c9153d85cf451810dcf2255a9464fe805f3ace09
[ab/samba.git/.git] / source4 / scripting / python / samba / samba3.py
1 #!/usr/bin/python
2
3 # Unix SMB/CIFS implementation.
4 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
5 #   
6 # This program is free software; you can redistribute it and/or modify
7 # it under the terms of the GNU General Public License as published by
8 # the Free Software Foundation; either version 3 of the License, or
9 # (at your option) any later version.
10 #   
11 # This program is distributed in the hope that it will be useful,
12 # but WITHOUT ANY WARRANTY; without even the implied warranty of
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 # GNU General Public License for more details.
15 #   
16 # You should have received a copy of the GNU General Public License
17 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 #
19
20 """Support for reading Samba 3 data files."""
21
22 REGISTRY_VALUE_PREFIX = "SAMBA_REGVAL"
23 REGISTRY_DB_VERSION = 1
24
25 import os
26 import tdb
27
28 class Registry:
29     """Simple read-only support for reading the Samba3 registry."""
30     def __init__(self, file):
31         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
32
33     def close(self):
34         self.tdb.close()
35
36     def __len__(self):
37         """Return the number of keys."""
38         return len(self.keys())
39
40     def keys(self):
41         """Return list with all the keys."""
42         return [k.rstrip("\x00") for k in self.tdb.keys() if not k.startswith(REGISTRY_VALUE_PREFIX)]
43
44     def subkeys(self, key):
45         data = self.tdb.get("%s\x00" % key)
46         if data is None:
47             return []
48         import struct
49         (num, ) = struct.unpack("<L", data[0:4])
50         keys = data[4:].split("\0")
51         assert keys[-1] == ""
52         keys.pop()
53         assert len(keys) == num
54         return keys
55
56     def values(self, key):
57         """Return a dictionary with the values set for a specific key."""
58         data = self.tdb.get("%s/%s\x00" % (REGISTRY_VALUE_PREFIX, key))
59         if data is None:
60             return {}
61         ret = {}
62         import struct
63         (num, ) = struct.unpack("<L", data[0:4])
64         data = data[4:]
65         for i in range(num):
66             # Value name
67             (name, data) = data.split("\0", 1)
68
69             (type, ) = struct.unpack("<L", data[0:4])
70             data = data[4:]
71             (value_len, ) = struct.unpack("<L", data[0:4])
72             data = data[4:]
73
74             ret[name] = (type, data[:value_len])
75             data = data[value_len:]
76
77         return ret
78
79
80 class PolicyDatabase:
81     def __init__(self, file):
82         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
83         self.min_password_length = self.tdb.fetch_uint32("min password length\x00")
84         self.password_history = self.tdb.fetch_uint32("password history\x00")
85         self.user_must_logon_to_change_password = self.tdb.fetch_uint32("user must logon to change pasword\x00")
86         self.maximum_password_age = self.tdb.fetch_uint32("maximum password age\x00")
87         self.minimum_password_age = self.tdb.fetch_uint32("minimum password age\x00")
88         self.lockout_duration = self.tdb.fetch_uint32("lockout duration\x00")
89         self.reset_count_minutes = self.tdb.fetch_uint32("reset count minutes\x00")
90         self.bad_lockout_minutes = self.tdb.fetch_uint32("bad lockout minutes\x00")
91         self.disconnect_time = self.tdb.fetch_int32("disconnect time\x00")
92         self.refuse_machine_password_change = self.tdb.fetch_uint32("refuse machine password change\x00")
93
94         # FIXME: Read privileges as well
95
96     def close(self):
97         self.tdb.close()
98
99
100 GROUPDB_DATABASE_VERSION_V1 = 1 # native byte format.
101 GROUPDB_DATABASE_VERSION_V2 = 2 # le format.
102
103 GROUP_PREFIX = "UNIXGROUP/"
104
105 # Alias memberships are stored reverse, as memberships. The performance
106 # critical operation is to determine the aliases a SID is member of, not
107 # listing alias members. So we store a list of alias SIDs a SID is member of
108 # hanging of the member as key.
