/*

 * adcli

 *

 * Copyright (C) 2012 Red Hat Inc.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

 * MA 02110-1301 USA

 *

 * Author: Stef Walter <stefw@gnome.org>

 */

#include "config.h"

#include "adenroll.h"

#include "adprivate.h"

#include "seq.h"

#include <gssapi/gssapi_krb5.h>

#include <krb5/krb5.h>

#include <ldap.h>

#include <sasl/sasl.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <assert.h>

#include <ctype.h>

#include <errno.h>

#include <netdb.h>

#include <stdio.h>

#include <unistd.h>

#ifndef SAMBA_DATA_TOOL

#define SAMBA_DATA_TOOL "/usr/bin/net"

#endif

static krb5_enctype v60_later_enctypes[] = {

	ENCTYPE_AES256_CTS_HMAC_SHA1_96,

	ENCTYPE_AES128_CTS_HMAC_SHA1_96,

	ENCTYPE_DES3_CBC_SHA1,

	ENCTYPE_ARCFOUR_HMAC,

	ENCTYPE_DES_CBC_MD5,

	ENCTYPE_DES_CBC_CRC,

	0

};

static krb5_enctype v51_earlier_enctypes[] = {

	ENCTYPE_DES_CBC_CRC,

	ENCTYPE_DES_CBC_MD5,

	ENCTYPE_ARCFOUR_HMAC,

	0

};

/* Some constants for the userAccountControl AD LDAP attribute, see e.g.

 * https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro

 * for details. */

#define UAC_WORKSTATION_TRUST_ACCOUNT  0x1000

#define UAC_DONT_EXPIRE_PASSWORD      0x10000

#define UAC_TRUSTED_FOR_DELEGATION    0x80000

struct _adcli_enroll {

	int refs;

	adcli_conn *conn;

	char *host_fqdn;

	int host_fqdn_explicit;

	char *computer_name;

	int computer_name_explicit;

	char *computer_sam;

	char *computer_password;

	int computer_password_explicit;

	int reset_password;

	krb5_principal computer_principal;

	char *domain_ou;

	int domain_ou_validated;

	int domain_ou_explicit;

	char *computer_dn;

	char *computer_container;

	LDAPMessage *computer_attributes;

	char **service_names;

	char **service_principals;

	int service_principals_explicit;

	char *user_principal;

	int user_princpal_generate;

	char *os_name;

	int os_name_explicit;

	char *os_version;

	int os_version_explicit;

	char *os_service_pack;

	int os_service_pack_explicit;

	krb5_kvno kvno;

	char *keytab_name;

	int keytab_name_is_krb5;

	krb5_keytab keytab;

	krb5_principal *keytab_principals;

	krb5_enctype *keytab_enctypes;

	int keytab_enctypes_explicit;

	unsigned int computer_password_lifetime;

	int computer_password_lifetime_explicit;

	char *samba_data_tool;

	bool trusted_for_delegation;

	int trusted_for_delegation_explicit;

};

static adcli_result

ensure_host_fqdn (adcli_result res,

                  adcli_enroll *enroll)

{

	const char *fqdn;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->host_fqdn) {

		_adcli_info ("Using fully qualified name: %s",

		             enroll->host_fqdn);

		return ADCLI_SUCCESS;

	}

	if (enroll->host_fqdn_explicit) {

		_adcli_info ("Not setting fully qualified name");

		return ADCLI_SUCCESS;

	}

	/* By default use our actual host name discovered during connecting */

	fqdn = adcli_conn_get_host_fqdn (enroll->conn);

	_adcli_str_set (&enroll->host_fqdn, fqdn);

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_computer_name (adcli_result res,

                      adcli_enroll *enroll)

{

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->computer_name) {

		_adcli_info ("Enrolling computer name: %s",

		             enroll->computer_name);

		return ADCLI_SUCCESS;

	}

	if (!enroll->host_fqdn) {

		_adcli_err ("No host name from which to determine the computer name");

		return ADCLI_ERR_CONFIG;

	}

	enroll->computer_name = _adcli_calc_netbios_name (enroll->host_fqdn);

	if (enroll->computer_name == NULL)

		return ADCLI_ERR_CONFIG;

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_computer_sam (adcli_result res,

                     adcli_enroll *enroll)

