Remove LDAP support from NSS.

patches/nss-pkix-no-ldap.patch

Index: patches/nss-pkix-no-ldap.patch
===================================================================
--- patches/nss-pkix-no-ldap.patch	(revision 0)
+++ patches/nss-pkix-no-ldap.patch	(working copy)
@@ -0,0 +1,503 @@
+diff --git a/lib/libpkix/include/pkix_errorstrings.h b/lib/libpkix/include/pkix_errorstrings.h
+--- a/lib/libpkix/include/pkix_errorstrings.h
++++ b/lib/libpkix/include/pkix_errorstrings.h
+@@ -573,17 +573,19 @@ PKIX_ERRORENTRY(ILLEGALUSEOFAMP,Illegal 
+ PKIX_ERRORENTRY(IMPOSSIBLECRITERIONFORCRLQUERY,Impossible criterion for Crl Query,SEC_ERROR_INVALID_ARGS),
+ PKIX_ERRORENTRY(INDEXOUTOFBOUNDS,Index out of bounds,SEC_ERROR_LIBPKIX_INTERNAL),
+ PKIX_ERRORENTRY(INESCAPEDASCII,in EscapedASCII,0),
+ PKIX_ERRORENTRY(INFOACCESSCREATEFAILED,pkix_pl_InfoAccess_Create failed,0),
+ PKIX_ERRORENTRY(INFOACCESSCREATELISTFAILED,pkix_pl_InfoAccess_CreateList failed,0),
+ PKIX_ERRORENTRY(INFOACCESSGETLOCATIONFAILED,PKIX_PL_InfoAccess_GetLocation failed,0),
+ PKIX_ERRORENTRY(INFOACCESSGETLOCATIONTYPEFAILED,PKIX_PL_InfoAccess_GetLocationType failed,0),
+ PKIX_ERRORENTRY(INFOACCESSGETMETHODFAILED,PKIX_PL_InfoAccess_GetMethod failed,0),
++#ifndef NSS_PKIX_NO_LDAP
+ PKIX_ERRORENTRY(INFOACCESSPARSELOCATIONFAILED,pkix_pl_InfoAccess_ParseLocation failed,SEC_ERROR_BAD_INFO_ACCESS_LOCATION),
++#endif
+ PKIX_ERRORENTRY(INFOACCESSPARSETOKENSFAILED,pkix_pl_InfoAccess_ParseTokens failed,SEC_ERROR_BAD_INFO_ACCESS_LOCATION),
+ PKIX_ERRORENTRY(INITIALIZECHECKERSFAILED,pkix_InitializeCheckers failed,0),
+ PKIX_ERRORENTRY(INITIALIZEFAILED,PKIX_PL_Initialize failed,0),
+ PKIX_ERRORENTRY(INPUTLISTMUSTBEHEADER,Input List must be header,SEC_ERROR_INVALID_ARGS),
+ PKIX_ERRORENTRY(INPUTLISTSMUSTBELISTHEADERS,Input Lists must be list headers,SEC_ERROR_INVALID_ARGS),
+ PKIX_ERRORENTRY(INSUFFICIENTCRITERIAFORCERTQUERY,Insufficient criteria for Cert query,0),
+ PKIX_ERRORENTRY(INSUFFICIENTCRITERIAFORCRLQUERY,Insufficient criteria for Crl Query,0),
+ PKIX_ERRORENTRY(INTRUSTEDCERT,in Trusted Cert,0),
+diff --git a/lib/libpkix/include/pkix_pl_pki.h b/lib/libpkix/include/pkix_pl_pki.h
+--- a/lib/libpkix/include/pkix_pl_pki.h
++++ b/lib/libpkix/include/pkix_pl_pki.h
+@@ -1822,17 +1822,19 @@ PKIX_PL_Cert_GetCrlDp(PKIX_PL_Cert *cert
+ 
+ #define PKIX_INFOACCESS_OCSP          1
+ #define PKIX_INFOACCESS_CA_ISSUERS    2
+ #define PKIX_INFOACCESS_TIMESTAMPING  3
+ #define PKIX_INFOACCESS_CA_REPOSITORY 5
+ 
+ #define PKIX_INFOACCESS_LOCATION_UNKNOWN 0
+ #define PKIX_INFOACCESS_LOCATION_HTTP    1
++#ifndef NSS_PKIX_NO_LDAP
+ #define PKIX_INFOACCESS_LOCATION_LDAP    2
++#endif
+ 
+ /*
+  * FUNCTION: PKIX_PL_InfoAccess_GetMethod
+  * DESCRIPTION:
+  *
+  *  Stores the method of the Information Access from "infoAccess" and
+  *  returns in "pMethod".
