s3-libgpo: move group policy protos to where they belong.
[kai/samba.git] / libgpo / gpo_util.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2005-2008
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define TALLOC_DEPRECATED 1
20 #include "includes.h"
21 #include "librpc/gen_ndr/ndr_misc.h"
22 #include "../libgpo/gpo.h"
23 #if _SAMBA_BUILD_ == 4
24 #include "system/filesys.h"
25 #include "auth/auth.h"
26 #include "../lib/talloc/talloc.h"
27 #include "source4/libgpo/ads_convenience.h"
28 #endif
29 #undef strdup
30
31 #if 0
32 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
33 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
34 #endif
35
36 /* should we store a parsed guid ? */
37 struct gp_table {
38         const char *name;
39         const char *guid_string;
40 };
41
42 #if 0 /* unused */
43 static struct gp_table gpo_default_policy[] = {
44         { DEFAULT_DOMAIN_POLICY,
45                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
46         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
47                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
48         { NULL, NULL }
49 };
50 #endif
51
52 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
53
54 static struct gp_table gpo_cse_extensions[] = {
55         /* used to be "Administrative Templates Extension" */
56         /* "Registry Settings"
57         (http://support.microsoft.com/kb/216357/EN-US/) */
58         { "Registry Settings",
59                 GP_EXT_GUID_REGISTRY },
60         { "Microsoft Disc Quota",
61                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
62         { "EFS recovery",
63                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
64         { "Folder Redirection",
65                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
66         { "IP Security",
67                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
68         { "Internet Explorer Branding",
69                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
70         { "QoS Packet Scheduler",
71                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
72         { "Scripts",
73                 GP_EXT_GUID_SCRIPTS },
74         { "Security",
75                 GP_EXT_GUID_SECURITY },
76         { "Software Installation",
77                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
78         { "Wireless Group Policy",
79                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
80         { "Application Management",
81                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
82         { "unknown",
83                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
84         { NULL, NULL }
85 };
86
87 /* guess work */
88 static struct gp_table gpo_cse_snapin_extensions[] = {
89         { "Administrative Templates",
90                 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
91         { "Certificates",
92                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
93         { "EFS recovery policy processing",
94                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
95         { "Folder Redirection policy processing",
96                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
97         { "Folder Redirection",
98                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
99         { "Registry policy processing",
100                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
101         { "Remote Installation Services",
102                 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
103         { "Security Settings",
104                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
105         { "Security policy processing",
106                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
107         { "unknown",
108                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
109         { "unknown2",
110                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
111         { NULL, NULL }
112 };
113
114 /****************************************************************
115 ****************************************************************/
116
117 static const char *name_to_guid_string(const char *name,
118                                        struct gp_table *table)
119 {
120         int i;
121
122         for (i = 0; table[i].name; i++) {
123                 if (strequal(name, table[i].name)) {
124                         return table[i].guid_string;
125                 }
126         }
127
128         return NULL;
129 }
130
131 /****************************************************************
132 ****************************************************************/
133
134 static const char *guid_string_to_name(const char *guid_string,
135                                        struct gp_table *table)
136 {
137         int i;
138
139         for (i = 0; table[i].guid_string; i++) {
140                 if (strequal(guid_string, table[i].guid_string)) {
141                         return table[i].name;
142                 }
143         }
144
145         return NULL;
146 }
147
148 /****************************************************************
149 ****************************************************************/
150
151 static const char *snapin_guid_string_to_name(const char *guid_string,
152                                               struct gp_table *table)
153 {
154         int i;
155         for (i = 0; table[i].guid_string; i++) {
156                 if (strequal(guid_string, table[i].guid_string)) {
