xref: /titanic_44/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c (revision 5c066ec28ea93f3a7c93082611a61747f255290a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/param.h>
27 #include <ldap.h>
28 #include <stdlib.h>
29 #include <gssapi/gssapi.h>
30 #include <sys/types.h>
31 #include <sys/socket.h>
32 #include <netinet/in.h>
33 #include <arpa/inet.h>
34 #include <sys/time.h>
35 #include <netdb.h>
36 #include <pthread.h>
37 #include <unistd.h>
38 #include <arpa/nameser.h>
39 #include <resolv.h>
40 #include <sys/synch.h>
41 #include <string.h>
42 #include <strings.h>
43 #include <fcntl.h>
44 #include <sys/types.h>
45 #include <sys/stat.h>
46 #include <assert.h>
47 
48 #include <smbsrv/libsmbns.h>
49 #include <smbns_ads.h>
50 #include <smbns_dyndns.h>
51 #include <smbns_krb.h>
52 
53 #define	SMB_ADS_DN_MAX	300
54 #define	SMB_ADS_MAXMSGLEN 512
55 #define	SMB_ADS_COMPUTERS_CN "Computers"
56 #define	SMB_ADS_COMPUTER_NUM_ATTR 8
57 #define	SMB_ADS_SHARE_NUM_ATTR 3
58 #define	SMB_ADS_SITE_MAX MAXHOSTNAMELEN
59 
60 #define	SMB_ADS_MSDCS_SRV_DC_RR		"_ldap._tcp.dc._msdcs"
61 #define	SMB_ADS_MSDCS_SRV_SITE_RR	"_ldap._tcp.%s._sites.dc._msdcs"
62 
63 /*
64  * domainControllerFunctionality
65  *
66  * This rootDSE attribute indicates the functional level of the DC.
67  */
68 #define	SMB_ADS_ATTR_DCLEVEL	"domainControllerFunctionality"
69 #define	SMB_ADS_DCLEVEL_W2K	0
70 #define	SMB_ADS_DCLEVEL_W2K3	2
71 #define	SMB_ADS_DCLEVEL_W2K8	3
72 
73 /*
74  * msDs-supportedEncryptionTypes (Windows Server 2008 only)
75  *
76  * This attribute defines the encryption types supported by the system.
77  * Encryption Types:
78  *  - DES cbc mode with CRC-32
79  *  - DES cbc mode with RSA-MD5
80  *  - ArcFour with HMAC/md5
81  *  - AES-128
82  *  - AES-256
83  */
84 #define	SMB_ADS_ATTR_ENCTYPES	"msDs-supportedEncryptionTypes"
85 #define	SMB_ADS_ENC_DES_CRC	1
86 #define	SMB_ADS_ENC_DES_MD5	2
87 #define	SMB_ADS_ENC_RC4		4
88 #define	SMB_ADS_ENC_AES128	8
89 #define	SMB_ADS_ENC_AES256	16
90 
91 #define	SMB_ADS_ATTR_SAMACCT	"sAMAccountName"
92 #define	SMB_ADS_ATTR_UPN	"userPrincipalName"
93 #define	SMB_ADS_ATTR_SPN	"servicePrincipalName"
94 #define	SMB_ADS_ATTR_CTL	"userAccountControl"
95 #define	SMB_ADS_ATTR_DNSHOST	"dNSHostName"
96 #define	SMB_ADS_ATTR_KVNO	"msDS-KeyVersionNumber"
97 #define	SMB_ADS_ATTR_DN		"distinguishedName"
98 
99 /*
100  * Length of "dc=" prefix.
101  */
102 #define	SMB_ADS_DN_PREFIX_LEN	3
103 
104 #define	SMB_ADS_MSDCS_SVC_CNT	2
105 
106 /* Cached ADS server to communicate with */
107 static smb_ads_host_info_t *smb_ads_cached_host_info = NULL;
108 static mutex_t smb_ads_cached_host_mtx;
109 
110 static char smb_ads_site[SMB_ADS_SITE_MAX];
111 static mutex_t smb_ads_site_mtx;
112 
113 /*
114  * smb_ads_adjoin_errmsg
115  *
116  * Use the adjoin return status defined in adjoin_status_t as the index
117  * to this table.
118  */
119 static char *smb_ads_adjoin_errmsg[] = {
120 	"ADJOIN succeeded.",
121 	"ADJOIN failed to get handle.",
122 	"ADJOIN failed to generate machine password.",
123 	"ADJOIN failed to add workstation trust account.",
124 	"ADJOIN failed to modify workstation trust account.",
125 	"ADJOIN failed to get list of encryption types.",
126 	"ADJOIN failed to initialize kerberos context.",
127 	"ADJOIN failed to get Kerberos principal.",
128 	"ADJOIN failed to set machine account password on AD.",
129 	"ADJOIN failed to modify CONTROL attribute of the account.",
130 	"ADJOIN failed to write Kerberos keytab file.",
131 	"ADJOIN failed to configure domain_name property for idmapd.",
132 	"ADJOIN failed to refresh idmap service."
133 };
134 
135 /* attribute/value pair */
136 typedef struct smb_ads_avpair {
137 	char *avp_attr;
138 	char *avp_val;
139 } smb_ads_avpair_t;
140 
141 /* query status */
142 typedef enum smb_ads_qstat {
143 	SMB_ADS_STAT_ERR = -2,
144 	SMB_ADS_STAT_DUP,
145 	SMB_ADS_STAT_NOT_FOUND,
146 	SMB_ADS_STAT_FOUND
147 } smb_ads_qstat_t;
148 
149 static smb_ads_handle_t *smb_ads_open_main(char *, char *, char *);
150 static int smb_ads_bind(smb_ads_handle_t *);
151 static int smb_ads_add_computer(smb_ads_handle_t *, int, char *);
152 static int smb_ads_modify_computer(smb_ads_handle_t *, int, char *);
153 static int smb_ads_computer_op(smb_ads_handle_t *, int, int, char *);
154 static smb_ads_qstat_t smb_ads_lookup_computer_n_attr(smb_ads_handle_t *,
155     smb_ads_avpair_t *, int, char *);
156 static int smb_ads_update_computer_cntrl_attr(smb_ads_handle_t *, int, char *);
157 static krb5_kvno smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t *, char *);
158 static int smb_ads_gen_machine_passwd(char *, int);
159 static smb_ads_host_info_t *smb_ads_get_cached_host(void);
160 static void smb_ads_set_cached_host(smb_ads_host_info_t *);
161 static void smb_ads_free_cached_host(void);
162 static int smb_ads_get_spnset(char *, char **);
163 static void smb_ads_free_spnset(char **);
164 static int smb_ads_alloc_attr(LDAPMod **, int);
165 static void smb_ads_free_attr(LDAPMod **);
166 static int smb_ads_get_dc_level(smb_ads_handle_t *);
167 static smb_ads_host_info_t *smb_ads_select_dc(smb_ads_host_list_t *);
168 static smb_ads_qstat_t smb_ads_find_computer(smb_ads_handle_t *, char *);
169 static smb_ads_qstat_t smb_ads_getattr(LDAP *, LDAPMessage *,
170     smb_ads_avpair_t *);
171 static smb_ads_qstat_t smb_ads_get_qstat(smb_ads_handle_t *, LDAPMessage *,
172     smb_ads_avpair_t *);
173 
174 /*
175  * smb_ads_init
176  *
177  * Initializes the smb_ads_site global variable.
178  */
179 void
180 smb_ads_init(void)
181 {
182 	(void) mutex_lock(&smb_ads_site_mtx);
183 	(void) smb_config_getstr(SMB_CI_ADS_SITE,
184 	    smb_ads_site, sizeof (smb_ads_site));
185 	(void) mutex_unlock(&smb_ads_site_mtx);
186 }
187 
188 /*
189  * smb_ads_refresh
190  *
191  * If the smb_ads_site has changed, clear the smb_ads_cached_host_info cache.
192  */
193 void
194 smb_ads_refresh(void)
195 {
196 	char new_site[SMB_ADS_SITE_MAX];
197 
198 	(void) smb_config_getstr(SMB_CI_ADS_SITE, new_site, sizeof (new_site));
199 	(void) mutex_lock(&smb_ads_site_mtx);
200 	if (utf8_strcasecmp(smb_ads_site, new_site)) {
201 		(void) strlcpy(smb_ads_site, new_site, sizeof (smb_ads_site));
202 		smb_ads_free_cached_host();
203 	}
204 	(void) mutex_unlock(&smb_ads_site_mtx);
205 }
206 
207 /*
208  * smb_ads_build_unc_name
209  *
210  * Construct the UNC name of the share object in the format of
211  * \\hostname.domain\shareUNC
212  *
213  * Returns 0 on success, -1 on error.
214  */
215 int
216 smb_ads_build_unc_name(char *unc_name, int maxlen,
217     const char *hostname, const char *shareUNC)
218 {
219 	char my_domain[MAXHOSTNAMELEN];
220 
221 	if (smb_getfqdomainname(my_domain, sizeof (my_domain)) != 0)
222 		return (-1);
223 
224 	(void) snprintf(unc_name, maxlen, "\\\\%s.%s\\%s",
225 	    hostname, my_domain, shareUNC);
226 	return (0);
227 }
228 
229 /*
230  * smb_ads_ldap_ping
231  *
232  * This is used to bind to an ADS server to see
233  * if it is still alive.
234  *
235  * Returns:
236  *   -1: error
237  *    0: successful
238  */
239 /*ARGSUSED*/
240 static int
241 smb_ads_ldap_ping(smb_ads_host_info_t *ads_host)
242 {
243 	struct in_addr addr;
244 	int ldversion = LDAP_VERSION3, status, timeoutms = 5 * 1000;
245 	LDAP *ld = NULL;
246 
247 	addr.s_addr = ads_host->ip_addr;
248 
249 	ld = ldap_init((char *)inet_ntoa(addr), ads_host->port);
250 	if (ld == NULL)
251 		return (-1);
252 
253 	ldversion = LDAP_VERSION3;
254 	(void) ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &ldversion);
255 	/* setup TCP/IP connect timeout */
256 	(void) ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeoutms);
257 
258 	status = ldap_bind_s(ld, "", NULL, LDAP_AUTH_SIMPLE);
259 
260 	if (status != LDAP_SUCCESS) {
261 		(void) ldap_unbind(ld);
262 		return (-1);
263 	}
264 
265 	(void) ldap_unbind(ld);
266 
267 	return (0);
268 }
269 
270 /*
271  * smb_ads_set_cached_host
272  *
273  * Cache the result of the ADS discovery if the cache is empty.
274  */
275 static void
276 smb_ads_set_cached_host(smb_ads_host_info_t *host)
277 {
278 	(void) mutex_lock(&smb_ads_cached_host_mtx);
279 	if (!smb_ads_cached_host_info)
280 		smb_ads_cached_host_info = host;
281 	(void) mutex_unlock(&smb_ads_cached_host_mtx);
282 }
283 
284 /*
285  * smb_ads_get_cached_host
286  *
287  * Get the cached ADS host info.
288  */
289 static smb_ads_host_info_t *
290 smb_ads_get_cached_host(void)
291 {
292 	smb_ads_host_info_t *host;
293 
294 	(void) mutex_lock(&smb_ads_cached_host_mtx);
295 	host = smb_ads_cached_host_info;
296 	(void) mutex_unlock(&smb_ads_cached_host_mtx);
297 	return (host);
298 }
299 
300 /*
301  * smb_ads_is_sought_host
302  *
303  * Returns true, if the sought host name matches the input host (host) name.
304  * The sought host is expected to be in Fully Qualified Domain Name (FQDN)
305  * format.
306  */
307 static boolean_t
308 smb_ads_is_sought_host(smb_ads_host_info_t *host, char *sought_host_name)
309 {
310 	if ((host == NULL) || (sought_host_name == NULL))
311 		return (B_FALSE);
312 
313 	if (utf8_strcasecmp(host->name, sought_host_name))
314 		return (B_FALSE);
315 
316 	return (B_TRUE);
317 }
318 
319 /*
320  * smb_ads_match_hosts_same_domain
321  *
322  * Returns true, if the cached ADS host is in the same domain as the
323  * current (given) domain.
324  */
325 static boolean_t
326 smb_ads_is_same_domain(char *cached_host_name, char *current_domain)
327 {
328 	char *cached_host_domain;
329 
330 	if ((cached_host_name == NULL) || (current_domain == NULL))
331 		return (B_FALSE);
332 
333 	cached_host_domain = strchr(cached_host_name, '.');
334 	if (cached_host_domain == NULL)
335 		return (B_FALSE);
336 
337 	++cached_host_domain;
338 	if (utf8_strcasecmp(cached_host_domain, current_domain))
339 		return (B_FALSE);
340 
341 	return (B_TRUE);
342 }
343 
344 /*
345  * smb_ads_skip_ques_sec
346  * Skips the question section.
347  */
348 static int
349 smb_ads_skip_ques_sec(int qcnt, uchar_t **ptr, uchar_t *eom)
350 {
351 	int i, len;
352 
353 	for (i = 0; i < qcnt; i++) {
354 		if ((len = dn_skipname(*ptr, eom)) < 0)
355 			return (-1);
356 
357 		*ptr += len + QFIXEDSZ;
358 	}
359 
360 	return (0);
361 }
362 
363 /*
364  * smb_ads_decode_host_ans_sec
365  * Decodes ADS hosts, priority, weight and port number from the answer
366  * section based on the current buffer pointer.
