#include "stdafx.h"

#include "exchange.hpp"

#include "common.hpp"
#include "err.hpp"
#include "ErrDct.hpp"
#include "UString.hpp"

#include "sidcache.hpp"
#include "sd.hpp"
#include "SecObj.hpp"
#include "exldap.h"

#include "Mcs.h"
#include "folders.h"
#include "treg.hpp"

using namespace nsFolders;

extern TErrorDct     err;

#define NOT_PT_ERROR(x) ( PROP_TYPE(x.ulPropTag) != PT_ERROR )

#define LDAP_PortNumber_DN_Part          L"/cn=Protocols/cn=LDAP"
#define ATT_OBJ_CLASS          L"Obj-Class"
#define ATT_DIST_NAME          L"Obj-Dist-Name"
#define ATT_LDAP_PORT          L"Port-Number"
#define LDAP_USE_SITE_VALUES     L"Use-Site-Values"


TGlobalDirectory::TGlobalDirectory()
{
   m_stat                     = NULL;
}

TGlobalDirectory::~TGlobalDirectory()
{
}

#define NDX_SID         3
#define NDX_SD          4

void 
   TGlobalDirectory::GetSiteNameForServer(
      WCHAR          const * server,                  // in - name of exchange server to use
      CLdapEnum            * e,                       // in - LDAP connection to use for query
      WCHAR                * siteName                 // out- distinguished name of exchange site for server
      )
{
   WCHAR                   * atts[6] = { L"distinguishedName", L"rdn",NULL };
   WCHAR                     query[200];
   DWORD                     rc;
   WCHAR                  ** values = NULL;
   siteName[0] = 0;
   
   swprintf(query,L"(&(objectClass=computer)(rdn=%ls))",server);
   rc = e->Open(query,L"",2,100,3,atts);
   // there should be only one server with this name
   if (! rc )
      rc = e->Next(&values);
   if (! rc )
   {
      if ( !UStrICmp(values[1],server) )
      {
         WCHAR       serverPrefix[LEN_Path];
         _snwprintf(serverPrefix,DIM(serverPrefix),L"cn=%ls,cn=Servers,cn=Configuration,",values[1]);
         serverPrefix[DIM(serverPrefix) - 1] = L'\0';
         if ( ! UStrICmp(values[0],serverPrefix,UStrLen(serverPrefix)) )
         {
            UStrCpy(siteName,values[0] + UStrLen(serverPrefix),LEN_Path);
         }
         else
         {
            err.MsgWrite(ErrE,DCT_MSG_GENERIC_S,values[0]);
         }
      }
      else
      {
         err.MsgWrite(ErrE,DCT_MSG_LDAP_CALL_FAILED_SD,server,ERROR_NOT_FOUND);
      }
      e->FreeData(values);
   }
   else
   {
      err.SysMsgWrite(ErrE,e->m_connection.LdapMapErrorToWin32(rc),DCT_MSG_LDAP_CALL_FAILED_SD,server,rc);
   }

}


BOOL 
   TGlobalDirectory::DoLdapTranslation(
      WCHAR                  * server,
      WCHAR                  * domain,
      WCHAR                  * user,
      WCHAR                  * password,
      SecurityTranslatorArgs * args,
      WCHAR                  * basept,
      WCHAR                  * query
   )
{
   CLdapEnum                 e;
   WCHAR                   * atts[6] = { L"distinguishedName", L"rdn", L"cn", L"Assoc-NT-Account",L"NT-Security-Descriptor",NULL };
   WCHAR                  ** values = NULL;
   DWORD ldapPort, sslPort;
   GetLDAPPort(&ldapPort, &sslPort);
   ULONG                     pageSize = 100;
   WCHAR                     basepoint[LEN_Path] = L"";

   e.m_connection.SetCredentials(domain,user,password);

