works for openldap
This commit is contained in:
Ertuğrul Erata
@@ -0,0 +1,100 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Licensed under the GNU General Public License, version 3.
|
||||
# See the file http://www.gnu.org/licenses/gpl.txt
|
||||
|
||||
from pisi.actionsapi import get
|
||||
from pisi.actionsapi import autotools
|
||||
from pisi.actionsapi import pisitools
|
||||
from pisi.actionsapi import shelltools
|
||||
|
||||
KeepSpecial = ["libtool"]
|
||||
|
||||
def setup():
|
||||
pisitools.dosed(
|
||||
"include/ldap_defaults.h",
|
||||
"(#define LDAPI_SOCK).*",
|
||||
'\\1 "/run/openldap/slapd.sock"'
|
||||
)
|
||||
pisitools.dosed("servers/slapd/Makefile.in", "(\$\(DESTDIR\))\$\(localstatedir\)(\/run)", r"\1\2")
|
||||
|
||||
pisitools.flags.add("-D_REENTRANT -D_GNU_SOURCE -fPIC -Wl,--as-needed -DLDAP_CONNECTIONLESS")
|
||||
#pisitools.ldflags.add("-pie")
|
||||
|
||||
options = "--prefix=/usr \
|
||||
--enable-bdb \
|
||||
--enable-hdb=mod \
|
||||
--enable-slapd \
|
||||
--enable-passwd=mod \
|
||||
--enable-dnssrv=mod \
|
||||
--enable-ldap \
|
||||
--enable-wrappers \
|
||||
--enable-meta=mod \
|
||||
--enable-monitor=mod \
|
||||
--enable-null=mod \
|
||||
--enable-shell=mod \
|
||||
--enable-rewrite \
|
||||
--enable-rlookups \
|
||||
--enable-aci \
|
||||
--enable-modules \
|
||||
--enable-cleartext \
|
||||
--enable-lmpasswd \
|
||||
--enable-spasswd \
|
||||
--enable-slapi \
|
||||
--enable-dyngroup \
|
||||
--enable-proxycache \
|
||||
--enable-perl \
|
||||
--enable-syslog \
|
||||
--enable-dynamic \
|
||||
--enable-local \
|
||||
--enable-proctitle \
|
||||
--enable-overlays=mod \
|
||||
--with-pic \
|
||||
--with-cyrus-sasl \
|
||||
--with-threads \
|
||||
--without-fetch \
|
||||
--enable-crypt \
|
||||
--enable-ipv6 \
|
||||
--enable-dynacl \
|
||||
--enable-shared \
|
||||
--disable-static \
|
||||
--disable-slp \
|
||||
--localstatedir=/var/lib"
|
||||
|
||||
if get.buildTYPE() == "emul32":
|
||||
options += " --prefix=/emul32 \
|
||||
--libdir=/usr/lib32 \
|
||||
--libexecdir=/emul32/libexec \
|
||||
--disable-bdb \
|
||||
--disable-hdb \
|
||||
--disable-wrappers \
|
||||
--disable-spasswd \
|
||||
--disable-perl \
|
||||
--with-tls \
|
||||
--without-cyrus-sasl"
|
||||
else: options += " --with-tls=moznss"
|
||||
|
||||
shelltools.export("AUTOMAKE", "/bin/true")
|
||||
autotools.autoreconf("-fi")
|
||||
autotools.configure(options)
|
||||
pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ")
|
||||
|
||||
def build():
|
||||
autotools.make("-j1")
|
||||
|
||||
def install():
|
||||
if get.buildTYPE() == "emul32":
|
||||
autotools.rawInstall("DESTDIR=%s" % get.installDIR())
|
||||
return
|
||||
|
||||
autotools.rawInstall("DESTDIR=%s" % get.installDIR())
|
||||
|
||||
|
||||
pisitools.dodir("/run/openldap")
|
||||
pisitools.dodir("/etc/openldap/ssl")
|
||||
|
||||
pisitools.dodoc("ANNOUNCEMENT", "CHANGES", "COPYRIGHT", "README", "LICENSE")
|
||||
|
||||
pisitools.remove("/usr/lib/*.la")
|
||||
pisitools.remove("/usr/libexec/openldap/*.la")
|
||||
@@ -0,0 +1,17 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
import os
|
||||
import pwd
|
||||
import grp
|
||||
|
||||
def postInstall(fromVersion, fromRelease, toVersion, toRelease):
|
||||
os.system("/bin/chown ldap:ldap /var/lib/openldap-data")
|
||||
os.system("/bin/chown ldap:ldap /var/lib/openldap-slurp")
|
||||
os.system("/bin/chown ldap:ldap /run/openldap")
|
||||
os.system("/bin/chown root:ldap /etc/openldap/slapd.conf")
|
||||
os.system("/bin/chown root:ldap /etc/openldap/slapd.conf.default")
|
||||
os.system("/bin/chmod 0700 /var/lib/openldap-data")
|
||||
os.system("/bin/chmod 0700 /var/lib/openldap-slurp")
|
||||
os.system("/bin/chmod 0755 /run/openldap")
|
||||
os.system("/bin/chmod 0640 /etc/openldap/slapd.conf")
|
||||
os.system("/bin/chmod 0640 /etc/openldap/slapd.conf.default")
|
||||
@@ -0,0 +1,23 @@
|
||||
from comar.service import *
|
||||
|
||||
serviceType = "server"
|
||||
serviceDesc = _({"en": "OpenLDAP Server",
|
||||
"tr": "OpenLDAP Sunucusu"})
|
||||
serviceConf = "slapd"
|
||||
|
||||
def start():
|
||||
import os
|
||||
os.environ["LC_ALL"] = "C"
|
||||
os.environ["LANG"] = "C"
|
||||
|
||||
startService(command="/usr/libexec/slapd",
|
||||
args="-u ldap -g ldap %s" % config.get("OPTS", ""),
|
||||
pidfile="/run/openldap/slapd.pid",
|
||||
donotify=True)
|
||||
|
||||
def stop():
|
||||
stopService(pidfile="/run/openldap/slapd.pid",
|
||||
donotify=True)
|
||||
|
||||
def status():
|
||||
return isServiceRunning("/run/openldap/slapd.pid")
|
||||
@@ -0,0 +1,17 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
from comar.service import *
|
||||
|
||||
serviceType = "server"
|
||||
serviceDesc = _({"en": "Slurpd Daemon",
|
||||
"tr": "Slurpd Servisi"})
|
||||
|
||||
def start():
|
||||
startService(command="/usr/libexec/slurpd",
|
||||
donotify=True)
|
||||
|
||||
def stop():
|
||||
stopService(command="/usr/libexec/slurpd",
|
||||
donotify=True)
|
||||
|
||||
def status():
|
||||
return isServiceRunning(command="/usr/libexec/slurpd")
|
||||
@@ -0,0 +1,49 @@
|
||||
Use pkg-config for Mozilla NSS library detection
|
||||
|
||||
Author: Jan Vcelak <jvcelak@redhat.com>
|
||||
|
||||
---
|
||||
configure.in | 22 +++++-----------------
|
||||
1 file changed, 5 insertions(+), 17 deletions(-)
|
||||
|
||||
diff --git a/configure.in b/configure.in
|
||||
index ecffe30..2a9cfb4 100644
|
||||
--- a/configure.in
|
||||
+++ b/configure.in
|
||||
@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then
|
||||
fi
|
||||
fi
|
||||
|
||||
-dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3
|
||||
-dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs
|
||||
-dnl are not in the default system location
|
||||
if test $ol_link_tls = no ; then
|
||||
if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then
|
||||
- have_moznss=no
|
||||
- AC_CHECK_HEADERS([nssutil.h])
|
||||
- if test "$ac_cv_header_nssutil_h" = yes ; then
|
||||
- AC_CHECK_LIB([nss3], [NSS_Initialize],
|
||||
- [ have_moznss=yes ], [ have_moznss=no ])
|
||||
- fi
|
||||
+ PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no])
|
||||
|
||||
- if test "$have_moznss" = yes ; then
|
||||
+ if test $have_moznss = yes ; then
|
||||
ol_with_tls=moznss
|
||||
ol_link_tls=yes
|
||||
- AC_DEFINE(HAVE_MOZNSS, 1,
|
||||
- [define if you have MozNSS])
|
||||
- TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4"
|
||||
- else
|
||||
- if test $ol_with_tls = moznss ; then
|
||||
- AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)])
|
||||
- fi
|
||||
+ AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS])
|
||||
+ TLS_LIBS="$MOZNSS_LIBS"
|
||||
+ CFLAGS="$CFLAGS $MOZNSS_CFLAGS"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
--
|
||||
1.7.11.7
|
||||
|
||||
@@ -0,0 +1,192 @@
|
||||
Implement priority/weight for DNS SRV records
|
||||
|
||||
From RFC 2782:
|
||||
|
||||
A client MUST attempt to contact the target host with the
|
||||
lowest-numbered priority it can reach.
|
||||
|
||||
This patch sorts the DNS SRV records by their priority, and
|
||||
additionally gives records with a larger weight a higher probability
|
||||
of appearing earlier. This way, the DNS SRV records are tried in the
|
||||
order of their priority.
|
||||
|
||||
Author: James M Leddy <james.leddy@redhat.com>
|
||||
Upstream ITS: #7027
|
||||
Resolves: #733078
|
||||
|
||||
---
|
||||
libraries/libldap/dnssrv.c | 106 ++++++++++++++++++++++++++++++++++----------
|
||||
1 files changed, 83 insertions(+), 23 deletions(-)
|
||||
|
||||
diff --git a/libraries/libldap/dnssrv.c b/libraries/libldap/dnssrv.c
|
||||
index 16b1544..40f93b4 100644
|
||||
--- a/libraries/libldap/dnssrv.c
|
||||
+++ b/libraries/libldap/dnssrv.c
|
||||
@@ -174,6 +174,46 @@ int ldap_domain2dn(
|
||||
return LDAP_SUCCESS;
|
||||
}
|
||||
|
||||
+#ifdef HAVE_RES_QUERY
|
||||
+#define DNSBUFSIZ (64*1024)
|
||||
+typedef struct srv_record {
|
||||
+ u_short priority;
|
||||
+ u_short weight;
|
||||
+ u_short port;
|
||||
+ char hostname[DNSBUFSIZ];
|
||||
+} srv_record;
|
||||
+
|
||||
+
|
||||
+static int srv_cmp(const void *aa, const void *bb){
|
||||
+ srv_record *a=(srv_record *)aa;
|
||||
+ srv_record *b=(srv_record *)bb;
|
||||
+ u_long total;
|
||||
+
|
||||
+ if(a->priority < b->priority) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+ if(a->priority > b->priority) {
|
||||
+ return 1;
|
||||
+ }
|
||||
+ if(a->priority == b->priority){
|
||||
+ /* targets with same priority are in psudeo random order */
|
||||
+ if (a->weight == 0 && b->weight == 0) {
|
||||
+ if (rand() % 2) {
|
||||
+ return -1;
|
||||
+ } else {
|
||||
+ return 1;
|
||||
+ }
|
||||
+ }
|
||||
+ total = a->weight + b->weight;
|
||||
+ if (rand() % total < a->weight) {
|
||||
+ return -1;
|
||||
+ } else {
|
||||
+ return 1;
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+#endif /* HAVE_RES_QUERY */
|
||||
+
|
||||
/*
|
||||
* Lookup and return LDAP servers for domain (using the DNS
|
||||
* SRV record _ldap._tcp.domain).
