Merge branch 'master' of https://github.com/pisilinux/main

2015-07-04 15:28:51 +03:00
parent d68741e3b1 727f679942
commit 5fe52eed17
688 changed files with 59894 additions and 402 deletions
@@ -0,0 +1,3 @@
+<PISI>
+    <Name>server.auth</Name>
+</PISI>
@@ -0,0 +1,79 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Licensed under the GNU General Public License, version 3.
+# See the file http://www.gnu.org/licenses/gpl.txt
+
+from pisi.actionsapi import get
+from pisi.actionsapi import autotools
+from pisi.actionsapi import pisitools
+from pisi.actionsapi import shelltools
+
+def setup():
+    pisitools.dosed("libsasl2.pc.in", "libdir = @libdir@", "prefix=/usr\nexec_prefix=${prefix}\nlibdir = @libdir@")
+    def cleanup():
+        for p in ("config.*", "ltconfig", "ltmain.sh", "libtool.m4"):
+            shelltools.unlink("config/%s" % p)
+
+    cleanup()
+    autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal")
+    shelltools.cd("saslauthd")
+    cleanup()
+    autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config")
+    shelltools.cd("..")
+
+    pisitools.cflags.add("-fPIC")
+
+    # Don't disable ldap support to break circular dep. with openldap
+    # As workaround, we remove openldap-client runtime dep. in pspec
+    autotools.configure("--with-saslauthd=/run/saslauthd \
+                         --with-pwcheck=/var/lib/sasl2 \
+                         --with-configdir=/etc/sasl2 \
+                         --with-plugindir=/usr/lib/sasl2 \
+                         --with-dbpath=/etc/sasl2/sasldb2 \
+                         --with-pam \
+                         --without-ldap \
+                         --with-openssl \
+                         --with-dblib=gdbm \
+                         --with-gss_impl=mit \
+                         --with-devrandom=/dev/urandom \
+                         --without-pgsql \
+                         --without-mysql \
+                         --enable-anon \
+                         --enable-cram \
+                         --enable-digest \
+                         --enable-gssapi \
+                         --enable-login \
+                         --enable-ntlm \
+                         --enable-plain \
+                         --disable-ldapdb \
+                         --enable-checkapop \
+                         --enable-alwaystrue \
+                         --disable-java \
+                         --disable-krb4 \
+                         --disable-otp \
+                         --disable-srp \
+                         --disable-sql \
+                         --disable-passdss \
+                         --disable-macos-framework \
+                         --disable-static")
+    
+    # for remove unused
+    pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ")
+
+def build():
+    autotools.make("-j1")
+    autotools.make("-C saslauthd testsaslauthd")
+
+def install():
+    autotools.rawInstall("DESTDIR=%s" % get.installDIR())
+    autotools.rawInstall("DESTDIR=%s -C plugins" % get.installDIR())
+
+    pisitools.dodir("/etc/sasl2")
+    pisitools.dodir("/run/saslauthd")
+
+    for doc in ["AUTHORS", "COPYING", "ChangeLog", "LDAP_SASLAUTHD", "NEWS", "README"]:
+        pisitools.newdoc("saslauthd/%s" % doc, "saslauthd/%s" % doc)
+
+    pisitools.dohtml("doc/*.html")
+    pisitools.dodoc("AUTHORS", "COPYING", "ChangeLog", "NEWS", "README", "doc/TODO", "doc/*.txt")
@@ -0,0 +1,11 @@
+#!/usr/bin/python
+
+import os
+
+def postInstall(fromVersion, fromRelease, toVersion, toRelease):
+    if not os.path.exists("/etc/sasl2/sasldb2"):
+        os.system("/usr/sbin/saslpasswd2 -f /etc/sasl2/sasldb2 -p login")
+        os.system("/usr/sbin/saslpasswd2 -f /etc/sasl2/sasldb2 -d login")
+
+    os.system("/bin/chown root:mail /etc/sasl2/sasldb2")
+    os.system("/bin/chmod 0640 /etc/sasl2/sasldb2")
@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+
+from comar.service import *
+
+serviceType = "server"
+serviceDesc = _({"en": "Cyrus-SASL Daemon",
+                 "tr": "Cyrus-SASL Servisi"})
+serviceConf = "saslauthd"
+
+SOCKETDIR = "/run/saslauthd"
+PIDFILE = "/run/saslauthd/saslauthd.pid"
+
+@synchronized
+def start():
+    startService(command="/usr/sbin/saslauthd",
+                 args="-m %s %s" % (SOCKETDIR, config.get("SASLAUTHD_OPTS", "")),
+                 pidfile=PIDFILE,
+                 donotify=True)
+
+@synchronized
+def stop():
+    stopService(pidfile=PIDFILE,
+                donotify=True)
+
+def status():
+    return isServiceRunning(PIDFILE)
@@ -0,0 +1,15 @@
+0011_saslauthd_ac_prog_libtool.dpatch by  <fabbe@debian.org>
+
+Enable libtool use.
+
+diff -urNad trunk~/saslauthd/configure.in trunk/saslauthd/configure.in
+--- trunk~/saslauthd/configure.in	2006-05-29 22:52:42.000000000 +0300
+++ trunk/saslauthd/configure.in	2006-11-01 23:41:51.000000000 +0200
+@@ -25,6 +25,7 @@
+ AC_PROG_MAKE_SET
+ AC_PROG_LN_S
+ AC_PROG_INSTALL
+AC_PROG_LIBTOOL
+ 
+ dnl Checks for build foo
+ CMU_C___ATTRIBUTE__
@@ -0,0 +1,27 @@
+Author: Matthias Klose <doko@ubuntu.com>
+Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use
+it.
+--- a/saslauthd/Makefile.am
+++ b/saslauthd/Makefile.am
+@@ -16,7 +16,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c
+ saslauthd_DEPENDENCIES = saslauthd-main.o @LTLIBOBJS@
+ saslauthd_LDADD	= @SASL_KRB_LIB@ \
+ 		  @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \
+-		  @LIB_SOCKET@ @SASL_DB_LIB@ @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@
+		  @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@
+ 
+ testsaslauthd_SOURCES = testsaslauthd.c utils.c
+ testsaslauthd_LDADD = @LIB_SOCKET@
+--- a/sasldb/Makefile.am
+++ b/sasldb/Makefile.am
+@@ -55,8 +55,8 @@ noinst_LIBRARIES = libsasldb.a
+ 
+ libsasldb_la_SOURCES = allockey.c sasldb.h
+ EXTRA_libsasldb_la_SOURCES = $(extra_common_sources)
+-libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND)
+-libsasldb_la_LIBADD = $(SASL_DB_BACKEND) 
+libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) $(SASL_DB_LIB)
+libsasldb_la_LIBADD = $(SASL_DB_BACKEND) $(SASL_DB_LIB)
+ 
+ # Prevent make dist stupidity
+ libsasldb_a_SOURCES =
@@ -0,0 +1,14 @@
+Author: Roberto C. Sanchez <roberto@connexer.com>
+Description: Drop gratuitous dependency on krb5support
+--- a/cmulocal/sasl2.m4
+++ b/cmulocal/sasl2.m4
+@@ -112,9 +112,6 @@ if test "$gssapi" != no; then
+   fi
+ 
+   if test "$gss_impl" = "auto" -o "$gss_impl" = "mit"; then
+-    # check for libkrb5support first
+-    AC_CHECK_LIB(krb5support,krb5int_getspecific,K5SUP=-lkrb5support K5SUPSTATIC=$gssapi_dir/libkrb5support.a,,${LIB_SOCKET})
+-
+     gss_failed=0
+     AC_CHECK_LIB(gssapi_krb5,gss_unwrap,gss_impl="mit",gss_failed=1,
+                  ${GSSAPIBASE_LIBS} -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err ${K5SUP} ${LIB_SOCKET})
@@ -0,0 +1,134 @@
+--- a/lib/dlopen.c
+++ b/lib/dlopen.c
+@@ -247,105 +247,6 @@ static int _sasl_plugin_load(char *plugi
+     return result;
+ }
+ 
+-/* this returns the file to actually open.
+- *  out should be a buffer of size PATH_MAX
+- *  and may be the same as in. */
+-
+-/* We'll use a static buffer for speed unless someone complains */
+-#define MAX_LINE 2048
+-
+-static int _parse_la(const char *prefix, const char *in, char *out) 
+-{
+-    FILE *file;
+-    size_t length;
+-    char line[MAX_LINE];
+-    char *ntmp = NULL;
+-
+-    if(!in || !out || !prefix || out == in) return SASL_BADPARAM;
+-
+-    /* Set this so we can detect failure */
+-    *out = '\0';
+-
+-    length = strlen(in);
+-
+-    if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) {
+-	if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) {
+-	    /* check for a .la file */
+-	    strcpy(line, prefix);
+-	    strcat(line, in);
+-	    length = strlen(line);
+-	    *(line + (length - strlen(SO_SUFFIX))) = '\0';
+-	    strcat(line, LA_SUFFIX);
+-	    file = fopen(line, "r");
+-	    if(file) {
+-		/* We'll get it on the .la open */
+-		fclose(file);
+-		return SASL_FAIL;
+-	    }
+-	}
+-	strcpy(out, prefix);
+-	strcat(out, in);
+-	return SASL_OK;
+-    }
+-
+-    strcpy(line, prefix);
+-    strcat(line, in);
+-
+-    file = fopen(line, "r");
+-    if(!file) {
+-	_sasl_log(NULL, SASL_LOG_WARN,
+-		  "unable to open LA file: %s", line);
+-	return SASL_FAIL;
+-    }
+-    
+-    while(!feof(file)) {
+-	if(!fgets(line, MAX_LINE, file)) break;
+-	if(line[strlen(line) - 1] != '\n') {
+-	    _sasl_log(NULL, SASL_LOG_WARN,
+-		      "LA file has too long of a line: %s", in);
+-	    return SASL_BUFOVER;
+-	}
+-	if(line[0] == '\n' || line[0] == '#') continue;
+-	if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) {
+-	    /* We found the line with the name in it */
+-	    char *end;
+-	    char *start;
+-	    size_t len;
+-	    end = strrchr(line, '\'');
+-	    if(!end) continue;
+-	    start = &line[sizeof("dlname=")-1];
+-	    len = strlen(start);
+-	    if(len > 3 && start[0] == '\'') {
+-		ntmp=&start[1];
+-		*end='\0';
+-		/* Do we have dlname="" ? */
+-		if(ntmp == end) {
+-		    _sasl_log(NULL, SASL_LOG_DEBUG,
+-			      "dlname is empty in .la file: %s", in);
+-		    return SASL_FAIL;
+-		}
+-		strcpy(out, prefix);
+-		strcat(out, ntmp);
+-	    }
+-	    break;
+-	}
+-    }
+-    if(ferror(file) || feof(file)) {
+-	_sasl_log(NULL, SASL_LOG_WARN,
+-		  "Error reading .la: %s\n", in);
+-	fclose(file);
+-	return SASL_FAIL;
+-    }
+-    fclose(file);
+-
+-    if(!(*out)) {
+-	_sasl_log(NULL, SASL_LOG_WARN,
+-		  "Could not find a dlname line in .la file: %s", in);
+-	return SASL_FAIL;
+-    }
+-
+-    return SASL_OK;
+-}
+ #endif /* DO_DLOPEN */
+ 
+ /* loads a plugin library */
+@@ -499,18 +400,18 @@ int _sasl_load_plugins(const add_plugin_
+ 		if (length + pos>=PATH_MAX) continue; /* too big */
+ 
+ 		if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)),
+-			   SO_SUFFIX)
+-		    && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)),
+-			   LA_SUFFIX))
+			   SO_SUFFIX))
+ 		    continue;
+ 
+		/* We only use .so files for loading plugins */
+
+ 		memcpy(name,dir->d_name,length);
+ 		name[length]='\0';
+ 
+-		result = _parse_la(prefix, name, tmp);
+-		if(result != SASL_OK)
+-		    continue;
+-		
+		/* Create full name with path */
+		strncpy(tmp, prefix, PATH_MAX);
+		strncat(tmp, name, PATH_MAX);
+
+ 		/* skip "lib" and cut off suffix --
+ 		   this only need be approximate */
+ 		strcpy(plugname, name + 3);
@@ -0,0 +1,116 @@
+From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@hush.com>
+Date: Thu, 11 Jul 2013 09:08:07 +0000
+Subject: Handle NULL returns from glibc 2.17+ crypt()
+
+Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL
+(w/ NULL return) if the salt violates specifications. Additionally,
+on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords
+passed to crypt() fail with EPERM (w/ NULL return).
+
+When using glibc's crypt(), check return value to avoid a possible
+NULL pointer dereference.
+
+Patch by mancha1@hush.com.
+---
+diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c
+index 4b34222..400289c 100644
+--- a/pwcheck/pwcheck_getpwnam.c
+++ b/pwcheck/pwcheck_getpwnam.c
+@@ -32,6 +32,7 @@ char *userid;
+ char *password;
+ {
+     char* r;
+    char* crpt_passwd;
+     struct passwd *pwd;
+ 
+     pwd = getpwnam(userid);
+@@ -41,7 +42,7 @@ char *password;
+     else if (pwd->pw_passwd[0] == '*') {
+ 	r = "Account disabled";
+     }
+-    else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) {
+    else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) {
+ 	r = "Incorrect password";
+     }
+     else {
+diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c
+index 2b11286..6d607bb 100644
+--- a/pwcheck/pwcheck_getspnam.c
+++ b/pwcheck/pwcheck_getspnam.c
+@@ -32,13 +32,15 @@ char *userid;
+ char *password;
+ {
+     struct spwd *pwd;
+    char *crpt_passwd;
+ 
+     pwd = getspnam(userid);
+     if (!pwd) {
+ 	return "Userid not found";
+     }
+     
+-    if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) {
+    crpt_passwd = crypt(password, pwd->sp_pwdp);
+    if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) {
+ 	return "Incorrect password";
+     }
+     else {
+diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c
+index fc8029d..d4ebe54 100644
+--- a/saslauthd/auth_getpwent.c
+++ b/saslauthd/auth_getpwent.c
+@@ -77,6 +77,7 @@ auth_getpwent (
+ {
+     /* VARIABLES */
+     struct passwd *pw;			/* pointer to passwd file entry */
+    char *crpt_passwd;			/* encrypted password */
+     int errnum;
+     /* END VARIABLES */
+   
+@@ -105,7 +106,8 @@ auth_getpwent (
+ 	}
+     }
+ 
+-    if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) {
+    crpt_passwd = crypt(password, pw->pw_passwd);
+    if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) {
+ 	if (flags & VERBOSE) {
+ 	    syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login);
+ 	}
+diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c
+index 677131b..1988afd 100644
+--- a/saslauthd/auth_shadow.c
+++ b/saslauthd/auth_shadow.c
+@@ -210,8 +210,8 @@ auth_shadow (
+ 	RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)");
+     }
+ 
+-    cpw = strdup((const char *)crypt(password, sp->sp_pwdp));
+-    if (strcmp(sp->sp_pwdp, cpw)) {
+    cpw = crypt(password, sp->sp_pwdp);
+    if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) {
+ 	if (flags & VERBOSE) {
+ 	    /*
+ 	     * This _should_ reveal the SHADOW_PW_LOCKED prefix to an
+@@ -221,10 +221,8 @@ auth_shadow (
+ 	    syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'",
+ 		   sp->sp_pwdp, cpw);
+ 	}
+-	free(cpw);
+ 	RETURN("NO Incorrect password");
+     }
+-    free(cpw);
+ 
+     /*
+      * The following fields will be set to -1 if:
+@@ -286,7 +284,7 @@ auth_shadow (
+ 	RETURN("NO Invalid username");
+     }
+   
+-    if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) {
+    if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) {
+ 	if (flags & VERBOSE) {
+ 	    syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s",
+ 		   password, upw->upw_passwd);
+--
+cgit v0.9.2
@@ -0,0 +1,20 @@
+--- cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc	2005-05-06 16:05:44.000000000 -0400
+++ cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc	2005-05-06 16:05:39.000000000 -0400
+@@ -216,7 +216,7 @@
+ .Em (All platforms that support OpenLDAP 2.0 or higher)
+ .Pp
+ Authenticate against an ldap server.  The ldap configuration parameters are
+-read from /usr/local/etc/saslauthd.conf.  The location of this file can be
+read from /etc/saslauthd.conf.  The location of this file can be
+ changed with the -O parameter. See the LDAP_SASLAUTHD file included with the
+ distribution for the list of available parameters.
+ .It Li sia
+@@ -249,7 +249,7 @@
+ .Bl -tag -width "/run/saslauthd/mux"
+ .It Pa /run/saslauthd/mux
+ The default communications socket.
+-.It Pa /usr/local/etc/saslauthd.conf
+.It Pa /etc/saslauthd.conf
+ The default configuration file for ldap support.
+ .El
+ .Sh SEE ALSO
@@ -0,0 +1,120 @@
+Prefer types in <inttypes.h> to our own, because it removes file content
+conflicts between 32- and 64-bit architectures.  RFEd as #2829.
