libsldap/common/ns_standalone.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2008, 2012, Oracle and/or its affiliates. All rights reserved.
 */

#define __STANDALONE_MODULE__

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
#include <libintl.h>
#include <string.h>
#include <ctype.h>

#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <syslog.h>
#include <locale.h>
#include <errno.h>
#include <sys/time.h>

#include <arpa/inet.h>
#include <netdb.h>
#include <strings.h>

#include <thread.h>

#include <nsswitch.h>
#include <nss_dbdefs.h>
#include <nss.h>

#include "ns_cache_door.h"
#include "ns_internal.h"
#include "ns_connmgmt.h"

extern int str2hostent(const char *, int, void *, char *, int);
extern int str2hostent6(const char *, int, void *, char *, int);

typedef enum {
    INFO_SERVER_JUST_INITED = -1,
    INFO_SERVER_UNKNOWN = 0,
    INFO_SERVER_CONNECTING  = 1,
    INFO_SERVER_UP      = 2,
    INFO_SERVER_ERROR   = 3,
    INFO_SERVER_REMOVED = 4
} dir_server_status_t;

typedef enum {
    INFO_STATUS_NEW     = 2,
    INFO_STATUS_OLD     = 3
} dir_server_info_t;

typedef struct dir_server {
    char            *ip;
    char            **controls;
    char            **saslMech;
    ns_ldap_server_type_t   serverType;
    dir_server_status_t status;
    mutex_t         updateStatus;
    dir_server_info_t   info;
} dir_server_t;

typedef struct dir_server_list {
    dir_server_t    **nsServers;

    rwlock_t    listDestroyLock;
} dir_server_list_t;

struct {
    /* The local list of the directory servers' root DSEs. */
    dir_server_list_t   *list;
    /* The flag indicating if libsldap is in the 'Standalone' mode. */
    int         standalone;
    /*
     * The mutex ensuring that only one thread performs
     * the initialization of the list.
     */
    mutex_t         listReplaceLock;
    /*
     * A flag indicating that a particular thread is
     * in the 'ldap_cachemgr' mode. It is stored by thread as
     * a thread specific data.
     */
    const int       initFlag;
    /*
     * A thread specific key storing
     * the the 'ldap_cachemgr' mode indicator.
     */
    thread_key_t        standaloneInitKey;
} dir_servers = {NULL, 0, DEFAULTMUTEX, '1'};

typedef struct switchDatabase {
    char *conf;
    uint32_t alloced;
} switch_database_t;

static thread_key_t switchConfigKey;

#pragma init(createStandaloneKey)

#define DONT_INCLUDE_ATTR_NAMES 0
#define INCLUDE_ATTR_NAMES  1
#define IS_PROFILE      1
#define NOT_PROFILE     0
/* INET6_ADDRSTRLEN + ":" + <5-digit port> + some round-up */
#define MAX_HOSTADDR_LEN (INET6_ADDRSTRLEN + 6 + 12)

static
void
switch_conf_disposer(void *data)
{
    switch_database_t *localData = (switch_database_t *)data;

    free(localData->conf);
    free(localData);
}

/*
 * This function initializes an indication that a thread obtaining a root DSE
 * will be switched to the 'ldap_cachemgr' mode. Within the thread libsldap
 * will not invoke the __s_api_requestServer function. Instead, the library
 * will establish a connection to the server specified by
 * the __ns_ldap_getRootDSE function.
 * Since  ldap_cachmgr can obtain a DUAProfile and root DSEs at the same time
 * and we do not want to affect a thread obtaining a DUAProfile,
 * the 'ldap_cachemgr' mode is thread private.
 * In addition, this function creates a key holding temporary configuration
 * for the "hosts" and "ipnodes" databases which is used by the "SKIPDB"
 * mechanism (__s_api_ip2hostname() & _s_api_hostname2ip()).
 */
static
void
createStandaloneKey()
{
    if (thr_keycreate(&dir_servers.standaloneInitKey, NULL) != 0) {
        syslog(LOG_ERR, gettext("libsldap: unable to create a thread "
        "key needed for sharing ldap connections"));
    }
    if (thr_keycreate(&switchConfigKey, switch_conf_disposer) != 0) {
        syslog(LOG_ERR, gettext("libsldap: unable to create a thread "
            "key containing current nsswitch configuration"));
    }
}

/*
 * This function sets the 'ldap_cachemgr' mode indication.
 */
void
__s_api_setInitMode()
{
    (void) thr_setspecific(dir_servers.standaloneInitKey,
        (void *) &dir_servers.initFlag);
}

/*
 * This function unset the 'ldap_cachemgr' mode indication.
 */
void
__s_api_unsetInitMode()
{
    (void) thr_setspecific(dir_servers.standaloneInitKey, NULL);
}

/*
 * This function checks if the 'ldap_cachemgr' mode indication is set.
 */
int
__s_api_isInitializing() {
    int *flag = NULL;

    (void) thr_getspecific(dir_servers.standaloneInitKey, (void **) &flag);

    return (flag != NULL && *flag == dir_servers.initFlag);
}

/*
 * This function checks if the process runs in the 'Standalone' mode.
 * In this mode libsldap will check the local, process private list of root DSEs
 * instead of requesting them via a door call to ldap_cachemgr.
 */
int
__s_api_isStandalone()
{
    int mode;

    (void) mutex_lock(&dir_servers.listReplaceLock);
    mode = dir_servers.standalone;
    (void) mutex_unlock(&dir_servers.listReplaceLock);

    return (mode);
}


static
int
remove_ldap(char *dst, char *src, int dst_buf_len)
{
    int i = 0;

    if (strlen(src) >= dst_buf_len)
        return (0);

    while (*src != '\0') {
        /* Copy up to one space from source. */
        if (isspace(*src)) {
            dst[i++] = *src;
            while (isspace(*src))
                src++;
        }

        /* If not "ldap", just copy. */
        if (strncmp(src, "ldap", 4) != 0) {
            while (!isspace(*src)) {
                dst[i++] = *src++;
                /* At the end of string? */
                if (dst[i-1] == '\0')
                    return (1);
            }
            /* Copy up to one space from source. */
            if (isspace(*src)) {
                dst[i++] = *src;
                while (isspace(*src))
                    src++;
            }
            /* Copy also the criteria section */
            if (*src == '[')
                while (*src != ']') {
                    dst[i++] = *src++;
                    /* Shouln't happen if format is right */
                    if (dst[i-1] == '\0')
                        return (1);
                }
        }

        /* If next part is ldap, skip over it ... */
        if (strncmp(src, "ldap", 4) == 0) {
            if (isspace(*(src+4)) || *(src+4) == '\0') {
                src += 4;
                while (isspace(*src))
                    src++;
                if (*src == '[') {
                    while (*src++ != ']') {
                        /*
                         * See comment above about
                         * correct format.
                         */
                        if (*src == '\0') {
                            dst[i++] = '\0';
                            return (1);
                        }
                    }
                }
                while (isspace(*src))
                    src++;
            }
        }
        if (*src == '\0')
            dst[i++] = '\0';
    }

    return (1);
}

static
char *
get_db(const char *db_name)
{
    char            *ptr;
    switch_database_t   *hostService = NULL;
    FILE            *fp = fopen(__NSW_CONFIG_FILE, "rF");
    char            *linep, line[NSS_BUFSIZ];

    if (fp == NULL) {
        syslog(LOG_WARNING, gettext("libsldap: can not read %s"),
            __NSW_CONFIG_FILE);
        return (NULL);
    }

    while ((linep = fgets(line, NSS_BUFSIZ, fp)) != NULL) {
        while (isspace(*linep)) {
            ++linep;
        }
        if (*linep == '#') {
            continue;
        }
        if (strncmp(linep, db_name, strlen(db_name)) != 0) {
            continue;
        }
        if ((linep = strchr(linep, ':')) != NULL) {
            if (linep[strlen(linep) - 1] == '\n') {
                linep[strlen(linep) - 1] = '\0';
            }

            while (isspace(*++linep))
                ;

            if ((ptr = strchr(linep, '#')) != NULL) {
                while (--ptr >= linep && isspace(*ptr))
                    ;
                *(ptr + 1) = '\0';
            }

            if (strlen(linep) == 0) {
                continue;
            }
            break;
        }
    }

    (void) fclose(fp);

    if (linep == NULL) {
        syslog(LOG_WARNING,
            gettext("libsldap: the %s database "
            "is missing from %s"),
            db_name,
            __NSW_CONFIG_FILE);
        return (NULL);
    }

    (void) thr_getspecific(switchConfigKey, (void **) &hostService);
    if (hostService == NULL) {
        hostService = calloc(1, sizeof (switch_database_t));
        if (hostService == NULL) {
            return (NULL);
        }
        (void) thr_setspecific(switchConfigKey, hostService);
    }

    /*
     * In a long-living process threads can perform several
     * getXbyY requests. And the windows between those requests
     * can be long. The nsswitch configuration can change from time
     * to time. So instead of allocating/freeing memory every time
     * the API is called, reallocate memory only when the current
     * configuration for the database being used is longer than
     * the previous one.
     */
    if (strlen(linep) >= hostService->alloced) {
        ptr = (char *)realloc((void *)hostService->conf,
            strlen(linep) + 1);
        if (ptr == NULL) {
            free((void *)hostService->conf);
            hostService->conf = NULL;
            hostService->alloced = 0;
            return (NULL);
        }
        bzero(ptr, strlen(linep) + 1);
        hostService->conf = ptr;
        hostService->alloced = strlen(linep) + 1;
    }

    if (remove_ldap(hostService->conf, linep, hostService->alloced))
        return (hostService->conf);
    else
        return (NULL);
}

static
void
_initf_ipnodes(nss_db_params_t *p)
{
    char *services = get_db("ipnodes");

    p->name = NSS_DBNAM_IPNODES;
    p->flags |= NSS_USE_DEFAULT_CONFIG;
    p->default_config = services == NULL ? "" : services;
}

static
void
_initf_hosts(nss_db_params_t *p)
{
    char *services = get_db("hosts");

    p->name = NSS_DBNAM_HOSTS;
    p->flags |= NSS_USE_DEFAULT_CONFIG;
    p->default_config = services == NULL ? "" : services;
}

