libgpo/gpo_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2005-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/ndr_misc.h"
  22 #if _SAMBA_BUILD_ == 4
  23 #include "../libgpo/gpo.h"
  24 #include "source4/libgpo/ads_convenience.h"
  25 #endif
  26 #undef strdup
  27
  28 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
  29 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
  30
  31 /* should we store a parsed guid ? */
  32 struct gp_table {
  33         const char *name;
  34         const char *guid_string;
  35 };
  36
  37 #if 0 /* unused */
  38 static struct gp_table gpo_default_policy[] = {
  39         { DEFAULT_DOMAIN_POLICY,
  40                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
  41         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
  42                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
  43         { NULL, NULL }
  44 };
  45 #endif
  46
  47 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
  48
  49 static struct gp_table gpo_cse_extensions[] = {
  50         /* used to be "Administrative Templates Extension" */
  51         /* "Registry Settings"
  52         (http://support.microsoft.com/kb/216357/EN-US/) */
  53         { "Registry Settings",
  54                 GP_EXT_GUID_REGISTRY },
  55         { "Microsoft Disc Quota",
  56                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
  57         { "EFS recovery",
  58                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  59         { "Folder Redirection",
  60                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  61         { "IP Security",
  62                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
  63         { "Internet Explorer Branding",
  64                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
  65         { "QoS Packet Scheduler",
  66                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
  67         { "Scripts",
  68                 GP_EXT_GUID_SCRIPTS },
  69         { "Security",
  70                 GP_EXT_GUID_SECURITY },
  71         { "Software Installation",
  72                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  73         { "Wireless Group Policy",
  74                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
  75         { "Application Management",
  76                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  77         { "unknown",
  78                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
  79         { NULL, NULL }
  80 };
  81
  82 /* guess work */
  83 static struct gp_table gpo_cse_snapin_extensions[] = {
  84         { "Administrative Templates",
  85                 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
  86         { "Certificates",
  87                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
  88         { "EFS recovery policy processing",
  89                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  90         { "Folder Redirection policy processing",
  91                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  92         { "Folder Redirection",
  93                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
  94         { "Registry policy processing",
  95                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
  96         { "Remote Installation Services",
  97                 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
  98         { "Security Settings",
  99                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
 100         { "Security policy processing",
 101                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
 102         { "unknown",
 103                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
 104         { "unknown2",
 105                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
 106         { NULL, NULL }
 107 };
 108
 109 /****************************************************************
 110 ****************************************************************/
 111
 112 static const char *name_to_guid_string(const char *name,
 113                                        struct gp_table *table)
 114 {
 115         int i;
 116
 117         for (i = 0; table[i].name; i++) {
 118                 if (strequal(name, table[i].name)) {
 119                         return table[i].guid_string;
 120                 }
 121         }
 122
 123         return NULL;
 124 }
 125
 126 /****************************************************************
 127 ****************************************************************/
 128
 129 static const char *guid_string_to_name(const char *guid_string,
 130                                        struct gp_table *table)
 131 {
 132         int i;
 133
 134         for (i = 0; table[i].guid_string; i++) {
 135                 if (strequal(guid_string, table[i].guid_string)) {
 136                         return table[i].name;
 137                 }
 138         }
 139
 140         return NULL;
 141 }
 142
 143 /****************************************************************
 144 ****************************************************************/
 145
 146 static const char *snapin_guid_string_to_name(const char *guid_string,
 147                                               struct gp_table *table)
 148 {
 149         int i;
 150         for (i = 0; table[i].guid_string; i++) {
 151                 if (strequal(guid_string, table[i].guid_string)) {
 152                         return table[i].name;
 153                 }
 154         }
 155         return NULL;
 156 }
 157
 158 #if 0 /* unused */
 159 static const char *default_gpo_name_to_guid_string(const char *name)
 160 {
 161         return name_to_guid_string(name, gpo_default_policy);
