2 Unix SMB/CIFS implementation.
3 Samba utility functions
5 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2008-2010
6 Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "auth/credentials/pycredentials.h"
27 #include "libcli/security/security.h"
28 #include "lib/events/events.h"
29 #include "param/pyparam.h"
30 #include "auth/gensec/gensec.h"
31 #include "librpc/rpc/pyrpc_util.h"
32 #include "libcli/resolve/resolve.h"
33 #include "libcli/finddc.h"
34 #include "dsdb/samdb/samdb.h"
39 static PyObject
*py_net_join_member(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
41 struct libnet_Join_member r
;
46 const char *kwnames
[] = { "domain_name", "netbios_name", "level", "machinepass", NULL
};
50 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "ssi|z:Join", discard_const_p(char *, kwnames
),
51 &r
.in
.domain_name
, &r
.in
.netbios_name
,
53 &r
.in
.account_pass
)) {
58 mem_ctx
= talloc_new(self
->mem_ctx
);
59 if (mem_ctx
== NULL
) {
64 status
= libnet_Join_member(self
->libnet_ctx
, mem_ctx
, &r
);
65 if (NT_STATUS_IS_ERR(status
)) {
66 PyErr_SetString(PyExc_RuntimeError
, r
.out
.error_string
?r
.out
.error_string
:nt_errstr(status
));
71 result
= Py_BuildValue("sss", r
.out
.join_password
,
72 dom_sid_string(mem_ctx
, r
.out
.domain_sid
),
80 static const char py_net_join_member_doc
[] = "join_member(domain_name, netbios_name, level) -> (join_password, domain_sid, domain_name)\n\n" \
81 "Join the domain with the specified name.";
83 static PyObject
*py_net_change_password(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
85 union libnet_ChangePassword r
;
88 struct tevent_context
*ev
;
89 const char *kwnames
[] = { "newpassword", NULL
};
93 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "s:change_password",
94 discard_const_p(char *, kwnames
),
95 &r
.generic
.in
.newpassword
)) {
99 r
.generic
.level
= LIBNET_CHANGE_PASSWORD_GENERIC
;
100 r
.generic
.in
.account_name
= cli_credentials_get_username(self
->libnet_ctx
->cred
);
101 r
.generic
.in
.domain_name
= cli_credentials_get_domain(self
->libnet_ctx
->cred
);
102 r
.generic
.in
.oldpassword
= cli_credentials_get_password(self
->libnet_ctx
->cred
);
104 /* FIXME: we really need to get a context from the caller or we may end
105 * up with 2 event contexts */
106 ev
= s4_event_context_init(NULL
);
108 mem_ctx
= talloc_new(ev
);
109 if (mem_ctx
== NULL
) {
114 status
= libnet_ChangePassword(self
->libnet_ctx
, mem_ctx
, &r
);
115 if (NT_STATUS_IS_ERR(status
)) {
116 PyErr_SetString(PyExc_RuntimeError
,
117 r
.generic
.out
.error_string
?r
.generic
.out
.error_string
:nt_errstr(status
));
118 talloc_free(mem_ctx
);
122 talloc_free(mem_ctx
);
127 static const char py_net_change_password_doc
[] = "change_password(newpassword) -> True\n\n" \
128 "Change password for a user. You must supply credential with enough rights to do this.\n\n" \
129 "Sample usage is:\n" \
130 "net.set_password(newpassword=<new_password>\n";
133 static PyObject
*py_net_set_password(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