157                         return table[i].name;
158                 }
159         }
160         return NULL;
161 }
162
163 #if 0 /* unused */
164 static const char *default_gpo_name_to_guid_string(const char *name)
165 {
166         return name_to_guid_string(name, gpo_default_policy);
167 }
168
169 static const char *default_gpo_guid_string_to_name(const char *guid)
170 {
171         return guid_string_to_name(guid, gpo_default_policy);
172 }
173 #endif
174
175 /****************************************************************
176 ****************************************************************/
177
178 const char *cse_gpo_guid_string_to_name(const char *guid)
179 {
180         return guid_string_to_name(guid, gpo_cse_extensions);
181 }
182
183 /****************************************************************
184 ****************************************************************/
185
186 const char *cse_gpo_name_to_guid_string(const char *name)
187 {
188         return name_to_guid_string(name, gpo_cse_extensions);
189 }
190
191 /****************************************************************
192 ****************************************************************/
193
194 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
195 {
196         return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
197 }
198
199 /****************************************************************
200 ****************************************************************/
201
202 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
203 {
204         int lvl = debuglevel;
205         int i;
206
207         if (gp_ext == NULL) {
208                 return;
209         }
210
211         DEBUG(lvl,("\t---------------------\n\n"));
212         DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
213
214         for (i=0; i< gp_ext->num_exts; i++) {
215
216                 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
217                         gp_ext->extensions_guid[i]));
218                 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
219                         gp_ext->extensions[i]));
220
221                 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
222                         gp_ext->snapins_guid[i]));
223                 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
224                         gp_ext->snapins[i]));
225         }
226 }
227
228 #ifdef HAVE_LDAP
229
230 /****************************************************************
231 ****************************************************************/
232
233 void dump_gpo(ADS_STRUCT *ads,
234               TALLOC_CTX *mem_ctx,
235               struct GROUP_POLICY_OBJECT *gpo,
236               int debuglevel)
237 {
238         int lvl = debuglevel;
239
240         if (gpo == NULL) {
241                 return;
242         }
243
244         DEBUG(lvl,("---------------------\n\n"));
245
246         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
247         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
248         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
249         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
250                 GPO_VERSION_USER(gpo->version),
251                 GPO_VERSION_USER(gpo->version)));
252         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
253                 GPO_VERSION_MACHINE(gpo->version),
254                  GPO_VERSION_MACHINE(gpo->version)));
255         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
256         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
257
258         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
259         switch (gpo->options) {
260                 case GPFLAGS_ALL_ENABLED:
261                         DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
262                         break;
263                 case GPFLAGS_USER_SETTINGS_DISABLED:
264                         DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
265                         break;
266                 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
267                         DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
268                         break;
269                 case GPFLAGS_ALL_DISABLED:
270                         DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
271                         break;
272                 default:
273                         DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
274                         break;
275         }
276
277         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
278         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
279         switch (gpo->link_type) {
280                 case GP_LINK_UNKOWN:
281                         DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
282                         break;
283                 case GP_LINK_OU:
284                         DEBUGADD(lvl,("GP_LINK_OU\n"));
285                         break;
286                 case GP_LINK_DOMAIN:
287                         DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
288                         break;
289                 case GP_LINK_SITE:
290                         DEBUGADD(lvl,("GP_LINK_SITE\n"));
291                         break;
292                 case GP_LINK_MACHINE:
293                         DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
294                         break;
295                 default:
296                         break;
297         }
298
299         DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
300