109 MEMBEROF_PREFIX = "MEMBEROF/"
110
111 class GroupMappingDatabase:
112     def __init__(self, file): 
113         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
114         assert self.tdb.fetch_int32("INFO/version\x00") in (GROUPDB_DATABASE_VERSION_V1, GROUPDB_DATABASE_VERSION_V2)
115
116     def groupsids(self):
117         for k in self.tdb.keys():
118             if k.startswith(GROUP_PREFIX):
119                 yield k[len(GROUP_PREFIX):].rstrip("\0")
120
121     def get_group(self, sid):
122         data = self.tdb.get("%s%s\0" % (GROUP_PREFIX, sid))
123         if data is None:
124             return data
125         import struct
126         (gid, sid_name_use) = struct.unpack("<lL", data[0:8])
127         (nt_name, comment, _) = data[8:].split("\0")
128         return (gid, sid_name_use, nt_name, comment)
129
130     def aliases(self):
131         for k in self.tdb.keys():
132             if k.startswith(MEMBEROF_PREFIX):
133                 yield k[len(MEMBEROF_PREFIX):].rstrip("\0")
134
135     def close(self):
136         self.tdb.close()
137
138
139 # High water mark keys
140 IDMAP_HWM_GROUP = "GROUP HWM\0"
141 IDMAP_HWM_USER = "USER HWM\0"
142
143 IDMAP_GROUP_PREFIX = "GID "
144 IDMAP_USER_PREFIX = "UID "
145
146 # idmap version determines auto-conversion
147 IDMAP_VERSION_V2 = 2
148
149 class IdmapDatabase:
150     def __init__(self, file):
151         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
152         assert self.tdb.fetch_int32("IDMAP_VERSION\0") == IDMAP_VERSION_V2
153
154     def uids(self):
155         for k in self.tdb.keys():
156             if k.startswith(IDMAP_USER_PREFIX):
157                 yield int(k[len(IDMAP_USER_PREFIX):].rstrip("\0"))
158
159     def gids(self):
160         for k in self.tdb.keys():
161             if k.startswith(IDMAP_GROUP_PREFIX):
162                 yield int(k[len(IDMAP_GROUP_PREFIX):].rstrip("\0"))
163
164     def get_user_sid(self, uid):
165         data = self.tdb.get("%s%d\0" % (IDMAP_USER_PREFIX, uid))
166         if data is None:
167             return data
168         return data.rstrip("\0")
169
170     def get_group_sid(self, gid):
171         data = self.tdb.get("%s%d\0" % (IDMAP_GROUP_PREFIX, gid))
172         if data is None:
173             return data
174         return data.rstrip("\0")
175
176     def get_user_hwm(self):
177         return self.tdb.fetch_uint32(IDMAP_HWM_USER)
178
179     def get_group_hwm(self):
180         return self.tdb.fetch_uint32(IDMAP_HWM_GROUP)
181
182     def close(self):
183         self.tdb.close()
184
185
186 class SecretsDatabase:
187     def __init__(self, file):
188         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
189
190     def get_auth_password(self):
191         return self.tdb.get("SECRETS/AUTH_PASSWORD")
192
193     def get_auth_domain(self):
194         return self.tdb.get("SECRETS/AUTH_DOMAIN")
195
196     def get_auth_user(self):
197         return self.tdb.get("SECRETS/AUTH_USER")
198
199     def get_domain_guid(self, host):
200         return self.tdb.get("SECRETS/DOMGUID/%s" % host)
201
202     def ldap_dns(self):
203         for k in self.tdb.keys():
204             if k.startswith("SECRETS/LDAP_BIND_PW/"):
205                 yield k[len("SECRETS/LDAP_BIND_PW/"):].rstrip("\0")
206
207     def domains(self):
208         for k in self.tdb.keys():
