2 Unix SMB/CIFS implementation.
3 Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "param/pyparam.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
30 #include "python/py3compat.h"
32 /* A Python C API module to use LIBGPO */
34 #define GPO_getter(ATTR) \
35 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
37 struct GROUP_POLICY_OBJECT *gpo_ptr \
38 = pytalloc_get_ptr(self); \
41 return PyStr_FromString(gpo_ptr->ATTR); \
46 GPO_getter(file_sys_path)
47 GPO_getter(display_name)
50 GPO_getter(user_extensions)
51 GPO_getter(machine_extensions)
53 static PyGetSetDef GPO_setters[] = {
54 {discard_const_p(char, "ds_path"), (getter)GPO_get_ds_path, NULL, NULL,
56 {discard_const_p(char, "file_sys_path"), (getter)GPO_get_file_sys_path,
58 {discard_const_p(char, "display_name"), (getter)GPO_get_display_name,
60 {discard_const_p(char, "name"), (getter)GPO_get_name, NULL, NULL,
62 {discard_const_p(char, "link"), (getter)GPO_get_link, NULL, NULL,
64 {discard_const_p(char, "user_extensions"),
65 (getter)GPO_get_user_extensions,
67 {discard_const_p(char, "machine_extensions"),
68 (getter)GPO_get_machine_extensions, NULL, NULL, NULL},
72 static PyObject *py_gpo_get_unix_path(PyObject *self, PyObject *args,
76 const char *cache_dir = NULL;
77 PyObject *ret = Py_None;
78 char *unix_path = NULL;
79 TALLOC_CTX *frame = NULL;
80 static const char *kwlist[] = {"cache_dir", NULL};
81 struct GROUP_POLICY_OBJECT *gpo_ptr \
82 = (struct GROUP_POLICY_OBJECT *)pytalloc_get_ptr(self);
84 frame = talloc_stackframe();
86 if (!PyArg_ParseTupleAndKeywords(args, kwds, "|s",
87 discard_const_p(char *, kwlist),
89 PyErr_SetString(PyExc_SystemError,
90 "Failed to parse arguments to "
91 "gpo_get_unix_path()");
96 cache_dir = cache_path(talloc_tos(), GPO_CACHE_DIR);
98 PyErr_SetString(PyExc_MemoryError,
99 "Failed to determine gpo cache dir");
104 status = gpo_get_unix_path(frame, cache_dir, gpo_ptr, &unix_path);
106 if (!NT_STATUS_IS_OK(status)) {
107 PyErr_SetString(PyExc_SystemError,
108 "Failed to determine gpo unix path");
112 ret = PyStr_FromString(unix_path);
119 static PyMethodDef GPO_methods[] = {
120 {"get_unix_path", (PyCFunction)py_gpo_get_unix_path, METH_KEYWORDS,
125 static PyTypeObject GPOType = {
126 PyVarObject_HEAD_INIT(NULL, 0)
127 .tp_name = "gpo.GROUP_POLICY_OBJECT",
128 .tp_doc = "GROUP_POLICY_OBJECT",
129 .tp_getset = GPO_setters,
130 .tp_methods = GPO_methods,
131 .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
137 struct cli_credentials *cli_creds;
140 static void py_ads_dealloc(ADS* self)
142 ads_destroy(&(self->ads_ptr));
143 Py_TYPE(self)->tp_free((PyObject*)self);
146 static PyObject* py_ads_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
149 self = (ADS*)type->tp_alloc(type, 0);
150 return (PyObject*)self;
153 static PyObject* py_ads_connect(ADS *self);
154 static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
156 const char *realm = NULL;
157 const char *workgroup = NULL;
158 const char *ldap_server = NULL;
159 PyObject *py_creds = NULL;
160 PyObject *lp_obj = NULL;
161 struct loadparm_context *lp_ctx = NULL;
163 static const char *kwlist[] = {
164 "ldap_server", "loadparm_context", "credentials", NULL
166 if (!PyArg_ParseTupleAndKeywords(args, kwds, "sO|O",
167 discard_const_p(char *, kwlist),
168 &ldap_server, &lp_obj, &py_creds)) {
173 if (!py_check_dcerpc_type(py_creds, "samba.credentials",
