1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  * Copyright 2012 Milan Jurik. All rights reserved.
25  * Copyright (c) 2016 by Delphix. All rights reserved.
26  */
27 
28 /*
29  * ldapclient command. To make (initiailize) or uninitialize a machines as
30  * and LDAP client.  This command MUST be run as root (or it will simply exit).
31  *
32  *	-I	Install. No file_backup/recover for installing only (no doc).
33  *
34  *	init	Initialze (create) an LDAP client from a profile stored
35  *		in a directory-server.
36  *	manual	Initialze (create) an LDAP client by hand (-file option
37  *		reads from file).
38  *	mod	Modify the LDAP client configuration on this machine by hand.
39  *	list	List the contents of the LDAP client cache files.
40  *	uninit	Uninitialize this machine.
41  *
42  *	-v	Verbose flag.
43  *	-q	Quiet flag (mutually exclusive with -v).
44  *
45  *	-a attrName=attrVal
46  *	<attrName> can be one of the following:
47  *
48  *	attributeMap
49  *		Attribute map.  Can be multiple instances of this option.
50  *		(no former option)
51  *	authenticationMethod
52  *		Authentication method (formerly -a)
53  *	bindTimeLimit
54  *		Bind time limit. (no former option)
55  *	certificatePath
56  *		Path to certificates used for secure bind (no former option)
57  *	credentialLevel
58  *		Client credential level (no former option)
59  *	defaultServerList
60  *		Default server (no former option) Refer to DUA Config
61  *		Schema draft.
62  *	defaultSearchBase
63  *		Search Base DN. e.g. dc=eng,dc=sun,dc=com (formerly -b)
64  *	defaultSearchScope
65  *		Search scope. (formerly -s)
66  *	domainName
67  *		Hosts lookup domain (DNS)  Ex. eng.sun.com (formerly -d)
68  *	followReferrals
69  *		Search dereference. followref or noref (default followref)
70  *		(formerly -r)
71  *	objectclassMap
72  *		Objectclass map.  Can be multiple instances of this option.
73  *		(no former option)
74  *	preferredServerList
75  *		Server preference list. Comma ',' seperated list of IPaddr.
76  *		(formerly -p)
77  *	profileName
78  *		Profile name to use for init (ldapclient) or
79  *		generate (gen_profile). (formerly -P)
80  *	profileTTL
81  *		Client info TTL.  If set to 0 this information will not be
82  *		automatically updated by the ldap_cachemgr(1M).
83  *		(formerly -e)
84  *	proxyDN
85  *		Binding DN.  Ex. cn=client,ou=people,cd=eng,dc=sun,dc=com
86  *		(formerly -D)
87  *	proxyPassword
88  *		Client password not needed for authentication "none".
89  *		(formerly -w)
90  *	adminDN
91  *		Administrator DN for updating naming data.
92  *	adminPassword
93  *		Administrator password
94  *	enableShadowUpdate
95  *		Allow Administrator to change shadow data in LDAP
96  *	searchTimeLimit
97  *		Timeout value. (formerly -o)
98  *	serviceSearchDescriptor
99  *		Service search scope. (no former option)
100  *	serviceAuthenticationMethod
101  *		Service authenticaion method (no former option)
102  *	serviceCredentialLevel
103  *		Service credential level (no former option)
104  *
105  */
106 
107 #include <stdlib.h>
108 #include <stdio.h>
109 #include <unistd.h>
110 #include <errno.h>
111 #include <sys/types.h>
112 #include <time.h>
113 #include <sys/param.h>
114 #include <sys/stat.h>
115 #include <sys/systeminfo.h>
116 #include <fcntl.h>
117 #include <xti.h>
118 #include <strings.h>
119 #include <limits.h>
120 #include <locale.h>
121 #include <syslog.h>
122 #include <libscf.h>
123 #include <assert.h>
124 
125 #include "standalone.h"
126 
127 #if !defined(TEXT_DOMAIN)
128 #define	TEXT_DOMAIN "SUNW_OST_OSCMD"
129 #endif
130 
131 /* error codes */
132 /* The manpage doc only allows for SUCCESS(0), FAIL(1) and CRED(2) on exit */
133 #define	CLIENT_SUCCESS		0
134 #define	CLIENT_ERR_PARSE	-1
135 #define	CLIENT_ERR_FAIL		1
136 #define	CLIENT_ERR_CREDENTIAL	2
137 #define	CLIENT_ERR_MEMORY	3
138 #define	CLIENT_ERR_RESTORE	4
139 #define	CLIENT_ERR_RENAME	5
140 #define	CLIENT_ERR_RECOVER	6
141 #define	CLIENT_ERR_TIMEDOUT	7
142 #define	CLIENT_ERR_MAINTENANCE	8
143 
144 /* Reset flag for start_services() */
145 #define	START_INIT	1
146 #define	START_RESET	2
147 #define	START_UNINIT	3
148 
149 /* Reset flag for stop_services() */
150 #define	STATE_NOSAVE	0
151 #define	STATE_SAVE	1
152 
153 /* files to (possibiliy) restore */
154 #define	LDAP_RESTORE_DIR	"/var/ldap/restore"
155 
156 #define	DOMAINNAME_DIR		"/etc"
157 #define	DOMAINNAME_FILE		"defaultdomain"
158 #define	DOMAINNAME		DOMAINNAME_DIR "/" DOMAINNAME_FILE
159 #define	DOMAINNAME_BACK		LDAP_RESTORE_DIR "/" DOMAINNAME_FILE
160 
161 #define	NSSWITCH_DIR		"/etc"
162 #define	NSSWITCH_FILE		"nsswitch.conf"
163 #define	NSSWITCH_CONF		NSSWITCH_DIR "/" NSSWITCH_FILE
164 #define	NSSWITCH_BACK		LDAP_RESTORE_DIR "/" NSSWITCH_FILE
165 #define	NSSWITCH_LDAP		"/etc/nsswitch.ldap"
166 
167 #define	YP_BIND_DIR		"/var/yp/binding"
168 
169 /* Define the service FMRIs */
170 #define	SENDMAIL_FMRI		"network/smtp:sendmail"
171 #define	NSCD_FMRI		"system/name-service-cache:default"
172 #define	AUTOFS_FMRI		"system/filesystem/autofs:default"
173 #define	LDAP_FMRI		"network/ldap/client:default"
174 #define	YP_FMRI			"network/nis/client:default"
175 #define	NS_MILESTONE_FMRI	"milestone/name-services:default"
176 
177 /* Define flags for checking if services were enabled */
178 #define	SENDMAIL_ON	0x1
179 #define	NSCD_ON		0x10
180 #define	AUTOFS_ON	0x100
181 
182 #define	CMD_DOMAIN_START	"/usr/bin/domainname"
183 
184 /* Command to copy files */
185 #define	CMD_CP			"/bin/cp -f"
186 #define	CMD_MV			"/bin/mv -f"
187 #define	CMD_RM			"/bin/rm -f"
188 
189 #define	TO_DEV_NULL		" >/dev/null 2>&1"
190 
191 /* Files that need to be just removed */
192 #define	LDAP_CACHE_LOG		"/var/ldap/cachemgr.log"
193 
194 /* Output defines to supress if quiet mode set */
195 #define	CLIENT_FPUTS if (!mode_quiet) (void) fputs
196 #define	CLIENT_FPRINTF if (!mode_quiet) (void) fprintf
197 #define	CLIENT_FPUTC if (!mode_quiet) (void) fputc
198 
199 #define	restart_service(fmri, waitflag)\
200 		do_service(fmri, waitflag, RESTART_SERVICE,\
201 		SCF_STATE_STRING_ONLINE)
202 #define	start_service(fmri, waitflag)	\
203 		do_service(fmri, waitflag, START_SERVICE,\
204 		SCF_STATE_STRING_ONLINE)
205 #define	disable_service(fmri, waitflag)	\
206 		do_service(fmri, waitflag, STOP_SERVICE,\
207 		SCF_STATE_STRING_DISABLED)
208 
209 /*
210  * There isn't a domainName defined as a param, so we set a value here
211  * (1001) should be big enough
212  */
213 #define	LOCAL_DOMAIN_P 1001
214 
215 #define	START_SERVICE	1
216 #define	STOP_SERVICE	2
217 #define	RESTART_SERVICE	3
218 
219 #define	DEFAULT_TIMEOUT	60000000
220 
221 #define	INIT_WAIT_USECS	50000
222 
223 /* Used to turn off profile checking */
224 #define	CACHETTL_OFF "0"
225 
226 /* Globals */
227 static char *cmd;
228 
229 static char *dname = NULL;
230 static char dname_buf[BUFSIZ];
231 
232 static boolean_t sysid_install = B_FALSE;
233 
234 static int mode_verbose = 0;
235 static int mode_quiet = 0;
236 static int gen = 0;
237 
238 static int gStartLdap = 0;
239 static int gStartYp = 0;
240 
241 static int enableFlag = 0;
242 
243 /* multival_t is used to hold params that can have more than one value */
244 typedef struct {
245 	int count;
246 	char **optlist;
247 } multival_t;
248 
249 static multival_t *multival_new();
250 static int multival_add(multival_t *list, char *opt);
251 static void multival_free(multival_t *list);
252 
253 /*
254  * clientopts_t is used to hold and pass around the param values from
255  * the cmd line
256  */
257 typedef struct {
258 	multival_t	*attributeMap;
259 	char		*authenticationMethod;
260 	char		*bindTimeLimit;
261 	char		*certificatePath;
262 	char		*credentialLevel;
263 	char		*defaultSearchBase;
264 	char		*defaultServerList;
265 	char		*domainName;
266 	char		*followReferrals;
267 	multival_t	*objectclassMap;
268 	char		*preferredServerList;
269 	char		*profileName;
270 	char		*profileTTL;
271 	char		*proxyDN;
272 	char		*proxyPassword;
273 	char		*enableShadowUpdate;
274 	char		*adminDN;
275 	char		*adminPassword;
276 	char		*bindDN;
277 	char		*bindPasswd;
278 	char		*defaultSearchScope;
279 	char		*searchTimeLimit;
280 	multival_t	*serviceAuthenticationMethod;
281 	multival_t	*serviceCredentialLevel;
282 	multival_t	*serviceSearchDescriptor;
283 } clientopts_t;
284 
285 static clientopts_t *clientopts_new();
286 static void clientopts_free(clientopts_t *list);
287 
288 extern ns_ldap_error_t *__ns_ldap_print_config(int);
289 extern void __ns_ldap_default_config();
290 extern int __ns_ldap_download(const char *, char *, char *, ns_ldap_error_t **);
291 
292 /* Function prototypes (these could be static) */
293 static void usage(void);
294 
295 static int credCheck(clientopts_t *arglist);
296 static int adminCredCheck(clientopts_t *arglist);
297 static int clientSetParam(clientopts_t *optlist, int paramFlag, char *attrVal);
298 static int parseParam(char *param, char **paramVal);
299 static void dumpargs(clientopts_t *arglist);
300 static int num_args(clientopts_t *arglist);
301 
302 static int file_backup(void);
303 static int recover(int saveState);
304 static int mod_backup(void);
305 static int mod_recover(void);
306 static void mod_cleanup(void);
307 
308 static int client_list(clientopts_t *arglist);
309 static int client_manual(clientopts_t *arglist);
310 static int client_mod(clientopts_t *arglist);
311 static int client_uninit(clientopts_t *arglist);
312 static int client_genProfile(clientopts_t *arglist);
313 static int client_init(clientopts_t *arglist);
314 static int file_move(const char *from, const char *to);
315 
316 static int start_services(int flag);
317 static int stop_services(int saveState);
318 static boolean_t is_service(const char *fmri, const char *state);
319 static int wait_till(const char *fmri, const char *state, useconds_t max,
320 		const char *what, boolean_t check_maint);
321 static int do_service(const char *fmri, boolean_t waitflag, int dowhat,
322 		const char *state);
323 static useconds_t get_timeout_value(int dowhat, const char *fmri,
324 		useconds_t default_val);
325 
326 int
327 main(int argc, char **argv)
328 {
329 	char		*ret_locale, *ret_textdomain;
330 	int		retcode;
331 	int		paramFlag;
332 	char		*attrVal;
333 	int		sysinfostatus;
334 	clientopts_t	*optlist = NULL;
335 	int		op_manual = 0, op_mod = 0, op_uninit = 0;
336 	int		op_list = 0, op_init = 0, op_genprofile = 0;
337 	extern char	*optarg;
338 	extern int	optind;
339 	int		option;
340 
341 	ret_locale = setlocale(LC_ALL, "");
342 	if (ret_locale == NULL) {
343 		CLIENT_FPUTS(gettext("Unable to set locale.\n"), stderr);
344 	}
345 	ret_textdomain = textdomain(TEXT_DOMAIN);
346 	if (ret_textdomain == NULL) {
347 		CLIENT_FPUTS(gettext("Unable to set textdomain.\n"), stderr);
348 	}
349 
350 	openlog("ldapclient", LOG_PID, LOG_USER);
351 
352 	/* get name that invoked us */
353 	if (cmd = strrchr(argv[0], '/'))
354 		++cmd;
355 	else
356 		cmd = argv[0];
357 
358 	sysinfostatus = sysinfo(SI_SRPC_DOMAIN, dname_buf, BUFSIZ);
359 	if (0 < sysinfostatus)
360 		dname = &dname_buf[0];
361 
362 	optlist = clientopts_new();
363 	if (optlist == NULL) {
364 		CLIENT_FPUTS(
365 		    gettext("Error getting optlist (malloc fail)\n"),
366 		    stderr);
367 		exit(CLIENT_ERR_FAIL);
368 	}
369 
370 	optind = 1;
371 	while (optind < argc) {
372 		option = getopt(argc, argv, "vqa:ID:w:j:y:z:");
373 
374 		switch (option) {
375 		case 'v':
376 			mode_verbose = 1;
377 			break;
378 		case 'q':
379 			mode_quiet = 1;
380 			break;
381 		case 'a':
382 			attrVal = NULL;
383 			paramFlag = parseParam(optarg, &attrVal);
384 			if (paramFlag == CLIENT_ERR_PARSE) {
385 				CLIENT_FPRINTF(stderr,
386 				    gettext("Unrecognized "
387 				    "parameter \"%s\"\n"),
388 				    optarg);
389 				usage();
390 				exit(CLIENT_ERR_FAIL);
391 			}
392 			if (paramFlag == NS_LDAP_BINDPASSWD_P &&
393 			    optlist->proxyPassword != NULL) {
394 				(void) fprintf(stderr,
395 				    gettext("The -a proxyPassword option is "
396 				    "mutually exclusive of -y. "
397 				    "-a proxyPassword is ignored.\n"));
398 				break;
399 			}
400 			if (paramFlag == NS_LDAP_ADMIN_BINDPASSWD_P &&
401 			    optlist->adminPassword != NULL) {
402 				(void) fprintf(stderr,
403 				    gettext("The -a adminPassword option is "
404 				    "mutually exclusive of -z. "
405 				    "-a adminPassword is ignored.\n"));
406 				break;
407 			}
408 			retcode = clientSetParam(optlist, paramFlag, attrVal);
409 			if (retcode != CLIENT_SUCCESS) {
410 				CLIENT_FPRINTF(
411 				    stderr,
412 				    gettext("Error (%d) setting "
413 				    "param \"%s\"\n"),
414 				    retcode, optarg);
415 				usage();
416 				exit(CLIENT_ERR_FAIL);
417 			}
418 			break;
419 		case 'D':
420 			optlist->bindDN = strdup(optarg);
421 			break;
422 		case 'w':
423 			if (optlist->bindPasswd != NULL) {
424 				CLIENT_FPRINTF(stderr,
425 				    gettext("The -w option is mutually "
426 				    "exclusive of -j. -w is ignored."));
427 				break;
428 			}
429 
430 			if (optarg[0] == '-' && optarg[1] == '\0') {
431 				/* Ask for a password later */
432 				break;
433 			}
434 
435 			optlist->bindPasswd = strdup(optarg);
436 			break;
437 		case 'j':
438 			if (optlist->bindPasswd != NULL) {
439 				(void) fprintf(stderr,
440 				    gettext("The -w option is mutually "
441 				    "exclusive of -j. -w is ignored.\n"));
442 				free(optlist->bindPasswd);
443 			}
444 			optlist->bindPasswd = readPwd(optarg);
445 			if (optlist->bindPasswd == NULL) {
446 				exit(CLIENT_ERR_FAIL);
447 			}
448 			break;
449 		case 'y':
450 			if (optlist->proxyPassword != NULL) {
451 				(void) fprintf(stderr,
452 				    gettext("The -a proxyPassword option is "
453 				    "mutually exclusive of -y. "
454 				    "-a proxyPassword is ignored.\n"));
455 			}
456 			optlist->proxyPassword = readPwd(optarg);
457 			if (optlist->proxyPassword == NULL) {
458 				exit(CLIENT_ERR_FAIL);
459 			}
460 			break;
461 		case 'z':
462 			if (optlist->adminPassword != NULL) {
463 				(void) fprintf(stderr,
464 				    gettext("The -a adminPassword option is "
465 				    "mutually exclusive of -z. "
466 				    "-a adminPassword is ignored.\n"));
467 			}
468 			optlist->adminPassword = readPwd(optarg);
469 			if (optlist->adminPassword == NULL) {
470 				exit(CLIENT_ERR_FAIL);
471 			}
472 			break;
473 		case EOF:
474 			if (strcmp(argv[optind], "init") == 0) {
475 				op_init = 1;
476 			} else if (strcmp(argv[optind], "manual") == 0) {
477 				op_manual = 1;
478 			} else if (strcmp(argv[optind], "mod") == 0) {
479 				op_mod = 1;
480 			} else if (strcmp(argv[optind], "list") == 0) {
481 				op_list = 1;
482 			} else if (strcmp(argv[optind], "uninit") == 0) {
483 				op_uninit = 1;
484 			} else if (strcmp(argv[optind], "genprofile") == 0) {
485 				gen = 1;
486 				op_genprofile = 1;
487 			} else if (optind == argc-1) {
488 				retcode = clientSetParam(
489 				    optlist,
490 				    NS_LDAP_SERVERS_P,
491 				    argv[optind]);	/* ipAddr */
492 				if (retcode != CLIENT_SUCCESS) {
493 					CLIENT_FPRINTF(
494 					    stderr,
495 					    gettext("Error (%d) setting "
496 					    "serverList param.\n"),
497 					    retcode);
498 					usage();
499 					exit(CLIENT_ERR_FAIL);
500 				}
501 			} else {
502 				CLIENT_FPUTS(
503 				    gettext("Error parsing "
504 				    "command line\n"),
505 				    stderr);
506 				usage();
507 				exit(CLIENT_ERR_FAIL);
508 			}
509 			optind++;	/* get past the verb and keep trying */
510 			break;
511 		/* Backwards compatibility to support system install */
512 		case 'I':
513 			sysid_install = B_TRUE;
514 			op_init = 1;
515 			mode_quiet = 1;
516 			break;
517 		case '?':
518 			usage();
519 			CLIENT_FPUTS(gettext("\nOr\n\n"), stderr);
520 			gen = 1;
521 			usage();
522 			exit(CLIENT_ERR_FAIL);
523 			break;
524 		}
525 
526 	}
527 
528 	if ((getuid() != 0) && (!op_genprofile)) {
529 		(void) puts(
530 		    "You must be root (SuperUser) to run this command.");
531 		usage();
532 		exit(CLIENT_ERR_FAIL);
533 	}
534 
535 /*
536  *	All command line arguments are finished being parsed now
537  */
538 
539 /* *** Do semantic checking here *** */
540 
541 /* if gen and no no searchBase then err */
542 	if (gen && !optlist->defaultSearchBase) {
543 		CLIENT_FPUTS(
544 		    gettext("ldapclient: Missing required attrName "
545 		    "defaultSearchBase\n"),
546 		    stderr);
547 		usage();
548 		clientopts_free(optlist);
549 		exit(CLIENT_ERR_FAIL);
550 	}
551 
552 /*
553  * if init or manual, and if adminDN is specified then enableShadowUpdate
554  * must be set to TRUE.
