diff -up openssh-5.5p1/config.h.in.ldap openssh-5.5p1/config.h.in

--- openssh-5.5p1/config.h.in.ldap	2010-04-16 02:17:09.000000000 +0200

+++ openssh-5.5p1/config.h.in	2010-04-28 11:34:13.000000000 +0200

@@ -1,5 +1,8 @@

 /* config.h.in.  Generated from configure.ac by autoheader.  */

+/* Define if building universal (internal helper macro) */

+#undef AC_APPLE_UNIVERSAL_BUILD

+

 /* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address

    */

 #undef AIX_GETNAMEINFO_HACK

@@ -536,6 +539,57 @@

 /* Define to 1 if you have the <lastlog.h> header file. */

 #undef HAVE_LASTLOG_H

+/* Define to 1 if you have the <lber.h> header file. */

+#undef HAVE_LBER_H

+

+/* Define to 1 if you have the `ldapssl_init' function. */

+#undef HAVE_LDAPSSL_INIT

+

+/* Define to 1 if you have the `ldap_controls_free' function. */

+#undef HAVE_LDAP_CONTROLS_FREE

+

+/* Define to 1 if you have the `ldap_get_lderrno' function. */

+#undef HAVE_LDAP_GET_LDERRNO

+

+/* Define to 1 if you have the `ldap_get_option' function. */

+#undef HAVE_LDAP_GET_OPTION

+

+/* Define to 1 if you have the <ldap.h> header file. */

+#undef HAVE_LDAP_H

+

+/* Define to 1 if you have the `ldap_init' function. */

+#undef HAVE_LDAP_INIT

+

+/* Define to 1 if you have the `ldap_initialize' function. */

+#undef HAVE_LDAP_INITIALIZE

+

+/* Define to 1 if you have the `ldap_memfree' function. */

+#undef HAVE_LDAP_MEMFREE

+

+/* Define to 1 if you have the `ldap_parse_result' function. */

+#undef HAVE_LDAP_PARSE_RESULT

+

+/* Define to 1 if you have the `ldap_pvt_tls_set_option' function. */

+#undef HAVE_LDAP_PVT_TLS_SET_OPTION

+

+/* Define to 1 if you have the `ldap_set_lderrno' function. */

+#undef HAVE_LDAP_SET_LDERRNO

+

+/* Define to 1 if you have the `ldap_set_option' function. */

+#undef HAVE_LDAP_SET_OPTION

+

+/* Define to 1 if you have the `ldap_set_rebind_proc' function. */

+#undef HAVE_LDAP_SET_REBIND_PROC

+

+/* Define to 1 if you have the <ldap_ssl.h> header file. */

+#undef HAVE_LDAP_SSL_H

+

+/* Define to 1 if you have the `ldap_start_tls_s' function. */

+#undef HAVE_LDAP_START_TLS_S

+

+/* Define to 1 if you have the <libaudit.h> header file. */

+#undef HAVE_LIBAUDIT_H

+

 /* Define to 1 if you have the `bsm' library (-lbsm). */

 #undef HAVE_LIBBSM

@@ -575,6 +629,9 @@

 /* Define to 1 if you have the <limits.h> header file. */

 #undef HAVE_LIMITS_H

+/* Define if you want Linux audit support. */

+#undef HAVE_LINUX_AUDIT

+

 /* Define to 1 if you have the <linux/if_tun.h> header file. */

 #undef HAVE_LINUX_IF_TUN_H

@@ -771,6 +828,9 @@

 /* Define to 1 if you have the `setgroups' function. */

 #undef HAVE_SETGROUPS

+/* Define to 1 if you have the `setkeycreatecon' function. */

+#undef HAVE_SETKEYCREATECON

+

 /* Define to 1 if you have the `setlogin' function. */

 #undef HAVE_SETLOGIN

@@ -921,13 +981,13 @@

 /* define if you have struct sockaddr_in6 data type */

 #undef HAVE_STRUCT_SOCKADDR_IN6

-/* Define to 1 if `sin6_scope_id' is member of `struct sockaddr_in6'. */

+/* Define to 1 if `sin6_scope_id' is a member of `struct sockaddr_in6'. */

 #undef HAVE_STRUCT_SOCKADDR_IN6_SIN6_SCOPE_ID

 /* define if you have struct sockaddr_storage data type */

 #undef HAVE_STRUCT_SOCKADDR_STORAGE

-/* Define to 1 if `st_blksize' is member of `struct stat'. */

+/* Define to 1 if `st_blksize' is a member of `struct stat'. */

 #undef HAVE_STRUCT_STAT_ST_BLKSIZE

