X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=clients%2Ftools%2Fldapsearch.c;h=da6831074139dffcfe6e7859ac642aa9407b9cee;hb=8045b54124f0365b3d34d9d3220256f052f2b76b;hp=0ae11544ece6e44dbf75b74204f1abd9bb98b88b;hpb=b73b0c61582166d37d55a90067c5783d2164af39;p=openldap diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c index 0ae11544ec..da68310741 100644 --- a/clients/tools/ldapsearch.c +++ b/clients/tools/ldapsearch.c @@ -1,3 +1,9 @@ +/* $OpenLDAP$ */ +/* + * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. + * COPYING RESTRICTIONS APPLY, see COPYRIGHT file + */ + #include "portable.h" #include @@ -8,16 +14,28 @@ #include #include #include +#include +#include + +#ifdef HAVE_FCNTL_H +#include +#endif +#ifdef HAVE_SYS_TYPES_H +#include +#endif +#ifdef HAVE_IO_H +#include +#endif #include -#include +#include "ldif.h" #include "ldap_defaults.h" #define DEFSEP "=" static void -usage( char *s ) +usage( const char *s ) { fprintf( stderr, "usage: %s [options] filter [attributes...]\nwhere:\n" @@ -28,38 +46,48 @@ usage( char *s ) "\t\t+ -- all operational attributes\n" "\t\tempty list -- all non-operational attributes\n" "options:\n" -" -n\t\tshow what would be done but don't actually search\n" -" -v\t\trun in verbose mode (diagnostics to standard output)\n" -" -t\t\twrite binary values to files in TMPDIR\n" -" -tt\t\twrite all values to files in TMPDIR\n" -" -T path\twrite files to directory specified by path (default: \"/tmp\")\n" -" -V prefix\tURL prefix for files (default: \"file://tmp/\"\n" -" -u\t\tinclude User Friendly entry names in the output\n" +" -a deref\tone of `never', `always', `search', or `find' (alias\n" +" \tdereferencing)\n" " -A\t\tretrieve attribute names only (no values)\n" +" -b basedn\tbase dn for search\n" " -B\t\tdo not suppress printing of binary values\n" -" -F sep\tprint `sep' instead of `=' between attribute names and values\n" +" -d level\tset LDAP debugging level to `level'\n" +" -D binddn\tbind DN\n" +" -E\t\trequest SASL privacy (-EE to make it critical)\n" +" -f file\t\tperform sequence of searches listed in `file'\n" +" -F sep\t\tprint `sep' instead of `=' between attribute names and\n" +" \tvalues\n" +" -h host\t\tLDAP server\n" +" -I\t\trequest SASL integrity checking (-II to make it\n" +" \tcritical)\n" +" -k\t\tuse Kerberos authentication\n" +" -K\t\tlike -k, but do only step 1 of the Kerberos bind\n" +" -l limit\ttime limit (in seconds) for search\n" " -L\t\tprint entries in LDIF format (implies -B)\n" " -LL\t\tprint entries in LDIF format without comments\n" -" -LLL\t\tprint entries in LDIF format without comments and version\n" +" -LLL\t\tprint entries in LDIF format without comments and\n" +" \tversion\n" " -M\t\tenable Manage DSA IT control (-MM to make critical)\n" +" -n\t\tshow what would be done but don't actually search\n" +" -p port\t\tport on LDAP server\n" +" -P version\tprocotol version (2 or 3)\n" " -R\t\tdo not automatically follow referrals\n" -" -S attr\tsort the results by attribute `attr'\n" -" -d level\tset LDAP debugging level to `level'\n" -" -f file\tperform sequence of searches listed in `file'\n" -" -b basedn\tbase dn for search\n" " -s scope\tone of base, one, or sub (search scope)\n" -" -a deref\tone of never, always, search, or