diff -up openssh-5.5p1/auth2-pubkey.c.pka openssh-5.5p1/auth2-pubkey.c

--- openssh-5.5p1/auth2-pubkey.c.pka	2010-05-06 10:50:47.000000000 +0200

+++ openssh-5.5p1/auth2-pubkey.c	2010-05-06 10:50:49.000000000 +0200

@@ -186,27 +186,15 @@ done:

 /* return 1 if user allows given key */

 static int

-user_key_allowed2(struct passwd *pw, Key *key, char *file)

+user_search_key_in_file(FILE *f, char *file, Key* key, struct passwd *pw)

 {

 	char line[SSH_MAX_PUBKEY_BYTES];

 	const char *reason;

 	int found_key = 0;

-	FILE *f;

 	u_long linenum = 0;

 	Key *found;

 	char *fp;

-	/* Temporarily use the user's uid. */

-	temporarily_use_uid(pw);

-

-	debug("trying public key file %s", file);

-	f = auth_openkeyfile(file, pw, options.strict_modes);

-

-	if (!f) {

-		restore_uid();

-		return 0;

-	}

-

 	found_key = 0;

 	found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);

@@ -281,8 +269,6 @@ user_key_allowed2(struct passwd *pw, Key

 			break;

 		}

 	}

-	restore_uid();

-	fclose(f);

 	key_free(found);

 	if (!found_key)

 		debug2("key not found");

@@ -329,13 +315,153 @@ user_cert_trusted_ca(struct passwd *pw, 

 	return ret;

 }

-/* check whether given key is in .ssh/authorized_keys* */

+/* return 1 if user allows given key */

+static int

+user_key_allowed2(struct passwd *pw, Key *key, char *file)

+{

+	FILE *f;

+	int found_key = 0;

+

+	/* Temporarily use the user's uid. */

+	temporarily_use_uid(pw);

+

+	debug("trying public key file %s", file);

+	f = auth_openkeyfile(file, pw, options.strict_modes);

+

+ 	if (f) {

+ 		found_key = user_search_key_in_file (f, file, key, pw);

+		fclose(f);

+	}

+

+	restore_uid();

+	return found_key;

+}

+

+#ifdef WITH_PUBKEY_AGENT

+

+#define WHITESPACE " \t\r\n"

+

+/* return 1 if user allows given key */

+static int

+user_key_via_agent_allowed2(struct passwd *pw, Key *key)

+{

+	FILE *f;

+	int found_key = 0;

+	char *pubkey_agent_string = NULL;

+	char *tmp_pubkey_agent_string = NULL;

+	char *progname;

+	char *cp;

+	struct passwd *runas_pw;

+	struct stat st;

+

+	if (options.pubkey_agent == NULL || options.pubkey_agent[0] != '/')

+		return -1;

+

+	/* get the run as identity from config */

+	runas_pw = (options.pubkey_agent_runas == NULL)? pw

+	    : getpwnam (options.pubkey_agent_runas);

+	if (!runas_pw) {

+		error("%s: getpwnam(\"%s\"): %s", __func__,

+		    options.pubkey_agent_runas, strerror(errno));

+		return 0;

+	}

+

+	/* Temporarily use the specified uid. */

+	if (runas_pw->pw_uid != 0)

+		temporarily_use_uid(runas_pw);

+

+	pubkey_agent_string = percent_expand(options.pubkey_agent,

+	    "h", pw->pw_dir, "u", pw->pw_name, (char *)NULL);

+

+	/* Test whether agent can be modified by non root user */

+	tmp_pubkey_agent_string = xstrdup (pubkey_agent_string);

+	progname = strtok (tmp_pubkey_agent_string, WHITESPACE);

+

+	debug3("%s: checking program '%s'", __func__, progname);

+

+	if (stat (progname, &st) < 0) {

+		error("%s: stat(\"%s\"): %s", __func__,

+		    progname, strerror(errno));

+		goto go_away;

+	}

+

+	if (st.st_uid != 0 || (st.st_mode & 022) != 0) {

+		error("bad ownership or modes for pubkey agent \"%s\"",

+		    progname);

+		goto go_away;

+	}

+

+	if (!S_ISREG(st.st_mode)) {

+		error("pubkey agent \"%s\" is not a regular file",

+		    progname);

+		goto go_away;

+	}

+

+	/*

+	 * Descend the path, checking that each component is a

+	 * root-owned directory with strict permissions.

