sm-commit AT lists.ibiblio.org
Subject: Source Mage code commit list
List archive
[SM-Commit] GIT changes to master grimoire by Vlad Glagolev (8f263101003fb52446deb59c47bce498bb86107d)
- From: Vlad Glagolev <scm AT sourcemage.org>
- To: sm-commit AT lists.ibiblio.org
- Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (8f263101003fb52446deb59c47bce498bb86107d)
- Date: Tue, 31 Jul 2012 06:42:25 -0500
GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:
ftp/proftpd/BUILD | 38 ++---
ftp/proftpd/CONFIGURE | 158 +++++++++++++++++++-----
ftp/proftpd/DEPENDS | 112 ++++++++++++++---
ftp/proftpd/DETAILS | 1
ftp/proftpd/HISTORY | 10 +
ftp/proftpd/PRE_BUILD | 6
ftp/proftpd/ldap-cert.patch | 286
++++++++++++++++++++++++++++++++++++++++++++
7 files changed, 547 insertions(+), 64 deletions(-)
New commits:
commit 8f263101003fb52446deb59c47bce498bb86107d
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
proftpd: refreshed the spell
diff --git a/ftp/proftpd/BUILD b/ftp/proftpd/BUILD
index 7e44a7f..652c27e 100755
--- a/ftp/proftpd/BUILD
+++ b/ftp/proftpd/BUILD
@@ -1,26 +1,26 @@
-#if [[ $PROFTPD_DEVEL == "n" ]]; then
-if [[ -z $PROFTPD_CAPS ]]; then
- CFLAGS=${CFLAGS/-fPIC} &&
- CFLAGS=${CFLAGS/-DPIC} &&
- CXXFLAGS=${CXXFLAGS/-fPIC} &&
- CXXFLAGS=${CXXFLAGS/-DPIC}
-fi
-#fi &&
+if list_find "$PROFTPD_OPTS" "--disable-cap"; then
+ disable_pic
+fi &&
-sedit "s/ standalone/ inetd/" sample-configurations/basic.conf
&&
+if [[ $XINETD_INSTALLED ]]; then
+ sedit "s/ standalone/ inetd/" sample-configurations/basic.conf
+fi &&
-OPTS="${PROFTPD_CAPS} ${PROFTPD_MODS} ${OPTS}" &&
+local SQL_INC="." &&
-./configure --prefix=${INSTALL_ROOT}/usr \
- --sysconfdir=${INSTALL_ROOT}/etc \
- --localstatedir=${INSTALL_ROOT}/var/run \
- --mandir=$INSTALL_ROOT/usr/share/man \
- --enable-shadow \
- ${OPTS} &&
+if list_find "$PROFTPD_MODS" "mod_sql_mysql"; then
+ SQL_INC="$SQL_INC:$INSTALL_ROOT/usr/include/mysql"
+fi &&
-sedit 's:RUN_DIR.*"/var/run/proftpd":RUN_DIR "/var/run":' config.h &&
-sedit 's:rundir=/var/run/proftpd:rundir=/var/run:' Make.rules &&
+if list_find "$PROFTPD_MODS" "mod_sql_postgres"; then
+ SQL_INC="$SQL_INC:$INSTALL_ROOT/usr/include/postgresql"
+fi &&
+
+OPTS="${PROFTPD_OPTS} \
+ ${OPTS} \
+ --with-modules=${PROFTPD_MODS// /:} \
+ --with-includes=${SQL_INC}" &&
make_single &&
-make &&
+default_build &&
make_normal
diff --git a/ftp/proftpd/CONFIGURE b/ftp/proftpd/CONFIGURE
index 67b6db6..ac57f9c 100755
--- a/ftp/proftpd/CONFIGURE
+++ b/ftp/proftpd/CONFIGURE
@@ -1,40 +1,138 @@
-. $GRIMOIRE/FUNCTIONS &&
-#if [[ $PROFTPD_DEVEL == "n" ]]; then
+. $GRIMOIRE/FUNCTIONS &&
+
if [[ $(get_sorcery_kernel_config CONFIG_SECURITY) != y ]]; then
- config_query_option PROFTPD_CAPS \
- "You don't have capabilities enabled in your kernel, do you still \
- want to build them?" n "" "--disable-cap"
-fi
-#fi &&
+ config_query_option PROFTPD_OPTS "You don't have capabilities enabled in
your kernel, do you still want to build them?" n \