175 PyErr_Format(PyExc_TypeError,
176 "Expected samba.credentials "
177 "for credentials argument");
181 = PyCredentials_AsCliCredentials(py_creds);
185 bool ok = py_check_dcerpc_type(lp_obj, "samba.param",
188 PyErr_Format(PyExc_TypeError,
189 "Expected samba.param.LoadParm "
193 lp_ctx = pytalloc_get_type(lp_obj, struct loadparm_context);
194 if (lp_ctx == NULL) {
197 ok = lp_load_initial_only(lp_ctx->szConfigFile);
203 if (self->cli_creds) {
204 realm = cli_credentials_get_realm(self->cli_creds);
205 workgroup = cli_credentials_get_domain(self->cli_creds);
208 workgroup = lp_workgroup();
211 if (ldap_server == NULL) {
215 self->ads_ptr = ads_init(realm, workgroup, ldap_server);
216 if (self->ads_ptr == NULL) {
223 static PyObject* py_ads_connect(ADS *self)
226 TALLOC_CTX *frame = talloc_stackframe();
227 if (self->cli_creds) {
228 self->ads_ptr->auth.user_name =
229 SMB_STRDUP(cli_credentials_get_username(self->cli_creds));
230 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
231 self->ads_ptr->auth.password =
232 SMB_STRDUP(cli_credentials_get_password(self->cli_creds));
233 self->ads_ptr->auth.realm =
234 SMB_STRDUP(cli_credentials_get_realm(self->cli_creds));
236 status = ads_connect_user_creds(self->ads_ptr);
237 if (!ADS_ERR_OK(status)) {
238 PyErr_SetString(PyExc_SystemError,
239 "ads_connect() failed");
245 int ret = asprintf(&(self->ads_ptr->auth.user_name), "%s$",
248 PyErr_SetString(PyExc_SystemError,
249 "Failed to asprintf");
253 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
256 if (!secrets_init()) {
257 PyErr_SetString(PyExc_SystemError,
258 "secrets_init() failed");
263 passwd = secrets_fetch_machine_password(self->ads_ptr->server.workgroup,
265 if (passwd == NULL) {
266 PyErr_SetString(PyExc_SystemError,
267 "Failed to fetch the machine account "
272 self->ads_ptr->auth.password = smb_xstrdup(passwd);
274 self->ads_ptr->auth.realm =
275 smb_xstrdup(self->ads_ptr->server.realm);
276 if (!strupper_m(self->ads_ptr->auth.realm)) {
277 PyErr_SetString(PyExc_SystemError, "Failed to strdup");
282 status = ads_connect(self->ads_ptr);
283 if (!ADS_ERR_OK(status)) {
284 PyErr_SetString(PyExc_SystemError,
285 "ads_connect() failed");
295 /* Parameter mapping and functions for the GP_EXT struct */
298 /* Global methods aka do not need a special pyobject type */
299 static PyObject *py_gpo_get_sysvol_gpt_version(PyObject * self,
302 TALLOC_CTX *tmp_ctx = NULL;
304 char *display_name = NULL;
305 uint32_t sysvol_version = 0;
309 tmp_ctx = talloc_new(NULL);
311 if (!PyArg_ParseTuple(args, "s", &unix_path)) {
314 status = gpo_get_sysvol_gpt_version(tmp_ctx, unix_path,
317 if (!NT_STATUS_IS_OK(status)) {
318 PyErr_SetNTSTATUS(status);
319 TALLOC_FREE(tmp_ctx);
323 talloc_free(tmp_ctx);
324 result = Py_BuildValue("[s,i]", display_name, sysvol_version);
329 static ADS_STATUS find_samaccount(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
330 const char *samaccountname,
331 uint32_t *uac_ret, const char **dn_ret)
334 const char *attrs[] = { "userAccountControl", NULL };
336 LDAPMessage *res = NULL;
340 filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
342 if (filter == NULL) {
343 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
347 status = ads_do_search_all(ads, ads->config.bind_path,
348 LDAP_SCOPE_SUBTREE, filter, attrs, &res);
350 if (!ADS_ERR_OK(status)) {
354 if (ads_count_replies(ads, res) != 1) {
