diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7e0ec57 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +SOURCES/ltb-project-openldap-ppolicy-check-password-1.1.tar.gz +SOURCES/openldap-2.4.57.tgz diff --git a/.openldap.metadata b/.openldap.metadata new file mode 100644 index 0000000..efc624d --- /dev/null +++ b/.openldap.metadata @@ -0,0 +1,2 @@ +444fe85f8c42d97355d88ec295b18ecb58faeb52 SOURCES/ltb-project-openldap-ppolicy-check-password-1.1.tar.gz +1cffa70a3ea8545948041fd113f8f53bc24d6d87 SOURCES/openldap-2.4.57.tgz diff --git a/SOURCES/check-password-makefile.patch b/SOURCES/check-password-makefile.patch new file mode 100644 index 0000000..f39ba81 --- /dev/null +++ b/SOURCES/check-password-makefile.patch @@ -0,0 +1,41 @@ +--- a/Makefile 2009-10-31 18:59:06.000000000 +0100 ++++ b/Makefile 2014-12-17 09:42:37.586079225 +0100 +@@ -13,22 +13,11 @@ + # + CONFIG=/etc/openldap/check_password.conf + +-OPT=-g -O2 -Wall -fpic \ +- -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ +- -DCONFIG_FILE="\"$(CONFIG)\"" \ ++CFLAGS+=-fpic \ ++ -DHAVE_CRACKLIB -DCRACKLIB_DICTPATH="\"$(CRACKLIB)\"" \ ++ -DCONFIG_FILE="\"$(CONFIG)\"" \ + -DDEBUG + +-# Where to find the OpenLDAP headers. +-# +-LDAP_INC=-I/home/pyb/tmp/openldap-2.3.39/include \ +- -I/home/pyb/tmp/openldap-2.3.39/servers/slapd +- +-# Where to find the CrackLib headers. +-# +-CRACK_INC= +- +-INCS=$(LDAP_INC) $(CRACK_INC) +- + LDAP_LIB=-lldap_r -llber + + # Comment out this line if you do NOT want to use the cracklib. +@@ -45,10 +34,10 @@ + all: check_password + + check_password.o: +- $(CC) $(OPT) -c $(INCS) check_password.c ++ $(CC) $(CFLAGS) -c $(LDAP_INC) check_password.c + + check_password: clean check_password.o +- $(CC) -shared -o check_password.so check_password.o $(CRACKLIB_LIB) ++ $(CC) $(LDFLAGS) -shared -o check_password.so check_password.o $(CRACKLIB_LIB) + + install: check_password + cp -f check_password.so ../../../usr/lib/openldap/modules/ diff --git a/SOURCES/check-password.patch b/SOURCES/check-password.patch new file mode 100644 index 0000000..7a79e95 --- /dev/null +++ b/SOURCES/check-password.patch @@ -0,0 +1,321 @@ +--- a/check_password.c 2009-10-31 18:59:06.000000000 +0100 ++++ b/check_password.c 2014-12-17 12:25:00.148900907 +0100 +@@ -10,7 +10,7 @@ + #include + + #ifdef HAVE_CRACKLIB +-#include "crack.h" ++#include + #endif + + #if defined(DEBUG) +@@ -34,18 +34,77 @@ + #define PASSWORD_TOO_SHORT_SZ \ + "Password for dn=\"%s\" is too short (%d/6)" + #define PASSWORD_QUALITY_SZ \ +- "Password for dn=\"%s\" does not pass required number of strength checks (%d of %d)" ++ "Password for dn=\"%s\" does not pass required number of strength checks for the required character sets (%d of %d)" + #define BAD_PASSWORD_SZ \ + "Bad password for dn=\"%s\" because %s" ++#define UNKNOWN_ERROR_SZ \ ++ "An unknown error occurred, please see your systems administrator" + + typedef int (*validator) (char*); +-static int read_config_file (char *); ++static int read_config_file (); + static validator valid_word (char *); + static int set_quality (char *); + static int set_cracklib (char *); + + int check_password (char *pPasswd, char **ppErrStr, Entry *pEntry); + ++struct config_entry { ++ char* key; ++ char* value; ++ char* def_value; ++} config_entries[] = { { "minPoints", NULL, "3"}, ++ { "useCracklib", NULL, "1"}, ++ { "minUpper", NULL, "0"}, ++ { "minLower", NULL, "0"}, ++ { "minDigit", NULL, "0"}, ++ { "minPunct", NULL, "0"}, ++ { NULL, NULL, NULL }}; ++ ++int get_config_entry_int(char* entry) { ++ struct config_entry* centry = config_entries; ++ ++ int i = 0; ++ char* key = centry[i].key; ++ while (key != NULL) { ++ if ( strncmp(key, entry, strlen(key)) == 0 ) { ++ if ( centry[i].value == NULL ) { ++ return atoi(centry[i].def_value); ++ } ++ else { ++ return atoi(centry[i].value); ++ } ++ } ++ i++; ++ key = centry[i].key; ++ } ++ ++ return -1; ++} ++ ++void dealloc_config_entries() { ++ struct config_entry* centry = config_entries; ++ ++ int i = 0; ++ while (centry[i].key != NULL) { ++ if ( centry[i].value != NULL ) { ++ ber_memfree(centry[i].value); ++ } ++ i++; ++ } ++} ++ ++char* chomp(char *s) ++{ ++ char* t = ber_memalloc(strlen(s)+1); ++ strncpy (t,s,strlen(s)+1); ++ ++ if ( t[strlen(t)-1] == '\n' ) { ++ t[strlen(t)-1] = '\0'; ++ } ++ ++ return t; ++} ++ + static int set_quality (char *value) + { + #if defined(DEBUG) +@@ -84,12 +143,12 @@ + char * parameter; + validator dealer; + } list[] = { { "minPoints", set_quality }, +- { "useCracklib", set_cracklib }, +- { "minUpper", set_digit }, +- { "minLower", set_digit }, +- { "minDigit", set_digit }, +- { "minPunct", set_digit }, +- { NULL, NULL } }; ++ { "useCracklib", set_cracklib }, ++ { "minUpper", set_digit }, ++ { "minLower", set_digit }, ++ { "minDigit", set_digit }, ++ { "minPunct", set_digit }, ++ { NULL, NULL } }; + int index = 0; + + #if defined(DEBUG) +@@ -98,7 +157,7 @@ + + while (list[index].parameter != NULL) { + if (strlen(word) == strlen(list[index].parameter) && +- strcmp(list[index].parameter, word) == 0) { ++ strcmp(list[index].parameter, word) == 0) { + #if defined(DEBUG) + syslog(LOG_NOTICE, "check_password: Parameter accepted."); + #endif +@@ -114,13 +173,15 @@ + return NULL; + } + +-static int read_config_file (char *keyWord) ++static int read_config_file () + { + FILE * config; + char * line; + int returnValue = -1; + +- if ((line = ber_memcalloc(260, sizeof(char))) == NULL) { ++ line = ber_memcalloc(260, sizeof(char)); ++ ++ if ( line == NULL ) { + return returnValue; + } + +@@ -133,6 +194,8 @@ + return returnValue; + } + ++ returnValue = 0; ++ + while (fgets(line, 256, config) != NULL) { + char *start = line; + char *word, *value; +@@ -145,23 +208,40 @@ + + while (isspace(*start) && isascii(*start)) start++; + +- if (! isascii(*start)) ++ /* If we've got punctuation, just skip the line. */ ++ if ( ispunct(*start)) { ++#if defined(DEBUG) ++ /* Debug traces to syslog. */ ++ syslog(LOG_NOTICE, "check_password: Skipped line |%s|", line); ++#endif + continue; ++ } + +- if ((word = strtok(start, " \t")) && (dealer = valid_word(word)) && (strcmp(keyWord,word)==0)) { +- if ((value = strtok(NULL, " \t")) == NULL) +- continue; ++ if( isascii(*start)) { ++ ++ struct config_entry* centry = config_entries; ++ int i = 0; ++ char* keyWord = centry[i].key; ++ if ((word = strtok(start, " \t")) && (value = strtok(NULL, " \t"))) { ++ while ( keyWord != NULL ) { ++ if ((strncmp(keyWord,word,strlen(keyWord)) == 0) && (dealer = valid_word(word)) ) { + + #if defined(DEBUG) +- syslog(LOG_NOTICE, "check_password: Word = %s, value = %s", word, value); ++ syslog(LOG_NOTICE, "check_password: Word = %s, value = %s", word, value); + #endif + +- returnValue = (*dealer)(value); ++ centry[i].value = chomp(value); ++ break; ++ } ++ i++; ++ keyWord = centry[i].key; ++ } ++ } + } + } +- + fclose(config); + ber_memfree(line); ++ + return returnValue; + } + +@@ -170,7 +250,7 @@ + if (curlen < nextlen + MEMORY_MARGIN) { + #if defined(DEBUG) + syslog(LOG_WARNING, "check_password: Reallocating szErrStr from %d to %d", +- curlen, nextlen + MEMORY_MARGIN); ++ curlen, nextlen + MEMORY_MARGIN); + #endif + ber_memfree(*target); + curlen = nextlen + MEMORY_MARGIN; +@@ -180,7 +260,7 @@ + return curlen; + } + +- int ++int + check_password (char *pPasswd, char **ppErrStr, Entry *pEntry) + { + +@@ -210,20 +290,22 @@ + nLen = strlen (pPasswd); + if ( nLen < 6) { + mem_len = realloc_error_message(&szErrStr, mem_len, +- strlen(PASSWORD_TOO_SHORT_SZ) + +- strlen(pEntry->e_name.bv_val) + 1); ++ strlen(PASSWORD_TOO_SHORT_SZ) + ++ strlen(pEntry->e_name.bv_val) + 1); + sprintf (szErrStr, PASSWORD_TOO_SHORT_SZ, pEntry->e_name.bv_val, nLen); + goto fail; + } + +- /* Read config file */ +- minQuality = read_config_file("minPoints"); ++ if (read_config_file() == -1) { ++ syslog(LOG_ERR, "Warning: Could not read values from config file %s. Using defaults.", CONFIG_FILE); ++ } + +- useCracklib = read_config_file("useCracklib"); +- minUpper = read_config_file("minUpper"); +- minLower = read_config_file("minLower"); +- minDigit = read_config_file("minDigit"); +- minPunct = read_config_file("minPunct"); ++ minQuality = get_config_entry_int("minPoints"); ++ useCracklib = get_config_entry_int("useCracklib"); ++ minUpper = get_config_entry_int("minUpper"); ++ minLower = get_config_entry_int("minLower"); ++ minDigit = get_config_entry_int("minDigit"); ++ minPunct = get_config_entry_int("minPunct"); + + /** The password must have at least minQuality strength points with one + * point for the first occurrance of a lower, upper, digit and +@@ -232,8 +314,6 @@ + + for ( i = 0; i < nLen; i++ ) { + +- if ( nQuality >= minQuality ) break; +- + if ( islower (pPasswd[i]) ) { + minLower--; + if ( !nLower && (minLower < 1)) { +@@ -279,12 +359,23 @@ + } + } + +- if ( nQuality < minQuality ) { ++ /* ++ * If you have a required field, then it should be required in the strength ++ * checks. ++ */ ++ ++ if ( ++ (minLower > 0 ) || ++ (minUpper > 0 ) || ++ (minDigit > 0 ) || ++ (minPunct > 0 ) || ++ (nQuality < minQuality) ++ ) { + mem_len = realloc_error_message(&szErrStr, mem_len, +- strlen(PASSWORD_QUALITY_SZ) + +- strlen(pEntry->e_name.bv_val) + 2); ++ strlen(PASSWORD_QUALITY_SZ) + ++ strlen(pEntry->e_name.bv_val) + 2); + sprintf (szErrStr, PASSWORD_QUALITY_SZ, pEntry->e_name.bv_val, +- nQuality, minQuality); ++ nQuality, minQuality); + goto fail; + } + +@@ -306,7 +397,7 @@ + for ( j = 0; j < 3; j++ ) { + + snprintf (filename, FILENAME_MAXLEN - 1, "%s.%s", \ +- CRACKLIB_DICTPATH, ext[j]); ++ CRACKLIB_DICTPATH, ext[j]); + + if (( fp = fopen ( filename, "r")) == NULL ) { + +@@ -326,9 +417,9 @@ + r = (char *) FascistCheck (pPasswd, CRACKLIB_DICTPATH); + if ( r != NULL ) { + mem_len = realloc_error_message(&szErrStr, mem_len, +- strlen(BAD_PASSWORD_SZ) + +- strlen(pEntry->e_name.bv_val) + +- strlen(r)); ++ strlen(BAD_PASSWORD_SZ) + ++ strlen(pEntry->e_name.bv_val) + ++ strlen(r)); + sprintf (szErrStr, BAD_PASSWORD_SZ, pEntry->e_name.bv_val, r); + goto fail; + } +@@ -342,15 +433,15 @@ + } + + #endif +- ++ dealloc_config_entries(); + *ppErrStr = strdup (""); + ber_memfree(szErrStr); + return (LDAP_SUCCESS); + + fail: ++ dealloc_config_entries(); + *ppErrStr = strdup (szErrStr); + ber_memfree(szErrStr); + return (EXIT_FAILURE); + + } +- diff --git a/SOURCES/ldap.conf b/SOURCES/ldap.conf new file mode 100644 index 0000000..02c595f --- /dev/null +++ b/SOURCES/ldap.conf @@ -0,0 +1,28 @@ +# +# LDAP Defaults +# + +# See ldap.conf(5) for details +# This file should be world readable but not world writable. + +#BASE dc=example,dc=com +#URI ldap://ldap.example.com ldap://ldap-master.example.com:666 + +#SIZELIMIT 12 +#TIMELIMIT 15 +#DEREF never + +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by TLS_CACERTDIR one has to include them explicitly: +#TLS_CACERT /etc/pki/tls/cert.pem + +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#TLS_CIPHER_SUITE PROFILE=SYSTEM + +# Turning this off breaks GSSAPI used with krb5 when rdns = false +SASL_NOCANON on + diff --git a/SOURCES/libexec-check-config.sh b/SOURCES/libexec-check-config.sh new file mode 100755 index 0000000..87e377f --- /dev/null +++ b/SOURCES/libexec-check-config.sh @@ -0,0 +1,91 @@ +#!/bin/sh +# Author: Jan Vcelak + +. /usr/libexec/openldap/functions + +function check_config_syntax() +{ + retcode=0 + tmp_slaptest=`mktemp --tmpdir=/var/run/openldap` + run_as_ldap "/usr/sbin/slaptest $SLAPD_GLOBAL_OPTIONS -u" &>$tmp_slaptest + if [ $? -ne 0 ]; then + error "Checking configuration file failed:" + cat $tmp_slaptest >&2 + retcode=1 + fi + rm $tmp_slaptest + return $retcode +} + +function check_certs_perms() +{ + retcode=0 + for cert in `certificates`; do + run_as_ldap "/usr/bin/test -e \"$cert\"" + if [ $? -ne 0 ]; then + error "TLS certificate/key/DB '%s' was not found." "$cert" + retcoder=1 + continue + fi + run_as_ldap "/usr/bin/test -r \"$cert\"" + if [ $? -ne 0 ]; then + error "TLS certificate/key/DB '%s' is not readable." "$cert" + retcode=1 + fi + done + return $retcode +} + +function check_db_perms() +{ + retcode=0 + for dbdir in `databases`; do + [ -d "$dbdir" ] || continue + for dbfile in `find ${dbdir} -maxdepth 1 -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" -or -name "log.*" -or -name "alock"`; do + run_as_ldap "/usr/bin/test -r \"$dbfile\" -a -w \"$dbfile\"" + if [ $? -ne 0 ]; then + error "Read/write permissions for DB file '%s' are required." "$dbfile" + retcode=1 + fi + done + done + return $retcode +} + +function check_everything() +{ + retcode=0 + check_config_syntax || retcode=1 + # TODO: need support for Mozilla NSS, disabling temporarily + #check_certs_perms || retcode=1 + check_db_perms || retcode=1 + return $retcode +} + +if [ `id -u` -ne 0 ]; then + error "You have to be root to run this script." + exit 4 +fi + +load_sysconfig + +if [ -n "$SLAPD_CONFIG_DIR" ]; then + if [ ! -d "$SLAPD_CONFIG_DIR" ]; then + error "Configuration directory '%s' does not exist." "$SLAPD_CONFIG_DIR" + else + check_everything + exit $? + fi +fi + +if [ -n "$SLAPD_CONFIG_FILE" ]; then + if [ ! -f "$SLAPD_CONFIG_FILE" ]; then + error "Configuration file '%s' does not exist." "$SLAPD_CONFIG_FILE" + else + error "Warning: Usage of a configuration file is obsolete!" + check_everything + exit $? + fi +fi + +exit 1 diff --git a/SOURCES/libexec-functions b/SOURCES/libexec-functions new file mode 100644 index 0000000..990d2b8 --- /dev/null +++ b/SOURCES/libexec-functions @@ -0,0 +1,134 @@ +# Author: Jan Vcelak + +SLAPD_USER= +SLAPD_CONFIG_FILE= +SLAPD_CONFIG_DIR= +SLAPD_CONFIG_CUSTOM= +SLAPD_GLOBAL_OPTIONS= +SLAPD_SYSCONFIG_FILE= + +function default_config() +{ + SLAPD_USER=ldap + SLAPD_CONFIG_FILE=/etc/openldap/slapd.conf + SLAPD_CONFIG_DIR=/etc/openldap/slapd.d + SLAPD_CONFIG_CUSTOM= + SLAPD_GLOBAL_OPTIONS= + SLAPD_SYSCONFIG_FILE=/etc/sysconfig/slapd +} + +function parse_config_options() +{ + user= + config_file= + config_dir= + while getopts :u:f:F: opt; do + case "$opt" in + u) + user="$OPTARG" + ;; + f) + config_file="$OPTARG" + ;; + F) + config_dir="$OPTARG" + ;; + esac + done + + if [ -n "$user" ]; then + SLAPD_USER="$user" + fi + + if [ -n "$config_dir" ]; then + SLAPD_CONFIG_DIR="$config_dir" + SLAPD_CONFIG_FILE= + SLAPD_CONFIG_CUSTOM=1 + SLAPD_GLOBAL_OPTIONS="-F '$config_dir'" + elif [ -n "$config_file" ]; then + SLAPD_CONFIG_DIR= + SLAPD_CONFIG_FILE="$config_file" + SLAPD_CONFIG_CUSTOM=1 + SLAPD_GLOBAL_OPTIONS="-f '$config_file'" + fi +} + +function uses_new_config() +{ + [ -n "$SLAPD_CONFIG_DIR" ] + return $? +} + +function run_as_ldap() +{ + /sbin/runuser --shell /bin/sh --session-command "$1" "$SLAPD_USER" + return $? +} + +function ldif_unbreak() +{ + sed ':a;N;s/\n //;ta;P;D' +} + +function ldif_value() +{ + sed 's/^[^:]*: //' +} + +function databases_new() +{ + slapcat $SLAPD_GLOBAL_OPTIONS -c \ + -H 'ldap:///cn=config???(|(objectClass=olcBdbConfig)(objectClass=olcHdbConfig))' 2>/dev/null | \ + ldif_unbreak | \ + grep '^olcDbDirectory: ' | \ + ldif_value +} + +function databases_old() +{ + awk 'begin { database="" } + $1 == "database" { database=$2 } + $1 == "directory" { if (database == "bdb" || database == "hdb") print $2}' \ + "$SLAPD_CONFIG_FILE" +} + +function certificates_new() +{ + slapcat $SLAPD_GLOBAL_OPTIONS -c -H 'ldap:///cn=config???(cn=config)' 2>/dev/null | \ + ldif_unbreak | \ + grep '^olcTLS\(CACertificateFile\|CACertificatePath\|CertificateFile\|CertificateKeyFile\): ' | \ + ldif_value +} + +function certificates_old() +{ + awk '$1 ~ "^TLS(CACertificate(File|Path)|CertificateFile|CertificateKeyFile)$" { print $2 } ' \ + "$SLAPD_CONFIG_FILE" +} + +function certificates() +{ + uses_new_config && certificates_new || certificates_old +} + +function databases() +{ + uses_new_config && databases_new || databases_old +} + + +function error() +{ + format="$1\n"; shift + printf "$format" $@ >&2 +} + +function load_sysconfig() +{ + [ -r "$SLAPD_SYSCONFIG_FILE" ] || return + + . "$SLAPD_SYSCONFIG_FILE" + [ -n "$SLAPD_OPTIONS" ] && parse_config_options $SLAPD_OPTIONS +} + +default_config diff --git a/SOURCES/libexec-upgrade-db.sh b/SOURCES/libexec-upgrade-db.sh new file mode 100755 index 0000000..1543c80 --- /dev/null +++ b/SOURCES/libexec-upgrade-db.sh @@ -0,0 +1,40 @@ +#!/bin/sh +# Author: Jan Vcelak + +. /usr/libexec/openldap/functions + +if [ `id -u` -ne 0 ]; then + error "You have to be root to run this command." + exit 4 +fi + +load_sysconfig +retcode=0 + +for dbdir in `databases`; do + upgrade_log="$dbdir/db_upgrade.`date +%Y%m%d%H%M%S`.log" + bdb_files=`find "$dbdir" -maxdepth 1 -name "*.bdb" -printf '"%f" '` + + # skip uninitialized database + [ -z "$bdb_files"] || continue + + printf "Updating '%s', logging into '%s'\n" "$dbdir" "$upgrade_log" + + # perform the update + for command in \ + "/usr/bin/db_recover -v -h \"$dbdir\"" \ + "/usr/bin/db_upgrade -v -h \"$dbdir\" $bdb_files" \ + "/usr/bin/db_checkpoint -v -h \"$dbdir\" -1" \ + ; do + printf "Executing: %s\n" "$command" &>>$upgrade_log + run_as_ldap "$command" &>>$upgrade_log + result=$? + printf "Exit code: %d\n" $result >>"$upgrade_log" + if [ $result -ne 0 ]; then + printf "Upgrade failed: %d\n" $result + retcode=1 + fi + done +done + +exit $retcode diff --git a/SOURCES/openldap-ai-addrconfig.patch b/SOURCES/openldap-ai-addrconfig.patch new file mode 100644 index 0000000..0858fac --- /dev/null +++ b/SOURCES/openldap-ai-addrconfig.patch @@ -0,0 +1,20 @@ +use AI_ADDRCONFIG if defined in the environment + +Author: Jan Vcelak +Upstream ITS: #7326 +Resolves: #835013 + +diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c +index b31e05d..fa361ab 100644 +--- a/libraries/libldap/os-ip.c ++++ b/libraries/libldap/os-ip.c +@@ -594,8 +594,7 @@ ldap_connect_to_host(LDAP *ld, Sockbuf *sb, + + #if defined( HAVE_GETADDRINFO ) && defined( HAVE_INET_NTOP ) + memset( &hints, '\0', sizeof(hints) ); +-#ifdef USE_AI_ADDRCONFIG /* FIXME: configure test needed */ +- /* Use AI_ADDRCONFIG only on systems where its known to be needed. */ ++#ifdef AI_ADDRCONFIG + hints.ai_flags = AI_ADDRCONFIG; + #endif + hints.ai_family = ldap_int_inet4or6; diff --git a/SOURCES/openldap-allop-overlay.patch b/SOURCES/openldap-allop-overlay.patch new file mode 100644 index 0000000..608ee44 --- /dev/null +++ b/SOURCES/openldap-allop-overlay.patch @@ -0,0 +1,40 @@ +Compile AllOp together with other overlays. + +Author: Matus Honek +Resolves: #1319782 + +diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in +--- a/servers/slapd/overlays/Makefile.in ++++ b/servers/slapd/overlays/Makefile.in +@@ -33,7 +33,8 @@ SRCS = overlays.c \ + translucent.c \ + unique.c \ + valsort.c \ +- smbk5pwd.c ++ smbk5pwd.c \ ++ allop.c + OBJS = statover.o \ + @SLAPD_STATIC_OVERLAYS@ \ + overlays.o +@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) + UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) + + LIBRARY = ../liboverlays.a +-PROGRAMS = @SLAPD_DYNAMIC_OVERLAYS@ smbk5pwd.la ++PROGRAMS = @SLAPD_DYNAMIC_OVERLAYS@ smbk5pwd.la allop.la + + XINCPATH = -I.. -I$(srcdir)/.. + XDEFS = $(MODULES_CPPFLAGS) +@@ -125,6 +126,12 @@ unique.la : unique.lo + smbk5pwd.la : smbk5pwd.lo + $(LTLINK_MOD) -module -o $@ smbk5pwd.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) + ++allop.lo : allop.c ++ $(LTCOMPILE_MOD) -DDO_SAMBA -UHAVE_MOZNSS -DHAVE_OPENSSL $(shell pkg-config openssl --cflags) $< ++ ++allop.la : allop.lo ++ $(LTLINK_MOD) -module -o $@ allop.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) ++ + install-local: $(PROGRAMS) + @if test -n "$?" ; then \ + $(MKDIR) $(DESTDIR)$(moduledir); \ diff --git a/SOURCES/openldap-cbinding-Add-channel-binding-support.patch b/SOURCES/openldap-cbinding-Add-channel-binding-support.patch new file mode 100644 index 0000000..42efaee --- /dev/null +++ b/SOURCES/openldap-cbinding-Add-channel-binding-support.patch @@ -0,0 +1,291 @@ +From ca310ebff44f10739fd75aff437c7676e089b134 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Mon, 26 Aug 2013 23:31:48 -0700 +Subject: [PATCH] Add channel binding support + +Currently only implemented for OpenSSL. +Needs an option to set the criticality flag. +--- + include/ldap_pvt.h | 1 + + libraries/libldap/cyrus.c | 22 ++++++++++++++++++++++ + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/ldap-tls.h | 2 ++ + libraries/libldap/tls2.c | 7 +++++++ + libraries/libldap/tls_g.c | 7 +++++++ + libraries/libldap/tls_m.c | 7 +++++++ + libraries/libldap/tls_o.c | 16 ++++++++++++++++ + servers/slapd/connection.c | 8 ++++++++ + servers/slapd/sasl.c | 18 ++++++++++++++++++ + servers/slapd/slap.h | 1 + + 11 files changed, 90 insertions(+) + +diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h +index 716c1a90f..61c620785 100644 +--- a/include/ldap_pvt.h ++++ b/include/ldap_pvt.h +@@ -420,6 +420,7 @@ LDAP_F (int) ldap_pvt_tls_get_my_dn LDAP_P(( void *ctx, struct berval *dn, + LDAP_F (int) ldap_pvt_tls_get_peer_dn LDAP_P(( void *ctx, struct berval *dn, + LDAPDN_rewrite_dummy *func, unsigned flags )); + LDAP_F (int) ldap_pvt_tls_get_strength LDAP_P(( void *ctx )); ++LDAP_F (int) ldap_pvt_tls_get_unique LDAP_P(( void *ctx, struct berval *buf, int is_server )); + + LDAP_END_DECL + +diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c +index 4c0089d5d..3171d56a3 100644 +--- a/libraries/libldap/cyrus.c ++++ b/libraries/libldap/cyrus.c +@@ -360,6 +360,10 @@ int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc ) + lc->lconn_sasl_sockctx = NULL; + lc->lconn_sasl_authctx = NULL; + } ++ if( lc->lconn_sasl_cbind ) { ++ ldap_memfree( lc->lconn_sasl_cbind ); ++ lc->lconn_sasl_cbind = NULL; ++ } + + return LDAP_SUCCESS; + } +@@ -492,6 +496,24 @@ ldap_int_sasl_bind( + + (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac ); + LDAP_FREE( authid.bv_val ); ++#ifdef SASL_CHANNEL_BINDING /* 2.1.25+ */ ++ { ++ char cbinding[64]; ++ struct berval cbv = { sizeof(cbinding), cbinding }; ++ if ( ldap_pvt_tls_get_unique( ssl, &cbv, 0 )) { ++ sasl_channel_binding_t *cb = ldap_memalloc( sizeof(*cb) + ++ cbv.bv_len); ++ cb->name = "ldap"; ++ cb->critical = 0; ++ cb->data = (char *)(cb+1); ++ cb->len = cbv.bv_len; ++ memcpy( cb->data, cbv.bv_val, cbv.bv_len ); ++ sasl_setprop( ld->ld_defconn->lconn_sasl_authctx, ++ SASL_CHANNEL_BINDING, cb ); ++ ld->ld_defconn->lconn_sasl_cbind = cb; ++ } ++ } ++#endif + } + #endif + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 98ad4dc05..397894271 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -308,6 +308,7 @@ typedef struct ldap_conn { + #ifdef HAVE_CYRUS_SASL + void *lconn_sasl_authctx; /* context for bind */ + void *lconn_sasl_sockctx; /* for security layer */ ++ void *lconn_sasl_cbind; /* for channel binding */ + #endif + #ifdef HAVE_GSSAPI + void *lconn_gss_ctx; /* gss_ctx_id_t */ +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index c8a27112f..0ecf81ab9 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -41,6 +41,7 @@ typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len + typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); + typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_strength)(tls_session *sess); ++typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); + + typedef void (TI_thr_init)(void); + +@@ -64,6 +65,7 @@ typedef struct tls_impl { + TI_session_dn *ti_session_peer_dn; + TI_session_chkhost *ti_session_chkhost; + TI_session_strength *ti_session_strength; ++ TI_session_unique *ti_session_unique; + + Sockbuf_IO *ti_sbio; + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 82ca5272c..13d734362 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -1013,6 +1013,13 @@ ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, + rc = ldap_X509dn2bv(&der_dn, dn, (LDAPDN_rewrite_func *)func, flags ); + return rc; + } ++ ++int ++ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) ++{ ++ tls_session *session = s; ++ return tls_imp->ti_session_unique( session, buf, is_server ); ++} + #endif /* HAVE_TLS */ + + int +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 3b72cd2a1..b78c12086 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -669,6 +669,12 @@ tlsg_session_strength( tls_session *session ) + return gnutls_cipher_get_key_size( c ) * 8; + } + ++static int ++tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) ++{ ++ return 0; ++} ++ + /* suites is a string of colon-separated cipher suite names. */ + static int + tlsg_parse_ciphers( tlsg_ctx *ctx, char *suites ) +@@ -925,6 +931,7 @@ tls_impl ldap_int_tls_impl = { + tlsg_session_peer_dn, + tlsg_session_chkhost, + tlsg_session_strength, ++ tlsg_session_unique, + + &tlsg_sbio, + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index 43fbae4bc..c64f4c176 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -2874,6 +2874,12 @@ tlsm_session_strength( tls_session *session ) + return rc ? 0 : keySize; + } + ++static int ++tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server) ++{ ++ return 0; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -3302,6 +3308,7 @@ tls_impl ldap_int_tls_impl = { + tlsm_session_peer_dn, + tlsm_session_chkhost, + tlsm_session_strength, ++ tlsm_session_unique, + + &tlsm_sbio, + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index a13f11fb5..f741a461f 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -846,6 +846,21 @@ tlso_session_strength( tls_session *sess ) + return SSL_CIPHER_get_bits(SSL_get_current_cipher(s), NULL); + } + ++static int ++tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) ++{ ++ tlso_session *s = (tlso_session *)sess; ++ ++ /* Usually the client sends the finished msg. But if the ++ * session was resumed, the server sent the msg. ++ */ ++ if (SSL_session_reused(s) ^ !is_server) ++ buf->bv_len = SSL_get_finished(s, buf->bv_val, buf->bv_len); ++ else ++ buf->bv_len = SSL_get_peer_finished(s, buf->bv_val, buf->bv_len); ++ return buf->bv_len; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -1363,6 +1378,7 @@ tls_impl ldap_int_tls_impl = { + tlso_session_peer_dn, + tlso_session_chkhost, + tlso_session_strength, ++ tlso_session_unique, + + &tlso_sbio, + +diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c +index 44c3fc63d..0602fdceb 100644 +--- a/servers/slapd/connection.c ++++ b/servers/slapd/connection.c +@@ -406,6 +406,7 @@ Connection * connection_init( + c->c_sasl_sockctx = NULL; + c->c_sasl_extra = NULL; + c->c_sasl_bindop = NULL; ++ c->c_sasl_cbind = NULL; + + c->c_sb = ber_sockbuf_alloc( ); + +@@ -451,6 +452,7 @@ Connection * connection_init( + assert( c->c_sasl_sockctx == NULL ); + assert( c->c_sasl_extra == NULL ); + assert( c->c_sasl_bindop == NULL ); ++ assert( c->c_sasl_cbind == NULL ); + assert( c->c_currentber == NULL ); + assert( c->c_writewaiter == 0); + assert( c->c_writers == 0); +@@ -1428,6 +1430,12 @@ connection_read( ber_socket_t s, conn_readinfo *cri ) + c->c_connid, (int) s, c->c_tls_ssf, c->c_ssf, 0 ); + slap_sasl_external( c, c->c_tls_ssf, &authid ); + if ( authid.bv_val ) free( authid.bv_val ); ++ { ++ char cbinding[64]; ++ struct berval cbv = { sizeof(cbinding), cbinding }; ++ if ( ldap_pvt_tls_get_unique( ssl, &cbv, 1 )) ++ slap_sasl_cbinding( c, &cbv ); ++ } + } else if ( rc == 1 && ber_sockbuf_ctrl( c->c_sb, + LBER_SB_OPT_NEEDS_WRITE, NULL )) { /* need to retry */ + slapd_set_write( s, 1 ); +diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c +index 5144170d1..258cd5407 100644 +--- a/servers/slapd/sasl.c ++++ b/servers/slapd/sasl.c +@@ -1389,6 +1389,21 @@ int slap_sasl_external( + return LDAP_SUCCESS; + } + ++int slap_sasl_cbinding( Connection *conn, struct berval *cbv ) ++{ ++#ifdef SASL_CHANNEL_BINDING ++ sasl_channel_binding_t *cb = ch_malloc( sizeof(*cb) + cbv->bv_len );; ++ cb->name = "ldap"; ++ cb->critical = 0; ++ cb->data = (char *)(cb+1); ++ cb->len = cbv->bv_len; ++ memcpy( cb->data, cbv->bv_val, cbv->bv_len ); ++ sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); ++ conn->c_sasl_cbind = cb; ++#endif ++ return LDAP_SUCCESS; ++} ++ + int slap_sasl_reset( Connection *conn ) + { + return LDAP_SUCCESS; +@@ -1454,6 +1469,9 @@ int slap_sasl_close( Connection *conn ) + free( conn->c_sasl_extra ); + conn->c_sasl_extra = NULL; + ++ free( conn->c_sasl_cbind ); ++ conn->c_sasl_cbind = NULL; ++ + #elif defined(SLAP_BUILTIN_SASL) + SASL_CTX *ctx = conn->c_sasl_authctx; + if( ctx ) { +diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h +index 7581967be..ad797d752 100644 +--- a/servers/slapd/slap.h ++++ b/servers/slapd/slap.h +@@ -2910,6 +2910,7 @@ struct Connection { + void *c_sasl_authctx; /* SASL authentication context */ + void *c_sasl_sockctx; /* SASL security layer context */ + void *c_sasl_extra; /* SASL session extra stuff */ ++ void *c_sasl_cbind; /* SASL channel binding */ + Operation *c_sasl_bindop; /* set to current op if it's a bind */ + + #ifdef LDAP_X_TXN +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-Convert-test077-to-LDIF-config.patch b/SOURCES/openldap-cbinding-Convert-test077-to-LDIF-config.patch new file mode 100644 index 0000000..5ca02fb --- /dev/null +++ b/SOURCES/openldap-cbinding-Convert-test077-to-LDIF-config.patch @@ -0,0 +1,236 @@ +From 59bdc8158f51fc22cc3c6d6dd2db9e5aa4bcfdc4 Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Mon, 27 Apr 2020 23:24:16 -0700 +Subject: [PATCH] Convert test077 to LDIF config + +--- + tests/data/slapd-sasl-gssapi.conf | 65 ------------------ + tests/scripts/defines.sh | 1 - + tests/scripts/test077-sasl-gssapi | 108 ++++++++++++++++++++++++++++-- + 3 files changed, 103 insertions(+), 71 deletions(-) + delete mode 100644 tests/data/slapd-sasl-gssapi.conf + +diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf +deleted file mode 100644 +index 611fc7097..000000000 +--- a/tests/data/slapd-sasl-gssapi.conf ++++ /dev/null +@@ -1,65 +0,0 @@ +-# stand-alone slapd config -- for testing (with indexing) +-# $OpenLDAP$ +-## This work is part of OpenLDAP Software . +-## +-## Copyright 1998-2020 The OpenLDAP Foundation. +-## All rights reserved. +-## +-## Redistribution and use in source and binary forms, with or without +-## modification, are permitted only as authorized by the OpenLDAP +-## Public License. +-## +-## A copy of this license is available in the file LICENSE in the +-## top-level directory of the distribution or, alternatively, at +-## . +- +-# +-include @SCHEMADIR@/core.schema +-include @SCHEMADIR@/cosine.schema +-# +-include @SCHEMADIR@/corba.schema +-include @SCHEMADIR@/java.schema +-include @SCHEMADIR@/inetorgperson.schema +-include @SCHEMADIR@/misc.schema +-include @SCHEMADIR@/nis.schema +-include @SCHEMADIR@/openldap.schema +-# +-include @SCHEMADIR@/duaconf.schema +-include @SCHEMADIR@/dyngroup.schema +- +-# +-pidfile @TESTDIR@/slapd.1.pid +-argsfile @TESTDIR@/slapd.1.args +- +-# SSL configuration +-TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt +-TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key +-TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt +- +-# +-rootdse @DATADIR@/rootdse.ldif +- +-#mod#modulepath ../servers/slapd/back-@BACKEND@/ +-#mod#moduleload back_@BACKEND@.la +-#monitormod#modulepath ../servers/slapd/back-monitor/ +-#monitormod#moduleload back_monitor.la +- +- +-####################################################################### +-# database definitions +-####################################################################### +- +-database @BACKEND@ +-suffix "dc=example,dc=com" +-rootdn "cn=Manager,dc=example,dc=com" +-rootpw secret +-#~null~#directory @TESTDIR@/db.1.a +-#indexdb#index objectClass eq +-#indexdb#index mail eq +-#ndb#dbname db_1_a +-#ndb#include @DATADIR@/ndb.conf +- +-#monitor#database monitor +- +-sasl-realm @KRB5REALM@ +-sasl-host localhost +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index 78dc1f8ae..76c85b442 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -108,7 +108,6 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf + SCHEMACONF=$DATADIR/slapd-schema.conf + TLSCONF=$DATADIR/slapd-tls.conf + TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf +-SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf + GLUECONF=$DATADIR/slapd-glue.conf + REFINTCONF=$DATADIR/slapd-refint.conf + RETCODECONF=$DATADIR/slapd-retcode.conf +diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi +index bde9006ca..322df60a4 100755 +--- a/tests/scripts/test077-sasl-gssapi ++++ b/tests/scripts/test077-sasl-gssapi +@@ -21,15 +21,40 @@ if test $WITH_SASL = no ; then + exit 0 + fi + +-mkdir -p $TESTDIR $DBDIR1 ++CONFDIR=$TESTDIR/slapd.d ++CONFLDIF=$TESTDIR/slapd.ldif ++ ++mkdir -p $TESTDIR $DBDIR1 $CONFDIR + cp -r $DATADIR/tls $TESTDIR ++$SLAPPASSWD -g -n >$CONFIGPWF + + echo "Starting KDC for SASL/GSSAPI tests..." + . $SRCDIR/scripts/setup_kdc.sh + +-echo "Running slapadd to build slapd database..." +-. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1 +-$SLAPADD -f $CONF1 -l $LDIFORDERED ++echo "Configuring slapd..." ++cat > $CONFLDIF < $LOG1 2>&1 & ++$SLAPD -F $CONFDIR -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & + PID=$! + if test $WAIT != 0 ; then + echo PID $PID +@@ -141,6 +166,79 @@ else + fi + fi + ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, skipping channe-binding test" ++elif test $HAVE_SASL_GSS_CBIND = no ; then ++ echo "SASL has no channel-binding support in GSSAPI, test skipped" ++else ++ echo "Testing SASL/GSSAPI with SASL_CBINDING..." ++ ++ for acb in "none" "tls-unique" "tls-endpoint" ; do ++ ++ echo "Modifying slapd's olcSaslCBinding to ${acb} ..." ++ $LDAPMODIFY -D cn=config -H $URI1 -y $CONFIGPWF < $TESTOUT 2>&1 ++dn: cn=config ++changetype: modify ++replace: olcSaslCBinding ++olcSaslCBinding: ${acb} ++EOF ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapmodify failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ ++ for icb in "none" "tls-unique" "tls-endpoint" ; do ++ ++ # The gnutls implemantation of "tls-unique" seems broken ++ if test $icb = "tls-unique" -o $acb = "tls-unique" ; then ++ if test $WITH_TLS_TYPE == gnutls ; then ++ continue ++ fi ++ fi ++ ++ fail="no" ++ if test $icb != $acb -a $acb != "none" ; then ++ # This currently fails in MIT, but it is planned to be ++ # fixed not to fail like in heimdal - avoid testing. ++ if test $icb = "none" ; then ++ continue ++ fi ++ # Otherwise unmatching bindings are expected to fail. ++ fail="yes" ++ fi ++ ++ echo -n "Using ldapwhoami with SASL/GSSAPI and SASL_CBINDING " ++ echo -ne "(client: ${icb},\tserver: ${acb}): " ++ ++ $LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow \ ++ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ -o SASL_CBINDING=$icb > $TESTOUT 2>&1 ++ ++ RC=$? ++ if test $RC != 0 ; then ++ if test $fail = "no" ; then ++ echo "test failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ elif test $fail = "yes" ; then ++ echo "failed: command succeeded unexpectedly." ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++ fi ++ ++ echo "success" ++ RC=0 ++ done ++ done ++fi ++ ++ + kill $KDCPROC + test $KILLSERVERS != no && kill -HUP $KILLPIDS + +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-Fix-slaptest-in-test077.patch b/SOURCES/openldap-cbinding-Fix-slaptest-in-test077.patch new file mode 100644 index 0000000..0e93108 --- /dev/null +++ b/SOURCES/openldap-cbinding-Fix-slaptest-in-test077.patch @@ -0,0 +1,39 @@ +From e006994d83af9dcb7813a18253cf4e5beacee043 Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Sun, 26 Apr 2020 11:40:23 -0700 +Subject: [PATCH] Fix slaptest in test077 + +The libtool wrapper scripts lose argv[0] when exec'ing the real binary. + +In the CI Docker container, where the build runs as root, this was +actually starting a real slapd on the default port. + +Outside Docker, running as a non-root user, this slapd would just fail +to start, and wouldn't convert the config either. + +Using "slapd -Tt" fixes the issue but also prints a warning from +slaptest since the database hasn't been initialized yet. + +Dynamic config isn't actually used in this test script, so let's just +run slapd off the config file directly. +--- + tests/scripts/test077-sasl-gssapi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi +index 64abe16fe..bde9006ca 100755 +--- a/tests/scripts/test077-sasl-gssapi ++++ b/tests/scripts/test077-sasl-gssapi +@@ -24,9 +24,6 @@ fi + mkdir -p $TESTDIR $DBDIR1 + cp -r $DATADIR/tls $TESTDIR + +-cd $TESTWD +- +- + echo "Starting KDC for SASL/GSSAPI tests..." + . $SRCDIR/scripts/setup_kdc.sh + +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch b/SOURCES/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch new file mode 100644 index 0000000..b38dd83 --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch @@ -0,0 +1,220 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From 16f8b0902c28b1eaab93ddf120ce40b89bcda8d1 Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Tue, 10 Sep 2013 04:26:51 -0700 +Subject: [PATCH] ITS#7398 add LDAP_OPT_X_TLS_PEERCERT + +retrieve peer cert for an active TLS session +--- + doc/man/man3/ldap_get_option.3 | 8 ++++++++ + include/ldap.h | 1 + + libraries/libldap/ldap-tls.h | 2 ++ + libraries/libldap/tls2.c | 24 ++++++++++++++++++++++++ + libraries/libldap/tls_g.c | 19 +++++++++++++++++++ + libraries/libldap/tls_m.c | 17 +++++++++++++++++ + libraries/libldap/tls_o.c | 16 ++++++++++++++++ + 7 files changed, 87 insertions(+) + +diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 +index eb3f25b33..7546875f5 100644 +--- a/doc/man/man3/ldap_get_option.3 ++++ b/doc/man/man3/ldap_get_option.3 +@@ -744,6 +744,14 @@ A non-zero value pointed to by + .BR invalue + tells the library to create a context for a server. + .TP ++.B LDAP_OPT_X_TLS_PEERCERT ++Gets the peer's certificate in DER format from an established TLS session. ++.BR outvalue ++must be ++.BR "struct berval *" , ++and the data it returns needs to be freed by the caller using ++.BR ldap_memfree (3). ++.TP + .B LDAP_OPT_X_TLS_PROTOCOL_MIN + Sets/gets the minimum protocol version. + .BR invalue +diff --git a/include/ldap.h b/include/ldap.h +index 389441031..88bfcabf8 100644 +--- a/include/ldap.h ++++ b/include/ldap.h +@@ -160,6 +160,7 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_TLS_PACKAGE 0x6011 + #define LDAP_OPT_X_TLS_ECNAME 0x6012 + #define LDAP_OPT_X_TLS_REQUIRE_SAN 0x601a ++#define LDAP_OPT_X_TLS_PEERCERT 0x6015 /* read-only */ + + #define LDAP_OPT_X_TLS_NEVER 0 + #define LDAP_OPT_X_TLS_HARD 1 +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index 0ecf81ab9..103004fa7 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -42,6 +42,7 @@ typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); + typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_strength)(tls_session *sess); + typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); ++typedef int (TI_session_peercert)(tls_session *s, struct berval *der); + + typedef void (TI_thr_init)(void); + +@@ -66,6 +67,7 @@ typedef struct tls_impl { + TI_session_chkhost *ti_session_chkhost; + TI_session_strength *ti_session_strength; + TI_session_unique *ti_session_unique; ++ TI_session_peercert *ti_session_peercert; + + Sockbuf_IO *ti_sbio; + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 13d734362..ad09ba39b 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -705,6 +705,23 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) + case LDAP_OPT_X_TLS_CONNECT_ARG: + *(void **)arg = lo->ldo_tls_connect_arg; + break; ++ case LDAP_OPT_X_TLS_PEERCERT: { ++ void *sess = NULL; ++ struct berval *bv = arg; ++ bv->bv_len = 0; ++ bv->bv_val = NULL; ++ if ( ld != NULL ) { ++ LDAPConn *conn = ld->ld_defconn; ++ if ( conn != NULL ) { ++ Sockbuf *sb = conn->lconn_sb; ++ sess = ldap_pvt_tls_sb_ctx( sb ); ++ if ( sess != NULL ) ++ return ldap_pvt_tls_get_peercert( sess, bv ); ++ } ++ } ++ break; ++ } ++ + default: + return -1; + } +@@ -1020,6 +1037,13 @@ ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) + tls_session *session = s; + return tls_imp->ti_session_unique( session, buf, is_server ); + } ++ ++int ++ldap_pvt_tls_get_peercert( void *s, struct berval *der ) ++{ ++ tls_session *session = s; ++ return tls_imp->ti_session_peercert( session, der ); ++} + #endif /* HAVE_TLS */ + + int +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index b78c12086..26d9f99ce 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -675,6 +675,24 @@ tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) + return 0; + } + ++static int ++tlsg_session_peercert( tls_session *sess, struct berval *der ) ++{ ++ tlsg_session *s = (tlsg_session *)sess; ++ const gnutls_datum_t *peer_cert_list; ++ unsigned int list_size; ++ ++ peer_cert_list = gnutls_certificate_get_peers( s->session, &list_size ); ++ if (!peer_cert_list) ++ return -1; ++ der->bv_len = peer_cert_list[0].size; ++ der->bv_val = LDAP_MALLOC( der->bv_len ); ++ if (!der->bv_val) ++ return -1; ++ memcpy(der->bv_val, peer_cert_list[0].data, der->bv_len); ++ return 0; ++} ++ + /* suites is a string of colon-separated cipher suite names. */ + static int + tlsg_parse_ciphers( tlsg_ctx *ctx, char *suites ) +@@ -932,6 +950,7 @@ tls_impl ldap_int_tls_impl = { + tlsg_session_chkhost, + tlsg_session_strength, + tlsg_session_unique, ++ tlsg_session_peercert, + + &tlsg_sbio, + +diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c +index c64f4c176..d35a803de 100644 +--- a/libraries/libldap/tls_m.c ++++ b/libraries/libldap/tls_m.c +@@ -2880,6 +2880,22 @@ tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server) + return 0; + } + ++static int ++tlsm_session_peercert( tls_session *sess, struct berval *der ) ++{ ++ tlsm_session *s = (tlsm_session *)sess; ++ CERTCertificate *cert; ++ cert = SSL_PeerCertificate( s ); ++ if (!cert) ++ return -1; ++ der->bv_len = cert->derCert.len; ++ der->bv_val = LDAP_MALLOC( der->bv_len ); ++ if (!der->bv_val) ++ return -1; ++ memcpy( der->bv_val, cert->derCert.data, der->bv_len ); ++ return 0; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -3309,6 +3325,7 @@ tls_impl ldap_int_tls_impl = { + tlsm_session_chkhost, + tlsm_session_strength, + tlsm_session_unique, ++ tlsm_session_peercert, + + &tlsm_sbio, + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index f741a461f..157923289 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -861,6 +861,21 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) + return buf->bv_len; + } + ++static int ++tlso_session_peercert( tls_session *sess, struct berval *der ) ++{ ++ tlso_session *s = (tlso_session *)sess; ++ unsigned char *ptr; ++ X509 *x = SSL_get_peer_certificate(s); ++ der->bv_len = i2d_X509(x, NULL); ++ der->bv_val = LDAP_MALLOC(der->bv_len); ++ if ( !der->bv_val ) ++ return -1; ++ ptr = der->bv_val; ++ i2d_X509(x, &ptr); ++ return 0; ++} ++ + /* + * TLS support for LBER Sockbufs + */ +@@ -1379,6 +1394,7 @@ tls_impl ldap_int_tls_impl = { + tlso_session_chkhost, + tlso_session_strength, + tlso_session_unique, ++ tlso_session_peercert, + + &tlso_sbio, + +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch b/SOURCES/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch new file mode 100644 index 0000000..404c4a4 --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch @@ -0,0 +1,70 @@ +From 465b1c5972eef1d4e60eb98ae3776d33e270853d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Fri, 15 Jun 2018 15:12:28 +0100 +Subject: [PATCH] ITS#8573 Add missing URI variables for tests + +--- + tests/scripts/conf.sh | 18 ++++++++++++++++++ + tests/scripts/defines.sh | 7 +++++++ + 2 files changed, 25 insertions(+) + +diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh +index 9a33d88e9..2a859d89d 100755 +--- a/tests/scripts/conf.sh ++++ b/tests/scripts/conf.sh +@@ -74,6 +74,24 @@ sed -e "s/@BACKEND@/${BACKEND}/" \ + -e "s;@PORT4@;${PORT4};" \ + -e "s;@PORT5@;${PORT5};" \ + -e "s;@PORT6@;${PORT6};" \ ++ -e "s;@SURI1@;${SURI1};" \ ++ -e "s;@SURI2@;${SURI2};" \ ++ -e "s;@SURI3@;${SURI3};" \ ++ -e "s;@SURI4@;${SURI4};" \ ++ -e "s;@SURI5@;${SURI5};" \ ++ -e "s;@SURI6@;${SURI6};" \ ++ -e "s;@URIP1@;${URIP1};" \ ++ -e "s;@URIP2@;${URIP2};" \ ++ -e "s;@URIP3@;${URIP3};" \ ++ -e "s;@URIP4@;${URIP4};" \ ++ -e "s;@URIP5@;${URIP5};" \ ++ -e "s;@URIP6@;${URIP6};" \ ++ -e "s;@SURIP1@;${SURIP1};" \ ++ -e "s;@SURIP2@;${SURIP2};" \ ++ -e "s;@SURIP3@;${SURIP3};" \ ++ -e "s;@SURIP4@;${SURIP4};" \ ++ -e "s;@SURIP5@;${SURIP5};" \ ++ -e "s;@SURIP6@;${SURIP6};" \ + -e "s/@SASL_MECH@/${SASL_MECH}/" \ + -e "s;@TESTDIR@;${TESTDIR};" \ + -e "s;@TESTWD@;${TESTWD};" \ +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index 8f7c7b853..26dab1bae 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -221,16 +221,23 @@ URIP2="ldap://${LOCALIP}:$PORT2/" + URI3="ldap://${LOCALHOST}:$PORT3/" + URIP3="ldap://${LOCALIP}:$PORT3/" + URI4="ldap://${LOCALHOST}:$PORT4/" ++URIP4="ldap://${LOCALIP}:$PORT4/" + URI5="ldap://${LOCALHOST}:$PORT5/" ++URIP5="ldap://${LOCALIP}:$PORT5/" + URI6="ldap://${LOCALHOST}:$PORT6/" ++URIP6="ldap://${LOCALIP}:$PORT6/" + SURI1="ldaps://${LOCALHOST}:$PORT1/" + SURIP1="ldaps://${LOCALIP}:$PORT1/" + SURI2="ldaps://${LOCALHOST}:$PORT2/" + SURIP2="ldaps://${LOCALIP}:$PORT2/" + SURI3="ldaps://${LOCALHOST}:$PORT3/" ++SURIP3="ldaps://${LOCALIP}:$PORT3/" + SURI4="ldaps://${LOCALHOST}:$PORT4/" ++SURIP4="ldaps://${LOCALIP}:$PORT4/" + SURI5="ldaps://${LOCALHOST}:$PORT5/" ++SURIP5="ldaps://${LOCALIP}:$PORT5/" + SURI6="ldaps://${LOCALHOST}:$PORT6/" ++SURIP6="ldaps://${LOCALIP}:$PORT6/" + + # LDIF + LDIF=$DATADIR/test.ldif +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch b/SOURCES/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch new file mode 100644 index 0000000..e9f5172 --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-8573-TLS-option-test-suite.patch @@ -0,0 +1,2108 @@ +From eb087e0861f207858a4e08c72836a86f26d9701c Mon Sep 17 00:00:00 2001 +From: Quanah Gibson-Mount +Date: Thu, 14 Jun 2018 16:12:59 +0100 +Subject: [PATCH] ITS#8573 TLS option test suite + +--- + configure | 4 + + configure.in | 4 + + tests/data/slapd-tls-sasl.conf | 65 ++ + tests/data/slapd-tls.conf | 61 ++ + tests/data/tls/ca/certs/testsuiteCA.crt | 16 + + tests/data/tls/ca/private/testsuiteCA.key | 16 + + .../tls/certs/bjensen@mailgw.example.com.crt | 16 + + tests/data/tls/certs/localhost.crt | 16 + + tests/data/tls/conf/openssl.cnf | 129 ++++ + tests/data/tls/create-crt.sh | 78 +++ + .../private/bjensen@mailgw.example.com.key | 16 + + tests/data/tls/private/localhost.key | 16 + + tests/run.in | 3 +- + tests/scripts/defines.sh | 21 +- + tests/scripts/test067-tls | 140 +++++ + tests/scripts/test068-sasl-tls-external | 102 ++++ + .../test069-delta-multimaster-starttls | 574 ++++++++++++++++++ + tests/scripts/test070-delta-multimaster-ldaps | 571 +++++++++++++++++ + 18 files changed, 1846 insertions(+), 2 deletions(-) + create mode 100644 tests/data/slapd-tls-sasl.conf + create mode 100644 tests/data/slapd-tls.conf + create mode 100644 tests/data/tls/ca/certs/testsuiteCA.crt + create mode 100644 tests/data/tls/ca/private/testsuiteCA.key + create mode 100644 tests/data/tls/certs/bjensen@mailgw.example.com.crt + create mode 100644 tests/data/tls/certs/localhost.crt + create mode 100644 tests/data/tls/conf/openssl.cnf + create mode 100755 tests/data/tls/create-crt.sh + create mode 100644 tests/data/tls/private/bjensen@mailgw.example.com.key + create mode 100644 tests/data/tls/private/localhost.key + create mode 100755 tests/scripts/test067-tls + create mode 100755 tests/scripts/test068-sasl-tls-external + create mode 100755 tests/scripts/test069-delta-multimaster-starttls + create mode 100755 tests/scripts/test070-delta-multimaster-ldaps + +diff --git a/configure b/configure +index e87850ec2..e8a720961 100755 +--- a/configure ++++ b/configure +@@ -758,6 +758,7 @@ AUTH_LIBS + LIBSLAPI + SLAPI_LIBS + MODULES_LIBS ++WITH_TLS_TYPE + TLS_LIBS + SASL_LIBS + KRB5_LIBS +@@ -5133,6 +5134,7 @@ KRB4_LIBS= + KRB5_LIBS= + SASL_LIBS= + TLS_LIBS= ++WITH_TLS_TYPE= + MODULES_LIBS= + SLAPI_LIBS= + LIBSLAPI= +@@ -15582,6 +15584,7 @@ fi + if test $have_openssl = yes ; then + ol_with_tls=openssl + ol_link_tls=yes ++ WITH_TLS_TYPE=openssl + + + $as_echo "#define HAVE_OPENSSL 1" >>confdefs.h +@@ -15716,6 +15719,7 @@ fi + if test $have_gnutls = yes ; then + ol_with_tls=gnutls + ol_link_tls=yes ++ WITH_TLS_TYPE=gnutls + + TLS_LIBS="-lgnutls" + +diff --git a/configure.in b/configure.in +index 0c7c0a9ee..cf143d9bf 100644 +--- a/configure.in ++++ b/configure.in +@@ -592,6 +592,7 @@ KRB4_LIBS= + KRB5_LIBS= + SASL_LIBS= + TLS_LIBS= ++WITH_TLS_TYPE= + MODULES_LIBS= + SLAPI_LIBS= + LIBSLAPI= +@@ -1186,6 +1187,7 @@ if test $ol_with_tls = openssl || test $ol_with_tls = auto ; then + if test $have_openssl = yes ; then + ol_with_tls=openssl + ol_link_tls=yes ++ WITH_TLS_TYPE=openssl + + AC_DEFINE(HAVE_OPENSSL, 1, + [define if you have OpenSSL]) +@@ -1226,6 +1228,7 @@ if test $ol_link_tls = no ; then + if test $have_gnutls = yes ; then + ol_with_tls=gnutls + ol_link_tls=yes ++ WITH_TLS_TYPE=gnutls + + TLS_LIBS="-lgnutls" + +@@ -3163,6 +3166,7 @@ AC_SUBST(KRB4_LIBS) + AC_SUBST(KRB5_LIBS) + AC_SUBST(SASL_LIBS) + AC_SUBST(TLS_LIBS) ++AC_SUBST(WITH_TLS_TYPE) + AC_SUBST(MODULES_LIBS) + AC_SUBST(SLAPI_LIBS) + AC_SUBST(LIBSLAPI) +diff --git a/tests/data/slapd-tls-sasl.conf b/tests/data/slapd-tls-sasl.conf +new file mode 100644 +index 000000000..f4bb0773e +--- /dev/null ++++ b/tests/data/slapd-tls-sasl.conf +@@ -0,0 +1,65 @@ ++# stand-alone slapd config -- for testing (with indexing) ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++# ++include @SCHEMADIR@/core.schema ++include @SCHEMADIR@/cosine.schema ++# ++include @SCHEMADIR@/corba.schema ++include @SCHEMADIR@/java.schema ++include @SCHEMADIR@/inetorgperson.schema ++include @SCHEMADIR@/misc.schema ++include @SCHEMADIR@/nis.schema ++include @SCHEMADIR@/openldap.schema ++# ++include @SCHEMADIR@/duaconf.schema ++include @SCHEMADIR@/dyngroup.schema ++include @SCHEMADIR@/ppolicy.schema ++ ++# ++pidfile @TESTDIR@/slapd.1.pid ++argsfile @TESTDIR@/slapd.1.args ++ ++# SSL configuration ++TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt ++TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key ++TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt ++TLSVerifyClient hard ++ ++# ++rootdse @DATADIR@/rootdse.ldif ++ ++#mod#modulepath ../servers/slapd/back-@BACKEND@/ ++#mod#moduleload back_@BACKEND@.la ++#monitormod#modulepath ../servers/slapd/back-monitor/ ++#monitormod#moduleload back_monitor.la ++ ++authz-regexp "email=([^,]*),cn=[^,]*,ou=OpenLDAP,o=OpenLDAP Foundation,st=CA,c=US" ldap:///ou=People,dc=example,dc=com??sub?(mail=$1) ++ ++####################################################################### ++# database definitions ++####################################################################### ++ ++database @BACKEND@ ++suffix "dc=example,dc=com" ++rootdn "cn=Manager,dc=example,dc=com" ++rootpw secret ++#~null~#directory @TESTDIR@/db.1.a ++#indexdb#index objectClass eq ++#indexdb#index mail eq ++#ndb#dbname db_1_a ++#ndb#include @DATADIR@/ndb.conf ++ ++#monitor#database monitor +diff --git a/tests/data/slapd-tls.conf b/tests/data/slapd-tls.conf +new file mode 100644 +index 000000000..6a7785557 +--- /dev/null ++++ b/tests/data/slapd-tls.conf +@@ -0,0 +1,61 @@ ++# stand-alone slapd config -- for testing (with indexing) ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++# ++include @SCHEMADIR@/core.schema ++include @SCHEMADIR@/cosine.schema ++# ++include @SCHEMADIR@/corba.schema ++include @SCHEMADIR@/java.schema ++include @SCHEMADIR@/inetorgperson.schema ++include @SCHEMADIR@/misc.schema ++include @SCHEMADIR@/nis.schema ++include @SCHEMADIR@/openldap.schema ++# ++include @SCHEMADIR@/duaconf.schema ++include @SCHEMADIR@/dyngroup.schema ++include @SCHEMADIR@/ppolicy.schema ++ ++# ++pidfile @TESTDIR@/slapd.1.pid ++argsfile @TESTDIR@/slapd.1.args ++ ++# SSL configuration ++TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key ++TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt ++ ++# ++rootdse @DATADIR@/rootdse.ldif ++ ++#mod#modulepath ../servers/slapd/back-@BACKEND@/ ++#mod#moduleload back_@BACKEND@.la ++#monitormod#modulepath ../servers/slapd/back-monitor/ ++#monitormod#moduleload back_monitor.la ++ ++####################################################################### ++# database definitions ++####################################################################### ++ ++database @BACKEND@ ++suffix "dc=example,dc=com" ++rootdn "cn=Manager,dc=example,dc=com" ++rootpw secret ++#~null~#directory @TESTDIR@/db.1.a ++#indexdb#index objectClass eq ++#indexdb#index mail eq ++#ndb#dbname db_1_a ++#ndb#include @DATADIR@/ndb.conf ++ ++#monitor#database monitor +diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt +new file mode 100644 +index 000000000..7458e7461 +--- /dev/null ++++ b/tests/data/tls/ca/certs/testsuiteCA.crt +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV ++BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv ++bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0 ++NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB ++MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB ++UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd ++rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb ++lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL ++6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU ++7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB ++SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/ ++wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws ++ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q ++aL52EFPS0o3tiAJXS82U2wrQdJ0YEw== ++-----END CERTIFICATE----- +diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key +new file mode 100644 +index 000000000..2e14d7033 +--- /dev/null ++++ b/tests/data/tls/ca/private/testsuiteCA.key +@@ -0,0 +1,16 @@ ++-----BEGIN PRIVATE KEY----- ++MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ ++WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc ++338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/ ++dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg ++O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf ++7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn ++rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f ++wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk ++AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l ++vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9 ++27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X ++KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N ++I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL +++b2qljWeZbGH ++-----END PRIVATE KEY----- +diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +new file mode 100644 +index 000000000..93e3a0d39 +--- /dev/null ++++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV ++BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx ++ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV ++BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD ++VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa ++YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A ++MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg ++QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU ++U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL ++MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn ++wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f ++7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo ++4DnnYQBDnq48VORVX94= ++-----END CERTIFICATE----- +diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt +new file mode 100644 +index 000000000..194cb119d +--- /dev/null ++++ b/tests/data/tls/certs/localhost.crt +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV ++BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx ++ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE ++CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT ++dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB ++iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4 ++7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv ++8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ ++BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A ++AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG ++8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl ++0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR ++GjeZB1FxqDGHjxBq2O828iejw28bSz4= ++-----END CERTIFICATE----- +diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf +new file mode 100644 +index 000000000..a3c8ad9f6 +--- /dev/null ++++ b/tests/data/tls/conf/openssl.cnf +@@ -0,0 +1,129 @@ ++HOME = . ++RANDFILE = $ENV::HOME/.rnd ++ ++oid_section = new_oids ++ ++[ new_oids ] ++tsa_policy1 = 1.2.3.4.1 ++tsa_policy2 = 1.2.3.4.5.6 ++tsa_policy3 = 1.2.3.4.5.7 ++ ++[ ca ] ++default_ca = CA_default # The default ca section ++ ++[ CA_default ] ++ ++dir = ./cruft # Where everything is kept ++certs = $dir/certs # Where the issued certs are kept ++crl_dir = $dir/crl # Where the issued crl are kept ++database = $dir/index.txt # database index file. ++new_certs_dir = $dir/certs # default place for new certs. ++certificate = $dir/cacert.pem # The CA certificate ++serial = $dir/serial # The current serial number ++crlnumber = $dir/crlnumber # the current crl number ++crl = $dir/crl.pem # The current CRL ++private_key = $dir/private/cakey.pem# The private key ++RANDFILE = $dir/private/.rand # private random number file ++x509_extensions = usr_cert # The extentions to add to the cert ++name_opt = ca_default # Subject Name options ++cert_opt = ca_default # Certificate field options ++default_days = 365 # how long to certify for ++default_crl_days= 30 # how long before next CRL ++default_md = default # use public key default MD ++preserve = no # keep passed DN ordering ++policy = policy_match ++ ++[ policy_match ] ++countryName = match ++stateOrProvinceName = match ++organizationName = match ++organizationalUnitName = optional ++commonName = supplied ++emailAddress = optional ++ ++[ policy_anything ] ++countryName = optional ++stateOrProvinceName = optional ++localityName = optional ++organizationName = optional ++organizationalUnitName = optional ++commonName = supplied ++emailAddress = optional ++ ++[ req ] ++default_bits = 2048 ++default_keyfile = privkey.pem ++distinguished_name = req_distinguished_name ++attributes = req_attributes ++x509_extensions = v3_ca # The extentions to add to the self signed cert ++ ++string_mask = utf8only ++ ++[ req_distinguished_name ] ++basicConstraints=CA:FALSE ++ ++[ req_attributes ] ++challengePassword = A challenge password ++challengePassword_min = 4 ++challengePassword_max = 20 ++ ++unstructuredName = An optional company name ++ ++[ usr_cert ] ++ ++basicConstraints=CA:FALSE ++nsComment = "OpenSSL Generated Certificate" ++ ++subjectKeyIdentifier=hash ++authorityKeyIdentifier=keyid,issuer ++ ++[ v3_req ] ++ ++basicConstraints = CA:FALSE ++keyUsage = nonRepudiation, digitalSignature, keyEncipherment ++subjectAltName = DNS:localhost,IP:127.0.0.1,IP:::1 ++ ++[ v3_ca ] ++subjectKeyIdentifier=hash ++authorityKeyIdentifier=keyid:always,issuer ++basicConstraints = CA:true ++ ++[ crl_ext ] ++ ++authorityKeyIdentifier=keyid:always ++ ++[ proxy_cert_ext ] ++basicConstraints=CA:FALSE ++nsComment = "OpenSSL Generated Certificate" ++ ++subjectKeyIdentifier=hash ++authorityKeyIdentifier=keyid,issuer ++proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo ++ ++[ tsa ] ++ ++default_tsa = tsa_config1 # the default TSA section ++ ++[ tsa_config1 ] ++ ++dir = ./demoCA # TSA root directory ++serial = $dir/tsaserial # The current serial number (mandatory) ++crypto_device = builtin # OpenSSL engine to use for signing ++signer_cert = $dir/tsacert.pem # The TSA signing certificate ++ # (optional) ++certs = $dir/cacert.pem # Certificate chain to include in reply ++ # (optional) ++signer_key = $dir/private/tsakey.pem # The TSA private key (optional) ++ ++default_policy = tsa_policy1 # Policy if request did not specify it ++ # (optional) ++other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) ++digests = md5, sha1 # Acceptable message digests (mandatory) ++accuracy = secs:1, millisecs:500, microsecs:100 # (optional) ++clock_precision_digits = 0 # number of digits after dot. (optional) ++ordering = yes # Is ordering defined for timestamps? ++ # (optional, default: no) ++tsa_name = yes # Must the TSA name be included in the reply? ++ # (optional, default: no) ++ess_cert_id_chain = no # Must the ESS cert id chain be included? ++ # (optional, default: no) +diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh +new file mode 100755 +index 000000000..8c33a24fe +--- /dev/null ++++ b/tests/data/tls/create-crt.sh +@@ -0,0 +1,78 @@ ++#!