libgpo: Remedy some longer lines
[nivanova/samba-autobuild/.git] / libgpo / pygpo.c
1 /*
2    Unix SMB/CIFS implementation.
3    Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
4
5    This program is free software; you can redistribute it and/or modify
6    it under the terms of the GNU General Public License as published by
7    the Free Software Foundation; either version 3 of the License, or
8    (at your option) any later version.
9
10    This program is distributed in the hope that it will be useful,
11    but WITHOUT ANY WARRANTY; without even the implied warranty of
12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13    GNU General Public License for more details.
14
15    You should have received a copy of the GNU General Public License
16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include <Python.h>
20 #include "includes.h"
21 #include "version.h"
22 #include "param/pyparam.h"
23 #include "gpo.h"
24 #include "ads.h"
25 #include "secrets.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
30
31 /* A Python C API module to use LIBGPO */
32
33 #define GPO_getter(ATTR) \
34 static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \
35 { \
36         struct GROUP_POLICY_OBJECT *gpo_ptr \
37                 = pytalloc_get_ptr(self); \
38         \
39         if (gpo_ptr->ATTR) \
40                 return PyString_FromString(gpo_ptr->ATTR); \
41         else \
42                 return Py_None; \
43 }
44 GPO_getter(ds_path)
45 GPO_getter(file_sys_path)
46 GPO_getter(display_name)
47 GPO_getter(name)
48 GPO_getter(link)
49 GPO_getter(user_extensions)
50 GPO_getter(machine_extensions)
51
52 static PyGetSetDef GPO_setters[] = {
53         {discard_const_p(char, "ds_path"), (getter)GPO_get_ds_path, NULL, NULL,
54                 NULL},
55         {discard_const_p(char, "file_sys_path"), (getter)GPO_get_file_sys_path,
56                 NULL, NULL, NULL},
57         {discard_const_p(char, "display_name"), (getter)GPO_get_display_name,
58                 NULL, NULL, NULL},
59         {discard_const_p(char, "name"), (getter)GPO_get_name, NULL, NULL,
60                 NULL},
61         {discard_const_p(char, "link"), (getter)GPO_get_link, NULL, NULL,
62                 NULL},
63         {discard_const_p(char, "user_extensions"),
64                 (getter)GPO_get_user_extensions,
65                 NULL, NULL, NULL},
66         {discard_const_p(char, "machine_extensions"),
67                 (getter)GPO_get_machine_extensions, NULL, NULL, NULL},
68         {NULL}
69 };
70
71 static PyObject *py_gpo_get_unix_path(PyObject *self, PyObject *args,
72                                       PyObject *kwds)
73 {
74         NTSTATUS status;
75         const char *cache_dir = NULL;
76         PyObject *ret = Py_None;
77         char *unix_path = NULL;
78         TALLOC_CTX *frame = NULL;
79         static const char *kwlist[] = {"cache_dir", NULL};
80         struct GROUP_POLICY_OBJECT *gpo_ptr \
81                 = (struct GROUP_POLICY_OBJECT *)pytalloc_get_ptr(self);
82
83         if (!PyArg_ParseTupleAndKeywords(args, kwds, "|s",
84                                          discard_const_p(char *, kwlist),
85                                          &cache_dir)) {
86                 PyErr_SetString(PyExc_SystemError,
87                                 "Failed to parse arguments to "
88                                 "gpo_get_unix_path()");
89                 goto out;
90         }
91
92         if (!cache_dir) {
93                 cache_dir = cache_path(GPO_CACHE_DIR);
94                 if (!cache_dir) {
95                         PyErr_SetString(PyExc_MemoryError,
96                                         "Failed to determine gpo cache dir");
97                         goto out;
98                 }
99         }
100
101         frame = talloc_stackframe();
102
103         status = gpo_get_unix_path(frame, cache_dir, gpo_ptr, &unix_path);
104
105         TALLOC_FREE(frame);
106
107         if (!NT_STATUS_IS_OK(status)) {
108                 PyErr_SetString(PyExc_SystemError,
109                                 "Failed to determine gpo unix path");
110                 goto out;
111         }
112
113         ret = PyString_FromString(unix_path);
114
115 out:
116         return ret;
117 }
118
119 static PyMethodDef GPO_methods[] = {
120         {"get_unix_path", (PyCFunction)py_gpo_get_unix_path, METH_KEYWORDS,
121                 NULL },
122         {NULL}
123 };
124
125 static PyTypeObject GPOType = {
126         PyVarObject_HEAD_INIT(NULL, 0)
127         .tp_name = "gpo.GROUP_POLICY_OBJECT",
128         .tp_doc = "GROUP_POLICY_OBJECT",
129         .tp_getset = GPO_setters,
130         .tp_methods = GPO_methods,
131         .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
132 };
133
134 typedef struct {
135         PyObject_HEAD
136         ADS_STRUCT *ads_ptr;