+	 */

+	do {

+		if ((cp = strrchr(progname, '/')) == NULL)

+			break;

+		else 

+			*cp = '\0';

+	

+		debug3("%s: checking component '%s'", __func__, progname);

+

+		if (stat(progname, &st) != 0) {

+			error("%s: stat(\"%s\"): %s", __func__,

+			    progname, strerror(errno));

+			goto go_away;

+		}

+		if (st.st_uid != 0 || (st.st_mode & 022) != 0) {

+			error("bad ownership or modes for pubkey agent path component \"%s\"",

+			    progname);

+			goto go_away;

+		}

+		if (!S_ISDIR(st.st_mode)) {

+			error("pubkey agent path component \"%s\" is not a directory",

+			    progname);

+			goto go_away;

+		}

+	} while (0);

+

+	/* open the pipe and read the keys */

+	f = popen (pubkey_agent_string, "r");

+	if (!f) {

+		error("%s: popen (\"%s\", \"r\"): %s", __func__,

+		    pubkey_agent_string, strerror (errno));

+		goto go_away;

+	}

+

+	found_key = user_search_key_in_file (f, options.pubkey_agent, key, pw);

+	pclose (f);

+

+go_away:

+	if (tmp_pubkey_agent_string)

+		xfree (tmp_pubkey_agent_string);

+	if (pubkey_agent_string)

+		xfree (pubkey_agent_string);

+

+	if (runas_pw->pw_uid != 0)

+		restore_uid();

+	return found_key;

+}

+#endif

+

+/* check whether given key is in 

 int

 user_key_allowed(struct passwd *pw, Key *key)

 {

 	int success;

 	char *file;

+#ifdef WITH_PUBKEY_AGENT

+	success = user_key_via_agent_allowed2(pw, key);

+	if (success >= 0)

+		return success;

+#endif

+

 	if (auth_key_is_revoked(key))

 		return 0;

 	if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key))

