git.sur5r.net Git - openldap/blob - clients/tools/ldapdelete.c

   1 /* ldapdelete.c - simple program to delete an entry using LDAP */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/stdlib.h>
  13 #include <ac/ctype.h>
  14
  15 #include <ac/signal.h>
  16 #include <ac/string.h>
  17 #include <ac/unistd.h>
  18
  19 #include <ldap.h>
  20 #include "lutil.h"
  21 #include "lutil_ldap.h"
  22 #include "ldap_defaults.h"
  23
  24 static char     *prog;
  25 static char     *binddn = NULL;
  26 static struct berval passwd = { 0, NULL };
  27 static char *ldapuri = NULL;
  28 static char     *ldaphost = NULL;
  29 static int      ldapport = 0;
  30 static int      prune = 0;
  31 #ifdef HAVE_CYRUS_SASL
  32 static unsigned sasl_flags = LDAP_SASL_AUTOMATIC;
  33 static char     *sasl_mech = NULL;
  34 static char *sasl_realm = NULL;
  35 static char     *sasl_authc_id = NULL;
  36 static char     *sasl_authz_id = NULL;
  37 static char     *sasl_secprops = NULL;
  38 #endif
  39 static int      use_tls = 0;
  40 static int      not, verbose, contoper;
  41 static LDAP     *ld = NULL;
  42
  43 static int dodelete LDAP_P((
  44     LDAP *ld,
  45     const char *dn));
  46
  47 static int deletechildren LDAP_P((
  48         LDAP *ld,
  49         const char *dn ));
  50
  51 static void
  52 usage( const char *s )
  53 {
  54         fprintf( stderr,
  55 "Delete entries from an LDAP server\n\n"
  56 "usage: %s [options] [dn]...\n"
  57 "       dn: list of DNs to delete. If not given, it will be readed from stdin\n"
  58 "           or from the file specified with \"-f file\".\n"
  59 "Delete Options:\n"
  60 "  -r         delete recursively\n"
  61
  62 "Common options:\n"
  63 "  -d level   set LDAP debugging level to `level'\n"
  64 "  -D binddn  bind DN\n"
  65 "  -e [!]<ctrl>[=<ctrlparam>] general controls (! indicates criticality)\n"
  66 "             [!]manageDSAit   (alternate form, see -M)\n"
  67 #ifdef LDAP_CONTROL_NOOP
  68 "             [!]noop\n"
  69 #endif
  70 "  -f file    read operations from `file'\n"
  71 "  -h host    LDAP server\n"
  72 "  -H URI     LDAP Uniform Resource Indentifier(s)\n"
  73 "  -I         use SASL Interactive mode\n"
  74 "  -k         use Kerberos authentication\n"
  75 "  -K         like -k, but do only step 1 of the Kerberos bind\n"
  76 "  -M         enable Manage DSA IT control (-MM to make critical)\n"
  77 "  -n         show what would be done but don't actually do it\n"
  78 "  -O props   SASL security properties\n"
  79 "  -p port    port on LDAP server\n"
  80 "  -P version procotol version (default: 3)\n"
  81 "  -Q         use SASL Quiet mode\n"
  82 "  -R realm   SASL realm\n"
  83 "  -U authcid SASL authentication identity\n"
  84 "  -v         run in verbose mode (diagnostics to standard output)\n"
  85 "  -w passwd  bind passwd (for simple authentication)\n"
  86 "  -W         prompt for bind passwd\n"
  87 "  -x         Simple authentication\n"
  88 "  -X authzid SASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
  89 "  -y file    Read passwd from file\n"
  90 "  -Y mech    SASL mechanism\n"
  91 "  -Z         Start TLS request (-ZZ to require successful response)\n"
  92 ,               s );
  93
  94         exit( EXIT_FAILURE );
  95 }
  96
  97
  98 int
  99 main( int argc, char **argv )
 100 {
 101         char            buf[ 4096 ];
 102         FILE            *fp;
 103         int             i, rc, authmethod, referrals, want_bindpw, version, debug, manageDSAit, crit;
 104         char    *pw_file;
 105         char    *control, *cvalue;
 106 #ifdef LDAP_CONTROL_NOOP
 107         int noop=0;
 108 #endif
 109
 110     not = verbose = contoper = want_bindpw = debug
 111                 = manageDSAit = referrals = 0;
 112     fp = NULL;
 113     authmethod = -1;
 114         version = -1;
 115         pw_file = NULL;
 116
 117     prog = lutil_progname( "ldapdelete", argc, argv );
 118
 119     while (( i = getopt( argc, argv, "cf:r"
 120                 "Cd:D:e:h:H:IkKMnO:p:P:QR:U:vw:WxX:y:Y:Z" )) != EOF )
 121         {
 122         switch( i ) {
 123         /* Delete Specific Options */
 124         case 'c':       /* continuous operation mode */
 125             ++contoper;
 126             break;
 127         case 'E': /* delete controls */
 128                 if( version == LDAP_VERSION2 ) {
 129                         fprintf( stderr, "%s: -E incompatible with LDAPv%d\n",
 130                                 prog, version );
 131                         return EXIT_FAILURE;
 132                 }
 133
 134                 /* should be extended to support comma separated list of