 162 }
 163
 164 static const char *default_gpo_guid_string_to_name(const char *guid)
 165 {
 166         return guid_string_to_name(guid, gpo_default_policy);
 167 }
 168 #endif
 169
 170 /****************************************************************
 171 ****************************************************************/
 172
 173 const char *cse_gpo_guid_string_to_name(const char *guid)
 174 {
 175         return guid_string_to_name(guid, gpo_cse_extensions);
 176 }
 177
 178 /****************************************************************
 179 ****************************************************************/
 180
 181 const char *cse_gpo_name_to_guid_string(const char *name)
 182 {
 183         return name_to_guid_string(name, gpo_cse_extensions);
 184 }
 185
 186 /****************************************************************
 187 ****************************************************************/
 188
 189 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
 190 {
 191         return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
 192 }
 193
 194 /****************************************************************
 195 ****************************************************************/
 196
 197 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
 198 {
 199         int lvl = debuglevel;
 200         int i;
 201
 202         if (gp_ext == NULL) {
 203                 return;
 204         }
 205
 206         DEBUG(lvl,("\t---------------------\n\n"));
 207         DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
 208
 209         for (i=0; i< gp_ext->num_exts; i++) {
 210
 211                 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
 212                         gp_ext->extensions_guid[i]));
 213                 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
 214                         gp_ext->extensions[i]));
 215
 216                 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
 217                         gp_ext->snapins_guid[i]));
 218                 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
 219                         gp_ext->snapins[i]));
 220         }
 221 }
 222
 223 #ifdef HAVE_LDAP
 224
 225 /****************************************************************
 226 ****************************************************************/
 227
 228 void dump_gpo(ADS_STRUCT *ads,
 229               TALLOC_CTX *mem_ctx,
 230               struct GROUP_POLICY_OBJECT *gpo,
 231               int debuglevel)
 232 {
 233         int lvl = debuglevel;
 234
 235         if (gpo == NULL) {
 236                 return;
 237         }
 238
 239         DEBUG(lvl,("---------------------\n\n"));
 240
 241         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
 242         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
 243         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
 244         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
 245                 GPO_VERSION_USER(gpo->version),
 246                 GPO_VERSION_USER(gpo->version)));
 247         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
 248                 GPO_VERSION_MACHINE(gpo->version),
 249                  GPO_VERSION_MACHINE(gpo->version)));
 250         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
 251         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
 252
 253         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
 254         switch (gpo->options) {
 255                 case GPFLAGS_ALL_ENABLED:
 256                         DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
 257                         break;
 258                 case GPFLAGS_USER_SETTINGS_DISABLED:
 259                         DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
 260                         break;
 261                 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
 262                         DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
 263                         break;
 264                 case GPFLAGS_ALL_DISABLED:
 265                         DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
 266                         break;
 267                 default:
 268                         DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
 269                         break;
 270         }
 271
 272         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
 273         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
 274         switch (gpo->link_type) {
 275                 case GP_LINK_UNKOWN:
 276                         DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
 277                         break;
 278                 case GP_LINK_OU:
 279                         DEBUGADD(lvl,("GP_LINK_OU\n"));
 280                         break;
 281                 case GP_LINK_DOMAIN:
 282                         DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
 283                         break;
 284                 case GP_LINK_SITE:
 285                         DEBUGADD(lvl,("GP_LINK_SITE\n"));
 286                         break;
 287                 case GP_LINK_MACHINE:
 288                         DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
 289                         break;
 290                 default:
 291                         break;
 292         }
 293
 294         DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
 295
 296         if (gpo->machine_extensions) {
 297
 298                 struct GP_EXT *gp_ext = NULL;
 299
 300                 if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
 301                                       &gp_ext)) {
 302                         return;
 303                 }
 304                 dump_gp_ext(gp_ext, lvl);
 305         }
 306
