code:
diff -up ntp-4.2.6p2/html/authopt.html.htmldoc ntp-4.2.6p2/html/authopt.html
--- ntp-4.2.6p2/html/authopt.html.htmldoc	2010-04-18 10:05:39.000000000 +0200
+++ ntp-4.2.6p2/html/authopt.html	2010-07-12 16:31:43.000000000 +0200
@@ -208,11 +208,7 @@ UTC

-Client
-Server
-

-
-

+Client/Server
 NONE
 AUTH
 PC
@@ -368,7 +364,7 @@ UTC

 	are left unspecified, the default names are used as described below. Unless
 	the complete path and name of the file are specified, the location of a file
 	is relative to the keys directory specified in the <tt>keysdir</tt> configuration
-	command or default <tt>/usr/local/etc</tt>. Following are the options.

+	command or default <tt>/etc/ntp/crypto</tt>. Following are the options.

@@ -400,7 +396,7 @@ UTC

Specifies the complete path to the MD5 key file containing the keys and key IDs used by <tt>ntpd</tt>, <tt>ntpq</tt> and <tt>ntpdc</tt> when operating with symmetric key cryptography. This is the same operation as the <tt>-k </tt>command line option. Note that the directory path for Autokey media is specified by the <tt>keysdir</tt> command.

<tt>keysdir path</tt>K

-
This command specifies the default directory path for Autokey cryptographic keys, parameters and certificates. The default is <tt>/usr/local/etc/</tt>. Note that the path for the symmetric keys file is specified by the <tt>keys</tt> command.

+
This command specifies the default directory path for Autokey cryptographic keys, parameters and certificates. The default is <tt>/etc/ntp/crypto</tt>. Note that the path for the symmetric keys file is specified by the <tt>keys</tt> command.

<tt>requestkey keyid</tt>

Specifies the key ID to use with the
@@ -494,4 +490,4 @@ UTC

-
\ No newline at end of file
+
diff -up ntp-4.2.6p2/html/keygen.html.htmldoc ntp-4.2.6p2/html/keygen.html
--- ntp-4.2.6p2/html/keygen.html.htmldoc	2009-12-09 08:36:35.000000000 +0100
+++ ntp-4.2.6p2/html/keygen.html	2010-07-12 16:27:39.000000000 +0200
@@ -90,7 +90,7 @@

The <tt>pw</tt> option of the <tt>crypto</tt> configuration command specifies the read password for previously encrypted files. This must match the local password used by this program. If not specified, the host name is used. Thus, if files are generated by this program without password, they can be read back by <tt>ntpd</tt> without password, but only on the same host.

-
All files and links are usually installed   in the  directory <tt>/usr/local/etc</tt>,
+
All files and links are usually installed   in the  directory <tt>/etc/ntp/crypto</tt>,
 	which is normally in a shared filesystem in NFS-mounted networks and cannot
 	be changed by shared clients. The location of the keys directory can be changed
 	by the <tt>keysdir</tt> configuration command in such cases. Normally, encrypted
@@ -101,7 +101,7 @@

Running the Program

-
To test and gain experience with Autokey concepts, log in as root and change to the keys directory, usually <tt>/usr/local/etc</tt>. When run for the first time, or if all files with names beginning <tt>ntpkey</tt> have been removed, use the <tt>ntp-keygen </tt>command without arguments to generate a default RSA host key and matching RSA-MD5 certificate with expiration date one year hence. If run again, the program uses the existing keys and parameters and generates only a new certificate with new expiration date one year hence; however, the certificate is not generated if the <tt>-e</tt> or <tt>-q</tt> options are  present.

+
To test and gain experience with Autokey concepts, log in as root and change to the keys directory, usually <tt>/etc/ntp/crypto</tt>. When run for the first time, or if all files with names beginning <tt>ntpkey</tt> have been removed, use the <tt>ntp-keygen </tt>command without arguments to generate a default RSA host key and matching RSA-MD5 certificate with expiration date one year hence. If run again, the program uses the existing keys and parameters and generates only a new certificate with new expiration date one year hence; however, the certificate is not generated if the <tt>-e</tt> or <tt>-q</tt> options are  present.

Run the command on as many hosts as necessary. Designate one of them as the trusted host (TH) using <tt>ntp-keygen</tt> with the <tt>-T</tt> option and configure it to synchronize from reliable Internet servers. Then configure the other hosts to synchronize to the TH directly or indirectly. A certificate trail is created when Autokey asks the immediately ascendant host towards the TH to sign its certificate, which is then provided to the immediately descendant host on request. All group hosts should have acyclic certificate trails ending on the TH.

@@ -206,6 +206,7 @@

All cryptographically sound key generation schemes must have means to randomize the entropy seed used to initialize the internal pseudo-random number generator used by the OpenSSL library routines. If a site supports <tt>ssh</tt>, it is very likely that means to do this are already available. The entropy seed used by the OpenSSL library is contained in a file, usually called <tt>.rnd</tt>, which must be available when starting the <tt>ntp-keygen</tt> program or <tt>ntpd</tt> daemon.

The OpenSSL library looks for the file using the path specified by the <tt>RANDFILE</tt> environment variable in the user home directory, whether root or some other user. If the <tt>RANDFILE</tt> environment variable is not present, the library looks for the <tt>.rnd</tt> file in the user home directory. Since both the <tt>ntp-keygen</tt> program and <tt>ntpd</tt> daemon must run as root, the logical place to put this file is in <tt>/.rnd</tt> or <tt>/root/.rnd</tt>. If the file is not available or cannot be written, the program exits with a message to the system log.

+
On systems that provide /dev/urandom, the randomness device is used instead and the file specified by the <tt>randfile</tt> subcommand or the <tt>RANDFILE</tt> environment variable is ignored.

Cryptographic Data Files

@@ -237,4 +238,4 @@

-
\ No newline at end of file
+
diff -up ntp-4.2.6p2/html/ntp-wait.html.htmldoc ntp-4.2.6p2/html/ntp-wait.html
--- ntp-4.2.6p2/html/ntp-wait.html.htmldoc	2010-07-12 16:27:39.000000000 +0200
+++ ntp-4.2.6p2/html/ntp-wait.html	2010-07-12 16:27:39.000000000 +0200
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+
+		<meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
+		<meta name="generator" content="HTML Tidy, see www.w3.org">
+		<title>ntp-wait - waits until ntpd is in synchronized state</title>
+		<link href="scripts/style.css" type="text/css" rel="stylesheet">
+
+
+
<tt>ntp-wait</tt> - waits until ntpd is in synchronized state

+

+
Synopsis

+
<tt>ntp-wait [ -v ] [ -n tries ] [ -s seconds ]</tt>

+
Description

+
The <tt>ntp-wait</tt> program blocks until ntpd is in synchronized state.
+		This can be useful at boot time, to delay the boot sequence
+		until after "ntpd -g" has set the time.
+
Command Line Options

+

+
<tt>-n tries</tt>
+
Number of tries before giving up. The default is 1000.
+
<tt>-s seconds</tt>
+
Seconds to sleep between tries. The default is 6 seconds.
+
<tt>-v</tt>
+
Be verbose.
+

+
+
+
+
diff -up ntp-4.2.6p2/html/ntpd.html.htmldoc ntp-4.2.6p2/html/ntpd.html
--- ntp-4.2.6p2/html/ntpd.html.htmldoc	2009-12-09 08:36:35.000000000 +0100
+++ ntp-4.2.6p2/html/ntpd.html	2010-07-12 16:27:39.000000000 +0200
@@ -32,7 +32,7 @@

Synopsis

-		<tt>ntpd [ -46aAbdDgLmnNqx ] [ -c conffile ] [ -f driftfile ] [ -i jaildir ] [ -k keyfile ] [ -l logfile ] [ -p pidfile ] [ -P priority ] [ -r broadcastdelay ] [ -s statsdir ] [ -t key ] [ -u user[:group] ] [ -U interface_update_interval ] [ -v variable ] [ -V variable ]</tt>
+		<tt>ntpd [ -46aAbdDgLnNqx ] [ -c conffile ] [ -f driftfile ] [ -i jaildir ] [ -I iface ] [ -k keyfile ] [ -l logfile ] [ -p pidfile ] [ -P priority ] [ -r broadcastdelay ] [ -s statsdir ] [ -t key ] [ -u user[:group] ] [ -U interface_update_interval ] [ -v variable ] [ -V variable ]</tt>

Description

The <tt>ntpd</tt> program is an operating system daemon that synchronises the system clock with remote NTP time servers or local reference clocks. It is a complete implementation of the Network Time Protocol (NTP) version 4, but also retains compatibility with version 3, as defined by RFC-1305, and version 1 and 2, as defined by RFC-1059 and RFC-1119, respectively. The program can operate in any of several modes, as described on the Association Management page, and with both symmetric key and public key cryptography, as described on the Authentication Options page.

The <tt>ntpd</tt> program ordinarily requires a configuration file as desccribe on the Configuration Commands and Options collection above. However a client can discover remote servers and configure them automatically. This makes it possible to deploy a fleet of workstations without specifying configuration details specific to the local environment. Further details are on the Automatic Server Discovery page.

@@ -44,7 +44,7 @@

The issues should be carefully considered before using these options. The maximum slew rate possible is limited to 500 parts-per-million (PPM) by the Unix kernel. As a result, the clock can take 2000 s for each second the clock is outside the acceptable range. During this interval the clock will not be consistent with any other network clock and the system cannot be used for distributed applications that require correctly synchronized network time.

The frequency file, usually called <tt>ntp.drift</tt>, contains the latest estimate  of clock frequency. If this file does not exist when <tt>ntpd</tt> is started, it enters a special mode designed to measure the particular frequency directly. The measurement takes 15 minutes, after which the frequency is set and <tt>ntpd</tt> resumes normal mode where the time and frequency are continuously adjusted. The frequency file is updated at intervals of an hour or more depending on the measured clock stability.

Operating Modes

-
The <tt>ntpd</tt> program normally operates continuously while adjusting the time and frequency, but in some cases it may not be practical to run it continuously. With the <tt>-q</tt> option <tt>ntpd</tt> operates as in continous mode, but exits just after setting the clock for the first time. Most applications will probably want to specify the <tt>iburst</tt> option with the <tt>server</tt> command. With this option a volley of messages is exchanged to groom the data and set the clock in about 10 s. If nothing is heard after a few minutes, the daemon times out and exits.

+
The <tt>ntpd</tt> program normally operates continuously while adjusting the time and frequency, but in some cases it may not be practical to run it continuously. With the <tt>-q</tt> option <tt>ntpd</tt> operates as in continous mode, but exits just after setting the clock for the first time with the configured servers. Most applications will probably want to specify the <tt>iburst</tt> option with the <tt>server</tt> command. With this option a volley of messages is exchanged to groom the data and set the clock in about 10 s. If nothing is heard after a few minutes, the daemon times out and exits.

Poll Interval Control

NTP uses an intricate heuristic algorithm to automatically control the poll interval for maximum accuracy consistent with minimum network overhead. The algorithm measures the incidental offset and jitter to determine the best poll interval. When <tt>ntpd</tt> starts, the interval is the default minimum 64 s. Under normal conditions when the clock discipline has stabilized, the interval increases in steps to the default maximum 1024 s. In addition, should a server become unreachable after some time, the interval increases in steps to the maximum in order to reduce network overhead.

The default poll interval range is suitable for most conditions, but can be changed using options on the Server Options and Miscellaneous Options pages. However, when using maximum intervals much larger than the default, the residual clock frequency error must be small enough for the discipline loop to capture and correct. The capture range is 500 PPM with a 64-s interval decreasing by a factor of two for each interval doubling. At a 36-hr interval, for example, the capture range is only 0.24 PPM.

@@ -88,8 +88,13 @@

In contexts where a host name is expected, a <tt>-4</tt> qualifier preceding the host name forces DNS resolution to the IPv4 namespace, while a <tt>-6</tt> qualifier forces DNS resolution to the IPv6 namespace.

Various internal <tt>ntpd</tt> variables can be displayed and configuration options altered while the <tt>ntpd</tt> is running using the <tt>ntpq</tt> and <tt>ntpdc</tt> utility programs.

When <tt>ntpd</tt> starts it looks at the value of <tt>umask</tt>, and if zero <tt>ntpd</tt> will set the <tt>umask</tt> to <tt>022</tt>.

