Add net-nds/openldap-2.4.38-r2, update README.md

19 files changed, 723 insertions, 0 deletions

diff --git a/net-nds/openldap/files/DB_CONFIG.fast.example b/net-nds/openldap/files/DB_CONFIG.fast.example
new file mode 100644
index 00000000..8b52062c
--- /dev/null
+++ b/net-nds/openldap/files/DB_CONFIG.fast.example
@@ -0,0 +1,25 @@
+# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.1 2004/06/18 02:49:08 kurt Exp $
+# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases.
+#
+# See Sleepycat Berkeley DB documentation
+#   <http://www.sleepycat.com/docs/ref/env/db_config.html>
+# for detail description of DB_CONFIG syntax and semantics.
+#
+# Hints can also be found in the OpenLDAP Software FAQ
+#	<http://www.openldap.org/faq/index.cgi?file=2>
+
+# one 0.25 GB cache
+set_cachesize 0 16777216 0
+
+# Data Directory
+#set_data_dir db
+
+# Transaction Log settings
+set_lg_regionmax 262144
+set_lg_bsize 524288
+#set_lg_dir logs
+
+# When using (and only when using) slapadd(8) or slapindex(8),
+# the following flags may be useful:
+#set_flags DB_TXN_NOSYNC
+#set_flags DB_TXN_NOT_DURABLE
diff --git a/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch b/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch
new file mode 100644
index 00000000..ddb6672a
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch
@@ -0,0 +1,12 @@
+diff -ur openldap-2.2.14.orig/servers/slapd/back-perl/Makefile.in openldap-2.2.14/servers/slapd/back-perl/Makefile.in
+--- openldap-2.2.14.orig/servers/slapd/back-perl/Makefile.in	2004-04-12 11:20:14.000000000 -0700
++++ openldap-2.2.14/servers/slapd/back-perl/Makefile.in	2004-06-20 18:43:41.000000000 -0700
+@@ -31,7 +31,7 @@
+ 
+ shared_LDAP_LIBS = $(LDAP_LIBLDAP_R_LA) $(LDAP_LIBLBER_LA)
+ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS)
+-UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS)
++UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) `perl -MExtUtils::Embed -e ldopts`
+ 
+ LIBBASE = back_perl
+ 
diff --git a/net-nds/openldap/files/openldap-2.3.34-slapd-conf b/net-nds/openldap/files/openldap-2.3.34-slapd-conf
new file mode 100644
index 00000000..ad767cfd
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.3.34-slapd-conf
@@ -0,0 +1,64 @@
+#
+# See slapd.conf(5) for details on configuration options.
+# This file should NOT be world readable.
+#
+include		/etc/openldap/schema/core.schema
+
+# Define global ACLs to disable default read access.
+
+# Do not enable referrals until AFTER you have a working directory
+# service AND an understanding of referrals.
+#referral	ldap://root.openldap.org
+
+pidfile		/var/run/openldap/slapd.pid
+argsfile	/var/run/openldap/slapd.args
+
+# Load dynamic backend modules:
+###INSERTDYNAMICMODULESHERE###
+
+# Sample security restrictions
+#	Require integrity protection (prevent hijacking)
+#	Require 112-bit (3DES or better) encryption for updates
+#	Require 63-bit encryption for simple bind
+# security ssf=1 update_ssf=112 simple_bind=64
+
+# Sample access control policy:
+#	Root DSE: allow anyone to read it
+#	Subschema (sub)entry DSE: allow anyone to read it
+#	Other DSEs:
+#		Allow self write access
+#		Allow authenticated users read access
+#		Allow anonymous users to authenticate
+#	Directives needed to implement policy:
+# access to dn.base="" by * read
+# access to dn.base="cn=Subschema" by * read
+# access to *
+#	by self write
+#	by users read
+#	by anonymous auth
+#
+# if no access controls are present, the default policy
+# allows anyone and everyone to read anything but restricts
+# updates to rootdn.  (e.g., "access to * by * read")
+#
+# rootdn can always read and write EVERYTHING!
+
+#######################################################################
+# BDB database definitions
+#######################################################################
+
+database	hdb
+suffix		"dc=my-domain,dc=com"
+#         <kbyte> <min>
+checkpoint	32	30 
+rootdn		"cn=Manager,dc=my-domain,dc=com"
+# Cleartext passwords, especially for the rootdn, should
+# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
+# Use of strong authentication encouraged.
+rootpw		secret
+# The database directory MUST exist prior to running slapd AND 
+# should only be accessible by the slapd and slap tools.
+# Mode 700 recommended.
