/* * squid_ldap_group: lookup group membership in LDAP * * (C)2002,2003 MARA Systems AB * * License: squid_ldap_group is free software; you can redistribute it * and/or modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2, * or (at your option) any later version. *  * Authors: *  Flavio Pescuma <flavio@marasystems.com> *  Henrik Nordstrom <hno@marasystems.com> *  MARA Systems AB, Sweden <http://www.marasystems.com> * * With contributions from others mentioned in the ChangeLog file * * In part based on squid_ldap_auth by Glen Newton and Henrik Nordstrom. * * Latest version of this program can always be found from MARA Systems * at http://marasystems.com/download/LDAP_Group/ *  * Dependencies: You need to get the OpenLDAP libraries * from http://www.openldap.org or use another compatible * LDAP C-API library. * * If you want to make a TLS enabled connection you will also need the * OpenSSL libraries linked into openldap. See http://www.openssl.org/ *  * License: squid_ldap_group is free software; you can redistribute it  * and/or modify it under the terms of the GNU General Public License  * as published by the Free Software Foundation; either version 2,  * or (at your option) any later version. */#define LDAP_DEPRECATED 1#include "util.h"#include <stdio.h>#include <string.h>#include <stdlib.h>#include <ctype.h>#ifdef _SQUID_MSWIN_		/* Native Windows port and MinGW */#define snprintf _snprintf#include <windows.h>#include <winldap.h>#ifndef LDAPAPI#define LDAPAPI __cdecl#endif#ifdef LDAP_VERSION3#ifndef LDAP_OPT_X_TLS#define LDAP_OPT_X_TLS 0x6000#endif/* Some tricks to allow dynamic bind with ldap_start_tls_s entry point at * run time. */#undef ldap_start_tls_s#if LDAP_UNICODE#define LDAP_START_TLS_S "ldap_start_tls_sW"typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlW *, IN PLDAPControlW *);#else#define LDAP_START_TLS_S "ldap_start_tls_sA"typedef WINLDAPAPI ULONG(LDAPAPI * PFldap_start_tls_s) (IN PLDAP, OUT PULONG, OUT LDAPMessage **, IN PLDAPControlA *, IN PLDAPControlA *);#endif /* LDAP_UNICODE */PFldap_start_tls_s Win32_ldap_start_tls_s;#define ldap_start_tls_s(l,s,c) Win32_ldap_start_tls_s(l,NULL,NULL,s,c)#endif /* LDAP_VERSION3 */#else#include <lber.h>#include <ldap.h>#endif#if defined(LDAP_OPT_NETWORK_TIMEOUT)#include <sys/time.h>#endif#define PROGRAM_NAME "squid_ldap_group"#define PROGRAM_VERSION "2.17"/* Globals */static char *basedn = NULL;static char *searchfilter = NULL;static char *userbasedn = NULL;static char *userdnattr = NULL;static char *usersearchfilter = NULL;static char *binddn = NULL;static char *bindpasswd = NULL;static int searchscope = LDAP_SCOPE_SUBTREE;static int persistent = 0;static int noreferrals = 0;static int debug = 0;static int aliasderef = LDAP_DEREF_NEVER;#if defined(NETSCAPE_SSL)static char *sslpath = NULL;static int sslinit = 0;#endifstatic int connect_timeout = 0;static int timelimit = LDAP_NO_LIMIT;#ifdef LDAP_VERSION3/* Added for TLS support and version 3 */static int use_tls = 0;static int version = -1;#endifstatic int searchLDAP(LDAP * ld, char *group, char *user, char *extension_dn);static int readSecret(char *filename);/* Yuck.. we need to glue to different versions of the API */#ifndef LDAP_NO_ATTRS#define LDAP_NO_ATTRS "1.1"#endif#if defined(LDAP_API_VERSION) && LDAP_API_VERSION > 1823static intsquid_ldap_errno(LDAP * ld){    int err = 0;    ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &err);    return err;}static voidsquid_ldap_set_aliasderef(LDAP * ld, int deref){    ldap_set_option(ld, LDAP_OPT_DEREF, &deref);}static voidsquid_ldap_set_referrals(LDAP * ld, int referrals){    int *value = referrals ? LDAP_OPT_ON : LDAP_OPT_OFF;    ldap_set_option(ld, LDAP_OPT_REFERRALS, value);}static voidsquid_ldap_set_timelimit(LDAP * ld, int timelimit){    ldap_set_option(ld, LDAP_OPT_TIMELIMIT, &timelimit);}static voidsquid_ldap_set_connect_timeout(LDAP * ld, int timelimit){#if defined(LDAP_OPT_NETWORK_TIMEOUT)    struct timeval tv;    tv.tv_sec = timelimit;    tv.tv_usec = 0;    ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);#elif defined(LDAP_X_OPT_CONNECT_TIMEOUT)    timelimit *= 1000;    ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timelimit);#endif}static voidsquid_ldap_memfree(char *p){    ldap_memfree(p);}#elsestatic intsquid_ldap_errno(LDAP * ld){    return ld->ld_errno;}static voidsquid_ldap_set_aliasderef(LDAP * ld, int deref){    ld->ld_deref = deref;}static voidsquid_ldap_set_referrals(LDAP * ld, int referrals){    if (referrals)	ld->ld_options |= ~LDAP_OPT_REFERRALS;    else	ld->ld_options &= ~LDAP_OPT_REFERRALS;}static voidsquid_ldap_set_timelimit(LDAP * ld, int timelimit){    ld->ld_timelimit = timelimit;}static voidsquid_ldap_set_connect_timeout(LDAP * ld, int timelimit){    fprintf(stderr, "Connect timeouts not supported in your LDAP library\n");}static voidsquid_ldap_memfree(char *p){    free(p);}#endif#ifdef LDAP_API_FEATURE_X_OPENLDAP#if LDAP_VENDOR_VERSION > 194#define HAS_URI_SUPPORT 1#endif#endifintmain(int argc, char **argv){    char buf[8192];    char *user, *group, *extension_dn = NULL;    char *ldapServer = NULL;    LDAP *ld = NULL;    int tryagain = 0, rc;    int port = LDAP_PORT;    int use_extension_dn = 0;    int strip_nt_domain = 0;    int err = 0;    setbuf(stdout, NULL);    while (argc > 1 && argv[1][0] == '-') {	char *value = "";	char option = argv[1][1];	switch (option) {	case 'P':	case 'R':	case 'z':	case 'Z':	case 'd':	case 'g':	case 'S':	    break;	default:	    if (strlen(argv[1]) > 2) {		value = argv[1] + 2;	    } else if (argc > 2) {		value = argv[2];		argv++;		argc--;	    } else		value = "";	    break;	}	argv++;	argc--;	switch (option) {	case 'H':#if !HAS_URI_SUPPORT	    fprintf(stderr, "ERROR: Your LDAP library does not have URI support\n");	    exit(1);#endif	    /* Fall thru to -h */	case 'h':	    if (ldapServer) {		int len = strlen(ldapServer) + 1 + strlen(value) + 1;		char *newhost = malloc(len);		snprintf(newhost, len, "%s %s", ldapServer, value);		free(ldapServer);		ldapServer = newhost;	    } else {		ldapServer = strdup(value);	    }	    break;	case 'b':	    basedn = value;	    break;	case 'f':	    searchfilter = value;	    break;	case 'B':	    userbasedn = value;	    break;	case 'F':	    usersearchfilter = value;	    break;	case 'u':	    userdnattr = value;	    break;	case 's':	    if (strcmp(value, "base") == 0)		searchscope = LDAP_SCOPE_BASE;	    else if (strcmp(value, "one") == 0)		searchscope = LDAP_SCOPE_ONELEVEL;	    