source/libads/gpo_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2005
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 #include "includes.h"
  22
  23 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
  24 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
  25
  26 /* should we store a parsed guid ? UUID_FLAT guid; */
  27 struct gpo_table {
  28         const char *name;
  29         const char *guid_string;
  30 };
  31
  32 struct snapin_table {
  33         const char *name;
  34         const char *guid_string;
  35         ADS_STATUS (*snapin_fn)(ADS_STRUCT *, TALLOC_CTX *mem_ctx, const char *, const char *);
  36 };
  37
  38 static struct gpo_table gpo_default_policy[] = {
  39         { DEFAULT_DOMAIN_POLICY,
  40                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
  41         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
  42                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
  43         { NULL, NULL }
  44 };
  45
  46
  47 /* the following is seen in gPCMachineExtensionNames or gPCUserExtensionNames */
  48
  49 static struct gpo_table gpo_cse_extensions[] = {
  50         { "Administrative Templates Extension",
  51                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" }, /* Registry Policy ? */
  52         { "Microsoft Disc Quota",
  53                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
  54         { "EFS recovery",
  55                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  56         { "Folder Redirection",
  57                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  58         { "IP Security",
  59                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
  60         { "Internet Explorer Branding",
  61                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
  62         { "QoS Packet Scheduler",
  63                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
  64         { "Scripts",
  65                 "42B5FAAE-6536-11D2-AE5A-0000F87571E3" },
  66         { "Security",
  67                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
  68         { "Software Installation",
  69                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  70         { "Wireless Group Policy",
  71                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
  72         { NULL, NULL }
  73 };
  74
  75 /* guess work */
  76 static struct snapin_table gpo_cse_snapin_extensions[] = {
  77         { "Administrative Templates",
  78                 "0F6B957D-509E-11D1-A7CC-0000F87571E3", gpo_snapin_handler_none },
  79         { "Certificates",
  80                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17", gpo_snapin_handler_none },
  81         { "EFS recovery policy processing",
  82                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A", gpo_snapin_handler_none },
  83         { "Folder Redirection policy processing",
  84                 "25537BA6-77A8-11D2-9B6C-0000F8080861", gpo_snapin_handler_none },
  85         { "Folder Redirection",
  86                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F", gpo_snapin_handler_none },
  87         { "Registry policy processing",
  88                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2", gpo_snapin_handler_none },
  89         { "Remote Installation Services",
  90                 "3060E8CE-7020-11D2-842D-00C04FA372D4", gpo_snapin_handler_none },
  91         { "Security Settings",
  92                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B", gpo_snapin_handler_security_settings },
  93         { "Security policy processing",
  94                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A", gpo_snapin_handler_security_settings },
  95         { "unknown",
  96                 "3060E8D0-7020-11D2-842D-00C04FA372D4", gpo_snapin_handler_none },
  97         { "unknown2",
  98                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17", gpo_snapin_handler_none },
  99         { NULL, NULL, NULL }
 100 };
 101
 102 static const char *name_to_guid_string(const char *name, struct gpo_table *table)
 103 {
 104         int i;
 105
 106         for (i = 0; table[i].name; i++) {
 107                 if (strequal(name, table[i].name)) {
 108                         return table[i].guid_string;
 109                 }
 110         }
 111
 112         return NULL;
 113 }
 114
 115 static const char *guid_string_to_name(const char *guid_string, struct gpo_table *table)
 116 {
 117         int i;
 118
 119         for (i = 0; table[i].guid_string; i++) {
 120                 if (strequal(guid_string, table[i].guid_string)) {
