jeremycx · jjhoughton · Nov 2, 2019 · Mar 3, 2020 · Mar 4, 2020 · Mar 6, 2020
diff --git a/LDAPCnx.cc b/LDAPCnx.cc
@@ -62,6 +62,7 @@ void LDAPCnx::New(const Nan::FunctionCallbackInfo<Value>& info) {
     int debug           = info[5]->NumberValue();
     int verifycert      = info[6]->NumberValue();
     int referrals       = info[7]->NumberValue();
+    Nan::Utf8String       cacertfile(info[8]);
     int zero            = 0;
 
     ld->ldap_callback = (ldap_conncb *)malloc(sizeof(ldap_conncb));
@@ -76,6 +77,10 @@ void LDAPCnx::New(const Nan::FunctionCallbackInfo<Value>& info) {
 
     struct timeval ntimeout = { timeout/1000, (timeout%1000) * 1000 };
 
+    if (info[8]->IsString()) {
+      ldap_set_option(ld->ld, LDAP_OPT_X_TLS_CACERTFILE, *cacertfile);
+    }
+
     ldap_set_option(ld->ld, LDAP_OPT_PROTOCOL_VERSION,   &ver);
     ldap_set_option(NULL,   LDAP_OPT_DEBUG_LEVEL,        &debug);
     ldap_set_option(ld->ld, LDAP_OPT_CONNECT_CB,         ld->ldap_callback);

diff --git a/README.md b/README.md
@@ -63,6 +63,7 @@ var LDAP = require('ldap-client');
 var ldap = new LDAP({
     uri:             'ldap://server',   // string
     validatecert:    false,             // Verify server certificate
+    ca:              "ca.pem",          // optional path of a ca certificate file
     connecttimeout:  -1,                // seconds, default is -1 (infinite timeout), connect timeout
     base:            'dc=com',          // default base for all future searches
     attrs:           '*',               // default attribute list for future searches
@@ -94,7 +95,7 @@ var ldap = new LDAP({
 
 TLS
 ===
-TLS can be used via the ldaps:// protocol string in the URI attribute on instantiation. If you want to eschew server certificate checking (if you have a self-signed cserver certificate, for example), you can set the `verifycert` attribute to `LDAP.LDAP_OPT_X_TLS_NEVER`, or one of the following values:
+TLS can be used via the ldaps:// protocol string in the URI attribute on instantiation. If you want to eschew server certificate checking, you can set the `verifycert` attribute to `LDAP.LDAP_OPT_X_TLS_NEVER`, or one of the following values:
 
 ```js
 var LDAP=require('ldap-client');

diff --git a/index.js b/index.js