else if (strcmp(value, "sub") == 0)		searchscope = LDAP_SCOPE_SUBTREE;	    else {		fprintf(stderr, PROGRAM_NAME " ERROR: Unknown search scope '%s'\n", value);		exit(1);	    }	    break;	case 'E':#if defined(NETSCAPE_SSL)	    sslpath = value;	    if (port == LDAP_PORT)		port = LDAPS_PORT;#else	    fprintf(stderr, PROGRAM_NAME " ERROR: -E unsupported with this LDAP library\n");	    exit(1);#endif	    break;	case 'c':	    connect_timeout = atoi(value);	    break;	case 't':	    timelimit = atoi(value);	    break;	case 'a':	    if (strcmp(value, "never") == 0)		aliasderef = LDAP_DEREF_NEVER;	    else if (strcmp(value, "always") == 0)		aliasderef = LDAP_DEREF_ALWAYS;	    else if (strcmp(value, "search") == 0)		aliasderef = LDAP_DEREF_SEARCHING;	    else if (strcmp(value, "find") == 0)		aliasderef = LDAP_DEREF_FINDING;	    else {		fprintf(stderr, PROGRAM_NAME " ERROR: Unknown alias dereference method '%s'\n", value);		exit(1);	    }	    break;	case 'D':	    binddn = value;	    break;	case 'w':	    bindpasswd = value;	    break;	case 'W':	    readSecret(value);	    break;	case 'P':	    persistent = !persistent;	    break;	case 'p':	    port = atoi(value);	    break;	case 'R':	    noreferrals = !noreferrals;	    break;#ifdef LDAP_VERSION3	case 'v':	    switch (atoi(value)) {	    case 2:		version = LDAP_VERSION2;		break;	    case 3:		version = LDAP_VERSION3;		break;	    default:		fprintf(stderr, "Protocol version should be 2 or 3\n");		exit(1);	    }	    break;	case 'Z':	    if (version == LDAP_VERSION2) {		fprintf(stderr, "TLS (-Z) is incompatible with version %d\n",		    version);		exit(1);	    }	    version = LDAP_VERSION3;	    use_tls = 1;	    break;#endif	case 'd':	    debug = 1;	    break;	case 'g':	    use_extension_dn = 1;	    break;	case 'S':	    strip_nt_domain = 1;	    break;	default:	    fprintf(stderr, PROGRAM_NAME " ERROR: Unknown command line option '%c'\n", option);	    exit(1);	}    }    while (argc > 1) {	char *value = argv[1];	if (ldapServer) {	    int len = strlen(ldapServer) + 1 + strlen(value) + 1;	    char *newhost = malloc(len);	    snprintf(newhost, len, "%s %s", ldapServer, value);	    free(ldapServer);	    ldapServer = newhost;	} else {	    ldapServer = strdup(value);	}	argc--;	argv++;    }    if (!ldapServer)	ldapServer = "localhost";    if (!basedn || !searchfilter) {	fprintf(stderr, "\n" PROGRAM_NAME " version " PROGRAM_VERSION "\n\n");	fprintf(stderr, "Usage: " PROGRAM_NAME " -b basedn -f filter [options] ldap_server_name\n\n");	fprintf(stderr, "\t-b basedn (REQUIRED)\tbase dn under where to search for groups\n");	fprintf(stderr, "\t-f filter (REQUIRED)\tgroup search filter pattern. %%v = user,\n\t\t\t\t%%a = group\n");	fprintf(stderr, "\t-B basedn (REQUIRED)\tbase dn under where to search for users\n");	fprintf(stderr, "\t-F filter (REQUIRED)\tuser search filter pattern. %%s = login\n");	fprintf(stderr, "\t-s base|one|sub\t\tsearch scope\n");	fprintf(stderr, "\t-D binddn\t\tDN to bind as to perform searches\n");	fprintf(stderr, "\t-w bindpasswd\t\tpassword for binddn\n");	fprintf(stderr, "\t-W secretfile\t\tread password for binddn from file secretfile\n");#if HAS_URI_SUPPORT	fprintf(stderr, "\t-H URI\t\t\tLDAPURI (defaults to ldap://localhost)\n");