301         if (gpo->machine_extensions) {
302
303                 struct GP_EXT *gp_ext = NULL;
304
305                 if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
306                                       &gp_ext)) {
307                         return;
308                 }
309                 dump_gp_ext(gp_ext, lvl);
310         }
311
312         DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
313
314         if (gpo->user_extensions) {
315
316                 struct GP_EXT *gp_ext = NULL;
317
318                 if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
319                                       &gp_ext)) {
320                         return;
321                 }
322                 dump_gp_ext(gp_ext, lvl);
323         }
324         if (gpo->security_descriptor) {
325                 DEBUGADD(lvl,("security descriptor:\n"));
326
327                 NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
328         }
329 }
330
331 /****************************************************************
332 ****************************************************************/
333
334 void dump_gpo_list(ADS_STRUCT *ads,
335                    TALLOC_CTX *mem_ctx,
336                    struct GROUP_POLICY_OBJECT *gpo_list,
337                    int debuglevel)
338 {
339         struct GROUP_POLICY_OBJECT *gpo = NULL;
340
341         for (gpo = gpo_list; gpo; gpo = gpo->next) {
342                 dump_gpo(ads, mem_ctx, gpo, debuglevel);
343         }
344 }
345
346 /****************************************************************
347 ****************************************************************/
348
349 void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link)
350 {
351         ADS_STATUS status;
352         int i;
353         int lvl = 10;
354
355         if (gp_link == NULL) {
356                 return;
357         }
358
359         DEBUG(lvl,("---------------------\n\n"));
360
361         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
362         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
363         switch (gp_link->gp_opts) {
364                 case GPOPTIONS_INHERIT:
365                         DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
366                         break;
367                 case GPOPTIONS_BLOCK_INHERITANCE:
368                         DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
369                         break;
370                 default:
371                         break;
372         }
373
374         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
375
376         for (i = 0; i < gp_link->num_links; i++) {
377
378                 DEBUGADD(lvl,("---------------------\n\n"));
379
380                 DEBUGADD(lvl,("link: #%d\n", i + 1));
381                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
382
383                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
384                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
385                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
386                 }
387                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
388                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
389                 }
390                 DEBUGADD(lvl,("\n"));
391
392                 if (ads != NULL && mem_ctx != NULL) {
393
394                         struct GROUP_POLICY_OBJECT gpo;
395
396                         status = ads_get_gpo(ads, mem_ctx,
397                                              gp_link->link_names[i],
398                                              NULL, NULL, &gpo);
399                         if (!ADS_ERR_OK(status)) {
400                                 DEBUG(lvl,("get gpo for %s failed: %s\n",
401                                         gp_link->link_names[i],
402                                         ads_errstr(status)));
403                                 return;
404                         }
405                         dump_gpo(ads, mem_ctx, &gpo, lvl);
406                 }
407         }
408 }
409
410 #endif /* HAVE_LDAP */
411
412 /****************************************************************
413 ****************************************************************/
414
415 static bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
416                                     uint32_t flags,
417                                     struct GROUP_POLICY_OBJECT *gpo,
418                                     struct GP_EXT **gp_ext)
419 {
420         ZERO_STRUCTP(*gp_ext);
421
422         if (flags & GPO_INFO_FLAG_MACHINE) {
423
424                 if (gpo->machine_extensions) {
425
426                         if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
427                                               gp_ext)) {
428                                 return false;
429                         }
430                 }
431         } else {
432
433                 if (gpo->user_extensions) {
434
435                         if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
436                                               gp_ext)) {
437                                 return false;
438                         }
439                 }
440         }
441
442         return true;
443 }
444
445 /****************************************************************
446 ****************************************************************/
447
448 ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads,
449                              TALLOC_CTX *mem_ctx,
450                              const NT_USER_TOKEN *token,