 /* Define to 1 if the system has the type `struct timespec'. */

@@ -1191,6 +1251,9 @@

 /* Define if pututxline updates lastlog too */

 #undef LASTLOG_WRITE_PUTUTXLINE

+/* number arguments of ldap_set_rebind_proc */

+#undef LDAP_SET_REBIND_PROC_ARGS

+

 /* Define if you want TCP Wrappers support */

 #undef LIBWRAP

@@ -1274,6 +1337,9 @@

 /* Define to the one symbol short name of this package. */

 #undef PACKAGE_TARNAME

+/* Define to the home page for this package. */

+#undef PACKAGE_URL

+

 /* Define to the version of this package. */

 #undef PACKAGE_VERSION

@@ -1360,6 +1426,10 @@

 /* Prepend the address family to IP tunnel traffic */

 #undef SSH_TUN_PREPEND_AF

+/* Define to your vendor patch level, if it has been modified from the

+   upstream source release. */

+#undef SSH_VENDOR_PATCHLEVEL

+

 /* Define to 1 if you have the ANSI C header files. */

 #undef STDC_HEADERS

@@ -1384,6 +1454,9 @@

 /* Use btmp to log bad logins */

 #undef USE_BTMP

+/* platform uses an in-memory credentials cache */

+#undef USE_CCAPI

+

 /* Use libedit for sftp */

 #undef USE_LIBEDIT

@@ -1396,6 +1469,9 @@

 /* Use PIPES instead of a socketpair() */

 #undef USE_PIPES

+/* platform has the Security Authorization Session API */

+#undef USE_SECURITY_SESSION_API

+

 /* Define if you have Solaris process contracts */

 #undef USE_SOLARIS_PROCESS_CONTRACTS

@@ -1418,12 +1494,26 @@

 /* Define if you want IRIX project management */

 #undef WITH_IRIX_PROJECT

+/* Enable LDAP pubkey support */

+#undef WITH_LDAP_PUBKEY

+

+/* Enable pubkey agent support */

+#undef WITH_PUBKEY_AGENT

+

 /* Define if you want SELinux support. */

 #undef WITH_SELINUX

-/* Define to 1 if your processor stores words with the most significant byte

-   first (like Motorola and SPARC, unlike Intel and VAX). */

-#undef WORDS_BIGENDIAN

+/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most

+   significant byte first (like Motorola and SPARC, unlike Intel). */

+#if defined AC_APPLE_UNIVERSAL_BUILD

+# if defined __BIG_ENDIAN__

+#  define WORDS_BIGENDIAN 1

+# endif

+#else

+# ifndef WORDS_BIGENDIAN

+#  undef WORDS_BIGENDIAN

+# endif

+#endif

 /* Define if xauth is found in your path */

 #undef XAUTH_PATH

diff -up openssh-5.5p1/configure.ac.ldap openssh-5.5p1/configure.ac

--- openssh-5.5p1/configure.ac.ldap	2010-04-28 11:34:09.000000000 +0200

+++ openssh-5.5p1/configure.ac	2010-04-28 11:34:13.000000000 +0200

@@ -1382,6 +1382,106 @@ AC_ARG_WITH(pka,

 	]

 )

+# Check whether user wants LDAP support

+LDAP_MSG="no"

+INSTALL_SSH_LDAP_HELPER=""

+AC_ARG_WITH(ldap,

+	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],

+	[

+		if test "x$withval" != "xno" ; then

+

+			INSTALL_SSH_LDAP_HELPER="yes"

+			CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"

+

+			if test "x$withval" != "xyes" ; then

+				CPPFLAGS="$CPPFLAGS -I${withval}/include"

+				LDFLAGS="$LDFLAGS -L${withval}/lib"

+			fi

+

+			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])

+			LDAP_MSG="yes"

+

+			AC_CHECK_HEADERS(lber.h)

+			AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))

+			AC_CHECK_HEADERS(ldap_ssl.h)

+

+			AC_ARG_WITH(ldap-lib,

+				[  --with-ldap-lib=type    select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])

+

+			if test -z "$with_ldap_lib"; then

+				with_ldap_lib=auto

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then

+				AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)