+directory	/var/lib/openldap-data
+# Indices to maintain
+index	objectClass	eq
diff --git a/net-nds/openldap/files/openldap-2.4.11-libldap_r.patch b/net-nds/openldap/files/openldap-2.4.11-libldap_r.patch
new file mode 100644
index 00000000..448249a3
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.11-libldap_r.patch
@@ -0,0 +1,11 @@
+diff -Nuar openldap-2.4.11.orig/servers/slapd/slapi/Makefile.in openldap-2.4.11/servers/slapd/slapi/Makefile.in
+--- openldap-2.4.11.orig/servers/slapd/slapi/Makefile.in	2008-02-11 15:26:49.000000000 -0800
++++ openldap-2.4.11/servers/slapd/slapi/Makefile.in	2008-10-14 02:10:18.402799262 -0700
+@@ -37,6 +37,7 @@
+ XLIBS = $(LIBRARY)
+ XXLIBS = 
+ NT_LINK_LIBS = $(AC_LIBS)
++UNIX_LINK_LIBS = ../../../libraries/libldap_r/libldap_r.la $(LTHREAD_LIBS)
+ 
+ XINCPATH = -I$(srcdir)/.. -I$(srcdir)
+ XDEFS = $(MODULES_CPPFLAGS)
diff --git a/net-nds/openldap/files/openldap-2.4.15-ppolicy.patch b/net-nds/openldap/files/openldap-2.4.15-ppolicy.patch
new file mode 100644
index 00000000..3195ee55
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.15-ppolicy.patch
@@ -0,0 +1,12 @@
+--- openldap-2.4.15/clients/tools/common.c.orig	2009-02-05 15:05:03.000000000 -0800
++++ openldap-2.4.15/clients/tools/common.c	2009-03-21 01:45:14.000000000 -0700
+@@ -1315,8 +1315,8 @@
+ 	int		nsctrls = 0;
+ 
+ #ifdef LDAP_CONTROL_PASSWORDPOLICYREQUEST
++	LDAPControl c;
+ 	if ( ppolicy ) {
+-		LDAPControl c;
+ 		c.ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST;
+ 		c.ldctl_value.bv_val = NULL;
+ 		c.ldctl_value.bv_len = 0;
diff --git a/net-nds/openldap/files/openldap-2.4.17-fix-lmpasswd-gnutls-symbols.patch b/net-nds/openldap/files/openldap-2.4.17-fix-lmpasswd-gnutls-symbols.patch
new file mode 100644
index 00000000..e5117468
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.17-fix-lmpasswd-gnutls-symbols.patch
@@ -0,0 +1,109 @@
+If GnuTLS is used, the lmpasswd module for USE=samba does not compile.
+Forward-port an old Debian patch that upstream never applied.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+Signed-off-by: Steffen Hau <steffen@hauihau.de>
+X-Gentoo-Bug: http://bugs.gentoo.org/show_bug.cgi?id=233633
+X-Upstream-Bug: http://www.openldap.org/its/index.cgi/Software%20Enhancements?id=4997
+X-Debian-Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=245341
+
+--- openldap-2.4.17.orig/libraries/liblutil/passwd.c	2009-07-27 18:59:19.635995474 -0700
++++ openldap-2.4.17/libraries/liblutil/passwd.c	2009-07-27 19:01:13.588069010 -0700
+@@ -51,6 +51,26 @@ typedef unsigned char des_data_block[8];
+ typedef PK11Context *des_context[1];
+ #define DES_ENCRYPT CKA_ENCRYPT
+ 
++#elif defined(HAVE_GNUTLS_GNUTLS_H) && !defined(DES_ENCRYPT)
++#	include <gcrypt.h>
++static int gcrypt_init = 0;
++
++typedef const void* des_key;
++typedef unsigned char des_cblock[8];
++typedef des_cblock des_data_block;
++typedef int des_key_schedule; /* unused */
++typedef des_key_schedule des_context; /* unused */
++#define des_failed(encrypted) 0
++#define des_finish(key, schedule) 
++
++#define des_set_key_unchecked( key, key_sched ) \
++  gcry_cipher_setkey( hd, key, 8 )
++
++#define des_ecb_encrypt( input, output, key_sched, enc ) \
++  gcry_cipher_encrypt( hd, *output, 8, *input, 8 )
++
++#define des_set_odd_parity( key ) do {} while(0)
++
+ #endif
+ 
+ #endif /* SLAPD_LMHASH */
+@@ -651,7 +671,7 @@ static int chk_md5(
+ 
+ #ifdef SLAPD_LMHASH
+ 
+-#if defined(HAVE_OPENSSL)
++#if defined(HAVE_OPENSSL) || defined(HAVE_GNUTLS_GNUTLS_H)
+ 
+ /*
+  * abstract away setting the parity.
