.5 -@@ -1004,6 +1004,11 @@ Check the CRL for a whole certificate chain - Specifies a file containing a Certificate Revocation List to be used - for verifying that certificates have not been revoked. This parameter - is only valid when using GnuTLS or Mozilla NSS. -+.RE -+.TP -+.B olcTLSMozNSSCompatibility -+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. -+This option defaults to be on. - .SH DYNAMIC MODULE OPTIONS - If - .B slapd -diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 ---- a/doc/man/man5/slapd.conf.5 -+++ b/doc/man/man5/slapd.conf.5 -@@ -1235,6 +1235,11 @@ Check the CRL for a whole certificate chain - Specifies a file containing a Certificate Revocation List to be used - for verifying that certificates have not been revoked. This directive is - only valid when using GnuTLS and Mozilla NSS. -+.RE -+.TP -+.B TLSMozNSSCompatibility -+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL. -+This option defaults to be on. - .SH GENERAL BACKEND OPTIONS - Options in this section only apply to the configuration file section - for the specified backend. They are supported by every -diff --git a/include/ldap.h b/include/ldap.h ---- a/include/ldap.h -+++ b/include/ldap.h -@@ -158,6 +158,10 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_NEWCTX 0x600f - #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ - #define LDAP_OPT_X_TLS_PACKAGE 0x6011 -+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY 0x6050 -+ -+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED 0 -+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED 1 - - #define LDAP_OPT_X_TLS_NEVER 0 - #define LDAP_OPT_X_TLS_HARD 1 -diff --git a/libraries/libldap/Makefile.in b/libraries/libldap/Makefile.in ---- a/libraries/libldap/Makefile.in -+++ b/libraries/libldap/Makefile.in -@@ -26,7 +26,7 @@ SRCS = bind.c open.c result.c error.c compare.c search.c \ - request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \ - init.c options.c print.c string.c util-int.c schema.c \ - charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ -- tls2.c tls_o.c tls_g.c tls_m.c \ -+ tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \ - turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ - assertion.c deref.c ldif.c fetch.c - -@@ -39,7 +39,7 @@ OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \ - request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \ - init.lo options.lo print.lo string.lo util-int.lo schema.lo \ - charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ -- tls2.lo tls_o.lo tls_g.lo tls_m.lo \ -+ tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \ - turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ - assertion.lo deref.lo ldif.lo fetch.lo - -diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c ---- a/libraries/libldap/init.c -+++ b/libraries/libldap/init.c -@@ -137,7 +137,9 @@ static const struct ol_attribute { - #ifdef HAVE_GNUTLS - {0, ATTR_TLS, "TLS_CRLFILE", NULL, LDAP_OPT_X_TLS_CRLFILE}, - #endif -- -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ {0, ATTR_TLS, "TLS_MOZNSS_COMPATIBILITY", NULL, LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY}, -+#endif - #endif - - {0, ATTR_NONE, NULL, NULL, 0} -@@ -582,6 +584,9 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl - gopts->ldo_tls_connect_cb = NULL; - gopts->ldo_tls_connect_arg = NULL; - gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND; -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ gopts->ldo_tls_moznss_compatibility = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED; -+#endif - #endif - gopts->ldo_keepalive_probes = 0; - gopts->ldo_keepalive_interval = 0; -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -260,7 +260,8 @@ struct ldapoptions { - int ldo_tls_require_cert; - int ldo_tls_impl; - int ldo_tls_crlcheck; --#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0 -+ int ldo_tls_moznss_compatibility; -+#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0,0 - #else - #define LDAP_LDO_TLS_NULLARG - #endif -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -37,6 +37,8 @@ - - #include "ldap-tls.h" - -+#include "tls_mc.h" -+ - static tls_impl *tls_imp = &ldap_int_tls_impl; - #define HAS_TLS( sb ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \ - (void *)tls_imp->ti_sbio ) -@@ -96,6 +98,7 @@ tls_ctx_ref( tls_ctx *ctx ) - * an extra mutex for the default ctx. - */ - static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; -+ldap_pvt_thread_mutex_t tlsmc_mutex; - #endif - - void -@@ -161,6 +164,7 @@ tls_init(tls_impl *impl ) - if ( !tls_initialized++ ) { - #ifdef LDAP_R_COMPILE - ldap_pvt_thread_mutex_init( &tls_def_ctx_mutex ); -+ ldap_pvt_thread_mutex_init( &tlsmc_mutex ); - #endif - } - -@@ -196,6 +200,27 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) - - tls_init( ti ); - -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ if ( LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED == lo->ldo_tls_moznss_compatibility ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLSMC: MozNSS compatibility interception begins.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_intercept_initialization( lo, is_server ) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "TLSMC: ERROR: MozNSS compatibility layer failed.\n", -+ 0, 0, 0 ); -+ } -+ lts = lo->ldo_tls_info; -+ Debug( LDAP_DEBUG_ANY, -+ "TLSMC: MozNSS compatibility interception ends.\n", -+ 0, 0, 0 ); -+ } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "TLS: MozNSS compatibility layer disabled.\n", -+ 0, 0, 0 ); -+ } -+#endif -+ - if ( is_server && !lts.lt_certfile && !lts.lt_keyfile && - !lts.lt_cacertfile && !lts.lt_cacertdir ) { - /* minimum configuration not provided */ -@@ -572,6 +597,21 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg ) - return ldap_pvt_tls_set_option( ld, option, &i ); - } - return -1; -+#endif -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: -+ i = -1; -+ if ( (strcasecmp( arg, "yes" ) == 0) || -+ (strcasecmp( arg, "true" ) == 0) || -+ (strcasecmp( arg, "on" ) == 0) ) { -+ i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED; -+ } -+ if ( (strcasecmp( arg, "no" ) == 0) || -+ (strcasecmp( arg, "false" ) == 0) || -+ (strcasecmp( arg, "off" ) == 0) ) { -+ i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED; -+ } -+ return ldap_pvt_tls_set_option( ld, option, &i ); - #endif - } - return -1; -@@ -675,6 +715,9 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) - case LDAP_OPT_X_TLS_CONNECT_ARG: - *(void **)arg = lo->ldo_tls_connect_arg; - break; -+ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: -+ *(int *)arg = lo->ldo_tls_moznss_compatibility; -+ break; - default: - return -1; - } -@@ -802,6 +845,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) - ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); - lo->ldo_tls_ctx = NULL; - return ldap_int_tls_init_ctx( lo, *(int *)arg ); -+ case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY: -+ if ( !arg ) return -1; -+ lo->ldo_tls_moznss_compatibility = *(int *)arg; -+ break; - default: - return -1; - } -diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc.c -@@ -0,0 +1,1369 @@ -+#include "portable.h" -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+ -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "ldap-int.h" -+#include "ldap-tls.h" -+#include "ldap_pvt_thread.h" -+ -+#include "tls_mc.h" -+#include "tls_mc_ossl.h" -+ -+#define TLSMC_CHECKSUM_LEN 32 -+ -+#define TLSMC_CACERTS_DIR_NAME "cacerts" -+#define TLSMC_CERT_FILE_NAME "cert.pem" -+#define TLSMC_KEY_FILE_NAME "key.pem" -+#define TLSMC_README_FILE_NAME "README" -+ -+#define TLSM_CERTDB_DESC "ldap" -+#define DEFAULT_TOKEN_NAME "default" -+ -+#define TLSMC_IS_INPLACE 1 -+#define TLSMC_IS_TEMPORARY 2 -+ -+#define DONOTEDIT \ -+ "This file is auto-generated by the MozNSS Compatibility Layer of OpenLDAP software.\n" \ -+ "This layer is not part of the OpenLDAP software distributed in upstream.\n" \ -+ "Please file any related bugs with your GNU/Linux distribution.\n" \ -+ "Do not edit contents of this directory structure directly. Rather, change your configuration to use the OpenSSL-style TLS options, so that this directory structure does not need to be generated anymore.\n" \ -+ "Please refer to the slapd.conf(5), slapd-config(5), and ldap.conf(5) man pages for more information." -+#define PEM_CERT_HEADER "-----BEGIN CERTIFICATE-----" -+#define PEM_CERT_FOOTER "-----END CERTIFICATE-----" -+#define PEM_KEY_HEADER "-----BEGIN PRIVATE KEY-----" -+#define PEM_KEY_FOOTER "-----END PRIVATE KEY-----" -+#define README_HEADER "The contents of this file are hashed and used as part of the name of the parent directory.\n" -+ -+#ifdef LDAP_R_COMPILE -+ldap_pvt_thread_mutex_t tlsmc_mutex; -+#endif -+/*******************************************************************/ -+ -+ -+char * -+tlsmc_path2name( char *path ) -+{ -+ if ( NULL == path ) return NULL; -+ char *last_slash = strrchr( path, '/' ); -+ if ( NULL == last_slash ) -+ return path; -+ else -+ return last_slash + 1; -+} -+ -+ -+int -+tlsmc_write_file( char *filename, char *buf, mode_t final_mode ) -+{ -+ int rv = 0; -+ int fd = -1; -+ if ( 0 > ( fd = open( filename, O_WRONLY | O_CREAT | O_EXCL, S_IWUSR ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not open file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( -1 >= write( fd, buf, strlen(buf) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not write file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( -1 >= fchmod( fd, final_mode ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not set file mode: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( -1 >= fsync( fd ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not fsync file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ goto bail; -+ } -+ if ( 0 > close( fd ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_write_file: ERROR: could not close file: `%s': %s.\n", -+ filename, strerror(errno), 0 ); -+ fd = -1; -+ goto bail; -+ } -+ fd = -1; -+ rv = 1; -+bail: -+ if ( fd > -1 ) close( fd ); -+ return rv; -+} -+ -+ -+static int -+tlsmc_remove_dir_recursively( const char *dir_name ) -+{ -+ int rv = 0; -+ DIR *dir = NULL; -+ struct dirent *entry = NULL; -+ char *full_path = NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: starting recursively removing directory `%s'.\n", -+ dir_name, 0, 0 ); -+ if ( NULL == ( dir = opendir( dir_name ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not open the directory (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail; -+ } -+ -+ while ( NULL != ( entry = readdir( dir ) ) ) { -+ struct stat info; -+ -+ full_path = NULL; -+ full_path = PR_smprintf( "%s/%s", dir_name, entry->d_name ); -+ -+ if ( 0 != strcmp( entry->d_name, "." ) && 0 != strcmp( entry->d_name, ".." ) ) { -+ if ( 0 == lstat( full_path, &info ) ) { -+ if ( S_ISDIR( info.st_mode ) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: stepping into directory `%s'.\n", -+ entry->d_name, 0, 0 ); -+ if ( 0 == tlsmc_remove_dir_recursively( full_path ) ) { -+ goto bail_and_close_dir; -+ } -+ } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: removing file `%s'.\n", -+ entry->d_name, 0, 0 ); -+ if ( 0 != remove( full_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not remove the file (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail_and_close_dir; -+ } -+ } -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not stat `%s', (errno %d: %s).\n", -+ full_path, errno, strerror( errno ) ); -+ goto bail_and_close_dir; -+ } -+ } -+ -+ if ( full_path ) { -+ PR_smprintf_free( full_path ); -+ full_path = NULL; -+ } -+ -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: stepping out of the directory.\n", -+ 0, 0, 0 ); -+ if ( 0 != closedir( dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: WARN: could not close the directory (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_remove_dir_recursively: INFO: removing the directory itself.\n", -+ 0, 0, 0 ); -+ if ( 0 != remove( dir_name ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_remove_dir_recursively: ERROR: could not remove the directory (errno %d: %s).\n", -+ errno, strerror( errno ), 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+ goto bail; -+bail_and_close_dir: -+ closedir( dir ); -+bail: -+ if ( full_path ) PR_smprintf_free( full_path ); -+ return rv; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+static void -+tlsmc_get_certdb_prefix( const char *certdir, char **nsscertdir, char **realcertdir, char **prefix ) -+{ -+ char sep = PR_GetDirectorySeparator(); -+ char *ptr = NULL; -+ char *chkpath = NULL; -+ struct PRFileInfo prfi; -+ PRStatus prc; -+ -+ *realcertdir = (char *)certdir; /* default is the one passed in */ -+ -+ /* if certdir is not given, just return */ -+ if ( !certdir ) return; -+ -+ *nsscertdir = certdir; -+ -+ /* ignore database type prefix (e.g. sql:, dbm:) if provided */ -+ if ( NULL != ( chkpath = strchr( certdir, ':' ) ) ) { -+ *realcertdir = chkpath + 1; -+ } -+ -+ /* if certdir exists (file or directory) then it cannot specify a prefix */ -+ prc = PR_GetFileInfo( *realcertdir, &prfi ); -+ if ( prc == PR_SUCCESS ) { -+ goto finish; -+ } -+ -+ /* if certdir was given, and there is a '/' in certdir, see if there -+ is anything after the last '/' - if so, assume it is the prefix */ -+ /* if ( ( ( ptr = strrchr( *realcertdir, sep ) ) ) && *(ptr + 1) ) { */ -+ /* *realcertdir = PL_strndup( *realcertdir, ptr - (*realcertdir) ); */ -+ /* *prefix = PL_strdup( ptr + 1 ); */ -+ /* } */ -+ -+ -+ if ( ptr = strrchr( *realcertdir, sep ) ) { -+ if ( *(ptr + 1) ) { -+ *ptr = '\0'; -+ *prefix = ptr + 1; -+ } else { -+ *prefix = *realcertdir + strlen( *realcertdir ); // empty string -+ } -+ } else { -+ *prefix = *realcertdir; -+ *realcertdir = *prefix + strlen( *prefix ); // empty string -+ } -+finish: -+ /* drop potential last '/' from realcertdir */ -+ do { -+ ptr = strrchr( *realcertdir, sep ); -+ if ( ptr && (! *(ptr+1) ) ) { -+ *ptr = '\0'; -+ } else { -+ break; -+ } -+ } while (1); -+ -+ return; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+static char * -+tlsmc_get_pin_from_file(const char *token_name, char *filename) -+{ -+ char *pwdstr = NULL; -+ char *contents = NULL; -+ char *lasts = NULL; -+ char *line = NULL; -+ char *candidate = NULL; -+ PRFileInfo file_info; -+ PRFileDesc *pwd_fileptr = NULL; -+ pwd_fileptr = PR_Open( filename, PR_RDONLY, 00400 ); -+ -+ /* open the password file */ -+ if ( !pwd_fileptr ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not open security pin file %s - error %d:%s.\n", -+ filename, errcode, -+ PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* get the file size */ -+ if ( PR_SUCCESS != PR_GetFileInfo( filename, &file_info ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not get file info from pin file %s - error %d:%s.\n", -+ filename, errcode, -+ PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* create a buffer to hold the file contents */ -+ if ( !( contents = PR_CALLOC( file_info.size + 1 ) ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not alloc a buffer for contents of pin file %s - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* read file into the buffer */ -+ if( PR_Read( pwd_fileptr, contents, file_info.size ) <= 0 ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_get_pin_from_file: could not read the file contents from pin file %s - error %d:%s.\n", -+ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); -+ goto done; -+ } -+ -+ /* format is [tokenname:]password EOL [tokenname:]password EOL ... */ -+ /* if you want to use a password containing a colon character, use -+ the special tokenname "default" */ -+ for ( line = PL_strtok_r( contents, "\r\n", &lasts ); line; -+ line = PL_strtok_r( NULL, "\r\n", &lasts ) ) { -+ char *colon; -+ -+ if ( !*line ) { -+ continue; /* skip blank lines */ -+ } -+ colon = PL_strchr( line, ':' ); -+ if ( colon ) { -+ if ( *(colon + 1) && token_name && -+ !PL_strncmp( token_name, line, colon-line ) ) { -+ candidate = colon + 1; /* found a definite match */ -+ break; -+ } else if ( !PL_strncmp( DEFAULT_TOKEN_NAME, line, colon-line ) ) { -+ candidate = colon + 1; /* found possible match */ -+ } -+ } else { /* no token name */ -+ candidate = line; -+ } -+ } -+done: -+ if ( pwd_fileptr ) { -+ PR_Close( pwd_fileptr ); -+ } -+ if ( candidate ) { -+ pwdstr = PL_strdup( candidate ); -+ } -+ PL_strfree( contents ); -+ -+ return pwdstr; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+/* -+ * Turn the echoing off on a tty. -+ */ -+static void -+echoOff(int fd) -+{ -+ if ( isatty( fd ) ) { -+ struct termios tio; -+ tcgetattr( fd, &tio ); -+ tio.c_lflag &= ~ECHO; -+ tcsetattr( fd, TCSAFLUSH, &tio ); -+ } -+} -+ -+/* BORROWED FROM tls_m.c */ -+/* -+ * Turn the echoing on on a tty. -+ */ -+static void -+echoOn(int fd) -+{ -+ if ( isatty( fd ) ) { -+ struct termios tio; -+ tcgetattr( fd, &tio ); -+ tio.c_lflag |= ECHO; -+ tcsetattr( fd, TCSAFLUSH, &tio ); -+ tcsetattr( fd, TCSAFLUSH, &tio ); -+ } -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+char * -+tlsmc_get_pin( PK11SlotInfo *slot, PRBool retry, void * filename) -+{ -+ char *token_name = NULL; -+ char *pwdstr = NULL; -+ -+ token_name = PK11_GetTokenName( slot ); -+ /* Try to get the passwords from the password file if it exists. -+ * THIS IS UNSAFE and is provided for convenience only. Without this -+ * capability the server would have to be started in foreground mode -+ * if using an encrypted key. -+ */ -+ if ( filename ) { -+ fprintf( stderr, -+ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n"); -+ pwdstr = tlsmc_get_pin_from_file( token_name, (char *)filename ); -+ if ( retry && pwdstr != NULL ) -+ return NULL; -+ } -+ if ( !pwdstr ) { -+ int infd = PR_FileDesc2NativeHandle( PR_STDIN ); -+ int isTTY = isatty( infd ); -+ unsigned char phrase[200]; -+ /* Prompt for password */ -+ if ( isTTY ) { -+ fprintf( stderr, -+ "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n"); -+ fprintf( stdout, -+ "Please enter pin, password, or pass phrase for security token '%s': ", -+ token_name ? token_name : DEFAULT_TOKEN_NAME ); -+ echoOff( infd ); -+ } -+ fgets( (char*)phrase, sizeof(phrase), stdin ); -+ if ( isTTY ) { -+ fprintf( stdout, "\n" ); -+ echoOn( infd ); -+ } -+ /* stomp on newline */ -+ phrase[strlen((char*)phrase)-1] = 0; -+ -+ pwdstr = PL_strdup( (char*)phrase ); -+ } -+ -+ return pwdstr; -+} -+ -+ -+int -+tlsmc_hash( char **dest, const char *src ) -+{ -+ int rv = 0; -+ unsigned char fp[SHA256_LENGTH]; -+ SECItem fpItem; -+ -+ if ( SECSuccess != ( rv = PK11_HashBuf( SEC_OID_SHA256, fp, src, strlen(src) ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_hash: could not hash a buffer", -+ NULL, NULL, NULL ); -+ goto bail; -+ } -+ fpItem.data = fp; -+ fpItem.len = SHA256_LENGTH; -+ if ( NULL == ( *dest = CERT_Hexify( &fpItem, 0 ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_hash: could not hexify the hash", -+ NULL, NULL, NULL ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ return rv; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+int -+tlsmc_open_nssdb( char *ld_cacertdir, NSSInitContext **out_initctx, char **out_nssdb_dir, char **out_nssdb_prefix ) -+{ -+#define SECURITYDIRS_COUNT 3 -+ int rc = 0; -+ PRErrorCode errcode = 1; -+ -+ /* restart secmod modules */ -+#ifdef HAVE_SECMOD_RESTARTMODULES -+ /* NSS enforces the pkcs11 requirement that modules should be unloaded after -+ a fork() - since there is no portable way to determine if NSS has been -+ already initialized in a parent process, we just call SECMOD_RestartModules -+ with force == FALSE - if the module has been unloaded due to a fork, it will -+ be reloaded, otherwise, it is a no-op */ -+ if ( 0 == ( rc = SECMOD_RestartModules(PR_FALSE /* do not force */) ) ) { -+ errcode = PORT_GetError(); -+ if ( errcode != SEC_ERROR_NOT_INITIALIZED ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_open_nssdb: WARN: could not restart the security modules: %d:%s.\n", -+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); -+ } else { -+ errcode = 1; -+ } -+ } -+#endif -+ -+ -+ /* context and certdb */ -+ char *dir_moznss = PR_GetEnv( "MOZNSS_DIR" ); -+ char *dir_default_moznss = PR_GetEnv( "DEFAULT_MOZNSS_DIR" ); -+ const char *securitydirs[SECURITYDIRS_COUNT] = { dir_moznss, ld_cacertdir, dir_default_moznss }; -+ int done = 0; -+ int ii = 0; -+ for ( ii = 0; !done && ( ii < SECURITYDIRS_COUNT ); ++ii ) { -+ // get certdb prefix -+ const char *securitydir = securitydirs[ii]; -+ char *nsscertdir = NULL; -+ char *realcertdir = NULL; -+ const char *defprefix = ""; -+ char *prefix = (char *)defprefix; -+ if ( securitydir == NULL ) continue; -+ tlsmc_get_certdb_prefix( securitydir, &nsscertdir, &realcertdir, &prefix ); -+ *out_nssdb_dir = strdup( realcertdir ); -+ *out_nssdb_prefix = strdup( prefix ); -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_open_nssdb: INFO: trying to initialize moznss using security dir `%s` prefix `%s`.\n", -+ nsscertdir, prefix, NULL); -+ -+ // init context -+ NSSInitContext *initctx = NULL; -+ NSSInitParameters initparams; -+ memset( &initparams, 0, sizeof( initparams ) ); -+ initparams.length = sizeof( initparams ); -+ -+ initctx = NSS_InitContext( nsscertdir, -+ prefix, -+ prefix, -+ SECMOD_DB, -+ &initparams, -+ NSS_INIT_READONLY // | NSS_INIT_NOCERTDB -+ ); -+ rc = initctx ? 1 : 0; -+ -+ *out_initctx = initctx; -+ -+ if ( rc != 1 ) { -+ errcode = PORT_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_open_nssdb: WARN: could not initialize MozNSS context - error %d.\n", -+ errcode, 0, 0 ); -+ } else { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_open_nssdb: INFO: initialized MozNSS context.\n", -+ 0, 0, 0 ); -+ errcode = 0; -+ done = 1; -+ } -+ } -+ -+ PR_Free( dir_moznss ); -+ PR_Free( dir_default_moznss ); -+ -+ PK11_SetPasswordFunc( tlsmc_get_pin ); -+ -+ if ( done && (errcode == 0) && out_initctx ) { -+ return 1; -+ } else { -+ return 0; -+ } -+} -+ -+ -+int -+tlsmc_filestamp( char **filestamp, char *path ) -+{ -+ int rv = 0; -+ struct stat attr; -+ char stime[20]; -+ -+ if ( 0 != stat( path, &attr ) ) { -+ rv = -1; -+ goto bail; -+ } -+ if ( 0 == strftime(stime, sizeof(stime), "%FT%T", localtime(&attr.st_mtime)) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_filestamp: ERROR: could not format mtime: %s.\n", -+ strerror(errno), 0, 0 ); -+ goto bail; -+ } -+ -+ *filestamp = PR_smprintf("mtime %s.%d, size %lld", -+ stime, attr.st_mtim.tv_nsec, (long long) attr.st_size); -+ -+ rv = 1; -+bail: -+ return rv; -+} -+ -+ -+char * -+tlsmc_compute_checksum( char *nssdb_dir, char *nssdb_prefix, -+ char *ld_cacertdir, char *ld_cert, char *ld_key, -+ char **out_data) -+{ -+ int rv = 0; -+ char *data = NULL; -+ char *checksum = NULL; -+ -+ /* gather data */ -+ data = PR_sprintf_append( data, -+ DONOTEDIT "\n" -+ README_HEADER "\n" -+ "PARAMETERS:\n" -+ "nssdb_dir: %s\n" -+ "nssdb_prefix: %s\n" -+ "ld_cacertdir: %s\n" -+ "ld_cert: %s\n" -+ "ld_key: %s\n" -+ "euid: %d\n\n" -+ "FILES:\n", -+ nssdb_dir, nssdb_prefix, ld_cacertdir, ld_cert, ld_key, geteuid() ); -+ -+ char *files[] = { "cert8.db", "cert9.db", "key3.db", "key4.db", "secmod.db", NULL }; -+ char **filep = NULL; -+ for ( filep = files; NULL != *filep; filep++ ) { -+ char *filestamp = NULL; -+ char *path = NULL; -+ path = PR_smprintf( "%s/%s%s", nssdb_dir, nssdb_prefix, *filep ); -+ if ( 0 == tlsmc_filestamp( &filestamp, path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_compute_checksum: INFO: could not check file `%s'.\n", -+ path, 0, 0 ); -+ rv = -1; -+ } else { -+ data = PR_sprintf_append( data, "%s: %s\n", *filep, filestamp ); -+ } -+ if ( filestamp ) PR_smprintf_free( filestamp ); -+ if ( path ) PR_smprintf_free( path ); -+ if ( -1 == rv ) goto bail; -+ } -+ -+ /* compute data checksum */ -+ if ( 1 != tlsmc_hash( &checksum, (const char*) data ) ) { -+ checksum = NULL; -+ goto bail; -+ } -+ -+ /* possibly supply data */ -+ if ( out_data ) { -+ *out_data = strdup( data ); -+ } -+ -+ /* return checksum */ -+bail: -+ if ( data ) PR_smprintf_free( data ); -+ return checksum; -+} -+ -+ -+int -+tlsmc_prepare_dir( char *dir ) -+{ -+ int rv = 0; -+ char *cacerts_dir = NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_prepare_dir: INFO: preparing PEM directory `%s'.\n", -+ dir, 0, 0 ); -+ -+ if ( 0 != mkdir( dir, S_IRWXU /* u+rwx */ ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_prepare_dir: WARN: could not create the PEM directory.\n", -+ 0, 0, 0 ); -+ rv = 0; -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_prepare_dir: INFO: creating a subdirectory `%s'.\n", -+ TLSMC_CACERTS_DIR_NAME, 0, 0 ); -+ cacerts_dir = PR_smprintf( "%s/%s", dir, TLSMC_CACERTS_DIR_NAME ); -+ if ( 0 != mkdir( cacerts_dir, S_IRWXU /* u+rwx */ ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_prepare_dir: WARN: could not create the subdirectory.\n", -+ 0, 0, 0 ); -+ rv = 0; -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_prepare_dir: INFO: successfully created PEM directory structure.\n", -+ TLSMC_CACERTS_DIR_NAME, 0, 0 ); -+ rv = 1; -+ -+bail: -+ if ( cacerts_dir ) PR_smprintf_free( cacerts_dir ); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_cert_to_file(CERTCertDBHandle *certdb_handle, CERTCertificate *cert, char *file_path) -+{ -+ int rv = 0; -+ SECItem data; -+ char *b64 = NULL; -+ char *output = NULL; -+ -+ if ( ! cert ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_to_file: ERROR: cert empty.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ data.data = cert->derCert.data; -+ data.len = cert->derCert.len; -+ b64 = BTOA_DataToAscii(data.data, data.len); -+ if ( ! b64 ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_to_file: ERROR: could not base64 encode.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ output = PR_smprintf( DONOTEDIT "\n\n" -+ "NSS nickname: %s\n" -+ "Issuer: %s\n" -+ "Subject: %s\n" -+ PEM_CERT_HEADER "\n" -+ "%s\n" -+ PEM_CERT_FOOTER "\n", -+ cert->nickname, -+ cert->issuerName, -+ cert->subjectName, -+ b64 ); -+ -+ if ( 0 == tlsmc_write_file( file_path, output, S_IRUSR ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_to_file: ERROR: could not write certificate.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ if ( output ) PR_smprintf_free( output ); -+ if ( b64 ) PORT_Free( b64 ); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_decrypt_key(SECKEYEncryptedPrivateKeyInfo *epki, -+ SECOidTag algTag, -+ SECItem *pwitem, -+ void *pin_arg, -+ SECItem *derPKI) -+{ -+ SECItem *cryptoParam = NULL; -+ PK11SymKey *symKey = NULL; -+ PK11Context *ctx = NULL; -+ int rv = 0; -+ -+ if (!pwitem) return rv; -+ -+ do { -+ SECAlgorithmID algid = epki->algorithm; -+ CK_MECHANISM_TYPE cryptoMechType; -+ CK_ATTRIBUTE_TYPE operation = CKA_DECRYPT; -+ PK11SlotInfo *slot = NULL; -+ -+ cryptoMechType = PK11_GetPBECryptoMechanism(&algid, &cryptoParam, pwitem); -+ if (cryptoMechType == CKM_INVALID_MECHANISM) { -+ goto bail; -+ } -+ -+ if ( NULL == ( slot = PK11_GetBestSlot(cryptoMechType, NULL) ) ) { -+ goto bail; -+ } -+ -+ if ( NULL == ( symKey = PK11_PBEKeyGen(slot, &algid, pwitem, PR_FALSE, pin_arg) ) ) { -+ rv = -1; -+ goto bail_one; -+ } -+ -+ if ( NULL == ( ctx = PK11_CreateContextBySymKey( -+ cryptoMechType, operation, symKey, cryptoParam) ) ) { -+ rv = -1; -+ goto bail_one; -+ } -+ -+ if ( SECSuccess != PK11_CipherOp(ctx, -+ derPKI->data, /* out */ -+ (int *)(&derPKI->len), /* out len */ -+ (int)epki->encryptedData.len, /* max out */ -+ epki->encryptedData.data, /* in */ -+ (int)epki->encryptedData.len /* in len */ ) ) { -+ rv = -1; -+ goto bail_one; -+ } -+ -+ if ( derPKI->len != epki->encryptedData.len ) goto bail_one; -+ if ( SECSuccess != PK11_Finalize(ctx) ) goto bail_one; -+ bail_one: -+ if (slot) PK11_FreeSlot(slot); -+ } while (0); -+ -+ rv = ((rv == 0) ? 1 : 0); -+bail: -+ if (symKey) PK11_FreeSymKey(symKey); -+ if (cryptoParam) { -+ SECITEM_ZfreeItem(cryptoParam, PR_TRUE); -+ cryptoParam = NULL; -+ } -+ if (ctx) PK11_DestroyContext(ctx, PR_TRUE); -+ -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_key_of_cert_to_file(CERTCertificate *cert, -+ char *pin_filename, -+ char *filename) -+{ -+ int rv = 0; -+ SECKEYPrivateKey *key = NULL; -+ SECItem pwitem; -+ SECKEYEncryptedPrivateKeyInfo *epki = NULL; -+ PLArenaPool *arenaForPKI = NULL; -+ SECItem clearKeyDER; -+ char *b64 = NULL; -+ char *output = NULL; -+ -+ // establish password -+ pwitem.data = "secretpw"; // FIXME use pin_filename -+ pwitem.len = strlen(pwitem.data); -+ pwitem.type = siBuffer; -+ -+ // get key -+ if ( NULL == ( key = PK11_FindKeyByAnyCert(cert, (void *)pin_filename) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: PK11_FindKeyByAnyCert failed.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // get key info -+ if ( NULL == ( epki = PK11_ExportEncryptedPrivKeyInfo( -+ NULL, SEC_OID_DES_EDE3_CBC, &pwitem, key, 1000, (void *)pin_filename) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: PK11_ExportEncryptedPrivKeyInfo returned NULL.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // get clear DER -+ if ( NULL == ( arenaForPKI = PORT_NewArena(2048) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: PORT_NewArena failed.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ clearKeyDER.data = PORT_ArenaAlloc(arenaForPKI, epki->encryptedData.len); -+ clearKeyDER.len = epki->encryptedData.len; -+ clearKeyDER.type = siBuffer; -+ -+ if ( 0 == tlsmc_decrypt_key(epki, SEC_OID_DES_EDE3_CBC, &pwitem, -+ (void *)pin_filename, &clearKeyDER) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: could not decrypt the key.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // base64 encode -+ if ( NULL == ( b64 = BTOA_ConvertItemToAscii(&clearKeyDER) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: could not base64 encode.\n", -+ 0,0,0); -+ goto bail; -+ } -+ -+ // print out -+ output = PR_smprintf( DONOTEDIT "\n" -+ PEM_KEY_HEADER "\n" -+ "%s\n" -+ PEM_KEY_FOOTER "\n", -+ b64 ); -+ -+ if ( 0 == tlsmc_write_file( filename, output, S_IRUSR ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_key_of_cert_to_file: ERROR: could not write PK.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+ -+bail: -+ if (b64) PORT_Free(b64); -+ if (arenaForPKI) PORT_FreeArena(arenaForPKI, PR_FALSE); -+ if (epki) SECKEY_DestroyEncryptedPrivateKeyInfo(epki, PR_TRUE); -+ if (key) SECKEY_DestroyPrivateKey(key); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_cert_key_pair(char *nickname, char *pin_filename, char *dir_name) -+{ -+ int rv = 0; -+ CERTCertDBHandle *certHandle = NULL; -+ CERTCertificate *cert = NULL; -+ char *cert_file_path = NULL; -+ char *key_file_path = NULL; -+ char *file_realpath = NULL; -+ -+ -+ cert_file_path = PR_smprintf( "%s/cert.pem", dir_name ); -+ key_file_path = PR_smprintf( "%s/key.pem", dir_name ); -+ -+ if ( NULL == nickname ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: WARN: supplied nickname is empty (NULL).\n", -+ 0, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ if ( NULL == ( certHandle = CERT_GetDefaultCertDB() ) ) { -+ // FIXME see same in tlsmc_extract_cacerts() -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not get certificate handle.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( NULL != ( cert = PK11_FindCertFromNickname(nickname, NULL) ) ) { -+ /* extract cert/key from NSS db */ -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: extracting certificate `%s' to file `%s'.\n", -+ nickname, cert_file_path, 0 ); -+ if ( 0 == tlsmc_extract_cert_to_file(certHandle, cert, cert_file_path) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not extract certificate.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: extracting associated PK to file `%s'.\n", -+ key_file_path, 0, 0 ); -+ if ( 0 == tlsmc_extract_key_of_cert_to_file( cert, pin_filename, key_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not extract PK.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ } else { -+ /* symlink PEM cert/key PEM files */ -+ -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: INFO: could not find certificate with nickname `%s', expecting a PEM file.\n", -+ nickname, 0, 0 ); -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: symlinking certificate file `%s' to file `%s'.\n", -+ nickname, cert_file_path, 0 ); -+ if ( NULL == ( file_realpath = realpath( nickname, NULL ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not get realpath of certificate file `%s'.\n", -+ nickname, 0, 0 ); -+ goto bail; -+ } -+ if ( -1 == symlink( file_realpath, cert_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not create a symlink of `%s' to `%s'.\n", -+ file_realpath, cert_file_path, 0 ); -+ goto bail; -+ } -+ if ( file_realpath ) free( file_realpath ); -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cert_key_pair: INFO: symlinking PK file `%s' to file `%s'.\n", -+ pin_filename, key_file_path, 0 ); -+ if ( NULL == ( file_realpath = realpath( pin_filename, NULL ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not get realpath of PK file `%s'.\n", -+ pin_filename, 0, 0 ); -+ goto bail; -+ } -+ if ( -1 == symlink( file_realpath, key_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cert_key_pair: ERROR: could not create a symlink of `%s' to `%s'.\n", -+ file_realpath, key_file_path, 0 ); -+ goto bail; -+ } -+ } -+ -+ rv = 1; -+ -+bail: -+ if (file_realpath) free(file_realpath); -+ if (key_file_path) PR_smprintf_free(key_file_path); -+ if (cert_file_path) PR_smprintf_free(cert_file_path); -+ if (cert) CERT_DestroyCertificate(cert); -+ return rv; -+} -+ -+ -+/* BORROWED FROM 389ds: ssl.c */ -+int -+tlsmc_extract_cacerts( char *dir_name ) -+{ -+ int rv = 0; -+ CERTCertDBHandle *certHandle = NULL; -+ CERTCertListNode *node = NULL; -+ CERTCertList *list = NULL; -+ char *cacerts_dir = NULL; -+ int cert_cnt = 0; -+ -+ cacerts_dir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, dir_name ); -+ -+ certHandle = CERT_GetDefaultCertDB(); // FIXME maybe we should really use certdb_slot? -+ if ( ! certHandle ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: could not get certificate database handle.\n", -+ 0, 0, 0); -+ goto bail; -+ } -+ -+ list = PK11_ListCerts(PK11CertListAll, NULL); -+ if ( ! list ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: could not get list of certificates.\n", -+ 0, 0, 0); -+ goto bail; -+ } -+ for ( node = CERT_LIST_HEAD(list); -+ !CERT_LIST_END(node, list); -+ node = CERT_LIST_NEXT(node)) { -+ -+ CERTCertificate *cert = NULL; -+ CERTCertTrust trust; -+ char *cert_file_path = NULL; -+ int is_ca = 0; -+ -+ cert = node->cert; -+ if ( SECFailure == CERT_GetCertTrust( cert, &trust ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cacerts: ERROR: could not get trust flags of certificate nick=`%s'.\n", -+ cert->nickname, 0, 0); -+ goto bail; -+ } -+ if (trust.sslFlags & -+ (CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA)) { -+ is_ca = 1; -+ } -+ -+ Debug(LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: INFO: found cert nick=`%s'%s.\n", -+ cert->nickname, is_ca ? ", a trusted CA" : ", _not_ a trusted CA, skipping", 0); -+ if ( ! is_ca ) continue; -+ -+ cert_file_path = PR_smprintf( "%s/cert%d.pem", cacerts_dir, cert_cnt ); -+ cert_cnt++; -+ Debug(LDAP_DEBUG_TRACE, -+ "tlsmc_extract_cacerts: INFO: extracting cert nick=`%s' to file `%s'.\n", -+ cert->nickname, cert_file_path, 0); -+ if ( 0 == tlsmc_extract_cert_to_file( certHandle, cert, cert_file_path ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cacerts: ERROR: could not extract the certificate.\n", -+ 0, 0, 0); -+ goto bail_one; -+ } -+ if ( 0 == tlsmc_cert_create_hash_symlink( cert_file_path, cacerts_dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_cacerts: ERROR: could not rehash the certificate.\n", -+ 0, 0, 0); -+ goto bail_one; -+ } -+ if ( cert_file_path ) PR_smprintf_free( cert_file_path ); -+ continue; -+ bail_one: -+ if ( cert_file_path ) PR_smprintf_free( cert_file_path ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ if ( cacerts_dir ) PR_smprintf_free( cacerts_dir ); -+ if ( list ) CERT_DestroyCertList( list ); -+ return rv; -+} -+ -+ -+/* returns 1 if successfull; -+ returns -1 if only cert-key pair is NULL or could not be extracted; -+ returns 0 if any other error -+*/ -+int -+tlsmc_extract_nssdb( char *dir_name, char **ld_cacertdir, char **ld_cert, char **ld_key ) -+{ -+ int rv = 0; -+ -+ if ( ! dir_name ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: FATAL: target dir name empty.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( 0 == tlsmc_extract_cacerts( dir_name ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: ERROR: could not export CA certificates.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( 0 == tlsmc_extract_cert_key_pair( *ld_cert, *ld_key, dir_name ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_extract_nssdb: ERROR: could not export user cert and/or key.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ rv = 1; -+bail: -+ return rv; -+} -+ -+ -+/* BORROWED FROM tls_m.c */ -+int -+tlsmc_close_nssdb(NSSInitContext **initctx) -+{ -+ if ( *initctx && NSS_ShutdownContext( *initctx ) ) { -+ PRErrorCode errcode = PR_GetError(); -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_close_nssdb: ERROR: could not shutdown NSS - error %d:%s.\n", -+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); -+ return 0; -+ } else { -+ return 1; -+ } -+} -+ -+ -+int -+tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ) -+{ -+ -+ int rv = 0; -+ -+ NSSInitContext *nss_ctx = NULL; -+ char *nssdb_dir_path = NULL; -+ char *nssdb_prefix = NULL; -+ char *pem_dir = NULL; -+ char *readme_path = NULL; -+ char *data = NULL; // data before checksum -+ char *checksum = NULL; // checksummed data -+ struct stat stat_buf; -+ -+#ifdef LDAP_R_COMPILE -+ ldap_pvt_thread_mutex_lock( &tlsmc_mutex ); -+#endif -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: trying to open NSS DB with CACertDir = `%s'.\n", -+ *ld_cacertdir, 0, 0 ); -+ if ( NULL == ld_cacertdir || NULL == ld_cert || NULL == ld_key ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: cannot proceed, some of the arguments are NULL.\n", -+ 0, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ if ( 0 == tlsmc_open_nssdb( *ld_cacertdir, &nss_ctx, &nssdb_dir_path, &nssdb_prefix ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.\n", -+ 0, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ -+ if ( NULL == ( checksum = tlsmc_compute_checksum( nssdb_dir_path, nssdb_prefix, -+ *ld_cacertdir, *ld_cert, *ld_key, -+ &data ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: could not compute checksum.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( NULL == ( pem_dir = PR_smprintf( "/tmp/openldap-tlsmc-%s-%s-%s", -+ tlsmc_path2name( nssdb_dir_path ), -+ nssdb_prefix, -+ checksum) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not allocate memory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( NULL == ( readme_path = PR_smprintf( "%s/" TLSMC_README_FILE_NAME, pem_dir ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not allocate memory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: trying with PEM dir = `%s'.\n", -+ pem_dir, 0, 0 ); -+ if ( 0 == stat( pem_dir, &stat_buf ) ) { -+ if ( S_ISDIR(stat_buf.st_mode) ) { -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: INFO: using the existing PEM dir.\n", -+ 0, 0, 0 ); -+ if ( 0 == stat( readme_path, &stat_buf ) ) { -+ goto pem_dir_exists; -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: the PEM dir found does not contain README file. Will remove the PEM dir and try to recreate it.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_remove_dir_recursively( pem_dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not remove the PEM dir. Cannot properly set TLS.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ } -+ } else { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: tried to stat the PEM dir but it is not a directory.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_convert: WARN: will try to create PEM dir.\n", -+ 0, 0, 0 ); -+ if ( 0 == tlsmc_prepare_dir( pem_dir ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: cannot prepare the PEM dir.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( 0 == tlsmc_extract_nssdb( pem_dir, ld_cacertdir, ld_cert, ld_key ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: FATAL: could not extract from the NSS DB.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( 0 == tlsmc_write_file( readme_path, data, S_IRUSR ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: ERROR: could not create README file.\n", -+ 0, 0, 0 ); -+ } -+ -+pem_dir_exists: -+ if (*ld_cacertdir) free(*ld_cacertdir); -+ *ld_cacertdir = PR_smprintf( "%s/" TLSMC_CACERTS_DIR_NAME, pem_dir ); -+ if ( ! ( ( 0 == stat( *ld_cacertdir, &stat_buf ) ) -+ && S_ISDIR(stat_buf.st_mode) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: extracted cacerts dir is not present.\n", -+ 0, 0, 0 ); -+ if ( *ld_cacertdir ) PR_smprintf_free( *ld_cacertdir ); -+ *ld_cacertdir = NULL; -+ } -+ -+ if (*ld_cert) free(*ld_cert); -+ *ld_cert = PR_smprintf( "%s/" TLSMC_CERT_FILE_NAME, pem_dir ); -+ if ( ! ( ( 0 == stat( *ld_cert, &stat_buf ) ) -+ && ( S_ISREG(stat_buf.st_mode) -+ || S_ISLNK(stat_buf.st_mode) ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: extracted cert file is not present.\n", -+ 0, 0, 0 ); -+ if ( *ld_cert ) PR_smprintf_free( *ld_cert ); -+ *ld_cert = NULL; -+ } -+ -+ if (*ld_key) free(*ld_key); -+ *ld_key = PR_smprintf( "%s/" TLSMC_KEY_FILE_NAME, pem_dir ); -+ if ( ! ( ( 0 == stat( *ld_key, &stat_buf ) ) -+ && ( S_ISREG(stat_buf.st_mode) -+ || S_ISLNK(stat_buf.st_mode) ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_convert: WARN: extracted key file is not present.\n", -+ 0, 0, 0 ); -+ if ( *ld_key ) PR_smprintf_free( *ld_key ); -+ *ld_key = NULL; -+ } -+ -+ rv = 1; -+ -+bail: -+ if ( checksum ) free( checksum ); -+ if ( pem_dir ) PR_smprintf_free( pem_dir ); -+ if ( readme_path ) PR_smprintf_free( readme_path ); -+ if ( data ) free( data ); -+ if ( nssdb_prefix ) free( nssdb_prefix ); -+ if ( nssdb_dir_path ) free( nssdb_dir_path ); -+ if ( nss_ctx ) tlsmc_close_nssdb( &nss_ctx ); -+ -+#ifdef LDAP_R_COMPILE -+ ldap_pvt_thread_mutex_unlock( &tlsmc_mutex ); -+#endif -+ -+ return rv; -+} -+ -+ -+// returns 0 when successful -+int -+tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ) -+{ -+ int rv = 0; -+ char *ld_cacertdir = NULL; -+ char *ld_cert = NULL; -+ char *ld_key = NULL; -+ -+ ld_cacertdir = lo->ldo_tls_cacertdir ? LDAP_STRDUP( (char *) lo->ldo_tls_cacertdir ) : NULL; -+ ld_cert = lo->ldo_tls_certfile ? LDAP_STRDUP( (char *) lo->ldo_tls_certfile ) : NULL; -+ ld_key = lo->ldo_tls_keyfile ? LDAP_STRDUP( (char *) lo->ldo_tls_keyfile ) : NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_intercept_initialization: INFO: entry options follow:\n" -+ "tlsmc_intercept_initialization: INFO: cacertdir = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: certfile = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: keyfile = `%s'\n", -+ lo->ldo_tls_cacertdir, lo->ldo_tls_certfile, lo->ldo_tls_keyfile ); -+ -+ if ( 0 == tlsmc_convert( &ld_cacertdir, &ld_cert, &ld_key ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_intercept_initialization: FATAL: could not intercept TLS initialization. TLS will not work!\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir ); -+ lo->ldo_tls_cacertdir = ld_cacertdir ? LDAP_STRDUP( (char *) ld_cacertdir ) : NULL; -+ -+ if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile ); -+ lo->ldo_tls_certfile = ld_cert ? LDAP_STRDUP( (char *) ld_cert ) : NULL; -+ -+ if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile ); -+ lo->ldo_tls_keyfile = ld_key ? LDAP_STRDUP( (char *) ld_key ) : NULL; -+ -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_intercept_initialization: INFO: altered options follow:\n" -+ "tlsmc_intercept_initialization: INFO: cacertdir = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: certfile = `%s'\n" -+ "tlsmc_intercept_initialization: INFO: keyfile = `%s'\n", -+ lo->ldo_tls_cacertdir, lo->ldo_tls_certfile, lo->ldo_tls_keyfile ); -+ -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only.\n", -+ 0, 0, 0 ); -+ rv = 1; -+bail: -+ if ( ld_cacertdir ) LDAP_FREE( ld_cacertdir ); -+ if ( ld_cert ) LDAP_FREE( ld_cert ); -+ if ( ld_key ) LDAP_FREE( ld_key ); -+ return rv; -+} -+ -+ -+#endif /* HAVE_MOZNSS_COMPATIBILITY */ -+/* -+ emacs settings -+ Local Variables: -+ indent-tabs-mode: t -+ tab-width: 4 -+ End: -+*/ -diff --git a/libraries/libldap/tls_mc.h b/libraries/libldap/tls_mc.h -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc.h -@@ -0,0 +1,18 @@ -+#ifndef _LDAP_TLSMC_H -+#define _LDAP_TLSMC_H -+ -+#include "portable.h" -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+#include "ldap-int.h" -+ -+int -+tlsmc_convert( char **ld_cacertdir, char **ld_cert, char **ld_key ); -+ -+int -+tlsmc_intercept_initialization( struct ldapoptions *lo, int is_server ); -+ -+ -+#endif /* HAVE_MOZNSS_COMPATIBILITY */ -+#endif /* _LDAP_TLSMC_H */ -diff --git a/libraries/libldap/tls_mc_ossl.c b/libraries/libldap/tls_mc_ossl.c -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc_ossl.c -@@ -0,0 +1,95 @@ -+#include "portable.h" -+ -+/* This file contains functions that require OpenSSL headers due to some -+ conflicts with what MozNSS defines. -+*/ -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+#include -+#include -+#include "ldap-int.h" -+#include -+#include -+#include -+ -+ -+int -+tlsmc_cert_create_hash_symlink( char *cert_path, char *cacerts_dir ) -+{ -+ int rv = 0; -+ X509 *cert = NULL; -+ FILE *fp = NULL; -+ unsigned long hash = 0; -+ char *cert_filename_p = NULL; -+ char *last_slash_p = NULL; -+ char *symlink_path = NULL; -+ int cnt = 0; -+ -+ if ( NULL == ( fp = fopen( cert_path, "r" ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not open the cert file.\n", -+ 0, 0, 0 ); -+ perror( "tlsmc_cert_create_hash_symlink: ERROR: OS error" ); -+ goto bail; -+ } -+ if ( NULL == PEM_read_X509( fp, &cert, NULL, NULL ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not read PEM data.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ if ( 0 == ( hash = X509_subject_name_hash( cert ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not hash subject.\n", -+ 0, 0, 0 ); -+ goto bail; -+ } -+ -+ last_slash_p = strrchr( cert_path, '/' ); -+ cert_filename_p = last_slash_p ? last_slash_p + 1 : cert_path; -+ for ( cnt = 0; cnt < 10; cnt++ ) { -+ if ( NULL == ( symlink_path = PR_smprintf( "%s/%08lx.%d", cacerts_dir, hash, cnt ) ) ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: memory allocation error.\n", -+ 0, 0, 0 ); -+ continue; -+ } -+ if ( 0 != symlink( cert_filename_p, symlink_path ) ) { -+ if ( errno == EEXIST ) { -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: INFO: symlink `%s' already exists.\n", -+ symlink_path, 0, 0 ); -+ if ( symlink_path ) PR_smprintf( symlink_path ); -+ continue; -+ } -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: ERROR: could not create symlink.\n", -+ 0, 0, 0 ); -+ perror( "tlsmc_cert_create_hash_symlink: ERROR: OS error" ); -+ goto bail; -+ } -+ Debug( LDAP_DEBUG_TRACE, -+ "tlsmc_cert_create_hash_symlink: INFO: the cert is now symlinked to %s.\n", -+ symlink_path, 0, 0 ); -+ rv = 1; -+ goto bail; -+ } -+ Debug( LDAP_DEBUG_ANY, -+ "tlsmc_cert_create_hash_symlink: INFO: could not create symlink (all possible file names taken).\n", -+ 0, 0, 0 ); -+bail: -+ if ( symlink_path ) PR_smprintf_free( symlink_path ); -+ if ( cert ) X509_free( cert ); -+ if ( fp ) fclose( fp ); -+ return rv; -+} -+ -+#endif /* HAVE_MOZNSS_COMPATIBILITY */ -+/* -+ emacs settings -+ Local Variables: -+ indent-tabs-mode: t -+ tab-width: 4 -+ End: -+*/ -diff --git a/libraries/libldap/tls_mc_ossl.h b/libraries/libldap/tls_mc_ossl.h -new file mode 100644 ---- /dev/null -+++ b/libraries/libldap/tls_mc_ossl.h -@@ -0,0 +1,12 @@ -+#ifndef _LDAP_TLSMC_OSSL_H -+#define _LDAP_TLSMC_OSSL_H -+ -+#include "portable.h" -+ -+#ifdef HAVE_MOZNSS_COMPATIBILITY -+ -+int -+tlsmc_cert_create_hash_symlink( char *cert_path, char *cacerts_dir ); -+ -+#endif -+#endif -diff --git a/libraries/libldap_r/Makefile.in b/libraries/libldap_r/Makefile.in ---- a/libraries/libldap_r/Makefile.in -+++ b/libraries/libldap_r/Makefile.in -@@ -28,7 +28,7 @@ XXSRCS = apitest.c test.c \ - request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \ - init.c options.c print.c string.c util-int.c schema.c \ - charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ -- tls2.c tls_o.c tls_g.c tls_m.c \ -+ tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \ - turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ - assertion.c deref.c ldif.c fetch.c - SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \ -@@ -46,7 +46,7 @@ OBJS = threads.lo rdwr.lo rmutex.lo tpool.lo rq.lo \ - request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \ - init.lo options.lo print.lo string.lo util-int.lo schema.lo \ - charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ -- tls2.lo tls_o.lo tls_g.lo tls_m.lo \ -+ tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \ - turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ - assertion.lo deref.lo ldif.lo fetch.lo - diff --git a/openldap.spec b/openldap.spec index 0306a46..3408666 100644 --- a/openldap.spec +++ b/openldap.spec @@ -1,10 +1,3 @@ -# TLSMC is MozNSS compatibility layer and should be disabled in F29+ -%if 0%{?fedora} && 0%{?fedora} <= 28 -%bcond_without tlsmc -%else -%bcond_with tlsmc -%endif - %global _hardened_build 1 %global systemctl_bin /usr/bin/systemctl @@ -12,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -46,14 +39,6 @@ Patch20: openldap-ldapi-sasl.patch Patch90: check-password-makefile.patch Patch91: check-password.patch -# MozNSS compatibility layer -Patch100: openldap-tlsmc.patch - -%if %{with tlsmc} -BuildRequires: nss-devel -Recommends: nss-tools -%endif - BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) @@ -191,8 +176,6 @@ pushd openldap-%{version} \ --disable-static \ \ - --enable-moznss-compatibility=%{?with_tlsmc:yes}%{!?with_tlsmc:no} \ - \ --with-cyrus-sasl \ --without-fetch \ --with-threads \ @@ -504,6 +487,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Jul 4 2018 Matus Honek - 2.4.46-4 +- Remove unused leftover MozNSS Compat. Layer references (#1557967) + * Wed Jul 4 2018 Matus Honek - 2.4.46-3 - MozNSS Compat. Layer: Make log messages more clear (#1598103) - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203) From 15e6edc51510b39352f4c193dbb78cb83b4c3dc3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Fri, 6 Jul 2018 09:36:41 +0200 Subject: [PATCH 034/118] Perl 5.28 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 3408666..f12afac 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -487,6 +487,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Fri Jul 06 2018 Petr Pisar - 2.4.46-5 +- Perl 5.28 rebuild + * Wed Jul 4 2018 Matus Honek - 2.4.46-4 - Remove unused leftover MozNSS Compat. Layer references (#1557967) From 8b7d2a395d0ceb1fc4a62dd1f7de5d0b4b94b5d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Fri, 6 Jul 2018 19:16:02 +0200 Subject: [PATCH 035/118] Remove unused leftover MozNSS Compat. Layer references (cont.) A bit more for the before previous commmit 5411c84. Related: #1557967 --- openldap.spec | 8 -------- 1 file changed, 8 deletions(-) diff --git a/openldap.spec b/openldap.spec index f12afac..e3964ae 100644 --- a/openldap.spec +++ b/openldap.spec @@ -101,14 +101,6 @@ programs needed for accessing and modifying OpenLDAP directories. pushd openldap-%{version} -%if %{with tlsmc} -# alternative include paths for Mozilla NSS -ln -s %{_includedir}/nss3 include/nss -ln -s %{_includedir}/nspr4 include/nspr - -%patch100 -p1 -%endif - AUTOMAKE=%{_bindir}/true autoreconf -fi %patch0 -p1 From db6986970e88c0f4cf54e712b14bb65a825ed50c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Thu, 21 Jun 2018 20:10:41 +0200 Subject: [PATCH 036/118] Build with LDAP_USE_NON_BLOCKING_TLS The default bahviour should not change as the default timeout is infinity. Resolves: #1594928 --- openldap.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/openldap.spec b/openldap.spec index e3964ae..e4bdd82 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -138,7 +138,7 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS -DLDAP_USE_NON_BLOCKING_TLS" pushd openldap-%{version} %configure \ @@ -479,6 +479,10 @@ exit 0 %{_mandir}/man3/* %changelog +* Fri Jul 6 2018 Matus Honek - 2.4.46-6 +- Build with LDAP_USE_NON_BLOCKING_TLS (#1594928) +- Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967) + * Fri Jul 06 2018 Petr Pisar - 2.4.46-5 - Perl 5.28 rebuild From 7b3fb1195af0b873499b04c855659e54d6dcb899 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 13 Jul 2018 15:07:42 +0000 Subject: [PATCH 037/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index e4bdd82..96f70e5 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 6%{?dist} +Release: 7%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -479,6 +479,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.46-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Fri Jul 6 2018 Matus Honek - 2.4.46-6 - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928) - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967) From 53b870b7dbc10d0b1955a217be656b221cfa01b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Tue, 14 Aug 2018 16:11:47 +0200 Subject: [PATCH 038/118] Fix: Cannot use SSL3 anymore Resolves: #1592431 --- openldap-openssl-allow-ssl3.patch | 24 ++++++++++++++++++++++++ openldap.spec | 7 ++++++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 openldap-openssl-allow-ssl3.patch diff --git a/openldap-openssl-allow-ssl3.patch b/openldap-openssl-allow-ssl3.patch new file mode 100644 index 0000000..2a8e56d --- /dev/null +++ b/openldap-openssl-allow-ssl3.patch @@ -0,0 +1,24 @@ +Ensure SSLv3 is enabled when necessary + +Either at compilation time, or as a system-wide configuration, OpenSSL +may have disabled SSLv3 protocol by default. This change ensures the +protocol NO flag is cleared when necessary, hence allowing for the +protocol to be used. + +Author: Matus Honek + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -297,8 +297,10 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) + #endif + if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL3 ) + SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 ); +- else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) ++ else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) { + SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 ); ++ SSL_CTX_clear_options( ctx, SSL_OP_NO_SSLv3 ); ++ } + + if ( lo->ldo_tls_ciphersuite && + !SSL_CTX_set_cipher_list( ctx, lt->lt_ciphersuite ) ) diff --git a/openldap.spec b/openldap.spec index 96f70e5..86ac611 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 7%{?dist} +Release: 8%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -34,6 +34,7 @@ Patch17: openldap-allop-overlay.patch Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # ldapi sasl fix pending upstream inclusion Patch20: openldap-ldapi-sasl.patch +Patch21: openldap-openssl-allow-ssl3.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -110,6 +111,7 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch17 -p1 %patch19 -p1 %patch20 -p1 +%patch21 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -479,6 +481,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Tue Aug 14 2018 Matus Honek - 2.4.46-8 +- Fix: Cannot use SSL3 anymore (#1592431) + * Fri Jul 13 2018 Fedora Release Engineering - 2.4.46-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From b325dd4ca43c87bc2562e7ec5c4d1cbf72337cc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Tue, 21 Aug 2018 20:16:20 +0200 Subject: [PATCH 039/118] Backport upstream fixes for ITS 7595 - add OpenSSL EC support Resolves: #1623495 --- ...dap-openssl-ITS7595-Add-EC-support-1.patch | 227 ++++++++++++++++++ ...dap-openssl-ITS7595-Add-EC-support-2.patch | 34 +++ openldap.spec | 9 +- 3 files changed, 269 insertions(+), 1 deletion(-) create mode 100644 openldap-openssl-ITS7595-Add-EC-support-1.patch create mode 100644 openldap-openssl-ITS7595-Add-EC-support-2.patch diff --git a/openldap-openssl-ITS7595-Add-EC-support-1.patch b/openldap-openssl-ITS7595-Add-EC-support-1.patch new file mode 100644 index 0000000..61e1df5 --- /dev/null +++ b/openldap-openssl-ITS7595-Add-EC-support-1.patch @@ -0,0 +1,227 @@ +ITS#7595 Add Elliptic Curve support for OpenSSL + +Cherry-picked upstream e631ce808ed56119e61321463d06db7999ba5a08 +Author: Howard Chu +Date: Sat Sep 7 09:47:19 2013 -0700 + +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index 9c72e8296..2311c3096 100644 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -922,6 +922,13 @@ are not used. + When using Mozilla NSS these parameters are always generated randomly + so this directive is ignored. + .TP ++.B olcTLSECName: ++Specify the name of a curve to use for Elliptic curve Diffie-Hellman ++ephemeral key exchange. This is required to enable ECDHE algorithms in ++OpenSSL. This option is not used with GnuTLS; the curves may be ++chosen in the GnuTLS ciphersuite specification. This option is also ++ignored for Mozilla NSS. ++.TP + .B olcTLSProtocolMin: [.] + Specifies minimum SSL/TLS protocol version that will be negotiated. + If the server doesn't support at least that version, +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index f504adcf9..ef03e0ad8 100644 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -1153,6 +1153,13 @@ are not used. + When using Mozilla NSS these parameters are always generated randomly + so this directive is ignored. + .TP ++.B TLSECName ++Specify the name of a curve to use for Elliptic curve Diffie-Hellman ++ephemeral key exchange. This is required to enable ECDHE algorithms in ++OpenSSL. This option is not used with GnuTLS; the curves may be ++chosen in the GnuTLS ciphersuite specification. This option is also ++ignored for Mozilla NSS. ++.TP + .B TLSProtocolMin [.] + Specifies minimum SSL/TLS protocol version that will be negotiated. + If the server doesn't support at least that version, +diff --git a/include/ldap.h b/include/ldap.h +index c245651c2..0964a193e 100644 +--- a/include/ldap.h ++++ b/include/ldap.h +@@ -158,6 +158,7 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_TLS_NEWCTX 0x600f + #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ + #define LDAP_OPT_X_TLS_PACKAGE 0x6011 ++#define LDAP_OPT_X_TLS_ECNAME 0x6012 + + #define LDAP_OPT_X_TLS_NEVER 0 + #define LDAP_OPT_X_TLS_HARD 1 +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 66e04ae80..db7193f4f 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -165,6 +165,7 @@ struct ldaptls { + char *lt_ciphersuite; + char *lt_crlfile; + char *lt_randfile; /* OpenSSL only */ ++ char *lt_ecname; /* OpenSSL only */ + int lt_protocol_min; + }; + #endif +@@ -250,6 +251,7 @@ struct ldapoptions { + #define ldo_tls_certfile ldo_tls_info.lt_certfile + #define ldo_tls_keyfile ldo_tls_info.lt_keyfile + #define ldo_tls_dhfile ldo_tls_info.lt_dhfile ++#define ldo_tls_ecname ldo_tls_info.lt_ecname + #define ldo_tls_cacertfile ldo_tls_info.lt_cacertfile + #define ldo_tls_cacertdir ldo_tls_info.lt_cacertdir + #define ldo_tls_ciphersuite ldo_tls_info.lt_ciphersuite +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index d25c190ea..0451b01af 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -118,6 +118,10 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) + LDAP_FREE( lo->ldo_tls_dhfile ); + lo->ldo_tls_dhfile = NULL; + } ++ if ( lo->ldo_tls_ecname ) { ++ LDAP_FREE( lo->ldo_tls_ecname ); ++ lo->ldo_tls_ecname = NULL; ++ } + if ( lo->ldo_tls_cacertfile ) { + LDAP_FREE( lo->ldo_tls_cacertfile ); + lo->ldo_tls_cacertfile = NULL; +@@ -232,6 +236,10 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) + lts.lt_dhfile = LDAP_STRDUP( lts.lt_dhfile ); + __atoe( lts.lt_dhfile ); + } ++ if ( lts.lt_ecname ) { ++ lts.lt_ecname = LDAP_STRDUP( lts.lt_ecname ); ++ __atoe( lts.lt_ecname ); ++ } + #endif + lo->ldo_tls_ctx = ti->ti_ctx_new( lo ); + if ( lo->ldo_tls_ctx == NULL ) { +@@ -257,6 +265,7 @@ error_exit: + LDAP_FREE( lts.lt_crlfile ); + LDAP_FREE( lts.lt_cacertdir ); + LDAP_FREE( lts.lt_dhfile ); ++ LDAP_FREE( lts.lt_ecname ); + #endif + return rc; + } +@@ -646,6 +655,10 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) + *(char **)arg = lo->ldo_tls_dhfile ? + LDAP_STRDUP( lo->ldo_tls_dhfile ) : NULL; + break; ++ case LDAP_OPT_X_TLS_ECNAME: ++ *(char **)arg = lo->ldo_tls_ecname ? ++ LDAP_STRDUP( lo->ldo_tls_ecname ) : NULL; ++ break; + case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ + *(char **)arg = lo->ldo_tls_crlfile ? + LDAP_STRDUP( lo->ldo_tls_crlfile ) : NULL; +@@ -765,6 +778,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) + if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile ); + lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; ++ case LDAP_OPT_X_TLS_ECNAME: ++ if ( lo->ldo_tls_ecname ) LDAP_FREE( lo->ldo_tls_ecname ); ++ lo->ldo_tls_ecname = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ return 0; + case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ + if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile ); + lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index f24060b7e..1370923af 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -373,10 +373,9 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) + return -1; + } + +- if ( lo->ldo_tls_dhfile ) { +- DH *dh = NULL; ++ if ( is_server && lo->ldo_tls_dhfile ) { ++ DH *dh; + BIO *bio; +- SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); + + if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) { + Debug( LDAP_DEBUG_ANY, +@@ -395,7 +394,35 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) + } + BIO_free( bio ); + SSL_CTX_set_tmp_dh( ctx, dh ); ++ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); ++ DH_free( dh ); ++ } ++ ++#ifdef SSL_OP_SINGLE_ECDH_USE ++ if ( is_server && lo->ldo_tls_ecname ) { ++ EC_KEY *ecdh; ++ ++ int nid = OBJ_sn2nid( lt->lt_ecname ); ++ if ( nid == NID_undef ) { ++ Debug( LDAP_DEBUG_ANY, ++ "TLS: could not use EC name `%s'.\n", ++ lo->ldo_tls_ecname,0,0); ++ tlso_report_error(); ++ return -1; ++ } ++ ecdh = EC_KEY_new_by_curve_name( nid ); ++ if ( ecdh == NULL ) { ++ Debug( LDAP_DEBUG_ANY, ++ "TLS: could not generate key for EC name `%s'.\n", ++ lo->ldo_tls_ecname,0,0); ++ tlso_report_error(); ++ return -1; ++ } ++ SSL_CTX_set_tmp_ecdh( ctx, ecdh ); ++ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); ++ EC_KEY_free( ecdh ); + } ++#endif + + if ( tlso_opt_trace ) { + SSL_CTX_set_info_callback( ctx, tlso_info_cb ); +diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c +index 250f14100..8b1e4e582 100644 +--- a/servers/slapd/bconfig.c ++++ b/servers/slapd/bconfig.c +@@ -194,6 +194,7 @@ enum { + CFG_ACL_ADD, + CFG_SYNC_SUBENTRY, + CFG_LTHREADS, ++ CFG_TLS_ECNAME, + + CFG_LAST + }; +@@ -738,6 +739,14 @@ static ConfigTable config_back_cf_table[] = { + #endif + "( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' " + "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ++ { "TLSECName", NULL, 2, 2, 0, ++#ifdef HAVE_TLS ++ CFG_TLS_ECNAME|ARG_STRING|ARG_MAGIC, &config_tls_option, ++#else ++ ARG_IGNORED, NULL, ++#endif ++ "( OLcfgGlAt:96 NAME 'olcTLSECName' " ++ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, + { "TLSProtocolMin", NULL, 2, 2, 0, + #ifdef HAVE_TLS + CFG_TLS_PROTOCOL_MIN|ARG_STRING|ARG_MAGIC, &config_tls_config, +@@ -819,7 +828,7 @@ static ConfigOCs cf_ocs[] = { + "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ " + "olcTLSCACertificatePath $ olcTLSCertificateFile $ " + "olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ " +- "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ " ++ "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSECName $ " + "olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ " + "olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ " + "olcDitContentRules $ olcLdapSyntaxes ) )", Cft_Global }, +@@ -3824,6 +3833,7 @@ config_tls_option(ConfigArgs *c) { + case CFG_TLS_CA_PATH: flag = LDAP_OPT_X_TLS_CACERTDIR; break; + case CFG_TLS_CA_FILE: flag = LDAP_OPT_X_TLS_CACERTFILE; break; + case CFG_TLS_DH_FILE: flag = LDAP_OPT_X_TLS_DHFILE; break; ++ case CFG_TLS_ECNAME: flag = LDAP_OPT_X_TLS_ECNAME; break; + #ifdef HAVE_GNUTLS + case CFG_TLS_CRL_FILE: flag = LDAP_OPT_X_TLS_CRLFILE; break; + #endif diff --git a/openldap-openssl-ITS7595-Add-EC-support-2.patch b/openldap-openssl-ITS7595-Add-EC-support-2.patch new file mode 100644 index 0000000..6c28f3f --- /dev/null +++ b/openldap-openssl-ITS7595-Add-EC-support-2.patch @@ -0,0 +1,34 @@ +ITS#7595 don't try to use EC if OpenSSL lacks it + +Cherry-picked upstream 721e46fe6695077d63a3df6ea2e397920a72308d +Author: Howard Chu +Date: Sun Sep 8 06:32:23 2013 -0700 + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 1a81bc625..71c2b055c 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -321,8 +321,12 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) + DH_free( dh ); + } + +-#ifdef SSL_OP_SINGLE_ECDH_USE + if ( is_server && lo->ldo_tls_ecname ) { ++#ifdef OPENSSL_NO_EC ++ Debug( LDAP_DEBUG_ANY, ++ "TLS: Elliptic Curves not supported.\n", 0,0,0 ); ++ return -1; ++#else + EC_KEY *ecdh; + + int nid = OBJ_sn2nid( lt->lt_ecname ); +@@ -344,8 +348,8 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) + SSL_CTX_set_tmp_ecdh( ctx, ecdh ); + SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); + EC_KEY_free( ecdh ); +- } + #endif ++ } + + if ( tlso_opt_trace ) { + SSL_CTX_set_info_callback( ctx, tlso_info_cb ); diff --git a/openldap.spec b/openldap.spec index 86ac611..e69fec9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 8%{?dist} +Release: 9%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -35,6 +35,8 @@ Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # ldapi sasl fix pending upstream inclusion Patch20: openldap-ldapi-sasl.patch Patch21: openldap-openssl-allow-ssl3.patch +Patch22: openldap-openssl-ITS7595-Add-EC-support-1.patch +Patch23: openldap-openssl-ITS7595-Add-EC-support-2.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -112,6 +114,8 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch19 -p1 %patch20 -p1 %patch21 -p1 +%patch22 -p1 +%patch23 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -481,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Mon Oct 08 2018 Matus Honek - 2.4.46-9 +- Backport upstream fixes for ITS 7595 - add OpenSSL EC support (#1623495) + * Tue Aug 14 2018 Matus Honek - 2.4.46-8 - Fix: Cannot use SSL3 anymore (#1592431) From 939ce64f7f313df3db35e1fda38e8c143e208c9a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Tue, 16 Oct 2018 11:02:38 +0200 Subject: [PATCH 040/118] Revert "Fix: Cannot use SSL3 anymore" This reverts commit 53b870b7dbc10d0b1955a217be656b221cfa01b5. Turns out the OpenSSL setting SSL_OP_NO_SSLv3 by default means we really should not use the SSLv3 anymore, so removing the patch that tried hard. --- openldap-openssl-allow-ssl3.patch | 24 ------------------------ openldap.spec | 7 ++++--- 2 files changed, 4 insertions(+), 27 deletions(-) delete mode 100644 openldap-openssl-allow-ssl3.patch diff --git a/openldap-openssl-allow-ssl3.patch b/openldap-openssl-allow-ssl3.patch deleted file mode 100644 index 2a8e56d..0000000 --- a/openldap-openssl-allow-ssl3.patch +++ /dev/null @@ -1,24 +0,0 @@ -Ensure SSLv3 is enabled when necessary - -Either at compilation time, or as a system-wide configuration, OpenSSL -may have disabled SSLv3 protocol by default. This change ensures the -protocol NO flag is cleared when necessary, hence allowing for the -protocol to be used. - -Author: Matus Honek - -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -297,8 +297,10 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - #endif - if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL3 ) - SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 ); -- else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) -+ else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) { - SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 ); -+ SSL_CTX_clear_options( ctx, SSL_OP_NO_SSLv3 ); -+ } - - if ( lo->ldo_tls_ciphersuite && - !SSL_CTX_set_cipher_list( ctx, lt->lt_ciphersuite ) ) diff --git a/openldap.spec b/openldap.spec index e69fec9..349cb71 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 9%{?dist} +Release: 10%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -34,7 +34,6 @@ Patch17: openldap-allop-overlay.patch Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # ldapi sasl fix pending upstream inclusion Patch20: openldap-ldapi-sasl.patch -Patch21: openldap-openssl-allow-ssl3.patch Patch22: openldap-openssl-ITS7595-Add-EC-support-1.patch Patch23: openldap-openssl-ITS7595-Add-EC-support-2.patch @@ -113,7 +112,6 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch17 -p1 %patch19 -p1 %patch20 -p1 -%patch21 -p1 %patch22 -p1 %patch23 -p1 @@ -485,6 +483,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Tue Oct 16 2018 Matus Honek - 2.4.46-10 +- Revert "Fix: Cannot use SSL3 anymore" + * Mon Oct 08 2018 Matus Honek - 2.4.46-9 - Backport upstream fixes for ITS 7595 - add OpenSSL EC support (#1623495) From 3b59a4668dc01d8c6d97b16ab51dd42a97553c83 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Mon, 17 Dec 2018 16:46:54 +0100 Subject: [PATCH 041/118] Reference default system-wide CA certificates in manpages Resolves: #1611591 --- openldap-openssl-manpage-defaultCA.patch | 48 ++++++++++++++++++++++++ openldap.spec | 5 +++ 2 files changed, 53 insertions(+) create mode 100644 openldap-openssl-manpage-defaultCA.patch diff --git a/openldap-openssl-manpage-defaultCA.patch b/openldap-openssl-manpage-defaultCA.patch new file mode 100644 index 0000000..7ec2caa --- /dev/null +++ b/openldap-openssl-manpage-defaultCA.patch @@ -0,0 +1,48 @@ +Reference default system-wide CA certificates in manpages + +OpenSSL, unless explicitly configured, uses system-wide default set of CA +certificates. + +Author: Matus Honek + +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -307,6 +307,9 @@ are more options you can specify. These options are used when an + .B ldaps:// URI + is selected (by default or otherwise) or when the application + negotiates TLS by issuing the LDAP StartTLS operation. ++.LP ++When using OpenSSL, if neither \fBTLS_CACERT\fP nor \fBTLS_CACERTDIR\fP ++is set, the system-wide default set of CA certificates is used. + .TP + .B TLS_CACERT + Specifies the file that contains certificates for all of the Certificate +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -801,6 +801,10 @@ If + .B slapd + is built with support for Transport Layer Security, there are more options + you can specify. ++.LP ++When using OpenSSL, if neither \fBolcTLSCACertificateFile\fP nor ++\fBolcTLSCACertificatePath\fP is set, the system-wide default set of CA ++certificates is used. + .TP + .B olcTLSCipherSuite: + Permits configuring what ciphers will be accepted and the preference order. +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -1032,6 +1032,10 @@ If + .B slapd + is built with support for Transport Layer Security, there are more options + you can specify. ++.LP ++When using OpenSSL, if neither \fBTLSCACertificateFile\fP nor ++\fBTLSCACertificatePath\fP is set, the system-wide default set of CA ++certificates is used. + .TP + .B TLSCipherSuite + Permits configuring what ciphers will be accepted and the preference order. diff --git a/openldap.spec b/openldap.spec index 349cb71..62f0c07 100644 --- a/openldap.spec +++ b/openldap.spec @@ -36,6 +36,7 @@ Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch Patch20: openldap-ldapi-sasl.patch Patch22: openldap-openssl-ITS7595-Add-EC-support-1.patch Patch23: openldap-openssl-ITS7595-Add-EC-support-2.patch +Patch24: openldap-openssl-manpage-defaultCA.