/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2023 RackTop Systems, Inc.
 */

#include <alloca.h>
#include <string.h>
#include <strings.h>
#include <lber.h>
#include <sasl/sasl.h>
#include <string.h>
#include <ctype.h>
#include <synch.h>
#include <atomic.h>
#include <errno.h>
#include <assert.h>
#include <limits.h>
#include <syslog.h>
#include <sys/u8_textprep.h>
#include <sys/varargs.h>
#include "libadutils.h"
#include "adutils_impl.h"

/* List of DSs, needed by the idle connection reaper thread */
static pthread_mutex_t  adhostlock = PTHREAD_MUTEX_INITIALIZER;
static adutils_host_t   *host_head = NULL;

/*
 * List of query state structs -- needed so we can "route" LDAP results
 * to the right context if multiple threads should be using the same
 * connection concurrently
 */
static pthread_mutex_t          qstatelock = PTHREAD_MUTEX_INITIALIZER;
static adutils_query_state_t    *qstatehead = NULL;

static char *adutils_sid_ber2str(BerValue *bvalues);
static void adutils_lookup_batch_unlock(adutils_query_state_t **state);
static void delete_ds(adutils_ad_t *ad, const char *host, int port);

int ad_debug[AD_DEBUG_MAX+1] = {0};

typedef struct binary_attrs {
        const char      *name;
        char            *(*ber2str)(BerValue *bvalues);
} binary_attrs_t;

static binary_attrs_t binattrs[] = {
        {"objectSID", adutils_sid_ber2str},
        {NULL, NULL}
};


adutils_logger logger = syslog;


void
adutils_set_logger(adutils_logger funct)
{
        logger = funct;
}


/*
 * Turn "foo.bar.com" into "dc=foo,dc=bar,dc=com"
 */
static
char *
adutils_dns2dn(const char *dns)
{
        int num_parts;

        return (ldap_dns_to_dn((char *)dns, &num_parts));
}


/*
 * Turn "dc=foo,dc=bar,dc=com" into "foo.bar.com"; ignores any other
 * attributes (CN, etc...).
 */
char *
adutils_dn2dns(const char *dn)
{
        return (DN_to_DNS(dn));
}


/*
 * Convert a binary SID in a BerValue to a adutils_sid_t
 */
int
adutils_getsid(BerValue *bval, adutils_sid_t *sidp)
{
        int             i, j;
        uchar_t         *v;
        uint32_t        a;

        /*
         * The binary format of a SID is as follows:
         *
         * byte #0: version, always 0x01
         * byte #1: RID count, always <= 0x0f
         * bytes #2-#7: SID authority, big-endian 48-bit unsigned int
         *
         * followed by RID count RIDs, each a little-endian, unsigned
         * 32-bit int.
         */
        /*
         * Sanity checks: must have at least one RID, version must be
         * 0x01, and the length must be 8 + rid count * 4
         */
        if (bval->bv_len > 8 && bval->bv_val[0] == 0x01 &&
            bval->bv_len == 1 + 1 + 6 + bval->bv_val[1] * 4) {
                v = (uchar_t *)bval->bv_val;
                sidp->version = v[0];
                sidp->sub_authority_count = v[1];
                sidp->authority =
                    /* big endian -- so start from the left */
                    ((u_longlong_t)v[2] << 40) |
                    ((u_longlong_t)v[3] << 32) |
                    ((u_longlong_t)v[4] << 24) |
                    ((u_longlong_t)v[5] << 16) |
                    ((u_longlong_t)v[6] << 8) |
                    (u_longlong_t)v[7];
                for (i = 0; i < sidp->sub_authority_count; i++) {
                        j = 8 + (i * 4);
                        /* little endian -- so start from the right */
                        a = (v[j + 3] << 24) | (v[j + 2] << 16) |
                            (v[j + 1] << 8) | (v[j]);
                        sidp->sub_authorities[i] = a;
                }
                return (0);
        }
        return (-1);
}

/*
 * Convert a adutils_sid_t to S-1-...
 */
char *
adutils_sid2txt(adutils_sid_t *sidp)
{
        int     rlen, i, len;
        char    *str, *cp;

        if (sidp->version != 1)
                return (NULL);

        len = sizeof ("S-1-") - 1;

        /*
         * We could optimize like so, but, why?
         *      if (sidp->authority < 10)
         *              len += 2;
         *      else if (sidp->authority < 100)
         *              len += 3;
         *      else
         *              len += snprintf(NULL, 0"%llu", sidp->authority);
         */
        len += snprintf(NULL, 0, "%llu", sidp->authority);

        /* Max length of a uint32_t printed out in ASCII is 10 bytes */
        len += 1 + (sidp->sub_authority_count + 1) * 10;

        if ((cp = str = malloc(len)) == NULL)
                return (NULL);

        rlen = snprintf(str, len, "S-1-%llu", sidp->authority);

        cp += rlen;
        len -= rlen;

        for (i = 0; i < sidp->sub_authority_count; i++) {
                assert(len > 0);
                rlen = snprintf(cp, len, "-%u", sidp->sub_authorities[i]);
                cp += rlen;
                len -= rlen;
                assert(len >= 0);
        }

        return (str);
}

/*
 * Convert a adutils_sid_t to on-the-wire encoding
 */
static
int
sid2binsid(adutils_sid_t *sid, uchar_t *binsid, int binsidlen)
{
        uchar_t         *p;
        int             i;
        uint64_t        a;
        uint32_t        r;

        if (sid->version != 1 ||
            binsidlen != (1 + 1 + 6 + sid->sub_authority_count * 4))
                return (-1);

        p = binsid;
        *p++ = 0x01;            /* version */
        /* sub authority count */
        *p++ = sid->sub_authority_count;
        /* Authority */
        a = sid->authority;
        /* big-endian -- start from left */
        *p++ = (a >> 40) & 0xFF;
        *p++ = (a >> 32) & 0xFF;
        *p++ = (a >> 24) & 0xFF;
        *p++ = (a >> 16) & 0xFF;
        *p++ = (a >> 8) & 0xFF;
        *p++ = a & 0xFF;