diff -up openssh-5.5p1/config.h.in.pka openssh-5.5p1/config.h.in

--- openssh-5.5p1/config.h.in.pka	2010-04-16 02:17:09.000000000 +0200

+++ openssh-5.5p1/config.h.in	2010-05-06 10:51:21.000000000 +0200

@@ -1,5 +1,8 @@

 /* config.h.in.  Generated from configure.ac by autoheader.  */

+/* Define if building universal (internal helper macro) */

+#undef AC_APPLE_UNIVERSAL_BUILD

+

 /* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address

    */

 #undef AIX_GETNAMEINFO_HACK

@@ -536,6 +539,57 @@

 /* Define to 1 if you have the <lastlog.h> header file. */

 #undef HAVE_LASTLOG_H

+/* Define to 1 if you have the <lber.h> header file. */

+#undef HAVE_LBER_H

+

+/* Define to 1 if you have the `ldapssl_init' function. */

+#undef HAVE_LDAPSSL_INIT

+

+/* Define to 1 if you have the `ldap_controls_free' function. */

+#undef HAVE_LDAP_CONTROLS_FREE

+

+/* Define to 1 if you have the `ldap_get_lderrno' function. */

+#undef HAVE_LDAP_GET_LDERRNO

+

+/* Define to 1 if you have the `ldap_get_option' function. */

+#undef HAVE_LDAP_GET_OPTION

+

+/* Define to 1 if you have the <ldap.h> header file. */

+#undef HAVE_LDAP_H

+

+/* Define to 1 if you have the `ldap_init' function. */

+#undef HAVE_LDAP_INIT

+

+/* Define to 1 if you have the `ldap_initialize' function. */

+#undef HAVE_LDAP_INITIALIZE

+

+/* Define to 1 if you have the `ldap_memfree' function. */

+#undef HAVE_LDAP_MEMFREE

+

+/* Define to 1 if you have the `ldap_parse_result' function. */

+#undef HAVE_LDAP_PARSE_RESULT

+

+/* Define to 1 if you have the `ldap_pvt_tls_set_option' function. */

+#undef HAVE_LDAP_PVT_TLS_SET_OPTION

+

+/* Define to 1 if you have the `ldap_set_lderrno' function. */

+#undef HAVE_LDAP_SET_LDERRNO

+

+/* Define to 1 if you have the `ldap_set_option' function. */

+#undef HAVE_LDAP_SET_OPTION

+

+/* Define to 1 if you have the `ldap_set_rebind_proc' function. */

+#undef HAVE_LDAP_SET_REBIND_PROC

+

+/* Define to 1 if you have the <ldap_ssl.h> header file. */

+#undef HAVE_LDAP_SSL_H

+

+/* Define to 1 if you have the `ldap_start_tls_s' function. */

+#undef HAVE_LDAP_START_TLS_S

+

+/* Define to 1 if you have the <libaudit.h> header file. */

+#undef HAVE_LIBAUDIT_H

+

 /* Define to 1 if you have the `bsm' library (-lbsm). */

 #undef HAVE_LIBBSM

@@ -575,6 +629,9 @@

 /* Define to 1 if you have the <limits.h> header file. */

 #undef HAVE_LIMITS_H

+/* Define if you want Linux audit support. */

+#undef HAVE_LINUX_AUDIT

+

 /* Define to 1 if you have the <linux/if_tun.h> header file. */

 #undef HAVE_LINUX_IF_TUN_H

@@ -771,6 +828,9 @@

 /* Define to 1 if you have the `setgroups' function. */

 #undef HAVE_SETGROUPS

+/* Define to 1 if you have the `setkeycreatecon' function. */

+#undef HAVE_SETKEYCREATECON

+

 /* Define to 1 if you have the `setlogin' function. */

 #undef HAVE_SETLOGIN

@@ -921,13 +981,13 @@

 /* define if you have struct sockaddr_in6 data type */

 #undef HAVE_STRUCT_SOCKADDR_IN6

-/* Define to 1 if `sin6_scope_id' is member of `struct sockaddr_in6'. */

+/* Define to 1 if `sin6_scope_id' is a member of `struct sockaddr_in6'. */

 #undef HAVE_STRUCT_SOCKADDR_IN6_SIN6_SCOPE_ID

 /* define if you have struct sockaddr_storage data type */

 #undef HAVE_STRUCT_SOCKADDR_STORAGE

-/* Define to 1 if `st_blksize' is member of `struct stat'. */

+/* Define to 1 if `st_blksize' is a member of `struct stat'. */

 #undef HAVE_STRUCT_STAT_ST_BLKSIZE

 /* Define to 1 if the system has the type `struct timespec'. */

@@ -1191,6 +1251,9 @@

 /* Define if pututxline updates lastlog too */

 #undef LASTLOG_WRITE_PUTUTXLINE

+/* number arguments of ldap_set_rebind_proc */

+#undef LDAP_SET_REBIND_PROC_ARGS

+

 /* Define if you want TCP Wrappers support */

 #undef LIBWRAP

@@ -1274,6 +1337,9 @@

 /* Define to the one symbol short name of this package. */

 #undef PACKAGE_TARNAME

+/* Define to the home page for this package. */

+#undef PACKAGE_URL

+

 /* Define to the version of this package. */