+
+--- cyrus-sasl-2.1.21/configure.in	2006-05-16 07:37:52.000000000 -0400
+++ cyrus-sasl-2.1.21/configure.in	2006-05-16 07:37:52.000000000 -0400
+@@ -1083,6 +1083,10 @@
+ AC_HEADER_DIRENT
+ AC_HEADER_SYS_WAIT
+ AC_CHECK_HEADERS(des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h)
+AC_CHECK_TYPES([long long, int8_t, uint8_t, int16_t, uint16_t, int32_t, uint32_t, int64_t, uint64_t],,,[
+#ifdef HAVE_INTTYPES_H
+#include <inttypes.h>
+#endif])
+ 
+ IPv6_CHECK_SS_FAMILY()
+ IPv6_CHECK_SA_LEN()
+--- cyrus-sasl-2.1.21/include/makemd5.c	2003-02-13 14:55:52.000000000 -0500
+++ cyrus-sasl-2.1.21/include/makemd5.c	2006-05-16 07:45:08.000000000 -0400
+@@ -82,12 +82,19 @@
+  */
+ 
+ 
+#ifdef HAVE_CONFIG_H
+#include "../config.h"
+#endif
+ 
+ #include <stdio.h>
+ #include <string.h>
+ #include <stdlib.h>
+ #include <ctype.h>
+ 
+#ifdef HAVE_INTTYPES_H
+#include <inttypes.h>
+#endif
+
+ 
+ static void
+ my_strupr(char *s)
+@@ -122,6 +129,18 @@
+ static void
+ try_signed(FILE *f, int len)
+ {
+#ifdef HAVE_INT8_T
+    BITSIZE(int8_t);
+#endif
+#ifdef HAVE_INT16_T
+    BITSIZE(int16_t);
+#endif
+#ifdef HAVE_INT32_T
+    BITSIZE(int32_t);
+#endif
+#ifdef HAVE_INT64_T
+    BITSIZE(int64_t);
+#endif
+     BITSIZE(signed char);
+     BITSIZE(short);
+     BITSIZE(int);
+@@ -135,6 +154,18 @@
+ static void
+ try_unsigned(FILE *f, int len)
+ {
+#ifdef HAVE_UINT8_T
+    BITSIZE(uint8_t);
+#endif
+#ifdef HAVE_UINT16_T
+    BITSIZE(uint16_t);
+#endif
+#ifdef HAVE_UINT32_T
+    BITSIZE(uint32_t);
+#endif
+#ifdef HAVE_UINT64_T
+    BITSIZE(uint64_t);
+#endif
+     BITSIZE(unsigned char);
+     BITSIZE(unsigned short);
+     BITSIZE(unsigned int);
+@@ -165,6 +196,11 @@
+ 	  "/* POINTER defines a generic pointer type */\n"
+ 	  "typedef unsigned char *POINTER;\n"
+ 	  "\n"
+#ifdef HAVE_INTTYPES_H
+	  "/* We try to define integer types for our use */\n"
+	  "#include <inttypes.h>\n"
+	  "\n"
+#endif
+ 	  );
+   return 1;
+ }
+@@ -212,31 +248,15 @@
+ 
+   print_pre(f);
+ 
+-#ifndef HAVE_INT8_T
+     try_signed (f, 8);
+-#endif /* HAVE_INT8_T */
+-#ifndef HAVE_INT16_T
+     try_signed (f, 16);
+-#endif /* HAVE_INT16_T */
+-#ifndef HAVE_INT32_T
+     try_signed (f, 32);
+-#endif /* HAVE_INT32_T */
+-#ifndef HAVE_INT64_T
+     try_signed (f, 64);
+-#endif /* HAVE_INT64_T */
+ 
+-#ifndef HAVE_U_INT8_T
+     try_unsigned (f, 8);
+-#endif /* HAVE_INT8_T */
+-#ifndef HAVE_U_INT16_T
+     try_unsigned (f, 16);
+-#endif /* HAVE_U_INT16_T */
+-#ifndef HAVE_U_INT32_T
+     try_unsigned (f, 32);
+-#endif /* HAVE_U_INT32_T */
+-#ifndef HAVE_U_INT64_T
+     try_unsigned (f, 64);
+-#endif /* HAVE_U_INT64_T */
+ 
+     print_post(f);
+   
@@ -0,0 +1,11 @@
+--- saslauthd/configure.in.orig	2006-05-23 15:53:17.000000000 -0700
+++ saslauthd/configure.in	2006-05-23 15:53:33.000000000 -0700
+@@ -77,7 +77,7 @@
+   AC_DEFINE(AUTH_SASLDB,[],[Include SASLdb Support])
+   SASL_DB_PATH_CHECK()
+   SASL_DB_CHECK()
+-  SASL_DB_LIB="$SASL_DB_LIB ../sasldb/.libs/libsasldb.al"
+  SASL_DB_LIB="../sasldb/.libs/libsasldb.a $SASL_DB_LIB"
+ fi
+ 
+ AC_ARG_ENABLE(httpform, [  --enable-httpform       enable HTTP form authentication [[no]] ],
@@ -0,0 +1,26 @@
+diff -up cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 cyrus-sasl-2.1.22/config/kerberos_v4.m4
+--- cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4	2005-05-07 06:14:55.000000000 +0200
+++ cyrus-sasl-2.1.22/config/kerberos_v4.m4	2008-08-14 23:41:26.000000000 +0200
+@@ -102,7 +102,6 @@ AC_DEFUN([SASL_KERBEROS_V4_CHK], [
+        if test -n "${cyrus_krbinclude}"; then
+          CPPFLAGS="$CPPFLAGS -I${cyrus_krbinclude}"
+        fi
+-       LDFLAGS="$LDFLAGS -L$krb4/lib"
+     fi
+ 
+     if test "$with_des" != no; then
+diff -up cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 cyrus-sasl-2.1.22/plugins/kerberos4.c
+--- cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4	2005-01-10 08:08:53.000000000 +0100
+++ cyrus-sasl-2.1.22/plugins/kerberos4.c	2008-08-14 23:36:33.000000000 +0200
+@@ -49,11 +49,7 @@
+ #include <krb.h>
+ 
+ #ifdef WITH_DES
+-# ifdef WITH_SSL_DES
+-#  include <openssl/des.h>
+-# else
+ #  include <des.h>
+-# endif /* WITH_SSL_DES */
+ #endif /* WITH_DES */
+ 
+ #ifdef WIN32
@@ -0,0 +1,25 @@
+commit c9447e1c3ffba88783e5d9396b832be82d3c78fc
+Author: Kazuo Ito <ito.kazuo@oss.ntt.co.jp>
+Date:   Wed Dec 10 12:03:29 2008 +0900
+
+    support for LDAP_OPT_TIMEOUT
+    
+    OpenLDAP since 2.4 implements support for this option in ldap_result(),
+    among other things.
+
+diff --git a/saslauthd/lak.c b/saslauthd/lak.c
+index 803d51f..8714265 100644
+--- a/saslauthd/lak.c
+++ b/saslauthd/lak.c
+@@ -833,6 +833,11 @@ static int lak_connect(
+ 		syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_NETWORK_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec);
+ 	}
+ 
+	rc = ldap_set_option(lak->ld, LDAP_OPT_TIMEOUT, &(lak->conf->timeout));
+	if (rc != LDAP_OPT_SUCCESS) {
+		syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec);
+	}
+
+ 	rc = ldap_set_option(lak->ld, LDAP_OPT_TIMELIMIT, &(lak->conf->time_limit));
+ 	if (rc != LDAP_OPT_SUCCESS) {
+ 		syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMELIMIT %d.", lak->conf->time_limit);
@@ -0,0 +1,22 @@
+fix missing prototype warnings
+
+--- cyrus-sasl-2.1.22/lib/auxprop.c
+++ cyrus-sasl-2.1.22/lib/auxprop.c
+@@ -43,6 +43,7 @@
+  */
+ 
+ #include <config.h>
+#include <stdio.h>
+ #include <sasl.h>
+ #include <prop.h>
+ #include <ctype.h>
+--- cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c
+++ cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c
+@@ -24,6 +24,7 @@ OF OR IN CONNECTION WITH THE USE OR PERF
+ ******************************************************************/
+ 
+ #include <shadow.h>
+#include <string.h>
+ 
+ extern char *crypt();
+ 
@@ -0,0 +1,37 @@
+diff -up cyrus-sasl-2.1.23/mac/libdes/src/des_crypt.man cyrus-sasl-2.1.23/mac/libdes/src/des_crypt
+diff -up cyrus-sasl-2.1.23/mac/libdes/src/des.man cyrus-sasl-2.1.23/mac/libdes/src/des
+diff -up cyrus-sasl-2.1.23/man/Makefile.am.man cyrus-sasl-2.1.23/man/Makefile.am
+--- cyrus-sasl-2.1.23/man/Makefile.am.man	2010-02-05 10:40:17.000000000 +0100
+++ cyrus-sasl-2.1.23/man/Makefile.am	2010-02-05 10:40:47.000000000 +0100
+@@ -54,6 +54,6 @@ man_MANS = sasl_authorize_t.3 sasl_done.
+ 	   sasl_auxprop_getctx.3 sasl_auxprop.3 sasl_idle.3 \
+ 	   sasl_errdetail.3 sasl_user_exists.3 sasl_setpass.3 \
+ 	   sasl_server_userdb_checkpass_t.3 sasl_server_userdb_setpass_t.3 \
+-	   sasl_global_listmech.3 sasl_getconfpath_t.3
+	   sasl_global_listmech.3 sasl_getconfpath_t.3 testsaslauthd.8
+ 
+ EXTRA_DIST = $(man_MANS)
+diff -up cyrus-sasl-2.1.23/man/testsaslauthd.8.man cyrus-sasl-2.1.23/man/testsaslauthd.8
+--- cyrus-sasl-2.1.23/man/testsaslauthd.8.man	2010-02-05 10:40:07.000000000 +0100
+++ cyrus-sasl-2.1.23/man/testsaslauthd.8	2010-02-05 09:48:43.000000000 +0100
+@@ -0,0 +1,20 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.TH TESTSASLAUTHD 8 "14 October 2006"
+.SH NAME
+testsaslauthd \- test utility for the SASL authentication server
+.SH SYNOPSIS
+.B testsaslauthd
+.RI "[ " \(hyr " " realm " ] [ " \(hys " " servicename " ] [ " \(hyf " " socket " " path " ] [ " \(hyR " " repeatnum " ]"
+.SH DESCRIPTION
+This manual page documents briefly the
+.B testsaslauthd
+command.
+.PP
+.SH SEE ALSO
+.BR saslauthd (8).
+.br
+.SH AUTHOR
+testsaslauthd was written by Carnegie Mellon University.
+.PP
+This manual page was written by Roberto C. Sanchez <roberto@connexer.com>,
+for the Debian project (but may be used by others).
@@ -0,0 +1,36 @@
+diff --git a/cmulocal/sasl2.m4 b/cmulocal/sasl2.m4
+index 3c2841a..b086b8f 100644
+--- a/cmulocal/sasl2.m4
+++ b/cmulocal/sasl2.m4
+@@ -269,6 +269,18 @@ if test "$gssapi" != no; then
+   cmu_save_LIBS="$LIBS"
+   LIBS="$LIBS $GSSAPIBASE_LIBS"
+   AC_CHECK_FUNCS(gsskrb5_register_acceptor_identity)
+  if test "$ac_cv_func_gsskrb5_register_acceptor_identity" = no ; then
+    AC_CHECK_HEADERS(gssapi/gssapi_krb5.h)
+    if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then
+      AC_CHECK_DECL(gsskrb5_register_acceptor_identity,
+                    [AC_DEFINE(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY,1,
+                               [Define if your GSSAPI implementation defines gsskrb5_register_acceptor_identity])],,
+                    [
+                    AC_INCLUDES_DEFAULT
+                    #include <gssapi/gssapi_krb5.h>
+                    ])
+    fi
+  fi
+   AC_CHECK_FUNCS(gss_decapsulate_token)
+   AC_CHECK_FUNCS(gss_encapsulate_token)
+   AC_CHECK_FUNCS(gss_oid_equal)
+diff --git a/plugins/gssapi.c b/plugins/gssapi.c
+index 6be9d23..e6fcf46 100644
+--- a/plugins/gssapi.c
+++ b/plugins/gssapi.c
+@@ -51,6 +51,8 @@
+ #include <gssapi/gssapi.h>
+ #endif
+ 
+#include <gssapi/gssapi_krb5.h>
+
+ #ifdef WIN32
+ #  include <winsock2.h>
+ 
@@ -0,0 +1,19 @@
+--- cmulocal/cyrus.m4~	2014-01-09 11:31:10.423302394 +0100
+++ cmulocal/cyrus.m4	2014-01-09 11:31:56.823302243 +0100
+@@ -32,14 +32,5 @@
+ dnl runpath initialization
+ AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [
+    # CMU GUESS RUNPATH SWITCH
+-  AC_CACHE_CHECK(for runpath switch, andrew_cv_runpath_switch, [
+-    # first, try -R
+-    SAVE_LDFLAGS="${LDFLAGS}"
+-    LDFLAGS="-R /usr/lib"
+-    AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-R"], [
+-  	LDFLAGS="-Wl,-rpath,/usr/lib"
+-    AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-Wl,-rpath,"],
+-    [andrew_cv_runpath_switch="none"])
+-    ])
+-  LDFLAGS="${SAVE_LDFLAGS}"
+-  ])])
+    andrew_runpath_switch="none"
+  ])
@@ -0,0 +1,13 @@
+diff --git a/configure.in b/configure.in
+index e70c99a..60f366c 100644
+--- a/configure.in
+++ b/configure.in
+@@ -1416,7 +1416,7 @@ inline static unsigned int sleep(unsigned int seconds) {
+ #endif /* CONFIG_H */
+ ])
+ 
+-AM_CONFIG_HEADER(config.h)
+AC_CONFIG_HEADERS(config.h)
+ 
+ AC_OUTPUT(Makefile
+ libsasl2.pc
@@ -0,0 +1,51 @@
+commit 26dcfb2d7176b78e70757aa5d01951a28ca217c7
+Author: Alexey Melnikov <alexey.melnikov@isode.com>
+Date:   Fri Jul 5 16:37:59 2013 +0100
+
+    Treat SCRAM-SHA-1/DIGEST-MD5 as more secure than PLAIN when selecting the best client side SASL mechanism
+    
+    Both SCRAM-SHA-1 & DIGEST-MD5 are lacking SASL_SEC_PASS_CREDENTIALS security
+    flag, which prevented them from being chosen over PLAIN when PLAIN is selected
+    as the best mechanism first. For example the problem can be observed when
+    the server advertises "PLAIN DIGEST-MD5 SCRAM-SHA-1" (PLAIN just has to be
+    returned before SCRAM/DIGEST.)
+    
+    Cyrus SASL bug # 3793
+
+diff --git a/lib/client.c b/lib/client.c
+index 62dfb0b..31fe346 100644
+--- a/lib/client.c
+++ b/lib/client.c
+@@ -658,6 +658,20 @@ _sasl_cbinding_disp(sasl_client_params_t *cparams,
+     return SASL_OK;
+ }
+ 
+static int
+_sasl_are_current_security_flags_worse_then_best(unsigned best_security_flags,
+						 unsigned current_security_flags)
+{
+    /* We don't qualify SASL_SEC_PASS_CREDENTIALS as "secure" flag */
+    best_security_flags &= ~SASL_SEC_PASS_CREDENTIALS;
+
+    if ((current_security_flags ^ best_security_flags) & best_security_flags) {
+	return 1;
+    } else {
+	return 0;
+    }
+}
+
+ /* select a mechanism for a connection
+  *  mechlist      -- mechanisms server has available (punctuation ignored)
+  *  secret        -- optional secret from previous session
+@@ -823,8 +837,9 @@ int sasl_client_start(sasl_conn_t *conn,
+ 	     */
+ 
+ 	    if (bestm &&
+-		((m->m.plug->security_flags ^ bestm->m.plug->security_flags) &
+-		 bestm->m.plug->security_flags)) {
+		_sasl_are_current_security_flags_worse_then_best(
+		    bestm->m.plug->security_flags,
+		    m->m.plug->security_flags)) {
+ 		break;
+ 	    }
+ 
@@ -0,0 +1,59 @@
+diff -up cyrus-sasl-2.1.26/lib/Makefile.am.relro cyrus-sasl-2.1.26/lib/Makefile.am
+--- cyrus-sasl-2.1.26/lib/Makefile.am.relro	2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/lib/Makefile.am	2013-02-11 14:18:01.749053772 +0100
+@@ -64,7 +64,7 @@ LIB_DOOR= @LIB_DOOR@
+ lib_LTLIBRARIES = libsasl2.la
+ 
+ libsasl2_la_SOURCES = $(common_sources) $(common_headers)
+-libsasl2_la_LDFLAGS = -version-info $(sasl_version)
+libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version)
+ libsasl2_la_DEPENDENCIES = $(LTLIBOBJS)
+ libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR)
+ 
+diff -up cyrus-sasl-2.1.26/lib/Makefile.in.relro cyrus-sasl-2.1.26/lib/Makefile.in
+--- cyrus-sasl-2.1.26/lib/Makefile.in.relro	2013-11-13 16:55:09.606555125 +0100
+++ cyrus-sasl-2.1.26/lib/Makefile.in	2013-11-13 16:56:43.331096795 +0100
+@@ -330,7 +330,7 @@ common_headers = saslint.h
+ common_sources = auxprop.c canonusr.c checkpw.c client.c common.c config.c external.c md5.c saslutil.c server.c seterror.c dlopen.c ../plugins/plugin_common.c
+ lib_LTLIBRARIES = libsasl2.la
+ libsasl2_la_SOURCES = $(common_sources) $(common_headers)
+-libsasl2_la_LDFLAGS = -version-info $(sasl_version)
+libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version)
+ libsasl2_la_DEPENDENCIES = $(LTLIBOBJS)
+ libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR)
+ @MACOSX_TRUE@framedir = /Library/Frameworks/SASL2.framework
+diff -up cyrus-sasl-2.1.26/plugins/Makefile.am.relro cyrus-sasl-2.1.26/plugins/Makefile.am
+--- cyrus-sasl-2.1.26/plugins/Makefile.am.relro	2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/plugins/Makefile.am	2013-02-11 14:18:01.749053772 +0100
+@@ -50,7 +50,7 @@
+ plugin_version = 3:0:0
+ 
+ INCLUDES=-I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include
+-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
+AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
+ 
+ COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@
+ 
+diff -up cyrus-sasl-2.1.26/plugins/Makefile.in.relro cyrus-sasl-2.1.26/plugins/Makefile.in
+--- cyrus-sasl-2.1.26/plugins/Makefile.in.relro	2013-11-13 16:57:08.430974081 +0100
+++ cyrus-sasl-2.1.26/plugins/Makefile.in	2013-11-13 16:57:58.911727846 +0100
+@@ -364,7 +364,7 @@ top_srcdir = @top_srcdir@
+ # CURRENT:REVISION:AGE
+ plugin_version = 3:0:0
+ INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include
+-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
+AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
+ COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@
+ EXTRA_DIST = makeinit.sh NTMakefile
+ noinst_SCRIPTS = makeinit.sh
+diff -up cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro cyrus-sasl-2.1.26/saslauthd/Makefile.am
+--- cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro	2013-02-11 14:18:36.910900647 +0100
+++ cyrus-sasl-2.1.26/saslauthd/Makefile.am	2013-02-11 14:20:17.336463915 +0100
+@@ -17,6 +17,7 @@ saslauthd_DEPENDENCIES = saslauthd-main.
