]> git.sur5r.net Git - openldap/blobdiff - include/ldap.h
New access_allowed()
[openldap] / include / ldap.h
index d3321be909d87f0b380d52c8af4de8b43b22f522..5cda775cfd3da464368825f7a7193e7fa1cd19c7 100644 (file)
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  * 
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -108,6 +108,17 @@ LDAP_BEGIN_DECL
 #define LDAP_OPT_ERROR_STRING                  LDAP_OPT_DIAGNOSTIC_MESSAGE
 #define LDAP_OPT_MATCHED_DN                    0x0033
 /* 0x0034 - 0x3fff not defined */
+/* 0x0091 used by Microsoft for LDAP_OPT_AUTO_RECONNECT */
+#define LDAP_OPT_SSPI_FLAGS                    0x0092
+/* 0x0093 used by Microsoft for LDAP_OPT_SSL_INFO */
+/* 0x0094 used by Microsoft for LDAP_OPT_REF_DEREF_CONN_PER_MSG */
+#define LDAP_OPT_SIGN                          0x0095
+#define LDAP_OPT_ENCRYPT                       0x0096
+#define LDAP_OPT_SASL_METHOD                   0x0097
+/* 0x0098 used by Microsoft for LDAP_OPT_AREC_EXCLUSIVE */
+#define LDAP_OPT_SECURITY_CONTEXT              0x0099
+/* 0x009A used by Microsoft for LDAP_OPT_ROOTDSE_CACHE */
+/* 0x009B - 0x3fff not defined */
 
 /* API Extensions */
 #define LDAP_OPT_API_EXTENSION_BASE 0x4000  /* API extensions */
@@ -122,24 +133,27 @@ LDAP_BEGIN_DECL
 #define LDAP_OPT_REFERRAL_URLS      0x5007  /* Referral URLs */
 #define LDAP_OPT_SOCKBUF            0x5008  /* sockbuf */
 #define LDAP_OPT_DEFBASE               0x5009  /* searchbase */
+#define        LDAP_OPT_CONNECT_ASYNC          0x5010  /* create connections asynchronously */
+#define        LDAP_OPT_CONNECT_CB                     0x5011  /* connection callbacks */
 
 /* OpenLDAP TLS options */
 #define LDAP_OPT_X_TLS                         0x6000
-#define LDAP_OPT_X_TLS_CTX                     0x6001  /* OpenSSL CTX */
+#define LDAP_OPT_X_TLS_CTX                     0x6001  /* OpenSSL CTX* */
 #define LDAP_OPT_X_TLS_CACERTFILE      0x6002
 #define LDAP_OPT_X_TLS_CACERTDIR       0x6003
 #define LDAP_OPT_X_TLS_CERTFILE                0x6004
 #define LDAP_OPT_X_TLS_KEYFILE         0x6005
 #define LDAP_OPT_X_TLS_REQUIRE_CERT    0x6006
-/* #define LDAP_OPT_X_TLS_PROTOCOL             0x6007 */
+#define LDAP_OPT_X_TLS_PROTOCOL_MIN    0x6007
 #define LDAP_OPT_X_TLS_CIPHER_SUITE    0x6008
 #define LDAP_OPT_X_TLS_RANDOM_FILE     0x6009
-#define LDAP_OPT_X_TLS_SSL_CTX         0x600a
+#define LDAP_OPT_X_TLS_SSL_CTX         0x600a  /* OpenSSL SSL* */
 #define LDAP_OPT_X_TLS_CRLCHECK                0x600b
 #define LDAP_OPT_X_TLS_CONNECT_CB      0x600c
 #define LDAP_OPT_X_TLS_CONNECT_ARG     0x600d
 #define LDAP_OPT_X_TLS_DHFILE          0x600e
 #define LDAP_OPT_X_TLS_NEWCTX          0x600f
+#define LDAP_OPT_X_TLS_CRLFILE         0x6010  /* GNUtls only */
 
