code:
TLS: do not reuse tls_session if hostname check fails

If multiple servers are specified, the connection to the first one succeeds, and the hostname verification fails,
*tls_session is not dropped, but reused when connecting to the second server.

This is a problem with Mozilla NSS backend because another handshake cannot be performed on the same file descriptor.
From this reason, hostname checking was moved into ldap_int_tls_connect() before connection error handling.

Author: Jan Vcelak <jvcelak@redhat.com>
Upstream ITS: #7373
Resolves: #852476

diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 10b993b..a3cd590 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -320,7 +320,7 @@ update_flags( Sockbuf *sb, tls_session * ssl, int rc )
  */

 static int
-ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
+ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
 {
 	Sockbuf *sb = conn->lconn_sb;
 	int	err;
@@ -365,6 +365,10 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn )
 	errno = WSAGetLastError();
 #endif

+	if ( err == 0 ) {
+		err = ldap_pvt_tls_check_hostname( ld, ssl, host );
+	}
+
 	if ( err < 0 )
 	{
 		char buf[256], *msg;
@@ -495,7 +499,15 @@ ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in )
 {
 	tls_session *session = s;

-	return tls_imp->ti_session_chkhost( ld, session, name_in );
+	if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
+	    ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
+		ld->ld_errno = tls_imp->ti_session_chkhost( ld, session, name_in );
+		if (ld->ld_errno != LDAP_SUCCESS) {
+			return ld->ld_errno;
+		}
+	}
+
+	return LDAP_SUCCESS;
 }

 int
@@ -857,7 +869,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 #endif /* LDAP_USE_NON_BLOCKING_TLS */

 	ld->ld_errno = LDAP_SUCCESS;
-	ret = ldap_int_tls_connect( ld, conn );
+	ret = ldap_int_tls_connect( ld, conn, host );

 #ifdef LDAP_USE_NON_BLOCKING_TLS
 	while ( ret > 0 ) { /* this should only happen for non-blocking io */
@@ -878,7 +890,7 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 		} else {
 			/* ldap_int_poll called ldap_pvt_ndelay_off */
 			ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_SET_NONBLOCK, sb );
-			ret = ldap_int_tls_connect( ld, conn );
+			ret = ldap_int_tls_connect( ld, conn, host );
 			if ( ret > 0 ) { /* need to call tls_connect once more */
 				struct timeval curr_time_tv, delta_tv;

@@ -935,20 +947,6 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 		return (ld->ld_errno);
 	}

-	ssl = ldap_pvt_tls_sb_ctx( sb );
-	assert( ssl != NULL );
-
-	/*
-	 * compare host with name(s) in certificate
-	 */
-	if (ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER &&
-	    ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW) {
-		ld->ld_errno = ldap_pvt_tls_check_hostname( ld, ssl, host );
-		if (ld->ld_errno != LDAP_SUCCESS) {
-			return ld->ld_errno;
-		}
-	}
-
 	return LDAP_SUCCESS;
 }


code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<title>openldap.git - openldap</title>
<meta name='generator' content='cgit v0.9.2'/>
<meta name='robots' content='index, nofollow'/>
<link rel='stylesheet' type='text/css' href='/cgit-data/cgit.css'/>
<link rel='alternate' title='Atom feed' href='http://pkgs.fedoraproject.org/cgit/openldap.git/atom/openldap-userconfig-setgid.patch?h=master' type='application/atom+xml'/>

index : openldap.git	<form method='get' action=''>
<select name='h' onchange='this.form.submit();'>
<option value='FC-4-split'>FC-4-split</option>
<option value='f10'>f10</option>
<option value='f11'>f11</option>
<option value='f12'>f12</option>
<option value='f13'>f13</option>
<option value='f14'>f14</option>
<option value='f15'>f15</option>
<option value='f16'>f16</option>
<option value='f17'>f17</option>
<option value='f18'>f18</option>
<option value='f19'>f19</option>
<option value='f20'>f20</option>
<option value='f7'>f7</option>
<option value='f8'>f8</option>
<option value='f9'>f9</option>
<option value='master' selected='selected'>master</option>
<option value='private-moznss-f17'>private-moznss-f17</option>
</select> <input type='submit' name='' value='switch'/></form>

openldap	Jesse Keating

summaryrefslogtreecommitdiffstats	<form class='right' method='get' action='/cgit/openldap.git/log/openldap-userconfig-setgid.patch'>
<select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='text' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>

path: root/openldap-userconfig-setgid.patch

blob: 70f0d28ecab7c4152aa414adde93e462179ba0f8 (plain)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Normally, skips reading of user configuration file when running with different effective UID.
This patch adds the same behavior for GID.

Author: Nalin Dahyabhai <nalin@redhat.com>

diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index e6b17b4..fbf4829 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -678,7 +678,7 @@ void ldap_int_initialize( struct ldapoptions *gopts, int *dbglvl )
 	openldap_ldap_init_w_sysconf(LDAP_CONF_FILE);

 #ifdef HAVE_GETEUID
-	if ( geteuid() != getuid() )
+	if ( geteuid() != getuid() || getegid() != getgid() )
 		return;
 #endif

generated  by cgit v0.9.2 at 2014-01-09 14:22:50 (GMT)

repo_name: ayhanyalcinsoy/main


code:
#!/bin/sh
# Last update 20050401 - Christian Zoffoli <xmerlin@gentoo.org>

VERSION="0.3"
openssl="/usr/bin/openssl"
opensslopts=""
ldapconfdir="/etc/openldap/ssl"
pemfile="${ldapconfdir}/ldap.pem"
randfile="${ldapconfdir}/ldap.rand"
cfgfile="${ldapconfdir}/ldap.cfg"

function fixperms {
	chown root:ldap ${ldapconfdir} -R
	find ${ldapconfdir} -type f -exec chmod 640 \{\} \;
	chmod 750 ${ldapconfdir}
}

if [ ! -x ${openssl} ]; then
	exit 0
fi

if [ ! -d ${ldapconfdir} ]; then
	mkdir -p ${ldapconfdir}
fi

fixperms

if [ -f ${pemfile} ]; then
	echo "${pemfile} already exist, dying"
	exit 0
fi

dd if=/dev/urandom of=$randfile count=1 2>/dev/null

echo ""
echo "______________________________________________________________________${T_ME}"
echo ""
echo "Creating self-signed certificate -- Version ${VERSION}"
echo ""
echo "______________________________________________________________________${T_ME}"
echo ""

COMMONNAME=`hostname`
if [ ! -n "$COMMONNAME" ]; then
	COMMONNAME="www.openldap.org"
fi

if [ -f ${cfgfile} ]; then
	echo "${cfgfile} found, would you like to use it ? (y/n)"
	read answer

	case "$answer" in
		y|Y)
			opensslopts="-batch"
		;;
		n|N)
			cat >${cfgfile} <<EOT
			[ req ]
			default_bits                    = 1024
			distinguished_name              = req_DN
			RANDFILE                        = ${randfile}
			[ req_DN ]
			countryName                     = "1. Country Name             (2 letter code)"
			countryName_default             = "US"
			countryName_min			= 2
			countryName_max			= 2
			stateOrProvinceName		= "2. State or Province Name   (full name)    "
			stateOrProvinceName_default	= ""
			localityName                    = "3. Locality Name            (eg, city)     "
			localityName_default		= ""
			0.organizationName		= "4. Organization Name        (eg, company)  "
			0.organizationName_default	= "LDAP Server"
			organizationalUnitName		= "5. Organizational Unit Name (eg, section)  "
			organizationalUnitName_default	= "For testing purposes only"
			commonName			= "6. Common Name              (eg, CA name)  "
			commonName_max			= 64
			commonName_default		= "${COMMONNAME}"
			emailAddress			= "7. Email Address            (eg, name@FQDN)"
			emailAddress_max		= 40
			emailAddress_default		= ""
EOT
		;;
		*)
			echo "Wrong answer, retry!"
			exit 1
		;;
	esac
fi

echo ""

${openssl} req -config ${cfgfile} ${opensslopts} -new -rand ${randfile} -x509 -nodes -out ${pemfile} -keyout ${pemfile} -days 999999

if [ $? -ne 0 ]; then
	echo "cca:Error: Failed to generate certificate " 1>&2
	exit 1
else
	echo -e "\nCertificate creation done!"
fi

if [ -f ${randfile} ]; then
	rm -f ${randfile}
fi

if [ -f ${pemfile} ]; then
	fixperms
fi


code:
Submitted By:            Armin K. <krejzi at email dot com>
Date:                    2012-04-06
Initial Package Version: 2.4.30
Upstream Status:         BLFS Specific
Origin:                  Self
Description:             Patch changes various installation options, such as ldap database path,
                         configuration file options, slapd install location, etc.

