#!/bin/bash
#
# ldap	This shell script takes care of starting and stopping
#	ldap servers (slapd and slurpd).
#
# chkconfig: - 27 73
# description: LDAP stands for Lightweight Directory Access Protocol, used \
#              for implementing the industry standard directory services.
# processname: slapd
# config: /etc/openldap/slapd.conf
# pidfile: /var/run/openldap/slapd.pid

# Source function library.
. /etc/init.d/functions

# Source networking configuration and check that networking is up.
if [ -r /etc/sysconfig/network ] ; then
	. /etc/sysconfig/network
	[ ${NETWORKING} = "no" ] && exit 0
fi

# Source an auxiliary options file if we have one, and pick up OPTIONS,
# SLAPD_OPTIONS, SLURPD_OPTIONS, SLAPD_LDAPS, SLAPD_LDAPI, and maybe
# KRB5_KTNAME.
if [ -r /etc/sysconfig/ldap ] ; then
	. /etc/sysconfig/ldap
fi

slapd=/usr/sbin/slapd
slurpd=/usr/sbin/slurpd
slaptest=/usr/sbin/slaptest
[ -x ${slapd} ] || exit 0
[ -x ${slurpd} ] || exit 0

RETVAL=0

#
# Pass commands given in $2 and later to "test" run as user given in $1.
#
function testasuser() {
    local user= cmd=
    user="$1"
    shift
    cmd="$@"
    if test x"$user" != x ; then
	if test x"$cmd" != x ; then
	    /sbin/runuser -f -m -s /bin/sh -c "test $cmd" -- "$user"
	else
	    false
	fi
    else
	false
    fi
}

#
# Check for read-access errors for the user given in $1 for a service named $2.
# If $3 is specified, the command is run if "klist" can't be found.
#
function checkkeytab() {
    local user= service= klist= default=
    user="$1"
    service="$2"
    default="${3:-false}"
    if test -x /usr/kerberos/bin/klist ; then
	klist=/usr/kerberos/bin/klist
    elif test -x /usr/bin/klist ; then
	klist=/usr/bin/klist
    fi
    KRB5_KTNAME="${KRB5_KTNAME:-/etc/krb5.keytab}"
    export KRB5_KTNAME
    if test -s "$KRB5_KTNAME" ; then
	if test x"$klist" != x ; then
	    if LANG=C $klist -k "$KRB5_KTNAME" | tail -n 4 | awk '{print $2}' | grep -q ^"$service"/ ; then
		if ! testasuser "$user" -r ${KRB5_KTNAME:-/etc/krb5.keytab} ; then
		    true
		else
		    false
		fi
	    else
		false
	    fi
	else
	    $default
	fi
    else
	false
    fi
}

