From 7c996d3dbc7f8609f7dedbf0928305930d86c9cf Mon Sep 17 00:00:00 2001
From: Britney Fransen <brfransen@gmail.com>
Date: Mon, 14 Apr 2014 22:54:39 +0000
Subject: openldap: update to 2.4.39. refs #961

---
 abs/core/openldap/PKGBUILD                         |  78 +++---
 .../openldap/mutex-end-of-struct-sigsegv.patch     | 293 ---------------------
 abs/core/openldap/ntlm.patch                       | 230 ----------------
 abs/core/openldap/openldap-ntlm.patch              | 230 ++++++++++++++++
 abs/core/openldap/openldap.install                 |   1 +
 abs/core/openldap/slapd                            |  49 ----
 abs/core/openldap/slapd.default                    |   6 -
 abs/core/openldap/slapd.service                    |   2 +-
 abs/core/openldap/slapd.tmpfiles                   |   2 +-
 9 files changed, 277 insertions(+), 614 deletions(-)
 delete mode 100644 abs/core/openldap/mutex-end-of-struct-sigsegv.patch
 delete mode 100644 abs/core/openldap/ntlm.patch
 create mode 100644 abs/core/openldap/openldap-ntlm.patch
 delete mode 100755 abs/core/openldap/slapd
 delete mode 100644 abs/core/openldap/slapd.default

diff --git a/abs/core/openldap/PKGBUILD b/abs/core/openldap/PKGBUILD
index b7af129..0131552 100644
--- a/abs/core/openldap/PKGBUILD
+++ b/abs/core/openldap/PKGBUILD
@@ -1,39 +1,40 @@
-# $Id: PKGBUILD 162887 2012-07-02 18:03:02Z eric $
+# $Id$
 # Maintainer:
 
 pkgbase=openldap
 pkgname=('libldap' 'openldap')
-pkgver=2.4.31
-pkgrel=4
+pkgver=2.4.39
+pkgrel=1
 arch=('i686' 'x86_64')
 url="http://www.openldap.org/"
 license=('custom')
-makedepends=('libltdl' 'libsasl' 'e2fsprogs' 'util-linux')
+makedepends=('libltdl' 'libsasl' 'e2fsprogs' 'util-linux' 'chrpath')
+#options=('!makeflags')
 source=(ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/${pkgbase}-${pkgver}.tgz
-        slapd slapd.default slapd.service slapd.tmpfiles
-        ntlm.patch
-        mutex-end-of-struct-sigsegv.patch)
-sha1sums=('8315a283fb3724abe6062e38d93bb69298d05765'
-          'bd1ea19256d3d467f1f803e0f4046ef50f17628f'
-          'd89b8a533045123f1ab46c9c430cf132d58a20a4'
-          'a2cdab7e800a9f0c8b1e319a68598a12f4af27a4'
-          'f86a82e35ebe15026980467c9dee4007e686b795'
-          'e4afd9f1c810ef4c4cd8fe1101dfe5887f2b7eef'
-          '694269dad78c7a806649c2d7f57bb7e503df3af1')
+        slapd.service slapd.tmpfiles openldap-ntlm.patch)
+sha1sums=('2b8e8401214867c361f7212e7058f95118b5bd6c'
+          '2441815efbfa01ad7a1d39068e5503b53d1d04b0'
+          '59241a813d7508294e4ef1cec3bfe1f5495e109d'
+          'e4afd9f1c810ef4c4cd8fe1101dfe5887f2b7eef')
 
-build() {
-  cd "${srcdir}"/${pkgbase}-${pkgver}
-  patch -Np1 -i "${srcdir}"/ntlm.patch
-  patch -Np1 -i "${srcdir}"/mutex-end-of-struct-sigsegv.patch
+# see http://www.openldap.org/faq/data/cache/756.html
+# there's no proper backend support for anything apart from
+# BerkeleyDB, if we don't want to drop local backend server support 
+# we are forced to keep Berkeley DB here
 
+prepare() {
+  cd ${pkgbase}-${pkgver}
+  patch -p1 -i "${srcdir}"/openldap-ntlm.patch
   sed -i 's|-m 644 $(LIBRARY)|-m 755 $(LIBRARY)|' libraries/{liblber,libldap,libldap_r}/Makefile.in
   sed -i 's|#define LDAPI_SOCK LDAP_RUNDIR LDAP_DIRSEP "run" LDAP_DIRSEP "ldapi"|#define LDAPI_SOCK LDAP_DIRSEP "run" LDAP_DIRSEP "openldap" LDAP_DIRSEP "ldapi"|' include/ldap_defaults.h
-  sed -i 's|%LOCALSTATEDIR%/run|/run/openldap|' servers/slapd/slapd.conf
+  sed -i 's|%LOCALSTATEDIR%/run|/run/openldap|' servers/slapd/slapd.{conf,ldif}
   sed -i 's|-$(MKDIR) $(DESTDIR)$(localstatedir)/run|-$(MKDIR) $(DESTDIR)/run/openldap|' servers/slapd/Makefile.in
+}
 