|
||||
@@ -183,15 +223,16 @@ int ldap_domain2hostlist(
|
||||
char **list )
|
||||
{
|
||||
#ifdef HAVE_RES_QUERY
|
||||
-#define DNSBUFSIZ (64*1024)
|
||||
- char *request;
|
||||
- char *hostlist = NULL;
|
||||
+ char *request;
|
||||
+ char *hostlist = NULL;
|
||||
+ srv_record *hostent_head=NULL;
|
||||
+ int i;
|
||||
int rc, len, cur = 0;
|
||||
unsigned char reply[DNSBUFSIZ];
|
||||
+ int hostent_count=0;
|
||||
|
||||
assert( domain != NULL );
|
||||
assert( list != NULL );
|
||||
-
|
||||
if( *domain == '\0' ) {
|
||||
return LDAP_PARAM_ERROR;
|
||||
}
|
||||
@@ -223,8 +264,7 @@ int ldap_domain2hostlist(
|
||||
unsigned char *p;
|
||||
char host[DNSBUFSIZ];
|
||||
int status;
|
||||
- u_short port;
|
||||
- /* int priority, weight; */
|
||||
+ u_short port, priority, weight;
|
||||
|
||||
/* Parse out query */
|
||||
p = reply;
|
||||
@@ -263,40 +303,56 @@ int ldap_domain2hostlist(
|
||||
size = (p[0] << 8) | p[1];
|
||||
p += 2;
|
||||
if (type == T_SRV) {
|
||||
- int buflen;
|
||||
status = dn_expand(reply, reply + len, p + 6, host, sizeof(host));
|
||||
if (status < 0) {
|
||||
goto out;
|
||||
}
|
||||
- /* ignore priority and weight for now */
|
||||
- /* priority = (p[0] << 8) | p[1]; */
|
||||
- /* weight = (p[2] << 8) | p[3]; */
|
||||
+
|
||||
+ /* Get priority weight and port */
|
||||
+ priority = (p[0] << 8) | p[1];
|
||||
+ weight = (p[2] << 8) | p[3];
|
||||
port = (p[4] << 8) | p[5];
|
||||
|
||||
if ( port == 0 || host[ 0 ] == '\0' ) {
|
||||
goto add_size;
|
||||
}
|
||||
|
||||
- buflen = strlen(host) + STRLENOF(":65355 ");
|
||||
- hostlist = (char *) LDAP_REALLOC(hostlist, cur + buflen + 1);
|
||||
- if (hostlist == NULL) {
|
||||
- rc = LDAP_NO_MEMORY;
|
||||
- goto out;
|
||||
+ hostent_head = (srv_record *) LDAP_REALLOC(hostent_head, (hostent_count+1)*(sizeof(srv_record)));
|
||||
+ if(hostent_head==NULL){
|
||||
+ rc=LDAP_NO_MEMORY;
|
||||
+ goto out;
|
||||
+
|
||||
}
|
||||
- if (cur > 0) {
|
||||
- /* not first time around */
|
||||
- hostlist[cur++] = ' ';
|
||||
- }
|
||||
- cur += sprintf(&hostlist[cur], "%s:%hu", host, port);
|
||||
+ hostent_head[hostent_count].priority=priority;
|
||||
+ hostent_head[hostent_count].weight=weight;
|
||||
+ hostent_head[hostent_count].port=port;
|
||||
+ strncpy(hostent_head[hostent_count].hostname, host,255);
|
||||
+ hostent_count=hostent_count+1;
|
||||
}
|
||||
add_size:;
|
||||
p += size;
|
||||
}
|
||||
}
|
||||
+ qsort(hostent_head, hostent_count, sizeof(srv_record), srv_cmp);
|
||||
+
|
||||
+ for(i=0; i<hostent_count; i++){
|
||||
+ int buflen;
|
||||
+ buflen = strlen(hostent_head[i].hostname) + STRLENOF(":65355" );
|
||||
+ hostlist = (char *) LDAP_REALLOC(hostlist, cur+buflen+1);
|
||||
+ if (hostlist == NULL) {
|
||||
+ rc = LDAP_NO_MEMORY;
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if(cur>0){
|
||||
+ hostlist[cur++]=' ';
|
||||
+ }
|
||||
+ cur += sprintf(&hostlist[cur], "%s:%hd", hostent_head[i].hostname, hostent_head[i].port);
|
||||
+ }
|
||||
+
|
||||
if (hostlist == NULL) {
|
||||
- /* No LDAP servers found in DNS. */
|
||||
- rc = LDAP_UNAVAILABLE;
|
||||
- goto out;
|
||||
+ /* No LDAP servers found in DNS. */
|
||||
+ rc = LDAP_UNAVAILABLE;
|
||||
+ goto out;
|
||||
}
|
||||
|
||||
rc = LDAP_SUCCESS;
|
||||
@@ -308,8 +364,12 @@ add_size:;
|
||||
if (request != NULL) {
|
||||
LDAP_FREE(request);
|
||||
}
|
||||
+ if (hostent_head != NULL) {
|
||||
+ LDAP_FREE(hostent_head);
|
||||
+ }
|
||||
if (rc != LDAP_SUCCESS && hostlist != NULL) {
|
||||
LDAP_FREE(hostlist);
|
||||
+
|
||||
}
|
||||
return rc;
|
||||
#else
|
||||
--
|
||||
1.7.6
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Tue, 7 May 2013 17:02:57 +0200
|
||||
Subject: [PATCH] LDAPI SASL fix
|
||||
|
||||
Resolves: #960222
|
||||
---
|
||||
libraries/libldap/cyrus.c | 19 ++++++++++++++++---
|
||||
1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-)
|
||||
|
||||
diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
|
||||
index 28c241b..a9acf36 100644
|
||||
--- a/libraries/libldap/cyrus.c
|
||||
+++ b/libraries/libldap/cyrus.c
|
||||
@@ -394,6 +394,8 @@ ldap_int_sasl_bind(
|
||||
struct berval ccred = BER_BVNULL;
|
||||
int saslrc, rc;
|
||||
unsigned credlen;
|
||||
+ char my_hostname[HOST_NAME_MAX + 1];
|
||||
+ int free_saslhost = 0;
|
||||
|
||||
Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n",
|
||||
mechs ? mechs : "<null>", 0, 0 );
|
||||
@@ -454,14 +456,25 @@ ldap_int_sasl_bind(
|
||||
|
||||
/* If we don't need to canonicalize just use the host
|
||||
* from the LDAP URI.
|
||||
+ * Always use the result of gethostname() for LDAPI.
|
||||
*/
|
||||
- if ( nocanon )
|
||||
+ if (ld->ld_defconn->lconn_server->lud_scheme != NULL &&
|
||||
+ strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) {
|
||||
+ rc = gethostname(my_hostname, HOST_NAME_MAX + 1);
|
||||
+ if (rc == 0) {
|
||||
+ saslhost = my_hostname;
|
||||
+ } else {
|
||||
+ saslhost = "localhost";
|
||||
+ }
|
||||
+ } else if ( nocanon )
|
||||
saslhost = ld->ld_defconn->lconn_server->lud_host;
|
||||
- else
|
||||
+ else {
|
||||
saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb,
|
||||
"localhost" );
|
||||
+ free_saslhost = 1;
|
||||
+ }
|
||||
rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost );
|
||||
- if ( !nocanon )
|
||||
+ if ( free_saslhost )
|
||||
LDAP_FREE( saslhost );
|
||||
}
|
||||
|
||||
--
|
||||
1.7.11.7
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
Disables opening of ldaprc file in current directory.
|
||||
|
||||
Resolves: #38402
|
||||
Upstream: ITS #1131
|
||||
Author: Henning Schmiedehausen <hps@intermeta.de>
|
||||
|
||||
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
|
||||
index 8617527..e6b17b4 100644
|
||||
--- a/libraries/libldap/init.c
|
||||
+++ b/libraries/libldap/init.c
|
||||
@@ -352,9 +352,6 @@ static void openldap_ldap_init_w_userconf(const char *file)
|
||||
if(path != NULL) {
|
||||
LDAP_FREE(path);
|
||||
}
|
||||
-
|
||||
- /* try file */
|
||||
- openldap_ldap_init_w_conf(file, 1);
|
||||
}
|
||||
|
||||
static void openldap_ldap_init_w_env(
|
||||
@@ -0,0 +1,86 @@
|
||||
MozNSS: load certificates from certdb, fallback to PEM
|
||||
|
||||
If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS
|
||||
certificate database, the backend assumed that the certificate is always
|
||||
located in the certificate database. This assumption might be wrong.
|
||||
|
||||
This patch makes the library to try to load the certificate from NSS
|
||||
database and fallback to PEM file if unsuccessfull.
|
||||
|
||||
Author: Jan Vcelak <jvcelak@redhat.com>
|
||||
Upstream ITS: #7389
|
||||
Resolves: #857455
|
||||
|
||||
diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
|
||||
index 6847bea..8339391 100644
|
||||
--- a/libraries/libldap/tls_m.c
|
||||
+++ b/libraries/libldap/tls_m.c
|
||||
@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx )
|
||||
/* prefer unlocked key, then key from opened certdb, then any other */
|
||||
if ( unlocked_key )
|
||||
ctx->tc_private_key = unlocked_key;
|
||||
- else if ( ctx->tc_certdb_slot )
|
||||
+ else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem )
|
||||
ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg );
|
||||
else
|
||||
ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg );
|
||||
@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg )
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
-
|
||||
- ctx->tc_using_pem = PR_TRUE;
|
||||
}
|
||||
|
||||
NSS_SetDomesticPolicy();
|
||||
@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg )
|
||||
|
||||
/* set up our cert and key, if any */
|
||||
if ( lt->lt_certfile ) {
|
||||
- /* if using the PEM module, load the PEM file specified by lt_certfile */
|
||||
- /* otherwise, assume this is the name of a cert already in the db */
|
||||
- if ( ctx->tc_using_pem ) {
|
||||
- /* this sets ctx->tc_certificate to the correct value */
|
||||
- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE );
|
||||
- if ( rc ) {
|
||||
- return rc;
|
||||
- }
|
||||
- } else {
|
||||
+
|
||||
+ /* first search in certdb (lt_certfile is nickname) */
|
||||
+ if ( ctx->tc_certdb ) {
|
||||
char *tmp_certname;
|
||||
|
||||
if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) {
|
||||
@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg )
|
||||
Debug( LDAP_DEBUG_ANY,
|
||||
"TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n",
|
||||
lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* fallback to PEM module (lt_certfile is filename) */
|
||||
+ if ( !ctx->tc_certificate ) {
|
||||
+ if ( !pem_module && tlsm_init_pem_module() ) {
|
||||
+ int pem_errcode = PORT_GetError();
|
||||
+ Debug( LDAP_DEBUG_ANY,
|
||||
+ "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n",
|
||||
+ pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
|
||||
return -1;
|
||||
}
|
||||
+
|
||||
+ /* this sets ctx->tc_certificate to the correct value */
|
||||
+ if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) {
|
||||
+ ctx->tc_using_pem = PR_TRUE;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if ( ctx->tc_certificate ) {
|
||||
+ Debug( LDAP_DEBUG_ANY,
|
||||
+ "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile,
|
||||
+ ctx->tc_using_pem ? "PEM file" : "moznss database", 0);
|
||||
+ } else {
|
||||
+ return -1;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
MozNSS: ignore certdb database type prefix when checking existence of the directory
|
||||
|
||||
If the certdb is specified including the database type prefix (e.g.
|
||||
sql:, dbm:), the prefix has to be ignored when checking the
|
||||
certificate directory existence.