555  */
556 	if ((op_init || op_manual) &&
557 	    (!optlist->enableShadowUpdate ||
558 	    strcasecmp(optlist->enableShadowUpdate, "TRUE") != 0) &&
559 	    (optlist->adminDN || optlist->adminPassword)) {
560 		CLIENT_FPUTS(
561 		    gettext("ldapclient: adminDN and adminPassword must not "
562 		    "be specified if enableShadowUpdate is not set to TRUE \n"),
563 		    stderr);
564 		usage();
565 		clientopts_free(optlist);
566 		exit(CLIENT_ERR_FAIL);
567 	}
568 
569 /* Only one verb can be specified */
570 	if ((op_init + op_manual + op_mod + op_uninit +
571 	    op_list + op_genprofile) != 1) {
572 		usage();
573 		clientopts_free(optlist);
574 		exit(CLIENT_ERR_FAIL);
575 	}
576 
577 /* *** We passed semantic checking, so now do the operation *** */
578 
579 	if (mode_verbose) {
580 		CLIENT_FPUTS(gettext("Arguments parsed:\n"), stderr);
581 		dumpargs(optlist);
582 	}
583 
584 
585 /* handle "ldapclient list" here.  err checking done in func */
586 	if (op_list) {
587 		if (mode_verbose)
588 			CLIENT_FPUTS(
589 			    gettext("Handling list option\n"),
590 			    stderr);
591 		retcode = client_list(optlist);
592 	}
593 
594 /* handle "ldapclient uninit" here */
595 	if (op_uninit) {
596 		if (mode_verbose)
597 			CLIENT_FPUTS(
598 			    gettext("Handling uninit option\n"),
599 			    stderr);
600 		retcode = client_uninit(optlist);
601 	}
602 
603 /* handle "ldapclient init" (profile) */
604 	if (op_init) {
605 		if (mode_verbose)
606 			CLIENT_FPUTS(
607 			    gettext("Handling init option\n"),
608 			    stderr);
609 		retcode = client_init(optlist);
610 	}
611 
612 /* handle "genprofile" here */
613 	if (op_genprofile) {
614 		if (mode_verbose)
615 			CLIENT_FPUTS(
616 			    gettext("Handling genProfile\n"),
617 			    stderr);
618 		retcode = client_genProfile(optlist);
619 	}
620 
621 /* handle "ldapclient manual" here */
622 	if (op_manual) {
623 		if (mode_verbose)
624 			CLIENT_FPUTS(
625 			    gettext("Handling manual option\n"),
626 			    stderr);
627 		retcode = client_manual(optlist);
628 	}
629 
630 /* handle "ldapclient mod" here */
631 	if (op_mod) {
632 		if (mode_verbose)
633 			CLIENT_FPUTS(
634 			    gettext("Handling mod option\n"),
635 			    stderr);
636 		retcode = client_mod(optlist);
637 	}
638 
639 	clientopts_free(optlist);
640 	if ((retcode == CLIENT_SUCCESS) ||
641 	    (retcode == CLIENT_ERR_FAIL) ||
642 	    (retcode == CLIENT_ERR_CREDENTIAL))
643 		return (retcode);
644 	else
645 		return (CLIENT_ERR_FAIL);
646 }
647 
648 static int
649 client_list(clientopts_t *arglist)
650 {
651 	ns_ldap_error_t *errorp;
652 	int retcode = CLIENT_SUCCESS;
653 
654 	if (num_args(arglist) > 0) {
655 		CLIENT_FPUTS(
656 		    gettext("No args supported with \"list\" option\n"),
657 		    stderr);
658 		usage();
659 		return (CLIENT_ERR_FAIL);	/* exit code here ? */
660 	}
661 	if ((errorp = __ns_ldap_print_config(mode_verbose)) != NULL) {
662 		retcode = CLIENT_ERR_FAIL;
663 		CLIENT_FPUTS(
664 		    gettext("Cannot get print configuration\n"),
665 		    stderr);
666 		CLIENT_FPUTS(errorp->message, stderr);
667 		(void) __ns_ldap_freeError(&errorp);
668 		CLIENT_FPUTC('\n', stderr);
669 	}
670 
671 	return (retcode);
672 }
673 
674 static int
675 client_uninit(clientopts_t *arglist)
676 {
677 	int retcode = CLIENT_SUCCESS;
678 	ns_ldap_self_gssapi_config_t config = NS_LDAP_SELF_GSSAPI_CONFIG_NONE;
679 
680 	if (mode_verbose) {
681 		CLIENT_FPUTS(
682 		    gettext("Restoring machine to previous "
683 		    "configuration state\n"),
684 		    stderr);
685 	}
686 
687 	if (num_args(arglist) > 0) {
688 		CLIENT_FPUTS(
689 		    gettext("No args supported with \"uninit\" option\n"),
690 		    stderr);
691 		usage();
692 		return (CLIENT_ERR_FAIL);
693 	}
694 
695 	(void) __ns_ldap_self_gssapi_config(&config);
696 
697 	retcode = stop_services(STATE_SAVE);
698 
699 	if (config != NS_LDAP_SELF_GSSAPI_CONFIG_NONE)
700 		(void) system("/usr/sbin/cryptoadm enable metaslot");
701 
702 	if (retcode != CLIENT_SUCCESS) {
703 		CLIENT_FPUTS(
704 		    gettext("Errors stopping network services.\n"), stderr);
705 		/* restart whatever services we can */
706 		(void) start_services(START_RESET);
707 		return (CLIENT_ERR_FAIL);
708 	}
709 
710 	retcode = recover(STATE_SAVE);
711 	if (retcode != CLIENT_SUCCESS) {
712 		CLIENT_FPUTS(
713 		    gettext("Cannot recover the configuration on "
714 		    "this machine.\n"),
715 		    stderr);
716 		(void) start_services(START_RESET);
717 	} else {
718 		retcode = start_services(START_UNINIT);
719 		if (retcode != CLIENT_SUCCESS) {
720 			CLIENT_FPUTS(
721 			    gettext("Config restored but problems "
722 			    "encountered resetting network "
723 			    "services.\n"),
724 			    stderr);
725 		}
726 	}
727 
728 	if (retcode == CLIENT_SUCCESS) {
729 		CLIENT_FPUTS(
730 		    gettext("System successfully recovered\n"),
731 		    stderr);
732 	}
733 
734 	return (retcode);
735 }
736 
737 /*
738  * The following macro is used to do a __ns_ldap_setParam().
739  * On every call, the return code is checked, and if there was
740  * a problem then the error message is printed, the ldaperr
741  * is freed and we return from the function with the offending
742  * error return code.  This macro keeps us from having to
743  * repeat this code for every call to setParam as was done
744  * in the previous incarnation of ldapclient.
745  *
746  * assumes a "retcode" variable is available for status
747  */
748 #define	LDAP_SET_PARAM(argval, argdef)	\
749 retcode = 0;	\
750 if (NULL != argval) {	\
751 	ns_ldap_error_t *ldaperr;	\
752 	retcode = __ns_ldap_setParam(argdef, (void *)argval, &ldaperr);	\
753 	if (retcode != NS_LDAP_SUCCESS) {	\
754 		if (NULL != ldaperr) {	\
755 			CLIENT_FPUTS(ldaperr->message, stderr);	\
756 			CLIENT_FPUTC('\n', stderr);	\
757 			(void) __ns_ldap_freeError(&ldaperr);	\
758 		}	\
759 		return (retcode ? CLIENT_ERR_FAIL : CLIENT_SUCCESS);	\
760 	}	\
761 }
762 
763 /*
764  * The following macro is used to check if an arg has already been set
765  * and issues an error message, a usage message and then returns an error.
766  * This was made into a macro to avoid the duplication of this code many
767  * times in the function below.
768  */
769 #define	LDAP_CHECK_INVALID(arg, param)	\
770 if (arg) {	\
771 	CLIENT_FPRINTF(stderr, gettext("Invalid parameter (%s) " \
772 	    "specified\n"), param);	\
773 	usage();	\
774 	return (CLIENT_ERR_FAIL);	\
775 }
776 
777 static int
778 client_manual(clientopts_t *arglist)
779 {
780 	int counter;
781 	int domain_fp;
782 	ns_ldap_error_t *errorp;
783 	int ret_copy;
784 	int reset_ret;
785 	int retcode = CLIENT_SUCCESS;
786 
787 	if (dname == NULL) {
788 		CLIENT_FPUTS(
789 		    gettext("Manual failed: System domain not set and "
790 		    "no domainName specified.\n"),
791 		    stderr);
792 		return (CLIENT_ERR_FAIL);
793 	}
794 
795 	if (arglist->defaultSearchBase == NULL) {
796 		CLIENT_FPUTS(
797 		    gettext("Manual failed: Missing required "
798 		    "defaultSearchBase attribute.\n"),
799 		    stderr);
800 		return (CLIENT_ERR_FAIL);
801 	}
802 
803 	if ((arglist->defaultServerList == NULL) &&
804 	    (arglist->preferredServerList == NULL)) {
805 		CLIENT_FPUTS(
806 		    gettext("Manual failed: Missing required "
807 		    "defaultServerList or preferredServerList "
808 		    "attribute.\n"),
809 		    stderr);
810 		return (CLIENT_ERR_FAIL);
811 	}
812 
813 	if (arglist->profileTTL != NULL) {
814 		CLIENT_FPUTS(
815 		    gettext("Manual aborted: profileTTL is not supported "
816 		    "in manual mode.\n"),
817 		    stderr);
818 		return (CLIENT_ERR_FAIL);
819 	}
820 
821 	if (arglist->profileName != NULL) {
822 		CLIENT_FPUTS(
823 		    gettext("Manual aborted: profileName is not supported "
824 		    "in manual mode.\n"),
825 		    stderr);
826 		return (CLIENT_ERR_FAIL);
827 	}
828 
829 	LDAP_CHECK_INVALID(arglist->bindDN, "bind DN");
830 	LDAP_CHECK_INVALID(arglist->bindPasswd, "bind password");
831 
832 	__ns_ldap_setServer(TRUE);	/* Need this for _ns_setParam() */
833 	__ns_ldap_default_config();
834 
835 	/* Set version to latest (not version 1) */
836 	LDAP_SET_PARAM(NS_LDAP_VERSION, NS_LDAP_FILE_VERSION_P);
837 
838 	/* Set profileTTL to 0 since NO profile on manual */
839 	LDAP_SET_PARAM(CACHETTL_OFF, NS_LDAP_CACHETTL_P);
840 
841 	/* Set additional valid params from command line */
842 	LDAP_SET_PARAM(arglist->authenticationMethod, NS_LDAP_AUTH_P);
843 	LDAP_SET_PARAM(arglist->defaultSearchBase, NS_LDAP_SEARCH_BASEDN_P);
844 	LDAP_SET_PARAM(arglist->credentialLevel, NS_LDAP_CREDENTIAL_LEVEL_P);
845 	LDAP_SET_PARAM(arglist->proxyDN, NS_LDAP_BINDDN_P);
846 	LDAP_SET_PARAM(arglist->enableShadowUpdate,
847 	    NS_LDAP_ENABLE_SHADOW_UPDATE_P);
848 	LDAP_SET_PARAM(arglist->adminDN, NS_LDAP_ADMIN_BINDDN_P);
849 	LDAP_SET_PARAM(arglist->searchTimeLimit, NS_LDAP_SEARCH_TIME_P);
850 	LDAP_SET_PARAM(arglist->preferredServerList, NS_LDAP_SERVER_PREF_P);
851 	LDAP_SET_PARAM(arglist->profileName, NS_LDAP_PROFILE_P);
852 	LDAP_SET_PARAM(arglist->followReferrals, NS_LDAP_SEARCH_REF_P);
853 	LDAP_SET_PARAM(arglist->defaultSearchScope, NS_LDAP_SEARCH_SCOPE_P);
854 	LDAP_SET_PARAM(arglist->bindTimeLimit, NS_LDAP_BIND_TIME_P);
855 	LDAP_SET_PARAM(arglist->proxyPassword, NS_LDAP_BINDPASSWD_P);
856 	LDAP_SET_PARAM(arglist->adminPassword, NS_LDAP_ADMIN_BINDPASSWD_P);
857 	LDAP_SET_PARAM(arglist->defaultServerList, NS_LDAP_SERVERS_P);
858 	LDAP_SET_PARAM(arglist->certificatePath, NS_LDAP_HOST_CERTPATH_P);
859 
860 	for (counter = 0;
861 	    counter < arglist->serviceAuthenticationMethod->count;
862 	    counter++) {
863 
864 		LDAP_SET_PARAM(
865 		    arglist->serviceAuthenticationMethod->optlist[counter],
866 		    NS_LDAP_SERVICE_AUTH_METHOD_P);
867 	}
868 	for (counter = 0;
869 	    counter < arglist->serviceCredentialLevel->count;
870 	    counter++) {
871 
872 		LDAP_SET_PARAM(
873 		    arglist->serviceCredentialLevel->optlist[counter],
874 		    NS_LDAP_SERVICE_CRED_LEVEL_P);
875 	}
876 	for (counter = 0;
877 	    counter < arglist->objectclassMap->count;
878 	    counter++) {
879 
880 		LDAP_SET_PARAM(arglist->objectclassMap->optlist[counter],
881 		    NS_LDAP_OBJECTCLASSMAP_P);
882 	}
883 	for (counter = 0; counter < arglist->attributeMap->count; counter++) {
884 		LDAP_SET_PARAM(arglist->attributeMap->optlist[counter],
885 		    NS_LDAP_ATTRIBUTEMAP_P);
886 	}
887 	for (counter = 0;
888 	    counter < arglist->serviceSearchDescriptor->count;
889 	    counter++) {
890 
891 		LDAP_SET_PARAM(
892 		    arglist->serviceSearchDescriptor->optlist[counter],
893 		    NS_LDAP_SERVICE_SEARCH_DESC_P);
894 	}
895 
896 	retcode = credCheck(arglist);
897 	if (retcode == CLIENT_SUCCESS)
898 		retcode = adminCredCheck(arglist);
899 	if (retcode != CLIENT_SUCCESS) {
900 		CLIENT_FPUTS(
901 		    gettext("Error in setting up credentials\n"),
902 		    stderr);
903 		return (retcode);
904 	}
905 
906 	if (mode_verbose)
907 		CLIENT_FPUTS(
908 		    gettext("About to modify this machines "
909 		    "configuration by writing the files\n"),
910 		    stderr);
911 
912 	/* get ready to start playing with files */
913 	retcode = stop_services(STATE_SAVE);
914 	if (retcode != CLIENT_SUCCESS) {
915 		CLIENT_FPUTS(
916 		    gettext("Errors stopping network services.\n"), stderr);
917 		return (CLIENT_ERR_FAIL);
918 	}
919 
920 	/* Save orig versions of files */
921 	retcode = file_backup();
922 	if (retcode == CLIENT_ERR_RESTORE) {
923 		CLIENT_FPUTS(
924 		    gettext("System not in state to enable ldap client.\n"),
925 		    stderr);
926 
927 		reset_ret = start_services(START_RESET);
928 		if (reset_ret != CLIENT_SUCCESS) {
929 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
930 			    "starting services during reset\n"),
931 			    reset_ret);
932 		}
933 		return (retcode);
934 	} else if (retcode != CLIENT_SUCCESS) {
935 		CLIENT_FPUTS(
936 		    gettext("Save of system configuration failed!  "
937 		    "Attempting recovery.\n"),
938 		    stderr);
939 		retcode = recover(STATE_NOSAVE);
940 		if (retcode != CLIENT_SUCCESS) {
941 			CLIENT_FPUTS(
942 			    gettext("Recovery of systems configuration "
943 			    "failed.  Manual intervention of "
944 			    "config files is required.\n"),
945 			    stderr);
946 			return (retcode);
947 		}
948 
949 		reset_ret = start_services(START_RESET);
950 		if (reset_ret != CLIENT_SUCCESS) {
951 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
952 			    "starting services during reset\n"),
953 			    reset_ret);
954 		}
955 
956 		return (retcode);
957 	}
958 
959 	/* Dump new files */
960 	errorp = __ns_ldap_DumpConfiguration(NSCONFIGFILE);
961 	if (errorp != NULL) {
962 		CLIENT_FPRINTF(stderr,
963 		    gettext("%s manual: errorp is not NULL; %s\n"),
964 		    cmd, errorp->message);
965 		retcode = recover(STATE_NOSAVE);
966 		if (retcode != CLIENT_SUCCESS) {
967 			CLIENT_FPUTS(
968 			    gettext("Recovery of systems configuration "
969 			    "failed.  Manual intervention of "
970 			    "config files is required.\n"),
971 			    stderr);
972 			return (retcode);
973 		}
974 		reset_ret = start_services(START_RESET);
975 		if (reset_ret != CLIENT_SUCCESS) {
976 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
977 			    "starting services during reset\n"),
978 			    reset_ret);
979 		}
980 		(void) __ns_ldap_freeError(&errorp);
981 		return (CLIENT_ERR_FAIL);
982 	}
983 
984 	/* if (credargs(arglist)) */
985 	errorp = __ns_ldap_DumpConfiguration(NSCREDFILE);
986 	if (errorp != NULL) {
987 		CLIENT_FPRINTF(stderr,
988 		    gettext("%s init: errorp is not NULL; %s\n"),
989 		    cmd, errorp->message);
990 		retcode = recover(STATE_NOSAVE);
991 		if (retcode != CLIENT_SUCCESS) {
992 			CLIENT_FPUTS(
993 			    gettext("Recovery of systems configuration "
994 			    "failed.  Manual intervention of "
995 			    "config files is required.\n"),
996 			    stderr);
997 			return (retcode);
998 		}
999 		reset_ret = start_services(START_RESET);
1000 		if (reset_ret != CLIENT_SUCCESS) {
1001 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1002 			    "starting services during reset\n"),
1003 			    reset_ret);
1004 		}
1005 		(void) __ns_ldap_freeError(&errorp);
1006 		return (CLIENT_ERR_FAIL);
1007 	}
1008 
1009 	ret_copy = system(CMD_CP " " NSSWITCH_LDAP " " NSSWITCH_CONF);
1010 	if (ret_copy != 0) {
1011 		CLIENT_FPRINTF(stderr,
1012 		    gettext("Error %d copying (%s) -> (%s)\n"),
1013 		    ret_copy, NSSWITCH_LDAP, NSSWITCH_CONF);
1014 		retcode = recover(STATE_NOSAVE);
1015 		if (retcode != CLIENT_SUCCESS) {
1016 			CLIENT_FPUTS(
1017 			    gettext("Recovery of systems configuration "
1018 			    "failed.  Manual intervention of "
1019 			    "config files is required.\n"),
1020 			    stderr);
1021 		}
1022 		reset_ret = start_services(START_RESET);
1023 		if (reset_ret != CLIENT_SUCCESS) {
1024 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1025 			    "starting services during reset\n"),
1026 			    reset_ret);
1027 		}
1028 		return (CLIENT_ERR_FAIL);
1029 	}
1030 
1031 	if ((domain_fp = open(DOMAINNAME, O_WRONLY|O_CREAT|O_TRUNC,
1032 	    S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1) { /* 0644 */
1033 		CLIENT_FPRINTF(stderr, gettext("Cannot open %s\n"), DOMAINNAME);
1034 		retcode = recover(STATE_NOSAVE);
1035 		if (retcode != CLIENT_SUCCESS) {
1036 			CLIENT_FPUTS(
1037 			    gettext("Recovery of systems configuration "
1038 			    "failed.  Manual intervention of "
1039 			    "config files is required.\n"),
1040 			    stderr);
1041 			return (CLIENT_ERR_FAIL);
1042 		}
1043 		reset_ret = start_services(START_RESET);
1044 		if (reset_ret != CLIENT_SUCCESS) {
1045 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1046 			    "starting services during reset\n"),
1047 			    reset_ret);
1048 		}
1049 		return (CLIENT_ERR_FAIL);
1050 	}
1051 	(void) write(domain_fp, dname, strlen(dname));
1052 	(void) write(domain_fp, "\n", 1);
1053 	(void) close(domain_fp);
1054 
1055 	retcode = start_services(START_INIT);
1056 
1057 	if (retcode == CLIENT_SUCCESS) {
1058 		CLIENT_FPUTS(gettext("System successfully configured\n"),
1059 		    stderr);
1060 	} else {
1061 		CLIENT_FPUTS(gettext("Error resetting system.\n"
1062 		    "Recovering old system settings.\n"), stderr),
1063 
1064 		    /* stop any started services for recover */