{

	krb5_error_code code;

	krb5_context k5;

	if (res != ADCLI_SUCCESS)

		return res;

	free (enroll->computer_sam);

	enroll->computer_sam = NULL;

	if (asprintf (&enroll->computer_sam, "%s$", enroll->computer_name) < 0)

		return_unexpected_if_fail (enroll->computer_sam != NULL);

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	if (enroll->computer_principal)

		krb5_free_principal (k5, enroll->computer_principal);

	enroll->computer_principal = NULL;

	code = _adcli_krb5_build_principal (k5, enroll->computer_sam,

	                                    adcli_conn_get_domain_realm (enroll->conn),

	                                    &enroll->computer_principal);

	return_unexpected_if_fail (code == 0);

	return ADCLI_SUCCESS;

}

static int

filter_password_chars (char *password,

                       int length)

{

	int i, j;

	/*

	 * The MS documentation says their servers only use ASCII characters

	 * between 32 and 122 inclusive. We do that as well, and filter out

	 * all other random characters. We also remove certain characters

	 * special for use in a shell.

	 */

	for (i = 0, j = 0; i < length; i++) {

		if (password[i] >= 32 && password[i] <= 122 &&

		    strchr (" !'\"$`", password[i]) == NULL)

			password[j++] = password[i];

	}

	/* return the number of valid characters remaining */

	return j;

}

static char *

generate_host_password  (adcli_enroll *enroll,

                         size_t length)

{

	char *password;

	krb5_context k5;

	krb5_error_code code;

	krb5_data buffer;

	int at;

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_val_if_fail (k5 != NULL, NULL);

	password = malloc (length + 1);

	return_val_if_fail (password != NULL, NULL);

	at = 0;

	while (at != length) {

		buffer.length = length - at;

		buffer.data = password + at;

		code = krb5_c_random_make_octets (k5, &buffer);

		return_val_if_fail (code == 0, NULL);

		at += filter_password_chars (buffer.data, buffer.length);

		assert (at <= length);

	}

	/* This null termination works around a bug in krb5 */

	password[length] = '\0';

	return password;

}

static adcli_result

ensure_computer_password (adcli_result res,

                      adcli_enroll *enroll)

{

	const int length = 120;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->computer_password)

		return ADCLI_SUCCESS;

	if (enroll->reset_password) {

		assert (enroll->computer_name != NULL);

		enroll->computer_password = _adcli_calc_reset_password (enroll->computer_name);

		return_unexpected_if_fail (enroll->computer_password != NULL);

		_adcli_info ("Using default reset computer password");

	} else {

		enroll->computer_password = generate_host_password (enroll, length);

		return_unexpected_if_fail (enroll->computer_password != NULL);

		_adcli_info ("Generated %d character computer password", length);

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_service_names (adcli_result res,

                      adcli_enroll *enroll)

{

	int length = 0;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->service_names || enroll->service_principals)

		return ADCLI_SUCCESS;

	/* The default ones specified by MS */

	enroll->service_names = _adcli_strv_add (enroll->service_names,

	                                         strdup ("host"), &length);

	enroll->service_names = _adcli_strv_add (enroll->service_names,

	                                         strdup ("RestrictedKrbHost"), &length);

	return ADCLI_SUCCESS;

}

static adcli_result

add_service_names_to_service_principals (adcli_enroll *enroll)

{

	char *name;

	int length = 0;

	int i;

	if (enroll->service_principals != NULL) {

		length = seq_count (enroll->service_principals);

	}

	for (i = 0; enroll->service_names[i] != NULL; i++) {

		if (asprintf (&name, "%s/%s", enroll->service_names[i], enroll->computer_name) < 0)

			return_unexpected_if_reached ();

		enroll->service_principals = _adcli_strv_add (enroll->service_principals,

			                                      name, &length);

		if (enroll->host_fqdn) {

			if (asprintf (&name, "%s/%s", enroll->service_names[i], enroll->host_fqdn) < 0)

				return_unexpected_if_reached ();

			enroll->service_principals = _adcli_strv_add (enroll->service_principals,

				                                      name, &length);

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_service_principals (adcli_result res,

                           adcli_enroll *enroll)

{

	if (res != ADCLI_SUCCESS)

		return res;

	assert (enroll->keytab_principals == NULL);

	if (!enroll->service_principals) {

		assert (enroll->service_names != NULL);

		return add_service_names_to_service_principals (enroll);

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_keytab_principals (adcli_result res,

                          adcli_enroll *enroll)

