X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=sidebyside;f=clients%2Ftools%2Fldapmodrdn.c;h=4bb2b80f8667cb1423a0835899af767ccff1b014;hb=5a2909c06494d84d47e5c4584c6e589ad4b1a24d;hp=bf490744991cf7397d56989054b22298c859a419;hpb=1a862732eee6c21cf97d9b58570a1e0e4587d5c4;p=openldap diff --git a/clients/tools/ldapmodrdn.c b/clients/tools/ldapmodrdn.c index bf49074499..4bb2b80f86 100644 --- a/clients/tools/ldapmodrdn.c +++ b/clients/tools/ldapmodrdn.c @@ -1,22 +1,48 @@ +/* ldapmodrdn.c - generic program to modify an entry's RDN using LDAP */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file - */ -/* ldapmodrdn.c - generic program to modify an entry's RDN using LDAP. +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2003 The OpenLDAP Foundation. + * Portions Copyright 1998-2003 Kurt D. Zeilenga. + * Portions Copyright 1998-2001 Net Boolean Incorporated. + * Portions Copyright 2001-2003 IBM Corporation. + * All rights reserved. * - * Support for MODIFYDN REQUEST V3 (newSuperior) by: - * - * Copyright 1999, Juan C. Gomez, All rights reserved. + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* Portions Copyright 1999, Juan C. Gomez, All rights reserved. * This software is not subject to any license of Silicon Graphics * Inc. or Purdue University. * * Redistribution and use in source and binary forms are permitted * without restriction or fee of any kind as long as this notice * is preserved. + */ +/* Portions Copyright (c) 1992-1996 Regents of the University of Michigan. + * All rights reserved. * + * Redistribution and use in source and binary forms are permitted + * provided that this notice is preserved and that due credit is given + * to the University of Michigan at Ann Arbor. The name of the + * University may not be used to endorse or promote products derived + * from this software without specific prior written permission. This + * software is provided ``as is'' without express or implied warranty. + */ +/* ACKNOWLEDGEMENTS: + * This work was originally developed by the University of Michigan + * (as part of U-MICH LDAP). Additional significant contributors + * include: + * Kurt D. Zeilenga + * Juan C Gomez */ + #include "portable.h" #include @@ -24,26 +50,20 @@ #include #include -#include #include #include #include +#include "lutil.h" +#include "lutil_ldap.h" +#include "ldap_defaults.h" + +#include "common.h" + + +static char *newSuperior = NULL; +static int remove_old_RDN = 0; -static char *binddn = NULL; -static struct berval passwd = { 0, NULL}; -static char *ldaphost = NULL; -static int ldapport = 0; -#ifdef HAVE_CYRUS_SASL -static char *sasl_authc_id = NULL; -static char *sasl_authz_id = NULL; -static char *sasl_mech = NULL; -static int sasl_integrity = 0; -static int sasl_privacy = 0; -#endif -static int use_tls = 0; -static int not, verbose, contoper; -static LDAP *ld; static int domodrdn( LDAP *ld, @@ -52,257 +72,92 @@ static int domodrdn( char *newSuperior, int remove ); /* flag: remove old RDN */ -static void -usage( const char *s ) +void +usage( void ) { - fprintf( stderr, -"Rename LDAP entries\n\n" -"usage: %s [options] [dn rdn]\n" -" dn rdn: If given, rdn will replace the RDN of the entry specified by DN\n" -" If not given, the list of modifications is read from stdin or\n" -" from the file specified by \"-f file\" (see man page).