examples/misc/adssearch.pl

   1 #!/usr/bin/perl -w
   2 #
   3 # adssearch.pl  - query an Active Directory server and
   4 #                 display objects in a human readable format
   5 #
   6 # Copyright (C) Guenther Deschner <gd@samba.org> 2003-2008
   7 #
   8 # TODO: add range retrieval
   9 #       write sddl-converter, decode userParameters
  10 #       apparently only win2k3 allows simple-binds with machine-accounts.
  11 #       make sasl support independent from Authen::SASL::Cyrus v >0.11
  12 use strict;
  13
  14 use Net::LDAP;
  15 use Net::LDAP::Control;
  16 use Net::LDAP::Constant qw(LDAP_REFERRAL);
  17 use Convert::ASN1;
  18 use Time::Local;
  19 use POSIX qw(strftime);
  20 use Getopt::Long;
  21
  22 my $have_sasl;
  23 my $works_sasl;
  24 my $pref_version;
  25 BEGIN {
  26         my $class = 'Authen::SASL';
  27         $pref_version = "0.32";
  28         if ( eval "require $class;" ) {
  29                 $have_sasl = 1;
  30         }
  31         if ( eval "Net::LDAP->VERSION($pref_version);" ) {
  32                 $works_sasl = 1;
  33         }
  34 }
  35
  36 # users may set defaults here
  37 my $base        = "";
  38 my $binddn      = "";
  39 my $password    = "";
  40 my $server      = "";
  41 my $rebind_url;
  42
  43
  44 my $tdbdump     = "/usr/bin/tdbdump";
  45 my $ntdbdump    = "/usr/bin/ntdbdump";
  46 my $testparm    = "/usr/bin/testparm";
  47 my $net         = "/usr/bin/net";
  48 my $dig         = "/usr/bin/dig";
  49 my $nmblookup   = "/usr/bin/nmblookup";
  50 my $secrets_tdb = "/etc/samba/secrets.tdb";
  51 my $secrets_ntdb = "/etc/samba/secrets.ntdb";
  52 my $klist       = "/usr/bin/klist";
  53 my $kinit       = "/usr/bin/kinit";
  54 my $workgroup   = "";
  55 my $machine     = "";
  56 my $realm       = "";
  57
  58 # parse input
  59 my (
  60         $opt_asq,
  61         $opt_base,
  62         $opt_binddn,
  63         $opt_debug,
  64         $opt_display_extendeddn,
  65         $opt_display_metadata,
  66         $opt_display_raw,
  67         $opt_domain_scope,
  68         $opt_dump_rootdse,
  69         $opt_dump_schema,
  70         $opt_dump_wknguid,
  71         $opt_fastbind,
  72         $opt_help,
  73         $opt_host,
  74         $opt_machine,
  75         $opt_notify,
  76         $opt_notify_nodiffs,
  77         $opt_paging,
  78         $opt_password,
  79         $opt_port,
  80         $opt_realm,
  81         $opt_saslmech,
  82         $opt_search_opt,
  83         $opt_scope,
  84         $opt_simpleauth,
  85         $opt_starttls,
  86         $opt_user,
  87         $opt_verbose,
  88         $opt_workgroup,
  89 );
  90
  91 GetOptions(
  92         'asq=s'         => \$opt_asq,
  93         'base|b=s'      => \$opt_base,
  94         'D|DN=s'        => \$opt_binddn,
  95         'debug=i'       => \$opt_debug,
  96         'domain_scope'  => \$opt_domain_scope,
  97         'extendeddn|e:i'        => \$opt_display_extendeddn,
  98         'fastbind'      => \$opt_fastbind,
  99         'help'          => \$opt_help,
 100         'host|h=s'      => \$opt_host,
 101         'machine|P'     => \$opt_machine,
 102         'metadata|m'    => \$opt_display_metadata,
 103         'nodiffs'       => \$opt_notify_nodiffs,
 104         'notify|n'      => \$opt_notify,
 105         'paging:i'      => \$opt_paging,
 106         'password|w=s'  => \$opt_password,
 107         'port=i'        => \$opt_port,
 108         'rawdisplay'    => \$opt_display_raw,
 109         'realm|R=s'     => \$opt_realm,
 110         'rootDSE'       => \$opt_dump_rootdse,
 111         'saslmech|Y=s'  => \$opt_saslmech,
 112         'schema|c'      => \$opt_dump_schema,
 113         'scope|s=s'     => \$opt_scope,
 114         'searchopt:i'   => \$opt_search_opt,
 115         'simpleauth|x'  => \$opt_simpleauth,
 116         'tls|Z'         => \$opt_starttls,
 117         'user|U=s'      => \$opt_user,
 118         'verbose|v'     => \$opt_verbose,
 119         'wknguid'       => \$opt_dump_wknguid,
 120         'workgroup|k=s' => \$opt_workgroup,
 121         );
 122
 123
 124 if (!@ARGV && !$opt_dump_schema && !$opt_dump_rootdse && !$opt_notify || $opt_help) {
 125         usage();
 126         exit 1;
 127 }
 128
 129 if ($opt_fastbind && !$opt_simpleauth) {
 130         printf("LDAP fast bind can only be performed with simple binds\n");
 131         exit 1;
 132 }
 133
 134 if ($opt_notify) {
 135         $opt_paging = undef;
 136 }
 137
 138 # get the query
 139 my $query       = shift;
 140 my @attrs       = @ARGV;
 141
 142 # some global vars
 143 my $filter = "";
 144 my ($dse, $uri);
 145 my ($attr, $value);
 146 my (@ctrls, @ctrls_s);
 147 my ($ctl_paged, $cookie);
 148 my ($page_count, $total_entry_count);
 149 my ($sasl_hd, $async_ldap_hd, $sync_ldap_hd);
 150 my ($mesg, $usn);
 151 my (%entry_store);
 152 my $async_search;
 153
 154 # fixed values and vars
 155 my $set         = "X";
 156 my $unset       = "-";
 157 my $tabsize     = "\t\t\t";
 158
 159 # get defaults
 160 my $scope       = $opt_scope    || "sub";
 161 my $port        = $opt_port;
 162
 163 my %ads_controls = (
 164 "LDAP_SERVER_NOTIFICATION_OID"          => "1.2.840.113556.1.4.528",
 165 "LDAP_SERVER_EXTENDED_DN_OID"           => "1.2.840.113556.1.4.529",
 166 "LDAP_PAGED_RESULT_OID_STRING"          => "1.2.840.113556.1.4.319",
 167 "LDAP_SERVER_SD_FLAGS_OID"              => "1.2.840.113556.1.4.801",
 168 "LDAP_SERVER_SORT_OID"                  => "1.2.840.113556.1.4.473",
 169 "LDAP_SERVER_RESP_SORT_OID"             => "1.2.840.113556.1.4.474",
 170 "LDAP_CONTROL_VLVREQUEST"               => "2.16.840.1.113730.3.4.9",
 171 "LDAP_CONTROL_VLVRESPONSE"              => "2.16.840.1.113730.3.4.10",
 172 "LDAP_SERVER_RANGE_RETRIEVAL"           => "1.2.840.113556.1.4.802", #unsure
 173 "LDAP_SERVER_SHOW_DELETED_OID"          => "1.2.840.113556.1.4.417",
 174 "LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID"  => "1.2.840.113556.1.4.521",
 175 "LDAP_SERVER_LAZY_COMMIT_OID"           => "1.2.840.113556.1.4.619",
 176 "LDAP_SERVER_TREE_DELETE_OID"           => "1.2.840.113556.1.4.805",
 177 "LDAP_SERVER_DIRSYNC_OID"               => "1.2.840.113556.1.4.841",
 178 "LDAP_SERVER_VERIFY_NAME_OID"           => "1.2.840.113556.1.4.1338",
 179 "LDAP_SERVER_DOMAIN_SCOPE_OID"          => "1.2.840.113556.1.4.1339",
 180 "LDAP_SERVER_SEARCH_OPTIONS_OID"        => "1.2.840.113556.1.4.1340",
 181 "LDAP_SERVER_PERMISSIVE_MODIFY_OID"     => "1.2.840.113556.1.4.1413",
 182 "LDAP_SERVER_ASQ_OID"                   => "1.2.840.113556.1.4.1504",
 183 "NONE (Get stats control)"              => "1.2.840.113556.1.4.970",
 184 "LDAP_SERVER_QUOTA_CONTROL_OID"         => "1.2.840.113556.1.4.1852",
 185 "LDAP_SERVER_SHUTDOWN_NOTIFY_OID"       => "1.2.840.113556.1.4.1907",
 186 );
 187
 188 my %ads_capabilities = (
 189 "LDAP_CAP_ACTIVE_DIRECTORY_OID"         => "1.2.840.113556.1.4.800",
 190 "LDAP_CAP_ACTIVE_DIRECTORY_V51_OID"     => "1.2.840.113556.1.4.1670",
 191 "LDAP_CAP_ACTIVE_DIRECTORY_LDAP_INTEG_OID" => "1.2.840.113556.1.4.1791",
 192 );
 193
 194 my %ads_extensions = (
 195 "LDAP_START_TLS_OID"                    => "1.3.6.1.4.1.1466.20037",
 196 "LDAP_TTL_EXTENDED_OP_OID"              => "1.3.6.1.4.1.1466.101.119.1",
 197 "LDAP_SERVER_FAST_BIND_OID"             => "1.2.840.113556.1.4.1781",
 198 "NONE (TTL refresh extended op)"        => "1.3.6.1.4.1.1466.101.119.1",
 199 );
 200
 201 my %ads_matching_rules = (
