diff --git a/server/auth/cyrus-sasl/actions.py b/server/auth/cyrus-sasl/actions.py new file mode 100644 index 0000000000..283514a333 --- /dev/null +++ b/server/auth/cyrus-sasl/actions.py @@ -0,0 +1,76 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +def setup(): + pisitools.dosed("libsasl2.pc.in", "libdir = @libdir@", "prefix=/usr\nexec_prefix=${prefix}\nlibdir = @libdir@") + def cleanup(): + for p in ("config.*", "ltconfig", "ltmain.sh", "libtool.m4"): + shelltools.unlink("config/%s" % p) + + cleanup() + autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal") + shelltools.cd("saslauthd") + cleanup() + autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config") + shelltools.cd("..") + + pisitools.cflags.add("-fPIC") + + # Don't disable ldap support to break circular dep. with openldap + # As workaround, we remove openldap-client runtime dep. in pspec + autotools.configure("--with-saslauthd=/run/saslauthd \ + --with-pwcheck=/var/lib/sasl2 \ + --with-configdir=/etc/sasl2 \ + --with-plugindir=/usr/lib/sasl2 \ + --with-dbpath=/etc/sasl2/sasldb2 \ + --with-pam \ + --with-ldap \ + --with-openssl \ + --with-dblib=gdbm \ + --with-gss_impl=mit \ + --with-devrandom=/dev/urandom \ + --without-pgsql \ + --without-mysql \ + --enable-anon \ + --enable-cram \ + --enable-digest \ + --enable-gssapi \ + --enable-login \ + --enable-ntlm \ + --enable-plain \ + --enable-ldapdb \ + --enable-checkapop \ + --enable-alwaystrue \ + --disable-java \ + --disable-krb4 \ + --disable-otp \ + --disable-srp \ + --disable-sql \ + --disable-passdss \ + --disable-macos-framework \ + --disable-static") + +def build(): + autotools.make("-j1") + autotools.make("-C saslauthd testsaslauthd") + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + autotools.rawInstall("DESTDIR=%s -C plugins" % get.installDIR()) + + pisitools.dodir("/etc/sasl2") + pisitools.dodir("/run/saslauthd") + + for doc in ["AUTHORS", "COPYING", "ChangeLog", "LDAP_SASLAUTHD", "NEWS", "README"]: + pisitools.newdoc("saslauthd/%s" % doc, "saslauthd/%s" % doc) + + pisitools.dohtml("doc/*.html") + pisitools.dodoc("AUTHORS", "COPYING", "ChangeLog", "NEWS", "README", "doc/TODO", "doc/*.txt") diff --git a/server/auth/cyrus-sasl/comar/package.py b/server/auth/cyrus-sasl/comar/package.py new file mode 100644 index 0000000000..997efd2baa --- /dev/null +++ b/server/auth/cyrus-sasl/comar/package.py @@ -0,0 +1,11 @@ +#!/usr/bin/python + +import os + +def postInstall(fromVersion, fromRelease, toVersion, toRelease): + if not os.path.exists("/etc/sasl2/sasldb2"): + os.system("/usr/sbin/saslpasswd2 -f /etc/sasl2/sasldb2 -p login") + os.system("/usr/sbin/saslpasswd2 -f /etc/sasl2/sasldb2 -d login") + + os.system("/bin/chown root:mail /etc/sasl2/sasldb2") + os.system("/bin/chmod 0640 /etc/sasl2/sasldb2") diff --git a/server/auth/cyrus-sasl/comar/service.py b/server/auth/cyrus-sasl/comar/service.py new file mode 100644 index 0000000000..04ba1f063e --- /dev/null +++ b/server/auth/cyrus-sasl/comar/service.py @@ -0,0 +1,26 @@ +# -*- coding: utf-8 -*- + +from comar.service import * + +serviceType = "server" +serviceDesc = _({"en": "Cyrus-SASL Daemon", + "tr": "Cyrus-SASL Servisi"}) +serviceConf = "saslauthd" + +SOCKETDIR = "/run/saslauthd" +PIDFILE = "/run/saslauthd/saslauthd.pid" + +@synchronized +def start(): + startService(command="/usr/sbin/saslauthd", + args="-m %s %s" % (SOCKETDIR, config.get("SASLAUTHD_OPTS", "")), + pidfile=PIDFILE, + donotify=True) + +@synchronized +def stop(): + stopService(pidfile=PIDFILE, + donotify=True) + +def status(): + return isServiceRunning(PIDFILE) diff --git a/server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch b/server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch new file mode 100644 index 0000000000..3805b4857c --- /dev/null +++ b/server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch @@ -0,0 +1,15 @@ +0011_saslauthd_ac_prog_libtool.dpatch by + +Enable libtool use. + +diff -urNad trunk~/saslauthd/configure.in trunk/saslauthd/configure.in +--- trunk~/saslauthd/configure.in 2006-05-29 22:52:42.000000000 +0300 ++++ trunk/saslauthd/configure.in 2006-11-01 23:41:51.000000000 +0200 +@@ -25,6 +25,7 @@ + AC_PROG_MAKE_SET + AC_PROG_LN_S + AC_PROG_INSTALL ++AC_PROG_LIBTOOL + + dnl Checks for build foo + CMU_C___ATTRIBUTE__ diff --git a/server/auth/cyrus-sasl/files/0025_ld_as_needed.patch b/server/auth/cyrus-sasl/files/0025_ld_as_needed.patch new file mode 100644 index 0000000000..67b48b4a49 --- /dev/null +++ b/server/auth/cyrus-sasl/files/0025_ld_as_needed.patch @@ -0,0 +1,27 @@ +Author: Matthias Klose +Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use +it. +--- a/saslauthd/Makefile.am ++++ b/saslauthd/Makefile.am +@@ -16,7 +16,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c + saslauthd_DEPENDENCIES = saslauthd-main.o @LTLIBOBJS@ + saslauthd_LDADD = @SASL_KRB_LIB@ \ + @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ +- @LIB_SOCKET@ @SASL_DB_LIB@ @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ ++ @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ + + testsaslauthd_SOURCES = testsaslauthd.c utils.c + testsaslauthd_LDADD = @LIB_SOCKET@ +--- a/sasldb/Makefile.am ++++ b/sasldb/Makefile.am +@@ -55,8 +55,8 @@ noinst_LIBRARIES = libsasldb.a + + libsasldb_la_SOURCES = allockey.c sasldb.h + EXTRA_libsasldb_la_SOURCES = $(extra_common_sources) +-libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) +-libsasldb_la_LIBADD = $(SASL_DB_BACKEND) ++libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) $(SASL_DB_LIB) ++libsasldb_la_LIBADD = $(SASL_DB_BACKEND) $(SASL_DB_LIB) + + # Prevent make dist stupidity + libsasldb_a_SOURCES = diff --git a/server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch b/server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch new file mode 100644 index 0000000000..cc00867ef0 --- /dev/null +++ b/server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch @@ -0,0 +1,14 @@ +Author: Roberto C. Sanchez +Description: Drop gratuitous dependency on krb5support +--- a/cmulocal/sasl2.m4 ++++ b/cmulocal/sasl2.m4 +@@ -112,9 +112,6 @@ if test "$gssapi" != no; then + fi + + if test "$gss_impl" = "auto" -o "$gss_impl" = "mit"; then +- # check for libkrb5support first +- AC_CHECK_LIB(krb5support,krb5int_getspecific,K5SUP=-lkrb5support K5SUPSTATIC=$gssapi_dir/libkrb5support.a,,${LIB_SOCKET}) +- + gss_failed=0 + AC_CHECK_LIB(gssapi_krb5,gss_unwrap,gss_impl="mit",gss_failed=1, + ${GSSAPIBASE_LIBS} -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err ${K5SUP} ${LIB_SOCKET}) diff --git a/server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch b/server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch new file mode 100644 index 0000000000..14a322496e --- /dev/null +++ b/server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch @@ -0,0 +1,134 @@ +--- a/lib/dlopen.c ++++ b/lib/dlopen.c +@@ -247,105 +247,6 @@ static int _sasl_plugin_load(char *plugi + return result; + } + +-/* this returns the file to actually open. +- * out should be a buffer of size PATH_MAX +- * and may be the same as in. */ +- +-/* We'll use a static buffer for speed unless someone complains */ +-#define MAX_LINE 2048 +- +-static int _parse_la(const char *prefix, const char *in, char *out) +-{ +- FILE *file; +- size_t length; +- char line[MAX_LINE]; +- char *ntmp = NULL; +- +- if(!in || !out || !prefix || out == in) return SASL_BADPARAM; +- +- /* Set this so we can detect failure */ +- *out = '\0'; +- +- length = strlen(in); +- +- if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) { +- if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) { +- /* check for a .la file */ +- strcpy(line, prefix); +- strcat(line, in); +- length = strlen(line); +- *(line + (length - strlen(SO_SUFFIX))) = '\0'; +- strcat(line, LA_SUFFIX); +- file = fopen(line, "r"); +- if(file) { +- /* We'll get it on the .la open */ +- fclose(file); +- return SASL_FAIL; +- } +- } +- strcpy(out, prefix); +- strcat(out, in); +- return SASL_OK; +- } +- +- strcpy(line, prefix); +- strcat(line, in); +- +- file = fopen(line, "r"); +- if(!file) { +- _sasl_log(NULL, SASL_LOG_WARN, +- "unable to open LA file: %s", line); +- return SASL_FAIL; +- } +- +- while(!feof(file)) { +- if(!fgets(line, MAX_LINE, file)) break; +- if(line[strlen(line) - 1] != '\n') { +- _sasl_log(NULL, SASL_LOG_WARN, +- "LA file has too long of a line: %s", in); +- return SASL_BUFOVER; +- } +- if(line[0] == '\n' || line[0] == '#') continue; +- if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) { +- /* We found the line with the name in it */ +- char *end; +- char *start; +- size_t len; +- end = strrchr(line, '\''); +- if(!end) continue; +- start = &line[sizeof("dlname=")-1]; +- len = strlen(start); +- if(len > 3 && start[0] == '\'') { +- ntmp=&start[1]; +- *end='\0'; +- /* Do we have dlname="" ? */ +- if(ntmp == end) { +- _sasl_log(NULL, SASL_LOG_DEBUG, +- "dlname is empty in .la file: %s", in); +- return SASL_FAIL; +- } +- strcpy(out, prefix); +- strcat(out, ntmp); +- } +- break; +- } +- } +- if(ferror(file) || feof(file)) { +- _sasl_log(NULL, SASL_LOG_WARN, +- "Error reading .la: %s\n", in); +- fclose(file); +- return SASL_FAIL; +- } +- fclose(file); +- +- if(!(*out)) { +- _sasl_log(NULL, SASL_LOG_WARN, +- "Could not find a dlname line in .la file: %s", in); +- return SASL_FAIL; +- } +- +- return SASL_OK; +-} + #endif /* DO_DLOPEN */ + + /* loads a plugin library */ +@@ -499,18 +400,18 @@ int _sasl_load_plugins(const add_plugin_ + if (length + pos>=PATH_MAX) continue; /* too big */ + + if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)), +- SO_SUFFIX) +- && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)), +- LA_SUFFIX)) ++ SO_SUFFIX)) + continue; + ++ /* We only use .so files for loading plugins */ ++ + memcpy(name,dir->d_name,length); + name[length]='\0'; + +- result = _parse_la(prefix, name, tmp); +- if(result != SASL_OK) +- continue; +- ++ /* Create full name with path */ ++ strncpy(tmp, prefix, PATH_MAX); ++ strncat(tmp, name, PATH_MAX); ++ + /* skip "lib" and cut off suffix -- + this only need be approximate */ + strcpy(plugname, name + 3); diff --git a/server/auth/cyrus-sasl/files/CVE-2013-4122.patch b/server/auth/cyrus-sasl/files/CVE-2013-4122.patch new file mode 100644 index 0000000000..d6b9800e66 --- /dev/null +++ b/server/auth/cyrus-sasl/files/CVE-2013-4122.patch @@ -0,0 +1,116 @@ +From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001 +From: mancha +Date: Thu, 11 Jul 2013 09:08:07 +0000 +Subject: Handle NULL returns from glibc 2.17+ crypt() + +Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL +(w/ NULL return) if the salt violates specifications. Additionally, +on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords +passed to crypt() fail with EPERM (w/ NULL return). + +When using glibc's crypt(), check return value to avoid a possible +NULL pointer dereference. + +Patch by mancha1@hush.com. +--- +diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c +index 4b34222..400289c 100644 +--- a/pwcheck/pwcheck_getpwnam.c ++++ b/pwcheck/pwcheck_getpwnam.c +@@ -32,6 +32,7 @@ char *userid; + char *password; + { + char* r; ++ char* crpt_passwd; + struct passwd *pwd; + + pwd = getpwnam(userid); +@@ -41,7 +42,7 @@ char *password; + else if (pwd->pw_passwd[0] == '*') { + r = "Account disabled"; + } +- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) { ++ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) { + r = "Incorrect password"; + } + else { +diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c +index 2b11286..6d607bb 100644 +--- a/pwcheck/pwcheck_getspnam.c ++++ b/pwcheck/pwcheck_getspnam.c +@@ -32,13 +32,15 @@ char *userid; + char *password; + { + struct spwd *pwd; ++ char *crpt_passwd; + + pwd = getspnam(userid); + if (!pwd) { + return "Userid not found"; + } + +- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) { ++ crpt_passwd = crypt(password, pwd->sp_pwdp); ++ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) { + return "Incorrect password"; + } + else { +diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c +index fc8029d..d4ebe54 100644 +--- a/saslauthd/auth_getpwent.c ++++ b/saslauthd/auth_getpwent.c +@@ -77,6 +77,7 @@ auth_getpwent ( + { + /* VARIABLES */ + struct passwd *pw; /* pointer to passwd file entry */ ++ char *crpt_passwd; /* encrypted password */ + int errnum; + /* END VARIABLES */ + +@@ -105,7 +106,8 @@ auth_getpwent ( + } + } + +- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) { ++ crpt_passwd = crypt(password, pw->pw_passwd); ++ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login); + } +diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c +index 677131b..1988afd 100644 +--- a/saslauthd/auth_shadow.c ++++ b/saslauthd/auth_shadow.c +@@ -210,8 +210,8 @@ auth_shadow ( + RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)"); + } + +- cpw = strdup((const char *)crypt(password, sp->sp_pwdp)); +- if (strcmp(sp->sp_pwdp, cpw)) { ++ cpw = crypt(password, sp->sp_pwdp); ++ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) { + if (flags & VERBOSE) { + /* + * This _should_ reveal the SHADOW_PW_LOCKED prefix to an +@@ -221,10 +221,8 @@ auth_shadow ( + syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'", + sp->sp_pwdp, cpw); + } +- free(cpw); + RETURN("NO Incorrect password"); + } +- free(cpw); + + /* + * The following fields will be set to -1 if: +@@ -286,7 +284,7 @@ auth_shadow ( + RETURN("NO Invalid username"); + } + +- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) { ++ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s", + password, upw->upw_passwd); +-- +cgit v0.9.2 diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch new file