985851
diff -up dhcp-3.1.0/server/mdb.c.ldap dhcp-3.1.0/server/mdb.c
985851
--- dhcp-3.1.0/server/mdb.c.ldap	2007-06-08 14:57:02.000000000 -0400
985851
+++ dhcp-3.1.0/server/mdb.c	2007-11-12 15:41:15.000000000 -0500
985851
@@ -454,6 +454,12 @@ int find_hosts_by_haddr (struct host_dec
985851
 {
985851
 	struct host_decl *foo;
985851
 	struct hardware h;
985851
+	int ret;
985851
+
985851
+#if defined(LDAP_CONFIGURATION)
985851
+	if ((ret = find_haddr_in_ldap (hp, htype, hlen, haddr, file, line)))
985851
+		return ret;
985851
+#endif
985851
 
985851
 	h.hlen = hlen + 1;
985851
 	h.hbuf [0] = htype;
985851
diff -up /dev/null dhcp-3.1.0/server/ldap_casa.c
985851
--- /dev/null	2007-11-12 10:55:50.854093917 -0500
985851
+++ dhcp-3.1.0/server/ldap_casa.c	2007-11-12 15:41:15.000000000 -0500
985851
@@ -0,0 +1,138 @@
985851
+/* ldap_casa.c
985851
+   
985851
+   CASA routines for DHCPD... */
985851
+
985851
+/* Copyright (c) 2004 Internet Systems Consorium, Inc. ("ISC")
985851
+ * Copyright (c) 1995-2003 Internet Software Consortium.
985851
+ * Copyright (c) 2006 Novell, Inc.
985851
+
985851
+ * All rights reserved.
985851
+ * Redistribution and use in source and binary forms, with or without 
985851
+ * modification, are permitted provided that the following conditions are met: 
985851
+ * 1.Redistributions of source code must retain the above copyright notice, 
985851
+ *   this list of conditions and the following disclaimer. 
985851
+ * 2.Redistributions in binary form must reproduce the above copyright notice, 
985851
+ *   this list of conditions and the following disclaimer in the documentation 
985851
+ *   and/or other materials provided with the distribution. 
985851
+ * 3.Neither the name of ISC, ISC DHCP, nor the names of its contributors 
985851
+ *   may be used to endorse or promote products derived from this software 
985851
+ *   without specific prior written permission. 
985851
+
985851
+ * THIS SOFTWARE IS PROVIDED BY INTERNET SYSTEMS CONSORTIUM AND CONTRIBUTORS 
985851
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
985851
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 
985851
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ISC OR CONTRIBUTORS BE LIABLE 
985851
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
985851
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
985851
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
985851
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 
985851
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 
985851
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
985851
+ * POSSIBILITY OF SUCH DAMAGE.
985851
+
985851
+ * This file was written by S Kalyanasundaram <skalyanasundaram@novell.com>
985851
+ */
985851
+
985851
+#if defined(LDAP_CASA_AUTH)
985851
+#include "ldap_casa.h"
985851
+#include "dhcpd.h"
985851
+
985851
+int
985851
+load_casa (void)
985851
+{
985851
+       if( !(casaIDK = dlopen(MICASA_LIB,RTLD_LAZY)))
985851
+       	  return 0;
985851
+       p_miCASAGetCredential = (CASA_GetCredential_T) dlsym(casaIDK, "miCASAGetCredential");
985851
+       p_miCASASetCredential = (CASA_SetCredential_T) dlsym(casaIDK, "miCASASetCredential");
985851
+       p_miCASARemoveCredential = (CASA_RemoveCredential_T) dlsym(casaIDK, "miCASARemoveCredential");
985851
+
985851
+       if((p_miCASAGetCredential == NULL) ||
985851
+         (p_miCASASetCredential == NULL) ||
985851
+         (p_miCASARemoveCredential == NULL))
985851
+       {
985851
+          if(casaIDK)
985851
+            dlclose(casaIDK);
985851
+          casaIDK = NULL;
985851
+          p_miCASAGetCredential = NULL;
985851
+          p_miCASASetCredential = NULL;
985851
+          p_miCASARemoveCredential = NULL;
985851
+          return 0;
985851
+       }
985851
+       else
985851
+          return 1;
985851
+}
985851
+
985851
+static void
985851
+release_casa(void)
985851
+{
985851
+   if(casaIDK)
985851
+   {
985851
+      dlclose(casaIDK);
985851
+      casaIDK = NULL;
985851
+   }
985851
+
985851
+   p_miCASAGetCredential = NULL;
985851
+   p_miCASASetCredential = NULL;
985851
+   p_miCASARemoveCredential = NULL;
985851
+
985851
+}
985851
+
985851
+int
985851
+load_uname_pwd_from_miCASA (char **ldap_username, char **ldap_password)
985851
+ {
985851
+   int                     result = 0;
985851
+   uint32_t                credentialtype = SSCS_CRED_TYPE_SERVER_F;
985851
+   SSCS_BASIC_CREDENTIAL   credential;
985851
+   SSCS_SECRET_ID_T        applicationSecretId;
985851
+   char                    *tempVar = NULL;
985851
+
985851
+   const char applicationName[10] = "dhcp-ldap";
985851
+
985851
+   if ( load_casa() )
985851
+   {
985851
+      memset(&credential, 0, sizeof(SSCS_BASIC_CREDENTIAL));
985851
+      memset(&applicationSecretId, 0, sizeof(SSCS_SECRET_ID_T));
985851
+
985851
+      applicationSecretId.len = strlen(applicationName) + 1;
985851
+      memcpy (applicationSecretId.id, applicationName, applicationSecretId.len);
985851
+
985851
+      credential.unFlags = USERNAME_TYPE_CN_F;
985851
+
985851
+      result = p_miCASAGetCredential (0,
985851
+                 &applicationSecretId,NULL,&credentialtype,
985851
+                 &credential,NULL);
985851
+
985851
+      if(credential.unLen)
985851
+      {
985851
+         tempVar = dmalloc (credential.unLen + 1, MDL);
985851
+         if (!tempVar)
985851
+             log_fatal ("no memory for ldap_username");
985851
+         memcpy(tempVar , credential.username, credential.unLen);
985851
+         *ldap_username = tempVar;
985851
+
985851
+         tempVar = dmalloc (credential.pwordLen + 1, MDL);
985851
+         if (!tempVar)
985851
+             log_fatal ("no memory for ldap_password");
985851
+         memcpy(tempVar, credential.password, credential.pwordLen);
985851
+         *ldap_password = tempVar;
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+         log_info ("Authentication credential taken from CASA");
985851
+#endif
985851
+
985851
+         release_casa();
985851
+         return 1;
985851
+
985851
+        }
985851
+        else
985851
+        {
985851
+            release_casa();
985851
+            return 0;
985851
+        }
985851
+      }
985851
+      else
985851
+          return 0; //casa libraries not loaded
985851
+ }
985851
+
985851
+#endif /* LDAP_CASA_AUTH */
985851
+
985851
diff -up dhcp-3.1.0/server/Makefile.dist.ldap dhcp-3.1.0/server/Makefile.dist
985851
--- dhcp-3.1.0/server/Makefile.dist.ldap	2006-07-25 09:26:00.000000000 -0400
985851
+++ dhcp-3.1.0/server/Makefile.dist	2007-11-12 15:41:15.000000000 -0500
985851
@@ -25,14 +25,14 @@
985851
 CATMANPAGES = dhcpd.cat8 dhcpd.conf.cat5 dhcpd.leases.cat5
985851
 SEDMANPAGES = dhcpd.man8 dhcpd.conf.man5 dhcpd.leases.man5
985851
 SRCS   = dhcpd.c dhcp.c bootp.c confpars.c db.c class.c failover.c \
985851
-	 omapi.c mdb.c stables.c salloc.c ddns.c dhcpleasequery.c
985851
+	 omapi.c mdb.c stables.c salloc.c ddns.c dhcpleasequery.c ldap.c ldap_casa.c
985851
 OBJS   = dhcpd.o dhcp.o bootp.o confpars.o db.o class.o failover.o \
985851
-	 omapi.o mdb.o stables.o salloc.o ddns.o dhcpleasequery.o
985851
+	 omapi.o mdb.o stables.o salloc.o ddns.o dhcpleasequery.o ldap.o ldap_casa.o
985851
 PROG   = dhcpd
985851
 MAN    = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
985851
 
985851
 INCLUDES = -I$(TOP) $(BINDINC) -I$(TOP)/includes
985851
-DHCPLIB = ../common/libdhcp.a $(BINDLIB) ../omapip/libomapi.a ../dst/libdst.a
985851
+DHCPLIB = ../common/libdhcp.a $(BINDLIB) ../omapip/libomapi.a ../dst/libdst-nomd5.a
985851
 CFLAGS = $(DEBUG) $(PREDEFINES) $(INCLUDES) $(COPTS)
985851
 
985851
 all:	$(PROG) $(CATMANPAGES)
985851
@@ -106,6 +106,6 @@ dhcpd.leases.man5:	dhcpd.leases.5
985851
 		-e "s#RUNDIR#$(VARRUN)#g" < dhcpd.leases.5 >dhcpd.leases.man5
985851
 
985851
 dhcpd:	$(OBJS) $(COBJ) $(DHCPLIB)
985851
-	$(CC) $(LFLAGS) -o dhcpd $(OBJS) $(DHCPLIB) $(LIBS)
985851
+	$(CC) $(LFLAGS) -o dhcpd $(OBJS) $(DHCPLIB) $(LIBS) -lldap
985851
 
985851
 # Dependencies (semi-automatically-generated)
985851
diff -up dhcp-3.1.0/server/dhcpd.c.ldap dhcp-3.1.0/server/dhcpd.c
985851
--- dhcp-3.1.0/server/dhcpd.c.ldap	2007-05-29 13:49:44.000000000 -0400
985851
+++ dhcp-3.1.0/server/dhcpd.c	2007-11-12 15:41:15.000000000 -0500
985851
@@ -440,6 +440,14 @@ int main (argc, argv, envp)
985851
 	/* Add the ddns update style enumeration prior to parsing. */
985851
 	add_enumeration (&ddns_styles);
985851
 	add_enumeration (&syslog_enum);
985851
+#if defined (LDAP_CONFIGURATION)
985851
+	add_enumeration (&ldap_methods);
985851
+#if defined (USE_SSL)
985851
+	add_enumeration (&ldap_ssl_usage_enum);
985851
+	add_enumeration (&ldap_tls_reqcert_enum);
985851
+	add_enumeration (&ldap_tls_crlcheck_enum);
985851
+#endif
985851
+#endif
985851
 
985851
 	if (!group_allocate (&root_group, MDL))
985851
 		log_fatal ("Can't allocate root group!");
985851
diff -up /dev/null dhcp-3.1.0/server/ldap.c
985851
--- /dev/null	2007-11-12 10:55:50.854093917 -0500
985851
+++ dhcp-3.1.0/server/ldap.c	2007-11-12 17:31:46.000000000 -0500
985851
@@ -0,0 +1,2003 @@
985851
+/* ldap.c
985851
+
985851
+   Routines for reading the configuration from LDAP */
985851
+
985851
+/*
985851
+ * Copyright (c) 2003-2006 Ntelos, Inc.
