?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
replace/waf: add rt to deps at this place
[Samba/gebeck_regimport.git] / source4 / lib / policy / gp_ldap.c
blob87fde9dbd78f4d22c6c129f0308954d44bf5f93e
1 /*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Jelmer Vernooij 2008
5 * Copyright (C) Wilco Baan Hofman 2008-2010
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20 #include "includes.h"
21 #include "param/param.h"
22 #include "lib/ldb/include/ldb.h"
23 #include "lib/ldb-samba/ldb_wrap.h"
24 #include "auth/credentials/credentials.h"
25 #include "../librpc/gen_ndr/nbt.h"
26 #include "libcli/libcli.h"
27 #include "libnet/libnet.h"
28 #include "../librpc/gen_ndr/ndr_security.h"
29 #include "../libcli/security/dom_sid.h"
30 #include "libcli/security/security.h"
31 #include "../lib/talloc/talloc.h"
32 #include "lib/policy/policy.h"
33
34 struct gpo_stringmap {
35 const char *str;
36 uint32_t flags;
37 };
38 static const struct gpo_stringmap gplink_options [] = {
39 { "GPLINK_OPT_DISABLE", GPLINK_OPT_DISABLE },
40 { "GPLINK_OPT_ENFORCE", GPLINK_OPT_ENFORCE },
41 { NULL, 0 }
42 };
43 static const struct gpo_stringmap gpo_flags [] = {
44 { "GPO_FLAG_USER_DISABLE", GPO_FLAG_USER_DISABLE },
45 { "GPO_FLAG_MACHINE_DISABLE", GPO_FLAG_MACHINE_DISABLE },
46 { NULL, 0 }
47 };
48 static const struct gpo_stringmap gpo_inheritance [] = {
49 { "GPO_INHERIT", GPO_INHERIT },
50 { "GPO_BLOCK_INHERITANCE", GPO_BLOCK_INHERITANCE },
51 { NULL, 0 }
52 };
53
54
55 static NTSTATUS parse_gpo(TALLOC_CTX *mem_ctx, struct ldb_message *msg, struct gp_object **ret)
56 {
57 struct gp_object *gpo = talloc(mem_ctx, struct gp_object);
58 enum ndr_err_code ndr_err;
59 const DATA_BLOB *data;
60
61 NT_STATUS_HAVE_NO_MEMORY(gpo);
62
63 gpo->dn = talloc_strdup(mem_ctx, ldb_dn_get_linearized(msg->dn));
64 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo->dn, gpo);
65
66 DEBUG(9, ("Parsing GPO LDAP data for %s\n", gpo->dn));
67
68 gpo->display_name = talloc_strdup(gpo, ldb_msg_find_attr_as_string(msg, "displayName", ""));
69 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo->display_name, gpo);
70
71 gpo->name = talloc_strdup(gpo, ldb_msg_find_attr_as_string(msg, "name", ""));
72 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo->name, gpo);
73
74 gpo->flags = ldb_msg_find_attr_as_uint(msg, "flags", 0);
75 gpo->version = ldb_msg_find_attr_as_uint(msg, "versionNumber", 0);
76
77 gpo->file_sys_path = talloc_strdup(gpo, ldb_msg_find_attr_as_string(msg, "gPCFileSysPath", ""));
78 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo->file_sys_path, gpo);
79
80 /* Pull the security descriptor through the NDR library */
81 data = ldb_msg_find_ldb_val(msg, "nTSecurityDescriptor");
82 gpo->security_descriptor = talloc(gpo, struct security_descriptor);
83 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo->security_descriptor, gpo);
84
85 ndr_err = ndr_pull_struct_blob(data,
86 mem_ctx,
87 gpo->security_descriptor,
88 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
89 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
90 return ndr_map_error2ntstatus(ndr_err);
91 }
92
93 *ret = gpo;
94 return NT_STATUS_OK;
95 }
96
97 NTSTATUS gp_get_gpo_flags(TALLOC_CTX *mem_ctx, uint32_t flags, const char ***ret)
98 {
99 unsigned int i, count=0;
100 const char **flag_strs = talloc_array(mem_ctx, const char *, 1);
101
102 NT_STATUS_HAVE_NO_MEMORY(flag_strs);
103
104 flag_strs[0] = NULL;
105
106 for (i = 0; gpo_flags[i].str != NULL; i++) {
107 if (flags & gpo_flags[i].flags) {
108 flag_strs = talloc_realloc(mem_ctx, flag_strs, const char *, count+2);
109 NT_STATUS_HAVE_NO_MEMORY(flag_strs);
110 flag_strs[count] = gpo_flags[i].str;
111 flag_strs[count+1] = NULL;
112 count++;
113 }
114 }
115 *ret = flag_strs;
116 return NT_STATUS_OK;
117 }
118
119 NTSTATUS gp_get_gplink_options(TALLOC_CTX *mem_ctx, uint32_t options, const char ***ret)
120 {
121 unsigned int i, count=0;
122 const char **flag_strs = talloc_array(mem_ctx, const char *, 1);
123
124 NT_STATUS_HAVE_NO_MEMORY(flag_strs);
125 flag_strs[0] = NULL;
126
127 for (i = 0; gplink_options[i].str != NULL; i++) {
128 if (options & gplink_options[i].flags) {
129 flag_strs = talloc_realloc(mem_ctx, flag_strs, const char *, count+2);
130 NT_STATUS_HAVE_NO_MEMORY(flag_strs);
