code:
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
    <Source>
        <Name>ntp</Name>
        <Homepage>http://www.ntp.org</Homepage>
        <Packager>
            <Name>PisiLinux Community</Name>
            <Email>admins@pisilinux.org</Email>
        </Packager>
        <License>MIT</License>
        <License>BSD</License>
        <License>GPLv2+</License>
        <IsA>service</IsA>
        NTP daemon and client
        <Description>Network Time Protocol utilities and daemons that will synchronize your computer's time to Coordinated Universal Time (UTC) via the NTP protocol and NTP servers.</Description>
        <Archive sha1sum="503d68cfd3e6a9354e0e28dd38b39d850b1228b2" type="targz">https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8p10.tar.gz</Archive>

        <AdditionalFiles>
            <AdditionalFile permission="0755" target="fix-man-pages">fix-man-pages.sh</AdditionalFile>
        </AdditionalFiles>
        <BuildDependencies>
            <Dependency>avahi-compat-libdns_sd-devel</Dependency>
            <Dependency>libedit-devel</Dependency>
            <Dependency>net-snmp-devel</Dependency>
            <Dependency>perl-HTML-Parser</Dependency>
            <Dependency>libcap-devel</Dependency>
            <Dependency>openssl-devel</Dependency>
            <Dependency>libevent-devel</Dependency>
        </BuildDependencies>

    </Source>

    <Package>
        <Name>ntp-server</Name>
        NTP server
        <RuntimeDependencies>
            <Dependency>avahi-compat-libdns_sd</Dependency>
            <Dependency>libedit</Dependency>
            <Dependency>net-snmp</Dependency>
            <Dependency>libcap</Dependency>
            <Dependency>openssl</Dependency>
            <Dependency>libevent</Dependency>
            <Dependency release="current">ntp-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc/ntp.conf</Path>
            <Path fileType="config">/etc/conf.d</Path>
            <Path fileType="config">/etc/ntp/crypto</Path>
            <Path fileType="executable">/usr/bin/ntpstat</Path>
            <Path fileType="executable">/usr/bin/update-leap</Path>
            <Path fileType="executable">/usr/bin/calc_tickadj</Path>
            <Path fileType="data">/usr/share/ntp/lib/NTP/Util.pm</Path>
            <Path fileType="executable">/usr/libexec</Path>
            <Path fileType="executable">/usr/sbin</Path>
            <Path fileType="doc">/usr/share/doc</Path>
            <Path fileType="man">/usr/share/man</Path>
            <Path fileType="data">/var/lib/ntp</Path>
        </Files>
        <AdditionalFiles>
            <AdditionalFile owner="root" permission="0644" target="/etc/ntp.conf">fedora/ntp.conf</AdditionalFile>
            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/ntpd">fedora/ntpd.sysconfig</AdditionalFile>
            <AdditionalFile owner="root" permission="0600" target="/etc/ntp/crypto/pw">fedora/ntp.cryptopw</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="ntp-server-package.py">System.Package</COMAR>
            <COMAR script="ntpd-service.py" name="ntpd">System.Service</COMAR>
        </Provides>
    </Package>

    <Package>
        <Name>ntp-client</Name>
        <IsA>app:console</IsA>
        <PartOf>util.admin</PartOf>
        NTP client
        <Files>
            <Path fileType="config">/etc/conf.d/ntpdate</Path>
            <Path fileType="config">/etc/ntp/step-tickers</Path>
            <Path fileType="config">/etc/ntp/keys</Path>
            <Path fileType="executable">/usr/sbin/ntpdate</Path>
            <Path fileType="man">/usr/share/man/man8/ntpdate.8*</Path>
        </Files>
        <AdditionalFiles>
            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/ntpdate">fedora/ntpdate.sysconfig</AdditionalFile>
            <AdditionalFile owner="root" permission="0644" target="/etc/ntp/step-tickers">fedora/ntp.step-tickers</AdditionalFile>
            <AdditionalFile owner="root" permission="0600" target="/etc/ntp/keys">fedora/ntp.keys</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="ntpdate-service.py" name="ntpdate">System.Service</COMAR>

            <COMAR script="ntpdate-package.py">System.Package</COMAR>
        </Provides>
    </Package>

    <Package>
        <Name>ntp-docs</Name>
        <IsA>data:doc</IsA>
        NTP documentation
        <RuntimeDependencies>
            <Dependency release="current">ntp-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="doc">/usr/share/doc/ntp/html</Path>
        </Files>
    </Package>

    <History>
        <Update release="4">
            <Date>2017-05-09</Date>
            <Version>4.2.8_p10</Version>
            <Comment>Version Bump</Comment>
            <Name>Kamil Atlı</Name>
            <Email>suvari@pisilinux.org</Email>
        </Update>
        <Update release="3">
            <Date>2016-10-27</Date>
            <Version>4.2.8_p8</Version>
            <Comment>Version Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="2">
            <Date>2016-06-08</Date>
            <Version>4.2.8_p4</Version>
            <Comment>Release Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="1">
            <Date>2016-01-01</Date>
            <Version>4.2.8_p4</Version>
            <Comment>First release</Comment>
            <Name>Stefan Gronewold</Name>
            <Email>groni@pisilinux.org</Email>
        </Update>
    </History>
</PISI>


code:
<?xml version="1.0" ?>
<PISI>
    <Source>
        <Name>ntp</Name>
        NTP hizmeti ve istemcisi
        <Description xml:lang="tr">ntp, NTP protokolü üzerinden uzak sunucuları kullanarak sisteminizin zamanını eşitlemek için gerekli araçları ve hizmetleri içerir.</Description>
    </Source>

    <Package>
        <Name>ntp-server</Name>
        NTP hizmeti
    </Package>

    <Package>
        <Name>ntp-client</Name>
        NTP istemcisi
    </Package>

    <Package>
        <Name>ntp-docs</Name>
        NTP belgeleri
    </Package>
</PISI>

repo_name: ayhanyalcinsoy/main


code:
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt

from pisi.actionsapi import get
from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools

KeepSpecial = ["libtool"]

def setup():
    pisitools.dosed(
        "include/ldap_defaults.h",
        "(#define LDAPI_SOCK).*",
        '\\1 "/run/openldap/slapd.sock"'
    )
    pisitools.dosed("servers/slapd/Makefile.in", "(\$\(DESTDIR\))\$\(localstatedir\)(\/run)", r"\1\2")

    pisitools.flags.add("-D_REENTRANT -D_GNU_SOURCE -fPIC -Wl,--as-needed -DLDAP_CONNECTIONLESS")
    #pisitools.ldflags.add("-pie")

    options = "--prefix=/usr \
               --disable-bdb \
               --disable-hdb \
               --enable-backends=mod \
               --enable-slapd \
               --enable-passwd=mod \
               --enable-dnssrv=mod \
               --enable-ldap \
               --enable-wrappers \
               --enable-meta=mod \
               --enable-monitor=mod \
               --enable-null=mod \
               --enable-shell=mod \
               --enable-rewrite \
               --enable-rlookups \
               --enable-aci \
               --enable-modules \
               --enable-cleartext \
               --enable-lmpasswd \
               --enable-spasswd \
               --enable-slapi \
               --enable-dyngroup \
               --enable-proxycache \
               --enable-perl \
               --enable-syslog \
               --enable-dynamic \
               --enable-local \
               --enable-proctitle \
               --enable-overlays=mod \
               --enable-ndb=no \
               --with-pic \
               --with-threads \
               --with-cyrus-sasl \
               --without-fetch \
               --without-threads \
               --enable-crypt \
               --enable-ipv6 \
               --enable-dynacl \
               --enable-shared \
               --disable-static \
               --disable-slp \
               --localstatedir=/var/lib"

    if get.buildTYPE() == "emul32":
        options =  " --prefix=/emul32 \
                     --libdir=/usr/lib32 \
                     --libexecdir=/emul32/libexec \
                     --disable-bdb \
                     --disable-hdb \
                     --disable-wrappers \
                     --disable-spasswd \
                     --disable-perl \
                     --without-tls \
                     --without-cyrus-sasl"
    else: options += " --with-tls=auto"

    shelltools.export("AUTOMAKE", "/bin/true")
    autotools.autoreconf("-fi")
    autotools.configure(options)

    pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ")

def build():
    autotools.make("-j1")

def install():
    if get.buildTYPE() == "emul32":
        autotools.rawInstall("DESTDIR=%s" % get.installDIR())
        return

    autotools.rawInstall("DESTDIR=%s" % get.installDIR())

    pisitools.dodir("/run/openldap")
    pisitools.dodir("/etc/openldap/ssl")

    pisitools.dodoc("ANNOUNCEMENT", "CHANGES", "COPYRIGHT", "README", "LICENSE")

    pisitools.remove("/usr/lib/*.la")
    pisitools.remove("/usr/libexec/openldap/*.la")


code:
#!/usr/bin/python

import os
import pwd
import grp

def postInstall(fromVersion, fromRelease, toVersion, toRelease):
    os.system("/bin/chown ldap:ldap /var/lib/openldap-data")
    os.system("/bin/chown ldap:ldap /var/lib/openldap-slurp")
    os.system("/bin/chown ldap:ldap /run/openldap")
    os.system("/bin/chown root:ldap /etc/openldap/slapd.conf")
    os.system("/bin/chown root:ldap /etc/openldap/slapd.conf.default")
    os.system("/bin/chmod 0700 /var/lib/openldap-data")
    os.system("/bin/chmod 0700 /var/lib/openldap-slurp")
    os.system("/bin/chmod 0755 /run/openldap")
    os.system("/bin/chmod 0640 /etc/openldap/slapd.conf")
    os.system("/bin/chmod 0640 /etc/openldap/slapd.conf.default")


code:
from comar.service import *

serviceType = "server"
serviceDesc = _({"en": "OpenLDAP Server",
                 "tr": "OpenLDAP Sunucusu"})
serviceConf = "slapd"

def start():
    import os
    os.environ["LC_ALL"] = "C"
    os.environ["LANG"] = "C"

    startService(command="/usr/libexec/slapd",
                 args="-u ldap -g ldap %s" % config.get("OPTS", ""),
                 pidfile="/run/openldap/slapd.pid",
                 donotify=True)

def stop():
    stopService(pidfile="/run/openldap/slapd.pid",
                donotify=True)

def status():
    return isServiceRunning("/run/openldap/slapd.pid")


code:
# -*- coding: utf-8 -*-
from comar.service import *

serviceType = "server"
serviceDesc = _({"en": "Slurpd Daemon",
                 "tr": "Slurpd Servisi"})

def start():
    startService(command="/usr/libexec/slurpd",
                 donotify=True)

def stop():
    stopService(command="/usr/libexec/slurpd",
                donotify=True)

def status():
    return isServiceRunning(command="/usr/libexec/slurpd")


code:
Use pkg-config for Mozilla NSS library detection

Author: Jan Vcelak <jvcelak@redhat.com>

---
 configure.in | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/configure.in b/configure.in
index ecffe30..2a9cfb4 100644
--- a/configure.in
+++ b/configure.in
@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then
 	fi
 fi

-dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3
-dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs
-dnl are not in the default system location
 if test $ol_link_tls = no ; then
 	if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then
-		have_moznss=no
-		AC_CHECK_HEADERS([nssutil.h])
-		if test "$ac_cv_header_nssutil_h" = yes ; then
-			AC_CHECK_LIB([nss3], [NSS_Initialize],
-						 [ have_moznss=yes ], [ have_moznss=no ])
-		fi
+		PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no])

-		if test "$have_moznss" = yes ; then
+		if test $have_moznss = yes ; then
 			ol_with_tls=moznss
 			ol_link_tls=yes
-			AC_DEFINE(HAVE_MOZNSS, 1,
-					  [define if you have MozNSS])
-			TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4"
-		else
-			if test $ol_with_tls = moznss ; then
-			AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)])
-			fi
+			AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS])
+			TLS_LIBS="$MOZNSS_LIBS"
+			CFLAGS="$CFLAGS $MOZNSS_CFLAGS"
 		fi
 	fi
 fi
--
1.7.11.7


code:
Implement priority/weight for DNS SRV records

From RFC 2782:

  A client MUST attempt to contact the target host with the
  lowest-numbered priority it can reach.

