]> git.pld-linux.org Git - packages/dhcp.git/blame - dhcp-ldap.patch
projects / packages / dhcp.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
- added try-restart and force-reload options
[packages/dhcp.git] / dhcp-ldap.patch
CommitLineData
a37573f1
JR		 1diff -Naur dhcp-3.0.5/Changelog-LDAP dhcp-3.0.5-ldap/Changelog-LDAP
2--- dhcp-3.0.5/Changelog-LDAP 1969-12-31 19:00:00.000000000 -0500
3+++ dhcp-3.0.5-ldap/Changelog-LDAP 2007-02-23 14:06:33.000000000 -0500
4@@ -0,0 +1,251 @@
5+2007-2-23 Brian Masney <masneyb@ntelos.net>
6+ * contrib/dhcpd-conf-to-ldap.pl - fixed a parsing bug in which
7+ didn't handle correctly quoted string containing spaces.
8+ (Rapha?l Luta <raphael.luta@aptiwan.com>)
9+
10+ * dst/Makefile.dist server/Makefile.dist site.conf - updated build
11+ method when using -lssl.
12+ (from Marius Tomaschewski <mt@suse.de>)
13+
14+ * server/ldap.c - fix for ldap_read_function to avoid returning
15+ empty strings (skipped host declaration from ldap) that are causing
16+ parsing errors in ldap-dynamic mode.
17+ (from Marius Tomaschewski <mt@suse.de>)
18+
19+ * includes/dhcpd.h README.ldap server/dhcpd.c server/ldap.c
20+ server/stables.c - added ldap-ssl <off|start_tls|ldaps|on> option and
21+ several ldap-tls* options, that are described in the "man ldap.conf".
22+ (from Marius Tomaschewski <mt@suse.de>)
23+
24+ * includes/dhcpd.h server/ldap.c server/stables.c - added ldap-referrals
25+ <on|off> option. Also implemented a LDAP rebuind function
26+ (from Kalyan <skalyanasundaram@novell.com>)
27+
28+ * includes/dhcpd.h server/ldap.c server/stables.c - renamed dhcpd.conf
29+ option ldap-server-cn to ldap-dhcp-server-cn
30+ (from Marius Tomaschewski <mt@suse.de>)
31+
32+ * contrib/dhcp.schema - schema updates
33+ (from Kalyan <skalyanasundaram@novell.com>)
34+
35+ * server/ldap.c server/ldap_casa.c - CASA support fixes
36+ (from Marius Tomaschewski <mt@suse.de>)
37+
38+ * server/ldap.c - added strncat() fix
39+ (from Marius Tomaschewski <mt@suse.de>)
40+
41+2006-12-15 Brian Masney <masneyb@ntelos.net>
42+ * server/ldap.c (ldap_read_config) - unbind from the LDAP server after
43+ the config file has been ran if the server is being ran in static mode
44+ (from Tomas Hoger <thoger@pobox.sk>)
45+
46+ * server/ldap.c (ldap_read_function) - fixed bug where the entire
47+ configuration was not being processed in the LDAP directory.
48+
49+ * server/ldap.c - added the following functions for reading values
50+ from the config file: _do_lookup_dhcp_string_option(),
51+ _do_lookup_dhcp_int_option() and _do_lookup_dhcp_enum_option(). This
52+ helped to clean up ldap_start() start a bit. Also, various small
53+ formatting changes to the code.
54+
55+2006-12-15 Marius Tomaschewski <mt@suse.de>
56+ * Changelog-LDAP - Added / changed some of entries in
57+ Changelog-LDAP, e.g. changes to the dhcpServer and
58+ dhcpService objectclasses in schema file was not mentioned.
59+
60+ * server/ldap.c Some a little bit paranoid checks to strchr results
61+ in the group patch, avoided allocation of groupname using snprintf
62+ with a "%.*s" format.
63+
64+ * server/ldap.c - Readded FIXME comment about one space in
65+ dhcpHWAddress.
66+
67+ * server/ldap.c Changed "dhcpdnsZone" and "dhcpdnszoneServer" into
68+ "dhcpDnsZone" and "dhcpDnsZoneServer".
69+
70+ * Fixed memory leak in ldap_parse_zone (dfree of keyCn), added checks
71+ for dmalloc and strchr results.
72+
73+ * ldap_casa.c, ldap_casa.h - surrounded content of ldap_casa.h and
74+ ldap_casa.c with if defined(LDAP_CASA_AUTH).
75+
76+ * contrib/dhcp.schema - Reverted the equality change for dhcpOption.
77+ The dhcp options are case-insensitive in dhcpd.conf.
78+
79+ * Changed "dhcpdnsZone" and "dhcpdnszoneServer" into "dhcpDnsZone"
80+ and "dhcpDnsZoneServer".
81+
82+ * Changed "FQDNs" into "DNs" in dhcpLocatorDN description (DN is already
83+ absolute, RDN is relative DN, FQDN means a full qualified domain name).
84+
85+2006-12-15 Kalyan <skalyanasundaram@novell.com>
86+ * includes/ldap_casa.h server/ldap_casa.c - updated to support CASA
87+ 1.7
88+
89+2006-8-15 Kalyan <skalyanasundaram@novell.com>
90+ * server/ldap.c (ldap_parse_options) - fetch option from the group
91+ if the host belongs to that group in the dynamic method.
92+
93+ * contrib/dhcp.schema - modified dhcpServiceDN attribute in dhcpServer
94+ objectclasses to be optional instead of mandatory
95+
96+ * contrib/dhcp.schema - modified dhcpPrimaryDN attribute in dhcpService
97+ objectclasses to be optional instead of mandatory
98+
99+ * contrib/dhcp.schema - schema has been updated with
100+ new objectclasses dhcpLocator,dhcpTsigKey,dhcpdnsZone,dhcpFailOver and
101+ many attributes.
102+
103+ * contrib/dhcp.schema - dhcpHWAddress's equality has been modified to
104+ caseIgnoreIA5Match.
105+
106+ * server/ldap.c - added support for reading the dhcpTsigKey and
107+ dhcpdnsZone objects.
108+
109+ * server/ldap.c (ldap_parse_options) Fetch option from the group if
110+ the host belongs to that group in the dynamic method.
111+
112+ * server/ldap.c - CASA authentication is enabled.
113+
114+ * server/ldap.c - introduced new attribute ldap-server-cn to mention
115+ the dhcpServer object name in configuration.
116+
117+2006-7-17 Brian Masney <masneyb@ntelos.net>
118+ * server/ldap.c (ldap_read_function) - fixes for reading the data
119+ from the LDAP tree in some cases (patch from
120+ Darrin Smith <beldin@beldin.org>)
121+
122+2006-3-17 Brian Masney <masneyb@ntelos.net>
123+ * server/ldap.c (ldap_read_function) - added patch from
124+ Dmitriy Bogun <kabanyura@gmail.com>. This patch fixes a bug when
125+ EOF wasn't returned in some cases.
126+
127+2005-9-26 Brian Masney <masneyb@ntelos.net>
128+ * server/ldap.c (ldap_start) - added support for reading the
129+ ldap-port option. This option was not being used.
130+
131+2005-5-24 Brian Masney <masneyb@ntelos.net>
132+ * server/ldap.c (ldap_parse_host) - allow dhcpHost entries that do
133+ not have a hardware address associated with them
134+
135+2005-4-11 Brian Masney <masneyb@ntelos.net>
136+ * README.ldap - updated directions on how to use LDAP over SSL on
137+ non-Linux machines
138+
139+2005-2-23 Brian Masney <masneyb@ntelos.net>
140+ * server/ldap.c (ldap_generate_config_string) - do a case insensitive
141+ string comparsion when comparing the object classes
142+
143+2004-11-8 Brian Masney <masneyb@ntelos.net>
144+ * debian/control - updated the depends and build-depends line
145+ (from Andrew Pollock <me@andrew.net.au>)
146+
147+2004-10-13 Brian Masney <masneyb@ntelos.net>
148+ * server/ldap.c (ldap_start) - allow doing an anonymous bind to the
149+ LDAP server
150+
151+2004-9-27 Brian Masney <masneyb@ntelos.net>
152+ * contrib/dhcpd-conf-to-ldap.pl - make sure the DHCP hardware address
153+ is always lowercased
154+
155+2004-7-30 Brian Masney <masneyb@ntelos.net>
156+ * server/ldap.c - added more debbuging statements. Fixed possible crash
157+ that could occur whenever more than 1 external DN is added to an LDAP
158+ entry. Fixed possible infinite loop when reading the external DNs.
159+ (from Sebastian Hetze <s.hetze@linux-ag.de>)
160+
161+2004-7-1 Brian Masney <masneyb@ntelos.net>
162+ * README.ldap - updated build instructions paragraph
163+ (from Mason Schmitt <sysadmin@sunwave.net>)
164+
165+2004-6-29 Brian Masney <masneyb@ntelos.net>
166+ * debian/control - set the minimum required version of the DHCP server
167+ to be 3.0.1rc9
168+
169+ * configure - fix for sed when configure was run from an older shell
170+
171+2004-6-22 Brian Masney <masneyb@ntelos.net>
172+ * Updated patch to use ISC DHCP 3.0.1rc14
173+
3150c1ff 174+2004-5-24 Brian Masney <masneyb@ntelos.net>
175+ * server/ldap.c - don't append a ; to the end of a dhcpStatement if it
176+ ends in }
177+
178+ * server/ldap.c contrib/dhcpd-conf-to-ldap.pl - support having multiple
179+ dhcpRange statements (from Marco D'Ettorre <marco.dettorre@sys-net.it>)
180+
181+2004-5-5 Brian Masney <masneyb@ntelos.net>
182+ * server/ldap.c - added more debugging statements when
183+ it is compiled in to help troubleshoot parsing errors. Don't free
184+ a LDAP connection prematurely when there is a reference to another
185+ LDAP tree. If the config entry ends in }, make sure a ; gets tacked
186+ on
187+
188+ * debian/* - Updated version number. Renamed package from
189+ dhcp3-ldap-ntelos to dhcp3-server-ldap.
190+
191+ * server/ldap.c - enclose the shared-network name in quotes so
192+ that there can be shared network statements in LDAP that have spaces
193+ in them
194+
195+ * configure - after the work directory is setup, add -lldap -llber
196+ to the server Makefile
197+
198+Wed Apr 21 15:09:08 CEST 2004 - mt@suse.de
199+ * contrib/dhcpd-conf-to-ldap.pl:
200+ - added "--conf=file" option usable instead of stdin
201+ - added "--ldif=file" option usable instead of stdout
202+ - added "--second=host|dn" option usefull for failover
203+ - added "--use=feature" option to enable extended features;
204+ currently used to enable failover (default is disabled).
205+ - extended remaining_line() to support block statements
206+ - fixed / improved failover support, added notes about
207+
208+ * server/ldap.c:
209+ - moved code checking statement ends to check_statement_end()
210+ - moved parsing of entry options/statements to
211+ ldap_parse_entry_options()
212+ - moved code closing debug fd into ldap_close_debug_fd()
213+ - moved code writing to debug fd into ldap_write_debug()
214+ - added support for full hostname in dhcpServer search filter
215+ - added support for multiple dhcpService entries in dhcpServer object
216+ - added parsing of options and statements for dhcpServer object
217+ - added verify if dhcpService contains server dn as primary or
218+ secondary
219+ - changed to search for dhcpHost,dhcpSubClass bellow of all
220+ dhcpService trees instead of base-dn (avoids finding of hosts in
221+ foreign configs)
222+ - fixes to free all dn's fetched by ldap_get_dn (e.g. debug output)
223+ - fixes to free ldap results, mainly in cases where no LDAP_SUCCESS
224+ returned or other error conditions happened
225+ - fixed/improved some log messages
226+
1097e9ca 227+2004-3-30 Brian Masney <masneyb@ntelos.net>
228+ * contrib/dhcpd-conf-to-ldap.pl - added option to control the
229+ DHCP Config DN. Wrap the DHCP Statements in { }
230+ This patch was contributed by Marius Tomaschewski <mt@suse.de>
231+
232+ * server/ldap.c - changed ldap_username and ldap_password to
233+ be optional (anonymous bind is used then). Added {} block support
234+ to dhcpStatements. (no ";" at end if statement ends with a "}").
235+ Fixed writing to ldap-debug-file. Changed find_haddr_in_ldap() to
236+ use dhcpHost objectClass in its filter
237+ This patch was contributed by Marius Tomaschewski <mt@suse.de>
238+
239+2004-3-23 Brian Masney <masneyb@ntelos.net>
240+ * contrib/dhcpd-conf-to-ldap.pl - added options for server, basedn
241+ options and usage message (Net::Domain instead of SYS::Hostname).
242+ Added handling of zone, authoritative and failover (config and
243+ pool-refs) statements. Added numbering of groups and pools per
244+ subnet. This patch was contributed by Marius Tomaschewski <mt@suse.de>
245+
246+2004-2-26 Brian Masney <masneyb@ntelos.net>
247+ * fixed an instance where the LDAP server would restart, but the DHCP
248+ server would not reconnect
249+
250+2004-2-18 Brian Masney <masneyb@ntelos.net>
251+ * allow multiple dhcp*DN entries in the LDAP entry.
252+
253+2003-9-11 Brian Masney <masneyb@ntelos.net>
254+ * updated patch to work with 3.0.1rc12
255+
a37573f1
JR		 256diff -Naur dhcp-3.0.5/README.ldap dhcp-3.0.5-ldap/README.ldap
257--- dhcp-3.0.5/README.ldap 1969-12-31 19:00:00.000000000 -0500
258+++ dhcp-3.0.5-ldap/README.ldap 2007-02-23 13:13:36.000000000 -0500
259@@ -0,0 +1,190 @@
1097e9ca 260+LDAP Support in DHCP
261+Brian Masney <masneyb@ntelos.net>
262+Last updated 3/23/2003
263+
264+This document describes setting up the DHCP server to read it's configuration
265+from LDAP. This work is based on the IETF document
266+draft-ietf-dhc-ldap-schema-01.txt included in the doc directory. For the latest
267+version of this document, please see http://home.ntelos.net/~masneyb.
268+
269+First question on most people's mind is "Why do I want to store my
270+configuration in LDAP?" If you run a small DHCP server, and the configuration
271+on it rarely changes, then you won't need to store your configuration in LDAP.
272+But, if you have several DHCP servers, and you want an easy way to manage your
273+configuration, this can be a solution.
274+
275+The first step will be to setup your LDAP server. I am using OpenLDAP from
276+www.openldap.org. Building and installing OpenLDAP is beyond the scope of this
277+document. There is plenty of documentation out there about this. Once you have
278+OpenLDAP installed, you will have to edit your slapd.conf file. I added the
279+following 2 lines to my configuration file:
280+
281+include /etc/ldap/schema/dhcp.schema
282+index dhcpHWAddress eq
283+index dhcpClassData eq
284+
285+The first line tells it to include the dhcp schema file. You will find this
286+file under the contrib directory in this distribution. You will need to copy
287+this file to where your other schema files are (maybe
288+/usr/local/openldap/etc/openldap/schema/). The second line sets up
289+an index for the dhcpHWAddress parameter. The third parameter is for reading
290+subclasses from LDAP every time a DHCP request comes in. Make sure you run the
291+slapindex command and restart slapd to have these changes to into effect.
292+
293+Now that you have LDAP setup, you should be able to use gq (http://biot.com/gq/)
294+to verify that the dhcp schema file is loaded into LDAP. Pull up gq, and click
295+on the Schema tab. Go under objectClasses, and you should see at least the
296+following object classes listed: dhcpClass, dhcpGroup, dhcpHost, dhcpOptions,
297+dhcpPool, dhcpServer, dhcpService, dhcpSharedNetwork, dhcpSubClass, and
298+dhcpSubnet. If you do not see these, you need to check over your LDAP
299+configuration before you go any further.
300+
a37573f1
JR		 301+You should now be ready to build DHCP. If you would like to enable LDAP over
302+SSL, you will need to perform the following steps:
303+
304+ * Edit the includes/site.h file and uncomment the USE_SSL line
305+ or specify "-DUSE_SSL" via CFLAGS.
306+ * Edit the dst/Makefile.dist file and remove md5_dgst.c and md5_dgst.o
307+ from the SRC= and OBJ= lines (around line 24)
308+ * Now run configure in the base source directory. If you chose to enable
309+ LDAP over SSL, you must append -lcrypto -lssl to the LIBS= line in the file
310+ work.os/server/Makefile (replace os with your operating system, linux-2.2 on
311+ my machine). You should now be able to type make to build your DHCP server.
312+
313+If you choose to not enable LDAP over SSL, then you only need to run configure
314+and make in the toplevel source directory.
1097e9ca 315+
316+Once you have DHCP installed, you will need to setup your initial plaintext
317+config file. In my /etc/dhcpd.conf file, I have:
318+
319+ldap-server "localhost";
320+ldap-port 389;
321+ldap-username "cn=DHCP User, dc=ntelos, dc=net";
322+ldap-password "blah";
323+ldap-base-dn "dc=ntelos, dc=net";
324+ldap-method dynamic;
325+ldap-debug-file "/var/log/dhcp-ldap-startup.log";
326+
a37573f1
JR		 327+If SSL has been enabled at compile time using the USE_SSL flag, the dhcp
328+server trys to use TLS if possible, but continues without TLS if not.
329+
330+You can modify this behaviour using following option in /etc/dhcpd.conf:
331+
332+ldap-ssl <off | ldaps | start_tls | on>
333+ off: disables TLS/LDAPS.
334+ ldaps: enables LDAPS -- don't forget to set ldap-port to 636.
335+ start_tls: enables TLS using START_TLS command
336+ on: enables LDAPS if ldap-port is set to 636 or TLS in
337+ other cases.
338+
339+See also "man 5 ldap.conf" for description the following TLS related
340+options:
341+ ldap-tls-reqcert, ldap-tls-ca-file, ldap-tls-ca-dir, ldap-tls-cert
342+ ldap-tls-key, ldap-tls-crlcheck, ldap-tls-ciphers, ldap-tls-randfile
343+
1097e9ca 344+All of these parameters should be self explanatory except for the ldap-method.
345+You can set this to static or dynamic. If you set it to static, the
346+configuration is read once on startup, and LDAP isn't used anymore. But, if you
347+set this to dynamic, the configuration is read once on startup, and the
348+hosts that are stored in LDAP are looked up every time a DHCP request comes in.
349+
350+When the optional statement ldap-debug-file is specified, on startup the DHCP
351+server will write out the configuration that it generated from LDAP. If you are
352+getting errors about your LDAP configuration, this is a good place to start
353+looking.
354+
355+The next step is to set up your LDAP tree. Here is an example config that will
356+give a 10.100.0.x address to machines that have a host entry in LDAP.
357+Otherwise, it will give a 10.200.0.x address to them. (NOTE: replace
358+dc=ntelos, dc=net with your base dn). If you would like to convert your
359+existing dhcpd.conf file to LDIF format, there is a script
360+contrib/dhcpd-conf-to-ldap.pl that will convert it for you. Type
361+dhcpd-conf-to-ldap.pl --help to see the usage information for this script.
362+
363+# You must specify the server's host name in LDAP that you are going to run
364+# DHCP on and point it to which config tree you want to use. Whenever DHCP
365+# first starts up, it will do a search for this entry to find out which
366+# config to use
367+dn: cn=brian.ntelos.net, dc=ntelos, dc=net
368+objectClass: top
369+objectClass: dhcpServer
370+cn: brian.ntelos.net
371+dhcpServiceDN: cn=DHCP Service Config, dc=ntelos, dc=net
372+
373+# Here is the config tree that brian.ntelos.net points to.
374+dn: cn=DHCP Service Config, dc=ntelos, dc=net
375+cn: DHCP Service Config
376+objectClass: top
377+objectClass: dhcpService
378+dhcpPrimaryDN: dc=ntelos, dc=net
379+dhcpStatements: ddns-update-style none
380+dhcpStatements: default-lease-time 600
381+dhcpStatements: max-lease-time 7200
382+
383+# Set up a shared network segment
384+dn: cn=WV Test, cn=DHCP Service Config, dc=ntelos, dc=net
385+cn: WV
386+objectClass: top
387+objectClass: dhcpSharedNetwork
388+
389+# Set up a subnet declaration with a pool statement. Also note that we have
390+# a dhcpOptions object with this entry
391+dn: cn=10.100.0.0, cn=WV Test, cn=DHCP Service Config, dc=ntelos, dc=net
392+cn: 10.100.0.0
393+objectClass: top
394+objectClass: dhcpSubnet
395+objectClass: dhcpOptions
396+dhcpOption: domain-name-servers 10.100.0.2
397+dhcpOption: routers 10.100.0.1
398+dhcpOption: subnet-mask 255.255.255.0
399+dhcpOption: broadcast-address 10.100.0.255
400+dhcpNetMask: 24
401+
402+# Set up a pool for this subnet. Only known hosts will get these IPs
403+dn: cn=Known Pool, cn=10.100.0.0, cn=WV Test, cn=DHCP Service Config, dc=ntelos, dc=net
404+cn: Known Pool
405+objectClass: top
406+objectClass: dhcpPool
407+dhcpRange: 10.100.0.3 10.100.0.254
408+dhcpPermitList: deny unknown-clients
409+
410+# Set up another subnet declaration with a pool statement
411+dn: cn=10.200.0.0, cn=WV Test, cn=DHCP Service Config, dc=ntelos, dc=net
412+cn: 10.200.0.0
413+objectClass: top
414+objectClass: dhcpSubnet
415+objectClass: dhcpOptions
416+dhcpOption: domain-name-servers 10.200.0.2
417+dhcpOption: routers 10.200.0.1
418+dhcpOption: subnet-mask 255.255.255.0
419+dhcpOption: broadcast-address 10.200.0.255
420+dhcpNetMask: 24
421+
422+# Set up a pool for this subnet. Only unknown hosts will get these IPs
423+dn: cn=Known Pool, cn=10.200.0.0, cn=WV Test, cn=DHCP Service Config, dc=ntelos, dc=net
424+cn: Known Pool
425+objectClass: top
426+objectClass: dhcpPool
427+dhcpRange: 10.200.0.3 10.200.0.254
428+dhcpPermitList: deny known clients
429+
430+# Set aside a group for all of our known MAC addresses
431+dn: cn=Customers, cn=DHCP Service Config, dc=ntelos, dc=net
432+objectClass: top
433+objectClass: dhcpGroup
434+cn: Customers
435+
436+# Host entry for my laptop
437+dn: cn=brianlaptop, cn=Customers, cn=DHCP Service Config, dc=ntelos, dc=net
438+objectClass: top
439+objectClass: dhcpHost
440+cn: brianlaptop
441+dhcpHWAddress: ethernet 00:00:00:00:00:00
442+
443+You can use the command slapadd to load all of these entries into your LDAP
444+server. After you load this, you should be able to start up DHCP. If you run
445+into problems reading the configuration, try running dhcpd with the -d flag.
446+If you still have problems, edit the site.conf file in the DHCP source and
447+add the line: COPTS= -DDEBUG_LDAP and recompile DHCP. (make sure you run make
448+clean and rerun configure before you rebuild).
449+
a37573f1
JR		 450diff -Naur dhcp-3.0.5/common/conflex.c dhcp-3.0.5-ldap/common/conflex.c
451--- dhcp-3.0.5/common/conflex.c 2006-02-22 17:43:27.000000000 -0500
452+++ dhcp-3.0.5-ldap/common/conflex.c 2006-12-14 10:03:41.000000000 -0500
3150c1ff 453@@ -47,6 +47,7 @@
1097e9ca 454 static enum dhcp_token read_number PROTO ((int, struct parse *));
455 static enum dhcp_token read_num_or_name PROTO ((int, struct parse *));
f20f83d3 456 static enum dhcp_token intern PROTO ((unsigned char *, enum dhcp_token));
a37573f1 457+static int read_function PROTO ((struct parse *));
1097e9ca 458
459 isc_result_t new_parse (cfile, file, inbuf, buflen, name, eolp)
460 struct parse **cfile;
3150c1ff 461@@ -74,6 +75,10 @@
1097e9ca 462 tmp -> file = file;
463 tmp -> eol_token = eolp;
464
465+ if (file != -1) {
466+ tmp -> read_function = read_function;;
467+ }
468+
469 tmp -> bufix = 0;
470 tmp -> buflen = buflen;
471 if (inbuf) {
a37573f1 472@@ -113,22 +118,11 @@
1097e9ca 473 int c;
474
475 if (cfile -> bufix == cfile -> buflen) {
476- if (cfile -> file != -1) {
477- cfile -> buflen =
478- read (cfile -> file,
479- cfile -> inbuf, cfile -> bufsiz);
480- if (cfile -> buflen == 0) {
481- c = EOF;
482- cfile -> bufix = 0;
483- } else if (cfile -> buflen < 0) {
484- c = EOF;
485- cfile -> bufix = cfile -> buflen = 0;
486- } else {
487- c = cfile -> inbuf [0];
488- cfile -> bufix = 1;
489- }
490- } else
491+ if (cfile -> read_function) {
492+ c = cfile -> read_function (cfile);
493+ } else {
494 c = EOF;
495+ }
496 } else {
497 c = cfile -> inbuf [cfile -> bufix];
498 cfile -> bufix++;
a37573f1 499@@ -1128,3 +1122,25 @@
1097e9ca 500 }
501 return dfv;
502 }
503+
504+
a37573f1 505+static int
1097e9ca 506+read_function (struct parse * cfile)
507+{
a37573f1 508+ int c;
1097e9ca 509+
510+ cfile -> buflen = read (cfile -> file, cfile -> inbuf, cfile -> bufsiz);
511+ if (cfile -> buflen == 0) {
512+ c = EOF;
513+ cfile -> bufix = 0;
514+ } else if (cfile -> buflen < 0) {
515+ c = EOF;
516+ cfile -> bufix = cfile -> buflen = 0;
517+ } else {
518+ c = cfile -> inbuf [0];
519+ cfile -> bufix = 1;
520+ }
521+
522+ return c;
523+}
524+
a37573f1
JR		 525diff -Naur dhcp-3.0.5/common/print.c dhcp-3.0.5-ldap/common/print.c
526--- dhcp-3.0.5/common/print.c 2006-02-22 17:43:27.000000000 -0500
527+++ dhcp-3.0.5-ldap/common/print.c 2006-12-14 10:03:41.000000000 -0500
3150c1ff 528@@ -166,9 +166,9 @@
1097e9ca 529 }
530
531 char *print_hw_addr (htype, hlen, data)
532- int htype;
533- int hlen;
534- unsigned char *data;
535+ const int htype;
536+ const int hlen;
537+ const unsigned char *data;
538 {
539 static char habuf [49];
540 char *s;
a37573f1
JR		 541diff -Naur dhcp-3.0.5/contrib/dhcp.schema dhcp-3.0.5-ldap/contrib/dhcp.schema
542--- dhcp-3.0.5/contrib/dhcp.schema 1969-12-31 19:00:00.000000000 -0500
543+++ dhcp-3.0.5-ldap/contrib/dhcp.schema 2007-02-23 12:53:22.000000000 -0500
544@@ -0,0 +1,462 @@
1097e9ca 545+attributetype ( 2.16.840.1.113719.1.203.4.1
546+ NAME 'dhcpPrimaryDN'
547+ EQUALITY distinguishedNameMatch
548+ DESC 'The DN of the dhcpServer which is the primary server for the configuration.'
549+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
550+
551+attributetype ( 2.16.840.1.113719.1.203.4.2
552+ NAME 'dhcpSecondaryDN'
553+ EQUALITY distinguishedNameMatch
554+ DESC 'The DN of dhcpServer(s) which provide backup service for the configuration.'
555+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
556+
557+attributetype ( 2.16.840.1.113719.1.203.4.3
558+ NAME 'dhcpStatements'
559+ EQUALITY caseIgnoreIA5Match
560+ DESC 'Flexible storage for specific data depending on what object this exists in. Like conditional statements, server parameters, etc. This allows the standard to evolve without needing to adjust the schema.'
561+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
562+
563+attributetype ( 2.16.840.1.113719.1.203.4.4
564+ NAME 'dhcpRange'
565+ EQUALITY caseIgnoreIA5Match
566+ DESC 'The starting & ending IP Addresses in the range (inclusive), separated by a hyphen; if the range only contains one address, then just the address can be specified with no hyphen. Each range is defined as a separate value.'
567+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
568+
569+attributetype ( 2.16.840.1.113719.1.203.4.5
570+ NAME 'dhcpPermitList'
571+ EQUALITY caseIgnoreIA5Match
572+ DESC 'This attribute contains the permit lists associated with a pool. Each permit list is defined as a separate value.'
573+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
574+
575+attributetype ( 2.16.840.1.113719.1.203.4.6
576+ NAME 'dhcpNetMask'
577+ EQUALITY integerMatch
578+ DESC 'The subnet mask length for the subnet. The mask can be easily computed from this length.'
579+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
580+
581+attributetype ( 2.16.840.1.113719.1.203.4.7
582+ NAME 'dhcpOption'
583+ EQUALITY caseIgnoreIA5Match
584+ DESC 'Encoded option values to be sent to clients. Each value represents a single option and contains (OptionTag, Length, OptionValue) encoded in the format used by DHCP.'
585+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
586+
587+attributetype ( 2.16.840.1.113719.1.203.4.8
588+ NAME 'dhcpClassData'
589+ EQUALITY caseIgnoreIA5Match
590+ DESC 'Encoded text string or list of bytes expressed in hexadecimal, separated by colons. Clients match subclasses based on matching the class data with the results of match or spawn with statements in the class name declarations.'
591+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
592+
593+attributetype ( 2.16.840.1.113719.1.203.4.9
594+ NAME 'dhcpOptionsDN'
595+ EQUALITY distinguishedNameMatch
596+ DESC 'The distinguished name(s) of the dhcpOption objects containing the configuration options provided by the server.'
597+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
598+
599+attributetype ( 2.16.840.1.113719.1.203.4.10
600+ NAME 'dhcpHostDN'
601+ EQUALITY distinguishedNameMatch
602+ DESC 'the distinguished name(s) of the dhcpHost objects.'
603+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
604+
605+attributetype ( 2.16.840.1.113719.1.203.4.11
606+ NAME 'dhcpPoolDN'
607+ EQUALITY distinguishedNameMatch
608+ DESC 'The distinguished name(s) of pools.'
609+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
610+
611+attributetype ( 2.16.840.1.113719.1.203.4.12
612+ NAME 'dhcpGroupDN'
613+ EQUALITY distinguishedNameMatch
614+ DESC 'The distinguished name(s) of the groups.'
615+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
616+
617+attributetype ( 2.16.840.1.113719.1.203.4.13
618+ NAME 'dhcpSubnetDN'
619+ EQUALITY distinguishedNameMatch
620+ DESC 'The distinguished name(s) of the subnets.'