-  LDFLAGS="$LDFLAGS -L\"${pkgdir}\"/libldap/usr/lib" 
+build() {
+  cd ${pkgbase}-${pkgver}
   ./configure --prefix=/usr --mandir=/usr/share/man --libexecdir=/usr/lib \
-    --sysconfdir=/etc --localstatedir=/var/lib/openldap \
+    --sysconfdir=/etc --localstatedir=/var/lib/openldap --sbindir=/usr/bin \
     --enable-ipv6 --enable-syslog --enable-local \
     --enable-bdb --enable-hdb \
     --enable-crypt --enable-dynamic \
@@ -42,10 +43,14 @@ build() {
     --enable-spasswd --with-cyrus-sasl \
     --enable-overlays=mod --enable-modules=yes
   make
+
+  cd contrib/slapd-modules/nssov
+  make prefix=/usr libexecdir=/usr/lib sysconfdir=/etc/openldap
+  chrpath -d .libs/nssov.so
 }
 
 check() {
-  cd "${srcdir}"/${pkgbase}-${pkgver}
+  cd ${pkgbase}-${pkgver}
   make test
 }
 
@@ -53,9 +58,8 @@ package_libldap() {
   pkgdesc="Lightweight Directory Access Protocol (LDAP) client libraries"
   depends=('libsasl' 'e2fsprogs')
   backup=('etc/openldap/ldap.conf')
-  options=('!libtool')
 
-  cd "${srcdir}"/${pkgbase}-${pkgver}
+  cd ${pkgbase}-${pkgver}
   for dir in include libraries doc/man/man3 ; do
     pushd ${dir}
     make DESTDIR="${pkgdir}" install
@@ -74,32 +78,38 @@ package_libldap() {
 
 package_openldap() {
   pkgdesc="Lightweight Directory Access Protocol (LDAP) client and server"
-  depends=("libldap>=${pkgver}" 'libltdl' 'util-linux')
-  backup=('etc/openldap/slapd.conf' 'etc/conf.d/slapd')
-  options=('!libtool' 'emptydirs')
+  depends=("libldap>=${pkgver}" 'libltdl')
+  backup=('etc/openldap/slapd.conf' 'etc/openldap/slapd.ldif')
+  options=('emptydirs')
   install=openldap.install
 
-  cd "${srcdir}"/${pkgbase}-${pkgver}
-  for dir in clients servers doc/man/man{1,5,8} ; do
+  cd ${pkgbase}-${pkgver}
+  for dir in clients servers doc/man/man{1,5,8}; do
     pushd ${dir}
     make DESTDIR="${pkgdir}" install
     popd
   done
+
+  pushd contrib/slapd-modules/nssov
+  install -m755 .libs/nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap
+  ln -s nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap/nssov.so
+  ln -s nssov.so.0.0.0 "${pkgdir}"/usr/lib/openldap/nssov.so.0
+  install -m444 ldapns.schema "${pkgdir}"/etc/openldap/schema
+  popd
+
   rm "${pkgdir}"/usr/share/man/man5/ldap.conf.5
   rm -r "${pkgdir}"/run
 
 # get rid of duplicate default conf files
   rm "${pkgdir}"/etc/openldap/*.default
 
-  ln -s ../lib/slapd "${pkgdir}"/usr/sbin/slapd
+  ln -s ../lib/slapd "${pkgdir}"/usr/bin/slapd
 
-  chown root:439 "${pkgdir}"/etc/openldap/{slapd.conf,DB_CONFIG.example}
-  chmod 640 "${pkgdir}"/etc/openldap/{slapd.conf,DB_CONFIG.example}
+  chown root:439 "${pkgdir}"/etc/openldap/{slapd.{conf,ldif},DB_CONFIG.example}
+  chmod 640 "${pkgdir}"/etc/openldap/{slapd.{conf,ldif},DB_CONFIG.example}
 