367  */
368 static int
369 smb_ads_decode_host_ans_sec(int ans_cnt, uchar_t **ptr, uchar_t *eom,
370     uchar_t *buf, smb_ads_host_info_t *ads_host_list)
371 {
372 	int i, len;
373 	smb_ads_host_info_t *ads_host;
374 
375 	for (i = 0; i < ans_cnt; i++) {
376 		ads_host = &ads_host_list[i];
377 
378 		if ((len = dn_skipname(*ptr, eom)) < 0)
379 			return (-1);
380 
381 
382 		*ptr += len;
383 
384 		/* skip type, class, ttl */
385 		*ptr += 8;
386 		/* data size */
387 		*ptr += 2;
388 
389 		/* Get priority, weight */
390 		/* LINTED: E_CONSTANT_CONDITION */
391 		NS_GET16(ads_host->priority, *ptr);
392 		/* LINTED: E_CONSTANT_CONDITION */
393 		NS_GET16(ads_host->weight, *ptr);
394 
395 		/* port */
396 		/* LINTED: E_CONSTANT_CONDITION */
397 		NS_GET16(ads_host->port, *ptr);
398 		/* domain name */
399 		len = dn_expand(buf, eom, *ptr, ads_host->name, MAXHOSTNAMELEN);
400 		if (len < 0)
401 			return (-1);
402 
403 		*ptr += len;
404 	}
405 
406 	return (0);
407 }
408 
409 /*
410  * smb_ads_skip_auth_sec
411  * Skips the authority section.
412  */
413 static int
414 smb_ads_skip_auth_sec(int ns_cnt, uchar_t **ptr, uchar_t *eom)
415 {
416 	int i, len;
417 	uint16_t size;
418 
419 	for (i = 0; i < ns_cnt; i++) {
420 		if ((len = dn_skipname(*ptr, eom)) < 0)
421 			return (-1);
422 
423 		*ptr += len;
424 		/* skip type, class, ttl */
425 		*ptr += 8;
426 		/* get len of data */
427 		/* LINTED: E_CONSTANT_CONDITION */
428 		NS_GET16(size, *ptr);
429 		if ((*ptr + size) > eom)
430 			return (-1);
431 
432 		*ptr += size;
433 	}
434 
435 	return (0);
436 }
437 
438 /*
439  * smb_ads_decode_host_ip
440  *
441  * Decodes ADS hosts and IP Addresses from the additional section based
442  * on the current buffer pointer.
443  */
444 static int
445 smb_ads_decode_host_ip(int addit_cnt, int ans_cnt, uchar_t **ptr,
446     uchar_t *eom, uchar_t *buf, smb_ads_host_info_t *ads_host_list)
447 {
448 	int i, j, len;
449 	in_addr_t ipaddr;
450 	char hostname[MAXHOSTNAMELEN];
451 	char *name;
452 
453 	for (i = 0; i < addit_cnt; i++) {
454 
455 		/* domain name */
456 		len = dn_expand(buf, eom, *ptr, hostname, MAXHOSTNAMELEN);
457 		if (len < 0)
458 			return (-1);
459 
460 		*ptr += len;
461 
462 		/* skip type, class, TTL, data len */
463 		*ptr += 10;
464 
465 		/* LINTED: E_CONSTANT_CONDITION */
466 		NS_GET32(ipaddr, *ptr);
467 
468 		/*
469 		 * find the host in the list of DC records from
470 		 * the answer section, that matches the host in the
471 		 * additional section, and set its IP address.
472 		 */
473 		for (j = 0; j < ans_cnt; j++) {
474 			if ((name = ads_host_list[j].name) == NULL)
475 				continue;
476 
477 			if (utf8_strcasecmp(name, hostname) == 0)
478 				ads_host_list[j].ip_addr = htonl(ipaddr);
479 		}
480 	}
481 
482 	return (0);
483 }
484 
485 /*
486  * smb_ads_dup_host_info
487  *
488  * Duplicates the passed smb_ads_host_info_t structure.
489  * Caller must free memory allocated by this method.
490  *
491  * Returns a reference to the duplicated smb_ads_host_info_t structure.
492  * Returns NULL on error.
493  */
494 static smb_ads_host_info_t *
495 smb_ads_dup_host_info(smb_ads_host_info_t *ads_host)
496 {
497 	smb_ads_host_info_t *dup_host;
498 
499 	if (ads_host == NULL)
500 		return (NULL);
501 
502 	dup_host = malloc(sizeof (smb_ads_host_info_t));
503 
504 	if (dup_host != NULL)
505 		bcopy(ads_host, dup_host, sizeof (smb_ads_host_info_t));
506 
507 	return (dup_host);
508 }
509 
510 /*
511  * smb_ads_hlist_alloc
512  */
513 smb_ads_host_list_t *
514 smb_ads_hlist_alloc(int count)
515 {
516 	int size;
517 	smb_ads_host_list_t *hlist;
518 
519 	if (count == 0)
520 		return (NULL);
521 
522 	size = sizeof (smb_ads_host_info_t) * count;
523 	hlist = (smb_ads_host_list_t *)malloc(sizeof (smb_ads_host_list_t));
524 	if (hlist == NULL)
525 		return (NULL);
526 
527 	hlist->ah_cnt = count;
528 	hlist->ah_list = (smb_ads_host_info_t *)malloc(size);
529 	if (hlist->ah_list == NULL) {
530 		free(hlist);
531 		return (NULL);
532 	}
533 
534 	bzero(hlist->ah_list, size);
535 	return (hlist);
536 }
537 
538 /*
539  * smb_ads_hlist_free
540  */
541 static void
542 smb_ads_hlist_free(smb_ads_host_list_t *host_list)
543 {
544 	if (host_list == NULL)
545 		return;
546 
547 	free(host_list->ah_list);
548 	free(host_list);
549 }
550 
551 /*
552  * smb_ads_query_dns_server
553  *
554  * This routine sends a DNS service location (SRV) query message to the
555  * DNS server via TCP to query it for a list of ADS server(s). Once a reply
556  * is received, the reply message is parsed to get the hostname. If there are IP
557  * addresses populated in the additional section then the additional section
558  * is parsed to obtain the IP addresses.
559  *
560  * The service location of _ldap._tcp.dc.msdcs.<ADS domain> is used to
561  * guarantee that Microsoft domain controllers are returned.  Microsoft domain
562  * controllers are also ADS servers.
563  *
564  * The ADS hostnames are stored in the answer section of the DNS reply message.
565  * The IP addresses are stored in the additional section.
566  *
567  * The DNS reply message may be in compress formed.  The compression is done
568  * on repeating domain name label in the message.  i.e hostname.
569  *
570  * Upon successful completion, host list of ADS server(s) is returned.
571  */
572 static smb_ads_host_list_t *
573 smb_ads_query_dns_server(char *domain, char *msdcs_svc_name)
574 {
575 	smb_ads_host_list_t *hlist = NULL;
576 	int len, qcnt, ans_cnt, ns_cnt, addit_cnt;
577 	uchar_t *ptr, *eom;
578 	struct __res_state res_state;
579 	union {
580 		HEADER hdr;
581 		uchar_t buf[NS_MAXMSG];
582 	} msg;
583 
584 	bzero(&res_state, sizeof (struct __res_state));
585 	if (res_ninit(&res_state) < 0)
586 		return (NULL);
587 
588 	/* use TCP */
589 	res_state.options |= RES_USEVC;
590 
591 	len = res_nquerydomain(&res_state, msdcs_svc_name, domain,
592 	    C_IN, T_SRV, msg.buf, sizeof (msg.buf));
593 
594 	if (len < 0) {
595 		smb_tracef("smbns_ads: DNS query for '%s' failed (%s)",
596 		    msdcs_svc_name, hstrerror(res_state.res_h_errno));
597 		res_ndestroy(&res_state);
598 		return (NULL);
599 	}
600 
601 	if (len > sizeof (msg.buf)) {
602 		smb_tracef("smbns_ads: DNS query %s: message too big (%d)",
603 		    msdcs_svc_name, len);
604 		res_ndestroy(&res_state);
605 		return (NULL);
606 	}
607 
608 	/* parse the reply, skip header and question sections */
609 	ptr = msg.buf + sizeof (msg.hdr);
610 	eom = msg.buf + len;
611 
612 	/* check truncated message bit */
613 	if (msg.hdr.tc)
614 		smb_tracef("smbns_ads: DNS query for '%s' detected "
615 		    "truncated TCP reply message", msdcs_svc_name);
616 
617 	qcnt = ntohs(msg.hdr.qdcount);
618 	ans_cnt = ntohs(msg.hdr.ancount);
619 	ns_cnt = ntohs(msg.hdr.nscount);
620 	addit_cnt = ntohs(msg.hdr.arcount);
621 
622 	if (smb_ads_skip_ques_sec(qcnt, &ptr, eom) != 0) {
623 		res_ndestroy(&res_state);
624 		return (NULL);
625 	}
626 
627 	hlist = smb_ads_hlist_alloc(ans_cnt);
628 	if (hlist == NULL) {
629 		res_ndestroy(&res_state);
630 		return (NULL);
631 	}
632 
633 	/* walk through the answer section */
634 	if (smb_ads_decode_host_ans_sec(ans_cnt, &ptr, eom, msg.buf,
635 	    hlist->ah_list) != 0) {
636 		smb_ads_hlist_free(hlist);
637 		res_ndestroy(&res_state);
638 		return (NULL);
639 	}
640 
641 	/* check authority section */
642 	if (ns_cnt > 0) {
643 		if (smb_ads_skip_auth_sec(ns_cnt, &ptr, eom) != 0) {
644 			smb_ads_hlist_free(hlist);
645 			res_ndestroy(&res_state);
646 			return (NULL);
647 		}
648 	}
649 
650 	/*
651 	 * Check additional section to get IP address of ADS host.
652 	 */
653 	if (addit_cnt > 0) {
654 		if (smb_ads_decode_host_ip(addit_cnt, ans_cnt,
655 		    &ptr, eom, msg.buf, hlist->ah_list) != 0) {
656 			smb_ads_hlist_free(hlist);
657 			res_ndestroy(&res_state);
658 			return (NULL);
659 		}
660 	}
661 
662 	res_ndestroy(&res_state);
663 	return (hlist);
664 }
665 
666 /*
667  * smb_ads_set_site_service
668  *
669  * This method sets the name of the site, to look for the ADS domain.
670  */
671 static void
672 smb_ads_set_site_service(char *site_service)
673 {
674 	(void) mutex_lock(&smb_ads_site_mtx);
675 	if (*smb_ads_site == '\0')
676 		*site_service = '\0';
677 	else
678 		(void) snprintf(site_service, sizeof (site_service),
679 		    SMB_ADS_MSDCS_SRV_SITE_RR, smb_ads_site);
680 	(void) mutex_unlock(&smb_ads_site_mtx);
681 }
682 
683 /*
684  * smb_ads_getipnodebyname
685  *
686  * This method gets the IP address by doing a host name lookup.
687  */
688 static int
689 smb_ads_getipnodebyname(smb_ads_host_info_t *hentry)
690 {
691 	struct hostent *h;
692 	int error;
693 
694 	h = getipnodebyname(hentry->name, AF_INET, 0, &error);
695 	if (h == NULL || h->h_addr == NULL)
696 		return (-1);
697 
698 	(void) memcpy(&hentry->ip_addr, h->h_addr, h->h_length);
699 
700 	freehostent(h);
701 	return (0);
702 }
703 
704 /*
705  * smb_ads_find_host
706  *
707  * Finds a ADS host in a given domain.
708  *
709  * Parameters:
710  *   domain: domain of ADS host.
711  *   sought: the ADS host to be sought.
712  *
713  *           If the ADS host is cached and it responds to ldap ping,
714  *		- Cached ADS host is returned, if sought host is not specified.
715  *			OR
716  *		- Cached ADS host is returned, if the sought host matches the
717  *		  cached ADS host AND the cached ADS host is in the same domain
718  *		  as the given domain.
719  *
720  *	     If the ADS host is not cached in the given domain, the ADS host
721  *	     is returned if it matches the sought host.
722  *
723  * Returns:
724  *   ADS host: fully qualified hostname, ip address, ldap port.
725  */
726 /*ARGSUSED*/
727 smb_ads_host_info_t *
728 smb_ads_find_host(char *domain, char *sought)
729 {
730 	int i;
731 	smb_ads_host_list_t *hlist;
732 	smb_ads_host_info_t *hlistp = NULL, *hentry = NULL, *host = NULL;
733 	char site_service[MAXHOSTNAMELEN];
734 	char *msdcs_svc_name[SMB_ADS_MSDCS_SVC_CNT] =
735 	    {site_service, SMB_ADS_MSDCS_SRV_DC_RR};
736 
737 	if ((sought) && (*sought == '\0'))
738 		sought = NULL;
739 
740 	/*
741 	 * If the cached host responds to ldap ping,
742 	 *   -	return cached ADS host, if sought host is not specified OR
743 	 *   -	return cached ADS host, if the sought host matches the cached
744 	 *	ADS host AND the cached ADS host is in the same domain as the
745 	 *	given domain.
