2 Unix SMB/CIFS implementation.
3 Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "param/pyparam.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
30 #include "python/py3compat.h"
31 #include "python/modules.h"
33 #include "../libcli/security/security.h"
35 /* A Python C API module to use LIBGPO */
37 #define GPO_getter(ATTR) \
38 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
40 struct GROUP_POLICY_OBJECT *gpo_ptr \
41 = pytalloc_get_ptr(self); \
44 return PyUnicode_FromString(gpo_ptr->ATTR); \
49 GPO_getter(file_sys_path)
50 GPO_getter(display_name)
53 GPO_getter(user_extensions)
54 GPO_getter(machine_extensions)
55 #define GPO_setter(ATTR) \
56 static int GPO_set_##ATTR(PyObject *self, PyObject *val, void *closure) \
58 struct GROUP_POLICY_OBJECT *gpo_ptr \
59 = pytalloc_get_ptr(self); \
61 if (!PyUnicode_Check(val)) { \
62 PyErr_Format(PyExc_TypeError, \
63 "Cannot convert input to string"); \
66 if (val != Py_None) { \
67 gpo_ptr->ATTR = talloc_strdup(gpo_ptr, \
68 _PyUnicode_AsString(val)); \
70 gpo_ptr->ATTR = NULL; \
75 GPO_setter(file_sys_path)
76 GPO_setter(display_name)
79 GPO_setter(user_extensions)
80 GPO_setter(machine_extensions)
81 #define GPO_int_getter(ATTR) \
82 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
84 struct GROUP_POLICY_OBJECT *gpo_ptr \
85 = pytalloc_get_ptr(self); \
87 return PyLong_FromLong(gpo_ptr->ATTR); \
89 GPO_int_getter(options)
90 GPO_int_getter(version)
91 GPO_int_getter(link_type)
92 #define GPO_int_setter(ATTR) \
93 static int GPO_set_##ATTR(PyObject *self, PyObject *val, void *closure) \
95 struct GROUP_POLICY_OBJECT *gpo_ptr \
96 = pytalloc_get_ptr(self); \
98 if (!PyLong_Check(val)) { \
99 PyErr_Format(PyExc_TypeError, \
100 "Cannot convert input to int"); \
103 gpo_ptr->ATTR = PyLong_AsLong(val); \
107 GPO_int_setter(options)
108 GPO_int_setter(version)
109 GPO_int_setter(link_type)
111 static PyObject *GPO_marshall_get_sec_desc_buf(PyObject *self, PyObject *args,
114 struct GROUP_POLICY_OBJECT *gpo_ptr = pytalloc_get_ptr(self);
116 uint8_t *data = NULL;
119 status = marshall_sec_desc(gpo_ptr, gpo_ptr->security_descriptor,
121 if (!NT_STATUS_IS_OK(status)) {
122 PyErr_Format(PyExc_BufferError,
123 "marshall_sec_desc_buf failed: %s",
128 return PyBytes_FromStringAndSize((char *)data, len);
131 static PyObject *GPO_unmarshall_set_sec_desc(PyObject *self, PyObject *args,
134 struct GROUP_POLICY_OBJECT *gpo_ptr = pytalloc_get_ptr(self);
139 if (!PyArg_ParseTuple(args, "s#", &bytes, &length)) {
140 PyErr_Format(PyExc_TypeError,
141 "Cannot convert input to bytes");
145 gpo_ptr->security_descriptor = talloc_zero(gpo_ptr,
146 struct security_descriptor);
147 status = unmarshall_sec_desc(gpo_ptr, (uint8_t *)bytes, length,
148 &gpo_ptr->security_descriptor);
149 if (!NT_STATUS_IS_OK(status)) {
150 PyErr_Format(PyExc_BufferError,
151 "unmarshall_sec_desc failed: %s",
159 static PyGetSetDef GPO_setters[] = {
160 {discard_const_p(char, "options"), (getter)GPO_get_options,
161 (setter)GPO_set_options, NULL, NULL},
162 {discard_const_p(char, "version"), (getter)GPO_get_version,
