Bug 580888 – net-nds/openldap-2.4.44 USE=libressl fails to build

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Pablo Cholaky 2016-04-23 01:49:35 UTC]

Created attachment 431596 [details, diff]
OpenLDAP patch for LibreSSL due old LANMAN support

OpenLDAP fails to compile when libressl use flag is used.

Please include this patch for libressl, it compiles correctly when used:

The reason of the problem: http://www.openldap.org/lists/openldap-bugs/201411/msg00007.html

The proposed working patch: http://www.openldap.org/lists/openldap-technical/201411/msg00121.html

Tested version: 2.4.44
Patch attached.

Diff for openldap-2.4.44.ebuild:

341a342,343
>       epatch "${FILESDIR}"/${PN}-2.4.44-libressl.patch
>

[Comment 1 Tomáš Mózes 2016-04-23 19:28:29 UTC]

Please attach the full build log.

[Comment 2 Pablo Cholaky 2016-04-23 21:46:22 UTC]

Created attachment 431742 [details]
Build log for compiling openldap

[Comment 3 Pablo Cholaky 2016-04-23 21:46:40 UTC]

Created attachment 431744 [details]
Emerge --info

[Comment 4 Pablo Cholaky 2016-04-23 22:13:46 UTC]

Pull request added in https://github.com/gentoo/gentoo/pull/1334 if needed.

[Comment 5 Anthony Basile 2016-04-23 22:19:19 UTC]

How does that patch affect building against current stable openssl?

Has upstream openldap adopted it yet?  It looks like they intend to from the last comment in http://www.openldap.org/its/index.cgi/Incoming?id=7978

[Comment 6 Pablo Cholaky 2016-04-25 22:45:34 UTC]

Anthony,

I don't have openssl installed in my computer, and doing a test would take me a lot of time right now due recompilation on every single package from libressl to openssl, that's why I have the patch working only for libressl instead openssl.

Testing against openssl that would require a further analysis, open for anyone who wants it, but this patch at least is intended for libressl specific use case, no idea if would work for openssl correctly as global feature, even understanding the OpenLDAP devs approved that change as proposal for OpenLDAP 2.5 following your mailing list posted. Can someone test if works correctly using openssl?

[Comment 7 Robin Johnson 2016-04-25 23:58:27 UTC]

1. This patch causes build failure with OpenSSL.
2. It overrides prototypes wrongly: OpenLDAP has it's own des_* functions, eg des_set_key_unchecked function which was search & replaced to DES_set_key_unchecked very dubiously
3. After you ignore all the changes in case, I'm concerned about the subtle :
function signature changes regarding the schedule argument:
148 -   des_set_key_unchecked( &key, schedule );
149 -   des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT );
150 +   DES_set_key_unchecked( &key, &schedule );
151 +   DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT );
(and more of the same)

I'm in favour of upstream's suggest that lmpasswd is to be removed entirely.

Pablo:
For future reference, it shouldn't take you long at all to start up a chroot that uses openssl, just unpack a stage tarball into a directory, bindmount proc/sys/dev/etc, chroot, emerge-webrsync, modify ebuild for test, get results.
Or fire up a virtual machine running gentoo.

[Comment 8 Felix Janda 2016-10-06 23:39:29 UTC]

So why don't we disable-lmpasswd as upstream suggests?

lmhash only seems to be necessary when using Samba and Windows prior to Windows NT.

[Comment 9 Pablo Cholaky 2016-10-06 23:52:11 UTC]

(In reply to Felix Janda from comment #8)
> So why don't we disable-lmpasswd as upstream suggests?
> 
> lmhash only seems to be necessary when using Samba and Windows prior to
> Windows NT.

Do you mean, some USE parameter only for lmpasswd? I think would work. I can work on a patch if this idea would be approved, I don't want to create a patch if the idea will never go upstream.

I'm really sorry for not responding this ticket again with a proper test of openssl, I just forgot to answer.

[Comment 10 Pablo Cholaky 2017-09-18 04:45:45 UTC]

Fixed in 2.4.45