   install -dm700 -o 439 -g 439 "${pkgdir}"/var/lib/openldap
   install -dm700 -o 439 -g 439 "${pkgdir}"/etc/openldap/slapd.d
-  install -Dm755 "${srcdir}"/slapd "${pkgdir}"/etc/rc.d/slapd
-  install -Dm644 "${srcdir}"/slapd.default "${pkgdir}"/etc/conf.d/slapd
   install -Dm644 "${srcdir}"/slapd.service "${pkgdir}"/usr/lib/systemd/system/slapd.service
   install -Dm644 "${srcdir}"/slapd.tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/slapd.conf
   install -Dm644 LICENSE "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE
diff --git a/abs/core/openldap/mutex-end-of-struct-sigsegv.patch b/abs/core/openldap/mutex-end-of-struct-sigsegv.patch
deleted file mode 100644
index e899638..0000000
--- a/abs/core/openldap/mutex-end-of-struct-sigsegv.patch
+++ /dev/null
@@ -1,293 +0,0 @@
- libraries/libldap/init.c     |    8 ++-
- libraries/libldap/ldap-int.h |  198 ++++++++++++++++++++++--------------------
- 2 files changed, 110 insertions(+), 96 deletions(-)
-
-diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
-index 39292d2..9d37e64 100644
---- a/libraries/libldap/init.c
-+++ b/libraries/libldap/init.c
-@@ -36,7 +36,13 @@
- #include "lutil.h"
- 
- struct ldapoptions ldap_int_global_options =
--	{ LDAP_UNINITIALIZED, LDAP_DEBUG_NONE LDAP_LDO_MUTEX_NULLARG };  
-+	{ LDAP_UNINITIALIZED, LDAP_DEBUG_NONE
-+		LDAP_LDO_NULLARG
-+		LDAP_LDO_CONNECTIONLESS_NULLARG
-+		LDAP_LDO_TLS_NULLARG
-+		LDAP_LDO_SASL_NULLARG
-+		LDAP_LDO_GSSAPI_NULLARG
-+		LDAP_LDO_MUTEX_NULLARG };
- 
- #define ATTR_NONE	0
- #define ATTR_BOOL	1
-diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
-index f8e6126..ac6c9e5 100644
---- a/libraries/libldap/ldap-int.h
-+++ b/libraries/libldap/ldap-int.h
-@@ -185,29 +185,59 @@ struct ldapoptions {
- #define LDAP_TRASHED_SESSION	0xFF
- 	int   ldo_debug;
- 
--#ifdef LDAP_R_COMPILE
--	ldap_pvt_thread_mutex_t	ldo_mutex;
--#define LDAP_LDO_MUTEX_NULLARG	, LDAP_PVT_MUTEX_NULL
--#else
--#define LDAP_LDO_MUTEX_NULLARG
--#endif
-+	ber_int_t		ldo_version;
-+	ber_int_t		ldo_deref;
-+	ber_int_t		ldo_timelimit;
-+	ber_int_t		ldo_sizelimit;
-+
-+	/* per API call timeout */
-+	struct timeval		ldo_tm_api;
-+	struct timeval		ldo_tm_net;
-+
-+	LDAPURLDesc *ldo_defludp;
-+	int		ldo_defport;
-+	char*	ldo_defbase;
-+	char*	ldo_defbinddn;	/* bind dn */
-+
-+	/*
-+	 * Per connection tcp-keepalive settings (Linux only,
-+	 * ignored where unsupported)
-+	 */
-+	ber_int_t ldo_keepalive_idle;
-+	ber_int_t ldo_keepalive_probes;
-+	ber_int_t ldo_keepalive_interval;
-+
-+	int		ldo_refhoplimit;	/* limit on referral nesting */
-+
-+	/* LDAPv3 server and client controls */
-+	LDAPControl	**ldo_sctrls;
-+	LDAPControl **ldo_cctrls;
-+
-+	/* LDAP rebind callback function */
-+	LDAP_REBIND_PROC *ldo_rebind_proc;
-+	void *ldo_rebind_params;
-+	LDAP_NEXTREF_PROC *ldo_nextref_proc;
-+	void *ldo_nextref_params;
-+	LDAP_URLLIST_PROC *ldo_urllist_proc;
-+	void *ldo_urllist_params;
-+
-+	/* LDAP connection callback stack */
-+	ldaplist *ldo_conn_cbs;
-+
-+	LDAP_BOOLEANS ldo_booleans;	/* boolean options */
-+
-+#define LDAP_LDO_NULLARG	,0,0,0,0 ,{0},{0} ,0,0,0,0, 0,0,0,0, 0,0, 0,0,0,0,0,0, 0, 0
- 
- #ifdef LDAP_CONNECTIONLESS
- #define	LDAP_IS_UDP(ld)		((ld)->ld_options.ldo_is_udp)
- 	void*			ldo_peer;	/* struct sockaddr* */
- 	char*			ldo_cldapdn;
- 	int			ldo_is_udp;
-+#define	LDAP_LDO_CONNECTIONLESS_NULLARG	,0,0,0
-+#else
-+#define	LDAP_LDO_CONNECTIONLESS_NULLARG
- #endif
- 
--	/* per API call timeout */
--	struct timeval		ldo_tm_api;
--	struct timeval		ldo_tm_net;
--
--	ber_int_t		ldo_version;
--	ber_int_t		ldo_deref;
--	ber_int_t		ldo_timelimit;
--	ber_int_t		ldo_sizelimit;
--
- #ifdef HAVE_TLS
-    	/* tls context */
-    	void		*ldo_tls_ctx;
-@@ -226,16 +256,12 @@ struct ldapoptions {
-    	int			ldo_tls_mode;
-    	int			ldo_tls_require_cert;
- 	int			ldo_tls_impl;
--#ifdef HAVE_OPENSSL_CRL
-    	int			ldo_tls_crlcheck;
--#endif
-+#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0
-+#else
-+#define LDAP_LDO_TLS_NULLARG
- #endif
- 
--	LDAPURLDesc *ldo_defludp;
--	int		ldo_defport;
--	char*	ldo_defbase;
--	char*	ldo_defbinddn;	/* bind dn */
--
- #ifdef HAVE_CYRUS_SASL
- 	char*	ldo_def_sasl_mech;		/* SASL Mechanism(s) */
- 	char*	ldo_def_sasl_realm;		/* SASL realm */
-@@ -244,6 +270,9 @@ struct ldapoptions {
- 
