git.sur5r.net Git - openldap/blob - clients/tools/ldapdelete.c

   1 /* ldapdelete.c - simple program to delete an entry using LDAP */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/stdlib.h>
  13 #include <ac/ctype.h>
  14
  15 #include <ac/signal.h>
  16 #include <ac/string.h>
  17 #include <ac/unistd.h>
  18
  19 #include <ldap.h>
  20 #include "lutil_ldap.h"
  21 #include "ldap_defaults.h"
  22
  23 static char     *prog;
  24 static char     *binddn = NULL;
  25 static struct berval passwd = { 0, NULL };
  26 static char     *ldaphost = NULL;
  27 static int      ldapport = 0;
  28 static int      prune = 0;
  29 #ifdef HAVE_CYRUS_SASL
  30 static unsigned sasl_flags = LDAP_SASL_AUTOMATIC;
  31 static char     *sasl_mech = NULL;
  32 static char *sasl_realm = NULL;
  33 static char     *sasl_authc_id = NULL;
  34 static char     *sasl_authz_id = NULL;
  35 static char     *sasl_secprops = NULL;
  36 #endif
  37 static int      use_tls = 0;
  38 static int      not, verbose, contoper;
  39 static LDAP     *ld;
  40
  41 static int dodelete LDAP_P((
  42     LDAP *ld,
  43     const char *dn));
  44
  45 static int deletechildren LDAP_P((
  46         LDAP *ld,
  47         const char *dn ));
  48
  49 static void
  50 usage( const char *s )
  51 {
  52         fprintf( stderr,
  53 "Delete entries from an LDAP server\n\n"
  54 "usage: %s [options] [dn]...\n"
  55 "       dn: list of DNs to delete. If not given, it will be readed from stdin\n"
  56 "           or from the file specified with \"-f file\".\n"
  57 "Delete Options:\n"
  58 "  -r         delete recursively\n"
  59
  60 "Common options:\n"
  61 "  -d level   set LDAP debugging level to `level'\n"
  62 "  -D binddn  bind DN\n"
  63 "  -f file    read operations from `file'\n"
  64 "  -h host    LDAP server\n"
  65 "  -I         use SASL Interactive mode\n"
  66 "  -k         use Kerberos authentication\n"
  67 "  -K         like -k, but do only step 1 of the Kerberos bind\n"
  68 "  -M         enable Manage DSA IT control (-MM to make critical)\n"
  69 "  -n         show what would be done but don't actually search\n"
  70 "  -O props   SASL security properties\n"
  71 "  -p port    port on LDAP server\n"
  72 "  -P version procotol version (default: 3)\n"
  73 "  -Q         use SASL Quiet mode\n"
  74 "  -R realm   SASL realm\n"
  75 "  -U user    SASL authentication identity (username)\n"
  76 "  -v         run in verbose mode (diagnostics to standard output)\n"
  77 "  -w passwd  bind passwd (for simple authentication)\n"
  78 "  -W         prompt for bind passwd\n"
  79 "  -x         Simple authentication\n"
  80 "  -X id      SASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
  81 "  -Y mech    SASL mechanism\n"
  82 "  -Z         Start TLS request (-ZZ to require successful response)\n"
  83 ,               s );
  84
  85         exit( EXIT_FAILURE );
  86 }
  87
  88
  89 int
  90 main( int argc, char **argv )
  91 {
  92         char            buf[ 4096 ];
  93         FILE            *fp;
  94         int             i, rc, authmethod, referrals, want_bindpw, version, debug, manageDSAit;
  95
  96     not = verbose = contoper = want_bindpw = debug = manageDSAit = referrals = 0;
  97     fp = NULL;
  98     authmethod = -1;
  99         version = -1;
 100
 101     prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1;
 102
 103     while (( i = getopt( argc, argv, "cf:r" "Cd:D:h:IkKMnO:p:P:QRU:vw:WxX:Y:Z" )) != EOF ) {
 104         switch( i ) {
 105         /* Delete Specific Options */
 106         case 'c':       /* continuous operation mode */
 107             ++contoper;
 108             break;
 109         case 'f':       /* read DNs from a file */
 110                 if( fp != NULL ) {
 111                         fprintf( stderr, "%s: -f previously specified\n" );
 112                         return EXIT_FAILURE;
 113                 }
 114             if (( fp = fopen( optarg, "r" )) == NULL ) {
 115                 perror( optarg );
 116                 exit( EXIT_FAILURE );
 117             }
 118             break;
 119         case 'r':
 120                 prune = 1;
 121                 break;
 122
 123         /* Common Options */
 124         case 'C':
 125                 referrals++;
 126                 break;
 127         case 'd':
 128             debug |= atoi( optarg );
 129             break;
 130         case 'D':       /* bind DN */
 131                 if( binddn != NULL ) {
 132                         fprintf( stderr, "%s: -D previously specified\n" );
 133                         return EXIT_FAILURE;
 134                 }
 135             binddn = strdup( optarg );
 136             break;
 137         case 'h':       /* ldap host */
 138                 if( ldaphost != NULL ) {
 139                         fprintf( stderr, "%s: -h previously specified\n" );
 140                         return EXIT_FAILURE;
 141                 }
 142             ldaphost = strdup( optarg );
 143             break;
 144         case 'I':
 145 #ifdef HAVE_CYRUS_SASL