+				AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then

+				AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then

+				AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)

+				fi

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)

+				fi

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)

+				fi

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then

+				AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib"; then

+				AC_MSG_ERROR(could not locate a valid LDAP library)

+			fi

+

+			AC_MSG_CHECKING([for working LDAP support])

+			AC_TRY_COMPILE(

+				[#include <sys/types.h>

+				 #include <ldap.h>],

+				[(void)ldap_init(0, 0);],

+				[AC_MSG_RESULT(yes)],

+				[

+				    AC_MSG_RESULT(no) 

+					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])

+				])

+			AC_CHECK_FUNCS( \

+				ldap_init \

+				ldap_get_lderrno \

+				ldap_set_lderrno \

+				ldap_parse_result \

+				ldap_memfree \

+				ldap_controls_free \

+				ldap_set_option \

+				ldap_get_option \

+				ldapssl_init \

+				ldap_start_tls_s \

+				ldap_pvt_tls_set_option \

+				ldap_initialize \

+			)

+			AC_CHECK_FUNCS(ldap_set_rebind_proc,

+				AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])

+				AC_TRY_COMPILE(

+					[#include <lber.h>

+					#include <ldap.h>],

+					[ldap_set_rebind_proc(0, 0, 0);],

+					[ac_cv_ldap_set_rebind_proc=3],

+					[ac_cv_ldap_set_rebind_proc=2])

+				AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)

+				AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])

+			)

+		fi

+	]

+)

+AC_SUBST(INSTALL_SSH_LDAP_HELPER)

+

 dnl    Checks for library functions. Please keep in alphabetical order

 AC_CHECK_FUNCS( \

 	arc4random \

@@ -4239,6 +4339,7 @@ echo "                 Smartcard support

 echo "                     S/KEY support: $SKEY_MSG"

 echo "              TCP Wrappers support: $TCPW_MSG"

 echo "                       PKA support: $PKA_MSG"

+echo "                      LDAP support: $LDAP_MSG"

 echo "              MD5 password support: $MD5_MSG"

 echo "                   libedit support: $LIBEDIT_MSG"

 echo "  Solaris process contract support: $SPC_MSG"

diff -up openssh-5.5p1/ldapbody.c.ldap openssh-5.5p1/ldapbody.c

--- openssh-5.5p1/ldapbody.c.ldap	2010-04-28 11:34:13.000000000 +0200

+++ openssh-5.5p1/ldapbody.c	2010-04-28 11:34:13.000000000 +0200

@@ -0,0 +1,494 @@

+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "ldapincludes.h"

+#include "log.h"

+#include "xmalloc.h"

+#include "ldapconf.h"

+#include "ldapmisc.h"

+#include "ldapbody.h"

+#include <stdio.h>

+#include <unistd.h>

+

+#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"

+#define PUBKEYATTR "sshPublicKey"

+#define LDAP_LOGFILE	"%s/ldap.%d"

+

+static FILE *logfile = NULL;

+static LDAP *ld;

+

+static char *attrs[] = {

+    PUBKEYATTR,

+    NULL

+};

+

+void

+ldap_checkconfig (void)

+{

+#ifdef HAVE_LDAP_INITIALIZE

+		if (options.host == NULL && options.uri == NULL)

+#else

+		if (options.host == NULL)

+#endif

+		    fatal ("missing  \"host\" in config file");

+}

+

+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)

+static int

+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)

+{

+	struct timeval timeout;

+	int rc;

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	LDAPMessage *result;

+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */

+

+	debug2 ("Doing LDAP rebind to %s", options.binddn);

+	if (options.ssl == SSL_START_TLS) {

+		if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {

+			error ("ldap_starttls_s: %s", ldap_err2string (rc));

+			return LDAP_OPERATIONS_ERROR;

+		}

+	}

+

+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)

+	return ldap_simple_bind_s (ld, options.binddn, options.bindpw);

+#else

+	if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)

+	    fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));

+

+	timeout.tv_sec = options.bind_timelimit;

+	timeout.tv_usec = 0;

+	result = NULL;

+	if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {

+		error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));

+		ldap_msgfree (result);

+		return LDAP_OPERATIONS_ERROR;

+	}

+	debug3 ("LDAP rebind to %s succesfull", options.binddn);

+	return rc;

+#endif

+}

+#else

+

+static int

+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)

+{

+	if (freeit)

