1cb5caa98Sdjl /*
2cb5caa98Sdjl  * CDDL HEADER START
3cb5caa98Sdjl  *
4cb5caa98Sdjl  * The contents of this file are subject to the terms of the
5cb5caa98Sdjl  * Common Development and Distribution License (the "License").
6cb5caa98Sdjl  * You may not use this file except in compliance with the License.
7cb5caa98Sdjl  *
8cb5caa98Sdjl  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9cb5caa98Sdjl  * or http://www.opensolaris.org/os/licensing.
10cb5caa98Sdjl  * See the License for the specific language governing permissions
11cb5caa98Sdjl  * and limitations under the License.
12cb5caa98Sdjl  *
13cb5caa98Sdjl  * When distributing Covered Code, include this CDDL HEADER in each
14cb5caa98Sdjl  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15cb5caa98Sdjl  * If applicable, add the following below this CDDL HEADER, with the
16cb5caa98Sdjl  * fields enclosed by brackets "[]" replaced with your own identifying
17cb5caa98Sdjl  * information: Portions Copyright [yyyy] [name of copyright owner]
18cb5caa98Sdjl  *
19cb5caa98Sdjl  * CDDL HEADER END
20cb5caa98Sdjl  */
21*442384bbSJulian Pullen 
22cb5caa98Sdjl /*
23*442384bbSJulian Pullen  * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
24cb5caa98Sdjl  */
26cb5caa98Sdjl #include <stdio.h>
27cb5caa98Sdjl #include <stdlib.h>
28cb5caa98Sdjl #include <strings.h>
29cb5caa98Sdjl #include <sys/types.h>
30cb5caa98Sdjl #include <sys/stat.h>
31cb5caa98Sdjl #include <unistd.h>
32cb5caa98Sdjl #include <thread.h>
33cb5caa98Sdjl #include <synch.h>
34cb5caa98Sdjl #include <sasl/sasl.h>
35cb5caa98Sdjl #include <sys/socket.h>
36cb5caa98Sdjl #include <netdb.h>
37cb5caa98Sdjl #include <netinet/in.h>
38cb5caa98Sdjl #include <arpa/inet.h>
39cb5caa98Sdjl #include <syslog.h>
40cb5caa98Sdjl #include <ctype.h>
41cb5caa98Sdjl #include <libscf.h>
42cb5caa98Sdjl #include <libintl.h>
43cb5caa98Sdjl #include <locale.h>
44cb5caa98Sdjl #include "ns_sldap.h"
45cb5caa98Sdjl #include "ns_internal.h"
47cb5caa98Sdjl static int self_gssapi_only = 0;
48cb5caa98Sdjl static mutex_t self_gssapi_only_lock = DEFAULTMUTEX;
50cb5caa98Sdjl #define	DNS_FMRI	"svc:/network/dns/client:default"
51cb5caa98Sdjl #define	MSGSIZE		256
53cb5caa98Sdjl #define	NSSWITCH_CONF	"/etc/nsswitch.conf"
55cb5caa98Sdjl /*
56cb5caa98Sdjl  * Error Handling
57cb5caa98Sdjl  */
58cb5caa98Sdjl #define	CLIENT_FPRINTF if (mode_verbose && !mode_quiet) (void) fprintf
60cb5caa98Sdjl /*
61cb5caa98Sdjl  * nscd calls this function to set self_gssapi_only flag so libsldap performs
62cb5caa98Sdjl  * sasl/GSSAPI bind only. Also see comments of __ns_ldap_self_gssapi_config.
63cb5caa98Sdjl  *
64cb5caa98Sdjl  * Input: flag 0 use any kind of connection
65cb5caa98Sdjl  *             1 use self/gssapi connection only
66cb5caa98Sdjl  */
67cb5caa98Sdjl void
__ns_ldap_self_gssapi_only_set(int flag)68cb5caa98Sdjl __ns_ldap_self_gssapi_only_set(int flag) {
69cb5caa98Sdjl 	(void) mutex_lock(&self_gssapi_only_lock);
70cb5caa98Sdjl 	self_gssapi_only = flag;
71cb5caa98Sdjl 	(void) mutex_unlock(&self_gssapi_only_lock);
72cb5caa98Sdjl }
73*442384bbSJulian Pullen 
74cb5caa98Sdjl /*
75cb5caa98Sdjl  * Get the flag value of self_gssapi_only
76cb5caa98Sdjl  */
77cb5caa98Sdjl int
__s_api_self_gssapi_only_get(void)78cb5caa98Sdjl __s_api_self_gssapi_only_get(void) {
79cb5caa98Sdjl 	int flag;
80cb5caa98Sdjl 	(void) mutex_lock(&self_gssapi_only_lock);
81cb5caa98Sdjl 	flag = self_gssapi_only;
82cb5caa98Sdjl 	(void) mutex_unlock(&self_gssapi_only_lock);
83cb5caa98Sdjl 	return (flag);
84cb5caa98Sdjl }
85*442384bbSJulian Pullen 
86cb5caa98Sdjl /*
87cb5caa98Sdjl  * nscd calls this function to detect the current native ldap configuration.