 #define LDAP_OPT_X_TLS_NEVER   0
 #define LDAP_OPT_X_TLS_HARD            1
@@ -151,6 +165,14 @@ LDAP_BEGIN_DECL
 #define LDAP_OPT_X_TLS_CRL_PEER        1
 #define LDAP_OPT_X_TLS_CRL_ALL 2
 
+/* for LDAP_OPT_X_TLS_PROTOCOL_MIN */
+#define LDAP_OPT_X_TLS_PROTOCOL(maj,min)       (((maj) << 8) + (min))
+#define LDAP_OPT_X_TLS_PROTOCOL_SSL2           (2 << 8)
+#define LDAP_OPT_X_TLS_PROTOCOL_SSL3           (3 << 8)
+#define LDAP_OPT_X_TLS_PROTOCOL_TLS1_0         ((3 << 8) + 1)
+#define LDAP_OPT_X_TLS_PROTOCOL_TLS1_1         ((3 << 8) + 2)
+#define LDAP_OPT_X_TLS_PROTOCOL_TLS1_2         ((3 << 8) + 3)
+
 /* OpenLDAP SASL options */
 #define LDAP_OPT_X_SASL_MECH                   0x6100
 #define LDAP_OPT_X_SASL_REALM                  0x6101
@@ -161,7 +183,22 @@ LDAP_BEGIN_DECL
 #define LDAP_OPT_X_SASL_SECPROPS               0x6106 /* write-only */
 #define LDAP_OPT_X_SASL_SSF_MIN                        0x6107
 #define LDAP_OPT_X_SASL_SSF_MAX                        0x6108
-#define        LDAP_OPT_X_SASL_MAXBUFSIZE              0x6109
+#define LDAP_OPT_X_SASL_MAXBUFSIZE             0x6109
+#define LDAP_OPT_X_SASL_MECHLIST               0x610a /* read-only */
+#define LDAP_OPT_X_SASL_NOCANON                        0x610b
+#define LDAP_OPT_X_SASL_USERNAME               0x610c /* read-only */
+
+/* OpenLDAP GSSAPI options */
+#define LDAP_OPT_X_GSSAPI_DO_NOT_FREE_CONTEXT      0x6200
+#define LDAP_OPT_X_GSSAPI_ALLOW_REMOTE_PRINCIPAL   0x6201
+
+/*
+ * OpenLDAP per connection tcp-keepalive settings
+ * (Linux only, ignored where unsupported)
+ */
+#define LDAP_OPT_X_KEEPALIVE_IDLE              0x6300
+#define LDAP_OPT_X_KEEPALIVE_PROBES            0x6301
+#define LDAP_OPT_X_KEEPALIVE_INTERVAL  0x6302
 
 /* Private API Extensions -- reserved for application use */
 #define LDAP_OPT_PRIVATE_EXTENSION_BASE 0x7000  /* Private API inclusive */
@@ -217,7 +254,6 @@ typedef struct ldapcontrol {
 #define LDAP_CONTROL_PRE_READ                  "1.3.6.1.1.13.1"                /* RFC 4527 */
 #define LDAP_CONTROL_POST_READ                 "1.3.6.1.1.13.2"                /* RFC 4527 */
 
-/*  standard track - not implemented in slapd(8) */
 #define LDAP_CONTROL_SORTREQUEST    "1.2.840.113556.1.4.473" /* RFC 2891 */
 #define LDAP_CONTROL_SORTRESPONSE      "1.2.840.113556.1.4.474" /* RFC 2891 */
 
@@ -253,6 +289,7 @@ typedef struct ldapcontrol {
 #define LDAP_SYNC_ADD                                  1
 #define LDAP_SYNC_MODIFY                               2
 #define LDAP_SYNC_DELETE                               3
+#define LDAP_SYNC_NEW_COOKIE                   4
 
 
 /* Password policy Controls *//* work in progress */
@@ -268,7 +305,8 @@ typedef struct ldapcontrol {
 #define LDAP_CONTROL_SLURP                             "1.3.6.1.4.1.4203.666.5.13"
 #define LDAP_CONTROL_VALSORT                   "1.3.6.1.4.1.4203.666.5.14"
 #define LDAP_CONTROL_DONTUSECOPY               "1.3.6.1.4.1.4203.666.5.15"
-
+#define        LDAP_CONTROL_X_DEREF                    "1.3.6.1.4.1.4203.666.5.16"
+#define        LDAP_CONTROL_X_WHATFAILED               "1.3.6.1.4.1.4203.666.5.17"
 
