2 Unix SMB/CIFS implementation.
3 Copyright (C) Luke Morrison <luc785@hotmail.com> 2013
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "param/pyparam.h"
26 #include "../libds/common/flags.h"
27 #include "librpc/rpc/pyrpc_util.h"
28 #include "auth/credentials/pycredentials.h"
29 #include "libcli/util/pyerrors.h"
31 /* A Python C API module to use LIBGPO */
33 #ifndef Py_RETURN_NONE
34 #define Py_RETURN_NONE return Py_INCREF(Py_None), Py_None
40 struct GROUP_POLICY_OBJECT *gpo_ptr;
41 struct GROUP_POLICY_OBJECT *head;
44 static void py_gpo_dealloc(GPO* self)
46 talloc_free(self->frame);
47 Py_TYPE(self)->tp_free((PyObject*)self);
50 static PyObject* py_gpo_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
55 static const char *kwlist[] = {"gpo_ptr", "talloc_ctx", NULL};
56 self = (GPO*)type->tp_alloc(type, 0);
57 if (PyArg_ParseTupleAndKeywords(args, kwds, "|OO", discard_const_p(char *, kwlist),
58 &c_obj, &talloc_obj)) {
59 self->gpo_ptr = PyCapsule_GetPointer(c_obj, NULL);
60 self->head = self->gpo_ptr;
61 self->frame = PyCapsule_GetPointer(talloc_obj, NULL);
65 return (PyObject*)self;
68 static int py_gpo_init(GPO *self, PyObject *args, PyObject *kwds)
73 #define GPO_getter(ATTR) \
74 static PyObject* GPO_get_##ATTR(GPO *self, void *closure) \
76 if (self->gpo_ptr->ATTR) \
77 return PyString_FromString(self->gpo_ptr->ATTR); \
82 GPO_getter(file_sys_path)
83 GPO_getter(display_name)
86 GPO_getter(user_extensions)
87 GPO_getter(machine_extensions)
89 static PyGetSetDef GPO_setters[] = {
90 {discard_const_p(char, "ds_path"), (getter)GPO_get_ds_path, NULL, NULL, NULL},
91 {discard_const_p(char, "file_sys_path"), (getter)GPO_get_file_sys_path, NULL, NULL, NULL},
92 {discard_const_p(char, "display_name"), (getter)GPO_get_display_name, NULL, NULL, NULL},
93 {discard_const_p(char, "name"), (getter)GPO_get_name, NULL, NULL, NULL},
94 {discard_const_p(char, "link"), (getter)GPO_get_link, NULL, NULL, NULL},
95 {discard_const_p(char, "user_extensions"), (getter)GPO_get_user_extensions, NULL, NULL, NULL},
96 {discard_const_p(char, "machine_extensions"), (getter)GPO_get_machine_extensions, NULL, NULL, NULL},
100 static PyObject *py_gpo_get_unix_path(GPO *self, PyObject *args, PyObject *kwds)
103 const char *cache_dir = NULL;
104 PyObject *ret = Py_None;
105 char *unix_path = NULL;
107 static const char *kwlist[] = {"cache_dir", NULL};
108 if (!PyArg_ParseTupleAndKeywords(args, kwds, "|s", discard_const_p(char *, kwlist), &cache_dir)) {
109 PyErr_SetString(PyExc_SystemError, "Failed to parse arguments to gpo_get_unix_path()");
114 cache_dir = cache_path(GPO_CACHE_DIR);
116 PyErr_SetString(PyExc_MemoryError, "Failed to determine gpo cache dir");
121 status = gpo_get_unix_path(self->frame, cache_dir, self->gpo_ptr, &unix_path);
122 if (!NT_STATUS_IS_OK(status)) {
123 PyErr_SetString(PyExc_SystemError, "Failed to determine gpo unix path");
127 ret = PyString_FromString(unix_path);
133 static PyMethodDef GPO_methods[] = {
134 {"get_unix_path", (PyCFunction)py_gpo_get_unix_path, METH_KEYWORDS, NULL },
138 static PyTypeObject GPOType;
139 static PyObject* py_gpo_iternext(GPO *self)
141 if (self->gpo_ptr && self->gpo_ptr->next) {
142 self->gpo_ptr = self->gpo_ptr->next;
143 return (PyObject *)self;
145 self->gpo_ptr = self->head;
146 PyErr_SetNone(PyExc_StopIteration);
151 static PyObject* py_gpo_iter(PyObject *self)
157 static PyTypeObject GPOType = {
158 .tp_name = "gpo.GROUP_POLICY_OBJECT",
159 .tp_basicsize = sizeof(GPO),
160 .tp_new = py_gpo_new,
161 .tp_free = PyObject_Del,
162 .tp_init = (initproc)py_gpo_init,
163 .tp_alloc = PyType_GenericAlloc,
164 .tp_dealloc = (destructor)py_gpo_dealloc,
165 .tp_doc = "GROUP_POLICY_OBJECT",
166 .tp_getset = GPO_setters,
167 .tp_methods = GPO_methods,
