Update contrib/libs/openldap to 2.6.9

commit_hash:49dc22409f7e26735a51eb017bdd3f81018bf440

17 files changed, 116 insertions, 37 deletions

diff --git a/contrib/libs/openldap/.yandex_meta/override.nix b/contrib/libs/openldap/.yandex_meta/override.nix
index 69ca17d87e..bb17f87de9 100644
--- a/contrib/libs/openldap/.yandex_meta/override.nix
+++ b/contrib/libs/openldap/.yandex_meta/override.nix
@@ -1,5 +1,5 @@
 pkgs: attrs: with pkgs; rec {
-  version = "2.6.8";
+  version = "2.6.9";
 
   versionWithUnderscores = "${lib.replaceStrings ["."] ["_"] version}";
 
@@ -7,7 +7,7 @@ pkgs: attrs: with pkgs; rec {
     owner = "openldap";
     repo = "openldap";
     rev = "OPENLDAP_REL_ENG_${versionWithUnderscores}";
-    hash = "sha256-fJ6cpLR4DUlNlxGvKliGHu4aT93vR2mNB6AUcqDl+gk=";
+    hash = "sha256-GpNrca+POD8bhyGZn5DYwzsJI0sDU4wxOYBHVXFNjDY=";
   };
 
   patches = [];
diff --git a/contrib/libs/openldap/CHANGES b/contrib/libs/openldap/CHANGES
index 019c055c04..7360990b06 100644
--- a/contrib/libs/openldap/CHANGES
+++ b/contrib/libs/openldap/CHANGES
@@ -1,5 +1,31 @@
 OpenLDAP 2.6 Change Log
 
+OpenLDAP 2.6.9 Release (2024/11/26)
+	Fixed libldap TLS connection timeout handling (ITS#8047)
+	Fixed libldap GnuTLS incompatible pointer type (ITS#10253)
+	Fixed libldap OpenSSL set_ciphersuite error handling (ITS#10223)
+	Fixed libldap to check for OpenSSL EVP_Digest* failure (ITS#10224)
+	Fixed slapd cn=config disallowed modification of cn=schema (ITS#10256)
+	Fixed slapd syncrepl assert during refresh at shutdown (ITS#10232)
+	Fixed slapd syncrepl retry state during refreshDone (ITS#10234)
+	Fixed slapd-ldap use of multi-precision add for op counters (ITS#10237)
+	Fixed slapd-mdb idl intersection (ITS#10233)
+	Fixed slapd-wt idl intersection (ITS#10233)
+	Fixed slapo-memberof to omit dynamic values (ITS#10230)
+	Fixed slapo-nestgroup leak in nestgroup_memberFilter (ITS#10249)
+	Fixed slapo-translucent regression with subordinate databases (ITS#10248)
+	Fixed slapo-translucent regression when requesting attributes (ITS#10272)
+	Fixed slappw-argon2 defaults to be more secure (ITS#9827)
+	Minor Cleanup
+		ITS#10155
+		ITS#10218
+		ITS#10219
+		ITS#10227
+		ITS#10231
+		ITS#10235
+		ITS#10263
+		ITS#10264
+
 OpenLDAP 2.6.8 Release (2024/05/21)
 	Fixed libldap exit handling with OpenSSL3 again (ITS#9952)
 	Fixed libldap OpenSSL channel binding digest (ITS#10216)
diff --git a/contrib/libs/openldap/include/ldap_config.h b/contrib/libs/openldap/include/ldap_config.h
index 2b031824e6..b7c76a1919 100644
--- a/contrib/libs/openldap/include/ldap_config.h
+++ b/contrib/libs/openldap/include/ldap_config.h
@@ -52,10 +52,10 @@
 #define LDAP_SBINDIR		"/var/empty/tmp/out/sbin"
 #endif
 #ifndef LDAP_DATADIR
-#define LDAP_DATADIR		"/var/empty/openldap-2.6.8/share/openldap"
+#define LDAP_DATADIR		"/var/empty/openldap-2.6.9/share/openldap"
 #endif
 #ifndef LDAP_SYSCONFDIR
-#define LDAP_SYSCONFDIR		"/var/empty/openldap-2.6.8/etc/openldap"
+#define LDAP_SYSCONFDIR		"/var/empty/openldap-2.6.9/etc/openldap"
 #endif
 #ifndef LDAP_LIBEXECDIR
 #define LDAP_LIBEXECDIR		"/var/empty/tmp/out/libexec"
@@ -64,7 +64,7 @@
 #define LDAP_MODULEDIR		"/var/empty/tmp/out/libexec/openldap"
 #endif
 #ifndef LDAP_RUNDIR
-#define LDAP_RUNDIR			"/var/empty/openldap-2.6.8/var"
+#define LDAP_RUNDIR			"/var/empty/openldap-2.6.9/var"
 #endif
 #ifndef LDAP_LOCALEDIR
 #define LDAP_LOCALEDIR		""
diff --git a/contrib/libs/openldap/include/ldap_features.h b/contrib/libs/openldap/include/ldap_features.h
index bcd78f34d9..88d4d153de 100644
--- a/contrib/libs/openldap/include/ldap_features.h
+++ b/contrib/libs/openldap/include/ldap_features.h
@@ -22,10 +22,10 @@
 #define _LDAP_FEATURES_H 1
 