+ "--enable-cap" \
+ "--disable-cap"
+fi &&
+
+config_query_option PROFTPD_OPTS "Enable IPv6 support?" y \
+ "--enable-ipv6" \
+ "--disable-ipv6" &&
+
+config_query_option PROFTPD_OPTS "Enable use of ident (RFC1413) lookups?" y \
+ "--enable-ident" \
+ "--disable-ident" &&
-config_query_option PROFTPD_IP6 "enable IPv6 support?" \
-y "--enable-ipv6" "" &&
+config_query_option PROFTPD_OPTS "Enable sendfile support?" y \
+ "--enable-sendfile" \
+ "--disable-sendfile" &&
-config_query PROFTPD_MOD \
-"Choose optional user contributed modules to install?" n &&
+config_query_option PROFTPD_OPTS "Enable proftpd controls via ftpdctl?" n \
+ "--enable-ctrls" \
+ "--disable-ctrls" &&
+
+config_query PROFTPD_MOD "Choose optional user contributed modules to
install?" n &&
-#radius module failed (probably missing dep), all the others not in
-#the query are yet to be tried.
if [[ $PROFTPD_MOD == "y" ]]; then
- config_query_multi PROFTPD_MODS "Choose among this list:" \
- mod_ratio mod_readme mod_rewrite mod_tls mod_wrap \
- mod_sql mod_ldap &&
+ local MODULES="mod_copy \
+ mod_deflate \
+ mod_dynmasq \
+ mod_exec \
+ mod_ifsession \
+ mod_ifversion \
+ mod_load \
+ mod_qos \
+ mod_quotatab \
+ mod_ratio \
+ mod_readme \
+ mod_rewrite \
+ mod_sftp \
+ mod_site_misc \
+ mod_sql \
+ mod_tls \
+ mod_unique_id \
+ mod_wrap \
+ mod_wrap2" &&
+
+ if list_find "$PROFTPD_OPTS" "--enable-ctrls"; then
+ MODULES="mod_ban \
+ mod_ctrls_admin \
+ mod_shaper \
+ ${MODULES}"
+ fi &&
+
+ config_query_multi PROFTPD_MODS "Choose among this list:" ${MODULES} &&
+
+ if list_find "$PROFTPD_MODS" "mod_quotatab"; then
+ config_query PROFTPD_MOD_QUOTATAB_LDAP "Include LDAP support in
mod_quotatab?" n &&
- PROFTPD_MODS="--with-modules=`echo $PROFTPD_MODS | sed 's/\ /:/g'`" &&
+ if [[ $PROFTPD_MOD_QUOTATAB_LDAP == y ]]; then
+ list_add "PROFTPD_MODS" "mod_quotatab_ldap"
+ fi &&
- if [[ "x`echo $PROFTPD_MODS | grep sql`" != "x" ]]; then
- config_query_list PROFTPD_SQL \
- "You chose mod_sql, now which DBMS do you want:" mod_sql_mysql \
- mod_sql_postgres &&
+ config_query PROFTPD_MOD_QUOTATAB_RADIUS "Include RADIUS support in
mod_quotatab?" n &&
- if [[ "x${PROFTPD_SQL}" == "xmod_sql_mysql" ]]; then
- SQL_INC="/usr/include/mysql"
- else
- SQL_INC="/usr/include/postgresql"
+ if [[ $PROFTPD_MOD_QUOTATAB_RADIUS == y ]]; then
+ list_add "PROFTPD_MODS" "mod_quotatab_radius"
+ fi &&
+
+ config_query PROFTPD_MOD_QUOTATAB_SQL "Include SQL support in
mod_quotatab?" n &&
+
+ if ! list_find "$PROFTPD_MODS" "mod_sql"; then
+ list_add "PROFTPD_MODS" "mod_sql"
+ fi &&
+
+ if [[ $PROFTPD_MOD_QUOTATAB_SQL == y ]]; then
+ list_add "PROFTPD_MODS" "mod_quotatab_sql"
fi
-
- PROFTPD_MODS="${PROFTPD_MODS}:${PROFTPD_SQL} \
- --with-includes=${SQL_INC}"
- fi
-fi
+ fi &&
+
+ if list_find "$PROFTPD_MODS" "mod_sftp"; then
+ config_query PROFTPD_MOD_SFTP_SQL "Include SQL support in mod_sftp?" n &&
+
+ if ! list_find "$PROFTPD_MODS" "mod_sql"; then