985851
+ * All rights reserved.
985851
+ *
985851
+ * Redistribution and use in source and binary forms, with or without
985851
+ * modification, are permitted provided that the following conditions
985851
+ * are met:
985851
+ *
985851
+ * 1. Redistributions of source code must retain the above copyright
985851
+ *    notice, this list of conditions and the following disclaimer.
985851
+ * 2. Redistributions in binary form must reproduce the above copyright
985851
+ *    notice, this list of conditions and the following disclaimer in the
985851
+ *    documentation and/or other materials provided with the distribution.
985851
+ * 3. Neither the name of The Internet Software Consortium nor the names
985851
+ *    of its contributors may be used to endorse or promote products derived
985851
+ *    from this software without specific prior written permission.
985851
+ *
985851
+ * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
985851
+ * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
985851
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
985851
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
985851
+ * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
985851
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
985851
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
985851
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
985851
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
985851
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
985851
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
985851
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
985851
+ * SUCH DAMAGE.
985851
+ *
985851
+ * This LDAP module was written by Brian Masney <masneyb@ntelos.net>. Its
985851
+ * development was sponsored by Ntelos, Inc. (www.ntelos.com).
985851
+ */
985851
+
985851
+#include "dhcpd.h"
985851
+#include <signal.h>
985851
+
985851
+#if defined(LDAP_CONFIGURATION)
985851
+
985851
+#if defined(LDAP_CASA_AUTH)
985851
+#include "ldap_casa.h"
985851
+#endif
985851
+
985851
+static LDAP * ld = NULL;
985851
+static char *ldap_server = NULL, 
985851
+            *ldap_username = NULL, 
985851
+            *ldap_password = NULL,
985851
+            *ldap_base_dn = NULL,
985851
+            *ldap_dhcp_server_cn = NULL,
985851
+            *ldap_debug_file = NULL;
985851
+static int ldap_port = LDAP_PORT,
985851
+           ldap_method = LDAP_METHOD_DYNAMIC,
985851
+           ldap_referrals = -1,
985851
+           ldap_debug_fd = -1;
985851
+#if defined (USE_SSL)
985851
+static int ldap_use_ssl = -1,        /* try TLS if possible */
985851
+           ldap_tls_reqcert = -1,
985851
+           ldap_tls_crlcheck = -1;
985851
+static char *ldap_tls_ca_file = NULL,
985851
+            *ldap_tls_ca_dir = NULL,
985851
+            *ldap_tls_cert = NULL,
985851
+            *ldap_tls_key = NULL,
985851
+            *ldap_tls_ciphers = NULL,
985851
+            *ldap_tls_randfile = NULL;
985851
+#endif
985851
+static struct ldap_config_stack *ldap_stack = NULL;
985851
+
985851
+typedef struct ldap_dn_node {
985851
+    struct ldap_dn_node *next;
985851
+    size_t refs;
985851
+    char *dn;
985851
+} ldap_dn_node;
985851
+
985851
+static ldap_dn_node *ldap_service_dn_head = NULL;
985851
+static ldap_dn_node *ldap_service_dn_tail = NULL;
985851
+
985851
+
985851
+static char *
985851
+x_strncat(char *dst, const char *src, size_t dst_size)
985851
+{
985851
+  size_t len = strlen(dst);
985851
+  return strncat(dst, src, dst_size > len ? dst_size - len - 1: 0);
985851
+}
985851
+
985851
+static void
985851
+ldap_parse_class (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) == NULL ||
985851
+      tempbv[0] == NULL)
985851
+    {
985851
+      if (tempbv != NULL)
985851
+        ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  x_strncat (cfile->inbuf, "class \"", LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, "\" {\n", LDAP_BUFFER_SIZE);
985851
+
985851
+  item->close_brace = 1;
985851
+  ldap_value_free_len (tempbv);
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_subclass (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv, **classdata;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) == NULL ||
985851
+      tempbv[0] == NULL)
985851
+    {
985851
+      if (tempbv != NULL)
985851
+        ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  if ((classdata = ldap_get_values_len (ld, item->ldent, 
985851
+                                  "dhcpClassData")) == NULL || 
985851
+      classdata[0] == NULL)
985851
+    {
985851
+      if (classdata != NULL)
985851
+        ldap_value_free_len (classdata);
985851
+      ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  x_strncat (cfile->inbuf, "subclass ", LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, classdata[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, " ", LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
985851
+
985851
+  item->close_brace = 1;
985851
+  ldap_value_free_len (tempbv);
985851
+  ldap_value_free_len (classdata);
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_host (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv, **hwaddr;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) == NULL ||
985851
+      tempbv[0] == NULL)
985851
+    {
985851
+      if (tempbv != NULL)
985851
+        ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  hwaddr = ldap_get_values_len (ld, item->ldent, "dhcpHWAddress");
985851
+
985851
+  x_strncat (cfile->inbuf, "host ", LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+
985851
+  if (hwaddr != NULL && hwaddr[0] != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, " {\nhardware ", LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, hwaddr[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (hwaddr);
985851
+    }
985851
+
985851
+  item->close_brace = 1;
985851
+  ldap_value_free_len (tempbv);
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_shared_network (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) == NULL ||
985851
+      tempbv[0] == NULL)
985851
+    {
985851
+      if (tempbv != NULL)
985851
+        ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  x_strncat (cfile->inbuf, "shared-network \"", LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, "\" {\n", LDAP_BUFFER_SIZE);
985851
+
985851
+  item->close_brace = 1;
985851
+  ldap_value_free_len (tempbv);
985851
+}
985851
+
985851
+
985851
+static void
985851
+parse_netmask (int netmask, char *netmaskbuf)
985851
+{
985851
+  unsigned long nm;
985851
+  int i;
985851
+
985851
+  nm = 0;
985851
+  for (i=1; i <= netmask; i++)
985851
+    {
985851
+      nm |= 1 << (32 - i);
985851
+    }
985851
+
985851
+  sprintf (netmaskbuf, "%d.%d.%d.%d", (int) (nm >> 24) & 0xff, 
985851
+                                      (int) (nm >> 16) & 0xff, 
985851
+                                      (int) (nm >> 8) & 0xff, 
985851
+                                      (int) nm & 0xff);
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_subnet (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv, **netmaskstr;
985851
+  char netmaskbuf[16];
985851
+  int i;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) == NULL ||
985851
+      tempbv[0] == NULL)
985851
+    {
985851
+      if (tempbv != NULL)
985851
+        ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  if ((netmaskstr = ldap_get_values_len (ld, item->ldent, 
985851
+                                     "dhcpNetmask")) == NULL || 
985851
+      netmaskstr[0] == NULL)
985851
+    {
985851
+      if (netmaskstr != NULL)
985851
+        ldap_value_free_len (netmaskstr);
985851
+      ldap_value_free_len (tempbv);
985851
+
985851
+      return;
985851
+    }
985851
+
985851
+  x_strncat (cfile->inbuf, "subnet ", LDAP_BUFFER_SIZE);
985851
+  x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+
985851
+  x_strncat (cfile->inbuf, " netmask ", LDAP_BUFFER_SIZE);
985851
+  parse_netmask (strtol (netmaskstr[0]->bv_val, NULL, 10), netmaskbuf);
985851
+  x_strncat (cfile->inbuf, netmaskbuf, LDAP_BUFFER_SIZE);
985851
+
985851
+  x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
985851
+
985851
+  ldap_value_free_len (tempbv);
985851
+  ldap_value_free_len (netmaskstr);
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpRange")) != NULL)
985851
+    {
985851
+      for (i=0; tempbv[i] != NULL; i++)
985851
+        {
985851
+          x_strncat (cfile->inbuf, "range", LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, " ", LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, tempbv[i]->bv_val, LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+        }
985851
+    }
985851
+
985851
+  item->close_brace = 1;
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_pool (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv;
985851
+  int i;
985851
+
985851
+  x_strncat (cfile->inbuf, "pool {\n", LDAP_BUFFER_SIZE);
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpRange")) != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "range", LDAP_BUFFER_SIZE);
985851
+      for (i=0; tempbv[i] != NULL; i++)
