1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
24 */
25
26/*
27 * This module contains smbadm CLI which offers smb configuration
28 * functionalities.
29 */
30#include <errno.h>
31#include <err.h>
32#include <ctype.h>
33#include <stdlib.h>
34#include <unistd.h>
35#include <stdio.h>
36#include <syslog.h>
37#include <strings.h>
38#include <limits.h>
39#include <getopt.h>
40#include <libintl.h>
41#include <zone.h>
42#include <pwd.h>
43#include <grp.h>
44#include <libgen.h>
45#include <netinet/in.h>
46#include <auth_attr.h>
47#include <locale.h>
48#include <smbsrv/libsmb.h>
49#include <smbsrv/libsmbns.h>
50
51#if !defined(TEXT_DOMAIN)
52#define	TEXT_DOMAIN "SYS_TEST"
53#endif
54
55typedef enum {
56	HELP_ADD_MEMBER,
57	HELP_CREATE,
58	HELP_DELETE,
59	HELP_DEL_MEMBER,
60	HELP_GET,
61	HELP_JOIN,
62	HELP_LIST,
63	HELP_LOOKUP,
64	HELP_RENAME,
65	HELP_SET,
66	HELP_SHOW,
67	HELP_USER_DISABLE,
68	HELP_USER_ENABLE,
69	HELP_USER_DELETE
70} smbadm_help_t;
71
72#define	SMBADM_CMDF_NONE	0x00
73#define	SMBADM_CMDF_USER	0x01
74#define	SMBADM_CMDF_GROUP	0x02
75#define	SMBADM_CMDF_TYPEMASK	0x0F
76
77typedef enum {
78	SMBADM_GRP_ADDMEMBER = 0,
79	SMBADM_GRP_DELMEMBER,
80} smbadm_grp_action_t;
81
82#define	SMBADM_ANSBUFSIZ	64
83
84typedef struct smbadm_cmdinfo {
85	char *name;
86	int (*func)(int, char **);
87	smbadm_help_t usage;
88	uint32_t flags;
89	char *auth;
90} smbadm_cmdinfo_t;
91
92smbadm_cmdinfo_t *curcmd;
93static char *progname;
94
95#define	SMBADM_ACTION_AUTH	"solaris.smf.manage.smb"
96#define	SMBADM_VALUE_AUTH	"solaris.smf.value.smb"
97#define	SMBADM_BASIC_AUTH	"solaris.network.hosts.read"
98
99static boolean_t smbadm_checkauth(const char *);
100
101static void smbadm_usage(boolean_t);
102static int smbadm_join_workgroup(const char *, boolean_t);
103static int smbadm_join_domain(const char *, const char *, boolean_t);
104static void smbadm_extract_domain(char *, char **, char **);
105
106static int smbadm_join(int, char **);
107static int smbadm_list(int, char **);
108static int smbadm_lookup(int, char **);
109static void smbadm_lookup_name(char *);
110static void smbadm_lookup_sid(char *);
111static int smbadm_group_create(int, char **);
112static int smbadm_group_delete(int, char **);
113static int smbadm_group_rename(int, char **);
114static int smbadm_group_show(int, char **);
115static void smbadm_group_show_name(const char *, const char *);
116static int smbadm_group_getprop(int, char **);
117static int smbadm_group_setprop(int, char **);
118static int smbadm_group_addmember(int, char **);
119static int smbadm_group_delmember(int, char **);
120static int smbadm_group_add_del_member(char *, char *, smbadm_grp_action_t);
121
122static int smbadm_user_delete(int, char **);
123static int smbadm_user_disable(int, char **);
124static int smbadm_user_enable(int, char **);
125
126/* Please keep the order consistent with smbadm(1M) man page */
127static smbadm_cmdinfo_t smbadm_cmdtable[] =
128{
129	{ "create",		smbadm_group_create,	HELP_CREATE,
130		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
131	{ "delete",		smbadm_group_delete,	HELP_DELETE,
132		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
133	{ "rename",		smbadm_group_rename,	HELP_RENAME,
134		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
135	{ "show",		smbadm_group_show,	HELP_SHOW,
136		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
137	{ "get",		smbadm_group_getprop,	HELP_GET,
138		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
139	{ "set",		smbadm_group_setprop,	HELP_SET,
140		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
141	{ "add-member",		smbadm_group_addmember,	HELP_ADD_MEMBER,
142		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
143	{ "remove-member",	smbadm_group_delmember,	HELP_DEL_MEMBER,
144		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
145	{ "delete-user",	smbadm_user_delete,	HELP_USER_DELETE,
146		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
147	{ "disable-user",	smbadm_user_disable,	HELP_USER_DISABLE,
148		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
149	{ "enable-user",	smbadm_user_enable,	HELP_USER_ENABLE,
150		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
151	{ "join",		smbadm_join,		HELP_JOIN,
152		SMBADM_CMDF_NONE,	SMBADM_VALUE_AUTH },
153	{ "list",		smbadm_list,		HELP_LIST,
154		SMBADM_CMDF_NONE,	SMBADM_BASIC_AUTH },
155	{ "lookup",		smbadm_lookup,		HELP_LOOKUP,
156		SMBADM_CMDF_NONE,	SMBADM_BASIC_AUTH },
157};
158
159#define	SMBADM_NCMD	(sizeof (smbadm_cmdtable) / sizeof (smbadm_cmdtable[0]))
160
161typedef struct smbadm_prop {
162	char *p_name;
163	char *p_value;
164} smbadm_prop_t;
165
166typedef struct smbadm_prop_handle {
167	char *p_name;
168	char *p_dispvalue;
169	int (*p_setfn)(char *, smbadm_prop_t *);
170	int (*p_getfn)(char *, smbadm_prop_t *);
171	boolean_t (*p_chkfn)(smbadm_prop_t *);
172} smbadm_prop_handle_t;
173
174static boolean_t smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval);
175static int smbadm_prop_parse(char *arg, smbadm_prop_t *prop);
176static smbadm_prop_handle_t *smbadm_prop_gethandle(char *pname);
177
178static boolean_t smbadm_chkprop_priv(smbadm_prop_t *prop);
179static int smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop);
180static int smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop);
181static int smbadm_setprop_readfile(char *gname, smbadm_prop_t *prop);
182static int smbadm_getprop_readfile(char *gname, smbadm_prop_t *prop);
183static int smbadm_setprop_writefile(char *gname, smbadm_prop_t *prop);
184static int smbadm_getprop_writefile(char *gname, smbadm_prop_t *prop);
185static int smbadm_setprop_backup(char *gname, smbadm_prop_t *prop);
186static int smbadm_getprop_backup(char *gname, smbadm_prop_t *prop);
187static int smbadm_setprop_restore(char *gname, smbadm_prop_t *prop);
188static int smbadm_getprop_restore(char *gname, smbadm_prop_t *prop);
189static int smbadm_setprop_desc(char *gname, smbadm_prop_t *prop);
190static int smbadm_getprop_desc(char *gname, smbadm_prop_t *prop);
191
192static smbadm_prop_handle_t smbadm_ptable[] = {
193	{"backup",	"on|off",	smbadm_setprop_backup,
194	smbadm_getprop_backup,	smbadm_chkprop_priv	},
195	{"restore",	"on|off",	smbadm_setprop_restore,
196	smbadm_getprop_restore,	smbadm_chkprop_priv	},
197	{"take-ownership", "on|off",	smbadm_setprop_tkowner,
198	smbadm_getprop_tkowner,	smbadm_chkprop_priv	},
199	{"bypass-read", "on|off",	smbadm_setprop_readfile,
200	smbadm_getprop_readfile,	smbadm_chkprop_priv	},
201	{"bypass-write", "on|off",	smbadm_setprop_writefile,