@@ -98,7 +98,8 @@ function LDAP(opt, fn) {
                                   this.options.ntimeout,
                                   this.options.debug,
                                   this.options.validatecert,
-                                  this.options.referrals);
+                                  this.options.referrals,
+                                  this.options.ca);
 
     if (typeof fn !== 'function') {
         fn = function() {};

diff --git a/test/certs/ca.crt b/test/certs/ca.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDAjCCAeoCCQCJz+e6p8ebYzANBgkqhkiG9w0BAQsFADBDMQswCQYDVQQGEwJH
+QjETMBEGA1UECAwKQ2hlbHRlbmhhbTENMAsGA1UECgwESm9zaDEQMA4GA1UEAwwH
+Sm9zaCBDQTAeFw0yMDAzMDYxMjEyNDFaFw00NzA3MjMxMjEyNDFaMEMxCzAJBgNV
+BAYTAkdCMRMwEQYDVQQIDApDaGVsdGVuaGFtMQ0wCwYDVQQKDARKb3NoMRAwDgYD
+VQQDDAdKb3NoIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6PDH
+4W4xF8eai4Ijz/uuRpvVElHnD8MzqfMBx16TzxKXVGMK2MCUYK+WCAv32u06e6bB
+Ocj9IyOumGktRqVwrY0r43yKjssUp+k0Q4/PWHsBo4VgSzRVUXiUbB08tikHS7XZ
+vXBjRtlsW+/PWGkuce6n/MfiRDHUgedRPa4Q5wYMOdi04D5uhE/nH1WYP+K0/sFi
+FhjrruzpGoPrRdNa2TN8EzgU/83y/6bMlLrG8TXD/s2+7gBodY7zl1AP0A/+Gna2
+rZQFOBPC6o4Jj/q4YzLbldrJ9TBjxGwT0gFCOVcd7kwOtgdpdzHWfb0+rBSS8cw+
+IR3ZhJsfyum6OXDU+wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAAL3fvqGAeWZMG
+MgEh6UQP0dgerLTb+lUiLKJzsOpm5Ys0sIoaAEee9q3TxyD6v/u8Vh2ildHGpyS2
+Nge8uzznW34sTCpFLJf0JysbV7l4xYkmEn/z5iYYqh+p6khUUzQkkhy/MT0CWVtq
+5pYTpMREGJMTFAgP03cZ66HyCuENcijWW7Xfu0dFjvOzyNOUc3/PrQKgDRQODzz/
+8+bR+9xY++cGSe0O8o54FSWqV43V5yIpusIBXJR+dPh6Cua7UnqUNW824RFSRnsQ
+2XddOhCYHhRpzN5XPmFtOYlfhvnQDQo82CH3A/kKO7t1XsTUTwRskT1yafqEnajg
+CnnloSdU
+-----END CERTIFICATE-----
diff --git a/test/certs/ca.key b/test/certs/ca.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA6PDH4W4xF8eai4Ijz/uuRpvVElHnD8MzqfMBx16TzxKXVGMK
+2MCUYK+WCAv32u06e6bBOcj9IyOumGktRqVwrY0r43yKjssUp+k0Q4/PWHsBo4Vg
+SzRVUXiUbB08tikHS7XZvXBjRtlsW+/PWGkuce6n/MfiRDHUgedRPa4Q5wYMOdi0
+4D5uhE/nH1WYP+K0/sFiFhjrruzpGoPrRdNa2TN8EzgU/83y/6bMlLrG8TXD/s2+
+7gBodY7zl1AP0A/+Gna2rZQFOBPC6o4Jj/q4YzLbldrJ9TBjxGwT0gFCOVcd7kwO
+tgdpdzHWfb0+rBSS8cw+IR3ZhJsfyum6OXDU+wIDAQABAoIBAQCsXEW6Q5vl2Zc8
+NT6kjblFm9cMaDgNzMV0slAVoqDCLyJ0mZiUC+N+q03bhGeQwcptZlVBmbvc/XEa
