Round 2 of tools work.

-R now ignored
-C added to chase.  No rebind proc yet, no checking of appropriate authentication.
complain if non-critical TLS was not started.
Fail if requested version is not supported.
ldapdelete:
  deletechildren modified to use ldap_search_ext_s()
  fixed deletechildren dn memory leak
ldapsearch:
  modified to use ldap_search_ext()

diff --git a/clients/tools/ldapdelete.c b/clients/tools/ldapdelete.c
index 229a63b5fd90d8e9422ae5b92c38981ccbc243ee..64dc8b39c5bd1c2db7f31675f8fa54f64f2d58e6 100644 (file)
--- a/clients/tools/ldapdelete.c
+++ b/clients/tools/ldapdelete.c
@@ -35,11 +35,12 @@ static int  not, verbose, contoper;
 static LDAP    *ld;
 
 static int dodelete LDAP_P((
-    LDAP       *ld,
-    char       *dn));
+    LDAP *ld,
+    const char *dn));
 
-static int deletechildren LDAP_P(( LDAP *ld,
-                                   char *dn ));
+static int deletechildren LDAP_P((
+       LDAP *ld,
+       const char *dn ));
 
 static void
 usage( const char *s )
@@ -51,6 +52,7 @@ usage( const char *s )
 "          or from the file specified with \"-f file\".\n"
 "options:\n"
 "      -c\t\tcontinuous operation mode (do not stop on errors)\n"
+"      -C\t\tchase referrals\n"
 "      -d level\tset LDAP debugging level to `level'\n"
 "      -D binddn\tbind DN\n"
 "      -E\t\trequest SASL privacy (-EE to make it critical)\n"
@@ -83,14 +85,14 @@ main( int argc, char **argv )
 {
        char            buf[ 4096 ];
        FILE            *fp;
-       int             i, rc, authmethod, want_bindpw, version, debug, manageDSAit;
+       int             i, rc, authmethod, referrals, want_bindpw, version, debug, manageDSAit;
 
-    not = verbose = contoper = want_bindpw = debug = manageDSAit = 0;
+    not = verbose = contoper = want_bindpw = debug = manageDSAit = referrals = 0;
     fp = NULL;
     authmethod = LDAP_AUTH_SIMPLE;
        version = -1;
 
-    while (( i = getopt( argc, argv, "cD:d:Ef:h:IKkMnP:p:rU:vWw:X:Y:Z" )) != EOF ) {
+    while (( i = getopt( argc, argv, "cCD:d:Ef:h:IKMnP:p:rU:vWw:X:Y:Z" )) != EOF ) {
        switch( i ) {
        case 'k':       /* kerberos bind */
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
@@ -111,6 +113,9 @@ main( int argc, char **argv )
        case 'c':       /* continuous operation mode */
            ++contoper;
            break;
+       case 'C':
+               referrals++;
+               break;
        case 'h':       /* ldap host */
            ldaphost = strdup( optarg );
            break;
@@ -290,18 +295,24 @@ main( int argc, char **argv )
 #endif
 
     if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
-       perror( "ldap_init" );
-       return( EXIT_FAILURE );
+               perror( "ldap_init" );
+               return( EXIT_FAILURE );
     }
 
        {
-               /* this seems prudent */
+               /* this seems prudent for searches below */
                int deref = LDAP_DEREF_NEVER;
                ldap_set_option( ld, LDAP_OPT_DEREF, &deref );
        }
 