{

	krb5_context k5;

	krb5_error_code code;

	int count;

	int at, i;

	/* Prepare the principals we're going to add to the keytab */

	return_unexpected_if_fail (enroll->service_principals);

	count = _adcli_strv_len (enroll->service_principals);

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	enroll->keytab_principals = calloc (count + 3, sizeof (krb5_principal));

	return_unexpected_if_fail (enroll->keytab_principals != NULL);

	at = 0;

	/* First add the principal for the computer account name */

	code = krb5_copy_principal (k5, enroll->computer_principal,

	                            &enroll->keytab_principals[at++]);

	return_unexpected_if_fail (code == 0);

	/* Next, optionally add the user principal */

	if (enroll->user_principal) {

		code = krb5_parse_name (k5, enroll->user_principal,

		                        &enroll->keytab_principals[at++]);

		if (code != 0) {

			if (code != 0) {

				_adcli_err ("Couldn't parse kerberos user principal: %s: %s",

				            enroll->user_principal,

				            krb5_get_error_message (k5, code));

				return ADCLI_ERR_CONFIG;

			}

		}

	}

	/* Now add the principals for all the various services */

	for (i = 0; i < count; i++) {

		code = _adcli_krb5_build_principal (k5, enroll->service_principals[i],

		                                    adcli_conn_get_domain_realm (enroll->conn),

		                                    &enroll->keytab_principals[at++]);

		if (code != 0) {

			_adcli_err ("Couldn't parse kerberos service principal: %s: %s",

			            enroll->service_principals[i],

			            krb5_get_error_message (k5, code));

			return ADCLI_ERR_CONFIG;

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_user_principal (adcli_result res,

                       adcli_enroll *enroll)

{

	char *name;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->user_princpal_generate) {

		name = strdup (enroll->computer_name);

		return_unexpected_if_fail (name != NULL);

		_adcli_str_down (name);

		assert (enroll->user_principal == NULL);

		if (asprintf (&enroll->user_principal, "host/%s@%s",

		              name, adcli_conn_get_domain_realm (enroll->conn)) < 0)

			return_unexpected_if_reached ();

		free (name);

	}

	if (enroll->user_principal)

		_adcli_info ("With user principal: %s", enroll->user_principal);

	return ADCLI_SUCCESS;

}

static adcli_result

lookup_computer_container (adcli_enroll *enroll,

                           LDAP *ldap)

{

	char *attrs[] = { "wellKnownObjects", NULL };

	char *prefix = "B:32:AA312825768811D1ADED00C04FD8D5CD:";

	int prefix_len;

	LDAPMessage *results;

	const char *base;

	char **values;

	int ret;

	int i;

	if (enroll->computer_container)

		return ADCLI_SUCCESS;

	base = enroll->domain_ou;

	if (base == NULL)

		base = adcli_conn_get_default_naming_context (enroll->conn);

	assert (base != NULL);

	ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,

	                         "(objectClass=*)", attrs, 0, NULL, NULL,

	                         NULL, -1, &results);

	if (ret == LDAP_NO_SUCH_OBJECT && enroll->domain_ou) {

		_adcli_err ("The organizational unit does not exist: %s", enroll->domain_ou);

		return enroll->domain_ou_explicit ? ADCLI_ERR_CONFIG : ADCLI_ERR_DIRECTORY;

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't lookup computer container: %s", base);

	}

	values = _adcli_ldap_parse_values (ldap, results, "wellKnownObjects");

	ldap_msgfree (results);

	prefix_len = strlen (prefix);

	for (i = 0; values && values[i]; i++) {

		if (strncmp (values[i], prefix, prefix_len) == 0) {

			enroll->computer_container = strdup (values[i] + prefix_len);

			return_unexpected_if_fail (enroll->computer_container != NULL);

			_adcli_info ("Found well known computer container at: %s",

			             enroll->computer_container);

			break;

		}

	}

	_adcli_strv_free (values);

	/* Try harder */

	if (!enroll->computer_container) {

		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,

		                         "(&(objectClass=container)(cn=Computers))",

		                         attrs, 0, NULL, NULL, NULL, -1, &results);

		if (ret == LDAP_SUCCESS) {

			enroll->computer_container = _adcli_ldap_parse_dn (ldap, results);

			if (enroll->computer_container) {

				_adcli_info ("Well known computer container not "

				             "found, but found suitable one at: %s",

				             enroll->computer_container);

