test

    src/krb5.cpp

    src/gssapi.cpp

    src/sasl.cpp

    src/discover.cpp

    src/join.cpp

)

target_link_libraries(adconnect_core PUBLIC adconnect_proto confplus::confplus netplus::netplus Threads::Threads)

#include "cache.h"

#include "config.h"

#include "directory.h"

#include "join.h"

#include "protocol.h"

using namespace adconnect;

void usage() {

    std::cerr << "usage: adconnectd [-c config] [-n | -t | -q \"REQUEST\"]\n"

                 "       adconnectd -j DOMAIN -u ADMIN [-s SECRETDIR]   (the password on stdin)\n"

                 "  -j  join DOMAIN: a computer account for this system, made with the\n"

                 "      administrator's password; prints the settings for adconnect.yaml\n"

                 "  -n  only read the configuration (no network), then exit\n"

                 "  -t  connect and bind to a domain controller of each domain, then exit\n"

                 "  -q  answer one request (\"PWNAM jan\", \"GROUPS jan\", ...) and exit\n";

    std::string configPath = ADCONNECT_CONFIG, query;

    bool check = false, parseOnly = false;

    std::string joinDomainName, joinAdmin, secretDir = "/etc/adconnect";

    int opt;

    while ((opt = getopt(argc, argv, "c:ntq:h")) != -1) {

    while ((opt = getopt(argc, argv, "c:ntq:j:u:s:h")) != -1) {

        switch (opt) {

        case 'c': configPath = optarg; break;

        case 'j': joinDomainName = optarg; break;

        case 'u': joinAdmin = optarg; break;

        case 's': secretDir = optarg; break;

        case 'n': parseOnly = true; break;

        case 't': check = true; break;

        case 'q': query = optarg; break;

        }

    }

    if (!joinDomainName.empty()) {

        if (joinAdmin.empty()) {

            usage();

            return 2;

        }

        std::string password;

        std::getline(std::cin, password);

        while (!password.empty() && (password.back() == '\r' || password.back() == '\n')) password.pop_back();

        try {

            JoinResult r = joinDomain(joinDomainName, joinAdmin, password, secretDir);

            std::string servers;

            for (const std::string &s : r.servers) servers += (servers.empty() ? "" : " ") + s;

            std::cout << "domain=" << r.domain << "\nrealm=" << r.realm << "\nbase=" << r.base << "\nservers=" << servers

                      << "\nprincipal=" << r.principal << "\nsecret_file=" << r.secretFile

                      << "\ncreated=" << (r.created ? "yes" : "no") << std::endl;

        } catch (const std::exception &e) {

            std::cerr << "adconnectd: joining " << joinDomainName << ": " << e.what() << std::endl;

            return 1;

        }

        return 0;

    }

    std::vector<Config> configs;

    try {

        configs = loadConfigs(configPath);

    ensure();

}

void LdapSource::add(const std::string &dn, const ldap::Connection::Attributes &attrs) {

    ensure();

    _conn.add(dn, attrs);

}

void LdapSource::modify(const std::string &dn,

                        const std::vector<std::pair<ldap::Connection::ModOp, ldap::Connection::Attributes::value_type>> &changes) {

    ensure();

    _conn.modify(dn, changes);

}

void LdapSource::search(const std::string &base, ldap::Scope scope, const std::string &filter,

                        const std::vector<std::string> &attrs,

                        const std::function<void(const ldap::Entry &)> &cb, int pageSize) {

                int pageSize) override;

    /* connects and binds now; throws ldap::Error */

    void check();

    /* writes, on the bound connection (for the domain join) */

    void add(const std::string &dn, const ldap::Connection::Attributes &attrs);

    void modify(const std::string &dn,

                const std::vector<std::pair<ldap::Connection::ModOp, ldap::Connection::Attributes::value_type>> &changes);

private:

    void ensure();

/*******************************************************************************

Copyright (c) 2026, Jan Koester jan.koester@gmx.net

All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright

      notice, this list of conditions and the following disclaimer.

    * Redistributions in binary form must reproduce the above copyright

      notice, this list of conditions and the following disclaimer in the

      documentation and/or other materials provided with the distribution.

    * Neither the name of the <organization> nor the

      names of its contributors may be used to endorse or promote products

      derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND

ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*******************************************************************************/

#include "discover.h"

#include <algorithm>

#include <arpa/nameser.h>

#include <netinet/in.h>

#include <resolv.h>

namespace adconnect {

namespace {

/* a possibly compressed name at off; advances off past it (in the record) */

bool readName(const unsigned char *msg, size_t len, size_t &off, std::string &out) {

    out.clear();

    size_t p = off;

    bool jumped = false;

    for (int hops = 0; hops < 64; hops++) {

        if (p >= len) return false;

        unsigned l = msg[p];

        if ((l & 0xc0) == 0xc0) {

            if (p + 1 >= len) return false;

            size_t target = (size_t)(l & 0x3f) << 8 | msg[p + 1];

            if (!jumped) off = p + 2;

            jumped = true;

            p = target;

            continue;

        }

        if (l == 0) {

            if (!jumped) off = p + 1;

            return true;

        }

        if (l > 63 || p + 1 + l > len) return false;

        if (!out.empty()) out += '.';

        out.append((const char *)msg + p + 1, l);

        p += 1 + l;

    }

    return false;

}

uint16_t u16(const unsigned char *p) { return (uint16_t)(p[0] << 8 | p[1]); }

} // namespace

std::vector<SrvRecord> parseSrv(const unsigned char *msg, size_t len) {

    std::vector<SrvRecord> out;

    if (len < 12) return out;

    unsigned qd = u16(msg + 4), an = u16(msg + 6);

    size_t off = 12;

    std::string name;

    for (unsigned i = 0; i < qd; i++) {

        if (!readName(msg, len, off, name) || off + 4 > len) return out;

        off += 4;  /* type, class */

    }

    for (unsigned i = 0; i < an; i++) {

        if (!readName(msg, len, off, name) || off + 10 > len) return out;

        unsigned type = u16(msg + off), rdlen = u16(msg + off + 8);

        off += 10;

        if (off + rdlen > len) return out;

        if (type == 33 && rdlen >= 7) {

            SrvRecord r;

            r.priority = u16(msg + off);

            r.weight = u16(msg + off + 2);

            r.port = u16(msg + off + 4);

            size_t t = off + 6;

            if (readName(msg, len, t, r.target) && !r.target.empty()) out.push_back(r);

        }

        off += rdlen;

    }

    return out;

}

std::vector<std::string> findDomainControllers(const std::string &domain) {

    unsigned char answer[4096];

    int n = res_query(("_ldap._tcp.dc._msdcs." + domain).c_str(), 1 /* IN */, 33 /* SRV */, answer, sizeof answer);

    std::vector<std::string> out;

    if (n <= 0) return out;

    std::vector<SrvRecord> recs = parseSrv(answer, (size_t)n);

    std::stable_sort(recs.begin(), recs.end(), [](const SrvRecord &a, const SrvRecord &b) {

        return a.priority != b.priority ? a.priority < b.priority : a.weight > b.weight;

    });

    for (const SrvRecord &r : recs) {

        std::string t = r.target;

        for (char &c : t) c = (char)tolower((unsigned char)c);

        if (std::find(out.begin(), out.end(), t) == out.end()) out.push_back(t);

    }

    return out;

}

} // namespace adconnect