X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=clients%2Ftools%2Fldapdelete.c;h=71f13cebe82c6999d7bee226f509ba6f8d53c25f;hb=6911e557deb4ec5061bac1158f6c1e9ecf0de732;hp=200d9f2a21fc90033c61c781dcfc1c6b112d7381;hpb=f6cda93bd1288a5c3ded4b963c7e70d83cb63f3a;p=openldap diff --git a/clients/tools/ldapdelete.c b/clients/tools/ldapdelete.c index 200d9f2a21..71f13cebe8 100644 --- a/clients/tools/ldapdelete.c +++ b/clients/tools/ldapdelete.c @@ -1,8 +1,34 @@ /* ldapdelete.c - simple program to delete an entry using LDAP */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2006 The OpenLDAP Foundation. + * Portions Copyright 1998-2003 Kurt D. Zeilenga. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* Portions Copyright (c) 1992-1996 Regents of the University of Michigan. + * All rights reserved. + * + * Redistribution and use in source and binary forms are permitted + * provided that this notice is preserved and that due credit is given + * to the University of Michigan at Ann Arbor. The name of the + * University may not be used to endorse or promote products derived + * from this software without specific prior written permission. This + * software is provided ``as is'' without express or implied warranty. + */ +/* ACKNOWLEDGEMENTS: + * This work was originally developed by the University of Michigan + * (as part of U-MICH LDAP). Additional significant contributors + * include: + * Kurt D. Zeilenga */ #include "portable.h" @@ -11,28 +37,21 @@ #include #include - -#include #include #include +#include +#include #include +#include "lutil.h" +#include "lutil_ldap.h" +#include "ldap_defaults.h" + +#include "common.h" + -static char *binddn = NULL; -static struct berval passwd = { 0, NULL}; -static char *ldaphost = NULL; -static int ldapport = 0; static int prune = 0; -#ifdef HAVE_CYRUS_SASL -static char *sasl_authc_id = NULL; -static char *sasl_authz_id = NULL; -static char *sasl_mech = NULL; -static int sasl_integrity = 0; -static int sasl_privacy = 0; -#endif -static int use_tls = 0; -static int not, verbose, contoper; -static LDAP *ld; + static int dodelete LDAP_P(( LDAP *ld, @@ -42,392 +61,145 @@ static int deletechildren LDAP_P(( LDAP *ld, const char *dn )); -static void -usage( const char *s ) +void +usage( void ) { - fprintf( stderr, -"Delete entries from an LDAP server\n\n" -"usage: %s [options] [dn]...\n" -" dn: list of DNs to delete. If not given, it will be readed from stdin\n" -" or from the file specified with \"-f file\".\n" -"options:\n" -" -c\t\tcontinuous operation mode (do not stop on errors)\n" -" -C\t\tchase referrals\n" -" -d level\tset LDAP debugging level to `level'\n" -" -D binddn\tbind DN\n" -" -E\t\trequest SASL privacy (-EE to make it critical)\n" -" -f file\t\tdelete DNs listed in `file'\n" -" -h host\t\tLDAP server\n" -" -I\t\trequest SASL integrity checking (-II to make it\n" -" \tcritical)\n" -" -k\t\tuse Kerberos authentication\n" -" -K\t\tlike -k, but do only step 1 of the Kerberos bind\n" -" -M\t\tenable Manage DSA IT control (-MM to make it critical)\n" -" -n\t\tshow what would be done but don't actually delete\n" -" -p port\t\tport on LDAP server\n" -" -P version\tprocotol version (default: 3)\n" -" -r\t\tdelete recursively\n" -" -U user\t\tSASL authentication identity (username)\n" -" -v\t\trun in verbose mode (diagnostics to standard output)\n" -" -w passwd\tbind passwd (for simple authentication)\n" -" -W\t\tprompt for bind passwd\n" -" -X id\t\tSASL authorization identity (\"dn:\" or \"u:\")\n" -" -Y mech\t\tSASL mechanism\n" -" -Z\t\tissue Start TLS request (-ZZ to require successful response)\n" -, s ); - + fprintf( stderr, _("Delete entries from an LDAP server\n\n")); + fprintf( stderr, _("usage: %s [options] [dn]...\n"), prog); + fprintf( stderr, _(" dn: list of DNs to delete. If not given, it will be readed from stdin\n")); + fprintf( stderr, _(" or from the file specified with \"-f file\".