helpers/digest_auth/eDirectory/ldap_backend.cc

   1 /*
   2  *
   3  *
   4  *
   5  * ldap_backend.c
   6  * AUTHOR: Flavio Pescuma, MARA Systems AB <flavio@marasystems.com>
   7  */
   8 #include "squid.h"
   9
  10 #define LDAP_DEPRECATED 1
  11
  12 #include "ldap_backend.h"
  13
  14 #if _SQUID_MSWIN_               /* Native Windows port and MinGW */
  15
  16 #define snprintf _snprintf
  17 #include <windows.h>
  18 #include <winldap.h>
  19 #ifndef LDAPAPI
  20 #define LDAPAPI __cdecl
  21 #endif
  22 #ifdef LDAP_VERSION3
  23 #ifndef LDAP_OPT_X_TLS
  24 #define LDAP_OPT_X_TLS 0x6000
  25 #endif
  26 /* Some tricks to allow dynamic bind with ldap_start_tls_s entry point at
  27  * run time.
  28  */
  29 #undef ldap_start_tls_s
  30 #if LDAP_UNICODE
  31 #define LDAP_START_TLS_S "ldap_start_tls_sW"
  32 typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlW *, IN PLDAPControlW *);
  33 #else
  34 #define LDAP_START_TLS_S "ldap_start_tls_sA"
  35 typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlA *, IN PLDAPControlA *);
  36 #endif /* LDAP_UNICODE */
  37 PFldap_start_tls_s Win32_ldap_start_tls_s;
  38 #define ldap_start_tls_s(l,s,c) Win32_ldap_start_tls_s(l,NULL,NULL,s,c)
  39 #endif /* LDAP_VERSION3 */
  40
  41 #else
  42
  43 #include <lber.h>
  44 #include <ldap.h>
  45
  46 #endif
  47 #include "edir_ldapext.h"
  48 #define PROGRAM_NAME "digest_pw_auth(LDAP_backend)"
  49
  50 /* Globals */
  51
  52 static LDAP *ld = NULL;
  53 static const char *passattr = NULL;
  54 static char *ldapServer = NULL;
  55 static const char *userbasedn = NULL;
  56 static const char *userdnattr = NULL;
  57 static const char *usersearchfilter = NULL;
  58 static const char *binddn = NULL;
  59 static const char *bindpasswd = NULL;
  60 static const char *delimiter = ":";
  61 static int encrpass = 0;
  62 static int searchscope = LDAP_SCOPE_SUBTREE;
  63 static int persistent = 0;
  64 static int noreferrals = 0;
  65 static int port = LDAP_PORT;
  66 static int strip_nt_domain = 0;
  67 static int edir_universal_passwd = 0;
  68 static int aliasderef = LDAP_DEREF_NEVER;
  69 #if defined(NETSCAPE_SSL)
  70 static char *sslpath = NULL;
  71 static int sslinit = 0;
  72 #endif
  73 static int connect_timeout = 0;
  74 static int timelimit = LDAP_NO_LIMIT;
  75
  76 #ifdef LDAP_VERSION3
  77 /* Added for TLS support and version 3 */
  78 static int use_tls = 0;
  79 static int version = -1;
  80 #endif
  81
  82 static void ldapconnect(void);
  83 static int readSecret(const char *filename);
  84
  85 /* Yuck.. we need to glue to different versions of the API */
  86
  87 #if defined(LDAP_API_VERSION) && LDAP_API_VERSION > 1823
  88 static void
  89 squid_ldap_set_aliasderef(int deref)
  90 {
  91     ldap_set_option(ld, LDAP_OPT_DEREF, &deref);
  92 }
  93 static void
  94 squid_ldap_set_referrals(int referrals)
  95 {
  96     int *value = static_cast<int*>(referrals ? LDAP_OPT_ON :LDAP_OPT_OFF);
  97     ldap_set_option(ld, LDAP_OPT_REFERRALS, value);
  98 }
  99 static void
 100 squid_ldap_set_timelimit(int aTimeLimit)
 101 {
 102     ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &aTimeLimit);
 103 }
 104 static void
 105 squid_ldap_set_connect_timeout(int aTimeLimit)
 106 {
 107 #if defined(LDAP_OPT_NETWORK_TIMEOUT)
 108     struct timeval tv;
