ldap/servers/slapd/tools/ldclt/ldapfct.c | 912 ++++++++++++++++--------------
ldap/servers/slapd/tools/ldclt/ldclt.h | 1
ldap/servers/slapd/tools/ldclt/scalab01.c | 133 ----
3 files changed, 501 insertions(+), 545 deletions(-)
New commits:
commit aea218c41961502b1cbdfc4c082ed494db6a49a7
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Aug 3 12:04:52 2011 -0600
Bug 727511 - ldclt SSL search requests are failing with "illegal error number
-1" error
https://bugzilla.redhat.com/show_bug.cgi?id=727511
Resolves: bug 727511
Bug Description: ldclt SSL search requests are failing with "illegal error number
-1" error
Reviewed by: nkinder (Thanks!)
Branch: master
Fix Description: Make all code in ldclt use the same function for creating
and binding to an LDAP*. Add code to initialize TLS/SSL when using openldap.
If using cert client auth, add code to authenticate to the token using the
given password.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c
b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 317628c..7123a1a 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -261,6 +261,11 @@ dd/mm/yy | Author | Comments
#endif
#include <prprf.h>
+#include <plstr.h>
+#include <nspr.h>
+#include <nss.h>
+#include <ssl.h>
+#include <pk11pub.h>
#define LDCLT_DEREF_ATTR "secretary"
int ldclt_create_deref_control( LDAP *ld, char *derefAttr, char **attrs, LDAPControl
**ctrlp );
@@ -598,211 +603,266 @@ referralSetup (
-
/* ****************************************************************************
- FUNCTION : connectToServer
- PURPOSE : Realise the connection to the server.
- If requested by the user, it also realize the
- disconnection prior to connect.
- INPUT : tttctx = this thread's thread_context
- OUTPUT : None.
- RETURN : -1 if error, 0 else.
- DESCRIPTION :
+ FUNCTION : dirname
+ PURPOSE : given a relative or absolute path name, return
+ the name of the directory containing the path
+ INPUT : path
+ OUTPUT : none
+ RETURN : directory part of path or "."
+ DESCRIPTION : caller must free return value when done
*****************************************************************************/
-int
-connectToServer (
- thread_context *tttctx)
+static char *
+ldclt_dirname(const char *path) {
+ char sep = PR_GetDirectorySeparator();
+ char *ptr = NULL;
+ char *ret = NULL;
+ if (path && ((ptr = strrchr(path, sep))) && *(ptr+1)) {
+ ret = PL_strndup(path, ptr-path);
+ } else {
+ ret = PL_strdup(".");
+ }
+
+ return ret;
+}
+
+static char *
+ldclt_get_sec_pwd(PK11SlotInfo *slot, PRBool retry, void *arg)
{
- int ret; /* Return value */
- LBER_SOCKET fd; /* LDAP cnx's fd */
- int v2v3; /* LDAP version used */
- struct berval cred = {0, NULL};
+ char *pwd = (char *)arg;
+ return PL_strdup(pwd);
+}
- /*
- * Maybe close the connection ?
- * We will do this *here* to keep the cnx the longest time open.
- */
- if ((mctx.mode & BIND_EACH_OPER) && (tttctx->ldapCtx != NULL))
- {
- /*
- * Maybe the user want the connection to be *closed* rather than
- * being kindly unbinded ?
- */
- if (mctx.mode & CLOSE_FD)
- {
- /*
- * Get the corresponding fd
- */
-#ifdef WORKAROUND_4197228
- if (getFdFromLdapSession (tttctx->ldapCtx, &fd) < 0)
- {
- printf ("ldclt[%d]: T%03d: Cannot extract fd from ldap session\n",
- mctx.pid, tttctx->thrdNum);
- fflush (stdout);
- return (-1);
- }
-#else
- ret = ldap_get_option (tttctx->ldapCtx, LDAP_OPT_DESC, &fd);
- if (ret < 0)
- {
- printf ("ldclt[%d]: T%03d: Cannot ldap_get_option(LDAP_OPT_DESC)\n",
- mctx.pid, tttctx->thrdNum);
- fflush (stdout);
- return (-1);
- }
-#endif
-#ifdef TRACE_FD_GET_OPTION_BUG
- printf ("ldclt[%d]: T%03d: fd=%d\n", mctx.pid, tttctx->thrdNum,
(int)fd);
-#endif
- if (close ((int)fd) < 0)
- {
- perror ("ldctx");
- printf ("ldclt[%d]: T%03d: cannot close(fd=%d), error=%d (%s)\n",
- mctx.pid, tttctx->thrdNum, (int)fd, errno, strerror (errno));
- return (-1);
- }
- }
+static int
+ldclt_clientauth(thread_context *tttctx, const char *path, const char *certname, const
char *pwd)
+{
+ const char *colon = NULL;
+ char *token_name = NULL;
+ PK11SlotInfo *slot = NULL;
+ int rc = 0;
+
+ rc = NSS_Initialize(path, "", "", SECMOD_DB, NSS_INIT_READONLY);
+ if (rc != SECSuccess) {
+ printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
+ mctx.pid, tttctx->thrdNum, path, PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
- /*
- * Ok, anyway, we must ldap_unbind() to release our contextes
- * at the client side, otherwise this process will rocket through
- * the ceiling.
- * But don't be afraid, the UNBIND operation never reach the
- * server that will only see a suddent socket disconnection.
- */
- ret = ldap_unbind_ext (tttctx->ldapCtx, NULL, NULL);
- if (ret != LDAP_SUCCESS)
- {
- fprintf (stderr, "ldclt[%d]: T%03d: cannot ldap_unbind(), error=%d
(%s)\n",
- mctx.pid, tttctx->thrdNum, ret,strerror (ret));
- fflush (stderr);
- if (addErrorStat (ret) < 0)
- return (-1);
- return (-1);
- }
- tttctx->ldapCtx = NULL;
+ if ((colon = PL_strchr(certname, ':' ))) {
+ token_name = PL_strndup(certname, colon-certname);
}
- /*
- * Maybe create the LDAP context ?
