Skip to content

Commit 679f0f1

Browse files
authored
Merge pull request #999 from flatcar/dongsu/openldap-2.5.14
net-nds/openldap: update to 2.5.14
2 parents 027e1ca + 4cec3b6 commit 679f0f1

20 files changed

+2328
-1053
lines changed

.github/workflows/portage-stable-packages-list

+1
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,7 @@ net-misc/socat
343343
net-misc/wget
344344
net-misc/whois
345345

346+
net-nds/openldap
346347
net-nds/rpcbind
347348

348349
net-vpn/wireguard-tools
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- openldap ([CVE-2023-2953](https://nvd.nist.gov/vuln/detail/CVE-2023-2953))
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- openldap ([2.5.14](https://lists.openldap.org/hyperkitty/list/[email protected]/thread/TZQHR4SIWUA5BZTKDAKSFDOOGDVU4TU7/) (includes [2.5](https://lists.openldap.org/hyperkitty/list/[email protected]/thread/BH3VDPG6IYYF5L5U6LZGHHKMJY5HFA3L/)))

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask

+5
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,8 @@
2020
# Python 3.12 is in portage-stable (currently testing), so avoid picking it
2121
# up. Update this to mask later versions when we switch to 3.11.
2222
>=dev-lang/python-3.12
23+
24+
# Do not update to openldap 2.6.3+, to take 2 different steps of updating
25+
# openldap, 1) from 2.4 to 2.5, 2) do an Alpha release around 2023-08, and
26+
# 3) finally update from 2.5 to 2.6.
27+
>=net-nds/openldap-2.6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
DIST openldap-2.4.57.tgz 5883912 BLAKE2B 439605e1bebcf34968f0a552aaade1b72b7671ae2a94a0b700a84f9f715acd162e7b8dadfdd3ffd5b0a785f9306b5f5033ab956cf0ffd26b66119a7110d0aa57 SHA512 b929bced0f5ba9a90e015a24b8037c8958fbb7282db272bd0cacf43b5f7540ab42159a3c4441148074340228bb5f07f93651c0dbb2affde961be156058f99ce5
2-
DIST openldap-2.4.58.tgz 5885225 BLAKE2B effb618dba03497796a497cd7f53ec52e389133769321dd242433bed5ec4b1f66cf7353f08a49d5f3465880f6bcfc9afc9c7d2a28e075b66f5fd926b02213541 SHA512 2fa2aa36117692eca44e55559f162c8c796f78469e6c2aee91b06d46f2b755d416979c913a3d89bbf9db14cc84881ecffee69af75b48e1d16b7aa9d2e3873baa
31
DIST openldap-2.4.59.tgz 5886272 BLAKE2B a2a8bed1d2af97fd41d651668152fd4740871bc5a8abf4b50390839228af82ac103346b3500ae0f8dd31b708acabb30435b90cd48dfafe510e648df5150d96b8 SHA512 233459ab446da6e107a7fc4ecd5668d6b08c11a11359ee76449550393e8f586a29b59d7ae09a050a1fca4fcf388ea61438ef60831b3ae802d92c048365ae3968