985851
+        {
985851
+          x_strncat (cfile->inbuf, " ", LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, tempbv[i]->bv_val, LDAP_BUFFER_SIZE);
985851
+        }
985851
+      x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpPermitList")) != NULL)
985851
+    {
985851
+      for (i=0; tempbv[i] != NULL; i++)
985851
+        {
985851
+          x_strncat (cfile->inbuf, tempbv[i]->bv_val, LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+        }
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  item->close_brace = 1;
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_group (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  x_strncat (cfile->inbuf, "group {\n", LDAP_BUFFER_SIZE);
985851
+  item->close_brace = 1;
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_key (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  struct berval **tempbv;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "key ", LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpKeyAlgorithm")) != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "algorithm ", LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpKeySecret")) != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "secret ", LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  item->close_brace = 1;
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_parse_zone (struct ldap_config_stack *item, struct parse *cfile)
985851
+{
985851
+  char *cnFindStart, *cnFindEnd;
985851
+  struct berval **tempbv;
985851
+  char *keyCn;
985851
+  size_t len;
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "cn")) != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "zone ", LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpDnsZoneServer")) != NULL)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "primary ", LDAP_BUFFER_SIZE);
985851
+      x_strncat (cfile->inbuf, tempbv[0]->bv_val, LDAP_BUFFER_SIZE);
985851
+
985851
+      x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, item->ldent, "dhcpKeyDN")) != NULL)
985851
+    {
985851
+      cnFindStart = strchr(tempbv[0]->bv_val,'=');
985851
+      if (cnFindStart != NULL)
985851
+        cnFindEnd = strchr(++cnFindStart,',');
985851
+      else
985851
+        cnFindEnd = NULL;
985851
+
985851
+      if (cnFindEnd != NULL && cnFindEnd > cnFindStart)
985851
+        {
985851
+          len = cnFindEnd - cnFindStart;
985851
+          keyCn = dmalloc (len + 1, MDL);
985851
+        }
985851
+      else
985851
+        {
985851
+          len = 0;
985851
+          keyCn = NULL;
985851
+        }
985851
+
985851
+      if (keyCn != NULL)
985851
+        {
985851
+          strncpy (keyCn, cnFindStart, len);
985851
+          keyCn[len] = '\0';
985851
+
985851
+          x_strncat (cfile->inbuf, "key ", LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, keyCn, LDAP_BUFFER_SIZE);
985851
+          x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
985851
+
985851
+          dfree (keyCn, MDL);
985851
+        }
985851
+
985851
+      ldap_value_free_len (tempbv);
985851
+     }
985851
+
985851
+  item->close_brace = 1;
985851
+}
985851
+
985851
+
985851
+static void
985851
+add_to_config_stack (LDAPMessage * res, LDAPMessage * ent)
985851
+{
985851
+  struct ldap_config_stack *ns;
985851
+
985851
+  ns = dmalloc (sizeof (*ns), MDL);
985851
+  ns->res = res;
985851
+  ns->ldent = ent;
985851
+  ns->close_brace = 0;
985851
+  ns->processed = 0;
985851
+  ns->next = ldap_stack;
985851
+  ldap_stack = ns;
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_stop()
985851
+{
985851
+  struct sigaction old, new;
985851
+
985851
+  if (ld == NULL)
985851
+    return;
985851
+
985851
+  /*
985851
+   ** ldap_unbind after a LDAP_SERVER_DOWN result
985851
+   ** causes a SIGPIPE and dhcpd gets terminated,
985851
+   ** since it doesn't handle it...
985851
+   */
985851
+
985851
+  new.sa_flags   = 0;
985851
+  new.sa_handler = SIG_IGN;
985851
+  sigemptyset (&new.sa_mask);
985851
+  sigaction (SIGPIPE, &new, &old);
985851
+
985851
+  ldap_unbind_ext_s (ld, NULL, NULL);
985851
+  ld = NULL;
985851
+
985851
+  sigaction (SIGPIPE, &old, &new);
985851
+}
985851
+
985851
+
985851
+static char *
985851
+_do_lookup_dhcp_string_option (struct option_state *options, int option_name)
985851
+{
985851
+  struct option_cache *oc;
985851
+  struct data_string db;
985851
+  char *ret;
985851
+
985851
+  memset (&db, 0, sizeof (db));
985851
+  oc = lookup_option (&server_universe, options, option_name);
985851
+  if (oc &&
985851
+      evaluate_option_cache (&db, (struct packet*) NULL,
985851
+                             (struct lease *) NULL,
985851
+                             (struct client_state *) NULL, options,
985851
+                             (struct option_state *) NULL,
985851
+                             &global_scope, oc, MDL) &&
985851
+      db.data != NULL && *db.data != '\0')
985851
+
985851
+    {
985851
+      ret = dmalloc (db.len + 1, MDL);
985851
+      if (ret == NULL)
985851
+        log_fatal ("no memory for ldap option %d value", option_name);
985851
+
985851
+      memcpy (ret, db.data, db.len);
985851
+      ret[db.len] = 0;
985851
+      data_string_forget (&db, MDL);
985851
+    }
985851
+  else
985851
+    ret = NULL;
985851
+
985851
+  return (ret);
985851
+}
985851
+
985851
+
985851
+static int
985851
+_do_lookup_dhcp_int_option (struct option_state *options, int option_name)
985851
+{
985851
+  struct option_cache *oc;
985851
+  struct data_string db;
985851
+  int ret;
985851
+
985851
+  memset (&db, 0, sizeof (db));
985851
+  oc = lookup_option (&server_universe, options, option_name);
985851
+  if (oc &&
985851
+      evaluate_option_cache (&db, (struct packet*) NULL,
985851
+                             (struct lease *) NULL,
985851
+                             (struct client_state *) NULL, options,
985851
+                             (struct option_state *) NULL,
985851
+                             &global_scope, oc, MDL) &&
985851
+      db.data != NULL && *db.data != '\0')
985851
+    {
985851
+      ret = strtol ((const char *) db.data, NULL, 10);
985851
+      data_string_forget (&db, MDL);
985851
+    }
985851
+  else
985851
+    ret = 0;
985851
+
985851
+  return (ret);
985851
+}
985851
+
985851
+
985851
+static int
985851
+_do_lookup_dhcp_enum_option (struct option_state *options, int option_name)
985851
+{
985851
+  struct option_cache *oc;
985851
+  struct data_string db;
985851
+  int ret = -1;
985851
+
985851
+  memset (&db, 0, sizeof (db));
985851
+  oc = lookup_option (&server_universe, options, option_name);
985851
+  if (oc &&
985851
+      evaluate_option_cache (&db, (struct packet*) NULL,
985851
+                             (struct lease *) NULL,
985851
+                             (struct client_state *) NULL, options,
985851
+                             (struct option_state *) NULL,
985851
+                             &global_scope, oc, MDL) &&
985851
+      db.data != NULL && *db.data != '\0')
985851
+    {
985851
+      if (db.len == 1) 
985851
+        ret = db.data [0];
985851
+      else
985851
+        log_fatal ("invalid option name %d", option_name);
985851
+
985851
+      data_string_forget (&db, MDL);
985851
+    }
985851
+  else
985851
+    ret = 0;
985851
+
985851
+  return (ret);
985851
+}
985851
+
985851
+int
985851
+ldap_rebind_cb (LDAP *ld, LDAP_CONST char *url, ber_tag_t request, ber_int_t msgid, void *parms)
985851
+{
985851
+  int ret;
985851
+  LDAPURLDesc *ldapurl = NULL;
985851
+  char *who = NULL;
985851
+  struct berval creds;
985851
+
985851
+  log_info("LDAP rebind to '%s'", url);
985851
+  if ((ret = ldap_url_parse(url, &ldapurl)) != LDAP_SUCCESS)
985851
+    {
985851
+      log_error ("Error: Can not parse ldap rebind url '%s': %s",
985851
+                 url, ldap_err2string(ret));
985851
+      return ret;
985851
+    }
985851
+
985851
+
985851
+#if defined (USE_SSL)
985851
+  if (strcasecmp(ldapurl->lud_scheme, "ldaps") == 0)
985851
+    {
985851
+      int opt = LDAP_OPT_X_TLS_HARD;
985851
+      if ((ret = ldap_set_option (ld, LDAP_OPT_X_TLS, &opt)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Error: Cannot init LDAPS session to %s:%d: %s",
985851
+                    ldapurl->lud_host, ldapurl->lud_port, ldap_err2string (ret));
985851
+          return ret;
985851
+        }
985851
+      else
985851
+        {
985851
+          log_info ("LDAPS session successfully enabled to %s", ldap_server);
985851
+        }
985851
+    }
985851
+  else
985851
+  if (strcasecmp(ldapurl->lud_scheme, "ldap") == 0 &&
985851
+      ldap_use_ssl != LDAP_SSL_OFF)
985851
+    {
985851
+      if ((ret = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Error: Cannot start TLS session to %s:%d: %s",
985851
+                     ldapurl->lud_host, ldapurl->lud_port, ldap_err2string (ret));
985851
+          return ret;
985851
+        }
985851
+      else
985851
+        {
985851
+          log_info ("TLS session successfully started to %s:%d",
985851
+                    ldapurl->lud_host, ldapurl->lud_port);
985851
+        }
985851
+    }