 /* OpenLDAP API version macros */
-#define LDAP_VENDOR_VERSION 20608
+#define LDAP_VENDOR_VERSION 20609
 #define LDAP_VENDOR_VERSION_MAJOR 2
 #define LDAP_VENDOR_VERSION_MINOR 6
-#define LDAP_VENDOR_VERSION_PATCH 8
+#define LDAP_VENDOR_VERSION_PATCH 9
 
 /*
 ** WORK IN PROGRESS!
diff --git a/contrib/libs/openldap/include/portable-linux.h b/contrib/libs/openldap/include/portable-linux.h
index c42a93a0d7..ed90094e38 100644
--- a/contrib/libs/openldap/include/portable-linux.h
+++ b/contrib/libs/openldap/include/portable-linux.h
@@ -850,7 +850,7 @@
 #define LDAP_SYSLOG 1
 
 /* Version */
-#define LDAP_VENDOR_VERSION 20608
+#define LDAP_VENDOR_VERSION 20609
 
 /* Major */
 #define LDAP_VENDOR_VERSION_MAJOR 2
@@ -859,7 +859,7 @@
 #define LDAP_VENDOR_VERSION_MINOR 6
 
 /* Patch */
-#define LDAP_VENDOR_VERSION_PATCH 8
+#define LDAP_VENDOR_VERSION_PATCH 9
 
 /* Define to the sub-directory where libtool stores uninstalled libraries. */
 #define LT_OBJDIR ".libs/"
@@ -877,7 +877,7 @@
 #define OPENLDAP_PACKAGE "OpenLDAP"
 
 /* Version */
-#define OPENLDAP_VERSION "2.6.8"
+#define OPENLDAP_VERSION "2.6.9"
 
 /* Define to the address where bug reports for this package should be sent. */
 #define PACKAGE_BUGREPORT ""
diff --git a/contrib/libs/openldap/libraries/liblber/version.c b/contrib/libs/openldap/libraries/liblber/version.c
index a18166a189..e1a19373d7 100644
--- a/contrib/libs/openldap/libraries/liblber/version.c
+++ b/contrib/libs/openldap/libraries/liblber/version.c
@@ -17,6 +17,6 @@ static const char copyright[] =
 "COPYING RESTRICTIONS APPLY\n";
 
 static const char __Version[] =
-"@(#) $OpenLDAP: liblber.la 2.6.8 (" __DATE__ " " __TIME__ ") $\n"
+"@(#) $OpenLDAP: liblber.la 2.6.9 (" __DATE__ " " __TIME__ ") $\n"
 "\topenldap\n";
 
diff --git a/contrib/libs/openldap/libraries/liblber/ya.make b/contrib/libs/openldap/libraries/liblber/ya.make
index 32d00b8518..6860686577 100644
--- a/contrib/libs/openldap/libraries/liblber/ya.make
+++ b/contrib/libs/openldap/libraries/liblber/ya.make
@@ -9,7 +9,7 @@ LICENSE(
 
