#endif	fprintf(stderr, "\t-h server\t\tLDAP server (defaults to localhost)\n");	fprintf(stderr, "\t-p port\t\t\tLDAP server port (defaults to %d)\n", LDAP_PORT);	fprintf(stderr, "\t-P\t\t\tpersistent LDAP connection\n");#if defined(NETSCAPE_SSL)	fprintf(stderr, "\t-E sslcertpath\t\tenable LDAP over SSL\n");#endif	fprintf(stderr, "\t-c timeout\t\tconnect timeout\n");	fprintf(stderr, "\t-t timelimit\t\tsearch time limit\n");	fprintf(stderr, "\t-R\t\t\tdo not follow referrals\n");	fprintf(stderr, "\t-a never|always|search|find\n\t\t\t\twhen to dereference aliases\n");#ifdef LDAP_VERSION3	fprintf(stderr, "\t-v 2|3\t\t\tLDAP version\n");	fprintf(stderr, "\t-Z\t\t\tTLS encrypt the LDAP connection, requires\n\t\t\t\tLDAP version 3\n");#endif	fprintf(stderr, "\t-g\t\t\tfirst query parameter is base DN extension\n\t\t\t\tfor this query\n");	fprintf(stderr, "\t-S\t\t\tStrip NT domain from usernames\n");	fprintf(stderr, "\n");	fprintf(stderr, "\tIf you need to bind as a user to perform searches then use the\n\t-D binddn -w bindpasswd or -D binddn -W secretfile options\n\n");	exit(1);    }/* On Windows ldap_start_tls_s is available starting from Windows XP,  * so we need to bind at run-time with the function entry point */#ifdef _SQUID_MSWIN_    if (use_tls) {	HMODULE WLDAP32Handle;	WLDAP32Handle = GetModuleHandle("wldap32");	if ((Win32_ldap_start_tls_s = (PFldap_start_tls_s) GetProcAddress(WLDAP32Handle, LDAP_START_TLS_S)) == NULL) {	    fprintf(stderr, PROGRAM_NAME ": ERROR: TLS (-Z) not supported on this platform.\n");	    exit(1);	}    }#endif    while (fgets(buf, 256, stdin) != NULL) {	int found = 0;	if (!strchr(buf, '\n')) {	    /* too large message received.. skip and deny */	    fprintf(stderr, "%s: ERROR: Too large: %s\n", argv[0], buf);	    while (fgets(buf, sizeof(buf), stdin)) {		fprintf(stderr, "%s: ERROR: Too large..: %s\n", argv[0], buf);		if (strchr(buf, '\n') != NULL)		    break;	    }	    goto error;	}	user = strtok(buf, " \n");	if (!user) {	    fprintf(stderr, "%s: Invalid request\n", argv[0]);	    goto error;	}	rfc1738_unescape(user);	if (strip_nt_domain) {	    char *u = strchr(user, '\\');	    if (!u)		u = strchr(user, '/');	    if (u && u[1])		user = u + 1;	}	if (use_extension_dn) {	    extension_dn = strtok(NULL, " \n");	    if (!extension_dn) {		fprintf(stderr, "%s: Invalid request\n", argv[0]);		goto error;	    }	    rfc1738_unescape(extension_dn);	}	while (!found && user && (group = strtok(NULL, " \n")) != NULL) {	    rfc1738_unescape(group);	  recover:	    if (ld == NULL) {#if HAS_URI_SUPPORT		if (strstr(ldapServer, "://") != NULL) {		    rc = ldap_initialize(&ld, ldapServer);		    if (rc != LDAP_SUCCESS) {			fprintf(stderr, "\nUnable to connect to LDAPURI:%s\n", ldapServer);			break;		    }		} else#endif#if NETSCAPE_SSL		if (sslpath) {		    if (!sslinit && (ldapssl_client_init(sslpath, NULL) != LDAP_SUCCESS)) {			fprintf(stderr, "\nUnable to initialise SSL with cert path %s\n",			    sslpath);			exit(1);		    } else {			sslinit++;		    }		    if ((ld = ldapssl_init(ldapServer, port, 1)) == NULL) {			fprintf(stderr, "\nUnable to connect to SSL LDAP server: %s port:%d\n",			    ldapServer, port);			exit(1);		    }		} else#endif		if ((ld = ldap_init(ldapServer, port)) == NULL) {		    fprintf(stderr, "\nUnable to connect to LDAP server:%s port:%d\n", ldapServer, port);		    break;		}		if (connect_timeout)		    squid_ldap_set_connect_timeout(ld, connect_timeout);#ifdef LDAP_VERSION3		if (version == -1) {		    version = LDAP_VERSION2;		}		if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_SUCCESS) {		    