--- openldap.orig/doc/man/man5/slapd-bdb.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd-bdb.5	2012-04-06 00:18:54.171136608 +0200
@@ -131,7 +131,7 @@
 associated indexes live.
 A separate directory must be specified for each database.
 The default is
-.BR LOCALSTATEDIR/openldap\-data .
+.BR LOCALSTATEDIR/lib/openldap .
 .TP
 .B dirtyread
 Allow reads of modified but not yet committed data.
--- openldap.orig/doc/man/man5/slapd.conf.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd.conf.5	2012-04-06 00:18:54.174136671 +0200
@@ -1987,7 +1987,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-directory LOCALSTATEDIR/openldap\-data
+directory LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 index     objectClass  eq
 index     cn,sn,mail   pres,eq,approx,sub
--- openldap.orig/doc/man/man5/slapd-config.5	2012-02-29 18:37:09.000000000 +0100
+++ openldap/doc/man/man5/slapd-config.5	2012-04-06 00:18:54.194137078 +0200
@@ -2029,7 +2029,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-olcDbDirectory: LOCALSTATEDIR/openldap\-data
+olcDbDirectory: LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 olcDbIndex:     objectClass  eq
 olcDbIndex:     cn,sn,mail   pres,eq,approx,sub
--- openldap.orig/include/ldap_defaults.h	2012-02-29 18:37:09.000000000 +0100
+++ openldap/include/ldap_defaults.h	2012-04-06 00:18:54.200137199 +0200
@@ -39,7 +39,7 @@
 #define LDAP_ENV_PREFIX "LDAP"

 /* default ldapi:// socket */
-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"
+#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"

 /*
  * SLAPD DEFINITIONS
@@ -47,7 +47,7 @@
 	/* location of the default slapd config file */
 #define SLAPD_DEFAULT_CONFIGFILE	LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf"
 #define SLAPD_DEFAULT_CONFIGDIR		LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d"
-#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "openldap-data"
+#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap"
 #define SLAPD_DEFAULT_DB_MODE		0600
 #define SLAPD_DEFAULT_UCDATA		LDAP_DATADIR LDAP_DIRSEP "ucdata"
 	/* default max deref depth for aliases */
--- openldap.orig/libraries/liblber/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/liblber/Makefile.in	2012-04-06 00:18:54.204137280 +0200
@@ -48,6 +48,6 @@

 install-local: FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

--- openldap.orig/libraries/libldap/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/libldap/Makefile.in	2012-04-06 00:18:54.204137280 +0200
@@ -68,7 +68,7 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)
 	-$(MKDIR) $(DESTDIR)$(sysconfdir)
 	@for i in $(CFFILES); do \
--- openldap.orig/libraries/libldap_r/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-06 00:18:54.208137362 +0200
@@ -83,6 +83,6 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

--- openldap.orig/servers/slapd/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/Makefile.in	2012-04-06 00:18:54.208137362 +0200
@@ -370,10 +370,10 @@
 	install-conf install-db-config install-schema install-tools

 install-slapd: FORCE
-	-$(MKDIR) $(DESTDIR)$(libexecdir)
+	-$(MKDIR) $(DESTDIR)$(sbindir)
 	-$(MKDIR) $(DESTDIR)$(localstatedir)/run
 	$(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \
-		slapd$(EXEEXT) $(DESTDIR)$(libexecdir)
+		slapd$(EXEEXT) $(DESTDIR)$(sbindir)
 	@for i in $(SUBDIRS); do \
 	    if test -d $$i && test -f $$i/Makefile ; then \
 		echo; echo "  cd $$i; $(MAKE) $(MFLAGS) install"; \
@@ -439,9 +439,9 @@

 install-db-config: FORCE
 	@-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir)
-	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data
+	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
-		$(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example
+		$(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
 		$(DESTDIR)$(sysconfdir)/DB_CONFIG.example

@@ -449,6 +449,6 @@
 	-$(MKDIR) $(DESTDIR)$(sbindir)
 	for i in $(SLAPTOOLS); do \
 		$(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
-		$(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+		$(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
 	done

--- openldap.orig/servers/slapd/slapd.conf	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/slapd.conf	2012-04-06 00:21:12.891992222 +0200
@@ -10,14 +10,12 @@
 # service AND an understanding of referrals.
 #referral	ldap://root.openldap.org

-pidfile		%LOCALSTATEDIR%/run/slapd.pid
-argsfile	%LOCALSTATEDIR%/run/slapd.args
+pidfile		%LOCALSTATEDIR%/run/openldap/slapd.pid
+argsfile	%LOCALSTATEDIR%/run/openldap/slapd.args

 # Load dynamic backend modules:
-# modulepath	%MODULEDIR%
-# moduleload	back_bdb.la
-# moduleload	back_hdb.la
-# moduleload	back_ldap.la
+modulepath	%MODULEDIR%
+moduleload	back_bdb

 # Sample security restrictions
 #	Require integrity protection (prevent hijacking)
@@ -46,20 +44,26 @@
 #
 # rootdn can always read and write EVERYTHING!

+# Specific Backend Directives for bdb:
+backend         bdb
+
 #######################################################################
 # BDB database definitions
 #######################################################################

 database	bdb
 suffix		"dc=my-domain,dc=com"
-rootdn		"cn=Manager,dc=my-domain,dc=com"
+#rootdn		"cn=Manager,dc=my-domain,dc=com"
+
 # Cleartext passwords, especially for the rootdn, should
 # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
 # Use of strong authentication encouraged.
-rootpw		secret
+#rootpw		secret
+
 # The database directory MUST exist prior to running slapd AND
 # should only be accessible by the slapd and slap tools.
 # Mode 700 recommended.
-directory	%LOCALSTATEDIR%/openldap-data
+directory	%LOCALSTATEDIR%/lib/openldap
+
 # Indices to maintain
 index	objectClass	eq
--- openldap.orig/servers/slapd/slapi/Makefile.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/servers/slapd/slapi/Makefile.in	2012-04-06 00:18:54.210137403 +0200
@@ -46,6 +46,6 @@
 install-local: FORCE
 	if test "$(BUILD_MOD)" = "yes"; then \
 		$(MKDIR) $(DESTDIR)$(libdir); \
-		$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \
+		$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \
 	fi


code:
Submitted By:            Armin K. <krejzi at email dot com>
Date:                    2012-04-06
Initial Package Version: 2.4.30
Upstream Status:         Unknown
Origin:                  Debian
Description:             Patch from evolution-exchange (2.10.3).  The ldap_ntlm_bind function is
                         actually called by evolution-data-server, checked at version 1.12.2.
                         Without this patch, the Exchange addressbook integration uses simple binds
                         with cleartext passwords.

--- openldap.orig/include/ldap.h	2012-02-29 18:37:09.000000000 +0100
+++ openldap/include/ldap.h	2012-04-01 00:20:00.059827789 +0200
@@ -2517,5 +2517,25 @@
 	LDAPControl	**ctrls,
 	LDAPDerefRes	**drp ));

+/*
+ * hacks for NTLM
+ */
+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
+#define LDAP_AUTH_NTLM_RESPONSE  ((ber_tag_t) 0x8bU)
+LDAP_F( int )
+ldap_ntlm_bind LDAP_P((
+      LDAP    *ld,
+      LDAP_CONST char *dn,
+      ber_tag_t tag,
+      struct berval *cred,
+      LDAPControl **sctrls,
+      LDAPControl **cctrls,
+      int   *msgidp ));
+LDAP_F( int )
+ldap_parse_ntlm_bind_result LDAP_P((
+      LDAP    *ld,
+      LDAPMessage *res,
+      struct berval *challenge));
+
 LDAP_END_DECL
 #endif /* _LDAP_H */
--- openldap.orig/libraries/libldap/Makefile.in	2012-04-01 00:18:54.233419658 +0200
+++ openldap/libraries/libldap/Makefile.in	2012-04-01 00:20:00.060827810 +0200
@@ -27,7 +27,7 @@
 	init.c options.c print.c string.c util-int.c schema.c \
 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
 	tls2.c tls_o.c tls_g.c tls_m.c \
-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
 	assertion.c deref.c ldif.c fetch.c

 OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
@@ -40,7 +40,7 @@
 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
 	assertion.lo deref.lo ldif.lo fetch.lo

 LDAP_INCDIR= ../../include
--- openldap.orig/libraries/libldap/ntlm.c	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/libldap/ntlm.c	2012-04-01 00:20:00.059827789 +0200
@@ -0,0 +1,138 @@
+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
+/*
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
+
+/* Mostly copied from sasl.c */
+
+#include "portable.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/errno.h>
+
+#include "ldap-int.h"
+
+int
+ldap_ntlm_bind(
+ LDAP    *ld,
+ LDAP_CONST char *dn,
+ ber_tag_t tag,
+ struct berval *cred,
+ LDAPControl **sctrls,
+ LDAPControl **cctrls,
+ int   *msgidp )
+{
+ BerElement  *ber;
+ int rc;
+ ber_int_t id;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( msgidp != NULL );
+
+ if( msgidp == NULL ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ /* create a message to send */
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ assert( LBER_VALID( ber ) );
+
+ LDAP_NEXT_MSGID( ld, id );
+ rc = ber_printf( ber, "{it{istON}" /*}*/,
+      id, LDAP_REQ_BIND,
+      ld->ld_version, dn, tag,
+      cred );
+
+ /* Put Server Controls */
+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
+   ld->ld_errno = LDAP_ENCODING_ERROR;
+   ber_free( ber, 1 );
+   return ld->ld_errno;
+ }
+
+ /* send the message */
+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
+
+ if(*msgidp < 0)
+   return ld->ld_errno;
+
+ return LDAP_SUCCESS;
+}
+
+int
+ldap_parse_ntlm_bind_result(
+ LDAP    *ld,
+ LDAPMessage *res,
+ struct berval *challenge)
+{
+ ber_int_t errcode;
+ ber_tag_t tag;
+ BerElement  *ber;
+ ber_len_t len;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( res != NULL );
+
+ if ( ld == NULL || res == NULL ) {
+   return LDAP_PARAM_ERROR;
+ }
+
+ if( res->lm_msgtype != LDAP_RES_BIND ) {
+   ld->ld_errno = LDAP_PARAM_ERROR;
+   return ld->ld_errno;
+ }
+
+ if ( ld->ld_error ) {
+   LDAP_FREE( ld->ld_error );
+   ld->ld_error = NULL;
+ }
+ if ( ld->ld_matched ) {
+   LDAP_FREE( ld->ld_matched );
+   ld->ld_matched = NULL;
+ }
+
+ /* parse results */
+
+ ber = ber_dup( res->lm_ber );
+
+ if( ber == NULL ) {
+   ld->ld_errno = LDAP_NO_MEMORY;
+   return ld->ld_errno;
+ }
+
+ tag = ber_scanf( ber, "{ioa" /*}*/,
+      &errcode, challenge, &ld->ld_error );
+ ber_free( ber, 0 );
+
+ if( tag == LBER_ERROR ) {
+   ld->ld_errno = LDAP_DECODING_ERROR;
+   return ld->ld_errno;
+ }
+
+ ld->ld_errno = errcode;
+
+ return( ld->ld_errno );
+}
+
--- openldap.orig/libraries/libldap_r/Makefile.in	2012-04-01 00:18:54.234419703 +0200
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-01 00:20:00.060827810 +0200
@@ -29,7 +29,7 @@
 	init.c options.c print.c string.c util-int.c schema.c \
 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
 	tls2.c tls_o.c tls_g.c tls_m.c \
-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
 	assertion.c deref.c ldif.c fetch.c
 SRCS	= threads.c rdwr.c rmutex.c tpool.c rq.c \
 	thr_posix.c thr_cthreads.c thr_thr.c thr_nt.c \
@@ -47,7 +47,7 @@
 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
 	assertion.lo deref.lo ldif.lo fetch.lo

 LDAP_INCDIR= ../../include


code:
Submitted By:            Armin K. <krejzi at email dot com>
Date:                    2012-04-06
Initial Package Version: 2.4.30
Upstream Status:         Unknown
Origin:                  Debian
Description:             This patch enables symbol versioning in ldap libraries. Without this
                         patch some applications might generate a warning about missing symbol
                         versions.