621+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
622+
623+attributetype ( 2.16.840.1.113719.1.203.4.14
624+ NAME 'dhcpLeaseDN'
625+ EQUALITY distinguishedNameMatch
626+ DESC 'The distinguished name of a client address.'
627+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE)
628+
a37573f1
JR		 629+attributetype ( 2.16.840.1.113719.1.203.4.15
630+ NAME 'dhcpLeasesDN'
1097e9ca 631+ DESC 'The distinguished name(s) client addresses.'
632+ EQUALITY distinguishedNameMatch
633+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
634+
635+attributetype ( 2.16.840.1.113719.1.203.4.16
636+ NAME 'dhcpClassesDN'
637+ EQUALITY distinguishedNameMatch
638+ DESC 'The distinguished name(s) of a class(es) in a subclass.'
639+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
640+
641+attributetype ( 2.16.840.1.113719.1.203.4.17
642+ NAME 'dhcpSubclassesDN'
643+ EQUALITY distinguishedNameMatch
644+ DESC 'The distinguished name(s) of subclass(es).'
645+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
646+
647+attributetype ( 2.16.840.1.113719.1.203.4.18
648+ NAME 'dhcpSharedNetworkDN'
649+ EQUALITY distinguishedNameMatch
650+ DESC 'The distinguished name(s) of sharedNetworks.'
651+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
652+
653+attributetype ( 2.16.840.1.113719.1.203.4.19
654+ NAME 'dhcpServiceDN'
655+ EQUALITY distinguishedNameMatch
656+ DESC 'The DN of dhcpService object(s)which contain the configuration information. Each dhcpServer object has this attribute identifying the DHCP configuration(s) that the server is associated with.'
657+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
658+
659+attributetype ( 2.16.840.1.113719.1.203.4.20
a37573f1
JR		 660+ NAME 'dhcpVersion'
661+ DESC 'The version attribute of this object.'
1097e9ca 662+ EQUALITY caseIgnoreIA5Match
663+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
664+
665+attributetype ( 2.16.840.1.113719.1.203.4.21
666+ NAME 'dhcpImplementation'
667+ EQUALITY caseIgnoreIA5Match
668+ DESC 'Description of the DHCP Server implementation e.g. DHCP Servers vendor.'
669+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
670+
671+attributetype ( 2.16.840.1.113719.1.203.4.22
672+ NAME 'dhcpAddressState'
673+ EQUALITY caseIgnoreIA5Match
674+ DESC 'This stores information about the current binding-status of an address. For dynamic addresses managed by DHCP, the values should be restricted to the following: "FREE", "ACTIVE", "EXPIRED", "RELEASED", "RESET", "ABANDONED", "BACKUP". For other addresses, it SHOULD be one of the following: "UNKNOWN", "RESERVED" (an address that is managed by DHCP that is reserved for a specific client), "RESERVED-ACTIVE" (same as reserved, but address is currently in use), "ASSIGNED" (assigned manually or by some other mechanism), "UNASSIGNED", "NOTASSIGNABLE".'
675+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
676+
677+attributetype ( 2.16.840.1.113719.1.203.4.23
678+ NAME 'dhcpExpirationTime'
679+ EQUALITY generalizedTimeMatch
680+ DESC 'This is the time the current lease for an address expires.'
681+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
682+
683+attributetype ( 2.16.840.1.113719.1.203.4.24
684+ NAME 'dhcpStartTimeOfState'
685+ EQUALITY generalizedTimeMatch
686+ DESC 'This is the time of the last state change for a leased address.'
687+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
688+
689+attributetype ( 2.16.840.1.113719.1.203.4.25
690+ NAME 'dhcpLastTransactionTime'
691+ EQUALITY generalizedTimeMatch
692+ DESC 'This is the last time a valid DHCP packet was received from the client.'
693+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
694+
695+attributetype ( 2.16.840.1.113719.1.203.4.26
696+ NAME 'dhcpBootpFlag'
697+ EQUALITY booleanMatch
698+ DESC 'This indicates whether the address was assigned via BOOTP.'
699+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
700+
701+attributetype ( 2.16.840.1.113719.1.203.4.27
702+ NAME 'dhcpDomainName'
703+ EQUALITY caseIgnoreIA5Match
704+ DESC 'This is the name of the domain sent to the client by the server. It is essentially the same as the value for DHCP option 15 sent to the client, and represents only the domain - not the full FQDN. To obtain the full FQDN assigned to the client you must prepend the "dhcpAssignedHostName" to this value with a ".".'
705+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
706+
707+attributetype ( 2.16.840.1.113719.1.203.4.28
708+ NAME 'dhcpDnsStatus'
709+ EQUALITY integerMatch
710+ DESC 'This indicates the status of updating DNS resource records on behalf of the client by the DHCP server for this address. The value is a 16-bit bitmask.'
711+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
712+
713+attributetype ( 2.16.840.1.113719.1.203.4.29
714+ NAME 'dhcpRequestedHostName'
715+ EQUALITY caseIgnoreIA5Match
716+ DESC 'This is the hostname that was requested by the client.'
717+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
718+
719+attributetype ( 2.16.840.1.113719.1.203.4.30
720+ NAME 'dhcpAssignedHostName'
721+ EQUALITY caseIgnoreIA5Match
722+ DESC 'This is the actual hostname that was assigned to a client. It may not be the name that was requested by the client. The fully qualified domain name can be determined by appending the value of "dhcpDomainName" (with a dot separator) to this name.'
723+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
724+
725+attributetype ( 2.16.840.1.113719.1.203.4.31
726+ NAME 'dhcpReservedForClient'
727+ EQUALITY distinguishedNameMatch
728+ DESC 'The distinguished name of a "dhcpClient" that an address is reserved for. This may not be the same as the "dhcpAssignedToClient" attribute if the address is being reassigned but the current lease has not yet expired.'
729+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
730+
731+attributetype ( 2.16.840.1.113719.1.203.4.32
732+ NAME 'dhcpAssignedToClient'
733+ EQUALITY distinguishedNameMatch
734+ DESC 'This is the distinguished name of a "dhcpClient" that an address is currently assigned to. This attribute is only present in the class when the address is leased.'
735+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
736+
737+attributetype ( 2.16.840.1.113719.1.203.4.33
738+ NAME 'dhcpRelayAgentInfo'
739+ EQUALITY octetStringMatch
740+ DESC 'If the client request was received via a relay agent, this contains information about the relay agent that was available from the DHCP request. This is a hex-encoded option value.'
741+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
742+
743+attributetype ( 2.16.840.1.113719.1.203.4.34
744+ NAME 'dhcpHWAddress'
a37573f1 745+ EQUALITY caseIgnoreIA5Match
1097e9ca 746+ DESC 'The clients hardware address that requested this IP address.'
a37573f1 747+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
1097e9ca 748+
749+attributetype ( 2.16.840.1.113719.1.203.4.35
750+ NAME 'dhcpHashBucketAssignment'
751+ EQUALITY octetStringMatch
752+ DESC 'HashBucketAssignment bit map for the DHCP Server, as defined in DHC Load Balancing Algorithm [RFC 3074].'
753+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
754+
755+attributetype ( 2.16.840.1.113719.1.203.4.36
756+ NAME 'dhcpDelayedServiceParameter'
757+ EQUALITY integerMatch
758+ DESC 'Delay in seconds corresponding to Delayed Service Parameter configuration, as defined in DHC Load Balancing Algorithm [RFC 3074]. '
759+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
760+
761+attributetype ( 2.16.840.1.113719.1.203.4.37
762+ NAME 'dhcpMaxClientLeadTime'
763+ EQUALITY integerMatch
764+ DESC 'Maximum Client Lead Time configuration in seconds, as defined in DHCP Failover Protocol [FAILOVR]'
765+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
766+
767+attributetype ( 2.16.840.1.113719.1.203.4.38
768+ NAME 'dhcpFailOverEndpointState'
769+ EQUALITY caseIgnoreIA5Match
770+ DESC 'Server (Failover Endpoint) state, as defined in DHCP Failover Protocol [FAILOVR]'
771+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
772+
773+attributetype ( 2.16.840.1.113719.1.203.4.39
774+ NAME 'dhcpErrorLog'
775+ EQUALITY caseIgnoreIA5Match
776+ DESC 'Generic error log attribute that allows logging error conditions within a dhcpService or a dhcpSubnet, like no IP addresses available for lease.'
777+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
778+
a37573f1
JR		 779+attributetype ( 2.16.840.1.113719.1.203.4.40
780+ NAME 'dhcpLocatorDN'
781+ EQUALITY distinguishedNameMatch
782+ DESC 'The DN of dhcpLocator object which contain the DNs of all DHCP configuration objects. There will be a single dhcpLocator object in the tree with links to all the DHCP objects in the tree'
783+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
784+
785+attributetype ( 2.16.840.1.113719.1.203.4.41
786+ NAME 'dhcpKeyAlgorithm'
787+ EQUALITY caseIgnoreIA5Match
788+ DESC 'Algorithm to generate TSIG Key'
789+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
790+
791+attributetype ( 2.16.840.1.113719.1.203.4.42
792+ NAME 'dhcpKeySecret'
793+ EQUALITY octetStringMatch
794+ DESC 'Secret to generate TSIG Key' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
795+
796+attributetype ( 2.16.840.1.113719.1.203.4.43
797+ NAME 'dhcpDnsZoneServer'
798+ EQUALITY caseIgnoreIA5Match
799+ DESC 'Master server of the DNS Zone'
800+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
801+
802+attributetype ( 2.16.840.1.113719.1.203.4.44
803+ NAME 'dhcpKeyDN'
804+ EQUALITY distinguishedNameMatch
805+ DESC 'The DNs of TSIG Key to use in secure dynamic updates. In case of locator object, this will be list of TSIG keys. In case of DHCP Service, Shared Network, Subnet and DNS Zone, it will be a single key.'
806+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
807+
808+attributetype ( 2.16.840.1.113719.1.203.4.45
809+ NAME 'dhcpZoneDN'
810+ EQUALITY distinguishedNameMatch
811+ DESC 'The DNs of DNS Zone. In case of locator object, this will be list of DNS Zones in the tree. In case of DHCP Service, Shared Network and Subnet, it will be a single DNS Zone.'
812+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12)
813+
814+attributetype ( 2.16.840.1.113719.1.203.4.46
815+ NAME 'dhcpFailOverPrimaryServer'
816+ EQUALITY caseIgnoreIA5Match
817+ DESC 'IP address or DNS name of the server playing primary role in DHC Load Balancing and Fail over.'
818+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
819+
820+attributetype ( 2.16.840.1.113719.1.203.4.47
821+ NAME 'dhcpFailOverSecondaryServer'
822+ EQUALITY caseIgnoreIA5Match
823+ DESC 'IP address or DNS name of the server playing secondary role in DHC Load Balancing and Fail over.'
824+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
825+
826+attributetype ( 2.16.840.1.113719.1.203.4.48
827+ NAME 'dhcpFailOverPrimaryPort'
828+ EQUALITY integerMatch
829+ DESC 'Port on which primary server listens for connections from its fail over peer (secondary server)'
830+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
831+
832+attributetype ( 2.16.840.1.113719.1.203.4.49
833+ NAME 'dhcpFailOverSecondaryPort'
834+ EQUALITY integerMatch
835+ DESC 'Port on which secondary server listens for connections from its fail over peer (primary server)'
836+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
837+
838+attributetype ( 2.16.840.1.113719.1.203.4.50
839+ NAME 'dhcpFailOverResponseDelay'
840+ EQUALITY integerMatch
841+ DESC 'Maximum response time in seconds, before Server assumes that connection to fail over peer has failed'
842+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
843+
844+attributetype ( 2.16.840.1.113719.1.203.4.51
845+ NAME 'dhcpFailOverUnackedUpdates'
846+ EQUALITY integerMatch
847+ DESC 'Number of BNDUPD messages that server can send before it receives BNDACK from its fail over peer'
848+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
849+
850+attributetype ( 2.16.840.1.113719.1.203.4.52
851+ NAME 'dhcpFailOverSplit'
852+ EQUALITY integerMatch
853+ DESC 'Split between the primary and secondary servers for fail over purpose'
854+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
855+
856+attributetype ( 2.16.840.1.113719.1.203.4.53
857+ NAME 'dhcpFailOverLoadBalanceTime'
858+ EQUALITY integerMatch
859+ DESC 'Cutoff time in seconds, after which load balance is disabled'
860+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
861+
862+attributetype ( 2.16.840.1.113719.1.203.4.54
863+ NAME 'dhcpFailOverPeerDN'
864+ EQUALITY distinguishedNameMatch
865+ DESC 'The DNs of Fail over peers. In case of locator object, this will be list of fail over peers in the tree. In case of Subnet and pool, it will be a single Fail Over Peer'
866+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
867+
868+#List of all servers in the tree
869+attributetype ( 2.16.840.1.113719.1.203.4.55
870+ NAME 'dhcpServerDN'
871+ EQUALITY distinguishedNameMatch
872+ DESC 'List of all DHCP Servers in the tree. Used by dhcpLocatorObject'
873+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
874+
875+attributetype ( 2.16.840.1.113719.1.203.4.56
876+ NAME 'dhcpComments'
877+ EQUALITY caseIgnoreIA5Match
878+ DESC 'Generic attribute that allows coments within any DHCP object'
879+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
880+
1097e9ca 881+# Classes
882+
883+objectclass ( 2.16.840.1.113719.1.203.6.1
884+ NAME 'dhcpService'
885+ DESC 'Service object that represents the actual DHCP Service configuration. This is a container object.'
886+ SUP top
a37573f1
JR		 887+ MUST (cn)
888+ MAY ( dhcpPrimaryDN $ dhcpSecondaryDN $ dhcpServerDN $ dhcpSharedNetworkDN $ dhcpSubnetDN $ dhcpGroupDN $ dhcpHostDN $ dhcpClassesDN $ dhcpOptionsDN $ dhcpZoneDN $ dhcpKeyDN $ dhcpFailOverPeerDN $ dhcpStatements $dhcpComments $ dhcpOption) )
1097e9ca 889+
890+objectclass ( 2.16.840.1.113719.1.203.6.2
891+ NAME 'dhcpSharedNetwork'
892+ DESC 'This stores configuration information for a shared network.'
893+ SUP top
894+ MUST cn
a37573f1 895+ MAY ( dhcpSubnetDN $ dhcpPoolDN $ dhcpOptionsDN $ dhcpZoneDN $ dhcpStatements $dhcpComments $ dhcpOption) X-NDS_CONTAINMENT ('dhcpService' ) )
1097e9ca 896+
897+objectclass ( 2.16.840.1.113719.1.203.6.3
898+ NAME 'dhcpSubnet'
899+ DESC 'This class defines a subnet. This is a container object.'
900+ SUP top
901+ MUST ( cn $ dhcpNetMask )
a37573f1 902+ MAY ( dhcpRange $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostDN $ dhcpClassesDN $ dhcpLeasesDN $ dhcpOptionsDN $ dhcpZoneDN $ dhcpKeyDN $ dhcpFailOverPeerDN $ dhcpStatements $ dhcpComments $ dhcpOption ) X-NDS_CONTAINMENT ('dhcpService' 'dhcpSharedNetwork') )
1097e9ca 903+
904+objectclass ( 2.16.840.1.113719.1.203.6.4
905+ NAME 'dhcpPool'
906+ DESC 'This stores configuration information about a pool.'
907+ SUP top
908+ MUST ( cn $ dhcpRange )
a37573f1 909+ MAY ( dhcpClassesDN $ dhcpPermitList $ dhcpLeasesDN $ dhcpOptionsDN $ dhcpZoneDN $dhcpKeyDN $ dhcpStatements $ dhcpComments $ dhcpOption )
1097e9ca 910+ X-NDS_CONTAINMENT ('dhcpSubnet' 'dhcpSharedNetwork') )
911+
912+objectclass ( 2.16.840.1.113719.1.203.6.5
913+ NAME 'dhcpGroup'
914+ DESC 'Group object that lists host DNs and parameters. This is a container object.'
915+ SUP top
916+ MUST cn
a37573f1 917+ MAY ( dhcpHostDN $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption )
1097e9ca 918+ X-NDS_CONTAINMENT ('dhcpSubnet' 'dhcpService' ) )
919+
920+objectclass ( 2.16.840.1.113719.1.203.6.6
921+ NAME 'dhcpHost'
922+ DESC 'This represents information about a particular client'
923+ SUP top
924+ MUST cn
a37573f1 925+ MAY (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
1097e9ca 926+ X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
927+
928+objectclass ( 2.16.840.1.113719.1.203.6.7
929+ NAME 'dhcpClass'
930+ DESC 'Represents information about a collection of related clients.'
931+ SUP top
932+ MUST cn
a37573f1 933+ MAY (dhcpSubClassesDN $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
1097e9ca 934+ X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' ) )
935+
936+objectclass ( 2.16.840.1.113719.1.203.6.8
937+ NAME 'dhcpSubClass'
938+ DESC 'Represents information about a collection of related classes.'
939+ SUP top
940+ MUST cn
a37573f1 941+ MAY (dhcpClassData $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption) X-NDS_CONTAINMENT 'dhcpClass' )
1097e9ca 942+
943+objectclass ( 2.16.840.1.113719.1.203.6.9
944+ NAME 'dhcpOptions'
945+ DESC 'Represents information about a collection of options defined.'
946+ SUP top AUXILIARY
947+ MUST cn
a37573f1
JR		 948+ MAY ( dhcpOption $ dhcpComments )
949+ X-NDS_CONTAINMENT ('dhcpService' 'dhcpSharedNetwork' 'dhcpSubnet' 'dhcpPool' 'dhcpGroup' 'dhcpHost' 'dhcpClass' ) )
1097e9ca 950+
951+objectclass ( 2.16.840.1.113719.1.203.6.10
952+ NAME 'dhcpLeases'
953+ DESC 'This class represents an IP Address, which may or may not have been leased.'
954+ SUP top
955+ MUST ( cn $ dhcpAddressState )
a37573f1 956+ MAY ( dhcpExpirationTime $ dhcpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName $ dhcpDnsStatus $ dhcpRequestedHostName $ dhcpAssignedHostName $ dhcpReservedForClient $ dhcpAssignedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress )
1097e9ca 957+ X-NDS_CONTAINMENT ( 'dhcpService' 'dhcpSubnet' 'dhcpPool') )
958+
959+objectclass ( 2.16.840.1.113719.1.203.6.11
960+ NAME 'dhcpLog'
961+ DESC 'This is the object that holds past information about the IP address. The cn is the time/date stamp when the address was assigned or released, the address state at the time, if the address was assigned or released.'
962+ SUP top
963+ MUST ( cn )
a37573f1
JR		 964+ MAY ( dhcpAddressState $ dhcpExpirationTime $ dhcpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $ dhcpDomainName $ dhcpDnsStatus $ dhcpRequestedHostName $ dhcpAssignedHostName $ dhcpReservedForClient $ dhcpAssignedToClient $ dhcpRelayAgentInfo $ dhcpHWAddress $ dhcpErrorLog)
965+ X-NDS_CONTAINMENT ('dhcpLeases' 'dhcpPool' 'dhcpSubnet' 'dhcpSharedNetwork' 'dhcpService' ) )
1097e9ca 966+
967+objectclass ( 2.16.840.1.113719.1.203.6.12
968+ NAME 'dhcpServer'
969+ DESC 'DHCP Server Object'
970+ SUP top
a37573f1
JR		 971+ MUST ( cn )
972+ MAY (dhcpServiceDN $ dhcpLocatorDN $ dhcpVersion $ dhcpImplementation $ dhcpHashBucketAssignment $ dhcpDelayedServiceParameter $ dhcpMaxClientLeadTime $ dhcpFailOverEndpointState $ dhcpStatements $ dhcpComments $ dhcpOption)
973+ X-NDS_CONTAINMENT ('organization' 'organizationalunit' 'domain') )
974+
975+objectclass ( 2.16.840.1.113719.1.203.6.13
976+ NAME 'dhcpTSigKey'
977+ DESC 'TSIG key for secure dynamic updates'
978+ SUP top
979+ MUST (cn $ dhcpKeyAlgorithm $ dhcpKeySecret )
980+ MAY ( dhcpComments )
981+ X-NDS_CONTAINMENT ('dhcpService' 'dhcpSharedNetwork' 'dhcpSubnet') )
982+
983+objectclass ( 2.16.840.1.113719.1.203.6.14
984+ NAME 'dhcpDnsZone'
985+ DESC 'DNS Zone for updating leases'
986+ SUP top
987+ MUST (cn $ dhcpDnsZoneServer )
988+ MAY (dhcpKeyDN $ dhcpComments)
989+ X-NDS_CONTAINMENT ('dhcpService' 'dhcpSharedNetwork' 'dhcpSubnet') )
990+
991+objectclass ( 2.16.840.1.113719.1.203.6.15
992+ NAME 'dhcpFailOverPeer'
993+ DESC 'This class defines the Fail over peer'
994+ SUP top
995+ MUST ( cn $ dhcpFailOverPrimaryServer $ dhcpFailOverSecondaryServer $ dhcpFailoverPrimaryPort $ dhcpFailOverSecondaryPort) MAY (dhcpFailOverResponseDelay $ dhcpFailOverUnackedUpdates $ dhcpMaxClientLeadTime $ dhcpFailOverSplit $ dhcpHashBucketAssignment $ dhcpFailOverLoadBalanceTime $ dhcpComments )
996+ X-NDS_CONTAINMENT ('dhcpService' 'dhcpSharedNetwork' 'dhcpSubnet') )
997+
998+objectclass ( 2.16.840.1.113719.1.203.6.16
999+ NAME 'dhcpLocator'
1000+ DESC 'Locator object for DHCP configuration in the tree. There will be a single dhcpLocator object in the tree with links to all the DHCP objects in the tree'
1001+ SUP top
1002+ MUST ( cn )
1003+ MAY ( dhcpServiceDN $dhcpServerDN $ dhcpSharedNetworkDN $ dhcpSubnetDN $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostDN $ dhcpClassesDN $ dhcpKeyDN $ dhcpZoneDN $ dhcpFailOverPeerDN $ dhcpOption $ dhcpComments)
1004+ X-NDS_CONTAINMENT ('organization' 'organizationalunit' 'domain') )
1005+
1006+
1007diff -Naur dhcp-3.0.5/contrib/dhcpd-conf-to-ldap.pl dhcp-3.0.5-ldap/contrib/dhcpd-conf-to-ldap.pl
1008--- dhcp-3.0.5/contrib/dhcpd-conf-to-ldap.pl 1969-12-31 19:00:00.000000000 -0500
1009+++ dhcp-3.0.5-ldap/contrib/dhcpd-conf-to-ldap.pl 2007-02-23 14:01:43.000000000 -0500
1010@@ -0,0 +1,760 @@
1097e9ca 1011+#!/usr/bin/perl -w
1012+
1013+# Brian Masney <masneyb@ntelos.net>
1014+# To use this script, set your base DN below. Then run
1015+# ./dhcpd-conf-to-ldap.pl < /path-to-dhcpd-conf/dhcpd.conf > output-file
1016+# The output of this script will generate entries in LDIF format. You can use
1017+# the slapadd command to add these entries into your LDAP server. You will
1018+# definately want to double check that your LDAP entries are correct before
1019+# you load them into LDAP.
1020+
1021+# This script does not do much error checking. Make sure before you run this
1022+# that the DHCP server doesn't give any errors about your config file
1023+
3150c1ff 1024+# FailOver notes:
1025+# Failover is disabled by default, since it may need manually intervention.
1026+# You can try the '--use=failover' option to see what happens :-)
1027+#
1028+# If enabled, the failover pool references will be written to LDIF output.
1029+# The failover configs itself will be added to the dhcpServer statements
1030+# and not to the dhcpService object (since this script uses only one and
1031+# it may be usefull to have multiple service containers in failover mode).
1032+# Further, this script does not check if primary or secondary makes sense,
1033+# it simply converts what it gets...