 135                  *      [!]key[=value] parameters, e.g.  -E !foo,bar=567
 136                  */
 137
 138                 crit = 0;
 139                 cvalue = NULL;
 140                 if( optarg[0] == '!' ) {
 141                         crit = 1;
 142                         optarg++;
 143                 }
 144
 145                 control = strdup( optarg );
 146                 if ( (cvalue = strchr( control, '=' )) != NULL ) {
 147                         *cvalue++ = '\0';
 148                 }
 149                 fprintf( stderr, "Invalid delete control name: %s\n", control );
 150                 usage(prog);
 151                 return EXIT_FAILURE;
 152         case 'f':       /* read DNs from a file */
 153                 if( fp != NULL ) {
 154                         fprintf( stderr, "%s: -f previously specified\n", prog );
 155                         return EXIT_FAILURE;
 156                 }
 157             if (( fp = fopen( optarg, "r" )) == NULL ) {
 158                 perror( optarg );
 159                 exit( EXIT_FAILURE );
 160             }
 161             break;
 162         case 'r':
 163                 prune = 1;
 164                 break;
 165
 166         /* Common Options */
 167         case 'C':
 168                 referrals++;
 169                 break;
 170         case 'd':
 171             debug |= atoi( optarg );
 172             break;
 173         case 'D':       /* bind DN */
 174                 if( binddn != NULL ) {
 175                         fprintf( stderr, "%s: -D previously specified\n", prog );
 176                         return EXIT_FAILURE;
 177                 }
 178             binddn = strdup( optarg );
 179             break;
 180         case 'e': /* general controls */
 181                 if( version == LDAP_VERSION2 ) {
 182                         fprintf( stderr, "%s: -e incompatible with LDAPv%d\n",
 183                                 prog, version );
 184                         return EXIT_FAILURE;
 185                 }
 186
 187                 /* should be extended to support comma separated list of
 188                  *      [!]key[=value] parameters, e.g.  -e !foo,bar=567
 189                  */
 190
 191                 crit = 0;
 192                 cvalue = NULL;
 193                 if( optarg[0] == '!' ) {
 194                         crit = 1;
 195                         optarg++;
 196                 }
 197
 198                 control = strdup( optarg );
 199                 if ( (cvalue = strchr( control, '=' )) != NULL ) {
 200                         *cvalue++ = '\0';
 201                 }
 202
 203                 if ( strcasecmp( control, "manageDSAit" ) == 0 ) {
 204                         if( cvalue != NULL ) {
 205                                 fprintf( stderr, "manageDSAit: no control value expected" );
 206                                 usage(prog);
 207                                 return EXIT_FAILURE;
 208                         }
 209
 210                         manageDSAit = 1 + crit;
 211                         free( control );
 212                         break;
 213
 214 #ifdef LDAP_CONTROL_NOOP
 215                 } else if ( strcasecmp( control, "noop" ) == 0 ) {
 216                         if( cvalue != NULL ) {
 217                                 fprintf( stderr, "noop: no control value expected" );
 218                                 usage(prog);
 219                                 return EXIT_FAILURE;
 220                         }
 221
 222                         noop = 1 + crit;
 223                         free( control );
 224                         break;
 225 #endif
 226
 227                 } else {
 228                         fprintf( stderr, "Invalid general control name: %s\n", control );
 229                         usage(prog);
 230                         return EXIT_FAILURE;
 231                 }
 232         case 'h':       /* ldap host */
 233                 if( ldapuri != NULL ) {
 234                         fprintf( stderr, "%s: -h incompatible with -H\n", prog );
 235                         return EXIT_FAILURE;
 236                 }
 237                 if( ldaphost != NULL ) {
 238                         fprintf( stderr, "%s: -h previously specified\n", prog );
 239                         return EXIT_FAILURE;
 240                 }
 241             ldaphost = strdup( optarg );
 242             break;
 243         case 'H':       /* ldap URI */
 244                 if( ldaphost != NULL ) {
 245                         fprintf( stderr, "%s: -H incompatible with -h\n", prog );