202	smbadm_getprop_writefile,	smbadm_chkprop_priv	},
203	{"description",	"<string>",	smbadm_setprop_desc,
204	smbadm_getprop_desc,	NULL			},
205};
206
207static int smbadm_init(void);
208static void smbadm_fini(void);
209static const char *smbadm_pwd_strerror(int error);
210
211/*
212 * Number of supported properties
213 */
214#define	SMBADM_NPROP	(sizeof (smbadm_ptable) / sizeof (smbadm_ptable[0]))
215
216static void
217smbadm_cmdusage(FILE *fp, smbadm_cmdinfo_t *cmd)
218{
219	switch (cmd->usage) {
220	case HELP_ADD_MEMBER:
221		(void) fprintf(fp,
222		    gettext("\t%s -m <member> [-m <member>]... <group>\n"),
223		    cmd->name);
224		return;
225
226	case HELP_CREATE:
227		(void) fprintf(fp, gettext("\t%s [-d <description>] <group>\n"),
228		    cmd->name);
229		return;
230
231	case HELP_DELETE:
232		(void) fprintf(fp, gettext("\t%s <group>\n"), cmd->name);
233		return;
234
235	case HELP_USER_DELETE:
236	case HELP_USER_DISABLE:
237	case HELP_USER_ENABLE:
238		(void) fprintf(fp, gettext("\t%s <username>\n"), cmd->name);
239		return;
240
241	case HELP_GET:
242		(void) fprintf(fp, gettext("\t%s [-p <property>]... <group>\n"),
243		    cmd->name);
244		return;
245
246	case HELP_JOIN:
247#if 0	/* Don't document "-p" yet, still needs work (NEX-11960) */
248		(void) fprintf(fp, gettext("\t%s [-y] -p <domain>\n"
249		    "\t%s [-y] -u <username domain>\n"
250		    "\t%s [-y] -w <workgroup>\n"),
251		    cmd->name, cmd->name, cmd->name);
252#else
253		(void) fprintf(fp, gettext("\t%s [-y] -u <username> <domain>\n"
254		    "\t%s [-y] -w <workgroup>\n"), cmd->name, cmd->name);
255#endif
256		return;
257
258	case HELP_LIST:
259		(void) fprintf(fp, gettext("\t%s\n"), cmd->name);
260		return;
261
262	case HELP_LOOKUP:
263		(void) fprintf(fp,
264		    gettext("\t%s <account-name>\n"),
265		    cmd->name);
266		return;
267
268	case HELP_DEL_MEMBER:
269		(void) fprintf(fp,
270		    gettext("\t%s -m <member> [-m <member>]... <group>\n"),
271		    cmd->name);
272		return;
273
274	case HELP_RENAME:
275		(void) fprintf(fp, gettext("\t%s <group> <new-group>\n"),
276		    cmd->name);
277		return;
278
279	case HELP_SET:
280		(void) fprintf(fp, gettext("\t%s -p <property>=<value> "
281		    "[-p <property>=<value>]... <group>\n"), cmd->name);
282		return;
283
284	case HELP_SHOW:
285		(void) fprintf(fp, gettext("\t%s [-mp] [<group>]\n"),
286		    cmd->name);
287		return;
288
289	default:
290		break;
291	}
292
293	abort();
294	/* NOTREACHED */
295}
296
297static void
298smbadm_usage(boolean_t requested)
299{
300	FILE *fp = requested ? stdout : stderr;
301	boolean_t show_props = B_FALSE;
302	int i;
303
304	if (curcmd == NULL) {
305		(void) fprintf(fp,
306		    gettext("usage: %s <subcommand> <args> ...\n"),
307		    progname);
308
309		for (i = 0; i < SMBADM_NCMD; i++)
310			smbadm_cmdusage(fp, &smbadm_cmdtable[i]);
311
312		(void) fprintf(fp,
313		    gettext("\nFor property list, run %s %s|%s\n"),
314		    progname, "get", "set");
315
316		exit(requested ? 0 : 2);
317	}
318
319	(void) fprintf(fp, gettext("usage:\n"));
320	smbadm_cmdusage(fp, curcmd);
321
322	if (strcmp(curcmd->name, "get") == 0 ||
323	    strcmp(curcmd->name, "set") == 0)
324		show_props = B_TRUE;
325
326	if (show_props) {
327		(void) fprintf(fp,
328		    gettext("\nThe following properties are supported:\n"));
329
330		(void) fprintf(fp, "\n\t%-16s   %s\n\n",
331		    "PROPERTY", "VALUES");
332
333		for (i = 0; i < SMBADM_NPROP; i++) {
334			(void) fprintf(fp, "\t%-16s   %s\n",
335			    smbadm_ptable[i].p_name,
336			    smbadm_ptable[i].p_dispvalue);
337		}
338	}
339
340	exit(requested ? 0 : 2);
341}
342
343/*
344 * smbadm_strcasecmplist
345 *
346 * Find a string 's' within a list of strings.
347 *
348 * Returns the index of the matching string or -1 if there is no match.
349 */
350static int
351smbadm_strcasecmplist(const char *s, ...)
352{
353	va_list ap;
354	char *p;
355	int ndx;
356
357	va_start(ap, s);
358
359	for (ndx = 0; ((p = va_arg(ap, char *)) != NULL); ++ndx) {
360		if (strcasecmp(s, p) == 0) {
361			va_end(ap);
362			return (ndx);
363		}
364	}
365
366	va_end(ap);
367	return (-1);
368}
369
370/*
371 * smbadm_answer_prompt
372 *
373 * Prompt for the answer to a question.  A default response must be
374 * specified, which will be used if the user presses <enter> without
375 * answering the question.
376 */
377static int
378smbadm_answer_prompt(const char *prompt, char *answer, const char *dflt)
379{
380	char buf[SMBADM_ANSBUFSIZ];
381	char *p;
382
383	(void) printf(gettext("%s [%s]: "), prompt, dflt);
384
385	if (fgets(buf, SMBADM_ANSBUFSIZ, stdin) == NULL)
386		return (-1);
387
388	if ((p = strchr(buf, '\n')) != NULL)
389		*p = '\0';
390
391	if (*buf == '\0')
392		(void) strlcpy(answer, dflt, SMBADM_ANSBUFSIZ);
393	else
394		(void) strlcpy(answer, buf, SMBADM_ANSBUFSIZ);
395
396	return (0);
397}
398
399/*
400 * smbadm_confirm
401 *
402 * Ask a question that requires a yes/no answer.
403 * A default response must be specified.
404 */
405static boolean_t
406smbadm_confirm(const char *prompt, const char *dflt)
407{
408	char buf[SMBADM_ANSBUFSIZ];
409
410	for (;;) {
411		if (smbadm_answer_prompt(prompt, buf, dflt) < 0)
412			return (B_FALSE);
413
414		if (smbadm_strcasecmplist(buf, "n", "no", 0) >= 0)
415			return (B_FALSE);
416
417		if (smbadm_strcasecmplist(buf, "y", "yes", 0) >= 0)
418			return (B_TRUE);
419
420		(void) printf(gettext("Please answer yes or no.\n"));
421	}
422}
423
424static boolean_t
425smbadm_join_prompt(const char *domain)
426{
427	(void) printf(gettext("After joining %s the smb service will be "
428	    "restarted automatically.\n"), domain);
429
430	return (smbadm_confirm("Would you like to continue?", "no"));
431}
432
433static void
434smbadm_restart_service(void)
435{
436	if (smb_smf_restart_service() != 0) {
437		(void) fprintf(stderr,
438		    gettext("Unable to restart smb service. "
439		    "Run 'svcs -xv smb/server' for more information."));
440	}
441}
442
443/*
444 * smbadm_join
445 *
446 * Join a domain or workgroup.
447 *
448 * When joining a domain, we may receive the username, password and
449 * domain name in any of the following combinations.  Note that the
450 * password is optional on the command line: if it is not provided,
451 * we will prompt for it later.
452 *
453 *	username+password domain
454 *	domain\username+password
455 *	domain/username+password
456 *	username@domain
457 *
458 * We allow domain\name+password or domain/name+password but not
459 * name+password@domain because @ is a valid password character.