 /* LDAP Chaining Behavior Control *//* work in progress */
 /* <draft-sermersheim-ldap-chaining>;
@@ -287,11 +325,22 @@ typedef struct ldapcontrol {
 #define LDAP_CONTROL_X_SEARCH_OPTIONS          "1.2.840.113556.1.4.1340"
 #define LDAP_SEARCH_FLAG_DOMAIN_SCOPE 1 /* do not generate referrals */
 #define LDAP_SEARCH_FLAG_PHANTOM_ROOT 2 /* search all subordinate NCs */
+#define LDAP_CONTROL_X_TREE_DELETE             "1.2.840.113556.1.4.805"
 
 /* MS Active Directory controls - not implemented in slapd(8) */
-#define LDAP_CONTROL_X_TREE_DELETE             "1.2.840.113556.1.4.805"
 #define LDAP_CONTROL_X_EXTENDED_DN             "1.2.840.113556.1.4.529"
 
+#ifdef LDAP_DEVEL
+/* <draft-wahl-ldap-session> */
+#define LDAP_CONTROL_X_SESSION_TRACKING                "1.3.6.1.4.1.21008.108.63.1"
+#define LDAP_CONTROL_X_SESSION_TRACKING_RADIUS_ACCT_SESSION_ID \
+                                               LDAP_CONTROL_X_SESSION_TRACKING ".1"
+#define LDAP_CONTROL_X_SESSION_TRACKING_RADIUS_ACCT_MULTI_SESSION_ID \
+                                               LDAP_CONTROL_X_SESSION_TRACKING ".2"
+#define LDAP_CONTROL_X_SESSION_TRACKING_USERNAME \
+                                               LDAP_CONTROL_X_SESSION_TRACKING ".3"
+#endif /* LDAP_DEVEL */
+
 /* various expired works */
 /* LDAP Duplicated Entry Control Extension *//* not implemented in slapd(8) */
 #define LDAP_CONTROL_DUPENT_REQUEST            "2.16.840.1.113719.1.27.101.1"
@@ -307,11 +356,10 @@ typedef struct ldapcontrol {
 #define LDAP_CONTROL_PERSIST_ENTRY_CHANGE_MODIFY       0x4
 #define LDAP_CONTROL_PERSIST_ENTRY_CHANGE_RENAME       0x8
 
-/* LDAP VLV *//* not implemented in slapd(8) */
+/* LDAP VLV */
 #define LDAP_CONTROL_VLVREQUEST        "2.16.840.1.113730.3.4.9"
 #define LDAP_CONTROL_VLVRESPONSE    "2.16.840.1.113730.3.4.10"
 
-
 /* LDAP Unsolicited Notifications */
 #define        LDAP_NOTICE_OF_DISCONNECTION    "1.3.6.1.4.1.1466.20036" /* RFC 4511 */
 #define LDAP_NOTICE_DISCONNECT LDAP_NOTICE_OF_DISCONNECTION
@@ -467,6 +515,8 @@ typedef struct ldapcontrol {
 #define LDAP_AUTH_KRBV41 ((ber_tag_t) 0x81U) /* context specific + primitive */
 #define LDAP_AUTH_KRBV42 ((ber_tag_t) 0x82U) /* context specific + primitive */
 
+/* used by the Windows API but not used on the wire */
+#define LDAP_AUTH_NEGOTIATE ((ber_tag_t) 0x04FFU)
 
 /* filter types */
 #define LDAP_FILTER_AND        ((ber_tag_t) 0xa0U)     /* context specific + constructed */
@@ -574,6 +624,8 @@ typedef struct ldapcontrol {
 #define LDAP_RESULTS_TOO_LARGE         0x46 /* CLDAP */
 #define LDAP_AFFECTS_MULTIPLE_DSAS     0x47
 
+#define LDAP_VLV_ERROR                         0x4C
+
 #define LDAP_OTHER                                     0x50
 
 /* LCUP operation codes (113-117) - not implemented */
@@ -653,6 +705,7 @@ typedef struct ldapcontrol {
 #define LDAP_MORE_RESULTS_TO_RETURN            (-15)   /* Obsolete */
 #define LDAP_CLIENT_LOOP                               (-16)
 #define LDAP_REFERRAL_LIMIT_EXCEEDED   (-17)
+#define        LDAP_X_CONNECTING                       (-18)
 
 
 /*
@@ -735,6 +788,159 @@ typedef struct ldap_url_desc {
 #define LDAP_URL_ERR_BADFILTER 0x09    /* bad or missing filter */
 #define LDAP_URL_ERR_BADEXTS   0x0a    /* bad or missing extensions */
 
+/*
+ * LDAP sync (RFC4533) API
+ */
+
+typedef struct ldap_sync_t ldap_sync_t;
+
+typedef enum {
+       /* these are private - the client should never see them */
+       LDAP_SYNC_CAPI_NONE             = -1,
+
+       LDAP_SYNC_CAPI_PHASE_FLAG       = 0x10U,
+       LDAP_SYNC_CAPI_IDSET_FLAG       = 0x20U,
+       LDAP_SYNC_CAPI_DONE_FLAG        = 0x40U,
+
+       /* these are passed to ls_search_entry() */
+       LDAP_SYNC_CAPI_PRESENT          = LDAP_SYNC_PRESENT,
+       LDAP_SYNC_CAPI_ADD              = LDAP_SYNC_ADD,
+       LDAP_SYNC_CAPI_MODIFY           = LDAP_SYNC_MODIFY,
+       LDAP_SYNC_CAPI_DELETE           = LDAP_SYNC_DELETE,
+
+       /* these are passed to ls_intermediate() */
+       LDAP_SYNC_CAPI_PRESENTS         = ( LDAP_SYNC_CAPI_PHASE_FLAG | LDAP_SYNC_CAPI_PRESENT ),
+       LDAP_SYNC_CAPI_DELETES          = ( LDAP_SYNC_CAPI_PHASE_FLAG | LDAP_SYNC_CAPI_DELETE ),
+
+       LDAP_SYNC_CAPI_PRESENTS_IDSET   = ( LDAP_SYNC_CAPI_PRESENTS | LDAP_SYNC_CAPI_IDSET_FLAG ),
+       LDAP_SYNC_CAPI_DELETES_IDSET    = ( LDAP_SYNC_CAPI_DELETES | LDAP_SYNC_CAPI_IDSET_FLAG ),
+
+       LDAP_SYNC_CAPI_DONE             = ( LDAP_SYNC_CAPI_DONE_FLAG | LDAP_SYNC_CAPI_PRESENTS )
+} ldap_sync_refresh_t;
+
+/*
+ * Called when an entry is returned by ldap_result().
+ * If phase is LDAP_SYNC_CAPI_ADD or LDAP_SYNC_CAPI_MODIFY,
+ * the entry has been either added or modified, and thus
+ * the complete view of the entry should be in the LDAPMessage.
+ * If phase is LDAP_SYNC_CAPI_PRESENT or LDAP_SYNC_CAPI_DELETE,
+ * only the DN should be in the LDAPMessage.
+ */
+typedef int (*ldap_sync_search_entry_f) LDAP_P((
+       ldap_sync_t                     *ls,
+       LDAPMessage                     *msg,
+       struct berval                   *entryUUID,
+       ldap_sync_refresh_t             phase ));
+
+/*
+ * Called when a reference is returned; the client should know 
+ * what to do with it.
+ */
+typedef int (*ldap_sync_search_reference_f) LDAP_P((
+       ldap_sync_t                     *ls,
+       LDAPMessage                     *msg ));
+
+/*
+ * Called when specific intermediate/final messages are returned.
+ * If phase is LDAP_SYNC_CAPI_PRESENTS or LDAP_SYNC_CAPI_DELETES,
+ * a "presents" or "deletes" phase begins.
+ * If phase is LDAP_SYNC_CAPI_DONE, a special "presents" phase
+ * with refreshDone set to "TRUE" has been returned, to indicate
+ * that the refresh phase of a refreshAndPersist is complete.
+ * In the above cases, syncUUIDs is NULL.
+ *
+ * If phase is LDAP_SYNC_CAPI_PRESENTS_IDSET or 
+ * LDAP_SYNC_CAPI_DELETES_IDSET, syncUUIDs is an array of UUIDs
+ * that are either present or have been deleted.
+ */
+typedef int (*ldap_sync_intermediate_f) LDAP_P((
+       ldap_sync_t                     *ls,