|
||||
|
||||
Author: Jan Vcelak <jvcelak@redhat.com>
|
||||
Upstream ITS: #7388
|
||||
Resolves: #857373
|
||||
|
||||
---
|
||||
libraries/libldap/tls_m.c | 11 ++++++++++-
|
||||
1 file changed, 10 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
|
||||
index 49a3f8f..5ee21a2 100644
|
||||
--- a/libraries/libldap/tls_m.c
|
||||
+++ b/libraries/libldap/tls_m.c
|
||||
@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
|
||||
{
|
||||
char sep = PR_GetDirectorySeparator();
|
||||
char *ptr = NULL;
|
||||
+ char *chkpath = NULL;
|
||||
struct PRFileInfo prfi;
|
||||
PRStatus prc;
|
||||
|
||||
@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
|
||||
return;
|
||||
}
|
||||
|
||||
- prc = PR_GetFileInfo( certdir, &prfi );
|
||||
+ /* ignore database type prefix (e.g. sql:, dbm:) if provided */
|
||||
+ chkpath = strchr( certdir, ':' );
|
||||
+ if ( chkpath != NULL ) {
|
||||
+ chkpath += 1;
|
||||
+ } else {
|
||||
+ chkpath = certdir;
|
||||
+ }
|
||||
+
|
||||
/* if certdir exists (file or directory) then it cannot specify a prefix */
|
||||
+ prc = PR_GetFileInfo( chkpath, &prfi );
|
||||
if ( prc == PR_SUCCESS ) {
|
||||
return;
|
||||
}
|
||||
--
|
||||
1.7.11.7
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
Resolves: #929357
|
||||
|
||||
From 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec Mon Sep 17 00:00:00 2001
|
||||
From: Rich Megginson <rmeggins@redhat.com>
|
||||
Date: Thu, 28 Mar 2013 19:05:02 -0600
|
||||
Subject: [PATCH] must call PK11_FreeSlot after SECMOD_CloseUserDB to remove ref to slot
|
||||
|
||||
---
|
||||
libraries/libldap/tls_m.c | 2 ++
|
||||
1 files changed, 2 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
|
||||
index 072d41d..c59d303 100644
|
||||
--- a/libraries/libldap/tls_m.c
|
||||
+++ b/libraries/libldap/tls_m.c
|
||||
@@ -2063,6 +2063,8 @@ tlsm_ctx_free ( tls_ctx *ctx )
|
||||
"TLS: could not close certdb slot - error %d:%s.\n",
|
||||
errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
|
||||
}
|
||||
+ PK11_FreeSlot( c->tc_certdb_slot );
|
||||
+ c->tc_certdb_slot = NULL;
|
||||
}
|
||||
PL_strfree( c->tc_pin_file );
|
||||
c->tc_pin_file = NULL;
|
||||
--
|
||||
1.7.1
|
||||
|
||||
@@ -0,0 +1,91 @@
|
||||
MozNSS: better file name matching for hashed CA certificate directory
|
||||
|
||||
CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name
|
||||
should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used
|
||||
to differentiate between two certificates with the same subject name.
|
||||
|
||||
Wit this patch, certificate file names are matched correctly (using regular expressions).
|
||||
|
||||
Author: Jan Vcelak <jvcelak@redhat.com>
|
||||
Upstream ITS: #7374
|
||||
Resolves: #852786
|
||||
|
||||
diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
|
||||
index 5e49fc5..61d71d4 100644
|
||||
--- a/libraries/libldap/tls_m.c
|
||||
+++ b/libraries/libldap/tls_m.c
|
||||
@@ -38,6 +38,7 @@
|
||||
#include <ac/unistd.h>
|
||||
#include <ac/param.h>
|
||||
#include <ac/dirent.h>
|
||||
+#include <ac/regex.h>
|
||||
|
||||
#include "ldap-int.h"
|
||||
#include "ldap-tls.h"
|
||||
@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods;
|
||||
|
||||
#define PEM_LIBRARY "nsspem"
|
||||
#define PEM_MODULE "PEM"
|
||||
-/* hash files for use with cacertdir have this file name suffix */
|
||||
-#define PEM_CA_HASH_FILE_SUFFIX ".0"
|
||||
-#define PEM_CA_HASH_FILE_SUFFIX_LEN 2
|
||||
+#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$"
|
||||
|
||||
static SECMODModule *pem_module;
|
||||
|
||||
@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
|
||||
PRDir *dir;
|
||||
PRDirEntry *entry;
|
||||
PRStatus fistatus = PR_FAILURE;
|
||||
+ regex_t hashfile_re;
|
||||
|
||||
memset( &fi, 0, sizeof(fi) );
|
||||
fistatus = PR_GetFileInfo( cacertdir, &fi );
|
||||
@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
|
||||
goto done;
|
||||
}
|
||||
|
||||
+ if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) {
|
||||
+ Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 );
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
do {
|
||||
entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN );
|
||||
if ( ( NULL != entry ) && ( NULL != entry->name ) ) {
|
||||
char *fullpath = NULL;
|
||||
- char *ptr;
|
||||
+ int match;
|
||||
|
||||
- ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX );
|
||||
- if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) {
|
||||
+ match = regexec( &hashfile_re, entry->name, 0, NULL, 0 );
|
||||
+ if ( match == REG_NOMATCH ) {
|
||||
Debug( LDAP_DEBUG_TRACE,
|
||||
- "TLS: file %s does not end in [%s] - does not appear to be a CA certificate "
|
||||
- "directory file with a properly hashed file name - skipping.\n",
|
||||
- entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 );
|
||||
+ "TLS: skipping '%s' - filename does not have expected format "
|
||||
+ "(certificate hash with numeric suffix)\n", entry->name, 0, 0 );
|
||||
+ continue;
|
||||
+ } else if ( match != 0 ) {
|
||||
+ Debug( LDAP_DEBUG_ANY,
|
||||
+ "TLS: cannot execute regex for CA hash file matching (%d).\n",
|
||||
+ match, 0, 0 );
|
||||
continue;
|
||||
}
|
||||
+
|
||||
fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name );
|
||||
if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) {
|
||||
Debug( LDAP_DEBUG_TRACE,
|
||||
@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
|
||||
PR_smprintf_free( fullpath );
|
||||
}
|
||||
} while ( NULL != entry );
|
||||
+ regfree ( &hashfile_re );
|
||||
PR_CloseDir( dir );
|
||||
}
|
||||
done:
|
||||
--
|
||||
1.7.11.4
|
||||
|
||||
@@ -0,0 +1,193 @@
|
||||
MozNSS: update list of supported cipher suites
|
||||
|
||||
The updated list includes all ciphers implemented in Mozilla NSS 3.13.15
|
||||
|
||||
Author: Jan Vcelak <jvcelak@redhat.com>
|
||||
Upstream ITS: #7374
|
||||
|
||||
diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
|
||||
index 1422ce2..5e49fc5 100644
|
||||
--- a/libraries/libldap/tls_m.c
|
||||
+++ b/libraries/libldap/tls_m.c
|
||||
@@ -211,27 +211,34 @@ typedef struct {
|
||||
int num; /* The cipher id */
|
||||
int attr; /* cipher attributes: algorithms, etc */
|
||||
int version; /* protocol version valid for this cipher */
|
||||
- int bits; /* bits of strength */
|
||||
- int alg_bits; /* bits of the algorithm */
|
||||
int strength; /* LOW, MEDIUM, HIGH */
|
||||
int enabled; /* Enabled by default? */
|
||||
} cipher_properties;
|
||||
|
||||
/* cipher attributes */
|
||||
-#define SSL_kRSA 0x00000001L
|
||||
-#define SSL_aRSA 0x00000002L
|
||||
-#define SSL_aDSS 0x00000004L
|
||||
-#define SSL_DSS SSL_aDSS
|
||||
-#define SSL_eNULL 0x00000008L
|
||||
-#define SSL_DES 0x00000010L
|
||||
-#define SSL_3DES 0x00000020L
|
||||
-#define SSL_RC4 0x00000040L
|
||||
-#define SSL_RC2 0x00000080L
|
||||
-#define SSL_AES 0x00000100L
|
||||
-#define SSL_MD5 0x00000200L
|
||||
-#define SSL_SHA1 0x00000400L
|
||||
-#define SSL_SHA SSL_SHA1
|
||||
-#define SSL_RSA (SSL_kRSA|SSL_aRSA)
|
||||
+#define SSL_kRSA 0x00000001L
|
||||
+#define SSL_aRSA 0x00000002L
|
||||
+#define SSL_RSA (SSL_kRSA|SSL_aRSA)
|
||||
+#define SSL_aDSA 0x00000004L
|
||||
+#define SSL_DSA SSL_aDSA
|
||||
+#define SSL_eNULL 0x00000008L
|
||||
+#define SSL_DES 0x00000010L
|
||||
+#define SSL_3DES 0x00000020L
|
||||
+#define SSL_RC4 0x00000040L
|
||||
+#define SSL_RC2 0x00000080L
|
||||
+#define SSL_AES128 0x00000100L
|
||||
+#define SSL_AES256 0x00000200L
|
||||
+#define SSL_AES (SSL_AES128|SSL_AES256)
|
||||
+#define SSL_MD5 0x00000400L
|
||||
+#define SSL_SHA1 0x00000800L
|
||||
+#define SSL_kEDH 0x00001000L
|
||||
+#define SSL_CAMELLIA128 0x00002000L
|
||||
+#define SSL_CAMELLIA256 0x00004000L
|
||||
+#define SSL_CAMELLIA (SSL_CAMELLIA128|SSL_CAMELLIA256)
|
||||
+#define SSL_SEED 0x00008000L
|
||||
+#define SSL_kECDH 0x00010000L
|
||||
+#define SSL_kECDHE 0x00020000L
|
||||
+#define SSL_aECDSA 0x00040000L
|
||||
|
||||
/* cipher strength */
|
||||
#define SSL_NULL 0x00000001L
|
||||
@@ -248,29 +255,70 @@ typedef struct {
|
||||
|
||||
/* Cipher translation */
|
||||
static cipher_properties ciphers_def[] = {
|
||||
- /* SSL 2 ciphers */
|
||||
- {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED},
|
||||
- {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
|
||||
- {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
|
||||
- {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED},
|
||||
- {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
|
||||
- {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
|
||||
-
|
||||
- /* SSL3 ciphers */
|
||||
- {"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
|
||||
- {"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
|
||||
- {"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED},
|
||||
- {"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED},
|
||||
- {"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
|
||||
- {"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED},
|
||||
- {"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
- {"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+
|
||||
+ /*
|
||||
+ * Use the same DEFAULT cipher list as OpenSSL, which is defined as: ALL:!aNULL:!eNULL:!SSLv2
|
||||
+ */
|
||||
+
|
||||
+ /* SSLv2 ciphers */
|
||||
+ {"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, SSL_LOW, SSL_NOT_ALLOWED},
|
||||
+ {"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH, SSL_NOT_ALLOWED},
|
||||
+ {"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_MEDIUM, SSL_NOT_ALLOWED},
|
||||
+ {"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_MEDIUM, SSL_NOT_ALLOWED},
|
||||
+ {"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
|
||||
+ {"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
|
||||
+
|
||||
+ /* SSLv3 ciphers */
|
||||
+ {"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+ {"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+ {"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW, SSL_ALLOWED},
|
||||
+ {"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, SSL_EXPORT40, SSL_ALLOWED},
|
||||
+ {"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, SSL_EXPORT40, SSL_ALLOWED},
|
||||
+ {"EDH-RSA-DES-CBC-SHA", SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW, SSL_ALLOWED},
|
||||
+ {"EDH-RSA-DES-CBC3-SHA", SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"EDH-DSS-DES-CBC-SHA", SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1, SSL3, SSL_LOW, SSL_ALLOWED},
|
||||
+ {"EDH-DSS-DES-CBC3-SHA", SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1, SSL3, SSL_HIGH, SSL_ALLOWED},
|
||||
|
||||
/* TLSv1 ciphers */
|
||||
- {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
|
||||
- {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
|
||||
- {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED},
|
||||
- {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, TLS1, SSL_EXPORT56, SSL_ALLOWED},