+	    return LDAP_SUCCESS;

+

+	*whop = strdup (options.binddn);

+	*credp = strdup (options.bindpw);

+	*methodp = LDAP_AUTH_SIMPLE;

+	debug2 ("Doing LDAP rebind for %s", *whop);

+	return LDAP_SUCCESS;

+}

+#endif

+

+void

+ldap_do_connect(void)

+{

+	int rc, msgid, ld_errno = 0;

+	struct timeval timeout;

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	int parserc;

+	LDAPMessage *result;

+	LDAPControl **controls;

+	int reconnect = 0;

+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */

+

+	debug ("LDAP do connect");

+

+retry:

+	if (reconnect) {

+		debug3 ("Reconnecting with ld_errno %d", ld_errno);

+		if (options.bind_policy == 0 ||

+		    (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||

+			reconnect > 5)

+			    fatal ("Cannot connect to LDAP server");

+	

+		if (reconnect > 1)

+			sleep (reconnect - 1);

+

+		if (ld != NULL) {

+			ldap_unbind (ld);

+			ld = NULL;

+		}

+		logit("reconnecting to LDAP server...");

+	}

+

+	if (ld == NULL) {

+		int rc;

+		struct timeval tv;

+

+#ifdef HAVE_LDAP_SET_OPTION

+		if (options.debug > 0) {

+#ifdef LBER_OPT_LOG_PRINT_FILE

+			if (options.logdir) {

+				char *logfilename;

+				int logfilenamelen;

+

+				logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);

+				logfilename = xmalloc (logfilenamelen);

+				snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());

+				logfilename[logfilenamelen - 1] = 0;

+				if ((logfile = fopen (logfilename, "a")) == NULL)

+				    fatal ("cannot append to %s: %s", logfilename, strerror (errno));

+				debug3 ("LDAP debug into %s", logfilename);

+				xfree (logfilename);

+				ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);

+			}

+#endif

+			if (options.debug) {

+#ifdef LBER_OPT_DEBUG_LEVEL

+				ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);

+#endif /* LBER_OPT_DEBUG_LEVEL */

+#ifdef LDAP_OPT_DEBUG_LEVEL

+				ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);

+#endif /* LDAP_OPT_DEBUG_LEVEL */

+				debug3 ("Set LDAP debug to %d", options.debug);

+			}

+		}

+#endif /* HAVE_LDAP_SET_OPTION */

+

+		ld = NULL;

+#ifdef HAVE_LDAPSSL_INIT

+		if (options.host != NULL) {

+			if (options.ssl_on == SSL_LDAPS) {

+				if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)

+				    fatal ("ldapssl_client_init %s", ldap_err2string (rc));

+				debug3 ("LDAPssl client init");

+			}

+

+			if (options.ssl_on != SSL_OFF) {

+				if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)

+				    fatal ("ldapssl_init failed");

+				debug3 ("LDAPssl init");

+			}

+		}

+#endif /* HAVE_LDAPSSL_INIT */

+

+		/* continue with opening */

+		if (ld == NULL) {

+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))

+			/* Some global TLS-specific options need to be set before we create our

+			 * session context, so we set them here. */

+

+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE

+			/* rand file */

+			if (options.tls_randfile != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,

+				    options.tls_randfile)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS random file %s", options.tls_randfile);

+			}

+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */

+

+			/* ca cert file */

+			if (options.tls_cacertfile != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,

+				    options.tls_cacertfile)) != LDAP_SUCCESS)

+					error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);

+			}

+

+			/* ca cert directory */

+			if (options.tls_cacertdir != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,

+				    options.tls_cacertdir)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);

+			}

+

+			/* require cert? */

+			if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,

+			    &options.tls_checkpeer)) != LDAP_SUCCESS)

+				fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",

+				    ldap_err2string (rc));

+			debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);

+

+			/* set cipher suite, certificate and private key: */

+			if (options.tls_ciphers != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,

+				    options.tls_ciphers)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);

+			}

+

+			/* cert file */

+			if (options.tls_cert != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,

+				    options.tls_cert)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS cert file %s ", options.tls_cert);

+			}

+

+			/* key file */

+			if (options.tls_key != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,

+				    options.tls_key)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS key file %s ", options.tls_key);

+			}

+#endif

+#ifdef HAVE_LDAP_INITIALIZE

+			if (options.uri != NULL) {

+				if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)