355 status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
359 dn = ads_get_dn(ads, talloc_tos(), res);
361 status = ADS_ERROR(LDAP_NO_MEMORY);
365 if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
366 status = ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
375 *dn_ret = talloc_strdup(mem_ctx, dn);
376 if (*dn_ret == NULL) {
377 status = ADS_ERROR(LDAP_NO_MEMORY);
383 ads_msgfree(ads, res);
388 static PyObject *py_ads_get_gpo_list(ADS *self, PyObject *args, PyObject *kwds)
390 TALLOC_CTX *frame = NULL;
391 struct GROUP_POLICY_OBJECT *gpo = NULL, *gpo_list = NULL;
393 const char *samaccountname = NULL;
394 const char *dn = NULL;
397 struct security_token *token = NULL;
398 PyObject *ret = Py_None;
403 static const char *kwlist[] = {"samaccountname", NULL};
404 if (!PyArg_ParseTupleAndKeywords(args, kwds, "s",
405 discard_const_p(char *, kwlist),
407 PyErr_SetString(PyExc_SystemError,
408 "Failed to parse arguments to "
409 "py_ads_get_gpo_list()");
413 frame = talloc_stackframe();
415 status = find_samaccount(self->ads_ptr, frame,
416 samaccountname, &uac, &dn);
417 if (!ADS_ERR_OK(status)) {
419 PyErr_SetString(PyExc_SystemError,
420 "Failed to find samAccountName");
424 if (uac & UF_WORKSTATION_TRUST_ACCOUNT ||
425 uac & UF_SERVER_TRUST_ACCOUNT) {
426 flags |= GPO_LIST_FLAG_MACHINE;
427 status = gp_get_machine_token(self->ads_ptr, frame, dn,
430 status = ads_get_sid_token(self->ads_ptr, frame, dn, &token);
432 if (!ADS_ERR_OK(status)) {
434 PyErr_SetString(PyExc_SystemError, "Failed to get token");
438 gpo_ctx = talloc_new(frame);
439 status = ads_get_gpo_list(self->ads_ptr, gpo_ctx, dn, flags, token,
441 if (!ADS_ERR_OK(status)) {
443 PyErr_SetString(PyExc_SystemError, "Failed to fetch GPO list");
447 /* Convert the C linked list into a python list */
449 for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
454 ret = PyList_New(list_size);
460 for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
461 PyObject *obj = pytalloc_reference_ex(&GPOType,
468 PyList_SetItem(ret, i, obj);
480 static PyMethodDef ADS_methods[] = {
481 { "connect", (PyCFunction)py_ads_connect, METH_NOARGS,
482 "Connect to the LDAP server" },
484 { "get_gpo_list", (PyCFunction)py_ads_get_gpo_list, METH_VARARGS | METH_KEYWORDS,
490 static PyTypeObject ads_ADSType = {
491 .tp_name = "gpo.ADS_STRUCT",
492 .tp_basicsize = sizeof(ADS),
493 .tp_dealloc = (destructor)py_ads_dealloc,
494 .tp_flags = Py_TPFLAGS_DEFAULT,
495 .tp_doc = "ADS struct",
496 .tp_methods = ADS_methods,
497 .tp_init = (initproc)py_ads_init,
498 .tp_new = py_ads_new,
501 static PyMethodDef py_gpo_methods[] = {
502 {"gpo_get_sysvol_gpt_version",
503 (PyCFunction)py_gpo_get_sysvol_gpt_version,
508 static struct PyModuleDef moduledef = {
509 PyModuleDef_HEAD_INIT,
511 .m_doc = "libgpo python bindings",
513 .m_methods = py_gpo_methods,
516 /* Will be called by python when loading this module */
519 MODULE_INIT_FUNC(gpo)
523 debug_setup_talloc_log();
525 /* Instantiate the types */
526 m = PyModule_Create(&moduledef);
531 PyModule_AddObject(m, "version",
532 PyStr_FromString(SAMBA_VERSION_STRING));
534 if (PyType_Ready(&ads_ADSType) < 0) {
538 PyModule_AddObject(m, "ADS_STRUCT", (PyObject *)&ads_ADSType);
540 if (pytalloc_BaseObject_PyType_Ready(&GPOType) < 0) {
544 Py_INCREF((PyObject *)(void *)&GPOType);
545 PyModule_AddObject(m, "GROUP_POLICY_OBJECT",
546 (PyObject *)&GPOType);