1034+
1097e9ca 1035+use Net::Domain qw(hostname hostfqdn hostdomain);
1036+use Getopt::Long;
1037+
1038+my $domain = hostdomain(); # your.domain
1039+my $basedn = "dc=".$domain;
1040+ $basedn =~ s/\./,dc=/g; # dc=your,dc=domain
1041+my $server = hostname(); # hostname (nodename)
1042+my $dhcpcn = 'DHCP Config'; # CN of DHCP config tree
1043+my $dhcpdn = "cn=$dhcpcn, $basedn"; # DHCP config tree DN
3150c1ff 1044+my $second = ''; # secondary server DN / hostname
1045+my $i_conf = ''; # dhcp.conf file to read or stdin
1046+my $o_ldif = ''; # output ldif file name or stdout
1047+my @use = (); # extended flags (failover)
1097e9ca 1048+
1049+sub usage($;$)
1050+{
1051+ my $rc = shift;
1052+ my $err= shift;
1053+
1054+ print STDERR "Error: $err\n\n" if(defined $err);
1055+ print STDERR <<__EOF_USAGE__;
1056+usage:
1057+ $0 [options] < dhcpd.conf > dhcpd.ldif
1058+
1059+options:
1060+
3150c1ff 1061+ --basedn "dc=your,dc=domain" ("$basedn")
1097e9ca 1062+
3150c1ff 1063+ --dhcpdn "dhcp config DN" ("$dhcpdn")
1097e9ca 1064+
3150c1ff 1065+ --server "dhcp server name" ("$server")
1097e9ca 1066+
3150c1ff 1067+ --second "secondary server or DN" ("$second")
1068+
1069+ --conf "/path/to/dhcpd.conf" (default is stdin)
1070+ --ldif "/path/to/output.ldif" (default is stdout)
1071+
1072+ --use "extended features" (see source comments)
1097e9ca 1073+__EOF_USAGE__
1074+ exit($rc);
1075+}
1076+
1077+
1078+sub next_token
1079+{
1080+ local ($lowercase) = @_;
1081+ local ($token, $newline);
1082+
1083+ do
1084+ {
1085+ if (!defined ($line) || length ($line) == 0)
1086+ {
1087+ $line = <>;
1088+ return undef if !defined ($line);
1089+ chop $line;
1090+ $line_number++;
1091+ $token_number = 0;
1092+ }
1093+
1094+ $line =~ s/#.*//;
1095+ $line =~ s/^\s+//;
1096+ $line =~ s/\s+$//;
1097+ }
1098+ while (length ($line) == 0);
1099+
1100+ if (($token, $newline) = $line =~ /^(.*?)\s+(.*)/)
1101+ {
a37573f1
JR		 1102+ if ($token =~ /^"/) {
1103+ #handle quoted token
1104+ if ($token !~ /"\s*$/)
1105+ {
1106+ ($tok, $newline) = $newline =~ /([^"]+")(.*)/;
1107+ $token .= " $tok";
1108+ }
1109+ }
1097e9ca 1110+ $line = $newline;
1111+ }
1112+ else
1113+ {
1114+ $token = $line;
1115+ $line = '';
1116+ }
1117+ $token_number++;
1118+
1119+ $token =~ y/[A-Z]/[a-z]/ if $lowercase;
1120+
1121+ return ($token);
1122+}
1123+
1124+
1125+sub remaining_line
1126+{
3150c1ff 1127+ local ($block) = shift || 0;
1097e9ca 1128+ local ($tmp, $str);
1129+
1130+ $str = "";
3150c1ff 1131+ while (defined($tmp = next_token (0)))
1097e9ca 1132+ {
1133+ $str .= ' ' if !($str eq "");
1134+ $str .= $tmp;
1135+ last if $tmp =~ /;\s*$/;
3150c1ff 1136+ last if($block and $tmp =~ /\s*[}{]\s*$/);
1097e9ca 1137+ }
1138+
1139+ $str =~ s/;$//;
1140+ return ($str);
1141+}
1142+
1143+
1144+sub
1145+add_dn_to_stack
1146+{
1147+ local ($dn) = @_;
1148+
1149+ $current_dn = "$dn, $current_dn";
1150+}
1151+
1152+
1153+sub
1154+remove_dn_from_stack
1155+{
1156+ $current_dn =~ s/^.*?,\s*//;
1157+}
1158+
1159+
1160+sub
1161+parse_error
1162+{
1163+ print "Parse error on line number $line_number at token number $token_number\n";
1164+ exit (1);
1165+}
1166+
1167+
1168+sub
1169+print_entry
1170+{
1171+ return if (scalar keys %curentry == 0);
1172+
1173+ if (!defined ($curentry{'type'}))
1174+ {
1175+ $hostdn = "cn=$server, $basedn";
1176+ print "dn: $hostdn\n";
3150c1ff 1177+ print "cn: $server\n";
1097e9ca 1178+ print "objectClass: top\n";
1179+ print "objectClass: dhcpServer\n";
3150c1ff 1180+ print "dhcpServiceDN: $current_dn\n";
1181+ if(grep(/FaIlOvEr/i, @use))
1182+ {
1183+ foreach my $fo_peer (keys %failover)
1184+ {
1185+ next if(scalar(@{$failover{$fo_peer}}) <= 1);
1186+ print "dhcpStatements: failover peer $fo_peer { ",
1187+ join('; ', @{$failover{$fo_peer}}), "; }\n";
1188+ }
1189+ }
1190+ print "\n";
1097e9ca 1191+
1192+ print "dn: $current_dn\n";
1193+ print "cn: $dhcpcn\n";
1194+ print "objectClass: top\n";
1195+ print "objectClass: dhcpService\n";
1196+ if (defined ($curentry{'options'}))
1197+ {
1198+ print "objectClass: dhcpOptions\n";
1199+ }
1200+ print "dhcpPrimaryDN: $hostdn\n";
3150c1ff 1201+ if(grep(/FaIlOvEr/i, @use) and ($second ne ''))
1202+ {
1203+ print "dhcpSecondaryDN: $second\n";
1204+ }
1097e9ca 1205+ }
1206+ elsif ($curentry{'type'} eq 'subnet')
1207+ {
1208+ print "dn: $current_dn\n";
1209+ print "cn: " . $curentry{'ip'} . "\n";
1210+ print "objectClass: top\n";
1211+ print "objectClass: dhcpSubnet\n";
1212+ if (defined ($curentry{'options'}))
1213+ {
1214+ print "objectClass: dhcpOptions\n";
1215+ }
1216+
1217+ print "dhcpNetMask: " . $curentry{'netmask'} . "\n";
3150c1ff 1218+ if (defined ($curentry{'ranges'}))
1097e9ca 1219+ {
3150c1ff 1220+ foreach $statement (@{$curentry{'ranges'}})
1221+ {
1222+ print "dhcpRange: $statement\n";
1223+ }
1097e9ca 1224+ }
1225+ }
1226+ elsif ($curentry{'type'} eq 'shared-network')
1227+ {
1228+ print "dn: $current_dn\n";
1229+ print "cn: " . $curentry{'descr'} . "\n";
1230+ print "objectClass: top\n";
1231+ print "objectClass: dhcpSharedNetwork\n";
1232+ if (defined ($curentry{'options'}))
1233+ {
1234+ print "objectClass: dhcpOptions\n";
1235+ }
1236+ }
1237+ elsif ($curentry{'type'} eq 'group')
1238+ {
1239+ print "dn: $current_dn\n";
1240+ print "cn: group", $curentry{'idx'}, "\n";
1241+ print "objectClass: top\n";
1242+ print "objectClass: dhcpGroup\n";
1243+ if (defined ($curentry{'options'}))
1244+ {
1245+ print "objectClass: dhcpOptions\n";
1246+ }
1247+ }
1248+ elsif ($curentry{'type'} eq 'host')
1249+ {
1250+ print "dn: $current_dn\n";
1251+ print "cn: " . $curentry{'host'} . "\n";
1252+ print "objectClass: top\n";
1253+ print "objectClass: dhcpHost\n";
1254+ if (defined ($curentry{'options'}))
1255+ {
1256+ print "objectClass: dhcpOptions\n";
1257+ }
1258+
1259+ if (defined ($curentry{'hwaddress'}))
1260+ {
a37573f1 1261+ $curentry{'hwaddress'} =~ y/[A-Z]/[a-z]/;
1097e9ca 1262+ print "dhcpHWAddress: " . $curentry{'hwaddress'} . "\n";
1263+ }
1264+ }
1265+ elsif ($curentry{'type'} eq 'pool')
1266+ {
1267+ print "dn: $current_dn\n";
1268+ print "cn: pool", $curentry{'idx'}, "\n";
1269+ print "objectClass: top\n";
1270+ print "objectClass: dhcpPool\n";
1271+ if (defined ($curentry{'options'}))
1272+ {
1273+ print "objectClass: dhcpOptions\n";
1274+ }
1275+
3150c1ff 1276+ if (defined ($curentry{'ranges'}))
1097e9ca 1277+ {
3150c1ff 1278+ foreach $statement (@{$curentry{'ranges'}})
1279+ {
1280+ print "dhcpRange: $statement\n";
1281+ }
1097e9ca 1282+ }
1283+ }
1284+ elsif ($curentry{'type'} eq 'class')
1285+ {
1286+ print "dn: $current_dn\n";
1287+ print "cn: " . $curentry{'class'} . "\n";
1288+ print "objectClass: top\n";
1289+ print "objectClass: dhcpClass\n";
1290+ if (defined ($curentry{'options'}))
1291+ {
1292+ print "objectClass: dhcpOptions\n";
1293+ }
1294+ }
1295+ elsif ($curentry{'type'} eq 'subclass')
1296+ {
1297+ print "dn: $current_dn\n";
1298+ print "cn: " . $curentry{'subclass'} . "\n";
1299+ print "objectClass: top\n";
1300+ print "objectClass: dhcpSubClass\n";
1301+ if (defined ($curentry{'options'}))
1302+ {
1303+ print "objectClass: dhcpOptions\n";
1304+ }
1305+ print "dhcpClassData: " . $curentry{'class'} . "\n";
1306+ }
1307+
1308+ if (defined ($curentry{'statements'}))
1309+ {
1310+ foreach $statement (@{$curentry{'statements'}})
1311+ {
1312+ print "dhcpStatements: $statement\n";
1313+ }
1314+ }
1315+
1316+ if (defined ($curentry{'options'}))
1317+ {
1318+ foreach $statement (@{$curentry{'options'}})
1319+ {
1320+ print "dhcpOption: $statement\n";
1321+ }
1322+ }
1323+
1324+ print "\n";
1325+ undef (%curentry);
1326+}
1327+
1328+
1329+sub parse_netmask
1330+{
1331+ local ($netmask) = @_;
1332+ local ($i);
1333+
1334+ if ((($a, $b, $c, $d) = $netmask =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/) != 4)
1335+ {
1336+ parse_error ();
1337+ }
1338+
1339+ $num = (($a & 0xff) << 24) |
1340+ (($b & 0xff) << 16) |
1341+ (($c & 0xff) << 8) |
1342+ ($d & 0xff);
1343+
1344+ for ($i=1; $i<=32 && $num & (1 << (32 - $i)); $i++)
1345+ {
1346+ }
1347+ $i--;
1348+
1349+ return ($i);
1350+}
1351+
1352+
1353+sub parse_subnet
1354+{
1355+ local ($ip, $tmp, $netmask);
1356+
1357+ print_entry () if %curentry;
1358+
1359+ $ip = next_token (0);
1360+ parse_error () if !defined ($ip);
1361+
1362+ $tmp = next_token (1);
1363+ parse_error () if !defined ($tmp);
1364+ parse_error () if !($tmp eq 'netmask');
1365+
1366+ $tmp = next_token (0);
1367+ parse_error () if !defined ($tmp);
1368+ $netmask = parse_netmask ($tmp);
1369+
1370+ $tmp = next_token (0);
1371+ parse_error () if !defined ($tmp);
1372+ parse_error () if !($tmp eq '{');
1373+
1374+ add_dn_to_stack ("cn=$ip");
1375+ $curentry{'type'} = 'subnet';
1376+ $curentry{'ip'} = $ip;
1377+ $curentry{'netmask'} = $netmask;
1378+ $cursubnet = $ip;
1379+ $curcounter{$ip} = { pool => 0, group => 0 };
1380+}
1381+
1382+
1383+sub parse_shared_network
1384+{
1385+ local ($descr, $tmp);
1386+
1387+ print_entry () if %curentry;
1388+
1389+ $descr = next_token (0);
1390+ parse_error () if !defined ($descr);
1391+
1392+ $tmp = next_token (0);
1393+ parse_error () if !defined ($tmp);
1394+ parse_error () if !($tmp eq '{');
1395+
1396+ add_dn_to_stack ("cn=$descr");
1397+ $curentry{'type'} = 'shared-network';
1398+ $curentry{'descr'} = $descr;
1399+}
1400+
1401+
1402+sub parse_host
1403+{
1404+ local ($descr, $tmp);
1405+
1406+ print_entry () if %curentry;
1407+
1408+ $host = next_token (0);
1409+ parse_error () if !defined ($host);
1410+
1411+ $tmp = next_token (0);
1412+ parse_error () if !defined ($tmp);
1413+ parse_error () if !($tmp eq '{');
1414+
1415+ add_dn_to_stack ("cn=$host");
1416+ $curentry{'type'} = 'host';
1417+ $curentry{'host'} = $host;
1418+}
1419+
1420+
1421+sub parse_group
1422+{
1423+ local ($descr, $tmp);
1424+
1425+ print_entry () if %curentry;
1426+
1427+ $tmp = next_token (0);
1428+ parse_error () if !defined ($tmp);
1429+ parse_error () if !($tmp eq '{');
1430+
1431+ my $idx;
1432+ if(exists($curcounter{$cursubnet})) {
1433+ $idx = ++$curcounter{$cursubnet}->{'group'};
1434+ } else {
1435+ $idx = ++$curcounter{''}->{'group'};
1436+ }
1437+
1438+ add_dn_to_stack ("cn=group".$idx);
1439+ $curentry{'type'} = 'group';
1440+ $curentry{'idx'} = $idx;
1441+}
1442+
1443+
1444+sub parse_pool
1445+{
1446+ local ($descr, $tmp);
1447+
1448+ print_entry () if %curentry;
1449+
1450+ $tmp = next_token (0);
1451+ parse_error () if !defined ($tmp);
1452+ parse_error () if !($tmp eq '{');
1453+
1454+ my $idx;
1455+ if(exists($curcounter{$cursubnet})) {
1456+ $idx = ++$curcounter{$cursubnet}->{'pool'};
1457+ } else {
1458+ $idx = ++$curcounter{''}->{'pool'};
1459+ }
1460+
1461+ add_dn_to_stack ("cn=pool".$idx);
1462+ $curentry{'type'} = 'pool';
1463+ $curentry{'idx'} = $idx;
1464+}
1465+
1466+
1467+sub parse_class
1468+{
1469+ local ($descr, $tmp);
1470+
1471+ print_entry () if %curentry;
1472+
1473+ $class = next_token (0);
1474+ parse_error () if !defined ($class);
1475+
1476+ $tmp = next_token (0);
1477+ parse_error () if !defined ($tmp);
1478+ parse_error () if !($tmp eq '{');
1479+
1480+ $class =~ s/\"//g;
1481+ add_dn_to_stack ("cn=$class");
1482+ $curentry{'type'} = 'class';
1483+ $curentry{'class'} = $class;
1484+}
1485+
1486+
1487+sub parse_subclass
1488+{
1489+ local ($descr, $tmp);
1490+
1491+ print_entry () if %curentry;
1492+
1493+ $class = next_token (0);
1494+ parse_error () if !defined ($class);
1495+
1496+ $subclass = next_token (0);
1497+ parse_error () if !defined ($subclass);
1498+
1499+ $tmp = next_token (0);
1500+ parse_error () if !defined ($tmp);
1501+ parse_error () if !($tmp eq '{');
1502+
1503+ add_dn_to_stack ("cn=$subclass");
1504+ $curentry{'type'} = 'subclass';
1505+ $curentry{'class'} = $class;
1506+ $curentry{'subclass'} = $subclass;
1507+}
1508+
1509+
1510+sub parse_hwaddress
1511+{
1512+ local ($type, $hw, $tmp);
1513+
1514+ $type = next_token (1);
1515+ parse_error () if !defined ($type);
1516+
1517+ $hw = next_token (1);
1518+ parse_error () if !defined ($hw);
1519+ $hw =~ s/;$//;
1520+
1521+ $curentry{'hwaddress'} = "$type $hw";
1522+}
1523+
1524+
1525+sub parse_range
1526+{
1527+ local ($tmp, $str);
1528+
1529+ $str = remaining_line ();
1530+
1531+ if (!($str eq ''))
1532+ {
1533+ $str =~ s/;$//;
3150c1ff 1534+ push (@{$curentry{'ranges'}}, $str);
1097e9ca 1535+ }
1536+}
1537+
1538+
1539+sub parse_statement
1540+{
1541+ local ($token) = shift;
1542+ local ($str);
1543+
1544+ if ($token eq 'option')
1545+ {
1546+ $str = remaining_line ();
1547+ push (@{$curentry{'options'}}, $str);
1548+ }
1549+ elsif($token eq 'failover')
1550+ {
3150c1ff 1551+ $str = remaining_line (1); # take care on block
1552+ if($str =~ /[{]/)
1553+ {
1554+ my ($peername, @statements);
1555+
1556+ parse_error() if($str !~ /^\s*peer\s+(.+?)\s+[{]\s*$/);
1557+ parse_error() if(($peername = $1) !~ /^\"?[^\"]+\"?$/);
1558+
1559+ #
1560+ # failover config block found:
1561+ # e.g. 'failover peer "some-name" {'
1562+ #
1563+ if(not grep(/FaIlOvEr/i, @use))
1564+ {
1565+ print STDERR "Warning: Failover config 'peer $peername' found!\n";
1566+ print STDERR " Skipping it, since failover disabled!\n";
1567+ print STDERR " You may try out --use=failover option.\n";
1568+ }
1569+
1570+ until($str =~ /[}]/ or $str eq "")
1571+ {
1572+ $str = remaining_line (1);
1573+ # collect all statements, except ending '}'
1574+ push(@statements, $str) if($str !~ /[}]/);
1575+ }
1576+ $failover{$peername} = [@statements];
1577+ }
1578+ else
1579+ {
1580+ #
1581+ # pool reference to failover config is fine
1582+ # e.g. 'failover peer "some-name";'
1583+ #
1584+ if(not grep(/FaIlOvEr/i, @use))
1585+ {
1586+ print STDERR "Warning: Failover reference '$str' found!\n";
1587+ print STDERR " Skipping it, since failover disabled!\n";
1588+ print STDERR " You may try out --use=failover option.\n";
1589+ }
1590+ else
1591+ {
1592+ push (@{$curentry{'statements'}}, $token. " " . $str);
1593+ }
1097e9ca 1594+ }
1097e9ca 1595+ }
1596+ elsif($token eq 'zone')
1597+ {
1598+ $str = $token;
1599+ while($str !~ /}$/) {
1600+ $str .= ' ' . next_token (0);
1601+ }
1602+ push (@{$curentry{'statements'}}, $str);
1603+ }
1604+ elsif($token =~ /^(authoritative)[;]*$/)
1605+ {
1606+ push (@{$curentry{'statements'}}, $1);
1607+ }
1608+ else
1609+ {
1610+ $str = $token . " " . remaining_line ();
1611+ push (@{$curentry{'statements'}}, $str);
1612+ }
1613+}
1614+
1615+
1616+my $ok = GetOptions(
1617+ 'basedn=s' => \$basedn,
1097e9ca 1618+ 'dhcpdn=s' => \$dhcpdn,
3150c1ff 1619+ 'server=s' => \$server,
1620+ 'second=s' => \$second,
1621+ 'conf=s' => \$i_conf,
1622+ 'ldif=s' => \$o_ldif,
1623+ 'use=s' => \@use,
1097e9ca 1624+ 'h|help|usage' => sub { usage(0); },
1625+);
1626+
1097e9ca 1627+unless($server =~ /^\w+/)
1628+ {
1629+ usage(1, "invalid server name '$server'");
1630+ }
1631+unless($basedn =~ /^\w+=[^,]+/)
1632+ {
1633+ usage(1, "invalid base dn '$basedn'");
1634+ }
1635+
1636+if($dhcpdn =~ /^cn=([^,]+)/i)
1637+ {
1638+ $dhcpcn = "$1";
1639+ }
3150c1ff 1640+$second = '' if not defined $second;
1641+unless($second eq '' or $second =~ /^cn=[^,]+\s*,\s*\w+=[^,]+/i)
1642+ {
1643+ if($second =~ /^cn=[^,]+$/i)
1644+ {
1645+ # relative DN 'cn=name'
1646+ $second = "$second, $basedn";
1647+ }
1648+ elsif($second =~ /^\w+/)
1649+ {
1650+ # assume hostname only
1651+ $second = "cn=$second, $basedn";
1652+ }
1653+ else
1654+ {
1655+ usage(1, "invalid secondary '$second'")
1656+ }
1657+ }
1097e9ca 1658+
1659+usage(1) unless($ok);
1660+
3150c1ff 1661+if($i_conf ne "" and -f $i_conf)
1662+ {
1663+ if(not open(STDIN, '<', $i_conf))
1664+ {
1665+ print STDERR "Error: can't open conf file '$i_conf': $!\n";
1666+ exit(1);
1667+ }
1668+ }
1669+if($o_ldif ne "")
1670+ {
1671+ if(-e $o_ldif)
1672+ {
1673+ print STDERR "Error: output ldif name '$o_ldif' already exists!\n";
1674+ exit(1);
1675+ }
1676+ if(not open(STDOUT, '>', $o_ldif))
1677+ {
1678+ print STDERR "Error: can't open ldif file '$o_ldif': $!\n";
1679+ exit(1);
1680+ }
1681+ }
1682+
1683+
1097e9ca 1684+print STDERR "Creating LDAP Configuration with the following options:\n";
1685+print STDERR "\tBase DN: $basedn\n";
1097e9ca 1686+print STDERR "\tDHCP DN: $dhcpdn\n";
3150c1ff 1687+print STDERR "\tServer DN: cn=$server, $basedn\n";
1688+print STDERR "\tSecondary DN: $second\n"
1689+ if(grep(/FaIlOvEr/i, @use) and $second ne '');
1690+print STDERR "\n";
1097e9ca 1691+
1692+my $token;
1693+my $token_number = 0;
1694+my $line_number = 0;
1695+my %curentry;
1696+my $cursubnet = '';
1697+my %curcounter = ( '' => { pool => 0, group => 0 } );
1698+
1699+$current_dn = "$dhcpdn";
1700+$curentry{'descr'} = $dhcpcn;
1701+$line = '';
3150c1ff 1702+%failover = ();
1097e9ca 1703+
1704+while (($token = next_token (1)))
1705+ {
1706+ if ($token eq '}')
1707+ {
1708+ print_entry () if %curentry;
1709+ if($current_dn =~ /.+?,\s*${dhcpdn}$/) {
3150c1ff 1710+ # don't go below dhcpdn ...
1097e9ca 1711+ remove_dn_from_stack ();
1712+ }
1713+ }
1714+ elsif ($token eq 'subnet')
1715+ {
1716+ parse_subnet ();
1717+ next;
1718+ }
1719+ elsif ($token eq 'shared-network')
1720+ {
1721+ parse_shared_network ();
1722+ next;
1723+ }
1724+ elsif ($token eq 'class')
1725+ {
1726+ parse_class ();
1727+ next;
1728+ }
1729+ elsif ($token eq 'subclass')
1730+ {
1731+ parse_subclass ();
1732+ next;
1733+ }
1734+ elsif ($token eq 'pool')
1735+ {
1736+ parse_pool ();
1737+ next;
1738+ }
1739+ elsif ($token eq 'group')
1740+ {
1741+ parse_group ();
1742+ next;
1743+ }
1744+ elsif ($token eq 'host')
1745+ {
1746+ parse_host ();
1747+ next;
1748+ }
1749+ elsif ($token eq 'hardware')
1750+ {
1751+ parse_hwaddress ();
1752+ next;
1753+ }
1754+ elsif ($token eq 'range')
1755+ {
1756+ parse_range ();
1757+ next;
1758+ }
1759+ else
1760+ {
1761+ parse_statement ($token);
1762+ next;
1763+ }
1764+ }
1765+
3150c1ff 1766+close(STDIN) if($i_conf);
1767+close(STDOUT) if($o_ldif);
1768+
1097e9ca 1769+print STDERR "Done.\n";
1770+
a37573f1
JR		 1771diff -Naur dhcp-3.0.5/debian/changelog dhcp-3.0.5-ldap/debian/changelog
1772--- dhcp-3.0.5/debian/changelog 1969-12-31 19:00:00.000000000 -0500
1773+++ dhcp-3.0.5-ldap/debian/changelog 2006-12-14 10:03:41.000000000 -0500
3150c1ff 1774@@ -0,0 +1,25 @@
a37573f1 1775+dhcp3-server-ldap (3.0.4-1) unstable; urgency=low
3150c1ff 1776+
1777+ * See ChangeLog-LDAP for changes in this release
1778+
a37573f1 1779+ -- Brian Masney <masneyb@gftp.org> Mon, 08 May 2006 08:31:46 -0400
3150c1ff 1780+
1781+dhcp3-server-ldap (3.0.1rc13-1) unstable; urgency=low
1782+
1783+ * See ChangeLog-LDAP for changes in this release
1784+
1785+ -- Brian Masney <masneyb@gftp.org> Wed, 05 May 2004 07:20:13 -0400
1786+
1787+dhcp3-server-ldap (3.0.1rc12-1) unstable; urgency=low
1097e9ca 1788+
1789+ * Updated patch to work against ISC DHCPD 3.0.1rc12
1790+
1791+ -- Brian Masney <masneyb@gftp.org> Mon, 08 Sep 2003 16:34:00 -0400
1792+
3150c1ff 1793+dhcp3-server-ldap (3.0.1rc11-2) unstable; urgency=low
1097e9ca 1794+
1795+ * Added these Debian files. They are mostly from the existing dhcp3-server
1796+ package in Debian.
1797+
1798+ -- Brian Masney <masneyb@gftp.org> Mon, 04 Aug 2003 13:34:00 -0400
1799+
a37573f1
JR		 1800diff -Naur dhcp-3.0.5/debian/control dhcp-3.0.5-ldap/debian/control
1801--- dhcp-3.0.5/debian/control 1969-12-31 19:00:00.000000000 -0500
1802+++ dhcp-3.0.5-ldap/debian/control 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1803@@ -0,0 +1,12 @@
3150c1ff 1804+Source: dhcp3-server-ldap
1097e9ca 1805+Section: net
1806+Priority: optional
1807+Maintainer: Brian Masney <masneyb@gftp.org>
a37573f1 1808+Build-Depends: debhelper (>= 2.1.18), dpkg-dev (>= 1.7.0), groff, libldap2-dev
1097e9ca 1809+Standards-Version: 2.4.0.0
1810+
3150c1ff 1811+Package: dhcp3-server-ldap
1097e9ca 1812+Architecture: any
a37573f1 1813+Depends: ${shlibs:Depends}, debconf, debianutils (>= 1.7), dhcp3-server (>= 3.0+3.0.1rc9)
3150c1ff 1814+Conflicts: dhcp, dhcp3-ldap-ntelos
1097e9ca 1815+Description: This is the DHCP server with LDAP patches applied to it
a37573f1
JR		 1816diff -Naur dhcp-3.0.5/debian/copyright dhcp-3.0.5-ldap/debian/copyright
1817--- dhcp-3.0.5/debian/copyright 1969-12-31 19:00:00.000000000 -0500
1818+++ dhcp-3.0.5-ldap/debian/copyright 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1819@@ -0,0 +1,30 @@
1820+/*
1821+ * Copyright (c) 1996, 1997 The Internet Software Consortium.
1822+ * All rights reserved.
1823+ *
1824+ * Redistribution and use in source and binary forms, with or without
1825+ * modification, are permitted provided that the following conditions
1826+ * are met:
1827+ *
1828+ * 1. Redistributions of source code must retain the above copyright
1829+ * notice, this list of conditions and the following disclaimer.
1830+ * 2. Redistributions in binary form must reproduce the above copyright
1831+ * notice, this list of conditions and the following disclaimer in the
1832+ * documentation and/or other materials provided with the distribution.
1833+ * 3. Neither the name of The Internet Software Consortium nor the names of its
1834+ * contributors may be used to endorse or promote products derived
1835+ * from this software without specific prior written permission.
1836+ *
1837+ * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
1838+ * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
1839+ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
1840+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
1841+ * THE INTERNET SOFTWARE CONSORTIUM OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
1842+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
1843+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
1844+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1845+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
1846+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
1847+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
1848+ * OF THE POSSIBILITY OF SUCH DAMAGE.
1849+ */
a37573f1
JR		 1850diff -Naur dhcp-3.0.5/debian/dhcp3-server-ldap.files dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.files
1851--- dhcp-3.0.5/debian/dhcp3-server-ldap.files 1969-12-31 19:00:00.000000000 -0500
1852+++ dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.files 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1853@@ -0,0 +1 @@
1854+usr/sbin/dhcpd3
a37573f1
JR		 1855diff -Naur dhcp-3.0.5/debian/dhcp3-server-ldap.postinst dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.postinst
1856--- dhcp-3.0.5/debian/dhcp3-server-ldap.postinst 1969-12-31 19:00:00.000000000 -0500
1857+++ dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.postinst 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1858@@ -0,0 +1,13 @@
1859+#!/bin/sh
1860+
1861+set -e
1862+
1863+# Removes the left over diversions of the old package
1864+
1865+if [ "$1" = remove -o "$1" = upgrade ]; then
1866+ for v in `list_versions`; do
3150c1ff 1867+ dpkg-divert --package dhcp3-server-ldap --remove \
1097e9ca 1868+ --rename --divert /usr/sbin/dhcpd3-noldap \
1869+ /usr/sbin/dhcpd3
1870+ done
1871+fi
a37573f1
JR		 1872diff -Naur dhcp-3.0.5/debian/dhcp3-server-ldap.postrm dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.postrm
1873--- dhcp-3.0.5/debian/dhcp3-server-ldap.postrm 1969-12-31 19:00:00.000000000 -0500
1874+++ dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.postrm 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1875@@ -0,0 +1,8 @@
1876+#!/bin/sh
1877+
1878+set -e
1879+
1880+if [ "$1" = remove ]; then
3150c1ff 1881+ dpkg-divert --package dhcp3-server-ldap --remove --rename \
1097e9ca 1882+ --divert /usr/sbin/dhcpd3-noldap /usr/sbin/dhcpd3
1883+fi
a37573f1
JR		 1884diff -Naur dhcp-3.0.5/debian/dhcp3-server-ldap.preinst dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.preinst
1885--- dhcp-3.0.5/debian/dhcp3-server-ldap.preinst 1969-12-31 19:00:00.000000000 -0500
1886+++ dhcp-3.0.5-ldap/debian/dhcp3-server-ldap.preinst 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1887@@ -0,0 +1,14 @@
1888+#!/bin/sh
1889+
1890+set -e
1891+
1892+if [ "$1" = install -o "$1" = upgrade ]; then
1893+ if dpkg-divert --list /usr/sbin/dhcpd3 \
3150c1ff 1894+ | grep -q "by dhcp3-server-ldap";
1097e9ca 1895+ then
1896+ exit 0
1897+ fi
1898+
3150c1ff 1899+ dpkg-divert --package dhcp3-server-ldap --add --rename \
1097e9ca 1900+ --divert /usr/sbin/dhcpd3-noldap /usr/sbin/dhcpd3
1901+fi
a37573f1
JR		 1902diff -Naur dhcp-3.0.5/debian/dirs dhcp-3.0.5-ldap/debian/dirs
1903--- dhcp-3.0.5/debian/dirs 1969-12-31 19:00:00.000000000 -0500
1904+++ dhcp-3.0.5-ldap/debian/dirs 2006-12-14 10:03:41.000000000 -0500
1097e9ca 1905@@ -0,0 +1 @@
1906+usr/sbin
a37573f1
JR		 1907diff -Naur dhcp-3.0.5/debian/rules dhcp-3.0.5-ldap/debian/rules
1908--- dhcp-3.0.5/debian/rules 1969-12-31 19:00:00.000000000 -0500
1909+++ dhcp-3.0.5-ldap/debian/rules 2006-12-14 10:03:41.000000000 -0500
3150c1ff 1910@@ -0,0 +1,87 @@
1097e9ca 1911+#!/usr/bin/make -f
1912+# Made with the iad of dh_make, by Craig Small
1913+# Sample debian/rules that uses debhelper. GNU copyright 1997 by Joey Hess.
1914+# Also some stuff taken from debmake scripts, by Cristopt Lameter.
1915+
1916+# Uncomment this to turn on verbose mode.
1917+#export DH_VERBOSE=1
1918+
1919+export DH_COMPAT=3
1920+
1921+DESTDIR = `pwd`/debian/tmp
1922+
1923+IVARS = DESTDIR=$(DESTDIR)
1924+
1925+BVARS = PREDEFINES='-D_PATH_DHCPD_DB=\"/var/lib/dhcp3/dhcpd.leases\" \
1926+ -D_PATH_DHCLIENT_DB=\"/var/lib/dhcp3/dhclient.leases\" \
1927+ -D_PATH_DHCLIENT_SCRIPT=\"/etc/dhcp3/dhclient-script\" \
1928+ -D_PATH_DHCPD_CONF=\"/etc/dhcp3/dhcpd.conf\" \
1929+ -D_PATH_DHCLIENT_CONF=\"/etc/dhcp3/dhclient.conf\"'
1930+
1931+build: build-stamp
1932+build-stamp:
1933+ dh_testdir
1934+
1935+ ./configure
1097e9ca 1936+ $(MAKE) $(BVARS)
1937+
1938+ touch build-stamp
1939+
1940+clean:
1941+ dh_testdir
1942+ rm -f build-stamp install-stamp
1943+
1944+ # Add here commands to clean up after the build process.
1945+ -$(MAKE) distclean
1946+
1947+ # Remove leftover junk...
1948+ rm -Rf work.linux-2.2/
1949+
1950+ dh_clean
1951+
1952+install: install-stamp
1953+install-stamp: build-stamp
1954+ dh_testdir
1955+ dh_testroot
1956+ dh_clean -k
1957+ dh_installdirs
1958+
1959+ # Add here commands to install the package into debian/tmp.
1960+ $(MAKE) install $(IVARS)
1961+
1962+ mv $(DESTDIR)/usr/sbin/dhcpd $(DESTDIR)/usr/sbin/dhcpd3
1963+
1964+ dh_movefiles
1965+
1966+ # Remove unwanted directories that dh_movefiles leaves around
1967+ rmdir $(DESTDIR)/etc
1968+ rm -Rf $(DESTDIR)/sbin/
1969+ rm -Rf $(DESTDIR)/usr/bin/
1970+ rm -Rf $(DESTDIR)/usr/include/
1971+ rm -Rf $(DESTDIR)/usr/lib/
1972+ rm -Rf $(DESTDIR)/usr/local/
1973+ rm -Rf $(DESTDIR)/usr/man/
1974+ rm -Rf $(DESTDIR)/var/
1975+ rm -f $(DESTDIR)/usr/sbin/dhcrelay
1976+
1977+ touch install-stamp
1978+
1979+# Build architecture-dependent files here (this package does not contain
1980+# architecture-independent files).
1981+binary-arch: build install
1982+ dh_testdir -a
1983+ dh_testroot -a
1984+ dh_strip -a
1985+ dh_compress -a
1986+ dh_fixperms -a
1987+ dh_installdeb -a
1988+ dh_shlibdeps -a
1989+ dh_gencontrol -a
1990+ dh_md5sums -a
1991+ dh_builddeb -a
1992+
1993+source diff:
1994+ @echo >&2 'source and diff are obsolete - use dpkg-source -b'; false
1995+
1996+binary: binary-arch
1997+.PHONY: build clean binary-indep binary-arch binary
a37573f1
JR		 1998diff -Naur dhcp-3.0.5/doc/draft-ietf-dhc-ldap-schema-01.txt dhcp-3.0.5-ldap/doc/draft-ietf-dhc-ldap-schema-01.txt
1999--- dhcp-3.0.5/doc/draft-ietf-dhc-ldap-schema-01.txt 1969-12-31 19:00:00.000000000 -0500
2000+++ dhcp-3.0.5-ldap/doc/draft-ietf-dhc-ldap-schema-01.txt 2006-12-14 10:03:41.000000000 -0500
1097e9ca 2001@@ -0,0 +1,1089 @@
2002+
2003+
2004+
2005+
2006+
2007+Network Working Group M. Meredith,
2008+Internet Draft V. Nanjundaswamy,
2009+Document: <draft-ietf-dhc-ldap-schema-00.txt> M. Hinckley
2010+Category: Proposed Standard Novell Inc.
2011+Expires: 15th December 2001 16th June 2001
2012+
2013+
2014+ LDAP Schema for DHCP
2015+
2016+Status of this Memo
2017+
2018+This document is an Internet-Draft and is in full conformance with all
2019+provisions of Section 10 of RFC2026 [ ].
2020+
2021+Internet-Drafts are working documents of the Internet Engineering Task
2022+Force (IETF), its areas, and its working groups. Note that other groups
2023+may also distribute working documents as Internet-Drafts. Internet-
2024+Drafts are draft documents valid for a maximum of six months and may be
2025+updated, replaced, or obsolete by other documents at any time. It is
2026+inappropriate to use Internet-Drafts as reference material or to cite
2027+them other than as "work in progress." The list of current Internet-
2028+Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The
2029+list of Internet-Draft Shadow Directories can be accessed at
2030+http://www.ietf.org/shadow.html.