+ saslauthd_LDADD	= @SASL_KRB_LIB@ \
+ 		  @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \
+ 		  @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@
+saslauthd_LDFLAGS = -pie -Wl,-z,now
+ 
+ testsaslauthd_SOURCES = testsaslauthd.c utils.c
+ testsaslauthd_LDADD = @LIB_SOCKET@
@@ -0,0 +1,12 @@
+diff -up cyrus-sasl-2.1.26/include/sasl.h.size_t cyrus-sasl-2.1.26/include/sasl.h
+--- cyrus-sasl-2.1.26/include/sasl.h.size_t	2012-10-12 09:05:48.000000000 -0500
+++ cyrus-sasl-2.1.26/include/sasl.h	2013-01-31 13:21:04.007739327 -0600
+@@ -223,6 +223,8 @@ extern "C" {
+  * they must be called before all other SASL functions:
+  */
+ 
+#include <sys/types.h>
+
+ /* memory allocation functions which may optionally be replaced:
+  */
+ typedef void *sasl_malloc_t(size_t);
@@ -0,0 +1,74 @@
+diff -up cyrus-sasl-2.1.26/lib/server.c.warnings cyrus-sasl-2.1.26/lib/server.c
+--- cyrus-sasl-2.1.26/lib/server.c.warnings	2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/lib/server.c	2012-12-20 17:49:39.620254792 +0100
+@@ -650,7 +650,7 @@ static int load_config(const sasl_callba
+             goto done;
+         }
+ 
+-        snprintf(config_filename, len, "%.*s%c%s.conf", path_len, path_to_config, 
+        snprintf(config_filename, len, "%.*s%c%s.conf", (int)path_len, path_to_config, 
+ 	        HIER_DELIMITER, global_callbacks.appname);
+ 
+         /* Ask the application if it's safe to use this file */
+diff -up cyrus-sasl-2.1.26/plugins/gssapi.c.warnings cyrus-sasl-2.1.26/plugins/gssapi.c
+--- cyrus-sasl-2.1.26/plugins/gssapi.c.warnings	2012-01-28 00:31:36.000000000 +0100
+++ cyrus-sasl-2.1.26/plugins/gssapi.c	2012-12-20 17:49:39.620254792 +0100
+@@ -202,7 +202,8 @@ sasl_gss_seterror_(const sasl_utils_t *u
+     OM_uint32 msg_ctx;
+     int ret;
+     char *out = NULL;
+-    size_t len, curlen = 0;
+    size_t len;
+    unsigned curlen = 0;
+     const char prefix[] = "GSSAPI Error: ";
+ 
+     if (!utils) return SASL_OK;
+diff -up cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings cyrus-sasl-2.1.26/plugins/ldapdb.c
+--- cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings	2012-01-28 00:31:36.000000000 +0100
+++ cyrus-sasl-2.1.26/plugins/ldapdb.c	2012-12-20 17:49:39.621254788 +0100
+@@ -22,6 +22,7 @@
+ 
+ #include "plugin_common.h"
+ 
+#define LDAP_DEPRECATED 1
+ #include <ldap.h>
+ 
+ static char ldapdb[] = "ldapdb";
+diff -up cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings cyrus-sasl-2.1.26/plugins/plugin_common.c
+--- cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings	2013-09-03 14:40:35.181455452 +0200
+++ cyrus-sasl-2.1.26/plugins/plugin_common.c	2013-09-03 14:40:38.320441024 +0200
+@@ -94,7 +94,7 @@ static void sockaddr_unmapped(
+     if (!IN6_IS_ADDR_V4MAPPED((&sin6->sin6_addr)))
+ 	return;
+     sin4 = (struct sockaddr_in *)sa;
+-    addr = *(uint32_t *)&sin6->sin6_addr.s6_addr[12];
+    addr = *(uint32_t *)&sin6->sin6_addr.s6_addr32[3];
+     port = sin6->sin6_port;
+     memset(sin4, 0, sizeof(struct sockaddr_in));
+     sin4->sin_addr.s_addr = addr;
+diff -up cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_httpform.c
+--- cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings	2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/saslauthd/auth_httpform.c	2013-09-03 14:39:25.411776109 +0200
+@@ -574,7 +574,7 @@ auth_httpform (
+               "Content-Type: application/x-www-form-urlencoded" CRLF
+               "Content-Length: %d" TWO_CRLF
+               "%s",
+-              r_uri, r_host, r_port, strlen(req), req);
+              r_uri, r_host, r_port, (int)strlen(req), req);
+ 
+     if (flags & VERBOSE) {
+         syslog(LOG_DEBUG, "auth_httpform: sending %s %s %s",
+diff -up cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_shadow.c
+--- cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings	2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/saslauthd/auth_shadow.c	2012-12-20 17:49:39.621254788 +0100
+@@ -70,6 +70,10 @@
+ #  include <shadow.h>
+ # endif /* ! HAVE_GETUSERPW */
+ 
+# ifdef HAVE_CRYPT_H
+#  include <crypt.h>
+# endif
+
+ # include "auth_shadow.h"
+ # include "globals.h"
+ /* END PUBLIC DEPENDENCIES */
@@ -0,0 +1,16 @@
+# Specify the authentications mechanism.
+# List: getpwent,kerberos5,pam,rimap,shadow,ldap
+# *NOTE* For actual list see: saslauthd -v
+SASLAUTHD_OPTS="-a pam"
+
+# Specify the hostname for remote IMAP server.
+# *NOTE* Only needed if rimap auth mech is used.
+#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -O localhost"
+
+# Specify the number of worker processes to create.
+#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -n 5"
+
+# Enable credential cache, cache size, and timeout.
+# *NOTE* Size is measured in kilobytes 
+#        Timeout is measured in seconds
+#SASLAUTHD_OPTS="${SASLAUTHD_OPTS} -c -s 128 -t 30"
@@ -0,0 +1,6 @@
+#%PAM-1.0
+
+auth       required     pam_nologin.so
+auth       include      system-auth
+account    include      system-auth
+session    include      system-auth
@@ -0,0 +1 @@
+d /run/saslauthd 0755 root root - -
@@ -0,0 +1,138 @@
+<?xml version="1.0" ?>
+<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
+<PISI>
+    <Source>
+        <Name>cyrus-sasl</Name>
+        <Homepage>http://asg.web.cmu.edu/sasl/</Homepage>
+        <Packager>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Packager>
+        <License>as-is</License>
+        <IsA>library</IsA>
+        <IsA>service</IsA>
+        <Summary>The Cyrus SASL (Simple Authentication and Security Layer)</Summary>
+        <Description>cyrus-sasl is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions.</Description>
+        <Archive sha1sum="d6669fb91434192529bd13ee95737a8a5040241c" type="targz">http://cyrusimap.org/releases/cyrus-sasl-2.1.26.tar.gz</Archive>
+        <BuildDependencies>
+            <Dependency>mit-kerberos</Dependency>
+            <Dependency>pam-devel</Dependency>
+            <Dependency>gdbm-devel</Dependency>
+            <Dependency>e2fsprogs-devel</Dependency>
+            <Dependency>openssl-devel</Dependency>
+            <Dependency>groff</Dependency>
+        </BuildDependencies>
+        <Patches>
+            <!--Patch level="1">fix-linkage.patch</Patch-->
+            <Patch level="1">CVE-2013-4122.patch</Patch>
+            <Patch level="1">0011_saslauthd_ac_prog_libtool.patch</Patch>
+            <Patch level="1">0025_ld_as_needed.patch</Patch>
+            <Patch level="1">0026_drop_krb5support_dependency.patch</Patch>
+            <Patch level="1">0030-dont_use_la_files_for_opening_plugins.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.20-saslauthd.conf-path.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.21-sizes.patch</Patch>
+            <Patch level="0">cyrus-sasl-2.1.22-as-needed.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.22-qa.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.22-kerberos4.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.22-ldap-timeout.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.23-man.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.26-keytab.patch</Patch>
+            <Patch level="0">cyrus-sasl-2.1.26-no_rpath.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.26-obsolete-macro.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.26-relro.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.26-size_t.patch</Patch>
+            <Patch level="1">cyrus-sasl-2.1.26-warnings.patch</Patch>
+        </Patches>
+    </Source>
+
+    <Package>
+        <Name>cyrus-sasl</Name>
+        <RuntimeDependencies>
+	  <!--<Dependency>openldap-client</Dependency>-->
+            <Dependency>mit-kerberos</Dependency>
+            <Dependency>pam</Dependency>
+            <Dependency>gdbm</Dependency>
+            <Dependency>e2fsprogs</Dependency>
+            <Dependency>openssl</Dependency>
+        </RuntimeDependencies>
+        <Files>
+            <Path fileType="config">/etc</Path>
+            <Path fileType="config">/usr/lib/tmpfiles.d/cyrus-sasl.conf</Path>
+            <Path fileType="executable">/usr/sbin</Path>
+            <Path fileType="library">/usr/lib</Path>
+            <Path fileType="data">/usr/share/cyrus-sasl-2</Path>
+            <Path fileType="data">/run</Path>
+            <Path fileType="man">/usr/share/man</Path>
+            <Path fileType="doc">/usr/share/doc</Path>
+        </Files>
+        <AdditionalFiles>
+            <AdditionalFile target="/etc/conf.d/saslauthd" permission="0644" owner="root">saslauthd.confd</AdditionalFile>
+            <AdditionalFile target="/etc/pam.d/saslauthd" permission="0644" owner="root">saslauthd.pam</AdditionalFile>
+            <AdditionalFile owner="root" permission="0644" target="/usr/lib/tmpfiles.d/cyrus-sasl.conf">tmpfiles.conf</AdditionalFile>
+        </AdditionalFiles>
+        <Provides>
+            <COMAR script="service.py">System.Service</COMAR>
+            <COMAR script="package.py">System.Package</COMAR>
+        </Provides>
+    </Package>
+
+    <Package>
+        <Name>cyrus-sasl-devel</Name>
+        <Summary>Development files for cyrus-sasl</Summary>
+        <RuntimeDependencies>
+            <Dependency release="current">cyrus-sasl</Dependency>
+        </RuntimeDependencies>
+        <Files>
+            <Path fileType="header">/usr/include</Path>
+            <Path fileType="data">/usr/lib/pkgconfig</Path>
+            <Path fileType="doc">/usr/share/doc/cyrus-sasl/*.txt</Path>
+            <Path fileType="man">/usr/share/man/man3</Path>
+        </Files>
+    </Package>
+
+    <History>
+        <Update release="6">
+            <Date>2014-07-05</Date>
+            <Version>2.1.26</Version>
+            <Comment>Release bump.</Comment>
+            <Name>Marcin Bojara</Name>
+            <Email>marcin@pisilinux.org</Email>
+        </Update>
+        <Update release="5">
+            <Date>2014-01-09</Date>
+            <Version>2.1.26</Version>
+            <Comment>Version bump. Add tmpfiles.conf</Comment>
+            <Name>Marcin Bojara</Name>
+            <Email>marcin@pisilinux.org</Email>
+        </Update>
+        <Update release="4">
+            <Date>2013-07-30</Date>
+            <Version>2.1.25</Version>
+            <Comment>Rebuild</Comment>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Update>
+        <Update release="3">
+            <Date>2013-05-05</Date>
+            <Version>2.1.25</Version>
+            <Comment>Added some patches and remove unused.</Comment>
+            <Name>Aydın Demirel</Name>
+            <Email>aydin@demirel.web.tr</Email>
+        </Update>
+        <Update release="2">
+            <Date>2013-04-25</Date>
+            <Version>2.1.25</Version>
+            <Comment>Dep Fixed.</Comment>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Update>
+        <Update release="1">
+            <Date>2012-09-29</Date>
+            <Version>2.1.25</Version>
+            <Comment>First release</Comment>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Update>
+    </History>
+</PISI>
@@ -0,0 +1,13 @@
+<?xml version="1.0" ?>
+<PISI>
+    <Source>
+        <Name>cyrus-sasl</Name>
+        <Summary xml:lang="tr">Cyrus basit kimlik tanımlama ve güvenlik katmanı</Summary>
+        <Description xml:lang="tr">Cyrus-sasl, bağlantı tabanlı protokoller için kullanılan bir kimlik doğrulama uygulamasıdır. Çoğunlukla Smtp doğrulaması için kullanılır.</Description>
+    </Source>
+
+    <Package>
+        <Name>cyrus-sasl-devel</Name>
+        <Summary xml:lang="tr">cyrus-sasl için geliştirme dosyaları</Summary>
+    </Package>
+</PISI>
@@ -0,0 +1,87 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Licensed under the GNU General Public License, version 3.
+# See the file http://www.gnu.org/licenses/gpl.txt
+
+from pisi.actionsapi import get
+from pisi.actionsapi import autotools
+from pisi.actionsapi import pisitools
+from pisi.actionsapi import shelltools
+
+pisitools.flags.add("-fPIC -fno-strict-aliasing -fno-strict-overflow -fstack-protector-all")
+pisitools.cxxflags.add("-I/usr/include/et")
+
+def rename_man_pages():
+    manpages = ["appl/bsd/klogind.M",
+                "appl/bsd/kshd.M",
+                "appl/sample/sserver/sserver.M",
+                "appl/telnet/telnetd/telnetd.8",
+                "appl/gssftp/ftpd/ftpd.M",
+                "config-files/kdc.conf.M",
+                "config-files/krb5.conf.M",
+                "kadmin/cli/kadmin.M",
+                "slave/kpropd.M",
+                "slave/kprop.M"]
+    for manpage in manpages:
+        shelltools.move(manpage, "%s.in" % manpage)
+
+def setup():
+    shelltools.cd("src")
+    shelltools.system("sed -i -e 's/^YYSTYPE yylval/&={0}/' lib/krb5/krb/deltat.c")
+    pisitools.dosed("util/ac_check_krb5.m4", "(KRB5ROOT=\/usr)\/local", r"\1")
+
+    autotools.autoreconf("-fi")
+
+    # Fix pthread linking
+    #pisitools.dosed("configure", "-lthread", "-lpthread")
+    #pisitools.dosed("configure", "-pthread", "-lpthread")
+
+    autotools.configure("--localstatedir=/var/lib \
+                         --without-tcl \
+                         --without-hesiod \
+                         --enable-shared \
+                         --enable-kdc-lookaside-cache \
+                         --without-system-verto \
+                         --disable-rpath \
+                         --with-system-et \
+                         --with-system-ss \
+                         --enable-dns-for-realm")
+
+    # Fix krb5-config script to remove rpaths and CFLAGS
+    #pisitools.dosed("krb5-config", "^CC_LINK=.*", "CC_LINK='$(CC) $(PROG_LIBPATH)'")
+    # Fix unused dependency
+    pisitools.dosed("config/shlib.conf"," -shared ", " -Wl,--as-needed -shared ")
+
+def build():
+    autotools.make("-C src/")
+
+# def check():
+   # check failed
+   # autotools.make("-C src/ -j1 check")
+   # import tempfile
+   # import shutil
+   # tmpdir = tempfile.mkdtemp(prefix='pisitest')
+   # autotools.make("-C src/ check TMPDIR=%s -j1" % tmpdir)
+   # shutil.rmtree("rm -rf %s" % tmpdir)
+
+def install():
+    pisitools.dodoc("NOTICE", "README")
+    shelltools.cd("src")
+    autotools.rawInstall("DESTDIR=%s" % get.installDIR())
+
+    # Install additional headers
+    for d in ("kadm5", "krb5"):
+        pisitools.insinto("/usr/include/%s" % d, "include/%s/*.h" % d)
+
+    # Add "k" prefix to some apps and manpages to resolve conflicts
+    #for app in ["telnetd", "ftpd"]:
+     #   pisitools.rename("/usr/share/man/man8/%s.8" % app, "k%s.8" % app)
+      #  pisitools.rename("/usr/sbin/%s" % app, "k%s" % app)
+
+    #for app in ["rcp", "rsh", "telnet", "ftp", "rlogin"]:
+     #   pisitools.rename("/usr/share/man/man1/%s.1" % app, "k%s.1" % app)
+      #  pisitools.rename("/usr/bin/%s" % app, "k%s" % app)
+
+    # Remove examples
+    pisitools.removeDir("/usr/share/examples")
@@ -0,0 +1,15 @@
+--- configure.in.orig	2014-01-16 02:44:15.000000000 +0200
+++ src/configure.in	2014-05-17 17:05:05.317924895 +0300
+@@ -1206,9 +1206,9 @@
+ # default, so it's not a big deal that it isn't very good.  We should
+ # use python-config instead.