 121                         return table[i].name;
 122                 }
 123         }
 124
 125         return NULL;
 126 }
 127
 128 static const char *default_gpo_name_to_guid_string(const char *name)
 129 {
 130         return name_to_guid_string(name, gpo_default_policy);
 131 }
 132
 133 static const char *default_gpo_guid_string_to_name(const char *guid)
 134 {
 135         return guid_string_to_name(guid, gpo_default_policy);
 136 }
 137
 138 const char *cse_gpo_guid_string_to_name(const char *guid)
 139 {
 140         return guid_string_to_name(guid, gpo_cse_extensions);
 141 }
 142
 143 static const char *cse_gpo_name_to_guid_string(const char *name)
 144 {
 145         return name_to_guid_string(name, gpo_cse_extensions);
 146 }
 147
 148 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
 149 {
 150         return guid_string_to_name(guid, gpo_cse_snapin_extensions);
 151 }
 152
 153 void dump_gp_ext(struct GP_EXT *gp_ext)
 154 {
 155         int lvl = 10;
 156         int i;
 157
 158         if (gp_ext == NULL) {
 159                 return;
 160         }
 161
 162         DEBUG(lvl,("---------------------\n\n"));
 163         DEBUGADD(lvl,("name:\t\t\t%s\n", gp_ext->gp_extension));
 164
 165         for (i=0; i< gp_ext->num_exts; i++) {
 166
 167                 DEBUGADD(lvl,("extension:\t\t\t%s\n", gp_ext->extensions_guid[i]));
 168                 DEBUGADD(lvl,("extension (name):\t\t\t%s\n", gp_ext->extensions[i]));
 169
 170                 DEBUGADD(lvl,("snapin:\t\t\t%s\n", gp_ext->snapins_guid[i]));
 171                 DEBUGADD(lvl,("snapin (name):\t\t\t%s\n", gp_ext->snapins[i]));
 172         }
 173 }
 174
 175 void dump_gpo(TALLOC_CTX *mem_ctx, struct GROUP_POLICY_OBJECT *gpo)
 176 {
 177         int lvl = 1;
 178
 179         if (gpo == NULL) {
 180                 return;
 181         }
 182
 183         DEBUG(lvl,("---------------------\n\n"));
 184
 185         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
 186         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
 187         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
 188         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n", gpo->version_user, gpo->version_user));
 189         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n", gpo->version_machine, gpo->version_machine));
 190         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
 191         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
 192
 193         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
 194         if (gpo->options & GPFLAGS_USER_SETTINGS_DISABLED) {
 195                 DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED "));
 196         }
 197         if (gpo->options & GPFLAGS_MACHINE_SETTINGS_DISABLED) {
 198                 DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED"));
 199         }
 200         DEBUGADD(lvl,("\n"));
 201
 202         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
 203         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
 204         switch (gpo->link_type) {
 205         case GP_LINK_UNKOWN:
 206                 DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
 207                 break;
 208         case GP_LINK_OU:
 209                 DEBUGADD(lvl,("GP_LINK_OU\n"));
 210                 break;
 211         case GP_LINK_DOMAIN:
 212                 DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
 213                 break;
 214         case GP_LINK_SITE:
 215                 DEBUGADD(lvl,("GP_LINK_SITE\n"));
 216                 break;
 217         case GP_LINK_MACHINE:
 218                 DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
 219                 break;
 220         default:
 221                 break;
 222         }
 223
 224         if (gpo->machine_extensions) {
 225
 226                 struct GP_EXT gp_ext;
 227                 ADS_STATUS status;
 228
 229                 DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
 230
 231                 status = ads_parse_gp_ext(mem_ctx, gpo->machine_extensions, &gp_ext);
 232                 if (!ADS_ERR_OK(status)) {
 233                         return;
 234                 }
 235                 dump_gp_ext(&gp_ext);
 236         }
 237
 238         if (gpo->user_extensions) {
 239
 240                 struct GP_EXT gp_ext;
 241                 ADS_STATUS status;
 242
 243                 DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
 244
 245                 status = ads_parse_gp_ext(mem_ctx, gpo->user_extensions, &gp_ext);
 246                 if (!ADS_ERR_OK(status)) {
 247                         return;
 248                 }