/bin/sh ++openssl=$(which openssl) ++ ++if [ x"$openssl" = "x" ]; then ++echo "OpenSSL command line binary not found, skipping..." ++fi ++ ++USAGE="$0 [-s] [-u ]" ++SERVER=0 ++USER=0 ++EMAIL= ++ ++while test $# -gt 0 ; do ++ case "$1" in ++ -s | -server) ++ SERVER=1; ++ shift;; ++ -u | -user) ++ if [ x"$2" = "x" ]; then ++ echo "User cert requires an email address as an argument" ++ exit; ++ fi ++ USER=1; ++ EMAIL="$2"; ++ shift; shift;; ++ -) ++ shift;; ++ -*) ++ echo "$USAGE"; exit 1 ++ ;; ++ *) ++ break;; ++ esac ++done ++ ++if [ $SERVER = 0 -a $USER = 0 ]; then ++ echo "$USAGE"; ++ exit 1; ++fi ++ ++rm -rf ./openssl.cnf cruft ++mkdir -p private certs cruft/private cruft/certs ++ ++echo "00" > cruft/serial ++touch cruft/index.txt ++touch cruft/index.txt.attr ++hn=$(hostname -f) ++sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf > ./openssl.cnf ++ ++if [ $SERVER = 1 ]; then ++ rm -rf private/localhost.key certs/localhost.crt ++ ++ $openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \ ++ -newkey rsa:1024 -config ./openssl.cnf \ ++ -subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \ ++ -batch > /dev/null 2>&1 ++ ++ $openssl ca -out certs/localhost.crt -notext -config ./openssl.cnf -days 183000 -in localhost.csr \ ++ -keyfile ca/private/testsuiteCA.key -extensions v3_req -cert ca/certs/testsuiteCA.crt \ ++ -batch >/dev/null 2>&1 ++ ++ rm -rf ./openssl.cnf ./localhost.csr cruft ++fi ++ ++if [ $USER = 1 ]; then ++ rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr ++ ++ $openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \ ++ -newkey rsa:1024 -config ./openssl.cnf \ ++ -subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \ ++ -batch >/dev/null 2>&1 ++ ++ $openssl ca -out certs/$EMAIL.crt -notext -config ./openssl.cnf -days 183000 -in $EMAIL.csr \ ++ -keyfile ca/private/testsuiteCA.key -extensions req_distinguished_name \ ++ -cert ca/certs/testsuiteCA.crt -batch >/dev/null 2>&1 ++ ++ rm -rf ./openssl.cnf ./$EMAIL.csr cruft ++fi +diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key +new file mode 100644 +index 000000000..5f4625fd7 +--- /dev/null ++++ b/tests/data/tls/private/bjensen@mailgw.example.com.key +@@ -0,0 +1,16 @@ ++-----BEGIN PRIVATE KEY----- ++MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2 ++xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4 ++9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z ++yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r ++oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e ++nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg ++xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra ++EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd ++9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/ ++pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI ++tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ ++3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D ++tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg ++36Ixj3L+5H18 ++-----END PRIVATE KEY----- +diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key +new file mode 100644 +index 000000000..8a24f69f8 +--- /dev/null ++++ b/tests/data/tls/private/localhost.key +@@ -0,0 +1,16 @@ ++-----BEGIN PRIVATE KEY----- ++MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg ++ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM ++w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM ++brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij ++Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf ++2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ ++bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q ++1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf ++3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U ++VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7 ++TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b ++iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP ++5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3 ++b61hkjQZfbEg5cg= ++-----END PRIVATE KEY----- +diff --git a/tests/run.in b/tests/run.in +index a542eedec..468c3e1f2 100644 +--- a/tests/run.in ++++ b/tests/run.in +@@ -56,6 +56,7 @@ AC_valsort=valsort@BUILD_VALSORT@ + # misc + AC_WITH_SASL=@WITH_SASL@ + AC_WITH_TLS=@WITH_TLS@ ++AC_TLS_TYPE=@WITH_TLS_TYPE@ + AC_WITH_MODULES_ENABLED=@WITH_MODULES_ENABLED@ + AC_ACI_ENABLED=aci@WITH_ACI_ENABLED@ + AC_THREADS=threads@BUILD_THREAD@ +@@ -74,7 +75,7 @@ export AC_bdb AC_hdb AC_ldap AC_mdb AC_meta AC_monitor AC_null AC_relay AC_sql \ + AC_refint AC_retcode AC_rwm AC_unique AC_syncprov AC_translucent \ + AC_valsort \ + AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED AC_ACI_ENABLED \ +- AC_THREADS AC_LIBS_DYNAMIC ++ AC_THREADS AC_LIBS_DYNAMIC AC_WITH_TLS AC_TLS_TYPE + + if test ! -x ../servers/slapd/slapd ; then + echo "Could not locate slapd(8)" +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index b374cc500..8f7c7b853 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -45,6 +45,9 @@ VALSORT=${AC_valsort-valsortno} + # misc + WITH_SASL=${AC_WITH_SASL-no} + USE_SASL=${SLAPD_USE_SASL-no} ++WITH_TLS=${AC_WITH_TLS-no} ++WITH_TLS_TYPE=${AC_TLS_TYPE-no} ++ + ACI=${AC_ACI_ENABLED-acino} + THREADS=${AC_THREADS-threadsno} + SLEEP0=${SLEEP0-1} +@@ -103,6 +106,8 @@ P2SRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist2.conf + P3SRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist3.conf + REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf + SCHEMACONF=$DATADIR/slapd-schema.conf ++TLSCONF=$DATADIR/slapd-tls.conf ++TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf + GLUECONF=$DATADIR/slapd-glue.conf + REFINTCONF=$DATADIR/slapd-refint.conf + RETCODECONF=$DATADIR/slapd-retcode.conf +@@ -163,6 +168,7 @@ SLURPLOG=$TESTDIR/slurp.log + CONFIGPWF=$TESTDIR/configpw + + # args ++SASLARGS="-Q" + TOOLARGS="-x $LDAP_TOOLARGS" + TOOLPROTO="-P 3" + +@@ -184,7 +190,8 @@ BCMP="diff -iB" + CMPOUT=/dev/null + SLAPD="$TESTWD/../servers/slapd/slapd -s0" + LDAPPASSWD="$CLIENTDIR/ldappasswd $TOOLARGS" +-LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $LDAP_TOOLARGS -LLL" ++LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $SASLARGS $TOOLPROTO $LDAP_TOOLARGS -LLL" ++LDAPSASLWHOAMI="$CLIENTDIR/ldapwhoami $SASLARGS $LDAP_TOOLARGS" + LDAPSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS -LLL" + LDAPRSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS" + LDAPDELETE="$CLIENTDIR/ldapdelete $TOOLPROTO $TOOLARGS" +@@ -199,6 +206,7 @@ LDIFFILTER=$PROGDIR/ldif-filter + SLAPDMTREAD=$PROGDIR/slapd-mtread + LVL=${SLAPD_DEBUG-0x4105} + LOCALHOST=localhost ++LOCALIP=127.0.0.1 + BASEPORT=${SLAPD_BASEPORT-9010} + PORT1=`expr $BASEPORT + 1` + PORT2=`expr $BASEPORT + 2` +@@ -207,11 +215,22 @@ PORT4=`expr $BASEPORT + 4` + PORT5=`expr $BASEPORT + 5` + PORT6=`expr $BASEPORT + 6` + URI1="ldap://${LOCALHOST}:$PORT1/" ++URIP1="ldap://${LOCALIP}:$PORT1/" + URI2="ldap://${LOCALHOST}:$PORT2/" ++URIP2="ldap://${LOCALIP}:$PORT2/" + URI3="ldap://${LOCALHOST}:$PORT3/" ++URIP3="ldap://${LOCALIP}:$PORT3/" + URI4="ldap://${LOCALHOST}:$PORT4/" + URI5="ldap://${LOCALHOST}:$PORT5/" + URI6="ldap://${LOCALHOST}:$PORT6/" ++SURI1="ldaps://${LOCALHOST}:$PORT1/" ++SURIP1="ldaps://${LOCALIP}:$PORT1/" ++SURI2="ldaps://${LOCALHOST}:$PORT2/" ++SURIP2="ldaps://${LOCALIP}:$PORT2/" ++SURI3="ldaps://${LOCALHOST}:$PORT3/" ++SURI4="ldaps://${LOCALHOST}:$PORT4/" ++SURI5="ldaps://${LOCALHOST}:$PORT5/" ++SURI6="ldaps://${LOCALHOST}:$PORT6/" + + # LDIF + LDIF=$DATADIR/test.ldif +diff --git a/tests/scripts/test067-tls b/tests/scripts/test067-tls +new file mode 100755 +index 000000000..2b245f5f5 +--- /dev/null ++++ b/tests/scripts/test067-tls +@@ -0,0 +1,140 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++mkdir -p $TESTDIR $DBDIR1 ++cp -r $DATADIR/tls $TESTDIR ++ ++cd $TESTWD ++ ++echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." ++. $CONFFILTER $BACKEND $MONITORDB < $TLSCONF > $CONF1 ++$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID" ++ ++sleep 1 ++ ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $URI1 \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo -n "Using ldapsearch with startTLS with no server cert validation...." ++$LDAPSEARCH -o tls_reqcert=never -ZZ -b "" -s base -H $URIP1 \ ++ '@extensibleObject' > $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (startTLS) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Using ldapsearch with startTLS with hard require cert...." ++$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -ZZ -b "" -s base -H $URIP1 \ ++ '@extensibleObject' > $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (startTLS) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++if test $WITH_TLS_TYPE = openssl ; then ++ echo -n "Using ldapsearch with startTLS and specific protocol version...." ++ $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -o tls_protocol_min=3.3 -ZZ -b "" -s base -H $URIP1 \ ++ '@extensibleObject' > $SEARCHOUT 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapsearch (protocol-min) failed ($RC)!" ++ exit $RC ++ else ++ echo "success" ++ fi ++fi ++ ++echo -n "Using ldapsearch on $SURI2 with no server cert validation..." ++$LDAPSEARCH -o tls_reqcert=never -b "cn=Subschema" -s base -H $SURIP2 \ ++ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ ++ >> $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (ldaps) failed($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Using ldapsearch on $SURI2 with reqcert HARD and no CA cert. Should fail..." ++$LDAPSEARCH -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ ++ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ ++ >> $SEARCHOUT 2>&1 ++RC=$? ++if test $RC = 0 ; then ++ echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!" ++ exit 1 ++else ++ echo "failed correctly with error code ($RC)" ++fi ++ ++echo -n "Using ldapsearch on $SURI2 with CA cert and reqcert HARD..." ++$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \ ++ '(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \ ++ >> $SEARCHOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch (ldaps) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++if test $RC != 0 ; then ++ echo ">>>>> Test failed" ++else ++ echo ">>>>> Test succeeded" ++ RC=0 ++fi ++ ++test $KILLSERVERS != no && wait ++ ++exit $RC +diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external +new file mode 100755 +index 000000000..dcbc50fd4 +--- /dev/null ++++ b/tests/scripts/test068-sasl-tls-external +@@ -0,0 +1,102 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++mkdir -p $TESTDIR $DBDIR1 ++cp -r $DATADIR/tls $TESTDIR ++ ++cd $TESTWD ++ ++echo "Running slapadd to build slapd database..." ++. $CONFFILTER $BACKEND $MONITORDB < $TLSSASLCONF > $CONF1 ++$SLAPADD -f $CONF1 -l $LDIFORDERED ++RC=$? ++if test $RC != 0 ; then ++ echo "slapadd failed ($RC)!" ++ exit $RC ++fi ++ ++echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." ++$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID" ++ ++sleep 1 ++ ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $URI1 \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo -n "Using ldapwhoami with SASL/EXTERNAL...." ++$LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \ ++ -o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key -ZZ -Y EXTERNAL -H $URIP1 \ ++ > $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapwhoami (startTLS) failed ($RC)!" ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Validating mapped SASL ID..." ++echo 'dn:cn=barbara jensen,ou=information technology division,ou=people,dc=example,dc=com' > $TESTDIR/dn.out ++$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT ++ ++RC=$? ++if test $RC != 0 ; then ++ echo "Comparison failed" ++ test $KILLSERVERS != no && kill -HUP $PID ++ exit $RC ++else ++ echo "success" ++fi ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++if test $RC != 0 ; then ++ echo ">>>>> Test failed" ++else ++ echo ">>>>> Test succeeded" ++ RC=0 ++fi ++ ++test $KILLSERVERS != no && wait ++ ++exit $RC +diff --git a/tests/scripts/test069-delta-multimaster-starttls b/tests/scripts/test069-delta-multimaster-starttls +new file mode 100755 +index 000000000..2dfbb30a1 +--- /dev/null ++++ b/tests/scripts/test069-delta-multimaster-starttls +@@ -0,0 +1,574 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++if test $SYNCPROV = syncprovno; then ++ echo "Syncrepl provider overlay not available, test skipped" ++ exit 0 ++fi ++if test $ACCESSLOG = accesslogno; then ++ echo "Accesslog overlay not available, test skipped" ++ exit 0 ++fi ++ ++MMR=2 ++ ++XDIR=$TESTDIR/srv ++TMP=$TESTDIR/tmp ++ ++mkdir -p $TESTDIR ++cp -r $DATADIR/tls $TESTDIR ++ ++$SLAPPASSWD -g -n >$CONFIGPWF ++ ++if test x"$SYNCMODE" = x ; then ++ SYNCMODE=rp ++fi ++case "$SYNCMODE" in ++ ro) ++ SYNCTYPE="type=refreshOnly interval=00:00:00:03" ++ ;; ++ rp) ++ SYNCTYPE="type=refreshAndPersist interval=00:00:00:03" ++ ;; ++ *) ++ echo "unknown sync mode $SYNCMODE" ++ exit 1; ++ ;; ++esac ++ ++# ++# Test delta-sync mmr ++# - start servers ++# - configure over ldap ++# - populate over ldap ++# - configure syncrepl over ldap ++# - break replication ++# - modify each server separately ++# - restore replication ++# - compare results ++# ++ ++nullExclude="" ++test $BACKEND = null && nullExclude="# " ++ ++KILLPIDS= ++ ++echo "Initializing server configurations..." ++n=1 ++while [ $n -le $MMR ]; do ++ ++DBDIR=${XDIR}$n/db ++CFDIR=${XDIR}$n/slapd.d ++ ++mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR ++ ++o=`expr 3 - $n` ++cat > $TMP <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/overlays ++EOF ++ if [ "$SYNCPROV" = syncprovmod ]; then ++ echo "olcModuleLoad: syncprov.la" >> $TMP ++ fi ++ if [ "$ACCESSLOG" = accesslogmod ]; then ++ echo "olcModuleLoad: accesslog.la" >> $TMP ++ fi ++ echo "" >> $TMP ++fi ++ ++if [ "$BACKENDTYPE" = mod ]; then ++cat <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND ++olcModuleLoad: back_$BACKEND.la ++ ++EOF ++fi ++MYURI=`eval echo '$URI'$n` ++PROVIDERURI=`eval echo '$URIP'$o` ++if test $INDEXDB = indexdb ; then ++INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq" ++INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq" ++else ++INDEX1= ++INDEX2= ++fi ++cat >> $TMP < $TESTOUT 2>&1 ++PORT=`eval echo '$PORT'$n` ++echo "Starting server $n on TCP/IP port $PORT..." ++cd ${XDIR}${n} ++LOG=`eval echo '$LOG'$n` ++$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID $KILLPIDS" ++cd $TESTWD ++ ++echo "Using ldapsearch to check that server $n is running..." ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $MYURI \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++if [ $n = 1 ]; then ++echo "Using ldapadd for context on server 1..." ++$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++fi ++ ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 1..." ++$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDNOCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++sleep $SLEEP1 ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldap://${LOCALHOST}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 2..." ++$LDAPADD -D "$MANAGERDN" -H $URI2 -w $PASSWD -f $LDIFADD1 \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" ++sleep 1 ++for i in 1 2 3; do ++ $LDAPSEARCH -S "" -b "$THEDN" -H $URI1 \ ++ -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 ++ RC=$? ++ ++ if test $RC = 0 ; then ++ break ++ fi ++ ++ if test $RC != 32 ; then ++ echo "ldapsearch failed at slave ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ ++ echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++ sleep $SLEEP1 ++done ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldap://${LOCALHOST}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Breaking replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$URI'$n` ++PROVIDERURI=`eval echo '$URIP'$o` ++$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Amazing ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Stupendous ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: Outstanding ++- ++add: description ++description: Mindboggling ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: OutStanding ++- ++add: description ++description: Bizarre ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: carLicense ++carLicense: 123-XYZ ++- ++add: employeeNumber ++employeeNumber: 32 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: employeeType ++employeeType: deadwood ++- ++add: employeeNumber ++employeeNumber: 64 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++replace: sn ++sn: Replaced later ++- ++replace: sn ++sn: Surname ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Restoring replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$URI'$n` ++PROVIDERURI=`eval echo '$URIP'$o` ++$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 < $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++echo ">>>>> Test succeeded" ++ ++test $KILLSERVERS != no && wait ++ ++exit 0 +diff --git a/tests/scripts/test070-delta-multimaster-ldaps b/tests/scripts/test070-delta-multimaster-ldaps +new file mode 100755 +index 000000000..1024640ef +--- /dev/null ++++ b/tests/scripts/test070-delta-multimaster-ldaps +@@ -0,0 +1,571 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2017 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_TLS = no ; then ++ echo "TLS support not available, test skipped" ++ exit 0 ++fi ++ ++if test $SYNCPROV = syncprovno; then ++ echo "Syncrepl provider overlay not available, test skipped" ++ exit 0 ++fi ++if test $ACCESSLOG = accesslogno; then ++ echo "Accesslog overlay not available, test skipped" ++ exit 0 ++fi ++ ++MMR=2 ++ ++XDIR=$TESTDIR/srv ++TMP=$TESTDIR/tmp ++ ++mkdir -p $TESTDIR ++cp -r $DATADIR/tls $TESTDIR ++ ++$SLAPPASSWD -g -n >$CONFIGPWF ++ ++if test x"$SYNCMODE" = x ; then ++ SYNCMODE=rp ++fi ++case "$SYNCMODE" in ++ ro) ++ SYNCTYPE="type=refreshOnly interval=00:00:00:03" ++ ;; ++ rp) ++ SYNCTYPE="type=refreshAndPersist interval=00:00:00:03" ++ ;; ++ *) ++ echo "unknown sync mode $SYNCMODE" ++ exit 1; ++ ;; ++esac ++ ++# ++# Test delta-sync mmr ++# - start servers ++# - configure over ldap ++# - populate over ldap ++# - configure syncrepl over ldap ++# - break replication ++# - modify each server separately ++# - restore replication ++# - compare results ++# ++ ++nullExclude="" ++test $BACKEND = null && nullExclude="# " ++ ++KILLPIDS= ++ ++echo "Initializing server configurations..." ++n=1 ++while [ $n -le $MMR ]; do ++ ++DBDIR=${XDIR}$n/db ++CFDIR=${XDIR}$n/slapd.d ++ ++mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR ++ ++o=`expr 3 - $n` ++cat > $TMP <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/overlays ++EOF ++ if [ "$SYNCPROV" = syncprovmod ]; then ++ echo "olcModuleLoad: syncprov.la" >> $TMP ++ fi ++ if [ "$ACCESSLOG" = accesslogmod ]; then ++ echo "olcModuleLoad: accesslog.la" >> $TMP ++ fi ++ echo "" >> $TMP ++fi ++ ++if [ "$BACKENDTYPE" = mod ]; then ++cat <> $TMP ++dn: cn=module,cn=config ++objectClass: olcModuleList ++cn: module ++olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND ++olcModuleLoad: back_$BACKEND.la ++ ++EOF ++fi ++MYURI=`eval echo '$SURIP'$n` ++PROVIDERURI=`eval echo '$SURIP'$o` ++if test $INDEXDB = indexdb ; then ++INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq" ++INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq" ++else ++INDEX1= ++INDEX2= ++fi ++cat >> $TMP < $TESTOUT 2>&1 ++PORT=`eval echo '$PORT'$n` ++echo "Starting server $n on TCP/IP port $PORT..." ++cd ${XDIR}${n} ++LOG=`eval echo '$LOG'$n` ++$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID $KILLPIDS" ++cd $TESTWD ++ ++echo "Using ldapsearch to check that server $n is running..." ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -s base -b "" -H $MYURI \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++if [ $n = 1 ]; then ++echo "Using ldapadd for context on server 1..." ++$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++fi ++ ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 1..." ++$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDNOCP \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server $n database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++sleep $SLEEP1 ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldaps://${LOCALIP}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -b "$BASEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Using ldapadd to populate server 2..." ++$LDAPADD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD -f $LDIFADD1 \ ++ >> $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapadd failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" ++sleep 1 ++for i in 1 2 3; do ++ $LDAPSEARCH -S "" -b "$THEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $SURIP1 \ ++ -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 ++ RC=$? ++ ++ if test $RC = 0 ; then ++ break ++ fi ++ ++ if test $RC != 32 ; then ++ echo "ldapsearch failed at slave ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ fi ++ ++ echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..." ++ sleep $SLEEP1 ++done ++ ++n=1 ++while [ $n -le $MMR ]; do ++PORT=`expr $BASEPORT + $n` ++URI="ldaps://${LOCALIP}:$PORT/" ++ ++echo "Using ldapsearch to read all the entries from server $n..." ++$LDAPSEARCH -S "" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD \ ++ 'objectclass=*' > $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++echo "Breaking replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$SURIP'$n` ++PROVIDERURI=`eval echo '$SURIP'$o` ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Amazing ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: description ++description: Stupendous ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: Outstanding ++- ++add: description ++description: Mindboggling ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++delete: description ++description: OutStanding ++- ++add: description ++description: Bizarre ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: carLicense ++carLicense: 123-XYZ ++- ++add: employeeNumber ++employeeNumber: 32 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++add: employeeType ++employeeType: deadwood ++- ++add: employeeNumber ++employeeNumber: 64 ++ ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 2 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \ ++ >> $TESTOUT 2>&1 << EOF ++dn: $THEDN ++changetype: modify ++replace: sn ++sn: Replaced later ++- ++replace: sn ++sn: Surname ++EOF ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapmodify failed for server 1 database ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo "Restoring replication between server 1 and 2..." ++n=1 ++while [ $n -le $MMR ]; do ++o=`expr 3 - $n` ++MYURI=`eval echo '$SURIP'$n` ++PROVIDERURI=`eval echo '$SURIP'$o` ++$LDAPMODIFY -D cn=config -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 < $TESTDIR/server$n.out 2>&1 ++RC=$? ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed at server $n ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt ++n=`expr $n + 1` ++done ++ ++n=2 ++while [ $n -le $MMR ]; do ++echo "Comparing retrieved entries from server 1 and server $n..." ++$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++ ++if test $? != 0 ; then ++ echo "test failed - server 1 and server $n databases differ" ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit 1 ++fi ++n=`expr $n + 1` ++done ++ ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++echo ">>>>> Test succeeded" ++ ++test $KILLSERVERS != no && wait ++ ++exit 0 +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch b/SOURCES/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch new file mode 100644 index 0000000..d86a707 --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch @@ -0,0 +1,582 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From 8a259e3df16def3f05828f355e98a5089cd6e6d0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Thu, 14 Jun 2018 16:14:15 +0100 +Subject: [PATCH] ITS#8573 allow all libldap options in tools -o option + +--- + clients/tools/common.c | 15 ++- + doc/devel/args | 2 +- + doc/man/man1/ldapcompare.1 | 9 +- + doc/man/man1/ldapdelete.1 | 9 +- + doc/man/man1/ldapexop.1 | 9 +- + doc/man/man1/ldapmodify.1 | 9 +- + doc/man/man1/ldapmodrdn.1 | 9 +- + doc/man/man1/ldappasswd.1 | 9 +- + doc/man/man1/ldapsearch.1 | 9 +- + doc/man/man1/ldapwhoami.1 | 13 ++- + doc/man/man8/slapcat.8 | 2 +- + include/ldap_pvt.h | 5 + + libraries/libldap/init.c | 231 ++++++++++++++++++++++--------------- + servers/slapd/slapcommon.c | 5 +- + 14 files changed, 200 insertions(+), 136 deletions(-) + +diff --git a/clients/tools/common.c b/clients/tools/common.c +index 39db70b93..d5c3491fc 100644 +--- a/clients/tools/common.c ++++ b/clients/tools/common.c +@@ -351,9 +351,9 @@ N_(" -I use SASL Interactive mode\n"), + N_(" -n show what would be done but don't actually do it\n"), + N_(" -N do not use reverse DNS to canonicalize SASL host name\n"), + N_(" -O props SASL security properties\n"), +-N_(" -o [=] general options\n"), ++N_(" -o [=] any libldap ldap.conf options, plus\n"), ++N_(" ldif_wrap= (in columns, or \"no\" for no wrapping)\n"), + N_(" nettimeout= (in seconds, or \"none\" or \"max\")\n"), +-N_(" ldif-wrap= (in columns, or \"no\" for no wrapping)\n"), + N_(" -p port port on LDAP server\n"), + N_(" -Q use SASL Quiet mode\n"), + N_(" -R realm SASL realm\n"), +@@ -785,6 +785,11 @@ tool_args( int argc, char **argv ) + if ( (cvalue = strchr( control, '=' )) != NULL ) { + *cvalue++ = '\0'; + } ++ for ( next=control; *next; next++ ) { ++ if ( *next == '-' ) { ++ *next = '_'; ++ } ++ } + + if ( strcasecmp( control, "nettimeout" ) == 0 ) { + if( nettimeout.tv_sec != -1 ) { +@@ -814,7 +819,7 @@ tool_args( int argc, char **argv ) + exit( EXIT_FAILURE ); + } + +- } else if ( strcasecmp( control, "ldif-wrap" ) == 0 ) { ++ } else if ( strcasecmp( control, "ldif_wrap" ) == 0 ) { + if ( cvalue == 0 ) { + ldif_wrap = LDIF_LINE_WIDTH; + +@@ -825,13 +830,13 @@ tool_args( int argc, char **argv ) + unsigned int u; + if ( lutil_atou( &u, cvalue ) ) { + fprintf( stderr, +- _("Unable to parse ldif-wrap=\"%s\"\n"), cvalue ); ++ _("Unable to parse ldif_wrap=\"%s\"\n"), cvalue ); + exit( EXIT_FAILURE ); + } + ldif_wrap = (ber_len_t)u; + } + +- } else { ++ } else if ( ldap_pvt_conf_option( control, cvalue, 1 ) ) { + fprintf( stderr, "Invalid general option name: %s\n", + control ); + usage(); +diff --git a/doc/devel/args b/doc/devel/args +index 7805eff1c..31c22f948 100644 +--- a/doc/devel/args ++++ b/doc/devel/args +@@ -27,7 +27,7 @@ ldapwhoami * DE**HI** NO QR UVWXYZ def*h*** *nop* vwxy + -h host + -n no-op + -N no (SASLprep) normalization of simple bind password +- -o general options (currently nettimeout and ldif-wrap only) ++ -o general libldap options (plus ldif_wrap and nettimeout for backwards comp.) + -p port + -v verbose + -V version +diff --git a/doc/man/man1/ldapcompare.1 b/doc/man/man1/ldapcompare.1 +index 667815a26..de90498db 100644 +--- a/doc/man/man1/ldapcompare.1 ++++ b/doc/man/man1/ldapcompare.1 +@@ -186,13 +186,14 @@ Compare extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapdelete.1 b/doc/man/man1/ldapdelete.1 +index 9e7036230..872424a65 100644 +--- a/doc/man/man1/ldapdelete.1 ++++ b/doc/man/man1/ldapdelete.1 +@@ -192,13 +192,14 @@ Delete extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapexop.1 b/doc/man/man1/ldapexop.1 +index 5f5ae7aae..96a7c514e 100644 +--- a/doc/man/man1/ldapexop.1 ++++ b/doc/man/man1/ldapexop.1 +@@ -189,13 +189,14 @@ Specify general extensions. \'!\' indicates criticality. + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 +index f884c5bfb..90f813506 100644 +--- a/doc/man/man1/ldapmodify.1 ++++ b/doc/man/man1/ldapmodify.1 +@@ -255,13 +255,14 @@ Modify extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR]] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapmodrdn.1 b/doc/man/man1/ldapmodrdn.1 +index fa9eac627..900ba7e0e 100644 +--- a/doc/man/man1/ldapmodrdn.1 ++++ b/doc/man/man1/ldapmodrdn.1 +@@ -186,13 +186,14 @@ Modrdn extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldappasswd.1 b/doc/man/man1/ldappasswd.1 +index d3f45b082..bf273fb25 100644 +--- a/doc/man/man1/ldappasswd.1 ++++ b/doc/man/man1/ldappasswd.1 +@@ -188,13 +188,14 @@ Passwd Modify extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR]] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapsearch.1 b/doc/man/man1/ldapsearch.1 +index 196179232..901e56043 100644 +--- a/doc/man/man1/ldapsearch.1 ++++ b/doc/man/man1/ldapsearch.1 +@@ -332,13 +332,14 @@ Search extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man1/ldapwhoami.1 b/doc/man/man1/ldapwhoami.1 +index b684de54a..79864c729 100644 +--- a/doc/man/man1/ldapwhoami.1 ++++ b/doc/man/man1/ldapwhoami.1 +@@ -143,13 +143,18 @@ WhoAmI extensions: + .TP + .BI \-o \ opt \fR[= optparam \fR] + +-Specify general options. +- +-General options: ++Specify any ++.BR ldap.conf (5) ++option or one of the following: + .nf + nettimeout= (in seconds, or "none" or "max") +- ldif-wrap= (in columns, or "no" for no wrapping) ++ ldif_wrap= (in columns, or "no" for no wrapping) + .fi ++ ++.B -o ++option that can be passed here, check ++.BR ldap.conf (5) ++for details. + .TP + .BI \-O \ security-properties + Specify SASL security properties. +diff --git a/doc/man/man8/slapcat.8 b/doc/man/man8/slapcat.8 +index d05cfa643..24c8f03ea 100644 +--- a/doc/man/man8/slapcat.8 ++++ b/doc/man/man8/slapcat.8 +@@ -149,7 +149,7 @@ Possible generic options/values are: + syslog\-level= (see `\-S' in slapd(8)) + syslog\-user= (see `\-l' in slapd(8)) + +- ldif-wrap={no|} ++ ldif_wrap={no|} + + .in + \fIn\fP is the number of columns allowed for the LDIF output +diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h +index 61c620785..c586a95b5 100644 +--- a/include/ldap_pvt.h ++++ b/include/ldap_pvt.h +@@ -321,6 +321,11 @@ struct ldapmsg; + LDAP_F ( int ) ldap_pvt_discard LDAP_P(( + struct ldap *ld, ber_int_t msgid )); + ++/* init.c */ ++LDAP_F( int ) ++ldap_pvt_conf_option LDAP_P(( ++ char *cmd, char *opt, int userconf )); ++ + /* messages.c */ + LDAP_F( BerElement * ) + ldap_get_message_ber LDAP_P(( +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 182ef7d7e..746824fbd 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -148,6 +148,141 @@ static const struct ol_attribute { + #define MAX_LDAP_ATTR_LEN sizeof("GSSAPI_ALLOW_REMOTE_PRINCIPAL") + #define MAX_LDAP_ENV_PREFIX_LEN 8 + ++static int ++ldap_int_conf_option( ++ struct ldapoptions *gopts, ++ char *cmd, char *opt, int userconf ) ++{ ++ int i; ++ ++ for(i=0; attrs[i].type != ATTR_NONE; i++) { ++ void *p; ++ ++ if( !userconf && attrs[i].useronly ) { ++ continue; ++ } ++ ++ if(strcasecmp(cmd, attrs[i].name) != 0) { ++ continue; ++ } ++ ++ switch(attrs[i].type) { ++ case ATTR_BOOL: ++ if((strcasecmp(opt, "on") == 0) ++ || (strcasecmp(opt, "yes") == 0) ++ || (strcasecmp(opt, "true") == 0)) ++ { ++ LDAP_BOOL_SET(gopts, attrs[i].offset); ++ ++ } else { ++ LDAP_BOOL_CLR(gopts, attrs[i].offset); ++ } ++ ++ break; ++ ++ case ATTR_INT: { ++ char *next; ++ long l; ++ p = &((char *) gopts)[attrs[i].offset]; ++ l = strtol( opt, &next, 10 ); ++ if ( next != opt && next[ 0 ] == '\0' ) { ++ * (int*) p = l; ++ } ++ } break; ++ ++ case ATTR_KV: { ++ const struct ol_keyvalue *kv; ++ ++ for(kv = attrs[i].data; ++ kv->key != NULL; ++ kv++) { ++ ++ if(strcasecmp(opt, kv->key) == 0) { ++ p = &((char *) gopts)[attrs[i].offset]; ++ * (int*) p = kv->value; ++ break; ++ } ++ } ++ } break; ++ ++ case ATTR_STRING: ++ p = &((char *) gopts)[attrs[i].offset]; ++ if (* (char**) p != NULL) LDAP_FREE(* (char**) p); ++ * (char**) p = LDAP_STRDUP(opt); ++ break; ++ case ATTR_OPTION: ++ ldap_set_option( NULL, attrs[i].offset, opt ); ++ break; ++ case ATTR_SASL: ++#ifdef HAVE_CYRUS_SASL ++ ldap_int_sasl_config( gopts, attrs[i].offset, opt ); ++#endif ++ break; ++ case ATTR_GSSAPI: ++#ifdef HAVE_GSSAPI ++ ldap_int_gssapi_config( gopts, attrs[i].offset, opt ); ++#endif ++ break; ++ case ATTR_TLS: ++#ifdef HAVE_TLS ++ ldap_int_tls_config( NULL, attrs[i].offset, opt ); ++#endif ++ break; ++ case ATTR_OPT_TV: { ++ struct timeval tv; ++ char *next; ++ tv.tv_usec = 0; ++ tv.tv_sec = strtol( opt, &next, 10 ); ++ if ( next != opt && next[ 0 ] == '\0' && tv.tv_sec > 0 ) { ++ (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&tv ); ++ } ++ } break; ++ case ATTR_OPT_INT: { ++ long l; ++ char *next; ++ l = strtol( opt, &next, 10 ); ++ if ( next != opt && next[ 0 ] == '\0' && l > 0 && (long)((int)l) == l ) { ++ int v = (int)l; ++ (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&v ); ++ } ++ } break; ++ } ++ ++ break; ++ } ++ ++ if ( attrs[i].type == ATTR_NONE ) { ++ Debug( LDAP_DEBUG_TRACE, "ldap_int_tls_config: " ++ "unknown option '%s'", ++ cmd, 0, 0 ); ++ return 1; ++ } ++ ++ return 0; ++} ++ ++int ++ldap_pvt_conf_option( ++ char *cmd, char *opt, int userconf ) ++{ ++ struct ldapoptions *gopts; ++ int rc = LDAP_OPT_ERROR; ++ ++ /* Get pointer to global option structure */ ++ gopts = LDAP_INT_GLOBAL_OPT(); ++ if (NULL == gopts) { ++ return LDAP_NO_MEMORY; ++ } ++ ++ if ( gopts->ldo_valid != LDAP_INITIALIZED ) { ++ ldap_int_initialize(gopts, NULL); ++ if ( gopts->ldo_valid != LDAP_INITIALIZED ) ++ return LDAP_LOCAL_ERROR; ++ } ++ ++ return ldap_int_conf_option( gopts, cmd, opt, userconf ); ++} ++ + static void openldap_ldap_init_w_conf( + const char *file, int userconf ) + { +@@ -213,101 +348,7 @@ static void openldap_ldap_init_w_conf( + while(isspace((unsigned char)*start)) start++; + opt = start; + +- for(i=0; attrs[i].type != ATTR_NONE; i++) { +- void *p; +- +- if( !userconf && attrs[i].useronly ) { +- continue; +- } +- +- if(strcasecmp(cmd, attrs[i].name) != 0) { +- continue; +- } +- +- switch(attrs[i].type) { +- case ATTR_BOOL: +- if((strcasecmp(opt, "on") == 0) +- || (strcasecmp(opt, "yes") == 0) +- || (strcasecmp(opt, "true") == 0)) +- { +- LDAP_BOOL_SET(gopts, attrs[i].offset); +- +- } else { +- LDAP_BOOL_CLR(gopts, attrs[i].offset); +- } +- +- break; +- +- case ATTR_INT: { +- char *next; +- long l; +- p = &((char *) gopts)[attrs[i].offset]; +- l = strtol( opt, &next, 10 ); +- if ( next != opt && next[ 0 ] == '\0' ) { +- * (int*) p = l; +- } +- } break; +- +- case ATTR_KV: { +- const struct ol_keyvalue *kv; +- +- for(kv = attrs[i].data; +- kv->key != NULL; +- kv++) { +- +- if(strcasecmp(opt, kv->key) == 0) { +- p = &((char *) gopts)[attrs[i].offset]; +- * (int*) p = kv->value; +- break; +- } +- } +- } break; +- +- case ATTR_STRING: +- p = &((char *) gopts)[attrs[i].offset]; +- if (* (char**) p != NULL) LDAP_FREE(* (char**) p); +- * (char**) p = LDAP_STRDUP(opt); +- break; +- case ATTR_OPTION: +- ldap_set_option( NULL, attrs[i].offset, opt ); +- break; +- case ATTR_SASL: +-#ifdef HAVE_CYRUS_SASL +- ldap_int_sasl_config( gopts, attrs[i].offset, opt ); +-#endif +- break; +- case ATTR_GSSAPI: +-#ifdef HAVE_GSSAPI +- ldap_int_gssapi_config( gopts, attrs[i].offset, opt ); +-#endif +- break; +- case ATTR_TLS: +-#ifdef HAVE_TLS +- ldap_int_tls_config( NULL, attrs[i].offset, opt ); +-#endif +- break; +- case ATTR_OPT_TV: { +- struct timeval tv; +- char *next; +- tv.tv_usec = 0; +- tv.tv_sec = strtol( opt, &next, 10 ); +- if ( next != opt && next[ 0 ] == '\0' && tv.tv_sec > 0 ) { +- (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&tv ); +- } +- } break; +- case ATTR_OPT_INT: { +- long l; +- char *next; +- l = strtol( opt, &next, 10 ); +- if ( next != opt && next[ 0 ] == '\0' && l > 0 && (long)((int)l) == l ) { +- int v = (int)l; +- (void)ldap_set_option( NULL, attrs[i].offset, (const void *)&v ); +- } +- } break; +- } +- +- break; +- } ++ ldap_int_conf_option( gopts, cmd, opt, userconf ); + } + + fclose(fp); +diff --git a/servers/slapd/slapcommon.c b/servers/slapd/slapcommon.c +index 01574af1e..a62c69581 100644 +--- a/servers/slapd/slapcommon.c ++++ b/servers/slapd/slapcommon.c +@@ -228,7 +228,8 @@ parse_slapopt( int tool, int *mode ) + break; + } + +- } else if ( strncasecmp( optarg, "ldif-wrap", len ) == 0 ) { ++ } else if ( ( strncasecmp( optarg, "ldif_wrap", len ) == 0 ) || ++ ( strncasecmp( optarg, "ldif-wrap", len ) == 0 ) ) { + switch ( tool ) { + case SLAPCAT: + if ( strcasecmp( p, "no" ) == 0 ) { +@@ -237,7 +238,7 @@ parse_slapopt( int tool, int *mode ) + } else { + unsigned int u; + if ( lutil_atou( &u, p ) ) { +- Debug( LDAP_DEBUG_ANY, "unable to parse ldif-wrap=\"%s\".\n", p, 0, 0 ); ++ Debug( LDAP_DEBUG_ANY, "unable to parse ldif_wrap=\"%s\".