- 	/* SASL Security Properties */
- 	struct sasl_security_properties	ldo_sasl_secprops;
-+#define LDAP_LDO_SASL_NULLARG ,0,0,0,0,{0}
-+#else
-+#define LDAP_LDO_SASL_NULLARG
- #endif
- 
- #ifdef HAVE_GSSAPI
-@@ -253,34 +282,17 @@ struct ldapoptions {
- #define LDAP_GSSAPI_OPT_DO_NOT_FREE_GSS_CONTEXT	0x0001
- #define LDAP_GSSAPI_OPT_ALLOW_REMOTE_PRINCIPAL	0x0002
- 	unsigned ldo_gssapi_options;
-+#define LDAP_LDO_GSSAPI_NULLARG ,0,0
-+#else
-+#define LDAP_LDO_GSSAPI_NULLARG
- #endif
- 
--	/*
--	 * Per connection tcp-keepalive settings (Linux only,
--	 * ignored where unsupported)
--	 */
--	ber_int_t ldo_keepalive_idle;
--	ber_int_t ldo_keepalive_probes;
--	ber_int_t ldo_keepalive_interval;
--
--	int		ldo_refhoplimit;	/* limit on referral nesting */
--
--	/* LDAPv3 server and client controls */
--	LDAPControl	**ldo_sctrls;
--	LDAPControl **ldo_cctrls;
--
--	/* LDAP rebind callback function */
--	LDAP_REBIND_PROC *ldo_rebind_proc;
--	void *ldo_rebind_params;
--	LDAP_NEXTREF_PROC *ldo_nextref_proc;
--	void *ldo_nextref_params;
--	LDAP_URLLIST_PROC *ldo_urllist_proc;
--	void *ldo_urllist_params;
--
--	/* LDAP connection callback stack */
--	ldaplist *ldo_conn_cbs;
--
--	LDAP_BOOLEANS ldo_booleans;	/* boolean options */
-+#ifdef LDAP_R_COMPILE
-+	ldap_pvt_thread_mutex_t	ldo_mutex;
-+#define LDAP_LDO_MUTEX_NULLARG	, LDAP_PVT_MUTEX_NULL
-+#else
-+#define LDAP_LDO_MUTEX_NULLARG
-+#endif
- };
- 
- 
-@@ -375,6 +387,46 @@ struct ldap_common {
- 	Sockbuf		*ldc_sb;	/* socket descriptor & buffer */
- #define ld_sb			ldc->ldc_sb
- 
-+	unsigned short	ldc_lberoptions;
-+#define	ld_lberoptions		ldc->ldc_lberoptions
-+
-+	/* protected by msgid_mutex */
-+	ber_len_t		ldc_msgid;
-+#define	ld_msgid		ldc->ldc_msgid
-+
-+	/* do not mess with these */
-+	/* protected by req_mutex */
-+	LDAPRequest	*ldc_requests;	/* list of outstanding requests */
-+	/* protected by res_mutex */
-+	LDAPMessage	*ldc_responses;	/* list of outstanding responses */
-+#define	ld_requests		ldc->ldc_requests
-+#define	ld_responses		ldc->ldc_responses
-+
-+	/* protected by abandon_mutex */
-+	ber_len_t	ldc_nabandoned;
-+	ber_int_t	*ldc_abandoned;	/* array of abandoned requests */
-+#define	ld_nabandoned		ldc->ldc_nabandoned
-+#define	ld_abandoned		ldc->ldc_abandoned
-+
-+	/* unused by libldap */
-+	LDAPCache	*ldc_cache;	/* non-null if cache is initialized */
-+#define	ld_cache		ldc->ldc_cache
-+
-+	/* do not mess with the rest though */
-+
-+	/* protected by conn_mutex */
-+	LDAPConn	*ldc_defconn;	/* default connection */
-+#define	ld_defconn		ldc->ldc_defconn
-+	LDAPConn	*ldc_conns;	/* list of server connections */
-+#define	ld_conns		ldc->ldc_conns
-+	void		*ldc_selectinfo;/* platform specifics for select */
-+#define	ld_selectinfo		ldc->ldc_selectinfo
-+
-+	/* ldap_common refcnt - free only if 0 */
-+	/* protected by ldc_mutex */
-+	unsigned int		ldc_refcnt;
-+#define	ld_ldcrefcnt		ldc->ldc_refcnt
-+
- 	/* protected by ldo_mutex */
- 	struct ldapoptions ldc_options;
- #define ld_options		ldc->ldc_options
-@@ -403,66 +455,22 @@ struct ldap_common {
- #define ld_urllist_params	ld_options.ldo_urllist_params
- 
- #define ld_version		ld_options.ldo_version
--#ifdef LDAP_R_COMPILE
--#define	ld_ldopts_mutex		ld_options.ldo_mutex
--#endif
--
--	unsigned short	ldc_lberoptions;
--#define	ld_lberoptions		ldc->ldc_lberoptions
--
--	/* protected by msgid_mutex */
--	ber_len_t		ldc_msgid;
--#define	ld_msgid		ldc->ldc_msgid
--
--	/* do not mess with these */
--	/* protected by req_mutex */
--	LDAPRequest	*ldc_requests;	/* list of outstanding requests */
--	/* protected by res_mutex */
--	LDAPMessage	*ldc_responses;	/* list of outstanding responses */
--#define	ld_requests		ldc->ldc_requests
--#define	ld_responses		ldc->ldc_responses
- 
- #ifdef LDAP_R_COMPILE
-+	ldap_pvt_thread_mutex_t	ldc_mutex;
- 	ldap_pvt_thread_mutex_t	ldc_msgid_mutex;
- 	ldap_pvt_thread_mutex_t	ldc_conn_mutex;
- 	ldap_pvt_thread_mutex_t	ldc_req_mutex;
- 	ldap_pvt_thread_mutex_t	ldc_res_mutex;
- 	ldap_pvt_thread_mutex_t	ldc_abandon_mutex;
-+#define	ld_ldopts_mutex		ld_options.ldo_mutex
-+#define	ld_ldcmutex		ldc->ldc_mutex
- #define	ld_msgid_mutex		ldc->ldc_msgid_mutex
- #define	ld_conn_mutex		ldc->ldc_conn_mutex
- #define	ld_req_mutex		ldc->ldc_req_mutex
- #define	ld_res_mutex		ldc->ldc_res_mutex