451                              struct registry_key *root_key,
452                              struct GROUP_POLICY_OBJECT *gpo,
453                              const char *extension_guid_filter,
454                              uint32_t flags)
455 {
456         struct GP_EXT *gp_ext = NULL;
457         int i;
458
459         DEBUG(10,("gpo_process_a_gpo: processing gpo %s (%s)\n",
460                 gpo->name, gpo->display_name));
461         if (extension_guid_filter) {
462                 DEBUGADD(10,("gpo_process_a_gpo: using filter %s (%s)\n",
463                         extension_guid_filter,
464                         cse_gpo_guid_string_to_name(extension_guid_filter)));
465         }
466
467         if (!gpo_get_gp_ext_from_gpo(mem_ctx, flags, gpo, &gp_ext)) {
468                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
469         }
470
471         if (!gp_ext || !gp_ext->num_exts) {
472                 if (flags & GPO_INFO_FLAG_VERBOSE) {
473                         DEBUG(0,("gpo_process_a_gpo: "
474                                 "no policies in %s (%s) for this extension\n",
475                                 gpo->name, gpo->display_name));
476                 }
477                 return ADS_SUCCESS;
478         }
479
480         for (i=0; i<gp_ext->num_exts; i++) {
481
482                 NTSTATUS ntstatus;
483
484                 if (extension_guid_filter &&
485                     !strequal(extension_guid_filter,
486                               gp_ext->extensions_guid[i])) {
487                         continue;
488                 }
489
490                 ntstatus = gpext_process_extension(ads, mem_ctx,
491                                                    flags, token, root_key, gpo,
492                                                    gp_ext->extensions_guid[i],
493                                                    gp_ext->snapins_guid[i]);
494                 if (!NT_STATUS_IS_OK(ntstatus)) {
495                         ADS_ERROR_NT(ntstatus);
496                 }
497         }
498
499         return ADS_SUCCESS;
500 }
501
502 /****************************************************************
503 ****************************************************************/
504
505 static ADS_STATUS gpo_process_gpo_list_by_ext(ADS_STRUCT *ads,
506                                               TALLOC_CTX *mem_ctx,
507                                               const NT_USER_TOKEN *token,
508                                               struct registry_key *root_key,
509                                               struct GROUP_POLICY_OBJECT *gpo_list,
510                                               const char *extensions_guid,
511                                               uint32_t flags)
512 {
513         ADS_STATUS status;
514         struct GROUP_POLICY_OBJECT *gpo;
515
516         for (gpo = gpo_list; gpo; gpo = gpo->next) {
517
518                 if (gpo->link_type == GP_LINK_LOCAL) {
519                         continue;
520                 }
521
522
523                 /* FIXME: we need to pass down the *list* down to the
524                  * extension, otherwise we cannot store the e.g. the *list* of
525                  * logon-scripts correctly (for more then one GPO) */
526
527                 status = gpo_process_a_gpo(ads, mem_ctx, token, root_key,
528                                            gpo, extensions_guid, flags);
529
530                 if (!ADS_ERR_OK(status)) {
531                         DEBUG(0,("failed to process gpo by ext: %s\n",
532                                 ads_errstr(status)));
533                         return status;
534                 }
535         }
536
537         return ADS_SUCCESS;
538 }
539
540 /****************************************************************
541 ****************************************************************/
542
543 ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads,
544                                 TALLOC_CTX *mem_ctx,
545                                 const NT_USER_TOKEN *token,
546                                 struct GROUP_POLICY_OBJECT *gpo_list,
547                                 const char *extensions_guid_filter,
548                                 uint32_t flags)
549 {
550         ADS_STATUS status = ADS_SUCCESS;
551         struct gp_extension *gp_ext_list = NULL;
552         struct gp_extension *gp_ext = NULL;
553         struct registry_key *root_key = NULL;
554         struct gp_registry_context *reg_ctx = NULL;
555 #if 0
556         WERROR werr;
557 #endif
558         status = ADS_ERROR_NT(init_gp_extensions(mem_ctx));
559         if (!ADS_ERR_OK(status)) {
560                 return status;
561         }
562
563         gp_ext_list = get_gp_extension_list();
564         if (!gp_ext_list) {
565                 return ADS_ERROR_NT(NT_STATUS_DLL_INIT_FAILED);
566         }
567 /* FIXME Needs to be replaced with new patchfile_preg calls */
568 #if 0
569         /* get the key here */
570         if (flags & GPO_LIST_FLAG_MACHINE) {
571                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
572                                        get_system_token(),
573                                        &reg_ctx);
574         } else {
575                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
576                                        token,
577                                        &reg_ctx);
578         }
579         if (!W_ERROR_IS_OK(werr)) {
580                 talloc_free(reg_ctx);
581                 return ADS_ERROR_NT(werror_to_ntstatus(werr));
582         }
583 #endif
584