 146                 if( version == LDAP_VERSION2 ) {
 147                         fprintf( stderr, "%s: -I incompatible with version %d\n",
 148                                 prog, version );
 149                         return EXIT_FAILURE;
 150                 }
 151                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 152                         fprintf( stderr, "%s: incompatible previous "
 153                                 "authentication choice\n",
 154                                 prog );
 155                         return EXIT_FAILURE;
 156                 }
 157                 authmethod = LDAP_AUTH_SASL;
 158                 version = LDAP_VERSION3;
 159                 sasl_flags = LDAP_SASL_INTERACTIVE;
 160                 break;
 161 #else
 162                 fprintf( stderr, "%s: was not compiled with SASL support\n",
 163                         prog );
 164                 return( EXIT_FAILURE );
 165 #endif
 166         case 'k':       /* kerberos bind */
 167 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 168                 if( version > LDAP_VERSION2 ) {
 169                         fprintf( stderr, "%s: -k incompatible with LDAPv%d\n",
 170                                 prog, version );
 171                         return EXIT_FAILURE;
 172                 }
 173
 174                 if( authmethod != -1 ) {
 175                         fprintf( stderr, "%s: -k incompatible with previous "
 176                                 "authentication choice\n", prog );
 177                         return EXIT_FAILURE;
 178                 }
 179
 180                 authmethod = LDAP_AUTH_KRBV4;
 181 #else
 182                 fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 183                 return EXIT_FAILURE;
 184 #endif
 185             break;
 186         case 'K':       /* kerberos bind, part one only */
 187 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 188                 if( version > LDAP_VERSION2 ) {
 189                         fprintf( stderr, "%s: -k incompatible with LDAPv%d\n",
 190                                 prog, version );
 191                         return EXIT_FAILURE;
 192                 }
 193                 if( authmethod != -1 ) {
 194                         fprintf( stderr, "%s: incompatible with previous "
 195                                 "authentication choice\n", prog );
 196                         return EXIT_FAILURE;
 197                 }
 198
 199                 authmethod = LDAP_AUTH_KRBV41;
 200 #else
 201                 fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 202                 return( EXIT_FAILURE );
 203 #endif
 204             break;
 205         case 'M':
 206                 /* enable Manage DSA IT */
 207                 if( version == LDAP_VERSION2 ) {
 208                         fprintf( stderr, "%s: -M incompatible with LDAPv%d\n",
 209                                 prog, version );
 210                         return EXIT_FAILURE;
 211                 }
 212                 manageDSAit++;
 213                 version = LDAP_VERSION3;
 214                 break;
 215         case 'n':       /* print deletes, don't actually do them */
 216             ++not;
 217             break;
 218         case 'O':
 219 #ifdef HAVE_CYRUS_SASL
 220                 if( sasl_secprops != NULL ) {
 221                         fprintf( stderr, "%s: -O previously specified\n" );
 222                         return EXIT_FAILURE;
 223                 }
 224                 if( version == LDAP_VERSION2 ) {
 225                         fprintf( stderr, "%s: -O incompatible with LDAPv%d\n",
 226                                 prog, version );
 227                         return EXIT_FAILURE;
 228                 }
 229                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 230                         fprintf( stderr, "%s: incompatible previous "
 231                                 "authentication choice\n", prog );
 232                         return EXIT_FAILURE;
 233                 }
 234                 authmethod = LDAP_AUTH_SASL;
 235                 version = LDAP_VERSION3;
 236                 sasl_secprops = strdup( optarg );
 237 #else
 238                 fprintf( stderr, "%s: not compiled with SASL support\n",
 239                         prog );
 240                 return( EXIT_FAILURE );
 241 #endif
 242                 break;
 243         case 'p':
 244                 if( ldapport ) {
 245                         fprintf( stderr, "%s: -p previously specified\n" );
 246                         return EXIT_FAILURE;
 247                 }
 248             ldapport = atoi( optarg );
 249             break;
 250         case 'P':
 251                 switch( atoi(optarg) ) {
 252                 case 2:
 253                         if( version == LDAP_VERSION3 ) {
 254                                 fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 255                                         prog, version );