This patch sorts the DNS SRV records by their priority, and
additionally gives records with a larger weight a higher probability
of appearing earlier. This way, the DNS SRV records are tried in the
order of their priority.

Author: James M Leddy <james.leddy@redhat.com>
Upstream ITS: #7027
Resolves: #733078

---
 libraries/libldap/dnssrv.c |  106 ++++++++++++++++++++++++++++++++++----------
 1 files changed, 83 insertions(+), 23 deletions(-)

diff --git a/libraries/libldap/dnssrv.c b/libraries/libldap/dnssrv.c
index 16b1544..40f93b4 100644
--- a/libraries/libldap/dnssrv.c
+++ b/libraries/libldap/dnssrv.c
@@ -174,6 +174,46 @@ int ldap_domain2dn(
 	return LDAP_SUCCESS;
 }

+#ifdef HAVE_RES_QUERY
+#define DNSBUFSIZ (64*1024)
+typedef struct srv_record {
+    u_short priority;
+    u_short weight;
+    u_short port;
+    char hostname[DNSBUFSIZ];
+} srv_record;
+
+
+static int srv_cmp(const void *aa, const void *bb){
+    srv_record *a=(srv_record *)aa;
+    srv_record *b=(srv_record *)bb;
+    u_long total;
+
+    if(a->priority < b->priority) {
+	return -1;
+    }
+    if(a->priority > b->priority) {
+	return 1;
+    }
+    if(a->priority == b->priority){
+	/* targets with same priority are in psudeo random order */
+	if (a->weight == 0 && b->weight == 0) {
+	    if (rand() % 2) {
+		return -1;
+	    } else {
+		return 1;
+	    }
+	}
+	total = a->weight + b->weight;
+	if (rand() % total < a->weight) {
+	    return -1;
+	} else {
+	    return 1;
+	}
+    }
+}
+#endif /* HAVE_RES_QUERY */
+
 /*
  * Lookup and return LDAP servers for domain (using the DNS
  * SRV record _ldap._tcp.domain).
@@ -183,15 +223,16 @@ int ldap_domain2hostlist(
 	char **list )
 {
 #ifdef HAVE_RES_QUERY
-#define DNSBUFSIZ (64*1024)
-    char *request;
-    char *hostlist = NULL;
+    char *request;
+   char *hostlist = NULL;
+    srv_record *hostent_head=NULL;
+    int i;
     int rc, len, cur = 0;
     unsigned char reply[DNSBUFSIZ];
+    int hostent_count=0;

 	assert( domain != NULL );
 	assert( list != NULL );
-
 	if( *domain == '\0' ) {
 		return LDAP_PARAM_ERROR;
 	}
@@ -223,8 +264,7 @@ int ldap_domain2hostlist(
 	unsigned char *p;
 	char host[DNSBUFSIZ];
 	int status;
-	u_short port;
-	/* int priority, weight; */
+	u_short port, priority, weight;

 	/* Parse out query */
 	p = reply;
@@ -263,40 +303,56 @@ int ldap_domain2hostlist(
 	    size = (p[0] << 8) | p[1];
 	    p += 2;
 	    if (type == T_SRV) {
-		int buflen;
 		status = dn_expand(reply, reply + len, p + 6, host, sizeof(host));
 		if (status < 0) {
 		    goto out;
 		}
-		/* ignore priority and weight for now */
-		/* priority = (p[0] << 8) | p[1]; */
-		/* weight = (p[2] << 8) | p[3]; */
+
+		/* Get priority weight and port */
+		priority = (p[0] << 8) | p[1];
+		weight = (p[2] << 8) | p[3];
 		port = (p[4] << 8) | p[5];

 		if ( port == 0 || host[ 0 ] == '\0' ) {
 		    goto add_size;
 		}

-		buflen = strlen(host) + STRLENOF(":65355 ");
-		hostlist = (char *) LDAP_REALLOC(hostlist, cur + buflen + 1);
-		if (hostlist == NULL) {
-		    rc = LDAP_NO_MEMORY;
-		    goto out;
+		hostent_head = (srv_record *) LDAP_REALLOC(hostent_head, (hostent_count+1)*(sizeof(srv_record)));
+		if(hostent_head==NULL){
+		  rc=LDAP_NO_MEMORY;
+		  goto out;
+
 		}
-		if (cur > 0) {
-		    /* not first time around */
-		    hostlist[cur++] = ' ';
-		}
-		cur += sprintf(&hostlist[cur], "%s:%hu", host, port);
+		hostent_head[hostent_count].priority=priority;
+		hostent_head[hostent_count].weight=weight;
+		hostent_head[hostent_count].port=port;
+		strncpy(hostent_head[hostent_count].hostname, host,255);
+		hostent_count=hostent_count+1;
 	    }
 add_size:;
 	    p += size;
 	}
     }
+    qsort(hostent_head, hostent_count, sizeof(srv_record), srv_cmp);
+
+    for(i=0; i<hostent_count; i++){
+	int buflen;
+        buflen = strlen(hostent_head[i].hostname) + STRLENOF(":65355" );
+        hostlist = (char *) LDAP_REALLOC(hostlist, cur+buflen+1);
+        if (hostlist == NULL) {
+            rc = LDAP_NO_MEMORY;
+            goto out;
+        }
+        if(cur>0){
+            hostlist[cur++]=' ';
+        }
+        cur += sprintf(&hostlist[cur], "%s:%hd", hostent_head[i].hostname, hostent_head[i].port);
+    }
+
     if (hostlist == NULL) {
-	/* No LDAP servers found in DNS. */
-	rc = LDAP_UNAVAILABLE;
-	goto out;
+         /* No LDAP servers found in DNS. */
+         rc = LDAP_UNAVAILABLE;
+         goto out;
     }

     rc = LDAP_SUCCESS;
@@ -308,8 +364,12 @@ add_size:;
     if (request != NULL) {
 	LDAP_FREE(request);
     }
+    if (hostent_head != NULL) {
+	LDAP_FREE(hostent_head);
+    }
     if (rc != LDAP_SUCCESS && hostlist != NULL) {
 	LDAP_FREE(hostlist);
+
     }
     return rc;
 #else
--
1.7.6


code:
From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 7 May 2013 17:02:57 +0200
Subject: [PATCH] LDAPI SASL fix

Resolves: #960222
---
 libraries/libldap/cyrus.c | 19 ++++++++++++++++---
 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-)

diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
index 28c241b..a9acf36 100644
--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
@@ -394,6 +394,8 @@ ldap_int_sasl_bind(
 	struct berval	ccred = BER_BVNULL;
 	int saslrc, rc;
 	unsigned credlen;
+	char my_hostname[HOST_NAME_MAX + 1];
+	int free_saslhost = 0;

 	Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n",
 		mechs ? mechs : "<null>", 0, 0 );
@@ -454,14 +456,25 @@ ldap_int_sasl_bind(

 			/* If we don't need to canonicalize just use the host
 			 * from the LDAP URI.
+			 * Always use the result of gethostname() for LDAPI.
 			 */
-			if ( nocanon )
+			if (ld->ld_defconn->lconn_server->lud_scheme != NULL &&
+			    strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) {
+				rc = gethostname(my_hostname, HOST_NAME_MAX + 1);
+				if (rc == 0) {
+					saslhost = my_hostname;
+				} else {
+					saslhost = "localhost";
+				}
+			} else if ( nocanon )
 				saslhost = ld->ld_defconn->lconn_server->lud_host;
-			else
+			else {
 				saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb,
 				"localhost" );
+				free_saslhost = 1;
+			}
 			rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost );
-			if ( !nocanon )
+			if ( free_saslhost )
 				LDAP_FREE( saslhost );
 		}

--
1.7.11.7


code:
Disables opening of ldaprc file in current directory.

Resolves: #38402
Upstream: ITS #1131
Author: Henning Schmiedehausen <hps@intermeta.de>

diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index 8617527..e6b17b4 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -352,9 +352,6 @@ static void openldap_ldap_init_w_userconf(const char *file)
 	if(path != NULL) {
 		LDAP_FREE(path);
 	}
-
-	/* try file */
-	openldap_ldap_init_w_conf(file, 1);
 }

 static void openldap_ldap_init_w_env(


code:
MozNSS: load certificates from certdb, fallback to PEM

If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS
certificate database, the backend assumed that the certificate is always
located in the certificate database. This assumption might be wrong.

This patch makes the library to try to load the certificate from NSS
database and fallback to PEM file if unsuccessfull.

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7389
Resolves: #857455

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 6847bea..8339391 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx )
 	/* prefer unlocked key, then key from opened certdb, then any other */
 	if ( unlocked_key )
 		ctx->tc_private_key = unlocked_key;
-	else if ( ctx->tc_certdb_slot )
+	else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem )
 		ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg );
 	else
 		ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg );
@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg )
 				}
 				return -1;
 			}
-
-			ctx->tc_using_pem = PR_TRUE;
 		}

 		NSS_SetDomesticPolicy();
@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg )

 	/* set up our cert and key, if any */
 	if ( lt->lt_certfile ) {
-		/* if using the PEM module, load the PEM file specified by lt_certfile */
-		/* otherwise, assume this is the name of a cert already in the db */
-		if ( ctx->tc_using_pem ) {
-			/* this sets ctx->tc_certificate to the correct value */
-			int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE );
-			if ( rc ) {
-				return rc;
-			}
-		} else {
+
+		/* first search in certdb (lt_certfile is nickname) */
+		if ( ctx->tc_certdb ) {
 			char *tmp_certname;

 			if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) {
@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg )
 				Debug( LDAP_DEBUG_ANY,
 					   "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n",
 					   lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+			}
+		}
+
+		/* fallback to PEM module (lt_certfile is filename) */
+		if ( !ctx->tc_certificate ) {
+			if ( !pem_module && tlsm_init_pem_module() ) {
+				int pem_errcode = PORT_GetError();
+				Debug( LDAP_DEBUG_ANY,
+					   "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n",
+					   pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
 				return -1;
 			}
+
+			/* this sets ctx->tc_certificate to the correct value */
+			if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) {
+				ctx->tc_using_pem = PR_TRUE;
+			}
+		}
+
+		if ( ctx->tc_certificate ) {
+			Debug( LDAP_DEBUG_ANY,
+				   "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile,
+				   ctx->tc_using_pem ? "PEM file" : "moznss database", 0);
+		} else {
+			return -1;
 		}
 	}


code:
MozNSS: ignore certdb database type prefix when checking existence of the directory

If the certdb is specified including the database type prefix (e.g.
sql:, dbm:), the prefix has to be ignored when checking the
certificate directory existence.