88cb5caa98Sdjl  * The output are
89cb5caa98Sdjl  * NS_LDAP_SELF_GSSAPI_CONFIG_NONE: No credential level self and
90cb5caa98Sdjl  *                                  no authentication method sasl/GSSAPI is
91cb5caa98Sdjl  *                                  configured.
92cb5caa98Sdjl  * NS_LDAP_SELF_GSSAPI_CONFIG_ONLY: Only credential level self and
93cb5caa98Sdjl  *                                  authentication method sasl/GSSAPI are
94cb5caa98Sdjl  *                                  configured.
95cb5caa98Sdjl  * NS_LDAP_SELF_GSSAPI_CONFIG_MIXED: More than one credential level are
96cb5caa98Sdjl  *                                   configured, including self.
97cb5caa98Sdjl  *                                   More than one authentication method
98cb5caa98Sdjl  *                                   are configured, including sasl/GSSAPI.
99cb5caa98Sdjl  *
100cb5caa98Sdjl  * __s_api_crosscheck makes sure self and sasl/GSSAPI pair up if they do
101cb5caa98Sdjl  * get configured.
102cb5caa98Sdjl  *
103cb5caa98Sdjl  * When nscd detects it's MIXED case, it calls __ns_ldap_self_gssapi_only_set
104cb5caa98Sdjl  * to force libsldap to do sasl/GSSAPI bind only for per-user lookup.
105cb5caa98Sdjl  *
106cb5caa98Sdjl  * Return: NS_LDAP_SUCCESS
107cb5caa98Sdjl  *         OTHERWISE - FAILURE
108cb5caa98Sdjl  *
109cb5caa98Sdjl  * Output: config. See comments above.
110cb5caa98Sdjl  *
111cb5caa98Sdjl  */
112cb5caa98Sdjl int
__ns_ldap_self_gssapi_config(ns_ldap_self_gssapi_config_t * config)113cb5caa98Sdjl __ns_ldap_self_gssapi_config(ns_ldap_self_gssapi_config_t *config) {
114cb5caa98Sdjl 	int	self = 0, other_level = 0, gssapi = 0, other_method = 0;
115cb5caa98Sdjl 	ns_auth_t	**aMethod = NULL, **aNext = NULL;
116cb5caa98Sdjl 	int		**cLevel = NULL, **cNext = NULL, rc;
117cb5caa98Sdjl 	ns_ldap_error_t	*errp = NULL;
1182e78cb0eSchinlong 	FILE		*fp;
120cb5caa98Sdjl 	if (config == NULL)
121cb5caa98Sdjl 		return (NS_LDAP_INVALID_PARAM);
122cb5caa98Sdjl 	else
123cb5caa98Sdjl 		*config = NS_LDAP_SELF_GSSAPI_CONFIG_NONE;
1252e78cb0eSchinlong 	/*
1262e78cb0eSchinlong 	 * If config files don't exist, return NS_LDAP_CONFIG.
1272e78cb0eSchinlong 	 * It's the same return code __ns_ldap_getParam
1282e78cb0eSchinlong 	 * returns in the same situation.