460 *
461 * If the username and domain name are passed as separate command
462 * line arguments, we process them directly.  Otherwise we separate
463 * them and continue as if they were separate command line arguments.
464 */
465static int
466smbadm_join(int argc, char **argv)
467{
468	char buf[MAXHOSTNAMELEN * 2];
469	char *domain = NULL;
470	char *username = NULL;
471	uint32_t mode = 0;
472	boolean_t do_prompt = B_TRUE;
473	char option;
474
475	while ((option = getopt(argc, argv, "pu:wy")) != -1) {
476		if (mode != 0) {
477			(void) fprintf(stderr, gettext(
478			    "join options are mutually exclusive\n"));
479			smbadm_usage(B_FALSE);
480		}
481		switch (option) {
482		case 'p':
483			mode = SMB_SECMODE_DOMAIN;
484			/* leave username = NULL */
485			break;
486
487		case 'u':
488			mode = SMB_SECMODE_DOMAIN;
489			username = optarg;
490			break;
491
492		case 'w':
493			mode = SMB_SECMODE_WORKGRP;
494			break;
495
496		case 'y':
497			do_prompt = B_FALSE;
498			break;
499
500		default:
501			smbadm_usage(B_FALSE);
502			break;
503		}
504	}
505
506	if (optind < argc)
507		domain = argv[optind];
508
509	if (username != NULL && domain == NULL) {
510		/*
511		 * The domain was not specified as a separate
512		 * argument, check for the combination forms.
513		 */
514		(void) strlcpy(buf, username, sizeof (buf));
515		smbadm_extract_domain(buf, &username, &domain);
516	}
517
518	if ((domain == NULL) || (*domain == '\0')) {
519		(void) fprintf(stderr, gettext("missing %s name\n"),
520		    (mode == SMB_SECMODE_WORKGRP) ? "workgroup" : "domain");
521		smbadm_usage(B_FALSE);
522	}
523
524	if (mode == SMB_SECMODE_WORKGRP) {
525		return (smbadm_join_workgroup(domain, do_prompt));
526	}
527	return (smbadm_join_domain(domain, username, do_prompt));
528}
529
530/*
531 * Workgroups comprise a collection of standalone, independently administered
532 * computers that use a common workgroup name.  This is a peer-to-peer model
533 * with no formal membership mechanism.
534 */
535static int
536smbadm_join_workgroup(const char *workgroup, boolean_t prompt)
537{
538	smb_joininfo_t jdi;
539	smb_joinres_t jdres;
540	uint32_t status;
541
542	bzero(&jdres, sizeof (jdres));
543	bzero(&jdi, sizeof (jdi));
544	jdi.mode = SMB_SECMODE_WORKGRP;
545	(void) strlcpy(jdi.domain_name, workgroup, sizeof (jdi.domain_name));
546	(void) strtrim(jdi.domain_name, " \t\n");
547
548	if (smb_name_validate_workgroup(jdi.domain_name) != ERROR_SUCCESS) {
549		(void) fprintf(stderr, gettext("workgroup name is invalid\n"));
550		smbadm_usage(B_FALSE);
551	}
552
553	if (prompt && !smbadm_join_prompt(jdi.domain_name))
554		return (0);
555
556	if ((status = smb_join(&jdi, &jdres)) != NT_STATUS_SUCCESS) {
557		(void) fprintf(stderr, gettext("failed to join %s: %s\n"),
558		    jdi.domain_name, xlate_nt_status(status));
559		return (1);
560	}
561
562	(void) printf(gettext("Successfully joined %s\n"), jdi.domain_name);
563	smbadm_restart_service();
564	return (0);
565}
566
567/*
568 * Domains comprise a centrally administered group of computers and accounts
569 * that share a common security and administration policy and database.
570 * Computers must join a domain and become domain members, which requires
571 * an administrator level account name.
572 *
573 * The '+' character is invalid within a username.  We allow the password
574 * to be appended to the username using '+' as a scripting convenience.
575 */
576static int
577smbadm_join_domain(const char *domain, const char *username, boolean_t prompt)
578{
579	smb_joininfo_t jdi;
580	smb_joinres_t jdres;
581	char *passwd_prompt;
582	char *p;
583	int len, rc;
584
585	bzero(&jdres, sizeof (jdres));
586	bzero(&jdi, sizeof (jdi));
587	jdi.mode = SMB_SECMODE_DOMAIN;
588	(void) strlcpy(jdi.domain_name, domain, sizeof (jdi.domain_name));
589	(void) strtrim(jdi.domain_name, " \t\n");
590
591	if (smb_name_validate_domain(jdi.domain_name) != ERROR_SUCCESS) {
592		(void) fprintf(stderr, gettext("domain name is invalid\n"));
593		smbadm_usage(B_FALSE);
594	}
595
596	if (prompt && !smbadm_join_prompt(jdi.domain_name))
597		return (0);
598
599	/*
600	 * Note: username is null for "unsecure join"
601	 * (join using a pre-created computer account)
602	 * No password either.
603	 */
604	if (username != NULL) {
605		if ((p = strchr(username, '+')) != NULL) {
606			++p;
607
608			len = (int)(p - username);
609			if (len > sizeof (jdi.domain_name))
610				len = sizeof (jdi.domain_name);
611
612			(void) strlcpy(jdi.domain_username, username, len);
613			(void) strlcpy(jdi.domain_passwd, p,
614			    sizeof (jdi.domain_passwd));
615		} else {
616			(void) strlcpy(jdi.domain_username, username,
617			    sizeof (jdi.domain_username));
618		}
619
620		if (smb_name_validate_account(jdi.domain_username)
621		    != ERROR_SUCCESS) {
622			(void) fprintf(stderr,
623			    gettext("username contains invalid characters\n"));
624			smbadm_usage(B_FALSE);
625		}
626
627		if (*jdi.domain_passwd == '\0') {
628			passwd_prompt = gettext("Enter domain password: ");
629
630			if ((p = getpassphrase(passwd_prompt)) == NULL) {
631				(void) fprintf(stderr, gettext(
632				    "missing password\n"));
633				smbadm_usage(B_FALSE);
634			}
635
636			(void) strlcpy(jdi.domain_passwd, p,
637			    sizeof (jdi.domain_passwd));
638		}
639	}
640
641	(void) printf(gettext("Joining %s ... this may take a minute ...\n"),
642	    jdi.domain_name);
643
644	rc = smb_join(&jdi, &jdres);
645	if (rc != 0) {
646		(void) printf(gettext("Cannot call the SMB service. "
647		    " (error %d: %s) "
648		    "Please check the service status "
649		    "(svcs -vx network/smb/server)\n"),
650		    rc, strerror(rc));
651		bzero(&jdi, sizeof (jdi));
652		return (1);
653	}
654
655	switch (jdres.status) {
656	case NT_STATUS_SUCCESS:
657		(void) printf(gettext(
658		    "Successfully joined domain %s using AD server %s\n"),
659		    jdi.domain_name, jdres.dc_name);
660		bzero(&jdi, sizeof (jdi));
661		smbadm_restart_service();
662		return (0);
663
664	case NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND:
665		/* See: smb_ads_lookup_msdcs */
666		(void) fprintf(stderr, gettext(
667		    "failed to find any AD servers for domain: %s\n"),
668		    jdi.domain_name);
669		goto common;
670
671	case NT_STATUS_BAD_NETWORK_PATH:
672		/* See: smbrdr_ctx_new / smb_ctx_resolve */
673		(void) fprintf(stderr, gettext(
674		    "failed to resolve address of AD server: %s\n"),
675		    jdres.dc_name);
676		goto common;
677
678	case NT_STATUS_NETWORK_ACCESS_DENIED:
679		/* See: smbrdr_ctx_new / smb_ctx_get_ssn */
680		(void) fprintf(stderr, gettext(
681		    "failed to authenticate with AD server: %s\n"),
682		    jdres.dc_name);
683		goto common;
684
685	case NT_STATUS_BAD_NETWORK_NAME:
686		/*
687		 * See: smbrdr_ctx_new / smb_ctx_get_tree
688		 * and: ndr_rpc_bind / smb_fh_open
689		 */
690		(void) fprintf(stderr, gettext(
691		    "failed connecting to services on AD server: %s\n"),
692		    jdres.dc_name);
693		goto common;
694
695	default:
696		(void) fprintf(stderr, gettext(
697		    "failed to join domain %s\n"),
698		    jdi.domain_name);
699		if (jdres.dc_name[0] != '\0') {
700			(void) fprintf(stderr, gettext(
701			    "using AD server: %s\n"),
702			    jdres.dc_name);
703		}
704		/* FALLTHROUGH */
705	common:
706		if (jdres.join_err != 0) {
707			(void) fprintf(stderr, "%s\n",
708			    smb_ads_strerror(jdres.join_err));
709		} else if (jdres.status != 0) {
710			(void) fprintf(stderr, "(%s)\n",
711			    xlate_nt_status(jdres.status));
712		}
713		(void) fprintf(stderr, gettext("Please refer to the "
714		    "service log for more information.\n"));
715		bzero(&jdi, sizeof (jdi));
716		return (1);
717	}
718}
719
720/*
721 * We want to process the user and domain names as separate strings.