 202 "LDAP_MATCHING_RULE_BIT_AND"            => "1.2.840.113556.1.4.803",
 203 "LDAP_MATCHING_RULE_BIT_OR"             => "1.2.840.113556.1.4.804",
 204 );
 205
 206 my %wknguids = (
 207 "WELL_KNOWN_GUID_COMPUTERS"             => "AA312825768811D1ADED00C04FD8D5CD",
 208 "WELL_KNOWN_GUID_DOMAIN_CONTROLLERS"    => "A361B2FFFFD211D1AA4B00C04FD7D83A",
 209 "WELL_KNOWN_GUID_SYSTEM"                => "AB1D30F3768811D1ADED00C04FD8D5CD",
 210 "WELL_KNOWN_GUID_USERS"                 => "A9D1CA15768811D1ADED00C04FD8D5CD",
 211 );
 212
 213 my %ads_systemflags = (
 214 "FLAG_DONT_REPLICATE"                   => 0x00000001,  # 1
 215 "FLAG_REPLICATE_TO_GC"                  => 0x00000002,  # 2
 216 "FLAG_ATTRIBUTE_CONSTRUCT"              => 0x00000004,  # 4
 217 "FLAG_CATEGORY_1_OBJECT"                => 0x00000010,  # 16
 218 "FLAG_DELETE_WITHOUT_TOMBSTONE"         => 0x02000000,  # 33554432
 219 "FLAG_DOMAIN_DISALLOW_MOVE"             => 0x04000000,  # 67108864
 220 "FLAG_DOMAIN_DISALLOW_RENAME"           => 0x08000000,  # 134217728
 221 #"FLAG_CONFIG_CAN_MOVE_RESTRICTED"      => 0x10000000,  # 268435456     # only setable on creation
 222 #"FLAG_CONFIG_CAN_MOVE"                 => 0x20000000,  # 536870912     # only setable on creation
 223 #"FLAG_CONFIG_CAN_RENAME"               => 0x40000000,  # 1073741824    # only setable on creation
 224 "FLAG_DISALLOW_DELETE"                  => 0x80000000,  # 2147483648
 225 );
 226
 227 my %ads_mixed_domain = (
 228 "NATIVE_LEVEL_DOMAIN"                   => 0,
 229 "MIXED_LEVEL_DOMAIN"                    => 1,
 230 );
 231
 232 my %ads_ds_func = (
 233 "DS_BEHAVIOR_WIN2000"                   => 0,   # untested
 234 "DS_BEHAVIOR_WIN2003"                   => 2,
 235 "DS_BEHAVIOR_WIN2008"                   => 3,
 236 );
 237
 238 my %ads_instance_type = (
 239 "DS_INSTANCETYPE_IS_NC_HEAD"            => 0x1,
 240 "IT_WRITE"                              => 0x4,
 241 "IT_NC_ABOVE"                           => 0x8,
 242 );
 243
 244 my %ads_uacc = (
 245         "ACCOUNT_NEVER_EXPIRES"         => 0x000000, # 0
 246         "ACCOUNT_OK"                    => 0x800000, # 8388608
 247         "ACCOUNT_LOCKED_OUT"            => 0x800010, # 8388624
 248 );
 249
 250 my %ads_enctypes = (
 251         "DES-CBC-CRC"                           => 0x01,
 252         "DES-CBC-MD5"                           => 0x02,
 253         "RC4_HMAC_MD5"                          => 0x04,
 254         "AES128_CTS_HMAC_SHA1_96"               => 0x08,
 255         "AES128_CTS_HMAC_SHA1_128"              => 0x10,
 256 );
 257
 258 my %ads_gpoptions = (
 259         "GPOPTIONS_INHERIT"             => 0,
 260         "GPOPTIONS_BLOCK_INHERITANCE"   => 1,
 261 );
 262
 263 my %ads_gplink_opts = (
 264         "GPLINK_OPT_NONE"               => 0,
 265         "GPLINK_OPT_DISABLED"           => 1,
 266         "GPLINK_OPT_ENFORCED"           => 2,
 267 );
 268
 269 my %ads_gpflags = (
 270         "GPFLAGS_ALL_ENABLED"                   => 0,
 271         "GPFLAGS_USER_SETTINGS_DISABLED"        => 1,
 272         "GPFLAGS_MACHINE_SETTINGS_DISABLED"     => 2,
 273         "GPFLAGS_ALL_DISABLED"                  => 3,
 274 );
 275
 276 my %ads_serverstate = (
 277         "SERVER_ENABLED"                => 1,
 278         "SERVER_DISABLED"               => 2,
 279 );
 280
 281 my %ads_sdeffective = (
 282         "OWNER_SECURITY_INFORMATION"    => 0x01,
 283         "DACL_SECURITY_INFORMATION"     => 0x04,
 284         "SACL_SECURITY_INFORMATION"     => 0x10,
 285 );
 286
 287 my %ads_trustattrs = (
 288         "TRUST_ATTRIBUTE_NON_TRANSITIVE"        => 1,
 289         "TRUST_ATTRIBUTE_TREE_PARENT"           => 2,
 290         "TRUST_ATTRIBUTE_TREE_ROOT"             => 3,
 291         "TRUST_ATTRIBUTE_UPLEVEL_ONLY"          => 4,
 292 );
 293
 294 my %ads_trustdirection = (
 295         "TRUST_DIRECTION_INBOUND"               => 1,
 296         "TRUST_DIRECTION_OUTBOUND"              => 2,
 297         "TRUST_DIRECTION_BIDIRECTIONAL"         => 3,
 298 );
 299
 300 my %ads_trusttype = (
 301         "TRUST_TYPE_DOWNLEVEL"                  => 1,
 302         "TRUST_TYPE_UPLEVEL"                    => 2,
 303         "TRUST_TYPE_KERBEROS"                   => 3,
 304         "TRUST_TYPE_DCE"                        => 4,
 305 );
 306
 307 my %ads_pwdproperties = (
 308         "DOMAIN_PASSWORD_COMPLEX"               => 1,
 309         "DOMAIN_PASSWORD_NO_ANON_CHANGE"        => 2,
 310         "DOMAIN_PASSWORD_NO_CLEAR_CHANGE"       => 4,
 311         "DOMAIN_LOCKOUT_ADMINS"                 => 8,
 312         "DOMAIN_PASSWORD_STORE_CLEARTEXT"       => 16,
 313         "DOMAIN_REFUSE_PASSWORD_CHANGE"         => 32,
 314 );
 315
 316 my %ads_uascompat = (
 317         "LANMAN_USER_ACCOUNT_SYSTEM_NOLIMITS"   => 0,
 318         "LANMAN_USER_ACCOUNT_SYSTEM_COMPAT"     => 1,
 319 );
 320
 321 my %ads_frstypes = (
 322         "REPLICA_SET_SYSVOL"            => 2,   # unsure
 323         "REPLICA_SET_DFS"               => 1,   # unsure
 324         "REPLICA_SET_OTHER"             => 0,   # unsure
 325 );
 326
 327 my %ads_gp_cse_extensions = (
 328 "Administrative Templates Extension"    => "35378EAC-683F-11D2-A89A-00C04FBBCFA2",
 329 "Disk Quotas"                           => "3610EDA5-77EF-11D2-8DC5-00C04FA31A66",
 330 "EFS Recovery"                          => "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A",
 331 "Folder Redirection"                    => "25537BA6-77A8-11D2-9B6C-0000F8080861",
 332 "IP Security"                           => "E437BC1C-AA7D-11D2-A382-00C04F991E27",
 333 "Internet Explorer Maintenance"         => "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B",
 334 "QoS Packet Scheduler"                  => "426031c0-0b47-4852-b0ca-ac3d37bfcb39",
 335 "Scripts"                               => "42B5FAAE-6536-11D2-AE5A-0000F87571E3",
 336 "Security"                              => "827D319E-6EAC-11D2-A4EA-00C04F79F83A",
 337 "Software Installation"                 => "C6DC5466-785A-11D2-84D0-00C04FB169F7",
 338 );
 339
 340 # guess work
 341 my %ads_gpcextensions = (
 342 "Administrative Templates"              => "0F6B957D-509E-11D1-A7CC-0000F87571E3",
 343 "Certificates"                          => "53D6AB1D-2488-11D1-A28C-00C04FB94F17",
 344 "EFS recovery policy processing"        => "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A",
 345 "Folder Redirection policy processing"  => "25537BA6-77A8-11D2-9B6C-0000F8080861",
 346 "Folder Redirection"                    => "88E729D6-BDC1-11D1-BD2A-00C04FB9603F",
 347 "Registry policy processing"            => "35378EAC-683F-11D2-A89A-00C04FBBCFA2",
 348 "Remote Installation Services"          => "3060E8CE-7020-11D2-842D-00C04FA372D4",
 349 "Security Settings"                     => "803E14A0-B4FB-11D0-A0D0-00A0C90F574B",
 350 "Security policy processing"            => "827D319E-6EAC-11D2-A4EA-00C04F79F83A",
 351 "unknown"                               => "3060E8D0-7020-11D2-842D-00C04FA372D4",
 352 "unknown2"                              => "53D6AB1B-2488-11D1-A28C-00C04FB94F17",
 353 );
 354
 355 my %ads_gpo_default_guids = (
 356 "Default Domain Policy"                 => "31B2F340-016D-11D2-945F-00C04FB984F9",
 357 "Default Domain Controllers Policy"     => "6AC1786C-016F-11D2-945F-00C04fB984F9",
 358 "mist"                                  => "61718096-3D3F-4398-8318-203A48976F9E",
 359 );
 360
 361 my %ads_uf = (
 362         "UF_SCRIPT"                             => 0x00000001,