+
Unless the <tt>-n</tt>, <tt>-d</tt> or <tt>-D</tt> option is used, <tt>ntpd</tt> changes the current working directory to the root directory, so any options or commands specifying paths need to use an absolute path or a path relative to the root.

Command Line Options

+
<tt>-4</tt>
+
Force DNS resolution of host names to the IPv4 namespace.
+
<tt>-6</tt>
+
Force DNS resolution of host names to the IPv6 namespace.

<tt>-a</tt>

Require cryptographic authentication for broadcast client, multicast client and symmetric passive associations. This is the same operation as the <tt>enable auth</tt> command and is the default.

<tt>-A</tt>

@@ -103,7 +108,7 @@

<tt>-D level</tt>

Specify debugging level directly.

<tt>-f driftfile</tt>

-
Specify the name and path of the frequency file, default <tt>/etc/ntp.drift</tt>. This is the same operation as the <tt>driftfile driftfile</tt> command.

+
Specify the name and path of the frequency file. This is the same operation as the <tt>driftfile driftfile</tt> command.

<tt>-g</tt>

Normally, <tt>ntpd</tt> exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, <tt>ntpd</tt> will exit with a message to the system log. This option can be used with the <tt>-q</tt> and <tt>-x</tt> options. See the <tt>tinker</tt> command for other options.

<tt>-i jaildir</tt>

@@ -111,7 +116,7 @@

<tt>-I [address | interface name]</tt>

Open the network address given, or all the addresses associated with the given interface name. This option may appear multiple times. This option also implies not opening other addresses, except wildcard and localhost. This option is deprecated. Please consider using the configuration file interface command, which is more versatile.

<tt>-k keyfile</tt>

-
Specify the name and path of the symmetric key file, default <tt>/etc/ntp.keys</tt>. This is the same operation as the <tt>keys keyfile</tt>  command.

+
Specify the name and path of the symmetric key file. This is the same operation as the <tt>keys keyfile</tt>  command.

<tt>-l logfile</tt>

Specify the name and path of the log file. The default is the system log file. This is the same operation as the <tt>logfile logfile</tt> command.

<tt>-L</tt>

@@ -209,17 +214,20 @@

 				statistics path
-				<tt>/var/NTP</tt>
+				<tt>/var/log/ntpstats/</tt>
 				<tt>-s</tt>
 				<tt>statsdir</tt>

 				keys path
-				<tt>/usr/local/etc</tt>
-				<tt>-k</tt>
+				<tt>/etc/ntp/crypto</tt>
+				<tt>none</tt>
 				<tt>keysdir</tt>

+
Exit Codes

+
A non-zero exit code indicates an error. Any error messages are logged to the system log by default.

+
The exit code is 0 only when <tt>ntpd</tt> is terminated by a signal, or when the <tt>-q</tt> option is used and <tt>ntpd</tt> successfully sets the system clock.

diff -up ntp-4.2.6p2/html/ntpdate.html.htmldoc ntp-4.2.6p2/html/ntpdate.html
--- ntp-4.2.6p2/html/ntpdate.html.htmldoc	2010-07-12 16:27:39.000000000 +0200
+++ ntp-4.2.6p2/html/ntpdate.html	2010-07-12 16:27:39.000000000 +0200
@@ -18,9 +18,9 @@

Disclaimer: The functionality of this program is now available in the <tt>ntpd</tt> program. See the <tt>-q</tt> command line option in the <tt>ntpd</tt> - Network Time Protocol (NTP) daemon page. After a suitable period of mourning, the <tt>ntpdate</tt> program is to be retired from this distribution

Synopsis

-		<tt>ntpdate [ -bBdoqsuv ] [ -a key ] [ -e authdelay ] [ -k keyfile ] [ -o version ] [ -p samples ] [ -t timeout ] [ -U user_name ] server [ ... ]</tt>
+		<tt>ntpdate [ -46bBdqsuv ] [ -a key ] [ -e authdelay ] [ -k keyfile ] [ -o version ] [ -p samples ] [ -t timeout ] [ -U user_name ] server [ ... ]</tt>

Description

-		<tt>ntpdate</tt> sets the local date and time by polling the Network Time Protocol (NTP) server(s) given as the server arguments to determine the correct time. It must be run as root on the local host. A number of samples are obtained from each of the servers specified and a subset of the NTP clock filter and selection algorithms are applied to select the best of these. Note that the accuracy and reliability of <tt>ntpdate</tt> depends on the number of servers, the number of polls each time it is run and the interval between runs.
+
<tt>ntpdate</tt> sets the local date and time by polling the Network Time Protocol (NTP) server(s) given as the server arguments to determine the correct time. It must be run as root on the local host. A number of samples are obtained from each of the servers specified and a subset of the NTP clock filter and selection algorithms are applied to select the best of these. Note that the accuracy and reliability of <tt>ntpdate</tt> depends on the number of servers, the number of polls each time it is run and the interval between runs.

<tt>ntpdate</tt> can be run manually as necessary to set the host clock, or it can be run from the host startup script to set the clock at boot time. This is useful in some cases to set the clock initially before starting the NTP daemon <tt>ntpd</tt>. It is also possible to run <tt>ntpdate</tt> from a <tt>cron</tt> script. However, it is important to note that <tt>ntpdate</tt> with contrived <tt>cron</tt> scripts is no substitute for the NTP daemon, which uses sophisticated algorithms to maximize accuracy and reliability while minimizing resource use. Finally, since <tt>ntpdate</tt> does not discipline the host clock frequency as does <tt>ntpd</tt>, the accuracy using <tt>ntpdate</tt> is limited.

Time adjustments are made by <tt>ntpdate</tt> in one of two ways. If <tt>ntpdate</tt> determines the clock is in error more than 0.5 second it will simply step the time by calling the system <tt>settimeofday()</tt> routine. If the error is less than 0.5 seconds, it will slew the time by calling the system <tt>adjtime()</tt> routine. The latter technique is less disruptive and more accurate when the error is small, and works quite well when <tt>ntpdate</tt> is run by <tt>cron</tt> every hour or two.

<tt>ntpdate</tt> will decline to set the date if an NTP server daemon (e.g., <tt>ntpd</tt>) is running on the same host. When running <tt>ntpdate</tt> on a regular basis from <tt>cron</tt> as an alternative to running a daemon, doing so once every hour or two will result in precise enough timekeeping to avoid stepping the clock.

@@ -33,9 +33,9 @@

<tt>-6</tt>

Force DNS resolution of following host names on the command line to the IPv6 namespace.

<tt>-a key</tt>
-
Enable the authentication function and specify the key identifier to be used for authentication as the argument key<tt>ntpdate</tt>. The keys and key identifiers must match in both the client and server key files. The default is to disable the authentication function.
+
Enable the authentication function and specify the key identifier to be used for authentication as the argument key. The keys and key identifiers must match in both the client and server key files. The default is to disable the authentication function.

<tt>-B</tt>
-
Force the time to always be slewed using the adjtime() system call, even if the measured offset is greater than +-128 ms. The default is to step the time using settimeofday() if the offset is greater than +-128 ms. Note that, if the offset is much greater than +-128 ms in this case, that it can take a long time (hours) to slew the clock to the correct value. During this time. the host should not be used to synchronize clients.
+
Force the time to always be slewed using the adjtime() system call, even if the measured offset is greater than +-500 ms. The default is to step the time using settimeofday() if the offset is greater than +-500 ms. Note that, if the offset is much greater than +-500 ms in this case, that it can take a long time (hours) to slew the clock to the correct value. During this time. the host should not be used to synchronize clients.

<tt>-b</tt>

Force the time to be stepped using the settimeofday() system call, rather than slewed (default) using the adjtime() system call. This option should be used when called from a startup file at boot time.

<tt>-d</tt>
@@ -43,9 +43,9 @@

<tt>-e authdelay</tt>

Specify the processing delay to perform an authentication function as the value authdelay, in seconds and fraction (see <tt>ntpd</tt> for details). This number is usually small enough to be negligible for most purposes, though specifying a value may improve timekeeping on very slow CPU's.

<tt>-k keyfile</tt>
-
Specify the path for the authentication key file as the string keyfile. The default is <tt>/etc/ntp.keys</tt>. This file should be in the format described in <tt>ntpd</tt>.
+
Specify the path for the authentication key file as the string keyfile. The default is <tt>/etc/ntp/keys</tt>. This file should be in the format described in <tt>ntpd</tt>.

<tt>-o version</tt>
-
Specify the NTP version for outgoing packets as the integer version, which can be 1 or 2. The default is 3. This allows <tt>ntpdate</tt> to be used with older NTP versions.
+
Specify the NTP version for outgoing packets as the integer version, which can be 1 or 2. The default is 4. This allows <tt>ntpdate</tt> to be used with older NTP versions.

<tt>-p samples</tt>

Specify the number of samples to be acquired from each server as the integer samples, with values from 1 to 8 inclusive. The default is 4.

<tt>-q</tt>
@@ -55,7 +55,7 @@

<tt>-t timeout</tt>

Specify the maximum time waiting for a server response as the value timeout, in seconds and fraction. The value is is rounded to a multiple of 0.2 seconds. The default is 1 second, a value suitable for polling across a LAN.

<tt>-u</tt>
-
Direct <tt>ntpdate</tt> to use an unprivileged port or outgoing packets. This is most useful when behind a firewall that blocks incoming traffic to privileged ports, and you want to synchronise with hosts beyond the firewall. Note that the <tt>-d</tt> option always uses unprivileged ports.
+
Direct <tt>ntpdate</tt> to use an unprivileged port for outgoing packets. This is most useful when behind a firewall that blocks incoming traffic to privileged ports, and you want to synchronize with hosts beyond the firewall. Note that the <tt>-d</tt> option always uses unprivileged ports.

<tt>-v</tt>

Be verbose. This option will cause <tt>ntpdate</tt>'s version identification string to be logged.

@@ -67,7 +67,7 @@

Diagnostics

 		<tt>ntpdate</tt>'s exit status is zero if it finds a server and updates the clock, and nonzero otherwise.

Files

-		<tt>/etc/ntp.keys</tt> - encryption keys used by <tt>ntpdate</tt>.
+		<tt>/etc/ntp/keys</tt> - encryption keys used by <tt>ntpdate</tt>.

Bugs

 		The slew adjustment is actually 50% larger than the measured offset, since this (it is argued) will tend to keep a badly drifting clock more accurate. This is probably not a good idea and may cause a troubling hunt for some values of the kernel variables <tt>tick</tt> and <tt>tickadj</tt>.

diff -up ntp-4.2.6p2/html/ntpdc.html.htmldoc ntp-4.2.6p2/html/ntpdc.html
--- ntp-4.2.6p2/html/ntpdc.html.htmldoc	2009-12-09 08:36:35.000000000 +0100
+++ ntp-4.2.6p2/html/ntpdc.html	2010-07-12 16:27:39.000000000 +0200
@@ -19,9 +19,9 @@

Synopsis

-		<tt>ntpdc [ -ilnps ] [ -c command ] [ host ] [ ... ]</tt>
+		<tt>ntpdc [ -46dilnps ] [ -c command ] [ host ] [ ... ]</tt>

Description

-		<tt>ntpdc</tt> is used to query the <tt>ntpd</tt> daemon about its current state and to request changes in that state. The program may be run either in interactive mode or controlled using command line arguments. Extensive state and statistics information is available through the <tt>ntpdc</tt> interface. In addition, nearly all the configuration options which can be specified at startup using ntpd's configuration file may also be specified at run time using <tt>ntpdc</tt>.
+
<tt>ntpdc</tt> is used to query the <tt>ntpd</tt> daemon about its current state and to request changes in that state. The program may be run either in interactive mode or controlled using command line arguments. Extensive state and statistics information is available through the <tt>ntpdc</tt> interface. In addition, nearly all the configuration options which can be specified at startup using ntpd's configuration file may also be specified at run time using <tt>ntpdc</tt>.

If one or more request options are included on the command line when <tt>ntpdc</tt> is executed, each of the requests will be sent to the NTP servers running on each of the hosts given as command line arguments, or on localhost by default. If no request options are given, <tt>ntpdc</tt> will attempt to read commands from the standard input and execute these on the NTP server running on the first host given on the command line, again defaulting to localhost when no other host is specified. <tt>ntpdc</tt> will prompt for commands if the standard input is a terminal device.