+ list_add "PROFTPD_MODS" "mod_sql"
+ fi &&
+
+ if [[ $PROFTPD_MOD_SFTP_SQL == y ]]; then
+ list_add "PROFTPD_MODS" "mod_sftp_sql"
+ fi &&
+
+ config_query PROFTPD_MOD_SFTP_PAM "Include PAM support in mod_sftp?" n &&
+ if [[ $PROFTPD_MOD_SFTP_PAM == y ]]; then
+ list_add "PROFTPD_MODS" "mod_sftp_pam"
+ fi
+ fi &&
+
+ if list_find "$PROFTPD_MODS" "mod_wrap2"; then
+ config_query PROFTPD_MOD_WRAP2_FILE "Include file support in mod_wrap2?"
n &&
+
+ if [[ $PROFTPD_MOD_WRAP2_FILE == y ]]; then
+ list_add "PROFTPD_MODS" "mod_wrap2_file"
+ fi &&
+
+ config_query PROFTPD_MOD_WRAP2_SQL "Include SQL support in mod_wrap2?" n
&&
+
+ if ! list_find "$PROFTPD_MODS" "mod_sql"; then
+ list_add "PROFTPD_MODS" "mod_sql"
+ fi &&
+
+ if [[ $PROFTPD_MOD_WRAP2_SQL == y ]]; then
+ list_add "PROFTPD_MODS" "mod_wrap2_sql"
+ fi
+ fi &&
+
+ if list_find "$PROFTPD_MODS" "mod_sql"; then
+ config_query PROFTPD_MOD_SQL_PASSWD "Include passwd support in mod_sql?"
n &&
+
+ if [[ $PROFTPD_MOD_SQL_PASSWD == y ]]; then
+ list_add "PROFTPD_MODS" "mod_sql_passwd"
+ fi
+ fi &&
+
+ if list_find "$PROFTPD_MODS" "mod_tls"; then
+ config_query PROFTPD_MOD_TLS_MEMCACHE "Include memcache support in
mod_tls?" n &&
+
+ if [[ $PROFTPD_MOD_TLS_MEMCACHE == y ]]; then
+ list_add "PROFTPD_MODS" "mod_tls_memcache"
+ fi &&
+
+ config_query PROFTPD_MOD_TLS_SHMCACHE "Include SysV shared memory cache
support in mod_tls?" n &&
+
+ if [[ $PROFTPD_MOD_TLS_SHMCACHE == y ]]; then
+ list_add "PROFTPD_MODS" "mod_tls_shmcache"
+ fi
+ fi
+fi
diff --git a/ftp/proftpd/DEPENDS b/ftp/proftpd/DEPENDS
index f4c0dd2..a45290b 100755
--- a/ftp/proftpd/DEPENDS
+++ b/ftp/proftpd/DEPENDS
@@ -1,29 +1,111 @@
-if [[ "x`echo $PROFTPD_MODS | grep tls`" != "x" ]]; then
- depends openssl
+if list_find "$PROFTPD_MODS" "mod_deflate"; then
+ depends zlib
fi &&
-if [[ "x`echo $PROFTPD_MODS | grep wrap`" != "x" ]]; then
- depends tcp_wrappers
+if list_find "$PROFTPD_MODS" "mod_sql"; then
+ optional_depends MYSQL "" "" "for MySQL support in mod_sql" &&
+
+ if is_depends_enabled $SPELL $(get_spell_provider $SPELL MYSQL); then
+ list_add "PROFTPD_MODS" "mod_sql_mysql"
+ fi &&
+
+ optional_depends postgresql "" "" "for PostgreSQL support in mod_sql" &&
+
+ if is_depends_enabled $SPELL postgresql; then
+ list_add "PROFTPD_MODS" "mod_sql_postgres"
+ fi &&
+
+ optional_depends sqlite "" "" "for SQLite support in mod_sql" &&
+
+ if is_depends_enabled $SPELL sqlite; then
+ list_add "PROFTPD_MODS" "mod_sql_sqlite"
+ fi &&
+
+ optional_depends ODBC-MGR "" "" "for ODBC support in mod_sql" &&
+
+ if is_depends_enabled $SPELL $(get_spell_provider $SPELL ODBC-MGR); then
+ list_add "PROFTPD_MODS" "mod_sql_odbc"
+ fi
+fi &&
+
+if list_find "$PROFTPD_MODS" "mod_wrap" || list_find "$PROFTPD_MODS"
"mod_wrap2"; then
+ depends tcp_wrappers
+fi &&
+
+if list_find "$PROFTPD_MODS" "mod_tls" || list_find "$PROFTPD_MODS"
"mod_sftp" || list_find "$PROFTPD_MODS" "mod_sql_passwd"; then
+ depends openssl '--enable-openssl'
+else
