libgpo/pygpo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include <Python.h>
  20 #include "includes.h"
  21 #include "version.h"
  22 #include "param/pyparam.h"
  23 #include "gpo.h"
  24 #include "ads.h"
  25 #include "secrets.h"
  26 #include "../libds/common/flags.h"
  27 #include "librpc/rpc/pyrpc_util.h"
  28 #include "auth/credentials/pycredentials.h"
  29 #include "libcli/util/pyerrors.h"
  30
  31 /* A Python C API module to use LIBGPO */
  32
  33 #define GPO_getter(ATTR) \
  34 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
  35 { \
  36         struct GROUP_POLICY_OBJECT *gpo_ptr \
  37                 = pytalloc_get_ptr(self); \
  38         \
  39         if (gpo_ptr->ATTR) \
  40                 return PyString_FromString(gpo_ptr->ATTR); \
  41         else \
  42                 return Py_None; \
  43 }
  44 GPO_getter(ds_path)
  45 GPO_getter(file_sys_path)
  46 GPO_getter(display_name)
  47 GPO_getter(name)
  48 GPO_getter(link)
  49 GPO_getter(user_extensions)
  50 GPO_getter(machine_extensions)
  51
  52 static PyGetSetDef GPO_setters[] = {
  53         {discard_const_p(char, "ds_path"), (getter)GPO_get_ds_path, NULL, NULL,
  54                 NULL},
  55         {discard_const_p(char, "file_sys_path"), (getter)GPO_get_file_sys_path,
  56                 NULL, NULL, NULL},
  57         {discard_const_p(char, "display_name"), (getter)GPO_get_display_name,
  58                 NULL, NULL, NULL},
  59         {discard_const_p(char, "name"), (getter)GPO_get_name, NULL, NULL,
  60                 NULL},
  61         {discard_const_p(char, "link"), (getter)GPO_get_link, NULL, NULL,
  62                 NULL},
  63         {discard_const_p(char, "user_extensions"),
  64                 (getter)GPO_get_user_extensions,
  65                 NULL, NULL, NULL},
  66         {discard_const_p(char, "machine_extensions"),
  67                 (getter)GPO_get_machine_extensions, NULL, NULL, NULL},
  68         {NULL}
  69 };
  70
  71 static PyObject *py_gpo_get_unix_path(PyObject *self, PyObject *args,
  72                                       PyObject *kwds)
  73 {
  74         NTSTATUS status;
  75         const char *cache_dir = NULL;
  76         PyObject *ret = Py_None;
  77         char *unix_path = NULL;
  78         TALLOC_CTX *frame = NULL;
  79         static const char *kwlist[] = {"cache_dir", NULL};
  80         struct GROUP_POLICY_OBJECT *gpo_ptr \
  81                 = (struct GROUP_POLICY_OBJECT *)pytalloc_get_ptr(self);
  82
  83         if (!PyArg_ParseTupleAndKeywords(args, kwds, "|s",
  84                                          discard_const_p(char *, kwlist),
  85                                          &cache_dir)) {
  86                 PyErr_SetString(PyExc_SystemError,
  87                                 "Failed to parse arguments to "
  88                                 "gpo_get_unix_path()");
  89                 goto out;
  90         }
  91
  92         if (!cache_dir) {
  93                 cache_dir = cache_path(GPO_CACHE_DIR);
  94                 if (!cache_dir) {
  95                         PyErr_SetString(PyExc_MemoryError,
  96                                         "Failed to determine gpo cache dir");
  97                         goto out;
  98                 }
  99         }
 100
 101         frame = talloc_stackframe();
 102
 103         status = gpo_get_unix_path(frame, cache_dir, gpo_ptr, &unix_path);
 104
 105         TALLOC_FREE(frame);
 106
 107         if (!NT_STATUS_IS_OK(status)) {
 108                 PyErr_SetString(PyExc_SystemError,
 109                                 "Failed to determine gpo unix path");
 110                 goto out;
 111         }
 112
 113         ret = PyString_FromString(unix_path);
 114
 115 out:
 116         return ret;
 117 }
 118
 119 static PyMethodDef GPO_methods[] = {
 120         {"get_unix_path", (PyCFunction)py_gpo_get_unix_path, METH_KEYWORDS,