4-
DIST openldap-2.5.4.tgz 6415235 BLAKE2B 16e466d01dc7642786bb88a101854513f1239f1e817fd05145e89deb54bc1b911a5dc5f42b132747f14bdd2a3355e7c398b8b14937e7093361f4a96bfb7e9197 SHA512 00b57c9179acf3b1bde738e91604f3b09b5f5309106362bb947154d131868f233713eaa75c9af9771bfad731902d67406e8fb429851bad227fc48054cace16a8
5-
DIST openldap-OPENLDAP_REL_ENG_2_6_1.tar.gz 6211863 BLAKE2B 81f4591db483a214351c2e02631fef2875e17e0890fc621182d2ed61d927c3c029a4f290ee6c0788952495d6f7a76ed15e62557b8d8f2e241d867e19fdf223b7 SHA512 ca61c1dccf3194d8d149ca0c45a4834d6fadf67a3676cf348f5f62ab92c94bc7501216d7da681c3a6f87f646a18d0f3d116c3d3a24d2e5cbebc6c695c986e517
2+
DIST openldap-OPENLDAP_REL_ENG_2_5_14.tar.bz2 5024359 BLAKE2B ffdffbd47e76545c2dc2d433d290945ab6eebd910031a60249cd8f6eac24f67841098e61c7e57864428e20a183a46d36dac422bba8cf6f3596f97439875af96b SHA512 abd1e8bda0762500db028f283fe2da9480a419072927295d6f3e1448cae130592511f385a87585843cf88217417c90ef57174ca919cfcf163eb41642a72bb4e3
3+
DIST openldap-OPENLDAP_REL_ENG_2_6_3.tar.gz 6244895 BLAKE2B 97792a1b368de44867b0ce9eef38601c3e64b7d40e4ca206295bee110097697c919040d2220eea6f0581812e09a2cc3e6afb4a243a5072a8a0a95f24f9fb354b SHA512 1c882a0cd0729b5d0f40b58588d0e36ae3b1cae6d569f0576e940c7c63d03c29ed2c9db87695a87594ba99a927ef4cba491bddba3ce049025fd5883463122ba7
4+
DIST openldap-OPENLDAP_REL_ENG_2_6_4.tar.bz2 5043227 BLAKE2B 9bec77dbace0e52d1607d9ac13a77349e7d0b8876aa81fa635893638d00db58ec6bf8412f11fd266bba0440887be1aa21eb4a876122152f7f6de9fd8f75b6b4c SHA512 bff11bf1ae125bcabbd307f6c4e1c102a8df6f1091f84f5e7053fdbaa89ccd6aa0c86cc8dcce4fb9b6ffd853b5f8d3c933733f5713aeb4d6a9d77ab145293b48
5+
DIST openldap-OPENLDAP_REL_ENG_2_6_5.tar.bz2 5040569 BLAKE2B d1835e560a81bc3df2eb44964162306057ad28869a1e41da7ab823460b4a33437cd385ec9448a6df9bc580afd04dff5c4680e0b91a2f16960ad2c5f3812410ba SHA512 d259ca5ac8fbdcf9bb477e24c0feaf05678ab660007164a54463a954f1b26c3f9740855d16155fa249adcb2652223fdcfc682bb4005b46a5f36e2d5cae37f158
66
DIST rfc2307bis.schema-20140524 12262 BLAKE2B 98031f49e9bde1e4821e637af3382364d8344ed7017649686a088070d96a632dffa6c661552352656b1b159c0fd962965580069a64c7f3d5bb6a3ed75f60fd99 SHA512 83b89a1deeefc8566b97e7e865b9b6d04541099cbdf719e24538a7d27d61b6209e87ab9003a9f140bd9afd018ec569e71721e3a24090e1902c8b6659d2ba103e