163 (setter)GPO_set_version, NULL, NULL},
164 {discard_const_p(char, "ds_path"), (getter)GPO_get_ds_path,
165 (setter)GPO_set_ds_path, NULL, NULL},
166 {discard_const_p(char, "file_sys_path"), (getter)GPO_get_file_sys_path,
167 (setter)GPO_set_file_sys_path, NULL, NULL},
168 {discard_const_p(char, "display_name"), (getter)GPO_get_display_name,
169 (setter)GPO_set_display_name, NULL, NULL},
170 {discard_const_p(char, "name"), (getter)GPO_get_name,
171 (setter)GPO_set_name, NULL, NULL},
172 {discard_const_p(char, "link"), (getter)GPO_get_link,
173 (setter)GPO_set_link, NULL, NULL},
174 {discard_const_p(char, "link_type"), (getter)GPO_get_link_type,
175 (setter)GPO_set_link_type, NULL, NULL},
176 {discard_const_p(char, "user_extensions"),
177 (getter)GPO_get_user_extensions,
178 (setter)GPO_set_user_extensions, NULL, NULL},
179 {discard_const_p(char, "machine_extensions"),
180 (getter)GPO_get_machine_extensions,
181 (setter)GPO_set_machine_extensions, NULL, NULL},
185 static PyObject *py_gpo_get_unix_path(PyObject *self, PyObject *args,
189 const char *cache_dir = NULL;
190 PyObject *ret = NULL;
191 char *unix_path = NULL;
192 TALLOC_CTX *frame = NULL;
193 static const char *kwlist[] = {"cache_dir", NULL};
194 struct GROUP_POLICY_OBJECT *gpo_ptr \
195 = (struct GROUP_POLICY_OBJECT *)pytalloc_get_ptr(self);
197 frame = talloc_stackframe();
199 if (!PyArg_ParseTupleAndKeywords(args, kwds, "|s",
200 discard_const_p(char *, kwlist),
206 cache_dir = cache_path(talloc_tos(), GPO_CACHE_DIR);
208 PyErr_SetString(PyExc_MemoryError,
209 "Failed to determine gpo cache dir");
214 status = gpo_get_unix_path(frame, cache_dir, gpo_ptr, &unix_path);
216 if (!NT_STATUS_IS_OK(status)) {
217 PyErr_Format(PyExc_RuntimeError,
218 "Failed to determine gpo unix path: %s",
219 get_friendly_nt_error_msg(status));
223 ret = PyUnicode_FromString(unix_path);
230 static PyMethodDef GPO_methods[] = {
231 {"get_unix_path", PY_DISCARD_FUNC_SIG(PyCFunction,
232 py_gpo_get_unix_path),
233 METH_VARARGS | METH_KEYWORDS,
235 {"set_sec_desc", PY_DISCARD_FUNC_SIG(PyCFunction,
236 GPO_unmarshall_set_sec_desc),
237 METH_VARARGS, NULL },
238 {"get_sec_desc_buf", PY_DISCARD_FUNC_SIG(PyCFunction,
239 GPO_marshall_get_sec_desc_buf),
244 static int py_gpo_init(PyObject *self, PyObject *args, PyObject *kwds)
246 struct GROUP_POLICY_OBJECT *gpo_ptr = pytalloc_get_ptr(self);
247 const char *name = NULL;
248 const char *display_name = NULL;
249 enum GPO_LINK_TYPE link_type = GP_LINK_UNKOWN;
250 const char *file_sys_path = NULL;
252 static const char *kwlist[] = {
253 "name", "display_name", "link_type", "file_sys_path", NULL
255 if (!PyArg_ParseTupleAndKeywords(args, kwds, "|ssIs",
256 discard_const_p(char *, kwlist),
257 &name, &display_name, &link_type,
263 gpo_ptr->name = talloc_strdup(gpo_ptr, name);
266 gpo_ptr->display_name = talloc_strdup(gpo_ptr, display_name);
268 gpo_ptr->link_type = link_type;
270 gpo_ptr->file_sys_path = talloc_strdup(gpo_ptr, file_sys_path);
276 static PyObject *py_gpo_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
278 return pytalloc_new(struct GROUP_POLICY_OBJECT, type);
