2 Unix SMB/CIFS implementation.
3 Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "param/pyparam.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
30 #include "python/py3compat.h"
32 /* A Python C API module to use LIBGPO */
34 #define GPO_getter(ATTR) \
35 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
37 struct GROUP_POLICY_OBJECT *gpo_ptr \
38 = pytalloc_get_ptr(self); \
41 return PyStr_FromString(gpo_ptr->ATTR); \
46 GPO_getter(file_sys_path
)
47 GPO_getter(display_name
)
50 GPO_getter(user_extensions
)
51 GPO_getter(machine_extensions
)
53 static PyGetSetDef GPO_setters
[] = {
54 {discard_const_p(char, "ds_path"), (getter
)GPO_get_ds_path
, NULL
, NULL
,
56 {discard_const_p(char, "file_sys_path"), (getter
)GPO_get_file_sys_path
,
58 {discard_const_p(char, "display_name"), (getter
)GPO_get_display_name
,
60 {discard_const_p(char, "name"), (getter
)GPO_get_name
, NULL
, NULL
,
62 {discard_const_p(char, "link"), (getter
)GPO_get_link
, NULL
, NULL
,
64 {discard_const_p(char, "user_extensions"),
65 (getter
)GPO_get_user_extensions
,
67 {discard_const_p(char, "machine_extensions"),
68 (getter
)GPO_get_machine_extensions
, NULL
, NULL
, NULL
},
72 static PyObject
*py_gpo_get_unix_path(PyObject
*self
, PyObject
*args
,
76 const char *cache_dir
= NULL
;
77 PyObject
*ret
= Py_None
;
78 char *unix_path
= NULL
;
79 TALLOC_CTX
*frame
= NULL
;
80 static const char *kwlist
[] = {"cache_dir", NULL
};
81 struct GROUP_POLICY_OBJECT
*gpo_ptr \
82 = (struct GROUP_POLICY_OBJECT
*)pytalloc_get_ptr(self
);
84 if (!PyArg_ParseTupleAndKeywords(args
, kwds
, "|s",
85 discard_const_p(char *, kwlist
),
87 PyErr_SetString(PyExc_SystemError
,
88 "Failed to parse arguments to "
89 "gpo_get_unix_path()");
94 cache_dir
= cache_path(GPO_CACHE_DIR
);
96 PyErr_SetString(PyExc_MemoryError
,
97 "Failed to determine gpo cache dir");
102 frame
= talloc_stackframe();
104 status
= gpo_get_unix_path(frame
, cache_dir
, gpo_ptr
, &unix_path
);
108 if (!NT_STATUS_IS_OK(status
)) {
109 PyErr_SetString(PyExc_SystemError
,
110 "Failed to determine gpo unix path");
114 ret
= PyStr_FromString(unix_path
);
120 static PyMethodDef GPO_methods
[] = {
121 {"get_unix_path", (PyCFunction
)py_gpo_get_unix_path
, METH_KEYWORDS
,
126 static PyTypeObject GPOType
= {
127 PyVarObject_HEAD_INIT(NULL
, 0)
128 .tp_name
= "gpo.GROUP_POLICY_OBJECT",
129 .tp_doc
= "GROUP_POLICY_OBJECT",
130 .tp_getset
= GPO_setters
,
131 .tp_methods
= GPO_methods
,
132 .tp_flags
= Py_TPFLAGS_DEFAULT
| Py_TPFLAGS_BASETYPE
,
138 struct cli_credentials
*cli_creds
;
141 static void py_ads_dealloc(ADS
* self
)
143 ads_destroy(&(self
->ads_ptr
));
144 Py_TYPE(self
)->tp_free((PyObject
*)self
);
147 static PyObject
* py_ads_new(PyTypeObject
*type
, PyObject
*args
, PyObject
*kwds
)
150 self
= (ADS
*)type
->tp_alloc(type
, 0);
151 return (PyObject
*)self
;
154 static PyObject
* py_ads_connect(ADS
*self
);
155 static int py_ads_init(ADS
*self
, PyObject
*args
, PyObject
*kwds
)
157 const char *realm
= NULL
;
158 const char *workgroup
= NULL
;
159 const char *ldap_server
= NULL
;
160 PyObject
*py_creds
= NULL
;
161 PyObject
*lp_obj
= NULL
;
162 struct loadparm_context
*lp_ctx
= NULL
;
164 static const char *kwlist
[] = {
165 "ldap_server", "loadparm_context", "credentials", NULL
167 if (!PyArg_ParseTupleAndKeywords(args
, kwds
, "sO|O",
168 discard_const_p(char *, kwlist
),
169 &ldap_server
, &lp_obj
, &py_creds
)) {
174 if (!py_check_dcerpc_type(py_creds
, "samba.credentials",
176 PyErr_Format(PyExc_TypeError