- */
- if (tttctx->ldapCtx == NULL)
- {
- const char *mech = LDAP_SASL_SIMPLE;
- const char *binddn = NULL;
- const char *passwd = NULL;
+ if (token_name) {
+ slot = PK11_FindSlotByName(token_name);
+ } else {
+ slot = PK11_GetInternalKeySlot();
+ }
+
+ if (!slot) {
+ printf ("ldclt[%d]: T%03d: Cannot find slot for token %s - %d\n",
+ mctx.pid, tttctx->thrdNum,
+ token_name ? token_name : "internal", PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
+
+ NSS_SetDomesticPolicy();
+
+ PK11_SetPasswordFunc(ldclt_get_sec_pwd);
+
+ rc = PK11_Authenticate(slot, PR_FALSE, (void *)pwd);
+ if (rc != SECSuccess) {
+ printf ("ldclt[%d]: T%03d: Cannot authenticate to token %s - %d\n",
+ mctx.pid, tttctx->thrdNum,
+ token_name ? token_name : "internal", PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
+
+ if ((rc = ldap_set_option(tttctx->ldapCtx, LDAP_OPT_X_TLS_CERTFILE, certname))) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_set_option(ld, LDAP_OPT_X_CERTFILE, %s),
errno=%d ldaperror=%d:%s\n",
+ mctx.pid, tttctx->thrdNum, certname, errno, rc, my_ldap_err2string(rc));
+ fflush (stdout);
+ goto done;
+ }
+
+ if ((rc = ldap_set_option(tttctx->ldapCtx, LDAP_OPT_X_TLS_KEYFILE, pwd))) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_set_option(ld, LDAP_OPT_X_KEYFILE, %s),
errno=%d ldaperror=%d:%s\n",
+ mctx.pid, tttctx->thrdNum, pwd, errno, rc, my_ldap_err2string(rc));
+ fflush (stdout);
+ goto done;
+ }
+
+done:
+ PL_strfree(token_name);
+ if (slot) {
+ PK11_FreeSlot(slot);
+ }
+
+ return rc;
+}
+
+/* mctx is a global */
+LDAP *
+connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPasswd,
unsigned int mode, unsigned int mod2)
+{
+ LDAP *ld = NULL;
+ const char *mech = LDAP_SASL_SIMPLE;
+ struct berval cred = {0, NULL};
+ int v2v3 = LDAP_VERSION3;
+ const char *binddn = NULL;
+ const char *passwd = NULL;
#if defined(USE_OPENLDAP)
- char *ldapurl = NULL;
+ char *ldapurl = NULL;
#endif
+ int thrdNum = 0;
+ int ret = -1;
+ int binded = 0;
+
+ if (tttctx) {
+ thrdNum = tttctx->thrdNum;
+ }
#if defined(USE_OPENLDAP)
- ldapurl = PR_smprintf("ldap%s://%s:%d/",
- (mctx.mode & SSL) ? "s" : "",
- mctx.hostname, mctx.port);
- if ((ret = ldap_initialize(&tttctx->ldapCtx, ldapurl))) {
- printf ("ldclt[%d]: T%03d: Cannot ldap_initialize (%s), errno=%d
ldaperror=%d:%s\n",
- mctx.pid, tttctx->thrdNum, ldapurl, errno, ret, my_ldap_err2string(ret));
- fflush (stdout);
- PR_smprintf_free(ldapurl);
- return (-1);
+ ldapurl = PR_smprintf("ldap%s://%s:%d/",
+ (mode & SSL) ? "s" : "",
+ mctx.hostname, mctx.port);
+ if ((ret = ldap_initialize(&ld, ldapurl))) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_initialize (%s), errno=%d
ldaperror=%d:%s\n",
+ mctx.pid, thrdNum, ldapurl, errno, ret, my_ldap_err2string(ret));
+ fflush (stdout);
+ goto done;
+ }
+ PR_smprintf_free(ldapurl);
+ ldapurl = NULL;
+ if (mode & SSL) {
+ int optval = 0;
+ /* bad, but looks like the tools expect to be able to use an ip address
+ for the hostname, so have to defeat fqdn checking in cn of subject of server cert
*/
+ int ssl_strength = LDAP_OPT_X_TLS_NEVER;
+ char *certdir = ldclt_dirname(mctx.certfile);
+ if ((ret = ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &optval))) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX),
errno=%d ldaperror=%d:%s\n",
+ mctx.pid, thrdNum, errno, ret, my_ldap_err2string(ret));
+ fflush (stdout);
+ free(certdir);
+ goto done;
}
- PR_smprintf_free(ldapurl);
- ldapurl = NULL;
+ if ((ret = ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &ssl_strength))) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_set_option(ld,
LDAP_OPT_X_TLS_REQUIRE_CERT), errno=%d ldaperror=%d:%s\n",
+ mctx.pid, thrdNum, errno, ret, my_ldap_err2string(ret));
+ fflush (stdout);
+ free(certdir);
+ goto done;
+ }
+ /* tell it where our cert db is */
+ if ((ret = ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, certdir))) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_set_option(ld, LDAP_OPT_X_CACERTDIR,
%s), errno=%d ldaperror=%d:%s\n",
+ mctx.pid, thrdNum, certdir, errno, ret, my_ldap_err2string(ret));
+ fflush (stdout);
+ free(certdir);
+ goto done;
+ }
+ if ((mode & CLTAUTH) &&
+ (ret = ldclt_clientauth(tttctx, certdir, mctx.cltcertname, mctx.keydbpin))) {
+ free(certdir);
+ goto done;
+ }
+ free(certdir);
+ }
#else /* !USE_OPENLDAP */
+ /*
+ * SSL is enabled ?
+ */
+ if (mode & SSL) {
/*
- * SSL is enabled ?
+ * LDAP session initialization in SSL mode
+ * added by: B Kolics (11/10/00)
*/
- if (mctx.mode & SSL)
- {
- /*
- * LDAP session initialization in SSL mode
- * added by: B Kolics (11/10/00)
- */
- tttctx->ldapCtx = ldapssl_init(mctx.hostname, mctx.port, 1);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: T%03d: After ldapssl_init (%s, %d), ldapCtx=0x%p\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port,
- tttctx->ldapCtx);
- if (tttctx->ldapCtx == NULL)
- {
- printf ("ldclt[%d]: T%03d: Cannot ldapssl_init (%s, %d), errno=%d\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port, errno);
- fflush (stdout);
- return (-1);
- }
- /*
- * Client authentication is used ?