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7388
Resolves: #857373

---
 libraries/libldap/tls_m.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 49a3f8f..5ee21a2 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
 {
 	char sep = PR_GetDirectorySeparator();
 	char *ptr = NULL;
+	char *chkpath = NULL;
 	struct PRFileInfo prfi;
 	PRStatus prc;

@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
 		return;
 	}

-	prc = PR_GetFileInfo( certdir, &prfi );
+	/* ignore database type prefix (e.g. sql:, dbm:) if provided */
+	chkpath = strchr( certdir, ':' );
+	if ( chkpath != NULL ) {
+		chkpath += 1;
+	} else {
+		chkpath = certdir;
+	}
+
 	/* if certdir exists (file or directory) then it cannot specify a prefix */
+	prc = PR_GetFileInfo( chkpath, &prfi );
 	if ( prc == PR_SUCCESS ) {
 		return;
 	}
--
1.7.11.7


code:
Resolves: #929357

From 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Thu, 28 Mar 2013 19:05:02 -0600
Subject: [PATCH] must call PK11_FreeSlot after SECMOD_CloseUserDB to remove ref to slot

---
 libraries/libldap/tls_m.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 072d41d..c59d303 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -2063,6 +2063,8 @@ tlsm_ctx_free ( tls_ctx *ctx )
 				   "TLS: could not close certdb slot - error %d:%s.\n",
 				   errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
 		}
+		PK11_FreeSlot( c->tc_certdb_slot );
+		c->tc_certdb_slot = NULL;
 	}
 	PL_strfree( c->tc_pin_file );
 	c->tc_pin_file = NULL;
--
1.7.1


code:
MozNSS: better file name matching for hashed CA  certificate directory

CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name
should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used
to differentiate between two certificates with the same subject name.

Wit this patch, certificate file names are matched correctly (using regular expressions).

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7374
Resolves: #852786

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 5e49fc5..61d71d4 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -38,6 +38,7 @@
 #include <ac/unistd.h>
 #include <ac/param.h>
 #include <ac/dirent.h>
+#include <ac/regex.h>

 #include "ldap-int.h"
 #include "ldap-tls.h"
@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods;

 #define PEM_LIBRARY	"nsspem"
 #define PEM_MODULE	"PEM"
-/* hash files for use with cacertdir have this file name suffix */
-#define PEM_CA_HASH_FILE_SUFFIX	".0"
-#define PEM_CA_HASH_FILE_SUFFIX_LEN 2
+#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$"

 static SECMODModule *pem_module;

@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
 		PRDir *dir;
 		PRDirEntry *entry;
 		PRStatus fistatus = PR_FAILURE;
+		regex_t hashfile_re;

 		memset( &fi, 0, sizeof(fi) );
 		fistatus = PR_GetFileInfo( cacertdir, &fi );
@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
 			goto done;
 		}

+		if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) {
+			Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 );
+			goto done;
+		}
+
 		do {
 			entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN );
 			if ( ( NULL != entry ) && ( NULL != entry->name ) ) {
 				char *fullpath = NULL;
-				char *ptr;
+				int match;

-				ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX );
-				if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) {
+				match = regexec( &hashfile_re, entry->name, 0, NULL, 0 );
+				if ( match == REG_NOMATCH ) {
 					Debug( LDAP_DEBUG_TRACE,
-						   "TLS: file %s does not end in [%s] - does not appear to be a CA certificate "
-						   "directory file with a properly hashed file name - skipping.\n",
-						   entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 );
+						   "TLS: skipping '%s' - filename does not have expected format "
+						   "(certificate hash with numeric suffix)\n", entry->name, 0, 0 );
+					continue;
+				} else if ( match != 0 ) {
+					Debug( LDAP_DEBUG_ANY,
+						   "TLS: cannot execute regex for CA hash file matching (%d).\n",
+						   match, 0, 0 );
 					continue;
 				}
+
 				fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name );
 				if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) {
 					Debug( LDAP_DEBUG_TRACE,
@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
 				PR_smprintf_free( fullpath );
 			}
 		} while ( NULL != entry );
+		regfree ( &hashfile_re );
 		PR_CloseDir( dir );
 	}
 done:
--
1.7.11.4


code:
MozNSS: update list of supported cipher suites

The updated list includes all ciphers implemented in Mozilla NSS 3.13.15

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7374

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 1422ce2..5e49fc5 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -211,27 +211,34 @@ typedef struct {
 	int num;            /* The cipher id */
 	int attr;           /* cipher attributes: algorithms, etc */
 	int version;        /* protocol version valid for this cipher */
-	int bits;           /* bits of strength */
-	int alg_bits;       /* bits of the algorithm */
 	int strength;       /* LOW, MEDIUM, HIGH */
 	int enabled;        /* Enabled by default? */
 } cipher_properties;

 /* cipher attributes  */
-#define SSL_kRSA  0x00000001L
-#define SSL_aRSA  0x00000002L
-#define SSL_aDSS  0x00000004L
-#define SSL_DSS   SSL_aDSS
-#define SSL_eNULL 0x00000008L
-#define SSL_DES   0x00000010L
-#define SSL_3DES  0x00000020L
-#define SSL_RC4   0x00000040L
-#define SSL_RC2   0x00000080L
-#define SSL_AES   0x00000100L
-#define SSL_MD5   0x00000200L
-#define SSL_SHA1  0x00000400L
-#define SSL_SHA   SSL_SHA1
-#define SSL_RSA   (SSL_kRSA|SSL_aRSA)
+#define SSL_kRSA        0x00000001L
+#define SSL_aRSA        0x00000002L
+#define SSL_RSA         (SSL_kRSA|SSL_aRSA)
+#define SSL_aDSA        0x00000004L
+#define SSL_DSA         SSL_aDSA
+#define SSL_eNULL       0x00000008L
+#define SSL_DES         0x00000010L
+#define SSL_3DES        0x00000020L
+#define SSL_RC4         0x00000040L
+#define SSL_RC2         0x00000080L
+#define SSL_AES128      0x00000100L
+#define SSL_AES256      0x00000200L
+#define SSL_AES         (SSL_AES128|SSL_AES256)
+#define SSL_MD5         0x00000400L
+#define SSL_SHA1        0x00000800L
+#define SSL_kEDH        0x00001000L
+#define SSL_CAMELLIA128 0x00002000L
+#define SSL_CAMELLIA256 0x00004000L
+#define SSL_CAMELLIA    (SSL_CAMELLIA128|SSL_CAMELLIA256)
+#define SSL_SEED        0x00008000L
+#define SSL_kECDH       0x00010000L
+#define SSL_kECDHE      0x00020000L
+#define SSL_aECDSA      0x00040000L

 /* cipher strength */
 #define SSL_NULL      0x00000001L
@@ -248,29 +255,70 @@ typedef struct {

 /* Cipher translation */
 static cipher_properties ciphers_def[] = {
-	/* SSL 2 ciphers */
-	{"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED},
-	{"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED},
-	{"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
-	{"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
-
-	/* SSL3 ciphers */
-	{"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED},
-	{"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED},
-	{"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
-	{"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED},
-	{"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
-	{"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
+
+	/*
+	 * Use the same DEFAULT cipher list as OpenSSL, which is defined as: ALL:!aNULL:!eNULL:!SSLv2
+	 */
+
+	/* SSLv2 ciphers */
+	{"DES-CBC-MD5",     SSL_EN_DES_64_CBC_WITH_MD5,           SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5,  SSL2, SSL_LOW,      SSL_NOT_ALLOWED},
+	{"DES-CBC3-MD5",    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,     SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH,     SSL_NOT_ALLOWED},
+	{"RC2-CBC-MD5",     SSL_EN_RC2_128_CBC_WITH_MD5,          SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,  SSL2, SSL_MEDIUM,   SSL_NOT_ALLOWED},
+	{"RC4-MD5",         SSL_EN_RC4_128_WITH_MD5,              SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,  SSL2, SSL_MEDIUM,   SSL_NOT_ALLOWED},
+	{"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,  SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
+	{"EXP-RC4-MD5",     SSL_EN_RC4_128_EXPORT40_WITH_MD5,     SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,  SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
+
+	/* SSLv3 ciphers */
+	{"NULL-MD5",             SSL_RSA_WITH_NULL_MD5,              SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5,  SSL3, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"NULL-SHA",             SSL_RSA_WITH_NULL_SHA,              SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"DES-CBC-SHA",          SSL_RSA_WITH_DES_CBC_SHA,           SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"DES-CBC3-SHA",         SSL_RSA_WITH_3DES_EDE_CBC_SHA,      SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+	{"RC4-MD5",              SSL_RSA_WITH_RC4_128_MD5,           SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,    SSL3, SSL_MEDIUM,   SSL_ALLOWED},
+	{"RC4-SHA",              SSL_RSA_WITH_RC4_128_SHA,           SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1,   SSL3, SSL_MEDIUM,   SSL_ALLOWED},
+	{"EXP-RC2-CBC-MD5",      SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,    SSL3, SSL_EXPORT40, SSL_ALLOWED},
+	{"EXP-RC4-MD5",          SSL_RSA_EXPORT_WITH_RC4_40_MD5,     SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,    SSL3, SSL_EXPORT40, SSL_ALLOWED},
+	{"EDH-RSA-DES-CBC-SHA",  SSL_DHE_RSA_WITH_DES_CBC_SHA,       SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"EDH-RSA-DES-CBC3-SHA", SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,  SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+	{"EDH-DSS-DES-CBC-SHA",  SSL_DHE_DSS_WITH_DES_CBC_SHA,       SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"EDH-DSS-DES-CBC3-SHA", SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,  SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},

