Fix LDAP initialization does unnecessary resolution of hostname

Resolves: rhbz#2392068

.fmf/version

@@ -0,0 +1 @@
+1

openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch

@@ -0,0 +1,120 @@
+From 606349836109cfb201bc5b5b424dffb749150a68 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
+Date: Mon, 28 Apr 2025 14:36:24 +0100
+Subject: [PATCH] ITS#10297 Defer hostname resolution til first use
+
+---
+ libraries/libldap/init.c     | 33 +++++++++++++++++++--------------
+ libraries/libldap/ldap-int.h |  1 +
+ libraries/libldap/os-ip.c    |  2 ++
+ libraries/libldap/tls_g.c    |  3 +++
+ libraries/libldap/tls_o.c    |  3 +++
+ 6 files changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
+index 213276b4b5..90fc34c5a6 100644
+--- a/libraries/libldap/init.c
++++ b/libraries/libldap/init.c
+@@ -631,6 +631,25 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl
+ 
+ #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL)
+ char * ldap_int_hostname = NULL;
++
++void
++ldap_int_resolve_hostname(void)
++{
++	static int resolved = 0;
++
++	LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex );
++	if ( !resolved ) {
++		char	*name = ldap_int_hostname;
++
++		ldap_int_hostname = ldap_pvt_get_fqdn( name );
++
++		if ( name != NULL && name != ldap_int_hostname ) {
++			LDAP_FREE( name );
++		}
++		resolved = 1;
++	}
++	LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex );
++}
+ #endif
+ 
+ #ifdef LDAP_R_COMPILE
+@@ -688,20 +707,6 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl )
+ }
+ #endif
+ 
+-#if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL)
+-	LDAP_MUTEX_LOCK( &ldap_int_hostname_mutex );
+-	{
+-		char	*name = ldap_int_hostname;
+-
+-		ldap_int_hostname = ldap_pvt_get_fqdn( name );
+-
+-		if ( name != NULL && name != ldap_int_hostname ) {
+-			LDAP_FREE( name );
+-		}
+-	}
+-	LDAP_MUTEX_UNLOCK( &ldap_int_hostname_mutex );
+-#endif
+-
+ #ifndef HAVE_POLL
+ 	if ( ldap_int_tblsize == 0 ) ldap_int_ip_init();
+ #endif
+diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
+index 7e754775e8..435b859066 100644
+--- a/libraries/libldap/ldap-int.h
++++ b/libraries/libldap/ldap-int.h
+@@ -743,6 +743,7 @@ LDAP_F (int) ldap_int_poll( LDAP *ld, ber_socket_t s,
+ 
+ #if defined(HAVE_TLS) || defined(HAVE_CYRUS_SASL)
+ LDAP_V (char *) ldap_int_hostname;
++LDAP_F (void) ldap_int_resolve_hostname(void);
+ LDAP_F (char *) ldap_host_connected_to( Sockbuf *sb,
+ 	const char *host );
+ #endif
+diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c
+index 6c86edd055..629b540352 100644
+--- a/libraries/libldap/os-ip.c
++++ b/libraries/libldap/os-ip.c
+@@ -890,6 +890,8 @@ ldap_host_connected_to( Sockbuf *sb, const char *host )
+ 	 * this is necessary for kerberos to work right, since the official
+ 	 * hostname is used as the kerberos instance.
+ 	 */
++	if ( !ldap_int_hostname )
++		ldap_int_resolve_hostname();
+ 
+ 	switch (sa->sa_family) {
+ #ifdef LDAP_PF_LOCAL
+diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c
+index de5b7f7c84..d4e7ee0bf7 100644
+--- a/libraries/libldap/tls_g.c
++++ b/libraries/libldap/tls_g.c
+@@ -597,6 +597,9 @@ tlsg_session_chkhost( LDAP *ld, tls_session *session, const char *name_in )
+ 	int len1 = 0, len2 = 0;
+ 	int ntype = IS_DNS;
+ 
++	if ( !ldap_int_hostname )
++		ldap_int_resolve_hostname();
++
+ 	if( ldap_int_hostname &&
+ 		( !name_in || !strcasecmp( name_in, "localhost" ) ) )
+ 	{
+diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
+index 71677847a9..155f685c99 100644
+--- a/libraries/libldap/tls_o.c
++++ b/libraries/libldap/tls_o.c
+@@ -830,6 +830,9 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in )
+ 	struct in_addr addr;
+ #endif
+ 
++	if ( !ldap_int_hostname )
++		ldap_int_resolve_hostname();
++
+ 	if( ldap_int_hostname &&
+ 		( !name_in || !strcasecmp( name_in, "localhost" ) ) )
+ 	{
+-- 
+GitLab
+

openldap.spec

@@ -17,7 +17,7 @@
 
 Name: openldap
 Version: 2.6.10
-Release: 3%{?dist}
+Release: 4%{?dist}
 Summary: LDAP support libraries
 License: OLDAP-2.8
 URL: http://www.openldap.org/
@@ -50,6 +50,7 @@ Patch6: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch
 Patch7: openldap-openssl-manpage-defaultCA.patch
 Patch8: openldap-add-export-symbols-LDAP_CONNECTIONLESS.patch
 Patch9: openldap-libldap-avoid-SSL-context-cleanup-during-library-des.patch
+Patch10: openldap-ITS-10297-Defer-hostname-resolution-til-first-use.patch
 