\n", p, 0, 0 ); + return -1; + } + ldif_wrap = (ber_len_t)u; +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch b/SOURCES/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch new file mode 100644 index 0000000..31574ee --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch @@ -0,0 +1,631 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From 3cd50fa8b32a21040a9892e2a8a7a9dfc7541ce6 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 14 Apr 2020 16:10:48 +0300 +Subject: [PATCH] ITS#9189 rework sasl-cbinding support + +Add LDAP_OPT_X_SASL_CBINDING option to define the binding type to use, +defaults to "none". + +Add "tls-endpoint" binding type implementing "tls-server-end-point" from +RCF 5929, which is compatible with Windows. + +Fix "tls-unique" to include the prefix in the bindings as per RFC 5056. +--- + doc/man/man3/ldap_get_option.3 | 16 ++++++ + doc/man/man5/ldap.conf.5 | 3 + + doc/man/man5/slapd-config.5 | 4 ++ + doc/man/man5/slapd.conf.5 | 3 + + include/ldap.h | 5 ++ + include/ldap_pvt.h | 5 ++ + libraries/libldap/cyrus.c | 101 +++++++++++++++++++++++++++++---- + libraries/libldap/init.c | 1 + + libraries/libldap/ldap-int.h | 1 + + libraries/libldap/ldap-tls.h | 2 + + libraries/libldap/tls2.c | 7 +++ + libraries/libldap/tls_g.c | 59 +++++++++++++++++++ + libraries/libldap/tls_o.c | 45 +++++++++++++++ + servers/slapd/bconfig.c | 11 +++- + servers/slapd/config.c | 1 + + servers/slapd/connection.c | 9 +-- + servers/slapd/proto-slap.h | 4 +- + servers/slapd/sasl.c | 27 ++++++--- + 18 files changed, 274 insertions(+), 30 deletions(-) + +diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3 +index 7546875f5..e953900ce 100644 +--- a/doc/man/man3/ldap_get_option.3 ++++ b/doc/man/man3/ldap_get_option.3 +@@ -557,6 +557,22 @@ must be a + .BR "char **" . + Its content needs to be freed by the caller using + .BR ldap_memfree (3). ++.B LDAP_OPT_X_SASL_CBINDING ++Sets/gets the channel-binding type to use in SASL, ++one of ++.BR LDAP_OPT_X_SASL_CBINDING_NONE ++(the default), ++.BR LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE ++the "tls-unique" type from RCF 5929. ++.BR LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT ++the "tls-server-end-point" from RCF 5929, compatible with Windows. ++.BR invalue ++must be ++.BR "const int *" ; ++.BR outvalue ++must be ++.BR "int *" . ++.TP + .SH TCP OPTIONS + The TCP options are OpenLDAP specific. + Mainly intended for use with Linux, they may not be portable. +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index adf134899..29810fc9f 100644 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -286,6 +286,9 @@ size allowed. 0 disables security layers. The default is 65536. + .TP + .B SASL_NOCANON + Do not perform reverse DNS lookups to canonicalize SASL host names. The default is off. ++.TP ++.B SASL_CBINDING ++The channel-binding type to use, see also LDAP_OPT_X_SASL_CBINDING. The default is none. + .SH GSSAPI OPTIONS + If OpenLDAP is built with Generic Security Services Application Programming Interface support, + there are more options you can specify. +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +index 0dddfdb6c..8c987d8c1 100644 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -699,6 +699,10 @@ Used to specify the fully qualified domain name used for SASL processing. + .B olcSaslRealm: + Specify SASL realm. Default is empty. + .TP ++.B olcSaslCbinding: none | tls-unique | tls-endpoint ++Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. ++Default is none. ++.TP + .B olcSaslSecProps: + Used to specify Cyrus SASL security properties. + The +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +index 0071072b1..203ab988e 100644 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -893,6 +893,9 @@ The + property specifies the maximum security layer receive buffer + size allowed. 0 disables security layers. The default is 65536. + .TP ++.B sasl\-cbinding none | tls-unique | tls-endpoint ++Specify the channel-binding type, see also LDAP_OPT_X_SASL_CBINDING. ++.TP + .B schemadn + Specify the distinguished name for the subschema subentry that + controls the entries on this server. The default is "cn=Subschema". +diff --git a/include/ldap.h b/include/ldap.h +index 88bfcabf8..e8ac968a9 100644 +--- a/include/ldap.h ++++ b/include/ldap.h +@@ -180,6 +180,10 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_1 ((3 << 8) + 2) + #define LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 ((3 << 8) + 3) + ++#define LDAP_OPT_X_SASL_CBINDING_NONE 0 ++#define LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE 1 ++#define LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT 2 ++ + /* OpenLDAP SASL options */ + #define LDAP_OPT_X_SASL_MECH 0x6100 + #define LDAP_OPT_X_SASL_REALM 0x6101 +@@ -195,6 +199,7 @@ LDAP_BEGIN_DECL + #define LDAP_OPT_X_SASL_NOCANON 0x610b + #define LDAP_OPT_X_SASL_USERNAME 0x610c /* read-only */ + #define LDAP_OPT_X_SASL_GSS_CREDS 0x610d ++#define LDAP_OPT_X_SASL_CBINDING 0x610e + + /* OpenLDAP GSSAPI options */ + #define LDAP_OPT_X_GSSAPI_DO_NOT_FREE_CONTEXT 0x6200 +diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h +index c586a95b5..b71552ec5 100644 +--- a/include/ldap_pvt.h ++++ b/include/ldap_pvt.h +@@ -262,6 +262,10 @@ LDAP_F (void *) ldap_pvt_sasl_mutex_new LDAP_P((void)); + LDAP_F (int) ldap_pvt_sasl_mutex_lock LDAP_P((void *mutex)); + LDAP_F (int) ldap_pvt_sasl_mutex_unlock LDAP_P((void *mutex)); + LDAP_F (void) ldap_pvt_sasl_mutex_dispose LDAP_P((void *mutex)); ++ ++LDAP_F (int) ldap_pvt_sasl_cbinding_parse LDAP_P(( const char *arg )); ++LDAP_F (void *) ldap_pvt_sasl_cbinding LDAP_P(( void *ssl, int type, ++ int is_server )); + #endif /* HAVE_CYRUS_SASL */ + + struct sockbuf; /* avoid pulling in */ +@@ -426,6 +430,7 @@ LDAP_F (int) ldap_pvt_tls_get_peer_dn LDAP_P(( void *ctx, struct berval *dn, + LDAPDN_rewrite_dummy *func, unsigned flags )); + LDAP_F (int) ldap_pvt_tls_get_strength LDAP_P(( void *ctx )); + LDAP_F (int) ldap_pvt_tls_get_unique LDAP_P(( void *ctx, struct berval *buf, int is_server )); ++LDAP_F (int) ldap_pvt_tls_get_endpoint LDAP_P(( void *ctx, struct berval *buf, int is_server )); + + LDAP_END_DECL + +diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c +index 3171d56a3..081e3cea5 100644 +--- a/libraries/libldap/cyrus.c ++++ b/libraries/libldap/cyrus.c +@@ -368,6 +368,65 @@ int ldap_int_sasl_close( LDAP *ld, LDAPConn *lc ) + return LDAP_SUCCESS; + } + ++int ldap_pvt_sasl_cbinding_parse( const char *arg ) ++{ ++ int i = -1; ++ ++ if ( strcasecmp(arg, "none") == 0 ) ++ i = LDAP_OPT_X_SASL_CBINDING_NONE; ++ else if ( strcasecmp(arg, "tls-unique") == 0 ) ++ i = LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE; ++ else if ( strcasecmp(arg, "tls-endpoint") == 0 ) ++ i = LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT; ++ ++ return i; ++} ++ ++void *ldap_pvt_sasl_cbinding( void *ssl, int type, int is_server ) ++{ ++#if defined(SASL_CHANNEL_BINDING) && defined(HAVE_TLS) ++ char unique_prefix[] = "tls-unique:"; ++ char endpoint_prefix[] = "tls-server-end-point:"; ++ char cbinding[ 64 ]; ++ struct berval cbv = { 64, cbinding }; ++ void *cb_data; /* used since cb->data is const* */ ++ sasl_channel_binding_t *cb; ++ char *prefix; ++ int plen; ++ ++ switch (type) { ++ case LDAP_OPT_X_SASL_CBINDING_NONE: ++ return NULL; ++ case LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE: ++ if ( !ldap_pvt_tls_get_unique( ssl, &cbv, is_server )) ++ return NULL; ++ prefix = unique_prefix; ++ plen = sizeof(unique_prefix) -1; ++ break; ++ case LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT: ++ if ( !ldap_pvt_tls_get_endpoint( ssl, &cbv, is_server )) ++ return NULL; ++ prefix = endpoint_prefix; ++ plen = sizeof(endpoint_prefix) -1; ++ break; ++ default: ++ return NULL; ++ } ++ ++ cb = ldap_memalloc( sizeof(*cb) + plen + cbv.bv_len ); ++ cb->len = plen + cbv.bv_len; ++ cb->data = cb_data = cb+1; ++ memcpy( cb_data, prefix, plen ); ++ memcpy( cb_data + plen, cbv.bv_val, cbv.bv_len ); ++ cb->name = "ldap"; ++ cb->critical = 0; ++ ++ return cb; ++#else ++ return NULL; ++#endif ++} ++ + int + ldap_int_sasl_bind( + LDAP *ld, +@@ -497,17 +556,12 @@ ldap_int_sasl_bind( + (void) ldap_int_sasl_external( ld, ld->ld_defconn, authid.bv_val, fac ); + LDAP_FREE( authid.bv_val ); + #ifdef SASL_CHANNEL_BINDING /* 2.1.25+ */ +- { +- char cbinding[64]; +- struct berval cbv = { sizeof(cbinding), cbinding }; +- if ( ldap_pvt_tls_get_unique( ssl, &cbv, 0 )) { +- sasl_channel_binding_t *cb = ldap_memalloc( sizeof(*cb) + +- cbv.bv_len); +- cb->name = "ldap"; +- cb->critical = 0; +- cb->data = (char *)(cb+1); +- cb->len = cbv.bv_len; +- memcpy( cb->data, cbv.bv_val, cbv.bv_len ); ++ if ( ld->ld_defconn->lconn_sasl_cbind == NULL ) { ++ void *cb; ++ cb = ldap_pvt_sasl_cbinding( ssl, ++ ld->ld_options.ldo_sasl_cbinding, ++ 0 ); ++ if ( cb != NULL ) { + sasl_setprop( ld->ld_defconn->lconn_sasl_authctx, + SASL_CHANNEL_BINDING, cb ); + ld->ld_defconn->lconn_sasl_cbind = cb; +@@ -930,12 +984,20 @@ int ldap_pvt_sasl_secprops( + int + ldap_int_sasl_config( struct ldapoptions *lo, int option, const char *arg ) + { +- int rc; ++ int rc, i; + + switch( option ) { + case LDAP_OPT_X_SASL_SECPROPS: + rc = ldap_pvt_sasl_secprops( arg, &lo->ldo_sasl_secprops ); + if( rc == LDAP_SUCCESS ) return 0; ++ break; ++ case LDAP_OPT_X_SASL_CBINDING: ++ i = ldap_pvt_sasl_cbinding_parse( arg ); ++ if ( i >= 0 ) { ++ lo->ldo_sasl_cbinding = i; ++ return 0; ++ } ++ break; + } + + return -1; +@@ -1041,6 +1103,10 @@ ldap_int_sasl_get_option( LDAP *ld, int option, void *arg ) + /* this option is write only */ + return -1; + ++ case LDAP_OPT_X_SASL_CBINDING: ++ *(int *)arg = ld->ld_options.ldo_sasl_cbinding; ++ break; ++ + #ifdef SASL_GSS_CREDS + case LDAP_OPT_X_SASL_GSS_CREDS: { + sasl_conn_t *ctx; +@@ -1142,6 +1208,17 @@ ldap_int_sasl_set_option( LDAP *ld, int option, void *arg ) + return sc == LDAP_SUCCESS ? 0 : -1; + } + ++ case LDAP_OPT_X_SASL_CBINDING: ++ if ( !arg ) return -1; ++ switch( *(int *) arg ) { ++ case LDAP_OPT_X_SASL_CBINDING_NONE: ++ case LDAP_OPT_X_SASL_CBINDING_TLS_UNIQUE: ++ case LDAP_OPT_X_SASL_CBINDING_TLS_ENDPOINT: ++ ld->ld_options.ldo_sasl_cbinding = *(int *) arg; ++ return 0; ++ } ++ return -1; ++ + #ifdef SASL_GSS_CREDS + case LDAP_OPT_X_SASL_GSS_CREDS: { + sasl_conn_t *ctx; +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index 746824fbd..0c4b6237e 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -113,6 +113,7 @@ static const struct ol_attribute { + offsetof(struct ldapoptions, ldo_def_sasl_authzid)}, + {0, ATTR_SASL, "SASL_SECPROPS", NULL, LDAP_OPT_X_SASL_SECPROPS}, + {0, ATTR_BOOL, "SASL_NOCANON", NULL, LDAP_BOOL_SASL_NOCANON}, ++ {0, ATTR_SASL, "SASL_CBINDING", NULL, LDAP_OPT_X_SASL_CBINDING}, + #endif + + #ifdef HAVE_GSSAPI +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 397894271..08d4b4a92 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -276,6 +276,7 @@ struct ldapoptions { + + /* SASL Security Properties */ + struct sasl_security_properties ldo_sasl_secprops; ++ int ldo_sasl_cbinding; + #define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0} + #else + #define LDAP_LDO_SASL_NULLARG +diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h +index 103004fa7..77975bb6c 100644 +--- a/libraries/libldap/ldap-tls.h ++++ b/libraries/libldap/ldap-tls.h +@@ -42,6 +42,7 @@ typedef int (TI_session_dn)(tls_session *sess, struct berval *dn); + typedef int (TI_session_chkhost)(LDAP *ld, tls_session *s, const char *name_in); + typedef int (TI_session_strength)(tls_session *sess); + typedef int (TI_session_unique)(tls_session *sess, struct berval *buf, int is_server); ++typedef int (TI_session_endpoint)(tls_session *sess, struct berval *buf, int is_server); + typedef int (TI_session_peercert)(tls_session *s, struct berval *der); + + typedef void (TI_thr_init)(void); +@@ -67,6 +68,7 @@ typedef struct tls_impl { + TI_session_chkhost *ti_session_chkhost; + TI_session_strength *ti_session_strength; + TI_session_unique *ti_session_unique; ++ TI_session_endpoint *ti_session_endpoint; + TI_session_peercert *ti_session_peercert; + + Sockbuf_IO *ti_sbio; +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 8b1fee748..f74af7d1d 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -1041,6 +1041,13 @@ ldap_pvt_tls_get_unique( void *s, struct berval *buf, int is_server ) + return tls_imp->ti_session_unique( session, buf, is_server ); + } + ++int ++ldap_pvt_tls_get_endpoint( void *s, struct berval *buf, int is_server ) ++{ ++ tls_session *session = s; ++ return tls_imp->ti_session_endpoint( session, buf, is_server ); ++} ++ + int + ldap_pvt_tls_get_peercert( void *s, struct berval *der ) + { +diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c +index 26d9f99ce..52dfcd3ab 100644 +--- a/libraries/libldap/tls_g.c ++++ b/libraries/libldap/tls_g.c +@@ -675,6 +675,64 @@ tlsg_session_unique( tls_session *sess, struct berval *buf, int is_server) + return 0; + } + ++static int ++tlsg_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) ++{ ++ tlsg_session *s = (tlsg_session *)sess; ++ const gnutls_datum_t *cert_data; ++ gnutls_x509_crt_t server_cert; ++ gnutls_digest_algorithm_t md; ++ int sign_algo, md_len, rc; ++ ++ if ( is_server ) ++ cert_data = gnutls_certificate_get_ours( s->session ); ++ else ++ cert_data = gnutls_certificate_get_peers( s->session, NULL ); ++ ++ if ( cert_data == NULL ) ++ return 0; ++ ++ rc = gnutls_x509_crt_init( &server_cert ); ++ if ( rc != GNUTLS_E_SUCCESS ) ++ return 0; ++ ++ rc = gnutls_x509_crt_import( server_cert, cert_data, GNUTLS_X509_FMT_DER ); ++ if ( rc != GNUTLS_E_SUCCESS ) { ++ gnutls_x509_crt_deinit( server_cert ); ++ return 0; ++ } ++ ++ sign_algo = gnutls_x509_crt_get_signature_algorithm( server_cert ); ++ gnutls_x509_crt_deinit( server_cert ); ++ if ( sign_algo <= GNUTLS_SIGN_UNKNOWN ) ++ return 0; ++ ++ md = gnutls_sign_get_hash_algorithm( sign_algo ); ++ if ( md == GNUTLS_DIG_UNKNOWN ) ++ return 0; ++ ++ /* See RFC 5929 */ ++ switch (md) { ++ case GNUTLS_DIG_NULL: ++ case GNUTLS_DIG_MD2: ++ case GNUTLS_DIG_MD5: ++ case GNUTLS_DIG_SHA1: ++ md = GNUTLS_DIG_SHA256; ++ } ++ ++ md_len = gnutls_hash_get_len( md ); ++ if ( md_len == 0 || md_len > buf->bv_len ) ++ return 0; ++ ++ rc = gnutls_hash_fast( md, cert_data->data, cert_data->size, buf->bv_val ); ++ if ( rc != GNUTLS_E_SUCCESS ) ++ return 0; ++ ++ buf->bv_len = md_len; ++ ++ return md_len; ++} ++ + static int + tlsg_session_peercert( tls_session *sess, struct berval *der ) + { +@@ -950,6 +1008,7 @@ tls_impl ldap_int_tls_impl = { + tlsg_session_chkhost, + tlsg_session_strength, + tlsg_session_unique, ++ tlsg_session_endpoint, + tlsg_session_peercert, + + &tlsg_sbio, +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index 157923289..8ede11572 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -861,6 +861,50 @@ tlso_session_unique( tls_session *sess, struct berval *buf, int is_server) + return buf->bv_len; + } + ++static int ++tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) ++{ ++ tlso_session *s = (tlso_session *)sess; ++ const EVP_MD *md; ++ unsigned int md_len; ++ X509 *cert; ++ ++ if ( buf->bv_len < EVP_MAX_MD_SIZE ) ++ return 0; ++ ++ if ( is_server ) ++ cert = SSL_get_certificate( s ); ++ else ++ cert = SSL_get_peer_certificate( s ); ++ ++ if ( cert == NULL ) ++ return 0; ++ ++#if OPENSSL_VERSION_NUMBER >= 0x10100000 ++ md = EVP_get_digestbynid( X509_get_signature_nid( cert )); ++#else ++ md = EVP_get_digestbynid(OBJ_obj2nid( cert->sig_alg->algorithm )); ++#endif ++ ++ /* See RFC 5929 */ ++ if ( md == NULL || ++ md == EVP_md_null() || ++#ifndef OPENSSL_NO_MD2 ++ md == EVP_md2() || ++#endif ++ md == EVP_md4() || ++ md == EVP_md5() || ++ md == EVP_sha1() ) ++ md = EVP_sha256(); ++ ++ if ( !X509_digest( cert, md, buf->bv_val, &md_len )) ++ return 0; ++ ++ buf->bv_len = md_len; ++ ++ return md_len; ++} ++ + static int + tlso_session_peercert( tls_session *sess, struct berval *der ) + { +@@ -1394,6 +1438,7 @@ tls_impl ldap_int_tls_impl = { + tlso_session_chkhost, + tlso_session_strength, + tlso_session_unique, ++ tlso_session_endpoint, + tlso_session_peercert, + + &tlso_sbio, +diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c +index 3188ccfbe..8c4ccb860 100644 +--- a/servers/slapd/bconfig.c ++++ b/servers/slapd/bconfig.c +@@ -569,6 +569,15 @@ static ConfigTable config_back_cf_table[] = { + #endif + "( OLcfgGlAt:89 NAME 'olcSaslAuxprops' " + "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ++ { "sasl-cbinding", NULL, 2, 2, 0, ++#ifdef HAVE_CYRUS_SASL ++ ARG_STRING, &sasl_cbinding, ++#else ++ ARG_IGNORED, NULL, ++#endif ++ "( OLcfgGlAt:100 NAME 'olcSaslCBinding' " ++ "EQUALITY caseIgnoreMatch " ++ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, + { "sasl-host", "host", 2, 2, 0, + #ifdef HAVE_CYRUS_SASL + ARG_STRING|ARG_UNIQUE, &sasl_host, +@@ -820,7 +829,7 @@ static ConfigOCs cf_ocs[] = { + "olcPluginLogFile $ olcReadOnly $ olcReferral $ " + "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ " + "olcRootDSE $ " +- "olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ " ++ "olcSaslAuxprops $ olcSaslCBinding $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ " + "olcSecurity $ olcServerID $ olcSizeLimit $ " + "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ " + "olcTCPBuffer $ " +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index 5108da696..77dd3c1ae 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -73,6 +73,7 @@ char *global_host = NULL; + struct berval global_host_bv = BER_BVNULL; + char *global_realm = NULL; + char *sasl_host = NULL; ++char *sasl_cbinding = NULL; + char **default_passwd_hash = NULL; + struct berval default_search_base = BER_BVNULL; + struct berval default_search_nbase = BER_BVNULL; +diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c +index 0602fdceb..d074009e4 100644 +--- a/servers/slapd/connection.c ++++ b/servers/slapd/connection.c +@@ -1430,12 +1430,9 @@ connection_read( ber_socket_t s, conn_readinfo *cri ) + c->c_connid, (int) s, c->c_tls_ssf, c->c_ssf, 0 ); + slap_sasl_external( c, c->c_tls_ssf, &authid ); + if ( authid.bv_val ) free( authid.bv_val ); +- { +- char cbinding[64]; +- struct berval cbv = { sizeof(cbinding), cbinding }; +- if ( ldap_pvt_tls_get_unique( ssl, &cbv, 1 )) +- slap_sasl_cbinding( c, &cbv ); +- } ++ ++ slap_sasl_cbinding( c, ssl ); ++ + } else if ( rc == 1 && ber_sockbuf_ctrl( c->c_sb, + LBER_SB_OPT_NEEDS_WRITE, NULL )) { /* need to retry */ + slapd_set_write( s, 1 ); +diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h +index de1cabf32..9b52760bd 100644 +--- a/servers/slapd/proto-slap.h ++++ b/servers/slapd/proto-slap.h +@@ -1657,8 +1657,7 @@ LDAP_SLAPD_F (int) slap_sasl_external( Connection *c, + slap_ssf_t ssf, /* relative strength of external security */ + struct berval *authid ); /* asserted authenication id */ + +-LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, +- struct berval *cbv ); ++LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, void *ssl ); + + LDAP_SLAPD_F (int) slap_sasl_reset( Connection *c ); + LDAP_SLAPD_F (int) slap_sasl_close( Connection *c ); +@@ -2039,6 +2038,7 @@ LDAP_SLAPD_V (char *) global_host; + LDAP_SLAPD_V (struct berval) global_host_bv; + LDAP_SLAPD_V (char *) global_realm; + LDAP_SLAPD_V (char *) sasl_host; ++LDAP_SLAPD_V (char *) sasl_cbinding; + LDAP_SLAPD_V (char *) slap_sasl_auxprops; + LDAP_SLAPD_V (char **) default_passwd_hash; + LDAP_SLAPD_V (int) lber_debug; +diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c +index 258cd5407..c14e8a628 100644 +--- a/servers/slapd/sasl.c ++++ b/servers/slapd/sasl.c +@@ -1203,6 +1203,8 @@ int slap_sasl_destroy( void ) + #endif + free( sasl_host ); + sasl_host = NULL; ++ free( sasl_cbinding ); ++ sasl_cbinding = NULL; + + return 0; + } +@@ -1389,17 +1391,24 @@ int slap_sasl_external( + return LDAP_SUCCESS; + } + +-int slap_sasl_cbinding( Connection *conn, struct berval *cbv ) ++int slap_sasl_cbinding( Connection *conn, void *ssl ) + { + #ifdef SASL_CHANNEL_BINDING +- sasl_channel_binding_t *cb = ch_malloc( sizeof(*cb) + cbv->bv_len );; +- cb->name = "ldap"; +- cb->critical = 0; +- cb->data = (char *)(cb+1); +- cb->len = cbv->bv_len; +- memcpy( cb->data, cbv->bv_val, cbv->bv_len ); +- sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); +- conn->c_sasl_cbind = cb; ++ void *cb; ++ int i; ++ ++ if ( sasl_cbinding == NULL ) ++ return LDAP_SUCCESS; ++ ++ i = ldap_pvt_sasl_cbinding_parse( sasl_cbinding ); ++ if ( i < 0 ) ++ return LDAP_SUCCESS; ++ ++ cb = ldap_pvt_sasl_cbinding( ssl, i, 1 ); ++ if ( cb != NULL ) { ++ sasl_setprop( conn->c_sasl_authctx, SASL_CHANNEL_BINDING, cb ); ++ conn->c_sasl_cbind = cb; ++ } + #endif + return LDAP_SUCCESS; + } +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch b/SOURCES/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch new file mode 100644 index 0000000..a8727dc --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch @@ -0,0 +1,45 @@ +From 7b0017ad49a2290ec26cbcdffded8a527799e981 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 18 Apr 2020 16:30:03 +0200 +Subject: [PATCH] ITS#9189 add channel-bindings tests + +--- + tests/scripts/test068-sasl-tls-external | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external +index dcbc50fd4..ee112cf98 100755 +--- a/tests/scripts/test068-sasl-tls-external ++++ b/tests/scripts/test068-sasl-tls-external +@@ -88,6 +88,28 @@ else + echo "success" + fi + ++# Exercise channel-bindings code in builds without SASL support ++for cb in "none" "tls-unique" "tls-endpoint" ; do ++ ++ echo -n "Using ldapwhoami with SASL/EXTERNAL and SASL_CBINDING (${cb})...." ++ ++ $LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ -o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt \ ++ -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key \ ++ -o tls_reqcert=hard -o SASL_CBINDING=$cb -ZZ -Y EXTERNAL -H $URIP1 \ ++ > $TESTOUT 2>&1 ++ ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ test $KILLSERVERS != no && kill -HUP $PID ++ exit $RC ++ else ++ echo "success" ++ fi ++done ++ ++ + test $KILLSERVERS != no && kill -HUP $KILLPIDS + + if test $RC != 0 ; then +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch b/SOURCES/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch new file mode 100644 index 0000000..ee9a3ca --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch @@ -0,0 +1,27 @@ +From 4cac398b19c21ad56949ef7e67e285c6c8e7ecea Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 23 Apr 2020 22:47:32 +0200 +Subject: [PATCH] ITS#9189 - initialize ldo_sasl_cbinding in + LDAP_LDO_SASL_NULLARG + +Reported-by: Ryan Tandy @ryan +--- + libraries/libldap/ldap-int.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h +index 08d4b4a92..8c7f1e5c1 100644 +--- a/libraries/libldap/ldap-int.h ++++ b/libraries/libldap/ldap-int.h +@@ -277,7 +277,7 @@ struct ldapoptions { + /* SASL Security Properties */ + struct sasl_security_properties ldo_sasl_secprops; + int ldo_sasl_cbinding; +-#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0} ++#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0},0 + #else + #define LDAP_LDO_SASL_NULLARG + #endif +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch b/SOURCES/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch new file mode 100644 index 0000000..ec62c85 --- /dev/null +++ b/SOURCES/openldap-cbinding-ITS-9215-fix-for-glibc-again.patch @@ -0,0 +1,28 @@ +From d548ab15e0d615524c403440c01a9748bfcac87d Mon Sep 17 00:00:00 2001 +From: Howard Chu +Date: Tue, 28 Apr 2020 16:33:41 +0100 +Subject: [PATCH] ITS#9215 fix for glibc again + +--- + libraries/libldap_r/thr_posix.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libraries/libldap_r/thr_posix.c b/libraries/libldap_r/thr_posix.c +index e4b435707..62f94ca16 100644 +--- a/libraries/libldap_r/thr_posix.c ++++ b/libraries/libldap_r/thr_posix.c +@@ -18,6 +18,11 @@ + + #if defined( HAVE_PTHREADS ) + ++#ifdef __GLIBC__ ++#undef _FEATURES_H ++#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */ ++#endif ++ + #include + + #ifdef REPLACE_BROKEN_YIELD +-- +2.31.1 + diff --git a/SOURCES/openldap-cbinding-Make-prototypes-available-where-needed.patch b/SOURCES/openldap-cbinding-Make-prototypes-available-where-needed.patch new file mode 100644 index 0000000..206f7ca --- /dev/null +++ b/SOURCES/openldap-cbinding-Make-prototypes-available-where-needed.patch @@ -0,0 +1,64 @@ +NOTE: The patch has been adjusted to match the base code before backporting. + +From cd914149a665167b2c5ae16baa0c438824588819 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Tue, 19 Feb 2019 10:26:39 +0000 +Subject: [PATCH] Make prototypes available where needed + +--- + libraries/libldap/tls2.c | 3 +++ + servers/slapd/config.c | 1 + + servers/slapd/proto-slap.h | 4 ++++ + 3 files changed, 8 insertions(+) + +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index ad09ba39b..8b1fee748 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -76,6 +76,9 @@ static oid_name oids[] = { + + #ifdef HAVE_TLS + ++LDAP_F(int) ldap_pvt_tls_check_hostname LDAP_P(( LDAP *ld, void *s, const char *name_in )); ++LDAP_F(int) ldap_pvt_tls_get_peercert LDAP_P(( void *s, struct berval *der )); ++ + void + ldap_pvt_tls_ctx_free ( void *c ) + { +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index bd68a2421..5108da696 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -48,6 +48,7 @@ + #endif + #include "lutil.h" + #include "lutil_ldap.h" ++#include "ldif.h" + #include "config.h" + + #ifdef _WIN32 +diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h +index 7f8e604fa..de1cabf32 100644 +--- a/servers/slapd/proto-slap.h ++++ b/servers/slapd/proto-slap.h +@@ -739,6 +739,7 @@ LDAP_SLAPD_F (int) bindconf_unparse LDAP_P(( + LDAP_SLAPD_F (int) bindconf_tls_set LDAP_P(( + slap_bindconf *bc, LDAP *ld )); + LDAP_SLAPD_F (void) bindconf_free LDAP_P(( slap_bindconf *bc )); ++LDAP_SLAPD_F (void) slap_client_keepalive LDAP_P(( LDAP *ld, slap_keepalive *sk )); + LDAP_SLAPD_F (int) slap_client_connect LDAP_P(( LDAP **ldp, slap_bindconf *sb )); + LDAP_SLAPD_F (int) config_generic_wrapper LDAP_P(( Backend *be, + const char *fname, int lineno, int argc, char **argv )); +@@ -1656,6 +1657,9 @@ LDAP_SLAPD_F (int) slap_sasl_external( Connection *c, + slap_ssf_t ssf, /* relative strength of external security */ + struct berval *authid ); /* asserted authenication id */ + ++LDAP_SLAPD_F (int) slap_sasl_cbinding( Connection *c, ++ struct berval *cbv ); ++ + LDAP_SLAPD_F (int) slap_sasl_reset( Connection *c ); + LDAP_SLAPD_F (int) slap_sasl_close( Connection *c ); + +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-Update-keys-to-RSA-4096.patch b/SOURCES/openldap-cbinding-Update-keys-to-RSA-4096.patch new file mode 100644 index 0000000..f4342e4 --- /dev/null +++ b/SOURCES/openldap-cbinding-Update-keys-to-RSA-4096.patch @@ -0,0 +1,526 @@ +From 3ab98b2fc98843289c1833891518fb3b5b42dcd8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= +Date: Tue, 30 Oct 2018 15:42:35 +0000 +Subject: [PATCH] Update keys to RSA 4096 + +--- + tests/data/tls/ca/certs/testsuiteCA.crt | 133 ++++++++++++++++-- + tests/data/tls/ca/private/testsuiteCA.key | 64 +++++++-- + .../tls/certs/bjensen@mailgw.example.com.crt | 44 ++++-- + tests/data/tls/certs/localhost.crt | 44 ++++-- + tests/data/tls/conf/openssl.cnf | 2 +- + tests/data/tls/create-crt.sh | 9 +- + .../private/bjensen@mailgw.example.com.key | 64 +++++++-- + tests/data/tls/private/localhost.key | 64 +++++++-- + 8 files changed, 336 insertions(+), 88 deletions(-) + +diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt +index 7458e7461..62c88acca 100644 +--- a/tests/data/tls/ca/certs/testsuiteCA.crt ++++ b/tests/data/tls/ca/certs/testsuiteCA.crt +@@ -1,16 +1,121 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: ++ 0b:43:f8:e9:ee:d3:38:37:92:db:19:65:d9:94:17:cc:70:45:d4:06 ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=US, ST=CA, O=OpenLDAP Foundation, OU=OpenLDAP Test Suite ++ Validity ++ Not Before: Oct 30 15:29:02 2018 GMT ++ Not After : Nov 13 15:29:02 2519 GMT ++ Subject: C=US, ST=CA, O=OpenLDAP Foundation, OU=OpenLDAP Test Suite ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (4096 bit) ++ Modulus: ++ 00:be:e0:ff:36:89:65:c0:4e:46:e6:24:e8:3d:81: ++ 97:92:28:4b:11:c6:21:ac:28:14:31:b2:a3:64:24: ++ 62:61:24:bd:76:7b:9e:7c:3a:50:65:fa:97:f3:c5: ++ 9d:49:cc:61:3a:31:6f:0d:a4:d8:70:57:73:c8:c6: ++ 66:06:d0:59:3f:24:3b:56:5d:70:20:e4:51:2b:88: ++ 5e:f4:78:82:bc:55:b5:d5:5b:f6:e5:55:1f:3a:af: ++ 59:9f:b7:5d:72:70:fe:b6:a4:dd:4e:f9:d0:38:e8: ++ 15:14:c7:45:ed:5e:d3:4c:ee:02:34:3a:37:d8:75: ++ f1:49:0d:f6:8a:7b:8c:87:39:c9:fb:f2:3a:96:57: ++ cd:7c:18:a7:bb:35:de:d3:c4:79:57:20:48:07:b9: ++ 65:f6:bd:7b:01:5c:99:8a:92:35:7c:b7:e3:96:1c: ++ 6f:4c:47:42:c1:77:d6:62:49:0e:be:01:8f:c9:f4: ++ 64:68:4c:b0:ec:10:12:d0:0e:5f:67:0e:e8:a4:bd: ++ df:9c:fb:5b:04:6f:3c:2a:35:1b:5a:ca:98:ba:f3: ++ 61:f4:3a:77:28:be:a3:63:f1:d6:94:0d:fb:a0:87: ++ e3:a5:9f:56:b6:a6:6a:90:13:80:2a:2e:ae:fe:af: ++ aa:e3:e7:d8:3b:2b:a3:52:4f:73:2d:12:aa:e2:a3: ++ 0c:aa:fb:11:40:86:68:de:be:2b:9b:36:19:9c:d7: ++ d7:5e:13:21:c9:b3:34:6d:09:53:ff:a3:2e:92:f4: ++ 33:80:de:7a:47:1c:47:57:68:53:2a:db:73:6e:6d: ++ fa:40:df:55:25:a1:fc:87:c4:86:ef:6e:16:ec:f8: ++ 48:35:f5:96:b3:55:ce:56:a9:6e:c1:8c:ea:32:85: ++ 26:ea:af:0c:92:24:05:e2:49:12:b7:07:8f:06:96: ++ be:13:fa:ec:49:f7:d4:49:6f:b9:c7:6c:79:53:39: ++ a3:89:c4:4a:92:66:b0:f3:0c:72:6d:50:3c:63:1f: ++ f3:76:63:a8:aa:b7:fd:db:ef:98:b4:5b:49:b6:84: ++ 66:e5:fc:60:0b:c1:f7:b0:f7:84:68:7e:71:5d:ac: ++ fc:a9:cb:f6:02:fc:86:d3:a7:c3:42:ef:ba:f4:1a: ++ 27:71:5d:22:f5:53:e1:a6:f4:a5:dc:31:38:45:0b: ++ a1:6d:ab:9c:05:2e:87:8c:31:02:99:80:6d:3f:66: ++ e8:8a:d7:64:4f:08:7e:2f:f0:1f:28:ff:85:57:22: ++ ee:6a:a7:05:72:f8:cf:5d:07:c6:73:23:82:85:82: ++ 76:4e:36:8a:ec:ea:f1:53:1e:e0:77:d1:4a:9f:df: ++ ec:87:91:0a:56:40:b7:23:19:fa:60:14:d0:f0:32: ++ 4d:11:39 ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Key Identifier: ++ 90:CF:51:1D:E8:08:D4:4C:34:70:71:6B:D2:0B:00:68:D9:FD:60:50 ++ X509v3 Authority Key Identifier: ++ keyid:90:CF:51:1D:E8:08:D4:4C:34:70:71:6B:D2:0B:00:68:D9:FD:60:50 ++ ++ X509v3 Basic Constraints: critical ++ CA:TRUE ++ Signature Algorithm: sha256WithRSAEncryption ++ 0f:7f:a0:c5:3c:ac:dc:ed:8f:56:3e:64:89:e6:87:d0:ca:a5: ++ 37:b8:0e:49:aa:93:d3:e5:ac:ff:54:24:91:07:1b:9c:dc:08: ++ e6:cc:15:53:be:85:4c:51:52:d3:88:d0:d8:c7:b7:98:40:41: ++ 8a:a7:7a:4c:96:85:61:8c:98:76:f6:a3:2c:10:31:a1:d8:e6: ++ a7:4c:ec:c3:29:ad:04:8b:e3:f2:2d:4c:30:0d:a4:bc:c8:93: ++ d2:9b:88:1d:a4:25:eb:ff:9f:f2:d9:c5:3b:bf:51:91:71:06: ++ 92:35:96:5c:ca:6d:d6:86:47:63:07:7f:37:35:53:68:e9:4e: ++ d0:d0:25:42:18:e0:00:9e:ca:f5:bd:b7:94:ee:99:51:44:3a: ++ 0c:44:40:e3:87:e6:ce:6c:2b:3f:c1:01:6c:5c:32:d5:59:b5: ++ bd:25:a3:1a:ff:85:a5:89:9c:d8:24:4b:fa:59:99:5a:64:ab: ++ a1:d8:0f:c0:19:28:84:1e:89:c2:a1:15:4e:0f:7e:1f:bf:f8: ++ 92:df:9f:1c:d5:4a:98:40:82:ee:41:1f:de:f7:25:11:fd:76: ++ 0a:cf:37:40:bc:c2:2d:6a:ea:4a:0c:6d:b0:e6:75:37:b5:63: ++ a8:a1:c5:81:d0:84:c0:f3:e0:c3:5c:c4:9f:ec:3b:9f:8a:74: ++ ce:f0:cc:e3:e9:15:08:a0:ea:3e:a9:8e:bc:9a:01:00:96:fe: ++ 37:6f:61:b5:2c:4b:1f:5d:d7:24:09:fe:bf:f4:77:47:e4:ee: ++ 7c:ea:6b:67:84:ee:56:4f:5f:b9:b8:e4:db:70:e1:4a:b3:94: ++ 4d:dd:52:45:05:4d:79:d4:7c:8b:9d:9b:6a:0b:73:9e:f3:0e: ++ d5:d5:46:da:b4:fb:4a:ea:5b:ab:8e:42:68:0e:96:cd:8a:6e: ++ 35:a8:e6:1b:6a:ed:a8:9e:3c:cc:3b:44:54:b8:2d:ba:c7:83: ++ 91:7c:70:40:0c:14:b8:21:7a:12:ac:8c:96:4c:94:a6:ee:fe: ++ cc:77:34:8e:e3:c3:c0:44:19:51:85:07:6c:d8:d1:2e:69:8d: ++ b1:0e:42:fb:e6:16:65:86:c6:e3:2f:a7:3f:b4:8e:4f:1c:83: ++ c4:0a:ae:a0:d9:17:fd:cf:a2:38:a1:9f:70:dc:5c:df:3c:07: ++ 7b:64:01:ff:35:8c:45:43:e8:fa:a4:f6:c4:71:78:17:6e:6a: ++ 7f:d1:6e:66:c6:89:33:3b:28:4a:76:bf:ca:29:05:51:07:98: ++ ce:63:62:25:61:7f:5e:c6:91:23:02:13:15:4f:fd:24:58:9d: ++ 2d:ac:eb:cb:9a:c2:82:2f:50:5c:5a:16:bb:8c:bf:4d:66:2c: ++ 6f:1c:c4:a9:28:e1:3d:4d + -----BEGIN CERTIFICATE----- +-MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV +-BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv +-bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0 +-NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB +-MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB +-UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd +-rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb +-lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL +-6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU +-7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB +-SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/ +-wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws +-ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q +-aL52EFPS0o3tiAJXS82U2wrQdJ0YEw== ++MIIFjzCCA3egAwIBAgIUC0P46e7TODeS2xll2ZQXzHBF1AYwDQYJKoZIhvcNAQEL ++BQAwVjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRwwGgYDVQQKDBNPcGVuTERB ++UCBGb3VuZGF0aW9uMRwwGgYDVQQLDBNPcGVuTERBUCBUZXN0IFN1aXRlMCAXDTE4 ++MTAzMDE1MjkwMloYDzI1MTkxMTEzMTUyOTAyWjBWMQswCQYDVQQGEwJVUzELMAkG ++A1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNVBAsM ++E09wZW5MREFQIFRlc3QgU3VpdGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK ++AoICAQC+4P82iWXATkbmJOg9gZeSKEsRxiGsKBQxsqNkJGJhJL12e558OlBl+pfz ++xZ1JzGE6MW8NpNhwV3PIxmYG0Fk/JDtWXXAg5FEriF70eIK8VbXVW/blVR86r1mf ++t11ycP62pN1O+dA46BUUx0XtXtNM7gI0OjfYdfFJDfaKe4yHOcn78jqWV818GKe7 ++Nd7TxHlXIEgHuWX2vXsBXJmKkjV8t+OWHG9MR0LBd9ZiSQ6+AY/J9GRoTLDsEBLQ ++Dl9nDuikvd+c+1sEbzwqNRtaypi682H0OncovqNj8daUDfugh+Oln1a2pmqQE4Aq ++Lq7+r6rj59g7K6NST3MtEqriowyq+xFAhmjeviubNhmc19deEyHJszRtCVP/oy6S ++9DOA3npHHEdXaFMq23NubfpA31UlofyHxIbvbhbs+Eg19ZazVc5WqW7BjOoyhSbq ++rwySJAXiSRK3B48Glr4T+uxJ99RJb7nHbHlTOaOJxEqSZrDzDHJtUDxjH/N2Y6iq ++t/3b75i0W0m2hGbl/GALwfew94RofnFdrPypy/YC/IbTp8NC77r0GidxXSL1U+Gm ++9KXcMThFC6Ftq5wFLoeMMQKZgG0/ZuiK12RPCH4v8B8o/4VXIu5qpwVy+M9dB8Zz ++I4KFgnZONors6vFTHuB30Uqf3+yHkQpWQLcjGfpgFNDwMk0ROQIDAQABo1MwUTAd ++BgNVHQ4EFgQUkM9RHegI1Ew0cHFr0gsAaNn9YFAwHwYDVR0jBBgwFoAUkM9RHegI ++1Ew0cHFr0gsAaNn9YFAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC ++AgEAD3+gxTys3O2PVj5kieaH0MqlN7gOSaqT0+Ws/1QkkQcbnNwI5swVU76FTFFS ++04jQ2Me3mEBBiqd6TJaFYYyYdvajLBAxodjmp0zswymtBIvj8i1MMA2kvMiT0puI ++HaQl6/+f8tnFO79RkXEGkjWWXMpt1oZHYwd/NzVTaOlO0NAlQhjgAJ7K9b23lO6Z ++UUQ6DERA44fmzmwrP8EBbFwy1Vm1vSWjGv+FpYmc2CRL+lmZWmSrodgPwBkohB6J ++wqEVTg9+H7/4kt+fHNVKmECC7kEf3vclEf12Cs83QLzCLWrqSgxtsOZ1N7VjqKHF ++gdCEwPPgw1zEn+w7n4p0zvDM4+kVCKDqPqmOvJoBAJb+N29htSxLH13XJAn+v/R3 ++R+TufOprZ4TuVk9fubjk23DhSrOUTd1SRQVNedR8i52bagtznvMO1dVG2rT7Supb ++q45CaA6WzYpuNajmG2rtqJ48zDtEVLgtuseDkXxwQAwUuCF6EqyMlkyUpu7+zHc0 ++juPDwEQZUYUHbNjRLmmNsQ5C++YWZYbG4y+nP7SOTxyDxAquoNkX/c+iOKGfcNxc ++3zwHe2QB/zWMRUPo+qT2xHF4F25qf9FuZsaJMzsoSna/yikFUQeYzmNiJWF/XsaR ++IwITFU/9JFidLazry5rCgi9QXFoWu4y/TWYsbxzEqSjhPU0= + -----END CERTIFICATE----- +diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key +index 2e14d7033..01a6614c1 100644 +--- a/tests/data/tls/ca/private/testsuiteCA.key ++++ b/tests/data/tls/ca/private/testsuiteCA.key +@@ -1,16 +1,52 @@ + -----BEGIN PRIVATE KEY----- +-MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ +-WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc +-338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/ +-dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg +-O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf +-7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn +-rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f +-wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk +-AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l +-vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9 +-27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X +-KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N +-I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL +-+b2qljWeZbGH ++MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQC+4P82iWXATkbm ++JOg9gZeSKEsRxiGsKBQxsqNkJGJhJL12e558OlBl+pfzxZ1JzGE6MW8NpNhwV3PI ++xmYG0Fk/JDtWXXAg5FEriF70eIK8VbXVW/blVR86r1mft11ycP62pN1O+dA46BUU ++x0XtXtNM7gI0OjfYdfFJDfaKe4yHOcn78jqWV818GKe7Nd7TxHlXIEgHuWX2vXsB ++XJmKkjV8t+OWHG9MR0LBd9ZiSQ6+AY/J9GRoTLDsEBLQDl9nDuikvd+c+1sEbzwq ++NRtaypi682H0OncovqNj8daUDfugh+Oln1a2pmqQE4AqLq7+r6rj59g7K6NST3Mt ++Eqriowyq+xFAhmjeviubNhmc19deEyHJszRtCVP/oy6S9DOA3npHHEdXaFMq23Nu ++bfpA31UlofyHxIbvbhbs+Eg19ZazVc5WqW7BjOoyhSbqrwySJAXiSRK3B48Glr4T +++uxJ99RJb7nHbHlTOaOJxEqSZrDzDHJtUDxjH/N2Y6iqt/3b75i0W0m2hGbl/GAL ++wfew94RofnFdrPypy/YC/IbTp8NC77r0GidxXSL1U+Gm9KXcMThFC6Ftq5wFLoeM ++MQKZgG0/ZuiK12RPCH4v8B8o/4VXIu5qpwVy+M9dB8ZzI4KFgnZONors6vFTHuB3 ++0Uqf3+yHkQpWQLcjGfpgFNDwMk0ROQIDAQABAoICAQCVkIdpnE92V9+GBfVT/G9f ++vuLTkoRf+SeZqXgNx9SuebNbW5HblXXZ8nmOMZIFeXfVuVZjQn+1x1CaSZs4S5ki ++uKkmCyEJJN3VVo3Q0XzfRemsvNrA5+oIec2oMG2wdomfY59leqmFbZTXKy3HyT2Y ++Uga4FcYcfo4JyD8eU6DRdJ6oJC10EGiajFchghyPoqvRcSH/q24R4Ha5om1M/zOZ ++/hz+SlmLU2sjXVtGuCgtCdw5Sp5Ce5VF43JaRGjMwAnazEyjHPE8kEx8ZhCBG66B ++DqP6UrV736T3c0/Hww0fxFrENA4mIE/vhNgwNVQ5jDxDSC9ObesTW93Lu4za+Re6 ++pmP1eeS/oe1OcI1d/xK2IIQwzB7ZkJ0StbFLnjs7DATO7BGzhC9egC6s+z9oSgTS ++KvmLyoiL5U4fesVJwcCPKwwkVH9n22TuqmvB5mmvZvRTe2+OgDH55Nkfx1SoI8+Q ++/fwV9UXIIg5en+Kv8lOaWCZujmMsjHC79bwxPLeaePRwD/RBkT1MLW/T4fWGpAt3 ++H89+yufH31Y/1QMxVVtR9OdxCtljiXno/bArMNZ0oE1TiCcckMzdjKh7RNfkEXRM ++Pga92HBTgtJ3tfWJ4qOtJ4NKJPQ7wRmR03Bug8+bGM4K5HDO08fNuag/pP3AQvrM ++QGbHFVho3I7/DXnmRBq/gQKCAQEA75eptBtP8PWnN9uNsQoWxvFKQBtbLfPKUcVP +++LWOWF4ag2YRRf6TIzvGfIk54OGSL/srWCDKjXWJ0NgUn6yiqOkoP4oxEE1m2QDY ++7oCk9vJipJcrtNCKL6NhKwZDOjlDSROb/hBeMgr14Da/WkPE6zQhuwN5y4Japbjs ++cBYTao2uOg4QQz5Aee+ee55L6iAgMT0PnlQtv1uVW3D46e02CrQKtRmtDxqT3Nux ++nudJdz+rMFM0EDgVKUYRwFCa6xjI4y2K1aCwCtJG9yTJpYqCD9hehfwEije6dNNg ++p5RX3M9ai710Yx4F26cwX/t8AxqgF/2XBI0ZWD6x69cp7suPTQKCAQEAy/NUEgXN ++nymq8NK+umZwFJU7cy3weozRuEkmgmCWj4XYhbvTw6MbK+2R9XKa3ilqSd2sU2lX ++qE66kfAgqZMJ9RB+7nDOaLAMUuGw1DrwFZE7r3mKXgc4NgjtmGav4E3URXPHj5zb ++JbbN95zl96Fm3Nevs5p8sb0KexgbzHe4UzJNYFgT0l+TjJbJUAiNPsEw1bnV4cxn ++b1HO2CWTeGtAOJyjMRNwI+40wnk2N6An+Ddvb2mj2h30HujSZHnL94RAqa7RHDb6 ++lU+7JX/ll5G0mFQOFQAs4UPos2bg7hS1mfYO+UVrG4OH9gXns12158WqFED+lhmJ ++O8WDWEVAblVrnQKCAQAB9aOVrYOB3QB5HHqUMBjvl5mb3J1qSswkzxBQYGvBnUNq ++P7N0dxiM+TguXJD0neOsMMmx9tKxRXzTEHFavPa3mvCRVHgCQh/NNoyPps2yl1jn ++L7VTzUDUEuoAiBSUrVM3jcmA0nFyx1QreUcnXdaGde6wsN6WI4LKSDDm2cde37nF ++D8hiRGgSlzscl7bXO1wICw/No7KcFguqq8ndX+tJOx+7S3J25SjAbauOOSYIq6Si ++yItsdoj1xXTvtbkOoy1BbmXsSVwnOoEKFGrxx6g4qPRc9Cq1Vq9XtULdHAF79NYw ++vmPtS5mQqlVi85OYEuesSo6pot3KMvkRjLjzEwchAoIBACEvrvZfy12iwhX9tNtP ++39z5i3rqdr76OwXpoUKFxPoFpX3dWk/zMnCrb5yo0VplEs6CK5BHC+RvKxykHix5 ++qJ0f2geig3O1ccvqvYNLM9XOlA+xjzpNom/odADgdK3i/C9w74AG3gH9BPbNqP3q ++XXqB/i0Tbkbdo97zxVI4CN5AySZsLo2Ez9WIk6laOuGDPhcI7iyXvhz3CtlRA/YM ++PZ74nfVWXGD8WclrP889WEOjgZZ3choD1b1R1SpUR0Q3WO5Da/NTXuL83k7zyMAp ++DWHcC46PQL5G9o56pw8Wf5ZV24nkKdGITY9S1qjxDrBwEYTKLqLt9M6tDPpICnvp ++mmECggEBALfnUgpdGugn46UmQUMI1y+NZbSKhJHG+OBWdcc1j4kDZhF/Ei7g8pvk ++hFU5p/YA6JbGioZxiqjdrYLvgTPnJVkxy7arLTN2j2GVlhUA74BY+kNzENk2Tj9c ++zJSMVZn+WZrXNQhfYyA3FyW3wGN67GBXAHPQxFTdU3G4mR1WcyJCxKIyzP+2M8o9 ++16tpb80QRnc0OLm9Izppe7JUp2hCQt+O6E8izvLE8k2ldOr5ncTNWlxTJ0yx0hEO ++WTFqhwOM1pEmtxas1gLr8MX0hNsaQR+kjG2f8rPmH+GEZeeAwuhoJY1PcKAOYM5Y ++yu/1yFXYTrmhD/P0+nJn1DfS5JljCJY= + -----END PRIVATE KEY----- +diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +index 93e3a0d39..eb0fc693f 100644 +--- a/tests/data/tls/certs/bjensen@mailgw.example.com.crt ++++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt +@@ -1,16 +1,32 @@ + -----BEGIN CERTIFICATE----- +-MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL +-MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV +-BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx +-ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV +-BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD +-VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa +-YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A +-MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg +-QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU +-U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL +-MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn +-wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f +-7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo +-4DnnYQBDnq48VORVX94= ++MIIFfDCCA2SgAwIBAgIBADANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNV ++BAsME09wZW5MREFQIFRlc3QgU3VpdGUwIBcNMTgxMDMwMTUzNzQwWhgPMjUxOTEx ++MTMxNTM3NDBaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNVBAoM ++E09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYDVQQD ++DBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYaYmpl ++bnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw ++ggIKAoICAQCcHBkHcUSKG4s7nKmcqZT3EoZkEgxoaMlpxUZtxBtO5ZXEfcpMaxuA ++7qkZvMJR8ws2u8TQU/18FhH4+0aZBefM0ExwqvGNJ8F0cTl3439DGNE+/psh5NWg ++qPYe/K3bAtSRtF7wDxF77eb2Yz0J3NIDxFrAbovfg0ydbt9pWJr5pDBvlqSdYu38 ++kpIB5WENCEy77QK9GEGAlMVIRXneA5t2CKsljujRG1H5YJeS6qVAEdMllHZ6a0nN ++LxTdLe1qbZyRgEqRKgW5WcWrW46Co9CRDcFeMqoHdwAQsRdOGBivgkeYUST1yIms ++CbzlSRLC1dfj++2mzCMxoc3xpZNPyHyBuRgou8VqWpF2NuG+KS7QBtm1PVUhSAvR ++X9uQOnXnazQvlRfsaHQjGUKyhMUr5dcwpTqThW4BoqtStd6/097sZTZVWmsC+mzL ++twWkESVDU0tNg/czWLn56smV7DfPjFDDAV6eNcScFfD8w04aPdk8ODalW/wnsTjI ++LQuEBssrV1h8WblruWRU31Mn+mw9SA3tDfTk9sJiEyiTJh3B1DrEb+pIuk4vz5ui ++cNcYTXCfa5ZpPL608f7cWuG2GP8f5ug4PMKyRkh6qCt7BWrVgOheo1ZhjvrbmhI4 ++yPXHATrCtYO1wqIyu9Yuirdg7WJD6npu8IV38VEgEBD3UFanY9xN7wIDAQABow0w ++CzAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCq8VvpcoAgCK/D5yi/2puB ++LD7kYaVaSXxrUQBeLTmKERw3akpgW7QTGCNgM425VVaBQRPtv8YcX9OycUAylAA+ ++7lzwdP95OJGnUOjQY4x4iRAwCPkpDCcnwc43c3WAyQb2S46aZJaWK4S0+RM3CmWH ++1Fzb6aODdnoBEKk0XgNrB6/teB+UWgtTSxWiY/HWiArDaZDPMAxqEK0hnB+b/sBD ++ZoBYnfnQXezylqbk9vkzTIbSVrv5ZZdQELOAnPuxUCFpYew1OGKcg+1twYKDHgBS ++s13zN03eMEnC/O4Z01dhu16vqdikdP+tJJrppjvZtJys0KIP24ltDnpA6h/3m/Cl ++U1eiTDgWO+SsfiL1K4gcTL1eLjnCBFfnHN5gfgAV5w5DaKzvKp7Qu8db4DtH+S4o ++W/MBKuaHHKWUPGksvFUiGNgE/XyDU4MK34/5ulzbrWmqb24pYAzm1MyjsdzmXObw +++fzg6EDBB14cWA2hA7mSqnzkiW1pELVym6+uTaIlopSIFr8nNAimwLiY5QJNGYvd ++hgNNvOyUUO+nON3aHsC/rRMgar3eo7A9AkQJ6qKVvPR2h1317PJLuKaLfjbaCzNw ++iA3JSQjcwR2ydlSgKKN2d/XXm/G4PZ9tUcBY4Zngn0ViT0/m7MFy9qsiWG97+yaZ ++nYsN5WfwDZrtG24dTotxVQ== + -----END CERTIFICATE----- +diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt +index 194cb119d..3aeae3c16 100644 +--- a/tests/data/tls/certs/localhost.crt ++++ b/tests/data/tls/certs/localhost.crt +@@ -1,16 +1,32 @@ + -----BEGIN CERTIFICATE----- +-MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL +-MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV +-BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx +-ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE +-CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT +-dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB +-iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4 +-7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv +-8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ +-BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A +-AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG +-8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl +-0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR +-GjeZB1FxqDGHjxBq2O828iejw28bSz4= ++MIIFhTCCA22gAwIBAgIBADANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJVUzEL ++MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHDAaBgNV ++BAsME09wZW5MREFQIFRlc3QgU3VpdGUwIBcNMTgxMDMwMTUzNjMwWhgPMjUxOTEx ++MTMxNTM2MzBaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwT ++T3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBTdWl0 ++ZTESMBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC ++CgKCAgEA6Ud89ugah2oWY00q1g+M6NkpluewwvGq4tkMau1gq+Q5Biv61bubgdSA ++Z+Zkkxe3Sx0Zv7i5wldIN4wXqEDlMg2qhfzKDSNKUofc0z7FLMb0Cn46WqlciUCY ++VetHhBghGd+6fxOOz+x98FhiiAif+AdiUWBTKFFohWXo/9aiGgm0ueJj2NS3Eyac ++xOKoTcDd9TMsOJ2fMH2MlquArLobCvuphOrVbqBoeeol2SzFDDOW8ryPDzFGy5xh ++ZHkm/3sGIoDpDkDR0yhvBzn47qdLI5myc6Fj96s7S2xgqiqGXJW0D0FCfpUQXxfm ++ahz/Jdwl+hqs5Eg/aA+LE/7lmS7szo3zwJQ53ApdcaupHi4fU60wPVrdo29wLwDO ++hDuS+Oc1os1UyJt0T0a+zB4PIP2rxifyxI1iWmZFt7tJyLv1k7yMN7CLCWzsSy5P ++BZpGmHV9Wbvb660N6NzlFDMqnjJWDAr1BLoV4ywmpiWPhy/7JtKXFe1V3jT5MvGM ++26IOC+zCwwZVyEIIASeWepZDuto00Lqo7jOKSlLRmuhTX1ELK8xYX6ZU/fz0FwYn ++bLu6bI4mRGfbJ12fWYm5QMje2QAuvndfi759HUeuLl6TgmeQFgqFA/6Kkwoz0Ncb ++Kaaj+ByvLXfI4S3lvkwT26nOAt966fb1bsdkb8P52NdkqeSMk5cCAwEAAaNIMEYw ++CQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwLAYDVR0RBCUwI4IJbG9jYWxob3N0hwR/ ++AAABhxAAAAAAAAAAAAAAAAAAAAABMA0GCSqGSIb3DQEBCwUAA4ICAQCGQCs10hwY ++t5o3AWjU8oT8HWnLDsEzIvI/Z2dvtsFSOFotH14d8a7CdCKNiry8BbQ82A4sG/Xw ++0aVdP1EscxGhpJuMHG4Ph9PZBm31ZW2VoRHOEs7/Moi6G/1yldVxWUH/qXO00Dw9 ++cEsiUQdPrPQDoVBKYAMuV15RP9b3iPpw3GY1EkIu+akGVziHFmFYUoU2gctiGIZ6 ++6KiqBFvCP1Yvm3RSZ5t/Kv/jPMetAnCq+9JAUAodAh2+goBvUCAN9Itr/tEs98jq ++9d14J7gzIRDdNHKOLrRFmoMrTaDZNtqBe5jiMf0O55tgjv4BqN4w11M51bjY4umd ++GX+OXoBJG+MK7AZyaHPjHa1NMoLDOUhTvHb4zPNkPiVb8r3lYkQ4VCtre+4qqrEn ++cEt9KWGpHkoz4GSKn6uidQebdi4waexcGttsHbKPaKZqzYXAJ2bjFZnv85zPtpjO ++qxzqrMUruiCU7EfjGAdZ8S0lwjdMihznLATjKuwQkJ2mVg2HbLgxZu578FHTBOHW ++LjVIr/80auF4Ino9ocHpIwL/E4jpYQWP/Uv4KBHwkAktmUOwqyt0iysRaWy4Gp7S ++keBI9FoGtJ1Mq5M2tVINBzt1ESC3t03KqyY+/9r/IeY7A7yukC0YJnJ+HorfuQFf ++0//7DOEA58bRswyWTLOAjYMJHilTKOozSQ== + -----END CERTIFICATE----- +diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf +index a3c8ad9f6..632cff11c 100644 +--- a/tests/data/tls/conf/openssl.cnf ++++ b/tests/data/tls/conf/openssl.cnf +@@ -51,7 +51,7 @@ commonName = supplied + emailAddress = optional + + [ req ] +-default_bits = 2048 ++default_bits = @KEY_BITS@ + default_keyfile = privkey.pem + distinguished_name = req_distinguished_name + attributes = req_attributes +diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh +index 8c33a24fe..739f8eaf1 100755 +--- a/tests/data/tls/create-crt.sh ++++ b/tests/data/tls/create-crt.sh +@@ -5,6 +5,9 @@ if [ x"$openssl" = "x" ]; then + echo "OpenSSL command line binary not found, skipping..." + fi + ++KEY_BITS=4096 ++KEY_TYPE=rsa:$KEY_BITS ++ + USAGE="$0 [-s] [-u ]" + SERVER=0 + USER=0 +@@ -45,13 +48,13 @@ echo "00" > cruft/serial + touch cruft/index.txt + touch cruft/index.txt.attr + hn=$(hostname -f) +-sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf > ./openssl.cnf ++sed -e "s;@HOSTNAME@;$hn;" -e "s;@KEY_BITS@;$KEY_BITS;" conf/openssl.cnf > ./openssl.cnf + + if [ $SERVER = 1 ]; then + rm -rf private/localhost.key certs/localhost.crt + + $openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \ +- -newkey rsa:1024 -config ./openssl.cnf \ ++ -newkey $KEY_TYPE -config ./openssl.cnf \ + -subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \ + -batch > /dev/null 2>&1 + +@@ -66,7 +69,7 @@ if [ $USER = 1 ]; then + rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr + + $openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \ +- -newkey rsa:1024 -config ./openssl.cnf \ ++ -newkey $KEY_TYPE -config ./openssl.cnf \ + -subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \ + -batch >/dev/null 2>&1 + +diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key +index 5f4625fd7..e30e11586 100644 +--- a/tests/data/tls/private/bjensen@mailgw.example.com.key ++++ b/tests/data/tls/private/bjensen@mailgw.example.com.key +@@ -1,16 +1,52 @@ + -----BEGIN PRIVATE KEY----- +-MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2 +-xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4 +-9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z +-yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r +-oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e +-nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg +-xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra +-EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd +-9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/ +-pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI +-tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ +-3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D +-tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg +-36Ixj3L+5H18 ++MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQCcHBkHcUSKG4s7 ++nKmcqZT3EoZkEgxoaMlpxUZtxBtO5ZXEfcpMaxuA7qkZvMJR8ws2u8TQU/18FhH4 +++0aZBefM0ExwqvGNJ8F0cTl3439DGNE+/psh5NWgqPYe/K3bAtSRtF7wDxF77eb2 ++Yz0J3NIDxFrAbovfg0ydbt9pWJr5pDBvlqSdYu38kpIB5WENCEy77QK9GEGAlMVI ++RXneA5t2CKsljujRG1H5YJeS6qVAEdMllHZ6a0nNLxTdLe1qbZyRgEqRKgW5WcWr ++W46Co9CRDcFeMqoHdwAQsRdOGBivgkeYUST1yImsCbzlSRLC1dfj++2mzCMxoc3x ++pZNPyHyBuRgou8VqWpF2NuG+KS7QBtm1PVUhSAvRX9uQOnXnazQvlRfsaHQjGUKy ++hMUr5dcwpTqThW4BoqtStd6/097sZTZVWmsC+mzLtwWkESVDU0tNg/czWLn56smV ++7DfPjFDDAV6eNcScFfD8w04aPdk8ODalW/wnsTjILQuEBssrV1h8WblruWRU31Mn +++mw9SA3tDfTk9sJiEyiTJh3B1DrEb+pIuk4vz5uicNcYTXCfa5ZpPL608f7cWuG2 ++GP8f5ug4PMKyRkh6qCt7BWrVgOheo1ZhjvrbmhI4yPXHATrCtYO1wqIyu9Yuirdg ++7WJD6npu8IV38VEgEBD3UFanY9xN7wIDAQABAoICAQCWY/s40EXXRvG7XBGKe1Sn ++MZGGllyduVVQMFzJIkOsnkDKKuTY+dZlP4Zo5Q/PIvWKpRnWGRP6lsh5tJkukiHd ++jk4VvJk4AzS7mNhkRyYy3ZW3ulB5NpsXS67P610RwIhIVhuf6ORPH8GBW9lRxwoL ++1v4WpGjbywHkKQvR0Sp7lVGULuwnM0dSK2G9sdztUTGbWZlp0hRIawojtcrRt2ft ++Liyy4hooWMmAFS3wu1y3fHSNn5kEFpfis5jF+5jdDvvmsFElx/X7uiBUFMAV2vry ++wu2mceibiGjnq7Nn6I7fhgKzGnkgzzDSLA9uVBde2+RAHlO0fLTq+5YLVhe0pNBM ++J1Y0soNaO3XfVV6Vnyz8X+ruHItW2OBF9AYhIlXq/6d3MMX51BEM6odEtsi8zFgo ++ENN0GAXoyoofg+IvzPiVU2Ud7s4pAlK473d7sAQEeiFWaj7iwueAgofSUFRz7E/H ++umdhytKiJXqcjJ9O2k4sBsmQoPIB++LlUPRIlZY9UvTFxLbd/ifFUv5fqa6z0IX6 ++wkIzXmRHhG+ETk1IZBJAAho7iyyYOTP+JnnToUAMWoUaZUO2bzaZfQha8Z3KVtG/ ++PJUfHClBXqvFNaAUvA9Df3JoJddJ4pO1g0QjS/dp4C2KwNkH4oqMJctvCersoPWu ++5DYiWY6KR4GjokJ1lBeWAQKCAQEAzSKa+m2C4ANNCJB9tcKYDbYIdibCpzO+k1Fb ++gZUtNi9dEE0Po8rMG0jthm+GKJjNjiG5idSUMo+WNEGBPkELueex81AlEpOqQ6/9 ++67cyjAsF/FvgkWOpKJnGOySF/TpK4kPGYyS3ICvs1KNE5HEywHyC4C/MD8N9Z5tX ++/DfW6sBM/wPipE9YDpKfAg3fDG9YJN/gJZ8TlZVqzzw75rKGcMeLc8f0mbMo+KWQ ++VKV4vrgz1eiVrHc5VeGUaXe1Yei5El671wAdtFdmm51A2fWd80fPlQdqfAwpX7x4 ++FWuo9z2QX70rM/NTWfk4nQ6ZFEHxtm++OiTfh7RwauI8fxye6QKCAQEAwtF/tOth ++UgHrohB2DCE9gA0rxkynJHK9/SXSd0KBjERO2i41iuC9YlJT/NpNz9fM7l+L02aP ++wWLMqyC7moNmIpJMY2xBGU0EowQ/3xsSNo3u/fvOS4MyGLKENUPMFgO0J7yopiqt ++Ea31TcrFSTMSmFZCv8cGt38EwS6sdJZd/RB+h3yxesit8pouwpfbtLPx6LSGkPHY ++5nNVPgbt6xaxZJ/1kNbLFObSoZ3lzWBwp93dQh/WqeeeI51LGdM1G6fTL8HrmGFJ ++EX0AKpexFVnG/GROJc8taWtMbk9W5oK30JqR7hpSaluYbonpr9k4WQA+EAZjXfcJ ++0V0AMsMUhGtvFwKCAQAQZf7LnCuFKt5im+JgwFCVcALXJxwSb7GBZ1SQVFOL7Fdd ++MTvZ1SFh4P+T6qBn6GcuQIXrfcHnFNFmFgJ17o84akwwbiy4gnNu+8epqzhwN4Vf +++hxGoxfntftByRao+pr34YEfddTpznkdOnwMYvwypQF1WHzQmckRmjp7YB9fHsZI ++8I+SoQEiERiC+oblIJWERR1PBJt1Lr+eF2uWcpkKtPjx5X8pNkhFMD8MdTnkzSbf ++p7snUVSVB/ZsQ/SNAiShUk9jzY+SVhZOxFBl3BunUgtHF5OsnPBFxfQ3iia0tQgw ++jxfADGiSXbjn3T3hf7AJ7H7heQchewwtjy5U3v3ZAoIBAQCEAyRPe0SKJoT+X7su ++QwQClmo4SE7mUt5NAOkaKTXRz6PDEpbzkZCjZHhHGcKqeWgDizkbuh7lg0Z/G4Ik ++lK+L86jRolSGiXr/3+xMCXMRBqKQ9qV24+L5e1Y9JcDQlhfo6V06pCZ8mW1lFmcT ++UAlksucuPvZdNzQIl9ECe7YauqeStbsqIXxFrZbMA808KMde0Z1x8H/ywOpdSqLD ++r6/rKL1lNTeN5U+Ldox228fa6Gt62EpE/Y9aQMbYLBeLsvBXJ0e3DQ1PTW3kbr/v ++YNOGyY1u73GtQqkbAqY3MxLNxz/loW6BZanoFYoFv+L/5Dsp7ro8vR6pASUWQLzR ++cl9nAoIBAQCre87G76UXv6FIggT+cKM9MKS69KIE3mzNTYUo90L74vF65hJqlaIa ++mfEcPpEU+UY+ufZSIHtTDBj/9Rswaf5whJY7RfL42pSGnW2YOMpuwDIKAEvcJedu ++kZhbthBin4pa28X6L5sNxug+7Wykgesd48PmMLG4pTF+D9u7SgO37Ew5UzylPWNi ++Lrv9TlX1vv9rNFh/hOCA93DNrJlNNPltIcMDByVVjrq31QmxMJwE7cdvl1V7eoiO ++NQuGuGyFIEKPtl9dEUaA4SGYZ7fUqPZaZuzzM0Xa5UMpdcIzcuYYNn3G6FvV6vwU ++dH+lv5X1bTB18GK88ANpC2qLCKRJPCTx + -----END PRIVATE KEY----- +diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key +index 8a24f69f8..99cb512c4 100644 +--- a/tests/data/tls/private/localhost.key ++++ b/tests/data/tls/private/localhost.key +@@ -1,16 +1,52 @@ + -----BEGIN PRIVATE KEY----- +-MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg +-ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM +-w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM +-brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij +-Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf +-2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ +-bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q +-1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf +-3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U +-VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7 +-TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b +-iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP +-5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3 +-b61hkjQZfbEg5cg= ++MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDpR3z26BqHahZj ++TSrWD4zo2SmW57DC8ari2Qxq7WCr5DkGK/rVu5uB1IBn5mSTF7dLHRm/uLnCV0g3 ++jBeoQOUyDaqF/MoNI0pSh9zTPsUsxvQKfjpaqVyJQJhV60eEGCEZ37p/E47P7H3w ++WGKICJ/4B2JRYFMoUWiFZej/1qIaCbS54mPY1LcTJpzE4qhNwN31Myw4nZ8wfYyW ++q4CsuhsK+6mE6tVuoGh56iXZLMUMM5byvI8PMUbLnGFkeSb/ewYigOkOQNHTKG8H ++Ofjup0sjmbJzoWP3qztLbGCqKoZclbQPQUJ+lRBfF+ZqHP8l3CX6GqzkSD9oD4sT ++/uWZLuzOjfPAlDncCl1xq6keLh9TrTA9Wt2jb3AvAM6EO5L45zWizVTIm3RPRr7M ++Hg8g/avGJ/LEjWJaZkW3u0nIu/WTvIw3sIsJbOxLLk8FmkaYdX1Zu9vrrQ3o3OUU ++MyqeMlYMCvUEuhXjLCamJY+HL/sm0pcV7VXeNPky8Yzbog4L7MLDBlXIQggBJ5Z6 ++lkO62jTQuqjuM4pKUtGa6FNfUQsrzFhfplT9/PQXBidsu7psjiZEZ9snXZ9ZiblA ++yN7ZAC6+d1+Lvn0dR64uXpOCZ5AWCoUD/oqTCjPQ1xsppqP4HK8td8jhLeW+TBPb ++qc4C33rp9vVux2Rvw/nY12Sp5IyTlwIDAQABAoICADh1+wLvjmwz+xMxvCpvPRWm ++afCCR0AHqeqZye2fYoR4Cm05+837SFoWCrYbB0CqvsxJUNAcb6lf4rS/DYLFojOJ ++JzqiwmyHnBd5lrLyQFrkFHDtuEX1M9ZscfJprbeE944BnmvfWfNtM9YWLlLqc31e ++nCdB/x6FBZ0z2z8Avd87dih/aNc0NNNHxy3IBiA7i/0q04soaz0bRgm5nL0xlhYE ++bzUieWH7JQ5M47g6o76eReyeQqnUrWPeh5v/zraLGiMDvGScv6wx3x2KpHtutjr5 ++mj1uVHm/UeyhYIwPGtIR0bDXhLaKcZnyeOw59G8/Z1mvVyUxb1dKW8kNKpj2yI2H ++Y1SjhW5qaOeaDPxAPqVyo6SUQIzOn6SD0l7aGyOyvYULjiw342HQYU4rQeSPOtjt +++NYMirnT7WNnmoSIsXx7nwUe38EWx5gCHy8taF4aZr5K85yZKnmsiX3vX/hH30yc ++GLOnDDa3b0FE2J2eYos14ru8RTqSLSxclr5Ru2yTdwLgE0gg+iygO1/tYYkqxZ09 ++j+METJpg4wv+cQUG/BxysISqNjaPSPHdyJeTMzC8B+PUUpbRoBuvLLokkZ9P95nG ++72TFklEOB0m0VMxrEfev0HGSzkQm92s2Bf41TRaHTPSkg+G1s0haZTNqRVTGPrr/ ++eyiz0qH2bgDeubJ3VuTBAoIBAQD9N+KeKo+hRWeV/I6BCBOfMeQOqlqIxYfYAxU+ ++CuutILbTnGKFMTAx43syh/a5EV7q4yM81RCXKK/Lmja2OIeYJUb88bC/h0x/gq5W ++LLxHbKgFDUDF2VcWShMqDOo8J8FbzWwb9bOOShqASoR6FacJuOqlFvS8gaswZtiW ++fOvlWRKO2ybULgQctX5gOf1ctuab1VrzuHnNB30gVFc95Dg1b6RiyVAa8AFm6gs9 ++6Rewk527+4T5Ho5UXvdsTVJsAhzJgVjPSyF2Vc1CRrp8lIffsg5Prb4w8kvB0i64 ++09zn+jAfVRpjdGWqMI7BR1pCdheGMqv006ZVYY+QhcBIb0BHAoIBAQDr14d5PPDv ++pCjlJnCKNzX2irU6bdIY+zvXoemj/cYvHqQbPOe/kaCWFNPMxANKMmZSTdSM7qqR ++s0P1RW/R7moWNSesYwW+2Jp2hIhiWmy+E+ksXeTlFwVpuMHSDPS/N61N8XgmT3pI ++Qngl1hgxGbttniKEwI+Nc7Z3FYDDCp206nmC5y33D+ZYHv1L3e33pyqHdHD/uIeU ++57OPr7Mmd/J6pmClh1dqyZwVBClc2V6w0y2G8Lk1v79wOMrn+4/p9KH2BgkFe2gr ++uB8TOLlUhttQ8VfzXCd+Zi9s3oW0h7Vkvt4kDlJm0MrnMmK0aqgKB+7XkKE0ccVQ ++xSodzbBdDYoxAoIBAH2qGmD8JkOWug2JRP9sDrDWhaNxj3SI8x2Uiho8OTG2JoVl +++s621oArsJwnNZ4qrLxM9NPfuVgK7RNR+Qz9iO1MsqodF+Y1MxWkuPgzQ0z+83Nu ++XFLTxZBeOpyHxEcOQ7tXeut1SCK5S+WXFZ+w1zDQAELl3ZcfkuF2aM5mOHuddMRI ++pkBuhcPpnkoK/V3htxhnDbgeOPQzXzmIIbOpauu5+A6+cW6s5UU5qVKUNxl+aK09 ++6YPoUiI07v1kch7//WFTO8vEMVsUwcS+bRYecD/nkYqhYt3PoSETOfSnz92gH/ms ++tmfdAAcyCeaJjpWlHY+P3h6mWsnMnP7QIdjQvUkCggEAGFkiBWRDQ5phFndHex2E ++FrXvS972p9mYLgTrSCD1CvxQ2PcKvf5c4+G2lBdQd6KIacrbPMmPFoe5ZmMKzlOc ++5DoMpIF8oF1gZQf9xJmtTFpl4ky3Sud7iZSnffYUdoFbBQb+7oWaDEfAe7eEu9z6 ++OrDuw2HV8DaYCedQadJ4warLbLZNSop7r3FTmTeKT90USPO+jsgQR1E8eoMbLceI ++Yx02MSCt57p0wL6zPoC6g+rpclr75A6txvo2CIkyLGczKWEqIUTCVnEl1CgxCgb6 ++MXsZJ2jGMwh9sPGwQBkaoxIJgRNxcmfv6rqK8jFos9Bp2ht2aSGty07vsDACGzlA ++oQKCAQEA8PzgkyGYHs2DwNhmv3j5ZFaP0RukwbdChSoxmbC9JP2JJxxYcnww5jYH ++xeM1bahqkdKyG5iDRiYB74EolZUMA3Zny13R4HWxNe4aUZW1H8mdmhllXX90aUOU ++WEvF2yYZbg9CQIq7zQh8HsF/S8sDTsXoZOx30zrPgb44spWKRmxdwUJt944weXvc ++p5XkLvVzBVJ+RD5IgPTBFl1iCkw3eq01CFcbTdfe9cS8V9IgDy0Jq2GvRE3Y2JS6 ++xqtBB1MgZvrUoAZ8jPacRRXddg87Hwgs9+R1jaE+ZYixojOFg+JnQOGkUd9FhJAW ++bcnWV4XIPIMbouL4132Ove+GukJlPA== + -----END PRIVATE KEY----- +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch b/SOURCES/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch new file mode 100644 index 0000000..125ae6b --- /dev/null +++ b/SOURCES/openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch @@ -0,0 +1,487 @@ +From 8e3e85e329f5cbd989936b0df8a0ac06906a4824 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 14 Apr 2020 16:19:05 +0300 +Subject: [PATCH] auth: add SASL/GSSAPI tests + +--- + tests/data/krb5.conf | 32 ++++++ + tests/data/slapd-sasl-gssapi.conf | 65 ++++++++++++ + tests/scripts/conf.sh | 3 + + tests/scripts/defines.sh | 5 + + tests/scripts/setup_kdc.sh | 144 +++++++++++++++++++++++++++ + tests/scripts/test077-sasl-gssapi | 159 ++++++++++++++++++++++++++++++ + 6 files changed, 408 insertions(+) + create mode 100644 tests/data/krb5.conf + create mode 100644 tests/data/slapd-sasl-gssapi.conf + create mode 100755 tests/scripts/setup_kdc.sh + create mode 100755 tests/scripts/test077-sasl-gssapi + +diff --git a/tests/data/krb5.conf b/tests/data/krb5.conf +new file mode 100644 +index 000000000..739113742 +--- /dev/null ++++ b/tests/data/krb5.conf +@@ -0,0 +1,32 @@ ++[libdefaults] ++ default_realm = @KRB5REALM@ ++ dns_lookup_realm = false ++ dns_lookup_kdc = false ++ default_ccache_name = FILE://@TESTDIR@/ccache ++ #udp_preference_limit = 1 ++[realms] ++ @KRB5REALM@ = { ++ kdc = @KDCHOST@:@KDCPORT@ ++ acl_file = @TESTDIR@/kadm.acl ++ database_name = @TESTDIR@/kdc.db ++ key_stash_file = @TESTDIR@/kdc.stash ++ } ++[kdcdefaults] ++ kdc_ports = @KDCPORT@ ++ kdc_tcp_ports = @KDCPORT@ ++[logging] ++ kdc = FILE:@TESTDIR@/kdc.log ++ admin_server = FILE:@TESTDIR@/kadm.log ++ default = FILE:@TESTDIR@/krb5.log ++ ++#Heimdal ++[kdc] ++ database = { ++ dbname = @TESTDIR@/kdc.db ++ realm = @KRB5REALM@ ++ mkey_file = @TESTDIR@/kdc.stash ++ log_file = @TESTDIR@/kdc.log ++ acl_file = @TESTDIR@/kadm.acl ++ } ++[hdb] ++ db-dir = @TESTDIR@ +diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf +new file mode 100644 +index 000000000..611fc7097 +--- /dev/null ++++ b/tests/data/slapd-sasl-gssapi.conf +@@ -0,0 +1,65 @@ ++# stand-alone slapd config -- for testing (with indexing) ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2020 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++# ++include @SCHEMADIR@/core.schema ++include @SCHEMADIR@/cosine.schema ++# ++include @SCHEMADIR@/corba.schema ++include @SCHEMADIR@/java.schema ++include @SCHEMADIR@/inetorgperson.schema ++include @SCHEMADIR@/misc.schema ++include @SCHEMADIR@/nis.schema ++include @SCHEMADIR@/openldap.schema ++# ++include @SCHEMADIR@/duaconf.schema ++include @SCHEMADIR@/dyngroup.schema ++ ++# ++pidfile @TESTDIR@/slapd.1.pid ++argsfile @TESTDIR@/slapd.1.args ++ ++# SSL configuration ++TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt ++TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key ++TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt ++ ++# ++rootdse @DATADIR@/rootdse.ldif ++ ++#mod#modulepath ../servers/slapd/back-@BACKEND@/ ++#mod#moduleload back_@BACKEND@.la ++#monitormod#modulepath ../servers/slapd/back-monitor/ ++#monitormod#moduleload back_monitor.la ++ ++ ++####################################################################### ++# database definitions ++####################################################################### ++ ++database @BACKEND@ ++suffix "dc=example,dc=com" ++rootdn "cn=Manager,dc=example,dc=com" ++rootpw secret ++#~null~#directory @TESTDIR@/db.1.a ++#indexdb#index objectClass eq ++#indexdb#index mail eq ++#ndb#dbname db_1_a ++#ndb#include @DATADIR@/ndb.conf ++ ++#monitor#database monitor ++ ++sasl-realm @KRB5REALM@ ++sasl-host localhost +diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh +index 2a859d89d..5b477ed93 100755 +--- a/tests/scripts/conf.sh ++++ b/tests/scripts/conf.sh +@@ -97,4 +97,7 @@ sed -e "s/@BACKEND@/${BACKEND}/" \ + -e "s;@TESTWD@;${TESTWD};" \ + -e "s;@DATADIR@;${DATADIR};" \ + -e "s;@SCHEMADIR@;${SCHEMADIR};" \ ++ -e "s;@KRB5REALM@;${KRB5REALM};" \ ++ -e "s;@KDCHOST@;${KDCHOST};" \ ++ -e "s;@KDCPORT@;${KDCPORT};" \ + -e "/^#/d" +diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh +index 26dab1bae..78dc1f8ae 100755 +--- a/tests/scripts/defines.sh ++++ b/tests/scripts/defines.sh +@@ -108,6 +108,7 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf + SCHEMACONF=$DATADIR/slapd-schema.conf + TLSCONF=$DATADIR/slapd-tls.conf + TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf ++SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf + GLUECONF=$DATADIR/slapd-glue.conf + REFINTCONF=$DATADIR/slapd-refint.conf + RETCODECONF=$DATADIR/slapd-retcode.conf +@@ -214,6 +215,7 @@ PORT3=`expr $BASEPORT + 3` + PORT4=`expr $BASEPORT + 4` + PORT5=`expr $BASEPORT + 5` + PORT6=`expr $BASEPORT + 6` ++KDCPORT=`expr $BASEPORT + 7` + URI1="ldap://${LOCALHOST}:$PORT1/" + URIP1="ldap://${LOCALIP}:$PORT1/" + URI2="ldap://${LOCALHOST}:$PORT2/" +@@ -239,6 +241,9 @@ SURIP5="ldaps://${LOCALIP}:$PORT5/" + SURI6="ldaps://${LOCALHOST}:$PORT6/" + SURIP6="ldaps://${LOCALIP}:$PORT6/" + ++KRB5REALM="K5.REALM" ++KDCHOST=$LOCALHOST ++ + # LDIF + LDIF=$DATADIR/test.ldif + LDIFADD1=$DATADIR/do_add.1 +diff --git a/tests/scripts/setup_kdc.sh b/tests/scripts/setup_kdc.sh +new file mode 100755 +index 000000000..1cb784075 +--- /dev/null ++++ b/tests/scripts/setup_kdc.sh +@@ -0,0 +1,144 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2020 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++export KRB5_TRACE=$TESTDIR/k5_trace ++export KRB5_CONFIG=$TESTDIR/krb5.conf ++export KRB5_KDC_PROFILE=$KRB5_CONFIG ++export KRB5_KTNAME=$TESTDIR/server.kt ++export KRB5_CLIENT_KTNAME=$TESTDIR/client.kt ++export KRB5CCNAME=$TESTDIR/client.ccache ++ ++KDCLOG=$TESTDIR/setup_kdc.log ++KSERVICE=ldap/$LOCALHOST ++KUSER=kuser ++ ++. $CONFFILTER < $DATADIR/krb5.conf > $KRB5_CONFIG ++ ++PATH=${PATH}:/usr/lib/heimdal-servers:/usr/sbin:/usr/local/sbin ++ ++echo "Trying Heimdal KDC..." ++ ++kdc --version 2>&1 | grep Heimdal > $KDCLOG 2>&1 ++RC=$? ++if test $RC = 0 ; then ++ ++ kstash --random-key > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kstash failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ flags="--realm-max-ticket-life=1h --realm-max-renewable-life=1h" ++ kadmin -l init $flags $KRB5REALM > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin init failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l add --random-key --use-defaults $KSERVICE > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin add failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l ext -k $KRB5_KTNAME $KSERVICE > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin ext failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l add --random-key --use-defaults $KUSER > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin add failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin -l ext -k $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "Heimdal: kadmin ext failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kdc --addresses=$LOCALIP --ports="$KDCPORT/udp" > $KDCLOG 2>&1 & ++else ++ echo "Trying MIT KDC..." ++ ++ kdb5_util create -r $KRB5REALM -s -P password > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kdb5_util create failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "addprinc -randkey $KSERVICE" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: admin addprinc failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "ktadd -k $KRB5_KTNAME $KSERVICE" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kadmin ktadd failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "addprinc -randkey $KUSER" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kadmin addprinc failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ kadmin.local -q "ktadd -k $KRB5_CLIENT_KTNAME $KUSER" > $KDCLOG 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "MIT: kadmin ktadd failed, skipping GSSAPI tests" ++ exit 0 ++ fi ++ ++ krb5kdc -n > $KDCLOG 2>&1 & ++fi ++ ++KDCPROC=$! ++sleep 1 ++ ++kinit -kt $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ kill $KDCPROC ++ echo "SASL/GSSAPI: kinit failed, skipping GSSAPI tests" ++ exit 0 ++fi ++ ++pluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null ++RC=$? ++if test $RC != 0 ; then ++ ++ saslpluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null ++ RC=$? ++ if test $RC != 0 ; then ++ kill $KDCPROC ++ echo "cyrus-sasl has no GSSAPI support, test skipped" ++ exit 0 ++ fi ++fi +diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi +new file mode 100755 +index 000000000..64abe16fe +--- /dev/null ++++ b/tests/scripts/test077-sasl-gssapi +@@ -0,0 +1,159 @@ ++#! /bin/sh ++# $OpenLDAP$ ++## This work is part of OpenLDAP Software . ++## ++## Copyright 1998-2020 The OpenLDAP Foundation. ++## All rights reserved. ++## ++## Redistribution and use in source and binary forms, with or without ++## modification, are permitted only as authorized by the OpenLDAP ++## Public License. ++## ++## A copy of this license is available in the file LICENSE in the ++## top-level directory of the distribution or, alternatively, at ++## . ++ ++echo "running defines.sh" ++. $SRCDIR/scripts/defines.sh ++ ++if test $WITH_SASL = no ; then ++ echo "SASL support not available, test skipped" ++ exit 0 ++fi ++ ++mkdir -p $TESTDIR $DBDIR1 ++cp -r $DATADIR/tls $TESTDIR ++ ++cd $TESTWD ++ ++ ++echo "Starting KDC for SASL/GSSAPI tests..." ++. $SRCDIR/scripts/setup_kdc.sh ++ ++echo "Running slapadd to build slapd database..." ++. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1 ++$SLAPADD -f $CONF1 -l $LDIFORDERED ++RC=$? ++if test $RC != 0 ; then ++ echo "slapadd failed ($RC)!" ++ kill $KDCPROC ++ exit $RC ++fi ++ ++echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..." ++$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 & ++PID=$! ++if test $WAIT != 0 ; then ++ echo PID $PID ++ read foo ++fi ++KILLPIDS="$PID" ++ ++sleep 1 ++ ++for i in 0 1 2 3 4 5; do ++ $LDAPSEARCH -s base -b "" -H $URI1 \ ++ 'objectclass=*' > /dev/null 2>&1 ++ RC=$? ++ if test $RC = 0 ; then ++ break ++ fi ++ echo "Waiting 5 seconds for slapd to start..." ++ sleep 5 ++done ++ ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++$LDAPSEARCH -x -H $URI1 -s "base" -b "" supportedSASLMechanisms > $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapsearch failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++grep GSSAPI $TESTOUT ++RC=$? ++if test $RC != 0 ; then ++ echo "failed: GSSAPI mechanism not in supportedSASLMechanisms." ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++fi ++ ++echo -n "Using ldapwhoami with SASL/GSSAPI: " ++$LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 > $TESTOUT 2>&1 ++RC=$? ++if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++else ++ echo "success" ++fi ++ ++echo -n "Validating mapped SASL/GSSAPI ID: " ++echo "dn:uid=$KUSER,cn=$KRB5REALM,cn=gssapi,cn=auth" > $TESTDIR/dn.out ++$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT ++RC=$? ++if test $RC != 0 ; then ++ echo "Comparison failed" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++else ++ echo "success" ++fi ++ ++if test $WITH_TLS = no ; then ++ echo "SASL/GSSAPI: TLS support not available, skipping TLS part." ++else ++ echo -n "Using ldapwhoami with SASL/GSSAPI with start-tls: " ++ $LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow \ ++ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ > $TESTOUT 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ else ++ echo "success" ++ fi ++ ++ echo -n "Using ldapwhoami with SASL/GSSAPI with ldaps: " ++ $LDAPSASLWHOAMI -N -Y GSSAPI -H $SURI2 -o tls_reqcert=allow \ ++ -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt \ ++ > $TESTOUT 2>&1 ++ RC=$? ++ if test $RC != 0 ; then ++ echo "ldapwhoami failed ($RC)!" ++ kill $KDCPROC ++ test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ exit $RC ++ else ++ echo "success" ++ fi ++fi ++ ++kill $KDCPROC ++test $KILLSERVERS != no && kill -HUP $KILLPIDS ++ ++if test $RC != 0 ; then ++ echo ">>>>> Test failed" ++else ++ echo ">>>>> Test succeeded" ++ RC=0 ++fi ++ ++test $KILLSERVERS != no && wait ++ ++exit $RC +-- +2.29.2 + diff --git a/SOURCES/openldap-cbinding-fix-multiprovider-tests.patch b/SOURCES/openldap-cbinding-fix-multiprovider-tests.patch new file mode 100644 index 0000000..532bec1 --- /dev/null +++ b/SOURCES/openldap-cbinding-fix-multiprovider-tests.patch @@ -0,0 +1,137 @@ +From a6d34ed8672a02b49bb286cbeb2d75a08bc0c085 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Thu, 1 Jul 2021 12:53:24 +0200 +Subject: [PATCH] Fix Channel Binding tests + +--- + ...s => test069-delta-multiprovider-starttls} | 24 +++++++++---------- + ...daps => test070-delta-multiprovider-ldaps} | 24 +++++++++---------- + 2 files changed, 24 insertions(+), 24 deletions(-) + rename tests/scripts/{test069-delta-multimaster-starttls => test069-delta-multiprovider-starttls} (96%) + rename tests/scripts/{test070-delta-multimaster-ldaps => test070-delta-multiprovider-ldaps} (96%) + +diff --git a/tests/scripts/test069-delta-multimaster-starttls b/tests/scripts/test069-delta-multiprovider-starttls +similarity index 96% +rename from tests/scripts/test069-delta-multimaster-starttls +rename to tests/scripts/test069-delta-multiprovider-starttls +index 2dfbb30a1..01fed1e2c 100755 +--- a/tests/scripts/test069-delta-multimaster-starttls ++++ b/tests/scripts/test069-delta-multiprovider-starttls +@@ -2,7 +2,7 @@ + # $OpenLDAP$ + ## This work is part of OpenLDAP Software . + ## +-## Copyright 1998-2017 The OpenLDAP Foundation. ++## Copyright 1998-2021 The OpenLDAP Foundation. + ## All rights reserved. + ## + ## Redistribution and use in source and binary forms, with or without +@@ -277,7 +277,7 @@ done + n=2 + while [ $n -le $MMR ]; do + echo "Comparing retrieved entries from server 1 and server $n..." +-$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++$CMP $PROVIDERFLT $TESTDIR/server$n.flt > $CMPOUT + + if test $? != 0 ; then + echo "test failed - server 1 and server $n databases differ" +@@ -301,7 +301,7 @@ THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" + sleep 1 + for i in 1 2 3; do + $LDAPSEARCH -S "" -b "$THEDN" -H $URI1 \ +- -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 ++ -s base '(objectClass=*)' entryCSN > "${PROVIDEROUT}.$i" 2>&1 + RC=$? + + if test $RC = 0 ; then +@@ -309,7 +309,7 @@ for i in 1 2 3; do + fi + + if test $RC != 32 ; then +- echo "ldapsearch failed at slave ($RC)!" ++ echo "ldapsearch failed at replica ($RC)!" + test $KILLSERVERS != no && kill -HUP $KILLPIDS + exit $RC + fi +@@ -340,7 +340,7 @@ done + n=2 + while [ $n -le $MMR ]; do + echo "Comparing retrieved entries from server 1 and server $n..." +-$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++$CMP $PROVIDERFLT $TESTDIR/server$n.flt > $CMPOUT + + if test $? != 0 ; then + echo "test failed - server 1 and server $n databases differ" +@@ -555,7 +555,7 @@ done + n=2 + while [ $n -le $MMR ]; do + echo "Comparing retrieved entries from server 1 and server $n..." +-$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++$CMP $PROVIDERFLT $TESTDIR/server$n.flt > $CMPOUT + + if test $? != 0 ; then + echo "test failed - server 1 and server $n databases differ" +diff --git a/tests/scripts/test070-delta-multimaster-ldaps b/tests/scripts/test070-delta-multiprovider-ldaps +similarity index 96% +rename from tests/scripts/test070-delta-multimaster-ldaps +rename to tests/scripts/test070-delta-multiprovider-ldaps +index 1024640ef..37de9ddd0 100755 +--- a/tests/scripts/test070-delta-multimaster-ldaps ++++ b/tests/scripts/test070-delta-multiprovider-ldaps +@@ -2,7 +2,7 @@ + # $OpenLDAP$ + ## This work is part of OpenLDAP Software . + ## +-## Copyright 1998-2017 The OpenLDAP Foundation. ++## Copyright 1998-2021 The OpenLDAP Foundation. + ## All rights reserved. + ## + ## Redistribution and use in source and binary forms, with or without +@@ -276,7 +276,7 @@ done + n=2 + while [ $n -le $MMR ]; do + echo "Comparing retrieved entries from server 1 and server $n..." +-$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++$CMP $PROVIDERFLT $TESTDIR/server$n.flt > $CMPOUT + + if test $? != 0 ; then + echo "test failed - server 1 and server $n databases differ" +@@ -300,7 +300,7 @@ THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com" + sleep 1 + for i in 1 2 3; do + $LDAPSEARCH -S "" -b "$THEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $SURIP1 \ +- -s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1 ++ -s base '(objectClass=*)' entryCSN > "${PROVIDEROUT}.$i" 2>&1 + RC=$? + + if test $RC = 0 ; then +@@ -308,7 +308,7 @@ for i in 1 2 3; do + fi + + if test $RC != 32 ; then +- echo "ldapsearch failed at slave ($RC)!" ++ echo "ldapsearch failed at replica ($RC)!" + test $KILLSERVERS != no && kill -HUP $KILLPIDS + exit $RC + fi +@@ -339,7 +339,7 @@ done + n=2 + while [ $n -le $MMR ]; do + echo "Comparing retrieved entries from server 1 and server $n..." +-$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++$CMP $PROVIDERFLT $TESTDIR/server$n.flt > $CMPOUT + + if test $? != 0 ; then + echo "test failed - server 1 and server $n databases differ" +@@ -552,7 +552,7 @@ done + n=2 + while [ $n -le $MMR ]; do + echo "Comparing retrieved entries from server 1 and server $n..." +-$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT ++$CMP $PROVIDERFLT $TESTDIR/server$n.flt > $CMPOUT + + if test $? != 0 ; then + echo "test failed - server 1 and server $n databases differ" +-- +2.31.1 + diff --git a/SOURCES/openldap-manpages.patch b/SOURCES/openldap-manpages.patch new file mode 100644 index 0000000..b69a391 --- /dev/null +++ b/SOURCES/openldap-manpages.patch @@ -0,0 +1,73 @@ +Various manual pages changes: +* removes LIBEXECDIR from slapd.8 +* removes references to non-existing manpages (bz 624616) + +diff --git a/doc/man/man1/ldapmodify.1 b/doc/man/man1/ldapmodify.1 +index 3def6da..466c772 100644 +--- a/doc/man/man1/ldapmodify.1 ++++ b/doc/man/man1/ldapmodify.1 +@@ -397,8 +397,7 @@ exit status and a diagnostic message being written to standard error. + .BR ldap_add_ext (3), + .BR ldap_delete_ext (3), + .BR ldap_modify_ext (3), +-.BR ldap_modrdn_ext (3), +-.BR ldif (5). ++.BR ldif (5) + .SH AUTHOR + The OpenLDAP Project + .SH ACKNOWLEDGEMENTS +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +index cfde143..63592cb 100644 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -317,6 +317,7 @@ certificates in separate individual files. The + .B TLS_CACERT + is always used before + .B TLS_CACERTDIR. ++The specified directory must be managed with the OpenSSL c_rehash utility. + This parameter is ignored with GnuTLS. + + When using Mozilla NSS, may contain a Mozilla NSS cert/key +diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8 +index b739f4d..e2a1a00 100644 +--- a/doc/man/man8/slapd.8 ++++ b/doc/man/man8/slapd.8 +@@ -5,7 +5,7 @@ + .SH NAME + slapd \- Stand-alone LDAP Daemon + .SH SYNOPSIS +-.B LIBEXECDIR/slapd ++.B slapd + [\c + .BR \-4 | \-6 ] + [\c +@@ -317,7 +317,7 @@ the LDAP databases defined in the default config file, just type: + .LP + .nf + .ft tt +- LIBEXECDIR/slapd ++ slapd + .ft + .fi + .LP +@@ -328,7 +328,7 @@ on voluminous debugging which will be printed on standard error, type: + .LP + .nf + .ft tt +- LIBEXECDIR/slapd \-f /var/tmp/slapd.conf \-d 255 ++ slapd -f /var/tmp/slapd.conf -d 255 + .ft + .fi + .LP +@@ -336,7 +336,7 @@ To test whether the configuration file is correct or not, type: + .LP + .nf + .ft tt +- LIBEXECDIR/slapd \-Tt ++ slapd -Tt + .ft + .fi + .LP +-- +1.8.1.4 + diff --git a/SOURCES/openldap-openssl-manpage-defaultCA.patch b/SOURCES/openldap-openssl-manpage-defaultCA.patch new file mode 100644 index 0000000..7ec2caa --- /dev/null +++ b/SOURCES/openldap-openssl-manpage-defaultCA.patch @@ -0,0 +1,48 @@ +Reference default system-wide CA certificates in manpages + +OpenSSL, unless explicitly configured, uses system-wide default set of CA +certificates. + +Author: Matus Honek + +diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 +--- a/doc/man/man5/ldap.conf.5 ++++ b/doc/man/man5/ldap.conf.5 +@@ -307,6 +307,9 @@ are more options you can specify. These options are used when an + .B ldaps:// URI + is selected (by default or otherwise) or when the application + negotiates TLS by issuing the LDAP StartTLS operation. ++.LP ++When using OpenSSL, if neither \fBTLS_CACERT\fP nor \fBTLS_CACERTDIR\fP ++is set, the system-wide default set of CA certificates is used. + .TP + .B TLS_CACERT + Specifies the file that contains certificates for all of the Certificate +diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 +--- a/doc/man/man5/slapd-config.5 ++++ b/doc/man/man5/slapd-config.5 +@@ -801,6 +801,10 @@ If + .B slapd + is built with support for Transport Layer Security, there are more options + you can specify. ++.LP ++When using OpenSSL, if neither \fBolcTLSCACertificateFile\fP nor ++\fBolcTLSCACertificatePath\fP is set, the system-wide default set of CA ++certificates is used. + .TP + .B olcTLSCipherSuite: + Permits configuring what ciphers will be accepted and the preference order. +diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 +--- a/doc/man/man5/slapd.conf.5 ++++ b/doc/man/man5/slapd.conf.5 +@@ -1032,6 +1032,10 @@ If + .B slapd + is built with support for Transport Layer Security, there are more options + you can specify. ++.LP ++When using OpenSSL, if neither \fBTLSCACertificateFile\fP nor ++\fBTLSCACertificatePath\fP is set, the system-wide default set of CA ++certificates is used. + .TP + .B TLSCipherSuite + Permits configuring what ciphers will be accepted and the preference order. diff --git a/SOURCES/openldap-reentrant-gethostby.patch b/SOURCES/openldap-reentrant-gethostby.patch new file mode 100644 index 0000000..140b6e3 --- /dev/null +++ b/SOURCES/openldap-reentrant-gethostby.patch @@ -0,0 +1,33 @@ +The non-reentrant gethostbyXXXX() functions deadlock if called recursively, for +example if libldap needs to be initialized from within gethostbyXXXX() (which +actually happens if nss_ldap is used for hostname resolution and earlier +modules can't resolve the local host name), so use the reentrant versions of +the functions, even if we're not being compiled for use in libldap_r + +Resolves: #179730 +Author: Jeffery Layton + +diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c +index 373c81c..a012062 100644 +--- a/libraries/libldap/util-int.c ++++ b/libraries/libldap/util-int.c +@@ -52,8 +52,8 @@ extern int h_errno; + #ifndef LDAP_R_COMPILE + # undef HAVE_REENTRANT_FUNCTIONS + # undef HAVE_CTIME_R +-# undef HAVE_GETHOSTBYNAME_R +-# undef HAVE_GETHOSTBYADDR_R ++/* # undef HAVE_GETHOSTBYNAME_R */ ++/* # undef HAVE_GETHOSTBYADDR_R */ + + #else + # include +@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod) + #define BUFSTART (1024-32) + #define BUFMAX (32*1024-32) + +-#if defined(LDAP_R_COMPILE) ++#if defined(LDAP_R_COMPILE) || defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R) + static char *safe_realloc( char **buf, int len ); + + #if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R)) diff --git a/SOURCES/openldap-smbk5pwd-overlay.patch b/SOURCES/openldap-smbk5pwd-overlay.patch new file mode 100644 index 0000000..38936cf --- /dev/null +++ b/SOURCES/openldap-smbk5pwd-overlay.patch @@ -0,0 +1,62 @@ +Compile smbk5pwd together with other overlays. + +Author: Jan Šafránek +Resolves: #550895 + +Update to link against OpenSSL + +Author: Jan Vcelak +Resolves: #841560 + +diff --git a/contrib/slapd-modules/smbk5pwd/README b/contrib/slapd-modules/smbk5pwd/README +index f20ad94..b6433ff 100644 +--- a/contrib/slapd-modules/smbk5pwd/README ++++ b/contrib/slapd-modules/smbk5pwd/README +@@ -1,3 +1,8 @@ ++****************************************************************************** ++Red Hat note: We do not provide Heimdal Kerberos but MIT. Therefore the module ++is compiled only with Samba features in Fedora and Red Hat Enterprise Linux. ++****************************************************************************** ++ + This directory contains a slapd overlay, smbk5pwd, that extends the + PasswordModify Extended Operation to update Kerberos keys and Samba + password hashes for an LDAP user. +diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in +index 3af20e8..ef73663 100644 +--- a/servers/slapd/overlays/Makefile.in ++++ b/servers/slapd/overlays/Makefile.in +@@ -33,7 +33,8 @@ SRCS = overlays.c \ + syncprov.c \ + translucent.c \ + unique.c \ +- valsort.c ++ valsort.c \ ++ smbk5pwd.c + OBJS = statover.o \ + @SLAPD_STATIC_OVERLAYS@ \ + overlays.o +@@ -53,7 +54,7 @@ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) + UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) + + LIBRARY = ../liboverlays.a +-PROGRAMS = @SLAPD_DYNAMIC_OVERLAYS@ ++PROGRAMS = @SLAPD_DYNAMIC_OVERLAYS@ smbk5pwd.la + + XINCPATH = -I.. -I$(srcdir)/.. + XDEFS = $(MODULES_CPPFLAGS) +@@ -125,6 +126,12 @@ unique.la : unique.lo + valsort.la : valsort.lo + $(LTLINK_MOD) -module -o $@ valsort.lo version.lo $(LINK_LIBS) + ++smbk5pwd.lo : smbk5pwd.c ++ $(LTCOMPILE_MOD) -DDO_SAMBA -UHAVE_MOZNSS -DHAVE_OPENSSL $(shell pkg-config openssl --cflags) $< ++ ++smbk5pwd.la : smbk5pwd.lo ++ $(LTLINK_MOD) -module -o $@ smbk5pwd.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) ++ + install-local: $(PROGRAMS) + @if test -n "$?" ; then \ + $(MKDIR) $(DESTDIR)$(moduledir); \ +-- +1.7.10.4 + diff --git a/SOURCES/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch b/SOURCES/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch new file mode 100644 index 0000000..ed4f2ad --- /dev/null +++ b/SOURCES/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch @@ -0,0 +1,41 @@ +From: Jan-Marek Glogowski +Date: Tue, 18 May 2010 17:47:05 +0200 +Subject: [PATCH] Switch to lt_dlopenadvise() to get RTLD_GLOBAL set. + +Proof of concept for fixing http://bugs.debian.org/327585 +(patch ported from freeradius bug http://bugs.debian.org/416266) + +Resolves: #960048 +--- +--- openldap/servers/slapd/module.c.orig 2010-05-18 17:42:04.000000000 +0200 ++++ openldap/servers/slapd/module.c 2010-05-18 17:45:46.000000000 +0200 +@@ -117,6 +117,20 @@ + return -1; /* not found */ + } + ++static lt_dlhandle slapd_lt_dlopenext_global( const char *filename ) ++{ ++ lt_dlhandle handle = 0; ++ lt_dladvise advise; ++ ++ if (!lt_dladvise_init (&advise) && !lt_dladvise_ext (&advise) ++ && !lt_dladvise_global (&advise)) ++ handle = lt_dlopenadvise (filename, advise); ++ ++ lt_dladvise_destroy (&advise); ++ ++ return handle; ++} ++ + int module_load(const char* file_name, int argc, char *argv[]) + { + module_loaded_t *module; +@@ -180,7 +194,7 @@ + * to calling Debug. This is because Debug is a macro that expands + * into multiple function calls. + */ +- if ((module->lib = lt_dlopenext(file)) == NULL) { ++ if ((module->lib = slapd_lt_dlopenext_global(file)) == NULL) { + error = lt_dlerror(); + #ifdef HAVE_EBCDIC + strcpy( ebuf, error ); diff --git a/SOURCES/slapd.ldif b/SOURCES/slapd.ldif new file mode 100644 index 0000000..a4ae4c0 --- /dev/null +++ b/SOURCES/slapd.ldif @@ -0,0 +1,158 @@ +# +# See slapd-config(5) for details on configuration options. +# This file should NOT be world readable. +# + +dn: cn=config +objectClass: olcGlobal +cn: config +# +# TLS settings +# +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by oclTLSCACertificatePath one has to include them explicitly: +#olcTLSCACertificateFile: /etc/pki/tls/cert.pem +# +# Private cert and key are not pregenerated. +#olcTLSCertificateFile: +#olcTLSCertificateKeyFile: +# +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#olcTLSCipherSuite: PROFILE=SYSTEM + + +# +# Do not enable referrals until AFTER you have a working directory +# service AND an understanding of referrals. +# +#olcReferral: ldap://root.openldap.org +# +# Sample security restrictions +# Require integrity protection (prevent hijacking) +# Require 112-bit (3DES or better) encryption for updates +# Require 64-bit encryption for simple bind +# +#olcSecurity: ssf=1 update_ssf=112 simple_bind=64 + + +# +# Load dynamic backend modules: +# - modulepath is architecture dependent value (32/64-bit system) +# - back_sql.la backend requires openldap-servers-sql package +# - dyngroup.la and dynlist.la cannot be used at the same time +# + +#dn: cn=module,cn=config +#objectClass: olcModuleList +#cn: module +#olcModulepath: /usr/lib/openldap +#olcModulepath: /usr/lib64/openldap +#olcModuleload: accesslog.la +#olcModuleload: auditlog.la +#olcModuleload: back_dnssrv.la +#olcModuleload: back_ldap.la +#olcModuleload: back_mdb.la +#olcModuleload: back_meta.la +#olcModuleload: back_null.la +#olcModuleload: back_passwd.la +#olcModuleload: back_relay.la +#olcModuleload: back_shell.la +#olcModuleload: back_sock.la +#olcModuleload: collect.la +#olcModuleload: constraint.la +#olcModuleload: dds.la +#olcModuleload: deref.la +#olcModuleload: dyngroup.la +#olcModuleload: dynlist.la +#olcModuleload: memberof.la +#olcModuleload: pcache.la +#olcModuleload: ppolicy.la +#olcModuleload: refint.la +#olcModuleload: retcode.la +#olcModuleload: rwm.la +#olcModuleload: seqmod.la +#olcModuleload: smbk5pwd.la +#olcModuleload: sssvlv.la +#olcModuleload: syncprov.la +#olcModuleload: translucent.la +#olcModuleload: unique.la +#olcModuleload: valsort.la + + +# +# Schema settings +# + +dn: cn=schema,cn=config +objectClass: olcSchemaConfig +cn: schema + +include: file:///etc/openldap/schema/core.ldif + +# +# Frontend settings +# + +dn: olcDatabase=frontend,cn=config +objectClass: olcDatabaseConfig +olcDatabase: frontend +# +# Sample global access control policy: +# Root DSE: allow anyone to read it +# Subschema (sub)entry DSE: allow anyone to read it +# Other DSEs: +# Allow self write access +# Allow authenticated users read access +# Allow anonymous users to authenticate +# +#olcAccess: to dn.base="" by * read +#olcAccess: to dn.base="cn=Subschema" by * read +#olcAccess: to * +# by self write +# by users read +# by anonymous auth +# +# if no access controls are present, the default policy +# allows anyone and everyone to read anything but restricts +# updates to rootdn. (e.g., "access to * by * read") +# +# rootdn can always read and write EVERYTHING! +# + +# +# Configuration database +# + +dn: olcDatabase=config,cn=config +objectClass: olcDatabaseConfig +olcDatabase: config +olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c + n=auth" manage by * none + +# +# Server status monitoring +# + +dn: olcDatabase=monitor,cn=config +objectClass: olcDatabaseConfig +olcDatabase: monitor +olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c + n=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none + +# +# Backend database definitions +# + +dn: olcDatabase=mdb,cn=config +objectClass: olcDatabaseConfig +objectClass: olcMdbConfig +olcDatabase: mdb +olcSuffix: dc=my-domain,dc=com +olcRootDN: cn=Manager,dc=my-domain,dc=com +olcDbDirectory: /var/lib/ldap +olcDbIndex: objectClass eq,pres +olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub diff --git a/SOURCES/slapd.service b/SOURCES/slapd.service new file mode 100644 index 0000000..30821fd --- /dev/null +++ b/SOURCES/slapd.service @@ -0,0 +1,17 @@ +[Unit] +Description=OpenLDAP Server Daemon +After=syslog.target network-online.target +Documentation=man:slapd +Documentation=man:slapd-config +Documentation=man:slapd-hdb +Documentation=man:slapd-mdb +Documentation=file:///usr/share/doc/openldap-servers/guide.html + +[Service] +Type=forking +ExecStartPre=/usr/libexec/openldap/check-config.sh +ExecStart=/usr/sbin/slapd -u ldap -h "ldap:/// ldaps:/// ldapi:///" + +[Install] +WantedBy=multi-user.target +Alias=openldap.service diff --git a/SOURCES/slapd.tmpfiles b/SOURCES/slapd.tmpfiles new file mode 100644 index 0000000..634cea1 --- /dev/null +++ b/SOURCES/slapd.tmpfiles @@ -0,0 +1,2 @@ +# openldap runtime directory for slapd.arg and slapd.pid +d /run/openldap 0755 ldap ldap - diff --git a/SPECS/openldap.spec b/SPECS/openldap.spec new file mode 100644 index 0000000..0d45ae7 --- /dev/null +++ b/SPECS/openldap.spec @@ -0,0 +1,2286 @@ +%global _hardened_build 1 + +%global systemctl_bin /usr/bin/systemctl +%global check_password_version 1.1 + +%global so_ver 2 + +Name: openldap +Version: 2.4.57 +Release: 8%{?dist} +Summary: LDAP support libraries +License: OpenLDAP +URL: http://www.openldap.org/ + +Source0: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-%{version}.tgz +Source1: slapd.service +Source2: slapd.tmpfiles +Source3: slapd.ldif +Source4: ldap.conf +Source10: ltb-project-openldap-ppolicy-check-password-%{check_password_version}.tar.gz +Source50: libexec-functions +Source52: libexec-check-config.sh +Source53: libexec-upgrade-db.sh + +# patches for 2.4 +Patch0: openldap-manpages.patch +Patch2: openldap-reentrant-gethostby.patch +Patch3: openldap-smbk5pwd-overlay.patch +Patch5: openldap-ai-addrconfig.patch +Patch17: openldap-allop-overlay.patch + +# fix back_perl problems with lt_dlopen() +# might cause crashes because of symbol collisions +# the proper fix is to link all perl modules against libperl +# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327585 +Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch +Patch24: openldap-openssl-manpage-defaultCA.patch + +# The below patches come from upstream master and are necessary for Channel Binding +# (both tls-unique and tls-server-end-point) to work properly. +# Additionally, for Samba to be able to implement Channel Binding, the PEERCERT option +# is being included as well. +Patch50: openldap-cbinding-Add-channel-binding-support.patch +Patch51: openldap-cbinding-ITS-8573-allow-all-libldap-options-in-tools-o-option.patch +Patch52: openldap-cbinding-ITS-8573-TLS-option-test-suite.patch +Patch53: openldap-cbinding-ITS-8573-Add-missing-URI-variables-for-tests.patch +Patch54: openldap-cbinding-auth-add-SASL-GSSAPI-tests.patch +Patch55: openldap-cbinding-ITS-7398-add-LDAP_OPT_X_TLS_PEERCERT.patch +Patch56: openldap-cbinding-Make-prototypes-available-where-needed.patch +Patch57: openldap-cbinding-ITS-9189_1-rework-sasl-cbinding-support.patch +Patch58: openldap-cbinding-ITS-9189_2-add-channel-bindings-tests.patch +Patch59: openldap-cbinding-ITS-9189_3-initialize-ldo_sasl_cbinding-in-LDAP_LDO_SA.patch +Patch60: openldap-cbinding-Fix-slaptest-in-test077.patch +Patch61: openldap-cbinding-Convert-test077-to-LDIF-config.patch +Patch62: openldap-cbinding-Update-keys-to-RSA-4096.patch +Patch63: openldap-cbinding-ITS-9215-fix-for-glibc-again.patch +Patch64: openldap-cbinding-fix-multiprovider-tests.patch + +# check-password module specific patches +Patch90: check-password-makefile.patch +Patch91: check-password.patch + +BuildRequires: make +BuildRequires: cyrus-sasl-devel, openssl-devel, krb5-devel, unixODBC-devel +BuildRequires: glibc-devel, libtool, libtool-ltdl-devel, groff, perl-interpreter, perl-devel, perl-generators, perl(ExtUtils::Embed) +BuildRequires: gcc + +%description +OpenLDAP is an open source suite of LDAP (Lightweight Directory Access +Protocol) applications and development tools. LDAP is a set of +protocols for accessing directory services (usually phone book style +information, but other information is possible) over the Internet, +similar to the way DNS (Domain Name System) information is propagated +over the Internet. The openldap package contains configuration files, +libraries, and documentation for OpenLDAP. + +%package devel +Summary: LDAP development libraries and header files +Requires: openldap%{?_isa} = %{version}-%{release}, cyrus-sasl-devel%{?_isa} + +%description devel +The openldap-devel package includes the development libraries and +header files needed for compiling applications that use LDAP +(Lightweight Directory Access Protocol) internals. LDAP is a set of +protocols for enabling directory services over the Internet. Install +this package only if you plan to develop or will need to compile +customized LDAP clients. + +%package compat +Summary: Package providing legacy non-threded libldap +Requires: openldap%{?_isa} = %{version}-%{release} +# since libldap is manually linked from libldap_r, the provides is not generated automatically +%ifarch armv7hl i686 +Provides: libldap-2.4.so.%{so_ver} +%else +Provides: libldap-2.4.so.%{so_ver}()(%{__isa_bits}bit) +%endif + +%description compat +The openldap-compat package contains non-threaded variant of libldap +which should not be used. Instead, applications should link to libldap_r +which provides thread-safe variant with the very same API. + +%package servers +Summary: LDAP server +License: OpenLDAP +Requires: openldap%{?_isa} = %{version}-%{release}, libdb-utils +Requires(pre): shadow-utils +BuildRequires: systemd +%{?systemd_requires} +BuildRequires: libdb-devel +BuildRequires: cracklib-devel +# migrationtools (slapadd functionality): +Provides: ldif2ldbm + +%description servers +OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access +Protocol) applications and development tools. LDAP is a set of +protocols for accessing directory services (usually phone book style +information, but other information is possible) over the Internet, +similar to the way DNS (Domain Name System) information is propagated +over the Internet. This package contains the slapd server and related files. + +%package clients +Summary: LDAP client utilities +Requires: openldap%{?_isa} = %{version}-%{release} + +%description clients +OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access +Protocol) applications and development tools. LDAP is a set of +protocols for accessing directory services (usually phone book style +information, but other information is possible) over the Internet, +similar to the way DNS (Domain Name System) information is propagated +over the Internet. The openldap-clients package contains the client +programs needed for accessing and modifying OpenLDAP directories. + +%prep +%setup -q -c -a 0 -a 10 + +pushd openldap-%{version} + +AUTOMAKE=%{_bindir}/true autoreconf -fi + +%patch0 -p1 +%patch2 -p1 +%patch3 -p1 +%patch5 -p1 +%patch17 -p1 +%patch19 -p1 +%patch24 -p1 +%patch50 -p1 +%patch51 -p1 +%patch52 -p1 +%patch53 -p1 +%patch54 -p1 +%patch55 -p1 +%patch56 -p1 +%patch57 -p1 +%patch58 -p1 +%patch59 -p1 +%patch60 -p1 +%patch61 -p1 +%patch62 -p1 +%patch63 -p1 +%patch64 -p1 + +# build smbk5pwd with other overlays +ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays +mv contrib/slapd-modules/smbk5pwd/README contrib/slapd-modules/smbk5pwd/README.smbk5pwd +# build allop with other overlays +ln -s ../../../contrib/slapd-modules/allop/allop.c servers/slapd/overlays +mv contrib/slapd-modules/allop/README contrib/slapd-modules/allop/README.allop +mv contrib/slapd-modules/allop/slapo-allop.5 doc/man/man5/slapo-allop.5 + +mv servers/slapd/back-perl/README{,.back_perl} + +# fix documentation encoding +for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do + iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8" + mv "$filename.utf8" "$filename" +done + +popd + +pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +%patch90 -p1 +%patch91 -p1 +popd + +%build + +%set_build_flags +# enable experimental support for LDAP over UDP (LDAP_CONNECTIONLESS) +export CFLAGS="${CFLAGS} ${LDFLAGS} -Wl,--as-needed -DLDAP_CONNECTIONLESS -DLDAP_USE_NON_BLOCKING_TLS -DOPENSSL_NO_MD2" + +pushd openldap-%{version} +%configure \ + --enable-debug \ + --enable-dynamic \ + \ + --enable-dynacl \ + --enable-cleartext \ + --enable-crypt \ + --enable-lmpasswd \ + --enable-spasswd \ + --enable-modules \ + --enable-rewrite \ + --enable-rlookups \ + --enable-slapi \ + --disable-slp \ + \ + --enable-backends=mod \ + --enable-bdb=yes \ + --enable-hdb=yes \ + --enable-mdb=yes \ + --enable-monitor=yes \ + --disable-ndb \ + --disable-sql \ + \ + --enable-overlays=mod \ + \ + --disable-static \ + \ + --with-cyrus-sasl \ + --without-fetch \ + --with-threads \ + --with-pic \ + --with-gnu-ld \ + \ + --libexecdir=%{_libdir} + +%make_build +popd + +pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +%make_build LDAP_INC="-I../openldap-%{version}/include \ + -I../openldap-%{version}/servers/slapd \ + -I../openldap-%{version}/build-servers/include" +popd + +%install + +mkdir -p %{buildroot}%{_libdir}/ + +pushd openldap-%{version} +%make_install STRIP="" +popd + +# install check_password module +pushd ltb-project-openldap-ppolicy-check-password-%{check_password_version} +mv check_password.so check_password.so.%{check_password_version} +ln -s check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/check_password.so +install -m 755 check_password.so.%{check_password_version} %{buildroot}%{_libdir}/openldap/ +# install -m 644 README %{buildroot}%{_libdir}/openldap +install -d -m 755 %{buildroot}%{_sysconfdir}/openldap +cat > %{buildroot}%{_sysconfdir}/openldap/check_password.conf </dev/null || groupadd -r -g 55 ldap +getent passwd ldap &>/dev/null || \ + useradd -r -g ldap -u 55 -d %{_sharedstatedir}/ldap -s /sbin/nologin -c "OpenLDAP server" ldap + +if [ $1 -eq 2 ]; then + # package upgrade + + old_version=$(rpm -q --qf=%%{version} openldap-servers) + new_version=%{version} + + if [ "$old_version" != "$new_version" ]; then + touch %{_sharedstatedir}/ldap/rpm_upgrade_openldap &>/dev/null + fi +fi + +exit 0 + + +%post servers +%systemd_post slapd.service + +# generate configuration if necessary +if [[ ! -f %{_sysconfdir}/openldap/slapd.d/cn=config.ldif && \ + ! -f %{_sysconfdir}/openldap/slapd.conf + ]]; then + # if there is no configuration available, generate one from the defaults + mkdir -p %{_sysconfdir}/openldap/slapd.d/ &>/dev/null || : + /usr/sbin/slapadd -F %{_sysconfdir}/openldap/slapd.d/ -n0 -l %{_datadir}/openldap-servers/slapd.ldif + chown -R ldap:ldap %{_sysconfdir}/openldap/slapd.d/ + %{systemctl_bin} try-restart slapd.service &>/dev/null +fi + +start_slapd=0 + +# upgrade the database +if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap ]; then + if %{systemctl_bin} --quiet is-active slapd.service; then + %{systemctl_bin} stop slapd.service + start_slapd=1 + fi + + %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null + rm -f %{_sharedstatedir}/ldap/rpm_upgrade_openldap +fi + +# restart after upgrade +if [ $1 -ge 1 ]; then + if [ $start_slapd -eq 1 ]; then + %{systemctl_bin} start slapd.service &>/dev/null || : + else + %{systemctl_bin} condrestart slapd.service &>/dev/null || : + fi +fi + +exit 0 + +%preun servers +%systemd_preun slapd.service + +%postun servers +%systemd_postun_with_restart slapd.service + +%triggerin servers -- libdb + +# libdb upgrade (setup for %%triggerun) +if [ $2 -eq 2 ]; then + # we are interested in minor version changes (both versions of libdb are installed at this moment) + if [ "$(rpm -q --qf="%%{version}\n" libdb | sed 's/\.