 	/* TLSv1 ciphers */
-	{"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
-	{"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
-	{"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED},
-	{"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED},
+	{"EXP1024-DES-CBC-SHA",      TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,   SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1,         TLS1, SSL_EXPORT56, SSL_ALLOWED},
+	{"EXP1024-RC4-SHA",          TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,    SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1,         TLS1, SSL_EXPORT56, SSL_ALLOWED},
+	{"SEED-SHA",                 TLS_RSA_WITH_SEED_CBC_SHA,             SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1,        TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"AES128-SHA",               TLS_RSA_WITH_AES_128_CBC_SHA,          SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"AES256-SHA",               TLS_RSA_WITH_AES_256_CBC_SHA,          SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"CAMELLIA256-SHA",          TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,     SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"CAMELLIA128-SHA",          TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,     SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-AES128-SHA",       TLS_DHE_RSA_WITH_AES_128_CBC_SHA,      SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-AES256-SHA",       TLS_DHE_RSA_WITH_AES_256_CBC_SHA,      SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-CAMELLIA128-SHA",  TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-CAMELLIA256-SHA",  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-RC4-SHA",          TLS_DHE_DSS_WITH_RC4_128_SHA,          SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1,         TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"DHE-DSS-AES128-SHA",       TLS_DHE_DSS_WITH_AES_128_CBC_SHA,      SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-AES256-SHA",       TLS_DHE_DSS_WITH_AES_256_CBC_SHA,      SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-CAMELLIA128-SHA",  TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-CAMELLIA256-SHA",  TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-NULL-SHA",        TLS_ECDH_RSA_WITH_NULL_SHA,            SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1,      TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDH-RSA-RC4-SHA",         TLS_ECDH_RSA_WITH_RC4_128_SHA,         SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1,        TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDH-RSA-DES-CBC3-SHA",    TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1,       TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-AES128-SHA",      TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,     SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-AES256-SHA",      TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,     SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-NULL-SHA",      TLS_ECDH_ECDSA_WITH_NULL_SHA,          SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1,    TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDH-ECDSA-RC4-SHA",       TLS_ECDH_ECDSA_WITH_RC4_128_SHA,       SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1,      TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDH-ECDSA-DES-CBC3-SHA",  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,  SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-AES128-SHA",    TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,   SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1,   TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-AES256-SHA",    TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,   SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1,   TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-NULL-SHA",       TLS_ECDHE_RSA_WITH_NULL_SHA,           SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1,     TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDHE-RSA-RC4-SHA",        TLS_ECDHE_RSA_WITH_RC4_128_SHA,        SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1,       TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDHE-RSA-DES-CBC3-SHA",   TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,   SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-AES128-SHA",     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,    SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-AES256-SHA",     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,    SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-NULL-SHA",     TLS_ECDHE_ECDSA_WITH_NULL_SHA,         SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1,   TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDHE-ECDSA-RC4-SHA",      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,      SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1,     TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-AES128-SHA",   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,  SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1,  TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-AES256-SHA",   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,  SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1,  TLS1, SSL_HIGH,     SSL_ALLOWED},
 };

 #define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties))
@@ -577,6 +625,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
 					mask |= SSL_RSA;
 				} else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) {
 					mask |= SSL_eNULL;
+				} else if (!strcmp(cipher, "AES128")) {
+					mask |= SSL_AES128;
+				} else if (!strcmp(cipher, "AES256")) {
+					mask |= SSL_AES256;
 				} else if (!strcmp(cipher, "AES")) {
 					mask |= SSL_AES;
 				} else if (!strcmp(cipher, "3DES")) {
@@ -591,6 +643,24 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
 					mask |= SSL_MD5;
 				} else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) {
 					mask |= SSL_SHA1;
+				} else if (!strcmp(cipher, "EDH")) {
+					mask |= SSL_kEDH;
+				} else if (!strcmp(cipher, "DSS")) {
+					mask |= SSL_aDSA;
+				} else if (!strcmp(cipher, "CAMELLIA128")) {
+					mask |= SSL_CAMELLIA128;
+				} else if (!strcmp(cipher, "CAMELLIA256")) {
+					mask |= SSL_CAMELLIA256;
+				} else if (!strcmp(cipher, "CAMELLIA")) {
+					mask |= SSL_CAMELLIA;
+				} else if (!strcmp(cipher, "SEED")) {
+					mask |= SSL_SEED;
+				} else if (!strcmp(cipher, "ECDH")) {
+					mask |= SSL_kECDH;
+				} else if (!strcmp(cipher, "ECDHE")) {
+					mask |= SSL_kECDHE;
+				} else if (!strcmp(cipher, "ECDSA")) {
+					mask |= SSL_aECDSA;
 				} else if (!strcmp(cipher, "SSLv2")) {
 					protocol |= SSL2;
 				} else if (!strcmp(cipher, "SSLv3")) {
--
1.7.11.4


code:
The non-reentrant gethostbyXXXX() functions deadlock if called recursively, for
example if libldap needs to be initialized from within gethostbyXXXX() (which
actually happens if nss_ldap is used for hostname resolution and earlier
modules can't resolve the local host name), so use the reentrant versions of
the functions, even if we're not being compiled for use in libldap_r

Resolves: #179730
Author: Jeffery Layton <jlayton@redhat.com>

diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c
index 373c81c..a012062 100644
--- a/libraries/libldap/util-int.c
+++ b/libraries/libldap/util-int.c
@@ -52,8 +52,8 @@ extern int h_errno;
 #ifndef LDAP_R_COMPILE
 # undef HAVE_REENTRANT_FUNCTIONS
 # undef HAVE_CTIME_R
-# undef HAVE_GETHOSTBYNAME_R
-# undef HAVE_GETHOSTBYADDR_R
+/* # undef HAVE_GETHOSTBYNAME_R */
+/* # undef HAVE_GETHOSTBYADDR_R */

 #else
 # include <ldap_pvt_thread.h>
@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod)
 #define BUFSTART (1024-32)
 #define BUFMAX (32*1024-32)

-#if defined(LDAP_R_COMPILE)
+#if defined(LDAP_R_COMPILE) || defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R)
 static char *safe_realloc( char **buf, int len );

 #if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R))


code:
Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package
independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.)

--- openldap-2.4.24.orig/build/top.mk
+++ openldap-2.4.24/build/top.mk
@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@
 SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@
 SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@

-SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)
+SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)

 # Our Defaults
 CC = $(AC_CC)


code:
From: Jan-Marek Glogowski <jan-marek.glogowski@muenchen.de>
Date: Tue, 18 May 2010 17:47:05 +0200
Subject: [PATCH] Switch to lt_dlopenadvise() to get RTLD_GLOBAL set.

Proof of concept for fixing http://bugs.debian.org/327585
(patch ported from freeradius bug http://bugs.debian.org/416266)

Resolves: #960048
---
--- openldap/servers/slapd/module.c.orig	2010-05-18 17:42:04.000000000 +0200
+++ openldap/servers/slapd/module.c	2010-05-18 17:45:46.000000000 +0200
@@ -117,6 +117,20 @@
 	return -1;	/* not found */
 }

+static lt_dlhandle slapd_lt_dlopenext_global( const char *filename )
+{
+	lt_dlhandle handle = 0;
+	lt_dladvise advise;
+
+	if (!lt_dladvise_init (&advise) && !lt_dladvise_ext (&advise)
+			&& !lt_dladvise_global (&advise))
+		handle = lt_dlopenadvise (filename, advise);
+
+	lt_dladvise_destroy (&advise);
+
+	return handle;
+}
+
 int module_load(const char* file_name, int argc, char *argv[])
 {
 	module_loaded_t *module;
@@ -180,7 +194,7 @@
 	 * to calling Debug. This is because Debug is a macro that expands
 	 * into multiple function calls.
 	 */
-	if ((module->lib = lt_dlopenext(file)) == NULL) {
+	if ((module->lib = slapd_lt_dlopenext_global(file)) == NULL) {
 		error = lt_dlerror();
 #ifdef HAVE_EBCDIC
 		strcpy( ebuf, error );


code:
allow unsetting of tls_* syncrepl options

Author: Patrick Monnerat <pm@datasphere.ch>
Upstream ITS: #7042
Resolves: #734187

diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 654a4bf..10b993b 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -735,27 +735,27 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 		return 0;
 	case LDAP_OPT_X_TLS_CACERTFILE:
 		if ( lo->ldo_tls_cacertfile ) LDAP_FREE( lo->ldo_tls_cacertfile );
-		lo->ldo_tls_cacertfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_cacertfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_CACERTDIR:
 		if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir );
-		lo->ldo_tls_cacertdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_cacertdir = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_CERTFILE:
 		if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile );
-		lo->ldo_tls_certfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_certfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_KEYFILE:
 		if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile );
-		lo->ldo_tls_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_keyfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_DHFILE:
 		if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile );
-		lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_dhfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_CRLFILE:	/* GnuTLS only */
 		if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile );
-		lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_crlfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_REQUIRE_CERT:
 		if ( !arg ) return -1;
@@ -783,7 +783,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 #endif
 	case LDAP_OPT_X_TLS_CIPHER_SUITE:
 		if ( lo->ldo_tls_ciphersuite ) LDAP_FREE( lo->ldo_tls_ciphersuite );
-		lo->ldo_tls_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_ciphersuite = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;

 	case LDAP_OPT_X_TLS_PROTOCOL_MIN:
@@ -794,7 +794,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 		if ( ld != NULL )
 			return -1;
 		if ( lo->ldo_tls_randfile ) LDAP_FREE (lo->ldo_tls_randfile );
-		lo->ldo_tls_randfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_randfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		break;
 	case LDAP_OPT_X_TLS_NEWCTX:
 		if ( !arg ) return -1;


code:
TLS: do not reuse tls_session if hostname check fails

If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails,
*tls_session is not dropped, but reused when connecting to the second server.

This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor.
From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling.

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7373
Resolves: #852476

diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 10b993b..a3cd590 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc )
  */

 static int
-ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
+ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
 {
 	Sockbuf *sb = conn->lconn_sb;
 	int	err;
@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
 	errno = WSAGetLastError();
 #endif

+	if ( err == 0 ) {
+		err = ldap_pvt_tls_check_hostname( ld, ssl, host );
+	}
+
 	if ( err < 0 )
 	{
 		char buf[256], *msg;
@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in )
 {
 	tls_session *session = s;

-	return tls_imp->ti_session_chkhost( ld, session, name_in );
+	if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
+	    ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
+		ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in );
+		if (ld->ld_errno != LDAP_SUCCESS) {
+			return ld->ld_errno;
+		}
+	}
+
+	return LDAP_SUCCESS;
 }

 int
@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 #endif /* LDAP_USE_NON_BLOCKING_TLS */

 	ld->ld_errno = LDAP_SUCCESS;
-	ret = ldap_int_tls_connect( ld, conn );
+	ret = ldap_int_tls_connect( ld, conn, host );

 #ifdef LDAP_USE_NON_BLOCKING_TLS
 	while ( ret > 0 ) { /* this should only happen for non-blocking io */
@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 		} else {
 			/* ldap_int_poll called ldap_pvt_ndelay_off */
 			ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb );
-			ret = ldap_int_tls_connect( ld, conn );
+			ret = ldap_int_tls_connect( ld, conn, host );
 			if ( ret > 0 ) { /* need to call tls_connect once more */
 				struct timeval curr_time_tv, delta_tv;

@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 		return (ld->ld_errno);
 	}