281 static PyTypeObject GPOType = {
282 PyVarObject_HEAD_INIT(NULL, 0)
283 .tp_name = "gpo.GROUP_POLICY_OBJECT",
284 .tp_doc = "GROUP_POLICY_OBJECT",
285 .tp_getset = GPO_setters,
286 .tp_methods = GPO_methods,
287 .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
288 .tp_new = py_gpo_new,
289 .tp_init = (initproc)py_gpo_init,
296 struct cli_credentials *cli_creds;
299 static void py_ads_dealloc(ADS* self)
301 TALLOC_FREE(self->ads_ptr);
302 Py_CLEAR(self->py_creds);
303 Py_TYPE(self)->tp_free((PyObject*)self);
306 static PyObject* py_ads_connect(ADS *self, PyObject *Py_UNUSED(ignored));
307 static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
309 const char *realm = NULL;
310 const char *workgroup = NULL;
311 const char *ldap_server = NULL;
312 PyObject *lp_obj = NULL;
313 PyObject *py_creds = NULL;
314 struct loadparm_context *lp_ctx = NULL;
317 static const char *kwlist[] = {
318 "ldap_server", "loadparm_context", "credentials", NULL
320 if (!PyArg_ParseTupleAndKeywords(args, kwds, "sO|O",
321 discard_const_p(char *, kwlist),
322 &ldap_server, &lp_obj, &py_creds)) {
325 /* keep reference to the credentials. Clear any earlier ones */
326 Py_CLEAR(self->py_creds);
327 self->cli_creds = NULL;
328 self->py_creds = py_creds;
329 Py_XINCREF(self->py_creds);
331 if (self->py_creds) {
332 ok = py_check_dcerpc_type(self->py_creds, "samba.credentials",
338 = PyCredentials_AsCliCredentials(self->py_creds);
341 ok = py_check_dcerpc_type(lp_obj, "samba.param", "LoadParm");
345 lp_ctx = pytalloc_get_type(lp_obj, struct loadparm_context);
346 if (lp_ctx == NULL) {
349 ok = lp_load_initial_only(lp_ctx->szConfigFile);
351 PyErr_Format(PyExc_RuntimeError, "Could not load config file '%s'",
352 lp_ctx->szConfigFile);
356 if (self->cli_creds) {
357 realm = cli_credentials_get_realm(self->cli_creds);
358 workgroup = cli_credentials_get_domain(self->cli_creds);
361 workgroup = lp_workgroup();
364 /* in case __init__ is called more than once */
366 TALLOC_FREE(self->ads_ptr);
368 /* always succeeds or crashes */
369 self->ads_ptr = ads_init(pytalloc_get_mem_ctx(args),
378 /* connect. Failure to connect results in an Exception */
379 static PyObject* py_ads_connect(ADS *self,
380 PyObject *Py_UNUSED(ignored))
383 TALLOC_CTX *frame = talloc_stackframe();
384 if (!self->ads_ptr) {
385 PyErr_SetString(PyExc_RuntimeError, "Uninitialized");
388 ADS_TALLOC_CONST_FREE(self->ads_ptr->auth.user_name);
389 ADS_TALLOC_CONST_FREE(self->ads_ptr->auth.password);
390 ADS_TALLOC_CONST_FREE(self->ads_ptr->auth.realm);
391 if (self->cli_creds) {
392 self->ads_ptr->auth.user_name = talloc_strdup(self->ads_ptr,
393 cli_credentials_get_username(self->cli_creds));
394 if (self->ads_ptr->auth.user_name == NULL) {
398 self->ads_ptr->auth.password = talloc_strdup(self->ads_ptr,
399 cli_credentials_get_password(self->cli_creds));
400 if (self->ads_ptr->auth.password == NULL) {
404 self->ads_ptr->auth.realm = talloc_strdup(self->ads_ptr,
405 cli_credentials_get_realm(self->cli_creds));
406 if (self->ads_ptr->auth.realm == NULL) {
410 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