2031+
2032+1. Abstract
2033+
2034+This document defines a schema for representing DHCP configuration in an
2035+LDAP directory. It can be used to represent the DHCP Service
2036+configuration(s) for an entire enterprise network, a subset of the
2037+network, or even a single server. Representing DHCP configuration in an
2038+LDAP directory enables centralized management of DHCP services offered
2039+by one or more DHCP Servers within the enterprise.
2040+
2041+2. Conventions used in this document
2042+
2043+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
2044+"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
2045+document are to be interpreted as described in RFC-2119 [ ].
2046+
2047+In places where different sets of terminology are commonly used to
2048+represent similar DHCP concepts, this schema uses the terminology of the
2049+Internet Software Consortium's DHCP server reference implementation.
2050+For more information see www.isc.org.
2051+
2052+3. Design Considerations
2053+
2054+The DHCP LDAP schema is designed to be a simple multi-server schema. The
2055+
2056+
2057+
2058+M. Meredith et al. Expires December 2001 [Page 1]
2059+
2060+
2061+
2062+
2063+
2064+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2065+
2066+
2067+intent of this schema is to provide a basic framework for representing
2068+the most common elements used in the configuration of DHCP Server. This
2069+should allow other network services to obtain and use basic DHCP
2070+configuration information in a server-independent but knowledgeable way.
2071+
2072+It is expected that some implementations may need to extend the schema
2073+objects, in order to implement all of their features or needs. It is
2074+recommended that you use the schema defined in this draft to represent
2075+DHCP configuration information in an LDAP directory. Conforming to a
2076+standard schema improves interoperability between DHCP implementations
2077+from different vendors.
2078+
2079+Some implementations may choose not to support all of the objects
2080+defined here.
2081+
2082+Two decisions are explicitly left up to each implementation:
2083+
2084+First, implementations may choose not to store the lease information in
2085+the directory, so those objects would not be used.
2086+
2087+Second, implementations may choose not to implement the auditing
2088+information.
2089+
2090+It is up to the implementation to determine if the data in the directory
2091+is considered "authoritative", or if it is simply a copy of data from an
2092+authoritative source. Validity of the information if used as a copy is
2093+to be ensured by the implementation.
2094+
2095+Primarily two types of applications will use the information in this
2096+schema: 1. DHCP servers (for loading their configuration) 2. Management
2097+Interfaces (for defining/editing configurations).
2098+
2099+The schema should be efficient for the needs of both types of
2100+applications. The schema is designed to allow objects managed by DHCP
2101+(such as computers, subnets, etc) to be present anywhere in a directory
2102+hierarchy (to allow those objects to be placed in the directory for
2103+managing administrative control and access to the objects).
2104+
2105+The schema uses a few naming conventions - all object classes and
2106+attributes are prefixed with "dhcp" to decrease the chance that object
2107+classes and attributes will have the same name. The schema also uses
2108+standard naming attributes ("cn", "ou", etc) for all objects.
2109+
2110+4. Common DHCP Configuration Attributes
2111+
2112+Although DHCP manages several different types of objects, the
2113+configuration of those objects is often similar. Consequently, most of
2114+these objects have a common set of attributes, which are defined below.
2115+
2116+
2117+
2118+M. Meredith et al. Expires December 2001 [Page 2]
2119+
2120+
2121+
2122+
2123+
2124+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2125+
2126+
2127+4.1. Attributes Definitions
2128+
2129+The schema definitions listed below are for readability. The LDIF
2130+layout for this schema will follow in section 8.
2131+
2132+Name: dhcpPrimaryDN Description: The Distinguished Name of the
2133+dhcpServer object, which is the primary server for the configuration.
2134+Syntax: DN Flags: SINGLE-VALUE
2135+
2136+Named: dhcpSecondaryDN Description: The Distinguished Name(s) of the
2137+dhcpServer object(s), which are secondary servers for the configuration.
2138+Syntax: DN
2139+
2140+Name: dhcpStatements Description: Flexible storage for representing any
2141+specific data depending on the object to which it is attached. Examples
2142+include conditional statements, Server parameters, etc. This also
2143+serves as a 'catch-all' attribute that allows the standard to evolve
2144+without needing to update the schema. Syntax: IA5String
2145+
2146+Name: dhcpRange Description: The starting and ending IP Addresses in the
2147+range (inclusive), separated by a hyphen; if the range only contains one
2148+address, then just the address can be specified with no hyphen. Each
2149+range is defined as a separate value. Syntax: IA5String
2150+
2151+Name: dhcpPermitList Description: This attribute contains the permit
2152+lists associated with a pool. Each permit list is defined as a separate
2153+value. Syntax: IA5String
2154+
2155+Name: dhcpNetMask Description: The subnet mask length for the subnet.
2156+The mask can be easily computed from this length. Syntax: Integer
2157+Flags: SINGLE-VALUE
2158+
2159+Name: dhcpOption Description: Encoded option values to be sent to
2160+clients. Each value represents a single option and contains (OptionTag,
2161+Length, OptionData) encoded in the format used by DHCP. For more
2162+information see [DHCPOPT]. Syntax: OctetString
2163+
2164+Name: dhcpClassData Description: Encoded text string or list of bytes
2165+expressed in hexadecimal, separated by colons. Clients match subclasses
2166+based on matching the class data with the results of a 'match' or 'spawn
2167+with' statement in the class name declarations. Syntax: IA5String
2168+Flags: SINGLE-VALUE
2169+
2170+Name: dhcpSubclassesDN Description: List of subclasses, these are the
2171+actual DN of each subclass object. Syntax: DN
2172+
2173+Name: dhcpClassesDN Description: List of classes, these are the actual
2174+DN of each class object. Syntax: DN
2175+
2176+
2177+
2178+M. Meredith et al. Expires December 2001 [Page 3]
2179+
2180+
2181+
2182+
2183+
2184+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2185+
2186+
2187+Name: dhcpSubnetDN Description: List of subnets, these are the actual DN
2188+of each subnet object. Syntax: DN
2189+
2190+Name: dhcpPoolDN Description: List of pools, these are the actual DN of
2191+each Pool object. Syntax: DN
2192+
2193+Name: dhcpOptionsDN Description: List of options, these are the actual
2194+DN of each Options object. Syntax: DN
2195+
2196+Name: dhcpHostDN Description: List of hosts, these are the actual DN of
2197+each host object. Syntax: DN
2198+
2199+Name: dhcpSharedNetworkDN Description: List of shared networks, these
2200+are the actual DN of each shared network object. Syntax: DN
2201+
2202+Name: dhcpGroupDN Description: List of groups, these are the actual DN
2203+of each Group object. Syntax: DN
2204+
2205+Name: dhcpLeaseDN Description: Single Lease DN. A dhcpHost configuration
2206+uses this attribute to identify a static IP address assignment. Syntax:
2207+DN Flags: SINGLE-VALUE
2208+
2209+Name: dhcpLeasesDN Description: List of leases, these are the actual DN
2210+of each lease object. Syntax: DN
2211+
2212+Name: dhcpServiceDN Description: The DN of dhcpService object(s)which
2213+contain the configuration information. Each dhcpServer object has this
2214+attribute identifying the DHCP configuration(s) that the server is
2215+associated with. Syntax: DN
2216+
2217+Name: dhcpHWAddress Description: The hardware address of the client
2218+associated with a lease Syntax: OctetString Flags: SINGLE-VALUE
2219+
2220+Name: dhcpVersion Description: This is the version identified for the
2221+object that this attribute is part of. In case of the dhcpServer object,
2222+this represents the DHCP software version. Syntax: IA5String Flags:
2223+SINGLE-VALUE
2224+
2225+Name: dhcpImplementation Description: DHCP Server implementation
2226+description e.g. DHCP Vendor information. Syntax: IA5String Flags:
2227+SINGLE-VALUE
2228+
2229+Name: dhcpHashBucketAssignment Description: HashBucketAssignment bit map
2230+for the DHCP Server, as defined in DHC Load Balancing Algorithm [RFC
2231+3074]. Syntax: Octet String Flags: SINGLE-VALUE
2232+
2233+Name: dhcpDelayedServiceParameter Description: Delay in seconds
2234+corresponding to Delayed Service Parameter configuration, as defined in
2235+
2236+
2237+
2238+M. Meredith et al. Expires December 2001 [Page 4]
2239+
2240+
2241+
2242+
2243+
2244+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2245+
2246+
2247+DHC Load Balancing Algorithm [RFC 3074]. Syntax: Integer Flags: SINGLE-
2248+VALUE
2249+
2250+Name: dhcpMaxClientLeadTime Description: Maximum Client Lead Time
2251+configuration in seconds, as defined in DHCP Failover Protocol [FAILOVR]
2252+Syntax: Integer Flags: SINGLE-VALUE
2253+
2254+Name: dhcpFailOverEndpointState Description: Server (Failover Endpoint)
2255+state, as defined in DHCP Failover Protocol [FAILOVR] Syntax: IA5String
2256+Flags: SINGLE-VALUE
2257+
2258+5. Configurations and Services
2259+
2260+The schema definitions below are for readability the LDIF layout for
2261+this schema will follow in section 8.
2262+
2263+The DHC working group is currently considering several proposals for
2264+fail-over and redundancy of DHCP servers. These may require sharing of
2265+configuration information between servers. This schema provides a
2266+generalized mechanism for supporting any of these proposals, by
2267+separating the definition of a server from the definition of
2268+configuration service provided by the server.
2269+
2270+Separating the DHCP Server (dhcpServer) and the DHCP Configuration
2271+(dhcpService) representations allows a configuration service to be
2272+provided by one or more servers. Similarly, a server may provide one or
2273+more configurations. The schema allows a server to be configured as
2274+either a primary or secondary provider of a DHCP configuration.
2275+
2276+Configurations are also defined so that one configuration can include
2277+some of the objects that are defined in another configuration. This
2278+allows for sharing and/or a hierarchy of related configuration items.
2279+
2280+Name: dhcpService Description: Service object that represents the
2281+actual DHCP Service configuration. This will be a container with the
2282+following attributes. Must: cn, dhcpPrimaryDN May: dhcpSecondaryDN,
2283+dhcpSharedNetworkDN, dhcpSubnetDN, dhcpGroupDN, dhcpHostDN,
2284+dhcpClassesDN, dhcpOptionsDN, dhcpStatements
2285+
2286+The following objects could exist inside the dhcpService container:
2287+dhcpSharedNetwork, dhcpSubnet, dhcpGroup, dhcpHost, dhcpClass,
2288+dhcpOptions, dhcpLog
2289+
2290+Name: dhcpServer Description: Server object that the DHCP server will
2291+login as. The configuration information is in the dhcpService container
2292+that the dhcpServiceDN points to. Must: cn, dhcpServiceDN May:
2293+dhcpVersion, dhcpImplementation, dhcpHashBucketAssignment,
2294+dhcpDelayedServiceParameter, dhcpMaxClientLeadTime,
2295+
2296+
2297+
2298+M. Meredith et al. Expires December 2001 [Page 5]
2299+
2300+
2301+
2302+
2303+
2304+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2305+dhcpFailOverEndpointState, dhcpStatements
2306+
2307+5.1. DHCP Declaration related classes:
2308+
2309+Name: dhcpSharedNetwork Description: Shared Network class will list what
2310+pools and subnets are in this network.
2311+
2312+This will be a container with the following attributes. Must: cn May:
2313+dhcpSubnetDN, dhcpPoolDN, dhcpOptionsDN, dhcpStatements
2314+
2315+The following objects can exist within a dhcpSharedNetwork container:
2316+dhcpSubnet, dhcpPool, dhcpOptions, dhcpLog
2317+
2318+Name: dhcpSubnet Description: Subnet object will include configuration
2319+information associated with a subnet, including a range and a net mask.
2320+
2321+This will be a container with the following attributes. Must: cn
2322+(Subnet address), dhcpNetMask May: dhcpRange, dhcpPoolDN, dhcpGroupDN,
2323+dhcpHostDN, dhcpClassesDN, dhcpLeasesDN, dhcpOptionsDN, dhcpStatements
2324+
2325+The following objects can exist within a dhcpSubnet container: dhcpPool,
2326+dhcpGroup, dhcpHost, dhcpClass, dhcpOptions, dhcpLease, dhcpLog
2327+
2328+Name: dhcpGroup Description: Group object will have configuration
2329+information associated with a group.
2330+
2331+This will be a container with the following attributes. Must: cn May:
2332+dhcpHostDN, dhcpOptionsDN, dhcpStatements
2333+
2334+The following objects can exist within a dhcpGroup container: dhcpHost,
2335+dhcpOptions
2336+
2337+Name: dhcpHost Description: The host object includes DHCP host
2338+declarations to assign a static IP address or declare the client as
2339+known or specify statements for a specific client. Must: cn May:
2340+dhcpLeaseDN, dhcpHWAddress, dhcpOptionsDN, dhcpStatements
2341+
2342+The following objects can exist within a dhcpHost container: dhcpLease,
2343+dhcpOptions
2344+
2345+Name: dhcpOptions Description: The options class is for option space
2346+declarations, it contains a list of options. Must: cn, dhcpOption
2347+
2348+Name: dhcpClass Description: This is a class to group clients together
2349+based on matching rules.
2350+
2351+This will be a container with the following attributes. Must: cn May:
2352+dhcpSubClassesDN, dhcpOptionsDN, dhcpStatements
2353+
2354+The following object can exist within a dhcpClass container:
2355+dhcpSubclass, dhcpOptions
2356+
2357+
2358+
2359+M. Meredith et al. Expires December 2001 [Page 6]
2360+
2361+
2362+
2363+
2364+
2365+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2366+
2367+
2368+Name: dhcpSubClass Description: This includes configuration information
2369+for a subclass associated with a class. The dhcpSubClass object will
2370+always be contained within the corresponding class container object.
2371+Must: cn May: dhcpClassData, dhcpOptionsDN, dhcpStatements
2372+
2373+Name: dhcpPool Description: This contains configuration for a pool that
2374+will have the range of addresses, permit lists and point to classes and
2375+leases that are members of this pool.
2376+
2377+This will be a container that could be contained by dhcpSubnet or a
2378+dhcpSharedNetwork. Must: cn, dhcpRange May: dhcpClassesDN,
2379+dhcpPermitList, dhcpLeasesDN, dhcpOptionsDN, dhcpStatements
2380+
2381+The following objects can exist within a dhcpPool container: dhcpClass,
2382+dhcpOptions, dhcpLease, dhcpLog
2383+
2384+6. Tracking Address Assignments
2385+
2386+The behavior of a DHCP server is influenced by two factors - it's
2387+configuration and the current state of the addresses that have been
2388+assigned to clients. This schema defines a set of objects for
2389+representing the DHCP configuration associated with a server. The
2390+following object classes provide the ability to record how addresses are
2391+used including maintaining history (audit log) on individual leases.
2392+Recording lease information in a directory could result in a significant
2393+performance impact and is therefore optional. Implementations supporting
2394+logging of leases need to consider the performance impact.
2395+
2396+6.1. dhcpLeases Attribute Definitions
2397+
2398+The schema definitions below are for readability the LDIF layout for
2399+this schema will follow in section 8.
2400+
2401+Name: dhcpAddressState Description: This stores information about the
2402+current binding-status of an address. For dynamic addresses managed by
2403+DHCP, the values should be restricted to the states defined in the DHCP
2404+Failover Protocol draft [FAILOVR]: 'FREE', 'ACTIVE', 'EXPIRED',
2405+'RELEASED', 'RESET', 'ABANDONED', 'BACKUP'. For more information on
2406+these states see [FAILOVR]. For other addresses, it SHOULD be one of
2407+the following: 'UNKNOWN', 'RESERVED' (an address that is managed by DHCP
2408+that is reserved for a specific client), 'RESERVED-ACTIVE' (same as
2409+reserved, but address is currently in use), 'ASSIGNED' (assigned
2410+manually or by some other mechanism), 'UNASSIGNED', 'NOTASSIGNABLE'.
2411+Syntax: IA5String Flags: SINGLE-VALUE
2412+
2413+Name: dhcpExpirationTime Description: This is the time the current lease
2414+for an address expires. Syntax: DateTime Flags: SINGLE-VALUE
2415+
2416+
2417+
2418+
2419+M. Meredith et al. Expires December 2001 [Page 7]
2420+
2421+
2422+
2423+
2424+
2425+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2426+
2427+
2428+Name: dhcpStartTimeOfState Description: This is the time of the last
2429+state change for a leased address. Syntax: DateTime Flags: SINGLE-VALUE
2430+
2431+Name: dhcpLastTransactionTime Description: This is the last time a valid
2432+DHCP packet was received from the client. Syntax: DateTime Flags:
2433+SINGLE-VALUE
2434+
2435+Name: dhcpBootpFlag Description: This indicates whether the address was
2436+assigned via BOOTP Syntax: Boolean Flags: SINGLE-VALUE
2437+
2438+Name: dhcpDomainName Description: This is the name of the domain sent to
2439+the client by the server. It is essentially the same as the value for
2440+DHCP option 15 sent to the client, and represents only the domain - not
2441+the full FQDN. To obtain the full FQDN assigned to the client you must
2442+prepend the "dhcpAssignedHostName" to this value with a ".". Syntax:
2443+IA5String Flags: SINGLE-VALUE
2444+
2445+Name: dhcpDnsStatus Description: This indicates the status of updating
2446+DNS resource records on behalf of the client by the DHCP server for this
2447+address. The value is a 16-bit bitmask that has the same values as
2448+specified by the Failover-DDNS option (see [FAILOVR]). Syntax: Integer
2449+Flags: SINGLE-VALUE
2450+
2451+Name: dhcpRequestedHostName Description: This is the hostname that was
2452+requested by the client. Syntax: IA5String Flags: SINGLE-VALUE
2453+
2454+Name: dhcpAssignedHostName Description: This is the actual hostname that
2455+was assigned to a client. It may not be the name that was requested by
2456+the client. The fully qualified domain name can be determined by
2457+appending the value of "dhcpDomainName" (with a dot separator) to this
2458+name. Syntax: IA5String Flags: SINGLE-VALUE
2459+
2460+Name: dhcpReservedForClient Description: This is the distinguished name
2461+of the "dhcpHost" that an address is reserved for. This may not be the
2462+same as the "dhcpAssignedToClient" attribute if the address is being
2463+reassigned but the current lease has not yet expired. Syntax: DN Flags:
2464+SINGLE-VALUE
2465+
2466+Name: dhcpAssignedToClient Description: This is the distinguished name
2467+of a "dhcpHost" that an address is currently assigned to. This
2468+attribute is only present in the class when the address is leased.
2469+Syntax: DN Flags: SINGLE-VALUE
2470+
2471+Name: dhcpRelayAgentInfo Description: If the client request was received
2472+via a relay agent, this contains information about the relay agent that
2473+was available from the DHCP request. This is a hex-encoded option
2474+value. Syntax: OctetString Flags: SINGLE-VALUE
2475+
2476+Name: dhcpErrorLog Description: Generic error log attribute that allows
2477+logging error conditions within a dhcpService or a dhcpSubnet, like no IP
2478+addresses available for lease. Syntax: IA5String
2479+
2480+M. Meredith et al. Expires December 2001 [Page 8]
2481+
2482+
2483+
2484+
2485+
2486+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2487+
2488+
2489+6.2. dhcpLeases Object Class
2490+
2491+This class represents an IP address. It may or may not be leaseable,
2492+and the object may exist even though a lease is not currently active for
2493+the associated IP address.
2494+
2495+It is recommended that all Lease objects for a single DHCP Service be
2496+centrally located within a single container. This ensures that the lease
2497+objects and the corresponding logs do not have to be relocated, when
2498+address ranges allocated to individual DHCP subnets and/or pools change.
2499+
2500+The schema definitions below are for readability the LDIF layout for
2501+this schema will follow in section 8.
2502+
2503+Name: dhcpLeases Description: This is the object that holds state
2504+information about an IP address. The cn (which is the IP address), and
2505+the current address-state are mandatory attributes. If the address is
2506+assigned then, some of the optional attributes will have valid data.
2507+Must: cn, dhcpAddressState May: dhcpExpirationTime,
2508+dhcpStartTimeOfState, dhcpLastTransactionTime, dhcpBootpFlag,
2509+dhcpDomainName, dhcpDnsStatus, dhcpRequestedHostName,
2510+dhcpAssignedHostName, dhcpReservedForClient, dhcpAssignedToClient,
2511+dhcpRelayAgentInfo, dhcpHWAddress
2512+
2513+6.3 Audit Log Information
2514+
2515+A dhcpLog object is created whenever a lease is assigned or released.
2516+This object is intended to be created under the corresponding dhcpLeases
2517+container, or dhcpPool, dhcpSubnet, dhcpSharedNetwork or dhcpService
2518+containers.
2519+
2520+The log information under the dhcpLeases container would be for
2521+addresses matching that lease information. The log information in the
2522+other containers could be used for errors, i.e. when a pool or subnet is
2523+out our addresses or if a server is not able to assign any more
2524+addresses for a particular dhcpService.
2525+
2526+Name: dhcpLog Description: This is the object that holds past
2527+information about an IP address. The cn is the time/date stamp when the
2528+address was assigned or released, the address state at the time, if the
2529+address was assigned or released. Must: cn May: dhcpAddressState,
2530+dhcpExpirationTime, dhcpStartTimeOfState, dhcpLastTransactionTime,
2531+dhcpBootpFlag, dhcpDomainName, dhcpDnsStatus, dhcpRequestedHostName,
2532+dhcpAssignedHostName, dhcpReservedForClient, dhcpAssignedToClient,
2533+dhcpRelayAgentInfo, dhcpHWAddress, dhcpErrorLog
2534+
2535+
2536+
2537+
2538+
2539+
2540+M. Meredith et al. Expires December 2001 [Page 9]
2541+
2542+
2543+
2544+
2545+
2546+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2547+
2548+
2549+7. Determining settings
2550+
2551+The dhcpStatements attribute is the key to DHC enhancements that may
2552+come along, and the different key words that a particular server
2553+implementation may use. This attribute can be used to hold conditional
2554+DHCP Statements and DHCP server parameters. Having a generic settings
2555+attribute that is just a string, allows this schema to be extensible and
2556+easy to configure.
2557+
2558+All of the attributes that end with DN are references to the class that
2559+precedes the DN e.g. the dhcpPrimaryDN and dhcpSecondaryDN attributes
2560+hold the Distinguished Names of the dhcpServer objects that are
2561+associated with the dhcpService object.
2562+
2563+8. LDIF format for attributes and classes.
2564+
2565+# Attributes
2566+
2567+( 2.16.840.1.113719.1.203.4.1 NAME 'dhcpPrimaryDN' DESC
2568+'The DN of the dhcpServer which is the primary server for the
2569+configuration.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
2570+
2571+( 2.16.840.1.113719.1.203.4.2 NAME 'dhcpSecondaryDN' DESC 'The DN of
2572+dhcpServer(s) which provide backup service for the configuration.'
2573+SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
2574+
2575+( 2.16.840.1.113719.1.203.4.3 NAME 'dhcpStatements' DESC 'Flexible
2576+storage for specific data depending on what object this exists in. Like
2577+conditional statements, server parameters, etc. This allows the standard
2578+to evolve without needing to adjust the schema.' SYNTAX
2579+1.3.6.1.4.1.1466.115.121.1.26 )
2580+
2581+( 2.16.840.1.113719.1.203.4.4 NAME 'dhcpRange' DESC 'The starting &
2582+ending IP Addresses in the range (inclusive), separated by a hyphen; if
2583+the range only contains one address, then just the address can be
2584+specified with no hyphen. Each range is defined as a separate value.'
2585+SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
2586+
2587+( 2.16.840.1.113719.1.203.4.5 NAME 'dhcpPermitList' DESC 'This attribute
2588+contains the permit lists associated with a pool. Each permit list is
2589+defined as a separate value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
2590+
2591+( 2.16.840.1.113719.1.203.4.6 NAME 'dhcpNetMask' DESC 'The subnet mask
2592+length for the subnet. The mask can be easily computed from this
2593+length.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
2594+
2595+( 2.16.840.1.113719.1.203.4.7 NAME 'dhcpOption' DESC 'Encoded option
2596+values to be sent to clients. Each value represents a single option and
2597+contains (OptionTag, Length, OptionValue) encoded in the format used by
2598+DHCP.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
2599+
2600+M. Meredith et al. Expires December 2001 [Page 10]
2601+
2602+
2603+
2604+
2605+
2606+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2607+
2608+
2609+( 2.16.840.1.113719.1.203.4.8 NAME 'dhcpClassData' DESC 'Encoded text
2610+string or list of bytes expressed in hexadecimal, separated by colons.
2611+Clients match subclasses based on matching the class data with the
2612+results of match or spawn with statements in the class name
2613+declarations.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
2614+
2615+( 2.16.840.1.113719.1.203.4.9 NAME 'dhcpOptionsDN' DESC 'The
2616+distinguished name(s) of the dhcpOption objects containing the
2617+configuration options provided by the server.' SYNTAX
2618+1.3.6.1.4.1.1466.115.121.1.12 )
2619+
2620+( 2.16.840.1.113719.1.203.4.10 NAME 'dhcpHostDN' DESC 'the distinguished
2621+name(s) of the dhcpHost objects.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
2622+
2623+( 2.16.840.1.113719.1.203.4.11 NAME 'dhcpPoolDN' DESC 'The distinguished
2624+name(s) of pools.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
2625+
2626+( 2.16.840.1.113719.1.203.4.12 NAME 'dhcpGroupDN' DESC 'The
2627+distinguished name(s) of the groups.' SYNTAX
2628+1.3.6.1.4.1.1466.115.121.1.12 )
2629+
2630+( 2.16.840.1.113719.1.203.4.13 NAME 'dhcpSubnetDN' DESC 'The
2631+distinguished name(s) of the subnets.' SYNTAX
2632+1.3.6.1.4.1.1466.115.121.1.12 )
2633+
2634+( 2.16.840.1.113719.1.203.4.14 NAME 'dhcpLeaseDN' DESC 'The
2635+distinguished name of a client address.' SYNTAX
2636+1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE)
2637+
2638+( 2.16.840.1.113719.1.203.4.15 NAME 'dhcpLeasesDN' DESC 'The
2639+distinguished name(s) client addresses.' SYNTAX
2640+1.3.6.1.4.1.1466.115.121.1.12 )
2641+
2642+( 2.16.840.1.113719.1.203.4.16 NAME 'dhcpClassesDN' DESC 'The
2643+distinguished name(s) of a class(es) in a subclass.' SYNTAX
2644+1.3.6.1.4.1.1466.115.121.1.12 )
2645+
2646+( 2.16.840.1.113719.1.203.4.17 NAME 'dhcpSubclassesDN' DESC 'The
2647+distinguished name(s) of subclass(es).' SYNTAX
2648+1.3.6.1.4.1.1466.115.121.1.12 )
2649+
2650+( 2.16.840.1.113719.1.203.4.18 NAME 'dhcpSharedNetworkDN' DESC 'The
2651+distinguished name(s) of sharedNetworks.' SYNTAX
2652+1.3.6.1.4.1.1466.115.121.1.12 )
2653+
2654+( 2.16.840.1.113719.1.203.4.19 NAME 'dhcpServiceDN' DESC 'The DN of
2655+dhcpService object(s)which contain the configuration information. Each
2656+dhcpServer object has this attribute identifying the DHCP
2657+
2658+
2659+
2660+M. Meredith et al. Expires December 2001 [Page 11]
2661+
2662+
2663+
2664+
2665+
2666+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2667+
2668+
2669+configuration(s) that the server is associated with.' SYNTAX
2670+1.3.6.1.4.1.1466.115.121.1.12 )
2671+
2672+( 2.16.840.1.113719.1.203.4.20 NAME 'dhcpVersion' DESC 'The version
2673+attribute of this object.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
2674+VALUE )
2675+
2676+( 2.16.840.1.113719.1.203.4.21 NAME 'dhcpImplementation' DESC
2677+'Description of the DHCP Server implementation e.g. DHCP Server's
2678+vendor.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
2679+
2680+( 2.16.840.1.113719.1.203.4.22 NAME 'dhcpAddressState' DESC 'This stores
2681+information about the current binding-status of an address. For dynamic
2682+addresses managed by DHCP, the values should be restricted to the
2683+following: "FREE", "ACTIVE", "EXPIRED", "RELEASED", "RESET",
2684+"ABANDONED", "BACKUP". For other addresses, it SHOULD be one of the
2685+following: "UNKNOWN", "RESERVED" (an address that is managed by DHCP
2686+that is reserved for a specific client), "RESERVED-ACTIVE" (same as
2687+reserved, but address is currently in use), "ASSIGNED" (assigned
2688+manually or by some other mechanism), "UNASSIGNED", "NOTASSIGNABLE".'
2689+SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
2690+
2691+( 2.16.840.1.113719.1.203.4.23 NAME 'dhcpExpirationTime' DESC 'This is
2692+the time the current lease for an address expires.' SYNTAX
2693+1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
2694+
2695+( 2.16.840.1.113719.1.203.4.24 NAME 'dhcpStartTimeOfState' DESC 'This is
2696+the time of the last state change for a leased address.' SYNTAX
2697+1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
2698+
2699+( 2.16.840.1.113719.1.203.4.25 NAME 'dhcpLastTransactionTime' DESC 'This
2700+is the last time a valid DHCP packet was received from the client.'
2701+SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
2702+
2703+( 2.16.840.1.113719.1.203.4.26 NAME 'dhcpBootpFlag' DESC 'This indicates
2704+whether the address was assigned via BOOTP.' SYNTAX
2705+1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
2706+
2707+( 2.16.840.1.113719.1.203.4.27 NAME 'dhcpDomainName' DESC 'This is the
2708+name of the domain sent to the client by the server. It is essentially
2709+the same as the value for DHCP option 15 sent to the client, and
2710+represents only the domain - not the full FQDN. To obtain the full FQDN
2711+assigned to the client you must prepend the "dhcpAssignedHostName" to
2712+this value with a ".".' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
2713+VALUE )
2714+
2715+( 2.16.840.1.113719.1.203.4.28 NAME 'dhcpDnsStatus' DESC 'This indicates
2716+the status of updating DNS resource records on behalf of the client by
2717+
2718+
2719+
2720+M. Meredith et al. Expires December 2001 [Page 12]
2721+
2722+
2723+
2724+
2725+
2726+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2727+
2728+
2729+the DHCP server for this address. The value is a 16-bit bitmask.'