mode 100644 index 0000000000..822be9a56d --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch @@ -0,0 +1,20 @@ +--- cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc 2005-05-06 16:05:44.000000000 -0400 ++++ cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc 2005-05-06 16:05:39.000000000 -0400 +@@ -216,7 +216,7 @@ + .Em (All platforms that support OpenLDAP 2.0 or higher) + .Pp + Authenticate against an ldap server. The ldap configuration parameters are +-read from /usr/local/etc/saslauthd.conf. The location of this file can be ++read from /etc/saslauthd.conf. The location of this file can be + changed with the -O parameter. See the LDAP_SASLAUTHD file included with the + distribution for the list of available parameters. + .It Li sia +@@ -249,7 +249,7 @@ + .Bl -tag -width "/run/saslauthd/mux" + .It Pa /run/saslauthd/mux + The default communications socket. +-.It Pa /usr/local/etc/saslauthd.conf ++.It Pa /etc/saslauthd.conf + The default configuration file for ldap support. + .El + .Sh SEE ALSO diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch new file mode 100644 index 0000000000..006962bd24 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch @@ -0,0 +1,120 @@ +Prefer types in to our own, because it removes file content +conflicts between 32- and 64-bit architectures. RFEd as #2829. + +--- cyrus-sasl-2.1.21/configure.in 2006-05-16 07:37:52.000000000 -0400 ++++ cyrus-sasl-2.1.21/configure.in 2006-05-16 07:37:52.000000000 -0400 +@@ -1083,6 +1083,10 @@ + AC_HEADER_DIRENT + AC_HEADER_SYS_WAIT + AC_CHECK_HEADERS(des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h) ++AC_CHECK_TYPES([long long, int8_t, uint8_t, int16_t, uint16_t, int32_t, uint32_t, int64_t, uint64_t],,,[ ++#ifdef HAVE_INTTYPES_H ++#include ++#endif]) + + IPv6_CHECK_SS_FAMILY() + IPv6_CHECK_SA_LEN() +--- cyrus-sasl-2.1.21/include/makemd5.c 2003-02-13 14:55:52.000000000 -0500 ++++ cyrus-sasl-2.1.21/include/makemd5.c 2006-05-16 07:45:08.000000000 -0400 +@@ -82,12 +82,19 @@ + */ + + ++#ifdef HAVE_CONFIG_H ++#include "../config.h" ++#endif + + #include + #include + #include + #include + ++#ifdef HAVE_INTTYPES_H ++#include ++#endif ++ + + static void + my_strupr(char *s) +@@ -122,6 +129,18 @@ + static void + try_signed(FILE *f, int len) + { ++#ifdef HAVE_INT8_T ++ BITSIZE(int8_t); ++#endif ++#ifdef HAVE_INT16_T ++ BITSIZE(int16_t); ++#endif ++#ifdef HAVE_INT32_T ++ BITSIZE(int32_t); ++#endif ++#ifdef HAVE_INT64_T ++ BITSIZE(int64_t); ++#endif + BITSIZE(signed char); + BITSIZE(short); + BITSIZE(int); +@@ -135,6 +154,18 @@ + static void + try_unsigned(FILE *f, int len) + { ++#ifdef HAVE_UINT8_T ++ BITSIZE(uint8_t); ++#endif ++#ifdef HAVE_UINT16_T ++ BITSIZE(uint16_t); ++#endif ++#ifdef HAVE_UINT32_T ++ BITSIZE(uint32_t); ++#endif ++#ifdef HAVE_UINT64_T ++ BITSIZE(uint64_t); ++#endif + BITSIZE(unsigned char); + BITSIZE(unsigned short); + BITSIZE(unsigned int); +@@ -165,6 +196,11 @@ + "/* POINTER defines a generic pointer type */\n" + "typedef unsigned char *POINTER;\n" + "\n" ++#ifdef HAVE_INTTYPES_H ++ "/* We try to define integer types for our use */\n" ++ "#include \n" ++ "\n" ++#endif + ); + return 1; + } +@@ -212,31 +248,15 @@ + + print_pre(f); + +-#ifndef HAVE_INT8_T + try_signed (f, 8); +-#endif /* HAVE_INT8_T */ +-#ifndef HAVE_INT16_T + try_signed (f, 16); +-#endif /* HAVE_INT16_T */ +-#ifndef HAVE_INT32_T + try_signed (f, 32); +-#endif /* HAVE_INT32_T */ +-#ifndef HAVE_INT64_T + try_signed (f, 64); +-#endif /* HAVE_INT64_T */ + +-#ifndef HAVE_U_INT8_T + try_unsigned (f, 8); +-#endif /* HAVE_INT8_T */ +-#ifndef HAVE_U_INT16_T + try_unsigned (f, 16); +-#endif /* HAVE_U_INT16_T */ +-#ifndef HAVE_U_INT32_T + try_unsigned (f, 32); +-#endif /* HAVE_U_INT32_T */ +-#ifndef HAVE_U_INT64_T + try_unsigned (f, 64); +-#endif /* HAVE_U_INT64_T */ + + print_post(f); + diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch new file mode 100644 index 0000000000..1294cb5077 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch @@ -0,0 +1,11 @@ +--- saslauthd/configure.in.orig 2006-05-23 15:53:17.000000000 -0700 ++++ saslauthd/configure.in 2006-05-23 15:53:33.000000000 -0700 +@@ -77,7 +77,7 @@ + AC_DEFINE(AUTH_SASLDB,[],[Include SASLdb Support]) + SASL_DB_PATH_CHECK() + SASL_DB_CHECK() +- SASL_DB_LIB="$SASL_DB_LIB ../sasldb/.libs/libsasldb.al" ++ SASL_DB_LIB="../sasldb/.libs/libsasldb.a $SASL_DB_LIB" + fi + + AC_ARG_ENABLE(httpform, [ --enable-httpform enable HTTP form authentication [[no]] ], diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch new file mode 100644 index 0000000000..09e23d7bc5 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch @@ -0,0 +1,26 @@ +diff -up cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 cyrus-sasl-2.1.22/config/kerberos_v4.m4 +--- cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 2005-05-07 06:14:55.000000000 +0200 ++++ cyrus-sasl-2.1.22/config/kerberos_v4.m4 2008-08-14 23:41:26.000000000 +0200 +@@ -102,7 +102,6 @@ AC_DEFUN([SASL_KERBEROS_V4_CHK], [ + if test -n "${cyrus_krbinclude}"; then + CPPFLAGS="$CPPFLAGS -I${cyrus_krbinclude}" + fi +- LDFLAGS="$LDFLAGS -L$krb4/lib" + fi + + if test "$with_des" != no; then +diff -up cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 cyrus-sasl-2.1.22/plugins/kerberos4.c +--- cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 2005-01-10 08:08:53.000000000 +0100 ++++ cyrus-sasl-2.1.22/plugins/kerberos4.c 2008-08-14 23:36:33.000000000 +0200 +@@ -49,11 +49,7 @@ + #include + + #ifdef WITH_DES +-# ifdef WITH_SSL_DES +-# include +-# else + # include +-# endif /* WITH_SSL_DES */ + #endif /* WITH_DES */ + + #ifdef WIN32 diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch new file mode 100644 index 0000000000..82c6c826c1 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch @@ -0,0 +1,25 @@ +commit c9447e1c3ffba88783e5d9396b832be82d3c78fc +Author: Kazuo Ito +Date: Wed Dec 10 12:03:29 2008 +0900 + + support for LDAP_OPT_TIMEOUT + + OpenLDAP since 2.4 implements support for this option in ldap_result(), + among other things. + +diff --git a/saslauthd/lak.c b/saslauthd/lak.c +index 803d51f..8714265 100644 +--- a/saslauthd/lak.c ++++ b/saslauthd/lak.c +@@ -833,6 +833,11 @@ static int lak_connect( + syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_NETWORK_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec); + } + ++ rc = ldap_set_option(lak->ld, LDAP_OPT_TIMEOUT, &(lak->conf->timeout)); ++ if (rc != LDAP_OPT_SUCCESS) { ++ syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec); ++ } ++ + rc = ldap_set_option(lak->ld, LDAP_OPT_TIMELIMIT, &(lak->conf->time_limit)); + if (rc != LDAP_OPT_SUCCESS) { + syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMELIMIT %d.", lak->conf->time_limit); diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch new file mode 100644 index 0000000000..4f7b04f135 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch @@ -0,0 +1,22 @@ +fix missing prototype warnings + +--- cyrus-sasl-2.1.22/lib/auxprop.c ++++ cyrus-sasl-2.1.22/lib/auxprop.c +@@ -43,6 +43,7 @@ + */ + + #include ++#include + #include + #include + #include +--- cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c ++++ cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c +@@ -24,6 +24,7 @@ OF OR IN CONNECTION WITH THE USE OR PERF + ******************************************************************/ + + #include ++#include + + extern char *crypt(); + diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch new file mode 100644 index 0000000000..5a16187f01 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch @@ -0,0 +1,37 @@ +diff -up cyrus-sasl-2.1.23/mac/libdes/src/des_crypt.man cyrus-sasl-2.1.23/mac/libdes/src/des_crypt +diff -up cyrus-sasl-2.1.23/mac/libdes/src/des.man cyrus-sasl-2.1.23/mac/libdes/src/des +diff -up cyrus-sasl-2.1.23/man/Makefile.am.man cyrus-sasl-2.1.23/man/Makefile.am +--- cyrus-sasl-2.1.23/man/Makefile.am.man 2010-02-05 10:40:17.000000000 +0100 ++++ cyrus-sasl-2.1.23/man/Makefile.am 2010-02-05 10:40:47.000000000 +0100 +@@ -54,6 +54,6 @@ man_MANS = sasl_authorize_t.3 sasl_done. + sasl_auxprop_getctx.3 sasl_auxprop.3 sasl_idle.3 \ + sasl_errdetail.3 sasl_user_exists.3 sasl_setpass.3 \ + sasl_server_userdb_checkpass_t.3 sasl_server_userdb_setpass_t.3 \ +- sasl_global_listmech.3 sasl_getconfpath_t.3 ++ sasl_global_listmech.3 sasl_getconfpath_t.3 testsaslauthd.8 + + EXTRA_DIST = $(man_MANS) +diff -up cyrus-sasl-2.1.23/man/testsaslauthd.8.man cyrus-sasl-2.1.23/man/testsaslauthd.8 +--- cyrus-sasl-2.1.23/man/testsaslauthd.8.man 2010-02-05 10:40:07.000000000 +0100 ++++ cyrus-sasl-2.1.23/man/testsaslauthd.8 2010-02-05 09:48:43.000000000 +0100 +@@ -0,0 +1,20 @@ ++.\" Hey, EMACS: -*- nroff -*- ++.TH TESTSASLAUTHD 8 "14 October 2006" ++.SH NAME ++testsaslauthd \- test utility for the SASL authentication server ++.SH SYNOPSIS ++.B testsaslauthd ++.RI "[ " \(hyr " " realm " ] [ " \(hys " " servicename " ] [ " \(hyf " " socket " " path " ] [ " \(hyR " " repeatnum " ]" ++.SH DESCRIPTION ++This manual page documents briefly the ++.B testsaslauthd ++command. ++.PP ++.SH SEE ALSO ++.BR saslauthd (8). ++.br ++.SH AUTHOR ++testsaslauthd was written by Carnegie Mellon University. ++.PP ++This manual page was written by Roberto C. Sanchez , ++for the Debian project (but may be used by others). diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch new file mode 100644 index 0000000000..390b5176a4 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch @@ -0,0 +1,36 @@ +diff --git a/cmulocal/sasl2.m4 b/cmulocal/sasl2.m4 +index 3c2841a..b086b8f 100644 +--- a/cmulocal/sasl2.m4 ++++ b/cmulocal/sasl2.m4 +@@ -269,6 +269,18 @@ if test "$gssapi" != no; then + cmu_save_LIBS="$LIBS" + LIBS="$LIBS $GSSAPIBASE_LIBS" + AC_CHECK_FUNCS(gsskrb5_register_acceptor_identity) ++ if test "$ac_cv_func_gsskrb5_register_acceptor_identity" = no ; then ++ AC_CHECK_HEADERS(gssapi/gssapi_krb5.h) ++ if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then ++ AC_CHECK_DECL(gsskrb5_register_acceptor_identity, ++ [AC_DEFINE(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY,1, ++ [Define if your GSSAPI implementation defines gsskrb5_register_acceptor_identity])],, ++ [ ++ AC_INCLUDES_DEFAULT ++ #include ++ ]) ++ fi ++ fi + AC_CHECK_FUNCS(gss_decapsulate_token) + AC_CHECK_FUNCS(gss_encapsulate_token) + AC_CHECK_FUNCS(gss_oid_equal) +diff --git a/plugins/gssapi.c b/plugins/gssapi.c +index 6be9d23..e6fcf46 100644 +--- a/plugins/gssapi.c ++++ b/plugins/gssapi.c +@@ -51,6 +51,8 @@ + #include + #endif + ++#include ++ + #ifdef WIN32 + # include + diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch new file mode 100644 index 0000000000..7028db6fe7 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch @@ -0,0 +1,19 @@ +--- cmulocal/cyrus.m4~ 2014-01-09 11:31:10.423302394 +0100 ++++ cmulocal/cyrus.m4 2014-01-09 11:31:56.823302243 +0100 +@@ -32,14 +32,5 @@ + dnl runpath initialization + AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [ + # CMU GUESS RUNPATH SWITCH +- AC_CACHE_CHECK(for runpath switch, andrew_cv_runpath_switch, [ +- # first, try -R +- SAVE_LDFLAGS="${LDFLAGS}" +- LDFLAGS="-R /usr/lib" +- AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-R"], [ +- LDFLAGS="-Wl,-rpath,/usr/lib" +- AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-Wl,-rpath,"], +- [andrew_cv_runpath_switch="none"]) +- ]) +- LDFLAGS="${SAVE_LDFLAGS}" +- ])]) ++ andrew_runpath_switch="none" ++ ]) diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch new file mode 100644 index 0000000000..a836d8fb4e --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch @@ -0,0 +1,13 @@ +diff --git a/configure.in b/configure.in +index e70c99a..60f366c 100644 +--- a/configure.in ++++ b/configure.in +@@ -1416,7 +1416,7 @@ inline static unsigned int sleep(unsigned int seconds) { + #endif /* CONFIG_H */ + ]) + +-AM_CONFIG_HEADER(config.h) ++AC_CONFIG_HEADERS(config.h) + + AC_OUTPUT(Makefile + libsasl2.pc diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch new file mode 100644 index 0000000000..af88e81ed8 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch @@ -0,0 +1,51 @@ +commit 26dcfb2d7176b78e70757aa5d01951a28ca217c7 +Author: Alexey Melnikov +Date: Fri Jul 5 16:37:59 2013 +0100 + + Treat SCRAM-SHA-1/DIGEST-MD5 as more secure than PLAIN when selecting the best client side SASL mechanism + + Both SCRAM-SHA-1 & DIGEST-MD5 are lacking SASL_SEC_PASS_CREDENTIALS security + flag, which prevented them from being chosen over PLAIN when PLAIN is selected + as the best mechanism first. For example the problem can be observed when + the server advertises "PLAIN DIGEST-MD5 SCRAM-SHA-1" (PLAIN just has to be + returned before SCRAM/DIGEST.) + + Cyrus SASL bug # 3793 + +diff --git a/lib/client.c b/lib/client.c +index 62dfb0b..31fe346 100644 +--- a/lib/client.c ++++ b/lib/client.c +@@ -658,6 +658,20 @@ _sasl_cbinding_disp(sasl_client_params_t *cparams, + return SASL_OK; + } + ++static int ++_sasl_are_current_security_flags_worse_then_best(unsigned best_security_flags, ++ unsigned current_security_flags) ++{ ++ /* We don't qualify SASL_SEC_PASS_CREDENTIALS as "secure" flag */ ++ best_security_flags &= ~SASL_SEC_PASS_CREDENTIALS; ++ ++ if ((current_security_flags ^ best_security_flags) & best_security_flags) { ++ return 1; ++ } else { ++ return 0; ++ } ++} ++ + /* select a mechanism for a connection + * mechlist -- mechanisms server has available (punctuation ignored) + * secret -- optional secret from previous session +@@ -823,8 +837,9 @@ int sasl_client_start(sasl_conn_t *conn, + */ + + if (bestm && +- ((m->m.plug->security_flags ^ bestm->m.plug->security_flags) & +- bestm->m.plug->security_flags)) { ++ _sasl_are_current_security_flags_worse_then_best( ++ bestm->m.plug->security_flags, ++ m->m.plug->security_flags)) { + break; + } + diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch new file mode 100644 index 0000000000..3a405f6541 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch @@ -0,0 +1,59 @@ +diff -up cyrus-sasl-2.1.26/lib/Makefile.am.relro cyrus-sasl-2.1.26/lib/Makefile.am +--- cyrus-sasl-2.1.26/lib/Makefile.am.relro 2012-10-12 16:05:48.000000000 +0200 ++++ cyrus-sasl-2.1.26/lib/Makefile.am 2013-02-11 14:18:01.749053772 +0100 +@@ -64,7 +64,7 @@ LIB_DOOR= @LIB_DOOR@ + lib_LTLIBRARIES = libsasl2.la + + libsasl2_la_SOURCES = $(common_sources) $(common_headers) +-libsasl2_la_LDFLAGS = -version-info $(sasl_version) ++libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version) + libsasl2_la_DEPENDENCIES = $(LTLIBOBJS) + libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR) + +diff -up cyrus-sasl-2.1.26/lib/Makefile.in.relro cyrus-sasl-2.1.26/lib/Makefile.in +--- cyrus-sasl-2.1.26/lib/Makefile.in.relro 2013-11-13 16:55:09.606555125 +0100 ++++ cyrus-sasl-2.1.26/lib/Makefile.in 2013-11-13 16:56:43.331096795 +0100 +@@ -330,7 +330,7 @@ common_headers = saslint.h + common_sources = auxprop.c canonusr.c checkpw.c client.c common.c config.c external.c md5.c saslutil.c server.c seterror.c dlopen.c ../plugins/plugin_common.c + lib_LTLIBRARIES = libsasl2.la + libsasl2_la_SOURCES = $(common_sources) $(common_headers) +-libsasl2_la_LDFLAGS = -version-info $(sasl_version) ++libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version) + libsasl2_la_DEPENDENCIES = $(LTLIBOBJS) + libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR) + @MACOSX_TRUE@framedir = /Library/Frameworks/SASL2.framework +diff -up cyrus-sasl-2.1.26/plugins/Makefile.am.relro cyrus-sasl-2.1.26/plugins/Makefile.am +--- cyrus-sasl-2.1.26/plugins/Makefile.am.relro 2012-10-12 16:05:48.000000000 +0200 ++++ cyrus-sasl-2.1.26/plugins/Makefile.am 2013-02-11 14:18:01.749053772 +0100 +@@ -50,7 +50,7 @@ + plugin_version = 3:0:0 + + INCLUDES=-I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include +-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) ++AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) + + COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@ + +diff -up cyrus-sasl-2.1.26/plugins/Makefile.in.relro cyrus-sasl-2.1.26/plugins/Makefile.in +--- cyrus-sasl-2.1.26/plugins/Makefile.in.relro 2013-11-13 16:57:08.430974081 +0100 ++++ cyrus-sasl-2.1.26/plugins/Makefile.in 2013-11-13 16:57:58.911727846 +0100 +@@ -364,7 +364,7 @@ top_srcdir = @top_srcdir@ + # CURRENT:REVISION:AGE + plugin_version = 3:0:0 + INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include +-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) ++AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) + COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@ + EXTRA_DIST = makeinit.sh NTMakefile + noinst_SCRIPTS = makeinit.sh +diff -up cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro cyrus-sasl-2.1.26/saslauthd/Makefile.am +--- cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro 2013-02-11 14:18:36.910900647 +0100 ++++ cyrus-sasl-2.1.26/saslauthd/Makefile.am 2013-02-11 14:20:17.336463915 +0100 +@@ -17,6 +17,7 @@ saslauthd_DEPENDENCIES = saslauthd-main. + saslauthd_LDADD = @SASL_KRB_LIB@ \ + @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ + @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ ++saslauthd_LDFLAGS = -pie -Wl,-z,now + + testsaslauthd_SOURCES = testsaslauthd.c utils.c + testsaslauthd_LDADD = @LIB_SOCKET@ diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch new file mode 100644 index 0000000000..cde823835b --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch @@ -0,0 +1,12 @@ +diff -up cyrus-sasl-2.1.26/include/sasl.h.size_t cyrus-sasl-2.1.26/include/sasl.h +--- cyrus-sasl-2.1.26/include/sasl.h.size_t 2012-10-12 09:05:48.000000000 -0500 ++++ cyrus-sasl-2.1.26/include/sasl.h 2013-01-31 13:21:04.007739327 -0600 +@@ -223,6 +223,8 @@ extern "C" { + * they must be called before all other SASL functions: + */ + ++#include ++ + /* memory allocation functions which may optionally be replaced: + */ + typedef void *sasl_malloc_t(size_t); diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch new file mode 100644 index 0000000000..f7127bb0d9 --- /dev/null +++ b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch @@ -0,0 +1,74 @@ +diff -up cyrus-sasl-2.1.26/lib/server.c.warnings cyrus-sasl-2.1.26/lib/server.c +--- cyrus-sasl-2.1.26/lib/server.c.warnings 2012-10-12 16:05:48.000000000 +0200 ++++ cyrus-sasl-2.1.26/lib/server.c 2012-12-20 17:49:39.620254792 +0100 +@@ -650,7 +650,7 @@ static int load_config(const sasl_callba + goto done; + } + +- snprintf(config_filename, len, "%.*s%c%s.conf", path_len, path_to_config, ++ snprintf(config_filename, len, "%.*s%c%s.conf", (int)path_len, path_to_config, + HIER_DELIMITER, global_callbacks.appname); + + /* Ask the application if it's safe to use this file */ +diff -up cyrus-sasl-2.1.26/plugins/gssapi.c.warnings cyrus-sasl-2.1.26/plugins/gssapi.c +--- cyrus-sasl-2.1.26/plugins/gssapi.c.warnings 2012-01-28 00:31:36.000000000 +0100 ++++ cyrus-sasl-2.1.26/plugins/gssapi.c 2012-12-20 17:49:39.620254792 +0100 +@@ -202,7 +202,8 @@ sasl_gss_seterror_(const sasl_utils_t *u + OM_uint32 msg_ctx; + int ret; + char *out = NULL; +- size_t len, curlen = 0; ++ size_t len; ++ unsigned curlen = 0; + const char prefix[] = "GSSAPI Error: "; + + if (!utils) return SASL_OK; +diff -up cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings cyrus-sasl-2.1.26/plugins/ldapdb.c +--- cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings 2012-01-28 00:31:36.000000000 +0100 ++++ cyrus-sasl-2.1.26/plugins/ldapdb.c 2012-12-20 17:49:39.621254788 +0100 +@@ -22,6 +22,7 @@ + + #include "plugin_common.h" + ++#define LDAP_DEPRECATED 1 + #include + + static char ldapdb[] = "ldapdb"; +diff -up cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings cyrus-sasl-2.1.26/plugins/plugin_common.c +--- cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings 2013-09-03 14:40:35.181455452 +0200 ++++ cyrus-sasl-2.1.26/plugins/plugin_common.c 2013-09-03 14:40:38.320441024 +0200 +@@ -94,7 +94,7 @@ static void sockaddr_unmapped( + if (!IN6_IS_ADDR_V4MAPPED((&sin6->sin6_addr))) + return; + sin4 = (struct sockaddr_in *)sa; +- addr = *(uint32_t *)&sin6->sin6_addr.s6_addr[12]; ++ addr = *(uint32_t *)&sin6->sin6_addr.s6_addr32[3]; + port = sin6->sin6_port; + memset(sin4, 0, sizeof(struct sockaddr_in)); + sin4->sin_addr.s_addr = addr; +diff -up cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_httpform.c +--- cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings 2012-10-12 16:05:48.000000000 +0200 ++++ cyrus-sasl-2.1.26/saslauthd/auth_httpform.c 2013-09-03 14:39:25.411776109 +0200 +@@ -574,7 +574,7 @@ auth_httpform ( + "Content-Type: application/x-www-form-urlencoded" CRLF + "Content-Length: %d" TWO_CRLF + "%s", +- r_uri, r_host, r_port, strlen(req), req); ++ r_uri, r_host, r_port, (int)strlen(req), req); + + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "auth_httpform: sending %s %s %s", +diff -up cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_shadow.c +--- cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings 2012-10-12 16:05:48.000000000 +0200 ++++ cyrus-sasl-2.1.26/saslauthd/auth_shadow.c 2012-12-20 17:49:39.621254788 +0100 +@@ -70,6 +70,10 @@ + # include + # endif /* ! HAVE_GETUSERPW */ + ++# ifdef HAVE_CRYPT_H ++# include ++# endif ++ + # include "auth_shadow.h" + # include "globals.h" + /* END PUBLIC DEPENDENCIES */ diff --git a/server/auth/cyrus-sasl/files/saslauthd.confd b/server/auth/cyrus-sasl/files/saslauthd.confd new file mode 100644 index 0000000000..abbb75f86e --- /dev/null +++ b/server/auth/cyrus-sasl/files/saslauthd.confd @@ -0,0 +1,16 @@ +# Specify the authentications mechanism. +# List: getpwent,kerberos5,pam,rimap,shadow,ldap +# *NOTE* For actual list see: saslauthd -v +SASLAUTHD_OPTS="-a pam" + +# Specify the hostname for remote IMAP server. +# *NOTE* Only needed if rimap auth mech is used. +#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -O localhost" + +# Specify the number of worker processes to create. +#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -n 5" + +# Enable credential cache, cache size, and timeout. +# *NOTE* Size is measured in kilobytes +# Timeout is measured in seconds +#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -c -s 128 -t 30" diff --git a/server/auth/cyrus-sasl/files/saslauthd.pam b/server/auth/cyrus-sasl/files/saslauthd.pam new file mode 100644 index 0000000000..2c5a5347ad --- /dev/null +++ b/server/auth/cyrus-sasl/files/saslauthd.pam @@ -0,0 +1,6 @@ +#%PAM-1.0 + +auth required pam_nologin.so +auth include system-auth +account include system-auth +session include system-auth diff --git a/server/auth/cyrus-sasl/files/tmpfiles.conf b/server/auth/cyrus-sasl/files/tmpfiles.conf new file mode 100644 index 0000000000..7258b1a9ff --- /dev/null +++ b/server/auth/cyrus-sasl/files/tmpfiles.conf @@ -0,0 +1 @@ +d /run/saslauthd 0755 root root - - diff --git a/server/auth/cyrus-sasl/pspec.xml b/server/auth/cyrus-sasl/pspec.xml new file mode 100644 index 0000000000..b6ab0d7e00 --- /dev/null +++ b/server/auth/cyrus-sasl/pspec.xml @@ -0,0 +1,129 @@ + + + + + cyrus-sasl + http://asg.web.cmu.edu/sasl/ + + PisiLinux Community + admins@pisilinux.org + + as-is + library + service + The Cyrus SASL (Simple Authentication and Security Layer) + cyrus-sasl is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. + http://cyrusimap.org/releases/cyrus-sasl-2.1.26.tar.gz + + mit-kerberos + + + + CVE-2013-4122.patch + 0011_saslauthd_ac_prog_libtool.patch + 0025_ld_as_needed.patch + 0026_drop_krb5support_dependency.patch + 0030-dont_use_la_files_for_opening_plugins.patch + cyrus-sasl-2.1.20-saslauthd.conf-path.patch + cyrus-sasl-2.1.21-sizes.patch + cyrus-sasl-2.1.22-as-needed.patch + cyrus-sasl-2.1.22-qa.patch + cyrus-sasl-2.1.22-kerberos4.patch + cyrus-sasl-2.1.22-ldap-timeout.patch + cyrus-sasl-2.1.23-man.patch + cyrus-sasl-2.1.26-keytab.patch + cyrus-sasl-2.1.26-no_rpath.patch + cyrus-sasl-2.1.26-obsolete-macro.patch + cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch + cyrus-sasl-2.1.26-relro.patch + cyrus-sasl-2.1.26-size_t.patch + cyrus-sasl-2.1.26-warnings.patch + + + + + cyrus-sasl + + openldap-client + mit-kerberos + + + /etc + /usr/lib/tmpfiles.d/cyrus-sasl.conf + /usr/sbin + /usr/lib + /usr/share/cyrus-sasl-2 + /run + /usr/share/man + /usr/share/doc + + + saslauthd.confd + saslauthd.pam + tmpfiles.conf + + + System.Service + System.Package + + + + + cyrus-sasl-devel + Development files for cyrus-sasl + + cyrus-sasl + + + /usr/include + /usr/lib/pkgconfig + /usr/share/doc/cyrus-sasl/*.txt + /usr/share/man/man3 + + + + + + 2014-07-05 + 2.1.26 + Release bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-01-09 + 2.1.26 + Version bump. Add tmpfiles.conf + Marcin Bojara + marcin@pisilinux.org + + + 2013-07-30 + 2.1.25 + Rebuild + PisiLinux Community + admins@pisilinux.org + + + 2013-05-05 + 2.1.25 + Added some patches and remove unused. + Aydın Demirel + aydin@demirel.web.tr + + + 2013-04-25 + 2.1.25 + Dep Fixed. + PisiLinux Community + admins@pisilinux.org + + + 2012-09-29 + 2.1.25 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/server/auth/cyrus-sasl/translations.xml b/server/auth/cyrus-sasl/translations.xml new file mode 100644 index 0000000000..97378329ca --- /dev/null +++ b/server/auth/cyrus-sasl/translations.xml @@ -0,0 +1,13 @@ + + + + cyrus-sasl + Cyrus basit kimlik tanımlama ve güvenlik katmanı + Cyrus-sasl, bağlantı tabanlı protokoller için kullanılan bir kimlik doğrulama uygulamasıdır. Çoğunlukla Smtp doğrulaması için kullanılır. + + + + cyrus-sasl-devel + cyrus-sasl için geliştirme dosyaları + + diff --git a/server/auth/mit-kerberos/pspec.xml b/server/auth/mit-kerberos/pspec.xml index ed87ae8e84..010e9862c2 100644 --- a/server/auth/mit-kerberos/pspec.xml +++ b/server/auth/mit-kerberos/pspec.xml @@ -26,7 +26,7 @@ krb5-config_LDFLAGS.patch - + rebuild-configure-scripts.patch fix-python-detection.patch diff --git a/server/database/postgresql/actions.py b/server/database/postgresql/actions.py index 437615bb7b..e76141a115 100644 --- a/server/database/postgresql/actions.py +++ b/server/database/postgresql/actions.py @@ -21,7 +21,7 @@ def setup(): --with-pam \ --with-libxml \ --with-libxslt \ - --with-ldap \ + --without-ldap \ --enable-integer-datetimes \ --enable-thread-safety \ --enable-depend \ diff --git a/server/database/postgresql/pspec.xml b/server/database/postgresql/pspec.xml index 316334eb63..8ece19e861 100644 --- a/server/database/postgresql/pspec.xml +++ b/server/database/postgresql/pspec.xml @@ -15,13 +15,15 @@ https://ftp.postgresql.org/pub/source/v9.3.9/postgresql-9.3.9.tar.bz2 mit-kerberos - pam-devel + e2fsprogs-devel + pam-devel readline-devel zlib-devel + python-devel openssl-devel tcl-devel - libxslt - libxml2 + libxslt-devel + libxml2-devel diff --git a/server/openldap/actions.py b/server/openldap/actions.py new file mode 100644 index 0000000000..3623aae981 --- /dev/null +++ b/server/openldap/actions.py @@ -0,0 +1,100 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +KeepSpecial = ["libtool"] + +def setup(): + pisitools.dosed( + "include/ldap_defaults.h", + "(#define LDAPI_SOCK).