2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2005
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
24 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
26 /* should we store a parsed guid ? UUID_FLAT guid; */
29 const char *guid_string
;
34 const char *guid_string
;
35 ADS_STATUS (*snapin_fn
)(ADS_STRUCT
*, TALLOC_CTX
*mem_ctx
, const char *, const char *);
38 static struct gpo_table gpo_default_policy
[] = {
39 { DEFAULT_DOMAIN_POLICY
,
40 "31B2F340-016D-11D2-945F-00C04FB984F9" },
41 { DEFAULT_DOMAIN_CONTROLLERS_POLICY
,
42 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
47 /* the following is seen in gPCMachineExtensionNames or gPCUserExtensionNames */
49 static struct gpo_table gpo_cse_extensions
[] = {
50 { "Administrative Templates Extension",
51 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" }, /* Registry Policy ? */
52 { "Microsoft Disc Quota",
53 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
55 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
56 { "Folder Redirection",
57 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
59 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
60 { "Internet Explorer Branding",
61 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
62 { "QoS Packet Scheduler",
63 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
65 "42B5FAAE-6536-11D2-AE5A-0000F87571E3" },
67 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
68 { "Software Installation",
69 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
70 { "Wireless Group Policy",
71 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
76 static struct snapin_table gpo_cse_snapin_extensions
[] = {
77 { "Administrative Templates",
78 "0F6B957D-509E-11D1-A7CC-0000F87571E3", gpo_snapin_handler_none
},
80 "53D6AB1D-2488-11D1-A28C-00C04FB94F17", gpo_snapin_handler_none
},
81 { "EFS recovery policy processing",
82 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A", gpo_snapin_handler_none
},
83 { "Folder Redirection policy processing",
84 "25537BA6-77A8-11D2-9B6C-0000F8080861", gpo_snapin_handler_none
},
85 { "Folder Redirection",
86 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F", gpo_snapin_handler_none
},
87 { "Registry policy processing",
88 "35378EAC-683F-11D2-A89A-00C04FBBCFA2", gpo_snapin_handler_none
},
89 { "Remote Installation Services",
90 "3060E8CE-7020-11D2-842D-00C04FA372D4", gpo_snapin_handler_none
},
91 { "Security Settings",
92 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B", gpo_snapin_handler_security_settings
},
93 { "Security policy processing",
94 "827D319E-6EAC-11D2-A4EA-00C04F79F83A", gpo_snapin_handler_security_settings
},
96 "3060E8D0-7020-11D2-842D-00C04FA372D4", gpo_snapin_handler_none
},
98 "53D6AB1B-2488-11D1-A28C-00C04FB94F17", gpo_snapin_handler_none
},
102 static const char *name_to_guid_string(const char *name