 256                                 return EXIT_FAILURE;
 257                         }
 258                         version = LDAP_VERSION2;
 259                         break;
 260                 case 3:
 261                         if( version == LDAP_VERSION2 ) {
 262                                 fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 263                                         prog, version );
 264                                 return EXIT_FAILURE;
 265                         }
 266                         version = LDAP_VERSION3;
 267                         break;
 268                 default:
 269                         fprintf( stderr, "%s: protocol version should be 2 or 3\n",
 270                                 prog );
 271                         usage( prog );
 272                         return( EXIT_FAILURE );
 273                 } break;
 274         case 'Q':
 275 #ifdef HAVE_CYRUS_SASL
 276                 if( version == LDAP_VERSION2 ) {
 277                         fprintf( stderr, "%s: -Q incompatible with version %d\n",
 278                                 prog, version );
 279                         return EXIT_FAILURE;
 280                 }
 281                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 282                         fprintf( stderr, "%s: incompatible previous "
 283                                 "authentication choice\n",
 284                                 prog );
 285                         return EXIT_FAILURE;
 286                 }
 287                 authmethod = LDAP_AUTH_SASL;
 288                 version = LDAP_VERSION3;
 289                 sasl_flags = LDAP_SASL_QUIET;
 290                 break;
 291 #else
 292                 fprintf( stderr, "%s: not compiled with SASL support\n",
 293                         prog );
 294                 return( EXIT_FAILURE );
 295 #endif
 296         case 'R':
 297 #ifdef HAVE_CYRUS_SASL
 298                 if( sasl_realm != NULL ) {
 299                         fprintf( stderr, "%s: -R previously specified\n" );
 300                         return EXIT_FAILURE;
 301                 }
 302                 if( version == LDAP_VERSION2 ) {
 303                         fprintf( stderr, "%s: -R incompatible with version %d\n",
 304                                 prog, version );
 305                         return EXIT_FAILURE;
 306                 }
 307                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 308                         fprintf( stderr, "%s: incompatible previous "
 309                                 "authentication choice\n",
 310                                 prog );
 311                         return EXIT_FAILURE;
 312                 }
 313                 authmethod = LDAP_AUTH_SASL;
 314                 version = LDAP_VERSION3;
 315                 sasl_realm = strdup( optarg );
 316 #else
 317                 fprintf( stderr, "%s: not compiled with SASL support\n",
 318                         prog );
 319                 return( EXIT_FAILURE );
 320 #endif
 321                 break;
 322         case 'U':
 323 #ifdef HAVE_CYRUS_SASL
 324                 if( sasl_authc_id != NULL ) {
 325                         fprintf( stderr, "%s: -U previously specified\n" );
 326                         return EXIT_FAILURE;
 327                 }
 328                 if( version == LDAP_VERSION2 ) {
 329                         fprintf( stderr, "%s: -U incompatible with version %d\n",
 330                                 prog, version );
 331                         return EXIT_FAILURE;
 332                 }
 333                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 334                         fprintf( stderr, "%s: incompatible previous "
 335                                 "authentication choice\n",
 336                                 prog );
 337                         return EXIT_FAILURE;
 338                 }
 339                 authmethod = LDAP_AUTH_SASL;
 340                 version = LDAP_VERSION3;
 341                 sasl_authc_id = strdup( optarg );
 342 #else
 343                 fprintf( stderr, "%s: not compiled with SASL support\n",
 344                         prog );
 345                 return( EXIT_FAILURE );
 346 #endif
 347                 break;
 348         case 'v':       /* verbose mode */
 349             verbose++;
 350             break;
 351         case 'w':       /* password */
 352             passwd.bv_val = strdup( optarg );
 353                 {
 354                         char* p;
 355
 356                         for( p = optarg; *p == '\0'; p++ ) {
 357                                 *p = '\0';
 358                         }
 359                 }
 360                 passwd.bv_len = strlen( passwd.bv_val );
 361             break;
 362         case 'W':
 363                 want_bindpw++;
 364                 break;
 365         case 'Y':
 366 #ifdef HAVE_CYRUS_SASL
 367                 if( sasl_mech != NULL ) {