*", + '\\1 "/run/openldap/slapd.sock"' + ) + pisitools.dosed("servers/slapd/Makefile.in", "(\$\(DESTDIR\))\$\(localstatedir\)(\/run)", r"\1\2") + + pisitools.flags.add("-D_REENTRANT -D_GNU_SOURCE -fPIC -Wl,--as-needed -DLDAP_CONNECTIONLESS") + #pisitools.ldflags.add("-pie") + + options = "--prefix=/usr \ + --enable-bdb \ + --enable-hdb=mod \ + --enable-slapd \ + --enable-passwd=mod \ + --enable-dnssrv=mod \ + --enable-ldap \ + --enable-wrappers \ + --enable-meta=mod \ + --enable-monitor=mod \ + --enable-null=mod \ + --enable-shell=mod \ + --enable-rewrite \ + --enable-rlookups \ + --enable-aci \ + --enable-modules \ + --enable-cleartext \ + --enable-lmpasswd \ + --enable-spasswd \ + --enable-slapi \ + --enable-dyngroup \ + --enable-proxycache \ + --enable-perl \ + --enable-syslog \ + --enable-dynamic \ + --enable-local \ + --enable-proctitle \ + --enable-overlays=mod \ + --with-pic \ + --with-cyrus-sasl \ + --with-threads \ + --without-fetch \ + --enable-crypt \ + --enable-ipv6 \ + --enable-dynacl \ + --enable-shared \ + --disable-static \ + --disable-slp \ + --localstatedir=/var/lib" + + if get.buildTYPE() == "emul32": + options += " --prefix=/emul32 \ + --libdir=/usr/lib32 \ + --libexecdir=/emul32/libexec \ + --disable-bdb \ + --disable-hdb \ + --disable-wrappers \ + --disable-spasswd \ + --disable-perl \ + --with-tls \ + --without-cyrus-sasl" + else: options += " --with-tls=moznss" + + shelltools.export("AUTOMAKE", "/bin/true") + autotools.autoreconf("-fi") + autotools.configure(options) + pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ") + +def build(): + autotools.make("-j1") + +def install(): + if get.buildTYPE() == "emul32": + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + return + + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + + pisitools.dodir("/run/openldap") + pisitools.dodir("/etc/openldap/ssl") + + pisitools.dodoc("ANNOUNCEMENT", "CHANGES", "COPYRIGHT", "README", "LICENSE") + + pisitools.remove("/usr/lib/*.la") + pisitools.remove("/usr/libexec/openldap/*.la") diff --git a/server/openldap/comar/package.py b/server/openldap/comar/package.py new file mode 100644 index 0000000000..4fb89377f2 --- /dev/null +++ b/server/openldap/comar/package.py @@ -0,0 +1,17 @@ +#!/usr/bin/python + +import os +import pwd +import grp + +def postInstall(fromVersion, fromRelease, toVersion, toRelease): + os.system("/bin/chown ldap:ldap /var/lib/openldap-data") + os.system("/bin/chown ldap:ldap /var/lib/openldap-slurp") + os.system("/bin/chown ldap:ldap /run/openldap") + os.system("/bin/chown root:ldap /etc/openldap/slapd.conf") + os.system("/bin/chown root:ldap /etc/openldap/slapd.conf.default") + os.system("/bin/chmod 0700 /var/lib/openldap-data") + os.system("/bin/chmod 0700 /var/lib/openldap-slurp") + os.system("/bin/chmod 0755 /run/openldap") + os.system("/bin/chmod 0640 /etc/openldap/slapd.conf") + os.system("/bin/chmod 0640 /etc/openldap/slapd.conf.default") diff --git a/server/openldap/comar/slapd.py b/server/openldap/comar/slapd.py new file mode 100644 index 0000000000..768adf7aef --- /dev/null +++ b/server/openldap/comar/slapd.py @@ -0,0 +1,23 @@ +from comar.service import * + +serviceType = "server" +serviceDesc = _({"en": "OpenLDAP Server", + "tr": "OpenLDAP Sunucusu"}) +serviceConf = "slapd" + +def start(): + import os + os.environ["LC_ALL"] = "C" + os.environ["LANG"] = "C" + + startService(command="/usr/libexec/slapd", + args="-u ldap -g ldap %s" % config.get("OPTS", ""), + pidfile="/run/openldap/slapd.pid", + donotify=True) + +def stop(): + stopService(pidfile="/run/openldap/slapd.pid", + donotify=True) + +def status(): + return isServiceRunning("/run/openldap/slapd.pid") diff --git a/server/openldap/comar/slurpd.py b/server/openldap/comar/slurpd.py new file mode 100644 index 0000000000..dcc9a1f7ca --- /dev/null +++ b/server/openldap/comar/slurpd.py @@ -0,0 +1,17 @@ +# -*- coding: utf-8 -*- +from comar.service import * + +serviceType = "server" +serviceDesc = _({"en": "Slurpd Daemon", + "tr": "Slurpd Servisi"}) + +def start(): + startService(command="/usr/libexec/slurpd", + donotify=True) + +def stop(): + stopService(command="/usr/libexec/slurpd", + donotify=True) + +def status(): + return isServiceRunning(command="/usr/libexec/slurpd") diff --git a/server/openldap/files/fedora/openldap-autoconf-pkgconfig-nss.patch b/server/openldap/files/fedora/openldap-autoconf-pkgconfig-nss.patch new file mode 100644 index 0000000000..8b4bb199ca --- /dev/null +++ b/server/openldap/files/fedora/openldap-autoconf-pkgconfig-nss.patch @@ -0,0 +1,49 @@ +Use pkg-config for Mozilla NSS library detection + +Author: Jan Vcelak + +--- + configure.in | 22 +++++----------------- + 1 file changed, 5 insertions(+), 17 deletions(-) + +diff --git a/configure.in b/configure.in +index ecffe30..2a9cfb4 100644 +--- a/configure.in ++++ b/configure.in +@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then + fi + fi + +-dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3 +-dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs +-dnl are not in the default system location + if test $ol_link_tls = no ; then + if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then +- have_moznss=no +- AC_CHECK_HEADERS([nssutil.h]) +- if test "$ac_cv_header_nssutil_h" = yes ; then +- AC_CHECK_LIB([nss3], [NSS_Initialize], +- [ have_moznss=yes ], [ have_moznss=no ]) +- fi ++ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no]) + +- if test "$have_moznss" = yes ; then ++ if test $have_moznss = yes ; then + ol_with_tls=moznss + ol_link_tls=yes +- AC_DEFINE(HAVE_MOZNSS, 1, +- [define if you have MozNSS]) +- TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4" +- else +- if test $ol_with_tls = moznss ; then +- AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)]) +- fi ++ AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS]) ++ TLS_LIBS="$MOZNSS_LIBS" ++ CFLAGS="$CFLAGS $MOZNSS_CFLAGS" + fi + fi + fi +-- +1.7.11.7 + diff --git a/server/openldap/files/fedora/openldap-dns-priority.patch b/server/openldap/files/fedora/openldap-dns-priority.patch new file mode 100644 index 0000000000..8dc0923801 --- /dev/null +++ b/server/openldap/files/fedora/openldap-dns-priority.patch @@ -0,0 +1,192 @@ +Implement priority/weight for DNS SRV records + +From RFC 2782: + + A client MUST attempt to contact the target host with the + lowest-numbered priority it can reach. + +This patch sorts the DNS SRV records by their priority, and +additionally gives records with a larger weight a higher probability +of appearing earlier. This way, the DNS SRV records are tried in the +order of their priority. + +Author: James M Leddy +Upstream ITS: #7027 +Resolves: #733078 + +--- + libraries/libldap/dnssrv.c | 106 ++++++++++++++++++++++++++++++++++---------- + 1 files changed, 83 insertions(+), 23 deletions(-) + +diff --git a/libraries/libldap/dnssrv.c b/libraries/libldap/dnssrv.c +index 16b1544..40f93b4 100644 +--- a/libraries/libldap/dnssrv.c ++++ b/libraries/libldap/dnssrv.c +@@ -174,6 +174,46 @@ int ldap_domain2dn( + return LDAP_SUCCESS; + } + ++#ifdef HAVE_RES_QUERY ++#define DNSBUFSIZ (64*1024) ++typedef struct srv_record { ++ u_short priority; ++ u_short weight; ++ u_short port; ++ char hostname[DNSBUFSIZ]; ++} srv_record; ++ ++ ++static int srv_cmp(const void *aa, const void *bb){ ++ srv_record *a=(srv_record *)aa; ++ srv_record *b=(srv_record *)bb; ++ u_long total; ++ ++ if(a->priority < b->priority) { ++ return -1; ++ } ++ if(a->priority > b->priority) { ++ return 1; ++ } ++ if(a->priority == b->priority){ ++ /* targets with same priority are in psudeo random order */ ++ if (a->weight == 0 && b->weight == 0) { ++ if (rand() % 2) { ++ return -1; ++ } else { ++ return 1; ++ } ++ } ++ total = a->weight + b->weight; ++ if (rand() % total < a->weight) { ++ return -1; ++ } else { ++ return 1; ++ } ++ } ++} ++#endif /* HAVE_RES_QUERY */ ++ + /* + * Lookup and return LDAP servers for domain (using the DNS + * SRV record _ldap._tcp.domain). +@@ -183,15 +223,16 @@ int ldap_domain2hostlist( + char **list ) + { + #ifdef HAVE_RES_QUERY +-#define DNSBUFSIZ (64*1024) +- char *request; +- char *hostlist = NULL; ++ char *request; ++ char *hostlist = NULL; ++ srv_record *hostent_head=NULL; ++ int i; + int rc, len, cur = 0; + unsigned char reply[DNSBUFSIZ]; ++ int hostent_count=0; + + assert( domain != NULL ); + assert( list != NULL ); +- + if( *domain == '\0' ) { + return LDAP_PARAM_ERROR; + } +@@ -223,8 +264,7 @@ int ldap_domain2hostlist( + unsigned char *p; + char host[DNSBUFSIZ]; + int status; +- u_short port; +- /* int priority, weight; */ ++ u_short port, priority, weight; + + /* Parse out query */ + p = reply; +@@ -263,40 +303,56 @@ int ldap_domain2hostlist( + size = (p[0] << 8) | p[1]; + p += 2; + if (type == T_SRV) { +- int buflen; + status = dn_expand(reply, reply + len, p + 6, host, sizeof(host)); + if (status < 0) { + goto out; + } +- /* ignore priority and weight for now */ +- /* priority = (p[0] << 8) | p[1]; */ +- /* weight = (p[2] << 8) | p[3]; */ ++ ++ /* Get priority weight and port */ ++ priority = (p[0] << 8) | p[1]; ++ weight = (p[2] << 8) | p[3]; + port = (p[4] << 8) | p[5]; + + if ( port == 0 || host[ 0 ] == '\0' ) { + goto add_size; + } + +- buflen = strlen(host) + STRLENOF(":65355 "); +- hostlist = (char *) LDAP_REALLOC(hostlist, cur + buflen + 1); +- if (hostlist == NULL) { +- rc = LDAP_NO_MEMORY; +- goto out; ++ hostent_head = (srv_record *) LDAP_REALLOC(hostent_head, (hostent_count+1)*(sizeof(srv_record))); ++ if(hostent_head==NULL){ ++ rc=LDAP_NO_MEMORY; ++ goto out; ++ + } +- if (cur > 0) { +- /* not first time around */ +- hostlist[cur++] = ' '; +- } +- cur += sprintf(&hostlist[cur], "%s:%hu", host, port); ++ hostent_head[hostent_count].priority=priority; ++ hostent_head[hostent_count].weight=weight; ++ hostent_head[hostent_count].port=port; ++ strncpy(hostent_head[hostent_count].hostname, host,255); ++ hostent_count=hostent_count+1; + } + add_size:; + p += size; + } + } ++ qsort(hostent_head, hostent_count, sizeof(srv_record), srv_cmp); ++ ++ for(i=0; i0){ ++ hostlist[cur++]=' '; ++ } ++ cur += sprintf(&hostlist[cur], "%s:%hd", hostent_head[i].hostname, hostent_head[i].port); ++ } ++ + if (hostlist == NULL) { +- /* No LDAP servers found in DNS. */ +- rc = LDAP_UNAVAILABLE; +- goto out; ++ /* No LDAP servers found in DNS. */ ++ rc = LDAP_UNAVAILABLE; ++ goto out; + } + + rc = LDAP_SUCCESS; +@@ -308,8 +364,12 @@ add_size:; + if (request != NULL) { + LDAP_FREE(request); + } ++ if (hostent_head != NULL) { ++ LDAP_FREE(hostent_head); ++ } + if (rc != LDAP_SUCCESS && hostlist != NULL) { + LDAP_FREE(hostlist); ++ + } + return rc; + #else +-- +1.7.6 + diff --git a/server/openldap/files/fedora/openldap-ldapi-sasl.patch b/server/openldap/files/fedora/openldap-ldapi-sasl.patch new file mode 100644 index 0000000000..058cc1c32e --- /dev/null +++ b/server/openldap/files/fedora/openldap-ldapi-sasl.patch @@ -0,0 +1,55 @@ +From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 7 May 2013 17:02:57 +0200 +Subject: [PATCH] LDAPI SASL fix + +Resolves: #960222 +--- + libraries/libldap/cyrus.c | 19 ++++++++++++++++--- + 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-) + +diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c +index 28c241b..a9acf36 100644 +--- a/libraries/libldap/cyrus.c ++++ b/libraries/libldap/cyrus.c +@@ -394,6 +394,8 @@ ldap_int_sasl_bind( + struct berval ccred = BER_BVNULL; + int saslrc, rc; + unsigned credlen; ++ char my_hostname[HOST_NAME_MAX + 1]; ++ int free_saslhost = 0; + + Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n", + mechs ? mechs : "", 0, 0 ); +@@ -454,14 +456,25 @@ ldap_int_sasl_bind( + + /* If we don't need to canonicalize just use the host + * from the LDAP URI. ++ * Always use the result of gethostname() for LDAPI. + */ +- if ( nocanon ) ++ if (ld->ld_defconn->lconn_server->lud_scheme != NULL && ++ strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) { ++ rc = gethostname(my_hostname, HOST_NAME_MAX + 1); ++ if (rc == 0) { ++ saslhost = my_hostname; ++ } else { ++ saslhost = "localhost"; ++ } ++ } else if ( nocanon ) + saslhost = ld->ld_defconn->lconn_server->lud_host; +- else ++ else { + saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb, + "localhost" ); ++ free_saslhost = 1; ++ } + rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost ); +- if ( !nocanon ) ++ if ( free_saslhost ) + LDAP_FREE( saslhost ); + } + +-- +1.7.11.7 + diff --git a/server/openldap/files/fedora/openldap-ldaprc-currentdir.patch b/server/openldap/files/fedora/openldap-ldaprc-currentdir.patch new file mode 100644 index 0000000000..420c1f98c5 --- /dev/null +++ b/server/openldap/files/fedora/openldap-ldaprc-currentdir.patch @@ -0,0 +1,20 @@ +Disables opening of ldaprc file in current directory. + +Resolves: #38402 +Upstream: ITS #1131 +Author: Henning Schmiedehausen + +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 8617527..e6b17b4 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -352,9 +352,6 @@ static void openldap_ldap_init_w_userconf(const char *file) + if(path != NULL) { + LDAP_FREE(path); + } +- +- /* try file */ +- openldap_ldap_init_w_conf(file, 1); + } + + static void openldap_ldap_init_w_env( diff --git a/server/openldap/files/fedora/openldap-nss-certs-from-certdb-fallback-pem.patch b/server/openldap/files/fedora/openldap-nss-certs-from-certdb-fallback-pem.patch new file mode 100644 index 0000000000..d20e48aa64 --- /dev/null +++ b/server/openldap/files/fedora/openldap-nss-certs-from-certdb-fallback-pem.patch @@ -0,0 +1,86 @@ +MozNSS: load certificates from certdb, fallback to PEM + +If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS +certificate database, the backend assumed that the certificate is always +located in the certificate database. This assumption might be wrong. + +This patch makes the library to try to load the certificate from NSS +database and fallback to PEM file if unsuccessfull. + +Author: Jan Vcelak +Upstream ITS: #7389 +Resolves: #857455 + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 