, struct gpo_table
*table
)
106 for (i
= 0; table
[i
].name
; i
++) {
107 if (strequal(name
, table
[i
].name
)) {
108 return table
[i
].guid_string
;
115 static const char *guid_string_to_name(const char *guid_string
, struct gpo_table
*table
)
119 for (i
= 0; table
[i
].guid_string
; i
++) {
120 if (strequal(guid_string
, table
[i
].guid_string
)) {
121 return table
[i
].name
;
128 static const char *default_gpo_name_to_guid_string(const char *name
)
130 return name_to_guid_string(name
, gpo_default_policy
);
133 static const char *default_gpo_guid_string_to_name(const char *guid
)
135 return guid_string_to_name(guid
, gpo_default_policy
);
138 const char *cse_gpo_guid_string_to_name(const char *guid
)
140 return guid_string_to_name(guid
, gpo_cse_extensions
);
143 static const char *cse_gpo_name_to_guid_string(const char *name
)
145 return name_to_guid_string(name
, gpo_cse_extensions
);
148 const char *cse_snapin_gpo_guid_string_to_name(const char *guid
)
150 return guid_string_to_name(guid
, gpo_cse_snapin_extensions
);
153 void dump_gp_ext(struct GP_EXT
*gp_ext
)
158 if (gp_ext
== NULL
) {
162 DEBUG(lvl
,("---------------------\n\n"));
163 DEBUGADD(lvl
,("name:\t\t\t%s\n", gp_ext
->gp_extension
));
165 for (i
=0; i
< gp_ext
->num_exts
; i
++) {
167 DEBUGADD(lvl
,("extension:\t\t\t%s\n", gp_ext
->extensions_guid
[i
]));
168 DEBUGADD(lvl
,("extension (name):\t\t\t%s\n", gp_ext
->extensions
[i
]));
170 DEBUGADD(lvl
,("snapin:\t\t\t%s\n", gp_ext
->snapins_guid
[i
]));
171 DEBUGADD(lvl
,("snapin (name):\t\t\t%s\n", gp_ext
->snapins
[i
]));
175 void dump_gpo(TALLOC_CTX
*mem_ctx
, struct GROUP_POLICY_OBJECT
*gpo
)
183 DEBUG(lvl
,("---------------------\n\n"));
185 DEBUGADD(lvl
,("name:\t\t\t%s\n", gpo
->name
));
186 DEBUGADD(lvl
,("displayname:\t\t%s\n", gpo
->display_name
));
187 DEBUGADD(lvl
,("version:\t\t%d (0x%08x)\n", gpo
->version
, gpo
->version
));
188 DEBUGADD(lvl
,("version_user:\t\t%d (0x%04x)\n", gpo
->version_user
, gpo
->version_user
));
189 DEBUGADD(lvl
,("version_machine:\t%d (0x%04x)\n", gpo
->version_machine
, gpo
->version_machine
));
190 DEBUGADD(lvl
,("filesyspath:\t\t%s\n", gpo
->file_sys_path
));
191 DEBUGADD(lvl
,("dspath:\t\t%s\n", gpo
->ds_path
));
193 DEBUGADD(lvl
,("options:\t\t%d ", gpo
->options
));
194 if (gpo
->options
& GPFLAGS_USER_SETTINGS_DISABLED
) {
195 DEBUGADD(lvl
,("GPFLAGS_USER_SETTINGS_DISABLED "));
197 if (gpo
->options
& GPFLAGS_MACHINE_SETTINGS_DISABLED
) {
198 DEBUGADD(lvl
,("GPFLAGS_MACHINE_SETTINGS_DISABLED"));
200 DEBUGADD(lvl
,("\n"));
202 DEBUGADD(lvl
,("link:\t\t\t%s\n", gpo
->link
));
203 DEBUGADD(lvl
,("link_type:\t\t%d ", gpo
->link_type
));
204 switch (gpo
->link_type
) {
206 DEBUGADD(lvl
,("GP_LINK_UNKOWN\n"));
209 DEBUGADD(lvl
,("GP_LINK_OU\n"));
212 DEBUGADD(lvl
,("GP_LINK_DOMAIN\n"));
215 DEBUGADD(lvl
,("GP_LINK_SITE\n"));
217 case GP_LINK_MACHINE
