source4 smbd test: prefork process restart
[bbaumbach/samba-autobuild/.git] / libgpo / pygpo.c
1 /*
2    Unix SMB/CIFS implementation.
3    Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
4
5    This program is free software; you can redistribute it and/or modify
6    it under the terms of the GNU General Public License as published by
7    the Free Software Foundation; either version 3 of the License, or
8    (at your option) any later version.
9
10    This program is distributed in the hope that it will be useful,
11    but WITHOUT ANY WARRANTY; without even the implied warranty of
12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13    GNU General Public License for more details.
14
15    You should have received a copy of the GNU General Public License
16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include <Python.h>
20 #include "includes.h"
21 #include "version.h"
22 #include "param/pyparam.h"
23 #include "gpo.h"
24 #include "ads.h"
25 #include "secrets.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
30 #include "python/py3compat.h"
31
32 /* A Python C API module to use LIBGPO */
33
34 #define GPO_getter(ATTR) \
35 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
36 { \
37         struct GROUP_POLICY_OBJECT *gpo_ptr \
38                 = pytalloc_get_ptr(self); \
39         \
40         if (gpo_ptr->ATTR) \
41                 return PyStr_FromString(gpo_ptr->ATTR); \
42         else \
43                 return Py_None; \
44 }
45 GPO_getter(ds_path)
46 GPO_getter(file_sys_path)
47 GPO_getter(display_name)
48 GPO_getter(name)
49 GPO_getter(link)
50 GPO_getter(user_extensions)
51 GPO_getter(machine_extensions)
52
53 static PyGetSetDef GPO_setters[] = {
54         {discard_const_p(char, "ds_path"), (getter)GPO_get_ds_path, NULL, NULL,
55                 NULL},
56         {discard_const_p(char, "file_sys_path"), (getter)GPO_get_file_sys_path,
57                 NULL, NULL, NULL},
58         {discard_const_p(char, "display_name"), (getter)GPO_get_display_name,
59                 NULL, NULL, NULL},
60         {discard_const_p(char, "name"), (getter)GPO_get_name, NULL, NULL,
61                 NULL},
62         {discard_const_p(char, "link"), (getter)GPO_get_link, NULL, NULL,
63                 NULL},
64         {discard_const_p(char, "user_extensions"),
65                 (getter)GPO_get_user_extensions,
66                 NULL, NULL, NULL},
67         {discard_const_p(char, "machine_extensions"),
68                 (getter)GPO_get_machine_extensions, NULL, NULL, NULL},
69         {NULL}
70 };
71
72 static PyObject *py_gpo_get_unix_path(PyObject *self, PyObject *args,
73                                       PyObject *kwds)
74 {
75         NTSTATUS status;
76         const char *cache_dir = NULL;
77         PyObject *ret = Py_None;
78         char *unix_path = NULL;
79         TALLOC_CTX *frame = NULL;
80         static const char *kwlist[] = {"cache_dir", NULL};
81         struct GROUP_POLICY_OBJECT *gpo_ptr \
82                 = (struct GROUP_POLICY_OBJECT *)pytalloc_get_ptr(self);
83
84         frame = talloc_stackframe();
85
86         if (!PyArg_ParseTupleAndKeywords(args, kwds, "|s",
87                                          discard_const_p(char *, kwlist),
88                                          &cache_dir)) {
89                 PyErr_SetString(PyExc_SystemError,
90                                 "Failed to parse arguments to "
91                                 "gpo_get_unix_path()");
92                 goto out;
93         }
94
95         if (!cache_dir) {
96                 cache_dir = cache_path(talloc_tos(), GPO_CACHE_DIR);
97                 if (!cache_dir) {
98                         PyErr_SetString(PyExc_MemoryError,
99                                         "Failed to determine gpo cache dir");
100                         goto out;
101                 }
102         }
103
104         status = gpo_get_unix_path(frame, cache_dir, gpo_ptr, &unix_path);
105
106         if (!NT_STATUS_IS_OK(status)) {
107                 PyErr_SetString(PyExc_SystemError,
108                                 "Failed to determine gpo unix path");
109                 goto out;
110         }
111
112         ret = PyStr_FromString(unix_path);
113
114 out:
115         TALLOC_FREE(frame);
116         return ret;
117 }
118
119 static PyMethodDef GPO_methods[] = {
120         {"get_unix_path", (PyCFunction)py_gpo_get_unix_path, METH_KEYWORDS,
121                 NULL },
122         {NULL}
123 };
124
125 static PyTypeObject GPOType = {
126         PyVarObject_HEAD_INIT(NULL, 0)
127         .tp_name = "gpo.GROUP_POLICY_OBJECT",
128         .tp_doc = "GROUP_POLICY_OBJECT",
129         .tp_getset = GPO_setters,
130         .tp_methods = GPO_methods,
131         .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
132 };
133
134 typedef struct {
135         PyObject_HEAD
136         ADS_STRUCT *ads_ptr;
137         struct cli_credentials *cli_creds;
138 } ADS;
139
140 static void py_ads_dealloc(ADS* self)
141 {
142         ads_destroy(&(self->ads_ptr));