+ PYTHON_LIB=
+-AC_CHECK_HEADERS(Python.h python2.3/Python.h python2.5/Python.h)
+-AC_CHECK_LIB(python2.3,main,[PYTHON_LIB=-lpython2.3],
+-  AC_CHECK_LIB(python2.5,main,[PYTHON_LIB=-lpython2.5]))
+AC_CHECK_HEADERS(Python.h python2.5/Python.h python2.7/Python.h)
+AC_CHECK_LIB(python2.5,main,[PYTHON_LIB=-lpython2.5],
+  AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7]))
+ AC_SUBST(PYTHON_LIB)
+ 
+ 
@@ -0,0 +1,16 @@
+[kdcdefaults]
+	kdc_ports = 88,750
+
+[realms]
+	EXAMPLE.COM = {
+	database_name = /etc/krb5kdc/principal
+	admin_keytab = /etc/krb5kdc/kadm5.keytab
+	acl_file = /etc/krb5kdc/kadm5.acl
+	dict_file = /etc/krb5kdc/kadm5.dict
+	key_stash_file = /etc/krb5kdc/.k5.EXAMPLE.COM
+	kadmind_port = 749
+	max_life = 10h 0m 0s
+	max_renewable_life = 7d 0h 0m 0s
+	master_key_type = des3-hmac-sha1
+	supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal
+	}
@@ -0,0 +1,11 @@
+--- src/build-tools/krb5-config.in.orig	2014-01-16 02:44:15.000000000 +0200
+++ src/build-tools/krb5-config.in	2014-05-17 17:00:42.624580187 +0300
+@@ -221,7 +221,7 @@
+ 	    -e 's#\$(PROG_RPATH)#'$libdir'#' \
+ 	    -e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \
+ 	    -e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \
+-	    -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \
+	    -e 's#\$(LDFLAGS)##' \
+ 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
+ 	    -e 's#\$(CFLAGS)##'`
+ 
@@ -0,0 +1,25 @@
+[libdefaults]
+	ticket_lifetime = 600
+	default_realm = EXAMPLE.COM
+	default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
+	default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
+
+[realms]
+	EXAMPLE.COM = {
+	kdc = kerberos.example.com:88
+	kdc = kerberos2.example.com:88
+	admin_server = kerberos.example.com:749
+	}
+
+[domain_realm]
+	.example.com = EXAMPLE.COM
+	example.com = EXAMPLE.COM
+
+[kdc]
+	profile = /etc/krb5kdc/kdc.conf
+
+[logging]
+	kdc = FILE:/var/log/krb5kdc.log
+	admin_server = FILE:/var/log/kadmin.log
+	default = FILE:/var/log/krb5lib.log
+	    
@@ -0,0 +1,55 @@
+--- a/src/slave/kprop.c
+++ b/src/slave/kprop.c
+@@ -91,7 +91,7 @@ main(argc, argv)
+     int     argc;
+     char    **argv;
+ {
+-    int     fd, database_fd, database_size;
+    int     fd = -1, database_fd, database_size;
+     krb5_error_code retval;
+     krb5_context context;
+     krb5_creds *my_creds;
+--- a/src/kadmin/ktutil/ktutil_funcs.c
+++ b/src/kadmin/ktutil/ktutil_funcs.c
+@@ -64,7 +64,7 @@
+     krb5_kt_list *list;
+     int idx;
+ {
+-    krb5_kt_list lp, prev;
+    krb5_kt_list lp, prev = NULL;
+     int i;
+ 
+     for (lp = *list, i = 1; lp; prev = lp, lp = lp->next, i++) {
+--- a/src/lib/kadm5/alt_prof.c
+++ b/src/lib/kadm5/alt_prof.c
+@@ -164,7 +164,7 @@
+     char **values;
+     char *valp;
+     int idx;
+-    krb5_boolean val;
+    krb5_boolean val = 0;
+ 
+     kret = krb5_aprof_getvals (acontext, hierarchy, &values);
+     if (kret)
+
+--- a/src/util/profile/prof_init.c
+++ b/src/util/profile/prof_init.c
+@@ -255,7 +255,7 @@ copy_vtable_profile(profile_t profile, profile_t *ret_new_profile)
+ {
+     errcode_t err;
+     void *cbdata;
+-    profile_t new_profile;
+    profile_t new_profile = NULL;
+ 
+     *ret_new_profile = NULL;
+ 
+--- a/src/tests/asn.1/trval.c   2013-04-12 12:51:36.000000000 -0500
+++ b/src/tests/asn.1/trval.c   2013-05-24 04:31:14.077036380 -0500
+@@ -404,7 +404,7 @@
+ {
+     int n;
+     int r = 0;
+-    int rlen2;
+    int rlen2 = 0;
+     int rlent;
+     int save_appl;
@@ -0,0 +1,12 @@
+--- /dev/null	2009-10-20 19:31:44.183325514 +0300
+++ src/rebuild-configure-scripts.sh	2009-10-22 10:37:14.583117034 +0300
+@@ -0,0 +1,9 @@
+#!/bin/bash
+
+top=`pwd`
+for configurein in `find -name configure.in -type f` ; do
+    pushd `dirname $configurein`
+    grep -q A._CONFIG_HEADER configure.in && autoheader -I "$top"
+    autoconf -I "$top"
+    popd
+done
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
+<PISI>
+    <Source>
+        <Name>mit-kerberos</Name>
+        <Homepage>http://web.mit.edu/kerberos/www/</Homepage>
+        <Packager>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Packager>
+        <License>as-is</License>
+        <IsA>library</IsA>
+        <IsA>app:console</IsA>
+        <Summary>MIT Kerberos Library</Summary>
+        <Description>Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.</Description>
+        <Archive sha1sum="6342e29980210c32dee3563dfb0728b4b9592381" type="targz">http://source.pisilinux.org/1.0/krb5-1.13.1.tar.gz</Archive>
+
+        <BuildDependencies>
+            <Dependency>keyutils</Dependency>
+            <Dependency>openssl-devel</Dependency>
+            <Dependency>e2fsprogs-devel</Dependency>
+            <!-- FIXME: openldap-client requires mit-kerberos too -->
+            <!-- disable for now for the circular dep
+            <Dependency>openldap-client</Dependency>
+            -->
+        </BuildDependencies>
+        <Patches>
+            <Patch level="0">krb5-config_LDFLAGS.patch</Patch>
+            <!--<Patch level="1">mit-krb5-1.12_uninitialized.patch</Patch> -->
+            <Patch level="0">rebuild-configure-scripts.patch</Patch>
+            <Patch level="0">fix-python-detection.patch</Patch>
+        </Patches>
+    </Source>
+
+    <Package>
+        <Name>mit-kerberos</Name>
+        <RuntimeDependencies>
+            <Dependency>keyutils</Dependency>
+            <Dependency>openssl</Dependency>
+            <Dependency>e2fsprogs</Dependency>
+            <!-- FIXME: This introduces a circular dep
+            <Dependency>openldap-client</Dependency>
+            -->
+        </RuntimeDependencies>
+        <Files>
+            <Path fileType="config">/etc</Path>
+            <Path fileType="header">/usr/include</Path>
+            <Path fileType="executable">/usr/bin</Path>
+            <Path fileType="executable">/usr/sbin</Path>
+            <Path fileType="library">/usr/lib</Path>
+            <Path fileType="data">/usr/share</Path>
+            <Path fileType="data">/var/lib</Path>
+            <Path fileType="info">/usr/share/info</Path>
+            <Path fileType="man">/usr/share/man</Path>
+        </Files>
+        <AdditionalFiles>
+            <AdditionalFile owner="root" permission="0644" target="/etc/krb5.conf">krb5.conf</AdditionalFile>
+            <AdditionalFile owner="root" permission="0644" target="/etc/kdc.conf">kdc.conf</AdditionalFile>
+        </AdditionalFiles>
+    </Package>
+
+    <History>
+         <Update release="6">
+            <Date>2015-04-23</Date>
+            <Version>1.13.1</Version>
+            <Comment>Version bump,fix deps.</Comment>
+            <Name>Ertuğrul Erata</Name>
+            <Email>ertugrulerata@gmail.com</Email>
+        </Update>
+        <Update release="5">
+            <Date>2014-12-13</Date>
+            <Version>1.13</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Yusuf Aydemir</Name>
+            <Email>yusuf.aydemir@pisilinux.org</Email>
+        </Update>
+        <Update release="4">
+            <Date>2014-05-17</Date>
+            <Version>1.12.1</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Alihan Öztürk</Name>
+            <Email>alihan@pisilinux.org</Email>
+        </Update>
+        <Update release="3">
+            <Date>2014-01-22</Date>
+            <Version>1.11.4</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Marcin Bojara</Name>
+            <Email>marcin@pisilinux.org</Email>
+        </Update>
+        <Update release="2">
+            <Date>2013-02-20</Date>
+            <Version>1.11</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Marcin Bojara</Name>
+            <Email>marcin@pisilinux.org</Email>
+        </Update>
+        <Update release="1">
+            <Date>2012-09-27</Date>
+            <Version>1.10.3</Version>
+            <Comment>First release</Comment>
+            <Name>Yusuf Aydemir</Name>
+            <Email>yusuf.aydemir@pisilinux.org</Email>
+        </Update>
+    </History>
+</PISI>
@@ -0,0 +1,8 @@
+<?xml version="1.0" ?>
+<PISI>
+    <Source>
+        <Name>mit-kerberos</Name>
+        <Summary xml:lang="tr">MIT Kerberos kütüphanesi</Summary>
+        <Description xml:lang="tr">Kerberos bir ağ doğrulama protokolüdür. Sunucu/istemci uygulamalarında, gizli anahtar kriptoloji teknolojisini kullanarak, güçlü bir doğrulama sağlar.</Description>
+    </Source>
+</PISI>
@@ -15,7 +15,7 @@
        <IsA>library</IsA>
        <Summary>A relational database offering many ANSI SQL-99 features</Summary>
        <Description>Firebird is an open source relational database management system offering many ANSI SQL-99 features.</Description>
-        <Archive sha1sum="1b91d3b01d27ea420d21daa025ded3dffa9b297a" type="tarbz2">http://sourceforge.net/projects/firebird/files/firebird/2.5.2-Release/Firebird-2.5.2.26540-0.tar.bz2/download</Archive>
+        <Archive sha1sum="e8f33daf8211666eac5b7a5eecc133f599e3bc9f" type="tarbz2">http://sourceforge.net/projects/firebird/files/firebird/2.5.4-Release/Firebird-2.5.4.26856-0.tar.bz2</Archive>
        <BuildDependencies>
            <Dependency>icu4c-devel</Dependency>
            <Dependency>btyacc</Dependency>
@@ -34,6 +34,9 @@

    <Package>
        <Name>firebird-client</Name>
+        <RuntimeDependencies>
+            <Dependency>libgcc</Dependency>
+        </RuntimeDependencies>
        <Summary>Firebird database client library</Summary>
        <Description>Firebird relational database client library.</Description>
        <Files>
@@ -50,12 +53,13 @@

    <Package>
        <Name>firebird-superserver</Name>
-        <Summary>Firebird super server</Summary>
        <RuntimeDependencies>
            <Dependency>firebird-client</Dependency>
            <Dependency>icu4c</Dependency>
            <Dependency>libedit</Dependency>
+            <Dependency>libgcc</Dependency>
        </RuntimeDependencies>
+        <Summary>Firebird super server</Summary>
        <Files>
            <Path fileType="config">/etc/firebird</Path>
            <Path fileType="config">/etc/env.d/50firebird</Path>
@@ -98,6 +102,13 @@
    </Package>

    <History>
+         <Update release="5">
+            <Date>2015-07-03</Date>
+            <Version>2.5.4.26856</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Ertuğrul Erata</Name>
+            <Email>ertugrulerata@gmail.com</Email>
+        </Update>
        <Update release="4">
            <Date>2014-05-19</Date>
            <Version>2.5.2.26540</Version>
@@ -12,10 +12,18 @@
        <IsA>app:console</IsA>
        <Summary>MariaDB is a drop-in replacement for MySQL</Summary>
        <Description>MariaDB strives to be the logical choice for database professionals looking for a robust, scalable, and reliable SQL server.</Description>
-        <Archive sha1sum="240253b3ee21dea5e2f501778e8ee72b32a5d052" type="targz">ftp://ftp.ulak.net.tr/pub/MariaDB/mariadb-10.0.17/source/mariadb-10.0.17.tar.gz</Archive>
+        <Archive sha1sum="e005c8dc2b2e4b0b3215f8bbb9b0b43726c7cf6a" type="targz">ftp://ftp.ulak.net.tr/pub/MariaDB/mariadb-10.0.20/source/mariadb-10.0.20.tar.gz</Archive>
        <BuildDependencies>
+            <Dependency>ncurses-devel</Dependency>
+            <Dependency>zlib-devel</Dependency>
+            <Dependency>libxml2-devel</Dependency>
+            <Dependency>readline-devel</Dependency>
+            <Dependency>libevent-devel</Dependency>
+            <Dependency>openssl-devel</Dependency>
+            <Dependency>libpcre-devel</Dependency>
            <Dependency>libaio-devel</Dependency>
            <Dependency>unixODBC-devel</Dependency>
+            <Dependency>cmake</Dependency>
        </BuildDependencies>
        <Patches>
        </Patches>
@@ -27,6 +35,11 @@
        <IsA>library</IsA>
        <Summary>The shared libraries required for MariaDB clients</Summary>
        <RuntimeDependencies>
+            <Dependency>zlib</Dependency>
+            <Dependency>libgcc</Dependency>
+            <Dependency>libpcre</Dependency>
+            <Dependency>libxml2</Dependency>
+            <Dependency>openssl</Dependency>
            <Dependency>libaio</Dependency>
            <Dependency>unixODBC</Dependency>
        </RuntimeDependencies>
@@ -73,6 +86,11 @@
        <RuntimeDependencies>
            <Dependency version="current">mariadb-lib</Dependency>
            <Dependency>libaio</Dependency>
+            <Dependency>zlib</Dependency>
+            <Dependency>libgcc</Dependency>
+            <Dependency>libpcre</Dependency>
+            <Dependency>ncurses</Dependency>
+            <Dependency>openssl</Dependency>
        </RuntimeDependencies>
        <Replaces>
            <Package>mysql-client</Package>
@@ -89,7 +107,9 @@
        <RuntimeDependencies>
            <Dependency version="current">mariadb-lib</Dependency>
            <Dependency version="current">mariadb-client</Dependency>
-            <Dependency>libaio</Dependency>
+            <Dependency>zlib</Dependency>
+            <Dependency>libgcc</Dependency>
+            <Dependency>openssl</Dependency>
        </RuntimeDependencies>
        <Replaces>
            <Package>mysql-server</Package>
@@ -150,6 +170,13 @@
    </Package>

    <History>
+        <Update release="9">
+            <Date>2015-07-03</Date>
+            <Version>10.0.20</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Ertuğrul Erata</Name>
+            <Email>ertugrulerata@gmail.com</Email>
+        </Update>
        <Update release="8">
            <Date>2015-01-25</Date>
            <Version>10.0.17</Version>
@@ -21,7 +21,7 @@ def setup():
                         --with-pam \
                         --with-libxml \
                         --with-libxslt \
-                         --with-ldap \
+                         --without-ldap \
                         --enable-integer-datetimes \
                         --enable-thread-safety \
                         --enable-depend \
@@ -12,9 +12,15 @@
        <IsA>service</IsA>
        <Summary>A powerful, open source relational database system</Summary>
        <Description>PostgreSQL is a powerful, open source relational database system.</Description>
-        <Archive sha1sum="a5b4a63339c26849e8e9b7645436c976e4b40f50" type="tarbz2">http://ftp.postgresql.org/pub/source/v9.3.4/postgresql-9.3.4.tar.bz2</Archive>
+        <Archive sha1sum="0a1ea210e12bc07ac8c528c8997b90bd5d41df6e" type="tarbz2">https://ftp.postgresql.org/pub/source/v9.3.9/postgresql-9.3.9.tar.bz2</Archive>
        <BuildDependencies>
            <Dependency>mit-kerberos</Dependency>
+            <Dependency>e2fsprogs-devel</Dependency>
+            <Dependency>pam-devel</Dependency>
+            <Dependency>readline-devel</Dependency>
+            <Dependency>zlib-devel</Dependency>
+            <Dependency>python-devel</Dependency>
+            <Dependency>openssl-devel</Dependency>
            <Dependency>tcl-devel</Dependency>
            <Dependency>libxslt-devel</Dependency>
            <Dependency>libxml2-devel</Dependency>
@@ -98,6 +104,13 @@
    </Package>

    <History>
+        <Update release="8">
+            <Date>2015-07-03</Date>
+            <Version>9.3.9</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Ertuğrul Erata</Name>
+            <Email>ertugrulerata@gmail.com</Email>
+        </Update>
        <Update release="7">
            <Date>2014-05-19</Date>
            <Version>9.3.4</Version>
@@ -0,0 +1,100 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Licensed under the GNU General Public License, version 3.
+# See the file http://www.gnu.org/licenses/gpl.txt
+
+from pisi.actionsapi import get
+from pisi.actionsapi import autotools
+from pisi.actionsapi import pisitools
+from pisi.actionsapi import shelltools
+
+KeepSpecial = ["libtool"]
+
+def setup():
+    pisitools.dosed(
+        "include/ldap_defaults.h",
+        "(#define LDAPI_SOCK).*",
+        '\\1 "/run/openldap/slapd.sock"'
+    )
+    pisitools.dosed("servers/slapd/Makefile.in", "(\$\(DESTDIR\))\$\(localstatedir\)(\/run)", r"\1\2")
+
+    pisitools.flags.add("-D_REENTRANT -D_GNU_SOURCE -fPIC -Wl,--as-needed -DLDAP_CONNECTIONLESS")
+    #pisitools.ldflags.add("-pie")
+
+    options = "--prefix=/usr \
+               --enable-bdb \
+               --enable-hdb=mod \
+               --enable-slapd \
+               --enable-passwd=mod \
+               --enable-dnssrv=mod \
+               --enable-ldap \
+               --enable-wrappers \
+               --enable-meta=mod \
+               --enable-monitor=mod \
+               --enable-null=mod \
+               --enable-shell=mod \
+               --enable-rewrite \
+               --enable-rlookups \
+               --enable-aci \
+               --enable-modules \
+               --enable-cleartext \
+               --enable-lmpasswd \
+               --enable-spasswd \
+               --enable-slapi \
+               --enable-dyngroup \
+               --enable-proxycache \
+               --enable-perl \
+               --enable-syslog \
+               --enable-dynamic \
+               --enable-local \
+               --enable-proctitle \
+               --enable-overlays=mod \
+               --with-pic \
+               --without-cyrus-sasl \
+               --with-threads \
+               --without-fetch \
+               --enable-crypt \
+               --enable-ipv6 \
+               --enable-dynacl \
+               --enable-shared \
+               --disable-static \
+               --disable-slp \
+               --localstatedir=/var/lib"
+
+    if get.buildTYPE() == "emul32":
+        options += " --prefix=/emul32 \
+                     --libdir=/usr/lib32 \
+                     --libexecdir=/emul32/libexec \
+                     --disable-bdb \
+                     --disable-hdb \
+                     --disable-wrappers \
+                     --disable-spasswd \
+                     --disable-perl \
+                     --with-tls \
+                     --without-cyrus-sasl"
+    else: options += " --with-tls=moznss"
+
+    shelltools.export("AUTOMAKE", "/bin/true")
+    autotools.autoreconf("-fi")
+    autotools.configure(options)
+    pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ")
+
+def build():
+    autotools.make("-j1")
+
+def install():
+    if get.buildTYPE() == "emul32":
+        autotools.rawInstall("DESTDIR=%s" % get.installDIR())
+        return
+
+    autotools.rawInstall("DESTDIR=%s" % get.installDIR())
+
+
+    pisitools.dodir("/run/openldap")
+    pisitools.dodir("/etc/openldap/ssl")
+
+    pisitools.dodoc("ANNOUNCEMENT", "CHANGES", "COPYRIGHT", "README", "LICENSE")
+
+    pisitools.remove("/usr/lib/*.la")
+    pisitools.remove("/usr/libexec/openldap/*.la")
@@ -0,0 +1,17 @@
+#!/usr/bin/python
+
+import os
+import pwd
+import grp
+
+def postInstall(fromVersion, fromRelease, toVersion, toRelease):
+    os.system("/bin/chown ldap:ldap /var/lib/openldap-data")
+    os.system("/bin/chown ldap:ldap /var/lib/openldap-slurp")
+    os.system("/bin/chown ldap:ldap /run/openldap")
+    os.system("/bin/chown root:ldap /etc/openldap/slapd.conf")
+    os.system("/bin/chown root:ldap /etc/openldap/slapd.conf.default")
+    os.system("/bin/chmod 0700 /var/lib/openldap-data")
+    os.system("/bin/chmod 0700 /var/lib/openldap-slurp")
+    os.system("/bin/chmod 0755 /run/openldap")
+    os.system("/bin/chmod 0640 /etc/openldap/slapd.conf")
+    os.system("/bin/chmod 0640 /etc/openldap/slapd.conf.default")
@@ -0,0 +1,23 @@
+from comar.service import *
+
+serviceType = "server"
+serviceDesc = _({"en": "OpenLDAP Server",
+                 "tr": "OpenLDAP Sunucusu"})
+serviceConf = "slapd"
+
+def start():
+    import os
+    os.environ["LC_ALL"] = "C"
+    os.environ["LANG"] = "C"
+
+    startService(command="/usr/libexec/slapd",
+                 args="-u ldap -g ldap %s" % config.get("OPTS", ""),
+                 pidfile="/run/openldap/slapd.pid",
+                 donotify=True)
+
+def stop():
+    stopService(pidfile="/run/openldap/slapd.pid",
+                donotify=True)
+
+def status():
+    return isServiceRunning("/run/openldap/slapd.pid")
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+from comar.service import *
+
+serviceType = "server"
+serviceDesc = _({"en": "Slurpd Daemon",
+                 "tr": "Slurpd Servisi"})
+
+def start():
+    startService(command="/usr/libexec/slurpd",
+                 donotify=True)
+
+def stop():
+    stopService(command="/usr/libexec/slurpd",
+                donotify=True)
+
+def status():
+    return isServiceRunning(command="/usr/libexec/slurpd")
@@ -0,0 +1,49 @@
+Use pkg-config for Mozilla NSS library detection
+
+Author: Jan Vcelak <jvcelak@redhat.com>
+
+---
+ configure.in | 22 +++++-----------------
+ 1 file changed, 5 insertions(+), 17 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index ecffe30..2a9cfb4 100644
+--- a/configure.in
+++ b/configure.in
+@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then
+ 	fi
+ fi
+ 
+-dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3
+-dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs
+-dnl are not in the default system location
+ if test $ol_link_tls = no ; then
+ 	if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then
+-		have_moznss=no
+-		AC_CHECK_HEADERS([nssutil.h])
+-		if test "$ac_cv_header_nssutil_h" = yes ; then
+-			AC_CHECK_LIB([nss3], [NSS_Initialize],
+-						 [ have_moznss=yes ], [ have_moznss=no ])
+-		fi
+		PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no])
+ 
+-		if test "$have_moznss" = yes ; then
+		if test $have_moznss = yes ; then
+ 			ol_with_tls=moznss
+ 			ol_link_tls=yes
+-			AC_DEFINE(HAVE_MOZNSS, 1, 
+-					  [define if you have MozNSS])
+-			TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4"
+-		else
+-			if test $ol_with_tls = moznss ; then
+-			AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)])
+-			fi
+			AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS])
+			TLS_LIBS="$MOZNSS_LIBS"
+			CFLAGS="$CFLAGS $MOZNSS_CFLAGS"
+ 		fi
+ 	fi
+ fi
+-- 
+1.7.11.7
+
@@ -0,0 +1,192 @@
+Implement priority/weight for DNS SRV records
+
+From RFC 2782:
+
+  A client MUST attempt to contact the target host with the
+  lowest-numbered priority it can reach.