1292e78cb0eSchinlong 	 */
1302e78cb0eSchinlong 	if ((fp = fopen(NSCONFIGFILE, "rF")) == NULL)
1312e78cb0eSchinlong 		return (NS_LDAP_CONFIG);
1322e78cb0eSchinlong 	else
1332e78cb0eSchinlong 		(void) fclose(fp);
1342e78cb0eSchinlong 	if ((fp = fopen(NSCREDFILE, "rF")) == NULL)
1352e78cb0eSchinlong 		return (NS_LDAP_CONFIG);
1362e78cb0eSchinlong 	else
1372e78cb0eSchinlong 		(void) fclose(fp);
139cb5caa98Sdjl 	/* Get the credential level list */
140cb5caa98Sdjl 	if ((rc = __ns_ldap_getParam(NS_LDAP_CREDENTIAL_LEVEL_P,
141cb5caa98Sdjl 		(void ***)&cLevel, &errp)) != NS_LDAP_SUCCESS) {
142cb5caa98Sdjl 		if (errp)
143cb5caa98Sdjl 			(void) __ns_ldap_freeError(&errp);
144cb5caa98Sdjl 		if (cLevel)
145cb5caa98Sdjl 			(void) __ns_ldap_freeParam((void ***)&cLevel);
146cb5caa98Sdjl 		return (rc);
147cb5caa98Sdjl 	}
148cb5caa98Sdjl 	if (errp)
149cb5caa98Sdjl 		(void) __ns_ldap_freeError(&errp);
150cb5caa98Sdjl 	/* Get the authentication method list */
151cb5caa98Sdjl 	if ((rc = __ns_ldap_getParam(NS_LDAP_AUTH_P,
152cb5caa98Sdjl 		(void ***)&aMethod, &errp)) != NS_LDAP_SUCCESS) {
153cb5caa98Sdjl 		if (errp)
154cb5caa98Sdjl 			(void) __ns_ldap_freeError(&errp);
155cb5caa98Sdjl 		if (cLevel)
156cb5caa98Sdjl 			(void) __ns_ldap_freeParam((void ***)&cLevel);
157cb5caa98Sdjl 		if (aMethod)
158cb5caa98Sdjl 			(void) __ns_ldap_freeParam((void ***)&aMethod);
159cb5caa98Sdjl 		return (rc);
160cb5caa98Sdjl 	}
161cb5caa98Sdjl 	if (errp)
162cb5caa98Sdjl 		(void) __ns_ldap_freeError(&errp);
164cb5caa98Sdjl 	if (cLevel == NULL || aMethod == NULL) {
165cb5caa98Sdjl 		if (cLevel)
166cb5caa98Sdjl 			(void) __ns_ldap_freeParam((void ***)&cLevel);
167cb5caa98Sdjl 		if (aMethod)
168cb5caa98Sdjl 			(void) __ns_ldap_freeParam((void ***)&aMethod);
169cb5caa98Sdjl 		return (NS_LDAP_SUCCESS);
170cb5caa98Sdjl 	}
172cb5caa98Sdjl 	for (cNext = cLevel; *cNext != NULL; cNext++) {
173cb5caa98Sdjl 		if (**cNext == NS_LDAP_CRED_SELF)
174cb5caa98Sdjl 			self++;
175cb5caa98Sdjl 		else
176cb5caa98Sdjl 			other_level++;
177cb5caa98Sdjl 	}
178cb5caa98Sdjl 	for (aNext = aMethod; *aNext != NULL; aNext++) {
179cb5caa98Sdjl 		if ((*aNext)->saslmech == NS_LDAP_SASL_GSSAPI)
180cb5caa98Sdjl 			gssapi++;
181cb5caa98Sdjl 		else
182cb5caa98Sdjl 			other_method++;
183cb5caa98Sdjl 	}
185cb5caa98Sdjl 	if (self > 0 && gssapi > 0) {
186cb5caa98Sdjl 		if (other_level == 0 && other_method == 0)
187cb5caa98Sdjl 			*config = NS_LDAP_SELF_GSSAPI_CONFIG_ONLY;
188cb5caa98Sdjl 		else
189cb5caa98Sdjl 			*config = NS_LDAP_SELF_GSSAPI_CONFIG_MIXED;
190cb5caa98Sdjl 	}
192cb5caa98Sdjl 	if (cLevel)
193cb5caa98Sdjl 		(void) __ns_ldap_freeParam((void ***)&cLevel);
194cb5caa98Sdjl 	if (aMethod)
195cb5caa98Sdjl 		(void) __ns_ldap_freeParam((void ***)&aMethod);
196cb5caa98Sdjl 	return (NS_LDAP_SUCCESS);
197cb5caa98Sdjl }
199cb5caa98Sdjl int
