From cecd142f2bb77787985a1a55b1f55cef7ff9af75 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Sun, 1 Mar 2009 02:13:21 +0100 Subject: Move some libgpo files to root. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Günther Deschner --- libgpo/config.mk | 3 + libgpo/gpext/gpext.c | 749 +++++++++++++++++++++++++++++++++++++ libgpo/gpext/gpext.h | 86 +++++ libgpo/gpo.h | 163 ++++++++ libgpo/gpo_util.c | 872 +++++++++++++++++++++++++++++++++++++++++++ source3/Makefile.in | 4 +- source3/include/gpo.h | 158 -------- source3/include/includes.h | 2 +- source3/libgpo/gpext/gpext.c | 746 ------------------------------------ source3/libgpo/gpext/gpext.h | 79 ---- source3/libgpo/gpo_util.c | 870 ------------------------------------------ 11 files changed, 1876 insertions(+), 1856 deletions(-) create mode 100644 libgpo/config.mk create mode 100644 libgpo/gpext/gpext.c create mode 100644 libgpo/gpext/gpext.h create mode 100644 libgpo/gpo.h create mode 100644 libgpo/gpo_util.c delete mode 100644 source3/include/gpo.h delete mode 100644 source3/libgpo/gpext/gpext.c delete mode 100644 source3/libgpo/gpext/gpext.h delete mode 100644 source3/libgpo/gpo_util.c diff --git a/libgpo/config.mk b/libgpo/config.mk new file mode 100644 index 0000000000..ebfcafd024 --- /dev/null +++ b/libgpo/config.mk @@ -0,0 +1,3 @@ +[SUBSYSTEM::LIBGPO] + +LIBGPO_OBJ_FILES = ../libgpo/gpo_util.o diff --git a/libgpo/gpext/gpext.c b/libgpo/gpext/gpext.c new file mode 100644 index 0000000000..82c0459e45 --- /dev/null +++ b/libgpo/gpext/gpext.c @@ -0,0 +1,749 @@ +/* + * Unix SMB/CIFS implementation. + * Group Policy Support + * Copyright (C) Guenther Deschner 2007-2008 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#include "includes.h" +#include "../libgpo/gpext/gpext.h" +#include "librpc/gen_ndr/ndr_misc.h" +#include "lib/util/dlinklist.h" + +static struct gp_extension *extensions = NULL; + +/**************************************************************** +****************************************************************/ + +struct gp_extension *get_gp_extension_list(void) +{ + return extensions; +} + +/**************************************************************** +****************************************************************/ + +/* see http://support.microsoft.com/kb/216358/en-us/ for more info */ + +struct gp_extension_reg_table gpext_reg_vals[] = { + { "DllName", REG_EXPAND_SZ }, + { "ProcessGroupPolicy", REG_SZ }, + { "NoMachinePolicy", REG_DWORD }, + { "NoUserPolicy", REG_DWORD }, + { "NoSlowLink", REG_DWORD }, + { "NoBackgroundPolicy", REG_DWORD }, + { "NoGPOListChanges", REG_DWORD }, + { "PerUserLocalSettings", REG_DWORD }, + { "RequiresSuccessfulRegistry", REG_DWORD }, + { "EnableAsynchronousProcessing", REG_DWORD }, + { "ExtensionDebugLevel", REG_DWORD }, + /* new */ + { "GenerateGroupPolicy", REG_SZ }, /* not supported on w2k */ + { "NotifyLinkTransition", REG_DWORD }, + { "ProcessGroupPolicyEx", REG_SZ }, /* not supported on w2k */ + { "ExtensionEventSource", REG_MULTI_SZ }, /* not supported on w2k */ + { "GenerateGroupPolicy", REG_SZ }, + { "MaxNoGPOListChangesInterval", REG_DWORD }, + { NULL, REG_NONE } +}; + +/**************************************************************** +****************************************************************/ + +static struct gp_extension *get_extension_by_name(struct gp_extension *be, + const char *name) +{ + struct gp_extension *b; + + for (b = be; b; b = b->next) { + if (strequal(b->name, name)) { + return b; + } + } + + return NULL; +} + +/**************************************************************** +****************************************************************/ + +static struct gp_extension_methods *get_methods_by_name(struct gp_extension *be, + const char *name) +{ + struct gp_extension *b; + + for (b = be; b; b = b->next) { + if (strequal(b->name, name)) { + return b->methods; + } + } + + return NULL; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS unregister_gp_extension(const char *name) +{ + struct gp_extension *ext; + + ext = get_extension_by_name(extensions, name); + if (!ext) { + return NT_STATUS_OK; + } + + DLIST_REMOVE(extensions, ext); + talloc_free(ext); + + DEBUG(2,("Successfully removed GP extension '%s'\n", name)); + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS register_gp_extension(TALLOC_CTX *gpext_ctx, + int version, + const char *name, + const char *guid, + struct gp_extension_methods *methods) +{ + struct gp_extension_methods *test; + struct gp_extension *entry; + NTSTATUS status; + + if (!gpext_ctx) { + return NT_STATUS_INTERNAL_DB_ERROR; + } + + if ((version != SMB_GPEXT_INTERFACE_VERSION)) { + DEBUG(0,("Failed to register gp extension.\n" + "The module was compiled against " + "SMB_GPEXT_INTERFACE_VERSION %d,\n" + "current SMB_GPEXT_INTERFACE_VERSION is %d.\n" + "Please recompile against the current " + "version of samba!\n", + version, SMB_GPEXT_INTERFACE_VERSION)); + return NT_STATUS_OBJECT_TYPE_MISMATCH; + } + + if (!guid || !name || !name[0] || !methods) { + DEBUG(0,("Called with NULL pointer or empty name!\n")); + return NT_STATUS_INVALID_PARAMETER; + } + + test = get_methods_by_name(extensions, name); + if (test) { + DEBUG(0,("GP extension module %s already registered!