+  *
+diff --git a/lib/libpkix/include/pkix_sample_modules.h b/lib/libpkix/include/pkix_sample_modules.h
+--- a/lib/libpkix/include/pkix_sample_modules.h
++++ b/lib/libpkix/include/pkix_sample_modules.h
+@@ -112,16 +112,17 @@ PKIX_PL_CollectionCertStore_Create(
+  *  Returns a CertStore Error if the function fails in a non-fatal way.
+  *  Returns a Fatal Error if the function fails in an unrecoverable way.
+  */
+ PKIX_Error *
+ PKIX_PL_Pk11CertStore_Create(
+         PKIX_CertStore **pPk11CertStore,
+         void *plContext);
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ /* PKIX_PL_LdapCertStore
+  *
+  * A PKIX_PL_LdapCertStore retrieves certificates and CRLs from an LDAP server
+  * over a socket connection. It used the LDAP protocol as described in RFC1777.
+  *
+  * Once the caller has created the LdapCertStore object, the caller can call
+  * pkix_pl_LdapCertStore_GetCert or pkix_pl_LdapCertStore_GetCert to obtain
+  * a List of PKIX_PL_Certs or PKIX_PL_CRL objects, respectively.
+@@ -244,16 +245,17 @@ PKIX_PL_LdapDefaultClient_CreateByName(
+  *  Returns a CertStore Error if the function fails in a non-fatal way.
+  *  Returns a Fatal Error if the function fails in an unrecoverable way.
+  */
+ PKIX_Error *
+ PKIX_PL_LdapCertStore_Create(
+         PKIX_PL_LdapClient *client,
+         PKIX_CertStore **pCertStore,
+         void *plContext);
++#endif /* !NSS_PKIX_NO_LDAP */
+ 
+ /* PKIX_PL_NssContext
+  *
+  * A PKIX_PL_NssContext provides an example showing how the "plContext"
+  * argument, that is part of every libpkix function call, can be used.
+  * The "plContext" is the Portability Layer Context, which can be used
+  * to communicate layer-specific information from the application to the
+  * underlying Portability Layer (while bypassing the Portable Code, which
+diff --git a/lib/libpkix/pkix/top/pkix_build.h b/lib/libpkix/pkix/top/pkix_build.h
+--- a/lib/libpkix/pkix/top/pkix_build.h
++++ b/lib/libpkix/pkix/top/pkix_build.h
+@@ -6,17 +6,19 @@
+  *
+  * Header file for buildChain function
+  *
+  */
+ 
+ #ifndef _PKIX_BUILD_H
+ #define _PKIX_BUILD_H
+ #include "pkix_tools.h"
++#ifndef NSS_PKIX_NO_LDAP
+ #include "pkix_pl_ldapt.h"
++#endif
+ #include "pkix_ekuchecker.h"
+ 
+ #ifdef __cplusplus
+ extern "C" {
+ #endif
+ 
+ typedef enum {
+         BUILD_SHORTCUTPENDING,
+diff --git a/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c b/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c
+--- a/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c
++++ b/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c
+@@ -6,16 +6,17 @@
+  *
+  * AIAMgr Object Definitions
+  *
+  */
+ 
+ #include "pkix_pl_aiamgr.h"
+ extern PKIX_PL_HashTable *aiaConnectionCache;
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ /* --Virtual-LdapClient-Functions------------------------------------ */
+ 
+ PKIX_Error *
+ PKIX_PL_LdapClient_InitiateRequest(
+         PKIX_PL_LdapClient *client,
+         LDAPRequestParams *requestParams,