746 	 */
747 	host = smb_ads_get_cached_host();
748 	if (host) {
749 		if (smb_ads_ldap_ping(host) == 0) {
750 			if (!sought)
751 				return (host);
752 
753 			if (smb_ads_is_same_domain(host->name, domain) &&
754 			    smb_ads_is_sought_host(host, sought))
755 				return (host);
756 		}
757 
758 		smb_ads_free_cached_host();
759 	}
760 
761 	smb_ads_set_site_service(site_service);
762 
763 	/*
764 	 * First look for ADS hosts in ADS site if configured.  Then try
765 	 * without ADS site info.
766 	 */
767 	for (i = 0; i < SMB_ADS_MSDCS_SVC_CNT; i++) {
768 		if (*msdcs_svc_name[i] == '\0')
769 			continue;
770 
771 		hlist = smb_ads_query_dns_server(domain, msdcs_svc_name[i]);
772 		if (hlist != NULL)
773 			break;
774 	}
775 
776 	if ((hlist == NULL) || (hlist->ah_list == NULL) || (hlist->ah_cnt == 0))
777 		return (NULL);
778 	hlistp = hlist->ah_list;
779 
780 	for (i = 0; i < hlist->ah_cnt; i++) {
781 
782 		/* Do a host lookup by hostname to get the IP address */
783 		if (hlistp[i].ip_addr == 0) {
784 			if (smb_ads_getipnodebyname(&hlistp[i]) < 0)
785 				continue;
786 		}
787 
788 		/* If a dc is sought, return it here */
789 		if (smb_ads_is_sought_host(&hlistp[i], sought) &&
790 		    (smb_ads_ldap_ping(&hlistp[i]) == 0)) {
791 			host = smb_ads_dup_host_info(&hlistp[i]);
792 			smb_ads_set_cached_host(host);
793 			smb_ads_hlist_free(hlist);
794 			return (host);
795 		}
796 	}
797 
798 	/* Select DC from DC list */
799 	hentry = smb_ads_select_dc(hlist);
800 	if (hentry != NULL) {
801 		host = smb_ads_dup_host_info(hentry);
802 		smb_ads_set_cached_host(host);
803 		smb_ads_hlist_free(hlist);
804 		return (host);
805 	}
806 
807 	smb_ads_hlist_free(hlist);
808 
809 	return (NULL);
810 }
811 
812 /*
813  * Return the number of dots in a string.
814  */
815 static int
816 smb_ads_count_dots(const char *s)
817 {
818 	int ndots = 0;
819 
820 	while (*s) {
821 		if (*s++ == '.')
822 			ndots++;
823 	}
824 
825 	return (ndots);
826 }
827 
828 /*
829  * Convert a domain name in dot notation to distinguished name format,
830  * for example: sun.com -> dc=sun,dc=com.
831  *
832  * Returns a pointer to an allocated buffer containing the distinguished
833  * name.
834  */
835 static char *
836 smb_ads_convert_domain(const char *domain_name)
837 {
838 	const char *s;
839 	char *dn_name;
840 	char buf[2];
841 	int ndots;
842 	int len;
843 
844 	if (domain_name == NULL || *domain_name == 0)
845 		return (NULL);
846 
847 	ndots = smb_ads_count_dots(domain_name);
848 	++ndots;
849 	len = strlen(domain_name) + (ndots * SMB_ADS_DN_PREFIX_LEN) + 1;
850 
851 	if ((dn_name = malloc(len)) == NULL)
852 		return (NULL);
853 
854 	bzero(dn_name, len);
855 	(void) strlcpy(dn_name, "dc=", len);
856 
857 	buf[1] = '\0';
858 	s = domain_name;
859 
860 	while (*s) {
861 		if (*s == '.') {
862 			(void) strlcat(dn_name, ",dc=", len);
863 		} else {
864 			buf[0] = *s;
865 			(void) strlcat(dn_name, buf, len);
866 		}
867 		++s;
868 	}
869 
870 	return (dn_name);
871 }
872 
873 /*
874  * smb_ads_free_cached_host
875  *
876  * Free the memory use by the global smb_ads_cached_host_info & set it to NULL.
877  */
878 static void
879 smb_ads_free_cached_host(void)
880 {
881 	(void) mutex_lock(&smb_ads_cached_host_mtx);
882 	if (smb_ads_cached_host_info) {
883 		free(smb_ads_cached_host_info);
884 		smb_ads_cached_host_info = NULL;
885 	}
886 	(void) mutex_unlock(&smb_ads_cached_host_mtx);
887 }
888 
889 /*
890  * smb_ads_open
891  * Open a LDAP connection to an ADS server if the system is in domain mode.
892  * Acquire both Kerberos TGT and LDAP service tickets for the host principal.
893  *
894  * This function should only be called after the system is successfully joined
895  * to a domain.
896  */
897 smb_ads_handle_t *
898 smb_ads_open(void)
899 {
900 	char domain[MAXHOSTNAMELEN];
901 
902 	if (smb_config_get_secmode() != SMB_SECMODE_DOMAIN)
903 		return (NULL);
904 
905 	if (smb_getfqdomainname(domain, MAXHOSTNAMELEN) != 0)
906 		return (NULL);
907 
908 	return (smb_ads_open_main(domain, NULL, NULL));
909 }
910 
911 /*
912  * smb_ads_open_main
913  * Open a LDAP connection to an ADS server.
914  * If ADS is enabled and the administrative username, password, and
915  * ADS domain are defined then query DNS to find an ADS server if this is the
916  * very first call to this routine.  After an ADS server is found then this
917  * server will be used everytime this routine is called until the system is
918  * rebooted or the ADS server becomes unavailable then an ADS server will
919  * be queried again.  After the connection is made then an ADS handle
920  * is created to be returned.
921  *
922  * After the LDAP connection, the LDAP version will be set to 3 using
923  * ldap_set_option().
924  *
925  * The smb_ads_bind() routine is also called before the ADS handle is returned.
926  * Parameters:
927  *   domain - fully-qualified domain name
928  *   user   - the user account for whom the Kerberos TGT ticket and ADS
929  *            service tickets are acquired.
930  *   password - password of the specified user
931  *
932  * Returns:
933  *   NULL              : can't connect to ADS server or other errors
934  *   smb_ads_handle_t* : handle to ADS server
935  */
936 static smb_ads_handle_t *
937 smb_ads_open_main(char *domain, char *user, char *password)
938 {
939 	smb_ads_handle_t *ah;
940 	LDAP *ld;
941 	int version = 3;
942 	smb_ads_host_info_t *ads_host = NULL;
943 	struct in_addr addr;
944 
945 	ads_host = smb_ads_find_host(domain, NULL);
946 	if (ads_host == NULL)
947 		return (NULL);
948 
949 
950 	ah = (smb_ads_handle_t *)malloc(sizeof (smb_ads_handle_t));
951 	if (ah == NULL)
952 		return (NULL);
953 	(void) memset(ah, 0, sizeof (smb_ads_handle_t));
954 
955 	addr.s_addr = ads_host->ip_addr;
956 	if ((ld = ldap_init((char *)inet_ntoa(addr), ads_host->port)) == NULL) {
957 		smb_ads_free_cached_host();
958 		free(ah);
959 		return (NULL);
960 	}
961 
962 	if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)
963 	    != LDAP_SUCCESS) {
964 		smb_ads_free_cached_host();
965 		free(ah);
966 		(void) ldap_unbind(ld);
967 		return (NULL);
968 	}
969 
970 	(void) ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
971 	ah->ld = ld;
972 	ah->user = (user) ? strdup(user) : NULL;
973 	ah->pwd = (password) ? strdup(password) : NULL;
974 	ah->domain = strdup(domain);
975 
976 	if (ah->domain == NULL) {
977 		smb_ads_close(ah);
978 		return (NULL);
979 	}
980 
981 	ah->domain_dn = smb_ads_convert_domain(domain);
982 	if (ah->domain_dn == NULL) {
983 		smb_ads_close(ah);
984 		return (NULL);
985 	}
986 
987 	ah->hostname = strdup(ads_host->name);
988 	if (ah->hostname == NULL) {
989 		smb_ads_close(ah);
990 		return (NULL);
991 	}
992 	(void) mutex_lock(&smb_ads_site_mtx);
993 	if (*smb_ads_site != '\0') {
994 		if ((ah->site = strdup(smb_ads_site)) == NULL) {
995 			smb_ads_close(ah);
996 			(void) mutex_unlock(&smb_ads_site_mtx);
997 			return (NULL);
998 		}
999 	} else {
1000 		ah->site = NULL;
1001 	}
1002 	(void) mutex_unlock(&smb_ads_site_mtx);
1003 
1004 	if (smb_ads_bind(ah) == -1) {
1005 		smb_ads_close(ah);
1006 		return (NULL);
1007 	}
1008 
1009 	return (ah);
1010 }
1011 
1012 /*
1013  * smb_ads_close
1014  * Close connection to ADS server and free memory allocated for ADS handle.
1015  * LDAP unbind is called here.
1016  * Parameters:
1017  *   ah: handle to ADS server
1018  * Returns:
1019  *   void
1020  */
1021 void
1022 smb_ads_close(smb_ads_handle_t *ah)
1023 {
1024 	int len;
1025 
1026 	if (ah == NULL)
1027 		return;
1028 	/* close and free connection resources */
1029 	if (ah->ld)
1030 		(void) ldap_unbind(ah->ld);
1031 
1032 	free(ah->user);
1033 	if (ah->pwd) {
1034 		len = strlen(ah->pwd);
1035 		/* zero out the memory that contains user's password */
1036 		if (len > 0)
1037 			bzero(ah->pwd, len);
1038 		free(ah->pwd);
1039 	}
1040 	free(ah->domain);
1041 	free(ah->domain_dn);
1042 	free(ah->hostname);
1043 	free(ah->site);
1044 	free(ah);
1045 }
1046 
1047 /*
1048  * smb_ads_display_stat
1049  * Display error message for GSS-API routines.
1050  * Parameters:
1051  *   maj:  GSS major status
1052  *   min:  GSS minor status
1053  * Returns:
1054  *   None
1055  */
1056 static void
1057 smb_ads_display_stat(OM_uint32 maj, OM_uint32 min)
1058 {
1059 	gss_buffer_desc msg;
1060 	OM_uint32 msg_ctx = 0;
1061 	OM_uint32 min2;
1062 	(void) gss_display_status(&min2, maj, GSS_C_GSS_CODE, GSS_C_NULL_OID,
1063 	    &msg_ctx, &msg);
1064 	smb_tracef("smbns_ads: major status error: %s", (char *)msg.value);
1065 	(void) gss_release_buffer(&min2, &msg);
1066 	(void) gss_display_status(&min2, min, GSS_C_MECH_CODE, GSS_C_NULL_OID,
1067 	    &msg_ctx, &msg);
1068 	smb_tracef("smbns_ads: minor status error: %s", (char *)msg.value);
1069 	(void) gss_release_buffer(&min2, &msg);
1070 }
1071 
1072 /*
1073  * smb_ads_alloc_attr
1074  *
1075  * Since the attrs is a null-terminated array, all elements
1076  * in the array (except the last one) will point to allocated
1077  * memory.
1078  */
1079 static int
1080 smb_ads_alloc_attr(LDAPMod *attrs[], int num)
1081 {
1082 	int i;
1083 
1084 	bzero(attrs, num * sizeof (LDAPMod *));
1085 	for (i = 0; i < (num - 1); i++) {
1086 		attrs[i] = (LDAPMod *)malloc(sizeof (LDAPMod));
1087 		if (attrs[i] == NULL) {
1088 			smb_ads_free_attr(attrs);
1089 			return (-1);
1090 		}
1091 	}
1092 
1093 	return (0);
1094 }
1095 
1096 /*
1097  * smb_ads_free_attr
1098  * Free memory allocated when publishing a share.
1099  * Parameters:
1100  *   attrs: an array of LDAPMod pointers
1101  * Returns:
1102  *   None
1103  */
1104 static void
1105 smb_ads_free_attr(LDAPMod *attrs[])
1106 {
1107 	int i;
1108 	for (i = 0; attrs[i]; i++) {
1109 		free(attrs[i]);
1110 	}
1111 }
1112 
1113 /*
1114  * smb_ads_get_spnset
1115  *
1116  * Derives the core set of SPNs based on the FQHN.
1117  * The spn_set is a null-terminated array of char pointers.
1118  *
1119  * Returns 0 upon success. Otherwise, returns -1.
1120  */
1121 static int
1122 smb_ads_get_spnset(char *fqhost, char **spn_set)
1123 {
1124 	int i;
1125 
1126 	bzero(spn_set, (SMBKRB5_SPN_IDX_MAX + 1) * sizeof (char *));
1127 	for (i = 0; i < SMBKRB5_SPN_IDX_MAX; i++) {
1128 		if ((spn_set[i] = smb_krb5_get_spn(i, fqhost)) == NULL) {
1129 			smb_ads_free_spnset(spn_set);
1130 			return (-1);
1131 		}
1132 	}
1133 
1134 	return (0);
1135 }
1136 
1137 /*
1138  * smb_ads_free_spnset
1139  *
1140  * Free the memory allocated for the set of SPNs.