--- openldap.orig/build/openldap.m4	2012-02-29 18:37:09.000000000 +0100
+++ openldap/build/openldap.m4	2012-04-01 17:29:50.973881411 +0200
@@ -1136,3 +1136,54 @@
 #endif
 	], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])])
 ])
+
+dnl ====================================================================
+dnl check for symbol versioning support
+AC_DEFUN([OL_SYMBOL_VERSIONING],
+[AC_CACHE_CHECK([for .symver assembler directive],
+	[ol_cv_asm_symver_directive],[
+cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+  ol_cv_asm_symver_directive=yes
+else
+  ol_cv_asm_symver_directive=no
+fi
+rm -f conftest*])
+AC_CACHE_CHECK([for ld --version-script],
+	[ol_cv_ld_version_script_option],[
+if test $ol_cv_asm_symver_directive = yes; then
+  cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+  cat > conftest.map <<EOF
+VERS_1 {
+	global: sym;
+};
+
+VERS_2 {
+	global: sym;
+} VERS_1;
+EOF
+  if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+    if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared
+                                                 -o conftest.so conftest.o
+                                                 -Wl,--version-script,conftest.map
+                       1>&AS_MESSAGE_LOG_FD]);
+    then
+      ol_cv_ld_version_script_option=yes
+    else
+      ol_cv_ld_version_script_option=no
+    fi
+  else
+    ol_cv_ld_version_script_option=no
+  fi
+else
+  ol_cv_ld_version_script_option=no
+fi
+rm -f conftest*])])
--- openldap.orig/build/top.mk	2012-02-29 18:37:09.000000000 +0100
+++ openldap/build/top.mk	2012-04-01 17:29:50.972881390 +0200
@@ -104,6 +104,9 @@
 # LINK_LIBS referenced in library and module link commands.
 LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)

+# option to pass to $(CC) to support library symbol versioning, if any
+VERSION_OPTION = @VERSION_OPTION@
+
 LTSTATIC = @LTSTATIC@

 LTLINK   = $(LIBTOOL) --mode=link \
@@ -113,7 +116,7 @@
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c

 LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \
-	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB)
+	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS)

 LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c
--- openldap.orig/configure.in	2012-02-29 18:37:09.000000000 +0100
+++ openldap/configure.in	2012-04-01 17:29:50.981881580 +0200
@@ -1907,6 +1907,13 @@
 fi
 AC_SUBST(LTSTATIC)dnl

+VERSION_OPTION=""
+OL_SYMBOL_VERSIONING
+if test $ol_cv_ld_version_script_option = yes ; then
+  VERSION_OPTION="-Wl,--version-script="
+fi
+AC_SUBST(VERSION_OPTION)
+
 dnl ----------------------------------------------------------------
 if test $ol_enable_wrappers != no ; then
 	AC_CHECK_HEADERS(tcpd.h,[
--- openldap.orig/libraries/liblber/liblber.map	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/liblber/liblber.map	2012-04-01 17:29:50.983881622 +0200
@@ -0,0 +1,8 @@
+OPENLDAP_2.4_2 {
+  global:
+    ber_*;
+    der_alloc;
+    lutil_*;
+  local:
+    *;
+};
--- openldap.orig/libraries/liblber/Makefile.in	2012-04-01 17:27:12.042526978 +0200
+++ openldap/libraries/liblber/Makefile.in	2012-04-01 17:29:50.982881601 +0200
@@ -38,6 +38,9 @@
 XXLIBS =
 NT_LINK_LIBS = $(AC_LIBS)
 UNIX_LINK_LIBS = $(AC_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map"
+endif

 dtest:    $(XLIBS) dtest.o
 	$(LTLINK) -o $@ dtest.o $(LIBS)
--- openldap.orig/libraries/libldap/libldap.map	1970-01-01 01:00:00.000000000 +0100
+++ openldap/libraries/libldap/libldap.map	2012-04-01 17:29:50.981881580 +0200
@@ -0,0 +1,7 @@
+OPENLDAP_2.4_2 {
+  global:
+    ldap_*;
+    ldif_*;
+  local:
+    *;
+};
--- openldap.orig/libraries/libldap/Makefile.in	2012-04-01 17:27:12.043527000 +0200
+++ openldap/libraries/libldap/Makefile.in	2012-04-01 17:29:50.982881601 +0200
@@ -52,6 +52,9 @@
 XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map
+endif

 apitest:	$(XLIBS) apitest.o
 	$(LTLINK) -o $@ apitest.o $(LIBS)
--- openldap.orig/libraries/libldap_r/Makefile.in	2012-04-01 17:27:12.043527000 +0200
+++ openldap/libraries/libldap_r/Makefile.in	2012-04-01 17:29:50.971881369 +0200
@@ -61,6 +61,9 @@
 XXXLIBS = $(LTHREAD_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map"
+endif

 .links : Makefile
 	@for i in $(XXSRCS); do \


code:
Submitted by:            Bruce Dubbs <bdubbs at linuxfromscratch.org>
Date:                    2012-03-26
Initial Package Version: 2.4.40
Upstream Status:         BLFS Specific
Origin:                  Armin K. <krejzi at email dot com> and Debian
Comment:                 Rediffed by Fernando de Oliveira <famobr at yahoo dot
                         com dot br> for version 2.4.44 - 2016.02.06
                         Rediffed by Pierre Labastie <pierre dot labastie at
                         neuf dot fr> to add mdb backend and slapd.ldif. See
                         ticket #7394 - 2016.02.24
Description:             Consolidate earlier patches to:
 1. Update various installation options, such as ldap database path,
    configuration file options, slapd install location, etc.
 2. Remove reference to bdb module
 3. Enables symbol versioning in ldap libraries. Without these changes
    some applications might generate a warning about missing symbol versions.

diff -Naur openldap-2.4.40.orig/build/openldap.m4 openldap-2.4.40/build/openldap.m4
--- openldap-2.4.40.orig/build/openldap.m4	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/build/openldap.m4	2015-03-26 15:37:39.801077750 -0500
@@ -1142,3 +1142,54 @@
 #endif
 	], [ol_cv_ssl_crl_compat=yes], [ol_cv_ssl_crl_compat=no])])
 ])
+
+dnl ====================================================================
+dnl check for symbol versioning support
+AC_DEFUN([OL_SYMBOL_VERSIONING],
+[AC_CACHE_CHECK([for .symver assembler directive],
+	[ol_cv_asm_symver_directive],[
+cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+  ol_cv_asm_symver_directive=yes
+else
+  ol_cv_asm_symver_directive=no
+fi
+rm -f conftest*])
+AC_CACHE_CHECK([for ld --version-script],
+	[ol_cv_ld_version_script_option],[
+if test $ol_cv_asm_symver_directive = yes; then
+  cat > conftest.s <<EOF
+${libc_cv_dot_text}
+_sym:
+.symver _sym,sym@VERS
+EOF
+  cat > conftest.map <<EOF
+VERS_1 {
+	global: sym;
+};
+
+VERS_2 {
+	global: sym;
+} VERS_1;
+EOF
+  if ${CC-cc} -c $ASFLAGS conftest.s 1>&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD; then
+    if AC_TRY_COMMAND([${CC-cc} $CFLAGS $LDFLAGS -shared
+                                                 -o conftest.so conftest.o
+                                                 -Wl,--version-script,conftest.map
+                       1>&AS_MESSAGE_LOG_FD]);
+    then
+      ol_cv_ld_version_script_option=yes
+    else
+      ol_cv_ld_version_script_option=no
+    fi
+  else
+    ol_cv_ld_version_script_option=no
+  fi
+else
+  ol_cv_ld_version_script_option=no
+fi
+rm -f conftest*])])
diff -Naur openldap-2.4.40.orig/build/top.mk openldap-2.4.40/build/top.mk
--- openldap-2.4.40.orig/build/top.mk	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/build/top.mk	2015-03-26 15:37:39.801077750 -0500
@@ -104,6 +104,9 @@
 # LINK_LIBS referenced in library and module link commands.
 LINK_LIBS = $(MOD_LIBS) $(@PLAT@_LINK_LIBS)

+# option to pass to $(CC) to support library symbol versioning, if any
+VERSION_OPTION = @VERSION_OPTION@
+
 LTSTATIC = @LTSTATIC@

 LTLINK   = $(LIBTOOL) --mode=link \
@@ -113,7 +116,7 @@
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(LIB_DEFS) -c

 LTLINK_LIB = $(LIBTOOL) $(LTONLY_LIB) --mode=link \
-	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB)
+	$(CC) $(LT_CFLAGS) $(LDFLAGS) $(LTFLAGS_LIB) $(VERSION_FLAGS)