+         void **pNBIO,
+         PKIX_List **pResponse,
+@@ -46,16 +47,17 @@ PKIX_PL_LdapClient_ResumeRequest(
+         PKIX_CHECK(client->resumeFcn
+                 (client, pNBIO, pResponse, plContext),
+                 PKIX_LDAPCLIENTRESUMEREQUESTFAILED);
+ cleanup:
+ 
+         PKIX_RETURN(LDAPCLIENT);
+ 
+ }
++#endif /* !NSS_PKIX_NO_LDAP */
+ 
+ /* --Private-AIAMgr-Functions----------------------------------*/
+ 
+ /*
+  * FUNCTION: pkix_pl_AIAMgr_Destroy
+  * (see comments for PKIX_PL_DestructorCallback in pkix_pl_pki.h)
+  */
+ static PKIX_Error *
+@@ -76,17 +78,19 @@ pkix_pl_AIAMgr_Destroy(
+         /* pointer to cert cache */
+         /* pointer to crl cache */
+         aiaMgr->method = 0;
+         aiaMgr->aiaIndex = 0;
+         aiaMgr->numAias = 0;
+         PKIX_DECREF(aiaMgr->aia);
+         PKIX_DECREF(aiaMgr->location);
+         PKIX_DECREF(aiaMgr->results);
++#ifndef NSS_PKIX_NO_LDAP
+         PKIX_DECREF(aiaMgr->client.ldapClient);
++#endif
+ 
+ cleanup:
+ 
+         PKIX_RETURN(AIAMGR);
+ }
+ 
+ /*
+  * FUNCTION: pkix_pl_AIAMgr_RegisterSelf
+@@ -109,16 +113,17 @@ pkix_pl_AIAMgr_RegisterSelf(void *plCont
+ 
+         entry->description = "AIAMgr";
+         entry->typeObjectSize = sizeof(PKIX_PL_AIAMgr);
+         entry->destructor = pkix_pl_AIAMgr_Destroy;
+ 
+         PKIX_RETURN(AIAMGR);
+ }
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ /*
+  * FUNCTION: pkix_pl_AiaMgr_FindLDAPClient
+  * DESCRIPTION:
+  *
+  *  This function checks the collection of LDAPClient connections held by the
+  *  AIAMgr pointed to by "aiaMgr" for one matching the domain name given by
+  *  "domainName". The string may include a port number: e.g., "betty.nist.gov"
+  *  or "nss.red.iplanet.com:1389". If a match is found, that LDAPClient is
+@@ -194,16 +199,17 @@ pkix_pl_AiaMgr_FindLDAPClient(
+         *pClient = (PKIX_PL_LdapClient *)client;
+ 
+ cleanup:
+ 
+         PKIX_DECREF(domainString);
+ 
+         PKIX_RETURN(AIAMGR);
+ }
++#endif /* !NSS_PKIX_NO_LDAP */
+ 
+ PKIX_Error *
+ pkix_pl_AIAMgr_GetHTTPCerts(
+         PKIX_PL_AIAMgr *aiaMgr,
+ 	PKIX_PL_InfoAccess *ia,
+ 	void **pNBIOContext,
+ 	PKIX_List **pCerts,
+         void *plContext)
+@@ -370,16 +376,17 @@ cleanup:
+         }
+         if (path) {
+             PORT_Free(path);
+         }
+ 
+         PKIX_RETURN(AIAMGR);
+ }
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ PKIX_Error *
+ pkix_pl_AIAMgr_GetLDAPCerts(
+         PKIX_PL_AIAMgr *aiaMgr,
+ 	PKIX_PL_InfoAccess *ia,
+ 	void **pNBIOContext,
+ 	PKIX_List **pCerts,
+         void *plContext)
+ {
+@@ -478,16 +485,17 @@ cleanup:
+         if (PKIX_ERROR_RECEIVED) {
+ 	        PKIX_DECREF(aiaMgr->client.ldapClient);
+ 	}
+ 
+         PKIX_DECREF(location);
+ 
+         PKIX_RETURN(AIAMGR);
+ }
++#endif /* !NSS_PKIX_NO_LDAP */
+ 
+ /*
+  * FUNCTION: PKIX_PL_AIAMgr_Create
+  * DESCRIPTION:
+  *
+  *  This function creates an AIAMgr, storing the result at "pAIAMgr".
