/*

   Unix SMB/CIFS implementation.

   Authentication utility functions

   Copyright (C) Stefan Metzmacher 2018,2025

   This program is free software; you can redistribute it and/or modify

   it under the terms of the GNU General Public License as published by

   the Free Software Foundation; either version 3 of the License, or

   (at your option) any later version.

   This program is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License

   along with this program.  If not, see <http://www.gnu.org/licenses/>.

*/

#include "replace.h"

#include "libcli/security/security.h"

#include "librpc/gen_ndr/ndr_drsblobs.h"

#include "librpc/gen_ndr/ndr_lsa.h"

#include "lib/util/talloc_stack.h"

#include "lib/util/bytearray.h"

#include "lib/util/dns_cmp.h"

static NTSTATUS trust_forest_record_from_lsa(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustRecord2 *lftr,

        struct ForestTrustInfoRecord *ftr)

{

  struct ForestTrustString *str = NULL;

  const struct lsa_StringLarge *lstr = NULL;

  const struct lsa_ForestTrustDomainInfo *linfo = NULL;

  struct ForestTrustDataDomainInfo *info = NULL;

  DATA_BLOB blob = { .length = 0, };

  if (lftr == NULL) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  ftr->flags = lftr->flags;

  ftr->timestamp = lftr->time;

  switch (lftr->type) {

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME:

    ftr->type = FOREST_TRUST_TOP_LEVEL_NAME;

    lstr = &lftr->forest_trust_data.top_level_name;

    str = &ftr->data.name;

    str->string = talloc_strdup(mem_ctx, lstr->string);

    if (str->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:

    ftr->type = FOREST_TRUST_TOP_LEVEL_NAME_EX;

    lstr = &lftr->forest_trust_data.top_level_name_ex;

    str = &ftr->data.name;

    str->string = talloc_strdup(mem_ctx, lstr->string);

    if (str->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_DOMAIN_INFO:

    ftr->type = FOREST_TRUST_DOMAIN_INFO;

    linfo = &lftr->forest_trust_data.domain_info;

    info = &ftr->data.info;

    if (linfo->domain_sid == NULL) {

      return NT_STATUS_INVALID_PARAMETER;

    }

    info->sid = *linfo->domain_sid;

    lstr = &linfo->dns_domain_name;

    str = &info->dns_name;

    str->string = talloc_strdup(mem_ctx, lstr->string);

    if (str->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    lstr = &linfo->netbios_domain_name;

    str = &info->netbios_name;

    str->string = talloc_strdup(mem_ctx, lstr->string);

    if (str->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_BINARY_DATA:

    ftr->type = FOREST_TRUST_BINARY_DATA;

    blob = data_blob_talloc_named(mem_ctx,

                lftr->forest_trust_data.data.data,

                lftr->forest_trust_data.data.length,

                "BINARY_DATA");

    if (blob.length != lftr->forest_trust_data.data.length) {

      return NT_STATUS_NO_MEMORY;

    }

    ftr->data.binary.data = blob.data;

    ftr->data.binary.size = blob.length;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_SCANNER_INFO:

    ftr->type = FOREST_TRUST_SCANNER_INFO;

    linfo = &lftr->forest_trust_data.scanner_info;

    info = &ftr->data.scanner_info.info;

    ftr->data.scanner_info.sub_type = FOREST_TRUST_SCANNER_INFO;

    if (linfo->domain_sid != NULL) {

      info->sid = *linfo->domain_sid;

    } else {

      info->sid = (struct dom_sid) { .sid_rev_num = 0, };

    }

    lstr = &linfo->dns_domain_name;

    str = &info->dns_name;

    str->string = talloc_strdup(mem_ctx, lstr->string);

    if (str->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    lstr = &linfo->netbios_domain_name;

    str = &info->netbios_name;

    str->string = talloc_strdup(mem_ctx, lstr->string);

    if (str->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  }

  return NT_STATUS_NOT_SUPPORTED;

}

static NTSTATUS trust_forest_record_lsa_resolve_binary(TALLOC_CTX *mem_ctx,

        uint32_t flags,

        NTTIME time,

        const struct lsa_ForestTrustBinaryData *binary,

        struct lsa_ForestTrustRecord2 *lftr2)

{

  enum ForestTrustInfoRecordType sub_type = FOREST_TRUST_BINARY_DATA;

  DATA_BLOB blob = { .length = 0, };

  if (binary == NULL) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  /*

   * Note 'binary' may points to

   * lftr2->forest_trust_data.data

   *

   * So we remember the relevant

   * information in blob and clear

   * the binary pointer in order

   * to avoid touching it again.