        /* sub-authorities */
        for (i = 0; i < sid->sub_authority_count; i++) {
                r = sid->sub_authorities[i];
                /* little-endian -- start from right */
                *p++ = (r & 0x000000FF);
                *p++ = (r & 0x0000FF00) >> 8;
                *p++ = (r & 0x00FF0000) >> 16;
                *p++ = (r & 0xFF000000) >> 24;
        }

        return (0);
}

/*
 * Convert a stringified SID (S-1-...) into a hex-encoded version of the
 * on-the-wire encoding, but with each pair of hex digits pre-pended
 * with a '\', so we can pass this to libldap.
 */
int
adutils_txtsid2hexbinsid(const char *txt, const uint32_t *rid,
    char *hexbinsid, int hexbinsidlen)
{
        adutils_sid_t   sid = { 0 };
        int             i, j;
        const char      *cp;
        char            *ecp;
        u_longlong_t    a;
        unsigned long   r;
        uchar_t         *binsid, b, hb;

        /* Only version 1 SIDs please */
        if (strncmp(txt, "S-1-", strlen("S-1-")) != 0)
                return (-1);

        if (strlen(txt) < (strlen("S-1-") + 1))
                return (-1);

        /* count '-'s */
        for (j = 0, cp = strchr(txt, '-');
            cp != NULL && *cp != '\0';
            j++, cp = strchr(cp + 1, '-')) {
                /* can't end on a '-' */
                if (*(cp + 1) == '\0')
                        return (-1);
        }

        /* Adjust count for version and authority */
        j -= 2;

        /* we know the version number and RID count */
        sid.version = 1;
        sid.sub_authority_count = (rid != NULL) ? j + 1 : j;

        /* must have at least one RID, but not too many */
        if (sid.sub_authority_count < 1 ||
            sid.sub_authority_count > ADUTILS_SID_MAX_SUB_AUTHORITIES)
                return (-1);

        /* check that we only have digits and '-' */
        if (strspn(txt + 1, "0123456789-") < (strlen(txt) - 1))
                return (-1);

        cp = txt + strlen("S-1-");

        /* 64-bit safe parsing of unsigned 48-bit authority value */
        errno = 0;
        a = strtoull(cp, &ecp, 10);

        /* errors parsing the authority or too many bits */
        if (cp == ecp || (a == 0 && errno == EINVAL) ||
            (a == ULLONG_MAX && errno == ERANGE) ||
            (a & 0x0000ffffffffffffULL) != a)
                return (-1);

        cp = ecp;

        sid.authority = (uint64_t)a;

        for (i = 0; i < j; i++) {
                if (*cp++ != '-')
                        return (-1);
                /* 64-bit safe parsing of unsigned 32-bit RID */
                errno = 0;
                r = strtoul(cp, &ecp, 10);
                /* errors parsing the RID or too many bits */
                if (cp == ecp || (r == 0 && errno == EINVAL) ||
                    (r == ULONG_MAX && errno == ERANGE) ||
                    (r & 0xffffffffUL) != r)
                        return (-1);
                sid.sub_authorities[i] = (uint32_t)r;
                cp = ecp;
        }

        /* check that all of the string SID has been consumed */
        if (*cp != '\0')
                return (-1);

        if (rid != NULL)
                sid.sub_authorities[j] = *rid;

        j = 1 + 1 + 6 + sid.sub_authority_count * 4;

        if (hexbinsidlen < (j * 3))
                return (-2);

        /* binary encode the SID */
        binsid = (uchar_t *)alloca(j);
        (void) sid2binsid(&sid, binsid, j);

        /* hex encode, with a backslash before each byte */
        for (ecp = hexbinsid, i = 0; i < j; i++) {
                b = binsid[i];
                *ecp++ = '\\';
                hb = (b >> 4) & 0xF;
                *ecp++ = (hb <= 0x9 ? hb + '0' : hb - 10 + 'A');
                hb = b & 0xF;
                *ecp++ = (hb <= 0x9 ? hb + '0' : hb - 10 + 'A');
        }
        *ecp = '\0';

        return (0);
}

static
char *
convert_bval2sid(BerValue *bval, uint32_t *rid)
{
        adutils_sid_t   sid;

        if (adutils_getsid(bval, &sid) < 0)
                return (NULL);

        /*
         * If desired and if the SID is what should be a domain/computer
         * user or group SID (i.e., S-1-5-w-x-y-z-<user/group RID>) then
         * save the last RID and truncate the SID
         */
        if (rid != NULL && sid.authority == 5 && sid.sub_authority_count == 5)
                *rid = sid.sub_authorities[--sid.sub_authority_count];
        return (adutils_sid2txt(&sid));
}


/*
 * Return a NUL-terminated stringified SID from the value of an
 * objectSid attribute and put the last RID in *rid.
 */
char *
adutils_bv_objsid2sidstr(BerValue *bval, uint32_t *rid)
{
        char *sid;

        if (bval == NULL)
                return (NULL);
        /* objectSid is single valued */
        if ((sid = convert_bval2sid(bval, rid)) == NULL)
                return (NULL);
        return (sid);
}

static
char *
adutils_sid_ber2str(BerValue *bval)
{
        return (adutils_bv_objsid2sidstr(bval, NULL));
}


/*
 * Extract an int from the Ber value
 * Return B_TRUE if a valid integer was found, B_FALSE if not.
 */
boolean_t
adutils_bv_uint(BerValue *bval, unsigned int *result)
{
        char buf[40];   /* big enough for any int */
        unsigned int tmp;
        char *p;

        *result = 0;    /* for error cases */

        if (bval == NULL || bval->bv_val == NULL)
                return (B_FALSE);
        if (bval->bv_len >= sizeof (buf))
                return (B_FALSE);

        (void) memcpy(buf, bval->bv_val, bval->bv_len);
        buf[bval->bv_len] = '\0';

        tmp = strtoul(buf, &p, 10);

        /* Junk after the number? */
        if (*p != '\0')
                return (B_FALSE);

        *result = tmp;

        return (B_TRUE);
}

/* Return a NUL-terminated string from the Ber value */
char *
adutils_bv_str(BerValue *bval)
{
        char *s;

        if (bval == NULL || bval->bv_val == NULL)
                return (NULL);
        if ((s = malloc(bval->bv_len + 1)) == NULL)
                return (NULL);
        (void) snprintf(s, bval->bv_len + 1, "%.*s", bval->bv_len,
            bval->bv_val);
        return (s);
}

