Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Ryan Tandy [Fri, 28 Jul 2017 01:04:41 +0000 (02:04 +0100)]
openldap (2.4.45+dfsg-1) unstable; urgency=medium
* New upstream release.
- fixed a use-after-free in GnuTLS options handling
(ITS#8385) (Closes: #820244) (LP: #1557248)
- fixed unsafe concurrent SASL calls causing memory corruption
(ITS#8648) (Closes: #860947) (LP: #1688575)
- fixed syncrepl infinite looping with multi-master delta-syncrepl
(ITS#8432) (Closes: #868753)
* Rebase patches to apply cleanly:
- do-not-second-guess-sonames
- no-AM_INIT_AUTOMAKE
* Drop patches applied upstream:
- ITS-8554-kFreeBSD-is-like-BSD.patch
- ITS-8644-wait-for-slapd-to-start-in-test064.patch
- ITS-8655-paged-results-double-free.patch
* Upgrade to debhelper compat level 10.
- Depend on debhelper 10.
- Stop enabling parallel and autoreconf explicitly. They are now enabled
by default.
- Drop dh-autoreconf from build-depends since debhelper requires it.
* Add -Wno-format-extra-args to CFLAGS to reduce the noise in the build
logs, as this warning is emitted on each use of the Debug() macro.
* Drop libldap-2.4-4-dbg and slapd-dbg binary packages in favour of
automatic dbgsym packages.
* Update Standards-Version to 4.0.0; no changes required.
* Drop Priority and Section from binary package stanzas when they only
duplicate information from the source stanza.
* Update Priority of slapd-smbk5pwd and libldap2-dev to optional to match
the archive.
* Remove retired developer, Roland Bauerschmidt, from Uploaders.
(Closes: #856422)
* Remove Timo Aaltonen from Uploaders, with his agreement.
* debian/patches/ITS8650-retry-gnutls_handshake-after-GNUTLS_E_AGAIN.patch:
If gnutls_handshake() returns EAGAIN, call it again. Fixes TLS handshake
failures when the ServerHello message exceeds 16K.
(ITS#8650) (Closes: #861838)
* Drop time from Build-Depends. The upstream testsuite no longer calls it.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Ryan Tandy [Sun, 16 Jul 2017 19:57:41 +0000 (20:57 +0100)]
openldap (2.4.44+dfsg-8) unstable; urgency=medium
* Disable test060-mt-hot on ppc64el temporarily to avoid failing tests until
the underlying kernel bug #866122 is fixed.
* Fix FTBFS with Heimdal 7.2.0: Drop patch heimdal-fix as the
hdb_generate_key_set_password change was reverted in heimdal. Depend on an
appropriate minimum version of heimdal.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
projects / openldap.git / log