/*

   Unix SMB/CIFS implementation.

   net ads setspn routines

   Copyright (C) Noel Power 2018

   This program is free software; you can redistribute it and/or modify

   it under the terms of the GNU General Public License as published by

   the Free Software Foundation; either version 3 of the License, or

   (at your option) any later version.

   This program is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License

   along with this program.  If not, see <http://www.gnu.org/licenses/>.

*/

#include "includes.h"

#include "ads.h"

#ifdef HAVE_ADS

bool ads_setspn_list(ADS_STRUCT *ads, const char *machine_name)

{

  size_t i = 0;

  TALLOC_CTX *frame = NULL;

  char **spn_array = NULL;

  size_t num_spns = 0;

  bool ok = false;

  ADS_STATUS status;

  frame = talloc_stackframe();

  status = ads_get_service_principal_names(frame,

             ads,

             machine_name,

             &spn_array,

             &num_spns);

  if (!ADS_ERR_OK(status)) {

    goto done;

  }

  d_printf("Registered SPNs for %s\n", machine_name);

  for (i = 0; i < num_spns; i++) {

    d_printf("\t%s\n", spn_array[i]);

  }

  ok = true;

done:

  TALLOC_FREE(frame);

  return ok;

}

/* returns true if spn exists in spn_array (match is NOT case-sensitive) */

static bool find_spn_in_spnlist(TALLOC_CTX *ctx,

        const char *spn,

        char **spn_array,

        size_t num_spns)

{

  char *lc_spn = NULL;

  size_t i = 0;

  lc_spn = strlower_talloc(ctx, spn);

  if (lc_spn == NULL) {

    DBG_ERR("Out of memory, lowercasing %s.\n",

      spn);

    return false;

  }

  for (i = 0; i < num_spns; i++) {

    char *lc_spn_attr = strlower_talloc(ctx, spn_array[i]);

    if (lc_spn_attr == NULL) {

      DBG_ERR("Out of memory, lowercasing %s.\n",

        spn_array[i]);

      return false;

    }

    if (strequal(lc_spn, lc_spn_attr)) {

      return true;

    }

  }

  return false;

}

bool ads_setspn_add(ADS_STRUCT *ads, const char *machine_name, const char * spn)

{

  bool ret = false;

  TALLOC_CTX *frame = NULL;

  ADS_STATUS status;

  struct spn_struct *spn_struct = NULL;

  const char *spns[2] = {NULL, NULL};

  char **existing_spns = NULL;

  size_t num_spns = 0;

  bool found = false;

  frame = talloc_stackframe();

  spns[0] = spn;

  spn_struct = parse_spn(frame, spn);

  if (spn_struct == NULL) {

    goto done;

  }

  status = ads_get_service_principal_names(frame,

             ads,

             machine_name,

             &existing_spns,

             &num_spns);

  if (!ADS_ERR_OK(status)) {

    goto done;

  }

  found = find_spn_in_spnlist(frame, spn, existing_spns, num_spns);

  if (found) {

    d_printf("Duplicate SPN found, aborting operation.\n");

    goto done;

  }

  d_printf("Registering SPN %s for object %s\n", spn, machine_name);

  status = ads_add_service_principal_names(ads, machine_name, spns);

  if (!ADS_ERR_OK(status)) {

    goto done;

  }

  ret = true;

  d_printf("Updated object\n");

done:

  TALLOC_FREE(frame);

  return ret;

}

bool ads_setspn_delete(ADS_STRUCT *ads,

           const char *machine_name,

           const char * spn)

{

  size_t i = 0, j = 0;

  TALLOC_CTX *frame = NULL;

  char **spn_array = NULL;

  const char **new_spn_array = NULL;

  char *lc_spn = NULL;

  size_t num_spns = 0;

  ADS_STATUS status;

  ADS_MODLIST mods;

  bool ok = false;

  LDAPMessage *res = NULL;

  frame = talloc_stackframe();

  lc_spn = strlower_talloc(frame, spn);

  if (lc_spn == NULL) {

    DBG_ERR("Out of memory, lowercasing %s.\n", spn);

    goto done;

  }

  status = ads_find_machine_acct(ads,

               &res,

               machine_name);

  if (!ADS_ERR_OK(status)) {

    goto done;

  }

  status = ads_get_service_principal_names(frame,

             ads,

             machine_name,

             &spn_array,

             &num_spns);

  if (!ADS_ERR_OK(status)) {

    goto done;

  }

  new_spn_array = talloc_zero_array(frame, const char*, num_spns + 1);

  if (!new_spn_array) {

    DBG_ERR("Out of memory, failed to allocate array.\n");

    goto done;

  }

  /*

   * create new spn list to write to object (excluding the spn to

   * be deleted).

   */

  for (i = 0, j = 0; i < num_spns; i++) {

    /*

     * windows setspn.exe deletes matching spn in a case

     * insensitive way.

     */

    char *lc_spn_attr = strlower_talloc(frame, spn_array[i]);

    if (lc_spn_attr == NULL) {

      DBG_ERR("Out of memory, lowercasing %s.\n",

        spn_array[i]);

      goto done;

    }

    if (!strequal(lc_spn, lc_spn_attr)) {

      new_spn_array[j++] = spn_array[i];

    }

  }

  /* found and removed spn */

  if (j < num_spns) {

    char *dn = NULL;

    mods = ads_init_mods(frame);

    if (mods == NULL) {

      goto done;

    }

    d_printf("Unregistering SPN %s for %s\n", spn, machine_name);

    status = ads_mod_strlist(frame, &mods, "servicePrincipalName", new_spn_array);

    if (!ADS_ERR_OK(status)) {

      goto done;

    }

    dn = ads_get_dn(ads, frame, res);

    if (dn == NULL ) {

      goto done;

    }

    status = ads_gen_mod(ads, dn, mods);

    if (!ADS_ERR_OK(status)) {

      goto done;

    }

  }

  d_printf("Updated object\n");

  ok = true;

done:

  TALLOC_FREE(frame);

  return ok;

}

#endif /* HAVE_ADS */