/*ARGSUSED*/
int
saslcallback(LDAP *ld, unsigned flags, void *defaults, void *prompts)
{
        sasl_interact_t *interact;

        if (prompts == NULL || flags != LDAP_SASL_INTERACTIVE)
                return (LDAP_PARAM_ERROR);

        /* There should be no extra arguemnts for SASL/GSSAPI authentication */
        for (interact = prompts; interact->id != SASL_CB_LIST_END;
            interact++) {
                interact->result = NULL;
                interact->len = 0;
        }
        return (LDAP_SUCCESS);
}


#define ADCONN_TIME     300

/*
 * Idle connection reaping side of connection management
 */
void
adutils_reap_idle_connections()
{
        adutils_host_t  *adh;
        time_t          now;

        (void) pthread_mutex_lock(&adhostlock);
        now = time(NULL);
        for (adh = host_head; adh != NULL; adh = adh->next) {
                (void) pthread_mutex_lock(&adh->lock);
                if (adh->ref == 0 && adh->idletime != 0 &&
                    adh->idletime + ADCONN_TIME < now) {
                        if (adh->ld) {
                                (void) ldap_unbind(adh->ld);
                                adh->ld = NULL;
                                adh->idletime = 0;
                                adh->ref = 0;
                        }
                }
                (void) pthread_mutex_unlock(&adh->lock);
        }
        (void) pthread_mutex_unlock(&adhostlock);
}


adutils_rc
adutils_ad_alloc(adutils_ad_t **new_ad, const char *domain_name,
    adutils_ad_partition_t part)
{
        adutils_ad_t *ad;

        *new_ad = NULL;

        if ((ad = calloc(1, sizeof (*ad))) == NULL)
                return (ADUTILS_ERR_MEMORY);
        ad->ref = 1;
        ad->partition = part;

        /* domain_name is required iff we are talking directly to a DC */
        if (part == ADUTILS_AD_DATA) {
                assert(domain_name != NULL);
                assert(*domain_name != '\0');

                ad->basedn = adutils_dns2dn(domain_name);
        } else {
                assert(domain_name == NULL);
                ad->basedn = strdup("");
        }
        if (ad->basedn == NULL)
                goto err;

        if (pthread_mutex_init(&ad->lock, NULL) != 0)
                goto err;
        *new_ad = ad;
        return (ADUTILS_SUCCESS);

err:
        free(ad->basedn);
        free(ad);
        return (ADUTILS_ERR_MEMORY);
}

void
adutils_ad_free(adutils_ad_t **ad)
{
        adutils_host_t *p;
        adutils_host_t *prev;

        if (ad == NULL || *ad == NULL)
                return;

        (void) pthread_mutex_lock(&(*ad)->lock);

        if (atomic_dec_32_nv(&(*ad)->ref) > 0) {
                (void) pthread_mutex_unlock(&(*ad)->lock);
                *ad = NULL;
                return;
        }

        (void) pthread_mutex_lock(&adhostlock);
        prev = NULL;
        p = host_head;
        while (p != NULL) {
                if (p->owner != (*ad)) {
                        prev = p;
                        p = p->next;
                        continue;
                } else {
                        delete_ds((*ad), p->host, p->port);
                        if (prev == NULL)
                                p = host_head;
                        else
                                p = prev->next;
                }
        }
        (void) pthread_mutex_unlock(&adhostlock);

        (void) pthread_mutex_unlock(&(*ad)->lock);
        (void) pthread_mutex_destroy(&(*ad)->lock);

        if ((*ad)->known_domains)
                free((*ad)->known_domains);
        free((*ad)->basedn);
        free(*ad);

        *ad = NULL;
}

static
int
open_conn(adutils_host_t *adh, int timeoutsecs)
{
        int zero = 0;
        int ldversion, rc;
        int timeoutms = timeoutsecs * 1000;

        if (adh == NULL)
                return (0);

        (void) pthread_mutex_lock(&adh->lock);

        if (!adh->dead && adh->ld != NULL)
                /* done! */
                goto out;

        if (adh->ld != NULL) {
                (void) ldap_unbind(adh->ld);
                adh->ld = NULL;
        }
        adh->num_requests = 0;

        atomic_inc_64(&adh->generation);

        /* Open and bind an LDAP connection */
        adh->ld = ldap_init(adh->host, adh->port);
        if (adh->ld == NULL) {
                logger(LOG_INFO, "ldap_init() to server "
                    "%s port %d failed. (%s)", adh->host,
                    adh->port, strerror(errno));
                goto out;
        }
        ldversion = LDAP_VERSION3;
        (void) ldap_set_option(adh->ld, LDAP_OPT_PROTOCOL_VERSION, &ldversion);
        (void) ldap_set_option(adh->ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
        (void) ldap_set_option(adh->ld, LDAP_OPT_TIMELIMIT, &zero);
        (void) ldap_set_option(adh->ld, LDAP_OPT_SIZELIMIT, &zero);
        (void) ldap_set_option(adh->ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeoutms);
        (void) ldap_set_option(adh->ld, LDAP_OPT_RESTART, LDAP_OPT_ON);

        rc = adutils_set_thread_functions(adh->ld);
        if (rc != LDAP_SUCCESS) {
                /* Error has already been logged */
                (void) ldap_unbind(adh->ld);
                adh->ld = NULL;
                goto out;
        }

        rc = ldap_sasl_interactive_bind_s(adh->ld, "" /* binddn */,
            adh->saslmech, NULL, NULL, adh->saslflags, &saslcallback,
            NULL);

        if (rc != LDAP_SUCCESS) {
                logger(LOG_INFO, "ldap_sasl_interactive_bind_s() to server "
                    "%s port %d failed. (%s)", adh->host, adh->port,
                    ldap_err2string(rc));
                ldap_perror(adh->ld, adh->host);
                (void) ldap_unbind(adh->ld);
                adh->ld = NULL;
                goto out;
        }

        logger(LOG_DEBUG, "Using server %s:%d",
            adh->host, adh->port);

out:
        if (adh->ld != NULL) {
                atomic_inc_32(&adh->ref);
                adh->idletime = time(NULL);
                adh->dead = 0;
                (void) pthread_mutex_unlock(&adh->lock);
                return (1);
        }

