git.sur5r.net Git - openldap/blob - clients/tools/common.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6 /* common.c - common routines for the ldap client tools */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/stdlib.h>
  13 #include <ac/signal.h>
  14 #include <ac/string.h>
  15 #include <ac/unistd.h>
  16 #include <ac/errno.h>
  17
  18 #include <ldap.h>
  19
  20 #include "lutil_ldap.h"
  21
  22 #include "common.h"
  23
  24
  25 int   authmethod = -1;
  26 char *binddn = NULL;
  27 int   contoper = 0;
  28 int   debug = 0;
  29 char *infile = NULL;
  30 char *ldapuri = NULL;
  31 char *ldaphost = NULL;
  32 int   ldapport = 0;
  33 #ifdef HAVE_CYRUS_SASL
  34 unsigned sasl_flags = LDAP_SASL_AUTOMATIC;
  35 char    *sasl_realm = NULL;
  36 char    *sasl_authc_id = NULL;
  37 char    *sasl_authz_id = NULL;
  38 char    *sasl_mech = NULL;
  39 char    *sasl_secprops = NULL;
  40 #endif
  41 int   use_tls = 0;
  42
  43 char *authzid = NULL;
  44 int   manageDSAit = 0;
  45 int   noop = 0;
  46
  47 int   not = 0;
  48 int   want_bindpw = 0;
  49 struct berval passwd = { 0, NULL };
  50 char *pw_file = NULL;
  51 int   referrals = 0;
  52 int   protocol = -1;
  53 int   verbose = 0;
  54 int   version = 0;
  55
  56 /* Set in main() */
  57 char *prog = NULL;
  58
  59 void
  60 tool_init( void )
  61 {
  62         setlocale(LC_MESSAGES,"");
  63         bindtextdomain(OPENLDAP_PACKAGE, LDAP_LOCALEDIR);
  64         textdomain(OPENLDAP_PACKAGE);
  65 }
  66
  67 void
  68 tool_common_usage( void )
  69 {
  70         static const char *const descriptions[] = {
  71 N_("  -c         continuous operation mode (do not stop on errors)\n"),
  72 N_("  -C         chase referrals\n"),
  73 N_("  -d level   set LDAP debugging level to `level'\n"),
  74 N_("  -D binddn  bind DN\n"),
  75 N_("  -e [!]<ctrl>[=<ctrlparam>] general controls (! indicates criticality)\n")
  76 N_("             [!]authzid=<authzid> (\"dn:<dn>\" or \"u:<user>\")\n")
  77 N_("             [!]manageDSAit       (alternate form, see -M)\n")
  78 N_("             [!]noop\n"),
  79 N_("  -f file    read operations from `file'\n"),
  80 N_("  -h host    LDAP server\n"),
  81 N_("  -H URI     LDAP Uniform Resource Indentifier(s)\n"),
  82 N_("  -I         use SASL Interactive mode\n"),
  83 N_("  -k         use Kerberos authentication\n"),
  84 N_("  -K         like -k, but do only step 1 of the Kerberos bind\n"),
  85 N_("  -M         enable Manage DSA IT control (-MM to make critical)\n"),
  86 N_("  -n         show what would be done but don't actually do it\n"),
  87 N_("  -O props   SASL security properties\n"),
  88 N_("  -p port    port on LDAP server\n"),
  89 N_("  -P version procotol version (default: 3)\n"),
  90 N_("  -Q         use SASL Quiet mode\n"),
  91 N_("  -R realm   SASL realm\n"),
  92 N_("  -U authcid SASL authentication identity\n"),
  93 N_("  -v         run in verbose mode (diagnostics to standard output)\n"),
  94 N_("  -V         print version info (-VV only)\n"),
  95 N_("  -w passwd  bind password (for simple authentication)\n"),
  96 N_("  -W         prompt for bind password\n"),
  97 N_("  -x         Simple authentication\n"),
  98 N_("  -X authzid SASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"),
  99 N_("  -y file    Read password from file\n"),
 100 N_("  -Y mech    SASL mechanism\n"),
 101 N_("  -Z         Start TLS request (-ZZ to require successful response)\n"),
 102 NULL
 103         };
 104         const char *const *cpp;
 105
 106         fputs( _("Common options:\n"), stderr );
 107         for( cpp = descriptions; *cpp != NULL; cpp++ ) {
 108                 if( strchr( options, (*cpp)[3] ) ) {
 109                         fputs( _(*cpp), stderr );
 110                 }
 111         }
 112 }
 113
 114
 115 void
 116 tool_args( int argc, char **argv )
 117 {
 118         int i;
 119
 120         while (( i = getopt( argc, argv, options )) != EOF ) {
 121                 int crit;
 122                 char *control, *cvalue;
 123                 switch( i ) {
 124                 case 'c':       /* continuous operation mode */
 125                         contoper++;
 126                         break;
 127                 case 'C':
 128                         referrals++;
 129                         break;
 130                 case 'd':
 131                         debug |= atoi( optarg );
 132                         break;
 133                 case 'D':       /* bind DN */
 134                         if( binddn != NULL ) {
 135                                 fprintf( stderr, "%s: -D previously specified\n", prog );
 136                                 exit( EXIT_FAILURE );
 137                         }
 138                         binddn = ber_strdup( optarg );
 139                         break;