 109     tv.tv_sec = aTimeLimit;
 110     tv.tv_usec = 0;
 111     ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
 112 #elif defined(LDAP_X_OPT_CONNECT_TIMEOUT)
 113     aTimeLimit *= 1000;
 114     ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, &aTimeLimit);
 115 #endif
 116 }
 117
 118 #else
 119 static int
 120 squid_ldap_errno(LDAP * ld)
 121 {
 122     return ld->ld_errno;
 123 }
 124 static void
 125 squid_ldap_set_aliasderef(int deref)
 126 {
 127     ld->ld_deref = deref;
 128 }
 129 static void
 130 squid_ldap_set_referrals(int referrals)
 131 {
 132     if (referrals)
 133         ld->ld_options |= ~LDAP_OPT_REFERRALS;
 134     else
 135         ld->ld_options &= ~LDAP_OPT_REFERRALS;
 136 }
 137 static void
 138 squid_ldap_set_timelimit(int aTimeLimit)
 139 {
 140     ld->ld_timelimit = aTimeLimit;
 141 }
 142 static void
 143 squid_ldap_set_connect_timeout(int aTimeLimit)
 144 {
 145     fprintf(stderr, "ERROR: Connect timeouts not supported in your LDAP library\n");
 146 }
 147 static void
 148 squid_ldap_memfree(char *p)
 149 {
 150     free(p);
 151 }
 152
 153 #endif
 154
 155 #ifdef LDAP_API_FEATURE_X_OPENLDAP
 156 #if LDAP_VENDOR_VERSION > 194
 157 #define HAS_URI_SUPPORT 1
 158 #endif
 159 #endif
 160
 161 static int
 162 ldap_escape_value(char *escaped, int size, const char *src)
 163 {
 164     int n = 0;
 165     while (size > 4 && *src) {
 166         switch (*src) {
 167         case '*':
 168         case '(':
 169         case ')':
 170         case '\\':
 171             n += 3;
 172             size -= 3;
 173             if (size > 0) {
 174                 *escaped = '\\';
 175                 ++escaped;
 176                 snprintf(escaped, 3, "%02x", (int) *src);
 177                 ++src;
 178                 escaped += 2;
 179             }
 180             break;
 181         default:
 182             *escaped = *src;
 183             ++escaped;
 184             ++src;
 185             ++n;
 186             --size;
 187         }
 188     }
 189     *escaped = '\0';
 190     return n;
 191 }
 192
 193 static char *
 194 getpassword(char *login, char *realm)
 195 {
 196     LDAPMessage *res = NULL;
 197     LDAPMessage *entry;
 198     char **values = NULL;
 199     char **value = NULL;
 200     char *password = NULL;
 201     int retry = 0;
 202     char filter[8192];
 203     char searchbase[8192];
 204     char *universal_password = NULL;
 205     size_t universal_password_len = 256;
 206     int nmas_res = 0;
 207     int rc = -1;
 208     if (ld) {
 209         if (usersearchfilter) {
 210             char escaped_login[1024];
 211             snprintf(searchbase, sizeof(searchbase), "%s", userbasedn);
 212             ldap_escape_value(escaped_login, sizeof(escaped_login), login);
 213             snprintf(filter, sizeof(filter), usersearchfilter, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login);
 214
 215 retrysrch:
 216             debug("user filter '%s', searchbase '%s'\n", filter, searchbase);
 217
 218             rc = ldap_search_s(ld, searchbase, searchscope, filter, NULL, 0, &res);
 219             if (rc != LDAP_SUCCESS) {
 220                 if (noreferrals && rc == LDAP_PARTIAL_RESULTS) {
 221                     /* Everything is fine. This is expected when referrals
 222                      * are disabled.