722 * Check for names of the forms below and separate the components as
723 * required.
724 *
725 *	name@domain
726 *	domain\name
727 *	domain/name
728 *
729 * If we encounter any of the forms above in arg, the @, / or \
730 * separator is replaced by \0 and the username and domain pointers
731 * are changed to point to the appropriate components (in arg).
732 *
733 * If none of the separators are encountered, the username and domain
734 * pointers remain unchanged.
735 */
736static void
737smbadm_extract_domain(char *arg, char **username, char **domain)
738{
739	char *p;
740
741	if ((p = strpbrk(arg, "/\\@")) != NULL) {
742		if (*p == '@') {
743			*p = '\0';
744			++p;
745
746			if (strchr(arg, '+') != NULL)
747				return;
748
749			*domain = p;
750			*username = arg;
751		} else {
752			*p = '\0';
753			++p;
754			*username = p;
755			*domain = arg;
756		}
757	}
758}
759
760/*
761 * smbadm_list
762 *
763 * Displays current security mode and domain/workgroup name.
764 */
765/*ARGSUSED*/
766static int
767smbadm_list(int argc, char **argv)
768{
769	char domain[MAXHOSTNAMELEN];
770	char fqdn[MAXHOSTNAMELEN];
771	char srvname[MAXHOSTNAMELEN];
772	char modename[16];
773	int rc;
774	smb_inaddr_t srvipaddr;
775	char ipstr[INET6_ADDRSTRLEN];
776
777	rc = smb_config_getstr(SMB_CI_SECURITY, modename, sizeof (modename));
778	if (rc != SMBD_SMF_OK) {
779		(void) fprintf(stderr,
780		    gettext("cannot determine the operational mode\n"));
781		return (1);
782	}
783
784	if (smb_getdomainname(domain, sizeof (domain)) != 0) {
785		(void) fprintf(stderr, gettext("failed to get the %s name\n"),
786		    modename);
787		return (1);
788	}
789
790	if (strcmp(modename, "workgroup") == 0) {
791		(void) printf(gettext("[*] [%s]\n"), domain);
792		return (0);
793	}
794
795	(void) printf(gettext("[*] [%s]\n"), domain);
796	if ((smb_getfqdomainname(fqdn, sizeof (fqdn)) == 0) && (*fqdn != '\0'))
797		(void) printf(gettext("[*] [%s]\n"), fqdn);
798
799	if ((smb_get_dcinfo(srvname, MAXHOSTNAMELEN, &srvipaddr)
800	    == NT_STATUS_SUCCESS) && (*srvname != '\0') &&
801	    (!smb_inet_iszero(&srvipaddr))) {
802		(void) smb_inet_ntop(&srvipaddr, ipstr,
803		    SMB_IPSTRLEN(srvipaddr.a_family));
804		(void) printf(gettext("\t[+%s] [%s]\n"),
805		    srvname, ipstr);
806	}
807
808	/* Print the local and domain SID. */
809	smb_domain_show();
810	return (0);
811}
812
813/*
814 * smbadm_lookup
815 *
816 * Lookup the SID for a given account (user or group)
817 */
818static int
819smbadm_lookup(int argc, char **argv)
820{
821	int i;
822
823	if (argc < 2) {
824		(void) fprintf(stderr, gettext("missing account name\n"));
825		smbadm_usage(B_FALSE);
826	}
827
828	for (i = 1; i < argc; i++) {
829		if (strncmp(argv[i], "S-1-", 4) == 0)
830			smbadm_lookup_sid(argv[i]);
831		else
832			smbadm_lookup_name(argv[i]);
833	}
834	return (0);
835}
836
837static void
838smbadm_lookup_name(char *name)
839{
840	lsa_account_t	acct;
841	int rc;
842
843	if ((rc = smb_lookup_name(name, SidTypeUnknown, &acct)) != 0) {
844		(void) fprintf(stderr, gettext(
845		    "\t\t%s: lookup name failed, rc=%d\n"),
846		    name, rc);
847		return;
848	}
849	if (acct.a_status != NT_STATUS_SUCCESS) {
850		(void) fprintf(stderr, gettext("\t\t%s [%s]\n"),
851		    name, xlate_nt_status(acct.a_status));
852		return;
853	}
854	(void) printf("\t%s\n", acct.a_sid);
855}
856
857static void
858smbadm_lookup_sid(char *sidstr)
859{
860	lsa_account_t	acct;
861	int rc;
862
863	if ((rc = smb_lookup_sid(sidstr, &acct)) != 0) {
864		(void) fprintf(stderr, gettext(
865		    "\t\t%s: lookup SID failed, rc=%d\n"),
866		    sidstr, rc);
867		return;
868	}
869	if (acct.a_status != NT_STATUS_SUCCESS) {
870		(void) fprintf(stderr, gettext("\t\t%s [%s]\n"),
871		    sidstr, xlate_nt_status(acct.a_status));
872		return;
873	}
874	(void) printf("\t%s\\%s\n", acct.a_domain, acct.a_name);
875}
876
877/*
878 * smbadm_group_create
879 *
880 * Creates a local SMB group
881 */
882static int
883smbadm_group_create(int argc, char **argv)
884{
885	char *gname = NULL;
886	char *desc = NULL;
887	char option;
888	int status;
889
890	while ((option = getopt(argc, argv, "d:")) != -1) {
891		switch (option) {
892		case 'd':
893			desc = optarg;
894			break;
895
896		default:
897			smbadm_usage(B_FALSE);
898		}
899	}
900
901	gname = argv[optind];
902	if (optind >= argc || gname == NULL || *gname == '\0') {
903		(void) fprintf(stderr, gettext("missing group name\n"));
904		smbadm_usage(B_FALSE);
905	}
906
907	status = smb_lgrp_add(gname, desc);
908	if (status != SMB_LGRP_SUCCESS) {
909		(void) fprintf(stderr,
910		    gettext("failed to create %s (%s)\n"), gname,
911		    smb_lgrp_strerror(status));
912	} else {
913		(void) printf(gettext("%s created\n"), gname);
914	}
915
916	return (status);
917}
918
919/*
920 * smbadm_group_dump_members
921 *
922 * Dump group members details.