__s_api_sasl_bind_callback(LDAP * ld,unsigned flags,void * defaults,void * in)200cb5caa98Sdjl __s_api_sasl_bind_callback(
201cb5caa98Sdjl 	/* LINTED E_FUNC_ARG_UNUSED */
202cb5caa98Sdjl 	LDAP		*ld,
203cb5caa98Sdjl 	/* LINTED E_FUNC_ARG_UNUSED */
204cb5caa98Sdjl 	unsigned	flags,
205cb5caa98Sdjl 	void		*defaults,
206cb5caa98Sdjl 	void		*in)
207cb5caa98Sdjl {
208cb5caa98Sdjl 	char		*ret = NULL;
209cb5caa98Sdjl 	sasl_interact_t *interact = in;
210cb5caa98Sdjl 	ns_sasl_cb_param_t	*cred = (ns_sasl_cb_param_t *)defaults;
213cb5caa98Sdjl 	while (interact->id != SASL_CB_LIST_END) {
215cb5caa98Sdjl 		switch (interact->id) {
217cb5caa98Sdjl 		case SASL_CB_GETREALM:
218cb5caa98Sdjl 			ret =   cred->realm;
219cb5caa98Sdjl 			break;
220cb5caa98Sdjl 		case SASL_CB_AUTHNAME:
221cb5caa98Sdjl 			ret = cred->authid;
222cb5caa98Sdjl 			break;
223cb5caa98Sdjl 		case SASL_CB_PASS:
224cb5caa98Sdjl 			ret = cred->passwd;
225cb5caa98Sdjl 			break;
226cb5caa98Sdjl 		case SASL_CB_USER:
227cb5caa98Sdjl 			ret = cred->authzid;
228cb5caa98Sdjl 			break;
229cb5caa98Sdjl 		case SASL_CB_NOECHOPROMPT:
230cb5caa98Sdjl 		case SASL_CB_ECHOPROMPT:
231cb5caa98Sdjl 		default:
232cb5caa98Sdjl 			break;
233cb5caa98Sdjl 		}
235cb5caa98Sdjl 		if (ret) {
236e84b06c3SMichen Chang 			/*
237e84b06c3SMichen Chang 			 * No need to do strdup(ret), the data is always
238e84b06c3SMichen Chang 			 * available in 'defaults' and libldap won't
239e84b06c3SMichen Chang 			 * free it either. strdup(ret) causes memory
240e84b06c3SMichen Chang 			 * leak.
241e84b06c3SMichen Chang 			 */
242e84b06c3SMichen Chang 			interact->result = ret;
243cb5caa98Sdjl 			interact->len = strlen(ret);
244cb5caa98Sdjl 		} else {
245cb5caa98Sdjl 			interact->result = NULL;
246cb5caa98Sdjl 			interact->len = 0;
247cb5caa98Sdjl 		}
248cb5caa98Sdjl 		interact++;
249cb5caa98Sdjl 	}
251cb5caa98Sdjl 	return (LDAP_SUCCESS);
252cb5caa98Sdjl }
254cb5caa98Sdjl /*
255cb5caa98Sdjl  * Find "dbase: service1 [...] services2" in fname and return
256cb5caa98Sdjl  * " service1 [...] services2"
257cb5caa98Sdjl  * e.g.
258cb5caa98Sdjl  * Find "hosts: files dns" and return " files dns"
259cb5caa98Sdjl  */
260cb5caa98Sdjl static char *
__ns_nsw_getconfig(const char * dbase,const char * fname,int * errp)261cb5caa98Sdjl __ns_nsw_getconfig(const char *dbase, const char *fname, int *errp)
262cb5caa98Sdjl {
263cb5caa98Sdjl 	FILE *fp = NULL;
264cb5caa98Sdjl 	char *linep, *retp = NULL;
265cb5caa98Sdjl 	char lineq[BUFSIZ], db_colon[BUFSIZ];
267cb5caa98Sdjl 	if ((fp = fopen(fname, "rF")) == NULL) {
268cb5caa98Sdjl 		*errp = NS_LDAP_CONFIG;
269cb5caa98Sdjl 		return (NULL);
270cb5caa98Sdjl 	}
271cb5caa98Sdjl 	*errp = NS_LDAP_SUCCESS;
273cb5caa98Sdjl 	while (linep = fgets(lineq, BUFSIZ, fp)) {
274cb5caa98Sdjl 		char			*tokenp, *comment;
276cb5caa98Sdjl 		/*
277cb5caa98Sdjl 		 * Ignore portion of line following the comment character '#'.