<tt>ntpdc</tt> uses NTP mode 7 packets to communicate with the NTP server, and hence can be used to query any compatible server on the network which permits it. Note that since NTP is a UDP protocol this communication will be somewhat unreliable, especially over large distances in terms of network topology. <tt>ntpdc</tt> makes no attempt to retransmit requests, and will time requests out if the remote host is not heard from within a suitable timeout time.

The operation of <tt>ntpdc</tt> are specific to the particular implementation of the <tt>ntpd</tt> daemon and can be expected to work only with this and maybe some previous versions of the daemon. Requests from a remote <tt>ntpdc</tt> program which affect the state of the local server must be authenticated, which requires both the remote program and local server share a common key and key identifier.

@@ -35,6 +35,8 @@

Force DNS resolution of following host names on the command line to the IPv6 namespace.

<tt>-c command</tt>

The following argument is interpreted as an interactive format command and is added to the list of commands to be executed on the specified host(s). Multiple -c options may be given.
+
<tt>-d</tt>
+
Turn on debugging mode.

<tt>-i</tt>

Force <tt>ntpdc</tt> to operate in interactive mode. Prompts will be written to the standard output and commands read from the standard input.

<tt>-l</tt>
@@ -134,11 +136,11 @@

<tt>addpeer peer_address [
 		keyid ] [ version ] [
 		<tt>minpoll# | prefer | iburst  | burst | minpoll
-		N | <tt>maxpoll</tt> N [...] ]</tt>
+		N | <tt>maxpoll</tt> N [...] </tt> ]</tt>

<tt>addpeer peer_address [
 		<tt>prefer | iburst | burst | minpoll
 		N | <tt>maxpoll</tt> N | <tt>keyid</tt>
-			N | <tt>version</tt> N [...] ]</tt>
+			N | <tt>version</tt> N [...] </tt> ]</tt>

Add a configured peer association at the
 			given address and operating in symmetric
 			active mode. Note that an existing association
@@ -162,16 +164,16 @@
 			<tt>peer</tt> configuration file command of
 			ntpd.  See the Server Options page for further information.
 			Each flag (or its absence) replaces the
-			previous setting. The <tt>prefer</tt> keyword indicates a preferred peer (and thus will be used primarily for clock synchronisation if possible). The preferred peer also determines the validity of the PPS signal - if the preferred peer is suitable for synchronisation so is the PPS signal.
+			previous setting. The <tt>prefer</tt> keyword indicates a preferred peer (and thus will be used primarily for clock synchronization if possible). The preferred peer also determines the validity of the PPS signal - if the preferred peer is suitable for synchronization so is the PPS signal.
 			The <tt>dynamic</tt> keyword allows association configuration even when no suitable network interface is found at configuration time. The dynamic interface update mechanism may complete the configuration when new interfaces appear (e.g. WLAN/PPP interfaces) at a later time and thus render the association operable.

<tt>addserver peer_address [
 		keyid ] [ version ] [
 		<tt>minpoll# | prefer | iburst  | burst | minpoll
-		N | <tt>maxpoll</tt> N [...] ]</tt>
+		N | <tt>maxpoll</tt> N [...] </tt> ]</tt>

<tt>addserver peer_address [
 		<tt>prefer | iburst | burst | minpoll
 		N | <tt>maxpoll</tt> N | <tt>keyid</tt>
-			N | <tt>version</tt> N [...] ]</tt>
+			N | <tt>version</tt> N [...] </tt> ]</tt>

Identical to the addpeer command, except that the operating mode is client.

<tt>broadcast peer_address [
 			keyid ] [ version ] [ prefer ]</tt>
@@ -200,9 +202,9 @@

Returns information concerning the authentication module, including known keys and counts of encryptions and decryptions which have been done.

<tt>traps</tt>

Display the traps set in the server. See the source listing for further information.
-
<tt>addtrap [ address [ port ] [ interface ]</tt>
+
<tt>addtrap [ address ] [ port ] [ interface ]</tt>

Set a trap for asynchronous messages. See the source listing for further information.
-
<tt>clrtrap [ address [ port ] [ interface]</tt>
+
<tt>clrtrap [ address ] [ port ] [ interface]</tt>

Clear a trap for asynchronous messages. See the source listing for further information.

<tt>reset</tt>

Clear the statistics counters in various modules of the server. See the source listing for further information.
diff -up ntp-4.2.6p2/html/ntpq.html.htmldoc ntp-4.2.6p2/html/ntpq.html
--- ntp-4.2.6p2/html/ntpq.html.htmldoc	2010-02-09 11:01:26.000000000 +0100
+++ ntp-4.2.6p2/html/ntpq.html	2010-07-12 16:27:39.000000000 +0200
@@ -21,7 +21,7 @@

Synopsis

-		<tt>ntpq [-inp] [-c command] [host] [...]</tt>
+		<tt>ntpq [-46dinp] [-c command] [host] [...]</tt>

Description

The <tt>ntpq</tt> utility program is used to monitor NTP daemon <tt>ntpd</tt> operations
 			and determine performance. It uses the standard NTP mode 6 control
@@ -591,4 +591,4 @@

-
\ No newline at end of file
+
diff -up ntp-4.2.6p2/html/ntptrace.html.htmldoc ntp-4.2.6p2/html/ntptrace.html
--- ntp-4.2.6p2/html/ntptrace.html.htmldoc	2009-12-09 08:36:36.000000000 +0100
+++ ntp-4.2.6p2/html/ntptrace.html	2010-07-12 16:27:39.000000000 +0200
@@ -17,7 +17,7 @@

Synopsis

-		<tt>ntptrace [ -vdn ] [ -r retries ] [ -t timeout ] [ server ]</tt>
+		<tt>ntptrace [ -n ] [ -m maxhosts ] [ server ]</tt>

Description

<tt>ntptrace</tt> is a <tt>perl</tt> script that uses the <tt>ntpq</tt> utility program to follow the chain of NTP servers from a given host back to the primary time source. For <tt>ntptrace</tt> to work properly, each of these servers must implement the NTP Control and Monitoring Protocol specified in RFC 1305 and enable NTP Mode 6 packets.

If given no arguments, <tt>ntptrace</tt> starts with <tt>localhost</tt>. Here is an example of the output from <tt>ntptrace</tt>:

@@ -30,16 +30,8 @@ usndh.edu: stratum 1, offset 0.0019298,

On each line, the fields are (left to right): the host name, the host stratum, the time offset between that host and the local host (as measured by <tt>ntptrace</tt>; this is why it is not always zero for "<tt>localhost</tt>"), the host synchronization distance, and (only for stratum-1 servers) the reference clock ID. All times are given in seconds. Note that the stratum is the server hop count to the primary source, while the synchronization distance is the estimated error relative to the primary source. These terms are precisely defined in RFC-1305.

Options

-
<tt>-d</tt>
-
Turns on some debugging output.

<tt>-n</tt>

Turns off the printing of host names; instead, host IP addresses are given. This may be useful if a nameserver is down.
-
<tt>-r retries</tt>
-
Sets the number of retransmission attempts for each host (default = 5).
-
<tt>-t timeout</tt>
-
Sets the retransmission timeout (in seconds) (default = 2).
-
<tt>-v</tt>
-
Prints verbose information about the NTP servers.

Bugs

This program makes no attempt to improve accuracy by doing multiple samples.

@@ -47,4 +39,4 @@ usndh.edu: stratum 1, offset 0.0019298,

-
\ No newline at end of file
+
diff -up ntp-4.2.6p2/html/tickadj.html.htmldoc ntp-4.2.6p2/html/tickadj.html
--- ntp-4.2.6p2/html/tickadj.html.htmldoc	2009-12-09 08:36:36.000000000 +0100
+++ ntp-4.2.6p2/html/tickadj.html	2010-07-12 16:27:39.000000000 +0200
@@ -14,10 +14,12 @@

Last update: <csobj format="ShortTime" h="25" locale="00000409" region="0" t="DateTime" w="61">18:53</csobj> UTC <csobj format="LongDate" h="25" locale="00000409" region="0" t="DateTime" w="308">Wednesday, January 16, 2008</csobj>

Synopsis

-		<tt>tickadj [ -Aqs ] [ -a tickadj ] [ -t tick ]</tt>
+
<tt>tickadj [ tick ]</tt>

+
<tt>tickadj [ -Aqs ] [ -a tickadj ] [ -t tick ]</tt>

Description

The <tt>tickadj</tt> program reads, and optionally modifies, several timekeeping-related variables in older kernels that do not have support for precision ttimekeeping, including HP-UX, SunOS, Ultrix, SGI and probably others. Those machines provide means to patch the kernel <tt>/dev/kmem</tt>. Newer machines with kernel time support, including Solaris, Tru64, FreeBSD and Linux, should NOT use the program, even if it appears to work, as it will destabilize the kernel time support. Use the <tt>ntptime</tt> program instead.

The particular variables that can be changed with <tt>tickadj</tt> include <tt>tick</tt>, which is the number of microseconds added to the system time for a clock interrupt, <tt>tickadj</tt>, which sets the slew rate and resolution used by the <tt>adjtime</tt> system call, and <tt>dosynctodr</tt>, which indicates to the kernels on some machines whether they should internally adjust the system clock to keep it in line with time-of-day clock or not.

+
On Linux, only the <tt>tick</tt> variable is supported and the only allowed argument is the tick value.

By default, with no arguments, <tt>tickadj</tt> reads the variables of interest in the kernel and displays them. At the same time, it determines an "optimal" value for the value of the <tt>tickadj</tt> variable if the intent is to run the <tt>ntpd</tt> Network Time Protocol (NTP) daemon, and prints this as well. Since the operation of <tt>tickadj</tt> when reading the kernel mimics the operation of similar parts of the <tt>ntpd</tt> program fairly closely, this can be useful when debugging problems with <tt>ntpd</tt>.

Note that <tt>tickadj</tt> should be run with some caution when being used for the first time on different types of machines. The operations which <tt>tickadj</tt> tries to perform are not guaranteed to work on all Unix machines and may in rare cases cause the kernel to crash.

Command Line Options

@@ -43,4 +45,4 @@

-
\ No newline at end of file
+


code:
diff -up ntp-4.2.6p2/html/ntpd.html.mlock ntp-4.2.6p2/html/ntpd.html
--- ntp-4.2.6p2/html/ntpd.html.mlock	2010-07-12 16:36:09.000000000 +0200
+++ ntp-4.2.6p2/html/ntpd.html	2010-07-12 16:36:09.000000000 +0200
@@ -32,7 +32,7 @@

Synopsis

-		<tt>ntpd [ -46aAbdDgLnNqx ] [ -c conffile ] [ -f driftfile ] [ -i jaildir ] [ -I iface ] [ -k keyfile ] [ -l logfile ] [ -p pidfile ] [ -P priority ] [ -r broadcastdelay ] [ -s statsdir ] [ -t key ] [ -u user[:group] ] [ -U interface_update_interval ] [ -v variable ] [ -V variable ]</tt>
+		<tt>ntpd [ -46aAbdDgLmnNqx ] [ -c conffile ] [ -f driftfile ] [ -i jaildir ] [ -I iface ] [ -k keyfile ] [ -l logfile ] [ -p pidfile ] [ -P priority ] [ -r broadcastdelay ] [ -s statsdir ] [ -t key ] [ -u user[:group] ] [ -U interface_update_interval ] [ -v variable ] [ -V variable ]</tt>

Description

The <tt>ntpd</tt> program is an operating system daemon that synchronises the system clock with remote NTP time servers or local reference clocks. It is a complete implementation of the Network Time Protocol (NTP) version 4, but also retains compatibility with version 3, as defined by RFC-1305, and version 1 and 2, as defined by RFC-1059 and RFC-1119, respectively. The program can operate in any of several modes, as described on the Association Management page, and with both symmetric key and public key cryptography, as described on the Authentication Options page.

The <tt>ntpd</tt> program ordinarily requires a configuration file as desccribe on the Configuration Commands and Options collection above. However a client can discover remote servers and configure them automatically. This makes it possible to deploy a fleet of workstations without specifying configuration details specific to the local environment. Further details are on the Automatic Server Discovery page.

@@ -123,6 +123,8 @@

Do not listen to virtual interfaces, defined as those with names containing a colon. This option is deprecated. Please consider using the configuration file interface command, which is more versatile.

<tt>-M</tt>

Raise scheduler precision to its maximum (1 msec) using timeBeginPeriod. (Windows only)

+
<tt>-m</tt>
+
Lock memory.