 LICENSE_TEXTS(.yandex_meta/licenses.list.txt)
 
-VERSION(2.6.8)
+VERSION(2.6.9)
 
 ADDINCL(
     contrib/libs/openldap/include
diff --git a/contrib/libs/openldap/libraries/libldap/ldap-int.h b/contrib/libs/openldap/libraries/libldap/ldap-int.h
index 3ef17643b1..7e754775e8 100644
--- a/contrib/libs/openldap/libraries/libldap/ldap-int.h
+++ b/contrib/libs/openldap/libraries/libldap/ldap-int.h
@@ -368,6 +368,7 @@ typedef struct ldap_conn {
 #define LDAP_CONNST_NEEDSOCKET		1
 #define LDAP_CONNST_CONNECTING		2
 #define LDAP_CONNST_CONNECTED		3
+#define LDAP_CONNST_TLS_INPROGRESS	4
 	LDAPURLDesc		*lconn_server;
 	BerElement		*lconn_ber;	/* ber receiving on this conn. */
 
diff --git a/contrib/libs/openldap/libraries/libldap/ldifutil.c b/contrib/libs/openldap/libraries/libldap/ldifutil.c
index 24227eb77d..370d951f88 100644
--- a/contrib/libs/openldap/libraries/libldap/ldifutil.c
+++ b/contrib/libs/openldap/libraries/libldap/ldifutil.c
@@ -239,8 +239,6 @@ short_input:
 
 	/* Check for changetype */
 	if ( BV_CASEMATCH( lr->lr_btype+i, &BV_CHANGETYPE )) {
-#ifdef LIBERAL_CHANGETYPE_MODOP
-		/* trim trailing spaces (and log warning ...) */
 		int icnt;
 		for ( icnt = lr->lr_vals[i].bv_len; --icnt > 0; ) {
 			if ( !isspace( (unsigned char) lr->lr_vals[i].bv_val[icnt] ) ) {
@@ -249,12 +247,21 @@ short_input:
 		}
 
 		if ( ++icnt != lr->lr_vals[i].bv_len ) {
+#ifdef LIBERAL_CHANGETYPE_MODOP
+		/* trim trailing spaces (and log warning ...) */
 			fprintf( stderr, _("%s: illegal trailing space after"
 				" \"%s: %s\" trimmed (line %lu, entry \"%s\")\n"),
 				errstr, BV_CHANGETYPE.bv_val, lr->lr_vals[i].bv_val, linenum+i, dn );
 			lr->lr_vals[i].bv_val[icnt] = '\0';
+			lr->lr_vals[i].bv_len = icnt;
+#else /* !LIBERAL_CHANGETYPE_MODOP */
+			fprintf( stderr, _("%s: illegal trailing space after"
+				" \"%s: %s\" (line %lu, entry \"%s\")\n"),
+				errstr, BV_CHANGETYPE.bv_val, lr->lr_vals[i].bv_val, linenum+i, dn );
+			rc = LDAP_PARAM_ERROR;
+			goto leave;
+#endif /* !LIBERAL_CHANGETYPE_MODOP */
 		}
-#endif /* LIBERAL_CHANGETYPE_MODOP */
 
 		/* if LDIF_ENTRIES_ONLY, then either the changetype must be add, or
 		   there must be no changetype, and the flag LDIF_DEFAULT_ADD must be set */
@@ -442,7 +449,6 @@ short_input:
 
 	for ( ; i<lr->lr_lines; i++ ) {
 		if ( expect_modop ) {
-#ifdef LIBERAL_CHANGETYPE_MODOP
 			/* trim trailing spaces (and log warning ...) */
 		    int icnt;
 		    for ( icnt = lr->lr_vals[i].bv_len; --icnt > 0; ) {
@@ -450,12 +456,22 @@ short_input:
 			}
     