+
+This patch sorts the DNS SRV records by their priority, and
+additionally gives records with a larger weight a higher probability
+of appearing earlier. This way, the DNS SRV records are tried in the
+order of their priority.
+
+Author: James M Leddy <james.leddy@redhat.com>
+Upstream ITS: #7027
+Resolves: #733078
+
+---
+ libraries/libldap/dnssrv.c |  106 ++++++++++++++++++++++++++++++++++----------
+ 1 files changed, 83 insertions(+), 23 deletions(-)
+
+diff --git a/libraries/libldap/dnssrv.c b/libraries/libldap/dnssrv.c
+index 16b1544..40f93b4 100644
+--- a/libraries/libldap/dnssrv.c
+++ b/libraries/libldap/dnssrv.c
+@@ -174,6 +174,46 @@ int ldap_domain2dn(
+ 	return LDAP_SUCCESS;
+ }
+ 
+#ifdef HAVE_RES_QUERY
+#define DNSBUFSIZ (64*1024)
+typedef struct srv_record {
+    u_short priority;
+    u_short weight;
+    u_short port;
+    char hostname[DNSBUFSIZ];
+} srv_record;
+
+
+static int srv_cmp(const void *aa, const void *bb){
+    srv_record *a=(srv_record *)aa;
+    srv_record *b=(srv_record *)bb;
+    u_long total;
+    
+    if(a->priority < b->priority) {
+	return -1;
+    }
+    if(a->priority > b->priority) {
+	return 1;
+    }
+    if(a->priority == b->priority){
+	/* targets with same priority are in psudeo random order */
+	if (a->weight == 0 && b->weight == 0) {
+	    if (rand() % 2) {
+		return -1;
+	    } else {
+		return 1;
+	    }
+	}
+	total = a->weight + b->weight;
+	if (rand() % total < a->weight) {
+	    return -1;
+	} else {
+	    return 1;
+	}
+    }
+}
+#endif /* HAVE_RES_QUERY */
+
+ /*
+  * Lookup and return LDAP servers for domain (using the DNS
+  * SRV record _ldap._tcp.domain).
+@@ -183,15 +223,16 @@ int ldap_domain2hostlist(
+ 	char **list )
+ {
+ #ifdef HAVE_RES_QUERY
+-#define DNSBUFSIZ (64*1024)
+-    char *request;
+-    char *hostlist = NULL;
+    char *request; 
+   char *hostlist = NULL;
+    srv_record *hostent_head=NULL;
+    int i;
+     int rc, len, cur = 0;
+     unsigned char reply[DNSBUFSIZ];
+    int hostent_count=0;
+ 
+ 	assert( domain != NULL );
+ 	assert( list != NULL );
+-
+ 	if( *domain == '\0' ) {
+ 		return LDAP_PARAM_ERROR;
+ 	}
+@@ -223,8 +264,7 @@ int ldap_domain2hostlist(
+ 	unsigned char *p;
+ 	char host[DNSBUFSIZ];
+ 	int status;
+-	u_short port;
+-	/* int priority, weight; */
+	u_short port, priority, weight; 
+ 
+ 	/* Parse out query */
+ 	p = reply;
+@@ -263,40 +303,56 @@ int ldap_domain2hostlist(
+ 	    size = (p[0] << 8) | p[1];
+ 	    p += 2;
+ 	    if (type == T_SRV) {
+-		int buflen;
+ 		status = dn_expand(reply, reply + len, p + 6, host, sizeof(host));
+ 		if (status < 0) {
+ 		    goto out;
+ 		}
+-		/* ignore priority and weight for now */
+-		/* priority = (p[0] << 8) | p[1]; */
+-		/* weight = (p[2] << 8) | p[3]; */
+		
+		/* Get priority weight and port */
+		priority = (p[0] << 8) | p[1];
+		weight = (p[2] << 8) | p[3]; 
+ 		port = (p[4] << 8) | p[5];
+ 
+ 		if ( port == 0 || host[ 0 ] == '\0' ) {
+ 		    goto add_size;
+ 		}
+ 
+-		buflen = strlen(host) + STRLENOF(":65355 ");
+-		hostlist = (char *) LDAP_REALLOC(hostlist, cur + buflen + 1);
+-		if (hostlist == NULL) {
+-		    rc = LDAP_NO_MEMORY;
+-		    goto out;
+		hostent_head = (srv_record *) LDAP_REALLOC(hostent_head, (hostent_count+1)*(sizeof(srv_record)));
+		if(hostent_head==NULL){
+		  rc=LDAP_NO_MEMORY;
+		  goto out;
+		  
+ 		}
+-		if (cur > 0) {
+-		    /* not first time around */
+-		    hostlist[cur++] = ' ';
+-		}
+-		cur += sprintf(&hostlist[cur], "%s:%hu", host, port);
+		hostent_head[hostent_count].priority=priority;
+		hostent_head[hostent_count].weight=weight;
+		hostent_head[hostent_count].port=port;
+		strncpy(hostent_head[hostent_count].hostname, host,255);
+		hostent_count=hostent_count+1;
+ 	    }
+ add_size:;
+ 	    p += size;
+ 	}
+     }
+    qsort(hostent_head, hostent_count, sizeof(srv_record), srv_cmp);
+
+    for(i=0; i<hostent_count; i++){
+	int buflen;
+        buflen = strlen(hostent_head[i].hostname) + STRLENOF(":65355" );
+        hostlist = (char *) LDAP_REALLOC(hostlist, cur+buflen+1);
+        if (hostlist == NULL) {
+            rc = LDAP_NO_MEMORY;
+            goto out;
+        }
+        if(cur>0){
+            hostlist[cur++]=' ';
+        }
+        cur += sprintf(&hostlist[cur], "%s:%hd", hostent_head[i].hostname, hostent_head[i].port);
+    }
+
+     if (hostlist == NULL) {
+-	/* No LDAP servers found in DNS. */
+-	rc = LDAP_UNAVAILABLE;
+-	goto out;
+         /* No LDAP servers found in DNS. */
+         rc = LDAP_UNAVAILABLE;
+         goto out;
+     }
+ 
+     rc = LDAP_SUCCESS;
+@@ -308,8 +364,12 @@ add_size:;
+     if (request != NULL) {
+ 	LDAP_FREE(request);
+     }
+    if (hostent_head != NULL) {
+	LDAP_FREE(hostent_head);
+    }
+     if (rc != LDAP_SUCCESS && hostlist != NULL) {
+ 	LDAP_FREE(hostlist);
+	
+     }
+     return rc;
+ #else
+-- 
+1.7.6
+
@@ -0,0 +1,55 @@
+From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Tue, 7 May 2013 17:02:57 +0200
+Subject: [PATCH] LDAPI SASL fix
+
+Resolves: #960222
+---
+ libraries/libldap/cyrus.c | 19 ++++++++++++++++---
+ 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-)
+
+diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
+index 28c241b..a9acf36 100644
+--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
+@@ -394,6 +394,8 @@ ldap_int_sasl_bind(
+ 	struct berval	ccred = BER_BVNULL;
+ 	int saslrc, rc;
+ 	unsigned credlen;
+	char my_hostname[HOST_NAME_MAX + 1];
+	int free_saslhost = 0;
+ 
+ 	Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n",
+ 		mechs ? mechs : "<null>", 0, 0 );
+@@ -454,14 +456,25 @@ ldap_int_sasl_bind(
+ 
+ 			/* If we don't need to canonicalize just use the host
+ 			 * from the LDAP URI.
+			 * Always use the result of gethostname() for LDAPI.
+ 			 */
+-			if ( nocanon )
+			if (ld->ld_defconn->lconn_server->lud_scheme != NULL &&
+			    strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) {
+				rc = gethostname(my_hostname, HOST_NAME_MAX + 1);
+				if (rc == 0) {
+					saslhost = my_hostname;
+				} else {
+					saslhost = "localhost";
+				}
+			} else if ( nocanon )
+ 				saslhost = ld->ld_defconn->lconn_server->lud_host;
+-			else 
+			else {
+ 				saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb,
+ 				"localhost" );
+				free_saslhost = 1;
+			}
+ 			rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost );
+-			if ( !nocanon )
+			if ( free_saslhost )
+ 				LDAP_FREE( saslhost );
+ 		}
+ 
+-- 
+1.7.11.7
+
@@ -0,0 +1,20 @@
+Disables opening of ldaprc file in current directory.
+
+Resolves: #38402
+Upstream: ITS #1131
+Author: Henning Schmiedehausen <hps@intermeta.de>
+
+diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
+index 8617527..e6b17b4 100644
+--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
+@@ -352,9 +352,6 @@ static void openldap_ldap_init_w_userconf(const char *file)
+ 	if(path != NULL) {
+ 		LDAP_FREE(path);
+ 	}
+-
+-	/* try file */
+-	openldap_ldap_init_w_conf(file, 1);
+ }
+ 
+ static void openldap_ldap_init_w_env(
@@ -0,0 +1,86 @@
+MozNSS: load certificates from certdb, fallback to PEM
+
+If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS
+certificate database, the backend assumed that the certificate is always
+located in the certificate database. This assumption might be wrong.
+
+This patch makes the library to try to load the certificate from NSS
+database and fallback to PEM file if unsuccessfull.
+
+Author: Jan Vcelak <jvcelak@redhat.com>
+Upstream ITS: #7389
+Resolves: #857455
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 6847bea..8339391 100644
+--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
+@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx )
+ 	/* prefer unlocked key, then key from opened certdb, then any other */
+ 	if ( unlocked_key )
+ 		ctx->tc_private_key = unlocked_key;
+-	else if ( ctx->tc_certdb_slot )
+	else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem )
+ 		ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg );
+ 	else
+ 		ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg );
+@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg )
+ 				}
+ 				return -1;
+ 			}
+-
+-			ctx->tc_using_pem = PR_TRUE;
+ 		}
+ 
+ 		NSS_SetDomesticPolicy();
+@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg )
+ 
+ 	/* set up our cert and key, if any */
+ 	if ( lt->lt_certfile ) {
+-		/* if using the PEM module, load the PEM file specified by lt_certfile */
+-		/* otherwise, assume this is the name of a cert already in the db */
+-		if ( ctx->tc_using_pem ) {
+-			/* this sets ctx->tc_certificate to the correct value */
+-			int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE );
+-			if ( rc ) {
+-				return rc;
+-			}
+-		} else {
+
+		/* first search in certdb (lt_certfile is nickname) */
+		if ( ctx->tc_certdb ) {
+ 			char *tmp_certname;
+ 
+ 			if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) {
+@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg )
+ 				Debug( LDAP_DEBUG_ANY,
+ 					   "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n",
+ 					   lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+			}
+		}
+
+		/* fallback to PEM module (lt_certfile is filename) */
+		if ( !ctx->tc_certificate ) {
+			if ( !pem_module && tlsm_init_pem_module() ) {
+				int pem_errcode = PORT_GetError();
+				Debug( LDAP_DEBUG_ANY,
+					   "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n",
+					   pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
+ 				return -1;
+ 			}
+
+			/* this sets ctx->tc_certificate to the correct value */
+			if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) {
+				ctx->tc_using_pem = PR_TRUE;
+			}
+		}
+
+		if ( ctx->tc_certificate ) {
+			Debug( LDAP_DEBUG_ANY,
+				   "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile,
+				   ctx->tc_using_pem ? "PEM file" : "moznss database", 0);
+		} else {
+			return -1;
+ 		}
+ 	}
+ 
@@ -0,0 +1,47 @@
+MozNSS: ignore certdb database type prefix when checking existence of the directory
+
+If the certdb is specified including the database type prefix (e.g.
+sql:, dbm:), the prefix has to be ignored when checking the
+certificate directory existence.
+
+Author: Jan Vcelak <jvcelak@redhat.com>
+Upstream ITS: #7388
+Resolves: #857373
+
+---
+ libraries/libldap/tls_m.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 49a3f8f..5ee21a2 100644
+--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
+@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
+ {
+ 	char sep = PR_GetDirectorySeparator();
+ 	char *ptr = NULL;
+	char *chkpath = NULL;
+ 	struct PRFileInfo prfi;
+ 	PRStatus prc;
+ 
+@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
+ 		return;
+ 	}
+ 
+-	prc = PR_GetFileInfo( certdir, &prfi );
+	/* ignore database type prefix (e.g. sql:, dbm:) if provided */
+	chkpath = strchr( certdir, ':' );
+	if ( chkpath != NULL ) {
+		chkpath += 1;
+	} else {
+		chkpath = certdir;
+	}
+
+ 	/* if certdir exists (file or directory) then it cannot specify a prefix */
+	prc = PR_GetFileInfo( chkpath, &prfi );
+ 	if ( prc == PR_SUCCESS ) {
+ 		return;
+ 	}
+-- 
+1.7.11.7
+
@@ -0,0 +1,27 @@
+Resolves: #929357
+
+From 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Thu, 28 Mar 2013 19:05:02 -0600
+Subject: [PATCH] must call PK11_FreeSlot after SECMOD_CloseUserDB to remove ref to slot
+
+---
+ libraries/libldap/tls_m.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 072d41d..c59d303 100644
+--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
+@@ -2063,6 +2063,8 @@ tlsm_ctx_free ( tls_ctx *ctx )
+ 				   "TLS: could not close certdb slot - error %d:%s.\n",
+ 				   errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
+ 		}
+		PK11_FreeSlot( c->tc_certdb_slot );
+		c->tc_certdb_slot = NULL;
+ 	}
+ 	PL_strfree( c->tc_pin_file );
+ 	c->tc_pin_file = NULL;
+-- 
+1.7.1
+
@@ -0,0 +1,91 @@
+MozNSS: better file name matching for hashed CA  certificate directory
+
+CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name
+should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used
+to differentiate between two certificates with the same subject name.
+
+Wit this patch, certificate file names are matched correctly (using regular expressions).