-       /* don't chase referrals */
-       ldap_set_option( ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF );
+       /* chase referrals */
+       if( ldap_set_option( ld, LDAP_OPT_REFERRALS,
+               referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
+       {
+               fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
+                       referrals ? "on" : "off" );
+               return EXIT_FAILURE;
+       }
 
        if (version == -1 ) {
                version = 3;
@@ -312,13 +323,15 @@ main( int argc, char **argv )
        {
                fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
                        version );
+               return EXIT_FAILURE;
        }
 
        if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
                if ( use_tls > 1 ) {
                        ldap_perror( ld, "ldap_start_tls" );
-                       return( EXIT_FAILURE );
+                       return EXIT_FAILURE;
                }
+               fprintf( stderr, "WARNING: could not start TLS\n" );
        }
 
        if (want_bindpw) {
@@ -390,7 +403,8 @@ main( int argc, char **argv )
                err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, &ctrls );
 
                if( err != LDAP_OPT_SUCCESS ) {
-                       fprintf( stderr, "Could not set Manage DSA IT Control\n" );
+                       fprintf( stderr, "Could not set ManageDSAit %scontrol\n",
+                               c.ldctl_iscritical ? "critical " : "" );
                        if( c.ldctl_iscritical ) {
                                exit( EXIT_FAILURE );
                        }
@@ -419,83 +433,105 @@ main( int argc, char **argv )
 
 static int dodelete(
     LDAP       *ld,
-    char       *dn)
+    const char *dn)
 {
-    int        rc;
+       int     rc;
 
-    if ( verbose ) {
-       printf( "%sdeleting entry \"%s\"\n",
-               (not ? "!" : ""), dn );
-    }
-    if ( not ) {
-       rc = LDAP_SUCCESS;
-    } else {
-               /* If prune is on, remove a whole subtree.  Delete the children of the
-                * DN recursively, then the DN requested.
-                */
-               if ( prune ) deletechildren( ld, dn );
-               if (( rc = ldap_delete_s( ld, dn )) != LDAP_SUCCESS ) {
-                       ldap_perror( ld, "ldap_delete" );
-       } else if ( verbose ) {
-           printf( "\tremoved\n" );
+       if ( verbose ) {
+               printf( "%sdeleting entry \"%s\"\n",
+                       (not ? "!" : ""), dn );
        }
-    }
 
-    return( rc );
+       if ( not ) {
+               return LDAP_SUCCESS;
+       }
+
+       /* If prune is on, remove a whole subtree.  Delete the children of the
+        * DN recursively, then the DN requested.
+        */
+       if ( prune ) deletechildren( ld, dn );
+
+       rc = ldap_delete_s( ld, dn );
+       if ( rc != LDAP_SUCCESS ) {
+               ldap_perror( ld, "ldap_delete" );
+       }
+
+       if ( verbose ) {
+               printf( "\tremoved\n" );
+       }
+
+       return rc;
 }
 
 /*
  * Delete all the children of an entry recursively until leaf nodes are reached.
  *
  */
-static int deletechildren( LDAP *ld,
-                           char *dn )
+static int deletechildren(
+       LDAP *ld,
+       const char *dn )
 {
-    LDAPMessage *res, *e;
-    int entries;
-    int rc;
-       int timeout = 30 * 10000;
-
-    ldap_set_option( ld, LDAP_OPT_TIMEOUT, &timeout );
-    if ( verbose ) printf ( "deleting children of: %s\n", dn );
-    /*
-     * Do a one level search at dn for children.  For each, delete its children.
-     */
-    if ( ldap_search_s( ld, dn, LDAP_SCOPE_ONELEVEL, NULL, NULL, 0, &res ) == -1 )
-    {
-        ldap_perror( ld, "ldap_search" );
-               ldap_get_option( ld, LDAP_OPT_ERROR_NUMBER, &rc );
-        return( rc );
-    }
+       LDAPMessage *res, *e;
+       int entries;
+       int rc;
+       static char *attrs[] = { "1.1", NULL };
+
+       if ( verbose ) printf ( "deleting children of: %s\n", dn );
+       /*
+        * Do a one level search at dn for children.  For each, delete its children.
+        */
+
+       rc = ldap_search_ext_s( ld, dn, LDAP_SCOPE_ONELEVEL, NULL, attrs, 1,
+               NULL, NULL, NULL, -1, &res );
+       if ( rc != LDAP_SUCCESS ) {
+               ldap_perror( ld, "ldap_search" );
+               return( rc );
+       }
 