- */
- if (mctx.mode & CLTAUTH)
- {
- ret = ldapssl_enable_clientauth(tttctx->ldapCtx, "", mctx.keydbpin,
mctx.cltcertname);
- if (mctx.mode & VERY_VERBOSE)
- printf
- ("ldclt[%d]: T%03d: After ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
- mctx.pid, tttctx->thrdNum, tttctx->ldapCtx, mctx.keydbpin,
- mctx.cltcertname);
- if (ret < 0)
- {
- printf
- ("ldclt[%d]: T%03d: Cannot ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
- mctx.pid, tttctx->thrdNum, tttctx->ldapCtx, mctx.keydbpin,
- mctx.cltcertname);
- ldap_perror(tttctx->ldapCtx, "ldapssl_enable_clientauth");
- fflush (stdout);
- return (-1);
- }
- }
- } else {
- /*
- * connection initialization in normal, unencrypted mode
- */
- tttctx->ldapCtx = ldap_init (mctx.hostname, mctx.port);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: T%03d: After ldap_init (%s, %d), ldapCtx=0x%p\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port,
- tttctx->ldapCtx);
- if (tttctx->ldapCtx == NULL)
- {
- printf ("ldclt[%d]: T%03d: Cannot ldap_init (%s, %d), errno=%d\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port, errno);
+ ld = ldapssl_init(mctx.hostname, mctx.port, 1);
+ if (mode & VERY_VERBOSE)
+ printf ("ldclt[%d]: T%03d: After ldapssl_init (%s, %d), ldapCtx=0x%p\n",
+ mctx.pid, thrdNum, mctx.hostname, mctx.port,
+ ld);
+ if (ld == NULL) {
+ printf ("ldclt[%d]: T%03d: Cannot ldapssl_init (%s, %d), errno=%d\n",
+ mctx.pid, thrdNum, mctx.hostname, mctx.port, errno);
+ fflush (stdout);
+ ret = -1;
+ goto done;
+ }
+ /*
+ * Client authentication is used ?
+ */
+ if (mode & CLTAUTH) {
+ ret = ldapssl_enable_clientauth(ld, "", mctx.keydbpin,
mctx.cltcertname);
+ if (mode & VERY_VERBOSE)
+ printf
+ ("ldclt[%d]: T%03d: After ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
+ mctx.pid, thrdNum, ld, mctx.keydbpin,
+ mctx.cltcertname);
+ if (ret < 0) {
+ printf
+ ("ldclt[%d]: T%03d: Cannot ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
+ mctx.pid, thrdNum, ld, mctx.keydbpin, mctx.cltcertname);
+ ldap_perror(ld, "ldapssl_enable_clientauth");
fflush (stdout);
- return (-1);
+ goto done;
}
}
+ } else {
+ /*
+ * connection initialization in normal, unencrypted mode
+ */
+ ld = ldap_init (mctx.hostname, mctx.port);
+ if (mode & VERY_VERBOSE)
+ printf ("ldclt[%d]: T%03d: After ldap_init (%s, %d), ldapCtx=0x%p\n",
+ mctx.pid, thrdNum, mctx.hostname, mctx.port,
+ ld);
+ if (ld == NULL) {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_init (%s, %d), errno=%d\n",
+ mctx.pid, thrdNum, mctx.hostname, mctx.port, errno);
+ fflush (stdout);
+ ret = -1;
+ goto done;
+ }
+ }
#endif /* !USE_OPENLDAP */
- if (mctx.mode & CLTAUTH) {
- mech = "EXTERNAL";
- binddn = "";
- passwd = NULL;
- } else {
- binddn = tttctx->bufBindDN?tttctx->bufBindDN:mctx.bindDN;
- passwd = tttctx->bufPasswd?tttctx->bufPasswd:mctx.passwd;
- if (passwd) {
- cred.bv_val = (char *)passwd;
- cred.bv_len = strlen(passwd);
- }
+ if (mode & CLTAUTH) {
+ mech = "EXTERNAL";
+ binddn = "";
+ passwd = NULL;
+ } else {
+ binddn = bufBindDN?bufBindDN:mctx.bindDN;
+ passwd = bufPasswd?bufPasswd:mctx.passwd;
+ if (passwd) {
+ cred.bv_val = (char *)passwd;
+ cred.bv_len = strlen(passwd);
}
+ }
- if (mctx.mode & LDAP_V2)
- v2v3 = LDAP_VERSION2;
- else
- v2v3 = LDAP_VERSION3;
+ if (mode & LDAP_V2)
+ v2v3 = LDAP_VERSION2;
+ else
+ v2v3 = LDAP_VERSION3;
- ret = ldap_set_option (tttctx->ldapCtx, LDAP_OPT_PROTOCOL_VERSION, &v2v3);
- if (ret < 0)
- {
- printf ("ldclt[%d]: T%03d: Cannot
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)\n",
- mctx.pid, tttctx->thrdNum);
- fflush (stdout);
- return (-1);
- }
+ ret = ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &v2v3);
+ if (ret < 0) {
+ printf ("ldclt[%d]: T%03d: Cannot
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)\n",
+ mctx.pid, thrdNum);
+ fflush (stdout);
+ ret = -1;
+ goto done;
+ }
- /*
- * Set the referral options...
- */
- if (referralSetup (tttctx) < 0)
- return (-1);
+ /*
+ * Set the referral options...
+ */
+ if (tttctx && (referralSetup (tttctx) < 0)) {
+ ret = -1;
+ goto done;
}
/*
@@ -813,11 +873,13 @@ connectToServer (
* below in this function ?