 246                         return EXIT_FAILURE;
 247                 }
 248                 if( ldapport ) {
 249                         fprintf( stderr, "%s: -H incompatible with -p\n", prog );
 250                         return EXIT_FAILURE;
 251                 }
 252                 if( ldapuri != NULL ) {
 253                         fprintf( stderr, "%s: -H previously specified\n", prog );
 254                         return EXIT_FAILURE;
 255                 }
 256             ldapuri = strdup( optarg );
 257             break;
 258         case 'I':
 259 #ifdef HAVE_CYRUS_SASL
 260                 if( version == LDAP_VERSION2 ) {
 261                         fprintf( stderr, "%s: -I incompatible with version %d\n",
 262                                 prog, version );
 263                         return EXIT_FAILURE;
 264                 }
 265                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 266                         fprintf( stderr, "%s: incompatible previous "
 267                                 "authentication choice\n",
 268                                 prog );
 269                         return EXIT_FAILURE;
 270                 }
 271                 authmethod = LDAP_AUTH_SASL;
 272                 version = LDAP_VERSION3;
 273                 sasl_flags = LDAP_SASL_INTERACTIVE;
 274                 break;
 275 #else
 276                 fprintf( stderr, "%s: was not compiled with SASL support\n",
 277                         prog );
 278                 return( EXIT_FAILURE );
 279 #endif
 280         case 'k':       /* kerberos bind */
 281 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 282                 if( version > LDAP_VERSION2 ) {
 283                         fprintf( stderr, "%s: -k incompatible with LDAPv%d\n",
 284                                 prog, version );
 285                         return EXIT_FAILURE;
 286                 }
 287
 288                 if( authmethod != -1 ) {
 289                         fprintf( stderr, "%s: -k incompatible with previous "
 290                                 "authentication choice\n", prog );
 291                         return EXIT_FAILURE;
 292                 }
 293
 294                 authmethod = LDAP_AUTH_KRBV4;
 295 #else
 296                 fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 297                 return EXIT_FAILURE;
 298 #endif
 299             break;
 300         case 'K':       /* kerberos bind, part one only */
 301 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 302                 if( version > LDAP_VERSION2 ) {
 303                         fprintf( stderr, "%s: -k incompatible with LDAPv%d\n",
 304                                 prog, version );
 305                         return EXIT_FAILURE;
 306                 }
 307                 if( authmethod != -1 ) {
 308                         fprintf( stderr, "%s: incompatible with previous "
 309                                 "authentication choice\n", prog );
 310                         return EXIT_FAILURE;
 311                 }
 312
 313                 authmethod = LDAP_AUTH_KRBV41;
 314 #else
 315                 fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 316                 return( EXIT_FAILURE );
 317 #endif
 318             break;
 319         case 'M':
 320                 /* enable Manage DSA IT */
 321                 if( version == LDAP_VERSION2 ) {
 322                         fprintf( stderr, "%s: -M incompatible with LDAPv%d\n",
 323                                 prog, version );
 324                         return EXIT_FAILURE;
 325                 }
 326                 manageDSAit++;
 327                 version = LDAP_VERSION3;
 328                 break;
 329         case 'n':       /* print deletes, don't actually do them */
 330             ++not;
 331             break;
 332         case 'O':
 333 #ifdef HAVE_CYRUS_SASL
 334                 if( sasl_secprops != NULL ) {
 335                         fprintf( stderr, "%s: -O previously specified\n", prog );
 336                         return EXIT_FAILURE;
 337                 }
 338                 if( version == LDAP_VERSION2 ) {
 339                         fprintf( stderr, "%s: -O incompatible with LDAPv%d\n",
 340                                 prog, version );
 341                         return EXIT_FAILURE;
 342                 }
 343                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 344                         fprintf( stderr, "%s: incompatible previous "
 345                                 "authentication choice\n", prog );