/*
 * This function is an analog of the standard gethostbyaddr_r()
 * function with an exception that it removes the 'ldap' back-end
 * (if any) from the host/ipnodes nsswitch's databases and then
 * looks up using remaining back-ends.
 */
static
struct hostent *
_filter_gethostbyaddr_r(const char *addr, int len, int type,
    struct hostent *result, char *buffer, int buflen,
    int *h_errnop)
{
    DEFINE_NSS_DB_ROOT(db_root_hosts);
    DEFINE_NSS_DB_ROOT(db_root_ipnodes);
    nss_XbyY_args_t arg;
    nss_status_t    res;
    int     (*str2ent)();
    void        (*nss_initf)();
    nss_db_root_t   *nss_db_root;
    int     dbop;

    switch (type) {
    case AF_INET:
        str2ent     = str2hostent;
        nss_initf   = _initf_hosts;
        nss_db_root = &db_root_hosts;
        dbop        = NSS_DBOP_HOSTS_BYADDR;
        break;
    case AF_INET6:
        str2ent     = str2hostent6;
        nss_initf   = _initf_ipnodes;
        nss_db_root = &db_root_ipnodes;
        dbop        = NSS_DBOP_IPNODES_BYADDR;
    default:
        return (NULL);
    }

    NSS_XbyY_INIT(&arg, result, buffer, buflen, str2ent);

    arg.key.hostaddr.addr   = addr;
    arg.key.hostaddr.len    = len;
    arg.key.hostaddr.type   = type;
    arg.stayopen        = 0;
    arg.h_errno     = NETDB_SUCCESS;

    res = nss_search(nss_db_root, nss_initf, dbop, &arg);
    arg.status = res;
    *h_errnop = arg.h_errno;
    return (struct hostent *)NSS_XbyY_FINI(&arg);
}

/*
 * This routine is an analog of gethostbyaddr_r().
 * But in addition __s_api_hostname2ip() performs the "LDAP SKIPDB" activity
 * prior to querying the name services.
 * If the buffer is not big enough to accommodate a returning data,
 * NULL is returned and h_errnop is set to TRY_AGAIN.
 */
struct hostent *
__s_api_hostname2ip(const char *name,
    struct hostent *result, char *buffer, int buflen,
    int *h_errnop)
{
    DEFINE_NSS_DB_ROOT(db_root_ipnodes);
    DEFINE_NSS_DB_ROOT(db_root_hosts);
    nss_XbyY_args_t arg;
    nss_status_t    res;
    struct in_addr  addr;
    struct in6_addr addr6;

    if (inet_pton(AF_INET, name, &addr) > 0) {
        if (buflen < strlen(name) + 1 +
            sizeof (char *) * 2 + /* The h_aliases member */
            sizeof (struct in_addr) +
            sizeof (struct in_addr *) * 2) {
            *h_errnop = TRY_AGAIN;
            return (NULL);
        }

        result->h_addrtype = AF_INET;
        result->h_length = sizeof (struct in_addr);
        (void) strncpy(buffer, name, buflen);

        result->h_addr_list = (char **)ROUND_UP(
            buffer + strlen(name) + 1,
            sizeof (char *));
        result->h_aliases = (char **)ROUND_UP(result->h_addr_list,
            sizeof (char *));
        result->h_aliases[0] = buffer;
        result->h_aliases[1] = NULL;
        bcopy(&addr,
            buffer + buflen - sizeof (struct in_addr),
            sizeof (struct in_addr));
        result->h_addr_list[0] = buffer + buflen -
            sizeof (struct in_addr);
        result->h_addr_list[1] = NULL;
        result->h_aliases = result->h_addr_list;
        result->h_name = buffer;

        *h_errnop = NETDB_SUCCESS;
        return (result);
    }
    if (inet_pton(AF_INET6, name, &addr6) > 0) {
        if (buflen < strlen(name) + 1 +
            sizeof (char *) * 2 + /* The h_aliases member */
            sizeof (struct in6_addr) +
            sizeof (struct in6_addr *) * 2) {
            *h_errnop = TRY_AGAIN;
            return (NULL);
        }

        result->h_addrtype = AF_INET6;
        result->h_length = sizeof (struct in6_addr);
        (void) strncpy(buffer, name, buflen);

        result->h_addr_list = (char **)ROUND_UP(
            buffer + strlen(name) + 1,
            sizeof (char *));
        result->h_aliases = (char **)ROUND_UP(result->h_addr_list,
            sizeof (char *));
        result->h_aliases[0] = buffer;
        result->h_aliases[1] = NULL;
        bcopy(&addr6,
            buffer + buflen - sizeof (struct in6_addr),
            sizeof (struct in6_addr));
        result->h_addr_list[0] = buffer + buflen -
            sizeof (struct in6_addr);
        result->h_addr_list[1] = NULL;
        result->h_aliases = result->h_addr_list;
        result->h_name = buffer;

        *h_errnop = NETDB_SUCCESS;
        return (result);
    }

    NSS_XbyY_INIT(&arg, result, buffer, buflen, str2hostent);

    arg.key.name = name;
    arg.stayopen = 0;
    arg.h_errno = NETDB_SUCCESS;

    res = nss_search(&db_root_ipnodes, _initf_ipnodes,
        NSS_DBOP_IPNODES_BYNAME, &arg);
    if (res == NSS_NOTFOUND || res == NSS_UNAVAIL) {
        arg.h_errno = NETDB_SUCCESS;
        res = nss_search(&db_root_hosts, _initf_hosts,
            NSS_DBOP_HOSTS_BYNAME, &arg);
    }
    arg.status = res;
    *h_errnop = arg.h_errno;
    return ((struct hostent *)NSS_XbyY_FINI(&arg));
}

/*
 * Convert an IP to a host name.
 */
ns_ldap_return_code
__s_api_ip2hostname(char *ipaddr, char **hostname) {
    struct in_addr  in;
    struct in6_addr in6;
    struct hostent  *hp = NULL, hostEnt;
    char        buffer[NSS_BUFLEN_HOSTS];
    int     buflen = NSS_BUFLEN_HOSTS;
    char        *start = NULL,
            *end = NULL,
            delim = '\0';
    char        *port = NULL,
            *addr = NULL;
    int     errorNum = 0,
            len = 0;

    if (ipaddr == NULL || hostname == NULL)
        return (NS_LDAP_INVALID_PARAM);
    *hostname = NULL;
    if ((addr = strdup(ipaddr)) == NULL)
        return (NS_LDAP_MEMORY);

    if (addr[0] == '[') {
        /*
         * Assume it's [ipv6]:port
         * Extract ipv6 IP
         */
        start = &addr[1];
        if ((end = strchr(addr, ']')) != NULL) {
            *end = '\0';
            delim = ']';
            if (*(end + 1) == ':')
                /* extract port */
                port = end + 2;
        } else {
            free(addr);
            return (NS_LDAP_INVALID_PARAM);
        }
    } else if ((end = strchr(addr, ':')) != NULL) {
        /* assume it's ipv4:port */
        *end = '\0';
        delim = ':';
        start = addr;
        port = end + 1;
    } else
        /* No port */
        start = addr;


    if (inet_pton(AF_INET, start, &in) == 1) {
        /* IPv4 */
        hp = _filter_gethostbyaddr_r((char *)&in,
            sizeof (in.s_addr),
            AF_INET,
            &hostEnt,
            buffer,
            buflen,
            &errorNum);
        if (hp && hp->h_name) {
            /* hostname + '\0' */
            len = strlen(hp->h_name) + 1;
            if (port)
                /* ':' + port */
                len += strlen(port) + 1;
            if ((*hostname = malloc(len)) == NULL) {
                free(addr);
                return (NS_LDAP_MEMORY);
            }

            if (port)
                (void) snprintf(*hostname, len, "%s:%s",
                        hp->h_name, port);
            else
                (void) strlcpy(*hostname, hp->h_name, len);

            free(addr);
            return (NS_LDAP_SUCCESS);
        } else {
            free(addr);
            return (NS_LDAP_NOTFOUND);
        }
    } else if (inet_pton(AF_INET6, start, &in6) == 1) {
        /* IPv6 */
        hp = _filter_gethostbyaddr_r((char *)&in6,
            sizeof (in6.s6_addr),
            AF_INET6,
            &hostEnt,
            buffer,
            buflen,
            &errorNum);
        if (hp && hp->h_name) {
            /* hostname + '\0' */
            len = strlen(hp->h_name) + 1;
            if (port)
                /* ':' + port */
                len += strlen(port) + 1;
            if ((*hostname = malloc(len)) == NULL) {
                free(addr);
                return (NS_LDAP_MEMORY);
            }

            if (port)
                (void) snprintf(*hostname, len, "%s:%s",
                        hp->h_name, port);
            else
                (void) strlcpy(*hostname, hp->h_name, len);

            free(addr);
            return (NS_LDAP_SUCCESS);
        } else {
            free(addr);
            return (NS_LDAP_NOTFOUND);
        }
    } else {
        /*
         * A hostname
         * Return it as is
         */
        if (end)
            *end = delim;
        *hostname = addr;
        return (NS_LDAP_SUCCESS);
    }
}