* 03-05-01 : no cleanup I think, cf M2_RNDBINDFILE
*/
- if ((mctx.bindDN == NULL) && ((!(mctx.mod2 & M2_RNDBINDFILE))
- && (!(mctx.mod2 & M2_SASLAUTH))))
- { /*JLS 05-03-01*/
- tttctx->binded = 1; /*JLS 05-03-01*/
- return (0); /*JLS 05-03-01*/
+ if ((bufBindDN == NULL) && (mctx.bindDN == NULL) &&
+ ((!(mod2 & M2_RNDBINDFILE)) && (!(mod2 & M2_SASLAUTH)))) {/*JLS
05-03-01*/
+ if (tttctx) {
+ tttctx->binded = 1; /*JLS 05-03-01*/
+ }
+ ret = 0;
+ goto done;
} /*JLS 05-03-01*/
/*
@@ -826,181 +888,301 @@ connectToServer (
/*
* for SSL client authentication, SASL BIND is used
*/
- if ((mctx.mode & CLTAUTH) && ((!(tttctx->binded)) ||
- (mctx.mode & BIND_EACH_OPER)))
- {
- if (mctx.mode & VERY_VERBOSE)
+ if (tttctx) {
+ binded = tttctx->binded;
+ }
+ if ((mode & CLTAUTH) && ((!(binded)) ||
+ (mode & BIND_EACH_OPER))) {
+ if (mode & VERY_VERBOSE)
printf ("ldclt[%d]: T%03d: Before ldap_sasl_bind_s\n",
- mctx.pid, tttctx->thrdNum);
- ret = ldap_sasl_bind_s (tttctx->ldapCtx, "", "EXTERNAL", NULL,
NULL, NULL,
+ mctx.pid, thrdNum);
+ ret = ldap_sasl_bind_s (ld, "", "EXTERNAL", NULL, NULL, NULL,
NULL);
- if (mctx.mode & VERY_VERBOSE)
+ if (mode & VERY_VERBOSE)
printf ("ldclt[%d]: T%03d: After ldap_sasl_bind_s\n",
- mctx.pid, tttctx->thrdNum);
- if (ret == LDAP_SUCCESS) /*JLS 18-12-00*/
- tttctx->binded = 1; /*JLS 18-12-00*/
- else /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
- tttctx->binded = 0; /*JLS 18-12-00*/
- if (ignoreError (ret)) /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
- if (!(mctx.mode & QUIET)) /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
+ mctx.pid, thrdNum);
+ if (ret == LDAP_SUCCESS) { /*JLS 18-12-00*/
+ if (tttctx) {
+ tttctx->binded = 1; /*JLS 18-12-00*/
+ }
+ } else { /*JLS 18-12-00*/
+ if (tttctx) {
+ tttctx->binded = 0; /*JLS 18-12-00*/
+ }
+ if (ignoreError (ret)) { /*JLS 18-12-00*/
+ if (!(mode & QUIET)) { /*JLS 18-12-00*/
printf ("ldclt[%d]: T%03d: Cannot ldap_sasl_bind_s, error=%d (%s)\n",
- mctx.pid, tttctx->thrdNum, ret, my_ldap_err2string (ret));
+ mctx.pid, thrdNum, ret, my_ldap_err2string (ret));
fflush (stdout); /*JLS 18-12-00*/
} /*JLS 18-12-00*/
if (addErrorStat (ret) < 0) /*JLS 18-12-00*/
- return (-1); /*JLS 18-12-00*/
- return (0); /*JLS 18-12-00*/
- } /*JLS 18-12-00*/
- else /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
+ ret = -1;
+ else
+ ret = 0;
+ goto done;
+ } else { /*JLS 18-12-00*/
printf ("ldclt[%d]: T%03d: Cannot ldap_sasl_bind_s, error=%d (%s)\n",
- mctx.pid, tttctx->thrdNum, ret, my_ldap_err2string (ret));
+ mctx.pid, thrdNum, ret, my_ldap_err2string (ret));
fflush (stdout); /*JLS 18-12-00*/
- tttctx->exitStatus = EXIT_NOBIND; /*JLS 18-12-00*/
- if (addErrorStat (ret) < 0) /*JLS 18-12-00*/
- return (-1); /*JLS 18-12-00*/
- return (-1); /*JLS 18-12-00*/
+ if (tttctx)
+ tttctx->exitStatus = EXIT_NOBIND; /*JLS 18-12-00*/
+ (void)addErrorStat(ret);
+ ret = -1;
+ goto done;
} /*JLS 18-12-00*/
}
- } else if ((mctx.mod2 & M2_SASLAUTH) && ((!(tttctx->binded)) ||
- (mctx.mode & BIND_EACH_OPER))) {
+ } else if ((mod2 & M2_SASLAUTH) && ((!(binded)) ||
+ (mode & BIND_EACH_OPER))) {
void *defaults;
char *my_saslauthid = NULL;
if ( mctx.sasl_mech == NULL) {
fprintf( stderr, "Please specify the SASL mechanism name when "
- "using SASL options\n");
- return (-1);
+ "using SASL options\n");
+ ret = -1;
+ goto done;
}
if ( mctx.sasl_secprops != NULL) {
- ret = ldap_set_option( tttctx->ldapCtx, LDAP_OPT_X_SASL_SECPROPS,
+ ret = ldap_set_option( ld, LDAP_OPT_X_SASL_SECPROPS,
(void *) mctx.sasl_secprops );
if ( ret != LDAP_SUCCESS ) {
fprintf( stderr, "Unable to set LDAP_OPT_X_SASL_SECPROPS: %s\n",
- mctx.sasl_secprops );
- return (-1);
+ mctx.sasl_secprops );
+ goto done;
}
}
- /*
- * Generate the random authid if set up so
- */
- if (mctx.mod2 & M2_RANDOM_SASLAUTHID)
- {
+ /*
+ * Generate the random authid if set up so
+ */
+ if ((mod2 & M2_RANDOM_SASLAUTHID) && tttctx) {
rnd (tttctx->buf2, mctx.sasl_authid_low, mctx.sasl_authid_high,
- mctx.sasl_authid_nbdigit);
+ mctx.sasl_authid_nbdigit);
strncpy (&(tttctx->bufSaslAuthid[tttctx->startSaslAuthid]),
- tttctx->buf2, mctx.sasl_authid_nbdigit);
+ tttctx->buf2, mctx.sasl_authid_nbdigit);
my_saslauthid = tttctx->bufSaslAuthid;
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: T%03d: Sasl Authid=\"%s\"\n",
- mctx.pid, tttctx->thrdNum, tttctx->bufSaslAuthid);
- }
- else
- {
+ if (mode & VERY_VERBOSE)
+ printf ("ldclt[%d]: T%03d: Sasl Authid=\"%s\"\n",
+ mctx.pid, thrdNum, tttctx->bufSaslAuthid);
+ } else {
my_saslauthid = mctx.sasl_authid;
}
- defaults = ldaptool_set_sasl_defaults( tttctx->ldapCtx, mctx.sasl_flags,
mctx.sasl_mech,
- my_saslauthid, mctx.sasl_username, mctx.passwd, mctx.sasl_realm );
+ defaults = ldaptool_set_sasl_defaults( ld, mctx.sasl_flags, mctx.sasl_mech,
+ my_saslauthid, mctx.sasl_username, mctx.passwd, mctx.sasl_realm );
if (defaults == NULL) {
perror ("malloc");
exit (LDAP_NO_MEMORY);
}
#if defined(USE_OPENLDAP)
- ret = ldap_sasl_interactive_bind_s( tttctx->ldapCtx, mctx.bindDN, mctx.sasl_mech,
- NULL, NULL, mctx.sasl_flags,
- ldaptool_sasl_interact, defaults );
+ ret = ldap_sasl_interactive_bind_s( ld, mctx.bindDN, mctx.sasl_mech,