 121                 NULL },
 122         {NULL}
 123 };
 124
 125 static PyTypeObject GPOType = {
 126         PyVarObject_HEAD_INIT(NULL, 0)
 127         .tp_name = "gpo.GROUP_POLICY_OBJECT",
 128         .tp_doc = "GROUP_POLICY_OBJECT",
 129         .tp_getset = GPO_setters,
 130         .tp_methods = GPO_methods,
 131         .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
 132 };
 133
 134 typedef struct {
 135         PyObject_HEAD
 136         ADS_STRUCT *ads_ptr;
 137         struct cli_credentials *cli_creds;
 138 } ADS;
 139
 140 static void py_ads_dealloc(ADS* self)
 141 {
 142         ads_destroy(&(self->ads_ptr));
 143         Py_TYPE(self)->tp_free((PyObject*)self);
 144 }
 145
 146 static PyObject* py_ads_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 147 {
 148         ADS *self;
 149         self = (ADS*)type->tp_alloc(type, 0);
 150         return (PyObject*)self;
 151 }
 152
 153 static PyObject* py_ads_connect(ADS *self);
 154 static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
 155 {
 156         const char *realm = NULL;
 157         const char *workgroup = NULL;
 158         const char *ldap_server = NULL;
 159         PyObject *py_creds = NULL;
 160         PyObject *lp_obj = NULL;
 161         struct loadparm_context *lp_ctx = NULL;
 162
 163         static const char *kwlist[] = {
 164                 "ldap_server", "loadparm_context", "credentials", NULL
 165         };
 166         if (!PyArg_ParseTupleAndKeywords(args, kwds, "sO|O",
 167                                          discard_const_p(char *, kwlist),
 168                                          &ldap_server, &lp_obj, &py_creds)) {
 169                 return -1;
 170         }
 171
 172         if (py_creds) {
 173                 if (!py_check_dcerpc_type(py_creds, "samba.credentials",
 174                                           "Credentials")) {
 175                         PyErr_Format(PyExc_TypeError,
 176                                      "Expected samba.credentials "
 177                                      "for credentials argument");
 178                         return -1;
 179                 }
 180                 self->cli_creds
 181                         = PyCredentials_AsCliCredentials(py_creds);
 182         }
 183
 184         if (lp_obj) {
 185                 bool ok;
 186                 lp_ctx = pytalloc_get_type(lp_obj, struct loadparm_context);
 187                 if (lp_ctx == NULL) {
 188                         return -1;
 189                 }
 190                 ok = lp_load_initial_only(lp_ctx->szConfigFile);
 191                 if (!ok) {
 192                         return -1;
 193                 }
 194         }
 195
 196         if (self->cli_creds) {
 197                 realm = cli_credentials_get_realm(self->cli_creds);
 198                 workgroup = cli_credentials_get_domain(self->cli_creds);
 199         } else {
 200                 realm = lp_realm();
 201                 workgroup = lp_workgroup();
 202         }
 203
 204         if (ldap_server == NULL) {
 205                 return -1;
 206         }
 207
 208         self->ads_ptr = ads_init(realm, workgroup, ldap_server);
 209         if (self->ads_ptr == NULL) {
 210                 return -1;
 211         }
 212
 213         return 0;
 214 }
 215
 216 static PyObject* py_ads_connect(ADS *self)
 217 {
 218         ADS_STATUS status;
 219         TALLOC_CTX *frame = talloc_stackframe();
 220         if (self->cli_creds) {
 221                 self->ads_ptr->auth.user_name =
 222                         SMB_STRDUP(cli_credentials_get_username(self->cli_creds));
 223                 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
 224                 self->ads_ptr->auth.password =
 225                         SMB_STRDUP(cli_credentials_get_password(self->cli_creds));