 307         DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
 308
 309         if (gpo->user_extensions) {
 310
 311                 struct GP_EXT *gp_ext = NULL;
 312
 313                 if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
 314                                       &gp_ext)) {
 315                         return;
 316                 }
 317                 dump_gp_ext(gp_ext, lvl);
 318         }
 319
 320         DEBUGADD(lvl,("security descriptor:\n"));
 321
 322         NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
 323 }
 324
 325 /****************************************************************
 326 ****************************************************************/
 327
 328 void dump_gpo_list(ADS_STRUCT *ads,
 329                    TALLOC_CTX *mem_ctx,
 330                    struct GROUP_POLICY_OBJECT *gpo_list,
 331                    int debuglevel)
 332 {
 333         struct GROUP_POLICY_OBJECT *gpo = NULL;
 334
 335         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 336                 dump_gpo(ads, mem_ctx, gpo, debuglevel);
 337         }
 338 }
 339
 340 /****************************************************************
 341 ****************************************************************/
 342
 343 void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link)
 344 {
 345         ADS_STATUS status;
 346         int i;
 347         int lvl = 10;
 348
 349         if (gp_link == NULL) {
 350                 return;
 351         }
 352
 353         DEBUG(lvl,("---------------------\n\n"));
 354
 355         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
 356         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
 357         switch (gp_link->gp_opts) {
 358                 case GPOPTIONS_INHERIT:
 359                         DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
 360                         break;
 361                 case GPOPTIONS_BLOCK_INHERITANCE:
 362                         DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
 363                         break;
 364                 default:
 365                         break;
 366         }
 367
 368         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
 369
 370         for (i = 0; i < gp_link->num_links; i++) {
 371
 372                 DEBUGADD(lvl,("---------------------\n\n"));
 373
 374                 DEBUGADD(lvl,("link: #%d\n", i + 1));
 375                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
 376
 377                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
 378                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
 379                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
 380                 }
 381                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
 382                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
 383                 }
 384                 DEBUGADD(lvl,("\n"));
 385
 386                 if (ads != NULL && mem_ctx != NULL) {
 387
 388                         struct GROUP_POLICY_OBJECT gpo;
 389
 390                         status = ads_get_gpo(ads, mem_ctx,
 391                                              gp_link->link_names[i],
 392                                              NULL, NULL, &gpo);
 393                         if (!ADS_ERR_OK(status)) {
 394                                 DEBUG(lvl,("get gpo for %s failed: %s\n",
 395                                         gp_link->link_names[i],
 396                                         ads_errstr(status)));
 397                                 return;
 398                         }
 399                         dump_gpo(ads, mem_ctx, &gpo, lvl);
 400                 }
 401         }
 402 }
 403
 404 #endif /* HAVE_LDAP */
 405
 406 /****************************************************************
 407 ****************************************************************/
 408
 409 static bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
 410                                     uint32_t flags,
 411                                     struct GROUP_POLICY_OBJECT *gpo,
 412                                     struct GP_EXT **gp_ext)
 413 {
 414         ZERO_STRUCTP(*gp_ext);
 415
 416         if (flags & GPO_INFO_FLAG_MACHINE) {
 417
 418                 if (gpo->machine_extensions) {
 419
 420                         if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
 421                                               gp_ext)) {
 422                                 return false;
 423                         }
 424                 }
 425         } else {
 426
 427                 if (gpo->user_extensions) {
 428
 429                         if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
 430                                               gp_ext)) {
 431                                 return false;
 432                         }
 433                 }
 434         }
 435
 436         return true;
 437 }
 438
 439 /****************************************************************
 440 ****************************************************************/
 441
 442 ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads,
 443                              TALLOC_CTX *mem_ctx,
 444                              const NT_USER_TOKEN *token,
 445                              struct registry_key *root_key,
 446                              struct GROUP_POLICY_OBJECT *gpo,
 447                              const char *extension_guid_filter,
 448                              uint32_t flags)
 449 {
 450         struct GP_EXT *gp_ext = NULL;
 451         int i;
 452
 453         DEBUG(10,("gpo_process_a_gpo: processing gpo %s (%s)\n",
 454                 gpo->name, gpo->display_name));
 455         if (extension_guid_filter) {