+a3DJ/m6irHvWJvgrco9FM2StvUKSWOo8gdtfqkibMRq56ORccX1pgxSrfPaonQb1
+/DszUxi/yvTYMVr2VNzGhk/x0NPG7KQ+OsYz1sCSJCXJOhtzjNIHNobEgog/+Cj2
+hX5Qe9wF2+cygsUCjsKKvkYhCDN6AYjyEuVdKRZHDsBCu3Q2ErfAmFgO0Fs5D7v0
+bcTf1HCT+WCoyw3DDJu+TDlId8ChN+8fOjEJKajBdAddh84DsJWc00fmyYUShEez
+VtfleW35AoGBAPgwbR8njas0RBTHes6hQYrTem5Gu75mOAHQeIWVUEOpoS3ReVtS
+yhw4T35HPmA7IKmKZu4/GYBCjISYpM5SMK1fLxV/PnbrqRnyZDXEslRKduexfkxX
+4wOL6SR6XNIA/Gc15uOmoPcZhlkzUwPl9QaAxwWJ0OikcHr3tTYmhuB1AoGBAPBF
+gHIUNEIYripRTyFe8N75I3Sq7QtmZ592m76vVXtM5xPPQHZGkzVmGctY70GVCP5J
+lAtW0U7QWnH8SiLkI8Ezjv/wssjnrkvCsVXTdV3sU5eEaN9fXaGfyXNDg00E6Ata
+qw08kImb9uxx2VoeYa2ukJoERQ9Ys+OZ2D8QSzGvAoGBAJAt0bafi7VBj6tilv0i
+wKidYipd/QMG7tJfASTZMN+d03yCjDV5SuBJ9iQtzxaoQrk7JcCR94aDIo6E/ni9
+VnnhKcEbQnZjQMFKBt0Vf2NoPtsqSWygQcj1pmMCkpmM6RQsRA1L54ak1V9MaZWC
+KW21seiNv0bnAFDvRd5HU2NhAoGAc34VBcDsdbEDVtgKn1HRmnxLLLNUihxJRv9u
+UbRZ9JC8qmr+41t9Oze+wl4Xc4C99+1KOkEbDzVbpFrPEAJ1pVKxNBlw9t1WjJgj
+QcwJKIKGk9hTyLtAeIYkAUG8hXMMTxjgC9bG6z6K7JC1F3pvHVtBqqbOw1ex8H9s
+0LN2UYUCgYEAqU5hznevJYnkdsGr/xxpCqHUpbllEWDBCVrZraUxJ2DP/6U61hH6
+StqyN2qutkSDTLNMUDeAR1tLIAb9xonbQzzsd07/CbNu9iHJwidYopU3RBRdHjtj
+iPiyb8EP5x7ugYx7l8OT2ZFF75d2DbuUzabj5P8BpSFjyvr5Xmj72hg=
+-----END RSA PRIVATE KEY-----
diff --git a/test/certs/device.crt b/test/certs/device.crt
diff --git a/test/certs/device.csr b/test/certs/device.csr
diff --git a/test/certs/device.key b/test/certs/device.key
diff --git a/test/certs/rootCA.key b/test/certs/rootCA.key
diff --git a/test/certs/rootCA.pem b/test/certs/rootCA.pem
diff --git a/test/certs/rootCA.srl b/test/certs/rootCA.srl
diff --git a/test/certs/server.crt b/test/certs/server.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC/DCCAeQCCQC/bkZwDQTlnjANBgkqhkiG9w0BAQsFADBDMQswCQYDVQQGEwJH
+QjETMBEGA1UECAwKQ2hlbHRlbmhhbTENMAsGA1UECgwESm9zaDEQMA4GA1UEAwwH
+Sm9zaCBDQTAeFw0yMDAzMDYxMjE1NTdaFw00NzA3MjMxMjE1NTdaMD0xCzAJBgNV
+BAYTAkdCMRMwEQYDVQQIDApDaGVsdGVuaGFtMQ0wCwYDVQQKDARKb3NoMQowCAYD
+VQQDDAEqMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwD4jhNzitaEu
+Yw9e/3wDgdvbDoote5diOPUsE3r9jHm4ZQcSiZmgj93ulYBDzzNX4q8Nbgk04keU
+EUJBx/7sN4n2QpsJ8iN+cThRNDMU0LeQ/ekKpzAcq9bi60QzTuazfcC/INVXKyOr
+b0ZqsGMRxnKAB8BRITuoDDOBQPFVvay4VXV5i4wKb12hJTqEbhmHpFHAtpEInZHk
+Tj5ADUjlYnnvy3VxJjFSAWW2mRjm39LPtFQR1Rgohq8xOnhRIS/WmEJMrYrj596I