\n")); + fprintf( stderr, _("Delete Options:\n")); + fprintf( stderr, _(" -r delete recursively\n")); + tool_common_usage(); exit( EXIT_FAILURE ); } +const char options[] = "r" + "cd:D:e:f:h:H:IkKMnO:o:p:P:QR:U:vVw:WxX:y:Y:Z"; + int -main( int argc, char **argv ) +handle_private_option( int i ) { - char buf[ 4096 ]; - FILE *fp; - int i, rc, authmethod, referrals, want_bindpw, version, debug, manageDSAit; + switch ( i ) { +#if 0 + int crit; + char *control, *cvalue; + case 'E': /* delete extensions */ + if( protocol == LDAP_VERSION2 ) { + fprintf( stderr, _("%s: -E incompatible with LDAPv%d\n"), + prog, protocol ); + exit( EXIT_FAILURE ); + } - not = verbose = contoper = want_bindpw = debug = manageDSAit = referrals = 0; - fp = NULL; - authmethod = LDAP_AUTH_SIMPLE; - version = -1; - - while (( i = getopt( argc, argv, "cCD:d:Ef:h:IKMnP:p:rU:vWw:X:Y:Z" )) != EOF ) { - switch( i ) { - case 'k': /* kerberos bind */ -#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND - authmethod = LDAP_AUTH_KRBV4; -#else - fprintf( stderr, "%s was not compiled with Kerberos support\n", argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'K': /* kerberos bind, part one only */ -#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND - authmethod = LDAP_AUTH_KRBV41; -#else - fprintf( stderr, "%s was not compiled with Kerberos support\n", argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'c': /* continuous operation mode */ - ++contoper; - break; - case 'C': - referrals++; - break; - case 'h': /* ldap host */ - ldaphost = strdup( optarg ); - break; - case 'D': /* bind DN */ - binddn = strdup( optarg ); - break; - case 'w': /* password */ - passwd.bv_val = strdup( optarg ); - { - char* p; + /* should be extended to support comma separated list of + * [!]key[=value] parameters, e.g. -E !foo,bar=567 + */ - for( p = optarg; *p == '\0'; p++ ) { - *p = '*'; - } + crit = 0; + cvalue = NULL; + if( optarg[0] == '!' ) { + crit = 1; + optarg++; } - passwd.bv_len = strlen( passwd.bv_val ); - break; - case 'f': /* read DNs from a file */ - if (( fp = fopen( optarg, "r" )) == NULL ) { - perror( optarg ); - exit( EXIT_FAILURE ); - } - break; - case 'd': - debug |= atoi( optarg ); - break; - case 'p': - ldapport = atoi( optarg ); - break; - case 'n': /* print deletes, don't actually do them */ - ++not; - break; - case 'r': - prune = 1; - break; - case 'v': /* verbose mode */ - verbose++; - break; - case 'M': - /* enable Manage DSA IT */ - manageDSAit++; - break; - case 'W': - want_bindpw++; - break; - case 'P': - switch( atoi(optarg) ) - { - case 2: - version = LDAP_VERSION2; - break; - case 3: - version = LDAP_VERSION3; - break; - default: - fprintf( stderr, "protocol version should be 2 or 3\n" ); - usage( argv[0] ); - return( EXIT_FAILURE ); - } - break; - case 'I': -#ifdef HAVE_CYRUS_SASL - sasl_integrity++; - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'E': -#ifdef HAVE_CYRUS_SASL - sasl_privacy++; - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'Y': -#ifdef HAVE_CYRUS_SASL - if ( strcasecmp( optarg, "any" ) && strcmp( optarg, "*" ) ) { - sasl_mech = strdup( optarg ); + + control = strdup( optarg ); + if ( (cvalue = strchr( control, '=' )) != NULL ) { + *cvalue++ = '\0'; } - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'U': -#ifdef HAVE_CYRUS_SASL - sasl_authc_id = strdup( optarg ); - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'X': -#ifdef HAVE_CYRUS_SASL - sasl_authz_id = strdup( optarg ); - authmethod = LDAP_AUTH_SASL; -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - break; - case 'Z': -#ifdef HAVE_TLS - use_tls++; -#else - fprintf( stderr, "%s was not compiled with TLS support\n", - argv[0] ); - return( EXIT_FAILURE ); + fprintf( stderr, _("Invalid delete extension name: %s\n"), control ); + usage(); #endif + + case 'r': + prune = 