923 */
924static void
925smbadm_group_dump_members(smb_gsid_t *members, int num)
926{
927	char		sidstr[SMB_SID_STRSZ];
928	lsa_account_t	acct;
929	int		i;
930
931	if (num == 0) {
932		(void) printf(gettext("\tNo members\n"));
933		return;
934	}
935
936	(void) printf(gettext("\tMembers:\n"));
937	for (i = 0; i < num; i++) {
938		smb_sid_tostr(members[i].gs_sid, sidstr);
939
940		if (smb_lookup_sid(sidstr, &acct) == 0) {
941			if (acct.a_status == NT_STATUS_SUCCESS)
942				smbadm_group_show_name(acct.a_domain,
943				    acct.a_name);
944			else
945				(void) printf(gettext("\t\t%s [%s]\n"),
946				    sidstr, xlate_nt_status(acct.a_status));
947		} else {
948			(void) printf(gettext("\t\t%s\n"), sidstr);
949		}
950	}
951}
952
953static void
954smbadm_group_show_name(const char *domain, const char *name)
955{
956	if (strchr(domain, '.') != NULL)
957		(void) printf("\t\t%s@%s\n", name, domain);
958	else
959		(void) printf("\t\t%s\\%s\n", domain, name);
960}
961
962/*
963 * smbadm_group_dump_privs
964 *
965 * Dump group privilege details.
966 */
967static void
968smbadm_group_dump_privs(smb_privset_t *privs)
969{
970	smb_privinfo_t *pinfo;
971	char *pstatus;
972	int i;
973
974	(void) printf(gettext("\tPrivileges: \n"));
975
976	for (i = 0; i < privs->priv_cnt; i++) {
977		pinfo = smb_priv_getbyvalue(privs->priv[i].luid.lo_part);
978		if ((pinfo == NULL) || (pinfo->flags & PF_PRESENTABLE) == 0)
979			continue;
980
981		switch (privs->priv[i].attrs) {
982		case SE_PRIVILEGE_ENABLED:
983			pstatus = "On";
984			break;
985		case SE_PRIVILEGE_DISABLED:
986			pstatus = "Off";
987			break;
988		default:
989			pstatus = "Unknown";
990			break;
991		}
992		(void) printf(gettext("\t\t%s: %s\n"), pinfo->name, pstatus);
993	}
994
995	if (privs->priv_cnt == 0)
996		(void) printf(gettext("\t\tNo privileges\n"));
997}
998
999/*
1000 * smbadm_group_dump
1001 *
1002 * Dump group details.
1003 */
1004static void
1005smbadm_group_dump(smb_group_t *grp, boolean_t show_mem, boolean_t show_privs)
1006{
1007	char sidstr[SMB_SID_STRSZ];
1008
1009	(void) printf(gettext("%s (%s)\n"), grp->sg_name, grp->sg_cmnt);
1010
1011	smb_sid_tostr(grp->sg_id.gs_sid, sidstr);
1012	(void) printf(gettext("\tSID: %s\n"), sidstr);
1013
1014	if (show_privs)
1015		smbadm_group_dump_privs(grp->sg_privs);
1016
1017	if (show_mem)
1018		smbadm_group_dump_members(grp->sg_members, grp->sg_nmembers);
1019}
1020
1021/*
1022 * smbadm_group_show
1023 *
1024 */
1025static int
1026smbadm_group_show(int argc, char **argv)
1027{
1028	char *gname = NULL;
1029	boolean_t show_privs;
1030	boolean_t show_members;
1031	char option;
1032	int status;
1033	smb_group_t grp;
1034	smb_giter_t gi;
1035
1036	show_privs = show_members = B_FALSE;
1037
1038	while ((option = getopt(argc, argv, "mp")) != -1) {
1039		switch (option) {
1040		case 'm':
1041			show_members = B_TRUE;
1042			break;
1043		case 'p':
1044			show_privs = B_TRUE;
1045			break;
1046
1047		default:
1048			smbadm_usage(B_FALSE);
1049		}
1050	}
1051
1052	gname = argv[optind];
1053	if (optind >= argc || gname == NULL || *gname == '\0')
1054		gname = "*";
1055
1056	if (strcmp(gname, "*")) {
1057		status = smb_lgrp_getbyname(gname, &grp);
1058		if (status == SMB_LGRP_SUCCESS) {
1059			smbadm_group_dump(&grp, show_members, show_privs);
1060			smb_lgrp_free(&grp);
1061		} else {
1062			(void) fprintf(stderr,
1063			    gettext("failed to find %s (%s)\n"),
1064			    gname, smb_lgrp_strerror(status));
1065		}
1066		return (status);
1067	}
1068
1069	if ((status = smb_lgrp_iteropen(&gi)) != SMB_LGRP_SUCCESS) {
1070		(void) fprintf(stderr, gettext("failed to list groups (%s)\n"),
1071		    smb_lgrp_strerror(status));
1072		return (status);
1073	}
1074
1075	while ((status = smb_lgrp_iterate(&gi, &grp)) == SMB_LGRP_SUCCESS) {
1076		smbadm_group_dump(&grp, show_members, show_privs);
1077		smb_lgrp_free(&grp);
1078	}
1079
1080	smb_lgrp_iterclose(&gi);
1081
1082	if ((status != SMB_LGRP_NO_MORE) || smb_lgrp_itererror(&gi)) {
1083		if (status != SMB_LGRP_NO_MORE)
1084			smb_syslog(LOG_ERR, "smb_lgrp_iterate: %s",
1085			    smb_lgrp_strerror(status));
1086
1087		(void) fprintf(stderr,
1088		    gettext("\nAn error occurred while retrieving group data.\n"
1089		    "Check the system log for more information.\n"));
1090		return (status);
1091	}
1092
1093	return (0);
1094}
1095
1096/*
1097 * smbadm_group_delete
1098 */
1099static int
1100smbadm_group_delete(int argc, char **argv)
1101{
1102	char *gname = NULL;
1103	int status;
1104
1105	gname = argv[optind];
1106	if (optind >= argc || gname == NULL || *gname == '\0') {
1107		(void) fprintf(stderr, gettext("missing group name\n"));
1108		smbadm_usage(B_FALSE);
1109	}
1110
1111	status = smb_lgrp_delete(gname);
1112	if (status != SMB_LGRP_SUCCESS) {
1113		(void) fprintf(stderr,
1114		    gettext("failed to delete %s (%s)\n"), gname,
1115		    smb_lgrp_strerror(status));
1116	} else {
1117		(void) printf(gettext("%s deleted\n"), gname);
1118	}
1119
1120	return (status);
1121}
1122
1123/*
1124 * smbadm_group_rename
1125 */
1126static int
1127smbadm_group_rename(int argc, char **argv)
1128{
1129	char *gname = NULL;
1130	char *ngname = NULL;
1131	int status;
1132
1133	gname = argv[optind];
1134	if (optind++ >= argc || gname == NULL || *gname == '\0') {
1135		(void) fprintf(stderr, gettext("missing group name\n"));
1136		smbadm_usage(B_FALSE);
1137	}
1138
1139	ngname = argv[optind];
1140	if (optind >= argc || ngname == NULL || *ngname == '\0') {
1141		(void) fprintf(stderr, gettext("missing new group name\n"));
1142		smbadm_usage(B_FALSE);
1143	}
1144
1145	status = smb_lgrp_rename(gname, ngname);
1146	if (status != SMB_LGRP_SUCCESS) {
1147		if (status == SMB_LGRP_EXISTS)
1148			(void) fprintf(stderr,
1149			    gettext("failed to rename '%s' (%s already "
1150			    "exists)\n"), gname, ngname);
1151		else
1152			(void) fprintf(stderr,
1153			    gettext("failed to rename '%s' (%s)\n"), gname,
1154			    smb_lgrp_strerror(status));
1155	} else {
1156		(void) printf(gettext("'%s' renamed to '%s'\n"), gname, ngname);
1157	}
1158
1159	return (status);
1160}
1161
1162/*
1163 * smbadm_group_setprop
1164 *
1165 * Set the group properties.
