/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * This module provides the high level interface to the SAM RPC
 * functions.
 */

#include <sys/types.h>
#include <sys/isa_defs.h>
#include <sys/byteorder.h>

#include <alloca.h>

#include <smbsrv/libsmb.h>
#include <smbsrv/libmlsvc.h>
#include <smb/ntaccess.h>
#include <lsalib.h>
#include <samlib.h>

#ifdef _LITTLE_ENDIAN
/* little-endian values on little-endian */
#define htolel(x)       ((uint32_t)(x))
#define letohl(x)       ((uint32_t)(x))
#else   /* (BYTE_ORDER == LITTLE_ENDIAN) */
/* little-endian values on big-endian (swap) */
#define letohl(x)       BSWAP_32(x)
#define htolel(x)       BSWAP_32(x)
#endif  /* (BYTE_ORDER == LITTLE_ENDIAN) */

/*
 * Valid values for the OEM OWF password encryption.
 */
#define SAM_KEYLEN              16

static void samr_fill_userpw(struct samr_user_password *, const char *);
static void samr_make_encrypted_password(
        struct samr_encr_passwd *epw,
        char *new_pw_clear,
        uint8_t *crypt_key);


/*
 * Todo: Implement "unjoin" domain, which would use the
 * sam_remove_trust_account code below.
 */

/*
 * sam_remove_trust_account
 *
 * Attempt to remove the workstation trust account for this system.
 * Administrator access is required to perform this operation.
 *
 * Returns NT status codes.
 */
DWORD
sam_remove_trust_account(char *server, char *domain)
{
        char account_name[SMB_SAMACCT_MAXLEN];

        if (smb_getsamaccount(account_name, SMB_SAMACCT_MAXLEN) != 0)
                return (NT_STATUS_INTERNAL_ERROR);

        return (sam_delete_account(server, domain, account_name));
}


/*
 * sam_delete_account
 *
 * Attempt to remove an account from the SAM database on the specified
 * server.
 *
 * Returns NT status codes.
 */
DWORD
sam_delete_account(char *server, char *domain_name, char *account_name)
{
        mlsvc_handle_t samr_handle;
        mlsvc_handle_t domain_handle;
        mlsvc_handle_t user_handle;
        smb_account_t ainfo;
        smb_sid_t *sid;
        DWORD access_mask;
        DWORD status;
        int rc;
        char user[SMB_USERNAME_MAXLEN];

        smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);

        rc = samr_open(server, domain_name, user, SAM_LOOKUP_INFORMATION,
            &samr_handle);
        if (rc != 0)
                return (NT_STATUS_CANT_ACCESS_DOMAIN_INFO);

        sid = samr_lookup_domain(&samr_handle, domain_name);
        if (sid == NULL) {
                status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
                goto out_samr_hdl;
        }

        status = samr_open_domain(&samr_handle, SAM_LOOKUP_INFORMATION,
            (struct samr_sid *)sid, &domain_handle);
        if (status != NT_STATUS_SUCCESS)
                goto out_sid_ptr;

        status = samr_lookup_domain_names(&domain_handle, account_name, &ainfo);
        if (status != NT_STATUS_SUCCESS)
                goto out_dom_hdl;

        access_mask = STANDARD_RIGHTS_EXECUTE | DELETE;
        status = samr_open_user(&domain_handle, access_mask,
            ainfo.a_rid, &user_handle);
        if (status != NT_STATUS_SUCCESS)
                goto out_dom_hdl;

        status = samr_delete_user(&user_handle);

        (void) samr_close_handle(&user_handle);
out_dom_hdl:
        (void) samr_close_handle(&domain_handle);
out_sid_ptr:
        free(sid);
out_samr_hdl:
        (void) samr_close_handle(&samr_handle);

        return (status);
}


/*
 * sam_lookup_name
 *
 * Lookup an account name in the SAM database on the specified domain
 * controller. Provides the account RID on success.
 *
 * Returns NT status codes.
 */
DWORD
sam_lookup_name(char *server, char *domain_name, char *account_name,
    DWORD *rid_ret)
{
        mlsvc_handle_t samr_handle;
        mlsvc_handle_t domain_handle;
        smb_account_t ainfo;
        struct samr_sid *domain_sid;
        int rc;
        DWORD status;
        char user[SMB_USERNAME_MAXLEN];

        smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);