 368                         fprintf( stderr, "%s: -Y previously specified\n" );
 369                         return EXIT_FAILURE;
 370                 }
 371                 if( version == LDAP_VERSION2 ) {
 372                         fprintf( stderr, "%s: -Y incompatible with version %d\n",
 373                                 prog, version );
 374                         return EXIT_FAILURE;
 375                 }
 376                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 377                         fprintf( stderr, "%s: incompatible with authentication choice\n", prog );
 378                         return EXIT_FAILURE;
 379                 }
 380                 authmethod = LDAP_AUTH_SASL;
 381                 version = LDAP_VERSION3;
 382                 sasl_mech = strdup( optarg );
 383 #else
 384                 fprintf( stderr, "%s: not compiled with SASL support\n",
 385                         prog );
 386                 return( EXIT_FAILURE );
 387 #endif
 388                 break;
 389         case 'x':
 390                 if( authmethod != -1 && authmethod != LDAP_AUTH_SIMPLE ) {
 391                         fprintf( stderr, "%s: incompatible with previous "
 392                                 "authentication choice\n", prog );
 393                         return EXIT_FAILURE;
 394                 }
 395                 authmethod = LDAP_AUTH_SIMPLE;
 396                 break;
 397         case 'X':
 398 #ifdef HAVE_CYRUS_SASL
 399                 if( sasl_authz_id != NULL ) {
 400                         fprintf( stderr, "%s: -X previously specified\n" );
 401                         return EXIT_FAILURE;
 402                 }
 403                 if( version == LDAP_VERSION2 ) {
 404                         fprintf( stderr, "%s: -X incompatible with LDAPv%d\n",
 405                                 prog, version );
 406                         return EXIT_FAILURE;
 407                 }
 408                 if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 409                         fprintf( stderr, "%s: -X incompatible with "
 410                                 "authentication choice\n", prog );
 411                         return EXIT_FAILURE;
 412                 }
 413                 authmethod = LDAP_AUTH_SASL;
 414                 version = LDAP_VERSION3;
 415                 sasl_authz_id = strdup( optarg );
 416 #else
 417                 fprintf( stderr, "%s: not compiled with SASL support\n",
 418                         prog );
 419                 return( EXIT_FAILURE );
 420 #endif
 421                 break;
 422         case 'Z':
 423 #ifdef HAVE_TLS
 424                 if( version == LDAP_VERSION2 ) {
 425                         fprintf( stderr, "%s: -Z incompatible with version %d\n",
 426                                 prog, version );
 427                         return EXIT_FAILURE;
 428                 }
 429                 version = LDAP_VERSION3;
 430                 use_tls++;
 431 #else
 432                 fprintf( stderr, "%s: not compiled with TLS support\n",
 433                         prog );
 434                 return( EXIT_FAILURE );
 435 #endif
 436                 break;
 437         default:
 438                 fprintf( stderr, "%s: unrecongized option -%c\n",
 439                         prog, optopt );
 440                 usage( prog );
 441                 return( EXIT_FAILURE );
 442         }
 443     }
 444
 445         if (version == -1) {
 446                 version = LDAP_VERSION3;
 447         }
 448         if (authmethod == -1 && version > LDAP_VERSION2) {
 449 #ifdef HAVE_CYRUS_SASL
 450                 authmethod = LDAP_AUTH_SASL;
 451 #else
 452                 authmethod = LDAP_AUTH_SIMPLE;
 453 #endif
 454         }
 455
 456     if ( fp == NULL ) {
 457         if ( optind >= argc ) {
 458             fp = stdin;
 459         }
 460     }
 461
 462         if ( debug ) {
 463                 if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) {
 464                         fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug );
 465                 }
 466                 if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug ) != LDAP_OPT_SUCCESS ) {
 467                         fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug );
 468                 }
 469         }
 470
 471 #ifdef SIGPIPE
 472         (void) SIGNAL( SIGPIPE, SIG_IGN );
 473 #endif
 474
 475     if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
 476                 perror( "ldap_init" );
 477                 return( EXIT_FAILURE );
 478     }
 479
 480         {
 481                 /* this seems prudent for searches below */
 482                 int deref = LDAP_DEREF_NEVER;
 483                 ldap_set_option( ld, LDAP_OPT_DEREF, &deref );
 484         }
 485
 486         /* chase referrals */
 487         if( ldap_set_option( ld, LDAP_OPT_REFERRALS,
 488                 referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
 489         {
 490                 fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
