Description: support for ldap tls required for samba4
 TODO: Put a short summary on the line above and replace this paragraph
 with a longer explanation of this change. Complete the meta-information
 with other relevant fields (see below for details). To make it easier, the
 information below has been extracted from the changelog. Adjust it or drop
 it.
 .
 quassel (1:0.14.0-1) unstable; urgency=medium
 .
   * Update d/watch to version 4 and to point to the new upstream location
   * Delete d/patches/qt514 and update d/p/series due to new release
   * New upstream release
     - Refresh patches
   * Add libboost-dev to build-depends
   * Update d/quassel-data.install for current install locations
   * Update d/rules to not build shared library: ENABLE_SHARED=OFF
   * Add libldap2-dev to build-depends to enable support for LDAP
     authentication
   * Add NEWS entry about new database and config file formats
   * Update quasselcore.1 for 0.14.0
Author: Jan Koester <jan.koester@tuxist.de>

---
The information above should follow the Patch Tagging Guidelines, please
checkout https://dep.debian.net/deps/dep3/ to learn about the format. Here
are templates for supplementary fields that you might want to add:

Origin: (upstream|backport|vendor|other), (<patch-url>|commit:<commit-id>)
Bug: <upstream-bugtracker-url>
Bug-Debian: https://bugs.debian.org/<bugnumber>
Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
Forwarded: (no|not-needed|<patch-forwarded-url>)
Applied-Upstream: <version>, (<commit-url>|commit:<commid-id>)
Reviewed-By: <name and email of someone who approved/reviewed the patch>
Last-Update: 2024-01-23

--- quassel-0.14.0.orig/src/core/ldapauthenticator.cpp
+++ quassel-0.14.0/src/core/ldapauthenticator.cpp
@@ -49,7 +49,7 @@ LdapAuthenticator::LdapAuthenticator(QOb
 LdapAuthenticator::~LdapAuthenticator()
 {
     if (_connection != nullptr) {
-        ldap_unbind_ext(_connection, nullptr, nullptr);
+        ldap_unbind_ext(_connection, &_serverctls,&_clientctls);
     }
 }
 
@@ -193,6 +193,9 @@ bool LdapAuthenticator::ldapConnect()
         return false;
     }
 
+
+    ldap_start_tls_s(_connection, &_serverctls, &_clientctls);
+
     return true;
 }
 
@@ -232,7 +235,7 @@ bool LdapAuthenticator::ldapAuth(const Q
     cred.bv_val = (bindPassword.size() > 0 ? bindPassword.data() : nullptr);
     cred.bv_len = bindPassword.size();
 
-    res = ldap_sasl_bind_s(_connection, bindDN.size() > 0 ? bindDN.constData() : nullptr, LDAP_SASL_SIMPLE, &cred, nullptr, nullptr, nullptr);
+    res = ldap_sasl_bind_s(_connection, bindDN.size() > 0 ? bindDN.constData() : nullptr, LDAP_SASL_SIMPLE, &cred, &_serverctls, &_clientctls, nullptr);
 
     if (res != LDAP_SUCCESS) {
         qWarning() << "Refusing connection from" << username << "(LDAP bind failed:" << ldap_err2string(res) << ")";
@@ -250,8 +253,8 @@ bool LdapAuthenticator::ldapAuth(const Q
                             ldapQuery.constData(),
                             nullptr,
                             0,
-                            nullptr,
-                            nullptr,
+                            &_serverctls,
+                            &_clientctls,
                             nullptr,
                             0,
                             &msg);
@@ -281,7 +284,7 @@ bool LdapAuthenticator::ldapAuth(const Q
 
     char* userDN = ldap_get_dn(_connection, entry);
 
-    res = ldap_sasl_bind_s(_connection, userDN, LDAP_SASL_SIMPLE, &cred, nullptr, nullptr, nullptr);
+    res = ldap_sasl_bind_s(_connection, userDN, LDAP_SASL_SIMPLE, &cred, &_serverctls, &_clientctls, nullptr);
 
     if (res != LDAP_SUCCESS) {
         qWarning() << "Refusing connection from" << username << "(LDAP authentication failed)";
--- quassel-0.14.0.orig/src/core/ldapauthenticator.h
+++ quassel-0.14.0/src/core/ldapauthenticator.h
@@ -89,4 +89,6 @@ private:
 
     // The actual connection object.
     LDAP* _connection{nullptr};
+    LDAPControl*  _serverctls = nullptr;
+    LDAPControl*  _clientctls = nullptr;
 };