        *rid_ret = 0;

        rc = samr_open(server, domain_name, user, SAM_LOOKUP_INFORMATION,
            &samr_handle);

        if (rc != 0)
                return (NT_STATUS_OPEN_FAILED);

        domain_sid = (struct samr_sid *)samr_lookup_domain(&samr_handle,
            domain_name);
        if (domain_sid == NULL) {
                (void) samr_close_handle(&samr_handle);
                return (NT_STATUS_NO_SUCH_DOMAIN);
        }

        status = samr_open_domain(&samr_handle, SAM_LOOKUP_INFORMATION,
            domain_sid, &domain_handle);
        if (status == NT_STATUS_SUCCESS) {
                status = samr_lookup_domain_names(&domain_handle,
                    account_name, &ainfo);
                if (status == NT_STATUS_SUCCESS)
                        *rid_ret = ainfo.a_rid;

                (void) samr_close_handle(&domain_handle);
        }

        (void) samr_close_handle(&samr_handle);
        return (status);
}

/*
 * sam_get_local_domains
 *
 * Query a remote server to get the list of local domains that it
 * supports.
 *
 * Returns NT status codes.
 */
DWORD
sam_get_local_domains(char *server, char *domain_name)
{
        mlsvc_handle_t samr_handle;
        DWORD status;
        int rc;
        char user[SMB_USERNAME_MAXLEN];

        smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);

        rc = samr_open(server, domain_name, user, SAM_ENUM_LOCAL_DOMAIN,
            &samr_handle);
        if (rc != 0)
                return (NT_STATUS_OPEN_FAILED);

        status = samr_enum_local_domains(&samr_handle);
        (void) samr_close_handle(&samr_handle);
        return (status);
}

/*
 * Set the account control flags on some account for which we
 * have already opened a SAM handle with appropriate rights,
 * passed in here as sam_handle, along with the new flags.
 */
DWORD
netr_set_user_control(
        mlsvc_handle_t *user_handle,
        DWORD UserAccountControl)
{
        struct samr_SetUserInfo16 info;

        info.UserAccountControl = UserAccountControl;
        return (samr_set_user_info(user_handle, 16, &info));
}

/*
 * Set the password on some account, for which we have already
 * opened a SAM handle with appropriate rights, passed in here
 * as sam_handle, along with the new password as cleartext.
 *
 * This builds a struct SAMPR_USER_INTERNAL5_INFORMATION [MS-SAMR]
 * containing the new password, encrypted with our session key.
 */
DWORD
netr_set_user_password(
        mlsvc_handle_t *user_handle,
        char *new_pw_clear)
{
        unsigned char ssn_key[SMBAUTH_HASH_SZ];
        struct samr_SetUserInfo24 info;

        if (ndr_rpc_get_ssnkey(user_handle, ssn_key, SMBAUTH_HASH_SZ))
                return (NT_STATUS_INTERNAL_ERROR);

        (void) memset(&info, 0, sizeof (info));
        samr_make_encrypted_password(&info.encr_pw, new_pw_clear, ssn_key);

        /* Rather not leave the session key around. */
        (void) memset(ssn_key, 0, sizeof (ssn_key));

        return (samr_set_user_info(user_handle, 24, &info));
}

/*
 * Change a password like NetUserChangePassword(),
 * but where we already know which AD server to use,
 * so we don't request the domain name or search for
 * an AD server for that domain here.
 */
DWORD
netr_change_password(
        char *server,
        char *account,
        char *old_pw_clear,
        char *new_pw_clear)
{
        struct samr_encr_passwd epw;
        struct samr_encr_hash old_hash;
        uint8_t old_nt_hash[SAMR_PWHASH_LEN];
        uint8_t new_nt_hash[SAMR_PWHASH_LEN];
        mlsvc_handle_t handle;
        DWORD status;