6847bea..8339391 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx ) + /* prefer unlocked key, then key from opened certdb, then any other */ + if ( unlocked_key ) + ctx->tc_private_key = unlocked_key; +- else if ( ctx->tc_certdb_slot ) ++ else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem ) + ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg ); + else + ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg ); +@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg ) + } + return -1; + } +- +- ctx->tc_using_pem = PR_TRUE; + } + + NSS_SetDomesticPolicy(); +@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg ) + + /* set up our cert and key, if any */ + if ( lt->lt_certfile ) { +- /* if using the PEM module, load the PEM file specified by lt_certfile */ +- /* otherwise, assume this is the name of a cert already in the db */ +- if ( ctx->tc_using_pem ) { +- /* this sets ctx->tc_certificate to the correct value */ +- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ); +- if ( rc ) { +- return rc; +- } +- } else { ++ ++ /* first search in certdb (lt_certfile is nickname) */ ++ if ( ctx->tc_certdb ) { + char *tmp_certname; + + if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) { +@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg ) + Debug( LDAP_DEBUG_ANY, + "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n", + lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) ); ++ } ++ } ++ ++ /* fallback to PEM module (lt_certfile is filename) */ ++ if ( !ctx->tc_certificate ) { ++ if ( !pem_module && tlsm_init_pem_module() ) { ++ int pem_errcode = PORT_GetError(); ++ Debug( LDAP_DEBUG_ANY, ++ "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n", ++ pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); + return -1; + } ++ ++ /* this sets ctx->tc_certificate to the correct value */ ++ if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) { ++ ctx->tc_using_pem = PR_TRUE; ++ } ++ } ++ ++ if ( ctx->tc_certificate ) { ++ Debug( LDAP_DEBUG_ANY, ++ "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile, ++ ctx->tc_using_pem ? "PEM file" : "moznss database", 0); ++ } else { ++ return -1; + } + } + diff --git a/server/openldap/files/fedora/openldap-nss-ignore-certdb-type-prefix.patch b/server/openldap/files/fedora/openldap-nss-ignore-certdb-type-prefix.patch new file mode 100644 index 0000000000..2fab916e28 --- /dev/null +++ b/server/openldap/files/fedora/openldap-nss-ignore-certdb-type-prefix.patch @@ -0,0 +1,47 @@ +MozNSS: ignore certdb database type prefix when checking existence of the directory + +If the certdb is specified including the database type prefix (e.g. +sql:, dbm:), the prefix has to be ignored when checking the +certificate directory existence. + +Author: Jan Vcelak +Upstream ITS: #7388 +Resolves: #857373 + +--- + libraries/libldap/tls_m.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 49a3f8f..5ee21a2 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) + { + char sep = PR_GetDirectorySeparator(); + char *ptr = NULL; ++ char *chkpath = NULL; + struct PRFileInfo prfi; + PRStatus prc; + +@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) + return; + } + +- prc = PR_GetFileInfo( certdir, &prfi ); ++ /* ignore database type prefix (e.g. sql:, dbm:) if provided */ ++ chkpath = strchr( certdir, ':' ); ++ if ( chkpath != NULL ) { ++ chkpath += 1; ++ } else { ++ chkpath = certdir; ++ } ++ + /* if certdir exists (file or directory) then it cannot specify a prefix */ ++ prc = PR_GetFileInfo( chkpath, &prfi ); + if ( prc == PR_SUCCESS ) { + return; + } +-- +1.7.11.7 + diff --git a/server/openldap/files/fedora/openldap-nss-pk11-freeslot.patch b/server/openldap/files/fedora/openldap-nss-pk11-freeslot.patch new file mode 100644 index 0000000000..9ac541d22f --- /dev/null +++ b/server/openldap/files/fedora/openldap-nss-pk11-freeslot.patch @@ -0,0 +1,27 @@ +Resolves: #929357 + +From 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec Mon Sep 17 00:00:00 2001 +From: Rich Megginson +Date: Thu, 28 Mar 2013 19:05:02 -0600 +Subject: [PATCH] must call PK11_FreeSlot after SECMOD_CloseUserDB to remove ref to slot + +--- + libraries/libldap/tls_m.c | 2 ++ + 1 files changed, 2 insertions(+), 0 deletions(-) + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 072d41d..c59d303 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -2063,6 +2063,8 @@ tlsm_ctx_free ( tls_ctx *ctx ) + "TLS: could not close certdb slot - error %d:%s.\n", + errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 ); + } ++ PK11_FreeSlot( c->tc_certdb_slot ); ++ c->tc_certdb_slot = NULL; + } + PL_strfree( c->tc_pin_file ); + c->tc_pin_file = NULL; +-- +1.7.1 + diff --git a/server/openldap/files/fedora/openldap-nss-regex-search-hashed-cacert-dir.patch b/server/openldap/files/fedora/openldap-nss-regex-search-hashed-cacert-dir.patch new file mode 100644 index 0000000000..03493db2b0 --- /dev/null +++ b/server/openldap/files/fedora/openldap-nss-regex-search-hashed-cacert-dir.patch @@ -0,0 +1,91 @@ +MozNSS: better file name matching for hashed CA certificate directory + +CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name +should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used +to differentiate between two certificates with the same subject name. + +Wit this patch, certificate file names are matched correctly (using regular expressions). + +Author: Jan Vcelak +Upstream ITS: #7374 +Resolves: #852786 + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 5e49fc5..61d71d4 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + #include "ldap-int.h" + #include "ldap-tls.h" +@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods; + + #define PEM_LIBRARY "nsspem" + #define PEM_MODULE "PEM" +-/* hash files for use with cacertdir have this file name suffix */ +-#define PEM_CA_HASH_FILE_SUFFIX ".0" +-#define PEM_CA_HASH_FILE_SUFFIX_LEN 2 ++#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$" + + static SECMODModule *pem_module; + +@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir + PRDir *dir; + PRDirEntry *entry; + PRStatus fistatus = PR_FAILURE; ++ regex_t hashfile_re; + + memset( &fi, 0, sizeof(fi) ); + fistatus = PR_GetFileInfo( cacertdir, &fi ); +@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir + goto done; + } + ++ if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) { ++ Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 ); ++ goto done; ++ } ++ + do { + entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN ); + if ( ( NULL != entry ) && ( NULL != entry->name ) ) { + char *fullpath = NULL; +- char *ptr; ++ int match; + +- ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX ); +- if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) { ++ match = regexec( &hashfile_re, entry->name, 0, NULL, 0 ); ++ if ( match == REG_NOMATCH ) { + Debug( LDAP_DEBUG_TRACE, +- "TLS: file %s does not end in [%s] - does not appear to be a CA certificate " +- "directory file with a properly hashed file name - skipping.\n", +- entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 ); ++ "TLS: skipping '%s' - filename does not have expected format " ++ "(certificate hash with numeric suffix)\n", entry->name, 0, 0 ); ++ continue; ++ } else if ( match != 0 ) { ++ Debug( LDAP_DEBUG_ANY, ++ "TLS: cannot execute regex for CA hash file matching (%d).\n", ++ match, 0, 0 ); + continue; + } ++ + fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name ); + if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) { + Debug( LDAP_DEBUG_TRACE, +@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir + PR_smprintf_free( fullpath ); + } + } while ( NULL != entry ); ++ regfree ( &hashfile_re ); + PR_CloseDir( dir ); + } + done: +-- +1.7.11.4 + diff --git a/server/openldap/files/fedora/openldap-nss-update-list-of-ciphers.patch b/server/openldap/files/fedora/openldap-nss-update-list-of-ciphers.patch new file mode 100644 index 0000000000..d5986c0031 --- /dev/null +++ b/server/openldap/files/fedora/openldap-nss-update-list-of-ciphers.patch @@ -0,0 +1,193 @@ +MozNSS: update list of supported cipher suites + +The updated list includes all ciphers implemented in Mozilla NSS 3.13.15 + +Author: Jan Vcelak +Upstream ITS: #7374 + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 1422ce2..5e49fc5 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -211,27 +211,34 @@ typedef struct { + int num; /* The cipher id */ + int attr; /* cipher attributes: algorithms, etc */ + int version; /* protocol version valid for this cipher */ +- int bits; /* bits of strength */ +- int alg_bits; /* bits of the algorithm */ + int strength; /* LOW, MEDIUM, HIGH */ + int enabled; /* Enabled by default? */ + } cipher_properties; + + /* cipher attributes */ +-#define SSL_kRSA 0x00000001L +-#define SSL_aRSA 0x00000002L +-#define SSL_aDSS 0x00000004L +-#define SSL_DSS SSL_aDSS +-#define SSL_eNULL 0x00000008L +-#define SSL_DES 0x00000010L +-#define SSL_3DES 0x00000020L +-#define SSL_RC4 0x00000040L +-#define SSL_RC2 0x00000080L +-#define SSL_AES 0x00000100L +-#define SSL_MD5 0x00000200L +-#define SSL_SHA1 0x00000400L +-#define SSL_SHA SSL_SHA1 +-#define SSL_RSA (SSL_kRSA|SSL_aRSA) ++#define SSL_kRSA 0x00000001L ++#define SSL_aRSA 0x00000002L ++#define SSL_RSA (SSL_kRSA|SSL_aRSA) ++#define SSL_aDSA 0x00000004L ++#define SSL_DSA SSL_aDSA ++#define SSL_eNULL 0x00000008L ++#define SSL_DES 0x00000010L ++#define SSL_3DES 0x00000020L ++#define SSL_RC4 0x00000040L ++#define SSL_RC2 0x00000080L ++#define SSL_AES128 0x00000100L ++#define SSL_AES256 0x00000200L ++#define SSL_AES (SSL_AES128|SSL_AES256) ++#define SSL_MD5 0x00000400L ++#define SSL_SHA1 0x00000800L ++#define SSL_kEDH 0x00001000L ++#define SSL_CAMELLIA128 0x00002000L ++#define SSL_CAMELLIA256 0x00004000L ++#define SSL_CAMELLIA (SSL_CAMELLIA128|SSL_CAMELLIA256) ++#define SSL_SEED 0x00008000L ++#define SSL_kECDH 0x00010000L ++#define SSL_kECDHE 0x00020000L ++#define SSL_aECDSA 0x00040000L + + /* cipher strength */ + #define SSL_NULL 0x00000001L +@@ -248,29 +255,70 @@ typedef struct { + + /* Cipher translation */ + static cipher_properties ciphers_def[] = { +- /* SSL 2 ciphers */ +- {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED}, +- {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, +- {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, +- {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED}, +- {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, +- {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, +- +- /* SSL3 ciphers */ +- {"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, +- {"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED}, +- {"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED}, +- {"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED}, +- {"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED}, +- {"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED}, +- {"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED}, +- {"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED}, ++ ++ /* ++ * Use the same DEFAULT cipher list as OpenSSL, which is defined as: ALL:!aNULL:!eNULL:!SSLv2 ++ */ ++ ++ /* SSLv2 ciphers */ ++ {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, SSL_LOW, SSL_NOT_ALLOWED}, ++ {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH, SSL_NOT_ALLOWED}, ++ {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_MEDIUM, SSL_NOT_ALLOWED}, ++ {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_MEDIUM, SSL_NOT_ALLOWED}, ++ {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED}, ++ {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED}, ++ ++ /* SSLv3 ciphers */ ++ {"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, SSL_NULL, SSL_NOT_ALLOWED}, ++ {"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL, SSL_NOT_ALLOWED}, ++ {"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW, SSL_ALLOWED}, ++ {"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH, SSL_ALLOWED}, ++ {"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_MEDIUM, SSL_ALLOWED}, ++ {"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, SSL_MEDIUM, SSL_ALLOWED}, ++ {"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, SSL_EXPORT40, SSL_ALLOWED}, ++ {"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_EXPORT40, SSL_ALLOWED}, ++ {"EDH-RSA-DES-CBC-SHA", SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW, SSL_ALLOWED}, ++ {"EDH-RSA-DES-CBC3-SHA", SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH, SSL_ALLOWED}, ++ {"EDH-DSS-DES-CBC-SHA", SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW, SSL_ALLOWED}, ++ {"EDH-DSS-DES-CBC3-SHA", SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH, SSL_ALLOWED}, + + /* TLSv1 ciphers */ +- {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED}, +- {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED}, +- {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED}, +- {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED}, ++ {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, TLS1, SSL_EXPORT56, SSL_ALLOWED}, ++ {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_EXPORT56, SSL_ALLOWED}, ++ {"SEED-SHA", TLS_RSA_WITH_SEED_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED}, ++ {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"CAMELLIA256-SHA", TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"CAMELLIA128-SHA", TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-RSA-AES128-SHA", TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-RSA-AES256-SHA", TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-RSA-CAMELLIA128-SHA", TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-RSA-CAMELLIA256-SHA", TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-DSS-RC4-SHA", TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED}, ++ {"DHE-DSS-AES128-SHA", TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-DSS-AES256-SHA", TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-DSS-CAMELLIA128-SHA", TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"DHE-DSS-CAMELLIA256-SHA", TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDH-RSA-NULL-SHA", TLS_ECDH_RSA_WITH_NULL_SHA, SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED}, ++ {"ECDH-RSA-RC4-SHA", TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED}, ++ {"ECDH-RSA-DES-CBC3-SHA", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDH-RSA-AES128-SHA", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDH-RSA-AES256-SHA", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDH-ECDSA-NULL-SHA", TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED}, ++ {"ECDH-ECDSA-RC4-SHA", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED}, ++ {"ECDH-ECDSA-DES-CBC3-SHA", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDH-ECDSA-AES128-SHA", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDH-ECDSA-AES256-SHA", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDHE-RSA-NULL-SHA", TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED}, ++ {"ECDHE-RSA-RC4-SHA", TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED}, ++ {"ECDHE-RSA-DES-CBC3-SHA", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDHE-RSA-AES128-SHA", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDHE-RSA-AES256-SHA", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDHE-ECDSA-NULL-SHA", TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED}, ++ {"ECDHE-ECDSA-RC4-SHA", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED}, ++ {"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDHE-ECDSA-AES128-SHA", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, ++ {"ECDHE-ECDSA-AES256-SHA", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED}, + }; + + #define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties)) +@@ -577,6 +625,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) + mask |= SSL_RSA; + } else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) { + mask |= SSL_eNULL; ++ } else if (!strcmp(cipher, "AES128")) { ++ mask |= SSL_AES128; ++ } else if (!strcmp(cipher, "AES256")) { ++ mask |= SSL_AES256; + } else if (!strcmp(cipher, "AES")) { + mask |= SSL_AES; + } else if (!strcmp(cipher, "3DES")) { +@@ -591,6 +643,24 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum]) + mask |= SSL_MD5; + } else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) { + mask |= SSL_SHA1; ++ } else if (!strcmp(cipher, "EDH")) { ++ mask |= SSL_kEDH; ++ } else if (!strcmp(cipher, "DSS")) { ++ mask |= SSL_aDSA; ++ } else if (!strcmp(cipher, "CAMELLIA128")) { ++ mask |= SSL_CAMELLIA128; ++ } else if (!strcmp(cipher, "CAMELLIA256")) { ++ mask |= SSL_CAMELLIA256; ++ } else if (!strcmp(cipher, "CAMELLIA")) { ++ mask |= SSL_CAMELLIA; ++ } else if (!strcmp(cipher, "SEED")) { ++ mask |= SSL_SEED; ++ } else if (!strcmp(cipher, "ECDH")) { ++ mask |= SSL_kECDH; ++ } else if (!strcmp(cipher, "ECDHE")) { ++ mask |= SSL_kECDHE; ++ } else if (!strcmp(cipher, "ECDSA")) { ++ mask |= SSL_aECDSA; + } else if (!strcmp(cipher, "SSLv2")) { + protocol |= SSL2; + } else if (!strcmp(cipher, "SSLv3")) { +-- +1.7.11.4 + diff --git a/server/openldap/files/fedora/openldap-reentrant-gethostby.patch b/server/openldap/files/fedora/openldap-reentrant-gethostby.patch new file mode 100644 index 0000000000..140b6e3381 --- /dev/null +++ b/server/openldap/files/fedora/openldap-reentrant-gethostby.patch @@ -0,0 +1,33 @@ +The non-reentrant gethostbyXXXX() functions deadlock if called recursively, for +example if libldap needs to be initialized from within gethostbyXXXX() (which +actually happens if nss_ldap is used for hostname resolution and earlier +modules can't resolve the local host name), so use the reentrant versions of +the functions, even if we're not being compiled for use in libldap_r + +Resolves: #179730 +Author: Jeffery Layton + +diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c +index 373c81c..a012062 100644 +--- a/libraries/libldap/util-int.c ++++ b/libraries/libldap/util-int.c +@@ -52,8 +52,8 @@ extern int h_errno; + #ifndef LDAP_R_COMPILE + # undef HAVE_REENTRANT_FUNCTIONS + # undef HAVE_CTIME_R +-# undef HAVE_GETHOSTBYNAME_R +-# undef HAVE_GETHOSTBYADDR_R ++/* # undef HAVE_GETHOSTBYNAME_R */ ++/* # undef HAVE_GETHOSTBYADDR_R */ + + #else + # include +@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) + #define BUFSTART (1024-32) + #define BUFMAX (32*1024-32) + +-#if defined(LDAP_R_COMPILE) ++#if defined(LDAP_R_COMPILE) || defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R) + static char *safe_realloc( char **buf, int len ); + + #if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R)) diff --git a/server/openldap/files/fedora/openldap-sql-linking.patch b/server/openldap/files/fedora/openldap-sql-linking.patch new file mode 100644 index 0000000000..c7edf8c6d1 --- /dev/null +++ b/server/openldap/files/fedora/openldap-sql-linking.patch @@ -0,0 +1,14 @@ +Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package +independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.) + +--- openldap-2.4.24.orig/build/top.mk ++++ openldap-2.4.24/build/top.mk +@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@ + SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@ + SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@ + +-SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS) ++SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS) + + # Our Defaults + CC = $(AC_CC) diff --git a/server/openldap/files/fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch b/server/openldap/files/fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch new file mode 100644 index 0000000000..ed4f2ad875 --- /dev/null +++ b/server/openldap/files/fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch @@ -0,0 +1,41 @@ +From: Jan-Marek Glogowski +Date: Tue, 18 May 2010 17:47:05 +0200 +Subject: [PATCH] Switch to lt_dlopenadvise() to get RTLD_GLOBAL set. + +Proof of concept for fixing http://bugs.debian.org/327585 +(patch ported from freeradius bug http://bugs.debian.org/416266) + +Resolves: #960048 +--- +--- openldap/servers/slapd/module.c.orig 2010-05-18 17:42:04.000000000 +0200 ++++ openldap/servers/slapd/module.c 2010-05-18 17:45:46.000000000 +0200 +@@ -117,6 +117,20 @@ + return -1; /* not found */ + } + ++static lt_dlhandle slapd_lt_dlopenext_global( const char *filename ) ++{ ++ lt_dlhandle handle = 0; ++ lt_dladvise advise; ++ ++ if (!lt_dladvise_init (&advise) && !lt_dladvise_ext (&advise) ++ && !lt_dladvise_global (&advise)) ++ handle = lt_dlopenadvise (filename, advise); ++ ++ lt_dladvise_destroy (&advise); ++ ++ return handle; ++} ++ + int module_load(const char* file_name, int argc, char *argv[]) + { + module_loaded_t *module; +@@ -180,7 +194,7 @@ + * to calling Debug. This is because Debug is a macro that expands + * into multiple function calls. + */ +- if ((module->lib = lt_dlopenext(file)) == NULL) { ++ if ((module->lib = slapd_lt_dlopenext_global(file)) == NULL) { + error = lt_dlerror(); + #ifdef HAVE_EBCDIC + strcpy( ebuf, error ); diff --git a/server/openldap/files/fedora/openldap-syncrepl-unset-tls-options.patch b/server/openldap/files/fedora/openldap-syncrepl-unset-tls-options.patch new file mode 100644 index 0000000000..156971ad08 --- /dev/null +++ b/server/openldap/files/fedora/openldap-syncrepl-unset-tls-options.patch @@ -0,0 +1,62 @@ +allow unsetting of tls_* syncrepl options + +Author: Patrick Monnerat +Upstream ITS: #7042 +Resolves: #734187 + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 654a4bf..10b993b 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -735,27 +735,27 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) + return 0; + case LDAP_OPT_X_TLS_CACERTFILE: + if ( lo->ldo_tls_cacertfile ) LDAP_FREE( lo->ldo_tls_cacertfile ); +- lo->ldo_tls_cacertfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_cacertfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + case LDAP_OPT_X_TLS_CACERTDIR: + if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir ); +- lo->ldo_tls_cacertdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_cacertdir = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + case LDAP_OPT_X_TLS_CERTFILE: + if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile ); +- lo->ldo_tls_certfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_certfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + case LDAP_OPT_X_TLS_KEYFILE: + if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile ); +- lo->ldo_tls_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_keyfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + case LDAP_OPT_X_TLS_DHFILE: + if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile ); +- lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_dhfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ + if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile ); +- lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_crlfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + case LDAP_OPT_X_TLS_REQUIRE_CERT: + if ( !arg ) return -1; +@@ -783,7 +783,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) + #endif + case LDAP_OPT_X_TLS_CIPHER_SUITE: + if ( lo->ldo_tls_ciphersuite ) LDAP_FREE( lo->ldo_tls_ciphersuite ); +- lo->ldo_tls_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_ciphersuite = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + return 0; + + case LDAP_OPT_X_TLS_PROTOCOL_MIN: +@@ -794,7 +794,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) + if ( ld != NULL ) + return -1; + if ( lo->ldo_tls_randfile ) LDAP_FREE (lo->ldo_tls_randfile ); +- lo->ldo_tls_randfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; ++ lo->ldo_tls_randfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; + break; + case LDAP_OPT_X_TLS_NEWCTX: + if ( !arg ) return -1; diff --git a/server/openldap/files/fedora/openldap-tls-no-reuse-of-tls_session.patch b/server/openldap/files/fedora/openldap-tls-no-reuse-of-tls_session.patch new file mode 100644 index 0000000000..5c397d1ae3 --- /dev/null +++ b/server/openldap/files/fedora/openldap-tls-no-reuse-of-tls_session.patch @@ -0,0 +1,92 @@ +TLS: do not reuse tls_session if hostname check fails + +If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails, +*tls_session is not dropped, but reused when connecting to the second server. + +This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor. +From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling. + +Author: Jan Vcelak +Upstream ITS: #7373 +Resolves: #852476 + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 10b993b..a3cd590 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc ) + */ + + static int +-ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) ++ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host ) + { + Sockbuf *sb = conn->lconn_sb; + int err; +@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn ) + errno = WSAGetLastError(); + #endif + ++ if ( err == 0 ) { ++ err = ldap_pvt_tls_check_hostname( ld, ssl, host ); ++ } ++ + if ( err < 0 ) + { + char buf[256], *msg; +@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in ) + { + tls_session *session = s; + +- return tls_imp->ti_session_chkhost( ld, session, name_in ); ++ if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER && ++ ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) { ++ ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in ); ++ if (ld->ld_errno != LDAP_SUCCESS) { ++ return ld->ld_errno; ++ } ++ } ++ ++ return LDAP_SUCCESS; + } + + int +@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) + #endif /* LDAP_USE_NON_BLOCKING_TLS */ + + ld->ld_errno = LDAP_SUCCESS; +- ret = ldap_int_tls_connect( ld, conn ); ++ ret = ldap_int_tls_connect( ld, conn, host ); + + #ifdef LDAP_USE_NON_BLOCKING_TLS + while ( ret > 0 ) { /* this should only happen for non-blocking io */ +@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) + } else { + /* ldap_int_poll called ldap_pvt_ndelay_off */ + ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb ); +- ret = ldap_int_tls_connect( ld, conn ); ++ ret = ldap_int_tls_connect( ld, conn, host ); + if ( ret > 0 ) { /* need to call tls_connect once more */ + struct timeval curr_time_tv, delta_tv; + +@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv ) + return (ld->ld_errno); + } + +- ssl = ldap_pvt_tls_sb_ctx( sb ); +- assert( ssl != NULL ); +- +- /* +- * compare host with name(s) in certificate +- */ +- if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER && +- ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) { +- ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host ); +- if (ld->ld_errno != LDAP_SUCCESS) { +- return ld->ld_errno; +- } +- } +- + return LDAP_SUCCESS; + } + diff --git a/server/openldap/files/fedora/openldap-userconfig-setgid.patch b/server/openldap/files/fedora/openldap-userconfig-setgid.patch new file mode 100644 index 0000000000..8b9be3014a --- /dev/null +++ b/server/openldap/files/fedora/openldap-userconfig-setgid.patch @@ -0,0 +1,92 @@ + + + +openldap.git - openldap + + + + + + +
+ + + + +
+summaryrefslogtreecommitdiffstats
+ + + +
+
+
path: root/openldap-userconfig-setgid.patch
blob: 70f0d28ecab7c4152aa414adde93e462179ba0f8 (plain) + + +
1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+
Normally, skips reading of user configuration file when running with different effective UID.