1065 		    /* don't stomp on history of saved services state */
1066 		    reset_ret = stop_services(STATE_NOSAVE);
1067 		if (reset_ret != CLIENT_SUCCESS) {
1068 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1069 			    "stopping services during reset\n"),
1070 			    reset_ret);
1071 			/* Coninue and try to recover what we can */
1072 		}
1073 		reset_ret = recover(STATE_NOSAVE);
1074 		if (reset_ret != CLIENT_SUCCESS) {
1075 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1076 			    "recovering service files during "
1077 			    "reset\n"), reset_ret);
1078 			/* Continue and start what we can */
1079 		}
1080 		reset_ret = start_services(START_RESET);
1081 		if (reset_ret != CLIENT_SUCCESS) {
1082 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1083 			    "starting services during reset\n"),
1084 			    reset_ret);
1085 		}
1086 	}
1087 
1088 	return (retcode);
1089 }
1090 
1091 static int
1092 client_mod(clientopts_t *arglist)
1093 {
1094 	int counter;
1095 	int domain_fp;
1096 	ns_ldap_error_t *errorp;
1097 	int reset_ret;
1098 	int retcode = CLIENT_SUCCESS;
1099 
1100 	__ns_ldap_setServer(TRUE);	/* Need this for _ns_setParam() */
1101 	if ((errorp = __ns_ldap_LoadConfiguration()) != NULL) {
1102 		CLIENT_FPUTS(gettext("Cannot get load configuration\n"),
1103 		    stderr);
1104 		CLIENT_FPUTS(errorp->message, stderr);
1105 		CLIENT_FPUTC('\n', stderr);
1106 		(void) __ns_ldap_freeError(&errorp);
1107 		return (CLIENT_ERR_FAIL);
1108 	}
1109 
1110 	if (arglist->profileTTL != NULL) {
1111 		CLIENT_FPUTS(
1112 		    gettext("Mod aborted: profileTTL modification is "
1113 		    "not allowed in mod mode.\n"),
1114 		    stderr);
1115 		return (CLIENT_ERR_FAIL);
1116 	}
1117 
1118 	if (arglist->profileName != NULL) {
1119 		CLIENT_FPUTS(
1120 		    gettext("Mod aborted: profileName modification is "
1121 		    "not allowed.  If you want to use profiles "
1122 		    "generate one with genProfile and load it "
1123 		    "on the server with ldapadd.\n"),
1124 		    stderr);
1125 		return (CLIENT_ERR_FAIL);
1126 	}
1127 
1128 	LDAP_CHECK_INVALID(arglist->bindDN, "bind DN");
1129 	LDAP_CHECK_INVALID(arglist->bindPasswd, "bind password");
1130 
1131 	/* Set additional valid params from command line */
1132 	LDAP_SET_PARAM(arglist->authenticationMethod, NS_LDAP_AUTH_P);
1133 	LDAP_SET_PARAM(arglist->defaultSearchBase, NS_LDAP_SEARCH_BASEDN_P);
1134 	LDAP_SET_PARAM(arglist->credentialLevel, NS_LDAP_CREDENTIAL_LEVEL_P);
1135 	LDAP_SET_PARAM(arglist->proxyDN, NS_LDAP_BINDDN_P);
1136 	LDAP_SET_PARAM(arglist->adminDN, NS_LDAP_ADMIN_BINDDN_P);
1137 	LDAP_SET_PARAM(arglist->profileTTL, NS_LDAP_CACHETTL_P);
1138 	LDAP_SET_PARAM(arglist->searchTimeLimit, NS_LDAP_SEARCH_TIME_P);
1139 	LDAP_SET_PARAM(arglist->preferredServerList, NS_LDAP_SERVER_PREF_P);
1140 	LDAP_SET_PARAM(arglist->profileName, NS_LDAP_PROFILE_P);
1141 	LDAP_SET_PARAM(arglist->followReferrals, NS_LDAP_SEARCH_REF_P);
1142 	LDAP_SET_PARAM(arglist->defaultSearchScope, NS_LDAP_SEARCH_SCOPE_P);
1143 	LDAP_SET_PARAM(arglist->bindTimeLimit, NS_LDAP_BIND_TIME_P);
1144 	LDAP_SET_PARAM(arglist->proxyPassword, NS_LDAP_BINDPASSWD_P);
1145 	LDAP_SET_PARAM(arglist->adminPassword, NS_LDAP_ADMIN_BINDPASSWD_P);
1146 	LDAP_SET_PARAM(arglist->defaultServerList, NS_LDAP_SERVERS_P);
1147 	LDAP_SET_PARAM(arglist->enableShadowUpdate,
1148 	    NS_LDAP_ENABLE_SHADOW_UPDATE_P);
1149 	LDAP_SET_PARAM(arglist->certificatePath, NS_LDAP_HOST_CERTPATH_P);
1150 
1151 	for (counter = 0;
1152 	    counter < arglist->serviceAuthenticationMethod->count;
1153 	    counter++) {
1154 
1155 		LDAP_SET_PARAM(
1156 		    arglist->serviceAuthenticationMethod->optlist[counter],
1157 		    NS_LDAP_SERVICE_AUTH_METHOD_P);
1158 	}
1159 	for (counter = 0;
1160 	    counter < arglist->serviceCredentialLevel->count;
1161 	    counter++) {
1162 
1163 		LDAP_SET_PARAM(
1164 		    arglist->serviceCredentialLevel->optlist[counter],
1165 		    NS_LDAP_SERVICE_CRED_LEVEL_P);
1166 	}
1167 	for (counter = 0;
1168 	    counter < arglist->objectclassMap->count;
1169 	    counter++) {
1170 
1171 		LDAP_SET_PARAM(
1172 		    arglist->objectclassMap->optlist[counter],
1173 		    NS_LDAP_OBJECTCLASSMAP_P);
1174 	}
1175 	for (counter = 0;
1176 	    counter < arglist->attributeMap->count;
1177 	    counter++) {
1178 
1179 		LDAP_SET_PARAM(
1180 		    arglist->attributeMap->optlist[counter],
1181 		    NS_LDAP_ATTRIBUTEMAP_P);
1182 	}
1183 	for (counter = 0;
1184 	    counter < arglist->serviceSearchDescriptor->count;
1185 	    counter++) {
1186 
1187 		LDAP_SET_PARAM(
1188 		    arglist->serviceSearchDescriptor->optlist[counter],
1189 		    NS_LDAP_SERVICE_SEARCH_DESC_P);
1190 	}
1191 
1192 	retcode = credCheck(arglist);
1193 	if (retcode == CLIENT_SUCCESS)
1194 		retcode = adminCredCheck(arglist);
1195 	if (retcode != CLIENT_SUCCESS) {
1196 		CLIENT_FPUTS(
1197 		    gettext("Error in setting up credentials\n"),
1198 		    stderr);
1199 		return (retcode);
1200 	}
1201 
1202 	if (mode_verbose)
1203 		CLIENT_FPUTS(
1204 		    gettext("About to modify this machines configuration "
1205 		    "by writing the files\n"),
1206 		    stderr);
1207 
1208 	/* get ready to start playing with files */
1209 	retcode = stop_services(STATE_SAVE);
1210 	if (retcode != CLIENT_SUCCESS) {
1211 		CLIENT_FPUTS(
1212 		    gettext("Errors stopping network services.\n"), stderr);
1213 		return (CLIENT_ERR_FAIL);
1214 	}
1215 
1216 	/* Temporarily save orig versions of files */
1217 	retcode = mod_backup();
1218 	if (retcode != CLIENT_SUCCESS) {
1219 		CLIENT_FPUTS(
1220 		    gettext("Unable to backup the ldap client files!\n"),
1221 		    stderr);
1222 
1223 		return (retcode);
1224 
1225 	}
1226 
1227 	/* Dump new files */
1228 	errorp = __ns_ldap_DumpConfiguration(NSCONFIGFILE);
1229 	if (errorp != NULL) {
1230 		CLIENT_FPRINTF(stderr,
1231 		    gettext("%s mod: errorp is not NULL; %s\n"),
1232 		    cmd, errorp->message);
1233 		retcode = mod_recover();
1234 		if (retcode != CLIENT_SUCCESS) {
1235 			CLIENT_FPUTS(
1236 			    gettext("Recovery of systems configuration "
1237 			    "failed.  Manual intervention of "
1238 			    "config files is required.\n"),
1239 			    stderr);
1240 		}
1241 		(void) __ns_ldap_freeError(&errorp);
1242 		reset_ret = start_services(START_RESET);
1243 		if (reset_ret != CLIENT_SUCCESS) {
1244 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1245 			    "starting services during reset\n"),
1246 			    reset_ret);
1247 		}
1248 		return (CLIENT_ERR_FAIL);
1249 	}
1250 
1251 	/* if (credargs(arglist)) */
1252 	errorp = __ns_ldap_DumpConfiguration(NSCREDFILE);
1253 	if (errorp != NULL) {
1254 		CLIENT_FPRINTF(stderr,
1255 		    gettext("%s mod: errorp is not NULL; %s\n"),
1256 		    cmd, errorp->message);
1257 		retcode = mod_recover();
1258 		if (retcode != CLIENT_SUCCESS) {
1259 			CLIENT_FPUTS(
1260 			    gettext("Recovery of systems configuration "
1261 			    "failed.  Manual intervention of "
1262 			    "config files is required.\n"),
1263 			    stderr);
1264 		}
1265 		(void) __ns_ldap_freeError(&errorp);
1266 		reset_ret = start_services(START_RESET);
1267 		if (reset_ret != CLIENT_SUCCESS) {
1268 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1269 			    "starting services during reset\n"),
1270 			    reset_ret);
1271 		}
1272 		return (CLIENT_ERR_FAIL);
1273 	}
1274 
1275 	if ((domain_fp = open(DOMAINNAME, O_WRONLY|O_CREAT|O_TRUNC,
1276 	    S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1) { /* 0644 */
1277 		CLIENT_FPRINTF(stderr, gettext("Cannot open %s\n"), DOMAINNAME);
1278 		retcode = mod_recover();
1279 		if (retcode != CLIENT_SUCCESS) {
1280 			CLIENT_FPUTS(
1281 			    gettext("Recovery of systems configuration "
1282 			    "failed!  Machine needs to be "
1283 			    "fixed!\n"),
1284 			    stderr);
1285 		}
1286 		reset_ret = start_services(START_RESET);
1287 		if (reset_ret != CLIENT_SUCCESS) {
1288 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1289 			    "starting services during reset\n"),
1290 			    reset_ret);
1291 		}
1292 		return (CLIENT_ERR_FAIL);
1293 	}
1294 	(void) write(domain_fp, dname, strlen(dname));
1295 	(void) write(domain_fp, "\n", 1);
1296 	(void) close(domain_fp);
1297 
1298 	retcode = start_services(START_INIT);
1299 
1300 	if (retcode == CLIENT_SUCCESS) {
1301 		CLIENT_FPUTS(gettext("System successfully configured\n"),
1302 		    stderr);
1303 	} else {
1304 		CLIENT_FPUTS(gettext("Error resetting system.\n"
1305 		    "Recovering old system settings.\n"), stderr),
1306 
1307 		    /* stop any started services for recover */
1308 		    /* don't stomp on history of saved services state */
1309 		    reset_ret = stop_services(STATE_NOSAVE);
1310 		if (reset_ret != CLIENT_SUCCESS) {
1311 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1312 			    "stopping services during reset\n"),
1313 			    reset_ret);
1314 			/* Coninue and try to recover what we can */
1315 		}
1316 		reset_ret = mod_recover();
1317 		if (reset_ret != CLIENT_SUCCESS) {
1318 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1319 			    "recovering service files during "
1320 			    "reset\n"), reset_ret);
1321 			/* Continue and start what we can */
1322 		}
1323 		reset_ret = start_services(START_RESET);
1324 		if (reset_ret != CLIENT_SUCCESS) {
1325 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1326 			    "starting services during reset\n"),
1327 			    reset_ret);
1328 		}
1329 	}
1330 
1331 	/* Cleanup temporary files created by mod_backup() */
1332 	mod_cleanup();
1333 
1334 	return (retcode);
1335 }
1336 
1337 
1338 static int
1339 client_genProfile(clientopts_t *arglist)
1340 {
1341 	int counter;
1342 	int retcode;	/* required for LDAP_SET_PARAM macro */
1343 	ns_ldap_error_t *errorp;
1344 
1345 	if (mode_verbose)
1346 		CLIENT_FPUTS(gettext("About to generate a profile\n"), stderr);
1347 
1348 	/* *** Check for invalid args *** */
1349 	LDAP_CHECK_INVALID(arglist->proxyDN, "proxyDN");
1350 	LDAP_CHECK_INVALID(arglist->proxyPassword, "proxyPassword");
1351 	LDAP_CHECK_INVALID(arglist->enableShadowUpdate,
1352 	    "enableShadowUpdate");
1353 	LDAP_CHECK_INVALID(arglist->adminDN, "adminDN");
1354 	LDAP_CHECK_INVALID(arglist->adminPassword, "adminPassword");
1355 	LDAP_CHECK_INVALID(arglist->certificatePath, "certificatePath");
1356 	LDAP_CHECK_INVALID(arglist->domainName, "domainName");
1357 	LDAP_CHECK_INVALID(arglist->bindDN, "bind DN");
1358 	LDAP_CHECK_INVALID(arglist->bindPasswd, "bind password");
1359 	/* *** End check for invalid args *** */
1360 
1361 	if (arglist->profileName == NULL) {
1362 		if (mode_verbose)
1363 			CLIENT_FPUTS(
1364 			    gettext("No profile specified. "
1365 			    "Using \"default\"\n"),
1366 			    stderr);
1367 		arglist->profileName = "default";
1368 	}
1369 
1370 	__ns_ldap_setServer(TRUE);
1371 	__ns_ldap_default_config();
1372 
1373 	/* Set version to latest (not version 1) */
1374 	LDAP_SET_PARAM(NS_LDAP_VERSION, NS_LDAP_FILE_VERSION_P);
1375 
1376 	/* Set additional valid params from command line */
1377 	LDAP_SET_PARAM(arglist->authenticationMethod, NS_LDAP_AUTH_P);
1378 	LDAP_SET_PARAM(arglist->defaultSearchBase, NS_LDAP_SEARCH_BASEDN_P);
1379 	LDAP_SET_PARAM(arglist->credentialLevel, NS_LDAP_CREDENTIAL_LEVEL_P);
1380 	LDAP_SET_PARAM(arglist->profileTTL, NS_LDAP_CACHETTL_P);
1381 	LDAP_SET_PARAM(arglist->searchTimeLimit, NS_LDAP_SEARCH_TIME_P);
1382 	LDAP_SET_PARAM(arglist->preferredServerList, NS_LDAP_SERVER_PREF_P);
1383 	LDAP_SET_PARAM(arglist->profileName, NS_LDAP_PROFILE_P);
1384 	LDAP_SET_PARAM(arglist->followReferrals, NS_LDAP_SEARCH_REF_P);
1385 	LDAP_SET_PARAM(arglist->defaultSearchScope, NS_LDAP_SEARCH_SCOPE_P);
1386 	LDAP_SET_PARAM(arglist->bindTimeLimit, NS_LDAP_BIND_TIME_P);
1387 	LDAP_SET_PARAM(arglist->defaultServerList, NS_LDAP_SERVERS_P);
1388 
1389 	for (counter = 0;
1390 	    counter < arglist->serviceAuthenticationMethod->count;
1391 	    counter++) {
1392 
1393 		LDAP_SET_PARAM(
1394 		    arglist->serviceAuthenticationMethod->optlist[counter],
1395 		    NS_LDAP_SERVICE_AUTH_METHOD_P);
1396 	}
1397 	for (counter = 0;
1398 	    counter < arglist->serviceCredentialLevel->count;
1399 	    counter++) {
1400 
1401 		LDAP_SET_PARAM(
1402 		    arglist->serviceCredentialLevel->optlist[counter],
1403 		    NS_LDAP_SERVICE_CRED_LEVEL_P);
1404 	}
1405 	for (counter = 0;
1406 	    counter < arglist->objectclassMap->count;
1407 	    counter++) {
1408 
1409 		LDAP_SET_PARAM(
1410 		    arglist->objectclassMap->optlist[counter],
1411 		    NS_LDAP_OBJECTCLASSMAP_P);
1412 	}
1413 	for (counter = 0;
1414 	    counter < arglist->attributeMap->count;
1415 	    counter++) {
1416 
1417 		LDAP_SET_PARAM(
1418 		    arglist->attributeMap->optlist[counter],
1419 		    NS_LDAP_ATTRIBUTEMAP_P);
1420 	}
1421 	for (counter = 0;
1422 	    counter < arglist->serviceSearchDescriptor->count;
1423 	    counter++) {
1424 
1425 		LDAP_SET_PARAM(
1426 		    arglist->serviceSearchDescriptor->optlist[counter],
1427 		    NS_LDAP_SERVICE_SEARCH_DESC_P);
1428 	}
1429 
1430 	errorp = __ns_ldap_DumpLdif(NULL);
1431 	if (errorp != NULL) {
1432 		CLIENT_FPUTS(errorp->message, stderr);
1433 		CLIENT_FPUTC('\n', stderr);
1434 		(void) __ns_ldap_freeError(&errorp);
1435 		return (CLIENT_ERR_FAIL);
1436 	}
1437 
1438 	return (CLIENT_SUCCESS);
1439 }
1440 
1441 /* INET6_ADDRSTRLEN + ":" + <5-digit port> + some round-up */
1442 #define	MAX_HOSTADDR_LEN (INET6_ADDRSTRLEN + 6 + 12)
1443 
1444 static int
1445 client_init(clientopts_t *arglist)
1446 {
1447 	int			profile_fp;
1448 	int			retcode = CLIENT_SUCCESS;
1449 	ns_ldap_error_t		*errorp;
1450 	int			reset_ret;
1451 	int			ret_copy;
1452 	ns_standalone_conf_t	cfg = standaloneDefaults;
1453 	ns_auth_t		auth = {NS_LDAP_AUTH_NONE,
1454 					NS_LDAP_TLS_NONE,
1455 					NS_LDAP_SASL_NONE,
1456 					NS_LDAP_SASLOPT_NONE};
1457 	char			peer[MAX_HOSTADDR_LEN];
1458 	ns_auth_t		**authMethod;
1459 	int			**credLevel, i;
1460 	char			*cred;
1461 
1462 	if (mode_verbose)
1463 		CLIENT_FPUTS(
1464 		    gettext("About to configure machine by downloading "
1465 		    "a profile\n"),
1466 		    stderr);
1467 
1468 	if (dname == NULL) {
1469 		CLIENT_FPUTS(
1470 		    gettext("Init failed: System domain not set and "
1471 		    "no domainName specified.\n"),
1472 		    stderr);
1473 		return (CLIENT_ERR_FAIL);
1474 	}
1475 
1476 	if (!arglist->defaultServerList) {
1477 		CLIENT_FPUTS(gettext("Missing LDAP server address\n"), stderr);
1478 		return (CLIENT_ERR_FAIL);
1479 	}
1480 
1481 	/* *** Check for invalid args *** */
1482 	LDAP_CHECK_INVALID(arglist->defaultSearchBase,
1483 	    "defaultSearchBase");
1484 	LDAP_CHECK_INVALID(arglist->profileTTL,
1485 	    "profileTTL");
1486 	LDAP_CHECK_INVALID(arglist->searchTimeLimit,
1487 	    "searchTimeLimit");
1488 	LDAP_CHECK_INVALID(arglist->preferredServerList,
1489 	    "preferredServerList");
1490 	LDAP_CHECK_INVALID(arglist->followReferrals,
1491 	    "followReferrals");
1492 	LDAP_CHECK_INVALID(arglist->defaultSearchScope,
1493 	    "defaultSearchScope");
1494 	LDAP_CHECK_INVALID(arglist->bindTimeLimit,
1495 	    "bindTimeLimit");
1496 
1497 	LDAP_CHECK_INVALID(arglist->objectclassMap->count,
1498 	    "objectclassMap");
1499 	LDAP_CHECK_INVALID(arglist->attributeMap->count,
1500 	    "attributeMap");
1501 	LDAP_CHECK_INVALID(arglist->serviceAuthenticationMethod->count,
1502 	    "serviceAuthenticationMethod");
1503 	LDAP_CHECK_INVALID(arglist->serviceCredentialLevel->count,
1504 	    "serviceCredentialLevel");
1505 	LDAP_CHECK_INVALID(arglist->serviceSearchDescriptor->count,
1506 	    "serviceSearchDescriptor");
1507 	/* *** End check for invalid args *** */
1508 
1509 	if (arglist->profileName == NULL) {
1510 		if (mode_verbose)
1511 			CLIENT_FPUTS(
1512 			    gettext("No profile specified. "
1513 			    "Using \"default\"\n"),
1514 			    stderr);
1515 		arglist->profileName = "default";
1516 	}
1517 
1518 	(void) strncpy(peer, arglist->defaultServerList, MAX_HOSTADDR_LEN - 1);
1519 	if (separatePort(peer, &cfg.SA_SERVER, &cfg.SA_PORT) > 0) {
1520 		return (CLIENT_ERR_FAIL);
1521 	}
1522 
1523 	if (arglist->bindDN != NULL) {
1524 		cfg.SA_CRED = "proxy";
1525 		/*
1526 		 * We don't want to force users to always specify authentication
1527 		 * method when we can infer it. If users want SSL, they would
1528 		 * have to specify appropriate -a though.