 223                      */
 224                     rc = LDAP_SUCCESS;
 225                 } else {
 226                     fprintf(stderr, PROGRAM_NAME " WARNING, LDAP search error '%s'\n", ldap_err2string(rc));
 227 #if defined(NETSCAPE_SSL)
 228                     if (sslpath && ((rc == LDAP_SERVER_DOWN) || (rc == LDAP_CONNECT_ERROR))) {
 229                         int sslerr = PORT_GetError();
 230                         fprintf(stderr, PROGRAM_NAME ": WARNING, SSL error %d (%s)\n", sslerr, ldapssl_err2string(sslerr));
 231                     }
 232 #endif
 233                     fprintf(stderr, PROGRAM_NAME " WARNING, LDAP search error, trying to recover'%s'\n", ldap_err2string(rc));
 234                     ldap_msgfree(res);
 235                     /* try to connect to the LDAP server agin, maybe my persisten conexion failed. */
 236                     if (!retry) {
 237                         ++retry;
 238                         ldap_unbind(ld);
 239                         ld = NULL;
 240                         ldapconnect();
 241                         goto retrysrch;
 242                     }
 243                     return NULL;
 244
 245                 }
 246             }
 247         } else if (userdnattr) {
 248             snprintf(searchbase, 8192, "%s=%s, %s", userdnattr, login, userbasedn);
 249
 250 retrydnattr:
 251             debug("searchbase '%s'\n", searchbase);
 252             rc = ldap_search_s(ld, searchbase, searchscope, NULL, NULL, 0, &res);
 253         }
 254         if (rc == LDAP_SUCCESS) {
 255             entry = ldap_first_entry(ld, res);
 256             if (entry) {
 257                 debug("ldap dn: %s\n", ldap_get_dn(ld, entry));
 258                 if (edir_universal_passwd) {
 259
 260                     /* allocate some memory for the universal password returned by NMAS */
 261                     universal_password = (char*)calloc(1, universal_password_len);
 262                     values = (char**)calloc(1, sizeof(char *));
 263
 264                     /* actually talk to NMAS to get a password */
 265                     nmas_res = nds_get_password(ld, ldap_get_dn(ld, entry), &universal_password_len, universal_password);
 266                     if (nmas_res == LDAP_SUCCESS && universal_password) {
 267                         debug("NMAS returned value %s\n", universal_password);
 268                         values[0] = universal_password;
 269                     } else {
 270                         debug("Error reading Universal Password: %d = %s\n", nmas_res, ldap_err2string(nmas_res));
 271                     }
 272                 } else {
 273                     values = ldap_get_values(ld, entry, passattr);
 274                 }
 275             } else {
 276                 ldap_msgfree(res);
 277                 return NULL;
 278             }
 279             if (!values) {
 280                 debug("No attribute value found\n");
 281                 if (edir_universal_passwd)
 282                     free(universal_password);
 283                 ldap_msgfree(res);
 284                 return NULL;
 285             }
 286             value = values;
 287             while (*value) {
 288                 if (encrpass) {
 289                     if (strcmp(strtok(*value, delimiter), realm) == 0) {
 290                         password = strtok(NULL, delimiter);
 291                         break;
 292                     }
 293                 } else {
 294                     password = *value;
 295                     break;
 296                 }
 297                 ++value;
 298             }
 299             debug("password: %s\n", password);
 300             if (password)