 249                 dump_gp_ext(&gp_ext);
 250         }
 251 };
 252
 253 void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link)
 254 {
 255         ADS_STATUS status;
 256         int i;
 257         int lvl = 10;
 258
 259         if (gp_link == NULL) {
 260                 return;
 261         }
 262
 263         DEBUG(lvl,("---------------------\n\n"));
 264
 265         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
 266         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
 267         switch (gp_link->gp_opts) {
 268         case GPOPTIONS_INHERIT:
 269                 DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
 270                 break;
 271         case GPOPTIONS_BLOCK_INHERITANCE:
 272                 DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
 273                 break;
 274         default:
 275                 break;
 276         }
 277
 278         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
 279
 280         for (i = 0; i < gp_link->num_links; i++) {
 281
 282                 DEBUGADD(lvl,("---------------------\n\n"));
 283
 284                 DEBUGADD(lvl,("link: #%d\n", i + 1));
 285                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
 286
 287                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
 288                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
 289                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
 290                 }
 291                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
 292                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
 293                 }
 294                 DEBUGADD(lvl,("\n"));
 295
 296                 if (ads != NULL && mem_ctx != NULL) {
 297
 298                         struct GROUP_POLICY_OBJECT gpo;
 299
 300                         status = ads_get_gpo(ads, mem_ctx, gp_link->link_names[i], NULL, NULL, &gpo);
 301                         if (!ADS_ERR_OK(status)) {
 302                                 DEBUG(lvl,("get gpo for %s failed: %s\n", gp_link->link_names[i], ads_errstr(status)));
 303                                 return;
 304                         }
 305                         dump_gpo(mem_ctx, &gpo);
 306                 }
 307         }
 308 }
 309
 310 ADS_STATUS process_extension_with_snapin(ADS_STRUCT *ads,
 311                                          TALLOC_CTX *mem_ctx,
 312                                          const char *extension_guid,
 313                                          const char *snapin_guid)
 314 {
 315         int i;
 316
 317         for (i=0; gpo_cse_snapin_extensions[i].guid_string; i++) {
 318
 319                 if (strcmp(gpo_cse_snapin_extensions[i].guid_string, snapin_guid) == 0) {
 320
 321                         return gpo_cse_snapin_extensions[i].snapin_fn(ads, mem_ctx,
 322                                                                       extension_guid, snapin_guid);
 323                 }
 324         }
 325
 326         DEBUG(10,("process_extension_with_snapin: no snapin handler for extension %s (%s) found\n",
 327                 extension_guid, snapin_guid));
 328
 329         return ADS_ERROR(LDAP_SUCCESS);
 330 }
 331
 332 ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads,
 333                              TALLOC_CTX *mem_ctx,
 334                              struct GROUP_POLICY_OBJECT *gpo,
 335                              const char *extension_guid,
 336                              uint32 flags)
 337 {
 338         ADS_STATUS status;
 339         struct GP_EXT gp_ext;
 340         int i;
 341
 342         if (flags & GPO_LIST_FLAG_MACHINE) {
 343
 344                 if (gpo->machine_extensions) {
 345
 346                         status = ads_parse_gp_ext(mem_ctx, gpo->machine_extensions, &gp_ext);
 347
 348                         if (!ADS_ERR_OK(status)) {
 349                                 return status;
 350                         }
 351
 352                 } else {
 353                         /* nothing to apply */
 354                         return ADS_ERROR(LDAP_SUCCESS);
 355                 }
 356
 357         } else {
 358
 359                 if (gpo->user_extensions) {
 360
 361                         status = ads_parse_gp_ext(mem_ctx, gpo->user_extensions, &gp_ext);
 362
 363                         if (!ADS_ERR_OK(status)) {
 364                                 return status;
 365                         }
 366                 } else {
 367                         /* nothing to apply */
 368                         return ADS_ERROR(LDAP_SUCCESS);
 369                 }
 370         }
 371
 372         for (i=0; i<gp_ext.num_exts; i++) {