131 flag_strs[count] = gplink_options[i].str;
132 flag_strs[count+1] = NULL;
133 count++;
134 }
135 }
136 *ret = flag_strs;
137 return NT_STATUS_OK;
138 }
139
140 NTSTATUS gp_init(TALLOC_CTX *mem_ctx,
141 struct loadparm_context *lp_ctx,
142 struct cli_credentials *credentials,
143 struct tevent_context *ev_ctx,
144 struct gp_context **gp_ctx)
145 {
146
147 struct libnet_LookupDCs *io;
148 char *url;
149 struct libnet_context *net_ctx;
150 struct ldb_context *ldb_ctx;
151 NTSTATUS rv;
152
153 /* Initialise the libnet context */
154 net_ctx = libnet_context_init(ev_ctx, lp_ctx);
155 net_ctx->cred = credentials;
156
157 /* Prepare libnet lookup structure for looking a DC (PDC is correct). */
158 io = talloc_zero(mem_ctx, struct libnet_LookupDCs);
159 NT_STATUS_HAVE_NO_MEMORY(io);
160 io->in.name_type = NBT_NAME_PDC;
161 io->in.domain_name = lpcfg_workgroup(lp_ctx);
162
163 /* Find Active DC's */
164 rv = libnet_LookupDCs(net_ctx, mem_ctx, io);
165 if (!NT_STATUS_IS_OK(rv)) {
166 DEBUG(0, ("Failed to lookup DCs in domain\n"));
167 return rv;
168 }
169
170 /* Connect to ldap://DC_NAME with all relevant contexts*/
171 url = talloc_asprintf(mem_ctx, "ldap://%s", io->out.dcs[0].name);
172 NT_STATUS_HAVE_NO_MEMORY(url);
173 ldb_ctx = ldb_wrap_connect(mem_ctx, net_ctx->event_ctx, lp_ctx,
174 url, NULL, net_ctx->cred, 0);
175 if (ldb_ctx == NULL) {
176 DEBUG(0, ("Can't connect to DC's LDAP with url %s\n", url));
177 return NT_STATUS_UNSUCCESSFUL;
178 }
179
180
181 *gp_ctx = talloc_zero(mem_ctx, struct gp_context);
182 NT_STATUS_HAVE_NO_MEMORY(gp_ctx);
183
184 (*gp_ctx)->lp_ctx = lp_ctx;
185 (*gp_ctx)->credentials = credentials;
186 (*gp_ctx)->ev_ctx = ev_ctx;
187 (*gp_ctx)->ldb_ctx = ldb_ctx;
188 (*gp_ctx)->active_dc = io->out.dcs[0];
189
190 /* We don't need to keep the libnet context */
191 talloc_free(net_ctx);
192 return NT_STATUS_OK;
193 }
194
195 NTSTATUS gp_list_all_gpos(struct gp_context *gp_ctx, struct gp_object ***ret)
196 {
197 struct ldb_result *result;
198 int rv;
199 NTSTATUS status;
200 TALLOC_CTX *mem_ctx;
201 struct ldb_dn *dn;
202 struct gp_object **gpo;
203 unsigned int i; /* same as in struct ldb_result */
204 const char **attrs;
205
206 /* Create a forked memory context, as a base for everything here */
207 mem_ctx = talloc_new(gp_ctx);
208 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
209
210 /* Create full ldb dn of the policies base object */
211 dn = ldb_get_default_basedn(gp_ctx->ldb_ctx);
212 rv = ldb_dn_add_child(dn, ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, "CN=Policies,CN=System"));
213 if (!rv) {
214 DEBUG(0, ("Can't append subtree to DN\n"));
215 talloc_free(mem_ctx);
216 return NT_STATUS_UNSUCCESSFUL;
217 }
218
219 DEBUG(10, ("Searching for policies in DN: %s\n", ldb_dn_get_linearized(dn)));
220
221 attrs = talloc_array(mem_ctx, const char *, 7);
222 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(attrs, mem_ctx);
223
224 attrs[0] = "nTSecurityDescriptor";
225 attrs[1] = "versionNumber";
226 attrs[2] = "flags";
227 attrs[3] = "name";
228 attrs[4] = "displayName";
229 attrs[5] = "gPCFileSysPath";
230 attrs[6] = NULL;
231
232 rv = ldb_search(gp_ctx->ldb_ctx, mem_ctx, &result, dn, LDB_SCOPE_ONELEVEL, attrs, "(objectClass=groupPolicyContainer)");
233 if (rv != LDB_SUCCESS) {
234 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv), ldb_errstring(gp_ctx->ldb_ctx)));
235 talloc_free(mem_ctx);
236 return NT_STATUS_UNSUCCESSFUL;
237 }
238
239 gpo = talloc_array(gp_ctx, struct gp_object *, result->count+1);
240 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo, mem_ctx);
241
242 gpo[result->count] = NULL;
243
244 for (i = 0; i < result->count; i++) {
245 status = parse_gpo(gp_ctx, result->msgs[i], &gpo[i]);
246 if (!NT_STATUS_IS_OK(status)) {
247 DEBUG(0, ("Failed to parse GPO.\n"));
248 talloc_free(mem_ctx);
249 return status;
250 }
251 }
252
253 talloc_free(mem_ctx);
254
255 *ret = gpo;
256 return NT_STATUS_OK;
257 }
258
259 NTSTATUS gp_get_gpo_info(struct gp_context *gp_ctx, const char *dn_str, struct gp_object **ret)
260 {
261 struct ldb_result *result;
262 struct ldb_dn *dn;
263 struct gp_object *gpo;
264 int rv;
265 NTSTATUS status;
266 TALLOC_CTX *mem_ctx;
267 const char **attrs;
268
269 /* Create a forked memory context, as a base for everything here */