- #define	ld_abandon_mutex	ldc->ldc_abandon_mutex
- #endif
--
--	/* protected by abandon_mutex */
--	ber_len_t	ldc_nabandoned;
--	ber_int_t	*ldc_abandoned;	/* array of abandoned requests */
--#define	ld_nabandoned		ldc->ldc_nabandoned
--#define	ld_abandoned		ldc->ldc_abandoned
--
--	/* unused by libldap */
--	LDAPCache	*ldc_cache;	/* non-null if cache is initialized */
--#define	ld_cache		ldc->ldc_cache
--
--	/* do not mess with the rest though */
--
--	/* protected by conn_mutex */
--	LDAPConn	*ldc_defconn;	/* default connection */
--#define	ld_defconn		ldc->ldc_defconn
--	LDAPConn	*ldc_conns;	/* list of server connections */
--#define	ld_conns		ldc->ldc_conns
--	void		*ldc_selectinfo;/* platform specifics for select */
--#define	ld_selectinfo		ldc->ldc_selectinfo
--
--	/* ldap_common refcnt - free only if 0 */
--#ifdef LDAP_R_COMPILE
--	ldap_pvt_thread_mutex_t	ldc_mutex;
--#define	ld_ldcmutex		ldc->ldc_mutex
--#endif
--	/* protected by ldc_mutex */
--	unsigned int		ldc_refcnt;
--#define	ld_ldcrefcnt		ldc->ldc_refcnt
- };
- 
- struct ldap {
diff --git a/abs/core/openldap/ntlm.patch b/abs/core/openldap/ntlm.patch
deleted file mode 100644
index 6804b61..0000000
--- a/abs/core/openldap/ntlm.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-Patch from evolution-exchange (2.10.3).  The ldap_ntlm_bind function is
-actually called by evolution-data-server, checked at version 1.12.2.
-Without this patch, the Exchange addressbook integration uses simple binds
-with cleartext passwords.
-
-Russ checked with openldap-software for upstream's opinion on this patch
-on 2007-12-21.  Upstream had never received it as a patch submission and
-given that it's apparently only for older Exchange servers that can't do
-SASL and DIGEST-MD5, it's not very appealing.
-
-Bug#457374 filed against evolution-data-server asking if this support is
-still required on 2007-12-21.
-
-Index: trunk/include/ldap.h
-===================================================================
---- trunk.orig/include/ldap.h
-+++ trunk/include/ldap.h
-@@ -2461,5 +2461,25 @@
- 	LDAPControl	**ctrls,
- 	LDAPDerefRes	**drp ));
- 
-+/*
-+ * hacks for NTLM
-+ */
-+#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
-+#define LDAP_AUTH_NTLM_RESPONSE  ((ber_tag_t) 0x8bU)
-+LDAP_F( int )
-+ldap_ntlm_bind LDAP_P((
-+      LDAP    *ld,
-+      LDAP_CONST char *dn,
-+      ber_tag_t tag,
-+      struct berval *cred,
-+      LDAPControl **sctrls,
-+      LDAPControl **cctrls,
-+      int   *msgidp ));
-+LDAP_F( int )
-+ldap_parse_ntlm_bind_result LDAP_P((
-+      LDAP    *ld,
-+      LDAPMessage *res,
-+      struct berval *challenge));
-+
- LDAP_END_DECL
- #endif /* _LDAP_H */
-Index: trunk/libraries/libldap/ntlm.c
-===================================================================
---- /dev/null
-+++ trunk/libraries/libldap/ntlm.c
-@@ -0,0 +1,138 @@
-+/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
-+/*
-+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
-+ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
-+ */
-+
-+/* Mostly copied from sasl.c */
-+
-+#include "portable.h"
-+
-+#include <stdlib.h>
-+#include <stdio.h>
-+
-+#include <ac/socket.h>
-+#include <ac/string.h>
-+#include <ac/time.h>
-+#include <ac/errno.h>
-+
-+#include "ldap-int.h"
-+
-+int
-+ldap_ntlm_bind(
-+ LDAP    *ld,
-+ LDAP_CONST char *dn,
-+ ber_tag_t tag,
-+ struct berval *cred,
-+ LDAPControl **sctrls,
-+ LDAPControl **cctrls,
-+ int   *msgidp )
-+{
-+ BerElement  *ber;
-+ int rc;
-+ ber_int_t id;
-+
-+ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
-+
-+ assert( ld != NULL );
-+ assert( LDAP_VALID( ld ) );
-+ assert( msgidp != NULL );
-+
-+ if( msgidp == NULL ) {
-+   ld->ld_errno = LDAP_PARAM_ERROR;
-+   return ld->ld_errno;
-+ }
-+
-+ /* create a message to send */
-+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
-+   ld->ld_errno = LDAP_NO_MEMORY;
-+   return ld->ld_errno;
-+ }
-+
-+ assert( LBER_VALID( ber ) );
-+
-+ LDAP_NEXT_MSGID( ld, id );
-+ rc = ber_printf( ber, "{it{istON}" /*}*/,
-+      id, LDAP_REQ_BIND,
-+      ld->ld_version, dn, tag,
-+      cred );
-+
-+ /* Put Server Controls */
-+ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
-+   ber_free( ber, 1 );
-+   return ld->ld_errno;
-+ }
-+
-+ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