 			if ( ++icnt != lr->lr_vals[i].bv_len ) {
+#ifdef LIBERAL_CHANGETYPE_MODOP
 				fprintf( stderr, _("%s: illegal trailing space after"
 					" \"%s: %s\" trimmed (line %lu, entry \"%s\")\n"),
-					errstr, type, lr->lr_vals[i].bv_val, linenum+i, dn );
+					errstr, lr->lr_btype[i].bv_val, lr->lr_vals[i].bv_val,
+					linenum+i, dn );
 				lr->lr_vals[i].bv_val[icnt] = '\0';
+				lr->lr_vals[i].bv_len = icnt;
+#else /* !LIBERAL_CHANGETYPE_MODOP */
+				fprintf( stderr, _("%s: illegal trailing space after"
+					" \"%s: %s\" (line %lu, entry \"%s\")\n"),
+					errstr, lr->lr_btype[i].bv_val, lr->lr_vals[i].bv_val,
+					linenum+i, dn );
+				rc = LDAP_PARAM_ERROR;
+				goto leave;
+#endif /* !LIBERAL_CHANGETYPE_MODOP */
 			}
-#endif /* LIBERAL_CHANGETYPE_MODOP */
 
 			expect_modop = 0;
 			expect_sep = 1;
diff --git a/contrib/libs/openldap/libraries/libldap/result.c b/contrib/libs/openldap/libraries/libldap/result.c
index 95dba93902..e80b681045 100644
--- a/contrib/libs/openldap/libraries/libldap/result.c
+++ b/contrib/libs/openldap/libraries/libldap/result.c
@@ -898,6 +898,13 @@ nextresp2:
 
 				if ( lr != &dummy_lr ) {
 					ldap_return_request( ld, lr, 1 );
+				} else {
+					if ( lr->lr_res_matched ) {
+						LDAP_FREE( lr->lr_res_matched );
+					}
+					if ( lr->lr_res_error ) {
+						LDAP_FREE( lr->lr_res_error );
+					}
 				}
 				lr = NULL;
 			}
diff --git a/contrib/libs/openldap/libraries/libldap/tls2.c b/contrib/libs/openldap/libraries/libldap/tls2.c
index dea46de0ad..cf6f4dcf9a 100644
--- a/contrib/libs/openldap/libraries/libldap/tls2.c
+++ b/contrib/libs/openldap/libraries/libldap/tls2.c
@@ -383,6 +383,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
 		if ( lo && lo->ldo_tls_connect_cb && lo->ldo_tls_connect_cb !=
 			ld->ld_options.ldo_tls_connect_cb )
 			lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg );
+		conn->lconn_status = LDAP_CONNST_TLS_INPROGRESS;
 	}
 
 	/* pass hostname for SNI, but only if it's an actual name
@@ -441,9 +442,11 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
 		ber_sockbuf_remove_io( sb, &ber_sockbuf_io_debug,
 			LBER_SBIOD_LEVEL_TRANSPORT );
 #endif
+		conn->lconn_status = LDAP_CONNST_CONNECTED;
 		return -1;
 	}
 
+	conn->lconn_status = LDAP_CONNST_CONNECTED;
 	return 0;
 }
 
@@ -516,8 +519,9 @@ int
 ldap_tls_inplace( LDAP *ld )
 {
 	Sockbuf		*sb = NULL;
+	LDAPConn	*lc = ld->ld_defconn;
 
-	if ( ld->ld_defconn && ld->ld_defconn->lconn_sb ) {
+	if ( lc && lc->lconn_sb ) {
 		sb = ld->ld_defconn->lconn_sb;
 
 	} else if ( ld->ld_sb ) {
@@ -527,6 +531,10 @@ ldap_tls_inplace( LDAP *ld )
 		return 0;
 	}
 
+	if ( lc && lc->lconn_status == LDAP_CONNST_TLS_INPROGRESS ) {
+		return 0;
+	}
+
 	return ldap_pvt_tls_inplace( sb );
 }
 
@@ -1159,6 +1167,9 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 	  */
 	while ( ret > 0 ) {
 		if ( async ) {
+			ld->ld_errno = LDAP_X_CONNECTING;
+			return (ld->ld_errno);
+		} else {
 			struct timeval curr_time_tv, delta_tv;
 			int wr=0;
 
@@ -1217,6 +1228,11 @@ ldap_int_tls_start ( LDAP *ld, LDAPConn *conn, LDAPURLDesc *srv )
 		ret = ldap_int_tls_connect( ld, conn, host );
 	}
 