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -114,6 +115,7 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch20 -p1 %patch22 -p1 %patch23 -p1 +%patch24 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -483,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Mon Dec 17 2018 Matus Honek - 2.4.46-10 +- Reference default system-wide CA certificates in manpages (#1611591) + * Tue Oct 16 2018 Matus Honek - 2.4.46-10 - Revert "Fix: Cannot use SSL3 anymore" From 8bd8644add18a25e0f761cf0eb0d23082d9d4dee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Mon, 17 Dec 2018 17:11:26 +0100 Subject: [PATCH 042/118] Bump release version (to 2.4.46-11) Fixes previous commit. --- openldap.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openldap.spec b/openldap.spec index 62f0c07..d694d7a 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 10%{?dist} +Release: 11%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,7 +485,7 @@ exit 0 %{_mandir}/man3/* %changelog -* Mon Dec 17 2018 Matus Honek - 2.4.46-10 +* Mon Dec 17 2018 Matus Honek - 2.4.46-11 - Reference default system-wide CA certificates in manpages (#1611591) * Tue Oct 16 2018 Matus Honek - 2.4.46-10 From f6fb5e8a930930b0a3c2c04bdc4678eaa02acdcd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Mon, 14 Jan 2019 19:10:54 +0100 Subject: [PATCH 043/118] Rebuilt for libcrypt.so.2 (#1666033) --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index d694d7a..d523d5e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 11%{?dist} +Release: 12%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Mon Jan 14 2019 Björn Esser - 2.4.46-12 +- Rebuilt for libcrypt.so.2 (#1666033) + * Mon Dec 17 2018 Matus Honek - 2.4.46-11 - Reference default system-wide CA certificates in manpages (#1611591) From f5aae857a3e61a6391a10181a8dbf14f5cc57b10 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 1 Feb 2019 17:25:59 +0000 Subject: [PATCH 044/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index d523d5e..b8d76f4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.46 -Release: 12%{?dist} +Release: 13%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Fri Feb 01 2019 Fedora Release Engineering - 2.4.46-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Mon Jan 14 2019 Björn Esser - 2.4.46-12 - Rebuilt for libcrypt.so.2 (#1666033) From d91e3752b493c28137d6fb5e5d4113a45f8f6dd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= Date: Wed, 13 Feb 2019 17:54:00 +0100 Subject: [PATCH 045/118] Rebase to upstream version 2.4.47 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a31ea14..73bde65 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ /openldap-2.4.44.tgz /openldap-2.4.45.tgz /openldap-2.4.46.tgz +/openldap-2.4.47.tgz diff --git a/openldap.spec b/openldap.spec index b8d76f4..f1014b5 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,8 +4,8 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.46 -Release: 13%{?dist} +Version: 2.4.47 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Feb 13 2019 Matus Honek - 2.4.47-1 +- Rebase to upstream version 2.4.47 + * Fri Feb 01 2019 Fedora Release Engineering - 2.4.46-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/sources b/sources index c9ef3a9..7ad4ad1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.46.tgz) = eef39d43f04aa09c657a1422cefef060fe00368559ae40d0d97536c08ebeaaa1ab06207b3f121ba6afcde54abdc550027c3505e5217e5fd47ae6f8c001260186 +SHA512 (openldap-2.4.47.tgz) = d424079e34207e3d24383a2bea70a07ded40714982a6767174d2b2cb208cd94feab5ef12157accae915b8e404e5773a7547aaef65f06b44dc3cc09c6a64d5a11 From 1fb1d20a05d9e0ea377ee508af884801761ed72d Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Thu, 30 May 2019 13:22:08 +0200 Subject: [PATCH 046/118] Perl 5.30 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index f1014b5..19ecfba 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.47 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu May 30 2019 Jitka Plesnikova - 2.4.47-2 +- Perl 5.30 rebuild + * Wed Feb 13 2019 Matus Honek - 2.4.47-1 - Rebase to upstream version 2.4.47 From 3eaf4e4abf3727053824a33a3b090219fd2b5ce7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jul 2019 23:29:39 +0000 Subject: [PATCH 047/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 19ecfba..b61a926 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.47 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu Jul 25 2019 Fedora Release Engineering - 2.4.47-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Thu May 30 2019 Jitka Plesnikova - 2.4.47-2 - Perl 5.30 rebuild From a01eca4e7f8cc57c1857168c2a4ae17b10b04ce0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 20:19:26 +0000 Subject: [PATCH 048/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index b61a926..e1ea3c5 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.47 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -485,6 +485,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 2.4.47-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Thu Jul 25 2019 Fedora Release Engineering - 2.4.47-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 54bacfed357a5fd461156bd7a310583b6128509d Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 16 Jun 2020 03:41:24 +0000 Subject: [PATCH 049/118] Spec file cleanups Add BuildRequres: gcc [1] make_build [2] and make_install [3] [1] https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_buildrequires_and_requires [2] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make [3] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_why_the_makeinstall_macro_should_not_be_used --- openldap.spec | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/openldap.spec b/openldap.spec index e1ea3c5..7f799ff 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.47 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -44,6 +44,7 @@ Patch91: check-password.patch BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) +BuildRequires: gcc %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -182,11 +183,11 @@ pushd openldap-%{version} \ --libexecdir=%{_libdir} -make %{_smp_mflags} +%make_build popd pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} -make LDAP_INC="-I../openldap-%{version}/include \ +%make_build LDAP_INC="-I../openldap-%{version}/include \ -I../openldap-%{version}/servers/slapd \ -I../openldap-%{version}/build-servers/include" popd @@ -196,7 +197,7 @@ popd mkdir -p %{buildroot}%{_libdir}/ pushd openldap-%{version} -make install DESTDIR=%{buildroot} STRIP="" +%make_install STRIP="" popd # install check_password module @@ -485,6 +486,14 @@ exit 0 %{_mandir}/man3/* %changelog +* Tue Jun 16 2020 Tom Stellard - 2.4.47-5 +- Spec file cleanups +- Add BuildRequres: gcc [1] +- make_build [2] and make_install [3] +- [1] https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_buildrequires_and_requires +- [2] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make +- [3] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_why_the_makeinstall_macro_should_not_be_used + * Wed Jan 29 2020 Fedora Release Engineering - 2.4.47-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 9d8fa89777a0755ecda2d9e9107797cbc8310438 Mon Sep 17 00:00:00 2001 From: Matus Honek Date: Fri, 5 Jun 2020 11:57:25 +0200 Subject: [PATCH 050/118] Rebase to version 2.4.50 Resolves: #1742285 --- .gitignore | 1 + ...ix-Debug-usage-to-follow-RE24-format.patch | 36 +++ openldap-ldapi-sasl.patch | 55 ----- ...dap-openssl-ITS7595-Add-EC-support-1.patch | 227 ------------------ ...dap-openssl-ITS7595-Add-EC-support-2.patch | 34 --- openldap.spec | 16 +- sources | 2 +- 7 files changed, 45 insertions(+), 326 deletions(-) create mode 100644 openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch delete mode 100644 openldap-ldapi-sasl.patch delete mode 100644 openldap-openssl-ITS7595-Add-EC-support-1.patch delete mode 100644 openldap-openssl-ITS7595-Add-EC-support-2.patch diff --git a/.gitignore b/.gitignore index 73bde65..128fbb8 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ /openldap-2.4.45.tgz /openldap-2.4.46.tgz /openldap-2.4.47.tgz +/openldap-2.4.50.tgz diff --git a/openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch b/openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch new file mode 100644 index 0000000..350626e --- /dev/null +++ b/openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch @@ -0,0 +1,36 @@ +From 85fc8974f5c32a9a052baafaa9499c8484e043c2 Mon Sep 17 00:00:00 2001 +From: Quanah Gibson-Mount +Date: Tue, 28 Apr 2020 20:49:53 +0000 +Subject: [PATCH] ITS#8650 - Fix Debug usage to follow RE24 format + +--- + libraries/libldap/tls2.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index c1f15cbc1..ebe5bf125 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -907,8 +907,8 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) + } else if ( sb->sb_trans_needs_write ) { + wr=1; + } +- Debug1( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ldap_int_tls_connect needs %s\n", +- wr ? "write": "read" ); ++ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ldap_int_tls_connect needs %s\n", ++ wr ? "write": "read", 0, 0 ); + + /* This is mostly copied from result.c:wait4msg(), should + * probably be moved into a separate function */ +@@ -946,7 +946,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) + start_time_tv.tv_sec = curr_time_tv.tv_sec; + start_time_tv.tv_usec = curr_time_tv.tv_usec; + tv = tv0; +- Debug3( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ld %p %ld s %ld us to go\n", ++ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ld %p %ld s %ld us to go\n", + (void *)ld, (long) tv.tv_sec, (long) tv.tv_usec ); + ret = ldap_int_poll( ld, sd, &tv, wr); + if ( ret < 0 ) { +-- +2.25.4 + diff --git a/openldap-ldapi-sasl.patch b/openldap-ldapi-sasl.patch deleted file mode 100644 index 058cc1c..0000000 --- a/openldap-ldapi-sasl.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Tue, 7 May 2013 17:02:57 +0200 -Subject: [PATCH] LDAPI SASL fix - -Resolves: #960222 ---- - libraries/libldap/cyrus.c | 19 ++++++++++++++++--- - 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-) - -diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c -index 28c241b..a9acf36 100644 ---- a/libraries/libldap/cyrus.c -+++ b/libraries/libldap/cyrus.c -@@ -394,6 +394,8 @@ ldap_int_sasl_bind( - struct berval ccred = BER_BVNULL; - int saslrc, rc; - unsigned credlen; -+ char my_hostname[HOST_NAME_MAX + 1]; -+ int free_saslhost = 0; - - Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n", - mechs ? mechs : "", 0, 0 ); -@@ -454,14 +456,25 @@ ldap_int_sasl_bind( - - /* If we don't need to canonicalize just use the host - * from the LDAP URI. -+ * Always use the result of gethostname() for LDAPI. - */ -- if ( nocanon ) -+ if (ld->ld_defconn->lconn_server->lud_scheme != NULL && -+ strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) { -+ rc = gethostname(my_hostname, HOST_NAME_MAX + 1); -+ if (rc == 0) { -+ saslhost = my_hostname; -+ } else { -+ saslhost = "localhost"; -+ } -+ } else if ( nocanon ) - saslhost = ld->ld_defconn->lconn_server->lud_host; -- else -+ else { - saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb, - "localhost" ); -+ free_saslhost = 1; -+ } - rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost ); -- if ( !nocanon ) -+ if ( free_saslhost ) - LDAP_FREE( saslhost ); - } - --- -1.7.11.7 - diff --git a/openldap-openssl-ITS7595-Add-EC-support-1.patch b/openldap-openssl-ITS7595-Add-EC-support-1.patch deleted file mode 100644 index 61e1df5..0000000 --- a/openldap-openssl-ITS7595-Add-EC-support-1.patch +++ /dev/null @@ -1,227 +0,0 @@ -ITS#7595 Add Elliptic Curve support for OpenSSL - -Cherry-picked upstream e631ce808ed56119e61321463d06db7999ba5a08 -Author: Howard Chu -Date: Sat Sep 7 09:47:19 2013 -0700 - -diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 -index 9c72e8296..2311c3096 100644 ---- a/doc/man/man5/slapd-config.5 -+++ b/doc/man/man5/slapd-config.5 -@@ -922,6 +922,13 @@ are not used. - When using Mozilla NSS these parameters are always generated randomly - so this directive is ignored. - .TP -+.B olcTLSECName: -+Specify the name of a curve to use for Elliptic curve Diffie-Hellman -+ephemeral key exchange. This is required to enable ECDHE algorithms in -+OpenSSL. This option is not used with GnuTLS; the curves may be -+chosen in the GnuTLS ciphersuite specification. This option is also -+ignored for Mozilla NSS. -+.TP - .B olcTLSProtocolMin: [.] - Specifies minimum SSL/TLS protocol version that will be negotiated. - If the server doesn't support at least that version, -diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 -index f504adcf9..ef03e0ad8 100644 ---- a/doc/man/man5/slapd.conf.5 -+++ b/doc/man/man5/slapd.conf.5 -@@ -1153,6 +1153,13 @@ are not used. - When using Mozilla NSS these parameters are always generated randomly - so this directive is ignored. - .TP -+.B TLSECName -+Specify the name of a curve to use for Elliptic curve Diffie-Hellman -+ephemeral key exchange. This is required to enable ECDHE algorithms in -+OpenSSL. This option is not used with GnuTLS; the curves may be -+chosen in the GnuTLS ciphersuite specification. This option is also -+ignored for Mozilla NSS. -+.TP - .B TLSProtocolMin [.] - Specifies minimum SSL/TLS protocol version that will be negotiated. - If the server doesn't support at least that version, -diff --git a/include/ldap.h b/include/ldap.h -index c245651c2..0964a193e 100644 ---- a/include/ldap.h -+++ b/include/ldap.h -@@ -158,6 +158,7 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_NEWCTX 0x600f - #define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ - #define LDAP_OPT_X_TLS_PACKAGE 0x6011 -+#define LDAP_OPT_X_TLS_ECNAME 0x6012 - - #define LDAP_OPT_X_TLS_NEVER 0 - #define LDAP_OPT_X_TLS_HARD 1 -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h -index 66e04ae80..db7193f4f 100644 ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -165,6 +165,7 @@ struct ldaptls { - char *lt_ciphersuite; - char *lt_crlfile; - char *lt_randfile; /* OpenSSL only */ -+ char *lt_ecname; /* OpenSSL only */ - int lt_protocol_min; - }; - #endif -@@ -250,6 +251,7 @@ struct ldapoptions { - #define ldo_tls_certfile ldo_tls_info.lt_certfile - #define ldo_tls_keyfile ldo_tls_info.lt_keyfile - #define ldo_tls_dhfile ldo_tls_info.lt_dhfile -+#define ldo_tls_ecname ldo_tls_info.lt_ecname - #define ldo_tls_cacertfile ldo_tls_info.lt_cacertfile - #define ldo_tls_cacertdir ldo_tls_info.lt_cacertdir - #define ldo_tls_ciphersuite ldo_tls_info.lt_ciphersuite -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index d25c190ea..0451b01af 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -118,6 +118,10 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) - LDAP_FREE( lo->ldo_tls_dhfile ); - lo->ldo_tls_dhfile = NULL; - } -+ if ( lo->ldo_tls_ecname ) { -+ LDAP_FREE( lo->ldo_tls_ecname ); -+ lo->ldo_tls_ecname = NULL; -+ } - if ( lo->ldo_tls_cacertfile ) { - LDAP_FREE( lo->ldo_tls_cacertfile ); - lo->ldo_tls_cacertfile = NULL; -@@ -232,6 +236,10 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) - lts.lt_dhfile = LDAP_STRDUP( lts.lt_dhfile ); - __atoe( lts.lt_dhfile ); - } -+ if ( lts.lt_ecname ) { -+ lts.lt_ecname = LDAP_STRDUP( lts.lt_ecname ); -+ __atoe( lts.lt_ecname ); -+ } - #endif - lo->ldo_tls_ctx = ti->ti_ctx_new( lo ); - if ( lo->ldo_tls_ctx == NULL ) { -@@ -257,6 +265,7 @@ error_exit: - LDAP_FREE( lts.lt_crlfile ); - LDAP_FREE( lts.lt_cacertdir ); - LDAP_FREE( lts.lt_dhfile ); -+ LDAP_FREE( lts.lt_ecname ); - #endif - return rc; - } -@@ -646,6 +655,10 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) - *(char **)arg = lo->ldo_tls_dhfile ? - LDAP_STRDUP( lo->ldo_tls_dhfile ) : NULL; - break; -+ case LDAP_OPT_X_TLS_ECNAME: -+ *(char **)arg = lo->ldo_tls_ecname ? -+ LDAP_STRDUP( lo->ldo_tls_ecname ) : NULL; -+ break; - case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ - *(char **)arg = lo->ldo_tls_crlfile ? - LDAP_STRDUP( lo->ldo_tls_crlfile ) : NULL; -@@ -765,6 +778,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) - if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile ); - lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; - return 0; -+ case LDAP_OPT_X_TLS_ECNAME: -+ if ( lo->ldo_tls_ecname ) LDAP_FREE( lo->ldo_tls_ecname ); -+ lo->ldo_tls_ecname = arg ? LDAP_STRDUP( (char *) arg ) : NULL; -+ return 0; - case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ - if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile ); - lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index f24060b7e..1370923af 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -373,10 +373,9 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - return -1; - } - -- if ( lo->ldo_tls_dhfile ) { -- DH *dh = NULL; -+ if ( is_server && lo->ldo_tls_dhfile ) { -+ DH *dh; - BIO *bio; -- SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); - - if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) { - Debug( LDAP_DEBUG_ANY, -@@ -395,7 +394,35 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - } - BIO_free( bio ); - SSL_CTX_set_tmp_dh( ctx, dh ); -+ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); -+ DH_free( dh ); -+ } -+ -+#ifdef SSL_OP_SINGLE_ECDH_USE -+ if ( is_server && lo->ldo_tls_ecname ) { -+ EC_KEY *ecdh; -+ -+ int nid = OBJ_sn2nid( lt->lt_ecname ); -+ if ( nid == NID_undef ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not use EC name `%s'.\n", -+ lo->ldo_tls_ecname,0,0); -+ tlso_report_error(); -+ return -1; -+ } -+ ecdh = EC_KEY_new_by_curve_name( nid ); -+ if ( ecdh == NULL ) { -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: could not generate key for EC name `%s'.\n", -+ lo->ldo_tls_ecname,0,0); -+ tlso_report_error(); -+ return -1; -+ } -+ SSL_CTX_set_tmp_ecdh( ctx, ecdh ); -+ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); -+ EC_KEY_free( ecdh ); - } -+#endif - - if ( tlso_opt_trace ) { - SSL_CTX_set_info_callback( ctx, tlso_info_cb ); -diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c -index 250f14100..8b1e4e582 100644 ---- a/servers/slapd/bconfig.c -+++ b/servers/slapd/bconfig.c -@@ -194,6 +194,7 @@ enum { - CFG_ACL_ADD, - CFG_SYNC_SUBENTRY, - CFG_LTHREADS, -+ CFG_TLS_ECNAME, - - CFG_LAST - }; -@@ -738,6 +739,14 @@ static ConfigTable config_back_cf_table[] = { - #endif - "( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' " - "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, -+ { "TLSECName", NULL, 2, 2, 0, -+#ifdef HAVE_TLS -+ CFG_TLS_ECNAME|ARG_STRING|ARG_MAGIC, &config_tls_option, -+#else -+ ARG_IGNORED, NULL, -+#endif -+ "( OLcfgGlAt:96 NAME 'olcTLSECName' " -+ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, - { "TLSProtocolMin", NULL, 2, 2, 0, - #ifdef HAVE_TLS - CFG_TLS_PROTOCOL_MIN|ARG_STRING|ARG_MAGIC, &config_tls_config, -@@ -819,7 +828,7 @@ static ConfigOCs cf_ocs[] = { - "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ " - "olcTLSCACertificatePath $ olcTLSCertificateFile $ " - "olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ " -- "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ " -+ "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSECName $ " - "olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ " - "olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ " - "olcDitContentRules $ olcLdapSyntaxes ) )", Cft_Global }, -@@ -3824,6 +3833,7 @@ config_tls_option(ConfigArgs *c) { - case CFG_TLS_CA_PATH: flag = LDAP_OPT_X_TLS_CACERTDIR; break; - case CFG_TLS_CA_FILE: flag = LDAP_OPT_X_TLS_CACERTFILE; break; - case CFG_TLS_DH_FILE: flag = LDAP_OPT_X_TLS_DHFILE; break; -+ case CFG_TLS_ECNAME: flag = LDAP_OPT_X_TLS_ECNAME; break; - #ifdef HAVE_GNUTLS - case CFG_TLS_CRL_FILE: flag = LDAP_OPT_X_TLS_CRLFILE; break; - #endif diff --git a/openldap-openssl-ITS7595-Add-EC-support-2.patch b/openldap-openssl-ITS7595-Add-EC-support-2.patch deleted file mode 100644 index 6c28f3f..0000000 --- a/openldap-openssl-ITS7595-Add-EC-support-2.patch +++ /dev/null @@ -1,34 +0,0 @@ -ITS#7595 don't try to use EC if OpenSSL lacks it - -Cherry-picked upstream 721e46fe6695077d63a3df6ea2e397920a72308d -Author: Howard Chu -Date: Sun Sep 8 06:32:23 2013 -0700 - -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index 1a81bc625..71c2b055c 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -321,8 +321,12 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - DH_free( dh ); - } - --#ifdef SSL_OP_SINGLE_ECDH_USE - if ( is_server && lo->ldo_tls_ecname ) { -+#ifdef OPENSSL_NO_EC -+ Debug( LDAP_DEBUG_ANY, -+ "TLS: Elliptic Curves not supported.\n", 0,0,0 ); -+ return -1; -+#else - EC_KEY *ecdh; - - int nid = OBJ_sn2nid( lt->lt_ecname ); -@@ -344,8 +348,8 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) - SSL_CTX_set_tmp_ecdh( ctx, ecdh ); - SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); - EC_KEY_free( ecdh ); -- } - #endif -+ } - - if ( tlso_opt_trace ) { - SSL_CTX_set_info_callback( ctx, tlso_info_cb ); diff --git a/openldap.spec b/openldap.spec index 7f799ff..26d5e5c 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,8 +4,8 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.47 -Release: 5%{?dist} +Version: 2.4.50 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -32,11 +32,8 @@ Patch17: openldap-allop-overlay.patch # the proper fix is to link all perl modules against libperl # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327585 Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch -# ldapi sasl fix pending upstream inclusion -Patch20: openldap-ldapi-sasl.patch -Patch22: openldap-openssl-ITS7595-Add-EC-support-1.patch -Patch23: openldap-openssl-ITS7595-Add-EC-support-2.patch Patch24: openldap-openssl-manpage-defaultCA.patch +Patch25: openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -113,10 +110,8 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch5 -p1 %patch17 -p1 %patch19 -p1 -%patch20 -p1 -%patch22 -p1 -%patch23 -p1 %patch24 -p1 +%patch25 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -486,6 +481,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Jun 17 2020 Matus Honek - 2.4.50-1 +- Rebase to version 2.4.50 (#1742285) + * Tue Jun 16 2020 Tom Stellard - 2.4.47-5 - Spec file cleanups - Add BuildRequres: gcc [1] diff --git a/sources b/sources index 7ad4ad1..8b790c5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.47.tgz) = d424079e34207e3d24383a2bea70a07ded40714982a6767174d2b2cb208cd94feab5ef12157accae915b8e404e5773a7547aaef65f06b44dc3cc09c6a64d5a11 +SHA512 (openldap-2.4.50.tgz) = f528043ff9de36f7b65d8816c9a9c24f0ac400041b2969965178ee6eae62c92a11af33a0a883e4954e5fff98a0738a9f9aa2faf5b385d21974754e045aab31ae From 29543a7139574dc4f5e49a1179f584800a436eb3 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Mon, 22 Jun 2020 17:42:20 +0200 Subject: [PATCH 051/118] Perl 5.32 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 26d5e5c..971a2c9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.50 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -481,6 +481,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Mon Jun 22 2020 Jitka Plesnikova - 2.4.50-2 +- Perl 5.32 rebuild + * Wed Jun 17 2020 Matus Honek - 2.4.50-1 - Rebase to version 2.4.50 (#1742285) From a79e9a93cf18432da75b9f7763c4dfbcee2efb6a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 12:44:28 +0000 Subject: [PATCH 052/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 971a2c9..d51d781 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.50 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -481,6 +481,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.50-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Mon Jun 22 2020 Jitka Plesnikova - 2.4.50-2 - Perl 5.32 rebuild From c0e9e1a02c8ed53644572a000d4820a935c23b23 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 1 Aug 2020 06:52:04 +0000 Subject: [PATCH 053/118] - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index d51d781..d74038b 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,7 +5,7 @@ Name: openldap Version: 2.4.50 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -481,6 +481,10 @@ exit 0 %{_mandir}/man3/* %changelog +* Sat Aug 01 2020 Fedora Release Engineering - 2.4.50-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jul 28 2020 Fedora Release Engineering - 2.4.50-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From cdabac68fb78123790d30f9a52f4ccb63499c7b0 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 3 Sep 2020 16:25:59 +0200 Subject: [PATCH 054/118] Rebase to version 2.4.52 Resolves: #1868240 --- .gitignore | 1 + ...ix-Debug-usage-to-follow-RE24-format.patch | 36 ------------------- openldap.spec | 9 ++--- sources | 2 +- 4 files changed, 7 insertions(+), 41 deletions(-) delete mode 100644 openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch diff --git a/.gitignore b/.gitignore index 128fbb8..8e867ca 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ /openldap-2.4.46.tgz /openldap-2.4.47.tgz /openldap-2.4.50.tgz +/openldap-2.4.52.tgz diff --git a/openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch b/openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch deleted file mode 100644 index 350626e..0000000 --- a/openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 85fc8974f5c32a9a052baafaa9499c8484e043c2 Mon Sep 17 00:00:00 2001 -From: Quanah Gibson-Mount -Date: Tue, 28 Apr 2020 20:49:53 +0000 -Subject: [PATCH] ITS#8650 - Fix Debug usage to follow RE24 format - ---- - libraries/libldap/tls2.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index c1f15cbc1..ebe5bf125 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -907,8 +907,8 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - } else if ( sb->sb_trans_needs_write ) { - wr=1; - } -- Debug1( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ldap_int_tls_connect needs %s\n", -- wr ? "write": "read" ); -+ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ldap_int_tls_connect needs %s\n", -+ wr ? "write": "read", 0, 0 ); - - /* This is mostly copied from result.c:wait4msg(), should - * probably be moved into a separate function */ -@@ -946,7 +946,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) - start_time_tv.tv_sec = curr_time_tv.tv_sec; - start_time_tv.tv_usec = curr_time_tv.tv_usec; - tv = tv0; -- Debug3( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ld %p %ld s %ld us to go\n", -+ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_start: ld %p %ld s %ld us to go\n", - (void *)ld, (long) tv.tv_sec, (long) tv.tv_usec ); - ret = ldap_int_poll( ld, sd, &tv, wr); - if ( ret < 0 ) { --- -2.25.4 - diff --git a/openldap.spec b/openldap.spec index d74038b..b7aa7a3 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,8 +4,8 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.50 -Release: 4%{?dist} +Version: 2.4.52 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -33,7 +33,6 @@ Patch17: openldap-allop-overlay.patch # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327585 Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch Patch24: openldap-openssl-manpage-defaultCA.patch -Patch25: openldap-ITS-8650-Fix-Debug-usage-to-follow-RE24-format.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -111,7 +110,6 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch17 -p1 %patch19 -p1 %patch24 -p1 -%patch25 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -481,6 +479,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu Sep 03 2020 Simon Pichugin - 2.4.52-1 +- Rebase to version 2.4.52 (#1868240) + * Sat Aug 01 2020 Fedora Release Engineering - 2.4.50-4 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 8b790c5..3faa763 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.50.tgz) = f528043ff9de36f7b65d8816c9a9c24f0ac400041b2969965178ee6eae62c92a11af33a0a883e4954e5fff98a0738a9f9aa2faf5b385d21974754e045aab31ae +SHA512 (openldap-2.4.52.tgz) = aba0e11b91d175230a525f7a74a8d896b743719364487976e0502570fec353d107d3fadedf4c0b8516eca2f572b38bd0a4288283a6918ef7ea322c889396f84c From c01ccf342eeebd44e5a88b8f0b7d6e82d8e4bfef Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 10 Sep 2020 14:46:44 +0200 Subject: [PATCH 055/118] Rebase to version 2.4.53 Resolves: #1868240 --- .gitignore | 1 + openldap.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8e867ca..9eee474 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /openldap-2.4.47.tgz /openldap-2.4.50.tgz /openldap-2.4.52.tgz +/openldap-2.4.53.tgz diff --git a/openldap.spec b/openldap.spec index b7aa7a3..b91cd99 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,7 +4,7 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.52 +Version: 2.4.53 Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP @@ -479,6 +479,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu Sep 10 2020 Simon Pichugin - 2.4.53-1 +- Rebase to version 2.4.53 (#1868240) + * Thu Sep 03 2020 Simon Pichugin - 2.4.52-1 - Rebase to version 2.4.52 (#1868240) diff --git a/sources b/sources index 3faa763..cd1bfcc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.52.tgz) = aba0e11b91d175230a525f7a74a8d896b743719364487976e0502570fec353d107d3fadedf4c0b8516eca2f572b38bd0a4288283a6918ef7ea322c889396f84c +SHA512 (openldap-2.4.53.tgz) = 32dcbf18ffa53b3c2c5399f726c7a8970154d40fb88de85896d18ea2abd79c55ebe28fcf5fbfd52771f95561d70ab364db5f667fe2ec0e67b21e281f5112ec99 From f9945ac297c550f1bcc2cb810f2284e4b23b1e75 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Tue, 13 Oct 2020 13:57:41 +0200 Subject: [PATCH 056/118] Rebase to version 2.4.54 Resolves: #1887581 --- .gitignore | 1 + openldap.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 9eee474..0bb4a4d 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /openldap-2.4.50.tgz /openldap-2.4.52.tgz /openldap-2.4.53.tgz +/openldap-2.4.54.tgz diff --git a/openldap.spec b/openldap.spec index b91cd99..a77f2f4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,7 +4,7 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.53 +Version: 2.4.54 Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP @@ -479,6 +479,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu Oct 13 2020 Simon Pichugin - 2.4.54-1 +- Rebase to version 2.4.54 (#1887581) + * Thu Sep 10 2020 Simon Pichugin - 2.4.53-1 - Rebase to version 2.4.53 (#1868240) diff --git a/sources b/sources index cd1bfcc..680420b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.53.tgz) = 32dcbf18ffa53b3c2c5399f726c7a8970154d40fb88de85896d18ea2abd79c55ebe28fcf5fbfd52771f95561d70ab364db5f667fe2ec0e67b21e281f5112ec99 +SHA512 (openldap-2.4.54.tgz) = 30cbe23f310f1901a0300ac0d123fc2e6fcc5bde8b15692f2fd8291d1f1e5b7e97426823eb1be9977a15d728fd175c8938c6790a57582a72d10be0b497c3ef5f From 847f09020e4fd37e4a0845109648fc6c61498229 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 2 Nov 2020 08:59:40 +0100 Subject: [PATCH 057/118] Rebase to version 2.4.55 Resolves: #1891622 --- .gitignore | 1 + openldap.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0bb4a4d..a4ea37a 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ /openldap-2.4.52.tgz /openldap-2.4.53.tgz /openldap-2.4.54.tgz +/openldap-2.4.55.tgz diff --git a/openldap.spec b/openldap.spec index a77f2f4..bd5da4c 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,7 +4,7 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.54 +Version: 2.4.55 Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP @@ -479,6 +479,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Thu Nov 02 2020 Simon Pichugin - 2.4.55-1 +- Rebase to version 2.4.55 (#1891622) + * Thu Oct 13 2020 Simon Pichugin - 2.4.54-1 - Rebase to version 2.4.54 (#1887581) diff --git a/sources b/sources index 680420b..321040e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.54.tgz) = 30cbe23f310f1901a0300ac0d123fc2e6fcc5bde8b15692f2fd8291d1f1e5b7e97426823eb1be9977a15d728fd175c8938c6790a57582a72d10be0b497c3ef5f +SHA512 (openldap-2.4.55.tgz) = c58296cc9dfecf0830ec1e79feeac14e0c5a76a03f2a9a17ff39886d2cbf05e695dd8bdb748a5927a256476cb5340d6ecbdd8781f98a3a9ed6b1ce53ee90bd38 From 663399630fa7f8e6c478d6ad5f46fc8c1b07ab67 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 18 Nov 2020 14:46:07 +0100 Subject: [PATCH 058/118] Rebase to version 2.4.56 Resolves: #1896508 --- .gitignore | 1 + openldap.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a4ea37a..2f82141 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ /openldap-2.4.53.tgz /openldap-2.4.54.tgz /openldap-2.4.55.tgz +/openldap-2.4.56.tgz diff --git a/openldap.spec b/openldap.spec index bd5da4c..3d01de5 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,7 +4,7 @@ %global check_password_version 1.1 Name: openldap -Version: 2.4.55 +Version: 2.4.56 Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP @@ -479,6 +479,9 @@ exit 0 %{_mandir}/man3/* %changelog +* Wed Nov 18 2020 Simon Pichugin - 2.4.56-1 +- Rebase to version 2.4.56 (#1896508) + * Thu Nov 02 2020 Simon Pichugin - 2.4.55-1 - Rebase to version 2.4.55 (#1891622) diff --git a/sources b/sources index 321040e..cedee79 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.55.tgz) = c58296cc9dfecf0830ec1e79feeac14e0c5a76a03f2a9a17ff39886d2cbf05e695dd8bdb748a5927a256476cb5340d6ecbdd8781f98a3a9ed6b1ce53ee90bd38 +SHA512 (openldap-2.4.56.tgz) = cf371db5595d5b6643db3e6788ce56e34fe271c244dd39d781cadd2a7f85cec421a51c11a4857a7e286ba94a27c1f0dab0ff27e8de20208587471f4a589588e6 From 09678ce9b0de890a82cbaeab54f0dc0d798a121d Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Fri, 20 Nov 2020 13:25:44 +0100 Subject: [PATCH 059/118] Drop non-threaded libldap Resolves: #1537260 --- openldap.spec | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/openldap.spec b/openldap.spec index 3d01de5..49d14b7 100644 --- a/openldap.spec +++ b/openldap.spec @@ -3,9 +3,11 @@ %global systemctl_bin /usr/bin/systemctl %global check_password_version 1.1 +%global so_ver 2 + Name: openldap Version: 2.4.56 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -63,6 +65,17 @@ protocols for enabling directory services over the Internet. Install this package only if you plan to develop or will need to compile customized LDAP clients. +%package compat +Summary: Package providing legacy non-threded libldap +Requires: openldap%{?_isa} = %{version}-%{release} +# since libldap is manually linked from libldap_r, the provides is not generated automatically +Provides: libldap-2.4.so.%{so_ver}()(%{__isa_bits}bit) + +%description compat +The openldap-compat package contains non-threaded variant of libldap +which should not be used. Instead, applications should link to libldap_r +which provides thread-safe variant with the very same API. + %package servers Summary: LDAP server License: OpenLDAP @@ -263,8 +276,14 @@ v=%{version} version=$(echo ${v%.[0-9]*}) for lib in liblber libldap libldap_r libslapi; do rm -f ${lib}.so - ln -s ${lib}-${version}.so.2 ${lib}.so + ln -s ${lib}-${version}.so.%{so_ver} ${lib}.so done + +# provide only libldap_r and symlink libldap to it +rm -f libldap.so +ln -s libldap{_r,}.so +rm -f libldap-*.so.* +ln -s libldap{_r,}-${version}.so.%{so_ver} popd # tweak permissions on the libraries to make sure they're correct @@ -403,7 +422,6 @@ exit 0 %config(noreplace) %{_sysconfdir}/openldap/ldap.conf %dir %{_libexecdir}/openldap/ %{_libdir}/liblber-2.4*.so.* -%{_libdir}/libldap-2.4*.so.* %{_libdir}/libldap_r-2.4*.so.* %{_libdir}/libslapi-2.4*.so.* %{_mandir}/man5/ldif.5* @@ -478,14 +496,21 @@ exit 0 %{_includedir}/* %{_mandir}/man3/* + +%files compat +%{_libdir}/libldap-2.4*.so.* + %changelog +* Wed Nov 18 2020 Simon Pichugin - 2.4.56-2 +- Drop non-threaded libldap (#1537260) + * Wed Nov 18 2020 Simon Pichugin - 2.4.56-1 - Rebase to version 2.4.56 (#1896508) -* Thu Nov 02 2020 Simon Pichugin - 2.4.55-1 +* Mon Nov 02 2020 Simon Pichugin - 2.4.55-1 - Rebase to version 2.4.55 (#1891622) -* Thu Oct 13 2020 Simon Pichugin - 2.4.54-1 +* Tue Oct 13 2020 Simon Pichugin - 2.4.54-1 - Rebase to version 2.4.54 (#1887581) * Thu Sep 10 2020 Simon Pichugin - 2.4.53-1 From 01bd7adabbe327dfa3b07a3a381efef7b6411081 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Fri, 20 Nov 2020 18:24:08 +0100 Subject: [PATCH 060/118] Set correct Provides to fix 32-bit builds --- openldap.spec | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/openldap.spec b/openldap.spec index 49d14b7..33b76b9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.56 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -69,7 +69,11 @@ customized LDAP clients. Summary: Package providing legacy non-threded libldap Requires: openldap%{?_isa} = %{version}-%{release} # since libldap is manually linked from libldap_r, the provides is not generated automatically +%if %{__isa_bits} == 32 +Provides: libldap-2.4.so.%{so_ver} +%else Provides: libldap-2.4.so.%{so_ver}()(%{__isa_bits}bit) +%endif %description compat The openldap-compat package contains non-threaded variant of libldap @@ -501,7 +505,10 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog -* Wed Nov 18 2020 Simon Pichugin - 2.4.56-2 +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-3 +- Fix 32-bit libraries build + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-2 - Drop non-threaded libldap (#1537260) * Wed Nov 18 2020 Simon Pichugin - 2.4.56-1 From cf3a5b608f44426e35c332fdea975e068eeba66d Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Fri, 20 Nov 2020 19:53:03 +0100 Subject: [PATCH 061/118] Use ifarch instead of if __isa_bits for compatibility --- openldap.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 33b76b9..5adaed4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -69,7 +69,7 @@ customized LDAP clients. Summary: Package providing legacy non-threded libldap Requires: openldap%{?_isa} = %{version}-%{release} # since libldap is manually linked from libldap_r, the provides is not generated automatically -%if %{__isa_bits} == 32 +%ifarch armv7hl i686 Provides: libldap-2.4.so.%{so_ver} %else Provides: libldap-2.4.so.%{so_ver}()(%{__isa_bits}bit) From 3664d0fd7b80f25dd5618d0e783e9c629d8c2520 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 25 Nov 2020 10:11:45 +0100 Subject: [PATCH 062/118] Use gcc to link libldap_r to libldap --- openldap.spec | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/openldap.spec b/openldap.spec index 5adaed4..ded3292 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.56 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -283,11 +283,26 @@ for lib in liblber libldap libldap_r libslapi; do ln -s ${lib}-${version}.so.%{so_ver} ${lib}.so done -# provide only libldap_r and symlink libldap to it +# provide only libldap_r and copy it to libldap, make a versioned lib link rm -f libldap.so -ln -s libldap{_r,}.so +ln -s libldap_r.so "%{buildroot}%{_libdir}/libldap.so" rm -f libldap-*.so.* -ln -s libldap{_r,}-${version}.so.%{so_ver} +for lib in $(ls | grep libldap_r-); do + IFS='.' + read -r -a libsplit <<< "$lib" + if [ -z "${libsplit[4]}" ] + then + so_ver_short="${libsplit[3]}" + unset IFS + gcc -shared -o "%{buildroot}%{_libdir}/libldap-${version}.so.${so_ver_short}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap-${version}.so.${so_ver_short} -L "%{buildroot}%{_libdir}" -lldap_r + else + so_ver_full="${libsplit[3]}.${libsplit[4]}.${libsplit[5]}" + unset IFS + fi +done +ln -s libldap-${version}.so.{${so_ver_short},${so_ver_full}} + popd # tweak permissions on the libraries to make sure they're correct @@ -505,8 +520,11 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Thu Nov 26 2020 Simon Pichugin - 2.4.56-4 +- Use gcc to link libldap_r to libldap (#1537260) + * Fri Nov 20 2020 Simon Pichugin - 2.4.56-3 -- Fix 32-bit libraries build +- Fix 32-bit libraries build (#1537260) * Fri Nov 20 2020 Simon Pichugin - 2.4.56-2 - Drop non-threaded libldap (#1537260) From 5009550e1d648aa2190d52ad18fb3f60a9d9f599 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Thu, 7 Jan 2021 06:33:42 +0000 Subject: [PATCH 063/118] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- openldap.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/openldap.spec b/openldap.spec index ded3292..86c416a 100644 --- a/openldap.spec +++ b/openldap.spec @@ -40,6 +40,7 @@ Patch24: openldap-openssl-manpage-defaultCA.patch Patch90: check-password-makefile.patch Patch91: check-password.patch +BuildRequires: make BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) BuildRequires: gcc From 18c0dd6f11762bb7729a6b9ca9e0641f36284c75 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Tue, 19 Jan 2021 13:00:13 +0100 Subject: [PATCH 064/118] Rebase to version 2.4.57 Resolves: #1917583 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2f82141..003405d 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /openldap-2.4.54.tgz /openldap-2.4.55.tgz /openldap-2.4.56.tgz +/openldap-2.4.57.tgz diff --git a/openldap.spec b/openldap.spec index 86c416a..cfd12a6 100644 --- a/openldap.spec +++ b/openldap.spec @@ -6,8 +6,8 @@ %global so_ver 2 Name: openldap -Version: 2.4.56 -Release: 4%{?dist} +Version: 2.4.57 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -521,6 +521,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Wed Jan 19 2021 Simon Pichugin - 2.4.57-1 +- Rebase to version 2.4.57 (#1917583) + * Thu Nov 26 2020 Simon Pichugin - 2.4.56-4 - Use gcc to link libldap_r to libldap (#1537260) diff --git a/sources b/sources index cedee79..b773e89 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.56.tgz) = cf371db5595d5b6643db3e6788ce56e34fe271c244dd39d781cadd2a7f85cec421a51c11a4857a7e286ba94a27c1f0dab0ff27e8de20208587471f4a589588e6 +SHA512 (openldap-2.4.57.tgz) = b929bced0f5ba9a90e015a24b8037c8958fbb7282db272bd0cacf43b5f7540ab42159a3c4441148074340228bb5f07f93651c0dbb2affde961be156058f99ce5 From 84b2fbbec18c63ff878961676dbbdddc8c74336b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 22:32:06 +0000 Subject: [PATCH 065/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index cfd12a6..cebe110 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.57 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -521,6 +521,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.57-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Jan 19 2021 Simon Pichugin - 2.4.57-1 - Rebase to version 2.4.57 (#1917583) From ff3112bddd0b2970738da4295705cd5d5d8672dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:10 +0100 Subject: [PATCH 066/118] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- openldap.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index cebe110..43de793 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.57 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -521,6 +521,10 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.4.57-3 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Tue Jan 26 2021 Fedora Release Engineering - 2.4.57-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 2e823bcb52730b437d374578bcd966d5de026b1e Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Tue, 23 Mar 2021 14:37:32 +0100 Subject: [PATCH 067/118] Rebase to version 2.4.58 Resolves: #1939663 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 003405d..04c4971 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ /openldap-2.4.55.tgz /openldap-2.4.56.tgz /openldap-2.4.57.tgz +/openldap-2.4.58.tgz diff --git a/openldap.spec b/openldap.spec index 43de793..ba19620 100644 --- a/openldap.spec +++ b/openldap.spec @@ -6,8 +6,8 @@ %global so_ver 2 Name: openldap -Version: 2.4.57 -Release: 3%{?dist} +Version: 2.4.58 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -521,6 +521,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Tue Mar 23 2021 Simon Pichugin - 2.4.58-1 +- Rebase to version 2.4.58 (#1939663) + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.4.57-3 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/sources b/sources index b773e89..5bd8a20 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.57.tgz) = b929bced0f5ba9a90e015a24b8037c8958fbb7282db272bd0cacf43b5f7540ab42159a3c4441148074340228bb5f07f93651c0dbb2affde961be156058f99ce5 +SHA512 (openldap-2.4.58.tgz) = 2fa2aa36117692eca44e55559f162c8c796f78469e6c2aee91b06d46f2b755d416979c913a3d89bbf9db14cc84881ecffee69af75b48e1d16b7aa9d2e3873baa From 4cd1219804782b0b909661a64f4e1845435cb326 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Fri, 12 Feb 2021 13:45:39 +0100 Subject: [PATCH 068/118] Backport Channel Binding support Resolves: #1822904, #1822737 --- ...cbinding-Add-channel-binding-support.patch | 291 +++ ...nding-Convert-test077-to-LDIF-config.patch | 236 ++ ...dap-cbinding-Fix-slaptest-in-test077.patch | 39 + ...ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch | 220 ++ ...-Add-missing-URI-variables-for-tests.patch | 70 + ...nding-ITS-8573-TLS-option-test-suite.patch | 2108 +++++++++++++++++ ...ll-libldap-options-in-tools-o-option.patch | 582 +++++ ...-9189_1-rework-sasl-cbinding-support.patch | 631 +++++ ...TS-9189_2-add-channel-bindings-tests.patch | 45 + ...ize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch | 27 + ...ke-prototypes-available-where-needed.patch | 64 + ...dap-cbinding-Update-keys-to-RSA-4096.patch | 526 ++++ ...-cbinding-auth-add-SASL-GSSAPI-tests.patch | 487 ++++ openldap.spec | 38 +- 14 files changed, 5362 insertions(+), 2 deletions(-) create mode 100644 openldap-cbinding-Add-channel-binding-support.patch create mode 100644 openldap-cbinding-Convert-test077-to-LDIF-config.patch create mode 100644 openldap-cbinding-Fix-slaptest-in-test077.patch create mode 100644 openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch create mode 100644 openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch create mode 100644 openldap-cbinding-ITS-8573-TLS-option-test-suite.patch create mode 100644 openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch create mode 100644 openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch create mode 100644 openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch create mode 100644 openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch create mode 100644 openldap-cbinding-Make-prototypes-available-where-needed.patch create mode 100644 openldap-cbinding-Update-keys-to-RSA-4096.patch create mode 100644 openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch diff --git a/openldap-cbinding-Add-channel-binding-support.patch b/openldap-cbinding-Add-channel-binding-support.patch new file mode 100644 index 0000000..42efaee --- /dev/null +++ b/openldap-cbinding-Add-channel-binding-support.patch @@ -0,0 +1,291 @@ +From ca310ebff44f10739fd75aff437c7676e089b134 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 26 Aug 2013 23:31:48 -0700 +Subject: [PATCH] Add channel binding support + +Currently only implemented for OpenSSL. +Needs an option to set the criticality flag. +--- + include/ldap_pvt.h | 1 + + libraries/libldap/cyrus.c | 22 ++++++++++++++++++++++ + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/ldap-tls.h | 2 ++ + libraries/libldap/tls2.c | 7 +++++++ + libraries/libldap/tls_g.c | 7 +++++++ + libraries/libldap/tls_m.c | 7 +++++++ + libraries/libldap/tls_o.c | 16 ++++++++++++++++ + servers/slapd/connection.c | 8 ++++++++ + servers/slapd/sasl.c | 18 ++++++++++++++++++ + servers/slapd/slap.h | 1 + + 11 files changed, 90 insertions(+) + +diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h +index 716c1a90f..61c620785 100644 +--- a/include/ldap_pvt.h ++++ b/include/ldap_pvt.h +@@ -420,6 +420,7 @@ LDAP_F (int) ldap_pvt_tls_get_my_dn LDAP_P(( void *ctx, struct berval *dn, + LDAP_F (int) ldap_pvt_tls_get_peer_dn LDAP_P(( void *ctx, struct berval *dn, + LDAPDN_rewrite_dummy *func, unsigned flags )); + LDAP_F (int) ldap_pvt_tls_get_strength LDAP_P(( void *ctx )); ++LDAP_F (int) ldap_pvt_tls_get_unique LDAP_P(( void *ctx, struct berval *buf, int is_server )); + + LDAP_END_DECL + +diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c +index 4c0089d5d..3171d56a3 100644 +--- a/libraries/libldap/cyrus.c ++++ b/libraries/libldap/cyrus.c +@@ -360,6 +360,10 @@ int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc ) + lc->lconn_sasl_sockctx = NULL; + lc->lconn_sasl_authctx = NULL; + } ++ if( lc->lconn_sasl_cbind ) { ++ ldap_memfree( lc->lconn_sasl_cbind ); ++ lc->lconn_sasl_cbind = NULL; ++ } + + return LDAP_SUCCESS; + } +@@ -492,6 +496,24 @@ ldap_int_sasl_bind( + + (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac ); + LDAP_FREE( authid.bv_val ); ++#ifdef SASL_CHANNEL_BINDING /* 2.1.25+ */ ++ { ++ char cbinding[64]; ++ struct berval cbv = { sizeof(cbinding), cbinding }; ++ if ( ldap_pvt_tls_get_unique( ssl, &cbv, 0 )) { ++ sasl_channel_binding_t *cb = ldap_memalloc( sizeof(*cb) + ++ cbv.bv_len); ++ cb->name = "ldap"; ++ cb->critical = 0; ++ cb->data = (char *)(cb+1); ++ cb->len = cbv.bv_len; ++ memcpy( cb->data, cbv.bv_val, cbv.bv_len ); ++ sasl_setprop( ld->ld_defconn->lconn_sasl_authctx, ++ SASL_CHANNEL_BINDING, cb ); ++ ld->ld_defconn->lconn_sasl_cbind = cb; ++ } ++ } ++#endif + } + #endif + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 98ad4dc05..397894271 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -308,6 +308,7 @@ typedef struct ldap_conn { + #ifdef HAVE_CYRUS_SASL + void *lconn_sasl_authctx; /* context for bind */ + void *lconn_sasl_sockctx; /* for security layer */ ++ void *lconn_sasl_cbind; /* for channel binding */ + #endif + #ifdef HAVE_GSSAPI + void *lconn_gss_ctx; /* gss_ctx_id_t */ +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index c8a27112f..0ecf81ab9 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -41,6 +41,7 @@ typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len + typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); + typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_strength)(tls_session *sess); ++typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); + + typedef void (TI_thr_init)(void); + +@@ -64,6 +65,7 @@ typedef struct tls_impl { + TI_session_dn *ti_session_peer_dn; + TI_session_chkhost *ti_session_chkhost; + TI_session_strength *ti_session_strength; ++ TI_session_unique *ti_session_unique; + + Sockbuf_IO *ti_sbio; + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 82ca5272c..13d734362 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -1013,6 +1013,13 @@ ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, + rc = ldap_X509dn2bv(&der_dn, dn, (LDAPDN_rewrite_func *)func, flags ); + return rc; + } ++ ++int ++ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) ++{ ++ tls_session *session = s; ++ return tls_imp->ti_session_unique( session, buf, is_server ); ++} + #endif /* HAVE_TLS */ + + int +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 3b72cd2a1..b78c12086 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -669,6 +669,12 @@ tlsg_session_strength( tls_session *session ) + return gnutls_cipher_get_key_size( c ) * 8; + } + ++static int ++tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) ++{ ++ return 0; ++} ++ + /* suites is a string of colon-separated cipher suite names. */ + static int + tlsg_parse_ciphers( tlsg_ctx *ctx, char *suites ) +@@ -925,6 +931,7 @@ tls_impl ldap_int_tls_impl = { + tlsg_session_peer_dn, + tlsg_session_chkhost, + tlsg_session_strength, ++ tlsg_session_unique, + + &tlsg_sbio, + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 43fbae4bc..c64f4c176 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -2874,6 +2874,12 @@ tlsm_session_strength( tls_session *session ) + return rc ? 0 : keySize; + } + ++static int ++tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server) ++{ ++ return 0; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -3302,6 +3308,7 @@ tls_impl ldap_int_tls_impl = { + tlsm_session_peer_dn, + tlsm_session_chkhost, + tlsm_session_strength, ++ tlsm_session_unique, + + &tlsm_sbio, + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index a13f11fb5..f741a461f 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -846,6 +846,21 @@ tlso_session_strength( tls_session *sess ) + return SSL_CIPHER_get_bits(SSL_get_current_cipher(s), NULL); + } + ++static int ++tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) ++{ ++ tlso_session *s = (tlso_session *)sess; ++ ++ /* Usually the client sends the finished msg. But if the ++ * session was resumed, the server sent the msg. ++ */ ++ if (SSL_session_reused(s) ^ !is_server) ++ buf->bv_len = SSL_get_finished(s, buf->bv_val, buf->bv_len); ++ else ++ buf->bv_len = SSL_get_peer_finished(s, buf->bv_val, buf->bv_len); ++ return buf->bv_len; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -1363,6 +1378,7 @@ tls_impl ldap_int_tls_impl = { + tlso_session_peer_dn, + tlso_session_chkhost, + tlso_session_strength, ++ tlso_session_unique, + + &tlso_sbio, + +diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c +index 44c3fc63d..0602fdceb 100644 +--- a/servers/slapd/connection.c ++++ b/servers/slapd/connection.c +@@ -406,6 +406,7 @@ Connection * connection_init( + c->c_sasl_sockctx = NULL; + c->c_sasl_extra = NULL; + c->c_sasl_bindop = NULL; ++ c->c_sasl_cbind = NULL; + + c->c_sb = ber_sockbuf_alloc( ); + +@@ -451,6 +452,7 @@ Connection * connection_init( + assert( c->c_sasl_sockctx == NULL ); + assert( c->c_sasl_extra == NULL ); + assert( c->c_sasl_bindop == NULL ); ++ assert( c->c_sasl_cbind == NULL ); + assert( c->c_currentber == NULL ); + assert( c->c_writewaiter == 0); + assert( c->c_writers == 0); +@@ -1428,6 +1430,12 @@ connection_read( ber_socket_t s, conn_readinfo *cri ) + c->c_connid, (int) s, c->c_tls_ssf, c->c_ssf, 0 ); + slap_sasl_external( c, c->c_tls_ssf, &authid ); + if ( authid.bv_val ) free( authid.bv_val ); ++ { ++ char cbinding[64]; ++ struct berval cbv = { sizeof(cbinding), cbinding }; ++ if ( ldap_pvt_tls_get_unique( ssl, &cbv, 1 )) ++ slap_sasl_cbinding( c, &cbv ); ++ } + } else if ( rc == 1 && ber_sockbuf_ctrl( c->c_sb, + LBER_SB_OPT_NEEDS_WRITE, NULL )) { /* need to retry */ + slapd_set_write( s, 1 ); +diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c +index 5144170d1..258cd5407 100644 +--- a/servers/slapd/sasl.c ++++ b/servers/slapd/sasl.c +@@ -1389,6 +1389,21 @@ int slap_sasl_external( + return LDAP_SUCCESS; + } + ++int slap_sasl_cbinding( Connection *conn, struct berval *cbv ) ++{ ++#ifdef SASL_CHANNEL_BINDING ++ sasl_channel_binding_t *cb = ch_malloc( sizeof(*cb) + cbv->bv_len );; ++ cb->name = "ldap"; ++ cb->critical = 0; ++ cb->data = (char *)(cb+1); ++ cb->len = cbv->bv_len; ++ memcpy( cb->data, cbv->bv_val, cbv->bv_len ); ++ sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); ++ conn->c_sasl_cbind = cb; ++#endif ++ return LDAP_SUCCESS; ++} ++ + int slap_sasl_reset( Connection *conn ) + { + return LDAP_SUCCESS; +@@ -1454,6 +1469,9 @@ int slap_sasl_close( Connection *conn ) + free( conn->c_sasl_extra ); + conn->c_sasl_extra = NULL; + ++ free( conn->c_sasl_cbind ); ++ conn->c_sasl_cbind = NULL; ++ + #elif defined(SLAP_BUILTIN_SASL) + SASL_CTX *ctx = conn->c_sasl_authctx; + if( ctx ) { +diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h +index 7581967be..ad797d752 100644 +--- a/servers/slapd/slap.h ++++ b/servers/slapd/slap.h +@@ -2910,6 +2910,7 @@ struct Connection { + void *c_sasl_authctx; /* SASL authentication context */ + void *c_sasl_sockctx; /* SASL security layer context */ + void *c_sasl_extra; /* SASL session extra stuff */ ++ void *c_sasl_cbind; /* SASL channel binding */ + Operation *c_sasl_bindop; /* set to current op if it's a bind */ + + #ifdef LDAP_X_TXN +-- +2.29.2 + diff --git a/openldap-cbinding-Convert-test077-to-LDIF-config.patch b/openldap-cbinding-Convert-test077-to-LDIF-config.patch new file mode 100644 index 0000000..5ca02fb --- /dev/null +++ b/openldap-cbinding-Convert-test077-to-LDIF-config.patch @@ -0,0 +1,236 @@ +From 59bdc8158f51fc22cc3c6d6dd2db9e5aa4bcfdc4 Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Mon, 27 Apr 2020 23:24:16 -0700 +Subject: [PATCH] Convert test077 to LDIF config + +--- + tests/data/slapd-sasl-gssapi.conf | 65 ------------------ + tests/scripts/defines.sh | 1 - + tests/scripts/test077-sasl-gssapi | 108 ++++++++++++++++++++++++++++-- + 3 files changed, 103 insertions(+), 71 deletions(-) + delete mode 100644 tests/data/slapd-sasl-gssapi.conf + +diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf +deleted file mode 100644 +index 611fc7097..000000000 +--- a/tests/data/slapd-sasl-gssapi.conf ++++ /dev/null +@@ -1,65 +0,0 @@ +-# stand-alone slapd config -- for testing (with indexing) +-# $OpenLDAP$ +-## This work is part of OpenLDAP Software . +-## +-## Copyright 1998-2020 The OpenLDAP Foundation. +-## All rights reserved. +-## +-## Redistribution and use in source and binary forms, with or without +-## modification, are permitted only as authorized by the OpenLDAP +-## Public License. +-## +-## A copy of this license is available in the file LICENSE in the +-## top-level directory of the distribution or, alternatively, at +-## . +- +-# +-include @SCHEMADIR@/core.schema +-include @SCHEMADIR@/cosine.schema +-# +-include @SCHEMADIR@/corba.schema +-include @SCHEMADIR@/java.schema +-include @SCHEMADIR@/inetorgperson.schema +-include @SCHEMADIR@/misc.schema +-include @SCHEMADIR@/nis.schema +-include @SCHEMADIR@/openldap.schema +-# +-include @SCHEMADIR@/duaconf.schema +-include @SCHEMADIR@/dyngroup.schema +- +-# +-pidfile @TESTDIR@/slapd.1.pid +-argsfile @TESTDIR@/slapd.1.args +- +-# SSL configuration +-TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt +-TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key +-TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt +- +-# +-rootdse @DATADIR@/rootdse.ldif +- +-#mod#modulepath ../servers/slapd/back-@BACKEND@/ +-#mod#moduleload back_@BACKEND@.la +-#monitormod#modulepath ../servers/slapd/back-monitor/ +-#monitormod#moduleload back_monitor.la +- +- +-####################################################################### +-# database definitions +-####################################################################### +- +-database @BACKEND@ +-suffix "dc=example,dc=com" +-rootdn "cn=Manager,dc=example,dc=com" +-rootpw secret +-#~null~#directory @TESTDIR@/db.1.a +-#indexdb#index objectClass eq +-#indexdb#index mail eq +-#ndb#dbname db_1_a +-#ndb#include @DATADIR@/ndb.conf +- +-#monitor#database monitor +- +-sasl-realm @KRB5REALM@ +-sasl-host localhost +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index 78dc1f8ae..76c85b442 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -108,7 +108,6 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf + SCHEMACONF=$DATADIR/slapd-schema.conf + TLSCONF=$DATADIR/slapd-tls.conf + TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf +-SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf + GLUECONF=$DATADIR/slapd-glue.conf + REFINTCONF=$DATADIR/slapd-refint.conf + RETCODECONF=$DATADIR/slapd-retcode.conf +diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi +index bde9006ca..322df60a4 100755 +--- a/tests/scripts/test077-sasl-gssapi ++++ b/tests/scripts/test077-sasl-gssapi +@@ -21,15 +21,40 @@ if test $WITH_SASL = no ; then + exit 0 + fi + +-mkdir -p $TESTDIR $DBDIR1 ++CONFDIR=$TESTDIR/slapd.d ++CONFLDIF=$TESTDIR/slapd.ldif ++ ++mkdir -p $TESTDIR $DBDIR1 $CONFDIR + cp -r $DATADIR/tls $TESTDIR ++$SLAPPASSWD -g -n >$CONFIGPWF + + echo "Starting KDC for SASL/GSSAPI tests..." + . $SRCDIR/scripts/setup_kdc.sh + +-echo "Running slapadd to build slapd database..." +-. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1 +-$SLAPADD -f $CONF1 -l $LDIFORDERED ++echo "Configuring slapd..." ++cat > $CONFLDIF < $LOG1 2>&1 & ++$SLAPD -F $CONFDIR -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & + PID=$! + if test $WAIT != 0 ; then + echo PID $PID +@@ -141,6 +166,79 @@ else + fi + fi + ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, skipping channe-binding test" ++elif test $HAVE_SASL_GSS_CBIND = no ; then ++ echo "SASL has no channel-binding support in GSSAPI, test skipped" ++else ++ echo "Testing SASL/GSSAPI with SASL_CBINDING..." ++ ++ for acb in "none" "tls-unique" "tls-endpoint" ; do ++ ++ echo "Modifying slapd's olcSaslCBinding to ${acb} ..." ++ $LDAPMODIFY -D cn=config -H $URI1 -y $CONFIGPWF < $TESTOUT 2>&1 ++dn: cn=config ++changetype: modify ++replace: olcSaslCBinding ++olcSaslCBinding: ${acb} ++EOF ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapmodify failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ ++ for icb in "none" "tls-unique" "tls-endpoint" ; do ++ ++ # The gnutls implemantation of "tls-unique" seems broken ++ if test $icb = "tls-unique" -o $acb = "tls-unique" ; then ++ if test $WITH_TLS_TYPE == gnutls ; then ++ continue ++ fi ++ fi ++ ++ fail="no" ++ if test $icb != $acb -a $acb != "none" ; then ++ # This currently fails in MIT, but it is planned to be ++ # fixed not to fail like in heimdal - avoid testing. ++ if test $icb = "none" ; then ++ continue ++ fi ++ # Otherwise unmatching bindings are expected to fail. ++ fail="yes" ++ fi ++ ++ echo -n "Using ldapwhoami with SASL/GSSAPI and SASL_CBINDING " ++ echo -ne "(client: ${icb},\tserver: ${acb}): " ++ ++ $LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow \ ++ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ -o SASL_CBINDING=$icb > $TESTOUT 2>&1 ++ ++ RC=$? ++ if test $RC != 0 ; then ++ if test $fail = "no" ; then ++ echo "test failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ elif test $fail = "yes" ; then ++ echo "failed: command succeeded unexpectedly." ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++ fi ++ ++ echo "success" ++ RC=0 ++ done ++ done ++fi ++ ++ + kill $KDCPROC + test $KILLSERVERS != no && kill -HUP $KILLPIDS + +-- +2.29.2 + diff --git a/openldap-cbinding-Fix-slaptest-in-test077.patch b/openldap-cbinding-Fix-slaptest-in-test077.patch new file mode 100644 index 0000000..0e93108 --- /dev/null +++ b/openldap-cbinding-Fix-slaptest-in-test077.patch @@ -0,0 +1,39 @@ +From e006994d83af9dcb7813a18253cf4e5beacee043 Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Sun, 26 Apr 2020 11:40:23 -0700 +Subject: [PATCH] Fix slaptest in test077 + +The libtool wrapper scripts lose argv[0] when exec'ing the real binary. + +In the CI Docker container, where the build runs as root, this was +actually starting a real slapd on the default port. + +Outside Docker, running as a non-root user, this slapd would just fail +to start, and wouldn't convert the config either. + +Using "slapd -Tt" fixes the issue but also prints a warning from +slaptest since the database hasn't been initialized yet. + +Dynamic config isn't actually used in this test script, so let's just +run slapd off the config file directly. +--- + tests/scripts/test077-sasl-gssapi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi +index 64abe16fe..bde9006ca 100755 +--- a/tests/scripts/test077-sasl-gssapi ++++ b/tests/scripts/test077-sasl-gssapi +@@ -24,9 +24,6 @@ fi + mkdir -p $TESTDIR $DBDIR1 + cp -r $DATADIR/tls $TESTDIR + +-cd $TESTWD +- +- + echo "Starting KDC for SASL/GSSAPI tests..." + . $SRCDIR/scripts/setup_kdc.sh + +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch b/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch new file mode 100644 index 0000000..b38dd83 --- /dev/null +++ b/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch @@ -0,0 +1,220 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From 16f8b0902c28b1eaab93ddf120ce40b89bcda8d1 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Tue, 10 Sep 2013 04:26:51 -0700 +Subject: [PATCH] ITS#7398 add LDAP_OPT_X_TLS_PEERCERT + +retrieve peer cert for an active TLS session +--- + doc/man/man3/ldap_get_option.3 | 8 ++++++++ + include/ldap.h | 1 + + libraries/libldap/ldap-tls.h | 2 ++ + libraries/libldap/tls2.c | 24 ++++++++++++++++++++++++ + libraries/libldap/tls_g.c | 19 +++++++++++++++++++ + libraries/libldap/tls_m.c | 17 +++++++++++++++++ + libraries/libldap/tls_o.c | 16 ++++++++++++++++ + 7 files changed, 87 insertions(+) + +diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 +index eb3f25b33..7546875f5 100644 +--- a/doc/man/man3/ldap_get_option.3 ++++ b/doc/man/man3/ldap_get_option.3 +@@ -744,6 +744,14 @@ A non-zero value pointed to by + .BR invalue + tells the library to create a context for a server. + .TP ++.B LDAP_OPT_X_TLS_PEERCERT ++Gets the peer's certificate in DER format from an established TLS session. ++.BR outvalue ++must be ++.BR "struct berval *" , ++and the data it returns needs to be freed by the caller using ++.BR ldap_memfree (3). ++.TP + .B LDAP_OPT_X_TLS_PROTOCOL_MIN + Sets/gets the minimum protocol version. + .BR invalue +diff --git a/include/ldap.h b/include/ldap.h +index 389441031..88bfcabf8 100644 +--- a/include/ldap.h ++++ b/include/ldap.h +@@ -160,6 +160,7 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_TLS_PACKAGE 0x6011 + #define LDAP_OPT_X_TLS_ECNAME 0x6012 + #define LDAP_OPT_X_TLS_REQUIRE_SAN 0x601a ++#define LDAP_OPT_X_TLS_PEERCERT 0x6015 /* read-only */ + + #define LDAP_OPT_X_TLS_NEVER 0 + #define LDAP_OPT_X_TLS_HARD 1 +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index 0ecf81ab9..103004fa7 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -42,6 +42,7 @@ typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); + typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_strength)(tls_session *sess); + typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); ++typedef int (TI_session_peercert)(tls_session *s, struct berval *der); + + typedef void (TI_thr_init)(void); + +@@ -66,6 +67,7 @@ typedef struct tls_impl { + TI_session_chkhost *ti_session_chkhost; + TI_session_strength *ti_session_strength; + TI_session_unique *ti_session_unique; ++ TI_session_peercert *ti_session_peercert; + + Sockbuf_IO *ti_sbio; + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 13d734362..ad09ba39b 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -705,6 +705,23 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) + case LDAP_OPT_X_TLS_CONNECT_ARG: + *(void **)arg = lo->ldo_tls_connect_arg; + break; ++ case LDAP_OPT_X_TLS_PEERCERT: { ++ void *sess = NULL; ++ struct berval *bv = arg; ++ bv->bv_len = 0; ++ bv->bv_val = NULL; ++ if ( ld != NULL ) { ++ LDAPConn *conn = ld->ld_defconn; ++ if ( conn != NULL ) { ++ Sockbuf *sb = conn->lconn_sb; ++ sess = ldap_pvt_tls_sb_ctx( sb ); ++ if ( sess != NULL ) ++ return ldap_pvt_tls_get_peercert( sess, bv ); ++ } ++ } ++ break; ++ } ++ + default: + return -1; + } +@@ -1020,6 +1037,13 @@ ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) + tls_session *session = s; + return tls_imp->ti_session_unique( session, buf, is_server ); + } ++ ++int ++ldap_pvt_tls_get_peercert( void *s, struct berval *der ) ++{ ++ tls_session *session = s; ++ return tls_imp->ti_session_peercert( session, der ); ++} + #endif /* HAVE_TLS */ + + int +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index b78c12086..26d9f99ce 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -675,6 +675,24 @@ tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) + return 0; + } + ++static int ++tlsg_session_peercert( tls_session *sess, struct berval *der ) ++{ ++ tlsg_session *s = (tlsg_session *)sess; ++ const gnutls_datum_t *peer_cert_list; ++ unsigned int list_size; ++ ++ peer_cert_list = gnutls_certificate_get_peers( s->session, &list_size ); ++ if (!peer_cert_list) ++ return -1; ++ der->bv_len = peer_cert_list[0].size; ++ der->bv_val = LDAP_MALLOC( der->bv_len ); ++ if (!der->bv_val) ++ return -1; ++ memcpy(der->bv_val, peer_cert_list[0].data, der->bv_len); ++ return 0; ++} ++ + /* suites is a string of colon-separated cipher suite names. */ + static int + tlsg_parse_ciphers( tlsg_ctx *ctx, char *suites ) +@@ -932,6 +950,7 @@ tls_impl ldap_int_tls_impl = { + tlsg_session_chkhost, + tlsg_session_strength, + tlsg_session_unique, ++ tlsg_session_peercert, + + &tlsg_sbio, + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index c64f4c176..d35a803de 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -2880,6 +2880,22 @@ tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server) + return 0; + } + ++static int ++tlsm_session_peercert( tls_session *sess, struct berval *der ) ++{ ++ tlsm_session *s = (tlsm_session *)sess; ++ CERTCertificate *cert; ++ cert = SSL_PeerCertificate( s ); ++ if (!cert) ++ return -1; ++ der->bv_len = cert->derCert.len; ++ der->bv_val = LDAP_MALLOC( der->bv_len ); ++ if (!der->bv_val) ++ return -1; ++ memcpy( der->bv_val, cert->derCert.data, der->bv_len ); ++ return 0; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -3309,6 +3325,7 @@ tls_impl ldap_int_tls_impl = { + tlsm_session_chkhost, + tlsm_session_strength, + tlsm_session_unique, ++ tlsm_session_peercert, + + &tlsm_sbio, + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index f741a461f..157923289 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -861,6 +861,21 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) + return buf->bv_len; + } + ++static int ++tlso_session_peercert( tls_session *sess, struct berval *der ) ++{ ++ tlso_session *s = (tlso_session *)sess; ++ unsigned char *ptr; ++ X509 *x = SSL_get_peer_certificate(s); ++ der->bv_len = i2d_X509(x, NULL); ++ der->bv_val = LDAP_MALLOC(der->bv_len); ++ if ( !der->bv_val ) ++ return -1; ++ ptr = der->bv_val; ++ i2d_X509(x, &ptr); ++ return 0; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -1379,6 +1394,7 @@ tls_impl ldap_int_tls_impl = { + tlso_session_chkhost, + tlso_session_strength, + tlso_session_unique, ++ tlso_session_peercert, + + &tlso_sbio, + +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch b/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch new file mode 100644 index 0000000..404c4a4 --- /dev/null +++ b/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch @@ -0,0 +1,70 @@ +From 465b1c5972eef1d4e60eb98ae3776d33e270853d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Fri, 15 Jun 2018 15:12:28 +0100 +Subject: [PATCH] ITS#8573 Add missing URI variables for tests + +--- + tests/scripts/conf.sh | 18 ++++++++++++++++++ + tests/scripts/defines.sh | 7 +++++++ + 2 files changed, 25 insertions(+) + +diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh +index 9a33d88e9..2a859d89d 100755 +--- a/tests/scripts/conf.sh ++++ b/tests/scripts/conf.sh +@@ -74,6 +74,24 @@ sed -e "s/@BACKEND@/${BACKEND}/" \ + -e "s;@PORT4@;${PORT4};" \ + -e "s;@PORT5@;${PORT5};" \ + -e "s;@PORT6@;${PORT6};" \ ++ -e "s;@SURI1@;${SURI1};" \ ++ -e "s;@SURI2@;${SURI2};" \ ++ -e "s;@SURI3@;${SURI3};" \ ++ -e "s;@SURI4@;${SURI4};" \ ++ -e "s;@SURI5@;${SURI5};" \ ++ -e "s;@SURI6@;${SURI6};" \ ++ -e "s;@URIP1@;${URIP1};" \ ++ -e "s;@URIP2@;${URIP2};" \ ++ -e "s;@URIP3@;${URIP3};" \ ++ -e "s;@URIP4@;${URIP4};" \ ++ -e "s;@URIP5@;${URIP5};" \ ++ -e "s;@URIP6@;${URIP6};" \ ++ -e "s;@SURIP1@;${SURIP1};" \ ++ -e "s;@SURIP2@;${SURIP2};" \ ++ -e "s;@SURIP3@;${SURIP3};" \ ++ -e "s;@SURIP4@;${SURIP4};" \ ++ -e "s;@SURIP5@;${SURIP5};" \ ++ -e "s;@SURIP6@;${SURIP6};" \ + -e "s/@SASL_MECH@/${SASL_MECH}/" \ + -e "s;@TESTDIR@;${TESTDIR};" \ + -e "s;@TESTWD@;${TESTWD};" \ +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index 8f7c7b853..26dab1bae 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -221,16 +221,23 @@ URIP2="ldap://${LOCALIP}:$PORT2/" + URI3="ldap://${LOCALHOST}:$PORT3/" + URIP3="ldap://${LOCALIP}:$PORT3/" + URI4="ldap://${LOCALHOST}:$PORT4/" ++URIP4="ldap://${LOCALIP}:$PORT4/" + URI5="ldap://${LOCALHOST}:$PORT5/" ++URIP5="ldap://${LOCALIP}:$PORT5/" + URI6="ldap://${LOCALHOST}:$PORT6/" ++URIP6="ldap://${LOCALIP}:$PORT6/" + SURI1="ldaps://${LOCALHOST}:$PORT1/" + SURIP1="ldaps://${LOCALIP}:$PORT1/" + SURI2="ldaps://${LOCALHOST}:$PORT2/" + SURIP2="ldaps://${LOCALIP}:$PORT2/" + SURI3="ldaps://${LOCALHOST}:$PORT3/" ++SURIP3="ldaps://${LOCALIP}:$PORT3/" + SURI4="ldaps://${LOCALHOST}:$PORT4/" ++SURIP4="ldaps://${LOCALIP}:$PORT4/" + SURI5="ldaps://${LOCALHOST}:$PORT5/" ++SURIP5="ldaps://${LOCALIP}:$PORT5/" + SURI6="ldaps://${LOCALHOST}:$PORT6/" ++SURIP6="ldaps://${LOCALIP}:$PORT6/" + + # LDIF + LDIF=$DATADIR/test.ldif +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch b/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch new file mode 100644 index 0000000..e9f5172 --- /dev/null +++ b/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch @@ -0,0 +1,2108 @@ +From eb087e0861f207858a4e08c72836a86f26d9701c Mon Sep 17 00:00:00 2001 +From: Quanah Gibson-Mount +Date: Thu, 14 Jun 2018 16:12:59 +0100 +Subject: [PATCH] ITS#8573 TLS option test suite + +--- + configure | 4 + + configure.in | 4 + + tests/data/slapd-tls-sasl.conf | 65 ++ + tests/data/slapd-tls.conf | 61 ++ + tests/data/tls/ca/certs/testsuiteCA.crt | 16 + + tests/data/tls/ca/private/testsuiteCA.key | 16 + + .../tls/certs/bjensen@mailgw.example.com.crt | 16 + + tests/data/tls/certs/localhost.crt | 16 + + tests/data/tls/conf/openssl.cnf | 129 ++++ + tests/data/tls/create-crt.sh | 78 +++ + .../private/bjensen@mailgw.example.com.key | 16 + + tests/data/tls/private/localhost.key | 16 + + tests/run.in | 3 +- + tests/scripts/defines.sh | 21 +- + tests/scripts/test067-tls | 140 +++++ + tests/scripts/test068-sasl-tls-external | 102 ++++ + .../test069-delta-multimaster-starttls | 574 ++++++++++++++++++ + tests/scripts/test070-delta-multimaster-ldaps | 571 +++++++++++++++++ + 18 files changed, 1846 insertions(+), 2 deletions(-) + create mode 100644 tests/data/slapd-tls-sasl.conf + create mode 100644 tests/data/slapd-tls.conf + create mode 100644 tests/data/tls/ca/certs/testsuiteCA.crt + create mode 100644 tests/data/tls/ca/private/testsuiteCA.key + create mode 100644 tests/data/tls/certs/bjensen@mailgw.example.com.crt + create mode 100644 tests/data/tls/certs/localhost.crt + create mode 100644 tests/data/tls/conf/openssl.cnf + create mode 100755 tests/data/tls/create-crt.sh + create mode 100644 tests/data/tls/private/bjensen@mailgw.example.com.key + create mode 100644 tests/data/tls/private/localhost.key + create mode 100755 tests/scripts/test067-tls + create mode 100755 tests/scripts/test068-sasl-tls-external + create mode 100755 tests/scripts/test069-delta-multimaster-starttls + create mode 100755 tests/scripts/test070-delta-multimaster-ldaps + +diff --git a/configure b/configure +index e87850ec2..e8a720961 100755 +--- a/configure ++++ b/configure +@@ -758,6 +758,7 @@ AUTH_LIBS + LIBSLAPI + SLAPI_LIBS + MODULES_LIBS ++WITH_TLS_TYPE + TLS_LIBS + SASL_LIBS + KRB5_LIBS +@@ -5133,6 +5134,7 @@ KRB4_LIBS= + KRB5_LIBS= + SASL_LIBS= + TLS_LIBS= ++WITH_TLS_TYPE= + MODULES_LIBS= + SLAPI_LIBS= + LIBSLAPI= +@@ -15582,6 +15584,7 @@ fi + if test $have_openssl = yes ; then + ol_with_tls=openssl + ol_link_tls=yes ++ WITH_TLS_TYPE=openssl + + + $as_echo "#define HAVE_OPENSSL 1" >>confdefs.h +@@ -15716,6 +15719,7 @@ fi + if test $have_gnutls = yes ; then + ol_with_tls=gnutls + ol_link_tls=yes ++ WITH_TLS_TYPE=gnutls + + TLS_LIBS="-lgnutls" + +diff --git a/configure.in b/configure.in +index 0c7c0a9ee..cf143d9bf 100644 +--- a/configure.in ++++ b/configure.in +@@ -592,6 +592,7 @@ KRB4_LIBS= + KRB5_LIBS= + SASL_LIBS= + TLS_LIBS= ++WITH_TLS_TYPE= + MODULES_LIBS= + SLAPI_LIBS= + LIBSLAPI= +@@ -1186,6 +1187,7 @@ if test $ol_with_tls = openssl || test $ol_with_tls = auto ; then + if test $have_openssl = yes ; then + ol_with_tls=openssl + ol_link_tls=yes ++ WITH_TLS_TYPE=openssl + + AC_DEFINE(HAVE_OPENSSL, 1, + [define if you have OpenSSL]) +@@ -1226,6 +1228,7 @@ if test $ol_link_tls = no ; then + if test $have_gnutls = yes ; then + ol_with_tls=gnutls + ol_link_tls=yes ++ WITH_TLS_TYPE=gnutls + + TLS_LIBS="-lgnutls" + +@@ -3163,6 +3166,7 @@ AC_SUBST(KRB4_LIBS) + AC_SUBST(KRB5_LIBS) + AC_SUBST(SASL_LIBS) + AC_SUBST(TLS_LIBS) ++AC_SUBST(WITH_TLS_TYPE) + AC_SUBST(MODULES_LIBS) + AC_SUBST(SLAPI_LIBS) + AC_SUBST(LIBSLAPI) +diff --git a/tests/data/slapd-tls-sasl.conf b/tests/data/slapd-tls-sasl.conf +new file mode 100644 +index 000000000..f4bb0773e +--- /dev/null ++++ b/tests/data/slapd-tls-sasl.conf +@@ -0,0 +1,65 @@ ++# stand-alone slapd config -- for testing (with indexing) ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++# ++include @SCHEMADIR@/core.schema ++include @SCHEMADIR@/cosine.schema ++# ++include @SCHEMADIR@/corba.schema ++include @SCHEMADIR@/java.schema ++include @SCHEMADIR@/inetorgperson.schema ++include @SCHEMADIR@/misc.schema ++include @SCHEMADIR@/nis.schema ++include @SCHEMADIR@/openldap.schema ++# ++include @SCHEMADIR@/duaconf.schema ++include @SCHEMADIR@/dyngroup.schema ++include @SCHEMADIR@/ppolicy.schema ++ ++# ++pidfile @TESTDIR@/slapd.1.pid ++argsfile @TESTDIR@/slapd.1.args ++ ++# SSL configuration ++TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt ++TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key ++TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt ++TLSVerifyClient hard ++ ++# ++rootdse @DATADIR@/rootdse.ldif ++ ++#mod#modulepath ../servers/slapd/back-@BACKEND@/ ++#mod#moduleload back_@BACKEND@.la ++#monitormod#modulepath ../servers/slapd/back-monitor/ ++#monitormod#moduleload back_monitor.la ++ ++authz-regexp "email=([^,]*),cn=[^,]*,ou=OpenLDAP,o=OpenLDAP Foundation,st=CA,c=US" ldap:///ou=People,dc=example,dc=com??sub?(mail=$1) ++ ++####################################################################### ++# database definitions ++####################################################################### ++ ++database @BACKEND@ ++suffix "dc=example,dc=com" ++rootdn "cn=Manager,dc=example,dc=com" ++rootpw secret ++#~null~#directory @TESTDIR@/db.1.a ++#indexdb#index objectClass eq ++#indexdb#index mail eq ++#ndb#dbname db_1_a ++#ndb#include @DATADIR@/ndb.conf ++ ++#monitor#database monitor +diff --git a/tests/data/slapd-tls.conf b/tests/data/slapd-tls.conf +new file mode 100644 +index 000000000..6a7785557 +--- /dev/null ++++ b/tests/data/slapd-tls.conf +@@ -0,0 +1,61 @@ ++# stand-alone slapd config -- for testing (with indexing) ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++# ++include @SCHEMADIR@/core.schema ++include @SCHEMADIR@/cosine.schema ++# ++include @SCHEMADIR@/corba.schema ++include @SCHEMADIR@/java.schema ++include @SCHEMADIR@/inetorgperson.schema ++include @SCHEMADIR@/misc.schema ++include @SCHEMADIR@/nis.schema ++include @SCHEMADIR@/openldap.schema ++# ++include @SCHEMADIR@/duaconf.schema ++include @SCHEMADIR@/dyngroup.schema ++include @SCHEMADIR@/ppolicy.schema ++ ++# ++pidfile @TESTDIR@/slapd.1.pid ++argsfile @TESTDIR@/slapd.1.args ++ ++# SSL configuration ++TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key ++TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt ++ ++# ++rootdse @DATADIR@/rootdse.ldif ++ ++#mod#modulepath ../servers/slapd/back-@BACKEND@/ ++#mod#moduleload back_@BACKEND@.la ++#monitormod#modulepath ../servers/slapd/back-monitor/ ++#monitormod#moduleload back_monitor.la ++ ++####################################################################### ++# database definitions ++####################################################################### ++ ++database @BACKEND@ ++suffix "dc=example,dc=com" ++rootdn "cn=Manager,dc=example,dc=com" ++rootpw secret ++#~null~#directory @TESTDIR@/db.1.a ++#indexdb#index objectClass eq ++#indexdb#index mail eq ++#ndb#dbname db_1_a ++#ndb#include @DATADIR@/ndb.conf ++ ++#monitor#database monitor +diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt +new file mode 100644 +index 000000000..7458e7461 +--- /dev/null ++++ b/tests/data/tls/ca/certs/testsuiteCA.crt +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV ++BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv ++bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0 ++NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB ++MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB ++UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd ++rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb ++lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL ++6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU ++7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB ++SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/ ++wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws ++ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q ++aL52EFPS0o3tiAJXS82U2wrQdJ0YEw== ++-----END CERTIFICATE----- +diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key +new file mode 100644 +index 000000000..2e14d7033 +--- /dev/null ++++ b/tests/data/tls/ca/private/testsuiteCA.key +@@ -0,0 +1,16 @@ ++-----BEGIN PRIVATE KEY----- ++MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ ++WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc ++338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/ ++dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg ++O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf ++7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn ++rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f ++wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk ++AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l ++vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9 ++27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X ++KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N ++I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL +++b2qljWeZbGH ++-----END PRIVATE KEY----- +diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +new file mode 100644 +index 000000000..93e3a0d39 +--- /dev/null ++++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV ++BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx ++ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV ++BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD ++VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa ++YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A ++MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg ++QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU ++U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL ++MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn ++wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f ++7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo ++4DnnYQBDnq48VORVX94= ++-----END CERTIFICATE----- +diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt +new file mode 100644 +index 000000000..194cb119d +--- /dev/null ++++ b/tests/data/tls/certs/localhost.crt +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV ++BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx ++ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE ++CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT ++dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB ++iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4 ++7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv ++8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ ++BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A ++AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG ++8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl ++0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR ++GjeZB1FxqDGHjxBq2O828iejw28bSz4= ++-----END CERTIFICATE----- +diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf +new file mode 100644 +index 000000000..a3c8ad9f6 +--- /dev/null ++++ b/tests/data/tls/conf/openssl.cnf +@@ -0,0 +1,129 @@ ++HOME = . ++RANDFILE = $ENV::HOME/.rnd ++ ++oid_section = new_oids ++ ++[ new_oids ] ++tsa_policy1 = 1.2.3.4.1 ++tsa_policy2 = 1.2.3.4.5.6 ++tsa_policy3 = 1.2.3.4.5.7 ++ ++[ ca ] ++default_ca = CA_default # The default ca section ++ ++[ CA_default ] ++ ++dir = ./cruft # Where everything is kept ++certs = $dir/certs # Where the issued certs are kept ++crl_dir = $dir/crl # Where the issued crl are kept ++database = $dir/index.txt # database index file. ++new_certs_dir = $dir/certs # default place for new certs. ++certificate = $dir/cacert.pem # The CA certificate ++serial = $dir/serial # The current serial number ++crlnumber = $dir/crlnumber # the current crl number ++crl = $dir/crl.pem # The current CRL ++private_key = $dir/private/cakey.pem# The private key ++RANDFILE = $dir/private/.rand # private random number file ++x509_extensions = usr_cert # The extentions to add to the cert ++name_opt = ca_default # Subject Name options ++cert_opt = ca_default # Certificate field options ++default_days = 365 # how long to certify for ++default_crl_days= 30 # how long before next CRL ++default_md = default # use public key default MD ++preserve = no # keep passed DN ordering ++policy = policy_match ++ ++[ policy_match ] ++countryName = match ++stateOrProvinceName = match ++organizationName = match ++organizationalUnitName = optional ++commonName = supplied ++emailAddress = optional ++ ++[ policy_anything ] ++countryName = optional ++stateOrProvinceName = optional ++localityName = optional ++organizationName = optional ++organizationalUnitName = optional ++commonName = supplied ++emailAddress = optional ++ ++[ req ] ++default_bits = 2048 ++default_keyfile = privkey.pem ++distinguished_name = req_distinguished_name ++attributes = req_attributes ++x509_extensions = v3_ca # The extentions to add to the self signed cert ++ ++string_mask = utf8only ++ ++[ req_distinguished_name ] ++basicConstraints=CA:FALSE ++ ++[ req_attributes ] ++challengePassword = A challenge password ++challengePassword_min = 4 ++challengePassword_max = 20 ++ ++unstructuredName = An optional company name ++ ++[ usr_cert ] ++ ++basicConstraints=CA:FALSE ++nsComment = "OpenSSL Generated Certificate" ++ ++subjectKeyIdentifier=hash ++authorityKeyIdentifier=keyid,issuer ++ ++[ v3_req ] ++ ++basicConstraints = CA:FALSE ++keyUsage = nonRepudiation, digitalSignature, keyEncipherment ++subjectAltName = DNS:localhost,IP:127.0.0.1,IP:::1 ++ ++[ v3_ca ] ++subjectKeyIdentifier=hash ++authorityKeyIdentifier=keyid:always,issuer ++basicConstraints = CA:true ++ ++[ crl_ext ] ++ ++authorityKeyIdentifier=keyid:always ++ ++[ proxy_cert_ext ] ++basicConstraints=CA:FALSE ++nsComment = "OpenSSL Generated Certificate" ++ ++subjectKeyIdentifier=hash ++authorityKeyIdentifier=keyid,issuer ++proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo ++ ++[ tsa ] ++ ++default_tsa = tsa_config1 # the default TSA section ++ ++[ tsa_config1 ] ++ ++dir = ./demoCA # TSA root directory ++serial = $dir/tsaserial # The current serial number (mandatory) ++crypto_device = builtin # OpenSSL engine to use for signing ++signer_cert = $dir/tsacert.pem # The TSA signing certificate ++ # (optional) ++certs = $dir/cacert.pem # Certificate chain to include in reply ++ # (optional) ++signer_key = $dir/private/tsakey.pem # The TSA private key (optional) ++ ++default_policy = tsa_policy1 # Policy if request did not specify it ++ # (optional) ++other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) ++digests = md5, sha1 # Acceptable message digests (mandatory) ++accuracy = secs:1, millisecs:500, microsecs:100 # (optional) ++clock_precision_digits = 0 # number of digits after dot. (optional) ++ordering = yes # Is ordering defined for timestamps? ++ # (optional, default: no) ++tsa_name = yes # Must the TSA name be included in the reply? ++ # (optional, default: no) ++ess_cert_id_chain = no # Must the ESS cert id chain be included? ++ # (optional, default: no) +diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh +new file mode 100755 +index 000000000..8c33a24fe +--- /dev/null ++++ b/tests/data/tls/create-crt.sh +@@ -0,0 +1,78 @@ ++#!/bin/sh ++openssl=$(which openssl) ++ ++if [ x"$openssl" = "x" ]; then ++echo "OpenSSL command line binary not found, skipping..." ++fi ++ ++USAGE="$0 [-s] [-u ]" ++SERVER=0 ++USER=0 ++EMAIL= ++ ++while test $# -gt 0 ; do ++ case "$1" in ++ -s | -server) ++ SERVER=1; ++ shift;; ++ -u | -user) ++ if [ x"$2" = "x" ]; then ++ echo "User cert requires an email address as an argument" ++ exit; ++ fi ++ USER=1; ++ EMAIL="$2"; ++ shift; shift;; ++ -) ++ shift;; ++ -*) ++ echo "$USAGE"; exit 1 ++ ;; ++ *) ++ break;; ++ esac ++done ++ ++if [ $SERVER = 0 -a $USER = 0 ]; then ++ echo "$USAGE"; ++ exit 1; ++fi ++ ++rm -rf ./openssl.cnf cruft ++mkdir -p private certs cruft/private cruft/certs ++ ++echo "00" > cruft/serial ++touch cruft/index.txt ++touch cruft/index.txt.attr ++hn=$(hostname -f) ++sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf > ./openssl.cnf ++ ++if [ $SERVER = 1 ]; then ++ rm -rf private/localhost.key certs/localhost.crt ++ ++ $openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \ ++ -newkey rsa:1024 -config ./openssl.cnf \ ++ -subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \ ++ -batch > /dev/null 2>&1 ++ ++ $openssl ca -out certs/localhost.crt -notext -config ./openssl.cnf -days 183000 -in localhost.csr \ ++ -keyfile ca/private/testsuiteCA.key -extensions v3_req -cert ca/certs/testsuiteCA.crt \ ++ -batch >/dev/null 2>&1 ++ ++ rm -rf ./openssl.cnf ./localhost.csr cruft ++fi ++ ++if [ $USER = 1 ]; then ++ rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr ++ ++ $openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \ ++ -newkey rsa:1024 -config ./openssl.cnf \ ++ -subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \ ++ -batch >/dev/null 2>&1 ++ ++ $openssl ca -out certs/$EMAIL.crt -notext -config ./openssl.cnf -days 183000 -in $EMAIL.csr \ ++ -keyfile ca/private/testsuiteCA.key -extensions req_distinguished_name \ ++ -cert ca/certs/testsuiteCA.crt -batch >/dev/null 2>&1 ++ ++ rm -rf ./openssl.cnf ./$EMAIL.csr cruft ++fi +diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key +new file mode 100644 +index 000000000..5f4625fd7 +--- /dev/null ++++ b/tests/data/tls/private/bjensen@mailgw.example.com.key +@@ -0,0 +1,16 @@ ++-----BEGIN PRIVATE KEY----- ++MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2 ++xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4 ++9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z ++yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r ++oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e ++nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg ++xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra ++EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd ++9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/ ++pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI ++tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ ++3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D ++tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg ++36Ixj3L+5H18 ++-----END PRIVATE KEY----- +diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key +new file mode 100644 +index 000000000..8a24f69f8 +--- /dev/null ++++ b/tests/data/tls/private/localhost.key +@@ -0,0 +1,16 @@ ++-----BEGIN PRIVATE KEY----- ++MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg ++ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM ++w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM ++brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij ++Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf ++2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ ++bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q ++1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf ++3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U ++VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7 ++TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b ++iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP ++5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3 ++b61hkjQZfbEg5cg= ++-----END PRIVATE KEY----- +diff --git a/tests/run.in b/tests/run.in +index a542eedec..468c3e1f2 100644 +--- a/tests/run.in ++++ b/tests/run.in +@@ -56,6 +56,7 @@ AC_valsort=valsort@BUILD_VALSORT@ + # misc + AC_WITH_SASL=@WITH_SASL@ + AC_WITH_TLS=@WITH_TLS@ ++AC_TLS_TYPE=@WITH_TLS_TYPE@ + AC_WITH_MODULES_ENABLED=@WITH_MODULES_ENABLED@ + AC_ACI_ENABLED=aci@WITH_ACI_ENABLED@ + AC_THREADS=threads@BUILD_THREAD@ +@@ -74,7 +75,7 @@ export AC_bdb AC_hdb AC_ldap AC_mdb AC_meta AC_monitor AC_null AC_relay AC_sql \ + AC_refint AC_retcode AC_rwm AC_unique AC_syncprov AC_translucent \ + AC_valsort \ + AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED AC_ACI_ENABLED \ +- AC_THREADS AC_LIBS_DYNAMIC ++ AC_THREADS AC_LIBS_DYNAMIC AC_WITH_TLS AC_TLS_TYPE + + if test ! -x ../servers/slapd/slapd ; then + echo "Could not locate slapd(8)" +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index b374cc500..8f7c7b853 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -45,6 +45,9 @@ VALSORT=${AC_valsort-valsortno} + # misc + WITH_SASL=${AC_WITH_SASL-no} + USE_SASL=${SLAPD_USE_SASL-no} ++WITH_TLS=${AC_WITH_TLS-no} ++WITH_TLS_TYPE=${AC_TLS_TYPE-no} ++ + ACI=${AC_ACI_ENABLED-acino} + THREADS=${AC_THREADS-threadsno} + SLEEP0=${SLEEP0-1} +@@ -103,6 +106,8 @@ P2SRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist2.conf + P3SRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist3.conf + REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf + SCHEMACONF=$DATADIR/slapd-schema.conf ++TLSCONF=$DATADIR/slapd-tls.conf ++TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf + GLUECONF=$DATADIR/slapd-glue.conf + REFINTCONF=$DATADIR/slapd-refint.conf + RETCODECONF=$DATADIR/slapd-retcode.conf +@@ -163,6 +168,7 @@ SLURPLOG=$TESTDIR/slurp.log + CONFIGPWF=$TESTDIR/configpw + + # args ++SASLARGS="-Q" + TOOLARGS="-x $LDAP_TOOLARGS" + TOOLPROTO="-P 3" + +@@ -184,7 +190,8 @@ BCMP="diff -iB" + CMPOUT=/dev/null + SLAPD="$TESTWD/../servers/slapd/slapd -s0" + LDAPPASSWD="$CLIENTDIR/ldappasswd $TOOLARGS" +-LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $LDAP_TOOLARGS -LLL" ++LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $SASLARGS $TOOLPROTO $LDAP_TOOLARGS -LLL" ++LDAPSASLWHOAMI="$CLIENTDIR/ldapwhoami $SASLARGS $LDAP_TOOLARGS" + LDAPSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS -LLL" + LDAPRSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS" + LDAPDELETE="$CLIENTDIR/ldapdelete $TOOLPROTO $TOOLARGS" +@@ -199,6 +206,7 @@ LDIFFILTER=$PROGDIR/ldif-filter + SLAPDMTREAD=$PROGDIR/slapd-mtread + LVL=${SLAPD_DEBUG-0x4105} + LOCALHOST=localhost ++LOCALIP=127.0.0.1 + BASEPORT=${SLAPD_BASEPORT-9010} + PORT1=`expr $BASEPORT + 1` + PORT2=`expr $BASEPORT + 2` +@@ -207,11 +215,22 @@ PORT4=`expr $BASEPORT + 4` + PORT5=`expr $BASEPORT + 5` + PORT6=`expr $BASEPORT + 6` + URI1="ldap://${LOCALHOST}:$PORT1/" ++URIP1="ldap://${LOCALIP}:$PORT1/" + URI2="ldap://${LOCALHOST}:$PORT2/" ++URIP2="ldap://${LOCALIP}:$PORT2/" + URI3="ldap://${LOCALHOST}:$PORT3/" ++URIP3="ldap://${LOCALIP}:$PORT3/" + URI4="ldap://${LOCALHOST}:$PORT4/" + URI5="ldap://${LOCALHOST}:$PORT5/" + URI6="ldap://${LOCALHOST}:$PORT6/" ++SURI1="ldaps://${LOCALHOST}:$PORT1/" ++SURIP1="ldaps://${LOCALIP}:$PORT1/" ++SURI2="ldaps://${LOCALHOST}:$PORT2/" ++SURIP2="ldaps://${LOCALIP}:$PORT2/" ++SURI3="ldaps://${LOCALHOST}:$PORT3/" ++SURI4="ldaps://${LOCALHOST}:$PORT4/" ++SURI5="ldaps://${LOCALHOST}:$PORT5/" ++SURI6="ldaps://${LOCALHOST}:$PORT6/" + + # LDIF + LDIF=$DATADIR/test.ldif +diff --git a/tests/scripts/test067-tls b/tests/scripts/test067-tls +new file mode 100755 +index 000000000..2b245f5f5 +--- /dev/null ++++ b/tests/scripts/test067-tls +@@ -0,0 +1,140 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++mkdir -p $TESTDIR $DBDIR1 ++cp -r $DATADIR/tls $TESTDIR ++ ++cd $TESTWD ++ ++echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." ++. $CONFFILTER $BACKEND $MONITORDB < $TLSCONF > $CONF1 ++$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID" ++ ++sleep 1 ++ ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $URI1 \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo -n "Using ldapsearch with startTLS with no server cert validation...." ++$LDAPSEARCH -o tls_reqcert=never -ZZ -b "" -s base -H $URIP1 \ ++ '@extensibleObject' > $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (startTLS) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Using ldapsearch with startTLS with hard require cert...." ++$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -ZZ -b "" -s base -H $URIP1 \ ++ '@extensibleObject' > $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (startTLS) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++if test $WITH_TLS_TYPE = openssl ; then ++ echo -n "Using ldapsearch with startTLS and specific protocol version...." ++ $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -o tls_protocol_min=3.3 -ZZ -b "" -s base -H $URIP1 \ ++ '@extensibleObject' > $SEARCHOUT 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapsearch (protocol-min) failed ($RC)!" ++ exit $RC ++ else ++ echo "success" ++ fi ++fi ++ ++echo -n "Using ldapsearch on $SURI2 with no server cert validation..." ++$LDAPSEARCH -o tls_reqcert=never -b "cn=Subschema" -s base -H $SURIP2 \ ++ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ ++ >> $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (ldaps) failed($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Using ldapsearch on $SURI2 with reqcert HARD and no CA cert. Should fail..." ++$LDAPSEARCH -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ ++ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ ++ >> $SEARCHOUT 2>&1 ++RC=$? ++if test $RC = 0 ; then ++ echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!" ++ exit 1 ++else ++ echo "failed correctly with error code ($RC)" ++fi ++ ++echo -n "Using ldapsearch on $SURI2 with CA cert and reqcert HARD..." ++$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ ++ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ ++ >> $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (ldaps) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++if test $RC != 0 ; then ++ echo ">>>>> Test failed" ++else ++ echo ">>>>> Test succeeded" ++ RC=0 ++fi ++ ++test $KILLSERVERS != no && wait ++ ++exit $RC +diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external +new file mode 100755 +index 000000000..dcbc50fd4 +--- /dev/null ++++ b/tests/scripts/test068-sasl-tls-external +@@ -0,0 +1,102 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++mkdir -p $TESTDIR $DBDIR1 ++cp -r $DATADIR/tls $TESTDIR ++ ++cd $TESTWD ++ ++echo "Running slapadd to build slapd database..." ++. $CONFFILTER $BACKEND $MONITORDB < $TLSSASLCONF > $CONF1 ++$SLAPADD -f $CONF1 -l $LDIFORDERED ++RC=$? ++if test $RC != 0 ; then ++ echo "slapadd failed ($RC)!" ++ exit $RC ++fi ++ ++echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." ++$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID" ++ ++sleep 1 ++ ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $URI1 \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo -n "Using ldapwhoami with SASL/EXTERNAL...." ++$LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \ ++ -o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key -ZZ -Y EXTERNAL -H $URIP1 \ ++ > $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapwhoami (startTLS) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Validating mapped SASL ID..." ++echo 'dn:cn=barbara jensen,ou=information technology division,ou=people,dc=example,dc=com' > $TESTDIR/dn.out ++$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT ++ ++RC=$? ++if test $RC != 0 ; then ++ echo "Comparison failed" ++ test $KILLSERVERS != no && kill -HUP $PID ++ exit $RC ++else ++ echo "success" ++fi ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++if test $RC != 0 ; then ++ echo ">>>>> Test failed" ++else ++ echo ">>>>> Test succeeded" ++ RC=0 ++fi ++ ++test $KILLSERVERS != no && wait ++ ++exit $RC +diff --git a/tests/scripts/test069-delta-multimaster-starttls b/tests/scripts/test069-delta-multimaster-starttls +new file mode 100755 +index 000000000..2dfbb30a1 +--- /dev/null ++++ b/tests/scripts/test069-delta-multimaster-starttls +@@ -0,0 +1,574 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++if test $SYNCPROV = syncprovno; then ++ echo "Syncrepl provider overlay not available, test skipped" ++ exit 0 ++fi ++if test $ACCESSLOG = accesslogno; then ++ echo "Accesslog overlay not available, test skipped" ++ exit 0 ++fi ++ ++MMR=2 ++ ++XDIR=$TESTDIR/srv ++TMP=$TESTDIR/tmp ++ ++mkdir -p $TESTDIR ++cp -r $DATADIR/tls $TESTDIR ++ ++$SLAPPASSWD -g -n >$CONFIGPWF ++ ++if test x"$SYNCMODE" = x ; then ++ SYNCMODE=rp ++fi ++case "$SYNCMODE" in ++ ro) ++ SYNCTYPE="type=refreshOnly interval=00:00:00:03" ++ ;; ++ rp) ++ SYNCTYPE="type=refreshAndPersist interval=00:00:00:03" ++ ;; ++ *) ++ echo "unknown sync mode $SYNCMODE" ++ exit 1; ++ ;; ++esac ++ ++# ++# Test delta-sync mmr ++# - start servers ++# - configure over ldap ++# - populate over ldap ++# - configure syncrepl over ldap ++# - break replication ++# - modify each server separately ++# - restore replication ++# - compare results ++# ++ ++nullExclude="" ++test $BACKEND = null && nullExclude="# " ++ ++KILLPIDS= ++ ++echo "Initializing server configurations..." ++n=1 ++while [ $n -le $MMR ]; do ++ ++DBDIR=${XDIR}$n/db ++CFDIR=${XDIR}$n/slapd.d ++ ++mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR ++ ++o=`expr 3 - $n` ++cat > $TMP <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/overlays ++EOF ++ if [ "$SYNCPROV" = syncprovmod ]; then ++ echo "olcModuleLoad: syncprov.la" >> $TMP ++ fi ++ if [ "$ACCESSLOG" = accesslogmod ]; then ++ echo "olcModuleLoad: accesslog.la" >> $TMP ++ fi ++ echo "" >> $TMP ++fi ++ ++if [ "$BACKENDTYPE" = mod ]; then ++cat <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND ++olcModuleLoad: back_$BACKEND.la ++ ++EOF ++fi ++MYURI=`eval echo '$URI'$n` ++PROVIDERURI=`eval echo '$URIP'$o` ++if test $INDEXDB = indexdb ; then ++INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq" ++INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq" ++else ++INDEX1= ++INDEX2= ++fi ++cat >> $TMP < $TESTOUT 2>&1 ++PORT=`eval echo '$PORT'$n` ++echo "Starting server $n on TCP/IP port $PORT..." ++cd ${XDIR}${n} ++LOG=`eval echo '$LOG'$n` ++$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID $KILLPIDS" ++cd $TESTWD ++ ++echo "Using ldapsearch to check that server $n is running..." ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $MYURI \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++if [ $n = 1 ]; then ++echo "Using ldapadd for context on server 1..." ++$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++fi ++ ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 1..." ++$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDNOCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++sleep $SLEEP1 ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldap://${LOCALHOST}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 2..." ++$LDAPADD -D "$MANAGERDN" -H $URI2 -w $PASSWD -f $LDIFADD1 \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" ++sleep 1 ++for i in 1 2 3; do ++ $LDAPSEARCH -S "" -b "$THEDN" -H $URI1 \ ++ -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 ++ RC=$? ++ ++ if test $RC = 0 ; then ++ break ++ fi ++ ++ if test $RC != 32 ; then ++ echo "ldapsearch failed at slave ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ ++ echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++ sleep $SLEEP1 ++done ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldap://${LOCALHOST}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Breaking replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$URI'$n` ++PROVIDERURI=`eval echo '$URIP'$o` ++$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Amazing ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Stupendous ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: Outstanding ++- ++add: description ++description: Mindboggling ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: OutStanding ++- ++add: description ++description: Bizarre ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: carLicense ++carLicense: 123-XYZ ++- ++add: employeeNumber ++employeeNumber: 32 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: employeeType ++employeeType: deadwood ++- ++add: employeeNumber ++employeeNumber: 64 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++replace: sn ++sn: Replaced later ++- ++replace: sn ++sn: Surname ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Restoring replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$URI'$n` ++PROVIDERURI=`eval echo '$URIP'$o` ++$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 < $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++echo ">>>>> Test succeeded" ++ ++test $KILLSERVERS != no && wait ++ ++exit 0 +diff --git a/tests/scripts/test070-delta-multimaster-ldaps b/tests/scripts/test070-delta-multimaster-ldaps +new file mode 100755 +index 000000000..1024640ef +--- /dev/null ++++ b/tests/scripts/test070-delta-multimaster-ldaps +@@ -0,0 +1,571 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++if test $SYNCPROV = syncprovno; then ++ echo "Syncrepl provider overlay not available, test skipped" ++ exit 0 ++fi ++if test $ACCESSLOG = accesslogno; then ++ echo "Accesslog overlay not available, test skipped" ++ exit 0 ++fi ++ ++MMR=2 ++ ++XDIR=$TESTDIR/srv ++TMP=$TESTDIR/tmp ++ ++mkdir -p $TESTDIR ++cp -r $DATADIR/tls $TESTDIR ++ ++$SLAPPASSWD -g -n >$CONFIGPWF ++ ++if test x"$SYNCMODE" = x ; then ++ SYNCMODE=rp ++fi ++case "$SYNCMODE" in ++ ro) ++ SYNCTYPE="type=refreshOnly interval=00:00:00:03" ++ ;; ++ rp) ++ SYNCTYPE="type=refreshAndPersist interval=00:00:00:03" ++ ;; ++ *) ++ echo "unknown sync mode $SYNCMODE" ++ exit 1; ++ ;; ++esac ++ ++# ++# Test delta-sync mmr ++# - start servers ++# - configure over ldap ++# - populate over ldap ++# - configure syncrepl over ldap ++# - break replication ++# - modify each server separately ++# - restore replication ++# - compare results ++# ++ ++nullExclude="" ++test $BACKEND = null && nullExclude="# " ++ ++KILLPIDS= ++ ++echo "Initializing server configurations..." ++n=1 ++while [ $n -le $MMR ]; do ++ ++DBDIR=${XDIR}$n/db ++CFDIR=${XDIR}$n/slapd.d ++ ++mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR ++ ++o=`expr 3 - $n` ++cat > $TMP <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/overlays ++EOF ++ if [ "$SYNCPROV" = syncprovmod ]; then ++ echo "olcModuleLoad: syncprov.la" >> $TMP ++ fi ++ if [ "$ACCESSLOG" = accesslogmod ]; then ++ echo "olcModuleLoad: accesslog.la" >> $TMP ++ fi ++ echo "" >> $TMP ++fi ++ ++if [ "$BACKENDTYPE" = mod ]; then ++cat <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND ++olcModuleLoad: back_$BACKEND.la ++ ++EOF ++fi ++MYURI=`eval echo '$SURIP'$n` ++PROVIDERURI=`eval echo '$SURIP'$o` ++if test $INDEXDB = indexdb ; then ++INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq" ++INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq" ++else ++INDEX1= ++INDEX2= ++fi ++cat >> $TMP < $TESTOUT 2>&1 ++PORT=`eval echo '$PORT'$n` ++echo "Starting server $n on TCP/IP port $PORT..." ++cd ${XDIR}${n} ++LOG=`eval echo '$LOG'$n` ++$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID $KILLPIDS" ++cd $TESTWD ++ ++echo "Using ldapsearch to check that server $n is running..." ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -s base -b "" -H $MYURI \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++if [ $n = 1 ]; then ++echo "Using ldapadd for context on server 1..." ++$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++fi ++ ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 1..." ++$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDNOCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++sleep $SLEEP1 ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldaps://${LOCALIP}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -b "$BASEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 2..." ++$LDAPADD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD -f $LDIFADD1 \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" ++sleep 1 ++for i in 1 2 3; do ++ $LDAPSEARCH -S "" -b "$THEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $SURIP1 \ ++ -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 ++ RC=$? ++ ++ if test $RC = 0 ; then ++ break ++ fi ++ ++ if test $RC != 32 ; then ++ echo "ldapsearch failed at slave ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ ++ echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++ sleep $SLEEP1 ++done ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldaps://${LOCALIP}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Breaking replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$SURIP'$n` ++PROVIDERURI=`eval echo '$SURIP'$o` ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Amazing ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Stupendous ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: Outstanding ++- ++add: description ++description: Mindboggling ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: OutStanding ++- ++add: description ++description: Bizarre ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: carLicense ++carLicense: 123-XYZ ++- ++add: employeeNumber ++employeeNumber: 32 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: employeeType ++employeeType: deadwood ++- ++add: employeeNumber ++employeeNumber: 64 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++replace: sn ++sn: Replaced later ++- ++replace: sn ++sn: Surname ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Restoring replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$SURIP'$n` ++PROVIDERURI=`eval echo '$SURIP'$o` ++$LDAPMODIFY -D cn=config -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 < $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++echo ">>>>> Test succeeded" ++ ++test $KILLSERVERS != no && wait ++ ++exit 0 +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch b/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch new file mode 100644 index 0000000..d86a707 --- /dev/null +++ b/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch @@ -0,0 +1,582 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From 8a259e3df16def3f05828f355e98a5089cd6e6d0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Thu, 14 Jun 2018 16:14:15 +0100 +Subject: [PATCH] ITS#8573 allow all libldap options in tools -o option + +--- + clients/tools/common.c | 15 ++- + doc/devel/args | 2 +- + doc/man/man1/ldapcompare.1 | 9 +- + doc/man/man1/ldapdelete.1 | 9 +- + doc/man/man1/ldapexop.1 | 9 +- + doc/man/man1/ldapmodify.1 | 9 +- + doc/man/man1/ldapmodrdn.1 | 9 +- + doc/man/man1/ldappasswd.1 | 9 +- + doc/man/man1/ldapsearch.1 | 9 +- + doc/man/man1/ldapwhoami.1 | 13 ++- + doc/man/man8/slapcat.8 | 2 +- + include/ldap_pvt.h | 5 + + libraries/libldap/init.c | 231 ++++++++++++++++++++++--------------- + servers/slapd/slapcommon.c | 5 +- + 14 files changed, 200 insertions(+), 136 deletions(-) + +diff --git a/clients/tools/common.c b/clients/tools/common.c +index 39db70b93..d5c3491fc 100644 +--- a/clients/tools/common.c ++++ b/clients/tools/common.c +@@ -351,9 +351,9 @@ N_(" -I use SASL Interactive mode\n"), + N_(" -n show what would be done but don't actually do it\n"), + N_(" -N do not use reverse DNS to canonicalize SASL host name\n"), + N_(" -O props SASL security properties\n"), +-N_(" -o [=] general options\n"), ++N_(" -o [=] any libldap ldap.conf options, plus\n"), ++N_(" ldif_wrap= (in columns, or \"no\" for no wrapping)\n"), + N_(" nettimeout= (in seconds, or \"none\" or \"max\")\n"), +-N_(" ldif-wrap= (in columns, or \"no\" for no wrapping)\n"), + N_(" -p port port on LDAP server\n"), + N_(" -Q use SASL Quiet mode\n"), + N_(" -R realm SASL realm\n"), +@@ -785,6 +785,11 @@ tool_args( int argc, char **argv ) + if ( (cvalue = strchr( control, '=' )) != NULL ) { + *cvalue++ = '\0'; + } ++ for ( next=control; *next; next++ ) { ++ if ( *next == '-' ) { ++ *next = '_'; ++ } ++ } + + if ( strcasecmp( control, "nettimeout" ) == 0 ) { + if( nettimeout.tv_sec != -1 ) { +@@ -814,7 +819,7 @@ tool_args( int argc, char **argv ) + exit( EXIT_FAILURE ); + } + +- } else if ( strcasecmp( control, "ldif-wrap" ) == 0 ) { ++ } else if ( strcasecmp( control, "ldif_wrap" ) == 0 ) { + if ( cvalue == 0 ) { + ldif_wrap = LDIF_LINE_WIDTH; + +@@ -825,13 +830,13 @@ tool_args( int argc, char **argv ) + unsigned int u; + if ( lutil_atou( &u, cvalue ) ) { + fprintf( stderr, +- _("Unable to parse ldif-wrap=\"%s\"\n"), cvalue ); ++ _("Unable to parse ldif_wrap=\"%s\"\n"), cvalue ); + exit( EXIT_FAILURE ); + } + ldif_wrap = (ber_len_t)u; + } + +- } else { ++ } else if ( ldap_pvt_conf_option( control, cvalue, 1 ) ) { + fprintf( stderr, "Invalid general option name: %s\n", + control ); + usage(); +diff --git a/doc/devel/args b/doc/devel/args +index 7805eff1c..31c22f948 100644 +--- a/doc/devel/args ++++ b/doc/devel/args +@@ -27,7 +27,7 @@ ldapwhoami * DE**HI** NO QR UVWXYZ def*h*** *nop* vwxy + -h host + -n no-op + -N no (SASLprep) normalization of simple bind password +- -o general options (currently nettimeout and ldif-wrap only) ++ -o general libldap options (plus ldif_wrap and nettimeout for backwards comp.) + -p port + -v verbose + -V version +diff --git a/doc/man/man1/ldapcompare.1 b/doc/man/man1/ldapcompare.1 +index 667815a26..de90498db 100644 +--- a/doc/man/man1/ldapcompare.1 ++++ b/doc/man/man1/ldapcompare.1 +@@ -186,13 +186,14 @@ Compare extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapdelete.1 b/doc/man/man1/ldapdelete.1 +index 9e7036230..872424a65 100644 +--- a/doc/man/man1/ldapdelete.1 ++++ b/doc/man/man1/ldapdelete.1 +@@ -192,13 +192,14 @@ Delete extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapexop.1 b/doc/man/man1/ldapexop.1 +index 5f5ae7aae..96a7c514e 100644 +--- a/doc/man/man1/ldapexop.1 ++++ b/doc/man/man1/ldapexop.1 +@@ -189,13 +189,14 @@ Specify general extensions. \'!\' indicates criticality. + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 +index f884c5bfb..90f813506 100644 +--- a/doc/man/man1/ldapmodify.1 ++++ b/doc/man/man1/ldapmodify.1 +@@ -255,13 +255,14 @@ Modify extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR]] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapmodrdn.1 b/doc/man/man1/ldapmodrdn.1 +index fa9eac627..900ba7e0e 100644 +--- a/doc/man/man1/ldapmodrdn.1 ++++ b/doc/man/man1/ldapmodrdn.1 +@@ -186,13 +186,14 @@ Modrdn extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldappasswd.1 b/doc/man/man1/ldappasswd.1 +index d3f45b082..bf273fb25 100644 +--- a/doc/man/man1/ldappasswd.1 ++++ b/doc/man/man1/ldappasswd.1 +@@ -188,13 +188,14 @@ Passwd Modify extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR]] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapsearch.1 b/doc/man/man1/ldapsearch.1 +index 196179232..901e56043 100644 +--- a/doc/man/man1/ldapsearch.1 ++++ b/doc/man/man1/ldapsearch.1 +@@ -332,13 +332,14 @@ Search extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapwhoami.1 b/doc/man/man1/ldapwhoami.1 +index b684de54a..79864c729 100644 +--- a/doc/man/man1/ldapwhoami.1 ++++ b/doc/man/man1/ldapwhoami.1 +@@ -143,13 +143,18 @@ WhoAmI extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ ++.B -o ++option that can be passed here, check ++.BR ldap.conf (5) ++for details. + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man8/slapcat.8 b/doc/man/man8/slapcat.8 +index d05cfa643..24c8f03ea 100644 +--- a/doc/man/man8/slapcat.8 ++++ b/doc/man/man8/slapcat.8 +@@ -149,7 +149,7 @@ Possible generic options/values are: + syslog\-level= (see `\-S' in slapd(8)) + syslog\-user= (see `\-l' in slapd(8)) + +- ldif-wrap={no|} ++ ldif_wrap={no|} + + .in + \fIn\fP is the number of columns allowed for the LDIF output +diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h +index 61c620785..c586a95b5 100644 +--- a/include/ldap_pvt.h ++++ b/include/ldap_pvt.h +@@ -321,6 +321,11 @@ struct ldapmsg; + LDAP_F ( int ) ldap_pvt_discard LDAP_P(( + struct ldap *ld, ber_int_t msgid )); + ++/* init.c */ ++LDAP_F( int ) ++ldap_pvt_conf_option LDAP_P(( ++ char *cmd, char *opt, int userconf )); ++ + /* messages.c */ + LDAP_F( BerElement * ) + ldap_get_message_ber LDAP_P(( +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 182ef7d7e..746824fbd 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -148,6 +148,141 @@ static const struct ol_attribute { + #define MAX_LDAP_ATTR_LEN sizeof("GSSAPI_ALLOW_REMOTE_PRINCIPAL") + #define MAX_LDAP_ENV_PREFIX_LEN 8 + ++static int ++ldap_int_conf_option( ++ struct ldapoptions *gopts, ++ char *cmd, char *opt, int userconf ) ++{ ++ int i; ++ ++ for(i=0; attrs[i].type != ATTR_NONE; i++) { ++ void *p; ++ ++ if( !userconf && attrs[i].useronly ) { ++ continue; ++ } ++ ++ if(strcasecmp(cmd, attrs[i].name) != 0) { ++ continue; ++ } ++ ++ switch(attrs[i].type) { ++ case ATTR_BOOL: ++ if((strcasecmp(opt, "on") == 0) ++ || (strcasecmp(opt, "yes") == 0) ++ || (strcasecmp(opt, "true") == 0)) ++ { ++ LDAP_BOOL_SET(gopts, attrs[i].offset); ++ ++ } else { ++ LDAP_BOOL_CLR(gopts, attrs[i].offset); ++ } ++ ++ break; ++ ++ case ATTR_INT: { ++ char *next; ++ long l; ++ p = &((char *) gopts)[attrs[i].offset]; ++ l = strtol( opt, &next, 10 ); ++ if ( next != opt && next[ 0 ] == '\0' ) { ++ * (int*) p = l; ++ } ++ } break; ++ ++ case ATTR_KV: { ++ const struct ol_keyvalue *kv; ++ ++ for(kv = attrs[i].data; ++ kv->key != NULL; ++ kv++) { ++ ++ if(strcasecmp(opt, kv->key) == 0) { ++ p = &((char *) gopts)[attrs[i].offset]; ++ * (int*) p = kv->value; ++ break; ++ } ++ } ++ } break; ++ ++ case ATTR_STRING: ++ p = &((char *) gopts)[attrs[i].offset]; ++ if (* (char**) p != NULL) LDAP_FREE(* (char**) p); ++ * (char**) p = LDAP_STRDUP(opt); ++ break; ++ case ATTR_OPTION: ++ ldap_set_option( NULL, attrs[i].offset, opt ); ++ break; ++ case ATTR_SASL: ++#ifdef HAVE_CYRUS_SASL ++ ldap_int_sasl_config( gopts, attrs[i].offset, opt ); ++#endif ++ break; ++ case ATTR_GSSAPI: ++#ifdef HAVE_GSSAPI ++ ldap_int_gssapi_config( gopts, attrs[i].offset, opt ); ++#endif ++ break; ++ case ATTR_TLS: ++#ifdef HAVE_TLS ++ ldap_int_tls_config( NULL, attrs[i].offset, opt ); ++#endif ++ break; ++ case ATTR_OPT_TV: { ++ struct timeval tv; ++ char *next; ++ tv.tv_usec = 0; ++ tv.tv_sec = strtol( opt, &next, 10 ); ++ if ( next != opt && next[ 0 ] == '\0' && tv.tv_sec > 0 ) { ++ (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&tv ); ++ } ++ } break; ++ case ATTR_OPT_INT: { ++ long l; ++ char *next; ++ l = strtol( opt, &next, 10 ); ++ if ( next != opt && next[ 0 ] == '\0' && l > 0 && (long)((int)l) == l ) { ++ int v = (int)l; ++ (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&v ); ++ } ++ } break; ++ } ++ ++ break; ++ } ++ ++ if ( attrs[i].type == ATTR_NONE ) { ++ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_config: " ++ "unknown option '%s'", ++ cmd, 0, 0 ); ++ return 1; ++ } ++ ++ return 0; ++} ++ ++int ++ldap_pvt_conf_option( ++ char *cmd, char *opt, int userconf ) ++{ ++ struct ldapoptions *gopts; ++ int rc = LDAP_OPT_ERROR; ++ ++ /* Get pointer to global option structure */ ++ gopts = LDAP_INT_GLOBAL_OPT(); ++ if (NULL == gopts) { ++ return LDAP_NO_MEMORY; ++ } ++ ++ if ( gopts->ldo_valid != LDAP_INITIALIZED ) { ++ ldap_int_initialize(gopts, NULL); ++ if ( gopts->ldo_valid != LDAP_INITIALIZED ) ++ return LDAP_LOCAL_ERROR; ++ } ++ ++ return ldap_int_conf_option( gopts, cmd, opt, userconf ); ++} ++ + static void openldap_ldap_init_w_conf( + const char *file, int userconf ) + { +@@ -213,101 +348,7 @@ static void openldap_ldap_init_w_conf( + while(isspace((unsigned char)*start)) start++; + opt = start; + +- for(i=0; attrs[i].type != ATTR_NONE; i++) { +- void *p; +- +- if( !userconf && attrs[i].useronly ) { +- continue; +- } +- +- if(strcasecmp(cmd, attrs[i].name) != 0) { +- continue; +- } +- +- switch(attrs[i].type) { +- case ATTR_BOOL: +- if((strcasecmp(opt, "on") == 0) +- || (strcasecmp(opt, "yes") == 0) +- || (strcasecmp(opt, "true") == 0)) +- { +- LDAP_BOOL_SET(gopts, attrs[i].offset); +- +- } else { +- LDAP_BOOL_CLR(gopts, attrs[i].offset); +- } +- +- break; +- +- case ATTR_INT: { +- char *next; +- long l; +- p = &((char *) gopts)[attrs[i].offset]; +- l = strtol( opt, &next, 10 ); +- if ( next != opt && next[ 0 ] == '\0' ) { +- * (int*) p = l; +- } +- } break; +- +- case ATTR_KV: { +- const struct ol_keyvalue *kv; +- +- for(kv = attrs[i].data; +- kv->key != NULL; +- kv++) { +- +- if(strcasecmp(opt, kv->key) == 0) { +- p = &((char *) gopts)[attrs[i].offset]; +- * (int*) p = kv->value; +- break; +- } +- } +- } break; +- +- case ATTR_STRING: +- p = &((char *) gopts)[attrs[i].offset]; +- if (* (char**) p != NULL) LDAP_FREE(* (char**) p); +- * (char**) p = LDAP_STRDUP(opt); +- break; +- case ATTR_OPTION: +- ldap_set_option( NULL, attrs[i].offset, opt ); +- break; +- case ATTR_SASL: +-#ifdef HAVE_CYRUS_SASL +- ldap_int_sasl_config( gopts, attrs[i].offset, opt ); +-#endif +- break; +- case ATTR_GSSAPI: +-#ifdef HAVE_GSSAPI +- ldap_int_gssapi_config( gopts, attrs[i].offset, opt ); +-#endif +- break; +- case ATTR_TLS: +-#ifdef HAVE_TLS +- ldap_int_tls_config( NULL, attrs[i].offset, opt ); +-#endif +- break; +- case ATTR_OPT_TV: { +- struct timeval tv; +- char *next; +- tv.tv_usec = 0; +- tv.tv_sec = strtol( opt, &next, 10 ); +- if ( next != opt && next[ 0 ] == '\0' && tv.tv_sec > 0 ) { +- (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&tv ); +- } +- } break; +- case ATTR_OPT_INT: { +- long l; +- char *next; +- l = strtol( opt, &next, 10 ); +- if ( next != opt && next[ 0 ] == '\0' && l > 0 && (long)((int)l) == l ) { +- int v = (int)l; +- (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&v ); +- } +- } break; +- } +- +- break; +- } ++ ldap_int_conf_option( gopts, cmd, opt, userconf ); + } + + fclose(fp); +diff --git a/servers/slapd/slapcommon.c b/servers/slapd/slapcommon.c +index 01574af1e..a62c69581 100644 +--- a/servers/slapd/slapcommon.c ++++ b/servers/slapd/slapcommon.c +@@ -228,7 +228,8 @@ parse_slapopt( int tool, int *mode ) + break; + } + +- } else if ( strncasecmp( optarg, "ldif-wrap", len ) == 0 ) { ++ } else if ( ( strncasecmp( optarg, "ldif_wrap", len ) == 0 ) || ++ ( strncasecmp( optarg, "ldif-wrap", len ) == 0 ) ) { + switch ( tool ) { + case SLAPCAT: + if ( strcasecmp( p, "no" ) == 0 ) { +@@ -237,7 +238,7 @@ parse_slapopt( int tool, int *mode ) + } else { + unsigned int u; + if ( lutil_atou( &u, p ) ) { +- Debug( LDAP_DEBUG_ANY, "unable to parse ldif-wrap=\"%s\".\n", p, 0, 0 ); ++ Debug( LDAP_DEBUG_ANY, "unable to parse ldif_wrap=\"%s\".\n", p, 0, 0 ); + return -1; + } + ldif_wrap = (ber_len_t)u; +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch b/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch new file mode 100644 index 0000000..31574ee --- /dev/null +++ b/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch @@ -0,0 +1,631 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From 3cd50fa8b32a21040a9892e2a8a7a9dfc7541ce6 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 14 Apr 2020 16:10:48 +0300 +Subject: [PATCH] ITS#9189 rework sasl-cbinding support + +Add LDAP_OPT_X_SASL_CBINDING option to define the binding type to use, +defaults to "none". + +Add "tls-endpoint" binding type implementing "tls-server-end-point" from +RCF 5929, which is compatible with Windows. + +Fix "tls-unique" to include the prefix in the bindings as per RFC 5056. +--- + doc/man/man3/ldap_get_option.3 | 16 ++++++ + doc/man/man5/ldap.conf.5 | 3 + + doc/man/man5/slapd-config.5 | 4 ++ + doc/man/man5/slapd.conf.5 | 3 + + include/ldap.h | 5 ++ + include/ldap_pvt.h | 5 ++ + libraries/libldap/cyrus.c | 101 +++++++++++++++++++++++++++++---- + libraries/libldap/init.c | 1 + + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/ldap-tls.h | 2 + + libraries/libldap/tls2.c | 7 +++ + libraries/libldap/tls_g.c | 59 +++++++++++++++++++ + libraries/libldap/tls_o.c | 45 +++++++++++++++ + servers/slapd/bconfig.c | 11 +++- + servers/slapd/config.c | 1 + + servers/slapd/connection.c | 9 +-- + servers/slapd/proto-slap.h | 4 +- + servers/slapd/sasl.c | 27 ++++++--- + 18 files changed, 274 insertions(+), 30 deletions(-) + +diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 +index 7546875f5..e953900ce 100644 +--- a/doc/man/man3/ldap_get_option.3 ++++ b/doc/man/man3/ldap_get_option.3 +@@ -557,6 +557,22 @@ must be a + .BR "char **" . + Its content needs to be freed by the caller using + .BR ldap_memfree (3). ++.B LDAP_OPT_X_SASL_CBINDING ++Sets/gets the channel-binding type to use in SASL, ++one of ++.BR LDAP_OPT_X_SASL_CBINDING_NONE ++(the default), ++.BR LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE ++the "tls-unique" type from RCF 5929. ++.BR LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT ++the "tls-server-end-point" from RCF 5929, compatible with Windows. ++.BR invalue ++must be ++.BR "const int *" ; ++.BR outvalue ++must be ++.BR "int *" . ++.TP + .SH TCP OPTIONS + The TCP options are OpenLDAP specific. + Mainly intended for use with Linux, they may not be portable. +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index adf134899..29810fc9f 100644 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -286,6 +286,9 @@ size allowed. 0 disables security layers. The default is 65536. + .TP + .B SASL_NOCANON + Do not perform reverse DNS lookups to canonicalize SASL host names. The default is off. ++.TP ++.B SASL_CBINDING ++The channel-binding type to use, see also LDAP_OPT_X_SASL_CBINDING. The default is none. + .SH GSSAPI OPTIONS + If OpenLDAP is built with Generic Security Services Application Programming Interface support, + there are more options you can specify. +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index 0dddfdb6c..8c987d8c1 100644 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -699,6 +699,10 @@ Used to specify the fully qualified domain name used for SASL processing. + .B olcSaslRealm: + Specify SASL realm. Default is empty. + .TP ++.B olcSaslCbinding: none | tls-unique | tls-endpoint ++Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. ++Default is none. ++.TP + .B olcSaslSecProps: + Used to specify Cyrus SASL security properties. + The +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index 0071072b1..203ab988e 100644 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -893,6 +893,9 @@ The + property specifies the maximum security layer receive buffer + size allowed. 0 disables security layers. The default is 65536. + .TP ++.B sasl\-cbinding none | tls-unique | tls-endpoint ++Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. ++.TP + .B schemadn + Specify the distinguished name for the subschema subentry that + controls the entries on this server. The default is "cn=Subschema". +diff --git a/include/ldap.h b/include/ldap.h +index 88bfcabf8..e8ac968a9 100644 +--- a/include/ldap.h ++++ b/include/ldap.h +@@ -180,6 +180,10 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_1 ((3 << 8) + 2) + #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 ((3 << 8) + 3) + ++#define LDAP_OPT_X_SASL_CBINDING_NONE 0 ++#define LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE 1 ++#define LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT 2 ++ + /* OpenLDAP SASL options */ + #define LDAP_OPT_X_SASL_MECH 0x6100 + #define LDAP_OPT_X_SASL_REALM 0x6101 +@@ -195,6 +199,7 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_SASL_NOCANON 0x610b + #define LDAP_OPT_X_SASL_USERNAME 0x610c /* read-only */ + #define LDAP_OPT_X_SASL_GSS_CREDS 0x610d ++#define LDAP_OPT_X_SASL_CBINDING 0x610e + + /* OpenLDAP GSSAPI options */ + #define LDAP_OPT_X_GSSAPI_DO_NOT_FREE_CONTEXT 0x6200 +diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h +index c586a95b5..b71552ec5 100644 +--- a/include/ldap_pvt.h ++++ b/include/ldap_pvt.h +@@ -262,6 +262,10 @@ LDAP_F (void *) ldap_pvt_sasl_mutex_new LDAP_P((void)); + LDAP_F (int) ldap_pvt_sasl_mutex_lock LDAP_P((void *mutex)); + LDAP_F (int) ldap_pvt_sasl_mutex_unlock LDAP_P((void *mutex)); + LDAP_F (void) ldap_pvt_sasl_mutex_dispose LDAP_P((void *mutex)); ++ ++LDAP_F (int) ldap_pvt_sasl_cbinding_parse LDAP_P(( const char *arg )); ++LDAP_F (void *) ldap_pvt_sasl_cbinding LDAP_P(( void *ssl, int type, ++ int is_server )); + #endif /* HAVE_CYRUS_SASL */ + + struct sockbuf; /* avoid pulling in */ +@@ -426,6 +430,7 @@ LDAP_F (int) ldap_pvt_tls_get_peer_dn LDAP_P(( void *ctx, struct berval *dn, + LDAPDN_rewrite_dummy *func, unsigned flags )); + LDAP_F (int) ldap_pvt_tls_get_strength LDAP_P(( void *ctx )); + LDAP_F (int) ldap_pvt_tls_get_unique LDAP_P(( void *ctx, struct berval *buf, int is_server )); ++LDAP_F (int) ldap_pvt_tls_get_endpoint LDAP_P(( void *ctx, struct berval *buf, int is_server )); + + LDAP_END_DECL + +diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c +index 3171d56a3..081e3cea5 100644 +--- a/libraries/libldap/cyrus.c ++++ b/libraries/libldap/cyrus.c +@@ -368,6 +368,65 @@ int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc ) + return LDAP_SUCCESS; + } + ++int ldap_pvt_sasl_cbinding_parse( const char *arg ) ++{ ++ int i = -1; ++ ++ if ( strcasecmp(arg, "none") == 0 ) ++ i = LDAP_OPT_X_SASL_CBINDING_NONE; ++ else if ( strcasecmp(arg, "tls-unique") == 0 ) ++ i = LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE; ++ else if ( strcasecmp(arg, "tls-endpoint") == 0 ) ++ i = LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT; ++ ++ return i; ++} ++ ++void *ldap_pvt_sasl_cbinding( void *ssl, int type, int is_server ) ++{ ++#if defined(SASL_CHANNEL_BINDING) && defined(HAVE_TLS) ++ char unique_prefix[] = "tls-unique:"; ++ char endpoint_prefix[] = "tls-server-end-point:"; ++ char cbinding[ 64 ]; ++ struct berval cbv = { 64, cbinding }; ++ void *cb_data; /* used since cb->data is const* */ ++ sasl_channel_binding_t *cb; ++ char *prefix; ++ int plen; ++ ++ switch (type) { ++ case LDAP_OPT_X_SASL_CBINDING_NONE: ++ return NULL; ++ case LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE: ++ if ( !ldap_pvt_tls_get_unique( ssl, &cbv, is_server )) ++ return NULL; ++ prefix = unique_prefix; ++ plen = sizeof(unique_prefix) -1; ++ break; ++ case LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT: ++ if ( !ldap_pvt_tls_get_endpoint( ssl, &cbv, is_server )) ++ return NULL; ++ prefix = endpoint_prefix; ++ plen = sizeof(endpoint_prefix) -1; ++ break; ++ default: ++ return NULL; ++ } ++ ++ cb = ldap_memalloc( sizeof(*cb) + plen + cbv.bv_len ); ++ cb->len = plen + cbv.bv_len; ++ cb->data = cb_data = cb+1; ++ memcpy( cb_data, prefix, plen ); ++ memcpy( cb_data + plen, cbv.bv_val, cbv.bv_len ); ++ cb->name = "ldap"; ++ cb->critical = 0; ++ ++ return cb; ++#else ++ return NULL; ++#endif ++} ++ + int + ldap_int_sasl_bind( + LDAP *ld, +@@ -497,17 +556,12 @@ ldap_int_sasl_bind( + (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac ); + LDAP_FREE( authid.bv_val ); + #ifdef SASL_CHANNEL_BINDING /* 2.1.25+ */ +- { +- char cbinding[64]; +- struct berval cbv = { sizeof(cbinding), cbinding }; +- if ( ldap_pvt_tls_get_unique( ssl, &cbv, 0 )) { +- sasl_channel_binding_t *cb = ldap_memalloc( sizeof(*cb) + +- cbv.bv_len); +- cb->name = "ldap"; +- cb->critical = 0; +- cb->data = (char *)(cb+1); +- cb->len = cbv.bv_len; +- memcpy( cb->data, cbv.bv_val, cbv.bv_len ); ++ if ( ld->ld_defconn->lconn_sasl_cbind == NULL ) { ++ void *cb; ++ cb = ldap_pvt_sasl_cbinding( ssl, ++ ld->ld_options.ldo_sasl_cbinding, ++ 0 ); ++ if ( cb != NULL ) { + sasl_setprop( ld->ld_defconn->lconn_sasl_authctx, + SASL_CHANNEL_BINDING, cb ); + ld->ld_defconn->lconn_sasl_cbind = cb; +@@ -930,12 +984,20 @@ int ldap_pvt_sasl_secprops( + int + ldap_int_sasl_config( struct ldapoptions *lo, int option, const char *arg ) + { +- int rc; ++ int rc, i; + + switch( option ) { + case LDAP_OPT_X_SASL_SECPROPS: + rc = ldap_pvt_sasl_secprops( arg, &lo->ldo_sasl_secprops ); + if( rc == LDAP_SUCCESS ) return 0; ++ break; ++ case LDAP_OPT_X_SASL_CBINDING: ++ i = ldap_pvt_sasl_cbinding_parse( arg ); ++ if ( i >= 0 ) { ++ lo->ldo_sasl_cbinding = i; ++ return 0; ++ } ++ break; + } + + return -1; +@@ -1041,6 +1103,10 @@ ldap_int_sasl_get_option( LDAP *ld, int option, void *arg ) + /* this option is write only */ + return -1; + ++ case LDAP_OPT_X_SASL_CBINDING: ++ *(int *)arg = ld->ld_options.ldo_sasl_cbinding; ++ break; ++ + #ifdef SASL_GSS_CREDS + case LDAP_OPT_X_SASL_GSS_CREDS: { + sasl_conn_t *ctx; +@@ -1142,6 +1208,17 @@ ldap_int_sasl_set_option( LDAP *ld, int option, void *arg ) + return sc == LDAP_SUCCESS ? 0 : -1; + } + ++ case LDAP_OPT_X_SASL_CBINDING: ++ if ( !arg ) return -1; ++ switch( *(int *) arg ) { ++ case LDAP_OPT_X_SASL_CBINDING_NONE: ++ case LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE: ++ case LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT: ++ ld->ld_options.ldo_sasl_cbinding = *(int *) arg; ++ return 0; ++ } ++ return -1; ++ + #ifdef SASL_GSS_CREDS + case LDAP_OPT_X_SASL_GSS_CREDS: { + sasl_conn_t *ctx; +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 746824fbd..0c4b6237e 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -113,6 +113,7 @@ static const struct ol_attribute { + offsetof(struct ldapoptions, ldo_def_sasl_authzid)}, + {0, ATTR_SASL, "SASL_SECPROPS", NULL, LDAP_OPT_X_SASL_SECPROPS}, + {0, ATTR_BOOL, "SASL_NOCANON", NULL, LDAP_BOOL_SASL_NOCANON}, ++ {0, ATTR_SASL, "SASL_CBINDING", NULL, LDAP_OPT_X_SASL_CBINDING}, + #endif + + #ifdef HAVE_GSSAPI +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 397894271..08d4b4a92 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -276,6 +276,7 @@ struct ldapoptions { + + /* SASL Security Properties */ + struct sasl_security_properties ldo_sasl_secprops; ++ int ldo_sasl_cbinding; + #define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0} + #else + #define LDAP_LDO_SASL_NULLARG +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index 103004fa7..77975bb6c 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -42,6 +42,7 @@ typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); + typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_strength)(tls_session *sess); + typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); ++typedef int (TI_session_endpoint)(tls_session *sess, struct berval *buf, int is_server); + typedef int (TI_session_peercert)(tls_session *s, struct berval *der); + + typedef void (TI_thr_init)(void); +@@ -67,6 +68,7 @@ typedef struct tls_impl { + TI_session_chkhost *ti_session_chkhost; + TI_session_strength *ti_session_strength; + TI_session_unique *ti_session_unique; ++ TI_session_endpoint *ti_session_endpoint; + TI_session_peercert *ti_session_peercert; + + Sockbuf_IO *ti_sbio; +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 8b1fee748..f74af7d1d 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -1041,6 +1041,13 @@ ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) + return tls_imp->ti_session_unique( session, buf, is_server ); + } + ++int ++ldap_pvt_tls_get_endpoint( void *s, struct berval *buf, int is_server ) ++{ ++ tls_session *session = s; ++ return tls_imp->ti_session_endpoint( session, buf, is_server ); ++} ++ + int + ldap_pvt_tls_get_peercert( void *s, struct berval *der ) + { +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 26d9f99ce..52dfcd3ab 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -675,6 +675,64 @@ tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) + return 0; + } + ++static int ++tlsg_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) ++{ ++ tlsg_session *s = (tlsg_session *)sess; ++ const gnutls_datum_t *cert_data; ++ gnutls_x509_crt_t server_cert; ++ gnutls_digest_algorithm_t md; ++ int sign_algo, md_len, rc; ++ ++ if ( is_server ) ++ cert_data = gnutls_certificate_get_ours( s->session ); ++ else ++ cert_data = gnutls_certificate_get_peers( s->session, NULL ); ++ ++ if ( cert_data == NULL ) ++ return 0; ++ ++ rc = gnutls_x509_crt_init( &server_cert ); ++ if ( rc != GNUTLS_E_SUCCESS ) ++ return 0; ++ ++ rc = gnutls_x509_crt_import( server_cert, cert_data, GNUTLS_X509_FMT_DER ); ++ if ( rc != GNUTLS_E_SUCCESS ) { ++ gnutls_x509_crt_deinit( server_cert ); ++ return 0; ++ } ++ ++ sign_algo = gnutls_x509_crt_get_signature_algorithm( server_cert ); ++ gnutls_x509_crt_deinit( server_cert ); ++ if ( sign_algo <= GNUTLS_SIGN_UNKNOWN ) ++ return 0; ++ ++ md = gnutls_sign_get_hash_algorithm( sign_algo ); ++ if ( md == GNUTLS_DIG_UNKNOWN ) ++ return 0; ++ ++ /* See RFC 5929 */ ++ switch (md) { ++ case GNUTLS_DIG_NULL: ++ case GNUTLS_DIG_MD2: ++ case GNUTLS_DIG_MD5: ++ case GNUTLS_DIG_SHA1: ++ md = GNUTLS_DIG_SHA256; ++ } ++ ++ md_len = gnutls_hash_get_len( md ); ++ if ( md_len == 0 || md_len > buf->bv_len ) ++ return 0; ++ ++ rc = gnutls_hash_fast( md, cert_data->data, cert_data->size, buf->bv_val ); ++ if ( rc != GNUTLS_E_SUCCESS ) ++ return 0; ++ ++ buf->bv_len = md_len; ++ ++ return md_len; ++} ++ + static int + tlsg_session_peercert( tls_session *sess, struct berval *der ) + { +@@ -950,6 +1008,7 @@ tls_impl ldap_int_tls_impl = { + tlsg_session_chkhost, + tlsg_session_strength, + tlsg_session_unique, ++ tlsg_session_endpoint, + tlsg_session_peercert, + + &tlsg_sbio, +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 157923289..8ede11572 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -861,6 +861,50 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) + return buf->bv_len; + } + ++static int ++tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) ++{ ++ tlso_session *s = (tlso_session *)sess; ++ const EVP_MD *md; ++ unsigned int md_len; ++ X509 *cert; ++ ++ if ( buf->bv_len < EVP_MAX_MD_SIZE ) ++ return 0; ++ ++ if ( is_server ) ++ cert = SSL_get_certificate( s ); ++ else ++ cert = SSL_get_peer_certificate( s ); ++ ++ if ( cert == NULL ) ++ return 0; ++ ++#if OPENSSL_VERSION_NUMBER >= 0x10100000 ++ md = EVP_get_digestbynid( X509_get_signature_nid( cert )); ++#else ++ md = EVP_get_digestbynid(OBJ_obj2nid( cert->sig_alg->algorithm )); ++#endif ++ ++ /* See RFC 5929 */ ++ if ( md == NULL || ++ md == EVP_md_null() || ++#ifndef OPENSSL_NO_MD2 ++ md == EVP_md2() || ++#endif ++ md == EVP_md4() || ++ md == EVP_md5() || ++ md == EVP_sha1() ) ++ md = EVP_sha256(); ++ ++ if ( !X509_digest( cert, md, buf->bv_val, &md_len )) ++ return 0; ++ ++ buf->bv_len = md_len; ++ ++ return md_len; ++} ++ + static int + tlso_session_peercert( tls_session *sess, struct berval *der ) + { +@@ -1394,6 +1438,7 @@ tls_impl ldap_int_tls_impl = { + tlso_session_chkhost, + tlso_session_strength, + tlso_session_unique, ++ tlso_session_endpoint, + tlso_session_peercert, + + &tlso_sbio, +diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c +index 3188ccfbe..8c4ccb860 100644 +--- a/servers/slapd/bconfig.c ++++ b/servers/slapd/bconfig.c +@@ -569,6 +569,15 @@ static ConfigTable config_back_cf_table[] = { + #endif + "( OLcfgGlAt:89 NAME 'olcSaslAuxprops' " + "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ++ { "sasl-cbinding", NULL, 2, 2, 0, ++#ifdef HAVE_CYRUS_SASL ++ ARG_STRING, &sasl_cbinding, ++#else ++ ARG_IGNORED, NULL, ++#endif ++ "( OLcfgGlAt:100 NAME 'olcSaslCBinding' " ++ "EQUALITY caseIgnoreMatch " ++ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, + { "sasl-host", "host", 2, 2, 0, + #ifdef HAVE_CYRUS_SASL + ARG_STRING|ARG_UNIQUE, &sasl_host, +@@ -820,7 +829,7 @@ static ConfigOCs cf_ocs[] = { + "olcPluginLogFile $ olcReadOnly $ olcReferral $ " + "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ " + "olcRootDSE $ " +- "olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ " ++ "olcSaslAuxprops $ olcSaslCBinding $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ " + "olcSecurity $ olcServerID $ olcSizeLimit $ " + "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ " + "olcTCPBuffer $ " +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index 5108da696..77dd3c1ae 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -73,6 +73,7 @@ char *global_host = NULL; + struct berval global_host_bv = BER_BVNULL; + char *global_realm = NULL; + char *sasl_host = NULL; ++char *sasl_cbinding = NULL; + char **default_passwd_hash = NULL; + struct berval default_search_base = BER_BVNULL; + struct berval default_search_nbase = BER_BVNULL; +diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c +index 0602fdceb..d074009e4 100644 +--- a/servers/slapd/connection.c ++++ b/servers/slapd/connection.c +@@ -1430,12 +1430,9 @@ connection_read( ber_socket_t s, conn_readinfo *cri ) + c->c_connid, (int) s, c->c_tls_ssf, c->c_ssf, 0 ); + slap_sasl_external( c, c->c_tls_ssf, &authid ); + if ( authid.bv_val ) free( authid.bv_val ); +- { +- char cbinding[64]; +- struct berval cbv = { sizeof(cbinding), cbinding }; +- if ( ldap_pvt_tls_get_unique( ssl, &cbv, 1 )) +- slap_sasl_cbinding( c, &cbv ); +- } ++ ++ slap_sasl_cbinding( c, ssl ); ++ + } else if ( rc == 1 && ber_sockbuf_ctrl( c->c_sb, + LBER_SB_OPT_NEEDS_WRITE, NULL )) { /* need to retry */ + slapd_set_write( s, 1 ); +diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h +index de1cabf32..9b52760bd 100644 +--- a/servers/slapd/proto-slap.h ++++ b/servers/slapd/proto-slap.h +@@ -1657,8 +1657,7 @@ LDAP_SLAPD_F (int) slap_sasl_external( Connection *c, + slap_ssf_t ssf, /* relative strength of external security */ + struct berval *authid ); /* asserted authenication id */ + +-LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, +- struct berval *cbv ); ++LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, void *ssl ); + + LDAP_SLAPD_F (int) slap_sasl_reset( Connection *c ); + LDAP_SLAPD_F (int) slap_sasl_close( Connection *c ); +@@ -2039,6 +2038,7 @@ LDAP_SLAPD_V (char *) global_host; + LDAP_SLAPD_V (struct berval) global_host_bv; + LDAP_SLAPD_V (char *) global_realm; + LDAP_SLAPD_V (char *) sasl_host; ++LDAP_SLAPD_V (char *) sasl_cbinding; + LDAP_SLAPD_V (char *) slap_sasl_auxprops; + LDAP_SLAPD_V (char **) default_passwd_hash; + LDAP_SLAPD_V (int) lber_debug; +diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c +index 258cd5407..c14e8a628 100644 +--- a/servers/slapd/sasl.c ++++ b/servers/slapd/sasl.c +@@ -1203,6 +1203,8 @@ int slap_sasl_destroy( void ) + #endif + free( sasl_host ); + sasl_host = NULL; ++ free( sasl_cbinding ); ++ sasl_cbinding = NULL; + + return 0; + } +@@ -1389,17 +1391,24 @@ int slap_sasl_external( + return LDAP_SUCCESS; + } + +-int slap_sasl_cbinding( Connection *conn, struct berval *cbv ) ++int slap_sasl_cbinding( Connection *conn, void *ssl ) + { + #ifdef SASL_CHANNEL_BINDING +- sasl_channel_binding_t *cb = ch_malloc( sizeof(*cb) + cbv->bv_len );; +- cb->name = "ldap"; +- cb->critical = 0; +- cb->data = (char *)(cb+1); +- cb->len = cbv->bv_len; +- memcpy( cb->data, cbv->bv_val, cbv->bv_len ); +- sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); +- conn->c_sasl_cbind = cb; ++ void *cb; ++ int i; ++ ++ if ( sasl_cbinding == NULL ) ++ return LDAP_SUCCESS; ++ ++ i = ldap_pvt_sasl_cbinding_parse( sasl_cbinding ); ++ if ( i < 0 ) ++ return LDAP_SUCCESS; ++ ++ cb = ldap_pvt_sasl_cbinding( ssl, i, 1 ); ++ if ( cb != NULL ) { ++ sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); ++ conn->c_sasl_cbind = cb; ++ } + #endif + return LDAP_SUCCESS; + } +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch b/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch new file mode 100644 index 0000000..a8727dc --- /dev/null +++ b/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch @@ -0,0 +1,45 @@ +From 7b0017ad49a2290ec26cbcdffded8a527799e981 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 18 Apr 2020 16:30:03 +0200 +Subject: [PATCH] ITS#9189 add channel-bindings tests + +--- + tests/scripts/test068-sasl-tls-external | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external +index dcbc50fd4..ee112cf98 100755 +--- a/tests/scripts/test068-sasl-tls-external ++++ b/tests/scripts/test068-sasl-tls-external +@@ -88,6 +88,28 @@ else + echo "success" + fi + ++# Exercise channel-bindings code in builds without SASL support ++for cb in "none" "tls-unique" "tls-endpoint" ; do ++ ++ echo -n "Using ldapwhoami with SASL/EXTERNAL and SASL_CBINDING (${cb})...." ++ ++ $LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ -o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt \ ++ -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key \ ++ -o tls_reqcert=hard -o SASL_CBINDING=$cb -ZZ -Y EXTERNAL -H $URIP1 \ ++ > $TESTOUT 2>&1 ++ ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $PID ++ exit $RC ++ else ++ echo "success" ++ fi ++done ++ ++ + test $KILLSERVERS != no && kill -HUP $KILLPIDS + + if test $RC != 0 ; then +-- +2.29.2 + diff --git a/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch b/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch new file mode 100644 index 0000000..ee9a3ca --- /dev/null +++ b/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch @@ -0,0 +1,27 @@ +From 4cac398b19c21ad56949ef7e67e285c6c8e7ecea Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 23 Apr 2020 22:47:32 +0200 +Subject: [PATCH] ITS#9189 - initialize ldo_sasl_cbinding in + LDAP_LDO_SASL_NULLARG + +Reported-by: Ryan Tandy @ryan +--- + libraries/libldap/ldap-int.