From 6ff6b5be71c567e908b45d01f965b0d124a1cb6a Mon Sep 17 00:00:00 2001 From: Sangbum Kim Date: Thu, 27 Apr 2017 01:12:24 +0900 Subject: [PATCH] added initial commit --- PKGBUILD | 212 ++++++++++++++++++++++++++++++++++++++++ openldap-ntlm.patch | 230 ++++++++++++++++++++++++++++++++++++++++++++ openldap.sysusers | 1 + openldap.tmpfiles | 3 + slapd.service | 9 ++ 5 files changed, 455 insertions(+) create mode 100644 PKGBUILD create mode 100644 openldap-ntlm.patch create mode 100644 openldap.sysusers create mode 100644 openldap.tmpfiles create mode 100644 slapd.service diff --git a/PKGBUILD b/PKGBUILD new file mode 100644 index 0000000..acaa4de --- /dev/null +++ b/PKGBUILD @@ -0,0 +1,212 @@ +# $Id: PKGBUILD 294300 2017-04-24 11:54:27Z jgc $ +# Maintainer: + +pkgbase=openldap +pkgname=('openldap' 'libldap') +pkgver=2.4.44 +pkgrel=4 +arch=('i686' 'x86_64') +url="http://www.openldap.org/" +license=('custom') +makedepends=('libltdl' 'libsasl' 'e2fsprogs' 'util-linux' 'chrpath' 'unixodbc' ) +options=('!makeflags' 'emptydirs') +source=(ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/${pkgbase}-${pkgver}.tgz + slapd.service openldap.tmpfiles openldap.sysusers openldap-ntlm.patch) +sha1sums=('016a738d050a68d388602a74b5e991035cdba149' + '2441815efbfa01ad7a1d39068e5503b53d1d04b0' + '1f68bd85fb50595c4e916db164d8e90e0c6e21ee' + '2bf64351c32b0bf0a70663bd42de22910998b795' + 'e4afd9f1c810ef4c4cd8fe1101dfe5887f2b7eef') + +# see http://www.openldap.org/faq/data/cache/756.html +# there's no proper backend support for anything apart from +# BerkeleyDB, if we don't want to drop local backend server support +# we are forced to keep Berkeley DB here + +prepare() { + cd ${pkgbase}-${pkgver} + patch -p1 -i "${srcdir}"/openldap-ntlm.patch + sed -i 's|-m 644 $(LIBRARY)|-m 755 $(LIBRARY)|' libraries/{liblber,libldap,libldap_r}/Makefile.in + sed -i 's|#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"|#define LDAPI_SOCK LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"|' include/ldap_defaults.h + sed -i 's|%LOCALSTATEDIR%/run|/run/openldap|' servers/slapd/slapd.{conf,ldif} + sed -i 's|-$(MKDIR) $(DESTDIR)$(localstatedir)/run|-$(MKDIR) $(DESTDIR)/run/openldap|' servers/slapd/Makefile.in +} + +build() { + cd ${pkgbase}-${pkgver} + autoconf + ./configure --prefix=/usr --libexecdir=/usr/lib \ + --sysconfdir=/etc --localstatedir=/var/lib/openldap --sbindir=/usr/bin \ + --enable-dynamic --enable-syslog --enable-ipv6 --enable-local \ + --enable-crypt --enable-spasswd --enable-modules \ + --enable-backends --disable-ndb --enable-overlays=mod \ + --with-cyrus-sasl --with-threads + make -j12 + + pushd contrib/slapd-modules/nssov + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/nssov.so + popd + + pushd contrib/slapd-modules/passwd/pbkdf2 + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/pw-pbkdf2.so + popd + + pushd contrib/slapd-modules/passwd/sha2 + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/pw-sha2.so + popd + + + pushd contrib/slapd-modules/lastbind + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/lastbind.so + popd + + pushd contrib/slapd-modules/lastmod + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/lastmod.so + popd + + pushd contrib/slapd-modules/cloak + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/cloak.so + popd + + pushd contrib/slapd-modules/denyop + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/denyop.so + popd + + pushd contrib/slapd-modules/allowed + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/allowed.so + popd + + pushd contrib/slapd-modules/addpartial + make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap + chrpath -d .libs/addpartial.so + popd +} + +check() { + cd ${pkgbase}-${pkgver} +# make test +} + +package_libldap() { + pkgdesc="Lightweight Directory Access Protocol (LDAP) client libraries" + depends=('libsasl' 'e2fsprogs') + backup=('etc/openldap/ldap.conf') + + cd ${pkgbase}-${pkgver} + for dir in include libraries doc/man/man3 ; do + pushd ${dir} + make DESTDIR="${pkgdir}" install + popd + done + install -Dm644 doc/man/man5/ldap.conf.5.tmp "${pkgdir}"/usr/share/man/man5/ldap.conf.5 + +# get rid of duplicate default conf files + rm "${pkgdir}"/etc/openldap/*.default + + ln -sf liblber.so "${pkgdir}"/usr/lib/liblber.so.2 + ln -sf libldap.so "${pkgdir}"/usr/lib/libldap.so.2 + + install -Dm644 LICENSE "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE +} + +package_openldap() { + pkgdesc="Lightweight Directory Access Protocol (LDAP) client and server" + depends=("libldap>=${pkgver}" 'libltdl' 'unixodbc') + backup=('etc/openldap/slapd.conf' 'etc/openldap/slapd.ldif') + + cd ${pkgbase}-${pkgver} + for dir in clients servers doc/man/man{1,5,8}; do + pushd ${dir} + make DESTDIR="${pkgdir}" install + popd + done + + pushd contrib/slapd-modules/nssov + install -m755 .libs/nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap/nssov.so + ln -s nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap/nssov.so.0 + install -m444 ldapns.schema "${pkgdir}"/etc/openldap/schema + install -m644 slapo-nssov.5 "${pkgdir}"/usr/share/man/man5/slapo-nssov.5 + popd + + pushd contrib/slapd-modules/passwd/pbkdf2 + install -m755 .libs/pw-pbkdf2.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s pw-pbkdf2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-pbkdf2.so + ln -s pw-pbkdf2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-pbkdf2.so.0 + popd + + pushd contrib/slapd-modules/passwd/sha2 + install -m755 .libs/pw-sha2.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s pw-sha2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-sha2.so + ln -s pw-sha2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-sha2.so.0 + popd + + + pushd contrib/slapd-modules/lastbind + install -m755 .libs/lastbind.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s lastbind.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastbind.so + ln -s lastbind.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastbind.so.0 + install -m644 slapo-lastbind.5 "${pkgdir}"/usr/share/man/man5/slapo-lastbind.5 + popd + + pushd contrib/slapd-modules/lastmod + install -m755 .libs/lastmod.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s lastmod.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastmod.so + ln -s lastmod.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastmod.so.0 + install -m644 slapo-lastmod.5 "${pkgdir}"/usr/share/man/man5/slapo-lastmod.5 + popd + + pushd contrib/slapd-modules/cloak + install -m755 .libs/cloak.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s cloak.so.0.0.0 "${pkgdir}"/usr/lib/openldap/cloak.so + ln -s cloak.so.0.0.0 "${pkgdir}"/usr/lib/openldap/cloak.so.0 + install -m644 slapo-cloak.5 "${pkgdir}"/usr/share/man/man5/slapo-cloak.5 + popd + + pushd contrib/slapd-modules/denyop + install -m755 .libs/denyop.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s denyop.so.0.0.0 "${pkgdir}"/usr/lib/openldap/denyop.so + ln -s denyop.so.0.0.0 "${pkgdir}"/usr/lib/openldap/denyop.so.0 + popd + + pushd contrib/slapd-modules/allowed + install -m755 .libs/allowed.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s allowed.so.0.0.0 "${pkgdir}"/usr/lib/openldap/allowed.so + ln -s allowed.so.0.0.0 "${pkgdir}"/usr/lib/openldap/allowed.so.0 + popd + + pushd contrib/slapd-modules/addpartial + install -m755 .libs/addpartial.so.0.0.0 "${pkgdir}"/usr/lib/openldap + ln -s addpartial.so.0.0.0 "${pkgdir}"/usr/lib/openldap/addpartial.so + ln -s addpartial.so.0.0.0 "${pkgdir}"/usr/lib/openldap/addpartial.so.0 + popd + + + rm "${pkgdir}"/usr/share/man/man5/ldap.conf.5 + rm -r "${pkgdir}"/run + +# get rid of duplicate default conf files + rm "${pkgdir}"/etc/openldap/*.default + + ln -s ../lib/slapd "${pkgdir}"/usr/bin/slapd + + chown root:439 "${pkgdir}"/etc/openldap/{slapd.