209             if k.startswith("SECRETS/SID/"):
210                 yield k[len("SECRETS/SID/"):].rstrip("\0")
211
212     def get_ldap_bind_pw(self, host):
213         return self.tdb.get("SECRETS/LDAP_BIND_PW/%s" % host)
214     
215     def get_afs_keyfile(self, host):
216         return self.tdb.get("SECRETS/AFS_KEYFILE/%s" % host)
217
218     def get_machine_sec_channel_type(self, host):
219         return self.tdb.fetch_uint32("SECRETS/MACHINE_SEC_CHANNEL_TYPE/%s" % host)
220
221     def get_machine_last_change_time(self, host):
222         return self.tdb.fetch_uint32("SECRETS/MACHINE_LAST_CHANGE_TIME/%s" % host)
223             
224     def get_machine_password(self, host):
225         return self.tdb.get("SECRETS/MACHINE_PASSWORD/%s" % host)
226
227     def get_machine_acc(self, host):
228         return self.tdb.get("SECRETS/$MACHINE.ACC/%s" % host)
229
230     def get_domtrust_acc(self, host):
231         return self.tdb.get("SECRETS/$DOMTRUST.ACC/%s" % host)
232
233     def trusted_domains(self):
234         for k in self.tdb.keys():
235             if k.startswith("SECRETS/$DOMTRUST.ACC/"):
236                 yield k[len("SECRETS/$DOMTRUST.ACC/"):].rstrip("\0")
237
238     def get_random_seed(self):
239         return self.tdb.get("INFO/random_seed")
240
241     def get_sid(self, host):
242         return self.tdb.get("SECRETS/SID/%s" % host.upper())
243
244     def close(self):
245         self.tdb.close()
246
247
248 SHARE_DATABASE_VERSION_V1 = 1
249 SHARE_DATABASE_VERSION_V2 = 2
250
251 class ShareInfoDatabase:
252     def __init__(self, file):
253         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
254         assert self.tdb.fetch_int32("INFO/version\0") in (SHARE_DATABASE_VERSION_V1, SHARE_DATABASE_VERSION_V2)
255
256     def get_secdesc(self, name):
257         secdesc = self.tdb.get("SECDESC/%s" % name)
258         # FIXME: Run ndr_pull_security_descriptor
259         return secdesc
260
261     def close(self):
262         self.tdb.close()
263
264
265 class Shares:
266     def __init__(self, lp, shareinfo):
267         self.lp = lp
268         self.shareinfo = shareinfo
269
270     def __len__(self):
271         return len(self.lp) - 1
272
273     def __iter__(self):
274         return self.lp.__iter__()
275
276
277 ACB_DISABLED = 0x00000001
278 ACB_HOMDIRREQ = 0x00000002
279 ACB_PWNOTREQ = 0x00000004
280 ACB_TEMPDUP = 0x00000008
281 ACB_NORMAL = 0x00000010
282 ACB_MNS = 0x00000020
283 ACB_DOMTRUST = 0x00000040
284 ACB_WSTRUST = 0x00000080
285 ACB_SVRTRUST = 0x00000100
286 ACB_PWNOEXP = 0x00000200
287 ACB_AUTOLOCK = 0x00000400
288 ACB_ENC_TXT_PWD_ALLOWED = 0x00000800
289 ACB_SMARTCARD_REQUIRED = 0x00001000
290 ACB_TRUSTED_FOR_DELEGATION = 0x00002000
291 ACB_NOT_DELEGATED = 0x00004000
292 ACB_USE_DES_KEY_ONLY = 0x00008000
293 ACB_DONT_REQUIRE_PREAUTH = 0x00010000
294 ACB_PW_EXPIRED = 0x00020000
295 ACB_NO_AUTH_DATA_REQD = 0x00080000
296
297 acb_info_mapping = {
298         'N': ACB_PWNOTREQ,  # 'N'o password. 
299         'D': ACB_DISABLED,  # 'D'isabled.
300         'H': ACB_HOMDIRREQ, # 'H'omedir required.
301         'T': ACB_TEMPDUP,   # 'T'emp account.
302         'U': ACB_NORMAL,    # 'U'ser account (normal).
303         'M': ACB_MNS,       # 'M'NS logon user account. What is this ?
304         'W': ACB_WSTRUST,   # 'W'orkstation account.
305         'S': ACB_SVRTRUST,  # 'S'erver account. 