 346                         return EXIT_FAILURE;
 347                 }
 348                 authmethod = LDAP_AUTH_SASL;
 349                 version = LDAP_VERSION3;
 350                 sasl_secprops = strdup( optarg );
 351 #else
 352                 fprintf( stderr, "%s: not compiled with SASL support\n",
 353                         prog );
 354                 return( EXIT_FAILURE );
 355 #endif
 356                 break;
 357         case 'p':
 358                 if( ldapport ) {
 359                         fprintf( stderr, "%s: -p previously specified\n", prog );
 360                         return EXIT_FAILURE;
 361                 }
 362             ldapport = atoi( optarg );
 363             break;
 364         case 'P':
 365                 switch( atoi(optarg) ) {
 366                 case 2:
 367                         if( version == LDAP_VERSION3 ) {
 368                                 fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 369                                         prog, version );
 370                                 return EXIT_FAILURE;
 371                         }
 372                         version = LDAP_VERSION2;
 373                         break;
 374                 case 3:
 375                         if( version == LDAP_VERSION2 ) {
 376                                 fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 377                                         prog, version );
 378                                 return EXIT_FAILURE;
 379                         }
 380                         version = LDAP_VERSION3;
 381                         break;
 382                 default:
 383                         fprintf( stderr, "%s: protocol version should be 2 or 3\n",
 384                                 prog );
 385                         usage( prog );
 386                         return( EXIT_FAILURE );
 387                 } break;
 388         case 'Q':
 389 #ifdef HAVE_CYRUS_SASL
 390                 if( version == LDAP_VERSION2 ) {
 391                         fprintf( stderr, "%s: -Q incompatible with version %d\n",
 392                                 prog, version );
 393                         return EXIT_FAILURE;
 394                 }
 395                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 396                         fprintf( stderr, "%s: incompatible previous "
 397                                 "authentication choice\n",
 398                                 prog );
 399                         return EXIT_FAILURE;
 400                 }
 401                 authmethod = LDAP_AUTH_SASL;
 402                 version = LDAP_VERSION3;
 403                 sasl_flags = LDAP_SASL_QUIET;
 404                 break;
 405 #else
 406                 fprintf( stderr, "%s: not compiled with SASL support\n",
 407                         prog );
 408                 return( EXIT_FAILURE );
 409 #endif
 410         case 'R':
 411 #ifdef HAVE_CYRUS_SASL
 412                 if( sasl_realm != NULL ) {
 413                         fprintf( stderr, "%s: -R previously specified\n", prog );
 414                         return EXIT_FAILURE;
 415                 }
 416                 if( version == LDAP_VERSION2 ) {
 417                         fprintf( stderr, "%s: -R incompatible with version %d\n",
 418                                 prog, version );
 419                         return EXIT_FAILURE;
 420                 }
 421                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 422                         fprintf( stderr, "%s: incompatible previous "
 423                                 "authentication choice\n",
 424                                 prog );
 425                         return EXIT_FAILURE;
 426                 }
 427                 authmethod = LDAP_AUTH_SASL;
 428                 version = LDAP_VERSION3;
 429                 sasl_realm = strdup( optarg );
 430 #else
 431                 fprintf( stderr, "%s: not compiled with SASL support\n",
 432                         prog );
 433                 return( EXIT_FAILURE );
 434 #endif
 435                 break;
 436         case 'U':
 437 #ifdef HAVE_CYRUS_SASL
 438                 if( sasl_authc_id != NULL ) {
 439                         fprintf( stderr, "%s: -U previously specified\n", prog );
 440                         return EXIT_FAILURE;
 441                 }
 442                 if( version == LDAP_VERSION2 ) {
 443                         fprintf( stderr, "%s: -U incompatible with version %d\n",
 444                                 prog, version );