:
218 DEBUGADD(lvl
,("GP_LINK_MACHINE\n"));
224 if (gpo
->machine_extensions
) {
226 struct GP_EXT gp_ext
;
229 DEBUGADD(lvl
,("machine_extensions:\t%s\n", gpo
->machine_extensions
));
231 status
= ads_parse_gp_ext(mem_ctx
, gpo
->machine_extensions
, &gp_ext
);
232 if (!ADS_ERR_OK(status
)) {
235 dump_gp_ext(&gp_ext
);
238 if (gpo
->user_extensions
) {
240 struct GP_EXT gp_ext
;
243 DEBUGADD(lvl
,("user_extensions:\t%s\n", gpo
->user_extensions
));
245 status
= ads_parse_gp_ext(mem_ctx
, gpo
->user_extensions
, &gp_ext
);
246 if (!ADS_ERR_OK(status
)) {
249 dump_gp_ext(&gp_ext
);
253 void dump_gplink(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, struct GP_LINK
*gp_link
)
259 if (gp_link
== NULL
) {
263 DEBUG(lvl
,("---------------------\n\n"));
265 DEBUGADD(lvl
,("gplink: %s\n", gp_link
->gp_link
));
266 DEBUGADD(lvl
,("gpopts: %d ", gp_link
->gp_opts
));
267 switch (gp_link
->gp_opts
) {
268 case GPOPTIONS_INHERIT
:
269 DEBUGADD(lvl
,("GPOPTIONS_INHERIT\n"));
271 case GPOPTIONS_BLOCK_INHERITANCE
:
272 DEBUGADD(lvl
,("GPOPTIONS_BLOCK_INHERITANCE\n"));
278 DEBUGADD(lvl
,("num links: %d\n", gp_link
->num_links
));
280 for (i
= 0; i
< gp_link
->num_links
; i
++) {
282 DEBUGADD(lvl
,("---------------------\n\n"));
284 DEBUGADD(lvl
,("link: #%d\n", i
+ 1));
285 DEBUGADD(lvl
,("name: %s\n", gp_link
->link_names
[i
]));
287 DEBUGADD(lvl
,("opt: %d ", gp_link
->link_opts
[i
]));
288 if (gp_link
->link_opts
[i
] & GPO_LINK_OPT_ENFORCED
) {
289 DEBUGADD(lvl
,("GPO_LINK_OPT_ENFORCED "));
291 if (gp_link
->link_opts
[i
] & GPO_LINK_OPT_DISABLED
) {
292 DEBUGADD(lvl
,("GPO_LINK_OPT_DISABLED"));
294 DEBUGADD(lvl
,("\n"));
296 if (ads
!= NULL
&& mem_ctx
!= NULL
) {
298 struct GROUP_POLICY_OBJECT gpo
;
300 status
= ads_get_gpo(ads
, mem_ctx
, gp_link
->link_names
[i
], NULL
, NULL
, &gpo
);
301 if (!ADS_ERR_OK(status
)) {
302 DEBUG(lvl
,("get gpo for %s failed: %s\n", gp_link
->link_names
[i
], ads_errstr(status
)));
305 dump_gpo(mem_ctx
, &gpo
);
310 ADS_STATUS
process_extension_with_snapin(ADS_STRUCT
*ads
,
312 const char *extension_guid
,
313 const char *snapin_guid
)
317 for (i
=0; gpo_cse_snapin_extensions
[i
].guid_string
; i
++) {
319 if (strcmp(gpo_cse_snapin_extensions
[i
].guid_string
, snapin_guid
) == 0) {
321 return gpo_cse_snapin_extensions
[i
].snapin_fn(ads
, mem_ctx
,
322 extension_guid
, snapin_guid
);
326 DEBUG(10,("process_extension_with_snapin: no snapin handler for extension %s (%s) found\n",
327 extension_guid
, snapin_guid
));
329 return ADS_ERROR(LDAP_SUCCESS
);
332 ADS_STATUS
gpo_process_a_gpo(ADS_STRUCT
*ads
,
334 struct GROUP_POLICY_OBJECT
*gpo
,
335 const char *extension_guid
,
339 struct GP_EXT gp_ext
;
342 if (flags
& GPO_LIST_FLAG_MACHINE
) {
344 if (gpo
->machine_extensions
) {
346 status
= ads_parse_gp_ext(mem_ctx
, gpo
->machine_extensions
, &gp_ext
);
348 if (!ADS_ERR_OK(status