/*
 * This function obtains data returned by an LDAP search request and puts it
 * in a string in the ldap_cachmgr(1) door call format.
 *
 * INPUT:
 *     ld - a pointer to an LDAP structure used for a search operation,
 *     result_msg - a pointer to an LDAPMessage returned by the search,
 *     include_names - if set to INCLUDE_ATTR_NAMES, the output buffer will
 *                     contain attribute names.
 *                     Otherwise, only values will be return.
 *
 * OUTPUT:
 *      a buffer containing server info in the following format:
 *         [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
 *
 *      Should be free'ed by the caller.
 */
static
ns_ldap_return_code
convert_to_door_line(LDAP* ld,
        LDAPMessage *result_msg,
        int include_names,
        int is_profile,
        char **door_line)
{
    uint32_t    total_length = 0, attr_len = 0, i;
    LDAPMessage *e;
    char        *a, **vals;
    BerElement  *ber;
    int     seen_objectclass = 0, rewind = 0;

    if (!door_line) {
        return (NS_LDAP_INVALID_PARAM);
    }
    *door_line = NULL;

    if ((e = ldap_first_entry(ld, result_msg)) == NULL) {
        return (NS_LDAP_NOTFOUND);
    }

    /* calculate length of received data */
    for (a = ldap_first_attribute(ld, e, &ber);
        a != NULL;
        a = ldap_next_attribute(ld, e, ber)) {

        if ((vals = ldap_get_values(ld, e, a)) != NULL) {
            for (i = 0; vals[i] != NULL; i++) {
                total_length += (include_names ?
                    strlen(a) : 0) +
                    strlen(vals[i]) +
                    strlen(DOORLINESEP) +1;
            }
            ldap_value_free(vals);
        }
        ldap_memfree(a);
    }
    if (ber != NULL) {
        ber_free(ber, 0);
    }

    if (total_length == 0) {
        return (NS_LDAP_NOTFOUND);
    }

    /* copy the data */
    /* add 1 for the last '\0' */
    *door_line  = (char *)malloc(total_length + 1);
    if (*door_line == NULL) {
        return (NS_LDAP_MEMORY);
    }

    /* make it an empty string first */
    **door_line = '\0';
    a = ldap_first_attribute(ld, e, &ber);
    while (a != NULL) {
        if (is_profile) {
            /*
             * If we're processing DUAConfigProfile, we need to make
             * sure we put objectclass attribute first.
             * __s_api_create_config_door_str depends on that.
             */
            if (seen_objectclass) {
                if (strcasecmp(a, "objectclass") == 0) {
                    /* Skip objectclass now. */
                    a = ldap_next_attribute(ld, e, ber);
                    continue;
                }
            } else {
                if (strcasecmp(a, "objectclass") == 0) {
                    seen_objectclass = 1;
                    rewind = 1;
                } else {
                    /* Skip all but objectclass first. */
                    a = ldap_next_attribute(ld, e, ber);
                    continue;
                }
            }
        }

        if ((vals = ldap_get_values(ld, e, a)) != NULL) {
            for (i = 0; vals[i] != NULL; i++) {
                if (include_names) {
                    attr_len += strlen(a);
                }
                attr_len += strlen(vals[i]) +
                    strlen(DOORLINESEP) + 2;
                if (include_names) {
                    (void) snprintf(*door_line +
                        strlen(*door_line),
                        attr_len,
                        "%s=%s%s",
                        a, vals[i],
                        DOORLINESEP);
                } else {
                    (void) snprintf(*door_line +
                        strlen(*door_line),
                        attr_len,
                        "%s%s",
                        vals[i],
                        DOORLINESEP);
                }
            }
            ldap_value_free(vals);
        }
        ldap_memfree(a);

        /* Rewind */
        if (rewind) {
            if (ber != NULL) {
                ber_free(ber, 0);
            }
            a = ldap_first_attribute(ld, e, &ber);
            rewind = 0;
        } else {
            a = ldap_next_attribute(ld, e, ber);
        }
    }
    if (ber != NULL) {
        ber_free(ber, 0);
    }

    if (e != result_msg) {
        (void) ldap_msgfree(e);
    }

    return (NS_LDAP_SUCCESS);
}

/*
 * This function looks up the base DN of a directory serving
 * a specified domain name.
 *
 * INPUT:
 *     ld - a pointer to an LDAP structure used for the search operation,
 *     domain_name - the name of a domain.
 *
 * OUTPUT:
 *     a buffer containing a directory's base DN found.
 *     Should be free'ed by the caller.
 */
static
ns_ldap_return_code
getDirBaseDN(LDAP *ld, const char *domain_name, char **dir_base_dn)
{
    struct timeval      tv = {NS_DEFAULT_SEARCH_TIMEOUT, 0};
    char            *attrs[2], *DNlist, *rest, *ptr;
    char            filter[BUFSIZ], *a = NULL;
    int         ldap_rc;
    LDAPMessage     *resultMsg = NULL;
    ns_ldap_return_code ret_code;
    LDAPMessage     *entry;

    /* Get the whole list of naming contexts residing on the server */
    attrs[0] = "namingcontexts";
    attrs[1] = NULL;
    ldap_rc = ldap_search_ext_s(ld, "", LDAP_SCOPE_BASE, "(objectclass=*)",
        attrs, 0, NULL, NULL, &tv, 0, &resultMsg);
    switch (ldap_rc) {
        /* If successful, the root DSE was found. */
        case LDAP_SUCCESS:
            break;
        /*
         * If the root DSE was not found, the server does
         * not comply with the LDAP v3 protocol.
         */
        default:
            if (resultMsg) {
                (void) ldap_msgfree(resultMsg);
                resultMsg = NULL;
            }

            return (NS_LDAP_OP_FAILED);
            /* NOTREACHED */
            break;
    }

    if ((ret_code = convert_to_door_line(ld,
        resultMsg,
        DONT_INCLUDE_ATTR_NAMES,
        NOT_PROFILE,
        &DNlist)) != NS_LDAP_SUCCESS) {
        if (resultMsg) {
            (void) ldap_msgfree(resultMsg);
            resultMsg = NULL;
        }
        return (ret_code);
    }

    if (resultMsg) {
        (void) ldap_msgfree(resultMsg);
        resultMsg = NULL;
    }

    if (DNlist == NULL ||
        (ptr = strtok_r(DNlist, DOORLINESEP, &rest)) == NULL) {
        return (NS_LDAP_NOTFOUND);
    }
    attrs[0] = "dn";
    do {
        /*
         * For each context try to find a NIS domain object
         * which 'nisdomain' attribute's value matches the domain name
         */
        (void) snprintf(filter,
            BUFSIZ,
            "(&(objectclass=nisDomainObject)"
            "(nisdomain=%s))",
            domain_name);
        ldap_rc = ldap_search_ext_s(ld,
            ptr,
            LDAP_SCOPE_SUBTREE,
            filter,
            attrs,
            0,
            NULL,
            NULL,
            &tv,
            0,
            &resultMsg);
        if (ldap_rc != LDAP_SUCCESS) {
            if (resultMsg) {
                (void) ldap_msgfree(resultMsg);
                resultMsg = NULL;
            }
            continue;
        }

        if ((entry = ldap_first_entry(ld, resultMsg)) == NULL) {
            (void) ldap_msgfree(resultMsg);
            resultMsg = NULL;
            continue;
        }

        if ((a = ldap_get_dn(ld, entry)) != NULL) {
            *dir_base_dn = strdup(a);
            ldap_memfree(a);

            if (resultMsg) {
                (void) ldap_msgfree(resultMsg);
                resultMsg = NULL;
            }

            if (!*dir_base_dn) {
                free(DNlist);
                return (NS_LDAP_MEMORY);
            }
            break;
        }

        if (resultMsg) {
            (void) ldap_msgfree(resultMsg);
            resultMsg = NULL;
        }
    } while (ptr = strtok_r(NULL, DOORLINESEP, &rest));

    free(DNlist);

    if (!*dir_base_dn) {
        return (NS_LDAP_NOTFOUND);
    }

    return (NS_LDAP_SUCCESS);
}

/*
 * This function parses the results of a search operation
 * requesting a DUAProfile.
 *
 * INPUT:
 *     ld - a pointer to an LDAP structure used for the search operation,
 *     dir_base_dn - the name of a directory's base DN,
 *     profile_name - the name of a DUAProfile to be obtained.
 *
 * OUTPUT:
 *      a buffer containing the DUAProfile in the following format:
 *        [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
 *      Should be free'ed by the caller.
 */
static
ns_ldap_return_code
getDUAProfile(LDAP *ld,
        const char *dir_base_dn,
        const char *profile_name,
        char **profile)
{
    char            searchBaseDN[BUFSIZ], filter[BUFSIZ];
    LDAPMessage     *resultMsg = NULL;
    struct timeval      tv = {NS_DEFAULT_SEARCH_TIMEOUT, 0};
    int         ldap_rc;
    ns_ldap_return_code ret_code;

    (void) snprintf(searchBaseDN, BUFSIZ, "ou=profile,%s", dir_base_dn);
    (void) snprintf(filter,
        BUFSIZ,
        _PROFILE_FILTER,
        _PROFILE1_OBJECTCLASS,
        _PROFILE2_OBJECTCLASS,
        profile_name);
    ldap_rc = ldap_search_ext_s(ld,
        searchBaseDN,
        LDAP_SCOPE_SUBTREE,
        filter,
        NULL,
        0,
        NULL,
        NULL,
        &tv,
        0,
        &resultMsg);

    switch (ldap_rc) {
        /* If successful, the DUA profile was found. */
        case LDAP_SUCCESS:
            break;
        /*
         * If the root DSE was not found, the server does
         * not comply with the LDAP v3 protocol.
         */
        default:
            if (resultMsg) {
                (void) ldap_msgfree(resultMsg);
                resultMsg = NULL;
            }

            return (NS_LDAP_OP_FAILED);
            /* NOTREACHED */
            break;
    }

    ret_code = convert_to_door_line(ld,
        resultMsg,
        INCLUDE_ATTR_NAMES,
        IS_PROFILE,
        profile);
    if (resultMsg) {
        (void) ldap_msgfree(resultMsg);
        resultMsg = NULL;
    }
    return (ret_code);
}

