helpers/digest_auth/eDirectory/ldap_backend.cc

   1 /*
   2  *
   3  *
   4  *
   5  * ldap_backend.c
   6  * AUTHOR: Flavio Pescuma, MARA Systems AB <flavio@marasystems.com>
   7  */
   8 #include "squid.h"
   9
  10 #define LDAP_DEPRECATED 1
  11
  12 #include "ldap_backend.h"
  13
  14 #if _SQUID_MSWIN_               /* Native Windows port and MinGW */
  15
  16 #define snprintf _snprintf
  17 #include <windows.h>
  18 #include <winldap.h>
  19 #ifndef LDAPAPI
  20 #define LDAPAPI __cdecl
  21 #endif
  22 #ifdef LDAP_VERSION3
  23 #ifndef LDAP_OPT_X_TLS
  24 #define LDAP_OPT_X_TLS 0x6000
  25 #endif
  26 /* Some tricks to allow dynamic bind with ldap_start_tls_s entry point at
  27  * run time.
  28  */
  29 #undef ldap_start_tls_s
  30 #if LDAP_UNICODE
  31 #define LDAP_START_TLS_S "ldap_start_tls_sW"
  32 typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlW *, IN PLDAPControlW *);
  33 #else
  34 #define LDAP_START_TLS_S "ldap_start_tls_sA"
  35 typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlA *, IN PLDAPControlA *);
  36 #endif /* LDAP_UNICODE */
  37 PFldap_start_tls_s Win32_ldap_start_tls_s;
  38 #define ldap_start_tls_s(l,s,c) Win32_ldap_start_tls_s(l,NULL,NULL,s,c)
  39 #endif /* LDAP_VERSION3 */
  40
  41 #else
  42
  43 #include <lber.h>
  44 #include <ldap.h>
  45
  46 #endif
  47 #include "edir_ldapext.h"
  48 #define PROGRAM_NAME "digest_pw_auth(LDAP_backend)"
  49
  50 /* Globals */
  51
  52 static LDAP *ld = NULL;
  53 static const char *passattr = NULL;
  54 static char *ldapServer = NULL;
  55 static const char *userbasedn = NULL;
  56 static const char *userdnattr = NULL;
  57 static const char *usersearchfilter = NULL;
  58 static const char *binddn = NULL;
  59 static const char *bindpasswd = NULL;
  60 static const char *delimiter = ":";
  61 static int encrpass = 0;
  62 static int searchscope = LDAP_SCOPE_SUBTREE;
  63 static int persistent = 0;
  64 static int noreferrals = 0;
  65 static int port = LDAP_PORT;
  66 static int strip_nt_domain = 0;
  67 static int edir_universal_passwd = 0;
  68 static int aliasderef = LDAP_DEREF_NEVER;
  69 #if defined(NETSCAPE_SSL)
  70 static char *sslpath = NULL;
  71 static int sslinit = 0;
  72 #endif
  73 static int connect_timeout = 0;
  74 static int timelimit = LDAP_NO_LIMIT;
  75
  76 #ifdef LDAP_VERSION3
  77 /* Added for TLS support and version 3 */
  78 static int use_tls = 0;
  79 static int version = -1;
  80 #endif
  81
  82 static void ldapconnect(void);
  83 static int readSecret(const char *filename);
  84
  85 /* Yuck.. we need to glue to different versions of the API */
  86
  87 #if defined(LDAP_API_VERSION) && LDAP_API_VERSION > 1823
  88 static void
  89 squid_ldap_set_aliasderef(int deref)
  90 {
  91     ldap_set_option(ld, LDAP_OPT_DEREF, &deref);
  92 }
  93 static void
  94 squid_ldap_set_referrals(int referrals)
  95 {
  96     int *value = static_cast<int*>(referrals ? LDAP_OPT_ON :LDAP_OPT_OFF);
  97     ldap_set_option(ld, LDAP_OPT_REFERRALS, value);
  98 }
  99 static void
 100 squid_ldap_set_timelimit(int aTimeLimit)
 101 {
 102     ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &aTimeLimit);
 103 }
 104 static void
 105 squid_ldap_set_connect_timeout(int aTimeLimit)
 106 {
 107 #if defined(LDAP_OPT_NETWORK_TIMEOUT)