137         struct cli_credentials *cli_creds;
138 } ADS;
139
140 static void py_ads_dealloc(ADS* self)
141 {
142         ads_destroy(&(self->ads_ptr));
143         Py_TYPE(self)->tp_free((PyObject*)self);
144 }
145
146 static PyObject* py_ads_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
147 {
148         ADS *self;
149         self = (ADS*)type->tp_alloc(type, 0);
150         return (PyObject*)self;
151 }
152
153 static PyObject* py_ads_connect(ADS *self);
154 static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
155 {
156         const char *realm = NULL;
157         const char *workgroup = NULL;
158         const char *ldap_server = NULL;
159         PyObject *py_creds = NULL;
160         PyObject *lp_obj = NULL;
161         struct loadparm_context *lp_ctx = NULL;
162
163         static const char *kwlist[] = {
164                 "ldap_server", "loadparm_context", "credentials", NULL
165         };
166         if (!PyArg_ParseTupleAndKeywords(args, kwds, "sO|O",
167                                          discard_const_p(char *, kwlist),
168                                          &ldap_server, &lp_obj, &py_creds)) {
169                 return -1;
170         }
171
172         if (py_creds) {
173                 if (!py_check_dcerpc_type(py_creds, "samba.credentials",
174                                           "Credentials")) {
175                         PyErr_Format(PyExc_TypeError,
176                                      "Expected samba.credentials "
177                                      "for credentials argument");
178                         return -1;
179                 }
180                 self->cli_creds
181                         = PyCredentials_AsCliCredentials(py_creds);
182         }
183
184         if (lp_obj) {
185                 bool ok;
186                 lp_ctx = pytalloc_get_type(lp_obj, struct loadparm_context);
187                 if (lp_ctx == NULL) {
188                         return -1;
189                 }
190                 ok = lp_load_initial_only(lp_ctx->szConfigFile);
191                 if (!ok) {
192                         return -1;
193                 }
194         }
195
196         if (self->cli_creds) {
197                 realm = cli_credentials_get_realm(self->cli_creds);
198                 workgroup = cli_credentials_get_domain(self->cli_creds);
199         } else {
200                 realm = lp_realm();
201                 workgroup = lp_workgroup();
202         }
203
204         if (ldap_server == NULL) {
205                 return -1;
206         }
207
208         self->ads_ptr = ads_init(realm, workgroup, ldap_server);
209         if (self->ads_ptr == NULL) {
210                 return -1;
211         }
212
213         return 0;
214 }
215
216 static PyObject* py_ads_connect(ADS *self)
217 {
218         ADS_STATUS status;
219         TALLOC_CTX *frame = talloc_stackframe();
220         if (self->cli_creds) {
221                 self->ads_ptr->auth.user_name =
222                         SMB_STRDUP(cli_credentials_get_username(self->cli_creds));
223                 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
224                 self->ads_ptr->auth.password =
225                         SMB_STRDUP(cli_credentials_get_password(self->cli_creds));
226                 self->ads_ptr->auth.realm =
227                         SMB_STRDUP(cli_credentials_get_realm(self->cli_creds));
228
229                 status = ads_connect_user_creds(self->ads_ptr);
230                 if (!ADS_ERR_OK(status)) {
231                         PyErr_SetString(PyExc_SystemError,
232                                         "ads_connect() failed");
233                         TALLOC_FREE(frame);
234                         Py_RETURN_FALSE;
235                 }
236         } else {
237                 char *passwd = NULL;
238                 int ret = asprintf(&(self->ads_ptr->auth.user_name), "%s$",
239                                    lp_netbios_name());
240                 if (ret == -1) {
241                         PyErr_SetString(PyExc_SystemError,
242                                         "Failed to asprintf");
243                         TALLOC_FREE(frame);
244                         Py_RETURN_FALSE;
245                 } else {
246                         self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
247                 }
248
249                 if (!secrets_init()) {
250                         PyErr_SetString(PyExc_SystemError,
251                                         "secrets_init() failed");
252                         TALLOC_FREE(frame);
253                         Py_RETURN_FALSE;
254                 }
255
256                 passwd = secrets_fetch_machine_password(self->ads_ptr->server.workgroup,
257                                                         NULL, NULL);
258                 if (passwd == NULL) {