985851
+#endif
985851
+
985851
+
985851
+  if (ldap_username != NULL || *ldap_username != '\0')
985851
+    {
985851
+      who = ldap_username;
985851
+      creds.bv_val = strdup(ldap_password);
985851
+      creds.bv_len = strlen(ldap_password);
985851
+    }
985851
+
985851
+  if ((ret = ldap_sasl_bind_s (ld, who, LDAP_SASL_SIMPLE, &creds,
985851
+                               NULL, NULL, NULL)) != LDAP_SUCCESS)
985851
+    {
985851
+      log_error ("Error: Cannot login into ldap server %s:%d: %s",
985851
+                 ldapurl->lud_host, ldapurl->lud_port, ldap_err2string (ret));
985851
+    }
985851
+  return ret;
985851
+}
985851
+
985851
+static void
985851
+ldap_start (void)
985851
+{
985851
+  struct option_state *options;
985851
+  int ret, version;
985851
+  char *uri = NULL;
985851
+  struct berval creds;
985851
+
985851
+  if (ld != NULL)
985851
+    return;
985851
+
985851
+  if (ldap_server == NULL)
985851
+    {
985851
+      options = NULL;
985851
+      option_state_allocate (&options, MDL);
985851
+
985851
+      execute_statements_in_scope ((struct binding_value **) NULL,
985851
+                 (struct packet *) NULL, (struct lease *) NULL,
985851
+                 (struct client_state *) NULL, (struct option_state *) NULL,
985851
+                 options, &global_scope, root_group, (struct group *) NULL);
985851
+
985851
+      ldap_server = _do_lookup_dhcp_string_option (options, SV_LDAP_SERVER);
985851
+      ldap_dhcp_server_cn = _do_lookup_dhcp_string_option (options,
985851
+                                                      SV_LDAP_DHCP_SERVER_CN);
985851
+      ldap_port = _do_lookup_dhcp_int_option (options, SV_LDAP_PORT);
985851
+      ldap_base_dn = _do_lookup_dhcp_string_option (options, SV_LDAP_BASE_DN);
985851
+      ldap_method = _do_lookup_dhcp_enum_option (options, SV_LDAP_METHOD);
985851
+      ldap_debug_file = _do_lookup_dhcp_string_option (options,
985851
+                                                       SV_LDAP_DEBUG_FILE);
985851
+      ldap_referrals = _do_lookup_dhcp_enum_option (options, SV_LDAP_REFERRALS);
985851
+
985851
+#if defined (USE_SSL)
985851
+      ldap_use_ssl = _do_lookup_dhcp_enum_option (options, SV_LDAP_SSL);
985851
+      if( ldap_use_ssl != LDAP_SSL_OFF)
985851
+        {
985851
+          ldap_tls_reqcert = _do_lookup_dhcp_enum_option (options, SV_LDAP_TLS_REQCERT);
985851
+          ldap_tls_ca_file = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CA_FILE);
985851
+          ldap_tls_ca_dir = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CA_DIR);
985851
+          ldap_tls_cert = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CERT);
985851
+          ldap_tls_key = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_KEY);
985851
+          ldap_tls_crlcheck = _do_lookup_dhcp_enum_option (options, SV_LDAP_TLS_CRLCHECK);
985851
+          ldap_tls_ciphers = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CIPHERS);
985851
+          ldap_tls_randfile = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_RANDFILE);
985851
+        }
985851
+#endif
985851
+
985851
+#if defined (LDAP_CASA_AUTH)
985851
+      if (!load_uname_pwd_from_miCASA(&ldap_username,&ldap_password))
985851
+        {
985851
+#if defined (DEBUG_LDAP)
985851
+          log_info ("Authentication credential taken from file");
985851
+#endif
985851
+#endif
985851
+
985851
+      ldap_username = _do_lookup_dhcp_string_option (options, SV_LDAP_USERNAME);
985851
+      ldap_password = _do_lookup_dhcp_string_option (options, SV_LDAP_PASSWORD);
985851
+
985851
+#if defined (LDAP_CASA_AUTH)
985851
+      }
985851
+#endif
985851
+
985851
+      option_state_dereference (&options, MDL);
985851
+    }
985851
+
985851
+  if (ldap_server == NULL || ldap_base_dn == NULL)
985851
+    {
985851
+      log_info ("Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file");
985851
+      ldap_method = LDAP_METHOD_STATIC;
985851
+      return;
985851
+    }
985851
+
985851
+  if (ldap_debug_file != NULL && ldap_debug_fd == -1)
985851
+    {
985851
+      if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY,
985851
+                                 S_IRUSR | S_IWUSR)) < 0)
985851
+        log_error ("Error opening debug LDAP log file %s: %s", ldap_debug_file,
985851
+                   strerror (errno));
985851
+    }
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+  log_info ("Connecting to LDAP server %s:%d", ldap_server, ldap_port);
985851
+#endif
985851
+
985851
+#if defined (USE_SSL)
985851
+  if (ldap_use_ssl == -1)
985851
+    {
985851
+      /*
985851
+      ** There was no "ldap-ssl" option in dhcpd.conf (also not "off").
985851
+      ** Let's try, if we can use an anonymous TLS session without to
985851
+      ** verify the server certificate -- if not continue without TLS.
985851
+      */
985851
+      int opt = LDAP_OPT_X_TLS_ALLOW;
985851
+      if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
985851
+                                  &opt)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Warning: Cannot set LDAP TLS require cert option to 'allow': %s",
985851
+                     ldap_err2string (ret));
985851
+        }
985851
+    }
985851
+
985851
+  if (ldap_use_ssl != LDAP_SSL_OFF)
985851
+    {
985851
+      if (ldap_tls_reqcert != -1)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
985851
+                                      &ldap_tls_reqcert)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS require cert option: %s",
985851
+                         ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+
985851
+      if( ldap_tls_ca_file != NULL)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
985851
+                                      ldap_tls_ca_file)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS CA certificate file %s: %s",
985851
+                         ldap_tls_ca_file, ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+      if( ldap_tls_ca_dir != NULL)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
985851
+                                      ldap_tls_ca_dir)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS CA certificate dir %s: %s",
985851
+                         ldap_tls_ca_dir, ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+      if( ldap_tls_cert != NULL)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
985851
+                                      ldap_tls_cert)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS client certificate file %s: %s",
985851
+                         ldap_tls_cert, ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+      if( ldap_tls_key != NULL)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
985851
+                                      ldap_tls_key)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS certificate key file %s: %s",
985851
+                         ldap_tls_key, ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+      if( ldap_tls_crlcheck != -1)
985851
+        {
985851
+          int opt = ldap_tls_crlcheck;
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CRLCHECK,
985851
+                                      &opt)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS crl check option: %s",
985851
+                         ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+      if( ldap_tls_ciphers != NULL)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
985851
+                                      ldap_tls_ciphers)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS cipher suite %s: %s",
985851
+                         ldap_tls_ciphers, ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+      if( ldap_tls_randfile != NULL)
985851
+        {
985851
+          if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
985851
+                                      ldap_tls_randfile)) != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot set LDAP TLS random file %s: %s",
985851
+                         ldap_tls_randfile, ldap_err2string (ret));
985851
+            }
985851
+        }
985851
+    }
985851
+#endif
985851
+
985851
+  /* enough for 'ldap://+ + hostname + ':' + port number */
985851
+  uri = malloc(strlen(ldap_server) + 16);
985851
+  if (uri == NULL)
985851
+    {
985851
+      log_error ("Cannot build ldap init URI %s:%d", ldap_server, ldap_port);
985851
+      return;
985851
+    }
985851
+
985851
+  sprintf("ldap://%s:%d", ldap_server, ldap_port);
985851
+  ldap_initialize(&ld, uri);
985851
+
985851
+  if (ld == NULL)
985851
+    {
985851
+      log_error ("Cannot init ldap session to %s:%d", ldap_server, ldap_port);
985851
+      return;
985851
+    }
985851
+
985851
+  free(uri);
985851
+
985851
+  version = LDAP_VERSION3;
985851
+  if ((ret = ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_OPT_SUCCESS)
985851
+    {
985851
+      log_error ("Cannot set LDAP version to %d: %s", version,
985851
+                 ldap_err2string (ret));
985851
+    }
985851
+
985851
+  if (ldap_referrals != -1)
985851
+    {
985851
+      if ((ret = ldap_set_option (ld, LDAP_OPT_REFERRALS, ldap_referrals ?