1529 		 */
1530 		auth.type = NS_LDAP_AUTH_SIMPLE;
1531 		if (arglist->bindPasswd == NULL) {
1532 			arglist->bindPasswd =
1533 			    getpassphrase("Bind Password:");
1534 			if (arglist->bindPasswd == NULL) {
1535 				CLIENT_FPUTS(gettext("Get password failed\n"),
1536 				    stderr);
1537 
1538 				if (gStartLdap == START_RESET)
1539 					(void) start_service(LDAP_FMRI, B_TRUE);
1540 
1541 				return (CLIENT_ERR_CREDENTIAL);
1542 			}
1543 		}
1544 	}
1545 	cfg.SA_BIND_DN = arglist->bindDN;
1546 	cfg.SA_BIND_PWD = arglist->bindPasswd;
1547 
1548 	if (arglist->authenticationMethod != NULL) {
1549 		if (__ns_ldap_initAuth(arglist->authenticationMethod,
1550 		    &auth, &errorp) != NS_LDAP_SUCCESS) {
1551 			if (errorp != NULL) {
1552 				CLIENT_FPRINTF(stderr, "%s", errorp->message);
1553 				(void) __ns_ldap_freeError(&errorp);
1554 			}
1555 
1556 			if (gStartLdap == START_RESET)
1557 				(void) start_service(LDAP_FMRI, B_TRUE);
1558 
1559 			return (CLIENT_ERR_FAIL);
1560 		}
1561 		cfg.SA_AUTH = &auth;
1562 	}
1563 	cfg.SA_CRED = arglist->credentialLevel;
1564 
1565 	cfg.SA_DOMAIN = arglist->domainName;
1566 	cfg.SA_PROFILE_NAME = arglist->profileName;
1567 	cfg.SA_CERT_PATH = arglist->certificatePath;
1568 
1569 	cfg.type = NS_LDAP_SERVER;
1570 
1571 	if (__ns_ldap_initStandalone(&cfg, &errorp) != NS_LDAP_SUCCESS) {
1572 		if (errorp != NULL) {
1573 			CLIENT_FPRINTF(stderr, "%s", errorp->message);
1574 			(void) __ns_ldap_freeError(&errorp);
1575 		}
1576 
1577 		if (gStartLdap == START_RESET)
1578 			(void) start_service(LDAP_FMRI, B_TRUE);
1579 
1580 		return (CLIENT_ERR_FAIL);
1581 	}
1582 
1583 	if (arglist->proxyDN != NULL && arglist->proxyPassword == NULL) {
1584 		arglist->proxyPassword = getpassphrase("Proxy Bind Password:");
1585 		if (arglist->proxyPassword == NULL) {
1586 			CLIENT_FPUTS(gettext("Get password failed\n"), stderr);
1587 
1588 			if (gStartLdap == START_RESET)
1589 				(void) start_service(LDAP_FMRI, B_TRUE);
1590 
1591 			return (CLIENT_ERR_CREDENTIAL);
1592 		}
1593 	}
1594 	if (arglist->proxyDN != NULL && arglist->proxyPassword != NULL) {
1595 		if (__ns_ldap_setParam(NS_LDAP_BINDDN_P,
1596 		    arglist->proxyDN, &errorp) != NS_LDAP_SUCCESS) {
1597 			if (errorp != NULL) {
1598 				CLIENT_FPRINTF(stderr, "%s", errorp->message);
1599 				(void) __ns_ldap_freeError(&errorp);
1600 			}
1601 			return (CLIENT_ERR_CREDENTIAL);
1602 		}
1603 		if (__ns_ldap_setParam(NS_LDAP_BINDPASSWD_P,
1604 		    arglist->proxyPassword, &errorp) != NS_LDAP_SUCCESS) {
1605 			if (errorp != NULL) {
1606 				CLIENT_FPRINTF(stderr, "%s", errorp->message);
1607 				(void) __ns_ldap_freeError(&errorp);
1608 			}
1609 			return (CLIENT_ERR_CREDENTIAL);
1610 		}
1611 	}
1612 
1613 	if (arglist->enableShadowUpdate != NULL) {
1614 		LDAP_SET_PARAM(arglist->enableShadowUpdate,
1615 		    NS_LDAP_ENABLE_SHADOW_UPDATE_P);
1616 	}
1617 
1618 	if (arglist->enableShadowUpdate &&
1619 	    strcasecmp(arglist->enableShadowUpdate, "TRUE") == 0 &&
1620 	    arglist->adminDN != NULL && arglist->adminPassword == NULL) {
1621 		arglist->adminPassword = getpassphrase("admin Bind Password:");
1622 		if (arglist->adminPassword == NULL) {
1623 			CLIENT_FPUTS(gettext("Get password failed\n"), stderr);
1624 
1625 			if (gStartLdap == START_RESET)
1626 				(void) start_service(LDAP_FMRI, B_TRUE);
1627 
1628 			return (CLIENT_ERR_CREDENTIAL);
1629 		}
1630 	}
1631 	if (arglist->adminDN != NULL && arglist->adminPassword != NULL) {
1632 		if (__ns_ldap_setParam(NS_LDAP_ADMIN_BINDDN_P,
1633 		    arglist->adminDN, &errorp) != NS_LDAP_SUCCESS) {
1634 			if (errorp != NULL) {
1635 				CLIENT_FPRINTF(stderr, "%s\n", errorp->message);
1636 				(void) __ns_ldap_freeError(&errorp);
1637 			}
1638 			return (CLIENT_ERR_CREDENTIAL);
1639 		}
1640 		if (__ns_ldap_setParam(NS_LDAP_ADMIN_BINDPASSWD_P,
1641 		    arglist->adminPassword, &errorp) != NS_LDAP_SUCCESS) {
1642 			if (errorp != NULL) {
1643 				CLIENT_FPRINTF(stderr, "%s\n", errorp->message);
1644 				(void) __ns_ldap_freeError(&errorp);
1645 			}
1646 			return (CLIENT_ERR_CREDENTIAL);
1647 		}
1648 	}
1649 
1650 	if (arglist->authenticationMethod != NULL) {
1651 		if (__ns_ldap_getParam(NS_LDAP_AUTH_P,
1652 		    (void ***)&authMethod, &errorp) != NS_LDAP_SUCCESS) {
1653 			if (errorp != NULL) {
1654 				CLIENT_FPRINTF(stderr, "%s", errorp->message);
1655 				(void) __ns_ldap_freeError(&errorp);
1656 			}
1657 			return (CLIENT_ERR_CREDENTIAL);
1658 		}
1659 
1660 		if (authMethod != NULL) {
1661 			for (i = 0; authMethod[i] != NULL; ++i) {
1662 				if (authMethod[i]->type == auth.type) {
1663 					break;
1664 				}
1665 			}
1666 
1667 			if (authMethod[i] == NULL) {
1668 				CLIENT_FPRINTF(stderr, gettext(
1669 				    "Warning: init authentication method "
1670 				    "not found in DUAConfigProfile.\n"));
1671 			} else {
1672 				if (i != 0) {
1673 					CLIENT_FPRINTF(stderr,
1674 					    gettext(
1675 					    "Warning: init authentication"
1676 					    "method using secondary "
1677 					    "authentication method from "
1678 					    "DUAConfigProfile.\n"));
1679 				}
1680 			}
1681 			(void) __ns_ldap_freeParam((void ***) &authMethod);
1682 		}
1683 	}
1684 
1685 	if (arglist->credentialLevel != NULL) {
1686 		if (__ns_ldap_getParam(NS_LDAP_CREDENTIAL_LEVEL_P,
1687 		    (void ***)&credLevel, &errorp) != NS_LDAP_SUCCESS) {
1688 			if (errorp != NULL) {
1689 				CLIENT_FPRINTF(stderr, "%s", errorp->message);
1690 				(void) __ns_ldap_freeError(&errorp);
1691 			}
1692 			return (CLIENT_ERR_CREDENTIAL);
1693 		}
1694 		if (credLevel != NULL) {
1695 			for (i = 0; credLevel[i] != NULL; ++i) {
1696 				switch (*credLevel[i]) {
1697 				case NS_LDAP_CRED_ANON :
1698 					cred = "none";
1699 					break;
1700 				case NS_LDAP_CRED_PROXY :
1701 					cred = "proxy";
1702 					break;
1703 				case NS_LDAP_CRED_SELF :
1704 					cred = "self";
1705 					break;
1706 				default:
1707 					continue;
1708 				}
1709 				if (strcmp(cred,
1710 				    arglist->credentialLevel) == 0) {
1711 					break;
1712 				}
1713 			}
1714 			if (credLevel[i] == NULL) {
1715 				CLIENT_FPRINTF(stderr, gettext(
1716 				    "Warning: init credential level not found "
1717 				    "in DUAConfigProfile.\n"));
1718 			} else {
1719 				if (i != 0) {
1720 					CLIENT_FPRINTF(stderr,
1721 					    gettext("Warning: "
1722 					    "init credential level using "
1723 					    "secondary credential level from "
1724 					    "DUAConfigProfile.\n"));
1725 				}
1726 			}
1727 			(void) __ns_ldap_freeParam((void ***) &credLevel);
1728 		}
1729 	}
1730 
1731 	retcode = credCheck(arglist);
1732 	if (retcode == CLIENT_SUCCESS)
1733 		retcode = adminCredCheck(arglist);
1734 	if (retcode != CLIENT_SUCCESS) {
1735 		CLIENT_FPUTS(
1736 		    gettext("Error in setting up credentials\n"), stderr);
1737 
1738 		if (gStartLdap == START_RESET)
1739 			(void) start_service(LDAP_FMRI, B_TRUE);
1740 
1741 		return (retcode);
1742 	}
1743 
1744 	if (mode_verbose)
1745 		CLIENT_FPUTS(
1746 		    gettext("About to modify this machines configuration "
1747 		    "by writing the files\n"),
1748 		    stderr);
1749 
1750 	/* get ready to start playing with files */
1751 	retcode = stop_services(STATE_SAVE);
1752 	if (retcode != CLIENT_SUCCESS) {
1753 		CLIENT_FPUTS(
1754 		    gettext("Errors stopping network services.\n"), stderr);
1755 
1756 		if (gStartLdap == START_RESET)
1757 			(void) start_service(LDAP_FMRI, B_TRUE);
1758 
1759 		return (CLIENT_ERR_FAIL);
1760 	}
1761 
1762 	/* Save orig versions of files */
1763 	retcode = file_backup();
1764 	if (retcode == CLIENT_ERR_RESTORE) {
1765 		CLIENT_FPUTS(
1766 		    gettext("System not in state to enable ldap client.\n"),
1767 		    stderr);
1768 
1769 		return (retcode);
1770 
1771 	} else if (retcode != CLIENT_SUCCESS) {
1772 		CLIENT_FPUTS(
1773 		    gettext("Save of system configuration failed.  "
1774 		    "Attempting recovery.\n"),
1775 		    stderr);
1776 		retcode = recover(STATE_NOSAVE);
1777 		if (retcode != CLIENT_SUCCESS) {
1778 			CLIENT_FPUTS(
1779 			    gettext("Recovery of systems configuration "
1780 			    "failed.  Manual intervention of "
1781 			    "config files is required.\n"),
1782 			    stderr);
1783 		}
1784 
1785 		reset_ret = start_services(START_RESET);
1786 		if (reset_ret != CLIENT_SUCCESS) {
1787 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1788 			    "starting services during reset\n"),
1789 			    reset_ret);
1790 		}
1791 
1792 		return (retcode);
1793 	}
1794 
1795 	/* Dump new files */
1796 	errorp = __ns_ldap_DumpConfiguration(NSCONFIGFILE);
1797 	if (NULL != errorp) {
1798 		CLIENT_FPRINTF(stderr,
1799 		    gettext("%s init: errorp is not NULL; %s\n"),
1800 		    cmd, errorp->message);
1801 		retcode = recover(STATE_NOSAVE);
1802 		if (retcode != CLIENT_SUCCESS) {
1803 			CLIENT_FPUTS(
1804 			    gettext("Recovery of systems configuration "
1805 			    "failed.  Manual intervention of "
1806 			    "config files is required.\n"),
1807 			    stderr);
1808 			return (CLIENT_ERR_FAIL);
1809 		}
1810 		(void) __ns_ldap_freeError(&errorp);
1811 		reset_ret = start_services(START_RESET);
1812 		if (reset_ret != CLIENT_SUCCESS) {
1813 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1814 			    "starting services during reset\n"),
1815 			    reset_ret);
1816 		}
1817 		return (CLIENT_ERR_FAIL);
1818 	}
1819 
1820 	/* if (credargs(arglist)) */
1821 	errorp = __ns_ldap_DumpConfiguration(NSCREDFILE);
1822 	if (NULL != errorp) {
1823 		CLIENT_FPRINTF(stderr,
1824 		    gettext("%s init: errorp is not NULL; %s\n"),
1825 		    cmd, errorp->message);
1826 		retcode = recover(STATE_NOSAVE);
1827 		if (retcode != CLIENT_SUCCESS) {
1828 			CLIENT_FPUTS(
1829 			    gettext("Recovery of systems configuration "
1830 			    "failed.  Manual intervention of "
1831 			    "config files is required.\n"),
1832 			    stderr);
1833 			return (CLIENT_ERR_FAIL);
1834 		}
1835 		(void) __ns_ldap_freeError(&errorp);
1836 		reset_ret = start_services(START_RESET);
1837 		if (reset_ret != CLIENT_SUCCESS) {
1838 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1839 			    "starting services during reset\n"),
1840 			    reset_ret);
1841 		}
1842 		return (CLIENT_ERR_FAIL);
1843 	}
1844 
1845 	ret_copy = system(CMD_CP " " NSSWITCH_LDAP " " NSSWITCH_CONF);
1846 	if (ret_copy != 0) {
1847 		CLIENT_FPRINTF(stderr,
1848 		    gettext("Error %d copying (%s) -> (%s)\n"),
1849 		    ret_copy, NSSWITCH_LDAP, NSSWITCH_CONF);
1850 		retcode = recover(STATE_NOSAVE);
1851 		if (retcode != CLIENT_SUCCESS) {
1852 			CLIENT_FPUTS(
1853 			    gettext("Recovery of systems configuration "
1854 			    "failed.  Manual intervention of "
1855 			    "config files is required.\n"),
1856 			    stderr);
1857 		}
1858 		reset_ret = start_services(START_RESET);
1859 		if (reset_ret != CLIENT_SUCCESS) {
1860 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1861 			    "starting services during reset\n"),
1862 			    reset_ret);
1863 		}
1864 		return (CLIENT_ERR_FAIL);
1865 	}
1866 
1867 	if ((profile_fp = open(DOMAINNAME, O_WRONLY|O_CREAT|O_TRUNC,
1868 	    S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) == -1) { /* 0644 */
1869 		CLIENT_FPRINTF(stderr, gettext("Cannot open %s\n"), DOMAINNAME);
1870 		retcode = recover(STATE_NOSAVE);
1871 		if (retcode != CLIENT_SUCCESS) {
1872 			CLIENT_FPUTS(
1873 			    gettext("Recovery of systems configuration "
1874 			    "failed.  Manual intervention of "
1875 			    "config files is required.\n"),
1876 			    stderr);
1877 			return (CLIENT_ERR_FAIL);
1878 		}
1879 		reset_ret = start_services(START_RESET);
1880 		if (reset_ret != CLIENT_SUCCESS) {
1881 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1882 			    "starting services during reset\n"),
1883 			    reset_ret);
1884 		}
1885 		return (CLIENT_ERR_FAIL);
1886 	}
1887 	(void) write(profile_fp, dname, strlen(dname));
1888 	(void) write(profile_fp, "\n", 1);
1889 	(void) close(profile_fp);
1890 
1891 	retcode = start_services(START_INIT);
1892 
1893 	if (retcode == CLIENT_SUCCESS) {
1894 		CLIENT_FPUTS(gettext("System successfully configured\n"),
1895 		    stderr);
1896 	} else {
1897 		CLIENT_FPUTS(gettext("Error resetting system.\n"
1898 		    "Recovering old system settings.\n"), stderr),
1899 
1900 		    /* stop any started services for recover */
1901 		    /* don't stomp on history of saved services state */
1902 		    reset_ret = stop_services(STATE_NOSAVE);
1903 		if (reset_ret != CLIENT_SUCCESS) {
1904 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1905 			    "stopping services during reset\n"),
1906 			    reset_ret);
1907 			/* Coninue and try to recover what we can */
1908 		}
1909 		reset_ret = recover(STATE_NOSAVE);
1910 		if (reset_ret != CLIENT_SUCCESS) {
1911 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1912 			    "recovering service files during "
1913 			    "reset\n"), reset_ret);
1914 			/* Continue and start what we can */
1915 		}
1916 		reset_ret = start_services(START_RESET);
1917 		if (reset_ret != CLIENT_SUCCESS) {
1918 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
1919 			    "starting services during reset\n"),
1920 			    reset_ret);
1921 		}
1922 	}
1923 
1924 	return (retcode);
1925 }
1926 
1927 
1928 static void
1929 usage(void)
1930 {
1931 	if (mode_quiet)
1932 		return;
1933 
1934 	if (gen == 0) {
1935 		CLIENT_FPRINTF(stderr,
1936 		    gettext("Usage: %s [-v | -q] init | manual | mod | "
1937 		    "list | uninit [<args>]\n"),
1938 		    cmd);
1939 
1940 		CLIENT_FPRINTF(stderr,
1941 		    gettext("\n       %s [-v | -q] [-a authenticationMethod]"
1942 		    " [-D bindDN]\n\t[-w bindPassword] [-j passswdFile]"
1943 		    " [-y proxyPasswordFile]\n\t"
1944 		    "[-z adminPasswordFile] init [<args>]\n"),
1945 		    cmd);
1946 
1947 		CLIENT_FPUTS(
1948 		    gettext("\nSet up a server or workstation as a "
1949 		    "client of an LDAP namespace.\n"),
1950 		    stderr);
1951 	} else {	/* genprofile */
1952 		CLIENT_FPRINTF(stderr,
1953 		    gettext("Usage: %s [-v | -q] genprofile "
1954 		    "-a profileName=<name> "
1955 		    "-a defaultSearchBase=<base> <args>\n"),
1956 		    cmd);
1957 
1958 		CLIENT_FPUTS(
1959 		    gettext("\nGenerate a profile used to set up clients "
1960 		    "of an LDAP namespace.\n"),
1961 		    stderr);
1962 	}
1963 	CLIENT_FPUTS(
1964 	    gettext("<args> take the form of \'-a attrName=attrVal\' as "
1965 	    "described in the\n"),
1966 	    stderr);
1967 	CLIENT_FPUTS(gettext("man page: ldapclient(1M)\n"), stderr);
1968 }
1969 
1970 
1971 /*
1972  * stop_services is called to stop network services prior to their
1973  * config files being moved/changed.  In case a later recovery is needed
1974  * (an error occurs during config), we detect whether the service is
1975  * running and store that info so that a reset will only start services
1976  * that were stopped here.