 #undef PACKAGE_VERSION

@@ -1360,6 +1426,10 @@

 /* Prepend the address family to IP tunnel traffic */

 #undef SSH_TUN_PREPEND_AF

+/* Define to your vendor patch level, if it has been modified from the

+   upstream source release. */

+#undef SSH_VENDOR_PATCHLEVEL

+

 /* Define to 1 if you have the ANSI C header files. */

 #undef STDC_HEADERS

@@ -1418,12 +1488,26 @@

 /* Define if you want IRIX project management */

 #undef WITH_IRIX_PROJECT

+/* Enable LDAP pubkey support */

+#undef WITH_LDAP_PUBKEY

+

+/* Enable pubkey agent support */

+#undef WITH_PUBKEY_AGENT

+

 /* Define if you want SELinux support. */

 #undef WITH_SELINUX

-/* Define to 1 if your processor stores words with the most significant byte

-   first (like Motorola and SPARC, unlike Intel and VAX). */

-#undef WORDS_BIGENDIAN

+/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most

+   significant byte first (like Motorola and SPARC, unlike Intel). */

+#if defined AC_APPLE_UNIVERSAL_BUILD

+# if defined __BIG_ENDIAN__

+#  define WORDS_BIGENDIAN 1

+# endif

+#else

+# ifndef WORDS_BIGENDIAN

+#  undef WORDS_BIGENDIAN

+# endif

+#endif

 /* Define if xauth is found in your path */

 #undef XAUTH_PATH

diff -up openssh-5.5p1/configure.ac.pka openssh-5.5p1/configure.ac

--- openssh-5.5p1/configure.ac.pka	2010-05-06 10:50:49.000000000 +0200

+++ openssh-5.5p1/configure.ac	2010-05-06 10:50:49.000000000 +0200

@@ -1346,6 +1346,118 @@ AC_ARG_WITH(audit,

 	esac ]

 )

+# Check whether user wants pubkey agent support

+PKA_MSG="no"

+AC_ARG_WITH(pka,

+	[  --with-pka      Enable pubkey agent support],

+	[

+		if test "x$withval" != "xno" ; then

+			AC_DEFINE([WITH_PUBKEY_AGENT], 1, [Enable pubkey agent support])

+			PKA_MSG="yes"

+		fi

+	]

+)

+

+# Check whether user wants LDAP support

+LDAP_MSG="no"

+INSTALL_SSH_LDAP_HELPER=""

+AC_ARG_WITH(ldap,

+	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],

+	[

+		if test "x$withval" != "xno" ; then

+

+			INSTALL_SSH_LDAP_HELPER="yes"

+			CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"

+

+			if test "x$withval" != "xyes" ; then

+				CPPFLAGS="$CPPFLAGS -I${withval}/include"

+				LDFLAGS="$LDFLAGS -L${withval}/lib"

+			fi

+

+			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])

+			LDAP_MSG="yes"

+

+			AC_CHECK_HEADERS(lber.h)

+			AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))

+			AC_CHECK_HEADERS(ldap_ssl.h)

+

+			AC_ARG_WITH(ldap-lib,

+				[  --with-ldap-lib=type    select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])

+

+			if test -z "$with_ldap_lib"; then

+				with_ldap_lib=auto

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then

+				AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)

+				AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then

+				AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then

+				AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)

+				fi

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)

+				fi

+				if test -z "$found_ldap_lib"; then

+					AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)

+				fi

+			fi

+

+			if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then

+				AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)

+			fi

+

+			if test -z "$found_ldap_lib"; then

+				AC_MSG_ERROR(could not locate a valid LDAP library)

+			fi

+

+			AC_MSG_CHECKING([for working LDAP support])

+			AC_TRY_COMPILE(

+				[#include <sys/types.h>

+				 #include <ldap.h>],

+				[(void)ldap_init(0, 0);],

+				[AC_MSG_RESULT(yes)],

+				[

+				    AC_MSG_RESULT(no) 

+					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])

+				])

+			AC_CHECK_FUNCS( \

+				ldap_init \

+				ldap_get_lderrno \

+				ldap_set_lderrno \

+				ldap_parse_result \

+				ldap_memfree \

+				ldap_controls_free \

+				ldap_set_option \

+				ldap_get_option \

+				ldapssl_init \

+				ldap_start_tls_s \

+				ldap_pvt_tls_set_option \

+				ldap_initialize \

+			)