1166 */
1167static int
1168smbadm_group_setprop(int argc, char **argv)
1169{
1170	char *gname = NULL;
1171	smbadm_prop_t props[SMBADM_NPROP];
1172	smbadm_prop_handle_t *phandle;
1173	char option;
1174	int pcnt = 0;
1175	int ret = 0;
1176	int p;
1177
1178	bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t));
1179
1180	while ((option = getopt(argc, argv, "p:")) != -1) {
1181		switch (option) {
1182		case 'p':
1183			if (pcnt >= SMBADM_NPROP) {
1184				(void) fprintf(stderr,
1185				    gettext("exceeded number of supported"
1186				    " properties\n"));
1187				smbadm_usage(B_FALSE);
1188			}
1189
1190			if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0)
1191				smbadm_usage(B_FALSE);
1192			break;
1193
1194		default:
1195			smbadm_usage(B_FALSE);
1196		}
1197	}
1198
1199	if (pcnt == 0) {
1200		(void) fprintf(stderr,
1201		    gettext("missing property=value argument\n"));
1202		smbadm_usage(B_FALSE);
1203	}
1204
1205	gname = argv[optind];
1206	if (optind >= argc || gname == NULL || *gname == '\0') {
1207		(void) fprintf(stderr, gettext("missing group name\n"));
1208		smbadm_usage(B_FALSE);
1209	}
1210
1211	for (p = 0; p < pcnt; p++) {
1212		phandle = smbadm_prop_gethandle(props[p].p_name);
1213		if (phandle) {
1214			if (phandle->p_setfn(gname, &props[p]) != 0)
1215				ret = 1;
1216		}
1217	}
1218
1219	return (ret);
1220}
1221
1222/*
1223 * smbadm_group_getprop
1224 *
1225 * Get the group properties.
1226 */
1227static int
1228smbadm_group_getprop(int argc, char **argv)
1229{
1230	char *gname = NULL;
1231	smbadm_prop_t props[SMBADM_NPROP];
1232	smbadm_prop_handle_t *phandle;
1233	char option;
1234	int pcnt = 0;
1235	int ret = 0;
1236	int p;
1237
1238	bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t));
1239
1240	while ((option = getopt(argc, argv, "p:")) != -1) {
1241		switch (option) {
1242		case 'p':
1243			if (pcnt >= SMBADM_NPROP) {
1244				(void) fprintf(stderr,
1245				    gettext("exceeded number of supported"
1246				    " properties\n"));
1247				smbadm_usage(B_FALSE);
1248			}
1249
1250			if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0)
1251				smbadm_usage(B_FALSE);
1252			break;
1253
1254		default:
1255			smbadm_usage(B_FALSE);
1256		}
1257	}
1258
1259	gname = argv[optind];
1260	if (optind >= argc || gname == NULL || *gname == '\0') {
1261		(void) fprintf(stderr, gettext("missing group name\n"));
1262		smbadm_usage(B_FALSE);
1263	}
1264
1265	if (pcnt == 0) {
1266		/*
1267		 * If no property has be specified then get
1268		 * all the properties.
1269		 */
1270		pcnt = SMBADM_NPROP;
1271		for (p = 0; p < pcnt; p++)
1272			props[p].p_name = smbadm_ptable[p].p_name;
1273	}
1274
1275	for (p = 0; p < pcnt; p++) {
1276		phandle = smbadm_prop_gethandle(props[p].p_name);
1277		if (phandle) {
1278			if (phandle->p_getfn(gname, &props[p]) != 0)
1279				ret = 1;
1280		}
1281	}
1282
1283	return (ret);
1284}
1285
1286/*
1287 * smbadm_group_addmember
1288 *
1289 */
1290static int
1291smbadm_group_addmember(int argc, char **argv)
1292{
1293	char *gname = NULL;
1294	char **mname;
1295	char option;
1296	int mcnt = 0;
1297	int ret = 0;
1298	int i;
1299
1300
1301	mname = (char **)malloc(argc * sizeof (char *));
1302	if (mname == NULL) {
1303		warn(gettext("failed to add group member"));
1304		return (1);
1305	}
1306	bzero(mname, argc * sizeof (char *));
1307
1308	while ((option = getopt(argc, argv, "m:")) != -1) {
1309		switch (option) {
1310		case 'm':
1311			mname[mcnt++] = optarg;
1312			break;
1313
1314		default:
1315			free(mname);
1316			smbadm_usage(B_FALSE);
1317		}
1318	}
1319
1320	if (mcnt == 0) {
1321		(void) fprintf(stderr, gettext("missing member name\n"));
1322		free(mname);
1323		smbadm_usage(B_FALSE);
1324	}
1325
1326	gname = argv[optind];
1327	if (optind >= argc || gname == NULL || *gname == 0) {
1328		(void) fprintf(stderr, gettext("missing group name\n"));
1329		free(mname);
1330		smbadm_usage(B_FALSE);
1331	}
1332
1333	for (i = 0; i < mcnt; i++) {
1334		if (mname[i] == NULL)
1335			continue;
1336		ret |= smbadm_group_add_del_member(
1337		    gname, mname[i], SMBADM_GRP_ADDMEMBER);
1338	}
1339
1340	free(mname);
1341	return (ret);
1342}
1343
1344/*
1345 * smbadm_group_delmember
1346 */
1347static int
1348smbadm_group_delmember(int argc, char **argv)
1349{
1350	char *gname = NULL;
1351	char **mname;
1352	char option;
1353	int mcnt = 0;
1354	int ret = 0;
1355	int i;
1356
1357	mname = (char **)malloc(argc * sizeof (char *));
1358	if (mname == NULL) {
1359		warn(gettext("failed to delete group member"));
1360		return (1);
1361	}
1362	bzero(mname, argc * sizeof (char *));
1363
1364	while ((option = getopt(argc, argv, "m:")) != -1) {
1365		switch (option) {
1366		case 'm':
1367			mname[mcnt++] = optarg;
1368			break;
1369
1370		default:
1371			free(mname);
1372			smbadm_usage(B_FALSE);
1373		}
1374	}
1375
1376	if (mcnt == 0) {
1377		(void) fprintf(stderr, gettext("missing member name\n"));
1378		free(mname);
1379		smbadm_usage(B_FALSE);
1380	}
1381
1382	gname = argv[optind];
1383	if (optind >= argc || gname == NULL || *gname == 0) {
1384		(void) fprintf(stderr, gettext("missing group name\n"));
1385		free(mname);
1386		smbadm_usage(B_FALSE);
1387	}
1388
1389
1390	for (i = 0; i < mcnt; i++) {
1391		ret = 0;
1392		if (mname[i] == NULL)
1393			continue;
1394		ret |= smbadm_group_add_del_member(
1395		    gname, mname[i], SMBADM_GRP_DELMEMBER);
1396	}
1397
1398	free(mname);
1399	return (ret);
1400}
1401
1402static int
1403smbadm_group_add_del_member(char *gname, char *mname,
1404    smbadm_grp_action_t act)
1405{
1406	lsa_account_t	acct;
1407	smb_gsid_t msid;
1408	char *sidstr;
1409	char *act_str = NULL;
1410	int rc;
1411
1412	if (strncmp(mname, "S-1-", 4) == 0) {
1413		/*
1414		 * We are given a SID.  Just use it.
1415		 *
1416		 * We'd like the real account type if we can get it,
1417		 * but don't want to error out if we can't get it.
1418		 * Lacking other info, assume it's a group.