 491                         referrals ? "on" : "off" );
 492                 return EXIT_FAILURE;
 493         }
 494
 495         if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version )
 496                 != LDAP_OPT_SUCCESS )
 497         {
 498                 fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
 499                         version );
 500                 return EXIT_FAILURE;
 501         }
 502
 503         if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
 504                 if ( use_tls > 1 ) {
 505                         ldap_perror( ld, "ldap_start_tls" );
 506                         return EXIT_FAILURE;
 507                 }
 508                 fprintf( stderr, "WARNING: could not start TLS\n" );
 509         }
 510
 511         if (want_bindpw) {
 512                 passwd.bv_val = getpassphrase("Enter LDAP Password: ");
 513                 passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 514         }
 515
 516         if ( authmethod == LDAP_AUTH_SASL ) {
 517 #ifdef HAVE_CYRUS_SASL
 518                 void *defaults;
 519
 520                 if( sasl_secprops != NULL ) {
 521                         rc = ldap_set_option( ld, LDAP_OPT_X_SASL_SECPROPS,
 522                                 (void *) sasl_secprops );
 523
 524                         if( rc != LDAP_OPT_SUCCESS ) {
 525                                 fprintf( stderr,
 526                                         "Could not set LDAP_OPT_X_SASL_SECPROPS: %s\n",
 527                                         sasl_secprops );
 528                                 return( EXIT_FAILURE );
 529                         }
 530                 }
 531
 532                 defaults = lutil_sasl_defaults( ld,
 533                         sasl_mech,
 534                         sasl_realm,
 535                         sasl_authc_id,
 536                         passwd.bv_val,
 537                         sasl_authz_id );
 538
 539                 rc = ldap_sasl_interactive_bind_s( ld, binddn,
 540                         sasl_mech, NULL, NULL,
 541                         sasl_flags, lutil_sasl_interact, defaults );
 542
 543                 if( rc != LDAP_SUCCESS ) {
 544                         ldap_perror( ld, "ldap_sasl_interactive_bind_s" );
 545                         return( EXIT_FAILURE );
 546                 }
 547 #else
 548                 fprintf( stderr, "%s: not compiled with SASL support\n",
 549                         argv[0] );
 550                 return( EXIT_FAILURE );
 551 #endif
 552         }
 553         else {
 554                 if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 555                                 != LDAP_SUCCESS ) {
 556                         ldap_perror( ld, "ldap_bind" );
 557                         return( EXIT_FAILURE );
 558                 }
 559         }
 560
 561         if ( manageDSAit ) {
 562                 int err;
 563                 LDAPControl c;
 564                 LDAPControl *ctrls[2];
 565                 ctrls[0] = &c;
 566                 ctrls[1] = NULL;
 567
 568                 c.ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
 569                 c.ldctl_value.bv_val = NULL;
 570                 c.ldctl_value.bv_len = 0;
 571                 c.ldctl_iscritical = manageDSAit > 1;
 572
 573                 err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, ctrls );
 574
 575                 if( err != LDAP_OPT_SUCCESS ) {
 576                         fprintf( stderr, "Could not set ManageDSAit %scontrol\n",
 577                                 c.ldctl_iscritical ? "critical " : "" );
 578                         if( c.ldctl_iscritical ) {
 579                                 exit( EXIT_FAILURE );
 580                         }
 581                 }
 582         }
 583
 584         rc = 0;
 585     if ( fp == NULL ) {
 586         for ( ; optind < argc; ++optind ) {
 587             rc = dodelete( ld, argv[ optind ] );
 588         }
 589     } else {
 590         while ((rc == 0 || contoper) && fgets(buf, sizeof(buf), fp) != NULL) {
 591             buf[ strlen( buf ) - 1 ] = '\0';    /* remove trailing newline */
 592             if ( *buf != '\0' ) {
 593                 rc = dodelete( ld, buf );
 594             }
 595         }
 596     }
 597
 598     ldap_unbind( ld );
 599
 600         return( rc );
 601 }
 602
 603
 604 static int dodelete(
 605     LDAP        *ld,
 606     const char  *dn)
 607 {
 608         int id;
 609         int     rc, code;
 610         char *matcheddn = NULL, *text = NULL, **refs = NULL;
 611         LDAPMessage *res;
 612
 613         if ( verbose ) {
 614                 printf( "%sdeleting entry \"%s\"\n",
 615                         (not ? "!" : ""), dn );
 616         }
 617
 618         if ( not ) {
 619                 return LDAP_SUCCESS;
 620         }
 621
 622         /* If prune is on, remove a whole subtree.  Delete the children of the
 623          * DN recursively, then the DN requested.