<tt>-n</tt>

Don't fork.

<tt>-N</tt>

diff -up ntp-4.2.6p2/ntpd/ntpd-opts.c.mlock ntp-4.2.6p2/ntpd/ntpd-opts.c
--- ntp-4.2.6p2/ntpd/ntpd-opts.c.mlock	2010-07-09 04:23:28.000000000 +0200
+++ ntp-4.2.6p2/ntpd/ntpd-opts.c	2010-07-12 16:36:09.000000000 +0200
@@ -284,6 +284,15 @@ tSCC    zNice_Name[]               = "ni
 #define NICE_FLAGS       (OPTST_DISABLED)

 /*
+ *  Mlock option description:
+ */
+tSCC    zMlockText[] =
+        "Lock memory";
+tSCC    zMlock_NAME[]               = "MLOCK";
+tSCC    zMlock_Name[]               = "mlock";
+#define MLOCK_FLAGS       (OPTST_DISABLED)
+
+/*
  *  Pidfile option description:
  */
 tSCC    zPidfileText[] =
@@ -911,6 +920,18 @@ static tOptDesc optDesc[ OPTION_CT ] = {
      /* desc, NAME, name */ zPccfreqText, zPccfreq_NAME, zPccfreq_Name,
      /* disablement strs */ NULL, NULL },

+  {  /* entry idx, value */ 32, VALUE_OPT_MLOCK,
+     /* equiv idx, value */ 32, VALUE_OPT_MLOCK,
+     /* equivalenced to  */ NO_EQUIVALENT,
+     /* min, max, act ct */ 0, 1, 0,
+     /* opt state flags  */ MLOCK_FLAGS, 0,
+     /* last opt argumnt */ { NULL },
+     /* arg list/cookie  */ NULL,
+     /* must/cannot opts */ NULL, NULL,
+     /* option proc      */ NULL,
+     /* desc, NAME, name */ zMlockText, zMlock_NAME, zMlock_Name,
+     /* disablement strs */ NULL, NULL },
+
   {  /* entry idx, value */ INDEX_OPT_VERSION, VALUE_OPT_VERSION,
      /* equiv idx value  */ NO_EQUIVALENT, 0,
      /* equivalenced to  */ NO_EQUIVALENT,
@@ -1005,7 +1026,7 @@ tOptions ntpdOptions = {
       NO_EQUIVALENT, /* '-#' option index */
       NO_EQUIVALENT /* index of default opt */
     },
-    35 /* full option count */, 32 /* user option count */,
+    36 /* full option count */, 33 /* user option count */,
     ntpd_full_usage, ntpd_short_usage,
     NULL, NULL
 };
diff -up ntp-4.2.6p2/ntpd/ntpd-opts.h.mlock ntp-4.2.6p2/ntpd/ntpd-opts.h
--- ntp-4.2.6p2/ntpd/ntpd-opts.h.mlock	2010-07-09 04:23:28.000000000 +0200
+++ ntp-4.2.6p2/ntpd/ntpd-opts.h	2010-07-12 16:36:09.000000000 +0200
@@ -84,12 +84,13 @@ typedef enum {
     INDEX_OPT_SLEW              = 29,
     INDEX_OPT_USEPCC            = 30,
     INDEX_OPT_PCCFREQ           = 31,
-    INDEX_OPT_VERSION           = 32,
-    INDEX_OPT_HELP              = 33,
-    INDEX_OPT_MORE_HELP         = 34
+    INDEX_OPT_MLOCK             = 32,
+    INDEX_OPT_VERSION           = 33,
+    INDEX_OPT_HELP              = 34,
+    INDEX_OPT_MORE_HELP         = 35
 } teOptIndex;

-#define OPTION_CT    35
+#define OPTION_CT    36
 #define NTPD_VERSION       "4.2.6p2"
 #define NTPD_FULL_VERSION  "ntpd - NTP daemon program - Ver. 4.2.6p2"

@@ -182,6 +183,10 @@ typedef enum {
 #  warning undefining MODIFYMMTIMER due to option name conflict
 #  undef   MODIFYMMTIMER
 # endif
+# ifdef    MLOCK
+#  warning undefining MLOCK due to option name conflict
+#  undef   MLOCK
+# endif
 # ifdef    NOFORK
 #  warning undefining NOFORK due to option name conflict
 #  undef   NOFORK
@@ -263,6 +268,7 @@ typedef enum {
 # undef LOGFILE
 # undef NOVIRTUALIPS
 # undef MODIFYMMTIMER
+# undef MLOCK
 # undef NOFORK
 # undef NICE
 # undef PIDFILE
@@ -301,6 +307,7 @@ typedef enum {
 #define VALUE_OPT_LOGFILE        'l'
 #define VALUE_OPT_NOVIRTUALIPS   'L'
 #define VALUE_OPT_MODIFYMMTIMER  'M'
+#define VALUE_OPT_MLOCK          'm'
 #define VALUE_OPT_NOFORK         'n'
 #define VALUE_OPT_NICE           'N'
 #define VALUE_OPT_PIDFILE        'p'
diff -up ntp-4.2.6p2/ntpd/ntpd.c.mlock ntp-4.2.6p2/ntpd/ntpd.c
--- ntp-4.2.6p2/ntpd/ntpd.c.mlock	2010-07-12 16:36:09.000000000 +0200
+++ ntp-4.2.6p2/ntpd/ntpd.c	2010-07-12 16:36:09.000000000 +0200
@@ -722,7 +722,8 @@ ntpdmain(
 	}
 #endif

-#if defined(HAVE_MLOCKALL) && defined(MCL_CURRENT) && defined(MCL_FUTURE)
+#if defined(MCL_CURRENT) && defined(MCL_FUTURE)
+    if (HAVE_OPT( MLOCK )) {
 # ifdef HAVE_SETRLIMIT
 	/*
 	 * Set the stack limit to something smaller, so that we don't lock a lot
@@ -748,7 +749,7 @@ ntpdmain(
 	     * fail if we drop root privlege.  To be useful the value
 	     * has to be larger than the largest ntpd resident set size.
 	     */
-	    rl.rlim_cur = rl.rlim_max = 32*1024*1024;
+	    rl.rlim_cur = rl.rlim_max = 64*1024*1024;
 	    if (setrlimit(RLIMIT_MEMLOCK, &rl) == -1) {
 		msyslog(LOG_ERR, "Cannot set RLIMIT_MEMLOCK: %m");
 	    }
@@ -760,6 +761,7 @@ ntpdmain(
 	 */
 	if (mlockall(MCL_CURRENT|MCL_FUTURE) < 0)
 		msyslog(LOG_ERR, "mlockall(): %m");
+    }
 #else /* not (HAVE_MLOCKALL && MCL_CURRENT && MCL_FUTURE) */
 # ifdef HAVE_PLOCK
 #  ifdef PROCLOCK

repo_name: ayhanyalcinsoy/main


code:
diff -up ntp-4.2.6p2/lib/isc/unix/interfaceiter.c.tentative ntp-4.2.6p2/lib/isc/unix/interfaceiter.c
--- ntp-4.2.6p2/lib/isc/unix/interfaceiter.c.tentative	2010-06-12 08:13:53.000000000 +0200
+++ ntp-4.2.6p2/lib/isc/unix/interfaceiter.c	2010-07-12 16:25:43.000000000 +0200
@@ -45,6 +45,8 @@
 #include <isc/types.h>
 #include <isc/util.h>

+#include <linux/rtnetlink.h>
+
 /* Must follow <isc/net.h>. */
 #ifdef HAVE_NET_IF6_H
 #include <net/if6.h>
@@ -252,6 +254,10 @@ linux_if_inet6_current(isc_interfaceiter
 		iter->current.flags |= INTERFACE_F_MULTICAST;
 #endif

+	/* ignore tentative address */
+	if (flags & IFA_F_TENTATIVE)
+		iter->current.flags &= ~INTERFACE_F_UP;
+
 	isc_netaddr_fromin6(&iter->current.address, &addr6);
 	if (isc_netaddr_islinklocal(&iter->current.address)) {
 		isc_netaddr_setzone(&iter->current.address,


code:
# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
restrict -6 ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.pool.ntp.org
server 1.pool.ntp.org
server 2.pool.ntp.org

peer 127.127.4.76

#broadcast 192.168.1.255 autokey	# broadcast server
#broadcastclient			# broadcast client
#broadcast 224.0.1.1 autokey		# multicast server
#multicastclient 224.0.1.1		# multicast client
#manycastserver 239.255.254.254		# manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available.
#server	127.127.1.0	# local clock
#fudge	127.127.1.0 stratum 10

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats


code:
# Specify the password to decrypt files containing private keys and identity
# parameters.  This is required only if these files have been encrypted.
#
#crypto pw apassword


code:
#
# PLEASE DO NOT USE THE DEFAULT VALUES HERE.
#
#65535	M	akey
#1	M	pass


code: # List of servers used for initial synchronization.


code:
# Drop root to id 'ntp:ntp' by default.
OPTIONS="-u ntp:ntp -p /run/ntpd.pid -g"


code:
# Options for ntpdate
OPTIONS="-U ntp -s -b"

# Set to 'yes' to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no


code:
diff -up ntp-4.2.4p7/ntpstat-0.2/ntpstat.c.ntpstat ntp-4.2.4p7/ntpstat-0.2/ntpstat.c
--- ntpstat-0.2/ntpstat.c.ntpstat	2002-06-10 08:02:12.000000000 +0200
+++ ntpstat-0.2/ntpstat.c	2009-07-20 12:22:35.000000000 +0200
@@ -151,7 +151,7 @@ int main (void) {
   /* For the reply message to be valid, the first byte should be as sent,
      and the second byte should be the same, with the response bit set */
   byte1ok = ((ntpmsg.byte1&0x3F) == B1VAL);
-  byte2ok = (ntpmsg.byte2 == (B2VAL|RMASK));
+  byte2ok = ((ntpmsg.byte2 & ~MMASK) == (B2VAL|RMASK));
   if (!(byte1ok && byte2ok)) {
     fprintf (stderr,"status word is 0x%02x%02x\n", ntpmsg.byte1,ntpmsg.byte2 );
     die ("return data appears to be invalid based on status word");


code:
diff -up ntp-4.2.6p1/ntpstat-0.2/ntpstat.c.sysvars ntp-4.2.6p1/ntpstat-0.2/ntpstat.c
--- ntpstat-0.2/ntpstat.c.sysvars	2010-05-03 11:27:47.000000000 +0200
+++ ntpstat-0.2/ntpstat.c	2010-05-03 11:32:56.000000000 +0200
@@ -89,9 +89,9 @@ int main (void) {
     "modem"};         /* 9 */
   char *newstr;
   char *dispstr;
-  const char DISP[] = "rootdispersion=";
+  const char DISP[] = "rootdisp=";
   const char STRATUM[] = "stratum=";
-  const char POLL[] = "poll=";
+  const char POLL[] = "tc=";
   const char REFID[] = "refid=";

   /* initialise timeout value */


code:
#!/bin/bash

# remove adjacent blank lines
sed -i 's/^[\t\ ]*$//;/./,/^$/!d' man/man*/*.[58]

#sed -i 's/sntp\.1/sntp\.8/' man/man1/sntp.1
#mv man/man1/sntp.1 man/man8/sntp.8

# fix section numbers
sed -i 's/\(\.TH[a-zA-Z ]*\)[1-9]\(.*\)/\18\2/' man/man8/*.8


code:
## /etc/ntp/ntp.conf
##
## Sample NTP configuration file.
## See package 'ntp-doc' for documentation, Mini-HOWTO and FAQ.