411 status = ads_connect_user_creds(self->ads_ptr);
415 if (!secrets_init()) {
416 PyErr_SetString(PyExc_RuntimeError,
417 "secrets_init() failed");
421 self->ads_ptr->auth.user_name = talloc_asprintf(self->ads_ptr,
424 if (self->ads_ptr->auth.user_name == NULL) {
429 passwd = secrets_fetch_machine_password(
430 self->ads_ptr->server.workgroup, NULL, NULL);
431 if (passwd == NULL) {
432 PyErr_SetString(PyExc_RuntimeError,
433 "Failed to fetch the machine account "
438 self->ads_ptr->auth.password = talloc_strdup(self->ads_ptr,
441 if (self->ads_ptr->auth.password == NULL) {
445 self->ads_ptr->auth.realm = talloc_asprintf_strupper_m(
446 self->ads_ptr, "%s", self->ads_ptr->server.realm);
447 if (self->ads_ptr->auth.realm == NULL) {
451 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
452 status = ads_connect(self->ads_ptr);
454 if (!ADS_ERR_OK(status)) {
455 PyErr_Format(PyExc_RuntimeError,
456 "ads_connect() failed: %s",
469 /* Parameter mapping and functions for the GP_EXT struct */
472 /* Global methods aka do not need a special pyobject type */
473 static PyObject *py_gpo_get_sysvol_gpt_version(PyObject * self,
476 TALLOC_CTX *tmp_ctx = NULL;
478 char *display_name = NULL;
479 uint32_t sysvol_version = 0;
483 if (!PyArg_ParseTuple(args, "s", &unix_path)) {
486 tmp_ctx = talloc_new(NULL);
488 return PyErr_NoMemory();
490 status = gpo_get_sysvol_gpt_version(tmp_ctx, unix_path,
493 if (!NT_STATUS_IS_OK(status)) {
494 PyErr_SetNTSTATUS(status);
495 TALLOC_FREE(tmp_ctx);
499 result = Py_BuildValue("[s,i]", display_name, sysvol_version);
500 talloc_free(tmp_ctx);
505 static ADS_STATUS find_samaccount(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
506 const char *samaccountname,
507 uint32_t *uac_ret, const char **dn_ret)
510 const char *attrs[] = { "userAccountControl", NULL };
512 LDAPMessage *res = NULL;
516 filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
518 if (filter == NULL) {
519 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
523 status = ads_do_search_all(ads, ads->config.bind_path,
524 LDAP_SCOPE_SUBTREE, filter, attrs, &res);
526 if (!ADS_ERR_OK(status)) {
530 if (ads_count_replies(ads, res) != 1) {
531 status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
535 dn = ads_get_dn(ads, talloc_tos(), res);
537 status = ADS_ERROR(LDAP_NO_MEMORY);
541 if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
542 status = ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
551 *dn_ret = talloc_strdup(mem_ctx, dn);
552 if (*dn_ret == NULL) {
553 status = ADS_ERROR(LDAP_NO_MEMORY);
559 ads_msgfree(ads, res);
564 static PyObject *py_ads_get_gpo_list(ADS *self, PyObject *args, PyObject *kwds)
566 TALLOC_CTX *frame = NULL;
567 struct GROUP_POLICY_OBJECT *gpo = NULL, *gpo_list = NULL;
569 const char *samaccountname = NULL;
570 const char *dn = NULL;
573 struct security_token *token = NULL;
574 PyObject *ret = NULL;
575 TALLOC_CTX *gpo_ctx = NULL;
579 static const char *kwlist[] = {"samaccountname", NULL};
580 if (!PyArg_ParseTupleAndKeywords(args, kwds, "s",
581 discard_const_p(char *, kwlist),
585 if (!self->ads_ptr) {