+@@ -841,6 +861,19 @@ static int chk_lanman(
+ 	des_data_block StdText = "KGS!@#$%";
+ 	des_data_block PasswordHash1, PasswordHash2;
+ 	char PasswordHash[33], storedPasswordHash[33];
++
++#if defined(HAVE_GNUTLS_GNUTLS_H) && !defined(DES_ENCRYPT)
++	gcry_cipher_hd_t hd;
++
++	if ( !gcrypt_init ) {
++	  gcry_check_version( GCRYPT_VERSION );
++	  gcrypt_init = 1;
++	}
++
++	schedule = schedule; /* unused - avoid warning */
++
++	gcry_cipher_open( &hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0 );
++#endif /* HAVE_GNUTLS_GNUTLS_H && !DES_ENCRYPT */
+ 	
+ 	for( i=0; i<cred->bv_len; i++) {
+ 		if(cred->bv_val[i] == '\0') {
+@@ -883,6 +916,10 @@ static int chk_lanman(
+ 	strncpy( storedPasswordHash, passwd->bv_val, 32 );
+ 	storedPasswordHash[32] = '\0';
+ 	ldap_pvt_str2lower( storedPasswordHash );
++
++#if defined(HAVE_GNUTLS_GNUTLS_H) && !defined(DES_ENCRYPT)
++	gcry_cipher_close( hd );
++#endif /* HAVE_GNUTLS_GNUTLS_H && !DES_ENCRYPT */
+ 	
+ 	return memcmp( PasswordHash, storedPasswordHash, 32) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
+ }
+@@ -1138,6 +1175,19 @@ static int hash_lanman(
+ 	des_data_block PasswordHash1, PasswordHash2;
+ 	char PasswordHash[33];
+ 	
++#if defined(HAVE_GNUTLS_GNUTLS_H) && !defined(DES_ENCRYPT)
++	gcry_cipher_hd_t hd;
++
++	if ( !gcrypt_init ) {
++	  gcry_check_version( GCRYPT_VERSION );
++	  gcrypt_init = 1;
++	}
++
++	schedule = schedule; /* unused - avoid warning */
++
++	gcry_cipher_open( &hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0 );
++#endif /* HAVE_GNUTLS_GNUTLS_H && !DES_ENCRYPT */
++
+ 	for( i=0; i<passwd->bv_len; i++) {
+ 		if(passwd->bv_val[i] == '\0') {
+ 			return LUTIL_PASSWD_ERR;	/* NUL character in password */
+@@ -1168,6 +1218,10 @@ static int hash_lanman(
+ 	
+ 	hash->bv_val = PasswordHash;
+ 	hash->bv_len = 32;
++
++#if defined(HAVE_GNUTLS_GNUTLS_H) && !defined(DES_ENCRYPT)
++	gcry_cipher_close( hd );
++#endif /* HAVE_GNUTLS_GNUTLS_H && !DES_ENCRYPT */
+ 	
+ 	return pw_string( scheme, hash );
+ }
diff --git a/net-nds/openldap/files/openldap-2.4.17-gcc44.patch b/net-nds/openldap/files/openldap-2.4.17-gcc44.patch
new file mode 100644
index 00000000..aa7fe7ac
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.17-gcc44.patch
@@ -0,0 +1,11 @@
+diff -ur openldap-2.4.17.orig/contrib/ldapc++/src/SaslInteractionHandler.cpp openldap-2.4.17/contrib/ldapc++/src/SaslInteractionHandler.cpp
+--- openldap-2.4.17.orig/contrib/ldapc++/src/SaslInteractionHandler.cpp	2008-04-15 02:09:26.000000000 +0300
++++ openldap-2.4.17/contrib/ldapc++/src/SaslInteractionHandler.cpp	2009-08-10 13:21:24.000000000 +0300
+@@ -13,6 +13,7 @@
+ #include <termios.h>
+ #endif
+ 
++#include <stdio.h>
+ #include <string.h>
+ #include "SaslInteractionHandler.h"
+ #include "SaslInteraction.h"
diff --git a/net-nds/openldap/files/openldap-2.4.28-fix-dash.patch b/net-nds/openldap/files/openldap-2.4.28-fix-dash.patch
new file mode 100644
index 00000000..d15c3d22
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.28-fix-dash.patch
@@ -0,0 +1,26 @@
+Our libtool needs bash to work properly.