 226                 self->ads_ptr->auth.realm =
 227                         SMB_STRDUP(cli_credentials_get_realm(self->cli_creds));
 228
 229                 status = ads_connect_user_creds(self->ads_ptr);
 230                 if (!ADS_ERR_OK(status)) {
 231                         PyErr_SetString(PyExc_SystemError,
 232                                         "ads_connect() failed");
 233                         TALLOC_FREE(frame);
 234                         Py_RETURN_FALSE;
 235                 }
 236         } else {
 237                 char *passwd = NULL;
 238                 int ret = asprintf(&(self->ads_ptr->auth.user_name), "%s$",
 239                                    lp_netbios_name());
 240                 if (ret == -1) {
 241                         PyErr_SetString(PyExc_SystemError,
 242                                         "Failed to asprintf");
 243                         TALLOC_FREE(frame);
 244                         Py_RETURN_FALSE;
 245                 } else {
 246                         self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
 247                 }
 248
 249                 if (!secrets_init()) {
 250                         PyErr_SetString(PyExc_SystemError,
 251                                         "secrets_init() failed");
 252                         TALLOC_FREE(frame);
 253                         Py_RETURN_FALSE;
 254                 }
 255
 256                 passwd = secrets_fetch_machine_password(self->ads_ptr->server.workgroup,
 257                                                         NULL, NULL);
 258                 if (passwd == NULL) {
 259                         PyErr_SetString(PyExc_SystemError,
 260                                         "Failed to fetch the machine account "
 261                                         "password");
 262                         TALLOC_FREE(frame);
 263                         Py_RETURN_FALSE;
 264                 }
 265                 self->ads_ptr->auth.password = smb_xstrdup(passwd);
 266                 self->ads_ptr->auth.realm =
 267                         smb_xstrdup(self->ads_ptr->server.realm);
 268                 if (!strupper_m(self->ads_ptr->auth.realm)) {
 269                         PyErr_SetString(PyExc_SystemError, "Failed to strdup");
 270                         TALLOC_FREE(frame);
 271                         SAFE_FREE(passwd);
 272                         Py_RETURN_FALSE;
 273                 }
 274
 275                 status = ads_connect(self->ads_ptr);
 276                 if (!ADS_ERR_OK(status)) {
 277                         PyErr_SetString(PyExc_SystemError,
 278                                         "ads_connect() failed");
 279                         TALLOC_FREE(frame);
 280                         SAFE_FREE(passwd);
 281                         Py_RETURN_FALSE;
 282                 }
 283         }
 284
 285         TALLOC_FREE(frame);
 286         Py_RETURN_TRUE;
 287 }
 288
 289 /* Parameter mapping and functions for the GP_EXT struct */
 290 void initgpo(void);
 291
 292 /* Global methods aka do not need a special pyobject type */
 293 static PyObject *py_gpo_get_sysvol_gpt_version(PyObject * self,
 294                                                PyObject * args)
 295 {
 296         TALLOC_CTX *tmp_ctx = NULL;
 297         char *unix_path;
 298         char *display_name = NULL;
 299         uint32_t sysvol_version = 0;
 300         PyObject *result;
 301         NTSTATUS status;
 302
 303         tmp_ctx = talloc_new(NULL);
 304
 305         if (!PyArg_ParseTuple(args, "s", &unix_path)) {
 306                 return NULL;
 307         }
 308         status = gpo_get_sysvol_gpt_version(tmp_ctx, unix_path,
 309                                             &sysvol_version,
 310                                             &display_name);
 311         if (!NT_STATUS_IS_OK(status)) {
