2 Unix SMB/CIFS implementation.
3 Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "param/pyparam.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
30 #include "python/py3compat.h"
32 /* A Python C API module to use LIBGPO */
34 #define GPO_getter(ATTR) \
35 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
37 struct GROUP_POLICY_OBJECT *gpo_ptr \
38 = pytalloc_get_ptr(self); \
41 return PyStr_FromString(gpo_ptr->ATTR); \
46 GPO_getter(file_sys_path
)
47 GPO_getter(display_name
)
50 GPO_getter(user_extensions
)
51 GPO_getter(machine_extensions
)
53 static PyGetSetDef GPO_setters
[] = {
54 {discard_const_p(char, "ds_path"), (getter
)GPO_get_ds_path
, NULL
, NULL
,
56 {discard_const_p(char, "file_sys_path"), (getter
)GPO_get_file_sys_path
,
58 {discard_const_p(char, "display_name"), (getter
)GPO_get_display_name
,
60 {discard_const_p(char, "name"), (getter
)GPO_get_name
, NULL
, NULL
,
62 {discard_const_p(char, "link"), (getter
)GPO_get_link
, NULL
, NULL
,
64 {discard_const_p(char, "user_extensions"),
65 (getter
)GPO_get_user_extensions
,
67 {discard_const_p(char, "machine_extensions"),
68 (getter
)GPO_get_machine_extensions
, NULL
, NULL
, NULL
},
72 static PyObject
*py_gpo_get_unix_path(PyObject
*self
, PyObject
*args
,
76 const char *cache_dir
= NULL
;
78 char *unix_path
= NULL
;
79 TALLOC_CTX
*frame
= NULL
;
80 static const char *kwlist
[] = {"cache_dir", NULL
};
81 struct GROUP_POLICY_OBJECT
*gpo_ptr \
82 = (struct GROUP_POLICY_OBJECT
*)pytalloc_get_ptr(self
);
84 frame
= talloc_stackframe();
86 if (!PyArg_ParseTupleAndKeywords(args
, kwds
, "|s",
87 discard_const_p(char *, kwlist
),
93 cache_dir
= cache_path(talloc_tos(), GPO_CACHE_DIR
);
95 PyErr_SetString(PyExc_MemoryError
,
96 "Failed to determine gpo cache dir");
101 status
= gpo_get_unix_path(frame
, cache_dir
, gpo_ptr
, &unix_path
);
103 if (!NT_STATUS_IS_OK(status
)) {
104 PyErr_Format(PyExc_RuntimeError
,
105 "Failed to determine gpo unix path: %s",
106 get_friendly_nt_error_msg(status
));
110 ret
= PyStr_FromString(unix_path
);
117 static PyMethodDef GPO_methods
[] = {
118 {"get_unix_path", (PyCFunction
)py_gpo_get_unix_path
, METH_KEYWORDS
,
123 static PyTypeObject GPOType
= {
124 PyVarObject_HEAD_INIT(NULL
, 0)
125 .tp_name
= "gpo.GROUP_POLICY_OBJECT",
126 .tp_doc
= "GROUP_POLICY_OBJECT",
127 .tp_getset
= GPO_setters
,
128 .tp_methods
= GPO_methods
,
129 .tp_flags
= Py_TPFLAGS_DEFAULT
| Py_TPFLAGS_BASETYPE
,
136 struct cli_credentials
*cli_creds
;
139 static void py_ads_dealloc(ADS
* self
)
141 ads_destroy(&(self
->ads_ptr
));
142 Py_CLEAR(self
->py_creds
);
143 Py_TYPE(self
)->tp_free((PyObject
*)self
);
146 static PyObject
* py_ads_connect(ADS
*self
);
147 static int py_ads_init(ADS
*self
, PyObject
*args
, PyObject
*kwds
)
149 const char *realm
= NULL
;
150 const char *workgroup
= NULL
;
151 const char *ldap_server
= NULL
;
152 PyObject
*lp_obj
= NULL
;
153 PyObject
*py_creds
= NULL
;
154 struct loadparm_context
*lp_ctx
= NULL
;
157 static const char *kwlist
[] = {
158 "ldap_server", "loadparm_context", "credentials", NULL
160 if (!PyArg_ParseTupleAndKeywords(args
, kwds
, "sO|O",
161 discard_const_p(char *, kwlist
),
162 &ldap_server
, &lp_obj
, &py_creds
)) {
165 /* keep reference to the credentials. Clear any earlier ones */
166 Py_CLEAR(self
->py_creds
);
167 self
->cli_creds
= NULL
;
168 self
->py_creds
= py_creds
;
169 Py_XINCREF(self
->py_creds
);
171 if (self
->py_creds
) {
172 ok
= py_check_dcerpc_type(self
->py_creds
, "samba.credentials",
178 = PyCredentials_AsCliCredentials(self
->py_creds
);
181 ok
= py_check_dcerpc_type(lp_obj
, "samba.param", "LoadParm");
185 lp_ctx
= pytalloc_get_type(lp_obj
, struct loadparm_context
);
186 if (lp_ctx
== NULL
) {
189 ok
= lp_load_initial_only(lp_ctx
->szConfigFile
);
191 PyErr_Format(PyExc_RuntimeError
, "Could not load config file '%s'",
192 lp_ctx
->szConfigFile
);
196 if (self
->cli_creds
) {
197 realm
= cli_credentials_get_realm(self
->cli_creds
);
198 workgroup
= cli_credentials_get_domain(self
->cli_creds
);
201 workgroup
= lp_workgroup();
204 /* in case __init__ is called more than once */
206 ads_destroy(&self
->ads_ptr
);
207 self
->ads_ptr
= NULL
;
209 /* always succeeds or crashes */
210 self
->ads_ptr
= ads_init(realm
, workgroup
, ldap_server
);
215 /* connect. Failure to connect results in an Exception */
216 static PyObject
* py_ads_connect(ADS
*self
)
219 TALLOC_CTX
*frame
= talloc_stackframe();
220 if (!self
->ads_ptr
) {
221 PyErr_SetString(PyExc_RuntimeError
, "Uninitialized");
224 SAFE_FREE(self
->ads_ptr
->auth
.user_name
);
225 SAFE_FREE(self
->ads_ptr
->auth
.password
);
226 SAFE_FREE(self
->ads_ptr
->auth
.realm
);
227 if (self
->cli_creds
) {
228 self
->ads_ptr
->auth
.user_name
=
229 SMB_STRDUP(cli_credentials_get_username(self
->cli_creds
));
230 self
->ads_ptr
->auth
.password
=
231 SMB_STRDUP(cli_credentials_get_password(self
->cli_creds
));
232 self
->ads_ptr
->auth
.realm
=
233 SMB_STRDUP(cli_credentials_get_realm(self
->cli_creds
));
234 self
->ads_ptr
->auth
.flags
|= ADS_AUTH_USER_CREDS
;
235 status
= ads_connect_user_creds(self
->ads_ptr
);
239 if (!secrets_init()) {
240 PyErr_SetString(PyExc_RuntimeError
,
241 "secrets_init() failed");
245 passwd
= secrets_fetch_machine_password(self
->ads_ptr
->server
.workgroup
,
247 if (passwd
== NULL
) {
248 PyErr_SetString(PyExc_RuntimeError
,
249 "Failed to fetch the machine account "
253 ret
= asprintf(&(self
->ads_ptr
->auth
.user_name
), "%s$",
260 self
->ads_ptr
->auth
.password
= passwd
; /* take ownership of this data */
261 self
->ads_ptr
->auth
.realm
=
262 SMB_STRDUP(self
->ads_ptr
->server
.realm
);
263 if (!strupper_m(self
->ads_ptr
->auth
.realm
)) {
264 PyErr_SetString(PyExc_RuntimeError
, "Failed to strupper");
267 self
->ads_ptr
->auth
.flags
|= ADS_AUTH_USER_CREDS
;
268 status
= ads_connect(self
->ads_ptr
);
270 if (!ADS_ERR_OK(status
)) {
271 PyErr_Format(PyExc_RuntimeError
,
272 "ads_connect() failed: %s",
285 /* Parameter mapping and functions for the GP_EXT struct */
288 /* Global methods aka do not need a special pyobject type */
289 static PyObject
*py_gpo_get_sysvol_gpt_version(PyObject
* self
,
292 TALLOC_CTX
*tmp_ctx
= NULL
;
294 char *display_name
= NULL
;
295 uint32_t sysvol_version
= 0;
299 if (!PyArg_ParseTuple(args
, "s", &unix_path
)) {
302 tmp_ctx
= talloc_new(NULL
);
304 return PyErr_NoMemory();
306 status
= gpo_get_sysvol_gpt_version(tmp_ctx
, unix_path
,
309 if (!NT_STATUS_IS_OK(status
)) {
310 PyErr_SetNTSTATUS(status
);
311 TALLOC_FREE(tmp_ctx
);
315 result
= Py_BuildValue("[s,i]", display_name
, sysvol_version
);
316 talloc_free(tmp_ctx
);
321 static ADS_STATUS
find_samaccount(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
322 const char *samaccountname
,
323 uint32_t *uac_ret
, const char **dn_ret
)
326 const char *attrs
[] = { "userAccountControl", NULL
};
328 LDAPMessage
*res
= NULL
;
332 filter
= talloc_asprintf(mem_ctx
, "(sAMAccountName=%s)",
334 if (filter
== NULL
) {
335 status
= ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
339 status
= ads_do_search_all(ads
, ads
->config
.bind_path
,
340 LDAP_SCOPE_SUBTREE
, filter
, attrs
, &res
);
342 if (!ADS_ERR_OK(status
)) {
346 if (ads_count_replies(ads
, res
) != 1) {
347 status
= ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
351 dn
= ads_get_dn(ads
, talloc_tos(), res
);
353 status
= ADS_ERROR(LDAP_NO_MEMORY
);
357 if (!ads_pull_uint32(ads
, res
, "userAccountControl", &uac
)) {
358 status
= ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE
);
367 *dn_ret
= talloc_strdup(mem_ctx
, dn
);
368 if (*dn_ret
== NULL
) {
369 status
= ADS_ERROR(LDAP_NO_MEMORY
);
375 ads_msgfree(ads
, res
);
380 static PyObject
*py_ads_get_gpo_list(ADS
*self
, PyObject
*args
, PyObject
*kwds
)
382 TALLOC_CTX
*frame
= NULL
;
383 struct GROUP_POLICY_OBJECT
*gpo
= NULL
, *gpo_list
= NULL
;
385 const char *samaccountname
= NULL
;
386 const char *dn
= NULL
;
389 struct security_token
*token
= NULL
;
390 PyObject
*ret
= NULL
;
391 TALLOC_CTX
*gpo_ctx
= NULL
;
395 static const char *kwlist
[] = {"samaccountname", NULL
};
396 if (!PyArg_ParseTupleAndKeywords(args
, kwds
, "s",
397 discard_const_p(char *, kwlist
),
401 if (!self
->ads_ptr
) {
402 PyErr_SetString(PyExc_RuntimeError
, "Uninitialized");
406 frame
= talloc_stackframe();
408 status
= find_samaccount(self
->ads_ptr
, frame
,
409 samaccountname