278cb5caa98Sdjl 		 */
279cb5caa98Sdjl 		if ((comment = strchr(linep, '#')) != NULL) {
280cb5caa98Sdjl 			*comment = '\0';
281cb5caa98Sdjl 		}
282cb5caa98Sdjl 		if ((*linep == '\0') || isspace(*linep)) {
283cb5caa98Sdjl 			continue;
284cb5caa98Sdjl 		}
285cb5caa98Sdjl 		(void) snprintf(db_colon, BUFSIZ, "%s:", dbase);
286cb5caa98Sdjl 		if ((tokenp = strstr(linep, db_colon)) == NULL) {
287cb5caa98Sdjl 			continue; /* ignore this line */
288cb5caa98Sdjl 		} else {
289cb5caa98Sdjl 			/* skip "dbase:" */
290cb5caa98Sdjl 			retp = strdup(tokenp + strlen(db_colon));
291cb5caa98Sdjl 			if (retp == NULL)
292cb5caa98Sdjl 				*errp = NS_LDAP_MEMORY;
293cb5caa98Sdjl 		}
294cb5caa98Sdjl 	}
296cb5caa98Sdjl 	(void) fclose(fp);
297cb5caa98Sdjl 	return (retp);
298cb5caa98Sdjl }
299cb5caa98Sdjl /*
300cb5caa98Sdjl  *  Test the configurations of the "hosts" and "ipnodes"
301cb5caa98Sdjl  *  dns has to be present and appear before ldap
302cb5caa98Sdjl  *  e.g.
303cb5caa98Sdjl  *  "dns" , "dns files" "dns ldap files", "files dns" are allowed.
304cb5caa98Sdjl  *
305cb5caa98Sdjl  *  Kerberos requires dns or it'd fail.
306cb5caa98Sdjl  */
307cb5caa98Sdjl static int
test_dns_nsswitch(int foreground,const char * fname,ns_ldap_error_t ** errpp)308cb5caa98Sdjl test_dns_nsswitch(int foreground,
309cb5caa98Sdjl 		const char *fname,
310cb5caa98Sdjl 		ns_ldap_error_t **errpp) {
311cb5caa98Sdjl 	int	ldap, dns, i, pserr, rc = NS_LDAP_SUCCESS;
312cb5caa98Sdjl 	char	*db[3] = {"hosts", "ipnodes", NULL};
313cb5caa98Sdjl 	char	buf[MSGSIZE], *conf = NULL, *token = NULL, *last = NULL;
315cb5caa98Sdjl 	for (i = 0; db[i] != NULL; i++) {
316cb5caa98Sdjl 		conf = __ns_nsw_getconfig(db[i], fname, &pserr);
318cb5caa98Sdjl 		if (conf == NULL) {
319cb5caa98Sdjl 			(void) snprintf(buf, MSGSIZE,
320cb5caa98Sdjl 				gettext("Parsing %s to find \"%s:\" "
321cb5caa98Sdjl 					"failed. err: %d"),
322cb5caa98Sdjl 					fname, db[i], pserr);
323cb5caa98Sdjl 			if (foreground) {
324cb5caa98Sdjl 				(void) fprintf(stderr, "%s\n", buf);
325cb5caa98Sdjl 			} else {
326cb5caa98Sdjl 				MKERROR(LOG_ERR, *errpp, NS_LDAP_CONFIG,
327cb5caa98Sdjl 					strdup(buf), NS_LDAP_MEMORY);
328cb5caa98Sdjl 			}
329cb5caa98Sdjl 			return (pserr);
330cb5caa98Sdjl 		}
331cb5caa98Sdjl 		ldap = dns = 0;
332cb5caa98Sdjl 		token = strtok_r(conf, " ", &last);
333cb5caa98Sdjl 		while (token != NULL) {
334cb5caa98Sdjl 			if (strncmp(token, "dns", 3) == 0) {
335cb5caa98Sdjl 				if (ldap) {
336cb5caa98Sdjl 					(void) snprintf(buf, MSGSIZE,
337cb5caa98Sdjl 						gettext("%s: ldap can't appear "
338cb5caa98Sdjl 						"before dns"), db[i]);
339cb5caa98Sdjl 					if (foreground) {
340cb5caa98Sdjl 						(void) fprintf(stderr,