+srmo/QvGADgTzPg7R5WaJHChqCj9bYtS9pVs5GQpBqaQMLo4CdqrQ9ipTXxfA0Zg
+gEaau2LT3wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA4NsGrkqQHpZDM9lrybGLf
+fhMQD791zOEYzAiGSKCNqcIPeOGXeLEEN2afs76HcrCa3j0LLwZXO0B+QXLW0fZk
+z+xweyaJQ/3z3hW0LnmQNmO9wekKRw+8dknNSz3eo4H5qY0QRVq9ZQgdNx50Zry6
+kCtkOhtU5cihfdaEj2GhV5cfm6L6CMIhbXY8BDY+7NpFYfvQzWT9Z+Ohf9j+OHOo
+jB5mIv04Evdt6FWB60Ar1MkSiQjQVdE9C+4ordsTKGCQpjXRgXri5Qc6+rqguO8o
+Mixd1SAwrim5lhTSgz/ctlngzbJiqcOW83x+J9xLTsjBVi0Z/pXGkatZMa6/iV1W
+-----END CERTIFICATE-----
diff --git a/test/certs/server.key b/test/certs/server.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAwD4jhNzitaEuYw9e/3wDgdvbDoote5diOPUsE3r9jHm4ZQcS
+iZmgj93ulYBDzzNX4q8Nbgk04keUEUJBx/7sN4n2QpsJ8iN+cThRNDMU0LeQ/ekK
+pzAcq9bi60QzTuazfcC/INVXKyOrb0ZqsGMRxnKAB8BRITuoDDOBQPFVvay4VXV5
+i4wKb12hJTqEbhmHpFHAtpEInZHkTj5ADUjlYnnvy3VxJjFSAWW2mRjm39LPtFQR
+1Rgohq8xOnhRIS/WmEJMrYrj596Isrmo/QvGADgTzPg7R5WaJHChqCj9bYtS9pVs
+5GQpBqaQMLo4CdqrQ9ipTXxfA0ZggEaau2LT3wIDAQABAoIBAQCRgvdTq/YWUOhR
+puLbMz1cX9PRj5mZwR5hyoIQRLoCSGfgYJgRey1jeDMNCkdJYK2XMbVSorlaxZ83
+6RTtkvGtoEm8ZKoElAUzIdOlVTzeNvQSnQCpR+uLzl14gujrQgh+mRSSf6k5SAiN
+c5lx5asgsK5kL5e5NfSfN6UQSRwDMpc6oOqLvAT2XzMVRew6ivj1+OubYiC2Wdku
+2tmeixNVVwgMKwHzRfuFkwYOcvcjIw4lWg32A+yW2Rqn0Nq7kXLeDlTrkacPCfoa
+4yADV+2eyIxC+kMRnMdLgA91aM49wvtCJknNA60GYcQdLN9Pw/MDukR3gN+L3nDl
+hWbChGSRAoGBAOdUFWJmmWdq84k7z5DSJ1lO8tVkDXE35oYtMX2jQD8QMVw/UU8X
+4c8Wb1Ql9uSIkI95vixujYL7V76k52Lp/7FIdWShaS+itoJnmCKCTwbG9nCnp5lj
+Do04n873X0gcWQjUojiGmpfi2M3RsKGm4MUucWxRIw0095j++yjl8MzrAoGBANS+
+57zUTeecXT8EUf9HumLtFavAbWEgB0q4q4ewXr2VZBNXCE5dKnlvT2CDFZg/Upfg
+INsRi8dk7//bnpp8m8DzG9F8R8F1DWO/qata6rvdlNpQ07aL25Z7gJchAAVbLmIC
+pdNmqppODiF/g3rYlMwbQllJuzjoMZYt+rhW1ofdAoGBAK6fioT9bk/jLHQr8kQg
+YBPKxQTQwlT1Hc+rzfBJi/YPAzPfmEFchdkN1nxvLDDX5khoXmasDacSlOoVEZZZ
+jesGB5gvQHf1HFDUYsOqGn3DM8VWye3AGPwCAqD5m7OTsqI34T1KXujJFWBJKkzc
+7E/s/zIFDbCqiz2zPWViLqSBAoGANSPiWqZlNz81g3Ie0TcndWJnEVmleKc5aw6p
+ueDyKUTRlIsexgQ7gc2t9BuKH1dh2BHh4xaE5a9uy2geO9R4Sz/uaOs0OTx1tb7A
+MM8q5vY4IjgiSeyxUutSeW2CxdO6yDyFE0MHxjdNDEz/mIXU1Q7SCd+C5noJOMwP
+XlBCkfkCgYEA2d018ARx9l0CerVTz1uG1RyOWVLH/d5XuApov3+Bye7BeKlirv6m
+1RCFUDduXI3lr1TbifP7XK0W1E9A9u46KmTWm5PWRvNJOmSi3qXvI9nQsGvBmSQd