			}

		}

		ldap_msgfree (results);

	}

	if (!enroll->computer_container && enroll->domain_ou) {

		_adcli_warn ("Couldn't find a computer container in the ou, "

		             "creating computer account directly in: %s", enroll->domain_ou);

		enroll->computer_container = strdup (enroll->domain_ou);

		return_unexpected_if_fail (enroll->computer_container != NULL);

	}

	if (!enroll->computer_container) {

		_adcli_err ("Couldn't find location to create computer accounts");

		return ADCLI_ERR_DIRECTORY;

	}

	return ADCLI_SUCCESS;

}

static adcli_result

calculate_computer_account (adcli_enroll *enroll,

                            LDAP *ldap)

{

	adcli_result res;

	assert (enroll->computer_dn == NULL);

	/* Now need to find or validate the computer container */

	res = lookup_computer_container (enroll, ldap);

	if (res != ADCLI_SUCCESS)

		return res;

	assert (enroll->computer_container);

	free (enroll->computer_dn);

	enroll->computer_dn = NULL;

	if (asprintf (&enroll->computer_dn, "CN=%s,%s", enroll->computer_name, enroll->computer_container) < 0)

		return_unexpected_if_reached ();

	_adcli_info ("Calculated computer account: %s", enroll->computer_dn);

	return ADCLI_SUCCESS;

}

static adcli_result

calculate_enctypes (adcli_enroll *enroll, char **enctype)

{

	char *value = NULL;

	krb5_enctype *read_enctypes;

	char *new_value = NULL;

	int is_2008_or_later;

	LDAP *ldap;

	*enctype = NULL;

	/*

	 * Because we're using a keytab we want the server to be aware of the

	 * encryption types supported on the client, because we can't dynamically

	 * use a new one that's thrown at us.

	 *

	 * If the encryption types are not explicitly set by the caller of this

	 * library, then see if the account already has some encryption types

	 * marked on it.

	 *

	 * If not, write our default set to the account.

	 *

	 * Note that Windows 2003 and earlier have a standard set of encryption

	 * types, and no msDS-supportedEncryptionTypes attribute.

	 */

	ldap = adcli_conn_get_ldap_connection (enroll->conn);

	return_unexpected_if_fail (ldap != NULL);

	is_2008_or_later = adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID);

	/* In 2008 or later, use the msDS-supportedEncryptionTypes attribute */

	if (is_2008_or_later && enroll->computer_attributes != NULL) {

		value = _adcli_ldap_parse_value (ldap, enroll->computer_attributes,

		                                 "msDS-supportedEncryptionTypes");

		if (!enroll->keytab_enctypes_explicit && value != NULL) {

			read_enctypes = _adcli_krb5_parse_enctypes (value);

			if (read_enctypes == NULL) {

				_adcli_warn ("Invalid or unsupported encryption types are set on "

				             "the computer account (%s).", value);

			} else {

				free (enroll->keytab_enctypes);

				enroll->keytab_enctypes = read_enctypes;

			}

		}

	/* In 2003 or earlier, standard set of enc types */

	} else {

		value = _adcli_krb5_format_enctypes (v51_earlier_enctypes);

	}

	new_value = _adcli_krb5_format_enctypes (adcli_enroll_get_keytab_enctypes (enroll));

	if (new_value == NULL) {

		free (value);

		_adcli_warn ("The encryption types desired are not available in active directory");

		return ADCLI_ERR_CONFIG;

	}

	/* If we already have this value, then don't need to update */

	if (value && strcmp (new_value, value) == 0) {

		free (value);

		free (new_value);

		return ADCLI_SUCCESS;

	}

	free (value);

	if (!is_2008_or_later) {

		free (new_value);

		_adcli_warn ("Server does not support setting encryption types");

		return ADCLI_SUCCESS;

	}

	*enctype = new_value;

	return ADCLI_SUCCESS;

}

static adcli_result

create_computer_account (adcli_enroll *enroll,

                         LDAP *ldap)

{

	char *vals_objectClass[] = { "computer", NULL };

	LDAPMod objectClass = { LDAP_MOD_ADD, "objectClass", { vals_objectClass, } };

	char *vals_sAMAccountName[] = { enroll->computer_sam, NULL };

	LDAPMod sAMAccountName = { LDAP_MOD_ADD, "sAMAccountName", { vals_sAMAccountName, } };

	char *vals_userAccountControl[] = { "69632", NULL }; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD */

	LDAPMod userAccountControl = { LDAP_MOD_ADD, "userAccountControl", { vals_userAccountControl, } };

	char *vals_supportedEncryptionTypes[] = { NULL, NULL };

	LDAPMod encTypes = { LDAP_MOD_ADD, "msDS-supportedEncryptionTypes", { vals_supportedEncryptionTypes, } };

	char *vals_dNSHostName[] = { enroll->host_fqdn, NULL };

	LDAPMod dNSHostName = { LDAP_MOD_ADD, "dNSHostName", { vals_dNSHostName, } };

	char *vals_operatingSystem[] = { enroll->os_name, NULL };

	LDAPMod operatingSystem = { LDAP_MOD_ADD, "operatingSystem", { vals_operatingSystem, } };

	char *vals_operatingSystemVersion[] = { enroll->os_version, NULL };

	LDAPMod operatingSystemVersion = { LDAP_MOD_ADD, "operatingSystemVersion", { vals_operatingSystemVersion, } };

	char *vals_operatingSystemServicePack[] = { enroll->os_service_pack, NULL };

	LDAPMod operatingSystemServicePack = { LDAP_MOD_ADD, "operatingSystemServicePack", { vals_operatingSystemServicePack, } };

	char *vals_userPrincipalName[] = { enroll->user_principal, NULL };

	LDAPMod userPrincipalName = { LDAP_MOD_ADD, "userPrincipalName", { vals_userPrincipalName, }, };

	LDAPMod servicePrincipalName = { LDAP_MOD_ADD, "servicePrincipalName", { enroll->service_principals, } };

	char *val = NULL;

	int ret;

	size_t c;

	size_t m;

	LDAPMod *all_mods[] = {

		&objectClass,

		&sAMAccountName,

		&userAccountControl,

		&encTypes,

		&dNSHostName,

		&operatingSystem,

		&operatingSystemVersion,

		&operatingSystemServicePack,

		&userPrincipalName,

		&servicePrincipalName,

		NULL

	};

	size_t mods_count = sizeof (all_mods) / sizeof (LDAPMod *);

	LDAPMod *mods[mods_count];

	if (adcli_enroll_get_trusted_for_delegation (enroll)) {

		vals_userAccountControl[0] = "593920"; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD | TRUSTED_FOR_DELEGATION */

	}

	ret = calculate_enctypes (enroll, &val;;

	if (ret != ADCLI_SUCCESS) {

		return ret;

	}

	vals_supportedEncryptionTypes[0] = val;

	m = 0;

	for (c = 0; c < mods_count - 1; c++) {

		/* Skip empty LDAP sttributes */

		if (all_mods[c]->mod_vals.modv_strvals[0] != NULL) {

			mods[m++] = all_mods[c];

		}

	}

	mods[m] = NULL;

	ret = ldap_add_ext_s (ldap, enroll->computer_dn, mods, NULL, NULL);

	free (val);

	/*

	 * Hand to head. This is really dumb... AD returns

	 * OBJECT_CLASS_VIOLATION when the 'admin' account doesn't have

	 * enough permission to create this computer account.

	 *

	 * Additionally LDAP_UNWILLING_TO_PERFORM and LDAP_CONSTRAINT_VIOLATION

	 * are seen on various Windows Servers as responses to this case.

	 *

	 * TODO: Perhaps some missing attributes are auto-generated when

	 * the administrative credentials have sufficient permissions, and

	 * those missing attributes cause the object class violation. However

	 * I've tried to screw around with this, and can't find the missing

	 * attributes. They may be hidden, like unicodePwd.

	 */

	if (ret == LDAP_INSUFFICIENT_ACCESS || ret == LDAP_OBJECT_CLASS_VIOLATION ||

	    ret == LDAP_UNWILLING_TO_PERFORM || ret == LDAP_CONSTRAINT_VIOLATION) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_CREDENTIALS,

		                                   "Insufficient permissions to modify computer account: %s",

		                                   enroll->computer_dn);

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't create computer account: %s",

		                                   enroll->computer_dn);

	}

	_adcli_info ("Created computer account: %s", enroll->computer_dn);

	return ADCLI_SUCCESS;

}

static int

filter_for_necessary_updates (adcli_enroll *enroll,

                              LDAP *ldap,

                              LDAPMessage *entry,

                              LDAPMod **mods)