-	ssl = ldap_pvt_tls_sb_ctx( sb );
-	assert( ssl != NULL );
-
-	/*
-	 * compare host with name(s) in certificate
-	 */
-	if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
-	    ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
-		ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host );
-		if (ld->ld_errno != LDAP_SUCCESS) {
-			return ld->ld_errno;
-		}
-	}
-
 	return LDAP_SUCCESS;
 }


code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<title>openldap.git - openldap</title>
<meta name='generator' content='cgit v0.9.2'/>
<meta name='robots' content='index, nofollow'/>
<link rel='stylesheet' type='text/css' href='/cgit-data/cgit.css'/>
<link rel='alternate' title='Atom feed' href='http://pkgs.fedoraproject.org/cgit/openldap.git/atom/openldap-userconfig-setgid.patch?h=master' type='application/atom+xml'/>

index : openldap.git	<form method='get' action=''>
<select name='h' onchange='this.form.submit();'>
<option value='FC-4-split'>FC-4-split</option>
<option value='f10'>f10</option>
<option value='f11'>f11</option>
<option value='f12'>f12</option>
<option value='f13'>f13</option>
<option value='f14'>f14</option>
<option value='f15'>f15</option>
<option value='f16'>f16</option>
<option value='f17'>f17</option>
<option value='f18'>f18</option>
<option value='f19'>f19</option>
<option value='f20'>f20</option>
<option value='f7'>f7</option>
<option value='f8'>f8</option>
<option value='f9'>f9</option>
<option value='master' selected='selected'>master</option>
<option value='private-moznss-f17'>private-moznss-f17</option>
</select> <input type='submit' name='' value='switch'/></form>

openldap	Jesse Keating

summaryrefslogtreecommitdiffstats	<form class='right' method='get' action='/cgit/openldap.git/log/openldap-userconfig-setgid.patch'>
<select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='text' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>

path: root/openldap-userconfig-setgid.patch

blob: 70f0d28ecab7c4152aa414adde93e462179ba0f8 (plain)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Normally, skips reading of user configuration file when running with different effective UID.
This patch adds the same behavior for GID.

Author: Nalin Dahyabhai <nalin@redhat.com>

diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index e6b17b4..fbf4829 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -678,7 +678,7 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl )
 	openldap_ldap_init_w_sysconf(LDAP_CONF_FILE);

 #ifdef HAVE_GETEUID
-	if ( geteuid() != getuid() )
+	if ( geteuid() != getuid() || getegid() != getgid() )
 		return;
 #endif

generated  by cgit v0.9.2 at 2014-01-09 14:22:50 (GMT)


code:
#!/bin/sh
# Last update 20050401 - Christian Zoffoli <xmerlin@gentoo.org>

VERSION="0.3"
openssl="/usr/bin/openssl"
opensslopts=""
ldapconfdir="/etc/openldap/ssl"
pemfile="${ldapconfdir}/ldap.pem"
randfile="${ldapconfdir}/ldap.rand"
cfgfile="${ldapconfdir}/ldap.cfg"

function fixperms {
	chown root:ldap ${ldapconfdir} -R
	find ${ldapconfdir} -type f -exec chmod 640 \{\} \;
	chmod 750 ${ldapconfdir}
}

if [ ! -x ${openssl} ]; then
	exit 0
fi

if [ ! -d ${ldapconfdir} ]; then
	mkdir -p ${ldapconfdir}
fi

fixperms

if [ -f ${pemfile} ]; then
	echo "${pemfile} already exist, dying"
	exit 0
fi

dd if=/dev/urandom of=$randfile count=1 2>/dev/null

echo ""
echo "______________________________________________________________________${T_ME}"
echo ""
echo "Creating self-signed certificate -- Version ${VERSION}"
echo ""
echo "______________________________________________________________________${T_ME}"
echo ""

COMMONNAME=`hostname`
if [ ! -n "$COMMONNAME" ]; then
	COMMONNAME="www.openldap.org"
fi

if [ -f ${cfgfile} ]; then
	echo "${cfgfile} found, would you like to use it ? (y/n)"
	read answer

	case "$answer" in
		y|Y)
			opensslopts="-batch"
		;;
		n|N)
			cat >${cfgfile} <<EOT
			[ req ]
			default_bits                    = 1024
			distinguished_name              = req_DN
			RANDFILE                        = ${randfile}
			[ req_DN ]
			countryName                     = "1. Country Name             (2 letter code)"
			countryName_default             = "US"
			countryName_min			= 2
			countryName_max			= 2
			stateOrProvinceName		= "2. State or Province Name   (full name)    "
			stateOrProvinceName_default	= ""
			localityName                    = "3. Locality Name            (eg, city)     "
			localityName_default		= ""
			0.organizationName		= "4. Organization Name        (eg, company)  "
			0.organizationName_default	= "LDAP Server"
			organizationalUnitName		= "5. Organizational Unit Name (eg, section)  "
			organizationalUnitName_default	= "For testing purposes only"
			commonName			= "6. Common Name              (eg, CA name)  "
			commonName_max			= 64
			commonName_default		= "${COMMONNAME}"
			emailAddress			= "7. Email Address            (eg, name@FQDN)"
			emailAddress_max		= 40
			emailAddress_default		= ""
EOT
		;;
		*)
			echo "Wrong answer, retry!"
			exit 1
		;;
	esac
fi

echo ""

${openssl} req -config ${cfgfile} ${opensslopts} -new -rand ${randfile} -x509 -nodes -out ${pemfile} -keyout ${pemfile} -days 999999

if [ $? -ne 0 ]; then
	echo "cca:Error: Failed to generate certificate " 1>&2
	exit 1
else
	echo -e "\nCertificate creation done!"
fi

if [ -f ${randfile} ]; then
	rm -f ${randfile}
fi

if [ -f ${pemfile} ]; then
	fixperms
fi


code:
Submitted By:            Armin K. <krejzi at email dot com>
Date:                    2012-04-06
Initial Package Version: 2.4.30
Upstream Status:         BLFS Specific
Origin:                  Self
Description:             Patch changes various installation options, such as ldap database path,
                         configuration file options, slapd install location, etc.

--- openldap.orig/doc/man/man5/slapd-bdb.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd-bdb.5	2012-04-06 00:18:54.171136608 +0200
@@ -131,7 +131,7 @@
 associated indexes live.
 A separate directory must be specified for each database.
 The default is
-.BR LOCALSTATEDIR/openldap\-data .
+.BR LOCALSTATEDIR/lib/openldap .
 .TP
 .B dirtyread
 Allow reads of modified but not yet committed data.
--- openldap.orig/doc/man/man5/slapd.conf.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd.conf.5	2012-04-06 00:18:54.174136671 +0200
@@ -1987,7 +1987,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-directory LOCALSTATEDIR/openldap\-data
+directory LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 index     objectClass  eq
 index     cn,sn,mail   pres,eq,approx,sub
--- openldap.orig/doc/man/man5/slapd-config.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd-config.5	2012-04-06 00:18:54.194137078 +0200
@@ -2029,7 +2029,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-olcDbDirectory: LOCALSTATEDIR/openldap\-data
+olcDbDirectory: LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 olcDbIndex:     objectClass  eq
 olcDbIndex:     cn,sn,mail   pres,eq,approx,sub
--- openldap.orig/include/ldap_defaults.h	2012-02-29 18:37:09.000000000 +0100
+++ openldap/include/ldap_defaults.h	2012-04-06 00:18:54.200137199 +0200
@@ -39,7 +39,7 @@
 #define LDAP_ENV_PREFIX "LDAP"

 /* default ldapi:// socket */
-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"
+#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"

 /*
  * SLAPD DEFINITIONS
@@ -47,7 +47,7 @@
 	/* location of the default slapd config file */
 #define SLAPD_DEFAULT_CONFIGFILE	LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf"
 #define SLAPD_DEFAULT_CONFIGDIR		LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d"
-#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "openldap-data"
+#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap"
 #define SLAPD_DEFAULT_DB_MODE		0600
 #define SLAPD_DEFAULT_UCDATA		LDAP_DATADIR LDAP_DIRSEP "ucdata"
 	/* default max deref depth for aliases */
--- openldap.orig/libraries/liblber/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/liblber/Makefile.in	2012-04-06 00:18:54.204137280 +0200
@@ -48,6 +48,6 @@

 install-local: FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

--- openldap.orig/libraries/libldap/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/libldap/Makefile.in	2012-04-06 00:18:54.204137280 +0200
@@ -68,7 +68,7 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)
 	-$(MKDIR) $(DESTDIR)$(sysconfdir)
 	@for i in $(CFFILES); do \
--- openldap.orig/libraries/libldap_r/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-06 00:18:54.208137362 +0200
@@ -83,6 +83,6 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

--- openldap.orig/servers/slapd/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/Makefile.in	2012-04-06 00:18:54.208137362 +0200
@@ -370,10 +370,10 @@
 	install-conf install-db-config install-schema install-tools

 install-slapd: FORCE
-	-$(MKDIR) $(DESTDIR)$(libexecdir)
+	-$(MKDIR) $(DESTDIR)$(sbindir)
 	-$(MKDIR) $(DESTDIR)$(localstatedir)/run
 	$(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \
-		slapd$(EXEEXT) $(DESTDIR)$(libexecdir)
+		slapd$(EXEEXT) $(DESTDIR)$(sbindir)
 	@for i in $(SUBDIRS); do \
 	    if test -d $$i && test -f $$i/Makefile ; then \
 		echo; echo "  cd $$i; $(MAKE) $(MFLAGS) install"; \
@@ -439,9 +439,9 @@

 install-db-config: FORCE
 	@-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir)
-	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data
+	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
-		$(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example
+		$(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
 		$(DESTDIR)$(sysconfdir)/DB_CONFIG.example

@@ -449,6 +449,6 @@
 	-$(MKDIR) $(DESTDIR)$(sbindir)
 	for i in $(SLAPTOOLS); do \
 		$(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
-		$(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+		$(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
 	done

--- openldap.orig/servers/slapd/slapd.conf	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/slapd.conf	2012-04-06 00:21:12.891992222 +0200
@@ -10,14 +10,12 @@
 # service AND an understanding of referrals.
 #referral	ldap://root.openldap.org

-pidfile		%LOCALSTATEDIR%/run/slapd.pid
-argsfile	%LOCALSTATEDIR%/run/slapd.args
+pidfile		%LOCALSTATEDIR%/run/openldap/slapd.pid
+argsfile	%LOCALSTATEDIR%/run/openldap/slapd.args

 # Load dynamic backend modules:
-# modulepath	%MODULEDIR%
-# moduleload	back_bdb.la
-# moduleload	back_hdb.la
-# moduleload	back_ldap.la
+modulepath	%MODULEDIR%
+moduleload	back_bdb

 # Sample security restrictions
 #	Require integrity protection (prevent hijacking)
@@ -46,20 +44,26 @@
 #
 # rootdn can always read and write EVERYTHING!