-+   ld->ld_errno = LDAP_ENCODING_ERROR;
-+   ber_free( ber, 1 );
-+   return ld->ld_errno;
-+ }
-+
-+ /* send the message */
-+ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
-+
-+ if(*msgidp < 0)
-+   return ld->ld_errno;
-+
-+ return LDAP_SUCCESS;
-+}
-+
-+int
-+ldap_parse_ntlm_bind_result(
-+ LDAP    *ld,
-+ LDAPMessage *res,
-+ struct berval *challenge)
-+{
-+ ber_int_t errcode;
-+ ber_tag_t tag;
-+ BerElement  *ber;
-+ ber_len_t len;
-+
-+ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
-+
-+ assert( ld != NULL );
-+ assert( LDAP_VALID( ld ) );
-+ assert( res != NULL );
-+
-+ if ( ld == NULL || res == NULL ) {
-+   return LDAP_PARAM_ERROR;
-+ }
-+
-+ if( res->lm_msgtype != LDAP_RES_BIND ) {
-+   ld->ld_errno = LDAP_PARAM_ERROR;
-+   return ld->ld_errno;
-+ }
-+
-+ if ( ld->ld_error ) {
-+   LDAP_FREE( ld->ld_error );
-+   ld->ld_error = NULL;
-+ }
-+ if ( ld->ld_matched ) {
-+   LDAP_FREE( ld->ld_matched );
-+   ld->ld_matched = NULL;
-+ }
-+
-+ /* parse results */
-+
-+ ber = ber_dup( res->lm_ber );
-+
-+ if( ber == NULL ) {
-+   ld->ld_errno = LDAP_NO_MEMORY;
-+   return ld->ld_errno;
-+ }
-+
-+ tag = ber_scanf( ber, "{ioa" /*}*/,
-+      &errcode, challenge, &ld->ld_error );
-+ ber_free( ber, 0 );
-+
-+ if( tag == LBER_ERROR ) {
-+   ld->ld_errno = LDAP_DECODING_ERROR;
-+   return ld->ld_errno;
-+ }
-+
-+ ld->ld_errno = errcode;
-+
-+ return( ld->ld_errno );
-+}
-+
-Index: trunk/libraries/libldap/Makefile.in
-===================================================================
---- trunk.orig/libraries/libldap/Makefile.in
-+++ trunk/libraries/libldap/Makefile.in
-@@ -27,7 +27,7 @@
- 	init.c options.c print.c string.c util-int.c schema.c \
- 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
- 	tls2.c tls_o.c tls_g.c tls_m.c \
--	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
-+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
- 	assertion.c deref.c ldif.c fetch.c
- 
- OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
-@@ -40,7 +40,7 @@
- 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
- 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
- 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
--	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
-+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
- 	assertion.lo deref.lo ldif.lo fetch.lo
- 
- LDAP_INCDIR= ../../include       
-Index: trunk/libraries/libldap_r/Makefile.in
-===================================================================
---- trunk.orig/libraries/libldap_r/Makefile.in
-+++ trunk/libraries/libldap_r/Makefile.in
-@@ -29,7 +29,7 @@
- 	init.c options.c print.c string.c util-int.c schema.c \
- 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
- 	tls2.c tls_o.c tls_g.c tls_m.c \
--	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
-+	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
- 	assertion.c deref.c ldif.c fetch.c
- SRCS	= threads.c rdwr.c rmutex.c tpool.c rq.c \
- 	thr_posix.c thr_cthreads.c thr_thr.c thr_lwp.c thr_nt.c \
-@@ -47,7 +47,7 @@
- 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
- 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
- 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
--	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
-+	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
- 	assertion.lo deref.lo ldif.lo fetch.lo
- 
- LDAP_INCDIR= ../../include       
diff --git a/abs/core/openldap/openldap-ntlm.patch b/abs/core/openldap/openldap-ntlm.patch
new file mode 100644
index 0000000..6804b61
--- /dev/null
+++ b/abs/core/openldap/openldap-ntlm.patch
@@ -0,0 +1,230 @@
+Patch from evolution-exchange (2.10.3).  The ldap_ntlm_bind function is
+actually called by evolution-data-server, checked at version 1.12.2.
+Without this patch, the Exchange addressbook integration uses simple binds
+with cleartext passwords.
+
+Russ checked with openldap-software for upstream's opinion on this patch
+on 2007-12-21.  Upstream had never received it as a patch submission and
+given that it's apparently only for older Exchange servers that can't do
+SASL and DIGEST-MD5, it's not very appealing.
+
+Bug#457374 filed against evolution-data-server asking if this support is
+still required on 2007-12-21.
+
+Index: trunk/include/ldap.h