 363         "UF_ACCOUNTDISABLE"                     => 0x00000002,
 364 #       "UF_UNUSED_1"                           => 0x00000004,
 365         "UF_HOMEDIR_REQUIRED"                   => 0x00000008,
 366         "UF_LOCKOUT"                            => 0x00000010,
 367         "UF_PASSWD_NOTREQD"                     => 0x00000020,
 368         "UF_PASSWD_CANT_CHANGE"                 => 0x00000040,
 369         "UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED"    => 0x00000080,
 370         "UF_TEMP_DUPLICATE_ACCOUNT"             => 0x00000100,
 371         "UF_NORMAL_ACCOUNT"                     => 0x00000200,
 372 #       "UF_UNUSED_2"                           => 0x00000400,
 373         "UF_INTERDOMAIN_TRUST_ACCOUNT"          => 0x00000800,
 374         "UF_WORKSTATION_TRUST_ACCOUNT"          => 0x00001000,
 375         "UF_SERVER_TRUST_ACCOUNT"               => 0x00002000,
 376 #       "UF_UNUSED_3"                           => 0x00004000,
 377 #       "UF_UNUSED_4"                           => 0x00008000,
 378         "UF_DONT_EXPIRE_PASSWD"                 => 0x00010000,
 379         "UF_MNS_LOGON_ACCOUNT"                  => 0x00020000,
 380         "UF_SMARTCARD_REQUIRED"                 => 0x00040000,
 381         "UF_TRUSTED_FOR_DELEGATION"             => 0x00080000,
 382         "UF_NOT_DELEGATED"                      => 0x00100000,
 383         "UF_USE_DES_KEY_ONLY"                   => 0x00200000,
 384         "UF_DONT_REQUIRE_PREAUTH"               => 0x00400000,
 385         "UF_PASSWORD_EXPIRED"                   => 0x00800000,
 386         "UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION" => 0x01000000,
 387         "UF_NO_AUTH_DATA_REQUIRED"              => 0x02000000,
 388 #       "UF_UNUSED_8"                           => 0x04000000,
 389 #       "UF_UNUSED_9"                           => 0x08000000,
 390 #       "UF_UNUSED_10"                          => 0x10000000,
 391 #       "UF_UNUSED_11"                          => 0x20000000,
 392 #       "UF_UNUSED_12"                          => 0x40000000,
 393 #       "UF_UNUSED_13"                          => 0x80000000,
 394 );
 395
 396 my %ads_grouptype = (
 397         "GROUP_TYPE_BUILTIN_LOCAL_GROUP"        => 0x00000001,
 398         "GROUP_TYPE_ACCOUNT_GROUP"              => 0x00000002,
 399         "GROUP_TYPE_RESOURCE_GROUP"             => 0x00000004,
 400         "GROUP_TYPE_UNIVERSAL_GROUP"            => 0x00000008,
 401         "GROUP_TYPE_APP_BASIC_GROUP"            => 0x00000010,
 402         "GROUP_TYPE_APP_QUERY_GROUP"            => 0x00000020,
 403         "GROUP_TYPE_SECURITY_ENABLED"           => 0x80000000,
 404 );
 405
 406 my %ads_atype = (
 407         "ATYPE_NORMAL_ACCOUNT"                  => 0x30000000,
 408         "ATYPE_WORKSTATION_TRUST"               => 0x30000001,
 409         "ATYPE_INTERDOMAIN_TRUST"               => 0x30000002,
 410         "ATYPE_SECURITY_GLOBAL_GROUP"           => 0x10000000,
 411         "ATYPE_DISTRIBUTION_GLOBAL_GROUP"       => 0x10000001,
 412         "ATYPE_DISTRIBUTION_UNIVERSAL_GROUP"    => 0x10000001, # ATYPE_DISTRIBUTION_GLOBAL_GROUP
 413         "ATYPE_SECURITY_LOCAL_GROUP"            => 0x20000000,
 414         "ATYPE_DISTRIBUTION_LOCAL_GROUP"        => 0x20000001,
 415         "ATYPE_ACCOUNT"                         => 0x30000000, # ATYPE_NORMAL_ACCOUNT
 416         "ATYPE_GLOBAL_GROUP"                    => 0x10000000, # ATYPE_SECURITY_GLOBAL_GROUP
 417         "ATYPE_LOCAL_GROUP"                     => 0x20000000, # ATYPE_SECURITY_LOCAL_GROUP
 418 );
 419
 420 my %ads_gtype = (
 421         "GTYPE_SECURITY_BUILTIN_LOCAL_GROUP"    => 0x80000005,
 422         "GTYPE_SECURITY_DOMAIN_LOCAL_GROUP"     => 0x80000004,
 423         "GTYPE_SECURITY_GLOBAL_GROUP"           => 0x80000002,
 424         "GTYPE_SECURITY_UNIVERSAL_GROUP"        => 0x80000008,
 425         "GTYPE_DISTRIBUTION_GLOBAL_GROUP"       => 0x00000002,
 426         "GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP" => 0x00000004,
 427         "GTYPE_DISTRIBUTION_UNIVERSAL_GROUP"    => 0x00000008,
 428 );
 429
 430 my %munged_dial = (
 431         "CtxCfgPresent"         => \&dump_int,
 432         "CtxCfgFlags1"          => \&dump_int,
 433         "CtxCallback"           => \&dump_string,
 434         "CtxShadow"             => \&dump_string,
 435         "CtxMaxConnectionTime"  => \&dump_int,
 436         "CtxMaxDisconnectionTime"=> \&dump_int,
 437         "CtxMaxIdleTime"        => \&dump_int,
 438         "CtxKeyboardLayout"     => \&dump_int,
 439         "CtxMinEncryptionLevel" => \&dump_int,
 440         "CtxWorkDirectory"      => \&dump_string,
 441         "CtxNWLogonServer"      => \&dump_string,
 442         "CtxWFHomeDir"          => \&dump_string,
 443         "CtxWFHomeDirDrive"     => \&dump_string,
 444         "CtxWFProfilePath"      => \&dump_string,
 445         "CtxInitialProgram"     => \&dump_string,
 446         "CtxCallbackNumber"     => \&dump_string,
 447 );
 448
 449 $SIG{__WARN__} = sub {
 450         use Carp;
 451         Carp::cluck (shift);
 452 };
 453
 454 # if there is data missing, we try to autodetect with samba-tools (if installed)
 455 # this might fill up workgroup, machine, realm
 456 get_samba_info();
 457
 458 # get a workgroup
 459 $workgroup      = $workgroup || $opt_workgroup || "";
 460
 461 # get the server
 462 $server         = process_servername($opt_host) ||
 463                   detect_server($workgroup,$opt_realm) ||
 464                   die "please define server to query with -h host\n";
 465
 466
 467 # get the base
 468 $base           = defined($opt_base)? $opt_base : "" ||
 469                   get_base_from_rootdse($server,$dse);
 470
 471 # get the realm
 472 $realm          = $opt_realm ||
 473                   get_realm_from_rootdse($server,$dse);
 474
 475 # get sasl mechs
 476 my @sasl_mechs  = get_sasl_mechs_from_rootdse($server,$dse);
 477 my $sasl_mech   = "GSSAPI";
 478 if ($opt_saslmech) {
 479         $sasl_mech = sprintf("%s", (check_sasl_mech($opt_saslmech) == 0)?uc($opt_saslmech):"");
 480 }
 481
 482 # set bind type
 483 my $sasl_bind = 1 if (!$opt_simpleauth);
 484
 485 # get username
 486 my $user        = check_user($opt_user) || $ENV{'USER'} || "";
 487
 488 # gen upn
 489 my $upn         = sprintf("%s", gen_upn($opt_machine ? "$machine\$" : $user, $realm));
 490
 491 # get binddn
 492 $binddn         = $opt_binddn || $upn;
 493
 494 # get the password
 495 $password       = $password || $opt_password;
 496 if (!$password) {
 497         $password = $opt_machine ? get_machine_password($workgroup) : get_password();
 498 }
 499
 500 my %attr_handler = (
 501         "Token-Groups-No-GC-Acceptable" => \&dump_sid,  #wrong name
 502         "accountExpires"                => \&dump_nttime,
 503         "attributeSecurityGUID"         => \&dump_guid,
 504         "badPasswordTime"               => \&dump_nttime,
 505         "creationTime"                  => \&dump_nttime,
 506         "currentTime"                   => \&dump_timestr,
 507         "domainControllerFunctionality" => \&dump_ds_func,
 508         "domainFunctionality"           => \&dump_ds_func,
 509         "fRSReplicaSetGUID"             => \&dump_guid,
 510         "fRSReplicaSetType"             => \&dump_frstype,
 511         "fRSVersionGUID"                => \&dump_guid,
 512         "flags"                         => \&dump_gpflags,      # fixme: possibly only on gpos!