+
+Author: Jan Vcelak <jvcelak@redhat.com>
+Upstream ITS: #7374
+Resolves: #852786
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 5e49fc5..61d71d4 100644
+--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
+@@ -38,6 +38,7 @@
+ #include <ac/unistd.h>
+ #include <ac/param.h>
+ #include <ac/dirent.h>
+#include <ac/regex.h>
+ 
+ #include "ldap-int.h"
+ #include "ldap-tls.h"
+@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods;
+ 
+ #define PEM_LIBRARY	"nsspem"
+ #define PEM_MODULE	"PEM"
+-/* hash files for use with cacertdir have this file name suffix */
+-#define PEM_CA_HASH_FILE_SUFFIX	".0"
+-#define PEM_CA_HASH_FILE_SUFFIX_LEN 2
+#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$"
+ 
+ static SECMODModule *pem_module;
+ 
+@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
+ 		PRDir *dir;
+ 		PRDirEntry *entry;
+ 		PRStatus fistatus = PR_FAILURE;
+		regex_t hashfile_re;
+ 
+ 		memset( &fi, 0, sizeof(fi) );
+ 		fistatus = PR_GetFileInfo( cacertdir, &fi );
+@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
+ 			goto done;
+ 		}
+ 
+		if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) {
+			Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 );
+			goto done;
+		}
+
+ 		do {
+ 			entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN );
+ 			if ( ( NULL != entry ) && ( NULL != entry->name ) ) {
+ 				char *fullpath = NULL;
+-				char *ptr;
+				int match;
+ 
+-				ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX );
+-				if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) {
+				match = regexec( &hashfile_re, entry->name, 0, NULL, 0 );
+				if ( match == REG_NOMATCH ) {
+ 					Debug( LDAP_DEBUG_TRACE,
+-						   "TLS: file %s does not end in [%s] - does not appear to be a CA certificate "
+-						   "directory file with a properly hashed file name - skipping.\n",
+-						   entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 );
+						   "TLS: skipping '%s' - filename does not have expected format "
+						   "(certificate hash with numeric suffix)\n", entry->name, 0, 0 );
+					continue;
+				} else if ( match != 0 ) {
+					Debug( LDAP_DEBUG_ANY,
+						   "TLS: cannot execute regex for CA hash file matching (%d).\n",
+						   match, 0, 0 );
+ 					continue;
+ 				}
+
+ 				fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name );
+ 				if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) {
+ 					Debug( LDAP_DEBUG_TRACE,
+@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
+ 				PR_smprintf_free( fullpath );
+ 			}
+ 		} while ( NULL != entry );
+		regfree ( &hashfile_re );
+ 		PR_CloseDir( dir );
+ 	}
+ done:
+-- 
+1.7.11.4
+
@@ -0,0 +1,193 @@
+MozNSS: update list of supported cipher suites
+
+The updated list includes all ciphers implemented in Mozilla NSS 3.13.15
+
+Author: Jan Vcelak <jvcelak@redhat.com>
+Upstream ITS: #7374
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 1422ce2..5e49fc5 100644
+--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
+@@ -211,27 +211,34 @@ typedef struct {
+ 	int num;            /* The cipher id */
+ 	int attr;           /* cipher attributes: algorithms, etc */
+ 	int version;        /* protocol version valid for this cipher */
+-	int bits;           /* bits of strength */
+-	int alg_bits;       /* bits of the algorithm */
+ 	int strength;       /* LOW, MEDIUM, HIGH */
+ 	int enabled;        /* Enabled by default? */
+ } cipher_properties;
+ 
+ /* cipher attributes  */
+-#define SSL_kRSA  0x00000001L
+-#define SSL_aRSA  0x00000002L
+-#define SSL_aDSS  0x00000004L
+-#define SSL_DSS   SSL_aDSS
+-#define SSL_eNULL 0x00000008L
+-#define SSL_DES   0x00000010L
+-#define SSL_3DES  0x00000020L
+-#define SSL_RC4   0x00000040L
+-#define SSL_RC2   0x00000080L
+-#define SSL_AES   0x00000100L
+-#define SSL_MD5   0x00000200L
+-#define SSL_SHA1  0x00000400L
+-#define SSL_SHA   SSL_SHA1
+-#define SSL_RSA   (SSL_kRSA|SSL_aRSA)
+#define SSL_kRSA        0x00000001L
+#define SSL_aRSA        0x00000002L
+#define SSL_RSA         (SSL_kRSA|SSL_aRSA)
+#define SSL_aDSA        0x00000004L
+#define SSL_DSA         SSL_aDSA
+#define SSL_eNULL       0x00000008L
+#define SSL_DES         0x00000010L
+#define SSL_3DES        0x00000020L
+#define SSL_RC4         0x00000040L
+#define SSL_RC2         0x00000080L
+#define SSL_AES128      0x00000100L
+#define SSL_AES256      0x00000200L
+#define SSL_AES         (SSL_AES128|SSL_AES256)
+#define SSL_MD5         0x00000400L
+#define SSL_SHA1        0x00000800L
+#define SSL_kEDH        0x00001000L
+#define SSL_CAMELLIA128 0x00002000L
+#define SSL_CAMELLIA256 0x00004000L
+#define SSL_CAMELLIA    (SSL_CAMELLIA128|SSL_CAMELLIA256)
+#define SSL_SEED        0x00008000L
+#define SSL_kECDH       0x00010000L
+#define SSL_kECDHE      0x00020000L
+#define SSL_aECDSA      0x00040000L
+ 
+ /* cipher strength */
+ #define SSL_NULL      0x00000001L
+@@ -248,29 +255,70 @@ typedef struct {
+ 
+ /* Cipher translation */
+ static cipher_properties ciphers_def[] = {
+-	/* SSL 2 ciphers */
+-	{"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED},
+-	{"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
+-	{"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
+-	{"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED},
+-	{"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
+-	{"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
+-
+-	/* SSL3 ciphers */
+-	{"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
+-	{"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
+-	{"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED},
+-	{"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED},
+-	{"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
+-	{"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED},
+-	{"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
+-	{"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
+
+	/*
+	 * Use the same DEFAULT cipher list as OpenSSL, which is defined as: ALL:!aNULL:!eNULL:!SSLv2
+	 */
+
+	/* SSLv2 ciphers */
+	{"DES-CBC-MD5",     SSL_EN_DES_64_CBC_WITH_MD5,           SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5,  SSL2, SSL_LOW,      SSL_NOT_ALLOWED},
+	{"DES-CBC3-MD5",    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,     SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH,     SSL_NOT_ALLOWED},
+	{"RC2-CBC-MD5",     SSL_EN_RC2_128_CBC_WITH_MD5,          SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,  SSL2, SSL_MEDIUM,   SSL_NOT_ALLOWED},
+	{"RC4-MD5",         SSL_EN_RC4_128_WITH_MD5,              SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,  SSL2, SSL_MEDIUM,   SSL_NOT_ALLOWED},
+	{"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,  SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
+	{"EXP-RC4-MD5",     SSL_EN_RC4_128_EXPORT40_WITH_MD5,     SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,  SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
+
+	/* SSLv3 ciphers */
+	{"NULL-MD5",             SSL_RSA_WITH_NULL_MD5,              SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5,  SSL3, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"NULL-SHA",             SSL_RSA_WITH_NULL_SHA,              SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"DES-CBC-SHA",          SSL_RSA_WITH_DES_CBC_SHA,           SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"DES-CBC3-SHA",         SSL_RSA_WITH_3DES_EDE_CBC_SHA,      SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+	{"RC4-MD5",              SSL_RSA_WITH_RC4_128_MD5,           SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,    SSL3, SSL_MEDIUM,   SSL_ALLOWED},
+	{"RC4-SHA",              SSL_RSA_WITH_RC4_128_SHA,           SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1,   SSL3, SSL_MEDIUM,   SSL_ALLOWED},
+	{"EXP-RC2-CBC-MD5",      SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,    SSL3, SSL_EXPORT40, SSL_ALLOWED},
+	{"EXP-RC4-MD5",          SSL_RSA_EXPORT_WITH_RC4_40_MD5,     SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,    SSL3, SSL_EXPORT40, SSL_ALLOWED},
+	{"EDH-RSA-DES-CBC-SHA",  SSL_DHE_RSA_WITH_DES_CBC_SHA,       SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"EDH-RSA-DES-CBC3-SHA", SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,  SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+	{"EDH-DSS-DES-CBC-SHA",  SSL_DHE_DSS_WITH_DES_CBC_SHA,       SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"EDH-DSS-DES-CBC3-SHA", SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,  SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+ 
+ 	/* TLSv1 ciphers */
+-	{"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
+-	{"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
+-	{"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED},
+-	{"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED},
+	{"EXP1024-DES-CBC-SHA",      TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,   SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1,         TLS1, SSL_EXPORT56, SSL_ALLOWED},
+	{"EXP1024-RC4-SHA",          TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,    SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1,         TLS1, SSL_EXPORT56, SSL_ALLOWED},
+	{"SEED-SHA",                 TLS_RSA_WITH_SEED_CBC_SHA,             SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1,        TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"AES128-SHA",               TLS_RSA_WITH_AES_128_CBC_SHA,          SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"AES256-SHA",               TLS_RSA_WITH_AES_256_CBC_SHA,          SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"CAMELLIA256-SHA",          TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,     SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"CAMELLIA128-SHA",          TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,     SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-AES128-SHA",       TLS_DHE_RSA_WITH_AES_128_CBC_SHA,      SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-AES256-SHA",       TLS_DHE_RSA_WITH_AES_256_CBC_SHA,      SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-CAMELLIA128-SHA",  TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-CAMELLIA256-SHA",  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-RC4-SHA",          TLS_DHE_DSS_WITH_RC4_128_SHA,          SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1,         TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"DHE-DSS-AES128-SHA",       TLS_DHE_DSS_WITH_AES_128_CBC_SHA,      SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-AES256-SHA",       TLS_DHE_DSS_WITH_AES_256_CBC_SHA,      SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-CAMELLIA128-SHA",  TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-CAMELLIA256-SHA",  TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-NULL-SHA",        TLS_ECDH_RSA_WITH_NULL_SHA,            SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1,      TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDH-RSA-RC4-SHA",         TLS_ECDH_RSA_WITH_RC4_128_SHA,         SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1,        TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDH-RSA-DES-CBC3-SHA",    TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1,       TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-AES128-SHA",      TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,     SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-AES256-SHA",      TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,     SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-NULL-SHA",      TLS_ECDH_ECDSA_WITH_NULL_SHA,          SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1,    TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDH-ECDSA-RC4-SHA",       TLS_ECDH_ECDSA_WITH_RC4_128_SHA,       SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1,      TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDH-ECDSA-DES-CBC3-SHA",  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,  SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-AES128-SHA",    TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,   SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1,   TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-AES256-SHA",    TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,   SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1,   TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-NULL-SHA",       TLS_ECDHE_RSA_WITH_NULL_SHA,           SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1,     TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDHE-RSA-RC4-SHA",        TLS_ECDHE_RSA_WITH_RC4_128_SHA,        SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1,       TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDHE-RSA-DES-CBC3-SHA",   TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,   SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-AES128-SHA",     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,    SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-AES256-SHA",     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,    SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-NULL-SHA",     TLS_ECDHE_ECDSA_WITH_NULL_SHA,         SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1,   TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDHE-ECDSA-RC4-SHA",      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,      SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1,     TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-AES128-SHA",   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,  SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1,  TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-AES256-SHA",   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,  SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1,  TLS1, SSL_HIGH,     SSL_ALLOWED},
+ };
+ 
+ #define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties))
+@@ -577,6 +625,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
+ 					mask |= SSL_RSA;
+ 				} else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) {
+ 					mask |= SSL_eNULL;
+				} else if (!strcmp(cipher, "AES128")) {
+					mask |= SSL_AES128;
+				} else if (!strcmp(cipher, "AES256")) {
+					mask |= SSL_AES256;
+ 				} else if (!strcmp(cipher, "AES")) {
+ 					mask |= SSL_AES;
+ 				} else if (!strcmp(cipher, "3DES")) {
+@@ -591,6 +643,24 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
+ 					mask |= SSL_MD5;
+ 				} else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) {
+ 					mask |= SSL_SHA1;
+				} else if (!strcmp(cipher, "EDH")) {
+					mask |= SSL_kEDH;
+				} else if (!strcmp(cipher, "DSS")) {
+					mask |= SSL_aDSA;
+				} else if (!strcmp(cipher, "CAMELLIA128")) {
+					mask |= SSL_CAMELLIA128;
+				} else if (!strcmp(cipher, "CAMELLIA256")) {
+					mask |= SSL_CAMELLIA256;
+				} else if (!strcmp(cipher, "CAMELLIA")) {
+					mask |= SSL_CAMELLIA;
+				} else if (!strcmp(cipher, "SEED")) {
+					mask |= SSL_SEED;
+				} else if (!strcmp(cipher, "ECDH")) {
+					mask |= SSL_kECDH;
+				} else if (!strcmp(cipher, "ECDHE")) {
+					mask |= SSL_kECDHE;
+				} else if (!strcmp(cipher, "ECDSA")) {
+					mask |= SSL_aECDSA;
+ 				} else if (!strcmp(cipher, "SSLv2")) {
+ 					protocol |= SSL2;
+ 				} else if (!strcmp(cipher, "SSLv3")) {
+-- 
+1.7.11.4
+
@@ -0,0 +1,33 @@
+The non-reentrant gethostbyXXXX() functions deadlock if called recursively, for
+example if libldap needs to be initialized from within gethostbyXXXX() (which
+actually happens if nss_ldap is used for hostname resolution and earlier
+modules can't resolve the local host name), so use the reentrant versions of
+the functions, even if we're not being compiled for use in libldap_r
+
+Resolves: #179730
+Author: Jeffery Layton <jlayton@redhat.com>
+
+diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c
+index 373c81c..a012062 100644
+--- a/libraries/libldap/util-int.c
+++ b/libraries/libldap/util-int.c
+@@ -52,8 +52,8 @@ extern int h_errno;
+ #ifndef LDAP_R_COMPILE
+ # undef HAVE_REENTRANT_FUNCTIONS
+ # undef HAVE_CTIME_R
+-# undef HAVE_GETHOSTBYNAME_R
+-# undef HAVE_GETHOSTBYADDR_R
+/* # undef HAVE_GETHOSTBYNAME_R */
+/* # undef HAVE_GETHOSTBYADDR_R */
+ 
+ #else
+ # include <ldap_pvt_thread.h>
+@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod)
+ #define BUFSTART (1024-32)
+ #define BUFMAX (32*1024-32)
+ 
+-#if defined(LDAP_R_COMPILE)
+#if defined(LDAP_R_COMPILE) || defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R)
+ static char *safe_realloc( char **buf, int len );
+ 
+ #if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R))
@@ -0,0 +1,14 @@
+Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package
+independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.)
+
+--- openldap-2.4.24.orig/build/top.mk
+++ openldap-2.4.24/build/top.mk
+@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@
+ SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@
+ SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@
+ 
+-SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)
+SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)
+ 
+ # Our Defaults
+ CC = $(AC_CC)
@@ -0,0 +1,41 @@
+From: Jan-Marek Glogowski <jan-marek.glogowski@muenchen.de>
+Date: Tue, 18 May 2010 17:47:05 +0200
+Subject: [PATCH] Switch to lt_dlopenadvise() to get RTLD_GLOBAL set.
+
+Proof of concept for fixing http://bugs.debian.org/327585
+(patch ported from freeradius bug http://bugs.debian.org/416266)
+
+Resolves: #960048
+---
+--- openldap/servers/slapd/module.c.orig	2010-05-18 17:42:04.000000000 +0200
+++ openldap/servers/slapd/module.c	2010-05-18 17:45:46.000000000 +0200
+@@ -117,6 +117,20 @@
+ 	return -1;	/* not found */
+ }
+ 
+static lt_dlhandle slapd_lt_dlopenext_global( const char *filename )
+{
+	lt_dlhandle handle = 0;
+	lt_dladvise advise;
+
+	if (!lt_dladvise_init (&advise) && !lt_dladvise_ext (&advise)
+			&& !lt_dladvise_global (&advise))
+		handle = lt_dlopenadvise (filename, advise);
+
+	lt_dladvise_destroy (&advise);
+
+	return handle;
+}
+
+ int module_load(const char* file_name, int argc, char *argv[])
+ {
+ 	module_loaded_t *module;
+@@ -180,7 +194,7 @@
+ 	 * to calling Debug. This is because Debug is a macro that expands
+ 	 * into multiple function calls.
+ 	 */
+-	if ((module->lib = lt_dlopenext(file)) == NULL) {
+	if ((module->lib = slapd_lt_dlopenext_global(file)) == NULL) {
+ 		error = lt_dlerror();
+ #ifdef HAVE_EBCDIC
+ 		strcpy( ebuf, error );
@@ -0,0 +1,62 @@
+allow unsetting of tls_* syncrepl options
+
+Author: Patrick Monnerat <pm@datasphere.ch>
+Upstream ITS: #7042
+Resolves: #734187
+
+diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
+index 654a4bf..10b993b 100644
+--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
+@@ -735,27 +735,27 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_CACERTFILE:
+ 		if ( lo->ldo_tls_cacertfile ) LDAP_FREE( lo->ldo_tls_cacertfile );
+-		lo->ldo_tls_cacertfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_cacertfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_CACERTDIR:
+ 		if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir );
+-		lo->ldo_tls_cacertdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_cacertdir = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_CERTFILE:
+ 		if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile );
+-		lo->ldo_tls_certfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_certfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_KEYFILE:
+ 		if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile );
+-		lo->ldo_tls_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_keyfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_DHFILE:
+ 		if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile );
+-		lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_dhfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_CRLFILE:	/* GnuTLS only */
+ 		if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile );
+-		lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_crlfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 	case LDAP_OPT_X_TLS_REQUIRE_CERT:
+ 		if ( !arg ) return -1;
+@@ -783,7 +783,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
+ #endif
+ 	case LDAP_OPT_X_TLS_CIPHER_SUITE:
+ 		if ( lo->ldo_tls_ciphersuite ) LDAP_FREE( lo->ldo_tls_ciphersuite );
+-		lo->ldo_tls_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_ciphersuite = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		return 0;
+ 
+ 	case LDAP_OPT_X_TLS_PROTOCOL_MIN:
+@@ -794,7 +794,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
+ 		if ( ld != NULL )
+ 			return -1;
+ 		if ( lo->ldo_tls_randfile ) LDAP_FREE (lo->ldo_tls_randfile );
+-		lo->ldo_tls_randfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_randfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
+ 		break;
+ 	case LDAP_OPT_X_TLS_NEWCTX:
+ 		if ( !arg ) return -1;
@@ -0,0 +1,92 @@
+TLS: do not reuse tls_session if hostname check fails
+
+If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails,
+*tls_session is not dropped, but reused when connecting to the second server.
+
+This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor.
+From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling.