 140                 case 'e': /* general controls */
 141                         /* should be extended to support comma separated list of
 142                          *      [!]key[=value] parameters, e.g.  -e !foo,bar=567
 143                          */
 144
 145                         crit = 0;
 146                         cvalue = NULL;
 147                         if( optarg[0] == '!' ) {
 148                                 crit = 1;
 149                                 optarg++;
 150                         }
 151
 152                         control = ber_strdup( optarg );
 153                         if ( (cvalue = strchr( control, '=' )) != NULL ) {
 154                                 *cvalue++ = '\0';
 155                         }
 156
 157                         if ( strcasecmp( control, "authzid" ) == 0 ) {
 158                                 if( authzid != NULL ) {
 159                                         fprintf( stderr, "authzid control previously specified\n");
 160                                         exit( EXIT_FAILURE );
 161                                 }
 162                                 if( cvalue == NULL ) {
 163                                         fprintf( stderr, "authzid: control value expected\n" );
 164                                         usage();
 165                                 }
 166                                 if( !crit ) {
 167                                         fprintf( stderr, "authzid: must be marked critical\n" );
 168                                         usage();
 169                                 }
 170
 171                                 assert( authzid == NULL );
 172                                 authzid = cvalue;
 173
 174                         } else if ( strcasecmp( control, "manageDSAit" ) == 0 ) {
 175                                 if( manageDSAit ) {
 176                                         fprintf( stderr,
 177                                                 "manageDSAit control previously specified\n");
 178                                         exit( EXIT_FAILURE );
 179                                 }
 180                                 if( cvalue != NULL ) {
 181                                         fprintf( stderr,
 182                                                 "manageDSAit: no control value expected\n" );
 183                                         usage();
 184                                 }
 185
 186                                 manageDSAit = 1 + crit;
 187
 188                         } else if ( strcasecmp( control, "noop" ) == 0 ) {
 189                                 if( noop ) {
 190                                         fprintf( stderr, "noop control previously specified\n");
 191                                         exit( EXIT_FAILURE );
 192                                 }
 193                                 if( cvalue != NULL ) {
 194                                         fprintf( stderr, "noop: no control value expected\n" );
 195                                         usage();
 196                                 }
 197
 198                                 noop = 1 + crit;
 199
 200                         } else {
 201                                 fprintf( stderr, "Invalid general control name: %s\n",
 202                                         control );
 203                                 usage();
 204                         }
 205                         break;
 206                 case 'f':       /* read from file */
 207                         if( infile != NULL ) {
 208                                 fprintf( stderr, "%s: -f previously specified\n", prog );
 209                                 exit( EXIT_FAILURE );
 210                         }
 211                         infile = ber_strdup( optarg );
 212                         break;
 213                 case 'h':       /* ldap host */
 214                         if( ldaphost != NULL ) {
 215                                 fprintf( stderr, "%s: -h previously specified\n", prog );
 216                                 exit( EXIT_FAILURE );
 217                         }
 218                         ldaphost = ber_strdup( optarg );
 219                         break;
 220                 case 'H':       /* ldap URI */
 221                         if( ldapuri != NULL ) {
 222                                 fprintf( stderr, "%s: -H previously specified\n", prog );
 223                                 exit( EXIT_FAILURE );
 224                         }
 225                         ldapuri = ber_strdup( optarg );
 226                         break;
 227                 case 'I':
 228 #ifdef HAVE_CYRUS_SASL
 229                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 230                                 fprintf( stderr, "%s: incompatible previous "