306         'L': ACB_AUTOLOCK,  # 'L'ocked account.
307         'X': ACB_PWNOEXP,   # No 'X'piry on password
308         'I': ACB_DOMTRUST,  # 'I'nterdomain trust account.
309         ' ': 0
310         }
311
312 def decode_acb(text):
313     assert not "[" in text and not "]" in text
314     ret = 0
315     for x in text:
316         ret |= acb_info_mapping[x]
317     return ret
318
319
320 class SAMUser:
321     def __init__(self, name, uid=None, lm_password=None, nt_password=None, acct_ctrl=None, 
322                  last_change_time=None, nt_username=None, fullname=None, logon_time=None, logoff_time=None,
323                  acct_desc=None, group_rid=None, bad_password_count=None, logon_count=None,
324                  domain=None, dir_drive=None, munged_dial=None, homedir=None, logon_script=None,
325                  profile_path=None, workstations=None, kickoff_time=None, bad_password_time=None,
326                  pass_last_set_time=None, pass_can_change_time=None, pass_must_change_time=None,
327                  user_rid=None):
328         self.username = name
329         self.uid = uid
330         self.lm_password = lm_password
331         self.nt_password = nt_password
332         self.acct_ctrl = acct_ctrl
333         self.pass_last_set_time = last_change_time
334         self.nt_username = nt_username
335         self.fullname = fullname
336         self.logon_time = logon_time
337         self.logoff_time = logoff_time
338         self.acct_desc = acct_desc
339         self.group_rid = group_rid
340         self.bad_password_count = bad_password_count
341         self.logon_count = logon_count
342         self.domain = domain
343         self.dir_drive = dir_drive
344         self.munged_dial = munged_dial
345         self.homedir = homedir
346         self.logon_script = logon_script
347         self.profile_path = profile_path
348         self.workstations = workstations
349         self.kickoff_time = kickoff_time
350         self.bad_password_time = bad_password_time
351         self.pass_can_change_time = pass_can_change_time
352         self.pass_must_change_time = pass_must_change_time
353         self.user_rid = user_rid
354
355     def __eq__(self, other): 
356         if not isinstance(other, SAMUser):
357             return False
358         return (self.username == other.username and 
359                 self.uid == other.uid and 
360                 self.lm_password == other.lm_password and 
361                 self.nt_password == other.nt_password and 
362                 self.acct_ctrl == other.acct_ctrl and 
363                 self.pass_last_set_time == other.pass_last_set_time and 
364                 self.nt_username == other.nt_username and 
365                 self.fullname == other.fullname and 
366                 self.logon_time == other.logon_time and 
367                 self.logoff_time == other.logoff_time and 
368                 self.acct_desc == other.acct_desc and 
369                 self.group_rid == other.group_rid and 
370                 self.bad_password_count == other.bad_password_count and 
371                 self.logon_count == other.logon_count and 
372                 self.domain == other.domain and 
373                 self.dir_drive == other.dir_drive and 
374                 self.munged_dial == other.munged_dial and 
375                 self.homedir == other.homedir and 
376                 self.logon_script == other.logon_script and 
377                 self.profile_path == other.profile_path and 
378                 self.workstations == other.workstations and 
379                 self.kickoff_time == other.kickoff_time and 
380                 self.bad_password_time == other.bad_password_time and 
381                 self.pass_can_change_time == other.pass_can_change_time and 
382                 self.pass_must_change_time == other.pass_must_change_time and 
383                 self.user_rid == other.user_rid)
384
385
386 class SmbpasswdFile:
387     def __init__(self, file):
388         self.users = {}
389         f = open(file, 'r')
390         for l in f.readlines():
391             if len(l) == 0 or l[0] == "#":
392                 continue # Skip comments and blank lines
393             parts = l.split(":")
394             username = parts[0]
395             uid = int(parts[1])
396             acct_ctrl = 0
397             last_change_time = None
398             if parts[2] == "NO PASSWORD":
399                 acct_ctrl |= ACB_PWNOTREQ
400                 lm_password = None
401             elif parts[2][0] in ("*", "X"):
402                 # No password set
403                 lm_password = None
404             else:
405                 lm_password = parts[2]
406
407             if parts[3][0] in ("*", "X"):
408                 # No password set
409                 nt_password = None
410             else:
411                 nt_password = parts[3]
412
413             if parts[4][0] == '[':
414                 assert "]" in parts[4]
415                 acct_ctrl |= decode_acb(parts[4][1:-1])
416                 if parts[5].startswith("LCT-"):
417                     last_change_time = int(parts[5][len("LCT-"):], 16)
418             else: # old style file
419                 if username[-1] == "$":
420                     acct_ctrl &= ~ACB_NORMAL
421                     acct_ctrl |= ACB_WSTRUST
422
423             self.users[username] = SAMUser(username, uid, lm_password, nt_password, acct_ctrl, last_change_time)
424
425         f.close()
426
427     def __len__(self):
428         return len(self.users)
429
430     def __getitem__(self, name):
431         return self.users[name]
432
433     def __iter__(self):
434         return iter(self.users)
435
436     def close(self): # For consistency
437         pass
438
439
440 TDBSAM_FORMAT_STRING_V0 = "ddddddBBBBBBBBBBBBddBBwdwdBwwd"
441 TDBSAM_FORMAT_STRING_V1 = "dddddddBBBBBBBBBBBBddBBwdwdBwwd"
442 TDBSAM_FORMAT_STRING_V2 = "dddddddBBBBBBBBBBBBddBBBwwdBwwd"
443 TDBSAM_USER_PREFIX = "USER_"
444
445
446 class LdapSam:
447     def __init__(self, url):
448         self.ldap_url = ldap_url
449
450
451 class TdbSam:
452     def __init__(self, file):
453         self.tdb = tdb.Tdb(file, flags=os.O_RDONLY)
454         self.version = self.tdb.fetch_uint32("INFO/version") or 0
455         assert self.version in (0, 1, 2)
456
457     def usernames(self):
458         for k in self.tdb.keys():
459             if k.startswith(TDBSAM_USER_PREFIX):
460                 yield k[len(TDBSAM_USER_PREFIX):].rstrip("\0")
461
462     __iter__ = usernames
463     
464     def __getitem__(self, name):
465         data = self.tdb["%s%s\0" % (TDBSAM_USER_PREFIX, name)]
466         import struct
467         (logon_time, logoff_time, kickoff_time, pass_last_set_time, pass_can_change_time, \
468                 pass_must_change_time) = struct.unpack("<llllll", data[:6*4])
469         user = SAMUser(name)
470         user.logon_time = logon_time
471         user.logoff_time = logoff_time
472         user.kickoff_time = kickoff_time
473         user.pass_last_set_time = pass_last_set_time
474         user.pass_can_change_time = pass_can_change_time
475
476 #       &username_len, &sampass->username,                      /* B */
477 #               &domain_len, &sampass->domain,                          /* B */
478 #               &nt_username_len, &sampass->nt_username,                /* B */
479 #               &fullname_len, &sampass->fullname,                      /* B */
480 #               &homedir_len, &sampass->homedir,                        /* B */
481 #               &dir_drive_len, &sampass->dir_drive,                    /* B */
482 #               &logon_script_len, &sampass->logon_script,              /* B */
483 #               &profile_path_len, &sampass->profile_path,              /* B */
484 #               &acct_desc_len, &sampass->acct_desc,                    /* B */
485 #               &workstations_len, &sampass->workstations,              /* B */
486 #               &unknown_str_len, &sampass->unknown_str,                /* B */
487 #               &munged_dial_len, &sampass->munged_dial,                /* B */
488 #               &sampass->user_rid,                                     /* d */
489 #               &sampass->group_rid,                                    /* d */
490 #               &lm_pw_len, sampass->lm_pw.hash,                        /* B */
491 #               &nt_pw_len, sampass->nt_pw.hash,                        /* B */
492 #               &sampass->acct_ctrl,                                    /* w */
493 #               &remove_me, /* remove on the next TDB_FORMAT upgarde */ /* d */
494 #               &sampass->logon_divs,                                   /* w */
495 #               &sampass->hours_len,                                    /* d */
496 #               &hourslen, &sampass->hours,                             /* B */
497 #               &sampass->bad_password_count,                           /* w */
498 #               &sampass->logon_count,                                  /* w */
499 #               &sampass->unknown_6);                                   /* d */
500 #               
501         return user
502
503     def close(self):
504         self.tdb.close()
505
506
507 def shellsplit(text):
508     """Very simple shell-like line splitting.