+	if ( !async && ld->ld_options.ldo_tm_net.tv_sec >= 0 ) {
+		/* Restore original sb status */
+		ber_sockbuf_ctrl( sb, LBER_SB_OPT_SET_NONBLOCK, (void*)0 );
+	}
+
 	if ( ret < 0 ) {
 		if ( ld->ld_errno == LDAP_SUCCESS )
 			ld->ld_errno = LDAP_CONNECT_ERROR;
diff --git a/contrib/libs/openldap/libraries/libldap/tls_g.c b/contrib/libs/openldap/libraries/libldap/tls_g.c
index f4db40eef2..3fbca43b41 100644
--- a/contrib/libs/openldap/libraries/libldap/tls_g.c
+++ b/contrib/libs/openldap/libraries/libldap/tls_g.c
@@ -965,12 +965,13 @@ tlsg_session_pinning( LDAP *ld, tls_session *sess, char *hashalg, struct berval
 	}
 
 	if ( hashalg ) {
-		keyhash.bv_len = gnutls_hash_get_len( alg );
-		keyhash.bv_val = LDAP_MALLOC( keyhash.bv_len );
+		len = gnutls_hash_get_len( alg );
+		keyhash.bv_val = LDAP_MALLOC( len );
 		if ( !keyhash.bv_val || gnutls_fingerprint( alg, &key,
-					keyhash.bv_val, &keyhash.bv_len ) < 0 ) {
+					keyhash.bv_val, &len ) < 0 ) {
 			goto done;
 		}
+		keyhash.bv_len = len;
 	} else {
 		keyhash.bv_val = (char *)key.data;
 		keyhash.bv_len = key.size;
diff --git a/contrib/libs/openldap/libraries/libldap/tls_o.c b/contrib/libs/openldap/libraries/libldap/tls_o.c
index 2e0806315a..71677847a9 100644
--- a/contrib/libs/openldap/libraries/libldap/tls_o.c
+++ b/contrib/libs/openldap/libraries/libldap/tls_o.c
@@ -302,7 +302,7 @@ tlso_stecpy( char *dst, const char *src, const char *end )
 /* OpenSSL 1.1.1 uses a separate API for TLS1.3 ciphersuites.
  * Try to find any TLS1.3 ciphers in the given list of suites.
  */
-static void
+static int
 tlso_ctx_cipher13( tlso_ctx *ctx, char *suites, char **oldsuites )
 {
 	char tls13_suites[1024], *ts = tls13_suites, *te = tls13_suites + sizeof(tls13_suites);
@@ -310,12 +310,12 @@ tlso_ctx_cipher13( tlso_ctx *ctx, char *suites, char **oldsuites )
 	char sname[128];
 	STACK_OF(SSL_CIPHER) *cs;
 	SSL *s = SSL_new( ctx );
-	int ret;
+	int ret = 0;
 
 	*oldsuites = NULL;
 
 	if ( !s )
-		return;
+		return ret;
 
 	*ts = '\0';
 
@@ -362,8 +362,9 @@ tlso_ctx_cipher13( tlso_ctx *ctx, char *suites, char **oldsuites )
 	SSL_free( s );
 
 	/* If no TLS1.3 ciphersuites were specified, leave current settings untouched. */
-	if ( tls13_suites[0] )
-		SSL_CTX_set_ciphersuites( ctx, tls13_suites );
+	if ( tls13_suites[0] && !SSL_CTX_set_ciphersuites( ctx, tls13_suites ))
+		ret = -1;
+	return ret;
 }
 #endif /* OpenSSL 1.1.1 */
 
@@ -435,7 +436,14 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
 	if ( lo->ldo_tls_ciphersuite ) {
 		char *oldsuites = lt->lt_ciphersuite;
 #if OPENSSL_VERSION_NUMBER >= 0x10101000
-		tlso_ctx_cipher13( ctx, lt->lt_ciphersuite, &oldsuites );
+		if ( tlso_ctx_cipher13( ctx, lt->lt_ciphersuite, &oldsuites ))
+		{
+			Debug1( LDAP_DEBUG_ANY,
+				   "TLS: could not set TLSv1.3 cipher list %s.\n",
+				   lo->ldo_tls_ciphersuite );
+			tlso_report_error( errmsg );
+			return -1;
+		}
 #endif
 		if ( oldsuites && !SSL_CTX_set_cipher_list( ctx, oldsuites ) )
 		{
@@ -1186,15 +1194,19 @@ tlso_session_pinning( LDAP *ld, tls_session *sess, char *hashalg, struct berval
 			goto done;
 		}
 
