From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hnmSt5ZBqz378L for ; Sun, 20 Sep 2026 12:51:26 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hnmSp6fdQz371G for ; Sun, 20 Sep 2026 12:51:22 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hnmSp3SpKz4Wc; Sun, 20 Sep 2026 12:51:22 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789908682; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YBfrAww269xxWaFVEpLAUlNX5y+Z2zlIvCKp2pqaCmY=; b=xgYtP6qAvXn3ZevBwDH5ZbcqPIhM92EDZg9OOn3X3gVE+wX5CQqOwdNVpNltD9tsVRcz8a UuRoQWybwtRk4CAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789908682; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YBfrAww269xxWaFVEpLAUlNX5y+Z2zlIvCKp2pqaCmY=; b=fmOHPUEoo51uNXWBLH0NW/7iukytk0RjQOUStdbZ5hXSrLzOtTACkr8D12TgGDMr/25bh4 8x7PBpejxZ63kC/iVMymFcNLWDZSusj4LxnjKcSU+Jznq/zQs6iP5dP+uILE2pk0j7kPu1 g1d0NYhVOMK4xbQFEYBYWPM1n9qw3DVk/bsYMoyMtjzvADdk18lYwc6+mpv4hjfq3iu5bG 2d7UY5O998RpZsxQogeakp6uni2YUag7s5VyN7fNvB61agpPhI39UOL6ZRwSWnq+vmZOSX h53xNAxMi98koSUeJiW76XeQ8yBZ36XiDJThx+1QID22RKu29XWl1D7igZWmsA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] openldap: Update to version 2.7.1 Date: Sun, 20 Sep 2026 14:51:16 +0200 Message-ID: <20260920125116.3492275-6-adolf.belka@ipfire.org> In-Reply-To: <20260920125116.3492275-1-adolf.belka@ipfire.org> References: <20260920125116.3492275-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit - Update from version 2.6.10 to 2.7.1 - Update of rootfile - Changelog 2.7.1 Fixed libldap BER leak on notice of disconnection (ITS#10584) Fixed libldap request leak on malformed BER response (ITS#10577) Fixed libldap error stack handling with OpenSSL < 4.0 (ITS#10578) Fixed lload non-blocking BIO handling in SSL renegotiations (ITS#10579) Fixed slapo-ppolicy handling of old passwords (ITS#10565) Documentation slapo-pcache added note about referral chasing (ITS#10560) Minor Cleanup ITS#10561 ITS#10564 ITS#10566 ITS#10568 ITS#10574 ITS#10576 ITS#10582 2.7.0 The following new components and capabilities are highlighted for this release: Featured Enhancements * libldap enhancements: DNS SRV record support now also supports ldaps Support for TPM chips, smartcards, or hardware security modules Support for the mbedTLS library * back-mdb enhancements: Now using LMDB 1.0 which adds page-level database encryption and/or checksums New OpenLDAP Server Capabilities General * New Access Control Features There is now an explicit "increment" permission for ACLs ACLs can now be applied to operations and controls * New lloadd Configuration support The listen feature can now be modified at runtime * Index keys use 64 bit hashes by default now instead of 32 bit Details Updates to Existing Backends * back-asyncmeta has improved target connection management Updates to Existing Overlays The following updates have been made to existing overlays: * ppolicy: Added support for dynamic policy selection, per-policy default password hashes, rehashing of passwords on simple bind * otp: Added support for the LDAP Compare operation Deprecated Features * GnuTLS is no longer recommended and scheduled for removal in OpenLDAP 2.8 Obsolete Features that have been removed * back-perl and back-sql have been removed 2.6.15 Fixed libldap BER leak on notice of disconnection (ITS#10584) Fixed libldap request leak on malformed BER response (ITS#10577) Fixed libldap error stack handling with OpenSSL < 4.0 (ITS#10578) Fixed lload non-blocking BIO handling in SSL renegotiations (ITS#10579) Fixed slapo-ppolicy handling of old passwords (ITS#10565) Documentation slapo-pcache added note about referral chasing (ITS#10560) Minor Cleanup ITS#10561 ITS#10564 ITS#10566 ITS#10574 ITS#10582 2.6.14 Added libldap support for OpenSSL 4.0 series (ITS#10498) Fixed lloadd to report errors from bindconf_parse (ITS#10525) Fixed lloadd incoming message id validation (ITS#10505) Fixed slapd to report errors from bindconf_parse (ITS#10525) Fixed slapd-mdb IDL code to optimize the intersection of a list and a range (ITS#10526) Fixed slapo-constraint count constraint with more than one attribute (ITS#10491) Fixed slapadd to ignore dynamic attributes in input LDIF (ITS#10501) Minor Cleanup ITS#8064 ITS#9909 ITS#10026 ITS#10467 ITS#10469 ITS#10470 ITS#10471 ITS#10473 ITS#10476 ITS#10479 ITS#10480 ITS#10481 ITS#10482 ITS#10483 ITS#10484 ITS#10485 ITS#10489 ITS#10492 ITS#10493 ITS#10478 ITS#10495 ITS#10496 ITS#10500 ITS#10503 ITS#10510 ITS#10514 ITS#10516 ITS#10524 ITS#10530 ITS#10532 ITS#10533 ITS#10535 ITS#10541 