{conf,ldif},DB_CONFIG.example} + chmod 640 "${pkgdir}"/etc/openldap/{slapd.{conf,ldif},DB_CONFIG.example} + + install -dm700 -o 439 -g 439 "${pkgdir}"/var/lib/openldap + chown -R 439:439 "${pkgdir}"/var/lib/openldap + + install -dm700 -o 439 -g 439 "${pkgdir}"/etc/openldap/slapd.d + install -Dm644 "${srcdir}"/slapd.service "${pkgdir}"/usr/lib/systemd/system/slapd.service + install -Dm644 "${srcdir}"/openldap.tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/openldap.conf + install -Dm644 "${srcdir}"/openldap.sysusers "${pkgdir}"/usr/lib/sysusers.d/openldap.conf + install -Dm644 LICENSE "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE +} diff --git a/openldap-ntlm.patch b/openldap-ntlm.patch new file mode 100644 index 0000000..6804b61 --- /dev/null +++ b/openldap-ntlm.patch @@ -0,0 +1,230 @@ +Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is +actually called by evolution-data-server, checked at version 1.12.2. +Without this patch, the Exchange addressbook integration uses simple binds +with cleartext passwords. + +Russ checked with openldap-software for upstream's opinion on this patch +on 2007-12-21. Upstream had never received it as a patch submission and +given that it's apparently only for older Exchange servers that can't do +SASL and DIGEST-MD5, it's not very appealing. + +Bug#457374 filed against evolution-data-server asking if this support is +still required on 2007-12-21. + +Index: trunk/include/ldap.h +=================================================================== +--- trunk.orig/include/ldap.h ++++ trunk/include/ldap.h +@@ -2461,5 +2461,25 @@ + LDAPControl **ctrls, + LDAPDerefRes **drp )); + ++/* ++ * hacks for NTLM ++ */ ++#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU) ++#define LDAP_AUTH_NTLM_RESPONSE ((ber_tag_t) 0x8bU) ++LDAP_F( int ) ++ldap_ntlm_bind LDAP_P(( ++ LDAP *ld, ++ LDAP_CONST char *dn, ++ ber_tag_t tag, ++ struct berval *cred, ++ LDAPControl **sctrls, ++ LDAPControl **cctrls, ++ int *msgidp )); ++LDAP_F( int ) ++ldap_parse_ntlm_bind_result LDAP_P(( ++ LDAP *ld, ++ LDAPMessage *res, ++ struct berval *challenge)); ++ + LDAP_END_DECL + #endif /* _LDAP_H */ +Index: trunk/libraries/libldap/ntlm.c +=================================================================== +--- /dev/null ++++ trunk/libraries/libldap/ntlm.c +@@ -0,0 +1,138 @@ ++/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */ ++/* ++ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. ++ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file ++ */ ++ ++/* Mostly copied from sasl.c */ ++ ++#include "portable.h" ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++#include "ldap-int.h" ++ ++int ++ldap_ntlm_bind( ++ LDAP *ld, ++ LDAP_CONST char *dn, ++ ber_tag_t tag, ++ struct berval *cred, ++ LDAPControl **sctrls, ++ LDAPControl **cctrls, ++ int *msgidp ) ++{ ++ BerElement *ber; ++ int rc; ++ ber_int_t id; ++ ++ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 ); ++ ++ assert( ld != NULL ); ++ assert( LDAP_VALID( ld ) ); ++ assert( msgidp != NULL ); ++ ++ if( msgidp == NULL ) { ++ ld->ld_errno = LDAP_PARAM_ERROR; ++ return ld->ld_errno; ++ } ++ ++ /* create a message to send */ ++ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) { ++ ld->ld_errno = LDAP_NO_MEMORY; ++ return ld->ld_errno; ++ } ++ ++ assert( LBER_VALID( ber ) ); ++ ++ LDAP_NEXT_MSGID( ld, id ); ++ rc = ber_printf( ber, "{it{istON}" /*}*/, ++ id, LDAP_REQ_BIND, ++ ld->ld_version, dn, tag, ++ cred ); ++ ++ /* Put Server Controls */ ++ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) { ++ ber_free( ber, 1 ); ++ return ld->ld_errno; ++ } ++ ++ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) { ++ ld->ld_errno = LDAP_ENCODING_ERROR; ++ ber_free( ber, 1 ); ++ return ld->ld_errno; ++ } ++ ++ /* send the message */ ++ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id ); ++ ++ if(*msgidp < 0) ++ return ld->ld_errno; ++ ++ return LDAP_SUCCESS; ++} ++ ++int ++ldap_parse_ntlm_bind_result( ++ LDAP *ld, ++ LDAPMessage *res, ++ struct berval *challenge) ++{ ++ ber_int_t errcode; ++ ber_tag_t tag; ++ BerElement *ber; ++ ber_len_t len; ++ ++ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 ); ++ ++ assert( ld != NULL ); ++ assert( LDAP_VALID( ld ) ); ++ assert( res != NULL ); ++ ++ if ( ld == NULL || res == NULL ) { ++ return LDAP_PARAM_ERROR; ++ } ++ ++ if( res->lm_msgtype != LDAP_RES_BIND ) { ++ ld->ld_errno = LDAP_PARAM_ERROR; ++ return ld->ld_errno; ++ } ++ ++ if ( ld->ld_error ) { ++ LDAP_FREE( ld->ld_error ); ++ ld->ld_error = NULL; ++ } ++ if ( ld->ld_matched ) { ++ LDAP_FREE( ld->ld_matched ); ++ ld->ld_matched = NULL; ++ } ++ ++ /* parse results */ ++ ++ ber = ber_dup( res->lm_ber ); ++ ++ if( ber == NULL ) { ++ ld->ld_errno = LDAP_NO_MEMORY; ++ return ld->ld_errno; ++ } ++ ++ tag = ber_scanf( ber, "{ioa" /*}*/, ++ &errcode, challenge, &ld->ld_error ); ++ ber_free( ber, 0 ); ++ ++ if( tag == LBER_ERROR ) { ++ ld->ld_errno = LDAP_DECODING_ERROR; ++ return ld->ld_errno; ++ } ++ ++ ld->ld_errno = errcode; ++ ++ return( ld->ld_errno ); ++} ++ +Index: trunk/libraries/libldap/Makefile.in +=================================================================== +--- trunk.orig/libraries/libldap/Makefile.in ++++ trunk/libraries/libldap/Makefile.in +@@ -27,7 +27,7 @@ + init.c options.c print.c string.c util-int.c schema.c \ + charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ + tls2.c tls_o.c tls_g.c tls_m.c \ +- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ ++ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \ + assertion.c deref.c ldif.c fetch.c + + OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \ +@@ -40,7 +40,7 @@ + init.lo options.lo print.lo string.lo util-int.lo schema.lo \ + charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ + tls2.lo tls_o.lo tls_g.lo tls_m.lo \ +- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ ++ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \ + assertion.lo deref.lo ldif.lo fetch.lo + + LDAP_INCDIR= ../../include +Index: trunk/libraries/libldap_r/Makefile.in +=================================================================== +--- trunk.orig/libraries/libldap_r/Makefile.in ++++ trunk/libraries/libldap_r/Makefile.in +@@ -29,7 +29,7 @@ + init.c options.c print.c string.c util-int.c schema.c \ + charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \ + tls2.c tls_o.c tls_g.c tls_m.c \ +- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \ ++ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \ + assertion.c deref.c ldif.c fetch.c + SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \ + thr_posix.c thr_cthreads.c thr_thr.c thr_lwp.c thr_nt.c \ +@@ -47,7 +47,7 @@ + init.lo options.lo print.lo string.lo util-int.lo schema.lo \ + charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \ + tls2.lo tls_o.lo tls_g.lo tls_m.lo \ +- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \ ++ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \ + assertion.lo deref.lo ldif.lo fetch.lo + + LDAP_INCDIR= ../../include diff --git a/openldap.sysusers b/openldap.sysusers new file mode 100644 index 0000000..362d6c1 --- /dev/null +++ b/openldap.sysusers @@ -0,0 +1 @@ +u ldap 439 "LDAP Server" /var/lib/openldap diff --git a/openldap.tmpfiles b/openldap.tmpfiles new file mode 100644 index 0000000..9337fce --- /dev/null +++ b/openldap.tmpfiles @@ -0,0 +1,3 @@ +D /run/openldap 0755 ldap ldap - + +f /var/lib/openldap/.placeholder 0644 ldap ldap - "prevent pwcheck error; pacman should not remove ~ldap" diff --git a/slapd.service b/slapd.service new file mode 100644 index 0000000..a664fa3 --- /dev/null +++ b/slapd.service @@ -0,0 +1,9 @@ +[Unit] +Description=OpenLDAP server daemon + +[Service] +Type=forking +ExecStart=/usr/bin/slapd -u ldap -g ldap + +[Install] +WantedBy=multi-user.target