-		EVP_DigestInit_ex( mdctx, md, NULL );
-		EVP_DigestUpdate( mdctx, key.bv_val, key.bv_len );
-		EVP_DigestFinal_ex( mdctx, (unsigned char *)keyhash.bv_val, &len );
-		keyhash.bv_len = len;
+		if ( EVP_DigestInit_ex( mdctx, md, NULL ) &&
+			EVP_DigestUpdate( mdctx, key.bv_val, key.bv_len ) &&
+			EVP_DigestFinal_ex( mdctx, (unsigned char *)keyhash.bv_val, &len ))
+			keyhash.bv_len = len;
+		else
+			rc = -1;
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
 		EVP_MD_CTX_free( mdctx );
 #else
 		EVP_MD_CTX_destroy( mdctx );
 #endif
+		if ( rc )
+			goto done;
 	} else {
 		keyhash = key;
 	}
diff --git a/contrib/libs/openldap/libraries/libldap/version.c b/contrib/libs/openldap/libraries/libldap/version.c
index 7b1fb006b9..e21b48f7aa 100644
--- a/contrib/libs/openldap/libraries/libldap/version.c
+++ b/contrib/libs/openldap/libraries/libldap/version.c
@@ -17,6 +17,6 @@ static const char copyright[] =
 "COPYING RESTRICTIONS APPLY\n";
 
 static const char __Version[] =
-"@(#) $OpenLDAP: libldap.la 2.6.8 (" __DATE__ " " __TIME__ ") $\n"
+"@(#) $OpenLDAP: libldap.la 2.6.9 (" __DATE__ " " __TIME__ ") $\n"
 "\topenldap\n";
 
diff --git a/contrib/libs/openldap/libraries/liblmdb/ya.make b/contrib/libs/openldap/libraries/liblmdb/ya.make
index d0748a213b..3e5c14e6af 100644
--- a/contrib/libs/openldap/libraries/liblmdb/ya.make
+++ b/contrib/libs/openldap/libraries/liblmdb/ya.make
@@ -10,7 +10,7 @@ LICENSE(
 
 LICENSE_TEXTS(.yandex_meta/licenses.list.txt)
 
-VERSION(2.6.8)
+VERSION(2.6.9)
 
 NO_COMPILER_WARNINGS()
 
diff --git a/contrib/libs/openldap/libraries/ya.make b/contrib/libs/openldap/libraries/ya.make
index b116aa1db5..866671df43 100644
--- a/contrib/libs/openldap/libraries/ya.make
+++ b/contrib/libs/openldap/libraries/ya.make
@@ -1,6 +1,6 @@
 # Generated by devtools/yamaker.
 
-VERSION(2.6.8)
+VERSION(2.6.9)
 
 RECURSE(
     liblber
diff --git a/contrib/libs/openldap/ya.make b/contrib/libs/openldap/ya.make
index 76065b62e8..87feb54158 100644
--- a/contrib/libs/openldap/ya.make
+++ b/contrib/libs/openldap/ya.make
@@ -14,9 +14,9 @@ LICENSE(
 
 LICENSE_TEXTS(.yandex_meta/licenses.list.txt)
 
-VERSION(2.6.8)
+VERSION(2.6.9)
 
-ORIGINAL_SOURCE(https://gitlab.com/api/v4/projects/openldap%2Fopenldap/repository/archive.tar.gz?sha=OPENLDAP_REL_ENG_2_6_8)
+ORIGINAL_SOURCE(https://gitlab.com/api/v4/projects/openldap%2Fopenldap/repository/archive.tar.gz?sha=OPENLDAP_REL_ENG_2_6_9)
 
 PEERDIR(
     contrib/libs/openldap/libraries/liblber