\n" -"options:\n" -" -c\t\tcontinuous operation mode (do not stop on errors)\n" -" -C\t\tchase referrals\n" -" -d level\tset LDAP debugging level to `level'\n" -" -D binddn\tbind DN\n" -" -E\t\trequest SASL privacy (-EE to make it critical)\n" -" -f file\t\tdo renames listed in `file'\n" -" -h host\t\tLDAP server\n" -" -I\t\trequest SASL integrity checking (-II to make it\n" -" \tcritical)\n" -" -k\t\tuse Kerberos authentication\n" -" -K\t\tlike -k, but do only step 1 of the Kerberos bind\n" -" -M\t\tenable Manage DSA IT control (-MM to make it critical)\n" -" -n\t\tshow what would be done but don't actually do it\n" -" -p port\t\tport on LDAP server\n" -" -P version\tprocotol version (default: 3)\n" -" -r\t\tremove old RDN\n" -" -s newsuperior\tnew superior entry\n" -" -U user\t\tSASL authentication identity (username)\n" -" -v\t\trun in verbose mode (diagnostics to standard output)\n" -" -w passwd\tbind passwd (for simple authentication)\n" -" -W\t\tprompt for bind passwd\n" -" -X id\t\tSASL authorization identity (\"dn:\" or \"u:\")\n" -" -Y mech\t\tSASL mechanism\n" -" -Z\t\tissue Start TLS request (-ZZ to require successful response)\n" -, s ); - + fprintf( stderr, _("Rename LDAP entries\n\n")); + fprintf( stderr, _("usage: %s [options] [dn rdn]\n"), prog); + fprintf( stderr, _(" dn rdn: If given, rdn will replace the RDN of the entry specified by DN\n")); + fprintf( stderr, _(" If not given, the list of modifications is read from stdin or\n")); + fprintf( stderr, _(" from the file specified by \"-f file\" (see man page).\n")); + fprintf( stderr, _("Rename options:\n")); + fprintf( stderr, _(" -r remove old RDN\n")); + fprintf( stderr, _(" -s newsup new superior entry\n")); + tool_common_usage(); exit( EXIT_FAILURE ); } + +const char options[] = "rs:" + "cd:D:e:f:h:H:IkKMnO:p:P:QR:U:vVw:WxX:y:Y:Z"; + int -main(int argc, char **argv) +handle_private_option( int i ) { - char *myname,*infile, *entrydn = NULL, *rdn = NULL, buf[ 4096 ]; - FILE *fp; - int rc, i, remove, havedn, authmethod, version, want_bindpw, debug, manageDSAit; - int referrals; - char *newSuperior=NULL; - - infile = NULL; - not = contoper = verbose = remove = want_bindpw = - debug = manageDSAit = referrals = 0; - authmethod = LDAP_AUTH_SIMPLE; - version = -1; - - myname = (myname = strrchr(argv[0], '/')) == NULL ? argv[0] : ++myname; - - while (( i = getopt( argc, argv, "cCD:d:Ef:h:IKkMnP:p:rs:U:vWw:X:Y:Z" )) != EOF ) { - switch( i ) { - case 'k': /* kerberos bind */ -#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND - authmethod = LDAP_AUTH_KRBV4; -#else - fprintf( stderr, "%s was not compiled with Kerberos support\n", argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'K': /* kerberos bind, part one only */ -#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND - authmethod = LDAP_AUTH_KRBV41; -#else - fprintf( stderr, "%s was not compiled with Kerberos support\n", argv[0] ); - return( EXIT_FAILURE ); + switch ( i ) { +#if 0 + int crit; + char *control, *cvalue; + case 'E': /* modrdn controls */ + if( protocol == LDAP_VERSION2 ) { + fprintf( stderr, _("%s: -E incompatible with LDAPv%d\n"), + prog, version ); + exit( EXIT_FAILURE ); + } + + /* should be extended to support comma separated list of + * [!]key[=value] parameters, e.g. -E !foo,bar=567 + */ + + crit = 0; + cvalue = NULL; + if( optarg[0] == '!' ) { + crit = 1; + optarg++; + } + + control = strdup( optarg ); + if ( (cvalue = strchr( control, '=' )) != NULL ) { + *cvalue++ = '\0'; + } + fprintf( stderr, _("Invalid modrdn control name: %s\n"), control ); + usage(); #endif - break; - case 