        (void) pthread_mutex_unlock(&adh->lock);
        return (0);
}


/*
 * Connection management: find an open connection or open one
 */
static
adutils_host_t *
get_conn(adutils_ad_t *ad)
{
        adutils_host_t  *adh = NULL;
        int             tries;
        int             dscount = 0;
        int             timeoutsecs = ADUTILS_LDAP_OPEN_TIMEOUT;

retry:
        (void) pthread_mutex_lock(&adhostlock);

        if (host_head == NULL) {
                (void) pthread_mutex_unlock(&adhostlock);
                goto out;
        }

        if (dscount == 0) {
                /*
                 * First try: count the number of DSes.
                 *
                 * Integer overflow is not an issue -- we can't have so many
                 * DSes because they won't fit even DNS over TCP, and SMF
                 * shouldn't let you set so many.
                 */
                for (adh = host_head, tries = 0; adh != NULL; adh = adh->next) {
                        if (adh->owner == ad)
                                dscount++;
                }

                if (dscount == 0) {
                        (void) pthread_mutex_unlock(&adhostlock);
                        goto out;
                }

                tries = dscount * 3;    /* three tries per-ds */

                /*
                 * Begin round-robin at the next DS in the list after the last
                 * one that we had a connection to, else start with the first
                 * DS in the list.
                 */
                adh = ad->last_adh;
        }

        /*
         * Round-robin -- pick the next one on the list; if the list
         * changes on us, no big deal, we'll just potentially go
         * around the wrong number of times.
         */
        for (;;) {
                if (adh != NULL && adh->owner == ad && adh->ld != NULL &&
                    !adh->dead)
                        break;
                if (adh == NULL || (adh = adh->next) == NULL)
                        adh = host_head;
                if (adh->owner == ad)
                        break;
        }

        ad->last_adh = adh;
        (void) pthread_mutex_unlock(&adhostlock);

        /* Found suitable DS, open it if not already opened */
        if (open_conn(adh, timeoutsecs))
                return (adh);

        tries--;
        if ((tries % dscount) == 0)
                timeoutsecs *= 2;
        if (tries > 0)
                goto retry;

out:
        logger(LOG_NOTICE, "Couldn't open an LDAP connection to any global "
            "catalog server!");
        return (NULL);
}

static
void
release_conn(adutils_host_t *adh)
{
        int delete = 0;

        (void) pthread_mutex_lock(&adh->lock);
        if (atomic_dec_32_nv(&adh->ref) == 0) {
                if (adh->owner == NULL)
                        delete = 1;
                adh->idletime = time(NULL);
        }
        (void) pthread_mutex_unlock(&adh->lock);

        /* Free this host if its owner no longer exists. */
        if (delete) {
                (void) pthread_mutex_lock(&adhostlock);
                delete_ds(NULL, adh->host, adh->port);
                (void) pthread_mutex_unlock(&adhostlock);
        }
}

/*
 * Create a adutils_host_t, populate it and add it to the list of hosts.
 */
adutils_rc
adutils_add_ds(adutils_ad_t *ad, const char *host, int port)
{
        adutils_host_t  *p;
        adutils_host_t  *new = NULL;
        int             ret;
        adutils_rc      rc;

        (void) pthread_mutex_lock(&adhostlock);
        for (p = host_head; p != NULL; p = p->next) {
                if (p->owner != ad)
                        continue;

                if (strcmp(host, p->host) == 0 && p->port == port) {
                        /* already added */
                        rc = ADUTILS_SUCCESS;
                        goto err;
                }
        }

        rc = ADUTILS_ERR_MEMORY;

        /* add new entry */
        new = (adutils_host_t *)calloc(1, sizeof (*new));
        if (new == NULL)
                goto err;
        new->owner = ad;
        new->port = port;
        new->dead = 0;
        new->max_requests = 80;
        new->num_requests = 0;
        if ((new->host = strdup(host)) == NULL)
                goto err;
        new->saslflags = LDAP_SASL_INTERACTIVE;
        new->saslmech = "GSSAPI";

        if ((ret = pthread_mutex_init(&new->lock, NULL)) != 0) {
                free(new->host);
                new->host = NULL;
                errno = ret;
                rc = ADUTILS_ERR_INTERNAL;
                goto err;
        }

        /* link in */
        rc = ADUTILS_SUCCESS;
        new->next = host_head;
        host_head = new;

err:
        (void) pthread_mutex_unlock(&adhostlock);

        if (rc != 0 && new != NULL) {
                if (new->host != NULL) {
                        (void) pthread_mutex_destroy(&new->lock);
                        free(new->host);
                }
                free(new);
        }

        return (rc);
}

/*
 * Free a DS configuration.
 * Caller must lock the adhostlock mutex
 */
static
void
delete_ds(adutils_ad_t *ad, const char *host, int port)
{
        adutils_host_t  **p, *q;

        for (p = &host_head; *p != NULL; p = &((*p)->next)) {
                if ((*p)->owner != ad || strcmp(host, (*p)->host) != 0 ||
                    (*p)->port != port)
                        continue;
                /* found */

                (void) pthread_mutex_lock(&((*p)->lock));
                if ((*p)->ref > 0) {
                        /*
                         * Still in use. Set its owner to NULL so
                         * that it can be freed when its ref count
                         * becomes 0.
                         */
                        (*p)->owner = NULL;
                        (void) pthread_mutex_unlock(&((*p)->lock));
                        break;
                }
                (void) pthread_mutex_unlock(&((*p)->lock));

                q = *p;
                *p = (*p)->next;

                (void) pthread_mutex_destroy(&q->lock);

                if (q->ld)
                        (void) ldap_unbind(q->ld);
                if (q->host)
                        free(q->host);
                free(q);
                break;
        }