270 mem_ctx = talloc_new(gp_ctx);
271 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
272
273 /* Create an ldb dn struct for the dn string */
274 dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
275
276 attrs = talloc_array(mem_ctx, const char *, 7);
277 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(attrs, mem_ctx);
278
279 attrs[0] = "nTSecurityDescriptor";
280 attrs[1] = "versionNumber";
281 attrs[2] = "flags";
282 attrs[3] = "name";
283 attrs[4] = "displayName";
284 attrs[5] = "gPCFileSysPath";
285 attrs[6] = NULL;
286
287 rv = ldb_search(gp_ctx->ldb_ctx,
288 mem_ctx,
289 &result,
290 dn,
291 LDB_SCOPE_BASE,
292 attrs,
293 "objectClass=groupPolicyContainer");
294 if (rv != LDB_SUCCESS) {
295 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv), ldb_errstring(gp_ctx->ldb_ctx)));
296 talloc_free(mem_ctx);
297 return NT_STATUS_UNSUCCESSFUL;
298 }
299
300 /* We expect exactly one record */
301 if (result->count != 1) {
302 DEBUG(0, ("Could not find GPC with dn %s\n", dn_str));
303 talloc_free(mem_ctx);
304 return NT_STATUS_NOT_FOUND;
305 }
306
307 status = parse_gpo(gp_ctx, result->msgs[0], &gpo);
308 if (!NT_STATUS_IS_OK(status)) {
309 DEBUG(0, ("Failed to parse GPO.\n"));
310 talloc_free(mem_ctx);
311 return status;
312 }
313
314 talloc_free(mem_ctx);
315
316 *ret = gpo;
317 return NT_STATUS_OK;
318 }
319
320 static NTSTATUS parse_gplink (TALLOC_CTX *mem_ctx, const char *gplink_str, struct gp_link ***ret)
321 {
322 int start, idx=0;
323 int pos;
324 struct gp_link **gplinks;
325 char *buf, *end;
326 const char *gplink_start = "[LDAP://";
327
328 gplinks = talloc_array(mem_ctx, struct gp_link *, 1);
329 NT_STATUS_HAVE_NO_MEMORY(gplinks);
330
331 gplinks[0] = NULL;
332
333 /* Assuming every gPLink starts with "[LDAP://" */
334 start = strlen(gplink_start);
335
336 for (pos = start; pos < strlen(gplink_str); pos++) {
337 if (gplink_str[pos] == ';') {
338 gplinks = talloc_realloc(mem_ctx, gplinks, struct gp_link *, idx+2);
339 NT_STATUS_HAVE_NO_MEMORY(gplinks);
340 gplinks[idx] = talloc(mem_ctx, struct gp_link);
341 NT_STATUS_HAVE_NO_MEMORY(gplinks[idx]);
342 gplinks[idx]->dn = talloc_strndup(mem_ctx,
343 gplink_str + start,
344 pos - start);
345 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gplinks[idx]->dn, gplinks);
346
347 for (start = pos + 1; gplink_str[pos] != ']'; pos++);
348
349 buf = talloc_strndup(gplinks, gplink_str + start, pos - start);
350 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(buf, gplinks);
351 gplinks[idx]->options = (uint32_t) strtoll(buf, &end, 0);
352 talloc_free(buf);
353
354 /* Set the last entry in the array to be NULL */
355 gplinks[idx + 1] = NULL;
356
357 /* Increment the array index, the string position past
358 the next "[LDAP://", and set the start reference */
359 idx++;
360 pos += strlen(gplink_start)+1;
361 start = pos;
362 }
363 }
364
365 *ret = gplinks;
366 return NT_STATUS_OK;
367 }
368
369
370 NTSTATUS gp_get_gplinks(struct gp_context *gp_ctx, const char *dn_str, struct gp_link ***ret)
371 {
372 TALLOC_CTX *mem_ctx;
373 struct ldb_dn *dn;
374 struct ldb_result *result;
375 struct gp_link **gplinks;
376 char *gplink_str;
377 int rv;
378 unsigned int i, j;
379 NTSTATUS status;
380
381 /* Create a forked memory context, as a base for everything here */
382 mem_ctx = talloc_new(gp_ctx);
383 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
384
385 dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
386
387 rv = ldb_search(gp_ctx->ldb_ctx, mem_ctx, &result, dn, LDB_SCOPE_BASE, NULL, "(objectclass=*)");
388 if (rv != LDB_SUCCESS) {
389 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv), ldb_errstring(gp_ctx->ldb_ctx)));
390 talloc_free(mem_ctx);
391 return NT_STATUS_UNSUCCESSFUL;
392 }
393
394 for (i = 0; i < result->count; i++) {
395 for (j = 0; j < result->msgs[i]->num_elements; j++) {
396 struct ldb_message_element *element = &result->msgs[i]->elements[j];
397
398 if (strcmp(element->name, "gPLink") == 0) {
399 SMB_ASSERT(element->num_values > 0);
400 gplink_str = talloc_strdup(mem_ctx, (char *) element->values[0].data);
401 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gplink_str, mem_ctx);
402 goto found;
403 }
404 }
405 }
406 gplink_str = talloc_strdup(mem_ctx, "");