'c': /* continuous operation mode */ - ++contoper; - break; - case 'C': - referrals++; - break; - case 'h': /* ldap host */ - ldaphost = strdup( optarg ); - break; - case 'D': /* bind DN */ - binddn = strdup( optarg ); + + case 'r': /* remove old RDN */ + remove_old_RDN++; break; + case 's': /* newSuperior */ + if( protocol == LDAP_VERSION2 ) { + fprintf( stderr, _("%s: -X incompatible with LDAPv%d\n"), + prog, protocol ); + exit( EXIT_FAILURE ); + } newSuperior = strdup( optarg ); - version = LDAP_VERSION3; /* This option => force V3 */ + protocol = LDAP_VERSION3; break; - case 'w': /* password */ - passwd.bv_val = strdup( optarg ); - { - char* p; - for( p = optarg; *p == '\0'; p++ ) { - *p = '*'; - } - } - passwd.bv_len = strlen( passwd.bv_val ); - break; - case 'd': - debug |= atoi( optarg ); - break; - case 'f': /* read from file */ - infile = strdup( optarg ); - break; - case 'p': - ldapport = atoi( optarg ); - break; - case 'n': /* print adds, don't actually do them */ - ++not; - break; - case 'v': /* verbose mode */ - verbose++; - break; - case 'r': /* remove old RDN */ - remove++; - break; - case 'M': - /* enable Manage DSA IT */ - manageDSAit++; - break; - case 'W': - want_bindpw++; - break; - case 'P': - switch( atoi(optarg) ) - { - case 2: - version = LDAP_VERSION2; - break; - case 3: - version = LDAP_VERSION3; - break; - default: - fprintf( stderr, "protocol version should be 2 or 3\n" ); - usage( argv[0] ); - return( EXIT_FAILURE ); - } - break; - case 'I': -#ifdef HAVE_CYRUS_SASL - sasl_integrity++; - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'E': -#ifdef HAVE_CYRUS_SASL - sasl_privacy++; - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'Y': -#ifdef HAVE_CYRUS_SASL - if ( strcasecmp( optarg, "any" ) && strcmp( optarg, "*" ) ) { - sasl_mech = strdup( optarg ); - } - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'U': -#ifdef HAVE_CYRUS_SASL - sasl_authc_id = strdup( optarg ); - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'X': -#ifdef HAVE_CYRUS_SASL - sasl_authz_id = strdup( optarg ); - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'Z': -#ifdef HAVE_TLS - use_tls++; -#else - fprintf( stderr, "%s was not compiled with TLS support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; default: - usage( argv[0] ); - return( EXIT_FAILURE ); + return 0; } - } + return 1; +} - if ( ( authmethod == LDAP_AUTH_KRBV4 ) || ( authmethod == - LDAP_AUTH_KRBV41 ) ) { - if( version > LDAP_VERSION2 ) { - fprintf( stderr, "Kerberos requires LDAPv2\n" ); - return( EXIT_FAILURE ); - } - version = LDAP_VERSION2; - } - else if ( authmethod == LDAP_AUTH_SASL ) { - if( version != -1 && version != LDAP_VERSION3 ) { - fprintf( stderr, "SASL requires LDAPv3\n" ); - return( EXIT_FAILURE ); - } - version = LDAP_VERSION3; - } - if( manageDSAit ) { - if( version != -1 && version != LDAP_VERSION3 ) { - fprintf(stderr, "manage DSA control requires LDAPv3\n"); - return EXIT_FAILURE; - } - version = LDAP_VERSION3; - } +int +main(int argc, char **argv) +{ + char *entrydn = NULL, *rdn = NULL, buf[ 4096 ]; + FILE *fp; + LDAP *ld; + int rc, retval, havedn; - if( use_tls ) { - if( version != -1 && version != LDAP_VERSION3 ) { - fprintf(stderr, "Start TLS requires LDAPv3\n"); - return EXIT_FAILURE; - } - version = LDAP_VERSION3; - } + tool_init(); + prog = lutil_progname( "ldapmodrdn", argc, argv ); + + tool_args( argc, argv ); - if (newSuperior != NULL) { - if (version == LDAP_VERSION2) { - fprintf( stderr, - "%s: version conflict!, -s newSuperior requires LDAPv3\n", - myname); - usage( argv[0] ); - return( EXIT_FAILURE ); - } - version = LDAP_VERSION3; - } - havedn = 0; if (argc - optind == 2) { if (( rdn = strdup( argv[argc - 1] )) == NULL ) { @@ -315,9 +170,8 @@ main(int argc, char **argv) } ++havedn; } else if ( argc - optind != 0 ) { - fprintf( stderr, "%s: invalid number of arguments, only two allowed\n", myname); - usage( argv[0] ); - return( EXIT_FAILURE ); + fprintf( stderr, _("%s: invalid number of arguments (%d), only two allowed\n"), prog, argc-optind ); + usage(); } if ( infile != NULL ) { @@ -329,133 +183,27 @@ main(int argc, char **argv) fp = stdin; } - if ( debug ) { - if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug ); - } - if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug ) != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug ); - } - } - -#ifdef SIGPIPE - (void) SIGNAL( SIGPIPE, SIG_IGN ); -#endif - - if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) { - perror( "ldap_init" ); - return( EXIT_FAILURE ); - } - - /* referrals */ - if( ldap_set_option( ld, LDAP_OPT_REFERRALS, - referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS ) - { - fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n", - referrals ? "on" : "off" ); - return EXIT_FAILURE; - } - - if (version == -1 ) { - version = 3; - } - - if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ) - != LDAP_OPT_SUCCESS ) - { - fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", - version ); - return EXIT_FAILURE; - } + ld = tool_conn_setup( 0, 0 ); - if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) { - if ( use_tls > 1 ) { - ldap_perror( ld, "ldap_start_tls" ); - return( EXIT_FAILURE ); + if ( pw_file || want_bindpw ) { + if ( pw_file ) { + rc = lutil_get_filed_password( pw_file, &passwd ); + if( rc ) return EXIT_FAILURE; + } else { + passwd.bv_val = getpassphrase( _("Enter LDAP Password: ") ); + passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0; } - fprintf( stderr, "WARNING: could not start TLS\n" ); } - if (want_bindpw) { - passwd.bv_val = getpassphrase("Enter LDAP Password: "); - passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0; - } - - if ( authmethod == LDAP_AUTH_SASL ) { -#ifdef HAVE_CYRUS_SASL - int minssf = 0, maxssf = 0; - - if ( sasl_integrity > 0 ) - maxssf = 1; - if ( sasl_integrity > 1 ) - minssf = 1; - if ( sasl_privacy > 0 ) - maxssf = 100000; /* Something big value */ - if ( sasl_privacy > 1 ) - minssf = 56; - - if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MINSSF, - (void *)&minssf ) != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MINSSF" - "%d\n", minssf); - return( EXIT_FAILURE ); - } - if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MAXSSF, - (void *)&maxssf ) != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MAXSSF" - "%d\n", maxssf); - return( EXIT_FAILURE ); - } - - rc = ldap_negotiated_sasl_bind_s( ld, binddn, sasl_authc_id, - sasl_authz_id, sasl_mech, - passwd.bv_len ? &passwd : NULL, - NULL, NULL ); - - if( rc != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_negotiated_sasl_bind_s" ); - return( EXIT_FAILURE ); - } -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - } - else { - if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod ) - != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_bind" ); - return( EXIT_FAILURE ); - } - } + tool_bind( ld ); - if ( manageDSAit ) { - int err; - LDAPControl c; - LDAPControl *ctrls[2]; - ctrls[0] = &c; - ctrls[1] = NULL; - - c.ldctl_oid = LDAP_CONTROL_MANAGEDSAIT; - c.ldctl_value.bv_val = NULL; - c.ldctl_value.bv_len = 0; - c.ldctl_iscritical = manageDSAit > 1; - - err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, &ctrls ); - - if( err != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set ManageDSAit %scontrol\n", - c.ldctl_iscritical ? "critical " : "" ); - if( c.ldctl_iscritical ) { - exit( EXIT_FAILURE ); - } - } + if ( assertion || authzid || manageDSAit || noop ) { + tool_server_controls( ld, NULL, 0 ); } - rc = 0; + retval = rc = 0; if (havedn) - rc = domodrdn( ld, entrydn, rdn, newSuperior, remove ); + retval = domodrdn( ld, entrydn, rdn, newSuperior, remove_old_RDN ); else while ((rc == 0 || contoper) && fgets(buf, sizeof(buf), fp) != NULL) { if ( *buf != '\0' ) { /* blank lines optional, skip */ buf[ strlen( buf ) - 1 ] = '\0'; /* remove nl */ @@ -465,7 +213,9 @@ main(int argc, char **argv) perror( "strdup" ); return( EXIT_FAILURE ); } - rc = domodrdn(ld, entrydn, rdn, newSuperior, remove ); + rc = domodrdn(ld, entrydn, rdn, newSuperior, remove_old_RDN ); + if ( rc != 0 ) + retval = rc; havedn = 0; } else if ( !havedn ) { /* don't have DN yet */ if (( entrydn = strdup( buf )) == NULL ) { @@ -479,8 +229,7 @@ main(int argc, char **argv) ldap_unbind( ld ); - /* UNREACHABLE */ - return( rc ); + return( retval ); } static int domodrdn( @@ -490,27 +239,69 @@ static int domodrdn( char *newSuperior, int remove ) /* flag: remove old RDN */ { - int i; + int rc, code, id; + char *matcheddn=NULL, *text=NULL, **refs=NULL; + LDAPMessage *res; if ( verbose ) { - printf( "Renaming \"%s\"\n", dn ); - printf( "\tnew rdn=\"%s\" (%s old rdn)\n", - rdn, remove ? "delete" : "keep" ); + printf( _("Renaming \"%s\"\n"), dn ); + printf( _("\tnew rdn=\"%s\" (%s old rdn)\n"), + rdn, remove ? _("delete") : _("keep") ); if( newSuperior != NULL ) { - printf("\tnew parent=\"%s\"\n", newSuperior); + printf(_("\tnew parent=\"%s\"\n"), newSuperior); } } - if ( !not ) { - i = ldap_rename2_s( ld, dn, rdn, newSuperior, remove ); - if ( i != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_rename2_s" ); - } else if ( verbose ) { - printf( "modrdn complete\n" ); + if( not ) return LDAP_SUCCESS; + + rc = ldap_rename( ld, dn, rdn, newSuperior, remove, + NULL, NULL, &id ); + + if ( rc != LDAP_SUCCESS ) { + fprintf( stderr, "%s: ldap_rename: %s (%d)\n", + prog, ldap_err2string( rc ), rc ); + return rc; } - } else { - i = LDAP_SUCCESS; - } - return( i ); + rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res ); + if ( rc < 0 ) { + ldap_perror( ld, "ldapmodrdn: ldap_result" ); + return rc; + } + + rc = ldap_parse_result( ld, res, &code, &matcheddn, &text, &refs, NULL, 1 ); + + if( rc != LDAP_SUCCESS ) { + fprintf( stderr, "%s: ldap_parse_result: %s (%d)\n", + prog, ldap_err2string( rc ), rc ); + return rc; + } + + if( verbose || code != LDAP_SUCCESS || + (matcheddn && *matcheddn) || (text && *text) || (refs && *refs) ) + { + printf( _("Rename Result: %s (%d)\n"), + ldap_err2string( code ), code ); + + if( text && *text ) { + printf( _("Additional info: %s\n"), text ); + } + + if( matcheddn && *matcheddn ) { + printf( _("Matched DN: %s\n"), matcheddn ); + } + + if( refs ) { + int i; + for( i=0; refs[i]; i++ ) { + printf(_("Referral: %s\n"), refs[i] ); + } + } + } + + ber_memfree( text ); + ber_memfree( matcheddn ); + ber_memvfree( (void **) refs ); + + return code; }