}
/*
 * Add known domain name and domain SID to AD configuration.
 */

adutils_rc
adutils_add_domain(adutils_ad_t *ad, const char *domain, const char *sid)
{
        struct known_domain *new;
        int num = ad->num_known_domains;

        ad->num_known_domains++;
        new = realloc(ad->known_domains,
            sizeof (struct known_domain) * ad->num_known_domains);
        if (new != NULL) {
                ad->known_domains = new;
                (void) strlcpy(ad->known_domains[num].name, domain,
                    sizeof (ad->known_domains[num].name));
                (void) strlcpy(ad->known_domains[num].sid, sid,
                    sizeof (ad->known_domains[num].sid));
                return (ADUTILS_SUCCESS);
        } else {
                if (ad->known_domains != NULL) {
                        free(ad->known_domains);
                        ad->known_domains = NULL;
                }
                ad->num_known_domains = 0;
                return (ADUTILS_ERR_MEMORY);
        }
}


/*
 * Check that this AD supports this domain.
 * If there are no known domains assume that the
 * domain is supported by this AD.
 *
 * Returns 1 if this domain is supported by this AD
 * else returns 0;
 */

int
adutils_lookup_check_domain(adutils_query_state_t *qs, const char *domain)
{
        adutils_ad_t *ad = qs->qadh->owner;
        int i;

        for (i = 0; i < ad->num_known_domains; i++) {
                if (domain_eq(domain, ad->known_domains[i].name))
                        return (1);
        }

        return ((i == 0) ? 1 : 0);
}


/*
 * Check that this AD supports the SID prefix.
 * The SID prefix should match the domain SID.
 * If there are no known domains assume that the
 * SID prefix is supported by this AD.
 *
 * Returns 1 if this sid prefix is supported by this AD
 * else returns 0;
 */

int
adutils_lookup_check_sid_prefix(adutils_query_state_t *qs, const char *sid)
{
        adutils_ad_t *ad = qs->qadh->owner;
        int i;


        for (i = 0; i < ad->num_known_domains; i++) {
                if (strcmp(sid, ad->known_domains[i].sid) == 0)
                        return (1);
        }

        return ((i == 0) ? 1 : 0);
}


adutils_rc
adutils_lookup_batch_start(adutils_ad_t *ad, int nqueries,
    adutils_ldap_res_search_cb ldap_res_search_cb,
    void *ldap_res_search_argp,
    adutils_query_state_t **state)
{
        adutils_query_state_t   *new_state;
        adutils_host_t          *adh = NULL;

        if (ad == NULL)
                return (ADUTILS_ERR_INTERNAL);

        *state = NULL;
        adh = get_conn(ad);
        if (adh == NULL)
                return (ADUTILS_ERR_RETRIABLE_NET_ERR);

        new_state = calloc(1, sizeof (adutils_query_state_t) +
            (nqueries - 1) * sizeof (adutils_q_t));
        if (new_state == NULL)
                return (ADUTILS_ERR_MEMORY);

        new_state->ref_cnt = 1;
        new_state->qadh = adh;
        new_state->qsize = nqueries;
        new_state->qadh_gen = adh->generation;
        new_state->qcount = 0;
        new_state->ldap_res_search_cb = ldap_res_search_cb;
        new_state->ldap_res_search_argp = ldap_res_search_argp;
        (void) pthread_cond_init(&new_state->cv, NULL);

        (void) pthread_mutex_lock(&qstatelock);
        new_state->next = qstatehead;
        qstatehead = new_state;
        (void) pthread_mutex_unlock(&qstatelock);
        *state = new_state;

        return (ADUTILS_SUCCESS);
}

/*
 * Find the adutils_query_state_t to which a given LDAP result msgid on a
 * given connection belongs. This routine increaments the reference count
 * so that the object can not be freed. adutils_lookup_batch_unlock()
 * must be called to decreament the reference count.
 */
static
int
msgid2query(adutils_host_t *adh, int msgid,
    adutils_query_state_t **state, int *qid)
{
        adutils_query_state_t   *p;
        int                     i;
        int                     ret;

        (void) pthread_mutex_lock(&qstatelock);
        for (p = qstatehead; p != NULL; p = p->next) {
                if (p->qadh != adh || adh->generation != p->qadh_gen)
                        continue;
                for (i = 0; i < p->qcount; i++) {
                        if ((p->queries[i]).msgid == msgid) {
                                if (!p->qdead) {
                                        p->ref_cnt++;
                                        *state = p;
                                        *qid = i;
                                        ret = 1;
                                } else
                                        ret = 0;
                                (void) pthread_mutex_unlock(&qstatelock);
                                return (ret);
                        }
                }
        }
        (void) pthread_mutex_unlock(&qstatelock);
        return (0);
}

static
int
check_for_binary_attrs(const char *attr)
{
        int i;
        for (i = 0; binattrs[i].name != NULL; i++) {
                if (strcasecmp(binattrs[i].name, attr) == 0)
                        return (i);
        }
        return (-1);
}

static
void
free_entry(adutils_entry_t *entry)
{
        int             i, j;
        adutils_attr_t  *ap;

        if (entry == NULL)
                return;
        if (entry->attr_nvpairs == NULL) {
                free(entry);
                return;
        }
        for (i = 0; i < entry->num_nvpairs; i++) {
                ap = &entry->attr_nvpairs[i];
                if (ap->attr_name == NULL) {
                        ldap_value_free(ap->attr_values);
                        continue;
                }
                if (check_for_binary_attrs(ap->attr_name) >= 0) {
                        free(ap->attr_name);
                        if (ap->attr_values == NULL)
                                continue;
                        for (j = 0; j < ap->num_values; j++)
                                free(ap->attr_values[j]);
                        free(ap->attr_values);
                } else if (strcasecmp(ap->attr_name, "dn") == 0) {
                        free(ap->attr_name);
                        ldap_memfree(ap->attr_values[0]);
                        free(ap->attr_values);
                } else {
                        free(ap->attr_name);
                        ldap_value_free(ap->attr_values);
                }
        }
        free(entry->attr_nvpairs);
        free(entry);
}

void
adutils_freeresult(adutils_result_t **result)
{
        adutils_entry_t *e, *next;

        if (result == NULL || *result == NULL)
                return;
        if ((*result)->entries == NULL) {
                free(*result);
                *result = NULL;
                return;
        }
        for (e = (*result)->entries; e != NULL; e = next) {
                next = e->next;
                free_entry(e);
        }
        free(*result);
        *result = NULL;
}

const adutils_entry_t *
adutils_getfirstentry(adutils_result_t *result)
{
        if (result != NULL)
                return (result->entries);
        return (NULL);
}


char **
adutils_getattr(const adutils_entry_t *entry, const char *attrname)
{
        int             i;
        adutils_attr_t  *ap;

        if (entry == NULL || entry->attr_nvpairs == NULL)
                return (NULL);
        for (i = 0; i < entry->num_nvpairs; i++) {
                ap = &entry->attr_nvpairs[i];
                if (ap->attr_name != NULL &&
                    strcasecmp(ap->attr_name, attrname) == 0)
                        return (ap->attr_values);
        }
        return (NULL);
}