135 union libnet_SetPassword r
;
138 struct tevent_context
*ev
;
139 const char *kwnames
[] = { "account_name", "domain_name", "newpassword", NULL
};
143 r
.generic
.level
= LIBNET_SET_PASSWORD_GENERIC
;
145 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "sss:set_password",
146 discard_const_p(char *, kwnames
),
147 &r
.generic
.in
.account_name
,
148 &r
.generic
.in
.domain_name
,
149 &r
.generic
.in
.newpassword
)) {
153 /* FIXME: we really need to get a context from the caller or we may end
154 * up with 2 event contexts */
155 ev
= s4_event_context_init(NULL
);
157 mem_ctx
= talloc_new(ev
);
158 if (mem_ctx
== NULL
) {
163 status
= libnet_SetPassword(self
->libnet_ctx
, mem_ctx
, &r
);
164 if (NT_STATUS_IS_ERR(status
)) {
165 PyErr_SetString(PyExc_RuntimeError
,
166 r
.generic
.out
.error_string
?r
.generic
.out
.error_string
:nt_errstr(status
));
167 talloc_free(mem_ctx
);
171 talloc_free(mem_ctx
);
176 static const char py_net_set_password_doc
[] = "set_password(account_name, domain_name, newpassword) -> True\n\n" \
177 "Set password for a user. You must supply credential with enough rights to do this.\n\n" \
178 "Sample usage is:\n" \
179 "net.set_password(account_name=<account_name>,\n" \
180 " domain_name=domain_name,\n" \
181 " newpassword=new_pass)\n";
184 static PyObject
*py_net_time(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
186 const char *kwnames
[] = { "server_name", NULL
};
187 union libnet_RemoteTOD r
;
194 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "s",
195 discard_const_p(char *, kwnames
), &r
.generic
.in
.server_name
))
198 r
.generic
.level
= LIBNET_REMOTE_TOD_GENERIC
;
200 mem_ctx
= talloc_new(NULL
);
201 if (mem_ctx
== NULL
) {
206 status
= libnet_RemoteTOD(self
->libnet_ctx
, mem_ctx
, &r
);
207 if (!NT_STATUS_IS_OK(status
)) {
208 PyErr_SetString(PyExc_RuntimeError
,
209 r
.generic
.out
.error_string
?r
.generic
.out
.error_string
:nt_errstr(status
));
210 talloc_free(mem_ctx
);
214 ZERO_STRUCT(timestr
);
215 tm
= localtime(&r
.generic
.out
.time
);
216 strftime(timestr
, sizeof(timestr
)-1, "%c %Z",tm
);
218 ret
= PyString_FromString(timestr
);
220 talloc_free(mem_ctx
);
225 static const char py_net_time_doc
[] = "time(server_name) -> timestr\n"
226 "Retrieve the remote time on a server";
228 static PyObject
*py_net_user_create(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
230 const char *kwnames
[] = { "username", NULL
};
233 struct libnet_CreateUser r
;
235 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "s", discard_const_p(char *, kwnames
),
239 r
.in
.domain_name
= cli_credentials_get_domain(self
->libnet_ctx
->cred
);
241 mem_ctx
= talloc_new(NULL
);
242 if (mem_ctx
== NULL
) {
247 status
= libnet_CreateUser(self
->libnet_ctx
, mem_ctx
, &r
);
248 if (!NT_STATUS_IS_OK(status
)) {
249 PyErr_SetString(PyExc_RuntimeError
, r
.out
.error_string
?r
.out
.error_string
:nt_errstr(status
));
250 talloc_free(mem_ctx
);
254 talloc_free(mem_ctx
);