+
+Author: Jan Vcelak <jvcelak@redhat.com>
+Upstream ITS: #7373
+Resolves: #852476 
+
+diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
+index 10b993b..a3cd590 100644
+--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
+@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc )
+  */
+ 
+ static int
+-ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
+ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
+ {
+ 	Sockbuf *sb = conn->lconn_sb;
+ 	int	err;
+@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
+ 	errno = WSAGetLastError();
+ #endif
+ 
+	if ( err == 0 ) {
+		err = ldap_pvt_tls_check_hostname( ld, ssl, host );
+	}
+
+ 	if ( err < 0 )
+ 	{
+ 		char buf[256], *msg;
+@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in )
+ {
+ 	tls_session *session = s;
+ 
+-	return tls_imp->ti_session_chkhost( ld, session, name_in );
+	if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
+	    ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
+		ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in );
+		if (ld->ld_errno != LDAP_SUCCESS) {
+			return ld->ld_errno;
+		}
+	}
+
+	return LDAP_SUCCESS;
+ }
+ 
+ int
+@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
+ #endif /* LDAP_USE_NON_BLOCKING_TLS */
+ 
+ 	ld->ld_errno = LDAP_SUCCESS;
+-	ret = ldap_int_tls_connect( ld, conn );
+	ret = ldap_int_tls_connect( ld, conn, host );
+ 
+ #ifdef LDAP_USE_NON_BLOCKING_TLS
+ 	while ( ret > 0 ) { /* this should only happen for non-blocking io */
+@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
+ 		} else {
+ 			/* ldap_int_poll called ldap_pvt_ndelay_off */
+ 			ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb );
+-			ret = ldap_int_tls_connect( ld, conn );
+			ret = ldap_int_tls_connect( ld, conn, host );
+ 			if ( ret > 0 ) { /* need to call tls_connect once more */
+ 				struct timeval curr_time_tv, delta_tv;
+ 
+@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
+ 		return (ld->ld_errno);
+ 	}
+ 
+-	ssl = ldap_pvt_tls_sb_ctx( sb );
+-	assert( ssl != NULL );
+-
+-	/* 
+-	 * compare host with name(s) in certificate
+-	 */
+-	if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
+-	    ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
+-		ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host );
+-		if (ld->ld_errno != LDAP_SUCCESS) {
+-			return ld->ld_errno;
+-		}
+-	}
+-
+ 	return LDAP_SUCCESS;
+ }
+ 
@@ -0,0 +1,92 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
+<head>
+<title>openldap.git - openldap</title>
+<meta name='generator' content='cgit v0.9.2'/>
+<meta name='robots' content='index, nofollow'/>
+<link rel='stylesheet' type='text/css' href='/cgit-data/cgit.css'/>
+<link rel='alternate' title='Atom feed' href='http://pkgs.fedoraproject.org/cgit/openldap.git/atom/openldap-userconfig-setgid.patch?h=master' type='application/atom+xml'/>
+</head>
+<body>
+<div id='cgit'><table id='header'>
+<tr>
+<td class='logo' rowspan='2'><a href='/cgit/'><img src='/cgit-data/cgit.png' alt='cgit logo'/></a></td>
+<td class='main'><a href='/cgit/'>index</a> : <a title='openldap.git' href='/cgit/openldap.git/'>openldap.git</a></td><td class='form'><form method='get' action=''>
+<select name='h' onchange='this.form.submit();'>
+<option value='FC-4-split'>FC-4-split</option>
+<option value='f10'>f10</option>
+<option value='f11'>f11</option>
+<option value='f12'>f12</option>
+<option value='f13'>f13</option>
+<option value='f14'>f14</option>
+<option value='f15'>f15</option>
+<option value='f16'>f16</option>
+<option value='f17'>f17</option>
+<option value='f18'>f18</option>
+<option value='f19'>f19</option>
+<option value='f20'>f20</option>
+<option value='f7'>f7</option>
+<option value='f8'>f8</option>
+<option value='f9'>f9</option>
+<option value='master' selected='selected'>master</option>
+<option value='private-moznss-f17'>private-moznss-f17</option>
+</select> <input type='submit' name='' value='switch'/></form></td></tr>
+<tr><td class='sub'>openldap</td><td class='sub right'>Jesse Keating</td></tr></table>
+<table class='tabs'><tr><td>
+<a href='/cgit/openldap.git/'>summary</a><a href='/cgit/openldap.git/refs/'>refs</a><a href='/cgit/openldap.git/log/openldap-userconfig-setgid.patch'>log</a><a class='active' href='/cgit/openldap.git/tree/openldap-userconfig-setgid.patch'>tree</a><a href='/cgit/openldap.git/commit/openldap-userconfig-setgid.patch'>commit</a><a href='/cgit/openldap.git/diff/openldap-userconfig-setgid.patch'>diff</a><a href='/cgit/openldap.git/stats/openldap-userconfig-setgid.patch'>stats</a></td><td class='form'><form class='right' method='get' action='/cgit/openldap.git/log/openldap-userconfig-setgid.patch'>
+<select name='qt'>
+<option value='grep'>log msg</option>
+<option value='author'>author</option>
+<option value='committer'>committer</option>
+<option value='range'>range</option>
+</select>
+<input class='txt' type='text' size='10' name='q' value=''/>
+<input type='submit' value='search'/>
+</form>
+</td></tr></table>
+<div class='path'>path: <a href='/cgit/openldap.git/tree/'>root</a>/<a href='/cgit/openldap.git/tree/openldap-userconfig-setgid.patch'>openldap-userconfig-setgid.patch</a></div><div class='content'>blob: 70f0d28ecab7c4152aa414adde93e462179ba0f8 (<a href='/cgit/openldap.git/plain/openldap-userconfig-setgid.patch'>plain</a>)
+<table summary='blob content' class='blob'>
+<tr><td class='linenumbers'><pre><a class='no' id='n1' name='n1' href='#n1'>1</a>
+<a class='no' id='n2' name='n2' href='#n2'>2</a>
+<a class='no' id='n3' name='n3' href='#n3'>3</a>
+<a class='no' id='n4' name='n4' href='#n4'>4</a>
+<a class='no' id='n5' name='n5' href='#n5'>5</a>
+<a class='no' id='n6' name='n6' href='#n6'>6</a>
+<a class='no' id='n7' name='n7' href='#n7'>7</a>
+<a class='no' id='n8' name='n8' href='#n8'>8</a>
+<a class='no' id='n9' name='n9' href='#n9'>9</a>
+<a class='no' id='n10' name='n10' href='#n10'>10</a>
+<a class='no' id='n11' name='n11' href='#n11'>11</a>
+<a class='no' id='n12' name='n12' href='#n12'>12</a>
+<a class='no' id='n13' name='n13' href='#n13'>13</a>
+<a class='no' id='n14' name='n14' href='#n14'>14</a>
+<a class='no' id='n15' name='n15' href='#n15'>15</a>
+<a class='no' id='n16' name='n16' href='#n16'>16</a>
+<a class='no' id='n17' name='n17' href='#n17'>17</a>
+<a class='no' id='n18' name='n18' href='#n18'>18</a>
+</pre></td>
+<td class='lines'><pre><code>Normally, skips reading of user configuration file when running with different effective UID.
+This patch adds the same behavior for GID.
+
+Author: Nalin Dahyabhai &lt;nalin@redhat.com&gt;
+
+diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
+index e6b17b4..fbf4829 100644
+--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
+@@ -678,7 +678,7 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl )
+ 	openldap_ldap_init_w_sysconf(LDAP_CONF_FILE);
+ 
+ #ifdef HAVE_GETEUID
+-	if ( geteuid() != getuid() )
+	if ( geteuid() != getuid() || getegid() != getgid() )
+ 		return;
+ #endif
+ 
+</code></pre></td></tr></table>
+</div> <!-- class=content -->
+<div class='footer'>generated  by cgit v0.9.2 at 2014-01-09 14:22:50 (GMT)</div>
+</div> <!-- id=cgit -->
+</body>
+</html>
@@ -0,0 +1,111 @@
+#!/bin/sh
+# Last update 20050401 - Christian Zoffoli <xmerlin@gentoo.org>
+
+VERSION="0.3"
+openssl="/usr/bin/openssl"
+opensslopts=""
+ldapconfdir="/etc/openldap/ssl"
+pemfile="${ldapconfdir}/ldap.pem"
+randfile="${ldapconfdir}/ldap.rand"
+cfgfile="${ldapconfdir}/ldap.cfg"
+
+function fixperms {
+	chown root:ldap ${ldapconfdir} -R
+	find ${ldapconfdir} -type f -exec chmod 640 \{\} \;
+	chmod 750 ${ldapconfdir}
+}
+
+
+if [ ! -x ${openssl} ]; then
+	exit 0
+fi
+
+if [ ! -d ${ldapconfdir} ]; then
+	mkdir -p ${ldapconfdir}
+fi
+
+fixperms
+
+if [ -f ${pemfile} ]; then
+	echo "${pemfile} already exist, dying"
+	exit 0
+fi
+
+
+dd if=/dev/urandom of=$randfile count=1 2>/dev/null
+
+echo ""
+echo "______________________________________________________________________${T_ME}"
+echo ""
+echo "Creating self-signed certificate -- Version ${VERSION}"
+echo ""
+echo "______________________________________________________________________${T_ME}"
+echo ""
+
+
+COMMONNAME=`hostname`
+if [ ! -n "$COMMONNAME" ]; then
+	COMMONNAME="www.openldap.org"
+fi
+
+
+if [ -f ${cfgfile} ]; then
+	echo "${cfgfile} found, would you like to use it ? (y/n)"
+	read answer
+	
+	case "$answer" in
+		y|Y)
+			opensslopts="-batch"
+		;;
+		n|N)
+			cat >${cfgfile} <<EOT
+			[ req ]
+			default_bits                    = 1024
+			distinguished_name              = req_DN
+			RANDFILE                        = ${randfile}
+			[ req_DN ]
+			countryName                     = "1. Country Name             (2 letter code)"
+			countryName_default             = "US"
+			countryName_min			= 2
+			countryName_max			= 2
+			stateOrProvinceName		= "2. State or Province Name   (full name)    "
+			stateOrProvinceName_default	= ""
+			localityName                    = "3. Locality Name            (eg, city)     "
+			localityName_default		= ""
+			0.organizationName		= "4. Organization Name        (eg, company)  "
+			0.organizationName_default	= "LDAP Server"
+			organizationalUnitName		= "5. Organizational Unit Name (eg, section)  "
+			organizationalUnitName_default	= "For testing purposes only"
+			commonName			= "6. Common Name              (eg, CA name)  "
+			commonName_max			= 64
+			commonName_default		= "${COMMONNAME}"
+			emailAddress			= "7. Email Address            (eg, name@FQDN)"
+			emailAddress_max		= 40
+			emailAddress_default		= ""
+EOT
+		;;
+		*)
+			echo "Wrong answer, retry!"
+			exit 1
+		;;
+	esac 
+fi
+
+echo ""
+
+${openssl} req -config ${cfgfile} ${opensslopts} -new -rand ${randfile} -x509 -nodes -out ${pemfile} -keyout ${pemfile} -days 999999  
+
+if [ $? -ne 0 ]; then
+	echo "cca:Error: Failed to generate certificate " 1>&2
+	exit 1
+else
+	echo -e "\nCertificate creation done!"
+fi
+
+if [ -f ${randfile} ]; then
+	rm -f ${randfile}
+fi
+
+if [ -f ${pemfile} ]; then
+	fixperms
+fi
@@ -0,0 +1,188 @@
+Submitted By:            Armin K. <krejzi at email dot com>
+Date:                    2012-04-06
+Initial Package Version: 2.4.30
+Upstream Status:         BLFS Specific
+Origin:                  Self
+Description:             Patch changes various installation options, such as ldap database path,
+                         configuration file options, slapd install location, etc.
+
+--- openldap.orig/doc/man/man5/slapd-bdb.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd-bdb.5	2012-04-06 00:18:54.171136608 +0200
+@@ -131,7 +131,7 @@
+ associated indexes live.
+ A separate directory must be specified for each database.
+ The default is
+-.BR LOCALSTATEDIR/openldap\-data .
+.BR LOCALSTATEDIR/lib/openldap .
+ .TP
+ .B dirtyread
+ Allow reads of modified but not yet committed data.
+--- openldap.orig/doc/man/man5/slapd.conf.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd.conf.5	2012-04-06 00:18:54.174136671 +0200
+@@ -1987,7 +1987,7 @@
+ # The database directory MUST exist prior to
+ # running slapd AND should only be accessible
+ # by the slapd/tools. Mode 0700 recommended.
+-directory LOCALSTATEDIR/openldap\-data
+directory LOCALSTATEDIR/lib/openldap
+ # Indices to maintain
+ index     objectClass  eq
+ index     cn,sn,mail   pres,eq,approx,sub
+--- openldap.orig/doc/man/man5/slapd-config.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd-config.5	2012-04-06 00:18:54.194137078 +0200
+@@ -2029,7 +2029,7 @@
+ # The database directory MUST exist prior to
+ # running slapd AND should only be accessible
+ # by the slapd/tools. Mode 0700 recommended.
+-olcDbDirectory: LOCALSTATEDIR/openldap\-data
+olcDbDirectory: LOCALSTATEDIR/lib/openldap
+ # Indices to maintain
+ olcDbIndex:     objectClass  eq
+ olcDbIndex:     cn,sn,mail   pres,eq,approx,sub
+--- openldap.orig/include/ldap_defaults.h	2012-02-29 18:37:09.000000000 +0100
+++ openldap/include/ldap_defaults.h	2012-04-06 00:18:54.200137199 +0200
+@@ -39,7 +39,7 @@
+ #define LDAP_ENV_PREFIX "LDAP"
+ 
+ /* default ldapi:// socket */
+-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"
+#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"
+ 
+ /*
+  * SLAPD DEFINITIONS
+@@ -47,7 +47,7 @@
+ 	/* location of the default slapd config file */
+ #define SLAPD_DEFAULT_CONFIGFILE	LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf"
+ #define SLAPD_DEFAULT_CONFIGDIR		LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d"
+-#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "openldap-data"
+#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap"
+ #define SLAPD_DEFAULT_DB_MODE		0600
+ #define SLAPD_DEFAULT_UCDATA		LDAP_DATADIR LDAP_DIRSEP "ucdata"
+ 	/* default max deref depth for aliases */
+--- openldap.orig/libraries/liblber/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/liblber/Makefile.in	2012-04-06 00:18:54.204137280 +0200
+@@ -48,6 +48,6 @@
+ 
+ install-local: FORCE
+ 	-$(MKDIR) $(DESTDIR)$(libdir)
+-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
+ 	$(LTFINISH) $(DESTDIR)$(libdir)
+ 
+--- openldap.orig/libraries/libldap/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/libldap/Makefile.in	2012-04-06 00:18:54.204137280 +0200
+@@ -68,7 +68,7 @@
+ 
+ install-local: $(CFFILES) FORCE
+ 	-$(MKDIR) $(DESTDIR)$(libdir)
+-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
+ 	$(LTFINISH) $(DESTDIR)$(libdir)
+ 	-$(MKDIR) $(DESTDIR)$(sysconfdir)
+ 	@for i in $(CFFILES); do \
+--- openldap.orig/libraries/libldap_r/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-06 00:18:54.208137362 +0200
+@@ -83,6 +83,6 @@
+ 
+ install-local: $(CFFILES) FORCE
+ 	-$(MKDIR) $(DESTDIR)$(libdir)
+-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
+ 	$(LTFINISH) $(DESTDIR)$(libdir)
+ 
+--- openldap.orig/servers/slapd/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/Makefile.in	2012-04-06 00:18:54.208137362 +0200
+@@ -370,10 +370,10 @@
+ 	install-conf install-db-config install-schema install-tools
+ 
+ install-slapd: FORCE
+-	-$(MKDIR) $(DESTDIR)$(libexecdir)
+	-$(MKDIR) $(DESTDIR)$(sbindir)
+ 	-$(MKDIR) $(DESTDIR)$(localstatedir)/run
+ 	$(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \
+-		slapd$(EXEEXT) $(DESTDIR)$(libexecdir)
+		slapd$(EXEEXT) $(DESTDIR)$(sbindir)
+ 	@for i in $(SUBDIRS); do \
+ 	    if test -d $$i && test -f $$i/Makefile ; then \
+ 		echo; echo "  cd $$i; $(MAKE) $(MFLAGS) install"; \
+@@ -439,9 +439,9 @@
+ 
+ install-db-config: FORCE
+ 	@-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir)
+-	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data
+	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap
+ 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
+-		$(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example
+		$(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example
+ 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
+ 		$(DESTDIR)$(sysconfdir)/DB_CONFIG.example
+ 
+@@ -449,6 +449,6 @@
+ 	-$(MKDIR) $(DESTDIR)$(sbindir)
+ 	for i in $(SLAPTOOLS); do \
+ 		$(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+-		$(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+		$(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+ 	done
+ 
+--- openldap.orig/servers/slapd/slapd.conf	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/slapd.conf	2012-04-06 00:21:12.891992222 +0200
+@@ -10,14 +10,12 @@
+ # service AND an understanding of referrals.
+ #referral	ldap://root.openldap.org
+ 
+-pidfile		%LOCALSTATEDIR%/run/slapd.pid
+-argsfile	%LOCALSTATEDIR%/run/slapd.args
+pidfile		%LOCALSTATEDIR%/run/openldap/slapd.pid
+argsfile	%LOCALSTATEDIR%/run/openldap/slapd.args
+ 
+ # Load dynamic backend modules:
+-# modulepath	%MODULEDIR%
+-# moduleload	back_bdb.la
+-# moduleload	back_hdb.la
+-# moduleload	back_ldap.la
+modulepath	%MODULEDIR%
+moduleload	back_bdb
+ 
+ # Sample security restrictions
+ #	Require integrity protection (prevent hijacking)
+@@ -46,20 +44,26 @@
+ #
+ # rootdn can always read and write EVERYTHING!
+ 
+# Specific Backend Directives for bdb:
+backend         bdb
+
+ #######################################################################
+ # BDB database definitions
+ #######################################################################
+ 
+ database	bdb
+ suffix		"dc=my-domain,dc=com"
+-rootdn		"cn=Manager,dc=my-domain,dc=com"
+#rootdn		"cn=Manager,dc=my-domain,dc=com"
+
+ # Cleartext passwords, especially for the rootdn, should
+ # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
+ # Use of strong authentication encouraged.
+-rootpw		secret
+#rootpw		secret
+
+ # The database directory MUST exist prior to running slapd AND 
+ # should only be accessible by the slapd and slap tools.
+ # Mode 700 recommended.
+-directory	%LOCALSTATEDIR%/openldap-data
+directory	%LOCALSTATEDIR%/lib/openldap
+
+ # Indices to maintain
+ index	objectClass	eq
+--- openldap.orig/servers/slapd/slapi/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/slapi/Makefile.in	2012-04-06 00:18:54.210137403 +0200
+@@ -46,6 +46,6 @@
+ install-local: FORCE
+ 	if test "$(BUILD_MOD)" = "yes"; then \
+ 		$(MKDIR) $(DESTDIR)$(libdir); \
+-		$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \
+		$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \
+ 	fi
+ 
@@ -0,0 +1,219 @@
+Submitted By:            Armin K. <krejzi at email dot com>
+Date:                    2012-04-06
+Initial Package Version: 2.4.30
+Upstream Status:         Unknown
+Origin:                  Debian
+Description:             Patch from evolution-exchange (2.10.3).  The ldap_ntlm_bind function is
+                         actually called by evolution-data-server, checked at version 1.12.2.
+                         Without this patch, the Exchange addressbook integration uses simple binds
+                         with cleartext passwords.