+ optional_depends openssl \
+ "--enable-openssl" \
+ "--disable-openssl" \
+ "for OpenSSL support"
+fi &&
+
+if list_find "$PROFTPD_OPTS" "mod_sftp_pam"; then
+ depends linux-pam
+fi &&
+
+if list_find "$PROFTPD_OPTS" "mod_tls_memcache"; then
+ depends libmemcached
fi &&
-if [[ "x`echo $PROFTPD_MODS | grep mysql`" != "x" ]]; then
- depends MYSQL
+optional_depends openldap "" "" "to build mod_ldap module" &&
+
+if is_depends_enabled $SPELL openldap; then
+ list_add "PROFTPD_MODS" "mod_ldap"
+elif list_find "$PROFTPD_MODS" "mod_quotatab_ldap"; then
+ depends openldap
fi &&
-if [[ "x`echo $PROFTPD_MODS | grep postgresql`" != "x" ]]; then
- depends postgresql
+optional_depends freeradius "" "" "to build mod_radius module" &&
+
+if is_depends_enabled $SPELL freeradius; then
+ list_add "PROFTPD_MODS" "mod_radius"
+elif list_find "$PROFTPD_MODS" "mod_quotatab_radius"; then
+ depends freeradius
fi &&
-if [[ "x`echo $PROFTPD_MODS | grep ldap`" != "x" ]]; then
- depends openldap
+optional_depends ncurses \
+ "--enable-curses" \
+ "--disable-curses" \
+ "for use of curses" &&
+
+optional_depends shadow \
+ "--enable-shadow" \
+ "--disable-shadow" \
+ "for shadowed password support" &&
+
+if is_depends_enabled $SPELL shadow; then
+ config_query_option PROFTPD_OPTS "Enable run-time auto-detection of
shadowed passwords?" n \
+ "--enable-autoshadow" \
+ "--disable-autoshadow"
fi &&
-optional_depends libcap \
- "--enable-cap" \
- "--disable-cap" \
- "for POSIX.1e capabilities" &&
+if list_find "$PROFTPD_OPTS" "--enable-cap"; then
+ optional_depends libcap "" "" "to use system libcap library for POSIX.1e
capabilities"
+fi &&
optional_depends linux-pam \
"--enable-auth-pam" \
"--disable-auth-pam" \
- "for Linux-PAM support"
+ "for Linux-PAM support" &&
+
+optional_depends libmemcached \
+ "--enable-memcache" \
+ "--disable-memcache" \
+ "for memcache support" &&
+
+optional_depends gettext \
+ "--enable-nls" \
+ "--disable-nls" \
+ "for Native Language Support" &&
+
+optional_depends pcre \
+ "--enable-pcre" \
+ "--disable-pcre" \
+ "for use of PCRE for POSIX regular expressions rather than
the system library" &&
+
+optional_depends acl \
+ "--enable-facl" \
+ "--disable-facl" \
+ "for POSIX ACLs support"
diff --git a/ftp/proftpd/DETAILS b/ftp/proftpd/DETAILS
index 03ee949..43dcc2b 100755
--- a/ftp/proftpd/DETAILS
+++ b/ftp/proftpd/DETAILS
@@ -1,6 +1,7 @@
SPELL=proftpd
VERSION=1.3.4a
SECURITY_PATCH=2
+ PATCHLEVEL=1
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE2=$SOURCE.asc
SOURCE2_IGNORE=signature
diff --git a/ftp/proftpd/HISTORY b/ftp/proftpd/HISTORY
index 99ac8f3..e905d48 100644
--- a/ftp/proftpd/HISTORY
+++ b/ftp/proftpd/HISTORY
@@ -1,3 +1,13 @@
+2012-07-31 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: PATCHLEVEL=1
+ * BUILD: remove pic flags wisely; fix basic config file only when
xinetd
+ script had been installed; use default_build; dropped deprecated
seds;