   *

   * Because we likely change

   * the lftr2->forest_trust_data union

   */

  blob.data = binary->data;

  blob.length = binary->length;

  binary = NULL;

  /*

   * We need at least size and subtype

   */

  if (blob.length < 5) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  sub_type = PULL_LE_U8(blob.data, 4);

  /*

   * Only levels above LSA_FOREST_TRUST_DOMAIN_INFO

   * are handled as binary.

   */

  if (sub_type <= FOREST_TRUST_BINARY_DATA) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  lftr2->flags = flags;

  lftr2->time = time;

  /*

   * Depending if the sub_type is wellknown the information is upgraded,

   * currently only for the LSA_FOREST_TRUST_SCANNER_INFO records.

   */

  if (sub_type == FOREST_TRUST_SCANNER_INFO) {

    struct lsa_ForestTrustDomainInfo *d_sdi = NULL;

    union ForestTrustData fta = { .unknown = { .size = 0, }, };

    const struct ForestTrustDataDomainInfo *s_sdi = NULL;

    enum ndr_err_code ndr_err;

    ndr_err = ndr_pull_union_blob(&blob,

                mem_ctx,

                &fta,

                FOREST_TRUST_SCANNER_INFO,

                (ndr_pull_flags_fn_t)ndr_pull_ForestTrustData);

    if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {

      return ndr_map_error2ntstatus(ndr_err);

    }

    if (fta.scanner_info.sub_type != FOREST_TRUST_SCANNER_INFO) {

      return NT_STATUS_INVALID_PARAMETER;

    }

    s_sdi = &fta.scanner_info.info;

    d_sdi = &lftr2->forest_trust_data.scanner_info;

    d_sdi->dns_domain_name.string = s_sdi->dns_name.string;

    d_sdi->netbios_domain_name.string = s_sdi->netbios_name.string;

    if (s_sdi->sid_size != 0) {

      d_sdi->domain_sid = dom_sid_dup(mem_ctx,

              &s_sdi->sid);

      if (d_sdi->domain_sid == NULL) {

        return NT_STATUS_NO_MEMORY;

      }

    } else {

      d_sdi->domain_sid = NULL;

    }

    lftr2->type = LSA_FOREST_TRUST_SCANNER_INFO;

    return NT_STATUS_OK;

  }

  /*

   * In all other cases lftr->type is downgraded to

   * LSA_FOREST_TRUST_BINARY_DATA.

   */

  lftr2->type = LSA_FOREST_TRUST_BINARY_DATA;

  lftr2->forest_trust_data.data.data = blob.data;

  lftr2->forest_trust_data.data.length = blob.length;

  return NT_STATUS_OK;

}

static NTSTATUS trust_forest_record_lsa_1to2(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustRecord *lftr,

        struct lsa_ForestTrustRecord2 *lftr2)

{

  const struct lsa_ForestTrustBinaryData *binary = NULL;

  if (lftr == NULL) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  lftr2->flags = lftr->flags;

  lftr2->time = lftr->time;

  switch (lftr->type) {

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME:

    lftr2->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;

    lftr2->forest_trust_data.top_level_name =

      lftr->forest_trust_data.top_level_name;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:

    lftr2->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX;

    lftr2->forest_trust_data.top_level_name_ex =

      lftr->forest_trust_data.top_level_name_ex;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_DOMAIN_INFO:

    lftr2->type = LSA_FOREST_TRUST_DOMAIN_INFO;

    lftr2->forest_trust_data.domain_info =

      lftr->forest_trust_data.domain_info;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_BINARY_DATA:

  case LSA_FOREST_TRUST_SCANNER_INFO:

    /* just to avoid the missing enum switch warning */

    break;

  }

  /*

   * All levels above LSA_FOREST_TRUST_DOMAIN_INFO are handled as binary.

   *

   * Depending if the sub_type is wellknown the information is upgraded,

   * currently only for the LSA_FOREST_TRUST_SCANNER_INFO records.

   *

   * In all other cases lftr->type is downgraded to

   * LSA_FOREST_TRUST_BINARY_DATA.