143         Py_TYPE(self)->tp_free((PyObject*)self);
144 }
145
146 static PyObject* py_ads_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
147 {
148         ADS *self;
149         self = (ADS*)type->tp_alloc(type, 0);
150         return (PyObject*)self;
151 }
152
153 static PyObject* py_ads_connect(ADS *self);
154 static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
155 {
156         const char *realm = NULL;
157         const char *workgroup = NULL;
158         const char *ldap_server = NULL;
159         PyObject *py_creds = NULL;
160         PyObject *lp_obj = NULL;
161         struct loadparm_context *lp_ctx = NULL;
162
163         static const char *kwlist[] = {
164                 "ldap_server", "loadparm_context", "credentials", NULL
165         };
166         if (!PyArg_ParseTupleAndKeywords(args, kwds, "sO|O",
167                                          discard_const_p(char *, kwlist),
168                                          &ldap_server, &lp_obj, &py_creds)) {
169                 return -1;
170         }
171
172         if (py_creds) {
173                 if (!py_check_dcerpc_type(py_creds, "samba.credentials",
174                                           "Credentials")) {
175                         PyErr_Format(PyExc_TypeError,
176                                      "Expected samba.credentials "
177                                      "for credentials argument");
178                         return -1;
179                 }
180                 self->cli_creds
181                         = PyCredentials_AsCliCredentials(py_creds);
182         }
183
184         if (lp_obj) {
185                 bool ok = py_check_dcerpc_type(lp_obj, "samba.param",
186                                                "LoadParm");
187                 if (!ok) {
188                         PyErr_Format(PyExc_TypeError,
189                                      "Expected samba.param.LoadParm "
190                                      "for lp argument");
191                         return -1;
192                 }
193                 lp_ctx = pytalloc_get_type(lp_obj, struct loadparm_context);
194                 if (lp_ctx == NULL) {
195                         return -1;
196                 }
197                 ok = lp_load_initial_only(lp_ctx->szConfigFile);
198                 if (!ok) {
199                         return -1;
200                 }
201         }
202
203         if (self->cli_creds) {
204                 realm = cli_credentials_get_realm(self->cli_creds);
205                 workgroup = cli_credentials_get_domain(self->cli_creds);
206         } else {
207                 realm = lp_realm();
208                 workgroup = lp_workgroup();
209         }
210
211         if (ldap_server == NULL) {
212                 return -1;
213         }
214
215         self->ads_ptr = ads_init(realm, workgroup, ldap_server);
216         if (self->ads_ptr == NULL) {
217                 return -1;
218         }
219
220         return 0;
221 }
222
223 static PyObject* py_ads_connect(ADS *self)
224 {
225         ADS_STATUS status;
226         TALLOC_CTX *frame = talloc_stackframe();
227         if (self->cli_creds) {
228                 self->ads_ptr->auth.user_name =
229                         SMB_STRDUP(cli_credentials_get_username(self->cli_creds));
230                 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
231                 self->ads_ptr->auth.password =
232                         SMB_STRDUP(cli_credentials_get_password(self->cli_creds));
233                 self->ads_ptr->auth.realm =
234                         SMB_STRDUP(cli_credentials_get_realm(self->cli_creds));
235
236                 status = ads_connect_user_creds(self->ads_ptr);
237                 if (!ADS_ERR_OK(status)) {
238                         PyErr_SetString(PyExc_SystemError,
239                                         "ads_connect() failed");
240                         TALLOC_FREE(frame);
241                         Py_RETURN_FALSE;
242                 }
243         } else {
244                 char *passwd = NULL;
245                 int ret = asprintf(&(self->ads_ptr->auth.user_name), "%s$",
246                                    lp_netbios_name());
247                 if (ret == -1) {
248                         PyErr_SetString(PyExc_SystemError,
249                                         "Failed to asprintf");
250                         TALLOC_FREE(frame);
251                         Py_RETURN_FALSE;
252                 } else {
253                         self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
254                 }
255
256                 if (!secrets_init()) {
257                         PyErr_SetString(PyExc_SystemError,
258                                         "secrets_init() failed");
259                         TALLOC_FREE(frame);
260                         Py_RETURN_FALSE;
261                 }
262
263                 passwd = secrets_fetch_machine_password(self->ads_ptr->server.workgroup,