-    entries = ldap_count_entries( ld, res );
-    if ( entries > 0 )
-    {
-        int i;
-
-        for (e = ldap_first_entry( ld, res ), i = 0; e != NULL;
-             e = ldap_next_entry( ld, e ), i++ )
-        {
-            if ( (rc = deletechildren( ld, ldap_get_dn( ld, e) )) == -1 )
-            {
-                ldap_perror( ld, "ldap_prune" );
-                return rc;
-            }
-            if ( verbose )
-            {
-                printf( "\tremoving %s\n", ldap_get_dn( ld, e ) );
-            }
-            if ( ( rc = ldap_delete_s( ld, ldap_get_dn( ld, e ) ) ) == -1 )
-            {
-                ldap_perror( ld, "ldap_delete" );
-                return rc;
-            }
-            else if ( verbose )
-            {
-                printf( "\t%s removed\n", ldap_get_dn( ld, e ) );
-            }
-        }
-    }
-    ldap_msgfree( res );
-    return rc;
+       entries = ldap_count_entries( ld, res );
+
+       if ( entries > 0 ) {
+               int i;
+
+               for (e = ldap_first_entry( ld, res ), i = 0; e != NULL;
+                       e = ldap_next_entry( ld, e ), i++ )
+               {
+                       char *dn = ldap_get_dn( ld, e );
+
+                       if( dn == NULL ) {
+                               ldap_perror( ld, "ldap_prune" );
+                               ldap_get_option( ld, LDAP_OPT_ERROR_NUMBER, &rc );
+                               ber_memfree( dn );
+                               return rc;
+                       }
+
+                       rc = deletechildren( ld, dn );
+                       if ( rc == -1 ) {
+                               ldap_perror( ld, "ldap_prune" );
+                               ber_memfree( dn );
+                               return rc;
+                       }
+
+                       if ( verbose ) {
+                               printf( "\tremoving %s\n", dn );
+                       }
+
+                       rc = ldap_delete_s( ld, dn );
+                       if ( rc == -1 ) {
+                               ldap_perror( ld, "ldap_delete" );
+                               ber_memfree( dn );
+                               return rc;
+
+                       }
+                       
+                       if ( verbose ) {
+                               printf( "\t%s removed\n", dn );
+                       }
+
+                       ber_memfree( dn );
+               }
+       }
+
+       ldap_msgfree( res );
+       return rc;
 }

diff --git a/clients/tools/ldapmodify.c b/clients/tools/ldapmodify.c
index 45e87892cab510f3f35da9be083858fb80d4643c..f6f71033cd3467c85d1de28d81f5aff1ad82a72c 100644 (file)
--- a/clients/tools/ldapmodify.c
+++ b/clients/tools/ldapmodify.c
@@ -91,6 +91,7 @@ usage( const char *prog )
 "      -a\t\tadd values (default%s)\n"
 "      -b\t\tread values from files (for binary attributes)\n"
 "      -c\t\tcontinuous operation\n"
+"      -C\t\tchase referrals\n"
 "      -d level\tset LDAP debugging level to `level'\n"
 "      -D dn\t\tbind DN\n"
 "      -E\t\trequest SASL privacy (-EE to make it critical)\n"
@@ -121,7 +122,7 @@ main( int argc, char **argv )
 {
     char               *infile, *rbuf, *start;
     FILE               *fp;
-       int             rc, i, authmethod, version, want_bindpw, debug, manageDSAit;
+       int             rc, i, authmethod, version, want_bindpw, debug, manageDSAit, referrals;
        int count;
 
     if (( prog = strrchr( argv[ 0 ], *LDAP_DIRSEP )) == NULL ) {
@@ -136,11 +137,11 @@ main( int argc, char **argv )
     ldapadd = ( strcmp( prog, "ldapadd" ) == 0 );
 
     infile = NULL;
-    not = verbose = want_bindpw = debug = manageDSAit = 0;
+    not = verbose = want_bindpw = debug = manageDSAit = referrals = 0;
     authmethod = LDAP_AUTH_SIMPLE;
        version = -1;
 