259 static const char py_net_create_user_doc
[] = "create_user(username)\n"
260 "Create a new user.";
262 static PyObject
*py_net_user_delete(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
264 const char *kwnames
[] = { "username", NULL
};
267 struct libnet_DeleteUser r
;
269 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "s", discard_const_p(char *, kwnames
),
273 r
.in
.domain_name
= cli_credentials_get_domain(self
->libnet_ctx
->cred
);
275 mem_ctx
= talloc_new(NULL
);
276 if (mem_ctx
== NULL
) {
281 status
= libnet_DeleteUser(self
->libnet_ctx
, mem_ctx
, &r
);
282 if (!NT_STATUS_IS_OK(status
)) {
283 PyErr_SetString(PyExc_RuntimeError
, r
.out
.error_string
?r
.out
.error_string
:nt_errstr(status
));
284 talloc_free(mem_ctx
);
288 talloc_free(mem_ctx
);
293 static const char py_net_delete_user_doc
[] = "delete_user(username)\n"
296 static PyObject
*py_dom_sid_FromSid(struct dom_sid
*sid
)
298 PyObject
*mod_security
, *dom_sid_Type
;
300 mod_security
= PyImport_ImportModule("samba.dcerpc.security");
301 if (mod_security
== NULL
)
304 dom_sid_Type
= PyObject_GetAttrString(mod_security
, "dom_sid");
305 if (dom_sid_Type
== NULL
)
308 return pytalloc_reference((PyTypeObject
*)dom_sid_Type
, sid
);
311 static PyObject
*py_net_vampire(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
313 const char *kwnames
[] = { "domain", "target_dir", NULL
};
317 struct libnet_Vampire r
;
321 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "s|z", discard_const_p(char *, kwnames
),
322 &r
.in
.domain_name
, &r
.in
.targetdir
)) {
326 r
.in
.netbios_name
= lpcfg_netbios_name(self
->libnet_ctx
->lp_ctx
);
327 r
.out
.error_string
= NULL
;
329 mem_ctx
= talloc_new(NULL
);
330 if (mem_ctx
== NULL
) {
335 status
= libnet_Vampire(self
->libnet_ctx
, mem_ctx
, &r
);
337 if (!NT_STATUS_IS_OK(status
)) {
338 PyErr_SetString(PyExc_RuntimeError
,
339 r
.out
.error_string
? r
.out
.error_string
: nt_errstr(status
));
340 talloc_free(mem_ctx
);
344 ret
= Py_BuildValue("(sO)", r
.out
.domain_name
, py_dom_sid_FromSid(r
.out
.domain_sid
));
346 talloc_free(mem_ctx
);
351 struct replicate_state
{
353 dcerpc_InterfaceObject
*drs_pipe
;
354 struct libnet_BecomeDC_StoreChunk chunk
;
355 DATA_BLOB gensec_skey
;
356 struct libnet_BecomeDC_Partition partition
;
357 struct libnet_BecomeDC_Forest forest
;
358 struct libnet_BecomeDC_DestDSA dest_dsa
;
362 setup for replicate_chunk() calls
364 static PyObject
*py_net_replicate_init(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
366 const char *kwnames
[] = { "samdb", "lp", "drspipe", NULL
};
367 PyObject
*py_ldb
, *py_lp
, *py_drspipe
;
368 struct ldb_context
*samdb
;
369 struct loadparm_context
*lp
;
370 struct replicate_state
*s
;
373 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "OOO",
374 discard_const_p(char *, kwnames
),
375 &py_ldb
, &py_lp
, &py_drspipe
)) {
379 s
= talloc_zero(NULL
, struct replicate_state
);
382 lp
= lpcfg_from_py_object(s
, py_lp
);
384 PyErr_SetString(PyExc_TypeError