+Patch unbreaks build when /bin/sh points to dash:
+
+    Entering subdirectory liblber
+    /bin/sh ../../libtool  --mode=compile x86_64-pc-linux-gnu-gcc -O0 -D_GNU_SOURCE -I../../include -I../../include   -I/usr/include/db4.8 -DLDAP_CONNECTIONLESS   -DLBER_LIBRARY -c assert.c
+    ../../build/mkversion -v "2.4.28" liblber.la > version.c
+    /bin/sh ../../libtool  --mode=compile x86_64-pc-linux-gnu-gcc -O0 -D_GNU_SOURCE -I../../include -I../../include   -I/usr/include/db4.8 -DLDAP_CONNECTIONLESS   -DLBER_LIBRARY -c decode.c
+    eval: 1: base_compile+= x86_64-pc-linux-gnu-gcc: not found
+    eval: 1: base_compile+= -O0: not found
+    eval: 1: base_compile+= -D_GNU_SOURCE: not found
+    eval: 1: base_compile+= x86_64-pc-linux-gnu-gcc: not found
+    ...
+    make[2]: *** [decode.lo] Error 1
+diff --git a/build/top.mk b/build/top.mk
+index 6fea488..ea324e3 100644
+--- a/build/top.mk
++++ b/build/top.mk
+@@ -20,7 +20,7 @@ VERSION= @VERSION@
+ RELEASEDATE= @OPENLDAP_RELEASE_DATE@
+ 
+ @SET_MAKE@
+-SHELL = /bin/sh
++SHELL = @SHELL@
+ 
+ top_builddir = @top_builddir@
+ 
diff --git a/net-nds/openldap/files/openldap-2.4.28-gnutls-gcrypt.patch b/net-nds/openldap/files/openldap-2.4.28-gnutls-gcrypt.patch
new file mode 100644
index 00000000..aeecb0f4
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.28-gnutls-gcrypt.patch
@@ -0,0 +1,11 @@
+--- openldap-2.4.28/configure.in.orig	2012-02-11 22:40:36.004360795 +0000
++++ openldap-2.4.28/configure.in	2012-02-11 22:40:13.410986851 +0000
+@@ -1214,7 +1214,7 @@
+ 				ol_with_tls=gnutls
+ 				ol_link_tls=yes
+ 
+-				TLS_LIBS="-lgnutls"
++				TLS_LIBS="-lgnutls -lgcrypt"
+ 
+ 				AC_DEFINE(HAVE_GNUTLS, 1, 
+ 					[define if you have GNUtls])
diff --git a/net-nds/openldap/files/openldap-2.4.31-gcc47.patch b/net-nds/openldap/files/openldap-2.4.31-gcc47.patch
new file mode 100644
index 00000000..5b6af4b2
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.31-gcc47.patch
@@ -0,0 +1,16 @@
+Fix building with gcc-4.7
+
+https://bugs.gentoo.org/show_bug.cgi?id=420959
+http://www.openldap.org/its/index.cgi/Incoming?id=7304;page=16  #ITS 7304
+
+Patch written by Kacper Kowalik <xarthisius@gentoo.org>
+--- a/contrib/ldapc++/src/SaslInteractionHandler.cpp
++++ b/contrib/ldapc++/src/SaslInteractionHandler.cpp
+@@ -16,6 +16,7 @@
+ 
+ #include <stdio.h>
+ #include <string.h>
++#include <unistd.h>
+ #include "SaslInteractionHandler.h"
+ #include "SaslInteraction.h"
+ #include "debug.h"
diff --git a/net-nds/openldap/files/openldap-2.4.33-gnutls.patch b/net-nds/openldap/files/openldap-2.4.33-gnutls.patch
new file mode 100644
index 00000000..2b07c85c
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.33-gnutls.patch
@@ -0,0 +1,60 @@
+From 98de912932732f1441300eb64ca3070ff1469fcf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <petr.pisar@atlas.cz>
+Date: Sun, 30 Dec 2012 21:11:06 +0100
+Subject: [PATCH] GnuTLS 3.0 removed gnutls_certificate_get_x509_cas()
+
+---
+ libraries/libldap/tls_g.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c
+index 40616f5..374514d 100644
+--- a/libraries/libldap/tls_g.c
++++ b/libraries/libldap/tls_g.c
+@@ -60,6 +60,12 @@
+ #undef HAVE_GCRYPT_RAND
+ #endif
+ 
++#if LIBGNUTLS_VERSION_NUMBER >= 0x030000
++#define HAVE_GNUTLS_CERTIFICATE_GET_ISSUER 1
++#else
++#undef HAVE_GNUTLS_CERTIFICATE_GET_ISSUER
++#endif
++
+ #ifndef HAVE_CIPHERSUITES
+ /* Versions prior to 2.2.0 didn't handle cipher suites, so we had to
+  * kludge them ourselves.