+ NULL, NULL, mctx.sasl_flags,
+ ldaptool_sasl_interact, defaults );
#else
- ret = ldap_sasl_interactive_bind_ext_s( tttctx->ldapCtx, mctx.bindDN,
mctx.sasl_mech,
- NULL, NULL, mctx.sasl_flags,
- ldaptool_sasl_interact, defaults, NULL );
+ ret = ldap_sasl_interactive_bind_ext_s( ld, mctx.bindDN, mctx.sasl_mech,
+ NULL, NULL, mctx.sasl_flags,
+ ldaptool_sasl_interact, defaults, NULL );
#endif
if (ret != LDAP_SUCCESS ) {
- tttctx->binded = 0;
- if (!(mctx.mode & QUIET)) {
+ if (tttctx) {
+ tttctx->binded = 0;
+ }
+ if (!(mode & QUIET)) {
fprintf(stderr, "Error: could not bind: %d:%s\n",
ret, my_ldap_err2string(ret));
}
if (addErrorStat (ret) < 0)
- return (-1);
+ goto done;
} else {
+ if (tttctx) {
tttctx->binded = 1;
+ }
}
ldaptool_free_defaults( defaults );
} else {
- if (((mctx.bindDN != NULL) || (mctx.mod2 & M2_RNDBINDFILE)) &&
/*03-05-01*/
- ((!(tttctx->binded)) || (mctx.mode & BIND_EACH_OPER)))
- {
+ if (((mctx.bindDN != NULL) || (mod2 & M2_RNDBINDFILE)) && /*03-05-01*/
+ ((!(binded)) || (mode & BIND_EACH_OPER))) {
struct berval *servercredp = NULL;
- char *binddn = NULL;
- char *passwd = NULL;
-
- if (buildNewBindDN (tttctx) < 0) /*JLS 05-01-01*/
- return (-1); /*JLS 05-01-01*/
- if (tttctx->bufPasswd) {
- binddn = tttctx->bufBindDN;
- passwd = tttctx->bufPasswd;
+ const char *binddn = NULL;
+ const char *passwd = NULL;
+
+ if (tttctx && (buildNewBindDN (tttctx) < 0)) { /*JLS 05-01-01*/
+ ret = -1;
+ goto done;
+ }
+ if (tttctx && tttctx->bufPasswd) {
+ binddn = tttctx->bufBindDN;
+ passwd = tttctx->bufPasswd;
+ } else if (bufPasswd) {
+ binddn = bufBindDN;
+ passwd = bufPasswd;
} else if (mctx.passwd) {
- binddn = mctx.bindDN;
- passwd = mctx.passwd;
+ binddn = mctx.bindDN;
+ passwd = mctx.passwd;
}
if (passwd) {
- cred.bv_val = passwd;
- cred.bv_len = strlen(passwd);
+ cred.bv_val = (char *)passwd;
+ cred.bv_len = strlen(passwd);
}
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: T%03d: Before ldap_simple_bind_s (%s, %s)\n",
- mctx.pid, tttctx->thrdNum, binddn,
- passwd?passwd:"NO PASSWORD PROVIDED");
- ret = ldap_sasl_bind_s (tttctx->ldapCtx, binddn,
- LDAP_SASL_SIMPLE, &cred, NULL, NULL, &servercredp); /*JLS 05-01-01*/
+ if (mode & VERY_VERBOSE)
+ printf ("ldclt[%d]: T%03d: Before ldap_simple_bind_s (%s, %s)\n",
+ mctx.pid, thrdNum, binddn,
+ passwd?passwd:"NO PASSWORD PROVIDED");
+ ret = ldap_sasl_bind_s (ld, binddn,
+ LDAP_SASL_SIMPLE, &cred, NULL, NULL, &servercredp); /*JLS 05-01-01*/
ber_bvfree(servercredp);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: T%03d: After ldap_simple_bind_s (%s, %s)\n",
- mctx.pid, tttctx->thrdNum, binddn,
- passwd?passwd:"NO PASSWORD PROVIDED");
- if (ret == LDAP_SUCCESS) /*JLS 18-12-00*/
- tttctx->binded = 1; /*JLS 18-12-00*/
- else /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
- tttctx->binded = 0; /*JLS 18-12-00*/
- if (ignoreError (ret)) /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
- if (!(mctx.mode & QUIET)) /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
+ if (mode & VERY_VERBOSE)
+ printf ("ldclt[%d]: T%03d: After ldap_simple_bind_s (%s, %s)\n",
+ mctx.pid, thrdNum, binddn,
+ passwd?passwd:"NO PASSWORD PROVIDED");
+ if (ret == LDAP_SUCCESS) { /*JLS 18-12-00*/
+ if (tttctx) {
+ tttctx->binded = 1; /*JLS 18-12-00*/
+ }
+ } else { /*JLS 18-12-00*/
+ if (tttctx) {
+ tttctx->binded = 0; /*JLS 18-12-00*/
+ }
+ if (ignoreError (ret)) { /*JLS 18-12-00*/
+ if (!(mode & QUIET)) { /*JLS 18-12-00*/
printf("ldclt[%d]: T%03d: Cannot ldap_simple_bind_s (%s, %s), error=%d
(%s)\n",
- mctx.pid, tttctx->thrdNum, tttctx->bufBindDN,
- mctx.passwd?tttctx->bufPasswd:"NO PASSWORD PROVIDED",
- ret, my_ldap_err2string (ret));
+ mctx.pid, thrdNum, binddn,
+ passwd?passwd:"NO PASSWORD PROVIDED",
+ ret, my_ldap_err2string (ret));
fflush (stdout); /*JLS 18-12-00*/
} /*JLS 18-12-00*/
- if (addErrorStat (ret) < 0) /*JLS 18-12-00*/
- return (-1); /*JLS 18-12-00*/
- return (0); /*JLS 18-12-00*/
- } /*JLS 18-12-00*/
- else /*JLS 18-12-00*/
- { /*JLS 18-12-00*/
+ if (addErrorStat (ret) < 0) { /*JLS 18-12-00*/
+ ret = -1;
+ } else {
+ ret = 0;
+ }
+ goto done;
+ } else { /*JLS 18-12-00*/
printf ("ldclt[%d]: T%03d: Cannot ldap_simple_bind_s (%s, %s), error=%d
(%s)\n",
- mctx.pid, tttctx->thrdNum, tttctx->bufBindDN,
- mctx.passwd?tttctx->bufPasswd:"NO PASSWORD PROVIDED",
- ret, my_ldap_err2string (ret));
+ mctx.pid, thrdNum, binddn,
+ passwd?passwd:"NO PASSWORD PROVIDED",
+ ret, my_ldap_err2string (ret));
fflush (stdout); /*JLS 18-12-00*/
- tttctx->exitStatus = EXIT_NOBIND; /*JLS 18-12-00*/
- if (addErrorStat (ret) < 0) /*JLS 18-12-00*/
- return (-1); /*JLS 18-12-00*/
- return (-1); /*JLS 18-12-00*/
+ if (tttctx)
+ tttctx->exitStatus = EXIT_NOBIND; /*JLS 18-12-00*/
+ (void)addErrorStat(ret);
+ ret = -1;
+ goto done;
} /*JLS 18-12-00*/
}
}
}
+ done:
+ if (ret) {
+ ldap_unbind_ext(ld, NULL, NULL);
+ ld = NULL;
+ }
+ if (ldapurl) {
+ PR_smprintf_free(ldapurl);
+ ldapurl = NULL;
+ }
+
+ return ld;
+}
+
+/* ****************************************************************************
+ FUNCTION : connectToServer
+ PURPOSE : Realise the connection to the server.
