2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Wilco Baan Hofman 2008-2010
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "lib/policy/policy.h"
21 #include "libcli/raw/smb.h"
22 #include "libcli/libcli.h"
23 #include "param/param.h"
24 #include "libcli/resolve/resolve.h"
25 #include "libcli/raw/libcliraw.h"
32 #define GP_MAX_DEPTH 25
34 struct gp_file_entry {
40 struct gp_file_entry *files;
42 struct gp_list_state {
43 struct smbcli_tree *tree;
45 const char *cur_rel_path;
46 const char *share_path;
48 struct gp_file_list list;
51 static NTSTATUS gp_do_list(const char *, struct gp_list_state *);
53 /* Create a temporary policy directory */
54 static const char *gp_tmpdir(TALLOC_CTX *mem_ctx)
56 char *gp_dir = talloc_asprintf(mem_ctx, "%s/policy", tmpdir());
60 if (gp_dir == NULL) return NULL;
62 if (stat(gp_dir, &st) != 0) {
63 rv = mkdir(gp_dir, 0755);
65 DEBUG(0, ("Failed to create directory %s: %s\n",
66 gp_dir, strerror(errno)));
75 /* This function is called by the smbcli_list function */
76 static void gp_list_helper (struct clilist_file_info *info, const char *mask,
79 struct gp_list_state *state = list_state_ptr;
82 /* Ignore . and .. directory entries */
83 if (strcmp(info->name, ".") == 0 || strcmp(info->name, "..") == 0) {
87 /* Safety check against ../.. in filenames which may occur on non-POSIX
89 if (strstr(info->name, "../")) {
93 rel_path = talloc_asprintf(state, "%s\\%s", state->cur_rel_path, info->name);
94 if (rel_path == NULL) return;
96 /* Append entry to file list */
97 state->list.files = talloc_realloc(state, state->list.files,
99 state->list.num_files + 1);
100 if (state->list.files == NULL) return;
102 state->list.files[state->list.num_files].rel_path = rel_path;
105 if (info->attrib & FILE_ATTRIBUTE_DIRECTORY) {
106 state->list.files[state->list.num_files].is_directory = true;
107 state->list.num_files++;
109 /* Recurse into this directory if the depth is below the maximum */
110 if (state->depth < GP_MAX_DEPTH) {
111 gp_do_list(rel_path, state);
117 state->list.files[state->list.num_files].is_directory = false;
118 state->list.num_files++;
123 static NTSTATUS gp_do_list (const char *rel_path, struct gp_list_state *state)
128 const char *old_rel_path;
130 attributes = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN |
131 FILE_ATTRIBUTE_DIRECTORY;
133 /* Update the relative paths, while buffering the parent */
134 old_rel_path = state->cur_rel_path;
135 state->cur_rel_path = rel_path;
138 /* Get the current mask */
139 mask = talloc_asprintf(state, "%s%s\\*", state->share_path, rel_path);
140 NT_STATUS_HAVE_NO_MEMORY(mask);
141 rv = smbcli_list(state->tree, mask, attributes, gp_list_helper, state);
144 /* Go back to the state of the parent */
145 state->cur_rel_path = old_rel_path;
149 return NT_STATUS_UNSUCCESSFUL;
154 static NTSTATUS gp_cli_connect(struct gp_context *gp_ctx)
156 struct smbcli_options options;
157 struct smbcli_session_options session_options;
159 if (gp_ctx->cli != NULL)
162 gp_ctx->cli = smbcli_state_init(gp_ctx);
164 lpcfg_smbcli_options(gp_ctx->lp_ctx, &options);