407 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gplink_str, mem_ctx);
408
409 found:
410
411 status = parse_gplink(gp_ctx, gplink_str, &gplinks);
412 if (!NT_STATUS_IS_OK(status)) {
413 DEBUG(0, ("Failed to parse gPLink\n"));
414 return status;
415 }
416
417 talloc_free(mem_ctx);
418
419 *ret = gplinks;
420 return NT_STATUS_OK;
421 }
422
423 NTSTATUS gp_list_gpos(struct gp_context *gp_ctx, struct security_token *token, const char ***ret)
424 {
425 TALLOC_CTX *mem_ctx;
426 const char **gpos;
427 struct ldb_result *result;
428 const char *sid;
429 struct ldb_dn *dn;
430 struct ldb_message_element *element;
431 bool inherit;
432 const char *attrs[] = { "objectClass", NULL };
433 int rv;
434 NTSTATUS status;
435 unsigned int count = 0;
436 unsigned int i;
437 enum {
438 ACCOUNT_TYPE_USER = 0,
439 ACCOUNT_TYPE_MACHINE = 1
440 } account_type;
441
442 /* Create a forked memory context, as a base for everything here */
443 mem_ctx = talloc_new(gp_ctx);
444 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
445
446 sid = dom_sid_string(mem_ctx, &token->sids[PRIMARY_USER_SID_INDEX]);
447
448 /* Find the user DN and objectclass via the sid from the security token */
449 rv = ldb_search(gp_ctx->ldb_ctx,
450 mem_ctx,
451 &result,
452 ldb_get_default_basedn(gp_ctx->ldb_ctx),
453 LDB_SCOPE_SUBTREE,
454 attrs,
455 "(&(objectclass=user)(objectSid=%s))", sid);
456 if (rv != LDB_SUCCESS) {
457 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv),
458 ldb_errstring(gp_ctx->ldb_ctx)));
459 talloc_free(mem_ctx);
460 return NT_STATUS_UNSUCCESSFUL;
461 }
462 if (result->count != 1) {
463 DEBUG(0, ("Could not find user with sid %s.\n", sid));
464 talloc_free(mem_ctx);
465 return NT_STATUS_UNSUCCESSFUL;
466 }
467 DEBUG(10,("Found DN for this user: %s\n", ldb_dn_get_linearized(result->msgs[0]->dn)));
468
469 element = ldb_msg_find_element(result->msgs[0], "objectClass");
470
471 /* We need to know if this account is a user or machine. */
472 account_type = ACCOUNT_TYPE_USER;
473 for (i = 0; i < element->num_values; i++) {
474 if (strcmp((char *)element->values[i].data, "computer") == 0) {
475 account_type = ACCOUNT_TYPE_MACHINE;
476 DEBUG(10, ("This user is a machine\n"));
477 }
478 }
479
480 gpos = talloc_array(gp_ctx, const char *, 1);
481 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpos, mem_ctx);
482 gpos[0] = NULL;
483
484 /* Walk through the containers until we hit the root */
485 inherit = 1;
486 dn = ldb_dn_get_parent(mem_ctx, result->msgs[0]->dn);
487 while (ldb_dn_compare_base(ldb_get_default_basedn(gp_ctx->ldb_ctx), dn) == 0) {
488 const char *gpo_attrs[] = { "gPLink", "gPOptions", NULL };
489 struct gp_link **gplinks;
490 enum gpo_inheritance gpoptions;
491
492 DEBUG(10, ("Getting gPLinks for DN: %s\n", ldb_dn_get_linearized(dn)));
493
494 /* Get the gPLink and gPOptions attributes from the container */
495 rv = ldb_search(gp_ctx->ldb_ctx,
496 mem_ctx,
497 &result,
498 dn,
499 LDB_SCOPE_BASE,
500 gpo_attrs,
501 "objectclass=*");
502 if (rv != LDB_SUCCESS) {
503 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv),
504 ldb_errstring(gp_ctx->ldb_ctx)));
505 talloc_free(mem_ctx);
506 return NT_STATUS_UNSUCCESSFUL;
507 }
508
509 /* Parse the gPLink attribute, put it into a nice struct array */
510 status = parse_gplink(mem_ctx, ldb_msg_find_attr_as_string(result->msgs[0], "gPLink", ""), &gplinks);
511 if (!NT_STATUS_IS_OK(status)) {
512 DEBUG(0, ("Failed to parse gPLink\n"));
513 talloc_free(mem_ctx);
514 return status;
515 }
516
517 /* Check all group policy links on this container */
518 for (i = 0; gplinks[i] != NULL; i++) {
519 struct gp_object *gpo;
520 uint32_t access_granted;
521
522 /* If inheritance was blocked at a higher level and this
523 * gplink is not enforced, it should not be applied */
524 if (!inherit && !(gplinks[i]->options & GPLINK_OPT_ENFORCE))
525 continue;
526
527 /* Don't apply disabled links */
528 if (gplinks[i]->options & GPLINK_OPT_DISABLE)
529 continue;
530
531 /* Get GPO information */
532 status = gp_get_gpo_info(gp_ctx, gplinks[i]->dn, &gpo);
533 if (!NT_STATUS_IS_OK(status)) {
534 DEBUG(0, ("Failed to get gpo information for %s\n", gplinks[i]->dn));
535 talloc_free(mem_ctx);
536 return status;
537 }
538
539 /* If the account does not have read access, this GPO does not apply