985851
+                                  LDAP_OPT_ON : LDAP_OPT_OFF)) != LDAP_OPT_SUCCESS)
985851
+        {
985851
+          log_error ("Cannot %s LDAP referrals option: %s",
985851
+                     (ldap_referrals ? "enable" : "disable"),
985851
+                     ldap_err2string (ret));
985851
+        }
985851
+    }
985851
+
985851
+  if ((ret = ldap_set_rebind_proc(ld, ldap_rebind_cb, NULL)) != LDAP_SUCCESS)
985851
+    {
985851
+      log_error ("Warning: Cannot set ldap rebind procedure: %s",
985851
+                 ldap_err2string (ret));
985851
+    }
985851
+
985851
+#if defined (USE_SSL)
985851
+  if (ldap_use_ssl == LDAP_SSL_LDAPS ||
985851
+     (ldap_use_ssl == LDAP_SSL_ON && ldap_port == LDAPS_PORT))
985851
+    {
985851
+      int opt = LDAP_OPT_X_TLS_HARD;
985851
+      if ((ret = ldap_set_option (ld, LDAP_OPT_X_TLS, &opt)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Error: Cannot init LDAPS session to %s:%d: %s",
985851
+                    ldap_server, ldap_port, ldap_err2string (ret));
985851
+          ldap_stop();
985851
+          return;
985851
+        }
985851
+      else
985851
+        {
985851
+          log_info ("LDAPS session successfully enabled to %s:%d",
985851
+                    ldap_server, ldap_port);
985851
+        }
985851
+    }
985851
+  else if (ldap_use_ssl != LDAP_SSL_OFF)
985851
+    {
985851
+      if ((ret = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Error: Cannot start TLS session to %s:%d: %s",
985851
+                     ldap_server, ldap_port, ldap_err2string (ret));
985851
+          ldap_stop();
985851
+          return;
985851
+        }
985851
+      else
985851
+        {
985851
+          log_info ("TLS session successfully started to %s:%d",
985851
+                    ldap_server, ldap_port);
985851
+        }
985851
+    }
985851
+#endif
985851
+
985851
+  if (ldap_username != NULL && *ldap_username != '\0')
985851
+    {
985851
+      creds.bv_val = strdup(ldap_password);
985851
+      creds.bv_len = strlen(ldap_password);
985851
+
985851
+      if ((ret == ldap_sasl_bind_s (ld, ldap_username, LDAP_SASL_SIMPLE,
985851
+                                    &creds, NULL, NULL, NULL)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Error: Cannot login into ldap server %s:%d: %s",
985851
+                     ldap_server, ldap_port, ldap_err2string (ret));
985851
+          ldap_stop();
985851
+          return;
985851
+        }
985851
+    }
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+  log_info ("Successfully logged into LDAP server %s", ldap_server);
985851
+#endif
985851
+}
985851
+
985851
+
985851
+static void
985851
+parse_external_dns (LDAPMessage * ent)
985851
+{
985851
+  char *search[] = {"dhcpOptionsDN", "dhcpSharedNetworkDN", "dhcpSubnetDN",
985851
+                    "dhcpGroupDN", "dhcpHostDN", "dhcpClassesDN",
985851
+                    "dhcpPoolDN", NULL};
985851
+  LDAPMessage * newres, * newent;
985851
+  struct berval **tempbv;
985851
+  int i, j, ret;
985851
+#if defined (DEBUG_LDAP)
985851
+  char *dn;
985851
+
985851
+  dn = ldap_get_dn (ld, ent);
985851
+  if (dn != NULL)
985851
+    {
985851
+      log_info ("Parsing external DNs for '%s'", dn);
985851
+      ldap_memfree (dn);
985851
+    }
985851
+#endif
985851
+
985851
+  if (ld == NULL)
985851
+    ldap_start ();
985851
+  if (ld == NULL)
985851
+    return;
985851
+
985851
+  for (i=0; search[i] != NULL; i++)
985851
+    {
985851
+      if ((tempbv = ldap_get_values_len (ld, ent, search[i])) == NULL)
985851
+        continue;
985851
+
985851
+      for (j=0; tempbv[j] != NULL; j++)
985851
+        {
985851
+          if (*tempbv[j]->bv_val == '\0')
985851
+            continue;
985851
+
985851
+          if ((ret = ldap_search_ext_s(ld, tempbv[j]->bv_val, LDAP_SCOPE_BASE,
985851
+                                       "objectClass=*", NULL, 0, NULL,
985851
+                                       NULL, NULL, 0, &newres)) != LDAP_SUCCESS)
985851
+            {
985851
+              ldap_value_free_len (tempbv);
985851
+              ldap_stop();
985851
+              return;
985851
+            }
985851
+    
985851
+#if defined (DEBUG_LDAP)
985851
+          log_info ("Adding contents of subtree '%s' to config stack from '%s' reference", tempbv[j], search[i]);
985851
+#endif
985851
+          for (newent = ldap_first_entry (ld, newres);
985851
+               newent != NULL;
985851
+               newent = ldap_next_entry (ld, newent))
985851
+            {
985851
+#if defined (DEBUG_LDAP)
985851
+              dn = ldap_get_dn (ld, newent);
985851
+              if (dn != NULL)
985851
+                {
985851
+                  log_info ("Adding LDAP result set starting with '%s' to config stack", dn);
985851
+                  ldap_memfree (dn);
985851
+                }
985851
+#endif
985851
+
985851
+              add_to_config_stack (newres, newent);
985851
+              /* don't free newres here */
985851
+            }
985851
+        }
985851
+
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+}
985851
+
985851
+
985851
+static void
985851
+free_stack_entry (struct ldap_config_stack *item)
985851
+{
985851
+  struct ldap_config_stack *look_ahead_pointer = item;
985851
+  int may_free_msg = 1;
985851
+
985851
+  while (look_ahead_pointer->next != NULL)
985851
+    {
985851
+      look_ahead_pointer = look_ahead_pointer->next;
985851
+      if (look_ahead_pointer->res == item->res)
985851
+        {
985851
+          may_free_msg = 0;
985851
+          break;
985851
+        }
985851
+    }
985851
+
985851
+  if (may_free_msg) 
985851
+    ldap_msgfree (item->res);
985851
+
985851
+  dfree (item, MDL);
985851
+}
985851
+
985851
+
985851
+static void
985851
+next_ldap_entry (struct parse *cfile)
985851
+{
985851
+  struct ldap_config_stack *temp_stack;
985851
+
985851
+  if (ldap_stack != NULL && ldap_stack->close_brace)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "}\n", LDAP_BUFFER_SIZE);
985851
+      ldap_stack->close_brace = 0;
985851
+    }
985851
+
985851
+  while (ldap_stack != NULL && 
985851
+         (ldap_stack->ldent == NULL ||
985851
+          (ldap_stack->ldent = ldap_next_entry (ld, ldap_stack->ldent)) == NULL))
985851
+    {
985851
+      if (ldap_stack->close_brace)
985851
+        {
985851
+          x_strncat (cfile->inbuf, "}\n", LDAP_BUFFER_SIZE);
985851
+          ldap_stack->close_brace = 0;
985851
+        }
985851
+
985851
+      temp_stack = ldap_stack;
985851
+      ldap_stack = ldap_stack->next;
985851
+      free_stack_entry (temp_stack);
985851
+    }
985851
+
985851
+  if (ldap_stack != NULL && ldap_stack->close_brace)
985851
+    {
985851
+      x_strncat (cfile->inbuf, "}\n", LDAP_BUFFER_SIZE);
985851
+      ldap_stack->close_brace = 0;
985851
+    }
985851
+}
985851
+
985851
+
985851
+static char
985851
+check_statement_end (const char *statement)
985851
+{
985851
+  char *ptr;
985851
+
985851
+  if (statement == NULL || *statement == '\0')
985851
+    return ('\0');
985851
+
985851
+  /*
985851
+  ** check if it ends with "}", e.g.:
985851
+  **   "zone my.domain. { ... }"
985851
+  ** optionally followed by spaces
985851
+  */
985851
+  ptr = strrchr (statement, '}');
985851
+  if (ptr != NULL)
985851
+    {
985851
+      /* skip following white-spaces */
985851
+      for (++ptr; isspace ((int)*ptr); ptr++);
985851
+
985851
+      /* check if we reached the end */
985851
+      if (*ptr == '\0')
985851
+        return ('}'); /* yes, block end */
985851
+      else
985851
+        return (*ptr);
985851
+    }
985851
+
985851
+  /*
985851
+  ** this should not happen, but...