 231                                         "authentication choice\n",
 232                                         prog );
 233                                 exit( EXIT_FAILURE );
 234                         }
 235                         authmethod = LDAP_AUTH_SASL;
 236                         sasl_flags = LDAP_SASL_INTERACTIVE;
 237                         break;
 238 #else
 239                         fprintf( stderr, "%s: was not compiled with SASL support\n",
 240                                 prog );
 241                         exit( EXIT_FAILURE );
 242 #endif
 243                 case 'k':       /* kerberos bind */
 244 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 245                         if( authmethod != -1 ) {
 246                                 fprintf( stderr, "%s: -k incompatible with previous "
 247                                         "authentication choice\n", prog );
 248                                 exit( EXIT_FAILURE );
 249                         }
 250                         authmethod = LDAP_AUTH_KRBV4;
 251 #else
 252                         fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 253                         exit( EXIT_FAILURE );
 254 #endif
 255                         break;
 256                 case 'K':       /* kerberos bind, part one only */
 257 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 258                         if( authmethod != -1 ) {
 259                                 fprintf( stderr, "%s: incompatible with previous "
 260                                         "authentication choice\n", prog );
 261                                 exit( EXIT_FAILURE );
 262                         }
 263                         authmethod = LDAP_AUTH_KRBV41;
 264 #else
 265                         fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 266                         exit( EXIT_FAILURE );
 267 #endif
 268                         break;
 269                 case 'M':
 270                         /* enable Manage DSA IT */
 271                         manageDSAit++;
 272                         break;
 273                 case 'n':       /* print operations, don't actually do them */
 274                         not++;
 275                         break;
 276                 case 'O':
 277 #ifdef HAVE_CYRUS_SASL
 278                         if( sasl_secprops != NULL ) {
 279                                 fprintf( stderr, "%s: -O previously specified\n", prog );
 280                                 exit( EXIT_FAILURE );
 281                         }
 282                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 283                                 fprintf( stderr, "%s: incompatible previous "
 284                                         "authentication choice\n", prog );
 285                                 exit( EXIT_FAILURE );
 286                         }
 287                         authmethod = LDAP_AUTH_SASL;
 288                         sasl_secprops = ber_strdup( optarg );
 289 #else
 290                         fprintf( stderr, "%s: not compiled with SASL support\n", prog );
 291                         exit( EXIT_FAILURE );
 292 #endif
 293                         break;
 294                 case 'p':
 295                         if( ldapport ) {
 296                                 fprintf( stderr, "%s: -p previously specified\n", prog );
 297                                 exit( EXIT_FAILURE );
 298                         }
 299                         ldapport = atoi( optarg );
 300                         break;
 301                 case 'P':
 302                         switch( atoi(optarg) ) {
 303                         case 2:
 304                                 if( protocol == LDAP_VERSION3 ) {
 305                                         fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 306                                                 prog, protocol );
 307                                         exit( EXIT_FAILURE );
 308                                 }
 309                                 protocol = LDAP_VERSION2;
 310                                 break;
 311                         case 3:
 312                                 if( protocol == LDAP_VERSION2 ) {
 313                                         fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 314                                                 prog, protocol );
 315                                         exit( EXIT_FAILURE );
 316                                 }
 317                                 protocol = LDAP_VERSION3;
 318                                 break;
 319                         default:
 320                                 fprintf( stderr, "%s: protocol version should be 2 or 3\n",
 321                                         prog );