+
+--- openldap.orig/include/ldap.h	2012-02-29 18:37:09.000000000 +0100
+++ openldap/include/ldap.h	2012-04-01 00:20:00.059827789 +0200
+@@ -2517,5 +2517,25 @@
+ 	LDAPControl	**ctrls,
+ 	LDAPDerefRes	**drp ));
+ 
+/*
+ * hacks for NTLM
+ */
+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
+#define LDAP_AUTH_NTLM_RESPONSE  ((ber_tag_t) 0x8bU)
+LDAP_F( int )
+ldap_ntlm_bind LDAP_P((
+      LDAP    *ld,
+      LDAP_CONST char *dn,
+      ber_tag_t tag,
+      struct berval *cred,
+      LDAPControl **sctrls,
+      LDAPControl **cctrls,
+      int   *msgidp ));
+LDAP_F( int )
+ldap_parse_ntlm_bind_result LDAP_P((
+      LDAP    *ld,
+      LDAPMessage *res,
+      struct berval *challenge));
+
+ LDAP_END_DECL
+ #endif /* _LDAP_H */
+--- openldap.orig/libraries/libldap/Makefile.in	2012-04-01 00:18:54.233419658 +0200
+++ openldap/libraries/libldap/Makefile.in	2012-04-01 00:20:00.060827810 +0200
+@@ -27,7 +27,7 @@
+ 	init.c options.c print.c string.c util-int.c schema.c \
+ 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
+ 	tls2.c tls_o.c tls_g.c tls_m.c \
+-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
+ 	assertion.c deref.c ldif.c fetch.c
+ 
+ OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
+@@ -40,7 +40,7 @@
+ 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
+ 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
+ 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
+-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
+ 	assertion.lo deref.lo ldif.lo fetch.lo
+ 
+ LDAP_INCDIR= ../../include       
+--- openldap.orig/libraries/libldap/ntlm.c	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/libldap/ntlm.c	2012-04-01 00:20:00.059827789 +0200
+@@ -0,0 +1,138 @@
+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
+/*
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
+
+/* Mostly copied from sasl.c */
+
+#include "portable.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/errno.h>
+
+#include "ldap-int.h"
+
+int
+ldap_ntlm_bind(
+ LDAP    *ld,
+ LDAP_CONST char *dn,
+ ber_tag_t tag,
+ struct berval *cred,
+ LDAPControl **sctrls,
+ LDAPControl **cctrls,
+ int   *msgidp )
+{
+ BerElement  *ber;
+ int rc;
+ ber_int_t id;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( msgidp != NULL );
+
+ if( msgidp == NULL ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ /* create a message to send */
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ assert( LBER_VALID( ber ) );
+
+ LDAP_NEXT_MSGID( ld, id );
+ rc = ber_printf( ber, "{it{istON}" /*}*/,
+      id, LDAP_REQ_BIND,
+      ld->ld_version, dn, tag,
+      cred );
+
+ /* Put Server Controls */
+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
+   ld->ld_errno = LDAP_ENCODING_ERROR;
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ /* send the message */
+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
+
+ if(*msgidp < 0)
+   return ld->ld_errno;
+
+ return LDAP_SUCCESS;
+}
+
+int
+ldap_parse_ntlm_bind_result(
+ LDAP    *ld,
+ LDAPMessage *res,
+ struct berval *challenge)
+{
+ ber_int_t errcode;
+ ber_tag_t tag;
+ BerElement  *ber;
+ ber_len_t len;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( res != NULL );
+
+ if ( ld == NULL || res == NULL ) {
+   return LDAP_PARAM_ERROR;
+ }
+
+ if( res->lm_msgtype != LDAP_RES_BIND ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ if ( ld->ld_error ) {
+   LDAP_FREE( ld->ld_error );
+   ld->ld_error = NULL;
+ }
+ if ( ld->ld_matched ) {
+   LDAP_FREE( ld->ld_matched );
+   ld->ld_matched = NULL;
+ }
+
+ /* parse results */
+
+ ber = ber_dup( res->lm_ber );
+
+ if( ber == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ tag = ber_scanf( ber, "{ioa" /*}*/,
+      &errcode, challenge, &ld->ld_error );
+ ber_free( ber, 0 );
+
+ if( tag == LBER_ERROR ) {
+   ld->ld_errno = LDAP_DECODING_ERROR;
+   return ld->ld_errno;
+ }
+
+ ld->ld_errno = errcode;
+
+ return( ld->ld_errno );
+}
+
+--- openldap.orig/libraries/libldap_r/Makefile.in	2012-04-01 00:18:54.234419703 +0200
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-01 00:20:00.060827810 +0200
+@@ -29,7 +29,7 @@
+ 	init.c options.c print.c string.c util-int.c schema.c \
+ 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
+ 	tls2.c tls_o.c tls_g.c tls_m.c \
+-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
+ 	assertion.c deref.c ldif.c fetch.c
+ SRCS	= threads.c rdwr.c rmutex.c tpool.c rq.c \
+ 	thr_posix.c thr_cthreads.c thr_thr.c thr_nt.c \
+@@ -47,7 +47,7 @@
+ 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
+ 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
+ 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
+-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
+ 	assertion.lo deref.lo ldif.lo fetch.lo
+ 
+ LDAP_INCDIR= ../../include       
@@ -0,0 +1,160 @@
+Submitted By:            Armin K. <krejzi at email dot com>
+Date:                    2012-04-06
+Initial Package Version: 2.4.30
+Upstream Status:         Unknown
+Origin:                  Debian
+Description:             This patch enables symbol versioning in ldap libraries. Without this
+                         patch some applications might generate a warning about missing symbol
+                         versions.
+
+--- openldap.orig/build/openldap.m4	2012-02-29 18:37:09.000000000 +0100
+++ openldap/build/openldap.m4	2012-04-01 17:29:50.973881411 +0200
+@@ -1136,3 +1136,54 @@
+ #endif
+ 	], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])])
+ ])
+
+dnl ====================================================================
+dnl check for symbol versioning support
+AC_DEFUN([OL_SYMBOL_VERSIONING],
+[AC_CACHE_CHECK([for .symver assembler directive],
+	[ol_cv_asm_symver_directive],[
+cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+  ol_cv_asm_symver_directive=yes
+else
+  ol_cv_asm_symver_directive=no
+fi
+rm -f conftest*])
+AC_CACHE_CHECK([for ld --version-script],
+	[ol_cv_ld_version_script_option],[
+if test $ol_cv_asm_symver_directive = yes; then
+  cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+  cat > conftest.map <<EOF
+VERS_1 {
+	global: sym;
+};
+
+VERS_2 {
+	global: sym;
+} VERS_1;
+EOF
+  if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+    if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared
+                                                 -o conftest.so conftest.o
+                                                 -Wl,--version-script,conftest.map
+                       1>&AS_MESSAGE_LOG_FD]);
+    then
+      ol_cv_ld_version_script_option=yes
+    else
+      ol_cv_ld_version_script_option=no
+    fi
+  else
+    ol_cv_ld_version_script_option=no
+  fi
+else
+  ol_cv_ld_version_script_option=no
+fi
+rm -f conftest*])])
+--- openldap.orig/build/top.mk	2012-02-29 18:37:09.000000000 +0100
+++ openldap/build/top.mk	2012-04-01 17:29:50.972881390 +0200
+@@ -104,6 +104,9 @@
+ # LINK_LIBS referenced in library and module link commands.
+ LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)
+ 
+# option to pass to $(CC) to support library symbol versioning, if any
+VERSION_OPTION = @VERSION_OPTION@
+
+ LTSTATIC = @LTSTATIC@
+ 
+ LTLINK   = $(LIBTOOL) --mode=link \
+@@ -113,7 +116,7 @@
+ 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c
+ 
+ LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \
+-	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB)
+	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS)
+ 
+ LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \
+ 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c
+--- openldap.orig/configure.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/configure.in	2012-04-01 17:29:50.981881580 +0200
+@@ -1907,6 +1907,13 @@
+ fi
+ AC_SUBST(LTSTATIC)dnl
+ 
+VERSION_OPTION=""
+OL_SYMBOL_VERSIONING
+if test $ol_cv_ld_version_script_option = yes ; then
+  VERSION_OPTION="-Wl,--version-script="
+fi
+AC_SUBST(VERSION_OPTION)
+
+ dnl ----------------------------------------------------------------
+ if test $ol_enable_wrappers != no ; then
+ 	AC_CHECK_HEADERS(tcpd.h,[
+--- openldap.orig/libraries/liblber/liblber.map	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/liblber/liblber.map	2012-04-01 17:29:50.983881622 +0200
+@@ -0,0 +1,8 @@
+OPENLDAP_2.4_2 {
+  global:
+    ber_*;
+    der_alloc;
+    lutil_*;
+  local:
+    *;
+};
+--- openldap.orig/libraries/liblber/Makefile.in	2012-04-01 17:27:12.042526978 +0200
+++ openldap/libraries/liblber/Makefile.in	2012-04-01 17:29:50.982881601 +0200
+@@ -38,6 +38,9 @@
+ XXLIBS = 
+ NT_LINK_LIBS = $(AC_LIBS)
+ UNIX_LINK_LIBS = $(AC_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map"
+endif
+ 
+ dtest:    $(XLIBS) dtest.o
+ 	$(LTLINK) -o $@ dtest.o $(LIBS)
+--- openldap.orig/libraries/libldap/libldap.map	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/libldap/libldap.map	2012-04-01 17:29:50.981881580 +0200
+@@ -0,0 +1,7 @@
+OPENLDAP_2.4_2 {
+  global:
+    ldap_*;
+    ldif_*;
+  local:
+    *;
+};
+--- openldap.orig/libraries/libldap/Makefile.in	2012-04-01 17:27:12.043527000 +0200
+++ openldap/libraries/libldap/Makefile.in	2012-04-01 17:29:50.982881601 +0200
+@@ -52,6 +52,9 @@
+ XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS)
+ NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map
+endif
+ 
+ apitest:	$(XLIBS) apitest.o
+ 	$(LTLINK) -o $@ apitest.o $(LIBS)
+--- openldap.orig/libraries/libldap_r/Makefile.in	2012-04-01 17:27:12.043527000 +0200
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-01 17:29:50.971881369 +0200
+@@ -61,6 +61,9 @@
+ XXXLIBS = $(LTHREAD_LIBS)
+ NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map"
+endif
+ 
+ .links : Makefile
+ 	@for i in $(XXSRCS); do \
@@ -0,0 +1,9 @@
+# conf.d file for openldap
+#
+# To enable both the standard unciphered server and the ssl encrypted
+# one uncomment this line or set any other server starting options
+# you may desire.
+#
+# OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
+# Uncomment the below to use the new slapd configuration for openldap 2.3
+OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
@@ -0,0 +1 @@
+d /run/openldap 0755 ldap ldap - -
@@ -0,0 +1,166 @@
+<?xml version="1.0" ?>
+<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
+<PISI>
+    <Source>
+        <Name>openldap</Name>
+        <Homepage>http://www.openldap.org</Homepage>
+        <Packager>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Packager>
+        <License>OPENLDAP</License>
+        <Summary>Open-source suite of LDAP applications and development tools</Summary>
+        <Description>OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools</Description>
+        <Archive sha1sum="c6880df9fec928a5f010b78a4285b497e8a12d6b" type="targz">ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.41.tgz</Archive>
+        <BuildDependencies>
+            <Dependency>nss-devel</Dependency>
+            <Dependency>db-devel</Dependency>
+            <Dependency>tcp-wrappers-devel</Dependency>
+            <!--Dependency>cyrus-sasl-devel</Dependency-->
+            <Dependency>libtool-ltdl</Dependency>
+        </BuildDependencies>
+        <Patches>
+            <Patch level="1">openldap-2.4.39-blfs_paths-1.patch</Patch>
+            <Patch level="1">openldap-2.4.39-symbol_versions-1.patch</Patch>
+            <Patch level="1">openldap-2.4.39-ntlm-1.patch</Patch>
+            <Patch level="1">fedora/openldap-sql-linking.patch</Patch>
+            <Patch level="1">fedora/openldap-reentrant-gethostby.patch</Patch>
+            <Patch level="1">fedora/openldap-ldaprc-currentdir.patch</Patch>
+            <Patch level="1">fedora/openldap-userconfig-setgid.patch</Patch>
+            <!--<Patch level="1">fedora/openldap-dns-priority.patch</Patch>-->
+            <Patch level="1">fedora/openldap-syncrepl-unset-tls-options.patch</Patch>
+            <Patch level="1">fedora/openldap-nss-update-list-of-ciphers.patch</Patch>
+            <Patch level="1">fedora/openldap-tls-no-reuse-of-tls_session.patch</Patch>
+            <Patch level="1">fedora/openldap-nss-regex-search-hashed-cacert-dir.patch</Patch>
+            <Patch level="1">fedora/openldap-nss-ignore-certdb-type-prefix.patch</Patch>
+            <Patch level="1">fedora/openldap-nss-certs-from-certdb-fallback-pem.patch</Patch>
+            <Patch level="1">fedora/openldap-nss-pk11-freeslot.patch</Patch>
+            <Patch level="1">fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch</Patch>
+            <Patch level="1">fedora/openldap-ldapi-sasl.patch</Patch>
+            <Patch level="1">fedora/openldap-autoconf-pkgconfig-nss.patch</Patch>
+        </Patches>
+    </Source>
+
+    <Package>
+        <Name>openldap-client</Name>
+        <IsA>library</IsA>
+        <IsA>app:console</IsA>
+        <Summary>Command-line ldap client commands (ldapsearch, ldapadd etc..)</Summary>
+        <RuntimeDependencies>
+            <Dependency>nss</Dependency>
+            <!--Dependency>cyrus-sasl</Dependency-->
+        </RuntimeDependencies>
+        <Files>
+            <Path fileType="config">/etc/openldap/ldap.conf*</Path>
+            <Path fileType="header">/usr/include</Path>
+            <Path fileType="executable">/usr/bin</Path>
+            <Path fileType="library">/usr/lib</Path>
+            <Path fileType="man">/usr/share/man/man1</Path>
+            <Path fileType="man">/usr/share/man/man5/ldap.conf.5</Path>
+        </Files>
+    </Package>
+
+    <Package>
+        <Name>openldap-server</Name>
+        <IsA>service</IsA>
+        <Summary>OpenLDAP server slapd and releated tools</Summary>
+        <Description>OpenLDAP server slapd, additional backends, configuration files, schema definitions required for operation, and database maintenance tools</Description>
+        <RuntimeDependencies>
+            <Dependency>nss</Dependency>
+            <Dependency>cyrus-sasl</Dependency>
+            <Dependency>openldap-client</Dependency>
+        </RuntimeDependencies>
+        <Files>
+            <Path fileType="config">/etc/conf.d</Path>
+            <Path fileType="config">/etc/openldap</Path>
+            <Path fileType="config">/usr/lib/tmpfiles.d/openldap-server.conf</Path>
+            <Path fileType="executable">/usr/sbin</Path>
+            <Path fileType="library">/usr/libexec</Path>
+            <Path fileType="man">/usr/share/man/man3</Path>
+            <Path fileType="man">/usr/share/man/man5</Path>
+            <Path fileType="man">/usr/share/man/man8</Path>
+            <Path fileType="doc">/usr/share/doc</Path>
+            <Path fileType="data">/var/lib</Path>
+            <Path fileType="data">/run/openldap</Path>
+        </Files>
+        <AdditionalFiles>
+            <AdditionalFile owner="root" permission="0644" target="/usr/lib/tmpfiles.d/openldap-server.conf">tmpfiles.conf</AdditionalFile>
+            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/slapd">slapd.conf</AdditionalFile>
+            <AdditionalFile owner="root" permission="0755" target="/etc/openldap/ssl/gencert.sh">gencert.sh</AdditionalFile>
+        </AdditionalFiles>
+        <Provides>
+            <COMAR script="package.py">System.Package</COMAR>
+            <COMAR script="slapd.py">System.Service</COMAR>
+        </Provides>
+    </Package>
+
+    <Package>
+        <Name>openldap-32bit</Name>
+        <PartOf>emul32</PartOf>
+        <Summary>32-bit shared libraries for openldap</Summary>
+        <BuildType>emul32</BuildType>
+        <BuildDependencies>
+            <Dependency>openssl-32bit</Dependency>
+            <Dependency>libtool-ltdl-32bit</Dependency>
+        </BuildDependencies>
+        <RuntimeDependencies>
+            <Dependency>openssl-32bit</Dependency>
+            <Dependency release="current">openldap-client</Dependency>
+        </RuntimeDependencies>
+        <Files>
+            <Path fileType="library">/usr/lib32</Path>
+        </Files>
+    </Package>
+
+    <History>
+         <Update release="7">
+            <Date>2015-07-01</Date>
+            <Version>2.4.41</Version>
+            <Comment>Release bump.</Comment>
+            <Name>Ertuğrul Erata</Name>
+            <Email>ertugrulerata@gmail.com</Email>
+        </Update>
+        <Update release="6">
+            <Date>2014-05-17</Date>
+            <Version>2.4.39</Version>
+            <Comment>Release bump.</Comment>
+            <Name>Alihan Öztürk</Name>
+            <Email>alihan@pisilinux.org</Email>
+        </Update>
+        <Update release="5">
+            <Date>2014-02-03</Date>
+            <Version>2.4.39</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Marcin Bojara</Name>
+            <Email>marcin@pisilinux.org</Email>
+        </Update>
+        <Update release="4">
+            <Date>2014-01-09</Date>
+            <Version>2.4.38</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Marcin Bojara</Name>
+            <Email>marcin@pisilinux.org</Email>
+        </Update>
+        <Update release="3">
+            <Date>2013-08-20</Date>
+            <Version>2.4.33</Version>
+            <Comment>ignore cyrus</Comment>
+            <Name>Erdinç Gültekin</Name>
+            <Email>erdincgultekin@pisilinux.org</Email>
+        </Update>
+        <Update release="2">
+            <Date>2012-09-19</Date>
+            <Version>2.4.33</Version>
+            <Comment>First release</Comment>
+            <Name>PisiLinux Community</Name>
+            <Email>admins@pisilinux.org</Email>
+        </Update>
+        <Update release="1">
+            <Date>2012-09-19</Date>
+            <Version>2.4.32</Version>
+            <Comment>First release</Comment>
+            <Name>Yusuf Aydemir</Name>
+            <Email>yusuf.aydemir@pisilinux.org</Email>
+        </Update>
+    </History>
+</PISI>
@@ -0,0 +1,13 @@
+<?xml version="1.0" ?>
+<PISI>
+    <Source>
+        <Name>openldap</Name>
+        <Summary xml:lang="tr">LDAP uygulamaları ve geliştirme araçları</Summary>
+        <Description xml:lang="tr">LDAP hizmeti için gereken uygulamalar ve geliştirme araçlarını içerir</Description>
+    </Source>
+
+    <Package>
+        <Name>openldap-32bit</Name>
+        <Summary xml:lang="tr">openldap için 32-bit paylaşımlı kitaplıklar</Summary>
+    </Package>
+</PISI>