1
0
Fork 0

added initial commit

This commit is contained in:
Sangbum Kim 2017-04-27 01:12:24 +09:00
commit 6ff6b5be71
5 changed files with 455 additions and 0 deletions

212
PKGBUILD Normal file
View File

@ -0,0 +1,212 @@
# $Id: PKGBUILD 294300 2017-04-24 11:54:27Z jgc $
# Maintainer:
pkgbase=openldap
pkgname=('openldap' 'libldap')
pkgver=2.4.44
pkgrel=4
arch=('i686' 'x86_64')
url="http://www.openldap.org/"
license=('custom')
makedepends=('libltdl' 'libsasl' 'e2fsprogs' 'util-linux' 'chrpath' 'unixodbc' )
options=('!makeflags' 'emptydirs')
source=(ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/${pkgbase}-${pkgver}.tgz
slapd.service openldap.tmpfiles openldap.sysusers openldap-ntlm.patch)
sha1sums=('016a738d050a68d388602a74b5e991035cdba149'
'2441815efbfa01ad7a1d39068e5503b53d1d04b0'
'1f68bd85fb50595c4e916db164d8e90e0c6e21ee'
'2bf64351c32b0bf0a70663bd42de22910998b795'
'e4afd9f1c810ef4c4cd8fe1101dfe5887f2b7eef')
# see http://www.openldap.org/faq/data/cache/756.html
# there's no proper backend support for anything apart from
# BerkeleyDB, if we don't want to drop local backend server support
# we are forced to keep Berkeley DB here
prepare() {
cd ${pkgbase}-${pkgver}
patch -p1 -i "${srcdir}"/openldap-ntlm.patch
sed -i 's|-m 644 $(LIBRARY)|-m 755 $(LIBRARY)|' libraries/{liblber,libldap,libldap_r}/Makefile.in
sed -i 's|#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"|#define LDAPI_SOCK LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"|' include/ldap_defaults.h
sed -i 's|%LOCALSTATEDIR%/run|/run/openldap|' servers/slapd/slapd.{conf,ldif}
sed -i 's|-$(MKDIR) $(DESTDIR)$(localstatedir)/run|-$(MKDIR) $(DESTDIR)/run/openldap|' servers/slapd/Makefile.in
}
build() {
cd ${pkgbase}-${pkgver}
autoconf
./configure --prefix=/usr --libexecdir=/usr/lib \
--sysconfdir=/etc --localstatedir=/var/lib/openldap --sbindir=/usr/bin \
--enable-dynamic --enable-syslog --enable-ipv6 --enable-local \
--enable-crypt --enable-spasswd --enable-modules \
--enable-backends --disable-ndb --enable-overlays=mod \
--with-cyrus-sasl --with-threads
make -j12
pushd contrib/slapd-modules/nssov
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/nssov.so
popd
pushd contrib/slapd-modules/passwd/pbkdf2
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/pw-pbkdf2.so
popd
pushd contrib/slapd-modules/passwd/sha2
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/pw-sha2.so
popd
pushd contrib/slapd-modules/lastbind
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/lastbind.so
popd
pushd contrib/slapd-modules/lastmod
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/lastmod.so
popd
pushd contrib/slapd-modules/cloak
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/cloak.so
popd
pushd contrib/slapd-modules/denyop
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/denyop.so
popd
pushd contrib/slapd-modules/allowed
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/allowed.so
popd
pushd contrib/slapd-modules/addpartial
make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
chrpath -d .libs/addpartial.so
popd
}
check() {
cd ${pkgbase}-${pkgver}
# make test
}
package_libldap() {
pkgdesc="Lightweight Directory Access Protocol (LDAP) client libraries"
depends=('libsasl' 'e2fsprogs')
backup=('etc/openldap/ldap.conf')
cd ${pkgbase}-${pkgver}
for dir in include libraries doc/man/man3 ; do
pushd ${dir}
make DESTDIR="${pkgdir}" install
popd
done
install -Dm644 doc/man/man5/ldap.conf.5.tmp "${pkgdir}"/usr/share/man/man5/ldap.conf.5
# get rid of duplicate default conf files
rm "${pkgdir}"/etc/openldap/*.default
ln -sf liblber.so "${pkgdir}"/usr/lib/liblber.so.2
ln -sf libldap.so "${pkgdir}"/usr/lib/libldap.so.2
install -Dm644 LICENSE "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE
}
package_openldap() {