264                                                         NULL, NULL);
265                 if (passwd == NULL) {
266                         PyErr_SetString(PyExc_SystemError,
267                                         "Failed to fetch the machine account "
268                                         "password");
269                         TALLOC_FREE(frame);
270                         Py_RETURN_FALSE;
271                 }
272                 self->ads_ptr->auth.password = smb_xstrdup(passwd);
273                 SAFE_FREE(passwd);
274                 self->ads_ptr->auth.realm =
275                         smb_xstrdup(self->ads_ptr->server.realm);
276                 if (!strupper_m(self->ads_ptr->auth.realm)) {
277                         PyErr_SetString(PyExc_SystemError, "Failed to strdup");
278                         TALLOC_FREE(frame);
279                         Py_RETURN_FALSE;
280                 }
281
282                 status = ads_connect(self->ads_ptr);
283                 if (!ADS_ERR_OK(status)) {
284                         PyErr_SetString(PyExc_SystemError,
285                                         "ads_connect() failed");
286                         TALLOC_FREE(frame);
287                         Py_RETURN_FALSE;
288                 }
289         }
290
291         TALLOC_FREE(frame);
292         Py_RETURN_TRUE;
293 }
294
295 /* Parameter mapping and functions for the GP_EXT struct */
296 void initgpo(void);
297
298 /* Global methods aka do not need a special pyobject type */
299 static PyObject *py_gpo_get_sysvol_gpt_version(PyObject * self,
300                                                PyObject * args)
301 {
302         TALLOC_CTX *tmp_ctx = NULL;
303         char *unix_path;
304         char *display_name = NULL;
305         uint32_t sysvol_version = 0;
306         PyObject *result;
307         NTSTATUS status;
308
309         tmp_ctx = talloc_new(NULL);
310
311         if (!PyArg_ParseTuple(args, "s", &unix_path)) {
312                 return NULL;
313         }
314         status = gpo_get_sysvol_gpt_version(tmp_ctx, unix_path,
315                                             &sysvol_version,
316                                             &display_name);
317         if (!NT_STATUS_IS_OK(status)) {
318                 PyErr_SetNTSTATUS(status);
319                 TALLOC_FREE(tmp_ctx);
320                 return NULL;
321         }
322
323         talloc_free(tmp_ctx);
324         result = Py_BuildValue("[s,i]", display_name, sysvol_version);
325         return result;
326 }
327
328 #ifdef HAVE_ADS
329 static ADS_STATUS find_samaccount(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
330                                   const char *samaccountname,
331                                   uint32_t *uac_ret, const char **dn_ret)
332 {
333         ADS_STATUS status;
334         const char *attrs[] = { "userAccountControl", NULL };
335         const char *filter;
336         LDAPMessage *res = NULL;
337         char *dn = NULL;
338         uint32_t uac = 0;
339
340         filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
341                                  samaccountname);
342         if (filter == NULL) {
343                 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
344                 goto out;
345         }
346
347         status = ads_do_search_all(ads, ads->config.bind_path,
348                                    LDAP_SCOPE_SUBTREE, filter, attrs, &res);
349
350         if (!ADS_ERR_OK(status)) {
351                 goto out;
352         }
353
354         if (ads_count_replies(ads, res) != 1) {
355                 status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
356                 goto out;
357         }
358
359         dn = ads_get_dn(ads, talloc_tos(), res);
360         if (dn == NULL) {
361                 status = ADS_ERROR(LDAP_NO_MEMORY);
362                 goto out;
363         }
364
365         if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
366                 status = ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
367                 goto out;
368         }
369
370         if (uac_ret) {
371                 *uac_ret = uac;
372         }
373
374         if (dn_ret) {
375                 *dn_ret = talloc_strdup(mem_ctx, dn);
376                 if (*dn_ret == NULL) {
377                         status = ADS_ERROR(LDAP_NO_MEMORY);
378                         goto out;
379                 }
380         }
381 out:
382         TALLOC_FREE(dn);
383         ads_msgfree(ads, res);
384
385         return status;
386 }
387
388 static PyObject *py_ads_get_gpo_list(ADS *self, PyObject *args, PyObject *kwds)
389 {
390         TALLOC_CTX *frame = NULL;
391         struct GROUP_POLICY_OBJECT *gpo = NULL, *gpo_list = NULL;
392         ADS_STATUS status;
393         const char *samaccountname = NULL;
394         const char *dn = NULL;
395         uint32_t uac = 0;
396         uint32_t flags = 0;
397         struct security_token *token = NULL;
398         PyObject *ret = Py_None;
399         TALLOC_CTX *gpo_ctx;