540 * to this account */
541 status = sec_access_check(gpo->security_descriptor,
542 token,
543 (SEC_STD_READ_CONTROL | SEC_ADS_LIST | SEC_ADS_READ_PROP),
544 &access_granted);
545 if (!NT_STATUS_IS_OK(status)) {
546 continue;
547 }
548
549 /* If the account is a user and the GPO has user disabled flag, or
550 * a machine and the GPO has machine disabled flag, this GPO does
551 * not apply to this account */
552 if ((account_type == ACCOUNT_TYPE_USER &&
553 (gpo->flags & GPO_FLAG_USER_DISABLE)) ||
554 (account_type == ACCOUNT_TYPE_MACHINE &&
555 (gpo->flags & GPO_FLAG_MACHINE_DISABLE))) {
556 continue;
557 }
558
559 /* Add the GPO to the list */
560 gpos = talloc_realloc(gp_ctx, gpos, const char *, count+2);
561 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpos, mem_ctx);
562 gpos[count] = talloc_strdup(gp_ctx, gplinks[i]->dn);
563 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpos[count], mem_ctx);
564 gpos[count+1] = NULL;
565 count++;
566
567 /* Clean up */
568 talloc_free(gpo);
569 }
570
571 /* If inheritance is blocked, then we should only add enforced gPLinks
572 * higher up */
573 gpoptions = ldb_msg_find_attr_as_uint(result->msgs[0], "gPOptions", 0);
574 if (gpoptions == GPO_BLOCK_INHERITANCE) {
575 inherit = 0;
576 }
577 dn = ldb_dn_get_parent(mem_ctx, dn);
578 }
579
580 talloc_free(mem_ctx);
581
582 *ret = gpos;
583 return NT_STATUS_OK;
584 }
585
586 NTSTATUS gp_set_gplink(struct gp_context *gp_ctx, const char *dn_str, struct gp_link *gplink)
587 {
588 TALLOC_CTX *mem_ctx;
589 struct ldb_result *result;
590 struct ldb_dn *dn;
591 struct ldb_message *msg;
592 const char *attrs[] = { "gPLink", NULL };
593 const char *gplink_str;
594 int rv;
595 char *start;
596
597 /* Create a forked memory context, as a base for everything here */
598 mem_ctx = talloc_new(gp_ctx);
599 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
600
601 dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
602
603 rv = ldb_search(gp_ctx->ldb_ctx, mem_ctx, &result, dn, LDB_SCOPE_BASE, attrs, "(objectclass=*)");
604 if (rv != LDB_SUCCESS) {
605 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv), ldb_errstring(gp_ctx->ldb_ctx)));
606 talloc_free(mem_ctx);
607 return NT_STATUS_UNSUCCESSFUL;
608 }
609
610 if (result->count != 1) {
611 talloc_free(mem_ctx);
612 return NT_STATUS_NOT_FOUND;
613 }
614
615 gplink_str = ldb_msg_find_attr_as_string(result->msgs[0], "gPLink", "");
616
617 /* If this GPO link already exists, alter the options, else add it */
618 if ((start = strcasestr(gplink_str, gplink->dn)) != NULL) {
619 start += strlen(gplink->dn);
620 *start = '\0';
621 start++;
622 while (*start != ']' && *start != '\0') {
623 start++;
624 }
625 gplink_str = talloc_asprintf(mem_ctx, "%s;%d%s", gplink_str, gplink->options, start);
626 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gplink_str, mem_ctx);
627
628 } else {
629 /* Prepend the new GPO link to the string. This list is backwards in priority. */
630 gplink_str = talloc_asprintf(mem_ctx, "[LDAP://%s;%d]%s", gplink->dn, gplink->options, gplink_str);
631 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gplink_str, mem_ctx);
632 }
633
634
635
636 msg = ldb_msg_new(mem_ctx);
637 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
638
639 msg->dn = dn;
640
641 rv = ldb_msg_add_string(msg, "gPLink", gplink_str);
642 if (rv != 0) {
643 DEBUG(0, ("LDB message add string failed: %s\n", ldb_strerror(rv)));
644 talloc_free(mem_ctx);
645 return NT_STATUS_UNSUCCESSFUL;
646 }
647 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
648
649 rv = ldb_modify(gp_ctx->ldb_ctx, msg);
650 if (rv != 0) {
651 DEBUG(0, ("LDB modify failed: %s\n", ldb_strerror(rv)));
652 talloc_free(mem_ctx);
653 return NT_STATUS_UNSUCCESSFUL;
654 }
655
656 talloc_free(mem_ctx);
657 return NT_STATUS_OK;
658 }
659
660 NTSTATUS gp_del_gplink(struct gp_context *gp_ctx, const char *dn_str, const char *gplink_dn)
661 {
662 TALLOC_CTX *mem_ctx;
663 struct ldb_result *result;
664 struct ldb_dn *dn;
665 struct ldb_message *msg;
666 const char *attrs[] = { "gPLink", NULL };
667 const char *gplink_str, *search_string;
668 int rv;
669 char *p;
670
671 /* Create a forked memory context, as a base for everything here */
672 mem_ctx = talloc_new(gp_ctx);