+# Specific Backend Directives for bdb:
+backend         bdb
+
 #######################################################################
 # BDB database definitions
 #######################################################################

 database	bdb
 suffix		"dc=my-domain,dc=com"
-rootdn		"cn=Manager,dc=my-domain,dc=com"
+#rootdn		"cn=Manager,dc=my-domain,dc=com"
+
 # Cleartext passwords, especially for the rootdn, should
 # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
 # Use of strong authentication encouraged.
-rootpw		secret
+#rootpw		secret
+
 # The database directory MUST exist prior to running slapd AND
 # should only be accessible by the slapd and slap tools.
 # Mode 700 recommended.
-directory	%LOCALSTATEDIR%/openldap-data
+directory	%LOCALSTATEDIR%/lib/openldap
+
 # Indices to maintain
 index	objectClass	eq
--- openldap.orig/servers/slapd/slapi/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/slapi/Makefile.in	2012-04-06 00:18:54.210137403 +0200
@@ -46,6 +46,6 @@
 install-local: FORCE
 	if test "$(BUILD_MOD)" = "yes"; then \
 		$(MKDIR) $(DESTDIR)$(libdir); \
-		$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \
+		$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \
 	fi


code:
Submitted By:            Armin K. <krejzi at email dot com>
Date:                    2012-04-06
Initial Package Version: 2.4.30
Upstream Status:         Unknown
Origin:                  Debian
Description:             Patch from evolution-exchange (2.10.3).  The ldap_ntlm_bind function is
                         actually called by evolution-data-server, checked at version 1.12.2.
                         Without this patch, the Exchange addressbook integration uses simple binds
                         with cleartext passwords.

--- openldap.orig/include/ldap.h	2012-02-29 18:37:09.000000000 +0100
+++ openldap/include/ldap.h	2012-04-01 00:20:00.059827789 +0200
@@ -2517,5 +2517,25 @@
 	LDAPControl	**ctrls,
 	LDAPDerefRes	**drp ));

+/*
+ * hacks for NTLM
+ */
+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
+#define LDAP_AUTH_NTLM_RESPONSE  ((ber_tag_t) 0x8bU)
+LDAP_F( int )
+ldap_ntlm_bind LDAP_P((
+      LDAP    *ld,
+      LDAP_CONST char *dn,
+      ber_tag_t tag,
+      struct berval *cred,
+      LDAPControl **sctrls,
+      LDAPControl **cctrls,
+      int   *msgidp ));
+LDAP_F( int )
+ldap_parse_ntlm_bind_result LDAP_P((
+      LDAP    *ld,
+      LDAPMessage *res,
+      struct berval *challenge));
+
 LDAP_END_DECL
 #endif /* _LDAP_H */
--- openldap.orig/libraries/libldap/Makefile.in	2012-04-01 00:18:54.233419658 +0200
+++ openldap/libraries/libldap/Makefile.in	2012-04-01 00:20:00.060827810 +0200
@@ -27,7 +27,7 @@
 	init.c options.c print.c string.c util-int.c schema.c \
 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
 	tls2.c tls_o.c tls_g.c tls_m.c \
-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
 	assertion.c deref.c ldif.c fetch.c

 OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
@@ -40,7 +40,7 @@
 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
 	assertion.lo deref.lo ldif.lo fetch.lo

 LDAP_INCDIR= ../../include
--- openldap.orig/libraries/libldap/ntlm.c	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/libldap/ntlm.c	2012-04-01 00:20:00.059827789 +0200
@@ -0,0 +1,138 @@
+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
+/*
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
+
+/* Mostly copied from sasl.c */
+
+#include "portable.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/errno.h>
+
+#include "ldap-int.h"
+
+int
+ldap_ntlm_bind(
+ LDAP    *ld,
+ LDAP_CONST char *dn,
+ ber_tag_t tag,
+ struct berval *cred,
+ LDAPControl **sctrls,
+ LDAPControl **cctrls,
+ int   *msgidp )
+{
+ BerElement  *ber;
+ int rc;
+ ber_int_t id;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( msgidp != NULL );
+
+ if( msgidp == NULL ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ /* create a message to send */
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ assert( LBER_VALID( ber ) );
+
+ LDAP_NEXT_MSGID( ld, id );
+ rc = ber_printf( ber, "{it{istON}" /*}*/,
+      id, LDAP_REQ_BIND,
+      ld->ld_version, dn, tag,
+      cred );
+
+ /* Put Server Controls */
+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
+   ld->ld_errno = LDAP_ENCODING_ERROR;
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ /* send the message */
+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
+
+ if(*msgidp < 0)
+   return ld->ld_errno;
+
+ return LDAP_SUCCESS;
+}
+
+int
+ldap_parse_ntlm_bind_result(
+ LDAP    *ld,
+ LDAPMessage *res,
+ struct berval *challenge)
+{
+ ber_int_t errcode;
+ ber_tag_t tag;
+ BerElement  *ber;
+ ber_len_t len;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( res != NULL );
+
+ if ( ld == NULL || res == NULL ) {
+   return LDAP_PARAM_ERROR;
+ }
+
+ if( res->lm_msgtype != LDAP_RES_BIND ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ if ( ld->ld_error ) {
+   LDAP_FREE( ld->ld_error );
+   ld->ld_error = NULL;
+ }
+ if ( ld->ld_matched ) {
+   LDAP_FREE( ld->ld_matched );
+   ld->ld_matched = NULL;
+ }
+
+ /* parse results */
+
+ ber = ber_dup( res->lm_ber );
+
+ if( ber == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ tag = ber_scanf( ber, "{ioa" /*}*/,
+      &errcode, challenge, &ld->ld_error );
+ ber_free( ber, 0 );
+
+ if( tag == LBER_ERROR ) {
+   ld->ld_errno = LDAP_DECODING_ERROR;
+   return ld->ld_errno;
+ }
+
+ ld->ld_errno = errcode;
+
+ return( ld->ld_errno );
+}
+
--- openldap.orig/libraries/libldap_r/Makefile.in	2012-04-01 00:18:54.234419703 +0200
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-01 00:20:00.060827810 +0200
@@ -29,7 +29,7 @@
 	init.c options.c print.c string.c util-int.c schema.c \
 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
 	tls2.c tls_o.c tls_g.c tls_m.c \
-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
 	assertion.c deref.c ldif.c fetch.c
 SRCS	= threads.c rdwr.c rmutex.c tpool.c rq.c \
 	thr_posix.c thr_cthreads.c thr_thr.c thr_nt.c \
@@ -47,7 +47,7 @@
 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
 	assertion.lo deref.lo ldif.lo fetch.lo

 LDAP_INCDIR= ../../include


code:
Submitted By:            Armin K. <krejzi at email dot com>
Date:                    2012-04-06
Initial Package Version: 2.4.30
Upstream Status:         Unknown
Origin:                  Debian
Description:             This patch enables symbol versioning in ldap libraries. Without this
                         patch some applications might generate a warning about missing symbol
                         versions.

--- openldap.orig/build/openldap.m4	2012-02-29 18:37:09.000000000 +0100
+++ openldap/build/openldap.m4	2012-04-01 17:29:50.973881411 +0200
@@ -1136,3 +1136,54 @@
 #endif
 	], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])])
 ])
+
+dnl ====================================================================
+dnl check for symbol versioning support
+AC_DEFUN([OL_SYMBOL_VERSIONING],
+[AC_CACHE_CHECK([for .symver assembler directive],
+	[ol_cv_asm_symver_directive],[
+cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+  ol_cv_asm_symver_directive=yes
+else
+  ol_cv_asm_symver_directive=no
+fi
+rm -f conftest*])
+AC_CACHE_CHECK([for ld --version-script],
+	[ol_cv_ld_version_script_option],[
+if test $ol_cv_asm_symver_directive = yes; then
+  cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+  cat > conftest.map <<EOF
+VERS_1 {
+	global: sym;
+};
+
+VERS_2 {
+	global: sym;
+} VERS_1;
+EOF
+  if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+    if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared
+                                                 -o conftest.so conftest.o
+                                                 -Wl,--version-script,conftest.map
+                       1>&AS_MESSAGE_LOG_FD]);
+    then
+      ol_cv_ld_version_script_option=yes
+    else
+      ol_cv_ld_version_script_option=no
+    fi
+  else
+    ol_cv_ld_version_script_option=no
+  fi
+else
+  ol_cv_ld_version_script_option=no
+fi
+rm -f conftest*])])
--- openldap.orig/build/top.mk	2012-02-29 18:37:09.000000000 +0100
+++ openldap/build/top.mk	2012-04-01 17:29:50.972881390 +0200
@@ -104,6 +104,9 @@
 # LINK_LIBS referenced in library and module link commands.
 LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)

+# option to pass to $(CC) to support library symbol versioning, if any
+VERSION_OPTION = @VERSION_OPTION@
+
 LTSTATIC = @LTSTATIC@

 LTLINK   = $(LIBTOOL) --mode=link \
@@ -113,7 +116,7 @@
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c

 LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \
-	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB)
+	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS)

 LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c
--- openldap.orig/configure.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/configure.in	2012-04-01 17:29:50.981881580 +0200
@@ -1907,6 +1907,13 @@
 fi
 AC_SUBST(LTSTATIC)dnl

+VERSION_OPTION=""
+OL_SYMBOL_VERSIONING
+if test $ol_cv_ld_version_script_option = yes ; then
+  VERSION_OPTION="-Wl,--version-script="
+fi
+AC_SUBST(VERSION_OPTION)
+
 dnl ----------------------------------------------------------------
 if test $ol_enable_wrappers != no ; then
 	AC_CHECK_HEADERS(tcpd.h,[
--- openldap.orig/libraries/liblber/liblber.map	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/liblber/liblber.map	2012-04-01 17:29:50.983881622 +0200
@@ -0,0 +1,8 @@
+OPENLDAP_2.4_2 {
+  global:
+    ber_*;
+    der_alloc;
+    lutil_*;
+  local:
+    *;
+};
--- openldap.orig/libraries/liblber/Makefile.in	2012-04-01 17:27:12.042526978 +0200
+++ openldap/libraries/liblber/Makefile.in	2012-04-01 17:29:50.982881601 +0200
@@ -38,6 +38,9 @@
 XXLIBS =
 NT_LINK_LIBS = $(AC_LIBS)
 UNIX_LINK_LIBS = $(AC_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map"
+endif

 dtest:    $(XLIBS) dtest.o
 	$(LTLINK) -o $@ dtest.o $(LIBS)
--- openldap.orig/libraries/libldap/libldap.map	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/libldap/libldap.map	2012-04-01 17:29:50.981881580 +0200
@@ -0,0 +1,7 @@
+OPENLDAP_2.4_2 {
+  global:
+    ldap_*;
+    ldif_*;
+  local:
+    *;
+};
--- openldap.orig/libraries/libldap/Makefile.in	2012-04-01 17:27:12.043527000 +0200
+++ openldap/libraries/libldap/Makefile.in	2012-04-01 17:29:50.982881601 +0200
@@ -52,6 +52,9 @@
 XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map
+endif

 apitest:	$(XLIBS) apitest.o
 	$(LTLINK) -o $@ apitest.o $(LIBS)
--- openldap.orig/libraries/libldap_r/Makefile.in	2012-04-01 17:27:12.043527000 +0200
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-01 17:29:50.971881369 +0200
@@ -61,6 +61,9 @@
 XXXLIBS = $(LTHREAD_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map"
+endif