+VJfCUAeI1KaAMHp1fQq/tLbnOWUkEx1WjLe5Rs86CJ2VjCFfyATTYh4=
+-----END RSA PRIVATE KEY-----
diff --git a/test/certs/wrongca.crt b/test/certs/wrongca.crt
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFfTCCA2WgAwIBAgIUI8YwKAVnOqAcsENwBMFoOju6/20wDQYJKoZIhvcNAQEL
+BQAwTjELMAkGA1UEBhMCVUsxEDAOBgNVBAgMB0VuZ2xhbmQxEzARBgNVBAcMCkNo
+ZWx0ZW5oYW0xDDAKBgNVBAoMA2pqaDEKMAgGA1UEAwwBKjAeFw0xOTA2MTQyMDMy
+NDhaFw0yMjA2MTQyMDMyNDhaME4xCzAJBgNVBAYTAlVLMRAwDgYDVQQIDAdFbmds
+YW5kMRMwEQYDVQQHDApDaGVsdGVuaGFtMQwwCgYDVQQKDANqamgxCjAIBgNVBAMM
+ASowggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC0Vex3WyX6zHorsi28
+3+INfk/BxK8uT+peO4bcSBJvIp/3xswIGN0D7RnOsP5EpXDn57DWQGXW72Or3ec6
+dGYOQVA/tSv9qyx2HHytbvArhPVDwDscwDlict3qNoSCZIH5gjQZchmLxi5L0RJ7
+qBSiOzbMFcJGHJJvTCY10XeImlde+T/jak5NZQ3CAWBh6BEMZE7gK+ufdX4+M3N5
+ZfD7VlxA6q5TiZT50r5g9G9mKPM66UEK4TrosBGbCYNeGunLC4Q94oX7MzhAsAwl
+i8aHsA71455IH8g9WQ5/y2mYxuwdz4xdmBNtcmGlvd+BJ4PFtGvUqWdG5ECD55Ah
+718C2dnFnA53ZnHbIzf2XFSKILsUd/1uWhq0vBm5OlF96eD8BWYlBiBj6CXH9A24
+Gu0HzZtkKyO83yWC+uF3zz2/Ec7VN/cQUHIn2pixYL737o6EPxWnWxFuRCau2sue
+YnIw1x9BEg1cOLmSL6lHZj5Llr4mVCsewNMgMxzE2MfMpsnsEc0lwfX1ICFM347L
+sqx2LuArRytDV+ZJYueL33/eLw86BMjQ9FEBDNv3oEPi84raA76RMz1Z4yFAEW0M
+kcj9cUOsrM8G8Kud3eC/YnAMnOTQx2QETlnJv+E3frbgTYVxan8G5ynrbkJ7v0SD
++R8j57QzoTPAsDzJiIR0h2XfHQIDAQABo1MwUTAdBgNVHQ4EFgQUrQHskQDWP3Az
+mBnBpsC+wcBts7MwHwYDVR0jBBgwFoAUrQHskQDWP3AzmBnBpsC+wcBts7MwDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAar561zQXRH+t9nALpOuU
+ew1+hUqQlNmpg98Up2ZAjMtQmB+FiFc/2xMgk56F/sMUB3NHhtxQdPTpKELqdgmh
+sWJH0VwtAWB0lYOIvkTSLYEHvRRyzJOLJ9hUdS0ghLd52fNyBH5XOMo68z1CtjvN
+SCejAwkI/iZfXy94ZQAKaRLzRMd/MHDdIf4HrG3QHDA5WTlUUMnL+YyrmMtVjt3d
+9xZSIAXDvvAtqhyQN29wPY8d+m2xZIUs/sqluXvWB/z4Ze54tMqdKtnOfoBDIPoy
+Rnb24NY4pOrptj1qo2O7uNILXuK7snKBgVL4QtyG3UdOuVmzw+KfDr5fL1DmitIw
+JcLgQPY3ImVZA0owtScTV2sza7p7hrQJb3tc+JmXO7jywRzcr051Yrx9MgSO53RY
+veghNUHJYT/k4w4SbrNw5nJvcvnYMFxQgme/fLHhds+UsyjtlGRHI1VI39uZzjn2
+y8pPMPE+UWybc1BHP0xUCbShbqHlT2NTN8E+WyRM6SwzDTXRWKe87JaJQ/BU4InM
+3Msa9rdveyJMFBYmsq+/ikOltjp4kYSv2eUg38eemaK2Vo4E+lV9Vh7mjRinF1GA
+6cu6C8VbhlEIVz2KlS+hc7asLO2KNMbZYVSQf+4ASsLoVH2SeFZ4jIydEVAfhbJx
+pV7SBCA1RpxXszJYCDf4A6w=
+-----END CERTIFICATE-----
diff --git a/test/run_sasl.sh b/test/run_sasl.sh
@@ -1,15 +1,27 @@
 #!/bin/sh
 
