Okay, problem fixed:
1) cd /usr/{ports,pkgsrc}/{net/php5-ldap,databases/php-ldap} on
{Free,Net}BSD respectively
2) sudo make configure
3) sudo vim
On FreeBSD
work/php-5.0.4/ext/ldap/config.h or..
work/php-4.4.0/ext/ldap/config.h
on NetBSD:
work/php-5.0.4/ext/ldap/config.h
4) Change:
/* Define to 1 if you have the `ldap_start_tls_s' function. */
/* #undef HAVE_LDAP_START_TLS_S */
To:
#define HAVE_LDAP_START_TLS_S 1
5) sudo make install
6) carry on pretending that your employee data is secure
$ cat ~/public_html/testtls.php
<?
if (function_exists('ldap_start_tls'))
echo "I see it!\n";
?>
[0] seklecki@blah:/$ php ~/public_html/testtls.php
I see it!
7) ...sit around on your day off and try to determine how the following
piece of code from configure.sh was [ever] supposed to determine if
ldap_start_tls_s() was a valid function w/o including arguments
-I/usr/local/include, -L/usr/local/lib to gcc(1) or #including ldap.h or
lber.h, and wonder who is responsible >:}
*cough*
http://chora.php.net/diff.php/php-src/ext/ldap/config.m4?php=3c934ff67902f7c5ce419c901b82c77e&r1=1.23&r2=1.24&ty=h&num=10
*cough* ... 8-) ...i dunno, maybe it "just works(r)" on Linux >:}
| /* confdefs.h. */
|
| #define PACKAGE_NAME ""
| #define PACKAGE_TARNAME ""
| #define PACKAGE_VERSION ""
| #define PACKAGE_STRING ""
| #define PACKAGE_BUGREPORT ""
| #define COMPILE_DL_LDAP 1
| #define HAVE_LDAP 1
| #define HAVE_3ARG_SETREBINDPROC 1
| /* end confdefs.h. */
| /* Define ldap_start_tls_s to an innocuous variant, in case <limits.h>
declares ldap_start_tls_s.
| For example, HP-UX 11i <limits.h> declares gettimeofday. */
| #define ldap_start_tls_s innocuous_ldap_start_tls_s
| /* System header to define __stub macros and hopefully few prototypes,
| which can conflict with char ldap_start_tls_s (); below.
| Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
| <limits.h> exists even on freestanding compilers. */
|
| #ifdef __STDC__
| # include <limits.h>
| #else
| # include <assert.h>
| #endif
|
| #undef ldap_start_tls_s
|
| /* Override any gcc2 internal prototype to avoid an error. */
| #ifdef __cplusplus
| extern "C"
| {
| #endif
| /* We use char because int might match the return type of a gcc2
| builtin and then its argument prototype would still apply. */
| char ldap_start_tls_s ();
| /* The GNU C library defines this for functions which it implements
| to always fail with ENOSYS. Some functions are actually named
| something starting with __ and the normal name is an alias. */
| #if defined (__stub_ldap_start_tls_s) || defined
(__stub___ldap_start_tls_s)
| choke me
| #else
| char (*f) () = ldap_start_tls_s;
| #endif
| #ifdef __cplusplus
| }
| #endif
|
| int
| main ()
| {
| return f != ldap_start_tls_s;
| ;
| return 0;
| }
~BAS
On Sat, 3 Sep 2005, Brian A. Seklecki wrote:
Rasmus / all:
I'll revert to that as path of last resort. The FreeBSD port mechanism for
installing php extensions is administratively superior to maintaining source
installations manually. Apache/PHP/LDAP/SSL/SQL cocktails on anything other
than Linux are way too convuluted to not be using Ports, especially with the
number of security advisories that come out. Without the XML vulnerability
checklist from 'portaudit', you might as well grab your ankles.