1141  */
1142 static void
1143 smb_ads_free_spnset(char **spn_set)
1144 {
1145 	int i;
1146 	for (i = 0; spn_set[i]; i++)
1147 		free(spn_set[i]);
1148 }
1149 
1150 /*
1151  * smb_ads_acquire_cred
1152  * Called by smb_ads_bind() to get a handle to administrative user's credential
1153  * stored locally on the system.  The credential is the TGT.  If the attempt at
1154  * getting handle fails then a second attempt will be made after getting a
1155  * new TGT.
1156  * Please look at smb_ads_bind() for more information.
1157  *
1158  * Paramters:
1159  *   ah         : handle to ADS server
1160  *   kinit_retry: if 0 then a second attempt will be made to get handle to the
1161  *                credential if the first attempt fails
1162  * Returns:
1163  *   cred_handle: handle to the administrative user's credential (TGT)
1164  *   oid        : contains Kerberos 5 object identifier
1165  *   kinit_retry: A 1 indicates that a second attempt has been made to get
1166  *                handle to the credential and no further attempts can be made
1167  *   -1         : error
1168  *    0         : success
1169  */
1170 static int
1171 smb_ads_acquire_cred(smb_ads_handle_t *ah, gss_cred_id_t *cred_handle,
1172     gss_OID *oid, int *kinit_retry)
1173 {
1174 	return (krb5_acquire_cred_kinit(ah->user, ah->pwd, cred_handle, oid,
1175 	    kinit_retry, "ads"));
1176 }
1177 
1178 /*
1179  * smb_ads_establish_sec_context
1180  * Called by smb_ads_bind() to establish a security context to an LDAP service
1181  * on an ADS server. If the attempt at establishing the security context fails
1182  * then a second attempt will be made by smb_ads_bind() if a new TGT has not
1183  * been already obtained in ads_acquire_cred.  The second attempt, if allowed,
1184  * will obtained a new TGT here and a new handle to the credential will also be
1185  * obtained in ads_acquire_cred.  LDAP SASL bind is used to send and receive
1186  * the GSS tokens to and from the ADS server.
1187  * Please look at ads_bind for more information.
1188  * Paramters:
1189  *   ah             : handle to ADS server
1190  *   cred_handle    : handle to administrative user's credential (TGT)
1191  *   oid            : Kerberos 5 object identifier
1192  *   kinit_retry    : if 0 then a second attempt can be made to establish a
1193  *                    security context with ADS server if first attempt fails
1194  * Returns:
1195  *   gss_context    : security context to ADS server
1196  *   sercred        : encrypted ADS server's supported security layers
1197  *   do_acquire_cred: if 1 then a second attempt will be made to establish a
1198  *                    security context with ADS server after getting a new
1199  *                    handle to the user's credential
1200  *   kinit_retry    : if 1 then a second attempt will be made to establish a
1201  *                    a security context and no further attempts can be made
1202  *   -1             : error
1203  *    0             : success
1204  */
1205 static int
1206 smb_ads_establish_sec_context(smb_ads_handle_t *ah, gss_ctx_id_t *gss_context,
1207     gss_cred_id_t cred_handle, gss_OID oid, struct berval **sercred,
1208     int *kinit_retry, int *do_acquire_cred)
1209 {
1210 	OM_uint32 maj, min, time_rec;
1211 	char service_name[SMB_ADS_MAXBUFLEN];
1212 	gss_buffer_desc send_tok, service_buf;
1213 	gss_name_t target_name;
1214 	gss_buffer_desc input;
1215 	gss_buffer_desc *inputptr;
1216 	struct berval cred;
1217 	OM_uint32 ret_flags;
1218 	int stat;
1219 	int gss_flags;
1220 
1221 	(void) snprintf(service_name, SMB_ADS_MAXBUFLEN, "ldap@%s",
1222 	    ah->hostname);
1223 	service_buf.value = service_name;
1224 	service_buf.length = strlen(service_name)+1;
1225 	if ((maj = gss_import_name(&min, &service_buf,
1226 	    (gss_OID) gss_nt_service_name,
1227 	    &target_name)) != GSS_S_COMPLETE) {
1228 		smb_ads_display_stat(maj, min);
1229 		if (oid != GSS_C_NO_OID)
1230 			(void) gss_release_oid(&min, &oid);
1231 		return (-1);
1232 	}
1233 
1234 	*gss_context = GSS_C_NO_CONTEXT;
1235 	*sercred = NULL;
1236 	inputptr = GSS_C_NO_BUFFER;
1237 	gss_flags = GSS_C_MUTUAL_FLAG;
1238 	do {
1239 		if (krb5_establish_sec_ctx_kinit(ah->user, ah->pwd,
1240 		    cred_handle, gss_context, target_name, oid,
1241 		    gss_flags, inputptr, &send_tok,
1242 		    &ret_flags, &time_rec, kinit_retry,
1243 		    do_acquire_cred, &maj, "ads") == -1) {
1244 			if (oid != GSS_C_NO_OID)
1245 				(void) gss_release_oid(&min, &oid);
1246 			(void) gss_release_name(&min, &target_name);
1247 			return (-1);
1248 		}
1249 
1250 		cred.bv_val = send_tok.value;
1251 		cred.bv_len = send_tok.length;
1252 		if (*sercred) {
1253 			ber_bvfree(*sercred);
1254 			*sercred = NULL;
1255 		}
1256 		stat = ldap_sasl_bind_s(ah->ld, NULL, "GSSAPI",
1257 		    &cred, NULL, NULL, sercred);
1258 		if (stat != LDAP_SUCCESS &&
1259 		    stat != LDAP_SASL_BIND_IN_PROGRESS) {
1260 			smb_tracef("smbns_ads: ldap_sasl_bind error: %s",
1261 			    ldap_err2string(stat));
1262 			if (oid != GSS_C_NO_OID)
1263 				(void) gss_release_oid(&min, &oid);
1264 			(void) gss_release_name(&min, &target_name);
1265 			(void) gss_release_buffer(&min, &send_tok);
1266 			return (-1);
1267 		}
1268 		input.value = (*sercred)->bv_val;
1269 		input.length = (*sercred)->bv_len;
1270 		inputptr = &input;
1271 		if (send_tok.length > 0)
1272 			(void) gss_release_buffer(&min, &send_tok);
1273 	} while (maj != GSS_S_COMPLETE);
1274 
1275 	if (oid != GSS_C_NO_OID)
1276 		(void) gss_release_oid(&min, &oid);
1277 	(void) gss_release_name(&min, &target_name);
1278 
1279 	return (0);
1280 }
1281 
1282 /*
1283  * smb_ads_negotiate_sec_layer
1284  * Call by smb_ads_bind() to negotiate additional security layer for further
1285  * communication after security context establishment.  No additional security
1286  * is needed so a "no security layer" is negotiated.  The security layer is
1287  * described in the SASL RFC 2478 and this step is needed for secure LDAP
1288  * binding.  LDAP SASL bind is used to send and receive the GSS tokens to and
1289  * from the ADS server.
1290  * Please look at smb_ads_bind for more information.
1291  *
1292  * Paramters:
1293  *   ah         : handle to ADS server
1294  *   gss_context: security context to ADS server
1295  *   sercred    : encrypted ADS server's supported security layers
1296  * Returns:
1297  *   -1         : error
1298  *    0         : success
1299  */
1300 static int
1301 smb_ads_negotiate_sec_layer(smb_ads_handle_t *ah, gss_ctx_id_t gss_context,
1302     struct berval *sercred)
1303 {
1304 	OM_uint32 maj, min;
1305 	gss_buffer_desc unwrap_inbuf, unwrap_outbuf;
1306 	gss_buffer_desc wrap_inbuf, wrap_outbuf;
1307 	int conf_state, sec_layer;
1308 	char auth_id[5];
1309 	struct berval cred;
1310 	int stat;
1311 	gss_qop_t qt;
1312 
1313 	/* check for server supported security layer */
1314 	unwrap_inbuf.value = sercred->bv_val;
1315 	unwrap_inbuf.length = sercred->bv_len;
1316 	if ((maj = gss_unwrap(&min, gss_context,
1317 	    &unwrap_inbuf, &unwrap_outbuf,
1318 	    &conf_state, &qt)) != GSS_S_COMPLETE) {
1319 		smb_ads_display_stat(maj, min);
1320 		if (sercred)
1321 			ber_bvfree(sercred);
1322 		return (-1);
1323 	}
1324 	sec_layer = *((char *)unwrap_outbuf.value);
1325 	(void) gss_release_buffer(&min, &unwrap_outbuf);
1326 	if (!(sec_layer & 1)) {
1327 		if (sercred)
1328 			ber_bvfree(sercred);
1329 		return (-1);
1330 	}
1331 	if (sercred) ber_bvfree(sercred);
1332 
1333 	/* no security layer needed after successful binding */
1334 	auth_id[0] = 0x01;
1335 
1336 	/* byte 2-4: max client recv size in network byte order */
1337 	auth_id[1] = 0x00;
1338 	auth_id[2] = 0x40;
1339 	auth_id[3] = 0x00;
1340 	wrap_inbuf.value = auth_id;
1341 	wrap_inbuf.length = 4;
1342 	conf_state = 0;
1343 	if ((maj = gss_wrap(&min, gss_context, conf_state, 0, &wrap_inbuf,
1344 	    &conf_state, &wrap_outbuf)) != GSS_S_COMPLETE) {
1345 		smb_ads_display_stat(maj, min);
1346 		return (-1);
1347 	}
1348 
1349 	cred.bv_val = wrap_outbuf.value;
1350 	cred.bv_len = wrap_outbuf.length;
1351 	sercred = NULL;
1352 	stat = ldap_sasl_bind_s(ah->ld, NULL, "GSSAPI", &cred, NULL, NULL,
1353 	    &sercred);
1354 	if (stat != LDAP_SUCCESS && stat != LDAP_SASL_BIND_IN_PROGRESS) {
1355 		smb_tracef("smbns_ads: ldap_sasl_bind error: %s:",
1356 		    ldap_err2string(stat));
1357 		(void) gss_release_buffer(&min, &wrap_outbuf);
1358 		return (-1);
1359 	}
1360 
1361 	(void) gss_release_buffer(&min, &wrap_outbuf);
1362 	if (sercred)
1363 		ber_bvfree(sercred);
1364 
1365 	return (0);
1366 }
1367 
1368 /*
1369  * smb_ads_bind
1370  * Use secure binding to bind to ADS server.
1371  * Use GSS-API with Kerberos 5 as the security mechanism and LDAP SASL with
1372  * Kerberos 5 as the security mechanisn to authenticate, obtain a security
1373  * context, and securely bind an administrative user so that other LDAP
1374  * commands can be used, i.e. add and delete.
1375  *
1376  * To obtain the security context, a Kerberos ticket-granting ticket (TGT)
1377  * for the user is needed to obtain a ticket for the LDAP service.  To get
1378  * a TGT for the user, the username and password is needed.  Once a TGT is
1379  * obtained then it will be stored locally and used until it is expired.
1380  * This routine will automatically obtained a TGT for the first time or when
1381  * it expired.  LDAP SASL bind is then finally used to send GSS tokens to
1382  * obtain a security context for the LDAP service on the ADS server.  If
1383  * there is any problem getting the security context then a new TGT will be
1384  * obtain to try getting the security context once more.
1385  *
1386  * After the security context is obtain and established, the LDAP SASL bind
1387  * is used to negotiate an additional security layer.  No further security is
1388  * needed so a "no security layer" is negotiated.  After this the security
1389  * context can be deleted and further LDAP commands can be sent to the ADS
1390  * server until a LDAP unbind command is issued to the ADS server.
1391  * Paramaters:
1392  *   ah: handle to ADS server
1393  * Returns:
1394  *  -1: error
1395  *   0: success
1396  */
1397 static int
1398 smb_ads_bind(smb_ads_handle_t *ah)
1399 {
1400 	OM_uint32 min;
1401 	gss_cred_id_t cred_handle;
1402 	gss_ctx_id_t gss_context;
1403 	gss_OID oid;
1404 	struct berval *sercred;
1405 	int kinit_retry, do_acquire_cred;
1406 	int rc = 0;
1407 
1408 	kinit_retry = 0;
1409 	do_acquire_cred = 0;
1410 
1411 acquire_cred:
1412 
1413 	if (smb_ads_acquire_cred(ah, &cred_handle, &oid, &kinit_retry))
1414 		return (-1);
1415 
1416 	if (smb_ads_establish_sec_context(ah, &gss_context, cred_handle,
1417 	    oid, &sercred, &kinit_retry, &do_acquire_cred)) {
1418 		(void) gss_release_cred(&min, &cred_handle);
1419 		if (do_acquire_cred) {
1420 			do_acquire_cred = 0;
1421 			goto acquire_cred;
1422 		}
1423 		return (-1);
1424 	}
1425 	rc = smb_ads_negotiate_sec_layer(ah, gss_context, sercred);
1426 
1427 	if (cred_handle != GSS_C_NO_CREDENTIAL)
1428 		(void) gss_release_cred(&min, &cred_handle);
1429 	(void) gss_delete_sec_context(&min, &gss_context, NULL);
1430 
1431 	return ((rc) ? -1 : 0);
1432 }
1433 
1434 /*
1435  * smb_ads_add_share
1436  * Call by smb_ads_publish_share to create share object in ADS.
1437  * This routine specifies the attributes of an ADS LDAP share object. The first
1438  * attribute and values define the type of ADS object, the share object.  The
1439  * second attribute and value define the UNC of the share data for the share
1440  * object. The LDAP synchronous add command is used to add the object into ADS.