 108     struct timeval tv;
 109     tv.tv_sec = aTimeLimit;
 110     tv.tv_usec = 0;
 111     ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
 112 #elif defined(LDAP_X_OPT_CONNECT_TIMEOUT)
 113     aTimeLimit *= 1000;
 114     ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, &aTimeLimit);
 115 #endif
 116 }
 117
 118 #else
 119 static int
 120 squid_ldap_errno(LDAP * ld)
 121 {
 122     return ld->ld_errno;
 123 }
 124 static void
 125 squid_ldap_set_aliasderef(int deref)
 126 {
 127     ld->ld_deref = deref;
 128 }
 129 static void
 130 squid_ldap_set_referrals(int referrals)
 131 {
 132     if (referrals)
 133         ld->ld_options |= ~LDAP_OPT_REFERRALS;
 134     else
 135         ld->ld_options &= ~LDAP_OPT_REFERRALS;
 136 }
 137 static void
 138 squid_ldap_set_timelimit(int aTimeLimit)
 139 {
 140     ld->ld_timelimit = aTimeLimit;
 141 }
 142 static void
 143 squid_ldap_set_connect_timeout(int aTimeLimit)
 144 {
 145     fprintf(stderr, "ERROR: Connect timeouts not supported in your LDAP library\n");
 146 }
 147 static void
 148 squid_ldap_memfree(char *p)
 149 {
 150     free(p);
 151 }
 152
 153 #endif
 154
 155 #ifdef LDAP_API_FEATURE_X_OPENLDAP
 156 #if LDAP_VENDOR_VERSION > 194
 157 #define HAS_URI_SUPPORT 1
 158 #endif
 159 #endif
 160
 161 static int
 162 ldap_escape_value(char *escaped, int size, const char *src)
 163 {
 164     int n = 0;
 165     while (size > 4 && *src) {
 166         switch (*src) {
 167         case '*':
 168         case '(':
 169         case ')':
 170         case '\\':
 171             n += 3;
 172             size -= 3;
 173             if (size > 0) {
 174                 *escaped++ = '\\';
 175                 snprintf(escaped, 3, "%02x", (int) *src++);
 176                 escaped += 2;
 177             }
 178             break;
 179         default:
 180             *escaped++ = *src++;
 181             n++;
 182             size--;
 183         }
 184     }
 185     *escaped = '\0';
 186     return n;
 187 }
 188
 189 static char *
 190 getpassword(char *login, char *realm)
 191 {
 192     LDAPMessage *res = NULL;
 193     LDAPMessage *entry;
 194     char **values = NULL;
 195     char **value = NULL;
 196     char *password = NULL;
 197     int retry = 0;
 198     char filter[8192];
 199     char searchbase[8192];
 200     char *universal_password = NULL;
 201     size_t universal_password_len = 256;
 202     int nmas_res = 0;
 203     int rc = -1;
 204     if (ld) {
 205         if (usersearchfilter) {
 206             char escaped_login[1024];
 207             snprintf(searchbase, sizeof(searchbase), "%s", userbasedn);
 208             ldap_escape_value(escaped_login, sizeof(escaped_login), login);
 209             snprintf(filter, sizeof(filter), usersearchfilter, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login);
 210
 211 retrysrch:
 212             debug("user filter '%s', searchbase '%s'\n", filter, searchbase);
 213
 214             rc = ldap_search_s(ld, searchbase, searchscope, filter, NULL, 0, &res);
 215             if (rc != LDAP_SUCCESS) {
 216                 if (noreferrals && rc == LDAP_PARTIAL_RESULTS) {
 217                     /* Everything is fine. This is expected when referrals
 218                      * are disabled.