Anyway, It's not FreeBSD ports. The damn configure script in
php{4,5}???/ext/ldap/ per the following:
Update: The problem persists elsewhere than FreeBSD 5.3/i386. It's also
happening on a NetBSD/i386 host with a -current (cvs -rHEAD)
pkgsrc/databases/{,php-ldap-}openldap/
Okay, I traced it down:
in /usr/ports/net/php5-ldap/work/php-5.0.4/ext/ldap/configure ->
conftest -> ldap_start_tls_s();
ldap_start_tls_s return false -> ac_cv_func_ldap_start_tls_s=no in config.log
config.log -> ldap.h -> #undef HAVE_LDAP_START_TLS_S
config.c -> HAVE_LDAP_START_TLS_S -> PHP_FE(ldap_start_tls, NULL)
...therefore ldap_start_tls isn't registered. The question is why the
conftest.c in GNU autoconf is failing with:
configure:5048: cc -o conftest -O -pipe -march=pentium3 conftest.c >&5
/var/tmp//cc63HySI.o(.text+0x12): In function `main':
: undefined reference to `ldap_start_tls_s'
...Which is odd since:
php4$ grep -ir ldap_start_tls_s lib/*
Binary file lib/libldap-2.2.so matches
Binary file lib/libldap-2.2.so.7 matches
Binary file lib/libldap.a matches
Binary file lib/libldap.so matches
Binary file lib/libldap_r-2.2.so matches
Binary file lib/libldap_r-2.2.so.7 matches
Binary file lib/libldap_r.a matches
Binary file lib/libldap_r.so matches
Binary file lib/pam_ldap.so matches
php4$ grep -ir ldap_start_tls_s include/*
include/ldap.h:ldap_start_tls_s LDAP_P((
include/php/main/php_config.h:/* Define if you have the ldap_start_tls_s
function. */
include/php/main/php_config.h:/* #undef HAVE_LDAP_START_TLS_S */
$ nm lib/libldap-2.2.so.7|grep -i start_tls
0002b770 T ldap_start_tls_s
and...
php5$ grep -ir ldap_start_tls_s lib/*
Binary file lib/libldap-2.2.so matches
Binary file lib/libldap-2.2.so.7 matches
Binary file lib/libldap.a matches
Binary file lib/libldap.so matches
Binary file lib/libldap_r-2.2.so matches
Binary file lib/libldap_r-2.2.so.7 matches
Binary file lib/libldap_r.a matches
Binary file lib/libldap_r.so matches
php5$ grep -ir ldap_start_tls_s include/*
include/ldap.h:ldap_start_tls_s LDAP_P((
include/php/main/php_config.h:/* Define if you have the ldap_start_tls_s
function. */
include/php/main/php_config.h:/* #undef HAVE_LDAP_START_TLS_S */
$ nm lib/libldap-2.2.so.7|grep -i start_tls
0002b770 T ldap_start_tls_s
..from 'make configure' in ports/net/php5-ldap/
checking for LDAP support... yes, shared
checking for LDAP Cyrus SASL support... no
checking for 3 arg ldap_set_rebind_proc... yes
checking for ldap_parse_reference... no
checking for ldap_start_tls_s... no
checking for ldap_bind_s... yes
...from config.log:
configure:5048: cc -o conftest -O -pipe -march=pentium3 conftest.c >&5
/var/tmp//cc63HySI.o(.text+0x12): In function `main':
: undefined reference to `ldap_start_tls_s'
configure:5051: $? = 1
configure: failed program was:
#line 5011 "configure"
#include "confdefs.h"
/* System header to define __stub macros and hopefully few prototypes,
which can conflict with char ldap_start_tls_s (); below. */
#include <assert.h>
/* Override any gcc2 internal prototype to avoid an error. */
#ifdef __cplusplus
extern "C"
#endif
/* We use char because int might match the return type of a gcc2
builtin and then its argument prototype would still apply. */
char ldap_start_tls_s ();
char (*f) ();
#ifdef F77_DUMMY_MAIN
# ifdef __cplusplus
extern "C"
# endif
int F77_DUMMY_MAIN() { return 1; }
#endif
int
main ()
{
/* The GNU C library defines this for functions which it implements
to always fail with ENOSYS. Some functions are actually named
something starting with __ and the normal name is an alias. */
#if defined (__stub_ldap_start_tls_s) || defined (__stub___ldap_start_tls_s)
choke me
#else
f = ldap_start_tls_s;
#endif
;
return 0;
}
configure:5067: result: no
configure:5414: checking for ldap_bind_s
configure:5457: cc -o conftest -O -pipe -march=pentium3 -R/usr/local/lib