 513         "forceLogoff"                   => \&dump_nttime_abs,
 514         "forestFunctionality"           => \&dump_ds_func,
 515 #       "gPCMachineExtensionNames"      => \&dump_gpcextensions,
 516 #       "gPCUserExtensionNames"         => \&dump_gpcextensions,
 517         "gPLink"                        => \&dump_gplink,
 518         "gPOptions"                     => \&dump_gpoptions,
 519         "groupType"                     => \&dump_gtype,
 520         "instanceType"                  => \&dump_instance_type,
 521         "lastLogon"                     => \&dump_nttime,
 522         "lastLogonTimestamp"            => \&dump_nttime,
 523         "lastSetTime"                   => \&dump_nttime,
 524         "lockOutObservationWindow"      => \&dump_nttime_abs,
 525         "lockoutDuration"               => \&dump_nttime_abs,
 526         "lockoutTime"                   => \&dump_nttime,
 527 #       "logonHours"                    => \&dump_logonhours,
 528         "maxPwdAge"                     => \&dump_nttime_abs,
 529         "minPwdAge"                     => \&dump_nttime_abs,
 530         "modifyTimeStamp"               => \&dump_timestr,
 531         "msDS-Behavior-Version"         => \&dump_ds_func,      #unsure
 532         "msDS-User-Account-Control-Computed" => \&dump_uacc,
 533         "msDS-SupportedEncryptionTypes" => \&dump_enctypes,
 534         "mS-DS-CreatorSID"              => \&dump_sid,
 535 #       "msRADIUSFramedIPAddress"       => \&dump_ipaddr,
 536 #       "msRASSavedFramedIPAddress"     => \&dump_ipaddr,
 537         "netbootGUID"                   => \&dump_guid,
 538         "nTMixedDomain"                 => \&dump_mixed_domain,
 539         "nTSecurityDescriptor"          => \&dump_secdesc,
 540         "objectGUID"                    => \&dump_guid,
 541         "objectSid"                     => \&dump_sid,
 542         "pKT"                           => \&dump_pkt,
 543         "pKTGuid"                       => \&dump_guid,
 544         "priorSetTime"                  => \&dump_nttime,
 545         "pwdLastSet"                    => \&dump_nttime,
 546         "pwdProperties"                 => \&dump_pwdproperties,
 547         "sAMAccountType"                => \&dump_atype,
 548         "schemaIDGUID"                  => \&dump_guid,
 549         "sDRightsEffective"             => \&dump_sdeffective,
 550         "securityIdentifier"            => \&dump_sid,
 551         "serverState"                   => \&dump_serverstate,
 552         "supportedCapabilities",        => \&dump_capabilities,
 553         "supportedControl",             => \&dump_controls,
 554         "supportedExtension",           => \&dump_extension,
 555         "systemFlags"                   => \&dump_systemflags,
 556         "tokenGroups",                  => \&dump_sid,
 557         "tokenGroupsGlobalAndUniversal" => \&dump_sid,
 558         "tokenGroupsNoGCAcceptable"     => \&dump_sid,
 559         "trustAttributes"               => \&dump_trustattr,
 560         "trustDirection"                => \&dump_trustdirection,
 561         "trustType"                     => \&dump_trusttype,
 562         "uASCompat"                     => \&dump_uascompat,
 563         "userAccountControl"            => \&dump_uac,
 564         "userCertificate"               => \&dump_cert,
 565         "userFlags"                     => \&dump_uf,
 566         "userParameters"                => \&dump_munged_dial,
 567         "whenChanged"                   => \&dump_timestr,
 568         "whenCreated"                   => \&dump_timestr,
 569 #       "dSCorePropagationData"         => \&dump_timestr,
 570 );
 571
 572
 573
 574 ################
 575 # subfunctions #
 576 ################
 577
 578 sub usage {
 579         print "usage: $0 [--asq] [--base|-b base] [--debug level] [--debug level] [--DN|-D binddn] [--extendeddn|-e] [--help] [--host|-h host] [--machine|-P] [--metadata|-m] [--nodiffs] [--notify|-n] [--password|-w password] [--port port] [--rawdisplay] [--realm|-R realm] [--rootdse] [--saslmech|-Y saslmech] [--schema|-c] [--scope|-s scope] [--simpleauth|-x] [--starttls|-Z] [--user|-U user] [--wknguid] [--workgroup|-k workgroup] filter [attrs]\n";
 580         print "\t--asq [attribute]\n\t\tAttribute to use for a attribute scoped query (LDAP_SERVER_ASQ_OID)\n";
 581         print "\t--base|-b [base]\n\t\tUse base [base]\n";
 582         print "\t--debug [level]\n\t\tUse debuglevel (for Net::LDAP)\n";
 583         print "\t--domain_scope\n\t\tLimit LDAP search to local domain (LDAP_SERVER_DOMAIN_SCOPE_OID)\n";
 584         print "\t--DN|-D [binddn]\n\t\tUse binddn or principal\n";
 585         print "\t--extendeddn|-e [value]\n\t\tDisplay extended dn (LDAP_SERVER_EXTENDED_DN_OID)\n";
 586         print "\t--fastbind\n\t\tDo LDAP fast bind using LDAP_SERVER_FAST_BIND_OID extension\n";
 587         print "\t--help\n\t\tDisplay help page\n";
 588         print "\t--host|-h [host]\n\t\tQuery Host [host] (either a hostname or an LDAP uri)\n";
 589         print "\t--machine|-P\n\t\tUse samba3 machine account stored in $secrets_tdb (needs root access)\n";
 590         print "\t--metdata|-m\n\t\tDisplay replication metadata\n";
 591         print "\t--nodiffs\n\t\tDisplay no diffs but full entry dump when running in notify mode\n";
 592         print "\t--notify|-n\n\t\tActivate asynchronous change notification (LDAP_SERVER_NOTIFICATION_OID)\n";
 593         print "\t--paging [pagesize]\n\t\tUse paged results when searching\n";
 594         print "\t--password|-w [password]\n\t\tUse [password] for binddn\n";
 595         print "\t--port [port]\n\t\tUse [port] when connecting ADS\n";
 596         print "\t--rawdisplay\n\t\tDo not interpret values\n";
 597         print "\t--realm|-R [realm]\n\t\tUse [realm] when trying to construct bind-principal\n";
 598         print "\t--rootdse\n\t\tDisplay RootDSE (anonymously)\n";
 599         print "\t--saslmech|-Y [saslmech]\n\t\tUse SASL Mechanism [saslmech] when binding\n";
 600         print "\t--schema|-c\n\t\tDisplay DSE-Schema\n";
 601         print "\t--scope|-s [scope]\n\t\tUse scope [scope] (sub, base, one)\n";
 602         print "\t--simpleauth|-x\n\t\tUse simple bind (otherwise SASL binds are performed)\n";
 603         print "\t--starttls|-Z\n\t\tUse Start TLS extended operation to secure LDAP traffic\n";
 604         print "\t--user|-U [user]\n\t\tUse [user]\n";
 605         print "\t--wknguid\n\t\tDisplay well known guids\n";
 606         print "\t--workgroup|-k [workgroup]\n\t\tWhen LDAP-Server is not known try to find a Domain-Controller for [workgroup]\n";
 607 }
 608
 609 sub write_ads_list {
 610         my ($mod,$attr,$value) = @_;
 611         my $ofh = select(STDOUT);
 612         $~ = "ADS_LIST";
 613         select($ofh);
 614         write();
 615
 616 format ADS_LIST =
 617 @<<<< @>>>>>>>>>>>>>>>>>>>>>>>: @*
 618 $mod, $attr, $value
 619 .
 620 }
 621
 622 sub write_ads {
 623         my ($mod,$attr,$value) = @_;
 624         my $ofh = select(STDOUT);
 625         $~ = "ADS";
 626         select($ofh);
 627         write();
 628
 629 format ADS =
 630 @<<<< @>>>>>>>>>>>>>>>>>>>>>>>: ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 631 $mod, $attr, $value
 632 ~~                              ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 633                                 $value
 634 .
 635 }
 636
 637 sub detect_server {
 638
 639         my $workgroup = shift;
 640         my $realm = shift;
 641         my $result;
 642         my $found;
 643
 644         # try net cache (nbt records)
 645         if ( -x $net && $workgroup ) {
 646                 my $key = sprintf("NBT/%s#1C", uc($workgroup));
 647                 chomp($result = `$net cache search $key 2>&1 /dev/null`);
 648                 $result =~ s/^.*Value: //;
 649                 $result =~ s/:.*//;
 650                 return $result if $result;
 651                 printf("%10s query failed for [%s]\n", "net cache", $key);
 652         }
 653
 654         # try dns SRV entries
 655         if ( -x $dig && $realm ) {
 656                 my $key = sprintf("_ldap._tcp.%s", lc($realm));
 657                 chomp($result = `$dig $key SRV +short +search | egrep "^[0-9]" | head -1`);
 658                 $result =~ s/.* //g;
 659                 $result =~ s/.$//g;
 660                 return $result if $result;
 661                 printf("%10s query failed for [%s]\n", "dns", $key);
 662         }
 663
 664         # try netbios broadcast query
 665         if ( -x $nmblookup && $workgroup ) {
 666                 my $key = sprintf("%s#1C", uc($workgroup));
 667                 my $pattern = sprintf("%s<1c>", uc($workgroup));
 668                 chomp($result = `$nmblookup $key -d 0 | grep '$pattern'`);
 669                 $result =~ s/\s.*//;
 670                 return $result if $result;
 671                 printf("%10s query failed for [%s]\n", "nmblookup", $key);
 672         }
 673
 674         return "";
 675 }
 676
 677 sub get_samba_info {
 678
 679         if (! -x $testparm) { return -1; }
 680
 681         my $tmp;
 682         open(TESTPARM, "$testparm -s -v 2> /dev/null |");
 683         while (my $line = <TESTPARM>) {
 684                 chomp($line);
 685                 if ($line =~ /netbios name/) {
 686                         ($tmp, $machine) = split(/=/, $line);
 687                         $machine =~ s/\s+|\t+//g;
 688                 }
 689                 if ($line =~ /realm/) {
 690                         ($tmp, $realm) = split(/=/, $line);
 691                         $realm =~ s/\s+|\t+//g;
 692                 }
 693                 if ($line =~ /workgroup/) {
 694                         ($tmp, $workgroup) = split(/=/, $line);
 695                         $workgroup =~ s/\s+|\t+//g;
 696                 }
 697         }
 698         close(TESTPARM);
 699         return 0;
 700 }
 701
 702 sub gen_upn {
 703         my $machine = shift;
 704         my $realm = shift;
 705         if ($machine && $realm) {
 706                 return sprintf("%s\@%s", lc($machine), uc($realm));
 707         };
 708         return undef;
 709 }
 710
 711 sub get_password {
 712         if (!$password && $opt_simpleauth && check_ticket($user)) {
 713                 return prompt_password($user);
 714         }
 715         return "";
 716 }
 717
 718 sub get_user {
 719         my $user = shift || prompt_user();
 720         return $user;
 721 }
 722
 723 sub get_machine_password {
 724
 725         my $workgroup = shift || "";
 726         $workgroup = uc($workgroup);
 727
 728         my ($found, $tmp, $dbdump, $db);
 729         if (-r $secrets_ntdb) {
 730             -x $ntdbdump || die "ntdbdump is not installed. cannot proceed autodetection\n";
 731             $dbdump = $ntdbdump;
 732             $db = $secrets_ntdb;
 733         } else {
 734             -x $tdbdump || die "tdbdump is not installed. cannot proceed autodetection\n";
 735             -r $secrets_tdb || die "cannot read $secrets_tdb. cannot proceed autodetection\n";
 736             $dbdump = $tdbdump;
 737             $db = $secrets_tdb;
 738         }
 739
 740         # get machine-password
 741         my $key = sprintf("SECRETS/MACHINE_PASSWORD/%s", $workgroup);
 742         open(SECRETS,"$dbdump $db |");
 743         while(my $line = <SECRETS>) {
 744                 chomp($line);
 745                 if ($found) {
 746                         $line =~ s/\\00//;
 747                         ($line,$password) = split(/"/, $line);
 748                         last;
 749                 }
 750                 if ($line =~ /\"$key\"/) {
 751                         $found = 1;
 752                 }
 753         }
 754         close(SECRETS);
 755
 756         if ($found) {
 757                 print "Successfully autodetected machine password for workgroup: $workgroup\n";
 758                 return $password;
 759         } else {
 760                 warn "No machine password available for $workgroup\n";
 761         }
 762         return "";
 763 }
 764
 765 sub prompt_password {
 766
 767         my $acct = shift || "";
 768         if ($acct =~ /\%/) {
 769                 ($acct, $password) = split(/\%/, $acct);
 770                 return $password;
 771         }
 772         system "stty -echo";
 773         print "Enter password for $acct:";
 774         my $password = <STDIN>;
 775         chomp($password);
 776         print "\n";
 777         system "stty echo";
 778         return $password;
 779 }
 780
 781 sub prompt_user {
 782
 783         print "Enter Username:";
 784         my $user = <STDIN>;
 785         chomp($user);
 786         print "\n";
 787         return $user;
 788 }
 789
 790 sub check_ticket {
 791         return 0;
 792         # works only for heimdal
 793         return system("$klist -t");
 794 }
 795
 796 sub get_ticket {
 797
 798         my $KRB5_CONFIG = "/tmp/.krb5.conf.telads-$<";
 799
 800         open(KRB5CONF, "> $KRB5_CONFIG") || die "cannot write $KRB5_CONFIG";
 801         printf  KRB5CONF "# autogenerated by $0\n";
 802         printf  KRB5CONF "[libdefaults]\n\tdefault_realm = %s\n\tclockskew = %d\n", uc($realm), 60*60;
 803         printf  KRB5CONF "[realms]\n\t%s = {\n\t\tkdc = %s\n\t}\n", uc($realm), $server;
 804         close(KRB5CONF);
 805
 806         if ( system("KRB5_CONFIG=$KRB5_CONFIG $kinit $user") != 0) {
 807                 return -1;
 808         }
 809
 810         return 0;
 811 }
 812
 813 sub check_user {
 814         my $acct = shift || "";
 815         if ($acct =~ /\%/) {
 816                 ($acct, $password) = split(/\%/, $acct);
 817         }
 818         return $acct;
 819 }
 820
 821 sub check_root_dse($$$@) {
 822
 823         # bogus function??