 LTCOMPILE_MOD = $(LIBTOOL) $(LTONLY_MOD) --mode=compile \
 	$(CC) $(LT_CFLAGS) $(LT_CPPFLAGS) $(MOD_DEFS) -c
diff -Naur openldap-2.4.40.orig/configure.in openldap-2.4.40/configure.in
--- openldap-2.4.40.orig/configure.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/configure.in	2015-03-26 15:37:39.801077750 -0500
@@ -1916,6 +1916,13 @@
 fi
 AC_SUBST(LTSTATIC)dnl

+VERSION_OPTION=""
+OL_SYMBOL_VERSIONING
+if test $ol_cv_ld_version_script_option = yes ; then
+  VERSION_OPTION="-Wl,--version-script="
+fi
+AC_SUBST(VERSION_OPTION)
+
 dnl ----------------------------------------------------------------
 if test $ol_enable_wrappers != no ; then
 	AC_CHECK_HEADERS(tcpd.h,[
diff -Naur openldap-2.4.40.orig/doc/man/man5/slapd-bdb.5 openldap-2.4.40/doc/man/man5/slapd-bdb.5
--- openldap-2.4.40.orig/doc/man/man5/slapd-bdb.5	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/doc/man/man5/slapd-bdb.5	2015-03-26 15:36:59.637464038 -0500
@@ -135,7 +135,7 @@
 associated indexes live.
 A separate directory must be specified for each database.
 The default is
-.BR LOCALSTATEDIR/openldap\-data .
+.BR LOCALSTATEDIR/lib/openldap .
 .TP
 .B dirtyread
 Allow reads of modified but not yet committed data.
diff -Naur openldap-2.4.40.orig/doc/man/man5/slapd-config.5 openldap-2.4.40/doc/man/man5/slapd-config.5
--- openldap-2.4.40.orig/doc/man/man5/slapd-config.5	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/doc/man/man5/slapd-config.5	2015-03-26 15:36:59.638464004 -0500
@@ -2051,7 +2051,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-olcDbDirectory: LOCALSTATEDIR/openldap\-data
+olcDbDirectory: LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 olcDbIndex:     objectClass  eq
 olcDbIndex:     cn,sn,mail   pres,eq,approx,sub
diff -Naur openldap-2.4.40.orig/doc/man/man5/slapd.conf.5 openldap-2.4.40/doc/man/man5/slapd.conf.5
--- openldap-2.4.40.orig/doc/man/man5/slapd.conf.5	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/doc/man/man5/slapd.conf.5	2015-03-26 15:36:59.638464004 -0500
@@ -2021,7 +2021,7 @@
 # The database directory MUST exist prior to
 # running slapd AND should only be accessible
 # by the slapd/tools. Mode 0700 recommended.
-directory LOCALSTATEDIR/openldap\-data
+directory LOCALSTATEDIR/lib/openldap
 # Indices to maintain
 index     objectClass  eq
 index     cn,sn,mail   pres,eq,approx,sub
diff -Naur openldap-2.4.40.orig/include/ldap_defaults.h openldap-2.4.40/include/ldap_defaults.h
--- openldap-2.4.40.orig/include/ldap_defaults.h	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/include/ldap_defaults.h	2015-03-26 15:36:59.638464004 -0500
@@ -39,7 +39,7 @@
 #define LDAP_ENV_PREFIX "LDAP"

 /* default ldapi:// socket */
-#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"
+#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"

 /*
  * SLAPD DEFINITIONS
@@ -47,7 +47,7 @@
 	/* location of the default slapd config file */
 #define SLAPD_DEFAULT_CONFIGFILE	LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.conf"
 #define SLAPD_DEFAULT_CONFIGDIR		LDAP_SYSCONFDIR LDAP_DIRSEP "slapd.d"
-#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "openldap-data"
+#define SLAPD_DEFAULT_DB_DIR		LDAP_RUNDIR LDAP_DIRSEP "lib" LDAP_DIRSEP "openldap"
 #define SLAPD_DEFAULT_DB_MODE		0600
 #define SLAPD_DEFAULT_UCDATA		LDAP_DATADIR LDAP_DIRSEP "ucdata"
 	/* default max deref depth for aliases */
diff -Naur openldap-2.4.40.orig/libraries/liblber/Makefile.in openldap-2.4.40/libraries/liblber/Makefile.in
--- openldap-2.4.40.orig/libraries/liblber/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/libraries/liblber/Makefile.in	2015-03-26 15:37:39.801077750 -0500
@@ -38,6 +38,9 @@
 XXLIBS =
 NT_LINK_LIBS = $(AC_LIBS)
 UNIX_LINK_LIBS = $(AC_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(srcdir)/liblber.map"
+endif

 dtest:    $(XLIBS) dtest.o
 	$(LTLINK) -o $@ dtest.o $(LIBS)
@@ -48,6 +51,6 @@

 install-local: FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

diff -Naur openldap-2.4.40.orig/libraries/liblber/liblber.map openldap-2.4.40/libraries/liblber/liblber.map
--- openldap-2.4.40.orig/libraries/liblber/liblber.map	1969-12-31 18:00:00.000000000 -0600
+++ openldap-2.4.40/libraries/liblber/liblber.map	2015-03-26 15:37:39.801077750 -0500
@@ -0,0 +1,8 @@
+OPENLDAP_2.4_2 {
+  global:
+    ber_*;
+    der_alloc;
+    lutil_*;
+  local:
+    *;
+};
diff -Naur openldap-2.4.40.orig/libraries/libldap/Makefile.in openldap-2.4.40/libraries/libldap/Makefile.in
--- openldap-2.4.40.orig/libraries/libldap/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/libraries/libldap/Makefile.in	2015-03-26 15:37:39.802077716 -0500
@@ -52,6 +52,9 @@
 XXLIBS = $(SECURITY_LIBS) $(LUTIL_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = $(VERSION_OPTION)$(srcdir)/libldap.map
+endif

 apitest:	$(XLIBS) apitest.o
 	$(LTLINK) -o $@ apitest.o $(LIBS)
@@ -68,7 +71,7 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)
 	-$(MKDIR) $(DESTDIR)$(sysconfdir)
 	@for i in $(CFFILES); do \
diff -Naur openldap-2.4.40.orig/libraries/libldap/libldap.map openldap-2.4.40/libraries/libldap/libldap.map
--- openldap-2.4.40.orig/libraries/libldap/libldap.map	1969-12-31 18:00:00.000000000 -0600
+++ openldap-2.4.40/libraries/libldap/libldap.map	2015-03-26 15:37:39.802077716 -0500
@@ -0,0 +1,7 @@
+OPENLDAP_2.4_2 {
+  global:
+    ldap_*;
+    ldif_*;
+  local:
+    *;
+};
diff -Naur openldap-2.4.40.orig/libraries/libldap_r/Makefile.in openldap-2.4.40/libraries/libldap_r/Makefile.in
--- openldap-2.4.40.orig/libraries/libldap_r/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/libraries/libldap_r/Makefile.in	2015-03-26 15:37:39.802077716 -0500
@@ -61,6 +61,9 @@
 XXXLIBS = $(LTHREAD_LIBS)
 NT_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS)
 UNIX_LINK_LIBS = $(LDAP_LIBLBER_LA) $(AC_LIBS) $(SECURITY_LIBS) $(LTHREAD_LIBS)
+ifneq (,$(VERSION_OPTION))
+  VERSION_FLAGS = "$(VERSION_OPTION)$(XXDIR)/libldap.map"
+endif

 .links : Makefile
 	@for i in $(XXSRCS); do \
@@ -83,6 +86,6 @@

 install-local: $(CFFILES) FORCE
 	-$(MKDIR) $(DESTDIR)$(libdir)
-	$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir)
+	$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir)
 	$(LTFINISH) $(DESTDIR)$(libdir)

diff -Naur openldap-2.4.40.orig/servers/slapd/Makefile.in openldap-2.4.40/servers/slapd/Makefile.in
--- openldap-2.4.40.orig/servers/slapd/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/servers/slapd/Makefile.in	2015-03-26 15:36:59.639463969 -0500
@@ -376,10 +376,10 @@
 	install-conf install-dbc-maybe install-schema install-tools

 install-slapd: FORCE
-	-$(MKDIR) $(DESTDIR)$(libexecdir)
+	-$(MKDIR) $(DESTDIR)$(sbindir)
 	-$(MKDIR) $(DESTDIR)$(localstatedir)/run
 	$(LTINSTALL) $(INSTALLFLAGS) $(STRIP) -m 755 \
-		slapd$(EXEEXT) $(DESTDIR)$(libexecdir)
+		slapd$(EXEEXT) $(DESTDIR)$(sbindir)
 	@for i in $(SUBDIRS); do \
 	    if test -d $$i && test -f $$i/Makefile ; then \
 		echo; echo "  cd $$i; $(MAKE) $(MFLAGS) install"; \
@@ -445,9 +445,9 @@

 install-db-config: FORCE
 	@-$(MKDIR) $(DESTDIR)$(localstatedir) $(DESTDIR)$(sysconfdir)
-	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/openldap-data
+	@-$(INSTALL) -m 700 -d $(DESTDIR)$(localstatedir)/lib/openldap
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
-		$(DESTDIR)$(localstatedir)/openldap-data/DB_CONFIG.example
+		$(DESTDIR)$(localstatedir)/lib/openldap/DB_CONFIG.example
 	$(INSTALL) $(INSTALLFLAGS) -m 600 $(srcdir)/DB_CONFIG \
 		$(DESTDIR)$(sysconfdir)/DB_CONFIG.example