 456                 DEBUGADD(10,("gpo_process_a_gpo: using filter %s (%s)\n",
 457                         extension_guid_filter,
 458                         cse_gpo_guid_string_to_name(extension_guid_filter)));
 459         }
 460
 461         if (!gpo_get_gp_ext_from_gpo(mem_ctx, flags, gpo, &gp_ext)) {
 462                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 463         }
 464
 465         if (!gp_ext || !gp_ext->num_exts) {
 466                 if (flags & GPO_INFO_FLAG_VERBOSE) {
 467                         DEBUG(0,("gpo_process_a_gpo: "
 468                                 "no policies in %s (%s) for this extension\n",
 469                                 gpo->name, gpo->display_name));
 470                 }
 471                 return ADS_SUCCESS;
 472         }
 473
 474         for (i=0; i<gp_ext->num_exts; i++) {
 475
 476                 NTSTATUS ntstatus;
 477
 478                 if (extension_guid_filter &&
 479                     !strequal(extension_guid_filter,
 480                               gp_ext->extensions_guid[i])) {
 481                         continue;
 482                 }
 483
 484                 ntstatus = gpext_process_extension(ads, mem_ctx,
 485                                                    flags, token, root_key, gpo,
 486                                                    gp_ext->extensions_guid[i],
 487                                                    gp_ext->snapins_guid[i]);
 488                 if (!NT_STATUS_IS_OK(ntstatus)) {
 489                         ADS_ERROR_NT(ntstatus);
 490                 }
 491         }
 492
 493         return ADS_SUCCESS;
 494 }
 495
 496 /****************************************************************
 497 ****************************************************************/
 498
 499 static ADS_STATUS gpo_process_gpo_list_by_ext(ADS_STRUCT *ads,
 500                                               TALLOC_CTX *mem_ctx,
 501                                               const NT_USER_TOKEN *token,
 502                                               struct registry_key *root_key,
 503                                               struct GROUP_POLICY_OBJECT *gpo_list,
 504                                               const char *extensions_guid,
 505                                               uint32_t flags)
 506 {
 507         ADS_STATUS status;
 508         struct GROUP_POLICY_OBJECT *gpo;
 509
 510         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 511
 512                 if (gpo->link_type == GP_LINK_LOCAL) {
 513                         continue;
 514                 }
 515
 516
 517                 /* FIXME: we need to pass down the *list* down to the
 518                  * extension, otherwise we cannot store the e.g. the *list* of
 519                  * logon-scripts correctly (for more then one GPO) */
 520
 521                 status = gpo_process_a_gpo(ads, mem_ctx, token, root_key,
 522                                            gpo, extensions_guid, flags);
 523
 524                 if (!ADS_ERR_OK(status)) {
 525                         DEBUG(0,("failed to process gpo by ext: %s\n",
 526                                 ads_errstr(status)));
 527                         return status;
 528                 }
 529         }
 530
 531         return ADS_SUCCESS;
 532 }
 533
 534 /****************************************************************
 535 ****************************************************************/
 536
 537 ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads,
 538                                 TALLOC_CTX *mem_ctx,
 539                                 const NT_USER_TOKEN *token,
 540                                 struct GROUP_POLICY_OBJECT *gpo_list,
 541                                 const char *extensions_guid_filter,
 542                                 uint32_t flags)
 543 {
 544         ADS_STATUS status = ADS_SUCCESS;
 545         struct gp_extension *gp_ext_list = NULL;
 546         struct gp_extension *gp_ext = NULL;
 547         struct registry_key *root_key = NULL;
 548         struct gp_registry_context *reg_ctx = NULL;
 549         WERROR werr;
 550
 551         status = ADS_ERROR_NT(init_gp_extensions(mem_ctx));
 552         if (!ADS_ERR_OK(status)) {
 553                 return status;
 554         }
 555
 556         gp_ext_list = get_gp_extension_list();
 557         if (!gp_ext_list) {
 558                 return ADS_ERROR_NT(NT_STATUS_DLL_INIT_FAILED);
 559         }
 560 #if 0 /* Needs to be replaced with new patchfile_preg calls */
 561         /* get the key here */
 562         if (flags & GPO_LIST_FLAG_MACHINE) {
 563                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
 564                                        get_system_token(),
 565                                        &reg_ctx);
 566         } else {
 567                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
 568                                        token,
 569                                        &reg_ctx);
 570         }
 571 #endif
 572         if (!W_ERROR_IS_OK(werr)) {
 573                 gp_free_reg_ctx(reg_ctx);
 574                 return ADS_ERROR_NT(werror_to_ntstatus(werr));
 575         }
 576
 577         root_key = reg_ctx->curr_key;
 578
 579         for (gp_ext = gp_ext_list; gp_ext; gp_ext = gp_ext->next) {
 580
 581                 const char *guid_str = NULL;
 582
 583                 guid_str = GUID_string(mem_ctx, gp_ext->guid);
 584                 if (!guid_str) {
 585                         status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 586                         goto done;
 587                 }
 588
 589                 if (extensions_guid_filter &&
 590                     (!strequal(guid_str, extensions_guid_filter)))  {