+			AC_CHECK_FUNCS(ldap_set_rebind_proc,

+				AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])

+				AC_TRY_COMPILE(

+					[#include <lber.h>

+					#include <ldap.h>],

+					[ldap_set_rebind_proc(0, 0, 0);],

+					[ac_cv_ldap_set_rebind_proc=3],

+					[ac_cv_ldap_set_rebind_proc=2])

+				AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)

+				AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])

+			)

+		fi

+	]

+)

+AC_SUBST(INSTALL_SSH_LDAP_HELPER)

+

 dnl    Checks for library functions. Please keep in alphabetical order

 AC_CHECK_FUNCS( \

 	arc4random \

@@ -4202,6 +4314,8 @@ echo "               Linux audit support

 echo "                 Smartcard support: $SCARD_MSG"

 echo "                     S/KEY support: $SKEY_MSG"

 echo "              TCP Wrappers support: $TCPW_MSG"

+echo "                       PKA support: $PKA_MSG"

+echo "                      LDAP support: $LDAP_MSG"

 echo "              MD5 password support: $MD5_MSG"

 echo "                   libedit support: $LIBEDIT_MSG"

 echo "  Solaris process contract support: $SPC_MSG"

diff -up openssh-5.5p1/ldapbody.c.pka openssh-5.5p1/ldapbody.c

--- openssh-5.5p1/ldapbody.c.pka	2010-05-06 10:50:49.000000000 +0200

+++ openssh-5.5p1/ldapbody.c	2010-05-06 10:50:49.000000000 +0200

@@ -0,0 +1,494 @@

+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */

+/*

+ * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "ldapincludes.h"

+#include "log.h"

+#include "xmalloc.h"

+#include "ldapconf.h"

+#include "ldapmisc.h"

+#include "ldapbody.h"

+#include <stdio.h>

+#include <unistd.h>

+

+#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"

+#define PUBKEYATTR "sshPublicKey"

+#define LDAP_LOGFILE	"%s/ldap.%d"

+

+static FILE *logfile = NULL;

+static LDAP *ld;

+

+static char *attrs[] = {

+    PUBKEYATTR,

+    NULL

+};

+

+void

+ldap_checkconfig (void)

+{

+#ifdef HAVE_LDAP_INITIALIZE

+		if (options.host == NULL && options.uri == NULL)

+#else

+		if (options.host == NULL)

+#endif

+		    fatal ("missing  \"host\" in config file");

+}

+

+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)

+static int

+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)

+{

+	struct timeval timeout;

+	int rc;

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	LDAPMessage *result;

+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */

+

+	debug2 ("Doing LDAP rebind to %s", options.binddn);

+	if (options.ssl == SSL_START_TLS) {

+		if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {

+			error ("ldap_starttls_s: %s", ldap_err2string (rc));

+			return LDAP_OPERATIONS_ERROR;

+		}

+	}

+

+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)

+	return ldap_simple_bind_s (ld, options.binddn, options.bindpw);

+#else

+	if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)

+	    fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));

+

+	timeout.tv_sec = options.bind_timelimit;

+	timeout.tv_usec = 0;

+	result = NULL;

+	if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {

+		error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));

+		ldap_msgfree (result);

+		return LDAP_OPERATIONS_ERROR;

+	}

+	debug3 ("LDAP rebind to %s succesfull", options.binddn);

+	return rc;

+#endif

+}

+#else

+

+static int

+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)

+{

+	if (freeit)

+	    return LDAP_SUCCESS;

+

+	*whop = strdup (options.binddn);

+	*credp = strdup (options.bindpw);

+	*methodp = LDAP_AUTH_SIMPLE;

+	debug2 ("Doing LDAP rebind for %s", *whop);

+	return LDAP_SUCCESS;

+}

+#endif

+

+void

+ldap_do_connect(void)