168 .tp_iter = py_gpo_iter,
169 .tp_iternext = (iternextfunc)py_gpo_iternext,
170 .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_ITER,
177 struct cli_credentials *cli_creds;
180 static void py_ads_dealloc(ADS* self)
182 ads_destroy(&(self->ads_ptr));
183 talloc_free(self->frame);
184 Py_TYPE(self)->tp_free((PyObject*)self);
187 static PyObject* py_ads_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
190 self = (ADS*)type->tp_alloc(type, 0);
191 return (PyObject*)self;
194 static PyObject* py_ads_connect(ADS *self);
195 static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
197 const char *realm = NULL;
198 const char *workgroup = NULL;
199 const char *ldap_server = NULL;
200 PyObject *py_creds = NULL;
201 PyObject *lp_obj = NULL;
202 struct loadparm_context *lp_ctx = NULL;
204 static const char *kwlist[] = {"ldap_server", "loadparm_context", "credentials", NULL};
205 if (!PyArg_ParseTupleAndKeywords(args, kwds, "sO|O", discard_const_p(char *, kwlist), &ldap_server, &lp_obj, &py_creds))
208 self->frame = talloc_stackframe();
211 if (!py_check_dcerpc_type(py_creds, "samba.credentials",
213 PyErr_Format(PyExc_TypeError,
214 "Expected samba.credentaials "
215 "for credentials argument");
219 = PyCredentials_AsCliCredentials(py_creds);
223 lp_ctx = pytalloc_get_type(lp_obj, struct loadparm_context);
224 if (lp_ctx == NULL) {
228 if (!lp_load_initial_only(lp_ctx->szConfigFile)) return -1;
230 if (self->cli_creds) {
231 realm = cli_credentials_get_realm(self->cli_creds);
232 workgroup = cli_credentials_get_domain(self->cli_creds);
235 workgroup = lp_workgroup();
236 if (!ldap_server) return -1;
239 if ( !(self->ads_ptr = ads_init(realm, workgroup, ldap_server)) )
245 static PyObject* py_ads_connect(ADS *self)
248 if (self->cli_creds) {
249 self->ads_ptr->auth.user_name = SMB_STRDUP(cli_credentials_get_username(self->cli_creds));
250 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
251 self->ads_ptr->auth.password = SMB_STRDUP(cli_credentials_get_password(self->cli_creds));
252 self->ads_ptr->auth.realm = SMB_STRDUP(cli_credentials_get_realm(self->cli_creds));
254 status = ads_connect_user_creds(self->ads_ptr);
255 if (!ADS_ERR_OK(status)) {
256 PyErr_SetString(PyExc_SystemError, "ads_connect() failed");
262 if (asprintf(&(self->ads_ptr->auth.user_name), "%s$", lp_netbios_name()) == -1) {
263 PyErr_SetString(PyExc_SystemError, "Failed to asprintf");
266 self->ads_ptr->auth.flags |= ADS_AUTH_USER_CREDS;
267 if (!secrets_init()) {
268 PyErr_SetString(PyExc_SystemError, "secrets_init() failed");
271 if (!(passwd = secrets_fetch_machine_password(self->ads_ptr->server.workgroup, NULL, NULL))) {
272 PyErr_SetString(PyExc_SystemError, "Failed to fetch the machine account password");
275 self->ads_ptr->auth.password = smb_xstrdup(passwd);
276 self->ads_ptr->auth.realm = smb_xstrdup(self->ads_ptr->server.realm);
277 if (!strupper_m(self->ads_ptr->auth.realm)) {
278 PyErr_SetString(PyExc_SystemError, "Failed to strdup");
282 status = ads_connect(self->ads_ptr);
283 if (!ADS_ERR_OK(status)) {
284 PyErr_SetString(PyExc_SystemError, "ads_connect() failed");
292 /* Parameter mapping and functions for the GP_EXT struct */
295 /* Global methods aka do not need a special pyobject type */
296 static PyObject *py_gpo_get_sysvol_gpt_version(PyObject * self, PyObject * args)
298 TALLOC_CTX *tmp_ctx = NULL;
300 char *display_name = NULL;
301 uint32_t sysvol_version = 0;
305 tmp_ctx = talloc_new(NULL);
307 if (!PyArg_ParseTuple(args, "s", &unix_path)) {
310 status = gpo_get_sysvol_gpt_version(tmp_ctx, unix_path,
313 if (!NT_STATUS_IS_OK(status)) {
314 PyErr_SetNTSTATUS(status);
315 TALLOC_FREE(tmp_ctx);
319 talloc_free(tmp_ctx);
320 result = Py_BuildValue("[s,i]", display_name, sysvol_version);