 591                         continue;
 592                 }
 593
 594                 DEBUG(0,("-------------------------------------------------\n"));
 595                 DEBUG(0,("gpo_process_gpo_list: processing ext: %s {%s}\n",
 596                         gp_ext->name, guid_str));
 597
 598
 599                 status = gpo_process_gpo_list_by_ext(ads, mem_ctx, token,
 600                                                      root_key, gpo_list,
 601                                                      guid_str, flags);
 602                 if (!ADS_ERR_OK(status)) {
 603                         goto done;
 604                 }
 605         }
 606
 607  done:
 608         gp_free_reg_ctx(reg_ctx);
 609         talloc_free(root_key);
 610         free_gp_extensions();
 611
 612         return status;
 613 }
 614
 615
 616 /****************************************************************
 617  check wether the version number in a GROUP_POLICY_OBJECT match those of the
 618  locally stored version. If not, fetch the required policy via CIFS
 619 ****************************************************************/
 620
 621 NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
 622                            TALLOC_CTX *mem_ctx,
 623                            const char *cache_path,
 624                            uint32_t flags,
 625                            struct GROUP_POLICY_OBJECT *gpo,
 626                            struct cli_state **cli_out)
 627 {
 628         NTSTATUS result;
 629         char *server = NULL;
 630         char *share = NULL;
 631         char *nt_path = NULL;
 632         char *unix_path = NULL;
 633         uint32_t sysvol_gpt_version = 0;
 634         char *display_name = NULL;
 635         struct cli_state *cli = NULL;
 636
 637         result = gpo_explode_filesyspath(mem_ctx, cache_path, gpo->file_sys_path,
 638                                          &server, &share, &nt_path, &unix_path);
 639
 640         if (!NT_STATUS_IS_OK(result)) {
 641                 goto out;
 642         }
 643
 644         result = gpo_get_sysvol_gpt_version(mem_ctx,
 645                                             unix_path,
 646                                             &sysvol_gpt_version,
 647                                             &display_name);
 648         if (!NT_STATUS_IS_OK(result) &&
 649             !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
 650                 DEBUG(10,("check_refresh_gpo: "
 651                         "failed to get local gpt version: %s\n",
 652                         nt_errstr(result)));
 653                 goto out;
 654         }
 655
 656         DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
 657                 gpo->version, sysvol_gpt_version));
 658
 659         /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
 660
 661         while (gpo->version > sysvol_gpt_version) {
 662
 663                 DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
 664
 665                 if (*cli_out == NULL) {
 666
 667                         result = cli_full_connection(&cli,
 668                                         global_myname(),
 669                                         ads_get_ldap_server_name(ads),
 670                                         /* server */
 671                                         NULL, 0,
 672                                         share, "A:",
 673                                         ads->auth.user_name, NULL,
 674                                         ads->auth.password,
 675                                         CLI_FULL_CONNECTION_USE_KERBEROS |
 676                                         CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS,
 677                                         Undefined, NULL);
 678                         if (!NT_STATUS_IS_OK(result)) {
 679                                 DEBUG(10,("check_refresh_gpo: "
 680                                         "failed to connect: %s\n",
 681                                         nt_errstr(result)));
 682                                 goto out;
 683                         }
 684
 685                         *cli_out = cli;
 686                 }
 687
 688                 result = gpo_fetch_files(mem_ctx, cache_path, *cli_out, gpo);
 689                 if (!NT_STATUS_IS_OK(result)) {
 690                         goto out;
 691                 }
 692
 693                 result = gpo_get_sysvol_gpt_version(mem_ctx,
 694                                                     unix_path,
 695                                                     &sysvol_gpt_version,
 696                                                     &display_name);
 697                 if (!NT_STATUS_IS_OK(result)) {
 698                         DEBUG(10,("check_refresh_gpo: "
 699                                 "failed to get local gpt version: %s\n",
 700                                 nt_errstr(result)));
 701                         goto out;
 702                 }
 703
 704                 if (gpo->version == sysvol_gpt_version) {
 705                         break;
 706                 }
 707         }
 708
 709         DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
 710         DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
 711                 sysvol_gpt_version,
 712                 GPO_VERSION_USER(sysvol_gpt_version),
 713                 GPO_VERSION_MACHINE(sysvol_gpt_version)));
 714         DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
 715                 gpo->version,
 716                 GPO_VERSION_USER(gpo->version),
 717                 GPO_VERSION_MACHINE(gpo->version)));
 718         DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link));
 719
 720         result = NT_STATUS_OK;
 721
 722  out:
 723         return result;