1977  *
1978  * In terms of SMF, this translates to disabling the services. So we
1979  * try to disable them if they are in any other state
1980  *
1981  * Stop order :
1982  * sendmail, nscd, autofs, ldap.client, nisd (rpc), inetinit(domainname)
1983  */
1984 static int
1985 stop_services(int saveState)
1986 {
1987 	int ret;
1988 
1989 	if (mode_verbose) {
1990 		CLIENT_FPUTS(gettext("Stopping network services\n"), stderr);
1991 	}
1992 
1993 	if (!is_service(SENDMAIL_FMRI, SCF_STATE_STRING_DISABLED)) {
1994 		if (mode_verbose)
1995 			CLIENT_FPUTS(gettext("Stopping sendmail\n"), stderr);
1996 		ret = disable_service(SENDMAIL_FMRI, B_TRUE);
1997 		if (ret != CLIENT_SUCCESS) {
1998 			/* Not serious, but tell user what to do */
1999 			CLIENT_FPRINTF(stderr, gettext("Stopping sendmail "
2000 			    "failed with (%d). You may need to restart "
2001 			    "it manually for changes to take effect.\n"),
2002 			    ret);
2003 		} else enableFlag |= SENDMAIL_ON;
2004 	} else {
2005 		if (mode_verbose)
2006 			CLIENT_FPUTS(gettext("sendmail not running\n"), stderr);
2007 	}
2008 
2009 	if (!is_service(NSCD_FMRI, SCF_STATE_STRING_DISABLED)) {
2010 		if (mode_verbose)
2011 			CLIENT_FPUTS(gettext("Stopping nscd\n"), stderr);
2012 		ret = disable_service(NSCD_FMRI, B_TRUE);
2013 		if (ret != CLIENT_SUCCESS) {
2014 			CLIENT_FPRINTF(stderr, gettext("Stopping nscd "
2015 			    "failed with (%d)\n"), ret);
2016 			return (CLIENT_ERR_FAIL);
2017 		} else enableFlag |= NSCD_ON;
2018 	} else {
2019 		if (mode_verbose)
2020 			CLIENT_FPUTS(gettext("nscd not running\n"), stderr);
2021 	}
2022 
2023 	if (!is_service(AUTOFS_FMRI, SCF_STATE_STRING_DISABLED)) {
2024 		if (mode_verbose)
2025 			CLIENT_FPUTS(gettext("Stopping autofs\n"), stderr);
2026 		ret = disable_service(AUTOFS_FMRI, B_TRUE);
2027 		if (ret != CLIENT_SUCCESS) {
2028 			/* Not serious, but tell user what to do */
2029 			CLIENT_FPRINTF(stderr, gettext("Stopping autofs "
2030 			    "failed with (%d). You may need to restart "
2031 			    "it manually for changes to take effect.\n"),
2032 			    ret);
2033 		} else enableFlag |= AUTOFS_ON;
2034 	} else {
2035 		if (mode_verbose)
2036 			CLIENT_FPUTS(gettext("autofs not running\n"), stderr);
2037 	}
2038 
2039 	if (!is_service(LDAP_FMRI, SCF_STATE_STRING_DISABLED)) {
2040 		if (saveState)
2041 			gStartLdap = START_RESET;
2042 		if (mode_verbose)
2043 			CLIENT_FPUTS(gettext("Stopping ldap\n"), stderr);
2044 		ret = disable_service(LDAP_FMRI, B_TRUE);
2045 		if (ret != CLIENT_SUCCESS) {
2046 			CLIENT_FPRINTF(stderr, gettext("Stopping ldap "
2047 			    "failed with (%d)\n"), ret);
2048 			return (CLIENT_ERR_FAIL);
2049 		}
2050 	} else {
2051 		if (mode_verbose)
2052 			CLIENT_FPUTS(gettext("ldap not running\n"),
2053 			    stderr);
2054 	}
2055 
2056 	if (!is_service(YP_FMRI, SCF_STATE_STRING_DISABLED)) {
2057 		if (saveState)
2058 			gStartYp = START_RESET;
2059 		if (mode_verbose)
2060 			CLIENT_FPUTS(gettext("Stopping nis(yp)\n"), stderr);
2061 		ret = disable_service(YP_FMRI, B_TRUE);
2062 		if (ret != 0) {
2063 			CLIENT_FPRINTF(stderr, gettext("Stopping nis(yp) "
2064 			    "failed with (%d)\n"), ret);
2065 			return (CLIENT_ERR_FAIL);
2066 		}
2067 	} else {
2068 		if (mode_verbose)
2069 			CLIENT_FPUTS(gettext("nis(yp) not running\n"),
2070 			    stderr);
2071 	}
2072 
2073 	return (CLIENT_SUCCESS);
2074 }
2075 
2076 /*
2077  * start_services is called to start up network services after config
2078  * files have all been setup or recovered.  In the case of an error, the
2079  * files will be recovered and start_services will be called with the
2080  * "reset" flag set so that only those services that were earlier stopped
2081  * will be started.  If it is not a reset, then the services associated
2082  * with files "recovered" will attempt to be started.
2083  */
2084 static int
2085 start_services(int flag)
2086 {
2087 	int sysret, retcode = CLIENT_SUCCESS, rc = NS_LDAP_SUCCESS;
2088 	FILE *domain_fp;
2089 	char domainname[BUFSIZ];
2090 	char cmd_domain_start[BUFSIZ];
2091 	int domainlen;
2092 	ns_ldap_self_gssapi_config_t config = NS_LDAP_SELF_GSSAPI_CONFIG_NONE;
2093 	ns_ldap_error_t		*errorp = NULL;
2094 
2095 	if (mode_verbose) {
2096 		CLIENT_FPUTS(gettext("Starting network services\n"), stderr);
2097 	}
2098 
2099 	/* Read in current defaultdomain so we can set it */
2100 	domain_fp = fopen(DOMAINNAME, "r");
2101 	if (domain_fp == NULL) {
2102 		CLIENT_FPRINTF(stderr, gettext("Error opening defaultdomain "
2103 		    "(%d)\n"), errno);
2104 		/* if we did an ldap init, we must have domain */
2105 		if (flag == START_INIT)
2106 			return (CLIENT_ERR_FAIL);
2107 	} else {
2108 		if (fgets(domainname, BUFSIZ, domain_fp) == NULL) {
2109 			CLIENT_FPUTS(gettext("Error reading defaultdomain\n"),
2110 			    stderr);
2111 			return (CLIENT_ERR_FAIL);
2112 		}
2113 
2114 		if (fclose(domain_fp) != 0) {
2115 			CLIENT_FPRINTF(stderr,
2116 			    gettext("Error closing defaultdomain (%d)\n"),
2117 			    errno);
2118 			return (CLIENT_ERR_FAIL);
2119 		}
2120 		domainlen = strlen(domainname);
2121 		/* sanity check to make sure sprintf will fit */
2122 		if (domainlen > (BUFSIZE - sizeof (CMD_DOMAIN_START) -
2123 		    sizeof (TO_DEV_NULL) - 3)) {
2124 			CLIENT_FPUTS(gettext("Specified domainname is "
2125 			    "too large\n"), stderr);
2126 			return (CLIENT_ERR_FAIL);
2127 		}
2128 		if (domainname[domainlen-1] == '\n')
2129 			domainname[domainlen-1] = 0;
2130 		/* buffer size is checked above */
2131 		(void) snprintf(cmd_domain_start, BUFSIZ, "%s %s %s",
2132 		    CMD_DOMAIN_START, domainname, TO_DEV_NULL);
2133 	}
2134 
2135 	/*
2136 	 * We can be starting services after an init in which case
2137 	 * we want to start ldap and not start yp.
2138 	 */
2139 	if (flag == START_INIT) {
2140 		sysret = system(cmd_domain_start);
2141 		if (mode_verbose)
2142 			CLIENT_FPRINTF(stderr, "start: %s %s... %s\n",
2143 			    CMD_DOMAIN_START, domainname,
2144 			    (sysret == 0) ? gettext("success") :
2145 			    gettext("failed"));
2146 		if (sysret != 0) {
2147 			CLIENT_FPRINTF(stderr, gettext("\"%s\" returned: %d\n"),
2148 			    CMD_DOMAIN_START, sysret);
2149 
2150 			retcode = CLIENT_ERR_FAIL;
2151 		}
2152 
2153 		if ((rc = __ns_ldap_self_gssapi_config(&config)) !=
2154 		    NS_LDAP_SUCCESS) {
2155 			CLIENT_FPRINTF(stderr, gettext("Error (%d) while "
2156 			    "checking sasl/GSSAPI configuration\n"),
2157 			    rc);
2158 			retcode = CLIENT_ERR_FAIL;
2159 		}
2160 
2161 		if (config != NS_LDAP_SELF_GSSAPI_CONFIG_NONE) {
2162 
2163 			rc = __ns_ldap_check_dns_preq(
2164 			    1, mode_verbose, mode_quiet,
2165 			    NSSWITCH_LDAP, config, &errorp);
2166 			if (errorp)
2167 				(void) __ns_ldap_freeError(&errorp);
2168 
2169 			if (rc != NS_LDAP_SUCCESS)
2170 				retcode = CLIENT_ERR_FAIL;
2171 		}
2172 
2173 		if (rc == NS_LDAP_SUCCESS &&
2174 		    start_service(LDAP_FMRI, B_TRUE) != CLIENT_SUCCESS)
2175 			retcode = CLIENT_ERR_FAIL;
2176 
2177 		if (config != NS_LDAP_SELF_GSSAPI_CONFIG_NONE &&
2178 		    rc == NS_LDAP_SUCCESS && retcode == CLIENT_SUCCESS) {
2179 			rc = __ns_ldap_check_gssapi_preq(
2180 			    1, mode_verbose, mode_quiet, config,
2181 			    &errorp);
2182 			if (errorp)
2183 				(void) __ns_ldap_freeError(&errorp);
2184 
2185 			if (rc != NS_LDAP_SUCCESS)
2186 				retcode = CLIENT_ERR_FAIL;
2187 
2188 		}
2189 		/* No YP after init */
2190 	/*
2191 	 * Or we can be starting services after an uninit or error
2192 	 * recovery.  We want to start whatever services were running
2193 	 * before.  In the case of error recovery, it is the services
2194 	 * that were running before we stopped them (flags set in
2195 	 * stop_services).  If it is an uninit then we determine
2196 	 * which services to start based on the files we recovered
2197 	 * (flags set in recover).
2198 	 */
2199 	} else {
2200 		/* uninit and recover should set flags of what to start */
2201 		if (domain_fp) {
2202 			sysret = system(cmd_domain_start);
2203 			if (mode_verbose)
2204 				CLIENT_FPRINTF(stderr, "start: %s %s... %s\n",
2205 				    CMD_DOMAIN_START, domainname,
2206 				    (sysret == 0) ? gettext("success") :
2207 				    gettext("failed"));
2208 			if (sysret != 0) {
2209 				CLIENT_FPRINTF(stderr, gettext("\"%s\" "
2210 				    "returned: %d\n"),
2211 				    CMD_DOMAIN_START, sysret);
2212 
2213 				retcode = CLIENT_ERR_FAIL;
2214 			}
2215 		}
2216 
2217 		if (gStartLdap == flag) {
2218 			if (!(is_service(LDAP_FMRI, SCF_STATE_STRING_ONLINE)))
2219 				if (start_service(LDAP_FMRI, B_TRUE)
2220 				    != CLIENT_SUCCESS)
2221 					retcode = CLIENT_ERR_FAIL;
2222 		}
2223 
2224 		if (gStartYp == flag) {
2225 			if (!(is_service(YP_FMRI, SCF_STATE_STRING_ONLINE)))
2226 				(void) start_service(YP_FMRI, B_TRUE);
2227 		}
2228 	}
2229 	if ((enableFlag & AUTOFS_ON) &&
2230 	    !(is_service(AUTOFS_FMRI, SCF_STATE_STRING_ONLINE)))
2231 		(void) start_service(AUTOFS_FMRI, B_TRUE);
2232 
2233 	if ((enableFlag & NSCD_ON) &&
2234 	    !(is_service(NSCD_FMRI, SCF_STATE_STRING_ONLINE)))
2235 		(void) start_service(NSCD_FMRI, B_TRUE);
2236 
2237 #if 0
2238 	if (flag == START_INIT && config != NS_LDAP_SELF_GSSAPI_CONFIG_NONE &&
2239 	    retcode == CLIENT_SUCCESS &&
2240 	    !(is_service(NSCD_FMRI, SCF_STATE_STRING_ONLINE))) {
2241 		CLIENT_FPRINTF(stderr, "start: %s\n",
2242 		    gettext("self/sasl/GSSAPI is configured"
2243 		    " but nscd is not online"));
2244 		retcode = CLIENT_ERR_FAIL;
2245 	}
2246 #endif
2247 
2248 	if ((enableFlag & SENDMAIL_ON) &&
2249 	    !(is_service(SENDMAIL_FMRI, SCF_STATE_STRING_ONLINE)))
2250 		(void) start_service(SENDMAIL_FMRI, B_TRUE);
2251 
2252 	/*
2253 	 * Restart name-service milestone so that any consumer
2254 	 * which depends on it will be restarted.
2255 	 */
2256 	(void) restart_service(NS_MILESTONE_FMRI, B_TRUE);
2257 	return (retcode);
2258 }
2259 
2260 /*
2261  * credCheck is called to check if credentials are required for this
2262  * configuration.  Currently, this means that if any credentialLevel is
2263  * proxy and any authenticationMethod is something other than none, then
2264  * credential info is required (proxyDN and proxyPassword).
2265  */
2266 static int
2267 credCheck(clientopts_t *arglist)
2268 {
2269 	int counter;
2270 	int **credLevel;
2271 	ns_auth_t **authMethod;
2272 	char **proxyDN, **proxyPassword;
2273 	ns_ldap_error_t *errorp;
2274 	int credProxy, authNotNone;
2275 	int retcode;
2276 
2277 /* If credentialLevel is proxy, make sure we have proxyDN and proxyPassword */
2278 	retcode = __ns_ldap_getParam(NS_LDAP_CREDENTIAL_LEVEL_P,
2279 	    (void ***)&credLevel, &errorp);
2280 	if (retcode != 0) {
2281 		CLIENT_FPRINTF(stderr,
2282 		    gettext("Error %d while trying to retrieve "
2283 		    "credLevel\n"),
2284 		    retcode);
2285 		return (CLIENT_ERR_FAIL);
2286 	}
2287 	retcode = __ns_ldap_getParam(NS_LDAP_AUTH_P,
2288 	    (void ***)&authMethod, &errorp);
2289 	if (retcode != 0) {
2290 		CLIENT_FPRINTF(stderr,
2291 		    gettext("Error %d while trying to retrieve "
2292 		    "authMethod\n"), retcode);
2293 		return (CLIENT_ERR_FAIL);
2294 	}
2295 	retcode = __ns_ldap_getParam(NS_LDAP_BINDDN_P,
2296 	    (void ***)&proxyDN, &errorp);
2297 	if (retcode != 0) {
2298 		CLIENT_FPRINTF(stderr,
2299 		    gettext("Error %d while trying to retrieve proxyDN\n"),
2300 		    retcode);
2301 		return (CLIENT_ERR_FAIL);
2302 	}
2303 	retcode = __ns_ldap_getParam(NS_LDAP_BINDPASSWD_P,
2304 	    (void ***)&proxyPassword, &errorp);
2305 	if (retcode != 0) {
2306 		CLIENT_FPRINTF(stderr,
2307 		    gettext("Error %d while trying to retrieve "
2308 		    "proxyPassword\n"), retcode);
2309 		return (CLIENT_ERR_FAIL);
2310 	}
2311 
2312 	if (mode_verbose) {
2313 		CLIENT_FPRINTF(stderr,
2314 		    gettext("Proxy DN: %s\n"),
2315 		    (proxyDN && proxyDN[0]) ? proxyDN[0] : "NULL");
2316 		CLIENT_FPRINTF(stderr,
2317 		    gettext("Proxy password: %s\n"),
2318 		    (proxyPassword && proxyPassword[0]) ?
2319 		    proxyPassword[0] : "NULL");
2320 	}
2321 
2322 	credProxy = 0;	/* flag to indicate if we have a credLevel of proxy */
2323 	for (counter = 0; credLevel && credLevel[counter] != NULL; counter++) {
2324 		if (mode_verbose)
2325 			CLIENT_FPRINTF(stderr,
2326 			    gettext("Credential level: %d\n"),
2327 			    *credLevel[counter]);
2328 		if (*credLevel[counter] == NS_LDAP_CRED_PROXY) {
2329 			credProxy = 1;
2330 			break;
2331 		}
2332 	}
2333 
2334 	authNotNone = 0;	/* flag for authMethod other than none */
2335 	for (counter = 0;
2336 	    authMethod && authMethod[counter] != NULL;
2337 	    counter++) {
2338 
2339 		if (mode_verbose)
2340 			CLIENT_FPRINTF(stderr,
2341 			    gettext("Authentication method: %d\n"),
2342 			    authMethod[counter]->type);
2343 		if (authMethod[counter]->type != NS_LDAP_AUTH_NONE &&
2344 		    !(authMethod[counter]->type == NS_LDAP_AUTH_TLS &&
2345 		    authMethod[counter]->tlstype == NS_LDAP_TLS_NONE)) {
2346 			authNotNone = 1;
2347 			break;
2348 		}
2349 	}
2350 
2351 	/* First, if we don't need proxyDN/Password then just return ok */
2352 	if (!(credProxy && authNotNone)) {
2353 		if (mode_verbose)
2354 			CLIENT_FPUTS(
2355 			    gettext("No proxyDN/proxyPassword required\n"),
2356 			    stderr);
2357 		return (CLIENT_SUCCESS);
2358 	}
2359 
2360 	/* Now let's check if we have the cred stuff we need */
2361 	if (!proxyDN || !proxyDN[0]) {
2362 		CLIENT_FPUTS(
2363 		    gettext("credentialLevel is proxy and no proxyDN "
2364 		    "specified\n"),
2365 		    stderr);
2366 		return (CLIENT_ERR_CREDENTIAL);
2367 	}
2368 
2369 	/* If we need proxyPassword (prompt) */
2370 	if (!proxyPassword || !proxyPassword[0]) {
2371 		CLIENT_FPUTS(
2372 		    gettext("credentialLevel requires proxyPassword\n"),
2373 		    stderr);
2374 		arglist->proxyPassword = getpassphrase("Proxy Bind Password:");
2375 		if (arglist->proxyPassword == NULL) {
2376 			CLIENT_FPUTS(gettext("Get password failed\n"), stderr);
2377 			return (CLIENT_ERR_CREDENTIAL);
2378 		}
2379 		LDAP_SET_PARAM(arglist->proxyPassword, NS_LDAP_BINDPASSWD_P);
2380 		if (retcode != 0) {
2381 			CLIENT_FPUTS(
2382 			    gettext("setParam proxyPassword failed.\n"),
2383 			    stderr);
2384 			return (CLIENT_ERR_CREDENTIAL);
2385 		}
2386 	}
2387 
2388 	return (CLIENT_SUCCESS);
2389 }
2390 
2391 /*
2392  * adminCredCheck is called to check if the admin credential is required
2393  * for this configuration. This means that if enableShadowUpdate is set
2394  * to TRUE then credential info is required (adminDN and adminPassword).
2395  * One exception is that if there is a 'self' credentialLevel and
2396  * 'sasl/GSSAPI' authenticationMethod (i.e., possibly using Kerberos
2397  * host credential) then adminDN and adminPassword are not required.