509     
510     :param text: Text to split.
511     :return: List with parts of the line as strings.
512     """
513     ret = list()
514     inquotes = False
515     current = ""
516     for c in text:
517         if c == "\"":
518             inquotes = not inquotes
519         elif c in ("\t", "\n", " ") and not inquotes:
520             ret.append(current)
521             current = ""
522         else:
523             current += c
524     if current != "":
525         ret.append(current)
526     return ret
527
528
529 class WinsDatabase:
530     def __init__(self, file):
531         self.entries = {}
532         f = open(file, 'r')
533         assert f.readline().rstrip("\n") == "VERSION 1 0"
534         for l in f.readlines():
535             if l[0] == "#": # skip comments
536                 continue
537             entries = shellsplit(l.rstrip("\n"))
538             name = entries[0]
539             ttl = int(entries[1])
540             i = 2
541             ips = []
542             while "." in entries[i]:
543                 ips.append(entries[i])
544                 i+=1
545             nb_flags = int(entries[i][:-1], 16)
546             assert not name in self.entries, "Name %s exists twice" % name
547             self.entries[name] = (ttl, ips, nb_flags)
548         f.close()
549
550     def __getitem__(self, name):
551         return self.entries[name]
552
553     def __len__(self):
554         return len(self.entries)
555
556     def __iter__(self):
557         return iter(self.entries)
558
559     def items(self):
560         return self.entries.items()
561
562     def close(self): # for consistency
563         pass
564
565 class Samba3:
566     def __init__(self, libdir, smbconfpath):
567         self.smbconfpath = smbconfpath
568         self.libdir = libdir
569         import param
570         self.lp = param.ParamFile()
571         self.lp.read(self.smbconfpath)
572
573     def libdir_path(self, path):
574         if path[0] == "/" or path[0] == ".":
575             return path
576         return os.path.join(self.libdir, path)
577
578     def get_conf(self):
579         return self.lp
580
581     def get_sam_db(self):
582         lp = self.get_conf()
583         backends = str(lp.get("passdb backend")).split(" ")
584         if ":" in backends[0]:
585             (name, location) = backends[0].split(":", 2)
586         else:
587             name = backends[0]
588             location = None
589         if name == "smbpasswd":
590             return SmbpasswdFile(self.libdir_path(location or "smbpasswd"))
591         elif name == "tdbsam":
592             return TdbSam(self.libdir_path(location or "passdb.tdb"))
593         elif name == "ldapsam":
594             if location is not None:
595                 return LdapSam("ldap:%s" % location)
596             return LdapSam(lp.get("ldap server"))
597         else:
598             raise NotImplementedError("unsupported passdb backend %s" % backends[0])
599
600     def get_policy_db(self):
601         return PolicyDatabase(self.libdir_path("account_policy.tdb"))
602     
603     def get_registry(self):
604         return Registry(self.libdir_path("registry.tdb"))
605
606     def get_secrets_db(self):
607         return SecretsDatabase(self.libdir_path("secrets.tdb"))
608
609     def get_shareinfo_db(self):
610         return ShareInfoDatabase(self.libdir_path("share_info.tdb"))
611
612     def get_idmap_db(self):
613         return IdmapDatabase(self.libdir_path("winbindd_idmap.tdb"))
614
615     def get_wins_db(self):
616         return WinsDatabase(self.libdir_path("wins.dat"))
617
618     def get_shares(self):
619         return Shares(self.get_conf(), self.get_shareinfo_db())
620
621     def get_groupmapping_db(self):
622         return GroupMappingDatabase(self.libdir_path("group_mapping.tdb"))