400         size_t list_size;
401         size_t i;
402
403         static const char *kwlist[] = {"samaccountname", NULL};
404         if (!PyArg_ParseTupleAndKeywords(args, kwds, "s",
405                                          discard_const_p(char *, kwlist),
406                                          &samaccountname)) {
407                 PyErr_SetString(PyExc_SystemError,
408                                 "Failed to parse arguments to "
409                                 "py_ads_get_gpo_list()");
410                 goto out;
411         }
412
413         frame = talloc_stackframe();
414
415         status = find_samaccount(self->ads_ptr, frame,
416                                  samaccountname, &uac, &dn);
417         if (!ADS_ERR_OK(status)) {
418                 TALLOC_FREE(frame);
419                 PyErr_SetString(PyExc_SystemError,
420                                 "Failed to find samAccountName");
421                 goto out;
422         }
423
424         if (uac & UF_WORKSTATION_TRUST_ACCOUNT ||
425             uac & UF_SERVER_TRUST_ACCOUNT) {
426                 flags |= GPO_LIST_FLAG_MACHINE;
427                 status = gp_get_machine_token(self->ads_ptr, frame, dn,
428                                               &token);
429         } else {
430                 status = ads_get_sid_token(self->ads_ptr, frame, dn, &token);
431         }
432         if (!ADS_ERR_OK(status)) {
433                 TALLOC_FREE(frame);
434                 PyErr_SetString(PyExc_SystemError, "Failed to get token");
435                 goto out;
436         }
437
438         gpo_ctx = talloc_new(frame);
439         status = ads_get_gpo_list(self->ads_ptr, gpo_ctx, dn, flags, token,
440                                   &gpo_list);
441         if (!ADS_ERR_OK(status)) {
442                 TALLOC_FREE(frame);
443                 PyErr_SetString(PyExc_SystemError, "Failed to fetch GPO list");
444                 goto out;
445         }
446
447         /* Convert the C linked list into a python list */
448         list_size = 0;
449         for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
450                 list_size++;
451         }
452
453         i = 0;
454         ret = PyList_New(list_size);
455         if (ret == NULL) {
456                 TALLOC_FREE(frame);
457                 goto out;
458         }
459
460         for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
461                 PyObject *obj = pytalloc_reference_ex(&GPOType,
462                                                       gpo_ctx, gpo);
463                 if (obj == NULL) {
464                         TALLOC_FREE(frame);
465                         goto out;
466                 }
467
468                 PyList_SetItem(ret, i, obj);
469                 i++;
470         }
471
472 out:
473
474         TALLOC_FREE(frame);
475         return ret;
476 }
477
478 #endif
479
480 static PyMethodDef ADS_methods[] = {
481         { "connect", (PyCFunction)py_ads_connect, METH_NOARGS,
482                 "Connect to the LDAP server" },
483 #ifdef HAVE_ADS
484         { "get_gpo_list", (PyCFunction)py_ads_get_gpo_list, METH_VARARGS | METH_KEYWORDS,
485                 NULL },
486 #endif
487         { NULL }
488 };
489
490 static PyTypeObject ads_ADSType = {
491         .tp_name = "gpo.ADS_STRUCT",
492         .tp_basicsize = sizeof(ADS),
493         .tp_dealloc = (destructor)py_ads_dealloc,
494         .tp_flags = Py_TPFLAGS_DEFAULT,
495         .tp_doc = "ADS struct",
496         .tp_methods = ADS_methods,
497         .tp_init = (initproc)py_ads_init,
498         .tp_new = py_ads_new,
499 };
500
501 static PyMethodDef py_gpo_methods[] = {
502         {"gpo_get_sysvol_gpt_version",
503                 (PyCFunction)py_gpo_get_sysvol_gpt_version,
504                 METH_VARARGS, NULL},
505         {NULL}
506 };
507
508 static struct PyModuleDef moduledef = {
509         PyModuleDef_HEAD_INIT,
510         .m_name = "gpo",
511         .m_doc = "libgpo python bindings",
512         .m_size = -1,
513         .m_methods = py_gpo_methods,
514 };
515
516 /* Will be called by python when loading this module */
517 void initgpo(void);
518
519 MODULE_INIT_FUNC(gpo)
520 {
521         PyObject *m;
522
523         debug_setup_talloc_log();
524
525         /* Instantiate the types */
526         m = PyModule_Create(&moduledef);
527         if (m == NULL) {
528                 return m;
529         }
530
531         PyModule_AddObject(m, "version",
532                            PyStr_FromString(SAMBA_VERSION_STRING));
533
534         if (PyType_Ready(&ads_ADSType) < 0) {
535                 return m;
536         }
537
538         PyModule_AddObject(m, "ADS_STRUCT", (PyObject *)&ads_ADSType);
539
540         if (pytalloc_BaseObject_PyType_Ready(&GPOType) < 0) {
541                 return m;
542         }
543
544         Py_INCREF((PyObject *)(void *)&GPOType);
545         PyModule_AddObject(m, "GROUP_POLICY_OBJECT",
546                            (PyObject *)&GPOType);
547         return m;
548
549 }