1419		 */
1420		sidstr = mname;
1421		rc = smb_lookup_sid(sidstr, &acct);
1422		if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS))
1423			acct.a_sidtype = SidTypeGroup;
1424	} else {
1425		rc = smb_lookup_name(mname, SidTypeUnknown, &acct);
1426		if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS)) {
1427			(void) fprintf(stderr,
1428			    gettext("%s: name lookup failed\n"), mname);
1429			return (1);
1430		}
1431		sidstr = acct.a_sid;
1432	}
1433
1434	msid.gs_type = acct.a_sidtype;
1435	if ((msid.gs_sid = smb_sid_fromstr(sidstr)) == NULL) {
1436		(void) fprintf(stderr,
1437		    gettext("%s: no memory for SID\n"), sidstr);
1438		return (1);
1439	}
1440
1441	switch (act) {
1442	case SMBADM_GRP_ADDMEMBER:
1443		act_str = gettext("add");
1444		rc = smb_lgrp_add_member(gname,
1445		    msid.gs_sid, msid.gs_type);
1446		break;
1447	case SMBADM_GRP_DELMEMBER:
1448		act_str = gettext("remove");
1449		rc = smb_lgrp_del_member(gname,
1450		    msid.gs_sid, msid.gs_type);
1451		break;
1452	default:
1453		rc = SMB_LGRP_INTERNAL_ERROR;
1454		break;
1455	}
1456
1457	smb_sid_free(msid.gs_sid);
1458
1459	if (rc != SMB_LGRP_SUCCESS) {
1460		(void) fprintf(stderr,
1461		    gettext("failed to %s %s (%s)\n"),
1462		    act_str, mname, smb_lgrp_strerror(rc));
1463		return (1);
1464	}
1465	return (0);
1466}
1467
1468static int
1469smbadm_user_delete(int argc, char **argv)
1470{
1471	int error;
1472	char *user = NULL;
1473
1474	user = argv[optind];
1475	if (optind >= argc || user == NULL || *user == '\0') {
1476		(void) fprintf(stderr, gettext("missing user name\n"));
1477		smbadm_usage(B_FALSE);
1478	}
1479
1480	error = smb_pwd_setcntl(user, SMB_PWC_DELETE);
1481	if (error == SMB_PWE_SUCCESS)
1482		(void) printf(gettext("%s has been deleted.\n"), user);
1483	else
1484		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1485
1486	return (error);
1487}
1488
1489static int
1490smbadm_user_disable(int argc, char **argv)
1491{
1492	int error;
1493	char *user = NULL;
1494
1495	user = argv[optind];
1496	if (optind >= argc || user == NULL || *user == '\0') {
1497		(void) fprintf(stderr, gettext("missing user name\n"));
1498		smbadm_usage(B_FALSE);
1499	}
1500
1501	error = smb_pwd_setcntl(user, SMB_PWC_DISABLE);
1502	if (error == SMB_PWE_SUCCESS)
1503		(void) printf(gettext("%s is disabled.\n"), user);
1504	else
1505		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1506
1507	return (error);
1508}
1509
1510static int
1511smbadm_user_enable(int argc, char **argv)
1512{
1513	int error;
1514	char *user = NULL;
1515
1516	user = argv[optind];
1517	if (optind >= argc || user == NULL || *user == '\0') {
1518		(void) fprintf(stderr, gettext("missing user name\n"));
1519		smbadm_usage(B_FALSE);
1520	}
1521
1522	error = smb_pwd_setcntl(user, SMB_PWC_ENABLE);
1523	if (error == SMB_PWE_SUCCESS)
1524		(void) printf(gettext("%s is enabled.\n"), user);
1525	else
1526		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1527
1528	return (error);
1529}
1530
1531
1532int
1533main(int argc, char **argv)
1534{
1535	int ret;
1536	int i;
1537
1538	(void) setlocale(LC_ALL, "");
1539	(void) textdomain(TEXT_DOMAIN);
1540
1541	(void) malloc(0);	/* satisfy libumem dependency */
1542
1543	progname = basename(argv[0]);
1544
1545	if (is_system_labeled()) {
1546		(void) fprintf(stderr,
1547		    gettext("Trusted Extensions not supported\n"));
1548		return (1);
1549	}
1550
1551	if (argc < 2) {
1552		(void) fprintf(stderr, gettext("missing command\n"));
1553		smbadm_usage(B_FALSE);
1554	}
1555
1556	/*
1557	 * Special case "cmd --help/-?"
1558	 */
1559	if (strcmp(argv[1], "-?") == 0 ||
1560	    strcmp(argv[1], "--help") == 0 ||
1561	    strcmp(argv[1], "-h") == 0)
1562		smbadm_usage(B_TRUE);
1563
1564	for (i = 0; i < SMBADM_NCMD; ++i) {
1565		curcmd = &smbadm_cmdtable[i];
1566		if (strcasecmp(argv[1], curcmd->name) == 0) {
1567			if (argc > 2) {
1568				/* cmd subcmd --help/-? */
1569				if (strcmp(argv[2], "-?") == 0 ||
1570				    strcmp(argv[2], "--help") == 0 ||
1571				    strcmp(argv[2], "-h") == 0)
1572					smbadm_usage(B_TRUE);
1573			}
1574
1575			if (!smbadm_checkauth(curcmd->auth)) {
1576				(void) fprintf(stderr,
1577				    gettext("%s: %s: authorization denied\n"),
1578				    progname, curcmd->name);
1579				return (1);
1580			}
1581
1582			if ((ret = smbadm_init()) != 0)
1583				return (ret);
1584
1585			ret = curcmd->func(argc - 1, &argv[1]);
1586
1587			smbadm_fini();
1588			return (ret);
1589		}
1590	}
1591
1592	curcmd = NULL;
1593	(void) fprintf(stderr, gettext("unknown subcommand (%s)\n"), argv[1]);
1594	smbadm_usage(B_FALSE);
1595	return (2);
1596}
1597
1598static int
1599smbadm_init(void)
1600{
1601	int rc;
1602
1603	switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) {
1604	case SMBADM_CMDF_GROUP:
1605		if ((rc = smb_lgrp_start()) != SMB_LGRP_SUCCESS) {
1606			(void) fprintf(stderr,
1607			    gettext("failed to initialize (%s)\n"),
1608			    smb_lgrp_strerror(rc));
1609			return (1);
1610		}
1611		break;
1612
1613	case SMBADM_CMDF_USER:
1614		smb_pwd_init(B_FALSE);
1615		break;
1616
1617	default:
1618		break;
1619	}
1620
1621	return (0);
1622}
1623
1624static void
1625smbadm_fini(void)
1626{
1627	switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) {
1628	case SMBADM_CMDF_GROUP:
1629		smb_lgrp_stop();
1630		break;
1631
1632	case SMBADM_CMDF_USER:
1633		smb_pwd_fini();
1634		break;
1635
1636	default:
1637		break;
1638	}
1639}
1640
1641static boolean_t
1642smbadm_checkauth(const char *auth)
1643{
1644	struct passwd *pw;
1645
1646	if ((pw = getpwuid(getuid())) == NULL)
1647		return (B_FALSE);
1648
1649	if (chkauthattr(auth, pw->pw_name) == 0)
1650		return (B_FALSE);
1651
1652	return (B_TRUE);
1653}
1654
1655static boolean_t
1656smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval)
1657{
1658	smbadm_prop_handle_t *pinfo;
1659	int i;
1660
1661	for (i = 0; i < SMBADM_NPROP; i++) {
1662		pinfo = &smbadm_ptable[i];
1663		if (strcmp(pinfo->p_name, prop->p_name) == 0) {
1664			if (pinfo->p_chkfn && chkval)
1665				return (pinfo->p_chkfn(prop));
1666
1667			return (B_TRUE);
1668		}
1669	}
1670
1671	(void) fprintf(stderr, gettext("unrecognized property '%s'\n"),
1672	    prop->p_name);
1673
1674	return (B_FALSE);
1675}
1676
1677static int
1678smbadm_prop_parse(char *arg, smbadm_prop_t *prop)
1679{
1680	boolean_t parse_value;
1681	char *equal;
1682
1683	if (arg == NULL)
1684		return (2);
1685
1686	prop->p_name = prop->p_value = NULL;
1687