 .links : Makefile
 	@for i in $(XXSRCS); do \


code:
Submitted by:            Bruce Dubbs <bdubbs at linuxfromscratch.org>
Date:                    2012-03-26
Initial Package Version: 2.4.40
Upstream Status:         BLFS Specific
Origin:                  Armin K. <krejzi at email dot com> and Debian
Comment:                 Rediffed by Fernando de Oliveira <famobr at yahoo dot
                         com dot br> for version 2.4.44 - 2016.02.06
                         Rediffed by Pierre Labastie <pierre dot labastie at
                         neuf dot fr> to add mdb backend and slapd.ldif. See
                         ticket #7394 - 2016.02.24
Description:             Consolidate earlier patches to:
 1. Update various installation options, such as ldap database path,
    configuration file options, slapd install location, etc.
 2. Remove reference to bdb module
 3. Enables symbol versioning in ldap libraries. Without these changes
    some applications might generate a warning about missing symbol versions.

diff -Naur openldap-2.4.40.orig/build/openldap.m4 openldap-2.4.40/build/openldap.m4
--- openldap-2.4.40.orig/build/openldap.m4	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/build/openldap.m4	2015-03-26 15:37:39.801077750 -0500
@@ -1142,3 +1142,54 @@
 #endif
 	], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])])
 ])
+
+dnl ====================================================================
+dnl check for symbol versioning support
+AC_DEFUN([OL_SYMBOL_VERSIONING],
+[AC_CACHE_CHECK([for .symver assembler directive],
+	[ol_cv_asm_symver_directive],[
+cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+  ol_cv_asm_symver_directive=yes
+else
+  ol_cv_asm_symver_directive=no
+fi
+rm -f conftest*])
+AC_CACHE_CHECK([for ld --version-script],
+	[ol_cv_ld_version_script_option],[
+if test $ol_cv_asm_symver_directive = yes; then
+  cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+  cat > conftest.map <<EOF
+VERS_1 {
+	global: sym;
+};
+
+VERS_2 {
+	global: sym;
+} VERS_1;
+EOF
+  if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+    if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared
+                                                 -o conftest.so conftest.o
+                                                 -Wl,--version-script,conftest.map
+                       1>&AS_MESSAGE_LOG_FD]);
+    then
+      ol_cv_ld_version_script_option=yes
+    else
+      ol_cv_ld_version_script_option=no
+    fi
+  else
+    ol_cv_ld_version_script_option=no
+  fi
+else
+  ol_cv_ld_version_script_option=no
+fi
+rm -f conftest*])])
diff -Naur openldap-2.4.40.orig/build/top.mk openldap-2.4.40/build/top.mk
--- openldap-2.4.40.orig/build/top.mk	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/build/top.mk	2015-03-26 15:37:39.801077750 -0500
@@ -104,6 +104,9 @@
 # LINK_LIBS referenced in library and module link commands.
 LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)

+# option to pass to $(CC) to support library symbol versioning, if any
+VERSION_OPTION = @VERSION_OPTION@
+
 LTSTATIC = @LTSTATIC@

 LTLINK   = $(LIBTOOL) --mode=link \
@@ -113,7 +116,7 @@
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c

 LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \
-	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB)
+	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS)

 LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c
diff -Naur openldap-2.4.40.orig/configure.in openldap-2.4.40/configure.in
--- openldap-2.4.40.orig/configure.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/configure.in	2015-03-26 15:37:39.801077750 -0500
@@ -1916,6 +1916,13 @@
 fi
 AC_SUBST(LTSTATIC)dnl

+VERSION_OPTION=""
+OL_SYMBOL_VERSIONING
+if test $ol_cv_ld_version_script_option = yes ; then
+  VERSION_OPTION="-Wl,--version-script="
+fi
+AC_SUBST(VERSION_OPTION)
+
 dnl ----------------------------------------------------------------
 if test $ol_enable_wrappers != no ; then
 	AC_CHECK_HEADERS(tcpd.h,[
diff -Naur openldap-2.4.40.orig/doc/man/man5/slapd-bdb.5 openldap-2.4.40/doc/man/man5/slapd-bdb.5
--- openldap-2.4.40.orig/doc/man/man5/slapd-bdb.5	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/doc/man/man5/slapd-bdb.5	2015-03-26 15:36:59.637464038 -0500
@@ -135,7 +135,7 @@
 associated indexes live.
 A separate directory must be specified for each database.
 The default is
-.BR LOCALSTATEDIR/openldap\-data .
+.BR LOCALSTATEDIR/lib/openldap .
 .TP
 .B dirtyread
 Allow reads of modified but not yet committed data.
diff -Naur openldap-2.4.40.orig/doc/man/man5/slapd-config.5 openldap-2.4.40/doc/man/man5/slapd-config.5
--- openldap-2.4.40.orig/doc/man/man5/slapd-config.5	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/doc/man/man5/slapd-config.5	2015-03-26 15:36:59.638464004 -0500
@@ -2051,7 +2051,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-olcDbDirectory: LOCALSTATEDIR/openldap\-data
+olcDbDirectory: LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 olcDbIndex:     objectClass  eq
 olcDbIndex:     cn,sn,mail   pres,eq,approx,sub
diff -Naur openldap-2.4.40.orig/doc/man/man5/slapd.conf.5 openldap-2.4.40/doc/man/man5/slapd.conf.5
--- openldap-2.4.40.orig/doc/man/man5/slapd.conf.5	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/doc/man/man5/slapd.conf.5	2015-03-26 15:36:59.638464004 -0500
@@ -2021,7 +2021,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-directory LOCALSTATEDIR/openldap\-data
+directory LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 index     objectClass  eq
 index     cn,sn,mail   pres,eq,approx,sub
diff -Naur openldap-2.4.40.orig/include/ldap_defaults.h openldap-2.4.40/include/ldap_defaults.h
--- openldap-2.4.40.orig/include/ldap_defaults.h	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/include/ldap_defaults.h	2015-03-26 15:36:59.638464004 -0500
@@ -39,7 +39,7 @@
 #define LDAP_ENV_PREFIX "LDAP"

 /* default ldapi:// socket */
-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"
+#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"

 /*
  * SLAPD DEFINITIONS
@@ -47,7 +47,7 @@
 	/* location of the default slapd config file */
 #define SLAPD_DEFAULT_CONFIGFILE	LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf"
 #define SLAPD_DEFAULT_CONFIGDIR		LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d"
-#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "openldap-data"
+#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap"
 #define SLAPD_DEFAULT_DB_MODE		0600
 #define SLAPD_DEFAULT_UCDATA		LDAP_DATADIR LDAP_DIRSEP "ucdata"
 	/* default max deref depth for aliases */
diff -Naur openldap-2.4.40.orig/libraries/liblber/Makefile.in openldap-2.4.40/libraries/liblber/Makefile.in
--- openldap-2.4.40.orig/libraries/liblber/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/libraries/liblber/Makefile.in	2015-03-26 15:37:39.801077750 -0500
@@ -38,6 +38,9 @@
 XXLIBS =
 NT_LINK_LIBS = $(AC_LIBS)
 UNIX_LINK_LIBS = $(AC_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map"
+endif

 dtest:    $(XLIBS) dtest.o
 	$(LTLINK) -o $@ dtest.o $(LIBS)
@@ -48,6 +51,6 @@

 install-local: FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

diff -Naur openldap-2.4.40.orig/libraries/liblber/liblber.map openldap-2.4.40/libraries/liblber/liblber.map
--- openldap-2.4.40.orig/libraries/liblber/liblber.map	1969-12-31 18:00:00.000000000 -0600
+++ openldap-2.4.40/libraries/liblber/liblber.map	2015-03-26 15:37:39.801077750 -0500
@@ -0,0 +1,8 @@
+OPENLDAP_2.4_2 {
+  global:
+    ber_*;
+    der_alloc;
+    lutil_*;
+  local:
+    *;
+};
diff -Naur openldap-2.4.40.orig/libraries/libldap/Makefile.in openldap-2.4.40/libraries/libldap/Makefile.in
--- openldap-2.4.40.orig/libraries/libldap/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/libraries/libldap/Makefile.in	2015-03-26 15:37:39.802077716 -0500
@@ -52,6 +52,9 @@
 XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map
+endif

 apitest:	$(XLIBS) apitest.o
 	$(LTLINK) -o $@ apitest.o $(LIBS)
@@ -68,7 +71,7 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)
 	-$(MKDIR) $(DESTDIR)$(sysconfdir)
 	@for i in $(CFFILES); do \
diff -Naur openldap-2.4.40.orig/libraries/libldap/libldap.map openldap-2.4.40/libraries/libldap/libldap.map
--- openldap-2.4.40.orig/libraries/libldap/libldap.map	1969-12-31 18:00:00.000000000 -0600
+++ openldap-2.4.40/libraries/libldap/libldap.map	2015-03-26 15:37:39.802077716 -0500
@@ -0,0 +1,7 @@
+OPENLDAP_2.4_2 {
+  global:
+    ldap_*;
+    ldif_*;
+  local:
+    *;
+};
diff -Naur openldap-2.4.40.orig/libraries/libldap_r/Makefile.in openldap-2.4.40/libraries/libldap_r/Makefile.in
--- openldap-2.4.40.orig/libraries/libldap_r/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/libraries/libldap_r/Makefile.in	2015-03-26 15:37:39.802077716 -0500
@@ -61,6 +61,9 @@
 XXXLIBS = $(LTHREAD_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map"
+endif

 .links : Makefile
 	@for i in $(XXSRCS); do \
@@ -83,6 +86,6 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

diff -Naur openldap-2.4.40.orig/servers/slapd/Makefile.in openldap-2.4.40/servers/slapd/Makefile.in
--- openldap-2.4.40.orig/servers/slapd/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/servers/slapd/Makefile.in	2015-03-26 15:36:59.639463969 -0500
@@ -376,10 +376,10 @@
 	install-conf install-dbc-maybe install-schema install-tools

 install-slapd: FORCE
-	-$(MKDIR) $(DESTDIR)$(libexecdir)
+	-$(MKDIR) $(DESTDIR)$(sbindir)
 	-$(MKDIR) $(DESTDIR)$(localstatedir)/run
 	$(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \
-		slapd$(EXEEXT) $(DESTDIR)$(libexecdir)
+		slapd$(EXEEXT) $(DESTDIR)$(sbindir)
 	@for i in $(SUBDIRS); do \
 	    if test -d $$i && test -f $$i/Makefile ; then \
 		echo; echo "  cd $$i; $(MAKE) $(MFLAGS) install"; \
@@ -445,9 +445,9 @@

 install-db-config: FORCE
 	@-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir)
-	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data
+	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
-		$(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example
+		$(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
 		$(DESTDIR)$(sysconfdir)/DB_CONFIG.example