## Radio and modem clocks by convention have addresses in the
## form 127.127.t.u, where t is the clock type and u is a unit
## number in the range 0-3.
##
## Most of these clocks require support in the form of a
## serial port or special bus peripheral. The particular
## device is normally specified by adding a soft link
## /dev/device-u to the particular hardware device involved,
## where u correspond to the unit number above.
##
## Generic DCF77 clock on serial port (Conrad DCF77)
## Address:     127.127.8.u
## Serial Port: /dev/refclock-u
##
## (create soft link /dev/refclock-0 to the particular ttyS?)
##
# server 127.127.8.0 mode 5 prefer

## Undisciplined Local Clock. This is a fake driver intended for backup
## and when no outside source of synchronized time is available.
##
server 127.127.1.0		# local clock (LCL)
fudge  127.127.1.0 stratum 10	# LCL is unsynchronized

## Outside source of synchronized time
##
## server xx.xx.xx.xx		# IP address of server

## Miscellaneous stuff

driftfile /var/lib/ntp/drift/ntp.drift # path for drift file

logfile   /var/log/ntp		# alternate log file
# logconfig =syncstatus + sysevents
# logconfig =all

# statsdir /tmp/		# directory for statistics files
# filegen peerstats  file peerstats  type day enable
# filegen loopstats  file loopstats  type day enable
# filegen clockstats file clockstats type day enable

# Authentication stuff
#
# keys /etc/ntp.keys		# path for keys file
# trustedkey 1 2 3 4 5 6 14 15	# define trusted keys
# requestkey 15			# key (7) for accessing server variables
# controlkey 15			# key (6) for accessing server variables


code:
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
    <Source>
        <Name>ntp</Name>
        <Homepage>http://www.ntp.org</Homepage>
        <Packager>
            <Name>PisiLinux Community</Name>
            <Email>admins@pisilinux.org</Email>
        </Packager>
        <License>MIT</License>
        <License>BSD</License>
        <License>GPLv2+</License>
        <IsA>service</IsA>
        NTP daemon and client
        <Description>Network Time Protocol utilities and daemons that will synchronize your computer's time to Coordinated Universal Time (UTC) via the NTP protocol and NTP servers.</Description>
        <Archive sha1sum="503d68cfd3e6a9354e0e28dd38b39d850b1228b2" type="targz">https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8p10.tar.gz</Archive>

        <AdditionalFiles>
            <AdditionalFile permission="0755" target="fix-man-pages">fix-man-pages.sh</AdditionalFile>
        </AdditionalFiles>
        <BuildDependencies>
            <Dependency>avahi-compat-libdns_sd-devel</Dependency>
            <Dependency>libedit-devel</Dependency>
            <Dependency>net-snmp-devel</Dependency>
            <Dependency>perl-HTML-Parser</Dependency>
            <Dependency>libcap-devel</Dependency>
            <Dependency>openssl-devel</Dependency>
            <Dependency>libevent-devel</Dependency>
        </BuildDependencies>

    </Source>

    <Package>
        <Name>ntp-server</Name>
        NTP server
        <RuntimeDependencies>
            <Dependency>avahi-compat-libdns_sd</Dependency>
            <Dependency>libedit</Dependency>
            <Dependency>net-snmp</Dependency>
            <Dependency>libcap</Dependency>
            <Dependency>openssl</Dependency>
            <Dependency>libevent</Dependency>
            <Dependency release="current">ntp-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc/ntp.conf</Path>
            <Path fileType="config">/etc/conf.d</Path>
            <Path fileType="config">/etc/ntp/crypto</Path>
            <Path fileType="executable">/usr/bin/ntpstat</Path>
            <Path fileType="executable">/usr/bin/update-leap</Path>
            <Path fileType="executable">/usr/bin/calc_tickadj</Path>
            <Path fileType="data">/usr/share/ntp/lib/NTP/Util.pm</Path>
            <Path fileType="executable">/usr/libexec</Path>
            <Path fileType="executable">/usr/sbin</Path>
            <Path fileType="doc">/usr/share/doc</Path>
            <Path fileType="man">/usr/share/man</Path>
            <Path fileType="data">/var/lib/ntp</Path>
        </Files>
        <AdditionalFiles>
            <AdditionalFile owner="root" permission="0644" target="/etc/ntp.conf">fedora/ntp.conf</AdditionalFile>
            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/ntpd">fedora/ntpd.sysconfig</AdditionalFile>
            <AdditionalFile owner="root" permission="0600" target="/etc/ntp/crypto/pw">fedora/ntp.cryptopw</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="ntp-server-package.py">System.Package</COMAR>
            <COMAR script="ntpd-service.py" name="ntpd">System.Service</COMAR>
        </Provides>
    </Package>

    <Package>
        <Name>ntp-client</Name>
        <IsA>app:console</IsA>
        <PartOf>util.admin</PartOf>
        NTP client
        <Files>
            <Path fileType="config">/etc/conf.d/ntpdate</Path>
            <Path fileType="config">/etc/ntp/step-tickers</Path>
            <Path fileType="config">/etc/ntp/keys</Path>
            <Path fileType="executable">/usr/sbin/ntpdate</Path>
            <Path fileType="man">/usr/share/man/man8/ntpdate.8*</Path>
        </Files>
        <AdditionalFiles>
            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/ntpdate">fedora/ntpdate.sysconfig</AdditionalFile>
            <AdditionalFile owner="root" permission="0644" target="/etc/ntp/step-tickers">fedora/ntp.step-tickers</AdditionalFile>
            <AdditionalFile owner="root" permission="0600" target="/etc/ntp/keys">fedora/ntp.keys</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="ntpdate-service.py" name="ntpdate">System.Service</COMAR>

            <COMAR script="ntpdate-package.py">System.Package</COMAR>
        </Provides>
    </Package>

    <Package>
        <Name>ntp-docs</Name>
        <IsA>data:doc</IsA>
        NTP documentation
        <RuntimeDependencies>
            <Dependency release="current">ntp-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="doc">/usr/share/doc/ntp/html</Path>
        </Files>
    </Package>

    <History>
        <Update release="4">
            <Date>2017-05-09</Date>
            <Version>4.2.8_p10</Version>
            <Comment>Version Bump</Comment>
            <Name>Kamil Atlı</Name>
            <Email>suvari@pisilinux.org</Email>
        </Update>
        <Update release="3">
            <Date>2016-10-27</Date>
            <Version>4.2.8_p8</Version>
            <Comment>Version Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="2">
            <Date>2016-06-08</Date>
            <Version>4.2.8_p4</Version>
            <Comment>Release Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="1">
            <Date>2016-01-01</Date>
            <Version>4.2.8_p4</Version>
            <Comment>First release</Comment>
            <Name>Stefan Gronewold</Name>
            <Email>groni@pisilinux.org</Email>
        </Update>
    </History>
</PISI>


code:
<?xml version="1.0" ?>
<PISI>
    <Source>
        <Name>ntp</Name>
        NTP hizmeti ve istemcisi
        <Description xml:lang="tr">ntp, NTP protokolü üzerinden uzak sunucuları kullanarak sisteminizin zamanını eşitlemek için gerekli araçları ve hizmetleri içerir.</Description>
    </Source>

    <Package>
        <Name>ntp-server</Name>
        NTP hizmeti
    </Package>

    <Package>
        <Name>ntp-client</Name>
        NTP istemcisi
    </Package>

    <Package>
        <Name>ntp-docs</Name>
        NTP belgeleri
    </Package>
</PISI>


code:
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt

from pisi.actionsapi import get
from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools

KeepSpecial = ["libtool"]

def setup():
    pisitools.dosed(
        "include/ldap_defaults.h",
        "(#define LDAPI_SOCK).*",
        '\\1 "/run/openldap/slapd.sock"'
    )
    pisitools.dosed("servers/slapd/Makefile.in", "(\$\(DESTDIR\))\$\(localstatedir\)(\/run)", r"\1\2")

    pisitools.flags.add("-D_REENTRANT -D_GNU_SOURCE -fPIC -Wl,--as-needed -DLDAP_CONNECTIONLESS")
    #pisitools.ldflags.add("-pie")

    options = "--prefix=/usr \
               --disable-bdb \
               --disable-hdb \
               --enable-backends=mod \
               --enable-slapd \
               --enable-passwd=mod \
               --enable-dnssrv=mod \
               --enable-ldap \
               --enable-wrappers \
               --enable-meta=mod \
               --enable-monitor=mod \
               --enable-null=mod \
               --enable-shell=mod \
               --enable-rewrite \
               --enable-rlookups \
               --enable-aci \
               --enable-modules \
               --enable-cleartext \
               --enable-lmpasswd \
               --enable-spasswd \
               --enable-slapi \
               --enable-dyngroup \
               --enable-proxycache \
               --enable-perl \
               --enable-syslog \
               --enable-dynamic \
               --enable-local \
               --enable-proctitle \
               --enable-overlays=mod \
               --enable-ndb=no \
               --with-pic \
               --with-threads \
               --with-cyrus-sasl \
               --without-fetch \
               --without-threads \
               --enable-crypt \
               --enable-ipv6 \
               --enable-dynacl \
               --enable-shared \
               --disable-static \
               --disable-slp \
               --localstatedir=/var/lib"

    if get.buildTYPE() == "emul32":
        options =  " --prefix=/emul32 \
                     --libdir=/usr/lib32 \
                     --libexecdir=/emul32/libexec \
                     --disable-bdb \
                     --disable-hdb \
                     --disable-wrappers \
                     --disable-spasswd \
                     --disable-perl \
                     --without-tls \
                     --without-cyrus-sasl"
    else: options += " --with-tls=auto"

    shelltools.export("AUTOMAKE", "/bin/true")
    autotools.autoreconf("-fi")
    autotools.configure(options)

    pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ")

def build():
    autotools.make("-j1")

def install():
    if get.buildTYPE() == "emul32":
        autotools.rawInstall("DESTDIR=%s" % get.installDIR())
        return

    autotools.rawInstall("DESTDIR=%s" % get.installDIR())

    pisitools.dodir("/run/openldap")
    pisitools.dodir("/etc/openldap/ssl")

    pisitools.dodoc("ANNOUNCEMENT", "CHANGES", "COPYRIGHT", "README", "LICENSE")

    pisitools.remove("/usr/lib/*.la")
    pisitools.remove("/usr/libexec/openldap/*.la")


code:
#!/usr/bin/python

import os
import pwd
import grp

def postInstall(fromVersion, fromRelease, toVersion, toRelease):
    os.system("/bin/chown ldap:ldap /var/lib/openldap-data")
    os.system("/bin/chown ldap:ldap /var/lib/openldap-slurp")
    os.system("/bin/chown ldap:ldap /run/openldap")
    os.system("/bin/chown root:ldap /etc/openldap/slapd.conf")
    os.system("/bin/chown root:ldap /etc/openldap/slapd.conf.default")
    os.system("/bin/chmod 0700 /var/lib/openldap-data")
    os.system("/bin/chmod 0700 /var/lib/openldap-slurp")
    os.system("/bin/chmod 0755 /run/openldap")
    os.system("/bin/chmod 0640 /etc/openldap/slapd.conf")
    os.system("/bin/chmod 0640 /etc/openldap/slapd.conf.default")


code:
from comar.service import *

serviceType = "server"
serviceDesc = _({"en": "OpenLDAP Server",
                 "tr": "OpenLDAP Sunucusu"})
serviceConf = "slapd"

def start():
    import os
    os.environ["LC_ALL"] = "C"
    os.environ["LANG"] = "C"

    startService(command="/usr/libexec/slapd",
                 args="-u ldap -g ldap %s" % config.get("OPTS", ""),
                 pidfile="/run/openldap/slapd.pid",
                 donotify=True)

def stop():
    stopService(pidfile="/run/openldap/slapd.pid",
                donotify=True)

def status():
    return isServiceRunning("/run/openldap/slapd.pid")


code:
# -*- coding: utf-8 -*-
from comar.service import *

serviceType = "server"
serviceDesc = _({"en": "Slurpd Daemon",
                 "tr": "Slurpd Servisi"})

def start():
    startService(command="/usr/libexec/slurpd",
                 donotify=True)

def stop():
    stopService(command="/usr/libexec/slurpd",
                donotify=True)

def status():
    return isServiceRunning(command="/usr/libexec/slurpd")


code:
Use pkg-config for Mozilla NSS library detection

Author: Jan Vcelak <jvcelak@redhat.com>

---
 configure.in | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/configure.in b/configure.in
index ecffe30..2a9cfb4 100644
--- a/configure.in
+++ b/configure.in
@@ -1223,28 +1223,16 @@ if test $ol_link_tls = no ; then
 	fi
 fi

-dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3
-dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs
-dnl are not in the default system location
 if test $ol_link_tls = no ; then
 	if test $ol_with_tls = moznss || test $ol_with_tls = auto ; then
-		have_moznss=no
-		AC_CHECK_HEADERS([nssutil.h])
-		if test "$ac_cv_header_nssutil_h" = yes ; then
-			AC_CHECK_LIB([nss3], [NSS_Initialize],
-						 [ have_moznss=yes ], [ have_moznss=no ])
-		fi
+		PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss=yes], [have_moznss=no])

-		if test "$have_moznss" = yes ; then
+		if test $have_moznss = yes ; then
 			ol_with_tls=moznss
 			ol_link_tls=yes
-			AC_DEFINE(HAVE_MOZNSS, 1,
-					  [define if you have MozNSS])
-			TLS_LIBS="-lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4"
-		else
-			if test $ol_with_tls = moznss ; then
-			AC_MSG_ERROR([MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)])
-			fi
+			AC_DEFINE(HAVE_MOZNSS, 1, [define if you have MozNSS])
+			TLS_LIBS="$MOZNSS_LIBS"
+			CFLAGS="$CFLAGS $MOZNSS_CFLAGS"
 		fi
 	fi
 fi
--
1.7.11.7


code:
Implement priority/weight for DNS SRV records

From RFC 2782:

  A client MUST attempt to contact the target host with the
  lowest-numbered priority it can reach.