, &uac
, &dn
);
410 if (!ADS_ERR_OK(status
)) {
411 PyErr_Format(PyExc_RuntimeError
,
412 "Failed to find samAccountName '%s': %s",
413 samaccountname
, ads_errstr(status
));
417 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
||
418 uac
& UF_SERVER_TRUST_ACCOUNT
) {
419 flags
|= GPO_LIST_FLAG_MACHINE
;
420 status
= gp_get_machine_token(self
->ads_ptr
, frame
, dn
,
422 if (!ADS_ERR_OK(status
)) {
423 PyErr_Format(PyExc_RuntimeError
,
424 "Failed to get machine token for '%s'(%s): %s",
425 samaccountname
, dn
, ads_errstr(status
));
429 status
= ads_get_sid_token(self
->ads_ptr
, frame
, dn
, &token
);
430 if (!ADS_ERR_OK(status
)) {
431 PyErr_Format(PyExc_RuntimeError
,
432 "Failed to get sid token for '%s'(%s): %s",
433 samaccountname
, dn
, ads_errstr(status
));
438 gpo_ctx
= talloc_new(frame
);
443 status
= ads_get_gpo_list(self
->ads_ptr
, gpo_ctx
, dn
, flags
, token
,
445 if (!ADS_ERR_OK(status
)) {
446 PyErr_Format(PyExc_RuntimeError
,
447 "Failed to fetch GPO list: %s",
452 /* Convert the C linked list into a python list */
454 for (gpo
= gpo_list
; gpo
!= NULL
; gpo
= gpo
->next
) {
459 ret
= PyList_New(list_size
);
464 for (gpo
= gpo_list
; gpo
!= NULL
; gpo
= gpo
->next
) {
465 PyObject
*obj
= pytalloc_reference_ex(&GPOType
,
472 PyList_SetItem(ret
, i
, obj
);
477 TALLOC_FREE(gpo_ctx
);
484 static PyMethodDef ADS_methods
[] = {
485 { "connect", (PyCFunction
)py_ads_connect
, METH_NOARGS
,
486 "Connect to the LDAP server" },
488 { "get_gpo_list", (PyCFunction
)py_ads_get_gpo_list
, METH_VARARGS
| METH_KEYWORDS
,
494 static PyTypeObject ads_ADSType
= {
495 .tp_name
= "gpo.ADS_STRUCT",
496 .tp_basicsize
= sizeof(ADS
),
497 .tp_dealloc
= (destructor
)py_ads_dealloc
,
498 .tp_flags
= Py_TPFLAGS_DEFAULT
,
499 .tp_doc
= "ADS struct",
500 .tp_methods
= ADS_methods
,
501 .tp_init
= (initproc
)py_ads_init
,
504 static PyMethodDef py_gpo_methods
[] = {
505 {"gpo_get_sysvol_gpt_version",
506 (PyCFunction
)py_gpo_get_sysvol_gpt_version
,
511 static struct PyModuleDef moduledef
= {
512 PyModuleDef_HEAD_INIT
,
514 .m_doc
= "libgpo python bindings",
516 .m_methods
= py_gpo_methods
,
519 /* Will be called by python when loading this module */
522 MODULE_INIT_FUNC(gpo
)
526 debug_setup_talloc_log();
528 /* Instantiate the types */
529 m
= PyModule_Create(&moduledef
);
534 if (PyModule_AddObject(m
, "version",
535 PyStr_FromString(SAMBA_VERSION_STRING
)) ) {
539 ads_ADSType
.tp_new
= PyType_GenericNew
;
540 if (PyType_Ready(&ads_ADSType
) < 0) {
544 Py_INCREF(&ads_ADSType
);
545 if (PyModule_AddObject(m
, "ADS_STRUCT", (PyObject
*)&ads_ADSType
)) {
549 if (pytalloc_BaseObject_PyType_Ready(&GPOType
) < 0) {
553 Py_INCREF((PyObject
*)(void *)&GPOType
);
554 if (PyModule_AddObject(m
, "GROUP_POLICY_OBJECT",
555 (PyObject
*)&GPOType
)) {