{

	struct berval **vals;

	int match;

	int out;

	int in;

	for (in = 0, out = 0; mods[in] != NULL; in++) {

		match = 0;

		/* Never update these attributes */

		if (strcasecmp (mods[in]->mod_type, "objectClass") == 0)

			continue;

		/* If no entry, then no filtering */

		if (entry != NULL) {

			vals = ldap_get_values_len (ldap, entry, mods[in]->mod_type);

			if (vals != NULL) {

				match = _adcli_ldap_have_in_mod (mods[in], vals);

				ldap_value_free_len (vals);

			}

		}

		if (!match)

			mods[out++] = mods[in];

	}

	mods[out] = NULL;

	return out;

}

static adcli_result

validate_computer_account (adcli_enroll *enroll,

                           int allow_overwrite,

                           int already_exists)

{

	assert (enroll->computer_dn != NULL);

	if (already_exists && !allow_overwrite) {

		_adcli_err ("The computer account %s already exists",

		            enroll->computer_name);

		return ADCLI_ERR_CONFIG;

	}

	/* Do we have an explicitly requested ou? */

	if (enroll->domain_ou && enroll->domain_ou_explicit && already_exists) {

		if (!_adcli_ldap_dn_has_ancestor (enroll->computer_dn, enroll->domain_ou)) {

			_adcli_err ("The computer account %s already exists, "

			            "but is not in the desired organizational unit.",

			            enroll->computer_name);

			return ADCLI_ERR_CONFIG;

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

delete_computer_account (adcli_enroll *enroll,

                         LDAP *ldap)

{

	int ret;

	ret = ldap_delete_ext_s (ldap, enroll->computer_dn, NULL, NULL);

	if (ret == LDAP_INSUFFICIENT_ACCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_CREDENTIALS,

		                                   "Insufficient permissions to delete computer account: %s",

		                                   enroll->computer_dn);

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't delete computer account: %s",

		                                   enroll->computer_dn);

	} else {

		_adcli_info ("Deleted computer account at: %s", enroll->computer_dn);

	}

	return ADCLI_SUCCESS;

}

static adcli_result

locate_computer_account (adcli_enroll *enroll,

                         LDAP *ldap,

                         LDAPMessage **rresults,

                         LDAPMessage **rentry)

{

	char *attrs[] = { "1.1", NULL };

	LDAPMessage *results = NULL;

	LDAPMessage *entry = NULL;

	const char *base;

	char *value;

	char *filter;

	char *dn;

	int ret = 0;

	/* If we don't yet know our computer dn, then try and find it */

	value = _adcli_ldap_escape_filter (enroll->computer_sam);

	return_unexpected_if_fail (value != NULL);

	if (asprintf (&filter, "(&(objectClass=computer)(sAMAccountName=%s))", value) < 0)

		return_unexpected_if_reached ();

	free (value);

	base = adcli_conn_get_default_naming_context (enroll->conn);

	ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_SUB, filter, attrs, 0,

	                         NULL, NULL, NULL, 1, &results);

	free (filter);

	/* ldap_search_ext_s() can return results *and* an error. */

	if (ret == LDAP_SUCCESS) {

		entry = ldap_first_entry (ldap, results);

		/* If we found a computer account, make note of dn */

		if (entry) {

			dn = ldap_get_dn (ldap, entry);

			free (enroll->computer_dn);

			enroll->computer_dn = strdup (dn);

			return_unexpected_if_fail (enroll->computer_dn != NULL);

			_adcli_info ("Found computer account for %s at: %s",

			             enroll->computer_sam, dn);

			ldap_memfree (dn);

		} else {

			ldap_msgfree (results);

			results = NULL;

			_adcli_info ("Computer account for %s does not exist",

			             enroll->computer_sam);

		}

	} else {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't lookup computer account: %s",

		                                   enroll->computer_sam);

	}

	if (rresults)

		*rresults = results;

	else

		ldap_msgfree (results);

	if (rentry) {

		assert (rresults != NULL);

		*rentry = entry;

	}

	return ADCLI_SUCCESS;

}

static adcli_result

load_computer_account (adcli_enroll *enroll,

                       LDAP *ldap,

                       LDAPMessage **rresults,

                       LDAPMessage **rentry)

{

	char *attrs[] = { "1.1", NULL };

	LDAPMessage *results = NULL;

	LDAPMessage *entry = NULL;