|
||||
+ {"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_EXPORT56, SSL_ALLOWED},
|
||||
+ {"SEED-SHA", TLS_RSA_WITH_SEED_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"CAMELLIA256-SHA", TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"CAMELLIA128-SHA", TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-RSA-AES128-SHA", TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-RSA-AES256-SHA", TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-RSA-CAMELLIA128-SHA", TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-RSA-CAMELLIA256-SHA", TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-DSS-RC4-SHA", TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"DHE-DSS-AES128-SHA", TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-DSS-AES256-SHA", TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-DSS-CAMELLIA128-SHA", TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"DHE-DSS-CAMELLIA256-SHA", TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDH-RSA-NULL-SHA", TLS_ECDH_RSA_WITH_NULL_SHA, SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+ {"ECDH-RSA-RC4-SHA", TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"ECDH-RSA-DES-CBC3-SHA", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDH-RSA-AES128-SHA", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDH-RSA-AES256-SHA", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDH-ECDSA-NULL-SHA", TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+ {"ECDH-ECDSA-RC4-SHA", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"ECDH-ECDSA-DES-CBC3-SHA", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDH-ECDSA-AES128-SHA", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDH-ECDSA-AES256-SHA", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDHE-RSA-NULL-SHA", TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+ {"ECDHE-RSA-RC4-SHA", TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"ECDHE-RSA-DES-CBC3-SHA", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDHE-RSA-AES128-SHA", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDHE-RSA-AES256-SHA", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDHE-ECDSA-NULL-SHA", TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1, TLS1, SSL_NULL, SSL_NOT_ALLOWED},
|
||||
+ {"ECDHE-ECDSA-RC4-SHA", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1, TLS1, SSL_MEDIUM, SSL_ALLOWED},
|
||||
+ {"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDHE-ECDSA-AES128-SHA", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
+ {"ECDHE-ECDSA-AES256-SHA", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1, TLS1, SSL_HIGH, SSL_ALLOWED},
|
||||
};
|
||||
|
||||
#define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties))
|
||||
@@ -577,6 +625,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
|
||||
mask |= SSL_RSA;
|
||||
} else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) {
|
||||
mask |= SSL_eNULL;
|
||||
+ } else if (!strcmp(cipher, "AES128")) {
|
||||
+ mask |= SSL_AES128;
|
||||
+ } else if (!strcmp(cipher, "AES256")) {
|
||||
+ mask |= SSL_AES256;
|
||||
} else if (!strcmp(cipher, "AES")) {
|
||||
mask |= SSL_AES;
|
||||
} else if (!strcmp(cipher, "3DES")) {
|
||||
@@ -591,6 +643,24 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
|
||||
mask |= SSL_MD5;
|
||||
} else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) {
|
||||
mask |= SSL_SHA1;
|
||||
+ } else if (!strcmp(cipher, "EDH")) {
|
||||
+ mask |= SSL_kEDH;
|
||||
+ } else if (!strcmp(cipher, "DSS")) {
|
||||
+ mask |= SSL_aDSA;
|
||||
+ } else if (!strcmp(cipher, "CAMELLIA128")) {
|
||||
+ mask |= SSL_CAMELLIA128;
|
||||
+ } else if (!strcmp(cipher, "CAMELLIA256")) {
|
||||
+ mask |= SSL_CAMELLIA256;
|
||||
+ } else if (!strcmp(cipher, "CAMELLIA")) {
|
||||
+ mask |= SSL_CAMELLIA;
|
||||
+ } else if (!strcmp(cipher, "SEED")) {
|
||||
+ mask |= SSL_SEED;
|
||||
+ } else if (!strcmp(cipher, "ECDH")) {
|
||||
+ mask |= SSL_kECDH;
|
||||
+ } else if (!strcmp(cipher, "ECDHE")) {
|
||||
+ mask |= SSL_kECDHE;
|
||||
+ } else if (!strcmp(cipher, "ECDSA")) {
|
||||
+ mask |= SSL_aECDSA;
|
||||
} else if (!strcmp(cipher, "SSLv2")) {
|
||||
protocol |= SSL2;
|
||||
} else if (!strcmp(cipher, "SSLv3")) {
|
||||
--
|
||||
1.7.11.4
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
The non-reentrant gethostbyXXXX() functions deadlock if called recursively, for
|
||||
example if libldap needs to be initialized from within gethostbyXXXX() (which
|
||||
actually happens if nss_ldap is used for hostname resolution and earlier
|
||||
modules can't resolve the local host name), so use the reentrant versions of
|
||||
the functions, even if we're not being compiled for use in libldap_r
|
||||
|
||||
Resolves: #179730
|
||||
Author: Jeffery Layton <jlayton@redhat.com>
|
||||
|
||||
diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c
|
||||
index 373c81c..a012062 100644
|
||||
--- a/libraries/libldap/util-int.c
|
||||
+++ b/libraries/libldap/util-int.c
|
||||
@@ -52,8 +52,8 @@ extern int h_errno;
|
||||
#ifndef LDAP_R_COMPILE
|
||||
# undef HAVE_REENTRANT_FUNCTIONS
|
||||
# undef HAVE_CTIME_R
|
||||
-# undef HAVE_GETHOSTBYNAME_R
|
||||
-# undef HAVE_GETHOSTBYADDR_R
|
||||
+/* # undef HAVE_GETHOSTBYNAME_R */
|
||||
+/* # undef HAVE_GETHOSTBYADDR_R */
|
||||
|
||||
#else
|
||||
# include <ldap_pvt_thread.h>
|
||||
@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod)
|
||||
#define BUFSTART (1024-32)
|
||||
#define BUFMAX (32*1024-32)
|
||||
|
||||
-#if defined(LDAP_R_COMPILE)
|
||||
+#if defined(LDAP_R_COMPILE) || defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R)
|
||||
static char *safe_realloc( char **buf, int len );
|
||||
|
||||
#if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R))
|
||||
@@ -0,0 +1,14 @@
|
||||
Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package
|
||||
independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.)
|
||||
|
||||
--- openldap-2.4.24.orig/build/top.mk
|
||||
+++ openldap-2.4.24/build/top.mk
|
||||
@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@
|
||||
SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@
|
||||
SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@
|
||||
|
||||
-SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)
|
||||
+SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)
|
||||
|
||||
# Our Defaults
|
||||
CC = $(AC_CC)
|
||||
+41
@@ -0,0 +1,41 @@
|
||||
From: Jan-Marek Glogowski <jan-marek.glogowski@muenchen.de>
|
||||
Date: Tue, 18 May 2010 17:47:05 +0200
|
||||
Subject: [PATCH] Switch to lt_dlopenadvise() to get RTLD_GLOBAL set.
|
||||
|
||||
Proof of concept for fixing http://bugs.debian.org/327585
|
||||
(patch ported from freeradius bug http://bugs.debian.org/416266)
|
||||
|
||||
Resolves: #960048
|
||||
---
|
||||
--- openldap/servers/slapd/module.c.orig 2010-05-18 17:42:04.000000000 +0200
|
||||
+++ openldap/servers/slapd/module.c 2010-05-18 17:45:46.000000000 +0200
|
||||
@@ -117,6 +117,20 @@
|
||||
return -1; /* not found */
|
||||
}
|
||||
|
||||
+static lt_dlhandle slapd_lt_dlopenext_global( const char *filename )
|
||||
+{
|
||||
+ lt_dlhandle handle = 0;
|
||||
+ lt_dladvise advise;
|
||||
+
|
||||
+ if (!lt_dladvise_init (&advise) && !lt_dladvise_ext (&advise)
|
||||
+ && !lt_dladvise_global (&advise))
|
||||
+ handle = lt_dlopenadvise (filename, advise);
|
||||
+
|
||||
+ lt_dladvise_destroy (&advise);
|
||||
+
|
||||
+ return handle;
|
||||
+}
|
||||
+
|
||||
int module_load(const char* file_name, int argc, char *argv[])
|
||||
{
|
||||
module_loaded_t *module;
|
||||
@@ -180,7 +194,7 @@
|
||||
* to calling Debug. This is because Debug is a macro that expands
|
||||
* into multiple function calls.
|
||||
*/
|
||||
- if ((module->lib = lt_dlopenext(file)) == NULL) {
|
||||
+ if ((module->lib = slapd_lt_dlopenext_global(file)) == NULL) {
|
||||
error = lt_dlerror();
|
||||
#ifdef HAVE_EBCDIC
|
||||
strcpy( ebuf, error );
|
||||
@@ -0,0 +1,62 @@
|
||||
allow unsetting of tls_* syncrepl options
|
||||
|
||||
Author: Patrick Monnerat <pm@datasphere.ch>
|
||||
Upstream ITS: #7042
|
||||
Resolves: #734187
|
||||
|
||||
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
|
||||
index 654a4bf..10b993b 100644
|
||||
--- a/libraries/libldap/tls2.c
|
||||
+++ b/libraries/libldap/tls2.c
|
||||
@@ -735,27 +735,27 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_CACERTFILE:
|
||||
if ( lo->ldo_tls_cacertfile ) LDAP_FREE( lo->ldo_tls_cacertfile );
|
||||
- lo->ldo_tls_cacertfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_cacertfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_CACERTDIR:
|
||||
if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir );
|
||||
- lo->ldo_tls_cacertdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_cacertdir = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_CERTFILE:
|
||||
if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile );
|
||||
- lo->ldo_tls_certfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_certfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_KEYFILE:
|
||||
if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile );
|
||||
- lo->ldo_tls_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_keyfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_DHFILE:
|
||||
if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile );
|
||||
- lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_dhfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */
|
||||
if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile );
|
||||
- lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_crlfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
case LDAP_OPT_X_TLS_REQUIRE_CERT:
|
||||
if ( !arg ) return -1;
|
||||
@@ -783,7 +783,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
|
||||
#endif
|
||||
case LDAP_OPT_X_TLS_CIPHER_SUITE:
|
||||
if ( lo->ldo_tls_ciphersuite ) LDAP_FREE( lo->ldo_tls_ciphersuite );
|
||||
- lo->ldo_tls_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_ciphersuite = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
return 0;
|
||||
|
||||
case LDAP_OPT_X_TLS_PROTOCOL_MIN:
|
||||
@@ -794,7 +794,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
|
||||
if ( ld != NULL )
|
||||
return -1;
|
||||
if ( lo->ldo_tls_randfile ) LDAP_FREE (lo->ldo_tls_randfile );
|
||||
- lo->ldo_tls_randfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
+ lo->ldo_tls_randfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
|
||||
break;
|
||||
case LDAP_OPT_X_TLS_NEWCTX:
|
||||
if ( !arg ) return -1;
|
||||
@@ -0,0 +1,92 @@
|
||||
TLS: do not reuse tls_session if hostname check fails
|
||||
|
||||
If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails,
|
||||
*tls_session is not dropped, but reused when connecting to the second server.
|
||||
|
||||
This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor.
|
||||
From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling.