 824         my $server = shift || "";
 825         $dse = shift || get_dse($server) || return -1;
 826         my $attr = shift || die "unknown query";
 827         my @array = @_;
 828
 829         my $dse_list = $dse->get_value($attr, asref => '1');
 830         my @dse_array = @$dse_list;
 831
 832         foreach my $i (@array) {
 833                 # we could use -> supported_control but this
 834                 # is only available in newer versions of perl-ldap
 835 #               if ( ! $dse->supported_control( $i ) ) {
 836                 if ( grep(/$i->type()/, @dse_array) ) {
 837                         printf("required \"$attr\": %s is not supported by ADS-server.\n", $i->type());
 838                         return -1;
 839                 }
 840         }
 841         return 0;
 842 }
 843
 844 sub check_ctrls ($$@) {
 845         my $server = shift;
 846         my $dse = shift;
 847         my @array = @_;
 848         return check_root_dse($server, $dse, "supportedControl", @array);
 849 }
 850
 851 sub check_exts ($$@) {
 852         my $server = shift;
 853         my $dse = shift;
 854         my @array = @_;
 855         return check_root_dse($server, $dse, "supportedExtension", @array);
 856 }
 857
 858 sub get_base_from_rootdse {
 859
 860         my $server = shift || "";
 861         $dse = shift || get_dse($server,$async_ldap_hd) || return -1;
 862         return $dse->get_value($opt_dump_schema ? 'schemaNamingContext':
 863                                                   'defaultNamingContext');
 864 }
 865
 866 sub get_realm_from_rootdse {
 867
 868         my $server = shift || "";
 869         $dse = shift || get_dse($server,$async_ldap_hd) || return -1;
 870         my $service = $dse->get_value('ldapServiceName') || "";
 871         if ($service) {
 872                 my ($t,$realm) = split(/\@/, $service);
 873                 return $realm;
 874         } else {
 875                 die "very odd: could not get realm";
 876         }
 877 }
 878
 879 sub get_sasl_mechs_from_rootdse {
 880
 881         my $server = shift || "";
 882         $dse = shift || get_dse($server,$async_ldap_hd) || return -1;
 883         my $mechs = $dse->get_value('supportedSASLMechanisms', asref => 1);
 884         return @$mechs;
 885 }
 886
 887 sub get_dse {
 888
 889         my $server = shift || return undef;
 890         $async_ldap_hd = shift || get_ldap_hd($server,1);
 891         if (!$async_ldap_hd) {
 892                 print "oh, no connection\n";
 893                 return undef;
 894         }
 895         my $mesg = $async_ldap_hd->bind() || die "cannot bind\n";
 896         if ($mesg->code) { die "failed to bind\n"; };
 897         my $dse = $async_ldap_hd->root_dse( attrs => ['*', "supportedExtension", "supportedFeatures" ] );
 898
 899         return $dse;
 900 }
 901
 902 sub process_servername {
 903
 904         my $name = shift || return "";
 905         if ($name =~ /^ldaps:\/\//i ) {
 906                 $name =~ s#^ldaps://##i;
 907                 $uri = sprintf("%s://%s", "ldaps", $name);
 908         } else {
 909                 $name =~ s#^ldap://##i;
 910                 $uri = sprintf("%s://%s", "ldap", $name);
 911         }
 912         return $name;
 913 }
 914
 915 sub get_ldap_hd {
 916
 917         my $server = shift || return undef;
 918         my $async = shift || "0";
 919         my $hd;
 920         die "uri unavailable" if (!$uri);
 921         if ($uri =~ /^ldaps:\/\//i ) {
 922                 $port = $port || 636;
 923                 use Net::LDAPS;
 924                 $hd = Net::LDAPS->new( $server, async => $async, port => $port ) ||
 925                         die "host $server not available: $!";
 926         } else {
 927                 $port = $port || 389;
 928                 $hd = Net::LDAP->new( $server, async => $async, port => $port ) ||
 929                         die "host $server not available: $!";
 930         }
 931         $hd->debug($opt_debug);
 932         if ($opt_starttls) {
 933                 $hd->start_tls( verify => 'none' );
 934         }
 935
 936         return $hd;
 937 }
 938
 939 sub get_sasl_hd {
 940
 941         if (!$have_sasl) {
 942                 print "no sasl support\n";
 943                 return undef;
 944         }
 945
 946         my $hd;
 947         if ($sasl_mech && $sasl_mech eq "GSSAPI") {
 948                 my $user = sprintf("%s\@%s", $user, uc($realm));
 949                 if (check_ticket($user) != 0 && get_ticket($user) != 0) {
 950                         print "Could not get Kerberos ticket for user [$user]\n";
 951                         return undef;
 952                 }
 953
 954                 $hd = Authen::SASL->new( mechanism => 'GSSAPI' ) || die "nope";
 955                 my $conn = $hd->client_new("ldap", $server);
 956
 957                 if ($conn->code == -1) {
 958                         printf "%s\n", $conn->error();
 959                         return undef;
 960                 };
 961
 962         } elsif ($sasl_mech) {
 963
 964                 # here comes generic sasl code
 965                 $hd = Authen::SASL->new( mechanism => $sasl_mech,
 966                         callback  => {
 967                                 user => \&get_user,
 968                                 pass => \&get_password
 969                         }
 970                 ) || die "nope";
 971         } else {
 972                 $sasl_bind = 0;
 973                 print "no supported SASL mechanism found (@sasl_mechs).\n";
 974                 print "falling back to simple bind.\n";
 975                 return undef;
 976         }
 977
 978         return $hd;
 979 }
 980
 981 sub check_sasl_mech {
 982         my $mech_check = shift;
 983         my $have_mech = 0;
 984         foreach my $mech (@sasl_mechs) {
 985                 $have_mech = 1 if ($mech eq uc($mech_check));
 986         }
 987         if (!$have_mech) {
 988                 return -1;
 989         }
 990         return 0;
 991 }
 992
 993 sub store_result ($) {
 994
 995         my $entry = shift;
 996         return if (!$entry);
 997         $entry_store{$entry->dn} = $entry;
 998 }
 999
1000 sub display_result_diff ($) {
1001
1002         my $entry_new = shift;
1003         return if ( !$entry_new);
1004
1005         if ( !exists $entry_store{$entry_new->dn}) {
1006                 print "can't display any differences yet. full dump...\n";
1007                 display_entry_generic($entry_new);
1008                 return;
1009         }
1010
1011         my $entry_old = $entry_store{$entry_new->dn};
1012
1013         foreach my $attr (sort $entry_new->attributes) {
1014                 if ( $entry_new->exists($attr) && ! $entry_old->exists($attr)) {
1015                         display_attr_generic("add:\t", $entry_new, $attr);
1016                         next;
1017                 }
1018         }
1019
1020         foreach my $attr (sort $entry_old->attributes) {
1021                 if (! $entry_new->exists($attr) && $entry_old->exists($attr)) {
1022                         display_attr_generic("del:\t", $entry_old, $attr);
1023                         next;
1024                 }
1025
1026                 # now check for all values if they have changed, display changes
1027                 my ($old_vals, $new_vals, @old_vals, @new_vals, %old, %new);
1028
1029                 $old_vals = $entry_old->get_value($attr, asref => 1);
1030                 @old_vals = @$old_vals;
1031                 $new_vals = $entry_new->get_value($attr, asref => 1);
1032                 @new_vals = @$new_vals;
1033
1034                 if (scalar(@old_vals) == 1 && scalar(@new_vals) == 1) {
1035                         if ($old_vals[0] ne $new_vals[0]) {
1036                                 display_attr_generic("old:\t", $entry_old, $attr);
1037                                 display_attr_generic("new:\t", $entry_new, $attr);
1038                         }
1039                         next;
1040                 }
1041
1042                 # handle multivalued diffs
1043                 foreach my $val (@old_vals) { $old{$val} = "dummy"; };
1044                 foreach my $val (@new_vals) { $new{$val} = "dummy"; };
1045                 foreach my $val (sort keys %new) {
1046                         if (!exists $old{$val}) {
1047                                 display_value_generic("add:\t", $attr, $val);
1048                         }
1049                 }
1050                 foreach my $val (sort keys %old) {
1051                         if (!exists $new{$val}) {
1052                                 display_value_generic("del:\t", $attr, $val);
1053                         }
1054                 }
1055         }
1056         print "\n";
1057
1058 }
1059
1060 sub sid2string ($) {
1061
1062         # Fix from Michael James <michael@james.st>
1063         my $binary_sid = shift;
1064         my($sid_rev, $num_auths, $id1, $id2, @ids) = unpack("H2 H2 n N V*", $binary_sid);
1065         my $sid_string = join("-", "S", hex($sid_rev), ($id1<<32)+$id2, @ids);
1066         return $sid_string;
1067
1068 }
1069
1070 sub string_to_guid {
1071         my $string = shift;
1072         return undef unless $string =~ /([0-9,a-z]{8})-([0-9,a-z]{4})-([0-9,a-z]{4})-([0-9,a-z]{2})([0-9,a-z]{2})-([0-9,a-z]{2})([0-9,a-z]{2})([0-9,a-z]{2})([0-9,a-z]{2})([0-9,a-z]{2})([0-9,a-z]{2})/i;
1073
1074         return  pack("I", hex $1) .