+===================================================================
+--- trunk.orig/include/ldap.h
++++ trunk/include/ldap.h
+@@ -2461,5 +2461,25 @@
+ 	LDAPControl	**ctrls,
+ 	LDAPDerefRes	**drp ));
+ 
++/*
++ * hacks for NTLM
++ */
++#define LDAP_AUTH_NTLM_REQUEST ((ber_tag_t) 0x8aU)
++#define LDAP_AUTH_NTLM_RESPONSE  ((ber_tag_t) 0x8bU)
++LDAP_F( int )
++ldap_ntlm_bind LDAP_P((
++      LDAP    *ld,
++      LDAP_CONST char *dn,
++      ber_tag_t tag,
++      struct berval *cred,
++      LDAPControl **sctrls,
++      LDAPControl **cctrls,
++      int   *msgidp ));
++LDAP_F( int )
++ldap_parse_ntlm_bind_result LDAP_P((
++      LDAP    *ld,
++      LDAPMessage *res,
++      struct berval *challenge));
++
+ LDAP_END_DECL
+ #endif /* _LDAP_H */
+Index: trunk/libraries/libldap/ntlm.c
+===================================================================
+--- /dev/null
++++ trunk/libraries/libldap/ntlm.c
+@@ -0,0 +1,138 @@
++/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
++/*
++ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
++ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
++ */
++
++/* Mostly copied from sasl.c */
++
++#include "portable.h"
++
++#include <stdlib.h>
++#include <stdio.h>
++
++#include <ac/socket.h>
++#include <ac/string.h>
++#include <ac/time.h>
++#include <ac/errno.h>
++
++#include "ldap-int.h"
++
++int
++ldap_ntlm_bind(
++ LDAP    *ld,
++ LDAP_CONST char *dn,
++ ber_tag_t tag,
++ struct berval *cred,
++ LDAPControl **sctrls,
++ LDAPControl **cctrls,
++ int   *msgidp )
++{
++ BerElement  *ber;
++ int rc;
++ ber_int_t id;
++
++ Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
++
++ assert( ld != NULL );
++ assert( LDAP_VALID( ld ) );
++ assert( msgidp != NULL );
++
++ if( msgidp == NULL ) {
++   ld->ld_errno = LDAP_PARAM_ERROR;
++   return ld->ld_errno;
++ }
++
++ /* create a message to send */
++ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
++   ld->ld_errno = LDAP_NO_MEMORY;
++   return ld->ld_errno;
++ }
++
++ assert( LBER_VALID( ber ) );
++
++ LDAP_NEXT_MSGID( ld, id );
++ rc = ber_printf( ber, "{it{istON}" /*}*/,
++      id, LDAP_REQ_BIND,
++      ld->ld_version, dn, tag,
++      cred );
++
++ /* Put Server Controls */
++ if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
++   ber_free( ber, 1 );
++   return ld->ld_errno;
++ }
++
++ if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
++   ld->ld_errno = LDAP_ENCODING_ERROR;
++   ber_free( ber, 1 );
++   return ld->ld_errno;
++ }
++
++ /* send the message */
++ *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
++
++ if(*msgidp < 0)
++   return ld->ld_errno;
++
++ return LDAP_SUCCESS;
++}
++
++int
++ldap_parse_ntlm_bind_result(
++ LDAP    *ld,
++ LDAPMessage *res,
++ struct berval *challenge)
++{
++ ber_int_t errcode;
++ ber_tag_t tag;
++ BerElement  *ber;
++ ber_len_t len;
++
++ Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
++
++ assert( ld != NULL );
++ assert( LDAP_VALID( ld ) );
++ assert( res != NULL );
++
++ if ( ld == NULL || res == NULL ) {
++   return LDAP_PARAM_ERROR;
++ }
++
++ if( res->lm_msgtype != LDAP_RES_BIND ) {
++   ld->ld_errno = LDAP_PARAM_ERROR;
++   return ld->ld_errno;
++ }
++
++ if ( ld->ld_error ) {
++   LDAP_FREE( ld->ld_error );
++   ld->ld_error = NULL;
++ }
++ if ( ld->ld_matched ) {
++   LDAP_FREE( ld->ld_matched );
++   ld->ld_matched = NULL;
++ }
++
++ /* parse results */
++
++ ber = ber_dup( res->lm_ber );
++
++ if( ber == NULL ) {
++   ld->ld_errno = LDAP_NO_MEMORY;
++   return ld->ld_errno;
++ }
++
++ tag = ber_scanf( ber, "{ioa" /*}*/,
++      &errcode, challenge, &ld->ld_error );
++ ber_free( ber, 0 );
++
++ if( tag == LBER_ERROR ) {
++   ld->ld_errno = LDAP_DECODING_ERROR;
++   return ld->ld_errno;
++ }
++
++ ld->ld_errno = errcode;
++
++ return( ld->ld_errno );
++}
++
+Index: trunk/libraries/libldap/Makefile.in
+===================================================================
+--- trunk.orig/libraries/libldap/Makefile.in
++++ trunk/libraries/libldap/Makefile.in
+@@ -27,7 +27,7 @@
+ 	init.c options.c print.c string.c util-int.c schema.c \
+ 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
+ 	tls2.c tls_o.c tls_g.c tls_m.c \
+-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
++	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