 301                 password = xstrdup(password);
 302             if (edir_universal_passwd) {
 303                 free(values);
 304                 free(universal_password);
 305             } else {
 306                 ldap_value_free(values);
 307             }
 308             ldap_msgfree(res);
 309             return password;
 310         } else {
 311             fprintf(stderr, PROGRAM_NAME " WARNING, LDAP error '%s'\n", ldap_err2string(rc));
 312             /* try to connect to the LDAP server agin, maybe my persisten conexion failed. */
 313             if (!retry) {
 314                 ++retry;
 315                 ldap_unbind(ld);
 316                 ld = NULL;
 317                 ldapconnect();
 318                 goto retrydnattr;
 319             }
 320             return NULL;
 321         }
 322     }
 323     return NULL;
 324 }
 325
 326 static void
 327 ldapconnect(void)
 328 {
 329     int rc;
 330
 331     /* On Windows ldap_start_tls_s is available starting from Windows XP,
 332      * so we need to bind at run-time with the function entry point
 333      */
 334 #if _SQUID_MSWIN_
 335     if (use_tls) {
 336
 337         HMODULE WLDAP32Handle;
 338
 339         WLDAP32Handle = GetModuleHandle("wldap32");
 340         if ((Win32_ldap_start_tls_s = (PFldap_start_tls_s) GetProcAddress(WLDAP32Handle, LDAP_START_TLS_S)) == NULL) {
 341             fprintf(stderr, PROGRAM_NAME ": ERROR: TLS (-Z) not supported on this platform.\n");
 342             exit(1);
 343         }
 344     }
 345 #endif
 346
 347     if (ld == NULL) {
 348 #if HAS_URI_SUPPORT
 349         if (strstr(ldapServer, "://") != NULL) {
 350             rc = ldap_initialize(&ld, ldapServer);
 351             if (rc != LDAP_SUCCESS) {
 352                 fprintf(stderr, "\nUnable to connect to LDAPURI:%s\n", ldapServer);
 353             }
 354         } else
 355 #endif
 356 #if NETSCAPE_SSL
 357             if (sslpath) {
 358                 if (!sslinit && (ldapssl_client_init(sslpath, NULL) != LDAP_SUCCESS)) {
 359                     fprintf(stderr, "\nUnable to initialise SSL with cert path %s\n",
 360                             sslpath);
 361                     exit(1);
 362                 } else {
 363                     ++sslinit;
 364                 }
 365                 if ((ld = ldapssl_init(ldapServer, port, 1)) == NULL) {
 366                     fprintf(stderr, "\nUnable to connect to SSL LDAP server: %s port:%d\n",
 367                             ldapServer, port);
 368                     exit(1);
 369                 }
 370             } else
 371 #endif
 372                 if ((ld = ldap_init(ldapServer, port)) == NULL) {
 373                     fprintf(stderr, "\nUnable to connect to LDAP server:%s port:%d\n", ldapServer, port);
 374                 }
 375         if (connect_timeout)
 376             squid_ldap_set_connect_timeout(connect_timeout);
 377
 378 #ifdef LDAP_VERSION3
 379         if (version == -1) {
 380             version = LDAP_VERSION2;
 381         }
 382         if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)
 383                 != LDAP_SUCCESS) {
 384             fprintf(stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
 385                     version);
 386             ldap_unbind(ld);
 387             ld = NULL;
 388         }
 389         if (use_tls) {
 390 #ifdef LDAP_OPT_X_TLS
 391             if ((version == LDAP_VERSION3) && (ldap_start_tls_s(ld, NULL, NULL) == LDAP_SUCCESS)) {
 392                 fprintf(stderr, "Could not Activate TLS connection\n");
 393                 ldap_unbind(ld);
 394                 ld = NULL;
 395             }
 396 #else
 397             fprintf(stderr, "TLS not supported with your LDAP library\n");