|
||||
|
||||
Author: Jan Vcelak <jvcelak@redhat.com>
|
||||
Upstream ITS: #7373
|
||||
Resolves: #852476
|
||||
|
||||
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
|
||||
index 10b993b..a3cd590 100644
|
||||
--- a/libraries/libldap/tls2.c
|
||||
+++ b/libraries/libldap/tls2.c
|
||||
@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc )
|
||||
*/
|
||||
|
||||
static int
|
||||
-ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
|
||||
+ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
|
||||
{
|
||||
Sockbuf *sb = conn->lconn_sb;
|
||||
int err;
|
||||
@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
|
||||
errno = WSAGetLastError();
|
||||
#endif
|
||||
|
||||
+ if ( err == 0 ) {
|
||||
+ err = ldap_pvt_tls_check_hostname( ld, ssl, host );
|
||||
+ }
|
||||
+
|
||||
if ( err < 0 )
|
||||
{
|
||||
char buf[256], *msg;
|
||||
@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in )
|
||||
{
|
||||
tls_session *session = s;
|
||||
|
||||
- return tls_imp->ti_session_chkhost( ld, session, name_in );
|
||||
+ if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
|
||||
+ ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
|
||||
+ ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in );
|
||||
+ if (ld->ld_errno != LDAP_SUCCESS) {
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ return LDAP_SUCCESS;
|
||||
}
|
||||
|
||||
int
|
||||
@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
|
||||
#endif /* LDAP_USE_NON_BLOCKING_TLS */
|
||||
|
||||
ld->ld_errno = LDAP_SUCCESS;
|
||||
- ret = ldap_int_tls_connect( ld, conn );
|
||||
+ ret = ldap_int_tls_connect( ld, conn, host );
|
||||
|
||||
#ifdef LDAP_USE_NON_BLOCKING_TLS
|
||||
while ( ret > 0 ) { /* this should only happen for non-blocking io */
|
||||
@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
|
||||
} else {
|
||||
/* ldap_int_poll called ldap_pvt_ndelay_off */
|
||||
ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb );
|
||||
- ret = ldap_int_tls_connect( ld, conn );
|
||||
+ ret = ldap_int_tls_connect( ld, conn, host );
|
||||
if ( ret > 0 ) { /* need to call tls_connect once more */
|
||||
struct timeval curr_time_tv, delta_tv;
|
||||
|
||||
@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
|
||||
return (ld->ld_errno);
|
||||
}
|
||||
|
||||
- ssl = ldap_pvt_tls_sb_ctx( sb );
|
||||
- assert( ssl != NULL );
|
||||
-
|
||||
- /*
|
||||
- * compare host with name(s) in certificate
|
||||
- */
|
||||
- if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
|
||||
- ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
|
||||
- ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host );
|
||||
- if (ld->ld_errno != LDAP_SUCCESS) {
|
||||
- return ld->ld_errno;
|
||||
- }
|
||||
- }
|
||||
-
|
||||
return LDAP_SUCCESS;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,92 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
|
||||
<head>
|
||||
<title>openldap.git - openldap</title>
|
||||
<meta name='generator' content='cgit v0.9.2'/>
|
||||
<meta name='robots' content='index, nofollow'/>
|
||||
<link rel='stylesheet' type='text/css' href='/cgit-data/cgit.css'/>
|
||||
<link rel='alternate' title='Atom feed' href='http://pkgs.fedoraproject.org/cgit/openldap.git/atom/openldap-userconfig-setgid.patch?h=master' type='application/atom+xml'/>
|
||||
</head>
|
||||
<body>
|
||||
<div id='cgit'><table id='header'>
|
||||
<tr>
|
||||
<td class='logo' rowspan='2'><a href='/cgit/'><img src='/cgit-data/cgit.png' alt='cgit logo'/></a></td>
|
||||
<td class='main'><a href='/cgit/'>index</a> : <a title='openldap.git' href='/cgit/openldap.git/'>openldap.git</a></td><td class='form'><form method='get' action=''>
|
||||
<select name='h' onchange='this.form.submit();'>
|
||||
<option value='FC-4-split'>FC-4-split</option>
|
||||
<option value='f10'>f10</option>
|
||||
<option value='f11'>f11</option>
|
||||
<option value='f12'>f12</option>
|
||||
<option value='f13'>f13</option>
|
||||
<option value='f14'>f14</option>
|
||||
<option value='f15'>f15</option>
|
||||
<option value='f16'>f16</option>
|
||||
<option value='f17'>f17</option>
|
||||
<option value='f18'>f18</option>
|
||||
<option value='f19'>f19</option>
|
||||
<option value='f20'>f20</option>
|
||||
<option value='f7'>f7</option>
|
||||
<option value='f8'>f8</option>
|
||||
<option value='f9'>f9</option>
|
||||
<option value='master' selected='selected'>master</option>
|
||||
<option value='private-moznss-f17'>private-moznss-f17</option>
|
||||
</select> <input type='submit' name='' value='switch'/></form></td></tr>
|
||||
<tr><td class='sub'>openldap</td><td class='sub right'>Jesse Keating</td></tr></table>
|
||||
<table class='tabs'><tr><td>
|
||||
<a href='/cgit/openldap.git/'>summary</a><a href='/cgit/openldap.git/refs/'>refs</a><a href='/cgit/openldap.git/log/openldap-userconfig-setgid.patch'>log</a><a class='active' href='/cgit/openldap.git/tree/openldap-userconfig-setgid.patch'>tree</a><a href='/cgit/openldap.git/commit/openldap-userconfig-setgid.patch'>commit</a><a href='/cgit/openldap.git/diff/openldap-userconfig-setgid.patch'>diff</a><a href='/cgit/openldap.git/stats/openldap-userconfig-setgid.patch'>stats</a></td><td class='form'><form class='right' method='get' action='/cgit/openldap.git/log/openldap-userconfig-setgid.patch'>
|
||||
<select name='qt'>
|
||||
<option value='grep'>log msg</option>
|
||||
<option value='author'>author</option>
|
||||
<option value='committer'>committer</option>
|
||||
<option value='range'>range</option>
|
||||
</select>
|
||||
<input class='txt' type='text' size='10' name='q' value=''/>
|
||||
<input type='submit' value='search'/>
|
||||
</form>
|
||||
</td></tr></table>
|
||||
<div class='path'>path: <a href='/cgit/openldap.git/tree/'>root</a>/<a href='/cgit/openldap.git/tree/openldap-userconfig-setgid.patch'>openldap-userconfig-setgid.patch</a></div><div class='content'>blob: 70f0d28ecab7c4152aa414adde93e462179ba0f8 (<a href='/cgit/openldap.git/plain/openldap-userconfig-setgid.patch'>plain</a>)
|
||||
<table summary='blob content' class='blob'>
|
||||
<tr><td class='linenumbers'><pre><a class='no' id='n1' name='n1' href='#n1'>1</a>
|
||||
<a class='no' id='n2' name='n2' href='#n2'>2</a>
|
||||
<a class='no' id='n3' name='n3' href='#n3'>3</a>
|
||||
<a class='no' id='n4' name='n4' href='#n4'>4</a>
|
||||
<a class='no' id='n5' name='n5' href='#n5'>5</a>
|
||||
<a class='no' id='n6' name='n6' href='#n6'>6</a>
|
||||
<a class='no' id='n7' name='n7' href='#n7'>7</a>
|
||||
<a class='no' id='n8' name='n8' href='#n8'>8</a>
|
||||
<a class='no' id='n9' name='n9' href='#n9'>9</a>
|
||||
<a class='no' id='n10' name='n10' href='#n10'>10</a>
|
||||
<a class='no' id='n11' name='n11' href='#n11'>11</a>
|
||||
<a class='no' id='n12' name='n12' href='#n12'>12</a>
|
||||
<a class='no' id='n13' name='n13' href='#n13'>13</a>
|
||||
<a class='no' id='n14' name='n14' href='#n14'>14</a>
|
||||
<a class='no' id='n15' name='n15' href='#n15'>15</a>
|
||||
<a class='no' id='n16' name='n16' href='#n16'>16</a>
|
||||
<a class='no' id='n17' name='n17' href='#n17'>17</a>
|
||||
<a class='no' id='n18' name='n18' href='#n18'>18</a>
|
||||
</pre></td>
|
||||
<td class='lines'><pre><code>Normally, skips reading of user configuration file when running with different effective UID.
|
||||
This patch adds the same behavior for GID.
|
||||
|
||||
Author: Nalin Dahyabhai <nalin@redhat.com>
|
||||
|
||||
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
|
||||
index e6b17b4..fbf4829 100644
|
||||
--- a/libraries/libldap/init.c
|
||||
+++ b/libraries/libldap/init.c
|
||||
@@ -678,7 +678,7 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl )
|
||||
openldap_ldap_init_w_sysconf(LDAP_CONF_FILE);
|
||||
|
||||
#ifdef HAVE_GETEUID
|
||||
- if ( geteuid() != getuid() )
|
||||
+ if ( geteuid() != getuid() || getegid() != getgid() )
|
||||
return;
|
||||
#endif
|
||||
|
||||
</code></pre></td></tr></table>
|
||||
</div> <!-- class=content -->
|
||||
<div class='footer'>generated by cgit v0.9.2 at 2014-01-09 14:22:50 (GMT)</div>
|
||||
</div> <!-- id=cgit -->
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,111 @@
|
||||
#!/bin/sh
|
||||
# Last update 20050401 - Christian Zoffoli <xmerlin@gentoo.org>
|
||||
|
||||
VERSION="0.3"
|
||||
openssl="/usr/bin/openssl"
|
||||
opensslopts=""
|
||||
ldapconfdir="/etc/openldap/ssl"
|
||||
pemfile="${ldapconfdir}/ldap.pem"
|
||||
randfile="${ldapconfdir}/ldap.rand"
|
||||
cfgfile="${ldapconfdir}/ldap.cfg"
|
||||
|
||||
function fixperms {
|
||||
chown root:ldap ${ldapconfdir} -R
|
||||
find ${ldapconfdir} -type f -exec chmod 640 \{\} \;
|
||||
chmod 750 ${ldapconfdir}
|
||||
}
|
||||
|
||||
|
||||
if [ ! -x ${openssl} ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ ! -d ${ldapconfdir} ]; then
|
||||
mkdir -p ${ldapconfdir}
|
||||
fi
|
||||
|
||||
fixperms
|
||||
|
||||
if [ -f ${pemfile} ]; then
|
||||
echo "${pemfile} already exist, dying"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
||||
dd if=/dev/urandom of=$randfile count=1 2>/dev/null
|
||||
|
||||
echo ""
|
||||
echo "______________________________________________________________________${T_ME}"
|
||||
echo ""
|
||||
echo "Creating self-signed certificate -- Version ${VERSION}"
|
||||
echo ""
|
||||
echo "______________________________________________________________________${T_ME}"
|
||||
echo ""
|
||||
|
||||
|
||||
COMMONNAME=`hostname`
|
||||
if [ ! -n "$COMMONNAME" ]; then
|
||||
COMMONNAME="www.openldap.org"
|
||||
fi
|
||||
|
||||
|
||||
if [ -f ${cfgfile} ]; then
|
||||
echo "${cfgfile} found, would you like to use it ? (y/n)"
|
||||
read answer
|
||||
|
||||
case "$answer" in
|
||||
y|Y)
|
||||
opensslopts="-batch"
|
||||
;;
|
||||
n|N)
|
||||
cat >${cfgfile} <<EOT
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
distinguished_name = req_DN
|
||||
RANDFILE = ${randfile}
|
||||
[ req_DN ]
|
||||
countryName = "1. Country Name (2 letter code)"
|
||||
countryName_default = "US"
|
||||
countryName_min = 2
|
||||
countryName_max = 2
|
||||
stateOrProvinceName = "2. State or Province Name (full name) "
|
||||
stateOrProvinceName_default = ""
|
||||
localityName = "3. Locality Name (eg, city) "
|
||||
localityName_default = ""
|
||||
0.organizationName = "4. Organization Name (eg, company) "
|
||||
0.organizationName_default = "LDAP Server"
|
||||
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
|
||||
organizationalUnitName_default = "For testing purposes only"
|
||||
commonName = "6. Common Name (eg, CA name) "
|
||||
commonName_max = 64
|
||||
commonName_default = "${COMMONNAME}"
|
||||
emailAddress = "7. Email Address (eg, name@FQDN)"
|
||||
emailAddress_max = 40
|
||||
emailAddress_default = ""
|
||||
EOT
|
||||
;;
|
||||
*)
|
||||
echo "Wrong answer, retry!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
${openssl} req -config ${cfgfile} ${opensslopts} -new -rand ${randfile} -x509 -nodes -out ${pemfile} -keyout ${pemfile} -days 999999
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "cca:Error: Failed to generate certificate " 1>&2
|
||||
exit 1
|
||||
else
|
||||
echo -e "\nCertificate creation done!"