2398  */
2399 static int
2400 adminCredCheck(clientopts_t *arglist)
2401 {
2402 	int counter;
2403 	int **enabled = NULL;
2404 	int **credLevel = NULL;
2405 	char **adminDN = NULL;
2406 	char **adminPassword = NULL;
2407 	ns_auth_t **authMethod = NULL;
2408 	ns_ldap_error_t *errorp = NULL;
2409 	int credSelf, authSASLgss;
2410 	int retcode, rc;
2411 
2412 	/* If shadow update not enabled, then no need to check */
2413 	retcode = __ns_ldap_getParam(NS_LDAP_ENABLE_SHADOW_UPDATE_P,
2414 	    (void ***)&enabled, &errorp);
2415 	if (retcode != 0) {
2416 		CLIENT_FPRINTF(stderr,
2417 		    gettext("Error %d while trying to retrieve "
2418 		    "enableShadowUpdate\n"), retcode);
2419 		rc = CLIENT_ERR_FAIL;
2420 		goto out;
2421 	}
2422 	if (enabled == NULL ||
2423 	    *enabled[0] != NS_LDAP_ENABLE_SHADOW_UPDATE_TRUE) {
2424 		if (mode_verbose)
2425 			CLIENT_FPUTS(
2426 			    gettext("Shadow Update is not enabled, "
2427 			    "no adminDN/adminPassword is required.\n"), stderr);
2428 		rc = CLIENT_SUCCESS;
2429 		goto out;
2430 	}
2431 
2432 	/* get credentialLevel */
2433 	retcode = __ns_ldap_getParam(NS_LDAP_CREDENTIAL_LEVEL_P,
2434 	    (void ***)&credLevel, &errorp);
2435 	if (retcode != 0) {
2436 		CLIENT_FPRINTF(stderr,
2437 		    gettext("Error %d while trying to retrieve credLevel\n"),
2438 		    retcode);
2439 		rc = CLIENT_ERR_FAIL;
2440 		goto out;
2441 	}
2442 
2443 	/* get AuthenticationMethod */
2444 	retcode = __ns_ldap_getParam(NS_LDAP_AUTH_P,
2445 	    (void ***)&authMethod, &errorp);
2446 	if (retcode != 0) {
2447 		CLIENT_FPRINTF(stderr,
2448 		    gettext("Error %d while trying to retrieve authMethod\n"),
2449 		    retcode);
2450 		rc = CLIENT_ERR_FAIL;
2451 		goto out;
2452 	}
2453 
2454 	/* get adminDN */
2455 	retcode = __ns_ldap_getParam(NS_LDAP_ADMIN_BINDDN_P,
2456 	    (void ***)&adminDN, &errorp);
2457 	if (retcode != 0) {
2458 		CLIENT_FPRINTF(stderr,
2459 		    gettext("Error %d while trying to retrieve adminDN\n"),
2460 		    retcode);
2461 		rc = CLIENT_ERR_FAIL;
2462 		goto out;
2463 	}
2464 
2465 	/* get adminPassword */
2466 	retcode = __ns_ldap_getParam(NS_LDAP_ADMIN_BINDPASSWD_P,
2467 	    (void ***)&adminPassword, &errorp);
2468 	if (retcode != 0) {
2469 		CLIENT_FPRINTF(stderr,
2470 		    gettext("Error %d while trying to retrieve "
2471 		    "adminPassword\n"), retcode);
2472 		rc = CLIENT_ERR_FAIL;
2473 		goto out;
2474 	}
2475 
2476 	if (mode_verbose) {
2477 		CLIENT_FPRINTF(stderr,
2478 		    gettext("admin DN: %s\n"),
2479 		    (adminDN && adminDN[0]) ? adminDN[0] : "NULL");
2480 		CLIENT_FPRINTF(stderr,
2481 		    gettext("admin password: %s\n"),
2482 		    (adminPassword && adminPassword[0]) ?
2483 		    adminPassword[0] : "NULL");
2484 	}
2485 
2486 	credSelf = 0;	/* flag to indicate if we have a credLevel of self */
2487 	for (counter = 0; credLevel && credLevel[counter] != NULL; counter++) {
2488 		if (mode_verbose)
2489 			CLIENT_FPRINTF(stderr,
2490 			    gettext("Credential level: %d\n"),
2491 			    *credLevel[counter]);
2492 		if (*credLevel[counter] == NS_LDAP_CRED_SELF) {
2493 			credSelf = 1;
2494 			break;
2495 		}
2496 	}
2497 
2498 	authSASLgss = 0;	/* flag for authMethod of SASL/gssapi */
2499 	for (counter = 0;
2500 	    authMethod && authMethod[counter] != NULL;
2501 	    counter++) {
2502 
2503 		if (mode_verbose)
2504 			CLIENT_FPRINTF(stderr,
2505 			    gettext("Authentication sasl mechanism: %d\n"),
2506 			    authMethod[counter]->saslmech);
2507 		if (authMethod[counter]->saslmech == NS_LDAP_SASL_GSSAPI) {
2508 			authSASLgss = 1;
2509 			break;
2510 		}
2511 	}
2512 
2513 	/* First, if we don't need adminDN/adminPassword then just return ok */
2514 	if (credSelf && authSASLgss) {
2515 		if (mode_verbose)
2516 			CLIENT_FPUTS(
2517 			    gettext("A credential Level of self and an "
2518 			    "authentication method of sasl/GSSAPI is "
2519 			    "configured, no adminDN/adminPassword "
2520 			    "is required.\n"), stderr);
2521 		rc = CLIENT_SUCCESS;
2522 		goto out;
2523 	}
2524 
2525 	/* Now let's check if we have the cred stuff we need */
2526 	if (adminDN == NULL || adminDN[0] == NULL) {
2527 		CLIENT_FPUTS(
2528 		    gettext("Shadow Update is enabled, but "
2529 		    "no adminDN is configured.\n"), stderr);
2530 		rc = CLIENT_ERR_CREDENTIAL;
2531 		goto out;
2532 	}
2533 
2534 	/* If we need adminPassword (prompt) */
2535 	if (adminPassword == NULL || adminPassword[0] == NULL) {
2536 		CLIENT_FPUTS(
2537 		    gettext("Shadow Update requires adminPassword\n"),
2538 		    stderr);
2539 		arglist->adminPassword = getpassphrase("admin Password:");
2540 		if (arglist->adminPassword == NULL) {
2541 			CLIENT_FPUTS(gettext("Unable to get admin password\n"),
2542 			    stderr);
2543 			rc = CLIENT_ERR_CREDENTIAL;
2544 			goto out;
2545 		}
2546 		LDAP_SET_PARAM(arglist->adminPassword,
2547 		    NS_LDAP_ADMIN_BINDPASSWD_P);
2548 		if (retcode != 0) {
2549 			CLIENT_FPUTS(
2550 			    gettext("setParam adminPassword failed.\n"),
2551 			    stderr);
2552 			rc = CLIENT_ERR_CREDENTIAL;
2553 			goto out;
2554 		}
2555 	}
2556 
2557 	rc = CLIENT_SUCCESS;
2558 
2559 	out:
2560 	if (enabled != NULL)
2561 		(void) __ns_ldap_freeParam((void ***)&enabled);
2562 	if (credLevel != NULL)
2563 		(void) __ns_ldap_freeParam((void ***)&credLevel);
2564 	if (authMethod != NULL)
2565 		(void) __ns_ldap_freeParam((void ***)&authMethod);
2566 	if (adminDN != NULL)
2567 		(void) __ns_ldap_freeParam((void ***)&adminDN);
2568 	if (adminPassword != NULL)
2569 		(void) __ns_ldap_freeParam((void ***)&adminPassword);
2570 
2571 	return (rc);
2572 }
2573 
2574 /*
2575  * try to restore the previous name space on this machine
2576  */
2577 static int
2578 recover(int saveState)
2579 {
2580 	struct stat buf;
2581 	int stat_ret, retcode, fd;
2582 	int domain = 0, domainlen;
2583 	char yp_dir[BUFSIZE], yp_dir_back[BUFSIZE];
2584 	char name[BUFSIZ];
2585 	char *ldap_conf_file, *ldap_cred_file;
2586 	char ldap_file_back[BUFSIZE], ldap_cred_back[BUFSIZE];
2587 
2588 	/* If running as Sysid Install become a no-op */
2589 	if (sysid_install == B_TRUE)
2590 		return (CLIENT_SUCCESS);
2591 
2592 	stat_ret = stat(LDAP_RESTORE_DIR, &buf);
2593 	if (stat_ret != 0) {
2594 		CLIENT_FPUTS(
2595 		    gettext("Cannot recover.  No backup files "
2596 		    "found.\n"),
2597 		    stderr);
2598 		CLIENT_FPUTS(
2599 		    gettext("\t Either this machine was not initialized\n"),
2600 		    stderr);
2601 		CLIENT_FPUTS(
2602 		    gettext("\t by ldapclient or the backup files "
2603 		    "have been\n"),
2604 		    stderr);
2605 		CLIENT_FPUTS(
2606 		    gettext("\t removed manually or with an \"uninit\"\n"),
2607 		    stderr);
2608 		return (CLIENT_ERR_RESTORE);	/* invalid backup */
2609 	}
2610 
2611 	/*
2612 	 * Get domainname.  Allow no domainname for the case where "files"
2613 	 * config was backed up.
2614 	 */
2615 	stat_ret = stat(DOMAINNAME_BACK, &buf);
2616 	if (mode_verbose)
2617 		CLIENT_FPRINTF(stderr,
2618 		    gettext("recover: stat(%s)=%d\n"),
2619 		    DOMAINNAME_BACK, stat_ret);
2620 	if (stat_ret == 0) {
2621 		if (mode_verbose)
2622 			CLIENT_FPRINTF(stderr,
2623 			    gettext("recover: open(%s)\n"),
2624 			    DOMAINNAME_BACK);
2625 		fd = open(DOMAINNAME_BACK, O_RDONLY);
2626 		if (mode_verbose)
2627 			CLIENT_FPRINTF(stderr,
2628 			    gettext("recover: read(%s)\n"),
2629 			    DOMAINNAME_BACK);
2630 		domainlen = read(fd, &(name[0]), BUFSIZ-1);
2631 		(void) close(fd);
2632 		if (domainlen < 0) {
2633 			CLIENT_FPUTS(
2634 			    gettext("Cannot recover.  Cannot determine "
2635 			    "previous domain name.\n"),
2636 			    stderr);
2637 			return (CLIENT_ERR_RESTORE);	/* invalid backup */
2638 		} else 	{
2639 			char *ptr;
2640 
2641 			ptr = strchr(&(name[0]), '\n');
2642 			if (ptr != NULL)
2643 				*ptr = '\0';
2644 			else
2645 				name[domainlen] = '\0';
2646 
2647 			if (mode_verbose)
2648 				CLIENT_FPRINTF(stderr,
2649 				    gettext("recover: old domainname "
2650 				    "\"%s\"\n"), name);
2651 
2652 			if (strlen(name) == 0)
2653 				domain = 0;
2654 			else
2655 				domain = 1;	/* flag that we have domain */
2656 
2657 		}
2658 	}
2659 
2660 
2661 	/*
2662 	 * we can recover at this point
2663 	 * remove LDAP config files before restore
2664 	 */
2665 	(void) unlink(NSCONFIGFILE);
2666 	(void) unlink(NSCREDFILE);
2667 
2668 	ldap_conf_file = strrchr(NSCONFIGFILE, '/') + 1;
2669 	ldap_cred_file = strrchr(NSCREDFILE, '/') + 1;
2670 
2671 	(void) strlcpy(ldap_file_back, LDAP_RESTORE_DIR "/", BUFSIZE);
2672 	(void) strlcat(ldap_file_back, ldap_conf_file, BUFSIZE);
2673 
2674 	stat_ret = stat(ldap_file_back, &buf);
2675 	if (mode_verbose)
2676 		CLIENT_FPRINTF(stderr,
2677 		    gettext("recover: stat(%s)=%d\n"),
2678 		    ldap_file_back, stat_ret);
2679 	if (stat_ret == 0) {
2680 		if (saveState)
2681 			gStartLdap = START_UNINIT;
2682 		retcode = file_move(ldap_file_back, NSCONFIGFILE);
2683 		if (mode_verbose)
2684 			CLIENT_FPRINTF(stderr,
2685 			    gettext("recover: file_move(%s, %s)=%d\n"),
2686 			    ldap_file_back, NSCONFIGFILE, retcode);
2687 		if (retcode != 0)
2688 			CLIENT_FPRINTF(stderr,
2689 			    gettext("recover: file_move(%s, %s) failed\n"),
2690 			    ldap_file_back, NSCONFIGFILE);
2691 	}
2692 
2693 	(void) strlcpy(ldap_cred_back, LDAP_RESTORE_DIR "/", BUFSIZE);
2694 	(void) strlcat(ldap_cred_back, ldap_cred_file, BUFSIZE);
2695 
2696 	stat_ret = stat(ldap_cred_back, &buf);
2697 	if (mode_verbose)
2698 		CLIENT_FPRINTF(stderr,
2699 		    gettext("recover: stat(%s)=%d\n"),
2700 		    ldap_cred_back, stat_ret);
2701 	if (stat_ret == 0) {
2702 		retcode = file_move(ldap_cred_back, NSCREDFILE);
2703 		if (mode_verbose)
2704 			CLIENT_FPRINTF(stderr,
2705 			    gettext("recover: file_move(%s, %s)=%d\n"),
2706 			    ldap_cred_back, NSCREDFILE, retcode);
2707 		if (retcode != 0)
2708 			CLIENT_FPRINTF(stderr,
2709 			    gettext("recover: file_move(%s, %s) failed\n"),
2710 			    ldap_cred_back, NSCREDFILE);
2711 	}
2712 
2713 	/* Check for recovery of NIS(YP) if we have a domainname */
2714 	if (domain) {
2715 		/* "name" would have to be huge for this, but just in case */
2716 		if (strlen(name) >= (BUFSIZE - strlen(LDAP_RESTORE_DIR)))
2717 			return (CLIENT_ERR_FAIL);
2718 		if (strlen(name) >= (BUFSIZE - strlen(YP_BIND_DIR)))
2719 			return (CLIENT_ERR_FAIL);
2720 
2721 		(void) strlcpy(yp_dir_back, LDAP_RESTORE_DIR "/", BUFSIZE);
2722 		(void) strlcat(yp_dir_back, name, BUFSIZE);
2723 		stat_ret = stat(yp_dir_back, &buf);
2724 		if (mode_verbose)
2725 			CLIENT_FPRINTF(stderr,
2726 			    gettext("recover: stat(%s)=%d\n"),
2727 			    yp_dir_back, stat_ret);
2728 		if (stat_ret == 0) {
2729 			(void) strlcpy(yp_dir, YP_BIND_DIR "/", BUFSIZE);
2730 			(void) strlcat(yp_dir, name, BUFSIZE);
2731 			retcode = file_move(yp_dir_back, yp_dir);
2732 			if (mode_verbose)
2733 				CLIENT_FPRINTF(stderr,
2734 				    gettext("recover: file_move(%s, "
2735 				    "%s)=%d\n"),
2736 				    yp_dir_back, yp_dir, retcode);
2737 			if (retcode != 0) {
2738 				CLIENT_FPRINTF(stderr,
2739 				    gettext("recover: file_move(%s, "
2740 				    "%s) failed!\n"),
2741 				    yp_dir_back, yp_dir);
2742 			} else {
2743 				if (saveState)
2744 					gStartYp = START_UNINIT;
2745 			}
2746 		}
2747 	}
2748 
2749 	/* restore machine configuration */
2750 	stat_ret = stat(NSSWITCH_BACK, &buf);
2751 	if (mode_verbose)
2752 		CLIENT_FPRINTF(stderr,
2753 		    gettext("recover: stat(%s)=%d\n"),
2754 		    NSSWITCH_BACK, stat_ret);
2755 	if (stat_ret == 0) {
2756 		retcode = file_move(NSSWITCH_BACK, NSSWITCH_CONF);
2757 		if (mode_verbose)
2758 			CLIENT_FPRINTF(stderr,
2759 			    gettext("recover: file_move(%s, %s)=%d\n"),
2760 			    NSSWITCH_BACK, NSSWITCH_CONF, retcode);
2761 		if (retcode != 0)
2762 			CLIENT_FPRINTF(stderr,
2763 			    gettext("recover: file_move(%s, %s) failed\n"),
2764 			    NSSWITCH_BACK, NSSWITCH_CONF);
2765 	}
2766 
2767 	stat_ret = stat(DOMAINNAME_BACK, &buf);
2768 	if (mode_verbose)
2769 		CLIENT_FPRINTF(stderr,
2770 		    gettext("recover: stat(%s)=%d\n"),
2771 		    DOMAINNAME_BACK, stat_ret);
2772 	if (stat_ret == 0) {
2773 		retcode = file_move(DOMAINNAME_BACK, DOMAINNAME);
2774 		if (mode_verbose)
2775 			CLIENT_FPRINTF(stderr,
2776 			    gettext("recover: file_move(%s, %s)=%d\n"),
2777 			    DOMAINNAME_BACK, DOMAINNAME, retcode);
2778 		if (retcode != 0)
2779 			CLIENT_FPRINTF(stderr,
2780 			    gettext("recover: file_move(%s, %s) failed\n"),
2781 			    DOMAINNAME_BACK, DOMAINNAME);
2782 	}
2783 
2784 	retcode = rmdir(LDAP_RESTORE_DIR);
2785 	if (retcode != 0) {
2786 		CLIENT_FPRINTF(stderr,
2787 		    gettext("Error removing \"%s\" directory.\n"),
2788 		    LDAP_RESTORE_DIR);
2789 	}
2790 
2791 	return (CLIENT_SUCCESS);
2792 }
2793 
2794 /*
2795  * try to save the current state of this machine.
2796  * this just overwrites any old saved configration files.
2797  *
2798  * This function should only be called after network services have been stopped.