@@ -455,6 +455,6 @@
 	-$(MKDIR) $(DESTDIR)$(sbindir)
 	for i in $(SLAPTOOLS); do \
 		$(RM) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
-		$(LN_S) -f $(DESTDIR)$(libexecdir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
+		$(LN_S) -f $(DESTDIR)$(sbindir)/slapd$(EXEEXT) $(DESTDIR)$(sbindir)/$$i$(EXEEXT); \
 	done

diff -Naur openldap-2.4.44.orig/servers/slapd/slapd.conf openldap-2.4.44/servers/slapd/slapd.conf
--- openldap-2.4.44.orig/servers/slapd/slapd.conf	2016-02-06 00:57:45.000000000 +0100
+++ openldap-2.4.44/servers/slapd/slapd.conf	2016-02-22 23:01:47.681372594 +0100
@@ -10,12 +10,12 @@
 # service AND an understanding of referrals.
 #referral	ldap://root.openldap.org

-pidfile		%LOCALSTATEDIR%/run/slapd.pid
-argsfile	%LOCALSTATEDIR%/run/slapd.args
+pidfile		%LOCALSTATEDIR%/run/openldap/slapd.pid
+argsfile	%LOCALSTATEDIR%/run/openldap/slapd.args

 # Load dynamic backend modules:
-# modulepath	%MODULEDIR%
-# moduleload	back_mdb.la
+modulepath	%MODULEDIR%
+moduleload	back_mdb.la
 # moduleload	back_ldap.la

 # Sample security restrictions
@@ -60,6 +60,6 @@
 # The database directory MUST exist prior to running slapd AND
 # should only be accessible by the slapd and slap tools.
 # Mode 700 recommended.
-directory	%LOCALSTATEDIR%/openldap-data
+directory	%LOCALSTATEDIR%/lib/openldap
 # Indices to maintain
 index	objectClass	eq
diff -Naur openldap-2.4.44.orig/servers/slapd/slapd.ldif openldap-2.4.44/servers/slapd/slapd.ldif
--- openldap-2.4.44.orig/servers/slapd/slapd.ldif	2016-02-06 00:57:45.000000000 +0100
+++ openldap-2.4.44/servers/slapd/slapd.ldif	2016-02-22 22:59:57.824364446 +0100
@@ -9,8 +9,8 @@
 #
 # Define global ACLs to disable default read access.
 #
-olcArgsFile: %LOCALSTATEDIR%/run/slapd.args
-olcPidFile: %LOCALSTATEDIR%/run/slapd.pid
+olcArgsFile: %LOCALSTATEDIR%/run/openldap/slapd.args
+olcPidFile: %LOCALSTATEDIR%/run/openldap/slapd.pid
 #
 # Do not enable referrals until AFTER you have a working directory
 # service AND an understanding of referrals.
@@ -26,10 +26,11 @@
 #
 # Load dynamic backend modules:
 #
-#dn: cn=module,cn=config
-#objectClass: olcModuleList
-#cn: module
-#olcModulepath:	%MODULEDIR%
+dn: cn=module,cn=config
+objectClass: olcModuleList
+cn: module
+olcModulepath:	%MODULEDIR%
+olcModuleload: back_mdb.la
 #olcModuleload:	back_bdb.la
 #olcModuleload:	back_hdb.la
 #olcModuleload:	back_ldap.la
@@ -90,6 +91,6 @@
 # The database directory MUST exist prior to running slapd AND
 # should only be accessible by the slapd and slap tools.
 # Mode 700 recommended.
-olcDbDirectory:	%LOCALSTATEDIR%/openldap-data
+olcDbDirectory:	%LOCALSTATEDIR%/lib/openldap
 # Indices to maintain
 olcDbIndex: objectClass eq
diff -Naur openldap-2.4.40.orig/servers/slapd/slapi/Makefile.in openldap-2.4.40/servers/slapd/slapi/Makefile.in
--- openldap-2.4.40.orig/servers/slapd/slapi/Makefile.in	2014-09-18 20:48:49.000000000 -0500
+++ openldap-2.4.40/servers/slapd/slapi/Makefile.in	2015-03-26 15:36:59.639463969 -0500
@@ -46,6 +46,6 @@
 install-local: FORCE
 	if test "$(BUILD_MOD)" = "yes"; then \
 		$(MKDIR) $(DESTDIR)$(libdir); \
-		$(LTINSTALL) $(INSTALLFLAGS) -m 644 $(LIBRARY) $(DESTDIR)$(libdir); \
+		$(LTINSTALL) $(INSTALLFLAGS) -m 755 $(LIBRARY) $(DESTDIR)$(libdir); \
 	fi


code:
# conf.d file for openldap
#
# To enable both the standard unciphered server and the ssl encrypted
# one uncomment this line or set any other server starting options
# you may desire.
#
# OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
# Uncomment the below to use the new slapd configuration for openldap 2.3
OPTS="-h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"


code: d /run/openldap 0755 ldap ldap - -


code:
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
    <Source>
        <Name>openldap</Name>
        <Homepage>http://www.openldap.org</Homepage>
        <Packager>
            <Name>PisiLinux Community</Name>
            <Email>admins@pisilinux.org</Email>
        </Packager>
        <License>OPENLDAP</License>
        Open-source suite of LDAP applications and development tools
        <Description>OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools</Description>
        <Archive sha1sum="016a738d050a68d388602a74b5e991035cdba149" type="targz">ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.44.tgz</Archive>
        <BuildDependencies>
            <Dependency>nss-devel</Dependency>
            <Dependency>db-devel</Dependency>
            <Dependency>openssl-devel</Dependency>
            <Dependency>tcp-wrappers-devel</Dependency>
            <Dependency>cyrus-sasl-devel</Dependency>
            <Dependency>libtool-ltdl</Dependency>
            <Dependency>icu4c-devel</Dependency>
            <Dependency>unixODBC-devel</Dependency>
            <Dependency>mariadb-server</Dependency>
            <Dependency>libutil-linux-devel</Dependency>
            <Dependency>e2fsprogs-devel</Dependency>
            <Dependency>chrpath</Dependency>
            <Dependency>groff</Dependency>
        </BuildDependencies>
        <Patches>

            <Patch level="1">openldap-2.4.44-consolidated-2.patch</Patch>

            <Patch level="1">openldap-2.4.39-ntlm-1.patch</Patch>
            <Patch level="1">fedora/openldap-sql-linking.patch</Patch>
            <Patch level="1">fedora/openldap-reentrant-gethostby.patch</Patch>
            <Patch level="1">fedora/openldap-ldaprc-currentdir.patch</Patch>
            <Patch level="1">fedora/openldap-userconfig-setgid.patch</Patch>

            <Patch level="1">fedora/openldap-syncrepl-unset-tls-options.patch</Patch>
            <Patch level="1">fedora/openldap-nss-update-list-of-ciphers.patch</Patch>
            <Patch level="1">fedora/openldap-tls-no-reuse-of-tls_session.patch</Patch>
            <Patch level="1">fedora/openldap-nss-regex-search-hashed-cacert-dir.patch</Patch>
            <Patch level="1">fedora/openldap-nss-ignore-certdb-type-prefix.patch</Patch>
            <Patch level="1">fedora/openldap-nss-certs-from-certdb-fallback-pem.patch</Patch>
            <Patch level="1">fedora/openldap-nss-pk11-freeslot.patch</Patch>
            <Patch level="1">fedora/openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch</Patch>
            <Patch level="1">fedora/openldap-ldapi-sasl.patch</Patch>
            <Patch level="1">fedora/openldap-autoconf-pkgconfig-nss.patch</Patch>
        </Patches>
    </Source>

    <Package>
        <Name>openldap-client</Name>
        <IsA>library</IsA>
        <IsA>app:console</IsA>
        Command-line ldap client commands (ldapsearch, ldapadd etc..)
        <RuntimeDependencies>
            <Dependency>nss</Dependency>
            <Dependency>nspr</Dependency>
            <Dependency>openssl</Dependency>
            <Dependency>cyrus-sasl</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc/openldap/ldap.conf*</Path>
            <Path fileType="header">/usr/include</Path>
            <Path fileType="executable">/usr/bin</Path>
            <Path fileType="library">/usr/lib</Path>
            <Path fileType="man">/usr/share/man/man1</Path>
            <Path fileType="man">/usr/share/man/man5/ldap.conf.5</Path>
        </Files>
    </Package>

    <Package>
        <Name>openldap-server</Name>
        <IsA>service</IsA>
        OpenLDAP server slapd and releated tools
        <Description>OpenLDAP server slapd, additional backends, configuration files, schema definitions required for operation, and database maintenance tools</Description>
        <RuntimeDependencies>
            <Dependency>db</Dependency>
            <Dependency>perl</Dependency>
            <Dependency>unixODBC</Dependency>
            <Dependency>libutil-linux</Dependency>
            <Dependency>tcp-wrappers</Dependency>
            <Dependency>libtool-ltdl</Dependency>
            <Dependency>nss</Dependency>
            <Dependency>cyrus-sasl</Dependency>
            <Dependency release="current">openldap-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc/conf.d</Path>
            <Path fileType="config">/etc/openldap</Path>
            <Path fileType="config">/usr/lib/tmpfiles.d/openldap-server.conf</Path>
            <Path fileType="executable">/usr/sbin</Path>
            <Path fileType="library">/usr/libexec</Path>
            <Path fileType="man">/usr/share/man/man3</Path>
            <Path fileType="man">/usr/share/man/man5</Path>
            <Path fileType="man">/usr/share/man/man8</Path>
            <Path fileType="doc">/usr/share/doc</Path>
            <Path fileType="data">/var/lib</Path>
            <Path fileType="data">/run/openldap</Path>
        </Files>
        <AdditionalFiles>
            <AdditionalFile owner="root" permission="0644" target="/usr/lib/tmpfiles.d/openldap-server.conf">tmpfiles.conf</AdditionalFile>
            <AdditionalFile owner="root" permission="0644" target="/etc/conf.d/slapd">slapd.conf</AdditionalFile>
            <AdditionalFile owner="root" permission="0755" target="/etc/openldap/ssl/gencert.sh">gencert.sh</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="package.py">System.Package</COMAR>
            <COMAR script="slapd.py">System.Service</COMAR>
        </Provides>
    </Package>