, "Expected lp object");
389 samdb
= pyldb_Ldb_AsLdbContext(py_ldb
);
391 PyErr_SetString(PyExc_TypeError
, "Expected ldb object");
396 s
->drs_pipe
= (dcerpc_InterfaceObject
*)(py_drspipe
);
398 s
->vampire_state
= libnet_vampire_replicate_init(s
, samdb
, lp
);
399 if (s
->vampire_state
== NULL
) {
400 PyErr_SetString(PyExc_TypeError
, "Failed to initialise vampire_state");
405 status
= gensec_session_key(s
->drs_pipe
->pipe
->conn
->security_state
.generic_state
,
408 if (!NT_STATUS_IS_OK(status
)) {
409 PyErr_Format(PyExc_RuntimeError
, "Unable to get session key from drspipe: %s",
415 s
->forest
.dns_name
= samdb_dn_to_dns_domain(s
, ldb_get_root_basedn(samdb
));
416 s
->forest
.root_dn_str
= ldb_dn_get_linearized(ldb_get_root_basedn(samdb
));
417 s
->forest
.config_dn_str
= ldb_dn_get_linearized(ldb_get_config_basedn(samdb
));
418 s
->forest
.schema_dn_str
= ldb_dn_get_linearized(ldb_get_schema_basedn(samdb
));
420 s
->chunk
.gensec_skey
= &s
->gensec_skey
;
421 s
->chunk
.partition
= &s
->partition
;
422 s
->chunk
.forest
= &s
->forest
;
423 s
->chunk
.dest_dsa
= &s
->dest_dsa
;
425 return pytalloc_CObject_FromTallocPtr(s
);
430 process one replication chunk
432 static PyObject
*py_net_replicate_chunk(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
434 const char *kwnames
[] = { "state", "level", "ctr",
435 "schema", "req_level", "req",
437 PyObject
*py_state
, *py_ctr
, *py_schema
= Py_None
, *py_req
= Py_None
;
438 struct replicate_state
*s
;
440 unsigned req_level
= 0;
441 NTSTATUS (*chunk_handler
)(void *private_data
, const struct libnet_BecomeDC_StoreChunk
*c
);
444 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "OIO|OIO",
445 discard_const_p(char *, kwnames
),
446 &py_state
, &level
, &py_ctr
,
447 &py_schema
, &req_level
, &py_req
)) {
451 s
= talloc_get_type(PyCObject_AsVoidPtr(py_state
), struct replicate_state
);
453 PyErr_SetString(PyExc_TypeError
, "Expected replication_state");
459 if (!py_check_dcerpc_type(py_ctr
, "samba.dcerpc.drsuapi", "DsGetNCChangesCtr1")) {
462 s
->chunk
.ctr1
= pytalloc_get_ptr(py_ctr
);
463 s
->partition
.nc
= *s
->chunk
.ctr1
->naming_context
;
464 s
->partition
.more_data
= s
->chunk
.ctr1
->more_data
;
465 s
->partition
.source_dsa_guid
= s
->chunk
.ctr1
->source_dsa_guid
;
466 s
->partition
.source_dsa_invocation_id
= s
->chunk
.ctr1
->source_dsa_invocation_id
;
467 s
->partition
.highwatermark
= s
->chunk
.ctr1
->new_highwatermark
;
470 if (!py_check_dcerpc_type(py_ctr
, "samba.dcerpc.drsuapi", "DsGetNCChangesCtr6")) {
473 s
->chunk
.ctr6
= pytalloc_get_ptr(py_ctr
);
474 s
->partition
.nc
= *s
->chunk
.ctr6
->naming_context
;
475 s
->partition
.more_data
= s
->chunk
.ctr6
->more_data
;
476 s
->partition
.source_dsa_guid
= s
->chunk
.ctr6
->source_dsa_guid
;
477 s
->partition
.source_dsa_invocation_id
= s
->chunk
.ctr6
->source_dsa_invocation_id
;
478 s
->partition
.highwatermark
= s
->chunk
.ctr6
->new_highwatermark
;
481 PyErr_Format(PyExc_TypeError
, "Bad level %u in replicate_chunk", level