fprintf(stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",			version);		    ldap_unbind(ld);		    ld = NULL;		    break;		}		if (use_tls) {#ifdef LDAP_OPT_X_TLS		    if (version != LDAP_VERSION3) {			fprintf(stderr, "TLS requires LDAP version 3\n");			exit(1);		    } else if (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS) {			fprintf(stderr, "Could not Activate TLS connection\n");			ldap_unbind(ld);			ld = NULL;			break;		    }#else		    fprintf(stderr, "TLS not supported with your LDAP library\n");		    exit(1);#endif		}#endif		squid_ldap_set_timelimit(ld, timelimit);		squid_ldap_set_referrals(ld, !noreferrals);		squid_ldap_set_aliasderef(ld, aliasderef);		if (binddn && bindpasswd && *binddn && *bindpasswd) {		    rc = ldap_simple_bind_s(ld, binddn, bindpasswd);		    if (rc != LDAP_SUCCESS) {			fprintf(stderr, PROGRAM_NAME " WARNING, could not bind to binddn '%s'\n", ldap_err2string(rc));			ldap_unbind(ld);			ld = NULL;			break;		    }		}		if (debug)		    fprintf(stderr, "Connected OK\n");	    }	    if (searchLDAP(ld, group, user, extension_dn) == 0) {		found = 1;		break;	    } else {		if (tryagain) {		    tryagain = 0;		    ldap_unbind(ld);		    ld = NULL;		    goto recover;		}	    }	}	if (found)	    printf("OK\n");	else {	  error:	    printf("ERR\n");	}	if (ld != NULL) {	    if (!persistent || (squid_ldap_errno(ld) != LDAP_SUCCESS && squid_ldap_errno(ld) != LDAP_INVALID_CREDENTIALS)) {		ldap_unbind(ld);		ld = NULL;	    } else {		tryagain = 1;	    }	}	err = 0;    }    if (ld)	ldap_unbind(ld);    return 0;}static intldap_escape_value(char *escaped, int size, const char *src){    int n = 0;    while (size > 4 && *src) {	switch (*src) {	case '*':	case '(':	case ')':	case '\\':	    n += 3;	    size -= 3;	    if (size > 0) {		*escaped++ = '\\';		snprintf(escaped, 3, "%02x", (unsigned char) *src++);		escaped += 2;	    }	    break;	default:	    *escaped++ = *src++;	    n++;	    size--;	}    }    *escaped = '\0';    return n;}static intbuild_filter(char *filter, int size, const char *template, const char *user, const char *group){    int n;    while (*template && size > 0) {	switch (*template) {	case '%':	    template++;	    switch (*template) {	    case 'u':	    case 'v':		template++;		n = ldap_escape_value(filter, size, user);		size -= n;		filter += n;		break;	    case 'g':	    case 'a':		template++;		n = ldap_escape_value(filter, size, group);		size -= n;		filter += n;		break;	    default:		fprintf(stderr, "ERROR: Unknown filter template string %%%c\n", *template);		return 1;		break;	    }	    break;	case '\\':	    template++;	    if (*template) {		*filter++ = *template++;		size--;	    }	    break;	default:	    *filter++ = *template++;	    size--;	    break;	}    }    if (size <= 0) {	fprintf(stderr, "ERROR: Filter too large\n");	return 1;    }    *filter = '\0';    return 0;}static intsearchLDAPGroup(LDAP * ld, char *group, char *member, char *extension_dn){    char filter[256];    static char searchbase[256];    LDAPMessage *res = NULL;    LDAPMessage *entry;    int rc;    char *searchattr[] =    {LDAP_NO_ATTRS, NULL};    if (extension_dn && *extension_dn)	snprintf(searchbase, sizeof(searchbase), "%s,%s", extension_dn, basedn);    else	snprintf(searchbase, sizeof(searchbase), "%s", basedn);    if (build_filter(filter, sizeof(filter), searchfilter, member, group) != 0) {	fprintf(stderr, PROGRAM_NAME " ERROR, Failed to construct LDAP search filter. filter=\"%s\", user=\"%s\", group=\"%s\"\n", filter, member, group);	return 1;    }    if (debug)	fprintf(stderr, "group filter '%s', searchbase '%s'\n", filter, searchbase);    rc = ldap_search_s(ld, searchbase, searchscope, filter, searchattr, 1, &res);    if (rc != LDAP_SUCCESS) {	if (noreferrals && rc == LDAP_PARTIAL_RESULTS) {	    /* Everything is fine. This is expected when referrals	     * are disabled.	     */	} else {	    fprintf(stderr, PROGRAM_NAME " WARNING, LDAP search error '%s'\n", ldap_err2string(rc));#if defined(NETSCAPE_SSL)	    if (sslpath && ((rc == LDAP_SERVER_DOWN) || (rc == LDAP_CONNECT_ERROR))) {		int sslerr = PORT_GetError();		fprintf(stderr, PROGRAM_NAME ": WARNING, SSL error %d (%s)\n", sslerr, ldapssl_err2string(sslerr));	    }#endif	    ldap_msgfree(res);	    return 1;	}    }    entry = ldap_first_entry(ld, res);    if (!entry) {	ldap_msgfree(res);	return 1;    }    ldap_msgfree(res);    return 0;}static intsearchLDAP(LDAP * ld, char *group, char *login, char *extension_dn){    if (usersearchfilter) {	char filter[8192];	char searchbase[8192];	char escaped_login[1024];	LDAPMessage *res = NULL;	LDAPMessage *entry;	int rc;	char *userdn;	char *searchattr[] =	{LDAP_NO_ATTRS, NULL};	if (extension_dn && *extension_dn)	    snprintf(searchbase, sizeof(searchbase), "%s,%s", extension_dn, userbasedn ? userbasedn : basedn);	else	    snprintf(searchbase, sizeof(searchbase), "%s", userbasedn ? userbasedn : basedn);	ldap_escape_value(escaped_login, sizeof(escaped_login), login);	snprintf(filter, sizeof(filter), usersearchfilter, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login);	if (debug)	    fprintf(stderr, "user filter '%s', searchbase '%s'\n", filter, searchbase);	rc = ldap_search_s(ld, searchbase, searchscope, filter, searchattr, 1, &res);	if (rc != LDAP_SUCCESS) {	    if (noreferrals && rc == LDAP_PARTIAL_RESULTS) {		/* Everything is fine. This is expected when referrals		 * are disabled.		 */	    } else {		fprintf(stderr, PROGRAM_NAME " WARNING, LDAP search error '%s'\n", ldap_err2string(rc));#if defined(NETSCAPE_SSL)		if (sslpath && ((rc == LDAP_SERVER_DOWN) || (rc == LDAP_CONNECT_ERROR))) {		    int sslerr = PORT_GetError();		    fprintf(stderr, PROGRAM_NAME ": WARNING, SSL error %d (%s)\n", sslerr, ldapssl_err2string(sslerr));		}#endif		ldap_msgfree(res);		return 1;	    }	}	entry = ldap_first_entry(ld, res);	if (!entry) {	    fprintf(stderr, PROGRAM_NAME " WARNING, User '%s' not found in '%s'\n", login, searchbase);	    ldap_msgfree(res);	    return 1;	}	userdn = ldap_get_dn(ld, entry);	rc = searchLDAPGroup(ld, group, userdn, extension_dn);	squid_ldap_memfree(userdn);	ldap_msgfree(res);	return rc;    } else if (userdnattr) {	char dn[8192];	if (extension_dn && *extension_dn)	    sprintf(dn, "%s=%s, %s, %s", userdnattr, login, extension_dn, userbasedn ? userbasedn : basedn);	else	    sprintf(dn, "%s=%s, %s", userdnattr, login, userbasedn ? userbasedn : basedn);	return searchLDAPGroup(ld, group, dn, extension_dn);    } else {	return searchLDAPGroup(ld, group, login, extension_dn);    }}int readSecret(char *filename){    char buf[BUFSIZ];    char *e = 0;    FILE *f;    if (!(f = fopen(filename, "r"))) {	fprintf(stderr, PROGRAM_NAME " ERROR: Can not read secret file %s\n", filename);	return 1;    }    if (!fgets(buf, sizeof(buf) - 1, f)) {	fprintf(stderr, PROGRAM_NAME " ERROR: Secret file %s is empty\n", filename);	fclose(f);	return 1;    }    /* strip whitespaces on end */    if ((e = strrchr(buf, '\n')))	*e = 0;    if ((e = strrchr(buf, '\r')))	*e = 0;    bindpasswd = (char *) calloc(sizeof(char), strlen(buf) + 1);    if (bindpasswd) {	strcpy(bindpasswd, buf);    } else {	fprintf(stderr, PROGRAM_NAME " ERROR: can not allocate memory\n");    }    fclose(f);    return 0;}