673 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
674
675 dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
676
677 rv = ldb_search(gp_ctx->ldb_ctx, mem_ctx, &result, dn, LDB_SCOPE_BASE, attrs, "(objectclass=*)");
678 if (rv != LDB_SUCCESS) {
679 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv), ldb_errstring(gp_ctx->ldb_ctx)));
680 talloc_free(mem_ctx);
681 return NT_STATUS_UNSUCCESSFUL;
682 }
683
684 if (result->count != 1) {
685 talloc_free(mem_ctx);
686 return NT_STATUS_NOT_FOUND;
687 }
688
689 gplink_str = ldb_msg_find_attr_as_string(result->msgs[0], "gPLink", "");
690
691 /* If this GPO link already exists, alter the options, else add it */
692 search_string = talloc_asprintf(mem_ctx, "[LDAP://%s]", gplink_dn);
693 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(search_string, mem_ctx);
694
695 p = strcasestr(gplink_str, search_string);
696 if (p == NULL) {
697 talloc_free(mem_ctx);
698 return NT_STATUS_NOT_FOUND;
699 }
700
701 *p = '\0';
702 p++;
703 while (*p != ']' && *p != '\0') {
704 p++;
705 }
706 p++;
707 gplink_str = talloc_asprintf(mem_ctx, "%s%s", gplink_str, p);
708 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gplink_str, mem_ctx);
709
710
711 msg = ldb_msg_new(mem_ctx);
712 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
713
714 msg->dn = dn;
715
716 if (strcmp(gplink_str, "") == 0) {
717 rv = ldb_msg_add_empty(msg, "gPLink", LDB_FLAG_MOD_DELETE, NULL);
718 if (rv != 0) {
719 DEBUG(0, ("LDB message add empty element failed: %s\n", ldb_strerror(rv)));
720 talloc_free(mem_ctx);
721 return NT_STATUS_UNSUCCESSFUL;
722 }
723 } else {
724 rv = ldb_msg_add_string(msg, "gPLink", gplink_str);
725 if (rv != 0) {
726 DEBUG(0, ("LDB message add string failed: %s\n", ldb_strerror(rv)));
727 talloc_free(mem_ctx);
728 return NT_STATUS_UNSUCCESSFUL;
729 }
730 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
731 }
732 rv = ldb_modify(gp_ctx->ldb_ctx, msg);
733 if (rv != 0) {
734 DEBUG(0, ("LDB modify failed: %s\n", ldb_strerror(rv)));
735 talloc_free(mem_ctx);
736 return NT_STATUS_UNSUCCESSFUL;
737 }
738
739 talloc_free(mem_ctx);
740 return NT_STATUS_OK;
741 }
742
743 NTSTATUS gp_get_inheritance(struct gp_context *gp_ctx, const char *dn_str, enum gpo_inheritance *inheritance)
744 {
745 TALLOC_CTX *mem_ctx;
746 struct ldb_result *result;
747 struct ldb_dn *dn;
748 const char *attrs[] = { "gPOptions", NULL };
749 int rv;
750
751 /* Create a forked memory context, as a base for everything here */
752 mem_ctx = talloc_new(gp_ctx);
753 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
754
755 dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
756
757 rv = ldb_search(gp_ctx->ldb_ctx, mem_ctx, &result, dn, LDB_SCOPE_BASE, attrs, "(objectclass=*)");
758 if (rv != LDB_SUCCESS) {
759 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv), ldb_errstring(gp_ctx->ldb_ctx)));
760 talloc_free(mem_ctx);
761 return NT_STATUS_UNSUCCESSFUL;
762 }
763
764 if (result->count != 1) {
765 talloc_free(mem_ctx);
766 return NT_STATUS_NOT_FOUND;
767 }
768
769 *inheritance = ldb_msg_find_attr_as_uint(result->msgs[0], "gPOptions", 0);
770
771 talloc_free(mem_ctx);
772 return NT_STATUS_OK;
773 }
774
775 NTSTATUS gp_set_inheritance(struct gp_context *gp_ctx, const char *dn_str, enum gpo_inheritance inheritance)
776 {
777 char *inheritance_string;
778 struct ldb_message *msg;
779 int rv;
780
781 msg = ldb_msg_new(gp_ctx);
782 NT_STATUS_HAVE_NO_MEMORY(msg);
783
784 msg->dn = ldb_dn_new(msg, gp_ctx->ldb_ctx, dn_str);
785
786 inheritance_string = talloc_asprintf(msg, "%d", inheritance);
787 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(inheritance_string, msg);
788
789 rv = ldb_msg_add_string(msg, "gPOptions", inheritance_string);
790 if (rv != 0) {
791 DEBUG(0, ("LDB message add string failed: %s\n", ldb_strerror(rv)));
792 talloc_free(msg);
793 return NT_STATUS_UNSUCCESSFUL;
794 }
795 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
796
797 rv = ldb_modify(gp_ctx->ldb_ctx, msg);
798 if (rv != 0) {
799 DEBUG(0, ("LDB modify failed: %s\n", ldb_strerror(rv)));
800 talloc_free(msg);
801 return NT_STATUS_UNSUCCESSFUL;
802 }
803
804 talloc_free(msg);
805 return NT_STATUS_OK;
806 }
807
808 NTSTATUS gp_create_ldap_gpo(struct gp_context *gp_ctx, struct gp_object *gpo)