985851
+  ** check if it ends with ";", e.g.:
985851
+  **   "authoritative;"
985851
+  ** optionally followed by spaces
985851
+  */
985851
+  ptr = strrchr (statement, ';');
985851
+  if (ptr != NULL)
985851
+    {
985851
+      /* skip following white-spaces */
985851
+      for (++ptr; isspace ((int)*ptr); ptr++);
985851
+
985851
+      /* check if we reached the end */
985851
+      if (*ptr == '\0')
985851
+        return (';'); /* ends with a ; */
985851
+      else
985851
+        return (*ptr);
985851
+    }
985851
+
985851
+  return ('\0');
985851
+}
985851
+
985851
+
985851
+static isc_result_t
985851
+ldap_parse_entry_options (LDAPMessage *ent, char *buffer, size_t size,
985851
+                          int *lease_limit)
985851
+{
985851
+  struct berval **tempbv;
985851
+  int i;
985851
+
985851
+  if (ent == NULL || buffer == NULL || size == 0)
985851
+    return (ISC_R_FAILURE);
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, ent, "dhcpStatements")) != NULL)
985851
+    {
985851
+      for (i=0; tempbv[i] != NULL; i++)
985851
+        {
985851
+          if (lease_limit != NULL &&
985851
+              strncasecmp ("lease limit ", tempbv[i]->bv_val, 12) == 0)
985851
+            {
985851
+              *lease_limit = (int) strtol ((tempbv[i]->bv_val) + 12, NULL, 10);
985851
+              continue;
985851
+            }
985851
+
985851
+          x_strncat (buffer, tempbv[i]->bv_val, size);
985851
+
985851
+          switch((int) check_statement_end (tempbv[i]->bv_val))
985851
+            {
985851
+              case '}':
985851
+              case ';':
985851
+                x_strncat (buffer, "\n", size);
985851
+                break;
985851
+              default:
985851
+                x_strncat (buffer, ";\n", size);
985851
+                break;
985851
+            }
985851
+        }
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  if ((tempbv = ldap_get_values_len (ld, ent, "dhcpOption")) != NULL)
985851
+    {
985851
+      for (i=0; tempbv[i] != NULL; i++)
985851
+        {
985851
+          x_strncat (buffer, "option ", size);
985851
+          x_strncat (buffer, tempbv[i]->bv_val, size);
985851
+          switch ((int) check_statement_end (tempbv[i]->bv_val))
985851
+            {
985851
+              case ';':
985851
+                x_strncat (buffer, "\n", size);
985851
+                break;
985851
+              default:
985851
+                x_strncat (buffer, ";\n", size);
985851
+                break;
985851
+            }
985851
+        }
985851
+      ldap_value_free_len (tempbv);
985851
+    }
985851
+
985851
+  return (ISC_R_SUCCESS);
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_generate_config_string (struct parse *cfile)
985851
+{
985851
+  struct berval **objectClass;
985851
+  char *dn;
985851
+  struct ldap_config_stack *entry;
985851
+  LDAPMessage * ent, * res;
985851
+  int i, ignore, found;
985851
+  int ret;
985851
+
985851
+  if (ld == NULL)
985851
+    ldap_start ();
985851
+  if (ld == NULL)
985851
+    return;
985851
+
985851
+  entry = ldap_stack;
985851
+  if ((objectClass = ldap_get_values_len (ld, entry->ldent, 
985851
+                                      "objectClass")) == NULL)
985851
+    return;
985851
+    
985851
+  ignore = 0;
985851
+  found = 1;
985851
+  for (i=0; objectClass[i] != NULL; i++)
985851
+    {
985851
+      if (strcasecmp (objectClass[i]->bv_val, "dhcpSharedNetwork") == 0)
985851
+        ldap_parse_shared_network (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpClass") == 0)
985851
+        ldap_parse_class (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpSubnet") == 0)
985851
+        ldap_parse_subnet (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpPool") == 0)
985851
+        ldap_parse_pool (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpGroup") == 0)
985851
+        ldap_parse_group (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpTSigKey") == 0)
985851
+        ldap_parse_key (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpDnsZone") == 0)
985851
+        ldap_parse_zone (entry, cfile);
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpHost") == 0)
985851
+        {
985851
+          if (ldap_method == LDAP_METHOD_STATIC)
985851
+            ldap_parse_host (entry, cfile);
985851
+          else
985851
+            {
985851
+              ignore = 1;
985851
+              break;
985851
+            }
985851
+        }
985851
+      else if (strcasecmp (objectClass[i]->bv_val, "dhcpSubClass") == 0)
985851
+        {
985851
+          if (ldap_method == LDAP_METHOD_STATIC)
985851
+            ldap_parse_subclass (entry, cfile);
985851
+          else
985851
+            {
985851
+              ignore = 1;
985851
+              break;
985851
+            }
985851
+        }
985851
+      else
985851
+        found = 0;
985851
+
985851
+      if (found && cfile->inbuf[0] == '\0')
985851
+        {
985851
+          ignore = 1;
985851
+          break;
985851
+        }
985851
+    }
985851
+
985851
+  ldap_value_free_len (objectClass);
985851
+
985851
+  if (ignore)
985851
+    {
985851
+      next_ldap_entry (cfile);
985851
+      return;
985851
+    }
985851
+
985851
+  ldap_parse_entry_options(entry->ldent, cfile->inbuf,
985851
+                           LDAP_BUFFER_SIZE-1, NULL);
985851
+
985851
+  dn = ldap_get_dn (ld, entry->ldent);
985851
+
985851
+#if defined(DEBUG_LDAP)
985851
+  if (dn != NULL)
985851
+    log_info ("Found LDAP entry '%s'", dn);
985851
+#endif
985851
+
985851
+  if (dn == NULL ||
985851
+      (ret = ldap_search_ext_s (ld, dn, LDAP_SCOPE_ONELEVEL,
985851
+                                "objectClass=*", NULL, 0, NULL, NULL,
985851
+                                NULL, 0, &res)) != LDAP_SUCCESS)
985851
+    {
985851
+      if (dn)
985851
+        ldap_memfree (dn);
985851
+
985851
+      ldap_stop();
985851
+      return;
985851
+    }
985851
+
985851
+  ldap_memfree (dn);
985851
+
985851
+  if ((ent = ldap_first_entry (ld, res)) != NULL)
985851
+    {
985851
+      add_to_config_stack (res, ent);
985851
+      parse_external_dns (entry->ldent);
985851
+    }
985851
+  else
985851
+    {
985851
+      ldap_msgfree (res);
985851
+      parse_external_dns (entry->ldent);
985851
+      next_ldap_entry (cfile);
985851
+    }
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_close_debug_fd()
985851
+{
985851
+  if (ldap_debug_fd != -1)
985851
+    {
985851
+      close (ldap_debug_fd);
985851
+      ldap_debug_fd = -1;
985851
+    }
985851
+}
985851
+
985851
+
985851
+static void
985851
+ldap_write_debug (const void *buff, size_t size)
985851
+{
985851
+  if (ldap_debug_fd != -1)
985851
+    {
985851
+      if (write (ldap_debug_fd, buff, size) < 0)
985851
+        {
985851
+          log_error ("Error writing to LDAP debug file %s: %s."
985851
+                     " Disabling log file.", ldap_debug_file,
985851
+                     strerror (errno));
985851
+          ldap_close_debug_fd();
985851
+        }
985851
+    }
985851
+}
985851
+
985851
+static int
985851
+ldap_read_function (struct parse *cfile)
985851
+{
985851
+  cfile->inbuf[0] = '\0';
985851
+  cfile->buflen = 0;
985851
+ 
985851
+  while (ldap_stack != NULL && *cfile->inbuf == '\0')
985851
+    ldap_generate_config_string (cfile);
985851
+
985851
+  if (ldap_stack == NULL && *cfile->inbuf == '\0')
985851
+    return (EOF);
985851
+
985851
+  cfile->bufix = 1;
985851
+  cfile->buflen = strlen (cfile->inbuf);
985851
+  if (cfile->buflen > 0)
985851
+    ldap_write_debug (cfile->inbuf, cfile->buflen);
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+  log_info ("Sending config line '%s'", cfile->inbuf);
985851
+#endif
985851
+
985851
+  return (cfile->inbuf[0]);
985851
+}
985851
+
985851
+
985851
+static char *
985851
+ldap_get_host_name (LDAPMessage * ent)
985851
+{
985851
+  struct berval **name;
985851
+  char *ret;
985851
+
985851
+  ret = NULL;
985851
+  if ((name = ldap_get_values_len (ld, ent, "cn")) == NULL || name[0] == NULL)
985851
+    {
985851
+      if (name != NULL)
985851
+        ldap_value_free_len (name);
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+      ret = ldap_get_dn (ld, ent);
985851
+      if (ret != NULL)
985851
+        {
985851
+          log_info ("Cannot get cn attribute for LDAP entry %s", ret);
985851
+          ldap_memfree(ret);
985851
+        }
985851
+#endif
985851
+      return (NULL);
985851
+    }
985851
+
985851
+  ret = dmalloc (strlen (name[0]->bv_val) + 1, MDL);
985851
+  strcpy (ret, name[0]->bv_val);
985851
+  ldap_value_free_len (name);
985851
+
985851
+  return (ret);
985851
+}
985851
+
985851
+
985851
+static int
985851
+getfqhostname(char *fqhost, size_t size)
985851
+{
985851
+#if defined(MAXHOSTNAMELEN)
985851
+  char   hname[MAXHOSTNAMELEN];
985851
+#else
985851
+  char   hname[65];
985851
+#endif
985851
+  struct hostent *hp;
985851