pkgdesc="Lightweight Directory Access Protocol (LDAP) client and server"
depends=("libldap>=${pkgver}" 'libltdl' 'unixodbc')
backup=('etc/openldap/slapd.conf' 'etc/openldap/slapd.ldif')
cd ${pkgbase}-${pkgver}
for dir in clients servers doc/man/man{1,5,8}; do
pushd ${dir}
make DESTDIR="${pkgdir}" install
popd
done
pushd contrib/slapd-modules/nssov
install -m755 .libs/nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap/nssov.so
ln -s nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap/nssov.so.0
install -m444 ldapns.schema "${pkgdir}"/etc/openldap/schema
install -m644 slapo-nssov.5 "${pkgdir}"/usr/share/man/man5/slapo-nssov.5
popd
pushd contrib/slapd-modules/passwd/pbkdf2
install -m755 .libs/pw-pbkdf2.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s pw-pbkdf2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-pbkdf2.so
ln -s pw-pbkdf2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-pbkdf2.so.0
popd
pushd contrib/slapd-modules/passwd/sha2
install -m755 .libs/pw-sha2.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s pw-sha2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-sha2.so
ln -s pw-sha2.so.0.0.0 "${pkgdir}"/usr/lib/openldap/pw-sha2.so.0
popd
pushd contrib/slapd-modules/lastbind
install -m755 .libs/lastbind.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s lastbind.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastbind.so
ln -s lastbind.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastbind.so.0
install -m644 slapo-lastbind.5 "${pkgdir}"/usr/share/man/man5/slapo-lastbind.5
popd
pushd contrib/slapd-modules/lastmod
install -m755 .libs/lastmod.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s lastmod.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastmod.so
ln -s lastmod.so.0.0.0 "${pkgdir}"/usr/lib/openldap/lastmod.so.0
install -m644 slapo-lastmod.5 "${pkgdir}"/usr/share/man/man5/slapo-lastmod.5
popd
pushd contrib/slapd-modules/cloak
install -m755 .libs/cloak.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s cloak.so.0.0.0 "${pkgdir}"/usr/lib/openldap/cloak.so
ln -s cloak.so.0.0.0 "${pkgdir}"/usr/lib/openldap/cloak.so.0
install -m644 slapo-cloak.5 "${pkgdir}"/usr/share/man/man5/slapo-cloak.5
popd
pushd contrib/slapd-modules/denyop
install -m755 .libs/denyop.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s denyop.so.0.0.0 "${pkgdir}"/usr/lib/openldap/denyop.so
ln -s denyop.so.0.0.0 "${pkgdir}"/usr/lib/openldap/denyop.so.0
popd
pushd contrib/slapd-modules/allowed
install -m755 .libs/allowed.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s allowed.so.0.0.0 "${pkgdir}"/usr/lib/openldap/allowed.so
ln -s allowed.so.0.0.0 "${pkgdir}"/usr/lib/openldap/allowed.so.0
popd
pushd contrib/slapd-modules/addpartial
install -m755 .libs/addpartial.so.0.0.0 "${pkgdir}"/usr/lib/openldap
ln -s addpartial.so.0.0.0 "${pkgdir}"/usr/lib/openldap/addpartial.so
ln -s addpartial.so.0.0.0 "${pkgdir}"/usr/lib/openldap/addpartial.so.0
popd
rm "${pkgdir}"/usr/share/man/man5/ldap.conf.5
rm -r "${pkgdir}"/run
# get rid of duplicate default conf files
rm "${pkgdir}"/etc/openldap/*.default
ln -s ../lib/slapd "${pkgdir}"/usr/bin/slapd
chown root:439 "${pkgdir}"/etc/openldap/{slapd.{conf,ldif},DB_CONFIG.example}
chmod 640 "${pkgdir}"/etc/openldap/{slapd.{conf,ldif},DB_CONFIG.example}
install -dm700 -o 439 -g 439 "${pkgdir}"/var/lib/openldap
chown -R 439:439 "${pkgdir}"/var/lib/openldap
install -dm700 -o 439 -g 439 "${pkgdir}"/etc/openldap/slapd.d
install -Dm644 "${srcdir}"/slapd.service "${pkgdir}"/usr/lib/systemd/system/slapd.service
install -Dm644 "${srcdir}"/openldap.tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/openldap.conf
install -Dm644 "${srcdir}"/openldap.sysusers "${pkgdir}"/usr/lib/sysusers.d/openldap.conf
install -Dm644 LICENSE "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE
}