+					fatal ("ldap_initialize %s", ldap_err2string (rc));

+				debug3 ("LDAP initialize %s", options.uri);

+			}

+	}

+#endif /* HAVE_LDAP_INTITIALIZE */

+

+		/* continue with opening */

+		if ((ld == NULL) && (options.host != NULL)) {

+#ifdef HAVE_LDAP_INIT

+			if ((ld = ldap_init (options.host, options.port)) == NULL)

+			    fatal ("ldap_init failed");

+			debug3 ("LDAP init %s:%d", options.host, options.port);

+#else

+			if ((ld = ldap_open (options.host, options.port)) == NULL)

+			    fatal ("ldap_open failed");

+			debug3 ("LDAP open %s:%d", options.host, options.port);

+#endif /* HAVE_LDAP_INIT */

+		}

+

+		if (ld == NULL)

+			fatal ("no way to open ldap");

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)

+		if (options.ssl == SSL_LDAPS) {

+			if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)

+				fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));

+			debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);

+		}

+#endif /* LDAP_OPT_X_TLS */

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)

+		(void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,

+		    &options.ldap_version);

+#else

+		ld->ld_version = options.ldap_version;

+#endif

+		debug3 ("LDAP set version to %d", options.ldap_version);

+

+#if LDAP_SET_REBIND_PROC_ARGS == 3

+		ldap_set_rebind_proc (ld, _rebind_proc, NULL);

+#elif LDAP_SET_REBIND_PROC_ARGS == 2

+		ldap_set_rebind_proc (ld, _rebind_proc);

+#else

+#warning unknown LDAP_SET_REBIND_PROC_ARGS

+#endif

+		debug3 ("LDAP set rebind proc");

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)

+		(void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);

+#else

+		ld->ld_deref = options.deref;

+#endif

+		debug3 ("LDAP set deref to %d", options.deref);

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)

+		(void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,

+		    &options.timelimit);

+#else

+		ld->ld_timelimit = options.timelimit;

+#endif

+		debug3 ("LDAP set timelimit to %d", options.timelimit);

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)

+		/*

+		 * This is a new option in the Netscape SDK which sets 

+		 * the TCP connect timeout. For want of a better value,

+		 * we use the bind_timelimit to control this.

+		 */

+		timeout = options.bind_timelimit * 1000;

+		(void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);

+		debug3 ("LDAP set opt connect timeout to %d", timeout);

+#endif

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)

+		tv.tv_sec = options.bind_timelimit;

+		tv.tv_usec = 0;

+		(void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv;;

+		debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);

+#endif

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)

+		(void) ldap_set_option (ld, LDAP_OPT_REFERRALS,

+		    options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);

+		debug3 ("LDAP set referrals to %d", options.referrals);

+#endif

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)

+		(void) ldap_set_option (ld, LDAP_OPT_RESTART,

+		    options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);

+		debug3 ("LDAP set restart to %d", options.restart);

+#endif

+

+#ifdef HAVE_LDAP_START_TLS_S

+		if (options.ssl == SSL_START_TLS) {

+			int version;

+

+			if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)

+			    == LDAP_SUCCESS) {

+				if (version < LDAP_VERSION3) {

+					version = LDAP_VERSION3;

+					(void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,

+					    &version);

+					debug3 ("LDAP set version to %d", version);

+				}

+			}

+

+			if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)

+			    fatal ("ldap_starttls_s: %s", ldap_err2string (rc));

+			debug3 ("LDAP start TLS");

+		}

+#endif /* HAVE_LDAP_START_TLS_S */

+	}

+

+	if ((msgid = ldap_simple_bind (ld, options.binddn,

+	    options.bindpw)) == -1) {

+		ld_errno = ldap_get_lderrno (ld, 0, 0);

+

+		error ("ldap_simple_bind %s", ldap_err2string (ld_errno));

+		reconnect++;

+		goto retry;

+	}

+	debug3 ("LDAP simple bind (%s)", options.binddn);

+

+	timeout.tv_sec = options.bind_timelimit;

+	timeout.tv_usec = 0;

+	if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {

+		ld_errno = ldap_get_lderrno (ld, 0, 0);

+

+		error ("ldap_result %s", ldap_err2string (ld_errno));

+		reconnect++;

+		goto retry;

+	}

+	debug3 ("LDAP result in time");

+

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	controls = NULL;

