/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 * Copyright 2023-2024 RackTop Systems, Inc.
 */

#include <syslog.h>
#include <synch.h>
#include <pthread.h>
#include <unistd.h>
#include <string.h>
#include <strings.h>
#include <errno.h>
#include <netinet/in.h>
#include <netinet/tcp.h>

#include <smbsrv/libsmb.h>
#include <smbsrv/libsmbns.h>
#include <smbsrv/libmlsvc.h>
#include <smbsrv/smbinfo.h>
#include "smbd.h"

#define	SMBD_DC_MONITOR_ATTEMPTS		3
#define	SMBD_DC_MONITOR_RETRY_INTERVAL		3	/* seconds */
#define	SMBD_DC_MONITOR_INTERVAL		60	/* seconds */

extern smbd_t smbd;

static mutex_t smbd_dc_mutex;
static cond_t smbd_dc_cv;

static void *smbd_dc_monitor(void *);
static void smbd_dc_update(void);
static int smbd_dc_check(smb_domainex_t *);
/* Todo: static boolean_t smbd_set_netlogon_cred(void); */
static void smbd_join_workgroup(smb_joininfo_t *, smb_joinres_t *);
static void smbd_join_domain(smb_joininfo_t *, smb_joinres_t *);

/*
 * Launch the DC discovery and monitor thread.
 */
int
smbd_dc_monitor_init(void)
{
	pthread_attr_t	attr;
	int		rc;

	smb_ads_init();

	if (smbd.s_secmode != SMB_SECMODE_DOMAIN)
		return (0);

	(void) pthread_attr_init(&attr);
	(void) pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
	rc = pthread_create(&smbd.s_dc_monitor_tid, &attr, smbd_dc_monitor,
	    NULL);
	(void) pthread_attr_destroy(&attr);
	return (rc);
}

/*
 * Refresh the DC monitor.  Called from SMF refresh and when idmap
 * finds a different DC from what we were using previously.
 * Update our domain (and current DC) information.
 */
void
smbd_dc_monitor_refresh(void)
{

	syslog(LOG_INFO, "smbd_dc_monitor_refresh");

	smb_ddiscover_refresh();

	(void) mutex_lock(&smbd_dc_mutex);

	smbd.s_dc_changed = B_TRUE;
	(void) cond_signal(&smbd_dc_cv);

	(void) mutex_unlock(&smbd_dc_mutex);
}

/*ARGSUSED*/
static void *
smbd_dc_monitor(void *arg)
{
	smb_domainex_t	di;
	boolean_t	ds_not_responding;
	boolean_t	ds_cfg_changed;
	timestruc_t	delay;
	int		i;

	/* Wait for smb_dclocator_init() to complete. */
	smbd_online_wait("smbd_dc_monitor");
	smbd_dc_update();

	while (smbd_online()) {
		ds_not_responding = B_FALSE;
		ds_cfg_changed = B_FALSE;
		delay.tv_sec = SMBD_DC_MONITOR_INTERVAL;
		delay.tv_nsec = 0;

		(void) mutex_lock(&smbd_dc_mutex);
		(void) cond_reltimedwait(&smbd_dc_cv, &smbd_dc_mutex, &delay);

		if (smbd.s_dc_changed) {
			smbd.s_dc_changed = B_FALSE;
			ds_cfg_changed = B_TRUE;
			/* NB: smb_ddiscover_refresh was called. */
		}

		(void) mutex_unlock(&smbd_dc_mutex);

		if (ds_cfg_changed) {
			syslog(LOG_DEBUG, "smbd_dc_monitor: config changed");
			goto rediscover;
		}

		if (!smb_domain_getinfo(&di)) {
			syslog(LOG_DEBUG, "smbd_dc_monitor: no domain info");
			goto rediscover;
		}

		if (di.d_dci.dc_name[0] == '\0') {
			syslog(LOG_DEBUG, "smbd_dc_monitor: no DC name");
			goto rediscover;
		}

		for (i = 0; i < SMBD_DC_MONITOR_ATTEMPTS; ++i) {
			if (smbd_dc_check(&di) == 0) {
				ds_not_responding = B_FALSE;
				break;
			}

			ds_not_responding = B_TRUE;
			(void) sleep(SMBD_DC_MONITOR_RETRY_INTERVAL);
		}

		if (ds_not_responding) {
			syslog(LOG_NOTICE,
			    "smbd_dc_monitor: DC not responding: %s",
			    di.d_dci.dc_name);
			smb_ddiscover_bad_dc(di.d_dci.dc_name);
		}

		if (ds_not_responding || ds_cfg_changed) {
		rediscover:
			/*
			 * An smb_ads_refresh will be done by the
			 * smb_ddiscover_service when necessary.
			 * Note: smbd_dc_monitor_refresh was already
			 * called if appropriate.
			 */
			smbd_dc_update();
		}
	}