2730+SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
2731+
2732+( 2.16.840.1.113719.1.203.4.29 NAME 'dhcpRequestedHostName' DESC 'This
2733+is the hostname that was requested by the client.' SYNTAX
2734+1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
2735+
2736+( 2.16.840.1.113719.1.203.4.30 NAME 'dhcpAssignedHostName' DESC 'This is
2737+the actual hostname that was assigned to a client. It may not be the
2738+name that was requested by the client. The fully qualified domain name
2739+can be determined by appending the value of "dhcpDomainName" (with a dot
2740+separator) to this name.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
2741+VALUE )
2742+
2743+( 2.16.840.1.113719.1.203.4.31 NAME 'dhcpReservedForClient' DESC 'The
2744+distinguished name of a "dhcpClient" that an address is reserved for.
2745+This may not be the same as the "dhcpAssignedToClient" attribute if the
2746+address is being reassigned but the current lease has not yet expired.'
2747+SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
2748+
2749+( 2.16.840.1.113719.1.203.4.32 NAME 'dhcpAssignedToClient' DESC 'This is
2750+the distinguished name of a "dhcpClient" that an address is currently
2751+assigned to. This attribute is only present in the class when the
2752+address is leased.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
2753+
2754+( 2.16.840.1.113719.1.203.4.33 NAME 'dhcpRelayAgentInfo' DESC 'If the
2755+client request was received via a relay agent, this contains information
2756+about the relay agent that was available from the DHCP request. This is
2757+a hex-encoded option value.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
2758+SINGLE-VALUE )
2759+
2760+( 2.16.840.1.113719.1.203.4.34 NAME 'dhcpHWAddress' DESC 'The clients
2761+hardware address that requested this IP address.' SYNTAX
2762+1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
2763+
2764+( 2.16.840.1.113719.1.203.4.35 NAME 'dhcpHashBucketAssignment' DESC
2765+'HashBucketAssignment bit map for the DHCP Server, as defined in DHC
2766+Load Balancing Algorithm [RFC 3074].' SYNTAX
2767+1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
2768+
2769+( 2.16.840.1.113719.1.203.4.36 NAME 'dhcpDelayedServiceParameter' DESC
2770+'Delay in seconds corresponding to Delayed Service Parameter
2771+configuration, as defined in DHC Load Balancing Algorithm [RFC 3074]. '
2772+SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
2773+
2774+( 2.16.840.1.113719.1.203.4.37 NAME 'dhcpMaxClientLeadTime' DESC
2775+'Maximum Client Lead Time configuration in seconds, as defined in DHCP
2776+Failover Protocol [FAILOVR]' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
2777+
2778+
2779+
2780+M. Meredith et al. Expires December 2001 [Page 13]
2781+
2782+
2783+
2784+
2785+
2786+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2787+
2788+
2789+SINGLE-VALUE )
2790+
2791+( 2.16.840.1.113719.1.203.4.38 NAME 'dhcpFailOverEndpointState' DESC
2792+'Server (Failover Endpoint) state, as defined in DHCP Failover Protocol
2793+[FAILOVR]' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
2794+
2795+( 2.16.840.1.113719.1.203.4.39 NAME 'dhcpErrorLog' DESC
2796+Generic error log attribute that allows logging error conditions within a
2797+dhcpService or a dhcpSubnet, like no IP addresses available for lease.
2798+SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
2799+
2800+#Classes
2801+
2802+( 2.16.840.1.113719.1.203.6.1 NAME 'dhcpService' DESC ' Service object
2803+that represents the actual DHCP Service configuration. This is a
2804+container object.' SUP top MUST (cn $ dhcpPrimaryDN) MAY
2805+(dhcpSecondaryDN $ dhcpSharedNetworkDN $ dhcpSubnetDN $ dhcpGroupDN $
2806+dhcpHostDN $ dhcpClassesDN $ dhcpOptionsDN $ dhcpStatements ) )
2807+
2808+( 2.16.840.1.113719.1.203.6.2 NAME 'dhcpSharedNetwork' DESC 'This stores
2809+configuration information for a shared network.' SUP top MUST cn MAY
2810+(dhcpSubnetDN $ dhcpPoolDN $ dhcpOptionsDN $ dhcpStatements) X-
2811+NDS_CONTAINMENT ('dhcpService' ) )
2812+
2813+( 2.16.840.1.113719.1.203.6.3 NAME 'dhcpSubnet' DESC 'This class defines
2814+a subnet. This is a container object.' SUP top MUST ( cn $ dhcpNetMask )
2815+MAY (dhcpRange $ dhcpPoolDN $ dhcpGroupDN $ dhcpHostDN $ dhcpClassesDN $
2816+dhcpLeasesDN $ dhcpOptionsDN $ dhcpStatements) X-NDS_CONTAINMENT
2817+('dhcpService' 'dhcpSharedNetwork') )
2818+
2819+( 2.16.840.1.113719.1.203.6.4 NAME 'dhcpPool' DESC 'This stores
2820+configuration information about a pool.' SUP top MUST ( cn $ dhcpRange )
2821+MAY (dhcpClassesDN $ dhcpPermitList $ dhcpLeasesDN $ dhcpOptionsDN $
2822+dhcpStatements) X-NDS_CONTAINMENT ('dhcpSubnet' 'dhcpSharedNetwork') )
2823+
2824+( 2.16.840.1.113719.1.203.6.5 NAME 'dhcpGroup' DESC 'Group object that
2825+lists host DNs and parameters. This is a container object.' SUP top MUST
2826+cn MAY ( dhcpHostDN $ dhcpOptionsDN $ dhcpStatements ) X-NDS_CONTAINMENT
2827+('dhcpSubnet' 'dhcpService' ) )
2828+
2829+( 2.16.840.1.113719.1.203.6.6 NAME 'dhcpHost' DESC 'This represents
2830+information about a particular client' SUP top MUST cn MAY (dhcpLeaseDN
2831+$ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements) X-NDS_CONTAINMENT
2832+('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
2833+
2834+( 2.16.840.1.113719.1.203.6.7 NAME 'dhcpClass' DESC 'Represents
2835+information about a collection of related clients.' SUP top MUST cn MAY
2836+(dhcpSubClassesDN $ dhcpOptionsDN $ dhcpStatements) X-NDS_CONTAINMENT
2837+('dhcpService' 'dhcpSubnet' ) )
2838+
2839+( 2.16.840.1.113719.1.203.6.8 NAME 'dhcpSubClass' DESC 'Represents
2840+information about a collection of related classes.' SUP top MUST cn MAY
2841+(dhcpClassData $ dhcpOptionsDN $ dhcpStatements) X-NDS_CONTAINMENT
2842+
2843+
2844+
2845+M. Meredith et al. Expires December 2001 [Page 14]
2846+
2847+
2848+
2849+
2850+
2851+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2852+
2853+
2854+'dhcpClass' )
2855+
2856+( 2.16.840.1.113719.1.203.6.9 NAME 'dhcpOptions' DESC 'Represents
2857+information about a collection of options defined.' SUP top MUST cn MAY
2858+( dhcpOption ) X-NDS_CONTAINMENT ('dhcpService' 'dhcpSharedNetwork'
2859+'dhcpSubnet' 'dhcpPool' 'dhcpGroup' 'dhcpHost' 'dhcpClass' )
2860+
2861+( 2.16.840.1.113719.1.203.6.10 NAME 'dhcpLeases' DESC 'This class
2862+represents an IP Address, which may or may not have been leased.' SUP
2863+top MUST ( cn $ dhcpAddressState ) MAY ( dhcpExpirationTime $
2864+dhcpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $
2865+dhcpDomainName $ dhcpDnsStatus $ dhcpRequestedHostName $
2866+dhcpAssignedHostName $ dhcpReservedForClient $ dhcpAssignedToClient $
2867+dhcpRelayAgentInfo $ dhcpHWAddress ) X-NDS_CONTAINMENT ( 'dhcpService'
2868+'dhcpSubnet' 'dhcpPool') )
2869+
2870+( 2.16.840.1.113719.1.203.6.11 NAME 'dhcpLog' DESC 'This is the object
2871+that holds past information about the IP address. The cn is the
2872+time/date stamp when the address was assigned or released, the address
2873+state at the time, if the address was assigned or released.' SUP top
2874+MUST ( cn ) MAY ( dhcpAddressState $ dhcpExpirationTime $
2875+dhcpStartTimeOfState $ dhcpLastTransactionTime $ dhcpBootpFlag $
2876+dhcpDomainName $ dhcpDnsStatus $ dhcpRequestedHostName $
2877+dhcpAssignedHostName $ dhcpReservedForClient $ dhcpAssignedToClient $
2878+dhcpRelayAgentInfo $ dhcpHWAddress $ dhcpErrorLog) X-NDS_CONTAINMENT
2879+('dhcpLeases' 'dhcpPool' 'dhcpSubnet' 'dhcpSharedNetwork' 'dhcpService' ) )
2880+
2881+( 2.16.840.1.113719.1.203.6.12 NAME 'dhcpServer' DESC 'DHCP Server
2882+Object' SUP top MUST (cn, dhcpServiceDN) MAY (dhcpVersion $
2883+dhcpImplementation $ dhcpHashBucketAssignment $
2884+dhcpDelayedServiceParameter $ dhcpMaxClientLeadTime $
2885+dhcpFailOverEndpointState $ dhcpStatements) X-NDS_CONTAINMENT ('O' 'OU'
2886+'dc') )
2887+
2888+9. Security Considerations
2889+
2890+Since the DHCP Configuration information is stored in a directory, the
2891+security of the information is limited to the security offered by the
2892+directory including the security of the objects within that directory.
2893+
2894+10. Intellectual Property Rights Notices
2895+
2896+The IETF takes no position regarding the validity or scope of any
2897+intellectual property or other rights that might be claimed to pertain
2898+to the implementation or use of the technology described in this
2899+document or the extent to which any license under such rights might or
2900+might not be available; neither does it represent that it has made any
2901+effort to identify any such rights. Information on the IETF's
2902+procedures with respect to rights in standards-track and standards-
2903+
2904+
2905+
2906+M. Meredith et al. Expires December 2001 [Page 15]
2907+
2908+
2909+
2910+
2911+
2912+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2913+
2914+
2915+related documentation can be found in BCP-11. Copies of claims of
2916+rights made available for publication and any assurances of licenses to
2917+be made available, or the result of an attempt made to obtain a general
2918+license or permission for the use of such proprietary rights by
2919+implementors or users of this specification can be obtained from the
2920+IETF Secretariat.
2921+
2922+The IETF invites any interested party to bring to its attention any
2923+copyrights, patents or patent applications, or other proprietary rights
2924+which may cover technology that may be required to practice this
2925+standard. Please address the information to the IETF Executive
2926+Director.
2927+
2928+11. Full Copyright Statement
2929+
2930+Copyright (C) The Internet Society (2001). All Rights Reserved.
2931+
2932+This document and translations of it may be copied and furnished to
2933+others, and derivative works that comment on or otherwise explain it or
2934+assist in its implementation may be prepared, copied, published and
2935+distributed, in whole or in part, without restriction of any kind,
2936+provided that the above copyright notice and this paragraph are included
2937+on all such copies and derivative works. However, this document itself
2938+may not be modified in any way, such as by removing the copyright notice
2939+or references to the Internet Society or other Internet organizations,
2940+except as needed for the purpose of developing Internet standards in
2941+which case the procedures for copyrights defined in the Internet
2942+Standards process must be followed, or as required to translate it into
2943+languages other than English.
2944+
2945+The limited permissions granted above are perpetual and will not be
2946+revoked by the Internet Society or its successors or assigns.
2947+
2948+This document and the information contained herein is provided on an "AS
2949+IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK
2950+FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT
2951+LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT
2952+INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
2953+FITNESS FOR A PARTICULAR PURPOSE.
2954+
2955+12. References
2956+
2957+[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
2958+March 1997.
2959+
2960+[RFC2132] Alexander, S., Droms, R., "DHCP Options and BOOTP Vendor
2961+Extensions", RFC 2132, March 1997.
2962+
2963+
2964+
2965+
2966+M. Meredith et al. Expires December 2001 [Page 16]
2967+
2968+
2969+
2970+
2971+
2972+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
2973+
2974+
2975+[MSDHCP] Gu, Y., Vyaghrapuri, R., "An LDAP Schema for Dynamic Host
2976+Configuration Protocol Service", Internet Draft <draft-gu-dhcp-ldap-
2977+schema-00.txt>, August 1998.
2978+
2979+[NOVDHCP] Miller, T., Patel, A., Rao, P., "Lightweight Directory Access
2980+Protocol (v3): Schema for Dynamic Host Configuration Protocol (DHCP)",
2981+Internet Draft <draft-miller-dhcp-ldap-schema-00.txt>, June 1998.
2982+
2983+[FAILOVR] Droms, R., Rabil, G., Dooley, M., Kapur, A., Gonczi, S., Volz,
2984+B., "DHCP Failover Protocol", Internet Draft <draft-ietf-dhc-
2985+failover-08.txt>, July 2000.
2986+
2987+[RFC 3074] Volz B., Gonczi S., Lemon T., Stevens R., "DHC Load Balancing
2988+Algorithm", February 2001
2989+
2990+[AGENT] Patrick, M., "DHCP Relay Agent Information Option", Internet
2991+Draft <draft-ietf-dhc-agent-options-09.txt>, March 2000.
2992+
2993+[DHCPOPT] Carney, M., "New Option Review Guidelines and Additional
2994+Option Namespace", Internet Draft <draft-ietf-dhc-
2995+option_review_and_namespace-01.txt>, October 1999.
2996+
2997+[POLICY] Strassner, J., Elleson, E., Moore, B., "Policy Framework LDAP
2998+Core Schema", Internet Draft <draft-ietf-policy-core-schema-06.txt>,
2999+November 1999.
3000+
3001+[RFC2251] Wahl, M., Howes, T., Kille, S., "Lightweight Directory Access
3002+Protocol (v3)", RFC 2251, December 1997.
3003+
3004+[RFC2252] Wahl, M., Coulbeck, A., Howes, T., Kille, S., "Lightweight
3005+Directory Access Protocol (v3) Attribute Syntax Definitions", RFC 2252,
3006+December 1997.
3007+
3008+[RFC2255] Howes, T., Smith, M., "The LDAP URL Format", RFC 2255,
3009+December 1997.
3010+
3011+[RFC951] Croft, B., Gilmore, J., "Bootstrap Protocol (BOOTP)", RFC 951,
3012+September 1985.
3013+
3014+[RFC2119] Bradner, S. "Key words for use in RFCs to Indicate Requirement
3015+Levels", RFC 2119, March 1997.
3016+
3017+13. Acknowledgments
3018+
3019+This work is partially based on a previous draft draft-ietf-dhc-
3020+schema-02.doc.
3021+
3022+
3023+
3024+
3025+
3026+M. Meredith et al. Expires December 2001 [Page 17]
3027+
3028+
3029+
3030+
3031+
3032+INTERNET-DRAFT LDAP Schema for DHCP 16 June 2001
3033+
3034+
3035+14. Author's Addresses
3036+
3037+Comments regarding this draft may be sent to the authors at the
3038+following address:
3039+
3040+Mark Meredith
3041+Mark Hinckley
3042+Novell Inc.
3043+1800 S. Novell Place
3044+Provo, Utah 84606
3045+
3046+Vijay K. Nanjundaswamy
3047+Novell Software Development (I) Ltd
3048+49/1 & 49/3, Garvebhavi Palya,
3049+7th Mile, Hosur Road
3050+Bangalore 560068
3051+
3052+email: mark_meredith@novell.com
3053+email: knvijay@novell.com
3054+email: mhinckley@novell.com
3055+
3056+This Internet Draft expires December 16, 2001.
3057+
3058+
3059+
3060+
3061+
3062+
3063+
3064+
3065+
3066+
3067+
3068+
3069+
3070+
3071+
3072+
3073+
3074+
3075+
3076+
3077+
3078+
3079+
3080+
3081+
3082+
3083+
3084+
3085+
3086+M. Meredith et al. Expires December 2001 [Page 18]
3087+
3088+
3089+
3090+
a37573f1
JR		 3091diff -Naur dhcp-3.0.5/dst/Makefile.dist dhcp-3.0.5-ldap/dst/Makefile.dist
3092--- dhcp-3.0.5/dst/Makefile.dist 2004-06-10 13:59:28.000000000 -0400
3093+++ dhcp-3.0.5-ldap/dst/Makefile.dist 2007-02-23 13:41:54.000000000 -0500
3094@@ -23,12 +23,13 @@
3095
3096 SRC = dst_support.c dst_api.c hmac_link.c md5_dgst.c base64.c prandom.c
3097 OBJ = dst_support.o dst_api.o hmac_link.o md5_dgst.o base64.o prandom.o
3098+OBJ_NM5= dst_support.o dst_api.o hmac_link.o base64.o prandom.o
3099 HDRS = dst_internal.h md5.h md5_locl.h
3100
3101 INCLUDES = $(BINDINC) -I$(TOP)/includes
3102 CFLAGS = $(DEBUG) $(PREDEFINES) $(INCLUDES) $(COPTS) -DHMAC_MD5 -DMINIRES_LIB
3103
3104-all: libdst.a
3105+all: libdst.a libdst-nomd5.a
3106
3107 install:
3108
3109@@ -37,11 +38,16 @@
3110 ar cruv libdst.a $(OBJ)
3111 $(RANLIB) libdst.a
3112
3113+libdst-nomd5.a: $(OBJ_NM5)
3114+ rm -f libdst-nomd5.a
3115+ ar cruv libdst-nomd5.a $(OBJ_NM5)
3116+ $(RANLIB) libdst-nomd5.a
3117+
3118 depend:
3119 $(MKDEP) $(INCLUDES) $(PREDEFINES) $(SRC)
3120
3121 clean:
3122- -rm -f $(OBJ) libdst.a
3123+ -rm -f $(OBJ) libdst.a libdst-nomd5.a
3124
3125 realclean: clean
3126 -rm -f *~ $(CATMANPAGES) $(SEDMANPAGES)
3127diff -Naur dhcp-3.0.5/includes/dhcpd.h dhcp-3.0.5-ldap/includes/dhcpd.h
3128--- dhcp-3.0.5/includes/dhcpd.h 2006-05-17 16:16:59.000000000 -0400
3129+++ dhcp-3.0.5-ldap/includes/dhcpd.h 2007-02-23 13:13:36.000000000 -0500
3150c1ff 3130@@ -79,6 +79,11 @@
1097e9ca 3131 #include <isc-dhcp/result.h>
3132 #include <omapip/omapip_p.h>
3133
3134+#if defined(LDAP_CONFIGURATION)
3135+# include <ldap.h>
3136+# include <sys/utsname.h> /* for uname() */
3137+#endif
3138+
e0a22902
JR		 3139 #if !defined (BYTE_NAME_HASH_SIZE)
3140 # define BYTE_NAME_HASH_SIZE 401 /* Default would be rediculous. */
3141 #endif
3150c1ff 3142@@ -139,6 +144,8 @@
1097e9ca 3143 char *inbuf;
3144 unsigned bufix, buflen;
3145 unsigned bufsiz;
3146+
a37573f1 3147+ int (*read_function) (struct parse *);
1097e9ca 3148 };
3149
3150 /* Variable-length array of data. */
a37573f1 3151@@ -244,6 +251,32 @@
1097e9ca 3152 u_int8_t hbuf [17];
3153 };
3154
3155+#if defined(LDAP_CONFIGURATION)
3156+# define LDAP_BUFFER_SIZE 8192
3157+# define LDAP_METHOD_STATIC 0
3158+# define LDAP_METHOD_DYNAMIC 1
a37573f1
JR		 3159+#if defined (USE_SSL)
3160+# define LDAP_SSL_OFF 0
3161+# define LDAP_SSL_ON 1
3162+# define LDAP_SSL_TLS 2
3163+# define LDAP_SSL_LDAPS 3
3164+#endif
1097e9ca 3165+
3166+/* This is a tree of the current configuration we are building from LDAP */
3167+
3168+struct ldap_config_stack {
3169+ LDAPMessage * res; /* Pointer returned from ldap_search */
3170+ LDAPMessage * ldent; /* Current item in LDAP that we're processing
3171+ in res */
3172+ int close_brace; /* Put a closing } after we're through with
3173+ this item */
3174+ int processed; /* We set this flag if this base item has been
3175+ processed. After this base item is processed,
3176+ we can start processing the children */
3177+ struct ldap_config_stack *next;
3178+};
3179+#endif
3180+
3181 typedef enum {
3182 server_startup = 0,
3183 server_running = 1,
a37573f1 3184@@ -426,6 +459,29 @@
1097e9ca 3185 # define DEFAULT_PING_TIMEOUT 1
3186 #endif
3187
3188+#if defined(LDAP_CONFIGURATION)
3189+# define SV_LDAP_SERVER 47
3190+# define SV_LDAP_PORT 48
3191+# define SV_LDAP_USERNAME 49
3192+# define SV_LDAP_PASSWORD 50
3193+# define SV_LDAP_BASE_DN 51
3194+# define SV_LDAP_METHOD 52
3195+# define SV_LDAP_DEBUG_FILE 53
a37573f1
JR		 3196+# define SV_LDAP_DHCP_SERVER_CN 54
3197+# define SV_LDAP_REFERRALS 55
3198+#if defined (USE_SSL)
3199+# define SV_LDAP_SSL 56
3200+# define SV_LDAP_TLS_REQCERT 57
3201+# define SV_LDAP_TLS_CA_FILE 58
3202+# define SV_LDAP_TLS_CA_DIR 59
3203+# define SV_LDAP_TLS_CERT 60
3204+# define SV_LDAP_TLS_KEY 61
3205+# define SV_LDAP_TLS_CRLCHECK 62
3206+# define SV_LDAP_TLS_CIPHERS 63
3207+# define SV_LDAP_TLS_RANDFILE 64
3208+#endif
1097e9ca 3209+#endif
3210+
3211 #if !defined (DEFAULT_DEFAULT_LEASE_TIME)
3212 # define DEFAULT_DEFAULT_LEASE_TIME 43200
3213 #endif
a37573f1 3214@@ -1531,7 +1587,7 @@
1097e9ca 3215 char *quotify_string (const char *, const char *, int);
3216 char *quotify_buf (const unsigned char *, unsigned, const char *, int);
3217 char *print_base64 (const unsigned char *, unsigned, const char *, int);
3218-char *print_hw_addr PROTO ((int, int, unsigned char *));
3219+char *print_hw_addr PROTO ((const int, const int, const unsigned char *));
3220 void print_lease PROTO ((struct lease *));
3221 void dump_raw PROTO ((const unsigned char *, unsigned));
3222 void dump_packet_option (struct option_cache *, struct packet *,
a37573f1 3223@@ -2632,3 +2688,19 @@
1097e9ca 3224 #endif /* FAILOVER_PROTOCOL */
3225
3226 const char *binding_state_print (enum failover_state);
3227+
3228+/* ldap.c */
3229+#if defined(LDAP_CONFIGURATION)
3230+extern struct enumeration ldap_methods;
a37573f1
JR		 3231+#if defined (USE_SSL)
3232+extern struct enumeration ldap_ssl_usage_enum;
3233+extern struct enumeration ldap_tls_reqcert_enum;
3234+extern struct enumeration ldap_tls_crlcheck_enum;
3235+#endif
1097e9ca 3236+isc_result_t ldap_read_config (void);
3237+int find_haddr_in_ldap (struct host_decl **, int, unsigned,
3238+ const unsigned char *, const char *, int);
3239+int find_subclass_in_ldap (struct class *, struct class **,
3240+ struct data_string *);
3241+#endif
3242+
a37573f1
JR		 3243diff -Naur dhcp-3.0.5/includes/ldap_casa.h dhcp-3.0.5-ldap/includes/ldap_casa.h
3244--- dhcp-3.0.5/includes/ldap_casa.h 1969-12-31 19:00:00.000000000 -0500
3245+++ dhcp-3.0.5-ldap/includes/ldap_casa.h 2006-12-14 10:03:41.000000000 -0500
3246@@ -0,0 +1,83 @@
3247+/* ldap_casa.h
3248+
3249+ Definition for CASA modules... */
3250+
3251+/* Copyright (c) 2004 Internet Systems Consorium, Inc. ("ISC")
3252+ * Copyright (c) 1995-2003 Internet Software Consortium.
3253+ * Copyright (c) 2006 Novell, Inc.
3254+
3255+ * All rights reserved.
3256+ * Redistribution and use in source and binary forms, with or without
3257+ * modification, are permitted provided that the following conditions are met:
3258+ * 1.Redistributions of source code must retain the above copyright notice,
3259+ * this list of conditions and the following disclaimer.
3260+ * 2.Redistributions in binary form must reproduce the above copyright notice,
3261+ * this list of conditions and the following disclaimer in the documentation
3262+ * and/or other materials provided with the distribution.
3263+ * 3.Neither the name of ISC, ISC DHCP, nor the names of its contributors
3264+ * may be used to endorse or promote products derived from this software
3265+ * without specific prior written permission.
3266+
3267+ * THIS SOFTWARE IS PROVIDED BY INTERNET SYSTEMS CONSORTIUM AND CONTRIBUTORS
3268+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
3269+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
3270+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ISC OR CONTRIBUTORS BE LIABLE
3271+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
3272+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
3273+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3274+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3275+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
3276+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
3277+ * POSSIBILITY OF SUCH DAMAGE.
3278+
3279+ * This file was written by S Kalyanasundaram <skalyanasundaram@novell.com>
3280+ */
3281+
3282+#if defined(LDAP_CASA_AUTH)
3283+#ifndef __LDAP_CASA_H__
3284+#define __LDAP_CASA_H__
3285+
3286+#include <micasa_mgmd.h>
3287+#include <dlfcn.h>
3288+#include <string.h>
3289+
3290+#define MICASA_LIB "libmicasa.so.1"
3291+
3292+SSCS_TYPEDEF_LIBCALL(int, CASA_GetCredential_T)
3293+(
3294+ uint32_t ssFlags,
3295+ SSCS_SECRET_ID_T *appSecretID,
3296+ SSCS_SECRET_ID_T *sharedSecretID,
3297+ uint32_t *credentialType,
3298+ void *credential,
3299+ SSCS_EXT_T *ext
3300+);
3301+SSCS_TYPEDEF_LIBCALL(int, CASA_SetCredential_T)
3302+(
3303+ uint32_t ssFlags,
3304+ SSCS_SECRET_ID_T *appSecretID,
3305+ SSCS_SECRET_ID_T *sharedSecretID,
3306+ uint32_t credentialType,
3307+ void *credential,
3308+ SSCS_EXT_T *ext
3309+);
3310+
3311+SSCS_TYPEDEF_LIBCALL(int, CASA_RemoveCredential_T)
3312+(
3313+ uint32_t ssFlags,
3314+ SSCS_SECRET_ID_T *appSecretID,
3315+ SSCS_SECRET_ID_T *sharedSecretID,
3316+ SSCS_EXT_T *ext
3317+);
3318+static CASA_GetCredential_T p_miCASAGetCredential = NULL;
3319+static CASA_SetCredential_T p_miCASASetCredential = NULL;
3320+static CASA_RemoveCredential_T p_miCASARemoveCredential = NULL;
3321+static void *casaIDK = NULL;
3322+
3323+int load_casa(void);
3324+static void release_casa(void);
3325+int load_uname_pwd_from_miCASA(char **, char **);
3326+
3327+#endif /* __LDAP_CASA_H__ */
3328+#endif /* LDAP_CASA_AUTH */
3329+
3330diff -Naur dhcp-3.0.5/includes/site.h dhcp-3.0.5-ldap/includes/site.h
3331--- dhcp-3.0.5/includes/site.h 2002-03-12 13:33:39.000000000 -0500
3332+++ dhcp-3.0.5-ldap/includes/site.h 2006-12-14 10:03:41.000000000 -0500
1097e9ca 3333@@ -177,3 +177,13 @@
3334 traces. */
3335
3336 #define TRACING
3337+
3338+/* Define this if you want to read your config from LDAP. Read README.ldap
3339+ about how to set this up */
3340+
3341+#define LDAP_CONFIGURATION
3342+
3343+/* Define this if you want to enable LDAP over a SSL connection. You will need
3344+ to add -lcrypto -lssl to the LIBS= line of server/Makefile */
3345+
a37573f1
JR		 3346+#define USE_SSL
3347diff -Naur dhcp-3.0.5/server/Makefile.dist dhcp-3.0.5-ldap/server/Makefile.dist
3348--- dhcp-3.0.5/server/Makefile.dist 2004-06-10 13:59:50.000000000 -0400
3349+++ dhcp-3.0.5-ldap/server/Makefile.dist 2007-02-23 13:41:54.000000000 -0500
3350@@ -25,14 +25,14 @@
1097e9ca 3351 CATMANPAGES = dhcpd.cat8 dhcpd.conf.cat5 dhcpd.leases.cat5
3352 SEDMANPAGES = dhcpd.man8 dhcpd.conf.man5 dhcpd.leases.man5
3353 SRCS = dhcpd.c dhcp.c bootp.c confpars.c db.c class.c failover.c \
e0a22902 3354- omapi.c mdb.c stables.c salloc.c ddns.c dhcpleasequery.c
a37573f1 3355+ ldap.c ldap_casa.c omapi.c mdb.c stables.c salloc.c ddns.c dhcpleasequery.c
1097e9ca 3356 OBJS = dhcpd.o dhcp.o bootp.o confpars.o db.o class.o failover.o \
e0a22902 3357- omapi.o mdb.o stables.o salloc.o ddns.o dhcpleasequery.o
a37573f1 3358+ ldap.o ldap_casa.o omapi.o mdb.o stables.o salloc.o ddns.o dhcpleasequery.o
1097e9ca 3359 PROG = dhcpd
3360 MAN = dhcpd.8 dhcpd.conf.5 dhcpd.leases.5
3361
a37573f1
JR		 3362 INCLUDES = -I$(TOP) $(BINDINC) -I$(TOP)/includes
3363-DHCPLIB = ../common/libdhcp.a $(BINDLIB) ../omapip/libomapi.a ../dst/libdst.a
3364+DHCPLIB = ../common/libdhcp.a $(BINDLIB) ../omapip/libomapi.a ../dst/libdst-nomd5.a -lssl -lcrypto -lldap -llber
3365 CFLAGS = $(DEBUG) $(PREDEFINES) $(INCLUDES) $(COPTS)
3366
3367 all: $(PROG) $(CATMANPAGES)
3368diff -Naur dhcp-3.0.5/server/class.c dhcp-3.0.5-ldap/server/class.c
3369--- dhcp-3.0.5/server/class.c 2004-06-10 13:59:51.000000000 -0400
3370+++ dhcp-3.0.5-ldap/server/class.c 2006-12-14 10:03:41.000000000 -0500
3150c1ff 3371@@ -90,6 +90,7 @@
1097e9ca 3372 int matched = 0;
3373 int status;
3374 int ignorep;
3375+ int classfound;
3376
3377 for (class = collection -> classes; class; class = class -> nic) {
3378 #if defined (DEBUG_CLASS_MATCHING)
3150c1ff 3379@@ -135,9 +136,19 @@
1097e9ca 3380 class -> submatch, MDL));
3381 if (status && data.len) {
3382 nc = (struct class *)0;
3383- if (class_hash_lookup (&nc, class -> hash,
3384- (const char *)data.data,
3385- data.len, MDL)) {
3386+ classfound = class_hash_lookup (&nc,
3387+ class -> hash,
3388+ (const char *)data.data,
3389+ data.len, MDL);
3390+
3391+#ifdef LDAP_CONFIGURATION
3392+ if (!classfound &&
3393+ find_subclass_in_ldap (class,
3394+ &nc, &data))
3395+ classfound = 1;
3396+#endif
3397+
3398+ if (classfound) {
3399 #if defined (DEBUG_CLASS_MATCHING)
3400 log_info ("matches subclass %s.",
3401 print_hex_1 (data.len,
a37573f1
JR		 3402diff -Naur dhcp-3.0.5/server/confpars.c dhcp-3.0.5-ldap/server/confpars.c
3403--- dhcp-3.0.5/server/confpars.c 2006-07-20 12:02:52.000000000 -0400
3404+++ dhcp-3.0.5-ldap/server/confpars.c 2006-12-14 10:03:41.000000000 -0500
3405@@ -63,7 +63,17 @@
1097e9ca 3406
3407 isc_result_t readconf ()
3408 {
3409- return read_conf_file (path_dhcpd_conf, root_group, ROOT_GROUP, 0);
3410+ isc_result_t res;
3411+
3412+ res = read_conf_file (path_dhcpd_conf, root_group, ROOT_GROUP, 0);
3413+#if defined(LDAP_CONFIGURATION)
3414+ if (res != ISC_R_SUCCESS)
3415+ return (res);
3416+
3417+ return ldap_read_config ();
3418+#else
3419+ return (res);
3420+#endif
3421 }
3422
3423 isc_result_t read_conf_file (const char *filename, struct group *group,
a37573f1
JR		 3424diff -Naur dhcp-3.0.5/server/dhcpd.c dhcp-3.0.5-ldap/server/dhcpd.c
3425--- dhcp-3.0.5/server/dhcpd.c 2006-07-17 11:23:44.000000000 -0400
3426+++ dhcp-3.0.5-ldap/server/dhcpd.c 2007-02-23 13:13:36.000000000 -0500
3427@@ -436,6 +436,14 @@
1097e9ca 3428 /* Add the ddns update style enumeration prior to parsing. */
3429 add_enumeration (&ddns_styles);
3430 add_enumeration (&syslog_enum);
3431+#if defined (LDAP_CONFIGURATION)
3432+ add_enumeration (&ldap_methods);
a37573f1
JR		 3433+#if defined (USE_SSL)
3434+ add_enumeration (&ldap_ssl_usage_enum);
3435+ add_enumeration (&ldap_tls_reqcert_enum);
3436+ add_enumeration (&ldap_tls_crlcheck_enum);
3437+#endif
1097e9ca 3438+#endif
3439
3440 if (!group_allocate (&root_group, MDL))
3441 log_fatal ("Can't allocate root group!");
a37573f1
JR		 3442diff -Naur dhcp-3.0.5/server/ldap.c dhcp-3.0.5-ldap/server/ldap.c
3443--- dhcp-3.0.5/server/ldap.c 1969-12-31 19:00:00.000000000 -0500
3444+++ dhcp-3.0.5-ldap/server/ldap.c 2007-02-23 13:36:24.000000000 -0500
3445@@ -0,0 +1,1977 @@
1097e9ca 3446+/* ldap.c
3447+
3448+ Routines for reading the configuration from LDAP */
3449+
3450+/*
a37573f1 3451+ * Copyright (c) 2003-2006 Ntelos, Inc.