+@@ -368,6 +374,22 @@ tlsg_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
+ 		 * then we have to build the cert chain.
+ 		 */
+ 		if ( max == 1 && !gnutls_x509_crt_check_issuer( certs[0], certs[0] )) {
++#ifdef HAVE_GNUTLS_CERTIFICATE_GET_ISSUER
++			gnutls_x509_crt_t issuer;
++			unsigned int i;
++
++			for ( i = 1; i<VERIFY_DEPTH; i++ ) {
++				/* If no CA is known, we're done */
++				if ( gnutls_certificate_get_issuer( ctx->cred, certs[i-1],
++							&issuer, 0 ) )
++					break;
++				certs[i] = issuer;
++				max++;
++				/* If this CA is self-signed, we're done */
++				if ( gnutls_x509_crt_check_issuer( certs[i], certs[i] ))
++					break;
++			}
++#else
+ 			gnutls_x509_crt_t *cas;
+ 			unsigned int i, j, ncas;
+ 
+@@ -387,6 +409,7 @@ tlsg_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
+ 				if ( j == ncas )
+ 					break;
+ 			}
++#endif /* !defined HAVE_GNUTLS_CERTIFICATE_GET_ISSUER */
+ 		}
+ 		rc = gnutls_certificate_set_x509_key( ctx->cred, certs, max, key );
+ 		if ( rc ) return -1;
+-- 
+1.8.0.2
+
diff --git a/net-nds/openldap/files/openldap-2.4.35-contrib-samba4.patch b/net-nds/openldap/files/openldap-2.4.35-contrib-samba4.patch
new file mode 100644
index 00000000..4312dc7c
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.35-contrib-samba4.patch
@@ -0,0 +1,38 @@
+diff -Nuar openldap-2.4.35.orig/contrib/slapd-modules/samba4/Makefile openldap-2.4.35/contrib/slapd-modules/samba4/Makefile
+--- openldap-2.4.35.orig/contrib/slapd-modules/samba4/Makefile	2013-03-28 15:41:51.000000000 +0000
++++ openldap-2.4.35/contrib/slapd-modules/samba4/Makefile	2013-04-16 02:16:40.651868432 +0000
+@@ -20,7 +20,8 @@
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2 -Wall
++#OPT = -g -O2 -Wall
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_RDNVAL=SLAPD_MOD_DYNAMIC \
+ 	-DSLAPD_OVER_PGUID=SLAPD_MOD_DYNAMIC \
+ 	-DSLAPD_OVER_VERNUM=SLAPD_MOD_DYNAMIC
+@@ -41,20 +42,20 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(CFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all: $(PROGRAMS)
+ 
+ pguid.la: pguid.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(OPT) $(CFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ rdnval.la: rdnval.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(OPT) $(CFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ vernum.la: vernum.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(OPT) $(CFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:
diff --git a/net-nds/openldap/files/openldap-2.4.35-contrib-smbk5pwd.patch b/net-nds/openldap/files/openldap-2.4.35-contrib-smbk5pwd.patch
new file mode 100644
index 00000000..4383802a
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.35-contrib-smbk5pwd.patch
@@ -0,0 +1,48 @@
+diff -Nuar openldap-2.4.35.orig/contrib/slapd-modules/smbk5pwd/Makefile openldap-2.4.35/contrib/slapd-modules/smbk5pwd/Makefile
+--- openldap-2.4.35.orig/contrib/slapd-modules/smbk5pwd/Makefile	2013-03-28 15:41:51.000000000 +0000
++++ openldap-2.4.35/contrib/slapd-modules/smbk5pwd/Makefile	2013-04-16 02:13:38.939913119 +0000
+@@ -21,16 +21,23 @@
+ SSL_INC = 
+ SSL_LIB = -lcrypto
+ 
+-HEIMDAL_INC = -I/usr/heimdal/include
+-HEIMDAL_LIB = -L/usr/heimdal/lib -lkrb5 -lkadm5srv
++#HEIMDAL_INC = -I/usr/heimdal/include
++#HEIMDAL_LIB = -L/usr/heimdal/lib -lkrb5 -lkadm5srv
++KRB5_INC = $(HEIMDAL_INC)
++KRB5_LIB = $(HEIMDAL_LIB) -lkrb5 -lkadm5srv
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2 -Wall
++#OPT = -g -O2 -Wall
++OPT = -Wall
+ # Omit DO_KRB5, DO_SAMBA or DO_SHADOW if you don't want to support it.