+This patch adds the same behavior for GID.
+
+Author: Nalin Dahyabhai <nalin@redhat.com>
+
+diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
+index e6b17b4..fbf4829 100644
+--- a/libraries/libldap/init.c
++++ b/libraries/libldap/init.c
+@@ -678,7 +678,7 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl )
+ 	openldap_ldap_init_w_sysconf(LDAP_CONF_FILE);
+ 
+ #ifdef HAVE_GETEUID
+-	if ( geteuid() != getuid() )
++	if ( geteuid() != getuid() || getegid() != getgid() )
+ 		return;
+ #endif
+ 
+
+
+
generated by cgit v0.9.2 at 2014-01-09 14:22:50 (GMT)
+
+ + diff --git a/server/openldap/files/gencert.sh b/server/openldap/files/gencert.sh new file mode 100644 index 0000000000..d8f74ff21f --- /dev/null +++ b/server/openldap/files/gencert.sh @@ -0,0 +1,111 @@ +#!/bin/sh +# Last update 20050401 - Christian Zoffoli + +VERSION="0.3" +openssl="/usr/bin/openssl" +opensslopts="" +ldapconfdir="/etc/openldap/ssl" +pemfile="${ldapconfdir}/ldap.pem" +randfile="${ldapconfdir}/ldap.rand" +cfgfile="${ldapconfdir}/ldap.cfg" + +function fixperms { + chown root:ldap ${ldapconfdir} -R + find ${ldapconfdir} -type f -exec chmod 640 \{\} \; + chmod 750 ${ldapconfdir} +} + + +if [ ! -x ${openssl} ]; then + exit 0 +fi + +if [ ! -d ${ldapconfdir} ]; then + mkdir -p ${ldapconfdir} +fi + +fixperms + +if [ -f ${pemfile} ]; then + echo "${pemfile} already exist, dying" + exit 0 +fi + + +dd if=/dev/urandom of=$randfile count=1 2>/dev/null + +echo "" +echo "______________________________________________________________________${T_ME}" +echo "" +echo "Creating self-signed certificate -- Version ${VERSION}" +echo "" +echo "______________________________________________________________________${T_ME}" +echo "" + + +COMMONNAME=`hostname` +if [ ! -n "$COMMONNAME" ]; then + COMMONNAME="www.openldap.org" +fi + + +if [ -f ${cfgfile} ]; then + echo "${cfgfile} found, would you like to use it ? (y/n)" + read answer + + case "$answer" in + y|Y) + opensslopts="-batch" + ;; + n|N) + cat >${cfgfile} <&2 + exit 1 +else + echo -e "\nCertificate creation done!" +fi + +if [ -f ${randfile} ]; then + rm -f ${randfile} +fi + +if [ -f ${pemfile} ]; then + fixperms +fi diff --git a/server/openldap/files/openldap-2.4.39-blfs_paths-1.patch b/server/openldap/files/openldap-2.4.39-blfs_paths-1.patch new file mode 100644 index 0000000000..5102904788 --- /dev/null +++ b/server/openldap/files/openldap-2.4.39-blfs_paths-1.patch @@ -0,0 +1,188 @@ +Submitted By: Armin K. +Date: 2012-04-06 +Initial Package Version: 2.4.30 +Upstream Status: BLFS Specific +Origin: Self +Description: Patch changes various installation options, such as ldap database path, + configuration file options, slapd install location, etc. + +--- openldap.orig/doc/man/man5/slapd-bdb.5 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/doc/man/man5/slapd-bdb.5 2012-04-06 00:18:54.171136608 +0200 +@@ -131,7 +131,7 @@ + associated indexes live. + A separate directory must be specified for each database. + The default is +-.BR LOCALSTATEDIR/openldap\-data . ++.BR LOCALSTATEDIR/lib/openldap . + .TP + .B dirtyread + Allow reads of modified but not yet committed data. +--- openldap.orig/doc/man/man5/slapd.conf.5 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/doc/man/man5/slapd.conf.5 2012-04-06 00:18:54.174136671 +0200 +@@ -1987,7 +1987,7 @@ + # The database directory MUST exist prior to + # running slapd AND should only be accessible + # by the slapd/tools. Mode 0700 recommended. +-directory LOCALSTATEDIR/openldap\-data ++directory LOCALSTATEDIR/lib/openldap + # Indices to maintain + index objectClass eq + index cn,sn,mail pres,eq,approx,sub +--- openldap.orig/doc/man/man5/slapd-config.5 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/doc/man/man5/slapd-config.5 2012-04-06 00:18:54.194137078 +0200 +@@ -2029,7 +2029,7 @@ + # The database directory MUST exist prior to + # running slapd AND should only be accessible + # by the slapd/tools. Mode 0700 recommended. +-olcDbDirectory: LOCALSTATEDIR/openldap\-data ++olcDbDirectory: LOCALSTATEDIR/lib/openldap + # Indices to maintain + olcDbIndex: objectClass eq + olcDbIndex: cn,sn,mail pres,eq,approx,sub +--- openldap.orig/include/ldap_defaults.h 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/include/ldap_defaults.h 2012-04-06 00:18:54.200137199 +0200 +@@ -39,7 +39,7 @@ + #define LDAP_ENV_PREFIX "LDAP" + + /* default ldapi:// socket */ +-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi" ++#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi" + + /* + * SLAPD DEFINITIONS +@@ -47,7 +47,7 @@ + /* location of the default slapd config file */ + #define SLAPD_DEFAULT_CONFIGFILE LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf" + #define SLAPD_DEFAULT_CONFIGDIR LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d" +-#define SLAPD_DEFAULT_DB_DIR LDAP_RUNDIR LDAP_DIRSEP "openldap-data" ++#define SLAPD_DEFAULT_DB_DIR LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap" + #define SLAPD_DEFAULT_DB_MODE 0600 + #define SLAPD_DEFAULT_UCDATA LDAP_DATADIR LDAP_DIRSEP "ucdata" + /* default max deref depth for aliases */ +--- openldap.orig/libraries/liblber/Makefile.in 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/libraries/liblber/Makefile.in 2012-04-06 00:18:54.204137280 +0200 +@@ -48,6 +48,6 @@ + + install-local: FORCE + -$(MKDIR) $(DESTDIR)$(libdir) +- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir) ++ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir) + $(LTFINISH) $(DESTDIR)$(libdir) + +--- openldap.orig/libraries/libldap/Makefile.in 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/libraries/libldap/Makefile.in 2012-04-06 00:18:54.204137280 +0200 +@@ -68,7 +68,7 @@ + + install-local: $(CFFILES) FORCE + -$(MKDIR) $(DESTDIR)$(libdir) +- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir) ++ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir) + $(LTFINISH) $(DESTDIR)$(libdir) + -$(MKDIR) $(DESTDIR)$(sysconfdir) + @for i in $(CFFILES); do \ +--- openldap.orig/libraries/libldap_r/Makefile.in 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/libraries/libldap_r/Makefile.in 2012-04-06 00:18:54.208137362 +0200 +@@ -83,6 +83,6 @@ + + install-local: $(CFFILES) FORCE + -$(MKDIR) $(DESTDIR)$(libdir) +- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir) ++ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir) + $(LTFINISH) $(DESTDIR)$(libdir) + +--- openldap.orig/servers/slapd/Makefile.in 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/servers/slapd/Makefile.in 2012-04-06 00:18:54.208137362 +0200 +@@ -370,10 +370,10 @@ + install-conf install-db-config install-schema install-tools + + install-slapd: FORCE +- -$(MKDIR) $(DESTDIR)$(libexecdir) ++ -$(MKDIR) $(DESTDIR)$(sbindir) + -$(MKDIR) $(DESTDIR)$(localstatedir)/run + $(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \ +- slapd$(EXEEXT) $(DESTDIR)$(libexecdir) ++ slapd$(EXEEXT) $(DESTDIR)$(sbindir) + @for i in $(SUBDIRS); do \ + if test -d $$i && test -f $$i/Makefile ; then \ + echo; echo " cd $$i; $(MAKE) $(MFLAGS) install"; \ +@@ -439,9 +439,9 @@ + + install-db-config: FORCE + @-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir) +- @-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data ++ @-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap + $(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \ +- $(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example ++ $(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example + $(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \ + $(DESTDIR)$(sysconfdir)/DB_CONFIG.example + +@@ -449,6 +449,6 @@ + -$(MKDIR) $(DESTDIR)$(sbindir) + for i in $(SLAPTOOLS); do \ + $(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \ +- $(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \ ++ $(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \ + done + +--- openldap.orig/servers/slapd/slapd.conf 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/servers/slapd/slapd.conf 2012-04-06 00:21:12.891992222 +0200 +@@ -10,14 +10,12 @@ + # service AND an understanding of referrals. + #referral ldap://root.openldap.org + +-pidfile %LOCALSTATEDIR%/run/slapd.pid +-argsfile %LOCALSTATEDIR%/run/slapd.args ++pidfile %LOCALSTATEDIR%/run/openldap/slapd.pid ++argsfile %LOCALSTATEDIR%/run/openldap/slapd.args + + # Load dynamic backend modules: +-# modulepath %MODULEDIR% +-# moduleload back_bdb.la +-# moduleload back_hdb.la +-# moduleload back_ldap.la ++modulepath %MODULEDIR% ++moduleload back_bdb + + # Sample security restrictions + # Require integrity protection (prevent hijacking) +@@ -46,20 +44,26 @@ + # + # rootdn can always read and write EVERYTHING! + ++# Specific Backend Directives for bdb: ++backend bdb ++ + ####################################################################### + # BDB database definitions + ####################################################################### + + database bdb + suffix "dc=my-domain,dc=com" +-rootdn "cn=Manager,dc=my-domain,dc=com" ++#rootdn "cn=Manager,dc=my-domain,dc=com" ++ + # Cleartext passwords, especially for the rootdn, should + # be avoid. See slappasswd(8) and slapd.conf(5) for details. + # Use of strong authentication encouraged. +-rootpw secret ++#rootpw secret ++ + # The database directory MUST exist prior to running slapd AND + # should only be accessible by the slapd and slap tools. + # Mode 700 recommended. +-directory %LOCALSTATEDIR%/openldap-data ++directory %LOCALSTATEDIR%/lib/openldap ++ + # Indices to maintain + index objectClass eq +--- openldap.orig/servers/slapd/slapi/Makefile.in 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/servers/slapd/slapi/Makefile.in 2012-04-06 00:18:54.210137403 +0200 +@@ -46,6 +46,6 @@ + install-local: FORCE + if test "$(BUILD_MOD)" = "yes"; then \ + $(MKDIR) $(DESTDIR)$(libdir); \ +- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \ ++ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \ + fi + diff --git a/server/openldap/files/openldap-2.4.39-ntlm-1.patch b/server/openldap/files/openldap-2.4.39-ntlm-1.patch new file mode 100644 index 0000000000..ae981ebca5 --- /dev/null +++ b/server/openldap/files/openldap-2.4.39-ntlm-1.patch @@ -0,0 +1,219 @@ +Submitted By: Armin K. +Date: 2012-04-06 +Initial Package Version: 2.4.30 +Upstream Status: Unknown +Origin: Debian +Description: Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is + actually called by evolution-data-server, checked at version 1.12.2. + Without this patch, the Exchange addressbook integration uses simple binds + with cleartext passwords. + +--- openldap.orig/include/ldap.h 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/include/ldap.h 2012-04-01 00:20:00.059827789 +0200 +@@ -2517,5 +2517,25 @@ + LDAPControl **ctrls, + LDAPDerefRes **drp )); + ++/* ++ * hacks for NTLM ++ */ ++#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU) ++#define LDAP_AUTH_NTLM_RESPONSE ((ber_tag_t) 0x8bU) ++LDAP_F( int ) ++ldap_ntlm_bind LDAP_P(( ++ LDAP *ld, ++ LDAP_CONST char *dn, ++ ber_tag_t tag, ++ struct berval *cred, ++ LDAPControl **sctrls, ++ LDAPControl **cctrls, ++ int *msgidp )); ++LDAP_F( int ) ++ldap_parse_ntlm_bind_result LDAP_P(( ++ LDAP *ld, ++ LDAPMessage *res, ++ struct berval *challenge)); ++ + LDAP_END_DECL + #endif /* _LDAP_H */ +--- openldap.orig/libraries/libldap/Makefile.in 2012-04-01 00:18:54.233419658 +0200 ++++ openldap/libraries/libldap/Makefile.in 2012-04-01 00:20:00.060827810 +0200 +@@ -27,7 +27,7 @@ + init.c options.c print.c string.c util-int.c schema.c \ + charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ + tls2.c tls_o.c tls_g.c tls_m.c \ +- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ ++ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \ + assertion.c deref.c ldif.c fetch.c + + OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \ +@@ -40,7 +40,7 @@ + init.lo options.lo print.lo string.lo util-int.lo schema.lo \ + charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ + tls2.lo tls_o.lo tls_g.lo tls_m.lo \ +- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ ++ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \ + assertion.lo deref.lo ldif.lo fetch.lo + + LDAP_INCDIR= ../../include +--- openldap.orig/libraries/libldap/ntlm.c 1970-01-01 01:00:00.000000000 +0100 ++++ openldap/libraries/libldap/ntlm.c 2012-04-01 00:20:00.059827789 +0200 +@@ -0,0 +1,138 @@ ++/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */ ++/* ++ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. ++ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file ++ */ ++ ++/* Mostly copied from sasl.c */ ++ ++#include "portable.h" ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++#include "ldap-int.h" ++ ++int ++ldap_ntlm_bind( ++ LDAP *ld, ++ LDAP_CONST char *dn, ++ ber_tag_t tag, ++ struct berval *cred, ++ LDAPControl **sctrls, ++ LDAPControl **cctrls, ++ int *msgidp ) ++{ ++ BerElement *ber; ++ int rc; ++ ber_int_t id; ++ ++ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 ); ++ ++ assert( ld != NULL ); ++ assert( LDAP_VALID( ld ) ); ++ assert( msgidp != NULL ); ++ ++ if( msgidp == NULL ) { ++ ld->ld_errno = LDAP_PARAM_ERROR; ++ return ld->ld_errno; ++ } ++ ++ /* create a message to send */ ++ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) { ++ ld->ld_errno = LDAP_NO_MEMORY; ++ return ld->ld_errno; ++ } ++ ++ assert( LBER_VALID( ber ) ); ++ ++ LDAP_NEXT_MSGID( ld, id ); ++ rc = ber_printf( ber, "{it{istON}" /*}*/, ++ id, LDAP_REQ_BIND, ++ ld->ld_version, dn, tag, ++ cred ); ++ ++ /* Put Server Controls */ ++ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) { ++ ber_free( ber, 1 ); ++ return ld->ld_errno; ++ } ++ ++ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) { ++ ld->ld_errno = LDAP_ENCODING_ERROR; ++ ber_free( ber, 1 ); ++ return ld->ld_errno; ++ } ++ ++ /* send the message */ ++ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id ); ++ ++ if(*msgidp < 0) ++ return ld->ld_errno; ++ ++ return LDAP_SUCCESS; ++} ++ ++int ++ldap_parse_ntlm_bind_result( ++ LDAP *ld, ++ LDAPMessage *res, ++ struct berval *challenge) ++{ ++ ber_int_t errcode; ++ ber_tag_t tag; ++ BerElement *ber; ++ ber_len_t len; ++ ++ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 ); ++ ++ assert( ld != NULL ); ++ assert( LDAP_VALID( ld ) ); ++ assert( res != NULL ); ++ ++ if ( ld == NULL || res == NULL ) { ++ return LDAP_PARAM_ERROR; ++ } ++ ++ if( res->lm_msgtype != LDAP_RES_BIND ) { ++ ld->ld_errno = LDAP_PARAM_ERROR; ++ return ld->ld_errno; ++ } ++ ++ if ( ld->ld_error ) { ++ LDAP_FREE( ld->ld_error ); ++ ld->ld_error = NULL; ++ } ++ if ( ld->ld_matched ) { ++ LDAP_FREE( ld->ld_matched ); ++ ld->ld_matched = NULL; ++ } ++ ++ /* parse results */ ++ ++ ber = ber_dup( res->lm_ber ); ++ ++ if( ber == NULL ) { ++ ld->ld_errno = LDAP_NO_MEMORY; ++ return ld->ld_errno; ++ } ++ ++ tag = ber_scanf( ber, "{ioa" /*}*/, ++ &errcode, challenge, &ld->ld_error ); ++ ber_free( ber, 0 ); ++ ++ if( tag == LBER_ERROR ) { ++ ld->ld_errno = LDAP_DECODING_ERROR; ++ return ld->ld_errno; ++ } ++ ++ ld->ld_errno = errcode; ++ ++ return( ld->ld_errno ); ++} ++ +--- openldap.orig/libraries/libldap_r/Makefile.in 2012-04-01 00:18:54.234419703 +0200 ++++ openldap/libraries/libldap_r/Makefile.in 2012-04-01 00:20:00.060827810 +0200 +@@ -29,7 +29,7 @@ + init.c options.c print.c string.c util-int.c schema.c \ + charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ + tls2.c tls_o.c tls_g.c tls_m.c \ +- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ ++ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \ + assertion.c deref.c ldif.c fetch.c + SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \ + thr_posix.c thr_cthreads.c thr_thr.c thr_nt.c \ +@@ -47,7 +47,7 @@ + init.lo options.lo print.lo string.lo util-int.lo schema.lo \ + charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ + tls2.lo tls_o.lo tls_g.lo tls_m.lo \ +- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ ++ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \ + assertion.lo deref.lo ldif.lo fetch.lo + + LDAP_INCDIR= ../../include diff --git a/server/openldap/files/openldap-2.4.39-symbol_versions-1.patch b/server/openldap/files/openldap-2.4.39-symbol_versions-1.patch new file mode 100644 index 0000000000..f393f01b1d --- /dev/null +++ b/server/openldap/files/openldap-2.4.39-symbol_versions-1.patch @@ -0,0 +1,160 @@ +Submitted By: Armin K. +Date: 2012-04-06 +Initial Package Version: 2.4.30 +Upstream Status: Unknown +Origin: Debian +Description: This patch enables symbol versioning in ldap libraries. Without this + patch some applications might generate a warning about missing symbol + versions. + +--- openldap.orig/build/openldap.m4 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/build/openldap.m4 2012-04-01 17:29:50.973881411 +0200 +@@ -1136,3 +1136,54 @@ + #endif + ], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])]) + ]) ++ ++dnl ==================================================================== ++dnl check for symbol versioning support ++AC_DEFUN([OL_SYMBOL_VERSIONING], ++[AC_CACHE_CHECK([for .symver assembler directive], ++ [ol_cv_asm_symver_directive],[ ++cat > conftest.s <&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then ++ ol_cv_asm_symver_directive=yes ++else ++ ol_cv_asm_symver_directive=no ++fi ++rm -f conftest*]) ++AC_CACHE_CHECK([for ld --version-script], ++ [ol_cv_ld_version_script_option],[ ++if test $ol_cv_asm_symver_directive = yes; then ++ cat > conftest.s < conftest.map <&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then ++ if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared ++ -o conftest.so conftest.o ++ -Wl,--version-script,conftest.map ++ 1>&AS_MESSAGE_LOG_FD]); ++ then ++ ol_cv_ld_version_script_option=yes ++ else ++ ol_cv_ld_version_script_option=no ++ fi ++ else ++ ol_cv_ld_version_script_option=no ++ fi ++else ++ ol_cv_ld_version_script_option=no ++fi ++rm -f conftest*])]) +--- openldap.orig/build/top.mk 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/build/top.mk 2012-04-01 17:29:50.972881390 +0200 +@@ -104,6 +104,9 @@ + # LINK_LIBS referenced in library and module link commands. + LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS) + ++# option to pass to $(CC) to support library symbol versioning, if any ++VERSION_OPTION = @VERSION_OPTION@ ++ + LTSTATIC = @LTSTATIC@ + + LTLINK = $(LIBTOOL) --mode=link \ +@@ -113,7 +116,7 @@ + $(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c + + LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \ +- $(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) ++ $(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS) + + LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \ + $(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c +--- openldap.orig/configure.in 2012-02-29 18:37:09.000000000 +0100 ++++ openldap/configure.in 2012-04-01 17:29:50.981881580 +0200 +@@ -1907,6 +1907,13 @@ + fi + AC_SUBST(LTSTATIC)dnl + ++VERSION_OPTION="" ++OL_SYMBOL_VERSIONING ++if test $ol_cv_ld_version_script_option = yes ; then ++ VERSION_OPTION="-Wl,--version-script=" ++fi ++AC_SUBST(VERSION_OPTION) ++ + dnl ---------------------------------------------------------------- + if test $ol_enable_wrappers != no ; then + AC_CHECK_HEADERS(tcpd.h,[ +--- openldap.orig/libraries/liblber/liblber.map 1970-01-01 01:00:00.000000000 +0100 ++++ openldap/libraries/liblber/liblber.map 2012-04-01 17:29:50.983881622 +0200 +@@ -0,0 +1,8 @@ ++OPENLDAP_2.4_2 { ++ global: ++ ber_*; ++ der_alloc; ++ lutil_*; ++ local: ++ *; ++}; +--- openldap.orig/libraries/liblber/Makefile.in 2012-04-01 17:27:12.042526978 +0200 ++++ openldap/libraries/liblber/Makefile.in 2012-04-01 17:29:50.982881601 +0200 +@@ -38,6 +38,9 @@ + XXLIBS = + NT_LINK_LIBS = $(AC_LIBS) + UNIX_LINK_LIBS = $(AC_LIBS) ++ifneq (,$(VERSION_OPTION)) ++ VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map" ++endif + + dtest: $(XLIBS) dtest.o + $(LTLINK) -o $@ dtest.o $(LIBS) +--- openldap.orig/libraries/libldap/libldap.map 1970-01-01 01:00:00.000000000 +0100 ++++ openldap/libraries/libldap/libldap.map 2012-04-01 17:29:50.981881580 +0200 +@@ -0,0 +1,7 @@ ++OPENLDAP_2.4_2 { ++ global: ++ ldap_*; ++ ldif_*; ++ local: ++ *; ++}; +--- openldap.orig/libraries/libldap/Makefile.in 2012-04-01 17:27:12.043527000 +0200 ++++ openldap/libraries/libldap/Makefile.in 2012-04-01 17:29:50.982881601 +0200 +@@ -52,6 +52,9 @@ + XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS) + NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) + UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) ++ifneq (,$(VERSION_OPTION)) ++ VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map ++endif + + apitest: $(XLIBS) apitest.o + $(LTLINK) -o $@ apitest.o $(LIBS) +--- openldap.orig/libraries/libldap_r/Makefile.in 2012-04-01 17:27:12.043527000 +0200 ++++ openldap/libraries/libldap_r/Makefile.in 2012-04-01 17:29:50.971881369 +0200 +@@ -61,6 +61,9 @@ + XXXLIBS = $(LTHREAD_LIBS) + NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) + UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS) ++ifneq (,$(VERSION_OPTION)) ++ VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map" ++endif + + .links : Makefile + @for i in $(XXSRCS); do \ diff --git a/server/openldap/files/slapd.conf b/server/openldap/files/slapd.conf new file mode 100644 index 0000000000..94cc57adc6 --- /dev/null +++ b/server/openldap/files/slapd.conf @@ -0,0 +1,9 @@ +# conf.d file for openldap +# +# To enable both the standard unciphered server and the ssl encrypted +# one uncomment this line or set any other server starting options +# you may desire. +# +# OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'" +# Uncomment the below to use the new slapd configuration for openldap 2.3 +OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'" diff --git a/server/openldap/files/tmpfiles.conf b/server/openldap/files/tmpfiles.conf new file mode 100644 index 0000000000..cdcb10d03a --- /dev/null +++ b/server/openldap/files/tmpfiles.conf @@ -0,0 +1 @@ +d /run/openldap 0755 ldap ldap - - \ No newline at end of file diff --git a/server/openldap/pspec.xml b/server/openldap/pspec.xml new file mode 100644 index 0000000000..61d95fde56 --- /dev/null +++ b/server/openldap/pspec.xml @@ -0,0 +1,166 @@ + + + + + openldap + http://www.openldap.org + + PisiLinux Community + admins@pisilinux.org + + OPENLDAP + Open-source suite of LDAP applications and development tools + OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools + ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.41.tgz + + nss-devel + db-devel + tcp-wrappers-devel + + libtool-ltdl + + + openldap-2.4.39-blfs_paths-1.patch + openldap-2.4.39-symbol_versions-1.patch + openldap-2.4.39-ntlm-1.patch + fedora/openldap-sql-linking.patch + fedora/openldap-reentrant-gethostby.patch + fedora/openldap-ldaprc-currentdir.patch + fedora/openldap-userconfig-setgid.patch + + fedora/openldap-syncrepl-unset-tls-options.patch + fedora/openldap-nss-update-list-of-ciphers.patch + fedora/openldap-tls-no-reuse-of-tls_session.patch + fedora/openldap-nss-regex-search-hashed-cacert-dir.patch + fedora/openldap-nss-ignore-certdb-type-prefix.patch + fedora/openldap-nss-certs-from-certdb-fallback-pem.patch + fedora/openldap-nss-pk11-freeslot.patch + fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch + fedora/openldap-ldapi-sasl.patch + fedora/openldap-autoconf-pkgconfig-nss.patch + + + + + openldap-client + library + app:console + Command-line ldap client commands (ldapsearch, ldapadd etc..) + + nss + + + + /etc/openldap/ldap.conf* + /usr/include + /usr/bin + /usr/lib + /usr/share/man/man1 + /usr/share/man/man5/ldap.conf.5 + + + + + openldap-server + service + OpenLDAP server slapd and releated tools + OpenLDAP server slapd, additional backends, configuration files, schema definitions required for operation, and database maintenance tools + + nss + cyrus-sasl + openldap-client + + + /etc/conf.d + /etc/openldap + /usr/lib/tmpfiles.d/openldap-server.conf + /usr/sbin + /usr/libexec + /usr/share/man/man3 + /usr/share/man/man5 + /usr/share/man/man8 + /usr/share/doc + /var/lib + /run/openldap + + + tmpfiles.conf + slapd.conf + gencert.sh + + + System.Package + System.Service + + + + + openldap-32bit + emul32 + 32-bit shared libraries for openldap + emul32 + + openssl-32bit + libtool-ltdl-32bit + + + openssl-32bit + openldap-client + + + /usr/lib32 + + + + + + 2015-07-01 + 2.4.41 + Release bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2014-05-17 + 2.4.39 + Release bump. + Alihan Öztürk + alihan@pisilinux.org + + + 2014-02-03 + 2.4.39 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-01-09 + 2.4.38 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2013-08-20 + 2.4.33 + ignore cyrus + Erdinç Gültekin + erdincgultekin@pisilinux.org + + + 2012-09-19 + 2.4.33 + First release + PisiLinux Community + admins@pisilinux.org + + + 2012-09-19 + 2.4.32 + First release + Yusuf Aydemir + yusuf.aydemir@pisilinux.org + + + diff --git a/server/openldap/translations.xml b/server/openldap/translations.xml new file mode 100644 index 0000000000..c95463a4ee --- /dev/null +++ b/server/openldap/translations.xml @@ -0,0 +1,13 @@ + + + + openldap + LDAP uygulamaları ve geliştirme araçları + LDAP hizmeti için gereken uygulamalar ve geliştirme araçlarını içerir + + + + openldap-32bit + openldap için 32-bit paylaşımlı kitaplıklar + + diff --git a/util/crypt/nss/pspec.xml b/util/crypt/nss/pspec.xml index c76c168577..d6d9937737 100644 --- a/util/crypt/nss/pspec.xml +++ b/util/crypt/nss/pspec.xml @@ -24,6 +24,8 @@ nspr-devel + sqlite-devel + zlib-devel nss-3.18.1-standalone-1.patch