 219                      */
 220                     rc = LDAP_SUCCESS;
 221                 } else {
 222                     fprintf(stderr, PROGRAM_NAME " WARNING, LDAP search error '%s'\n", ldap_err2string(rc));
 223 #if defined(NETSCAPE_SSL)
 224                     if (sslpath && ((rc == LDAP_SERVER_DOWN) || (rc == LDAP_CONNECT_ERROR))) {
 225                         int sslerr = PORT_GetError();
 226                         fprintf(stderr, PROGRAM_NAME ": WARNING, SSL error %d (%s)\n", sslerr, ldapssl_err2string(sslerr));
 227                     }
 228 #endif
 229                     fprintf(stderr, PROGRAM_NAME " WARNING, LDAP search error, trying to recover'%s'\n", ldap_err2string(rc));
 230                     ldap_msgfree(res);
 231                     /* try to connect to the LDAP server agin, maybe my persisten conexion failed. */
 232                     if (!retry) {
 233                         retry++;
 234                         ldap_unbind(ld);
 235                         ld = NULL;
 236                         ldapconnect();
 237                         goto retrysrch;
 238                     }
 239                     return NULL;
 240
 241                 }
 242             }
 243         } else if (userdnattr) {
 244             snprintf(searchbase, 8192, "%s=%s, %s", userdnattr, login, userbasedn);
 245
 246 retrydnattr:
 247             debug("searchbase '%s'\n", searchbase);
 248             rc = ldap_search_s(ld, searchbase, searchscope, NULL, NULL, 0, &res);
 249         }
 250         if (rc == LDAP_SUCCESS) {
 251             entry = ldap_first_entry(ld, res);
 252             if (entry) {
 253                 debug("ldap dn: %s\n", ldap_get_dn(ld, entry));
 254                 if (edir_universal_passwd) {
 255
 256                     /* allocate some memory for the universal password returned by NMAS */
 257                     universal_password = (char*)calloc(1, universal_password_len);
 258                     values = (char**)calloc(1, sizeof(char *));
 259
 260                     /* actually talk to NMAS to get a password */
 261                     nmas_res = nds_get_password(ld, ldap_get_dn(ld, entry), &universal_password_len, universal_password);
 262                     if (nmas_res == LDAP_SUCCESS && universal_password) {
 263                         debug("NMAS returned value %s\n", universal_password);
 264                         values[0] = universal_password;
 265                     } else {
 266                         debug("Error reading Universal Password: %d = %s\n", nmas_res, ldap_err2string(nmas_res));
 267                     }
 268                 } else {
 269                     values = ldap_get_values(ld, entry, passattr);
 270                 }
 271             } else {
 272                 ldap_msgfree(res);
 273                 return NULL;
 274             }
 275             if (!values) {
 276                 debug("No attribute value found\n");
 277                 if (edir_universal_passwd)
 278                     free(universal_password);
 279                 ldap_msgfree(res);
 280                 return NULL;
 281             }
 282             value = values;
 283             while (*value) {
 284                 if (encrpass) {
 285                     if (strcmp(strtok(*value, delimiter), realm) == 0) {
 286                         password = strtok(NULL, delimiter);
 287                         break;
 288                     }
 289                 } else {
 290                     password = *value;
 291                     break;
 292                 }
 293                 value++;
 294             }
 295             debug("password: %s\n", password);
 296             if (password)