/*
 * This function derives the directory's base DN from a provided domain name.
 *
 * INPUT:
 *     domain_name - the name of a domain to be converted into a base DN,
 *     buffer - contains the derived base DN,
 *     buf_len - the length of the buffer.
 *
 * OUTPUT:
 *     The function returns the address of the buffer or NULL.
 */
static
char *
domainname2baseDN(char *domain_name, char *buffer, uint16_t buf_len)
{
    char        *nextDC, *chr;
    uint16_t    i, length;

    if (!domain_name || !buffer || buf_len == 0) {
        return (NULL);
    }

    buffer[0] = '\0';
    nextDC = chr = domain_name;
    length = strlen(domain_name);
    for (i = 0; i < length + 1; ++i, ++chr) {
        /* Simply replace dots with "dc=" */
        if (*chr != '.' && *chr != '\0') {
            continue;
        }
        *chr = '\0';
        if (strlcat(buffer, "dc=", buf_len) >= buf_len)
            return (NULL);
        if (strlcat(buffer, nextDC, buf_len) >= buf_len)
            return (NULL);
        if (i < length) {
            /*
             * The end of the domain name
             * has not been reached yet
             */
            if (strlcat(buffer, ",", buf_len) >= buf_len)
                return (NULL);
            nextDC = chr + 1;
            *chr = '.';
        }
    }

    return (buffer);
}

/*
 * This function obtains the directory's base DN and a DUAProfile
 * from a specified server.
 *
 * INPUT:
 *     server - a structure describing a server to connect to and
 *              a DUAProfile to be obtained from the server,
 *     cred - credentials to be used during establishing connections to
 *            the server.
 *
 * OUTPUT:
 *     dua_profile - a buffer containing the DUAProfile in the following format:
 *        [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
 *     dir_base_dn - a buffer containing the base DN,
 *     errorp - an error object describing an error, if any.
 *
 *     All the output data structures should be free'ed by the caller.
 */
ns_ldap_return_code
__ns_ldap_getConnectionInfoFromDUA(const ns_dir_server_t *server,
    const ns_cred_t *cred,
    char **dua_profile,
    char **dir_base_dn,
    ns_ldap_error_t **errorp)
{
    char            serverAddr[MAX_HOSTADDR_LEN];
    char            *dirBaseDN = NULL, *duaProfile = NULL;
    ns_cred_t       default_cred;
    ns_ldap_return_code ret_code;

    ns_config_t     *config_struct = __s_api_create_config();
    ConnectionID        sessionId = 0;
    Connection      *session = NULL;
    char            errmsg[MAXERROR];
    char            buffer[NSS_BUFLEN_HOSTS];
    ns_conn_user_t      *cu = NULL;

    if (errorp == NULL) {
        __s_api_destroy_config(config_struct);
        return (NS_LDAP_INVALID_PARAM);
    }

    *errorp = NULL;

    if (server == NULL) {
        __s_api_destroy_config(config_struct);
        return (NS_LDAP_INVALID_PARAM);
    }

    if (config_struct == NULL) {
        return (NS_LDAP_MEMORY);
    }

    /*
     * If no credentials are specified, try to establish a connection
     * as anonymous.
     */
    if (!cred) {
        default_cred.cred.unix_cred.passwd = NULL;
        default_cred.cred.unix_cred.userID = NULL;
        default_cred.auth.type = NS_LDAP_AUTH_NONE;
    }

    /* Now create a default LDAP configuration */

    (void) strncpy(buffer, server->server, sizeof (buffer));
    if (__ns_ldap_setParamValue(config_struct, NS_LDAP_SERVERS_P, buffer,
        errorp) != NS_LDAP_SUCCESS) {
        __s_api_destroy_config(config_struct);
        return (NS_LDAP_CONFIG);
    }

    /* Put together the address and the port specified by the user app. */
    if (server->port > 0) {
        (void) snprintf(serverAddr,
            sizeof (serverAddr),
            "%s:%hu",
            buffer,
            server->port);
    } else {
        (void) strncpy(serverAddr, buffer, sizeof (serverAddr));
    }

    /*
     * There is no default value for the 'Default Search Base DN' attribute.
     * Derive one from the domain name to make __s_api_crosscheck() happy.
     */
    if (domainname2baseDN(server->domainName ?
        server->domainName : config_struct->domainName,
        buffer, NSS_BUFLEN_HOSTS) == NULL) {
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("Can not convert %s into a base DN name"),
            server->domainName ?
            server->domainName : config_struct->domainName);
        MKERROR(LOG_ERR,
            *errorp,
            NS_LDAP_INTERNAL,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        __s_api_destroy_config(config_struct);
        return (NS_LDAP_INTERNAL);
    }
    if (__ns_ldap_setParamValue(config_struct, NS_LDAP_SEARCH_BASEDN_P,
        buffer, errorp) != NS_LDAP_SUCCESS) {
        __s_api_destroy_config(config_struct);
        return (NS_LDAP_CONFIG);
    }

    if (__s_api_crosscheck(config_struct, errmsg, B_FALSE, B_FALSE)
        != NS_SUCCESS) {
        __s_api_destroy_config(config_struct);
        return (NS_LDAP_CONFIG);
    }

    __s_api_init_config(config_struct);

    __s_api_setInitMode();

    cu = __s_api_conn_user_init(NS_CONN_USER_SEARCH, NULL, B_FALSE);
    if (cu == NULL) {
        return (NS_LDAP_INTERNAL);
    }

    if ((ret_code = __s_api_getConnection(serverAddr,
        NS_LDAP_NEW_CONN | NS_LDAP_NO_ROOT_DSE_INFO,
        cred ? cred : &default_cred,
        &sessionId,
        &session,
        errorp,
        0,
        0,
        cu)) != NS_LDAP_SUCCESS) {
        __s_api_conn_user_free(cu);
        __s_api_unsetInitMode();
        return (ret_code);
    }

    __s_api_unsetInitMode();

    if ((ret_code = getDirBaseDN(session->ld,
        server->domainName ?
        server->domainName :
        config_struct->domainName,
        &dirBaseDN)) != NS_LDAP_SUCCESS) {
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("Can not find the "
            "nisDomainObject for domain %s\n"),
            server->domainName ?
            server->domainName : config_struct->domainName);
        MKERROR(LOG_ERR,
            *errorp,
            ret_code,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        __s_api_conn_user_free(cu);
        DropConnection(sessionId, NS_LDAP_NEW_CONN);
        return (ret_code);
    }

    /*
     * And here obtain a DUAProfile which will be used
     * as a real configuration.
     */
    if ((ret_code = getDUAProfile(session->ld,
        dirBaseDN,
        server->profileName ?
        server->profileName : "default",
        &duaProfile)) != NS_LDAP_SUCCESS) {
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("Can not find the "
            "%s DUAProfile\n"),
            server->profileName ?
            server->profileName : "default");
        MKERROR(LOG_ERR,
            *errorp,
            ret_code,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        __s_api_conn_user_free(cu);
        DropConnection(sessionId, NS_LDAP_NEW_CONN);
        return (ret_code);
    }

    if (dir_base_dn) {
        *dir_base_dn = dirBaseDN;
    } else {
        free(dirBaseDN);
    }

    if (dua_profile) {
        *dua_profile = duaProfile;
    } else {
        free(duaProfile);
    }

    __s_api_conn_user_free(cu);
    DropConnection(sessionId, NS_LDAP_NEW_CONN);

    return (NS_LDAP_SUCCESS);
}

/*
 * set_ldap_server_type tries to determine the type of server where the
 * rootDSE data 'root_dse' is obtained. Currently it checks for server
 * specific objectclasses or attribute values to determine the type:
 *   ODSEE   : has venderName attribute value: "Sun Microsystems, Inc."
 *   OPENLDAP: has objectclass OpenLDAProotDSE
 *   AD      : has attribute isGlobalCatalogReady
 * A type of unkonwn is returned if not one of these three.
 */
static ns_ldap_server_type_t
set_ldap_server_type(char *root_dse)
{
    char    *rs, *attr, *val, *rest;
    ns_ldap_server_type_t   type = NS_LDAP_SERVERTYPE_UNKNOWN;

    /* make a working copy of root_dse */
    rs = strdup(root_dse);
    if (rs == NULL)
        return (type);

    for (attr = strtok_r(rs, DOORLINESEP, &rest);
        attr != NULL;
        attr = strtok_r(NULL, DOORLINESEP, &rest)) {
        if ((val = strchr(attr, '=')) == NULL) {
            continue;
        }
        *val++ = '\0';

        if (strcasecmp(attr, _VENDORNAME) == 0) {
            if (strcasecmp(val, _VENDORSUN) == 0) {
                type = NS_LDAP_SERVERTYPE_ODSEE;
                break;
            }
        }

        if (strcasecmp(attr, _ISGLOBALCATALOGREADY) == 0) {
            type = NS_LDAP_SERVERTYPE_AD;
            break;
        }

        if (strcasecmp(attr, "objectclass") == 0) {
            if (strcasecmp(val, _OPENLDAPROOTDSE) == 0) {
                type = NS_LDAP_SERVERTYPE_OPENLDAP;
                break;
            }
            continue;
        }

    }

    free(rs);
    return (type);