341cb5caa98Sdjl 								"start: %s\n",
342cb5caa98Sdjl 								buf);
343cb5caa98Sdjl 					} else {
344cb5caa98Sdjl 						MKERROR(LOG_ERR, *errpp,
345cb5caa98Sdjl 							NS_LDAP_CONFIG,
346cb5caa98Sdjl 							strdup(buf),
347cb5caa98Sdjl 							NS_LDAP_MEMORY);
348cb5caa98Sdjl 					}
349cb5caa98Sdjl 					free(conf);
350cb5caa98Sdjl 					return (NS_LDAP_CONFIG);
351cb5caa98Sdjl 				} else {
352cb5caa98Sdjl 					dns++;
353cb5caa98Sdjl 				}
354cb5caa98Sdjl 			} else if (strncmp(token, "ldap", 4) == 0) {
355cb5caa98Sdjl 				ldap++;
356cb5caa98Sdjl 			}
357cb5caa98Sdjl 			/* next token */
358cb5caa98Sdjl 			token = strtok_r(NULL, " ", &last);
359cb5caa98Sdjl 		}
360cb5caa98Sdjl 		if (conf) {
361cb5caa98Sdjl 			free(conf);
362cb5caa98Sdjl 			conf = NULL;
363cb5caa98Sdjl 		}
364cb5caa98Sdjl 		if (!dns) {
365cb5caa98Sdjl 			(void) snprintf(buf, MSGSIZE,
366cb5caa98Sdjl 				gettext("%s: dns is not defined in "
367cb5caa98Sdjl 				"%s"), db[i], fname);
368cb5caa98Sdjl 			if (foreground) {
369cb5caa98Sdjl 				(void) fprintf(stderr, "start: %s\n", buf);
370cb5caa98Sdjl 			} else {
371cb5caa98Sdjl 				MKERROR(LOG_ERR, *errpp, NS_LDAP_CONFIG,
372cb5caa98Sdjl 					strdup(buf), NS_LDAP_MEMORY);
373cb5caa98Sdjl 			}
374cb5caa98Sdjl 			rc = NS_LDAP_CONFIG;
375cb5caa98Sdjl 			break;
376cb5caa98Sdjl 		}
377cb5caa98Sdjl 	}
378cb5caa98Sdjl 	return (rc);
379cb5caa98Sdjl }
381cb5caa98Sdjl static boolean_t
is_service(const char * fmri,const char * state)382cb5caa98Sdjl is_service(const char *fmri, const char *state) {
383cb5caa98Sdjl 	char		*st;
384cb5caa98Sdjl 	boolean_t	result = B_FALSE;
386cb5caa98Sdjl 	if ((st = smf_get_state(fmri)) != NULL) {
387cb5caa98Sdjl 		if (strcmp(st, state) == 0)
388cb5caa98Sdjl 			result = B_TRUE;
389cb5caa98Sdjl 		free(st);
390cb5caa98Sdjl 	}
391cb5caa98Sdjl 	return (result);
392cb5caa98Sdjl }
395cb5caa98Sdjl /*
396cb5caa98Sdjl  * This function checks dns prerequisites for sasl/GSSAPI bind.
397cb5caa98Sdjl  * It's called only if config == NS_LDAP_SELF_GSSAPI_CONFIG_ONLY ||
398cb5caa98Sdjl  *   config == NS_LDAP_SELF_GSSAPI_CONFIG_MIXED.
399cb5caa98Sdjl  */
400cb5caa98Sdjl int
__ns_ldap_check_dns_preq(int foreground,int mode_verbose,int mode_quiet,const char * fname,ns_ldap_self_gssapi_config_t config,ns_ldap_error_t ** errpp)401cb5caa98Sdjl __ns_ldap_check_dns_preq(int foreground,
402cb5caa98Sdjl 		int mode_verbose,
403cb5caa98Sdjl 		int mode_quiet,
404cb5caa98Sdjl 		const char *fname,
405cb5caa98Sdjl 		ns_ldap_self_gssapi_config_t config,
406cb5caa98Sdjl 		ns_ldap_error_t **errpp) {
408cb5caa98Sdjl 	char	buf[MSGSIZE];
409cb5caa98Sdjl 	int	retcode = NS_LDAP_SUCCESS;
410cb5caa98Sdjl 	int	loglevel;