+
985851
+  if(NULL == fqhost || 1 >= size)
985851
+    return -1;
985851
+
985851
+  memset(hname, 0, sizeof(hname));
985851
+  if( gethostname(hname, sizeof(hname)-1))
985851
+    return -1;
985851
+
985851
+  if(NULL == (hp = gethostbyname(hname)))
985851
+    return -1;
985851
+
985851
+  strncpy(fqhost, hp->h_name, size-1);
985851
+  fqhost[size-1] = '\0';
985851
+  return 0;
985851
+}
985851
+
985851
+
985851
+isc_result_t
985851
+ldap_read_config (void)
985851
+{
985851
+  LDAPMessage * ldres, * hostres, * ent, * hostent;
985851
+  char hfilter[1024], sfilter[1024], fqdn[257];
985851
+  char *buffer, *hostdn;
985851
+  ldap_dn_node *curr = NULL;
985851
+  struct parse *cfile;
985851
+  struct utsname unme;
985851
+  isc_result_t res;
985851
+  size_t length;
985851
+  int ret, cnt;
985851
+  struct berval **tempbv = NULL;
985851
+
985851
+  if (ld == NULL)
985851
+    ldap_start ();
985851
+  if (ld == NULL)
985851
+    return (ldap_server == NULL ? ISC_R_SUCCESS : ISC_R_FAILURE);
985851
+ 
985851
+  buffer = dmalloc (LDAP_BUFFER_SIZE+1, MDL);
985851
+  if (buffer == NULL)
985851
+    return (ISC_R_FAILURE);
985851
+
985851
+  cfile = (struct parse *) NULL;
985851
+  res = new_parse (&cfile, -1, buffer, LDAP_BUFFER_SIZE, "LDAP", 0);
985851
+  if (res != ISC_R_SUCCESS)
985851
+    return (res);
985851
+ 
985851
+  uname (&unme);
985851
+  if (ldap_dhcp_server_cn != NULL)
985851
+    {
985851
+     snprintf (hfilter, sizeof (hfilter),
985851
+                "(&(objectClass=dhcpServer)(cn=%s))", ldap_dhcp_server_cn);
985851
+    }
985851
+  else
985851
+  {
985851
+  if(0 == getfqhostname(fqdn, sizeof(fqdn)))
985851
+    {
985851
+      snprintf (hfilter, sizeof (hfilter),
985851
+                "(&(objectClass=dhcpServer)(|(cn=%s)(cn=%s)))", 
985851
+                unme.nodename, fqdn);
985851
+    }
985851
+  else
985851
+    {
985851
+      snprintf (hfilter, sizeof (hfilter),
985851
+                "(&(objectClass=dhcpServer)(cn=%s))", unme.nodename);
985851
+    }
985851
+
985851
+  }
985851
+  hostres = NULL;
985851
+  if ((ret = ldap_search_ext_s (ld, ldap_base_dn, LDAP_SCOPE_SUBTREE,
985851
+                                hfilter, NULL, 0, NULL, NULL, NULL, 0,
985851
+                                &hostres)) != LDAP_SUCCESS)
985851
+    {
985851
+      log_error ("Cannot find host LDAP entry %s %s",
985851
+		 ((ldap_dhcp_server_cn == NULL)?(unme.nodename):(ldap_dhcp_server_cn)), hfilter);
985851
+      if(NULL != hostres)
985851
+        ldap_msgfree (hostres);
985851
+      ldap_stop();
985851
+      return (ISC_R_FAILURE);
985851
+    }
985851
+
985851
+  if ((hostent = ldap_first_entry (ld, hostres)) == NULL)
985851
+    {
985851
+      log_error ("Error: Cannot find LDAP entry matching %s", hfilter);
985851
+      ldap_msgfree (hostres);
985851
+      ldap_stop();
985851
+      return (ISC_R_FAILURE);
985851
+    }
985851
+
985851
+  hostdn = ldap_get_dn (ld, hostent);
985851
+#if defined(DEBUG_LDAP)
985851
+  if (hostdn != NULL)
985851
+    log_info ("Found dhcpServer LDAP entry '%s'", hostdn);
985851
+#endif
985851
+
985851
+  if (hostdn == NULL ||
985851
+      (tempbv = ldap_get_values_len (ld, hostent, "dhcpServiceDN")) == NULL ||
985851
+      tempbv[0] == NULL)
985851
+    {
985851
+      log_error ("Error: Cannot find LDAP entry matching %s", hfilter);
985851
+
985851
+      if (tempbv != NULL)
985851
+        ldap_value_free_len (tempbv);
985851
+
985851
+      if (hostdn)
985851
+        ldap_memfree (hostdn);
985851
+      ldap_msgfree (hostres);
985851
+      ldap_stop();
985851
+      return (ISC_R_FAILURE);
985851
+    }
985851
+
985851
+#if defined(DEBUG_LDAP)
985851
+  log_info ("LDAP: Parsing dhcpServer options '%s' ...", hostdn);
985851
+#endif
985851
+
985851
+  cfile->inbuf[0] = '\0';
985851
+  ldap_parse_entry_options(hostent, cfile->inbuf, LDAP_BUFFER_SIZE, NULL);
985851
+  cfile->buflen = strlen (cfile->inbuf);
985851
+  if(cfile->buflen > 0)
985851
+    {
985851
+      ldap_write_debug (cfile->inbuf, cfile->buflen);
985851
+
985851
+      res = conf_file_subparse (cfile, root_group, ROOT_GROUP);
985851
+      if (res != ISC_R_SUCCESS)
985851
+        {
985851
+          log_error ("LDAP: cannot parse dhcpServer entry '%s'", hostdn);
985851
+          ldap_memfree (hostdn);
985851
+          ldap_stop();
985851
+          return res;
985851
+        }
985851
+      cfile->inbuf[0] = '\0';
985851
+    }
985851
+  ldap_msgfree (hostres);
985851
+
985851
+  /*
985851
+  ** attach ldap (tree) read function now
985851
+  */
985851
+  cfile->bufix = cfile->buflen = 0;
985851
+  cfile->read_function = ldap_read_function;
985851
+
985851
+  res = ISC_R_SUCCESS;
985851
+  for (cnt=0; tempbv[cnt] != NULL; cnt++)
985851
+    {
985851
+      snprintf(sfilter, sizeof(sfilter), "(&(objectClass=dhcpService)"
985851
+                        "(|(dhcpPrimaryDN=%s)(dhcpSecondaryDN=%s)))",
985851
+                        hostdn, hostdn);
985851
+      ldres = NULL;
985851
+      if ((ret = ldap_search_ext_s (ld, tempbv[cnt]->bv_val, LDAP_SCOPE_BASE,
985851
+                                    sfilter, NULL, 0, NULL, NULL, NULL,
985851
+                                    0, &ldres)) != LDAP_SUCCESS)
985851
+        {
985851
+          log_error ("Error searching for dhcpServiceDN '%s': %s. Please update the LDAP entry '%s'",
985851
+                     tempbv[cnt]->bv_val, ldap_err2string (ret), hostdn);
985851
+          if(NULL != ldres)
985851
+            ldap_msgfree(ldres);
985851
+          res = ISC_R_FAILURE;
985851
+          break;
985851
+        }
985851
+
985851
+      if ((ent = ldap_first_entry (ld, ldres)) == NULL)
985851
+        {
985851
+          log_error ("Error: Cannot find dhcpService DN '%s' with primary or secondary server reference. Please update the LDAP server entry '%s'",
985851
+                     tempbv[cnt]->bv_val, hostdn);
985851
+
985851
+          ldap_msgfree(ldres);
985851
+          res = ISC_R_FAILURE;
985851
+          break;
985851
+        }
985851
+
985851
+      /*
985851
+      ** FIXME: how to free the remembered dn's on exit?
985851
+      **        This should be OK if dmalloc registers the
985851
+      **        memory it allocated and frees it on exit..
985851
+      */
985851
+
985851
+      curr = dmalloc (sizeof (*curr), MDL);
985851
+      if (curr != NULL)
985851
+        {
985851
+          length = strlen (tempbv[cnt]->bv_val);
985851
+          curr->dn = dmalloc (length + 1, MDL);
985851
+          if (curr->dn == NULL)
985851
+            {
985851
+              dfree (curr, MDL);
985851
+              curr = NULL;
985851
+            }
985851
+          else
985851
+            strcpy (curr->dn, tempbv[cnt]->bv_val);
985851
+        }
985851
+
985851
+      if (curr != NULL)
985851
+        {
985851
+          curr->refs++;
985851
+
985851
+          /* append to service-dn list */
985851
+          if (ldap_service_dn_tail != NULL)
985851
+            ldap_service_dn_tail->next = curr;
985851
+          else
985851
+            ldap_service_dn_head = curr;
985851
+
985851
+          ldap_service_dn_tail = curr;
985851
+        }
985851
+      else
985851
+        log_fatal ("no memory to remember ldap service dn");
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+      log_info ("LDAP: Parsing dhcpService DN '%s' ...", tempbv[cnt]);
985851
+#endif
985851
+      add_to_config_stack (ldres, ent);
985851
+      res = conf_file_subparse (cfile, root_group, ROOT_GROUP);
985851
+      if (res != ISC_R_SUCCESS)
985851
+        {
985851
+          log_error ("LDAP: cannot parse dhcpService entry '%s'", tempbv[cnt]->bv_val);
985851
+          break;
985851
+        }
985851
+    }
985851
+
985851
+  end_parse (&cfile);
985851
+  ldap_close_debug_fd();
985851
+
985851
+  ldap_memfree (hostdn);
985851
+  ldap_value_free_len (tempbv);
985851
+
985851
+  if (res != ISC_R_SUCCESS)
985851
+    {
985851
+      struct ldap_config_stack *temp_stack;
985851
+
985851
+      while ((curr = ldap_service_dn_head) != NULL)
985851
+        {
985851
+          ldap_service_dn_head = curr->next;
985851
+          dfree (curr->dn, MDL);
985851
+          dfree (curr, MDL);
985851
+        }
985851
+
985851
+      ldap_service_dn_tail = NULL;
985851
+
985851
+      while ((temp_stack = ldap_stack) != NULL)
985851
+        {
985851
+          ldap_stack = temp_stack->next;
985851
+          free_stack_entry (temp_stack);
985851
+        }
985851
+
985851
+      ldap_stop();
985851
+    }
985851
+
985851
+  /* Unbind from ldap immediately after reading config in static mode. */
985851
+  if (ldap_method == LDAP_METHOD_STATIC)
985851
+    ldap_stop();
985851
+
985851
+  return (res);
985851
+}
985851
+
985851
+
985851
+/* This function will parse the dhcpOption and dhcpStatements field in the LDAP
985851
+   entry if it exists. Right now, type will be either HOST_DECL or CLASS_DECL.