This patch sorts the DNS SRV records by their priority, and
additionally gives records with a larger weight a higher probability
of appearing earlier. This way, the DNS SRV records are tried in the
order of their priority.

Author: James M Leddy <james.leddy@redhat.com>
Upstream ITS: #7027
Resolves: #733078

---
 libraries/libldap/dnssrv.c |  106 ++++++++++++++++++++++++++++++++++----------
 1 files changed, 83 insertions(+), 23 deletions(-)

diff --git a/libraries/libldap/dnssrv.c b/libraries/libldap/dnssrv.c
index 16b1544..40f93b4 100644
--- a/libraries/libldap/dnssrv.c
+++ b/libraries/libldap/dnssrv.c
@@ -174,6 +174,46 @@ int ldap_domain2dn(
 	return LDAP_SUCCESS;
 }

+#ifdef HAVE_RES_QUERY
+#define DNSBUFSIZ (64*1024)
+typedef struct srv_record {
+    u_short priority;
+    u_short weight;
+    u_short port;
+    char hostname[DNSBUFSIZ];
+} srv_record;
+
+
+static int srv_cmp(const void *aa, const void *bb){
+    srv_record *a=(srv_record *)aa;
+    srv_record *b=(srv_record *)bb;
+    u_long total;
+
+    if(a->priority < b->priority) {
+	return -1;
+    }
+    if(a->priority > b->priority) {
+	return 1;
+    }
+    if(a->priority == b->priority){
+	/* targets with same priority are in psudeo random order */
+	if (a->weight == 0 && b->weight == 0) {
+	    if (rand() % 2) {
+		return -1;
+	    } else {
+		return 1;
+	    }
+	}
+	total = a->weight + b->weight;
+	if (rand() % total < a->weight) {
+	    return -1;
+	} else {
+	    return 1;
+	}
+    }
+}
+#endif /* HAVE_RES_QUERY */
+
 /*
  * Lookup and return LDAP servers for domain (using the DNS
  * SRV record _ldap._tcp.domain).
@@ -183,15 +223,16 @@ int ldap_domain2hostlist(
 	char **list )
 {
 #ifdef HAVE_RES_QUERY
-#define DNSBUFSIZ (64*1024)
-    char *request;
-    char *hostlist = NULL;
+    char *request;
+   char *hostlist = NULL;
+    srv_record *hostent_head=NULL;
+    int i;
     int rc, len, cur = 0;
     unsigned char reply[DNSBUFSIZ];
+    int hostent_count=0;

 	assert( domain != NULL );
 	assert( list != NULL );
-
 	if( *domain == '\0' ) {
 		return LDAP_PARAM_ERROR;
 	}
@@ -223,8 +264,7 @@ int ldap_domain2hostlist(
 	unsigned char *p;
 	char host[DNSBUFSIZ];
 	int status;
-	u_short port;
-	/* int priority, weight; */
+	u_short port, priority, weight;

 	/* Parse out query */
 	p = reply;
@@ -263,40 +303,56 @@ int ldap_domain2hostlist(
 	    size = (p[0] << 8) | p[1];
 	    p += 2;
 	    if (type == T_SRV) {
-		int buflen;
 		status = dn_expand(reply, reply + len, p + 6, host, sizeof(host));
 		if (status < 0) {
 		    goto out;
 		}
-		/* ignore priority and weight for now */
-		/* priority = (p[0] << 8) | p[1]; */
-		/* weight = (p[2] << 8) | p[3]; */
+
+		/* Get priority weight and port */
+		priority = (p[0] << 8) | p[1];
+		weight = (p[2] << 8) | p[3];
 		port = (p[4] << 8) | p[5];

 		if ( port == 0 || host[ 0 ] == '\0' ) {
 		    goto add_size;
 		}

-		buflen = strlen(host) + STRLENOF(":65355 ");
-		hostlist = (char *) LDAP_REALLOC(hostlist, cur + buflen + 1);
-		if (hostlist == NULL) {
-		    rc = LDAP_NO_MEMORY;
-		    goto out;
+		hostent_head = (srv_record *) LDAP_REALLOC(hostent_head, (hostent_count+1)*(sizeof(srv_record)));
+		if(hostent_head==NULL){
+		  rc=LDAP_NO_MEMORY;
+		  goto out;
+
 		}
-		if (cur > 0) {
-		    /* not first time around */
-		    hostlist[cur++] = ' ';
-		}
-		cur += sprintf(&hostlist[cur], "%s:%hu", host, port);
+		hostent_head[hostent_count].priority=priority;
+		hostent_head[hostent_count].weight=weight;
+		hostent_head[hostent_count].port=port;
+		strncpy(hostent_head[hostent_count].hostname, host,255);
+		hostent_count=hostent_count+1;
 	    }
 add_size:;
 	    p += size;
 	}
     }
+    qsort(hostent_head, hostent_count, sizeof(srv_record), srv_cmp);
+
+    for(i=0; i<hostent_count; i++){
+	int buflen;
+        buflen = strlen(hostent_head[i].hostname) + STRLENOF(":65355" );
+        hostlist = (char *) LDAP_REALLOC(hostlist, cur+buflen+1);
+        if (hostlist == NULL) {
+            rc = LDAP_NO_MEMORY;
+            goto out;
+        }
+        if(cur>0){
+            hostlist[cur++]=' ';
+        }
+        cur += sprintf(&hostlist[cur], "%s:%hd", hostent_head[i].hostname, hostent_head[i].port);
+    }
+
     if (hostlist == NULL) {
-	/* No LDAP servers found in DNS. */
-	rc = LDAP_UNAVAILABLE;
-	goto out;
+         /* No LDAP servers found in DNS. */
+         rc = LDAP_UNAVAILABLE;
+         goto out;
     }

     rc = LDAP_SUCCESS;
@@ -308,8 +364,12 @@ add_size:;
     if (request != NULL) {
 	LDAP_FREE(request);
     }
+    if (hostent_head != NULL) {
+	LDAP_FREE(hostent_head);
+    }
     if (rc != LDAP_SUCCESS && hostlist != NULL) {
 	LDAP_FREE(hostlist);
+
     }
     return rc;
 #else
--
1.7.6


code:
From 69709289b083c53ba41d2cef7d65120220f8c59b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 7 May 2013 17:02:57 +0200
Subject: [PATCH] LDAPI SASL fix

Resolves: #960222
---
 libraries/libldap/cyrus.c | 19 ++++++++++++++++---
 1 Datei geändert, 16 Zeilen hinzugefügt(+), 3 Zeilen entfernt(-)

diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
index 28c241b..a9acf36 100644
--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
@@ -394,6 +394,8 @@ ldap_int_sasl_bind(
 	struct berval	ccred = BER_BVNULL;
 	int saslrc, rc;
 	unsigned credlen;
+	char my_hostname[HOST_NAME_MAX + 1];
+	int free_saslhost = 0;

 	Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_bind: %s\n",
 		mechs ? mechs : "<null>", 0, 0 );
@@ -454,14 +456,25 @@ ldap_int_sasl_bind(

 			/* If we don't need to canonicalize just use the host
 			 * from the LDAP URI.
+			 * Always use the result of gethostname() for LDAPI.
 			 */
-			if ( nocanon )
+			if (ld->ld_defconn->lconn_server->lud_scheme != NULL &&
+			    strcmp("ldapi", ld->ld_defconn->lconn_server->lud_scheme) == 0) {
+				rc = gethostname(my_hostname, HOST_NAME_MAX + 1);
+				if (rc == 0) {
+					saslhost = my_hostname;
+				} else {
+					saslhost = "localhost";
+				}
+			} else if ( nocanon )
 				saslhost = ld->ld_defconn->lconn_server->lud_host;
-			else
+			else {
 				saslhost = ldap_host_connected_to( ld->ld_defconn->lconn_sb,
 				"localhost" );
+				free_saslhost = 1;
+			}
 			rc = ldap_int_sasl_open( ld, ld->ld_defconn, saslhost );
-			if ( !nocanon )
+			if ( free_saslhost )
 				LDAP_FREE( saslhost );
 		}

--
1.7.11.7


code:
Disables opening of ldaprc file in current directory.

Resolves: #38402
Upstream: ITS #1131
Author: Henning Schmiedehausen <hps@intermeta.de>

diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index 8617527..e6b17b4 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -352,9 +352,6 @@ static void openldap_ldap_init_w_userconf(const char *file)
 	if(path != NULL) {
 		LDAP_FREE(path);
 	}
-
-	/* try file */
-	openldap_ldap_init_w_conf(file, 1);
 }

 static void openldap_ldap_init_w_env(


code:
MozNSS: load certificates from certdb, fallback to PEM

If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS
certificate database, the backend assumed that the certificate is always
located in the certificate database. This assumption might be wrong.

This patch makes the library to try to load the certificate from NSS
database and fallback to PEM file if unsuccessfull.

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7389
Resolves: #857455

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 6847bea..8339391 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -1412,7 +1412,7 @@ tlsm_ctx_load_private_key( tlsm_ctx *ctx )
 	/* prefer unlocked key, then key from opened certdb, then any other */
 	if ( unlocked_key )
 		ctx->tc_private_key = unlocked_key;
-	else if ( ctx->tc_certdb_slot )
+	else if ( ctx->tc_certdb_slot && !ctx->tc_using_pem )
 		ctx->tc_private_key = PK11_FindKeyByDERCert( ctx->tc_certdb_slot, ctx->tc_certificate, pin_arg );
 	else
 		ctx->tc_private_key = PK11_FindKeyByAnyCert( ctx->tc_certificate, pin_arg );
@@ -1909,8 +1909,6 @@ tlsm_deferred_init( void *arg )
 				}
 				return -1;
 			}
-
-			ctx->tc_using_pem = PR_TRUE;
 		}

 		NSS_SetDomesticPolicy();
@@ -2363,15 +2361,9 @@ tlsm_deferred_ctx_init( void *arg )

 	/* set up our cert and key, if any */
 	if ( lt->lt_certfile ) {
-		/* if using the PEM module, load the PEM file specified by lt_certfile */
-		/* otherwise, assume this is the name of a cert already in the db */
-		if ( ctx->tc_using_pem ) {
-			/* this sets ctx->tc_certificate to the correct value */
-			int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE );
-			if ( rc ) {
-				return rc;
-			}
-		} else {
+
+		/* first search in certdb (lt_certfile is nickname) */
+		if ( ctx->tc_certdb ) {
 			char *tmp_certname;

 			if ( tlsm_is_tokenname_certnick( lt->lt_certfile )) {
@@ -2391,8 +2383,31 @@ tlsm_deferred_ctx_init( void *arg )
 				Debug( LDAP_DEBUG_ANY,
 					   "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n",
 					   lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+			}
+		}
+
+		/* fallback to PEM module (lt_certfile is filename) */
+		if ( !ctx->tc_certificate ) {
+			if ( !pem_module && tlsm_init_pem_module() ) {
+				int pem_errcode = PORT_GetError();
+				Debug( LDAP_DEBUG_ANY,
+					   "TLS: fallback to PEM impossible, module cannot be loaded - error %d:%s.\n",
+					   pem_errcode, PR_ErrorToString( pem_errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
 				return -1;
 			}
+
+			/* this sets ctx->tc_certificate to the correct value */
+			if ( !tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE ) ) {
+				ctx->tc_using_pem = PR_TRUE;
+			}
+		}
+
+		if ( ctx->tc_certificate ) {
+			Debug( LDAP_DEBUG_ANY,
+				   "TLS: certificate '%s' successfully loaded from %s.\n", lt->lt_certfile,
+				   ctx->tc_using_pem ? "PEM file" : "moznss database", 0);
+		} else {
+			return -1;
 		}
 	}


code:
MozNSS: ignore certdb database type prefix when checking existence of the directory

If the certdb is specified including the database type prefix (e.g.
sql:, dbm:), the prefix has to be ignored when checking the
certificate directory existence.