+ use PROFTPD_OPTS and PROFTPD_MODS; moved sql include paths here
+ * CONFIGURE, DEPENDS: use new modules framework; added missing options
+ and dependencies; switched to PROFTPD_OPTS
+ * PRE_BUILD: added, to optionally apply the patch
+ * ldap-cert.patch: added, for certificates selection support in
mod_ldap
+
2012-01-09 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++ (CVE-2011-4130)
diff --git a/ftp/proftpd/PRE_BUILD b/ftp/proftpd/PRE_BUILD
new file mode 100755
index 0000000..e4c1378
--- /dev/null
+++ b/ftp/proftpd/PRE_BUILD
@@ -0,0 +1,6 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+if is_depends_enabled $SPELL openldap; then
+ patch -p0 < "$SPELL_DIRECTORY/ldap-cert.patch"
+fi
diff --git a/ftp/proftpd/ldap-cert.patch b/ftp/proftpd/ldap-cert.patch
new file mode 100644
index 0000000..f4fee22
--- /dev/null
+++ b/ftp/proftpd/ldap-cert.patch
@@ -0,0 +1,286 @@
+--- contrib/mod_ldap.c.orig 2011-05-24 00:56:40.000000000 +0400
++++ contrib/mod_ldap.c 2012-07-31 15:14:59.181954021 +0400
+@@ -161,7 +161,14 @@
+ *ldap_attr_memberuid = "memberUid",
+ *ldap_attr_ftpquota = "ftpQuota",
+ *ldap_attr_ftpquota_profiledn = "ftpQuotaProfileDN",
+- *ldap_attr_ssh_pubkey = "sshPublicKey";
++ *ldap_attr_ssh_pubkey = "sshPublicKey",
++ *ldap_tls_ca_cert_dir,
++ *ldap_tls_ca_cert_file,
++ *ldap_tls_cert_file,
++ *ldap_tls_cipher_suite,
++ *ldap_tls_crl_file,
++ *ldap_tls_dh_file,
++ *ldap_tls_key_file;
+ #ifdef HAS_LDAP_INITIALIZE
+ static char *ldap_server_url;
+ #endif /* HAS_LDAP_INITIALIZE */
+@@ -171,7 +178,9 @@
+ ldap_forcedefaultuid = 0, ldap_forcedefaultgid = 0,
+ ldap_forcegenhdir = 0, ldap_protocol_version = 3,
+ ldap_dereference = LDAP_DEREF_NEVER,
+- ldap_search_scope = LDAP_SCOPE_SUBTREE;
++ ldap_search_scope = LDAP_SCOPE_SUBTREE,
++ ldap_tls_crl_check = -1,
++ ldap_tls_require_cert = -1;
+ static struct timeval ldap_querytimeout_tp;
+
+ static uid_t ldap_defaultuid = -1;
+@@ -214,6 +223,86 @@
+ struct berval bindcred;
+ #endif
+
++ if (ldap_tls_ca_cert_dir) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR,
ldap_tls_ca_cert_dir);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_CACERTDIR option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set LDAP_OPT_X_TLS_CACERTDIR
to %s", ldap_tls_ca_cert_dir);
++ }
++
++ if (ldap_tls_ca_cert_file) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,
ldap_tls_ca_cert_file);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_CACERTFILE option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set LDAP_OPT_X_TLS_CACERTFILE
to %s", ldap_tls_ca_cert_file);
++ }
++
++ if (ldap_tls_cert_file) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CERTFILE,
ldap_tls_cert_file);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_CERTFILE option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set LDAP_OPT_X_TLS_CERTFILE to
%s", ldap_tls_cert_file);
++ }
++
++ if (ldap_tls_cipher_suite) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
