OpenLDAP upstream conservatively assumes that any change to the version
number of libdb can result in an API-breaking change that could impact
the database. In Debian, we know that such changes require bumping the
library soname and changing the package name, and demand such rigor from
our package maintainers even when upstreams don't deliver; so any such
check in the source code works against the packaging system by forcing
database upgrades when we know none are required. Disable this check
so we rely on the packaging system to do its job.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Bug-Debian: http://bugs.debian.org/327585
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
Steve Langasek [Thu, 6 Feb 2020 18:08:12 +0000 (18:08 +0000)]
getaddrinfo-is-threadsafe
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Ryan Tandy [Thu, 6 Feb 2020 18:08:12 +0000 (18:08 +0000)]
openldap (2.4.49+dfsg-1) unstable; urgency=medium
* New upstream release.
- Drop patch no-gnutls_global_set_mutex, applied upstream.
* When validating the DNS domain chosen for slapd's default suffix, set
LC_COLLATE explicitly for grep to ensure character ranges behave as
expected. Thanks to Fredrik Roubert. (Closes: #940908)
* Backport proposed upstream patch to emit detailed messages about errors in
the TLS configuration. (ITS#9086) (Closes: #837341)
* slapd.scripts-common: Delete unused copy_example_DB_CONFIG function.
* Remove debconf support for choosing a database backend. Always use the
LMDB backend for new installs, as recommended by upstream.
* Remove the empty olcBackend section from the default configuration.
* Remove the unused slapd.conf template from /usr/share/slapd. Continue
shipping it as an example in /usr/share/doc/slapd.
* Fix a typo in index-files-created-as-root patch.
Thanks to Quanah Gibson-Mount.
* Annotate slapd's Depends on perl with :any. Fixes installation of
foreign-arch slapd. Thanks to Andreas Hasenack.
* Rename 'stage1' build profile to 'pkg.openldap.noslapd'.
Thanks to Helmut Grohne. (Closes: #949722)
* Drop Build-Conflicts: libicu-dev as upstream's configure no longer tests
for or links with libicu.
* Note ITS#9126 recommendation in slapd.NEWS.
* Update Standards-Version to 4.5.0; no changes required.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Ryan Tandy [Thu, 25 Jul 2019 15:32:00 +0000 (16:32 +0100)]
openldap (2.4.48+dfsg-1) unstable; urgency=medium
* New upstream release.
- fixed slapd to restrict rootDN proxyauthz to its own databases
(CVE-2019-13057) (ITS#9038) (Closes: #932997)
- fixed slapd to enforce sasl_ssf ACL statement on every connection
(CVE-2019-13565) (ITS#9052) (Closes: #932998)
- added new openldap.h header with OpenLDAP specific libldap interfaces
(ITS#8671)
- updated lastbind overlay to support forwarding authTimestamp updates
(ITS#7721) (Closes: #880656)
* Update Standards-Version to 4.4.0.
* Add a systemd drop-in to set RemainAfterExit=no on the slapd service, so
that systemd marks the service as dead after it crashes or is killed.
Thanks to Heitor Alves de Siqueira. (Closes: #926657, LP: #1821343)
* Use more entropy for generating a random admin password, if none was set
during initial configuration. Thanks to Judicael Courant.
(Closes: #932270)
* Replace debian/rules calls to dpkg-architecture and dpkg-parsechangelog
with variables provided by dpkg-dev includes.
* Declare R³: no.
* Create a simple autopkgtest that tests installing slapd and connecting to
it with an ldap tool.
* Install the new openldap.h header in libldap2-dev.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Ryan Tandy [Sat, 2 Feb 2019 18:30:10 +0000 (18:30 +0000)]
openldap (2.4.47+dfsg-3) unstable; urgency=medium
* Restore patches to contrib Makefiles to set CFLAGS, CPPFLAGS, and LDFLAGS
individually in the relevant command lines instead of overriding OPT. The
change to use OPT caused FTBFS on some ports arches where PIE enablement
uses spec files, by mixing compile-time and link-time flags.
(Closes: #919136)
* Fix architecture-specific path in smbk5pwd's binary-or-shlib-defines-rpath
Lintian override.
* Skip exporting cn=config to LDIF in preinst for upgrades where nothing
needs to be checked in it.
* Update Standards-Version to 4.3.0.
Switch to lt_dlopenadvise() so back_perl can be opened with RTLD_GLOBAL. Open all modules with RTLD_GLOBAL, needed so that back_perl can load non-trivial Perl extensions that require symbols from back_perl.so itself.
Gbp-Pq: Name switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.diff
Rip out code that second-guesses the libsasl soname / Debian shlibs. If
cyrus sasl upstream is breaking the ABI, this needs to be fixed upstream
there, not kludged around upstream here!
OpenLDAP upstream conservatively assumes that certain resolver functions
(getaddrinfo, getnameinfo, res_query, dn_expand) are not re-entrant; but we
know that the glibc implementations of these functions are thread-safe, so
we should bypass the use of this mutex. This fixes a locking problem when
an application uses libldap and libnss-ldap is also used for hosts
resolution.
Closes Debian bug #340601.
Not suitable for forwarding upstream; might be made suitable by adding a
configure-time check for glibc and disabling the mutex only on known
thread-safe implementations.
Add symbol versioning to the public LDAP libraries. This is required for
library transitions, such as the current transition from 2.1 to 2.4,
since programs will sometimes have both libraries loaded by different
dependency chains during the transition.
Not yet contributed upstream.
Upstream ITS #5365 filed requesting symbol versioning for libldap and
libber.
Document in the man page that slapindex should be run as the same user
as slapd, and print a warning if it's run as root (since Debian defaults
to running slapd as openldap).
Not suitable for upstream in this form. This patch needs to be reworked
to check the BerkeleyDB database ownership and only warn if running as
root with a database that's not owned by root.
Upstream ITS #5356 filed requesting better handling of this. Current
upstream discussion leans towards putting the check into the database
backend and aborting if slapd is run as a different user than the database
owner, which is an even better fix.
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
projects / openldap.git / log