 322                                 usage();
 323                         }
 324                         break;
 325                 case 'Q':
 326 #ifdef HAVE_CYRUS_SASL
 327                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 328                                 fprintf( stderr, "%s: incompatible previous "
 329                                         "authentication choice\n",
 330                                         prog );
 331                                 exit( EXIT_FAILURE );
 332                         }
 333                         authmethod = LDAP_AUTH_SASL;
 334                         sasl_flags = LDAP_SASL_QUIET;
 335                         break;
 336 #else
 337                         fprintf( stderr, "%s: not compiled with SASL support\n",
 338                                 prog );
 339                         exit( EXIT_FAILURE );
 340 #endif
 341                 case 'R':
 342 #ifdef HAVE_CYRUS_SASL
 343                         if( sasl_realm != NULL ) {
 344                                 fprintf( stderr, "%s: -R previously specified\n", prog );
 345                                 exit( EXIT_FAILURE );
 346                         }
 347                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 348                                 fprintf( stderr, "%s: incompatible previous "
 349                                         "authentication choice\n",
 350                                         prog );
 351                                 exit( EXIT_FAILURE );
 352                         }
 353                         authmethod = LDAP_AUTH_SASL;
 354                         sasl_realm = ber_strdup( optarg );
 355 #else
 356                         fprintf( stderr, "%s: not compiled with SASL support\n",
 357                                 prog );
 358                         exit( EXIT_FAILURE );
 359 #endif
 360                         break;
 361                 case 'U':
 362 #ifdef HAVE_CYRUS_SASL
 363                         if( sasl_authc_id != NULL ) {
 364                                 fprintf( stderr, "%s: -U previously specified\n", prog );
 365                                 exit( EXIT_FAILURE );
 366                         }
 367                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 368                                 fprintf( stderr, "%s: incompatible previous "
 369                                         "authentication choice\n",
 370                                         prog );
 371                                 exit( EXIT_FAILURE );
 372                         }
 373                         authmethod = LDAP_AUTH_SASL;
 374                         sasl_authc_id = ber_strdup( optarg );
 375 #else
 376                         fprintf( stderr, "%s: not compiled with SASL support\n",
 377                                 prog );
 378                         exit( EXIT_FAILURE );
 379 #endif
 380                         break;
 381                 case 'v':       /* verbose mode */
 382                         verbose++;
 383                         break;
 384                 case 'V':       /* version */
 385                         version++;
 386                         break;
 387                 case 'w':       /* password */
 388                         passwd.bv_val = ber_strdup( optarg );
 389                         {
 390                                 char* p;
 391
 392                                 for( p = optarg; *p != '\0'; p++ ) {
 393                                         *p = '\0';
 394                                 }
 395                         }
 396                         passwd.bv_len = strlen( passwd.bv_val );
 397                         break;
 398                 case 'W':
 399                         want_bindpw++;
 400                         break;
 401                 case 'y':
 402                         pw_file = optarg;
 403                         break;
 404                 case 'Y':
 405 #ifdef HAVE_CYRUS_SASL
 406                         if( sasl_mech != NULL ) {
 407                                 fprintf( stderr, "%s: -Y previously specified\n", prog );
 408                                 exit( EXIT_FAILURE );
 409                         }
 410                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 411                                 fprintf( stderr,
 412                                         "%s: incompatible with authentication choice\n", prog );
 413                                 exit( EXIT_FAILURE );
 414                         }
 415                         authmethod = LDAP_AUTH_SASL;
 416                         sasl_mech = ber_strdup( optarg );
 417 #else
 418                         fprintf( stderr, "%s: not compiled with SASL support\n", prog );
