Rebase to version 2.6.10

Resolves: rhbz2386672

.gitignore

@@ -40,3 +40,5 @@
 /openldap-2.6.6.tgz
 /openldap-2.6.7.tgz
 /openldap-2.6.8.tgz
+/openldap-2.6.9.tgz
+/openldap-2.6.10.tgz

openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch

@@ -0,0 +1,92 @@
+From 5f4569f0605a73eb1a282ee5251ead073ed3b26e Mon Sep 17 00:00:00 2001
+From: Simon Pichugin <spichugi@redhat.com>
+Date: Tue, 26 Nov 2024 12:32:07 -0800
+Subject: [PATCH] libldap: avoid SSL context cleanup during library destruction
+
+Given that libldap can be pulled into random applications and applications
+are allowed to call OPENSSL_cleanup() before exiting, the only sane thing
+to do is to avoid trying to touch SSL context in ldap destructors, and just
+let them leak if the application does not explicitly free the ldap context.
+
+Add ldap_int_tls_destroy_safe() which skips SSL context cleanup while
+maintaining all other cleanup operations, and use it in the library
+destructor path.
+
+Fixes: https://bugs.openldap.org/show_bug.cgi?id=9952
+---
+ libraries/libldap/init.c     |  2 +-
+ libraries/libldap/ldap-int.h |  1 +
+ libraries/libldap/tls2.c     | 25 +++++++++++++++++++++----
+ 3 files changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
+index 213276b4b5..aa017f4128 100644
+--- a/libraries/libldap/init.c
++++ b/libraries/libldap/init.c
+@@ -545,7 +545,7 @@ ldap_int_destroy_global_options(void)
+ 	}
+ #endif
+ #ifdef HAVE_TLS
+-	ldap_int_tls_destroy( gopts );
++	ldap_int_tls_destroy_safe( gopts );
+ #endif
+ }
+ 
+diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
+index 7e754775e8..b73097ccc7 100644
+--- a/libraries/libldap/ldap-int.h
++++ b/libraries/libldap/ldap-int.h
+@@ -914,6 +914,7 @@ LDAP_F (int) ldap_int_tls_start LDAP_P(( LDAP *ld,
+ 	LDAPConn *conn, LDAPURLDesc *srv ));
+ 
+ LDAP_F (void) ldap_int_tls_destroy LDAP_P(( struct ldapoptions *lo ));
++LDAP_F (void) ldap_int_tls_destroy_safe LDAP_P(( struct ldapoptions *lo ));
+ 
+ /*
+  *	in getvalues.c
+diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
+index 0841005a59..82f8573602 100644
+--- a/libraries/libldap/tls2.c
++++ b/libraries/libldap/tls2.c
+@@ -97,10 +97,14 @@ tls_ctx_ref( tls_ctx *ctx )
+ static ldap_pvt_thread_mutex_t tls_def_ctx_mutex;
+ #endif
+ 
+-void
+-ldap_int_tls_destroy( struct ldapoptions *lo )
+-{
+-	if ( lo->ldo_tls_ctx ) {
++/*
++ * Implementation function that handles all cleanup.
++ * skip_ctx_cleanup: 1 when called from destructor, 0 for normal operation
++ */
++static void
++ldap_int_tls_destroy_impl( struct ldapoptions *lo, int skip_ctx_cleanup )
++ {
++	if ( lo->ldo_tls_ctx && !skip_ctx_cleanup ) {
+ 		ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );
+ 		lo->ldo_tls_ctx = NULL;
+ 	}
+@@ -147,6 +151,19 @@ ldap_int_tls_destroy( struct ldapoptions *lo )
+ 	BER_BVZERO( &lo->ldo_tls_pin );
+ }
+ 
++
++void
++ldap_int_tls_destroy( struct ldapoptions *lo )
++{
++	ldap_int_tls_destroy_impl(lo, 0);
++}
++
++/* Safe version for destructor use */
++void ldap_int_tls_destroy_safe( struct ldapoptions *lo )
++{
++	ldap_int_tls_destroy_impl(lo, 1);
++}
++
+ /*
+  * Tear down the TLS subsystem. Should only be called once.
+  */
+-- 
+2.47.0
+

openldap-manpages.patch

@@ -1,35 +1,20 @@
 Various manual pages changes:
 * removes LIBEXECDIR from slapd.8
-* removes references to non-existing manpages (bz 624616)
 
-diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1
-index 353b075..cf37856 100644
---- a/doc/man/man1/ldapmodify.1
-+++ b/doc/man/man1/ldapmodify.1
-@@ -382,8 +382,7 @@ exit status and a diagnostic message being written to standard error.
- .BR ldap_add_ext (3),
- .BR ldap_delete_ext (3),
- .BR ldap_modify_ext (3),
--.BR ldap_modrdn_ext (3),
--.BR ldif (5).
-+.BR ldif (5)
- .SH AUTHOR
- The OpenLDAP Project <http://www.openldap.org/>
- .SH ACKNOWLEDGEMENTS
 diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5
-index 17b7154..6084298 100644
+index d47481d6ed..ff86fc52ca 100644
 --- a/doc/man/man5/ldap.conf.5
 +++ b/doc/man/man5/ldap.conf.5
-@@ -338,6 +338,7 @@ certificates in separate individual files. The
+@@ -341,6 +341,7 @@ be specified, separated by a semi-colon.  The
  .B TLS_CACERT
  is always used before
- .B TLS_CACERTDIR.
+ .BR TLS_CACERTDIR .
 +The specified directory must be managed with the OpenSSL c_rehash utility.
  .TP
  .B TLS_CERT <filename>
  Specifies the file that contains the client certificate.
 diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8
-index 8504b37..f02f1fa 100644
+index 807634e52d..a06110687b 100644
 --- a/doc/man/man8/slapd.8
 +++ b/doc/man/man8/slapd.8
 @@ -5,7 +5,7 @@
@@ -41,16 +26,16 @@ index 8504b37..f02f1fa 100644
  [\c
  .BR \-V [ V [ V ]]
  [\c
-@@ -332,7 +332,7 @@ the LDAP databases defined in the default config file, just type:
+@@ -333,7 +333,7 @@ the LDAP databases defined in the default config file, just type:
  .LP
  .nf
  .ft tt
 -	LIBEXECDIR/slapd
-+	slapd
++        slapd
  .ft
  .fi
  .LP
-@@ -343,7 +343,7 @@ on voluminous debugging which will be printed on standard error, type:
+@@ -344,7 +344,7 @@ on voluminous debugging which will be printed on standard error, type:
  .LP
  .nf
  .ft tt
@@ -59,7 +44,7 @@ index 8504b37..f02f1fa 100644
  .ft
  .fi
  .LP
-@@ -351,7 +351,7 @@ To test whether the configuration file is correct or not, type:
+@@ -352,7 +352,7 @@ To test whether the configuration file is correct or not, type:
  .LP
  .nf
  .ft tt

openldap.spec

@@ -16,8 +16,8 @@
 %global __brp_remove_la_files %nil
 
 Name: openldap
-Version: 2.6.8
-Release: 5%{?dist}
+Version: 2.6.10
+Release: 1%{?dist}
 Summary: LDAP support libraries
 License: OLDAP-2.8
 URL: http://www.openldap.org/
@@ -49,6 +49,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch
 # System-wide default for CA certs
 Patch7: openldap-openssl-manpage-defaultCA.patch
 Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch
+Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch
 
 # check-password module specific patches
 Patch90: check-password-makefile.patch
@@ -128,7 +129,6 @@ and are available for compatibility reasons.
 %if %{with servers}
 %package servers
 Summary: LDAP server
-License: OpenLDAP
 Requires: openldap%{?_isa} = %{version}-%{release}
 %{?systemd_requires}
 Requires(pre): shadow-utils
@@ -170,6 +170,7 @@ pushd openldap-%{version}
 %patch -P6 -p1
 %patch -P7 -p1
 %patch -P8 -p1
+%patch -P9 -p1
 
 # build smbk5pwd with other overlays
 ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays
@@ -199,6 +200,8 @@ popd
 %set_build_flags
 # enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS)
 export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -Wl,-z,now -DLDAP_CONNECTIONLESS"
+# disable legacy hash algorithm
+export CFLAGS="${CFLAGS} -DOPENSSL_NO_MD2"
 
 pushd openldap-%{version}
 %configure \
@@ -550,6 +553,18 @@ exit 0
 %endif
 
 %changelog
+* Tue Aug 5 2025 Simon Pichugin <spichugi@redhat.com> - 2.6.10-1
+- Rebase to version 2.6.10 (rhbz#2386672)
+
+* Thu Mar 27 2025 Simon Pichugin <spichugi@redhat.com> - 2.6.9-1
+- Rebase to version 2.6.9 (rhbz#2355652)
+
+* Thu Jan 16 2025 Simon Pichugin <spichugi@redhat.com> - 2.6.8-7
+- Disable MD2 hash algorithm (rhbz#2338562)
+
+* Thu Dec 5 2024 Simon Pichugin <spichugi@redhat.com> - 2.6.8-6
+- Avoid SSL context cleanup during library destruction (rhbz#2330711)
+
 * Tue Jul 23 2024 Simon Pichugin <spichugi@redhat.com> - 2.6.8-5
 - Clean up spec file so it's aligned with c10s
 - Remove UPGRADE_INSTRUCTIONS for openldap-server upgrade (rhbz#2133526)

sources

@@ -1,2 +1,2 @@
 SHA512 (openldap-ppolicy-check-password-1.1.tar.gz) = a92854d7438cb95fac361da80a49d084d502155e8ce0ad2ea679db9529bbe0182aa4354e6139793c775e496349375d8f017678941d23315ff1c20fefc9573cdc
-SHA512 (openldap-2.6.8.tgz) = c86bda8a0af2645e586d56a1494a5bd486ec5dd55c47859dbabcc2bb6ddc0a8307e23c6b58228d49ee3c8bc5e4d6ead305863442efdcee3dc2ab9953097b5a77
+SHA512 (openldap-2.6.10.tgz) = 18129ad9a385457941e3203de5f130fe2571701abf24592c5beffb01361aae3182c196b2cd48ffeecb792b9b0e5f82c8d92445a7ec63819084757bdedba63b20