|
||||
fi
|
||||
|
||||
if [ -f ${randfile} ]; then
|
||||
rm -f ${randfile}
|
||||
fi
|
||||
|
||||
if [ -f ${pemfile} ]; then
|
||||
fixperms
|
||||
fi
|
||||
@@ -0,0 +1,188 @@
|
||||
Submitted By: Armin K. <krejzi at email dot com>
|
||||
Date: 2012-04-06
|
||||
Initial Package Version: 2.4.30
|
||||
Upstream Status: BLFS Specific
|
||||
Origin: Self
|
||||
Description: Patch changes various installation options, such as ldap database path,
|
||||
configuration file options, slapd install location, etc.
|
||||
|
||||
--- openldap.orig/doc/man/man5/slapd-bdb.5 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/doc/man/man5/slapd-bdb.5 2012-04-06 00:18:54.171136608 +0200
|
||||
@@ -131,7 +131,7 @@
|
||||
associated indexes live.
|
||||
A separate directory must be specified for each database.
|
||||
The default is
|
||||
-.BR LOCALSTATEDIR/openldap\-data .
|
||||
+.BR LOCALSTATEDIR/lib/openldap .
|
||||
.TP
|
||||
.B dirtyread
|
||||
Allow reads of modified but not yet committed data.
|
||||
--- openldap.orig/doc/man/man5/slapd.conf.5 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/doc/man/man5/slapd.conf.5 2012-04-06 00:18:54.174136671 +0200
|
||||
@@ -1987,7 +1987,7 @@
|
||||
# The database directory MUST exist prior to
|
||||
# running slapd AND should only be accessible
|
||||
# by the slapd/tools. Mode 0700 recommended.
|
||||
-directory LOCALSTATEDIR/openldap\-data
|
||||
+directory LOCALSTATEDIR/lib/openldap
|
||||
# Indices to maintain
|
||||
index objectClass eq
|
||||
index cn,sn,mail pres,eq,approx,sub
|
||||
--- openldap.orig/doc/man/man5/slapd-config.5 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/doc/man/man5/slapd-config.5 2012-04-06 00:18:54.194137078 +0200
|
||||
@@ -2029,7 +2029,7 @@
|
||||
# The database directory MUST exist prior to
|
||||
# running slapd AND should only be accessible
|
||||
# by the slapd/tools. Mode 0700 recommended.
|
||||
-olcDbDirectory: LOCALSTATEDIR/openldap\-data
|
||||
+olcDbDirectory: LOCALSTATEDIR/lib/openldap
|
||||
# Indices to maintain
|
||||
olcDbIndex: objectClass eq
|
||||
olcDbIndex: cn,sn,mail pres,eq,approx,sub
|
||||
--- openldap.orig/include/ldap_defaults.h 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/include/ldap_defaults.h 2012-04-06 00:18:54.200137199 +0200
|
||||
@@ -39,7 +39,7 @@
|
||||
#define LDAP_ENV_PREFIX "LDAP"
|
||||
|
||||
/* default ldapi:// socket */
|
||||
-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"
|
||||
+#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"
|
||||
|
||||
/*
|
||||
* SLAPD DEFINITIONS
|
||||
@@ -47,7 +47,7 @@
|
||||
/* location of the default slapd config file */
|
||||
#define SLAPD_DEFAULT_CONFIGFILE LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf"
|
||||
#define SLAPD_DEFAULT_CONFIGDIR LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d"
|
||||
-#define SLAPD_DEFAULT_DB_DIR LDAP_RUNDIR LDAP_DIRSEP "openldap-data"
|
||||
+#define SLAPD_DEFAULT_DB_DIR LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap"
|
||||
#define SLAPD_DEFAULT_DB_MODE 0600
|
||||
#define SLAPD_DEFAULT_UCDATA LDAP_DATADIR LDAP_DIRSEP "ucdata"
|
||||
/* default max deref depth for aliases */
|
||||
--- openldap.orig/libraries/liblber/Makefile.in 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/libraries/liblber/Makefile.in 2012-04-06 00:18:54.204137280 +0200
|
||||
@@ -48,6 +48,6 @@
|
||||
|
||||
install-local: FORCE
|
||||
-$(MKDIR) $(DESTDIR)$(libdir)
|
||||
- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
|
||||
+ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
|
||||
$(LTFINISH) $(DESTDIR)$(libdir)
|
||||
|
||||
--- openldap.orig/libraries/libldap/Makefile.in 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/libraries/libldap/Makefile.in 2012-04-06 00:18:54.204137280 +0200
|
||||
@@ -68,7 +68,7 @@
|
||||
|
||||
install-local: $(CFFILES) FORCE
|
||||
-$(MKDIR) $(DESTDIR)$(libdir)
|
||||
- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
|
||||
+ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
|
||||
$(LTFINISH) $(DESTDIR)$(libdir)
|
||||
-$(MKDIR) $(DESTDIR)$(sysconfdir)
|
||||
@for i in $(CFFILES); do \
|
||||
--- openldap.orig/libraries/libldap_r/Makefile.in 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/libraries/libldap_r/Makefile.in 2012-04-06 00:18:54.208137362 +0200
|
||||
@@ -83,6 +83,6 @@
|
||||
|
||||
install-local: $(CFFILES) FORCE
|
||||
-$(MKDIR) $(DESTDIR)$(libdir)
|
||||
- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
|
||||
+ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
|
||||
$(LTFINISH) $(DESTDIR)$(libdir)
|
||||
|
||||
--- openldap.orig/servers/slapd/Makefile.in 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/servers/slapd/Makefile.in 2012-04-06 00:18:54.208137362 +0200
|
||||
@@ -370,10 +370,10 @@
|
||||
install-conf install-db-config install-schema install-tools
|
||||
|
||||
install-slapd: FORCE
|
||||
- -$(MKDIR) $(DESTDIR)$(libexecdir)
|
||||
+ -$(MKDIR) $(DESTDIR)$(sbindir)
|
||||
-$(MKDIR) $(DESTDIR)$(localstatedir)/run
|
||||
$(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \
|
||||
- slapd$(EXEEXT) $(DESTDIR)$(libexecdir)
|
||||
+ slapd$(EXEEXT) $(DESTDIR)$(sbindir)
|
||||
@for i in $(SUBDIRS); do \
|
||||
if test -d $$i && test -f $$i/Makefile ; then \
|
||||
echo; echo " cd $$i; $(MAKE) $(MFLAGS) install"; \
|
||||
@@ -439,9 +439,9 @@
|
||||
|
||||
install-db-config: FORCE
|
||||
@-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir)
|
||||
- @-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data
|
||||
+ @-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap
|
||||
$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
|
||||
- $(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example
|
||||
+ $(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example
|
||||
$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
|
||||
$(DESTDIR)$(sysconfdir)/DB_CONFIG.example
|
||||
|
||||
@@ -449,6 +449,6 @@
|
||||
-$(MKDIR) $(DESTDIR)$(sbindir)
|
||||
for i in $(SLAPTOOLS); do \
|
||||
$(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
|
||||
- $(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
|
||||
+ $(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
|
||||
done
|
||||
|
||||
--- openldap.orig/servers/slapd/slapd.conf 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/servers/slapd/slapd.conf 2012-04-06 00:21:12.891992222 +0200
|
||||
@@ -10,14 +10,12 @@
|
||||
# service AND an understanding of referrals.
|
||||
#referral ldap://root.openldap.org
|
||||
|
||||
-pidfile %LOCALSTATEDIR%/run/slapd.pid
|
||||
-argsfile %LOCALSTATEDIR%/run/slapd.args
|
||||
+pidfile %LOCALSTATEDIR%/run/openldap/slapd.pid
|
||||
+argsfile %LOCALSTATEDIR%/run/openldap/slapd.args
|
||||
|
||||
# Load dynamic backend modules:
|
||||
-# modulepath %MODULEDIR%
|
||||
-# moduleload back_bdb.la
|
||||
-# moduleload back_hdb.la
|
||||
-# moduleload back_ldap.la
|
||||
+modulepath %MODULEDIR%
|
||||
+moduleload back_bdb
|
||||
|
||||
# Sample security restrictions
|
||||
# Require integrity protection (prevent hijacking)
|
||||
@@ -46,20 +44,26 @@
|
||||
#
|
||||
# rootdn can always read and write EVERYTHING!
|
||||
|
||||
+# Specific Backend Directives for bdb:
|
||||
+backend bdb
|
||||
+
|
||||
#######################################################################
|
||||
# BDB database definitions
|
||||
#######################################################################
|
||||
|
||||
database bdb
|
||||
suffix "dc=my-domain,dc=com"
|
||||
-rootdn "cn=Manager,dc=my-domain,dc=com"
|
||||
+#rootdn "cn=Manager,dc=my-domain,dc=com"
|
||||
+
|
||||
# Cleartext passwords, especially for the rootdn, should
|
||||
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
|
||||
# Use of strong authentication encouraged.
|
||||
-rootpw secret
|
||||
+#rootpw secret
|
||||
+
|
||||
# The database directory MUST exist prior to running slapd AND
|
||||
# should only be accessible by the slapd and slap tools.
|
||||
# Mode 700 recommended.
|
||||
-directory %LOCALSTATEDIR%/openldap-data
|
||||
+directory %LOCALSTATEDIR%/lib/openldap
|
||||
+
|
||||
# Indices to maintain
|
||||
index objectClass eq
|
||||
--- openldap.orig/servers/slapd/slapi/Makefile.in 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/servers/slapd/slapi/Makefile.in 2012-04-06 00:18:54.210137403 +0200
|
||||
@@ -46,6 +46,6 @@
|
||||
install-local: FORCE
|
||||
if test "$(BUILD_MOD)" = "yes"; then \
|
||||
$(MKDIR) $(DESTDIR)$(libdir); \
|
||||
- $(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \
|
||||
+ $(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,219 @@
|
||||
Submitted By: Armin K. <krejzi at email dot com>
|
||||
Date: 2012-04-06
|
||||
Initial Package Version: 2.4.30
|
||||
Upstream Status: Unknown
|
||||
Origin: Debian
|
||||
Description: Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
|
||||
actually called by evolution-data-server, checked at version 1.12.2.
|
||||
Without this patch, the Exchange addressbook integration uses simple binds
|
||||
with cleartext passwords.