 419                         exit( EXIT_FAILURE );
 420 #endif
 421                         break;
 422                 case 'x':
 423                         if( authmethod != -1 && authmethod != LDAP_AUTH_SIMPLE ) {
 424                                 fprintf( stderr, "%s: incompatible with previous "
 425                                         "authentication choice\n", prog );
 426                                 exit( EXIT_FAILURE );
 427                         }
 428                         authmethod = LDAP_AUTH_SIMPLE;
 429                         break;
 430                 case 'X':
 431 #ifdef HAVE_CYRUS_SASL
 432                         if( sasl_authz_id != NULL ) {
 433                                 fprintf( stderr, "%s: -X previously specified\n", prog );
 434                                 exit( EXIT_FAILURE );
 435                         }
 436                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 437                                 fprintf( stderr, "%s: -X incompatible with "
 438                                         "authentication choice\n", prog );
 439                                 exit( EXIT_FAILURE );
 440                         }
 441                         authmethod = LDAP_AUTH_SASL;
 442                         sasl_authz_id = ber_strdup( optarg );
 443 #else
 444                         fprintf( stderr, "%s: not compiled with SASL support\n", prog );
 445                         exit( EXIT_FAILURE );
 446 #endif
 447                         break;
 448                 case 'Z':
 449 #ifdef HAVE_TLS
 450                         use_tls++;
 451 #else
 452                         fprintf( stderr, "%s: not compiled with TLS support\n", prog );
 453                         exit( EXIT_FAILURE );
 454 #endif
 455                         break;
 456                 default:
 457                         if( handle_private_option( i ) ) break;
 458                         fprintf( stderr, "%s: unrecognized option -%c\n",
 459                                 prog, optopt );
 460                         usage();
 461                 }
 462         }
 463
 464         {
 465                 /* prevent bad linking */
 466                 LDAPAPIInfo api;
 467                 api.ldapai_info_version = LDAP_API_INFO_VERSION;
 468
 469                 if ( ldap_get_option(NULL, LDAP_OPT_API_INFO, &api)
 470                         != LDAP_OPT_SUCCESS )
 471                 {
 472                         fprintf( stderr, "%s: ldap_get_option(API_INFO) failed\n", prog );
 473                         exit( EXIT_FAILURE );
 474                 }
 475
 476                 if (api.ldapai_info_version != LDAP_API_INFO_VERSION) {
 477                         fprintf( stderr, "LDAP APIInfo version mismatch: "
 478                                 "got %d, expected %d\n",
 479                                 api.ldapai_info_version, LDAP_API_INFO_VERSION );
 480                         exit( EXIT_FAILURE );
 481                 }
 482
 483                 if( api.ldapai_api_version != LDAP_API_VERSION ) {
 484                         fprintf( stderr, "LDAP API version mismatch: "
 485                                 "got %d, expected %d\n",
 486                                 api.ldapai_api_version, LDAP_API_VERSION );
 487                         exit( EXIT_FAILURE );
 488                 }
 489
 490                 if( strcmp(api.ldapai_vendor_name, LDAP_VENDOR_NAME ) != 0 ) {
 491                         fprintf( stderr, "LDAP vendor name mismatch: "
 492                                 "got %s, expected %s\n",
 493                                 api.ldapai_vendor_name, LDAP_VENDOR_NAME );
 494                         exit( EXIT_FAILURE );
 495                 }
 496
 497                 if( api.ldapai_vendor_version != LDAP_VENDOR_VERSION ) {
 498                         fprintf( stderr, "LDAP vendor version mismatch: "
 499                                 "got %d, expected %d\n",
 500                                 api.ldapai_vendor_version, LDAP_VENDOR_VERSION );
 501                         exit( EXIT_FAILURE );
 502                 }
 503
 504                 if (version) {
 505                         fprintf( stderr, "%s: %s\t(LDAP library: %s %d)\n",
 506                                 prog, __Version,
 507                                 LDAP_VENDOR_NAME, LDAP_VENDOR_VERSION );
 508                         if (version > 1) exit( EXIT_SUCCESS );
 509                 }
 510         }
 511
 512         if (protocol == -1)
 513                 protocol = LDAP_VERSION3;
 514
 515         if (authmethod == -1 && protocol > LDAP_VERSION2) {
 516 #ifdef HAVE_CYRUS_SASL
 517                 authmethod = LDAP_AUTH_SASL;
 518 #else
 519                 authmethod = LDAP_AUTH_SIMPLE;
 520 #endif
 521         }
 522
 523         if( ldapuri != NULL ) {