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 08d4b4a92..8c7f1e5c1 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -277,7 +277,7 @@ struct ldapoptions { + /* SASL Security Properties */ + struct sasl_security_properties ldo_sasl_secprops; + int ldo_sasl_cbinding; +-#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0} ++#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0},0 + #else + #define LDAP_LDO_SASL_NULLARG + #endif +-- +2.29.2 + diff --git a/openldap-cbinding-Make-prototypes-available-where-needed.patch b/openldap-cbinding-Make-prototypes-available-where-needed.patch new file mode 100644 index 0000000..206f7ca --- /dev/null +++ b/openldap-cbinding-Make-prototypes-available-where-needed.patch @@ -0,0 +1,64 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From cd914149a665167b2c5ae16baa0c438824588819 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Tue, 19 Feb 2019 10:26:39 +0000 +Subject: [PATCH] Make prototypes available where needed + +--- + libraries/libldap/tls2.c | 3 +++ + servers/slapd/config.c | 1 + + servers/slapd/proto-slap.h | 4 ++++ + 3 files changed, 8 insertions(+) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index ad09ba39b..8b1fee748 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -76,6 +76,9 @@ static oid_name oids[] = { + + #ifdef HAVE_TLS + ++LDAP_F(int) ldap_pvt_tls_check_hostname LDAP_P(( LDAP *ld, void *s, const char *name_in )); ++LDAP_F(int) ldap_pvt_tls_get_peercert LDAP_P(( void *s, struct berval *der )); ++ + void + ldap_pvt_tls_ctx_free ( void *c ) + { +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index bd68a2421..5108da696 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -48,6 +48,7 @@ + #endif + #include "lutil.h" + #include "lutil_ldap.h" ++#include "ldif.h" + #include "config.h" + + #ifdef _WIN32 +diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h +index 7f8e604fa..de1cabf32 100644 +--- a/servers/slapd/proto-slap.h ++++ b/servers/slapd/proto-slap.h +@@ -739,6 +739,7 @@ LDAP_SLAPD_F (int) bindconf_unparse LDAP_P(( + LDAP_SLAPD_F (int) bindconf_tls_set LDAP_P(( + slap_bindconf *bc, LDAP *ld )); + LDAP_SLAPD_F (void) bindconf_free LDAP_P(( slap_bindconf *bc )); ++LDAP_SLAPD_F (void) slap_client_keepalive LDAP_P(( LDAP *ld, slap_keepalive *sk )); + LDAP_SLAPD_F (int) slap_client_connect LDAP_P(( LDAP **ldp, slap_bindconf *sb )); + LDAP_SLAPD_F (int) config_generic_wrapper LDAP_P(( Backend *be, + const char *fname, int lineno, int argc, char **argv )); +@@ -1656,6 +1657,9 @@ LDAP_SLAPD_F (int) slap_sasl_external( Connection *c, + slap_ssf_t ssf, /* relative strength of external security */ + struct berval *authid ); /* asserted authenication id */ + ++LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, ++ struct berval *cbv ); ++ + LDAP_SLAPD_F (int) slap_sasl_reset( Connection *c ); + LDAP_SLAPD_F (int) slap_sasl_close( Connection *c ); + +-- +2.29.2 + diff --git a/openldap-cbinding-Update-keys-to-RSA-4096.patch b/openldap-cbinding-Update-keys-to-RSA-4096.patch new file mode 100644 index 0000000..f4342e4 --- /dev/null +++ b/openldap-cbinding-Update-keys-to-RSA-4096.patch @@ -0,0 +1,526 @@ +From 3ab98b2fc98843289c1833891518fb3b5b42dcd8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Tue, 30 Oct 2018 15:42:35 +0000 +Subject: [PATCH] Update keys to RSA 4096 + +--- + tests/data/tls/ca/certs/testsuiteCA.crt | 133 ++++++++++++++++-- + tests/data/tls/ca/private/testsuiteCA.key | 64 +++++++-- + .../tls/certs/bjensen@mailgw.example.com.crt | 44 ++++-- + tests/data/tls/certs/localhost.crt | 44 ++++-- + tests/data/tls/conf/openssl.cnf | 2 +- + tests/data/tls/create-crt.sh | 9 +- + .../private/bjensen@mailgw.example.com.key | 64 +++++++-- + tests/data/tls/private/localhost.key | 64 +++++++-- + 8 files changed, 336 insertions(+), 88 deletions(-) + +diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt +index 7458e7461..62c88acca 100644 +--- a/tests/data/tls/ca/certs/testsuiteCA.crt ++++ b/tests/data/tls/ca/certs/testsuiteCA.crt +@@ -1,16 +1,121 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: ++ 0b:43:f8:e9:ee:d3:38:37:92:db:19:65:d9:94:17:cc:70:45:d4:06 ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=US, ST=CA, O=OpenLDAP Foundation, OU=OpenLDAP Test Suite ++ Validity ++ Not Before: Oct 30 15:29:02 2018 GMT ++ Not After : Nov 13 15:29:02 2519 GMT ++ Subject: C=US, ST=CA, O=OpenLDAP Foundation, OU=OpenLDAP Test Suite ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (4096 bit) ++ Modulus: ++ 00:be:e0:ff:36:89:65:c0:4e:46:e6:24:e8:3d:81: ++ 97:92:28:4b:11:c6:21:ac:28:14:31:b2:a3:64:24: ++ 62:61:24:bd:76:7b:9e:7c:3a:50:65:fa:97:f3:c5: ++ 9d:49:cc:61:3a:31:6f:0d:a4:d8:70:57:73:c8:c6: ++ 66:06:d0:59:3f:24:3b:56:5d:70:20:e4:51:2b:88: ++ 5e:f4:78:82:bc:55:b5:d5:5b:f6:e5:55:1f:3a:af: ++ 59:9f:b7:5d:72:70:fe:b6:a4:dd:4e:f9:d0:38:e8: ++ 15:14:c7:45:ed:5e:d3:4c:ee:02:34:3a:37:d8:75: ++ f1:49:0d:f6:8a:7b:8c:87:39:c9:fb:f2:3a:96:57: ++ cd:7c:18:a7:bb:35:de:d3:c4:79:57:20:48:07:b9: ++ 65:f6:bd:7b:01:5c:99:8a:92:35:7c:b7:e3:96:1c: ++ 6f:4c:47:42:c1:77:d6:62:49:0e:be:01:8f:c9:f4: ++ 64:68:4c:b0:ec:10:12:d0:0e:5f:67:0e:e8:a4:bd: ++ df:9c:fb:5b:04:6f:3c:2a:35:1b:5a:ca:98:ba:f3: ++ 61:f4:3a:77:28:be:a3:63:f1:d6:94:0d:fb:a0:87: ++ e3:a5:9f:56:b6:a6:6a:90:13:80:2a:2e:ae:fe:af: ++ aa:e3:e7:d8:3b:2b:a3:52:4f:73:2d:12:aa:e2:a3: ++ 0c:aa:fb:11:40:86:68:de:be:2b:9b:36:19:9c:d7: ++ d7:5e:13:21:c9:b3:34:6d:09:53:ff:a3:2e:92:f4: ++ 33:80:de:7a:47:1c:47:57:68:53:2a:db:73:6e:6d: ++ fa:40:df:55:25:a1:fc:87:c4:86:ef:6e:16:ec:f8: ++ 48:35:f5:96:b3:55:ce:56:a9:6e:c1:8c:ea:32:85: ++ 26:ea:af:0c:92:24:05:e2:49:12:b7:07:8f:06:96: ++ be:13:fa:ec:49:f7:d4:49:6f:b9:c7:6c:79:53:39: ++ a3:89:c4:4a:92:66:b0:f3:0c:72:6d:50:3c:63:1f: ++ f3:76:63:a8:aa:b7:fd:db:ef:98:b4:5b:49:b6:84: ++ 66:e5:fc:60:0b:c1:f7:b0:f7:84:68:7e:71:5d:ac: ++ fc:a9:cb:f6:02:fc:86:d3:a7:c3:42:ef:ba:f4:1a: ++ 27:71:5d:22:f5:53:e1:a6:f4:a5:dc:31:38:45:0b: ++ a1:6d:ab:9c:05:2e:87:8c:31:02:99:80:6d:3f:66: ++ e8:8a:d7:64:4f:08:7e:2f:f0:1f:28:ff:85:57:22: ++ ee:6a:a7:05:72:f8:cf:5d:07:c6:73:23:82:85:82: ++ 76:4e:36:8a:ec:ea:f1:53:1e:e0:77:d1:4a:9f:df: ++ ec:87:91:0a:56:40:b7:23:19:fa:60:14:d0:f0:32: ++ 4d:11:39 ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Key Identifier: ++ 90:CF:51:1D:E8:08:D4:4C:34:70:71:6B:D2:0B:00:68:D9:FD:60:50 ++ X509v3 Authority Key Identifier: ++ keyid:90:CF:51:1D:E8:08:D4:4C:34:70:71:6B:D2:0B:00:68:D9:FD:60:50 ++ ++ X509v3 Basic Constraints: critical ++ CA:TRUE ++ Signature Algorithm: sha256WithRSAEncryption ++ 0f:7f:a0:c5:3c:ac:dc:ed:8f:56:3e:64:89:e6:87:d0:ca:a5: ++ 37:b8:0e:49:aa:93:d3:e5:ac:ff:54:24:91:07:1b:9c:dc:08: ++ e6:cc:15:53:be:85:4c:51:52:d3:88:d0:d8:c7:b7:98:40:41: ++ 8a:a7:7a:4c:96:85:61:8c:98:76:f6:a3:2c:10:31:a1:d8:e6: ++ a7:4c:ec:c3:29:ad:04:8b:e3:f2:2d:4c:30:0d:a4:bc:c8:93: ++ d2:9b:88:1d:a4:25:eb:ff:9f:f2:d9:c5:3b:bf:51:91:71:06: ++ 92:35:96:5c:ca:6d:d6:86:47:63:07:7f:37:35:53:68:e9:4e: ++ d0:d0:25:42:18:e0:00:9e:ca:f5:bd:b7:94:ee:99:51:44:3a: ++ 0c:44:40:e3:87:e6:ce:6c:2b:3f:c1:01:6c:5c:32:d5:59:b5: ++ bd:25:a3:1a:ff:85:a5:89:9c:d8:24:4b:fa:59:99:5a:64:ab: ++ a1:d8:0f:c0:19:28:84:1e:89:c2:a1:15:4e:0f:7e:1f:bf:f8: ++ 92:df:9f:1c:d5:4a:98:40:82:ee:41:1f:de:f7:25:11:fd:76: ++ 0a:cf:37:40:bc:c2:2d:6a:ea:4a:0c:6d:b0:e6:75:37:b5:63: ++ a8:a1:c5:81:d0:84:c0:f3:e0:c3:5c:c4:9f:ec:3b:9f:8a:74: ++ ce:f0:cc:e3:e9:15:08:a0:ea:3e:a9:8e:bc:9a:01:00:96:fe: ++ 37:6f:61:b5:2c:4b:1f:5d:d7:24:09:fe:bf:f4:77:47:e4:ee: ++ 7c:ea:6b:67:84:ee:56:4f:5f:b9:b8:e4:db:70:e1:4a:b3:94: ++ 4d:dd:52:45:05:4d:79:d4:7c:8b:9d:9b:6a:0b:73:9e:f3:0e: ++ d5:d5:46:da:b4:fb:4a:ea:5b:ab:8e:42:68:0e:96:cd:8a:6e: ++ 35:a8:e6:1b:6a:ed:a8:9e:3c:cc:3b:44:54:b8:2d:ba:c7:83: ++ 91:7c:70:40:0c:14:b8:21:7a:12:ac:8c:96:4c:94:a6:ee:fe: ++ cc:77:34:8e:e3:c3:c0:44:19:51:85:07:6c:d8:d1:2e:69:8d: ++ b1:0e:42:fb:e6:16:65:86:c6:e3:2f:a7:3f:b4:8e:4f:1c:83: ++ c4:0a:ae:a0:d9:17:fd:cf:a2:38:a1:9f:70:dc:5c:df:3c:07: ++ 7b:64:01:ff:35:8c:45:43:e8:fa:a4:f6:c4:71:78:17:6e:6a: ++ 7f:d1:6e:66:c6:89:33:3b:28:4a:76:bf:ca:29:05:51:07:98: ++ ce:63:62:25:61:7f:5e:c6:91:23:02:13:15:4f:fd:24:58:9d: ++ 2d:ac:eb:cb:9a:c2:82:2f:50:5c:5a:16:bb:8c:bf:4d:66:2c: ++ 6f:1c:c4:a9:28:e1:3d:4d + -----BEGIN CERTIFICATE----- +-MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV +-BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv +-bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0 +-NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB +-MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB +-UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd +-rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb +-lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL +-6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU +-7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB +-SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/ +-wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws +-ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q +-aL52EFPS0o3tiAJXS82U2wrQdJ0YEw== ++MIIFjzCCA3egAwIBAgIUC0P46e7TODeS2xll2ZQXzHBF1AYwDQYJKoZIhvcNAQEL ++BQAwVjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRwwGgYDVQQKDBNPcGVuTERB ++UCBGb3VuZGF0aW9uMRwwGgYDVQQLDBNPcGVuTERBUCBUZXN0IFN1aXRlMCAXDTE4 ++MTAzMDE1MjkwMloYDzI1MTkxMTEzMTUyOTAyWjBWMQswCQYDVQQGEwJVUzELMAkG ++A1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNVBAsM ++E09wZW5MREFQIFRlc3QgU3VpdGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK ++AoICAQC+4P82iWXATkbmJOg9gZeSKEsRxiGsKBQxsqNkJGJhJL12e558OlBl+pfz ++xZ1JzGE6MW8NpNhwV3PIxmYG0Fk/JDtWXXAg5FEriF70eIK8VbXVW/blVR86r1mf ++t11ycP62pN1O+dA46BUUx0XtXtNM7gI0OjfYdfFJDfaKe4yHOcn78jqWV818GKe7 ++Nd7TxHlXIEgHuWX2vXsBXJmKkjV8t+OWHG9MR0LBd9ZiSQ6+AY/J9GRoTLDsEBLQ ++Dl9nDuikvd+c+1sEbzwqNRtaypi682H0OncovqNj8daUDfugh+Oln1a2pmqQE4Aq ++Lq7+r6rj59g7K6NST3MtEqriowyq+xFAhmjeviubNhmc19deEyHJszRtCVP/oy6S ++9DOA3npHHEdXaFMq23NubfpA31UlofyHxIbvbhbs+Eg19ZazVc5WqW7BjOoyhSbq ++rwySJAXiSRK3B48Glr4T+uxJ99RJb7nHbHlTOaOJxEqSZrDzDHJtUDxjH/N2Y6iq ++t/3b75i0W0m2hGbl/GALwfew94RofnFdrPypy/YC/IbTp8NC77r0GidxXSL1U+Gm ++9KXcMThFC6Ftq5wFLoeMMQKZgG0/ZuiK12RPCH4v8B8o/4VXIu5qpwVy+M9dB8Zz ++I4KFgnZONors6vFTHuB30Uqf3+yHkQpWQLcjGfpgFNDwMk0ROQIDAQABo1MwUTAd ++BgNVHQ4EFgQUkM9RHegI1Ew0cHFr0gsAaNn9YFAwHwYDVR0jBBgwFoAUkM9RHegI ++1Ew0cHFr0gsAaNn9YFAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC ++AgEAD3+gxTys3O2PVj5kieaH0MqlN7gOSaqT0+Ws/1QkkQcbnNwI5swVU76FTFFS ++04jQ2Me3mEBBiqd6TJaFYYyYdvajLBAxodjmp0zswymtBIvj8i1MMA2kvMiT0puI ++HaQl6/+f8tnFO79RkXEGkjWWXMpt1oZHYwd/NzVTaOlO0NAlQhjgAJ7K9b23lO6Z ++UUQ6DERA44fmzmwrP8EBbFwy1Vm1vSWjGv+FpYmc2CRL+lmZWmSrodgPwBkohB6J ++wqEVTg9+H7/4kt+fHNVKmECC7kEf3vclEf12Cs83QLzCLWrqSgxtsOZ1N7VjqKHF ++gdCEwPPgw1zEn+w7n4p0zvDM4+kVCKDqPqmOvJoBAJb+N29htSxLH13XJAn+v/R3 ++R+TufOprZ4TuVk9fubjk23DhSrOUTd1SRQVNedR8i52bagtznvMO1dVG2rT7Supb ++q45CaA6WzYpuNajmG2rtqJ48zDtEVLgtuseDkXxwQAwUuCF6EqyMlkyUpu7+zHc0 ++juPDwEQZUYUHbNjRLmmNsQ5C++YWZYbG4y+nP7SOTxyDxAquoNkX/c+iOKGfcNxc ++3zwHe2QB/zWMRUPo+qT2xHF4F25qf9FuZsaJMzsoSna/yikFUQeYzmNiJWF/XsaR ++IwITFU/9JFidLazry5rCgi9QXFoWu4y/TWYsbxzEqSjhPU0= + -----END CERTIFICATE----- +diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key +index 2e14d7033..01a6614c1 100644 +--- a/tests/data/tls/ca/private/testsuiteCA.key ++++ b/tests/data/tls/ca/private/testsuiteCA.key +@@ -1,16 +1,52 @@ + -----BEGIN PRIVATE KEY----- +-MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ +-WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc +-338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/ +-dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg +-O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf +-7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn +-rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f +-wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk +-AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l +-vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9 +-27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X +-KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N +-I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL +-+b2qljWeZbGH ++MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQC+4P82iWXATkbm ++JOg9gZeSKEsRxiGsKBQxsqNkJGJhJL12e558OlBl+pfzxZ1JzGE6MW8NpNhwV3PI ++xmYG0Fk/JDtWXXAg5FEriF70eIK8VbXVW/blVR86r1mft11ycP62pN1O+dA46BUU ++x0XtXtNM7gI0OjfYdfFJDfaKe4yHOcn78jqWV818GKe7Nd7TxHlXIEgHuWX2vXsB ++XJmKkjV8t+OWHG9MR0LBd9ZiSQ6+AY/J9GRoTLDsEBLQDl9nDuikvd+c+1sEbzwq ++NRtaypi682H0OncovqNj8daUDfugh+Oln1a2pmqQE4AqLq7+r6rj59g7K6NST3Mt ++Eqriowyq+xFAhmjeviubNhmc19deEyHJszRtCVP/oy6S9DOA3npHHEdXaFMq23Nu ++bfpA31UlofyHxIbvbhbs+Eg19ZazVc5WqW7BjOoyhSbqrwySJAXiSRK3B48Glr4T +++uxJ99RJb7nHbHlTOaOJxEqSZrDzDHJtUDxjH/N2Y6iqt/3b75i0W0m2hGbl/GAL ++wfew94RofnFdrPypy/YC/IbTp8NC77r0GidxXSL1U+Gm9KXcMThFC6Ftq5wFLoeM ++MQKZgG0/ZuiK12RPCH4v8B8o/4VXIu5qpwVy+M9dB8ZzI4KFgnZONors6vFTHuB3 ++0Uqf3+yHkQpWQLcjGfpgFNDwMk0ROQIDAQABAoICAQCVkIdpnE92V9+GBfVT/G9f ++vuLTkoRf+SeZqXgNx9SuebNbW5HblXXZ8nmOMZIFeXfVuVZjQn+1x1CaSZs4S5ki ++uKkmCyEJJN3VVo3Q0XzfRemsvNrA5+oIec2oMG2wdomfY59leqmFbZTXKy3HyT2Y ++Uga4FcYcfo4JyD8eU6DRdJ6oJC10EGiajFchghyPoqvRcSH/q24R4Ha5om1M/zOZ ++/hz+SlmLU2sjXVtGuCgtCdw5Sp5Ce5VF43JaRGjMwAnazEyjHPE8kEx8ZhCBG66B ++DqP6UrV736T3c0/Hww0fxFrENA4mIE/vhNgwNVQ5jDxDSC9ObesTW93Lu4za+Re6 ++pmP1eeS/oe1OcI1d/xK2IIQwzB7ZkJ0StbFLnjs7DATO7BGzhC9egC6s+z9oSgTS ++KvmLyoiL5U4fesVJwcCPKwwkVH9n22TuqmvB5mmvZvRTe2+OgDH55Nkfx1SoI8+Q ++/fwV9UXIIg5en+Kv8lOaWCZujmMsjHC79bwxPLeaePRwD/RBkT1MLW/T4fWGpAt3 ++H89+yufH31Y/1QMxVVtR9OdxCtljiXno/bArMNZ0oE1TiCcckMzdjKh7RNfkEXRM ++Pga92HBTgtJ3tfWJ4qOtJ4NKJPQ7wRmR03Bug8+bGM4K5HDO08fNuag/pP3AQvrM ++QGbHFVho3I7/DXnmRBq/gQKCAQEA75eptBtP8PWnN9uNsQoWxvFKQBtbLfPKUcVP +++LWOWF4ag2YRRf6TIzvGfIk54OGSL/srWCDKjXWJ0NgUn6yiqOkoP4oxEE1m2QDY ++7oCk9vJipJcrtNCKL6NhKwZDOjlDSROb/hBeMgr14Da/WkPE6zQhuwN5y4Japbjs ++cBYTao2uOg4QQz5Aee+ee55L6iAgMT0PnlQtv1uVW3D46e02CrQKtRmtDxqT3Nux ++nudJdz+rMFM0EDgVKUYRwFCa6xjI4y2K1aCwCtJG9yTJpYqCD9hehfwEije6dNNg ++p5RX3M9ai710Yx4F26cwX/t8AxqgF/2XBI0ZWD6x69cp7suPTQKCAQEAy/NUEgXN ++nymq8NK+umZwFJU7cy3weozRuEkmgmCWj4XYhbvTw6MbK+2R9XKa3ilqSd2sU2lX ++qE66kfAgqZMJ9RB+7nDOaLAMUuGw1DrwFZE7r3mKXgc4NgjtmGav4E3URXPHj5zb ++JbbN95zl96Fm3Nevs5p8sb0KexgbzHe4UzJNYFgT0l+TjJbJUAiNPsEw1bnV4cxn ++b1HO2CWTeGtAOJyjMRNwI+40wnk2N6An+Ddvb2mj2h30HujSZHnL94RAqa7RHDb6 ++lU+7JX/ll5G0mFQOFQAs4UPos2bg7hS1mfYO+UVrG4OH9gXns12158WqFED+lhmJ ++O8WDWEVAblVrnQKCAQAB9aOVrYOB3QB5HHqUMBjvl5mb3J1qSswkzxBQYGvBnUNq ++P7N0dxiM+TguXJD0neOsMMmx9tKxRXzTEHFavPa3mvCRVHgCQh/NNoyPps2yl1jn ++L7VTzUDUEuoAiBSUrVM3jcmA0nFyx1QreUcnXdaGde6wsN6WI4LKSDDm2cde37nF ++D8hiRGgSlzscl7bXO1wICw/No7KcFguqq8ndX+tJOx+7S3J25SjAbauOOSYIq6Si ++yItsdoj1xXTvtbkOoy1BbmXsSVwnOoEKFGrxx6g4qPRc9Cq1Vq9XtULdHAF79NYw ++vmPtS5mQqlVi85OYEuesSo6pot3KMvkRjLjzEwchAoIBACEvrvZfy12iwhX9tNtP ++39z5i3rqdr76OwXpoUKFxPoFpX3dWk/zMnCrb5yo0VplEs6CK5BHC+RvKxykHix5 ++qJ0f2geig3O1ccvqvYNLM9XOlA+xjzpNom/odADgdK3i/C9w74AG3gH9BPbNqP3q ++XXqB/i0Tbkbdo97zxVI4CN5AySZsLo2Ez9WIk6laOuGDPhcI7iyXvhz3CtlRA/YM ++PZ74nfVWXGD8WclrP889WEOjgZZ3choD1b1R1SpUR0Q3WO5Da/NTXuL83k7zyMAp ++DWHcC46PQL5G9o56pw8Wf5ZV24nkKdGITY9S1qjxDrBwEYTKLqLt9M6tDPpICnvp ++mmECggEBALfnUgpdGugn46UmQUMI1y+NZbSKhJHG+OBWdcc1j4kDZhF/Ei7g8pvk ++hFU5p/YA6JbGioZxiqjdrYLvgTPnJVkxy7arLTN2j2GVlhUA74BY+kNzENk2Tj9c ++zJSMVZn+WZrXNQhfYyA3FyW3wGN67GBXAHPQxFTdU3G4mR1WcyJCxKIyzP+2M8o9 ++16tpb80QRnc0OLm9Izppe7JUp2hCQt+O6E8izvLE8k2ldOr5ncTNWlxTJ0yx0hEO ++WTFqhwOM1pEmtxas1gLr8MX0hNsaQR+kjG2f8rPmH+GEZeeAwuhoJY1PcKAOYM5Y ++yu/1yFXYTrmhD/P0+nJn1DfS5JljCJY= + -----END PRIVATE KEY----- +diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +index 93e3a0d39..eb0fc693f 100644 +--- a/tests/data/tls/certs/bjensen@mailgw.example.com.crt ++++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +@@ -1,16 +1,32 @@ + -----BEGIN CERTIFICATE----- +-MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL +-MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV +-BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx +-ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV +-BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD +-VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa +-YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A +-MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg +-QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU +-U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL +-MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn +-wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f +-7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo +-4DnnYQBDnq48VORVX94= ++MIIFfDCCA2SgAwIBAgIBADANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNV ++BAsME09wZW5MREFQIFRlc3QgU3VpdGUwIBcNMTgxMDMwMTUzNzQwWhgPMjUxOTEx ++MTMxNTM3NDBaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNVBAoM ++E09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYDVQQD ++DBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYaYmpl ++bnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw ++ggIKAoICAQCcHBkHcUSKG4s7nKmcqZT3EoZkEgxoaMlpxUZtxBtO5ZXEfcpMaxuA ++7qkZvMJR8ws2u8TQU/18FhH4+0aZBefM0ExwqvGNJ8F0cTl3439DGNE+/psh5NWg ++qPYe/K3bAtSRtF7wDxF77eb2Yz0J3NIDxFrAbovfg0ydbt9pWJr5pDBvlqSdYu38 ++kpIB5WENCEy77QK9GEGAlMVIRXneA5t2CKsljujRG1H5YJeS6qVAEdMllHZ6a0nN ++LxTdLe1qbZyRgEqRKgW5WcWrW46Co9CRDcFeMqoHdwAQsRdOGBivgkeYUST1yIms ++CbzlSRLC1dfj++2mzCMxoc3xpZNPyHyBuRgou8VqWpF2NuG+KS7QBtm1PVUhSAvR ++X9uQOnXnazQvlRfsaHQjGUKyhMUr5dcwpTqThW4BoqtStd6/097sZTZVWmsC+mzL ++twWkESVDU0tNg/czWLn56smV7DfPjFDDAV6eNcScFfD8w04aPdk8ODalW/wnsTjI ++LQuEBssrV1h8WblruWRU31Mn+mw9SA3tDfTk9sJiEyiTJh3B1DrEb+pIuk4vz5ui ++cNcYTXCfa5ZpPL608f7cWuG2GP8f5ug4PMKyRkh6qCt7BWrVgOheo1ZhjvrbmhI4 ++yPXHATrCtYO1wqIyu9Yuirdg7WJD6npu8IV38VEgEBD3UFanY9xN7wIDAQABow0w ++CzAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCq8VvpcoAgCK/D5yi/2puB ++LD7kYaVaSXxrUQBeLTmKERw3akpgW7QTGCNgM425VVaBQRPtv8YcX9OycUAylAA+ ++7lzwdP95OJGnUOjQY4x4iRAwCPkpDCcnwc43c3WAyQb2S46aZJaWK4S0+RM3CmWH ++1Fzb6aODdnoBEKk0XgNrB6/teB+UWgtTSxWiY/HWiArDaZDPMAxqEK0hnB+b/sBD ++ZoBYnfnQXezylqbk9vkzTIbSVrv5ZZdQELOAnPuxUCFpYew1OGKcg+1twYKDHgBS ++s13zN03eMEnC/O4Z01dhu16vqdikdP+tJJrppjvZtJys0KIP24ltDnpA6h/3m/Cl ++U1eiTDgWO+SsfiL1K4gcTL1eLjnCBFfnHN5gfgAV5w5DaKzvKp7Qu8db4DtH+S4o ++W/MBKuaHHKWUPGksvFUiGNgE/XyDU4MK34/5ulzbrWmqb24pYAzm1MyjsdzmXObw +++fzg6EDBB14cWA2hA7mSqnzkiW1pELVym6+uTaIlopSIFr8nNAimwLiY5QJNGYvd ++hgNNvOyUUO+nON3aHsC/rRMgar3eo7A9AkQJ6qKVvPR2h1317PJLuKaLfjbaCzNw ++iA3JSQjcwR2ydlSgKKN2d/XXm/G4PZ9tUcBY4Zngn0ViT0/m7MFy9qsiWG97+yaZ ++nYsN5WfwDZrtG24dTotxVQ== + -----END CERTIFICATE----- +diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt +index 194cb119d..3aeae3c16 100644 +--- a/tests/data/tls/certs/localhost.crt ++++ b/tests/data/tls/certs/localhost.crt +@@ -1,16 +1,32 @@ + -----BEGIN CERTIFICATE----- +-MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL +-MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV +-BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx +-ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE +-CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT +-dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB +-iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4 +-7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv +-8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ +-BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A +-AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG +-8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl +-0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR +-GjeZB1FxqDGHjxBq2O828iejw28bSz4= ++MIIFhTCCA22gAwIBAgIBADANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNV ++BAsME09wZW5MREFQIFRlc3QgU3VpdGUwIBcNMTgxMDMwMTUzNjMwWhgPMjUxOTEx ++MTMxNTM2MzBaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwT ++T3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBTdWl0 ++ZTESMBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC ++CgKCAgEA6Ud89ugah2oWY00q1g+M6NkpluewwvGq4tkMau1gq+Q5Biv61bubgdSA ++Z+Zkkxe3Sx0Zv7i5wldIN4wXqEDlMg2qhfzKDSNKUofc0z7FLMb0Cn46WqlciUCY ++VetHhBghGd+6fxOOz+x98FhiiAif+AdiUWBTKFFohWXo/9aiGgm0ueJj2NS3Eyac ++xOKoTcDd9TMsOJ2fMH2MlquArLobCvuphOrVbqBoeeol2SzFDDOW8ryPDzFGy5xh ++ZHkm/3sGIoDpDkDR0yhvBzn47qdLI5myc6Fj96s7S2xgqiqGXJW0D0FCfpUQXxfm ++ahz/Jdwl+hqs5Eg/aA+LE/7lmS7szo3zwJQ53ApdcaupHi4fU60wPVrdo29wLwDO ++hDuS+Oc1os1UyJt0T0a+zB4PIP2rxifyxI1iWmZFt7tJyLv1k7yMN7CLCWzsSy5P ++BZpGmHV9Wbvb660N6NzlFDMqnjJWDAr1BLoV4ywmpiWPhy/7JtKXFe1V3jT5MvGM ++26IOC+zCwwZVyEIIASeWepZDuto00Lqo7jOKSlLRmuhTX1ELK8xYX6ZU/fz0FwYn ++bLu6bI4mRGfbJ12fWYm5QMje2QAuvndfi759HUeuLl6TgmeQFgqFA/6Kkwoz0Ncb ++Kaaj+ByvLXfI4S3lvkwT26nOAt966fb1bsdkb8P52NdkqeSMk5cCAwEAAaNIMEYw ++CQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwLAYDVR0RBCUwI4IJbG9jYWxob3N0hwR/ ++AAABhxAAAAAAAAAAAAAAAAAAAAABMA0GCSqGSIb3DQEBCwUAA4ICAQCGQCs10hwY ++t5o3AWjU8oT8HWnLDsEzIvI/Z2dvtsFSOFotH14d8a7CdCKNiry8BbQ82A4sG/Xw ++0aVdP1EscxGhpJuMHG4Ph9PZBm31ZW2VoRHOEs7/Moi6G/1yldVxWUH/qXO00Dw9 ++cEsiUQdPrPQDoVBKYAMuV15RP9b3iPpw3GY1EkIu+akGVziHFmFYUoU2gctiGIZ6 ++6KiqBFvCP1Yvm3RSZ5t/Kv/jPMetAnCq+9JAUAodAh2+goBvUCAN9Itr/tEs98jq ++9d14J7gzIRDdNHKOLrRFmoMrTaDZNtqBe5jiMf0O55tgjv4BqN4w11M51bjY4umd ++GX+OXoBJG+MK7AZyaHPjHa1NMoLDOUhTvHb4zPNkPiVb8r3lYkQ4VCtre+4qqrEn ++cEt9KWGpHkoz4GSKn6uidQebdi4waexcGttsHbKPaKZqzYXAJ2bjFZnv85zPtpjO ++qxzqrMUruiCU7EfjGAdZ8S0lwjdMihznLATjKuwQkJ2mVg2HbLgxZu578FHTBOHW ++LjVIr/80auF4Ino9ocHpIwL/E4jpYQWP/Uv4KBHwkAktmUOwqyt0iysRaWy4Gp7S ++keBI9FoGtJ1Mq5M2tVINBzt1ESC3t03KqyY+/9r/IeY7A7yukC0YJnJ+HorfuQFf ++0//7DOEA58bRswyWTLOAjYMJHilTKOozSQ== + -----END CERTIFICATE----- +diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf +index a3c8ad9f6..632cff11c 100644 +--- a/tests/data/tls/conf/openssl.cnf ++++ b/tests/data/tls/conf/openssl.cnf +@@ -51,7 +51,7 @@ commonName = supplied + emailAddress = optional + + [ req ] +-default_bits = 2048 ++default_bits = @KEY_BITS@ + default_keyfile = privkey.pem + distinguished_name = req_distinguished_name + attributes = req_attributes +diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh +index 8c33a24fe..739f8eaf1 100755 +--- a/tests/data/tls/create-crt.sh ++++ b/tests/data/tls/create-crt.sh +@@ -5,6 +5,9 @@ if [ x"$openssl" = "x" ]; then + echo "OpenSSL command line binary not found, skipping..." + fi + ++KEY_BITS=4096 ++KEY_TYPE=rsa:$KEY_BITS ++ + USAGE="$0 [-s] [-u ]" + SERVER=0 + USER=0 +@@ -45,13 +48,13 @@ echo "00" > cruft/serial + touch cruft/index.txt + touch cruft/index.txt.attr + hn=$(hostname -f) +-sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf > ./openssl.cnf ++sed -e "s;@HOSTNAME@;$hn;" -e "s;@KEY_BITS@;$KEY_BITS;" conf/openssl.cnf > ./openssl.cnf + + if [ $SERVER = 1 ]; then + rm -rf private/localhost.key certs/localhost.crt + + $openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \ +- -newkey rsa:1024 -config ./openssl.cnf \ ++ -newkey $KEY_TYPE -config ./openssl.cnf \ + -subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \ + -batch > /dev/null 2>&1 + +@@ -66,7 +69,7 @@ if [ $USER = 1 ]; then + rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr + + $openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \ +- -newkey rsa:1024 -config ./openssl.cnf \ ++ -newkey $KEY_TYPE -config ./openssl.cnf \ + -subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \ + -batch >/dev/null 2>&1 + +diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key +index 5f4625fd7..e30e11586 100644 +--- a/tests/data/tls/private/bjensen@mailgw.example.com.key ++++ b/tests/data/tls/private/bjensen@mailgw.example.com.key +@@ -1,16 +1,52 @@ + -----BEGIN PRIVATE KEY----- +-MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2 +-xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4 +-9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z +-yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r +-oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e +-nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg +-xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra +-EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd +-9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/ +-pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI +-tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ +-3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D +-tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg +-36Ixj3L+5H18 ++MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQCcHBkHcUSKG4s7 ++nKmcqZT3EoZkEgxoaMlpxUZtxBtO5ZXEfcpMaxuA7qkZvMJR8ws2u8TQU/18FhH4 +++0aZBefM0ExwqvGNJ8F0cTl3439DGNE+/psh5NWgqPYe/K3bAtSRtF7wDxF77eb2 ++Yz0J3NIDxFrAbovfg0ydbt9pWJr5pDBvlqSdYu38kpIB5WENCEy77QK9GEGAlMVI ++RXneA5t2CKsljujRG1H5YJeS6qVAEdMllHZ6a0nNLxTdLe1qbZyRgEqRKgW5WcWr ++W46Co9CRDcFeMqoHdwAQsRdOGBivgkeYUST1yImsCbzlSRLC1dfj++2mzCMxoc3x ++pZNPyHyBuRgou8VqWpF2NuG+KS7QBtm1PVUhSAvRX9uQOnXnazQvlRfsaHQjGUKy ++hMUr5dcwpTqThW4BoqtStd6/097sZTZVWmsC+mzLtwWkESVDU0tNg/czWLn56smV ++7DfPjFDDAV6eNcScFfD8w04aPdk8ODalW/wnsTjILQuEBssrV1h8WblruWRU31Mn +++mw9SA3tDfTk9sJiEyiTJh3B1DrEb+pIuk4vz5uicNcYTXCfa5ZpPL608f7cWuG2 ++GP8f5ug4PMKyRkh6qCt7BWrVgOheo1ZhjvrbmhI4yPXHATrCtYO1wqIyu9Yuirdg ++7WJD6npu8IV38VEgEBD3UFanY9xN7wIDAQABAoICAQCWY/s40EXXRvG7XBGKe1Sn ++MZGGllyduVVQMFzJIkOsnkDKKuTY+dZlP4Zo5Q/PIvWKpRnWGRP6lsh5tJkukiHd ++jk4VvJk4AzS7mNhkRyYy3ZW3ulB5NpsXS67P610RwIhIVhuf6ORPH8GBW9lRxwoL ++1v4WpGjbywHkKQvR0Sp7lVGULuwnM0dSK2G9sdztUTGbWZlp0hRIawojtcrRt2ft ++Liyy4hooWMmAFS3wu1y3fHSNn5kEFpfis5jF+5jdDvvmsFElx/X7uiBUFMAV2vry ++wu2mceibiGjnq7Nn6I7fhgKzGnkgzzDSLA9uVBde2+RAHlO0fLTq+5YLVhe0pNBM ++J1Y0soNaO3XfVV6Vnyz8X+ruHItW2OBF9AYhIlXq/6d3MMX51BEM6odEtsi8zFgo ++ENN0GAXoyoofg+IvzPiVU2Ud7s4pAlK473d7sAQEeiFWaj7iwueAgofSUFRz7E/H ++umdhytKiJXqcjJ9O2k4sBsmQoPIB++LlUPRIlZY9UvTFxLbd/ifFUv5fqa6z0IX6 ++wkIzXmRHhG+ETk1IZBJAAho7iyyYOTP+JnnToUAMWoUaZUO2bzaZfQha8Z3KVtG/ ++PJUfHClBXqvFNaAUvA9Df3JoJddJ4pO1g0QjS/dp4C2KwNkH4oqMJctvCersoPWu ++5DYiWY6KR4GjokJ1lBeWAQKCAQEAzSKa+m2C4ANNCJB9tcKYDbYIdibCpzO+k1Fb ++gZUtNi9dEE0Po8rMG0jthm+GKJjNjiG5idSUMo+WNEGBPkELueex81AlEpOqQ6/9 ++67cyjAsF/FvgkWOpKJnGOySF/TpK4kPGYyS3ICvs1KNE5HEywHyC4C/MD8N9Z5tX ++/DfW6sBM/wPipE9YDpKfAg3fDG9YJN/gJZ8TlZVqzzw75rKGcMeLc8f0mbMo+KWQ ++VKV4vrgz1eiVrHc5VeGUaXe1Yei5El671wAdtFdmm51A2fWd80fPlQdqfAwpX7x4 ++FWuo9z2QX70rM/NTWfk4nQ6ZFEHxtm++OiTfh7RwauI8fxye6QKCAQEAwtF/tOth ++UgHrohB2DCE9gA0rxkynJHK9/SXSd0KBjERO2i41iuC9YlJT/NpNz9fM7l+L02aP ++wWLMqyC7moNmIpJMY2xBGU0EowQ/3xsSNo3u/fvOS4MyGLKENUPMFgO0J7yopiqt ++Ea31TcrFSTMSmFZCv8cGt38EwS6sdJZd/RB+h3yxesit8pouwpfbtLPx6LSGkPHY ++5nNVPgbt6xaxZJ/1kNbLFObSoZ3lzWBwp93dQh/WqeeeI51LGdM1G6fTL8HrmGFJ ++EX0AKpexFVnG/GROJc8taWtMbk9W5oK30JqR7hpSaluYbonpr9k4WQA+EAZjXfcJ ++0V0AMsMUhGtvFwKCAQAQZf7LnCuFKt5im+JgwFCVcALXJxwSb7GBZ1SQVFOL7Fdd ++MTvZ1SFh4P+T6qBn6GcuQIXrfcHnFNFmFgJ17o84akwwbiy4gnNu+8epqzhwN4Vf +++hxGoxfntftByRao+pr34YEfddTpznkdOnwMYvwypQF1WHzQmckRmjp7YB9fHsZI ++8I+SoQEiERiC+oblIJWERR1PBJt1Lr+eF2uWcpkKtPjx5X8pNkhFMD8MdTnkzSbf ++p7snUVSVB/ZsQ/SNAiShUk9jzY+SVhZOxFBl3BunUgtHF5OsnPBFxfQ3iia0tQgw ++jxfADGiSXbjn3T3hf7AJ7H7heQchewwtjy5U3v3ZAoIBAQCEAyRPe0SKJoT+X7su ++QwQClmo4SE7mUt5NAOkaKTXRz6PDEpbzkZCjZHhHGcKqeWgDizkbuh7lg0Z/G4Ik ++lK+L86jRolSGiXr/3+xMCXMRBqKQ9qV24+L5e1Y9JcDQlhfo6V06pCZ8mW1lFmcT ++UAlksucuPvZdNzQIl9ECe7YauqeStbsqIXxFrZbMA808KMde0Z1x8H/ywOpdSqLD ++r6/rKL1lNTeN5U+Ldox228fa6Gt62EpE/Y9aQMbYLBeLsvBXJ0e3DQ1PTW3kbr/v ++YNOGyY1u73GtQqkbAqY3MxLNxz/loW6BZanoFYoFv+L/5Dsp7ro8vR6pASUWQLzR ++cl9nAoIBAQCre87G76UXv6FIggT+cKM9MKS69KIE3mzNTYUo90L74vF65hJqlaIa ++mfEcPpEU+UY+ufZSIHtTDBj/9Rswaf5whJY7RfL42pSGnW2YOMpuwDIKAEvcJedu ++kZhbthBin4pa28X6L5sNxug+7Wykgesd48PmMLG4pTF+D9u7SgO37Ew5UzylPWNi ++Lrv9TlX1vv9rNFh/hOCA93DNrJlNNPltIcMDByVVjrq31QmxMJwE7cdvl1V7eoiO ++NQuGuGyFIEKPtl9dEUaA4SGYZ7fUqPZaZuzzM0Xa5UMpdcIzcuYYNn3G6FvV6vwU ++dH+lv5X1bTB18GK88ANpC2qLCKRJPCTx + -----END PRIVATE KEY----- +diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key +index 8a24f69f8..99cb512c4 100644 +--- a/tests/data/tls/private/localhost.key ++++ b/tests/data/tls/private/localhost.key +@@ -1,16 +1,52 @@ + -----BEGIN PRIVATE KEY----- +-MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg +-ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM +-w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM +-brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij +-Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf +-2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ +-bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q +-1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf +-3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U +-VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7 +-TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b +-iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP +-5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3 +-b61hkjQZfbEg5cg= ++MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDpR3z26BqHahZj ++TSrWD4zo2SmW57DC8ari2Qxq7WCr5DkGK/rVu5uB1IBn5mSTF7dLHRm/uLnCV0g3 ++jBeoQOUyDaqF/MoNI0pSh9zTPsUsxvQKfjpaqVyJQJhV60eEGCEZ37p/E47P7H3w ++WGKICJ/4B2JRYFMoUWiFZej/1qIaCbS54mPY1LcTJpzE4qhNwN31Myw4nZ8wfYyW ++q4CsuhsK+6mE6tVuoGh56iXZLMUMM5byvI8PMUbLnGFkeSb/ewYigOkOQNHTKG8H ++Ofjup0sjmbJzoWP3qztLbGCqKoZclbQPQUJ+lRBfF+ZqHP8l3CX6GqzkSD9oD4sT ++/uWZLuzOjfPAlDncCl1xq6keLh9TrTA9Wt2jb3AvAM6EO5L45zWizVTIm3RPRr7M ++Hg8g/avGJ/LEjWJaZkW3u0nIu/WTvIw3sIsJbOxLLk8FmkaYdX1Zu9vrrQ3o3OUU ++MyqeMlYMCvUEuhXjLCamJY+HL/sm0pcV7VXeNPky8Yzbog4L7MLDBlXIQggBJ5Z6 ++lkO62jTQuqjuM4pKUtGa6FNfUQsrzFhfplT9/PQXBidsu7psjiZEZ9snXZ9ZiblA ++yN7ZAC6+d1+Lvn0dR64uXpOCZ5AWCoUD/oqTCjPQ1xsppqP4HK8td8jhLeW+TBPb ++qc4C33rp9vVux2Rvw/nY12Sp5IyTlwIDAQABAoICADh1+wLvjmwz+xMxvCpvPRWm ++afCCR0AHqeqZye2fYoR4Cm05+837SFoWCrYbB0CqvsxJUNAcb6lf4rS/DYLFojOJ ++JzqiwmyHnBd5lrLyQFrkFHDtuEX1M9ZscfJprbeE944BnmvfWfNtM9YWLlLqc31e ++nCdB/x6FBZ0z2z8Avd87dih/aNc0NNNHxy3IBiA7i/0q04soaz0bRgm5nL0xlhYE ++bzUieWH7JQ5M47g6o76eReyeQqnUrWPeh5v/zraLGiMDvGScv6wx3x2KpHtutjr5 ++mj1uVHm/UeyhYIwPGtIR0bDXhLaKcZnyeOw59G8/Z1mvVyUxb1dKW8kNKpj2yI2H ++Y1SjhW5qaOeaDPxAPqVyo6SUQIzOn6SD0l7aGyOyvYULjiw342HQYU4rQeSPOtjt +++NYMirnT7WNnmoSIsXx7nwUe38EWx5gCHy8taF4aZr5K85yZKnmsiX3vX/hH30yc ++GLOnDDa3b0FE2J2eYos14ru8RTqSLSxclr5Ru2yTdwLgE0gg+iygO1/tYYkqxZ09 ++j+METJpg4wv+cQUG/BxysISqNjaPSPHdyJeTMzC8B+PUUpbRoBuvLLokkZ9P95nG ++72TFklEOB0m0VMxrEfev0HGSzkQm92s2Bf41TRaHTPSkg+G1s0haZTNqRVTGPrr/ ++eyiz0qH2bgDeubJ3VuTBAoIBAQD9N+KeKo+hRWeV/I6BCBOfMeQOqlqIxYfYAxU+ ++CuutILbTnGKFMTAx43syh/a5EV7q4yM81RCXKK/Lmja2OIeYJUb88bC/h0x/gq5W ++LLxHbKgFDUDF2VcWShMqDOo8J8FbzWwb9bOOShqASoR6FacJuOqlFvS8gaswZtiW ++fOvlWRKO2ybULgQctX5gOf1ctuab1VrzuHnNB30gVFc95Dg1b6RiyVAa8AFm6gs9 ++6Rewk527+4T5Ho5UXvdsTVJsAhzJgVjPSyF2Vc1CRrp8lIffsg5Prb4w8kvB0i64 ++09zn+jAfVRpjdGWqMI7BR1pCdheGMqv006ZVYY+QhcBIb0BHAoIBAQDr14d5PPDv ++pCjlJnCKNzX2irU6bdIY+zvXoemj/cYvHqQbPOe/kaCWFNPMxANKMmZSTdSM7qqR ++s0P1RW/R7moWNSesYwW+2Jp2hIhiWmy+E+ksXeTlFwVpuMHSDPS/N61N8XgmT3pI ++Qngl1hgxGbttniKEwI+Nc7Z3FYDDCp206nmC5y33D+ZYHv1L3e33pyqHdHD/uIeU ++57OPr7Mmd/J6pmClh1dqyZwVBClc2V6w0y2G8Lk1v79wOMrn+4/p9KH2BgkFe2gr ++uB8TOLlUhttQ8VfzXCd+Zi9s3oW0h7Vkvt4kDlJm0MrnMmK0aqgKB+7XkKE0ccVQ ++xSodzbBdDYoxAoIBAH2qGmD8JkOWug2JRP9sDrDWhaNxj3SI8x2Uiho8OTG2JoVl +++s621oArsJwnNZ4qrLxM9NPfuVgK7RNR+Qz9iO1MsqodF+Y1MxWkuPgzQ0z+83Nu ++XFLTxZBeOpyHxEcOQ7tXeut1SCK5S+WXFZ+w1zDQAELl3ZcfkuF2aM5mOHuddMRI ++pkBuhcPpnkoK/V3htxhnDbgeOPQzXzmIIbOpauu5+A6+cW6s5UU5qVKUNxl+aK09 ++6YPoUiI07v1kch7//WFTO8vEMVsUwcS+bRYecD/nkYqhYt3PoSETOfSnz92gH/ms ++tmfdAAcyCeaJjpWlHY+P3h6mWsnMnP7QIdjQvUkCggEAGFkiBWRDQ5phFndHex2E ++FrXvS972p9mYLgTrSCD1CvxQ2PcKvf5c4+G2lBdQd6KIacrbPMmPFoe5ZmMKzlOc ++5DoMpIF8oF1gZQf9xJmtTFpl4ky3Sud7iZSnffYUdoFbBQb+7oWaDEfAe7eEu9z6 ++OrDuw2HV8DaYCedQadJ4warLbLZNSop7r3FTmTeKT90USPO+jsgQR1E8eoMbLceI ++Yx02MSCt57p0wL6zPoC6g+rpclr75A6txvo2CIkyLGczKWEqIUTCVnEl1CgxCgb6 ++MXsZJ2jGMwh9sPGwQBkaoxIJgRNxcmfv6rqK8jFos9Bp2ht2aSGty07vsDACGzlA ++oQKCAQEA8PzgkyGYHs2DwNhmv3j5ZFaP0RukwbdChSoxmbC9JP2JJxxYcnww5jYH ++xeM1bahqkdKyG5iDRiYB74EolZUMA3Zny13R4HWxNe4aUZW1H8mdmhllXX90aUOU ++WEvF2yYZbg9CQIq7zQh8HsF/S8sDTsXoZOx30zrPgb44spWKRmxdwUJt944weXvc ++p5XkLvVzBVJ+RD5IgPTBFl1iCkw3eq01CFcbTdfe9cS8V9IgDy0Jq2GvRE3Y2JS6 ++xqtBB1MgZvrUoAZ8jPacRRXddg87Hwgs9+R1jaE+ZYixojOFg+JnQOGkUd9FhJAW ++bcnWV4XIPIMbouL4132Ove+GukJlPA== + -----END PRIVATE KEY----- +-- +2.29.2 + diff --git a/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch b/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch new file mode 100644 index 0000000..125ae6b --- /dev/null +++ b/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch @@ -0,0 +1,487 @@ +From 8e3e85e329f5cbd989936b0df8a0ac06906a4824 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 14 Apr 2020 16:19:05 +0300 +Subject: [PATCH] auth: add SASL/GSSAPI tests + +--- + tests/data/krb5.conf | 32 ++++++ + tests/data/slapd-sasl-gssapi.conf | 65 ++++++++++++ + tests/scripts/conf.sh | 3 + + tests/scripts/defines.sh | 5 + + tests/scripts/setup_kdc.sh | 144 +++++++++++++++++++++++++++ + tests/scripts/test077-sasl-gssapi | 159 ++++++++++++++++++++++++++++++ + 6 files changed, 408 insertions(+) + create mode 100644 tests/data/krb5.conf + create mode 100644 tests/data/slapd-sasl-gssapi.conf + create mode 100755 tests/scripts/setup_kdc.sh + create mode 100755 tests/scripts/test077-sasl-gssapi + +diff --git a/tests/data/krb5.conf b/tests/data/krb5.conf +new file mode 100644 +index 000000000..739113742 +--- /dev/null ++++ b/tests/data/krb5.conf +@@ -0,0 +1,32 @@ ++[libdefaults] ++ default_realm = @KRB5REALM@ ++ dns_lookup_realm = false ++ dns_lookup_kdc = false ++ default_ccache_name = FILE://@TESTDIR@/ccache ++ #udp_preference_limit = 1 ++[realms] ++ @KRB5REALM@ = { ++ kdc = @KDCHOST@:@KDCPORT@ ++ acl_file = @TESTDIR@/kadm.acl ++ database_name = @TESTDIR@/kdc.db ++ key_stash_file = @TESTDIR@/kdc.stash ++ } ++[kdcdefaults] ++ kdc_ports = @KDCPORT@ ++ kdc_tcp_ports = @KDCPORT@ ++[logging] ++ kdc = FILE:@TESTDIR@/kdc.log ++ admin_server = FILE:@TESTDIR@/kadm.log ++ default = FILE:@TESTDIR@/krb5.log ++ ++#Heimdal ++[kdc] ++ database = { ++ dbname = @TESTDIR@/kdc.db ++ realm = @KRB5REALM@ ++ mkey_file = @TESTDIR@/kdc.stash ++ log_file = @TESTDIR@/kdc.log ++ acl_file = @TESTDIR@/kadm.acl ++ } ++[hdb] ++ db-dir = @TESTDIR@ +diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf +new file mode 100644 +index 000000000..611fc7097 +--- /dev/null ++++ b/tests/data/slapd-sasl-gssapi.conf +@@ -0,0 +1,65 @@ ++# stand-alone slapd config -- for testing (with indexing) ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2020 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++# ++include @SCHEMADIR@/core.schema ++include @SCHEMADIR@/cosine.schema ++# ++include @SCHEMADIR@/corba.schema ++include @SCHEMADIR@/java.schema ++include @SCHEMADIR@/inetorgperson.schema ++include @SCHEMADIR@/misc.schema ++include @SCHEMADIR@/nis.schema ++include @SCHEMADIR@/openldap.schema ++# ++include @SCHEMADIR@/duaconf.schema ++include @SCHEMADIR@/dyngroup.schema ++ ++# ++pidfile @TESTDIR@/slapd.1.pid ++argsfile @TESTDIR@/slapd.1.args ++ ++# SSL configuration ++TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt ++TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key ++TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt ++ ++# ++rootdse @DATADIR@/rootdse.ldif ++ ++#mod#modulepath ../servers/slapd/back-@BACKEND@/ ++#mod#moduleload back_@BACKEND@.la ++#monitormod#modulepath ../servers/slapd/back-monitor/ ++#monitormod#moduleload back_monitor.la ++ ++ ++####################################################################### ++# database definitions ++####################################################################### ++ ++database @BACKEND@ ++suffix "dc=example,dc=com" ++rootdn "cn=Manager,dc=example,dc=com" ++rootpw secret ++#~null~#directory @TESTDIR@/db.1.a ++#indexdb#index objectClass eq ++#indexdb#index mail eq ++#ndb#dbname db_1_a ++#ndb#include @DATADIR@/ndb.conf ++ ++#monitor#database monitor ++ ++sasl-realm @KRB5REALM@ ++sasl-host localhost +diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh +index 2a859d89d..5b477ed93 100755 +--- a/tests/scripts/conf.sh ++++ b/tests/scripts/conf.sh +@@ -97,4 +97,7 @@ sed -e "s/@BACKEND@/${BACKEND}/" \ + -e "s;@TESTWD@;${TESTWD};" \ + -e "s;@DATADIR@;${DATADIR};" \ + -e "s;@SCHEMADIR@;${SCHEMADIR};" \ ++ -e "s;@KRB5REALM@;${KRB5REALM};" \ ++ -e "s;@KDCHOST@;${KDCHOST};" \ ++ -e "s;@KDCPORT@;${KDCPORT};" \ + -e "/^#/d" +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index 26dab1bae..78dc1f8ae 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -108,6 +108,7 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf + SCHEMACONF=$DATADIR/slapd-schema.conf + TLSCONF=$DATADIR/slapd-tls.conf + TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf ++SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf + GLUECONF=$DATADIR/slapd-glue.conf + REFINTCONF=$DATADIR/slapd-refint.conf + RETCODECONF=$DATADIR/slapd-retcode.conf +@@ -214,6 +215,7 @@ PORT3=`expr $BASEPORT + 3` + PORT4=`expr $BASEPORT + 4` + PORT5=`expr $BASEPORT + 5` + PORT6=`expr $BASEPORT + 6` ++KDCPORT=`expr $BASEPORT + 7` + URI1="ldap://${LOCALHOST}:$PORT1/" + URIP1="ldap://${LOCALIP}:$PORT1/" + URI2="ldap://${LOCALHOST}:$PORT2/" +@@ -239,6 +241,9 @@ SURIP5="ldaps://${LOCALIP}:$PORT5/" + SURI6="ldaps://${LOCALHOST}:$PORT6/" + SURIP6="ldaps://${LOCALIP}:$PORT6/" + ++KRB5REALM="K5.REALM" ++KDCHOST=$LOCALHOST ++ + # LDIF + LDIF=$DATADIR/test.ldif + LDIFADD1=$DATADIR/do_add.1 +diff --git a/tests/scripts/setup_kdc.sh b/tests/scripts/setup_kdc.sh +new file mode 100755 +index 000000000..1cb784075 +--- /dev/null ++++ b/tests/scripts/setup_kdc.sh +@@ -0,0 +1,144 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2020 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++export KRB5_TRACE=$TESTDIR/k5_trace ++export KRB5_CONFIG=$TESTDIR/krb5.conf ++export KRB5_KDC_PROFILE=$KRB5_CONFIG ++export KRB5_KTNAME=$TESTDIR/server.kt ++export KRB5_CLIENT_KTNAME=$TESTDIR/client.kt ++export KRB5CCNAME=$TESTDIR/client.ccache ++ ++KDCLOG=$TESTDIR/setup_kdc.log ++KSERVICE=ldap/$LOCALHOST ++KUSER=kuser ++ ++. $CONFFILTER < $DATADIR/krb5.conf > $KRB5_CONFIG ++ ++PATH=${PATH}:/usr/lib/heimdal-servers:/usr/sbin:/usr/local/sbin ++ ++echo "Trying Heimdal KDC..." ++ ++kdc --version 2>&1 | grep Heimdal > $KDCLOG 2>&1 ++RC=$? ++if test $RC = 0 ; then ++ ++ kstash --random-key > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kstash failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ flags="--realm-max-ticket-life=1h --realm-max-renewable-life=1h" ++ kadmin -l init $flags $KRB5REALM > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin init failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l add --random-key --use-defaults $KSERVICE > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin add failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l ext -k $KRB5_KTNAME $KSERVICE > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin ext failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l add --random-key --use-defaults $KUSER > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin add failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l ext -k $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin ext failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kdc --addresses=$LOCALIP --ports="$KDCPORT/udp" > $KDCLOG 2>&1 & ++else ++ echo "Trying MIT KDC..." ++ ++ kdb5_util create -r $KRB5REALM -s -P password > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kdb5_util create failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "addprinc -randkey $KSERVICE" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: admin addprinc failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "ktadd -k $KRB5_KTNAME $KSERVICE" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kadmin ktadd failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "addprinc -randkey $KUSER" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kadmin addprinc failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "ktadd -k $KRB5_CLIENT_KTNAME $KUSER" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kadmin ktadd failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ krb5kdc -n > $KDCLOG 2>&1 & ++fi ++ ++KDCPROC=$! ++sleep 1 ++ ++kinit -kt $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ kill $KDCPROC ++ echo "SASL/GSSAPI: kinit failed, skipping GSSAPI tests" ++ exit 0 ++fi ++ ++pluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null ++RC=$? ++if test $RC != 0 ; then ++ ++ saslpluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null ++ RC=$? ++ if test $RC != 0 ; then ++ kill $KDCPROC ++ echo "cyrus-sasl has no GSSAPI support, test skipped" ++ exit 0 ++ fi ++fi +diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi +new file mode 100755 +index 000000000..64abe16fe +--- /dev/null ++++ b/tests/scripts/test077-sasl-gssapi +@@ -0,0 +1,159 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2020 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_SASL = no ; then ++ echo "SASL support not available, test skipped" ++ exit 0 ++fi ++ ++mkdir -p $TESTDIR $DBDIR1 ++cp -r $DATADIR/tls $TESTDIR ++ ++cd $TESTWD ++ ++ ++echo "Starting KDC for SASL/GSSAPI tests..." ++. $SRCDIR/scripts/setup_kdc.sh ++ ++echo "Running slapadd to build slapd database..." ++. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1 ++$SLAPADD -f $CONF1 -l $LDIFORDERED ++RC=$? ++if test $RC != 0 ; then ++ echo "slapadd failed ($RC)!" ++ kill $KDCPROC ++ exit $RC ++fi ++ ++echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." ++$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID" ++ ++sleep 1 ++ ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $URI1 \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPSEARCH -x -H $URI1 -s "base" -b "" supportedSASLMechanisms > $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++grep GSSAPI $TESTOUT ++RC=$? ++if test $RC != 0 ; then ++ echo "failed: GSSAPI mechanism not in supportedSASLMechanisms." ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo -n "Using ldapwhoami with SASL/GSSAPI: " ++$LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 > $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Validating mapped SASL/GSSAPI ID: " ++echo "dn:uid=$KUSER,cn=$KRB5REALM,cn=gssapi,cn=auth" > $TESTDIR/dn.out ++$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT ++RC=$? ++if test $RC != 0 ; then ++ echo "Comparison failed" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++else ++ echo "success" ++fi ++ ++if test $WITH_TLS = no ; then ++ echo "SASL/GSSAPI: TLS support not available, skipping TLS part." ++else ++ echo -n "Using ldapwhoami with SASL/GSSAPI with start-tls: " ++ $LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow \ ++ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ > $TESTOUT 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ else ++ echo "success" ++ fi ++ ++ echo -n "Using ldapwhoami with SASL/GSSAPI with ldaps: " ++ $LDAPSASLWHOAMI -N -Y GSSAPI -H $SURI2 -o tls_reqcert=allow \ ++ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ > $TESTOUT 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ else ++ echo "success" ++ fi ++fi ++ ++kill $KDCPROC ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++if test $RC != 0 ; then ++ echo ">>>>> Test failed" ++else ++ echo ">>>>> Test succeeded" ++ RC=0 ++fi ++ ++test $KILLSERVERS != no && wait ++ ++exit $RC +-- +2.29.2 + diff --git a/openldap.spec b/openldap.spec index ba19620..06512bf 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.58 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -36,6 +36,24 @@ Patch17: openldap-allop-overlay.patch Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch Patch24: openldap-openssl-manpage-defaultCA.patch +# The below patches come from upstream master and are necessary for Channel Binding +# (both tls-unique and tls-server-end-point) to work properly. +# Additionally, for Samba to be able to implement Channel Binding, the PEERCERT option +# is being included as well. +Patch50: openldap-cbinding-Add-channel-binding-support.patch +Patch51: openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch +Patch52: openldap-cbinding-ITS-8573-TLS-option-test-suite.patch +Patch53: openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch +Patch54: openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch +Patch55: openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch +Patch56: openldap-cbinding-Make-prototypes-available-where-needed.patch +Patch57: openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch +Patch58: openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch +Patch59: openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch +Patch60: openldap-cbinding-Fix-slaptest-in-test077.patch +Patch61: openldap-cbinding-Convert-test077-to-LDIF-config.patch +Patch62: openldap-cbinding-Update-keys-to-RSA-4096.patch + # check-password module specific patches Patch90: check-password-makefile.patch Patch91: check-password.patch @@ -128,6 +146,19 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch17 -p1 %patch19 -p1 %patch24 -p1 +%patch50 -p1 +%patch51 -p1 +%patch52 -p1 +%patch53 -p1 +%patch54 -p1 +%patch55 -p1 +%patch56 -p1 +%patch57 -p1 +%patch58 -p1 +%patch59 -p1 +%patch60 -p1 +%patch61 -p1 +%patch62 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -521,6 +552,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Thu Apr 8 2021 Simon Pichugin - 2.4.58-2 +- Backport Channel Binding support (#1822904, #1822737) + * Tue Mar 23 2021 Simon Pichugin - 2.4.58-1 - Rebase to version 2.4.58 (#1939663) @@ -531,7 +565,7 @@ exit 0 * Tue Jan 26 2021 Fedora Release Engineering - 2.4.57-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild -* Wed Jan 19 2021 Simon Pichugin - 2.4.57-1 +* Tue Jan 19 2021 Simon Pichugin - 2.4.57-1 - Rebase to version 2.4.57 (#1917583) * Thu Nov 26 2020 Simon Pichugin - 2.4.56-4 From 8385ce0f4f968192568caa9e102e1868b3e36ae1 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 21 May 2021 12:37:43 +0200 Subject: [PATCH 069/118] Perl 5.34 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 06512bf..0f2b7e1 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.58 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -552,6 +552,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Fri May 21 2021 Jitka Plesnikova - 2.4.58-3 +- Perl 5.34 rebuild + * Thu Apr 8 2021 Simon Pichugin - 2.4.58-2 - Backport Channel Binding support (#1822904, #1822737) From 5d3d0ce081bc6728988ba1a8d35fa796c22d41df Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Tue, 18 May 2021 10:28:43 +0200 Subject: [PATCH 070/118] Rebuild without MP_2 support and fix coverity issues Resolves: #1967136 --- ...binding-ITS-9215-fix-for-glibc-again.patch | 28 +++++++++++++++++++ openldap.spec | 10 +++++-- 2 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 openldap-cbinding-ITS-9215-fix-for-glibc-again.patch diff --git a/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch b/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch new file mode 100644 index 0000000..ec62c85 --- /dev/null +++ b/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch @@ -0,0 +1,28 @@ +From d548ab15e0d615524c403440c01a9748bfcac87d Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Tue, 28 Apr 2020 16:33:41 +0100 +Subject: [PATCH] ITS#9215 fix for glibc again + +--- + libraries/libldap_r/thr_posix.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libraries/libldap_r/thr_posix.c b/libraries/libldap_r/thr_posix.c +index e4b435707..62f94ca16 100644 +--- a/libraries/libldap_r/thr_posix.c ++++ b/libraries/libldap_r/thr_posix.c +@@ -18,6 +18,11 @@ + + #if defined( HAVE_PTHREADS ) + ++#ifdef __GLIBC__ ++#undef _FEATURES_H ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#endif ++ + #include + + #ifdef REPLACE_BROKEN_YIELD +-- +2.31.1 + diff --git a/openldap.spec b/openldap.spec index 0f2b7e1..036a244 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.58 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -53,6 +53,7 @@ Patch59: openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_S Patch60: openldap-cbinding-Fix-slaptest-in-test077.patch Patch61: openldap-cbinding-Convert-test077-to-LDIF-config.patch Patch62: openldap-cbinding-Update-keys-to-RSA-4096.patch +Patch63: openldap-cbinding-ITS-9215-fix-for-glibc-again.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -159,6 +160,7 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch60 -p1 %patch61 -p1 %patch62 -p1 +%patch63 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -187,7 +189,7 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS -DLDAP_USE_NON_BLOCKING_TLS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS -DLDAP_USE_NON_BLOCKING_TLS -DOPENSSL_NO_MD2" pushd openldap-%{version} %configure \ @@ -552,6 +554,10 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Thu Jun 3 2021 Simon Pichugin - 2.4.58-4 +- Rebuild without MP_2 support (#1967136) +- Fix coverity issues + * Fri May 21 2021 Jitka Plesnikova - 2.4.58-3 - Perl 5.34 rebuild From 0a701caf56cfbe6d2c9bbef357527cfcbbb82b7d Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 10 Jun 2021 15:46:30 +0200 Subject: [PATCH 071/118] Fix slapd.tmpfiles complaints Resolves: #1972147 --- openldap.spec | 5 ++++- slapd.tmpfiles | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/openldap.spec b/openldap.spec index 036a244..4d126a9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.58 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -554,6 +554,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Tue Jun 15 2021 Simon Pichugin - 2.4.58-5 +- Fix slapd.tmpfiles complaints (#1972147) + * Thu Jun 3 2021 Simon Pichugin - 2.4.58-4 - Rebuild without MP_2 support (#1967136) - Fix coverity issues diff --git a/slapd.tmpfiles b/slapd.tmpfiles index 56aa32e..634cea1 100644 --- a/slapd.tmpfiles +++ b/slapd.tmpfiles @@ -1,2 +1,2 @@ # openldap runtime directory for slapd.arg and slapd.pid -d /var/run/openldap 0755 ldap ldap - +d /run/openldap 0755 ldap ldap - From 621a15cfd3fd6d52ec22de6a4c7d34ce2e96dc7f Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 10 Jun 2021 15:53:10 +0200 Subject: [PATCH 072/118] Use https:// for source Resolves: #1972141 --- openldap.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 4d126a9..770fe8f 100644 --- a/openldap.spec +++ b/openldap.spec @@ -12,7 +12,7 @@ Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ -Source0: ftp://ftp.OpenLDAP.org/pub/OpenLDAP/openldap-release/openldap-%{version}.tgz +Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-%{version}.tgz Source1: slapd.service Source2: slapd.tmpfiles Source3: slapd.ldif @@ -556,6 +556,7 @@ exit 0 %changelog * Tue Jun 15 2021 Simon Pichugin - 2.4.58-5 - Fix slapd.tmpfiles complaints (#1972147) +- Use https:// for source (#1972141) * Thu Jun 3 2021 Simon Pichugin - 2.4.58-4 - Rebuild without MP_2 support (#1967136) From a924611f4e67cd1e43016528788ebd70326bc365 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 7 Jul 2021 17:34:10 +0200 Subject: [PATCH 073/118] Rebase to version 2.4.59 Resolves: #1980015 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 04c4971..aa6af81 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ /openldap-2.4.56.tgz /openldap-2.4.57.tgz /openldap-2.4.58.tgz +/openldap-2.4.59.tgz diff --git a/openldap.spec b/openldap.spec index 770fe8f..7439623 100644 --- a/openldap.spec +++ b/openldap.spec @@ -6,8 +6,8 @@ %global so_ver 2 Name: openldap -Version: 2.4.58 -Release: 5%{?dist} +Version: 2.4.59 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -554,6 +554,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Wed Jul 7 2021 Simon Pichugin - 2.4.59-1 +- Rebase to version 2.4.59 (#1980015) + * Tue Jun 15 2021 Simon Pichugin - 2.4.58-5 - Fix slapd.tmpfiles complaints (#1972147) - Use https:// for source (#1972141) diff --git a/sources b/sources index 5bd8a20..d5dfa58 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.58.tgz) = 2fa2aa36117692eca44e55559f162c8c796f78469e6c2aee91b06d46f2b755d416979c913a3d89bbf9db14cc84881ecffee69af75b48e1d16b7aa9d2e3873baa +SHA512 (openldap-2.4.59.tgz) = 233459ab446da6e107a7fc4ecd5668d6b08c11a11359ee76449550393e8f586a29b59d7ae09a050a1fca4fcf388ea61438ef60831b3ae802d92c048365ae3968 From 66dbf1422125ea68fb95c3842a06ad4ff14baa46 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 7 Jul 2021 17:38:10 +0200 Subject: [PATCH 074/118] Update the spec file for upcoming autoconf-2.71 Resolves: #1943079 --- ...nding-ITS-8573-TLS-option-test-suite.patch | 37 ------------------- openldap.spec | 7 +++- 2 files changed, 5 insertions(+), 39 deletions(-) diff --git a/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch b/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch index e9f5172..4f9c34a 100644 --- a/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch +++ b/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch @@ -4,7 +4,6 @@ Date: Thu, 14 Jun 2018 16:12:59 +0100 Subject: [PATCH] ITS#8573 TLS option test suite --- - configure | 4 + configure.in | 4 + tests/data/slapd-tls-sasl.conf | 65 ++ tests/data/slapd-tls.conf | 61 ++ @@ -37,42 +36,6 @@ Subject: [PATCH] ITS#8573 TLS option test suite create mode 100755 tests/scripts/test068-sasl-tls-external create mode 100755 tests/scripts/test069-delta-multimaster-starttls create mode 100755 tests/scripts/test070-delta-multimaster-ldaps - -diff --git a/configure b/configure -index e87850ec2..e8a720961 100755 ---- a/configure -+++ b/configure -@@ -758,6 +758,7 @@ AUTH_LIBS - LIBSLAPI - SLAPI_LIBS - MODULES_LIBS -+WITH_TLS_TYPE - TLS_LIBS - SASL_LIBS - KRB5_LIBS -@@ -5133,6 +5134,7 @@ KRB4_LIBS= - KRB5_LIBS= - SASL_LIBS= - TLS_LIBS= -+WITH_TLS_TYPE= - MODULES_LIBS= - SLAPI_LIBS= - LIBSLAPI= -@@ -15582,6 +15584,7 @@ fi - if test $have_openssl = yes ; then - ol_with_tls=openssl - ol_link_tls=yes -+ WITH_TLS_TYPE=openssl - - - $as_echo "#define HAVE_OPENSSL 1" >>confdefs.h -@@ -15716,6 +15719,7 @@ fi - if test $have_gnutls = yes ; then - ol_with_tls=gnutls - ol_link_tls=yes -+ WITH_TLS_TYPE=gnutls - - TLS_LIBS="-lgnutls" diff --git a/configure.in b/configure.in index 0c7c0a9ee..cf143d9bf 100644 diff --git a/openldap.spec b/openldap.spec index 7439623..2d770ae 100644 --- a/openldap.spec +++ b/openldap.spec @@ -138,8 +138,6 @@ programs needed for accessing and modifying OpenLDAP directories. pushd openldap-%{version} -AUTOMAKE=%{_bindir}/true autoreconf -fi - %patch0 -p1 %patch2 -p1 %patch3 -p1 @@ -162,6 +160,10 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi %patch62 -p1 %patch63 -p1 +# The change is needed for autoconf-2.71 +sed 's@^AM_INIT_AUTOMAKE.*@AC_PROG_MAKE_SET@' -i configure.in +AUTOMAKE=%{_bindir}/true autoreconf -f -i + # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays mv contrib/slapd-modules/smbk5pwd/README contrib/slapd-modules/smbk5pwd/README.smbk5pwd @@ -556,6 +558,7 @@ exit 0 %changelog * Wed Jul 7 2021 Simon Pichugin - 2.4.59-1 - Rebase to version 2.4.59 (#1980015) +- Update the spec file for upcoming autoconf-2.71 (#1943079) * Tue Jun 15 2021 Simon Pichugin - 2.4.58-5 - Fix slapd.tmpfiles complaints (#1972147) From 371591c262afa6bbaa1ac794c8dd387f18b832b7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 17:16:05 +0000 Subject: [PATCH 075/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 2d770ae..5b83073 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.59 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -556,6 +556,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 2.4.59-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Jul 7 2021 Simon Pichugin - 2.4.59-1 - Rebase to version 2.4.59 (#1980015) - Update the spec file for upcoming autoconf-2.71 (#1943079) From deffd97bb98561f7de4d5a64d85bdcf802fa12bd Mon Sep 17 00:00:00 2001 From: Mark Fuller Date: Sun, 12 Sep 2021 10:33:53 +0000 Subject: [PATCH 076/118] Update openldap.spec Fix tiny typo (single omitted letter in summary for compat) --- openldap.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 5b83073..74b9f97 100644 --- a/openldap.spec +++ b/openldap.spec @@ -86,7 +86,7 @@ this package only if you plan to develop or will need to compile customized LDAP clients. %package compat -Summary: Package providing legacy non-threded libldap +Summary: Package providing legacy non-threaded libldap Requires: openldap%{?_isa} = %{version}-%{release} # since libldap is manually linked from libldap_r, the provides is not generated automatically %ifarch armv7hl i686 From 4ac8ebe5cf51a8ba3dcc50e6b40b49acb8e3e65c Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:10:02 +0200 Subject: [PATCH 077/118] Rebuilt with OpenSSL 3.0.0 --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 74b9f97..5fe511b 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.59 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -556,6 +556,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Tue Sep 14 2021 Sahana Prasad - 2.4.59-3 +- Rebuilt with OpenSSL 3.0.0 + * Thu Jul 22 2021 Fedora Release Engineering - 2.4.59-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 005aba9f80f084ae4c6a0b8ec05670009f1854e4 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 13 Sep 2021 10:26:25 -0700 Subject: [PATCH 078/118] Backport TLS SNI feature from OpenLDAP 2.5 Resolves: #2009534 --- openldap-add-tls-sni-support-to-libldap.patch | 197 ++++++++++++++++++ openldap.spec | 7 +- 2 files changed, 203 insertions(+), 1 deletion(-) create mode 100644 openldap-add-tls-sni-support-to-libldap.patch diff --git a/openldap-add-tls-sni-support-to-libldap.patch b/openldap-add-tls-sni-support-to-libldap.patch new file mode 100644 index 0000000..ee7e814 --- /dev/null +++ b/openldap-add-tls-sni-support-to-libldap.patch @@ -0,0 +1,197 @@ +From 19e631e977c4f57905b2380cf79ccaf8e6d99e9d Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 03:41:12 +0100 +Subject: [PATCH 1/4] ITS#9176 Add TLS SNI support to libldap + +Implemented for OpenSSL, GnuTLS just stubbed +--- + libraries/libldap/ldap-tls.h | 2 +- + libraries/libldap/tls2.c | 2 +- + libraries/libldap/tls_g.c | 2 +- + libraries/libldap/tls_o.c | 8 ++++++-- + 4 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index c8a27112f1..c149b1867c 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -34,7 +34,7 @@ typedef void (TI_ctx_free)(tls_ctx *ctx); + typedef int (TI_ctx_init)(struct ldapoptions *lo, struct ldaptls *lt, int is_server); + + typedef tls_session *(TI_session_new)(tls_ctx *ctx, int is_server); +-typedef int (TI_session_connect)(LDAP *ld, tls_session *s); ++typedef int (TI_session_connect)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_accept)(tls_session *s); + typedef int (TI_session_upflags)(Sockbuf *sb, tls_session *s, int rc); + typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len ); +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 82ca5272cc..cbeea8c6c4 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -368,7 +368,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + } + +- err = tls_imp->ti_session_connect( ld, ssl ); ++ err = tls_imp->ti_session_connect( ld, ssl, host ); + + #ifdef HAVE_WINSOCK + errno = WSAGetLastError(); +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 3b72cd2a1f..5468ed3f05 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -336,7 +336,7 @@ tlsg_session_accept( tls_session *session ) + } + + static int +-tlsg_session_connect( LDAP *ld, tls_session *session ) ++tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in ) + { + return tlsg_session_accept( session); + } +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 498f805fa1..455b23c0e9 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -548,12 +548,16 @@ tlso_session_new( tls_ctx *ctx, int is_server ) + } + + static int +-tlso_session_connect( LDAP *ld, tls_session *sess ) ++tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + { + tlso_session *s = (tlso_session *)sess; ++ int rc; + ++#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME ++ SSL_set_tlsext_host_name( s, name_in ); ++#endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ +- int rc = SSL_connect( s ) - 1; ++ rc = SSL_connect( s ) - 1; + #ifdef LDAP_USE_NON_BLOCKING_TLS + if ( rc < 0 ) { + int sockerr = sock_errno(); + +From 421c2021c7209bd7cd947ccb8b989bddab7b63cb Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 18:25:10 +0100 +Subject: [PATCH 2/4] ITS#9176 check for numeric addrs before passing SNI + +--- + libraries/libldap/tls2.c | 22 +++++++++++++++++++++- + libraries/libldap/tls_o.c | 4 +++- + 2 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index cbeea8c6c4..85628bc3b3 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -334,6 +334,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + Sockbuf *sb = conn->lconn_sb; + int err; + tls_session *ssl = NULL; ++ char *sni = host; + + if ( HAS_TLS( sb )) { + ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); +@@ -368,7 +369,26 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg ); + } + +- err = tls_imp->ti_session_connect( ld, ssl, host ); ++ /* pass hostname for SNI, but only if it's an actual name ++ * and not a numeric address ++ */ ++ { ++ int numeric = 1; ++ char *c; ++ for ( c = sni; *c; c++ ) { ++ if ( *c == ':' ) /* IPv6 address */ ++ break; ++ if ( *c == '.' ) ++ continue; ++ if ( !isdigit( *c )) { ++ numeric = 0; ++ break; ++ } ++ } ++ if ( numeric ) ++ sni = NULL; ++ } ++ err = tls_imp->ti_session_connect( ld, ssl, sni ); + + #ifdef HAVE_WINSOCK + errno = WSAGetLastError(); +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 455b23c0e9..45948dbc64 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -554,7 +554,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + int rc; + + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME +- SSL_set_tlsext_host_name( s, name_in ); ++ if ( name_in ) { ++ SSL_set_tlsext_host_name( s, name_in ); ++ } + #endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ + rc = SSL_connect( s ) - 1; + +From 05a65a46c684031a841bcc39cf01a82e8cc713a0 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 27 Apr 2020 18:54:02 +0100 +Subject: [PATCH 3/4] ITS#9176 check for failure setting SNI + +--- + libraries/libldap/tls_o.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 45948dbc64..86e86db3b6 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -555,7 +555,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in ) + + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + if ( name_in ) { +- SSL_set_tlsext_host_name( s, name_in ); ++ rc = SSL_set_tlsext_host_name( s, name_in ); ++ if ( !rc ) /* can fail to strdup the name */ ++ return -1; + } + #endif + /* Caller expects 0 = success, OpenSSL returns 1 = success */ + +From d059488fa86b58744ad70819516d3bf4a37dbb8e Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Mon, 27 Apr 2020 11:01:01 -0700 +Subject: [PATCH 4/4] ITS#9176 Implement SNI for GnuTLS + +--- + libraries/libldap/tls_g.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 5468ed3f05..5fceb3e935 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -338,6 +338,16 @@ tlsg_session_accept( tls_session *session ) + static int + tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in ) + { ++ tlsg_session *s = (tlsg_session *)session; ++ int rc; ++ ++ if ( name_in ) { ++ rc = gnutls_server_name_set( s->session, GNUTLS_NAME_DNS, name_in, strlen(name_in) ); ++ if ( rc != GNUTLS_E_SUCCESS ) { ++ return rc; ++ } ++ } ++ + return tlsg_session_accept( session); + } + diff --git a/openldap.spec b/openldap.spec index 5fe511b..e076e18 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.59 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -54,6 +54,7 @@ Patch60: openldap-cbinding-Fix-slaptest-in-test077.patch Patch61: openldap-cbinding-Convert-test077-to-LDIF-config.patch Patch62: openldap-cbinding-Update-keys-to-RSA-4096.patch Patch63: openldap-cbinding-ITS-9215-fix-for-glibc-again.patch +Patch64: openldap-add-tls-sni-support-to-libldap.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -159,6 +160,7 @@ pushd openldap-%{version} %patch61 -p1 %patch62 -p1 %patch63 -p1 +%patch64 -p1 # The change is needed for autoconf-2.71 sed 's@^AM_INIT_AUTOMAKE.