1097e9ca 3452+ * All rights reserved.
3453+ *
3454+ * Redistribution and use in source and binary forms, with or without
3455+ * modification, are permitted provided that the following conditions
3456+ * are met:
3457+ *
3458+ * 1. Redistributions of source code must retain the above copyright
3459+ * notice, this list of conditions and the following disclaimer.
3460+ * 2. Redistributions in binary form must reproduce the above copyright
3461+ * notice, this list of conditions and the following disclaimer in the
3462+ * documentation and/or other materials provided with the distribution.
3463+ * 3. Neither the name of The Internet Software Consortium nor the names
3464+ * of its contributors may be used to endorse or promote products derived
3465+ * from this software without specific prior written permission.
3466+ *
3467+ * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
3468+ * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
3469+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
3470+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
3471+ * DISCLAIMED. IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
3472+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
3473+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
3474+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
3475+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
3476+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
3477+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
3478+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3479+ * SUCH DAMAGE.
3480+ *
a37573f1 3481+ * This LDAP module was written by Brian Masney <masneyb@ntelos.net>. Its
1097e9ca 3482+ * development was sponsored by Ntelos, Inc. (www.ntelos.com).
3483+ */
3484+
3485+#include "dhcpd.h"
a37573f1 3486+#include <signal.h>
1097e9ca 3487+
3488+#if defined(LDAP_CONFIGURATION)
3489+
a37573f1
JR		 3490+#if defined(LDAP_CASA_AUTH)
3491+#include "ldap_casa.h"
3492+#endif
3493+
1097e9ca 3494+static LDAP * ld = NULL;
3495+static char *ldap_server = NULL,
3496+ *ldap_username = NULL,
3497+ *ldap_password = NULL,
3498+ *ldap_base_dn = NULL,
a37573f1 3499+ *ldap_dhcp_server_cn = NULL,
1097e9ca 3500+ *ldap_debug_file = NULL;
3150c1ff 3501+static int ldap_port = LDAP_PORT,
1097e9ca 3502+ ldap_method = LDAP_METHOD_DYNAMIC,
a37573f1 3503+ ldap_referrals = -1,
1097e9ca 3504+ ldap_debug_fd = -1;
a37573f1
JR		 3505+#if defined (USE_SSL)
3506+static int ldap_use_ssl = -1, /* try TLS if possible */
3507+ ldap_tls_reqcert = -1,
3508+ ldap_tls_crlcheck = -1;
3509+static char *ldap_tls_ca_file = NULL,
3510+ *ldap_tls_ca_dir = NULL,
3511+ *ldap_tls_cert = NULL,
3512+ *ldap_tls_key = NULL,
3513+ *ldap_tls_ciphers = NULL,
3514+ *ldap_tls_randfile = NULL;
3515+#endif
1097e9ca 3516+static struct ldap_config_stack *ldap_stack = NULL;
3517+
3150c1ff 3518+typedef struct ldap_dn_node {
3519+ struct ldap_dn_node *next;
3520+ size_t refs;
3521+ char *dn;
3522+} ldap_dn_node;
3523+
3524+static ldap_dn_node *ldap_service_dn_head = NULL;
3525+static ldap_dn_node *ldap_service_dn_tail = NULL;
3526+
1097e9ca 3527+
a37573f1
JR		 3528+static char *
3529+x_strncat(char *dst, const char *src, size_t dst_size)
3530+{
3531+ size_t len = strlen(dst);
3532+ return strncat(dst, src, dst_size > len ? dst_size - len - 1: 0);
3533+}
3534+
1097e9ca 3535+static void
3536+ldap_parse_class (struct ldap_config_stack *item, struct parse *cfile)
3537+{
3538+ char **tempstr;
3539+
3540+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) == NULL ||
3541+ tempstr[0] == NULL)
3542+ {
3543+ if (tempstr != NULL)
3544+ ldap_value_free (tempstr);
3545+
3546+ return;
3547+ }
3548+
a37573f1
JR		 3549+ x_strncat (cfile->inbuf, "class \"", LDAP_BUFFER_SIZE);
3550+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3551+ x_strncat (cfile->inbuf, "\" {\n", LDAP_BUFFER_SIZE);
1097e9ca 3552+
3553+ item->close_brace = 1;
3554+ ldap_value_free (tempstr);
3555+}
3556+
3557+
3558+static void
3559+ldap_parse_subclass (struct ldap_config_stack *item, struct parse *cfile)
3560+{
3561+ char **tempstr, **classdata;
3562+
3563+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) == NULL ||
3564+ tempstr[0] == NULL)
3565+ {
3566+ if (tempstr != NULL)
3567+ ldap_value_free (tempstr);
3568+
3569+ return;
3570+ }
3571+
1097e9ca 3572+ if ((classdata = ldap_get_values (ld, item->ldent,
3573+ "dhcpClassData")) == NULL ||
3574+ classdata[0] == NULL)
3575+ {
3576+ if (classdata != NULL)
3577+ ldap_value_free (classdata);
3578+ ldap_value_free (tempstr);
3579+
3580+ return;
3581+ }
3582+
a37573f1
JR		 3583+ x_strncat (cfile->inbuf, "subclass ", LDAP_BUFFER_SIZE);
3584+ x_strncat (cfile->inbuf, classdata[0], LDAP_BUFFER_SIZE);
3585+ x_strncat (cfile->inbuf, " ", LDAP_BUFFER_SIZE);
3586+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3587+ x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
1097e9ca 3588+
3589+ item->close_brace = 1;
3590+ ldap_value_free (tempstr);
3591+ ldap_value_free (classdata);
3592+}
3593+
3594+
3595+static void
3596+ldap_parse_host (struct ldap_config_stack *item, struct parse *cfile)
3597+{
3598+ char **tempstr, **hwaddr;
3599+
1097e9ca 3600+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) == NULL ||
3601+ tempstr[0] == NULL)
3602+ {
3603+ if (tempstr != NULL)
3604+ ldap_value_free (tempstr);
3605+
3606+ return;
3607+ }
3608+
a37573f1 3609+ hwaddr = ldap_get_values (ld, item->ldent, "dhcpHWAddress");
1097e9ca 3610+
a37573f1
JR		 3611+ x_strncat (cfile->inbuf, "host ", LDAP_BUFFER_SIZE);
3612+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
1097e9ca 3613+
a37573f1
JR		 3614+ if (hwaddr != NULL && hwaddr[0] != NULL)
3615+ {
3616+ x_strncat (cfile->inbuf, " {\nhardware ", LDAP_BUFFER_SIZE);
3617+ x_strncat (cfile->inbuf, hwaddr[0], LDAP_BUFFER_SIZE);
3618+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
3619+ ldap_value_free (hwaddr);
3620+ }
1097e9ca 3621+
3622+ item->close_brace = 1;
3623+ ldap_value_free (tempstr);
1097e9ca 3624+}
3625+
3626+
3627+static void
3628+ldap_parse_shared_network (struct ldap_config_stack *item, struct parse *cfile)
3629+{
3630+ char **tempstr;
3631+
1097e9ca 3632+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) == NULL ||
3633+ tempstr[0] == NULL)
3634+ {
3635+ if (tempstr != NULL)
3636+ ldap_value_free (tempstr);
3637+
3638+ return;
3639+ }
3640+
a37573f1
JR		 3641+ x_strncat (cfile->inbuf, "shared-network \"", LDAP_BUFFER_SIZE);
3642+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3643+ x_strncat (cfile->inbuf, "\" {\n", LDAP_BUFFER_SIZE);
1097e9ca 3644+
3645+ item->close_brace = 1;
3646+ ldap_value_free (tempstr);
3647+}
3648+
3649+
3650+static void
3651+parse_netmask (int netmask, char *netmaskbuf)
3652+{
3653+ unsigned long nm;
3654+ int i;
3655+
3656+ nm = 0;
3657+ for (i=1; i <= netmask; i++)
3658+ {
3659+ nm |= 1 << (32 - i);
3660+ }
3661+
3662+ sprintf (netmaskbuf, "%d.%d.%d.%d", (int) (nm >> 24) & 0xff,
3663+ (int) (nm >> 16) & 0xff,
3664+ (int) (nm >> 8) & 0xff,
3665+ (int) nm & 0xff);
3666+}
3667+
a37573f1 3668+
1097e9ca 3669+static void
3670+ldap_parse_subnet (struct ldap_config_stack *item, struct parse *cfile)
3671+{
3672+ char **tempstr, **netmaskstr, netmaskbuf[16];
3673+ int i;
3674+
3675+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) == NULL ||
3676+ tempstr[0] == NULL)
3677+ {
3678+ if (tempstr != NULL)
3679+ ldap_value_free (tempstr);
3680+
3681+ return;
3682+ }
3683+
3684+ if ((netmaskstr = ldap_get_values (ld, item->ldent,
3685+ "dhcpNetmask")) == NULL ||
3686+ netmaskstr[0] == NULL)
3687+ {
3688+ if (netmaskstr != NULL)
3689+ ldap_value_free (netmaskstr);
3690+ ldap_value_free (tempstr);
3691+
3692+ return;
3693+ }
3694+
a37573f1
JR		 3695+ x_strncat (cfile->inbuf, "subnet ", LDAP_BUFFER_SIZE);
3696+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
1097e9ca 3697+
a37573f1 3698+ x_strncat (cfile->inbuf, " netmask ", LDAP_BUFFER_SIZE);
1097e9ca 3699+ parse_netmask (strtol (netmaskstr[0], NULL, 10), netmaskbuf);
a37573f1 3700+ x_strncat (cfile->inbuf, netmaskbuf, LDAP_BUFFER_SIZE);
1097e9ca 3701+
a37573f1 3702+ x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
1097e9ca 3703+
3704+ ldap_value_free (tempstr);
3705+ ldap_value_free (netmaskstr);
3706+
3707+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpRange")) != NULL)
3708+ {
1097e9ca 3709+ for (i=0; tempstr[i] != NULL; i++)
3710+ {
a37573f1
JR		 3711+ x_strncat (cfile->inbuf, "range", LDAP_BUFFER_SIZE);
3712+ x_strncat (cfile->inbuf, " ", LDAP_BUFFER_SIZE);
3713+ x_strncat (cfile->inbuf, tempstr[i], LDAP_BUFFER_SIZE);
3714+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
1097e9ca 3715+ }
1097e9ca 3716+ ldap_value_free (tempstr);
3717+ }
3718+
3719+ item->close_brace = 1;
3720+}
3721+
3722+
3723+static void
3724+ldap_parse_pool (struct ldap_config_stack *item, struct parse *cfile)
3725+{
3726+ char **tempstr;
3727+ int i;
3728+
a37573f1 3729+ x_strncat (cfile->inbuf, "pool {\n", LDAP_BUFFER_SIZE);
1097e9ca 3730+
3731+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpRange")) != NULL)
3732+ {
a37573f1 3733+ x_strncat (cfile->inbuf, "range", LDAP_BUFFER_SIZE);
1097e9ca 3734+ for (i=0; tempstr[i] != NULL; i++)
3735+ {
a37573f1
JR		 3736+ x_strncat (cfile->inbuf, " ", LDAP_BUFFER_SIZE);
3737+ x_strncat (cfile->inbuf, tempstr[i], LDAP_BUFFER_SIZE);
1097e9ca 3738+ }
a37573f1 3739+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
1097e9ca 3740+ ldap_value_free (tempstr);
3741+ }
3742+
3743+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpPermitList")) != NULL)
3744+ {
3745+ for (i=0; tempstr[i] != NULL; i++)
3746+ {
a37573f1
JR		 3747+ x_strncat (cfile->inbuf, tempstr[i], LDAP_BUFFER_SIZE);
3748+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
1097e9ca 3749+ }
3750+ ldap_value_free (tempstr);
3751+ }
3752+
3753+ item->close_brace = 1;
3754+}
3755+
3756+
3757+static void
3758+ldap_parse_group (struct ldap_config_stack *item, struct parse *cfile)
3759+{
a37573f1
JR		 3760+ x_strncat (cfile->inbuf, "group {\n", LDAP_BUFFER_SIZE);
3761+ item->close_brace = 1;
3762+}
3763+
3764+
3765+static void
3766+ldap_parse_key (struct ldap_config_stack *item, struct parse *cfile)
3767+{
3768+ char **tempstr;
3769+
3770+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) != NULL)
3771+ {
3772+ x_strncat (cfile->inbuf, "key ", LDAP_BUFFER_SIZE);
3773+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3774+ x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
3775+ ldap_value_free (tempstr);
3776+ }
3777+
3778+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpKeyAlgorithm")) != NULL)
3779+ {
3780+ x_strncat (cfile->inbuf, "algorithm ", LDAP_BUFFER_SIZE);
3781+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3782+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
3783+ ldap_value_free (tempstr);
3784+ }
3785+
3786+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpKeySecret")) != NULL)
3787+ {
3788+ x_strncat (cfile->inbuf, "secret ", LDAP_BUFFER_SIZE);
3789+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3790+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
3791+ ldap_value_free (tempstr);
3792+ }
3793+
3794+ item->close_brace = 1;
3795+}
3796+
3797+
3798+static void
3799+ldap_parse_zone (struct ldap_config_stack *item, struct parse *cfile)
3800+{
3801+ char *cnFindStart, *cnFindEnd;
3802+ char **tempstr;
3803+ char *keyCn;
3804+ size_t len;
3805+
3806+ if ((tempstr = ldap_get_values (ld, item->ldent, "cn")) != NULL)
3807+ {
3808+ x_strncat (cfile->inbuf, "zone ", LDAP_BUFFER_SIZE);
3809+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3810+ x_strncat (cfile->inbuf, " {\n", LDAP_BUFFER_SIZE);
3811+ ldap_value_free (tempstr);
3812+ }
3813+
3814+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpDnsZoneServer")) != NULL)
3815+ {
3816+ x_strncat (cfile->inbuf, "primary ", LDAP_BUFFER_SIZE);
3817+ x_strncat (cfile->inbuf, tempstr[0], LDAP_BUFFER_SIZE);
3818+
3819+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
3820+ ldap_value_free (tempstr);
3821+ }
3822+
3823+ if ((tempstr = ldap_get_values (ld, item->ldent, "dhcpKeyDN")) != NULL)
3824+ {
3825+ cnFindStart = strchr(tempstr[0],'=');
3826+ if (cnFindStart != NULL)
3827+ cnFindEnd = strchr(++cnFindStart,',');
3828+ else
3829+ cnFindEnd = NULL;
3830+
3831+ if (cnFindEnd != NULL && cnFindEnd > cnFindStart)
3832+ {
3833+ len = cnFindEnd - cnFindStart;
3834+ keyCn = dmalloc (len + 1, MDL);
3835+ }
3836+ else
3837+ {
3838+ len = 0;
3839+ keyCn = NULL;
3840+ }
3841+
3842+ if (keyCn != NULL)
3843+ {
3844+ strncpy (keyCn, cnFindStart, len);
3845+ keyCn[len] = '\0';
3846+
3847+ x_strncat (cfile->inbuf, "key ", LDAP_BUFFER_SIZE);
3848+ x_strncat (cfile->inbuf, keyCn, LDAP_BUFFER_SIZE);
3849+ x_strncat (cfile->inbuf, ";\n", LDAP_BUFFER_SIZE);
3850+
3851+ dfree (keyCn, MDL);
3852+ }
3853+
3854+ ldap_value_free (tempstr);
3855+ }
3856+
1097e9ca 3857+ item->close_brace = 1;
3858+}
3859+
3860+
3861+static void
3862+add_to_config_stack (LDAPMessage * res, LDAPMessage * ent)
3863+{
3864+ struct ldap_config_stack *ns;
3865+
3866+ ns = dmalloc (sizeof (*ns), MDL);
3867+ ns->res = res;
3868+ ns->ldent = ent;
3869+ ns->close_brace = 0;
3870+ ns->processed = 0;
3871+ ns->next = ldap_stack;
3872+ ldap_stack = ns;
3873+}
3874+
3875+
3876+static void
a37573f1
JR		 3877+ldap_stop()
3878+{
3879+ struct sigaction old, new;
3880+
3881+ if (ld == NULL)
3882+ return;
3883+
3884+ /*
3885+ ** ldap_unbind after a LDAP_SERVER_DOWN result
3886+ ** causes a SIGPIPE and dhcpd gets terminated,
3887+ ** since it doesn't handle it...
3888+ */
3889+
3890+ new.sa_flags = 0;
3891+ new.sa_handler = SIG_IGN;
3892+ sigemptyset (&new.sa_mask);
3893+ sigaction (SIGPIPE, &new, &old);
3894+
3895+ ldap_unbind (ld);
3896+ ld = NULL;
3897+
3898+ sigaction (SIGPIPE, &old, &new);
3899+}
3900+
3901+
3902+static char *
3903+_do_lookup_dhcp_string_option (struct option_state *options, int option_name)
3904+{
3905+ struct option_cache *oc;
3906+ struct data_string db;
3907+ char *ret;
3908+
3909+ memset (&db, 0, sizeof (db));
3910+ oc = lookup_option (&server_universe, options, option_name);
3911+ if (oc &&
3912+ evaluate_option_cache (&db, (struct packet*) NULL,
3913+ (struct lease *) NULL,
3914+ (struct client_state *) NULL, options,
3915+ (struct option_state *) NULL,
3916+ &global_scope, oc, MDL) &&
3917+ db.data != NULL && *db.data != '\0')
3918+
3919+ {
3920+ ret = dmalloc (db.len + 1, MDL);
3921+ if (ret == NULL)
3922+ log_fatal ("no memory for ldap option %d value", option_name);
3923+
3924+ memcpy (ret, db.data, db.len);
3925+ ret[db.len] = 0;
3926+ data_string_forget (&db, MDL);
3927+ }
3928+ else
3929+ ret = NULL;
3930+
3931+ return (ret);
3932+}
3933+
3934+
3935+static int
3936+_do_lookup_dhcp_int_option (struct option_state *options, int option_name)
3937+{
3938+ struct option_cache *oc;
3939+ struct data_string db;
3940+ int ret;
3941+
3942+ memset (&db, 0, sizeof (db));
3943+ oc = lookup_option (&server_universe, options, option_name);
3944+ if (oc &&
3945+ evaluate_option_cache (&db, (struct packet*) NULL,
3946+ (struct lease *) NULL,
3947+ (struct client_state *) NULL, options,
3948+ (struct option_state *) NULL,
3949+ &global_scope, oc, MDL) &&
3950+ db.data != NULL && *db.data != '\0')
3951+ {
3952+ ret = strtol (db.data, NULL, 10);
3953+ data_string_forget (&db, MDL);
3954+ }
3955+ else
3956+ ret = 0;
3957+
3958+ return (ret);
3959+}
3960+
3961+
3962+static int
3963+_do_lookup_dhcp_enum_option (struct option_state *options, int option_name)
1097e9ca 3964+{
1097e9ca 3965+ struct option_cache *oc;
3966+ struct data_string db;
a37573f1
JR		 3967+ int ret;
3968+
3969+ memset (&db, 0, sizeof (db));
3970+ oc = lookup_option (&server_universe, options, option_name);
3971+ if (oc &&
3972+ evaluate_option_cache (&db, (struct packet*) NULL,
3973+ (struct lease *) NULL,
3974+ (struct client_state *) NULL, options,
3975+ (struct option_state *) NULL,
3976+ &global_scope, oc, MDL) &&
3977+ db.data != NULL && *db.data != '\0')
3978+ {
3979+ if (db.len == 1)
3980+ ret = db.data [0];
3981+ else
3982+ log_fatal ("invalid option name %d", option_name);
3983+
3984+ data_string_forget (&db, MDL);
3985+ }
3986+ else
3987+ ret = 0;
3988+
3989+ return (ret);
3990+}
3991+
3992+int
3993+ldap_rebind_cb (LDAP *ld, LDAP_CONST char *url, ber_tag_t request, ber_int_t msgid, void *parms)
3994+{
3995+ int ret;
3996+ LDAPURLDesc *ldapurl = NULL;
3997+ char *who = NULL, *pwd = NULL;
3998+
3999+ log_info("LDAP rebind to '%s'", url);
4000+ if ((ret = ldap_url_parse(url, &ldapurl)) != LDAP_SUCCESS)
4001+ {
4002+ log_error ("Error: Can not parse ldap rebind url '%s': %s",
4003+ url, ldap_err2string(ret));
4004+ return ret;
4005+ }
4006+
4007+
4008+#if defined (USE_SSL)
4009+ if (strcasecmp(ldapurl->lud_scheme, "ldaps") == 0)
4010+ {
4011+ int opt = LDAP_OPT_X_TLS_HARD;
4012+ if ((ret = ldap_set_option (ld, LDAP_OPT_X_TLS, &opt)) != LDAP_SUCCESS)
4013+ {
4014+ log_error ("Error: Cannot init LDAPS session to %s:%d: %s",
4015+ ldapurl->lud_host, ldapurl->lud_port, ldap_err2string (ret));
4016+ return ret;
4017+ }
4018+ else
4019+ {
4020+ log_info ("LDAPS session successfully enabled to %s", ldap_server);
4021+ }
4022+ }
4023+ else
4024+ if (strcasecmp(ldapurl->lud_scheme, "ldap") == 0 &&
4025+ ldap_use_ssl != LDAP_SSL_OFF)
4026+ {
4027+ if ((ret = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
4028+ {
4029+ log_error ("Error: Cannot start TLS session to %s:%d: %s",
4030+ ldapurl->lud_host, ldapurl->lud_port, ldap_err2string (ret));
4031+ return ret;
4032+ }
4033+ else
4034+ {
4035+ log_info ("TLS session successfully started to %s:%d",
4036+ ldapurl->lud_host, ldapurl->lud_port);
4037+ }
4038+ }
4039+#endif
4040+
4041+
4042+ if (ldap_username != NULL || *ldap_username != '\0')
4043+ {
4044+ who = ldap_username;
4045+ pwd = ldap_password;
4046+ }
4047+
4048+ if ((ret = ldap_simple_bind_s (ld, who, pwd)) != LDAP_SUCCESS)
4049+ {
4050+ log_error ("Error: Cannot login into ldap server %s:%d: %s",
4051+ ldapurl->lud_host, ldapurl->lud_port, ldap_err2string (ret));
4052+ }
4053+ return ret;
4054+}
4055+
4056+static void
4057+ldap_start (void)
4058+{
4059+ struct option_state *options;
1097e9ca 4060+ int ret, version;
4061+
4062+ if (ld != NULL)
4063+ return;
4064+
4065+ if (ldap_server == NULL)
4066+ {
4067+ options = NULL;
4068+ option_state_allocate (&options, MDL);
4069+
4070+ execute_statements_in_scope ((struct binding_value **) NULL,
4071+ (struct packet *) NULL, (struct lease *) NULL,
4072+ (struct client_state *) NULL, (struct option_state *) NULL,
4073+ options, &global_scope, root_group, (struct group *) NULL);
4074+
a37573f1
JR		 4075+ ldap_server = _do_lookup_dhcp_string_option (options, SV_LDAP_SERVER);
4076+ ldap_dhcp_server_cn = _do_lookup_dhcp_string_option (options,
4077+ SV_LDAP_DHCP_SERVER_CN);
4078+ ldap_port = _do_lookup_dhcp_int_option (options, SV_LDAP_PORT);
4079+ ldap_base_dn = _do_lookup_dhcp_string_option (options, SV_LDAP_BASE_DN);
4080+ ldap_method = _do_lookup_dhcp_enum_option (options, SV_LDAP_METHOD);
4081+ ldap_debug_file = _do_lookup_dhcp_string_option (options,
4082+ SV_LDAP_DEBUG_FILE);
4083+ ldap_referrals = _do_lookup_dhcp_enum_option (options, SV_LDAP_REFERRALS);
1097e9ca 4084+
a37573f1
JR		 4085+#if defined (USE_SSL)
4086+ ldap_use_ssl = _do_lookup_dhcp_enum_option (options, SV_LDAP_SSL);
4087+ if( ldap_use_ssl != LDAP_SSL_OFF)
1097e9ca 4088+ {
a37573f1
JR		 4089+ ldap_tls_reqcert = _do_lookup_dhcp_enum_option (options, SV_LDAP_TLS_REQCERT);
4090+ ldap_tls_ca_file = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CA_FILE);
4091+ ldap_tls_ca_dir = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CA_DIR);
4092+ ldap_tls_cert = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CERT);
4093+ ldap_tls_key = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_KEY);
4094+ ldap_tls_crlcheck = _do_lookup_dhcp_enum_option (options, SV_LDAP_TLS_CRLCHECK);
4095+ ldap_tls_ciphers = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_CIPHERS);
4096+ ldap_tls_randfile = _do_lookup_dhcp_string_option (options, SV_LDAP_TLS_RANDFILE);
1097e9ca 4097+ }
a37573f1 4098+#endif
1097e9ca 4099+
a37573f1
JR		 4100+#if defined (LDAP_CASA_AUTH)
4101+ if (!load_uname_pwd_from_miCASA(&ldap_username,&ldap_password))
1097e9ca 4102+ {
a37573f1
JR		 4103+#if defined (DEBUG_LDAP)
4104+ log_info ("Authentication credential taken from file");
4105+#endif
4106+#endif
1097e9ca 4107+
a37573f1
JR		 4108+ ldap_username = _do_lookup_dhcp_string_option (options, SV_LDAP_USERNAME);
4109+ ldap_password = _do_lookup_dhcp_string_option (options, SV_LDAP_PASSWORD);
1097e9ca 4110+
a37573f1
JR		 4111+#if defined (LDAP_CASA_AUTH)
4112+ }
4113+#endif
1097e9ca 4114+
4115+ option_state_dereference (&options, MDL);
4116+ }
4117+
4118+ if (ldap_server == NULL || ldap_base_dn == NULL)
4119+ {
4120+ log_info ("Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file");
4121+ ldap_method = LDAP_METHOD_STATIC;
4122+ return;
4123+ }
4124+
4125+ if (ldap_debug_file != NULL && ldap_debug_fd == -1)
4126+ {
4127+ if ((ldap_debug_fd = open (ldap_debug_file, O_CREAT | O_TRUNC | O_WRONLY,
4128+ S_IRUSR | S_IWUSR)) < 0)
4129+ log_error ("Error opening debug LDAP log file %s: %s", ldap_debug_file,
4130+ strerror (errno));
4131+ }
4132+
4133+#if defined (DEBUG_LDAP)
4134+ log_info ("Connecting to LDAP server %s:%d", ldap_server, ldap_port);
4135+#endif
4136+
a37573f1
JR		 4137+#if defined (USE_SSL)
4138+ if (ldap_use_ssl == -1)
4139+ {
4140+ /*
4141+ ** There was no "ldap-ssl" option in dhcpd.conf (also not "off").
4142+ ** Let's try, if we can use an anonymous TLS session without to
4143+ ** verify the server certificate -- if not continue without TLS.