230
openldap-ntlm.patch Normal file
View File

@ -0,0 +1,230 @@
Patch from evolution-exchange (2.10.3). The ldap_ntlm_bind function is
actually called by evolution-data-server, checked at version 1.12.2.
Without this patch, the Exchange addressbook integration uses simple binds
with cleartext passwords.
Russ checked with openldap-software for upstream's opinion on this patch
on 2007-12-21. Upstream had never received it as a patch submission and
given that it's apparently only for older Exchange servers that can't do
SASL and DIGEST-MD5, it's not very appealing.
Bug#457374 filed against evolution-data-server asking if this support is
still required on 2007-12-21.
Index: trunk/include/ldap.h
===================================================================
--- trunk.orig/include/ldap.h
+++ trunk/include/ldap.h
@@ -2461,5 +2461,25 @@
LDAPControl **ctrls,
LDAPDerefRes **drp ));
+/*
+ * hacks for NTLM
+ */
+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
+#define LDAP_AUTH_NTLM_RESPONSE ((ber_tag_t) 0x8bU)
+LDAP_F( int )
+ldap_ntlm_bind LDAP_P((
+ LDAP *ld,
+ LDAP_CONST char *dn,
+ ber_tag_t tag,
+ struct berval *cred,
+ LDAPControl **sctrls,
+ LDAPControl **cctrls,
+ int *msgidp ));
+LDAP_F( int )
+ldap_parse_ntlm_bind_result LDAP_P((
+ LDAP *ld,
+ LDAPMessage *res,
+ struct berval *challenge));
+
LDAP_END_DECL
#endif /* _LDAP_H */
Index: trunk/libraries/libldap/ntlm.c
===================================================================
--- /dev/null
+++ trunk/libraries/libldap/ntlm.c
@@ -0,0 +1,138 @@
+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
+/*
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+ */
+
+/* Mostly copied from sasl.c */
+
+#include "portable.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/errno.h>
+
+#include "ldap-int.h"
+
+int
+ldap_ntlm_bind(
+ LDAP *ld,
+ LDAP_CONST char *dn,
+ ber_tag_t tag,
+ struct berval *cred,
+ LDAPControl **sctrls,
+ LDAPControl **cctrls,
+ int *msgidp )
+{
+ BerElement *ber;
+ int rc;
+ ber_int_t id;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( msgidp != NULL );
+
+ if( msgidp == NULL ) {
+ ld->ld_errno = LDAP_PARAM_ERROR;
+ return ld->ld_errno;
+ }
+
+ /* create a message to send */
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
+ ld->ld_errno = LDAP_NO_MEMORY;
+ return ld->ld_errno;
+ }
+
+ assert( LBER_VALID( ber ) );
+
+ LDAP_NEXT_MSGID( ld, id );
+ rc = ber_printf( ber, "{it{istON}" /*}*/,
+ id, LDAP_REQ_BIND,
+ ld->ld_version, dn, tag,
+ cred );
+
+ /* Put Server Controls */
+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
+ ber_free( ber, 1 );
+ return ld->ld_errno;
+ }
+
+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
+ ld->ld_errno = LDAP_ENCODING_ERROR;
+ ber_free( ber, 1 );
+ return ld->ld_errno;
+ }
+
+ /* send the message */
+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
+
+ if(*msgidp < 0)
+ return ld->ld_errno;
+
+ return LDAP_SUCCESS;
+}
+
+int
+ldap_parse_ntlm_bind_result(
+ LDAP *ld,
+ LDAPMessage *res,
+ struct berval *challenge)
+{
+ ber_int_t errcode;
+ ber_tag_t tag;
+ BerElement *ber;
+ ber_len_t len;
+
+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