+{

+	int rc, msgid, ld_errno = 0;

+	struct timeval timeout;

+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)

+	int parserc;

+	LDAPMessage *result;

+	LDAPControl **controls;

+	int reconnect = 0;

+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */

+

+	debug ("LDAP do connect");

+

+retry:

+	if (reconnect) {

+		debug3 ("Reconnecting with ld_errno %d", ld_errno);

+		if (options.bind_policy == 0 ||

+		    (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||

+			reconnect > 5)

+			    fatal ("Cannot connect to LDAP server");

+	

+		if (reconnect > 1)

+			sleep (reconnect - 1);

+

+		if (ld != NULL) {

+			ldap_unbind (ld);

+			ld = NULL;

+		}

+		logit("reconnecting to LDAP server...");

+	}

+

+	if (ld == NULL) {

+		int rc;

+		struct timeval tv;

+

+#ifdef HAVE_LDAP_SET_OPTION

+		if (options.debug > 0) {

+#ifdef LBER_OPT_LOG_PRINT_FILE

+			if (options.logdir) {

+				char *logfilename;

+				int logfilenamelen;

+

+				logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);

+				logfilename = xmalloc (logfilenamelen);

+				snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());

+				logfilename[logfilenamelen - 1] = 0;

+				if ((logfile = fopen (logfilename, "a")) == NULL)

+				    fatal ("cannot append to %s: %s", logfilename, strerror (errno));

+				debug3 ("LDAP debug into %s", logfilename);

+				xfree (logfilename);

+				ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);

+			}

+#endif

+			if (options.debug) {

+#ifdef LBER_OPT_DEBUG_LEVEL

+				ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);

+#endif /* LBER_OPT_DEBUG_LEVEL */

+#ifdef LDAP_OPT_DEBUG_LEVEL

+				ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);

+#endif /* LDAP_OPT_DEBUG_LEVEL */

+				debug3 ("Set LDAP debug to %d", options.debug);

+			}

+		}

+#endif /* HAVE_LDAP_SET_OPTION */

+

+		ld = NULL;

+#ifdef HAVE_LDAPSSL_INIT

+		if (options.host != NULL) {

+			if (options.ssl_on == SSL_LDAPS) {

+				if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)

+				    fatal ("ldapssl_client_init %s", ldap_err2string (rc));

+				debug3 ("LDAPssl client init");

+			}

+

+			if (options.ssl_on != SSL_OFF) {

+				if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)

+				    fatal ("ldapssl_init failed");

+				debug3 ("LDAPssl init");

+			}

+		}

+#endif /* HAVE_LDAPSSL_INIT */

+

+		/* continue with opening */

+		if (ld == NULL) {

+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))

+			/* Some global TLS-specific options need to be set before we create our

+			 * session context, so we set them here. */

+

+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE

+			/* rand file */

+			if (options.tls_randfile != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,

+				    options.tls_randfile)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS random file %s", options.tls_randfile);

+			}

+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */

+

+			/* ca cert file */

+			if (options.tls_cacertfile != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,

+				    options.tls_cacertfile)) != LDAP_SUCCESS)

+					error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);

+			}

+

+			/* ca cert directory */

+			if (options.tls_cacertdir != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,

+				    options.tls_cacertdir)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);

+			}

+

+			/* require cert? */

+			if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,

+			    &options.tls_checkpeer)) != LDAP_SUCCESS)

+				fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",

+				    ldap_err2string (rc));

+			debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);

+

+			/* set cipher suite, certificate and private key: */

+			if (options.tls_ciphers != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,

+				    options.tls_ciphers)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);

+			}

+

+			/* cert file */

+			if (options.tls_cert != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,

+				    options.tls_cert)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS cert file %s ", options.tls_cert);

+			}

+

+			/* key file */

+			if (options.tls_key != NULL) {

+				if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,

+				    options.tls_key)) != LDAP_SUCCESS)

+					fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",

+					    ldap_err2string (rc));