-L/usr/local/lib -lldap -R/usr/local/lib -
L/usr/local/lib -llber conftest.c >&5
configure:5460: $? = 0
configure:5463: test -s conftest
configure:5466: $? = 0
configure:5476: result: yes
configure:5583: checking for ld used by GCC
configure:5646: result: /usr/bin/ld
configure:5655: checking if the linker (/usr/bin/ld) is GNU ld
GNU ld version 2.15 [FreeBSD] 2004-05-23
configure:5667: result: yes
configure:5672: checking for /usr/bin/ld option to reload object files
configure:5679: result: -r
configure:5684: checking for BSD-compatible nm
configure:5720: result: nm
configure:5723: checking for a sed that does not truncate output
configure:5805: result: /usr/bin/sed
configure:5808: checking whether ln -s works
configure:5812: result: yes
configure:5819: checking how to recognise dependent libraries
configure:6001: result: pass_all
configure:6013: checking command to parse nm output
configure:6097: cc -c -O -pipe -march=pentium3 conftest.c >&5
configure:6100: $? = 0
configure:6104: nm conftest.o \| sed -n -e 's/^.*[
]\([ABCDGISTW][ABCDGISTW]*\)[ ][ ]*\(\)\([_A-Za-z][_A-
Za-z0-9]*\)$/\1 \2\3 \3/p' \> conftest.nm
configure:6107: $? = 0
configure:6159: cc -o conftest -O -pipe -march=pentium3 conftest.c
conftstm.o >&5
configure:6162: $? = 0
configure:6206: result: ok
configure:6215: checking how to run the C preprocessor
configure:6241: cc -E conftest.c
configure:6247: $? = 0
configure:6274: cc -E conftest.c
configure:6271:28: ac_nonexistent.h: No such file or directory
configure:6280: $? = 1
configure: failed program was:
#line 6270 "configure"
#include "confdefs.h"
#include <ac_nonexistent.h>
configure:6317: result: cc -E
configure:6332: cc -E conftest.c
configure:6338: $? = 0
configure:6365: cc -E conftest.c
configure:6362:28: ac_nonexistent.h: No such file or directory
configure:6371: $? = 1
configure: failed program was:
#line 6361 "configure"
#include "confdefs.h"
#include <ac_nonexistent.h>
configure:6411: checking for ANSI C header files
configure:6425: cc -E conftest.c
configure:6431: $? = 0
configure:6518: cc -o conftest -O -pipe -march=pentium3 conftest.c >&5
configure:6521: $? = 0
ac_cv_func_ldap_start_tls_s=no
From php_ldap.h:
#if LDAP_API_VERSION > 2000
PHP_FUNCTION(ldap_start_tls);
#endif
From ldap.c:
#ifdef HAVE_LDAP_START_TLS_S
PHP_FE(ldap_start_tls, NULL)
#endif
#ifdef HAVE_LDAP_START_TLS_S
/* {{{ proto bool ldap_start_tls(resource link)
Start TLS */
PHP_FUNCTION(ldap_start_tls)
{
zval **link;
ldap_linkdata *ld;
int rc, protocol = LDAP_VERSION3;
if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &link) ==
FAILURE) {
WRONG_PARAM_COUNT;
}
ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, link, -1, "ldap link",
le_link);
if (((rc = ldap_set_option(ld->link, LDAP_OPT_PROTOCOL_VERSION,
&protocol)) != LDAP_SUCCESS) ||
((rc = ldap_start_tls_s(ld->link, NULL, NULL)) !=
LDAP_SUCCESS)
) {
php_error_docref(NULL TSRMLS_CC, E_WARNING,"Unable to start
TLS: %s", ldap_err2string(rc));
RETURN_FALSE;
} else {
RETURN_TRUE;
}
}
/* }}} */
#endif
On Fri, 2 Sep 2005, Rasmus Lerdorf wrote:
Brian A. Seklecki wrote:
Firstly, sorry if this is the wrong list. There are thousands of forums
and PHP5 related MLs, but nothing FBSD specific.
Second, I wouldn't post if this wasn't happening on two completely
different FBSD boxes.
For whatever reason, the php4 and php5 from FreeBSD ports refuses to
properly configure SSL/TLS support for the LDAP module.
Can't you just build from the PHP tarball instead? Seems like a messed
up port to me. I use FreeBSD all day, every day and haven't seen this
problem. But I also don't use the ports.
-Rasmus
l8*
-lava
x.25 - minix - bitnet - plan9 - 110 bps - ASR 33 - base8
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
l8*
-lava
x.25 - minix - bitnet - plan9 - 110 bps - ASR 33 - base8
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