    <Package>
        <Name>openldap-32bit</Name>
        <PartOf>emul32</PartOf>
        32-bit shared libraries for openldap
        <BuildType>emul32</BuildType>
        <BuildDependencies>
            <Dependency>openssl-32bit</Dependency>
            <Dependency>libtool-ltdl-32bit</Dependency>
        </BuildDependencies>
        <RuntimeDependencies>
            <Dependency>openssl-32bit</Dependency>
            <Dependency release="current">openldap-client</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="library">/usr/lib32</Path>
        </Files>
    </Package>

    <History>
        <Update release="4">
            <Date>2017-01-27</Date>
            <Version>2.4.44</Version>
            <Comment>Release bump for toolchain</Comment>
            <Name>Kamil Atlı</Name>
            <Email>suvari@pisilinux.org</Email>
        </Update>
        <Update release="3">
            <Date>2016-06-15</Date>
            <Version>2.4.44</Version>
            <Comment>Release Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="2">
            <Date>2016-05-27</Date>
            <Version>2.4.44</Version>
            <Comment>Release bump</Comment>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
         <Update release="1">
            <Date>2016-03-28</Date>
            <Version>2.4.44</Version>
            <Comment>First release</Comment>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
    </History>
</PISI>


code:
<?xml version="1.0" ?>
<PISI>
    <Source>
        <Name>openldap</Name>
        LDAP uygulamaları ve geliştirme araçları
        <Description xml:lang="tr">LDAP hizmeti için gereken uygulamalar ve geliştirme araçlarını içerir</Description>
    </Source>

    <Package>
        <Name>openldap-32bit</Name>
        openldap için 32-bit paylaşımlı kitaplıklar
    </Package>
</PISI>


code:
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt

from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools
from pisi.actionsapi import get

#WorkDir = "openssh-%s" % get.srcVERSION().replace("_","")

def setup():
    shelltools.export("CFLAGS","%s -fpie" % get.CFLAGS())
    shelltools.export("LDFLAGS","%s -pie" % get.LDFLAGS())

    #pisitools.dosed("pathnames.h", "/usr/X11R6/bin/xauth", r"/usr/bin/xauth")
    #pisitools.dosed("sshd_config", "(?m)^(^#UsePAM ).*", r"UsePAM yes")
    #pisitools.dosed("sshd_config", "(?m)^(^#PasswordAuthentication ).*", r"PasswordAuthentication no")
    #pisitools.dosed("sshd_config", "(?m)^(^#X11Forwarding ).*", r"X11Forwarding yes")
    #pisitools.dosed("sshd_config", "(?m)^(^#UseDNS ).*", r"UseDNS no")
    #pisitools.dosed("sshd_config", "(?m)^(^#PermitRootLogin ).*", r"PermitRootLogin no")

    autotools.autoreconf("-fi")

    # Kerberos support is a must, libedit is optional
    # Update configure parameters when both are ready
    autotools.configure("--sysconfdir=/etc/ssh \
                         --libexecdir=/usr/libexec/openssh \
                         --datadir=/usr/share/openssh \
                         --disable-strip \
                         --with-pam \
                         --with-libedit \
                         --with-kerberos5 \
                         --with-tcp-wrappers \
                         --with-md5-passwords \
                         --with-ipaddr-display \
                         --with-privsep-user=sshd \
                         --with-privsep-path=/var/empty \
                         --without-zlib-version-check \
                         --without-ssl-engine")

def build():
    autotools.make()

def install():
    autotools.rawInstall("DESTDIR=%s" % get.installDIR())

    # fixes #10992
    pisitools.dobin("contrib/ssh-copy-id")
    pisitools.doman("contrib/ssh-copy-id.1")

    # an script in contrib
    pisitools.dobin("contrib/findssl.sh")

    shelltools.chmod("%s/etc/ssh/sshd_config" % get.installDIR(), 0600)
    # special request by merensan
    shelltools.echo("%s/etc/ssh/ssh_config" % get.installDIR(), "ServerAliveInterval 5")

    pisitools.dodir("/var/empty/sshd")

    pisitools.dodoc("ChangeLog", "CREDITS", "OVERVIEW", "README*", "TODO", "sshd_config")


code:
# -*- coding: utf-8 -*-
from comar.service import *

serviceType = "server"
serviceDesc = _({"en": "Secure Shell Server",
                 "tr": "Güvenli Kabuk Sunucusu"
                 })

MSG_ERR_NEEDCONF = _({"en": "You need /etc/ssh/sshd_config to run sshd.",
                      "tr": "Sshd'yi çalıştırabilmek için /etc/ssh/sshd_config'e ihtiyaç var.",
                      })

PID_FILE = "/run/sshd.pid"
RSA1_KEY = "/etc/ssh/ssh_host_key"
RSA_KEY = "/etc/ssh/ssh_host_rsa_key"
DSA_KEY = "/etc/ssh/ssh_host_dsa_key"

def check_config():
    import os
    if not os.path.exists("/etc/ssh/sshd_config"):
        fail(MSG_ERR_NEEDCONF)
    if not os.path.exists(RSA1_KEY):
        # Default is 2048 bits, and is considered sufficient.
        run("/usr/bin/ssh-keygen", "-t", "rsa1",
            "-f", "/etc/ssh/ssh_host_key", "-N", "")
    if not os.path.exists(DSA_KEY):
        run("/usr/bin/ssh-keygen", "-t", "dsa",
            "-f", "/etc/ssh/ssh_host_dsa_key", "-N", "")
    if not os.path.exists(RSA_KEY):
        run("/usr/bin/ssh-keygen", "-t", "rsa",
            "-f", "/etc/ssh/ssh_host_rsa_key", "-N", "")

@synchronized
def start():
    check_config()
    startService(command="/usr/sbin/sshd",
                 pidfile=PID_FILE,
                 donotify=True)

@synchronized
def stop():
    stopService(pidfile=PID_FILE,
                donotify=True)

def status():
    return isServiceRunning(PID_FILE)


code:
Hi,

So I screwed up when writing the support for the curve25519 KEX method
that doesn't depend on OpenSSL's BIGNUM type - a bug in my code left
leading zero bytes where they should have been skipped. The impact of
this is that OpenSSH 6.5 and 6.6 will fail during key exchange with a
peer that implements curve25519-sha256@libssh.org properly about 0.2%
of the time (one in every 512ish connections).

We've fixed this for OpenSSH 6.7 by avoiding the curve25519-sha256
key exchange for previous versions, but I'd recommend distributors
of OpenSSH apply this patch so the affected code doesn't become
too entrenched in LTS releases.

The patch fixes the bug and makes OpenSSH identify itself as 6.6.1 so as
to distinguish itself from the incorrect versions so the compatibility
code to disable the affected KEX isn't activated.

I've committed this on the 6.6 branch too.

Apologies for the hassle.

-d

Index: version.h
===================================================================
RCS file: /var/cvs/openssh/version.h,v
retrieving revision 1.82
diff -u -p -r1.82 version.h
--- version.h	27 Feb 2014 23:01:54 -0000	1.82
+++ version.h	20 Apr 2014 03:35:15 -0000
@@ -1,6 +1,6 @@
 /* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */

-#define SSH_VERSION	"OpenSSH_6.6"
+#define SSH_VERSION	"OpenSSH_6.6.1"

 #define SSH_PORTABLE	"p1"
 #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
Index: compat.c
===================================================================
RCS file: /var/cvs/openssh/compat.c,v
retrieving revision 1.82
retrieving revision 1.85
diff -u -p -r1.82 -r1.85
--- compat.c	31 Dec 2013 01:25:41 -0000	1.82
+++ compat.c	20 Apr 2014 03:33:59 -0000	1.85
@@ -95,6 +95,9 @@ compat_datafellows(const char *version)
 		{ "Sun_SSH_1.0*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
 		{ "OpenSSH_4*",		0 },
 		{ "OpenSSH_5*",		SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
+		{ "OpenSSH_6.6.1*",	SSH_NEW_OPENSSH},
+		{ "OpenSSH_6.5*,"
+		  "OpenSSH_6.6*",	SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
 		{ "OpenSSH*",		SSH_NEW_OPENSSH },
 		{ "*MindTerm*",		0 },
 		{ "2.1.0*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
@@ -251,7 +254,6 @@ compat_cipher_proposal(char *cipher_prop
 	return cipher_prop;
 }

-
 char *
 compat_pkalg_proposal(char *pkalg_prop)
 {
@@ -263,5 +265,18 @@ compat_pkalg_proposal(char *pkalg_prop)
 	if (*pkalg_prop == '\0')
 		fatal("No supported PK algorithms found");
 	return pkalg_prop;
+}
+
+char *
+compat_kex_proposal(char *kex_prop)
+{
+	if (!(datafellows & SSH_BUG_CURVE25519PAD))
+		return kex_prop;
+	debug2("%s: original KEX proposal: %s", __func__, kex_prop);
+	kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org");
+	debug2("%s: compat KEX proposal: %s", __func__, kex_prop);
+	if (*kex_prop == '\0')
+		fatal("No supported key exchange algorithms found");
+	return kex_prop;
 }