   BOOL sslEnabled = FALSE;
   SetLastError(0);
   // try SSL port first
   DWORD rc  = e.InitSSLConnection(server,&sslEnabled,sslPort);

   if (rc || sslEnabled == FALSE)
   {
        WCHAR* serverName = (server == NULL) ? L"" : server;
        if (rc == 0)
            err.MsgWrite(ErrW, DCT_MSG_CANNOT_ESTABLISH_SSL_CONNECTION_WITH_EXCHANGE_SERVER_WITHOUT_RC_SD, serverName, sslPort);
        else
            err.SysMsgWrite(ErrW, rc, DCT_MSG_CANNOT_ESTABLISH_SSL_CONNECTION_WITH_EXCHANGE_SERVER_WITH_RC_SDD, serverName, sslPort,rc);
        err.MsgWrite(ErrI, DCT_MSG_USE_REGULAR_PORT_DS, ldapPort, serverName);
        rc = e.InitConnection(server, ldapPort);
   }
        
   BOOL                      anychange = FALSE;
   BOOL                      verbose = args->LogVerbose();
   BOOL						 bUseMapFile = args->UsingMapFile();


   if (! rc )
   {
      if ( ! basept )
      {
         GetSiteNameForServer(server,&e,basepoint);
      }
      else
      {
         // use the user-specified basepoint
         safecopy(basepoint,basept);
      }
      if ( query )
      {
         rc = e.Open(query,basepoint,2,pageSize,5,atts);  
      }
      else 
      {
         rc = e.Open(L"(objectClass=*)",basepoint,2,pageSize,5,atts);
      }
      if ( ! rc )
      {
         do 
         {
            rc = e.Next(&values);
            anychange = FALSE;
            if (! rc )
            {
               if ( args->Cache()->IsCancelled() )
               {
                  err.MsgWrite(0,DCT_MSG_OPERATION_ABORTED);
                  return FALSE;
               }
               if ( m_stat )
               {
                  m_stat->DisplayPath(values[0]);
                  m_stat->IncrementExamined(mailbox);
               }

               // update the Assoc-NT-Account, if any
               if ( values[NDX_SID] && *values[NDX_SID] )
               {
                  // convert the SID to a binary value and look it up in the cache
                  BYTE              pSid[500];

                  if ( e.m_connection.StringToBytes(values[NDX_SID],pSid) )
                  {
                     
                     // check if the sid is one we need to change            
                     //TRACE (_T("DisplayName = %s "),pUserProperties[0].Value.lpszW);
                     PSID newSid = 0;
                     TAcctNode * node;

                     if ( IsValidSid(pSid) )
                     {
                        if (!bUseMapFile)
                           node = args->Cache()->Lookup(pSid); 
                        else
                           node = args->Cache()->LookupWODomain(pSid); 
                        if ( m_stat )
                        {
                           m_stat->IncrementOwnerExamined();
                           if ( verbose )
                              err.MsgWrite(0,DCT_MSG_EXAMINED_S,values[0]);
                        }
                        if ( node == (TAcctNode*)-1  && m_stat )
                           m_stat->IncrementOwnerNoTarget();

                        if ( node && (node != (TAcctNode *)-1) && node->IsValidOnTgt() )
                        {
	                    if (!bUseMapFile)
                              newSid = args->Cache()->GetTgtSid(node);
	                    else
                              newSid = args->Cache()->GetTgtSidWODomain(node);
                        }
                        else
                        {
                           newSid = NULL;
                           m_stat->IncrementOwnerNoTarget();
                        }
                     }
                     else
                     {
                        newSid = NULL;
                     }
                     if ( newSid )
                     {
                        //TRACE (_T("needs to be translated\n"));
                        MCSASSERT ( IsValidSid(newSid) );
                        WCHAR                newSidStr[1000];

                        if ( e.m_connection.BytesToString((BYTE*)newSid,newSidStr,GetLengthSid(newSid)) )
                        {
                           if ( !args->NoChange() )
                           {
                              rc = e.m_connection.UpdateSimpleStringValue(values[0],atts[NDX_SID],newSidStr);

                              if ( rc ) 
                              {
                                 err.SysMsgWrite(ErrE,rc,DCT_MSG_UPDATE_ACCOUNT_FAILED_D, rc);
                              }
                              else
                                anychange = TRUE;
                           }
                           if ( anychange && m_stat )
                           {
                              m_stat->IncrementOwnerChange(node,mailbox,NULL);
                           }