 398             ldap_unbind(ld);
 399             ld = NULL;
 400 #endif
 401         }
 402 #endif
 403         squid_ldap_set_timelimit(timelimit);
 404         squid_ldap_set_referrals(!noreferrals);
 405         squid_ldap_set_aliasderef(aliasderef);
 406         if (binddn && bindpasswd && *binddn && *bindpasswd) {
 407             rc = ldap_simple_bind_s(ld, binddn, bindpasswd);
 408             if (rc != LDAP_SUCCESS) {
 409                 fprintf(stderr, PROGRAM_NAME " WARNING, could not bind to binddn '%s'\n", ldap_err2string(rc));
 410                 ldap_unbind(ld);
 411                 ld = NULL;
 412             }
 413         }
 414         debug("Connected OK\n");
 415     }
 416 }
 417 int
 418 LDAPArguments(int argc, char **argv)
 419 {
 420     setbuf(stdout, NULL);
 421
 422     while (argc > 1 && argv[1][0] == '-') {
 423         const char *value = "";
 424         char option = argv[1][1];
 425         switch (option) {
 426         case 'P':
 427         case 'R':
 428         case 'z':
 429         case 'Z':
 430         case 'g':
 431         case 'e':
 432         case 'S':
 433         case 'n':
 434         case 'd':
 435             break;
 436         default:
 437             if (strlen(argv[1]) > 2) {
 438                 value = argv[1] + 2;
 439             } else if (argc > 2) {
 440                 value = argv[2];
 441                 ++argv;
 442                 --argc;
 443             } else
 444                 value = "";
 445             break;
 446         }
 447         ++argv;
 448         --argc;
 449         switch (option) {
 450         case 'H':
 451 #if !HAS_URI_SUPPORT
 452             fprintf(stderr, "ERROR: Your LDAP library does not have URI support\n");
 453             return 1;
 454 #endif
 455             /* Fall thru to -h */
 456         case 'h':
 457             if (ldapServer) {
 458                 int len = strlen(ldapServer) + 1 + strlen(value) + 1;
 459                 char *newhost = (char*)malloc(len);
 460                 snprintf(newhost, len, "%s %s", ldapServer, value);
 461                 free(ldapServer);
 462                 ldapServer = newhost;
 463             } else {
 464                 ldapServer = xstrdup(value);
 465             }
 466             break;
 467         case 'A':
 468             passattr = value;
 469             break;
 470         case 'e':
 471             encrpass = 1;
 472             break;
 473         case 'l':
 474             delimiter = value;
 475             break;
 476         case 'b':
 477             userbasedn = value;
 478             break;
 479         case 'F':
 480             usersearchfilter = value;
 481             break;
 482         case 'u':
 483             userdnattr = value;
 484             break;
 485         case 's':
 486             if (strcmp(value, "base") == 0)
 487                 searchscope = LDAP_SCOPE_BASE;
 488             else if (strcmp(value, "one") == 0)
 489                 searchscope = LDAP_SCOPE_ONELEVEL;
 490             else if (strcmp(value, "sub") == 0)
 491                 searchscope = LDAP_SCOPE_SUBTREE;
 492             else {
 493                 fprintf(stderr, PROGRAM_NAME " ERROR: Unknown search scope '%s'\n", value);
 494                 return 1;
 495             }
 496             break;
 497         case 'S':
 498 #if defined(NETSCAPE_SSL)
 499             sslpath = value;
 500             if (port == LDAP_PORT)
 501                 port = LDAPS_PORT;
 502 #else
 503             fprintf(stderr, PROGRAM_NAME " ERROR: -E unsupported with this LDAP library\n");
 504             return 1;
 505 #endif
 506             break;
 507         case 'c':
 508             connect_timeout = atoi(value);
 509             break;