-    while (( i = getopt( argc, argv, "acD:d:EFf:h:IKkMnP:p:rtU:vWw:X:Y:Z" )) != EOF ) {
+    while (( i = getopt( argc, argv, "acCD:d:EFf:h:IKkMnP:p:rtU:vWw:X:Y:Z" )) != EOF ) {
        switch( i ) {
        case 'a':       /* add */
            ldapadd = 1;
@@ -148,6 +149,9 @@ main( int argc, char **argv )
        case 'c':       /* continuous operation */
            contoper = 1;
            break;
+       case 'C':
+               referrals++;
+               break;
        case 'r':       /* default is to replace rather than add values */
            replace = 1;
            break;
@@ -353,8 +357,15 @@ main( int argc, char **argv )
            return( EXIT_FAILURE );
        }
 
-       /* don't chase referrals */
-       ldap_set_option( ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF );
+       /* referrals */
+       if( ldap_set_option( ld, LDAP_OPT_REFERRALS,
+               referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
+       {
+               fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
+                       referrals ? "on" : "off" );
+               return EXIT_FAILURE;
+       }
+
 
        if (version == -1 ) {
                version = 3;
@@ -372,6 +383,7 @@ main( int argc, char **argv )
                        ldap_perror( ld, "ldap_start_tls" );
                        return( EXIT_FAILURE );
                }
+               fprintf( stderr, "WARNING: could not start TLS\n" );
        }
 
        if (want_bindpw) {
@@ -447,7 +459,8 @@ main( int argc, char **argv )
                err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, &ctrls );
 
                if( err != LDAP_OPT_SUCCESS ) {
-                       fprintf( stderr, "Could not set Manage DSA IT Control\n" );
+                       fprintf( stderr, "Could not set ManageDSAit %scontrol\n",
+                               c.ldctl_iscritical ? "critical " : "" );
                        if( c.ldctl_iscritical ) {
                                exit( EXIT_FAILURE );
                        }

diff --git a/clients/tools/ldapmodrdn.c b/clients/tools/ldapmodrdn.c
index 229150370208392da204bee6ff0abdc4b7d9a11b..1927cbd850162cc99f355efbd570c1579f4d1126 100644 (file)
--- a/clients/tools/ldapmodrdn.c
+++ b/clients/tools/ldapmodrdn.c
@@ -63,6 +63,7 @@ usage( const char *s )
 "              from the file specified by \"-f file\" (see man page).\n"
 "options:\n"
 "      -c\t\tcontinuous operation mode (do not stop on errors)\n"
+"      -C\t\tchase referrals\n"
 "      -d level\tset LDAP debugging level to `level'\n"
 "      -D binddn\tbind DN\n"
 "      -E\t\trequest SASL privacy (-EE to make it critical)\n"
@@ -96,16 +97,18 @@ main(int argc, char **argv)
     char               *myname,*infile, *entrydn = NULL, *rdn = NULL, buf[ 4096 ];
     FILE               *fp;
        int             rc, i, remove, havedn, authmethod, version, want_bindpw, debug, manageDSAit;
+       int             referrals;
     char       *newSuperior=NULL;
 
     infile = NULL;
-    not = contoper = verbose = remove = want_bindpw = debug = manageDSAit = 0;
+    not = contoper = verbose = remove = want_bindpw =
+               debug = manageDSAit = referrals = 0;
     authmethod = LDAP_AUTH_SIMPLE;
        version = -1;
 
     myname = (myname = strrchr(argv[0], '/')) == NULL ? argv[0] : ++myname;
 