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-make-flags.patch

-59
This file was deleted.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
From ee4983302d6f052e77ab0332d2a128d169c2eacb Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Arsen=20Arsenovi=C4=87?= <[email protected]>
3+
Date: Tue, 15 Nov 2022 21:45:27 +0100
4+
Subject: [PATCH] Remove default-int/k&r declarations from the configure macros
5+
6+
Recently, Clang tried to switch to having K&R prototypes and other
7+
non-strictly-conforming prototypes error out, as a result of C2x changes
8+
to the standard. These have been located across many packages, and
9+
range in severity from mild compile errors to runtime misconfiguration
10+
as a result of broken configure scripts.
11+
12+
This covers all the instances I could find by grepping around the
13+
codebase, and gets OpenLDAP building on my system.
14+
15+
Bug: https://bugs.gentoo.org/871288
16+
Bug: https://bugs.gentoo.org/871372
17+
--- a/build/openldap.m4
18+
+++ b/build/openldap.m4
19+
@@ -154,6 +154,7 @@ fi
20+
if test $ol_cv_header_stdc = yes; then
21+
# /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
22+
AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <ctype.h>
23+
+#include <stdlib.h>
24+
#ifndef HAVE_EBCDIC
25+
# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
26+
# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
27+
@@ -394,9 +395,7 @@ AC_DEFUN([OL_PTHREAD_TEST_FUNCTION],[[
28+
AC_DEFUN([OL_PTHREAD_TEST_PROGRAM],
29+
[AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES
30+
31+
-int main(argc, argv)
32+
- int argc;
33+
- char **argv;
34+
+int main(int argc, char **argv)
35+
{
36+
OL_PTHREAD_TEST_FUNCTION
37+
}
38+
@@ -518,7 +517,7 @@ AC_CACHE_CHECK([for compatible POSIX regex],ol_cv_c_posix_regex,[
39+
#include <sys/types.h>
40+
#include <regex.h>
41+
static char *pattern, *string;
42+
-main()
43+
+int main(void)
44+
{
45+
int rc;
46+
regex_t re;
47+
@@ -545,7 +544,8 @@ AC_DEFUN([OL_C_UPPER_LOWER],
48+
[AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[
49+
AC_RUN_IFELSE([AC_LANG_SOURCE([[
50+
#include <ctype.h>
51+
-main()
52+
+#include <stdlib.h>
53+
+int main(void)
54+
{
55+
if ('C' == toupper('C'))
56+
exit(0);
57+
@@ -603,7 +603,7 @@ AC_DEFUN([OL_NONPOSIX_STRERROR_R],
58+
]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no])
59+
else
60+
AC_RUN_IFELSE([AC_LANG_SOURCE([[
61+
- main() {
62+
+ int main(void) {
63+
char buf[100];
64+
buf[0] = 0;
65+
strerror_r( 1, buf, sizeof buf );
66+
--- a/configure.ac
67+
+++ b/configure.ac
68+
@@ -1031,7 +1031,11 @@ dnl ----------------------------------------------------------------
69+
AC_CHECK_HEADERS( sys/epoll.h )
70+
if test "${ac_cv_header_sys_epoll_h}" = yes; then
71+
AC_MSG_CHECKING(for epoll system call)
72+
- AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv)
73+
+ AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <stdlib.h>
74+
+#ifdef HAVE_SYS_POLL_H
75+
+#include <sys/epoll.h>
76+
+#endif
77+
+int main(int argc, char **argv)
78+
{
79+
int epfd = epoll_create(256);
80+
exit (epfd == -1 ? 1 : 0);
81+
@@ -1493,10 +1497,8 @@ pthread_rwlock_t rwlock;
82+
dnl save the flags
83+
AC_LINK_IFELSE([AC_LANG_PROGRAM([[
84+
#include <pthread.h>
85+
-#ifndef NULL
86+
-#define NULL (void*)0
87+
-#endif
88+
-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
89+
+pthread_t thread;
90+
+]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
91+
])
92+
93+
if test $ol_cv_func_pthread_detach = no ; then
94+
@@ -1551,6 +1553,9 @@ dnl esac
95+
AC_CACHE_CHECK([if select yields when using pthreads],
96+
ol_cv_pthread_select_yields,[
97+
AC_RUN_IFELSE([AC_LANG_SOURCE([[
98+
+#define _XOPEN_SOURCE 500 /* For pthread_setconcurrency() on glibc */
99+
+#include <stdlib.h>
100+
+#include <stdio.h>
101+
#include <sys/types.h>
102+
#include <sys/time.h>
103+
#include <unistd.h>
104+
@@ -1561,8 +1566,7 @@ dnl esac
105+
106+
static int fildes[2];
107+
108+
-static void *task(p)
109+
- void *p;
110+
+static void *task(void *p)
111+
{
112+
int i;
113+
struct timeval tv;
114+
@@ -1586,9 +1590,7 @@ static void *task(p)
115+
exit(0); /* if we exit here, the select blocked the whole process */