1688	if (strcmp(curcmd->name, "set") == 0)
1689		parse_value = B_TRUE;
1690	else
1691		parse_value = B_FALSE;
1692
1693	prop->p_name = arg;
1694
1695	if (parse_value) {
1696		equal = strchr(arg, '=');
1697		if (equal == NULL)
1698			return (2);
1699
1700		*equal++ = '\0';
1701		prop->p_value = equal;
1702	}
1703
1704	if (smbadm_prop_validate(prop, parse_value) == B_FALSE)
1705		return (2);
1706
1707	return (0);
1708}
1709
1710static smbadm_prop_handle_t *
1711smbadm_prop_gethandle(char *pname)
1712{
1713	int i;
1714
1715	for (i = 0; i < SMBADM_NPROP; i++)
1716		if (strcmp(pname, smbadm_ptable[i].p_name) == 0)
1717			return (&smbadm_ptable[i]);
1718
1719	return (NULL);
1720}
1721
1722static int
1723smbadm_setprop_desc(char *gname, smbadm_prop_t *prop)
1724{
1725	int status;
1726
1727	status = smb_lgrp_setcmnt(gname, prop->p_value);
1728	if (status != SMB_LGRP_SUCCESS) {
1729		(void) fprintf(stderr,
1730		    gettext("failed to modify the group description (%s)\n"),
1731		    smb_lgrp_strerror(status));
1732		return (1);
1733	}
1734
1735	(void) printf(gettext("%s: description modified\n"), gname);
1736	return (0);
1737}
1738
1739static int
1740smbadm_getprop_desc(char *gname, smbadm_prop_t *prop)
1741{
1742	char *cmnt = NULL;
1743	int status;
1744
1745	status = smb_lgrp_getcmnt(gname, &cmnt);
1746	if (status != SMB_LGRP_SUCCESS) {
1747		(void) fprintf(stderr,
1748		    gettext("failed to get the group description (%s)\n"),
1749		    smb_lgrp_strerror(status));
1750		return (1);
1751	}
1752
1753	(void) printf(gettext("\t%s: %s\n"), prop->p_name, cmnt);
1754	free(cmnt);
1755	return (0);
1756}
1757
1758static int
1759smbadm_group_setpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop)
1760{
1761	boolean_t enable;
1762	int status;
1763	int ret;
1764
1765	if (strcasecmp(prop->p_value, "on") == 0) {
1766		(void) printf(gettext("Enabling %s privilege "), prop->p_name);
1767		enable = B_TRUE;
1768	} else {
1769		(void) printf(gettext("Disabling %s privilege "), prop->p_name);
1770		enable = B_FALSE;
1771	}
1772
1773	status = smb_lgrp_setpriv(gname, priv_id, enable);
1774	if (status == SMB_LGRP_SUCCESS) {
1775		(void) printf(gettext("succeeded\n"));
1776		ret = 0;
1777	} else {
1778		(void) printf(gettext("failed: %s\n"),
1779		    smb_lgrp_strerror(status));
1780		ret = 1;
1781	}
1782
1783	return (ret);
1784}
1785
1786static int
1787smbadm_group_getpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop)
1788{
1789	boolean_t enable;
1790	int status;
1791
1792	status = smb_lgrp_getpriv(gname, priv_id, &enable);
1793	if (status != SMB_LGRP_SUCCESS) {
1794		(void) fprintf(stderr, gettext("failed to get %s (%s)\n"),
1795		    prop->p_name, smb_lgrp_strerror(status));
1796		return (1);
1797	}
1798
1799	(void) printf(gettext("\t%s: %s\n"), prop->p_name,
1800	    (enable) ? "On" : "Off");
1801
1802	return (0);
1803}
1804
1805static int
1806smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop)
1807{
1808	return (smbadm_group_setpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop));
1809}
1810
1811static int
1812smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop)
1813{
1814	return (smbadm_group_getpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop));
1815}
1816
1817static int
1818smbadm_setprop_readfile(char *gname, smbadm_prop_t *prop)
1819{
1820	return (smbadm_group_setpriv(gname, SE_READ_FILE_LUID, prop));
1821}
1822
1823static int
1824smbadm_getprop_readfile(char *gname, smbadm_prop_t *prop)
1825{
1826	return (smbadm_group_getpriv(gname, SE_READ_FILE_LUID, prop));
1827}
1828
1829static int
1830smbadm_setprop_writefile(char *gname, smbadm_prop_t *prop)
1831{
1832	return (smbadm_group_setpriv(gname, SE_WRITE_FILE_LUID, prop));
1833}
1834
1835static int
1836smbadm_getprop_writefile(char *gname, smbadm_prop_t *prop)
1837{
1838	return (smbadm_group_getpriv(gname, SE_WRITE_FILE_LUID, prop));
1839}
1840
1841static int
1842smbadm_setprop_backup(char *gname, smbadm_prop_t *prop)
1843{
1844	return (smbadm_group_setpriv(gname, SE_BACKUP_LUID, prop));
1845}
1846
1847static int
1848smbadm_getprop_backup(char *gname, smbadm_prop_t *prop)
1849{
1850	return (smbadm_group_getpriv(gname, SE_BACKUP_LUID, prop));
1851}
1852
1853static int
1854smbadm_setprop_restore(char *gname, smbadm_prop_t *prop)
1855{
1856	return (smbadm_group_setpriv(gname, SE_RESTORE_LUID, prop));
1857}
1858
1859static int
1860smbadm_getprop_restore(char *gname, smbadm_prop_t *prop)
1861{
1862	return (smbadm_group_getpriv(gname, SE_RESTORE_LUID, prop));
1863}
1864
1865static boolean_t
1866smbadm_chkprop_priv(smbadm_prop_t *prop)
1867{
1868	if (prop->p_value == NULL || *prop->p_value == '\0') {
1869		(void) fprintf(stderr,
1870		    gettext("missing value for '%s'\n"), prop->p_name);
1871		return (B_FALSE);
1872	}
1873
1874	if (strcasecmp(prop->p_value, "on") == 0)
1875		return (B_TRUE);
1876
1877	if (strcasecmp(prop->p_value, "off") == 0)
1878		return (B_TRUE);
1879
1880	(void) fprintf(stderr,
1881	    gettext("%s: unrecognized value for '%s' property\n"),
1882	    prop->p_value, prop->p_name);
1883
1884	return (B_FALSE);
1885}
1886
1887static const char *
1888smbadm_pwd_strerror(int error)
1889{
1890	switch (error) {
1891	case SMB_PWE_SUCCESS:
1892		return (gettext("Success."));
1893
1894	case SMB_PWE_USER_UNKNOWN:
1895		return (gettext("User does not exist."));
1896
1897	case SMB_PWE_USER_DISABLE:
1898		return (gettext("User is disabled."));
1899
1900	case SMB_PWE_CLOSE_FAILED:
1901	case SMB_PWE_OPEN_FAILED:
1902	case SMB_PWE_WRITE_FAILED:
1903	case SMB_PWE_UPDATE_FAILED:
1904		return (gettext("Unexpected failure. "
1905		    "SMB password database unchanged."));
1906
1907	case SMB_PWE_STAT_FAILED:
1908		return (gettext("stat of SMB password file failed."));
1909
1910	case SMB_PWE_BUSY:
1911		return (gettext("SMB password database busy. "
1912		    "Try again later."));
1913
1914	case SMB_PWE_DENIED:
1915		return (gettext("Operation not permitted."));
1916
1917	case SMB_PWE_SYSTEM_ERROR:
1918		return (gettext("System error."));
1919
1920	default:
1921		break;
1922	}
1923
1924	return (gettext("Unknown error code."));
1925}
1926
1927/*
1928 * Enable libumem debugging by default on DEBUG builds.
1929 */
1930#ifdef DEBUG
1931const char *
1932_umem_debug_init(void)
1933{
1934	return ("default,verbose"); /* $UMEM_DEBUG setting */
1935}
1936
1937const char *
1938_umem_logging_init(void)
1939{
1940	return ("fail,contents"); /* $UMEM_LOGGING setting */
1941}
1942#endif
1943