+-DEFS = -DDO_KRB5 -DDO_SAMBA -DDO_SHADOW
+-INCS = $(LDAP_INC) $(HEIMDAL_INC) $(SSL_INC)
+-LIBS = $(LDAP_LIB) $(HEIMDAL_LIB) $(SSL_LIB)
++#DEFS = -DDO_KRB5 -DDO_SAMBA -DDO_SHADOW
++INCS = $(LDAP_INC) $(KRB5_INC) $(SSL_INC)
++ifneq (DDO_KRB5,$(findstring DDO_KRB5,$(DEFS)))
++	LIBS=$(LDAP_LIB) $(SSL_LIB)
++else
++	LIBS=$(LDAP_LIB) $(KRB5_LIB) $(SSL_LIB)
++endif
+ 
+ PROGRAMS = smbk5pwd.la
+ LTVER = 0:0:0
+@@ -46,12 +53,12 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(CFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ all: $(PROGRAMS)
+ 
+ smbk5pwd.la:	smbk5pwd.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
++	$(LIBTOOL) --mode=link $(CC) $(OPT) $(CFLAGS) -version-info $(LTVER) \
+ 	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+ 
+ clean:
diff --git a/net-nds/openldap/files/openldap-2.4.6-evolution-ntlm.patch b/net-nds/openldap/files/openldap-2.4.6-evolution-ntlm.patch
new file mode 100644
index 00000000..33ff29e0
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.6-evolution-ntlm.patch
@@ -0,0 +1,192 @@
+diff -up evo-openldap-2.4.14/include/ldap.h.evolution-ntlm evo-openldap-2.4.14/include/ldap.h
+--- evo-openldap-2.4.14/include/ldap.h.evolution-ntlm	2009-01-27 00:29:53.000000000 +0100
++++ evo-openldap-2.4.14/include/ldap.h	2009-02-17 10:10:00.000000000 +0100
+@@ -2461,5 +2461,26 @@ ldap_parse_deref_control LDAP_P((
+ 	LDAPControl	**ctrls,
+ 	LDAPDerefRes	**drp ));
+ 
++/*
++ * hacks for NTLM
++ */
++#define LDAP_AUTH_NTLM_REQUEST	((ber_tag_t) 0x8aU)
++#define LDAP_AUTH_NTLM_RESPONSE	((ber_tag_t) 0x8bU)
++LDAP_F( int )
++ldap_ntlm_bind LDAP_P((
++	LDAP		*ld,
++	LDAP_CONST char	*dn,
++	ber_tag_t	tag,
++	struct berval	*cred,
++	LDAPControl	**sctrls,
++	LDAPControl	**cctrls,
++	int		*msgidp ));
++LDAP_F( int )
++ldap_parse_ntlm_bind_result LDAP_P((
++	LDAP		*ld,
++	LDAPMessage	*res,
++	struct berval	*challenge));
++
++
+ LDAP_END_DECL
+ #endif /* _LDAP_H */
+diff -up evo-openldap-2.4.14/libraries/libldap/Makefile.in.evolution-ntlm evo-openldap-2.4.14/libraries/libldap/Makefile.in
+--- evo-openldap-2.4.14/libraries/libldap/Makefile.in.evolution-ntlm	2009-01-27 00:29:53.000000000 +0100
++++ evo-openldap-2.4.14/libraries/libldap/Makefile.in	2009-02-17 10:10:00.000000000 +0100
+@@ -20,7 +20,7 @@ PROGRAMS = apitest dntest ftest ltest ur
+ SRCS	= bind.c open.c result.c error.c compare.c search.c \
+ 	controls.c messages.c references.c extended.c cyrus.c \
+ 	modify.c add.c modrdn.c delete.c abandon.c \
+-	sasl.c gssapi.c sbind.c unbind.c cancel.c  \
++	sasl.c ntlm.c gssapi.c sbind.c unbind.c cancel.c  \
+ 	filter.c free.c sort.c passwd.c whoami.c \
+ 	getdn.c getentry.c getattr.c getvalues.c addentry.c \
+ 	request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \
+@@ -33,7 +33,7 @@ SRCS	= bind.c open.c result.c error.c co
+ OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \
+ 	controls.lo messages.lo references.lo extended.lo cyrus.lo \
+ 	modify.lo add.lo modrdn.lo delete.lo abandon.lo \
+-	sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo \
++	sasl.lo ntlm.lo gssapi.lo sbind.lo unbind.lo cancel.lo \
+ 	filter.lo free.lo sort.lo passwd.lo whoami.lo \
+ 	getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo \
+ 	request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \
+diff -up /dev/null evo-openldap-2.4.14/libraries/libldap/ntlm.c
+--- /dev/null	2009-02-17 09:19:52.829004420 +0100