ldap_tls_cipher_suite);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_CIPHER_SUITE option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set
LDAP_OPT_X_TLS_CIPHER_SUITE to %s", ldap_tls_cipher_suite);
++ }
++
++ if (ldap_tls_dh_file) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_DHFILE, ldap_tls_dh_file);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_DHFILE option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set LDAP_OPT_X_TLS_DHFILE
version to %s", ldap_tls_dh_file);
++ }
++
++ if (ldap_tls_key_file) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_KEYFILE, ldap_tls_key_file);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_KEYFILE option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": pr_ldap_connect(): set
LDAP_OPT_X_TLS_KEYFILE to %s", ldap_tls_key_file);
++ }
++
++ if (ldap_tls_crl_check != -1) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CRLCHECK, (void
*)&ldap_tls_crl_check);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_CRLCHECK option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set LDAP_OPT_X_TLS_CRLCHECK to
%d", ldap_tls_crl_check);
++ }
++
++ if (ldap_tls_require_cert != -1) {
++ ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, (void
*)&ldap_tls_require_cert);
++ if (ret != LDAP_OPT_SUCCESS) {
++ pr_log_pri(PR_LOG_ERR, MOD_LDAP_VERSION ": pr_ldap_connect(): Setting
LDAP_OPT_X_TLS_REQUIRE_CERT option failed: %s", ldap_err2string(ret));
++ pr_ldap_unbind();
++ return -1;
++ }
++ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": set
LDAP_OPT_X_TLS_REQUIRE_CERT to %d", ldap_tls_require_cert);
++ }
++
+ #ifdef HAS_LDAP_INITIALIZE
+ pr_log_debug(DEBUG3, MOD_LDAP_VERSION ": attempting connection to %s",
ldap_server_url ? ldap_server_url : "(null)");
+
+@@ -1876,6 +1965,130 @@
+ return PR_HANDLED(cmd);
+ }
+
++MODRET
++set_ldap_tls_ca_cert_dir(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_ca_cert_file(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_cert_file(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_cipher_suite(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_crl_check(cmd_rec *cmd)
++{
++ int value;
++ config_rec *c;
++
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ if (strcasecmp(cmd->argv[1], "none") == 0) {
++ value = LDAP_OPT_X_TLS_CRL_NONE;
++ } else if (strcasecmp(cmd->argv[1], "peer") == 0) {
++ value = LDAP_OPT_X_TLS_CRL_PEER;
++ } else if (strcasecmp(cmd->argv[1], "all") == 0) {
++ value = LDAP_OPT_X_TLS_CRL_ALL;
++ } else {
++ CONF_ERROR(cmd, "LDAPTLSCrlCheck: expected a valid
LDAP_OPT_X_TLS_CRLCHECK option (none, peer, all).");
++ }
++
++ c = add_config_param("LDAPTLSCrlCheck", 1, NULL);
++ c->argv[0] = pcalloc(c->pool, sizeof(int));
++ *((int *) c->argv[0]) = value;
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_dh_file(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_crl_file(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_key_file(cmd_rec *cmd)
++{