1; break; + default: - usage( argv[0] ); - return( EXIT_FAILURE ); + return 0; } - } + return 1; +} - if ( ( authmethod == LDAP_AUTH_KRBV4 ) || ( authmethod == - LDAP_AUTH_KRBV41 ) ) { - if( version > LDAP_VERSION2 ) { - fprintf( stderr, "Kerberos requires LDAPv2\n" ); - return( EXIT_FAILURE ); - } - version = LDAP_VERSION2; - } - else if ( authmethod == LDAP_AUTH_SASL ) { - if( version != -1 && version != LDAP_VERSION3 ) { - fprintf( stderr, "SASL requires LDAPv3\n" ); - return( EXIT_FAILURE ); - } - version = LDAP_VERSION3; - } - if( manageDSAit ) { - if( version != -1 && version != LDAP_VERSION3 ) { - fprintf(stderr, "manage DSA control requires LDAPv3\n"); - return EXIT_FAILURE; - } - version = LDAP_VERSION3; - } +static void +private_conn_setup( LDAP *ld ) +{ + /* this seems prudent for searches below */ + int deref = LDAP_DEREF_NEVER; + ldap_set_option( ld, LDAP_OPT_DEREF, &deref ); +} - if( use_tls ) { - if( version != -1 && version != LDAP_VERSION3 ) { - fprintf(stderr, "Start TLS requires LDAPv3\n"); - return EXIT_FAILURE; - } - version = LDAP_VERSION3; - } - if ( fp == NULL ) { - if ( optind >= argc ) { - fp = stdin; - } - } +int +main( int argc, char **argv ) +{ + char buf[ 4096 ]; + FILE *fp; + LDAP *ld; + int rc, retval; - if ( debug ) { - if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug ); - } - if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug ) != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug ); - } - } + fp = NULL; -#ifdef SIGPIPE - (void) SIGNAL( SIGPIPE, SIG_IGN ); -#endif + tool_init( TOOL_DELETE ); + prog = lutil_progname( "ldapdelete", argc, argv ); - if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) { - perror( "ldap_init" ); - return( EXIT_FAILURE ); - } + tool_args( argc, argv ); - { - /* this seems prudent for searches below */ - int deref = LDAP_DEREF_NEVER; - ldap_set_option( ld, LDAP_OPT_DEREF, &deref ); + if ( infile != NULL ) { + if (( fp = fopen( infile, "r" )) == NULL ) { + perror( optarg ); + exit( EXIT_FAILURE ); + } + } else { + if ( optind >= argc ) { + fp = stdin; } + } - /* chase referrals */ - if( ldap_set_option( ld, LDAP_OPT_REFERRALS, - referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS ) - { - fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n", - referrals ? "on" : "off" ); - return EXIT_FAILURE; - } + ld = tool_conn_setup( 0, &private_conn_setup ); - if (version == -1 ) { - version = 3; + if ( pw_file || want_bindpw ) { + if ( pw_file ) { + rc = lutil_get_filed_password( pw_file, &passwd ); + if( rc ) return EXIT_FAILURE; + } else { + passwd.bv_val = getpassphrase( _("Enter LDAP Password: ") ); + passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0; + } } - if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ) - != LDAP_OPT_SUCCESS ) - { - fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", - version ); - return EXIT_FAILURE; - } + tool_bind( ld ); - if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) { - if ( use_tls > 1 ) { - ldap_perror( ld, "ldap_start_tls" ); - return EXIT_FAILURE; - } - fprintf( stderr, "WARNING: could not start TLS\n" ); - } + tool_server_controls( ld, NULL, 0 ); - if (want_bindpw) { - passwd.bv_val = getpassphrase("Enter LDAP Password: "); - passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0; - } + retval = rc = 0; - if ( authmethod == LDAP_AUTH_SASL ) { -#ifdef HAVE_CYRUS_SASL - int minssf = 0, maxssf = 0; - - if ( sasl_integrity > 0 ) - maxssf = 1; - if ( sasl_integrity > 1 ) - minssf = 1; - if ( sasl_privacy > 0 ) - maxssf = 100000; /* Something big value */ - if ( sasl_privacy > 1 ) - minssf = 56; - - if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MINSSF, - (void *)&minssf ) != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MINSSF" - "%d\n", minssf); - return( EXIT_FAILURE ); - } - if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MAXSSF, - (void *)&maxssf ) != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MAXSSF" - "%d\n", maxssf); - return( EXIT_FAILURE ); - } - - rc = ldap_negotiated_sasl_bind_s( ld, binddn, sasl_authc_id, - sasl_authz_id, sasl_mech, - passwd.bv_len ? &passwd : NULL, - NULL, NULL ); - - if( rc != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_negotiated_sasl_bind_s" ); - return( EXIT_FAILURE ); - } -#else - fprintf( stderr, "%s was not compiled with SASL support\n", - argv[0] ); - return( EXIT_FAILURE ); -#endif - } - else { - if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod ) - != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_bind" ); - return( EXIT_FAILURE ); - } - } + if ( fp == NULL ) { + for ( ; optind < argc; ++optind ) { + rc = dodelete( ld, argv[ optind ] ); - if ( manageDSAit ) { - int err; - LDAPControl c; - LDAPControl *ctrls[2]; - ctrls[0] = &c; - ctrls[1] = NULL; - - c.ldctl_oid = LDAP_CONTROL_MANAGEDSAIT; - c.ldctl_value.bv_val = NULL; - c.ldctl_value.bv_len = 0; - c.ldctl_iscritical = manageDSAit > 1; - - err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, &ctrls ); - - if( err != LDAP_OPT_SUCCESS ) { - fprintf( stderr, "Could not set ManageDSAit %scontrol\n", - c.ldctl_iscritical ? "critical " : "" ); - if( c.ldctl_iscritical ) { - exit( EXIT_FAILURE ); + /* Stop on error and no -c option */ + if( rc != 0 ) { + retval = rc; + if( contoper == 0 ) break; + } + } + } else { + while ((rc == 0 || contoper) && fgets(buf, sizeof(buf), fp) != NULL) { + buf[ strlen( buf ) - 1 ] = '\0'; /* remove trailing newline */ + + if ( *buf != '\0' ) { + rc = dodelete( ld, buf ); + if ( rc != 0 ) + retval = rc; } } } - rc = 0; - if ( fp == NULL ) { - for ( ; optind < argc; ++optind ) { - rc = dodelete( ld, argv[ optind ] ); - } - } else { - while ((rc == 0 || contoper) && fgets(buf, sizeof(buf), fp) != NULL) { - buf[ strlen( buf ) - 1 ] = '\0'; /* remove trailing newline */ - if ( *buf != '\0' ) { - rc = dodelete( ld, buf ); - } - } - } - - ldap_unbind( ld ); - - return( rc ); + tool_unbind( ld ); + tool_destroy(); + return retval; } @@ -441,11 +213,11 @@ static int dodelete( LDAPMessage *res; if ( verbose ) { - printf( "%sdeleting entry \"%s\"\n", - (not ? "!" : ""), dn ); + printf( _("%sdeleting entry \"%s\"\n"), + (dont ? "!" : ""), dn ); } - if ( not ) { + if ( dont ) { return LDAP_SUCCESS; } @@ -456,42 +228,60 @@ static int dodelete( rc = ldap_delete_ext( ld, dn, NULL, NULL, &id ); if ( rc != LDAP_SUCCESS ) { - fprintf( stderr, "ldapdelete: ldap_delete_ext: %s (%d)\n", - ldap_err2string( rc ), rc ); + fprintf( stderr, "%s: ldap_delete_ext: %s (%d)\n", + prog, ldap_err2string( rc ), rc ); return rc; } - rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res ); - if ( rc < 0 ) { - ldap_perror( ld, "ldapdelete: ldap_result" ); - return rc; + for ( ; ; ) { + struct timeval tv; + + if ( tool_check_abandon( ld, id ) ) { + return LDAP_CANCELLED; + } + + tv.tv_sec = 0; + tv.tv_usec = 100000; + + rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, &tv, &res ); + if ( rc < 0 ) { + tool_perror( "ldap_result", rc, NULL, NULL, NULL, NULL ); + return rc; + } + + if ( rc != 0 ) { + break; + } } rc = ldap_parse_result( ld, res, &code, &matcheddn, &text, &refs, NULL, 1 ); if( rc != LDAP_SUCCESS ) { - fprintf( stderr, "ldapdelete: ldap_parse_result: %s (%d)\n", - ldap_err2string( rc ), rc ); + fprintf( stderr, "%s: ldap_parse_result: %s (%d)\n", + prog, ldap_err2string( rc ), rc ); return rc; } - if( verbose || code != LDAP_SUCCESS || - (matcheddn && *matcheddn) || (text && *text) || (refs && *refs) ) + if( code != LDAP_SUCCESS ) { + tool_perror( "ldap_delete", code, NULL, matcheddn, text, refs ); + } else if ( verbose && + ((matcheddn && *matcheddn) || (text && *text) || (refs && *refs) )) { - printf( "Delete Result: %s (%d)\n", ldap_err2string( code ), code ); + printf( _("Delete