+
+ assert( ld != NULL );
+ assert( LDAP_VALID( ld ) );
+ assert( res != NULL );
+
+ if ( ld == NULL || res == NULL ) {
+ return LDAP_PARAM_ERROR;
+ }
+
+ if( res->lm_msgtype != LDAP_RES_BIND ) {
+ ld->ld_errno = LDAP_PARAM_ERROR;
+ return ld->ld_errno;
+ }
+
+ if ( ld->ld_error ) {
+ LDAP_FREE( ld->ld_error );
+ ld->ld_error = NULL;
+ }
+ if ( ld->ld_matched ) {
+ LDAP_FREE( ld->ld_matched );
+ ld->ld_matched = NULL;
+ }
+
+ /* parse results */
+
+ ber = ber_dup( res->lm_ber );
+
+ if( ber == NULL ) {
+ ld->ld_errno = LDAP_NO_MEMORY;
+ return ld->ld_errno;
+ }
+
+ tag = ber_scanf( ber, "{ioa" /*}*/,
+ &errcode, challenge, &ld->ld_error );
+ ber_free( ber, 0 );
+
+ if( tag == LBER_ERROR ) {
+ ld->ld_errno = LDAP_DECODING_ERROR;
+ return ld->ld_errno;
+ }
+
+ ld->ld_errno = errcode;
+
+ return( ld->ld_errno );
+}
+
Index: trunk/libraries/libldap/Makefile.in
===================================================================
--- trunk.orig/libraries/libldap/Makefile.in
+++ trunk/libraries/libldap/Makefile.in
@@ -27,7 +27,7 @@
init.c options.c print.c string.c util-int.c schema.c \
charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
tls2.c tls_o.c tls_g.c tls_m.c \
- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
assertion.c deref.c ldif.c fetch.c
OBJS = bind.lo open.lo result.lo error.lo compare.lo search.lo \
@@ -40,7 +40,7 @@
init.lo options.lo print.lo string.lo util-int.lo schema.lo \
charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
tls2.lo tls_o.lo tls_g.lo tls_m.lo \
- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
assertion.lo deref.lo ldif.lo fetch.lo
LDAP_INCDIR= ../../include
Index: trunk/libraries/libldap_r/Makefile.in
===================================================================
--- trunk.orig/libraries/libldap_r/Makefile.in
+++ trunk/libraries/libldap_r/Makefile.in
@@ -29,7 +29,7 @@
init.c options.c print.c string.c util-int.c schema.c \
charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
tls2.c tls_o.c tls_g.c tls_m.c \
- turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
+ turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
assertion.c deref.c ldif.c fetch.c
SRCS = threads.c rdwr.c rmutex.c tpool.c rq.c \
thr_posix.c thr_cthreads.c thr_thr.c thr_lwp.c thr_nt.c \
@@ -47,7 +47,7 @@
init.lo options.lo print.lo string.lo util-int.lo schema.lo \
charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
tls2.lo tls_o.lo tls_g.lo tls_m.lo \
- turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
+ turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
assertion.lo deref.lo ldif.lo fetch.lo
LDAP_INCDIR= ../../include

1
openldap.sysusers Normal file
View File

@ -0,0 +1 @@
u ldap 439 "LDAP Server" /var/lib/openldap

3
openldap.tmpfiles Normal file
View File

@ -0,0 +1,3 @@
D /run/openldap 0755 ldap ldap -
f /var/lib/openldap/.placeholder 0644 ldap ldap - "prevent pwcheck error; pacman should not remove ~ldap"

9
slapd.service Normal file
View File

@ -0,0 +1,9 @@
[Unit]
Description=OpenLDAP server daemon
[Service]
Type=forking
ExecStart=/usr/bin/slapd -u ldap -g ldap
[Install]
WantedBy=multi-user.target