259                         PyErr_SetString(PyExc_SystemError,
260                                         "Failed to fetch the machine account "
261                                         "password");
262                         TALLOC_FREE(frame);
263                         Py_RETURN_FALSE;
264                 }
265                 self->ads_ptr->auth.password = smb_xstrdup(passwd);
266                 self->ads_ptr->auth.realm =
267                         smb_xstrdup(self->ads_ptr->server.realm);
268                 if (!strupper_m(self->ads_ptr->auth.realm)) {
269                         PyErr_SetString(PyExc_SystemError, "Failed to strdup");
270                         TALLOC_FREE(frame);
271                         SAFE_FREE(passwd);
272                         Py_RETURN_FALSE;
273                 }
274
275                 status = ads_connect(self->ads_ptr);
276                 if (!ADS_ERR_OK(status)) {
277                         PyErr_SetString(PyExc_SystemError,
278                                         "ads_connect() failed");
279                         TALLOC_FREE(frame);
280                         SAFE_FREE(passwd);
281                         Py_RETURN_FALSE;
282                 }
283         }
284
285         TALLOC_FREE(frame);
286         Py_RETURN_TRUE;
287 }
288
289 /* Parameter mapping and functions for the GP_EXT struct */
290 void initgpo(void);
291
292 /* Global methods aka do not need a special pyobject type */
293 static PyObject *py_gpo_get_sysvol_gpt_version(PyObject * self,
294                                                PyObject * args)
295 {
296         TALLOC_CTX *tmp_ctx = NULL;
297         char *unix_path;
298         char *display_name = NULL;
299         uint32_t sysvol_version = 0;
300         PyObject *result;
301         NTSTATUS status;
302
303         tmp_ctx = talloc_new(NULL);
304
305         if (!PyArg_ParseTuple(args, "s", &unix_path)) {
306                 return NULL;
307         }
308         status = gpo_get_sysvol_gpt_version(tmp_ctx, unix_path,
309                                             &sysvol_version,
310                                             &display_name);
311         if (!NT_STATUS_IS_OK(status)) {
312                 PyErr_SetNTSTATUS(status);
313                 TALLOC_FREE(tmp_ctx);
314                 return NULL;
315         }
316
317         talloc_free(tmp_ctx);
318         result = Py_BuildValue("[s,i]", display_name, sysvol_version);
319         return result;
320 }
321
322 static ADS_STATUS find_samaccount(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
323                                   const char *samaccountname,
324                                   uint32_t *uac_ret, const char **dn_ret)
325 {
326         ADS_STATUS status;
327         const char *attrs[] = { "userAccountControl", NULL };
328         const char *filter;
329         LDAPMessage *res = NULL;
330         char *dn = NULL;
331         uint32_t uac = 0;
332
333         filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
334                                  samaccountname);
335         if (filter == NULL) {
336                 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
337                 goto out;
338         }
339
340         status = ads_do_search_all(ads, ads->config.bind_path,
341                                    LDAP_SCOPE_SUBTREE, filter, attrs, &res);
342
343         if (!ADS_ERR_OK(status)) {
344                 goto out;
345         }
346
347         if (ads_count_replies(ads, res) != 1) {
348                 status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
349                 goto out;
350         }
351
352         dn = ads_get_dn(ads, talloc_tos(), res);
353         if (dn == NULL) {
354                 status = ADS_ERROR(LDAP_NO_MEMORY);
355                 goto out;
356         }
357
358         if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
359                 status = ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
360                 goto out;
361         }
362
363         if (uac_ret) {
364                 *uac_ret = uac;
365         }
366
367         if (dn_ret) {
368                 *dn_ret = talloc_strdup(mem_ctx, dn);
369                 if (*dn_ret == NULL) {
370                         status = ADS_ERROR(LDAP_NO_MEMORY);
371                         goto out;
372                 }
373         }
374 out:
375         TALLOC_FREE(dn);
376         ads_msgfree(ads, res);
377
378         return status;
379 }
380
381 static PyObject *py_ads_get_gpo_list(ADS *self, PyObject *args, PyObject *kwds)
382 {
383         TALLOC_CTX *frame = NULL;
384         struct GROUP_POLICY_OBJECT *gpo = NULL, *gpo_list = NULL;
385         ADS_STATUS status;
386         const char *samaccountname = NULL;
387         const char *dn = NULL;
388         uint32_t uac = 0;