 297                 password = xstrdup(password);
 298             if (edir_universal_passwd) {
 299                 free(values);
 300                 free(universal_password);
 301             } else {
 302                 ldap_value_free(values);
 303             }
 304             ldap_msgfree(res);
 305             return password;
 306         } else {
 307             fprintf(stderr, PROGRAM_NAME " WARNING, LDAP error '%s'\n", ldap_err2string(rc));
 308             /* try to connect to the LDAP server agin, maybe my persisten conexion failed. */
 309             if (!retry) {
 310                 retry++;
 311                 ldap_unbind(ld);
 312                 ld = NULL;
 313                 ldapconnect();
 314                 goto retrydnattr;
 315             }
 316             return NULL;
 317         }
 318     }
 319     return NULL;
 320 }
 321
 322
 323
 324 static void
 325 ldapconnect(void)
 326 {
 327     int rc;
 328
 329     /* On Windows ldap_start_tls_s is available starting from Windows XP,
 330      * so we need to bind at run-time with the function entry point
 331      */
 332 #if _SQUID_MSWIN_
 333     if (use_tls) {
 334
 335         HMODULE WLDAP32Handle;
 336
 337         WLDAP32Handle = GetModuleHandle("wldap32");
 338         if ((Win32_ldap_start_tls_s = (PFldap_start_tls_s) GetProcAddress(WLDAP32Handle, LDAP_START_TLS_S)) == NULL) {
 339             fprintf(stderr, PROGRAM_NAME ": ERROR: TLS (-Z) not supported on this platform.\n");
 340             exit(1);
 341         }
 342     }
 343 #endif
 344
 345     if (ld == NULL) {
 346 #if HAS_URI_SUPPORT
 347         if (strstr(ldapServer, "://") != NULL) {
 348             rc = ldap_initialize(&ld, ldapServer);
 349             if (rc != LDAP_SUCCESS) {
 350                 fprintf(stderr, "\nUnable to connect to LDAPURI:%s\n", ldapServer);
 351             }
 352         } else
 353 #endif
 354 #if NETSCAPE_SSL
 355             if (sslpath) {
 356                 if (!sslinit && (ldapssl_client_init(sslpath, NULL) != LDAP_SUCCESS)) {
 357                     fprintf(stderr, "\nUnable to initialise SSL with cert path %s\n",
 358                             sslpath);
 359                     exit(1);
 360                 } else {
 361                     sslinit++;
 362                 }
 363                 if ((ld = ldapssl_init(ldapServer, port, 1)) == NULL) {
 364                     fprintf(stderr, "\nUnable to connect to SSL LDAP server: %s port:%d\n",
 365                             ldapServer, port);
 366                     exit(1);
 367                 }
 368             } else
 369 #endif
 370                 if ((ld = ldap_init(ldapServer, port)) == NULL) {
 371                     fprintf(stderr, "\nUnable to connect to LDAP server:%s port:%d\n", ldapServer, port);
 372                 }
 373         if (connect_timeout)
 374             squid_ldap_set_connect_timeout(connect_timeout);
 375
 376 #ifdef LDAP_VERSION3
 377         if (version == -1) {
 378             version = LDAP_VERSION2;
 379         }
 380         if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)
 381                 != LDAP_SUCCESS) {
 382             fprintf(stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
 383                     version);
 384             ldap_unbind(ld);
 385             ld = NULL;
 386         }
 387         if (use_tls) {
 388 #ifdef LDAP_OPT_X_TLS
 389             if ((version == LDAP_VERSION3) && (ldap_start_tls_s(ld, NULL, NULL) == LDAP_SUCCESS)) {
 390                 fprintf(stderr, "Could not Activate TLS connection\n");
 391                 ldap_unbind(ld);
 392                 ld = NULL;
 393             }
 394 #else
 395             fprintf(stderr, "TLS not supported with your LDAP library\n");