585         root_key = reg_ctx->curr_key;
586
587         for (gp_ext = gp_ext_list; gp_ext; gp_ext = gp_ext->next) {
588
589                 const char *guid_str = NULL;
590
591                 guid_str = GUID_string(mem_ctx, gp_ext->guid);
592                 if (!guid_str) {
593                         status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
594                         goto done;
595                 }
596
597                 if (extensions_guid_filter &&
598                     (!strequal(guid_str, extensions_guid_filter)))  {
599                         continue;
600                 }
601
602                 DEBUG(0,("-------------------------------------------------\n"));
603                 DEBUG(0,("gpo_process_gpo_list: processing ext: %s {%s}\n",
604                         gp_ext->name, guid_str));
605
606
607                 status = gpo_process_gpo_list_by_ext(ads, mem_ctx, token,
608                                                      root_key, gpo_list,
609                                                      guid_str, flags);
610                 if (!ADS_ERR_OK(status)) {
611                         goto done;
612                 }
613         }
614
615  done:
616         talloc_free(reg_ctx);
617         talloc_free(root_key);
618         free_gp_extensions();
619
620         return status;
621 }
622
623
624 /****************************************************************
625  check wether the version number in a GROUP_POLICY_OBJECT match those of the
626  locally stored version. If not, fetch the required policy via CIFS
627 ****************************************************************/
628
629 NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
630                            TALLOC_CTX *mem_ctx,
631                            const char *cache_dir,
632                            struct loadparm_context *lp_ctx,
633                            uint32_t flags,
634                            struct GROUP_POLICY_OBJECT *gpo)
635 {
636         NTSTATUS result;
637         char *server = NULL;
638         char *share = NULL;
639         char *nt_path = NULL;
640         char *unix_path = NULL;
641         uint32_t sysvol_gpt_version = 0;
642         char *display_name = NULL;
643
644         result = gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
645                                          &server, &share, &nt_path, &unix_path);
646
647         if (!NT_STATUS_IS_OK(result)) {
648                 goto out;
649         }
650
651         result = gpo_get_sysvol_gpt_version(mem_ctx,
652                                             unix_path,
653                                             &sysvol_gpt_version,
654                                             &display_name);
655         if (!NT_STATUS_IS_OK(result) &&
656             !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
657                 DEBUG(10,("check_refresh_gpo: "
658                         "failed to get local gpt version: %s\n",
659                         nt_errstr(result)));
660                 goto out;
661         }
662
663         DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
664                 gpo->version, sysvol_gpt_version));
665
666         /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
667
668         while (gpo->version > sysvol_gpt_version) {
669
670                 DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
671
672                 result = gpo_fetch_files(mem_ctx, ads, lp_ctx, cache_dir, gpo);
673                 if (!NT_STATUS_IS_OK(result)) {
674                         goto out;
675                 }
676
677                 result = gpo_get_sysvol_gpt_version(mem_ctx,
678                                                     unix_path,
679                                                     &sysvol_gpt_version,
680                                                     &display_name);
681                 if (!NT_STATUS_IS_OK(result)) {
682                         DEBUG(10,("check_refresh_gpo: "
683                                 "failed to get local gpt version: %s\n",
684                                 nt_errstr(result)));
685                         goto out;
686                 }
687
688                 if (gpo->version == sysvol_gpt_version) {
689                         break;
690                 }
691         }
692
693         DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
694         DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
695                 sysvol_gpt_version,
696                 GPO_VERSION_USER(sysvol_gpt_version),
697                 GPO_VERSION_MACHINE(sysvol_gpt_version)));
698         DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
699                 gpo->version,
700                 GPO_VERSION_USER(gpo->version),
701                 GPO_VERSION_MACHINE(gpo->version)));
702         DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link));
703
704         result = NT_STATUS_OK;
705
706  out:
707         return result;
708
709 }
710
711 /****************************************************************
712  check wether the version numbers in the gpo_list match the locally stored, if
713  not, go and get each required GPO via CIFS
714  ****************************************************************/
715
716 NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
717                                 TALLOC_CTX *mem_ctx,
718                                 const char *cache_dir,
719                                 struct loadparm_context *lp_ctx,
720                                 uint32_t flags,
