From 53b870b7dbc10d0b1955a217be656b221cfa01b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C3=BA=C5=A1=20Hon=C4=9Bk?= <mhonek@redhat.com>
Date: Tue, 14 Aug 2018 16:11:47 +0200
Subject: [PATCH] Fix: Cannot use SSL3 anymore

Resolves: #1592431
---
 openldap-openssl-allow-ssl3.patch | 24 ++++++++++++++++++++++++
 openldap.spec                     |  7 ++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 openldap-openssl-allow-ssl3.patch

diff --git a/openldap-openssl-allow-ssl3.patch b/openldap-openssl-allow-ssl3.patch
new file mode 100644
index 0000000..2a8e56d
--- /dev/null
+++ b/openldap-openssl-allow-ssl3.patch
@@ -0,0 +1,24 @@
+Ensure SSLv3 is enabled when necessary
+
+Either at compilation time, or as a system-wide configuration, OpenSSL
+may have disabled SSLv3 protocol by default. This change ensures the
+protocol NO flag is cleared when necessary, hence allowing for the
+protocol to be used.
+
+Author: Matus Honek <mhonek@redhat.com>
+
+diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
+--- a/libraries/libldap/tls_o.c
++++ b/libraries/libldap/tls_o.c
+@@ -297,8 +297,10 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
+ #endif
+ 	if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL3 )
+ 		SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 );
+-	else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 )
++	else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) {
+ 		SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 );
++		SSL_CTX_clear_options( ctx, SSL_OP_NO_SSLv3 );
++	}
+ 
+ 	if ( lo->ldo_tls_ciphersuite &&
+ 		!SSL_CTX_set_cipher_list( ctx, lt->lt_ciphersuite ) )
diff --git a/openldap.spec b/openldap.spec
index 96f70e5..86ac611 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -5,7 +5,7 @@
 
 Name: openldap
 Version: 2.4.46
-Release: 7%{?dist}
+Release: 8%{?dist}
 Summary: LDAP support libraries
 License: OpenLDAP
 URL: http://www.openldap.org/
@@ -34,6 +34,7 @@ Patch17: openldap-allop-overlay.patch
 Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch
 # ldapi sasl fix pending upstream inclusion
 Patch20: openldap-ldapi-sasl.patch
+Patch21: openldap-openssl-allow-ssl3.patch
 
 # check-password module specific patches
 Patch90: check-password-makefile.patch
@@ -110,6 +111,7 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi
 %patch17 -p1
 %patch19 -p1
 %patch20 -p1
+%patch21 -p1
 
 # build smbk5pwd with other overlays
 ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays
@@ -479,6 +481,9 @@ exit 0
 %{_mandir}/man3/*
 
 %changelog
+* Tue Aug 14 2018 Matus Honek <mhonek@redhat.com> - 2.4.46-8
+- Fix: Cannot use SSL3 anymore (#1592431)
+
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.46-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild