/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
 */


#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
#include <libintl.h>
#include <ctype.h>

#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <syslog.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <netdir.h>
#include <lber.h>
#include <ldap.h>

#include "ns_sldap.h"
#include "ns_internal.h"
#include "ns_cache_door.h"

#define UDP     "/dev/udp"
#define MAXIFS  32

struct ifinfo {
        struct in_addr addr, netmask;
};

static ns_service_map ns_def_map[] = {
        { "passwd",     "ou=people,",           NULL },
        { "shadow",     "ou=people,",           "passwd" },
        { "user_attr",  "ou=people,",           "passwd" },
        { "audit_user", "ou=people,",           "passwd" },
        { "group",      "ou=group,",            NULL },
        { "rpc",        "ou=rpc,",              NULL },
        { "project",    "ou=projects,",         NULL },
        { "protocols",  "ou=protocols,",        NULL },
        { "networks",   "ou=networks,",         NULL },
        { "netmasks",   "ou=networks,",         "networks" },
        { "netgroup",   "ou=netgroup,",         NULL },
        { "aliases",    "ou=aliases,",          NULL },
        { "Hosts",      "ou=Hosts,",            NULL },
        { "ipnodes",    "ou=Hosts,",            "hosts" },
        { "Services",   "ou=Services,",         NULL },
        { "bootparams", "ou=ethers,",           "ethers" },
        { "ethers",     "ou=ethers,",           NULL },
        { "auth_attr",  "ou=SolarisAuthAttr,",  NULL },
        { "prof_attr",  "ou=SolarisProfAttr,",  NULL },
        { "exec_attr",  "ou=SolarisProfAttr,",  "prof_attr" },
        { "profile",    "ou=profile,",          NULL },
        { "printers",   "ou=printers,",         NULL },
        { "automount",  "",                     NULL },
        { "tnrhtp",     "ou=ipTnet,",           NULL },
        { "tnrhdb",     "ou=ipTnet,",           "tnrhtp" },
        { NULL, NULL, NULL }
};


static char ** parseDN(const char *val, const char *service);
static char ** sortServerNet(char **srvlist);
static char ** sortServerPref(char **srvlist, char **preflist,
                boolean_t flag, int version, int *error);

/*
 * FUNCTION:    s_api_printResult
 *      Given a ns_ldap_result structure print it.
 */
int
__s_api_printResult(ns_ldap_result_t *result)
{

        ns_ldap_entry_t *curEntry;
        int             i, j, k = 0;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_printResult START\n");
#endif
        (void) printf("--------------------------------------\n");
        if (result == NULL) {
                (void) printf("No result\n");
                return (0);
        }
        (void) printf("entries_count %d\n", result->entries_count);
        curEntry = result->entry;
        for (i = 0; i < result->entries_count; i++) {

                (void) printf("entry %d has attr_count = %d \n", i,
                    curEntry->attr_count);
                for (j = 0; j < curEntry->attr_count; j++) {
                        (void) printf("entry %d has attr_pair[%d] = %s \n",
                            i, j, curEntry->attr_pair[j]->attrname);
                        for (k = 0; k < 20 &&
                            curEntry->attr_pair[j]->attrvalue[k]; k++)
                                (void) printf("entry %d has attr_pair[%d]->"
                                    "attrvalue[%d] = %s \n", i, j, k,
                                    curEntry->attr_pair[j]->attrvalue[k]);
                }
                (void) printf("\n--------------------------------------\n");
                curEntry = curEntry->next;
        }
        return (1);
}

/*
 * FUNCTION:    __s_api_getSearchScope
 *
 *      Retrieve the search scope for ldap search from the config module.
 *
 * RETURN VALUES:       NS_LDAP_SUCCESS, NS_LDAP_CONFIG
 * INPUT:               NONE
 * OUTPUT:              searchScope, errorp
 */
int
__s_api_getSearchScope(
        int *searchScope,
        ns_ldap_error_t **errorp)
{

        char            errmsg[MAXERROR];
        void            **paramVal = NULL;
        int             rc = 0;
        int             scope = 0;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_getSearchScope START\n");
#endif
        if (*searchScope == 0) {
                if ((rc = __ns_ldap_getParam(NS_LDAP_SEARCH_SCOPE_P,
                    &paramVal, errorp)) != NS_LDAP_SUCCESS) {
                        return (rc);
                }
                if (paramVal && *paramVal)
                        scope = * (int *)(*paramVal);
                else
                        scope = NS_LDAP_SCOPE_ONELEVEL;
                (void) __ns_ldap_freeParam(&paramVal);
        } else {
                scope = *searchScope;
        }

        switch (scope) {

                case    NS_LDAP_SCOPE_ONELEVEL:
                        *searchScope = LDAP_SCOPE_ONELEVEL;
                        break;
                case    NS_LDAP_SCOPE_BASE:
                        *searchScope = LDAP_SCOPE_BASE;
                        break;
                case    NS_LDAP_SCOPE_SUBTREE:
                        *searchScope = LDAP_SCOPE_SUBTREE;
                        break;
                default:
                        (void) snprintf(errmsg, sizeof (errmsg),
                            gettext("Invalid search scope!"));
                        MKERROR(LOG_ERR, *errorp, NS_CONFIG_FILE,
                            strdup(errmsg), NS_LDAP_CONFIG);
                        return (NS_LDAP_CONFIG);
        }

        return (NS_LDAP_SUCCESS);
}

/*
 * FUNCTION:    __ns_ldap_dupAuth
 *
 *      Duplicates an authentication structure.
 *
 * RETURN VALUES:       copy of authp or NULL on error
 * INPUT:               authp
 */
ns_cred_t *
__ns_ldap_dupAuth(const ns_cred_t *authp)
{
        ns_cred_t *ap;

#ifdef DEBUG
        (void) fprintf(stderr, "__ns_ldap_dupAuth START\n");
#endif
        if (authp == NULL)
                return (NULL);

        ap = (ns_cred_t *)calloc(1, sizeof (ns_cred_t));
        if (ap == NULL)
                return (NULL);

        if (authp->hostcertpath) {
                ap->hostcertpath = strdup(authp->hostcertpath);
                if (ap->hostcertpath == NULL) {
                        free(ap);
                        return (NULL);
                }
        }
        if (authp->cred.unix_cred.userID) {
                ap->cred.unix_cred.userID =
                    strdup(authp->cred.unix_cred.userID);
                if (ap->cred.unix_cred.userID == NULL) {
                        (void) __ns_ldap_freeCred(&ap);
                        return (NULL);
                }
        }
        if (authp->cred.unix_cred.passwd) {
                ap->cred.unix_cred.passwd =
                    strdup(authp->cred.unix_cred.passwd);
                if (ap->cred.unix_cred.passwd == NULL) {
                        (void) __ns_ldap_freeCred(&ap);
                        return (NULL);
                }
        }
        if (authp->cred.cert_cred.nickname) {
                ap->cred.cert_cred.nickname =
                    strdup(authp->cred.cert_cred.nickname);
                if (ap->cred.cert_cred.nickname == NULL) {
                        (void) __ns_ldap_freeCred(&ap);
                        return (NULL);
                }
        }
        ap->auth.type = authp->auth.type;
        ap->auth.tlstype = authp->auth.tlstype;
        ap->auth.saslmech = authp->auth.saslmech;
        ap->auth.saslopt = authp->auth.saslopt;
        return (ap);
}

/*
 * FUNCTION:    __ns_ldap_freeUnixCred
 *
 *      Frees all the memory associated with a UnixCred_t structure.
 *
 * RETURN VALUES:       NS_LDAP_INVALID_PARAM, NS_LDAP_SUCCESS
 * INPUT:               UnixCred
 */
int
__ns_ldap_freeUnixCred(UnixCred_t ** credp)
{
        UnixCred_t *ap;

#ifdef DEBUG
        (void) fprintf(stderr, "__ns_ldap_freeUnixCred START\n");
#endif
        if (credp == NULL || *credp == NULL)
                return (NS_LDAP_INVALID_PARAM);

        ap = *credp;
        if (ap->userID) {
                (void) memset(ap->userID, 0, strlen(ap->userID));
                free(ap->userID);
        }

        if (ap->passwd) {
                (void) memset(ap->passwd, 0, strlen(ap->passwd));
                free(ap->passwd);
        }

        free(ap);
        *credp = NULL;
        return (NS_LDAP_SUCCESS);
}

/*
 * FUNCTION:    __ns_ldap_freeCred
 *
 *      Frees all the memory associated with a ns_cred_t structure.
 *
 * RETURN VALUES:       NS_LDAP_INVALID_PARAM, NS_LDAP_SUCCESS
 * INPUT:               ns_cred_t
 */
int
__ns_ldap_freeCred(ns_cred_t ** credp)
{
        ns_cred_t *ap;

#ifdef DEBUG
        (void) fprintf(stderr, "__ns_ldap_freeCred START\n");
#endif
        if (credp == NULL || *credp == NULL)
                return (NS_LDAP_INVALID_PARAM);

        ap = *credp;
        if (ap->hostcertpath) {
                (void) memset(ap->hostcertpath, 0,
                    strlen(ap->hostcertpath));
                free(ap->hostcertpath);
        }

        if (ap->cred.unix_cred.userID) {
                (void) memset(ap->cred.unix_cred.userID, 0,
                    strlen(ap->cred.unix_cred.userID));
                free(ap->cred.unix_cred.userID);
        }

        if (ap->cred.unix_cred.passwd) {
                (void) memset(ap->cred.unix_cred.passwd, 0,
                    strlen(ap->cred.unix_cred.passwd));
                free(ap->cred.unix_cred.passwd);
        }

        if (ap->cred.cert_cred.nickname) {
                (void) memset(ap->cred.cert_cred.nickname, 0,
                    strlen(ap->cred.cert_cred.nickname));
                free(ap->cred.cert_cred.nickname);
        }

        free(ap);
        *credp = NULL;
        return (NS_LDAP_SUCCESS);
}

/*
 * FUNCTION:    __s_api_is_auth_matched
 *
 *      Compare an authentication structure.
 *
 * RETURN VALUES:       B_TRUE if matched, B_FALSE otherwise.
 * INPUT:               auth1, auth2
 */
boolean_t
__s_api_is_auth_matched(const ns_cred_t *auth1,
    const ns_cred_t *auth2)
{
        if ((auth1->auth.type != auth2->auth.type) ||
            (auth1->auth.tlstype != auth2->auth.tlstype) ||
            (auth1->auth.saslmech != auth2->auth.saslmech) ||
            (auth1->auth.saslopt != auth2->auth.saslopt))
                return (B_FALSE);

        if ((((auth1->auth.type == NS_LDAP_AUTH_SASL) &&
            ((auth1->auth.saslmech == NS_LDAP_SASL_CRAM_MD5) ||
            (auth1->auth.saslmech == NS_LDAP_SASL_DIGEST_MD5))) ||
            (auth1->auth.type == NS_LDAP_AUTH_SIMPLE)) &&
            ((auth1->cred.unix_cred.userID == NULL) ||
            (auth1->cred.unix_cred.passwd == NULL) ||
            ((strcasecmp(auth1->cred.unix_cred.userID,
            auth2->cred.unix_cred.userID) != 0)) ||
            ((strcmp(auth1->cred.unix_cred.passwd,
            auth2->cred.unix_cred.passwd) != 0))))
                return (B_FALSE);

        return (B_TRUE);
}

/*
 * FUNCTION:    __s_api_getDNs
 *
 *      Retrieves the default base dn for the given
 *      service.
 *
 * RETURN VALUES:       NS_LDAP_SUCCESS, NS_LDAP_MEMORY, NS_LDAP_CONFIG
 * INPUT:               service
 * OUTPUT:              DN, error
 */
typedef int (*pf)(const char *, char **, ns_ldap_error_t **);
int
__s_api_getDNs(
        char *** DN,
        const char *service,
        ns_ldap_error_t ** error)
{

        void    **paramVal = NULL;
        char    **dns = NULL;
        int     rc = 0;
        int     i, len;
        pf      prepend_auto2dn = __s_api_prepend_automountmapname_to_dn;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_getDNs START\n");
#endif
        if ((rc = __ns_ldap_getParam(NS_LDAP_SEARCH_BASEDN_P,
            &paramVal, error)) != NS_LDAP_SUCCESS) {
                return (rc);
        }
        if (!paramVal) {
                char errmsg[MAXERROR];

                (void) snprintf(errmsg, sizeof (errmsg),
                    gettext("BaseDN not defined"));
                MKERROR(LOG_ERR, *error, NS_CONFIG_FILE, strdup(errmsg),
                    NS_LDAP_CONFIG);
                return (NS_LDAP_CONFIG);
        }

        dns = (char **)calloc(2, sizeof (char *));
        if (dns == NULL) {
                (void) __ns_ldap_freeParam(&paramVal);
                return (NS_LDAP_MEMORY);
        }

        if (service == NULL) {
                dns[0] = strdup((char *)*paramVal);
                if (dns[0] == NULL) {
                        (void) __ns_ldap_freeParam(&paramVal);
                        free(dns);
                        return (NS_LDAP_MEMORY);
                }
        } else {
                for (i = 0; ns_def_map[i].service != NULL; i++) {
                        if (strcasecmp(service,
                            ns_def_map[i].service) == 0) {

                                len = strlen((char *)*paramVal) +
                                    strlen(ns_def_map[i].rdn) + 1;
                                dns[0] = (char *)
                                    calloc(len, sizeof (char));
                                if (dns[0] == NULL) {
                                        (void) __ns_ldap_freeParam(
                                            &paramVal);
                                        free(dns);
                                        return (NS_LDAP_MEMORY);
                                }
                                (void) strcpy(dns[0],
                                    ns_def_map[i].rdn);
                                (void) strcat(dns[0],
                                    (char *)*paramVal);
                                break;
                        }
                }
                if (ns_def_map[i].service == NULL) {
                        char *p = (char *)*paramVal;
                        char *buffer = NULL;
                        int  buflen = 0;

                        if (strchr(service, '=') == NULL) {
                            /* automount entries */
                                if (strncasecmp(service, "auto_", 5) == 0) {
                                        buffer = strdup(p);
                                        if (!buffer) {
                                                free(dns);
                                                (void) __ns_ldap_freeParam(
                                                    &paramVal);
                                                return (NS_LDAP_MEMORY);
                                        }
                                        /* shorten name to avoid cstyle error */
                                        rc = prepend_auto2dn(
                                            service, &buffer, error);
                                        if (rc != NS_LDAP_SUCCESS) {
                                                free(dns);
                                                free(buffer);
                                                (void) __ns_ldap_freeParam(
                                                    &paramVal);
                                                return (rc);
                                        }
                                } else {
                                /* strlen("nisMapName")+"="+","+'\0' = 13 */
                                        buflen = strlen(service) + strlen(p) +
                                            13;
                                        buffer = (char *)malloc(buflen);
                                        if (buffer == NULL) {
                                                free(dns);
                                                (void) __ns_ldap_freeParam(
                                                    &paramVal);
                                                return (NS_LDAP_MEMORY);
                                        }
                                        (void) snprintf(buffer, buflen,
                                            "nisMapName=%s,%s", service, p);
                                }
                        } else {
                                buflen = strlen(service) + strlen(p) + 2;
                                buffer = (char *)malloc(buflen);
                                if (buffer == NULL) {
                                        free(dns);
                                        (void) __ns_ldap_freeParam(&paramVal);
                                        return (NS_LDAP_MEMORY);
                                }
                                (void) snprintf(buffer, buflen,
                                    "%s,%s", service, p);
                        }
                        dns[0] = buffer;
                }
        }

        (void) __ns_ldap_freeParam(&paramVal);
        *DN = dns;
        return (NS_LDAP_SUCCESS);
}
/*
 * FUNCTION:    __s_api_get_search_DNs_v1
 *
 *      Retrieves the list of search DNS from the V1 profile for the given
 *      service.
 *
 * RETURN VALUES:       NS_LDAP_SUCCESS, NS_LDAP_MEMORY, NS_LDAP_CONFIG
 * INPUT:               service
 * OUTPUT:              DN, error
 */
int
__s_api_get_search_DNs_v1(
        char *** DN,
        const char *service,
        ns_ldap_error_t ** error)
{

        void    **paramVal = NULL;
        void    **temptr = NULL;
        char    **dns = NULL;
        int     rc = 0;

        if ((rc = __ns_ldap_getParam(NS_LDAP_SEARCH_DN_P,
            &paramVal, error)) != NS_LDAP_SUCCESS) {
                return (rc);
        }

        if (service && paramVal) {
                for (temptr = paramVal; *temptr != NULL; temptr++) {
                        dns = parseDN((const char *)(*temptr),
                            (const char *)service);
                        if (dns != NULL)
                                break;
                }
        }

        (void) __ns_ldap_freeParam(&paramVal);
        *DN = dns;
        return (NS_LDAP_SUCCESS);

}
/*
 * FUNCTION:    parseDN
 *
 *      Parse a special formated list(val) into an array of char *.
 *
 * RETURN VALUE:        A char * pointer to the new list of dns.
 * INPUT:               val, service
 */
static char **
parseDN(
        const char *val,
        const char *service)
{

        size_t          len = 0;
        size_t          slen = 0;
        char            **retVal = NULL;
        const char      *temptr;
        char            *temptr2;
        const char      *valend;
        int             valNo = 0;
        int             valSize = 0;
        int             i;
        char            *SSD_service = NULL;

#ifdef DEBUG
        (void) fprintf(stderr, "parseDN START\n");
#endif
        if (val == NULL || *val == '\0')
                return (NULL);
        if (service == NULL || *service == '\0')
                return (NULL);

        len = strlen(val);
        slen = strlen(service);
        if (strncasecmp(val, service, slen) != 0) {
                /*
                 * This routine is only called
                 * to process V1 profile and
                 * for V1 profile, map service
                 * to the corresponding SSD_service
                 * which is associated with a
                 * real container in the LDAP directory
                 * tree, e.g., map "shadow" to
                 * "password". See function
                 * __s_api_get_SSD_from_SSDtoUse_service
                 * for similar service to SSD_service
                 * mapping handling for V2 profile.
                 */
                for (i = 0; ns_def_map[i].service != NULL; i++) {
                        if (ns_def_map[i].SSDtoUse_service &&
                            strcasecmp(service,
                            ns_def_map[i].service) == 0) {
                                SSD_service =
                                    ns_def_map[i].SSDtoUse_service;
                                break;
                        }
                }

                if (SSD_service == NULL)
                        return (NULL);

                slen = strlen(SSD_service);
                if (strncasecmp(val, SSD_service, slen) != 0)
                        return (NULL);
        }

        temptr = val + slen;
        while (*temptr == SPACETOK || *temptr == TABTOK)
                temptr++;
        if (*temptr != COLONTOK)
                return (NULL);

        while (*temptr) {
                temptr2 = strchr(temptr, OPARATOK);
                if (temptr2 == NULL)
                        break;
                temptr2++;
                temptr2 = strchr(temptr2, CPARATOK);
                if (temptr2 == NULL)
                        break;
                valNo++;
                temptr = temptr2+1;
        }

        retVal = (char **)calloc(valNo +1, sizeof (char *));
        if (retVal == NULL)
                return (NULL);

        temptr = val;
        valend = val+len;

        for (i = 0; (i < valNo) && (temptr < valend); i++) {
                temptr = strchr(temptr, OPARATOK);
                if (temptr == NULL) {
                        __s_api_free2dArray(retVal);
                        return (NULL);
                }
                temptr++;
                temptr2 = strchr(temptr, CPARATOK);
                if (temptr2 == NULL) {
                        __s_api_free2dArray(retVal);
                        return (NULL);
                }
                valSize = temptr2 - temptr;

                retVal[i] = (char *)calloc(valSize + 1, sizeof (char));
                if (retVal[i] == NULL) {
                        __s_api_free2dArray(retVal);
                        return (NULL);
                }
                (void) strncpy(retVal[i], temptr, valSize);
                retVal[i][valSize] = '\0';
                temptr = temptr2 + 1;
        }

        return (retVal);
}


/*
 * __s_api_get_local_interfaces
 *
 * Returns a pointer to an array of addresses and netmasks of all interfaces
 * configured on the system.
 *
 * NOTE: This function is very IPv4 centric.
 */
static struct ifinfo *
__s_api_get_local_interfaces()
{
        struct ifconf           ifc;
        struct ifreq            ifreq, *ifr;
        struct ifinfo           *localinfo;
        struct in_addr          netmask;
        struct sockaddr_in      *sin;
        void                    *buf = NULL;
        int                     fd = 0;
        int                     numifs = 0;
        int                     i, n = 0;

        if ((fd = open(UDP, O_RDONLY)) < 0)
                return ((struct ifinfo *)NULL);

        if (ioctl(fd, SIOCGIFNUM, (char *)&numifs) < 0) {
                numifs = MAXIFS;
        }

        buf = malloc(numifs * sizeof (struct ifreq));
        if (buf == NULL) {
                (void) close(fd);
                return ((struct ifinfo *)NULL);
        }
        ifc.ifc_len = numifs * (int)sizeof (struct ifreq);
        ifc.ifc_buf = buf;
        if (ioctl(fd, SIOCGIFCONF, (char *)&ifc) < 0) {
                (void) close(fd);
                free(buf);
                buf = NULL;
                return ((struct ifinfo *)NULL);
        }
        ifr = (struct ifreq *)buf;
        numifs = ifc.ifc_len/(int)sizeof (struct ifreq);
        localinfo = (struct ifinfo *)malloc((numifs + 1) *
            sizeof (struct ifinfo));
        if (localinfo == NULL) {
                (void) close(fd);
                free(buf);
                buf = NULL;
                return ((struct ifinfo *)NULL);
        }

        for (i = 0, n = numifs; n > 0; n--, ifr++) {
                uint_t ifrflags;

                ifreq = *ifr;
                if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifreq) < 0)
                        continue;

                ifrflags = ifreq.ifr_flags;
                if (((ifrflags & IFF_UP) == 0) ||
                    (ifr->ifr_addr.sa_family != AF_INET))
                        continue;

                if (ioctl(fd, SIOCGIFNETMASK, (char *)&ifreq) < 0)
                        continue;
                netmask = ((struct sockaddr_in *)&ifreq.ifr_addr)->sin_addr;

                if (ioctl(fd, SIOCGIFADDR, (char *)&ifreq) < 0)
                        continue;

                sin = (struct sockaddr_in *)&ifreq.ifr_addr;

                localinfo[i].addr = sin->sin_addr;
                localinfo[i].netmask = netmask;
                i++;
        }
        localinfo[i].addr.s_addr = 0;

        free(buf);
        buf = NULL;
        (void) close(fd);
        return (localinfo);
}


/*
 * __s_api_samenet(char *, struct ifinfo *)
 *
 * Returns 1 if address is on the same subnet of the array of addresses
 * passed in.
 *
 * NOTE: This function is only valid for IPv4 addresses.
 */
static int
__s_api_IPv4sameNet(char *addr, struct ifinfo *ifs)
{
        int             answer = 0;

        if (addr && ifs) {
                char            *addr_raw;
                unsigned long   iaddr;
                int             i;

                if ((addr_raw = strdup(addr)) != NULL) {
                        char    *s;

                        /* Remove port number. */
                        if ((s = strchr(addr_raw, ':')) != NULL)
                                *s = '\0';

                        iaddr = inet_addr(addr_raw);

                        /* Loop through interface list to find match. */
                        for (i = 0; ifs[i].addr.s_addr != 0; i++) {
                                if ((iaddr & ifs[i].netmask.s_addr) ==
                                    (ifs[i].addr.s_addr &
                                    ifs[i].netmask.s_addr))
                                        answer++;
                        }
                        free(addr_raw);
                }
        }

        return (answer);
}

/*
 * FUNCTION:    __s_api_getServers
 *
 *      Retrieve a list of ldap servers from the config module.
 *
 * RETURN VALUE:        NS_LDAP_SUCCESS, NS_LDAP_CONFIG, NS_LDAP_MEMORY
 * INPUT:               NONE
 * OUTPUT:              servers, error
 */
int
__s_api_getServers(
                char *** servers,
                ns_ldap_error_t ** error)
{
        void    **paramVal = NULL;
        char    errmsg[MAXERROR];
        char    **sortServers = NULL;
        char    **netservers = NULL;
        int     rc = 0, err = NS_LDAP_CONFIG, version = 1;
        const   char    *str, *str1;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_getServers START\n");
#endif
        *servers = NULL;
        /* get profile version number */
        if ((rc = __ns_ldap_getParam(NS_LDAP_FILE_VERSION_P,
            &paramVal, error)) != NS_LDAP_SUCCESS)
                return (rc);

        if (paramVal == NULL || *paramVal == NULL) {
                (void) snprintf(errmsg, sizeof (errmsg),
                    gettext("No file version"));
                MKERROR(LOG_INFO, *error, NS_CONFIG_FILE, strdup(errmsg),
                    NS_LDAP_CONFIG);
                return (NS_LDAP_CONFIG);
        }

        if (strcasecmp((char *)*paramVal, NS_LDAP_VERSION_1) == 0)
                version = 1;
        else if (strcasecmp((char *)*paramVal, NS_LDAP_VERSION_2) == 0)
                version = 2;

        (void) __ns_ldap_freeParam(&paramVal);
        paramVal = NULL;

        if ((rc = __ns_ldap_getParam(NS_LDAP_SERVERS_P,
            &paramVal, error)) != NS_LDAP_SUCCESS)
                return (rc);

        /*
         * For version 2, default server list could be
         * empty.
         */
        if ((paramVal == NULL || (char *)*paramVal == NULL) &&
            version == 1) {
                str = NULL_OR_STR(__s_api_get_configname(NS_LDAP_SERVERS_P));
                (void) snprintf(errmsg, sizeof (errmsg),
                    gettext("Unable to retrieve the '%s' list"), str);
                MKERROR(LOG_WARNING, *error, NS_CONFIG_FILE, strdup(errmsg),
                    NS_LDAP_CONFIG);
                return (NS_LDAP_CONFIG);
        }

        /*
         * Get server address(es) and go through them.
         */
        *servers = (char **)paramVal;
        paramVal = NULL;

        /* Sort servers based on network. */
        if (*servers) {
                netservers = sortServerNet(*servers);
                if (netservers) {
                        free(*servers);
                        *servers = netservers;
                } else {
                        return (NS_LDAP_MEMORY);
                }
        }

        /* Get preferred server list and sort servers based on that. */
        if ((rc = __ns_ldap_getParam(NS_LDAP_SERVER_PREF_P,
            &paramVal, error)) != NS_LDAP_SUCCESS) {
                if (*servers)
                        __s_api_free2dArray(*servers);
                *servers = NULL;
                return (rc);
        }

        if (paramVal != NULL) {
                char **prefServers;
                void **val = NULL;

                if ((rc =  __ns_ldap_getParam(NS_LDAP_PREF_ONLY_P,
                    &val, error)) != NS_LDAP_SUCCESS) {
                                if (*servers)
                                        __s_api_free2dArray(*servers);
                                *servers = NULL;
                        (void) __ns_ldap_freeParam(&paramVal);
                        return (rc);
                }

                prefServers = (char **)paramVal;
                paramVal = NULL;
                if (prefServers) {
                        if (val != NULL && (*val) != NULL &&
                            *(int *)val[0] == 1)
                                sortServers = sortServerPref(*servers,
                                    prefServers, B_FALSE, version,
                                    &err);
                        else
                                sortServers = sortServerPref(*servers,
                                    prefServers, B_TRUE, version,
                                    &err);
                        if (sortServers) {
                                if (*servers)
                                        free(*servers);
                                *servers = NULL;
                                free(prefServers);
                                prefServers = NULL;
                                *servers = sortServers;
                        } else {
                                if (*servers)
                                        __s_api_free2dArray(*servers);
                                *servers = NULL;
                                __s_api_free2dArray(prefServers);
                                prefServers = NULL;
                        }
                }
                (void) __ns_ldap_freeParam(&val);
        }
        (void) __ns_ldap_freeParam(&paramVal);

        if (*servers == NULL) {
                if (err == NS_LDAP_CONFIG) {
                str = NULL_OR_STR(__s_api_get_configname(
                    NS_LDAP_SERVERS_P));
                str1 = NULL_OR_STR(__s_api_get_configname(
                    NS_LDAP_SERVER_PREF_P));
                        (void) snprintf(errmsg, sizeof (errmsg),
                            gettext("Unable to generate a new server list "
                            "based on '%s' and/or '%s'"), str, str1);
                        MKERROR(LOG_WARNING, *error, NS_CONFIG_FILE,
                            strdup(errmsg), err);
                        return (err);
                }
                return (NS_LDAP_MEMORY);
        }

        return (NS_LDAP_SUCCESS);

}

/*
 * FUNCTION:    sortServerNet
 *      Sort the serverlist based on the distance from client as long
 *      as the list only contains IPv4 addresses.  Otherwise do nothing.
 */
static char **
sortServerNet(char **srvlist)
{
        int             count = 0;
        int             all = 0;
        int             ipv4only = 1;
        struct ifinfo   *ifs = __s_api_get_local_interfaces();
        char            **tsrvs;
        char            **psrvs, **retsrvs;

        /* Sanity check. */
        if (srvlist == NULL || srvlist[0] == NULL)
                return (NULL);

        /* Count the number of servers to sort. */
        for (count = 0; srvlist[count] != NULL; count++) {
                if (!__s_api_isipv4(srvlist[count]))
                        ipv4only = 0;
        }
        count++;

        /* Make room for the returned list of servers. */
        retsrvs = (char **)calloc(count, sizeof (char *));
        if (retsrvs == NULL) {
                free(ifs);
                ifs = NULL;
                return (NULL);
        }

        retsrvs[count - 1] = NULL;

        /* Make a temporary list of servers. */
        psrvs = (char **)calloc(count, sizeof (char *));
        if (psrvs == NULL) {
                free(ifs);
                ifs = NULL;
                free(retsrvs);
                retsrvs = NULL;
                return (NULL);
        }

        /* Filter servers on the same subnet */
        tsrvs = srvlist;
        while (*tsrvs) {
                if (ipv4only && __s_api_IPv4sameNet(*tsrvs, ifs)) {
                        psrvs[all] = *tsrvs;
                        retsrvs[all++] = *(tsrvs);
                }
                tsrvs++;
        }

        /* Filter remaining servers. */
        tsrvs = srvlist;
        while (*tsrvs) {
                char    **ttsrvs = psrvs;

                while (*ttsrvs) {
                        if (strcmp(*tsrvs, *ttsrvs) == 0)
                                break;
                        ttsrvs++;
                }

                if (*ttsrvs == NULL)
                        retsrvs[all++] = *(tsrvs);
                tsrvs++;
        }

        free(ifs);
        ifs = NULL;
        free(psrvs);
        psrvs = NULL;

        return (retsrvs);
}

/*
 * FUNCTION:    sortServerPref
 *      Sort the serverlist based on the preferred server list.
 *
 * The sorting algorithm works as follows:
 *
 * If version 1, if flag is TRUE, find all the servers in both preflist
 * and srvlist, then append other servers in srvlist to this list
 * and return the list.
 * If flag is FALSE, just return srvlist.
 * srvlist can not be empty.
 *
 * If version 2, append all the servers in srvlist
 * but not in preflist to preflist, and return the merged list.
 * If srvlist is empty, just return preflist.
 * If preflist is empty, just return srvlist.
 */
static char **
sortServerPref(char **srvlist, char **preflist,
                boolean_t flag, int version, int *error)
{
        int             i, scount = 0, pcount = 0;
        int             all = 0, dup = 0;
        char            **tsrvs;
        char            **retsrvs;
        char            **dupsrvs;

        /* Count the number of servers to sort. */
        if (srvlist && srvlist[0])
                for (i = 0; srvlist[i] != NULL; i++)
                        scount++;

        /* Sanity check. */
        if (scount == 0 && version == 1) {
                *error = NS_LDAP_CONFIG;
                return (NULL);
        }

        /* Count the number of preferred servers */
        if (preflist && preflist[0])
                for (i = 0; preflist[i] != NULL; i++)
                        pcount++;

        /* Sanity check. */
        if (scount == 0 && pcount == 0) {
                *error = NS_LDAP_CONFIG;
                return (NULL);
        }

        /* Make room for the returned list of servers */
        retsrvs = (char **)calloc(scount + pcount + 1, sizeof (char *));
        if (retsrvs == NULL) {
                *error = NS_LDAP_MEMORY;
                return (NULL);
        }

        /*
         * if the preferred server list is empty,
         * just return a copy of the server list
         */
        if (pcount == 0) {
                tsrvs = srvlist;
                while (*tsrvs)
                        retsrvs[all++] = *(tsrvs++);
                return (retsrvs);
        }
        all = 0;

        /*
         * if the server list is empty,
         * just return a copy of the preferred server list
         */
        if (scount == 0) {
                tsrvs = preflist;
                while (*tsrvs)
                        retsrvs[all++] = *(tsrvs++);
                return (retsrvs);
        }
        all = 0;

        /* Make room for the servers whose memory needs to be freed */
        dupsrvs = (char **)calloc(scount + pcount + 1, sizeof (char *));
        if (dupsrvs == NULL) {
                free(retsrvs);
                *error = NS_LDAP_MEMORY;
                return (NULL);
        }

        /*
         * If version 1,
         * throw out preferred servers not on server list.
         * If version 2, make a copy of the preferred server list.
         */
        if (version == 1) {
                tsrvs = preflist;
                while (*tsrvs) {
                        char    **ttsrvs = srvlist;

                        while (*ttsrvs) {
                                if (strcmp(*tsrvs, *(ttsrvs)) == 0)
                                        break;
                                ttsrvs++;
                        }
                        if (*ttsrvs != NULL)
                                retsrvs[all++] = *tsrvs;
                        else
                                dupsrvs[dup++] = *tsrvs;
                        tsrvs++;
                }
        } else {
                tsrvs = preflist;
                while (*tsrvs)
                        retsrvs[all++] = *(tsrvs++);
        }
        /*
         * If version 1,
         * if PREF_ONLY is false, we append the non-preferred servers
         * to bottom of list.
         * For version 2, always append.
         */
        if (flag == B_TRUE || version != 1) {

                tsrvs = srvlist;
                while (*tsrvs) {
                        char    **ttsrvs = preflist;

                        while (*ttsrvs) {
                                if (strcmp(*tsrvs, *ttsrvs) == 0) {
                                        break;
                                }
                                ttsrvs++;
                        }
                        if (*ttsrvs == NULL)
                                retsrvs[all++] = *tsrvs;
                        else
                                dupsrvs[dup++] = *tsrvs;
                        tsrvs++;
                }
        }

        /* free memory for duplicate servers */
        if (dup) {
                for (tsrvs = dupsrvs; *tsrvs; tsrvs++)
                        free(*tsrvs);
        }
        free(dupsrvs);

        return (retsrvs);
}

/*
 * FUNCTION:    __s_api_removeBadServers
 *      Contacts the ldap cache manager for marking the
 *      problem servers as down, so that the server is
 *      not contacted until the TTL expires.
 */
void
__s_api_removeBadServers(char ** Servers)
{

        char    **host;

        if (Servers == NULL)
                return;

        for (host = Servers; *host != NULL; host++) {
                if (__s_api_removeServer(*host) < 0) {
                        /*
                         * Couldn't remove server from
                         * server list. Log a warning.
                         */
                        syslog(LOG_WARNING, "libsldap: could "
                            "not remove %s from servers list", *host);
                }
        }
}

/*
 * FUNCTION:    __s_api_free2dArray
 */
void
__s_api_free2dArray(char ** inarray)
{

        char    **temptr;

        if (inarray == NULL)
                return;

        for (temptr = inarray; *temptr != NULL; temptr++) {
                free(*temptr);
        }
        free(inarray);
}

/*
 * FUNCTION:    __s_api_cp2dArray
 */
char **
__s_api_cp2dArray(char **inarray)
{
        char    **newarray;
        char     **ttarray, *ret;
        int     count;

        if (inarray == NULL)
                return (NULL);

        for (count = 0; inarray[count] != NULL; count++)
                ;

        newarray = (char **)calloc(count + 1, sizeof (char *));
        if (newarray == NULL)
                return (NULL);

        ttarray = newarray;
        for (; *inarray; inarray++) {
                *(ttarray++) = ret = strdup(*inarray);
                if (ret == NULL) {
                        __s_api_free2dArray(newarray);
                        return (NULL);
                }
        }
        return (newarray);
}

/*
 * FUNCTION:    __s_api_isCtrlSupported
 *      Determines if the passed control is supported by the LDAP sever.
 * RETURNS:     NS_LDAP_SUCCESS if yes, NS_LDAP_OP_FAIL if not.
 */
int
__s_api_isCtrlSupported(Connection *con, char *ctrlString)
{
        char            **ctrl;
        int             len;

        len = strlen(ctrlString);
        for (ctrl = con->controls; ctrl && *ctrl; ctrl++) {
                if (strncasecmp(*ctrl, ctrlString, len) == 0)
                        return (NS_LDAP_SUCCESS);
        }
        return (NS_LDAP_OP_FAILED);
}

/*
 * FUNCTION:    __s_api_toFollowReferrals
 *      Determines if need to follow referral for an SLDAP API.
 * RETURN VALUES:       NS_LDAP_SUCCESS, NS_LDAP_INVALID_PARAM, or
 *                      other rc from __ns_ldap_getParam()
 * INPUT:               flags
 * OUTPUT:              toFollow, errorp
 */
int
__s_api_toFollowReferrals(const int flags,
        int *toFollow,
        ns_ldap_error_t **errorp)
{
        void            **paramVal = NULL;
        int             rc = 0;
        int             iflags = 0;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_toFollowReferrals START\n");
#endif

        /* Either NS_LDAP_NOREF or NS_LDAP_FOLLOWREF not both */
        if ((flags & (NS_LDAP_NOREF | NS_LDAP_FOLLOWREF)) ==
            (NS_LDAP_NOREF | NS_LDAP_FOLLOWREF)) {
                return (NS_LDAP_INVALID_PARAM);
        }

        /*
         * if the NS_LDAP_NOREF or NS_LDAP_FOLLOWREF is set
         * this will take precendence over the values specified
         * in the configuration file
         */
        if (flags & (NS_LDAP_NOREF | NS_LDAP_FOLLOWREF)) {
                        iflags = flags;
        } else {
                rc = __ns_ldap_getParam(NS_LDAP_SEARCH_REF_P,
                    &paramVal, errorp);
                if (rc != NS_LDAP_SUCCESS)
                        return (rc);
                if (paramVal == NULL || *paramVal == NULL) {
                        (void) __ns_ldap_freeParam(&paramVal);
                        if (*errorp)
                                (void) __ns_ldap_freeError(errorp);
                        *toFollow = TRUE;
                        return (NS_LDAP_SUCCESS);
                }
                iflags = (* (int *)(*paramVal));
                (void) __ns_ldap_freeParam(&paramVal);
        }

        if (iflags & NS_LDAP_NOREF)
                *toFollow = FALSE;
        else
                *toFollow = TRUE;

        return (NS_LDAP_SUCCESS);
}

/*
 * FUNCTION:    __s_api_addRefInfo
 *      Insert a referral info into a referral info list.
 * RETURN VALUES:       NS_LDAP_SUCCESS, NS_LDAP_MEMORY, NS_LDAP_OP_FAILED
 * INPUT:               LDAP URL, pointer to the referral info list,
 *                      search baseDN, search scope, search filter,
 *                      previous connection
 */
int
__s_api_addRefInfo(ns_referral_info_t **head, char *url,
                        char *baseDN, int *scope,
                        char *filter, LDAP *ld)
{
        char                    errmsg[MAXERROR], *tmp;
        ns_referral_info_t      *ref, *tmpref;
        LDAPURLDesc             *ludp = NULL;
        int                     hostlen;
        char *ld_defhost = NULL;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_addRefInfo START\n");
#endif

        /* sanity check */
        if (head == NULL)
                return (NS_LDAP_OP_FAILED);

        /*
         * log error and return NS_LDAP_SUCCESS
         * if one of the following:
         * 1. non-LDAP URL
         * 2. LDAP URL which can not be parsed
         */
        if (!ldap_is_ldap_url(url) ||
            ldap_url_parse_nodn(url, &ludp) != 0) {
                (void) snprintf(errmsg, MAXERROR, "%s: %s",
                    gettext("Invalid or non-LDAP URL when"
                    " processing referrals URL"),
                    url);
                syslog(LOG_ERR, "libsldap: %s", errmsg);
                if (ludp)
                                ldap_free_urldesc(ludp);
                return (NS_LDAP_SUCCESS);
        }

        ref = (ns_referral_info_t *)calloc(1,
            sizeof (ns_referral_info_t));
        if (ref == NULL) {
                ldap_free_urldesc(ludp);
                return (NS_LDAP_MEMORY);
        }

        /*
         * we do have a valid URL and we were able to parse it
         * however, we still need to find out what hostport to
         * use if none were provided in the LDAP URL
         * (e.g., ldap:///...)
         */
        if ((ludp->lud_port == 0) && (ludp->lud_host == NULL)) {
                if (ld == NULL) {
                        (void) snprintf(errmsg, MAXERROR, "%s: %s",
                            gettext("no LDAP handle when"
                            " processing referrals URL"),
                            url);
                        syslog(LOG_WARNING, "libsldap: %s", errmsg);
                        ldap_free_urldesc(ludp);
                        free(ref);
                        return (NS_LDAP_SUCCESS);
                } else {
                        (void) ldap_get_option(ld, LDAP_OPT_HOST_NAME,
                            &ld_defhost);
                        if (ld_defhost == NULL) {
                                (void) snprintf(errmsg, MAXERROR, "%s: %s",
                                    gettext("not able to retrieve default "
                                    "host when processing "
                                    "referrals URL"),
                                    url);
                                syslog(LOG_WARNING, "libsldap: %s", errmsg);
                                ldap_free_urldesc(ludp);
                                free(ref);
                                return (NS_LDAP_SUCCESS);
                        } else {
                                ref->refHost = strdup(ld_defhost);
                                if (ref->refHost == NULL) {
                                        ldap_free_urldesc(ludp);
                                        free(ref);
                                        return (NS_LDAP_MEMORY);
                                }
                        }
                }
        } else {
                /*
                 * add 4 here:
                 * 1 for the last '\0'.
                 * 1 for host and prot separator ":"
                 * and "[" & "]" for possible ipV6 addressing
                 */
                hostlen = strlen(ludp->lud_host) +
                    sizeof (MAXPORTNUMBER_STR) + 4;
                ref->refHost = (char *)malloc(hostlen);
                if (ref->refHost == NULL) {
                        ldap_free_urldesc(ludp);
                        free(ref);
                        return (NS_LDAP_MEMORY);
                }

                if (ludp->lud_port != 0) {
                        /*
                         * serverAddr = host:port
                         * or
                         * if host is an IPV6 address
                         * [host]:port
                         */
                        tmp = strstr(url, ludp->lud_host);
                        if (tmp && (tmp > url) && *(tmp - 1) == '[') {
                                (void) snprintf(ref->refHost, hostlen,
                                    "[%s]:%d",
                                    ludp->lud_host,
                                    ludp->lud_port);
                        } else {
                                (void) snprintf(ref->refHost, hostlen,
                                    "%s:%d",
                                    ludp->lud_host,
                                    ludp->lud_port);
                        }
                } else {
                        /* serverAddr = host */
                        (void) snprintf(ref->refHost, hostlen, "%s",
                            ludp->lud_host);
                }
        }

        if (ludp->lud_dn) {
                ref->refDN = strdup(ludp->lud_dn);
                if (ref->refDN == NULL) {
                        ldap_free_urldesc(ludp);
                        free(ref->refHost);
                        free(ref);
                        return (NS_LDAP_MEMORY);
                }
        } else {
                if (baseDN) {
                        ref->refDN = strdup(baseDN);
                        if (ref->refDN == NULL) {
                                ldap_free_urldesc(ludp);
                                free(ref->refHost);
                                free(ref);
                                return (NS_LDAP_MEMORY);
                        }
                }
        }

        if (filter)
                ref->refFilter = strdup(filter);
        else if (ludp->lud_filter)
                ref->refFilter = strdup(ludp->lud_filter);
        else
                ref->refFilter = strdup("");

        if (ref->refFilter == NULL) {
                ldap_free_urldesc(ludp);
                free(ref->refHost);
                if (ref->refDN)
                        free(ref->refDN);
                free(ref);
                return (NS_LDAP_MEMORY);
        }

        /*
         * If the scope is specified in the URL use it.
         * Note if the scope is missing in the URL, ldap_url_parse_nodn()
         * returns the scope BASE. We need to check that the scope of BASE
         * is actually present in the URL.
         * If the scope is missing in the URL then use the passed-in
         * scope.
         * If there is no passed-in scope, then use the scope SUBTREE.
         */
        if (ludp->lud_dn && ludp->lud_scope != LDAP_SCOPE_BASE)
                ref->refScope = ludp->lud_scope;
        else if (ludp->lud_dn && strstr(url, "?base"))
                ref->refScope = LDAP_SCOPE_BASE;
        else if (scope)
                ref->refScope = *scope;
        else
                ref->refScope = LDAP_SCOPE_SUBTREE;

        ref->next = NULL;

        ldap_free_urldesc(ludp);

        /* insert the referral info */
        if (*head) {
                for (tmpref = *head; tmpref->next; tmpref = tmpref->next)
                        ;
                tmpref->next = ref;
        } else
                *head = ref;

        return (NS_LDAP_SUCCESS);
}

/*
 * FUNCTION:    __s_api_deleteRefInfo
 *      Delete a referral info list.
 * INPUT:               pointer to the referral info list
 */
void
__s_api_deleteRefInfo(ns_referral_info_t *head)
{
        ns_referral_info_t      *ref, *tmp;

#ifdef DEBUG
        (void) fprintf(stderr, "__s_api_deleteRefInfo START\n");
#endif

        for (ref = head; ref; ) {
                if (ref->refHost)
                        free(ref->refHost);
                if (ref->refDN)
                        free(ref->refDN);
                if (ref->refFilter)
                        free(ref->refFilter);
                tmp = ref->next;
                free(ref);
                ref = tmp;
        }

}

/*
 * FUNCTION:    __s_api_get_SSD_from_SSDtoUse_service
 *
 *      Retrieves the Service Search Descriptors which should be used for
 *      the given service. For example, return all the "passwd" SSDs for
 *      service "shadow" if no SSD is defined for service "shadow" and
 *      no filter component is defined in all the "passwd" SSDs. This idea
 *      of sharing the SSDs defined for some other service is to reduce the
 *      configuration complexity. For a service, which does not have its own
 *      entries in the LDAP directory, SSD for it is useless, and should not
 *      be set. But since this service must share the container with at least
 *      one other service which does have it own entries, the SSD for
 *      this other service will be shared by this service.
 *      This other service is called the SSD-to-use service.
 *      The static data structure, ns_def_map[], in this file
 *      defines the SSD-to-use service for all the services supported.
 *
 * RETURN VALUES:       NS_LDAP_SUCCESS, NS_LDAP_MEMORY, NS_LDAP_INVALID_PARAM
 * INPUT:               service
 * OUTPUT:              *SSDlist, *errorp if error
 */
int
__s_api_get_SSD_from_SSDtoUse_service(const char *service,
                ns_ldap_search_desc_t ***SSDlist,
                ns_ldap_error_t **errorp)
{
        int                     i, rc;
        int                     found = FALSE;
        int                     filter_found = FALSE;
        char                    *SSD_service = NULL;
        char                    errmsg[MAXERROR];
        ns_ldap_search_desc_t   **sdlist;
        int                     auto_service = FALSE;

#ifdef DEBUG
        (void) fprintf(stderr,
            "__s_api_get_SSD_from_SSDtoUse_service START\n");
#endif

        if (SSDlist == NULL || errorp == NULL)
                return (NS_LDAP_INVALID_PARAM);

        *SSDlist = NULL;
        *errorp = NULL;

        if (service == NULL)
                return (NS_LDAP_SUCCESS);

        if (strncasecmp(service, "auto_", 5) == 0)
                auto_service = TRUE;

        /*
         * First try to return the configured SSDs for the input server
         */
        rc = __ns_ldap_getSearchDescriptors(service, SSDlist, errorp);
        if (rc != NS_LDAP_SUCCESS)
                return (rc);
        else {
                if (*SSDlist != NULL)
                        return (NS_LDAP_SUCCESS);
        }

        /*
         * If service == auto_* and SSD is not found,
         * then try automount to see if there is an SSD
         * for automount.
         */

        if (auto_service) {
                rc = __ns_ldap_getSearchDescriptors(
                    "automount", SSDlist, errorp);
                if (rc != NS_LDAP_SUCCESS)
                        return (rc);
                else {
                        if (*SSDlist != NULL) {
                                /*
                                 * If SSDlist is found,
                                 * prepend automountMapName to the basedn
                                 * in the SSDlist
                                 *
                                 */
                                rc = __s_api_prepend_automountmapname(
                                    service,
                                    SSDlist,
                                    errorp);

                                if (rc != NS_LDAP_SUCCESS) {
                                        (void) __ns_ldap_freeSearchDescriptors(
                                            SSDlist);
                                        *SSDlist = NULL;
                                }

                                return (rc);
                        }
                }
        }

        /*
         * Find the SSDtoUse service.
         * If none found, flag "found" remains FALSE.
         */
        for (i = 0; ns_def_map[i].service != NULL; i++) {
                if (ns_def_map[i].SSDtoUse_service &&
                    strcasecmp(service,
                    ns_def_map[i].service) == 0) {
                        found = TRUE;
                        SSD_service = ns_def_map[i].SSDtoUse_service;
                        break;
                }
        }

        if (!found)
                return (NS_LDAP_SUCCESS);

        /*
         * return the SSDs for SSD_service only if no optional filter
         * component is defined in the SSDs
         */
        rc = __ns_ldap_getSearchDescriptors(SSD_service,
            SSDlist, errorp);
        if (rc != NS_LDAP_SUCCESS) {
                return (rc);
        } else {
                if (*SSDlist == NULL)
                        return (NS_LDAP_SUCCESS);

                /* check to see if filter defined in SSD */
                for (sdlist = *SSDlist; *sdlist; sdlist++) {
                        if ((*sdlist)->filter &&
                            strlen((*sdlist)->filter) > 0) {
                                filter_found = TRUE;
                                break;
                        }
                }
                if (filter_found) {
                        (void) __ns_ldap_freeSearchDescriptors(SSDlist);
                        *SSDlist = NULL;
                        (void) snprintf(errmsg, sizeof (errmsg),
                            gettext("Service search descriptor for "
                            "service '%s' contains filter, "
                            "which can not be used for "
                            "service '%s'."),
                            SSD_service, service);
                        MKERROR(LOG_WARNING, *errorp, NS_CONFIG_FILE,
                            strdup(errmsg), NS_LDAP_CONFIG);
                        return (NS_LDAP_CONFIG);
                }

        }
        return (NS_LDAP_SUCCESS);
}


/*
 * verify addr is an IPv4 address with the optional [:portno]
 * RFC2373 & RFC2732 & RFC2396
 */
int
__s_api_isipv4(char *addr)
{
        int i, seg, digit, port;

        if (!addr)
                return (0);

        digit = seg = port = 0;

        for (i = 0; i < strlen(addr); i++) {
                if (isdigit(addr[i])) {
                        digit++;
                        continue;
                }
                if (addr[i] == '.') {
                        if (digit > 3 || digit == 0)
                                return (0);
                        digit = 0;
                        seg++;
                        continue;
                }
                if (addr[i] == ':') {
                        if (digit > 3)
                                return (0);
                        port++;
                        digit = 0;
                        seg++;
                        continue;
                }
                return (0);
        }

        if ((seg == 3 && port == 0 && digit > 0 && digit < 4) ||
            (seg == 4 && port == 1 && digit > 0))
                return (1);

        return (0);
}


/*
 * verify addr is an IPv6 address with the optional [IPv6]:portno
 * RFC2373 & RFC2732 & RFC2396
 */
int
__s_api_isipv6(char *addr)
{
        int i, col, digit, port, dc, tc;
        char *laddr, *c1, *s;

        if (!addr)
                return (0);

        s = addr;
        laddr = NULL;
        digit = col = port = 0;
        if (addr[0] == '[') {
                laddr = strdup(addr);
                if (!laddr)
                        return (0);
                c1 = strchr(laddr, ']');
                /* only 1 ']' should be in an addr */
                if (!c1 || (strchr(c1+1, ']')))
                        goto bad;
                switch (c1[1]) {
                        case ':':
                                port++;
                                for (i = 2; i < strlen(c1); i++) {
                                        if (!isdigit(c1[i]))
                                                goto bad;
                                        digit++;
                                }
                                if (!digit)
                                        goto bad;
                                c1[0] = '\0';
                                break;
                        case '\0':
                                c1[0] = '\0';
                                break;
                        default:
                                goto bad;
                }
                s = &laddr[1];
        }

        digit = dc = tc = 0;
        for (i = 0; i < strlen(s); i++) {
                if (isxdigit(s[i])) {
                        if (digit == 0)
                                dc = i;
                        digit++;
                        col = 0;
                        continue;
                }
                if (s[i] == ':') {
                        tc++;
                        if ((col > 1) || (i && !col && !digit))
                                goto bad;
                        digit = 0;
                        col++;
                        continue;
                }
                if (s[i] == '.') {
                        if (__s_api_isipv4(&s[dc]) && tc)
                                goto good;
                        else
                                goto bad;
                }
                goto bad;
        }

good:
        free(laddr);
        return (1);
bad:
        free(laddr);
        return (0);
}


/*
 * verify addr is a valid hostname with the optional [:portno]
 * RFC2373 & RFC2732 & RFC2396
 */
int
__s_api_ishost(char *addr)
{
        int i, seg, alpha, digit, port;

        if (!addr)
                return (0);

        alpha = digit = seg = port = 0;

        /* must start with alpha character */
        if (!isalpha(addr[0]))
                return (0);

        for (i = 0; i < strlen(addr); i++) {
                if (isalpha(addr[i]) || (i && addr[i] == '-')) {
                        alpha++;
                        continue;
                }
                if (isdigit(addr[i])) {
                        digit++;
                        continue;
                }
                if (addr[i] == '.') {
                        if (!alpha && !digit)
                                return (0);
                        alpha = digit = 0;
                        seg++;
                        continue;
                }
                if (addr[i] == ':') {
                        if (!alpha && !digit)
                                return (0);
                        alpha = digit = 0;
                        port++;
                        seg++;
                        continue;
                }
                return (0);
        }

        if ((port == 0 && (seg || alpha || digit)) ||
            (port == 1 && alpha == 0 && digit))
                return (1);

        return (0);
}


/*
 * Prepend automountMapName=auto_xxx to the basedn
 * in the SSDlist
 */

int __s_api_prepend_automountmapname(
        const char *service,
        ns_ldap_search_desc_t ***SSDlist,
        ns_ldap_error_t **errorp)
{
        int                     i, rc;
        ns_ldap_search_desc_t   ** ssdlist = NULL;

        if (service == NULL || SSDlist == NULL || *SSDlist == NULL)
                return (NS_LDAP_INVALID_PARAM);

        ssdlist = *SSDlist;

        for (i = 0; ssdlist[i] != NULL; i++) {
                rc = __s_api_prepend_automountmapname_to_dn(
                    service, &ssdlist[i]->basedn, errorp);

                if (rc != NS_LDAP_SUCCESS)
                        return (rc);
        }

        return (NS_LDAP_SUCCESS);
}


/*
 * Prepend automountMapName=auto_xxx to the DN
 * Construct a string of
 * "automountMapName=auto_xxx,dn"
 *
 * If automountMapName is mapped to some other attribute,
 * then use the mapping in the setup.
 *
 * If a version 1 profile is in use, use nisMapName for
 * backward compatibility (i.e. "nisMapName=auto_xxx,dn").
 */

int
__s_api_prepend_automountmapname_to_dn(
        const char *service,
        char **dn,
        ns_ldap_error_t **errorp)
{
        int rc, len_s = 0, len_d = 0, len = 0;
        char *buffer = NULL;
        char *default_automountmapname = "automountMapName";
        char *automountmapname = NULL;
        char **mappedattrs = NULL;
        char errstr[MAXERROR];
        void **paramVal = NULL;

        if (service == NULL || dn == NULL || *dn == NULL)
                return (NS_LDAP_INVALID_PARAM);

        rc = __ns_ldap_getParam(NS_LDAP_FILE_VERSION_P, &paramVal, errorp);
        if (rc != NS_LDAP_SUCCESS || !paramVal || !*paramVal) {
                if (paramVal)
                        (void) __ns_ldap_freeParam(&paramVal);
                return (rc);
        }
        if (strcasecmp(*paramVal, NS_LDAP_VERSION_1) == 0) {
                automountmapname = strdup("nisMapName");
                (void) __ns_ldap_freeParam(&paramVal);
                if (automountmapname == NULL) {
                        return (NS_LDAP_MEMORY);
                }
        } else {
                (void) __ns_ldap_freeParam(&paramVal);

                /* Find mapped attribute name of auto_xxx first */
                mappedattrs = __ns_ldap_getMappedAttributes(
                    service, default_automountmapname);
                /*
                 * if mapped attribute name of auto_xxx is not found,
                 * find the mapped attribute name of automount
                 */

                if (mappedattrs == NULL)
                        mappedattrs = __ns_ldap_getMappedAttributes(
                        "automount", default_automountmapname);

                /*
                 * if mapped attr is not found, use the default automountmapname
                 */

                if (mappedattrs == NULL) {
                        automountmapname = strdup(default_automountmapname);
                        if (automountmapname == NULL)
                                return (NS_LDAP_MEMORY);
                } else {
                        if (mappedattrs[0] != NULL) {
                                /*
                                 * Copy it from the mapped attr list
                                 * Assume it's 1 to 1 mapping
                                 * 1 to n does not make sense
                                 */
                                automountmapname = strdup(mappedattrs[0]);
                                __s_api_free2dArray(mappedattrs);
                                if (automountmapname == NULL) {
                                        return (NS_LDAP_MEMORY);
                                }
                        } else {

                                /*
                                 * automountmapname is mapped to an empty string
                                 */

                                __s_api_free2dArray(mappedattrs);

                                (void) sprintf(errstr,
                                    gettext(
                                    "Attribute automountMapName is "
                                    "mapped to an empty string.\n"));

                                MKERROR(LOG_WARNING, *errorp, NS_CONFIG_SYNTAX,
                                    strdup(errstr), NS_LDAP_MEMORY);

                                return (NS_LDAP_CONFIG);
                        }
                }
        }

        len_s = strlen(service);
        len_d  = strlen(*dn);
        /* automountMapName + "=" + service + "," + dn + '\0' */
        len = strlen(automountmapname) + 1 + len_s + 1 + len_d + 1;
        buffer = (char *)malloc(len);
        if (buffer == NULL) {
                free(automountmapname);
                return (NS_LDAP_MEMORY);
        }

        (void) snprintf(buffer, len, "%s=%s,%s",
            automountmapname, service, *dn);

        buffer[len-1] = '\0';

        free(automountmapname);

        /* free the original dn */
        (void) free(*dn);

        *dn = buffer;

        return (NS_LDAP_SUCCESS);
}

/*
 * Map the LDAP error code and error message from LDAP server
 * to a password status used for password aging/management.
 */
ns_ldap_passwd_status_t
__s_api_set_passwd_status(int errnum, char *errmsg)
{
        syslog(LOG_DEBUG, "libsldap: got LDAP errnum %d & message: %s ", errnum,
            (errmsg != NULL) ? errmsg : "error msg not available");
        if (errmsg) {
                if (errnum ==
                    LDAP_INVALID_CREDENTIALS) {
                        /*
                         * case 1 (Bind):
                         * password expired
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_EXPIRED))
                                return (NS_PASSWD_EXPIRED);
                }

                if (errnum ==
                    LDAP_UNWILLING_TO_PERFORM) {
                        /*
                         * case 1.1 (Bind):
                         * password expired
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_EXPIRED))
                                return (NS_PASSWD_EXPIRED);

                        /*
                         * case 2 (Bind):
                         * Account inactivated
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_ACCT_INACTIVATED))
                                return (NS_PASSWD_EXPIRED);


                        /*
                         * case 3 (Modify passwd):
                         * the user is not allow to change
                         * password; only admin can change it
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_CHANGE_NOT_ALLOW))
                                return (NS_PASSWD_CHANGE_NOT_ALLOWED);
                }

                if (errnum ==
                    LDAP_CONSTRAINT_VIOLATION) {
                        /*
                         * case 4 (Bind):
                         * the user account is locked due to
                         * too many login failures.
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_MAXTRIES))
                                return (NS_PASSWD_RETRY_EXCEEDED);
                        /*
                         * case 5 (Modify passwd):
                         * syntax error: the new password
                         * has length less than defined
                         * minimum
                         * Not true anymore with strong password
                         * policies on LDAP server: errmsg that
                         * contain NS_PWDERR_INVALID_SYNTAX may
                         * have different meanings.
                         * To keep compatibility with older password
                         * policy, check if errmsg is strictly equal
                         * to NS_PWDERR_INVALID_SYNTAX and if yes only,
                         * return NS_PASSWD_TOO_SHORT.
                         */
                        if (strcmp(errmsg,
                            NS_PWDERR_INVALID_SYNTAX) == 0)
                                return (NS_PASSWD_TOO_SHORT);
                        if (strstr(errmsg,
                            NS_PWDERR_INVALID_SYNTAX))
                                return (NS_PASSWD_INVALID_SYNTAX);
                        /*
                         * case 6 (Modify passwd):
                         * trivial password: same value as
                         * that of attribute cn, sn, or uid ...
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_TRIVIAL_PASSWD))
                                return (NS_PASSWD_INVALID_SYNTAX);
                        /*
                         * case 7 (Modify passwd):
                         * re-use one of the old passwords
                         * in history list
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_IN_HISTORY))
                                return (NS_PASSWD_IN_HISTORY);
                        /*
                         * case 8 (Modify passwd):
                         * password not allowed to be
                         * changed yet; within minimum
                         * age
                         */
                        if (strstr(errmsg,
                            NS_PWDERR_WITHIN_MIN_AGE))
                                return (NS_PASSWD_WITHIN_MIN_AGE);
                }

        }

        return (NS_PASSWD_GOOD);
}

/*
 * Determine if the input OID list contains
 * one of the password control OIDs, which are:
 * LDAP_CONTROL_PWEXPIRED: 2.16.840.1.113730.3.4.4
 * LDAP_CONTROL_PWEXPIRING: 2.16.840.1.113730.3.4.5.
 * If yes, return 1, if no, 0.
 */
int
__s_api_contain_passwd_control_oid(char **oids)
{
        char **oid;

        if (oids == NULL)
                return (0);

        for (oid = oids; *oid; oid++) {
                if (strcmp(*oid, LDAP_CONTROL_PWEXPIRED) == 0 ||
                    strcmp(*oid, LDAP_CONTROL_PWEXPIRING) == 0) {
                        return (1);
                }
        }

        return (0);
}

/*
 * Determine if the input OID list contains LDAP V3 password less
 * account management control OID, which is:
 * NS_LDAP_ACCOUNT_USABLE_CONTROL:1.3.6.1.4.1.42.2.27.9.5.8
 * If yes, return 1, if no, 0.
 */
int
__s_api_contain_account_usable_control_oid(char **oids)
{
        char **oid;

        if (oids == NULL)
                return (0);

        for (oid = oids; *oid; oid++) {
                if (strcmp(*oid, NS_LDAP_ACCOUNT_USABLE_CONTROL) == 0) {
                        return (1);
                }
        }

        return (0);
}

/*
 * For some databases in name switch, the name and aliases are saved
 * as "cn". When the "cn" valuse are retrieved, there is no distinction
 * which is  the name and which is(are) aliase(s).
 * This function is to parse RDN and find the value of the "cn" and
 * then find the matching value in "cn" attribute.
 * Also see RFC 2307 section 5.6.
 *
 * Input -
 *  entry:      An LDAP entry
 *  attrptr:    A attribute which value appears in RDN
 *              This should be "cn" for the name switch for now.
 *  case_ignore:    0 Case sensitive comparison on the attribute value
 *                  1 Case insensitive comparison
 *
 * Return -
 *              The value of an attrbute which is used as canonical name
 *              This is read only and the caller should not try to free it.
 *              If it's a NULL, it could be either an RDN parsing error
 *              or RDN value does not match any existing "cn" values.
 *              e.g.
 *              dn: cn=xx+ipserviceprotocol=udp,......
 *              cn: aa
 *              cn: bb
 *
 * Note:
 *  Although the name switch/ldap's  rdn is in "cn=xx" or "cn=xx+..."
 * format, this function makes no such assumption. If the DN
 * is saved as "dn: yy=...+sn=my_canocical_name, ..", then it can still work.
 * The comments use "cn" as an example only.
 *
 */
typedef int (*cmpfunc)(const char *, const char *);

char *
__s_api_get_canonical_name(ns_ldap_entry_t *entry, ns_ldap_attr_t *attrptr,
                        int case_ignore) {
        uint_t                  i;
        char                    *token, *lasts, *value = NULL;
        char                    **rdn = NULL, **attrs = NULL, **values = NULL;
        char                    *rdn_attr_value = NULL;
        cmpfunc                 cmp;

        if (entry == NULL || attrptr == NULL)
                return (NULL);

        /* "values" is read-only */
        if ((values = __ns_ldap_getAttr(entry, "dn")) == NULL ||
            values[0] == NULL)
                return (NULL);

        if ((rdn = ldap_explode_dn(values[0], 0)) == NULL ||
            rdn[0] == NULL)
                return (NULL);

        if ((attrs = ldap_explode_rdn(rdn[0], 0)) == NULL) {
                ldap_value_free(rdn);
                return (NULL);
        }
        /* Assume the rdn is normalized */
        for (i = 0; attrs[i] != NULL; i++) {
                /* parse attribute name and value, get attribute name first */
                if ((token = strtok_r(attrs[i], "=", &lasts)) == NULL) {
                        goto cleanup;
                }
                if (strcasecmp(token, attrptr->attrname) == 0) {
                        /* get value */
                        rdn_attr_value = lasts;
                        break;
                }
        }
        if (rdn_attr_value) {
                if (case_ignore)
                        cmp = strcasecmp;
                else
                        cmp = strcmp;
                /*
                 * After parsing RDN and find the matching attribute in RDN,
                 * match rdn value with values in "cn".
                 */
                for (i = 0; i < attrptr->value_count; i++) {
                        if (attrptr->attrvalue[i] &&
                            (*cmp)(rdn_attr_value,
                            attrptr->attrvalue[i]) == 0) {
                                /* RDN "cn" value matches the "cn" value */
                                value = attrptr->attrvalue[i];
                                break;
                        }
                }
        }
cleanup:
        ldap_value_free(rdn);
        ldap_value_free(attrs);

        return (value);
}

/*
 * This function requests a server to be removed from
 * the cache manager maintained server list. This is
 * done via the door functionality.
 * Returns 0 if OK, else a negative value.
 */

int
__s_api_removeServer(const char *server)
{
        union {
                ldap_data_t     s_d;
                char            s_b[DOORBUFFERSIZE];
        } space;

        ns_server_info_t                r, *ret = &r;
        const char              *ireq;
        ldap_data_t             *sptr;
        int                     ndata;
        int                     adata;
        int                     len;
        int                     rc;
        ns_ldap_error_t         *error = NULL;

        if (server == NULL)
                return (-1);

        ireq = NS_CACHE_NORESP;

        if (__s_api_isStandalone()) {
                /*
                 * Remove 'server' from the standalone server list.
                 * __s_api_findRootDSE() is the standalone version
                 * of getldap_get_serverInfo() used in ldap_cachemgr.
                 * Request NS_CACHE_NORESP indicates 'server' should
                 * be removed.
                 */
                if (__s_api_findRootDSE(ireq,
                    server,
                    NS_CACHE_ADDR_IP,
                    NULL,
                    &error) != NS_LDAP_SUCCESS) {
                        syslog(LOG_WARNING,
                            "libsldap (\"standalone\" mode): "
                            " Unable to remove %s - %s",
                            server,
                            error != NULL && error->message != NULL ?
                            error->message : " no error info");
                        if (error != NULL) {
                                (void) __ns_ldap_freeError(&error);
                        }

                        return (NS_CACHE_NOSERVER);
                }

                return (0);
        }

        (void) memset(ret, 0, sizeof (ns_server_info_t));
        (void) memset(space.s_b, 0, DOORBUFFERSIZE);

        adata = (sizeof (ldap_call_t) + strlen(ireq) +
            strlen(NS_CACHE_ADDR_IP) + 1);
        adata += strlen(DOORLINESEP) + 1;
        adata += strlen(server) + 1;

        ndata = sizeof (space);
        space.s_d.ldap_call.ldap_callnumber = GETLDAPSERVER;
        len = sizeof (space) - sizeof (space.s_d.ldap_call.ldap_callnumber);
        if (strlcpy(space.s_d.ldap_call.ldap_u.domainname, ireq, len) >= len)
                return (-1);
        if (strlcat(space.s_d.ldap_call.ldap_u.domainname,
            NS_CACHE_ADDR_IP, len) >= len)
                return (-1);
        if (strlcat(space.s_d.ldap_call.ldap_u.domainname, DOORLINESEP, len) >=
            len)
                return (-1);
        if (strlcat(space.s_d.ldap_call.ldap_u.domainname, server, len) >= len)
                return (-1);
        sptr = &space.s_d;

        /* try to remove the server via the door interface */
        rc = __ns_ldap_trydoorcall(&sptr, &ndata, &adata);

        /* clean up the door call */
        if (sptr != &space.s_d) {
                (void) munmap((char *)sptr, ndata);
        }

        return (rc);
}

void
__s_api_free_server_info(ns_server_info_t *sinfo) {
        if (sinfo->server) {
                free(sinfo->server);
                sinfo->server = NULL;
        }
        if (sinfo->serverFQDN) {
                free(sinfo->serverFQDN);
                sinfo->serverFQDN = NULL;
        }
        __s_api_free2dArray(sinfo->saslMechanisms);
        sinfo->saslMechanisms = NULL;
        __s_api_free2dArray(sinfo->controls);
        sinfo->controls = NULL;
}

/*
 * Create an ns_ldap_error structure, set status to 'rc',
 * and copy in the error message 'msg'.
 */
ns_ldap_error_t *
__s_api_make_error(int rc, char *msg) {
        ns_ldap_error_t *ep;

        ep = (ns_ldap_error_t *)calloc(1, sizeof (*ep));
        if (ep == NULL)
                return (NULL);

        ep->status = rc;
        if (msg != NULL)
                ep->message =  strdup(msg); /* OK if ep->message is NULL */

        return (ep);
}

/*
 * Make a copy of the input ns_ldap_error.
 */
ns_ldap_error_t *
__s_api_copy_error(ns_ldap_error_t *errorp) {
        ns_ldap_error_t *ep;
        char            *msg;

        if (errorp == NULL)
                return (NULL);

        ep = (ns_ldap_error_t *)malloc(sizeof (*ep));
        if (ep != NULL) {
                *ep = *errorp;
                if (ep->message != NULL) {
                        msg = strdup(ep->message);
                        if (msg == NULL) {
                                free(ep);
                                ep = NULL;
                        } else
                                ep->message = msg;
                }
        }
        return (ep);
}