   */

  binary = &lftr->forest_trust_data.data;

  return trust_forest_record_lsa_resolve_binary(mem_ctx,

                  lftr->flags,

                  lftr->time,

                  binary,

                  lftr2);

}

NTSTATUS trust_forest_info_from_lsa(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustInformation *lfti,

        struct ForestTrustInfo **_fti)

{

  struct ForestTrustInfo *fti;

  uint32_t i;

  *_fti = NULL;

  fti = talloc_zero(mem_ctx, struct ForestTrustInfo);

  if (fti == NULL) {

    return NT_STATUS_NO_MEMORY;

  }

  fti->version = 1;

  fti->count = lfti->count;

  fti->records = talloc_zero_array(fti,

           struct ForestTrustInfoRecordArmor,

           fti->count);

  if (fti->records == NULL) {

    TALLOC_FREE(fti);

    return NT_STATUS_NO_MEMORY;

  }

  for (i = 0; i < fti->count; i++) {

    const struct lsa_ForestTrustRecord *lftr = lfti->entries[i];

    struct lsa_ForestTrustRecord2 lftr2 = { .flags = 0, };

    struct ForestTrustInfoRecord *ftr = &fti->records[i].record;

    TALLOC_CTX *frame = talloc_stackframe();

    NTSTATUS status;

    status = trust_forest_record_lsa_1to2(frame,

                  lftr,

                  &lftr2);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(frame);

      TALLOC_FREE(fti);

      return status;

    }

    status = trust_forest_record_from_lsa(fti->records,

                  &lftr2,

                  ftr);

    TALLOC_FREE(frame);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(fti);

      return status;

    }

  }

  *_fti = fti;

  return NT_STATUS_OK;

}

static NTSTATUS trust_forest_record_to_lsa(TALLOC_CTX *mem_ctx,

          const struct ForestTrustInfoRecord *ftr,

          struct lsa_ForestTrustRecord2 *lftr)

{

  const struct ForestTrustString *str = NULL;

  struct lsa_StringLarge *lstr = NULL;

  const struct ForestTrustDataDomainInfo *info = NULL;

  struct lsa_ForestTrustDomainInfo *linfo = NULL;

  DATA_BLOB blob = { .length = 0, };

  lftr->flags = ftr->flags;

  lftr->time = ftr->timestamp;

  switch (ftr->type) {

  case FOREST_TRUST_TOP_LEVEL_NAME:

    lftr->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;

    lstr = &lftr->forest_trust_data.top_level_name;

    str = &ftr->data.name;

    lstr->string = talloc_strdup(mem_ctx, str->string);

    if (lstr->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  case FOREST_TRUST_TOP_LEVEL_NAME_EX:

    lftr->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX;

    lstr = &lftr->forest_trust_data.top_level_name_ex;

    str = &ftr->data.name;

    lstr->string = talloc_strdup(mem_ctx, str->string);

    if (lstr->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  case FOREST_TRUST_DOMAIN_INFO:

    lftr->type = LSA_FOREST_TRUST_DOMAIN_INFO;

    linfo = &lftr->forest_trust_data.domain_info;

    info = &ftr->data.info;

    linfo->domain_sid = dom_sid_dup(mem_ctx, &info->sid);

    if (linfo->domain_sid == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    lstr = &linfo->dns_domain_name;

    str = &info->dns_name;

    lstr->string = talloc_strdup(mem_ctx, str->string);

    if (lstr->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    lstr = &linfo->netbios_domain_name;

    str = &info->netbios_name;

    lstr->string = talloc_strdup(mem_ctx, str->string);

    if (lstr->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  case FOREST_TRUST_BINARY_DATA:

    lftr->type = LSA_FOREST_TRUST_BINARY_DATA;

    blob = data_blob_talloc_named(mem_ctx,

                ftr->data.binary.data,

                ftr->data.binary.size,

                "BINARY_DATA");

    if (blob.length != ftr->data.binary.size) {

      return NT_STATUS_NO_MEMORY;

    }

    lftr->forest_trust_data.data.data = blob.data;

    lftr->forest_trust_data.data.length = blob.length;

    return NT_STATUS_OK;

  case FOREST_TRUST_SCANNER_INFO:

    lftr->type = LSA_FOREST_TRUST_SCANNER_INFO;

    linfo = &lftr->forest_trust_data.scanner_info;

    info = &ftr->data.scanner_info.info;

    if (info->sid_size != 0) {

      linfo->domain_sid = dom_sid_dup(mem_ctx,

              &info->sid);

      if (linfo->domain_sid == NULL) {

        return NT_STATUS_NO_MEMORY;

