rpms/openldap
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix: Cannot use SSL3 anymore

Browse Source 
Resolves: #1592431
This commit is contained in:
Matúš Honěk 2018-08-14 16:11:47 +02:00
parent 7b3fb1195a
commit 53b870b7db
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
openldap-openssl-allow-ssl3.patch Normal file
View File

@ -0,0 +1,24 @@
Ensure SSLv3 is enabled when necessary
Either at compilation time, or as a system-wide configuration, OpenSSL
may have disabled SSLv3 protocol by default. This change ensures the
protocol NO flag is cleared when necessary, hence allowing for the
protocol to be used.
Author: Matus Honek <mhonek@redhat.com>
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
--- a/libraries/libldap/tls_o.c
+++ b/libraries/libldap/tls_o.c
@@ -297,8 +297,10 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
#endif
if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL3 )
SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 );
- else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 )
+ else if ( lo->ldo_tls_protocol_min > LDAP_OPT_X_TLS_PROTOCOL_SSL2 ) {
SSL_CTX_set_options( ctx, SSL_OP_NO_SSLv2 );
+ SSL_CTX_clear_options( ctx, SSL_OP_NO_SSLv3 );
+ }
if ( lo->ldo_tls_ciphersuite &&
!SSL_CTX_set_cipher_list( ctx, lt->lt_ciphersuite ) )

7
openldap.spec
View File

@ -5,7 +5,7 @@
Name: openldap Name: openldap
Version: 2.4.46 Version: 2.4.46
Release: 7%{?dist} Release: 8%{?dist}
Summary: LDAP support libraries Summary: LDAP support libraries
License: OpenLDAP License: OpenLDAP
URL: http://www.openldap.org/ URL: http://www.openldap.org/
@ -34,6 +34,7 @@ Patch17: openldap-allop-overlay.patch
Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch Patch19: openldap-switch-to-lt_dlopenadvise-to-get-RTLD_GLOBAL-set.patch
# ldapi sasl fix pending upstream inclusion # ldapi sasl fix pending upstream inclusion
Patch20: openldap-ldapi-sasl.patch Patch20: openldap-ldapi-sasl.patch
Patch21: openldap-openssl-allow-ssl3.patch
# check-password module specific patches # check-password module specific patches
Patch90: check-password-makefile.patch Patch90: check-password-makefile.patch
@ -110,6 +111,7 @@ AUTOMAKE=%{_bindir}/true autoreconf -fi
%patch17 -p1 %patch17 -p1
%patch19 -p1 %patch19 -p1
%patch20 -p1 %patch20 -p1
%patch21 -p1
# build smbk5pwd with other overlays # build smbk5pwd with other overlays
ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays ln -s ../../../contrib/slapd-modules/smbk5pwd/smbk5pwd.c servers/slapd/overlays
@ -479,6 +481,9 @@ exit 0
%{_mandir}/man3/* %{_mandir}/man3/*
%changelog %changelog
* Tue Aug 14 2018 Matus Honek <mhonek@redhat.com> - 2.4.46-8
- Fix: Cannot use SSL3 anymore (#1592431)
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.46-7 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.46-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild