libgpo/gpo_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2005-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/ndr_misc.h"
  22 #if _SAMBA_BUILD_ == 4
  23 #include "../libgpo/gpo.h"
  24 #include "source4/libgpo/ads_convenience.h"
  25 #endif
  26 #undef strdup
  27
  28 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
  29 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
  30
  31 /* should we store a parsed guid ? */
  32 struct gp_table {
  33         const char *name;
  34         const char *guid_string;
  35 };
  36
  37 #if 0 /* unused */
  38 static struct gp_table gpo_default_policy[] = {
  39         { DEFAULT_DOMAIN_POLICY,
  40                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
  41         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
  42                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
  43         { NULL, NULL }
  44 };
  45 #endif
  46
  47 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
  48
  49 static struct gp_table gpo_cse_extensions[] = {
  50         /* used to be "Administrative Templates Extension" */
  51         /* "Registry Settings"
  52         (http://support.microsoft.com/kb/216357/EN-US/) */
  53         { "Registry Settings",
  54                 GP_EXT_GUID_REGISTRY },
  55         { "Microsoft Disc Quota",
  56                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
  57         { "EFS recovery",
  58                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  59         { "Folder Redirection",
  60                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  61         { "IP Security",
  62                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
  63         { "Internet Explorer Branding",
  64                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
  65         { "QoS Packet Scheduler",
  66                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
  67         { "Scripts",
  68                 GP_EXT_GUID_SCRIPTS },
  69         { "Security",
  70                 GP_EXT_GUID_SECURITY },
  71         { "Software Installation",
  72                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  73         { "Wireless Group Policy",
  74                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
  75         { "Application Management",
  76                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  77         { "unknown",
  78                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
  79         { NULL, NULL }
  80 };
  81
  82 /* guess work */
  83 static struct gp_table gpo_cse_snapin_extensions[] = {
  84         { "Administrative Templates",
  85                 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
  86         { "Certificates",
  87                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
  88         { "EFS recovery policy processing",
  89                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  90         { "Folder Redirection policy processing",
  91                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  92         { "Folder Redirection",
  93                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
  94         { "Registry policy processing",
  95                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
  96         { "Remote Installation Services",
  97                 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
  98         { "Security Settings",
  99                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
 100         { "Security policy processing",
 101                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
 102         { "unknown",
 103                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
 104         { "unknown2",
 105                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
 106         { NULL, NULL }
 107 };
 108
 109 /****************************************************************
 110 ****************************************************************/
 111
 112 static const char *name_to_guid_string(const char *name,
 113                                        struct gp_table *table)
 114 {
 115         int i;
 116
 117         for (i = 0; table[i].name; i++) {
 118                 if (strequal(name, table[i].name)) {
 119                         return table[i].guid_string;
 120                 }
 121         }
 122
 123         return NULL;
 124 }
 125
 126 /****************************************************************
 127 ****************************************************************/
 128
 129 static const char *guid_string_to_name(const char *guid_string,
 130                                        struct gp_table *table)
 131 {
 132         int i;
 133
 134         for (i = 0; table[i].guid_string; i++) {
 135                 if (strequal(guid_string, table[i].guid_string)) {
 136                         return table[i].name;
 137                 }
 138         }
 139
 140         return NULL;
 141 }
 142
 143 /****************************************************************
 144 ****************************************************************/
 145
 146 static const char *snapin_guid_string_to_name(const char *guid_string,
 147                                               struct gp_table *table)
 148 {
 149         int i;
 150         for (i = 0; table[i].guid_string; i++) {
 151                 if (strequal(guid_string, table[i].guid_string)) {
 152                         return table[i].name;
 153                 }
 154         }
 155         return NULL;
 156 }
 157
 158 #if 0 /* unused */
 159 static const char *default_gpo_name_to_guid_string(const char *name)
 160 {
 161         return name_to_guid_string(name, gpo_default_policy);
 162 }
 163
 164 static const char *default_gpo_guid_string_to_name(const char *guid)
 165 {
 166         return guid_string_to_name(guid, gpo_default_policy);
 167 }
 168 #endif
 169
 170 /****************************************************************
 171 ****************************************************************/
 172
 173 const char *cse_gpo_guid_string_to_name(const char *guid)
 174 {
 175         return guid_string_to_name(guid, gpo_cse_extensions);
 176 }
 177
 178 /****************************************************************
 179 ****************************************************************/
 180
 181 const char *cse_gpo_name_to_guid_string(const char *name)
 182 {
 183         return name_to_guid_string(name, gpo_cse_extensions);
 184 }
 185
 186 /****************************************************************
 187 ****************************************************************/
 188
 189 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
 190 {
 191         return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
 192 }
 193
 194 /****************************************************************
 195 ****************************************************************/
 196
 197 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
 198 {
 199         int lvl = debuglevel;
 200         int i;
 201
 202         if (gp_ext == NULL) {
 203                 return;
 204         }
 205
 206         DEBUG(lvl,("\t---------------------\n\n"));
 207         DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
 208
 209         for (i=0; i< gp_ext->num_exts; i++) {
 210
 211                 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
 212                         gp_ext->extensions_guid[i]));
 213                 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
 214                         gp_ext->extensions[i]));
 215
 216                 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
 217                         gp_ext->snapins_guid[i]));
 218                 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
 219                         gp_ext->snapins[i]));
 220         }
 221 }
 222
 223 #ifdef HAVE_LDAP
 224
 225 /****************************************************************
 226 ****************************************************************/
 227
 228 void dump_gpo(ADS_STRUCT *ads,
 229               TALLOC_CTX *mem_ctx,
 230               struct GROUP_POLICY_OBJECT *gpo,
 231               int debuglevel)
 232 {
 233         int lvl = debuglevel;
 234
 235         if (gpo == NULL) {
 236                 return;
 237         }
 238
 239         DEBUG(lvl,("---------------------\n\n"));
 240
 241         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
 242         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
 243         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
 244         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
 245                 GPO_VERSION_USER(gpo->version),
 246                 GPO_VERSION_USER(gpo->version)));
 247         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
 248                 GPO_VERSION_MACHINE(gpo->version),
 249                  GPO_VERSION_MACHINE(gpo->version)));
 250         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
 251         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
 252
 253         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
 254         switch (gpo->options) {
 255                 case GPFLAGS_ALL_ENABLED:
 256                         DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
 257                         break;
 258                 case GPFLAGS_USER_SETTINGS_DISABLED:
 259                         DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
 260                         break;
 261                 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
 262                         DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
 263                         break;
 264                 case GPFLAGS_ALL_DISABLED:
 265                         DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
 266                         break;
 267                 default:
 268                         DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
 269                         break;
 270         }
 271
 272         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
 273         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
 274         switch (gpo->link_type) {
 275                 case GP_LINK_UNKOWN:
 276                         DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
 277                         break;
 278                 case GP_LINK_OU:
 279                         DEBUGADD(lvl,("GP_LINK_OU\n"));
 280                         break;
 281                 case GP_LINK_DOMAIN:
 282                         DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
 283                         break;
 284                 case GP_LINK_SITE:
 285                         DEBUGADD(lvl,("GP_LINK_SITE\n"));
 286                         break;
 287                 case GP_LINK_MACHINE:
 288                         DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
 289                         break;
 290                 default:
 291                         break;
 292         }
 293
 294         DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
 295
 296         if (gpo->machine_extensions) {
 297
 298                 struct GP_EXT *gp_ext = NULL;
 299
 300                 if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
 301                                       &gp_ext)) {
 302                         return;
 303                 }
 304                 dump_gp_ext(gp_ext, lvl);
 305         }
 306
 307         DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
 308
 309         if (gpo->user_extensions) {
 310
 311                 struct GP_EXT *gp_ext = NULL;
 312
 313                 if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
 314                                       &gp_ext)) {
 315                         return;
 316                 }
 317                 dump_gp_ext(gp_ext, lvl);
 318         }
 319
 320         DEBUGADD(lvl,("security descriptor:\n"));
 321
 322         NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
 323 }
 324
 325 /****************************************************************
 326 ****************************************************************/
 327
 328 void dump_gpo_list(ADS_STRUCT *ads,
 329                    TALLOC_CTX *mem_ctx,
 330                    struct GROUP_POLICY_OBJECT *gpo_list,
 331                    int debuglevel)
 332 {
 333         struct GROUP_POLICY_OBJECT *gpo = NULL;
 334
 335         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 336                 dump_gpo(ads, mem_ctx, gpo, debuglevel);
 337         }
 338 }
 339
 340 /****************************************************************
 341 ****************************************************************/
 342
 343 void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link)
 344 {
 345         ADS_STATUS status;
 346         int i;
 347         int lvl = 10;
 348
 349         if (gp_link == NULL) {
 350                 return;
 351         }
 352
 353         DEBUG(lvl,("---------------------\n\n"));
 354
 355         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
 356         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
 357         switch (gp_link->gp_opts) {
 358                 case GPOPTIONS_INHERIT:
 359                         DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
 360                         break;
 361                 case GPOPTIONS_BLOCK_INHERITANCE:
 362                         DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
 363                         break;
 364                 default:
 365                         break;
 366         }
 367
 368         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
 369
 370         for (i = 0; i < gp_link->num_links; i++) {
 371
 372                 DEBUGADD(lvl,("---------------------\n\n"));
 373
 374                 DEBUGADD(lvl,("link: #%d\n", i + 1));
 375                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
 376
 377                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
 378                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
 379                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
 380                 }
 381                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
 382                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
 383                 }
 384                 DEBUGADD(lvl,("\n"));
 385
 386                 if (ads != NULL && mem_ctx != NULL) {
 387
 388                         struct GROUP_POLICY_OBJECT gpo;
 389
 390                         status = ads_get_gpo(ads, mem_ctx,
 391                                              gp_link->link_names[i],
 392                                              NULL, NULL, &gpo);
 393                         if (!ADS_ERR_OK(status)) {
 394                                 DEBUG(lvl,("get gpo for %s failed: %s\n",
 395                                         gp_link->link_names[i],
 396                                         ads_errstr(status)));
 397                                 return;
 398                         }
 399                         dump_gpo(ads, mem_ctx, &gpo, lvl);
 400                 }
 401         }
 402 }
 403
 404 #endif /* HAVE_LDAP */
 405
 406 /****************************************************************
 407 ****************************************************************/
 408
 409 static bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
 410                                     uint32_t flags,
 411                                     struct GROUP_POLICY_OBJECT *gpo,
 412                                     struct GP_EXT **gp_ext)
 413 {
 414         ZERO_STRUCTP(*gp_ext);
 415
 416         if (flags & GPO_INFO_FLAG_MACHINE) {
 417
 418                 if (gpo->machine_extensions) {
 419
 420                         if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
 421                                               gp_ext)) {
 422                                 return false;
 423                         }
 424                 }
 425         } else {
 426
 427                 if (gpo->user_extensions) {
 428
 429                         if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
 430                                               gp_ext)) {
 431                                 return false;
 432                         }
 433                 }
 434         }
 435
 436         return true;
 437 }
 438
 439 /****************************************************************
 440 ****************************************************************/
 441
 442 ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads,
 443                              TALLOC_CTX *mem_ctx,
 444                              const struct nt_user_token *token,
 445                              struct registry_key *root_key,
 446                              struct GROUP_POLICY_OBJECT *gpo,
 447                              const char *extension_guid_filter,
 448                              uint32_t flags)
 449 {
 450         struct GP_EXT *gp_ext = NULL;
 451         int i;
 452
 453         DEBUG(10,("gpo_process_a_gpo: processing gpo %s (%s)\n",
 454                 gpo->name, gpo->display_name));
 455         if (extension_guid_filter) {
 456                 DEBUGADD(10,("gpo_process_a_gpo: using filter %s (%s)\n",
 457                         extension_guid_filter,
 458                         cse_gpo_guid_string_to_name(extension_guid_filter)));
 459         }
 460
 461         if (!gpo_get_gp_ext_from_gpo(mem_ctx, flags, gpo, &gp_ext)) {
 462                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 463         }
 464
 465         if (!gp_ext || !gp_ext->num_exts) {
 466                 if (flags & GPO_INFO_FLAG_VERBOSE) {
 467                         DEBUG(0,("gpo_process_a_gpo: "
 468                                 "no policies in %s (%s) for this extension\n",
 469                                 gpo->name, gpo->display_name));
 470                 }
 471                 return ADS_SUCCESS;
 472         }
 473
 474         for (i=0; i<gp_ext->num_exts; i++) {
 475
 476                 NTSTATUS ntstatus;
 477
 478                 if (extension_guid_filter &&
 479                     !strequal(extension_guid_filter,
 480                               gp_ext->extensions_guid[i])) {
 481                         continue;
 482                 }
 483
 484                 ntstatus = gpext_process_extension(ads, mem_ctx,
 485                                                    flags, token, root_key, gpo,
 486                                                    gp_ext->extensions_guid[i],
 487                                                    gp_ext->snapins_guid[i]);
 488                 if (!NT_STATUS_IS_OK(ntstatus)) {
 489                         ADS_ERROR_NT(ntstatus);
 490                 }
 491         }
 492
 493         return ADS_SUCCESS;
 494 }
 495
 496 /****************************************************************
 497 ****************************************************************/
 498
 499 static ADS_STATUS gpo_process_gpo_list_by_ext(ADS_STRUCT *ads,
 500                                               TALLOC_CTX *mem_ctx,
 501                                               const struct nt_user_token *token,
 502                                               struct registry_key *root_key,
 503                                               struct GROUP_POLICY_OBJECT *gpo_list,
 504                                               const char *extensions_guid,
 505                                               uint32_t flags)
 506 {
 507         ADS_STATUS status;
 508         struct GROUP_POLICY_OBJECT *gpo;
 509
 510         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 511
 512                 if (gpo->link_type == GP_LINK_LOCAL) {
 513                         continue;
 514                 }
 515
 516
 517                 /* FIXME: we need to pass down the *list* down to the
 518                  * extension, otherwise we cannot store the e.g. the *list* of
 519                  * logon-scripts correctly (for more then one GPO) */
 520
 521                 status = gpo_process_a_gpo(ads, mem_ctx, token, root_key,
 522                                            gpo, extensions_guid, flags);
 523
 524                 if (!ADS_ERR_OK(status)) {
 525                         DEBUG(0,("failed to process gpo by ext: %s\n",
 526                                 ads_errstr(status)));
 527                         return status;
 528                 }
 529         }
 530
 531         return ADS_SUCCESS;
 532 }
 533
 534 /****************************************************************
 535 ****************************************************************/
 536
 537 ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads,
 538                                 TALLOC_CTX *mem_ctx,
 539                                 const struct nt_user_token *token,
 540                                 struct GROUP_POLICY_OBJECT *gpo_list,
 541                                 const char *extensions_guid_filter,
 542                                 uint32_t flags)
 543 {
 544         ADS_STATUS status = ADS_SUCCESS;
 545         struct gp_extension *gp_ext_list = NULL;
 546         struct gp_extension *gp_ext = NULL;
 547         struct registry_key *root_key = NULL;
 548         struct gp_registry_context *reg_ctx = NULL;
 549         WERROR werr;
 550
 551         status = ADS_ERROR_NT(init_gp_extensions(mem_ctx));
 552         if (!ADS_ERR_OK(status)) {
 553                 return status;
 554         }
 555
 556         gp_ext_list = get_gp_extension_list();
 557         if (!gp_ext_list) {
 558                 return ADS_ERROR_NT(NT_STATUS_DLL_INIT_FAILED);
 559         }
 560
 561         /* get the key here */
 562         if (flags & GPO_LIST_FLAG_MACHINE) {
 563                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
 564                                        get_system_token(),
 565                                        &reg_ctx);
 566         } else {
 567                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
 568                                        token,
 569                                        &reg_ctx);
 570         }
 571         if (!W_ERROR_IS_OK(werr)) {
 572                 gp_free_reg_ctx(reg_ctx);
 573                 return ADS_ERROR_NT(werror_to_ntstatus(werr));
 574         }
 575
 576         root_key = reg_ctx->curr_key;
 577
 578         for (gp_ext = gp_ext_list; gp_ext; gp_ext = gp_ext->next) {
 579
 580                 const char *guid_str = NULL;
 581
 582                 guid_str = GUID_string(mem_ctx, gp_ext->guid);
 583                 if (!guid_str) {
 584                         status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 585                         goto done;
 586                 }
 587
 588                 if (extensions_guid_filter &&
 589                     (!strequal(guid_str, extensions_guid_filter)))  {
 590                         continue;
 591                 }
 592
 593                 DEBUG(0,("-------------------------------------------------\n"));
 594                 DEBUG(0,("gpo_process_gpo_list: processing ext: %s {%s}\n",
 595                         gp_ext->name, guid_str));
 596
 597
 598                 status = gpo_process_gpo_list_by_ext(ads, mem_ctx, token,
 599                                                      root_key, gpo_list,
 600                                                      guid_str, flags);
 601                 if (!ADS_ERR_OK(status)) {
 602                         goto done;
 603                 }
 604         }
 605
 606  done:
 607         gp_free_reg_ctx(reg_ctx);
 608         talloc_free(root_key);
 609         free_gp_extensions();
 610
 611         return status;
 612 }
 613
 614
 615 /****************************************************************
 616  check wether the version number in a GROUP_POLICY_OBJECT match those of the
 617  locally stored version. If not, fetch the required policy via CIFS
 618 ****************************************************************/
 619
 620 NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
 621                            TALLOC_CTX *mem_ctx,
 622                            uint32_t flags,
 623                            struct GROUP_POLICY_OBJECT *gpo,
 624                            struct cli_state **cli_out)
 625 {
 626         NTSTATUS result;
 627         char *server = NULL;
 628         char *share = NULL;
 629         char *nt_path = NULL;
 630         char *unix_path = NULL;
 631         uint32_t sysvol_gpt_version = 0;
 632         char *display_name = NULL;
 633         struct cli_state *cli = NULL;
 634
 635         result = gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path,
 636                                          &server, &share, &nt_path, &unix_path);
 637
 638         if (!NT_STATUS_IS_OK(result)) {
 639                 goto out;
 640         }
 641
 642         result = gpo_get_sysvol_gpt_version(mem_ctx,
 643                                             unix_path,
 644                                             &sysvol_gpt_version,
 645                                             &display_name);
 646         if (!NT_STATUS_IS_OK(result) &&
 647             !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
 648                 DEBUG(10,("check_refresh_gpo: "
 649                         "failed to get local gpt version: %s\n",
 650                         nt_errstr(result)));
 651                 goto out;
 652         }
 653
 654         DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
 655                 gpo->version, sysvol_gpt_version));
 656
 657         /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
 658
 659         while (gpo->version > sysvol_gpt_version) {
 660
 661                 DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
 662
 663                 if (*cli_out == NULL) {
 664
 665                         result = cli_full_connection(&cli,
 666                                         global_myname(),
 667                                         ads_get_ldap_server_name(ads),
 668                                         /* server */
 669                                         NULL, 0,
 670                                         share, "A:",
 671                                         ads->auth.user_name, NULL,
 672                                         ads->auth.password,
 673                                         CLI_FULL_CONNECTION_USE_KERBEROS |
 674                                         CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS,
 675                                         Undefined, NULL);
 676                         if (!NT_STATUS_IS_OK(result)) {
 677                                 DEBUG(10,("check_refresh_gpo: "
 678                                         "failed to connect: %s\n",
 679                                         nt_errstr(result)));
 680                                 goto out;
 681                         }
 682
 683                         *cli_out = cli;
 684                 }
 685
 686                 result = gpo_fetch_files(mem_ctx, *cli_out, gpo);
 687                 if (!NT_STATUS_IS_OK(result)) {
 688                         goto out;
 689                 }
 690
 691                 result = gpo_get_sysvol_gpt_version(mem_ctx,
 692                                                     unix_path,
 693                                                     &sysvol_gpt_version,
 694                                                     &display_name);
 695                 if (!NT_STATUS_IS_OK(result)) {
 696                         DEBUG(10,("check_refresh_gpo: "
 697                                 "failed to get local gpt version: %s\n",
 698                                 nt_errstr(result)));
 699                         goto out;
 700                 }
 701
 702                 if (gpo->version == sysvol_gpt_version) {
 703                         break;
 704                 }
 705         }
 706
 707         DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
 708         DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
 709                 sysvol_gpt_version,
 710                 GPO_VERSION_USER(sysvol_gpt_version),
 711                 GPO_VERSION_MACHINE(sysvol_gpt_version)));
 712         DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
 713                 gpo->version,
 714                 GPO_VERSION_USER(gpo->version),
 715                 GPO_VERSION_MACHINE(gpo->version)));
 716         DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link));
 717
 718         result = NT_STATUS_OK;
 719
 720  out:
 721         return result;
 722
 723 }
 724
 725 /****************************************************************
 726  check wether the version numbers in the gpo_list match the locally stored, if
 727  not, go and get each required GPO via CIFS
 728  ****************************************************************/
 729
 730 NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
 731                                 TALLOC_CTX *mem_ctx,
 732                                 uint32_t flags,
 733                                 struct GROUP_POLICY_OBJECT *gpo_list)
 734 {
 735         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 736         struct cli_state *cli = NULL;
 737         struct GROUP_POLICY_OBJECT *gpo;
 738
 739         if (!gpo_list) {
 740                 return NT_STATUS_INVALID_PARAMETER;
 741         }
 742
 743         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 744
 745                 result = check_refresh_gpo(ads, mem_ctx, flags, gpo, &cli);
 746                 if (!NT_STATUS_IS_OK(result)) {
 747                         goto out;
 748                 }
 749         }
 750
 751         result = NT_STATUS_OK;
 752
 753  out:
 754         if (cli) {
 755                 cli_shutdown(cli);
 756         }
 757
 758         return result;
 759 }
 760
 761 /****************************************************************
 762 ****************************************************************/
 763
 764 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
 765                            struct GROUP_POLICY_OBJECT *gpo,
 766                            char **unix_path)
 767 {
 768         char *server, *share, *nt_path;
 769         return gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path,
 770                                        &server, &share, &nt_path, unix_path);
 771 }
 772
 773 /****************************************************************
 774 ****************************************************************/
 775
 776 char *gpo_flag_str(uint32_t flags)
 777 {
 778         fstring str = "";
 779
 780         if (flags == 0) {
 781                 return NULL;
 782         }
 783
 784         if (flags & GPO_INFO_FLAG_SLOWLINK)
 785                 fstrcat(str, "GPO_INFO_FLAG_SLOWLINK ");
 786         if (flags & GPO_INFO_FLAG_VERBOSE)
 787                 fstrcat(str, "GPO_INFO_FLAG_VERBOSE ");
 788         if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
 789                 fstrcat(str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
 790         if (flags & GPO_INFO_FLAG_NOCHANGES)
 791                 fstrcat(str, "GPO_INFO_FLAG_NOCHANGES ");
 792         if (flags & GPO_INFO_FLAG_MACHINE)
 793                 fstrcat(str, "GPO_INFO_FLAG_MACHINE ");
 794         if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
 795                 fstrcat(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
 796         if (flags & GPO_INFO_FLAG_LINKTRANSITION)
 797                 fstrcat(str, "GPO_INFO_FLAG_LINKTRANSITION ");
 798         if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
 799                 fstrcat(str, "GPO_INFO_FLAG_FORCED_REFRESH ");
 800         if (flags & GPO_INFO_FLAG_BACKGROUND)
 801                 fstrcat(str, "GPO_INFO_FLAG_BACKGROUND ");
 802
 803         return strdup(str);
 804 }
 805
 806 /****************************************************************
 807 ****************************************************************/
 808
 809 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
 810                       uint32_t flags,
 811                       const char *filename,
 812                       const char *suffix,
 813                       const char **filename_out)
 814 {
 815         const char *tmp = NULL;
 816         struct stat sbuf;
 817         const char *path = NULL;
 818
 819         if (flags & GPO_LIST_FLAG_MACHINE) {
 820                 path = "Machine";
 821         } else {
 822                 path = "User";
 823         }
 824
 825         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 826                               path, suffix);
 827         NT_STATUS_HAVE_NO_MEMORY(tmp);
 828
 829         if (stat(tmp, &sbuf) == 0) {
 830                 *filename_out = tmp;
 831                 return NT_STATUS_OK;
 832         }
 833
 834         path = talloc_strdup_upper(mem_ctx, path);
 835         NT_STATUS_HAVE_NO_MEMORY(path);
 836
 837         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 838                               path, suffix);
 839         NT_STATUS_HAVE_NO_MEMORY(tmp);
 840
 841         if (stat(tmp, &sbuf) == 0) {
 842                 *filename_out = tmp;
 843                 return NT_STATUS_OK;
 844         }
 845
 846         return NT_STATUS_NO_SUCH_FILE;
 847 }
 848
 849 /****************************************************************
 850 ****************************************************************/
 851
 852 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
 853                                 TALLOC_CTX *mem_ctx,
 854                                 const char *dn,
 855                                 struct nt_user_token **token)
 856 {
 857         struct nt_user_token *ad_token = NULL;
 858         ADS_STATUS status;
 859         NTSTATUS ntstatus;
 860
 861 #ifndef HAVE_ADS
 862         return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
 863 #endif
 864         status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
 865         if (!ADS_ERR_OK(status)) {
 866                 return status;
 867         }
 868
 869         ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
 870                                   token);
 871         if (!NT_STATUS_IS_OK(ntstatus)) {
 872                 return ADS_ERROR_NT(ntstatus);
 873         }
 874
 875         return ADS_SUCCESS;
 876 }