1441  * The container location to add the object needs to specified.
1442  * Parameters:
1443  *   ah          : handle to ADS server
1444  *   adsShareName: name of share object to be created in ADS
1445  *   shareUNC    : share name on NetForce
1446  *   adsContainer: location in ADS to create share object
1447  *
1448  * Returns:
1449  *   -1          : error
1450  *    0          : success
1451  */
1452 int
1453 smb_ads_add_share(smb_ads_handle_t *ah, const char *adsShareName,
1454     const char *unc_name, const char *adsContainer)
1455 {
1456 	LDAPMod *attrs[SMB_ADS_SHARE_NUM_ATTR];
1457 	char *tmp1[5], *tmp2[5];
1458 	int j = 0;
1459 	char *share_dn;
1460 	int len, ret;
1461 
1462 	len = 5 + strlen(adsShareName) + strlen(adsContainer) +
1463 	    strlen(ah->domain_dn) + 1;
1464 
1465 	share_dn = (char *)malloc(len);
1466 	if (share_dn == NULL)
1467 		return (-1);
1468 
1469 	(void) snprintf(share_dn, len, "cn=%s,%s,%s", adsShareName,
1470 	    adsContainer, ah->domain_dn);
1471 
1472 	if (smb_ads_alloc_attr(attrs, SMB_ADS_SHARE_NUM_ATTR) != 0) {
1473 		free(share_dn);
1474 		return (-1);
1475 	}
1476 
1477 	attrs[j]->mod_op = LDAP_MOD_ADD;
1478 	attrs[j]->mod_type = "objectClass";
1479 	tmp1[0] = "top";
1480 	tmp1[1] = "leaf";
1481 	tmp1[2] = "connectionPoint";
1482 	tmp1[3] = "volume";
1483 	tmp1[4] = 0;
1484 	attrs[j]->mod_values = tmp1;
1485 
1486 	attrs[++j]->mod_op = LDAP_MOD_ADD;
1487 	attrs[j]->mod_type = "uNCName";
1488 	tmp2[0] = (char *)unc_name;
1489 	tmp2[1] = 0;
1490 	attrs[j]->mod_values = tmp2;
1491 
1492 	if ((ret = ldap_add_s(ah->ld, share_dn, attrs)) != LDAP_SUCCESS) {
1493 		smb_tracef("smbns_ads: %s: ldap_add error: %s",
1494 		    share_dn, ldap_err2string(ret));
1495 		smb_ads_free_attr(attrs);
1496 		free(share_dn);
1497 		return (ret);
1498 	}
1499 	free(share_dn);
1500 	smb_ads_free_attr(attrs);
1501 
1502 	return (0);
1503 }
1504 
1505 /*
1506  * smb_ads_del_share
1507  * Call by smb_ads_remove_share to remove share object from ADS.  The container
1508  * location to remove the object needs to specified.  The LDAP synchronous
1509  * delete command is used.
1510  * Parameters:
1511  *   ah          : handle to ADS server
1512  *   adsShareName: name of share object in ADS to be removed
1513  *   adsContainer: location of share object in ADS
1514  * Returns:
1515  *   -1          : error
1516  *    0          : success
1517  */
1518 static int
1519 smb_ads_del_share(smb_ads_handle_t *ah, const char *adsShareName,
1520     const char *adsContainer)
1521 {
1522 	char *share_dn;
1523 	int len, ret;
1524 
1525 	len = 5 + strlen(adsShareName) + strlen(adsContainer) +
1526 	    strlen(ah->domain_dn) + 1;
1527 
1528 	share_dn = (char *)malloc(len);
1529 	if (share_dn == NULL)
1530 		return (-1);
1531 
1532 	(void) snprintf(share_dn, len, "cn=%s,%s,%s", adsShareName,
1533 	    adsContainer, ah->domain_dn);
1534 	if ((ret = ldap_delete_s(ah->ld, share_dn)) != LDAP_SUCCESS) {
1535 		smb_tracef("smbns_ads: ldap_delete error: %s",
1536 		    ldap_err2string(ret));
1537 		free(share_dn);
1538 		return (-1);
1539 	}
1540 	free(share_dn);
1541 
1542 	return (0);
1543 }
1544 
1545 
1546 /*
1547  * smb_ads_escape_search_filter_chars
1548  *
1549  * This routine will escape the special characters found in a string
1550  * that will later be passed to the ldap search filter.
1551  *
1552  * RFC 1960 - A String Representation of LDAP Search Filters
1553  * 3.  String Search Filter Definition
1554  * If a value must contain one of the characters '*' OR '(' OR ')',
1555  * these characters
1556  * should be escaped by preceding them with the backslash '\' character.
1557  *
1558  * RFC 2252 - LDAP Attribute Syntax Definitions
1559  * a backslash quoting mechanism is used to escape
1560  * the following separator symbol character (such as "'", "$" or "#") if
1561  * it should occur in that string.
1562  */
1563 static int
1564 smb_ads_escape_search_filter_chars(const char *src, char *dst)
1565 {
1566 	int avail = SMB_ADS_MAXBUFLEN - 1; /* reserve a space for NULL char */
1567 
1568 	if (src == NULL || dst == NULL)
1569 		return (-1);
1570 
1571 	while (*src) {
1572 		if (!avail) {
1573 			*dst = 0;
1574 			return (-1);
1575 		}
1576 
1577 		switch (*src) {
1578 		case '\\':
1579 		case '\'':
1580 		case '$':
1581 		case '#':
1582 		case '*':
1583 		case '(':
1584 		case ')':
1585 			*dst++ = '\\';
1586 			avail--;
1587 			/* fall through */
1588 
1589 		default:
1590 			*dst++ = *src++;
1591 			avail--;
1592 		}
1593 	}
1594 
1595 	*dst = 0;
1596 
1597 	return (0);
1598 }
1599 
1600 /*
1601  * smb_ads_lookup_share
1602  * The search filter is set to search for a specific share name in the
1603  * specified ADS container.  The LDSAP synchronous search command is used.
1604  * Parameters:
1605  *   ah          : handle to ADS server
1606  *   adsShareName: name of share object in ADS to be searched
1607  *   adsContainer: location of share object in ADS
1608  * Returns:
1609  *   -1          : error
1610  *    0          : not found
1611  *    1          : found
1612  */
1613 int
1614 smb_ads_lookup_share(smb_ads_handle_t *ah, const char *adsShareName,
1615     const char *adsContainer, char *unc_name)
1616 {
1617 	char *attrs[4], filter[SMB_ADS_MAXBUFLEN];
1618 	char *share_dn;
1619 	int len, ret;
1620 	LDAPMessage *res;
1621 	char tmpbuf[SMB_ADS_MAXBUFLEN];
1622 
1623 	if (adsShareName == NULL || adsContainer == NULL)
1624 		return (-1);
1625 
1626 	len = 5 + strlen(adsShareName) + strlen(adsContainer) +
1627 	    strlen(ah->domain_dn) + 1;
1628 
1629 	share_dn = (char *)malloc(len);
1630 	if (share_dn == NULL)
1631 		return (-1);
1632 
1633 	(void) snprintf(share_dn, len, "cn=%s,%s,%s", adsShareName,
1634 	    adsContainer, ah->domain_dn);
1635 
1636 	res = NULL;
1637 	attrs[0] = "cn";
1638 	attrs[1] = "objectClass";
1639 	attrs[2] = "uNCName";
1640 	attrs[3] = NULL;
1641 
1642 	if (smb_ads_escape_search_filter_chars(unc_name, tmpbuf) != 0) {
1643 		free(share_dn);
1644 		return (-1);
1645 	}
1646 
1647 	(void) snprintf(filter, sizeof (filter),
1648 	    "(&(objectClass=volume)(uNCName=%s))", tmpbuf);
1649 
1650 	if ((ret = ldap_search_s(ah->ld, share_dn,
1651 	    LDAP_SCOPE_BASE, filter, attrs, 0, &res)) != LDAP_SUCCESS) {
1652 		if (ret != LDAP_NO_SUCH_OBJECT)
1653 			smb_tracef("smbns_ads: %s: ldap_search error: %s",
1654 			    share_dn, ldap_err2string(ret));
1655 
1656 		(void) ldap_msgfree(res);
1657 		free(share_dn);
1658 		return (0);
1659 	}
1660 
1661 	(void) free(share_dn);
1662 
1663 	/* no match is found */
1664 	if (ldap_count_entries(ah->ld, res) == 0) {
1665 		(void) ldap_msgfree(res);
1666 		return (0);
1667 	}
1668 
1669 	/* free the search results */
1670 	(void) ldap_msgfree(res);
1671 
1672 	return (1);
1673 }
1674 
1675 /*
1676  * smb_ads_publish_share
1677  * Publish share into ADS.  If a share name already exist in ADS in the same
1678  * container then the existing share object is removed before adding the new
1679  * share object.
1680  * Parameters:
1681  *   ah          : handle return from smb_ads_open
1682  *   adsShareName: name of share to be added to ADS directory
1683  *   shareUNC    : name of share on client, can be NULL to use the same name
1684  *                 as adsShareName
1685  *   adsContainer: location for share to be added in ADS directory, ie
1686  *                   ou=share_folder
1687  *   uncType     : use UNC_HOSTNAME to use hostname for UNC, use UNC_HOSTADDR
1688  *                   to use host ip addr for UNC.
1689  * Returns:
1690  *   -1          : error
1691  *    0          : success
1692  */
1693 int
1694 smb_ads_publish_share(smb_ads_handle_t *ah, const char *adsShareName,
1695     const char *shareUNC, const char *adsContainer, const char *hostname)
1696 {
1697 	int ret;
1698 	char unc_name[SMB_ADS_MAXBUFLEN];
1699 
1700 	if (adsShareName == NULL || adsContainer == NULL)
1701 		return (-1);
1702 
1703 	if (shareUNC == 0 || *shareUNC == 0)
1704 		shareUNC = adsShareName;
1705 
1706 	if (smb_ads_build_unc_name(unc_name, sizeof (unc_name),
1707 	    hostname, shareUNC) < 0)
1708 		return (-1);
1709 
1710 	ret = smb_ads_lookup_share(ah, adsShareName, adsContainer, unc_name);
1711 
1712 	switch (ret) {
1713 	case 1:
1714 		(void) smb_ads_del_share(ah, adsShareName, adsContainer);
1715 		ret = smb_ads_add_share(ah, adsShareName, unc_name,
1716 		    adsContainer);
1717 		break;
1718 
1719 	case 0:
1720 		ret = smb_ads_add_share(ah, adsShareName, unc_name,
1721 		    adsContainer);
1722 		if (ret == LDAP_ALREADY_EXISTS)
1723 			ret = -1;
1724 
1725 		break;
1726 
1727 	case -1:
1728 	default:
1729 		/* return with error code */
1730 		ret = -1;
1731 	}
1732 
1733 	return (ret);
1734 }
1735 
1736 /*
1737  * smb_ads_remove_share
1738  * Remove share from ADS.  A search is done first before explicitly removing
1739  * the share.
1740  * Parameters:
1741  *   ah          : handle return from smb_ads_open
1742  *   adsShareName: name of share to be removed from ADS directory
1743  *   adsContainer: location for share to be removed from ADS directory, ie
1744  *                   ou=share_folder
1745  * Returns:
1746  *   -1          : error
1747  *    0          : success
1748  */
1749 int
1750 smb_ads_remove_share(smb_ads_handle_t *ah, const char *adsShareName,
1751     const char *shareUNC, const char *adsContainer, const char *hostname)
1752 {
1753 	int ret;
1754 	char unc_name[SMB_ADS_MAXBUFLEN];
1755 
1756 	if (adsShareName == NULL || adsContainer == NULL)
1757 		return (-1);
1758 	if (shareUNC == 0 || *shareUNC == 0)
1759 		shareUNC = adsShareName;
1760 
1761 	if (smb_ads_build_unc_name(unc_name, sizeof (unc_name),
1762 	    hostname, shareUNC) < 0)
1763 		return (-1);
1764 
1765 	ret = smb_ads_lookup_share(ah, adsShareName, adsContainer, unc_name);
1766 	if (ret == 0)
1767 		return (0);
1768 	if (ret == -1)
1769 		return (-1);
1770 
1771 	return (smb_ads_del_share(ah, adsShareName, adsContainer));
1772 }
1773 
1774 /*
1775  * smb_ads_get_default_comp_container_dn
1776  *
1777  * Build the distinguished name for the default computer conatiner (i.e. the
1778  * pre-defined Computers container).
1779  */
1780 static void
1781 smb_ads_get_default_comp_container_dn(smb_ads_handle_t *ah, char *buf,
1782     size_t buflen)
1783 {
1784 	(void) snprintf(buf, buflen, "cn=%s,%s", SMB_ADS_COMPUTERS_CN,
1785 	    ah->domain_dn);
1786 }
1787 
1788 /*
1789  * smb_ads_get_default_comp_dn
1790  *
1791  * Build the distinguished name for this system.