        /*
         * Create an RPC handle to this server, bound to SAMR.
         * Note: the group policy option to disable anonymous access to named
         * pipes on DCs doesn't work with this.
         * To work with that option, we'll have to find an interface that lets
         * us authenticate with an expired password, instead of the anonymous
         * bind we currently perform.
         */
        status = ndr_rpc_bind(&handle, server, "", "", "SAMR");
        if (status != NT_STATUS_SUCCESS)
                return (status);

        /*
         * Encrypt the new p/w (plus random filler) with the
         * old password, and send the old p/w encrypted with
         * the new p/w hash to prove we know the old p/w.
         * Details:  [MS-SAMR 3.1.5.10.3]
         */
        (void) smb_auth_ntlm_hash(old_pw_clear, old_nt_hash);
        (void) smb_auth_ntlm_hash(new_pw_clear, new_nt_hash);
        samr_make_encrypted_password(&epw, new_pw_clear, old_nt_hash);

        (void) smb_auth_DES(old_hash.data, SAMR_PWHASH_LEN,
            new_nt_hash, 14, /* key */
            old_nt_hash, SAMR_PWHASH_LEN);

        /*
         * Finally, ready to try the OtW call.
         */
        status = samr_change_password(
            &handle, server, account,
            &epw, &old_hash);

        /* Avoid leaving cleartext (or equivalent) around. */
        (void) memset(old_nt_hash, 0, sizeof (old_nt_hash));
        (void) memset(new_nt_hash, 0, sizeof (new_nt_hash));

        ndr_rpc_unbind(&handle);
        return (status);
}

/*
 * Build an encrypted password, as used by samr_set_user_info
 * and samr_change_password.  Note: This builds the unencrypted
 * form in one union arm, and encrypts it in the other union arm.
 */
void
samr_make_encrypted_password(
        struct samr_encr_passwd *epw,
        char *new_pw_clear,
        uint8_t *crypt_key)
{
        union {
                struct samr_user_password u;
                struct samr_encr_passwd e;
        } pwu;

        samr_fill_userpw(&pwu.u, new_pw_clear);

        (void) smb_auth_RC4(pwu.e.data, sizeof (pwu.e.data),
            crypt_key, SAMR_PWHASH_LEN,
            pwu.e.data, sizeof (pwu.e.data));

        (void) memcpy(epw->data, pwu.e.data, sizeof (pwu.e.data));
        (void) memset(pwu.e.data, 0, sizeof (pwu.e.data));
}

/*
 * This fills in a samr_user_password (a.k.a. SAMPR_USER_PASSWORD
 * in the MS Net API) which has the new password "right justified"
 * in the buffer, and any space on the left filled with random junk
 * to improve the quality of the encryption that is subsequently
 * applied to this buffer before it goes over the wire.
 */
static void
samr_fill_userpw(struct samr_user_password *upw, const char *new_pw)
{
        smb_wchar_t *pbuf;
        uint32_t pwlen_bytes;
        size_t pwlen_wchars;

        /*
         * First fill the whole buffer with the random junk.
         * (Slightly less random when debugging:)
         */
#ifdef DEBUG
        (void) memset(upw->Buffer, '*', sizeof (upw->Buffer));
#else
        randomize((char *)upw->Buffer, sizeof (upw->Buffer));
#endif

        /*
         * Now overwrite the last pwlen characters of
         * that buffer with the password, and set the
         * length field so the receiving end knows where
         * the junk ends and the real password starts.
         */
        pwlen_wchars = smb_wcequiv_strlen(new_pw) / 2;
        if (pwlen_wchars > SAMR_USER_PWLEN)
                pwlen_wchars = SAMR_USER_PWLEN;
        pwlen_bytes = pwlen_wchars * 2;

        pbuf = &upw->Buffer[SAMR_USER_PWLEN - pwlen_wchars];
        (void) smb_mbstowcs(pbuf, new_pw, pwlen_wchars);

        /* Yes, this is in Bytes, not wchars. */
        upw->Length = htolel(pwlen_bytes);
}