4144+ */
4145+ int opt = LDAP_OPT_X_TLS_ALLOW;
4146+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
4147+ &opt)) != LDAP_SUCCESS)
4148+ {
4149+ log_error ("Warning: Cannot set LDAP TLS require cert option to 'allow': %s",
4150+ ldap_err2string (ret));
4151+ }
4152+ }
4153+
4154+ if (ldap_use_ssl != LDAP_SSL_OFF)
4155+ {
4156+ if (ldap_tls_reqcert != -1)
4157+ {
4158+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
4159+ &ldap_tls_reqcert)) != LDAP_SUCCESS)
4160+ {
4161+ log_error ("Cannot set LDAP TLS require cert option: %s",
4162+ ldap_err2string (ret));
4163+ }
4164+ }
4165+
4166+ if( ldap_tls_ca_file != NULL)
4167+ {
4168+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
4169+ ldap_tls_ca_file)) != LDAP_SUCCESS)
4170+ {
4171+ log_error ("Cannot set LDAP TLS CA certificate file %s: %s",
4172+ ldap_tls_ca_file, ldap_err2string (ret));
4173+ }
4174+ }
4175+ if( ldap_tls_ca_dir != NULL)
4176+ {
4177+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
4178+ ldap_tls_ca_dir)) != LDAP_SUCCESS)
4179+ {
4180+ log_error ("Cannot set LDAP TLS CA certificate dir %s: %s",
4181+ ldap_tls_ca_dir, ldap_err2string (ret));
4182+ }
4183+ }
4184+ if( ldap_tls_cert != NULL)
4185+ {
4186+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
4187+ ldap_tls_cert)) != LDAP_SUCCESS)
4188+ {
4189+ log_error ("Cannot set LDAP TLS client certificate file %s: %s",
4190+ ldap_tls_cert, ldap_err2string (ret));
4191+ }
4192+ }
4193+ if( ldap_tls_key != NULL)
4194+ {
4195+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
4196+ ldap_tls_key)) != LDAP_SUCCESS)
4197+ {
4198+ log_error ("Cannot set LDAP TLS certificate key file %s: %s",
4199+ ldap_tls_key, ldap_err2string (ret));
4200+ }
4201+ }
4202+ if( ldap_tls_crlcheck != -1)
4203+ {
4204+ int opt = ldap_tls_crlcheck;
4205+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CRLCHECK,
4206+ &opt)) != LDAP_SUCCESS)
4207+ {
4208+ log_error ("Cannot set LDAP TLS crl check option: %s",
4209+ ldap_err2string (ret));
4210+ }
4211+ }
4212+ if( ldap_tls_ciphers != NULL)
4213+ {
4214+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
4215+ ldap_tls_ciphers)) != LDAP_SUCCESS)
4216+ {
4217+ log_error ("Cannot set LDAP TLS cipher suite %s: %s",
4218+ ldap_tls_ciphers, ldap_err2string (ret));
4219+ }
4220+ }
4221+ if( ldap_tls_randfile != NULL)
4222+ {
4223+ if ((ret = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
4224+ ldap_tls_randfile)) != LDAP_SUCCESS)
4225+ {
4226+ log_error ("Cannot set LDAP TLS random file %s: %s",
4227+ ldap_tls_randfile, ldap_err2string (ret));
4228+ }
4229+ }
4230+ }
4231+#endif
4232+
1097e9ca 4233+ if ((ld = ldap_init (ldap_server, ldap_port)) == NULL)
4234+ {
a37573f1 4235+ log_error ("Cannot init ldap session to %s:%d", ldap_server, ldap_port);
1097e9ca 4236+ return;
4237+ }
4238+
4239+ version = LDAP_VERSION3;
4240+ if ((ret = ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_OPT_SUCCESS)
4241+ {
4242+ log_error ("Cannot set LDAP version to %d: %s", version,
4243+ ldap_err2string (ret));
4244+ }
4245+
a37573f1
JR		 4246+ if (ldap_referrals != -1)
4247+ {
4248+ if ((ret = ldap_set_option (ld, LDAP_OPT_REFERRALS, ldap_referrals ?
4249+ LDAP_OPT_ON : LDAP_OPT_OFF)) != LDAP_OPT_SUCCESS)
4250+ {
4251+ log_error ("Cannot %s LDAP referrals option: %s",
4252+ (ldap_referrals ? "enable" : "disable"),
4253+ ldap_err2string (ret));
4254+ }
4255+ }
4256+
4257+ if ((ret = ldap_set_rebind_proc(ld, ldap_rebind_cb, NULL)) != LDAP_SUCCESS)
4258+ {
4259+ log_error ("Warning: Cannot set ldap rebind procedure: %s",
4260+ ldap_err2string (ret));
4261+ }
4262+
1097e9ca 4263+#if defined (USE_SSL)
a37573f1
JR		 4264+ if (ldap_use_ssl == LDAP_SSL_LDAPS ||
4265+ (ldap_use_ssl == LDAP_SSL_ON && ldap_port == LDAPS_PORT))
4266+ {
4267+ int opt = LDAP_OPT_X_TLS_HARD;
4268+ if ((ret = ldap_set_option (ld, LDAP_OPT_X_TLS, &opt)) != LDAP_SUCCESS)
4269+ {
4270+ log_error ("Error: Cannot init LDAPS session to %s:%d: %s",
4271+ ldap_server, ldap_port, ldap_err2string (ret));
4272+ ldap_stop();
4273+ return;
4274+ }
4275+ else
4276+ {
4277+ log_info ("LDAPS session successfully enabled to %s:%d",
4278+ ldap_server, ldap_port);
4279+ }
4280+ }
4281+ else if (ldap_use_ssl != LDAP_SSL_OFF)
4282+ {
4283+ if ((ret = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
4284+ {
4285+ log_error ("Error: Cannot start TLS session to %s:%d: %s",
4286+ ldap_server, ldap_port, ldap_err2string (ret));
4287+ ldap_stop();
4288+ return;
4289+ }
4290+ else
4291+ {
4292+ log_info ("TLS session successfully started to %s:%d",
4293+ ldap_server, ldap_port);
4294+ }
4295+ }
1097e9ca 4296+#endif
4297+
a37573f1 4298+ if (ldap_username != NULL && *ldap_username != '\0')
1097e9ca 4299+ {
a37573f1
JR		 4300+ if ((ret = ldap_simple_bind_s (ld, ldap_username,
4301+ ldap_password)) != LDAP_SUCCESS)
4302+ {
4303+ log_error ("Error: Cannot login into ldap server %s:%d: %s",
4304+ ldap_server, ldap_port, ldap_err2string (ret));
4305+ ldap_stop();
4306+ return;
4307+ }
1097e9ca 4308+ }
4309+
4310+#if defined (DEBUG_LDAP)
4311+ log_info ("Successfully logged into LDAP server %s", ldap_server);
4312+#endif
4313+}
4314+
4315+
4316+static void
4317+parse_external_dns (LDAPMessage * ent)
4318+{
4319+ char *search[] = {"dhcpOptionsDN", "dhcpSharedNetworkDN", "dhcpSubnetDN",
a37573f1 4320+ "dhcpGroupDN", "dhcpHostDN", "dhcpClassesDN",
1097e9ca 4321+ "dhcpPoolDN", NULL};
4322+ LDAPMessage * newres, * newent;
4323+ struct ldap_config_stack *ns;
4324+ char **tempstr;
3150c1ff 4325+ int i, j, ret;
4326+#if defined (DEBUG_LDAP)
4327+ char *dn;
a37573f1
JR		 4328+
4329+ dn = ldap_get_dn (ld, ent);
4330+ if (dn != NULL)
4331+ {
4332+ log_info ("Parsing external DNs for '%s'", dn);
4333+ ldap_memfree (dn);
4334+ }
3150c1ff 4335+#endif
1097e9ca 4336+
4337+ if (ld == NULL)
4338+ ldap_start ();
4339+ if (ld == NULL)
4340+ return;
4341+
4342+ for (i=0; search[i] != NULL; i++)
4343+ {
4344+ if ((tempstr = ldap_get_values (ld, ent, search[i])) == NULL)
4345+ continue;
4346+
3150c1ff 4347+ for (j=0; tempstr[j] != NULL; j++)
1097e9ca 4348+ {
3150c1ff 4349+ if (*tempstr[j] == '\0')
4350+ continue;
1097e9ca 4351+
3150c1ff 4352+ if ((ret = ldap_search_s (ld, tempstr[j], LDAP_SCOPE_BASE,
4353+ "objectClass=*", NULL, 0,
4354+ &newres)) != LDAP_SUCCESS)
4355+ {
4356+ ldap_value_free (tempstr);
a37573f1 4357+ ldap_stop();
3150c1ff 4358+ return;
4359+ }
4360+
4361+#if defined (DEBUG_LDAP)
4362+ log_info ("Adding contents of subtree '%s' to config stack from '%s' reference", tempstr[j], search[i]);
4363+#endif
4364+ for (newent = ldap_first_entry (ld, newres);
4365+ newent != NULL;
a37573f1 4366+ newent = ldap_next_entry (ld, newent))
3150c1ff 4367+ {
4368+#if defined (DEBUG_LDAP)
4369+ dn = ldap_get_dn (ld, newent);
4370+ if (dn != NULL)
4371+ {
a37573f1 4372+ log_info ("Adding LDAP result set starting with '%s' to config stack", dn);
3150c1ff 4373+ ldap_memfree (dn);
4374+ }
4375+#endif
1097e9ca 4376+
3150c1ff 4377+ add_to_config_stack (newres, newent);
4378+ /* don't free newres here */
4379+ }
1097e9ca 4380+ }
4381+
3150c1ff 4382+ ldap_value_free (tempstr);
1097e9ca 4383+ }
4384+}
4385+
4386+
4387+static void
4388+free_stack_entry (struct ldap_config_stack *item)
4389+{
a37573f1
JR		 4390+ struct ldap_config_stack *look_ahead_pointer = item;
4391+ int may_free_msg = 1;
4392+
4393+ while (look_ahead_pointer->next != NULL)
4394+ {
4395+ look_ahead_pointer = look_ahead_pointer->next;
4396+ if (look_ahead_pointer->res == item->res)
4397+ {
4398+ may_free_msg = 0;
4399+ break;
4400+ }
4401+ }
4402+
4403+ if (may_free_msg)
4404+ ldap_msgfree (item->res);
4405+
1097e9ca 4406+ dfree (item, MDL);
4407+}
4408+
4409+
4410+static void
4411+next_ldap_entry (struct parse *cfile)
4412+{
4413+ struct ldap_config_stack *temp_stack;
4414+
4415+ if (ldap_stack != NULL && ldap_stack->close_brace)
4416+ {
a37573f1 4417+ x_strncat (cfile->inbuf, "}\n", LDAP_BUFFER_SIZE);
1097e9ca 4418+ ldap_stack->close_brace = 0;
4419+ }
4420+
4421+ while (ldap_stack != NULL &&
4422+ (ldap_stack->ldent == NULL ||
4423+ (ldap_stack->ldent = ldap_next_entry (ld, ldap_stack->ldent)) == NULL))
4424+ {
4425+ if (ldap_stack->close_brace)
4426+ {
a37573f1 4427+ x_strncat (cfile->inbuf, "}\n", LDAP_BUFFER_SIZE);
1097e9ca 4428+ ldap_stack->close_brace = 0;
4429+ }
4430+
4431+ temp_stack = ldap_stack;
4432+ ldap_stack = ldap_stack->next;
4433+ free_stack_entry (temp_stack);
4434+ }
4435+
4436+ if (ldap_stack != NULL && ldap_stack->close_brace)
4437+ {
a37573f1 4438+ x_strncat (cfile->inbuf, "}\n", LDAP_BUFFER_SIZE);
1097e9ca 4439+ ldap_stack->close_brace = 0;
4440+ }
4441+}
4442+
4443+
3150c1ff 4444+static char
4445+check_statement_end (const char *statement)
4446+{
4447+ char *ptr;
4448+
4449+ if (statement == NULL || *statement == '\0')
4450+ return ('\0');
4451+
4452+ /*
4453+ ** check if it ends with "}", e.g.:
4454+ ** "zone my.domain. { ... }"
4455+ ** optionally followed by spaces
4456+ */
4457+ ptr = strrchr (statement, '}');
4458+ if (ptr != NULL)
4459+ {
4460+ /* skip following white-spaces */
4461+ for (++ptr; isspace ((int)*ptr); ptr++);
4462+
4463+ /* check if we reached the end */
4464+ if (*ptr == '\0')
4465+ return ('}'); /* yes, block end */
4466+ else
4467+ return (*ptr);
4468+ }
4469+
4470+ /*
4471+ ** this should not happen, but...
4472+ ** check if it ends with ";", e.g.:
4473+ ** "authoritative;"
4474+ ** optionally followed by spaces
4475+ */
4476+ ptr = strrchr (statement, ';');
4477+ if (ptr != NULL)
4478+ {
4479+ /* skip following white-spaces */
4480+ for (++ptr; isspace ((int)*ptr); ptr++);
4481+
4482+ /* check if we reached the end */
4483+ if (*ptr == '\0')
4484+ return (';'); /* ends with a ; */
4485+ else
4486+ return (*ptr);
4487+ }
4488+
4489+ return ('\0');
4490+}
4491+
4492+
4493+static isc_result_t
4494+ldap_parse_entry_options (LDAPMessage *ent, char *buffer, size_t size,
4495+ int *lease_limit)
4496+{
4497+ char **tempstr;
4498+ int i;
4499+
4500+ if (ent == NULL || buffer == NULL || size == 0)
4501+ return (ISC_R_FAILURE);
4502+
4503+ if ((tempstr = ldap_get_values (ld, ent, "dhcpStatements")) != NULL)
4504+ {
4505+ for (i=0; tempstr[i] != NULL; i++)
4506+ {
4507+ if (lease_limit != NULL &&
4508+ strncasecmp ("lease limit ", tempstr[i], 12) == 0)
4509+ {
4510+ *lease_limit = (int) strtol ((tempstr[i]) + 12, NULL, 10);
4511+ continue;
4512+ }
4513+
a37573f1 4514+ x_strncat (buffer, tempstr[i], size);
3150c1ff 4515+
4516+ switch((int) check_statement_end (tempstr[i]))
4517+ {
4518+ case '}':
4519+ case ';':
a37573f1 4520+ x_strncat (buffer, "\n", size);
3150c1ff 4521+ break;
4522+ default:
a37573f1 4523+ x_strncat (buffer, ";\n", size);
3150c1ff 4524+ break;
4525+ }
4526+ }
4527+ ldap_value_free (tempstr);
4528+ }
4529+
4530+ if ((tempstr = ldap_get_values (ld, ent, "dhcpOption")) != NULL)
4531+ {
4532+ for (i=0; tempstr[i] != NULL; i++)
4533+ {
a37573f1
JR		 4534+ x_strncat (buffer, "option ", size);
4535+ x_strncat (buffer, tempstr[i], size);
3150c1ff 4536+ switch ((int) check_statement_end (tempstr[i]))
4537+ {
4538+ case ';':
a37573f1 4539+ x_strncat (buffer, "\n", size);
3150c1ff 4540+ break;
4541+ default:
a37573f1 4542+ x_strncat (buffer, ";\n", size);
3150c1ff 4543+ break;
4544+ }
4545+ }
4546+ ldap_value_free (tempstr);
4547+ }
4548+
4549+ return (ISC_R_SUCCESS);
4550+}
4551+
4552+
1097e9ca 4553+static void
4554+ldap_generate_config_string (struct parse *cfile)
4555+{
3150c1ff 4556+ char **objectClass, *dn;
1097e9ca 4557+ struct ldap_config_stack *entry;
4558+ LDAPMessage * ent, * res;
4559+ int i, j, ignore, found;
4560+ int ret;
4561+
4562+ if (ld == NULL)
4563+ ldap_start ();
4564+ if (ld == NULL)
4565+ return;
4566+
4567+ entry = ldap_stack;
4568+ if ((objectClass = ldap_get_values (ld, entry->ldent,
4569+ "objectClass")) == NULL)
4570+ return;
4571+
4572+ ignore = 0;
4573+ found = 1;
4574+ for (i=0; objectClass[i] != NULL; i++)
4575+ {
a37573f1 4576+ if (strcasecmp (objectClass[i], "dhcpSharedNetwork") == 0)
1097e9ca 4577+ ldap_parse_shared_network (entry, cfile);
a37573f1 4578+ else if (strcasecmp (objectClass[i], "dhcpClass") == 0)
1097e9ca 4579+ ldap_parse_class (entry, cfile);
a37573f1 4580+ else if (strcasecmp (objectClass[i], "dhcpSubnet") == 0)
1097e9ca 4581+ ldap_parse_subnet (entry, cfile);
a37573f1 4582+ else if (strcasecmp (objectClass[i], "dhcpPool") == 0)
1097e9ca 4583+ ldap_parse_pool (entry, cfile);
a37573f1 4584+ else if (strcasecmp (objectClass[i], "dhcpGroup") == 0)
1097e9ca 4585+ ldap_parse_group (entry, cfile);
a37573f1
JR		 4586+ else if (strcasecmp (objectClass[i], "dhcpTSigKey") == 0)
4587+ ldap_parse_key (entry, cfile);
4588+ else if (strcasecmp (objectClass[i], "dhcpDnsZone") == 0)
4589+ ldap_parse_zone (entry, cfile);
4590+ else if (strcasecmp (objectClass[i], "dhcpHost") == 0)
1097e9ca 4591+ {
4592+ if (ldap_method == LDAP_METHOD_STATIC)
4593+ ldap_parse_host (entry, cfile);
4594+ else
4595+ {
4596+ ignore = 1;
4597+ break;
4598+ }
4599+ }
a37573f1 4600+ else if (strcasecmp (objectClass[i], "dhcpSubClass") == 0)
1097e9ca 4601+ {
4602+ if (ldap_method == LDAP_METHOD_STATIC)
4603+ ldap_parse_subclass (entry, cfile);
4604+ else
4605+ {
4606+ ignore = 1;
4607+ break;
4608+ }
4609+ }
4610+ else
4611+ found = 0;
4612+
4613+ if (found && cfile->inbuf[0] == '\0')
4614+ {
4615+ ignore = 1;
4616+ break;
4617+ }
4618+ }
4619+
4620+ ldap_value_free (objectClass);
4621+
4622+ if (ignore)
4623+ {
4624+ next_ldap_entry (cfile);
4625+ return;
4626+ }
4627+
3150c1ff 4628+ ldap_parse_entry_options(entry->ldent, cfile->inbuf,
4629+ LDAP_BUFFER_SIZE-1, NULL);
1097e9ca 4630+
4631+ dn = ldap_get_dn (ld, entry->ldent);
4632+
4633+#if defined(DEBUG_LDAP)
3150c1ff 4634+ if (dn != NULL)
4635+ log_info ("Found LDAP entry '%s'", dn);
1097e9ca 4636+#endif
4637+
3150c1ff 4638+ if (dn == NULL ||
4639+ (ret = ldap_search_s (ld, dn, LDAP_SCOPE_ONELEVEL, "objectClass=*",
1097e9ca 4640+ NULL, 0, &res)) != LDAP_SUCCESS)
4641+ {
3150c1ff 4642+ if (dn)
4643+ ldap_memfree (dn);
4644+
a37573f1 4645+ ldap_stop();
1097e9ca 4646+ return;
4647+ }
4648+
4649+ ldap_memfree (dn);
4650+
4651+ if ((ent = ldap_first_entry (ld, res)) != NULL)
4652+ {
4653+ add_to_config_stack (res, ent);
4654+ parse_external_dns (entry->ldent);
4655+ }
4656+ else
4657+ {
4658+ ldap_msgfree (res);
4659+ parse_external_dns (entry->ldent);
4660+ next_ldap_entry (cfile);
4661+ }
4662+}
4663+
4664+
3150c1ff 4665+static void
4666+ldap_close_debug_fd()
4667+{
4668+ if (ldap_debug_fd != -1)
4669+ {
4670+ close (ldap_debug_fd);
4671+ ldap_debug_fd = -1;
4672+ }
4673+}
4674+
4675+
4676+static void
4677+ldap_write_debug (const void *buff, size_t size)
4678+{
4679+ if (ldap_debug_fd != -1)
4680+ {
4681+ if (write (ldap_debug_fd, buff, size) < 0)
4682+ {
4683+ log_error ("Error writing to LDAP debug file %s: %s."
4684+ " Disabling log file.", ldap_debug_file,
4685+ strerror (errno));
4686+ ldap_close_debug_fd();
4687+ }
4688+ }
4689+}
4690+
a37573f1 4691+static int
1097e9ca 4692+ldap_read_function (struct parse *cfile)
4693+{
1097e9ca 4694+ cfile->inbuf[0] = '\0';
4695+ cfile->buflen = 0;
a37573f1 4696+
1097e9ca 4697+ while (ldap_stack != NULL && *cfile->inbuf == '\0')
4698+ ldap_generate_config_string (cfile);
4699+
a37573f1
JR		 4700+ if (ldap_stack == NULL && *cfile->inbuf == '\0')
4701+ return (EOF);
4702+
4703+ cfile->bufix = 1;
1097e9ca 4704+ cfile->buflen = strlen (cfile->inbuf);
3150c1ff 4705+ if (cfile->buflen > 0)
4706+ ldap_write_debug (cfile->inbuf, cfile->buflen);
1097e9ca 4707+
4708+#if defined (DEBUG_LDAP)
4709+ log_info ("Sending config line '%s'", cfile->inbuf);
4710+#endif
4711+
1097e9ca 4712+ return (cfile->inbuf[0]);
4713+}
4714+
4715+
4716+static char *
4717+ldap_get_host_name (LDAPMessage * ent)
4718+{
4719+ char **name, *ret;
4720+
4721+ ret = NULL;
4722+ if ((name = ldap_get_values (ld, ent, "cn")) == NULL || name[0] == NULL)
4723+ {
4724+ if (name != NULL)
4725+ ldap_value_free (name);
4726+
4727+#if defined (DEBUG_LDAP)
3150c1ff 4728+ ret = ldap_get_dn (ld, ent);
4729+ if (ret != NULL)
4730+ {
4731+ log_info ("Cannot get cn attribute for LDAP entry %s", ret);
4732+ ldap_memfree(ret);
4733+ }
1097e9ca 4734+#endif
4735+ return (NULL);
4736+ }
4737+
4738+ ret = dmalloc (strlen (name[0]) + 1, MDL);
4739+ strcpy (ret, name[0]);
4740+ ldap_value_free (name);
4741+
4742+ return (ret);
4743+}
4744+
4745+
3150c1ff 4746+static int
4747+getfqhostname(char *fqhost, size_t size)
4748+{
4749+#if defined(MAXHOSTNAMELEN)
4750+ char hname[MAXHOSTNAMELEN];
4751+#else
4752+ char hname[65];
4753+#endif
4754+ struct hostent *hp;
4755+
4756+ if(NULL == fqhost || 1 >= size)
4757+ return -1;
4758+
4759+ memset(hname, 0, sizeof(hname));
4760+ if( gethostname(hname, sizeof(hname)-1))
4761+ return -1;
4762+
4763+ if(NULL == (hp = gethostbyname(hname)))
4764+ return -1;
4765+
4766+ strncpy(fqhost, hp->h_name, size-1);
4767+ fqhost[size-1] = '\0';
4768+ return 0;
4769+}
4770+
4771+
1097e9ca 4772+isc_result_t
4773+ldap_read_config (void)
4774+{
4775+ LDAPMessage * ldres, * hostres, * ent, * hostent;
3150c1ff 4776+ char hfilter[1024], sfilter[1024], fqdn[257];
4777+ char *buffer, **tempstr = NULL, *hostdn;
4778+ ldap_dn_node *curr = NULL;
1097e9ca 4779+ struct parse *cfile;
4780+ struct utsname unme;
4781+ isc_result_t res;
3150c1ff 4782+ size_t length;
4783+ int ret, cnt;
1097e9ca 4784+
3150c1ff 4785+ if (ld == NULL)
4786+ ldap_start ();
4787+ if (ld == NULL)
4788+ return (ldap_server == NULL ? ISC_R_SUCCESS : ISC_R_FAILURE);
4789+
4790+ buffer = dmalloc (LDAP_BUFFER_SIZE+1, MDL);
4791+ if (buffer == NULL)
4792+ return (ISC_R_FAILURE);
1097e9ca 4793+
1097e9ca 4794+ cfile = (struct parse *) NULL;
4795+ res = new_parse (&cfile, -1, buffer, LDAP_BUFFER_SIZE, "LDAP", 0);
4796+ if (res != ISC_R_SUCCESS)
4797+ return (res);
3150c1ff 4798+
1097e9ca 4799+ uname (&unme);
a37573f1
JR		 4800+ if (ldap_dhcp_server_cn != NULL)
4801+ {
4802+ snprintf (hfilter, sizeof (hfilter),
4803+ "(&(objectClass=dhcpServer)(cn=%s))", ldap_dhcp_server_cn);
4804+ }
4805+ else
4806+ {
3150c1ff 4807+ if(0 == getfqhostname(fqdn, sizeof(fqdn)))
4808+ {
4809+ snprintf (hfilter, sizeof (hfilter),
4810+ "(&(objectClass=dhcpServer)(|(cn=%s)(cn=%s)))",
4811+ unme.nodename, fqdn);
4812+ }
4813+ else
4814+ {
4815+ snprintf (hfilter, sizeof (hfilter),
4816+ "(&(objectClass=dhcpServer)(cn=%s))", unme.nodename);
4817+ }
1097e9ca 4818+
a37573f1 4819+ }
3150c1ff 4820+ hostres = NULL;
4821+ if ((ret = ldap_search_s (ld, ldap_base_dn, LDAP_SCOPE_SUBTREE,
4822+ hfilter, NULL, 0, &hostres)) != LDAP_SUCCESS)
1097e9ca 4823+ {
3150c1ff 4824+ log_error ("Cannot find host LDAP entry %s %s",
a37573f1 4825+ ((ldap_dhcp_server_cn == NULL)?(unme.nodename):(ldap_dhcp_server_cn)), hfilter);
3150c1ff 4826+ if(NULL != hostres)
4827+ ldap_msgfree (hostres);
a37573f1 4828+ ldap_stop();
1097e9ca 4829+ return (ISC_R_FAILURE);
4830+ }
4831+
4832+ if ((hostent = ldap_first_entry (ld, hostres)) == NULL)
4833+ {
3150c1ff 4834+ log_error ("Error: Cannot find LDAP entry matching %s", hfilter);
4835+ ldap_msgfree (hostres);
a37573f1 4836+ ldap_stop();
1097e9ca 4837+ return (ISC_R_FAILURE);
4838+ }
4839+
3150c1ff 4840+ hostdn = ldap_get_dn (ld, hostent);
1097e9ca 4841+#if defined(DEBUG_LDAP)
3150c1ff 4842+ if (hostdn != NULL)
4843+ log_info ("Found dhcpServer LDAP entry '%s'", hostdn);
1097e9ca 4844+#endif
4845+
3150c1ff 4846+ if (hostdn == NULL ||
4847+ (tempstr = ldap_get_values (ld, hostent, "dhcpServiceDN")) == NULL ||
1097e9ca 4848+ tempstr[0] == NULL)
4849+ {
3150c1ff 4850+ log_error ("Error: Cannot find LDAP entry matching %s", hfilter);
1097e9ca 4851+
4852+ if (tempstr != NULL)
4853+ ldap_value_free (tempstr);
4854+
3150c1ff 4855+ if (hostdn)
4856+ ldap_memfree (hostdn);
4857+ ldap_msgfree (hostres);
a37573f1 4858+ ldap_stop();
1097e9ca 4859+ return (ISC_R_FAILURE);
4860+ }
4861+
3150c1ff 4862+#if defined(DEBUG_LDAP)
4863+ log_info ("LDAP: Parsing dhcpServer options '%s' ...", hostdn);
4864+#endif
4865+
4866+ cfile->inbuf[0] = '\0';
4867+ ldap_parse_entry_options(hostent, cfile->inbuf, LDAP_BUFFER_SIZE, NULL);
4868+ cfile->buflen = strlen (cfile->inbuf);
4869+ if(cfile->buflen > 0)
1097e9ca 4870+ {
3150c1ff 4871+ ldap_write_debug (cfile->inbuf, cfile->buflen);
4872+
4873+ res = conf_file_subparse (cfile, root_group, ROOT_GROUP);
4874+ if (res != ISC_R_SUCCESS)
4875+ {
4876+ log_error ("LDAP: cannot parse dhcpServer entry '%s'", hostdn);
4877+ ldap_memfree (hostdn);
a37573f1 4878+ ldap_stop();
3150c1ff 4879+ return res;
4880+ }
4881+ cfile->inbuf[0] = '\0';
1097e9ca 4882+ }
3150c1ff 4883+ ldap_msgfree (hostres);
1097e9ca 4884+
3150c1ff 4885+ /*
4886+ ** attach ldap (tree) read function now
4887+ */
4888+ cfile->bufix = cfile->buflen = 0;
4889+ cfile->read_function = ldap_read_function;
4890+
4891+ res = ISC_R_SUCCESS;
4892+ for (cnt=0; tempstr[cnt] != NULL; cnt++)
1097e9ca 4893+ {
3150c1ff 4894+ snprintf(sfilter, sizeof(sfilter), "(&(objectClass=dhcpService)"
4895+ "(|(dhcpPrimaryDN=%s)(dhcpSecondaryDN=%s)))",
4896+ hostdn, hostdn);
4897+ ldres = NULL;
4898+ if ((ret = ldap_search_s (ld, tempstr[cnt], LDAP_SCOPE_BASE,
4899+ sfilter, NULL, 0, &ldres)) != LDAP_SUCCESS)
4900+ {
4901+ log_error ("Error searching for dhcpServiceDN '%s': %s. Please update the LDAP entry '%s'",
4902+ tempstr[cnt], ldap_err2string (ret), hostdn);
4903+ if(NULL != ldres)
4904+ ldap_msgfree(ldres);
4905+ res = ISC_R_FAILURE;
4906+ break;
4907+ }
4908+
4909+ if ((ent = ldap_first_entry (ld, ldres)) == NULL)
4910+ {
4911+ log_error ("Error: Cannot find dhcpService DN '%s' with primary or secondary server reference. Please update the LDAP server entry '%s'",
4912+ tempstr[cnt], hostdn);
4913+
4914+ ldap_msgfree(ldres);
4915+ res = ISC_R_FAILURE;
4916+ break;
4917+ }
4918+
4919+ /*
4920+ ** FIXME: how to free the remembered dn's on exit?
4921+ ** This should be OK if dmalloc registers the
4922+ ** memory it allocated and frees it on exit..