 396             ldap_unbind(ld);
 397             ld = NULL;
 398 #endif
 399         }
 400 #endif
 401         squid_ldap_set_timelimit(timelimit);
 402         squid_ldap_set_referrals(!noreferrals);
 403         squid_ldap_set_aliasderef(aliasderef);
 404         if (binddn && bindpasswd && *binddn && *bindpasswd) {
 405             rc = ldap_simple_bind_s(ld, binddn, bindpasswd);
 406             if (rc != LDAP_SUCCESS) {
 407                 fprintf(stderr, PROGRAM_NAME " WARNING, could not bind to binddn '%s'\n", ldap_err2string(rc));
 408                 ldap_unbind(ld);
 409                 ld = NULL;
 410             }
 411         }
 412         debug("Connected OK\n");
 413     }
 414 }
 415 int
 416 LDAPArguments(int argc, char **argv)
 417 {
 418     setbuf(stdout, NULL);
 419
 420     while (argc > 1 && argv[1][0] == '-') {
 421         const char *value = "";
 422         char option = argv[1][1];
 423         switch (option) {
 424         case 'P':
 425         case 'R':
 426         case 'z':
 427         case 'Z':
 428         case 'g':
 429         case 'e':
 430         case 'S':
 431         case 'n':
 432         case 'd':
 433             break;
 434         default:
 435             if (strlen(argv[1]) > 2) {
 436                 value = argv[1] + 2;
 437             } else if (argc > 2) {
 438                 value = argv[2];
 439                 argv++;
 440                 argc--;
 441             } else
 442                 value = "";
 443             break;
 444         }
 445         argv++;
 446         argc--;
 447         switch (option) {
 448         case 'H':
 449 #if !HAS_URI_SUPPORT
 450             fprintf(stderr, "ERROR: Your LDAP library does not have URI support\n");
 451             return 1;
 452 #endif
 453             /* Fall thru to -h */
 454         case 'h':
 455             if (ldapServer) {
 456                 int len = strlen(ldapServer) + 1 + strlen(value) + 1;
 457                 char *newhost = (char*)malloc(len);
 458                 snprintf(newhost, len, "%s %s", ldapServer, value);
 459                 free(ldapServer);
 460                 ldapServer = newhost;
 461             } else {
 462                 ldapServer = xstrdup(value);
 463             }
 464             break;
 465         case 'A':
 466             passattr = value;
 467             break;
 468         case 'e':
 469             encrpass = 1;
 470             break;
 471         case 'l':
 472             delimiter = value;
 473             break;
 474         case 'b':
 475             userbasedn = value;
 476             break;
 477         case 'F':
 478             usersearchfilter = value;
 479             break;
 480         case 'u':
 481             userdnattr = value;
 482             break;
 483         case 's':
 484             if (strcmp(value, "base") == 0)
 485                 searchscope = LDAP_SCOPE_BASE;
 486             else if (strcmp(value, "one") == 0)
 487                 searchscope = LDAP_SCOPE_ONELEVEL;
 488             else if (strcmp(value, "sub") == 0)
 489                 searchscope = LDAP_SCOPE_SUBTREE;
 490             else {
 491                 fprintf(stderr, PROGRAM_NAME " ERROR: Unknown search scope '%s'\n", value);
 492                 return 1;
 493             }
 494             break;
 495         case 'S':
 496 #if defined(NETSCAPE_SSL)
 497             sslpath = value;
 498             if (port == LDAP_PORT)
 499                 port = LDAPS_PORT;
 500 #else
 501             fprintf(stderr, PROGRAM_NAME " ERROR: -E unsupported with this LDAP library\n");
 502             return 1;
 503 #endif
 504             break;
 505         case 'c':
 506             connect_timeout = atoi(value);
 507             break;