++++ evo-openldap-2.4.14/libraries/libldap/ntlm.c	2009-02-17 10:10:00.000000000 +0100
+@@ -0,0 +1,137 @@
++/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
++/*
++ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
++ * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
++ */
++
++/* Mostly copied from sasl.c */
++
++#include "portable.h"
++
++#include <stdlib.h>
++#include <stdio.h>
++
++#include <ac/socket.h>
++#include <ac/string.h>
++#include <ac/time.h>
++#include <ac/errno.h>
++
++#include "ldap-int.h"
++
++int
++ldap_ntlm_bind(
++	LDAP		*ld,
++	LDAP_CONST char	*dn,
++	ber_tag_t	tag,
++	struct berval	*cred,
++	LDAPControl	**sctrls,
++	LDAPControl	**cctrls,
++	int		*msgidp )
++{
++	BerElement	*ber;
++	int rc;
++	ber_int_t id;
++
++	Debug( LDAP_DEBUG_TRACE, "ldap_ntlm_bind\n", 0, 0, 0 );
++
++	assert( ld != NULL );
++	assert( LDAP_VALID( ld ) );
++	assert( msgidp != NULL );
++
++	if( msgidp == NULL ) {
++		ld->ld_errno = LDAP_PARAM_ERROR;
++		return ld->ld_errno;
++	}
++
++	/* create a message to send */
++	if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
++		ld->ld_errno = LDAP_NO_MEMORY;
++		return ld->ld_errno;
++	}
++
++	assert( LBER_VALID( ber ) );
++
++	LDAP_NEXT_MSGID( ld, id );
++	rc = ber_printf( ber, "{it{istON}" /*}*/,
++			 id, LDAP_REQ_BIND,
++			 ld->ld_version, dn, tag,
++			 cred );
++
++	/* Put Server Controls */
++	if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
++		ber_free( ber, 1 );
++		return ld->ld_errno;
++	}
++
++	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
++		ld->ld_errno = LDAP_ENCODING_ERROR;
++		ber_free( ber, 1 );
++		return ld->ld_errno;
++	}
++
++	/* send the message */
++	*msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id );
++
++	if(*msgidp < 0)
++		return ld->ld_errno;
++
++	return LDAP_SUCCESS;
++}
++
++int
++ldap_parse_ntlm_bind_result(
++	LDAP		*ld,
++	LDAPMessage	*res,
++	struct berval	*challenge)
++{
++	ber_int_t	errcode;
++	ber_tag_t	tag;
++	BerElement	*ber;
++	ber_len_t	len;
++
++	Debug( LDAP_DEBUG_TRACE, "ldap_parse_ntlm_bind_result\n", 0, 0, 0 );
++
++	assert( ld != NULL );
++	assert( LDAP_VALID( ld ) );
++	assert( res != NULL );
++
++	if ( ld == NULL || res == NULL ) {
++		return LDAP_PARAM_ERROR;
++	}
++
++	if( res->lm_msgtype != LDAP_RES_BIND ) {
++		ld->ld_errno = LDAP_PARAM_ERROR;
++		return ld->ld_errno;
++	}
++
++	if ( ld->ld_error ) {
++		LDAP_FREE( ld->ld_error );
++		ld->ld_error = NULL;
++	}
++	if ( ld->ld_matched ) {
++		LDAP_FREE( ld->ld_matched );
++		ld->ld_matched = NULL;
++	}
++
++	/* parse results */
++
++	ber = ber_dup( res->lm_ber );
++
++	if( ber == NULL ) {
++		ld->ld_errno = LDAP_NO_MEMORY;
++		return ld->ld_errno;
++	}
++
++	tag = ber_scanf( ber, "{ioa" /*}*/,
++			 &errcode, challenge, &ld->ld_error );
++	ber_free( ber, 0 );
++
++	if( tag == LBER_ERROR ) {
++		ld->ld_errno = LDAP_DECODING_ERROR;
++		return ld->ld_errno;
++	}
++
++	ld->ld_errno = errcode;
++
++	return( ld->ld_errno );
++}
diff --git a/net-nds/openldap/files/slapd-confd-2.4.28-r1 b/net-nds/openldap/files/slapd-confd-2.4.28-r1
new file mode 100644
index 00000000..ef19899a
--- /dev/null
+++ b/net-nds/openldap/files/slapd-confd-2.4.28-r1
@@ -0,0 +1,26 @@
+# conf.d file for openldap
+#
+# To enable both the standard unciphered server and the ssl encrypted
+# one uncomment this line or set any other server starting options
+# you may desire.