|
||||
|
||||
--- openldap.orig/include/ldap.h 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/include/ldap.h 2012-04-01 00:20:00.059827789 +0200
|
||||
@@ -2517,5 +2517,25 @@
|
||||
LDAPControl **ctrls,
|
||||
LDAPDerefRes **drp ));
|
||||
|
||||
+/*
|
||||
+ * hacks for NTLM
|
||||
+ */
|
||||
+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
|
||||
+#define LDAP_AUTH_NTLM_RESPONSE ((ber_tag_t) 0x8bU)
|
||||
+LDAP_F( int )
|
||||
+ldap_ntlm_bind LDAP_P((
|
||||
+ LDAP *ld,
|
||||
+ LDAP_CONST char *dn,
|
||||
+ ber_tag_t tag,
|
||||
+ struct berval *cred,
|
||||
+ LDAPControl **sctrls,
|
||||
+ LDAPControl **cctrls,
|
||||
+ int *msgidp ));
|
||||
+LDAP_F( int )
|
||||
+ldap_parse_ntlm_bind_result LDAP_P((
|
||||
+ LDAP *ld,
|
||||
+ LDAPMessage *res,
|
||||
+ struct berval *challenge));
|
||||
+
|
||||
LDAP_END_DECL
|
||||
#endif /* _LDAP_H */
|
||||
--- openldap.orig/libraries/libldap/Makefile.in 2012-04-01 00:18:54.233419658 +0200
|
||||
+++ openldap/libraries/libldap/Makefile.in 2012-04-01 00:20:00.060827810 +0200
|
||||
@@ -27,7 +27,7 @@
|
||||
init.c options.c print.c string.c util-int.c schema.c \
|
||||
charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
|
||||
tls2.c tls_o.c tls_g.c tls_m.c \
|
||||
- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
|
||||
+ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
|
||||
assertion.c deref.c ldif.c fetch.c
|
||||
|
||||
OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \
|
||||
@@ -40,7 +40,7 @@
|
||||
init.lo options.lo print.lo string.lo util-int.lo schema.lo \
|
||||
charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
|
||||
tls2.lo tls_o.lo tls_g.lo tls_m.lo \
|
||||
- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
|
||||
+ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
|
||||
assertion.lo deref.lo ldif.lo fetch.lo
|
||||
|
||||
LDAP_INCDIR= ../../include
|
||||
--- openldap.orig/libraries/libldap/ntlm.c 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ openldap/libraries/libldap/ntlm.c 2012-04-01 00:20:00.059827789 +0200
|
||||
@@ -0,0 +1,138 @@
|
||||
+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
|
||||
+/*
|
||||
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
|
||||
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
|
||||
+ */
|
||||
+
|
||||
+/* Mostly copied from sasl.c */
|
||||
+
|
||||
+#include "portable.h"
|
||||
+
|
||||
+#include <stdlib.h>
|
||||
+#include <stdio.h>
|
||||
+
|
||||
+#include <ac/socket.h>
|
||||
+#include <ac/string.h>
|
||||
+#include <ac/time.h>
|
||||
+#include <ac/errno.h>
|
||||
+
|
||||
+#include "ldap-int.h"
|
||||
+
|
||||
+int
|
||||
+ldap_ntlm_bind(
|
||||
+ LDAP *ld,
|
||||
+ LDAP_CONST char *dn,
|
||||
+ ber_tag_t tag,
|
||||
+ struct berval *cred,
|
||||
+ LDAPControl **sctrls,
|
||||
+ LDAPControl **cctrls,
|
||||
+ int *msgidp )
|
||||
+{
|
||||
+ BerElement *ber;
|
||||
+ int rc;
|
||||
+ ber_int_t id;
|
||||
+
|
||||
+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
|
||||
+
|
||||
+ assert( ld != NULL );
|
||||
+ assert( LDAP_VALID( ld ) );
|
||||
+ assert( msgidp != NULL );
|
||||
+
|
||||
+ if( msgidp == NULL ) {
|
||||
+ ld->ld_errno = LDAP_PARAM_ERROR;
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ /* create a message to send */
|
||||
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
|
||||
+ ld->ld_errno = LDAP_NO_MEMORY;
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ assert( LBER_VALID( ber ) );
|
||||
+
|
||||
+ LDAP_NEXT_MSGID( ld, id );
|
||||
+ rc = ber_printf( ber, "{it{istON}" /*}*/,
|
||||
+ id, LDAP_REQ_BIND,
|
||||
+ ld->ld_version, dn, tag,
|
||||
+ cred );
|
||||
+
|
||||
+ /* Put Server Controls */
|
||||
+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
|
||||
+ ber_free( ber, 1 );
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
|
||||
+ ld->ld_errno = LDAP_ENCODING_ERROR;
|
||||
+ ber_free( ber, 1 );
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ /* send the message */
|
||||
+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
|
||||
+
|
||||
+ if(*msgidp < 0)
|
||||
+ return ld->ld_errno;
|
||||
+
|
||||
+ return LDAP_SUCCESS;
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+ldap_parse_ntlm_bind_result(
|
||||
+ LDAP *ld,
|
||||
+ LDAPMessage *res,
|
||||
+ struct berval *challenge)
|
||||
+{
|
||||
+ ber_int_t errcode;
|
||||
+ ber_tag_t tag;
|
||||
+ BerElement *ber;
|
||||
+ ber_len_t len;
|
||||
+
|
||||
+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
|
||||
+
|
||||
+ assert( ld != NULL );
|
||||
+ assert( LDAP_VALID( ld ) );
|
||||
+ assert( res != NULL );
|
||||
+
|
||||
+ if ( ld == NULL || res == NULL ) {
|
||||
+ return LDAP_PARAM_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ if( res->lm_msgtype != LDAP_RES_BIND ) {
|
||||
+ ld->ld_errno = LDAP_PARAM_ERROR;
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ if ( ld->ld_error ) {
|
||||
+ LDAP_FREE( ld->ld_error );
|
||||
+ ld->ld_error = NULL;
|
||||
+ }
|
||||
+ if ( ld->ld_matched ) {
|
||||
+ LDAP_FREE( ld->ld_matched );
|
||||
+ ld->ld_matched = NULL;
|
||||
+ }
|
||||
+
|
||||
+ /* parse results */
|
||||
+
|
||||
+ ber = ber_dup( res->lm_ber );
|
||||
+
|
||||
+ if( ber == NULL ) {
|
||||
+ ld->ld_errno = LDAP_NO_MEMORY;
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ tag = ber_scanf( ber, "{ioa" /*}*/,
|
||||
+ &errcode, challenge, &ld->ld_error );
|
||||
+ ber_free( ber, 0 );
|
||||
+
|
||||
+ if( tag == LBER_ERROR ) {
|
||||
+ ld->ld_errno = LDAP_DECODING_ERROR;
|
||||
+ return ld->ld_errno;
|
||||
+ }
|
||||
+
|
||||
+ ld->ld_errno = errcode;
|
||||
+
|
||||
+ return( ld->ld_errno );
|
||||
+}
|
||||
+
|
||||
--- openldap.orig/libraries/libldap_r/Makefile.in 2012-04-01 00:18:54.234419703 +0200
|
||||
+++ openldap/libraries/libldap_r/Makefile.in 2012-04-01 00:20:00.060827810 +0200
|
||||
@@ -29,7 +29,7 @@
|
||||
init.c options.c print.c string.c util-int.c schema.c \
|
||||
charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
|
||||
tls2.c tls_o.c tls_g.c tls_m.c \
|
||||
- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
|
||||
+ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
|
||||
assertion.c deref.c ldif.c fetch.c
|
||||
SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \
|
||||
thr_posix.c thr_cthreads.c thr_thr.c thr_nt.c \
|
||||
@@ -47,7 +47,7 @@
|
||||
init.lo options.lo print.lo string.lo util-int.lo schema.lo \
|
||||
charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
|
||||
tls2.lo tls_o.lo tls_g.lo tls_m.lo \
|
||||
- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
|
||||
+ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
|
||||
assertion.lo deref.lo ldif.lo fetch.lo
|
||||
|
||||
LDAP_INCDIR= ../../include
|
||||
@@ -0,0 +1,160 @@
|
||||
Submitted By: Armin K. <krejzi at email dot com>
|
||||
Date: 2012-04-06
|
||||
Initial Package Version: 2.4.30
|
||||
Upstream Status: Unknown
|
||||
Origin: Debian
|
||||
Description: This patch enables symbol versioning in ldap libraries. Without this
|
||||
patch some applications might generate a warning about missing symbol
|
||||
versions.
|
||||
|
||||
--- openldap.orig/build/openldap.m4 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/build/openldap.m4 2012-04-01 17:29:50.973881411 +0200
|
||||
@@ -1136,3 +1136,54 @@
|
||||
#endif
|
||||
], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])])
|
||||
])
|
||||
+
|
||||
+dnl ====================================================================
|
||||
+dnl check for symbol versioning support
|
||||
+AC_DEFUN([OL_SYMBOL_VERSIONING],
|
||||
+[AC_CACHE_CHECK([for .symver assembler directive],
|
||||
+ [ol_cv_asm_symver_directive],[
|
||||
+cat > conftest.s <<EOF
|
||||
+${libc_cv_dot_text}
|
||||
+_sym:
|
||||
+.symver _sym,sym@VERS
|
||||
+EOF
|
||||
+if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
|
||||
+ ol_cv_asm_symver_directive=yes
|
||||
+else
|
||||
+ ol_cv_asm_symver_directive=no
|
||||
+fi
|
||||
+rm -f conftest*])
|
||||
+AC_CACHE_CHECK([for ld --version-script],
|
||||
+ [ol_cv_ld_version_script_option],[
|
||||
+if test $ol_cv_asm_symver_directive = yes; then
|
||||
+ cat > conftest.s <<EOF
|
||||
+${libc_cv_dot_text}
|
||||
+_sym:
|
||||
+.symver _sym,sym@VERS
|
||||
+EOF
|
||||
+ cat > conftest.map <<EOF
|
||||
+VERS_1 {
|
||||
+ global: sym;
|
||||
+};
|
||||
+
|
||||
+VERS_2 {
|
||||
+ global: sym;
|
||||
+} VERS_1;
|
||||
+EOF
|
||||
+ if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
|
||||
+ if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared
|
||||
+ -o conftest.so conftest.o
|
||||
+ -Wl,--version-script,conftest.map
|
||||
+ 1>&AS_MESSAGE_LOG_FD]);
|
||||
+ then
|
||||
+ ol_cv_ld_version_script_option=yes
|
||||
+ else
|
||||
+ ol_cv_ld_version_script_option=no
|
||||
+ fi
|
||||
+ else
|
||||
+ ol_cv_ld_version_script_option=no
|
||||
+ fi
|
||||
+else
|
||||
+ ol_cv_ld_version_script_option=no
|
||||
+fi
|
||||
+rm -f conftest*])])
|
||||
--- openldap.orig/build/top.mk 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/build/top.mk 2012-04-01 17:29:50.972881390 +0200