[0-9]*$//' | sort -u | wc -l)" != "1" ]; then + touch %{_sharedstatedir}/ldap/rpm_upgrade_libdb + else + rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb + fi +fi + +exit 0 + + +%triggerun servers -- libdb + +# libdb upgrade (finish %%triggerin) +if [ -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb ]; then + if %{systemctl_bin} --quiet is-active slapd.service; then + %{systemctl_bin} stop slapd.service + start=1 + else + start=0 + fi + + %{_libexecdir}/openldap/upgrade-db.sh &>/dev/null + rm -f %{_sharedstatedir}/ldap/rpm_upgrade_libdb + + [ $start -eq 1 ] && %{systemctl_bin} start slapd.service &>/dev/null +fi + +exit 0 + + +%files +%doc openldap-%{version}/ANNOUNCEMENT +%doc openldap-%{version}/CHANGES +%license openldap-%{version}/COPYRIGHT +%license openldap-%{version}/LICENSE +%doc openldap-%{version}/README +%dir %{_sysconfdir}/openldap +%dir %{_sysconfdir}/openldap/certs +%config(noreplace) %{_sysconfdir}/openldap/ldap.conf +%dir %{_libexecdir}/openldap/ +%{_libdir}/liblber-2.4*.so.* +%{_libdir}/libldap_r-2.4*.so.* +%{_libdir}/libslapi-2.4*.so.* +%{_mandir}/man5/ldif.5* +%{_mandir}/man5/ldap.conf.5* + +%files servers +%doc openldap-%{version}/contrib/slapd-modules/smbk5pwd/README.smbk5pwd +%doc openldap-%{version}/doc/guide/admin/*.html +%doc openldap-%{version}/doc/guide/admin/*.png +%doc openldap-%{version}/servers/slapd/back-perl/SampleLDAP.pm +%doc openldap-%{version}/servers/slapd/back-perl/README.back_perl +%doc openldap-%{version}/servers/slapd/back-perl/README.back_perl +%doc ltb-project-openldap-ppolicy-check-password-%{check_password_version}/README.check_pwd +%doc README.schema +%config(noreplace) %dir %attr(0750,ldap,ldap) %{_sysconfdir}/openldap/slapd.d +%config(noreplace) %{_sysconfdir}/openldap/schema +%config(noreplace) %{_sysconfdir}/openldap/check_password.conf +%{_tmpfilesdir}/slapd.conf +%dir %attr(0700,ldap,ldap) %{_sharedstatedir}/ldap +%dir %attr(-,ldap,ldap) %{_localstatedir}/run/openldap +%{_unitdir}/slapd.service +%{_datadir}/openldap-servers/ +%{_libdir}/openldap/accesslog* +%{_libdir}/openldap/auditlog* +%{_libdir}/openldap/allop* +%{_libdir}/openldap/back_dnssrv* +%{_libdir}/openldap/back_ldap* +%{_libdir}/openldap/back_meta* +%{_libdir}/openldap/back_null* +%{_libdir}/openldap/back_passwd* +%{_libdir}/openldap/back_relay* +%{_libdir}/openldap/back_shell* +%{_libdir}/openldap/back_sock* +%{_libdir}/openldap/back_perl* +%{_libdir}/openldap/collect* +%{_libdir}/openldap/constraint* +%{_libdir}/openldap/dds* +%{_libdir}/openldap/deref* +%{_libdir}/openldap/dyngroup* +%{_libdir}/openldap/dynlist* +%{_libdir}/openldap/memberof* +%{_libdir}/openldap/pcache* +%{_libdir}/openldap/ppolicy* +%{_libdir}/openldap/refint* +%{_libdir}/openldap/retcode* +%{_libdir}/openldap/rwm* +%{_libdir}/openldap/seqmod* +%{_libdir}/openldap/smbk5pwd* +%{_libdir}/openldap/sssvlv* +%{_libdir}/openldap/syncprov* +%{_libdir}/openldap/translucent* +%{_libdir}/openldap/unique* +%{_libdir}/openldap/valsort* +%{_libdir}/openldap/check_password* +%{_libexecdir}/openldap/functions +%{_libexecdir}/openldap/check-config.sh +%{_libexecdir}/openldap/upgrade-db.sh +%{_sbindir}/sl* +%{_mandir}/man8/* +%{_mandir}/man5/slapd*.5* +%{_mandir}/man5/slapo-*.5* +# obsolete configuration +%ghost %config(noreplace,missingok) %attr(0640,ldap,ldap) %{_sysconfdir}/openldap/slapd.conf + +%files clients +%{_bindir}/* +%{_mandir}/man1/* + +%files devel +%doc openldap-%{version}/doc/drafts openldap-%{version}/doc/rfc +%{_libdir}/lib*.so +%{_includedir}/* +%{_mandir}/man3/* + + +%files compat +%{_libdir}/libldap-2.4*.so.* + +%changelog +* Mon Aug 09 2021 Mohan Boddu - 2.4.57-8 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Mon Jul 12 2021 Simon Pichugin - 2.4.57-7 +- Fix Channel Binding tests Related: rhbz#1967853 + +* Thu Jun 24 2021 Simon Pichugin - 2.4.57-6 +- Fix slapd.tmpfiles complaints. Related: rhbz#1969853 +- Use https:// for source Related: rhbz#1973597 + +* Tue Jun 15 2021 Mohan Boddu - 2.4.57-5 +- Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 + +* Fri Jun 4 2021 Simon Pichugin - 2.4.57-4 +- Backport Channel Binding support. Related: rhbz#1967853 +- Fix coverity issues. Related: rhbz#1938829 + +* Fri Apr 16 2021 Mohan Boddu - 2.4.57-3 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.57-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jan 19 2021 Simon Pichugin - 2.4.57-1 +- Rebase to version 2.4.57 (#1917583) + +* Thu Nov 26 2020 Simon Pichugin - 2.4.56-4 +- Use gcc to link libldap_r to libldap (#1537260) + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-3 +- Fix 32-bit libraries build (#1537260) + +* Fri Nov 20 2020 Simon Pichugin - 2.4.56-2 +- Drop non-threaded libldap (#1537260) + +* Wed Nov 18 2020 Simon Pichugin - 2.4.56-1 +- Rebase to version 2.4.56 (#1896508) + +* Mon Nov 02 2020 Simon Pichugin - 2.4.55-1 +- Rebase to version 2.4.55 (#1891622) + +* Tue Oct 13 2020 Simon Pichugin - 2.4.54-1 +- Rebase to version 2.4.54 (#1887581) + +* Thu Sep 10 2020 Simon Pichugin - 2.4.53-1 +- Rebase to version 2.4.53 (#1868240) + +* Thu Sep 03 2020 Simon Pichugin - 2.4.52-1 +- Rebase to version 2.4.52 (#1868240) + +* Sat Aug 01 2020 Fedora Release Engineering - 2.4.50-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.50-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jun 22 2020 Jitka Plesnikova - 2.4.50-2 +- Perl 5.32 rebuild + +* Wed Jun 17 2020 Matus Honek - 2.4.50-1 +- Rebase to version 2.4.50 (#1742285) + +* Tue Jun 16 2020 Tom Stellard - 2.4.47-5 +- Spec file cleanups +- Add BuildRequres: gcc [1] +- make_build [2] and make_install [3] +- [1] https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_buildrequires_and_requires +- [2] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make +- [3] https://docs.fedoraproject.org/en-US/packaging-guidelines/#_why_the_makeinstall_macro_should_not_be_used + +* Wed Jan 29 2020 Fedora Release Engineering - 2.4.47-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jul 25 2019 Fedora Release Engineering - 2.4.47-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu May 30 2019 Jitka Plesnikova - 2.4.47-2 +- Perl 5.30 rebuild + +* Wed Feb 13 2019 Matus Honek - 2.4.47-1 +- Rebase to upstream version 2.4.47 + +* Fri Feb 01 2019 Fedora Release Engineering - 2.4.46-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 2.4.46-12 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Mon Dec 17 2018 Matus Honek - 2.4.46-11 +- Reference default system-wide CA certificates in manpages (#1611591) + +* Tue Oct 16 2018 Matus Honek - 2.4.46-10 +- Revert "Fix: Cannot use SSL3 anymore" + +* Mon Oct 08 2018 Matus Honek - 2.4.46-9 +- Backport upstream fixes for ITS 7595 - add OpenSSL EC support (#1623495) + +* Tue Aug 14 2018 Matus Honek - 2.4.46-8 +- Fix: Cannot use SSL3 anymore (#1592431) + +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.46-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jul 6 2018 Matus Honek - 2.4.46-6 +- Build with LDAP_USE_NON_BLOCKING_TLS (#1594928) +- Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967) + +* Fri Jul 06 2018 Petr Pisar - 2.4.46-5 +- Perl 5.28 rebuild + +* Wed Jul 4 2018 Matus Honek - 2.4.46-4 +- Remove unused leftover MozNSS Compat. Layer references (#1557967) + +* Wed Jul 4 2018 Matus Honek - 2.4.46-3 +- MozNSS Compat. Layer: Make log messages more clear (#1598103) +- MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203) + +* Wed Jun 27 2018 Jitka Plesnikova - 2.4.46-2 +- Perl 5.28 rebuild +- MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161) + +* Tue Mar 27 2018 Matus Honek - 2.4.46-1 +- Rebase to version OpenLDAP 2.4.46 (#1559652) + +* Mon Mar 5 2018 Matus Honek - 2.4.45-14 +- Utilize system-wide crypto-policies (#1483979) + +* Thu Mar 1 2018 Matus Honek - 2.4.45-13 +- fix: openldap does not use Fedora build flags + + makes use of redhat-rpm-config package +- Drop superfluous back-sql linking patch + +* Wed Feb 28 2018 Matus Honek - 2.4.45-12 +- MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110) + +* Wed Feb 21 2018 Matus Honek - 2.4.45-11 +- TLS: Use system trusted CA store by default (#1270678, #1537259) + +* Sun Feb 11 2018 Matus Honek - 2.4.45-10 +- Complete change: Disable TLSMC in F29+ + +* Fri Feb 09 2018 Igor Gnatenko - 2.4.45-9 +- Escape macros in %%changelog +- Disable TLSMC in F29+ +- Remove obsolete Group tag +- Don't call ldconfig in servers subpackage +- Switch to %%ldconfig_scriptlets +- Remove unneeded Requires(post): systemd-sysv, chkconfig +- Switch to %%systemd_requires +- Change BuildRequires: systemd-units to systemd + +* Wed Feb 7 2018 Matus Honek - 2.4.45-8 +- Drop TCP wrappers support (#1531487) + +* Wed Feb 7 2018 Matus Honek - 2.4.45-7 +- MozNSS Compat. Layer fixes (#1400570) + - fix incorrect parsing of CACertDir (orig. #1533955) + - fix PIN disclaimer not always shown (orig. #1516409) + - fix recursive directory deletion (orig. #1516409) + - Ensure consistency of a PEM dir before usage (orig. #1516409) + + Warn just before use of a PIN about key file extraction + - Enable usage of NSS DB with PEM cert/key (orig. #1525485) + + Fix a possible invalid dereference (covscan) + +* Sat Jan 20 2018 Björn Esser - 2.4.45-6 +- Rebuilt for switch to libxcrypt + +* Wed Dec 6 2017 Matus Honek - 2.4.45-5 +- Fix issues in MozNSS compatibility layer (#1400570) + + Force write file with fsync to avoid race conditions + + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix + + Allow missing cert and key which is a valid usecase + + Create extraction folder only in /tmp to simplify selinux rules + + Fix Covscan issues + +* Fri Nov 3 2017 Matus Honek - 2.4.45-4 +- Build with OpenSSL with MozNSS compatibility layer (#1400570) + +* Thu Aug 03 2017 Fedora Release Engineering - 2.4.45-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 2.4.45-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Jul 7 2017 Matus Honek - 2.4.45-1 +- Rebase to version 2.4.45 (#1458081) + * fixes CVE-2017-9287 (#1456712, #1456713) +- Update the 'sources' file with new SHA512 hashes + +* Fri Jul 7 2017 Matus Honek - 2.4.44-12 +- Change Requires to Recommends for nss-tools (#1415086) + +* Sun Jun 04 2017 Jitka Plesnikova - 2.4.44-11 +- Perl 5.26 rebuild + +* Fri Mar 31 2017 Matus Honek - 2.4.44-10 +- NSS: Maximal TLS protocol version should be equal to NSS default (#1435692) + +* Thu Mar 30 2017 Matus Honek - 2.4.44-9 +- NSS: Enhance OpenLDAP to support TLSv1.3 protocol with NSS (#1435692) +- NSS: Rearrange ciphers-, parsing-, and protocol-related patches (#1435692) + +* Sat Feb 11 2017 Fedora Release Engineering - 2.4.44-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Mon Jan 30 2017 Matus Honek - 2.4.44-7 +- NSS: Update list of ciphers (#1387868) + +* Mon Jan 30 2017 Matus Honek - 2.4.44-6 +- NSS: Use what NSS considers default for DEFAULT cipher string (#1387868) + +* Thu Jan 26 2017 Matus Honek - 2.4.44-5 +- NSS: fix: incorrect multi-keyword parsing and support new ones (#1243517) + +* Mon Jan 23 2017 Matus Honek - 2.4.44-4 +- fix previous commit (#1375432) + +* Fri Jan 20 2017 Matus Honek - 2.4.44-3 +- fix: Setting olcTLSProtocolMin does not change supported protocols (#1375432) +- fix: slapd should start after network-online.service (#1336487) + +* Sun May 15 2016 Jitka Plesnikova - 2.4.44-2 +- Perl 5.24 rebuild + +* Wed May 11 2016 Matus Honek - 2.4.44-1 +- Update to 2.4.44 (#1305191) + +* Tue May 3 2016 Matus Honek - 2.4.43-5 +- Bring back *.la files in %%{_libdir}/openldap/ (#1331484) + +* Wed Apr 27 2016 Matus Honek - 2.4.43-4 +- Keep *.so libraries in %%{_libdir}/openldap/ (#1331484) +- Include AllOp overlay (#1319782) + +* Sun Apr 10 2016 Peter Robinson 2.4.43-3 +- Ensure all libtool archive files are removed (.la) + +* Thu Feb 04 2016 Fedora Release Engineering - 2.4.43-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Dec 02 2015 Fedora Release Monitoring - 2.4.43-1 +- Update to 2.4.43 (#1253871) + +* Thu Jul 16 2015 Matúš Honěk - 2.4.41-1 +- New upstream release 2.4.41 (#1238251) + +* Wed Jun 17 2015 Fedora Release Engineering - 2.4.40-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Wed Jun 03 2015 Jitka Plesnikova - 2.4.40-13 +- Perl 5.22 rebuild + +* Mon Apr 27 2015 Jan Synáček - 2.4.40-12 +- fix: bring back tmpfiles config (#1215655) + +* Mon Mar 30 2015 Jan Synáček - 2.4.40-11 +- remove spurious ghosted file + +* Fri Feb 20 2015 Jan Synáček - 2.4.40-10 +- link against moznss again (#1187742) + +* Wed Feb 11 2015 Jan Synáček - 2.4.40-9 +- fix: Unknown Berkeley DB major version in db.h (#1191098) + +* Tue Feb 10 2015 Jan Synáček - 2.4.40-9 +- CVE-2015-1545: slapd crashes on search with deref control (#1190645) + +* Tue Jan 27 2015 Jan Synáček - 2.4.40-8 +- link against openssl by default +- simplify package even more by removing certificate generation + +* Mon Jan 26 2015 Jan Synáček - 2.4.40-7 +- remove tmpfiles config since it's no longer needed +- fix invalid ldif +- simplify checking for missing server configuration + +* Fri Jan 16 2015 Jan Synáček - 2.4.40-6 +- remove openldap-fedora-systemd.patch +- remove openldap-ldaprc-currentdir.patch +- remove openldap-userconfig-setgid.patch +- remove openldap-syncrepl-unset-tls-options.patch +- remove unneeded configure flags, disable sql backend and aci +- make mdb default after a new installation +- remove pid file and args file +- renumber patches and sources + +* Wed Dec 17 2014 Jan Synáček - 2.4.40-5 +- harden the build +- improve check_password +- provide an unversioned symlink to check_password.so.1.1 + +* Tue Dec 16 2014 Jan Synáček - 2.4.40-4 +- remove openldap.pc + +* Tue Dec 9 2014 Jan Synáček - 2.4.40-3 +- enhancement: generate openldap.pc (#1171493) + +* Fri Nov 14 2014 Jan Synáček - 2.4.40-2 +- enhancement: support TLSv1 and later (#1160466) + +* Mon Oct 6 2014 Jan Synáček - 2.4.40-1 +- new upstream release (#1147877) + +* Wed Aug 27 2014 Jitka Plesnikova - 2.4.39-12 +- Perl 5.20 rebuild + +* Sun Aug 17 2014 Fedora Release Engineering - 2.4.39-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Fri Jul 18 2014 Tom Callaway - 2.4.39-10 +- fix license handling + +* Mon Jul 14 2014 Jan Synáček - 2.4.39-9 +- fix: fix typo in generate-server-cert.sh (#1117229) + +* Mon Jun 9 2014 Jan Synáček - 2.4.39-8 +- fix: make default service configuration listen on ldaps:/// as well (#1105634) + +* Sat Jun 07 2014 Fedora Release Engineering - 2.4.39-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Fri May 30 2014 Jan Synáček - 2.4.39-6 +- fix: remove correct tmp file when generating server cert (#1103102) + +* Mon Mar 24 2014 Jan Synáček - 2.4.39-5 +- re-symlink unversioned libraries, so ldconfig is not confused (#1028557) + +* Tue Mar 4 2014 Jan Synáček - 2.4.39-4 +- don't automatically convert slapd.conf to slapd-config + +* Wed Feb 19 2014 Jan Synáček - 2.4.39-3 +- remove redundant sysconfig-related stuff +- add documentation reference to service file +- alias slapd.service as openldap.service + +* Tue Feb 4 2014 Jan Synáček - 2.4.39-2 +- CVE-2013-4449: segfault on certain queries with rwm overlay (#1060851) + +* Wed Jan 29 2014 Jan Synáček - 2.4.39-1 +- new upstream release (#1059186) + +* Mon Nov 18 2013 Jan Synáček - 2.4.38-1 +- new upstream release (#1031608) + +* Mon Nov 11 2013 Jan Synáček - 2.4.37-2 +- fix: slaptest incorrectly handles 'include' directives containing a custom file (#1028935) + +* Wed Oct 30 2013 Jan Synáček - 2.4.37-1 +- new upstream release (#1023916) +- fix: missing a linefeed at the end of file /etc/openldap/ldap.conf (#1019836) + +* Mon Oct 21 2013 Jan Synáček - 2.4.36-4 +- fix: slapd daemon fails to start with segmentation fault on s390x (#1020661) + +* Tue Oct 15 2013 Jan Synáček - 2.4.36-3 +- rebuilt for libdb-5.3.28 + +* Mon Oct 14 2013 Jan Synáček - 2.4.36-2 +- fix: CLDAP is broken for IPv6 (#1018688) + +* Wed Sep 4 2013 Jan Synáček - 2.4.36-2 +- fix: typos in manpages + +* Tue Aug 20 2013 Jan Synáček - 2.4.36-1 +- new upstream release + + compile-in mdb backend + +* Sat Aug 03 2013 Fedora Release Engineering - 2.4.35-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Wed Jul 17 2013 Petr Pisar - 2.4.35-6 +- Perl 5.18 rebuild + +* Fri Jun 14 2013 Jan Synáček - 2.4.35-5 +- fix: using slaptest to convert slapd.conf to LDIF format ignores "loglevel 0" + +* Thu May 09 2013 Jan Synáček 2.4.35-4 +- do not needlessly run ldconfig after installing openldap-devel +- fix: LDAPI with GSSAPI does not work if SASL_NOCANON=on (#960222) +- fix: lt_dlopen() with back_perl (#960048) + +* Tue Apr 09 2013 Jan Synáček 2.4.35-3 +- fix: minor documentation fixes +- set SASL_NOCANON to on by default (#949864) +- remove trailing spaces + +* Fri Apr 05 2013 Jan Synáček 2.4.35-2 +- drop the evolution patch + +* Tue Apr 02 2013 Jan Synáček 2.4.35-1 +- new upstream release (#947235) +- fix: slapd.service should ensure that network is up before starting (#946921) +- fix: NSS related resource leak (#929357) + +* Mon Mar 18 2013 Jan Synáček 2.4.34-2 +- fix: syncrepl push DELETE operation does not recover (#920482) +- run autoreconf every build, drop autoreconf patch (#926280) + +* Mon Mar 11 2013 Jan Synáček 2.4.34-1 +- enable perl backend (#820547) +- package ppolicy-check-password (#829749) +- add perl specific BuildRequires +- fix bogus dates + +* Wed Mar 06 2013 Jan Vcelak 2.4.34-1 +- new upstream release (#917603) +- fix: slapcat segfaults if cn=config.ldif not present (#872784) +- use systemd-rpm macros in spec file (#850247) + +* Thu Jan 31 2013 Jan Synáček 2.4.33-4 +- rebuild against new cyrus-sasl + +* Wed Oct 31 2012 Jan Vcelak 2.4.33-3 +- fix update: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#857455) + +* Fri Oct 12 2012 Jan Vcelak 2.4.33-2 +- fix: slapd with rwm overlay segfault following ldapmodify (#865685) + +* Thu Oct 11 2012 Jan Vcelak 2.4.33-1 +- new upstream release: + + slapd: ACLs, syncrepl + + backends: locking and memory management in MDB + + manpages: slapo-refint +- patch update: MozNSS certificate database in SQL format cannot be used (#860317) +- fix: slapd.service should not use /tmp (#859019) + +* Fri Sep 14 2012 Jan Vcelak 2.4.32-3 +- fix: some TLS ciphers cannot be enabled (#852338) +- fix: connection hangs after fallback to second server when certificate hostname verification fails (#852476) +- fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#852786) +- fix: MozNSS certificate database in SQL format cannot be used (#857373) +- fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#857455) + +* Mon Aug 20 2012 Jan Vcelak 2.4.32-2 +- enhancement: TLS, prefer private keys from authenticated slots +- enhancement: TLS, allow certificate specification including token name +- resolve TLS failures in replication in 389 Directory Server + +* Wed Aug 01 2012 Jan Vcelak 2.4.32-1 +- new upstream release + + library: double free, SASL handling + + tools: read SASL_NOCANON from config file + + slapd: config index renumbering, duplicate error response + + backends: various fixes in mdb, bdb/hdb, ldap + + accesslog, syncprov: fix memory leaks in with replication + + sha2: portability, thread safety, support SSHA256,384,512 + + documentation fixes + +* Sat Jul 21 2012 Jan Vcelak 2.4.31-7 +- fix: slapd refuses to set up TLS with self-signed PEM certificate (#842022) + +* Fri Jul 20 2012 Jan Vcelak 2.4.31-6 +- multilib fix: move libslapi from openldap-servers to openldap package + +* Thu Jul 19 2012 Jan Vcelak 2.4.31-5 +- fix: querying for IPv6 DNS records when IPv6 is disabled on the host (#835013) +- fix: smbk5pwd module computes invalid LM hashes (#841560) + +* Wed Jul 18 2012 Jan Vcelak 2.4.31-4 +- modify the package build process + + fix autoconfig files to detect Mozilla NSS library using pkg-config + + remove compiler flags which are not needed currently + + build server, client and library together + + avoid stray dependencies by using --as-needed linker flag + + enable SLAPI interface in slapd + +* Wed Jun 27 2012 Jan Vcelak 2.4.31-3 +- update fix: count constraint broken when using multiple modifications (#795766) +- fix: invalid order of TLS shutdown operations (#808464) +- fix: TLS error messages overwriting in tlsm_verify_cert() (#810462) +- fix: reading pin from file can make all TLS connections hang (#829317) +- CVE-2012-2668: cipher suite selection by name can be ignored (#825875) +- fix: slapd fails to start on reboot (#829272) +- fix: default cipher suite is always selected (#828790) +- fix: less influence between individual TLS contexts: + - replication with TLS does not work (#795763) + - possibly others + +* Fri May 18 2012 Jan Vcelak 2.4.31-2 +- fix: nss-tools package is required by the base package, not the server subpackage +- fix: MozNSS CA certdir does not work together with PEM CA cert file (#819536) + +* Tue Apr 24 2012 Jan Vcelak 2.4.31-1 +- new upstream release + + library: IPv6 url detection + + library: rebinding to failed connections + + server: various fixes in mdb backend + + server: various fixes in replication + + server: various fixes in overlays and minor backends + + documentation fixes +- remove patches which were merged upstream + +* Thu Apr 05 2012 Jan Vcelak 2.4.30-3 +- rebuild due to libdb rebase + +* Mon Mar 26 2012 Jan Synáček 2.4.30-2 +- fix: Re-binding to a failed connection can segfault (#784989) + +* Thu Mar 01 2012 Jan Vcelak 2.4.30-1 +- new upstream release + + server: fixes in mdb backend + + server: fixes in manual pages + + server: fixes in syncprov, syncrepl, and pcache +- removed patches which were merged upstream + +* Wed Feb 22 2012 Jan Vcelak 2.4.29-4 +- fix: missing options in manual pages of client tools (#796232) +- fix: SASL_NOCANON option missing in ldap.conf manual page (#732915) + +* Tue Feb 21 2012 Jan Vcelak 2.4.29-3 +- fix: ldap_result does not succeed for sssd (#771484) +- Jan Synáček : + + fix: count constraint broken when using multiple modifications (#795766) + +* Mon Feb 20 2012 Jan Vcelak 2.4.29-2 +- fix update: provide ldif2ldbm, not ldib2ldbm (#437104) +- Jan Synáček : + + unify systemctl binary paths throughout the specfile and make them usrmove compliant + + make path to chkconfig binary usrmove compliant + +* Wed Feb 15 2012 Jan Vcelak 2.4.29-1 +- new upstream release + + MozNSS fixes + + connection handling fixes + + server: buxfixes in mdb backend + + server: buxfixes in overlays (syncrepl, meta, monitor, perl, sql, dds, rwm) +- openldap-servers now provide ldib2ldbm (#437104) +- certificates management improvements + + create empty Mozilla NSS certificate database during installation + + enable builtin Root CA in generated database (#789088) + + generate server certificate using Mozilla NSS tools instead of OpenSSL tools + + fix: correct path to check-config.sh in service file (Jan Synáček ) +- temporarily disable certificates checking in check-config.sh script +- fix: check-config.sh get stuck when executing command as a ldap user + +* Tue Jan 31 2012 Jan Vcelak 2.4.28-3 +- fix: replication (syncrepl) with TLS causes segfault (#783431) +- fix: slapd segfaults when PEM certificate is used and key is not set (#772890) + +* Fri Jan 13 2012 Fedora Release Engineering - 2.4.28-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Wed Nov 30 2011 Jan Vcelak 2.4.28-1 +- new upstream release + + server: support for delta-syncrepl in multi master replication + + server: add experimental backend - MDB + + server: dynamic configuration for passwd, perl, shell, sock, and sql backends + + server: support passwords in APR1 + + library: support for Wahl (draft) + + a lot of bugfixes +- remove patches which were merged upstream +- compile backends as modules (except BDB, HDB, and monitor) +- reload systemd daemon after installation + +* Tue Nov 01 2011 Jan Vcelak 2.4.26-6 +- package cleanup: + + hardened build: switch from LDFLAGS to RPM macros + + remove old provides and obsoletes + + add new slapd maintainance scripts + + drop defattr macros, clean up permissions in specfile + + fix rpmlint warnings: macros in comments/changelog + + fix rpmlint warnings: non UTF-8 documentation + + rename environment file to be more consistent (ldap -> slapd) +- replace sysv initscript with systemd service file (# +- new format of environment file due to switch to systemd + (automatic conversion is performed) +- patch OpenLDAP to skip empty command line arguments + (arguments expansion in systemd works different than in shell) +- CVE-2011-4079: one-byte buffer overflow in slapd (#749324) + +* Thu Oct 06 2011 Jan Vcelak 2.4.26-5 +- rebuild: openldap does not work after libdb rebase (#743824) +- regression fix: openldap built without tcp_wrappers (#743213) + +* Wed Sep 21 2011 Jan Vcelak 2.4.26-4 +- new feature update: honor priority/weight with ldap_domain2hostlist (#733078) + +* Mon Sep 12 2011 Jan Vcelak 2.4.26-3 +- fix: SSL_ForceHandshake function is not thread safe (#701678) +- fix: allow unsetting of tls_* syncrepl options (#734187) + +* Wed Aug 24 2011 Jan Vcelak 2.4.26-2 +- security hardening: library needs partial RELRO support added (#733071) +- fix: NSS_Init* functions are not thread safe (#731112) +- fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#725819) +- fix: memleak - free the return of tlsm_find_and_verify_cert_key (#725818) +- fix: conversion of constraint overlay settings to cn=config is incorrect (#733067) +- fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#733069) +- manpage fix: errors in manual page slapo-unique (#733070) +- fix: matching wildcard hostnames in certificate Subject field does not work (#733073) +- new feature: honor priority/weight with ldap_domain2hostlist (#733078) +- manpage fix: wrong ldap_sync_destroy() prototype in ldap_sync(3) manpage (#717722) + +* Sun Aug 14 2011 Rex Dieter - 2.4.26-1.1 +- Rebuilt for rpm (#728707) + +* Wed Jul 20 2011 Jan Vcelak 2.4.26-1 +- rebase to new upstream release +- fix: memleak in tlsm_auth_cert_handler (#717730) + +* Mon Jun 27 2011 Jan Vcelak 2.4.25-1 +- rebase to new upstream release +- change default database type from BDB to HDB +- enable ldapi:/// interface by default +- set cn=config management ACLs for root user, SASL external schema (#712495) +- fix: server scriptlets require initscripts package (#716857) +- fix: connection fails if TLS_CACERTDIR doesn't exist but TLS_REQCERT + is set to 'never' (#716854) +- fix: segmentation fault caused by double-free in ldapexop (#699683) +- fix: segmentation fault of client tool when input line in LDIF file + is splitted but indented incorrectly (#716855) +- fix: segmentation fault of client tool when LDIF input file is not terminated + by a new line character (#716858) + +* Fri Mar 18 2011 Jan Vcelak 2.4.24-2 +- new: system resource limiting for slapd using ulimit +- fix update: openldap can't use TLS after a fork() (#636956) +- fix: possible null pointer dereference in NSS implementation +- fix: openldap-servers upgrade hangs or do not upgrade the database (#664433) + +* Mon Feb 14 2011 Jan Vcelak 2.4.24-1 +- rebase to 2.4.24 +- BDB backend switch from DB4 to DB5 + +* Tue Feb 08 2011 Fedora Release Engineering - 2.4.23-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Wed Feb 02 2011 Jan Vcelak 2.4.23-8 +- fix update: openldap can't use TLS after a fork() (#636956) + +* Tue Jan 25 2011 Jan Vcelak 2.4.23-7 +- fix: openldap can't use TLS after a fork() (#636956) +- fix: openldap-server upgrade gets stuck when the database is damaged (#664433) + +* Thu Jan 20 2011 Jan Vcelak 2.4.23-6 +- fix: some server certificates refused with inadequate type error (#668899) +- fix: default encryption strength dropped in switch to using NSS (#669446) +- systemd compatibility: add configuration file (#656647, #668223) + +* Thu Jan 06 2011 Jan Vcelak 2.4.23-5 +- initscript: slaptest with '-u' to skip database opening (#667768) +- removed slurpd options from sysconfig/ldap +- fix: verification of self issued certificates (#657984) + +* Mon Nov 22 2010 Jan Vcelak 2.4.23-4 +- Mozilla NSS - implement full non-blocking semantics + ldapsearch -Z hangs server if starttls fails (#652822) +- updated list of all overlays in slapd.conf (#655899) +- fix database upgrade process (#656257) + +* Thu Nov 18 2010 Jan Vcelak 2.4.23-3 +- add support for multiple prefixed Mozilla NSS database files in TLS_CACERTDIR +- reject non-file keyfiles in TLS_CACERTDIR (#652315) +- TLS_CACERTDIR precedence over TLS_CACERT (#652304) +- accept only files in hash.0 format in TLS_CACERTDIR (#650288) +- improve SSL/TLS trace messages (#652818) + +* Mon Nov 01 2010 Jan Vcelak 2.4.23-2 +- fix possible infinite loop when checking permissions of TLS files (#641946) +- removed outdated autofs.schema (#643045) +- removed outdated README.upgrade +- removed relics of migrationtools + +* Fri Aug 27 2010 Jan Vcelak 2.4.23-1 +- rebase to 2.4.23 +- embeded db4 library removed +- removed bogus links in "SEE ALSO" in several man-pages (#624616) + +* Thu Jul 22 2010 Jan Vcelak 2.4.22-7 +- Mozilla NSS - delay token auth until needed (#616552) +- Mozilla NSS - support use of self signed CA certs as server certs (#614545) + +* Tue Jul 20 2010 Jan Vcelak - 2.4.22-6 +- CVE-2010-0211 openldap: modrdn processing uninitialized pointer free (#605448) +- CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference (#605452) +- obsolete configuration file moved to /usr/share/openldap-servers (#612602) + +* Thu Jul 01 2010 Jan Zeleny - 2.4.22-5 +- another shot at previous fix + +* Thu Jul 01 2010 Jan Zeleny - 2.4.22-4 +- fixed issue with owner of /usr/lib/ldap/__db.