 724
 725 }
 726
 727 /****************************************************************
 728  check wether the version numbers in the gpo_list match the locally stored, if
 729  not, go and get each required GPO via CIFS
 730  ****************************************************************/
 731
 732 NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
 733                                 TALLOC_CTX *mem_ctx,
 734                                 uint32_t flags,
 735                                 struct GROUP_POLICY_OBJECT *gpo_list)
 736 {
 737         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 738         struct cli_state *cli = NULL;
 739         struct GROUP_POLICY_OBJECT *gpo;
 740
 741         if (!gpo_list) {
 742                 return NT_STATUS_INVALID_PARAMETER;
 743         }
 744
 745         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 746
 747                 result = check_refresh_gpo(ads, mem_ctx, flags, gpo, &cli);
 748                 if (!NT_STATUS_IS_OK(result)) {
 749                         goto out;
 750                 }
 751         }
 752
 753         result = NT_STATUS_OK;
 754
 755  out:
 756         if (cli) {
 757                 cli_shutdown(cli);
 758         }
 759
 760         return result;
 761 }
 762
 763 /****************************************************************
 764 ****************************************************************/
 765
 766 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
 767                            struct GROUP_POLICY_OBJECT *gpo,
 768                            char **unix_path)
 769 {
 770         char *server, *share, *nt_path;
 771         return gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path,
 772                                        &server, &share, &nt_path, unix_path);
 773 }
 774
 775 /****************************************************************
 776 ****************************************************************/
 777
 778 char *gpo_flag_str(uint32_t flags)
 779 {
 780         fstring str = "";
 781
 782         if (flags == 0) {
 783                 return NULL;
 784         }
 785
 786         if (flags & GPO_INFO_FLAG_SLOWLINK)
 787                 fstrcat(str, "GPO_INFO_FLAG_SLOWLINK ");
 788         if (flags & GPO_INFO_FLAG_VERBOSE)
 789                 fstrcat(str, "GPO_INFO_FLAG_VERBOSE ");
 790         if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
 791                 fstrcat(str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
 792         if (flags & GPO_INFO_FLAG_NOCHANGES)
 793                 fstrcat(str, "GPO_INFO_FLAG_NOCHANGES ");
 794         if (flags & GPO_INFO_FLAG_MACHINE)
 795                 fstrcat(str, "GPO_INFO_FLAG_MACHINE ");
 796         if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
 797                 fstrcat(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
 798         if (flags & GPO_INFO_FLAG_LINKTRANSITION)
 799                 fstrcat(str, "GPO_INFO_FLAG_LINKTRANSITION ");
 800         if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
 801                 fstrcat(str, "GPO_INFO_FLAG_FORCED_REFRESH ");
 802         if (flags & GPO_INFO_FLAG_BACKGROUND)
 803                 fstrcat(str, "GPO_INFO_FLAG_BACKGROUND ");
 804
 805         return strdup(str);
 806 }
 807
 808 /****************************************************************
 809 ****************************************************************/
 810
 811 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
 812                       uint32_t flags,
 813                       const char *filename,
 814                       const char *suffix,
 815                       const char **filename_out)
 816 {
 817         const char *tmp = NULL;
 818         struct stat sbuf;
 819         const char *path = NULL;
 820
 821         if (flags & GPO_LIST_FLAG_MACHINE) {
 822                 path = "Machine";
 823         } else {
 824                 path = "User";
 825         }
 826
 827         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 828                               path, suffix);
 829         NT_STATUS_HAVE_NO_MEMORY(tmp);
 830
 831         if (stat(tmp, &sbuf) == 0) {
 832                 *filename_out = tmp;
 833                 return NT_STATUS_OK;
 834         }
 835
 836         path = talloc_strdup_upper(mem_ctx, path);
 837         NT_STATUS_HAVE_NO_MEMORY(path);
 838
 839         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 840                               path, suffix);
 841         NT_STATUS_HAVE_NO_MEMORY(tmp);
 842
 843         if (stat(tmp, &sbuf) == 0) {
 844                 *filename_out = tmp;
 845                 return NT_STATUS_OK;
 846         }
 847
 848         return NT_STATUS_NO_SUCH_FILE;
 849 }
 850
 851 /****************************************************************
 852 ****************************************************************/
 853
 854 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
 855                                 TALLOC_CTX *mem_ctx,
 856                                 const char *dn,
 857                                 NT_USER_TOKEN **token)
 858 {
 859         NT_USER_TOKEN *ad_token = NULL;
 860         ADS_STATUS status;
 861         NTSTATUS ntstatus;
 862
 863 #ifndef HAVE_ADS
 864         return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
 865 #endif
 866         status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
 867         if (!ADS_ERR_OK(status)) {
 868                 return status;
 869         }
 870
 871         ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
 872                                   token);
 873         if (!NT_STATUS_IS_OK(ntstatus)) {
 874                 return ADS_ERROR_NT(ntstatus);
 875         }
 876
 877         return ADS_SUCCESS;
 878 }