324 static ADS_STATUS find_samaccount(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, const char *samaccountname, uint32_t *uac_ret, const char **dn_ret)
327 const char *attrs[] = { "userAccountControl", NULL };
329 LDAPMessage *res = NULL;
333 filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)", samaccountname);
334 if (filter == NULL) {
335 status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
339 status = ads_do_search_all(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE, filter, attrs, &res);
341 if (!ADS_ERR_OK(status)) {
345 if (ads_count_replies(ads, res) != 1) {
346 status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
350 dn = ads_get_dn(ads, talloc_tos(), res);
352 status = ADS_ERROR(LDAP_NO_MEMORY);
356 if (!ads_pull_uint32(ads, res, "userAccountControl", &uac)) {
357 status = ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
366 *dn_ret = talloc_strdup(mem_ctx, dn);
368 status = ADS_ERROR(LDAP_NO_MEMORY);
374 ads_msgfree(ads, res);
379 static PyObject *py_ads_get_gpo_list(ADS *self, PyObject *args, PyObject *kwds)
381 TALLOC_CTX *mem_ctx = NULL;
382 struct GROUP_POLICY_OBJECT *gpo_list = NULL;
384 const char *samaccountname = NULL;
385 const char *dn = NULL;
388 struct security_token *token = NULL;
389 PyObject *ret = Py_None;
393 static const char *kwlist[] = {"samaccountname", NULL};
394 if (!PyArg_ParseTupleAndKeywords(args, kwds, "s", discard_const_p(char *, kwlist), &samaccountname)) {
395 PyErr_SetString(PyExc_SystemError, "Failed to parse arguments to py_ads_get_gpo_list()");
399 mem_ctx = talloc_new(self->frame);
401 status = find_samaccount(self->ads_ptr, mem_ctx, samaccountname, &uac, &dn);
402 if (!ADS_ERR_OK(status)) {
403 PyErr_SetString(PyExc_SystemError, "Failed to find samAccountName");
407 if (uac & UF_WORKSTATION_TRUST_ACCOUNT || uac & UF_SERVER_TRUST_ACCOUNT) {
408 flags |= GPO_LIST_FLAG_MACHINE;
409 status = gp_get_machine_token(self->ads_ptr, mem_ctx, dn, &token);
411 status = ads_get_sid_token(self->ads_ptr, mem_ctx, dn, &token);
413 if (!ADS_ERR_OK(status)) {
414 PyErr_SetString(PyExc_SystemError, "Failed to get token");
418 gpo_ctx = talloc_new(NULL);
419 status = ads_get_gpo_list(self->ads_ptr, gpo_ctx, dn, flags, token, &gpo_list);
420 if (!ADS_ERR_OK(status)) {
421 PyErr_SetString(PyExc_SystemError, "Failed to fetch GPO list");
425 t_args = PyTuple_New(2);
426 PyTuple_SetItem(t_args, 0, PyCapsule_New(gpo_list, NULL, NULL));
427 PyTuple_SetItem(t_args, 1, PyCapsule_New(gpo_ctx, NULL, NULL));
428 ret = PyObject_CallObject((PyObject *)&GPOType, t_args);
431 talloc_free(mem_ctx);
439 static PyMethodDef ADS_methods[] = {
440 { "connect", (PyCFunction)py_ads_connect, METH_NOARGS, "Connect to the LDAP server" },
441 { "get_gpo_list", (PyCFunction)py_ads_get_gpo_list, METH_KEYWORDS, NULL },
445 static PyTypeObject ads_ADSType = {
446 .tp_name = "gpo.ADS_STRUCT",
447 .tp_basicsize = sizeof(ADS),
448 .tp_dealloc = (destructor)py_ads_dealloc,
449 .tp_flags = Py_TPFLAGS_DEFAULT,
450 .tp_doc = "ADS struct",
451 .tp_methods = ADS_methods,
452 .tp_init = (initproc)py_ads_init,
453 .tp_new = py_ads_new,
456 static PyMethodDef py_gpo_methods[] = {
457 {"gpo_get_sysvol_gpt_version", (PyCFunction) py_gpo_get_sysvol_gpt_version, METH_VARARGS, NULL},
461 /* Will be called by python when loading this module */
466 debug_setup_talloc_log();
467 /* Instantiate the types */
468 m = Py_InitModule3("gpo", py_gpo_methods, "libgpo python bindings");
469 if (m == NULL) return;
470 PyModule_AddObject(m, "version", PyString_FromString(SAMBA_VERSION_STRING));
471 if (PyType_Ready(&ads_ADSType) < 0)
473 PyModule_AddObject(m, "ADS_STRUCT", (PyObject *)&ads_ADSType);
474 if (PyType_Ready(&GPOType) < 0)
476 PyModule_AddObject(m, "GROUP_POLICY_OBJECT", (PyObject *)&GPOType);