|
||||
@@ -104,6 +104,9 @@
|
||||
# LINK_LIBS referenced in library and module link commands.
|
||||
LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)
|
||||
|
||||
+# option to pass to $(CC) to support library symbol versioning, if any
|
||||
+VERSION_OPTION = @VERSION_OPTION@
|
||||
+
|
||||
LTSTATIC = @LTSTATIC@
|
||||
|
||||
LTLINK = $(LIBTOOL) --mode=link \
|
||||
@@ -113,7 +116,7 @@
|
||||
$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c
|
||||
|
||||
LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \
|
||||
- $(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB)
|
||||
+ $(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS)
|
||||
|
||||
LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \
|
||||
$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c
|
||||
--- openldap.orig/configure.in 2012-02-29 18:37:09.000000000 +0100
|
||||
+++ openldap/configure.in 2012-04-01 17:29:50.981881580 +0200
|
||||
@@ -1907,6 +1907,13 @@
|
||||
fi
|
||||
AC_SUBST(LTSTATIC)dnl
|
||||
|
||||
+VERSION_OPTION=""
|
||||
+OL_SYMBOL_VERSIONING
|
||||
+if test $ol_cv_ld_version_script_option = yes ; then
|
||||
+ VERSION_OPTION="-Wl,--version-script="
|
||||
+fi
|
||||
+AC_SUBST(VERSION_OPTION)
|
||||
+
|
||||
dnl ----------------------------------------------------------------
|
||||
if test $ol_enable_wrappers != no ; then
|
||||
AC_CHECK_HEADERS(tcpd.h,[
|
||||
--- openldap.orig/libraries/liblber/liblber.map 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ openldap/libraries/liblber/liblber.map 2012-04-01 17:29:50.983881622 +0200
|
||||
@@ -0,0 +1,8 @@
|
||||
+OPENLDAP_2.4_2 {
|
||||
+ global:
|
||||
+ ber_*;
|
||||
+ der_alloc;
|
||||
+ lutil_*;
|
||||
+ local:
|
||||
+ *;
|
||||
+};
|
||||
--- openldap.orig/libraries/liblber/Makefile.in 2012-04-01 17:27:12.042526978 +0200
|
||||
+++ openldap/libraries/liblber/Makefile.in 2012-04-01 17:29:50.982881601 +0200
|
||||
@@ -38,6 +38,9 @@
|
||||
XXLIBS =
|
||||
NT_LINK_LIBS = $(AC_LIBS)
|
||||
UNIX_LINK_LIBS = $(AC_LIBS)
|
||||
+ifneq (,$(VERSION_OPTION))
|
||||
+ VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map"
|
||||
+endif
|
||||
|
||||
dtest: $(XLIBS) dtest.o
|
||||
$(LTLINK) -o $@ dtest.o $(LIBS)
|
||||
--- openldap.orig/libraries/libldap/libldap.map 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ openldap/libraries/libldap/libldap.map 2012-04-01 17:29:50.981881580 +0200
|
||||
@@ -0,0 +1,7 @@
|
||||
+OPENLDAP_2.4_2 {
|
||||
+ global:
|
||||
+ ldap_*;
|
||||
+ ldif_*;
|
||||
+ local:
|
||||
+ *;
|
||||
+};
|
||||
--- openldap.orig/libraries/libldap/Makefile.in 2012-04-01 17:27:12.043527000 +0200
|
||||
+++ openldap/libraries/libldap/Makefile.in 2012-04-01 17:29:50.982881601 +0200
|
||||
@@ -52,6 +52,9 @@
|
||||
XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS)
|
||||
NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
|
||||
UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
|
||||
+ifneq (,$(VERSION_OPTION))
|
||||
+ VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map
|
||||
+endif
|
||||
|
||||
apitest: $(XLIBS) apitest.o
|
||||
$(LTLINK) -o $@ apitest.o $(LIBS)
|
||||
--- openldap.orig/libraries/libldap_r/Makefile.in 2012-04-01 17:27:12.043527000 +0200
|
||||
+++ openldap/libraries/libldap_r/Makefile.in 2012-04-01 17:29:50.971881369 +0200
|
||||
@@ -61,6 +61,9 @@
|
||||
XXXLIBS = $(LTHREAD_LIBS)
|
||||
NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
|
||||
UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS)
|
||||
+ifneq (,$(VERSION_OPTION))
|
||||
+ VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map"
|
||||
+endif
|
||||
|
||||
.links : Makefile
|
||||
@for i in $(XXSRCS); do \
|
||||
@@ -0,0 +1,9 @@
|
||||
# conf.d file for openldap
|
||||
#
|
||||
# To enable both the standard unciphered server and the ssl encrypted
|
||||
# one uncomment this line or set any other server starting options
|
||||
# you may desire.
|
||||
#
|
||||
# OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
|
||||
# Uncomment the below to use the new slapd configuration for openldap 2.3
|
||||
OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
|
||||
@@ -0,0 +1 @@
|
||||
d /run/openldap 0755 ldap ldap - -
|
||||
@@ -0,0 +1,166 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
|
||||
<PISI>
|
||||
<Source>
|
||||
<Name>openldap</Name>
|
||||
<Homepage>http://www.openldap.org</Homepage>
|
||||
<Packager>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admins@pisilinux.org</Email>
|
||||
</Packager>
|
||||
<License>OPENLDAP</License>
|
||||
<Summary>Open-source suite of LDAP applications and development tools</Summary>
|
||||
<Description>OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools</Description>
|
||||
<Archive sha1sum="c6880df9fec928a5f010b78a4285b497e8a12d6b" type="targz">ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.41.tgz</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency>nss-devel</Dependency>
|
||||
<Dependency>db-devel</Dependency>
|
||||
<Dependency>tcp-wrappers-devel</Dependency>
|
||||
<!--Dependency>cyrus-sasl-devel</Dependency-->
|
||||
<Dependency>libtool-ltdl</Dependency>
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<Patch level="1">openldap-2.4.39-blfs_paths-1.patch</Patch>
|
||||
<Patch level="1">openldap-2.4.39-symbol_versions-1.patch</Patch>
|
||||
<Patch level="1">openldap-2.4.39-ntlm-1.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-sql-linking.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-reentrant-gethostby.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-ldaprc-currentdir.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-userconfig-setgid.patch</Patch>
|
||||
<!--<Patch level="1">fedora/openldap-dns-priority.patch</Patch>-->
|
||||
<Patch level="1">fedora/openldap-syncrepl-unset-tls-options.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-nss-update-list-of-ciphers.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-tls-no-reuse-of-tls_session.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-nss-regex-search-hashed-cacert-dir.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-nss-ignore-certdb-type-prefix.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-nss-certs-from-certdb-fallback-pem.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-nss-pk11-freeslot.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-ldapi-sasl.patch</Patch>
|
||||
<Patch level="1">fedora/openldap-autoconf-pkgconfig-nss.patch</Patch>
|
||||
</Patches>
|
||||
</Source>
|
||||
|
||||
<Package>
|
||||
<Name>openldap-client</Name>
|
||||
<IsA>library</IsA>
|
||||
<IsA>app:console</IsA>
|
||||
<Summary>Command-line ldap client commands (ldapsearch, ldapadd etc..)</Summary>
|
||||
<RuntimeDependencies>
|
||||
<Dependency>nss</Dependency>
|
||||
<!--Dependency>cyrus-sasl</Dependency-->
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="config">/etc/openldap/ldap.conf*</Path>
|
||||
<Path fileType="header">/usr/include</Path>
|
||||
<Path fileType="executable">/usr/bin</Path>
|
||||
<Path fileType="library">/usr/lib</Path>
|
||||
<Path fileType="man">/usr/share/man/man1</Path>
|
||||
<Path fileType="man">/usr/share/man/man5/ldap.conf.5</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
|
||||
<Package>
|
||||
<Name>openldap-server</Name>
|
||||
<IsA>service</IsA>
|
||||
<Summary>OpenLDAP server slapd and releated tools</Summary>
|
||||
<Description>OpenLDAP server slapd, additional backends, configuration files, schema definitions required for operation, and database maintenance tools</Description>
|
||||
<RuntimeDependencies>
|
||||
<Dependency>nss</Dependency>
|
||||
<Dependency>cyrus-sasl</Dependency>
|
||||
<Dependency>openldap-client</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="config">/etc/conf.d</Path>
|
||||
<Path fileType="config">/etc/openldap</Path>
|
||||
<Path fileType="config">/usr/lib/tmpfiles.d/openldap-server.conf</Path>
|
||||
<Path fileType="executable">/usr/sbin</Path>
|
||||
<Path fileType="library">/usr/libexec</Path>
|
||||
<Path fileType="man">/usr/share/man/man3</Path>
|
||||
<Path fileType="man">/usr/share/man/man5</Path>
|
||||
<Path fileType="man">/usr/share/man/man8</Path>
|
||||
<Path fileType="doc">/usr/share/doc</Path>
|
||||
<Path fileType="data">/var/lib</Path>
|
||||
<Path fileType="data">/run/openldap</Path>
|
||||
</Files>
|
||||
<AdditionalFiles>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/lib/tmpfiles.d/openldap-server.conf">tmpfiles.conf</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0644" target="/etc/conf.d/slapd">slapd.conf</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0755" target="/etc/openldap/ssl/gencert.sh">gencert.sh</AdditionalFile>
|
||||
</AdditionalFiles>
|
||||
<Provides>
|
||||
<COMAR script="package.py">System.Package</COMAR>
|
||||
<COMAR script="slapd.py">System.Service</COMAR>
|
||||
</Provides>
|
||||
</Package>
|
||||
|
||||
<Package>
|
||||
<Name>openldap-32bit</Name>
|
||||
<PartOf>emul32</PartOf>
|
||||
<Summary>32-bit shared libraries for openldap</Summary>
|
||||
<BuildType>emul32</BuildType>
|
||||
<BuildDependencies>
|
||||
<Dependency>openssl-32bit</Dependency>
|
||||
<Dependency>libtool-ltdl-32bit</Dependency>
|
||||
</BuildDependencies>
|
||||
<RuntimeDependencies>
|
||||
<Dependency>openssl-32bit</Dependency>
|
||||
<Dependency release="current">openldap-client</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="library">/usr/lib32</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="7">
|
||||
<Date>2015-07-01</Date>
|
||||
<Version>2.4.41</Version>
|
||||
<Comment>Release bump.</Comment>
|
||||
<Name>Ertuğrul Erata</Name>
|
||||
<Email>ertugrulerata@gmail.com</Email>
|
||||
</Update>
|
||||
<Update release="6">
|
||||
<Date>2014-05-17</Date>
|
||||
<Version>2.4.39</Version>
|
||||
<Comment>Release bump.</Comment>
|
||||
<Name>Alihan Öztürk</Name>
|
||||
<Email>alihan@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="5">
|
||||
<Date>2014-02-03</Date>
|
||||
<Version>2.4.39</Version>
|
||||
<Comment>Version bump.</Comment>
|
||||
<Name>Marcin Bojara</Name>
|
||||
<Email>marcin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="4">
|
||||
<Date>2014-01-09</Date>
|
||||
<Version>2.4.38</Version>
|
||||
<Comment>Version bump.</Comment>
|
||||
<Name>Marcin Bojara</Name>
|
||||
<Email>marcin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="3">
|
||||
<Date>2013-08-20</Date>
|
||||
<Version>2.4.33</Version>
|
||||
<Comment>ignore cyrus</Comment>
|
||||
<Name>Erdinç Gültekin</Name>
|
||||
<Email>erdincgultekin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="2">
|
||||
<Date>2012-09-19</Date>
|
||||
<Version>2.4.33</Version>
|
||||
<Comment>First release</Comment>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admins@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="1">
|
||||
<Date>2012-09-19</Date>
|
||||
<Version>2.4.32</Version>
|
||||
<Comment>First release</Comment>
|
||||
<Name>Yusuf Aydemir</Name>
|
||||
<Email>yusuf.aydemir@pisilinux.org</Email>
|
||||
</Update>
|
||||
</History>
|
||||
</PISI>
|
||||
@@ -0,0 +1,13 @@
|
||||
<?xml version="1.0" ?>
|
||||
<PISI>
|
||||
<Source>
|
||||
<Name>openldap</Name>
|
||||
<Summary xml:lang="tr">LDAP uygulamaları ve geliştirme araçları</Summary>
|
||||
<Description xml:lang="tr">LDAP hizmeti için gereken uygulamalar ve geliştirme araçlarını içerir</Description>
|
||||
</Source>
|
||||
|
||||
<Package>
|
||||
<Name>openldap-32bit</Name>
|
||||
<Summary xml:lang="tr">openldap için 32-bit paylaşımlı kitaplıklar</Summary>
|
||||
</Package>
|
||||
</PISI>
|
||||
Reference in New Issue
Block a user