ITS#10543 ITS#10548 ITS#10550 ITS#10554 ITS#10556 ITS#10559 2.6.13 Fixed liblber ber_bvreplace_x potential NULL dereference (ITS#10438) Fixed libldap heap buffer overflow in parse_whsp (ITS#10430) Fixed slap(add|modify) to not recreate config frontend (ITS#10414) Fixed slapd authzPrettyNormal function memory leak (ITS#10446) Fixed slapd memory leak in get_mra function (ITS#10445) Fixed slapd memory leak in parseAssert and parseReturnFilter functions (ITS#10450) Fixed slapd memory leak in parseReadAttrs function (ITS#10449) Fixed slapd slapd_sasl_mechs race condition (ITS#10443) Fixed slapd syncrepl to be more efficient with refresh task (ITS#10413) Fixed slapd unbind/close race condition (ITS#10258) Fixed slapd-ldap memory leak in ldap_chain_parse_ctrl function (ITS#10447) Fixed slapd-mdb always initialize pausepoll (ITS#10191) Fixed slapo-constraint to not propagate request controls to internal ops (ITS#10440) Fixed slapo-dds minttl incorrectly set in certain scenarios (ITS#10442) Fixed slapo-memberof to not propagate request controls to internal ops (ITS#10440) Fixed slapo-nestgroup to not propagate request controls to internal ops (ITS#10440) Fixed slapo-retcode to not propagate request controls to internal ops (ITS#10440) Fixed slapo-syncprov to not propagate request controls to internal ops (ITS#10440) Fixed slapo-syncprov memory leak in syncprov_parseCtrl (ITS#10448) Fixed slapo-translucent to not propagate request controls to internal ops (ITS#10440) Contrib Fixed slapo-autogroup to not propagate request controls to internal ops (ITS#10440) Minor Cleanup ITS#10427 ITS#10425 ITS#10451 2.6.12 Fixed libldap to reject empty types in LDIF (ITS#10429) Fixed libldap to not scroll past nul bytes (ITS#10430) Fixed libldap to enforce stop when encountering nul-leading line (ITS#10431) 2.6.11 Fixed slapd to use fresh timestamp for lastbind (ITS#10379) Fixed slapd delta-syncrepl to always use logDB rootdn (ITS#10360) Fixed slapd reverse lookup of proxied IPv6 addresses (ITS#10387) Fixed slapd logging buffer overflow (ITS#10410) Fixed slapd-ldap response when invalid secprops is configured (ITS#10392) Fixed slapd-mdb error when deleting last child of a branch (ITS#10304) Fixed slapd-mdb check for pool pause in search (ITS#10191) Fixed slapo-memberof clash with refint on subtree rename (ITS#10398) Fixed slapo-syncprov use correct rootDN for accesslog replay (ITS#10385) Minor Cleanup ITS#7901 ITS#10329 ITS#10335 ITS#10339 ITS#10343 ITS#10344 ITS#10345 ITS#10347 ITS#10348 ITS#10349 ITS#10353 ITS#10358 ITS#10359 ITS#10366 ITS#10367 ITS#10369 ITS#10370 ITS#10371 ITS#10372 ITS#10374 ITS#10375 ITS#10376 ITS#10377 ITS#10379 ITS#10380 ITS#10381 ITS#10384 ITS#10388 ITS#10390 ITS#10391 ITS#10400 ITS#10401 ITS#10408 Signed-off-by: Adolf Belka --- config/rootfiles/common/openldap | 7 ++----- lfs/openldap | 6 +++--- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/config/rootfiles/common/openldap b/config/rootfiles/common/openldap index eb9961c0b..624073da6 100644 --- a/config/rootfiles/common/openldap +++ b/config/rootfiles/common/openldap @@ -21,15 +21,14 @@ #usr/include/ldap_utf8.h #usr/include/ldif.h #usr/include/openldap.h -#usr/include/slapi-plugin.h #usr/lib/liblber.la #usr/lib/liblber.so usr/lib/liblber.so.2 -usr/lib/liblber.so.2.0.200 +usr/lib/liblber.so.2.0.201 #usr/lib/libldap.la #usr/lib/libldap.so usr/lib/libldap.so.2 -usr/lib/libldap.so.2.0.200 +usr/lib/libldap.so.2.0.201 #usr/lib/pkgconfig/lber.pc #usr/lib/pkgconfig/ldap.pc #usr/share/man/man1/ldapadd.1 @@ -240,10 +239,8 @@ usr/lib/libldap.so.2.0.200 #usr/share/man/man5/slapd-monitor.5 #usr/share/man/man5/slapd-null.5 #usr/share/man/man5/slapd-passwd.5 -#usr/share/man/man5/slapd-perl.5 #usr/share/man/man5/slapd-relay.5 #usr/share/man/man5/slapd-sock.5 -#usr/share/man/man5/slapd-sql.5 #usr/share/man/man5/slapd-wt.5 #usr/share/man/man5/slapd.access.5 #usr/share/man/man5/slapd.backends.5 diff --git a/lfs/openldap b/lfs/openldap index fe7069a39..9da734d98 100644 --- a/lfs/openldap +++ b/lfs/openldap @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.6.10 +VER = 2.7.1 THISAPP = openldap-$(VER) DL_FILE = $(THISAPP).tgz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = e3fce31795ed9eda3443b824c245951d655af0660f316d8b6e15264999a1ee3eaf7e4b7e901ad007361027ade9bcb7b102212d42939dc98d4229dc6983c381dc +$(DL_FILE)_BLAKE2 = cad365ea14819b4e78c0104c687a3b6c6aa67de2b48a2bdf6a31c0e39a9e5e49f8d0e61e80ee43ba5c84b0a986a4bc683b404b6ac6f391667aec3f16333244ff install : $(TARGET) -- 2.55.0