)) {
353 /* nothing to apply */
354 return ADS_ERROR(LDAP_SUCCESS
);
359 if (gpo
->user_extensions
) {
361 status
= ads_parse_gp_ext(mem_ctx
, gpo
->user_extensions
, &gp_ext
);
363 if (!ADS_ERR_OK(status
)) {
367 /* nothing to apply */
368 return ADS_ERROR(LDAP_SUCCESS
);
372 for (i
=0; i
<gp_ext
.num_exts
; i
++) {
374 if (extension_guid
&& !strequal(extension_guid
, gp_ext
.extensions_guid
[i
])) {
378 status
= process_extension_with_snapin(ads
, mem_ctx
, gp_ext
.extensions_guid
[i
],
379 gp_ext
.snapins_guid
[i
]);
380 if (!ADS_ERR_OK(status
)) {
385 return ADS_ERROR(LDAP_SUCCESS
);
388 ADS_STATUS
gpo_process_gpo_list(ADS_STRUCT
*ads
,
390 struct GROUP_POLICY_OBJECT
**gpo_list
,
391 const char *extensions_guid
,
395 struct GROUP_POLICY_OBJECT
*gpo
= *gpo_list
;
397 for (gpo
= *gpo_list
; gpo
; gpo
= gpo
->next
) {
399 status
= gpo_process_a_gpo(ads
, mem_ctx
, gpo
,
400 extensions_guid
, flags
);
402 if (!ADS_ERR_OK(status
)) {
408 return ADS_ERROR(LDAP_SUCCESS
);
411 ADS_STATUS
gpo_snapin_handler_none(ADS_STRUCT
*ads
,
413 const char *extension_guid
,
414 const char *snapin_guid
)
416 DEBUG(10,("gpo_snapin_handler_none\n"));
418 return ADS_ERROR(LDAP_SUCCESS
);
421 ADS_STATUS
gpo_snapin_handler_security_settings(ADS_STRUCT
*ads
,
423 const char *extension_guid
,
424 const char *snapin_guid
)
426 DEBUG(10,("gpo_snapin_handler_security_settings\n"));
428 return ADS_ERROR(LDAP_SUCCESS
);
431 ADS_STATUS
gpo_lockout_policy(ADS_STRUCT
*ads
,
433 const char *hostname
,
434 SAM_UNK_INFO_12
*lockout_policy
)
436 return ADS_ERROR_NT(NT_STATUS_NOT_IMPLEMENTED
);
439 ADS_STATUS
gpo_password_policy(ADS_STRUCT
*ads
,
441 const char *hostname
,
442 SAM_UNK_INFO_1
*password_policy
)
445 struct GROUP_POLICY_OBJECT
*gpo_list
;
446 const char *attrs
[] = {"distinguishedName", "userAccountControl", NULL
};
451 return ADS_ERROR_NT(NT_STATUS_NOT_IMPLEMENTED
);
453 filter
= talloc_asprintf(mem_ctx
, "(&(objectclass=user)(sAMAccountName=%s))", hostname
);
454 if (filter
== NULL
) {
455 return ADS_ERROR(LDAP_NO_MEMORY
);
458 status
= ads_do_search_all(ads
, ads
->config
.bind_path
,
460 filter
, attrs
, &res
);
462 if (!ADS_ERR_OK(status
)) {
466 if (ads_count_replies(ads
, res
) != 1) {
467 return ADS_ERROR(LDAP_NO_SUCH_OBJECT
);
470 dn
= ads_get_dn(ads
, res
);
472 return ADS_ERROR(LDAP_NO_MEMORY
);
475 if (!ads_pull_uint32(ads
, res
, "userAccountControl", &uac
)) {
476 return ADS_ERROR(LDAP_NO_MEMORY
);
479 if (!(uac
& UF_WORKSTATION_TRUST_ACCOUNT
)) {
480 return ADS_ERROR(LDAP_NO_SUCH_OBJECT
);
483 status
= ads_get_gpo_list(ads
, mem_ctx
, dn
, GPO_LIST_FLAG_MACHINE
, &gpo_list
);
484 if (!ADS_ERR_OK(status
)) {
488 status
= gpo_process_gpo_list(ads
, mem_ctx
, &gpo_list
,
489 cse_gpo_name_to_guid_string("Security"),
490 GPO_LIST_FLAG_MACHINE
);
491 if (!ADS_ERR_OK(status
)) {
495 return ADS_ERROR(LDAP_SUCCESS
);