1075                 pack("S", hex $2) .
1076                 pack("S", hex $3) .
1077                 pack("C", hex $4) .
1078                 pack("C", hex $5) .
1079                 pack("C", hex $6) .
1080                 pack("C", hex $7) .
1081                 pack("C", hex $8) .
1082                 pack("C", hex $9) .
1083                 pack("C", hex $10) .
1084                 pack("C", hex $11);
1085
1086 #       print "$1\n$2\n$3\n$4\n$5\n$6\n$7\n$8\n$9\n$10\n$11\n";
1087 }
1088
1089 sub bindstring_to_guid {
1090         my $str = shift;
1091         return pack("H2 H2 H2 H2 H2 H2 H2 H2 H2 H2 H2 H2 H2 H2 H2 H2",
1092                 substr($str,0,2),
1093                 substr($str,2,2),
1094                 substr($str,4,2),
1095                 substr($str,6,2),
1096                 substr($str,8,2),
1097                 substr($str,10,2),
1098                 substr($str,12,2),
1099                 substr($str,14,2),
1100                 substr($str,16,2),
1101                 substr($str,18,2),
1102                 substr($str,20,2),
1103                 substr($str,22,2),
1104                 substr($str,24,2),
1105                 substr($str,26,2),
1106                 substr($str,28,2),
1107                 substr($str,30,2));
1108 }
1109
1110 sub guid_to_string {
1111         my $guid = shift;
1112         my $string = sprintf "%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X",
1113                 unpack("I", $guid),
1114                 unpack("S", substr($guid, 4, 2)),
1115                 unpack("S", substr($guid, 6, 2)),
1116                 unpack("C", substr($guid, 8, 1)),
1117                 unpack("C", substr($guid, 9, 1)),
1118                 unpack("C", substr($guid, 10, 1)),
1119                 unpack("C", substr($guid, 11, 1)),
1120                 unpack("C", substr($guid, 12, 1)),
1121                 unpack("C", substr($guid, 13, 1)),
1122                 unpack("C", substr($guid, 14, 1)),
1123                 unpack("C", substr($guid, 15, 1));
1124         return lc($string);
1125 }
1126
1127 sub guid_to_bindstring {
1128         my $guid = shift;
1129         return unpack("H" . 2 * length($guid), $guid),
1130 }
1131
1132 sub dump_wknguid {
1133         print "Dumping Well known GUIDs:\n";
1134         foreach my $wknguid (keys %wknguids) {
1135
1136                 my $guid = bindstring_to_guid($wknguids{$wknguid});
1137                 my $str  = guid_to_string($guid);
1138                 my $back = guid_to_bindstring($guid);
1139
1140                 printf "wkguid:             %s\n", $wknguid;
1141                 printf "bind_string format: %s\n", $wknguids{$wknguid};
1142                 printf "string format:      %s\n", guid_to_string($guid);
1143                 printf "back to bind_string:%s\n", guid_to_bindstring($guid);
1144
1145                 printf "use base: \"<WKGUID=%s,%s>\"\n", guid_to_bindstring($guid), $base;
1146         }
1147 }
1148
1149 sub gen_bitmask_string_format($%) {
1150         my $mod = shift;
1151         my (%tmp) = @_;
1152         my @list;
1153         foreach my $key (sort keys %tmp) {
1154                 push(@list, sprintf("%s %s", $tmp{$key}, $key));
1155         }
1156         return join("\n$mod$tabsize",@list);
1157 }
1158
1159
1160 sub nt_to_unixtime ($) {
1161         # the number of 100 nanosecond intervals since jan. 1. 1601 (utc)
1162         my $t64 = shift;
1163         $t64 =~ s/(.+).{7,7}/$1/;
1164         $t64 -= 11644473600;
1165         return $t64;
1166 }
1167
1168 sub dump_equal {
1169         my $val = shift;
1170         my $mod = shift || die "no mod";
1171         my (%header) = @_;
1172         my %tmp;
1173         my $found = 0;
1174         foreach my $key (keys %header) {
1175                 if ($header{$key} eq $val) {
1176                         $tmp{"($val)"} = $key;
1177                         $found = 1;
1178                         last;
1179                 }
1180         }
1181         if (!$found) { $tmp{$val} = ""; };
1182         return gen_bitmask_string_format($mod,%tmp);
1183 }
1184
1185 sub dump_bitmask {
1186         my $op = shift || die "no op";
1187         my $val = shift;
1188         my $mod = shift || die "no mod";
1189         my (%header) = @_;
1190         my %tmp;
1191         $tmp{""} = sprintf("%s (0x%08x)", $val, $val);
1192         foreach my $key (sort keys %header) {   # sort by val !
1193                 my $val_hex = sprintf("0x%08x", $header{$key});
1194                 if ($op eq "&") {
1195                         $tmp{"$key ($val_hex)"} = ( $val & $header{$key} ) ? $set:$unset;
1196                 } elsif ($op eq "==") {
1197                         $tmp{"$key ($val_hex)"} = ( $val == $header{$key} ) ? $set:$unset;
1198                 } else {
1199                         print "unknown operator: $op\n";
1200                         return;
1201                 }
1202         }
1203         return gen_bitmask_string_format($mod,%tmp);
1204 }
1205
1206 sub dump_bitmask_and {
1207         return dump_bitmask("&",@_);
1208 }
1209
1210 sub dump_bitmask_equal {
1211         return dump_bitmask("==",@_);
1212 }
1213
1214 sub dump_uac {
1215         return dump_bitmask_and(@_,%ads_uf); # ads_uf ?
1216 }
1217
1218 sub dump_uascompat {
1219         return dump_bitmask_equal(@_,%ads_uascompat);
1220 }
1221
1222 sub dump_gpoptions {
1223         return dump_bitmask_equal(@_,%ads_gpoptions);
1224 }
1225
1226 sub dump_gpflags {
1227         return dump_bitmask_equal(@_,%ads_gpflags);
1228 }
1229
1230 sub dump_uacc {
1231         return dump_bitmask_equal(@_,%ads_uacc);
1232 }
1233
1234 sub dump_enctypes {
1235         return dump_bitmask_and(@_,%ads_enctypes);
1236 }
1237
1238 sub dump_uf {
1239         return dump_bitmask_and(@_,%ads_uf);
1240 }
1241
1242 sub dump_gtype {
1243         my $ret = dump_bitmask_and(@_,%ads_grouptype);
1244         $ret .= "\n$tabsize\t";
1245         $ret .= dump_bitmask_equal(@_,%ads_gtype);
1246         return $ret;
1247 }
1248
1249 sub dump_atype {
1250         return dump_bitmask_equal(@_,%ads_atype);
1251 }
1252
1253 sub dump_controls {
1254         return dump_equal(@_,%ads_controls);
1255 }
1256
1257 sub dump_capabilities {
1258         return dump_equal(@_,%ads_capabilities);
1259 }
1260
1261 sub dump_extension {
1262         return dump_equal(@_,%ads_extensions);
1263 }
1264
1265 sub dump_systemflags {
1266         return dump_bitmask_and(@_,%ads_systemflags);
1267 }
1268
1269 sub dump_instance_type {
1270         return dump_bitmask_and(@_,%ads_instance_type);
1271 }
1272
1273 sub dump_ds_func {
1274         return dump_bitmask_equal(@_,%ads_ds_func);
1275 }
1276
1277 sub dump_serverstate {
1278         return dump_bitmask_equal(@_,%ads_serverstate);
1279 }
1280
1281 sub dump_sdeffective {
1282         return dump_bitmask_and(@_,%ads_sdeffective);
1283 }
1284
1285 sub dump_trustattr {
1286         return dump_bitmask_equal(@_,%ads_trustattrs);
1287 }
1288
1289 sub dump_trusttype {
1290         return dump_bitmask_equal(@_,%ads_trusttype);
1291 }
1292
1293 sub dump_trustdirection {
1294         return dump_bitmask_equal(@_,%ads_trustdirection);
1295 }
1296
1297 sub dump_pwdproperties {
1298         return dump_bitmask_and(@_,%ads_pwdproperties);
1299 }
1300
1301 sub dump_frstype {
1302         return dump_bitmask_equal(@_,%ads_frstypes)
1303 }
1304
1305 sub dump_mixed_domain {
1306         return dump_bitmask_equal(@_,%ads_mixed_domain);
1307 }
1308
1309 sub dump_sid {
1310         my $bin_sid = shift;
1311         return sid2string($bin_sid);
1312 }
1313
1314 sub dump_guid {
1315         my $guid = shift;
1316         return guid_to_string($guid);
1317 }
1318
1319 sub dump_secdesc {
1320         my $val = shift;
1321         return "FIXME: write sddl-converter!";
1322 }
1323
1324 sub dump_nttime {
1325         my $nttime = shift;
1326         if ($nttime == 0) {
1327                 return sprintf("%s (%s)", "never", $nttime);
1328         }
1329         my $localtime = localtime(nt_to_unixtime($nttime));
1330         return sprintf("%s (%s)", $localtime, $nttime);
1331 }
1332
1333 sub dump_nttime_abs {
1334         if ($_[0] == 9223372036854775807) {
1335                 return sprintf("%s (%s)", "now", $_[0]);
1336         }
1337         if ($_[0] == -9223372036854775808 || $_[0] == 0) { # 0x7FFFFFFFFFFFFFFF
1338                 return sprintf("%s (%s)", "never", $_[0]);
1339         }
1340         # FIXME: actually *do* abs time !