2799  *
2800  * Returns 0 on successful save
2801  * Otherwise returns -1
2802  */
2803 static int
2804 file_backup(void)
2805 {
2806 	struct stat buf;
2807 	int domain_stat, conf_stat, ldap_stat;
2808 	int yp_stat, restore_stat;
2809 	int retcode, namelen, ret;
2810 	char yp_dir[BUFSIZ], yp_dir_back[BUFSIZ];
2811 	char name[BUFSIZ];
2812 	char *ldap_conf_file, *ldap_cred_file;
2813 	char ldap_file_back[BUFSIZE], ldap_cred_back[BUFSIZE];
2814 
2815 	ret = CLIENT_SUCCESS;
2816 	/* If running as Sysid Install become a no-op */
2817 	if (sysid_install == B_TRUE)
2818 		return (CLIENT_SUCCESS);
2819 
2820 	/* If existing backup files, clear for this run */
2821 	restore_stat = stat(LDAP_RESTORE_DIR, &buf);
2822 	if (restore_stat == 0) {
2823 		if (mode_verbose) {
2824 			CLIENT_FPUTS(
2825 			    gettext("Removing existing restore "
2826 			    "directory\n"),
2827 			    stderr);
2828 		}
2829 		(void) system("/bin/rm -fr " LDAP_RESTORE_DIR);
2830 		restore_stat = stat(LDAP_RESTORE_DIR, &buf);
2831 		if (restore_stat == 0) {
2832 			CLIENT_FPRINTF(stderr,
2833 			    gettext("Unable to remove backup "
2834 			    "directory (%s)\n"),
2835 			    LDAP_RESTORE_DIR);
2836 			return (CLIENT_ERR_RESTORE);
2837 		}
2838 	}
2839 
2840 	retcode = mkdir(LDAP_RESTORE_DIR, 0755);
2841 	if (retcode != 0) {
2842 		CLIENT_FPRINTF(stderr,
2843 		    gettext("file_backup: Failed to make %s backup "
2844 		    "directory. mkdir=%d\n"),
2845 		    LDAP_RESTORE_DIR, retcode);
2846 		return (CLIENT_ERR_FAIL);
2847 	}
2848 
2849 	conf_stat = stat(NSSWITCH_CONF, &buf);
2850 	if (mode_verbose)
2851 		CLIENT_FPRINTF(stderr,
2852 		    gettext("file_backup: stat(%s)=%d\n"),
2853 		    NSSWITCH_CONF, conf_stat);
2854 	if (conf_stat == 0) {
2855 		if (mode_verbose)
2856 			CLIENT_FPRINTF(stderr,
2857 			    gettext("file_backup: (%s -> %s)\n"),
2858 			    NSSWITCH_CONF, NSSWITCH_BACK);
2859 		retcode = file_move(NSSWITCH_CONF, NSSWITCH_BACK);
2860 		if (retcode != 0) {
2861 			CLIENT_FPRINTF(stderr,
2862 			    gettext("file_backup: file_move(%s, %s) failed "
2863 			    "with %d\n"),
2864 			    NSSWITCH_CONF, NSSWITCH_BACK, retcode);
2865 			ret = CLIENT_ERR_RENAME;
2866 		}
2867 	} else {
2868 		if (mode_verbose)
2869 			CLIENT_FPRINTF(stderr,
2870 			    gettext("file_backup: No %s file.\n"),
2871 			    NSSWITCH_CONF);
2872 	}
2873 
2874 	domain_stat = stat(DOMAINNAME, &buf);
2875 	if (mode_verbose)
2876 		CLIENT_FPRINTF(stderr,
2877 		    gettext("file_backup: stat(%s)=%d\n"),
2878 		    DOMAINNAME, domain_stat);
2879 	if ((domain_stat == 0) && (buf.st_size > 0)) {
2880 		if (mode_verbose)
2881 			CLIENT_FPRINTF(stderr,
2882 			    gettext("file_backup: (%s -> %s)\n"),
2883 			    DOMAINNAME, DOMAINNAME_BACK);
2884 		retcode = file_move(DOMAINNAME, DOMAINNAME_BACK);
2885 		if (retcode != 0) {
2886 			CLIENT_FPRINTF(stderr,
2887 			    gettext("file_backup: file_move(%s, %s) failed "
2888 			    "with %d\n"),
2889 			    DOMAINNAME, DOMAINNAME_BACK, retcode);
2890 			ret = CLIENT_ERR_RENAME;
2891 		}
2892 	} else {
2893 		if (mode_verbose)
2894 			if (domain_stat != 0) {
2895 				CLIENT_FPRINTF(stderr,
2896 				    gettext("file_backup: No %s file.\n"),
2897 				    DOMAINNAME);
2898 			} else {
2899 				CLIENT_FPRINTF(stderr,
2900 				    gettext("file_backup: Empty %s "
2901 				    "file.\n"),
2902 				    DOMAINNAME);
2903 			}
2904 	}
2905 
2906 	namelen = BUFSIZ;
2907 	(void) sysinfo(SI_SRPC_DOMAIN, &(name[0]), namelen);
2908 	namelen = strlen(name);
2909 
2910 	if (mode_verbose)
2911 		CLIENT_FPRINTF(stderr,
2912 		    gettext("file_backup: nis domain is \"%s\"\n"),
2913 		    (namelen > 0) ? name : "EMPTY");
2914 	/* check for domain name if not set cannot save NIS(YP) state */
2915 	if (namelen > 0) {
2916 		/* moving /var/yp/binding will cause ypbind to core dump */
2917 		(void) strlcpy(yp_dir, YP_BIND_DIR "/", BUFSIZE);
2918 		(void) strlcat(yp_dir, name, BUFSIZE);
2919 		yp_stat = stat(yp_dir, &buf);
2920 		if (mode_verbose)
2921 			CLIENT_FPRINTF(stderr,
2922 			    gettext("file_backup: stat(%s)=%d\n"),
2923 			    yp_dir, yp_stat);
2924 		if (yp_stat == 0) {
2925 			(void) strlcpy(yp_dir_back, LDAP_RESTORE_DIR "/",
2926 			    BUFSIZE);
2927 			(void) strlcat(yp_dir_back, name, BUFSIZE);
2928 			if (mode_verbose)
2929 				CLIENT_FPRINTF(stderr,
2930 				    gettext("file_backup: (%s -> %s)\n"),
2931 				    yp_dir, yp_dir_back);
2932 			retcode = file_move(yp_dir, yp_dir_back);
2933 			if (retcode != 0) {
2934 				CLIENT_FPRINTF(stderr,
2935 				    gettext("file_backup: file_move(%s, %s)"
2936 				    " failed with %d\n"),
2937 				    yp_dir, yp_dir_back, retcode);
2938 				ret = CLIENT_ERR_RENAME;
2939 			}
2940 		} else {
2941 			if (mode_verbose)
2942 				CLIENT_FPRINTF(stderr,
2943 				    gettext("file_backup: No %s "
2944 				    "directory.\n"), yp_dir);
2945 		}
2946 	}
2947 
2948 
2949 	/* point to file name, not path delim (/) */
2950 	ldap_conf_file = strrchr(NSCONFIGFILE, '/') + 1;
2951 	ldap_cred_file = strrchr(NSCREDFILE, '/') + 1;
2952 
2953 	ldap_stat = stat(NSCONFIGFILE, &buf);
2954 	if (mode_verbose)
2955 		CLIENT_FPRINTF(stderr,
2956 		    gettext("file_backup: stat(%s)=%d\n"),
2957 		    NSCONFIGFILE, ldap_stat);
2958 	if (ldap_stat == 0) {
2959 		(void) strlcpy(ldap_file_back, LDAP_RESTORE_DIR "/", BUFSIZE);
2960 		(void) strlcat(ldap_file_back, ldap_conf_file, BUFSIZE);
2961 		if (mode_verbose)
2962 			CLIENT_FPRINTF(stderr,
2963 			    gettext("file_backup: (%s -> %s)\n"),
2964 			    NSCONFIGFILE, ldap_file_back);
2965 		retcode = file_move(NSCONFIGFILE, ldap_file_back);
2966 		if (retcode != 0) {
2967 			CLIENT_FPRINTF(stderr,
2968 			    gettext("file_backup: file_move(%s, %s) failed "
2969 			    "with %d\n"),
2970 			    NSCONFIGFILE, ldap_file_back, retcode);
2971 			ret = CLIENT_ERR_RENAME;
2972 		}
2973 
2974 		(void) strlcpy(ldap_cred_back, LDAP_RESTORE_DIR "/", BUFSIZE);
2975 		(void) strlcat(ldap_cred_back, ldap_cred_file, BUFSIZE);
2976 		if (mode_verbose)
2977 			CLIENT_FPRINTF(stderr,
2978 			    gettext("file_backup: (%s -> %s)\n"),
2979 			    NSCREDFILE, ldap_cred_back);
2980 		retcode = file_move(NSCREDFILE, ldap_cred_back);
2981 		if (retcode != 0) {
2982 			CLIENT_FPRINTF(stderr,
2983 			    gettext("file_backup: file_move(%s, %s) failed "
2984 			    "with %d\n"),
2985 			    NSCREDFILE, ldap_cred_back, retcode);
2986 			ret = CLIENT_ERR_RENAME;
2987 		}
2988 	} else {
2989 		if (mode_verbose)
2990 			CLIENT_FPRINTF(stderr,
2991 			    gettext("file_backup: No %s file.\n"),
2992 			    NSCONFIGFILE);
2993 	}
2994 
2995 	return (ret);
2996 }
2997 
2998 /*
2999  * mod_backup()
3000  *
3001  * This function is used to temporily backup the LDAP client files in /var/ldap
3002  * that the "mod" operation needs to update.  If an error occurs then the
3003  * function mod_recover() can be invoke to recover the unmodified files.
3004  */
3005 static int
3006 mod_backup(void)
3007 {
3008 	int rc;
3009 	int retcode = CLIENT_SUCCESS;
3010 
3011 	rc = system(CMD_CP " " NSCONFIGFILE " " NSCONFIGFILE ".mod");
3012 	retcode += rc;
3013 	if (mode_verbose)
3014 		CLIENT_FPRINTF(stderr,
3015 		    gettext("mod_backup: backup %s for %s\n"),
3016 		    rc ? "failed" : "successful", NSCONFIGFILE);
3017 
3018 	rc = system(CMD_CP " " NSCREDFILE " " NSCREDFILE ".mod");
3019 	retcode += rc;
3020 	if (mode_verbose)
3021 		CLIENT_FPRINTF(stderr,
3022 		    gettext("mod_backup: backup %s for %s\n"),
3023 		    rc ? "failed" : "successful", NSCREDFILE);
3024 
3025 	rc = system(CMD_CP " " DOMAINNAME " " DOMAINNAME ".mod");
3026 	retcode += rc;
3027 	if (mode_verbose)
3028 		CLIENT_FPRINTF(stderr,
3029 		    gettext("mod_backup: backup %s for %s\n"),
3030 		    rc ? "failed" : "successful", DOMAINNAME);
3031 
3032 	if (retcode != CLIENT_SUCCESS)
3033 		retcode = CLIENT_ERR_RENAME;
3034 	return (retcode);
3035 }
3036 
3037 /*
3038  * mod_recover()
3039  *
3040  * This function is used to recover the temporily backed up files by
3041  * the mod_backup() function if an error occurs during the "mod"
3042  * operation.
3043  */
3044 static int
3045 mod_recover(void)
3046 {
3047 	int rc;
3048 	int retcode = CLIENT_SUCCESS;
3049 
3050 	rc = system(CMD_MV " " NSCONFIGFILE ".mod " NSCONFIGFILE);
3051 	retcode += rc;
3052 	if (mode_verbose)
3053 		CLIENT_FPRINTF(stderr,
3054 		    gettext("mod_recover: recovery %s for %s\n"),
3055 		    rc ? "failed" : "successful", NSCONFIGFILE);
3056 
3057 	rc = system(CMD_MV " " NSCREDFILE ".mod " NSCREDFILE);
3058 	retcode += rc;
3059 	if (mode_verbose)
3060 		CLIENT_FPRINTF(stderr,
3061 		    gettext("mod_recover: recovery %s for %s\n"),
3062 		    rc ? "failed" : "successful", NSCREDFILE);
3063 
3064 	rc = system(CMD_MV " " DOMAINNAME ".mod " DOMAINNAME);
3065 	retcode += rc;
3066 	if (mode_verbose)
3067 		CLIENT_FPRINTF(stderr,
3068 		    gettext("mod_recover: recovery %s for %s\n"),
3069 		    rc ? "failed" : "successful", DOMAINNAME);
3070 
3071 	if (retcode != CLIENT_SUCCESS)
3072 		retcode = CLIENT_ERR_RENAME;
3073 	return (retcode);
3074 }
3075 
3076 /*
3077  * mod_cleanup()
3078  *
3079  * This function removes the .mod files in /var/ldap.
3080  */
3081 static void
3082 mod_cleanup(void)
3083 {
3084 	(void) system(CMD_RM " " NSCONFIGFILE ".mod " TO_DEV_NULL);
3085 	(void) system(CMD_RM " " NSCREDFILE ".mod " TO_DEV_NULL);
3086 	(void) system(CMD_RM " " DOMAINNAME ".mod " TO_DEV_NULL);
3087 }
3088 
3089 #define	MAX_DN_ARRAY 100
3090 #define	LDAP_NAMINGCONTEXTS	"namingcontexts"
3091 
3092 static multival_t *
3093 multival_new()
3094 {
3095 	multival_t *hold;
3096 
3097 	hold = calloc(1, sizeof (multival_t));
3098 	if (hold == NULL) {
3099 		CLIENT_FPUTS(
3100 		    gettext("multival_new: Memory allocation error\n"),
3101 		    stderr);
3102 	}
3103 	return (hold);	/* NULL -> error */
3104 }
3105 
3106 static int
3107 multival_add(multival_t *list, char *opt)
3108 {
3109 	if (opt == NULL) {
3110 		CLIENT_FPUTS(
3111 		    gettext("Empty value passed to multival_add\n"),
3112 		    stderr);
3113 		return (CLIENT_ERR_FAIL);
3114 	}
3115 
3116 	if (list->count == 0) {
3117 		list->optlist = (char **)malloc(sizeof (char **));
3118 	} else {
3119 		list->optlist = (char **)realloc(list->optlist,
3120 		    (list->count + 1) * sizeof (char **));
3121 	}
3122 
3123 	if (list->optlist == NULL) {
3124 		CLIENT_FPUTS(gettext("Error allocating memory\n"), stderr);
3125 		return (CLIENT_ERR_MEMORY);	/* 0 is success */
3126 	}
3127 
3128 	list->optlist[list->count] = opt;
3129 	list->count++;
3130 
3131 	return (CLIENT_SUCCESS);
3132 }
3133 
3134 static void
3135 multival_free(multival_t *list)
3136 {
3137 	if (list == NULL)
3138 		return;
3139 
3140 	if (list->optlist != NULL)
3141 		free(list->optlist);
3142 	free(list);
3143 }
3144 
3145 static clientopts_t *
3146 clientopts_new()
3147 {
3148 	clientopts_t *hold;
3149 
3150 	hold = calloc(1, sizeof (clientopts_t));
3151 	if (NULL == hold) {
3152 		CLIENT_FPUTS(gettext("Error allocating memory for "
3153 		    "clientopts structure\n"), stderr);
3154 		return (hold);	/* NULL -> error */
3155 	}
3156 
3157 	hold->serviceAuthenticationMethod = multival_new();
3158 	if (NULL == hold->serviceAuthenticationMethod) {
3159 		CLIENT_FPUTS(gettext("Error allocating memory for "
3160 		    "serviceAuthenticationMethod\n"), stderr);
3161 		free(hold);
3162 		return (NULL);	/* NULL -> error */
3163 	}
3164 
3165 	hold->serviceCredentialLevel = multival_new();
3166 	if (NULL == hold->serviceCredentialLevel) {
3167 		CLIENT_FPUTS(gettext("Error allocating memory for "
3168 		    "serviceCredentialLevel\n"), stderr);
3169 		multival_free(hold->serviceAuthenticationMethod);
3170 		free(hold);
3171 		return (NULL);	/* NULL -> error */
3172 	}
3173 
3174 	hold->objectclassMap = multival_new();
3175 	if (NULL == hold->objectclassMap) {
3176 		CLIENT_FPUTS(gettext("Error allocating memory for "
3177 		    "objectclassMap\n"), stderr);
3178 		multival_free(hold->serviceAuthenticationMethod);
3179 		multival_free(hold->serviceCredentialLevel);
3180 		free(hold);
3181 		return (NULL);	/* NULL -> error */
3182 	}
3183 
3184 	hold->attributeMap = multival_new();
3185 	if (NULL == hold->attributeMap) {
3186 		CLIENT_FPUTS(gettext("Error allocating memory for "
3187 		    "attributeMap\n"), stderr);
3188 		multival_free(hold->serviceAuthenticationMethod);
3189 		multival_free(hold->serviceCredentialLevel);
3190 		multival_free(hold->objectclassMap);
3191 		free(hold);
3192 		return (NULL);	/* NULL -> error */
3193 	}
3194 
3195 	hold->serviceSearchDescriptor = multival_new();
3196 	if (NULL == hold->serviceSearchDescriptor) {
3197 		CLIENT_FPUTS(gettext("Error allocating memory for "
3198 		    "serviceSearchDescriptor\n"), stderr);
3199 		multival_free(hold->serviceAuthenticationMethod);
3200 		multival_free(hold->serviceCredentialLevel);
3201 		multival_free(hold->objectclassMap);
3202 		multival_free(hold->attributeMap);
3203 		free(hold);
3204 		return (NULL);	/* NULL -> error */
3205 	}
3206 
3207 	return (hold);
3208 }
3209 
3210 static void
3211 clientopts_free(clientopts_t *list)
3212 {
3213 	if (NULL == list)
3214 		return;
3215 
3216 	multival_free(list->serviceAuthenticationMethod);
3217 	multival_free(list->serviceCredentialLevel);
3218 	multival_free(list->objectclassMap);
3219 	multival_free(list->attributeMap);
3220 	multival_free(list->serviceSearchDescriptor);
3221 
3222 	free(list);
3223 
3224 }
3225 
3226 static void
3227 multival_list(char *opt, multival_t *list)
3228 {
3229 	int i;
3230 
3231 	if (list->count == 0)
3232 		return;
3233 
3234 	(void) puts(opt);
3235 	for (i = 0; i < list->count; i++) {
3236 		(void) printf("\t\targ[%d]: %s\n", i, list->optlist[i]);
3237 	}
3238 }
3239 
3240 /* return the number of arguments specified in the command line */
3241 static int
3242 num_args(clientopts_t *list)
3243 {
3244 	int arg_count = 0;
3245 
3246 	arg_count += list->authenticationMethod ? 1 : 0;
3247 	arg_count += list->serviceAuthenticationMethod->count;
3248 	arg_count += list->defaultSearchBase ? 1 : 0;
3249 	arg_count += list->credentialLevel ? 1 : 0;
3250 	arg_count += list->serviceCredentialLevel->count;
3251 	arg_count += list->domainName ? 1 : 0;
3252 	arg_count += list->proxyDN ? 1 : 0;
3253 	arg_count += list->enableShadowUpdate ? 1 : 0;
3254 	arg_count += list->adminDN ? 1 : 0;
3255 	arg_count += list->profileTTL ? 1 : 0;
3256 	arg_count += list->objectclassMap->count;
3257 	arg_count += list->searchTimeLimit ? 1 : 0;
3258 	arg_count += list->preferredServerList ? 1 : 0;
3259 	arg_count += list->profileName ? 1 : 0;
3260 	arg_count += list->followReferrals ? 1 : 0;
3261 	arg_count += list->attributeMap->count;
3262 	arg_count += list->defaultSearchScope ? 1 : 0;
3263 	arg_count += list->serviceSearchDescriptor->count;
3264 	arg_count += list->bindTimeLimit ? 1 : 0;
3265 	arg_count += list->proxyPassword ? 1 : 0;
3266 	arg_count += list->adminPassword ? 1 : 0;
3267 	arg_count += list->defaultServerList ? 1 : 0;
3268 	arg_count += list->certificatePath ? 1 : 0;
3269 
3270 	return (arg_count);
3271 }
3272 
3273 #define	CLIENT_PRINT(opt, str) if (str) \
3274 		(void) printf("%s%s\n", (opt), (str))
3275 
3276 static void
3277 dumpargs(clientopts_t *list)
3278 {
3279 	CLIENT_PRINT("\tauthenticationMethod: ", list->authenticationMethod);
3280 	multival_list("\tserviceAuthenticationMethod: ",
3281 	    list->serviceAuthenticationMethod);
3282 	CLIENT_PRINT("\tdefaultSearchBase: ", list->defaultSearchBase);
3283 	CLIENT_PRINT("\tcredentialLevel: ", list->credentialLevel);
3284 	multival_list("\tserviceCredentialLevel: ",
3285 	    list->serviceCredentialLevel);
3286 	CLIENT_PRINT("\tdomainName: ", list->domainName);
3287 	CLIENT_PRINT("\tproxyDN: ", list->proxyDN);
3288 	CLIENT_PRINT("\tadminDN: ", list->adminDN);
3289 	CLIENT_PRINT("\tenableShadowUpdate: ", list->enableShadowUpdate);
3290 	CLIENT_PRINT("\tprofileTTL: ", list->profileTTL);
3291 	multival_list("\tobjectclassMap: ", list->objectclassMap);
3292 	CLIENT_PRINT("\tsearchTimeLimit: ", list->searchTimeLimit);
3293 	CLIENT_PRINT("\tpreferredServerList: ", list->preferredServerList);
3294 	CLIENT_PRINT("\tprofileName: ", list->profileName);
3295 	CLIENT_PRINT("\tfollowReferrals: ", list->followReferrals);
3296 	multival_list("\tattributeMap: ", list->attributeMap);
3297 	CLIENT_PRINT("\tdefaultSearchScope: ", list->defaultSearchScope);
3298 	multival_list("\tserviceSearchDescriptor: ",
3299 	    list->serviceSearchDescriptor);
3300 	CLIENT_PRINT("\tbindTimeLimit: ", list->bindTimeLimit);
3301 	CLIENT_PRINT("\tproxyPassword: ", list->proxyPassword);
3302 	CLIENT_PRINT("\tadminPassword: ", list->adminPassword);
3303 	CLIENT_PRINT("\tdefaultServerList: ", list->defaultServerList);
3304 	CLIENT_PRINT("\tcertificatePath: ", list->certificatePath);