1792  */
1793 static void
1794 smb_ads_get_default_comp_dn(smb_ads_handle_t *ah, char *buf, size_t buflen)
1795 {
1796 	char nbname[NETBIOS_NAME_SZ];
1797 	char container_dn[SMB_ADS_DN_MAX];
1798 
1799 	(void) smb_getnetbiosname(nbname, sizeof (nbname));
1800 	smb_ads_get_default_comp_container_dn(ah, container_dn, SMB_ADS_DN_MAX);
1801 	(void) snprintf(buf, buflen, "cn=%s,%s", nbname, container_dn);
1802 }
1803 
1804 /*
1805  * smb_ads_add_computer
1806  *
1807  * Returns 0 upon success. Otherwise, returns -1.
1808  */
1809 static int
1810 smb_ads_add_computer(smb_ads_handle_t *ah, int dclevel, char *dn)
1811 {
1812 	return (smb_ads_computer_op(ah, LDAP_MOD_ADD, dclevel, dn));
1813 }
1814 
1815 /*
1816  * smb_ads_modify_computer
1817  *
1818  * Returns 0 upon success. Otherwise, returns -1.
1819  */
1820 static int
1821 smb_ads_modify_computer(smb_ads_handle_t *ah, int dclevel, char *dn)
1822 {
1823 	return (smb_ads_computer_op(ah, LDAP_MOD_REPLACE, dclevel, dn));
1824 }
1825 
1826 /*
1827  * smb_ads_get_dc_level
1828  *
1829  * Returns the functional level of the DC upon success.
1830  * Otherwise, -1 is returned.
1831  */
1832 static int
1833 smb_ads_get_dc_level(smb_ads_handle_t *ah)
1834 {
1835 	LDAPMessage *res, *entry;
1836 	char *attr[2];
1837 	char **vals;
1838 	int rc = -1;
1839 
1840 	res = NULL;
1841 	attr[0] = SMB_ADS_ATTR_DCLEVEL;
1842 	attr[1] = NULL;
1843 	if (ldap_search_s(ah->ld, "", LDAP_SCOPE_BASE, NULL, attr,
1844 	    0, &res) != LDAP_SUCCESS) {
1845 		(void) ldap_msgfree(res);
1846 		return (-1);
1847 	}
1848 
1849 	/* no match for the specified attribute is found */
1850 	if (ldap_count_entries(ah->ld, res) == 0) {
1851 		(void) ldap_msgfree(res);
1852 		return (-1);
1853 	}
1854 
1855 	entry = ldap_first_entry(ah->ld, res);
1856 	if (entry) {
1857 		if ((vals = ldap_get_values(ah->ld, entry,
1858 		    SMB_ADS_ATTR_DCLEVEL)) == NULL) {
1859 			/*
1860 			 * Observed the values aren't populated
1861 			 * by the Windows 2000 server.
1862 			 */
1863 			(void) ldap_msgfree(res);
1864 			return (SMB_ADS_DCLEVEL_W2K);
1865 		}
1866 
1867 		if (vals[0] != NULL)
1868 			rc = atoi(vals[0]);
1869 
1870 		ldap_value_free(vals);
1871 	}
1872 
1873 	(void) ldap_msgfree(res);
1874 	return (rc);
1875 }
1876 
1877 static int
1878 smb_ads_getfqhostname(smb_ads_handle_t *ah, char *fqhost, int len)
1879 {
1880 	if (smb_gethostname(fqhost, len, 0) != 0)
1881 		return (-1);
1882 
1883 	(void) snprintf(fqhost, len, "%s.%s", fqhost,
1884 	    ah->domain);
1885 
1886 	return (0);
1887 }
1888 
1889 static int
1890 smb_ads_computer_op(smb_ads_handle_t *ah, int op, int dclevel, char *dn)
1891 {
1892 	LDAPMod *attrs[SMB_ADS_COMPUTER_NUM_ATTR];
1893 	char *oc_vals[6], *sam_val[2], *usr_val[2];
1894 	char *spn_set[SMBKRB5_SPN_IDX_MAX + 1], *ctl_val[2], *fqh_val[2];
1895 	char *encrypt_val[2];
1896 	int j = -1;
1897 	int ret, usrctl_flags = 0;
1898 	char sam_acct[SMB_SAMACCT_MAXLEN];
1899 	char fqhost[MAXHOSTNAMELEN];
1900 	char *user_principal;
1901 	char usrctl_buf[16];
1902 	char encrypt_buf[16];
1903 	int max;
1904 
1905 	if (smb_getsamaccount(sam_acct, sizeof (sam_acct)) != 0)
1906 		return (-1);
1907 
1908 	if (smb_ads_getfqhostname(ah, fqhost, MAXHOSTNAMELEN))
1909 		return (-1);
1910 
1911 	if (smb_ads_get_spnset(fqhost, spn_set) != 0)
1912 		return (-1);
1913 
1914 	/*
1915 	 * Windows 2008 DC expects the UPN attribute to be host/fqhn while
1916 	 * both Windows 2000 & 2003 expect it to be host/fqhn@realm.
1917 	 */
1918 	if (dclevel == SMB_ADS_DCLEVEL_W2K8)
1919 		user_principal = smb_krb5_get_spn(SMBKRB5_SPN_IDX_HOST, fqhost);
1920 	else
1921 		user_principal = smb_krb5_get_upn(spn_set[SMBKRB5_SPN_IDX_HOST],
1922 		    ah->domain);
1923 
1924 	if (user_principal == NULL) {
1925 		smb_ads_free_spnset(spn_set);
1926 		return (-1);
1927 	}
1928 
1929 	max = (SMB_ADS_COMPUTER_NUM_ATTR - ((op != LDAP_MOD_ADD) ? 1 : 0))
1930 	    - (dclevel == SMB_ADS_DCLEVEL_W2K8 ?  0 : 1);
1931 
1932 	if (smb_ads_alloc_attr(attrs, max) != 0) {
1933 		free(user_principal);
1934 		smb_ads_free_spnset(spn_set);
1935 		return (-1);
1936 	}
1937 
1938 	/* objectClass attribute is not modifiable. */
1939 	if (op == LDAP_MOD_ADD) {
1940 		attrs[++j]->mod_op = op;
1941 		attrs[j]->mod_type = "objectClass";
1942 		oc_vals[0] = "top";
1943 		oc_vals[1] = "person";
1944 		oc_vals[2] = "organizationalPerson";
1945 		oc_vals[3] = "user";
1946 		oc_vals[4] = "computer";
1947 		oc_vals[5] = 0;
1948 		attrs[j]->mod_values = oc_vals;
1949 	}
1950 
1951 	attrs[++j]->mod_op = op;
1952 	attrs[j]->mod_type = SMB_ADS_ATTR_SAMACCT;
1953 	sam_val[0] = sam_acct;
1954 	sam_val[1] = 0;
1955 	attrs[j]->mod_values = sam_val;
1956 
1957 	attrs[++j]->mod_op = op;
1958 	attrs[j]->mod_type = SMB_ADS_ATTR_UPN;
1959 	usr_val[0] = user_principal;
1960 	usr_val[1] = 0;
1961 	attrs[j]->mod_values = usr_val;
1962 
1963 	attrs[++j]->mod_op = op;
1964 	attrs[j]->mod_type = SMB_ADS_ATTR_SPN;
1965 	attrs[j]->mod_values = spn_set;
1966 
1967 	attrs[++j]->mod_op = op;
1968 	attrs[j]->mod_type = SMB_ADS_ATTR_CTL;
1969 	usrctl_flags |= (SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
1970 	    SMB_ADS_USER_ACCT_CTL_PASSWD_NOTREQD |
1971 	    SMB_ADS_USER_ACCT_CTL_ACCOUNTDISABLE);
1972 	(void) snprintf(usrctl_buf, sizeof (usrctl_buf), "%d", usrctl_flags);
1973 	ctl_val[0] = usrctl_buf;
1974 	ctl_val[1] = 0;
1975 	attrs[j]->mod_values = ctl_val;
1976 
1977 	attrs[++j]->mod_op = op;
1978 	attrs[j]->mod_type = SMB_ADS_ATTR_DNSHOST;
1979 	fqh_val[0] = fqhost;
1980 	fqh_val[1] = 0;
1981 	attrs[j]->mod_values = fqh_val;
1982 
1983 	/* enctypes support starting in Windows Server 2008 */
1984 	if (dclevel > SMB_ADS_DCLEVEL_W2K3) {
1985 		attrs[++j]->mod_op = op;
1986 		attrs[j]->mod_type = SMB_ADS_ATTR_ENCTYPES;
1987 		(void) snprintf(encrypt_buf, sizeof (encrypt_buf), "%d",
1988 		    SMB_ADS_ENC_AES256 + SMB_ADS_ENC_AES128 + SMB_ADS_ENC_RC4 +
1989 		    SMB_ADS_ENC_DES_MD5 + SMB_ADS_ENC_DES_CRC);
1990 		encrypt_val[0] = encrypt_buf;
1991 		encrypt_val[1] = 0;
1992 		attrs[j]->mod_values = encrypt_val;
1993 	}
1994 
1995 	switch (op) {
1996 	case LDAP_MOD_ADD:
1997 		if ((ret = ldap_add_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
1998 			smb_tracef("smbns_ads: ldap_add error: %s",
1999 			    ldap_err2string(ret));
2000 			ret = -1;
2001 		}
2002 		break;
2003 
2004 	case LDAP_MOD_REPLACE:
2005 		if ((ret = ldap_modify_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
2006 			smb_tracef("smbns_ads: ldap_replace error: %s",
2007 			    ldap_err2string(ret));
2008 			ret = -1;
2009 		}
2010 		break;
2011 
2012 	default:
2013 		ret = -1;
2014 
2015 	}
2016 
2017 	smb_ads_free_attr(attrs);
2018 	free(user_principal);
2019 	smb_ads_free_spnset(spn_set);
2020 
2021 	return (ret);
2022 }
2023 
2024 /*
2025  * Delete an ADS computer account.
2026  */
2027 static void
2028 smb_ads_del_computer(smb_ads_handle_t *ah, char *dn)
2029 {
2030 	int rc;
2031 
2032 	if ((rc = ldap_delete_s(ah->ld, dn)) != LDAP_SUCCESS)
2033 		smb_tracef("smbns_ads: ldap_delete error: %s",
2034 		    ldap_err2string(rc));
2035 }
2036 
2037 /*
2038  * Gets the value of the given attribute.
2039  */
2040 static smb_ads_qstat_t
2041 smb_ads_getattr(LDAP *ld, LDAPMessage *entry, smb_ads_avpair_t *avpair)
2042 {
2043 	char **vals;
2044 	smb_ads_qstat_t rc = SMB_ADS_STAT_FOUND;
2045 
2046 	assert(avpair);
2047 	avpair->avp_val = NULL;
2048 	vals = ldap_get_values(ld, entry, avpair->avp_attr);
2049 	if (!vals)
2050 		return (SMB_ADS_STAT_NOT_FOUND);
2051 
2052 	if (!vals[0]) {
2053 		ldap_value_free(vals);
2054 		return (SMB_ADS_STAT_NOT_FOUND);
2055 	}
2056 
2057 	avpair->avp_val = strdup(vals[0]);
2058 	if (!avpair->avp_val)
2059 		rc = SMB_ADS_STAT_ERR;
2060 
2061 	ldap_value_free(vals);
2062 	return (rc);
2063 }
2064 
2065 /*
2066  * Process query's result.
2067  */
2068 static smb_ads_qstat_t
2069 smb_ads_get_qstat(smb_ads_handle_t *ah, LDAPMessage *res,
2070     smb_ads_avpair_t *avpair)
2071 {
2072 	char fqhost[MAXHOSTNAMELEN];
2073 	smb_ads_avpair_t dnshost_avp;
2074 	smb_ads_qstat_t rc = SMB_ADS_STAT_FOUND;
2075 	LDAPMessage *entry;
2076 
2077 	if (smb_ads_getfqhostname(ah, fqhost, MAXHOSTNAMELEN))
2078 		return (SMB_ADS_STAT_ERR);
2079 
2080 	if (ldap_count_entries(ah->ld, res) == 0)
2081 		return (SMB_ADS_STAT_NOT_FOUND);
2082 
2083 	if ((entry = ldap_first_entry(ah->ld, res)) == NULL)
2084 		return (SMB_ADS_STAT_ERR);
2085 
2086 	dnshost_avp.avp_attr = SMB_ADS_ATTR_DNSHOST;
2087 	rc = smb_ads_getattr(ah->ld, entry, &dnshost_avp);
2088 
2089 	switch (rc) {
2090 	case SMB_ADS_STAT_FOUND:
2091 		/*
2092 		 * Returns SMB_ADS_STAT_DUP to avoid overwriting
2093 		 * the computer account of another system whose
2094 		 * NetBIOS name collides with that of the current
2095 		 * system.
2096 		 */
2097 		if (strcasecmp(dnshost_avp.avp_val, fqhost))
2098 			rc = SMB_ADS_STAT_DUP;
2099 
2100 		free(dnshost_avp.avp_val);
2101 		break;
2102 
2103 	case SMB_ADS_STAT_NOT_FOUND:
2104 		/*
2105 		 * Pre-created computer account doesn't have
2106 		 * the dNSHostname attribute. It's been observed
2107 		 * that the dNSHostname attribute is only set after
2108 		 * a successful domain join.
2109 		 * Returns SMB_ADS_STAT_FOUND as the account is
2110 		 * pre-created for the current system.