1341         return dump_nttime($_[0]);
1342 }
1343
1344 sub dump_timestr {
1345         my $time = shift;
1346         if ($time eq "16010101000010.0Z") {
1347                 return sprintf("%s (%s)", "never", $time);
1348         }
1349         my ($year,$mon,$mday,$hour,$min,$sec,$zone) =
1350                 unpack('a4 a2 a2 a2 a2 a2 a4', $time);
1351         $mon -= 1;
1352         my $localtime = localtime(timegm($sec,$min,$hour,$mday,$mon,$year));
1353         return sprintf("%s (%s)", $localtime, $time);
1354 }
1355
1356 sub dump_string {
1357         return $_[0];
1358 }
1359
1360 sub dump_int {
1361         return sprintf("%d", $_[0]);
1362 }
1363
1364 sub dump_munged_dial {
1365         my $dial = shift;
1366         return "FIXME! decode this";
1367 }
1368
1369 sub dump_cert {
1370
1371         my $cert = shift;
1372         open(OPENSSL, "| /usr/bin/openssl x509 -text -inform der");
1373         print OPENSSL $cert;
1374         close(OPENSSL);
1375         return "";
1376 }
1377
1378 sub dump_pkt {
1379         my $pkt = shift;
1380         return "not yet";
1381         printf("%s: ", $pkt);
1382         printf("%02X", $pkt);
1383
1384 }
1385
1386 sub dump_gplink {
1387
1388         my $gplink = shift;
1389         my $gplink_mod = $gplink;
1390         my @links = split("\\]\\[", $gplink_mod);
1391         foreach my $link (@links) {
1392                 $link =~ s/^\[|\]$//g;
1393                 my ($ldap_link, $opt) = split(";", $link);
1394                 my @array = ( "$opt", "\t" );
1395                 printf("%slink: %s, opt: %s\n", $tabsize, $ldap_link, dump_bitmask_and(@array, %ads_gplink_opts));
1396         }
1397         return $gplink;
1398 }
1399
1400 sub construct_filter {
1401
1402         my $tmp = shift;
1403
1404         if (!$tmp || $opt_notify) {
1405                 return "(objectclass=*)";
1406         }
1407
1408         if ($tmp && $tmp !~ /^.*\=/) {
1409                 return "(ANR=$tmp)";
1410         }
1411
1412         return $tmp;
1413         # (&(objectCategory=person)
1414         # (userAccountControl:$ads_matching_rules{LDAP_MATCHING_RULE_BIT_AND}:=2))
1415 }
1416
1417 sub construct_attrs {
1418
1419         my @attrs = @_;
1420
1421         if (!@attrs) {
1422                 push(@attrs,"*");
1423         }
1424
1425         if ($opt_notify) {
1426                 push(@attrs,"uSNChanged");
1427         }
1428
1429         if ($opt_display_metadata) {
1430                 push(@attrs,"msDS-ReplAttributeMetaData");
1431                 push(@attrs,"replPropertyMetaData");
1432         }
1433
1434         if ($opt_verbose) {
1435                 push(@attrs,"nTSecurityDescriptor");
1436                 push(@attrs,"msDS-KeyVersionNumber");
1437                 push(@attrs,"msDS-User-Account-Control-Computed");
1438                 push(@attrs,"modifyTimeStamp");
1439         }
1440
1441         return sort @attrs;
1442 }
1443
1444 sub print_header {
1445
1446         print "\n";
1447         printf "%10s: %s\n", "uri", $uri;
1448         printf "%10s: %s\n", "port", $port;
1449         printf "%10s: %s\n", "base", $base;
1450         printf "%10s: %s\n", $sasl_bind ? "principal" : "binddn", $sasl_bind ? $upn : $binddn;
1451         printf "%10s: %s\n", "password", $password;
1452         printf "%10s: %s\n", "bind-type", $sasl_bind ? "SASL" : "simple";
1453         printf "%10s: %s\n", "sasl-mech", $sasl_mech if ($sasl_mech);
1454         printf "%10s: %s\n", "filter", $filter;
1455         printf "%10s: %s\n", "scope", $scope;
1456         printf "%10s: %s\n", "attrs", join(", ", @attrs);
1457         printf "%10s: %s\n", "controls", join(", ", @ctrls_s);
1458         printf "%10s: %s\n", "page_size", $opt_paging if ($opt_paging);
1459         printf "%10s: %s\n", "start_tls", $opt_starttls ? "yes" : "no";
1460         printf "\n";
1461 }
1462
1463 sub gen_controls {
1464
1465         # setup attribute-scoped query control
1466         my $asq_asn = Convert::ASN1->new;
1467         $asq_asn->prepare(
1468                 q<      asq ::= SEQUENCE {
1469                                 sourceAttribute   OCTET_STRING
1470                         }
1471                 >
1472         );
1473         my $ctl_asq_val = $asq_asn->encode( sourceAttribute => $opt_asq);
1474         my $ctl_asq = Net::LDAP::Control->new(
1475                 type => $ads_controls{'LDAP_SERVER_ASQ_OID'},
1476                 critical => 'true',
1477                 value => $ctl_asq_val);
1478
1479
1480         # setup extended dn control
1481         my $asn_extended_dn = Convert::ASN1->new;
1482         $asn_extended_dn->prepare(
1483                 q<      ExtendedDn ::= SEQUENCE {
1484                                 mode     INTEGER
1485                         }
1486                 >
1487         );
1488
1489         # only w2k3 accepts '1' and needs the ctl_val, w2k does not accept a ctl_val
1490         my $ctl_extended_dn_val = $asn_extended_dn->encode( mode => $opt_display_extendeddn);
1491         my $ctl_extended_dn = Net::LDAP::Control->new(
1492                         type => $ads_controls{'LDAP_SERVER_EXTENDED_DN_OID'},
1493                         critical => 'true',
1494                         value => $opt_display_extendeddn ? $ctl_extended_dn_val : "");
1495
1496         # setup search options
1497         my $search_opt = Convert::ASN1->new;
1498         $search_opt->prepare(
1499                 q<      searchopt ::= SEQUENCE {
1500                                 flags     INTEGER
1501                         }
1502                 >
1503         );
1504
1505         my $tmp = $search_opt->encode( flags => $opt_search_opt);
1506         my $ctl_search_opt = Net::LDAP::Control->new(
1507                 type => $ads_controls{'LDAP_SERVER_SEARCH_OPTIONS_OID'},
1508                 critical => 'true',
1509                 value => $tmp);
1510
1511         # setup notify control
1512         my $ctl_notification = Net::LDAP::Control->new(
1513                 type => $ads_controls{'LDAP_SERVER_NOTIFICATION_OID'},
1514                 critical => 'true');
1515
1516
1517         # setup paging control
1518         $ctl_paged = Net::LDAP::Control->new(
1519                 type => $ads_controls{'LDAP_PAGED_RESULT_OID_STRING'},
1520                 critical => 'true',
1521                 size => $opt_paging ? $opt_paging : 1000);
1522
1523         # setup domscope control
1524         my $ctl_domscope = Net::LDAP::Control->new(
1525                 type => $ads_controls{'LDAP_SERVER_DOMAIN_SCOPE_OID'},
1526                 critical => 'true',
1527                 value => "");
1528
1529         if (defined($opt_paging) || $opt_dump_schema) {
1530                 push(@ctrls, $ctl_paged);
1531                 push(@ctrls_s, "LDAP_PAGED_RESULT_OID_STRING" );
1532         }
1533
1534         if (defined($opt_display_extendeddn)) {
1535                 push(@ctrls, $ctl_extended_dn);
1536                 push(@ctrls_s, "LDAP_SERVER_EXTENDED_DN_OID");
1537         }
1538         if ($opt_notify) {
1539                 push(@ctrls, $ctl_notification);
1540                 push(@ctrls_s, "LDAP_SERVER_NOTIFICATION_OID");
1541         }
1542
1543         if ($opt_asq) {
1544                 push(@ctrls, $ctl_asq);
1545                 push(@ctrls_s, "LDAP_SERVER_ASQ_OID");
1546         }
1547
1548         if ($opt_domain_scope) {
1549                 push(@ctrls, $ctl_domscope);
1550                 push(@ctrls_s, "LDAP_SERVER_DOMAIN_SCOPE_OID");
1551         }
1552
1553         if ($opt_search_opt) {
1554                 push(@ctrls, $ctl_search_opt);
1555                 push(@ctrls_s, "LDAP_SERVER_SEARCH_OPTIONS_OID");
1556         }
1557
1558         return @ctrls;
1559 }
1560
1561 sub display_value_generic ($$$) {
1562
1563         my ($mod,$attr,$value) = @_;
1564         return unless (defined($value) and defined($attr));
1565
1566         if ( ! $opt_display_raw && exists $attr_handler{$attr} ) {
1567                 $value = $attr_handler{$attr}($value,$mod);
1568                 write_ads_list($mod,$attr,$value);
1569                 return;
1570         }
1571         write_ads($mod,$attr,$value);
1572 }
1573
1574 sub display_attr_generic ($$$) {
1575
1576         my ($mod,$entry,$attr) = @_;
1577         return if (!$attr || !$entry);
1578
1579         my $ref = $entry->get_value($attr, asref => 1);
1580         my @values = @$ref;
1581
1582         foreach my $value ( sort @values) {
1583                 display_value_generic($mod,$attr,$value);
1584         }
1585 }
1586
1587 sub display_entry_generic ($) {
1588
1589         my $entry = shift;
1590         return if (!$entry);
1591
1592         foreach my $attr ( sort $entry->attributes) {
1593                 display_attr_generic("\t",$entry,$attr);
1594         }
1595 }
1596
1597 sub display_ldap_err ($) {
1598
1599         my $msg = shift;
1600         print_header();
1601         my ($package, $filename, $line, $subroutine) = caller(0);
1602
1603         print "got error from ADS:\n";
1604         printf("%s(%d): ERROR (%s): %s\n",
1605                 $subroutine, $line, $msg->code, $msg->error);
1606
1607 }
1608
1609 sub process_result {
1610
1611         my ($msg,$entry) = @_;
1612
1613         if (!defined($msg)) {
1614                 return;
1615         }
1616
1617         if ($msg->code) {
1618                 display_ldap_err($msg);