 508         case 't':
 509             timelimit = atoi(value);
 510             break;
 511         case 'a':
 512             if (strcmp(value, "never") == 0)
 513                 aliasderef = LDAP_DEREF_NEVER;
 514             else if (strcmp(value, "always") == 0)
 515                 aliasderef = LDAP_DEREF_ALWAYS;
 516             else if (strcmp(value, "search") == 0)
 517                 aliasderef = LDAP_DEREF_SEARCHING;
 518             else if (strcmp(value, "find") == 0)
 519                 aliasderef = LDAP_DEREF_FINDING;
 520             else {
 521                 fprintf(stderr, PROGRAM_NAME " ERROR: Unknown alias dereference method '%s'\n", value);
 522                 return 1;
 523             }
 524             break;
 525         case 'D':
 526             binddn = value;
 527             break;
 528         case 'w':
 529             bindpasswd = value;
 530             break;
 531         case 'W':
 532             readSecret(value);
 533             break;
 534         case 'P':
 535             persistent = !persistent;
 536             break;
 537         case 'p':
 538             port = atoi(value);
 539             break;
 540         case 'R':
 541             noreferrals = !noreferrals;
 542             break;
 543 #ifdef LDAP_VERSION3
 544         case 'v':
 545             switch (atoi(value)) {
 546             case 2:
 547                 version = LDAP_VERSION2;
 548                 break;
 549             case 3:
 550                 version = LDAP_VERSION3;
 551                 break;
 552             default:
 553                 fprintf(stderr, "Protocol version should be 2 or 3\n");
 554                 return 1;
 555             }
 556             break;
 557         case 'Z':
 558             if (version == LDAP_VERSION2) {
 559                 fprintf(stderr, "TLS (-Z) is incompatible with version %d\n",
 560                         version);
 561                 return 1;
 562             }
 563             version = LDAP_VERSION3;
 564             use_tls = 1;
 565             break;
 566 #endif
 567         case 'd':
 568             debug_enabled = 1;
 569             break;
 570         case 'E':
 571             strip_nt_domain = 1;
 572             break;
 573         case 'n':
 574             edir_universal_passwd = 1;
 575             break;
 576         default:
 577             fprintf(stderr, PROGRAM_NAME " ERROR: Unknown command line option '%c'\n", option);
 578             return 1;
 579         }
 580     }
 581
 582     while (argc > 1) {
 583         char *value = argv[1];
 584         if (ldapServer) {
 585             int len = strlen(ldapServer) + 1 + strlen(value) + 1;
 586             char *newhost = (char*)malloc(len);
 587             snprintf(newhost, len, "%s %s", ldapServer, value);
 588             free(ldapServer);
 589             ldapServer = newhost;
 590         } else {
 591             ldapServer = xstrdup(value);
 592         }
 593         argc--;
 594         argv++;
 595     }
 596
 597     if (!ldapServer)
 598         ldapServer = (char *) "localhost";
 599
 600     if (!userbasedn || !((passattr != NULL) || (edir_universal_passwd && usersearchfilter && version == LDAP_VERSION3 && use_tls))) {
 601         fprintf(stderr, "Usage: " PROGRAM_NAME " -b basedn -f filter [options] ldap_server_name\n\n");
 602         fprintf(stderr, "\t-A password attribute(REQUIRED)\t\tUser attribute that contains the password\n");
 603         fprintf(stderr, "\t-l password realm delimiter(REQUIRED)\tCharater(s) that devides the password attribute\n\t\t\t\t\t\tin realm and password tokens, default ':' realm:password\n");
 604         fprintf(stderr, "\t-b basedn (REQUIRED)\t\t\tbase dn under where to search for users\n");