@@ -455,6 +455,6 @@
 	-$(MKDIR) $(DESTDIR)$(sbindir)
 	for i in $(SLAPTOOLS); do \
 		$(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
-		$(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+		$(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
 	done

diff -Naur openldap-2.4.44.orig/servers/slapd/slapd.conf openldap-2.4.44/servers/slapd/slapd.conf
--- openldap-2.4.44.orig/servers/slapd/slapd.conf	2016-02-06 00:57:45.000000000 +0100
+++ openldap-2.4.44/servers/slapd/slapd.conf	2016-02-22 23:01:47.681372594 +0100
@@ -10,12 +10,12 @@
 # service AND an understanding of referrals.
 #referral	ldap://root.openldap.org

-pidfile		%LOCALSTATEDIR%/run/slapd.pid
-argsfile	%LOCALSTATEDIR%/run/slapd.args
+pidfile		%LOCALSTATEDIR%/run/openldap/slapd.pid
+argsfile	%LOCALSTATEDIR%/run/openldap/slapd.args

 # Load dynamic backend modules:
-# modulepath	%MODULEDIR%
-# moduleload	back_mdb.la
+modulepath	%MODULEDIR%
+moduleload	back_mdb.la
 # moduleload	back_ldap.la

 # Sample security restrictions
@@ -60,6 +60,6 @@
 # The database directory MUST exist prior to running slapd AND
 # should only be accessible by the slapd and slap tools.
 # Mode 700 recommended.
-directory	%LOCALSTATEDIR%/openldap-data
+directory	%LOCALSTATEDIR%/lib/openldap
 # Indices to maintain
 index	objectClass	eq
diff -Naur openldap-2.4.44.orig/servers/slapd/slapd.ldif openldap-2.4.44/servers/slapd/slapd.ldif
--- openldap-2.4.44.orig/servers/slapd/slapd.ldif	2016-02-06 00:57:45.000000000 +0100
+++ openldap-2.4.44/servers/slapd/slapd.ldif	2016-02-22 22:59:57.824364446 +0100
@@ -9,8 +9,8 @@
 #
 # Define global ACLs to disable default read access.
 #
-olcArgsFile: %LOCALSTATEDIR%/run/slapd.args
-olcPidFile: %LOCALSTATEDIR%/run/slapd.pid
+olcArgsFile: %LOCALSTATEDIR%/run/openldap/slapd.args
+olcPidFile: %LOCALSTATEDIR%/run/openldap/slapd.pid
 #
 # Do not enable referrals until AFTER you have a working directory
 # service AND an understanding of referrals.
@@ -26,10 +26,11 @@
 #
 # Load dynamic backend modules:
 #
-#dn: cn=module,cn=config
-#objectClass: olcModuleList
-#cn: module
-#olcModulepath:	%MODULEDIR%
+dn: cn=module,cn=config
+objectClass: olcModuleList
+cn: module
+olcModulepath:	%MODULEDIR%
+olcModuleload: back_mdb.la
 #olcModuleload:	back_bdb.la
 #olcModuleload:	back_hdb.la
 #olcModuleload:	back_ldap.la
@@ -90,6 +91,6 @@
 # The database directory MUST exist prior to running slapd AND
 # should only be accessible by the slapd and slap tools.
 # Mode 700 recommended.
-olcDbDirectory:	%LOCALSTATEDIR%/openldap-data
+olcDbDirectory:	%LOCALSTATEDIR%/lib/openldap
 # Indices to maintain
 olcDbIndex: objectClass eq
diff -Naur openldap-2.4.40.orig/servers/slapd/slapi/Makefile.in openldap-2.4.40/servers/slapd/slapi/Makefile.in
--- openldap-2.4.40.orig/servers/slapd/slapi/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/servers/slapd/slapi/Makefile.in	2015-03-26 15:36:59.639463969 -0500
@@ -46,6 +46,6 @@
 install-local: FORCE
 	if test "$(BUILD_MOD)" = "yes"; then \
 		$(MKDIR) $(DESTDIR)$(libdir); \
-		$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \
+		$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \
 	fi


code:
# conf.d file for openldap
#
# To enable both the standard unciphered server and the ssl encrypted
# one uncomment this line or set any other server starting options
# you may desire.
#
# OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
# Uncomment the below to use the new slapd configuration for openldap 2.3
OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"


code: d /run/openldap 0755 ldap ldap - -


code:
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
    <Source>
        <Name>openldap</Name>
        <Homepage>http://www.openldap.org</Homepage>
        <Packager>
            <Name>PisiLinux Community</Name>
            <Email>admins@pisilinux.org</Email>
        </Packager>
        <License>OPENLDAP</License>
        Open-source suite of LDAP applications and development tools
        <Description>OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools</Description>
        <Archive sha1sum="016a738d050a68d388602a74b5e991035cdba149" type="targz">ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.44.tgz</Archive>
        <BuildDependencies>
            <Dependency>nss-devel</Dependency>
            <Dependency>db-devel</Dependency>
            <Dependency>openssl-devel</Dependency>
            <Dependency>tcp-wrappers-devel</Dependency>
            <Dependency>cyrus-sasl-devel</Dependency>
            <Dependency>libtool-ltdl</Dependency>
            <Dependency>icu4c-devel</Dependency>
            <Dependency>unixODBC-devel</Dependency>
            <Dependency>mariadb-server</Dependency>
            <Dependency>libutil-linux-devel</Dependency>
            <Dependency>e2fsprogs-devel</Dependency>
            <Dependency>chrpath</Dependency>
            <Dependency>groff</Dependency>
        </BuildDependencies>
        <Patches>

            <Patch level="1">openldap-2.4.44-consolidated-2.patch</Patch>

            <Patch level="1">openldap-2.4.39-ntlm-1.patch</Patch>
            <Patch level="1">fedora/openldap-sql-linking.patch</Patch>
            <Patch level="1">fedora/openldap-reentrant-gethostby.patch</Patch>
            <Patch level="1">fedora/openldap-ldaprc-currentdir.patch</Patch>
            <Patch level="1">fedora/openldap-userconfig-setgid.patch</Patch>

            <Patch level="1">fedora/openldap-syncrepl-unset-tls-options.patch</Patch>
            <Patch level="1">fedora/openldap-nss-update-list-of-ciphers.patch</Patch>
            <Patch level="1">fedora/openldap-tls-no-reuse-of-tls_session.patch</Patch>
            <Patch level="1">fedora/openldap-nss-regex-search-hashed-cacert-dir.patch</Patch>
            <Patch level="1">fedora/openldap-nss-ignore-certdb-type-prefix.patch</Patch>
            <Patch level="1">fedora/openldap-nss-certs-from-certdb-fallback-pem.patch</Patch>
            <Patch level="1">fedora/openldap-nss-pk11-freeslot.patch</Patch>
            <Patch level="1">fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch</Patch>
            <Patch level="1">fedora/openldap-ldapi-sasl.patch</Patch>
            <Patch level="1">fedora/openldap-autoconf-pkgconfig-nss.patch</Patch>
        </Patches>
    </Source>

    <Package>
        <Name>openldap-client</Name>
        <IsA>library</IsA>
        <IsA>app:console</IsA>
        Command-line ldap client commands (ldapsearch, ldapadd etc..)
        <RuntimeDependencies>
            <Dependency>nss</Dependency>
            <Dependency>nspr</Dependency>
            <Dependency>openssl</Dependency>
            <Dependency>cyrus-sasl</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc/openldap/ldap.conf*</Path>
            <Path fileType="header">/usr/include</Path>
            <Path fileType="executable">/usr/bin</Path>
            <Path fileType="library">/usr/lib</Path>
            <Path fileType="man">/usr/share/man/man1</Path>
            <Path fileType="man">/usr/share/man/man5/ldap.conf.5</Path>
        </Files>
    </Package>

    <Package>
        <Name>openldap-server</Name>
        <IsA>service</IsA>
        OpenLDAP server slapd and releated tools
        <Description>OpenLDAP server slapd, additional backends, configuration files, schema definitions required for operation, and database maintenance tools</Description>
        <RuntimeDependencies>
            <Dependency>db</Dependency>
            <Dependency>perl</Dependency>
            <Dependency>unixODBC</Dependency>
            <Dependency>libutil-linux</Dependency>
            <Dependency>tcp-wrappers</Dependency>
            <Dependency>libtool-ltdl</Dependency>
            <Dependency>nss</Dependency>
            <Dependency>cyrus-sasl</Dependency>
            <Dependency release="current">openldap-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc/conf.d</Path>
            <Path fileType="config">/etc/openldap</Path>
            <Path fileType="config">/usr/lib/tmpfiles.d/openldap-server.conf</Path>
            <Path fileType="executable">/usr/sbin</Path>
            <Path fileType="library">/usr/libexec</Path>
            <Path fileType="man">/usr/share/man/man3</Path>
            <Path fileType="man">/usr/share/man/man5</Path>
            <Path fileType="man">/usr/share/man/man8</Path>
            <Path fileType="doc">/usr/share/doc</Path>
            <Path fileType="data">/var/lib</Path>
            <Path fileType="data">/run/openldap</Path>
        </Files>
        <AdditionalFiles>
            <AdditionalFile owner="root" permission="0644" target="/usr/lib/tmpfiles.d/openldap-server.conf">tmpfiles.conf</AdditionalFile>
            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/slapd">slapd.conf</AdditionalFile>
            <AdditionalFile owner="root" permission="0755" target="/etc/openldap/ssl/gencert.sh">gencert.sh</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="package.py">System.Package</COMAR>
            <COMAR script="slapd.py">System.Service</COMAR>
        </Provides>
    </Package>

    <Package>
        <Name>openldap-32bit</Name>
        <PartOf>emul32</PartOf>
        32-bit shared libraries for openldap
        <BuildType>emul32</BuildType>
        <BuildDependencies>
            <Dependency>openssl-32bit</Dependency>
            <Dependency>libtool-ltdl-32bit</Dependency>
        </BuildDependencies>
        <RuntimeDependencies>
            <Dependency>openssl-32bit</Dependency>
            <Dependency release="current">openldap-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="library">/usr/lib32</Path>
        </Files>
    </Package>

    <History>
        <Update release="4">
            <Date>2017-01-27</Date>
            <Version>2.4.44</Version>
            <Comment>Release bump for toolchain</Comment>
            <Name>Kamil Atlı</Name>
            <Email>suvari@pisilinux.org</Email>
        </Update>
        <Update release="3">
            <Date>2016-06-15</Date>
            <Version>2.4.44</Version>
            <Comment>Release Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="2">
            <Date>2016-05-27</Date>
            <Version>2.4.44</Version>
            <Comment>Release bump</Comment>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
         <Update release="1">
            <Date>2016-03-28</Date>
            <Version>2.4.44</Version>
            <Comment>First release</Comment>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
    </History>
</PISI>


code:
<?xml version="1.0" ?>
<PISI>
    <Source>
        <Name>openldap</Name>
        LDAP uygulamaları ve geliştirme araçları
        <Description xml:lang="tr">LDAP hizmeti için gereken uygulamalar ve geliştirme araçlarını içerir</Description>
    </Source>

    <Package>
        <Name>openldap-32bit</Name>
        openldap için 32-bit paylaşımlı kitaplıklar
    </Package>
</PISI>