+ 	assertion.c deref.c ldif.c fetch.c
+ 
+ OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
+@@ -40,7 +40,7 @@
+ 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
+ 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
+ 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
+-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
++	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
+ 	assertion.lo deref.lo ldif.lo fetch.lo
+ 
+ LDAP_INCDIR= ../../include       
+Index: trunk/libraries/libldap_r/Makefile.in
+===================================================================
+--- trunk.orig/libraries/libldap_r/Makefile.in
++++ trunk/libraries/libldap_r/Makefile.in
+@@ -29,7 +29,7 @@
+ 	init.c options.c print.c string.c util-int.c schema.c \
+ 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \
+ 	tls2.c tls_o.c tls_g.c tls_m.c \
+-	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \
++	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c ntlm.c \
+ 	assertion.c deref.c ldif.c fetch.c
+ SRCS	= threads.c rdwr.c rmutex.c tpool.c rq.c \
+ 	thr_posix.c thr_cthreads.c thr_thr.c thr_lwp.c thr_nt.c \
+@@ -47,7 +47,7 @@
+ 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \
+ 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \
+ 	tls2.lo tls_o.lo tls_g.lo tls_m.lo \
+-	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \
++	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo ntlm.lo \
+ 	assertion.lo deref.lo ldif.lo fetch.lo
+ 
+ LDAP_INCDIR= ../../include       
diff --git a/abs/core/openldap/openldap.install b/abs/core/openldap/openldap.install
index cf3cb9f..a34ca1a 100644
--- a/abs/core/openldap/openldap.install
+++ b/abs/core/openldap/openldap.install
@@ -1,4 +1,5 @@
 post_install(){
+  systemd-tmpfiles --create slapd.conf
   groupadd -g 439 ldap &>/dev/null
   useradd -u 439 -g ldap -d /var/lib/openldap -s /bin/false ldap &>/dev/null
   chown -R ldap:ldap var/lib/openldap &>/dev/null
diff --git a/abs/core/openldap/slapd b/abs/core/openldap/slapd
deleted file mode 100755
index 4f212da..0000000
--- a/abs/core/openldap/slapd
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/bin/bash
-
-. /etc/rc.conf
-. /etc/rc.d/functions
-
-[ -f "/etc/conf.d/slapd" ] && . /etc/conf.d/slapd
-
-PID=`pidof -o %PPID /usr/sbin/slapd`
-case "$1" in
-  start)
-    stat_busy "Starting OpenLDAP"
-    [ ! -d /run/openldap ] && install -d -m755 -o ldap -g ldap /run/openldap
-    if [ -z "$PID" ]; then
-      if [ -z "$SLAPD_SERVICES" ]; then
-        /usr/sbin/slapd -u ldap -g ldap $SLAPD_OPTIONS
-      else
-        /usr/sbin/slapd -u ldap -g ldap -h "$SLAPD_SERVICES" $SLAPD_OPTIONS
-      fi
-      if [ $? -gt 0 ]; then
-        stat_fail
-      else
-        stat_done
-      fi
-      add_daemon slapd
-    else
-      stat_fail
-    fi
-    ;;
-  stop)
-    stat_busy "Stopping OpenLDAP"
-    [ ! -z "$PID" ] && kill $PID &> /dev/null
-    if [ $? -gt 0 ]; then
-      stat_fail
-    else
-      rm -f /run/openldap/slapd.pid
-      rm -f /run/openldap/slapd.args
-      rm_daemon slapd
-      stat_done
-    fi
-    ;;
-  restart)
-    $0 stop
-    sleep 3
-    $0 start
-    ;;
-  *)
-    echo "usage: $0 {start|stop|restart}"  
-esac
-exit 0
diff --git a/abs/core/openldap/slapd.default b/abs/core/openldap/slapd.default
deleted file mode 100644
index 72ae2a6..0000000
--- a/abs/core/openldap/slapd.default
+++ /dev/null
@@ -1,6 +0,0 @@
-# slapd normally serves ldap only on all TCP-ports 389. slapd can also
-# service requests on TCP-port 636 (ldaps) and requests via unix
-# sockets.
-# Example usage:
-#SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
-SLAPD_OPTIONS=""
diff --git a/abs/core/openldap/slapd.service b/abs/core/openldap/slapd.service
index d8baa57..a664fa3 100644
--- a/abs/core/openldap/slapd.service
+++ b/abs/core/openldap/slapd.service
@@ -3,7 +3,7 @@ Description=OpenLDAP server daemon
 
 [Service]
 Type=forking
-ExecStart=/usr/sbin/slapd
+ExecStart=/usr/bin/slapd -u ldap -g ldap
 
 [Install]
 WantedBy=multi-user.target
diff --git a/abs/core/openldap/slapd.tmpfiles b/abs/core/openldap/slapd.tmpfiles
index 5f63bd6..b22c831 100644
--- a/abs/core/openldap/slapd.tmpfiles
+++ b/abs/core/openldap/slapd.tmpfiles
@@ -1 +1 @@
-D /run/openldap 0750 ldap ldap -
+D /run/openldap 0755 ldap ldap -
-- 
cgit v0.12