\n", + name)); + return NT_STATUS_OBJECT_NAME_COLLISION; + } + + entry = talloc_zero(gpext_ctx, struct gp_extension); + NT_STATUS_HAVE_NO_MEMORY(entry); + + entry->name = talloc_strdup(gpext_ctx, name); + NT_STATUS_HAVE_NO_MEMORY(entry->name); + + entry->guid = talloc_zero(gpext_ctx, struct GUID); + NT_STATUS_HAVE_NO_MEMORY(entry->guid); + status = GUID_from_string(guid, entry->guid); + NT_STATUS_NOT_OK_RETURN(status); + + entry->methods = methods; + DLIST_ADD(extensions, entry); + + DEBUG(2,("Successfully added GP extension '%s' %s\n", + name, GUID_string2(gpext_ctx, entry->guid))); + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gp_extension_init_module(TALLOC_CTX *mem_ctx, + const char *name, + struct gp_extension **gpext) +{ + NTSTATUS status; + struct gp_extension *ext = NULL; + + ext = talloc_zero(mem_ctx, struct gp_extension); + NT_STATUS_HAVE_NO_MEMORY(gpext); + + ext->methods = get_methods_by_name(extensions, name); + if (!ext->methods) { + + status = smb_probe_module(SAMBA_SUBSYSTEM_GPEXT, + name); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + ext->methods = get_methods_by_name(extensions, name); + if (!ext->methods) { + return NT_STATUS_DLL_INIT_FAILED; + } + } + + *gpext = ext; + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +static bool add_gp_extension_reg_entry_to_array(TALLOC_CTX *mem_ctx, + struct gp_extension_reg_entry *entry, + struct gp_extension_reg_entry **entries, + size_t *num) +{ + *entries = talloc_realloc(mem_ctx, *entries, + struct gp_extension_reg_entry, + (*num)+1); + if (*entries == NULL) { + *num = 0; + return false; + } + + (*entries)[*num].value = entry->value; + (*entries)[*num].data = entry->data; + + *num += 1; + return true; +} + +/**************************************************************** +****************************************************************/ + +static bool add_gp_extension_reg_info_entry_to_array(TALLOC_CTX *mem_ctx, + struct gp_extension_reg_info_entry *entry, + struct gp_extension_reg_info_entry **entries, + size_t *num) +{ + *entries = talloc_realloc(mem_ctx, *entries, + struct gp_extension_reg_info_entry, + (*num)+1); + if (*entries == NULL) { + *num = 0; + return false; + } + + (*entries)[*num].guid = entry->guid; + (*entries)[*num].num_entries = entry->num_entries; + (*entries)[*num].entries = entry->entries; + + *num += 1; + return true; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gp_ext_info_add_reg(TALLOC_CTX *mem_ctx, + struct gp_extension_reg_info_entry *entry, + const char *value, + enum winreg_Type type, + const char *data_s) +{ + struct gp_extension_reg_entry *reg_entry = NULL; + struct registry_value *data = NULL; + + reg_entry = talloc_zero(mem_ctx, struct gp_extension_reg_entry); + NT_STATUS_HAVE_NO_MEMORY(reg_entry); + + data = talloc_zero(mem_ctx, struct registry_value); + NT_STATUS_HAVE_NO_MEMORY(data); + + data->type = type; + + switch (type) { + case REG_SZ: + case REG_EXPAND_SZ: + data->v.sz.str = talloc_strdup(mem_ctx, data_s); + NT_STATUS_HAVE_NO_MEMORY(data->v.sz.str); + data->v.sz.len = strlen(data_s); + break; + case REG_DWORD: + data->v.dword = atoi(data_s); + break; + default: + return NT_STATUS_NOT_SUPPORTED; + } + + reg_entry->value = value; + reg_entry->data = data; + + if (!add_gp_extension_reg_entry_to_array(mem_ctx, reg_entry, + &entry->entries, + &entry->num_entries)) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gp_ext_info_add_reg_table(TALLOC_CTX *mem_ctx, + const char *module, + struct gp_extension_reg_info_entry *entry, + struct gp_extension_reg_table *table) +{ + NTSTATUS status; + const char *module_name = NULL; + int i; + + module_name = talloc_asprintf(mem_ctx, "%s.%s", module, shlib_ext()); + NT_STATUS_HAVE_NO_MEMORY(module_name); + + status = gp_ext_info_add_reg(mem_ctx, entry, + "DllName", REG_EXPAND_SZ, module_name); + NT_STATUS_NOT_OK_RETURN(status); + + for (i=0; table[i].val; i++) { + status = gp_ext_info_add_reg(mem_ctx, entry, + table[i].val, + table[i].type, + table[i].data); + NT_STATUS_NOT_OK_RETURN(status); + } + + return status; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS gp_ext_info_add_entry(TALLOC_CTX *mem_ctx, + const char *module, + const char *ext_guid, + struct gp_extension_reg_table *table, + struct gp_extension_reg_info *info) +{ + NTSTATUS status; + struct gp_extension_reg_info_entry *entry = NULL; + + entry = TALLOC_ZERO_P(mem_ctx, struct gp_extension_reg_info_entry); + NT_STATUS_HAVE_NO_MEMORY(entry); + + status = GUID_from_string(ext_guid, &entry->guid); + NT_STATUS_NOT_OK_RETURN(status); + + status = gp_ext_info_add_reg_table(mem_ctx, module, entry, table); + NT_STATUS_NOT_OK_RETURN(status); + + if (!add_gp_extension_reg_info_entry_to_array(mem_ctx, entry, + &info->entries, + &info->num_entries)) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +static bool gp_extension_reg_info_verify_entry(struct gp_extension_reg_entry *entry) +{ + int i; + + for (i=0; gpext_reg_vals[i].val; i++) { + + if ((strequal(entry->value, gpext_reg_vals[i].val)) && + (entry->data->type == gpext_reg_vals[i].type)) { + return true; + } + } + + return false; +} + +/**************************************************************** +****************************************************************/ + +static bool gp_extension_reg_info_verify(struct gp_extension_reg_info_entry *entry) +{ + int i; + + for (i=0; i < entry->num_entries; i++) { + if (!gp_extension_reg_info_verify_entry(&entry->entries[i])) { + return false; + } + } + + return true; +} + +/**************************************************************** +****************************************************************/ + +static WERROR gp_extension_store_reg_vals(TALLOC_CTX *mem_ctx, + struct registry_key *key, + struct gp_extension_reg_info_entry *entry) +{ + WERROR werr = WERR_OK; + size_t i; + + for (i=0; i < entry->num_entries; i++) { + + werr = reg_setvalue(key, + entry->entries[i].value, + entry->entries[i].data); + W_ERROR_NOT_OK_RETURN(werr); + } + + return werr; +} + +/**************************************************************** +****************************************************************/ + +static WERROR gp_extension_store_reg_entry(TALLOC_CTX *mem_ctx, + struct gp_registry_context *reg_ctx, + struct gp_extension_reg_info_entry *entry) +{ + WERROR werr; + struct registry_key *key = NULL; + const char *subkeyname = NULL; + + if (!gp_extension_reg_info_verify(entry)) { + return WERR_INVALID_PARAM; + } + + subkeyname = GUID_string2(mem_ctx, &entry->guid); + W_ERROR_HAVE_NO_MEMORY(subkeyname); + + strupper_m(CONST_DISCARD(char *,subkeyname)); + + werr = gp_store_reg_subkey(mem_ctx, + subkeyname, + reg_ctx->curr_key, + &key); + W_ERROR_NOT_OK_RETURN(werr); + + werr = gp_extension_store_reg_vals(mem_ctx, + key, + entry); + W_ERROR_NOT_OK_RETURN(werr); + + return werr; +} + +/**************************************************************** +****************************************************************/ + +static WERROR gp_extension_store_reg(TALLOC_CTX *mem_ctx, + struct gp_registry_context *reg_ctx, + struct gp_extension_reg_info *info) +{ + WERROR werr = WERR_OK; + int i; + + if (!info) { + return WERR_OK; + } + + for (i=0; i < info->num_entries; i++) { + werr = gp_extension_store_reg_entry(mem_ctx, + reg_ctx, + &info->entries[i]); + W_ERROR_NOT_OK_RETURN(werr); + } + + return werr; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gp_glob_ext_list(TALLOC_CTX *mem_ctx, + const char ***ext_list, + size_t *ext_list_len) +{ + SMB_STRUCT_DIR *dir = NULL; + SMB_STRUCT_DIRENT *dirent = NULL; + + dir = sys_opendir(modules_path(SAMBA_SUBSYSTEM_GPEXT)); + if (!dir) { + return map_nt_error_from_unix(errno); + } + + while ((dirent = sys_readdir(dir))) { + + fstring name; /* forgive me... */ + char *p; + + if ((strequal(dirent->d_name, ".")) || + (strequal(dirent->d_name, ".."))) { + continue; + } + + p = strrchr(dirent->d_name, '.'); + if (!p) { + sys_closedir(dir); + return NT_STATUS_NO_MEMORY; + } + + if (!strcsequal(p+1, shlib_ext())) { + DEBUG(10,("gp_glob_ext_list: not a *.so file: %s\n", + dirent->d_name)); + continue; + } + + fstrcpy(name, dirent->d_name); + name[PTR_DIFF(p, dirent->d_name)] = 0; + + if (!add_string_to_array(mem_ctx, name, ext_list, + (int *)ext_list_len)) { + sys_closedir(dir); + return NT_STATUS_NO_MEMORY; + } + } + + sys_closedir(dir); + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS shutdown_gp_extensions(void) +{ + struct gp_extension *ext = NULL; + + for (ext = extensions; ext; ext = ext->next) { + if (ext->methods && ext->methods->shutdown) { + ext->methods->shutdown(); + } + } + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS init_gp_extensions(TALLOC_CTX *mem_ctx) +{ + NTSTATUS status; + WERROR werr; + int i = 0; + const char **ext_array = NULL; + size_t ext_array_len = 0; + struct gp_extension *gpext = NULL; + struct gp_registry_context *reg_ctx = NULL; + + if (get_gp_extension_list()) { + return NT_STATUS_OK; + } + + status = gp_glob_ext_list(mem_ctx, &ext_array, &ext_array_len); + NT_STATUS_NOT_OK_RETURN(status); + + for (i=0; imethods->get_reg_config) { + + status = gpext->methods->initialize(mem_ctx); + if (!NT_STATUS_IS_OK(status)) { + gpext->methods->shutdown(); + goto out; + } + + status = gpext->methods->get_reg_config(mem_ctx, + &info); + if (!NT_STATUS_IS_OK(status)) { + gpext->methods->shutdown(); + goto out; + } + + if (!reg_ctx) { + struct nt_user_token *token; + + token = registry_create_system_token(mem_ctx); + NT_STATUS_HAVE_NO_MEMORY(token); + + werr = gp_init_reg_ctx(mem_ctx, + KEY_WINLOGON_GPEXT_PATH, + REG_KEY_WRITE, + token, + ®_ctx); + if (!W_ERROR_IS_OK(werr)) { + status = werror_to_ntstatus(werr); + gpext->methods->shutdown(); + goto out; + } + } + + werr = gp_extension_store_reg(mem_ctx, reg_ctx, info); + if (!W_ERROR_IS_OK(werr)) { + DEBUG(1,("gp_extension_store_reg failed: %s\n", + win_errstr(werr))); + TALLOC_FREE(info); + gpext->methods->shutdown(); + status = werror_to_ntstatus(werr); + goto out; + } + TALLOC_FREE(info); + } + + } + + out: + TALLOC_FREE(reg_ctx); + + return status; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS free_gp_extensions(void) +{ + struct gp_extension *ext, *ext_next = NULL; + + for (ext = extensions; ext; ext = ext_next) { + ext_next = ext->next; + DLIST_REMOVE(extensions, ext); + TALLOC_FREE(ext); + } + + extensions = NULL; + + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +void debug_gpext_header(int lvl, + const char *name, + uint32_t flags, + struct GROUP_POLICY_OBJECT *gpo, + const char *extension_guid, + const char *snapin_guid) +{ + char *flags_str = NULL; + + DEBUG(lvl,("%s\n", name)); + DEBUGADD(lvl,("\tgpo: %s (%s)\n", gpo->name, + gpo->display_name)); + DEBUGADD(lvl,("\tcse extension: %s (%s)\n", extension_guid, + cse_gpo_guid_string_to_name(extension_guid))); + DEBUGADD(lvl,("\tgplink: %s\n", gpo->link)); + DEBUGADD(lvl,("\tsnapin: %s (%s)\n", snapin_guid, + cse_snapin_gpo_guid_string_to_name(snapin_guid))); + + flags_str = gpo_flag_str(flags); + DEBUGADD(lvl,("\tflags: 0x%08x %s\n", flags, flags_str)); + SAFE_FREE(flags_str); +} + +NTSTATUS process_gpo_list_with_extension(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + uint32_t flags, + const struct nt_user_token *token, + struct GROUP_POLICY_OBJECT *gpo_list, + const char *extension_guid, + const char *snapin_guid) +{ + return NT_STATUS_OK; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS gpext_process_extension(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + uint32_t flags, + const struct nt_user_token *token, + struct registry_key *root_key, + struct GROUP_POLICY_OBJECT *gpo, + const char *extension_guid, + const char *snapin_guid) +{ + NTSTATUS status; + struct gp_extension *ext = NULL; + struct GUID guid; + bool cse_found = false; + + status = init_gp_extensions(mem_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1,("init_gp_extensions failed: %s\n", + nt_errstr(status))); + return status; + } + + status = GUID_from_string(extension_guid, &guid); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + for (ext = extensions; ext; ext = ext->next) { + + if (GUID_equal(ext->guid, &guid)) { + cse_found = true; + break; + } + } + + if (!cse_found) { + goto no_ext; + } + + status = ext->methods->initialize(mem_ctx); + NT_STATUS_NOT_OK_RETURN(status); + + status = ext->methods->process_group_policy(ads, + mem_ctx, + flags, + root_key, + token, + gpo, + extension_guid, + snapin_guid); + if (!NT_STATUS_IS_OK(status)) { + ext->methods->shutdown(); + } + + return status; + + no_ext: + if (flags & GPO_INFO_FLAG_VERBOSE) { + DEBUG(0,("process_extension: no extension available for:\n")); + DEBUGADD(0,("%s (%s) (snapin: %s)\n", + extension_guid, + cse_gpo_guid_string_to_name(extension_guid), + snapin_guid)); + } + + return NT_STATUS_OK; +} diff --git a/libgpo/gpext/gpext.h b/libgpo/gpext/gpext.h new file mode 100644 index 0000000000..a3f9368f69 --- /dev/null +++ b/libgpo/gpext/gpext.h @@ -0,0 +1,86 @@ +/* + * Unix SMB/CIFS implementation. + * Group Policy Support + * Copyright (C) Guenther Deschner 2007-2008 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#ifndef __GPEXT_H__ +#define __GPEXT_H__ + +#include "librpc/gen_ndr/winreg.h" + +#define KEY_WINLOGON_GPEXT_PATH "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions" + +#define SAMBA_SUBSYSTEM_GPEXT "gpext" + +#define SMB_GPEXT_INTERFACE_VERSION 1 + +struct gp_extension { + struct GUID *guid; + const char *name; + struct gp_extension_methods *methods; + struct gp_extension *prev, *next; +}; + +struct gp_extension_reg_table { + const char *val; + enum winreg_Type type; + const char *data; +}; + +struct gp_extension_reg_entry { + const char *value; + struct registry_value *data; +}; + +struct gp_extension_reg_info_entry { + struct GUID guid; + size_t num_entries; + struct gp_extension_reg_entry *entries; +}; + +struct gp_extension_reg_info { + size_t num_entries; + struct gp_extension_reg_info_entry *entries; +}; + +struct gp_extension_methods { + + NTSTATUS (*initialize)(TALLOC_CTX *mem_ctx); + + NTSTATUS (*process_group_policy)(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + uint32_t flags, + struct registry_key *root_key, + const struct nt_user_token *token, + struct GROUP_POLICY_OBJECT *gpo, + const char *extension_guid, + const char *snapin_guid); + + NTSTATUS (*process_group_policy2)(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + uint32_t flags, + const struct nt_user_token *token, + struct GROUP_POLICY_OBJECT *gpo_list, + const char *extension_guid); + + NTSTATUS (*get_reg_config)(TALLOC_CTX *mem_ctx, + struct gp_extension_reg_info **info); + + NTSTATUS (*shutdown)(void); +}; + +#endif /* __GPEXT_H__ */ diff --git a/libgpo/gpo.h b/libgpo/gpo.h new file mode 100644 index 0000000000..9abf526e14 --- /dev/null +++ b/libgpo/gpo.h @@ -0,0 +1,163 @@ +/* + * Unix SMB/CIFS implementation. + * Group Policy Object Support + * Copyright (C) Guenther Deschner 2005-2008 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#ifndef __GPO_H__ +#define __GPO_H__ + +enum GPO_LINK_TYPE { + GP_LINK_UNKOWN = 0, + GP_LINK_MACHINE = 1, + GP_LINK_SITE = 2, + GP_LINK_DOMAIN = 3, + GP_LINK_OU = 4, + GP_LINK_LOCAL = 5 /* for convenience */ +}; + +/* GPO_OPTIONS */ +#define GPO_FLAG_DISABLE 0x00000001 +#define GPO_FLAG_FORCE 0x00000002 + +/* GPO_LIST_FLAGS */ +#define GPO_LIST_FLAG_MACHINE 0x00000001 +#define GPO_LIST_FLAG_SITEONLY 0x00000002 + +/* following flags from http://support.microsoft.com/kb/312164/EN-US/ */ +#define GPO_INFO_FLAG_MACHINE 0x00000001 +#define GPO_INFO_FLAG_BACKGROUND 0x00000010 +#define GPO_INFO_FLAG_SLOWLINK 0x00000020 +#define GPO_INFO_FLAG_VERBOSE 0x00000040 +#define GPO_INFO_FLAG_NOCHANGES 0x00000080 +#define GPO_INFO_FLAG_LINKTRANSITION 0x00000100 +#define GPO_INFO_FLAG_LOGRSOP_TRANSITION 0x00000200 +#define GPO_INFO_FLAG_FORCED_REFRESH 0x00000400 +#define GPO_INFO_FLAG_SAFEMODE_BOOT 0x00000800 + +#define GPO_VERSION_USER(x) (x >> 16) +#define GPO_VERSION_MACHINE(x) (x & 0xffff) + +struct GROUP_POLICY_OBJECT { + uint32_t options; /* GPFLAGS_* */ + uint32_t version; + const char *ds_path; + const char *file_sys_path; + const char *display_name; + const char *name; + const char *link; + enum GPO_LINK_TYPE link_type; + const char *user_extensions; + const char *machine_extensions; + struct security_descriptor *security_descriptor; + struct GROUP_POLICY_OBJECT *next, *prev; +}; + +/* the following is seen on the DS (see adssearch.pl for details) */ + +/* the type field in a 'gPLink', the same as GPO_FLAG ? */ +#define GPO_LINK_OPT_NONE 0x00000000 +#define GPO_LINK_OPT_DISABLED 0x00000001 +#define GPO_LINK_OPT_ENFORCED 0x00000002 + +/* GPO_LINK_OPT_ENFORCED takes precedence over GPOPTIONS_BLOCK_INHERITANCE */ + +/* 'gPOptions', maybe a bitmask as well */ +enum GPO_INHERIT { + GPOPTIONS_INHERIT = 0, + GPOPTIONS_BLOCK_INHERITANCE = 1 +}; + +/* 'flags' in a 'groupPolicyContainer' object */ +#define GPFLAGS_ALL_ENABLED 