 # check-password module specific patches
 Patch90: check-password-makefile.patch
@@ -170,6 +171,7 @@ pushd openldap-%{version}
 %patch -P7 -p1
 %patch -P8 -p1
 %patch -P9 -p1
+%patch -P10 -p1
 
 # build smbk5pwd with other overlays
 ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays
@@ -549,6 +551,10 @@ exit 0
 %endif
 
 %changelog
+* Fri Aug 29 2025 Simon Pichugin <spichugi@redhat.com> - 2.6.10-4
+- Fix LDAP initialization does unnecessary resolution of hostname (rhbz#2392068)
+- Convert STI tests to FMF (rhbz#2392069)
+
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.10-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 

plans/gating.fmf

@@ -0,0 +1,8 @@
+summary: Test plan for openldap
+
+discover:
+   how: fmf
+
+execute:
+  how: tmt
+

tests/smoke-test/Makefile

@@ -46,7 +46,7 @@ clean:
 include /usr/share/rhts/lib/rhts-make.include
 
 $(METADATA): Makefile
-	@echo "Owner:           Ondrej Moris <omoris@redhat.com>" > $(METADATA)
+	@echo "Owner:           Viktor Ashirov <vashirov@redhat.com>" > $(METADATA)
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
@@ -57,25 +57,23 @@ $(METADATA): Makefile
 	@echo "Requires:        openldap" >> $(METADATA)
 	@echo "Requires:        openldap-clients" >> $(METADATA)
 	@echo "Requires:        openldap-servers" >> $(METADATA)
+	@echo "Requires:       	nss-devel" >> $(METADATA)
+	@echo "Requires:        cracklib-devel" >> $(METADATA)
 	@echo "Requires:        cyrus-sasl-devel" >> $(METADATA)
 	@echo "Requires:        gdbm-devel" >> $(METADATA)
-	@echo "Requires:        libtool" >> $(METADATA)
+	@echo "Requires:        groff" >> $(METADATA)
 	@echo "Requires:        krb5-devel" >> $(METADATA)
+	@echo "Requires:        libdb-devel" >> $(METADATA)
+	@echo "Requires:        libtool" >> $(METADATA)
+	@echo "Requires:        libtool-ltdl-devel" >> $(METADATA)
+	@echo "Requires:        nfs-utils" >> $(METADATA)
 	@echo "Requires:        openssl-devel" >> $(METADATA)
 	@echo "Requires:        pam-devel" >> $(METADATA)
 	@echo "Requires:        perl" >> $(METADATA)
-	@echo "Requires:        pkgconfig" >> $(METADATA)
-	@echo "Requires:        tcp_wrappers-devel" >> $(METADATA)
-	@echo "Requires:        bind-libbind-devel" >> $(METADATA)
-	@echo "Requires:        unixODBC-devel" >> $(METADATA)
-	@echo "Requires:        libtool-ltdl-devel" >> $(METADATA)
-	@echo "Requires:        nfs-utils" >> $(METADATA)
-	@echo "Requires:        rpm-build" >> $(METADATA)
-	@echo "Requires:       	nss-devel" >> $(METADATA)
-	@echo "Requires:        libdb-devel" >> $(METADATA)
-	@echo "Requires:        groff" >> $(METADATA)
-	@echo "Requires:        cracklib-devel" >> $(METADATA)
 	@echo "Requires:        perl-ExtUtils-Embed" >> $(METADATA)
+	@echo "Requires:        pkgconfig" >> $(METADATA)
+	@echo "Requires:        rpm-build" >> $(METADATA)
+	@echo "Requires:        unixODBC-devel" >> $(METADATA)
 	@echo "Requires:        yum-utils" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)

tests/smoke-test/main.fmf

@@ -0,0 +1,31 @@
+summary: Test calls upstream test suite
+description: Test calls upstream test suite
+contact: Viktor Ashirov <vashirov@redhat.com>
+component:
+  - openldap
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+  - openldap
+  - openldap-clients
+  - openldap-servers
+  - cracklib-devel
+  - cyrus-sasl-devel
+  - gdbm-devel
+  - groff
+  - krb5-devel
+  - libdb-devel
+  - libtool
+  - libtool-ltdl-devel
+  - nfs-utils
+  - nss-devel
+  - openssl-devel
+  - pam-devel
+  - perl
+  - perl-ExtUtils-Embed
+  - pkgconf-pkg-config
+  - pkgconfig
+  - rpm-build
+  - unixODBC-devel
+  - yum-utils
+duration: 3h

tests/smoke-test/runtest.sh

@@ -27,7 +27,6 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 # Include rhts environment
-. /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="openldap"
@@ -45,58 +44,46 @@ PACKAGES=("openldap"           \
           "unixODBC-devel"     \
           "libtool-ltdl-devel" \
           "nfs-utils"          \
-          "rpm-build"          )
+          "rpm-build"          \
+          "nss-devel"          \
+          "libdb-devel"        \
+          "groff"              \
+          "cracklib-devel"     \
+          "perl-ExtUtils-Embed"\
+          "pkgconf-pkg-config" )
 