/*
 * Queue LDAP result for the given query.
 *
 * Return values:
 *  0 success
 * -1 ignore result
 * -2 error
 */
static
int
make_entry(adutils_q_t *q, adutils_host_t *adh, LDAPMessage *search_res,
    adutils_entry_t **entry)
{
        BerElement      *ber = NULL;
        BerValue        **bvalues = NULL;
        char            **strvalues;
        char            *attr = NULL, *dn = NULL, *domain = NULL;
        adutils_entry_t *ep;
        adutils_attr_t  *ap;
        int             i, j, b, ret = -2;

        *entry = NULL;

        /* Check that this is the domain that we were looking for */
        if ((dn = ldap_get_dn(adh->ld, search_res)) == NULL)
                return (-2);
        if ((domain = adutils_dn2dns(dn)) == NULL) {
                ldap_memfree(dn);
                return (-2);
        }
        if (q->edomain != NULL) {
                if (!domain_eq(q->edomain, domain)) {
                        ldap_memfree(dn);
                        free(domain);
                        return (-1);
                }
        }
        free(domain);

        /* Allocate memory for the entry */
        if ((ep = calloc(1, sizeof (*ep))) == NULL)
                goto out;

        /* For 'dn' */
        ep->num_nvpairs = 1;

        /* Count the number of name-value pairs for this entry */
        for (attr = ldap_first_attribute(adh->ld, search_res, &ber);
            attr != NULL;
            attr = ldap_next_attribute(adh->ld, search_res, ber)) {
                ep->num_nvpairs++;
                ldap_memfree(attr);
        }
        ber_free(ber, 0);
        ber = NULL;

        /* Allocate array for the attribute name-value pairs */
        ep->attr_nvpairs = calloc(ep->num_nvpairs, sizeof (*ep->attr_nvpairs));
        if (ep->attr_nvpairs == NULL) {
                ep->num_nvpairs = 0;
                goto out;
        }

        /* For dn */
        ap = &ep->attr_nvpairs[0];
        if ((ap->attr_name = strdup("dn")) == NULL)
                goto out;
        ap->num_values = 1;
        ap->attr_values = calloc(ap->num_values, sizeof (*ap->attr_values));
        if (ap->attr_values == NULL) {
                ap->num_values = 0;
                goto out;
        }
        ap->attr_values[0] = dn;
        dn = NULL;

        for (attr = ldap_first_attribute(adh->ld, search_res, &ber), i = 1;
            attr != NULL;
            ldap_memfree(attr), i++,
            attr = ldap_next_attribute(adh->ld, search_res, ber)) {
                ap = &ep->attr_nvpairs[i];
                if ((ap->attr_name = strdup(attr)) == NULL)
                        goto out;

                if ((b = check_for_binary_attrs(attr)) >= 0) {
                        bvalues =
                            ldap_get_values_len(adh->ld, search_res, attr);
                        if (bvalues == NULL)
                                continue;
                        ap->num_values = ldap_count_values_len(bvalues);
                        if (ap->num_values == 0) {
                                ldap_value_free_len(bvalues);
                                bvalues = NULL;
                                continue;
                        }
                        ap->attr_values = calloc(ap->num_values,
                            sizeof (*ap->attr_values));
                        if (ap->attr_values == NULL) {
                                ap->num_values = 0;
                                goto out;
                        }
                        for (j = 0; j < ap->num_values; j++) {
                                ap->attr_values[j] =
                                    binattrs[b].ber2str(bvalues[j]);
                                if (ap->attr_values[j] == NULL)
                                        goto out;
                        }
                        ldap_value_free_len(bvalues);
                        bvalues = NULL;
                        continue;
                }

                strvalues = ldap_get_values(adh->ld, search_res, attr);
                if (strvalues == NULL)
                        continue;
                ap->num_values = ldap_count_values(strvalues);
                if (ap->num_values == 0) {
                        ldap_value_free(strvalues);
                        continue;
                }
                ap->attr_values = strvalues;
        }

        ret = 0;
out:
        ldap_memfree(attr);
        ldap_memfree(dn);
        ber_free(ber, 0);
        ldap_value_free_len(bvalues);
        if (ret < 0)
                free_entry(ep);
        else
                *entry = ep;
        return (ret);
}

/*
 * Put the search result onto the given adutils_q_t.
 * Returns:       0 success
 *              < 0 error
 */
static
int
add_entry(adutils_host_t *adh, adutils_q_t *q, LDAPMessage *search_res)
{
        int                     ret = -1;
        adutils_entry_t         *entry = NULL;
        adutils_result_t        *res;

        ret = make_entry(q, adh, search_res, &entry);
        if (ret < -1) {
                *q->rc = ADUTILS_ERR_MEMORY;
                goto out;
        } else if (ret == -1) {
                /* ignore result */
                goto out;
        }
        if (*q->result == NULL) {
                res = calloc(1, sizeof (*res));
                if (res == NULL) {
                        *q->rc = ADUTILS_ERR_MEMORY;
                        goto out;
                }
                res->num_entries = 1;
                res->entries = entry;
                *q->result = res;
        } else {
                res = *q->result;
                entry->next = res->entries;
                res->entries = entry;
                res->num_entries++;
        }
        *q->rc = ADUTILS_SUCCESS;
        entry = NULL;
        ret = 0;

out:
        free_entry(entry);
        return (ret);
}

/*
 * Try to get a result; if there is one, find the corresponding
 * adutils_q_t and process the result.
 *
 * Returns:     0 success
 *              -1 error
 */
static
int
get_adobject_batch(adutils_host_t *adh, struct timeval *timeout)
{
        adutils_query_state_t   *query_state;
        LDAPMessage             *res = NULL;
        int                     rc, ret, msgid, qid;
        adutils_q_t             *que;
        int                     num;