	smbd.s_dc_monitor_tid = 0;
	return (NULL);
}

/*
 * Simply attempt a connection to the DC.
 */
static int
smbd_dc_check(smb_domainex_t *di)
{
	struct sockaddr_storage sa;
	int salen = 0;
	int sock = -1;
	int tmo = 5 * 1000;	/* 5 sec. */
	int rc;

	bzero(&sa, sizeof (sa));
	switch (di->d_dci.dc_addr.a_family) {
	case AF_INET: {
		struct sockaddr_in *sin = (void *)&sa;
		sin->sin_family = AF_INET;
		sin->sin_port = htons(IPPORT_SMB);
		sin->sin_addr.s_addr = di->d_dci.dc_addr.a_ipv4;
		salen = sizeof (*sin);
		break;
	}
	case AF_INET6: {
		struct sockaddr_in6 *sin6 = (void *)&sa;
		sin6->sin6_family = AF_INET6;
		sin6->sin6_port = htons(IPPORT_SMB);
		(void) memcpy(&sin6->sin6_addr,
		    &di->d_dci.dc_addr.a_ipv6,
		    sizeof (in6_addr_t));
		salen = sizeof (*sin6);
		break;
	}
	default:
		return (-1);
	}

	sock = socket(di->d_dci.dc_addr.a_family, SOCK_STREAM, 0);
	if (sock < 0)
		return (errno);
	(void) setsockopt(sock, IPPROTO_TCP,
	    TCP_CONN_ABORT_THRESHOLD, &tmo, sizeof (tmo));

	rc = connect(sock, (const struct sockaddr *)&sa, salen);
	if (rc < 0)
		rc = errno;

	(void) close(sock);
	return (rc);
}

/*
 * Locate a domain controller in the current resource domain and Update
 * the Netlogon credential chain.
 *
 * The domain configuration will be updated upon successful DC discovery.
 */
static void
smbd_dc_update(void)
{
	char		domain[MAXHOSTNAMELEN];
	smb_domainex_t	info;
	smb_domain_t	*di;
	DWORD		status;

	/*
	 * Don't want this active until we're a domain member.
	 */
	if (smb_config_get_secmode() != SMB_SECMODE_DOMAIN)
		return;

	if (smb_getfqdomainname(domain, MAXHOSTNAMELEN) != 0)
		return;

	if (domain[0] == '\0') {
		syslog(LOG_NOTICE,
		    "smbd_dc_update: no domain name set");
		return;
	}

	if (!smb_locate_dc(domain, &info)) {
		syslog(LOG_NOTICE,
		    "smbd_dc_update: %s: locate failed", domain);
		return;
	}

	di = &info.d_primary;
	syslog(LOG_INFO,
	    "smbd_dc_update: %s: located %s", domain, info.d_dci.dc_name);

	status = mlsvc_netlogon(info.d_dci.dc_name, di->di_nbname);
	if (status != NT_STATUS_SUCCESS) {
		syslog(LOG_NOTICE,
		    "failed to establish NETLOGON credential chain");
		syslog(LOG_NOTICE, " with server %s for domain %s (%s)",
		    info.d_dci.dc_name, domain,
		    xlate_nt_status(status));
	}
}

/*
 * smbd_join
 *
 * Joins the specified domain/workgroup.
 *
 * If the security mode or domain name is being changed,
 * the caller must restart the service.
 */
void
smbd_join(smb_joininfo_t *info, smb_joinres_t *res)
{
	dssetup_clear_domain_info();
	if (info->mode == SMB_SECMODE_WORKGRP)
		smbd_join_workgroup(info, res);
	else
		smbd_join_domain(info, res);
}

static void
smbd_join_workgroup(smb_joininfo_t *info, smb_joinres_t *res)
{
	char nb_domain[SMB_PI_MAX_DOMAIN];

	syslog(LOG_DEBUG, "smbd: join workgroup: %s", info->domain_name);

	(void) smb_config_getstr(SMB_CI_DOMAIN_NAME, nb_domain,
	    sizeof (nb_domain));

	(void) smb_config_setbool(SMB_CI_DOMAIN_MEMB, B_FALSE);
	smbd_set_secmode(SMB_SECMODE_WORKGRP);
	smb_config_setdomaininfo(info->domain_name, "", "", "", "");
	(void) smb_config_set_idmap_domain("");
	(void) smb_config_refresh_idmap();

	if (strcasecmp(nb_domain, info->domain_name))
		smb_browser_reconfig();

	res->status = NT_STATUS_SUCCESS;
}

static void
smbd_join_domain(smb_joininfo_t *info, smb_joinres_t *res)
{

	syslog(LOG_DEBUG, "smbd: join domain: %s", info->domain_name);

	/* info->domain_name could either be NetBIOS domain name or FQDN */
	mlsvc_join(info, res);
	if (res->status == 0) {
		smbd_set_secmode(SMB_SECMODE_DOMAIN);
	} else {
		syslog(LOG_ERR, "smbd: failed joining %s (%s)",
		    info->domain_name, xlate_nt_status(res->status));
	}
}