389         uint32_t flags = 0;
390         struct security_token *token = NULL;
391         PyObject *ret = Py_None;
392         TALLOC_CTX *gpo_ctx;
393         size_t list_size;
394         size_t i;
395
396         static const char *kwlist[] = {"samaccountname", NULL};
397         if (!PyArg_ParseTupleAndKeywords(args, kwds, "s",
398                                          discard_const_p(char *, kwlist),
399                                          &samaccountname)) {
400                 PyErr_SetString(PyExc_SystemError,
401                                 "Failed to parse arguments to "
402                                 "py_ads_get_gpo_list()");
403                 goto out;
404         }
405
406         frame = talloc_stackframe();
407
408         status = find_samaccount(self->ads_ptr, frame,
409                                  samaccountname, &uac, &dn);
410         if (!ADS_ERR_OK(status)) {
411                 TALLOC_FREE(frame);
412                 PyErr_SetString(PyExc_SystemError,
413                                 "Failed to find samAccountName");
414                 goto out;
415         }
416
417         if (uac & UF_WORKSTATION_TRUST_ACCOUNT ||
418             uac & UF_SERVER_TRUST_ACCOUNT) {
419                 flags |= GPO_LIST_FLAG_MACHINE;
420                 status = gp_get_machine_token(self->ads_ptr, frame, dn,
421                                               &token);
422         } else {
423                 status = ads_get_sid_token(self->ads_ptr, frame, dn, &token);
424         }
425         if (!ADS_ERR_OK(status)) {
426                 TALLOC_FREE(frame);
427                 PyErr_SetString(PyExc_SystemError, "Failed to get token");
428                 goto out;
429         }
430
431         gpo_ctx = talloc_new(frame);
432         status = ads_get_gpo_list(self->ads_ptr, gpo_ctx, dn, flags, token,
433                                   &gpo_list);
434         if (!ADS_ERR_OK(status)) {
435                 TALLOC_FREE(frame);
436                 PyErr_SetString(PyExc_SystemError, "Failed to fetch GPO list");
437                 goto out;
438         }
439
440         /* Convert the C linked list into a python list */
441         list_size = 0;
442         for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
443                 list_size++;
444         }
445
446         i = 0;
447         ret = PyList_New(list_size);
448         if (ret == NULL) {
449                 TALLOC_FREE(frame);
450                 goto out;
451         }
452
453         for (gpo = gpo_list; gpo != NULL; gpo = gpo->next) {
454                 PyObject *obj = pytalloc_reference_ex(&GPOType,
455                                                       gpo_ctx, gpo);
456                 if (obj == NULL) {
457                         TALLOC_FREE(frame);
458                         goto out;
459                 }
460
461                 PyList_SetItem(ret, i, obj);
462                 i++;
463         }
464
465 out:
466
467         TALLOC_FREE(frame);
468         return ret;
469 }
470
471 static PyMethodDef ADS_methods[] = {
472         { "connect", (PyCFunction)py_ads_connect, METH_NOARGS,
473                 "Connect to the LDAP server" },
474         { "get_gpo_list", (PyCFunction)py_ads_get_gpo_list, METH_KEYWORDS,
475                 NULL },
476         { NULL }
477 };
478
479 static PyTypeObject ads_ADSType = {
480         .tp_name = "gpo.ADS_STRUCT",
481         .tp_basicsize = sizeof(ADS),
482         .tp_dealloc = (destructor)py_ads_dealloc,
483         .tp_flags = Py_TPFLAGS_DEFAULT,
484         .tp_doc = "ADS struct",
485         .tp_methods = ADS_methods,
486         .tp_init = (initproc)py_ads_init,
487         .tp_new = py_ads_new,
488 };
489
490 static PyMethodDef py_gpo_methods[] = {
491         {"gpo_get_sysvol_gpt_version",
492                 (PyCFunction)py_gpo_get_sysvol_gpt_version,
493                 METH_VARARGS, NULL},
494         {NULL}
495 };
496
497 /* Will be called by python when loading this module */
498 void initgpo(void)
499 {
500         PyObject *m;
501
502         debug_setup_talloc_log();
503
504         /* Instantiate the types */
505         m = Py_InitModule3("gpo", py_gpo_methods, "libgpo python bindings");
506         if (m == NULL) {
507                 return;
508         }
509
510         PyModule_AddObject(m, "version",
511                            PyString_FromString(SAMBA_VERSION_STRING));
512
513         if (PyType_Ready(&ads_ADSType) < 0) {
514                 return;
515         }
516
517         PyModule_AddObject(m, "ADS_STRUCT", (PyObject *)&ads_ADSType);
518
519         if (pytalloc_BaseObject_PyType_Ready(&GPOType) < 0) {
520                 return;
521         }
522
523         Py_INCREF((PyObject *)(void *)&GPOType);
524         PyModule_AddObject(m, "GROUP_POLICY_OBJECT",
525                            (PyObject *)&GPOType);
526
527 }