+  *
+  * PARAMETERS:
+@@ -614,20 +622,22 @@ PKIX_PL_AIAMgr_GetAIACerts(
+                 PKIX_CHECK(PKIX_PL_InfoAccess_GetLocationType
+                         (ia, &iaType, plContext),
+                         PKIX_INFOACCESSGETLOCATIONTYPEFAILED);
+ 
+                 if (iaType == PKIX_INFOACCESS_LOCATION_HTTP) {
+ 			PKIX_CHECK(pkix_pl_AIAMgr_GetHTTPCerts
+ 				(aiaMgr, ia, &nbio, &certs, plContext),
+ 				PKIX_AIAMGRGETHTTPCERTSFAILED);
++#ifndef NSS_PKIX_NO_LDAP
+                 } else if (iaType == PKIX_INFOACCESS_LOCATION_LDAP) {
+ 			PKIX_CHECK(pkix_pl_AIAMgr_GetLDAPCerts
+ 				(aiaMgr, ia, &nbio, &certs, plContext),
+ 				PKIX_AIAMGRGETLDAPCERTSFAILED);
++#endif
+                 } else {
+                         /* We only support http and ldap requests. */
+                         PKIX_DECREF(ia);
+                         continue;
+                 }
+ 
+                 if (nbio != NULL) { /* WOULDBLOCK */
+                         aiaMgr->aiaIndex = aiaIndex;
+@@ -659,16 +669,18 @@ PKIX_PL_AIAMgr_GetAIACerts(
+         *pCerts = aiaMgr->results;
+         aiaMgr->results = NULL;
+ 
+ cleanup:
+ 
+         if (PKIX_ERROR_RECEIVED) {
+                 PKIX_DECREF(aiaMgr->aia);
+                 PKIX_DECREF(aiaMgr->results);
++#ifndef NSS_PKIX_NO_LDAP
+                 PKIX_DECREF(aiaMgr->client.ldapClient);
++#endif
+         }
+ 
+         PKIX_DECREF(certs);
+         PKIX_DECREF(ia);
+ 
+         PKIX_RETURN(AIAMGR);
+ }
+diff --git a/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.h b/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.h
+--- a/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.h
++++ b/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.h
+@@ -22,40 +22,44 @@ struct PKIX_PL_AIAMgrStruct {
+         /* pointer to crl cache */
+         PKIX_UInt32 method;
+         PKIX_UInt32 aiaIndex;
+         PKIX_UInt32 numAias;
+         PKIX_List *aia;
+         PKIX_PL_GeneralName *location;
+         PKIX_List *results;
+ 	union {
++#ifndef NSS_PKIX_NO_LDAP
+ 	        PKIX_PL_LdapClient *ldapClient;
++#endif
+ 		struct {
+ 		        const SEC_HttpClientFcn *httpClient;
+ 			SEC_HTTP_SERVER_SESSION serverSession;
+ 			SEC_HTTP_REQUEST_SESSION requestSession;
+ 			char *path;
+ 		} hdata;
+ 	} client;
+ };
+ 
+ /* see source file for function documentation */
+ 
+ PKIX_Error *pkix_pl_AIAMgr_RegisterSelf(void *plContext);
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ PKIX_Error *PKIX_PL_LdapClient_InitiateRequest(
+         PKIX_PL_LdapClient *client,
+         LDAPRequestParams *requestParams,
+         void **pPollDesc,
+         PKIX_List **pResponse,
+         void *plContext);
+ 
+ PKIX_Error *PKIX_PL_LdapClient_ResumeRequest(
+         PKIX_PL_LdapClient *client,
+         void **pPollDesc,
+         PKIX_List **pResponse,
+         void *plContext);
++#endif /* !NSS_PKIX_NO_LDAP */
+ 
+ #ifdef __cplusplus
+ }
+ #endif
+ 
+ #endif /* _PKIX_PL_AIAMGR_H */
+diff --git a/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c b/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c
+--- a/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c