 312                 PyErr_SetNTSTATUS(status);
 313                 TALLOC_FREE(tmp_ctx);
 314                 return NULL;
 315         }
 316
 317         talloc_free(tmp_ctx);
 318         result = Py_BuildValue("[s,i]", display_name, sysvol_version);
 319         return result;
 320 }
 321
 322 #ifdef HAVE_ADS
 323 static ADS_STATUS find_samaccount(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
 324                                   const char *samaccountname,
 325                                   uint32_t *uac_ret, const char **dn_ret)
 326 {
 327         ADS_STATUS status;
 328         const char *attrs[] = { "userAccountControl", NULL };
 329         const char *filter;
 330         LDAPMessage *res = NULL;
 331         char *dn = NULL;
 332         uint32_t uac = 0;
 333
 334         filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
 335                                  samaccountname);
 336         if (filter == NULL) {
 337                 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 338                 goto out;
 339         }
 340
 341         status = ads_do_search_all(ads, ads->config.bind_path,
 342                                    LDAP_SCOPE_SUBTREE, filter, attrs, &res);
 343
 344         if (!ADS_ERR_OK(status)) {
 345                 goto out;
 346         }
 347
 348         if (ads_count_replies(ads, res) != 1) {
 349                 status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
 350                 goto out;
 351         }
 352
 353         dn = ads_get_dn(ads, talloc_tos(), res);
 354         if (dn == NULL) {
 355                 status = ADS_ERROR(LDAP_NO_MEMORY);
 356                 goto out;
 357         }
 358
 359         if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
 360                 status = ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
 361                 goto out;
 362         }
 363
 364         if (uac_ret) {
 365                 *uac_ret = uac;
 366         }
 367
 368         if (dn_ret) {
 369                 *dn_ret = talloc_strdup(mem_ctx, dn);
 370                 if (*dn_ret == NULL) {
 371                         status = ADS_ERROR(LDAP_NO_MEMORY);
 372                         goto out;
 373                 }
 374         }
 375 out:
 376         TALLOC_FREE(dn);
 377         ads_msgfree(ads, res);
 378
 379         return status;
 380 }
 381
 382 static PyObject *py_ads_get_gpo_list(ADS *self, PyObject *args, PyObject *kwds)
 383 {
 384         TALLOC_CTX *frame = NULL;
 385         struct GROUP_POLICY_OBJECT *gpo = NULL, *gpo_list = NULL;
 386         ADS_STATUS status;
 387         const char *samaccountname = NULL;
 388         const char *dn = NULL;
 389         uint32_t uac = 0;
 390         uint32_t flags = 0;
 391         struct security_token *token = NULL;
 392         PyObject *ret = Py_None;
 393         TALLOC_CTX *gpo_ctx;
 394         size_t list_size;
 395         size_t i;
 396
 397         static const char *kwlist[] = {"samaccountname", NULL};
 398         if (!PyArg_ParseTupleAndKeywords(args, kwds, "s",
 399                                          discard_const_p(char *, kwlist),
 400                                          &samaccountname)) {
 401                 PyErr_SetString(PyExc_SystemError,
 402                                 "Failed to parse arguments to "
 403                                 "py_ads_get_gpo_list()");
 404                 goto out;
 405         }
 406
 407         frame = talloc_stackframe();
 408
 409         status = find_samaccount(self->ads_ptr, frame,
 410                                  samaccountname, &uac, &dn);
 411         if (!ADS_ERR_OK(status)) {
 412                 TALLOC_FREE(frame);
 413                 PyErr_SetString(PyExc_SystemError,
 414                                 "Failed to find samAccountName");
 415                 goto out;
 416         }
 417