Index: compat.h
===================================================================
RCS file: /var/cvs/openssh/compat.h,v
retrieving revision 1.42
retrieving revision 1.43
diff -u -p -r1.42 -r1.43
--- compat.h	31 Dec 2013 01:25:41 -0000	1.42
+++ compat.h	20 Apr 2014 03:25:31 -0000	1.43
@@ -59,6 +59,7 @@
 #define SSH_BUG_RFWD_ADDR	0x02000000
 #define SSH_NEW_OPENSSH		0x04000000
 #define SSH_BUG_DYNAMIC_RPORT	0x08000000
+#define SSH_BUG_CURVE25519PAD	0x10000000

 void     enable_compat13(void);
 void     enable_compat20(void);
@@ -66,6 +67,7 @@ void     compat_datafellows(const char *
 int	 proto_spec(const char *);
 char	*compat_cipher_proposal(char *);
 char	*compat_pkalg_proposal(char *);
+char	*compat_kex_proposal(char *);

 extern int compat13;
 extern int compat20;
Index: sshd.c
===================================================================
RCS file: /var/cvs/openssh/sshd.c,v
retrieving revision 1.448
retrieving revision 1.453
diff -u -p -r1.448 -r1.453
--- sshd.c	26 Feb 2014 23:20:08 -0000	1.448
+++ sshd.c	20 Apr 2014 03:28:41 -0000	1.453
@@ -2462,6 +2438,9 @@ do_ssh2_kex(void)
 	if (options.kex_algorithms != NULL)
 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;

+	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+	    myproposal[PROPOSAL_KEX_ALGS]);
+
 	if (options.rekey_limit || options.rekey_interval)
 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
 		    (time_t)options.rekey_interval);
Index: sshconnect2.c
===================================================================
RCS file: /var/cvs/openssh/sshconnect2.c,v
retrieving revision 1.197
retrieving revision 1.199
diff -u -p -r1.197 -r1.199
--- sshconnect2.c	4 Feb 2014 00:20:16 -0000	1.197
+++ sshconnect2.c	20 Apr 2014 03:25:31 -0000	1.199
@@ -195,6 +196,8 @@ ssh_kex2(char *host, struct sockaddr *ho
 	}
 	if (options.kex_algorithms != NULL)
 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+	    myproposal[PROPOSAL_KEX_ALGS]);

 	if (options.rekey_limit || options.rekey_interval)
 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
Index: bufaux.c
===================================================================
RCS file: /var/cvs/openssh/bufaux.c,v
retrieving revision 1.62
retrieving revision 1.63
diff -u -p -r1.62 -r1.63
--- bufaux.c	4 Feb 2014 00:20:15 -0000	1.62
+++ bufaux.c	20 Apr 2014 03:24:50 -0000	1.63
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -372,6 +372,9 @@ buffer_put_bignum2_from_string(Buffer *b

 	if (l > 8 * 1024)
 		fatal("%s: length %u too long", __func__, l);
+	/* Skip leading zero bytes */
+	for (; l > 0 && *s == 0; l--, s++)
+		;
 	p = buf = xmalloc(l + 1);
 	/*
 	 * If most significant bit is set then prepend a zero byte to
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


code:
#%PAM-1.0

auth       include	system-auth
auth       required     pam_shells.so
auth	   required	pam_nologin.so
account    include	system-auth
password   include	system-auth
session	   include	system-auth


code:
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
    <Source>
        <Name>openssh</Name>
        <Homepage>http://www.openssh.com/</Homepage>
        <Packager>
            <Name>PisiLinux Community</Name>
            <Email>admins@pisilinux.org</Email>
        </Packager>
        <License>BSD</License>
        <IsA>app:console</IsA>
        <IsA>service</IsA>
        <Summary>Port of OpenBSD's free SSH release</Summary>
        <Description>OpenSSH is a FREE version of the SSH connectivity tools that technical users of the Internet rely on. Users of telnet, rlogin, and ftp may not realize that their password is transmitted across the Internet unencrypted, but it is. OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks.</Description>
        <Archive sha1sum="2330bbf82ed08cf3ac70e0acf00186ef3eeb97e0" type="targz">http://ftp.icm.edu.pl/pub/OpenBSD/OpenSSH/portable/openssh-7.4p1.tar.gz</Archive>
        <BuildDependencies>
            <Dependency>libedit-devel</Dependency>
            <Dependency>zlib-devel</Dependency>
            <Dependency>openssl-devel</Dependency>
            <Dependency>mit-kerberos</Dependency>
            <!--Dependency>skey-devel</Dependency-->
            <Dependency>pam-devel</Dependency>
            <Dependency>e2fsprogs-devel</Dependency>
        </BuildDependencies>
        <Patches>
<!--             <Patch>curve25519pad.patch</Patch> -->
      </Patches>
    </Source>

    <Package>
        <Name>openssh</Name>
        <RuntimeDependencies>
            <Dependency>libedit</Dependency>
            <Dependency>zlib</Dependency>
            <Dependency>openssl</Dependency>
            <Dependency>mit-kerberos</Dependency>
            <!--Dependency>skey</Dependency-->
            <Dependency>pam</Dependency>
        </RuntimeDependencies>
        <Files>
            <Path fileType="config">/etc</Path>
            <Path fileType="executable">/usr/bin</Path>
            <Path fileType="executable">/usr/sbin</Path>
            <Path fileType="executable">/usr/libexec</Path>
            <Path fileType="library">/usr/lib</Path>
            <Path fileType="data">/usr/share/openssh</Path>
            <Path fileType="data">/var/empty</Path>
            <Path fileType="man">/usr/share/man</Path>
            <Path fileType="doc">/usr/share/doc</Path>
        </Files>
        <AdditionalFiles>
           <AdditionalFile owner="root" permission="0644" target="/etc/pam.d/sshd">sshd.pam</AdditionalFile>
        </AdditionalFiles>
        <Provides>
            <COMAR script="service.py">System.Service</COMAR>
        </Provides>
    </Package>

    <History>
        <Update release="3">
            <Date>2017-02-19</Date>
            <Version>7.4_p1</Version>
            <Comment>Version bump.</Comment>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
        <Update release="2">
            <Date>2016-06-08</Date>
            <Version>7.2_p2</Version>
            <Comment>Release Bump</Comment>
            <Name>Pisi Linux Community</Name>
            <Email>admin@pisilinux.org</Email>
        </Update>
        <Update release="1">
            <Date>2016-03-30</Date>
            <Version>7.2_p2</Version>
            <Comment>First release</Comment>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
    </History>
</PISI>


code:
<?xml version="1.0" ?>
<PISI>
    <Source>
        <Name>openssh</Name>
        <Summary xml:lang="tr">OpenBSD'den aktarılmış SSH sürümü</Summary>
        <Description xml:lang="tr">OpenSSH teknik internet kullanıcıların güvendikleri SSH bağlanırlık araçlarının Özgür (free) sürümüdür.telnet, rlogin ve ftp kullanıcıları parolalarının internetten şifresiz olarak aktarıldığını anlayamayabilirler ancak aktarılmaktadır.OpenSSH  eavesdropping (iletişim kanalını dinleme), connection hijacking (bağlantı çalma) ve diğer atakları önlemek için tüm bağlantı trafiğini (parolalar dahil) şifrelemektedir.</Description>
        <Description xml:lang="fr">OpenSSH est une version libre des outils de connexion SSH sur lesquels les utilisateurs techniquement chevronnés s'appuient. Les utilisateurs de telnet, rlogin et ftp ne se rendent peut être pas compte que les mots de passe sont transmis sur internet en clair. OpenSSH crypte tout le trafic (y compris les mots de passe) pour éliminer les écoutes passives, les détournements de connexion et autres attaques.</Description>
    </Source>
</PISI>


code:
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt

from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools
from pisi.actionsapi import get

def setup():
    pisitools.dosed("src/util/sys_defs.h", "hash:\/etc\/aliases", "hash:/etc/mail/aliases")

def build():
    cc_args = "-DHAS_PCRE -DHAS_MYSQL -I/usr/include/mysql -DHAS_PGSQL -I/usr/include/postgresql \
               -DUSE_TLS -DUSE_SASL_AUTH -DUSE_CYRUS_SASL -I/usr/include/sasl -DHAS_LDAP -fPIC"
    cc_libs = "-pie -Wl,-z,relro -Wl,-z,now -L/usr/lib -lpcre -lcrypt -lpthread -lpam -lssl -lcrypto -lsasl2 -lmysqlclient -lpq -lm -lz -lldap -llber"

    # Default paths
    pisitools.dosed("src/global/mail_params.h", \
                    "#define DEF_README_DIR\s+\"no\"", \
                    "#define DEF_README_DIR \"/usr/share/doc/%s/readme\"" % get.srcNAME())

    pisitools.dosed("src/global/mail_params.h", \
                    "#define DEF_HTML_DIR\s+\"no\"", \
                    "#define DEF_HTML_DIR \"/usr/share/doc/%s/html\"" % get.srcNAME())

    pisitools.dosed("src/global/mail_params.h", \
                    "#define DEF_MANPAGE_DIR\s+\"/usr/local/man\"", \
                    "#define DEF_MANPAGE_DIR \"/usr/share/man\"")

    pisitools.dosed("src/util/sys_defs.h", \
                    "#define NATIVE_DAEMON_DIR \"/usr/libexec/postfix\"", \
                    "#define NATIVE_DAEMON_DIR \"/usr/lib/postfix\"")

    autotools.make('CC=%s \
                    OPT="%s" \
                    CCARGS="%s" \
                    AUXLIBS="%s" makefiles' % (get.CC(), get.CFLAGS(), cc_args, cc_libs))

    autotools.make()

def install():
    shelltools.system('/bin/sh postfix-install \
                       -non-interactive \
                       install_root="%(installDIR)s" \
                       config_directory="/usr/share/doc/%(srcNAME)s/defaults" \
                       readme_directory="/usr/share/doc/%(srcNAME)s/readme" \
                       ' % {'installDIR': get.installDIR(), 'srcNAME': get.srcNAME()})

    pisitools.removeDir("/var/")

    # lets make dirs
    pisitools.dodir("/var/spool/postfix/")
    pisitools.dodir("/etc/mail/")
    pisitools.dodir("/etc/postfix/")
    pisitools.dodir("/var/spool/mail/")
    pisitools.dodir("/var/lib/postfix")
    pisitools.dosym("/var/spool/mail", "/var/mail")