985851
+   If we are parsing a HOST_DECL, this always returns 0. If we are parsing a 
985851
+   CLASS_DECL, this will return what the current lease limit is in LDAP. If
985851
+   there is no lease limit specified, we return 0 */
985851
+
985851
+static int
985851
+ldap_parse_options (LDAPMessage * ent, struct group *group,
985851
+                         int type, struct host_decl *host,
985851
+                         struct class **class)
985851
+{
985851
+  int declaration, lease_limit;
985851
+  char option_buffer[8192];
985851
+  enum dhcp_token token;
985851
+  struct parse *cfile;
985851
+  isc_result_t res;
985851
+  const char *val;
985851
+
985851
+  lease_limit = 0;
985851
+  *option_buffer = '\0';
985851
+ 
985851
+ /* This block of code will try to find the parent of the host, and
985851
+    if it is a group object, fetch the options and apply to the host. */
985851
+  if (type == HOST_DECL) 
985851
+    {
985851
+      char *hostdn, *basedn, *temp1, *temp2, filter[1024];
985851
+      LDAPMessage *groupdn, *entry;
985851
+      int ret;
985851
+
985851
+      hostdn = ldap_get_dn (ld, ent);
985851
+      if( hostdn != NULL)
985851
+        {
985851
+          basedn = NULL;
985851
+
985851
+          temp1 = strchr (hostdn, '=');
985851
+          if (temp1 != NULL)
985851
+            temp1 = strchr (++temp1, '=');
985851
+          if (temp1 != NULL)
985851
+            temp2 = strchr (++temp1, ',');
985851
+          else
985851
+            temp2 = NULL;
985851
+
985851
+          if (temp2 != NULL)
985851
+            {
985851
+              snprintf (filter, sizeof(filter),
985851
+                        "(&(cn=%.*s)(objectClass=dhcpGroup))",
985851
+                        (int)(temp2 - temp1), temp1);
985851
+
985851
+              basedn = strchr (temp1, ',');
985851
+              if (basedn != NULL)
985851
+                ++basedn;
985851
+            }
985851
+
985851
+          if (basedn != NULL && *basedn != '\0')
985851
+            {
985851
+              ret = ldap_search_ext_s (ld, basedn, LDAP_SCOPE_SUBTREE, filter,
985851
+                                       NULL, 0, NULL, NULL, NULL, 0, &groupdn);
985851
+              if (ret == LDAP_SUCCESS)
985851
+                {
985851
+                  if ((entry = ldap_first_entry (ld, groupdn)) != NULL)
985851
+                    {
985851
+                      res = ldap_parse_entry_options (entry, option_buffer,
985851
+                                                      sizeof(option_buffer) - 1,
985851
+                                                      &lease_limit);
985851
+                      if (res != ISC_R_SUCCESS)
985851
+                        {
985851
+                          /* reset option buffer discarding any results */
985851
+                          *option_buffer = '\0';
985851
+                          lease_limit = 0;
985851
+                        }
985851
+                    }
985851
+                  ldap_msgfree( groupdn);
985851
+                }
985851
+            }
985851
+          ldap_memfree( hostdn);
985851
+        }
985851
+    }
985851
+
985851
+  res = ldap_parse_entry_options (ent, option_buffer, sizeof(option_buffer) - 1,
985851
+                                  &lease_limit);
985851
+  if (res != ISC_R_SUCCESS)
985851
+    return (lease_limit);
985851
+
985851
+  option_buffer[sizeof(option_buffer) - 1] = '\0';
985851
+  if (*option_buffer == '\0')
985851
+    return (lease_limit);
985851
+
985851
+  cfile = (struct parse *) NULL;
985851
+  res = new_parse (&cfile, -1, option_buffer, strlen (option_buffer), 
985851
+                   type == HOST_DECL ? "LDAP-HOST" : "LDAP-SUBCLASS", 0);
985851
+  if (res != ISC_R_SUCCESS)
985851
+    return (lease_limit);
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+  log_info ("Sending the following options: '%s'", option_buffer);
985851
+#endif
985851
+
985851
+  declaration = 0;
985851
+  do
985851
+    {
985851
+      token = peek_token (&val, NULL, cfile);
985851
+      if (token == END_OF_FILE)
985851
+        break;
985851
+       declaration = parse_statement (cfile, group, type, host, declaration);
985851
+    } while (1);
985851
+
985851
+  end_parse (&cfile);
985851
+
985851
+  return (lease_limit);
985851
+}
985851
+
985851
+
985851
+
985851
+int
985851
+find_haddr_in_ldap (struct host_decl **hp, int htype, unsigned hlen,
985851
+                    const unsigned char *haddr, const char *file, int line)
985851
+{
985851
+  char buf[128], *type_str;
985851
+  LDAPMessage * res, *ent;
985851
+  struct host_decl * host;
985851
+  isc_result_t status;
985851
+  ldap_dn_node *curr;
985851
+  int ret;
985851
+
985851
+  if (ldap_method == LDAP_METHOD_STATIC)
985851
+    return (0);
985851
+
985851
+  if (ld == NULL)
985851
+    ldap_start ();
985851
+  if (ld == NULL)
985851
+    return (0);
985851
+
985851
+  switch (htype)
985851
+    {
985851
+      case HTYPE_ETHER:
985851
+        type_str = "ethernet";
985851
+        break;
985851
+      case HTYPE_IEEE802:
985851
+        type_str = "token-ring";
985851
+        break;
985851
+      case HTYPE_FDDI:
985851
+        type_str = "fddi";
985851
+        break;
985851
+      default:
985851
+        log_info ("Ignoring unknown type %d", htype);
985851
+        return (0);
985851
+    }
985851
+
985851
+  /*
985851
+  ** FIXME: It is not guaranteed, that the dhcpHWAddress attribute
985851
+  **        contains _exactly_ "type addr" with one space between!
985851
+  */
985851
+  snprintf (buf, sizeof (buf),
985851
+            "(&(objectClass=dhcpHost)(dhcpHWAddress=%s %s))",
985851
+           type_str, print_hw_addr (htype, hlen, haddr));
985851
+
985851
+  res = ent = NULL;
985851
+  for (curr = ldap_service_dn_head;
985851
+       curr != NULL && *curr->dn != '\0';
985851
+       curr = curr->next)
985851
+    {
985851
+#if defined (DEBUG_LDAP)
985851
+      log_info ("Searching for %s in LDAP tree %s", buf, curr->dn);
985851
+#endif
985851
+      ret = ldap_search_ext_s (ld, curr->dn, LDAP_SCOPE_SUBTREE, buf, NULL, 0,
985851
+                               NULL, NULL, NULL, 0, &res);
985851
+
985851
+      if(ret == LDAP_SERVER_DOWN)
985851
+        {
985851
+          log_info ("LDAP server was down, trying to reconnect...");
985851
+
985851
+          ldap_stop();
985851
+          ldap_start();
985851
+          if(ld == NULL)
985851
+            {
985851
+              log_info ("LDAP reconnect failed - try again later...");
985851
+              return (0);
985851
+            }
985851
+
985851
+          ret = ldap_search_ext_s (ld, curr->dn, LDAP_SCOPE_SUBTREE, buf, NULL,
985851
+                                   0, NULL, NULL, NULL, 0, &res);
985851
+        }
985851
+
985851
+      if (ret == LDAP_SUCCESS)
985851
+        {
985851
+          if( (ent = ldap_first_entry (ld, res)) != NULL)
985851
+            break; /* search OK and have entry */
985851
+
985851
+#if defined (DEBUG_LDAP)
985851
+          log_info ("No host entry for %s in LDAP tree %s",
985851
+                    buf, curr->dn);
985851
+#endif
985851
+          if(res)
985851
+            {
985851
+              ldap_msgfree (res);
985851
+              res = NULL;
985851
+            }
985851
+        }
985851
+      else
985851
+        {
985851
+          if(res)
985851
+            {
985851
+              ldap_msgfree (res);
985851
+              res = NULL;
985851
+            }
985851
+
985851
+          if (ret != LDAP_NO_SUCH_OBJECT && ret != LDAP_SUCCESS)
985851
+            {
985851
+              log_error ("Cannot search for %s in LDAP tree %s: %s", buf, 
985851
+                         curr->dn, ldap_err2string (ret));
985851
+              ldap_stop();
985851
+              return (0);
985851
+            }
985851
+#if defined (DEBUG_LDAP)
985851
+          else
985851
+            {
985851
+              log_info ("ldap_search_ext_s returned %s when searching for %s in %s",
985851
+                        ldap_err2string (ret), buf, curr->dn);
985851
+            }
985851
+#endif
985851
+        }
985851
+    }
985851
+
985851
+  if (res && ent)
985851
+    {
985851
+#if defined (DEBUG_LDAP)
985851
+      char *dn = ldap_get_dn (ld, ent);
985851
+      if (dn != NULL)
985851
+        {
985851
+          log_info ("Found dhcpHWAddress LDAP entry %s", dn);
985851
+          ldap_memfree(dn);
985851
+        }
985851
+#endif
985851
+
985851
+      host = (struct host_decl *)0;
985851
+      status = host_allocate (&host, MDL);
985851
+      if (status != ISC_R_SUCCESS)
985851
+        {
985851
+          log_fatal ("can't allocate host decl struct: %s", 
985851
+                     isc_result_totext (status)); 
985851
+          ldap_msgfree (res);
985851
+          return (0);
985851
+        }
985851
+
985851
+      host->name = ldap_get_host_name (ent);
985851
+      if (host->name == NULL)
985851
+        {
985851
+          host_dereference (&host, MDL);
985851
+          ldap_msgfree (res);
985851
+          return (0);
985851
+        }
985851
+
985851
+      if (!clone_group (&host->group, root_group, MDL))
985851
+        {
985851
+          log_fatal ("can't clone group for host %s", host->name);
985851
+          host_dereference (&host, MDL);
985851
+          ldap_msgfree (res);
985851
+          return (0);
985851
+        }
985851
+
985851
+      ldap_parse_options (ent, host->group, HOST_DECL, host, NULL);
985851
+
985851
+      *hp = host;
985851
+      ldap_msgfree (res);
985851
+      return (1);
985851
+    }
985851
+
985851
+
985851
+  if(res) ldap_msgfree (res);
985851
+  return (0);
985851
+}
985851
+
985851
+
985851
+int
985851
+find_subclass_in_ldap (struct class *class, struct class **newclass, 
985851
+                       struct data_string *data)
985851
+{
985851
+  LDAPMessage * res, * ent;
985851
+  int ret, lease_limit;
985851
+  isc_result_t status;
985851
+  ldap_dn_node *curr;
985851
+  char buf[1024];
985851
+
985851
+  if (ldap_method == LDAP_METHOD_STATIC)
985851
+    return (0);
985851
+
985851
+  if (ld == NULL)
985851
+    ldap_start ();
985851
+  if (ld == NULL)
985851
+    return (0);
985851
+
985851
+  snprintf (buf, sizeof (buf),