function configtest() {
	local user= ldapuid= dbdir= file=
	# Check for simple-but-common errors.
	user=ldap
	prog=`basename ${slapd}`
	ldapuid=`id -u $user`
	# Unaccessible database files.
	slaptestflags=
	for dbdir in `LANG=C egrep '^directory[[:space:]]+[[:print:]]+$' /etc/openldap/slapd.conf | sed s,^directory,,` ; do
		for file in `find ${dbdir}/ -not -uid $ldapuid -and \( -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" -or -name "log.*" -or -name alock \)` ; do
			echo -n $"$file is not owned by \"$user\"" ; warning ; echo
		done
		if ! test -s ${dbdir}/id2entry.dbb ; then
			if ! test -s ${dbdir}/id2entry.gdbm ; then
				if ! test -s ${dbdir}/id2entry.bdb ; then
					slaptestflags=-u
				fi
			fi
		fi
	done
	# Unaccessible keytab with an "ldap" key.
	if checkkeytab $user ldap ; then
		file=${KRB5_KTNAME:-/etc/krb5.keytab}
		echo -n $"$file is not readable by \"$user\"" ; warning ; echo
	fi
	# Unaccessible TLS configuration files.
	tlsconfigs=`LANG=C egrep '^(TLSCACertificateFile|TLSCertificateFile|TLSCertificateKeyFile)[[:space:]]' /etc/openldap/slapd.conf | awk '{print $2}'`
	for file in $tlsconfigs ; do
		if ! testasuser $user -r $file ; then
			echo -n $"$file is not readable by \"$user\"" ; warning ; echo
		fi
	done
	# Check the configuration file.
	slaptestout=`/sbin/runuser -m -s "$slaptest" -- "$user" $slaptestflags 2>&1`
	slaptestexit=$?
	# print warning if slaptest passed but reports some problems
	if test $slaptestexit == 0  -a  -n "$slaptestout" ; then
		echo -n $"Checking configuration files for $prog: " ; warning ; echo
		echo "$slaptestout"
	fi
	# report error if configuration file is wrong
	if test $slaptestexit != 0 ; then
		echo -n $"Checking configuration files for $prog: " ; failure ; echo
		echo "$slaptestout"
		if /sbin/runuser -m -s "$slaptest" -- "$user" "-u" > /dev/null 2> /dev/null ; then
			dirs=`LANG=C egrep '^directory[[:space:]]+[[:print:]]+$' /etc/openldap/slapd.conf | awk '{print $2}'`
			for directory in $dirs ; do
				if test -r $directory/__db.001 ; then
					echo -n $"stale lock files may be present in $directory" ; warning ; echo
				fi
			done
		fi
		exit 1
	fi
}

function start() {
	configtest
	# Define a couple of local variables which we'll need. Maybe.
	user=ldap
	prog=`basename ${slapd}`
	harg="ldap:///"
	if grep -q ^TLS /etc/openldap/slapd.conf || test x$SLAPD_LDAPS = xyes ; then
	    harg="$harg ldaps:///"
	fi
	if test x$SLAPD_LDAPI = xyes ; then
	    harg="$harg ldapi:///"
	fi
	# Start daemons.
	echo -n $"Starting $prog: "
	daemon --check=$prog ${slapd} -h "\"$harg\"" -u ${user} $OPTIONS $SLAPD_OPTIONS 
	RETVAL=$?
	echo
	if [ $RETVAL -eq 0 ]; then
	    if grep -q "^replogfile" /etc/openldap/slapd.conf; then
		prog=`basename ${slurpd}`
		i=1;
		for replogfile in `grep  "^replogfile" /etc/openldap/slapd.conf`
		do
		    if [ "$replogfile" != "replogfile" ]
		    then
			echo -n $"Starting $prog: "
			daemon ${slurpd} -r $replogfile -n $i
			# make the return value nozero if any of the slurpd failed
			RET=$?
			if [ $RET -ne 0 ] ; then
			    RETVAL=$RET
			fi
			i=$[i+1]
			echo
		    fi
		done
	    fi
	fi
	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/ldap
	return $RETVAL
}

function stop() {
	# Stop daemons.
	prog=`basename ${slapd}`
	echo -n $"Stopping $prog: "
	killproc ${slapd}
	RETVAL=$?
	echo
	if [ $RETVAL -eq 0 ]; then
	    if grep -q "^replogfile" /etc/openldap/slapd.conf; then
		prog=`basename ${slurpd}`
		echo -n $"Stopping $prog: "
		killproc ${slurpd}
		RETVAL=$?
		echo
	    fi
	fi
	[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/ldap /var/run/slapd.args
	return $RETVAL
}

# See how we were called.
case "$1" in
    configtest)
	configtest
	;;
    start)
	start
	;;
    stop)
	stop
	;;
    status)
	status ${slapd}
	if grep -q "^replogfile" /etc/openldap/slapd.conf ; then
	    status ${slurpd}
	fi
	;;
    restart)
	stop
	start
	;;
    condrestart)
	if [ -f /var/lock/subsys/ldap ] ; then
	    stop
	    start
	fi
	;;
    *)
	echo $"Usage: $0 {start|stop|restart|status|condrestart}"
	RETVAL=1
esac

exit $RETVAL