*@AC_PROG_MAKE_SET@' -i configure.in @@ -556,6 +558,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Thu Sep 30 2021 Simon Pichugin - 2.4.59-4 +- Backport TLS SNI feature from OpenLDAP 2.5 (#2009534) + * Tue Sep 14 2021 Sahana Prasad - 2.4.59-3 - Rebuilt with OpenSSL 3.0.0 From 1690fe447c7d0a18229da059cdd8502728c62738 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 22:24:28 +0000 Subject: [PATCH 079/118] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index e076e18..06d367c 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ Name: openldap Version: 2.4.59 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -558,6 +558,9 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.59-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Sep 30 2021 Simon Pichugin - 2.4.59-4 - Backport TLS SNI feature from OpenLDAP 2.5 (#2009534) From c7124f35aef699b9bf5691732b0ec10ef70fea82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Mon, 24 Jan 2022 14:20:48 +0100 Subject: [PATCH 080/118] Disable automatic .la file removal https://fedoraproject.org/wiki/Changes/RemoveLaFiles --- openldap.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 06d367c..21864dc 100644 --- a/openldap.spec +++ b/openldap.spec @@ -5,9 +5,12 @@ %global so_ver 2 +# Disable automatic .la file removal +%global __brp_remove_la_files %nil + Name: openldap Version: 2.4.59 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -558,6 +561,10 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %changelog +* Mon Jan 24 2022 Timm Bäder - 2.4.59-6 +- Disable automatic .la file removal +- https://fedoraproject.org/wiki/Changes/RemoveLaFiles + * Thu Jan 20 2022 Fedora Release Engineering - 2.4.59-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 004e302f0d7513fcfb30a27cf74b13e85878787d Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 16 Sep 2021 21:09:09 -0700 Subject: [PATCH 081/118] Update to new major release OpenLDAP 2.6.1 - rediff all patches and remove patches now upstream - use upstream source location for check password module and rediff patch due to this - add patch to fix build issue in 2.5.4 (from upstream) - clean and sort buildreqs - remove various refs to bdb - remove now default -DLDAP_USE_NON_BLOCKING_TLS - add new modules and enable load balancer as module - disable wiredtired backend due to missing build deps - don't remove files that don't exist - let check-config work on *.mdb over legacy files - remove refs to old-style config - new soname names - remove libldap_r link as the library was merged with libldap - refactor openldap-compat package to support the transition from 2.4 - add UPGRADE_INSTRUCTIONS for openldap-server upgrade The original patch was submitted by Fedora user - terjeros https://src.fedoraproject.org/rpms/openldap/pull-request/6 Resolves: #1955293 --- .gitignore | 6 + UPGRADE_INSTRUCTIONS | 30 + check-password-makefile.patch | 51 +- libexec-check-config.sh | 19 +- libexec-functions | 18 +- libexec-upgrade-db.sh | 40 - openldap-ai-addrconfig.patch | 4 +- openldap-allop-overlay.patch | 7 +- ...cbinding-Add-channel-binding-support.patch | 291 --- ...nding-Convert-test077-to-LDIF-config.patch | 236 -- ...dap-cbinding-Fix-slaptest-in-test077.patch | 39 - ...ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch | 220 -- ...-Add-missing-URI-variables-for-tests.patch | 70 - ...nding-ITS-8573-TLS-option-test-suite.patch | 2071 ----------------- ...ll-libldap-options-in-tools-o-option.patch | 582 ----- ...-9189_1-rework-sasl-cbinding-support.patch | 631 ----- ...TS-9189_2-add-channel-bindings-tests.patch | 45 - ...ize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch | 27 - ...binding-ITS-9215-fix-for-glibc-again.patch | 28 - ...ke-prototypes-available-where-needed.patch | 64 - ...dap-cbinding-Update-keys-to-RSA-4096.patch | 526 ----- ...-cbinding-auth-add-SASL-GSSAPI-tests.patch | 487 ---- openldap-fix-missing-mapping.patch | 24 + openldap-manpages.patch | 27 +- openldap-openssl-manpage-defaultCA.patch | 9 +- openldap-reentrant-gethostby.patch | 4 +- openldap-smbk5pwd-overlay.patch | 13 +- ..._dlopenadvise-to-get-RTLD_GLOBAL-set.patch | 12 +- openldap.spec | 328 ++- slapd.ldif | 15 +- slapd.service | 1 - sources | 4 +- 32 files changed, 307 insertions(+), 5622 deletions(-) create mode 100644 UPGRADE_INSTRUCTIONS delete mode 100755 libexec-upgrade-db.sh delete mode 100644 openldap-cbinding-Add-channel-binding-support.patch delete mode 100644 openldap-cbinding-Convert-test077-to-LDIF-config.patch delete mode 100644 openldap-cbinding-Fix-slaptest-in-test077.patch delete mode 100644 openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch delete mode 100644 openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch delete mode 100644 openldap-cbinding-ITS-8573-TLS-option-test-suite.patch delete mode 100644 openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch delete mode 100644 openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch delete mode 100644 openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch delete mode 100644 openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch delete mode 100644 openldap-cbinding-ITS-9215-fix-for-glibc-again.patch delete mode 100644 openldap-cbinding-Make-prototypes-available-where-needed.patch delete mode 100644 openldap-cbinding-Update-keys-to-RSA-4096.patch delete mode 100644 openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch create mode 100644 openldap-fix-missing-mapping.patch diff --git a/.gitignore b/.gitignore index aa6af81..11a76df 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,9 @@ /openldap-2.4.57.tgz /openldap-2.4.58.tgz /openldap-2.4.59.tgz +/openldap-2.5.4.tgz +/openldap-ppolicy-check-password-1.1.tar.gz +/openldap-2.5.5.tgz +/openldap-2.5.7.tgz +/openldap-2.5.8.tgz +/openldap-2.6.1.tgz diff --git a/UPGRADE_INSTRUCTIONS b/UPGRADE_INSTRUCTIONS new file mode 100644 index 0000000..14c051f --- /dev/null +++ b/UPGRADE_INSTRUCTIONS @@ -0,0 +1,30 @@ +You have upgraded your openldap-servers package. +Any major version upgrade can cause database corruption or loss. +Please, make sure that you have up-to-date back up and read this document carefully. + +It's still recommended to do the backup even on the minor version upgrade. + +Please, review the next links before performing any action: + +Upgrading from 2.4.x - https://www.openldap.org/doc/admin25/appendix-upgrading.html +Upgrading from 2.5.x - https://www.openldap.org/doc/admin26/appendix-upgrading.html +The normal upgrade procedure - https://www.openldap.org/doc/admin26/maintenance.html + +Additionally, please, review and perform the following steps that can help you with the upgrade: + + 1. Back up both data and configuration directories into a safe place; + 2. Export data to an LDIF file using slapcat; +a. If you have the deprecated DB type and you haven't performed the slapcat command, you need to move your data and configuration to the system with OpenLDAP 2.4 version and run slapcat command there; + 3. Change the server's configuration according to the changes in the above documents; + a. If you are replacing the BDB/HDB with MDB, make sure to replace the BDB/HDB sections with their MDB counterparts; +4. Clear out the current data directory; + 5. Import data to a new database from the LDIF file using slapadd; + 6. Make sure that your data is intact. + +After you have completed the above operations, you can remove this file (/usr/share/openldap-servers/UPGRADE_INSTRUCTIONS) and start the server: + + systemctl start slapd.service + +Be careful with this document's procedure, make sure you understand it, and test it in a non-production environment first. Always make sure that all backups are in place. + +You have been warned about the possibility of data corruption or loss. diff --git a/check-password-makefile.patch b/check-password-makefile.patch index f39ba81..048ee2e 100644 --- a/check-password-makefile.patch +++ b/check-password-makefile.patch @@ -1,32 +1,45 @@ ---- a/Makefile 2009-10-31 18:59:06.000000000 +0100 -+++ b/Makefile 2014-12-17 09:42:37.586079225 +0100 -@@ -13,22 +13,11 @@ +diff --git a/Makefile b/Makefile +index 4457bad..91de40b 100644 +--- a/Makefile ++++ b/Makefile +@@ -13,17 +13,10 @@ CRACKLIB=/usr/share/cracklib/pw_dict # CONFIG=/etc/openldap/check_password.conf --OPT=-g -O2 -Wall -fpic \ -- -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ -- -DCONFIG_FILE="\"$(CONFIG)\"" \ -+CFLAGS+=-fpic \ -+ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ -+ -DCONFIG_FILE="\"$(CONFIG)\"" \ - -DDEBUG - +- -# Where to find the OpenLDAP headers. -# --LDAP_INC=-I/home/pyb/tmp/openldap-2.3.39/include \ -- -I/home/pyb/tmp/openldap-2.3.39/servers/slapd +-LDAP_INC=-I/usr/include/openldap/include \ +- -I/usr/include/openldap/servers/slapd - -# Where to find the CrackLib headers. -# -CRACK_INC= - -INCS=$(LDAP_INC) $(CRACK_INC) -- ++CFLAGS+=-fpic \ ++ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ ++ -DCONFIG_FILE="\"$(CONFIG)\"" \ ++ -DDEBUG + LDAP_LIB=-lldap_r -llber - # Comment out this line if you do NOT want to use the cracklib. -@@ -45,10 +34,10 @@ +@@ -33,27 +26,21 @@ LDAP_LIB=-lldap_r -llber + # + CRACKLIB_LIB=-lcrack + +-CC_FLAGS=-g -O2 -Wall -fpic +-CRACKLIB_OPT=-DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" +-DEBUG_OPT=-DDEBUG +-CONFIG_OPT=-DCONFIG_FILE="\"$(CONFIG)\"" +- +-OPT=$(CC_FLAGS) $(CRACKLIB_OPT) $(CONFIG_OPT) $(DEBUG_OPT) +- + LIBS=$(LDAP_LIB) $(CRACKLIB_LIB) + + LIBDIR=/usr/lib/openldap/ + ++ all: check_password check_password.o: @@ -38,4 +51,8 @@ + $(CC) $(LDFLAGS) -shared -o check_password.so check_password.o $(CRACKLIB_LIB) install: check_password - cp -f check_password.so ../../../usr/lib/openldap/modules/ +- cp -f check_password.so $(LIBDIR) ++ cp -f check_password.so ../../../usr/lib/openldap/modules/ + + clean: + $(RM) check_password.o check_password.so check_password.lo diff --git a/libexec-check-config.sh b/libexec-check-config.sh index 87e377f..de6f3a8 100755 --- a/libexec-check-config.sh +++ b/libexec-check-config.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#! /usr/bin/sh # Author: Jan Vcelak . /usr/libexec/openldap/functions @@ -41,7 +41,7 @@ function check_db_perms() retcode=0 for dbdir in `databases`; do [ -d "$dbdir" ] || continue - for dbfile in `find ${dbdir} -maxdepth 1 -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" -or -name "log.*" -or -name "alock"`; do + for dbfile in `find ${dbdir} -maxdepth 1 -name "*.mdb"` ; do run_as_ldap "/usr/bin/test -r \"$dbfile\" -a -w \"$dbfile\"" if [ $? -ne 0 ]; then error "Read/write permissions for DB file '%s' are required." "$dbfile" @@ -52,12 +52,21 @@ function check_db_perms() return $retcode } +function check_major_upgrade() +{ + retcode=0 + if [ -f "/usr/share/openldap-servers/UPGRADE_INSTRUCTIONS" ]; then + error "You have upgraded your openldap-servers package. There are actions that need to be performed. Please, read the /usr/share/openldap-servers/UPGRADE_INSTRUCTIONS file" + retcode=1 + fi + return $retcode +} + function check_everything() { retcode=0 check_config_syntax || retcode=1 - # TODO: need support for Mozilla NSS, disabling temporarily - #check_certs_perms || retcode=1 + check_certs_perms || retcode=1 check_db_perms || retcode=1 return $retcode } @@ -67,6 +76,8 @@ if [ `id -u` -ne 0 ]; then exit 4 fi +check_major_upgrade || return 1 + load_sysconfig if [ -n "$SLAPD_CONFIG_DIR" ]; then diff --git a/libexec-functions b/libexec-functions index 990d2b8..8ee7500 100644 --- a/libexec-functions +++ b/libexec-functions @@ -84,14 +84,6 @@ function databases_new() ldif_value } -function databases_old() -{ - awk 'begin { database="" } - $1 == "database" { database=$2 } - $1 == "directory" { if (database == "bdb" || database == "hdb") print $2}' \ - "$SLAPD_CONFIG_FILE" -} - function certificates_new() { slapcat $SLAPD_GLOBAL_OPTIONS -c -H 'ldap:///cn=config???(cn=config)' 2>/dev/null | \ @@ -100,20 +92,14 @@ function certificates_new() ldif_value } -function certificates_old() -{ - awk '$1 ~ "^TLS(CACertificate(File|Path)|CertificateFile|CertificateKeyFile)$" { print $2 } ' \ - "$SLAPD_CONFIG_FILE" -} - function certificates() { - uses_new_config && certificates_new || certificates_old + uses_new_config && certificates_new } function databases() { - uses_new_config && databases_new || databases_old + uses_new_config && databases_new } diff --git a/libexec-upgrade-db.sh b/libexec-upgrade-db.sh deleted file mode 100755 index 1543c80..0000000 --- a/libexec-upgrade-db.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/sh -# Author: Jan Vcelak - -. /usr/libexec/openldap/functions - -if [ `id -u` -ne 0 ]; then - error "You have to be root to run this command." - exit 4 -fi - -load_sysconfig -retcode=0 - -for dbdir in `databases`; do - upgrade_log="$dbdir/db_upgrade.`date +%Y%m%d%H%M%S`.log" - bdb_files=`find "$dbdir" -maxdepth 1 -name "*.bdb" -printf '"%f" '` - - # skip uninitialized database - [ -z "$bdb_files"] || continue - - printf "Updating '%s', logging into '%s'\n" "$dbdir" "$upgrade_log" - - # perform the update - for command in \ - "/usr/bin/db_recover -v -h \"$dbdir\"" \ - "/usr/bin/db_upgrade -v -h \"$dbdir\" $bdb_files" \ - "/usr/bin/db_checkpoint -v -h \"$dbdir\" -1" \ - ; do - printf "Executing: %s\n" "$command" &>>$upgrade_log - run_as_ldap "$command" &>>$upgrade_log - result=$? - printf "Exit code: %d\n" $result >>"$upgrade_log" - if [ $result -ne 0 ]; then - printf "Upgrade failed: %d\n" $result - retcode=1 - fi - done -done - -exit $retcode diff --git a/openldap-ai-addrconfig.patch b/openldap-ai-addrconfig.patch index 0858fac..f9a7333 100644 --- a/openldap-ai-addrconfig.patch +++ b/openldap-ai-addrconfig.patch @@ -5,10 +5,10 @@ Upstream ITS: #7326 Resolves: #835013 diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c -index b31e05d..fa361ab 100644 +index 14899cc..b25e750 100644 --- a/libraries/libldap/os-ip.c +++ b/libraries/libldap/os-ip.c -@@ -594,8 +594,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, +@@ -620,8 +620,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, #if defined( HAVE_GETADDRINFO ) && defined( HAVE_INET_NTOP ) memset( &hints, '\0', sizeof(hints) ); diff --git a/openldap-allop-overlay.patch b/openldap-allop-overlay.patch index 608ee44..05a4c6e 100644 --- a/openldap-allop-overlay.patch +++ b/openldap-allop-overlay.patch @@ -4,9 +4,10 @@ Author: Matus Honek Resolves: #1319782 diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in +index b5c3fc8..9aa8a4f 100644 --- a/servers/slapd/overlays/Makefile.in +++ b/servers/slapd/overlays/Makefile.in -@@ -33,7 +33,8 @@ SRCS = overlays.c \ +@@ -38,7 +38,8 @@ SRCS = overlays.c \ translucent.c \ unique.c \ valsort.c \ @@ -16,7 +17,7 @@ diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefil OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ overlays.o -@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) +@@ -58,7 +59,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a @@ -25,7 +26,7 @@ diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefil XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) -@@ -125,6 +126,12 @@ unique.la : unique.lo +@@ -148,6 +149,12 @@ smbk5pwd.lo : smbk5pwd.c smbk5pwd.la : smbk5pwd.lo $(LTLINK_MOD) -module -o $@ smbk5pwd.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) diff --git a/openldap-cbinding-Add-channel-binding-support.patch b/openldap-cbinding-Add-channel-binding-support.patch deleted file mode 100644 index 42efaee..0000000 --- a/openldap-cbinding-Add-channel-binding-support.patch +++ /dev/null @@ -1,291 +0,0 @@ -From ca310ebff44f10739fd75aff437c7676e089b134 Mon Sep 17 00:00:00 2001 -From: Howard Chu -Date: Mon, 26 Aug 2013 23:31:48 -0700 -Subject: [PATCH] Add channel binding support - -Currently only implemented for OpenSSL. -Needs an option to set the criticality flag. ---- - include/ldap_pvt.h | 1 + - libraries/libldap/cyrus.c | 22 ++++++++++++++++++++++ - libraries/libldap/ldap-int.h | 1 + - libraries/libldap/ldap-tls.h | 2 ++ - libraries/libldap/tls2.c | 7 +++++++ - libraries/libldap/tls_g.c | 7 +++++++ - libraries/libldap/tls_m.c | 7 +++++++ - libraries/libldap/tls_o.c | 16 ++++++++++++++++ - servers/slapd/connection.c | 8 ++++++++ - servers/slapd/sasl.c | 18 ++++++++++++++++++ - servers/slapd/slap.h | 1 + - 11 files changed, 90 insertions(+) - -diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h -index 716c1a90f..61c620785 100644 ---- a/include/ldap_pvt.h -+++ b/include/ldap_pvt.h -@@ -420,6 +420,7 @@ LDAP_F (int) ldap_pvt_tls_get_my_dn LDAP_P(( void *ctx, struct berval *dn, - LDAP_F (int) ldap_pvt_tls_get_peer_dn LDAP_P(( void *ctx, struct berval *dn, - LDAPDN_rewrite_dummy *func, unsigned flags )); - LDAP_F (int) ldap_pvt_tls_get_strength LDAP_P(( void *ctx )); -+LDAP_F (int) ldap_pvt_tls_get_unique LDAP_P(( void *ctx, struct berval *buf, int is_server )); - - LDAP_END_DECL - -diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c -index 4c0089d5d..3171d56a3 100644 ---- a/libraries/libldap/cyrus.c -+++ b/libraries/libldap/cyrus.c -@@ -360,6 +360,10 @@ int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc ) - lc->lconn_sasl_sockctx = NULL; - lc->lconn_sasl_authctx = NULL; - } -+ if( lc->lconn_sasl_cbind ) { -+ ldap_memfree( lc->lconn_sasl_cbind ); -+ lc->lconn_sasl_cbind = NULL; -+ } - - return LDAP_SUCCESS; - } -@@ -492,6 +496,24 @@ ldap_int_sasl_bind( - - (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac ); - LDAP_FREE( authid.bv_val ); -+#ifdef SASL_CHANNEL_BINDING /* 2.1.25+ */ -+ { -+ char cbinding[64]; -+ struct berval cbv = { sizeof(cbinding), cbinding }; -+ if ( ldap_pvt_tls_get_unique( ssl, &cbv, 0 )) { -+ sasl_channel_binding_t *cb = ldap_memalloc( sizeof(*cb) + -+ cbv.bv_len); -+ cb->name = "ldap"; -+ cb->critical = 0; -+ cb->data = (char *)(cb+1); -+ cb->len = cbv.bv_len; -+ memcpy( cb->data, cbv.bv_val, cbv.bv_len ); -+ sasl_setprop( ld->ld_defconn->lconn_sasl_authctx, -+ SASL_CHANNEL_BINDING, cb ); -+ ld->ld_defconn->lconn_sasl_cbind = cb; -+ } -+ } -+#endif - } - #endif - -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h -index 98ad4dc05..397894271 100644 ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -308,6 +308,7 @@ typedef struct ldap_conn { - #ifdef HAVE_CYRUS_SASL - void *lconn_sasl_authctx; /* context for bind */ - void *lconn_sasl_sockctx; /* for security layer */ -+ void *lconn_sasl_cbind; /* for channel binding */ - #endif - #ifdef HAVE_GSSAPI - void *lconn_gss_ctx; /* gss_ctx_id_t */ -diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h -index c8a27112f..0ecf81ab9 100644 ---- a/libraries/libldap/ldap-tls.h -+++ b/libraries/libldap/ldap-tls.h -@@ -41,6 +41,7 @@ typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len - typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); - typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); - typedef int (TI_session_strength)(tls_session *sess); -+typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); - - typedef void (TI_thr_init)(void); - -@@ -64,6 +65,7 @@ typedef struct tls_impl { - TI_session_dn *ti_session_peer_dn; - TI_session_chkhost *ti_session_chkhost; - TI_session_strength *ti_session_strength; -+ TI_session_unique *ti_session_unique; - - Sockbuf_IO *ti_sbio; - -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index 82ca5272c..13d734362 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -1013,6 +1013,13 @@ ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, - rc = ldap_X509dn2bv(&der_dn, dn, (LDAPDN_rewrite_func *)func, flags ); - return rc; - } -+ -+int -+ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) -+{ -+ tls_session *session = s; -+ return tls_imp->ti_session_unique( session, buf, is_server ); -+} - #endif /* HAVE_TLS */ - - int -diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c -index 3b72cd2a1..b78c12086 100644 ---- a/libraries/libldap/tls_g.c -+++ b/libraries/libldap/tls_g.c -@@ -669,6 +669,12 @@ tlsg_session_strength( tls_session *session ) - return gnutls_cipher_get_key_size( c ) * 8; - } - -+static int -+tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) -+{ -+ return 0; -+} -+ - /* suites is a string of colon-separated cipher suite names. */ - static int - tlsg_parse_ciphers( tlsg_ctx *ctx, char *suites ) -@@ -925,6 +931,7 @@ tls_impl ldap_int_tls_impl = { - tlsg_session_peer_dn, - tlsg_session_chkhost, - tlsg_session_strength, -+ tlsg_session_unique, - - &tlsg_sbio, - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index 43fbae4bc..c64f4c176 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2874,6 +2874,12 @@ tlsm_session_strength( tls_session *session ) - return rc ? 0 : keySize; - } - -+static int -+tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server) -+{ -+ return 0; -+} -+ - /* - * TLS support for LBER Sockbufs - */ -@@ -3302,6 +3308,7 @@ tls_impl ldap_int_tls_impl = { - tlsm_session_peer_dn, - tlsm_session_chkhost, - tlsm_session_strength, -+ tlsm_session_unique, - - &tlsm_sbio, - -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index a13f11fb5..f741a461f 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -846,6 +846,21 @@ tlso_session_strength( tls_session *sess ) - return SSL_CIPHER_get_bits(SSL_get_current_cipher(s), NULL); - } - -+static int -+tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) -+{ -+ tlso_session *s = (tlso_session *)sess; -+ -+ /* Usually the client sends the finished msg. But if the -+ * session was resumed, the server sent the msg. -+ */ -+ if (SSL_session_reused(s) ^ !is_server) -+ buf->bv_len = SSL_get_finished(s, buf->bv_val, buf->bv_len); -+ else -+ buf->bv_len = SSL_get_peer_finished(s, buf->bv_val, buf->bv_len); -+ return buf->bv_len; -+} -+ - /* - * TLS support for LBER Sockbufs - */ -@@ -1363,6 +1378,7 @@ tls_impl ldap_int_tls_impl = { - tlso_session_peer_dn, - tlso_session_chkhost, - tlso_session_strength, -+ tlso_session_unique, - - &tlso_sbio, - -diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c -index 44c3fc63d..0602fdceb 100644 ---- a/servers/slapd/connection.c -+++ b/servers/slapd/connection.c -@@ -406,6 +406,7 @@ Connection * connection_init( - c->c_sasl_sockctx = NULL; - c->c_sasl_extra = NULL; - c->c_sasl_bindop = NULL; -+ c->c_sasl_cbind = NULL; - - c->c_sb = ber_sockbuf_alloc( ); - -@@ -451,6 +452,7 @@ Connection * connection_init( - assert( c->c_sasl_sockctx == NULL ); - assert( c->c_sasl_extra == NULL ); - assert( c->c_sasl_bindop == NULL ); -+ assert( c->c_sasl_cbind == NULL ); - assert( c->c_currentber == NULL ); - assert( c->c_writewaiter == 0); - assert( c->c_writers == 0); -@@ -1428,6 +1430,12 @@ connection_read( ber_socket_t s, conn_readinfo *cri ) - c->c_connid, (int) s, c->c_tls_ssf, c->c_ssf, 0 ); - slap_sasl_external( c, c->c_tls_ssf, &authid ); - if ( authid.bv_val ) free( authid.bv_val ); -+ { -+ char cbinding[64]; -+ struct berval cbv = { sizeof(cbinding), cbinding }; -+ if ( ldap_pvt_tls_get_unique( ssl, &cbv, 1 )) -+ slap_sasl_cbinding( c, &cbv ); -+ } - } else if ( rc == 1 && ber_sockbuf_ctrl( c->c_sb, - LBER_SB_OPT_NEEDS_WRITE, NULL )) { /* need to retry */ - slapd_set_write( s, 1 ); -diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c -index 5144170d1..258cd5407 100644 ---- a/servers/slapd/sasl.c -+++ b/servers/slapd/sasl.c -@@ -1389,6 +1389,21 @@ int slap_sasl_external( - return LDAP_SUCCESS; - } - -+int slap_sasl_cbinding( Connection *conn, struct berval *cbv ) -+{ -+#ifdef SASL_CHANNEL_BINDING -+ sasl_channel_binding_t *cb = ch_malloc( sizeof(*cb) + cbv->bv_len );; -+ cb->name = "ldap"; -+ cb->critical = 0; -+ cb->data = (char *)(cb+1); -+ cb->len = cbv->bv_len; -+ memcpy( cb->data, cbv->bv_val, cbv->bv_len ); -+ sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); -+ conn->c_sasl_cbind = cb; -+#endif -+ return LDAP_SUCCESS; -+} -+ - int slap_sasl_reset( Connection *conn ) - { - return LDAP_SUCCESS; -@@ -1454,6 +1469,9 @@ int slap_sasl_close( Connection *conn ) - free( conn->c_sasl_extra ); - conn->c_sasl_extra = NULL; - -+ free( conn->c_sasl_cbind ); -+ conn->c_sasl_cbind = NULL; -+ - #elif defined(SLAP_BUILTIN_SASL) - SASL_CTX *ctx = conn->c_sasl_authctx; - if( ctx ) { -diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h -index 7581967be..ad797d752 100644 ---- a/servers/slapd/slap.h -+++ b/servers/slapd/slap.h -@@ -2910,6 +2910,7 @@ struct Connection { - void *c_sasl_authctx; /* SASL authentication context */ - void *c_sasl_sockctx; /* SASL security layer context */ - void *c_sasl_extra; /* SASL session extra stuff */ -+ void *c_sasl_cbind; /* SASL channel binding */ - Operation *c_sasl_bindop; /* set to current op if it's a bind */ - - #ifdef LDAP_X_TXN --- -2.29.2 - diff --git a/openldap-cbinding-Convert-test077-to-LDIF-config.patch b/openldap-cbinding-Convert-test077-to-LDIF-config.patch deleted file mode 100644 index 5ca02fb..0000000 --- a/openldap-cbinding-Convert-test077-to-LDIF-config.patch +++ /dev/null @@ -1,236 +0,0 @@ -From 59bdc8158f51fc22cc3c6d6dd2db9e5aa4bcfdc4 Mon Sep 17 00:00:00 2001 -From: Ryan Tandy -Date: Mon, 27 Apr 2020 23:24:16 -0700 -Subject: [PATCH] Convert test077 to LDIF config - ---- - tests/data/slapd-sasl-gssapi.conf | 65 ------------------ - tests/scripts/defines.sh | 1 - - tests/scripts/test077-sasl-gssapi | 108 ++++++++++++++++++++++++++++-- - 3 files changed, 103 insertions(+), 71 deletions(-) - delete mode 100644 tests/data/slapd-sasl-gssapi.conf - -diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf -deleted file mode 100644 -index 611fc7097..000000000 ---- a/tests/data/slapd-sasl-gssapi.conf -+++ /dev/null -@@ -1,65 +0,0 @@ --# stand-alone slapd config -- for testing (with indexing) --# $OpenLDAP$ --## This work is part of OpenLDAP Software . --## --## Copyright 1998-2020 The OpenLDAP Foundation. --## All rights reserved. --## --## Redistribution and use in source and binary forms, with or without --## modification, are permitted only as authorized by the OpenLDAP --## Public License. --## --## A copy of this license is available in the file LICENSE in the --## top-level directory of the distribution or, alternatively, at --## . -- --# --include @SCHEMADIR@/core.schema --include @SCHEMADIR@/cosine.schema --# --include @SCHEMADIR@/corba.schema --include @SCHEMADIR@/java.schema --include @SCHEMADIR@/inetorgperson.schema --include @SCHEMADIR@/misc.schema --include @SCHEMADIR@/nis.schema --include @SCHEMADIR@/openldap.schema --# --include @SCHEMADIR@/duaconf.schema --include @SCHEMADIR@/dyngroup.schema -- --# --pidfile @TESTDIR@/slapd.1.pid --argsfile @TESTDIR@/slapd.1.args -- --# SSL configuration --TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt --TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key --TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt -- --# --rootdse @DATADIR@/rootdse.ldif -- --#mod#modulepath ../servers/slapd/back-@BACKEND@/ --#mod#moduleload back_@BACKEND@.la --#monitormod#modulepath ../servers/slapd/back-monitor/ --#monitormod#moduleload back_monitor.la -- -- --####################################################################### --# database definitions --####################################################################### -- --database @BACKEND@ --suffix "dc=example,dc=com" --rootdn "cn=Manager,dc=example,dc=com" --rootpw secret --#~null~#directory @TESTDIR@/db.1.a --#indexdb#index objectClass eq --#indexdb#index mail eq --#ndb#dbname db_1_a --#ndb#include @DATADIR@/ndb.conf -- --#monitor#database monitor -- --sasl-realm @KRB5REALM@ --sasl-host localhost -diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh -index 78dc1f8ae..76c85b442 100755 ---- a/tests/scripts/defines.sh -+++ b/tests/scripts/defines.sh -@@ -108,7 +108,6 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf - SCHEMACONF=$DATADIR/slapd-schema.conf - TLSCONF=$DATADIR/slapd-tls.conf - TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf --SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf - GLUECONF=$DATADIR/slapd-glue.conf - REFINTCONF=$DATADIR/slapd-refint.conf - RETCODECONF=$DATADIR/slapd-retcode.conf -diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi -index bde9006ca..322df60a4 100755 ---- a/tests/scripts/test077-sasl-gssapi -+++ b/tests/scripts/test077-sasl-gssapi -@@ -21,15 +21,40 @@ if test $WITH_SASL = no ; then - exit 0 - fi - --mkdir -p $TESTDIR $DBDIR1 -+CONFDIR=$TESTDIR/slapd.d -+CONFLDIF=$TESTDIR/slapd.ldif -+ -+mkdir -p $TESTDIR $DBDIR1 $CONFDIR - cp -r $DATADIR/tls $TESTDIR -+$SLAPPASSWD -g -n >$CONFIGPWF - - echo "Starting KDC for SASL/GSSAPI tests..." - . $SRCDIR/scripts/setup_kdc.sh - --echo "Running slapadd to build slapd database..." --. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1 --$SLAPADD -f $CONF1 -l $LDIFORDERED -+echo "Configuring slapd..." -+cat > $CONFLDIF < $LOG1 2>&1 & -+$SLAPD -F $CONFDIR -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & - PID=$! - if test $WAIT != 0 ; then - echo PID $PID -@@ -141,6 +166,79 @@ else - fi - fi - -+if test $WITH_TLS = no ; then -+ echo "TLS support not available, skipping channe-binding test" -+elif test $HAVE_SASL_GSS_CBIND = no ; then -+ echo "SASL has no channel-binding support in GSSAPI, test skipped" -+else -+ echo "Testing SASL/GSSAPI with SASL_CBINDING..." -+ -+ for acb in "none" "tls-unique" "tls-endpoint" ; do -+ -+ echo "Modifying slapd's olcSaslCBinding to ${acb} ..." -+ $LDAPMODIFY -D cn=config -H $URI1 -y $CONFIGPWF < $TESTOUT 2>&1 -+dn: cn=config -+changetype: modify -+replace: olcSaslCBinding -+olcSaslCBinding: ${acb} -+EOF -+ RC=$? -+ if test $RC != 0 ; then -+ echo "ldapmodify failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+ fi -+ -+ for icb in "none" "tls-unique" "tls-endpoint" ; do -+ -+ # The gnutls implemantation of "tls-unique" seems broken -+ if test $icb = "tls-unique" -o $acb = "tls-unique" ; then -+ if test $WITH_TLS_TYPE == gnutls ; then -+ continue -+ fi -+ fi -+ -+ fail="no" -+ if test $icb != $acb -a $acb != "none" ; then -+ # This currently fails in MIT, but it is planned to be -+ # fixed not to fail like in heimdal - avoid testing. -+ if test $icb = "none" ; then -+ continue -+ fi -+ # Otherwise unmatching bindings are expected to fail. -+ fail="yes" -+ fi -+ -+ echo -n "Using ldapwhoami with SASL/GSSAPI and SASL_CBINDING " -+ echo -ne "(client: ${icb},\tserver: ${acb}): " -+ -+ $LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow \ -+ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ -+ -o SASL_CBINDING=$icb > $TESTOUT 2>&1 -+ -+ RC=$? -+ if test $RC != 0 ; then -+ if test $fail = "no" ; then -+ echo "test failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+ fi -+ elif test $fail = "yes" ; then -+ echo "failed: command succeeded unexpectedly." -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+ fi -+ -+ echo "success" -+ RC=0 -+ done -+ done -+fi -+ -+ - kill $KDCPROC - test $KILLSERVERS != no && kill -HUP $KILLPIDS - --- -2.29.2 - diff --git a/openldap-cbinding-Fix-slaptest-in-test077.patch b/openldap-cbinding-Fix-slaptest-in-test077.patch deleted file mode 100644 index 0e93108..0000000 --- a/openldap-cbinding-Fix-slaptest-in-test077.patch +++ /dev/null @@ -1,39 +0,0 @@ -From e006994d83af9dcb7813a18253cf4e5beacee043 Mon Sep 17 00:00:00 2001 -From: Ryan Tandy -Date: Sun, 26 Apr 2020 11:40:23 -0700 -Subject: [PATCH] Fix slaptest in test077 - -The libtool wrapper scripts lose argv[0] when exec'ing the real binary. - -In the CI Docker container, where the build runs as root, this was -actually starting a real slapd on the default port. - -Outside Docker, running as a non-root user, this slapd would just fail -to start, and wouldn't convert the config either. - -Using "slapd -Tt" fixes the issue but also prints a warning from -slaptest since the database hasn't been initialized yet. - -Dynamic config isn't actually used in this test script, so let's just -run slapd off the config file directly. ---- - tests/scripts/test077-sasl-gssapi | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi -index 64abe16fe..bde9006ca 100755 ---- a/tests/scripts/test077-sasl-gssapi -+++ b/tests/scripts/test077-sasl-gssapi -@@ -24,9 +24,6 @@ fi - mkdir -p $TESTDIR $DBDIR1 - cp -r $DATADIR/tls $TESTDIR - --cd $TESTWD -- -- - echo "Starting KDC for SASL/GSSAPI tests..." - . $SRCDIR/scripts/setup_kdc.sh - --- -2.29.2 - diff --git a/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch b/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch deleted file mode 100644 index b38dd83..0000000 --- a/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch +++ /dev/null @@ -1,220 +0,0 @@ -NOTE: The patch has been adjusted to match the base code before backporting. - -From 16f8b0902c28b1eaab93ddf120ce40b89bcda8d1 Mon Sep 17 00:00:00 2001 -From: Howard Chu -Date: Tue, 10 Sep 2013 04:26:51 -0700 -Subject: [PATCH] ITS#7398 add LDAP_OPT_X_TLS_PEERCERT - -retrieve peer cert for an active TLS session ---- - doc/man/man3/ldap_get_option.3 | 8 ++++++++ - include/ldap.h | 1 + - libraries/libldap/ldap-tls.h | 2 ++ - libraries/libldap/tls2.c | 24 ++++++++++++++++++++++++ - libraries/libldap/tls_g.c | 19 +++++++++++++++++++ - libraries/libldap/tls_m.c | 17 +++++++++++++++++ - libraries/libldap/tls_o.c | 16 ++++++++++++++++ - 7 files changed, 87 insertions(+) - -diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 -index eb3f25b33..7546875f5 100644 ---- a/doc/man/man3/ldap_get_option.3 -+++ b/doc/man/man3/ldap_get_option.3 -@@ -744,6 +744,14 @@ A non-zero value pointed to by - .BR invalue - tells the library to create a context for a server. - .TP -+.B LDAP_OPT_X_TLS_PEERCERT -+Gets the peer's certificate in DER format from an established TLS session. -+.BR outvalue -+must be -+.BR "struct berval *" , -+and the data it returns needs to be freed by the caller using -+.BR ldap_memfree (3). -+.TP - .B LDAP_OPT_X_TLS_PROTOCOL_MIN - Sets/gets the minimum protocol version. - .BR invalue -diff --git a/include/ldap.h b/include/ldap.h -index 389441031..88bfcabf8 100644 ---- a/include/ldap.h -+++ b/include/ldap.h -@@ -160,6 +160,7 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_PACKAGE 0x6011 - #define LDAP_OPT_X_TLS_ECNAME 0x6012 - #define LDAP_OPT_X_TLS_REQUIRE_SAN 0x601a -+#define LDAP_OPT_X_TLS_PEERCERT 0x6015 /* read-only */ - - #define LDAP_OPT_X_TLS_NEVER 0 - #define LDAP_OPT_X_TLS_HARD 1 -diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h -index 0ecf81ab9..103004fa7 100644 ---- a/libraries/libldap/ldap-tls.h -+++ b/libraries/libldap/ldap-tls.h -@@ -42,6 +42,7 @@ typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); - typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); - typedef int (TI_session_strength)(tls_session *sess); - typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); -+typedef int (TI_session_peercert)(tls_session *s, struct berval *der); - - typedef void (TI_thr_init)(void); - -@@ -66,6 +67,7 @@ typedef struct tls_impl { - TI_session_chkhost *ti_session_chkhost; - TI_session_strength *ti_session_strength; - TI_session_unique *ti_session_unique; -+ TI_session_peercert *ti_session_peercert; - - Sockbuf_IO *ti_sbio; - -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index 13d734362..ad09ba39b 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -705,6 +705,23 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) - case LDAP_OPT_X_TLS_CONNECT_ARG: - *(void **)arg = lo->ldo_tls_connect_arg; - break; -+ case LDAP_OPT_X_TLS_PEERCERT: { -+ void *sess = NULL; -+ struct berval *bv = arg; -+ bv->bv_len = 0; -+ bv->bv_val = NULL; -+ if ( ld != NULL ) { -+ LDAPConn *conn = ld->ld_defconn; -+ if ( conn != NULL ) { -+ Sockbuf *sb = conn->lconn_sb; -+ sess = ldap_pvt_tls_sb_ctx( sb ); -+ if ( sess != NULL ) -+ return ldap_pvt_tls_get_peercert( sess, bv ); -+ } -+ } -+ break; -+ } -+ - default: - return -1; - } -@@ -1020,6 +1037,13 @@ ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) - tls_session *session = s; - return tls_imp->ti_session_unique( session, buf, is_server ); - } -+ -+int -+ldap_pvt_tls_get_peercert( void *s, struct berval *der ) -+{ -+ tls_session *session = s; -+ return tls_imp->ti_session_peercert( session, der ); -+} - #endif /* HAVE_TLS */ - - int -diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c -index b78c12086..26d9f99ce 100644 ---- a/libraries/libldap/tls_g.c -+++ b/libraries/libldap/tls_g.c -@@ -675,6 +675,24 @@ tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) - return 0; - } - -+static int -+tlsg_session_peercert( tls_session *sess, struct berval *der ) -+{ -+ tlsg_session *s = (tlsg_session *)sess; -+ const gnutls_datum_t *peer_cert_list; -+ unsigned int list_size; -+ -+ peer_cert_list = gnutls_certificate_get_peers( s->session, &list_size ); -+ if (!peer_cert_list) -+ return -1; -+ der->bv_len = peer_cert_list[0].size; -+ der->bv_val = LDAP_MALLOC( der->bv_len ); -+ if (!der->bv_val) -+ return -1; -+ memcpy(der->bv_val, peer_cert_list[0].data, der->bv_len); -+ return 0; -+} -+ - /* suites is a string of colon-separated cipher suite names. */ - static int - tlsg_parse_ciphers( tlsg_ctx *ctx, char *suites ) -@@ -932,6 +950,7 @@ tls_impl ldap_int_tls_impl = { - tlsg_session_chkhost, - tlsg_session_strength, - tlsg_session_unique, -+ tlsg_session_peercert, - - &tlsg_sbio, - -diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c -index c64f4c176..d35a803de 100644 ---- a/libraries/libldap/tls_m.c -+++ b/libraries/libldap/tls_m.c -@@ -2880,6 +2880,22 @@ tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server) - return 0; - } - -+static int -+tlsm_session_peercert( tls_session *sess, struct berval *der ) -+{ -+ tlsm_session *s = (tlsm_session *)sess; -+ CERTCertificate *cert; -+ cert = SSL_PeerCertificate( s ); -+ if (!cert) -+ return -1; -+ der->bv_len = cert->derCert.len; -+ der->bv_val = LDAP_MALLOC( der->bv_len ); -+ if (!der->bv_val) -+ return -1; -+ memcpy( der->bv_val, cert->derCert.data, der->bv_len ); -+ return 0; -+} -+ - /* - * TLS support for LBER Sockbufs - */ -@@ -3309,6 +3325,7 @@ tls_impl ldap_int_tls_impl = { - tlsm_session_chkhost, - tlsm_session_strength, - tlsm_session_unique, -+ tlsm_session_peercert, - - &tlsm_sbio, - -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index f741a461f..157923289 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -861,6 +861,21 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) - return buf->bv_len; - } - -+static int -+tlso_session_peercert( tls_session *sess, struct berval *der ) -+{ -+ tlso_session *s = (tlso_session *)sess; -+ unsigned char *ptr; -+ X509 *x = SSL_get_peer_certificate(s); -+ der->bv_len = i2d_X509(x, NULL); -+ der->bv_val = LDAP_MALLOC(der->bv_len); -+ if ( !der->bv_val ) -+ return -1; -+ ptr = der->bv_val; -+ i2d_X509(x, &ptr); -+ return 0; -+} -+ - /* - * TLS support for LBER Sockbufs - */ -@@ -1379,6 +1394,7 @@ tls_impl ldap_int_tls_impl = { - tlso_session_chkhost, - tlso_session_strength, - tlso_session_unique, -+ tlso_session_peercert, - - &tlso_sbio, - --- -2.29.2 - diff --git a/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch b/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch deleted file mode 100644 index 404c4a4..0000000 --- a/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 465b1c5972eef1d4e60eb98ae3776d33e270853d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= -Date: Fri, 15 Jun 2018 15:12:28 +0100 -Subject: [PATCH] ITS#8573 Add missing URI variables for tests - ---- - tests/scripts/conf.sh | 18 ++++++++++++++++++ - tests/scripts/defines.sh | 7 +++++++ - 2 files changed, 25 insertions(+) - -diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh -index 9a33d88e9..2a859d89d 100755 ---- a/tests/scripts/conf.sh -+++ b/tests/scripts/conf.sh -@@ -74,6 +74,24 @@ sed -e "s/@BACKEND@/${BACKEND}/" \ - -e "s;@PORT4@;${PORT4};" \ - -e "s;@PORT5@;${PORT5};" \ - -e "s;@PORT6@;${PORT6};" \ -+ -e "s;@SURI1@;${SURI1};" \ -+ -e "s;@SURI2@;${SURI2};" \ -+ -e "s;@SURI3@;${SURI3};" \ -+ -e "s;@SURI4@;${SURI4};" \ -+ -e "s;@SURI5@;${SURI5};" \ -+ -e "s;@SURI6@;${SURI6};" \ -+ -e "s;@URIP1@;${URIP1};" \ -+ -e "s;@URIP2@;${URIP2};" \ -+ -e "s;@URIP3@;${URIP3};" \ -+ -e "s;@URIP4@;${URIP4};" \ -+ -e "s;@URIP5@;${URIP5};" \ -+ -e "s;@URIP6@;${URIP6};" \ -+ -e "s;@SURIP1@;${SURIP1};" \ -+ -e "s;@SURIP2@;${SURIP2};" \ -+ -e "s;@SURIP3@;${SURIP3};" \ -+ -e "s;@SURIP4@;${SURIP4};" \ -+ -e "s;@SURIP5@;${SURIP5};" \ -+ -e "s;@SURIP6@;${SURIP6};" \ - -e "s/@SASL_MECH@/${SASL_MECH}/" \ - -e "s;@TESTDIR@;${TESTDIR};" \ - -e "s;@TESTWD@;${TESTWD};" \ -diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh -index 8f7c7b853..26dab1bae 100755 ---- a/tests/scripts/defines.sh -+++ b/tests/scripts/defines.sh -@@ -221,16 +221,23 @@ URIP2="ldap://${LOCALIP}:$PORT2/" - URI3="ldap://${LOCALHOST}:$PORT3/" - URIP3="ldap://${LOCALIP}:$PORT3/" - URI4="ldap://${LOCALHOST}:$PORT4/" -+URIP4="ldap://${LOCALIP}:$PORT4/" - URI5="ldap://${LOCALHOST}:$PORT5/" -+URIP5="ldap://${LOCALIP}:$PORT5/" - URI6="ldap://${LOCALHOST}:$PORT6/" -+URIP6="ldap://${LOCALIP}:$PORT6/" - SURI1="ldaps://${LOCALHOST}:$PORT1/" - SURIP1="ldaps://${LOCALIP}:$PORT1/" - SURI2="ldaps://${LOCALHOST}:$PORT2/" - SURIP2="ldaps://${LOCALIP}:$PORT2/" - SURI3="ldaps://${LOCALHOST}:$PORT3/" -+SURIP3="ldaps://${LOCALIP}:$PORT3/" - SURI4="ldaps://${LOCALHOST}:$PORT4/" -+SURIP4="ldaps://${LOCALIP}:$PORT4/" - SURI5="ldaps://${LOCALHOST}:$PORT5/" -+SURIP5="ldaps://${LOCALIP}:$PORT5/" - SURI6="ldaps://${LOCALHOST}:$PORT6/" -+SURIP6="ldaps://${LOCALIP}:$PORT6/" - - # LDIF - LDIF=$DATADIR/test.ldif --- -2.29.2 - diff --git a/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch b/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch deleted file mode 100644 index 4f9c34a..0000000 --- a/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch +++ /dev/null @@ -1,2071 +0,0 @@ -From eb087e0861f207858a4e08c72836a86f26d9701c Mon Sep 17 00:00:00 2001 -From: Quanah Gibson-Mount -Date: Thu, 14 Jun 2018 16:12:59 +0100 -Subject: [PATCH] ITS#8573 TLS option test suite - ---- - configure.in | 4 + - tests/data/slapd-tls-sasl.conf | 65 ++ - tests/data/slapd-tls.conf | 61 ++ - tests/data/tls/ca/certs/testsuiteCA.crt | 16 + - tests/data/tls/ca/private/testsuiteCA.key | 16 + - .../tls/certs/bjensen@mailgw.example.com.crt | 16 + - tests/data/tls/certs/localhost.crt | 16 + - tests/data/tls/conf/openssl.cnf | 129 ++++ - tests/data/tls/create-crt.sh | 78 +++ - .../private/bjensen@mailgw.example.com.key | 16 + - tests/data/tls/private/localhost.key | 16 + - tests/run.in | 3 +- - tests/scripts/defines.sh | 21 +- - tests/scripts/test067-tls | 140 +++++ - tests/scripts/test068-sasl-tls-external | 102 ++++ - .../test069-delta-multimaster-starttls | 574 ++++++++++++++++++ - tests/scripts/test070-delta-multimaster-ldaps | 571 +++++++++++++++++ - 18 files changed, 1846 insertions(+), 2 deletions(-) - create mode 100644 tests/data/slapd-tls-sasl.conf - create mode 100644 tests/data/slapd-tls.conf - create mode 100644 tests/data/tls/ca/certs/testsuiteCA.crt - create mode 100644 tests/data/tls/ca/private/testsuiteCA.key - create mode 100644 tests/data/tls/certs/bjensen@mailgw.example.com.crt - create mode 100644 tests/data/tls/certs/localhost.crt - create mode 100644 tests/data/tls/conf/openssl.cnf - create mode 100755 tests/data/tls/create-crt.sh - create mode 100644 tests/data/tls/private/bjensen@mailgw.example.com.key - create mode 100644 tests/data/tls/private/localhost.key - create mode 100755 tests/scripts/test067-tls - create mode 100755 tests/scripts/test068-sasl-tls-external - create mode 100755 tests/scripts/test069-delta-multimaster-starttls - create mode 100755 tests/scripts/test070-delta-multimaster-ldaps - -diff --git a/configure.in b/configure.in -index 0c7c0a9ee..cf143d9bf 100644 ---- a/configure.in -+++ b/configure.in -@@ -592,6 +592,7 @@ KRB4_LIBS= - KRB5_LIBS= - SASL_LIBS= - TLS_LIBS= -+WITH_TLS_TYPE= - MODULES_LIBS= - SLAPI_LIBS= - LIBSLAPI= -@@ -1186,6 +1187,7 @@ if test $ol_with_tls = openssl || test $ol_with_tls = auto ; then - if test $have_openssl = yes ; then - ol_with_tls=openssl - ol_link_tls=yes -+ WITH_TLS_TYPE=openssl - - AC_DEFINE(HAVE_OPENSSL, 1, - [define if you have OpenSSL]) -@@ -1226,6 +1228,7 @@ if test $ol_link_tls = no ; then - if test $have_gnutls = yes ; then - ol_with_tls=gnutls - ol_link_tls=yes -+ WITH_TLS_TYPE=gnutls - - TLS_LIBS="-lgnutls" - -@@ -3163,6 +3166,7 @@ AC_SUBST(KRB4_LIBS) - AC_SUBST(KRB5_LIBS) - AC_SUBST(SASL_LIBS) - AC_SUBST(TLS_LIBS) -+AC_SUBST(WITH_TLS_TYPE) - AC_SUBST(MODULES_LIBS) - AC_SUBST(SLAPI_LIBS) - AC_SUBST(LIBSLAPI) -diff --git a/tests/data/slapd-tls-sasl.conf b/tests/data/slapd-tls-sasl.conf -new file mode 100644 -index 000000000..f4bb0773e ---- /dev/null -+++ b/tests/data/slapd-tls-sasl.conf -@@ -0,0 +1,65 @@ -+# stand-alone slapd config -- for testing (with indexing) -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2017 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+# -+include @SCHEMADIR@/core.schema -+include @SCHEMADIR@/cosine.schema -+# -+include @SCHEMADIR@/corba.schema -+include @SCHEMADIR@/java.schema -+include @SCHEMADIR@/inetorgperson.schema -+include @SCHEMADIR@/misc.schema -+include @SCHEMADIR@/nis.schema -+include @SCHEMADIR@/openldap.schema -+# -+include @SCHEMADIR@/duaconf.schema -+include @SCHEMADIR@/dyngroup.schema -+include @SCHEMADIR@/ppolicy.schema -+ -+# -+pidfile @TESTDIR@/slapd.1.pid -+argsfile @TESTDIR@/slapd.1.args -+ -+# SSL configuration -+TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt -+TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key -+TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt -+TLSVerifyClient hard -+ -+# -+rootdse @DATADIR@/rootdse.ldif -+ -+#mod#modulepath ../servers/slapd/back-@BACKEND@/ -+#mod#moduleload back_@BACKEND@.la -+#monitormod#modulepath ../servers/slapd/back-monitor/ -+#monitormod#moduleload back_monitor.la -+ -+authz-regexp "email=([^,]*),cn=[^,]*,ou=OpenLDAP,o=OpenLDAP Foundation,st=CA,c=US" ldap:///ou=People,dc=example,dc=com??sub?(mail=$1) -+ -+####################################################################### -+# database definitions -+####################################################################### -+ -+database @BACKEND@ -+suffix "dc=example,dc=com" -+rootdn "cn=Manager,dc=example,dc=com" -+rootpw secret -+#~null~#directory @TESTDIR@/db.1.a -+#indexdb#index objectClass eq -+#indexdb#index mail eq -+#ndb#dbname db_1_a -+#ndb#include @DATADIR@/ndb.conf -+ -+#monitor#database monitor -diff --git a/tests/data/slapd-tls.conf b/tests/data/slapd-tls.conf -new file mode 100644 -index 000000000..6a7785557 ---- /dev/null -+++ b/tests/data/slapd-tls.conf -@@ -0,0 +1,61 @@ -+# stand-alone slapd config -- for testing (with indexing) -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2017 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+# -+include @SCHEMADIR@/core.schema -+include @SCHEMADIR@/cosine.schema -+# -+include @SCHEMADIR@/corba.schema -+include @SCHEMADIR@/java.schema -+include @SCHEMADIR@/inetorgperson.schema -+include @SCHEMADIR@/misc.schema -+include @SCHEMADIR@/nis.schema -+include @SCHEMADIR@/openldap.schema -+# -+include @SCHEMADIR@/duaconf.schema -+include @SCHEMADIR@/dyngroup.schema -+include @SCHEMADIR@/ppolicy.schema -+ -+# -+pidfile @TESTDIR@/slapd.1.pid -+argsfile @TESTDIR@/slapd.1.args -+ -+# SSL configuration -+TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key -+TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt -+ -+# -+rootdse @DATADIR@/rootdse.ldif -+ -+#mod#modulepath ../servers/slapd/back-@BACKEND@/ -+#mod#moduleload back_@BACKEND@.la -+#monitormod#modulepath ../servers/slapd/back-monitor/ -+#monitormod#moduleload back_monitor.la -+ -+####################################################################### -+# database definitions -+####################################################################### -+ -+database @BACKEND@ -+suffix "dc=example,dc=com" -+rootdn "cn=Manager,dc=example,dc=com" -+rootpw secret -+#~null~#directory @TESTDIR@/db.1.a -+#indexdb#index objectClass eq -+#indexdb#index mail eq -+#ndb#dbname db_1_a -+#ndb#include @DATADIR@/ndb.conf -+ -+#monitor#database monitor -diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt -new file mode 100644 -index 000000000..7458e7461 ---- /dev/null -+++ b/tests/data/tls/ca/certs/testsuiteCA.crt -@@ -0,0 +1,16 @@ -+-----BEGIN CERTIFICATE----- -+MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV -+BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv -+bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0 -+NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB -+MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB -+UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd -+rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb -+lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL -+6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU -+7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB -+SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/ -+wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws -+ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q -+aL52EFPS0o3tiAJXS82U2wrQdJ0YEw== -+-----END CERTIFICATE----- -diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key -new file mode 100644 -index 000000000..2e14d7033 ---- /dev/null -+++ b/tests/data/tls/ca/private/testsuiteCA.key -@@ -0,0 +1,16 @@ -+-----BEGIN PRIVATE KEY----- -+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ -+WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc -+338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/ -+dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg -+O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf -+7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn -+rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f -+wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk -+AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l -+vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9 -+27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X -+KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N -+I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL -++b2qljWeZbGH -+-----END PRIVATE KEY----- -diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt -new file mode 100644 -index 000000000..93e3a0d39 ---- /dev/null -+++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt -@@ -0,0 +1,16 @@ -+-----BEGIN CERTIFICATE----- -+MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL -+MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV -+BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx -+ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV -+BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD -+VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa -+YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A -+MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg -+QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU -+U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL -+MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn -+wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f -+7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo -+4DnnYQBDnq48VORVX94= -+-----END CERTIFICATE----- -diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt -new file mode 100644 -index 000000000..194cb119d ---- /dev/null -+++ b/tests/data/tls/certs/localhost.crt -@@ -0,0 +1,16 @@ -+-----BEGIN CERTIFICATE----- -+MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL -+MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV -+BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx -+ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE -+CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT -+dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB -+iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4 -+7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv -+8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ -+BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A -+AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG -+8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl -+0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR -+GjeZB1FxqDGHjxBq2O828iejw28bSz4= -+-----END CERTIFICATE----- -diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf -new file mode 100644 -index 000000000..a3c8ad9f6 ---- /dev/null -+++ b/tests/data/tls/conf/openssl.cnf -@@ -0,0 +1,129 @@ -+HOME = . -+RANDFILE = $ENV::HOME/.rnd -+ -+oid_section = new_oids -+ -+[ new_oids ] -+tsa_policy1 = 1.2.3.4.1 -+tsa_policy2 = 1.2.3.4.5.6 -+tsa_policy3 = 1.2.3.4.5.7 -+ -+[ ca ] -+default_ca = CA_default # The default ca section -+ -+[ CA_default ] -+ -+dir = ./cruft # Where everything is kept -+certs = $dir/certs # Where the issued certs are kept -+crl_dir = $dir/crl # Where the issued crl are kept -+database = $dir/index.txt # database index file. -+new_certs_dir = $dir/certs # default place for new certs. -+certificate = $dir/cacert.pem # The CA certificate -+serial = $dir/serial # The current serial number -+crlnumber = $dir/crlnumber # the current crl number -+crl = $dir/crl.pem # The current CRL -+private_key = $dir/private/cakey.pem# The private key -+RANDFILE = $dir/private/.rand # private random number file -+x509_extensions = usr_cert # The extentions to add to the cert -+name_opt = ca_default # Subject Name options -+cert_opt = ca_default # Certificate field options -+default_days = 365 # how long to certify for -+default_crl_days= 30 # how long before next CRL -+default_md = default # use public key default MD -+preserve = no # keep passed DN ordering -+policy = policy_match -+ -+[ policy_match ] -+countryName = match -+stateOrProvinceName = match -+organizationName = match -+organizationalUnitName = optional -+commonName = supplied -+emailAddress = optional -+ -+[ policy_anything ] -+countryName = optional -+stateOrProvinceName = optional -+localityName = optional -+organizationName = optional -+organizationalUnitName = optional -+commonName = supplied -+emailAddress = optional -+ -+[ req ] -+default_bits = 2048 -+default_keyfile = privkey.pem -+distinguished_name = req_distinguished_name -+attributes = req_attributes -+x509_extensions = v3_ca # The extentions to add to the self signed cert -+ -+string_mask = utf8only -+ -+[ req_distinguished_name ] -+basicConstraints=CA:FALSE -+ -+[ req_attributes ] -+challengePassword = A challenge password -+challengePassword_min = 4 -+challengePassword_max = 20 -+ -+unstructuredName = An optional company name -+ -+[ usr_cert ] -+ -+basicConstraints=CA:FALSE -+nsComment = "OpenSSL Generated Certificate" -+ -+subjectKeyIdentifier=hash -+authorityKeyIdentifier=keyid,issuer -+ -+[ v3_req ] -+ -+basicConstraints = CA:FALSE -+keyUsage = nonRepudiation, digitalSignature, keyEncipherment -+subjectAltName = DNS:localhost,IP:127.0.0.1,IP:::1 -+ -+[ v3_ca ] -+subjectKeyIdentifier=hash -+authorityKeyIdentifier=keyid:always,issuer -+basicConstraints = CA:true -+ -+[ crl_ext ] -+ -+authorityKeyIdentifier=keyid:always -+ -+[ proxy_cert_ext ] -+basicConstraints=CA:FALSE -+nsComment = "OpenSSL Generated Certificate" -+ -+subjectKeyIdentifier=hash -+authorityKeyIdentifier=keyid,issuer -+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo -+ -+[ tsa ] -+ -+default_tsa = tsa_config1 # the default TSA section -+ -+[ tsa_config1 ] -+ -+dir = ./demoCA # TSA root directory -+serial = $dir/tsaserial # The current serial number (mandatory) -+crypto_device = builtin # OpenSSL engine to use for signing -+signer_cert = $dir/tsacert.pem # The TSA signing certificate -+ # (optional) -+certs = $dir/cacert.pem # Certificate chain to include in reply -+ # (optional) -+signer_key = $dir/private/tsakey.pem # The TSA private key (optional) -+ -+default_policy = tsa_policy1 # Policy if request did not specify it -+ # (optional) -+other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) -+digests = md5, sha1 # Acceptable message digests (mandatory) -+accuracy = secs:1, millisecs:500, microsecs:100 # (optional) -+clock_precision_digits = 0 # number of digits after dot. (optional) -+ordering = yes # Is ordering defined for timestamps? -+ # (optional, default: no) -+tsa_name = yes # Must the TSA name be included in the reply? -+ # (optional, default: no) -+ess_cert_id_chain = no # Must the ESS cert id chain be included? -+ # (optional, default: no) -diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh -new file mode 100755 -index 000000000..8c33a24fe ---- /dev/null -+++ b/tests/data/tls/create-crt.sh -@@ -0,0 +1,78 @@ -+#!/bin/sh -+openssl=$(which openssl) -+ -+if [ x"$openssl" = "x" ]; then -+echo "OpenSSL command line binary not found, skipping..." -+fi -+ -+USAGE="$0 [-s] [-u ]" -+SERVER=0 -+USER=0 -+EMAIL= -+ -+while test $# -gt 0 ; do -+ case "$1" in -+ -s | -server) -+ SERVER=1; -+ shift;; -+ -u | -user) -+ if [ x"$2" = "x" ]; then -+ echo "User cert requires an email address as an argument" -+ exit; -+ fi -+ USER=1; -+ EMAIL="$2"; -+ shift; shift;; -+ -) -+ shift;; -+ -*) -+ echo "$USAGE"; exit 1 -+ ;; -+ *) -+ break;; -+ esac -+done -+ -+if [ $SERVER = 0 -a $USER = 0 ]; then -+ echo "$USAGE"; -+ exit 1; -+fi -+ -+rm -rf ./openssl.cnf cruft -+mkdir -p private certs cruft/private cruft/certs -+ -+echo "00" > cruft/serial -+touch cruft/index.txt -+touch cruft/index.txt.attr -+hn=$(hostname -f) -+sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf > ./openssl.cnf -+ -+if [ $SERVER = 1 ]; then -+ rm -rf private/localhost.key certs/localhost.crt -+ -+ $openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \ -+ -newkey rsa:1024 -config ./openssl.cnf \ -+ -subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \ -+ -batch > /dev/null 2>&1 -+ -+ $openssl ca -out certs/localhost.crt -notext -config ./openssl.cnf -days 183000 -in localhost.csr \ -+ -keyfile ca/private/testsuiteCA.key -extensions v3_req -cert ca/certs/testsuiteCA.crt \ -+ -batch >/dev/null 2>&1 -+ -+ rm -rf ./openssl.cnf ./localhost.csr cruft -+fi -+ -+if [ $USER = 1 ]; then -+ rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr -+ -+ $openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \ -+ -newkey rsa:1024 -config ./openssl.cnf \ -+ -subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \ -+ -batch >/dev/null 2>&1 -+ -+ $openssl ca -out certs/$EMAIL.crt -notext -config ./openssl.cnf -days 183000 -in $EMAIL.csr \ -+ -keyfile ca/private/testsuiteCA.key -extensions req_distinguished_name \ -+ -cert ca/certs/testsuiteCA.crt -batch >/dev/null 2>&1 -+ -+ rm -rf ./openssl.cnf ./$EMAIL.csr cruft -+fi -diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key -new file mode 100644 -index 000000000..5f4625fd7 ---- /dev/null -+++ b/tests/data/tls/private/bjensen@mailgw.example.com.key -@@ -0,0 +1,16 @@ -+-----BEGIN PRIVATE KEY----- -+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2 -+xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4 -+9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z -+yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r -+oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e -+nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg -+xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra -+EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd -+9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/ -+pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI -+tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ -+3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D -+tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg -+36Ixj3L+5H18 -+-----END PRIVATE KEY----- -diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key -new file mode 100644 -index 000000000..8a24f69f8 ---- /dev/null -+++ b/tests/data/tls/private/localhost.key -@@ -0,0 +1,16 @@ -+-----BEGIN PRIVATE KEY----- -+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg -+ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM -+w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM -+brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij -+Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf -+2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ -+bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q -+1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf -+3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U -+VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7 -+TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b -+iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP -+5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3 -+b61hkjQZfbEg5cg= -+-----END PRIVATE KEY----- -diff --git a/tests/run.in b/tests/run.in -index a542eedec..468c3e1f2 100644 ---- a/tests/run.in -+++ b/tests/run.in -@@ -56,6 +56,7 @@ AC_valsort=valsort@BUILD_VALSORT@ - # misc - AC_WITH_SASL=@WITH_SASL@ - AC_WITH_TLS=@WITH_TLS@ -+AC_TLS_TYPE=@WITH_TLS_TYPE@ - AC_WITH_MODULES_ENABLED=@WITH_MODULES_ENABLED@ - AC_ACI_ENABLED=aci@WITH_ACI_ENABLED@ - AC_THREADS=threads@BUILD_THREAD@ -@@ -74,7 +75,7 @@ export AC_bdb AC_hdb AC_ldap AC_mdb AC_meta AC_monitor AC_null AC_relay AC_sql \ - AC_refint AC_retcode AC_rwm AC_unique AC_syncprov AC_translucent \ - AC_valsort \ - AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED AC_ACI_ENABLED \ -- AC_THREADS AC_LIBS_DYNAMIC -+ AC_THREADS AC_LIBS_DYNAMIC AC_WITH_TLS AC_TLS_TYPE - - if test ! -x ../servers/slapd/slapd ; then - echo "Could not locate slapd(8)" -diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh -index b374cc500..8f7c7b853 100755 ---- a/tests/scripts/defines.sh -+++ b/tests/scripts/defines.sh -@@ -45,6 +45,9 @@ VALSORT=${AC_valsort-valsortno} - # misc - WITH_SASL=${AC_WITH_SASL-no} - USE_SASL=${SLAPD_USE_SASL-no} -+WITH_TLS=${AC_WITH_TLS-no} -+WITH_TLS_TYPE=${AC_TLS_TYPE-no} -+ - ACI=${AC_ACI_ENABLED-acino} - THREADS=${AC_THREADS-threadsno} - SLEEP0=${SLEEP0-1} -@@ -103,6 +106,8 @@ P2SRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist2.conf - P3SRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist3.conf - REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf - SCHEMACONF=$DATADIR/slapd-schema.conf -+TLSCONF=$DATADIR/slapd-tls.conf -+TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf - GLUECONF=$DATADIR/slapd-glue.conf - REFINTCONF=$DATADIR/slapd-refint.conf - RETCODECONF=$DATADIR/slapd-retcode.conf -@@ -163,6 +168,7 @@ SLURPLOG=$TESTDIR/slurp.log - CONFIGPWF=$TESTDIR/configpw - - # args -+SASLARGS="-Q" - TOOLARGS="-x $LDAP_TOOLARGS" - TOOLPROTO="-P 3" - -@@ -184,7 +190,8 @@ BCMP="diff -iB" - CMPOUT=/dev/null - SLAPD="$TESTWD/../servers/slapd/slapd -s0" - LDAPPASSWD="$CLIENTDIR/ldappasswd $TOOLARGS" --LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $LDAP_TOOLARGS -LLL" -+LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $SASLARGS $TOOLPROTO $LDAP_TOOLARGS -LLL" -+LDAPSASLWHOAMI="$CLIENTDIR/ldapwhoami $SASLARGS $LDAP_TOOLARGS" - LDAPSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS -LLL" - LDAPRSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS" - LDAPDELETE="$CLIENTDIR/ldapdelete $TOOLPROTO $TOOLARGS" -@@ -199,6 +206,7 @@ LDIFFILTER=$PROGDIR/ldif-filter - SLAPDMTREAD=$PROGDIR/slapd-mtread - LVL=${SLAPD_DEBUG-0x4105} - LOCALHOST=localhost -+LOCALIP=127.0.0.1 - BASEPORT=${SLAPD_BASEPORT-9010} - PORT1=`expr $BASEPORT + 1` - PORT2=`expr $BASEPORT + 2` -@@ -207,11 +215,22 @@ PORT4=`expr $BASEPORT + 4` - PORT5=`expr $BASEPORT + 5` - PORT6=`expr $BASEPORT + 6` - URI1="ldap://${LOCALHOST}:$PORT1/" -+URIP1="ldap://${LOCALIP}:$PORT1/" - URI2="ldap://${LOCALHOST}:$PORT2/" -+URIP2="ldap://${LOCALIP}:$PORT2/" - URI3="ldap://${LOCALHOST}:$PORT3/" -+URIP3="ldap://${LOCALIP}:$PORT3/" - URI4="ldap://${LOCALHOST}:$PORT4/" - URI5="ldap://${LOCALHOST}:$PORT5/" - URI6="ldap://${LOCALHOST}:$PORT6/" -+SURI1="ldaps://${LOCALHOST}:$PORT1/" -+SURIP1="ldaps://${LOCALIP}:$PORT1/" -+SURI2="ldaps://${LOCALHOST}:$PORT2/" -+SURIP2="ldaps://${LOCALIP}:$PORT2/" -+SURI3="ldaps://${LOCALHOST}:$PORT3/" -+SURI4="ldaps://${LOCALHOST}:$PORT4/" -+SURI5="ldaps://${LOCALHOST}:$PORT5/" -+SURI6="ldaps://${LOCALHOST}:$PORT6/" - - # LDIF - LDIF=$DATADIR/test.ldif -diff --git a/tests/scripts/test067-tls b/tests/scripts/test067-tls -new file mode 100755 -index 000000000..2b245f5f5 ---- /dev/null -+++ b/tests/scripts/test067-tls -@@ -0,0 +1,140 @@ -+#! /bin/sh -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2017 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+echo "running defines.sh" -+. $SRCDIR/scripts/defines.sh -+ -+if test $WITH_TLS = no ; then -+ echo "TLS support not available, test skipped" -+ exit 0 -+fi -+ -+mkdir -p $TESTDIR $DBDIR1 -+cp -r $DATADIR/tls $TESTDIR -+ -+cd $TESTWD -+ -+echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." -+. $CONFFILTER $BACKEND $MONITORDB < $TLSCONF > $CONF1 -+$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & -+PID=$! -+if test $WAIT != 0 ; then -+ echo PID $PID -+ read foo -+fi -+KILLPIDS="$PID" -+ -+sleep 1 -+ -+for i in 0 1 2 3 4 5; do -+ $LDAPSEARCH -s base -b "" -H $URI1 \ -+ 'objectclass=*' > /dev/null 2>&1 -+ RC=$? -+ if test $RC = 0 ; then -+ break -+ fi -+ echo "Waiting 5 seconds for slapd to start..." -+ sleep 5 -+done -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo -n "Using ldapsearch with startTLS with no server cert validation...." -+$LDAPSEARCH -o tls_reqcert=never -ZZ -b "" -s base -H $URIP1 \ -+ '@extensibleObject' > $SEARCHOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapsearch (startTLS) failed ($RC)!" -+ exit $RC -+else -+ echo "success" -+fi -+ -+echo -n "Using ldapsearch with startTLS with hard require cert...." -+$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -ZZ -b "" -s base -H $URIP1 \ -+ '@extensibleObject' > $SEARCHOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapsearch (startTLS) failed ($RC)!" -+ exit $RC -+else -+ echo "success" -+fi -+ -+if test $WITH_TLS_TYPE = openssl ; then -+ echo -n "Using ldapsearch with startTLS and specific protocol version...." -+ $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -o tls_protocol_min=3.3 -ZZ -b "" -s base -H $URIP1 \ -+ '@extensibleObject' > $SEARCHOUT 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "ldapsearch (protocol-min) failed ($RC)!" -+ exit $RC -+ else -+ echo "success" -+ fi -+fi -+ -+echo -n "Using ldapsearch on $SURI2 with no server cert validation..." -+$LDAPSEARCH -o tls_reqcert=never -b "cn=Subschema" -s base -H $SURIP2 \ -+ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ -+ >> $SEARCHOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapsearch (ldaps) failed($RC)!" -+ exit $RC -+else -+ echo "success" -+fi -+ -+echo -n "Using ldapsearch on $SURI2 with reqcert HARD and no CA cert. Should fail..." -+$LDAPSEARCH -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ -+ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ -+ >> $SEARCHOUT 2>&1 -+RC=$? -+if test $RC = 0 ; then -+ echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!" -+ exit 1 -+else -+ echo "failed correctly with error code ($RC)" -+fi -+ -+echo -n "Using ldapsearch on $SURI2 with CA cert and reqcert HARD..." -+$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ -+ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ -+ >> $SEARCHOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapsearch (ldaps) failed ($RC)!" -+ exit $RC -+else -+ echo "success" -+fi -+ -+test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ -+if test $RC != 0 ; then -+ echo ">>>>> Test failed" -+else -+ echo ">>>>> Test succeeded" -+ RC=0 -+fi -+ -+test $KILLSERVERS != no && wait -+ -+exit $RC -diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external -new file mode 100755 -index 000000000..dcbc50fd4 ---- /dev/null -+++ b/tests/scripts/test068-sasl-tls-external -@@ -0,0 +1,102 @@ -+#! /bin/sh -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2017 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+echo "running defines.sh" -+. $SRCDIR/scripts/defines.sh -+ -+if test $WITH_TLS = no ; then -+ echo "TLS support not available, test skipped" -+ exit 0 -+fi -+ -+mkdir -p $TESTDIR $DBDIR1 -+cp -r $DATADIR/tls $TESTDIR -+ -+cd $TESTWD -+ -+echo "Running slapadd to build slapd database..." -+. $CONFFILTER $BACKEND $MONITORDB < $TLSSASLCONF > $CONF1 -+$SLAPADD -f $CONF1 -l $LDIFORDERED -+RC=$? -+if test $RC != 0 ; then -+ echo "slapadd failed ($RC)!" -+ exit $RC -+fi -+ -+echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." -+$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & -+PID=$! -+if test $WAIT != 0 ; then -+ echo PID $PID -+ read foo -+fi -+KILLPIDS="$PID" -+ -+sleep 1 -+ -+for i in 0 1 2 3 4 5; do -+ $LDAPSEARCH -s base -b "" -H $URI1 \ -+ 'objectclass=*' > /dev/null 2>&1 -+ RC=$? -+ if test $RC = 0 ; then -+ break -+ fi -+ echo "Waiting 5 seconds for slapd to start..." -+ sleep 5 -+done -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo -n "Using ldapwhoami with SASL/EXTERNAL...." -+$LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \ -+ -o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key -ZZ -Y EXTERNAL -H $URIP1 \ -+ > $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapwhoami (startTLS) failed ($RC)!" -+ exit $RC -+else -+ echo "success" -+fi -+ -+echo -n "Validating mapped SASL ID..." -+echo 'dn:cn=barbara jensen,ou=information technology division,ou=people,dc=example,dc=com' > $TESTDIR/dn.out -+$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT -+ -+RC=$? -+if test $RC != 0 ; then -+ echo "Comparison failed" -+ test $KILLSERVERS != no && kill -HUP $PID -+ exit $RC -+else -+ echo "success" -+fi -+ -+test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ -+if test $RC != 0 ; then -+ echo ">>>>> Test failed" -+else -+ echo ">>>>> Test succeeded" -+ RC=0 -+fi -+ -+test $KILLSERVERS != no && wait -+ -+exit $RC -diff --git a/tests/scripts/test069-delta-multimaster-starttls b/tests/scripts/test069-delta-multimaster-starttls -new file mode 100755 -index 000000000..2dfbb30a1 ---- /dev/null -+++ b/tests/scripts/test069-delta-multimaster-starttls -@@ -0,0 +1,574 @@ -+#! /bin/sh -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2017 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+echo "running defines.sh" -+. $SRCDIR/scripts/defines.sh -+ -+if test $WITH_TLS = no ; then -+ echo "TLS support not available, test skipped" -+ exit 0 -+fi -+ -+if test $SYNCPROV = syncprovno; then -+ echo "Syncrepl provider overlay not available, test