 524                 if( ldaphost != NULL ) {
 525                         fprintf( stderr, "%s: -H incompatible with -h\n", prog );
 526                         exit( EXIT_FAILURE );
 527                 }
 528                 if( ldapport ) {
 529                         fprintf( stderr, "%s: -H incompatible with -p\n", prog );
 530                         exit( EXIT_FAILURE );
 531                 }
 532         }
 533         if( protocol == LDAP_VERSION2 ) {
 534                 if( authzid || manageDSAit || noop ) {
 535                         fprintf( stderr, "%s: -e/-M incompatible with LDAPv2\n", prog );
 536                         exit( EXIT_FAILURE );
 537                 }
 538 #ifdef HAVE_TLS
 539                 if( use_tls ) {
 540                         fprintf( stderr, "%s: -Z incompatible with LDAPv2\n", prog );
 541                         exit( EXIT_FAILURE );
 542                 }
 543 #endif
 544 #ifdef HAVE_CYRUS_SASL
 545                 if( authmethod == LDAP_AUTH_SASL ) {
 546                         fprintf( stderr, "%s: -[IOQRUXY] incompatible with LDAPv2\n",
 547                                 prog );
 548                         exit( EXIT_FAILURE );
 549                 }
 550 #endif
 551         } else {
 552 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 553                 if ( authmethod == LDAP_AUTH_KRBV4 || authmethod == LDAP_AUTH_KRBV41 ) {
 554                         fprintf( stderr, "%s: -k/-K incompatible with LDAPv%d\n",
 555                                 prog, protocol );
 556                         exit( EXIT_FAILURE );
 557                 }
 558 #endif
 559         }
 560 }
 561
 562
 563 LDAP *
 564 tool_conn_setup( int not, void (*private_setup)( LDAP * ) )
 565 {
 566         LDAP *ld = NULL;
 567
 568         if ( debug ) {
 569                 if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug )
 570                         != LBER_OPT_SUCCESS )
 571                 {
 572                         fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug );
 573                 }
 574                 if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug )
 575                         != LDAP_OPT_SUCCESS )
 576                 {
 577                         fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug );
 578                 }
 579         }
 580
 581 #ifdef SIGPIPE
 582         (void) SIGNAL( SIGPIPE, SIG_IGN );
 583 #endif
 584
 585         if ( !not ) {
 586                 /* connect to server */
 587                 if( ( ldaphost != NULL || ldapport ) && ( ldapuri == NULL ) ) {
 588                         if ( verbose ) {
 589                                 fprintf( stderr, "ldap_init( %s, %d )\n",
 590                                         ldaphost != NULL ? ldaphost : "<DEFAULT>",
 591                                         ldapport );
 592                         }
 593
 594                         ld = ldap_init( ldaphost, ldapport );
 595                         if( ld == NULL ) {
 596                                 char buf[20 + sizeof(": ldap_init")];
 597                                 sprintf( buf, "%.20s: ldap_init", prog );
 598                                 perror( buf );
 599                                 exit( EXIT_FAILURE );
 600                         }
 601
 602                 } else {
 603                         int rc;
 604                         if ( verbose ) {
 605                                 fprintf( stderr, "ldap_initialize( %s )\n",
 606                                         ldapuri != NULL ? ldapuri : "<DEFAULT>" );
 607                         }
 608                         rc = ldap_initialize( &ld, ldapuri );
 609                         if( rc != LDAP_SUCCESS ) {
 610                                 fprintf( stderr,
 611                                         "Could not create LDAP session handle (%d): %s\n",
 612                                         rc, ldap_err2string(rc) );
 613                                 exit( EXIT_FAILURE );
 614                         }
 615                 }
 616
 617                 if( private_setup ) private_setup( ld );
 618
 619                 /* referrals */
 620                 if( ldap_set_option( ld, LDAP_OPT_REFERRALS,
 621                         referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
 622                 {
 623                         fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
 624                                 referrals ? "on" : "off" );
 625                         exit( EXIT_FAILURE );
 626                 }
 627
 628                 if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &protocol )
 629                         != LDAP_OPT_SUCCESS )
 630                 {
 631                         fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