      }

    } else {

      linfo->domain_sid = NULL;

    }

    lstr = &linfo->dns_domain_name;

    str = &info->dns_name;

    lstr->string = talloc_strdup(mem_ctx, str->string);

    if (lstr->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    lstr = &linfo->netbios_domain_name;

    str = &info->netbios_name;

    lstr->string = talloc_strdup(mem_ctx, str->string);

    if (lstr->string == NULL) {

      return NT_STATUS_NO_MEMORY;

    }

    return NT_STATUS_OK;

  }

  return NT_STATUS_NOT_SUPPORTED;

}

static NTSTATUS trust_forest_record_lsa_2to1(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustRecord2 *lftr2,

        struct lsa_ForestTrustRecord *lftr)

{

  const struct lsa_ForestTrustDomainInfo *s_sdi = NULL;

  union ForestTrustData fta = { .unknown = { .size = 0, }, };

  struct ForestTrustDataDomainInfo *d_sdi = NULL;

  enum ndr_err_code ndr_err;

  DATA_BLOB blob = { .length = 0, };

  if (lftr2 == NULL) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  lftr->flags = lftr2->flags;

  lftr->time = lftr2->time;

  switch (lftr2->type) {

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME:

    lftr->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;

    lftr->forest_trust_data.top_level_name =

      lftr2->forest_trust_data.top_level_name;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:

    lftr->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX;

    lftr->forest_trust_data.top_level_name_ex =

      lftr2->forest_trust_data.top_level_name_ex;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_DOMAIN_INFO:

    lftr->type = LSA_FOREST_TRUST_DOMAIN_INFO;

    lftr->forest_trust_data.domain_info =

      lftr2->forest_trust_data.domain_info;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_BINARY_DATA:

    lftr->type = LSA_FOREST_TRUST_BINARY_DATA;

    lftr->forest_trust_data.data =

      lftr2->forest_trust_data.data;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_SCANNER_INFO:

    fta.scanner_info.sub_type = FOREST_TRUST_SCANNER_INFO;

    s_sdi = &lftr2->forest_trust_data.scanner_info;

    d_sdi = &fta.scanner_info.info;

    if (s_sdi->domain_sid != NULL) {

      d_sdi->sid = *s_sdi->domain_sid;

    } else {

      d_sdi->sid = (struct dom_sid) { .sid_rev_num = 0, };

    }

    d_sdi->dns_name.string = s_sdi->dns_domain_name.string;

    d_sdi->netbios_name.string = s_sdi->netbios_domain_name.string;

    ndr_err = ndr_push_union_blob(&blob,

                mem_ctx,

                &fta,

                FOREST_TRUST_SCANNER_INFO,

                (ndr_push_flags_fn_t)ndr_push_ForestTrustData);

    if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {

      return ndr_map_error2ntstatus(ndr_err);

    }

    lftr->type = LSA_FOREST_TRUST_SCANNER_INFO;

    lftr->forest_trust_data.data.data = blob.data;

    lftr->forest_trust_data.data.length = blob.length;

    return NT_STATUS_OK;

  }

  return NT_STATUS_NOT_SUPPORTED;

}

NTSTATUS trust_forest_info_to_lsa(TALLOC_CTX *mem_ctx,

          const struct ForestTrustInfo *fti,

          struct lsa_ForestTrustInformation **_lfti)

{

  struct lsa_ForestTrustInformation *lfti;

  uint32_t i;

  *_lfti = NULL;

  if (fti->version != 1) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  lfti = talloc_zero(mem_ctx, struct lsa_ForestTrustInformation);

  if (lfti == NULL) {

    return NT_STATUS_NO_MEMORY;

  }

  lfti->count = fti->count;

  lfti->entries = talloc_zero_array(mem_ctx,

            struct lsa_ForestTrustRecord *,

            lfti->count);

  if (lfti->entries == NULL) {

    TALLOC_FREE(lfti);

    return NT_STATUS_NO_MEMORY;