4923+ */
4924+
4925+ curr = dmalloc (sizeof (*curr), MDL);
4926+ if (curr != NULL)
4927+ {
4928+ length = strlen (tempstr[cnt]);
4929+ curr->dn = dmalloc (length + 1, MDL);
4930+ if (curr->dn == NULL)
4931+ {
4932+ dfree (curr, MDL);
4933+ curr = NULL;
4934+ }
4935+ else
4936+ strcpy (curr->dn, tempstr[cnt]);
4937+ }
4938+
4939+ if (curr != NULL)
4940+ {
4941+ curr->refs++;
4942+
4943+ /* append to service-dn list */
4944+ if (ldap_service_dn_tail != NULL)
4945+ ldap_service_dn_tail->next = curr;
4946+ else
4947+ ldap_service_dn_head = curr;
4948+
4949+ ldap_service_dn_tail = curr;
4950+ }
4951+ else
4952+ log_fatal ("no memory to remember ldap service dn");
4953+
4954+#if defined (DEBUG_LDAP)
4955+ log_info ("LDAP: Parsing dhcpService DN '%s' ...", tempstr[cnt]);
4956+#endif
4957+ add_to_config_stack (ldres, ent);
4958+ res = conf_file_subparse (cfile, root_group, ROOT_GROUP);
4959+ if (res != ISC_R_SUCCESS)
4960+ {
4961+ log_error ("LDAP: cannot parse dhcpService entry '%s'", tempstr[cnt]);
4962+ break;
4963+ }
1097e9ca 4964+ }
4965+
3150c1ff 4966+ end_parse (&cfile);
4967+ ldap_close_debug_fd();
1097e9ca 4968+
3150c1ff 4969+ ldap_memfree (hostdn);
1097e9ca 4970+ ldap_value_free (tempstr);
4971+
3150c1ff 4972+ if (res != ISC_R_SUCCESS)
4973+ {
4974+ struct ldap_config_stack *temp_stack;
1097e9ca 4975+
3150c1ff 4976+ while ((curr = ldap_service_dn_head) != NULL)
4977+ {
4978+ ldap_service_dn_head = curr->next;
4979+ dfree (curr->dn, MDL);
4980+ dfree (curr, MDL);
4981+ }
4982+
4983+ ldap_service_dn_tail = NULL;
4984+
4985+ while ((temp_stack = ldap_stack) != NULL)
4986+ {
4987+ ldap_stack = temp_stack->next;
4988+ free_stack_entry (temp_stack);
4989+ }
4990+
a37573f1 4991+ ldap_stop();
3150c1ff 4992+ }
1097e9ca 4993+
a37573f1
JR		 4994+ /* Unbind from ldap immediately after reading config in static mode. */
4995+ if (ldap_method == LDAP_METHOD_STATIC)
4996+ ldap_stop();
4997+
1097e9ca 4998+ return (res);
4999+}
5000+
5001+
5002+/* This function will parse the dhcpOption and dhcpStatements field in the LDAP
5003+ entry if it exists. Right now, type will be either HOST_DECL or CLASS_DECL.
5004+ If we are parsing a HOST_DECL, this always returns 0. If we are parsing a
5005+ CLASS_DECL, this will return what the current lease limit is in LDAP. If
5006+ there is no lease limit specified, we return 0 */
5007+
5008+static int
5009+ldap_parse_options (LDAPMessage * ent, struct group *group,
5010+ int type, struct host_decl *host,
5011+ struct class **class)
5012+{
1097e9ca 5013+ int i, declaration, lease_limit;
3150c1ff 5014+ char option_buffer[8192];
1097e9ca 5015+ enum dhcp_token token;
5016+ struct parse *cfile;
5017+ isc_result_t res;
5018+ const char *val;
5019+
5020+ lease_limit = 0;
5021+ *option_buffer = '\0';
a37573f1
JR		 5022+
5023+ /* This block of code will try to find the parent of the host, and
5024+ if it is a group object, fetch the options and apply to the host. */
5025+ if (type == HOST_DECL)
5026+ {
5027+ char *hostdn, *basedn, *temp1, *temp2, filter[1024];
5028+ LDAPMessage *groupdn, *entry;
5029+ int ret;
5030+
5031+ hostdn = ldap_get_dn (ld, ent);
5032+ if( hostdn != NULL)
5033+ {
5034+ basedn = NULL;
5035+
5036+ temp1 = strchr (hostdn, '=');
5037+ if (temp1 != NULL)
5038+ temp1 = strchr (++temp1, '=');
5039+ if (temp1 != NULL)
5040+ temp2 = strchr (++temp1, ',');
5041+ else
5042+ temp2 = NULL;
5043+
5044+ if (temp2 != NULL)
5045+ {
5046+ snprintf (filter, sizeof(filter),
5047+ "(&(cn=%.*s)(objectClass=dhcpGroup))",
5048+ (int)(temp2 - temp1), temp1);
5049+
5050+ basedn = strchr (temp1, ',');
5051+ if (basedn != NULL)
5052+ ++basedn;
5053+ }
5054+
5055+ if (basedn != NULL && *basedn != '\0')
5056+ {
5057+ ret = ldap_search_s (ld, basedn, LDAP_SCOPE_SUBTREE,
5058+ filter, NULL, 0, &groupdn);
5059+ if (ret == LDAP_SUCCESS)
5060+ {
5061+ if ((entry = ldap_first_entry (ld, groupdn)) != NULL)
5062+ {
5063+ res = ldap_parse_entry_options (entry, option_buffer,
5064+ sizeof(option_buffer) - 1,
5065+ &lease_limit);
5066+ if (res != ISC_R_SUCCESS)
5067+ {
5068+ /* reset option buffer discarding any results */
5069+ *option_buffer = '\0';
5070+ lease_limit = 0;
5071+ }
5072+ }
5073+ ldap_msgfree( groupdn);
5074+ }
5075+ }
5076+ ldap_memfree( hostdn);
5077+ }
5078+ }
5079+
3150c1ff 5080+ res = ldap_parse_entry_options (ent, option_buffer, sizeof(option_buffer) - 1,
5081+ &lease_limit);
5082+ if (res != ISC_R_SUCCESS)
5083+ return (lease_limit);
1097e9ca 5084+
3150c1ff 5085+ option_buffer[sizeof(option_buffer) - 1] = '\0';
1097e9ca 5086+ if (*option_buffer == '\0')
5087+ return (lease_limit);
5088+
5089+ cfile = (struct parse *) NULL;
5090+ res = new_parse (&cfile, -1, option_buffer, strlen (option_buffer),
5091+ type == HOST_DECL ? "LDAP-HOST" : "LDAP-SUBCLASS", 0);
5092+ if (res != ISC_R_SUCCESS)
5093+ return (lease_limit);
5094+
5095+#if defined (DEBUG_LDAP)
5096+ log_info ("Sending the following options: '%s'", option_buffer);
5097+#endif
5098+
5099+ declaration = 0;
3150c1ff 5100+ do
5101+ {
5102+ token = peek_token (&val, NULL, cfile);
5103+ if (token == END_OF_FILE)
5104+ break;
5105+ declaration = parse_statement (cfile, group, type, host, declaration);
1097e9ca 5106+ } while (1);
5107+
5108+ end_parse (&cfile);
5109+
5110+ return (lease_limit);
5111+}
5112+
5113+
5114+
5115+int
5116+find_haddr_in_ldap (struct host_decl **hp, int htype, unsigned hlen,
5117+ const unsigned char *haddr, const char *file, int line)
5118+{
3150c1ff 5119+ char buf[128], *type_str, **tempstr, *addr_str;
1097e9ca 5120+ LDAPMessage * res, *ent;
5121+ struct host_decl * host;
5122+ isc_result_t status;
3150c1ff 5123+ ldap_dn_node *curr;
1097e9ca 5124+ int ret;
5125+
5126+ if (ldap_method == LDAP_METHOD_STATIC)
5127+ return (0);
5128+
5129+ if (ld == NULL)
5130+ ldap_start ();
5131+ if (ld == NULL)
5132+ return (0);
5133+
5134+ switch (htype)
5135+ {
5136+ case HTYPE_ETHER:
5137+ type_str = "ethernet";
5138+ break;
5139+ case HTYPE_IEEE802:
5140+ type_str = "token-ring";
5141+ break;
5142+ case HTYPE_FDDI:
5143+ type_str = "fddi";
5144+ break;
5145+ default:
5146+ log_info ("Ignoring unknown type %d", htype);
5147+ return (0);
5148+ }
5149+
5150+ /*
a37573f1
JR		 5151+ ** FIXME: It is not guaranteed, that the dhcpHWAddress attribute
5152+ ** contains _exactly_ "type addr" with one space between!
1097e9ca 5153+ */
5154+ snprintf (buf, sizeof (buf),
5155+ "(&(objectClass=dhcpHost)(dhcpHWAddress=%s %s))",
3150c1ff 5156+ type_str, print_hw_addr (htype, hlen, haddr));
1097e9ca 5157+
3150c1ff 5158+ res = ent = NULL;
5159+ for (curr = ldap_service_dn_head;
5160+ curr != NULL && *curr->dn != '\0';
5161+ curr = curr->next)
5162+ {
1097e9ca 5163+#if defined (DEBUG_LDAP)
3150c1ff 5164+ log_info ("Searching for %s in LDAP tree %s", buf, curr->dn);
1097e9ca 5165+#endif
3150c1ff 5166+ ret = ldap_search_s (ld, curr->dn, LDAP_SCOPE_SUBTREE,
5167+ buf, NULL, 0, &res);
a37573f1
JR		 5168+
5169+ if(ret == LDAP_SERVER_DOWN)
5170+ {
5171+ log_info ("LDAP server was down, trying to reconnect...");
5172+
5173+ ldap_stop();
5174+ ldap_start();
5175+ if(ld == NULL)
5176+ {
5177+ log_info ("LDAP reconnect failed - try again later...");
5178+ return (0);
5179+ }
5180+
5181+ ret = ldap_search_s (ld, curr->dn, LDAP_SCOPE_SUBTREE,
5182+ buf, NULL, 0, &res);
5183+ }
5184+
3150c1ff 5185+ if (ret == LDAP_SUCCESS)
1097e9ca 5186+ {
3150c1ff 5187+ if( (ent = ldap_first_entry (ld, res)) != NULL)
5188+ break; /* search OK and have entry */
5189+
1097e9ca 5190+#if defined (DEBUG_LDAP)
3150c1ff 5191+ log_info ("No host entry for %s in LDAP tree %s",
5192+ buf, curr->dn);
1097e9ca 5193+#endif
3150c1ff 5194+ if(res)
5195+ {
5196+ ldap_msgfree (res);
5197+ res = NULL;
5198+ }
5199+ }
5200+ else
5201+ {
5202+ if(res)
5203+ {
5204+ ldap_msgfree (res);
5205+ res = NULL;
5206+ }
1097e9ca 5207+
3150c1ff 5208+ if (ret != LDAP_NO_SUCH_OBJECT && ret != LDAP_SUCCESS)
5209+ {
5210+ log_error ("Cannot search for %s in LDAP tree %s: %s", buf,
5211+ curr->dn, ldap_err2string (ret));
a37573f1 5212+ ldap_stop();
3150c1ff 5213+ return (0);
5214+ }
5215+#if defined (DEBUG_LDAP)
5216+ else
5217+ {
5218+ log_info ("ldap_search_s returned %s when searching for %s in %s",
5219+ ldap_err2string (ret), buf, curr->dn);
5220+ }
5221+#endif
5222+ }
1097e9ca 5223+ }
5224+
3150c1ff 5225+ if (res && ent)
1097e9ca 5226+ {
5227+#if defined (DEBUG_LDAP)
3150c1ff 5228+ char *dn = ldap_get_dn (ld, ent);
5229+ if (dn != NULL)
5230+ {
5231+ log_info ("Found dhcpHWAddress LDAP entry %s", dn);
5232+ ldap_memfree(dn);
5233+ }
1097e9ca 5234+#endif
3150c1ff 5235+
1097e9ca 5236+ host = (struct host_decl *)0;
5237+ status = host_allocate (&host, MDL);
5238+ if (status != ISC_R_SUCCESS)
5239+ {
5240+ log_fatal ("can't allocate host decl struct: %s",
5241+ isc_result_totext (status));
3150c1ff 5242+ ldap_msgfree (res);
1097e9ca 5243+ return (0);
5244+ }
5245+
5246+ host->name = ldap_get_host_name (ent);
5247+ if (host->name == NULL)
5248+ {
5249+ host_dereference (&host, MDL);
5250+ ldap_msgfree (res);
5251+ return (0);
5252+ }
5253+
5254+ if (!clone_group (&host->group, root_group, MDL))
5255+ {
5256+ log_fatal ("can't clone group for host %s", host->name);
5257+ host_dereference (&host, MDL);
3150c1ff 5258+ ldap_msgfree (res);
1097e9ca 5259+ return (0);
5260+ }
5261+
5262+ ldap_parse_options (ent, host->group, HOST_DECL, host, NULL);
5263+
5264+ *hp = host;
5265+ ldap_msgfree (res);
5266+ return (1);
5267+ }
5268+
5269+
3150c1ff 5270+ if(res) ldap_msgfree (res);
1097e9ca 5271+ return (0);
5272+}
5273+
5274+
5275+int
5276+find_subclass_in_ldap (struct class *class, struct class **newclass,
5277+ struct data_string *data)
5278+{
5279+ LDAPMessage * res, * ent;
5280+ int i, ret, lease_limit;
5281+ isc_result_t status;
3150c1ff 5282+ ldap_dn_node *curr;
1097e9ca 5283+ char buf[1024];
5284+
5285+ if (ldap_method == LDAP_METHOD_STATIC)
5286+ return (0);
5287+
5288+ if (ld == NULL)
5289+ ldap_start ();
5290+ if (ld == NULL)
5291+ return (0);
5292+
a37573f1
JR		 5293+ snprintf (buf, sizeof (buf),
5294+ "(&(objectClass=dhcpSubClass)(cn=%s)(dhcpClassData=%s))",
5295+ print_hex_1 (data->len, data->data, 60),
5296+ print_hex_2 (strlen (class->name), class->name, 60));
1097e9ca 5297+#if defined (DEBUG_LDAP)
5298+ log_info ("Searching LDAP for %s", buf);
5299+#endif
5300+
3150c1ff 5301+ res = ent = NULL;
5302+ for (curr = ldap_service_dn_head;
5303+ curr != NULL && *curr->dn != '\0';
5304+ curr = curr->next)
1097e9ca 5305+ {
3150c1ff 5306+#if defined (DEBUG_LDAP)
5307+ log_info ("Searching for %s in LDAP tree %s", buf, curr->dn);
5308+#endif
5309+ ret = ldap_search_s (ld, curr->dn, LDAP_SCOPE_SUBTREE,
5310+ buf, NULL, 0, &res);
a37573f1
JR		 5311+
5312+ if(ret == LDAP_SERVER_DOWN)
5313+ {
5314+ log_info ("LDAP server was down, trying to reconnect...");
5315+
5316+ ldap_stop();
5317+ ldap_start();
5318+
5319+ if(ld == NULL)
5320+ {
5321+ log_info ("LDAP reconnect failed - try again later...");
5322+ return (0);
5323+ }
5324+
5325+ ret = ldap_search_s (ld, curr->dn, LDAP_SCOPE_SUBTREE,
5326+ buf, NULL, 0, &res);
5327+ }
5328+
3150c1ff 5329+ if (ret == LDAP_SUCCESS)
1097e9ca 5330+ {
3150c1ff 5331+ if( (ent = ldap_first_entry (ld, res)) != NULL)
5332+ break; /* search OK and have entry */
5333+
1097e9ca 5334+#if defined (DEBUG_LDAP)
3150c1ff 5335+ log_info ("No subclass entry for %s in LDAP tree %s",
5336+ buf, curr->dn);
1097e9ca 5337+#endif
3150c1ff 5338+ if(res)
5339+ {
5340+ ldap_msgfree (res);
5341+ res = NULL;
5342+ }
5343+ }
5344+ else
5345+ {
5346+ if(res)
5347+ {
5348+ ldap_msgfree (res);
5349+ res = NULL;
5350+ }
1097e9ca 5351+
3150c1ff 5352+ if (ret != LDAP_NO_SUCH_OBJECT && ret != LDAP_SUCCESS)
5353+ {
5354+ log_error ("Cannot search for %s in LDAP tree %s: %s", buf,
5355+ curr->dn, ldap_err2string (ret));
a37573f1 5356+ ldap_stop();
3150c1ff 5357+ return (0);
5358+ }
5359+#if defined (DEBUG_LDAP)
5360+ else
5361+ {
5362+ log_info ("ldap_search_s returned %s when searching for %s in %s",
5363+ ldap_err2string (ret), buf, curr->dn);
5364+ }
5365+#endif
5366+ }
1097e9ca 5367+ }
5368+
3150c1ff 5369+ if (res && ent)
1097e9ca 5370+ {
5371+#if defined (DEBUG_LDAP)
3150c1ff 5372+ char *dn = ldap_get_dn (ld, ent);
5373+ if (dn != NULL)
5374+ {
5375+ log_info ("Found subclass LDAP entry %s", dn);
5376+ ldap_memfree(dn);
5377+ }
1097e9ca 5378+#endif
3150c1ff 5379+
1097e9ca 5380+ status = class_allocate (newclass, MDL);
5381+ if (status != ISC_R_SUCCESS)
5382+ {
5383+ log_error ("Cannot allocate memory for a new class");
3150c1ff 5384+ ldap_msgfree (res);
1097e9ca 5385+ return (0);
5386+ }
5387+
5388+ group_reference (&(*newclass)->group, class->group, MDL);
5389+ class_reference (&(*newclass)->superclass, class, MDL);
5390+ lease_limit = ldap_parse_options (ent, (*newclass)->group,
5391+ CLASS_DECL, NULL, newclass);
5392+ if (lease_limit == 0)
5393+ (*newclass)->lease_limit = class->lease_limit;
5394+ else
5395+ class->lease_limit = lease_limit;
5396+
5397+ if ((*newclass)->lease_limit)
5398+ {
5399+ (*newclass)->billed_leases =
5400+ dmalloc ((*newclass)->lease_limit * sizeof (struct lease *), MDL);
5401+ if (!(*newclass)->billed_leases)
5402+ {
5403+ log_error ("no memory for billing");
5404+ class_dereference (newclass, MDL);
3150c1ff 5405+ ldap_msgfree (res);
1097e9ca 5406+ return (0);
5407+ }
5408+ memset ((*newclass)->billed_leases, 0,
5409+ ((*newclass)->lease_limit * sizeof (*newclass)->billed_leases));
5410+ }
5411+
5412+ data_string_copy (&(*newclass)->hash_string, data, MDL);
5413+
5414+ ldap_msgfree (res);
5415+ return (1);
5416+ }
5417+
3150c1ff 5418+ if(res) ldap_msgfree (res);
1097e9ca 5419+ return (0);
5420+}
5421+
5422+#endif
a37573f1
JR		 5423diff -Naur dhcp-3.0.5/server/ldap_casa.c dhcp-3.0.5-ldap/server/ldap_casa.c
5424--- dhcp-3.0.5/server/ldap_casa.c 1969-12-31 19:00:00.000000000 -0500
5425+++ dhcp-3.0.5-ldap/server/ldap_casa.c 2007-02-23 12:48:56.000000000 -0500
5426@@ -0,0 +1,138 @@
5427+/* ldap_casa.c
5428+
5429+ CASA routines for DHCPD... */
5430+
5431+/* Copyright (c) 2004 Internet Systems Consorium, Inc. ("ISC")
5432+ * Copyright (c) 1995-2003 Internet Software Consortium.
5433+ * Copyright (c) 2006 Novell, Inc.
5434+
5435+ * All rights reserved.
5436+ * Redistribution and use in source and binary forms, with or without
5437+ * modification, are permitted provided that the following conditions are met:
5438+ * 1.Redistributions of source code must retain the above copyright notice,
5439+ * this list of conditions and the following disclaimer.
5440+ * 2.Redistributions in binary form must reproduce the above copyright notice,
5441+ * this list of conditions and the following disclaimer in the documentation
5442+ * and/or other materials provided with the distribution.
5443+ * 3.Neither the name of ISC, ISC DHCP, nor the names of its contributors
5444+ * may be used to endorse or promote products derived from this software
5445+ * without specific prior written permission.
5446+
5447+ * THIS SOFTWARE IS PROVIDED BY INTERNET SYSTEMS CONSORTIUM AND CONTRIBUTORS
5448+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
5449+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
5450+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ISC OR CONTRIBUTORS BE LIABLE
5451+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
5452+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
5453+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
5454+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
5455+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
5456+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
5457+ * POSSIBILITY OF SUCH DAMAGE.
5458+
5459+ * This file was written by S Kalyanasundaram <skalyanasundaram@novell.com>
5460+ */
5461+
5462+#if defined(LDAP_CASA_AUTH)
5463+#include "ldap_casa.h"
5464+#include "dhcpd.h"
5465+
5466+int
5467+load_casa (void)
5468+{
5469+ if( !(casaIDK = dlopen(MICASA_LIB,RTLD_LAZY)))
5470+ return 0;
5471+ p_miCASAGetCredential = (CASA_GetCredential_T) dlsym(casaIDK, "miCASAGetCredential");
5472+ p_miCASASetCredential = (CASA_SetCredential_T) dlsym(casaIDK, "miCASASetCredential");
5473+ p_miCASARemoveCredential = (CASA_RemoveCredential_T) dlsym(casaIDK, "miCASARemoveCredential");
5474+
5475+ if((p_miCASAGetCredential == NULL) ||
5476+ (p_miCASASetCredential == NULL) ||
5477+ (p_miCASARemoveCredential == NULL))
5478+ {
5479+ if(casaIDK)
5480+ dlclose(casaIDK);
5481+ casaIDK = NULL;
5482+ p_miCASAGetCredential = NULL;
5483+ p_miCASASetCredential = NULL;
5484+ p_miCASARemoveCredential = NULL;
5485+ return 0;
5486+ }
5487+ else
5488+ return 1;
5489+}
5490+
5491+static void
5492+release_casa(void)
5493+{
5494+ if(casaIDK)
5495+ {
5496+ dlclose(casaIDK);
5497+ casaIDK = NULL;
5498+ }
5499+
5500+ p_miCASAGetCredential = NULL;
5501+ p_miCASASetCredential = NULL;
5502+ p_miCASARemoveCredential = NULL;
5503+
5504+}
5505+
5506+int
5507+load_uname_pwd_from_miCASA (char **ldap_username, char **ldap_password)
5508+ {
5509+ int result = 0;
5510+ uint32_t credentialtype = SSCS_CRED_TYPE_SERVER_F;
5511+ SSCS_BASIC_CREDENTIAL credential;
5512+ SSCS_SECRET_ID_T applicationSecretId;
5513+ char *tempVar = NULL;
5514+
5515+ const char applicationName[10] = "dhcp-ldap";
5516+
5517+ if ( load_casa() )
5518+ {
5519+ memset(&credential, 0, sizeof(SSCS_BASIC_CREDENTIAL));
5520+ memset(&applicationSecretId, 0, sizeof(SSCS_SECRET_ID_T));
5521+
5522+ applicationSecretId.len = strlen(applicationName) + 1;
5523+ memcpy (applicationSecretId.id, applicationName, applicationSecretId.len);
5524+
5525+ credential.unFlags = USERNAME_TYPE_CN_F;
5526+
5527+ result = p_miCASAGetCredential (0,
5528+ &applicationSecretId,NULL,&credentialtype,
5529+ &credential,NULL);
5530+
5531+ if(credential.unLen)
5532+ {
5533+ tempVar = dmalloc (credential.unLen + 1, MDL);
5534+ if (!tempVar)
5535+ log_fatal ("no memory for ldap_username");
5536+ memcpy(tempVar , credential.username, credential.unLen);
5537+ *ldap_username = tempVar;
5538+
5539+ tempVar = dmalloc (credential.pwordLen + 1, MDL);
5540+ if (!tempVar)
5541+ log_fatal ("no memory for ldap_password");
5542+ memcpy(tempVar, credential.password, credential.pwordLen);
5543+ *ldap_password = tempVar;
5544+
5545+#if defined (DEBUG_LDAP)
5546+ log_info ("Authentication credential taken from CASA");
5547+#endif
5548+
5549+ release_casa();
5550+ return 1;
5551+
5552+ }
5553+ else
5554+ {
5555+ release_casa();
5556+ return 0;
5557+ }
5558+ }
5559+ else
5560+ return 0; //casa libraries not loaded
5561+ }
5562+
5563+#endif /* LDAP_CASA_AUTH */
1097e9ca 5564+
a37573f1
JR		 5565diff -Naur dhcp-3.0.5/server/mdb.c dhcp-3.0.5-ldap/server/mdb.c
5566--- dhcp-3.0.5/server/mdb.c 2006-07-18 14:16:25.000000000 -0400
5567+++ dhcp-3.0.5-ldap/server/mdb.c 2006-12-14 10:03:41.000000000 -0500
3150c1ff 5568@@ -375,6 +375,12 @@
1097e9ca 5569 {
5570 struct host_decl *foo;
5571 struct hardware h;
5572+ int ret;
5573+
5574+#if defined(LDAP_CONFIGURATION)
5575+ if ((ret = find_haddr_in_ldap (hp, htype, hlen, haddr, file, line)))
5576+ return ret;
5577+#endif
5578
5579 h.hlen = hlen + 1;
5580 h.hbuf [0] = htype;
a37573f1
JR		 5581diff -Naur dhcp-3.0.5/server/stables.c dhcp-3.0.5-ldap/server/stables.c
5582--- dhcp-3.0.5/server/stables.c 2004-06-10 13:59:58.000000000 -0400
5583+++ dhcp-3.0.5-ldap/server/stables.c 2007-02-23 13:13:36.000000000 -0500
5584@@ -236,9 +236,86 @@
e0a22902 5585 { "adaptive-lease-time-threshold", "B", &server_universe, 50, 1 },
f20f83d3
AM		 5586 { "do-reverse-updates", "f", &server_universe, 51, 1 },
5587 { "fqdn-reply", "f", &server_universe, 52, 1 },
1097e9ca 5588+#if defined(LDAP_CONFIGURATION)
f20f83d3
AM		 5589+ { "ldap-server", "t", &server_universe, 53, 1 },
5590+ { "ldap-port", "d", &server_universe, 54, 1 },
5591+ { "ldap-username", "t", &server_universe, 55, 1 },
5592+ { "ldap-password", "t", &server_universe, 56, 1 },
5593+ { "ldap-base-dn", "t", &server_universe, 57, 1 },
5594+ { "ldap-method", "Nldap-methods.", &server_universe, 58, 1 },
5595+ { "ldap-debug-file", "t", &server_universe, 59, 1 },
5596+ { "ldap-dhcp-server-cn", "t", &server_universe, 60, 1 },
5597+ { "ldap-referrals", "f", &server_universe, 61, 1 },
a37573f1 5598+#if defined(USE_SSL)
f20f83d3
AM		 5599+ { "ldap-ssl", "Nldap-ssl-usage.", &server_universe, 62, 1 },
5600+ { "ldap-tls-reqcert", "Nldap-tls-reqcert.", &server_universe, 63, 1 },
5601+ { "ldap-tls-ca-file", "t", &server_universe, 64, 1 },
5602+ { "ldap-tls-ca-dir", "t", &server_universe, 65, 1 },
5603+ { "ldap-tls-cert", "t", &server_universe, 66, 1 },
5604+ { "ldap-tls-key", "t", &server_universe, 67, 1 },
5605+ { "ldap-tls-crlcheck", "Nldap-tls-crlcheck.", &server_universe, 68, 1 },
5606+ { "ldap-tls-ciphers", "t", &server_universe, 69, 1 },
5607+ { "ldap-tls-randfile", "t", &server_universe, 70, 1 },
a37573f1 5608+#endif
1097e9ca 5609+#endif
e0a22902 5610 { NULL, NULL, NULL, 0, 0 }
1097e9ca 5611 };
5612
5613+#if defined(LDAP_CONFIGURATION)
5614+struct enumeration_value ldap_values [] = {
5615+ { "static", LDAP_METHOD_STATIC },
5616+ { "dynamic", LDAP_METHOD_DYNAMIC },
5617+ { (char *) 0, 0 }
5618+};
5619+
5620+struct enumeration ldap_methods = {
5621+ (struct enumeration *)0,
5622+ "ldap-methods",
5623+ ldap_values
5624+};
a37573f1
JR		 5625+
5626+#if defined(USE_SSL)
5627+struct enumeration_value ldap_ssl_usage_values [] = {
5628+ { "off", LDAP_SSL_OFF },
5629+ { "on", LDAP_SSL_ON },
5630+ { "ldaps", LDAP_SSL_LDAPS},
5631+ { "start_tls", LDAP_SSL_TLS },
5632+ { (char *) 0, 0 }
5633+};
5634+struct enumeration ldap_ssl_usage_enum = {
5635+ (struct enumeration *)0,
5636+ "ldap-ssl-usage",
5637+ ldap_ssl_usage_values
5638+};
5639+
5640+struct enumeration_value ldap_tls_reqcert_values [] = {
5641+ { "never", LDAP_OPT_X_TLS_NEVER },
5642+ { "hard", LDAP_OPT_X_TLS_HARD },
5643+ { "demand", LDAP_OPT_X_TLS_DEMAND},
5644+ { "allow", LDAP_OPT_X_TLS_ALLOW },
5645+ { "try", LDAP_OPT_X_TLS_TRY },
5646+ { (char *) 0, 0 }
5647+};
5648+struct enumeration ldap_tls_reqcert_enum = {
5649+ (struct enumeration *)0,
5650+ "ldap-tls-reqcert",
5651+ ldap_tls_reqcert_values
5652+};
5653+
5654+struct enumeration_value ldap_tls_crlcheck_values [] = {
5655+ { "none", LDAP_OPT_X_TLS_CRL_NONE},
5656+ { "peer", LDAP_OPT_X_TLS_CRL_PEER},
5657+ { "all", LDAP_OPT_X_TLS_CRL_ALL },
5658+ { (char *) 0, 0 }
5659+};
5660+struct enumeration ldap_tls_crlcheck_enum = {
5661+ (struct enumeration *)0,
5662+ "ldap-tls-crlcheck",
5663+ ldap_tls_crlcheck_values
5664+};
5665+#endif
1097e9ca 5666+#endif
5667+
5668 struct enumeration_value ddns_styles_values [] = {
5669 { "none", 0 },
5670 { "ad-hoc", 1 },
a37573f1
JR		 5671diff -Naur dhcp-3.0.5/site.conf dhcp-3.0.5-ldap/site.conf
5672--- dhcp-3.0.5/site.conf 1999-07-07 11:20:10.000000000 -0400
5673+++ dhcp-3.0.5-ldap/site.conf 2007-02-23 13:41:54.000000000 -0500
1097e9ca 5674@@ -1,2 +1,3 @@
5675 # Put local site configuration stuff here to override the default
5676 # settings in Makefile.conf
a37573f1 5677+#COPTS = -DDEBUG_LDAP -DLDAP_CASA_AUTH -DDEBUG_CLASS_MATCHING -Wall -O -Wno-unused
DHCP Server
This page took 0.856965 seconds and 4 git commands to generate.