 if [[ -z $SLAPD ]] ; then
-  SLAPD=/usr/local/libexec/slapd
+  if [ -f /usr/local/libexec/slapd ] ; then
+    SLAPD=/usr/local/libexec/slapd
+  else
+    SLAPD=slapd
+  fi
 fi
 
 if [[ -z $SLAPADD ]] ; then
-  SLAPADD=/usr/local/sbin/slapadd
+  if [ -f /usr/local/sbin/slapadd ] ; then
+    SLAPADD=/usr/local/sbin/slapadd
+  else
+    SLAPADD=slapadd
+  fi
 fi
 
 if [[ -z $SLAPD_CONF ]] ; then
-  SLAPD_CONF=sasl.conf
+  if [ -d /usr/local/etc/openldap/ ]; then
+    SLAPD_CONF=sasl.conf
+  else
+    SLAPD_CONF=sasl.linux.conf
+  fi
 fi
 
 MKDIR=/bin/mkdir

diff --git a/test/run_server.sh b/test/run_server.sh
@@ -1,16 +1,21 @@
 #!/bin/sh
 
-SLAPD=/usr/local/libexec/slapd
-SLAPADD=/usr/local/sbin/slapadd
+SLAPD=`test -f /usr/local/libexec/slapd && echo /usr/local/libexec/slapd || echo slapd`
+SLAPADD=`test -f /usr/local/sbin/slapadd && echo /usr/local/sbin/slapadd || echo slapadd`
 MKDIR=/bin/mkdir
 RM=/bin/rm
 KILL=/bin/kill
 
 $RM -rf openldap-data
 $MKDIR openldap-data
 
-$SLAPADD -f slapd.conf < startup.ldif
-$SLAPD -d999 -f slapd.conf -h "ldap://:1234 ldapi://%2ftmp%2fslapd.sock ldaps://localhost:1235"
+if [ -d /usr/local/etc/openldap/ ]; then
+    $SLAPADD -f slapd.conf < startup.ldif
+    $SLAPD -d999 -f slapd.conf -h "ldap://:1234 ldapi://%2ftmp%2fslapd.sock ldaps://localhost:1235"
+else
+    $SLAPADD -f slapd.linux.conf < startup.ldif
+    $SLAPD -d999 -f slapd.linux.conf -h "ldap://:1234 ldapi://%2ftmp%2fslapd.sock ldaps://localhost:1235"
+fi
+
 SLAPD_PID=$!
 # slapd should be running now
-
diff --git a/test/sasl.linux.conf b/test/sasl.linux.conf
@@ -0,0 +1,26 @@
+include		/etc/openldap/schema/core.schema
+include		/etc/openldap/schema/cosine.schema
+include		/etc/openldap/schema/inetorgperson.schema
+
+pidfile		./slapd.pid
+argsfile	./slapd.args
+
+modulepath	/usr/libexec/openldap
+moduleload	back_bdb
+
+idletimeout 100
+
+database	bdb
+
+sasl-auxprops slapd
+sasl-secprops none
+authz-regexp uid=(.*),cn=PLAIN,cn=auth cn=$1,dc=sample,dc=com
+authz-regexp uid=(.*),cn=authz,cn=auth cn=$1,dc=sample,dc=com
+password-hash {CLEARTEXT}
+authz-policy from
+
+suffix		"dc=sample,dc=com"
+rootdn		"cn=Manager,dc=sample,dc=com"
+rootpw		secret
+directory	./openldap-data
+index	objectClass,cn,contextCSN	eq