+ If requested by the user, it also realize the
+ disconnection prior to connect.
+ INPUT : tttctx = this thread's thread_context
+ OUTPUT : None.
+ RETURN : -1 if error, 0 else.
+ DESCRIPTION :
+ *****************************************************************************/
+int
+connectToServer (
+ thread_context *tttctx)
+{
+ int ret; /* Return value */
+ LBER_SOCKET fd; /* LDAP cnx's fd */
+
+ /*
+ * Maybe close the connection ?
+ * We will do this *here* to keep the cnx the longest time open.
+ */
+ if ((mctx.mode & BIND_EACH_OPER) && (tttctx->ldapCtx != NULL))
+ {
+ /*
+ * Maybe the user want the connection to be *closed* rather than
+ * being kindly unbinded ?
+ */
+ if (mctx.mode & CLOSE_FD)
+ {
+ /*
+ * Get the corresponding fd
+ */
+#ifdef WORKAROUND_4197228
+ if (getFdFromLdapSession (tttctx->ldapCtx, &fd) < 0)
+ {
+ printf ("ldclt[%d]: T%03d: Cannot extract fd from ldap session\n",
+ mctx.pid, tttctx->thrdNum);
+ fflush (stdout);
+ return (-1);
+ }
+#else
+ ret = ldap_get_option (tttctx->ldapCtx, LDAP_OPT_DESC, &fd);
+ if (ret < 0)
+ {
+ printf ("ldclt[%d]: T%03d: Cannot ldap_get_option(LDAP_OPT_DESC)\n",
+ mctx.pid, tttctx->thrdNum);
+ fflush (stdout);
+ return (-1);
+ }
+#endif
+#ifdef TRACE_FD_GET_OPTION_BUG
+ printf ("ldclt[%d]: T%03d: fd=%d\n", mctx.pid, tttctx->thrdNum,
(int)fd);
+#endif
+ if (close ((int)fd) < 0)
+ {
+ perror ("ldctx");
+ printf ("ldclt[%d]: T%03d: cannot close(fd=%d), error=%d (%s)\n",
+ mctx.pid, tttctx->thrdNum, (int)fd, errno, strerror (errno));
+ return (-1);
+ }
+ }
+
+ /*
+ * Ok, anyway, we must ldap_unbind() to release our contextes
+ * at the client side, otherwise this process will rocket through
+ * the ceiling.
+ * But don't be afraid, the UNBIND operation never reach the
+ * server that will only see a suddent socket disconnection.
+ */
+ ret = ldap_unbind_ext (tttctx->ldapCtx, NULL, NULL);
+ if (ret != LDAP_SUCCESS)
+ {
+ fprintf (stderr, "ldclt[%d]: T%03d: cannot ldap_unbind(), error=%d
(%s)\n",
+ mctx.pid, tttctx->thrdNum, ret,strerror (ret));
+ fflush (stderr);
+ if (addErrorStat (ret) < 0)
+ return (-1);
+ return (-1);
+ }
+ tttctx->ldapCtx = NULL;
+ }
+
+ /*
+ * Maybe create the LDAP context ?
+ */
+ if (tttctx->ldapCtx == NULL)
+ {
+ tttctx->ldapCtx = connectToLDAP(tttctx, tttctx->bufBindDN,
tttctx->bufPasswd,
+ mctx.mode, mctx.mod2);
+ if (!tttctx->ldapCtx) {
+ return (-1);
+ }
+ }
+
/*
* Normal end
*/
@@ -1015,8 +1197,6 @@ connectToServer (
-
-
/* ****************************************************************************
FUNCTION : buildVersatileAttribute
PURPOSE : Build a new attribute value using the definitions of
@@ -1915,7 +2095,6 @@ createMissingNodes (
int nbAttribs; /* Nb of attributes */
LDAPMod attribute; /* To build the attributes */
LDAPMod *attrs[4]; /* Attributes of this entry */
- int v2v3; /* LDAP version used */
/*
* Skip the rdn of the given newDN, that was rejected.