 632                                 protocol );
 633                         exit( EXIT_FAILURE );
 634                 }
 635
 636                 if ( use_tls &&
 637                         ( ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ))
 638                 {
 639                         ldap_perror( ld, "ldap_start_tls" );
 640                         if ( use_tls > 1 ) {
 641                                 exit( EXIT_FAILURE );
 642                         }
 643                 }
 644         }
 645
 646         return ld;
 647 }
 648
 649
 650 void
 651 tool_bind( LDAP *ld )
 652 {
 653         if ( authmethod == LDAP_AUTH_SASL ) {
 654 #ifdef HAVE_CYRUS_SASL
 655                 void *defaults;
 656                 int rc;
 657
 658                 if( sasl_secprops != NULL ) {
 659                         rc = ldap_set_option( ld, LDAP_OPT_X_SASL_SECPROPS,
 660                                 (void *) sasl_secprops );
 661
 662                         if( rc != LDAP_OPT_SUCCESS ) {
 663                                 fprintf( stderr,
 664                                         "Could not set LDAP_OPT_X_SASL_SECPROPS: %s\n",
 665                                         sasl_secprops );
 666                                 exit( EXIT_FAILURE );
 667                         }
 668                 }
 669
 670                 defaults = lutil_sasl_defaults( ld,
 671                         sasl_mech,
 672                         sasl_realm,
 673                         sasl_authc_id,
 674                         passwd.bv_val,
 675                         sasl_authz_id );
 676
 677                 rc = ldap_sasl_interactive_bind_s( ld, binddn,
 678                         sasl_mech, NULL, NULL,
 679                         sasl_flags, lutil_sasl_interact, defaults );
 680
 681                 lutil_sasl_freedefs( defaults );
 682                 if( rc != LDAP_SUCCESS ) {
 683                         ldap_perror( ld, "ldap_sasl_interactive_bind_s" );
 684                         exit( EXIT_FAILURE );
 685                 }
 686 #else
 687                 fprintf( stderr, "%s: not compiled with SASL support\n",
 688                         prog );
 689                 exit( EXIT_FAILURE );
 690 #endif
 691         } else {
 692                 if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 693                         != LDAP_SUCCESS )
 694                 {
 695                         ldap_perror( ld, "ldap_bind" );
 696                         exit( EXIT_FAILURE );
 697                 }
 698         }
 699 }
 700
 701
 702 /* Set server controls.  Add controls extra_c[0..count-1], if set. */
 703 void
 704 tool_server_controls( LDAP *ld, LDAPControl *extra_c, int count )
 705 {
 706         int i = 0, j, crit = 0, err;
 707         LDAPControl c[3], **ctrls;
 708
 709         ctrls = (LDAPControl**) malloc(sizeof(c) + (count+1)*sizeof(LDAPControl*));
 710         if ( ctrls == NULL ) {
 711                 fprintf( stderr, "No memory\n" );
 712                 exit( EXIT_FAILURE );
 713         }
 714
 715         if ( authzid ) {
 716                 c[i].ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
 717                 c[i].ldctl_value.bv_val = authzid;
 718                 c[i].ldctl_value.bv_len = strlen( authzid );
 719                 c[i].ldctl_iscritical = 1;
 720                 ctrls[i] = &c[i];
 721                 i++;
 722         }
 723
 724         if ( manageDSAit ) {
 725                 c[i].ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
 726                 c[i].ldctl_value.bv_val = NULL;
 727                 c[i].ldctl_value.bv_len = 0;
 728                 c[i].ldctl_iscritical = manageDSAit > 1;
 729                 ctrls[i] = &c[i];
 730                 i++;
 731         }
 732
 733         if ( noop ) {
 734                 c[i].ldctl_oid = LDAP_CONTROL_NOOP;
 735                 c[i].ldctl_value.bv_val = NULL;
 736                 c[i].ldctl_value.bv_len = 0;
 737                 c[i].ldctl_iscritical = noop > 1;
 738                 ctrls[i] = &c[i];
 739                 i++;
 740         }
 741
 742         while ( count-- ) {
 743                 ctrls[i++] = extra_c++;
 744         }
 745         ctrls[i] = NULL;
 746
 747         err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, ctrls );
 748
 749         if ( err != LDAP_OPT_SUCCESS ) {
 750                 for ( j = 0; j < i; j++ ) {
 751                         if ( ctrls[j]->ldctl_iscritical ) crit = 1;
 752                 }
 753                 fprintf( stderr, "Could not set %scontrols\n",
 754                         crit ? "critical " : "" );
 755         }
 756
 757         free( ctrls );
 758         if ( crit ) {
 759                 exit( EXIT_FAILURE );
 760         }
 761 }