+       LDAPMessage                     *msg,
+       BerVarray                       syncUUIDs,
+       ldap_sync_refresh_t             phase ));
+
+/*
+ * Called when a searchResultDone is returned.  In refreshAndPersist,
+ * this can only occur if the search for any reason is being terminated
+ * by the server.
+ */
+typedef int (*ldap_sync_search_result_f) LDAP_P((
+       ldap_sync_t                     *ls,
+       LDAPMessage                     *msg,
+       int                             refreshDeletes ));
+
+/*
+ * This structure contains all information about the persistent search;
+ * the caller is responsible for connecting, setting version, binding, tls...
+ */
+struct ldap_sync_t {
+       /* conf search params */
+       char                            *ls_base;
+       int                             ls_scope;
+       char                            *ls_filter;
+       char                            **ls_attrs;
+       int                             ls_timelimit;
+       int                             ls_sizelimit;
+
+       /* poll timeout */
+       int                             ls_timeout;
+
+       /* helpers - add as appropriate */
+       ldap_sync_search_entry_f        ls_search_entry;
+       ldap_sync_search_reference_f    ls_search_reference;
+       ldap_sync_intermediate_f        ls_intermediate;
+       ldap_sync_search_result_f       ls_search_result;
+
+       /* set by the caller as appropriate */
+       void                            *ls_private;
+
+       /* conn stuff */
+       LDAP                            *ls_ld;
+
+       /* --- the parameters below are private - do not modify --- */
+
+       /* FIXME: make the structure opaque, and provide an interface
+        * to modify the public values? */
+
+       /* result stuff */
+       int                             ls_msgid;
+
+       /* sync stuff */
+       /* needed by refreshOnly */
+       int                             ls_reloadHint;
+
+       /* opaque - need to pass between sessions, updated by the API */
+       struct berval                   ls_cookie;
+
+       /* state variable - do not modify */
+       ldap_sync_refresh_t             ls_refreshPhase;
+};
+
+/*
+ * End of LDAP sync (RFC4533) API
+ */
+
+/*
+ * Connection callbacks...
+ */
+struct ldap_conncb;
+struct sockaddr;
+
+/* Called after a connection is established */
+typedef int (ldap_conn_add_f) LDAP_P(( LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv, struct sockaddr *addr,
+       struct ldap_conncb *ctx ));
+/* Called before a connection is closed */
+typedef void (ldap_conn_del_f) LDAP_P(( LDAP *ld, Sockbuf *sb, struct ldap_conncb *ctx ));
+
+/* Callbacks are pushed on a stack. Last one pushed is first one executed. The
+ * delete callback is called with a NULL Sockbuf just before freeing the LDAP handle.
+ */
+typedef struct ldap_conncb {
+       ldap_conn_add_f *lc_add;
+       ldap_conn_del_f *lc_del;
+       void *lc_arg;
+} ldap_conncb;
+
 /*
  * The API draft spec says we should declare (or cause to be declared)
  * 'struct timeval'.   We don't.  See IETF LDAPext discussions.
@@ -795,17 +1001,33 @@ ldap_set_urllist_proc LDAP_P((
 /*
  * in controls.c:
  */
+#if LDAP_DEPRECATED    
 LDAP_F( int )
-ldap_create_control LDAP_P((
+ldap_create_control LDAP_P((   /* deprecated, use ldap_control_create */
        LDAP_CONST char *requestOID,
        BerElement *ber,
        int iscritical,
        LDAPControl **ctrlp ));
 