@@ -2000,135 +2179,22 @@ createMissingNodes (
*/
if (cnx == NULL)
{
- const char *mech = LDAP_SASL_SIMPLE;
- const char *binddn = NULL;
- const char *passwd = NULL;
- struct berval cred = {0, NULL};
-#if defined(USE_OPENLDAP)
- char *ldapurl = NULL;
-#endif
-
- if (mctx.mode & VERY_VERBOSE) /*JLS 14-12-00*/
+ unsigned int mode = mctx.mode;
+ unsigned int mod2 = mctx.mod2;
+ /* clear bits not applicable to this mode */
+ mod2 &= ~M2_RNDBINDFILE;
+ mod2 &= ~M2_SASLAUTH;
+ mod2 &= ~M2_RANDOM_SASLAUTHID;
+ /* force bind to happen */
+ mode |= BIND_EACH_OPER;
+ if (mode & VERY_VERBOSE) /*JLS 14-12-00*/
printf ("ldclt[%d]: T%03d: must connect to the server.\n",
mctx.pid, tttctx->thrdNum);
-#if defined(USE_OPENLDAP)
- ldapurl = PR_smprintf("ldap%s://%s:%d/",
- (mctx.mode & SSL) ? "s" : "",
- mctx.hostname, mctx.port);
- if ((ret = ldap_initialize(&tttctx->ldapCtx, ldapurl))) {
- printf ("ldclt[%d]: T%03d: Cannot ldap_initialize (%s), errno=%d
ldaperror=%d:%s\n",
- mctx.pid, tttctx->thrdNum, ldapurl, errno, ret, my_ldap_err2string(ret));
- fflush (stdout);
- PR_smprintf_free(ldapurl);
- return (-1);
- }
- PR_smprintf_free(ldapurl);
- ldapurl = NULL;
- cnx = tttctx->ldapCtx;
-#else /* !USE_OPENLDAP */
- /*
- * SSL is enabled ?
- */
- if (mctx.mode & SSL)
- {
- /*
- * LDAP session initialization in SSL mode
- * added by: B Kolics (11/10/00)
- */
- tttctx->ldapCtx = ldapssl_init(mctx.hostname, mctx.port, 1);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: T%03d: After ldapssl_init (%s, %d), ldapCtx=0x%p\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port,
- tttctx->ldapCtx);
- if (tttctx->ldapCtx == NULL)
- {
- printf ("ldclt[%d]: T%03d: Cannot ldapssl_init (%s, %d), errno=%d\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port, errno);
- fflush (stdout);
- return (-1);
- }
- /*
- * Client authentication is used ?
- */
- if (mctx.mode & CLTAUTH)
- {
- ret = ldapssl_enable_clientauth(tttctx->ldapCtx, "", mctx.keydbpin,
mctx.cltcertname);
- if (mctx.mode & VERY_VERBOSE)
- printf
- ("ldclt[%d]: T%03d: After ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
- mctx.pid, tttctx->thrdNum, tttctx->ldapCtx, mctx.keydbpin,
- mctx.cltcertname);
- if (ret < 0)
- {
- printf
- ("ldclt[%d]: T%03d: Cannot ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
- mctx.pid, tttctx->thrdNum, tttctx->ldapCtx, mctx.keydbpin,
- mctx.cltcertname);
- fflush (stdout);
- return (-1);
- }
- }
- } else {
- /*
- * connection initialization in normal, unencrypted mode
- */
- cnx = ldap_init (mctx.hostname, mctx.port);
- if (cnx == NULL)
- {
- printf ("ldclt[%d]: T%03d: Cannot ldap_init (%s, %d), errno=%d\n",
- mctx.pid, tttctx->thrdNum, mctx.hostname, mctx.port, errno);
- fflush (stdout);
- return (-1);
- }
- }
-#endif /* !USE_OPENLDAP */
-
- if (mctx.mode & CLTAUTH) {
- mech = "EXTERNAL";
- binddn = "";
- passwd = NULL;
- } else {
- binddn = tttctx->bufBindDN?tttctx->bufBindDN:mctx.bindDN;
- passwd = tttctx->bufPasswd?tttctx->bufPasswd:mctx.passwd;
- if (passwd) {
- cred.bv_val = (char *)passwd;
- cred.bv_len = strlen(passwd);
- }
- }
-
- if (mctx.mode & LDAP_V2)
- v2v3 = LDAP_VERSION2;
- else
- v2v3 = LDAP_VERSION3;
-
- ret = ldap_set_option (cnx, LDAP_OPT_PROTOCOL_VERSION, &v2v3);
- if (ret < 0)
- {
- printf ("ldclt[%d]: T%03d: Cannot
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)\n",
- mctx.pid, tttctx->thrdNum);
- fflush (stdout);
- return (-1);
- }
-
- /*
- * Bind to the server
- */
- ret = ldap_sasl_bind_s (tttctx->ldapCtx, binddn, mech, &cred, NULL, NULL,
- NULL);
- if (ret != LDAP_SUCCESS)
- {
- printf ("ldclt[%d]: T%03d: Cannot bind using mech [%s] (%s, %s), error=%d
(%s)\n",
- mctx.pid, tttctx->thrdNum,
- mech ? mech : "SIMPLE",
- tttctx->bufBindDN ? tttctx->bufBindDN : "",
- tttctx->bufPasswd ? tttctx->bufPasswd : "",
- ret, my_ldap_err2string (ret));
- fflush (stdout);
- tttctx->exitStatus = EXIT_NOBIND; /*JLS 25-08-00*/
- if (addErrorStat (ret) < 0)
- return (-1);
+ tttctx->ldapCtx = connectToLDAP(tttctx, tttctx->bufBindDN,
tttctx->bufPasswd, mode, mod2);
+ if (!tttctx->ldapCtx) {
return (-1);
}
+ cnx = tttctx->ldapCtx;
}
/*
diff --git a/ldap/servers/slapd/tools/ldclt/ldclt.h
b/ldap/servers/slapd/tools/ldclt/ldclt.h
index 48c398b..0426a1a 100644
--- a/ldap/servers/slapd/tools/ldclt/ldclt.h
+++ b/ldap/servers/slapd/tools/ldclt/ldclt.h
@@ -736,6 +736,7 @@ extern int setThreadStatus (thread_context *tttctx, /*JLS 17-11-00*/
int status); /*JLS 17-11-00*/
extern void *threadMain (void *);
/* From ldapfct.c */
+extern LDAP* connectToLDAP (thread_context *tttctx, const char *bufBindDN, const char
*bufPasswd, unsigned int mode, unsigned int mod2);
extern int connectToServer (thread_context *tttctx); /*JLS 14-03-01*/
extern char *dnFromMessage (thread_context *tttctx, LDAPMessage *res);
extern int doAddEntry (thread_context *tttctx);
diff --git a/ldap/servers/slapd/tools/ldclt/scalab01.c
b/ldap/servers/slapd/tools/ldclt/scalab01.c
index 39345bd..049e5f6 100644
--- a/ldap/servers/slapd/tools/ldclt/scalab01.c
+++ b/ldap/servers/slapd/tools/ldclt/scalab01.c
@@ -532,134 +532,23 @@ done:
int
scalab01_connectSuperuser (void)
{
- int ret; /* Return value */
- int v2v3; /* LDAP version used */
char bindDN [MAX_DN_LENGTH] = {0}; /* To bind */
- const char *mech = LDAP_SASL_SIMPLE;
- struct berval cred = {0, NULL};
- struct berval *servercredp = NULL;
-#if defined(USE_OPENLDAP)
- char *ldapurl = NULL;
-#endif
+ unsigned int mode = mctx.mode;
+ unsigned int mod2 = mctx.mod2;
-#if defined(USE_OPENLDAP)
- ldapurl = PR_smprintf("ldap%s://%s:%d/",
- (mctx.mode & SSL) ? "s" : "",
- mctx.hostname, mctx.port);
- if ((ret = ldap_initialize(&s1ctx.ldapCtx, ldapurl))) {
- printf ("ldclt[%d]: ctrl: Cannot ldap_initialize (%s), errno=%d
ldaperror=%d:%s\n",
- mctx.pid, ldapurl, errno, ret, my_ldap_err2string(ret));
- fflush (stdout);
- PR_smprintf_free(ldapurl);
- return (-1);
- }
- PR_smprintf_free(ldapurl);
- ldapurl = NULL;
-#else /* !USE_OPENLDAP */
- /*
- * Create the LDAP context
- */
- /*
- * SSL is enabled ?