 445                         return EXIT_FAILURE;
 446                 }
 447                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 448                         fprintf( stderr, "%s: incompatible previous "
 449                                 "authentication choice\n",
 450                                 prog );
 451                         return EXIT_FAILURE;
 452                 }
 453                 authmethod = LDAP_AUTH_SASL;
 454                 version = LDAP_VERSION3;
 455                 sasl_authc_id = strdup( optarg );
 456 #else
 457                 fprintf( stderr, "%s: not compiled with SASL support\n",
 458                         prog );
 459                 return( EXIT_FAILURE );
 460 #endif
 461                 break;
 462         case 'v':       /* verbose mode */
 463             verbose++;
 464             break;
 465         case 'w':       /* password */
 466             passwd.bv_val = strdup( optarg );
 467                 {
 468                         char* p;
 469
 470                         for( p = optarg; *p != '\0'; p++ ) {
 471                                 *p = '\0';
 472                         }
 473                 }
 474                 passwd.bv_len = strlen( passwd.bv_val );
 475             break;
 476         case 'W':
 477                 want_bindpw++;
 478                 break;
 479         case 'y':
 480                 pw_file = optarg;
 481                 break;
 482         case 'Y':
 483 #ifdef HAVE_CYRUS_SASL
 484                 if( sasl_mech != NULL ) {
 485                         fprintf( stderr, "%s: -Y previously specified\n", prog );
 486                         return EXIT_FAILURE;
 487                 }
 488                 if( version == LDAP_VERSION2 ) {
 489                         fprintf( stderr, "%s: -Y incompatible with version %d\n",
 490                                 prog, version );
 491                         return EXIT_FAILURE;
 492                 }
 493                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 494                         fprintf( stderr, "%s: incompatible with authentication choice\n", prog );
 495                         return EXIT_FAILURE;
 496                 }
 497                 authmethod = LDAP_AUTH_SASL;
 498                 version = LDAP_VERSION3;
 499                 sasl_mech = strdup( optarg );
 500 #else
 501                 fprintf( stderr, "%s: not compiled with SASL support\n",
 502                         prog );
 503                 return( EXIT_FAILURE );
 504 #endif
 505                 break;
 506         case 'x':
 507                 if( authmethod != -1 && authmethod != LDAP_AUTH_SIMPLE ) {
 508                         fprintf( stderr, "%s: incompatible with previous "
 509                                 "authentication choice\n", prog );
 510                         return EXIT_FAILURE;
 511                 }
 512                 authmethod = LDAP_AUTH_SIMPLE;
 513                 break;
 514         case 'X':
 515 #ifdef HAVE_CYRUS_SASL
 516                 if( sasl_authz_id != NULL ) {
 517                         fprintf( stderr, "%s: -X previously specified\n", prog );
 518                         return EXIT_FAILURE;
 519                 }
 520                 if( version == LDAP_VERSION2 ) {
 521                         fprintf( stderr, "%s: -X incompatible with LDAPv%d\n",
 522                                 prog, version );
 523                         return EXIT_FAILURE;
 524                 }
 525                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 526                         fprintf( stderr, "%s: -X incompatible with "
 527                                 "authentication choice\n", prog );
 528                         return EXIT_FAILURE;
 529                 }
 530                 authmethod = LDAP_AUTH_SASL;
 531                 version = LDAP_VERSION3;
 532                 sasl_authz_id = strdup( optarg );
 533 #else
 534                 fprintf( stderr, "%s: not compiled with SASL support\n",
 535                         prog );
 536                 return( EXIT_FAILURE );
 537 #endif
 538                 break;
 539         case 'Z':
 540 #ifdef HAVE_TLS
 541                 if( version == LDAP_VERSION2 ) {
 542                         fprintf( stderr, "%s: -Z incompatible with version %d\n",
 543                                 prog, version );
 544                         return EXIT_FAILURE;
 545                 }
 546                 version = LDAP_VERSION3;
 547                 use_tls++;
 548 #else
 549                 fprintf( stderr, "%s: not compiled with TLS support\n",