+	if ((parserc = ldap_parse_result (ld, result, &rc, 0, 0, 0, &controls, TRUE)) != LDAP_SUCCESS)

+	    fatal ("ldap_parse_result %s", ldap_err2string (parserc));

+	debug3 ("LDAP parse result OK");

+

+	if (controls != NULL) {

+		ldap_controls_free (controls);

+	}

+#else

+	rc = ldap_result2error (session->ld, result, TRUE);

+#endif

+	if (rc != LDAP_SUCCESS)

+	    fatal ("error trying to bind as user \"%s\" (%s)",

+		options.binddn, ldap_err2string (rc));

+

+	debug2 ("LDAP do connect OK");

+}

+

+void

+process_user (const char *user, FILE *output)

+{

+	LDAPMessage *res, *e;

+	char *buffer;

+	int bufflen, rc, i;

+	struct timeval timeout;

+

+	debug ("LDAP process user");

+

+	/* quick check for attempts to be evil */

+	if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||

+	    (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL)) {

+		logit ("illegal user name %s not processed", user);

+		return;

+	}

+

+	/* build  filter for LDAP request */

+	bufflen = strlen (LDAPSEARCH_FORMAT) + strlen (user);

+	if (options.ssh_filter != NULL)

+	    bufflen += strlen (options.ssh_filter);

+	buffer = xmalloc (bufflen);

+	snprintf(buffer, bufflen, LDAPSEARCH_FORMAT, user, (options.ssh_filter != NULL) ? options.ssh_filter : NULL);

+	buffer[bufflen - 1] = 0;

+

+	debug3 ("LDAP search scope = %d %s", options.scope, buffer);

+

+	timeout.tv_sec = options.timelimit;

+	timeout.tv_usec = 0;

+	if ((rc = ldap_search_st(ld, options.base, options.scope, buffer, attrs, 0, &timeout, &res)) != LDAP_SUCCESS) {

+		error ("ldap_search_st(): %s", ldap_err2string (rc));

+		xfree (buffer);

+		return;

+	}

+

+	/* free */

+	xfree (buffer);

+

+	for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {

+		int num;

+		struct berval **keys;

+

+		keys = ldap_get_values_len(ld, e, PUBKEYATTR);

+		num = ldap_count_values_len(keys);

+		for (i = 0 ; i < num ; i++) {

+			char *cp; //, *options = NULL;

+

+			for (cp = keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++);

+			if (!*cp || *cp == '\n' || *cp == '#')

+			    continue;

+

+			/* We have found the desired key. */

+			fprintf (output, "%s\n", keys[i]->bv_val);

+		}

+

+		ldap_value_free_len(keys);

+	}

+

+	ldap_msgfree(res);

+	debug2 ("LDAP process user finished");

+}

+

+void

+ldap_do_close(void)

+{

+	int rc;

+

+	debug ("LDAP do close");

+	if ((rc = ldap_unbind_ext(ld, NULL, NULL)) != LDAP_SUCCESS)

+	    fatal ("ldap_unbind_ext: %s",

+                                    ldap_err2string (rc));

+

+	ld = NULL;

+	debug2 ("LDAP do close OK");

+	return;

+}

+

diff -up openssh-5.5p1/ldapbody.h.ldap openssh-5.5p1/ldapbody.h

--- openssh-5.5p1/ldapbody.h.ldap	2010-04-28 11:34:14.000000000 +0200

+++ openssh-5.5p1/ldapbody.h	2010-04-28 11:34:14.000000000 +0200

@@ -0,0 +1,37 @@

+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef LDAPBODY_H

+#define LDAPBODY_H

+

+#include <stdio.h>

+

+void ldap_checkconfig(void);

+void ldap_do_connect(void);

+void process_user(const char *, FILE *);

+void ldap_do_close(void);

+

+#endif /* LDAPBODY_H */

+

diff -up openssh-5.5p1/ldapconf.c.ldap openssh-5.5p1/ldapconf.c

--- openssh-5.5p1/ldapconf.c.ldap	2010-04-28 11:34:14.000000000 +0200

+++ openssh-5.5p1/ldapconf.c	2010-04-28 11:34:14.000000000 +0200

@@ -0,0 +1,665 @@

+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "ldapincludes.h"

+#include "ldap-helper.h"

+#include "log.h"

+#include "misc.h"

+#include "xmalloc.h"

+#include "ldapconf.h"