2111 		 */
2112 		rc = SMB_ADS_STAT_FOUND;
2113 		break;
2114 
2115 	default:
2116 		break;
2117 	}
2118 
2119 	if (rc != SMB_ADS_STAT_FOUND)
2120 		return (rc);
2121 
2122 	if (avpair)
2123 		rc = smb_ads_getattr(ah->ld, entry, avpair);
2124 
2125 	return (rc);
2126 
2127 }
2128 
2129 /*
2130  * smb_ads_lookup_computer_n_attr
2131  *
2132  * If avpair is NULL, checks the status of the specified computer account.
2133  * Otherwise, looks up the value of the specified computer account's attribute.
2134  * If found, the value field of the avpair will be allocated and set. The
2135  * caller should free the allocated buffer.
2136  *
2137  * Return:
2138  *  SMB_ADS_STAT_FOUND  - if both the computer and the specified attribute is
2139  *                        found.
2140  *  SMB_ADS_STAT_NOT_FOUND - if either the computer or the specified attribute
2141  *                           is not found.
2142  *  SMB_ADS_STAT_DUP - if the computer account is already used by other systems
2143  *                     in the AD. This could happen if the hostname of multiple
2144  *                     systems resolved to the same NetBIOS name.
2145  *  SMB_ADS_STAT_ERR - any failure.
2146  */
2147 static smb_ads_qstat_t
2148 smb_ads_lookup_computer_n_attr(smb_ads_handle_t *ah, smb_ads_avpair_t *avpair,
2149     int scope, char *dn)
2150 {
2151 	char *attrs[3], filter[SMB_ADS_MAXBUFLEN];
2152 	LDAPMessage *res;
2153 	char sam_acct[SMB_SAMACCT_MAXLEN], sam_acct2[SMB_SAMACCT_MAXLEN];
2154 	smb_ads_qstat_t rc;
2155 
2156 	if (smb_getsamaccount(sam_acct, sizeof (sam_acct)) != 0)
2157 		return (SMB_ADS_STAT_ERR);
2158 
2159 	res = NULL;
2160 	attrs[0] = SMB_ADS_ATTR_DNSHOST;
2161 	attrs[1] = NULL;
2162 	attrs[2] = NULL;
2163 
2164 	if (avpair) {
2165 		if (!avpair->avp_attr)
2166 			return (SMB_ADS_STAT_ERR);
2167 
2168 		attrs[1] = avpair->avp_attr;
2169 	}
2170 
2171 	if (smb_ads_escape_search_filter_chars(sam_acct, sam_acct2) != 0)
2172 		return (SMB_ADS_STAT_ERR);
2173 
2174 	(void) snprintf(filter, sizeof (filter),
2175 	    "(&(objectClass=computer)(%s=%s))", SMB_ADS_ATTR_SAMACCT,
2176 	    sam_acct2);
2177 
2178 	if (ldap_search_s(ah->ld, dn, scope, filter, attrs, 0,
2179 	    &res) != LDAP_SUCCESS) {
2180 		(void) ldap_msgfree(res);
2181 		return (SMB_ADS_STAT_NOT_FOUND);
2182 	}
2183 
2184 	rc = smb_ads_get_qstat(ah, res, avpair);
2185 	/* free the search results */
2186 	(void) ldap_msgfree(res);
2187 	return (rc);
2188 }
2189 
2190 /*
2191  * smb_ads_find_computer
2192  *
2193  * Starts by searching for the system's AD computer object in the default
2194  * container (i.e. cn=Computers).  If not found, searches the entire directory.
2195  * If found, 'dn' will be set to the distinguished name of the system's AD
2196  * computer object.
2197  */
2198 static smb_ads_qstat_t
2199 smb_ads_find_computer(smb_ads_handle_t *ah, char *dn)
2200 {
2201 	smb_ads_qstat_t stat;
2202 	smb_ads_avpair_t avpair;
2203 
2204 	avpair.avp_attr = SMB_ADS_ATTR_DN;
2205 	smb_ads_get_default_comp_container_dn(ah, dn, SMB_ADS_DN_MAX);
2206 	stat = smb_ads_lookup_computer_n_attr(ah, &avpair, LDAP_SCOPE_ONELEVEL,
2207 	    dn);
2208 
2209 	if (stat == SMB_ADS_STAT_NOT_FOUND) {
2210 		(void) strlcpy(dn, ah->domain_dn, SMB_ADS_DN_MAX);
2211 		stat = smb_ads_lookup_computer_n_attr(ah, &avpair,
2212 		    LDAP_SCOPE_SUBTREE, dn);
2213 	}
2214 
2215 	if (stat == SMB_ADS_STAT_FOUND) {
2216 		(void) strlcpy(dn, avpair.avp_val, SMB_ADS_DN_MAX);
2217 		free(avpair.avp_val);
2218 	}
2219 
2220 	return (stat);
2221 }
2222 
2223 /*
2224  * smb_ads_update_computer_cntrl_attr
2225  *
2226  * Modify the user account control attribute of an existing computer
2227  * object on AD.
2228  *
2229  * Returns 0 on success. Otherwise, returns -1.
2230  */
2231 static int
2232 smb_ads_update_computer_cntrl_attr(smb_ads_handle_t *ah, int des_only, char *dn)
2233 {
2234 	LDAPMod *attrs[2];
2235 	char *ctl_val[2];
2236 	int ret, usrctl_flags = 0;
2237 	char usrctl_buf[16];
2238 
2239 	if (smb_ads_alloc_attr(attrs, sizeof (attrs) / sizeof (LDAPMod *)) != 0)
2240 		return (-1);
2241 
2242 	attrs[0]->mod_op = LDAP_MOD_REPLACE;
2243 	attrs[0]->mod_type = SMB_ADS_ATTR_CTL;
2244 
2245 	usrctl_flags |= (SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
2246 	    SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION |
2247 	    SMB_ADS_USER_ACCT_CTL_DONT_EXPIRE_PASSWD);
2248 
2249 	if (des_only)
2250 		usrctl_flags |= SMB_ADS_USER_ACCT_CTL_USE_DES_KEY_ONLY;
2251 
2252 	(void) snprintf(usrctl_buf, sizeof (usrctl_buf), "%d", usrctl_flags);
2253 	ctl_val[0] = usrctl_buf;
2254 	ctl_val[1] = 0;
2255 	attrs[0]->mod_values = ctl_val;
2256 
2257 	if ((ret = ldap_modify_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
2258 		smb_tracef("smbns_ads: ldap_modify error: %s",
2259 		    ldap_err2string(ret));
2260 		ret = -1;
2261 	}
2262 
2263 	smb_ads_free_attr(attrs);
2264 	return (ret);
2265 }
2266 
2267 /*
2268  * smb_ads_lookup_computer_attr_kvno
2269  *
2270  * Lookup the value of the Kerberos version number attribute of the computer
2271  * account.
2272  */
2273 static krb5_kvno
2274 smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t *ah, char *dn)
2275 {
2276 	smb_ads_avpair_t avpair;
2277 	int kvno = 1;
2278 
2279 	avpair.avp_attr = SMB_ADS_ATTR_KVNO;
2280 	if (smb_ads_lookup_computer_n_attr(ah, &avpair,
2281 	    LDAP_SCOPE_BASE, dn) == SMB_ADS_STAT_FOUND) {
2282 		kvno = atoi(avpair.avp_val);
2283 		free(avpair.avp_val);
2284 	}
2285 
2286 	return (kvno);
2287 }
2288 
2289 /*
2290  * smb_ads_gen_machine_passwd
2291  *
2292  * Returned a null-terminated machine password generated randomly
2293  * from [0-9a-zA-Z] character set. In order to pass the password
2294  * quality check (three character classes), an uppercase letter is
2295  * used as the first character of the machine password.
2296  */
2297 static int
2298 smb_ads_gen_machine_passwd(char *machine_passwd, int bufsz)
2299 {
2300 	char *data = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJK"
2301 	    "LMNOPQRSTUVWXYZ";
2302 	int datalen = strlen(data);
2303 	int i, data_idx;
2304 
2305 	if (!machine_passwd || bufsz == 0)
2306 		return (-1);
2307 
2308 	/*
2309 	 * The decimal value of upper case 'A' is 65. Randomly pick
2310 	 * an upper-case letter from the ascii table.
2311 	 */
2312 	machine_passwd[0] = (random() % 26) + 65;
2313 	for (i = 1; i < bufsz - 1; i++) {
2314 		data_idx = random() % datalen;
2315 		machine_passwd[i] = data[data_idx];
2316 	}
2317 
2318 	machine_passwd[bufsz - 1] = 0;
2319 	return (0);
2320 }
2321 
2322 /*
2323  * smb_ads_join
2324  *
2325  * Besides the NT-4 style domain join (using MS-RPC), CIFS server also
2326  * provides the domain join using Kerberos Authentication, Keberos
2327  * Change & Set password, and LDAP protocols. Basically, AD join
2328  * operation would require the following tickets to be acquired for the
2329  * the user account that is provided for the domain join.
2330  *
2331  * 1) a Keberos TGT ticket,
2332  * 2) a ldap service ticket, and
2333  * 3) kadmin/changpw service ticket
2334  *
2335  * The ADS client first sends a ldap search request to find out whether
2336  * or not the workstation trust account already exists in the Active Directory.
2337  * The existing computer object for this workstation will be removed and
2338  * a new one will be added. The machine account password is randomly
2339  * generated and set for the newly created computer object using KPASSWD
2340  * protocol (See RFC 3244). Once the password is set, our ADS client
2341  * finalizes the machine account by modifying the user acount control
2342  * attribute of the computer object. Kerberos keys derived from the machine
2343  * account password will be stored locally in /etc/krb5/krb5.keytab file.
2344  * That would be needed while acquiring Kerberos TGT ticket for the host
2345  * principal after the domain join operation.
2346  */
2347 smb_adjoin_status_t
2348 smb_ads_join(char *domain, char *user, char *usr_passwd, char *machine_passwd,
2349     int len)
2350 {
2351 	smb_ads_handle_t *ah = NULL;
2352 	krb5_context ctx = NULL;
2353 	krb5_principal krb5princs[SMBKRB5_SPN_IDX_MAX];
2354 	krb5_kvno kvno;
2355 	boolean_t des_only, delete = B_TRUE;
2356 	smb_adjoin_status_t rc = SMB_ADJOIN_SUCCESS;
2357 	boolean_t new_acct;
2358 	int dclevel, num;
2359 	smb_ads_qstat_t qstat;
2360 	char dn[SMB_ADS_DN_MAX];
2361 	char *tmpfile;
2362 
2363 	/*
2364 	 * Call library functions that can be used to get
2365 	 * the list of encryption algorithms available on the system.
2366 	 * (similar to what 'encrypt -l' CLI does). For now,
2367 	 * unless someone has modified the configuration of the
2368 	 * cryptographic framework (very unlikely), the following is the
2369 	 * list of algorithms available on any system running Nevada
2370 	 * by default.