 510         case 't':
 511             timelimit = atoi(value);
 512             break;
 513         case 'a':
 514             if (strcmp(value, "never") == 0)
 515                 aliasderef = LDAP_DEREF_NEVER;
 516             else if (strcmp(value, "always") == 0)
 517                 aliasderef = LDAP_DEREF_ALWAYS;
 518             else if (strcmp(value, "search") == 0)
 519                 aliasderef = LDAP_DEREF_SEARCHING;
 520             else if (strcmp(value, "find") == 0)
 521                 aliasderef = LDAP_DEREF_FINDING;
 522             else {
 523                 fprintf(stderr, PROGRAM_NAME " ERROR: Unknown alias dereference method '%s'\n", value);
 524                 return 1;
 525             }
 526             break;
 527         case 'D':
 528             binddn = value;
 529             break;
 530         case 'w':
 531             bindpasswd = value;
 532             break;
 533         case 'W':
 534             readSecret(value);
 535             break;
 536         case 'P':
 537             persistent = !persistent;
 538             break;
 539         case 'p':
 540             port = atoi(value);
 541             break;
 542         case 'R':
 543             noreferrals = !noreferrals;
 544             break;
 545 #ifdef LDAP_VERSION3
 546         case 'v':
 547             switch (atoi(value)) {
 548             case 2:
 549                 version = LDAP_VERSION2;
 550                 break;
 551             case 3:
 552                 version = LDAP_VERSION3;
 553                 break;
 554             default:
 555                 fprintf(stderr, "Protocol version should be 2 or 3\n");
 556                 return 1;
 557             }
 558             break;
 559         case 'Z':
 560             if (version == LDAP_VERSION2) {
 561                 fprintf(stderr, "TLS (-Z) is incompatible with version %d\n",
 562                         version);
 563                 return 1;
 564             }
 565             version = LDAP_VERSION3;
 566             use_tls = 1;
 567             break;
 568 #endif
 569         case 'd':
 570             debug_enabled = 1;
 571             break;
 572         case 'E':
 573             strip_nt_domain = 1;
 574             break;
 575         case 'n':
 576             edir_universal_passwd = 1;
 577             break;
 578         default:
 579             fprintf(stderr, PROGRAM_NAME " ERROR: Unknown command line option '%c'\n", option);
 580             return 1;
 581         }
 582     }
 583
 584     while (argc > 1) {
 585         char *value = argv[1];
 586         if (ldapServer) {
 587             int len = strlen(ldapServer) + 1 + strlen(value) + 1;
 588             char *newhost = (char*)malloc(len);
 589             snprintf(newhost, len, "%s %s", ldapServer, value);
 590             free(ldapServer);
 591             ldapServer = newhost;
 592         } else {
 593             ldapServer = xstrdup(value);
 594         }
 595         --argc;
 596         ++argv;
 597     }
 598
 599     if (!ldapServer)
 600         ldapServer = (char *) "localhost";
 601
 602     if (!userbasedn || !((passattr != NULL) || (edir_universal_passwd && usersearchfilter && version == LDAP_VERSION3 && use_tls))) {
 603         fprintf(stderr, "Usage: " PROGRAM_NAME " -b basedn -f filter [options] ldap_server_name\n\n");
 604         fprintf(stderr, "\t-A password attribute(REQUIRED)\t\tUser attribute that contains the password\n");
 605         fprintf(stderr, "\t-l password realm delimiter(REQUIRED)\tCharater(s) that devides the password attribute\n\t\t\t\t\t\tin realm and password tokens, default ':' realm:password\n");
 606         fprintf(stderr, "\t-b basedn (REQUIRED)\t\t\tbase dn under where to search for users\n");