++++ b/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c
+@@ -476,34 +476,37 @@ PKIX_PL_InfoAccess_GetLocationType(
+                 PKIX_TOSTRING(infoAccess->location, &locationString, plContext,
+                     PKIX_GENERALNAMETOSTRINGFAILED);
+ 
+                 PKIX_CHECK(PKIX_PL_String_GetEncoded
+                     (locationString, PKIX_ESCASCII, &location, &len, plContext),
+                     PKIX_STRINGGETENCODEDFAILED);
+ 
+                 PKIX_OID_DEBUG("\tCalling PORT_Strcmp).\n");
++#ifndef NSS_PKIX_NO_LDAP
+                 if (PORT_Strncmp(location, "ldap:", 5) == 0){
+                         type = PKIX_INFOACCESS_LOCATION_LDAP;
+                 } else
++#endif
+                 if (PORT_Strncmp(location, "http:", 5) == 0){
+                         type = PKIX_INFOACCESS_LOCATION_HTTP;
+                 }
+         }
+ 
+         *pType = type;
+ 
+ cleanup:
+ 
+         PKIX_PL_Free(location, plContext);
+         PKIX_DECREF(locationString);
+ 
+         PKIX_RETURN(INFOACCESS);
+ }
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ /*
+  * FUNCTION: pkix_pl_InfoAccess_ParseTokens
+  * DESCRIPTION:
+  *
+  *  This function parses the string beginning at "startPos" into tokens using
+  *  the separator contained in "separator" and the terminator contained in
+  *  "terminator", copying the tokens into space allocated from the arena
+  *  pointed to by "arena". It stores in "tokens" a null-terminated array of
+@@ -863,8 +866,9 @@ pkix_pl_InfoAccess_ParseLocation(
+ 
+ cleanup:
+ 
+         PKIX_PL_Free(locationAscii, plContext);
+         PKIX_DECREF(locationString);
+ 
+         PKIX_RETURN(INFOACCESS);
+ }
++#endif /* !NSS_PKIX_NO_LDAP */
+diff --git a/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.h b/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.h
+--- a/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.h
++++ b/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.h
+@@ -27,21 +27,23 @@ struct PKIX_PL_InfoAccessStruct{
+ PKIX_Error *pkix_pl_InfoAccess_RegisterSelf(void *plContext);
+ 
+ PKIX_Error *
+ pkix_pl_InfoAccess_CreateList(
+         CERTAuthInfoAccess **authInfoAccess,
+         PKIX_List **pAiaList, /* of PKIX_PL_InfoAccess */
+         void *plContext);
+ 
++#ifndef NSS_PKIX_NO_LDAP
+ PKIX_Error *
+ pkix_pl_InfoAccess_ParseLocation(
+         PKIX_PL_GeneralName *generalName,
+         PLArenaPool *arena,
+         LDAPRequestParams *request,
+         char **pDomainName,
+         void *plContext);
++#endif /* !NSS_PKIX_NO_LDAP */
+ 
+ #ifdef __cplusplus
+ }
+ #endif
+ 
+ #endif /* _PKIX_PL_INFOACCESS_H */
+diff --git a/lib/libpkix/pkix_pl_nss/system/pkix_pl_common.h b/lib/libpkix/pkix_pl_nss/system/pkix_pl_common.h
+--- a/lib/libpkix/pkix_pl_nss/system/pkix_pl_common.h
++++ b/lib/libpkix/pkix_pl_nss/system/pkix_pl_common.h
+@@ -33,17 +33,19 @@
+ #include "prio.h"
+ 
+ /* NSPR headers */
+ #include "nspr.h"
+ 
+ /* private PKIX_PL_NSS system headers */
+ #include "pkix_pl_object.h"
+ #include "pkix_pl_string.h"
++#ifndef NSS_PKIX_NO_LDAP
+ #include "pkix_pl_ldapt.h"
++#endif /* !NSS_PKIX_NO_LDAP */
+ #include "pkix_pl_aiamgr.h"
+ #include "pkix_pl_bigint.h"
+ #include "pkix_pl_oid.h"