}

/*
 * This function obtains the root DSE from a specified server.
 * Note this function creates a private temporary unshared connection.
 * It does not participate in connection sharing.  It returns data
 * on whether a conneciton would/would not be successful.  That data
 * can then be used to create a shared connection if desired.
 *
 * There is a similar function getServerInfo() in ns_connect.c
 * which is used to obtain the same information for cases where
 * the information is not available from the ldap_cachemgr.
 * The functionality is turned off by the flag NS_LDAP_NO_ROOT_DSE_INFO
 * in __s_api_getConnection()
 *
 * INPUT:
 *     server_addr - an adress of a server to be connected to.
 *
 * OUTPUT:
 *     root_dse - a buffer containing the root DSE in the following format:
 *          [<attribute name>=]value [DOORLINESEP [<attribute name>=]value ]...]
 *        For example: ( here | used as DOORLINESEP for visual purposes)
 *          supportedControl=1.1.1.1|supportedSASLmechanisms=EXTERNAL
 *        Should be free'ed by the caller.
 *
 *     server_type - type of server, DSEE, AD, OpenLDAP, etc.
 */
ns_ldap_return_code
__ns_ldap_getRootDSE(const char *server_addr,
        ns_ldap_server_type_t *server_type,
        char **root_dse,
        ns_ldap_error_t **errorp,
        int anon_fallback)
{
    char            errmsg[MAXERROR];
    ns_ldap_return_code ret_code;

    ConnectionID        sessionId = 0;
    Connection      *session = NULL;

    struct timeval      tv = {NS_DEFAULT_SEARCH_TIMEOUT, 0};
    int         rc, ldap_rc, ldaperrno = 0;
    LDAPMessage     *resultMsg = NULL;
    void            **paramVal = NULL;

    ns_cred_t       anon;
    char *attrs[] = {
        "supportedControl",
        "supportedsaslmechanisms",
        "vendorName",
        "objectclass",
        "isGlobalCatalogReady",
        NULL
    };

    if (server_addr == NULL || root_dse == NULL || errorp == NULL)
        return (NS_LDAP_INVALID_PARAM);

    *errorp = NULL;
    __s_api_setInitMode();

    /*
     * Get a new (private) connection
     * All the credentials will be taken from the current
     * libsldap configuration.
     */
    ret_code = __s_api_getConnection(server_addr,
        NS_LDAP_NEW_CONN | NS_LDAP_NO_ROOT_DSE_INFO,
        NULL, &sessionId, &session, errorp, 0, 0, NULL);
    if (ret_code != NS_LDAP_SUCCESS) {
        /* Fallback to anonymous mode is disabled. Stop. */
        if (anon_fallback == 0) {
            syslog(LOG_WARNING,
                gettext("libsldap: can not get the root DSE from "
                " the %s server: %s. "
                "Falling back to anonymous disabled.\n"),
                server_addr,
                errorp && *errorp && (*errorp)->message ?
                (*errorp)->message : "");
            if (*errorp != NULL) {
                (void) __ns_ldap_freeError(errorp);
                *errorp = NULL;
            }
            __s_api_unsetInitMode();
            return (ret_code);
        }

        /*
         * Fallback to anonymous, non-SSL mode for backward
         * compatibility reasons. This mode should only be used when
         * this function (__ns_ldap_getRootDSE) is called from
         * ldap_cachemgr(1M).
         */
        syslog(LOG_WARNING,
            gettext("libsldap: Falling back to anonymous, non-SSL"
            " mode for __ns_ldap_getRootDSE. %s\n"),
            errorp && *errorp && (*errorp)->message ?
            (*errorp)->message : "");

        /* Setup the anon credential for anonymous connection. */
        (void) memset(&anon, 0, sizeof (ns_cred_t));
        anon.auth.type = NS_LDAP_AUTH_NONE;

        if (*errorp != NULL)
            (void) __ns_ldap_freeError(errorp);
        *errorp = NULL;

        ret_code = __s_api_getConnection(server_addr,
            NS_LDAP_NEW_CONN | NS_LDAP_NO_ROOT_DSE_INFO,
            &anon, &sessionId, &session, errorp, 0, 0, NULL);
        if (ret_code != NS_LDAP_SUCCESS) {
            if (*errorp != NULL)
                (void) __ns_ldap_freeError(errorp);
            *errorp = NULL;
            __s_api_unsetInitMode();
            return (ret_code);
        }
    }

    __s_api_unsetInitMode();

    /* get search timeout value */
    rc = __ns_ldap_getParam(NS_LDAP_SEARCH_TIME_P, &paramVal, errorp);
    if (rc == NS_LDAP_SUCCESS) {
        if (paramVal != NULL && *paramVal != NULL) {
            tv.tv_sec = **((int **)paramVal);
            (void) __ns_ldap_freeParam(&paramVal);
        }
    } else {
        if (*errorp != NULL)
            (void) __ns_ldap_freeError(errorp);
        *errorp = NULL;
    }

    /* Get root DSE from the server specified by the caller. */
    ldap_rc = ldap_search_ext_s(session->ld, "", LDAP_SCOPE_BASE,
        "(objectclass=*)", attrs, 0, NULL, NULL, &tv, 0, &resultMsg);

    if (ldap_rc != LDAP_SUCCESS) {
        /*
         * Unable to get root DSE: server may be down,
         * connection is not a valid LDAPv3 or other error
         */
        (void) ldap_get_option(session->ld,
            LDAP_OPT_ERROR_NUMBER, &ldaperrno);
        (void) snprintf(errmsg, sizeof (errmsg),
            gettext(ldap_err2string(ldaperrno)));
        MKERROR(LOG_ERR, *errorp, NS_LDAP_OP_FAILED,
            strdup(errmsg), NS_LDAP_MEMORY);

        if (resultMsg) {
            (void) ldap_msgfree(resultMsg);
            resultMsg = NULL;
        }

        DropConnection(sessionId, NS_LDAP_NEW_CONN);
        return (NS_LDAP_OP_FAILED);
    }

    /*
     * Successful root DSE search. Now try to interpret it.
     */
    ret_code = convert_to_door_line(session->ld, resultMsg,
        INCLUDE_ATTR_NAMES, NOT_PROFILE, root_dse);
    if (ret_code == NS_LDAP_NOTFOUND) {
        (void) snprintf(errmsg, sizeof (errmsg),
            gettext("No root DSE data for server %s returned."),
            server_addr);
        MKERROR(LOG_ERR, *errorp, NS_LDAP_NOTFOUND,
            strdup(errmsg), NS_LDAP_MEMORY);
    }

    *server_type = set_ldap_server_type(*root_dse);

    if (resultMsg) {
        (void) ldap_msgfree(resultMsg);
        resultMsg = NULL;
    }

    DropConnection(sessionId, NS_LDAP_NEW_CONN);
    return (ret_code);
}

/*
 * This function destroys the local list of root DSEs. The input parameter is
 * a pointer to the list to be erased.
 * The type of the pointer passed to this function should be
 * (dir_server_list_t *).
 */
static
void *
disposeOfOldList(void *param)
{
    dir_server_list_t   *old_list = (dir_server_list_t *)param;
    long            i = 0, j;

    (void) rw_wrlock(&old_list->listDestroyLock);
    /* Destroy the old list */
    while (old_list->nsServers[i]) {
        free(old_list->nsServers[i]->ip);
        j = 0;
        while (old_list->nsServers[i]->controls &&
            old_list->nsServers[i]->controls[j]) {
            free(old_list->nsServers[i]->controls[j]);
            ++j;
        }
        free(old_list->nsServers[i]->controls);
        j = 0;
        while (old_list->nsServers[i]->saslMech &&
            old_list->nsServers[i]->saslMech[j]) {
            free(old_list->nsServers[i]->saslMech[j]);
            ++j;
        }
        free(old_list->nsServers[i]->saslMech);
        ++i;
    }
    /*
     * All the structures pointed by old_list->nsServers were allocated
     * in one chunck. The nsServers[0] pointer points to the beginning
     * of that chunck.
     */
    free(old_list->nsServers[0]);
    free(old_list->nsServers);
    (void) rw_unlock(&old_list->listDestroyLock);
    (void) rwlock_destroy(&old_list->listDestroyLock);
    free(old_list);

    return (NULL);
}

/*
 * This function cancels the Standalone mode and destroys the list of root DSEs.
 */
void
__ns_ldap_cancelStandalone(void)
{
    dir_server_list_t   *old_list;

    (void) mutex_lock(&dir_servers.listReplaceLock);
    dir_servers.standalone = 0;
    if (!dir_servers.list) {
        (void) mutex_unlock(&dir_servers.listReplaceLock);
        return;
    }
    old_list = dir_servers.list;
    dir_servers.list = NULL;
    (void) mutex_unlock(&dir_servers.listReplaceLock);

    (void) disposeOfOldList(old_list);
}


static
void*
create_ns_servers_entry(void *param)
{
#define CHUNK_SIZE 16

    dir_server_t        *server = (dir_server_t *)param;
    ns_ldap_return_code *retCode = calloc(1,
        sizeof (ns_ldap_return_code));
    uint32_t        sc_counter = 0, sm_counter = 0;
    uint32_t        sc_mem_blocks = 1, sm_mem_blocks = 1;
    char            *rootDSE = NULL, *attr, *val, *rest, **ptr;
    ns_ldap_error_t     *error = NULL;
    ns_ldap_server_type_t   server_type;

    if (retCode == NULL) {
        return (NULL);
    }

    /*
     * We call this function in non anon-fallback mode because we
     * want the whole procedure to fail as soon as possible to
     * indicate there are problems with connecting to the server.
     */
    *retCode = __ns_ldap_getRootDSE(server->ip,
        &server_type,
        &rootDSE,
        &error,
        SA_ALLOW_FALLBACK);

    if (*retCode == NS_LDAP_MEMORY) {
        free(retCode);
        return (NULL);
    }