 LDAP_F( LDAPControl * )
-ldap_find_control LDAP_P((
+ldap_find_control LDAP_P((     /* deprecated, use ldap_control_find */
        LDAP_CONST char *oid,
        LDAPControl **ctrls ));
+#endif
+
+LDAP_F( int )
+ldap_control_create LDAP_P((
+       LDAP_CONST char *requestOID,
+       int iscritical,
+       struct berval *value,
+       int dupval,
+       LDAPControl **ctrlp ));
+
+LDAP_F( LDAPControl * )
+ldap_control_find LDAP_P((
+       LDAP_CONST char *oid,
+       LDAPControl **ctrls,
+       LDAPControl ***nextctrlp ));
 
 LDAP_F( void )
 ldap_control_free LDAP_P((
@@ -815,6 +1037,14 @@ LDAP_F( void )
 ldap_controls_free LDAP_P((
        LDAPControl **ctrls ));
 
+LDAP_F( LDAPControl ** )
+ldap_controls_dup LDAP_P((
+       LDAPControl *LDAP_CONST *controls ));
+
+LDAP_F( LDAPControl * )
+ldap_control_dup LDAP_P((
+       LDAP_CONST LDAPControl *c ));
+
 /*
  * in dnssrv.c:
  */
@@ -1019,35 +1249,6 @@ ldap_simple_bind_s LDAP_P(( /* deprecated, use ldap_sasl_bind_s */
        LDAP_CONST char *who,
        LDAP_CONST char *passwd ));
 
-
-/*
- * in kbind.c:
- *     (deprecated - use SASL instead)
- */
-LDAP_F( int )
-ldap_kerberos_bind_s LDAP_P((  /* deprecated */
-       LDAP *ld,
-       LDAP_CONST char *who ));
-
-LDAP_F( int )
-ldap_kerberos_bind1 LDAP_P((   /* deprecated */
-       LDAP *ld,
-       LDAP_CONST char *who ));
-
-LDAP_F( int )
-ldap_kerberos_bind1_s LDAP_P(( /* deprecated */
-       LDAP *ld,
-       LDAP_CONST char *who ));
-
-LDAP_F( int )
-ldap_kerberos_bind2 LDAP_P((   /* deprecated */
-       LDAP *ld,
-       LDAP_CONST char *who ));
-
-LDAP_F( int )
-ldap_kerberos_bind2_s LDAP_P(( /* deprecated */
-       LDAP *ld,
-       LDAP_CONST char *who ));
 #endif
 
 
@@ -1153,6 +1354,22 @@ ldap_perror LDAP_P((     /* deprecated, use ldap_err2string */
 #endif
 
 
+/*
+ * gssapi.c:
+ */
+LDAP_F( int )
+ldap_gssapi_bind LDAP_P((
+       LDAP *ld,
+       LDAP_CONST char *dn,
+       LDAP_CONST char *creds ));
+
+LDAP_F( int )
+ldap_gssapi_bind_s LDAP_P((
+       LDAP *ld,
+       LDAP_CONST char *dn,
+       LDAP_CONST char *creds ));
+
+
 /*
  * in modify.c:
  */
@@ -1577,7 +1794,7 @@ ldap_count_values LDAP_P((        /* deprecated, use ldap_count_values_len */
        char **vals ));
 
 LDAP_F( void )
-ldap_value_free LDAP_P((       /* deprecated, use ldap_values_free_len */
+ldap_value_free LDAP_P((       /* deprecated, use ldap_value_free_len */
        char **vals ));
 #endif
 
@@ -2120,5 +2337,154 @@ ldap_txn_end_s LDAP_P(( LDAP *ld,
        int *retidp ));
 #endif
 