-    while (( i = getopt( argc, argv, "cD:d:Ef:h:IKkMnP:p:rs:U:vWw:X:Y:Z" )) != EOF ) {
+    while (( i = getopt( argc, argv, "cCD:d:Ef:h:IKkMnP:p:rs:U:vWw:X:Y:Z" )) != EOF ) {
        switch( i ) {
        case 'k':       /* kerberos bind */
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
@@ -126,6 +129,9 @@ main(int argc, char **argv)
        case 'c':       /* continuous operation mode */
            ++contoper;
            break;
+       case 'C':
+               referrals++;
+               break;
        case 'h':       /* ldap host */
            ldaphost = strdup( optarg );
            break;
@@ -341,8 +347,14 @@ main(int argc, char **argv)
        return( EXIT_FAILURE );
     }
 
-       /* don't chase referrals */
-       ldap_set_option( ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF );
+       /* referrals */
+       if( ldap_set_option( ld, LDAP_OPT_REFERRALS,
+               referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
+       {
+               fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
+                       referrals ? "on" : "off" );
+               return EXIT_FAILURE;
+       }
 
        if (version == -1 ) {
                version = 3;
@@ -360,6 +372,7 @@ main(int argc, char **argv)
                        ldap_perror( ld, "ldap_start_tls" );
                        return( EXIT_FAILURE );
                }
+               fprintf( stderr, "WARNING: could not start TLS\n" );
        }
 
        if (want_bindpw) {
@@ -431,7 +444,8 @@ main(int argc, char **argv)
                err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, &ctrls );
 
                if( err != LDAP_OPT_SUCCESS ) {
-                       fprintf( stderr, "Could not set Manage DSA IT Control\n" );
+                       fprintf( stderr, "Could not set ManageDSAit %scontrol\n",
+                               c.ldctl_iscritical ? "critical " : "" );
                        if( c.ldctl_iscritical ) {
                                exit( EXIT_FAILURE );
                        }

diff --git a/clients/tools/ldappasswd.c b/clients/tools/ldappasswd.c
index 7d558620e033077319c33a739cc3d124790d5b1e..1a8c8984e263fc602b9ee585212b8aa0a0147db0 100644 (file)
--- a/clients/tools/ldappasswd.c
+++ b/clients/tools/ldappasswd.c
@@ -34,6 +34,7 @@ usage(const char *s)
 "      -a secret\told password\n"
 "      -A\t\tprompt for old password\n"
 "      -d level\tdebugging level\n"
+"      -C\t\tchase referrals\n"
 "      -D binddn\tbind DN\n"
 "      -E\t\trequest SASL privacy (-EE to make it critical)\n"
 "      -h host\t\tLDAP server (default: localhost)\n"
@@ -86,6 +87,7 @@ main( int argc, char *argv[] )
        int             sasl_privacy = 0;
 #endif
        int             use_tls = 0;
+       int             referrals = 0;
        LDAP           *ld;
        struct berval *bv = NULL;
 
@@ -96,7 +98,7 @@ main( int argc, char *argv[] )
                usage (argv[0]);
 
        while( (i = getopt( argc, argv,
-               "Aa:D:d:EIh:np:Ss:U:vWw:X:Y:Z" )) != EOF )
+               "Aa:CD:d:EIh:np:Ss:U:vWw:X:Y:Z" )) != EOF )
        {
                switch (i) {
                case 'A':       /* prompt for oldr password */
@@ -113,6 +115,9 @@ main( int argc, char *argv[] )
                                }
                        }
                        break;
+               case 'C':
+                       referrals++;
+                       break;
                case 'D':       /* bind distinguished name */
                        binddn = strdup (optarg);
                        break;
@@ -139,7 +144,6 @@ main( int argc, char *argv[] )
 
                case 's':       /* new password (secret) */
                        newpw = strdup (optarg);
-
                        {
                                char* p;
 
@@ -307,8 +311,14 @@ main( int argc, char *argv[] )
                return EXIT_FAILURE;
        }
 
-       /* don't chase referrals */
-       ldap_set_option( ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF );
+       /* referrals */
+       if (ldap_set_option( ld, LDAP_OPT_REFERRALS,
+               referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
+       {
+               fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
+                       referrals ? "on" : "off" );
+               return EXIT_FAILURE;
+       }
 