skipped" -+ exit 0 -+fi -+if test $ACCESSLOG = accesslogno; then -+ echo "Accesslog overlay not available, test skipped" -+ exit 0 -+fi -+ -+MMR=2 -+ -+XDIR=$TESTDIR/srv -+TMP=$TESTDIR/tmp -+ -+mkdir -p $TESTDIR -+cp -r $DATADIR/tls $TESTDIR -+ -+$SLAPPASSWD -g -n >$CONFIGPWF -+ -+if test x"$SYNCMODE" = x ; then -+ SYNCMODE=rp -+fi -+case "$SYNCMODE" in -+ ro) -+ SYNCTYPE="type=refreshOnly interval=00:00:00:03" -+ ;; -+ rp) -+ SYNCTYPE="type=refreshAndPersist interval=00:00:00:03" -+ ;; -+ *) -+ echo "unknown sync mode $SYNCMODE" -+ exit 1; -+ ;; -+esac -+ -+# -+# Test delta-sync mmr -+# - start servers -+# - configure over ldap -+# - populate over ldap -+# - configure syncrepl over ldap -+# - break replication -+# - modify each server separately -+# - restore replication -+# - compare results -+# -+ -+nullExclude="" -+test $BACKEND = null && nullExclude="# " -+ -+KILLPIDS= -+ -+echo "Initializing server configurations..." -+n=1 -+while [ $n -le $MMR ]; do -+ -+DBDIR=${XDIR}$n/db -+CFDIR=${XDIR}$n/slapd.d -+ -+mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR -+ -+o=`expr 3 - $n` -+cat > $TMP <> $TMP -+dn: cn=module,cn=config -+objectClass: olcModuleList -+cn: module -+olcModulePath: $TESTWD/../servers/slapd/overlays -+EOF -+ if [ "$SYNCPROV" = syncprovmod ]; then -+ echo "olcModuleLoad: syncprov.la" >> $TMP -+ fi -+ if [ "$ACCESSLOG" = accesslogmod ]; then -+ echo "olcModuleLoad: accesslog.la" >> $TMP -+ fi -+ echo "" >> $TMP -+fi -+ -+if [ "$BACKENDTYPE" = mod ]; then -+cat <> $TMP -+dn: cn=module,cn=config -+objectClass: olcModuleList -+cn: module -+olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND -+olcModuleLoad: back_$BACKEND.la -+ -+EOF -+fi -+MYURI=`eval echo '$URI'$n` -+PROVIDERURI=`eval echo '$URIP'$o` -+if test $INDEXDB = indexdb ; then -+INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq" -+INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq" -+else -+INDEX1= -+INDEX2= -+fi -+cat >> $TMP < $TESTOUT 2>&1 -+PORT=`eval echo '$PORT'$n` -+echo "Starting server $n on TCP/IP port $PORT..." -+cd ${XDIR}${n} -+LOG=`eval echo '$LOG'$n` -+$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 & -+PID=$! -+if test $WAIT != 0 ; then -+ echo PID $PID -+ read foo -+fi -+KILLPIDS="$PID $KILLPIDS" -+cd $TESTWD -+ -+echo "Using ldapsearch to check that server $n is running..." -+for i in 0 1 2 3 4 5; do -+ $LDAPSEARCH -s base -b "" -H $MYURI \ -+ 'objectclass=*' > /dev/null 2>&1 -+ RC=$? -+ if test $RC = 0 ; then -+ break -+ fi -+ echo "Waiting 5 seconds for slapd to start..." -+ sleep 5 -+done -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+if [ $n = 1 ]; then -+echo "Using ldapadd for context on server 1..." -+$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDCP \ -+ >> $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapadd failed for server $n database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+fi -+ -+n=`expr $n + 1` -+done -+ -+echo "Using ldapadd to populate server 1..." -+$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDNOCP \ -+ >> $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapadd failed for server $n database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." -+sleep $SLEEP1 -+ -+n=1 -+while [ $n -le $MMR ]; do -+PORT=`expr $BASEPORT + $n` -+URI="ldap://${LOCALHOST}:$PORT/" -+ -+echo "Using ldapsearch to read all the entries from server $n..." -+$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ -+ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 -+RC=$? -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed at server $n ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt -+n=`expr $n + 1` -+done -+ -+n=2 -+while [ $n -le $MMR ]; do -+echo "Comparing retrieved entries from server 1 and server $n..." -+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT -+ -+if test $? != 0 ; then -+ echo "test failed - server 1 and server $n databases differ" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+fi -+n=`expr $n + 1` -+done -+ -+echo "Using ldapadd to populate server 2..." -+$LDAPADD -D "$MANAGERDN" -H $URI2 -w $PASSWD -f $LDIFADD1 \ -+ >> $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapadd failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" -+sleep 1 -+for i in 1 2 3; do -+ $LDAPSEARCH -S "" -b "$THEDN" -H $URI1 \ -+ -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 -+ RC=$? -+ -+ if test $RC = 0 ; then -+ break -+ fi -+ -+ if test $RC != 32 ; then -+ echo "ldapsearch failed at slave ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+ fi -+ -+ echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." -+ sleep $SLEEP1 -+done -+ -+n=1 -+while [ $n -le $MMR ]; do -+PORT=`expr $BASEPORT + $n` -+URI="ldap://${LOCALHOST}:$PORT/" -+ -+echo "Using ldapsearch to read all the entries from server $n..." -+$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ -+ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 -+RC=$? -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed at server $n ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt -+n=`expr $n + 1` -+done -+ -+n=2 -+while [ $n -le $MMR ]; do -+echo "Comparing retrieved entries from server 1 and server $n..." -+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT -+ -+if test $? != 0 ; then -+ echo "test failed - server 1 and server $n databases differ" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+fi -+n=`expr $n + 1` -+done -+ -+echo "Breaking replication between server 1 and 2..." -+n=1 -+while [ $n -le $MMR ]; do -+o=`expr 3 - $n` -+MYURI=`eval echo '$URI'$n` -+PROVIDERURI=`eval echo '$URIP'$o` -+$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: description -+description: Amazing -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: description -+description: Stupendous -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+delete: description -+description: Outstanding -+- -+add: description -+description: Mindboggling -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+delete: description -+description: OutStanding -+- -+add: description -+description: Bizarre -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: carLicense -+carLicense: 123-XYZ -+- -+add: employeeNumber -+employeeNumber: 32 -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: employeeType -+employeeType: deadwood -+- -+add: employeeNumber -+employeeNumber: 64 -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+replace: sn -+sn: Replaced later -+- -+replace: sn -+sn: Surname -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo "Restoring replication between server 1 and 2..." -+n=1 -+while [ $n -le $MMR ]; do -+o=`expr 3 - $n` -+MYURI=`eval echo '$URI'$n` -+PROVIDERURI=`eval echo '$URIP'$o` -+$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 < $TESTDIR/server$n.out 2>&1 -+RC=$? -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed at server $n ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt -+n=`expr $n + 1` -+done -+ -+n=2 -+while [ $n -le $MMR ]; do -+echo "Comparing retrieved entries from server 1 and server $n..." -+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT -+ -+if test $? != 0 ; then -+ echo "test failed - server 1 and server $n databases differ" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+fi -+n=`expr $n + 1` -+done -+ -+test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ -+echo ">>>>> Test succeeded" -+ -+test $KILLSERVERS != no && wait -+ -+exit 0 -diff --git a/tests/scripts/test070-delta-multimaster-ldaps b/tests/scripts/test070-delta-multimaster-ldaps -new file mode 100755 -index 000000000..1024640ef ---- /dev/null -+++ b/tests/scripts/test070-delta-multimaster-ldaps -@@ -0,0 +1,571 @@ -+#! /bin/sh -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2017 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+echo "running defines.sh" -+. $SRCDIR/scripts/defines.sh -+ -+if test $WITH_TLS = no ; then -+ echo "TLS support not available, test skipped" -+ exit 0 -+fi -+ -+if test $SYNCPROV = syncprovno; then -+ echo "Syncrepl provider overlay not available, test skipped" -+ exit 0 -+fi -+if test $ACCESSLOG = accesslogno; then -+ echo "Accesslog overlay not available, test skipped" -+ exit 0 -+fi -+ -+MMR=2 -+ -+XDIR=$TESTDIR/srv -+TMP=$TESTDIR/tmp -+ -+mkdir -p $TESTDIR -+cp -r $DATADIR/tls $TESTDIR -+ -+$SLAPPASSWD -g -n >$CONFIGPWF -+ -+if test x"$SYNCMODE" = x ; then -+ SYNCMODE=rp -+fi -+case "$SYNCMODE" in -+ ro) -+ SYNCTYPE="type=refreshOnly interval=00:00:00:03" -+ ;; -+ rp) -+ SYNCTYPE="type=refreshAndPersist interval=00:00:00:03" -+ ;; -+ *) -+ echo "unknown sync mode $SYNCMODE" -+ exit 1; -+ ;; -+esac -+ -+# -+# Test delta-sync mmr -+# - start servers -+# - configure over ldap -+# - populate over ldap -+# - configure syncrepl over ldap -+# - break replication -+# - modify each server separately -+# - restore replication -+# - compare results -+# -+ -+nullExclude="" -+test $BACKEND = null && nullExclude="# " -+ -+KILLPIDS= -+ -+echo "Initializing server configurations..." -+n=1 -+while [ $n -le $MMR ]; do -+ -+DBDIR=${XDIR}$n/db -+CFDIR=${XDIR}$n/slapd.d -+ -+mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR -+ -+o=`expr 3 - $n` -+cat > $TMP <> $TMP -+dn: cn=module,cn=config -+objectClass: olcModuleList -+cn: module -+olcModulePath: $TESTWD/../servers/slapd/overlays -+EOF -+ if [ "$SYNCPROV" = syncprovmod ]; then -+ echo "olcModuleLoad: syncprov.la" >> $TMP -+ fi -+ if [ "$ACCESSLOG" = accesslogmod ]; then -+ echo "olcModuleLoad: accesslog.la" >> $TMP -+ fi -+ echo "" >> $TMP -+fi -+ -+if [ "$BACKENDTYPE" = mod ]; then -+cat <> $TMP -+dn: cn=module,cn=config -+objectClass: olcModuleList -+cn: module -+olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND -+olcModuleLoad: back_$BACKEND.la -+ -+EOF -+fi -+MYURI=`eval echo '$SURIP'$n` -+PROVIDERURI=`eval echo '$SURIP'$o` -+if test $INDEXDB = indexdb ; then -+INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq" -+INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq" -+else -+INDEX1= -+INDEX2= -+fi -+cat >> $TMP < $TESTOUT 2>&1 -+PORT=`eval echo '$PORT'$n` -+echo "Starting server $n on TCP/IP port $PORT..." -+cd ${XDIR}${n} -+LOG=`eval echo '$LOG'$n` -+$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 & -+PID=$! -+if test $WAIT != 0 ; then -+ echo PID $PID -+ read foo -+fi -+KILLPIDS="$PID $KILLPIDS" -+cd $TESTWD -+ -+echo "Using ldapsearch to check that server $n is running..." -+for i in 0 1 2 3 4 5; do -+ $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -s base -b "" -H $MYURI \ -+ 'objectclass=*' > /dev/null 2>&1 -+ RC=$? -+ if test $RC = 0 ; then -+ break -+ fi -+ echo "Waiting 5 seconds for slapd to start..." -+ sleep 5 -+done -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+if [ $n = 1 ]; then -+echo "Using ldapadd for context on server 1..." -+$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDCP \ -+ >> $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapadd failed for server $n database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+fi -+ -+n=`expr $n + 1` -+done -+ -+echo "Using ldapadd to populate server 1..." -+$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDNOCP \ -+ >> $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapadd failed for server $n database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." -+sleep $SLEEP1 -+ -+n=1 -+while [ $n -le $MMR ]; do -+PORT=`expr $BASEPORT + $n` -+URI="ldaps://${LOCALIP}:$PORT/" -+ -+echo "Using ldapsearch to read all the entries from server $n..." -+$LDAPSEARCH -S "" -b "$BASEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $URI -w $PASSWD \ -+ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 -+RC=$? -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed at server $n ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt -+n=`expr $n + 1` -+done -+ -+n=2 -+while [ $n -le $MMR ]; do -+echo "Comparing retrieved entries from server 1 and server $n..." -+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT -+ -+if test $? != 0 ; then -+ echo "test failed - server 1 and server $n databases differ" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+fi -+n=`expr $n + 1` -+done -+ -+echo "Using ldapadd to populate server 2..." -+$LDAPADD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD -f $LDIFADD1 \ -+ >> $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapadd failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" -+sleep 1 -+for i in 1 2 3; do -+ $LDAPSEARCH -S "" -b "$THEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $SURIP1 \ -+ -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 -+ RC=$? -+ -+ if test $RC = 0 ; then -+ break -+ fi -+ -+ if test $RC != 32 ; then -+ echo "ldapsearch failed at slave ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+ fi -+ -+ echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." -+ sleep $SLEEP1 -+done -+ -+n=1 -+while [ $n -le $MMR ]; do -+PORT=`expr $BASEPORT + $n` -+URI="ldaps://${LOCALIP}:$PORT/" -+ -+echo "Using ldapsearch to read all the entries from server $n..." -+$LDAPSEARCH -S "" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ -+ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 -+RC=$? -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed at server $n ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt -+n=`expr $n + 1` -+done -+ -+n=2 -+while [ $n -le $MMR ]; do -+echo "Comparing retrieved entries from server 1 and server $n..." -+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT -+ -+if test $? != 0 ; then -+ echo "test failed - server 1 and server $n databases differ" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+fi -+n=`expr $n + 1` -+done -+ -+echo "Breaking replication between server 1 and 2..." -+n=1 -+while [ $n -le $MMR ]; do -+o=`expr 3 - $n` -+MYURI=`eval echo '$SURIP'$n` -+PROVIDERURI=`eval echo '$SURIP'$o` -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: description -+description: Amazing -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: description -+description: Stupendous -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+delete: description -+description: Outstanding -+- -+add: description -+description: Mindboggling -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+delete: description -+description: OutStanding -+- -+add: description -+description: Bizarre -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: carLicense -+carLicense: 123-XYZ -+- -+add: employeeNumber -+employeeNumber: 32 -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+add: employeeType -+employeeType: deadwood -+- -+add: employeeNumber -+employeeNumber: 64 -+ -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 2 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ -+ >> $TESTOUT 2>&1 << EOF -+dn: $THEDN -+changetype: modify -+replace: sn -+sn: Replaced later -+- -+replace: sn -+sn: Surname -+EOF -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapmodify failed for server 1 database ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo "Restoring replication between server 1 and 2..." -+n=1 -+while [ $n -le $MMR ]; do -+o=`expr 3 - $n` -+MYURI=`eval echo '$SURIP'$n` -+PROVIDERURI=`eval echo '$SURIP'$o` -+$LDAPMODIFY -D cn=config -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 < $TESTDIR/server$n.out 2>&1 -+RC=$? -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed at server $n ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt -+n=`expr $n + 1` -+done -+ -+n=2 -+while [ $n -le $MMR ]; do -+echo "Comparing retrieved entries from server 1 and server $n..." -+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT -+ -+if test $? != 0 ; then -+ echo "test failed - server 1 and server $n databases differ" -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit 1 -+fi -+n=`expr $n + 1` -+done -+ -+test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ -+echo ">>>>> Test succeeded" -+ -+test $KILLSERVERS != no && wait -+ -+exit 0 --- -2.29.2 - diff --git a/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch b/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch deleted file mode 100644 index d86a707..0000000 --- a/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch +++ /dev/null @@ -1,582 +0,0 @@ -NOTE: The patch has been adjusted to match the base code before backporting. - -From 8a259e3df16def3f05828f355e98a5089cd6e6d0 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= -Date: Thu, 14 Jun 2018 16:14:15 +0100 -Subject: [PATCH] ITS#8573 allow all libldap options in tools -o option - ---- - clients/tools/common.c | 15 ++- - doc/devel/args | 2 +- - doc/man/man1/ldapcompare.1 | 9 +- - doc/man/man1/ldapdelete.1 | 9 +- - doc/man/man1/ldapexop.1 | 9 +- - doc/man/man1/ldapmodify.1 | 9 +- - doc/man/man1/ldapmodrdn.1 | 9 +- - doc/man/man1/ldappasswd.1 | 9 +- - doc/man/man1/ldapsearch.1 | 9 +- - doc/man/man1/ldapwhoami.1 | 13 ++- - doc/man/man8/slapcat.8 | 2 +- - include/ldap_pvt.h | 5 + - libraries/libldap/init.c | 231 ++++++++++++++++++++++--------------- - servers/slapd/slapcommon.c | 5 +- - 14 files changed, 200 insertions(+), 136 deletions(-) - -diff --git a/clients/tools/common.c b/clients/tools/common.c -index 39db70b93..d5c3491fc 100644 ---- a/clients/tools/common.c -+++ b/clients/tools/common.c -@@ -351,9 +351,9 @@ N_(" -I use SASL Interactive mode\n"), - N_(" -n show what would be done but don't actually do it\n"), - N_(" -N do not use reverse DNS to canonicalize SASL host name\n"), - N_(" -O props SASL security properties\n"), --N_(" -o [=] general options\n"), -+N_(" -o [=] any libldap ldap.conf options, plus\n"), -+N_(" ldif_wrap= (in columns, or \"no\" for no wrapping)\n"), - N_(" nettimeout= (in seconds, or \"none\" or \"max\")\n"), --N_(" ldif-wrap= (in columns, or \"no\" for no wrapping)\n"), - N_(" -p port port on LDAP server\n"), - N_(" -Q use SASL Quiet mode\n"), - N_(" -R realm SASL realm\n"), -@@ -785,6 +785,11 @@ tool_args( int argc, char **argv ) - if ( (cvalue = strchr( control, '=' )) != NULL ) { - *cvalue++ = '\0'; - } -+ for ( next=control; *next; next++ ) { -+ if ( *next == '-' ) { -+ *next = '_'; -+ } -+ } - - if ( strcasecmp( control, "nettimeout" ) == 0 ) { - if( nettimeout.tv_sec != -1 ) { -@@ -814,7 +819,7 @@ tool_args( int argc, char **argv ) - exit( EXIT_FAILURE ); - } - -- } else if ( strcasecmp( control, "ldif-wrap" ) == 0 ) { -+ } else if ( strcasecmp( control, "ldif_wrap" ) == 0 ) { - if ( cvalue == 0 ) { - ldif_wrap = LDIF_LINE_WIDTH; - -@@ -825,13 +830,13 @@ tool_args( int argc, char **argv ) - unsigned int u; - if ( lutil_atou( &u, cvalue ) ) { - fprintf( stderr, -- _("Unable to parse ldif-wrap=\"%s\"\n"), cvalue ); -+ _("Unable to parse ldif_wrap=\"%s\"\n"), cvalue ); - exit( EXIT_FAILURE ); - } - ldif_wrap = (ber_len_t)u; - } - -- } else { -+ } else if ( ldap_pvt_conf_option( control, cvalue, 1 ) ) { - fprintf( stderr, "Invalid general option name: %s\n", - control ); - usage(); -diff --git a/doc/devel/args b/doc/devel/args -index 7805eff1c..31c22f948 100644 ---- a/doc/devel/args -+++ b/doc/devel/args -@@ -27,7 +27,7 @@ ldapwhoami * DE**HI** NO QR UVWXYZ def*h*** *nop* vwxy - -h host - -n no-op - -N no (SASLprep) normalization of simple bind password -- -o general options (currently nettimeout and ldif-wrap only) -+ -o general libldap options (plus ldif_wrap and nettimeout for backwards comp.) - -p port - -v verbose - -V version -diff --git a/doc/man/man1/ldapcompare.1 b/doc/man/man1/ldapcompare.1 -index 667815a26..de90498db 100644 ---- a/doc/man/man1/ldapcompare.1 -+++ b/doc/man/man1/ldapcompare.1 -@@ -186,13 +186,14 @@ Compare extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldapdelete.1 b/doc/man/man1/ldapdelete.1 -index 9e7036230..872424a65 100644 ---- a/doc/man/man1/ldapdelete.1 -+++ b/doc/man/man1/ldapdelete.1 -@@ -192,13 +192,14 @@ Delete extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldapexop.1 b/doc/man/man1/ldapexop.1 -index 5f5ae7aae..96a7c514e 100644 ---- a/doc/man/man1/ldapexop.1 -+++ b/doc/man/man1/ldapexop.1 -@@ -189,13 +189,14 @@ Specify general extensions. \'!\' indicates criticality. - .TP - .BI \-o \ opt \fR[= optparam \fR] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 -index f884c5bfb..90f813506 100644 ---- a/doc/man/man1/ldapmodify.1 -+++ b/doc/man/man1/ldapmodify.1 -@@ -255,13 +255,14 @@ Modify extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR]] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldapmodrdn.1 b/doc/man/man1/ldapmodrdn.1 -index fa9eac627..900ba7e0e 100644 ---- a/doc/man/man1/ldapmodrdn.1 -+++ b/doc/man/man1/ldapmodrdn.1 -@@ -186,13 +186,14 @@ Modrdn extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldappasswd.1 b/doc/man/man1/ldappasswd.1 -index d3f45b082..bf273fb25 100644 ---- a/doc/man/man1/ldappasswd.1 -+++ b/doc/man/man1/ldappasswd.1 -@@ -188,13 +188,14 @@ Passwd Modify extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR]] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldapsearch.1 b/doc/man/man1/ldapsearch.1 -index 196179232..901e56043 100644 ---- a/doc/man/man1/ldapsearch.1 -+++ b/doc/man/man1/ldapsearch.1 -@@ -332,13 +332,14 @@ Search extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man1/ldapwhoami.1 b/doc/man/man1/ldapwhoami.1 -index b684de54a..79864c729 100644 ---- a/doc/man/man1/ldapwhoami.1 -+++ b/doc/man/man1/ldapwhoami.1 -@@ -143,13 +143,18 @@ WhoAmI extensions: - .TP - .BI \-o \ opt \fR[= optparam \fR] - --Specify general options. -- --General options: -+Specify any -+.BR ldap.conf (5) -+option or one of the following: - .nf - nettimeout= (in seconds, or "none" or "max") -- ldif-wrap= (in columns, or "no" for no wrapping) -+ ldif_wrap= (in columns, or "no" for no wrapping) - .fi -+ -+.B -o -+option that can be passed here, check -+.BR ldap.conf (5) -+for details. - .TP - .BI \-O \ security-properties - Specify SASL security properties. -diff --git a/doc/man/man8/slapcat.8 b/doc/man/man8/slapcat.8 -index d05cfa643..24c8f03ea 100644 ---- a/doc/man/man8/slapcat.8 -+++ b/doc/man/man8/slapcat.8 -@@ -149,7 +149,7 @@ Possible generic options/values are: - syslog\-level= (see `\-S' in slapd(8)) - syslog\-user= (see `\-l' in slapd(8)) - -- ldif-wrap={no|} -+ ldif_wrap={no|} - - .in - \fIn\fP is the number of columns allowed for the LDIF output -diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h -index 61c620785..c586a95b5 100644 ---- a/include/ldap_pvt.h -+++ b/include/ldap_pvt.h -@@ -321,6 +321,11 @@ struct ldapmsg; - LDAP_F ( int ) ldap_pvt_discard LDAP_P(( - struct ldap *ld, ber_int_t msgid )); - -+/* init.c */ -+LDAP_F( int ) -+ldap_pvt_conf_option LDAP_P(( -+ char *cmd, char *opt, int userconf )); -+ - /* messages.c */ - LDAP_F( BerElement * ) - ldap_get_message_ber LDAP_P(( -diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c -index 182ef7d7e..746824fbd 100644 ---- a/libraries/libldap/init.c -+++ b/libraries/libldap/init.c -@@ -148,6 +148,141 @@ static const struct ol_attribute { - #define MAX_LDAP_ATTR_LEN sizeof("GSSAPI_ALLOW_REMOTE_PRINCIPAL") - #define MAX_LDAP_ENV_PREFIX_LEN 8 - -+static int -+ldap_int_conf_option( -+ struct ldapoptions *gopts, -+ char *cmd, char *opt, int userconf ) -+{ -+ int i; -+ -+ for(i=0; attrs[i].type != ATTR_NONE; i++) { -+ void *p; -+ -+ if( !userconf && attrs[i].useronly ) { -+ continue; -+ } -+ -+ if(strcasecmp(cmd, attrs[i].name) != 0) { -+ continue; -+ } -+ -+ switch(attrs[i].type) { -+ case ATTR_BOOL: -+ if((strcasecmp(opt, "on") == 0) -+ || (strcasecmp(opt, "yes") == 0) -+ || (strcasecmp(opt, "true") == 0)) -+ { -+ LDAP_BOOL_SET(gopts, attrs[i].offset); -+ -+ } else { -+ LDAP_BOOL_CLR(gopts, attrs[i].offset); -+ } -+ -+ break; -+ -+ case ATTR_INT: { -+ char *next; -+ long l; -+ p = &((char *) gopts)[attrs[i].offset]; -+ l = strtol( opt, &next, 10 ); -+ if ( next != opt && next[ 0 ] == '\0' ) { -+ * (int*) p = l; -+ } -+ } break; -+ -+ case ATTR_KV: { -+ const struct ol_keyvalue *kv; -+ -+ for(kv = attrs[i].data; -+ kv->key != NULL; -+ kv++) { -+ -+ if(strcasecmp(opt, kv->key) == 0) { -+ p = &((char *) gopts)[attrs[i].offset]; -+ * (int*) p = kv->value; -+ break; -+ } -+ } -+ } break; -+ -+ case ATTR_STRING: -+ p = &((char *) gopts)[attrs[i].offset]; -+ if (* (char**) p != NULL) LDAP_FREE(* (char**) p); -+ * (char**) p = LDAP_STRDUP(opt); -+ break; -+ case ATTR_OPTION: -+ ldap_set_option( NULL, attrs[i].offset, opt ); -+ break; -+ case ATTR_SASL: -+#ifdef HAVE_CYRUS_SASL -+ ldap_int_sasl_config( gopts, attrs[i].offset, opt ); -+#endif -+ break; -+ case ATTR_GSSAPI: -+#ifdef HAVE_GSSAPI -+ ldap_int_gssapi_config( gopts, attrs[i].offset, opt ); -+#endif -+ break; -+ case ATTR_TLS: -+#ifdef HAVE_TLS -+ ldap_int_tls_config( NULL, attrs[i].offset, opt ); -+#endif -+ break; -+ case ATTR_OPT_TV: { -+ struct timeval tv; -+ char *next; -+ tv.tv_usec = 0; -+ tv.tv_sec = strtol( opt, &next, 10 ); -+ if ( next != opt && next[ 0 ] == '\0' && tv.tv_sec > 0 ) { -+ (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&tv ); -+ } -+ } break; -+ case ATTR_OPT_INT: { -+ long l; -+ char *next; -+ l = strtol( opt, &next, 10 ); -+ if ( next != opt && next[ 0 ] == '\0' && l > 0 && (long)((int)l) == l ) { -+ int v = (int)l; -+ (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&v ); -+ } -+ } break; -+ } -+ -+ break; -+ } -+ -+ if ( attrs[i].type == ATTR_NONE ) { -+ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_config: " -+ "unknown option '%s'", -+ cmd, 0, 0 ); -+ return 1; -+ } -+ -+ return 0; -+} -+ -+int -+ldap_pvt_conf_option( -+ char *cmd, char *opt, int userconf ) -+{ -+ struct ldapoptions *gopts; -+ int rc = LDAP_OPT_ERROR; -+ -+ /* Get pointer to global option structure */ -+ gopts = LDAP_INT_GLOBAL_OPT(); -+ if (NULL == gopts) { -+ return LDAP_NO_MEMORY; -+ } -+ -+ if ( gopts->ldo_valid != LDAP_INITIALIZED ) { -+ ldap_int_initialize(gopts, NULL); -+ if ( gopts->ldo_valid != LDAP_INITIALIZED ) -+ return LDAP_LOCAL_ERROR; -+ } -+ -+ return ldap_int_conf_option( gopts, cmd, opt, userconf ); -+} -+ - static void openldap_ldap_init_w_conf( - const char *file, int userconf ) - { -@@ -213,101 +348,7 @@ static void openldap_ldap_init_w_conf( - while(isspace((unsigned char)*start)) start++; - opt = start; - -- for(i=0; attrs[i].type != ATTR_NONE; i++) { -- void *p; -- -- if( !userconf && attrs[i].useronly ) { -- continue; -- } -- -- if(strcasecmp(cmd, attrs[i].name) != 0) { -- continue; -- } -- -- switch(attrs[i].type) { -- case ATTR_BOOL: -- if((strcasecmp(opt, "on") == 0) -- || (strcasecmp(opt, "yes") == 0) -- || (strcasecmp(opt, "true") == 0)) -- { -- LDAP_BOOL_SET(gopts, attrs[i].offset); -- -- } else { -- LDAP_BOOL_CLR(gopts, attrs[i].offset); -- } -- -- break; -- -- case ATTR_INT: { -- char *next; -- long l; -- p = &((char *) gopts)[attrs[i].offset]; -- l = strtol( opt, &next, 10 ); -- if ( next != opt && next[ 0 ] == '\0' ) { -- * (int*) p = l; -- } -- } break; -- -- case ATTR_KV: { -- const struct ol_keyvalue *kv; -- -- for(kv = attrs[i].data; -- kv->key != NULL; -- kv++) { -- -- if(strcasecmp(opt, kv->key) == 0) { -- p = &((char *) gopts)[attrs[i].offset]; -- * (int*) p = kv->value; -- break; -- } -- } -- } break; -- -- case ATTR_STRING: -- p = &((char *) gopts)[attrs[i].offset]; -- if (* (char**) p != NULL) LDAP_FREE(* (char**) p); -- * (char**) p = LDAP_STRDUP(opt); -- break; -- case ATTR_OPTION: -- ldap_set_option( NULL, attrs[i].offset, opt ); -- break; -- case ATTR_SASL: --#ifdef HAVE_CYRUS_SASL -- ldap_int_sasl_config( gopts, attrs[i].offset, opt ); --#endif -- break; -- case ATTR_GSSAPI: --#ifdef HAVE_GSSAPI -- ldap_int_gssapi_config( gopts, attrs[i].offset, opt ); --#endif -- break; -- case ATTR_TLS: --#ifdef HAVE_TLS -- ldap_int_tls_config( NULL, attrs[i].offset, opt ); --#endif -- break; -- case ATTR_OPT_TV: { -- struct timeval tv; -- char *next; -- tv.tv_usec = 0; -- tv.tv_sec = strtol( opt, &next, 10 ); -- if ( next != opt && next[ 0 ] == '\0' && tv.tv_sec > 0 ) { -- (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&tv ); -- } -- } break; -- case ATTR_OPT_INT: { -- long l; -- char *next; -- l = strtol( opt, &next, 10 ); -- if ( next != opt && next[ 0 ] == '\0' && l > 0 && (long)((int)l) == l ) { -- int v = (int)l; -- (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&v ); -- } -- } break; -- } -- -- break; -- } -+ ldap_int_conf_option( gopts, cmd, opt, userconf ); - } - - fclose(fp); -diff --git a/servers/slapd/slapcommon.c b/servers/slapd/slapcommon.c -index 01574af1e..a62c69581 100644 ---- a/servers/slapd/slapcommon.c -+++ b/servers/slapd/slapcommon.c -@@ -228,7 +228,8 @@ parse_slapopt( int tool, int *mode ) - break; - } - -- } else if ( strncasecmp( optarg, "ldif-wrap", len ) == 0 ) { -+ } else if ( ( strncasecmp( optarg, "ldif_wrap", len ) == 0 ) || -+ ( strncasecmp( optarg, "ldif-wrap", len ) == 0 ) ) { - switch ( tool ) { - case SLAPCAT: - if ( strcasecmp( p, "no" ) == 0 ) { -@@ -237,7 +238,7 @@ parse_slapopt( int tool, int *mode ) - } else { - unsigned int u; - if ( lutil_atou( &u, p ) ) { -- Debug( LDAP_DEBUG_ANY, "unable to parse ldif-wrap=\"%s\".\n", p, 0, 0 ); -+ Debug( LDAP_DEBUG_ANY, "unable to parse ldif_wrap=\"%s\".\n", p, 0, 0 ); - return -1; - } - ldif_wrap = (ber_len_t)u; --- -2.29.2 - diff --git a/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch b/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch deleted file mode 100644 index 31574ee..0000000 --- a/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch +++ /dev/null @@ -1,631 +0,0 @@ -NOTE: The patch has been adjusted to match the base code before backporting. - -From 3cd50fa8b32a21040a9892e2a8a7a9dfc7541ce6 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 14 Apr 2020 16:10:48 +0300 -Subject: [PATCH] ITS#9189 rework sasl-cbinding support - -Add LDAP_OPT_X_SASL_CBINDING option to define the binding type to use, -defaults to "none". - -Add "tls-endpoint" binding type implementing "tls-server-end-point" from -RCF 5929, which is compatible with Windows. - -Fix "tls-unique" to include the prefix in the bindings as per RFC 5056. ---- - doc/man/man3/ldap_get_option.3 | 16 ++++++ - doc/man/man5/ldap.conf.5 | 3 + - doc/man/man5/slapd-config.5 | 4 ++ - doc/man/man5/slapd.conf.5 | 3 + - include/ldap.h | 5 ++ - include/ldap_pvt.h | 5 ++ - libraries/libldap/cyrus.c | 101 +++++++++++++++++++++++++++++---- - libraries/libldap/init.c | 1 + - libraries/libldap/ldap-int.h | 1 + - libraries/libldap/ldap-tls.h | 2 + - libraries/libldap/tls2.c | 7 +++ - libraries/libldap/tls_g.c | 59 +++++++++++++++++++ - libraries/libldap/tls_o.c | 45 +++++++++++++++ - servers/slapd/bconfig.c | 11 +++- - servers/slapd/config.c | 1 + - servers/slapd/connection.c | 9 +-- - servers/slapd/proto-slap.h | 4 +- - servers/slapd/sasl.c | 27 ++++++--- - 18 files changed, 274 insertions(+), 30 deletions(-) - -diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 -index 7546875f5..e953900ce 100644 ---- a/doc/man/man3/ldap_get_option.3 -+++ b/doc/man/man3/ldap_get_option.3 -@@ -557,6 +557,22 @@ must be a - .BR "char **" . - Its content needs to be freed by the caller using - .BR ldap_memfree (3). -+.B LDAP_OPT_X_SASL_CBINDING -+Sets/gets the channel-binding type to use in SASL, -+one of -+.BR LDAP_OPT_X_SASL_CBINDING_NONE -+(the default), -+.BR LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE -+the "tls-unique" type from RCF 5929. -+.BR LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT -+the "tls-server-end-point" from RCF 5929, compatible with Windows. -+.BR invalue -+must be -+.BR "const int *" ; -+.BR outvalue -+must be -+.BR "int *" . -+.TP - .SH TCP OPTIONS - The TCP options are OpenLDAP specific. - Mainly intended for use with Linux, they may not be portable. -diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index adf134899..29810fc9f 100644 ---- a/doc/man/man5/ldap.conf.5 -+++ b/doc/man/man5/ldap.conf.5 -@@ -286,6 +286,9 @@ size allowed. 0 disables security layers. The default is 65536. - .TP - .B SASL_NOCANON - Do not perform reverse DNS lookups to canonicalize SASL host names. The default is off. -+.TP -+.B SASL_CBINDING -+The channel-binding type to use, see also LDAP_OPT_X_SASL_CBINDING. The default is none. - .SH GSSAPI OPTIONS - If OpenLDAP is built with Generic Security Services Application Programming Interface support, - there are more options you can specify. -diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 -index 0dddfdb6c..8c987d8c1 100644 ---- a/doc/man/man5/slapd-config.5 -+++ b/doc/man/man5/slapd-config.5 -@@ -699,6 +699,10 @@ Used to specify the fully qualified domain name used for SASL processing. - .B olcSaslRealm: - Specify SASL realm. Default is empty. - .TP -+.B olcSaslCbinding: none | tls-unique | tls-endpoint -+Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. -+Default is none. -+.TP - .B olcSaslSecProps: - Used to specify Cyrus SASL security properties. - The -diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 -index 0071072b1..203ab988e 100644 ---- a/doc/man/man5/slapd.conf.5 -+++ b/doc/man/man5/slapd.conf.5 -@@ -893,6 +893,9 @@ The - property specifies the maximum security layer receive buffer - size allowed. 0 disables security layers. The default is 65536. - .TP -+.B sasl\-cbinding none | tls-unique | tls-endpoint -+Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. -+.TP - .B schemadn - Specify the distinguished name for the subschema subentry that - controls the entries on this server. The default is "cn=Subschema". -diff --git a/include/ldap.h b/include/ldap.h -index 88bfcabf8..e8ac968a9 100644 ---- a/include/ldap.h -+++ b/include/ldap.h -@@ -180,6 +180,10 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_1 ((3 << 8) + 2) - #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 ((3 << 8) + 3) - -+#define LDAP_OPT_X_SASL_CBINDING_NONE 0 -+#define LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE 1 -+#define LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT 2 -+ - /* OpenLDAP SASL options */ - #define LDAP_OPT_X_SASL_MECH 0x6100 - #define LDAP_OPT_X_SASL_REALM 0x6101 -@@ -195,6 +199,7 @@ LDAP_BEGIN_DECL - #define LDAP_OPT_X_SASL_NOCANON 0x610b - #define LDAP_OPT_X_SASL_USERNAME 0x610c /* read-only */ - #define LDAP_OPT_X_SASL_GSS_CREDS 0x610d -+#define LDAP_OPT_X_SASL_CBINDING 0x610e - - /* OpenLDAP GSSAPI options */ - #define LDAP_OPT_X_GSSAPI_DO_NOT_FREE_CONTEXT 0x6200 -diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h -index c586a95b5..b71552ec5 100644 ---- a/include/ldap_pvt.h -+++ b/include/ldap_pvt.h -@@ -262,6 +262,10 @@ LDAP_F (void *) ldap_pvt_sasl_mutex_new LDAP_P((void)); - LDAP_F (int) ldap_pvt_sasl_mutex_lock LDAP_P((void *mutex)); - LDAP_F (int) ldap_pvt_sasl_mutex_unlock LDAP_P((void *mutex)); - LDAP_F (void) ldap_pvt_sasl_mutex_dispose LDAP_P((void *mutex)); -+ -+LDAP_F (int) ldap_pvt_sasl_cbinding_parse LDAP_P(( const char *arg )); -+LDAP_F (void *) ldap_pvt_sasl_cbinding LDAP_P(( void *ssl, int type, -+ int is_server )); - #endif /* HAVE_CYRUS_SASL */ - - struct sockbuf; /* avoid pulling in */ -@@ -426,6 +430,7 @@ LDAP_F (int) ldap_pvt_tls_get_peer_dn LDAP_P(( void *ctx, struct berval *dn, - LDAPDN_rewrite_dummy *func, unsigned flags )); - LDAP_F (int) ldap_pvt_tls_get_strength LDAP_P(( void *ctx )); - LDAP_F (int) ldap_pvt_tls_get_unique LDAP_P(( void *ctx, struct berval *buf, int is_server )); -+LDAP_F (int) ldap_pvt_tls_get_endpoint LDAP_P(( void *ctx, struct berval *buf, int is_server )); - - LDAP_END_DECL - -diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c -index 3171d56a3..081e3cea5 100644 ---- a/libraries/libldap/cyrus.c -+++ b/libraries/libldap/cyrus.c -@@ -368,6 +368,65 @@ int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc ) - return LDAP_SUCCESS; - } - -+int ldap_pvt_sasl_cbinding_parse( const char *arg ) -+{ -+ int i = -1; -+ -+ if ( strcasecmp(arg, "none") == 0 ) -+ i = LDAP_OPT_X_SASL_CBINDING_NONE; -+ else if ( strcasecmp(arg, "tls-unique") == 0 ) -+ i = LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE; -+ else if ( strcasecmp(arg, "tls-endpoint") == 0 ) -+ i = LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT; -+ -+ return i; -+} -+ -+void *ldap_pvt_sasl_cbinding( void *ssl, int type, int is_server ) -+{ -+#if defined(SASL_CHANNEL_BINDING) && defined(HAVE_TLS) -+ char unique_prefix[] = "tls-unique:"; -+ char endpoint_prefix[] = "tls-server-end-point:"; -+ char cbinding[ 64 ]; -+ struct berval cbv = { 64, cbinding }; -+ void *cb_data; /* used since cb->data is const* */ -+ sasl_channel_binding_t *cb; -+ char *prefix; -+ int plen; -+ -+ switch (type) { -+ case LDAP_OPT_X_SASL_CBINDING_NONE: -+ return NULL; -+ case LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE: -+ if ( !ldap_pvt_tls_get_unique( ssl, &cbv, is_server )) -+ return NULL; -+ prefix = unique_prefix; -+ plen = sizeof(unique_prefix) -1; -+ break; -+ case LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT: -+ if ( !ldap_pvt_tls_get_endpoint( ssl, &cbv, is_server )) -+ return NULL; -+ prefix = endpoint_prefix; -+ plen = sizeof(endpoint_prefix) -1; -+ break; -+ default: -+ return NULL; -+ } -+ -+ cb = ldap_memalloc( sizeof(*cb) + plen + cbv.bv_len ); -+ cb->len = plen + cbv.bv_len; -+ cb->data = cb_data = cb+1; -+ memcpy( cb_data, prefix, plen ); -+ memcpy( cb_data + plen, cbv.bv_val, cbv.bv_len ); -+ cb->name = "ldap"; -+ cb->critical = 0; -+ -+ return cb; -+#else -+ return NULL; -+#endif -+} -+ - int - ldap_int_sasl_bind( - LDAP *ld, -@@ -497,17 +556,12 @@ ldap_int_sasl_bind( - (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac ); - LDAP_FREE( authid.bv_val ); - #ifdef SASL_CHANNEL_BINDING /* 2.1.25+ */ -- { -- char cbinding[64]; -- struct berval cbv = { sizeof(cbinding), cbinding }; -- if ( ldap_pvt_tls_get_unique( ssl, &cbv, 0 )) { -- sasl_channel_binding_t *cb = ldap_memalloc( sizeof(*cb) + -- cbv.bv_len); -- cb->name = "ldap"; -- cb->critical = 0; -- cb->data = (char *)(cb+1); -- cb->len = cbv.bv_len; -- memcpy( cb->data, cbv.bv_val, cbv.bv_len ); -+ if ( ld->ld_defconn->lconn_sasl_cbind == NULL ) { -+ void *cb; -+ cb = ldap_pvt_sasl_cbinding( ssl, -+ ld->ld_options.ldo_sasl_cbinding, -+ 0 ); -+ if ( cb != NULL ) { - sasl_setprop( ld->ld_defconn->lconn_sasl_authctx, - SASL_CHANNEL_BINDING, cb ); - ld->ld_defconn->lconn_sasl_cbind = cb; -@@ -930,12 +984,20 @@ int ldap_pvt_sasl_secprops( - int - ldap_int_sasl_config( struct ldapoptions *lo, int option, const char *arg ) - { -- int rc; -+ int rc, i; - - switch( option ) { - case LDAP_OPT_X_SASL_SECPROPS: - rc = ldap_pvt_sasl_secprops( arg, &lo->ldo_sasl_secprops ); - if( rc == LDAP_SUCCESS ) return 0; -+ break; -+ case LDAP_OPT_X_SASL_CBINDING: -+ i = ldap_pvt_sasl_cbinding_parse( arg ); -+ if ( i >= 0 ) { -+ lo->ldo_sasl_cbinding = i; -+ return 0; -+ } -+ break; - } - - return -1; -@@ -1041,6 +1103,10 @@ ldap_int_sasl_get_option( LDAP *ld, int option, void *arg ) - /* this option is write only */ - return -1; - -+ case LDAP_OPT_X_SASL_CBINDING: -+ *(int *)arg = ld->ld_options.ldo_sasl_cbinding; -+ break; -+ - #ifdef SASL_GSS_CREDS - case LDAP_OPT_X_SASL_GSS_CREDS: { - sasl_conn_t *ctx; -@@ -1142,6 +1208,17 @@ ldap_int_sasl_set_option( LDAP *ld, int option, void *arg ) - return sc == LDAP_SUCCESS ? 0 : -1; - } - -+ case LDAP_OPT_X_SASL_CBINDING: -+ if ( !arg ) return -1; -+ switch( *(int *) arg ) { -+ case LDAP_OPT_X_SASL_CBINDING_NONE: -+ case LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE: -+ case LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT: -+ ld->ld_options.ldo_sasl_cbinding = *(int *) arg; -+ return 0; -+ } -+ return -1; -+ - #ifdef SASL_GSS_CREDS - case LDAP_OPT_X_SASL_GSS_CREDS: { - sasl_conn_t *ctx; -diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c -index 746824fbd..0c4b6237e 100644 ---- a/libraries/libldap/init.c -+++ b/libraries/libldap/init.c -@@ -113,6 +113,7 @@ static const struct ol_attribute { - offsetof(struct ldapoptions, ldo_def_sasl_authzid)}, - {0, ATTR_SASL, "SASL_SECPROPS", NULL, LDAP_OPT_X_SASL_SECPROPS}, - {0, ATTR_BOOL, "SASL_NOCANON", NULL, LDAP_BOOL_SASL_NOCANON}, -+ {0, ATTR_SASL, "SASL_CBINDING", NULL, LDAP_OPT_X_SASL_CBINDING}, - #endif - - #ifdef HAVE_GSSAPI -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h -index 397894271..08d4b4a92 100644 ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -276,6 +276,7 @@ struct ldapoptions { - - /* SASL Security Properties */ - struct sasl_security_properties ldo_sasl_secprops; -+ int ldo_sasl_cbinding; - #define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0} - #else - #define LDAP_LDO_SASL_NULLARG -diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h -index 103004fa7..77975bb6c 100644 ---- a/libraries/libldap/ldap-tls.h -+++ b/libraries/libldap/ldap-tls.h -@@ -42,6 +42,7 @@ typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); - typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); - typedef int (TI_session_strength)(tls_session *sess); - typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); -+typedef int (TI_session_endpoint)(tls_session *sess, struct berval *buf, int is_server); - typedef int (TI_session_peercert)(tls_session *s, struct berval *der); - - typedef void (TI_thr_init)(void); -@@ -67,6 +68,7 @@ typedef struct tls_impl { - TI_session_chkhost *ti_session_chkhost; - TI_session_strength *ti_session_strength; - TI_session_unique *ti_session_unique; -+ TI_session_endpoint *ti_session_endpoint; - TI_session_peercert *ti_session_peercert; - - Sockbuf_IO *ti_sbio; -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index 8b1fee748..f74af7d1d 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -1041,6 +1041,13 @@ ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) - return tls_imp->ti_session_unique( session, buf, is_server ); - } - -+int -+ldap_pvt_tls_get_endpoint( void *s, struct berval *buf, int is_server ) -+{ -+ tls_session *session = s; -+ return tls_imp->ti_session_endpoint( session, buf, is_server ); -+} -+ - int - ldap_pvt_tls_get_peercert( void *s, struct berval *der ) - { -diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c -index 26d9f99ce..52dfcd3ab 100644 ---- a/libraries/libldap/tls_g.c -+++ b/libraries/libldap/tls_g.c -@@ -675,6 +675,64 @@ tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) - return 0; - } - -+static int -+tlsg_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) -+{ -+ tlsg_session *s = (tlsg_session *)sess; -+ const gnutls_datum_t *cert_data; -+ gnutls_x509_crt_t server_cert; -+ gnutls_digest_algorithm_t md; -+ int sign_algo, md_len, rc; -+ -+ if ( is_server ) -+ cert_data = gnutls_certificate_get_ours( s->session ); -+ else -+ cert_data = gnutls_certificate_get_peers( s->session, NULL ); -+ -+ if ( cert_data == NULL ) -+ return 0; -+ -+ rc = gnutls_x509_crt_init( &server_cert ); -+ if ( rc != GNUTLS_E_SUCCESS ) -+ return 0; -+ -+ rc = gnutls_x509_crt_import( server_cert, cert_data, GNUTLS_X509_FMT_DER ); -+ if ( rc != GNUTLS_E_SUCCESS ) { -+ gnutls_x509_crt_deinit( server_cert ); -+ return 0; -+ } -+ -+ sign_algo = gnutls_x509_crt_get_signature_algorithm( server_cert ); -+ gnutls_x509_crt_deinit( server_cert ); -+ if ( sign_algo <= GNUTLS_SIGN_UNKNOWN ) -+ return 0; -+ -+ md = gnutls_sign_get_hash_algorithm( sign_algo ); -+ if ( md == GNUTLS_DIG_UNKNOWN ) -+ return 0; -+ -+ /* See RFC 5929 */ -+ switch (md) { -+ case GNUTLS_DIG_NULL: -+ case GNUTLS_DIG_MD2: -+ case GNUTLS_DIG_MD5: -+ case GNUTLS_DIG_SHA1: -+ md = GNUTLS_DIG_SHA256; -+ } -+ -+ md_len = gnutls_hash_get_len( md ); -+ if ( md_len == 0 || md_len > buf->bv_len ) -+ return 0; -+ -+ rc = gnutls_hash_fast( md, cert_data->data, cert_data->size, buf->bv_val ); -+ if ( rc != GNUTLS_E_SUCCESS ) -+ return 0; -+ -+ buf->bv_len = md_len; -+ -+ return md_len; -+} -+ - static int - tlsg_session_peercert( tls_session *sess, struct berval *der ) - { -@@ -950,6 +1008,7 @@ tls_impl ldap_int_tls_impl = { - tlsg_session_chkhost, - tlsg_session_strength, - tlsg_session_unique, -+ tlsg_session_endpoint, - tlsg_session_peercert, - - &tlsg_sbio, -diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c -index 157923289..8ede11572 100644 ---- a/libraries/libldap/tls_o.c -+++ b/libraries/libldap/tls_o.c -@@ -861,6 +861,50 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) - return buf->bv_len; - } - -+static int -+tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) -+{ -+ tlso_session *s = (tlso_session *)sess; -+ const EVP_MD *md; -+ unsigned int md_len; -+ X509 *cert; -+ -+ if ( buf->bv_len < EVP_MAX_MD_SIZE ) -+ return 0; -+ -+ if ( is_server ) -+ cert = SSL_get_certificate( s ); -+ else -+ cert = SSL_get_peer_certificate( s ); -+ -+ if ( cert == NULL ) -+ return 0; -+ -+#if OPENSSL_VERSION_NUMBER >= 0x10100000 -+ md = EVP_get_digestbynid( X509_get_signature_nid( cert )); -+#else -+ md = EVP_get_digestbynid(OBJ_obj2nid( cert->sig_alg->algorithm )); -+#endif -+ -+ /* See RFC 5929 */ -+ if ( md == NULL || -+ md == EVP_md_null() || -+#ifndef OPENSSL_NO_MD2 -+ md == EVP_md2() || -+#endif -+ md == EVP_md4() || -+ md == EVP_md5() || -+ md == EVP_sha1() ) -+ md = EVP_sha256(); -+ -+ if ( !X509_digest( cert, md, buf->bv_val, &md_len )) -+ return 0; -+ -+ buf->bv_len = md_len; -+ -+ return md_len; -+} -+ - static int - tlso_session_peercert( tls_session *sess, struct berval *der ) - { -@@ -1394,6 +1438,7 @@ tls_impl ldap_int_tls_impl = { - tlso_session_chkhost, - tlso_session_strength, - tlso_session_unique, -+ tlso_session_endpoint, - tlso_session_peercert, - - &tlso_sbio, -diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c -index 3188ccfbe..8c4ccb860 100644 ---- a/servers/slapd/bconfig.c -+++ b/servers/slapd/bconfig.c -@@ -569,6 +569,15 @@ static ConfigTable config_back_cf_table[] = { - #endif - "( OLcfgGlAt:89 NAME 'olcSaslAuxprops' " - "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, -+ { "sasl-cbinding", NULL, 2, 2, 0, -+#ifdef HAVE_CYRUS_SASL -+ ARG_STRING, &sasl_cbinding, -+#else -+ ARG_IGNORED, NULL, -+#endif -+ "( OLcfgGlAt:100 NAME 'olcSaslCBinding' " -+ "EQUALITY caseIgnoreMatch " -+ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, - { "sasl-host", "host", 2, 2, 0, - #ifdef HAVE_CYRUS_SASL - ARG_STRING|ARG_UNIQUE, &sasl_host, -@@ -820,7 +829,7 @@ static ConfigOCs cf_ocs[] = { - "olcPluginLogFile $ olcReadOnly $ olcReferral $ " - "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ " - "olcRootDSE $ " -- "olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ " -+ "olcSaslAuxprops $ olcSaslCBinding $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ " - "olcSecurity $ olcServerID $ olcSizeLimit $ " - "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ " - "olcTCPBuffer $ " -diff --git a/servers/slapd/config.c b/servers/slapd/config.c -index 5108da696..77dd3c1ae 100644 ---- a/servers/slapd/config.c -+++ b/servers/slapd/config.c -@@ -73,6 +73,7 @@ char *global_host = NULL; - struct berval global_host_bv = BER_BVNULL; - char *global_realm = NULL; - char *sasl_host = NULL; -+char *sasl_cbinding = NULL; - char **default_passwd_hash = NULL; - struct berval default_search_base = BER_BVNULL; - struct berval default_search_nbase = BER_BVNULL; -diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c -index 0602fdceb..d074009e4 100644 ---- a/servers/slapd/connection.c -+++ b/servers/slapd/connection.c -@@ -1430,12 +1430,9 @@ connection_read( ber_socket_t s, conn_readinfo *cri ) - c->c_connid, (int) s, c->c_tls_ssf, c->c_ssf, 0 ); - slap_sasl_external( c, c->c_tls_ssf, &authid ); - if ( authid.bv_val ) free( authid.bv_val ); -- { -- char cbinding[64]; -- struct berval cbv = { sizeof(cbinding), cbinding }; -- if ( ldap_pvt_tls_get_unique( ssl, &cbv, 1 )) -- slap_sasl_cbinding( c, &cbv ); -- } -+ -+ slap_sasl_cbinding( c, ssl ); -+ - } else if ( rc == 1 && ber_sockbuf_ctrl( c->c_sb, - LBER_SB_OPT_NEEDS_WRITE, NULL )) { /* need to retry */ - slapd_set_write( s, 1 ); -diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h -index de1cabf32..9b52760bd 100644 ---- a/servers/slapd/proto-slap.h -+++ b/servers/slapd/proto-slap.h -@@ -1657,8 +1657,7 @@ LDAP_SLAPD_F (int) slap_sasl_external( Connection *c, - slap_ssf_t ssf, /* relative strength of external security */ - struct berval *authid ); /* asserted authenication id */ - --LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, -- struct berval *cbv ); -+LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, void *ssl ); - - LDAP_SLAPD_F (int) slap_sasl_reset( Connection *c ); - LDAP_SLAPD_F (int) slap_sasl_close( Connection *c ); -@@ -2039,6 +2038,7 @@ LDAP_SLAPD_V (char *) global_host; - LDAP_SLAPD_V (struct berval) global_host_bv; - LDAP_SLAPD_V (char *) global_realm; - LDAP_SLAPD_V (char *) sasl_host; -+LDAP_SLAPD_V (char *) sasl_cbinding; - LDAP_SLAPD_V (char *) slap_sasl_auxprops; - LDAP_SLAPD_V (char **) default_passwd_hash; - LDAP_SLAPD_V (int) lber_debug; -diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c -index 258cd5407..c14e8a628 100644 ---- a/servers/slapd/sasl.c -+++ b/servers/slapd/sasl.c -@@ -1203,6 +1203,8 @@ int slap_sasl_destroy( void ) - #endif - free( sasl_host ); - sasl_host = NULL; -+ free( sasl_cbinding ); -+ sasl_cbinding = NULL; - - return 0; - } -@@ -1389,17 +1391,24 @@ int slap_sasl_external( - return LDAP_SUCCESS; - } - --int slap_sasl_cbinding( Connection *conn, struct berval *cbv ) -+int slap_sasl_cbinding( Connection *conn, void *ssl ) - { - #ifdef SASL_CHANNEL_BINDING -- sasl_channel_binding_t *cb = ch_malloc( sizeof(*cb) + cbv->bv_len );; -- cb->name = "ldap"; -- cb->critical = 0; -- cb->data = (char *)(cb+1); -- cb->len = cbv->bv_len; -- memcpy( cb->data, cbv->bv_val, cbv->bv_len ); -- sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); -- conn->c_sasl_cbind = cb; -+ void *cb; -+ int i; -+ -+ if ( sasl_cbinding == NULL ) -+ return LDAP_SUCCESS; -+ -+ i = ldap_pvt_sasl_cbinding_parse( sasl_cbinding ); -+ if ( i < 0 ) -+ return LDAP_SUCCESS; -+ -+ cb = ldap_pvt_sasl_cbinding( ssl, i, 1 ); -+ if ( cb != NULL ) { -+ sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); -+ conn->c_sasl_cbind = cb; -+ } - #endif - return LDAP_SUCCESS; - } --- -2.29.2 - diff --git a/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch b/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch deleted file mode 100644 index a8727dc..0000000 --- a/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 7b0017ad49a2290ec26cbcdffded8a527799e981 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Sat, 18 Apr 2020 16:30:03 +0200 -Subject: [PATCH] ITS#9189 add channel-bindings tests - ---- - tests/scripts/test068-sasl-tls-external | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - -diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external -index dcbc50fd4..ee112cf98 100755 ---- a/tests/scripts/test068-sasl-tls-external -+++ b/tests/scripts/test068-sasl-tls-external -@@ -88,6 +88,28 @@ else - echo "success" - fi - -+# Exercise channel-bindings code in builds without SASL support -+for cb in "none" "tls-unique" "tls-endpoint" ; do -+ -+ echo -n "Using ldapwhoami with SASL/EXTERNAL and SASL_CBINDING (${cb})...." -+ -+ $LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ -+ -o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt \ -+ -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key \ -+ -o tls_reqcert=hard -o SASL_CBINDING=$cb -ZZ -Y EXTERNAL -H $URIP1 \ -+ > $TESTOUT 2>&1 -+ -+ RC=$? -+ if test $RC != 0 ; then -+ echo "ldapwhoami failed ($RC)!" -+ test $KILLSERVERS != no && kill -HUP $PID -+ exit $RC -+ else -+ echo "success" -+ fi -+done -+ -+ - test $KILLSERVERS != no && kill -HUP $KILLPIDS - - if test $RC != 0 ; then --- -2.29.2 - diff --git a/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch b/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch deleted file mode 100644 index ee9a3ca..0000000 --- a/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 4cac398b19c21ad56949ef7e67e285c6c8e7ecea Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 23 Apr 2020 22:47:32 +0200 -Subject: [PATCH] ITS#9189 - initialize ldo_sasl_cbinding in - LDAP_LDO_SASL_NULLARG - -Reported-by: Ryan Tandy @ryan ---- - libraries/libldap/ldap-int.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h -index 08d4b4a92..8c7f1e5c1 100644 ---- a/libraries/libldap/ldap-int.h -+++ b/libraries/libldap/ldap-int.h -@@ -277,7 +277,7 @@ struct ldapoptions { - /* SASL Security Properties */ - struct sasl_security_properties ldo_sasl_secprops; - int ldo_sasl_cbinding; --#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0} -+#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0},0 - #else - #define LDAP_LDO_SASL_NULLARG - #endif --- -2.29.2 - diff --git a/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch b/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch deleted file mode 100644 index ec62c85..0000000 --- a/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch +++ /dev/null @@ -1,28 +0,0 @@ -From d548ab15e0d615524c403440c01a9748bfcac87d Mon Sep 17 00:00:00 2001 -From: Howard Chu -Date: Tue, 28 Apr 2020 16:33:41 +0100 -Subject: [PATCH] ITS#9215 fix for glibc again - ---- - libraries/libldap_r/thr_posix.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libraries/libldap_r/thr_posix.c b/libraries/libldap_r/thr_posix.c -index e4b435707..62f94ca16 100644 ---- a/libraries/libldap_r/thr_posix.c -+++ b/libraries/libldap_r/thr_posix.c -@@ -18,6 +18,11 @@ - - #if defined( HAVE_PTHREADS ) - -+#ifdef __GLIBC__ -+#undef _FEATURES_H -+#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ -+#endif -+ - #include - - #ifdef REPLACE_BROKEN_YIELD --- -2.31.1 - diff --git a/openldap-cbinding-Make-prototypes-available-where-needed.patch b/openldap-cbinding-Make-prototypes-available-where-needed.patch deleted file mode 100644 index 206f7ca..0000000 --- a/openldap-cbinding-Make-prototypes-available-where-needed.patch +++ /dev/null @@ -1,64 +0,0 @@ -NOTE: The patch has been adjusted to match the base code before backporting. - -From cd914149a665167b2c5ae16baa0c438824588819 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= -Date: Tue, 19 Feb 2019 10:26:39 +0000 -Subject: [PATCH] Make prototypes available where needed - ---- - libraries/libldap/tls2.c | 3 +++ - servers/slapd/config.c | 1 + - servers/slapd/proto-slap.h | 4 ++++ - 3 files changed, 8 insertions(+) - -diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c -index ad09ba39b..8b1fee748 100644 ---- a/libraries/libldap/tls2.c -+++ b/libraries/libldap/tls2.c -@@ -76,6 +76,9 @@ static oid_name oids[] = { - - #ifdef HAVE_TLS - -+LDAP_F(int) ldap_pvt_tls_check_hostname LDAP_P(( LDAP *ld, void *s, const char *name_in )); -+LDAP_F(int) ldap_pvt_tls_get_peercert LDAP_P(( void *s, struct berval *der )); -+ - void - ldap_pvt_tls_ctx_free ( void *c ) - { -diff --git a/servers/slapd/config.c b/servers/slapd/config.c -index bd68a2421..5108da696 100644 ---- a/servers/slapd/config.c -+++ b/servers/slapd/config.c -@@ -48,6 +48,7 @@ - #endif - #include "lutil.h" - #include "lutil_ldap.h" -+#include "ldif.h" - #include "config.h" - - #ifdef _WIN32 -diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h -index 7f8e604fa..de1cabf32 100644 ---- a/servers/slapd/proto-slap.h -+++ b/servers/slapd/proto-slap.h -@@ -739,6 +739,7 @@ LDAP_SLAPD_F (int) bindconf_unparse LDAP_P(( - LDAP_SLAPD_F (int) bindconf_tls_set LDAP_P(( - slap_bindconf *bc, LDAP *ld )); - LDAP_SLAPD_F (void) bindconf_free LDAP_P(( slap_bindconf *bc )); -+LDAP_SLAPD_F (void) slap_client_keepalive LDAP_P(( LDAP *ld, slap_keepalive *sk )); - LDAP_SLAPD_F (int) slap_client_connect LDAP_P(( LDAP **ldp, slap_bindconf *sb )); - LDAP_SLAPD_F (int) config_generic_wrapper LDAP_P(( Backend *be, - const char *fname, int lineno, int argc, char **argv )); -@@ -1656,6 +1657,9 @@ LDAP_SLAPD_F (int) slap_sasl_external( Connection *c, - slap_ssf_t ssf, /* relative strength of external security */ - struct berval *authid ); /* asserted authenication id */ - -+LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, -+ struct berval *cbv ); -+ - LDAP_SLAPD_F (int) slap_sasl_reset( Connection *c ); - LDAP_SLAPD_F (int) slap_sasl_close( Connection *c ); - --- -2.29.2 - diff --git a/openldap-cbinding-Update-keys-to-RSA-4096.patch b/openldap-cbinding-Update-keys-to-RSA-4096.patch deleted file mode 100644 index f4342e4..0000000 --- a/openldap-cbinding-Update-keys-to-RSA-4096.patch +++ /dev/null @@ -1,526 +0,0 @@ -From 3ab98b2fc98843289c1833891518fb3b5b42dcd8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= -Date: Tue, 30 Oct 2018 15:42:35 +0000 -Subject: [PATCH] Update keys to RSA 4096 - ---- - tests/data/tls/ca/certs/testsuiteCA.crt | 133 ++++++++++++++++-- - tests/data/tls/ca/private/testsuiteCA.key | 64 +++++++-- - .../tls/certs/bjensen@mailgw.example.com.crt | 44 ++++-- - tests/data/tls/certs/localhost.crt | 44 ++++-- - tests/data/tls/conf/openssl.cnf | 2 +- - tests/data/tls/create-crt.sh | 9 +- - .../private/bjensen@mailgw.example.com.key | 64 +++++++-- - tests/data/tls/private/localhost.key | 64 +++++++-- - 8 files changed, 336 insertions(+), 88 deletions(-) - -diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt -index 7458e7461..62c88acca 100644 ---- a/tests/data/tls/ca/certs/testsuiteCA.crt -+++ b/tests/data/tls/ca/certs/testsuiteCA.crt -@@ -1,16 +1,121 @@ -+Certificate: -+ Data: -+ Version: 3 (0x2) -+ Serial Number: -+ 0b:43:f8:e9:ee:d3:38:37:92:db:19:65:d9:94:17:cc:70:45:d4:06 -+ Signature Algorithm: sha256WithRSAEncryption -+ Issuer: C=US, ST=CA, O=OpenLDAP Foundation, OU=OpenLDAP Test Suite -+ Validity -+ Not Before: Oct 30 15:29:02 2018 GMT -+ Not After : Nov 13 15:29:02 2519 GMT -+ Subject: C=US, ST=CA, O=OpenLDAP Foundation, OU=OpenLDAP Test Suite -+ Subject Public Key Info: -+ Public Key Algorithm: rsaEncryption -+ RSA Public-Key: (4096 bit) -+ Modulus: -+ 00:be:e0:ff:36:89:65:c0:4e:46:e6:24:e8:3d:81: -+ 97:92:28:4b:11:c6:21:ac:28:14:31:b2:a3:64:24: -+ 62:61:24:bd:76:7b:9e:7c:3a:50:65:fa:97:f3:c5: -+ 9d:49:cc:61:3a:31:6f:0d:a4:d8:70:57:73:c8:c6: -+ 66:06:d0:59:3f:24:3b:56:5d:70:20:e4:51:2b:88: -+ 5e:f4:78:82:bc:55:b5:d5:5b:f6:e5:55:1f:3a:af: -+ 59:9f:b7:5d:72:70:fe:b6:a4:dd:4e:f9:d0:38:e8: -+ 15:14:c7:45:ed:5e:d3:4c:ee:02:34:3a:37:d8:75: -+ f1:49:0d:f6:8a:7b:8c:87:39:c9:fb:f2:3a:96:57: -+ cd:7c:18:a7:bb:35:de:d3:c4:79:57:20:48:07:b9: -+ 65:f6:bd:7b:01:5c:99:8a:92:35:7c:b7:e3:96:1c: -+ 6f:4c:47:42:c1:77:d6:62:49:0e:be:01:8f:c9:f4: -+ 64:68:4c:b0:ec:10:12:d0:0e:5f:67:0e:e8:a4:bd: -+ df:9c:fb:5b:04:6f:3c:2a:35:1b:5a:ca:98:ba:f3: -+ 61:f4:3a:77:28:be:a3:63:f1:d6:94:0d:fb:a0:87: -+ e3:a5:9f:56:b6:a6:6a:90:13:80:2a:2e:ae:fe:af: -+ aa:e3:e7:d8:3b:2b:a3:52:4f:73:2d:12:aa:e2:a3: -+ 0c:aa:fb:11:40:86:68:de:be:2b:9b:36:19:9c:d7: -+ d7:5e:13:21:c9:b3:34:6d:09:53:ff:a3:2e:92:f4: -+ 33:80:de:7a:47:1c:47:57:68:53:2a:db:73:6e:6d: -+ fa:40:df:55:25:a1:fc:87:c4:86:ef:6e:16:ec:f8: -+ 48:35:f5:96:b3:55:ce:56:a9:6e:c1:8c:ea:32:85: -+ 26:ea:af:0c:92:24:05:e2:49:12:b7:07:8f:06:96: -+ be:13:fa:ec:49:f7:d4:49:6f:b9:c7:6c:79:53:39: -+ a3:89:c4:4a:92:66:b0:f3:0c:72:6d:50:3c:63:1f: -+ f3:76:63:a8:aa:b7:fd:db:ef:98:b4:5b:49:b6:84: -+ 66:e5:fc:60:0b:c1:f7:b0:f7:84:68:7e:71:5d:ac: -+ fc:a9:cb:f6:02:fc:86:d3:a7:c3:42:ef:ba:f4:1a: -+ 27:71:5d:22:f5:53:e1:a6:f4:a5:dc:31:38:45:0b: -+ a1:6d:ab:9c:05:2e:87:8c:31:02:99:80:6d:3f:66: -+ e8:8a:d7:64:4f:08:7e:2f:f0:1f:28:ff:85:57:22: -+ ee:6a:a7:05:72:f8:cf:5d:07:c6:73:23:82:85:82: -+ 76:4e:36:8a:ec:ea:f1:53:1e:e0:77:d1:4a:9f:df: -+ ec:87:91:0a:56:40:b7:23:19:fa:60:14:d0:f0:32: -+ 4d:11:39 -+ Exponent: 65537 (0x10001) -+ X509v3 extensions: -+ X509v3 Subject Key Identifier: -+ 90:CF:51:1D:E8:08:D4:4C:34:70:71:6B:D2:0B:00:68:D9:FD:60:50 -+ X509v3 Authority Key Identifier: -+ keyid:90:CF:51:1D:E8:08:D4:4C:34:70:71:6B:D2:0B:00:68:D9:FD:60:50 -+ -+ X509v3 Basic Constraints: critical -+ CA:TRUE -+ Signature Algorithm: sha256WithRSAEncryption -+ 0f:7f:a0:c5:3c:ac:dc:ed:8f:56:3e:64:89:e6:87:d0:ca:a5: -+ 37:b8:0e:49:aa:93:d3:e5:ac:ff:54:24:91:07:1b:9c:dc:08: -+ e6:cc:15:53:be:85:4c:51:52:d3:88:d0:d8:c7:b7:98:40:41: -+ 8a:a7:7a:4c:96:85:61:8c:98:76:f6:a3:2c:10:31:a1:d8:e6: -+ a7:4c:ec:c3:29:ad:04:8b:e3:f2:2d:4c:30:0d:a4:bc:c8:93: -+ d2:9b:88:1d:a4:25:eb:ff:9f:f2:d9:c5:3b:bf:51:91:71:06: -+ 92:35:96:5c:ca:6d:d6:86:47:63:07:7f:37:35:53:68:e9:4e: -+ d0:d0:25:42:18:e0:00:9e:ca:f5:bd:b7:94:ee:99:51:44:3a: -+ 0c:44:40:e3:87:e6:ce:6c:2b:3f:c1:01:6c:5c:32:d5:59:b5: -+ bd:25:a3:1a:ff:85:a5:89:9c:d8:24:4b:fa:59:99:5a:64:ab: -+ a1:d8:0f:c0:19:28:84:1e:89:c2:a1:15:4e:0f:7e:1f:bf:f8: -+ 92:df:9f:1c:d5:4a:98:40:82:ee:41:1f:de:f7:25:11:fd:76: -+ 0a:cf:37:40:bc:c2:2d:6a:ea:4a:0c:6d:b0:e6:75:37:b5:63: -+ a8:a1:c5:81:d0:84:c0:f3:e0:c3:5c:c4:9f:ec:3b:9f:8a:74: -+ ce:f0:cc:e3:e9:15:08:a0:ea:3e:a9:8e:bc:9a:01:00:96:fe: -+ 37:6f:61:b5:2c:4b:1f:5d:d7:24:09:fe:bf:f4:77:47:e4:ee: -+ 7c:ea:6b:67:84:ee:56:4f:5f:b9:b8:e4:db:70:e1:4a:b3:94: -+ 4d:dd:52:45:05:4d:79:d4:7c:8b:9d:9b:6a:0b:73:9e:f3:0e: -+ d5:d5:46:da:b4:fb:4a:ea:5b:ab:8e:42:68:0e:96:cd:8a:6e: -+ 35:a8:e6:1b:6a:ed:a8:9e:3c:cc:3b:44:54:b8:2d:ba:c7:83: -+ 91:7c:70:40:0c:14:b8:21:7a:12:ac:8c:96:4c:94:a6:ee:fe: -+ cc:77:34:8e:e3:c3:c0:44:19:51:85:07:6c:d8:d1:2e:69:8d: -+ b1:0e:42:fb:e6:16:65:86:c6:e3:2f:a7:3f:b4:8e:4f:1c:83: -+ c4:0a:ae:a0:d9:17:fd:cf:a2:38:a1:9f:70:dc:5c:df:3c:07: -+ 7b:64:01:ff:35:8c:45:43:e8:fa:a4:f6:c4:71:78:17:6e:6a: -+ 7f:d1:6e:66:c6:89:33:3b:28:4a:76:bf:ca:29:05:51:07:98: -+ ce:63:62:25:61:7f:5e:c6:91:23:02:13:15:4f:fd:24:58:9d: -+ 2d:ac:eb:cb:9a:c2:82:2f:50:5c:5a:16:bb:8c:bf:4d:66:2c: -+ 6f:1c:c4:a9:28:e1:3d:4d - -----BEGIN CERTIFICATE----- --MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV --BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv --bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0 --NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB --MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB --UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd --rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb --lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL --6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU --7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB --SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/ --wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws --ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q --aL52EFPS0o3tiAJXS82U2wrQdJ0YEw== -+MIIFjzCCA3egAwIBAgIUC0P46e7TODeS2xll2ZQXzHBF1AYwDQYJKoZIhvcNAQEL -+BQAwVjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRwwGgYDVQQKDBNPcGVuTERB -+UCBGb3VuZGF0aW9uMRwwGgYDVQQLDBNPcGVuTERBUCBUZXN0IFN1aXRlMCAXDTE4 -+MTAzMDE1MjkwMloYDzI1MTkxMTEzMTUyOTAyWjBWMQswCQYDVQQGEwJVUzELMAkG -+A1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNVBAsM -+E09wZW5MREFQIFRlc3QgU3VpdGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -+AoICAQC+4P82iWXATkbmJOg9gZeSKEsRxiGsKBQxsqNkJGJhJL12e558OlBl+pfz -+xZ1JzGE6MW8NpNhwV3PIxmYG0Fk/JDtWXXAg5FEriF70eIK8VbXVW/blVR86r1mf -+t11ycP62pN1O+dA46BUUx0XtXtNM7gI0OjfYdfFJDfaKe4yHOcn78jqWV818GKe7 -+Nd7TxHlXIEgHuWX2vXsBXJmKkjV8t+OWHG9MR0LBd9ZiSQ6+AY/J9GRoTLDsEBLQ -+Dl9nDuikvd+c+1sEbzwqNRtaypi682H0OncovqNj8daUDfugh+Oln1a2pmqQE4Aq -+Lq7+r6rj59g7K6NST3MtEqriowyq+xFAhmjeviubNhmc19deEyHJszRtCVP/oy6S -+9DOA3npHHEdXaFMq23NubfpA31UlofyHxIbvbhbs+Eg19ZazVc5WqW7BjOoyhSbq -+rwySJAXiSRK3B48Glr4T+uxJ99RJb7nHbHlTOaOJxEqSZrDzDHJtUDxjH/N2Y6iq -+t/3b75i0W0m2hGbl/GALwfew94RofnFdrPypy/YC/IbTp8NC77r0GidxXSL1U+Gm -+9KXcMThFC6Ftq5wFLoeMMQKZgG0/ZuiK12RPCH4v8B8o/4VXIu5qpwVy+M9dB8Zz -+I4KFgnZONors6vFTHuB30Uqf3+yHkQpWQLcjGfpgFNDwMk0ROQIDAQABo1MwUTAd -+BgNVHQ4EFgQUkM9RHegI1Ew0cHFr0gsAaNn9YFAwHwYDVR0jBBgwFoAUkM9RHegI -+1Ew0cHFr0gsAaNn9YFAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC -+AgEAD3+gxTys3O2PVj5kieaH0MqlN7gOSaqT0+Ws/1QkkQcbnNwI5swVU76FTFFS -+04jQ2Me3mEBBiqd6TJaFYYyYdvajLBAxodjmp0zswymtBIvj8i1MMA2kvMiT0puI -+HaQl6/+f8tnFO79RkXEGkjWWXMpt1oZHYwd/NzVTaOlO0NAlQhjgAJ7K9b23lO6Z -+UUQ6DERA44fmzmwrP8EBbFwy1Vm1vSWjGv+FpYmc2CRL+lmZWmSrodgPwBkohB6J -+wqEVTg9+H7/4kt+fHNVKmECC7kEf3vclEf12Cs83QLzCLWrqSgxtsOZ1N7VjqKHF -+gdCEwPPgw1zEn+w7n4p0zvDM4+kVCKDqPqmOvJoBAJb+N29htSxLH13XJAn+v/R3 -+R+TufOprZ4TuVk9fubjk23DhSrOUTd1SRQVNedR8i52bagtznvMO1dVG2rT7Supb -+q45CaA6WzYpuNajmG2rtqJ48zDtEVLgtuseDkXxwQAwUuCF6EqyMlkyUpu7+zHc0 -+juPDwEQZUYUHbNjRLmmNsQ5C++YWZYbG4y+nP7SOTxyDxAquoNkX/c+iOKGfcNxc -+3zwHe2QB/zWMRUPo+qT2xHF4F25qf9FuZsaJMzsoSna/yikFUQeYzmNiJWF/XsaR -+IwITFU/9JFidLazry5rCgi9QXFoWu4y/TWYsbxzEqSjhPU0= - -----END CERTIFICATE----- -diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key -index 2e14d7033..01a6614c1 100644 ---- a/tests/data/tls/ca/private/testsuiteCA.key -+++ b/tests/data/tls/ca/private/testsuiteCA.key -@@ -1,16 +1,52 @@ - -----BEGIN PRIVATE KEY----- --MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ --WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc --338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/ --dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg --O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf --7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn --rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f --wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk --AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l --vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9 --27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X --KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N --I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL --+b2qljWeZbGH -+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQC+4P82iWXATkbm -+JOg9gZeSKEsRxiGsKBQxsqNkJGJhJL12e558OlBl+pfzxZ1JzGE6MW8NpNhwV3PI -+xmYG0Fk/JDtWXXAg5FEriF70eIK8VbXVW/blVR86r1mft11ycP62pN1O+dA46BUU -+x0XtXtNM7gI0OjfYdfFJDfaKe4yHOcn78jqWV818GKe7Nd7TxHlXIEgHuWX2vXsB -+XJmKkjV8t+OWHG9MR0LBd9ZiSQ6+AY/J9GRoTLDsEBLQDl9nDuikvd+c+1sEbzwq -+NRtaypi682H0OncovqNj8daUDfugh+Oln1a2pmqQE4AqLq7+r6rj59g7K6NST3Mt -+Eqriowyq+xFAhmjeviubNhmc19deEyHJszRtCVP/oy6S9DOA3npHHEdXaFMq23Nu -+bfpA31UlofyHxIbvbhbs+Eg19ZazVc5WqW7BjOoyhSbqrwySJAXiSRK3B48Glr4T -++uxJ99RJb7nHbHlTOaOJxEqSZrDzDHJtUDxjH/N2Y6iqt/3b75i0W0m2hGbl/GAL -+wfew94RofnFdrPypy/YC/IbTp8NC77r0GidxXSL1U+Gm9KXcMThFC6Ftq5wFLoeM -+MQKZgG0/ZuiK12RPCH4v8B8o/4VXIu5qpwVy+M9dB8ZzI4KFgnZONors6vFTHuB3 -+0Uqf3+yHkQpWQLcjGfpgFNDwMk0ROQIDAQABAoICAQCVkIdpnE92V9+GBfVT/G9f -+vuLTkoRf+SeZqXgNx9SuebNbW5HblXXZ8nmOMZIFeXfVuVZjQn+1x1CaSZs4S5ki -+uKkmCyEJJN3VVo3Q0XzfRemsvNrA5+oIec2oMG2wdomfY59leqmFbZTXKy3HyT2Y -+Uga4FcYcfo4JyD8eU6DRdJ6oJC10EGiajFchghyPoqvRcSH/q24R4Ha5om1M/zOZ -+/hz+SlmLU2sjXVtGuCgtCdw5Sp5Ce5VF43JaRGjMwAnazEyjHPE8kEx8ZhCBG66B -+DqP6UrV736T3c0/Hww0fxFrENA4mIE/vhNgwNVQ5jDxDSC9ObesTW93Lu4za+Re6 -+pmP1eeS/oe1OcI1d/xK2IIQwzB7ZkJ0StbFLnjs7DATO7BGzhC9egC6s+z9oSgTS -+KvmLyoiL5U4fesVJwcCPKwwkVH9n22TuqmvB5mmvZvRTe2+OgDH55Nkfx1SoI8+Q -+/fwV9UXIIg5en+Kv8lOaWCZujmMsjHC79bwxPLeaePRwD/RBkT1MLW/T4fWGpAt3 -+H89+yufH31Y/1QMxVVtR9OdxCtljiXno/bArMNZ0oE1TiCcckMzdjKh7RNfkEXRM -+Pga92HBTgtJ3tfWJ4qOtJ4NKJPQ7wRmR03Bug8+bGM4K5HDO08fNuag/pP3AQvrM -+QGbHFVho3I7/DXnmRBq/gQKCAQEA75eptBtP8PWnN9uNsQoWxvFKQBtbLfPKUcVP -++LWOWF4ag2YRRf6TIzvGfIk54OGSL/srWCDKjXWJ0NgUn6yiqOkoP4oxEE1m2QDY -+7oCk9vJipJcrtNCKL6NhKwZDOjlDSROb/hBeMgr14Da/WkPE6zQhuwN5y4Japbjs -+cBYTao2uOg4QQz5Aee+ee55L6iAgMT0PnlQtv1uVW3D46e02CrQKtRmtDxqT3Nux -+nudJdz+rMFM0EDgVKUYRwFCa6xjI4y2K1aCwCtJG9yTJpYqCD9hehfwEije6dNNg -+p5RX3M9ai710Yx4F26cwX/t8AxqgF/2XBI0ZWD6x69cp7suPTQKCAQEAy/NUEgXN -+nymq8NK+umZwFJU7cy3weozRuEkmgmCWj4XYhbvTw6MbK+2R9XKa3ilqSd2sU2lX -+qE66kfAgqZMJ9RB+7nDOaLAMUuGw1DrwFZE7r3mKXgc4NgjtmGav4E3URXPHj5zb -+JbbN95zl96Fm3Nevs5p8sb0KexgbzHe4UzJNYFgT0l+TjJbJUAiNPsEw1bnV4cxn -+b1HO2CWTeGtAOJyjMRNwI+40wnk2N6An+Ddvb2mj2h30HujSZHnL94RAqa7RHDb6 -+lU+7JX/ll5G0mFQOFQAs4UPos2bg7hS1mfYO+UVrG4OH9gXns12158WqFED+lhmJ -+O8WDWEVAblVrnQKCAQAB9aOVrYOB3QB5HHqUMBjvl5mb3J1qSswkzxBQYGvBnUNq -+P7N0dxiM+TguXJD0neOsMMmx9tKxRXzTEHFavPa3mvCRVHgCQh/NNoyPps2yl1jn -+L7VTzUDUEuoAiBSUrVM3jcmA0nFyx1QreUcnXdaGde6wsN6WI4LKSDDm2cde37nF -+D8hiRGgSlzscl7bXO1wICw/No7KcFguqq8ndX+tJOx+7S3J25SjAbauOOSYIq6Si -+yItsdoj1xXTvtbkOoy1BbmXsSVwnOoEKFGrxx6g4qPRc9Cq1Vq9XtULdHAF79NYw -+vmPtS5mQqlVi85OYEuesSo6pot3KMvkRjLjzEwchAoIBACEvrvZfy12iwhX9tNtP -+39z5i3rqdr76OwXpoUKFxPoFpX3dWk/zMnCrb5yo0VplEs6CK5BHC+RvKxykHix5 -+qJ0f2geig3O1ccvqvYNLM9XOlA+xjzpNom/odADgdK3i/C9w74AG3gH9BPbNqP3q -+XXqB/i0Tbkbdo97zxVI4CN5AySZsLo2Ez9WIk6laOuGDPhcI7iyXvhz3CtlRA/YM -+PZ74nfVWXGD8WclrP889WEOjgZZ3choD1b1R1SpUR0Q3WO5Da/NTXuL83k7zyMAp -+DWHcC46PQL5G9o56pw8Wf5ZV24nkKdGITY9S1qjxDrBwEYTKLqLt9M6tDPpICnvp -+mmECggEBALfnUgpdGugn46UmQUMI1y+NZbSKhJHG+OBWdcc1j4kDZhF/Ei7g8pvk -+hFU5p/YA6JbGioZxiqjdrYLvgTPnJVkxy7arLTN2j2GVlhUA74BY+kNzENk2Tj9c -+zJSMVZn+WZrXNQhfYyA3FyW3wGN67GBXAHPQxFTdU3G4mR1WcyJCxKIyzP+2M8o9 -+16tpb80QRnc0OLm9Izppe7JUp2hCQt+O6E8izvLE8k2ldOr5ncTNWlxTJ0yx0hEO -+WTFqhwOM1pEmtxas1gLr8MX0hNsaQR+kjG2f8rPmH+GEZeeAwuhoJY1PcKAOYM5Y -+yu/1yFXYTrmhD/P0+nJn1DfS5JljCJY= - -----END PRIVATE KEY----- -diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt -index 93e3a0d39..eb0fc693f 100644 ---- a/tests/data/tls/certs/bjensen@mailgw.example.com.crt -+++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt -@@ -1,16 +1,32 @@ - -----BEGIN CERTIFICATE----- --MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL --MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV --BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx --ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV --BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD --VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa --YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A --MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg --QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU --U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL --MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn --wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f --7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo --4DnnYQBDnq48VORVX94= -+MIIFfDCCA2SgAwIBAgIBADANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJVUzEL -+MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNV -+BAsME09wZW5MREFQIFRlc3QgU3VpdGUwIBcNMTgxMDMwMTUzNzQwWhgPMjUxOTEx -+MTMxNTM3NDBaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNVBAoM -+E09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYDVQQD -+DBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYaYmpl -+bnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw -+ggIKAoICAQCcHBkHcUSKG4s7nKmcqZT3EoZkEgxoaMlpxUZtxBtO5ZXEfcpMaxuA -+7qkZvMJR8ws2u8TQU/18FhH4+0aZBefM0ExwqvGNJ8F0cTl3439DGNE+/psh5NWg -+qPYe/K3bAtSRtF7wDxF77eb2Yz0J3NIDxFrAbovfg0ydbt9pWJr5pDBvlqSdYu38 -+kpIB5WENCEy77QK9GEGAlMVIRXneA5t2CKsljujRG1H5YJeS6qVAEdMllHZ6a0nN -+LxTdLe1qbZyRgEqRKgW5WcWrW46Co9CRDcFeMqoHdwAQsRdOGBivgkeYUST1yIms -+CbzlSRLC1dfj++2mzCMxoc3xpZNPyHyBuRgou8VqWpF2NuG+KS7QBtm1PVUhSAvR -+X9uQOnXnazQvlRfsaHQjGUKyhMUr5dcwpTqThW4BoqtStd6/097sZTZVWmsC+mzL -+twWkESVDU0tNg/czWLn56smV7DfPjFDDAV6eNcScFfD8w04aPdk8ODalW/wnsTjI -+LQuEBssrV1h8WblruWRU31Mn+mw9SA3tDfTk9sJiEyiTJh3B1DrEb+pIuk4vz5ui -+cNcYTXCfa5ZpPL608f7cWuG2GP8f5ug4PMKyRkh6qCt7BWrVgOheo1ZhjvrbmhI4 -+yPXHATrCtYO1wqIyu9Yuirdg7WJD6npu8IV38VEgEBD3UFanY9xN7wIDAQABow0w -+CzAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCq8VvpcoAgCK/D5yi/2puB -+LD7kYaVaSXxrUQBeLTmKERw3akpgW7QTGCNgM425VVaBQRPtv8YcX9OycUAylAA+ -+7lzwdP95OJGnUOjQY4x4iRAwCPkpDCcnwc43c3WAyQb2S46aZJaWK4S0+RM3CmWH -+1Fzb6aODdnoBEKk0XgNrB6/teB+UWgtTSxWiY/HWiArDaZDPMAxqEK0hnB+b/sBD -+ZoBYnfnQXezylqbk9vkzTIbSVrv5ZZdQELOAnPuxUCFpYew1OGKcg+1twYKDHgBS -+s13zN03eMEnC/O4Z01dhu16vqdikdP+tJJrppjvZtJys0KIP24ltDnpA6h/3m/Cl -+U1eiTDgWO+SsfiL1K4gcTL1eLjnCBFfnHN5gfgAV5w5DaKzvKp7Qu8db4DtH+S4o -+W/MBKuaHHKWUPGksvFUiGNgE/XyDU4MK34/5ulzbrWmqb24pYAzm1MyjsdzmXObw -++fzg6EDBB14cWA2hA7mSqnzkiW1pELVym6+uTaIlopSIFr8nNAimwLiY5QJNGYvd -+hgNNvOyUUO+nON3aHsC/rRMgar3eo7A9AkQJ6qKVvPR2h1317PJLuKaLfjbaCzNw -+iA3JSQjcwR2ydlSgKKN2d/XXm/G4PZ9tUcBY4Zngn0ViT0/m7MFy9qsiWG97+yaZ -+nYsN5WfwDZrtG24dTotxVQ== - -----END CERTIFICATE----- -diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt -index 194cb119d..3aeae3c16 100644 ---- a/tests/data/tls/certs/localhost.crt -+++ b/tests/data/tls/certs/localhost.crt -@@ -1,16 +1,32 @@ - -----BEGIN CERTIFICATE----- --MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL --MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV --BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx --ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE --CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT --dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB --iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4 --7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv --8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ --BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A --AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG --8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl --0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR --GjeZB1FxqDGHjxBq2O828iejw28bSz4= -+MIIFhTCCA22gAwIBAgIBADANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJVUzEL -+MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNV -+BAsME09wZW5MREFQIFRlc3QgU3VpdGUwIBcNMTgxMDMwMTUzNjMwWhgPMjUxOTEx -+MTMxNTM2MzBaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwT -+T3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBTdWl0 -+ZTESMBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC -+CgKCAgEA6Ud89ugah2oWY00q1g+M6NkpluewwvGq4tkMau1gq+Q5Biv61bubgdSA -+Z+Zkkxe3Sx0Zv7i5wldIN4wXqEDlMg2qhfzKDSNKUofc0z7FLMb0Cn46WqlciUCY -+VetHhBghGd+6fxOOz+x98FhiiAif+AdiUWBTKFFohWXo/9aiGgm0ueJj2NS3Eyac -+xOKoTcDd9TMsOJ2fMH2MlquArLobCvuphOrVbqBoeeol2SzFDDOW8ryPDzFGy5xh -+ZHkm/3sGIoDpDkDR0yhvBzn47qdLI5myc6Fj96s7S2xgqiqGXJW0D0FCfpUQXxfm -+ahz/Jdwl+hqs5Eg/aA+LE/7lmS7szo3zwJQ53ApdcaupHi4fU60wPVrdo29wLwDO -+hDuS+Oc1os1UyJt0T0a+zB4PIP2rxifyxI1iWmZFt7tJyLv1k7yMN7CLCWzsSy5P -+BZpGmHV9Wbvb660N6NzlFDMqnjJWDAr1BLoV4ywmpiWPhy/7JtKXFe1V3jT5MvGM -+26IOC+zCwwZVyEIIASeWepZDuto00Lqo7jOKSlLRmuhTX1ELK8xYX6ZU/fz0FwYn -+bLu6bI4mRGfbJ12fWYm5QMje2QAuvndfi759HUeuLl6TgmeQFgqFA/6Kkwoz0Ncb -+Kaaj+ByvLXfI4S3lvkwT26nOAt966fb1bsdkb8P52NdkqeSMk5cCAwEAAaNIMEYw -+CQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwLAYDVR0RBCUwI4IJbG9jYWxob3N0hwR/ -+AAABhxAAAAAAAAAAAAAAAAAAAAABMA0GCSqGSIb3DQEBCwUAA4ICAQCGQCs10hwY -+t5o3AWjU8oT8HWnLDsEzIvI/Z2dvtsFSOFotH14d8a7CdCKNiry8BbQ82A4sG/Xw -+0aVdP1EscxGhpJuMHG4Ph9PZBm31ZW2VoRHOEs7/Moi6G/1yldVxWUH/qXO00Dw9 -+cEsiUQdPrPQDoVBKYAMuV15RP9b3iPpw3GY1EkIu+akGVziHFmFYUoU2gctiGIZ6 -+6KiqBFvCP1Yvm3RSZ5t/Kv/jPMetAnCq+9JAUAodAh2+goBvUCAN9Itr/tEs98jq -+9d14J7gzIRDdNHKOLrRFmoMrTaDZNtqBe5jiMf0O55tgjv4BqN4w11M51bjY4umd -+GX+OXoBJG+MK7AZyaHPjHa1NMoLDOUhTvHb4zPNkPiVb8r3lYkQ4VCtre+4qqrEn -+cEt9KWGpHkoz4GSKn6uidQebdi4waexcGttsHbKPaKZqzYXAJ2bjFZnv85zPtpjO -+qxzqrMUruiCU7EfjGAdZ8S0lwjdMihznLATjKuwQkJ2mVg2HbLgxZu578FHTBOHW -+LjVIr/80auF4Ino9ocHpIwL/E4jpYQWP/Uv4KBHwkAktmUOwqyt0iysRaWy4Gp7S -+keBI9FoGtJ1Mq5M2tVINBzt1ESC3t03KqyY+/9r/IeY7A7yukC0YJnJ+HorfuQFf -+0//7DOEA58bRswyWTLOAjYMJHilTKOozSQ== - -----END CERTIFICATE----- -diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf -index a3c8ad9f6..632cff11c 100644 ---- a/tests/data/tls/conf/openssl.cnf -+++ b/tests/data/tls/conf/openssl.cnf -@@ -51,7 +51,7 @@ commonName = supplied - emailAddress = optional - - [ req ] --default_bits = 2048 -+default_bits = @KEY_BITS@ - default_keyfile = privkey.pem - distinguished_name = req_distinguished_name - attributes = req_attributes -diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh -index 8c33a24fe..739f8eaf1 100755 ---- a/tests/data/tls/create-crt.sh -+++ b/tests/data/tls/create-crt.sh -@@ -5,6 +5,9 @@ if [ x"$openssl" = "x" ]; then - echo "OpenSSL command line binary not found, skipping..." - fi - -+KEY_BITS=4096 -+KEY_TYPE=rsa:$KEY_BITS -+ - USAGE="$0 [-s] [-u ]" - SERVER=0 - USER=0 -@@ -45,13 +48,13 @@ echo "00" > cruft/serial - touch cruft/index.txt - touch cruft/index.txt.attr - hn=$(hostname -f) --sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf > ./openssl.cnf -+sed -e "s;@HOSTNAME@;$hn;" -e "s;@KEY_BITS@;$KEY_BITS;" conf/openssl.cnf > ./openssl.cnf - - if [ $SERVER = 1 ]; then - rm -rf private/localhost.key certs/localhost.crt - - $openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \ -- -newkey rsa:1024 -config ./openssl.cnf \ -+ -newkey $KEY_TYPE -config ./openssl.cnf \ - -subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \ - -batch > /dev/null 2>&1 - -@@ -66,7 +69,7 @@ if [ $USER = 1 ]; then - rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr - - $openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \ -- -newkey rsa:1024 -config ./openssl.cnf \ -+ -newkey $KEY_TYPE -config ./openssl.cnf \ - -subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \ - -batch >/dev/null 2>&1 - -diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key -index 5f4625fd7..e30e11586 100644 ---- a/tests/data/tls/private/bjensen@mailgw.example.com.key -+++ b/tests/data/tls/private/bjensen@mailgw.example.com.key -@@ -1,16 +1,52 @@ - -----BEGIN PRIVATE KEY----- --MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2 --xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4 --9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z --yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r --oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e --nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg --xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra --EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd --9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/ --pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI --tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ --3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D --tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg --36Ixj3L+5H18 -+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQCcHBkHcUSKG4s7 -+nKmcqZT3EoZkEgxoaMlpxUZtxBtO5ZXEfcpMaxuA7qkZvMJR8ws2u8TQU/18FhH4 -++0aZBefM0ExwqvGNJ8F0cTl3439DGNE+/psh5NWgqPYe/K3bAtSRtF7wDxF77eb2 -+Yz0J3NIDxFrAbovfg0ydbt9pWJr5pDBvlqSdYu38kpIB5WENCEy77QK9GEGAlMVI -+RXneA5t2CKsljujRG1H5YJeS6qVAEdMllHZ6a0nNLxTdLe1qbZyRgEqRKgW5WcWr -+W46Co9CRDcFeMqoHdwAQsRdOGBivgkeYUST1yImsCbzlSRLC1dfj++2mzCMxoc3x -+pZNPyHyBuRgou8VqWpF2NuG+KS7QBtm1PVUhSAvRX9uQOnXnazQvlRfsaHQjGUKy -+hMUr5dcwpTqThW4BoqtStd6/097sZTZVWmsC+mzLtwWkESVDU0tNg/czWLn56smV -+7DfPjFDDAV6eNcScFfD8w04aPdk8ODalW/wnsTjILQuEBssrV1h8WblruWRU31Mn -++mw9SA3tDfTk9sJiEyiTJh3B1DrEb+pIuk4vz5uicNcYTXCfa5ZpPL608f7cWuG2 -+GP8f5ug4PMKyRkh6qCt7BWrVgOheo1ZhjvrbmhI4yPXHATrCtYO1wqIyu9Yuirdg -+7WJD6npu8IV38VEgEBD3UFanY9xN7wIDAQABAoICAQCWY/s40EXXRvG7XBGKe1Sn -+MZGGllyduVVQMFzJIkOsnkDKKuTY+dZlP4Zo5Q/PIvWKpRnWGRP6lsh5tJkukiHd -+jk4VvJk4AzS7mNhkRyYy3ZW3ulB5NpsXS67P610RwIhIVhuf6ORPH8GBW9lRxwoL -+1v4WpGjbywHkKQvR0Sp7lVGULuwnM0dSK2G9sdztUTGbWZlp0hRIawojtcrRt2ft -+Liyy4hooWMmAFS3wu1y3fHSNn5kEFpfis5jF+5jdDvvmsFElx/X7uiBUFMAV2vry -+wu2mceibiGjnq7Nn6I7fhgKzGnkgzzDSLA9uVBde2+RAHlO0fLTq+5YLVhe0pNBM -+J1Y0soNaO3XfVV6Vnyz8X+ruHItW2OBF9AYhIlXq/6d3MMX51BEM6odEtsi8zFgo -+ENN0GAXoyoofg+IvzPiVU2Ud7s4pAlK473d7sAQEeiFWaj7iwueAgofSUFRz7E/H -+umdhytKiJXqcjJ9O2k4sBsmQoPIB++LlUPRIlZY9UvTFxLbd/ifFUv5fqa6z0IX6 -+wkIzXmRHhG+ETk1IZBJAAho7iyyYOTP+JnnToUAMWoUaZUO2bzaZfQha8Z3KVtG/ -+PJUfHClBXqvFNaAUvA9Df3JoJddJ4pO1g0QjS/dp4C2KwNkH4oqMJctvCersoPWu -+5DYiWY6KR4GjokJ1lBeWAQKCAQEAzSKa+m2C4ANNCJB9tcKYDbYIdibCpzO+k1Fb -+gZUtNi9dEE0Po8rMG0jthm+GKJjNjiG5idSUMo+WNEGBPkELueex81AlEpOqQ6/9 -+67cyjAsF/FvgkWOpKJnGOySF/TpK4kPGYyS3ICvs1KNE5HEywHyC4C/MD8N9Z5tX -+/DfW6sBM/wPipE9YDpKfAg3fDG9YJN/gJZ8TlZVqzzw75rKGcMeLc8f0mbMo+KWQ -+VKV4vrgz1eiVrHc5VeGUaXe1Yei5El671wAdtFdmm51A2fWd80fPlQdqfAwpX7x4 -+FWuo9z2QX70rM/NTWfk4nQ6ZFEHxtm++OiTfh7RwauI8fxye6QKCAQEAwtF/tOth -+UgHrohB2DCE9gA0rxkynJHK9/SXSd0KBjERO2i41iuC9YlJT/NpNz9fM7l+L02aP -+wWLMqyC7moNmIpJMY2xBGU0EowQ/3xsSNo3u/fvOS4MyGLKENUPMFgO0J7yopiqt -+Ea31TcrFSTMSmFZCv8cGt38EwS6sdJZd/RB+h3yxesit8pouwpfbtLPx6LSGkPHY -+5nNVPgbt6xaxZJ/1kNbLFObSoZ3lzWBwp93dQh/WqeeeI51LGdM1G6fTL8HrmGFJ -+EX0AKpexFVnG/GROJc8taWtMbk9W5oK30JqR7hpSaluYbonpr9k4WQA+EAZjXfcJ -+0V0AMsMUhGtvFwKCAQAQZf7LnCuFKt5im+JgwFCVcALXJxwSb7GBZ1SQVFOL7Fdd -+MTvZ1SFh4P+T6qBn6GcuQIXrfcHnFNFmFgJ17o84akwwbiy4gnNu+8epqzhwN4Vf -++hxGoxfntftByRao+pr34YEfddTpznkdOnwMYvwypQF1WHzQmckRmjp7YB9fHsZI -+8I+SoQEiERiC+oblIJWERR1PBJt1Lr+eF2uWcpkKtPjx5X8pNkhFMD8MdTnkzSbf -+p7snUVSVB/ZsQ/SNAiShUk9jzY+SVhZOxFBl3BunUgtHF5OsnPBFxfQ3iia0tQgw -+jxfADGiSXbjn3T3hf7AJ7H7heQchewwtjy5U3v3ZAoIBAQCEAyRPe0SKJoT+X7su -+QwQClmo4SE7mUt5NAOkaKTXRz6PDEpbzkZCjZHhHGcKqeWgDizkbuh7lg0Z/G4Ik -+lK+L86jRolSGiXr/3+xMCXMRBqKQ9qV24+L5e1Y9JcDQlhfo6V06pCZ8mW1lFmcT -+UAlksucuPvZdNzQIl9ECe7YauqeStbsqIXxFrZbMA808KMde0Z1x8H/ywOpdSqLD -+r6/rKL1lNTeN5U+Ldox228fa6Gt62EpE/Y9aQMbYLBeLsvBXJ0e3DQ1PTW3kbr/v -+YNOGyY1u73GtQqkbAqY3MxLNxz/loW6BZanoFYoFv+L/5Dsp7ro8vR6pASUWQLzR -+cl9nAoIBAQCre87G76UXv6FIggT+cKM9MKS69KIE3mzNTYUo90L74vF65hJqlaIa -+mfEcPpEU+UY+ufZSIHtTDBj/9Rswaf5whJY7RfL42pSGnW2YOMpuwDIKAEvcJedu -+kZhbthBin4pa28X6L5sNxug+7Wykgesd48PmMLG4pTF+D9u7SgO37Ew5UzylPWNi -+Lrv9TlX1vv9rNFh/hOCA93DNrJlNNPltIcMDByVVjrq31QmxMJwE7cdvl1V7eoiO -+NQuGuGyFIEKPtl9dEUaA4SGYZ7fUqPZaZuzzM0Xa5UMpdcIzcuYYNn3G6FvV6vwU -+dH+lv5X1bTB18GK88ANpC2qLCKRJPCTx - -----END PRIVATE KEY----- -diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key -index 8a24f69f8..99cb512c4 100644 ---- a/tests/data/tls/private/localhost.key -+++ b/tests/data/tls/private/localhost.key -@@ -1,16 +1,52 @@ - -----BEGIN PRIVATE KEY----- --MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg --ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM --w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM --brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij --Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf --2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ --bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q --1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf --3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U --VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7 --TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b --iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP --5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3 --b61hkjQZfbEg5cg= -+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDpR3z26BqHahZj -+TSrWD4zo2SmW57DC8ari2Qxq7WCr5DkGK/rVu5uB1IBn5mSTF7dLHRm/uLnCV0g3 -+jBeoQOUyDaqF/MoNI0pSh9zTPsUsxvQKfjpaqVyJQJhV60eEGCEZ37p/E47P7H3w -+WGKICJ/4B2JRYFMoUWiFZej/1qIaCbS54mPY1LcTJpzE4qhNwN31Myw4nZ8wfYyW -+q4CsuhsK+6mE6tVuoGh56iXZLMUMM5byvI8PMUbLnGFkeSb/ewYigOkOQNHTKG8H -+Ofjup0sjmbJzoWP3qztLbGCqKoZclbQPQUJ+lRBfF+ZqHP8l3CX6GqzkSD9oD4sT -+/uWZLuzOjfPAlDncCl1xq6keLh9TrTA9Wt2jb3AvAM6EO5L45zWizVTIm3RPRr7M -+Hg8g/avGJ/LEjWJaZkW3u0nIu/WTvIw3sIsJbOxLLk8FmkaYdX1Zu9vrrQ3o3OUU -+MyqeMlYMCvUEuhXjLCamJY+HL/sm0pcV7VXeNPky8Yzbog4L7MLDBlXIQggBJ5Z6 -+lkO62jTQuqjuM4pKUtGa6FNfUQsrzFhfplT9/PQXBidsu7psjiZEZ9snXZ9ZiblA -+yN7ZAC6+d1+Lvn0dR64uXpOCZ5AWCoUD/oqTCjPQ1xsppqP4HK8td8jhLeW+TBPb -+qc4C33rp9vVux2Rvw/nY12Sp5IyTlwIDAQABAoICADh1+wLvjmwz+xMxvCpvPRWm -+afCCR0AHqeqZye2fYoR4Cm05+837SFoWCrYbB0CqvsxJUNAcb6lf4rS/DYLFojOJ -+JzqiwmyHnBd5lrLyQFrkFHDtuEX1M9ZscfJprbeE944BnmvfWfNtM9YWLlLqc31e -+nCdB/x6FBZ0z2z8Avd87dih/aNc0NNNHxy3IBiA7i/0q04soaz0bRgm5nL0xlhYE -+bzUieWH7JQ5M47g6o76eReyeQqnUrWPeh5v/zraLGiMDvGScv6wx3x2KpHtutjr5 -+mj1uVHm/UeyhYIwPGtIR0bDXhLaKcZnyeOw59G8/Z1mvVyUxb1dKW8kNKpj2yI2H -+Y1SjhW5qaOeaDPxAPqVyo6SUQIzOn6SD0l7aGyOyvYULjiw342HQYU4rQeSPOtjt -++NYMirnT7WNnmoSIsXx7nwUe38EWx5gCHy8taF4aZr5K85yZKnmsiX3vX/hH30yc -+GLOnDDa3b0FE2J2eYos14ru8RTqSLSxclr5Ru2yTdwLgE0gg+iygO1/tYYkqxZ09 -+j+METJpg4wv+cQUG/BxysISqNjaPSPHdyJeTMzC8B+PUUpbRoBuvLLokkZ9P95nG -+72TFklEOB0m0VMxrEfev0HGSzkQm92s2Bf41TRaHTPSkg+G1s0haZTNqRVTGPrr/ -+eyiz0qH2bgDeubJ3VuTBAoIBAQD9N+KeKo+hRWeV/I6BCBOfMeQOqlqIxYfYAxU+ -+CuutILbTnGKFMTAx43syh/a5EV7q4yM81RCXKK/Lmja2OIeYJUb88bC/h0x/gq5W -+LLxHbKgFDUDF2VcWShMqDOo8J8FbzWwb9bOOShqASoR6FacJuOqlFvS8gaswZtiW -+fOvlWRKO2ybULgQctX5gOf1ctuab1VrzuHnNB30gVFc95Dg1b6RiyVAa8AFm6gs9 -+6Rewk527+4T5Ho5UXvdsTVJsAhzJgVjPSyF2Vc1CRrp8lIffsg5Prb4w8kvB0i64 -+09zn+jAfVRpjdGWqMI7BR1pCdheGMqv006ZVYY+QhcBIb0BHAoIBAQDr14d5PPDv -+pCjlJnCKNzX2irU6bdIY+zvXoemj/cYvHqQbPOe/kaCWFNPMxANKMmZSTdSM7qqR -+s0P1RW/R7moWNSesYwW+2Jp2hIhiWmy+E+ksXeTlFwVpuMHSDPS/N61N8XgmT3pI -+Qngl1hgxGbttniKEwI+Nc7Z3FYDDCp206nmC5y33D+ZYHv1L3e33pyqHdHD/uIeU -+57OPr7Mmd/J6pmClh1dqyZwVBClc2V6w0y2G8Lk1v79wOMrn+4/p9KH2BgkFe2gr -+uB8TOLlUhttQ8VfzXCd+Zi9s3oW0h7Vkvt4kDlJm0MrnMmK0aqgKB+7XkKE0ccVQ -+xSodzbBdDYoxAoIBAH2qGmD8JkOWug2JRP9sDrDWhaNxj3SI8x2Uiho8OTG2JoVl -++s621oArsJwnNZ4qrLxM9NPfuVgK7RNR+Qz9iO1MsqodF+Y1MxWkuPgzQ0z+83Nu -+XFLTxZBeOpyHxEcOQ7tXeut1SCK5S+WXFZ+w1zDQAELl3ZcfkuF2aM5mOHuddMRI -+pkBuhcPpnkoK/V3htxhnDbgeOPQzXzmIIbOpauu5+A6+cW6s5UU5qVKUNxl+aK09 -+6YPoUiI07v1kch7//WFTO8vEMVsUwcS+bRYecD/nkYqhYt3PoSETOfSnz92gH/ms -+tmfdAAcyCeaJjpWlHY+P3h6mWsnMnP7QIdjQvUkCggEAGFkiBWRDQ5phFndHex2E -+FrXvS972p9mYLgTrSCD1CvxQ2PcKvf5c4+G2lBdQd6KIacrbPMmPFoe5ZmMKzlOc -+5DoMpIF8oF1gZQf9xJmtTFpl4ky3Sud7iZSnffYUdoFbBQb+7oWaDEfAe7eEu9z6 -+OrDuw2HV8DaYCedQadJ4warLbLZNSop7r3FTmTeKT90USPO+jsgQR1E8eoMbLceI -+Yx02MSCt57p0wL6zPoC6g+rpclr75A6txvo2CIkyLGczKWEqIUTCVnEl1CgxCgb6 -+MXsZJ2jGMwh9sPGwQBkaoxIJgRNxcmfv6rqK8jFos9Bp2ht2aSGty07vsDACGzlA -+oQKCAQEA8PzgkyGYHs2DwNhmv3j5ZFaP0RukwbdChSoxmbC9JP2JJxxYcnww5jYH -+xeM1bahqkdKyG5iDRiYB74EolZUMA3Zny13R4HWxNe4aUZW1H8mdmhllXX90aUOU -+WEvF2yYZbg9CQIq7zQh8HsF/S8sDTsXoZOx30zrPgb44spWKRmxdwUJt944weXvc -+p5XkLvVzBVJ+RD5IgPTBFl1iCkw3eq01CFcbTdfe9cS8V9IgDy0Jq2GvRE3Y2JS6 -+xqtBB1MgZvrUoAZ8jPacRRXddg87Hwgs9+R1jaE+ZYixojOFg+JnQOGkUd9FhJAW -+bcnWV4XIPIMbouL4132Ove+GukJlPA== - -----END PRIVATE KEY----- --- -2.29.2 - diff --git a/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch b/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch deleted file mode 100644 index 125ae6b..0000000 --- a/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch +++ /dev/null @@ -1,487 +0,0 @@ -From 8e3e85e329f5cbd989936b0df8a0ac06906a4824 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 14 Apr 2020 16:19:05 +0300 -Subject: [PATCH] auth: add SASL/GSSAPI tests - ---- - tests/data/krb5.conf | 32 ++++++ - tests/data/slapd-sasl-gssapi.conf | 65 ++++++++++++ - tests/scripts/conf.sh | 3 + - tests/scripts/defines.sh | 5 + - tests/scripts/setup_kdc.sh | 144 +++++++++++++++++++++++++++ - tests/scripts/test077-sasl-gssapi | 159 ++++++++++++++++++++++++++++++ - 6 files changed, 408 insertions(+) - create mode 100644 tests/data/krb5.conf - create mode 100644 tests/data/slapd-sasl-gssapi.conf - create mode 100755 tests/scripts/setup_kdc.sh - create mode 100755 tests/scripts/test077-sasl-gssapi - -diff --git a/tests/data/krb5.conf b/tests/data/krb5.conf -new file mode 100644 -index 000000000..739113742 ---- /dev/null -+++ b/tests/data/krb5.conf -@@ -0,0 +1,32 @@ -+[libdefaults] -+ default_realm = @KRB5REALM@ -+ dns_lookup_realm = false -+ dns_lookup_kdc = false -+ default_ccache_name = FILE://@TESTDIR@/ccache -+ #udp_preference_limit = 1 -+[realms] -+ @KRB5REALM@ = { -+ kdc = @KDCHOST@:@KDCPORT@ -+ acl_file = @TESTDIR@/kadm.acl -+ database_name = @TESTDIR@/kdc.db -+ key_stash_file = @TESTDIR@/kdc.stash -+ } -+[kdcdefaults] -+ kdc_ports = @KDCPORT@ -+ kdc_tcp_ports = @KDCPORT@ -+[logging] -+ kdc = FILE:@TESTDIR@/kdc.log -+ admin_server = FILE:@TESTDIR@/kadm.log -+ default = FILE:@TESTDIR@/krb5.log -+ -+#Heimdal -+[kdc] -+ database = { -+ dbname = @TESTDIR@/kdc.db -+ realm = @KRB5REALM@ -+ mkey_file = @TESTDIR@/kdc.stash -+ log_file = @TESTDIR@/kdc.log -+ acl_file = @TESTDIR@/kadm.acl -+ } -+[hdb] -+ db-dir = @TESTDIR@ -diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf -new file mode 100644 -index 000000000..611fc7097 ---- /dev/null -+++ b/tests/data/slapd-sasl-gssapi.conf -@@ -0,0 +1,65 @@ -+# stand-alone slapd config -- for testing (with indexing) -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2020 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+# -+include @SCHEMADIR@/core.schema -+include @SCHEMADIR@/cosine.schema -+# -+include @SCHEMADIR@/corba.schema -+include @SCHEMADIR@/java.schema -+include @SCHEMADIR@/inetorgperson.schema -+include @SCHEMADIR@/misc.schema -+include @SCHEMADIR@/nis.schema -+include @SCHEMADIR@/openldap.schema -+# -+include @SCHEMADIR@/duaconf.schema -+include @SCHEMADIR@/dyngroup.schema -+ -+# -+pidfile @TESTDIR@/slapd.1.pid -+argsfile @TESTDIR@/slapd.1.args -+ -+# SSL configuration -+TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt -+TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key -+TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt -+ -+# -+rootdse @DATADIR@/rootdse.ldif -+ -+#mod#modulepath ../servers/slapd/back-@BACKEND@/ -+#mod#moduleload back_@BACKEND@.la -+#monitormod#modulepath ../servers/slapd/back-monitor/ -+#monitormod#moduleload back_monitor.la -+ -+ -+####################################################################### -+# database definitions -+####################################################################### -+ -+database @BACKEND@ -+suffix "dc=example,dc=com" -+rootdn "cn=Manager,dc=example,dc=com" -+rootpw secret -+#~null~#directory @TESTDIR@/db.1.a -+#indexdb#index objectClass eq -+#indexdb#index mail eq -+#ndb#dbname db_1_a -+#ndb#include @DATADIR@/ndb.conf -+ -+#monitor#database monitor -+ -+sasl-realm @KRB5REALM@ -+sasl-host localhost -diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh -index 2a859d89d..5b477ed93 100755 ---- a/tests/scripts/conf.sh -+++ b/tests/scripts/conf.sh -@@ -97,4 +97,7 @@ sed -e "s/@BACKEND@/${BACKEND}/" \ - -e "s;@TESTWD@;${TESTWD};" \ - -e "s;@DATADIR@;${DATADIR};" \ - -e "s;@SCHEMADIR@;${SCHEMADIR};" \ -+ -e "s;@KRB5REALM@;${KRB5REALM};" \ -+ -e "s;@KDCHOST@;${KDCHOST};" \ -+ -e "s;@KDCPORT@;${KDCPORT};" \ - -e "/^#/d" -diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh -index 26dab1bae..78dc1f8ae 100755 ---- a/tests/scripts/defines.sh -+++ b/tests/scripts/defines.sh -@@ -108,6 +108,7 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf - SCHEMACONF=$DATADIR/slapd-schema.conf - TLSCONF=$DATADIR/slapd-tls.conf - TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf -+SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf - GLUECONF=$DATADIR/slapd-glue.conf - REFINTCONF=$DATADIR/slapd-refint.conf - RETCODECONF=$DATADIR/slapd-retcode.conf -@@ -214,6 +215,7 @@ PORT3=`expr $BASEPORT + 3` - PORT4=`expr $BASEPORT + 4` - PORT5=`expr $BASEPORT + 5` - PORT6=`expr $BASEPORT + 6` -+KDCPORT=`expr $BASEPORT + 7` - URI1="ldap://${LOCALHOST}:$PORT1/" - URIP1="ldap://${LOCALIP}:$PORT1/" - URI2="ldap://${LOCALHOST}:$PORT2/" -@@ -239,6 +241,9 @@ SURIP5="ldaps://${LOCALIP}:$PORT5/" - SURI6="ldaps://${LOCALHOST}:$PORT6/" - SURIP6="ldaps://${LOCALIP}:$PORT6/" - -+KRB5REALM="K5.REALM" -+KDCHOST=$LOCALHOST -+ - # LDIF - LDIF=$DATADIR/test.ldif - LDIFADD1=$DATADIR/do_add.1 -diff --git a/tests/scripts/setup_kdc.sh b/tests/scripts/setup_kdc.sh -new file mode 100755 -index 000000000..1cb784075 ---- /dev/null -+++ b/tests/scripts/setup_kdc.sh -@@ -0,0 +1,144 @@ -+#! /bin/sh -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2020 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+export KRB5_TRACE=$TESTDIR/k5_trace -+export KRB5_CONFIG=$TESTDIR/krb5.conf -+export KRB5_KDC_PROFILE=$KRB5_CONFIG -+export KRB5_KTNAME=$TESTDIR/server.kt -+export KRB5_CLIENT_KTNAME=$TESTDIR/client.kt -+export KRB5CCNAME=$TESTDIR/client.ccache -+ -+KDCLOG=$TESTDIR/setup_kdc.log -+KSERVICE=ldap/$LOCALHOST -+KUSER=kuser -+ -+. $CONFFILTER < $DATADIR/krb5.conf > $KRB5_CONFIG -+ -+PATH=${PATH}:/usr/lib/heimdal-servers:/usr/sbin:/usr/local/sbin -+ -+echo "Trying Heimdal KDC..." -+ -+kdc --version 2>&1 | grep Heimdal > $KDCLOG 2>&1 -+RC=$? -+if test $RC = 0 ; then -+ -+ kstash --random-key > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "Heimdal: kstash failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ flags="--realm-max-ticket-life=1h --realm-max-renewable-life=1h" -+ kadmin -l init $flags $KRB5REALM > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "Heimdal: kadmin init failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin -l add --random-key --use-defaults $KSERVICE > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "Heimdal: kadmin add failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin -l ext -k $KRB5_KTNAME $KSERVICE > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "Heimdal: kadmin ext failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin -l add --random-key --use-defaults $KUSER > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "Heimdal: kadmin add failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin -l ext -k $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "Heimdal: kadmin ext failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kdc --addresses=$LOCALIP --ports="$KDCPORT/udp" > $KDCLOG 2>&1 & -+else -+ echo "Trying MIT KDC..." -+ -+ kdb5_util create -r $KRB5REALM -s -P password > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "MIT: kdb5_util create failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin.local -q "addprinc -randkey $KSERVICE" > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "MIT: admin addprinc failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin.local -q "ktadd -k $KRB5_KTNAME $KSERVICE" > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "MIT: kadmin ktadd failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin.local -q "addprinc -randkey $KUSER" > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "MIT: kadmin addprinc failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ kadmin.local -q "ktadd -k $KRB5_CLIENT_KTNAME $KUSER" > $KDCLOG 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "MIT: kadmin ktadd failed, skipping GSSAPI tests" -+ exit 0 -+ fi -+ -+ krb5kdc -n > $KDCLOG 2>&1 & -+fi -+ -+KDCPROC=$! -+sleep 1 -+ -+kinit -kt $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ kill $KDCPROC -+ echo "SASL/GSSAPI: kinit failed, skipping GSSAPI tests" -+ exit 0 -+fi -+ -+pluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null -+RC=$? -+if test $RC != 0 ; then -+ -+ saslpluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null -+ RC=$? -+ if test $RC != 0 ; then -+ kill $KDCPROC -+ echo "cyrus-sasl has no GSSAPI support, test skipped" -+ exit 0 -+ fi -+fi -diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi -new file mode 100755 -index 000000000..64abe16fe ---- /dev/null -+++ b/tests/scripts/test077-sasl-gssapi -@@ -0,0 +1,159 @@ -+#! /bin/sh -+# $OpenLDAP$ -+## This work is part of OpenLDAP Software . -+## -+## Copyright 1998-2020 The OpenLDAP Foundation. -+## All rights reserved. -+## -+## Redistribution and use in source and binary forms, with or without -+## modification, are permitted only as authorized by the OpenLDAP -+## Public License. -+## -+## A copy of this license is available in the file LICENSE in the -+## top-level directory of the distribution or, alternatively, at -+## . -+ -+echo "running defines.sh" -+. $SRCDIR/scripts/defines.sh -+ -+if test $WITH_SASL = no ; then -+ echo "SASL support not available, test skipped" -+ exit 0 -+fi -+ -+mkdir -p $TESTDIR $DBDIR1 -+cp -r $DATADIR/tls $TESTDIR -+ -+cd $TESTWD -+ -+ -+echo "Starting KDC for SASL/GSSAPI tests..." -+. $SRCDIR/scripts/setup_kdc.sh -+ -+echo "Running slapadd to build slapd database..." -+. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1 -+$SLAPADD -f $CONF1 -l $LDIFORDERED -+RC=$? -+if test $RC != 0 ; then -+ echo "slapadd failed ($RC)!" -+ kill $KDCPROC -+ exit $RC -+fi -+ -+echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." -+$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & -+PID=$! -+if test $WAIT != 0 ; then -+ echo PID $PID -+ read foo -+fi -+KILLPIDS="$PID" -+ -+sleep 1 -+ -+for i in 0 1 2 3 4 5; do -+ $LDAPSEARCH -s base -b "" -H $URI1 \ -+ 'objectclass=*' > /dev/null 2>&1 -+ RC=$? -+ if test $RC = 0 ; then -+ break -+ fi -+ echo "Waiting 5 seconds for slapd to start..." -+ sleep 5 -+done -+ -+if test $RC != 0 ; then -+ echo "ldapsearch failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+$LDAPSEARCH -x -H $URI1 -s "base" -b "" supportedSASLMechanisms > $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapsearch failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+grep GSSAPI $TESTOUT -+RC=$? -+if test $RC != 0 ; then -+ echo "failed: GSSAPI mechanism not in supportedSASLMechanisms." -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+fi -+ -+echo -n "Using ldapwhoami with SASL/GSSAPI: " -+$LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 > $TESTOUT 2>&1 -+RC=$? -+if test $RC != 0 ; then -+ echo "ldapwhoami failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+else -+ echo "success" -+fi -+ -+echo -n "Validating mapped SASL/GSSAPI ID: " -+echo "dn:uid=$KUSER,cn=$KRB5REALM,cn=gssapi,cn=auth" > $TESTDIR/dn.out -+$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT -+RC=$? -+if test $RC != 0 ; then -+ echo "Comparison failed" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+else -+ echo "success" -+fi -+ -+if test $WITH_TLS = no ; then -+ echo "SASL/GSSAPI: TLS support not available, skipping TLS part." -+else -+ echo -n "Using ldapwhoami with SASL/GSSAPI with start-tls: " -+ $LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow \ -+ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ -+ > $TESTOUT 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "ldapwhoami failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+ else -+ echo "success" -+ fi -+ -+ echo -n "Using ldapwhoami with SASL/GSSAPI with ldaps: " -+ $LDAPSASLWHOAMI -N -Y GSSAPI -H $SURI2 -o tls_reqcert=allow \ -+ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ -+ > $TESTOUT 2>&1 -+ RC=$? -+ if test $RC != 0 ; then -+ echo "ldapwhoami failed ($RC)!" -+ kill $KDCPROC -+ test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ exit $RC -+ else -+ echo "success" -+ fi -+fi -+ -+kill $KDCPROC -+test $KILLSERVERS != no && kill -HUP $KILLPIDS -+ -+if test $RC != 0 ; then -+ echo ">>>>> Test failed" -+else -+ echo ">>>>> Test succeeded" -+ RC=0 -+fi -+ -+test $KILLSERVERS != no && wait -+ -+exit $RC --- -2.29.2 - diff --git a/openldap-fix-missing-mapping.patch b/openldap-fix-missing-mapping.patch new file mode 100644 index 0000000..dd4a7cc --- /dev/null +++ b/openldap-fix-missing-mapping.patch @@ -0,0 +1,24 @@ +From 59e013602d7b1aa0d7da79d65367c9ec391b96f8 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Wed, 3 Nov 2021 19:03:40 -0700 +Subject: [PATCH] Fix missing mapping + +--- + libraries/liblber/lber.map | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libraries/liblber/lber.map b/libraries/liblber/lber.map +index 9a4094b0f..083cd1f32 100644 +--- a/libraries/liblber/lber.map ++++ b/libraries/liblber/lber.map +@@ -121,6 +121,7 @@ OPENLDAP_2.200 + ber_sockbuf_io_fd; + ber_sockbuf_io_readahead; + ber_sockbuf_io_tcp; ++ ber_sockbuf_io_udp; + ber_sockbuf_remove_io; + ber_sos_dump; + ber_start; +-- +2.31.1 + diff --git a/openldap-manpages.patch b/openldap-manpages.patch index b69a391..df0d879 100644 --- a/openldap-manpages.patch +++ b/openldap-manpages.patch @@ -3,10 +3,10 @@ Various manual pages changes: * removes references to non-existing manpages (bz 624616) diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 -index 3def6da..466c772 100644 +index 353b075..cf37856 100644 --- a/doc/man/man1/ldapmodify.1 +++ b/doc/man/man1/ldapmodify.1 -@@ -397,8 +397,7 @@ exit status and a diagnostic message being written to standard error. +@@ -382,8 +382,7 @@ exit status and a diagnostic message being written to standard error. .BR ldap_add_ext (3), .BR ldap_delete_ext (3), .BR ldap_modify_ext (3), @@ -17,19 +17,19 @@ index 3def6da..466c772 100644 The OpenLDAP Project .SH ACKNOWLEDGEMENTS diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index cfde143..63592cb 100644 +index 17b7154..6084298 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -317,6 +317,7 @@ certificates in separate individual files. The +@@ -338,6 +338,7 @@ certificates in separate individual files. The .B TLS_CACERT is always used before .B TLS_CACERTDIR. +The specified directory must be managed with the OpenSSL c_rehash utility. - This parameter is ignored with GnuTLS. - - When using Mozilla NSS, may contain a Mozilla NSS cert/key + .TP + .B TLS_CERT + Specifies the file that contains the client certificate. diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 -index b739f4d..e2a1a00 100644 +index 8504b37..f02f1fa 100644 --- a/doc/man/man8/slapd.8 +++ b/doc/man/man8/slapd.8 @@ -5,7 +5,7 @@ @@ -39,9 +39,9 @@ index b739f4d..e2a1a00 100644 -.B LIBEXECDIR/slapd +.B slapd [\c - .BR \-4 | \-6 ] + .BR \-V [ V [ V ]] [\c -@@ -317,7 +317,7 @@ the LDAP databases defined in the default config file, just type: +@@ -332,7 +332,7 @@ the LDAP databases defined in the default config file, just type: .LP .nf .ft tt @@ -50,7 +50,7 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP -@@ -328,7 +328,7 @@ on voluminous debugging which will be printed on standard error, type: +@@ -343,7 +343,7 @@ on voluminous debugging which will be printed on standard error, type: .LP .nf .ft tt @@ -59,7 +59,7 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP -@@ -336,7 +336,7 @@ To test whether the configuration file is correct or not, type: +@@ -351,7 +351,7 @@ To test whether the configuration file is correct or not, type: .LP .nf .ft tt @@ -68,6 +68,3 @@ index b739f4d..e2a1a00 100644 .ft .fi .LP --- -1.8.1.4 - diff --git a/openldap-openssl-manpage-defaultCA.patch b/openldap-openssl-manpage-defaultCA.patch index 7ec2caa..e0c7cb7 100644 --- a/openldap-openssl-manpage-defaultCA.patch +++ b/openldap-openssl-manpage-defaultCA.patch @@ -6,9 +6,10 @@ certificates. Author: Matus Honek diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index 6084298..3070bb4 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -307,6 +307,9 @@ are more options you can specify. These options are used when an +@@ -327,6 +327,9 @@ are more options you can specify. These options are used when an .B ldaps:// URI is selected (by default or otherwise) or when the application negotiates TLS by issuing the LDAP StartTLS operation. @@ -19,9 +20,10 @@ diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 .B TLS_CACERT Specifies the file that contains certificates for all of the Certificate diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index a559b0c..adda87a 100644 --- a/doc/man/man5/slapd-config.5 +++ b/doc/man/man5/slapd-config.5 -@@ -801,6 +801,10 @@ If +@@ -878,6 +878,10 @@ If .B slapd is built with support for Transport Layer Security, there are more options you can specify. @@ -33,9 +35,10 @@ diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 .B olcTLSCipherSuite: Permits configuring what ciphers will be accepted and the preference order. diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index b6e9250..1653a1b 100644 --- a/doc/man/man5/slapd.conf.5 +++ b/doc/man/man5/slapd.conf.5 -@@ -1032,6 +1032,10 @@ If +@@ -1108,6 +1108,10 @@ If .B slapd is built with support for Transport Layer Security, there are more options you can specify. diff --git a/openldap-reentrant-gethostby.patch b/openldap-reentrant-gethostby.patch index 140b6e3..dcb3b73 100644 --- a/openldap-reentrant-gethostby.patch +++ b/openldap-reentrant-gethostby.patch @@ -8,7 +8,7 @@ Resolves: #179730 Author: Jeffery Layton diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c -index 373c81c..a012062 100644 +index aa69f70..4461bf2 100644 --- a/libraries/libldap/util-int.c +++ b/libraries/libldap/util-int.c @@ -52,8 +52,8 @@ extern int h_errno; @@ -22,7 +22,7 @@ index 373c81c..a012062 100644 #else # include -@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) +@@ -442,7 +442,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) #define BUFSTART (1024-32) #define BUFMAX (32*1024-32) diff --git a/openldap-smbk5pwd-overlay.patch b/openldap-smbk5pwd-overlay.patch index 38936cf..e5aaa57 100644 --- a/openldap-smbk5pwd-overlay.patch +++ b/openldap-smbk5pwd-overlay.patch @@ -9,7 +9,7 @@ Author: Jan Vcelak Resolves: #841560 diff --git a/contrib/slapd-modules/smbk5pwd/README b/contrib/slapd-modules/smbk5pwd/README -index f20ad94..b6433ff 100644 +index 4a710a7..0cd4e9e 100644 --- a/contrib/slapd-modules/smbk5pwd/README +++ b/contrib/slapd-modules/smbk5pwd/README @@ -1,3 +1,8 @@ @@ -22,10 +22,10 @@ index f20ad94..b6433ff 100644 PasswordModify Extended Operation to update Kerberos keys and Samba password hashes for an LDAP user. diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in -index 3af20e8..ef73663 100644 +index b84bc54..b5c3fc8 100644 --- a/servers/slapd/overlays/Makefile.in +++ b/servers/slapd/overlays/Makefile.in -@@ -33,7 +33,8 @@ SRCS = overlays.c \ +@@ -37,7 +37,8 @@ SRCS = overlays.c \ syncprov.c \ translucent.c \ unique.c \ @@ -35,7 +35,7 @@ index 3af20e8..ef73663 100644 OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ overlays.o -@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) +@@ -57,7 +58,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a @@ -44,7 +44,7 @@ index 3af20e8..ef73663 100644 XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) -@@ -125,6 +126,12 @@ unique.la : unique.lo +@@ -141,6 +142,12 @@ unique.la : unique.lo valsort.la : valsort.lo $(LTLINK_MOD) -module -o $@ valsort.lo version.lo $(LINK_LIBS) @@ -57,6 +57,3 @@ index 3af20e8..ef73663 100644 install-local: $(PROGRAMS) @if test -n "$?" ; then \ $(MKDIR) $(DESTDIR)$(moduledir); \ --- -1.7.10.4 - diff --git a/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch b/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch index ed4f2ad..0605304 100644 --- a/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch +++ b/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch @@ -6,10 +6,12 @@ Proof of concept for fixing http://bugs.debian.org/327585 (patch ported from freeradius bug http://bugs.debian.org/416266) Resolves: #960048 ---- ---- openldap/servers/slapd/module.c.orig 2010-05-18 17:42:04.000000000 +0200 -+++ openldap/servers/slapd/module.c 2010-05-18 17:45:46.000000000 +0200 -@@ -117,6 +117,20 @@ + +diff --git a/servers/slapd/module.c b/servers/slapd/module.c +index e616f1d..52bacff 100644 +--- a/servers/slapd/module.c ++++ b/servers/slapd/module.c +@@ -117,6 +117,20 @@ int module_unload( const char *file_name ) return -1; /* not found */ } @@ -30,7 +32,7 @@ Resolves: #960048 int module_load(const char* file_name, int argc, char *argv[]) { module_loaded_t *module; -@@ -180,7 +194,7 @@ +@@ -179,7 +193,7 @@ int module_load(const char* file_name, int argc, char *argv[]) * to calling Debug. This is because Debug is a macro that expands * into multiple function calls. */ diff --git a/openldap.spec b/openldap.spec index 21864dc..e4f25e2 100644 --- a/openldap.spec +++ b/openldap.spec @@ -4,13 +4,17 @@ %global check_password_version 1.1 %global so_ver 2 +%global so_ver_compat 2 + +# When you change "Version: " to the new major version, remember to change this value too +%global major_version 2.6 # Disable automatic .la file removal %global __brp_remove_la_files %nil Name: openldap -Version: 2.4.59 -Release: 6%{?dist} +Version: 2.6.1 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -20,53 +24,47 @@ Source1: slapd.service Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf -Source10: ltb-project-openldap-ppolicy-check-password-%{check_password_version}.tar.gz +Source5: UPGRADE_INSTRUCTIONS +Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions Source52: libexec-check-config.sh -Source53: libexec-upgrade-db.sh -# patches for 2.4 +# Patches for 2.6 Patch0: openldap-manpages.patch -Patch2: openldap-reentrant-gethostby.patch +Patch1: openldap-reentrant-gethostby.patch + Patch3: openldap-smbk5pwd-overlay.patch -Patch5: openldap-ai-addrconfig.patch -Patch17: openldap-allop-overlay.patch +Patch4: openldap-ai-addrconfig.patch +Patch5: openldap-allop-overlay.patch # fix back_perl problems with lt_dlopen() # might cause crashes because of symbol collisions # the proper fix is to link all perl modules against libperl # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327585 -Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch -Patch24: openldap-openssl-manpage-defaultCA.patch +Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch -# The below patches come from upstream master and are necessary for Channel Binding -# (both tls-unique and tls-server-end-point) to work properly. -# Additionally, for Samba to be able to implement Channel Binding, the PEERCERT option -# is being included as well. -Patch50: openldap-cbinding-Add-channel-binding-support.patch -Patch51: openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch -Patch52: openldap-cbinding-ITS-8573-TLS-option-test-suite.patch -Patch53: openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch -Patch54: openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch -Patch55: openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch -Patch56: openldap-cbinding-Make-prototypes-available-where-needed.patch -Patch57: openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch -Patch58: openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch -Patch59: openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch -Patch60: openldap-cbinding-Fix-slaptest-in-test077.patch -Patch61: openldap-cbinding-Convert-test077-to-LDIF-config.patch -Patch62: openldap-cbinding-Update-keys-to-RSA-4096.patch -Patch63: openldap-cbinding-ITS-9215-fix-for-glibc-again.patch -Patch64: openldap-add-tls-sni-support-to-libldap.patch +# System-wide default for CA certs +Patch7: openldap-openssl-manpage-defaultCA.patch +Patch8: openldap-fix-missing-mapping.patch # check-password module specific patches Patch90: check-password-makefile.patch Patch91: check-password.patch -BuildRequires: make -BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel -BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) +BuildRequires: cyrus-sasl-devel BuildRequires: gcc +BuildRequires: glibc-devel +BuildRequires: groff +BuildRequires: krb5-devel +BuildRequires: libtool-ltdl-devel +BuildRequires: libevent-devel +BuildRequires: make +BuildRequires: openssl-devel +BuildRequires: perl(ExtUtils::Embed) +BuildRequires: perl-devel +BuildRequires: perl-generators +BuildRequires: perl-interpreter +BuildRequires: unixODBC-devel %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -79,7 +77,8 @@ libraries, and documentation for OpenLDAP. %package devel Summary: LDAP development libraries and header files -Requires: openldap%{?_isa} = %{version}-%{release}, cyrus-sasl-devel%{?_isa} +Requires: openldap%{?_isa} = %{version}-%{release} +Requires: cyrus-sasl-devel%{?_isa} %description devel The openldap-devel package includes the development libraries and @@ -94,27 +93,33 @@ Summary: Package providing legacy non-threaded libldap Requires: openldap%{?_isa} = %{version}-%{release} # since libldap is manually linked from libldap_r, the provides is not generated automatically %ifarch armv7hl i686 -Provides: libldap-2.4.so.%{so_ver} +Provides: libldap-2.4.so.%{so_ver_compat} +Provides: libldap_r-2.4.so.%{so_ver_compat} +Provides: liblber-2.4.so.%{so_ver_compat} +Provides: libslapi-2.4.so.%{so_ver_compat} %else -Provides: libldap-2.4.so.%{so_ver}()(%{__isa_bits}bit) +Provides: libldap-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: libldap_r-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: liblber-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +Provides: libslapi-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) %endif %description compat -The openldap-compat package contains non-threaded variant of libldap -which should not be used. Instead, applications should link to libldap_r -which provides thread-safe variant with the very same API. +The openldap-compat package contains shared libraries named as libldap-2.4.so, +libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. +The libraries are just links to the current version shared libraries, +and are available for compatibility reasons. %package servers Summary: LDAP server License: OpenLDAP -Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils +Requires: openldap%{?_isa} = %{version}-%{release} Requires(pre): shadow-utils BuildRequires: systemd -%{?systemd_requires} -BuildRequires: libdb-devel BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm +%{?systemd_requires} %description servers OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access @@ -141,33 +146,14 @@ programs needed for accessing and modifying OpenLDAP directories. %setup -q -c -a 0 -a 10 pushd openldap-%{version} - %patch0 -p1 -%patch2 -p1 +%patch1 -p1 %patch3 -p1 +%patch4 -p1 %patch5 -p1 -%patch17 -p1 -%patch19 -p1 -%patch24 -p1 -%patch50 -p1 -%patch51 -p1 -%patch52 -p1 -%patch53 -p1 -%patch54 -p1 -%patch55 -p1 -%patch56 -p1 -%patch57 -p1 -%patch58 -p1 -%patch59 -p1 -%patch60 -p1 -%patch61 -p1 -%patch62 -p1 -%patch63 -p1 -%patch64 -p1 - -# The change is needed for autoconf-2.71 -sed 's@^AM_INIT_AUTOMAKE.*@AC_PROG_MAKE_SET@' -i configure.in -AUTOMAKE=%{_bindir}/true autoreconf -f -i +%patch6 -p1 +%patch7 -p1 +%patch8 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -181,13 +167,13 @@ mv servers/slapd/back-perl/README{,.back_perl} # fix documentation encoding for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do - iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" - mv "$filename.utf8" "$filename" + iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" + mv "$filename.utf8" "$filename" done popd -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +pushd openldap-ppolicy-check-password-%{check_password_version} %patch90 -p1 %patch91 -p1 popd @@ -196,12 +182,13 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS -DLDAP_USE_NON_BLOCKING_TLS -DOPENSSL_NO_MD2" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS" pushd openldap-%{version} %configure \ --enable-debug \ --enable-dynamic \ + --enable-versioning \ \ --enable-dynacl \ --enable-cleartext \ @@ -209,6 +196,7 @@ pushd openldap-%{version} --enable-lmpasswd \ --enable-spasswd \ --enable-modules \ + --enable-perl \ --enable-rewrite \ --enable-rlookups \ --enable-slapi \ @@ -221,11 +209,14 @@ pushd openldap-%{version} --enable-monitor=yes \ --disable-ndb \ --disable-sql \ + --disable-wt \ \ --enable-overlays=mod \ \ --disable-static \ \ + --enable-balancer=mod \ + \ --with-cyrus-sasl \ --without-fetch \ --with-threads \ @@ -237,7 +228,7 @@ pushd openldap-%{version} %make_build popd -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +pushd openldap-ppolicy-check-password-%{check_password_version} %make_build LDAP_INC="-I../openldap-%{version}/include \ -I../openldap-%{version}/servers/slapd \ -I../openldap-%{version}/build-servers/include" @@ -252,7 +243,7 @@ pushd openldap-%{version} popd # install check_password module -pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +pushd openldap-ppolicy-check-password-%{check_password_version} mv check_password.so check_password.so.%{check_password_version} ln -s check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/check_password.so install -m 755 check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/ @@ -285,7 +276,7 @@ mkdir -p %{buildroot}%{_tmpfilesdir} install -m 0644 %SOURCE2 %{buildroot}%{_tmpfilesdir}/slapd.conf # install default ldap.conf (customized) -rm -f %{buildroot}%{_sysconfdir}/openldap/ldap.conf +rm %{buildroot}%{_sysconfdir}/openldap/ldap.conf install -m 0644 %SOURCE4 %{buildroot}%{_sysconfdir}/openldap/ldap.conf # setup maintainance scripts @@ -293,15 +284,13 @@ mkdir -p %{buildroot}%{_libexecdir} install -m 0755 -d %{buildroot}%{_libexecdir}/openldap install -m 0644 %SOURCE50 %{buildroot}%{_libexecdir}/openldap/functions install -m 0755 %SOURCE52 %{buildroot}%{_libexecdir}/openldap/check-config.sh -install -m 0755 %SOURCE53 %{buildroot}%{_libexecdir}/openldap/upgrade-db.sh # remove build root from config files and manual pages perl -pi -e "s|%{buildroot}||g" %{buildroot}%{_sysconfdir}/openldap/*.conf perl -pi -e "s|%{buildroot}||g" %{buildroot}%{_mandir}/*/*.* # we don't need the default files -- RPM handles changes -rm -f %{buildroot}%{_sysconfdir}/openldap/*.default -rm -f %{buildroot}%{_sysconfdir}/openldap/schema/*.default +rm %{buildroot}%{_sysconfdir}/openldap/*.default # install an init script for the servers mkdir -p %{buildroot}%{_unitdir} @@ -311,90 +300,86 @@ install -m 0644 %SOURCE1 %{buildroot}%{_unitdir}/slapd.service mv %{buildroot}%{_libdir}/slapd %{buildroot}%{_sbindir}/ # setup tools as symlinks to slapd -rm -f %{buildroot}%{_sbindir}/slap{acl,add,auth,cat,dn,index,passwd,test,schema} -rm -f %{buildroot}%{_libdir}/slap{acl,add,auth,cat,dn,index,passwd,test,schema} -for X in acl add auth cat dn index passwd test schema; do ln -s slapd %{buildroot}%{_sbindir}/slap$X ; done +for X in acl add auth cat dn index modify passwd test schema ; do + rm %{buildroot}%{_sbindir}/slap$X + ln -s slapd %{buildroot}%{_sbindir}/slap$X +done # re-symlink unversioned libraries, so ldconfig is not confused pushd %{buildroot}%{_libdir} v=%{version} version=$(echo ${v%.[0-9]*}) -for lib in liblber libldap libldap_r libslapi; do - rm -f ${lib}.so - ln -s ${lib}-${version}.so.%{so_ver} ${lib}.so +for lib in liblber libldap libslapi; do + rm -f ${lib}.so + ln -s ${lib}.so.%{so_ver} ${lib}.so done -# provide only libldap_r and copy it to libldap, make a versioned lib link -rm -f libldap.so -ln -s libldap_r.so "%{buildroot}%{_libdir}/libldap.so" -rm -f libldap-*.so.* -for lib in $(ls | grep libldap_r-); do +for lib in $(ls | grep libldap); do IFS='.' read -r -a libsplit <<< "$lib" - if [ -z "${libsplit[4]}" ] + if [[ -z "${libsplit[3]}" && -n "${libsplit[2]}" ]] then - so_ver_short="${libsplit[3]}" - unset IFS - gcc -shared -o "%{buildroot}%{_libdir}/libldap-${version}.so.${so_ver_short}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libldap-${version}.so.${so_ver_short} -L "%{buildroot}%{_libdir}" -lldap_r - else - so_ver_full="${libsplit[3]}.${libsplit[4]}.${libsplit[5]}" - unset IFS + so_ver_short_2_4="%{so_ver_compat}" + elif [ -n "${libsplit[3]}" ] + then + so_ver_full_2_4="%{so_ver_compat}.${libsplit[3]}.${libsplit[4]}" fi + unset IFS done -ln -s libldap-${version}.so.{${so_ver_short},${so_ver_full}} + +# Provide only libldap and copy it to libldap_r for both 2.4 and 2.6+ versions, make a versioned lib link +# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOF) +gcc -shared -o "%{buildroot}%{_libdir}/libldap-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap +gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap +gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -llber +gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ + -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lslapi +ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s libldap_r-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s liblber-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} popd # tweak permissions on the libraries to make sure they're correct chmod 0755 %{buildroot}%{_libdir}/lib*.so* chmod 0644 %{buildroot}%{_libdir}/lib*.*a +chmod 0644 %{buildroot}%{_libdir}/openldap/*.la # slapd.conf(5) is obsoleted since 2.3, see slapd-config(5) mkdir -p %{buildroot}%{_datadir} install -m 0755 -d %{buildroot}%{_datadir}/openldap-servers install -m 0644 %SOURCE3 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif +install -m 0644 %SOURCE5 %{buildroot}%{_datadir}/openldap-servers/UPGRADE_INSTRUCTIONS install -m 0700 -d %{buildroot}%{_sysconfdir}/openldap/slapd.d -rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.conf -rm -f %{buildroot}%{_sysconfdir}/openldap/slapd.ldif +rm %{buildroot}%{_sysconfdir}/openldap/slapd.conf +rm %{buildroot}%{_sysconfdir}/openldap/slapd.ldif # move doc files out of _sysconfdir mv %{buildroot}%{_sysconfdir}/openldap/schema/README README.schema -mv %{buildroot}%{_sysconfdir}/openldap/DB_CONFIG.example %{buildroot}%{_datadir}/openldap-servers/DB_CONFIG.example -chmod 0644 %{buildroot}%{_datadir}/openldap-servers/DB_CONFIG.example # remove files which we don't want packaged -rm -f %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/openldap/ removed, yet - -rm -f %{buildroot}%{_localstatedir}/openldap-data/DB_CONFIG.example -rmdir %{buildroot}%{_localstatedir}/openldap-data +rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/openldap/ removed, yet %ldconfig_scriptlets %pre servers - # create ldap user and group getent group ldap &>/dev/null || groupadd -r -g 55 ldap getent passwd ldap &>/dev/null || \ useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap - -if [ $1 -eq 2 ]; then - # package upgrade - - old_version=$(rpm -q --qf=%%{version} openldap-servers) - new_version=%{version} - - if [ "$old_version" != "$new_version" ]; then - touch %{_sharedstatedir}/ldap/rpm_upgrade_openldap &>/dev/null - fi -fi - exit 0 - %post servers %systemd_post slapd.service +# If it's not upgrade - we remove the UPGRADE_INSTRUCTIONS +if [ $1 -lt 2 ] ; then + rm %{_datadir}/openldap-servers/UPGRADE_INSTRUCTIONS +fi # generate configuration if necessary if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ ! -f %{_sysconfdir}/openldap/slapd.conf @@ -406,26 +391,9 @@ if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ %{systemctl_bin} try-restart slapd.service &>/dev/null fi -start_slapd=0 - -# upgrade the database -if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap ]; then - if %{systemctl_bin} --quiet is-active slapd.service; then - %{systemctl_bin} stop slapd.service - start_slapd=1 - fi - - %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap -fi - # restart after upgrade if [ $1 -ge 1 ]; then - if [ $start_slapd -eq 1 ]; then - %{systemctl_bin} start slapd.service &>/dev/null || : - else - %{systemctl_bin} condrestart slapd.service &>/dev/null || : - fi + %{systemctl_bin} condrestart slapd.service &>/dev/null || : fi exit 0 @@ -436,41 +404,6 @@ exit 0 %postun servers %systemd_postun_with_restart slapd.service -%triggerin servers -- libdb - -# libdb upgrade (setup for %%triggerun) -if [ $2 -eq 2 ]; then - # we are interested in minor version changes (both versions of libdb are installed at this moment) - if [ "$(rpm -q --qf="%%{version}\n" libdb | sed 's/\.[0-9]*$//' | sort -u | wc -l)" != "1" ]; then - touch %{_sharedstatedir}/ldap/rpm_upgrade_libdb - else - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb - fi -fi - -exit 0 - - -%triggerun servers -- libdb - -# libdb upgrade (finish %%triggerin) -if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb ]; then - if %{systemctl_bin} --quiet is-active slapd.service; then - %{systemctl_bin} stop slapd.service - start=1 - else - start=0 - fi - - %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null - rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb - - [ $start -eq 1 ] && %{systemctl_bin} start slapd.service &>/dev/null -fi - -exit 0 - - %files %doc openldap-%{version}/ANNOUNCEMENT %doc openldap-%{version}/CHANGES @@ -481,9 +414,9 @@ exit 0 %dir %{_sysconfdir}/openldap/certs %config(noreplace) %{_sysconfdir}/openldap/ldap.conf %dir %{_libexecdir}/openldap/ -%{_libdir}/liblber-2.4*.so.* -%{_libdir}/libldap_r-2.4*.so.* -%{_libdir}/libslapi-2.4*.so.* +%{_libdir}/liblber*.so.* +%{_libdir}/libldap*.so.* +%{_libdir}/libslapi*.so.* %{_mandir}/man5/ldif.5* %{_mandir}/man5/ldap.conf.5* @@ -493,8 +426,7 @@ exit 0 %doc openldap-%{version}/doc/guide/admin/*.png %doc openldap-%{version}/servers/slapd/back-perl/SampleLDAP.pm %doc openldap-%{version}/servers/slapd/back-perl/README.back_perl -%doc openldap-%{version}/servers/slapd/back-perl/README.back_perl -%doc ltb-project-openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd +%doc openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd %doc README.schema %config(noreplace) %dir %attr(0750,ldap,ldap) %{_sysconfdir}/openldap/slapd.d %config(noreplace) %{_sysconfdir}/openldap/schema @@ -505,27 +437,32 @@ exit 0 %{_unitdir}/slapd.service %{_datadir}/openldap-servers/ %{_libdir}/openldap/accesslog* -%{_libdir}/openldap/auditlog* %{_libdir}/openldap/allop* +%{_libdir}/openldap/auditlog* +%{_libdir}/openldap/autoca* +%{_libdir}/openldap/back_asyncmeta* %{_libdir}/openldap/back_dnssrv* %{_libdir}/openldap/back_ldap* %{_libdir}/openldap/back_meta* %{_libdir}/openldap/back_null* %{_libdir}/openldap/back_passwd* %{_libdir}/openldap/back_relay* -%{_libdir}/openldap/back_shell* %{_libdir}/openldap/back_sock* -%{_libdir}/openldap/back_perl* +%{_libdir}/openldap/check_password* %{_libdir}/openldap/collect* %{_libdir}/openldap/constraint* %{_libdir}/openldap/dds* %{_libdir}/openldap/deref* %{_libdir}/openldap/dyngroup* %{_libdir}/openldap/dynlist* +%{_libdir}/openldap/home* +%{_libdir}/openldap/lloadd* %{_libdir}/openldap/memberof* +%{_libdir}/openldap/otp* %{_libdir}/openldap/pcache* %{_libdir}/openldap/ppolicy* %{_libdir}/openldap/refint* +%{_libdir}/openldap/remoteauth* %{_libdir}/openldap/retcode* %{_libdir}/openldap/rwm* %{_libdir}/openldap/seqmod* @@ -535,14 +472,14 @@ exit 0 %{_libdir}/openldap/translucent* %{_libdir}/openldap/unique* %{_libdir}/openldap/valsort* -%{_libdir}/openldap/check_password* %{_libexecdir}/openldap/functions %{_libexecdir}/openldap/check-config.sh -%{_libexecdir}/openldap/upgrade-db.sh %{_sbindir}/sl* %{_mandir}/man8/* +%{_mandir}/man5/lloadd.conf.5* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* +%{_mandir}/man5/slappw-argon2.5* # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf @@ -552,15 +489,42 @@ exit 0 %files devel %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc -%{_libdir}/lib*.so +%{_libdir}/liblber.so +%{_libdir}/libldap.so +%{_libdir}/libslapi.so %{_includedir}/* +%{_libdir}/pkgconfig/lber.pc +%{_libdir}/pkgconfig/ldap.pc %{_mandir}/man3/* - %files compat %{_libdir}/libldap-2.4*.so.* +%{_libdir}/libldap_r-2.4*.so.* +%{_libdir}/liblber-2.4*.so.* +%{_libdir}/libslapi-2.4*.so.* %changelog +* Mon Jan 31 2022 Simon Pichugin - 2.6.1-1 +- Update to new major release OpenLDAP 2.6.1 (#1955293) + + rediff all patches and remove patches now upstream + + use upstream source location for check password module + + and rediff patch due to this + + add patch to fix build issue in 2.5.4 (from upstream) + + clean and sort buildreqs + + remove various refs to bdb + + remove now default -DLDAP_USE_NON_BLOCKING_TLS + + add new modules and enable load balancer as module + + disable wiredtired backend due to missing build deps + + don't remove files that don't exist + + let check-config work on *.mdb over legacy files + + remove refs to old-style config + + new soname names + + remove libldap_r link as the library was merged with libldap + + refactor openldap-compat package to support the transition from 2.4 + + add UPGRADE_INSTRUCTIONS for openldap-server upgrade +- The original patch was submitted by Fedora user - terjeros + https://src.fedoraproject.org/rpms/openldap/pull-request/6 + * Mon Jan 24 2022 Timm Bäder - 2.4.59-6 - Disable automatic .la file removal - https://fedoraproject.org/wiki/Changes/RemoveLaFiles diff --git a/slapd.ldif b/slapd.ldif index a4ae4c0..e7449c1 100644 --- a/slapd.ldif +++ b/slapd.ldif @@ -42,36 +42,41 @@ cn: config # # Load dynamic backend modules: # - modulepath is architecture dependent value (32/64-bit system) -# - back_sql.la backend requires openldap-servers-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # #dn: cn=module,cn=config #objectClass: olcModuleList #cn: module -#olcModulepath: /usr/lib/openldap -#olcModulepath: /usr/lib64/openldap +#olcModulepath: /usr/lib/openldap +#olcModulepath: /usr/lib64/openldap #olcModuleload: accesslog.la +#olcModuleload: allop.la #olcModuleload: auditlog.la +#olcModuleload: autoca.la +#olcModuleload: back_asyncmeta.la #olcModuleload: back_dnssrv.la #olcModuleload: back_ldap.la -#olcModuleload: back_mdb.la #olcModuleload: back_meta.la #olcModuleload: back_null.la #olcModuleload: back_passwd.la #olcModuleload: back_relay.la -#olcModuleload: back_shell.la #olcModuleload: back_sock.la +#olcModuleload: check_password.la #olcModuleload: collect.la #olcModuleload: constraint.la #olcModuleload: dds.la #olcModuleload: deref.la #olcModuleload: dyngroup.la #olcModuleload: dynlist.la +#olcModuleload: home.la +#olcModuleload: lloadd.la #olcModuleload: memberof.la +#olcModuleload: otp.la #olcModuleload: pcache.la #olcModuleload: ppolicy.la #olcModuleload: refint.la +#olcModuleload: remoteauth.la #olcModuleload: retcode.la #olcModuleload: rwm.la #olcModuleload: seqmod.la diff --git a/slapd.service b/slapd.service index 30821fd..02fab7f 100644 --- a/slapd.service +++ b/slapd.service @@ -3,7 +3,6 @@ Description=OpenLDAP Server Daemon After=syslog.target network-online.target Documentation=man:slapd Documentation=man:slapd-config -Documentation=man:slapd-hdb Documentation=man:slapd-mdb Documentation=file:///usr/share/doc/openldap-servers/guide.html diff --git a/sources b/sources index d5dfa58..3ecf658 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ltb-project-openldap-ppolicy-check-password-1.1.tar.gz) = f3384a164ce5db488908cf6380bad8500b800b09d12a8f04e1b6ccb6f6af6ab3971fcdbe4acca7a1b6d16b408a11065c2b1ab2497863fe07d3c28262b0f6776e -SHA512 (openldap-2.4.59.tgz) = 233459ab446da6e107a7fc4ecd5668d6b08c11a11359ee76449550393e8f586a29b59d7ae09a050a1fca4fcf388ea61438ef60831b3ae802d92c048365ae3968 +SHA512 (openldap-2.6.1.tgz) = bdb961225313bc2717aabac7ba1dfcaabba7c933ab1c28959315b5e88074af0575f082c329fdfc0adde61b6b0e56315305156cee7eb879bc8e48b47cb9f5cd58 +SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc From 8bbac268180a3291995140054530b78d422b7d5a Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 2 Feb 2022 13:54:33 -0800 Subject: [PATCH 082/118] Fix twice packaged compat libraries issue Resolves: #2049085 --- openldap.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/openldap.spec b/openldap.spec index e4f25e2..20853b6 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -414,9 +414,9 @@ exit 0 %dir %{_sysconfdir}/openldap/certs %config(noreplace) %{_sysconfdir}/openldap/ldap.conf %dir %{_libexecdir}/openldap/ -%{_libdir}/liblber*.so.* -%{_libdir}/libldap*.so.* -%{_libdir}/libslapi*.so.* +%{_libdir}/liblber.so.* +%{_libdir}/libldap.so.* +%{_libdir}/libslapi.so.* %{_mandir}/man5/ldif.5* %{_mandir}/man5/ldap.conf.5* @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed Feb 2 2022 Simon Pichugin - 2.6.1-2 +- Fix twice packaged compat libraries issue (#2049085) + * Mon Jan 31 2022 Simon Pichugin - 2.6.1-1 - Update to new major release OpenLDAP 2.6.1 (#1955293) + rediff all patches and remove patches now upstream From 4552e530e832895b3482f4f38b17adbaf3b2b427 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 25 May 2022 12:01:11 -0700 Subject: [PATCH 083/118] Rebase to version 2.6.2 Resolves: #2090447 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 11a76df..10609a1 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ /openldap-2.5.7.tgz /openldap-2.5.8.tgz /openldap-2.6.1.tgz +/openldap-2.6.2.tgz diff --git a/openldap.spec b/openldap.spec index 20853b6..73f3985 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,8 +13,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.1 -Release: 2%{?dist} +Version: 2.6.2 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed May 25 2022 Simon Pichugin - 2.6.2-1 +- Rebase to version 2.6.2 (#2090447) + * Wed Feb 2 2022 Simon Pichugin - 2.6.1-2 - Fix twice packaged compat libraries issue (#2049085) diff --git a/sources b/sources index 3ecf658..109b946 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (openldap-2.6.1.tgz) = bdb961225313bc2717aabac7ba1dfcaabba7c933ab1c28959315b5e88074af0575f082c329fdfc0adde61b6b0e56315305156cee7eb879bc8e48b47cb9f5cd58 SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc +SHA512 (openldap-2.6.2.tgz) = a490a760ec954710e78821877744e8a6caa4e4f47cc292baae8106af2a4b62c16b7e8003af05ae16f58b28464d89e5459f9e4cf33241fe440c0c6ca041364420 From 105ad0992213f382e2558ebca052ddc81982c141 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Mon, 30 May 2022 20:05:08 +0200 Subject: [PATCH 084/118] Perl 5.36 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 73f3985..797b3bc 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Mon May 30 2022 Jitka Plesnikova - 2.6.2-2 +- Perl 5.36 rebuild + * Wed May 25 2022 Simon Pichugin - 2.6.2-1 - Rebase to version 2.6.2 (#2090447) From 8c62908069627b2a4b869fff5c395c89e9134297 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 27 Jun 2022 16:33:54 -0700 Subject: [PATCH 085/118] Change STRIP to STRIP_OPTS Resolves: #2101615 --- openldap.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/openldap.spec b/openldap.spec index 797b3bc..d12fa0b 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -239,7 +239,7 @@ popd mkdir -p %{buildroot}%{_libdir}/ pushd openldap-%{version} -%make_install STRIP="" +%make_install STRIP_OPTS="" popd # install check_password module @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Mon Jun 27 2022 Simon Pichugin - 2.6.2-3 +- Fix debuginfo missing issue (#2101615) + * Mon May 30 2022 Jitka Plesnikova - 2.6.2-2 - Perl 5.36 rebuild From 6986441e51316c102c8f8fcc967415996e31b55d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 02:08:50 +0000 Subject: [PATCH 086/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index d12fa0b..663b8fa 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 2.6.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Mon Jun 27 2022 Simon Pichugin - 2.6.2-3 - Fix debuginfo missing issue (#2101615) From b9ba9e58658134fc0aae332884d250ba12c309db Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 11 Aug 2022 21:09:02 -0700 Subject: [PATCH 087/118] Add export symbols related to LDAP_CONNECTIONLESS Related: rhbz#2117825 --- ...d-export-symbols-LDAP_CONNECTIONLESS.patch | 37 +++++++++++++++++++ openldap-fix-missing-mapping.patch | 24 ------------ openldap.spec | 8 +++- 3 files changed, 43 insertions(+), 26 deletions(-) create mode 100644 openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch delete mode 100644 openldap-fix-missing-mapping.patch diff --git a/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch b/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch new file mode 100644 index 0000000..0c1b3bb --- /dev/null +++ b/openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch @@ -0,0 +1,37 @@ +From 6779e56fafb0aa8ae5efa7068da34a630b51b530 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Fri, 5 Aug 2022 13:23:52 -0700 +Subject: [PATCH] Add export symbols related to LDAP_CONNECTIONLESS + +--- + libraries/liblber/lber.map | 1 + + libraries/libldap/ldap.map | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/libraries/liblber/lber.map b/libraries/liblber/lber.map +index 9a4094b0f..083cd1f32 100644 +--- a/libraries/liblber/lber.map ++++ b/libraries/liblber/lber.map +@@ -121,6 +121,7 @@ OPENLDAP_2.200 + ber_sockbuf_io_fd; + ber_sockbuf_io_readahead; + ber_sockbuf_io_tcp; ++ ber_sockbuf_io_udp; + ber_sockbuf_remove_io; + ber_sos_dump; + ber_start; +diff --git a/libraries/libldap/ldap.map b/libraries/libldap/ldap.map +index b28c9c21e..021aaba63 100644 +--- a/libraries/libldap/ldap.map ++++ b/libraries/libldap/ldap.map +@@ -200,6 +200,7 @@ OPENLDAP_2.200 + ldap_is_ldap_url; + ldap_is_ldapi_url; + ldap_is_ldaps_url; ++ ldap_is_ldapc_url; + ldap_is_read_ready; + ldap_is_write_ready; + ldap_ld_free; +-- +2.37.1 + diff --git a/openldap-fix-missing-mapping.patch b/openldap-fix-missing-mapping.patch deleted file mode 100644 index dd4a7cc..0000000 --- a/openldap-fix-missing-mapping.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 59e013602d7b1aa0d7da79d65367c9ec391b96f8 Mon Sep 17 00:00:00 2001 -From: Simon Pichugin -Date: Wed, 3 Nov 2021 19:03:40 -0700 -Subject: [PATCH] Fix missing mapping - ---- - libraries/liblber/lber.map | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libraries/liblber/lber.map b/libraries/liblber/lber.map -index 9a4094b0f..083cd1f32 100644 ---- a/libraries/liblber/lber.map -+++ b/libraries/liblber/lber.map -@@ -121,6 +121,7 @@ OPENLDAP_2.200 - ber_sockbuf_io_fd; - ber_sockbuf_io_readahead; - ber_sockbuf_io_tcp; -+ ber_sockbuf_io_udp; - ber_sockbuf_remove_io; - ber_sos_dump; - ber_start; --- -2.31.1 - diff --git a/openldap.spec b/openldap.spec index 663b8fa..7484580 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -45,7 +45,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch -Patch8: openldap-fix-missing-mapping.patch +Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -504,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Thu Aug 11 2022 Simon Pichugin - 2.6.2-5 +- Add export symbols related to LDAP_CONNECTIONLESS + Related: rhbz#2117825 + * Fri Jul 22 2022 Fedora Release Engineering - 2.6.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From c4be918d72bad7609d7235ab41da3a911a309995 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 17 Aug 2022 17:28:55 -0700 Subject: [PATCH 088/118] Rebase to version 2.6.3 Related: rhbz#2107382 --- .gitignore | 1 + openldap.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 10609a1..65b66b2 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ /openldap-2.5.8.tgz /openldap-2.6.1.tgz /openldap-2.6.2.tgz +/openldap-2.6.3.tgz diff --git a/openldap.spec b/openldap.spec index 7484580..2f1a750 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,8 +13,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.2 -Release: 5%{?dist} +Version: 2.6.3 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed Aug 17 2022 Simon Pichugin - 2.6.3-1 +- Rebase to version 2.6.3 + Related: rhbz#2107382 + * Thu Aug 11 2022 Simon Pichugin - 2.6.2-5 - Add export symbols related to LDAP_CONNECTIONLESS Related: rhbz#2117825 diff --git a/sources b/sources index 109b946..57593ff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.2.tgz) = a490a760ec954710e78821877744e8a6caa4e4f47cc292baae8106af2a4b62c16b7e8003af05ae16f58b28464d89e5459f9e4cf33241fe440c0c6ca041364420 +SHA512 (openldap-2.6.3.tgz) = 56efbbfc68779ad635d2c25228eb9c4f1553b107b96e8a438029b1c5d2f2647cf4d437770554392b436718ea44a4813e17f5195049f67fc09d063a981096cd85 From 8cdb41fb78cd0361532d32d706dfce7c613a1e8b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 22:52:16 +0000 Subject: [PATCH 089/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 2f1a750..24c3568 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 2.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Wed Aug 17 2022 Simon Pichugin - 2.6.3-1 - Rebase to version 2.6.3 Related: rhbz#2107382 From edea0c19a0f3ea22a845810dd2b6ec57547302b8 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 27 Feb 2023 18:47:38 -0800 Subject: [PATCH 090/118] Rebase to version 2.6.4 Related: rhbz#2168351 --- .gitignore | 1 + openldap.spec | 8 ++++++-- sources | 1 + 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 65b66b2..1284f15 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ /openldap-2.6.1.tgz /openldap-2.6.2.tgz /openldap-2.6.3.tgz +/openldap-2.6.4.tgz diff --git a/openldap.spec b/openldap.spec index 24c3568..29b4bdb 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,8 +13,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.3 -Release: 2%{?dist} +Version: 2.6.4 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Mon Feb 27 2023 Simon Pichugin - 2.6.4-1 +- Rebase to version 2.6.4 + Related: rhbz#2168351 + * Thu Jan 19 2023 Fedora Release Engineering - 2.6.