721                                 struct GROUP_POLICY_OBJECT *gpo_list)
722 {
723         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
724         struct GROUP_POLICY_OBJECT *gpo;
725
726         if (!gpo_list) {
727                 return NT_STATUS_INVALID_PARAMETER;
728         }
729
730         for (gpo = gpo_list; gpo; gpo = gpo->next) {
731
732                 result = check_refresh_gpo(ads, mem_ctx, cache_dir, lp_ctx, flags, gpo);
733                 if (!NT_STATUS_IS_OK(result)) {
734                         goto out;
735                 }
736         }
737
738         result = NT_STATUS_OK;
739
740  out:
741         /* FIXME close cli connection */
742
743         return result;
744 }
745
746 /****************************************************************
747 ****************************************************************/
748
749 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
750                            const char *cache_dir,
751                            struct GROUP_POLICY_OBJECT *gpo,
752                            char **unix_path)
753 {
754         char *server, *share, *nt_path;
755         return gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
756                                        &server, &share, &nt_path, unix_path);
757 }
758
759 /****************************************************************
760 ****************************************************************/
761
762 char *gpo_flag_str(TALLOC_CTX *ctx, uint32_t flags)
763 {
764         char *str = NULL;
765
766         if (flags == 0) {
767                 return NULL;
768         }
769
770         if (flags & GPO_INFO_FLAG_SLOWLINK)
771                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_SLOWLINK ");
772         if (flags & GPO_INFO_FLAG_VERBOSE)
773                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_VERBOSE ");
774         if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
775                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
776         if (flags & GPO_INFO_FLAG_NOCHANGES)
777                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_NOCHANGES ");
778         if (flags & GPO_INFO_FLAG_MACHINE)
779                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_MACHINE ");
780         if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
781                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
782         if (flags & GPO_INFO_FLAG_LINKTRANSITION)
783                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_LINKTRANSITION ");
784         if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
785                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_FORCED_REFRESH ");
786         if (flags & GPO_INFO_FLAG_BACKGROUND)
787                 str = talloc_append_string(ctx, str, "GPO_INFO_FLAG_BACKGROUND ");
788
789         return str;
790 }
791
792 /****************************************************************
793 ****************************************************************/
794
795 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
796                       uint32_t flags,
797                       const char *filename,
798                       const char *suffix,
799                       const char **filename_out)
800 {
801         const char *tmp = NULL;
802         struct stat sbuf;
803         const char *path = NULL;
804
805         if (flags & GPO_LIST_FLAG_MACHINE) {
806                 path = "Machine";
807         } else {
808                 path = "User";
809         }
810
811         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
812                               path, suffix);
813         NT_STATUS_HAVE_NO_MEMORY(tmp);
814
815         if (stat(tmp, &sbuf) == 0) {
816                 *filename_out = tmp;
817                 return NT_STATUS_OK;
818         }
819
820         path = talloc_strdup_upper(mem_ctx, path);
821         NT_STATUS_HAVE_NO_MEMORY(path);
822
823         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
824                               path, suffix);
825         NT_STATUS_HAVE_NO_MEMORY(tmp);
826
827         if (stat(tmp, &sbuf) == 0) {
828                 *filename_out = tmp;
829                 return NT_STATUS_OK;
830         }
831
832         return NT_STATUS_NO_SUCH_FILE;
833 }
834
835 /****************************************************************
836 ****************************************************************/
837
838 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
839                                 TALLOC_CTX *mem_ctx,
840                                 struct loadparm_context *lp_ctx,
841                                 const char *dn,
842                                 NT_USER_TOKEN **token)
843 {
844         NT_USER_TOKEN *ad_token = NULL;
845         ADS_STATUS status;
846 #if _SAMBA_BUILD_ == 4
847         struct auth_session_info *info;
848 #else
849         NTSTATUS ntstatus;
850 #endif
851
852 #ifndef HAVE_ADS
853         return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
854 #endif
855         status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
856         if (!ADS_ERR_OK(status)) {
857                 return status;
858         }
859 #if _SAMBA_BUILD_ == 4
860         info = system_session(mem_ctx, lp_ctx);
861         *token = info->security_token;
862 #else
863         ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
864                                   token);
865         if (!NT_STATUS_IS_OK(ntstatus)) {
866                 return ADS_ERROR_NT(ntstatus);
867         }
868 #endif
869         return ADS_SUCCESS;
870 }