+ #include "pkix_pl_x500name.h"
+ #include "pkix_pl_generalname.h"
+ #include "pkix_pl_publickey.h"
+ #include "pkix_pl_bytearray.h"
+ #include "pkix_pl_date.h"
+@@ -57,19 +59,21 @@
+ #include "pkix_pl_crldp.h"
+ #include "pkix_pl_crl.h"
+ #include "pkix_pl_crlentry.h"
+ #include "pkix_pl_nameconstraints.h"
+ #include "pkix_pl_ocsprequest.h"
+ #include "pkix_pl_ocspresponse.h"
+ #include "pkix_pl_pk11certstore.h"
+ #include "pkix_pl_socket.h"
++#ifndef NSS_PKIX_NO_LDAP
+ #include "pkix_pl_ldapcertstore.h"
+ #include "pkix_pl_ldaprequest.h"
+ #include "pkix_pl_ldapresponse.h"
++#endif /* !NSS_PKIX_NO_LDAP */
+ #include "pkix_pl_nsscontext.h"
+ #include "pkix_pl_httpcertstore.h"
+ #include "pkix_pl_httpdefaultclient.h"
+ #include "pkix_pl_infoaccess.h"
+ #include "pkix_sample_modules.h"
+ 
+ #define MAX_DIGITS_32 (PKIX_UInt32) 10
+ 
+diff --git a/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.c b/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.c
+--- a/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.c
++++ b/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.c
+@@ -199,19 +199,21 @@ PKIX_PL_Initialize(
+         pkix_BasicConstraintsCheckerState_RegisterSelf(plContext);
+         pkix_PolicyCheckerState_RegisterSelf(plContext);
+ 
+         pkix_pl_CollectionCertStoreContext_RegisterSelf(plContext); /* 41-50 */
+         pkix_CrlChecker_RegisterSelf(plContext);
+         pkix_ForwardBuilderState_RegisterSelf(plContext);
+         pkix_SignatureCheckerState_RegisterSelf(plContext);
+         pkix_NameConstraintsCheckerState_RegisterSelf(plContext);
++#ifndef NSS_PKIX_NO_LDAP
+         pkix_pl_LdapRequest_RegisterSelf(plContext);
+         pkix_pl_LdapResponse_RegisterSelf(plContext);
+         pkix_pl_LdapDefaultClient_RegisterSelf(plContext);
++#endif
+         pkix_pl_Socket_RegisterSelf(plContext);
+ 
+         pkix_ResourceLimits_RegisterSelf(plContext); /* 51-59 */
+         pkix_pl_MonitorLock_RegisterSelf(plContext);
+         pkix_pl_InfoAccess_RegisterSelf(plContext);
+         pkix_pl_AIAMgr_RegisterSelf(plContext);
+         pkix_OcspChecker_RegisterSelf(plContext);
+         pkix_pl_OcspCertID_RegisterSelf(plContext);
+diff --git a/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.h b/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.h
+--- a/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.h
++++ b/lib/libpkix/pkix_pl_nss/system/pkix_pl_lifecycle.h
+@@ -28,20 +28,22 @@
+ #include "pkix_pl_date.h"
+ #include "pkix_pl_basicconstraints.h"
+ #include "pkix_pl_certpolicyinfo.h"
+ #include "pkix_pl_certpolicymap.h"
+ #include "pkix_pl_certpolicyqualifier.h"
+ #include "pkix_pl_crlentry.h"
+ #include "pkix_pl_crl.h"
+ #include "pkix_pl_colcertstore.h"
++#ifndef NSS_PKIX_NO_LDAP
+ #include "pkix_pl_ldapcertstore.h"
+ #include "pkix_pl_ldapdefaultclient.h"
+ #include "pkix_pl_ldaprequest.h"
+ #include "pkix_pl_ldapresponse.h"
++#endif /* !NSS_PKIX_NO_LDAP */
+ #include "pkix_pl_socket.h"
+ #include "pkix_pl_infoaccess.h"
+ #include "pkix_store.h"
+ #include "pkix_error.h"
+ #include "pkix_logger.h"
+ #include "pkix_list.h"
+ #include "pkix_trustanchor.h"
+ #include "pkix_procparams.h"