165 lpcfg_smbcli_session_options(gp_ctx->lp_ctx, &session_options);
168 return smbcli_full_connection(gp_ctx,
170 gp_ctx->active_dc.name,
171 lpcfg_smb_ports(gp_ctx->lp_ctx),
174 lpcfg_socket_options(gp_ctx->lp_ctx),
176 lpcfg_resolve_context(gp_ctx->lp_ctx),
180 lpcfg_gensec_settings(gp_ctx, gp_ctx->lp_ctx));
183 static char * gp_get_share_path(TALLOC_CTX *mem_ctx, const char *file_sys_path)
185 unsigned int i, bkslash_cnt;
187 /* Get the path from the share down (\\..\..\(this\stuff) */
188 for (i = 0, bkslash_cnt = 0; file_sys_path[i] != '\0'; i++) {
189 if (file_sys_path[i] == '\\')
192 if (bkslash_cnt == 4) {
193 return talloc_strdup(mem_ctx, &file_sys_path[i]);
200 static NTSTATUS gp_get_file (struct smbcli_tree *tree, const char *remote_src,
201 const char *local_dst)
203 int fh_remote, fh_local;
206 size_t buf_size = 1024;
210 /* Open the remote file */
211 fh_remote = smbcli_open(tree, remote_src, O_RDONLY, DENY_NONE);
212 if (fh_remote == -1) {
213 DEBUG(0, ("Failed to open remote file: %s\n", remote_src));
214 return NT_STATUS_UNSUCCESSFUL;
217 /* Open the local file */
218 fh_local = open(local_dst, O_WRONLY | O_CREAT | O_TRUNC, 0644);
219 if (fh_local == -1) {
220 DEBUG(0, ("Failed to open local file: %s\n", local_dst));
221 return NT_STATUS_UNSUCCESSFUL;
224 /* Get the remote file size for error checking */
225 if (NT_STATUS_IS_ERR(smbcli_qfileinfo(tree, fh_remote,
226 &attr, &file_size, NULL, NULL, NULL, NULL, NULL)) &&
227 NT_STATUS_IS_ERR(smbcli_getattrE(tree, fh_remote,
228 &attr, &file_size, NULL, NULL, NULL))) {
229 DEBUG(0, ("Failed to get remote file size: %s\n", smbcli_errstr(tree)));
230 return NT_STATUS_UNSUCCESSFUL;
233 buf = talloc_zero_array(tree, uint8_t, buf_size);
234 NT_STATUS_HAVE_NO_MEMORY(buf);
236 /* Copy the contents of the file */
238 int n = smbcli_read(tree, fh_remote, buf, nread, buf_size);
244 if (write(fh_local, buf, n) != n) {
245 DEBUG(0, ("Short write while copying file.\n"));
247 return NT_STATUS_UNSUCCESSFUL;
252 /* Bytes read should match the file size, or the copy was incomplete */
253 if (nread != file_size) {
254 DEBUG(0, ("Remote/local file size mismatch after copying file: "
255 "%s (remote %zu, local %zu).\n",
256 remote_src, file_size, nread));
258 return NT_STATUS_UNSUCCESSFUL;
261 /* Close the files */
262 smbcli_close(tree, fh_remote);
269 static NTSTATUS gp_get_files(struct smbcli_tree *tree, const char *share_path,
270 const char *local_path, struct gp_file_list *list)
274 char *local_rel_path, *full_local_path, *full_remote_path;
278 mem_ctx = talloc_new(tree);
279 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
281 for (i = 0; i < list->num_files; i++) {
283 /* Get local path by replacing backslashes with slashes */
284 local_rel_path = talloc_strdup(mem_ctx, list->files[i].rel_path);
285 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(local_rel_path, mem_ctx);
286 string_replace(local_rel_path, '\\', '/');
288 full_local_path = talloc_asprintf(mem_ctx, "%s%s", local_path,
290 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(full_local_path, mem_ctx);
292 /* If the entry is a directory, create it. */