-if rlIsRHEL 5; then
-    PACKAGES=( ${PACKAGES[@]} "bind-libbind-devel" )
-elif rlIsRHEL 6; then
-    PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" )
-else
-    PACKAGES=( ${PACKAGES[@]} "tcp_wrappers-devel" "nss-devel" "libdb-devel" "groff" "cracklib-devel" "perl-ExtUtils-Embed" )
-fi
-if rlIsFedora; then
-    PACKAGES=( ${PACKAGES[@]} "pkgconf-pkg-config" )
-else
-    PACKAGES=( ${PACKAGES[@]} "pkgconfig" )
-fi
-
-if rlIsRHEL 5; then
-    LDAP_SERVICE='ldap'
-else
-    LDAP_SERVICE='slapd'
-fi
+LDAP_SERVICE='slapd'
 
 rlJournalStart
 
     rlPhaseStartSetup "General Setup"
 
-        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "TmpDir=$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
-    
+
         for P in "${PACKAGES[@]}"; do rlCheckRpm $P || rlDie; done
 
         rlFetchSrcForInstalled $PACKAGE
         rlRun "yum-builddep -y openldap*src.rpm" 0
         rlRun "rpm -ihv *.rpm" 0
 
-        rlServiceStop $LDAP_SERVICE 
+        rlServiceStop $LDAP_SERVICE
 
     rlPhaseEnd
 
     rlPhaseStartTest
 
-        TOPDIR=`rpm --eval %_topdir`
+        TOPDIR=$(rpm --eval %_topdir)
         rlRun "pushd $TOPDIR" 0
 
         rlRun "rpmbuild -vv -bc SPECS/openldap.spec >build.log 2>&1" 0
         [[ $? -ne 0 ]] && cat build.log
-        VERSION=`rpm -q --qf "%{VERSION}\n" openldap | tail -1`
-        rlRun "pushd BUILD/openldap-${VERSION}/openldap-${VERSION}" 0
+        VERSION=$(rpm -q --qf "%{VERSION}\n" openldap | tail -1)
+        rlRun "pushd BUILD/openldap-${VERSION}-build/openldap-${VERSION}/openldap-${VERSION}" 0
         # workaround for failing test, it tests unsupported configuration
         # see http://www.openldap.org/lists/openldap-technical/201204/msg00080.html for upstream reply
         # change of check after test is not enough because run of all tests with hdb is skipped if test058 fails with bdb
-        rm -f tests/scripts/test058-syncrepl-asymmetric
-        rlIsRHEL 5 6 && rlRun "pushd build-servers" 0
+        #rm -f tests/scripts/test058-syncrepl-asymmetric
 
         rlRun "make check > make_check.out 2>&1" 0
 
@@ -107,15 +94,14 @@ rlJournalStart
 
         rlAssertNotGrep "failed" make_check.results
 
-        rlIsRHEL 5 6 && rlRun "popd" 0
         rlRun "popd" 0
         rlRun "popd" 0
     rlPhaseEnd
 
     rlPhaseStartCleanup
 
-        rlServiceRestore $LDAP_SERVICE 
-        rlRun "rm -rf BUILD/opendap-`rpm -q --qf "%{VERSION}" openldap`" 0
+        rlServiceRestore $LDAP_SERVICE
+        rlRun "rm -rf BUILD/opendap-$(rpm -q --qf "%{VERSION}" openldap)" 0
         rlRun "popd"
         rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
 

tests/tests.yml

@@ -1,34 +0,0 @@
----
-# Tests that run in all contexts
-- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    tests:
-    - smoke-test
-    required_packages:
-    - openldap            # Required for smoke-test
-    - openldap-clients    # Required for smoke-test
-    - openldap-servers    # Required for smoke-test
-    - cyrus-sasl-devel    # Required for smoke-test
-    - gdbm-devel          # Required for smoke-test
-    - libtool             # Required for smoke-test
-    - krb5-devel          # Required for smoke-test
-    - openssl-devel       # Required for smoke-test
-    - pam-devel           # Required for smoke-test
-    - perl                # Required for smoke-test
-    - pkgconfig           # Required for smoke-test
-    - tcp_wrappers-devel  # Required for smoke-test
-    - bind-libbind-devel  # Required for smoke-test
-    - unixODBC-devel      # Required for smoke-test
-    - nfs-utils           # Required for smoke-test
-    - rpm-build           # Required for smoke-test
-    - nss-devel           # Required for smoke-test
-    - libdb-devel         # Required for smoke-test
-    - groff               # Required for smoke-test
-    - cracklib-devel      # Required for smoke-test
-    - perl-ExtUtils-Embed # Required for smoke-test
-    - yum-utils           # Required for smoke-test
-    - libtool-ltdl-devel  # Required for smoke-test
-    - wget                # Required for smoke-test