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7388
Resolves: #857373

---
 libraries/libldap/tls_m.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 49a3f8f..5ee21a2 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -1633,6 +1633,7 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
 {
 	char sep = PR_GetDirectorySeparator();
 	char *ptr = NULL;
+	char *chkpath = NULL;
 	struct PRFileInfo prfi;
 	PRStatus prc;

@@ -1643,8 +1644,16 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
 		return;
 	}

-	prc = PR_GetFileInfo( certdir, &prfi );
+	/* ignore database type prefix (e.g. sql:, dbm:) if provided */
+	chkpath = strchr( certdir, ':' );
+	if ( chkpath != NULL ) {
+		chkpath += 1;
+	} else {
+		chkpath = certdir;
+	}
+
 	/* if certdir exists (file or directory) then it cannot specify a prefix */
+	prc = PR_GetFileInfo( chkpath, &prfi );
 	if ( prc == PR_SUCCESS ) {
 		return;
 	}
--
1.7.11.7


code:
Resolves: #929357

From 6330d1b87a45b447f33fe8ffd6fbbce9e60bb0ec Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Thu, 28 Mar 2013 19:05:02 -0600
Subject: [PATCH] must call PK11_FreeSlot after SECMOD_CloseUserDB to remove ref to slot

---
 libraries/libldap/tls_m.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 072d41d..c59d303 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -2063,6 +2063,8 @@ tlsm_ctx_free ( tls_ctx *ctx )
 				   "TLS: could not close certdb slot - error %d:%s.\n",
 				   errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
 		}
+		PK11_FreeSlot( c->tc_certdb_slot );
+		c->tc_certdb_slot = NULL;
 	}
 	PL_strfree( c->tc_pin_file );
 	c->tc_pin_file = NULL;
--
1.7.1


code:
MozNSS: better file name matching for hashed CA  certificate directory

CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name
should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used
to differentiate between two certificates with the same subject name.

Wit this patch, certificate file names are matched correctly (using regular expressions).

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7374
Resolves: #852786

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 5e49fc5..61d71d4 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -38,6 +38,7 @@
 #include <ac/unistd.h>
 #include <ac/param.h>
 #include <ac/dirent.h>
+#include <ac/regex.h>

 #include "ldap-int.h"
 #include "ldap-tls.h"
@@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods;

 #define PEM_LIBRARY	"nsspem"
 #define PEM_MODULE	"PEM"
-/* hash files for use with cacertdir have this file name suffix */
-#define PEM_CA_HASH_FILE_SUFFIX	".0"
-#define PEM_CA_HASH_FILE_SUFFIX_LEN 2
+#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$"

 static SECMODModule *pem_module;

@@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
 		PRDir *dir;
 		PRDirEntry *entry;
 		PRStatus fistatus = PR_FAILURE;
+		regex_t hashfile_re;

 		memset( &fi, 0, sizeof(fi) );
 		fistatus = PR_GetFileInfo( cacertdir, &fi );
@@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
 			goto done;
 		}

+		if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) {
+			Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 );
+			goto done;
+		}
+
 		do {
 			entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN );
 			if ( ( NULL != entry ) && ( NULL != entry->name ) ) {
 				char *fullpath = NULL;
-				char *ptr;
+				int match;

-				ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX );
-				if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) {
+				match = regexec( &hashfile_re, entry->name, 0, NULL, 0 );
+				if ( match == REG_NOMATCH ) {
 					Debug( LDAP_DEBUG_TRACE,
-						   "TLS: file %s does not end in [%s] - does not appear to be a CA certificate "
-						   "directory file with a properly hashed file name - skipping.\n",
-						   entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 );
+						   "TLS: skipping '%s' - filename does not have expected format "
+						   "(certificate hash with numeric suffix)\n", entry->name, 0, 0 );
+					continue;
+				} else if ( match != 0 ) {
+					Debug( LDAP_DEBUG_ANY,
+						   "TLS: cannot execute regex for CA hash file matching (%d).\n",
+						   match, 0, 0 );
 					continue;
 				}
+
 				fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name );
 				if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) {
 					Debug( LDAP_DEBUG_TRACE,
@@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
 				PR_smprintf_free( fullpath );
 			}
 		} while ( NULL != entry );
+		regfree ( &hashfile_re );
 		PR_CloseDir( dir );
 	}
 done:
--
1.7.11.4


code:
MozNSS: update list of supported cipher suites

The updated list includes all ciphers implemented in Mozilla NSS 3.13.15

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7374

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 1422ce2..5e49fc5 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -211,27 +211,34 @@ typedef struct {
 	int num;            /* The cipher id */
 	int attr;           /* cipher attributes: algorithms, etc */
 	int version;        /* protocol version valid for this cipher */
-	int bits;           /* bits of strength */
-	int alg_bits;       /* bits of the algorithm */
 	int strength;       /* LOW, MEDIUM, HIGH */
 	int enabled;        /* Enabled by default? */
 } cipher_properties;

 /* cipher attributes  */
-#define SSL_kRSA  0x00000001L
-#define SSL_aRSA  0x00000002L
-#define SSL_aDSS  0x00000004L
-#define SSL_DSS   SSL_aDSS
-#define SSL_eNULL 0x00000008L
-#define SSL_DES   0x00000010L
-#define SSL_3DES  0x00000020L
-#define SSL_RC4   0x00000040L
-#define SSL_RC2   0x00000080L
-#define SSL_AES   0x00000100L
-#define SSL_MD5   0x00000200L
-#define SSL_SHA1  0x00000400L
-#define SSL_SHA   SSL_SHA1
-#define SSL_RSA   (SSL_kRSA|SSL_aRSA)
+#define SSL_kRSA        0x00000001L
+#define SSL_aRSA        0x00000002L
+#define SSL_RSA         (SSL_kRSA|SSL_aRSA)
+#define SSL_aDSA        0x00000004L
+#define SSL_DSA         SSL_aDSA
+#define SSL_eNULL       0x00000008L
+#define SSL_DES         0x00000010L
+#define SSL_3DES        0x00000020L
+#define SSL_RC4         0x00000040L
+#define SSL_RC2         0x00000080L
+#define SSL_AES128      0x00000100L
+#define SSL_AES256      0x00000200L
+#define SSL_AES         (SSL_AES128|SSL_AES256)
+#define SSL_MD5         0x00000400L
+#define SSL_SHA1        0x00000800L
+#define SSL_kEDH        0x00001000L
+#define SSL_CAMELLIA128 0x00002000L
+#define SSL_CAMELLIA256 0x00004000L
+#define SSL_CAMELLIA    (SSL_CAMELLIA128|SSL_CAMELLIA256)
+#define SSL_SEED        0x00008000L
+#define SSL_kECDH       0x00010000L
+#define SSL_kECDHE      0x00020000L
+#define SSL_aECDSA      0x00040000L

 /* cipher strength */
 #define SSL_NULL      0x00000001L
@@ -248,29 +255,70 @@ typedef struct {

 /* Cipher translation */
 static cipher_properties ciphers_def[] = {
-	/* SSL 2 ciphers */
-	{"DES-CBC3-MD5", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, 168, 168, SSL_HIGH, SSL_ALLOWED},
-	{"RC2-CBC-MD5", SSL_EN_RC2_128_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"RC4-MD5", SSL_EN_RC4_128_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"DES-CBC-MD5", SSL_EN_DES_64_CBC_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5, SSL2, 56, 56, SSL_LOW, SSL_ALLOWED},
-	{"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
-	{"EXP-RC4-MD5", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL2, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
-
-	/* SSL3 ciphers */
-	{"RC4-MD5", SSL_RSA_WITH_RC4_128_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"RC4-SHA", SSL_RSA_WITH_RC4_128_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSL3, 128, 128, SSL_MEDIUM, SSL_ALLOWED},
-	{"DES-CBC3-SHA", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSL3, 168, 168, SSL_HIGH, SSL_ALLOWED},
-	{"DES-CBC-SHA", SSL_RSA_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSL3, 56, 56, SSL_LOW, SSL_ALLOWED},
-	{"EXP-RC4-MD5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSL3, 40, 128, SSL_EXPORT40, SSL_ALLOWED},
-	{"EXP-RC2-CBC-MD5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSL3, 0, 0, SSL_EXPORT40, SSL_ALLOWED},
-	{"NULL-MD5", SSL_RSA_WITH_NULL_MD5, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
-	{"NULL-SHA", SSL_RSA_WITH_NULL_SHA, SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, 0, 0, SSL_NULL, SSL_NOT_ALLOWED},
+
+	/*
+	 * Use the same DEFAULT cipher list as OpenSSL, which is defined as: ALL:!aNULL:!eNULL:!SSLv2
+	 */
+
+	/* SSLv2 ciphers */
+	{"DES-CBC-MD5",     SSL_EN_DES_64_CBC_WITH_MD5,           SSL_kRSA|SSL_aRSA|SSL_DES|SSL_MD5,  SSL2, SSL_LOW,      SSL_NOT_ALLOWED},
+	{"DES-CBC3-MD5",    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,     SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_MD5, SSL2, SSL_HIGH,     SSL_NOT_ALLOWED},
+	{"RC2-CBC-MD5",     SSL_EN_RC2_128_CBC_WITH_MD5,          SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,  SSL2, SSL_MEDIUM,   SSL_NOT_ALLOWED},
+	{"RC4-MD5",         SSL_EN_RC4_128_WITH_MD5,              SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,  SSL2, SSL_MEDIUM,   SSL_NOT_ALLOWED},
+	{"EXP-RC2-CBC-MD5", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,  SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
+	{"EXP-RC4-MD5",     SSL_EN_RC4_128_EXPORT40_WITH_MD5,     SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,  SSL2, SSL_EXPORT40, SSL_NOT_ALLOWED},
+
+	/* SSLv3 ciphers */
+	{"NULL-MD5",             SSL_RSA_WITH_NULL_MD5,              SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_MD5,  SSL3, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"NULL-SHA",             SSL_RSA_WITH_NULL_SHA,              SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA1, SSL3, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"DES-CBC-SHA",          SSL_RSA_WITH_DES_CBC_SHA,           SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"DES-CBC3-SHA",         SSL_RSA_WITH_3DES_EDE_CBC_SHA,      SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+	{"RC4-MD5",              SSL_RSA_WITH_RC4_128_MD5,           SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,    SSL3, SSL_MEDIUM,   SSL_ALLOWED},
+	{"RC4-SHA",              SSL_RSA_WITH_RC4_128_SHA,           SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1,   SSL3, SSL_MEDIUM,   SSL_ALLOWED},
+	{"EXP-RC2-CBC-MD5",      SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5,    SSL3, SSL_EXPORT40, SSL_ALLOWED},
+	{"EXP-RC4-MD5",          SSL_RSA_EXPORT_WITH_RC4_40_MD5,     SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5,    SSL3, SSL_EXPORT40, SSL_ALLOWED},
+	{"EDH-RSA-DES-CBC-SHA",  SSL_DHE_RSA_WITH_DES_CBC_SHA,       SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"EDH-RSA-DES-CBC3-SHA", SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,  SSL_kEDH|SSL_aRSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},
+	{"EDH-DSS-DES-CBC-SHA",  SSL_DHE_DSS_WITH_DES_CBC_SHA,       SSL_kEDH|SSL_aDSA|SSL_DES|SSL_SHA1,   SSL3, SSL_LOW,      SSL_ALLOWED},
+	{"EDH-DSS-DES-CBC3-SHA", SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,  SSL_kEDH|SSL_aDSA|SSL_3DES|SSL_SHA1,  SSL3, SSL_HIGH,     SSL_ALLOWED},