293 if (list->files[i].is_directory == true) {
294 rv = mkdir(full_local_path, 0755);
296 DEBUG(0, ("Failed to create directory %s: %s\n",
297 full_local_path, strerror(errno)));
298 talloc_free(mem_ctx);
299 return NT_STATUS_UNSUCCESSFUL;
304 full_remote_path = talloc_asprintf(mem_ctx, "%s%s", share_path,
305 list->files[i].rel_path);
306 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(full_remote_path, mem_ctx);
309 status = gp_get_file(tree, full_remote_path, full_local_path);
310 if (!NT_STATUS_IS_OK(status)) {
311 DEBUG(0, ("Error getting file.\n"));
312 talloc_free(mem_ctx);
320 NTSTATUS gp_fetch_gpt (struct gp_context *gp_ctx, struct gp_object *gpo,
321 const char **ret_local_path)
324 struct gp_list_state *state;
328 const char *local_path, *share_path;
330 /* Create a forked memory context, as a base for everything here */
331 mem_ctx = talloc_new(gp_ctx);
332 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
334 if (gp_ctx->cli == NULL) {
335 status = gp_cli_connect(gp_ctx);
336 if (!NT_STATUS_IS_OK(status)) {
337 DEBUG(0, ("Failed to create cli connection to DC\n"));
338 talloc_free(mem_ctx);
343 /* Get the remote path to copy from */
344 share_path = gp_get_share_path(mem_ctx, gpo->file_sys_path);
345 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(share_path, mem_ctx);
347 /* Get the local path to copy to */
348 local_path = talloc_asprintf(gp_ctx, "%s/%s", gp_tmpdir(mem_ctx), gpo->name);
349 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(local_path, mem_ctx);
351 /* Prepare the state structure */
352 state = talloc_zero(mem_ctx, struct gp_list_state);
353 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(state, mem_ctx);
355 state->tree = gp_ctx->cli->tree;
356 state->share_path = share_path;
358 /* Create the GPO dir if it does not exist */
359 if (stat(local_path, &st) != 0) {
360 rv = mkdir(local_path, 0755);
362 DEBUG(0, ("Could not create local path\n"));
363 talloc_free(mem_ctx);
364 return NT_STATUS_UNSUCCESSFUL;
368 /* Get the file list */
369 status = gp_do_list("", state);
370 if (!NT_STATUS_IS_OK(status)) {
371 DEBUG(0, ("Could not list GPO files on remote server\n"));
372 talloc_free(mem_ctx);
376 /* If the list has no entries there is a problem. */
377 if (state->list.num_files == 0) {
378 DEBUG(0, ("File list is has no entries. Is the GPT directory empty?\n"));
379 talloc_free(mem_ctx);
380 return NT_STATUS_UNSUCCESSFUL;
383 /* Fetch the files */
384 status = gp_get_files(gp_ctx->cli->tree, share_path, local_path, &state->list);
386 /* Return the local path to the gpo */
387 *ret_local_path = local_path;
389 talloc_free(mem_ctx);
393 static NTSTATUS push_recursive (struct gp_context *gp_ctx, const char *local_path,
394 const char *remote_path, int depth)
397 struct dirent *dirent;
398 char *entry_local_path;
399 char *entry_remote_path;
400 int local_fd, remote_fd;
402 int nread, total_read;
405 dir = opendir(local_path);
406 while ((dirent = readdir(dir)) != NULL) {
407 if (strcmp(dirent->d_name, ".") == 0 ||
408 strcmp(dirent->d_name, "..") == 0) {