    /*
     * If the root DSE can not be obtained, log an error and keep the
     * server.
     */
    if (*retCode != NS_LDAP_SUCCESS) {
        server->status = INFO_SERVER_ERROR;
        syslog(LOG_WARNING,
            gettext("libsldap (\"standalone\" mode): "
            "can not obtain the root DSE from %s. %s"),
            server->ip,
            error && error->message ? error->message : "");
        if (error) {
            (void) __ns_ldap_freeError(&error);
        }
        return (retCode);
    }

    /* Get the first attribute of the root DSE. */
    attr = strtok_r(rootDSE, DOORLINESEP, &rest);
    if (attr == NULL) {
        free(rootDSE);
        server->status = INFO_SERVER_ERROR;
        syslog(LOG_WARNING,
            gettext("libsldap (\"standalone\" mode): "
            "the root DSE from %s is empty or corrupted."),
            server->ip);
        *retCode = NS_LDAP_INTERNAL;
        return (retCode);
    }

    server->controls = (char **)calloc(CHUNK_SIZE, sizeof (char *));
    server->saslMech = (char **)calloc(CHUNK_SIZE, sizeof (char *));
    if (server->controls == NULL || server->saslMech == NULL) {
        free(rootDSE);
        free(retCode);
        if (server->controls != NULL)
            free(server->controls);
        if (server->saslMech != NULL)
            free(server->saslMech);
        return (NULL);
    }

    do {
        if ((val = strchr(attr, '=')) == NULL) {
            continue;
        }
        ++val;

        if (strncasecmp(attr,
            _SASLMECHANISM,
            _SASLMECHANISM_LEN) == 0) {
            if (sm_counter == CHUNK_SIZE * sm_mem_blocks - 1) {
                ptr = (char **)realloc(server->saslMech,
                    CHUNK_SIZE *
                    ++sm_mem_blocks *
                    sizeof (char *));
                if (ptr == NULL) {
                    *retCode = NS_LDAP_MEMORY;
                    break;
                }
                bzero((char *)ptr +
                    (sm_counter + 1) *
                    sizeof (char *),
                    CHUNK_SIZE *
                    sm_mem_blocks *
                    sizeof (char *) -
                    (sm_counter + 1) *
                    sizeof (char *));
                server->saslMech = ptr;
            }
            server->saslMech[sm_counter] = strdup(val);
            if (server->saslMech[sm_counter] == NULL) {
                *retCode = NS_LDAP_MEMORY;
                break;
            }
            ++sm_counter;
            continue;
        }
        if (strncasecmp(attr,
            _SUPPORTEDCONTROL,
            _SUPPORTEDCONTROL_LEN) == 0) {
            if (sc_counter == CHUNK_SIZE * sc_mem_blocks - 1) {
                ptr = (char **)realloc(server->controls,
                    CHUNK_SIZE *
                    ++sc_mem_blocks *
                    sizeof (char *));
                if (ptr == NULL) {
                    *retCode = NS_LDAP_MEMORY;
                    break;
                }
                bzero((char *)ptr +
                    (sc_counter + 1) *
                    sizeof (char *),
                    CHUNK_SIZE *
                    sc_mem_blocks *
                    sizeof (char *) -
                    (sc_counter + 1) *
                    sizeof (char *));
                server->controls = ptr;
            }

            server->controls[sc_counter] = strdup(val);
            if (server->controls[sc_counter] == NULL) {
                *retCode = NS_LDAP_MEMORY;
                break;
            }
            ++sc_counter;
            continue;
        }

    } while (attr = strtok_r(NULL, DOORLINESEP, &rest));

    free(rootDSE);

    if (*retCode == NS_LDAP_MEMORY) {
        free(retCode);
        return (NULL);
    }

    server->controls[sc_counter] = NULL;
    server->saslMech[sm_counter] = NULL;

    server->serverType = server_type;

    server->status = INFO_SERVER_UP;

    return (retCode);
#undef CHUNK_SIZE
}


/*
 * This function creates a new local list of root DSEs from all the servers
 * mentioned in the DUAProfile (or local NS BEC) and returns
 * a pointer to the list.
 */
static
ns_ldap_return_code
createDirServerList(dir_server_list_t **new_list,
        ns_ldap_error_t **errorp)
{
    char            **serverList;
    ns_ldap_return_code retCode = NS_LDAP_SUCCESS;
    dir_server_t        *tmpSrvArray;
    long            srvListLength, i;
    thread_t        *thrPool, thrID;
    void            *status = NULL;

    if (errorp == NULL) {
        return (NS_LDAP_INVALID_PARAM);
    }

    *errorp = NULL;

    if (new_list == NULL) {
        return (NS_LDAP_INVALID_PARAM);
    }

    retCode = __s_api_getServers(&serverList, errorp);
    if (retCode != NS_LDAP_SUCCESS || serverList == NULL) {
        return (retCode);
    }

    for (i = 0; serverList[i]; ++i) {
        ;
    }
    srvListLength = i;

    thrPool = calloc(srvListLength, sizeof (thread_t));
    if (thrPool == NULL) {
        __s_api_free2dArray(serverList);
        return (NS_LDAP_MEMORY);
    }

    *new_list = (dir_server_list_t *)calloc(1,
        sizeof (dir_server_list_t));
    if (*new_list == NULL) {
        __s_api_free2dArray(serverList);
        free(thrPool);
        return (NS_LDAP_MEMORY);
    }
    (void) rwlock_init(&(*new_list)->listDestroyLock, USYNC_THREAD, NULL);

    (*new_list)->nsServers = (dir_server_t **)calloc(srvListLength + 1,
        sizeof (dir_server_t *));
    if ((*new_list)->nsServers == NULL) {
        free(*new_list);
        *new_list = NULL;
        __s_api_free2dArray(serverList);
        free(thrPool);
        return (NS_LDAP_MEMORY);
    }

    /*
     * Allocate a set of dir_server_t structures as an array,
     * with one alloc call and then initialize the nsServers pointers
     * with the addresses of the array's members.
     */
    tmpSrvArray = (dir_server_t *)calloc(srvListLength,
        sizeof (dir_server_t));
    for (i = 0; i < srvListLength; ++i) {
        (*new_list)->nsServers[i] = &tmpSrvArray[i];

        (*new_list)->nsServers[i]->info = INFO_STATUS_NEW;
        (void) mutex_init(&(*new_list)->nsServers[i]->updateStatus,
            USYNC_THREAD,
            NULL);

        (*new_list)->nsServers[i]->ip = strdup(serverList[i]);
        if ((*new_list)->nsServers[i]->ip == NULL) {
            retCode = NS_LDAP_MEMORY;
            break;
        }

        (*new_list)->nsServers[i]->status = INFO_SERVER_CONNECTING;

        switch (thr_create(NULL,
            0,
            create_ns_servers_entry,
            (*new_list)->nsServers[i],
            0,
            &thrID)) {
        case EAGAIN:
            (*new_list)->nsServers[i]->status =
                INFO_SERVER_ERROR;
            continue;
            /* NOTREACHED */
            break;
        case ENOMEM:
            (*new_list)->nsServers[i]->status =
                INFO_SERVER_ERROR;
            continue;
            /* NOTREACHED */
            break;
        default:
            thrPool[i] = thrID;
            continue;
            /* NOTREACHED */
            break;
        }
    }

    for (i = 0; i < srvListLength; ++i) {
        if (thrPool[i] != 0 &&
            thr_join(thrPool[i], NULL, &status) == 0) {
            if (status == NULL) {
                /*
                 * Some memory allocation problems occured. Just
                 * ignore the server and hope there will be some
                 * other good ones.
                 */
                (*new_list)->nsServers[i]->status =
                    INFO_SERVER_ERROR;
            }
            free(status);
        }
    }

    __s_api_free2dArray(serverList);
    free(thrPool);

    if (retCode == NS_LDAP_MEMORY) {
        (void) disposeOfOldList(*new_list);
        return (NS_LDAP_MEMORY);
    }

    return (NS_LDAP_SUCCESS);
}

/*
 * This functions replaces the local list of root DSEs with a new one and starts
 * a thread destroying the old list. There is no need for other threads to wait
 * until the old list will be destroyed.
 * Since it is possible that more than one thread can start creating the list,
 * this function should be protected by mutexes to be sure that only one thread
 * performs the initialization.
 */
static
ns_ldap_return_code
initGlobalList(ns_ldap_error_t **error)
{
    dir_server_list_t   *new_list, *old_list;
    ns_ldap_return_code ret_code;
    thread_t        tid;

    ret_code = createDirServerList(&new_list, error);
    if (ret_code != NS_LDAP_SUCCESS) {
        return (ret_code);
    }

    old_list = dir_servers.list;
    dir_servers.list = new_list;

    if (old_list) {
        (void) thr_create(NULL,
            0,
            disposeOfOldList,
            old_list,
            THR_DETACHED,
            &tid);
    }