        /* LDAPv3 only */
        version = 3;
@@ -323,6 +333,7 @@ main( int argc, char *argv[] )
                        ldap_perror( ld, "ldap_start_tls" );
                        return( EXIT_FAILURE );
                }
+               fprintf( stderr, "WARNING: could not start TLS\n" );
        }
 
        if ( authmethod == LDAP_AUTH_SASL ) {

diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c
index eace40916a5529a0a47dca90c64ec3535b4b2cde..0bd21c266fd1700d45b08eca72abaf28a8589ff7 100644 (file)
--- a/clients/tools/ldapsearch.c
+++ b/clients/tools/ldapsearch.c
@@ -66,7 +66,6 @@ usage( const char *s )
 "\t-n\t\tshow what would be done but don't actually search\n"
 "\t-p port\t\tport on LDAP server\n"
 "\t-P version\tprocotol version (default: 3)\n"
-"\t-R\t\tdo not automatically follow referrals\n"
 "\t-s scope\tone of base, one, or sub (search scope)\n"
 "\t-S attr\t\tsort the results by attribute `attr'\n"
 "\t-t\t\twrite binary values to files in temporary directory\n"
@@ -123,10 +122,14 @@ static int dosearch LDAP_P((
        LDAP    *ld,
        char    *base,
        int             scope,
+       char    *filtpatt,
+       char    *value,
        char    **attrs,
        int             attrsonly,
-       char    *filtpatt,
-       char    *value));
+       LDAPControl **sctrls,
+       LDAPControl **cctrls,
+       struct timeval *timelimit,
+       int     sizelimit ));
 
 static char *tmpdir = NULL;
 static char *urlpre = NULL;
@@ -158,19 +161,16 @@ main( int argc, char **argv )
        LDAP            *ld;
 
        infile = NULL;
-       debug = verbose = not = vals2tmp =
+       debug = verbose = not = vals2tmp = referrals =
                attrsonly = manageDSAit = ldif = want_bindpw = 0;
 
        deref = sizelimit = timelimit = version = -1;
 
-       /* default should be off */
-       referrals = 1;
-
        scope = LDAP_SCOPE_SUBTREE;
        authmethod = LDAP_AUTH_SIMPLE;
 
        while (( i = getopt( argc, argv,
-               "Aa:b:D:d:Ef:h:IKkLl:MnP:p:RS:s:T:tU:uV:vWw:X:Y:Zz:")) != EOF )
+               "Aa:b:CD:d:Ef:h:IKkLl:MnP:p:RS:s:T:tU:uV:vWw:X:Y:Zz:")) != EOF )
        {
        switch( i ) {
        case 'n':       /* do nothing */
@@ -209,8 +209,10 @@ main( int argc, char **argv )
                /* enable Manage DSA IT */
                manageDSAit++;
                break;
-       case 'R':       /* don't automatically chase referrals */
-               referrals = 0;
+       case 'C':
+               referrals++;
+               break;
+       case 'R':       /* ignore */
                break;
        case 'A':       /* retrieve attribute names only -- no values */
                ++attrsonly;
@@ -471,30 +473,35 @@ main( int argc, char **argv )
 
        if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
                perror( "ldap_init" );
-               return( EXIT_FAILURE );
+               return EXIT_FAILURE;
        }
 