Result: %s (%d)\n"), + ldap_err2string( code ), code ); if( text && *text ) { - printf( "Additional info: %s\n", text ); + printf( _("Additional info: %s\n"), text ); } if( matcheddn && *matcheddn ) { - printf( "Matched DN: %s\n", matcheddn ); + printf( _("Matched DN: %s\n"), matcheddn ); } if( refs ) { int i; for( i=0; refs[i]; i++ ) { - printf("Referral: %s\n", refs[i] ); + printf(_("Referral: %s\n"), refs[i] ); } } } @@ -505,7 +295,6 @@ static int dodelete( /* * Delete all the children of an entry recursively until leaf nodes are reached. - * */ static int deletechildren( LDAP *ld, @@ -514,9 +303,13 @@ static int deletechildren( LDAPMessage *res, *e; int entries; int rc; - static char *attrs[] = { "1.1", NULL }; + static char *attrs[] = { LDAP_NO_ATTRS, NULL }; + LDAPControl c, *ctrls[2]; + BerElement *ber = NULL; + LDAPMessage *res_se; + + if ( verbose ) printf ( _("deleting children of: %s\n"), dn ); - if ( verbose ) printf ( "deleting children of: %s\n", dn ); /* * Do a one level search at dn for children. For each, delete its children. */ @@ -524,7 +317,7 @@ static int deletechildren( rc = ldap_search_ext_s( ld, dn, LDAP_SCOPE_ONELEVEL, NULL, attrs, 1, NULL, NULL, NULL, -1, &res ); if ( rc != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_search" ); + tool_perror( "ldap_search", rc, NULL, NULL, NULL, NULL ); return( rc ); } @@ -539,33 +332,33 @@ static int deletechildren( char *dn = ldap_get_dn( ld, e ); if( dn == NULL ) { - ldap_perror( ld, "ldap_prune" ); - ldap_get_option( ld, LDAP_OPT_ERROR_NUMBER, &rc ); + ldap_get_option( ld, LDAP_OPT_RESULT_CODE, &rc ); + tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL ); ber_memfree( dn ); return rc; } rc = deletechildren( ld, dn ); if ( rc == -1 ) { - ldap_perror( ld, "ldap_prune" ); + tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL ); ber_memfree( dn ); return rc; } if ( verbose ) { - printf( "\tremoving %s\n", dn ); + printf( _("\tremoving %s\n"), dn ); } - rc = ldap_delete_s( ld, dn ); + rc = ldap_delete_ext_s( ld, dn, NULL, NULL ); if ( rc == -1 ) { - ldap_perror( ld, "ldap_delete" ); + tool_perror( "ldap_delete", rc, NULL, NULL, NULL, NULL ); ber_memfree( dn ); return rc; } if ( verbose ) { - printf( "\t%s removed\n", dn ); + printf( _("\t%s removed\n"), dn ); } ber_memfree( dn ); @@ -573,5 +366,73 @@ static int deletechildren( } ldap_msgfree( res ); + + /* + * Do a one level search at dn for subentry children. + */ + + if ((ber = ber_alloc_t(LBER_USE_DER)) == NULL) { + return EXIT_FAILURE; + } + rc = ber_printf( ber, "b", 1 ); + if ( rc == -1 ) { + ber_free( ber, 1 ); + fprintf( stderr, _("Subentries control encoding error!\n")); + return EXIT_FAILURE; + } + if ( ber_flatten2( ber, &c.ldctl_value, 0 ) == -1 ) { + return EXIT_FAILURE; + } + c.ldctl_oid = LDAP_CONTROL_SUBENTRIES; + c.ldctl_iscritical = 1; + ctrls[0] = &c; + ctrls[1] = NULL; + + rc = ldap_search_ext_s( ld, dn, LDAP_SCOPE_ONELEVEL, NULL, attrs, 1, + ctrls, NULL, NULL, -1, &res_se ); + if ( rc != LDAP_SUCCESS ) { + tool_perror( "ldap_search", rc, NULL, NULL, NULL, NULL ); + return( rc ); + } + ber_free( ber, 1 ); + + entries = ldap_count_entries( ld, res_se ); + + if ( entries > 0 ) { + int i; + + for (e = ldap_first_entry( ld, res_se ), i = 0; e != NULL; + e = ldap_next_entry( ld, e ), i++ ) + { + char *dn = ldap_get_dn( ld, e ); + + if( dn == NULL ) { + ldap_get_option( ld, LDAP_OPT_RESULT_CODE, &rc ); + tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL ); + ber_memfree( dn ); + return rc; + } + + if ( verbose ) { + printf( _("\tremoving %s\n"), dn ); + } + + rc = ldap_delete_ext_s( ld, dn, NULL, NULL ); + if ( rc == -1 ) { + tool_perror( "ldap_delete", rc, NULL, NULL, NULL, NULL ); + ber_memfree( dn ); + return rc; + + } + + if ( verbose ) { + printf( _("\t%s removed\n"), dn ); + } + + ber_memfree( dn ); + } + } + + ldap_msgfree( res_se ); return rc; }