 550                         prog );
 551                 return( EXIT_FAILURE );
 552 #endif
 553                 break;
 554         default:
 555                 fprintf( stderr, "%s: unrecognized option -%c\n",
 556                         prog, optopt );
 557                 usage( prog );
 558                 return( EXIT_FAILURE );
 559         }
 560     }
 561
 562         if (version == -1) {
 563                 version = LDAP_VERSION3;
 564         }
 565         if (authmethod == -1 && version > LDAP_VERSION2) {
 566 #ifdef HAVE_CYRUS_SASL
 567                 authmethod = LDAP_AUTH_SASL;
 568 #else
 569                 authmethod = LDAP_AUTH_SIMPLE;
 570 #endif
 571         }
 572
 573     if ( fp == NULL ) {
 574         if ( optind >= argc ) {
 575             fp = stdin;
 576         }
 577     }
 578
 579         if ( debug ) {
 580                 if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) {
 581                         fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug );
 582                 }
 583                 if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug ) != LDAP_OPT_SUCCESS ) {
 584                         fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug );
 585                 }
 586         }
 587
 588 #ifdef SIGPIPE
 589         (void) SIGNAL( SIGPIPE, SIG_IGN );
 590 #endif
 591
 592         if( ( ldaphost != NULL || ldapport ) && ( ldapuri == NULL ) ) {
 593                 if ( verbose ) {
 594                         fprintf( stderr, "ldap_init( %s, %d )\n",
 595                                 ldaphost != NULL ? ldaphost : "<DEFAULT>",
 596                                 ldapport );
 597                 }
 598
 599                 ld = ldap_init( ldaphost, ldapport );
 600                 if( ld == NULL ) {
 601                         perror("ldapdelete: ldap_init");
 602                         return EXIT_FAILURE;
 603                 }
 604
 605         } else {
 606                 if ( verbose ) {
 607                         fprintf( stderr, "ldap_initialize( %s )\n",
 608                                 ldapuri != NULL ? ldapuri : "<DEFAULT>" );
 609                 }
 610
 611                 rc = ldap_initialize( &ld, ldapuri );
 612                 if( rc != LDAP_SUCCESS ) {
 613                         fprintf( stderr, "Could not create LDAP session handle (%d): %s\n",
 614                                 rc, ldap_err2string(rc) );
 615                         return EXIT_FAILURE;
 616                 }
 617         }
 618
 619         {
 620                 /* this seems prudent for searches below */
 621                 int deref = LDAP_DEREF_NEVER;
 622                 ldap_set_option( ld, LDAP_OPT_DEREF, &deref );
 623         }
 624
 625         /* chase referrals */
 626         if( ldap_set_option( ld, LDAP_OPT_REFERRALS,
 627                 referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
 628         {
 629                 fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
 630                         referrals ? "on" : "off" );
 631                 return EXIT_FAILURE;
 632         }
 633
 634         if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version )
 635                 != LDAP_OPT_SUCCESS )
 636         {
 637                 fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
 638                         version );
 639                 return EXIT_FAILURE;
 640         }
 641
 642         if ( use_tls && ( ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS )) {
 643                 ldap_perror( ld, "ldap_start_tls" );
 644                 if ( use_tls > 1 ) {
 645                         return EXIT_FAILURE;
 646                 }
 647         }
 648
 649         if ( pw_file || want_bindpw ) {
 650                 if ( pw_file ) {
 651                         rc = lutil_get_filed_password( pw_file, &passwd );
 652                         if( rc ) return EXIT_FAILURE;
 653                 } else {
 654                         passwd.bv_val = getpassphrase( "Enter LDAP Password: " );
 655                         passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 656                 }
 657         }
 658
 659         if ( authmethod == LDAP_AUTH_SASL ) {
 660 #ifdef HAVE_CYRUS_SASL
 661                 void *defaults;
 662
 663                 if( sasl_secprops != NULL ) {
 664                         rc = ldap_set_option( ld, LDAP_OPT_X_SASL_SECPROPS,
 665                                 (void *) sasl_secprops );
 666
 667                         if( rc != LDAP_OPT_SUCCESS ) {