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 57593ff..502b716 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc SHA512 (openldap-2.6.3.tgz) = 56efbbfc68779ad635d2c25228eb9c4f1553b107b96e8a438029b1c5d2f2647cf4d437770554392b436718ea44a4813e17f5195049f67fc09d063a981096cd85 +SHA512 (openldap-2.6.4.tgz) = 4be49c4866e47e96677d0e1f7caa380791917c9df8d6bb343d032aba45031c87db3bd4f6b953e914a1f40044fa68f4886ae96929a410b7188c0ed9bb75073a30 From 0e7065eaf28b6a6e208a63e655b8c22983db333e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Sat, 15 Apr 2023 19:27:26 +0200 Subject: [PATCH 091/118] Apply upstream patch to fix C99 compatibility issues Related to: --- openldap-configure-c99.patch | 906 +++++++++++++++++++++++++++++++++++ openldap.spec | 7 +- 2 files changed, 912 insertions(+), 1 deletion(-) create mode 100644 openldap-configure-c99.patch diff --git a/openldap-configure-c99.patch b/openldap-configure-c99.patch new file mode 100644 index 0000000..1a0931a --- /dev/null +++ b/openldap-configure-c99.patch @@ -0,0 +1,906 @@ +commit 14f81bc47a4c462ccc609fce74feb014185e2bf9 +Author: Sam James +Date: Thu Feb 9 23:17:53 2023 +0000 + + ITS#10011 build: fix compatibility with stricter C99 compilers + + Fix the following warnings: + - -Wimplicit-int (fatal with Clang 16) + - -Wimplicit-function-declaration (fatal with Clang 16) + - -Wincompatible-function-pointer-types (fatal with Clang 16) + - -Wint-conversion (fatal with Clang 15) + - Old style prototypes (K&R, removed from C23) + + These warnings-now-error led to misconfigurations and failure to build + OpenLDAP, as the tests used during configure caused the wrong results + to be emitted. + + For more information, see LWN.net [0] or LLVM's Discourse [1], the Gentoo wiki [2], + or the (new) c-std-porting mailing list [3]. + + [0] https://lwn.net/Articles/913505/ + [1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213 + [2] https://wiki.gentoo.org/wiki/Modern_C_porting + [3] hosted at lists.linux.dev. + + Bug: https://bugs.gentoo.org/871288 + Signed-off-by: Sam James + +diff -ur openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 openldap-2.6.4/openldap-2.6.4/build/openldap.m4 +--- openldap-2.6.4.orig/openldap-2.6.4/build/openldap.m4 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/build/openldap.m4 2023-04-15 19:21:07.377380382 +0200 +@@ -154,6 +154,7 @@ + if test $ol_cv_header_stdc = yes; then + # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. + AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -303,8 +304,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -360,9 +365,13 @@ + AC_DEFUN([OL_PTHREAD_TEST_PROGRAM], + [AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + OL_PTHREAD_TEST_FUNCTION + } +@@ -484,7 +493,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -511,7 +520,8 @@ + [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +@@ -569,7 +579,7 @@ + ]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no]) + else + AC_RUN_IFELSE([AC_LANG_SOURCE([[ +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure openldap-2.6.4/openldap-2.6.4/configure +--- openldap-2.6.4.orig/openldap-2.6.4/configure 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure 2023-04-15 19:23:17.437078213 +0200 +@@ -14978,6 +14966,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + #include ++#include + #ifndef HAVE_EBCDIC + # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') + # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) +@@ -15946,6 +15935,10 @@ + else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ ++#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif + int main(int argc, char **argv) + { + int epfd = epoll_create(256); +@@ -16126,7 +16119,7 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + +- main() { ++ int main(void) { + char buf[100]; + buf[0] = 0; + strerror_r( 1, buf, sizeof buf ); +@@ -16326,7 +16319,7 @@ + #include + #include + static char *pattern, *string; +-main() ++int main(void) + { + int rc; + regex_t re; +@@ -17559,16 +17552,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17664,8 +17665,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17744,16 +17749,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -17854,8 +17867,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -17934,16 +17951,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18044,8 +18069,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18124,16 +18153,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18234,8 +18271,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18314,16 +18355,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18424,8 +18473,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18504,16 +18557,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18615,8 +18676,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18695,16 +18760,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18805,8 +18878,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -18885,16 +18962,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -18996,8 +19081,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19076,16 +19165,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19187,8 +19284,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19267,16 +19368,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19377,8 +19486,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19457,16 +19570,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19568,8 +19689,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19648,16 +19773,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19759,8 +19892,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -19839,16 +19976,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -19949,8 +20094,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20029,16 +20178,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20139,8 +20296,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20219,16 +20380,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20330,8 +20499,12 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } +@@ -20410,16 +20583,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20631,14 +20812,12 @@ + /* end confdefs.h. */ + + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif ++pthread_t thread; + + int + main () + { +-pthread_detach(NULL); ++pthread_detach(thread); + ; + return 0; + } +@@ -20752,16 +20931,24 @@ + #define NULL (void*)0 + #endif + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + return (void *) (p == NULL); + } + + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + + /* pthread test function */ +@@ -20851,6 +21038,9 @@ + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -20861,8 +21051,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -20886,9 +21080,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + +@@ -23241,7 +23439,8 @@ + /* end confdefs.h. */ + + #include +-main() ++#include ++int main(void) + { + if ('C' == toupper('C')) + exit(0); +diff -ur openldap-2.6.4.orig/openldap-2.6.4/configure.ac openldap-2.6.4/openldap-2.6.4/configure.ac +--- openldap-2.6.4.orig/openldap-2.6.4/configure.ac 2023-02-08 19:53:35.000000000 +0100 ++++ openldap-2.6.4/openldap-2.6.4/configure.ac 2023-04-15 19:21:07.377380382 +0200 +@@ -1003,7 +1003,11 @@ + AC_CHECK_HEADERS( sys/epoll.h ) + if test "${ac_cv_header_sys_epoll_h}" = yes; then + AC_MSG_CHECKING(for epoll system call) +- AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv) ++ AC_RUN_IFELSE([AC_LANG_SOURCE([[#include ++#ifdef HAVE_SYS_POLL_H ++#include ++#endif ++int main(int argc, char **argv) + { + int epfd = epoll_create(256); + exit (epfd == -1 ? 1 : 0); +@@ -1356,10 +1360,10 @@ + dnl pthread_create() in -lpthread (many) + dnl pthread_create() in -lc_r (FreeBSD) + dnl +- dnl Check pthread (draft4) flags (depreciated) ++ dnl Check pthread (draft4) flags (deprecated) + dnl pthread_create() with -threads (OSF/1) + dnl +- dnl Check pthread (draft4) libraries (depreciated) ++ dnl Check pthread (draft4) libraries (deprecated) + dnl pthread_mutex_unlock() in -lpthreads -lmach -lexc -lc_r (OSF/1) + dnl pthread_mutex_lock() in -lpthreads -lmach -lexc (OSF/1) + dnl pthread_mutex_trylock() in -lpthreads -lexc (OSF/1) +@@ -1378,7 +1382,7 @@ + ol_link_threads=posix + ol_link_pthreads="" + fi +- ++ + dnl OL_PTHREAD_TRY([-mt], [ol_cv_pthread_mt]) + OL_PTHREAD_TRY([-kthread], [ol_cv_pthread_kthread]) + OL_PTHREAD_TRY([-pthread], [ol_cv_pthread_pthread]) +@@ -1465,10 +1469,8 @@ + dnl save the flags + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ + #include +-#ifndef NULL +-#define NULL (void*)0 +-#endif +-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) ++pthread_t thread; ++]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no]) + ]) + + if test $ol_cv_func_pthread_detach = no ; then +@@ -1523,6 +1525,9 @@ + AC_CACHE_CHECK([if select yields when using pthreads], + ol_cv_pthread_select_yields,[ + AC_RUN_IFELSE([AC_LANG_SOURCE([[ ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#include ++#include + #include + #include + #include +@@ -1533,8 +1538,12 @@ + + static int fildes[2]; + ++#ifdef __STDC__ ++static void *task(void *p) ++#else + static void *task(p) + void *p; ++#endif + { + int i; + struct timeval tv; +@@ -1558,9 +1567,13 @@ + exit(0); /* if we exit here, the select blocked the whole process */ + } + ++#ifdef __STDC__ ++int main(int argc, char **argv) ++#else + int main(argc, argv) + int argc; + char **argv; ++#endif + { + pthread_t t; + diff --git a/openldap.spec b/openldap.spec index 29b4bdb..5ffb911 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -46,6 +46,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-configure-c99.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -154,6 +155,7 @@ pushd openldap-%{version} %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p2 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -504,6 +506,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Sat Apr 15 2023 Florian Weimer - 2.6.4-2 +- Apply upstream patch to fix C99 compatibility issues + * Mon Feb 27 2023 Simon Pichugin - 2.6.4-1 - Rebase to version 2.6.4 Related: rhbz#2168351 From 14bec36c6ce93d53ae2a5223ef875488c9b94db9 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 11 Jul 2023 15:18:36 +0200 Subject: [PATCH 092/118] Perl 5.38 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 5ffb911..96bbe5e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -506,6 +506,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Tue Jul 11 2023 Jitka Plesnikova - 2.6.4-3 +- Perl 5.38 rebuild + * Sat Apr 15 2023 Florian Weimer - 2.6.4-2 - Apply upstream patch to fix C99 compatibility issues From 0ed61f2f8f4f87fe6b6d3cbadcc4da86375a7f83 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 18:06:25 +0000 Subject: [PATCH 093/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 96bbe5e..90171fc 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -506,6 +506,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 2.6.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Jul 11 2023 Jitka Plesnikova - 2.6.4-3 - Perl 5.38 rebuild From e1d14a261f2801d35fa44263f99527369566c88a Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 26 Jul 2023 19:14:16 -0700 Subject: [PATCH 094/118] Rebase to version 2.6.5 Related: rhbz#2221798 --- .gitignore | 1 + openldap.spec | 10 ++++++---- sources | 3 +-- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 1284f15..5076f63 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ /openldap-2.6.2.tgz /openldap-2.6.3.tgz /openldap-2.6.4.tgz +/openldap-2.6.5.tgz diff --git a/openldap.spec b/openldap.spec index 90171fc..368c084 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,8 +13,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.4 -Release: 4%{?dist} +Version: 2.6.5 +Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -46,7 +46,6 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch -Patch9: openldap-configure-c99.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -155,7 +154,6 @@ pushd openldap-%{version} %patch6 -p1 %patch7 -p1 %patch8 -p1 -%patch9 -p2 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -506,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed Jul 26 2023 Simon Pichugin - 2.6.5-1 +- Rebase to version 2.6.5 + Related: rhbz#2221798 + * Thu Jul 20 2023 Fedora Release Engineering - 2.6.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild diff --git a/sources b/sources index 502b716..21c997b 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.3.tgz) = 56efbbfc68779ad635d2c25228eb9c4f1553b107b96e8a438029b1c5d2f2647cf4d437770554392b436718ea44a4813e17f5195049f67fc09d063a981096cd85 -SHA512 (openldap-2.6.4.tgz) = 4be49c4866e47e96677d0e1f7caa380791917c9df8d6bb343d032aba45031c87db3bd4f6b953e914a1f40044fa68f4886ae96929a410b7188c0ed9bb75073a30 +SHA512 (openldap-2.6.5.tgz) = 1babc2950382bc7c7da687bf60b798d4eb7d5543fc9bb321636302adfefa8b86b333ba734807bebd5100b23bfa9a3d534413268e462f95441ffdc4cdd3776961 From d0559e0c05c9ff027aa6cef536b3d6ae3246a21d Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 31 Jul 2023 17:30:54 -0700 Subject: [PATCH 095/118] Rebase to version 2.6.6 Related: rhbz#2227948 --- .gitignore | 1 + openldap.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 5076f63..64d058d 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ /openldap-2.6.3.tgz /openldap-2.6.4.tgz /openldap-2.6.5.tgz +/openldap-2.6.6.tgz diff --git a/openldap.spec b/openldap.spec index 368c084..fe70816 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,7 +13,7 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.5 +Version: 2.6.6 Release: 1%{?dist} Summary: LDAP support libraries License: OpenLDAP @@ -504,6 +504,10 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Mon Jul 31 2023 Simon Pichugin - 2.6.6-1 +- Rebase to version 2.6.6 + Related: rhbz#2227948 + * Wed Jul 26 2023 Simon Pichugin - 2.6.5-1 - Rebase to version 2.6.5 Related: rhbz#2221798 diff --git a/sources b/sources index 21c997b..f38b7f6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.5.tgz) = 1babc2950382bc7c7da687bf60b798d4eb7d5543fc9bb321636302adfefa8b86b333ba734807bebd5100b23bfa9a3d534413268e462f95441ffdc4cdd3776961 +SHA512 (openldap-2.6.6.tgz) = 0e800807b23f090b465dc18c2f0d342585f96768543b3298b85d17c18272d1c5576a66326d30b3520cac493cbd2ea70e309cd923bf19447c973a63d940619fa6 From 7f901dc8a93a5431cacb9ec1a021120e50607bed Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 11:15:47 +0000 Subject: [PATCH 096/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index fe70816..a4b9206 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 2.6.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jul 31 2023 Simon Pichugin - 2.6.6-1 - Rebase to version 2.6.6 Related: rhbz#2227948 From 0625ae77c6c7b3f4cfc1bf38ecee739ec9bbc5fd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 11:23:42 +0000 Subject: [PATCH 097/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index a4b9206..ddad919 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OpenLDAP URL: http://www.openldap.org/ @@ -504,6 +504,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Thu Jan 25 2024 Fedora Release Engineering - 2.6.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 2.6.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From dae8c83930ee9ba73dd3aa2c659cd044643b9360 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 7 Feb 2024 17:11:58 -0800 Subject: [PATCH 098/118] Rebase to version 2.6.7 Use systemd-sysusers for ldap user and group Fix compiler errors Replace License with SPDX identifier Resolves: rhbz#2261163, rhbz#2173965, rhbz#2261427 --- .gitignore | 1 + openldap-explicitly-cast-private-values.patch | 70 +++++++++++++++++++ ...i-fix-plugin-plugin_pblock_new-usage.patch | 23 ++++++ openldap.spec | 44 ++++++++---- openldap.sysusers | 3 + sources | 2 +- 6 files changed, 129 insertions(+), 14 deletions(-) create mode 100644 openldap-explicitly-cast-private-values.patch create mode 100644 openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch create mode 100644 openldap.sysusers diff --git a/.gitignore b/.gitignore index 64d058d..3feae2b 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ /openldap-2.6.4.tgz /openldap-2.6.5.tgz /openldap-2.6.6.tgz +/openldap-2.6.7.tgz diff --git a/openldap-explicitly-cast-private-values.patch b/openldap-explicitly-cast-private-values.patch new file mode 100644 index 0000000..80daad6 --- /dev/null +++ b/openldap-explicitly-cast-private-values.patch @@ -0,0 +1,70 @@ +From fb9e6a81bbee880549e7ec18f0a74ddddbd2d1ab Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 6 Feb 2024 21:38:24 -0500 +Subject: [PATCH] ITS#10171 - Explicitly cast private values + +Fixes issues with -Werror=incompatible-pointer-types + +Signed-off-by: Stephen Gallagher +--- + servers/slapd/config.c | 2 +- + servers/slapd/overlays/constraint.c | 2 +- + servers/slapd/overlays/dyngroup.c | 2 +- + servers/slapd/overlays/valsort.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index 80333f359c..987c862d91 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -151,7 +151,7 @@ int config_check_vals(ConfigTable *Conf, ConfigArgs *c, int check_only ) { + int rc, arg_user, arg_type, arg_syn, iarg; + unsigned uiarg; + long larg; +- size_t ularg; ++ unsigned long ularg; + ber_len_t barg; + + if(Conf->arg_type == ARG_IGNORED) { +diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c +index f939b37762..0d6156af4d 100644 +--- a/servers/slapd/overlays/constraint.c ++++ b/servers/slapd/overlays/constraint.c +@@ -557,7 +557,7 @@ done:; + a2->restrict_filter = ap.restrict_filter; + a2->restrict_val = ap.restrict_val; + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (constraint **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_next = *app; +diff --git a/servers/slapd/overlays/dyngroup.c b/servers/slapd/overlays/dyngroup.c +index 5d890d6650..e0e70af2d9 100644 +--- a/servers/slapd/overlays/dyngroup.c ++++ b/servers/slapd/overlays/dyngroup.c +@@ -111,7 +111,7 @@ static int dgroup_cf( ConfigArgs *c ) + */ + a2 = ch_malloc( sizeof(adpair) ); + +- for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next ) ++ for ( app = (adpair **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next ) + /* Get to the end */ ; + + a2->ap_mem = ap.ap_mem; +diff --git a/servers/slapd/overlays/valsort.c b/servers/slapd/overlays/valsort.c +index 3d998e2fcb..e251500d0b 100644 +--- a/servers/slapd/overlays/valsort.c ++++ b/servers/slapd/overlays/valsort.c +@@ -201,7 +201,7 @@ valsort_cf_func(ConfigArgs *c) { + return(1); + } + +- for ( vip = &on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) ++ for ( vip = (valsort_info **)&on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next ) + /* Get to the end */ ; + + vi = ch_malloc( sizeof(valsort_info) ); +-- +GitLab + diff --git a/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch new file mode 100644 index 0000000..dda0f52 --- /dev/null +++ b/openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch @@ -0,0 +1,23 @@ +From c7a4bd27f5dcf93806972aab236001f1d4801e80 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Wed, 31 Jan 2024 16:00:30 +0000 +Subject: [PATCH] ITS#10166 slapi: fix plugin.c plugin_pblock_new() usage + +Broken in 9142da8eaf691720f7d6288954250ef085bd3da0 +--- + servers/slapd/slapi/plugin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/servers/slapd/slapi/plugin.c b/servers/slapd/slapi/plugin.c +index ca5dbead59..bfa5c10344 100644 +--- a/servers/slapd/slapi/plugin.c ++++ b/servers/slapd/slapi/plugin.c +@@ -694,7 +694,7 @@ slapi_int_read_config( + int rc; + Slapi_PBlock *pPlugin; + +- pPlugin = plugin_pblock_new( iType, numPluginArgc, c->argv ); ++ pPlugin = plugin_pblock_new( iType, numPluginArgc, c ); + if (pPlugin == NULL) { + return 1; + } diff --git a/openldap.spec b/openldap.spec index ddad919..9398229 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,10 +13,10 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.6 -Release: 3%{?dist} +Version: 2.6.7 +Release: 1%{?dist} Summary: LDAP support libraries -License: OpenLDAP +License: OLDAP-2.8 URL: http://www.openldap.org/ Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-%{version}.tgz @@ -25,6 +25,7 @@ Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf Source5: UPGRADE_INSTRUCTIONS +Source6: openldap.sysusers Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions Source52: libexec-check-config.sh @@ -46,6 +47,8 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch +Patch10: openldap-explicitly-cast-private-values.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -116,6 +119,8 @@ License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} Requires(pre): shadow-utils BuildRequires: systemd +BuildRequires: systemd-rpm-macros +%{?sysusers_requires_compat} BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -146,14 +151,16 @@ programs needed for accessing and modifying OpenLDAP directories. %setup -q -c -a 0 -a 10 pushd openldap-%{version} -%patch0 -p1 -%patch1 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 -%patch8 -p1 +%patch -P0 -p1 +%patch -P1 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 +%patch -P9 -p1 +%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -174,8 +181,8 @@ done popd pushd openldap-ppolicy-check-password-%{check_password_version} -%patch90 -p1 -%patch91 -p1 +%patch -P90 -p1 +%patch -P91 -p1 popd %build @@ -237,6 +244,7 @@ popd %install mkdir -p %{buildroot}%{_libdir}/ +install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/openldap.conf pushd openldap-%{version} %make_install STRIP_OPTS="" @@ -368,6 +376,9 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %pre servers # create ldap user and group +# sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format +%sysusers_create_compat %{SOURCE6} + getent group ldap &>/dev/null || groupadd -r -g 55 ldap getent passwd ldap &>/dev/null || \ useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap @@ -480,6 +491,7 @@ exit 0 %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* %{_mandir}/man5/slappw-argon2.5* +%{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf @@ -504,6 +516,12 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Fri Feb 9 2024 Simon Pichugin - 2.6.7-1 +- Rebase to version 2.6.7 (rhbz#2261163) +- Use systemd-sysusers for ldap user and group (rhbz#2173965) +- Fix compiler errors (rhbz#2261427) +- Replace License with SPDX identifier + * Thu Jan 25 2024 Fedora Release Engineering - 2.6.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/openldap.sysusers b/openldap.sysusers new file mode 100644 index 0000000..37ef083 --- /dev/null +++ b/openldap.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +g ldap 55 +u ldap 55:55 "OpenLDAP server" /var/lib/ldap /sbin/nologin diff --git a/sources b/sources index f38b7f6..d27ec13 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.6.tgz) = 0e800807b23f090b465dc18c2f0d342585f96768543b3298b85d17c18272d1c5576a66326d30b3520cac493cbd2ea70e309cd923bf19447c973a63d940619fa6 +SHA512 (openldap-2.6.7.tgz) = ea207b84fdb7bc6cdff2bc1201fcdde6a907f5766f9637589d956ca86ecf61d4e732ab7d80f33b18b691644e1f5fa39b00ff2c7f4084c9b85760ee693a7c451e From ab6180a2bf698bcacb39872b976f8c1ac46a75f6 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 22 May 2024 16:18:32 -0700 Subject: [PATCH 099/118] Rebase to version 2.6.8 Resolves: rhbz#2282258 --- .gitignore | 1 + openldap.spec | 10 +++++----- sources | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 3feae2b..eab66c2 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ /openldap-2.6.5.tgz /openldap-2.6.6.tgz /openldap-2.6.7.tgz +/openldap-2.6.8.tgz diff --git a/openldap.spec b/openldap.spec index 9398229..f2e3f8e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -13,7 +13,7 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.7 +Version: 2.6.8 Release: 1%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 @@ -47,8 +47,6 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch -Patch9: openldap-slapi-fix-plugin-plugin_pblock_new-usage.patch -Patch10: openldap-explicitly-cast-private-values.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -159,8 +157,6 @@ pushd openldap-%{version} %patch -P6 -p1 %patch -P7 -p1 %patch -P8 -p1 -%patch -P9 -p1 -%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -469,6 +465,7 @@ exit 0 %{_libdir}/openldap/home* %{_libdir}/openldap/lloadd* %{_libdir}/openldap/memberof* +%{_libdir}/openldap/nestgroup* %{_libdir}/openldap/otp* %{_libdir}/openldap/pcache* %{_libdir}/openldap/ppolicy* @@ -516,6 +513,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Wed May 22 2024 Simon Pichugin - 2.6.8-1 +- Rebase to version 2.6.8 (rhbz#2282258) + * Fri Feb 9 2024 Simon Pichugin - 2.6.7-1 - Rebase to version 2.6.7 (rhbz#2261163) - Use systemd-sysusers for ldap user and group (rhbz#2173965) diff --git a/sources b/sources index d27ec13..a2fd447 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.7.tgz) = ea207b84fdb7bc6cdff2bc1201fcdde6a907f5766f9637589d956ca86ecf61d4e732ab7d80f33b18b691644e1f5fa39b00ff2c7f4084c9b85760ee693a7c451e +SHA512 (openldap-2.6.8.tgz) = c86bda8a0af2645e586d56a1494a5bd486ec5dd55c47859dbabcc2bb6ddc0a8307e23c6b58228d49ee3c8bc5e4d6ead305863442efdcee3dc2ab9953097b5a77 From 4b367ea030297d67a9b2331505d45979ef2c19e3 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 11 Jun 2024 06:11:22 +0200 Subject: [PATCH 100/118] Perl 5.40 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index f2e3f8e..95c3909 100644 --- a/openldap.spec +++ b/openldap.spec @@ -14,7 +14,7 @@ Name: openldap Version: 2.6.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -513,6 +513,9 @@ exit 0 %{_libdir}/libslapi-2.4*.so.* %changelog +* Tue Jun 11 2024 Jitka Plesnikova - 2.6.8-2 +- Perl 5.40 rebuild + * Wed May 22 2024 Simon Pichugin - 2.6.8-1 - Rebase to version 2.6.8 (rhbz#2282258) From 4ca5a77fa5da246b02d92eb86bb1e5172772a0be Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 24 Jun 2024 13:47:39 -0400 Subject: [PATCH 101/118] Disable libslapi and servers in RHEL builds Based on c10s: https://gitlab.com/redhat/centos-stream/rpms/openldap/-/merge_requests/19 --- openldap.spec | 61 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 6 deletions(-) diff --git a/openldap.spec b/openldap.spec index 95c3909..7feff4d 100644 --- a/openldap.spec +++ b/openldap.spec @@ -6,6 +6,9 @@ %global so_ver 2 %global so_ver_compat 2 +# Build openldap-servers package and its libslapi in openldap-devel and openldap-compat +%bcond servers %{undefined rhel} + # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -14,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -52,6 +55,7 @@ Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch Patch90: check-password-makefile.patch Patch91: check-password.patch +BuildRequires: cracklib-devel BuildRequires: cyrus-sasl-devel BuildRequires: gcc BuildRequires: glibc-devel @@ -65,6 +69,8 @@ BuildRequires: perl(ExtUtils::Embed) BuildRequires: perl-devel BuildRequires: perl-generators BuildRequires: perl-interpreter +BuildRequires: systemd +BuildRequires: systemd-rpm-macros BuildRequires: unixODBC-devel %description @@ -97,29 +103,35 @@ Requires: openldap%{?_isa} = %{version}-%{release} Provides: libldap-2.4.so.%{so_ver_compat} Provides: libldap_r-2.4.so.%{so_ver_compat} Provides: liblber-2.4.so.%{so_ver_compat} +%if %{with servers} Provides: libslapi-2.4.so.%{so_ver_compat} +%endif %else Provides: libldap-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) Provides: libldap_r-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) Provides: liblber-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) +%if %{with servers} Provides: libslapi-2.4.so.%{so_ver_compat}()(%{__isa_bits}bit) %endif +%endif %description compat The openldap-compat package contains shared libraries named as libldap-2.4.so, +%if %{with servers} libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. +%else +libldap_r-2.4.so and liblber-2.4.so. +%endif The libraries are just links to the current version shared libraries, and are available for compatibility reasons. +%if %{with servers} %package servers Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} Requires(pre): shadow-utils -BuildRequires: systemd -BuildRequires: systemd-rpm-macros %{?sysusers_requires_compat} -BuildRequires: cracklib-devel # migrationtools (slapadd functionality): Provides: ldif2ldbm %{?systemd_requires} @@ -131,6 +143,7 @@ protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. This package contains the slapd server and related files. +%endif %package clients Summary: LDAP client utilities @@ -202,7 +215,9 @@ pushd openldap-%{version} --enable-perl \ --enable-rewrite \ --enable-rlookups \ +%if %{with servers} --enable-slapi \ +%endif --disable-slp \ \ --enable-backends=mod \ @@ -240,7 +255,9 @@ popd %install mkdir -p %{buildroot}%{_libdir}/ +%if %{with servers} install -p -D -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/openldap.conf +%endif pushd openldap-%{version} %make_install STRIP_OPTS="" @@ -313,7 +330,7 @@ done pushd %{buildroot}%{_libdir} v=%{version} version=$(echo ${v%.[0-9]*}) -for lib in liblber libldap libslapi; do +for lib in liblber libldap %{?with_servers:libslapi}; do rm -f ${lib}.so ln -s ${lib}.so.%{so_ver} ${lib}.so done @@ -339,12 +356,14 @@ gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -llber +%if %{with servers} gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lslapi +ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} +%endif ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} ln -s libldap_r-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} ln -s liblber-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} -ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} popd @@ -370,6 +389,8 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %ldconfig_scriptlets +%if %{with servers} + %pre servers # create ldap user and group # sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format @@ -411,6 +432,8 @@ exit 0 %postun servers %systemd_postun_with_restart slapd.service +%endif + %files %doc openldap-%{version}/ANNOUNCEMENT %doc openldap-%{version}/CHANGES @@ -423,10 +446,13 @@ exit 0 %dir %{_libexecdir}/openldap/ %{_libdir}/liblber.so.* %{_libdir}/libldap.so.* +%if %{with servers} %{_libdir}/libslapi.so.* +%endif %{_mandir}/man5/ldif.5* %{_mandir}/man5/ldap.conf.5* +%if %{with servers} %files servers %doc openldap-%{version}/contrib/slapd-modules/smbk5pwd/README.smbk5pwd %doc openldap-%{version}/doc/guide/admin/*.html @@ -491,6 +517,22 @@ exit 0 %{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf +%else +%exclude %{_datadir}/openldap-servers/ +%exclude %{_libdir}/openldap/ +%exclude %{_libexecdir}/openldap/check-config.sh +%exclude %{_libexecdir}/openldap/functions +%exclude %{_mandir}/man5/slapd*.5* +%exclude %{_mandir}/man5/slapo-*.5* +%exclude %{_mandir}/man5/lloadd.conf.5* +%exclude %{_mandir}/man5/slappw-argon2.5* +%exclude %{_mandir}/man8/* +%exclude %{_sbindir}/sl* +%exclude %{_sysconfdir}/openldap/check_password.conf +%exclude %{_sysconfdir}/openldap/schema +%exclude %{_tmpfilesdir}/slapd.conf +%exclude %{_unitdir}/slapd.service +%endif %files clients %{_bindir}/* @@ -500,7 +542,9 @@ exit 0 %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc %{_libdir}/liblber.so %{_libdir}/libldap.so +%if %{with servers} %{_libdir}/libslapi.so +%endif %{_includedir}/* %{_libdir}/pkgconfig/lber.pc %{_libdir}/pkgconfig/ldap.pc @@ -510,9 +554,14 @@ exit 0 %{_libdir}/libldap-2.4*.so.* %{_libdir}/libldap_r-2.4*.so.* %{_libdir}/liblber-2.4*.so.* +%if %{with servers} %{_libdir}/libslapi-2.4*.so.* +%endif %changelog +* Mon Jun 24 2024 Yaakov Selkowitz - 2.6.8-3 +- Disable libslapi and servers in RHEL builds + * Tue Jun 11 2024 Jitka Plesnikova - 2.6.8-2 - Perl 5.40 rebuild From 1f131f51e61c306c75a9cd07cee9239cb45d813e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 20:54:33 +0000 Subject: [PATCH 102/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 7feff4d..c3ed74e 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -559,6 +559,9 @@ exit 0 %endif %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 2.6.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Mon Jun 24 2024 Yaakov Selkowitz - 2.6.8-3 - Disable libslapi and servers in RHEL builds From 126d88e16b0e194111a70571223f392ad0d197f5 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 17 Jul 2024 11:02:43 -0700 Subject: [PATCH 103/118] Clean up spec file so it's aligned with c10s Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade Resolves: rhbz#2133526 --- libexec-check-config.sh | 12 ----------- openldap.spec | 47 ++++++++++++++++++----------------------- 2 files changed, 21 insertions(+), 38 deletions(-) diff --git a/libexec-check-config.sh b/libexec-check-config.sh index de6f3a8..16f43ea 100755 --- a/libexec-check-config.sh +++ b/libexec-check-config.sh @@ -52,16 +52,6 @@ function check_db_perms() return $retcode } -function check_major_upgrade() -{ - retcode=0 - if [ -f "/usr/share/openldap-servers/UPGRADE_INSTRUCTIONS" ]; then - error "You have upgraded your openldap-servers package. There are actions that need to be performed. Please, read the /usr/share/openldap-servers/UPGRADE_INSTRUCTIONS file" - retcode=1 - fi - return $retcode -} - function check_everything() { retcode=0 @@ -76,8 +66,6 @@ if [ `id -u` -ne 0 ]; then exit 4 fi -check_major_upgrade || return 1 - load_sysconfig if [ -n "$SLAPD_CONFIG_DIR" ]; then diff --git a/openldap.spec b/openldap.spec index c3ed74e..a8c3b02 100644 --- a/openldap.spec +++ b/openldap.spec @@ -7,7 +7,7 @@ %global so_ver_compat 2 # Build openldap-servers package and its libslapi in openldap-devel and openldap-compat -%bcond servers %{undefined rhel} +%bcond servers 1 # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -27,7 +27,6 @@ Source1: slapd.service Source2: slapd.tmpfiles Source3: slapd.ldif Source4: ldap.conf -Source5: UPGRADE_INSTRUCTIONS Source6: openldap.sysusers Source10: https://github.com/ltb-project/openldap-ppolicy-check-password/archive/v%{check_password_version}/openldap-ppolicy-check-password-%{check_password_version}.tar.gz Source50: libexec-functions @@ -55,7 +54,6 @@ Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch Patch90: check-password-makefile.patch Patch91: check-password.patch -BuildRequires: cracklib-devel BuildRequires: cyrus-sasl-devel BuildRequires: gcc BuildRequires: glibc-devel @@ -69,9 +67,11 @@ BuildRequires: perl(ExtUtils::Embed) BuildRequires: perl-devel BuildRequires: perl-generators BuildRequires: perl-interpreter +BuildRequires: unixODBC-devel +BuildRequires: cracklib-devel BuildRequires: systemd BuildRequires: systemd-rpm-macros -BuildRequires: unixODBC-devel +%{?sysusers_requires_compat} %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -120,7 +120,7 @@ The openldap-compat package contains shared libraries named as libldap-2.4.so, %if %{with servers} libldap_r-2.4.so, liblber-2.4.so and libslapi-2.4.so. %else -libldap_r-2.4.so and liblber-2.4.so. +libldap_r-2.4.so and liblber-2.4.so %endif The libraries are just links to the current version shared libraries, and are available for compatibility reasons. @@ -130,11 +130,10 @@ and are available for compatibility reasons. Summary: LDAP server License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} +%{?systemd_requires} Requires(pre): shadow-utils -%{?sysusers_requires_compat} # migrationtools (slapadd functionality): Provides: ldif2ldbm -%{?systemd_requires} %description servers OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access @@ -143,6 +142,7 @@ protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. This package contains the slapd server and related files. +# endif servers %endif %package clients @@ -198,7 +198,7 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) -export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS" +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS" pushd openldap-%{version} %configure \ @@ -349,16 +349,16 @@ for lib in $(ls | grep libldap); do done # Provide only libldap and copy it to libldap_r for both 2.4 and 2.6+ versions, make a versioned lib link -# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOF) +# We increase it by 2 because libldap-2.4 has the 'so.2' major version on 2.4.59 (one of the last versions which is EOL) gcc -shared -o "%{buildroot}%{_libdir}/libldap-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap + -Wl,-soname -Wl,libldap-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap gcc -shared -o "%{buildroot}%{_libdir}/libldap_r-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lldap + -Wl,-soname -Wl,libldap_r-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lldap gcc -shared -o "%{buildroot}%{_libdir}/liblber-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -llber + -Wl,-soname -Wl,liblber-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -llber %if %{with servers} gcc -shared -o "%{buildroot}%{_libdir}/libslapi-2.4.so.${so_ver_short_2_4}" -Wl,--no-as-needed \ - -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -lslapi + -Wl,-soname -Wl,libslapi-2.4.so.${so_ver_short_2_4} -L "%{buildroot}%{_libdir}" -Wl,-z,now -lslapi ln -s libslapi-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} %endif ln -s libldap-2.4.so.{${so_ver_short_2_4},${so_ver_full_2_4}} @@ -376,7 +376,6 @@ chmod 0644 %{buildroot}%{_libdir}/openldap/*.la mkdir -p %{buildroot}%{_datadir} install -m 0755 -d %{buildroot}%{_datadir}/openldap-servers install -m 0644 %SOURCE3 %{buildroot}%{_datadir}/openldap-servers/slapd.ldif -install -m 0644 %SOURCE5 %{buildroot}%{_datadir}/openldap-servers/UPGRADE_INSTRUCTIONS install -m 0700 -d %{buildroot}%{_sysconfdir}/openldap/slapd.d rm %{buildroot}%{_sysconfdir}/openldap/slapd.conf rm %{buildroot}%{_sysconfdir}/openldap/slapd.ldif @@ -390,24 +389,14 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %ldconfig_scriptlets %if %{with servers} - %pre servers # create ldap user and group # sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format %sysusers_create_compat %{SOURCE6} -getent group ldap &>/dev/null || groupadd -r -g 55 ldap -getent passwd ldap &>/dev/null || \ - useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap -exit 0 - %post servers %systemd_post slapd.service -# If it's not upgrade - we remove the UPGRADE_INSTRUCTIONS -if [ $1 -lt 2 ] ; then - rm %{_datadir}/openldap-servers/UPGRADE_INSTRUCTIONS -fi # generate configuration if necessary if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ ! -f %{_sysconfdir}/openldap/slapd.conf @@ -431,8 +420,8 @@ exit 0 %postun servers %systemd_postun_with_restart slapd.service - %endif +# endif servers %files %doc openldap-%{version}/ANNOUNCEMENT @@ -533,6 +522,8 @@ exit 0 %exclude %{_tmpfilesdir}/slapd.conf %exclude %{_unitdir}/slapd.service %endif +# endif servers + %files clients %{_bindir}/* @@ -559,6 +550,10 @@ exit 0 %endif %changelog +* Tue Jul 23 2024 Simon Pichugin - 2.6.8-5 +- Clean up spec file so it's aligned with c10s +- Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526) + * Thu Jul 18 2024 Fedora Release Engineering - 2.6.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 02f7821806558079ae326bbdd786838befe277b5 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Wed, 27 Nov 2024 16:41:40 -0800 Subject: [PATCH 104/118] Avoid SSL context cleanup during library destruction --- ...L-context-cleanup-during-library-des.patch | 92 +++++++++++++++++++ openldap.spec | 7 +- 2 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch diff --git a/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch new file mode 100644 index 0000000..3663f3f --- /dev/null +++ b/openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch @@ -0,0 +1,92 @@ +From 5f4569f0605a73eb1a282ee5251ead073ed3b26e Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Tue, 26 Nov 2024 12:32:07 -0800 +Subject: [PATCH] libldap: avoid SSL context cleanup during library destruction + +Given that libldap can be pulled into random applications and applications +are allowed to call OPENSSL_cleanup() before exiting, the only sane thing +to do is to avoid trying to touch SSL context in ldap destructors, and just +let them leak if the application does not explicitly free the ldap context. + +Add ldap_int_tls_destroy_safe() which skips SSL context cleanup while +maintaining all other cleanup operations, and use it in the library +destructor path. + +Fixes: https://bugs.openldap.org/show_bug.cgi?id=9952 +--- + libraries/libldap/init.c | 2 +- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/tls2.c | 25 +++++++++++++++++++++---- + 3 files changed, 23 insertions(+), 5 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..aa017f4128 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -545,7 +545,7 @@ ldap_int_destroy_global_options(void) + } + #endif + #ifdef HAVE_TLS +- ldap_int_tls_destroy( gopts ); ++ ldap_int_tls_destroy_safe( gopts ); + #endif + } + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..b73097ccc7 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -914,6 +914,7 @@ LDAP_F (int) ldap_int_tls_start LDAP_P(( LDAP *ld, + LDAPConn *conn, LDAPURLDesc *srv )); + + LDAP_F (void) ldap_int_tls_destroy LDAP_P(( struct ldapoptions *lo )); ++LDAP_F (void) ldap_int_tls_destroy_safe LDAP_P(( struct ldapoptions *lo )); + + /* + * in getvalues.c +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 0841005a59..82f8573602 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -97,10 +97,14 @@ tls_ctx_ref( tls_ctx *ctx ) + static ldap_pvt_thread_mutex_t tls_def_ctx_mutex; + #endif + +-void +-ldap_int_tls_destroy( struct ldapoptions *lo ) +-{ +- if ( lo->ldo_tls_ctx ) { ++/* ++ * Implementation function that handles all cleanup. ++ * skip_ctx_cleanup: 1 when called from destructor, 0 for normal operation ++ */ ++static void ++ldap_int_tls_destroy_impl( struct ldapoptions *lo, int skip_ctx_cleanup ) ++ { ++ if ( lo->ldo_tls_ctx && !skip_ctx_cleanup ) { + ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx ); + lo->ldo_tls_ctx = NULL; + } +@@ -147,6 +151,19 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) + BER_BVZERO( &lo->ldo_tls_pin ); + } + ++ ++void ++ldap_int_tls_destroy( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 0); ++} ++ ++/* Safe version for destructor use */ ++void ldap_int_tls_destroy_safe( struct ldapoptions *lo ) ++{ ++ ldap_int_tls_destroy_impl(lo, 1); ++} ++ + /* + * Tear down the TLS subsystem. Should only be called once. + */ +-- +2.47.0 + diff --git a/openldap.spec b/openldap.spec index a8c3b02..9da5369 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.8 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -49,6 +49,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch # System-wide default for CA certs Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch +Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -170,6 +171,7 @@ pushd openldap-%{version} %patch -P6 -p1 %patch -P7 -p1 %patch -P8 -p1 +%patch -P9 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -550,6 +552,9 @@ exit 0 %endif %changelog +* Tue Dec 3 2024 Simon Pichugin - 2.6.8-6 +- Avoid SSL context cleanup during library destruction + * Tue Jul 23 2024 Simon Pichugin - 2.6.8-5 - Clean up spec file so it's aligned with c10s - Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526) From eb3554276019edf9fc22f57e6b4d6984443db3a6 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 9 Jan 2025 19:35:57 -0800 Subject: [PATCH 105/118] Rebase to version 2.6.9 Resolves: rhbz#2329002 --- .gitignore | 1 + openldap.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index eab66c2..400752c 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ /openldap-2.6.6.tgz /openldap-2.6.7.tgz /openldap-2.6.8.tgz +/openldap-2.6.9.tgz diff --git a/openldap.spec b/openldap.spec index 9da5369..e1506b8 100644 --- a/openldap.spec +++ b/openldap.spec @@ -16,8 +16,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.8 -Release: 6%{?dist} +Version: 2.6.9 +Release: 1%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -552,6 +552,9 @@ exit 0 %endif %changelog +* Thu Jan 9 2025 Simon Pichugin - 2.6.9-1 +- Rebase to version 2.6.9 (rhbz#2329002) + * Tue Dec 3 2024 Simon Pichugin - 2.6.8-6 - Avoid SSL context cleanup during library destruction diff --git a/sources b/sources index a2fd447..51594b5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.8.tgz) = c86bda8a0af2645e586d56a1494a5bd486ec5dd55c47859dbabcc2bb6ddc0a8307e23c6b58228d49ee3c8bc5e4d6ead305863442efdcee3dc2ab9953097b5a77 +SHA512 (openldap-2.6.9.tgz) = d3f839d3cf1030caa410e54f968e9c0caf3bc371c06ea0f64cf3a6ece6d31013c9dbfb08a3a63ea9137a2062aa6edc6e0bc542b365fe4ad66608df4cdbe94a4e From d9bd47979f15efb53dc317d5eb358c830d413e79 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 16 Jan 2025 15:46:54 -0800 Subject: [PATCH 106/118] Disable MD2 hash algorithm Resolves: rhbz#2338556 --- openldap.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index e1506b8..275c5f9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -201,6 +201,8 @@ popd %set_build_flags # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS" +# disable legacy hash algorithm +export CFLAGS="${CFLAGS} -DOPENSSL_NO_MD2" pushd openldap-%{version} %configure \ @@ -552,6 +554,9 @@ exit 0 %endif %changelog +* Thu Jan 16 2025 Simon Pichugin - 2.6.9-2 +- Disable MD2 hash algorithm (rhbz#2338556) + * Thu Jan 9 2025 Simon Pichugin - 2.6.9-1 - Rebase to version 2.6.9 (rhbz#2329002) From 5aabe4c7d9c94c706ae5e9cae71c07f37478ad68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 24 Jan 2025 06:53:11 +0000 Subject: [PATCH 107/118] Remove license of subpackage This license is not in SPDX format. But the license is the same as the main package and when the subpackage does not specify a license then the license is inherited from the main package. --- openldap.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 275c5f9..decc8f7 100644 --- a/openldap.spec +++ b/openldap.spec @@ -129,7 +129,6 @@ and are available for compatibility reasons. %if %{with servers} %package servers Summary: LDAP server -License: OpenLDAP Requires: openldap%{?_isa} = %{version}-%{release} %{?systemd_requires} Requires(pre): shadow-utils From 7fec13e914c2ee79a16818be9c416f81a235fbcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 24 Jan 2025 14:13:23 +0100 Subject: [PATCH 108/118] Adjust file patterns for the sbin merge %{_sbindir}/* and %{_bindir}/* are now the same, so both subpackages would have the same set of binaries. Switch to narrower globs to avoid inadvertent matches. --- openldap.spec | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/openldap.spec b/openldap.spec index decc8f7..97ac50c 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -500,12 +500,13 @@ exit 0 %{_libdir}/openldap/valsort* %{_libexecdir}/openldap/functions %{_libexecdir}/openldap/check-config.sh -%{_sbindir}/sl* -%{_mandir}/man8/* +%{_sbindir}/slap* %{_mandir}/man5/lloadd.conf.5* +%{_mandir}/man8/lloadd.8* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* %{_mandir}/man5/slappw-argon2.5* +%{_mandir}/man8/slap*.8* %{_sysusersdir}/openldap.conf # obsolete configuration %ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf @@ -519,7 +520,7 @@ exit 0 %exclude %{_mandir}/man5/lloadd.conf.5* %exclude %{_mandir}/man5/slappw-argon2.5* %exclude %{_mandir}/man8/* -%exclude %{_sbindir}/sl* +%exclude %{_sbindir}/slap* %exclude %{_sysconfdir}/openldap/check_password.conf %exclude %{_sysconfdir}/openldap/schema %exclude %{_tmpfilesdir}/slapd.conf @@ -529,8 +530,8 @@ exit 0 %files clients -%{_bindir}/* -%{_mandir}/man1/* +%{_bindir}/ldap* +%{_mandir}/man1/ldap*.1* %files devel %doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc @@ -553,6 +554,9 @@ exit 0 %endif %changelog +* Fri Jan 24 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-3 +- Adjust file patterns for the sbin merge + * Thu Jan 16 2025 Simon Pichugin - 2.6.9-2 - Disable MD2 hash algorithm (rhbz#2338556) From e9b2e83facf02f5dbe1d54c98b5ad4a9f533a85c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:12 +0100 Subject: [PATCH 109/118] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- openldap.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 97ac50c..60c7adc 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -62,6 +62,7 @@ BuildRequires: groff BuildRequires: krb5-devel BuildRequires: libtool-ltdl-devel BuildRequires: libevent-devel +BuildRequires: libxcrypt-devel BuildRequires: make BuildRequires: openssl-devel BuildRequires: perl(ExtUtils::Embed) @@ -554,6 +555,9 @@ exit 0 %endif %changelog +* Sat Feb 01 2025 Björn Esser - 2.6.9-4 +- Add explicit BR: libxcrypt-devel + * Fri Jan 24 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-3 - Adjust file patterns for the sbin merge From 4335fd47456672761b3c0ca48e52a61a67d50051 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 17:44:44 +0100 Subject: [PATCH 110/118] Drop call to %sysusers_create_compat After https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers, rpm will handle account creation automatically. --- openldap.spec | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/openldap.spec b/openldap.spec index 60c7adc..a137974 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.9 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -73,7 +73,6 @@ BuildRequires: unixODBC-devel BuildRequires: cracklib-devel BuildRequires: systemd BuildRequires: systemd-rpm-macros -%{?sysusers_requires_compat} %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -132,7 +131,6 @@ and are available for compatibility reasons. Summary: LDAP server Requires: openldap%{?_isa} = %{version}-%{release} %{?systemd_requires} -Requires(pre): shadow-utils # migrationtools (slapadd functionality): Provides: ldif2ldbm @@ -393,10 +391,6 @@ rm %{buildroot}%{_libdir}/*.la # because we do not want files in %{_libdir}/ope %ldconfig_scriptlets %if %{with servers} -%pre servers -# create ldap user and group -# sysusers.d format https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format -%sysusers_create_compat %{SOURCE6} %post servers %systemd_post slapd.service @@ -555,6 +549,9 @@ exit 0 %endif %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-5 +- Drop call to %sysusers_create_compat + * Sat Feb 01 2025 Björn Esser - 2.6.9-4 - Add explicit BR: libxcrypt-devel From 51354adeb8958afd5039e8f6b4a2ea83c04b6769 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Tue, 10 Jun 2025 15:35:12 -0700 Subject: [PATCH 111/118] Rebase to version 2.6.10 Resolves: rhbz#2368103 --- .gitignore | 1 + openldap-manpages.patch | 31 ++++++++----------------------- openldap.spec | 7 +++++-- sources | 2 +- 4 files changed, 15 insertions(+), 26 deletions(-) diff --git a/.gitignore b/.gitignore index 400752c..50fa4b0 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ /openldap-2.6.7.tgz /openldap-2.6.8.tgz /openldap-2.6.9.tgz +/openldap-2.6.10.tgz diff --git a/openldap-manpages.patch b/openldap-manpages.patch index df0d879..2303570 100644 --- a/openldap-manpages.patch +++ b/openldap-manpages.patch @@ -1,35 +1,20 @@ Various manual pages changes: * removes LIBEXECDIR from slapd.8 -* removes references to non-existing manpages (bz 624616) -diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 -index 353b075..cf37856 100644 ---- a/doc/man/man1/ldapmodify.1 -+++ b/doc/man/man1/ldapmodify.1 -@@ -382,8 +382,7 @@ exit status and a diagnostic message being written to standard error. - .BR ldap_add_ext (3), - .BR ldap_delete_ext (3), - .BR ldap_modify_ext (3), --.BR ldap_modrdn_ext (3), --.BR ldif (5). -+.BR ldif (5) - .SH AUTHOR - The OpenLDAP Project - .SH ACKNOWLEDGEMENTS diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 -index 17b7154..6084298 100644 +index d47481d6ed..ff86fc52ca 100644 --- a/doc/man/man5/ldap.conf.5 +++ b/doc/man/man5/ldap.conf.5 -@@ -338,6 +338,7 @@ certificates in separate individual files. The +@@ -341,6 +341,7 @@ be specified, separated by a semi-colon. The .B TLS_CACERT is always used before - .B TLS_CACERTDIR. + .BR TLS_CACERTDIR . +The specified directory must be managed with the OpenSSL c_rehash utility. .TP .B TLS_CERT Specifies the file that contains the client certificate. diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 -index 8504b37..f02f1fa 100644 +index 807634e52d..a06110687b 100644 --- a/doc/man/man8/slapd.8 +++ b/doc/man/man8/slapd.8 @@ -5,7 +5,7 @@ @@ -41,16 +26,16 @@ index 8504b37..f02f1fa 100644 [\c .BR \-V [ V [ V ]] [\c -@@ -332,7 +332,7 @@ the LDAP databases defined in the default config file, just type: +@@ -333,7 +333,7 @@ the LDAP databases defined in the default config file, just type: .LP .nf .ft tt - LIBEXECDIR/slapd -+ slapd ++ slapd .ft .fi .LP -@@ -343,7 +343,7 @@ on voluminous debugging which will be printed on standard error, type: +@@ -344,7 +344,7 @@ on voluminous debugging which will be printed on standard error, type: .LP .nf .ft tt @@ -59,7 +44,7 @@ index 8504b37..f02f1fa 100644 .ft .fi .LP -@@ -351,7 +351,7 @@ To test whether the configuration file is correct or not, type: +@@ -352,7 +352,7 @@ To test whether the configuration file is correct or not, type: .LP .nf .ft tt diff --git a/openldap.spec b/openldap.spec index a137974..6ca9d24 100644 --- a/openldap.spec +++ b/openldap.spec @@ -16,8 +16,8 @@ %global __brp_remove_la_files %nil Name: openldap -Version: 2.6.9 -Release: 5%{?dist} +Version: 2.6.10 +Release: 1%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -549,6 +549,9 @@ exit 0 %endif %changelog +* Tue Jun 10 2025 Simon Pichugin - 2.6.10-1 +- Rebase to version 2.6.10 (rhbz#2368103) + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.6.9-5 - Drop call to %sysusers_create_compat diff --git a/sources b/sources index 51594b5..0b0bd67 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc -SHA512 (openldap-2.6.9.tgz) = d3f839d3cf1030caa410e54f968e9c0caf3bc371c06ea0f64cf3a6ece6d31013c9dbfb08a3a63ea9137a2062aa6edc6e0bc542b365fe4ad66608df4cdbe94a4e +SHA512 (openldap-2.6.10.tgz) = 18129ad9a385457941e3203de5f130fe2571701abf24592c5beffb01361aae3182c196b2cd48ffeecb792b9b0e5f82c8d92445a7ec63819084757bdedba63b20 From 0b7f700e16e76c6e8ddcf68e4575ccbcd4daa578 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Mon, 7 Jul 2025 16:19:49 +0200 Subject: [PATCH 112/118] Perl 5.42 rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 6ca9d24..56bbbd9 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.10 -Release: 1%{?dist} +Release: 2%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -549,6 +549,9 @@ exit 0 %endif %changelog +* Mon Jul 07 2025 Jitka Plesnikova - 2.6.10-2 +- Perl 5.42 rebuild + * Tue Jun 10 2025 Simon Pichugin - 2.6.10-1 - Rebase to version 2.6.10 (rhbz#2368103) From 529c3466fbfdf965e83ec949813e59faff45b368 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 23:37:09 +0000 Subject: [PATCH 113/118] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- openldap.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 56bbbd9..6fa90d4 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.10 -Release: 2%{?dist} +Release: 3%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -549,6 +549,9 @@ exit 0 %endif %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 2.6.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Jul 07 2025 Jitka Plesnikova - 2.6.10-2 - Perl 5.42 rebuild From b6036115c7fbb03d78675c42f2a252672f99e1bd Mon Sep 17 00:00:00 2001 From: Viktor Ashirov Date: Thu, 28 Aug 2025 13:23:00 +0200 Subject: [PATCH 114/118] Convert STI tests to FMF Resolves: rhbz#2382998 openldap: STI tests will no longer be run in F43 --- .fmf/version | 1 + plans/gating.fmf | 8 +++++++ tests/smoke-test/Makefile | 24 +++++++++---------- tests/smoke-test/main.fmf | 31 ++++++++++++++++++++++++ tests/smoke-test/runtest.sh | 48 +++++++++++++------------------------ tests/tests.yml | 34 -------------------------- 6 files changed, 68 insertions(+), 78 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/gating.fmf create mode 100644 tests/smoke-test/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/gating.fmf b/plans/gating.fmf new file mode 100644 index 0000000..387b7bf --- /dev/null +++ b/plans/gating.fmf @@ -0,0 +1,8 @@ +summary: Test plan for openldap + +discover: + how: fmf + +execute: + how: tmt + diff --git a/tests/smoke-test/Makefile b/tests/smoke-test/Makefile index 5a549be..322f5a5 100644 --- a/tests/smoke-test/Makefile +++ b/tests/smoke-test/Makefile @@ -46,7 +46,7 @@ clean: include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile - @echo "Owner: Ondrej Moris " > $(METADATA) + @echo "Owner: Viktor Ashirov " > $(METADATA) @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) @@ -57,25 +57,23 @@ $(METADATA): Makefile @echo "Requires: openldap" >> $(METADATA) @echo "Requires: openldap-clients" >> $(METADATA) @echo "Requires: openldap-servers" >> $(METADATA) + @echo "Requires: nss-devel" >> $(METADATA) + @echo "Requires: cracklib-devel" >> $(METADATA) @echo "Requires: cyrus-sasl-devel" >> $(METADATA) @echo "Requires: gdbm-devel" >> $(METADATA) - @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: groff" >> $(METADATA) @echo "Requires: krb5-devel" >> $(METADATA) + @echo "Requires: libdb-devel" >> $(METADATA) + @echo "Requires: libtool" >> $(METADATA) + @echo "Requires: libtool-ltdl-devel" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) @echo "Requires: openssl-devel" >> $(METADATA) @echo "Requires: pam-devel" >> $(METADATA) @echo "Requires: perl" >> $(METADATA) - @echo "Requires: pkgconfig" >> $(METADATA) - @echo "Requires: tcp_wrappers-devel" >> $(METADATA) - @echo "Requires: bind-libbind-devel" >> $(METADATA) - @echo "Requires: unixODBC-devel" >> $(METADATA) - @echo "Requires: libtool-ltdl-devel" >> $(METADATA) - @echo "Requires: nfs-utils" >> $(METADATA) - @echo "Requires: rpm-build" >> $(METADATA) - @echo "Requires: nss-devel" >> $(METADATA) - @echo "Requires: libdb-devel" >> $(METADATA) - @echo "Requires: groff" >> $(METADATA) - @echo "Requires: cracklib-devel" >> $(METADATA) @echo "Requires: perl-ExtUtils-Embed" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Requires: rpm-build" >> $(METADATA) + @echo "Requires: unixODBC-devel" >> $(METADATA) @echo "Requires: yum-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/tests/smoke-test/main.fmf b/tests/smoke-test/main.fmf new file mode 100644 index 0000000..cc59f6b --- /dev/null +++ b/tests/smoke-test/main.fmf @@ -0,0 +1,31 @@ +summary: Test calls upstream test suite +description: Test calls upstream test suite +contact: Viktor Ashirov +component: + - openldap +test: ./runtest.sh +framework: beakerlib +recommend: + - openldap + - openldap-clients + - openldap-servers + - cracklib-devel + - cyrus-sasl-devel + - gdbm-devel + - groff + - krb5-devel + - libdb-devel + - libtool + - libtool-ltdl-devel + - nfs-utils + - nss-devel + - openssl-devel + - pam-devel + - perl + - perl-ExtUtils-Embed + - pkgconf-pkg-config + - pkgconfig + - rpm-build + - unixODBC-devel + - yum-utils +duration: 3h diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh index 63c8ccc..bd1ebe6 100755 --- a/tests/smoke-test/runtest.sh +++ b/tests/smoke-test/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="openldap" @@ -45,58 +44,46 @@ PACKAGES=("openldap" \ "unixODBC-devel" \ "libtool-ltdl-devel" \ "nfs-utils" \ - "rpm-build" ) + "rpm-build" \ + "nss-devel" \ + "libdb-devel" \ + "groff" \ + "cracklib-devel" \ + "perl-ExtUtils-Embed"\ + "pkgconf-pkg-config" ) -if rlIsRHEL 5; then - PACKAGES=( ${PACKAGES[@]} "bind-libbind-devel" ) -elif rlIsRHEL 6; then - PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" ) -else - PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" "nss-devel" "libdb-devel" "groff" "cracklib-devel" "perl-ExtUtils-Embed" ) -fi -if rlIsFedora; then - PACKAGES=( ${PACKAGES[@]} "pkgconf-pkg-config" ) -else - PACKAGES=( ${PACKAGES[@]} "pkgconfig" ) -fi - -if rlIsRHEL 5; then - LDAP_SERVICE='ldap' -else - LDAP_SERVICE='slapd' -fi +LDAP_SERVICE='slapd' rlJournalStart rlPhaseStartSetup "General Setup" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "TmpDir=$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" - + for P in "${PACKAGES[@]}"; do rlCheckRpm $P || rlDie; done rlFetchSrcForInstalled $PACKAGE rlRun "yum-builddep -y openldap*src.rpm" 0 rlRun "rpm -ihv *.rpm" 0 - rlServiceStop $LDAP_SERVICE + rlServiceStop $LDAP_SERVICE rlPhaseEnd rlPhaseStartTest - TOPDIR=`rpm --eval %_topdir` + TOPDIR=$(rpm --eval %_topdir) rlRun "pushd $TOPDIR" 0 rlRun "rpmbuild -vv -bc SPECS/openldap.spec >build.log 2>&1" 0 [[ $? -ne 0 ]] && cat build.log - VERSION=`rpm -q --qf "%{VERSION}\n" openldap | tail -1` - rlRun "pushd BUILD/openldap-${VERSION}/openldap-${VERSION}" 0 + VERSION=$(rpm -q --qf "%{VERSION}\n" openldap | tail -1) + rlRun "pushd BUILD/openldap-${VERSION}-build/openldap-${VERSION}/openldap-${VERSION}" 0 # workaround for failing test, it tests unsupported configuration # see http://www.openldap.org/lists/openldap-technical/201204/msg00080.html for upstream reply # change of check after test is not enough because run of all tests with hdb is skipped if test058 fails with bdb - rm -f tests/scripts/test058-syncrepl-asymmetric - rlIsRHEL 5 6 && rlRun "pushd build-servers" 0 + #rm -f tests/scripts/test058-syncrepl-asymmetric rlRun "make check > make_check.out 2>&1" 0 @@ -107,15 +94,14 @@ rlJournalStart rlAssertNotGrep "failed" make_check.results - rlIsRHEL 5 6 && rlRun "popd" 0 rlRun "popd" 0 rlRun "popd" 0 rlPhaseEnd rlPhaseStartCleanup - rlServiceRestore $LDAP_SERVICE - rlRun "rm -rf BUILD/opendap-`rpm -q --qf "%{VERSION}" openldap`" 0 + rlServiceRestore $LDAP_SERVICE + rlRun "rm -rf BUILD/opendap-$(rpm -q --qf "%{VERSION}" openldap)" 0 rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index b1b1905..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,34 +0,0 @@ ---- -# Tests that run in all contexts -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - smoke-test - required_packages: - - openldap # Required for smoke-test - - openldap-clients # Required for smoke-test - - openldap-servers # Required for smoke-test - - cyrus-sasl-devel # Required for smoke-test - - gdbm-devel # Required for smoke-test - - libtool # Required for smoke-test - - krb5-devel # Required for smoke-test - - openssl-devel # Required for smoke-test - - pam-devel # Required for smoke-test - - perl # Required for smoke-test - - pkgconfig # Required for smoke-test - - tcp_wrappers-devel # Required for smoke-test - - bind-libbind-devel # Required for smoke-test - - unixODBC-devel # Required for smoke-test - - nfs-utils # Required for smoke-test - - rpm-build # Required for smoke-test - - nss-devel # Required for smoke-test - - libdb-devel # Required for smoke-test - - groff # Required for smoke-test - - cracklib-devel # Required for smoke-test - - perl-ExtUtils-Embed # Required for smoke-test - - yum-utils # Required for smoke-test - - libtool-ltdl-devel # Required for smoke-test - - wget # Required for smoke-test From 96644176b318cb597c26e0d4503c5f07f1687cbb Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Thu, 28 Aug 2025 19:01:02 -0700 Subject: [PATCH 115/118] Fix LDAP initialization does unnecessary resolution of hostname Resolves: rhbz#2331728 --- ...er-hostname-resolution-til-first-use.patch | 120 ++++++++++++++++++ openldap.spec | 8 +- 2 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch diff --git a/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch new file mode 100644 index 0000000..62f85f4 --- /dev/null +++ b/openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch @@ -0,0 +1,120 @@ +From 606349836109cfb201bc5b5b424dffb749150a68 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Mon, 28 Apr 2025 14:36:24 +0100 +Subject: [PATCH] ITS#10297 Defer hostname resolution til first use + +--- + libraries/libldap/init.c | 33 +++++++++++++++++++-------------- + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/os-ip.c | 2 ++ + libraries/libldap/tls_g.c | 3 +++ + libraries/libldap/tls_o.c | 3 +++ + 6 files changed, 28 insertions(+), 14 deletions(-) + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 213276b4b5..90fc34c5a6 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -631,6 +631,25 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + char * ldap_int_hostname = NULL; ++ ++void ++ldap_int_resolve_hostname(void) ++{ ++ static int resolved = 0; ++ ++ LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); ++ if ( !resolved ) { ++ char *name = ldap_int_hostname; ++ ++ ldap_int_hostname = ldap_pvt_get_fqdn( name ); ++ ++ if ( name != NULL && name != ldap_int_hostname ) { ++ LDAP_FREE( name ); ++ } ++ resolved = 1; ++ } ++ LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); ++} + #endif + + #ifdef LDAP_R_COMPILE +@@ -688,20 +707,6 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl ) + } + #endif + +-#if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) +- LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex ); +- { +- char *name = ldap_int_hostname; +- +- ldap_int_hostname = ldap_pvt_get_fqdn( name ); +- +- if ( name != NULL && name != ldap_int_hostname ) { +- LDAP_FREE( name ); +- } +- } +- LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex ); +-#endif +- + #ifndef HAVE_POLL + if ( ldap_int_tblsize == 0 ) ldap_int_ip_init(); + #endif +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 7e754775e8..435b859066 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -743,6 +743,7 @@ LDAP_F (int) ldap_int_poll( LDAP *ld, ber_socket_t s, + + #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL) + LDAP_V (char *) ldap_int_hostname; ++LDAP_F (void) ldap_int_resolve_hostname(void); + LDAP_F (char *) ldap_host_connected_to( Sockbuf *sb, + const char *host ); + #endif +diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c +index 6c86edd055..629b540352 100644 +--- a/libraries/libldap/os-ip.c ++++ b/libraries/libldap/os-ip.c +@@ -890,6 +890,8 @@ ldap_host_connected_to( Sockbuf *sb, const char *host ) + * this is necessary for kerberos to work right, since the official + * hostname is used as the kerberos instance. + */ ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); + + switch (sa->sa_family) { + #ifdef LDAP_PF_LOCAL +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index de5b7f7c84..d4e7ee0bf7 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -597,6 +597,9 @@ tlsg_session_chkhost( LDAP *ld, tls_session *session, const char *name_in ) + int len1 = 0, len2 = 0; + int ntype = IS_DNS; + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 71677847a9..155f685c99 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -830,6 +830,9 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) + struct in_addr addr; + #endif + ++ if ( !ldap_int_hostname ) ++ ldap_int_resolve_hostname(); ++ + if( ldap_int_hostname && + ( !name_in || !strcasecmp( name_in, "localhost" ) ) ) + { +-- +GitLab + diff --git a/openldap.spec b/openldap.spec index 6fa90d4..62991fa 100644 --- a/openldap.spec +++ b/openldap.spec @@ -17,7 +17,7 @@ Name: openldap Version: 2.6.10 -Release: 3%{?dist} +Release: 4%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -50,6 +50,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch Patch7: openldap-openssl-manpage-defaultCA.patch Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch +Patch10: openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch # check-password module specific patches Patch90: check-password-makefile.patch @@ -170,6 +171,7 @@ pushd openldap-%{version} %patch -P7 -p1 %patch -P8 -p1 %patch -P9 -p1 +%patch -P10 -p1 # build smbk5pwd with other overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays @@ -549,6 +551,10 @@ exit 0 %endif %changelog +* Fri Aug 29 2025 Simon Pichugin - 2.6.10-4 +- Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728) +- Convert STI tests to FMF (rhbz#2382998) + * Thu Jul 24 2025 Fedora Release Engineering - 2.6.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From d2ffb525852e4517da4e0f6373302cc10e66cf01 Mon Sep 17 00:00:00 2001 From: Viktor Ashirov Date: Wed, 15 Oct 2025 13:17:44 +0200 Subject: [PATCH 116/118] Add support for argon2 Resolves: rhbz#2167213 --- openldap.spec | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 62991fa..1d3ef63 100644 --- a/openldap.spec +++ b/openldap.spec @@ -9,6 +9,9 @@ # Build openldap-servers package and its libslapi in openldap-devel and openldap-compat %bcond servers 1 +# Build with argon2 support +%bcond argon2 1 + # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -74,6 +77,9 @@ BuildRequires: unixODBC-devel BuildRequires: cracklib-devel BuildRequires: systemd BuildRequires: systemd-rpm-macros +%if %{with argon2} +BuildRequires: libsodium-devel +%endif %description OpenLDAP is an open source suite of LDAP (Lightweight Directory Access @@ -221,6 +227,9 @@ pushd openldap-%{version} --enable-rlookups \ %if %{with servers} --enable-slapi \ +%if %{with argon2} + --enable-argon2 \ +%endif %endif --disable-slp \ \ @@ -460,6 +469,12 @@ exit 0 %{_datadir}/openldap-servers/ %{_libdir}/openldap/accesslog* %{_libdir}/openldap/allop* +%if %{with argon2} +%{_libdir}/openldap/argon2* +%{_mandir}/man5/slappw-argon2.5* +%else +%exclude %{_mandir}/man5/slappw-argon2.5* +%endif %{_libdir}/openldap/auditlog* %{_libdir}/openldap/autoca* %{_libdir}/openldap/back_asyncmeta* @@ -502,7 +517,6 @@ exit 0 %{_mandir}/man8/lloadd.8* %{_mandir}/man5/slapd*.5* %{_mandir}/man5/slapo-*.5* -%{_mandir}/man5/slappw-argon2.5* %{_mandir}/man8/slap*.8* %{_sysusersdir}/openldap.conf # obsolete configuration From 24f6f7ee20ba53a570fc1c7885b7abf077846ee9 Mon Sep 17 00:00:00 2001 From: Simon Pichugin Date: Mon, 12 Jan 2026 18:29:13 -0800 Subject: [PATCH 117/118] Bump version 2.6.10-5 Resolves: rhbz#2167213 Resolves: FC-2548 --- openldap.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openldap.spec b/openldap.spec index 1d3ef63..83ad359 100644 --- a/openldap.spec +++ b/openldap.spec @@ -20,7 +20,7 @@ Name: openldap Version: 2.6.10 -Release: 4%{?dist} +Release: 5%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -565,6 +565,10 @@ exit 0 %endif %changelog +* Tue Jan 13 2026 Simon Pichugin - 2.6.10-5 +- Add support for argon2 (rhbz#2167213) +- Bump version 2.6.10-5 + * Fri Aug 29 2025 Simon Pichugin - 2.6.10-4 - Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2331728) - Convert STI tests to FMF (rhbz#2382998) From a09115fad0d7eae5663008b68ba5548ad9be369b Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 14 Jan 2026 14:38:56 -0500 Subject: [PATCH 118/118] Enable argon2 only in Fedora libsodium is not included in RHEL, nor is openldap-servers shipped. --- openldap.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/openldap.spec b/openldap.spec index 83ad359..b8d3d66 100644 --- a/openldap.spec +++ b/openldap.spec @@ -10,7 +10,7 @@ %bcond servers 1 # Build with argon2 support -%bcond argon2 1 +%bcond argon2 %{undefined rhel} # When you change "Version: " to the new major version, remember to change this value too %global major_version 2.6 @@ -20,7 +20,7 @@ Name: openldap Version: 2.6.10 -Release: 5%{?dist} +Release: 6%{?dist} Summary: LDAP support libraries License: OLDAP-2.8 URL: http://www.openldap.org/ @@ -565,8 +565,11 @@ exit 0 %endif %changelog +* Wed Jan 14 2026 Yaakov Selkowitz - 2.6.10-6 +- Enable argon2 only in Fedora + * Tue Jan 13 2026 Simon Pichugin - 2.6.10-5 -- Add support for argon2 (rhbz#2167213) +- Add support for argon2 (rhbz#2229405) - Bump version 2.6.10-5 * Fri Aug 29 2025 Simon Pichugin - 2.6.10-4