+
+# If you have multiple slapd instances per #376699, this will provide a default config
+INSTANCE="openldap${SVCNAME#slapd}"
+
+# If you use the classical configuration file:
+OPTS_CONF="-f /etc/${INSTANCE}/slapd.conf"
+# Uncomment this instead to use the new slapd.d configuration directory for openldap 2.3
+#OPTS_CONF="-F /etc/${INSTANCE}/slapd.d"
+# (the OPTS_CONF variable is also passed to slaptest during startup)
+
+OPTS="${OPTS_CONF} -h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
+# Optional connectionless LDAP:
+#OPTS="${OPTS_CONF} -h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock cldap://'"
+
+# If you change the above listen statement to bind on a specific IP for
+# listening, you should ensure that interface is up here (change eth0 as
+# needed).
+#rc_need="net.eth0"
+
+# Specify the kerberos keytab file
+#KRB5_KTNAME=/etc/openldap/krb5-ldap.keytab
diff --git a/net-nds/openldap/files/slapd-initd-2.4.28-r1 b/net-nds/openldap/files/slapd-initd-2.4.28-r1
new file mode 100644
index 00000000..9e67c476
--- /dev/null
+++ b/net-nds/openldap/files/slapd-initd-2.4.28-r1
@@ -0,0 +1,36 @@
+#!/sbin/runscript
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id: 52d3e4b2f273c4472b33d174f6689d7a67a7a3c0 $
+
+extra_commands="checkconfig"
+
+[ -z "$INSTANCE" ] && INSTANCE="openldap${SVCNAME#slapd}"
+
+depend() {
+	need net
+	before dbus hald avahi-daemon
+	provide ldap
+}
+
+start() {
+	checkpath -q -d /var/run/openldap/ -o ldap:ldap 
+	if ! checkconfig -Q ; then
+		eerror "There is a problem with your slapd.conf!"
+		return 1
+	fi
+	ebegin "Starting ldap-server"
+	[ -n "$KRB5_KTNAME" ] && export KRB5_KTNAME
+	eval start-stop-daemon --start --pidfile /var/run/openldap/${SVCNAME}.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}"
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ldap-server"
+	start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/${SVCNAME}.pid
+	eend $?
+}
+
+checkconfig() {
+	/usr/sbin/slaptest -u "$@" ${OPTS_CONF}
+}
diff --git a/net-nds/openldap/files/slapd.service b/net-nds/openldap/files/slapd.service
new file mode 100644
index 00000000..3427b87e
--- /dev/null
+++ b/net-nds/openldap/files/slapd.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=OpenLDAP Server Daemon
+After=network.target
+
+[Service]
+Type=forking
+PIDFile=/run/openldap/slapd.pid
+ExecStartPre=/usr/sbin/slaptest -Q -u $SLAPD_OPTIONS
+ExecStart=/usr/lib/openldap/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS
+
+[Install]
+WantedBy=multi-user.target
diff --git a/net-nds/openldap/files/slapd.service.conf b/net-nds/openldap/files/slapd.service.conf
new file mode 100644
index 00000000..812ea68e
--- /dev/null
+++ b/net-nds/openldap/files/slapd.service.conf
@@ -0,0 +1,12 @@
+[Service]
+# Use the classical configuration file:
+#Environment="SLAPD_OPTIONS=-f /etc/openldap/slapd.conf"
+# Use the slapd configuration directory:
+#Environment="SLAPD_OPTIONS=-F /etc/openldap/slapd.d"
+
+Environment="SLAPD_URLS=ldaps:/// ldap:/// ldapi:///"
+# Other examples:
+#Environment="SLAPD_URLS=ldap://127.0.0.1/ ldap://10.0.0.1:1389/ cldap:///"
+
+# Specify the kerberos keytab file
+#Environment=KRB5_KTNAME=/etc/openldap/krb5-ldap.keytab
diff --git a/net-nds/openldap/files/slapd.tmpfilesd b/net-nds/openldap/files/slapd.tmpfilesd
new file mode 100644
index 00000000..634cea16
--- /dev/null
+++ b/net-nds/openldap/files/slapd.tmpfilesd
@@ -0,0 +1,2 @@
+# openldap runtime directory for slapd.arg and slapd.pid
+d /run/openldap 0755 ldap ldap -