- */
- if (mctx.mode & SSL)
- {
- /*
- * LDAP session initialization in SSL mode
- */
- s1ctx.ldapCtx = ldapssl_init(mctx.hostname, mctx.port, 1);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: ctrl: ldapssl_init (%s, %d), ldapCtx=0x%p\n",
- mctx.pid, mctx.hostname, mctx.port, s1ctx.ldapCtx);
- if (s1ctx.ldapCtx == NULL)
- {
- printf ("ldclt[%d]: ctrl: Cannot ldapssl_init (%s, %d), errno=%d\n",
- mctx.pid, mctx.hostname, mctx.port, errno);
- fflush (stdout);
- return (-1);
- }
- /*
- * Client authentication is used ?
- */
- if (mctx.mode & CLTAUTH)
- {
- ret = ldapssl_enable_clientauth(s1ctx.ldapCtx, "", mctx.keydbpin,
mctx.cltcertname);
- if (mctx.mode & VERY_VERBOSE)
- printf
- ("ldclt[%d]: ctrl: After ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
- mctx.pid, s1ctx.ldapCtx, mctx.keydbpin, mctx.cltcertname);
- if (ret < 0)
- {
- printf
- ("ldclt[%d]: ctrl: Cannot ldapssl_enable_clientauth (ldapCtx=0x%p, %s,
%s)",
- mctx.pid, s1ctx.ldapCtx, mctx.keydbpin, mctx.cltcertname);
- ldap_perror(s1ctx.ldapCtx, "ldapssl_enable_clientauth");
- fflush (stdout);
- return (-1);
- }
- }
- }
- else
- {
- /*
- * Connection initialization in normal, unencrypted mode
- */
- s1ctx.ldapCtx = ldap_init (mctx.hostname, mctx.port);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: ctrl: After ldap_init (%s, %d), ldapCtx=0x%p\n",
- mctx.pid, mctx.hostname, mctx.port, s1ctx.ldapCtx);
- if (s1ctx.ldapCtx == NULL)
- {
- printf ("ldclt[%d]: ctrl: Cannot ldap_init (%s, %d), errno=%d\n",
- mctx.pid, mctx.hostname, mctx.port, errno);
- fflush (stdout);
- return (-1);
- }
- }
-#endif /* !USE_OPENLDAP */
-
- if (mctx.mode & CLTAUTH) {
- mech = "EXTERNAL";
- } else {
+ if (!(mode & CLTAUTH)) {
strcpy (bindDN, SCALAB01_SUPER_USER_RDN);
strcat (bindDN, ",");
strcat (bindDN, mctx.baseDN);
- cred.bv_val = SCALAB01_SUPER_USER_PASSWORD;
- cred.bv_len = strlen(cred.bv_val);
}
-
- /*
- * Set the LDAP version and other options...
- */
- if (mctx.mode & LDAP_V2)
- v2v3 = LDAP_VERSION2;
- else
- v2v3 = LDAP_VERSION3;
-
- ret = ldap_set_option (s1ctx.ldapCtx, LDAP_OPT_PROTOCOL_VERSION, &v2v3);
- if (ret < 0) /*JLS 14-03-01*/
- { /*JLS 14-03-01*/
- printf ("ldclt[%d]: ctrl: Cannot
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)\n",
- mctx.pid);
- fflush (stdout); /*JLS 14-03-01*/
- return (-1); /*JLS 14-03-01*/
- } /*JLS 14-03-01*/
-
-
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: ctrl: Before bind mech %s (%s , %s)\n",
- mctx.pid, mech ? mech : "SIMPLE", bindDN, SCALAB01_SUPER_USER_PASSWORD);
- ret = ldap_sasl_bind_s (s1ctx.ldapCtx, bindDN, mech, &cred, NULL, NULL,
&servercredp);
- ber_bvfree(servercredp);
- if (mctx.mode & VERY_VERBOSE)
- printf ("ldclt[%d]: ctrl: After bind mech %s (%s, %s)\n",
- mctx.pid, mech ? mech : "SIMPLE", bindDN, SCALAB01_SUPER_USER_PASSWORD);
- if (ret != LDAP_SUCCESS)
- {
- printf("ldclt[%d]: ctrl: Cannot bind mech %s (%s, %s), error=%d (%s)\n",
- mctx.pid, mech ? mech : "SIMPLE", bindDN, SCALAB01_SUPER_USER_PASSWORD,
- ret, my_ldap_err2string (ret));
- fflush (stdout);
+ /* clear bits not applicable to this mode */
+ mod2 &= ~M2_RNDBINDFILE;
+ mod2 &= ~M2_SASLAUTH;
+ mod2 &= ~M2_RANDOM_SASLAUTHID;
+ /* force bind to happen */
+ mode |= BIND_EACH_OPER;
+ s1ctx.ldapCtx = connectToLDAP(NULL, bindDN, SCALAB01_SUPER_USER_PASSWORD, mode, mod2);
+ if (!s1ctx.ldapCtx) {
return (-1);
}