  }

  for (i = 0; i < fti->count; i++) {

    struct ForestTrustInfoRecord *ftr = &fti->records[i].record;

    struct lsa_ForestTrustRecord2 lftr2 = { .flags = 0, };

    struct lsa_ForestTrustRecord *lftr = NULL;

    NTSTATUS status;

    lftr = talloc_zero(lfti->entries,

           struct lsa_ForestTrustRecord);

    if (lftr == NULL) {

      TALLOC_FREE(lfti);

      return NT_STATUS_NO_MEMORY;

    }

    status = trust_forest_record_to_lsa(lftr, ftr, &lftr2);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(lfti);

      return NT_STATUS_NO_MEMORY;

    }

    status = trust_forest_record_lsa_2to1(lftr, &lftr2, lftr);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(lfti);

      return NT_STATUS_NO_MEMORY;

    }

    lfti->entries[i] = lftr;

  }

  *_lfti = lfti;

  return NT_STATUS_OK;

}

static NTSTATUS trust_forest_record_lsa_2to2(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustRecord2 *in,

        struct lsa_ForestTrustRecord2 *out)

{

  const struct lsa_ForestTrustBinaryData *binary = NULL;

  if (in == NULL) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  out->flags = in->flags;

  out->time = in->time;

  switch (in->type) {

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME:

    out->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;

    out->forest_trust_data.top_level_name =

      in->forest_trust_data.top_level_name;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:

    out->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX;

    out->forest_trust_data.top_level_name_ex =

      in->forest_trust_data.top_level_name_ex;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_DOMAIN_INFO:

    out->type = LSA_FOREST_TRUST_DOMAIN_INFO;

    out->forest_trust_data.domain_info =

      in->forest_trust_data.domain_info;

    return NT_STATUS_OK;

  case LSA_FOREST_TRUST_BINARY_DATA:

    binary = &in->forest_trust_data.data;

    return trust_forest_record_lsa_resolve_binary(mem_ctx,

                    in->flags,

                    in->time,

                    binary,

                    out);

  case LSA_FOREST_TRUST_SCANNER_INFO:

    out->type = LSA_FOREST_TRUST_SCANNER_INFO;

    out->forest_trust_data.domain_info =

      in->forest_trust_data.domain_info;

    return NT_STATUS_OK;

  }

  return NT_STATUS_NOT_SUPPORTED;

}

NTSTATUS trust_forest_info_from_lsa2(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustInformation2 *lfti,

        struct ForestTrustInfo **_fti)

{

  struct ForestTrustInfo *fti;

  uint32_t i;

  *_fti = NULL;

  fti = talloc_zero(mem_ctx, struct ForestTrustInfo);

  if (fti == NULL) {

    return NT_STATUS_NO_MEMORY;

  }

  fti->version = 1;

  fti->count = lfti->count;

  fti->records = talloc_zero_array(fti,

           struct ForestTrustInfoRecordArmor,

           fti->count);

  if (fti->records == NULL) {

    TALLOC_FREE(fti);

    return NT_STATUS_NO_MEMORY;

  }

  for (i = 0; i < fti->count; i++) {

    const struct lsa_ForestTrustRecord2 *lftr2 = lfti->entries[i];

    struct lsa_ForestTrustRecord2 _lftr2 = { .flags = 0, };

    struct ForestTrustInfoRecord *ftr = &fti->records[i].record;

    TALLOC_CTX *frame = talloc_stackframe();

    NTSTATUS status;

    status = trust_forest_record_lsa_2to2(frame,

                  lftr2,

                  &_lftr2);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(frame);

      TALLOC_FREE(fti);

      return status;

    }

    status = trust_forest_record_from_lsa(fti->records,

                  &_lftr2,

                  ftr);

    TALLOC_FREE(frame);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(fti);

      return status;

    }

  }

  *_fti = fti;

  return NT_STATUS_OK;

}

NTSTATUS trust_forest_info_to_lsa2(TALLOC_CTX *mem_ctx,

           const struct ForestTrustInfo *fti,

           struct lsa_ForestTrustInformation2 **_lfti)

{

  struct lsa_ForestTrustInformation2 *lfti;

  uint32_t i;

  *_lfti = NULL;

  if (fti->version != 1) {

    return NT_STATUS_INVALID_PARAMETER;

  }

  lfti = talloc_zero(mem_ctx, struct lsa_ForestTrustInformation2);

  if (lfti == NULL) {

    return NT_STATUS_NO_MEMORY;