    # qshape comes
    pisitools.dosbin("auxiliary/qshape/qshape.pl")
    pisitools.rename("/usr/sbin/qshape.pl", "qshape")

    # legacy FSH
    pisitools.dosym("/usr/sbin/sendmail", "/usr/lib/sendmail")

    # performance tuning tools.
    pisitools.dosbin("bin/smtp-source")
    pisitools.dosbin("bin/smtp-sink")
    pisitools.dosbin("bin/qmqp-source")
    pisitools.dosbin("bin/qmqp-sink")
    pisitools.doman("man/man1/smtp-source.1")
    pisitools.doman("man/man1/smtp-sink.1")
    pisitools.doman("man/man1/qmqp-source.1")
    pisitools.doman("man/man1/qmqp-sink.1")

    # Move some files
    pisitools.domove("/usr/share/doc/%s/defaults/master.cf" % get.srcNAME(), "/etc/postfix/")

    # Docs
    pisitools.insinto("/usr/share/doc/%s/" % get.srcNAME(), "html/")
    pisitools.insinto("/usr/share/doc/%s/" % get.srcNAME(), "examples/")
    for s in ["*README", "COMPATIBILITY", "HISTORY", "LICENSE", "RELEASE_NOTES"]:
        pisitools.insinto("/usr/share/doc/%s/" % get.srcNAME(), s)


code:
#!/usr/bin/python

import os

def postInstall(fromVersion, fromRelease, toVersion, toRelease):
    if not os.path.exists("/etc/mail/aliases.db"):
        os.system("/usr/bin/newaliases")

    os.system("/bin/chown root:postdrop /usr/sbin/postdrop")
    os.system("/bin/chown root:postdrop /usr/sbin/postqueue")
    os.system("/bin/chown root:mail /var/spool/mail")
    os.system("/bin/chown postfix:postfix /var/lib/postfix")
    os.system("/bin/chmod 02711 /usr/sbin/postdrop")
    os.system("/bin/chmod 02711 /usr/sbin/postqueue")
    os.system("/bin/chmod 0755 /var/spool/mail")
    os.system("/bin/chmod 0600 /etc/postfix/saslpass")
    os.system("/usr/sbin/postfix check")


code:
from comar.service import *

serviceType = "server"
serviceDesc = _({"en": "Postfix Mail Server",
                 "tr": "Postfix E-Posta Sunucusu"})

@synchronized
def start():
    startService(command="/usr/sbin/postfix",
                 args="start",
                 donotify=True)

@synchronized
def stop():
    stopService(command="/usr/sbin/postfix",
                args="stop",
                donotify=True)

def reload():
    stopService(command="/usr/sbin/postfix",
                args="reload")

def status():
    return isServiceRunning(command="/usr/lib/postfix/master")


code:
# Basic system aliases -- these MUST be present.
MAILER-DAEMON:      postmaster
postmaster:         root

# General redirections for pseudo accounts.
adm:                root
bin:                root
daemon:             root
exim:               root
lp:                 root
mail:               root
named:              root
nobody:             root
postfix:            root

# Well-known aliases -- these should be filled in!
# root:
# operator:

# Standard RFC2142 aliases
abuse:              postmaster
ftp:                root
hostmaster:         root
news:               usenet
noc:                root
security:           root
usenet:             root
webmaster:          root
www:                webmaster

# trap decode to catch security attacks
# decode:           /dev/null

path: server/postfix/files/aliases


code:
#
# Do not edit this file. This file shows the default delivery status
# notification (DSN) messages that are built into Postfix.
#
# To change Postfix DSN messages, perhaps to add non-English text,
# follow instructions in the bounce(5) manual page.
#

#
# The failure template is used when mail is returned to the sender;
# either the destination rejected the message, or the destination
# could not be reached before the message expired in the queue.
#

failure_template = <<EOF
Charset: UTF-8
From: E-POSTANE (Posta iletim sistemi)
Subject: Iletilemeyen Posta Gonderene Geri Donduruldu
Postmaster-Subject: Postmaster Copy: Undelivered Mail

Ben $myhostname eposta sistemiyim.

Üzülerek bildirmek zorundayım ki, epostanız alıcıların en az
birine ulaştırılamadı. Ulaştırılamayan bu eposta ektedir.

Ek yardım için e-postane yönetimine eposta
gönderebilirsiniz. Gönderirseniz, lütfen bu problem
bildirimini de ekleyin. Ekteki döndürülen epostadan kendi
yazdığınız metinleri silebilirsiniz.

                   Posta sistemi
EOF

#
# The delay template is used when mail is delayed. Note a neat trick:
# the default template displays the delay_warning_time value as hours
# by appending the _hours suffix to the parameter name; it displays
# the maximal_queue_lifetime value as days by appending the _days
# suffix.
#
# Other suffixes are: _seconds, _minutes, _weeks. There are no other
# main.cf parameters that have this special behavior.
#
# You need to adjust these suffixes (and the surrounding text) if
# you have very different settings for these time parameters.
#

delay_template = <<EOF
Charset: UTF-8
From: E-POSTANE (Posta iletim sistemi)
Subject: Geciken Eposta (denemeler devam ediyor)
Postmaster-Subject: Postmaster Warning: Delayed Mail

Ben $myhostname eposta sistemiyim.

#######################################################################
# BU SADECE BİR BİLDİRİMDİR. EPOSTANIZI YENİDEN GÖNDERMENİZ GEREKMEZ. #
#######################################################################

Epostanız $delay_warning_time_hours saattir alıcıya iletilemedi.
Eposta gönderiminin üzerinden $maximal_queue_lifetime_days gün geçene
kadar denemeye devam edeceğim.

Ek yardım için e-postane yönetimine eposta
gönderebilirsiniz. Gönderirseniz, lütfen bu problem
bildirimini de ekleyin. Ekteki döndürülen epostadan kendi
yazdığınız metinleri silebilirsiniz.

                   Posta sistemi
EOF

#
# The success template is used when mail is delivered to mailbox,
# when an alias or list is expanded, or when mail is delivered to a
# system that does not announce DSN support. It is an error to specify
# a Postmaster-Subject: here.
#

success_template = <<EOF
Charset: UTF-8
From: E-POSTANE (Posta iletim sistemi)
Subject: Posta Basariyla Iletildi

Ben $myhostname eposta sistemiyim.

Epostanız aşağıda listelenen hedeflere başarıyla ulaştırıldı.
Eğer ileti posta kutusuna ulaştıysa başka bildiri almayacaksınız.
Aksi taktirde diğer sistemlerden posta iletimiyle ilgili hata
bildirimleri alabilirsiniz.

                   Posta sistemi
EOF

#
# The verify template is used for address verification (sendmail -bv
# address...). or for verbose mail delivery (sendmail -v address...).
# It is an error to specify a Postmaster-Subject: here.
#

verify_template = <<EOF
Charset: UTF-8
From: E-POSTANE (Posta iletim sistemi)
Subject: Mail Delivery Status Report

Ben $myhostname eposta sistemiyim.

İstediğiniz eposta iletim raporunu ekte bulabilirsiniz.

                   Posta sistemi
EOF


code:
# Standard pam.d file for mail service packages.

auth       required     pam_nologin.so
auth       include      system-auth
account    include      system-auth
session    include      system-auth


code:
text/plain; less '%s'; needsterminal
application/x-troff-man; /usr/bin/nroff -mandoc -Tlatin1; copiousoutput; print=/usr/bin/nroff -mandoc -Tlatin1 | print text/plain:-
text/plain; shownonascii iso-8859-1 '%s'; description="Plain ASCII Text"; test=test "$(echo %{charset} | tr "[A-Z]" "[a-z]")" = iso-8859-1 -a "$DISPLAY" != ""
text/richtext; shownonascii iso-8859-1 -e richtext -p '%s'; description="Richtext"; copiousoutput; test=test "$(echo %{charset} | tr "[A-Z]" "[a-z]")" = iso-8859-1 -a "$DISPLAY" != ""
text/enriched; shownonascii iso-8859-1 -e richtext -e -p '%s'; description="Enriched Text"; copiousoutput; test=test "$(echo %{charset} | tr "[A-Z]" "[a-z]")" = iso-8859-1 -a "$DISPLAY" != ""
message/partial; showpartial '%s' %{id} %{number} %{total}; description="An incomplete message"
message/external-body; showexternal '%s' %{access-type} %{name} %{site} %{directory} %{mode} %{server}; needsterminal; description="A reference to data stored in an external location"; composetyped="extcompose '%s"'
audio/basic; /usr/lib/mime/playaudio '%s'; description=Basic uLaw Audio; nametemplate=%s.au
application/x-tar; /bin/tar tvf -; print=/bin/tar tvf - | print text/plain:-; copiousoutput
application/x-gtar; /bin/tar tvzf -; print=/bin/tar tvzf - | print text/plain:-; copiousoutput
text/plain; more '%s'; needsterminal
application/xrx; view=xrx '%s'; description="remote X application"; test=test "$DISPLAY"; nametemplate=%s.rx
text/richtext; richtext '%s'; description="Richtext"; copiousoutput
text/enriched; richtext -e '%s'; description="Enriched Text"; copiousoutput
text/plain; gview '%s'; edit=gvim -f '%s'; compose=gvim -f '%s'; test=test "$DISPLAY" != ""
text/plain; view '%s'; edit=vim '%s'; compose=vim '%s'; needsterminal
text/html; /usr/bin/lynx -force_html '%s'; needsterminal; description=HTML Text; nametemplate=%s.html
text/*; less '%s'; needsterminal
text/html; /usr/bin/lynx -dump -force_html '%s'; copiousoutput; description=HTML Text; nametemplate=%s.html
text/*; gview '%s'; edit=gvim -f '%s'; compose=gvim -f '%s'; test=test "$DISPLAY" != ""
text/*; view '%s'; edit=vim '%s'; compose=vim '%s'; needsterminal
text/*; more '%s'; needsterminal
*/*; less '%s'; needsterminal
*/*; false; print=lpr '%s'

path: server/postfix/files/mailcap