                        }
                     }
                  }
                  
               }

               // this variable determines whether we should continue mailbox translation
               DWORD dwContinueRC = ERROR_SUCCESS;
               
               // Update the NT-Security-Descriptor, if any
               // however, we do not try to roll back if anything wrong happens in this part
               if ( values[NDX_SD] && *values[NDX_SD] )
               {
                  // convert the SID to a binary value and look it up in the cache
                  BYTE            * pSD = new BYTE[UStrLen(values[NDX_SD])];
				  if (!pSD)
				    dwContinueRC = ERROR_OUTOFMEMORY;

                  if ( dwContinueRC == ERROR_SUCCESS && e.m_connection.StringToBytes(values[NDX_SD],pSD) )
                  {
                     TMapiSD   tMailbox((SECURITY_DESCRIPTOR *)pSD);
                     if ( tMailbox.HasSecurity() )
                     {
                        TSD               * pSD = tMailbox.GetSecurity();

                        bool  changes = tMailbox.ResolveSDInternal(args->Cache(),m_stat,verbose,args->TranslationMode(),mailbox, bUseMapFile);
         
                        if ( changes )
                        {
                           SECURITY_DESCRIPTOR * pRelSD = (SECURITY_DESCRIPTOR *)pSD->MakeRelSD();
                           if (pRelSD == NULL)
                            dwContinueRC = ERROR_OUTOFMEMORY;
                           
                           if ( dwContinueRC == ERROR_SUCCESS && ! args->NoChange() )
                           {     
                              DWORD                 dwSDLength = GetSecurityDescriptorLength(pRelSD);
                           
                              WCHAR * pSDString = new WCHAR[1 + dwSDLength * 2];
							  if (!pSDString)
							    dwContinueRC = ERROR_OUTOFMEMORY;

                              if  ( dwContinueRC == ERROR_SUCCESS && e.m_connection.BytesToString((BYTE*)pRelSD,pSDString,dwSDLength) )
                              {
                                 rc = e.m_connection.UpdateSimpleStringValue(values[0],atts[NDX_SD],pSDString);
                                 if ( rc )
                                 {
                                    err.SysMsgWrite(ErrE,rc,DCT_MSG_RECIP_SD_WRITE_FAILED_SD,values[0],rc);
                                    if ( rc == ERROR_INVALID_PARAMETER )
                                    {
                                       // this error occurs when the security descriptor is too large
                                       // don't abort in this case
                                       rc = 0;
                                    }
                                 }
                                 else
                                    anychange = TRUE;
                  
                              }
                              delete [] pSDString;
                           }

                           if (pRelSD)
                            free(pRelSD);
                        }
                     }
                  }
                  delete [] pSD;
               }
               
               if ( anychange && m_stat )
               {
                  m_stat->IncrementChanged(mailbox);
                  err.MsgWrite(0, DCT_MSG_MAILBOX_HAS_BEEN_UPDATED_S, values[0]);
               }

               if (dwContinueRC != ERROR_SUCCESS)
               {
                if (anychange)
                    err.SysMsgWrite(ErrE,dwContinueRC,DCT_MSG_MAILBOX_TRANSLATION_ABORTED_WITH_UPDATE_SD,values[0],dwContinueRC);
                else    
                    err.SysMsgWrite(ErrE,dwContinueRC,DCT_MSG_MAILBOX_TRANSLATION_ABORTED_SD,values[0],dwContinueRC);
                e.FreeData(values);
                return FALSE;
               }

               e.FreeData(values);

            }

         } while ( ! rc );
      }
      if ( rc && (rc != LDAP_COMPARE_FALSE) && (rc != ERROR_NOT_FOUND) )
      {
         err.SysMsgWrite(ErrE,e.m_connection.LdapMapErrorToWin32(rc),DCT_MSG_LDAP_CALL_FAILED_SD,server,rc);
      }
   }
   else
   {
      err.SysMsgWrite(ErrE,rc,DCT_MSG_CANNOT_CONNECT_TO_EXCHANGE_SERVER_SSD,server,domain,user,rc);
   }         
   
   return rc;
}