809 {
810 struct ldb_message *msg;
811 TALLOC_CTX *mem_ctx;
812 int rv;
813 char *dn_str, *flags_str, *version_str;
814 struct ldb_dn *child_dn, *gpo_dn;
815
816 mem_ctx = talloc_new(gp_ctx);
817 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
818
819 /* CN={GUID} */
820 msg = ldb_msg_new(mem_ctx);
821 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
822
823 msg->dn = ldb_get_default_basedn(gp_ctx->ldb_ctx);
824 dn_str = talloc_asprintf(mem_ctx, "CN=%s,CN=Policies,CN=System", gpo->name);
825 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dn_str, mem_ctx);
826
827 child_dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
828 rv = ldb_dn_add_child(msg->dn, child_dn);
829 if (!rv) goto ldb_msg_add_error;
830
831 flags_str = talloc_asprintf(mem_ctx, "%d", gpo->flags);
832 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(flags_str, mem_ctx);
833
834 version_str = talloc_asprintf(mem_ctx, "%d", gpo->version);
835 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(version_str, mem_ctx);
836
837 rv = ldb_msg_add_string(msg, "objectClass", "top");
838 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
839 rv = ldb_msg_add_string(msg, "objectClass", "container");
840 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
841 rv = ldb_msg_add_string(msg, "objectClass", "groupPolicyContainer");
842 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
843 rv = ldb_msg_add_string(msg, "displayName", gpo->display_name);
844 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
845 rv = ldb_msg_add_string(msg, "name", gpo->name);
846 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
847 rv = ldb_msg_add_string(msg, "CN", gpo->name);
848 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
849 rv = ldb_msg_add_string(msg, "gPCFileSysPath", gpo->file_sys_path);
850 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
851 rv = ldb_msg_add_string(msg, "flags", flags_str);
852 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
853 rv = ldb_msg_add_string(msg, "versionNumber", version_str);
854 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
855 rv = ldb_msg_add_string(msg, "showInAdvancedViewOnly", "TRUE");
856 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
857 rv = ldb_msg_add_string(msg, "gpCFunctionalityVersion", "2");
858 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
859
860 rv = ldb_add(gp_ctx->ldb_ctx, msg);
861 if (rv != LDB_SUCCESS) {
862 DEBUG(0, ("LDB add error: %s\n", ldb_errstring(gp_ctx->ldb_ctx)));
863 talloc_free(mem_ctx);
864 return NT_STATUS_UNSUCCESSFUL;
865 }
866
867 gpo_dn = msg->dn;
868
869 /* CN=User */
870 msg = ldb_msg_new(mem_ctx);
871 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
872
873 msg->dn = ldb_dn_copy(mem_ctx, gpo_dn);
874 child_dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, "CN=User");
875 rv = ldb_dn_add_child(msg->dn, child_dn);
876 if (!rv) goto ldb_msg_add_error;
877
878 rv = ldb_msg_add_string(msg, "objectClass", "top");
879 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
880 rv = ldb_msg_add_string(msg, "objectClass", "container");
881 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
882 rv = ldb_msg_add_string(msg, "showInAdvancedViewOnly", "TRUE");
883 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
884 rv = ldb_msg_add_string(msg, "CN", "User");
885 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
886 rv = ldb_msg_add_string(msg, "name", "User");
887 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
888
889 rv = ldb_add(gp_ctx->ldb_ctx, msg);
890 if (rv != LDB_SUCCESS) {
891 DEBUG(0, ("LDB add error: %s\n", ldb_errstring(gp_ctx->ldb_ctx)));
892 talloc_free(mem_ctx);
893 return NT_STATUS_UNSUCCESSFUL;
894 }
895
896 /* CN=Machine */
897 msg = ldb_msg_new(mem_ctx);
898 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
899
900 msg->dn = ldb_dn_copy(mem_ctx, gpo_dn);
901 child_dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, "CN=Machine");
902 rv = ldb_dn_add_child(msg->dn, child_dn);
903 if (!rv) goto ldb_msg_add_error;
904
905 rv = ldb_msg_add_string(msg, "objectClass", "top");
906 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
907 rv = ldb_msg_add_string(msg, "objectClass", "container");
908 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