 605         fprintf(stderr, "\t-e Encrypted passwords(REQUIRED)\tPassword are stored encrypted using HHA1\n");
 606         fprintf(stderr, "\t-F filter\t\t\t\tuser search filter pattern. %%s = login\n");
 607         fprintf(stderr, "\t-u attribute\t\t\t\tattribute to use in combination with the basedn to create the user DN\n");
 608         fprintf(stderr, "\t-s base|one|sub\t\t\t\tsearch scope\n");
 609         fprintf(stderr, "\t-D binddn\t\t\t\tDN to bind as to perform searches\n");
 610         fprintf(stderr, "\t-w bindpasswd\t\t\t\tpassword for binddn\n");
 611         fprintf(stderr, "\t-W secretfile\t\t\t\tread password for binddn from file secretfile\n");
 612 #if HAS_URI_SUPPORT
 613         fprintf(stderr, "\t-H URI\t\t\t\t\tLDAPURI (defaults to ldap://localhost)\n");
 614 #endif
 615         fprintf(stderr, "\t-h server\t\t\t\tLDAP server (defaults to localhost)\n");
 616         fprintf(stderr, "\t-p port\t\t\t\t\tLDAP server port (defaults to %d)\n", LDAP_PORT);
 617         fprintf(stderr, "\t-P\t\t\t\t\tpersistent LDAP connection\n");
 618 #if defined(NETSCAPE_SSL)
 619         fprintf(stderr, "\t-E sslcertpath\t\t\t\tenable LDAP over SSL\n");
 620 #endif
 621         fprintf(stderr, "\t-c timeout\t\t\t\tconnect timeout\n");
 622         fprintf(stderr, "\t-t timelimit\t\t\t\tsearch time limit\n");
 623         fprintf(stderr, "\t-R\t\t\t\t\tdo not follow referrals\n");
 624         fprintf(stderr, "\t-a never|always|search|find\t\twhen to dereference aliases\n");
 625 #ifdef LDAP_VERSION3
 626         fprintf(stderr, "\t-v 2|3\t\t\t\t\tLDAP version\n");
 627         fprintf(stderr, "\t-Z\t\t\t\t\tTLS encrypt the LDAP connection, requires\n\t\t\t\tLDAP version 3\n");
 628 #endif
 629         fprintf(stderr, "\t-S\t\t\t\t\tStrip NT domain from usernames\n");
 630         fprintf(stderr, "\t-n\t\t\t\t\tGet an eDirectory Universal Password from Novell NMAS\n\t\t\t\t\t\t(requires bind credentials, version 3, TLS, and a search filter)\n");
 631         fprintf(stderr, "\n");
 632         fprintf(stderr, "\tIf you need to bind as a user to perform searches then use the\n\t-D binddn -w bindpasswd or -D binddn -W secretfile options\n\n");
 633         return -1;
 634     }
 635     return 0;
 636 }
 637 static int
 638 readSecret(const char *filename)
 639 {
 640     char buf[BUFSIZ];
 641     char *e = 0;
 642     FILE *f;
 643
 644     if (!(f = fopen(filename, "r"))) {
 645         fprintf(stderr, PROGRAM_NAME " ERROR: Can not read secret file %s\n", filename);
 646         return 1;
 647     }
 648     if (!fgets(buf, sizeof(buf) - 1, f)) {
 649         fprintf(stderr, PROGRAM_NAME " ERROR: Secret file %s is empty\n", filename);
 650         fclose(f);
 651         return 1;
 652     }
 653     /* strip whitespaces on end */
 654     if ((e = strrchr(buf, '\n')))
 655         *e = 0;
 656     if ((e = strrchr(buf, '\r')))
 657         *e = 0;
 658
 659     bindpasswd = xstrdup(buf);
 660     if (!bindpasswd) {
 661         fprintf(stderr, PROGRAM_NAME " ERROR: can not allocate memory\n");
 662     }
 663     fclose(f);
 664
 665     return 0;
 666 }
 667
 668 void
 669 LDAPHHA1(RequestData * requestData)
 670 {
 671     char *password;
 672     ldapconnect();
 673     password = getpassword(requestData->user, requestData->realm);
 674     if (password != NULL) {
 675         if (encrpass)
 676             xstrncpy(requestData->HHA1, password, sizeof(requestData->HHA1));
 677         else {
 678             HASH HA1;
 679             DigestCalcHA1("md5", requestData->user, requestData->realm, password, NULL, NULL, HA1, requestData->HHA1);
 680         }
 681         free(password);
 682     } else {
 683         requestData->error = -1;
 684     }
 685
 686 }