);
485 s
->chunk
.req5
= NULL
;
486 s
->chunk
.req8
= NULL
;
487 s
->chunk
.req10
= NULL
;
493 if (!py_check_dcerpc_type(py_req
, "samba.dcerpc.drsuapi", "DsGetNCChangesRequest5")) {
497 s
->chunk
.req5
= pytalloc_get_ptr(py_req
);
500 if (!py_check_dcerpc_type(py_req
, "samba.dcerpc.drsuapi", "DsGetNCChangesRequest8")) {
504 s
->chunk
.req8
= pytalloc_get_ptr(py_req
);
507 if (!py_check_dcerpc_type(py_req
, "samba.dcerpc.drsuapi", "DsGetNCChangesRequest10")) {
511 s
->chunk
.req10
= pytalloc_get_ptr(py_req
);
514 PyErr_Format(PyExc_TypeError
, "Bad req_level %u in replicate_chunk", req_level
);
518 s
->chunk
.req_level
= req_level
;
520 chunk_handler
= libnet_vampire_cb_store_chunk
;
522 if (!PyBool_Check(py_schema
)) {
523 PyErr_SetString(PyExc_TypeError
, "Expected boolean schema");
526 if (py_schema
== Py_True
) {
527 chunk_handler
= libnet_vampire_cb_schema_chunk
;
531 s
->chunk
.ctr_level
= level
;
533 status
= chunk_handler(s
->vampire_state
, &s
->chunk
);
534 if (!NT_STATUS_IS_OK(status
)) {
535 PyErr_Format(PyExc_TypeError
, "Failed to process chunk: %s", nt_errstr(status
));
544 find a DC given a domain name and server type
546 static PyObject
*py_net_finddc(py_net_Object
*self
, PyObject
*args
, PyObject
*kwargs
)
548 const char *domain
= NULL
, *address
= NULL
;
549 unsigned server_type
;
554 const char * const kwnames
[] = { "flags", "domain", "address", NULL
};
556 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "I|ss",
557 discard_const_p(char *, kwnames
),
558 &server_type
, &domain
, &address
)) {
562 mem_ctx
= talloc_new(self
->mem_ctx
);
564 io
= talloc_zero(mem_ctx
, struct finddcs
);
565 if (domain
!= NULL
) {
566 io
->in
.domain_name
= domain
;
568 if (address
!= NULL
) {
569 io
->in
.server_address
= address
;
571 io
->in
.minimum_dc_flags
= server_type
;
573 status
= finddcs_cldap(io
, io
,
574 lpcfg_resolve_context(self
->libnet_ctx
->lp_ctx
), self
->ev
);
575 if (NT_STATUS_IS_ERR(status
)) {
576 PyErr_SetString(PyExc_RuntimeError
, nt_errstr(status
));
577 talloc_free(mem_ctx
);
581 ret
= py_return_ndr_struct("samba.dcerpc.nbt", "NETLOGON_SAM_LOGON_RESPONSE_EX",
582 io
, &io
->out
.netlogon
.data
.nt5_ex
);
583 talloc_free(mem_ctx
);
589 static const char py_net_vampire_doc
[] = "vampire(domain, target_dir=None)\n"
592 static const char py_net_replicate_init_doc
[] = "replicate_init(samdb, lp, drspipe)\n"
593 "Setup for replicate_chunk calls.";
595 static const char py_net_replicate_chunk_doc
[] = "replicate_chunk(state, level, ctr, schema)\n"
596 "Process replication for one chunk";
598 static const char py_net_finddc_doc
[] = "finddc(flags=server_type, domain=None, address=None)\n"
599 "Find a DC with the specified 'server_type' bits. The 'domain' and/or 'address' have to be used as additional search criteria. Returns the whole netlogon struct";
601 static PyMethodDef net_obj_methods
[] = {
602 {"join_member", (PyCFunction
)py_net_join_member
, METH_VARARGS
|METH_KEYWORDS
, py_net_join_member_doc
},