3305 }
3306 
3307 
3308 /* These definitions are only used in parseParam() below. */
3309 struct param {
3310 	char	*name;
3311 	int	index;
3312 };
3313 
3314 static struct param paramArray[] = {
3315 	{"proxyDN", NS_LDAP_BINDDN_P},
3316 	{"proxyPassword", NS_LDAP_BINDPASSWD_P},
3317 	{"defaultServerList", NS_LDAP_SERVERS_P},
3318 	{"defaultSearchBase", NS_LDAP_SEARCH_BASEDN_P},
3319 	{"authenticationMethod", NS_LDAP_AUTH_P},
3320 	{"followReferrals", NS_LDAP_SEARCH_REF_P},
3321 	{"profileTTL", NS_LDAP_CACHETTL_P},
3322 	{"certificatePath", NS_LDAP_HOST_CERTPATH_P},
3323 	{"defaultSearchScope", NS_LDAP_SEARCH_SCOPE_P},
3324 	{"bindTimeLimit", NS_LDAP_BIND_TIME_P},
3325 	{"searchTimeLimit", NS_LDAP_SEARCH_TIME_P},
3326 	{"preferredServerList", NS_LDAP_SERVER_PREF_P},
3327 	{"profileName", NS_LDAP_PROFILE_P},
3328 	{"credentialLevel", NS_LDAP_CREDENTIAL_LEVEL_P},
3329 	{"serviceSearchDescriptor", NS_LDAP_SERVICE_SEARCH_DESC_P},
3330 	{"attributeMap", NS_LDAP_ATTRIBUTEMAP_P},
3331 	{"objectclassMap", NS_LDAP_OBJECTCLASSMAP_P},
3332 	{"serviceAuthenticationMethod", NS_LDAP_SERVICE_AUTH_METHOD_P},
3333 	{"serviceCredentialLevel", NS_LDAP_SERVICE_CRED_LEVEL_P},
3334 	{"domainName", LOCAL_DOMAIN_P},
3335 	{"enableShadowUpdate", NS_LDAP_ENABLE_SHADOW_UPDATE_P},
3336 	{"adminDN", NS_LDAP_ADMIN_BINDDN_P},
3337 	{"adminPassword", NS_LDAP_ADMIN_BINDPASSWD_P},
3338 	{NULL, 0}
3339 };
3340 
3341 static int
3342 parseParam(char *param, char **paramVal)
3343 {
3344 	char *val = NULL;
3345 	int counter;
3346 
3347 	if (mode_verbose) {
3348 		CLIENT_FPRINTF(stderr, gettext("Parsing %s\n"), param);
3349 	}
3350 
3351 	val = strchr(param, '=');
3352 	if (val == NULL) {
3353 		CLIENT_FPUTS(
3354 		    gettext("Didn\'t find \'=\' character in string\n"),
3355 		    stderr);
3356 		paramVal = NULL;
3357 		return (CLIENT_ERR_PARSE);
3358 	}
3359 
3360 	*val = '\0';
3361 
3362 	for (counter = 0; paramArray[counter].name != NULL; counter++) {
3363 		if (strcasecmp(paramArray[counter].name, param) == 0) {
3364 			*paramVal = val+1;
3365 			*val = '=';	/* restore original param */
3366 			return (paramArray[counter].index);
3367 		}
3368 	}
3369 
3370 	/* Not found */
3371 	*val = '=';	/* restore original param */
3372 	*paramVal = NULL;
3373 	return (CLIENT_ERR_PARSE);
3374 }
3375 
3376 /*
3377  * The following macro checks if an option has already been specified
3378  * and errs out with usage if so
3379  */
3380 #define	CLIENT_OPT_CHECK(opt, optarg)	\
3381 if (optarg) {			\
3382 	CLIENT_FPUTS(gettext("Invalid use of option\n"), stderr);	\
3383 	usage();		\
3384 	clientopts_free(optlist); \
3385 	return (CLIENT_ERR_FAIL);		\
3386 }
3387 
3388 static int
3389 clientSetParam(clientopts_t *optlist, int paramFlag, char *attrVal)
3390 {
3391 	int retcode = 0;
3392 	int counter;
3393 
3394 
3395 	switch (paramFlag) {
3396 	case NS_LDAP_AUTH_P:
3397 		CLIENT_OPT_CHECK(paramFlag, optlist->authenticationMethod);
3398 		optlist->authenticationMethod = attrVal;
3399 		break;
3400 
3401 	case NS_LDAP_SERVICE_AUTH_METHOD_P:	/* multiple allowed */
3402 		retcode = multival_add(optlist->serviceAuthenticationMethod,
3403 		    attrVal);
3404 		if (retcode != CLIENT_SUCCESS) {
3405 			CLIENT_FPRINTF(stderr,
3406 			    gettext("Error processing attrVal %s\n"),
3407 			    attrVal?attrVal:"NULL");
3408 			usage();
3409 			clientopts_free(optlist);
3410 			return (CLIENT_ERR_FAIL);
3411 		}
3412 		break;
3413 
3414 	case NS_LDAP_SEARCH_BASEDN_P:
3415 		CLIENT_OPT_CHECK(paramFlag, optlist->defaultSearchBase);
3416 		optlist->defaultSearchBase = attrVal;
3417 		break;
3418 
3419 	case NS_LDAP_CREDENTIAL_LEVEL_P:
3420 		CLIENT_OPT_CHECK(paramFlag, optlist->credentialLevel);
3421 		optlist->credentialLevel = attrVal;
3422 		break;
3423 
3424 	case NS_LDAP_SERVICE_CRED_LEVEL_P:	/* multiple allowed */
3425 		retcode = multival_add(optlist->serviceCredentialLevel,
3426 		    attrVal);
3427 		if (retcode != CLIENT_SUCCESS) {
3428 			CLIENT_FPRINTF(stderr,
3429 			    gettext("Error processing attrVal %s\n"),
3430 			    attrVal?attrVal:"NULL");
3431 			usage();
3432 			clientopts_free(optlist);
3433 			return (CLIENT_ERR_FAIL);
3434 		}
3435 		break;
3436 
3437 	case LOCAL_DOMAIN_P:
3438 		CLIENT_OPT_CHECK(paramFlag, optlist->domainName);
3439 		optlist->domainName = attrVal;
3440 		dname = optlist->domainName;
3441 		break;
3442 
3443 	case NS_LDAP_BINDDN_P:
3444 		CLIENT_OPT_CHECK(paramFlag, optlist->proxyDN);
3445 		optlist->proxyDN = attrVal;
3446 		break;
3447 
3448 	case NS_LDAP_ENABLE_SHADOW_UPDATE_P:
3449 		CLIENT_OPT_CHECK(paramFlag, optlist->enableShadowUpdate);
3450 		optlist->enableShadowUpdate = attrVal;
3451 		break;
3452 
3453 	case NS_LDAP_ADMIN_BINDDN_P:
3454 		CLIENT_OPT_CHECK(paramFlag, optlist->adminDN);
3455 		optlist->adminDN = attrVal;
3456 		break;
3457 
3458 	case NS_LDAP_CACHETTL_P:
3459 		CLIENT_OPT_CHECK(paramFlag, optlist->profileTTL);
3460 		optlist->profileTTL = attrVal;
3461 		break;
3462 
3463 	case NS_LDAP_OBJECTCLASSMAP_P:	/* multiple allowed */
3464 		retcode = multival_add(optlist->objectclassMap, attrVal);
3465 		if (retcode != CLIENT_SUCCESS) {
3466 			CLIENT_FPRINTF(stderr,
3467 			    gettext("Error processing attrVal %s\n"),
3468 			    attrVal?attrVal:"NULL");
3469 			usage();
3470 			clientopts_free(optlist);
3471 			return (CLIENT_ERR_FAIL);
3472 		}
3473 		break;
3474 
3475 	case NS_LDAP_SEARCH_TIME_P:
3476 		CLIENT_OPT_CHECK(paramFlag, optlist->searchTimeLimit);
3477 		optlist->searchTimeLimit = attrVal;
3478 		break;
3479 
3480 	case NS_LDAP_SERVER_PREF_P:
3481 		CLIENT_OPT_CHECK(paramFlag, optlist->preferredServerList);
3482 		optlist->preferredServerList = attrVal;
3483 		/* replace ',' chars with ' ' for proper syntax */
3484 		for (counter = 0;
3485 		    counter < strlen(optlist->preferredServerList);
3486 		    counter++) {
3487 
3488 			if (optlist->preferredServerList[counter] == ',')
3489 				optlist->preferredServerList[counter] = ' ';
3490 		}
3491 		break;
3492 
3493 	case NS_LDAP_PROFILE_P:
3494 		CLIENT_OPT_CHECK(paramFlag, optlist->profileName);
3495 		optlist->profileName = attrVal;
3496 		break;
3497 
3498 	case NS_LDAP_SEARCH_REF_P:
3499 		CLIENT_OPT_CHECK(paramFlag, optlist->followReferrals);
3500 		if (0 == strcasecmp(attrVal, "followref"))
3501 			optlist->followReferrals = "TRUE";
3502 		else if (0 == strcasecmp(attrVal, "noref"))
3503 			optlist->followReferrals = "FALSE";
3504 		else
3505 			optlist->followReferrals = attrVal;
3506 		break;
3507 
3508 	case NS_LDAP_ATTRIBUTEMAP_P:	/* multiple allowed */
3509 		retcode = multival_add(optlist->attributeMap, attrVal);
3510 		if (retcode != CLIENT_SUCCESS) {
3511 			CLIENT_FPRINTF(stderr,
3512 			    gettext("Error processing attrVal %s\n"),
3513 			    attrVal?attrVal:"NULL");
3514 			usage();
3515 			clientopts_free(optlist);
3516 			return (CLIENT_ERR_FAIL);
3517 		}
3518 		break;
3519 
3520 	case NS_LDAP_SEARCH_SCOPE_P:
3521 		CLIENT_OPT_CHECK(paramFlag, optlist->defaultSearchScope);
3522 		optlist->defaultSearchScope = attrVal;
3523 		break;
3524 
3525 	case NS_LDAP_SERVICE_SEARCH_DESC_P:	/* multiple allowed */
3526 		retcode = multival_add(optlist->serviceSearchDescriptor,
3527 		    attrVal);
3528 		if (retcode != CLIENT_SUCCESS) {
3529 			CLIENT_FPRINTF(stderr,
3530 			    gettext("Error processing attrVal %s\n"),
3531 			    attrVal?attrVal:"NULL");
3532 			usage();
3533 			clientopts_free(optlist);
3534 			return (CLIENT_ERR_FAIL);
3535 		}
3536 		break;
3537 
3538 	case NS_LDAP_BIND_TIME_P:
3539 		CLIENT_OPT_CHECK(paramFlag, optlist->bindTimeLimit);
3540 		optlist->bindTimeLimit = attrVal;
3541 		break;
3542 
3543 	case NS_LDAP_BINDPASSWD_P:
3544 		CLIENT_OPT_CHECK(paramFlag, optlist->proxyPassword);
3545 		optlist->proxyPassword = attrVal;
3546 		break;
3547 
3548 	case NS_LDAP_ADMIN_BINDPASSWD_P:
3549 		CLIENT_OPT_CHECK(paramFlag, optlist->adminPassword);
3550 		optlist->adminPassword = attrVal;
3551 		break;
3552 
3553 	case NS_LDAP_HOST_CERTPATH_P:
3554 		CLIENT_OPT_CHECK(paramFlag, optlist->certificatePath);
3555 		optlist->certificatePath = attrVal;
3556 		break;
3557 
3558 	case NS_LDAP_SERVERS_P:
3559 		CLIENT_OPT_CHECK(paramFlag, optlist->defaultServerList);
3560 		optlist->defaultServerList = attrVal;
3561 		break;
3562 
3563 	default:
3564 		usage();
3565 		return (CLIENT_ERR_FAIL);
3566 		/* break;  lint doesn't like break before end of switch */
3567 	}
3568 
3569 	return (retcode);
3570 }
3571 
3572 /*
3573  * file_move() - Used to move a config file (backup/restore).
3574  *
3575  * This function uses a system() call with /bin/mv to handle the
3576  * case where the backup directory (/var) is on a different file
3577  * system than the config file (typically /etc).
3578  */
3579 static int
3580 file_move(const char *from, const char *to)
3581 {
3582 	int retcode;
3583 	char mvCommand[] = CMD_MV;
3584 	char cmd_buffer[(2 * MAXPATHLEN) + sizeof (mvCommand) + 3];
3585 
3586 	(void) snprintf(cmd_buffer, sizeof (cmd_buffer), "%s %s %s",
3587 	    mvCommand, from, to);
3588 
3589 	/*
3590 	 * This function should only be used internally to move
3591 	 * system files to/from the backup directory.  For security
3592 	 * reasons (this is run as root), don't use this function
3593 	 * with arguments passed into the program.
3594 	 */
3595 	retcode = system(cmd_buffer);
3596 
3597 	return (retcode);
3598 }
3599 
3600 
3601 /*
3602  * Manipulate the service as instructed by "dowhat"
3603  */
3604 static int
3605 do_service(const char *fmri, boolean_t waitflag, int dowhat,
3606 		const char *state) {
3607 
3608 	int		status;
3609 	boolean_t	is_maint;
3610 	const char	*what = gettext("not set");
3611 	useconds_t	max;
3612 
3613 	/* Check if we are in maintenance */
3614 	is_maint = is_service(fmri, SCF_STATE_STRING_MAINT);
3615 
3616 	switch (dowhat) {
3617 	case START_SERVICE:
3618 		what = gettext("start");
3619 		status = smf_enable_instance(fmri,
3620 			(sysid_install == B_TRUE)?SMF_TEMPORARY:0);
3621 		break;
3622 	case STOP_SERVICE:
3623 		what = gettext("stop");
3624 		status = smf_disable_instance(fmri,
3625 			(sysid_install == B_TRUE)?SMF_TEMPORARY:0);
3626 		break;
3627 	case RESTART_SERVICE:
3628 		what = gettext("restart");
3629 		status = smf_restart_instance(fmri);
3630 		break;
3631 	default:
3632 		/* coding error; will not happen */
3633 		assert(0);
3634 	}
3635 
3636 	/*
3637 	 * If the service was previously in maintenance then we need to
3638 	 * clear it immediately.  The "dowhat" action will set the
3639 	 * enabled property of the service as intended by the caller while
3640 	 * clear will actually cause it to be enabled/disabled.
3641 	 * We assume that the caller has called us after taking some
3642 	 * recovery action. Even if it's not the case, we don't lose
3643 	 * anything.
3644 	 */
3645 	if (status == 0 && is_maint == B_TRUE) {
3646 		if (mode_verbose)
3647 			CLIENT_FPRINTF(stderr,
3648 				"%s: %s... %s\n",
3649 				what,
3650 				fmri,
3651 				gettext("restoring from maintenance state"));
3652 		status = smf_restore_instance(fmri);
3653 	}
3654 
3655 	if (status == 0) {
3656 		/* Check if we need to wait ? */
3657 		if (waitflag == B_FALSE) {
3658 			if (mode_verbose)
3659 				CLIENT_FPRINTF(stderr,
3660 					"%s: %s... %s\n",
3661 					what,
3662 					fmri,
3663 					gettext("success"));
3664 			return (CLIENT_SUCCESS);
3665 		}
3666 
3667 		/* Otherwise wait for max seconds (from the manifest) */
3668 		max = get_timeout_value(dowhat, fmri, DEFAULT_TIMEOUT);
3669 		status = wait_till(fmri, state, max, what, !is_maint);
3670 		if (status == CLIENT_SUCCESS)
3671 			return (CLIENT_SUCCESS);
3672 		/* For error fall through for corrective action */
3673 	} else {
3674 		/* Well, service failed ... */
3675 		if (mode_verbose)
3676 			CLIENT_FPRINTF(stderr, "%s: %s... %s: %s\n",
3677 				what,
3678 				fmri,
3679 				gettext("failed"),
3680 				scf_strerror(scf_error()));
3681 		status = CLIENT_ERR_FAIL;
3682 		/* For error fall through for corrective action */
3683 	}
3684 
3685 	/*
3686 	 * If service is still offline after start/restart, then transitioning
3687 	 * failed and guess is restarter failed to apply the timeout as well.
3688 	 * So instead of leaving it offline, let's just disable it until we have
3689 	 * some other mechanism available from smf to handle such situation.
3690 	 */
3691 	if (dowhat != STOP_SERVICE)
3692 		if (is_service(fmri, SCF_STATE_STRING_OFFLINE)) {
3693 			if (mode_verbose)
3694 				CLIENT_FPRINTF(stderr,
3695 					"%s: %s... %s\n",
3696 					what,
3697 					fmri,
3698 					gettext("offline to disable"));
3699 			(void) disable_service(fmri, waitflag);
3700 		}
3701 
3702 	return (status);
3703 }
3704 
3705 
3706 /*
3707  * Wait for "max" usecs for the service described by "fmri" to change
3708  * to "state". If check_maint is true then return immediately if
3709  * service goes into maintenance
3710  */
3711 static int
3712 wait_till(const char *fmri, const char *state, useconds_t max,
3713 		const char *what, boolean_t check_maint) {
3714 	char *st;
3715 	useconds_t usecs = INIT_WAIT_USECS;
3716 
3717 	for (; max > 0; max -= usecs) {
3718 		/* incremental wait */
3719 		usecs *= 2;
3720 		usecs = (usecs > max)?max:usecs;
3721 		if (mode_verbose)
3722 			CLIENT_FPRINTF(stderr,
3723 				"%s: %s %u %s\n",
3724 				what, gettext("sleep"), usecs,
3725 				gettext("microseconds"));
3726 		(void) usleep(usecs);
3727 
3728 		/* Check state after the wait */
3729 		if ((st = smf_get_state(fmri)) != NULL) {
3730 			if (strcmp(st, state) == 0) {
3731 				if (mode_verbose)
3732 					CLIENT_FPRINTF(stderr,
3733 						"%s: %s... %s\n",
3734 						what,
3735 						fmri,
3736 						gettext("success"));
3737 				free(st);
3738 				return (CLIENT_SUCCESS);
3739 			}
3740 
3741 			/*
3742 			 * If service has gone into maintenance then
3743 			 * we will time out anyway, so we are better
3744 			 * off returning now
3745 			 */
3746 			if (check_maint &&
3747 				strcmp(st, SCF_STATE_STRING_MAINT) == 0) {
3748 				if (mode_verbose)
3749 					CLIENT_FPRINTF(stderr,
3750 						"%s: %s... %s\n",
3751 						what,
3752 						fmri,
3753 						gettext("maintenance"));
3754 				free(st);
3755 				return (CLIENT_ERR_MAINTENANCE);
3756 			}
3757 			free(st);
3758 		} else {
3759 			if (mode_verbose)
3760 				CLIENT_FPRINTF(stderr,
3761 						"%s: %s... %s: %s\n",
3762 						what,
3763 						fmri,
3764 						gettext("failed"),
3765 						scf_strerror(scf_error()));
3766 			return (CLIENT_ERR_FAIL);
3767 		}
3768 	}
3769 
3770 	/* Timed out waiting */
3771 	if (mode_verbose)
3772 		CLIENT_FPRINTF(stderr,
3773 			"%s: %s... %s\n",
3774 			what,
3775 			fmri,
3776 			gettext("timed out"));
3777 	return (CLIENT_ERR_TIMEDOUT);
3778 }
3779 
3780 
3781 static boolean_t
3782 is_service(const char *fmri, const char *state) {
3783 	char		*st;
3784 	boolean_t	result = B_FALSE;
3785 
3786 	if ((st = smf_get_state(fmri)) != NULL) {
3787 		if (strcmp(st, state) == 0)
3788 			result = B_TRUE;
3789 		free(st);
3790 	}
3791 	return (result);
3792 }
3793 
3794 
3795 /*
3796  *
3797  * get_timeout_val : returns the timeout value set in fmri manifest
3798  * 	inputs	: action(start/stop)
3799  *	fmri(defined fmri string)
3800  *	Returns default if error, the timeout val otherwise
3801  *
3802  */
3803 
3804 static useconds_t
3805 get_timeout_value(int dowhat, const char *fmri, useconds_t default_val)
3806 {
3807 	scf_simple_prop_t	*sp = NULL;
3808 	uint64_t		*cp = NULL;
3809 	int			timeout = default_val/1000000;
3810 	char			*action = NULL;
3811 	const char		*actionstr = NULL;
3812 
3813 	switch (dowhat)  {
3814 		case START_SERVICE:
3815 		case RESTART_SERVICE:
3816 				action = "start";
3817 				actionstr = gettext("start");
3818 				break;
3819 		case STOP_SERVICE:
3820 				action = "stop";
3821 				actionstr = gettext("stop");
3822 				break;
3823 		default:
3824 			assert(0);
3825 	}
3826 
3827 
3828 	sp = scf_simple_prop_get(NULL, fmri, action, SCF_PROPERTY_TIMEOUT);
3829 	if (sp == NULL) {
3830 		if (mode_verbose)
3831 			CLIENT_FPRINTF(stderr, "%s: %s... %s: %s\n",
3832 			    actionstr,
3833 			    fmri,
3834 			    gettext("failed to retrieve timeout property"),
3835 			    scf_strerror(scf_error()));
3836 		return (default_val);
3837 	}
3838 
3839 	cp = scf_simple_prop_next_count(sp);
3840 	if (cp == NULL) {
3841 		if (mode_verbose)
3842 			CLIENT_FPRINTF(stderr, "%s: %s... %s: %s\n",
3843 			    actionstr,
3844 			    fmri,
3845 			    gettext("failed to retrieve timeout value"),
3846 			    scf_strerror(scf_error()));
3847 		scf_simple_prop_free(sp);
3848 		return (default_val);
3849 	}
3850 
3851 	if (*cp != 0)
3852 		timeout = *cp;
3853 	scf_simple_prop_free(sp);
3854 	return (timeout * 1000000);
3855 }
3856