586 PyErr_SetString(PyExc_RuntimeError, "Uninitialized");
590 frame = talloc_stackframe();
592 status = find_samaccount(self->ads_ptr, frame,
593 samaccountname, &uac, &dn);
594 if (!ADS_ERR_OK(status)) {
595 PyErr_Format(PyExc_RuntimeError,
596 "Failed to find samAccountName '%s': %s",
597 samaccountname, ads_errstr(status));
601 if (uac & UF_WORKSTATION_TRUST_ACCOUNT ||
602 uac & UF_SERVER_TRUST_ACCOUNT) {
603 flags |= GPO_LIST_FLAG_MACHINE;
604 status = gp_get_machine_token(self->ads_ptr, frame, dn,
606 if (!ADS_ERR_OK(status)) {
607 PyErr_Format(PyExc_RuntimeError,
608 "Failed to get machine token for '%s'(%s): %s",
609 samaccountname, dn, ads_errstr(status));
613 status = ads_get_sid_token(self->ads_ptr, frame, dn, &token);
614 if (!ADS_ERR_OK(status)) {
615 PyErr_Format(PyExc_RuntimeError,
616 "Failed to get sid token for '%s'(%s): %s",
617 samaccountname, dn, ads_errstr(status));
622 gpo_ctx = talloc_new(frame);
627 status = ads_get_gpo_list(self->ads_ptr, gpo_ctx, dn, flags, token,
629 if (!ADS_ERR_OK(status)) {
630 PyErr_Format(PyExc_RuntimeError,
631 "Failed to fetch GPO list: %s",
636 /* Convert the C linked list into a python list */
638 for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
643 ret = PyList_New(list_size);
648 for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
649 PyObject *obj = pytalloc_reference_ex(&GPOType,
656 PyList_SetItem(ret, i, obj);
667 static PyMethodDef ADS_methods[] = {
668 { "connect", (PyCFunction)py_ads_connect, METH_NOARGS,
669 "Connect to the LDAP server" },
671 { "get_gpo_list", PY_DISCARD_FUNC_SIG(PyCFunction, py_ads_get_gpo_list),
672 METH_VARARGS | METH_KEYWORDS,
678 static PyTypeObject ads_ADSType = {
679 .tp_name = "gpo.ADS_STRUCT",
680 .tp_basicsize = sizeof(ADS),
681 .tp_new = PyType_GenericNew,
682 .tp_dealloc = (destructor)py_ads_dealloc,
683 .tp_flags = Py_TPFLAGS_DEFAULT,
684 .tp_doc = "ADS struct",
685 .tp_methods = ADS_methods,
686 .tp_init = (initproc)py_ads_init,
689 static PyMethodDef py_gpo_methods[] = {
690 {"gpo_get_sysvol_gpt_version",
691 (PyCFunction)py_gpo_get_sysvol_gpt_version,
696 static struct PyModuleDef moduledef = {
697 PyModuleDef_HEAD_INIT,
699 .m_doc = "libgpo python bindings",
701 .m_methods = py_gpo_methods,
704 /* Will be called by python when loading this module */
707 MODULE_INIT_FUNC(gpo)
711 debug_setup_talloc_log();
713 /* Instantiate the types */
714 m = PyModule_Create(&moduledef);
719 if (PyModule_AddObject(m, "version",
720 PyUnicode_FromString(SAMBA_VERSION_STRING)) ) {
724 if (pytalloc_BaseObject_PyType_Ready(&ads_ADSType) < 0) {
728 Py_INCREF(&ads_ADSType);
729 if (PyModule_AddObject(m, "ADS_STRUCT", (PyObject *)&ads_ADSType)) {
733 if (pytalloc_BaseObject_PyType_Ready(&GPOType) < 0) {
737 Py_INCREF((PyObject *)(void *)&GPOType);
738 if (PyModule_AddObject(m, "GROUP_POLICY_OBJECT",
739 (PyObject *)&GPOType)) {
743 #define ADD_FLAGS(val) PyModule_AddObject(m, #val, PyLong_FromLong(val))
745 ADD_FLAGS(GP_LINK_UNKOWN);
746 ADD_FLAGS(GP_LINK_MACHINE);
747 ADD_FLAGS(GP_LINK_SITE);
748 ADD_FLAGS(GP_LINK_DOMAIN);
749 ADD_FLAGS(GP_LINK_OU);
750 ADD_FLAGS(GP_LINK_LOCAL);