,
177 "Expected samba.credentials "
178 "for credentials argument");
182 = PyCredentials_AsCliCredentials(py_creds
);
186 bool ok
= py_check_dcerpc_type(lp_obj
, "samba.param",
189 PyErr_Format(PyExc_TypeError
,
190 "Expected samba.param.LoadParm "
194 lp_ctx
= pytalloc_get_type(lp_obj
, struct loadparm_context
);
195 if (lp_ctx
== NULL
) {
198 ok
= lp_load_initial_only(lp_ctx
->szConfigFile
);
204 if (self
->cli_creds
) {
205 realm
= cli_credentials_get_realm(self
->cli_creds
);
206 workgroup
= cli_credentials_get_domain(self
->cli_creds
);
209 workgroup
= lp_workgroup();
212 if (ldap_server
== NULL
) {
216 self
->ads_ptr
= ads_init(realm
, workgroup
, ldap_server
);
217 if (self
->ads_ptr
== NULL
) {
224 static PyObject
* py_ads_connect(ADS
*self
)
227 TALLOC_CTX
*frame
= talloc_stackframe();
228 if (self
->cli_creds
) {
229 self
->ads_ptr
->auth
.user_name
=
230 SMB_STRDUP(cli_credentials_get_username(self
->cli_creds
));
231 self
->ads_ptr
->auth
.flags
|= ADS_AUTH_USER_CREDS
;
232 self
->ads_ptr
->auth
.password
=
233 SMB_STRDUP(cli_credentials_get_password(self
->cli_creds
));
234 self
->ads_ptr
->auth
.realm
=
235 SMB_STRDUP(cli_credentials_get_realm(self
->cli_creds
));
237 status
= ads_connect_user_creds(self
->ads_ptr
);
238 if (!ADS_ERR_OK(status
)) {
239 PyErr_SetString(PyExc_SystemError
,
240 "ads_connect() failed");
246 int ret
= asprintf(&(self
->ads_ptr
->auth
.user_name
), "%s$",
249 PyErr_SetString(PyExc_SystemError
,
250 "Failed to asprintf");
254 self
->ads_ptr
->auth
.flags
|= ADS_AUTH_USER_CREDS
;
257 if (!secrets_init()) {
258 PyErr_SetString(PyExc_SystemError
,
259 "secrets_init() failed");
264 passwd
= secrets_fetch_machine_password(self
->ads_ptr
->server
.workgroup
,
266 if (passwd
== NULL
) {
267 PyErr_SetString(PyExc_SystemError
,
268 "Failed to fetch the machine account "
273 self
->ads_ptr
->auth
.password
= smb_xstrdup(passwd
);
275 self
->ads_ptr
->auth
.realm
=
276 smb_xstrdup(self
->ads_ptr
->server
.realm
);
277 if (!strupper_m(self
->ads_ptr
->auth
.realm
)) {
278 PyErr_SetString(PyExc_SystemError
, "Failed to strdup");
283 status
= ads_connect(self
->ads_ptr
);
284 if (!ADS_ERR_OK(status
)) {
285 PyErr_SetString(PyExc_SystemError
,
286 "ads_connect() failed");
296 /* Parameter mapping and functions for the GP_EXT struct */
299 /* Global methods aka do not need a special pyobject type */
300 static PyObject
*py_gpo_get_sysvol_gpt_version(PyObject
* self
,
303 TALLOC_CTX
*tmp_ctx
= NULL
;
305 char *display_name
= NULL
;
306 uint32_t sysvol_version
= 0;
310 tmp_ctx
= talloc_new(NULL
);
312 if (!PyArg_ParseTuple(args
, "s", &unix_path
)) {
315 status
= gpo_get_sysvol_gpt_version(tmp_ctx
, unix_path
,
318 if (!NT_STATUS_IS_OK(status
)) {
319 PyErr_SetNTSTATUS(status
);
320 TALLOC_FREE(tmp_ctx
);
324 talloc_free(tmp_ctx
);
325 result
= Py_BuildValue("[s,i]", display_name
, sysvol_version
);
330 static ADS_STATUS
find_samaccount(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
331 const char *samaccountname
,
332 uint32_t *uac_ret
, const char **dn_ret
)
335 const char *attrs
[] = { "userAccountControl", NULL
};
337 LDAPMessage
*res
= NULL
;
341 filter
= talloc_asprintf(mem_ctx
, "(sAMAccountName=%s)",
343 if (filter
== NULL
) {
344 status
= ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
348 status
= ads_do_search_all(ads
, ads
->config
.bind_path
,
349 LDAP_SCOPE_SUBTREE
, filter
, attrs
, &res
);
351 if (!ADS_ERR_OK(status
)) {
355 if (ads_count_replies(ads
, res
) != 1) {
356 status
= ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
360 dn
= ads_get_dn(ads
, talloc_tos(), res
);
362 status
= ADS_ERROR(LDAP_NO_MEMORY
);
366 if (!ads_pull_uint32(ads
, res
, "userAccountControl", &uac
)) {
367 status
= ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE
);
376 *dn_ret
= talloc_strdup(mem_ctx
, dn
);
377 if (*dn_ret
== NULL
) {
378 status
= ADS_ERROR(LDAP_NO_MEMORY
);
384 ads_msgfree(ads
, res
);
389 static PyObject
*py_ads_get_gpo_list(ADS
*self
, PyObject
*args
, PyObject
*kwds
)
391 TALLOC_CTX
*frame
= NULL
;
392 struct GROUP_POLICY_OBJECT
*gpo
= NULL
, *gpo_list
= NULL
;
394 const char *samaccountname
= NULL
;
395 const char *dn
= NULL
;
398 struct security_token
*token
= NULL
;
399 PyObject
*ret
= Py_None
;
404 static const char *kwlist
[] = {"samaccountname", NULL
};
405 if (!PyArg_ParseTupleAndKeywords(args
, kwds
, "s",
406 discard_const_p(char *, kwlist
),
408 PyErr_SetString(PyExc_SystemError
,
409 "Failed to parse arguments to "
410 "py_ads_get_gpo_list()");
414 frame
= talloc_stackframe();
416 status
= find_samaccount(self
->ads_ptr
, frame
,
417 samaccountname
, &uac
, &dn
);
418 if (!ADS_ERR_OK(status
)) {
420 PyErr_SetString(PyExc_SystemError
,
421 "Failed to find samAccountName");
425 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
||
426 uac
& UF_SERVER_TRUST_ACCOUNT
) {
427 flags
|= GPO_LIST_FLAG_MACHINE
;
428 status
= gp_get_machine_token(self
->ads_ptr
, frame
, dn
,
431 status
= ads_get_sid_token(self
->ads_ptr
, frame
, dn
, &token
);
433 if (!ADS_ERR_OK(status
)) {
435 PyErr_SetString(PyExc_SystemError
, "Failed to get token");
439 gpo_ctx
= talloc_new(frame
);
440 status
= ads_get_gpo_list(self
->ads_ptr
, gpo_ctx
, dn
, flags
, token
,
442 if (!ADS_ERR_OK(status
)) {
444 PyErr_SetString(PyExc_SystemError
, "Failed to fetch GPO list");
448 /* Convert the C linked list into a python list */
450 for (gpo
= gpo_list
; gpo
!= NULL
; gpo
= gpo
->next
) {
455 ret
= PyList_New(list_size
);
461 for (gpo
= gpo_list
; gpo
!= NULL
; gpo
= gpo
->next
) {
462 PyObject
*obj
= pytalloc_reference_ex(&GPOType
,
469 PyList_SetItem(ret
, i
, obj
);
481 static PyMethodDef ADS_methods
[] = {
482 { "connect", (PyCFunction
)py_ads_connect
, METH_NOARGS
,
483 "Connect to the LDAP server" },
485 { "get_gpo_list", (PyCFunction
)py_ads_get_gpo_list
, METH_VARARGS
| METH_KEYWORDS
,
491 static PyTypeObject ads_ADSType
= {
492 .tp_name
= "gpo.ADS_STRUCT",
493 .tp_basicsize
= sizeof(ADS
),
494 .tp_dealloc
= (destructor
)py_ads_dealloc
,
495 .tp_flags
= Py_TPFLAGS_DEFAULT
,
496 .tp_doc
= "ADS struct",
497 .tp_methods
= ADS_methods
,
498 .tp_init
= (initproc
)py_ads_init
,
499 .tp_new
= py_ads_new
,
502 static PyMethodDef py_gpo_methods
[] = {
503 {"gpo_get_sysvol_gpt_version",
504 (PyCFunction
)py_gpo_get_sysvol_gpt_version
,
509 static struct PyModuleDef moduledef
= {
510 PyModuleDef_HEAD_INIT
,
512 .m_doc
= "libgpo python bindings",
514 .m_methods
= py_gpo_methods
,
517 /* Will be called by python when loading this module */
520 MODULE_INIT_FUNC(gpo
)
524 debug_setup_talloc_log();
526 /* Instantiate the types */
527 m
= PyModule_Create(&moduledef
);
532 PyModule_AddObject(m
, "version",
533 PyStr_FromString(SAMBA_VERSION_STRING
));
535 if (PyType_Ready(&ads_ADSType
) < 0) {
539 PyModule_AddObject(m
, "ADS_STRUCT", (PyObject
*)&ads_ADSType
);
541 if (pytalloc_BaseObject_PyType_Ready(&GPOType
) < 0) {
545 Py_INCREF((PyObject
*)(void *)&GPOType
);
546 PyModule_AddObject(m
, "GROUP_POLICY_OBJECT",
547 (PyObject
*)&GPOType
);