412 entry_local_path = talloc_asprintf(gp_ctx, "%s/%s", local_path,
414 NT_STATUS_HAVE_NO_MEMORY(entry_local_path);
416 entry_remote_path = talloc_asprintf(gp_ctx, "%s\\%s",
417 remote_path, dirent->d_name);
418 NT_STATUS_HAVE_NO_MEMORY(entry_remote_path);
420 if (stat(dirent->d_name, &s) != 0) {
421 return NT_STATUS_UNSUCCESSFUL;
423 if (s.st_mode & S_IFDIR) {
424 DEBUG(6, ("Pushing directory %s to %s on sysvol\n",
425 entry_local_path, entry_remote_path));
426 smbcli_mkdir(gp_ctx->cli->tree, entry_remote_path);
427 if (depth < GP_MAX_DEPTH) {
428 push_recursive(gp_ctx, entry_local_path,
429 entry_remote_path, depth+1);
432 DEBUG(6, ("Pushing file %s to %s on sysvol\n",
433 entry_local_path, entry_remote_path));
434 remote_fd = smbcli_open(gp_ctx->cli->tree,
439 talloc_free(entry_local_path);
440 talloc_free(entry_remote_path);
441 DEBUG(0, ("Failed to create remote file: %s\n",
443 return NT_STATUS_UNSUCCESSFUL;
445 local_fd = open(entry_local_path, O_RDONLY);
447 talloc_free(entry_local_path);
448 talloc_free(entry_remote_path);
449 DEBUG(0, ("Failed to open local file: %s\n",
451 return NT_STATUS_UNSUCCESSFUL;
454 while ((nread = read(local_fd, &buf, sizeof(buf)))) {
455 smbcli_write(gp_ctx->cli->tree, remote_fd, 0,
456 &buf, total_read, nread);
461 smbcli_close(gp_ctx->cli->tree, remote_fd);
463 talloc_free(entry_local_path);
464 talloc_free(entry_remote_path);
473 NTSTATUS gp_push_gpt(struct gp_context *gp_ctx, const char *local_path,
474 const char *file_sys_path)
479 if (gp_ctx->cli == NULL) {
480 status = gp_cli_connect(gp_ctx);
481 if (!NT_STATUS_IS_OK(status)) {
482 DEBUG(0, ("Failed to create cli connection to DC\n"));
486 share_path = gp_get_share_path(gp_ctx, file_sys_path);
488 DEBUG(5, ("Copying %s to %s on sysvol\n", local_path, share_path));
490 smbcli_mkdir(gp_ctx->cli->tree, share_path);
492 status = push_recursive(gp_ctx, local_path, share_path, 0);
494 talloc_free(share_path);
498 NTSTATUS gp_create_gpt(struct gp_context *gp_ctx, const char *name,
499 const char *file_sys_path)
502 const char *tmp_dir, *policy_dir, *tmp_str;
506 const char *file_content = "[General]\r\nVersion=0\r\n";
508 /* Create a forked memory context, as a base for everything here */
509 mem_ctx = talloc_new(gp_ctx);
510 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
512 tmp_dir = gp_tmpdir(mem_ctx);
513 NT_STATUS_HAVE_NO_MEMORY(tmp_dir);
514 policy_dir = talloc_asprintf(mem_ctx, "%s/%s", tmp_dir, name);
515 NT_STATUS_HAVE_NO_MEMORY(policy_dir);
517 /* Create the directories */
519 rv = mkdir(policy_dir, 0755);
521 DEBUG(0, ("Could not create the policy dir: %s\n", policy_dir));
522 talloc_free(mem_ctx);
523 return NT_STATUS_UNSUCCESSFUL;
526 tmp_str = talloc_asprintf(mem_ctx, "%s/User", policy_dir);
527 NT_STATUS_HAVE_NO_MEMORY(tmp_str);
528 rv = mkdir(tmp_str, 0755);
530 DEBUG(0, ("Could not create the User dir: %s\n", tmp_str));
531 talloc_free(mem_ctx);
532 return NT_STATUS_UNSUCCESSFUL;
535 tmp_str = talloc_asprintf(mem_ctx, "%s/Machine", policy_dir);
536 NT_STATUS_HAVE_NO_MEMORY(tmp_str);
537 rv = mkdir(tmp_str, 0755);
539 DEBUG(0, ("Could not create the Machine dir: %s\n", tmp_str));