1619                 exit 1;
1620         }
1621
1622         if (!defined($entry)) {
1623                 return;
1624         }
1625
1626         if ($entry->isa('Net::LDAP::Reference')) {
1627                 foreach my $ref ($entry->references) {
1628                         print "\ngot Reference: [$ref]\n";
1629                 }
1630                 return;
1631         }
1632
1633         print "\nfound entry: ".$entry->dn."\n".("-" x 80)."\n";
1634
1635         display_entry_generic($entry);
1636 }
1637
1638 sub default_callback {
1639
1640         my ($res,$obj) = @_;
1641
1642         if (!$opt_notify && $res->code == LDAP_REFERRAL) {
1643                 return;
1644         }
1645
1646         if (!$opt_notify) {
1647                 return process_result($res,$obj);
1648         }
1649 }
1650
1651 sub error_callback {
1652
1653         my ($msg,$entry) = @_;
1654
1655         if (!$msg) {
1656                 return;
1657         }
1658
1659         if ($msg->code) {
1660                 display_ldap_err($msg);
1661                 exit(1);
1662         }
1663         return;
1664 }
1665
1666 sub notify_callback {
1667
1668         my ($msg, $obj) = @_;
1669
1670         if (! defined($obj)) {
1671                 return;
1672         }
1673
1674         if ($obj->isa('Net::LDAP::Reference')) {
1675                 foreach my $ref ($obj->references) {
1676                         print "\ngot Reference: [$ref]\n";
1677                 }
1678                 return;
1679         }
1680
1681         while (1) {
1682
1683                 my $async_entry = $async_search->pop_entry;
1684
1685                 if (!$async_entry->dn) {
1686                         print "very weird. entry has no dn\n";
1687                         next;
1688                 }
1689
1690                 printf("\ngot changenotify for dn: [%s]\n%s\n", $async_entry->dn, ("-" x 80));
1691
1692                 my $new_usn = $async_entry->get_value('uSNChanged');
1693                 if (!$new_usn) {
1694                         die "odd, no usnChanged attribute???";
1695                 }
1696                 if (!$usn || $new_usn > $usn) {
1697                         $usn = $new_usn;
1698                         if ($opt_notify_nodiffs) {
1699                                 display_entry_generic($async_entry);
1700                         } else {
1701                                 display_result_diff($async_entry);
1702                         }
1703                 }
1704                 store_result($async_entry);
1705         }
1706 }
1707
1708 sub do_bind($$) {
1709
1710         my $async_ldap_hd = shift || return undef;
1711         my $sasl_bind = shift;
1712
1713         if ($sasl_bind) {
1714                 if (!$works_sasl) {
1715                         print "this version of Net::LDAP does not have proper SASL support.\n";
1716                         print "Need at least perl-ldap V. $pref_version\n";
1717                 }
1718                 $sasl_hd = get_sasl_hd();
1719                 if (!$sasl_hd) {
1720                         print "failed to create SASL handle\n";
1721                         return -1;
1722                 }
1723                 $mesg = $async_ldap_hd->bind(
1724                         sasl => $sasl_hd,
1725                         callback => \&error_callback
1726                 ) || die "doesnt work";
1727         } else {
1728                 $sasl_mech = "";
1729                 $mesg = $async_ldap_hd->bind(
1730                         $binddn,
1731                         password => $password,
1732                         callback => $opt_fastbind ? undef : \&error_callback
1733                 ) || die "doesnt work";
1734         };
1735         if ($mesg->code) {
1736                 display_ldap_err($mesg) if (!$opt_fastbind);
1737                 return -1;
1738         }
1739         return 0;
1740 }
1741
1742 sub do_fast_bind() {
1743
1744         do_unbind();
1745
1746         my $hd = get_ldap_hd($server,1);
1747
1748         my $mesg = $hd->extension(
1749                 name => $ads_extensions{'LDAP_SERVER_FAST_BIND_OID'});
1750
1751         if ($mesg->code) {
1752                 display_ldap_err($mesg);
1753                 return -1;
1754         }
1755
1756         my $ret = do_bind($hd, undef);
1757         $hd->unbind;
1758
1759         printf("bind using 'LDAP_SERVER_FAST_BIND_OID' %s\n",
1760                 $ret == 0 ? "succeeded" : "failed");
1761
1762         return $ret;
1763 }
1764
1765 sub do_unbind() {
1766         if ($async_ldap_hd) {
1767                 $async_ldap_hd->unbind;
1768         }
1769         if ($sync_ldap_hd) {
1770                 $sync_ldap_hd->unbind;
1771         }
1772 }
1773
1774 ###############################################################################
1775
1776 sub main () {
1777
1778         if ($opt_fastbind) {
1779
1780                 if (check_exts($server,$dse,"LDAP_SERVER_FAST_BIND_OID") == -1) {
1781                         print "LDAP_SERVER_FAST_BIND_OID not supported by this server\n";
1782                         exit 1;
1783                 }
1784
1785                 # fast bind can only bind, not search
1786                 exit do_fast_bind();
1787         }
1788
1789         $filter = construct_filter($query);
1790         @attrs  = construct_attrs(@attrs);
1791         @ctrls  = gen_controls();
1792
1793         if (check_ctrls($server,$dse,@ctrls) == -1) {
1794                 print "not all required LDAP Controls are supported by this server\n";
1795                 exit 1;
1796         }
1797
1798         if ($opt_dump_rootdse) {
1799                 print "Dumping Root-DSE:\n";
1800                 display_entry_generic($dse);
1801                 exit 0;
1802         }
1803
1804         if ($opt_dump_wknguid) {
1805                 dump_wknguid();
1806                 exit 0;
1807         }
1808
1809         if (do_bind($async_ldap_hd, $sasl_bind) == -1) {
1810                 exit 1;
1811         }
1812
1813         print_header();
1814
1815         if ($opt_dump_schema) {
1816                 print "Dumping Schema:\n";
1817 #               my $ads_schema = $async_ldap_hd->schema;
1818 #               $ads_schema->dump;
1819 #               exit 0;
1820         }
1821
1822         while (1) {
1823
1824                 $async_search = $async_ldap_hd->search(
1825                         base => $base,
1826                         filter => $filter,
1827                         attrs => [ @attrs ],
1828                         control => [ @ctrls ],
1829                         callback => \&default_callback,
1830                         scope => $scope,
1831                                 ) || die "cannot search";
1832
1833                 if (!$opt_notify && ($async_search->code == LDAP_REFERRAL)) {
1834                         foreach my $ref ($async_search->referrals) {
1835                                 print "\ngot Referral: [$ref]\n";
1836                                 my ($prot, $host, $base) = split(/\/+/, $ref);
1837                                 $async_ldap_hd->unbind();
1838                                 $async_ldap_hd = get_ldap_hd($host, 1);
1839                                 if (do_bind($async_ldap_hd, $sasl_bind) == -1) {
1840                                         $async_ldap_hd->unbind();
1841                                         next;
1842                                 }
1843                                 print "\nsuccessful rebind to: [$ref]\n";
1844                                 last;
1845                         }
1846                         next; # repeat the query
1847                 }
1848
1849                 if ($opt_notify) {
1850
1851                         print "Base [$base] is registered now for change-notify\n";
1852                         print "\nWaiting for change-notify...\n";
1853
1854                         my $sync_ldap_hd = get_ldap_hd($server,0);
1855                         if (do_bind($sync_ldap_hd, $sasl_bind) == -1) {
1856                                 exit 2;
1857                         }
1858
1859                         my $sync_search = $sync_ldap_hd->search(
1860                                 base => $base,
1861                                 filter => $filter,
1862                                 attrs => [ @attrs ],
1863                                 callback => \&notify_callback,
1864                                 scope => $scope,
1865                                 ) || die "cannot search";
1866
1867                 }
1868
1869                 $total_entry_count += $async_search->count;
1870                 ++$page_count;
1871                 print "-" x 80 . "\n";
1872                 printf("Got %d Entries in Page %d \n\n",
1873                         $async_search->count, $page_count);
1874                 my ($resp) = $async_search->control(
1875                         $ads_controls{'LDAP_PAGED_RESULT_OID_STRING'} ) or last;
1876                 last unless ref $resp && $ctl_paged->cookie($resp->cookie);
1877         }
1878
1879         if ($async_search->entries == 0) {
1880                 print "No entries found with filter $filter\n";
1881         } else {
1882                 print "Got $total_entry_count Entries in $page_count Pages\n" if ($opt_paging);
1883         }
1884
1885         do_unbind()
1886 }
1887
1888 main();
1889
1890 exit 0;