        if (deref != -1 &&
                ldap_set_option( ld, LDAP_OPT_DEREF, (void *) &deref ) != LDAP_OPT_SUCCESS )
        {
                fprintf( stderr, "Could not set LDAP_OPT_DEREF %d\n", deref );
+               return EXIT_FAILURE;
        }
        if (timelimit != -1 &&
                ldap_set_option( ld, LDAP_OPT_TIMELIMIT, (void *) &timelimit ) != LDAP_OPT_SUCCESS )
        {
                fprintf( stderr, "Could not set LDAP_OPT_TIMELIMIT %d\n", timelimit );
+               return EXIT_FAILURE;
        }
        if (sizelimit != -1 &&
                ldap_set_option( ld, LDAP_OPT_SIZELIMIT, (void *) &sizelimit ) != LDAP_OPT_SUCCESS )
        {
                fprintf( stderr, "Could not set LDAP_OPT_SIZELIMIT %d\n", sizelimit );
+               return EXIT_FAILURE;
        }
-       if (referrals != -1 &&
-               ldap_set_option( ld, LDAP_OPT_REFERRALS,
-                                (referrals ? LDAP_OPT_ON : LDAP_OPT_OFF) ) != LDAP_OPT_SUCCESS )
+
+       /* referrals */
+       if (ldap_set_option( ld, LDAP_OPT_REFERRALS,
+               referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
        {
                fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
                        referrals ? "on" : "off" );
+               return EXIT_FAILURE;
        }
 
        if (version == -1 ) {
@@ -506,13 +513,15 @@ main( int argc, char **argv )
        {
                fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
                        version );
+               return EXIT_FAILURE;
        }
 
        if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
                if ( use_tls > 1 ) {
                        ldap_perror( ld, "ldap_start_tls" );
-                       return( EXIT_FAILURE );
+                       return EXIT_FAILURE;
                }
+               fprintf( stderr, "WARNING: could not start TLS\n" );
        }
 
        if (want_bindpw) {
@@ -583,7 +592,8 @@ main( int argc, char **argv )
                err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, &ctrls );
 
                if( err != LDAP_OPT_SUCCESS ) {
-                       fprintf( stderr, "Could not set Manage DSA IT Control\n" );
+                       fprintf( stderr, "Could not set ManageDSAit %scontrol\n",
+                               c.ldctl_iscritical ? "critical " : "" );
                        if( c.ldctl_iscritical ) {
                                exit( EXIT_FAILURE );
                        }
@@ -631,7 +641,8 @@ main( int argc, char **argv )
        }
 
        if ( infile == NULL ) {
-               rc = dosearch( ld, base, scope, attrs, attrsonly, NULL, filtpattern );
+               rc = dosearch( ld, base, scope, NULL, filtpattern,
+                       attrs, attrsonly, NULL, NULL, NULL, -1 );
 
        } else {
                rc = 0;
@@ -643,8 +654,8 @@ main( int argc, char **argv )
                        } else {
                                first = 0;
                        }
-                       rc = dosearch( ld, base, scope, attrs, attrsonly,
-                               filtpattern, line );
+                       rc = dosearch( ld, base, scope, filtpattern, line,
+                               attrs, attrsonly, NULL, NULL, NULL, -1 );
                }
                if ( fp != stdin ) {
                        fclose( fp );
@@ -660,10 +671,14 @@ static int dosearch(
        LDAP    *ld,
        char    *base,
        int             scope,
+       char    *filtpatt,
+       char    *value,
        char    **attrs,
        int             attrsonly,
-       char    *filtpatt,
-       char    *value)
+       LDAPControl **sctrls,
+       LDAPControl **cctrls,
+       struct timeval *timelimit,
+       int sizelimit )
 {
        char            filter[ BUFSIZ ];
        int                     rc, first;
@@ -694,12 +709,12 @@ static int dosearch(
                return LDAP_SUCCESS;
        }
 
-       msgid = ldap_search( ld, base, scope, filter, attrs, attrsonly );
-       if( msgid == -1 ) {
-               int ld_errno;
+       rc = ldap_search_ext( ld, base, scope, filter, attrs, attrsonly,
+               sctrls, cctrls, timelimit, sizelimit, &msgid );
+
+       if( rc != LDAP_SUCCESS ) {
                ldap_perror( ld, "ldap_search" );
-               ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ld_errno);
-               return( ld_errno );
+               return( rc );
        }
 
        nresponses = nentries = nreferences = nextended = npartial = 0;