540 talloc_free(mem_ctx);
541 return NT_STATUS_UNSUCCESSFUL;
544 /* Create a GPT.INI with version 0 */
546 tmp_str = talloc_asprintf(mem_ctx, "%s/GPT.INI", policy_dir);
547 NT_STATUS_HAVE_NO_MEMORY(tmp_str);
548 fd = open(tmp_str, O_CREAT | O_WRONLY, 0644);
550 DEBUG(0, ("Could not create the GPT.INI: %s\n", tmp_str));
551 talloc_free(mem_ctx);
552 return NT_STATUS_UNSUCCESSFUL;
555 rv = write(fd, file_content, strlen(file_content));
556 if (rv != strlen(file_content)) {
557 DEBUG(0, ("Short write in GPT.INI\n"));
558 talloc_free(mem_ctx);
559 return NT_STATUS_UNSUCCESSFUL;
564 /* Upload the GPT to the sysvol share on a DC */
565 status = gp_push_gpt(gp_ctx, policy_dir, file_sys_path);
566 if (!NT_STATUS_IS_OK(status)) {
567 talloc_free(mem_ctx);
571 talloc_free(mem_ctx);
575 NTSTATUS gp_set_gpt_security_descriptor(struct gp_context *gp_ctx,
576 struct gp_object *gpo,
577 struct security_descriptor *sd)
581 union smb_setfileinfo fileinfo;
583 union smb_close io_close;
585 /* Create a connection to sysvol if it is not already there */
586 if (gp_ctx->cli == NULL) {
587 status = gp_cli_connect(gp_ctx);
588 if (!NT_STATUS_IS_OK(status)) {
589 DEBUG(0, ("Failed to create cli connection to DC\n"));
594 /* Create a forked memory context which can be freed easily */
595 mem_ctx = talloc_new(gp_ctx);
596 NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
598 /* Open the directory with NTCreate AndX call */
599 io.generic.level = RAW_OPEN_NTCREATEX;
600 io.ntcreatex.in.root_fid.fnum = 0;
601 io.ntcreatex.in.flags = 0;
602 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
603 io.ntcreatex.in.create_options = 0;
604 io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
605 io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ |
606 NTCREATEX_SHARE_ACCESS_WRITE;
607 io.ntcreatex.in.alloc_size = 0;
608 io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
609 io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
610 io.ntcreatex.in.security_flags = 0;
611 io.ntcreatex.in.fname = gp_get_share_path(mem_ctx, gpo->file_sys_path);
612 status = smb_raw_open(gp_ctx->cli->tree, mem_ctx, &io);
613 if (!NT_STATUS_IS_OK(status)) {
614 DEBUG(0, ("Can't open GPT directory\n"));
615 talloc_free(mem_ctx);
619 /* Set the security descriptor on the directory */
620 fileinfo.generic.level = RAW_FILEINFO_SEC_DESC;
621 fileinfo.set_secdesc.in.file.fnum = io.ntcreatex.out.file.fnum;
622 fileinfo.set_secdesc.in.secinfo_flags = SECINFO_PROTECTED_DACL |
626 fileinfo.set_secdesc.in.sd = sd;
627 status = smb_raw_setfileinfo(gp_ctx->cli->tree, &fileinfo);
628 if (!NT_STATUS_IS_OK(status)) {
629 DEBUG(0, ("Failed to set security descriptor on the GPT\n"));
630 talloc_free(mem_ctx);
634 /* Close the directory */
635 io_close.close.level = RAW_CLOSE_CLOSE;
636 io_close.close.in.file.fnum = io.ntcreatex.out.file.fnum;
637 io_close.close.in.write_time = 0;
638 status = smb_raw_close(gp_ctx->cli->tree, &io_close);
639 if (!NT_STATUS_IS_OK(status)) {
640 DEBUG(0, ("Failed to close directory\n"));
641 talloc_free(mem_ctx);
645 talloc_free(mem_ctx);