    return (NS_LDAP_SUCCESS);
}

static
struct {
    char *authMech;
    ns_auth_t auth;
} authArray[] = {{"none", {NS_LDAP_AUTH_NONE,
            NS_LDAP_TLS_NONE,
            NS_LDAP_SASL_NONE,
            NS_LDAP_SASLOPT_NONE}},
        {"simple", {NS_LDAP_AUTH_SIMPLE,
            NS_LDAP_TLS_NONE,
            NS_LDAP_SASL_NONE,
            NS_LDAP_SASLOPT_NONE}},
        {"tls:simple", {NS_LDAP_AUTH_TLS,
            NS_LDAP_TLS_SIMPLE,
            NS_LDAP_SASL_NONE,
            NS_LDAP_SASLOPT_NONE}},
        {"tls:sasl/CRAM-MD5", {NS_LDAP_AUTH_TLS,
            NS_LDAP_TLS_SASL,
            NS_LDAP_SASL_CRAM_MD5,
            NS_LDAP_SASLOPT_NONE}},
        {"tls:sasl/DIGEST-MD5", {NS_LDAP_AUTH_TLS,
            NS_LDAP_TLS_SASL,
            NS_LDAP_SASL_DIGEST_MD5,
            NS_LDAP_SASLOPT_NONE}},
        {"sasl/CRAM-MD5", {NS_LDAP_AUTH_SASL,
            NS_LDAP_TLS_SASL,
            NS_LDAP_SASL_CRAM_MD5,
            NS_LDAP_SASLOPT_NONE}},
        {"sasl/DIGEST-MD5", {NS_LDAP_AUTH_SASL,
            NS_LDAP_TLS_SASL,
            NS_LDAP_SASL_DIGEST_MD5,
            NS_LDAP_SASLOPT_NONE}},
        {"sasl/GSSAPI", {NS_LDAP_AUTH_SASL,
            NS_LDAP_TLS_SASL,
            NS_LDAP_SASL_GSSAPI,
            NS_LDAP_SASLOPT_PRIV | NS_LDAP_SASLOPT_INT}},
        {NULL, {NS_LDAP_AUTH_NONE,
            NS_LDAP_TLS_NONE,
            NS_LDAP_SASL_NONE,
            NS_LDAP_SASLOPT_NONE}}};

ns_ldap_return_code
__ns_ldap_initAuth(const char *auth_mech,
        ns_auth_t *auth,
        ns_ldap_error_t **errorp)
{
    uint32_t    i;
    char        errmsg[MAXERROR];

    if (auth_mech == NULL) {
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("Invalid authentication method specified\n"));
        MKERROR(LOG_WARNING,
            *errorp,
            NS_LDAP_INTERNAL,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        return (NS_LDAP_INTERNAL);
    }

    for (i = 0; authArray[i].authMech != NULL; ++i) {
        if (strcasecmp(auth_mech, authArray[i].authMech) == 0) {
            *auth = authArray[i].auth;
            return (NS_LDAP_SUCCESS);
        }
    }

    (void) snprintf(errmsg,
        sizeof (errmsg),
        gettext("Invalid authentication method specified\n"));
    MKERROR(LOG_WARNING,
        *errorp,
        NS_LDAP_INTERNAL,
        strdup(errmsg),
        NS_LDAP_MEMORY);
    return (NS_LDAP_INTERNAL);
}

/*
 * This function "informs" libsldap that a client application has specified
 * a directory to use. The function obtains a DUAProfile, credentials,
 * and naming context. During all further operations on behalf
 * of the application requested a standalone schema libsldap will use
 * the information obtained by __ns_ldap_initStandalone() instead of
 * door_call(3C)ing ldap_cachemgr(1M).
 *
 * INPUT:
 *     sa_conf - a structure describing where and in which way to obtain all
 *               the configuration describing how to communicate to
 *               a choosen LDAP directory,
 *     errorp - an error object describing an error occured.
 */
ns_ldap_return_code
__ns_ldap_initStandalone(const ns_standalone_conf_t *sa_conf,
            ns_ldap_error_t **errorp) {

    ns_cred_t   user_cred = {{NS_LDAP_AUTH_NONE,
                    NS_LDAP_TLS_NONE,
                    NS_LDAP_SASL_NONE,
                    NS_LDAP_SASLOPT_NONE},
                    NULL,
                    {NULL, NULL}};
    char        *dua_profile = NULL;
    char        errmsg[MAXERROR];
    ns_config_t     *cfg;
    int     ret_code;

    if (sa_conf->SA_BIND_DN == NULL && sa_conf->SA_BIND_PWD != NULL ||
        sa_conf->SA_BIND_DN != NULL && sa_conf->SA_BIND_PWD == NULL) {
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("Bind DN and bind password"
            " must both be provided\n"));
        MKERROR(LOG_ERR,
            *errorp,
            NS_CONFIG_NOTLOADED,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        return (NS_LDAP_INTERNAL);
    }

    switch (sa_conf->type) {
    case NS_LDAP_SERVER:
        if (sa_conf->SA_BIND_DN != NULL) {
            user_cred.cred.unix_cred.userID = sa_conf->SA_BIND_DN;
            user_cred.auth.type = NS_LDAP_AUTH_SIMPLE;
        }

        if (sa_conf->SA_BIND_PWD != NULL) {
            user_cred.cred.unix_cred.passwd = sa_conf->SA_BIND_PWD;
        }

        if (sa_conf->SA_AUTH != NULL) {
            user_cred.auth.type = sa_conf->SA_AUTH->type;
            user_cred.auth.tlstype = sa_conf->SA_AUTH->tlstype;
            user_cred.auth.saslmech = sa_conf->SA_AUTH->saslmech;
            user_cred.auth.saslopt = sa_conf->SA_AUTH->saslopt;
        }

        if (sa_conf->SA_CERT_PATH != NULL) {
            user_cred.hostcertpath = sa_conf->SA_CERT_PATH;
        }

        ret_code = __ns_ldap_getConnectionInfoFromDUA(
            &sa_conf->ds_profile.server,
            &user_cred,
            &dua_profile,
            NULL,
            errorp);
        if (ret_code != NS_LDAP_SUCCESS) {
            return (ret_code);
        }

        cfg = __s_api_create_config_door_str(dua_profile, errorp);
        if (cfg == NULL) {
            free(dua_profile);
            return (NS_LDAP_CONFIG);
        }

        if (sa_conf->SA_CERT_PATH != NULL) {
            char        *certPathAttr;
            ParamIndexType  type;

            switch (cfg->version) {
            case NS_LDAP_V1:
                certPathAttr = "NS_LDAP_CERT_PATH";
                break;
            default:    /* Version 2 */
                certPathAttr = "NS_LDAP_HOST_CERTPATH";
                break;
            }

            if (__s_api_get_versiontype(cfg,
                        certPathAttr,
                        &type) == 0 &&
                (ret_code = __ns_ldap_setParamValue(cfg,
                        type,
                        sa_conf->SA_CERT_PATH,
                        errorp)) != NS_LDAP_SUCCESS) {
                __s_api_destroy_config(cfg);
                return (ret_code);
            }
        }

        if (sa_conf->SA_BIND_DN != NULL &&
            sa_conf->SA_BIND_PWD != NULL) {
            char *authMethods;

            authMethods = __s_api_strValue(cfg, NS_LDAP_AUTH_P,
                NS_FILE_FMT);
            if (authMethods != NULL &&
                strstr(authMethods, "sasl/GSSAPI") != NULL) {
                /*
                 * The received DUAProfile specifies
                 * sasl/GSSAPI as an auth. mechanism.
                 * The bind DN and password will be
                 * ignored.
                 */
                syslog(LOG_INFO, gettext("sasl/GSSAPI will be "
                    "used as an authentication method. "
                    "The bind DN and password will "
                    "be ignored.\n"));
                free(authMethods);
                break;
            }

            if (authMethods != NULL)
                free(authMethods);

            if (__ns_ldap_setParamValue(cfg,
                        NS_LDAP_BINDDN_P,
                        sa_conf->SA_BIND_DN,
                        errorp) != NS_LDAP_SUCCESS) {
                __s_api_destroy_config(cfg);
                return (NS_LDAP_CONFIG);
            }

            if (__ns_ldap_setParamValue(cfg,
                NS_LDAP_BINDPASSWD_P,
                sa_conf->SA_BIND_PWD,
                errorp) != NS_LDAP_SUCCESS) {
                __s_api_destroy_config(cfg);
                return (NS_LDAP_CONFIG);
            }
        }

        break;
    default:    /* NS_CACHEMGR */
        return (NS_LDAP_SUCCESS);
    }

    __s_api_init_config(cfg);
    /* Connection management should use the new config now. */
    __s_api_reinit_conn_mgmt_new_config(cfg);
    __ns_ldap_setServer(TRUE);

    (void) mutex_lock(&dir_servers.listReplaceLock);
    if ((ret_code = initGlobalList(errorp)) != NS_SUCCESS) {
        (void) mutex_unlock(&dir_servers.listReplaceLock);
        return (ret_code);
    }
    dir_servers.standalone = 1;
    (void) mutex_unlock(&dir_servers.listReplaceLock);

    return (NS_LDAP_SUCCESS);
}

/*
 * INPUT:
 *     serverAddr is the address of a server and
 *     request is one of the following:
 *     NS_CACHE_NEW:    get a new server address, addr is ignored.
 *     NS_CACHE_NORESP: get the next one, remove addr from list.
 *     NS_CACHE_NEXT:   get the next one, keep addr on list.
 *     NS_CACHE_WRITE:  get a non-replica server, if possible, if not, same
 *                      as NS_CACHE_NEXT.
 *     addrType:
 *     NS_CACHE_ADDR_IP: return server address as is, this is default.
 *     NS_CACHE_ADDR_HOSTNAME: return server addess as FQDN format, only
 *                             self credential case requires such format.
 * OUTPUT:
 *     ret
 *
 *     a structure of type ns_server_info_t containing the server address
 *     or name, server controls and supported SASL mechanisms.
 *     NOTE: Caller should allocate space for the structure and free
 *     all the space allocated by the function for the information contained
 *     in the structure.
 *
 *     error - an error object describing an error, if any.
 */
ns_ldap_return_code
__s_api_findRootDSE(const char *request,
        const char *serverAddr,
        const char *addrType,
        ns_server_info_t *ret,
        ns_ldap_error_t **error)
{
    dir_server_list_t   *current_list = NULL;
    ns_ldap_return_code ret_code;
    long            i = 0;
    int         matched = FALSE;
    dir_server_t        *server = NULL;
    char            errmsg[MAXERROR];