909 rv = ldb_msg_add_string(msg, "showInAdvancedViewOnly", "TRUE");
910 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
911 rv = ldb_msg_add_string(msg, "CN", "Machine");
912 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
913 rv = ldb_msg_add_string(msg, "name", "Machine");
914 if (rv != LDB_SUCCESS) goto ldb_msg_add_error;
915
916 rv = ldb_add(gp_ctx->ldb_ctx, msg);
917 if (rv != LDB_SUCCESS) {
918 DEBUG(0, ("LDB add error: %s\n", ldb_errstring(gp_ctx->ldb_ctx)));
919 talloc_free(mem_ctx);
920 return NT_STATUS_UNSUCCESSFUL;
921 }
922
923 gpo->dn = talloc_strdup(gpo, ldb_dn_get_linearized(gpo_dn));
924 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(gpo->dn, mem_ctx);
925
926 talloc_free(mem_ctx);
927 return NT_STATUS_OK;
928
929 ldb_msg_add_error:
930 DEBUG(0, ("LDB Error adding element to ldb message\n"));
931 talloc_free(mem_ctx);
932 return NT_STATUS_UNSUCCESSFUL;
933 }
934
935 NTSTATUS gp_set_ads_acl (struct gp_context *gp_ctx, const char *dn_str, const struct security_descriptor *sd)
936 {
937 TALLOC_CTX *mem_ctx;
938 DATA_BLOB data;
939 enum ndr_err_code ndr_err;
940 struct ldb_message *msg;
941 int rv;
942
943 /* Create a forked memory context to clean up easily */
944 mem_ctx = talloc_new(gp_ctx);
945 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
946
947 /* Push the security descriptor through the NDR library */
948 ndr_err = ndr_push_struct_blob(&data,
949 mem_ctx,
950 sd,
951 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
952 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
953 return ndr_map_error2ntstatus(ndr_err);
954 }
955
956
957 /* Create a LDB message */
958 msg = ldb_msg_new(mem_ctx);
959 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
960
961 msg->dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, dn_str);
962
963 rv = ldb_msg_add_value(msg, "nTSecurityDescriptor", &data, NULL);
964 if (rv != 0) {
965 DEBUG(0, ("LDB message add element failed for adding nTSecurityDescriptor: %s\n", ldb_strerror(rv)));
966 talloc_free(mem_ctx);
967 return NT_STATUS_UNSUCCESSFUL;
968 }
969 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
970
971 rv = ldb_modify(gp_ctx->ldb_ctx, msg);
972 if (rv != 0) {
973 DEBUG(0, ("LDB modify failed: %s\n", ldb_strerror(rv)));
974 talloc_free(mem_ctx);
975 return NT_STATUS_UNSUCCESSFUL;
976 }
977
978 talloc_free(mem_ctx);
979 return NT_STATUS_OK;
980 }
981
982 /* This function sets flags, version and displayName on a GPO */
983 NTSTATUS gp_set_ldap_gpo(struct gp_context *gp_ctx, struct gp_object *gpo)
984 {
985 int rv;
986 TALLOC_CTX *mem_ctx;
987 struct ldb_message *msg;
988 char *version_str, *flags_str;
989
990 mem_ctx = talloc_new(gp_ctx);
991
992 msg = ldb_msg_new(mem_ctx);
993 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
994
995 msg->dn = ldb_dn_new(mem_ctx, gp_ctx->ldb_ctx, gpo->dn);
996
997 version_str = talloc_asprintf(mem_ctx, "%d", gpo->version);
998 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
999
1000 flags_str = talloc_asprintf(mem_ctx, "%d", gpo->flags);
1001 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, mem_ctx);
1002
1003 rv = ldb_msg_add_string(msg, "flags", flags_str);
1004 if (rv != 0) {
1005 DEBUG(0, ("LDB message add string failed for flags: %s\n", ldb_strerror(rv)));
1006 talloc_free(mem_ctx);
1007 return NT_STATUS_UNSUCCESSFUL;
1008 }
1009 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
1010
1011 rv = ldb_msg_add_string(msg, "version", version_str);
1012 if (rv != 0) {
1013 DEBUG(0, ("LDB message add string failed for version: %s\n", ldb_strerror(rv)));
1014 talloc_free(mem_ctx);
1015 return NT_STATUS_UNSUCCESSFUL;
1016 }
1017 msg->elements[1].flags = LDB_FLAG_MOD_REPLACE;
1018
1019 rv = ldb_msg_add_string(msg, "displayName", gpo->display_name);
1020 if (rv != 0) {
1021 DEBUG(0, ("LDB message add string failed for displayName: %s\n", ldb_strerror(rv)));
1022 talloc_free(mem_ctx);
1023 return NT_STATUS_UNSUCCESSFUL;
1024 }
1025 msg->elements[2].flags = LDB_FLAG_MOD_REPLACE;
1026
1027 rv = ldb_modify(gp_ctx->ldb_ctx, msg);
1028 if (rv != 0) {
1029 DEBUG(0, ("LDB modify failed: %s\n", ldb_strerror(rv)));
1030 talloc_free(mem_ctx);
1031 return NT_STATUS_UNSUCCESSFUL;
1032 }
1033
1034 talloc_free(mem_ctx);
1035 return NT_STATUS_OK;
1036 }
reg import