* (#609523) + +* Thu Jun 3 2010 Rich Megginson - 2.4.22-3 +- added ldif.h to the public api in the devel package +- added -lldif to the public api +- added HAVE_MOZNSS and other flags to use Mozilla NSS for crypto + +* Tue May 18 2010 Jan Zeleny - 2.4.22-2 +- rebuild with connectionless support (#587722) +- updated autofs schema (#584808) + +* Tue May 04 2010 Jan Zeleny - 2.4.22-1 +- rebased to 2.4.22 (mostly bugfixes, added back-ldif, back-null testing support) +- due to some possible issues pointed out in last update testing phase, I'm + pulling back the last change (slapd can't be moved since it depends on /usr + possibly mounted from network) + +* Fri Mar 19 2010 Jan Zeleny - 2.4.21-6 +- moved slapd to start earlier during boot sequence + +* Tue Mar 16 2010 Jan Zeleny - 2.4.21-5 +- minor corrections of init script (#571235, #570057, #573804) + +* Wed Feb 24 2010 Jan Zeleny - 2.4.21-4 +- fixed SIGSEGV when deleting data using hdb (#562227) + +* Mon Feb 01 2010 Jan Zeleny - 2.4.21-3 +- fixed broken link /usr/sbin/slapschema (#559873) + +* Tue Jan 19 2010 Jan Zeleny - 2.4.21-2 +- removed some static libraries from openldap-devel (#556090) + +* Mon Jan 11 2010 Jan Zeleny - 2.4.21-1 +- rebased openldap to 2.4.21 +- rebased bdb to 4.8.26 + +* Mon Nov 23 2009 Jan Zeleny - 2.4.19-3 +- minor corrections in init script + +* Mon Nov 16 2009 Jan Zeleny - 2.4.19-2 +- fixed tls connection accepting when TLSVerifyClient = allow +- /etc/openldap/ldap.conf removed from files owned by openldap-servers +- minor changes in spec file to supress warnings +- some changes in init script, so it would be possible to use it when + using old configuration style + +* Fri Nov 06 2009 Jan Zeleny - 2.4.19-1 +- rebased openldap to 2.4.19 +- rebased bdb to 4.8.24 + +* Wed Oct 07 2009 Jan Zeleny 2.4.18-4 +- updated smbk5pwd patch to be linked with libldap (#526500) +- the last buffer overflow patch replaced with the one from upstream +- added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak + to files owned by openldap-servers + +* Thu Sep 24 2009 Jan Zeleny 2.4.18-3 +- cleanup of previous patch fixing buffer overflow + +* Tue Sep 22 2009 Jan Zeleny 2.4.18-2 +- changed configuration approach. Instead od slapd.conf slapd + is using slapd.d directory now +- fix of some issues caused by renaming of init script +- fix of buffer overflow issue in ldif.c pointed out by new glibc + +* Fri Sep 18 2009 Jan Zeleny 2.4.18-1 +- rebase of openldap to 2.4.18 + +* Wed Sep 16 2009 Jan Zeleny 2.4.16-7 +- updated documentation (hashing the cacert dir) + +* Wed Sep 16 2009 Jan Zeleny 2.4.16-6 +- updated init script to be LSB-compliant (#523434) +- init script renamed to slapd + +* Thu Aug 27 2009 Tomas Mraz - 2.4.16-5 +- rebuilt with new openssl + +* Tue Aug 25 2009 Jan Zeleny 2.4.16-4 +- updated %%pre script to correctly install openldap group + +* Sat Jul 25 2009 Fedora Release Engineering - 2.4.16-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Jul 01 2009 Jan Zeleny 2.4.16-1 +- rebase of openldap to 2.4.16 +- fixed minor issue in spec file (output looking interactive + when installing servers) + +* Tue Jun 09 2009 Jan Zeleny 2.4.15-4 +- added $SLAPD_URLS variable to init script (#504504) + +* Thu Apr 09 2009 Jan Zeleny 2.4.15-3 +- extended previous patch (#481310) to remove options cfMP + from some client tools +- correction of patch setugid (#494330) + +* Thu Mar 26 2009 Jan Zeleny 2.4.15-2 +- removed -f option from some client tools (#481310) + +* Wed Feb 25 2009 Jan Safranek 2.4.15-1 +- new upstream release + +* Tue Feb 17 2009 Jan Safranek 2.4.14-1 +- new upstream release +- upgraded to db-4.7.25 + +* Sat Jan 17 2009 Tomas Mraz 2.4.12-3 +- rebuild with new openssl + +* Mon Dec 15 2008 Caolán McNamara 2.4.12-2 +- rebuild for libltdl, i.e. copy config.sub|guess from new location + +* Wed Oct 15 2008 Jan Safranek 2.4.12-1 +- new upstream release + +* Mon Oct 13 2008 Jan Safranek 2.4.11-3 +- add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins + to set non-default slapd shutdown timeout +- add checkpoint to default slapd.conf file (#458679) + +* Mon Sep 1 2008 Jan Safranek 2.4.11-2 +- provide ldif2ldbm functionality for migrationtools +- rediff all patches to get rid of patch fuzz + +* Mon Jul 21 2008 Jan Safranek 2.4.11-1 +- new upstream release +- apply official bdb-4.6.21 patches + +* Wed Jul 2 2008 Jan Safranek 2.4.10-2 +- fix CVE-2008-2952 (#453728) + +* Thu Jun 12 2008 Jan Safranek 2.4.10-1 +- new upstream release + +* Wed May 28 2008 Jan Safranek 2.4.9-5 +- use /sbin/nologin as shell of ldap user (#447919) + +* Tue May 13 2008 Jan Safranek 2.4.9-4 +- new upstream release +- removed unnecessary MigrationTools patches + +* Thu Apr 10 2008 Jan Safranek 2.4.8-4 +- bdb upgraded to 4.6.21 +- reworked upgrade logic again to run db_upgrade when bdb version + changes + +* Wed Mar 5 2008 Jan Safranek 2.4.8-3 +- reworked the upgrade logic, slapcat/slapadd of the whole database + is needed only if minor version changes (2.3.x -> 2.4.y) +- do not try to save database in LDIF format, if openldap-servers package + is being removed (it's up to the admin to do so manually) + +* Thu Feb 28 2008 Jan Safranek 2.4.8-2 +- migration tools carved out to standalone package "migrationtools" + (#236697) + +* Fri Feb 22 2008 Jan Safranek 2.4.8-1 +- new upstream release + +* Fri Feb 8 2008 Jan Safranek 2.4.7-7 +- fix CVE-2008-0658 (#432014) + +* Mon Jan 28 2008 Jan Safranek 2.4.7-6 +- init script fixes + +* Mon Jan 28 2008 Jan Safranek 2.4.7-5 +- init script made LSB-compliant (#247012) + +* Fri Jan 25 2008 Jan Safranek 2.4.7-4 +- fixed rpmlint warnings and errors + - /etc/openldap/schema/README moved to /usr/share/doc/openldap + +* Tue Jan 22 2008 Jan Safranek 2.4.7-3 +- obsoleting compat-openldap properly again :) + +* Tue Jan 22 2008 Jan Safranek 2.4.7-2 +- obsoleting compat-openldap properly (#429591) + +* Mon Jan 14 2008 Jan Safranek 2.4.7-1 +- new upstream version (openldap-2.4.7) + +* Mon Dec 3 2007 Jan Safranek 2.4.6-1 +- new upstream version (openldap-2.4) +- deprecating compat- package + +* Mon Nov 5 2007 Jan Safranek 2.3.39-1 +- new upstream release + +* Tue Oct 23 2007 Jan Safranek 2.3.38-4 +- fixed multilib issues - all platform independent files have the + same content now (#342791) + +* Thu Oct 4 2007 Jan Safranek 2.3.38-3 +- BDB downgraded back to 4.4.20 because 4.6.18 is not supported by + openldap (#314821) + +* Mon Sep 17 2007 Jan Safranek 2.3.38-2 +- skeleton /etc/sysconfig/ldap added +- new SLAPD_LDAP option to turn off listening on ldap:/// (#292591) +- fixed checking of SSL (#292611) +- fixed upgrade with empty database + +* Thu Sep 6 2007 Jan Safranek 2.3.38-1 +- new upstream version +- added images to the guide.html (#273581) + +* Wed Aug 22 2007 Jan Safranek 2.3.37-3 +- just rebuild + +* Thu Aug 2 2007 Jan Safranek 2.3.37-2 +- do not use specific automake and autoconf +- do not distinguish between NPTL and non-NPTL platforms, we have NPTL + everywhere +- db-4.6.18 integrated +- updated openldap-servers License: field to reference BDB license + +* Tue Jul 31 2007 Jan Safranek 2.3.37-1 +- new upstream version + +* Fri Jul 20 2007 Jan Safranek 2.3.34-7 +- MigrationTools-47 integrated + +* Wed Jul 4 2007 Jan Safranek 2.3.34-6 +- fix compat-slapcat compilation. Now it can be found in + /usr/lib/compat-openldap/slapcat, because the tool checks argv[0] + (#246581) + +* Fri Jun 29 2007 Jan Safranek 2.3.34-5 +- smbk5pwd added (#220895) +- correctly distribute modules between servers and servers-sql packages + +* Mon Jun 25 2007 Jan Safranek 2.3.34-4 +- Fix initscript return codes (#242667) +- Provide overlays (as modules; #246036, #245896) +- Add available modules to config file + +* Tue May 22 2007 Jan Safranek 2.3.34-3 +- do not create script in /tmp on startup (bz#188298) +- add compat-slapcat to openldap-compat (bz#179378) +- do not import ddp services with migrate_services.pl + (bz#201183) +- sort the hosts by adders, preventing duplicities + in migrate*nis*.pl (bz#201540) +- start slupd for each replicated database (bz#210155) +- add ldconfig to devel post/postun (bz#240253) +- include misc.schema in default slapd.conf (bz#147805) + +* Mon Apr 23 2007 Jan Safranek 2.3.34-2 +- slapadd during package update is now quiet (bz#224581) +- use _localstatedir instead of var/ during build (bz#220970) +- bind-libbind-devel removed from BuildRequires (bz#216851) +- slaptest is now quiet during service ldap start, if + there is no error/warning (bz#143697) +- libldap_r.so now links with pthread (bz#198226) +- do not strip binaries to produce correct .debuginfo packages + (bz#152516) + +* Mon Feb 19 2007 Jay Fenlason 2.3.34-1 +- New upstream release +- Upgrade the scripts for migrating the database so that they might + actually work. +- change bind-libbind-devel to bind-devel in BuildPreReq + +* Mon Dec 4 2006 Thomas Woerner 2.3.30-1.1 +- tcp_wrappers has a new devel and libs sub package, therefore changing build + requirement for tcp_wrappers to tcp_wrappers-devel + +* Wed Nov 15 2006 Jay Fenlason 2.3.30-1 +- New upstream version + +* Wed Oct 25 2006 Jay Fenlason 2.3.28-1 +- New upstream version + +* Sun Oct 01 2006 Jesse Keating - 2.3.27-4 +- rebuilt for unwind info generation, broken in gcc-4.1.1-21 + +* Mon Sep 18 2006 Jay Fenlason 2.3.27-3 +- Include --enable-multimaster to close + bz#185821: adding slapd_multimaster to the configure options +- Upgade guide.html to the correct one for openladp-2.3.27, closing + bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2 +- Remove the quotes from around the slaptestflags in ldap.init + This closes one part of + bz#204593: service ldap fails after having added entries to ldap +- include __db.* in the list of files to check ownership of in + ldap.init, as suggested in + bz#199322: RFE: perform cleanup in ldap.init + +* Fri Aug 25 2006 Jay Fenlason 2.3.27-2 +- New upstream release +- Include the gethostbyname_r patch so that nss_ldap won't hang + on recursive attemts to ldap_initialize. + +* Wed Jul 12 2006 Jesse Keating - 2.3.24-2.1 +- rebuild + +* Wed Jun 7 2006 Jay Fenlason 2.3.24-2 +- New upstream version + +* Thu Apr 27 2006 Jay Fenlason 2.3.21-2 +- Upgrade to 2.3.21 +- Add two upstream patches for db-4.4.20 + +* Mon Feb 13 2006 Jay Fenlason 2.3.19-4 +- Re-fix ldap.init + +* Fri Feb 10 2006 Jesse Keating - 2.3.19-3.1 +- bump again for double-long bug on ppc(64) + +* Thu Feb 9 2006 Jay Fenlason 2.3.19-3 +- Modify the ldap.init script to call runuser correctly. + +* Tue Feb 07 2006 Jesse Keating - 2.3.19-2.1 +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Tue Jan 10 2006 Jay Fenlason 2.3.19-2 +- Upgrade to 2.3.19, which upstream now considers stable +- Modify the -config.patch, ldap.init, and this spec file to put the + pid file and args file in an ldap-owned openldap subdirectory under + /var/run. +- Move back_sql* out of _sbindir/openldap , which requires + hand-moving slapd and slurpd to _sbindir, and recreating symlinks + by hand. +- Retire openldap-2.3.11-ads.patch, which went upstream. +- Update the ldap.init script to run slaptest as the ldap user rather + than as root. This solves + bz#150172 Startup failure after database problem +- Add to the servers post and preun scriptlets so that on preun, the + database is slapcatted to /var/lib/ldap/upgrade.ldif and the + database files are saved to /var/lib/ldap/rpmorig. On post, if + /var/lib/ldap/upgrade.ldif exists, it is slapadded. This means that + on upgrades from 2.3.16-2 to higher versions, the database files may + be automatically upgraded. Unfortunatly, because of the changes to + the preun scriptlet, users have to do the slapcat, etc by hand when + upgrading to 2.3.16-2. Also note that the /var/lib/ldap/rpmorig + files need to be removed by hand because automatically removing your + emergency fallback files is a bad idea. +- Upgrade internal bdb to db-4.4.20. For a clean upgrade, this will + require that users slapcat their databases into a temp file, move + /var/lib/ldap someplace safe, upgrade the openldap rpms, then + slapadd the temp file. + + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Mon Nov 21 2005 Jay Fenlason 2.3.11-3 +- Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and + compat-openldap- to close + bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5' + +* Thu Nov 10 2005 Jay Fenlason 2.3.11-2 +- Upgrade to 2.3.11, which upstream now considers stable. +- Switch compat-openldap to 2.2.29 +- remove references to nss_ldap_build from the spec file +- remove references to 2.0 and 2.1 from the spec file. +- reorganize the build() function slightly in the spec file to limit the + number of redundant and conflicting options passedto configure. +- Remove the attempt to hardlink ldapmodify and ldapadd together, since + the current make install make ldapadd a symlink to ldapmodify. +- Include the -ads patches to allow SASL binds to an Active Directory + server to work. Nalin wrote the patch, based on my + broken first attempt. + +* Thu Nov 10 2005 Tomas Mraz 2.2.29-3 +- rebuilt against new openssl + +* Mon Oct 10 2005 Jay Fenlason 2.2.29-2 +- New upstream version. + +* Thu Sep 29 2005 Jay Fenlason 2.2.28-2 +- Upgrade to nev upstream version. This makes the 2.2.*-hop patch obsolete. + +* Mon Aug 22 2005 Jay Fenlason 2.2.26-2 +- Move the slapd.pem file to /etc/pki/tls/certs + and edit the -config patch to match to close + bz#143393 Creates certificates + keys at an insecure/bad place +- also use _sysconfdir instead of hard-coding /etc + +* Thu Aug 11 2005 Jay Fenlason +- Add the tls-fix-connection-test patch to close + bz#161991 openldap password disclosure issue +- add the hop patches to prevent infinite looping when chasing referrals. + OpenLDAP ITS #3578 + +* Fri Aug 5 2005 Nalin Dahyabhai +- fix typo in ldap.init (call $klist instead of klist, from Charles Lopes) + +* Thu May 19 2005 Nalin Dahyabhai 2.2.26-1 +- run slaptest with the -u flag if no id2entry db files are found, because + you can't check for read-write access to a non-existent database (#156787) +- add _sysconfdir/openldap/cacerts, which authconfig sets as the + TLS_CACERTDIR path in /etc/openldap/ldap.conf now +- use a temporary wrapper script to launch slapd, in case we have arguments + with embedded whitespace (#158111) + +* Wed May 4 2005 Nalin Dahyabhai +- update to 2.2.26 (stable 20050429) +- enable the lmpasswd scheme +- print a warning if slaptest fails, slaptest -u succeeds, and one of the + directories listed as the storage location for a given suffix in slapd.conf + contains a readable file named __db.001 (#118678) + +* Tue Apr 26 2005 Nalin Dahyabhai 2.2.25-1 +- update to 2.2.25 (release) + +* Tue Apr 26 2005 Nalin Dahyabhai 2.2.24-1 +- update to 2.2.24 (stable 20050318) +- export KRB5_KTNAME in the init script, in case it was set in the sysconfig + file but not exported + +* Tue Mar 1 2005 Nalin Dahyabhai 2.2.23-4 +- prefer libresolv to libbind + +* Tue Mar 1 2005 Nalin Dahyabhai 2.2.23-3 +- add bind-libbind-devel and libtool-ltdl-devel buildprereqs + +* Tue Mar 1 2005 Tomas Mraz 2.2.23-2 +- rebuild with openssl-0.9.7e + +* Mon Jan 31 2005 Nalin Dahyabhai 2.2.23-1 +- update to 2.2.23 (stable-20050125) +- update notes on upgrading from earlier versions +- drop slapcat variations for 2.0/2.1, which choke on 2.2's config files + +* Tue Jan 4 2005 Nalin Dahyabhai 2.2.20-1 +- update to 2.2.20 (stable-20050103) +- warn about unreadable krb5 keytab files containing "ldap" keys +- warn about unreadable TLS-related files +- own a ref to subdirectories which we create under _libdir/tls + +* Tue Nov 2 2004 Nalin Dahyabhai 2.2.17-0 +- rebuild + +* Thu Sep 30 2004 Nalin Dahyabhai +- update to 2.2.17 (stable-20040923) (#135188) +- move nptl libraries into arch-specific subdirectories on x86 boxes +- require a newer glibc which can provide nptl libpthread on i486/i586 + +* Tue Aug 24 2004 Nalin Dahyabhai +- move slapd startup to earlier in the boot sequence (#103160) +- update to 2.2.15 (stable-20040822) +- change version number on compat-openldap to include the non-compat version + from which it's compiled, otherwise would have to start 2.2.15 at release 3 + so that it upgrades correctly + +* Thu Aug 19 2004 Nalin Dahyabhai 2.2.13-2 +- build a separate, static set of libraries for openldap-devel with the + non-standard ntlm bind patch applied, for use by the evolution-connector + package (#125579), and installing them under + evolution_connector_prefix) +- provide openldap-evolution-devel = version-release in openldap-devel + so that evolution-connector's source package can require a version of + openldap-devel which provides what it wants + +* Mon Jul 26 2004 Nalin Dahyabhai +- update administrator guide + +* Wed Jun 16 2004 Nalin Dahyabhai 2.2.13-1 +- add compat-openldap subpackage +- default to bdb, as upstream does, gambling that we're only going to be + on systems with nptl now + +* Tue Jun 15 2004 Nalin Dahyabhai 2.2.13-0 +- preliminary 2.2.13 update +- move ucdata to the -servers subpackage where it belongs + +* Tue Jun 15 2004 Nalin Dahyabhai 2.1.30-1 +- build experimental sql backend as a loadable module + +* Tue Jun 15 2004 Elliot Lee +- rebuilt + +* Tue May 18 2004 Nalin Dahyabhai 2.1.30-0 +- update to 2.1.30 + +* Thu May 13 2004 Thomas Woerner 2.1.29-3 +- removed rpath +- added pie patch: slapd and slurpd are now pie +- requires libtool >= 1.5.6-2 (PIC libltdl.a) + +* Fri Apr 16 2004 Nalin Dahyabhai 2.1.29-2 +- move rfc documentation from main to -devel (#121025) + +* Wed Apr 14 2004 Nalin Dahyabhai 2.1.29-1 +- rebuild + +* Tue Apr 6 2004 Nalin Dahyabhai 2.1.29-0 +- update to 2.1.29 (stable 20040329) + +* Mon Mar 29 2004 Nalin Dahyabhai +- don't build servers with --with-kpasswd, that option hasn't been recognized + since 2.1.23 + +* Tue Mar 02 2004 Elliot Lee 2.1.25-5.1 +- rebuilt + +* Mon Feb 23 2004 Tim Waugh 2.1.25-5 +- Use ':' instead of '.' as separator for chown. + +* Fri Feb 13 2004 Elliot Lee +- rebuilt + +* Tue Feb 10 2004 Nalin Dahyabhai 2.1.25-4 +- remove 'reload' from the init script -- it never worked as intended (#115310) + +* Wed Feb 4 2004 Nalin Dahyabhai 2.1.25-3 +- commit that last fix correctly this time + +* Tue Feb 3 2004 Nalin Dahyabhai 2.1.25-2 +- fix incorrect use of find when attempting to detect a common permissions + error in the init script (#114866) + +* Fri Jan 16 2004 Nalin Dahyabhai +- add bug fix patch for DB 4.2.52 + +* Thu Jan 8 2004 Nalin Dahyabhai 2.1.25-1 +- change logging facility used from daemon to local4 (#112730, reversing #11047) + BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES. + +* Wed Jan 7 2004 Nalin Dahyabhai +- incorporate fix for logic quasi-bug in slapd's SASL auxprop code (Dave Jones) + +* Thu Dec 18 2003 Nalin Dahyabhai +- update to 2.1.25, now marked STABLE + +* Thu Dec 11 2003 Jeff Johnson 2.1.22-9 +- update to db-4.2.52. + +* Thu Oct 23 2003 Nalin Dahyabhai 2.1.22-8 +- add another section to the ABI note for the TLS libdb so that it's marked as + not needing an executable stack (from Arjan Van de Ven) + +* Thu Oct 16 2003 Nalin Dahyabhai 2.1.22-7 +- force bundled libdb to not use O_DIRECT by making it forget that we have it + +* Wed Oct 15 2003 Nalin Dahyabhai +- build bundled libdb for slapd dynamically to make the package smaller, + among other things +- on tls-capable arches, build libdb both with and without shared posix + mutexes, otherwise just without +- disable posix mutexes unconditionally for db 4.0, which shouldn't need + them for the migration cases where it's used +- update to MigrationTools 45 + +* Thu Sep 25 2003 Jeff Johnson 2.1.22-6.1 +- upgrade db-4.1.25 to db-4.2.42. + +* Fri Sep 12 2003 Nalin Dahyabhai 2.1.22-6 +- drop rfc822-MailMember.schema, merged into upstream misc.schema at some point + +* Wed Aug 27 2003 Nalin Dahyabhai +- actually require newer libtool, as was intended back in 2.1.22-0, noted as + missed by Jim Richardson + +* Fri Jul 25 2003 Nalin Dahyabhai 2.1.22-5 +- enable rlookups, they don't cost anything unless also enabled in slapd's + configuration file + +* Tue Jul 22 2003 Nalin Dahyabhai 2.1.22-4 +- rebuild + +* Thu Jul 17 2003 Nalin Dahyabhai 2.1.22-3 +- rebuild + +* Wed Jul 16 2003 Nalin Dahyabhai 2.1.22-2 +- rebuild + +* Tue Jul 15 2003 Nalin Dahyabhai 2.1.22-1 +- build + +* Mon Jul 14 2003 Nalin Dahyabhai 2.1.22-0 +- 2.1.22 now badged stable +- be more aggressive in what we index by default +- use/require libtool 1.5 + +* Mon Jun 30 2003 Nalin Dahyabhai +- update to 2.1.22 + +* Wed Jun 04 2003 Elliot Lee +- rebuilt + +* Tue Jun 3 2003 Nalin Dahyabhai 2.1.21-1 +- update to 2.1.21 +- enable ldap, meta, monitor, null, rewrite in slapd + +* Mon May 19 2003 Nalin Dahyabhai 2.1.20-1 +- update to 2.1.20 + +* Thu May 8 2003 Nalin Dahyabhai 2.1.19-1 +- update to 2.1.19 + +* Mon May 5 2003 Nalin Dahyabhai 2.1.17-1 +- switch to db with crypto + +* Fri May 2 2003 Nalin Dahyabhai +- install the db utils for the bundled libdb as %%{_sbindir}/slapd_db_* +- install slapcat/slapadd from 2.0.x for migration purposes + +* Wed Apr 30 2003 Nalin Dahyabhai +- update to 2.1.17 +- disable the shell backend, not expected to work well with threads +- drop the kerberosSecurityObject schema, the krbName attribute it + contains is only used if slapd is built with v2 kbind support + +* Mon Feb 10 2003 Nalin Dahyabhai 2.0.27-8 +- back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups +- tweak SuSE patch to fix a few copy-paste errors and a NULL dereference + +* Wed Jan 22 2003 Tim Powers +- rebuilt + +* Tue Jan 7 2003 Nalin Dahyabhai 2.0.27-6 +- rebuild + +* Mon Dec 16 2002 Nalin Dahyabhai 2.0.27-5 +- rebuild + +* Fri Dec 13 2002 Nalin Dahyabhai 2.0.27-4 +- check for setgid as well + +* Thu Dec 12 2002 Nalin Dahyabhai 2.0.27-3 +- rebuild + +* Thu Dec 12 2002 Nalin Dahyabhai +- incorporate fixes from SuSE's security audit, except for fixes to ITS 1963, + 1936, 2007, 2009, which were included in 2.0.26. +- add two more patches for db 4.1.24 from sleepycat's updates page +- use openssl pkgconfig data, if any is available + +* Mon Nov 11 2002 Nalin Dahyabhai 2.0.27-2 +- add patches for db 4.1.24 from sleepycat's updates page + +* Mon Nov 4 2002 Nalin Dahyabhai +- add a sample TLSCACertificateFile directive to the default slapd.conf + +* Tue Sep 24 2002 Nalin Dahyabhai 2.0.27-1 +- update to 2.0.27 + +* Fri Sep 20 2002 Nalin Dahyabhai 2.0.26-1 +- update to 2.0.26, db 4.1.24.NC + +* Fri Sep 13 2002 Nalin Dahyabhai 2.0.25-2 +- change LD_FLAGS to refer to /usr/kerberos/_libdir instead of + /usr/kerberos/lib, which might not be right on some arches + +* Mon Aug 26 2002 Nalin Dahyabhai 2.0.25-1 +- update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM + slapd databases until we move to 2.1.x) +- use %%{_smp_mflags} when running make +- update to MigrationTools 44 +- enable dynamic module support in slapd + +* Thu May 16 2002 Nalin Dahyabhai 2.0.23-5 +- rebuild in new environment + +* Wed Feb 20 2002 Nalin Dahyabhai 2.0.23-3 +- use the gdbm backend again + +* Mon Feb 18 2002 Nalin Dahyabhai 2.0.23-2 +- make slapd.conf read/write by root, read by ldap + +* Sun Feb 17 2002 Nalin Dahyabhai +- fix corner case in sendbuf fix +- 2.0.23 now marked "stable" + +* Tue Feb 12 2002 Nalin Dahyabhai 2.0.23-1 +- update to 2.0.23 + +* Fri Feb 8 2002 Nalin Dahyabhai 2.0.22-2 +- switch to an internalized Berkeley DB as the ldbm back-end (NOTE: this breaks + access to existing on-disk directory data) +- add slapcat/slapadd with gdbm for migration purposes +- remove Kerberos dependency in client libs (the direct Kerberos dependency + is used by the server for checking {kerberos} passwords) + +* Fri Feb 1 2002 Nalin Dahyabhai 2.0.22-1 +- update to 2.0.22 + +* Sat Jan 26 2002 Florian La Roche 2.0.21-5 +- prereq chkconfig for server subpackage + +* Fri Jan 25 2002 Nalin Dahyabhai 2.0.21-4 +- update migration tools to version 40 + +* Wed Jan 23 2002 Nalin Dahyabhai 2.0.21-3 +- free ride through the build system + +* Wed Jan 16 2002 Nalin Dahyabhai 2.0.21-2 +- update to 2.0.21, now earmarked as STABLE + +* Wed Jan 16 2002 Nalin Dahyabhai 2.0.20-2 +- temporarily disable optimizations for ia64 arches +- specify pthreads at configure-time instead of letting configure guess + +* Mon Jan 14 2002 Nalin Dahyabhai +- and one for Raw Hide + +* Mon Jan 14 2002 Nalin Dahyabhai 2.0.20-0.7 +- build for RHL 7/7.1 + +* Mon Jan 14 2002 Nalin Dahyabhai 2.0.20-1 +- update to 2.0.20 (security errata) + +* Thu Dec 20 2001 Nalin Dahyabhai 2.0.19-1 +- update to 2.0.19 + +* Tue Nov 6 2001 Nalin Dahyabhai 2.0.18-2 +- fix the commented-out replication example in slapd.conf + +* Fri Oct 26 2001 Nalin Dahyabhai 2.0.18-1 +- update to 2.0.18 + +* Mon Oct 15 2001 Nalin Dahyabhai 2.0.17-1 +- update to 2.0.17 + +* Wed Oct 10 2001 Nalin Dahyabhai +- disable kbind support (deprecated, and I suspect unused) +- configure with --with-kerberos=k5only instead of --with-kerberos=k5 +- build slapd with threads + +* Thu Sep 27 2001 Nalin Dahyabhai 2.0.15-2 +- rebuild, 2.0.15 is now designated stable + +* Fri Sep 21 2001 Nalin Dahyabhai 2.0.15-1 +- update to 2.0.15 + +* Mon Sep 10 2001 Nalin Dahyabhai 2.0.14-1 +- update to 2.0.14 + +* Fri Aug 31 2001 Nalin Dahyabhai 2.0.12-1 +- update to 2.0.12 to pull in fixes for setting of default TLS options, among + other things +- update to migration tools 39 +- drop tls patch, which was fixed better in this release + +* Tue Aug 21 2001 Nalin Dahyabhai 2.0.11-13 +- install saucer correctly + +* Thu Aug 16 2001 Nalin Dahyabhai +- try to fix ldap_set_options not being able to set global options related + to TLS correctly + +* Thu Aug 9 2001 Nalin Dahyabhai +- don't attempt to create a cert at install-time, it's usually going + to get the wrong CN (#51352) + +* Mon Aug 6 2001 Nalin Dahyabhai +- add a build-time requirement on pam-devel +- add a build-time requirement on a sufficiently-new libtool to link + shared libraries to other shared libraries (which is needed in order + for prelinking to work) + +* Fri Aug 3 2001 Nalin Dahyabhai +- require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC + compliance) by name (follows from #43079, which split cyrus-sasl's + cram-md5 and digest-md5 modules out into cyrus-sasl-md5) + +* Fri Jul 20 2001 Nalin Dahyabhai +- enable passwd back-end (noted by Alan Sparks and Sergio Kessler) + +* Wed Jul 18 2001 Nalin Dahyabhai +- start to prep for errata release + +* Fri Jul 6 2001 Nalin Dahyabhai +- link libldap with liblber + +* Wed Jul 4 2001 Than Ngo 2.0.11-6 +- add symlink liblber.so libldap.so and libldap_r.so in /usr/lib + +* Tue Jul 3 2001 Nalin Dahyabhai +- move shared libraries to /lib +- redo init script for better internationalization (#26154) +- don't use ldaprc files in the current directory (#38402) (patch from + hps@intermeta.de) +- add BuildPrereq on tcp wrappers since we configure with + --enable-wrappers (#43707) +- don't overflow debug buffer in mail500 (#41751) +- don't call krb5_free_creds instead of krb5_free_cred_contents any + more (#43159) + +* Mon Jul 2 2001 Nalin Dahyabhai +- make config files noreplace (#42831) + +* Tue Jun 26 2001 Nalin Dahyabhai +- actually change the default config to use the dummy cert +- update to MigrationTools 38 + +* Mon Jun 25 2001 Nalin Dahyabhai +- build dummy certificate in %%post, use it in default config +- configure-time shenanigans to help a confused configure script + +* Wed Jun 20 2001 Nalin Dahyabhai +- tweak migrate_automount and friends so that they can be run from anywhere + +* Thu May 24 2001 Nalin Dahyabhai +- update to 2.0.11 + +* Wed May 23 2001 Nalin Dahyabhai +- update to 2.0.10 + +* Mon May 21 2001 Nalin Dahyabhai +- update to 2.0.9 + +* Tue May 15 2001 Nalin Dahyabhai +- update to 2.0.8 +- drop patch which came from upstream + +* Fri Mar 2 2001 Nalin Dahyabhai +- rebuild in new environment + +* Thu Feb 8 2001 Nalin Dahyabhai +- back out pidfile patches, which interact weirdly with Linux threads +- mark non-standard schema as such by moving them to a different directory + +* Mon Feb 5 2001 Nalin Dahyabhai +- update to MigrationTools 36, adds netgroup support + +* Mon Jan 29 2001 Nalin Dahyabhai +- fix thinko in that last patch + +* Thu Jan 25 2001 Nalin Dahyabhai +- try to work around some buffering problems + +* Tue Jan 23 2001 Nalin Dahyabhai +- gettextize the init script + +* Thu Jan 18 2001 Nalin Dahyabhai +- gettextize the init script + +* Fri Jan 12 2001 Nalin Dahyabhai +- move the RFCs to the base package (#21701) +- update to MigrationTools 34 + +* Wed Jan 10 2001 Nalin Dahyabhai +- add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in + a /etc/sysconfig/ldap file (#23549) + +* Fri Dec 29 2000 Nalin Dahyabhai +- change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13, + per mail from the ldap-nis mailing list + +* Tue Dec 5 2000 Nalin Dahyabhai +- force -fPIC so that shared libraries don't fall over + +* Mon Dec 4 2000 Nalin Dahyabhai +- add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs + (OpenLDAP ITS #889) +- add "-h ldaps:///" to server init when TLS is enabled, in order to support + ldaps in addition to the regular STARTTLS (suggested by Del) + +* Mon Nov 27 2000 Nalin Dahyabhai +- correct mismatched-dn-cn bug in migrate_automount.pl + +* Mon Nov 20 2000 Nalin Dahyabhai +- update to the correct OIDs for automount and automountInformation +- add notes on upgrading + +* Tue Nov 7 2000 Nalin Dahyabhai +- update to 2.0.7 +- drop chdir patch (went mainstream) + +* Thu Nov 2 2000 Nalin Dahyabhai +- change automount object classes from auxiliary to structural + +* Tue Oct 31 2000 Nalin Dahyabhai +- update to Migration Tools 27 +- change the sense of the last simple patch + +* Wed Oct 25 2000 Nalin Dahyabhai +- reorganize the patch list to separate MigrationTools and OpenLDAP patches +- switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema +- configure slapd to run as the non-root user "ldap" (#19370) +- chdir() before chroot() (we don't use chroot, though) (#19369) +- disable saving of the pid file because the parent thread which saves it and + the child thread which listens have different pids + +* Wed Oct 11 2000 Nalin Dahyabhai +- add missing required attributes to conversion scripts to comply with schema +- add schema for mail aliases, autofs, and kerberosSecurityObject rooted in + our own OID tree to define attributes and classes migration scripts expect +- tweak automounter migration script + +* Mon Oct 9 2000 Nalin Dahyabhai +- try adding the suffix first when doing online migrations +- force ldapadd to use simple authentication in migration scripts +- add indexing of a few attributes to the default configuration +- add commented-out section on using TLS to default configuration + +* Thu Oct 5 2000 Nalin Dahyabhai +- update to 2.0.6 +- add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel +- take the -s flag off of slapadd invocations in migration tools +- add the cosine.schema to the default server config, needed by inetorgperson + +* Wed Oct 4 2000 Nalin Dahyabhai +- add the nis.schema and inetorgperson.schema to the default server config +- make ldapadd a hard link to ldapmodify because they're identical binaries + +* Fri Sep 22 2000 Nalin Dahyabhai +- update to 2.0.4 + +* Fri Sep 15 2000 Nalin Dahyabhai +- remove prereq on /etc/init.d (#17531) +- update to 2.0.3 +- add saucer to the included clients + +* Wed Sep 6 2000 Nalin Dahyabhai +- update to 2.0.1 + +* Fri Sep 1 2000 Nalin Dahyabhai +- update to 2.0.0 +- patch to build against MIT Kerberos 1.1 and later instead of 1.0.x + +* Tue Aug 22 2000 Nalin Dahyabhai +- remove that pesky default password +- change "Copyright:" to "License:" + +* Sun Aug 13 2000 Nalin Dahyabhai +- adjust permissions in files lists +- move libexecdir from %%{_prefix}/sbin to %%{_sbindir} + +* Fri Aug 11 2000 Nalin Dahyabhai +- add migrate_automount.pl to the migration scripts set + +* Tue Aug 8 2000 Nalin Dahyabhai +- build a semistatic slurpd with threads, everything else without +- disable reverse lookups, per email on OpenLDAP mailing lists +- make sure the execute bits are set on the shared libraries + +* Mon Jul 31 2000 Nalin Dahyabhai +- change logging facility used from local4 to daemon (#11047) + +* Thu Jul 27 2000 Nalin Dahyabhai +- split off clients and servers to shrink down the package and remove the + base package's dependency on Perl +- make certain that the binaries have sane permissions + +* Mon Jul 17 2000 Nalin Dahyabhai +- move the init script back + +* Thu Jul 13 2000 Nalin Dahyabhai +- tweak the init script to only source /etc/sysconfig/network if it's found + +* Wed Jul 12 2000 Prospector +- automatic rebuild + +* Mon Jul 10 2000 Nalin Dahyabhai +- switch to gdbm; I'm getting off the db merry-go-round +- tweak the init script some more +- add instdir to @INC in migration scripts + +* Thu Jul 6 2000 Nalin Dahyabhai +- tweak init script to return error codes properly +- change initscripts dependency to one on /etc/init.d + +* Tue Jul 4 2000 Nalin Dahyabhai +- prereq initscripts +- make migration scripts use mktemp + +* Tue Jun 27 2000 Nalin Dahyabhai +- do condrestart in post and stop in preun +- move init script to /etc/init.d + +* Fri Jun 16 2000 Nalin Dahyabhai +- update to 1.2.11 +- add condrestart logic to init script +- munge migration scripts so that you don't have to be + /usr/share/openldap/migration to run them +- add code to create pid files in /var/run + +* Mon Jun 5 2000 Nalin Dahyabhai +- FHS tweaks +- fix for compiling with libdb2 + +* Thu May 4 2000 Bill Nottingham +- minor tweak so it builds on ia64 + +* Wed May 3 2000 Nalin Dahyabhai +- more minimalistic fix for bug #11111 after consultation with OpenLDAP team +- backport replacement for the ldapuser patch + +* Tue May 2 2000 Nalin Dahyabhai +- fix segfaults from queries with commas in them in in.xfingerd (bug #11111) + +* Tue Apr 25 2000 Nalin Dahyabhai +- update to 1.2.10 +- add revamped version of patch from kos@bastard.net to allow execution as + any non-root user +- remove test suite from %%build because of weirdness in the build system + +* Wed Apr 12 2000 Nalin Dahyabhai +- move the defaults for databases and whatnot to /var/lib/ldap (bug #10714) +- fix some possible string-handling problems + +* Mon Feb 14 2000 Bill Nottingham +- start earlier, stop later. + +* Thu Feb 3 2000 Nalin Dahyabhai +- auto rebuild in new environment (release 4) + +* Tue Feb 1 2000 Nalin Dahyabhai +- add -D_REENTRANT to make threaded stuff more stable, even though it looks + like the sources define it, too +- mark *.ph files in migration tools as config files + +* Fri Jan 21 2000 Nalin Dahyabhai +- update to 1.2.9 + +* Mon Sep 13 1999 Bill Nottingham +- strip files + +* Sat Sep 11 1999 Bill Nottingham +- update to 1.2.7 +- fix some bugs from bugzilla (#4885, #4887, #4888, #4967) +- take include files out of base package + +* Fri Aug 27 1999 Jeff Johnson +- missing ;; in init script reload) (#4734). + +* Tue Aug 24 1999 Cristian Gafton +- move stuff from /usr/libexec to /usr/sbin +- relocate config dirs to /etc/openldap + +* Mon Aug 16 1999 Bill Nottingham +- initscript munging + +* Wed Aug 11 1999 Cristian Gafton +- add the migration tools to the package + +* Fri Aug 06 1999 Cristian Gafton +- upgrade to 1.2.6 +- add rc.d script +- split -devel package + +* Sun Feb 07 1999 Preston Brown +- upgrade to latest stable (1.1.4), it now uses configure macro. + +* Fri Jan 15 1999 Bill Nottingham +- build on arm, glibc2.1 + +* Wed Oct 28 1998 Preston Brown +- initial cut. +- patches for signal handling on the alpha