+/*
+ * in ldap_sync.c
+ */
+
+/*
+ * initialize the persistent search structure
+ */
+LDAP_F( ldap_sync_t * )
+ldap_sync_initialize LDAP_P((
+       ldap_sync_t     *ls ));
+
+/*
+ * destroy the persistent search structure
+ */
+LDAP_F( void )
+ldap_sync_destroy LDAP_P((
+       ldap_sync_t     *ls,
+       int             freeit ));
+
+/*
+ * initialize a refreshOnly sync
+ */
+LDAP_F( int )
+ldap_sync_init LDAP_P((
+       ldap_sync_t     *ls,
+       int             mode ));
+
+/*
+ * initialize a refreshOnly sync
+ */
+LDAP_F( int )
+ldap_sync_init_refresh_only LDAP_P((
+       ldap_sync_t     *ls ));
+
+/*
+ * initialize a refreshAndPersist sync
+ */
+LDAP_F( int )
+ldap_sync_init_refresh_and_persist LDAP_P((
+       ldap_sync_t     *ls ));
+
+/*
+ * poll for new responses
+ */
+LDAP_F( int )
+ldap_sync_poll LDAP_P((
+       ldap_sync_t     *ls ));
+
+#ifdef LDAP_CONTROL_X_SESSION_TRACKING
+
+/*
+ * in stctrl.c
+ */
+LDAP_F( int )
+ldap_create_session_tracking_value LDAP_P((
+       LDAP            *ld,
+       char            *sessionSourceIp,
+       char            *sessionSourceName,
+       char            *formatOID,
+       struct berval   *sessionTrackingIdentifier,
+       struct berval   *value ));
+
+LDAP_F( int )
+ldap_create_session_tracking LDAP_P((
+       LDAP            *ld,
+       char            *sessionSourceIp,
+       char            *sessionSourceName,
+       char            *formatOID,
+       struct berval   *sessionTrackingIdentifier,
+       LDAPControl     **ctrlp ));
+
+LDAP_F( int )
+ldap_parse_session_tracking_control LDAP_P((
+       LDAP *ld,
+       LDAPControl *ctrl,
+       struct berval *ip,
+       struct berval *name,
+       struct berval *oid,
+       struct berval *id ));
+
+#endif /* LDAP_CONTROL_X_SESSION_TRACKING */
+
+/*
+ * in assertion.c
+ */
+LDAP_F (int)
+ldap_create_assertion_control_value LDAP_P((
+       LDAP            *ld,
+       char            *assertion,
+       struct berval   *value ));
+
+LDAP_F( int )
+ldap_create_assertion_control LDAP_P((
+       LDAP            *ld,
+       char            *filter,
+       int             iscritical,
+       LDAPControl     **ctrlp ));
+
+/*
+ * in deref.c
+ */
+
+typedef struct LDAPDerefSpec {
+       char *derefAttr;
+       char **attributes;
+} LDAPDerefSpec;
+
+typedef struct LDAPDerefVal {
+       char *type;
+       BerVarray vals;
+       struct LDAPDerefVal *next;
+} LDAPDerefVal;
+
+typedef struct LDAPDerefRes {
+       char *derefAttr;
+       struct berval derefVal;
+       LDAPDerefVal *attrVals;
+       struct LDAPDerefRes *next;
+} LDAPDerefRes;
+
+LDAP_F( int )
+ldap_create_deref_control_value LDAP_P((
+       LDAP *ld,
+       LDAPDerefSpec *ds,
+       struct berval *value ));
+
+LDAP_F( int )
+ldap_create_deref_control LDAP_P((
+       LDAP            *ld,
+       LDAPDerefSpec   *ds,
+       int             iscritical,
+       LDAPControl     **ctrlp ));
+
+LDAP_F( void )
+ldap_derefresponse_free LDAP_P((
+       LDAPDerefRes *dr ));
+
+LDAP_F( int )
+ldap_parse_derefresponse_control LDAP_P((
+       LDAP *ld,
+       LDAPControl *ctrl,
+       LDAPDerefRes **drp ));
+
+LDAP_F( int )
+ldap_parse_deref_control LDAP_P((
+       LDAP            *ld,
+       LDAPControl     **ctrls,
+       LDAPDerefRes    **drp ));
+
 LDAP_END_DECL
 #endif /* _LDAP_H */