 668                                 fprintf( stderr,
 669                                         "Could not set LDAP_OPT_X_SASL_SECPROPS: %s\n",
 670                                         sasl_secprops );
 671                                 return( EXIT_FAILURE );
 672                         }
 673                 }
 674
 675                 defaults = lutil_sasl_defaults( ld,
 676                         sasl_mech,
 677                         sasl_realm,
 678                         sasl_authc_id,
 679                         passwd.bv_val,
 680                         sasl_authz_id );
 681
 682                 rc = ldap_sasl_interactive_bind_s( ld, binddn,
 683                         sasl_mech, NULL, NULL,
 684                         sasl_flags, lutil_sasl_interact, defaults );
 685
 686                 if( rc != LDAP_SUCCESS ) {
 687                         ldap_perror( ld, "ldap_sasl_interactive_bind_s" );
 688                         return( EXIT_FAILURE );
 689                 }
 690 #else
 691                 fprintf( stderr, "%s: not compiled with SASL support\n",
 692                         prog );
 693                 return( EXIT_FAILURE );
 694 #endif
 695         }
 696         else {
 697                 if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 698                                 != LDAP_SUCCESS ) {
 699                         ldap_perror( ld, "ldap_bind" );
 700                         return( EXIT_FAILURE );
 701                 }
 702         }
 703
 704         if ( manageDSAit
 705 #ifdef LDAP_CONTROL_NOOP
 706                 || noop
 707 #endif
 708         ) {
 709                 int err, i = 0;
 710                 LDAPControl c1, c2;
 711                 LDAPControl *ctrls[3];
 712
 713                 if ( manageDSAit ) {
 714                         ctrls[i++] = &c1;
 715                         ctrls[i] = NULL;
 716                         c1.ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
 717                         c1.ldctl_value.bv_val = NULL;
 718                         c1.ldctl_value.bv_len = 0;
 719                         c1.ldctl_iscritical = manageDSAit > 1;
 720                 }
 721
 722 #ifdef LDAP_CONTROL_NOOP
 723                 if ( noop ) {
 724                         ctrls[i++] = &c2;
 725                         ctrls[i] = NULL;
 726
 727                         c2.ldctl_oid = LDAP_CONTROL_NOOP;
 728                         c2.ldctl_value.bv_val = NULL;
 729                         c2.ldctl_value.bv_len = 0;
 730                         c2.ldctl_iscritical = noop > 1;
 731                 }
 732 #endif
 733
 734                 err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, ctrls );
 735
 736                 if( err != LDAP_OPT_SUCCESS ) {
 737                         fprintf( stderr, "Could not set %scontrols\n",
 738                                 (c1.ldctl_iscritical || c2.ldctl_iscritical)
 739                                 ? "critical " : "" );
 740                         if ( c1.ldctl_iscritical && c2.ldctl_iscritical ) {
 741                                 return EXIT_FAILURE;
 742                         }
 743                 }
 744         }
 745
 746         rc = 0;
 747
 748     if ( fp == NULL ) {
 749                 for ( ; optind < argc; ++optind ) {
 750                         rc = dodelete( ld, argv[ optind ] );
 751
 752                         /* Stop on error and no -c option */
 753                         if( rc != 0 && contoper == 0) break;
 754                 }
 755         } else {
 756                 while ((rc == 0 || contoper) && fgets(buf, sizeof(buf), fp) != NULL) {
 757                         buf[ strlen( buf ) - 1 ] = '\0'; /* remove trailing newline */
 758
 759                         if ( *buf != '\0' ) {
 760                                 rc = dodelete( ld, buf );
 761                         }
 762                 }
 763         }
 764
 765     ldap_unbind( ld );
 766
 767         return( rc );
 768 }
 769
 770
 771 static int dodelete(
 772     LDAP        *ld,
 773     const char  *dn)
 774 {
 775         int id;
 776         int     rc, code;
 777         char *matcheddn = NULL, *text = NULL, **refs = NULL;
 778         LDAPMessage *res;
 779
 780         if ( verbose ) {
 781                 printf( "%sdeleting entry \"%s\"\n",
 782                         (not ? "!" : ""), dn );
 783         }
 784
 785         if ( not ) {
 786                 return LDAP_SUCCESS;
 787         }
 788
 789         /* If prune is on, remove a whole subtree.  Delete the children of the
 790          * DN recursively, then the DN requested.