603 {"change_password", (PyCFunction
)py_net_change_password
, METH_VARARGS
|METH_KEYWORDS
, py_net_change_password_doc
},
604 {"set_password", (PyCFunction
)py_net_set_password
, METH_VARARGS
|METH_KEYWORDS
, py_net_set_password_doc
},
605 {"time", (PyCFunction
)py_net_time
, METH_VARARGS
|METH_KEYWORDS
, py_net_time_doc
},
606 {"create_user", (PyCFunction
)py_net_user_create
, METH_VARARGS
|METH_KEYWORDS
, py_net_create_user_doc
},
607 {"delete_user", (PyCFunction
)py_net_user_delete
, METH_VARARGS
|METH_KEYWORDS
, py_net_delete_user_doc
},
608 {"vampire", (PyCFunction
)py_net_vampire
, METH_VARARGS
|METH_KEYWORDS
, py_net_vampire_doc
},
609 {"replicate_init", (PyCFunction
)py_net_replicate_init
, METH_VARARGS
|METH_KEYWORDS
, py_net_replicate_init_doc
},
610 {"replicate_chunk", (PyCFunction
)py_net_replicate_chunk
, METH_VARARGS
|METH_KEYWORDS
, py_net_replicate_chunk_doc
},
611 {"finddc", (PyCFunction
)py_net_finddc
, METH_KEYWORDS
, py_net_finddc_doc
},
615 static void py_net_dealloc(py_net_Object
*self
)
617 talloc_free(self
->mem_ctx
);
621 static PyObject
*net_obj_new(PyTypeObject
*type
, PyObject
*args
, PyObject
*kwargs
)
623 PyObject
*py_creds
, *py_lp
= Py_None
;
624 const char *kwnames
[] = { "creds", "lp", "server", NULL
};
626 struct loadparm_context
*lp
;
627 const char *server_address
= NULL
;
629 if (!PyArg_ParseTupleAndKeywords(args
, kwargs
, "O|Oz",
630 discard_const_p(char *, kwnames
), &py_creds
, &py_lp
,
634 ret
= PyObject_New(py_net_Object
, type
);
639 /* FIXME: we really need to get a context from the caller or we may end
640 * up with 2 event contexts */
641 ret
->ev
= s4_event_context_init(NULL
);
642 ret
->mem_ctx
= talloc_new(ret
->ev
);
644 lp
= lpcfg_from_py_object(ret
->mem_ctx
, py_lp
);
650 ret
->libnet_ctx
= libnet_context_init(ret
->ev
, lp
);
651 if (ret
->libnet_ctx
== NULL
) {
652 PyErr_SetString(PyExc_RuntimeError
, "Unable to initialize net");
657 ret
->libnet_ctx
->server_address
= server_address
;
659 ret
->libnet_ctx
->cred
= cli_credentials_from_py_object(py_creds
);
660 if (ret
->libnet_ctx
->cred
== NULL
) {
661 PyErr_SetString(PyExc_TypeError
, "Expected credentials object");
666 return (PyObject
*)ret
;
670 PyTypeObject py_net_Type
= {
671 PyObject_HEAD_INIT(NULL
) 0,
672 .tp_name
= "net.Net",
673 .tp_basicsize
= sizeof(py_net_Object
),
674 .tp_dealloc
= (destructor
)py_net_dealloc
,
675 .tp_methods
= net_obj_methods
,
676 .tp_new
= net_obj_new
,
683 if (PyType_Ready(&py_net_Type
) < 0)
686 m
= Py_InitModule3("net", NULL
, NULL
);
690 Py_INCREF(&py_net_Type
);
691 PyModule_AddObject(m
, "Net", (PyObject
*)&py_net_Type
);
692 PyModule_AddObject(m
, "LIBNET_JOINDOMAIN_AUTOMATIC", PyInt_FromLong(LIBNET_JOINDOMAIN_AUTOMATIC
));
693 PyModule_AddObject(m
, "LIBNET_JOINDOMAIN_SPECIFIED", PyInt_FromLong(LIBNET_JOINDOMAIN_SPECIFIED
));
694 PyModule_AddObject(m
, "LIBNET_JOIN_AUTOMATIC", PyInt_FromLong(LIBNET_JOIN_AUTOMATIC
));
695 PyModule_AddObject(m
, "LIBNET_JOIN_SPECIFIED", PyInt_FromLong(LIBNET_JOIN_SPECIFIED
));