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ add_config_param_str(cmd->argv[0], 1, cmd->argv[1]);
++ return PR_HANDLED(cmd);
++}
++
++MODRET
++set_ldap_tls_require_cert(cmd_rec *cmd)
++{
++ int value;
++ config_rec *c;
++
++ CHECK_ARGS(cmd, 1);
++ CHECK_CONF(cmd, CONF_ROOT | CONF_VIRTUAL | CONF_GLOBAL);
++
++ if (strcasecmp(cmd->argv[1], "never") == 0) {
++ value = LDAP_OPT_X_TLS_NEVER;
++ } else if (strcasecmp(cmd->argv[1], "hard") == 0) {
++ value = LDAP_OPT_X_TLS_HARD;
++ } else if (strcasecmp(cmd->argv[1], "demand") == 0) {
++ value = LDAP_OPT_X_TLS_DEMAND;
++ } else if (strcasecmp(cmd->argv[1], "allow") == 0) {
++ value = LDAP_OPT_X_TLS_ALLOW;
++ } else if (strcasecmp(cmd->argv[1], "try") == 0) {
++ value = LDAP_OPT_X_TLS_TRY;
++ } else {
++ CONF_ERROR(cmd, "LDAPTLSRequireCert: expected a valid
LDAP_OPT_X_TLS_REQUIRE_CERT option (never, hard, demand, allow, try).");
++ }
++
++ c = add_config_param("LDAPTLSRequireCert", 1, NULL);
++ c->argv[0] = pcalloc(c->pool, sizeof(int));
++ *((int *) c->argv[0]) = value;
++ return PR_HANDLED(cmd);
++}
++
+ static int
+ ldap_getconf(void)
+ {
+@@ -2060,6 +2273,22 @@
+ }
+ }
+
++ ldap_tls_ca_cert_dir = (char *)get_param_ptr(main_server->conf,
"LDAPTLSCACertDir", FALSE);
++ ldap_tls_ca_cert_file = (char *)get_param_ptr(main_server->conf,
"LDAPTLSCACertFile", FALSE);
++ ldap_tls_cert_file = (char *)get_param_ptr(main_server->conf,
"LDAPTLSCertFile", FALSE);
++ ldap_tls_cipher_suite = (char *)get_param_ptr(main_server->conf,
"LDAPTLSCipherSuite", FALSE);
++ ldap_tls_crl_file = (char *)get_param_ptr(main_server->conf,
"LDAPTLSCrlFile", FALSE);
++ ldap_tls_dh_file = (char *)get_param_ptr(main_server->conf,
"LDAPTLSDHFile", FALSE);
++ ldap_tls_key_file = (char *)get_param_ptr(main_server->conf,
"LDAPTLSKeyFile", FALSE);
++ ptr = get_param_ptr(main_server->conf, "LDAPTLSCrlCheck", FALSE);
++ if (ptr) {
++ ldap_tls_crl_check = *((int *) ptr);
++ }
++ ptr = get_param_ptr(main_server->conf, "LDAPTLSRequireCert", FALSE);
++ if (ptr) {
++ ldap_tls_require_cert = *((int *) ptr);
++ }
++
+ return 0;
+ }
+
+@@ -2093,6 +2322,15 @@
+ { "LDAPForceGeneratedHomedir", set_ldap_forcegenhdir, NULL },
+ { "LDAPDefaultQuota", set_ldap_defaultquota, NULL },
+ { "LDAPGroups", set_ldap_grouplookups, NULL },
++ { "LDAPTLSCACertDir", set_ldap_tls_ca_cert_dir, NULL },
++ { "LDAPTLSCACertFile", set_ldap_tls_ca_cert_file, NULL },
++ { "LDAPTLSCertFile", set_ldap_tls_cert_file, NULL },
++ { "LDAPTLSCipherSuite", set_ldap_tls_cipher_suite, NULL },
++ { "LDAPTLSCrlCheck", set_ldap_tls_crl_check, NULL },
++ { "LDAPTLSCrlFile", set_ldap_tls_crl_file, NULL },
++ { "LDAPTLSDHFile", set_ldap_tls_dh_file, NULL },
++ { "LDAPTLSKeyFile", set_ldap_tls_key_file, NULL },
++ { "LDAPTLSRequireCert", set_ldap_tls_require_cert, NULL },
+ { NULL, NULL, NULL },
+ };
+
- [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (8f263101003fb52446deb59c47bce498bb86107d), Vlad Glagolev, 07/31/2012
Archive powered by MHonArc 2.6.24.