 791          */
 792         if ( prune ) deletechildren( ld, dn );
 793
 794         rc = ldap_delete_ext( ld, dn, NULL, NULL, &id );
 795         if ( rc != LDAP_SUCCESS ) {
 796                 fprintf( stderr, "%s: ldap_delete_ext: %s (%d)\n",
 797                         prog, ldap_err2string( rc ), rc );
 798                 return rc;
 799         }
 800
 801         rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
 802         if ( rc < 0 ) {
 803                 ldap_perror( ld, "ldapdelete: ldap_result" );
 804                 return rc;
 805         }
 806
 807         rc = ldap_parse_result( ld, res, &code, &matcheddn, &text, &refs, NULL, 1 );
 808
 809         if( rc != LDAP_SUCCESS ) {
 810                 fprintf( stderr, "%s: ldap_parse_result: %s (%d)\n",
 811                         prog, ldap_err2string( rc ), rc );
 812                 return rc;
 813         }
 814
 815         if( verbose || code != LDAP_SUCCESS ||
 816                 (matcheddn && *matcheddn) || (text && *text) || (refs && *refs) )
 817         {
 818                 printf( "Delete Result: %s (%d)\n", ldap_err2string( code ), code );
 819
 820                 if( text && *text ) {
 821                         printf( "Additional info: %s\n", text );
 822                 }
 823
 824                 if( matcheddn && *matcheddn ) {
 825                         printf( "Matched DN: %s\n", matcheddn );
 826                 }
 827
 828                 if( refs ) {
 829                         int i;
 830                         for( i=0; refs[i]; i++ ) {
 831                                 printf("Referral: %s\n", refs[i] );
 832                         }
 833                 }
 834         }
 835
 836         ber_memfree( text );
 837         ber_memfree( matcheddn );
 838         ber_memvfree( (void **) refs );
 839
 840         return code;
 841 }
 842
 843 /*
 844  * Delete all the children of an entry recursively until leaf nodes are reached.
 845  *
 846  */
 847 static int deletechildren(
 848         LDAP *ld,
 849         const char *dn )
 850 {
 851         LDAPMessage *res, *e;
 852         int entries;
 853         int rc;
 854         static char *attrs[] = { "1.1", NULL };
 855
 856         if ( verbose ) printf ( "deleting children of: %s\n", dn );
 857         /*
 858          * Do a one level search at dn for children.  For each, delete its children.
 859          */
 860
 861         rc = ldap_search_ext_s( ld, dn, LDAP_SCOPE_ONELEVEL, NULL, attrs, 1,
 862                 NULL, NULL, NULL, -1, &res );
 863         if ( rc != LDAP_SUCCESS ) {
 864                 ldap_perror( ld, "ldap_search" );
 865                 return( rc );
 866         }
 867
 868         entries = ldap_count_entries( ld, res );
 869
 870         if ( entries > 0 ) {
 871                 int i;
 872
 873                 for (e = ldap_first_entry( ld, res ), i = 0; e != NULL;
 874                         e = ldap_next_entry( ld, e ), i++ )
 875                 {
 876                         char *dn = ldap_get_dn( ld, e );
 877
 878                         if( dn == NULL ) {
 879                                 ldap_perror( ld, "ldap_prune" );
 880                                 ldap_get_option( ld, LDAP_OPT_ERROR_NUMBER, &rc );
 881                                 ber_memfree( dn );
 882                                 return rc;
 883                         }
 884
 885                         rc = deletechildren( ld, dn );
 886                         if ( rc == -1 ) {
 887                                 ldap_perror( ld, "ldap_prune" );
 888                                 ber_memfree( dn );
 889                                 return rc;
 890                         }
 891
 892                         if ( verbose ) {
 893                                 printf( "\tremoving %s\n", dn );
 894                         }
 895
 896                         rc = ldap_delete_s( ld, dn );
 897                         if ( rc == -1 ) {
 898                                 ldap_perror( ld, "ldap_delete" );
 899                                 ber_memfree( dn );
 900                                 return rc;
 901
 902                         }
 903
 904                         if ( verbose ) {
 905                                 printf( "\t%s removed\n", dn );
 906                         }
 907
 908                         ber_memfree( dn );
 909                 }
 910         }
 911
 912         ldap_msgfree( res );
 913         return rc;
 914 }