find (alias dereferencing)\n" -" -l limit\ttime limit (in seconds) for search\n" -" -z limit\tsize limit (in entries) for search\n" -" -D binddn\tbind dn\n" +" -S attr\t\tsort the results by attribute `attr'\n" +" -t\t\twrite binary values to files in TMPDIR\n" +" -tt\t\twrite all values to files in TMPDIR\n" +" -T path\t\twrite files to directory specified by path (default:\n" +" \t\"/tmp\")\n" +" -u\t\tinclude User Friendly entry names in the output\n" +" -U user\t\tSASL authentication identity (username)\n" +" -v\t\trun in verbose mode (diagnostics to standard output)\n" +" -V prefix\tURL prefix for files (default: \"file://tmp/\")\n" " -w passwd\tbind passwd (for simple authentication)\n" " -W\t\tprompt for bind passwd\n" -#ifdef HAVE_KERBEROS -" -k\t\tuse Kerberos instead of Simple Password authentication\n" -#endif -" -h host\tldap server\n" -" -p port\tport on ldap server\n" -" -P version\tprocotol version (2 or 3)\n" +" -X id\t\tSASL authorization identity (\"dn:\" or \"u:\")\n" +" -Y mech\t\tSASL mechanism\n" +" -z limit\tsize limit (in entries) for search\n" +" -Z\t\trequest the use of TLS (-ZZ to make it critical)\n" , s ); exit( EXIT_FAILURE ); @@ -92,10 +120,18 @@ static char *tmpdir = NULL; static char *urlpre = NULL; static char *binddn = NULL; -static char *passwd = NULL; +static struct berval passwd = { 0, NULL }; static char *base = NULL; static char *ldaphost = NULL; static int ldapport = 0; +#ifdef HAVE_CYRUS_SASL +static char *sasl_authc_id = NULL; +static char *sasl_authz_id = NULL; +static char *sasl_mech = NULL; +static int sasl_integrity = 0; +static int sasl_privacy = 0; +#endif +static int use_tls = 0; static char *sep = DEFSEP; static char *sortattr = NULL; static int skipsortattr = 0; @@ -105,7 +141,7 @@ int main( int argc, char **argv ) { char *infile, *filtpattern, **attrs, line[ BUFSIZ ]; - FILE *fp; + FILE *fp = NULL; int rc, i, first, scope, deref, attrsonly, manageDSAit; int referrals, timelimit, sizelimit, debug; int authmethod, version, want_bindpw; @@ -121,7 +157,7 @@ main( int argc, char **argv ) authmethod = LDAP_AUTH_SIMPLE; while (( i = getopt( argc, argv, - "WKknuvtMRABLD:s:f:h:b:d:P:p:F:a:w:l:z:S:T:V:")) != EOF ) + "Aa:Bb:D:d:EF:f:h:IKkLl:MnP:p:RS:s:T:tU:uV:vWw:X:Y:Zz:")) != EOF ) { switch( i ) { case 'n': /* do Not do any searches */ @@ -134,19 +170,22 @@ main( int argc, char **argv ) debug |= atoi( optarg ); break; case 'k': /* use kerberos bind */ -#ifdef HAVE_KERBEROS +#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND authmethod = LDAP_AUTH_KRBV4; #else - fprintf (stderr, "%s was not compiled with Kerberos support\n", argv[0]); + fprintf( stderr, "%s was not compiled with Kerberos support\n", argv[0] ); + return( EXIT_FAILURE ); #endif break; case 'K': /* use kerberos bind, 1st part only */ -#ifdef HAVE_KERBEROS +#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND authmethod = LDAP_AUTH_KRBV41; #else - fprintf (stderr, "%s was not compiled with Kerberos support\n", argv[0]); + fprintf( stderr, "%s was not compiled with Kerberos support\n", argv[0] ); + return( EXIT_FAILURE ); #endif break; + break; case 'u': /* include UFN */ ++includeufn; break; @@ -224,7 +263,7 @@ main( int argc, char **argv ) ldapport = atoi( optarg ); break; case 'w': /* bind password */ - passwd = strdup( optarg ); + passwd.bv_val = strdup( optarg ); { char* p; @@ -232,6 +271,7 @@ main( int argc, char **argv ) *p = '*'; } } + passwd.bv_len = strlen( passwd.bv_val ); break; case 'l': /* time limit */ timelimit = atoi( optarg ); @@ -259,11 +299,109 @@ main( int argc, char **argv ) usage( argv[0] ); } break; + case 'I': +#ifdef HAVE_CYRUS_SASL + sasl_integrity++; + authmethod = LDAP_AUTH_SASL; +#else + fprintf( stderr, "%s was not compiled with SASL support\n", + argv[0] ); + return( EXIT_FAILURE ); +#endif + break; + case 'E': +#ifdef HAVE_CYRUS_SASL + sasl_privacy++; + authmethod = LDAP_AUTH_SASL; +#else + fprintf( stderr, "%s was not compiled with SASL support\n", + argv[0] ); + return( EXIT_FAILURE ); +#endif + break; + case 'Y': +#ifdef HAVE_CYRUS_SASL + if ( strcasecmp( optarg, "any" ) && strcmp( optarg, "*" ) ) { + sasl_mech = strdup( optarg ); + } + authmethod = LDAP_AUTH_SASL; +#else + fprintf( stderr, "%s was not compiled with SASL support\n", + argv[0] ); + return( EXIT_FAILURE ); +#endif + break; + case 'U': +#ifdef HAVE_CYRUS_SASL + sasl_authc_id = strdup( optarg ); + authmethod = LDAP_AUTH_SASL; +#else + fprintf( stderr, "%s was not compiled with SASL support\n", + argv[0] ); + return( EXIT_FAILURE ); +#endif + break; + case 'X': +#ifdef HAVE_CYRUS_SASL + sasl_authz_id = strdup( optarg ); + authmethod = LDAP_AUTH_SASL; +#else + fprintf( stderr, "%s was not compiled with SASL support\n", + argv[0] ); + return( EXIT_FAILURE ); +#endif + break; + case 'Z': +#ifdef HAVE_TLS + use_tls++; +#else + fprintf( stderr, "%s was not compiled with TLS support\n", + argv[0] ); + return( EXIT_FAILURE ); +#endif + break; default: usage( argv[0] ); } } +#ifdef LDAP_LDIF + /* no alternative format */ + if( ldif < 1 ) ldif = 1; +#endif + + if ( ( authmethod == LDAP_AUTH_KRBV4 ) || ( authmethod == + LDAP_AUTH_KRBV41 ) ) { + if( version > LDAP_VERSION2 ) { + fprintf( stderr, "Kerberos requires LDAPv2\n" ); + return( EXIT_FAILURE ); + } + version = LDAP_VERSION2; + } + else if ( authmethod == LDAP_AUTH_SASL ) { + if( version != -1 && version != LDAP_VERSION3 ) { + fprintf( stderr, "SASL requires LDAPv3\n" ); + return( EXIT_FAILURE ); + } + version = LDAP_VERSION3; + } + + if( manageDSAit ) { + if( version != -1 && version != LDAP_VERSION3 ) { + fprintf(stderr, "manage DSA control requires LDAPv3\n"); + return EXIT_FAILURE; + } + version = LDAP_VERSION3; + } + + if( use_tls ) { + if( version != -1 && version != LDAP_VERSION3 ) { + fprintf(stderr, "Start TLS requires LDAPv3\n"); + return EXIT_FAILURE; + } + version = LDAP_VERSION3; + } + if ( argc - optind < 1 ) { usage( argv[ 0 ] ); } @@ -307,7 +445,7 @@ main( int argc, char **argv ) } if( urlpre == NULL ) { - urlpre = malloc( sizeof("file:///") + strlen(tmpdir) ); + urlpre = malloc( sizeof("file:////") + strlen(tmpdir) ); if( urlpre == NULL ) { perror( "malloc" ); @@ -335,7 +473,8 @@ main( int argc, char **argv ) #endif if ( verbose ) { - fprintf( stderr, "ldap_init( %s, %d )\n", + fprintf( stderr, + (ldapport ? "ldap_init( %s, %d )\n" : "ldap_init( %s, )\n"), (ldaphost != NULL) ? ldaphost : "", ldapport ); } @@ -374,13 +513,65 @@ main( int argc, char **argv ) fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", version ); } - if (want_bindpw) { - passwd = getpass("Enter LDAP Password: "); + if ( use_tls && ldap_start_tls( ld, NULL, NULL ) != LDAP_SUCCESS ) { + if ( use_tls > 1 ) { + ldap_perror( ld, "ldap_start_tls" ); + return( EXIT_FAILURE ); + } } - if ( ldap_bind_s( ld, binddn, passwd, authmethod ) != LDAP_SUCCESS ) { - ldap_perror( ld, "ldap_bind" ); + if (want_bindpw) { + passwd.bv_val = getpassphrase("Enter LDAP Password: "); + passwd.bv_len = strlen( passwd.bv_val ); + } + + if ( authmethod == LDAP_AUTH_SASL ) { +#ifdef HAVE_CYRUS_SASL + int minssf = 0, maxssf = 0; + + if ( sasl_integrity > 0 ) + maxssf = 1; + if ( sasl_integrity > 1 ) + minssf = 1; + if ( sasl_privacy > 0 ) + maxssf = 100000; /* Something big value */ + if ( sasl_privacy > 1 ) + minssf = 56; + + if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MINSSF, + (void *)&minssf ) != LDAP_OPT_SUCCESS ) { + fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MINSSF" + "%d\n", minssf); + return( EXIT_FAILURE ); + } + if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MAXSSF, + (void *)&maxssf ) != LDAP_OPT_SUCCESS ) { + fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MAXSSF" + "%d\n", maxssf); + return( EXIT_FAILURE ); + } + + rc = ldap_negotiated_sasl_bind_s( ld, binddn, sasl_authc_id, + sasl_authz_id, sasl_mech, + passwd.bv_len ? &passwd : NULL, + NULL, NULL ); + + if( rc != LDAP_SUCCESS ) { + ldap_perror( ld, "ldap_negotiated_sasl_bind_s" ); + return( EXIT_FAILURE ); + } +#else + fprintf( stderr, "%s was not compiled with SASL support\n", + argv[0] ); return( EXIT_FAILURE ); +#endif + } + else { + if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod ) + != LDAP_SUCCESS ) { + ldap_perror( ld, "ldap_bind" ); + return( EXIT_FAILURE ); + } } if ( manageDSAit ) { @@ -411,7 +602,7 @@ main( int argc, char **argv ) filtpattern ); if ( attrs == NULL ) { - printf( "ALL" ); + fprintf( stderr, "ALL" ); } else { for ( i = 0; attrs[ i ] != NULL; ++i ) { fprintf( stderr, "%s ", attrs[ i ] ); @@ -422,8 +613,7 @@ main( int argc, char **argv ) if ( ldif ) { if (ldif < 3 ) { - /* TEMPORARILY put the version in a comment many tools cannot yet a version attribute */ - printf( "# version: 1\n"); + printf( "version: 1\n\n"); } if (ldif < 2 ) { @@ -557,7 +747,8 @@ static int dosearch( } -void print_entry( +static void +print_entry( LDAP *ld, LDAPMessage *entry, int attrsonly) @@ -616,6 +807,7 @@ void print_entry( if ( vals2tmp > 1 || ( vals2tmp && ldif_is_not_printable( bvals[i]->bv_val, bvals[i]->bv_len ) )) { + int tmpfd; /* write value to file */ sprintf( tmpfname, "%s" LDAP_DIRSEP "ldapsearch-%s-XXXXXX", tmpdir, a ); @@ -626,7 +818,12 @@ void print_entry( continue; } - if (( tmpfp = fopen( tmpfname, "w")) == NULL ) { + if (( tmpfd = open( tmpfname, O_WRONLY|O_CREAT|O_EXCL, 0600 )) == -1 ) { + perror( tmpfname ); + continue; + } + + if (( tmpfp = fdopen( tmpfd, "w")) == NULL ) { perror( tmpfname ); continue; } @@ -662,7 +859,6 @@ void print_entry( bvals[i]->bv_len ); printf( "%s%s", a, sep ); puts( notprint ? "NOT PRINTABLE" : bvals[ i ]->bv_val ); - puts( "\n" ); } } } @@ -676,7 +872,7 @@ void print_entry( } -int +static int write_ldif( int type, char *name, char *value, ber_len_t vallen ) { char *ldif;