+				debug3 ("Set TLS key file %s ", options.tls_key);

+			}

+#endif

+#ifdef HAVE_LDAP_INITIALIZE

+			if (options.uri != NULL) {

+				if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)

+					fatal ("ldap_initialize %s", ldap_err2string (rc));

+				debug3 ("LDAP initialize %s", options.uri);

+			}

+	}

+#endif /* HAVE_LDAP_INTITIALIZE */

+

+		/* continue with opening */

+		if ((ld == NULL) && (options.host != NULL)) {

+#ifdef HAVE_LDAP_INIT

+			if ((ld = ldap_init (options.host, options.port)) == NULL)

+			    fatal ("ldap_init failed");

+			debug3 ("LDAP init %s:%d", options.host, options.port);

+#else

+			if ((ld = ldap_open (options.host, options.port)) == NULL)

+			    fatal ("ldap_open failed");

+			debug3 ("LDAP open %s:%d", options.host, options.port);

+#endif /* HAVE_LDAP_INIT */

+		}

+

+		if (ld == NULL)

+			fatal ("no way to open ldap");

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)

+		if (options.ssl == SSL_LDAPS) {

+			if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)

+				fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));

+			debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);

+		}

+#endif /* LDAP_OPT_X_TLS */

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)

+		(void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,

+		    &options.ldap_version);

+#else

+		ld->ld_version = options.ldap_version;

+#endif

+		debug3 ("LDAP set version to %d", options.ldap_version);

+

+#if LDAP_SET_REBIND_PROC_ARGS == 3

+		ldap_set_rebind_proc (ld, _rebind_proc, NULL);

+#elif LDAP_SET_REBIND_PROC_ARGS == 2

+		ldap_set_rebind_proc (ld, _rebind_proc);

+#else

+#warning unknown LDAP_SET_REBIND_PROC_ARGS

+#endif

+		debug3 ("LDAP set rebind proc");

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)

+		(void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);

+#else

+		ld->ld_deref = options.deref;

+#endif

+		debug3 ("LDAP set deref to %d", options.deref);

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)

+		(void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,

+		    &options.timelimit);

+#else

+		ld->ld_timelimit = options.timelimit;

+#endif

+		debug3 ("LDAP set timelimit to %d", options.timelimit);

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)

+		/*

+		 * This is a new option in the Netscape SDK which sets 

+		 * the TCP connect timeout. For want of a better value,

+		 * we use the bind_timelimit to control this.

+		 */

+		timeout = options.bind_timelimit * 1000;

+		(void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);

+		debug3 ("LDAP set opt connect timeout to %d", timeout);

+#endif

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)

+		tv.tv_sec = options.bind_timelimit;

+		tv.tv_usec = 0;

+		(void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv;;

+		debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);

+#endif

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)

+		(void) ldap_set_option (ld, LDAP_OPT_REFERRALS,

+		    options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);

+		debug3 ("LDAP set referrals to %d", options.referrals);

+#endif

+

+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)

+		(void) ldap_set_option (ld, LDAP_OPT_RESTART,

+		    options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);

+		debug3 ("LDAP set restart to %d", options.restart);

+#endif

+

+#ifdef HAVE_LDAP_START_TLS_S

+		if (options.ssl == SSL_START_TLS) {

+			int version;

+

+			if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)

+			    == LDAP_SUCCESS) {

+				if (version < LDAP_VERSION3) {

+					version = LDAP_VERSION3;

+					(void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,

+					    &version);

+					debug3 ("LDAP set version to %d", version);

+				}

+			}

+

+			if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)

+			    fatal ("ldap_starttls_s: %s", ldap_err2string (rc));

+			debug3 ("LDAP start TLS");

+		}

+#endif /* HAVE_LDAP_START_TLS_S */

+	}

+

+	if ((msgid = ldap_simple_bind (ld, options.binddn,

+	    options.bindpw)) == -1) {

+		ld_errno = ldap_get_lderrno (ld, 0, 0);

+