 418         if (uac & UF_WORKSTATION_TRUST_ACCOUNT ||
 419             uac & UF_SERVER_TRUST_ACCOUNT) {
 420                 flags |= GPO_LIST_FLAG_MACHINE;
 421                 status = gp_get_machine_token(self->ads_ptr, frame, dn,
 422                                               &token);
 423         } else {
 424                 status = ads_get_sid_token(self->ads_ptr, frame, dn, &token);
 425         }
 426         if (!ADS_ERR_OK(status)) {
 427                 TALLOC_FREE(frame);
 428                 PyErr_SetString(PyExc_SystemError, "Failed to get token");
 429                 goto out;
 430         }
 431
 432         gpo_ctx = talloc_new(frame);
 433         status = ads_get_gpo_list(self->ads_ptr, gpo_ctx, dn, flags, token,
 434                                   &gpo_list);
 435         if (!ADS_ERR_OK(status)) {
 436                 TALLOC_FREE(frame);
 437                 PyErr_SetString(PyExc_SystemError, "Failed to fetch GPO list");
 438                 goto out;
 439         }
 440
 441         /* Convert the C linked list into a python list */
 442         list_size = 0;
 443         for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
 444                 list_size++;
 445         }
 446
 447         i = 0;
 448         ret = PyList_New(list_size);
 449         if (ret == NULL) {
 450                 TALLOC_FREE(frame);
 451                 goto out;
 452         }
 453
 454         for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
 455                 PyObject *obj = pytalloc_reference_ex(&GPOType,
 456                                                       gpo_ctx, gpo);
 457                 if (obj == NULL) {
 458                         TALLOC_FREE(frame);
 459                         goto out;
 460                 }
 461
 462                 PyList_SetItem(ret, i, obj);
 463                 i++;
 464         }
 465
 466 out:
 467
 468         TALLOC_FREE(frame);
 469         return ret;
 470 }
 471
 472 #endif
 473
 474 static PyMethodDef ADS_methods[] = {
 475         { "connect", (PyCFunction)py_ads_connect, METH_NOARGS,
 476                 "Connect to the LDAP server" },
 477 #ifdef HAVE_ADS
 478         { "get_gpo_list", (PyCFunction)py_ads_get_gpo_list, METH_KEYWORDS,
 479                 NULL },
 480 #endif
 481         { NULL }
 482 };
 483
 484 static PyTypeObject ads_ADSType = {
 485         .tp_name = "gpo.ADS_STRUCT",
 486         .tp_basicsize = sizeof(ADS),
 487         .tp_dealloc = (destructor)py_ads_dealloc,
 488         .tp_flags = Py_TPFLAGS_DEFAULT,
 489         .tp_doc = "ADS struct",
 490         .tp_methods = ADS_methods,
 491         .tp_init = (initproc)py_ads_init,
 492         .tp_new = py_ads_new,
 493 };
 494
 495 static PyMethodDef py_gpo_methods[] = {
 496         {"gpo_get_sysvol_gpt_version",
 497                 (PyCFunction)py_gpo_get_sysvol_gpt_version,
 498                 METH_VARARGS, NULL},
 499         {NULL}
 500 };
 501
 502 /* Will be called by python when loading this module */
 503 void initgpo(void)
 504 {
 505         PyObject *m;
 506
 507         debug_setup_talloc_log();
 508
 509         /* Instantiate the types */
 510         m = Py_InitModule3("gpo", py_gpo_methods, "libgpo python bindings");
 511         if (m == NULL) {
 512                 return;
 513         }
 514
 515         PyModule_AddObject(m, "version",
 516                            PyString_FromString(SAMBA_VERSION_STRING));
 517
 518         if (PyType_Ready(&ads_ADSType) < 0) {
 519                 return;
 520         }
 521
 522         PyModule_AddObject(m, "ADS_STRUCT", (PyObject *)&ads_ADSType);
 523
 524         if (pytalloc_BaseObject_PyType_Ready(&GPOType) < 0) {
 525                 return;
 526         }
 527
 528         Py_INCREF((PyObject *)(void *)&GPOType);
 529         PyModule_AddObject(m, "GROUP_POLICY_OBJECT",
 530                            (PyObject *)&GPOType);
 531
 532 }