 607         fprintf(stderr, "\t-e Encrypted passwords(REQUIRED)\tPassword are stored encrypted using HHA1\n");
 608         fprintf(stderr, "\t-F filter\t\t\t\tuser search filter pattern. %%s = login\n");
 609         fprintf(stderr, "\t-u attribute\t\t\t\tattribute to use in combination with the basedn to create the user DN\n");
 610         fprintf(stderr, "\t-s base|one|sub\t\t\t\tsearch scope\n");
 611         fprintf(stderr, "\t-D binddn\t\t\t\tDN to bind as to perform searches\n");
 612         fprintf(stderr, "\t-w bindpasswd\t\t\t\tpassword for binddn\n");
 613         fprintf(stderr, "\t-W secretfile\t\t\t\tread password for binddn from file secretfile\n");
 614 #if HAS_URI_SUPPORT
 615         fprintf(stderr, "\t-H URI\t\t\t\t\tLDAPURI (defaults to ldap://localhost)\n");
 616 #endif
 617         fprintf(stderr, "\t-h server\t\t\t\tLDAP server (defaults to localhost)\n");
 618         fprintf(stderr, "\t-p port\t\t\t\t\tLDAP server port (defaults to %d)\n", LDAP_PORT);
 619         fprintf(stderr, "\t-P\t\t\t\t\tpersistent LDAP connection\n");
 620 #if defined(NETSCAPE_SSL)
 621         fprintf(stderr, "\t-E sslcertpath\t\t\t\tenable LDAP over SSL\n");
 622 #endif
 623         fprintf(stderr, "\t-c timeout\t\t\t\tconnect timeout\n");
 624         fprintf(stderr, "\t-t timelimit\t\t\t\tsearch time limit\n");
 625         fprintf(stderr, "\t-R\t\t\t\t\tdo not follow referrals\n");
 626         fprintf(stderr, "\t-a never|always|search|find\t\twhen to dereference aliases\n");
 627 #ifdef LDAP_VERSION3
 628         fprintf(stderr, "\t-v 2|3\t\t\t\t\tLDAP version\n");
 629         fprintf(stderr, "\t-Z\t\t\t\t\tTLS encrypt the LDAP connection, requires\n\t\t\t\tLDAP version 3\n");
 630 #endif
 631         fprintf(stderr, "\t-S\t\t\t\t\tStrip NT domain from usernames\n");
 632         fprintf(stderr, "\t-n\t\t\t\t\tGet an eDirectory Universal Password from Novell NMAS\n\t\t\t\t\t\t(requires bind credentials, version 3, TLS, and a search filter)\n");
 633         fprintf(stderr, "\n");
 634         fprintf(stderr, "\tIf you need to bind as a user to perform searches then use the\n\t-D binddn -w bindpasswd or -D binddn -W secretfile options\n\n");
 635         return -1;
 636     }
 637     return 0;
 638 }
 639 static int
 640 readSecret(const char *filename)
 641 {
 642     char buf[BUFSIZ];
 643     char *e = 0;
 644     FILE *f;
 645
 646     if (!(f = fopen(filename, "r"))) {
 647         fprintf(stderr, PROGRAM_NAME " ERROR: Can not read secret file %s\n", filename);
 648         return 1;
 649     }
 650     if (!fgets(buf, sizeof(buf) - 1, f)) {
 651         fprintf(stderr, PROGRAM_NAME " ERROR: Secret file %s is empty\n", filename);
 652         fclose(f);
 653         return 1;
 654     }
 655     /* strip whitespaces on end */
 656     if ((e = strrchr(buf, '\n')))
 657         *e = 0;
 658     if ((e = strrchr(buf, '\r')))
 659         *e = 0;
 660
 661     bindpasswd = xstrdup(buf);
 662     if (!bindpasswd) {
 663         fprintf(stderr, PROGRAM_NAME " ERROR: can not allocate memory\n");
 664     }
 665     fclose(f);
 666
 667     return 0;
 668 }
 669
 670 void
 671 LDAPHHA1(RequestData * requestData)
 672 {
 673     char *password;
 674     ldapconnect();
 675     password = getpassword(requestData->user, requestData->realm);
 676     if (password != NULL) {
 677         if (encrpass)
 678             xstrncpy(requestData->HHA1, password, sizeof(requestData->HHA1));
 679         else {
 680             HASH HA1;
 681             DigestCalcHA1("md5", requestData->user, requestData->realm, password, NULL, NULL, HA1, requestData->HHA1);
 682         }
 683         free(password);
 684     } else {
 685         requestData->error = -1;
 686     }
 687
 688 }