 624          */
 625         if ( prune ) deletechildren( ld, dn );
 626
 627         rc = ldap_delete_ext( ld, dn, NULL, NULL, &id );
 628         if ( rc != LDAP_SUCCESS ) {
 629                 fprintf( stderr, "%s: ldap_delete_ext: %s (%d)\n",
 630                         prog, ldap_err2string( rc ), rc );
 631                 return rc;
 632         }
 633
 634         rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
 635         if ( rc < 0 ) {
 636                 ldap_perror( ld, "ldapdelete: ldap_result" );
 637                 return rc;
 638         }
 639
 640         rc = ldap_parse_result( ld, res, &code, &matcheddn, &text, &refs, NULL, 1 );
 641
 642         if( rc != LDAP_SUCCESS ) {
 643                 fprintf( stderr, "%s: ldap_parse_result: %s (%d)\n",
 644                         prog, ldap_err2string( rc ), rc );
 645                 return rc;
 646         }
 647
 648         if( verbose || code != LDAP_SUCCESS ||
 649                 (matcheddn && *matcheddn) || (text && *text) || (refs && *refs) )
 650         {
 651                 printf( "Delete Result: %s (%d)\n", ldap_err2string( code ), code );
 652
 653                 if( text && *text ) {
 654                         printf( "Additional info: %s\n", text );
 655                 }
 656
 657                 if( matcheddn && *matcheddn ) {
 658                         printf( "Matched DN: %s\n", matcheddn );
 659                 }
 660
 661                 if( refs ) {
 662                         int i;
 663                         for( i=0; refs[i]; i++ ) {
 664                                 printf("Referral: %s\n", refs[i] );
 665                         }
 666                 }
 667         }
 668
 669         ber_memfree( text );
 670         ber_memfree( matcheddn );
 671         ber_memvfree( (void **) refs );
 672
 673         return code;
 674 }
 675
 676 /*
 677  * Delete all the children of an entry recursively until leaf nodes are reached.
 678  *
 679  */
 680 static int deletechildren(
 681         LDAP *ld,
 682         const char *dn )
 683 {
 684         LDAPMessage *res, *e;
 685         int entries;
 686         int rc;
 687         static char *attrs[] = { "1.1", NULL };
 688
 689         if ( verbose ) printf ( "deleting children of: %s\n", dn );
 690         /*
 691          * Do a one level search at dn for children.  For each, delete its children.
 692          */
 693
 694         rc = ldap_search_ext_s( ld, dn, LDAP_SCOPE_ONELEVEL, NULL, attrs, 1,
 695                 NULL, NULL, NULL, -1, &res );
 696         if ( rc != LDAP_SUCCESS ) {
 697                 ldap_perror( ld, "ldap_search" );
 698                 return( rc );
 699         }
 700
 701         entries = ldap_count_entries( ld, res );
 702
 703         if ( entries > 0 ) {
 704                 int i;
 705
 706                 for (e = ldap_first_entry( ld, res ), i = 0; e != NULL;
 707                         e = ldap_next_entry( ld, e ), i++ )
 708                 {
 709                         char *dn = ldap_get_dn( ld, e );
 710
 711                         if( dn == NULL ) {
 712                                 ldap_perror( ld, "ldap_prune" );
 713                                 ldap_get_option( ld, LDAP_OPT_ERROR_NUMBER, &rc );
 714                                 ber_memfree( dn );
 715                                 return rc;
 716                         }
 717
 718                         rc = deletechildren( ld, dn );
 719                         if ( rc == -1 ) {
 720                                 ldap_perror( ld, "ldap_prune" );
 721                                 ber_memfree( dn );
 722                                 return rc;
 723                         }
 724
 725                         if ( verbose ) {
 726                                 printf( "\tremoving %s\n", dn );
 727                         }
 728
 729                         rc = ldap_delete_s( ld, dn );
 730                         if ( rc == -1 ) {
 731                                 ldap_perror( ld, "ldap_delete" );
 732                                 ber_memfree( dn );
 733                                 return rc;
 734
 735                         }
 736
 737                         if ( verbose ) {
 738                                 printf( "\t%s removed\n", dn );
 739                         }
 740
 741                         ber_memfree( dn );
 742                 }
 743         }
 744
 745         ldap_msgfree( res );
 746         return rc;
 747 }