116+
}
117+
118+
-int main(argc, argv)
119+
- int argc;
120+
- char **argv;
121+
+int main(int argc, char **argv)
122+
{
123+
pthread_t t;
124+
125+
--- a/contrib/ldaptcl/tclAppInit.c
126+
+++ b/contrib/ldaptcl/tclAppInit.c
127+
@@ -45,9 +45,7 @@ EXTERN int Tcltest_Init _ANSI_ARGS_((Tcl_Interp *interp));
128+
*/
129+
130+
int
131+
-main(argc, argv)
132+
- int argc; /* Number of command-line arguments. */
133+
- char **argv; /* Values of command-line arguments. */
134+
+main(int argc, char **argv)
135+
{
136+
#ifdef USE_TCLX
137+
TclX_Main(argc, argv, Tcl_AppInit);
138+
--- a/contrib/ldaptcl/tkAppInit.c
139+
+++ b/contrib/ldaptcl/tkAppInit.c
140+
@@ -37,16 +37,9 @@ int (*tclDummyMathPtr)() = matherr;
141+
* This is the main program for the application.
142+
*-----------------------------------------------------------------------------
143+
*/
144+
-#ifdef __cplusplus
145+
int
146+
main (int argc,
147+
char **argv)
148+
-#else
149+
-int
150+
-main (argc, argv)
151+
- int argc;
152+
- char **argv;
153+
-#endif
154+
{
155+
#ifdef USE_TCLX
156+
TkX_Main(argc, argv, Tcl_AppInit);
157+
@@ -68,14 +61,8 @@ main (argc, argv)
158+
* interp->result if an error occurs.
159+
*-----------------------------------------------------------------------------
160+
*/
161+
-#ifdef __cplusplus
162+
int
163+
Tcl_AppInit (Tcl_Interp *interp)
164+
-#else
165+
-int
166+
-Tcl_AppInit (interp)
167+
- Tcl_Interp *interp;
168+
-#endif
169+
{
170+
if (Tcl_Init (interp) == TCL_ERROR) {
171+
return TCL_ERROR;
172+
--- a/servers/slapd/syslog.c
173+
+++ b/servers/slapd/syslog.c
174+
@@ -209,7 +209,7 @@ openlog(const char *ident, int logstat, int logfac)
175+
}
176+
177+
void
178+
-closelog()
179+
+closelog(void)
180+
{
181+
(void)close(LogFile);
182+
LogFile = -1;
183+
--
184+
2.38.1
185+
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#
2+
# See slapd.conf(5) for details on configuration options.
3+
# This file should NOT be world readable.
4+
#
5+
include /etc/openldap/schema/core.schema
6+
7+
# Define global ACLs to disable default read access.
8+
9+
# Do not enable referrals until AFTER you have a working directory
10+
# service AND an understanding of referrals.
11+
#referral ldap://root.openldap.org
12+
13+
pidfile /run/openldap/slapd.pid
14+
argsfile /run/openldap/slapd.args
15+
16+
# Load dynamic backend modules:
17+
###INSERTDYNAMICMODULESHERE###
18+
19+
# Sample security restrictions
20+
# Require integrity protection (prevent hijacking)
21+
# Require 112-bit (3DES or better) encryption for updates
22+
# Require 63-bit encryption for simple bind
23+
# security ssf=1 update_ssf=112 simple_bind=64
24+
25+
# Sample access control policy:
26+
# Root DSE: allow anyone to read it
27+
# Subschema (sub)entry DSE: allow anyone to read it
28+
# Other DSEs:
29+
# Allow self write access
30+
# Allow authenticated users read access
31+
# Allow anonymous users to authenticate
32+
# Directives needed to implement policy:
33+
# access to dn.base="" by * read
34+
# access to dn.base="cn=Subschema" by * read
35+
# access to *
36+
# by self write
37+
# by users read
38+
# by anonymous auth
39+
#
40+
# if no access controls are present, the default policy
41+
# allows anyone and everyone to read anything but restricts
42+
# updates to rootdn. (e.g., "access to * by * read")
43+
#
44+
# rootdn can always read and write EVERYTHING!
45+
46+
#######################################################################
47+
# BDB database definitions
48+
#######################################################################
49+
50+
database mdb
51+
suffix "dc=my-domain,dc=com"
52+
# <kbyte> <min>
53+
checkpoint 32 30
54+
rootdn "cn=Manager,dc=my-domain,dc=com"
55+
# Cleartext passwords, especially for the rootdn, should
56+
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
57+
# Use of strong authentication encouraged.
58+
rootpw secret
59+
# The database directory MUST exist prior to running slapd AND
60+
# should only be accessible by the slapd and slap tools.
61+
# Mode 700 recommended.
62+
directory /var/lib/openldap-data
63+
# Indices to maintain
64+
index objectClass eq

0 commit comments

Comments
 (0)