 	/* TLSv1 ciphers */
-	{"EXP1024-DES-CBC-SHA", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
-	{"EXP1024-RC4-SHA", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA, TLS1, 56, 56, SSL_EXPORT56, SSL_ALLOWED},
-	{"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 128, 128, SSL_HIGH, SSL_ALLOWED},
-	{"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA, SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA, TLS1, 256, 256, SSL_HIGH, SSL_ALLOWED},
+	{"EXP1024-DES-CBC-SHA",      TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,   SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1,         TLS1, SSL_EXPORT56, SSL_ALLOWED},
+	{"EXP1024-RC4-SHA",          TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,    SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1,         TLS1, SSL_EXPORT56, SSL_ALLOWED},
+	{"SEED-SHA",                 TLS_RSA_WITH_SEED_CBC_SHA,             SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1,        TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"AES128-SHA",               TLS_RSA_WITH_AES_128_CBC_SHA,          SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"AES256-SHA",               TLS_RSA_WITH_AES_256_CBC_SHA,          SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"CAMELLIA256-SHA",          TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,     SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"CAMELLIA128-SHA",          TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,     SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-AES128-SHA",       TLS_DHE_RSA_WITH_AES_128_CBC_SHA,      SSL_kEDH|SSL_aRSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-AES256-SHA",       TLS_DHE_RSA_WITH_AES_256_CBC_SHA,      SSL_kEDH|SSL_aRSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-CAMELLIA128-SHA",  TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-RSA-CAMELLIA256-SHA",  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aRSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-RC4-SHA",          TLS_DHE_DSS_WITH_RC4_128_SHA,          SSL_kEDH|SSL_aDSA|SSL_RC4|SSL_SHA1,         TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"DHE-DSS-AES128-SHA",       TLS_DHE_DSS_WITH_AES_128_CBC_SHA,      SSL_kEDH|SSL_aDSA|SSL_AES128|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-AES256-SHA",       TLS_DHE_DSS_WITH_AES_256_CBC_SHA,      SSL_kEDH|SSL_aDSA|SSL_AES256|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-CAMELLIA128-SHA",  TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA128|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"DHE-DSS-CAMELLIA256-SHA",  TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kEDH|SSL_aDSA|SSL_CAMELLIA256|SSL_SHA1, TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-NULL-SHA",        TLS_ECDH_RSA_WITH_NULL_SHA,            SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA1,      TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDH-RSA-RC4-SHA",         TLS_ECDH_RSA_WITH_RC4_128_SHA,         SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA1,        TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDH-RSA-DES-CBC3-SHA",    TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA1,       TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-AES128-SHA",      TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,     SSL_kECDH|SSL_aRSA|SSL_AES128|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-RSA-AES256-SHA",      TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,     SSL_kECDH|SSL_aRSA|SSL_AES256|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-NULL-SHA",      TLS_ECDH_ECDSA_WITH_NULL_SHA,          SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA1,    TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDH-ECDSA-RC4-SHA",       TLS_ECDH_ECDSA_WITH_RC4_128_SHA,       SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA1,      TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDH-ECDSA-DES-CBC3-SHA",  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,  SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA1,     TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-AES128-SHA",    TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,   SSL_kECDH|SSL_aECDSA|SSL_AES128|SSL_SHA1,   TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDH-ECDSA-AES256-SHA",    TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,   SSL_kECDH|SSL_aECDSA|SSL_AES256|SSL_SHA1,   TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-NULL-SHA",       TLS_ECDHE_RSA_WITH_NULL_SHA,           SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA1,     TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDHE-RSA-RC4-SHA",        TLS_ECDHE_RSA_WITH_RC4_128_SHA,        SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA1,       TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDHE-RSA-DES-CBC3-SHA",   TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,   SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA1,      TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-AES128-SHA",     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,    SSL_kECDHE|SSL_aRSA|SSL_AES128|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-RSA-AES256-SHA",     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,    SSL_kECDHE|SSL_aRSA|SSL_AES256|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-NULL-SHA",     TLS_ECDHE_ECDSA_WITH_NULL_SHA,         SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA1,   TLS1, SSL_NULL,     SSL_NOT_ALLOWED},
+	{"ECDHE-ECDSA-RC4-SHA",      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,      SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA1,     TLS1, SSL_MEDIUM,   SSL_ALLOWED},
+	{"ECDHE-ECDSA-DES-CBC3-SHA", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA1,    TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-AES128-SHA",   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,  SSL_kECDHE|SSL_aECDSA|SSL_AES128|SSL_SHA1,  TLS1, SSL_HIGH,     SSL_ALLOWED},
+	{"ECDHE-ECDSA-AES256-SHA",   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,  SSL_kECDHE|SSL_aECDSA|SSL_AES256|SSL_SHA1,  TLS1, SSL_HIGH,     SSL_ALLOWED},
 };

 #define ciphernum (sizeof(ciphers_def)/sizeof(cipher_properties))
@@ -577,6 +625,10 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
 					mask |= SSL_RSA;
 				} else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) {
 					mask |= SSL_eNULL;
+				} else if (!strcmp(cipher, "AES128")) {
+					mask |= SSL_AES128;
+				} else if (!strcmp(cipher, "AES256")) {
+					mask |= SSL_AES256;
 				} else if (!strcmp(cipher, "AES")) {
 					mask |= SSL_AES;
 				} else if (!strcmp(cipher, "3DES")) {
@@ -591,6 +643,24 @@ nss_parse_ciphers(const char *cipherstr, int cipher_list[ciphernum])
 					mask |= SSL_MD5;
 				} else if ((!strcmp(cipher, "SHA")) || (!strcmp(cipher, "SHA1"))) {
 					mask |= SSL_SHA1;
+				} else if (!strcmp(cipher, "EDH")) {
+					mask |= SSL_kEDH;
+				} else if (!strcmp(cipher, "DSS")) {
+					mask |= SSL_aDSA;
+				} else if (!strcmp(cipher, "CAMELLIA128")) {
+					mask |= SSL_CAMELLIA128;
+				} else if (!strcmp(cipher, "CAMELLIA256")) {
+					mask |= SSL_CAMELLIA256;
+				} else if (!strcmp(cipher, "CAMELLIA")) {
+					mask |= SSL_CAMELLIA;
+				} else if (!strcmp(cipher, "SEED")) {
+					mask |= SSL_SEED;
+				} else if (!strcmp(cipher, "ECDH")) {
+					mask |= SSL_kECDH;
+				} else if (!strcmp(cipher, "ECDHE")) {
+					mask |= SSL_kECDHE;
+				} else if (!strcmp(cipher, "ECDSA")) {
+					mask |= SSL_aECDSA;
 				} else if (!strcmp(cipher, "SSLv2")) {
 					protocol |= SSL2;
 				} else if (!strcmp(cipher, "SSLv3")) {
--
1.7.11.4


code:
The non-reentrant gethostbyXXXX() functions deadlock if called recursively, for
example if libldap needs to be initialized from within gethostbyXXXX() (which
actually happens if nss_ldap is used for hostname resolution and earlier
modules can't resolve the local host name), so use the reentrant versions of
the functions, even if we're not being compiled for use in libldap_r

Resolves: #179730
Author: Jeffery Layton <jlayton@redhat.com>

diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c
index 373c81c..a012062 100644
--- a/libraries/libldap/util-int.c
+++ b/libraries/libldap/util-int.c
@@ -52,8 +52,8 @@ extern int h_errno;
 #ifndef LDAP_R_COMPILE
 # undef HAVE_REENTRANT_FUNCTIONS
 # undef HAVE_CTIME_R
-# undef HAVE_GETHOSTBYNAME_R
-# undef HAVE_GETHOSTBYADDR_R
+/* # undef HAVE_GETHOSTBYNAME_R */
+/* # undef HAVE_GETHOSTBYADDR_R */

 #else
 # include <ldap_pvt_thread.h>
@@ -317,7 +317,7 @@ ldap_pvt_csnstr(char *buf, size_t len, unsigned int replica, unsigned int mod)
 #define BUFSTART (1024-32)
 #define BUFMAX (32*1024-32)

-#if defined(LDAP_R_COMPILE)
+#if defined(LDAP_R_COMPILE) || defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R)
 static char *safe_realloc( char **buf, int len );

 #if !(defined(HAVE_GETHOSTBYNAME_R) && defined(HAVE_GETHOSTBYADDR_R))


code:
Removes unnecessary linking of SQL libraries into slapd. This makes openldap-servers package
independent on libodbc. (SQL backend is packaged separately in openldap-servers-sql.)

--- openldap-2.4.24.orig/build/top.mk
+++ openldap-2.4.24/build/top.mk
@@ -201,7 +201,7 @@ SLAPD_SQL_LDFLAGS = @SLAPD_SQL_LDFLAGS@
 SLAPD_SQL_INCLUDES = @SLAPD_SQL_INCLUDES@
 SLAPD_SQL_LIBS = @SLAPD_SQL_LIBS@

-SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SQL_LDFLAGS@ @SLAPD_SQL_LIBS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)
+SLAPD_LIBS = @SLAPD_LIBS@ @SLAPD_PERL_LDFLAGS@ @SLAPD_SLP_LIBS@ @SLAPD_GMP_LIBS@ $(ICU_LIBS)

 # Our Defaults
 CC = $(AC_CC)


code:
From: Jan-Marek Glogowski <jan-marek.glogowski@muenchen.de>
Date: Tue, 18 May 2010 17:47:05 +0200
Subject: [PATCH] Switch to lt_dlopenadvise() to get RTLD_GLOBAL set.

Proof of concept for fixing http://bugs.debian.org/327585
(patch ported from freeradius bug http://bugs.debian.org/416266)

Resolves: #960048
---
--- openldap/servers/slapd/module.c.orig	2010-05-18 17:42:04.000000000 +0200
+++ openldap/servers/slapd/module.c	2010-05-18 17:45:46.000000000 +0200
@@ -117,6 +117,20 @@
 	return -1;	/* not found */
 }

+static lt_dlhandle slapd_lt_dlopenext_global( const char *filename )
+{
+	lt_dlhandle handle = 0;
+	lt_dladvise advise;
+
+	if (!lt_dladvise_init (&advise) && !lt_dladvise_ext (&advise)
+			&& !lt_dladvise_global (&advise))
+		handle = lt_dlopenadvise (filename, advise);
+
+	lt_dladvise_destroy (&advise);
+
+	return handle;
+}
+
 int module_load(const char* file_name, int argc, char *argv[])
 {
 	module_loaded_t *module;
@@ -180,7 +194,7 @@
 	 * to calling Debug. This is because Debug is a macro that expands
 	 * into multiple function calls.
 	 */
-	if ((module->lib = lt_dlopenext(file)) == NULL) {
+	if ((module->lib = slapd_lt_dlopenext_global(file)) == NULL) {
 		error = lt_dlerror();
 #ifdef HAVE_EBCDIC
 		strcpy( ebuf, error );


code:
allow unsetting of tls_* syncrepl options

Author: Patrick Monnerat <pm@datasphere.ch>
Upstream ITS: #7042
Resolves: #734187

diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 654a4bf..10b993b 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -735,27 +735,27 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 		return 0;
 	case LDAP_OPT_X_TLS_CACERTFILE:
 		if ( lo->ldo_tls_cacertfile ) LDAP_FREE( lo->ldo_tls_cacertfile );
-		lo->ldo_tls_cacertfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_cacertfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_CACERTDIR:
 		if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir );
-		lo->ldo_tls_cacertdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_cacertdir = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_CERTFILE:
 		if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile );
-		lo->ldo_tls_certfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_certfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_KEYFILE:
 		if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile );
-		lo->ldo_tls_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_keyfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_DHFILE:
 		if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile );
-		lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_dhfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_CRLFILE:	/* GnuTLS only */
 		if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile );
-		lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_crlfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;
 	case LDAP_OPT_X_TLS_REQUIRE_CERT:
 		if ( !arg ) return -1;
@@ -783,7 +783,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 #endif
 	case LDAP_OPT_X_TLS_CIPHER_SUITE:
 		if ( lo->ldo_tls_ciphersuite ) LDAP_FREE( lo->ldo_tls_ciphersuite );
-		lo->ldo_tls_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_ciphersuite = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		return 0;

 	case LDAP_OPT_X_TLS_PROTOCOL_MIN:
@@ -794,7 +794,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
 		if ( ld != NULL )
 			return -1;
 		if ( lo->ldo_tls_randfile ) LDAP_FREE (lo->ldo_tls_randfile );
-		lo->ldo_tls_randfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL;
+		lo->ldo_tls_randfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL;
 		break;
 	case LDAP_OPT_X_TLS_NEWCTX:
 		if ( !arg ) return -1;