 373
 374                 if (extension_guid && !strequal(extension_guid, gp_ext.extensions_guid[i])) {
 375                         continue;
 376                 }
 377
 378                 status = process_extension_with_snapin(ads, mem_ctx, gp_ext.extensions_guid[i],
 379                                                        gp_ext.snapins_guid[i]);
 380                 if (!ADS_ERR_OK(status)) {
 381                         return status;
 382                 }
 383         }
 384
 385         return ADS_ERROR(LDAP_SUCCESS);
 386 }
 387
 388 ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads,
 389                                 TALLOC_CTX *mem_ctx,
 390                                 struct GROUP_POLICY_OBJECT **gpo_list,
 391                                 const char *extensions_guid,
 392                                 uint32 flags)
 393 {
 394         ADS_STATUS status;
 395         struct GROUP_POLICY_OBJECT *gpo = *gpo_list;
 396
 397         for (gpo = *gpo_list; gpo; gpo = gpo->next) {
 398
 399                 status = gpo_process_a_gpo(ads, mem_ctx, gpo,
 400                                            extensions_guid, flags);
 401
 402                 if (!ADS_ERR_OK(status)) {
 403                         return status;
 404                 }
 405
 406         }
 407
 408         return ADS_ERROR(LDAP_SUCCESS);
 409 }
 410
 411 ADS_STATUS gpo_snapin_handler_none(ADS_STRUCT *ads,
 412                                    TALLOC_CTX *mem_ctx,
 413                                    const char *extension_guid,
 414                                    const char *snapin_guid)
 415 {
 416         DEBUG(10,("gpo_snapin_handler_none\n"));
 417
 418         return ADS_ERROR(LDAP_SUCCESS);
 419 }
 420
 421 ADS_STATUS gpo_snapin_handler_security_settings(ADS_STRUCT *ads,
 422                                                 TALLOC_CTX *mem_ctx,
 423                                                 const char *extension_guid,
 424                                                 const char *snapin_guid)
 425 {
 426         DEBUG(10,("gpo_snapin_handler_security_settings\n"));
 427
 428         return ADS_ERROR(LDAP_SUCCESS);
 429 }
 430
 431 ADS_STATUS gpo_lockout_policy(ADS_STRUCT *ads,
 432                               TALLOC_CTX *mem_ctx,
 433                               const char *hostname,
 434                               SAM_UNK_INFO_12 *lockout_policy)
 435 {
 436         return ADS_ERROR_NT(NT_STATUS_NOT_IMPLEMENTED);
 437 }
 438
 439 ADS_STATUS gpo_password_policy(ADS_STRUCT *ads,
 440                                TALLOC_CTX *mem_ctx,
 441                                const char *hostname,
 442                                SAM_UNK_INFO_1 *password_policy)
 443 {
 444         ADS_STATUS status;
 445         struct GROUP_POLICY_OBJECT *gpo_list;
 446         const char *attrs[] = {"distinguishedName", "userAccountControl", NULL};
 447         char *filter, *dn;
 448         void *res = NULL;
 449         uint32 uac;
 450
 451         return ADS_ERROR_NT(NT_STATUS_NOT_IMPLEMENTED);
 452
 453         filter = talloc_asprintf(mem_ctx, "(&(objectclass=user)(sAMAccountName=%s))", hostname);
 454         if (filter == NULL) {
 455                 return ADS_ERROR(LDAP_NO_MEMORY);
 456         }
 457
 458         status = ads_do_search_all(ads, ads->config.bind_path,
 459                                    LDAP_SCOPE_SUBTREE,
 460                                    filter, attrs, &res);
 461
 462         if (!ADS_ERR_OK(status)) {
 463                 return status;
 464         }
 465
 466         if (ads_count_replies(ads, res) != 1) {
 467                 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
 468         }
 469
 470         dn = ads_get_dn(ads, res);
 471         if (dn == NULL) {
 472                 return ADS_ERROR(LDAP_NO_MEMORY);
 473         }
 474
 475         if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
 476                 return ADS_ERROR(LDAP_NO_MEMORY);
 477         }
 478
 479         if (!(uac & UF_WORKSTATION_TRUST_ACCOUNT)) {
 480                 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
 481         }
 482
 483         status = ads_get_gpo_list(ads, mem_ctx, dn, GPO_LIST_FLAG_MACHINE, &gpo_list);
 484         if (!ADS_ERR_OK(status)) {
 485                 return status;
 486         }
 487
 488         status = gpo_process_gpo_list(ads, mem_ctx, &gpo_list,
 489                                       cse_gpo_name_to_guid_string("Security"),
 490                                       GPO_LIST_FLAG_MACHINE);
 491         if (!ADS_ERR_OK(status)) {
 492                 return status;
 493         }
 494
 495         return ADS_ERROR(LDAP_SUCCESS);
 496 }