    (void) mutex_lock(&dir_servers.listReplaceLock);
    if (dir_servers.list == NULL) {
        (void) mutex_unlock(&dir_servers.listReplaceLock);
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("The list of root DSEs is empty: "
            "the Standalone mode was not properly initialized"));
        MKERROR(LOG_ERR,
            *error,
            NS_CONFIG_NOTLOADED,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        return (NS_LDAP_INTERNAL);
    }

    current_list = dir_servers.list;
    (void) rw_rdlock(&current_list->listDestroyLock);
    (void) mutex_unlock(&dir_servers.listReplaceLock);

    /*
     * The code below is mostly the clone of the
     * ldap_cachemgr::cachemgr_getldap.c::getldap_get_serverInfo() function.
     * Currently we have two different server lists: one is maintained
     * by libsldap ('standalone' mode), the other is in ldap_cachemgr
     * (a part of its standard functionality).
     */

    /*
     * If NS_CACHE_NEW, or the server info is new,
     * starts from the beginning of the list.
     */
    (void) mutex_lock(&current_list->nsServers[0]->updateStatus);
    if (strcmp(request, NS_CACHE_NEW) == 0 ||
        current_list->nsServers[0]->info == INFO_STATUS_NEW) {
        matched = TRUE;
    }
    (void) mutex_unlock(&current_list->nsServers[i]->updateStatus);

    for (i = 0; current_list->nsServers[i]; ++i) {
        /*
         * Lock the updateStatus mutex to
         * make sure the server status stays the same
         * while the data is being processed.
         */
        if (matched == FALSE &&
            strcmp(current_list->nsServers[i]->ip,
            serverAddr) == 0) {
            matched = TRUE;
            if (strcmp(request, NS_CACHE_NORESP) == 0) {

                /*
                 * if the server has already been removed,
                 * don't bother.
                 */
                (void) mutex_lock(&current_list->
                    nsServers[i]->updateStatus);
                if (current_list->nsServers[i]->status ==
                    INFO_SERVER_REMOVED) {
                    (void) mutex_unlock(&current_list->
                        nsServers[i]->
                        updateStatus);
                    continue;
                }
                (void) mutex_unlock(&current_list->
                    nsServers[i]->
                    updateStatus);

                /*
                 * if the information is new,
                 * give this server one more chance.
                 */
                (void) mutex_lock(&current_list->
                    nsServers[i]->
                    updateStatus);
                if (current_list->nsServers[i]->info ==
                    INFO_STATUS_NEW &&
                    current_list->nsServers[i]->status  ==
                    INFO_SERVER_UP) {
                    server = current_list->nsServers[i];
                    (void) mutex_unlock(&current_list->
                        nsServers[i]->
                        updateStatus);
                    break;
                } else {
                    /*
                     * it is recommended that
                     * before removing the
                     * server from the list,
                     * the server should be
                     * contacted one more time
                     * to make sure that it is
                     * really unavailable.
                     * For now, just trust the client
                     * (i.e., the sldap library)
                     * that it knows what it is
                     * doing and would not try
                     * to mess up the server
                     * list.
                     */
                    current_list->nsServers[i]->status =
                        INFO_SERVER_REMOVED;
                    (void) mutex_unlock(&current_list->
                        nsServers[i]->
                        updateStatus);
                    continue;
                }
            } else {
                /*
                 * req == NS_CACHE_NEXT or NS_CACHE_WRITE
                 */
                continue;
            }
        }

        if (matched) {
            if (strcmp(request, NS_CACHE_WRITE) == 0) {
                /*
                 * ldap_cachemgr checks here if the server
                 * is not a non-replica server (a server
                 * of type INFO_RW_WRITEABLE). But currently
                 * it considers all the servers in its list
                 * as those.
                 */
                (void) mutex_lock(&current_list->
                    nsServers[i]->
                    updateStatus);
                if (current_list->nsServers[i]->status  ==
                    INFO_SERVER_UP) {
                    (void) mutex_unlock(&current_list->
                        nsServers[i]->
                        updateStatus);
                    server = current_list->nsServers[i];
                    break;
                }
            } else {
                (void) mutex_lock(&current_list->
                    nsServers[i]->
                    updateStatus);
                if (current_list->nsServers[i]->status ==
                    INFO_SERVER_UP) {
                    (void) mutex_unlock(&current_list->
                        nsServers[i]->
                        updateStatus);
                    server = current_list->nsServers[i];
                    break;
                }
            }

            (void) mutex_unlock(&current_list->
                nsServers[i]->
                updateStatus);
        }
    }

    if (server == NULL) {
        (void) rw_unlock(&current_list->listDestroyLock);
        (void) snprintf(errmsg,
            sizeof (errmsg),
            gettext("No servers are available"));
        MKERROR(LOG_ERR,
            *error,
            NS_CONFIG_NOTLOADED,
            strdup(errmsg),
            NS_LDAP_MEMORY);
        return (NS_LDAP_NOTFOUND);
    }

    (void) mutex_lock(&server->updateStatus);
    server->info = INFO_STATUS_OLD;
    (void) mutex_unlock(&server->updateStatus);

    if (ret == NULL) {
        (void) rw_unlock(&current_list->listDestroyLock);
        return (NS_LDAP_SUCCESS);
    }

    if (strcmp(addrType, NS_CACHE_ADDR_HOSTNAME) == 0) {
        ret_code = __s_api_ip2hostname(server->ip, &ret->serverFQDN);
        if (ret_code != NS_LDAP_SUCCESS) {
            (void) snprintf(errmsg,
                sizeof (errmsg),
                gettext("The %s address "
                "can not be resolved into "
                "a host name. Returning "
                "the address as it is."),
                server->ip);
            MKERROR(LOG_ERR,
                *error,
                NS_CONFIG_NOTLOADED,
                strdup(errmsg),
                NS_LDAP_MEMORY);
            return (NS_LDAP_INTERNAL);
        }
    }

    ret->server = strdup(server->ip);

    ret->controls = __s_api_cp2dArray(server->controls);
    ret->saslMechanisms = __s_api_cp2dArray(server->saslMech);
    ret->serverType = server->serverType;

    (void) rw_unlock(&current_list->listDestroyLock);

    return (NS_LDAP_SUCCESS);
}

/*
 * This function iterates through the list of the configured LDAP servers
 * and "pings" those which are marked as removed or if any error occurred
 * during the previous receiving of the server's root DSE. If the
 * function is able to reach such a server and get its root DSE, it
 * marks the server as on-line. Otherwise, the server's status is set
 * to "Error".
 * For each server the function tries to connect to, it fires up
 * a separate thread and then waits until all the treads finish.
 * The function returns NS_LDAP_INTERNAL if the Standalone mode was not
 * initialized or was canceled prior to an invocation of
 * __ns_ldap_pingOfflineServers().
 */
ns_ldap_return_code
__ns_ldap_pingOfflineServers(void)
{
    dir_server_list_t   *current_list = NULL;
    ns_ldap_return_code retCode = NS_LDAP_SUCCESS;
    long            srvListLength, i = 0;
    thread_t        *thrPool, thrID;
    void            *status = NULL;

    (void) mutex_lock(&dir_servers.listReplaceLock);
    if (dir_servers.list == NULL) {
        (void) mutex_unlock(&dir_servers.listReplaceLock);
        return (NS_LDAP_INTERNAL);
    }

    current_list = dir_servers.list;
    (void) rw_wrlock(&current_list->listDestroyLock);
    (void) mutex_unlock(&dir_servers.listReplaceLock);

    while (current_list->nsServers[i] != NULL) {
        ++i;
    }
    srvListLength = i;

    thrPool = calloc(srvListLength, sizeof (thread_t));
    if (thrPool == NULL) {
        (void) rw_unlock(&current_list->listDestroyLock);
        return (NS_LDAP_MEMORY);
    }

    for (i = 0; i < srvListLength; ++i) {
        if (current_list->nsServers[i]->status != INFO_SERVER_REMOVED &&
            current_list->nsServers[i]->status != INFO_SERVER_ERROR) {
            continue;
        }
        current_list->nsServers[i]->status = INFO_SERVER_CONNECTING;
        current_list->nsServers[i]->info = INFO_STATUS_NEW;

        __s_api_free2dArray(current_list->nsServers[i]->controls);
        current_list->nsServers[i]->controls = NULL;
        __s_api_free2dArray(current_list->nsServers[i]->saslMech);
        current_list->nsServers[i]->saslMech = NULL;

        switch (thr_create(NULL,
            0,
            create_ns_servers_entry,
            current_list->nsServers[i],
            0,
            &thrID)) {
        case EAGAIN:
            current_list->nsServers[i]->status = INFO_SERVER_ERROR;
            continue;
            /* NOTREACHED */
            break;
        case ENOMEM:
            current_list->nsServers[i]->status = INFO_SERVER_ERROR;
            retCode = NS_LDAP_MEMORY;
            break;
        default:
            thrPool[i] = thrID;
            continue;
            /* NOTREACHED */
            break;
        }
        /* A memory allocation error has occured */
        break;

    }

    for (i = 0; i < srvListLength; ++i) {
        if (thrPool[i] != 0 &&
            thr_join(thrPool[i], NULL, &status) == 0) {
            if (status == NULL) {
                current_list->nsServers[i]->status =
                    INFO_SERVER_ERROR;
                retCode = NS_LDAP_MEMORY;
            }
            free(status);
        }
    }

    (void) rw_unlock(&current_list->listDestroyLock);

    free(thrPool);

    return (retCode);
}