  }

  lfti->count = fti->count;

  lfti->entries = talloc_zero_array(mem_ctx,

            struct lsa_ForestTrustRecord2 *,

            lfti->count);

  if (lfti->entries == NULL) {

    TALLOC_FREE(lfti);

    return NT_STATUS_NO_MEMORY;

  }

  for (i = 0; i < fti->count; i++) {

    struct ForestTrustInfoRecord *ftr = &fti->records[i].record;

    struct lsa_ForestTrustRecord2 *lftr2 = NULL;

    NTSTATUS status;

    lftr2 = talloc_zero(lfti->entries,

            struct lsa_ForestTrustRecord2);

    if (lftr2 == NULL) {

      TALLOC_FREE(lfti);

      return NT_STATUS_NO_MEMORY;

    }

    status = trust_forest_record_to_lsa(lftr2, ftr, lftr2);

    if (!NT_STATUS_IS_OK(status)) {

      TALLOC_FREE(lfti);

      return NT_STATUS_NO_MEMORY;

    }

    lfti->entries[i] = lftr2;

  }

  *_lfti = lfti;

  return NT_STATUS_OK;

}

NTSTATUS trust_forest_info_lsa_1to2(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustInformation *lfti,

        struct lsa_ForestTrustInformation2 **_lfti2)

{

  TALLOC_CTX *frame = talloc_stackframe();

  struct ForestTrustInfo *fti = NULL;

  struct lsa_ForestTrustInformation2 *lfti2 = NULL;

  NTSTATUS status;

  status = trust_forest_info_from_lsa(frame, lfti, &fti);

  if (!NT_STATUS_IS_OK(status)) {

    TALLOC_FREE(frame);

    return status;

  }

  status = trust_forest_info_to_lsa2(mem_ctx,

             fti,

             &lfti2);

  if (!NT_STATUS_IS_OK(status)) {

    TALLOC_FREE(frame);

    return status;

  }

  *_lfti2 = lfti2;

  TALLOC_FREE(frame);

  return NT_STATUS_OK;

}

NTSTATUS trust_forest_info_lsa_2to1(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustInformation2 *lfti2,

        struct lsa_ForestTrustInformation **_lfti)

{

  TALLOC_CTX *frame = talloc_stackframe();

  struct ForestTrustInfo *fti = NULL;

  struct lsa_ForestTrustInformation *lfti = NULL;

  NTSTATUS status;

  status = trust_forest_info_from_lsa2(frame, lfti2, &fti);

  if (!NT_STATUS_IS_OK(status)) {

    TALLOC_FREE(frame);

    return status;

  }

  status = trust_forest_info_to_lsa(mem_ctx,

            fti,

            &lfti);

  if (!NT_STATUS_IS_OK(status)) {

    TALLOC_FREE(frame);

    return status;

  }

  *_lfti = lfti;

  TALLOC_FREE(frame);

  return NT_STATUS_OK;

}

NTSTATUS trust_forest_info_lsa_2to2(TALLOC_CTX *mem_ctx,

        const struct lsa_ForestTrustInformation2 *in,

        struct lsa_ForestTrustInformation2 **_out)

{

  TALLOC_CTX *frame = talloc_stackframe();

  struct ForestTrustInfo *fti = NULL;

  struct lsa_ForestTrustInformation2 *out = NULL;

  NTSTATUS status;

  status = trust_forest_info_from_lsa2(frame, in, &fti);

  if (!NT_STATUS_IS_OK(status)) {

    TALLOC_FREE(frame);

    return status;

  }

  status = trust_forest_info_to_lsa2(mem_ctx,

             fti,

             &out);

  if (!NT_STATUS_IS_OK(status)) {

    TALLOC_FREE(frame);

    return status;

  }

  *_out = out;

  TALLOC_FREE(frame);

  return NT_STATUS_OK;

}

static int trust_forest_info_tln_match_internal(

    const struct lsa_ForestTrustInformation2 *info,

    enum lsa_ForestTrustRecordType type,

    uint32_t disable_mask,

    const char *tln)

{

  uint32_t i;

  for (i = 0; i < info->count; i++) {

    struct lsa_ForestTrustRecord2 *e = info->entries[i];

    struct lsa_StringLarge *t = NULL;

    int cmp;