        (void) pthread_mutex_lock(&adh->lock);
        if (adh->dead || adh->num_requests == 0) {
                ret = (adh->dead) ? -1 : -2;
                (void) pthread_mutex_unlock(&adh->lock);
                return (ret);
        }

        /* Get one result */
        rc = ldap_result(adh->ld, LDAP_RES_ANY, 0, timeout, &res);
        if ((timeout != NULL && timeout->tv_sec > 0 && rc == LDAP_SUCCESS) ||
            rc < 0)
                adh->dead = 1;

        if (rc == LDAP_RES_SEARCH_RESULT && adh->num_requests > 0)
                adh->num_requests--;
        if (adh->dead) {
                num = adh->num_requests;
                (void) pthread_mutex_unlock(&adh->lock);
                logger(LOG_DEBUG,
                    "AD ldap_result error - %d queued requests", num);
                return (-1);
        }

        switch (rc) {
        case LDAP_RES_SEARCH_RESULT:
                msgid = ldap_msgid(res);
                if (msgid2query(adh, msgid, &query_state, &qid)) {
                        if (query_state->ldap_res_search_cb != NULL) {
                                /*
                                 * We use the caller-provided callback
                                 * to process the result.
                                 */
                                query_state->ldap_res_search_cb(
                                    adh->ld, &res, rc, qid,
                                    query_state->ldap_res_search_argp);
                                (void) pthread_mutex_unlock(&adh->lock);
                        } else {
                                /*
                                 * No callback. We fallback to our
                                 * default behaviour. All the entries
                                 * gotten from this search have been
                                 * added to the result list during
                                 * LDAP_RES_SEARCH_ENTRY (see below).
                                 * Here we set the return status to
                                 * notfound if the result is still empty.
                                 */
                                (void) pthread_mutex_unlock(&adh->lock);
                                que = &(query_state->queries[qid]);
                                if (*que->result == NULL)
                                        *que->rc = ADUTILS_ERR_NOTFOUND;
                        }
                        atomic_dec_32(&query_state->qinflight);
                        adutils_lookup_batch_unlock(&query_state);
                } else {
                        num = adh->num_requests;
                        (void) pthread_mutex_unlock(&adh->lock);
                        logger(LOG_DEBUG,
                            "AD cannot find message ID (%d) "
                            "- %d queued requests",
                            msgid, num);
                }
                (void) ldap_msgfree(res);
                ret = 0;
                break;

        case LDAP_RES_SEARCH_ENTRY:
                msgid = ldap_msgid(res);
                if (msgid2query(adh, msgid, &query_state, &qid)) {
                        if (query_state->ldap_res_search_cb != NULL) {
                                /*
                                 * We use the caller-provided callback
                                 * to process the entry.
                                 */
                                query_state->ldap_res_search_cb(
                                    adh->ld, &res, rc, qid,
                                    query_state->ldap_res_search_argp);
                                (void) pthread_mutex_unlock(&adh->lock);
                        } else {
                                /*
                                 * No callback. We fallback to our
                                 * default behaviour. This entry
                                 * will be added to the result list.
                                 */
                                que = &(query_state->queries[qid]);
                                rc = add_entry(adh, que, res);
                                (void) pthread_mutex_unlock(&adh->lock);
                                if (rc < 0) {
                                        logger(LOG_DEBUG,
                                            "Failed to queue entry by "
                                            "message ID (%d) "
                                            "- %d queued requests",
                                            msgid, num);
                                }
                        }
                        adutils_lookup_batch_unlock(&query_state);
                } else {
                        num = adh->num_requests;
                        (void) pthread_mutex_unlock(&adh->lock);
                        logger(LOG_DEBUG,
                            "AD cannot find message ID (%d) "
                            "- %d queued requests",
                            msgid, num);
                }
                (void) ldap_msgfree(res);
                ret = 0;
                break;

        case LDAP_RES_SEARCH_REFERENCE:
                /*
                 * We have no need for these at the moment.  Eventually,
                 * when we query things that we can't expect to find in
                 * the Global Catalog then we'll need to learn to follow
                 * references.
                 */
                (void) pthread_mutex_unlock(&adh->lock);
                (void) ldap_msgfree(res);
                ret = 0;
                break;

        default:
                /* timeout or error; treat the same */
                (void) pthread_mutex_unlock(&adh->lock);
                ret = -1;
                break;
        }

        return (ret);
}

/*
 * This routine decreament the reference count of the
 * adutils_query_state_t
 */
static void
adutils_lookup_batch_unlock(adutils_query_state_t **state)
{
        /*
         * Decrement reference count with qstatelock locked
         */
        (void) pthread_mutex_lock(&qstatelock);
        (*state)->ref_cnt--;
        /*
         * If there are no references wakup the allocating thread
         */
        if ((*state)->ref_cnt <= 1)
                (void) pthread_cond_signal(&(*state)->cv);
        (void) pthread_mutex_unlock(&qstatelock);
        *state = NULL;
}

/*
 * This routine frees the adutils_query_state_t structure
 * If the reference count is greater than 1 it waits
 * for the other threads to finish using it.
 */
void
adutils_lookup_batch_release(adutils_query_state_t **state)
{
        adutils_query_state_t **p;
        int                     i;

        if (state == NULL || *state == NULL)
                return;

        /*
         * Set state to dead to stop further operations.
         * Wait for reference count with qstatelock locked
         * to get to one.
         */
        (void) pthread_mutex_lock(&qstatelock);
        (*state)->qdead = 1;
        while ((*state)->ref_cnt > 1) {
                (void) pthread_cond_wait(&(*state)->cv, &qstatelock);
        }

        /* Remove this state struct from the list of state structs */
        for (p = &qstatehead; *p != NULL; p = &(*p)->next) {
                if (*p == (*state)) {
                        *p = (*state)->next;
                        break;
                }
        }
        (void) pthread_mutex_unlock(&qstatelock);
        (void) pthread_cond_destroy(&(*state)->cv);
        release_conn((*state)->qadh);

        /* Clear results for queries that failed */
        for (i = 0; i < (*state)->qcount; i++) {
                if (*(*state)->queries[i].rc != ADUTILS_SUCCESS) {
                        adutils_freeresult((*state)->queries[i].result);
                }
        }
        free(*state);
        *state = NULL;
}