2371 	 */
2372 	krb5_enctype w2k8enctypes[] = {ENCTYPE_AES256_CTS_HMAC_SHA1_96,
2373 	    ENCTYPE_AES128_CTS_HMAC_SHA1_96, ENCTYPE_ARCFOUR_HMAC,
2374 	    ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5,
2375 	};
2376 
2377 	krb5_enctype pre_w2k8enctypes[] = {ENCTYPE_ARCFOUR_HMAC,
2378 	    ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5,
2379 	};
2380 
2381 	krb5_enctype *encptr;
2382 
2383 	if ((ah = smb_ads_open_main(domain, user, usr_passwd)) == NULL) {
2384 		smb_ccache_remove(SMB_CCACHE_PATH);
2385 		return (SMB_ADJOIN_ERR_GET_HANDLE);
2386 	}
2387 
2388 	if (smb_ads_gen_machine_passwd(machine_passwd, len) != 0) {
2389 		smb_ads_close(ah);
2390 		smb_ccache_remove(SMB_CCACHE_PATH);
2391 		return (SMB_ADJOIN_ERR_GEN_PASSWD);
2392 	}
2393 
2394 	if ((dclevel = smb_ads_get_dc_level(ah)) == -1) {
2395 		smb_ads_close(ah);
2396 		smb_ccache_remove(SMB_CCACHE_PATH);
2397 		return (SMB_ADJOIN_ERR_GET_DCLEVEL);
2398 	}
2399 
2400 	qstat = smb_ads_find_computer(ah, dn);
2401 	switch (qstat) {
2402 	case SMB_ADS_STAT_FOUND:
2403 		new_acct = B_FALSE;
2404 		if (smb_ads_modify_computer(ah, dclevel, dn) != 0) {
2405 			smb_ads_close(ah);
2406 			smb_ccache_remove(SMB_CCACHE_PATH);
2407 			return (SMB_ADJOIN_ERR_MOD_TRUST_ACCT);
2408 		}
2409 		break;
2410 
2411 	case SMB_ADS_STAT_NOT_FOUND:
2412 		new_acct = B_TRUE;
2413 		smb_ads_get_default_comp_dn(ah, dn, SMB_ADS_DN_MAX);
2414 		if (smb_ads_add_computer(ah, dclevel, dn) != 0) {
2415 			smb_ads_close(ah);
2416 			smb_ccache_remove(SMB_CCACHE_PATH);
2417 			return (SMB_ADJOIN_ERR_ADD_TRUST_ACCT);
2418 		}
2419 		break;
2420 
2421 	default:
2422 		if (qstat == SMB_ADS_STAT_DUP)
2423 			rc = SMB_ADJOIN_ERR_DUP_TRUST_ACCT;
2424 		else
2425 			rc = SMB_ADJOIN_ERR_TRUST_ACCT;
2426 		smb_ads_close(ah);
2427 		smb_ccache_remove(SMB_CCACHE_PATH);
2428 		return (rc);
2429 	}
2430 
2431 	des_only = B_FALSE;
2432 
2433 	if (smb_krb5_ctx_init(&ctx) != 0) {
2434 		rc = SMB_ADJOIN_ERR_INIT_KRB_CTX;
2435 		goto adjoin_cleanup;
2436 	}
2437 
2438 	if (smb_krb5_get_principals(ah->domain, ctx, krb5princs) != 0) {
2439 		rc = SMB_ADJOIN_ERR_GET_SPNS;
2440 		goto adjoin_cleanup;
2441 	}
2442 
2443 	if (smb_krb5_setpwd(ctx, krb5princs[SMBKRB5_SPN_IDX_HOST],
2444 	    machine_passwd) != 0) {
2445 		rc = SMB_ADJOIN_ERR_KSETPWD;
2446 		goto adjoin_cleanup;
2447 	}
2448 
2449 	kvno = smb_ads_lookup_computer_attr_kvno(ah, dn);
2450 
2451 	if (smb_ads_update_computer_cntrl_attr(ah, des_only, dn)
2452 	    != 0) {
2453 		rc = SMB_ADJOIN_ERR_UPDATE_CNTRL_ATTR;
2454 		goto adjoin_cleanup;
2455 	}
2456 
2457 	if (dclevel == SMB_ADS_DCLEVEL_W2K8) {
2458 		num = sizeof (w2k8enctypes) / sizeof (krb5_enctype);
2459 		encptr = w2k8enctypes;
2460 	} else {
2461 		num = sizeof (pre_w2k8enctypes) / sizeof (krb5_enctype);
2462 		encptr = pre_w2k8enctypes;
2463 	}
2464 
2465 	tmpfile = mktemp(SMBNS_KRB5_KEYTAB_TMP);
2466 	if (tmpfile == NULL)
2467 		tmpfile = SMBNS_KRB5_KEYTAB_TMP;
2468 
2469 	if (smb_krb5_add_keytab_entries(ctx, krb5princs, tmpfile,
2470 	    kvno, machine_passwd, encptr, num) != 0) {
2471 		rc = SMB_ADJOIN_ERR_WRITE_KEYTAB;
2472 		goto adjoin_cleanup;
2473 	}
2474 
2475 	delete = B_FALSE;
2476 adjoin_cleanup:
2477 	if (new_acct && delete)
2478 		smb_ads_del_computer(ah, dn);
2479 
2480 	if (rc != SMB_ADJOIN_ERR_INIT_KRB_CTX) {
2481 		if (rc != SMB_ADJOIN_ERR_GET_SPNS)
2482 			smb_krb5_free_principals(ctx, krb5princs,
2483 			    SMBKRB5_SPN_IDX_MAX);
2484 		smb_krb5_ctx_fini(ctx);
2485 	}
2486 
2487 	/* commit keytab file */
2488 	if (rc == SMB_ADJOIN_SUCCESS) {
2489 		if (rename(tmpfile, SMBNS_KRB5_KEYTAB) != 0) {
2490 			(void) unlink(tmpfile);
2491 			rc = SMB_ADJOIN_ERR_COMMIT_KEYTAB;
2492 		} else {
2493 			/* Set IDMAP config */
2494 			if (smb_config_set_idmap_domain(ah->domain) != 0) {
2495 				rc = SMB_ADJOIN_ERR_IDMAP_SET_DOMAIN;
2496 			} else {
2497 
2498 				/* Refresh IDMAP service */
2499 				if (smb_config_refresh_idmap() != 0)
2500 					rc = SMB_ADJOIN_ERR_IDMAP_REFRESH;
2501 			}
2502 		}
2503 	} else {
2504 		(void) unlink(tmpfile);
2505 	}
2506 
2507 	smb_ads_close(ah);
2508 	smb_ccache_remove(SMB_CCACHE_PATH);
2509 	return (rc);
2510 }
2511 
2512 /*
2513  * smb_adjoin_report_err
2514  *
2515  * Display error message for the specific adjoin error code.
2516  */
2517 char *
2518 smb_adjoin_report_err(smb_adjoin_status_t status)
2519 {
2520 	if (status < 0 || status >= SMB_ADJOIN_NUM_STATUS)
2521 		return ("ADJOIN: unknown status");
2522 
2523 	return (smb_ads_adjoin_errmsg[status]);
2524 }
2525 
2526 /*
2527  * smb_ads_get_pdc_ip
2528  *
2529  * Check to see if there is any configured PDC.
2530  * If there is then converts the string IP to
2531  * integer format and returns it.
2532  */
2533 static uint32_t
2534 smb_ads_get_pdc_ip(void)
2535 {
2536 	char p[INET_ADDRSTRLEN];
2537 	uint32_t ipaddr = 0;
2538 	int rc;
2539 
2540 	rc = smb_config_getstr(SMB_CI_DOMAIN_SRV, p, sizeof (p));
2541 	if (rc == SMBD_SMF_OK) {
2542 		rc = inet_pton(AF_INET, p, &ipaddr);
2543 		if (rc == 0)
2544 			ipaddr = 0;
2545 	}
2546 
2547 	return (ipaddr);
2548 }
2549 
2550 /*
2551  * smb_ads_select_pdc
2552  *
2553  * This method walks the list of DCs and returns the first DC record that
2554  * responds to ldap ping and whose IP address is same as the IP address set in
2555  * the Preferred Domain Controller (pdc) property.
2556  *
2557  * Returns a pointer to the found DC record.
2558  * Returns NULL, on error or if no DC record is found.
2559  */
2560 static smb_ads_host_info_t *
2561 smb_ads_select_pdc(smb_ads_host_list_t *hlist)
2562 {
2563 	smb_ads_host_info_t *hentry;
2564 	uint32_t ip;
2565 	size_t cnt;
2566 	int i;
2567 
2568 	if ((ip = smb_ads_get_pdc_ip()) == 0)
2569 		return (NULL);
2570 
2571 	cnt = hlist->ah_cnt;
2572 	for (i = 0; i < cnt; i++) {
2573 		hentry = &hlist->ah_list[i];
2574 		if ((hentry->ip_addr == ip) &&
2575 		    (smb_ads_ldap_ping(hentry) == 0))
2576 			return (hentry);
2577 	}
2578 
2579 	return (NULL);
2580 }
2581 
2582 /*
2583  * smb_ads_select_dcfromsubnet
2584  *
2585  * This method walks the list of DCs and returns the first DC record that
2586  * responds to ldap ping and is in the same subnet as the host.
2587  *
2588  * Returns a pointer to the found DC record.
2589  * Returns NULL, on error or if no DC record is found.
2590  */
2591 static smb_ads_host_info_t *
2592 smb_ads_select_dcfromsubnet(smb_ads_host_list_t *hlist)
2593 {
2594 	smb_ads_host_info_t *hentry;
2595 	smb_nic_t *lnic;
2596 	smb_niciter_t ni;
2597 	size_t cnt;
2598 	int i;
2599 
2600 	if (smb_nic_getfirst(&ni) != 0)
2601 		return (NULL);
2602 	do {
2603 		lnic = &ni.ni_nic;
2604 		cnt = hlist->ah_cnt;
2605 
2606 		for (i = 0; i < cnt; i++) {
2607 			hentry = &hlist->ah_list[i];
2608 			if ((hentry->ip_addr & lnic->nic_mask) ==
2609 			    (lnic->nic_ip & lnic->nic_mask))
2610 				if (smb_ads_ldap_ping(hentry) == 0)
2611 					return (hentry);
2612 		}
2613 	} while (smb_nic_getnext(&ni) == 0);
2614 
2615 	return (NULL);
2616 }
2617 
2618 /*
2619  * smb_ads_select_dcfromlist
2620  *
2621  * This method walks the list of DCs and returns the first DC that
2622  * responds to ldap ping.
2623  *
2624  * Returns a pointer to the found DC record.
2625  * Returns NULL if no DC record is found.
2626  */
2627 static smb_ads_host_info_t *
2628 smb_ads_select_dcfromlist(smb_ads_host_list_t *hlist)
2629 {
2630 	smb_ads_host_info_t *hentry;
2631 	size_t cnt;
2632 	int i;
2633 
2634 	cnt = hlist->ah_cnt;
2635 	for (i = 0; i < cnt; i++) {
2636 		hentry = &hlist->ah_list[i];
2637 		if (smb_ads_ldap_ping(hentry) == 0)
2638 			return (hentry);
2639 	}
2640 
2641 	return (NULL);
2642 }
2643 
2644 /*
2645  * smb_ads_dc_compare
2646  *
2647  * Comparision function for sorting host entries (SRV records of DC) via qsort.
2648  * RFC 2052/2782 are taken as reference, while implementing this algorithm.
2649  *
2650  * Domain Controllers(DCs) with lowest priority in their SRV DNS records
2651  * are selected first. If they have equal priorities, then DC with highest
2652  * weight in its SRV DNS record is selected. If the priority and weight are
2653  * both equal, then the DC at the top of the list is selected.
2654  */
2655 static int
2656 smb_ads_dc_compare(const void *p, const void *q)
2657 {
2658 	smb_ads_host_info_t *h1 = (smb_ads_host_info_t *)p;
2659 	smb_ads_host_info_t *h2 = (smb_ads_host_info_t *)q;
2660 
2661 	if (h1->priority < h2->priority)
2662 		return (-1);
2663 	if (h1->priority > h2->priority)
2664 		return (1);
2665 
2666 	/* Priorities are equal */
2667 	if (h1->weight < h2->weight)
2668 		return (1);
2669 	if (h1->weight > h2->weight)
2670 		return (-1);
2671 
2672 	return (0);
2673 }
2674 
2675 /*
2676  * smb_ads_select_dc
2677  *
2678  * The list of ADS hosts returned by ADS lookup, is sorted by lowest priority
2679  * and highest weight. On this sorted list, following additional rules are
2680  * applied, to select a DC.
2681  *
2682  *  - If there is a configured PDC and it's in the ADS list,
2683  *    then return the DC, if it responds to ldap ping.
2684  *  - If there is a DC in the same subnet, then return the DC,
2685  *    if it responds to ldap ping.
2686  *  - Else, return first DC that responds to ldap ping.
2687  *
2688  * A reference to the host entry from input host list is returned.
2689  *
2690  * Returns NULL on error.
2691  */
2692 static smb_ads_host_info_t *
2693 smb_ads_select_dc(smb_ads_host_list_t *hlist)
2694 {
2695 	smb_ads_host_info_t *hentry = NULL;
2696 
2697 	if (hlist->ah_cnt == 0)
2698 		return (NULL);
2699 
2700 	if (hlist->ah_cnt == 1) {
2701 		hentry = hlist->ah_list;
2702 		if (smb_ads_ldap_ping(hentry) == 0)
2703 			return (hentry);
2704 	}
2705 
2706 	/* Sort the list by priority and weight */
2707 	qsort(hlist->ah_list, hlist->ah_cnt,
2708 	    sizeof (smb_ads_host_info_t), smb_ads_dc_compare);
2709 
2710 	if ((hentry = smb_ads_select_pdc(hlist)) != NULL)
2711 		return (hentry);
2712 
2713 	if ((hentry = smb_ads_select_dcfromsubnet(hlist)) != NULL)
2714 		return (hentry);
2715 
2716 	if ((hentry = smb_ads_select_dcfromlist(hlist)) != NULL)
2717 		return (hentry);
2718 
2719 	return (NULL);
2720 }
2721 
2722 /*
2723  * smb_ads_lookup_msdcs
2724  *
2725  * If server argument is set, try to locate the specified DC.
2726  * If it is set to empty string, locate any DCs in the specified domain.
2727  * Returns the discovered DC via buf.
2728  *
2729  * fqdn	  - fully-qualified domain name
2730  * server - fully-qualifed hostname of a DC
2731  * buf    - the hostname of the discovered DC
2732  */
2733 boolean_t
2734 smb_ads_lookup_msdcs(char *fqdn, char *server, char *buf, uint32_t buflen)
2735 {
2736 	smb_ads_host_info_t *hinfo = NULL;
2737 	char *p;
2738 	struct in_addr addr;
2739 	char *sought_host;
2740 
2741 	if (!fqdn || !buf)
2742 		return (B_FALSE);
2743 
2744 	*buf = '\0';
2745 	sought_host = (*server == 0 ? NULL : server);
2746 	if ((hinfo = smb_ads_find_host(fqdn, sought_host)) == NULL)
2747 		return (B_FALSE);
2748 
2749 	addr.s_addr = hinfo->ip_addr;
2750 	syslog(LOG_DEBUG, "msdcsLookupADS: %s [%s]", hinfo->name,
2751 	    inet_ntoa(addr));
2752 
2753 	(void) strlcpy(buf, hinfo->name, buflen);
2754 	/*
2755 	 * Remove the domain extension
2756 	 */
2757 	if ((p = strchr(buf, '.')) != 0)
2758 		*p = '\0';
2759 
2760 	return (B_TRUE);
2761 }
2762