/*
 * This routine waits for other threads using the
 * adutils_query_state_t structure to finish.
 * If the reference count is greater than 1 it waits
 * for the other threads to finish using it.
 */
static
void
adutils_lookup_batch_wait(adutils_query_state_t *state)
{
        /*
         * Set state to dead to stop further operation.
         * stating.
         * Wait for reference count to get to one
         * with qstatelock locked.
         */
        (void) pthread_mutex_lock(&qstatelock);
        state->qdead = 1;
        while (state->ref_cnt > 1) {
                (void) pthread_cond_wait(&state->cv, &qstatelock);
        }
        (void) pthread_mutex_unlock(&qstatelock);
}

/*
 * Process active queries in the AD lookup batch and then finalize the
 * result.
 */
adutils_rc
adutils_lookup_batch_end(adutils_query_state_t **state)
{
        int                 rc = LDAP_SUCCESS;
        adutils_rc          ad_rc = ADUTILS_SUCCESS;
        struct timeval      tv;

        tv.tv_sec = ADUTILS_SEARCH_TIMEOUT;
        tv.tv_usec = 0;

        /* Process results until done or until timeout, if given */
        while ((*state)->qinflight > 0) {
                if ((rc = get_adobject_batch((*state)->qadh,
                    &tv)) != 0)
                        break;
        }
        (*state)->qdead = 1;
        /* Wait for other threads processing search result to finish */
        adutils_lookup_batch_wait(*state);
        if (rc == -1 || (*state)->qinflight != 0)
                ad_rc = ADUTILS_ERR_RETRIABLE_NET_ERR;
        adutils_lookup_batch_release(state);
        return (ad_rc);
}

/*
 * Send one prepared search, queue up msgid, process what results are
 * available
 */
adutils_rc
adutils_lookup_batch_add(adutils_query_state_t *state,
    const char *filter, const char * const *attrs, const char *edomain,
    adutils_result_t **result, adutils_rc *rc)
{
        adutils_rc      retcode = ADUTILS_SUCCESS;
        int             lrc, qid;
        int             num;
        int             dead;
        struct timeval  tv;
        adutils_q_t     *q;

        qid = atomic_inc_32_nv(&state->qcount) - 1;
        q = &(state->queries[qid]);

        assert(qid < state->qsize);

        /*
         * Remember the expected domain so we can check the results
         * against it
         */
        q->edomain = edomain;

        /* Remember where to put the results */
        q->result = result;
        q->rc = rc;

        /*
         * Provide sane defaults for the results in case we never hear
         * back from the DS before closing the connection.
         */
        *rc = ADUTILS_ERR_RETRIABLE_NET_ERR;
        if (result != NULL)
                *result = NULL;

        /* Check the number of queued requests first */
        tv.tv_sec = ADUTILS_SEARCH_TIMEOUT;
        tv.tv_usec = 0;
        while (!state->qadh->dead &&
            state->qadh->num_requests > state->qadh->max_requests) {
                if (get_adobject_batch(state->qadh, &tv) != 0)
                        break;
        }

        /* Send this lookup, don't wait for a result here */
        lrc = LDAP_SUCCESS;
        (void) pthread_mutex_lock(&state->qadh->lock);

        if (!state->qadh->dead) {
                state->qadh->idletime = time(NULL);

                lrc = ldap_search_ext(state->qadh->ld,
                    state->qadh->owner->basedn,
                    LDAP_SCOPE_SUBTREE, filter, (char **)attrs,
                    0, NULL, NULL, NULL, -1, &q->msgid);

                if (lrc == LDAP_SUCCESS) {
                        state->qadh->num_requests++;
                } else if (lrc == LDAP_BUSY || lrc == LDAP_UNAVAILABLE ||
                    lrc == LDAP_CONNECT_ERROR || lrc == LDAP_SERVER_DOWN ||
                    lrc == LDAP_UNWILLING_TO_PERFORM) {
                        retcode = ADUTILS_ERR_RETRIABLE_NET_ERR;
                        state->qadh->dead = 1;
                } else {
                        retcode = ADUTILS_ERR_OTHER;
                        state->qadh->dead = 1;
                }
        }
        dead = state->qadh->dead;
        num = state->qadh->num_requests;
        (void) pthread_mutex_unlock(&state->qadh->lock);

        if (dead) {
                if (lrc != LDAP_SUCCESS)
                        logger(LOG_DEBUG,
                            "AD ldap_search_ext error (%s) "
                            "- %d queued requests",
                            ldap_err2string(lrc), num);
                return (retcode);
        }

        atomic_inc_32(&state->qinflight);

        /*
         * Reap as many requests as we can _without_ waiting to prevent
         * any possible TCP socket buffer starvation deadlocks.
         */
        (void) memset(&tv, 0, sizeof (tv));
        while (get_adobject_batch(state->qadh, &tv) == 0)
                ;

        return (ADUTILS_SUCCESS);
}

/*
 * Single AD lookup request implemented on top of the batch API.
 */
adutils_rc
adutils_lookup(adutils_ad_t *ad, const char *filter, const char **attrs,
    const char *domain, adutils_result_t **result)
{
        adutils_rc              rc, brc;
        adutils_query_state_t   *qs;

        rc = adutils_lookup_batch_start(ad, 1, NULL, NULL, &qs);
        if (rc != ADUTILS_SUCCESS)
                return (rc);

        rc = adutils_lookup_batch_add(qs, filter, attrs, domain, result, &brc);
        if (rc != ADUTILS_SUCCESS) {
                adutils_lookup_batch_release(&qs);
                return (rc);
        }

        rc = adutils_lookup_batch_end(&qs);
        if (rc != ADUTILS_SUCCESS)
                return (rc);
        return (brc);
}

boolean_t
domain_eq(const char *a, const char *b)
{
        int err;

        return (u8_strcmp(a, b, 0, U8_STRCMP_CI_LOWER, U8_UNICODE_LATEST, &err)
            == 0 && err == 0);
}

void
adutils_set_debug(enum ad_debug item, int value)
{
        if (item >= 0 && item <= AD_DEBUG_MAX)
                ad_debug[item] = value;
}