0x00000000 +#define GPFLAGS_USER_SETTINGS_DISABLED 0x00000001 +#define GPFLAGS_MACHINE_SETTINGS_DISABLED 0x00000002 +#define GPFLAGS_ALL_DISABLED (GPFLAGS_USER_SETTINGS_DISABLED | \ + GPFLAGS_MACHINE_SETTINGS_DISABLED) + +struct GP_LINK { + const char *gp_link; /* raw link name */ + uint32_t gp_opts; /* inheritance options GPO_INHERIT */ + uint32_t num_links; /* number of links */ + char **link_names; /* array of parsed link names */ + uint32_t *link_opts; /* array of parsed link opts GPO_LINK_OPT_* */ +}; + +struct GP_EXT { + const char *gp_extension; /* raw extension name */ + uint32_t num_exts; + char **extensions; + char **extensions_guid; + char **snapins; + char **snapins_guid; + struct GP_EXT *next, *prev; +}; + +#define GPO_CACHE_DIR "gpo_cache" +#define GPT_INI "GPT.INI" +#define GPO_REFRESH_INTERVAL 60*90 + +#define GPO_REG_STATE_MACHINE "State\\Machine" + +enum gp_reg_action { + GP_REG_ACTION_NONE = 0, + GP_REG_ACTION_ADD_VALUE = 1, + GP_REG_ACTION_ADD_KEY = 2, + GP_REG_ACTION_DEL_VALUES = 3, + GP_REG_ACTION_DEL_VALUE = 4, + GP_REG_ACTION_DEL_ALL_VALUES = 5, + GP_REG_ACTION_DEL_KEYS = 6, + GP_REG_ACTION_SEC_KEY_SET = 7, + GP_REG_ACTION_SEC_KEY_RESET = 8 +}; + +struct gp_registry_entry { + enum gp_reg_action action; + const char *key; + const char *value; + struct registry_value *data; +}; + +struct gp_registry_value { + const char *value; + struct registry_value *data; +}; + +struct gp_registry_entry2 { + enum gp_reg_action action; + const char *key; + size_t num_values; + struct gp_registry_value **values; +}; + +struct gp_registry_entries { + size_t num_entries; + struct gp_registry_entry **entries; +}; + +struct gp_registry_context { + const struct nt_user_token *token; + const char *path; + struct registry_key *curr_key; +}; + +#define GP_EXT_GUID_SECURITY "827D319E-6EAC-11D2-A4EA-00C04F79F83A" +#define GP_EXT_GUID_REGISTRY "35378EAC-683F-11D2-A89A-00C04FBBCFA2" +#define GP_EXT_GUID_SCRIPTS "42B5FAAE-6536-11D2-AE5A-0000F87571E3" + +#include "../libgpo/gpext/gpext.h" + +#endif diff --git a/libgpo/gpo_util.c b/libgpo/gpo_util.c new file mode 100644 index 0000000000..505400be8c --- /dev/null +++ b/libgpo/gpo_util.c @@ -0,0 +1,872 @@ +/* + * Unix SMB/CIFS implementation. + * Group Policy Object Support + * Copyright (C) Guenther Deschner 2005-2008 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see . + */ + +#include "includes.h" +#include "../libgpo/gpo.h" +#undef strdup + +#define DEFAULT_DOMAIN_POLICY "Default Domain Policy" +#define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy" + +/* should we store a parsed guid ? */ +struct gp_table { + const char *name; + const char *guid_string; +}; + +#if 0 /* unused */ +static struct gp_table gpo_default_policy[] = { + { DEFAULT_DOMAIN_POLICY, + "31B2F340-016D-11D2-945F-00C04FB984F9" }, + { DEFAULT_DOMAIN_CONTROLLERS_POLICY, + "6AC1786C-016F-11D2-945F-00C04fB984F9" }, + { NULL, NULL } +}; +#endif + +/* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */ + +static struct gp_table gpo_cse_extensions[] = { + /* used to be "Administrative Templates Extension" */ + /* "Registry Settings" + (http://support.microsoft.com/kb/216357/EN-US/) */ + { "Registry Settings", + GP_EXT_GUID_REGISTRY }, + { "Microsoft Disc Quota", + "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" }, + { "EFS recovery", + "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" }, + { "Folder Redirection", + "25537BA6-77A8-11D2-9B6C-0000F8080861" }, + { "IP Security", + "E437BC1C-AA7D-11D2-A382-00C04F991E27" }, + { "Internet Explorer Branding", + "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" }, + { "QoS Packet Scheduler", + "426031c0-0b47-4852-b0ca-ac3d37bfcb39" }, + { "Scripts", + GP_EXT_GUID_SCRIPTS }, + { "Security", + GP_EXT_GUID_SECURITY }, + { "Software Installation", + "C6DC5466-785A-11D2-84D0-00C04FB169F7" }, + { "Wireless Group Policy", + "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" }, + { "Application Management", + "C6DC5466-785A-11D2-84D0-00C04FB169F7" }, + { "unknown", + "3060E8D0-7020-11D2-842D-00C04FA372D4" }, + { NULL, NULL } +}; + +/* guess work */ +static struct gp_table gpo_cse_snapin_extensions[] = { + { "Administrative Templates", + "0F6B957D-509E-11D1-A7CC-0000F87571E3" }, + { "Certificates", + "53D6AB1D-2488-11D1-A28C-00C04FB94F17" }, + { "EFS recovery policy processing", + "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" }, + { "Folder Redirection policy processing", + "25537BA6-77A8-11D2-9B6C-0000F8080861" }, + { "Folder Redirection", + "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" }, + { "Registry policy processing", + "35378EAC-683F-11D2-A89A-00C04FBBCFA2" }, + { "Remote Installation Services", + "3060E8CE-7020-11D2-842D-00C04FA372D4" }, + { "Security Settings", + "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" }, + { "Security policy processing", + "827D319E-6EAC-11D2-A4EA-00C04F79F83A" }, + { "unknown", + "3060E8D0-7020-11D2-842D-00C04FA372D4" }, + { "unknown2", + "53D6AB1B-2488-11D1-A28C-00C04FB94F17" }, + { NULL, NULL } +}; + +/**************************************************************** +****************************************************************/ + +static const char *name_to_guid_string(const char *name, + struct gp_table *table) +{ + int i; + + for (i = 0; table[i].name; i++) { + if (strequal(name, table[i].name)) { + return table[i].guid_string; + } + } + + return NULL; +} + +/**************************************************************** +****************************************************************/ + +static const char *guid_string_to_name(const char *guid_string, + struct gp_table *table) +{ + int i; + + for (i = 0; table[i].guid_string; i++) { + if (strequal(guid_string, table[i].guid_string)) { + return table[i].name; + } + } + + return NULL; +} + +/**************************************************************** +****************************************************************/ + +static const char *snapin_guid_string_to_name(const char *guid_string, + struct gp_table *table) +{ + int i; + for (i = 0; table[i].guid_string; i++) { + if (strequal(guid_string, table[i].guid_string)) { + return table[i].name; + } + } + return NULL; +} + +#if 0 /* unused */ +static const char *default_gpo_name_to_guid_string(const char *name) +{ + return name_to_guid_string(name, gpo_default_policy); +} + +static const char *default_gpo_guid_string_to_name(const char *guid) +{ + return guid_string_to_name(guid, gpo_default_policy); +} +#endif + +/**************************************************************** +****************************************************************/ + +const char *cse_gpo_guid_string_to_name(const char *guid) +{ + return guid_string_to_name(guid, gpo_cse_extensions); +} + +/**************************************************************** +****************************************************************/ + +const char *cse_gpo_name_to_guid_string(const char *name) +{ + return name_to_guid_string(name, gpo_cse_extensions); +} + +/**************************************************************** +****************************************************************/ + +const char *cse_snapin_gpo_guid_string_to_name(const char *guid) +{ + return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions); +} + +/**************************************************************** +****************************************************************/ + +void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel) +{ + int lvl = debuglevel; + int i; + + if (gp_ext == NULL) { + return; + } + + DEBUG(lvl,("\t---------------------\n\n")); + DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension)); + + for (i=0; i< gp_ext->num_exts; i++) { + + DEBUGADD(lvl,("\textension:\t\t\t%s\n", + gp_ext->extensions_guid[i])); + DEBUGADD(lvl,("\textension (name):\t\t\t%s\n", + gp_ext->extensions[i])); + + DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n", + gp_ext->snapins_guid[i])); + DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n", + gp_ext->snapins[i])); + } +} + +#ifdef HAVE_LDAP + +/**************************************************************** +****************************************************************/ + +void dump_gpo(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + struct GROUP_POLICY_OBJECT *gpo, + int debuglevel) +{ + int lvl = debuglevel; + + if (gpo == NULL) { + return; + } + + DEBUG(lvl,("---------------------\n\n")); + + DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name)); + DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name)); + DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version)); + DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n", + GPO_VERSION_USER(gpo->version), + GPO_VERSION_USER(gpo->version))); + DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n", + GPO_VERSION_MACHINE(gpo->version), + GPO_VERSION_MACHINE(gpo->version))); + DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path)); + DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path)); + + DEBUGADD(lvl,("options:\t\t%d ", gpo->options)); + switch (gpo->options) { + case GPFLAGS_ALL_ENABLED: + DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n")); + break; + case GPFLAGS_USER_SETTINGS_DISABLED: + DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n")); + break; + case GPFLAGS_MACHINE_SETTINGS_DISABLED: + DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n")); + break; + case GPFLAGS_ALL_DISABLED: + DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n")); + break; + default: + DEBUGADD(lvl,("unknown option: %d\n", gpo->options)); + break; + } + + DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link)); + DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type)); + switch (gpo->link_type) { + case GP_LINK_UNKOWN: + DEBUGADD(lvl,("GP_LINK_UNKOWN\n")); + break; + case GP_LINK_OU: + DEBUGADD(lvl,("GP_LINK_OU\n")); + break; + case GP_LINK_DOMAIN: + DEBUGADD(lvl,("GP_LINK_DOMAIN\n")); + break; + case GP_LINK_SITE: + DEBUGADD(lvl,("GP_LINK_SITE\n")); + break; + case GP_LINK_MACHINE: + DEBUGADD(lvl,("GP_LINK_MACHINE\n")); + break; + default: + break; + } + + DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions)); + + if (gpo->machine_extensions) { + + struct GP_EXT *gp_ext = NULL; + + if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions, + &gp_ext)) { + return; + } + dump_gp_ext(gp_ext, lvl); + } + + DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions)); + + if (gpo->user_extensions) { + + struct GP_EXT *gp_ext = NULL; + + if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions, + &gp_ext)) { + return; + } + dump_gp_ext(gp_ext, lvl); + } + + DEBUGADD(lvl,("security descriptor:\n")); + + ads_disp_sd(ads, mem_ctx, gpo->security_descriptor); +} + +/**************************************************************** +****************************************************************/ + +void dump_gpo_list(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + struct GROUP_POLICY_OBJECT *gpo_list, + int debuglevel) +{ + struct GROUP_POLICY_OBJECT *gpo = NULL; + + for (gpo = gpo_list; gpo; gpo = gpo->next) { + dump_gpo(ads, mem_ctx, gpo, debuglevel); + } +} + +/**************************************************************** +****************************************************************/ + +void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link) +{ + ADS_STATUS status; + int i; + int lvl = 10; + + if (gp_link == NULL) { + return; + } + + DEBUG(lvl,("---------------------\n\n")); + + DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link)); + DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts)); + switch (gp_link->gp_opts) { + case GPOPTIONS_INHERIT: + DEBUGADD(lvl,("GPOPTIONS_INHERIT\n")); + break; + case GPOPTIONS_BLOCK_INHERITANCE: + DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n")); + break; + default: + break; + } + + DEBUGADD(lvl,("num links: %d\n", gp_link->num_links)); + + for (i = 0; i < gp_link->num_links; i++) { + + DEBUGADD(lvl,("---------------------\n\n")); + + DEBUGADD(lvl,("link: #%d\n", i + 1)); + DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i])); + + DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i])); + if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) { + DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED ")); + } + if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) { + DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED")); + } + DEBUGADD(lvl,("\n")); + + if (ads != NULL && mem_ctx != NULL) { + + struct GROUP_POLICY_OBJECT gpo; + + status = ads_get_gpo(ads, mem_ctx, + gp_link->link_names[i], + NULL, NULL, &gpo); + if (!ADS_ERR_OK(status)) { + DEBUG(lvl,("get gpo for %s failed: %s\n", + gp_link->link_names[i], + ads_errstr(status))); + return; + } + dump_gpo(ads, mem_ctx, &gpo, lvl); + } + } +} + +#endif /* HAVE_LDAP */ + +/**************************************************************** +****************************************************************/ + +static bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx, + uint32_t flags, + struct GROUP_POLICY_OBJECT *gpo, + struct GP_EXT **gp_ext) +{ + ZERO_STRUCTP(*gp_ext); + + if (flags & GPO_INFO_FLAG_MACHINE) { + + if (gpo->machine_extensions) { + + if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions, + gp_ext)) { + return false; + } + } + } else { + + if (gpo->user_extensions) { + + if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions, + gp_ext)) { + return false; + } + } + } + + return true; +} + +/**************************************************************** +****************************************************************/ + +ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + const struct nt_user_token *token, + struct registry_key *root_key, + struct GROUP_POLICY_OBJECT *gpo, + const char *extension_guid_filter, + uint32_t flags) +{ + struct GP_EXT *gp_ext = NULL; + int i; + + DEBUG(10,("gpo_process_a_gpo: processing gpo %s (%s)\n", + gpo->name, gpo->display_name)); + if (extension_guid_filter) { + DEBUGADD(10,("gpo_process_a_gpo: using filter %s (%s)\n", + extension_guid_filter, + cse_gpo_guid_string_to_name(extension_guid_filter))); + } + + if (!gpo_get_gp_ext_from_gpo(mem_ctx, flags, gpo, &gp_ext)) { + return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); + } + + if (!gp_ext || !gp_ext->num_exts) { + if (flags & GPO_INFO_FLAG_VERBOSE) { + DEBUG(0,("gpo_process_a_gpo: " + "no policies in %s (%s) for this extension\n", + gpo->name, gpo->display_name)); + } + return ADS_SUCCESS; + } + + for (i=0; inum_exts; i++) { + + NTSTATUS ntstatus; + + if (extension_guid_filter && + !strequal(extension_guid_filter, + gp_ext->extensions_guid[i])) { + continue; + } + + ntstatus = gpext_process_extension(ads, mem_ctx, + flags, token, root_key, gpo, + gp_ext->extensions_guid[i], + gp_ext->snapins_guid[i]); + if (!NT_STATUS_IS_OK(ntstatus)) { + ADS_ERROR_NT(ntstatus); + } + } + + return ADS_SUCCESS; +} + +/**************************************************************** +****************************************************************/ + +static ADS_STATUS gpo_process_gpo_list_by_ext(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + const struct nt_user_token *token, + struct registry_key *root_key, + struct GROUP_POLICY_OBJECT *gpo_list, + const char *extensions_guid, + uint32_t flags) +{ + ADS_STATUS status; + struct GROUP_POLICY_OBJECT *gpo; + + for (gpo = gpo_list; gpo; gpo = gpo->next) { + + if (gpo->link_type == GP_LINK_LOCAL) { + continue; + } + + + /* FIXME: we need to pass down the *list* down to the + * extension, otherwise we cannot store the e.g. the *list* of + * logon-scripts correctly (for more then one GPO) */ + + status = gpo_process_a_gpo(ads, mem_ctx, token, root_key, + gpo, extensions_guid, flags); + + if (!ADS_ERR_OK(status)) { + DEBUG(0,("failed to process gpo by ext: %s\n", + ads_errstr(status))); + return status; + } + } + + return ADS_SUCCESS; +} + +/**************************************************************** +****************************************************************/ + +ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + const struct nt_user_token *token, + struct GROUP_POLICY_OBJECT *gpo_list, + const char *extensions_guid_filter, + uint32_t flags) +{ + ADS_STATUS status = ADS_SUCCESS; + struct gp_extension *gp_ext_list = NULL; + struct gp_extension *gp_ext = NULL; + struct registry_key *root_key = NULL; + struct gp_registry_context *reg_ctx = NULL; + WERROR werr; + + status = ADS_ERROR_NT(init_gp_extensions(mem_ctx)); + if (!ADS_ERR_OK(status)) { + return status; + } + + gp_ext_list = get_gp_extension_list(); + if (!gp_ext_list) { + return ADS_ERROR_NT(NT_STATUS_DLL_INIT_FAILED); + } + + /* get the key here */ + if (flags & GPO_LIST_FLAG_MACHINE) { + werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE, + get_system_token(), + ®_ctx); + } else { + werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE, + token, + ®_ctx); + } + if (!W_ERROR_IS_OK(werr)) { + gp_free_reg_ctx(reg_ctx); + return ADS_ERROR_NT(werror_to_ntstatus(werr)); + } + + root_key = reg_ctx->curr_key; + + for (gp_ext = gp_ext_list; gp_ext; gp_ext = gp_ext->next) { + + const char *guid_str = NULL; + + guid_str = GUID_string(mem_ctx, gp_ext->guid); + if (!guid_str) { + status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); + goto done; + } + + if (extensions_guid_filter && + (!strequal(guid_str, extensions_guid_filter))) { + continue; + } + + DEBUG(0,("-------------------------------------------------\n")); + DEBUG(0,("gpo_process_gpo_list: processing ext: %s {%s}\n", + gp_ext->name, guid_str)); + + + status = gpo_process_gpo_list_by_ext(ads, mem_ctx, token, + root_key, gpo_list, + guid_str, flags); + if (!ADS_ERR_OK(status)) { + goto done; + } + } + + done: + gp_free_reg_ctx(reg_ctx); + TALLOC_FREE(root_key); + free_gp_extensions(); + + return status; +} + + +/**************************************************************** + check wether the version number in a GROUP_POLICY_OBJECT match those of the + locally stored version. If not, fetch the required policy via CIFS +****************************************************************/ + +NTSTATUS check_refresh_gpo(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + uint32_t flags, + struct GROUP_POLICY_OBJECT *gpo, + struct cli_state **cli_out) +{ + NTSTATUS result; + char *server = NULL; + char *share = NULL; + char *nt_path = NULL; + char *unix_path = NULL; + uint32_t sysvol_gpt_version = 0; + char *display_name = NULL; + struct cli_state *cli = NULL; + + result = gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path, + &server, &share, &nt_path, &unix_path); + + if (!NT_STATUS_IS_OK(result)) { + goto out; + } + + result = gpo_get_sysvol_gpt_version(mem_ctx, + unix_path, + &sysvol_gpt_version, + &display_name); + if (!NT_STATUS_IS_OK(result) && + !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) { + DEBUG(10,("check_refresh_gpo: " + "failed to get local gpt version: %s\n", + nt_errstr(result))); + goto out; + } + + DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n", + gpo->version, sysvol_gpt_version)); + + /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */ + + while (gpo->version > sysvol_gpt_version) { + + DEBUG(1,("check_refresh_gpo: need to refresh GPO\n")); + + if (*cli_out == NULL) { + + result = cli_full_connection(&cli, + global_myname(), + ads->config.ldap_server_name, + /* server */ + NULL, 0, + share, "A:", + ads->auth.user_name, NULL, + ads->auth.password, + CLI_FULL_CONNECTION_USE_KERBEROS | + CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS, + Undefined, NULL); + if (!NT_STATUS_IS_OK(result)) { + DEBUG(10,("check_refresh_gpo: " + "failed to connect: %s\n", + nt_errstr(result))); + goto out; + } + + *cli_out = cli; + } + + result = gpo_fetch_files(mem_ctx, *cli_out, gpo); + if (!NT_STATUS_IS_OK(result)) { + goto out; + } + + result = gpo_get_sysvol_gpt_version(mem_ctx, + unix_path, + &sysvol_gpt_version, + &display_name); + if (!NT_STATUS_IS_OK(result)) { + DEBUG(10,("check_refresh_gpo: " + "failed to get local gpt version: %s\n", + nt_errstr(result))); + goto out; + } + + if (gpo->version == sysvol_gpt_version) { + break; + } + } + + DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name)); + DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n", + sysvol_gpt_version, + GPO_VERSION_USER(sysvol_gpt_version), + GPO_VERSION_MACHINE(sysvol_gpt_version))); + DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n", + gpo->version, + GPO_VERSION_USER(gpo->version), + GPO_VERSION_MACHINE(gpo->version))); + DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link)); + + result = NT_STATUS_OK; + + out: + return result; + +} + +/**************************************************************** + check wether the version numbers in the gpo_list match the locally stored, if + not, go and get each required GPO via CIFS + ****************************************************************/ + +NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + uint32_t flags, + struct GROUP_POLICY_OBJECT *gpo_list) +{ + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + struct cli_state *cli = NULL; + struct GROUP_POLICY_OBJECT *gpo; + + if (!gpo_list) { + return NT_STATUS_INVALID_PARAMETER; + } + + for (gpo = gpo_list; gpo; gpo = gpo->next) { + + result = check_refresh_gpo(ads, mem_ctx, flags, gpo, &cli); + if (!NT_STATUS_IS_OK(result)) { + goto out; + } + } + + result = NT_STATUS_OK; + + out: + if (cli) { + cli_shutdown(cli); + } + + return result; +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx, + struct GROUP_POLICY_OBJECT *gpo, + char **unix_path) +{ + char *server, *share, *nt_path; + return gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path, + &server, &share, &nt_path, unix_path); +} + +/**************************************************************** +****************************************************************/ + +char *gpo_flag_str(uint32_t flags) +{ + fstring str = ""; + + if (flags == 0) { + return NULL; + } + + if (flags & GPO_INFO_FLAG_SLOWLINK) + fstrcat(str, "GPO_INFO_FLAG_SLOWLINK "); + if (flags & GPO_INFO_FLAG_VERBOSE) + fstrcat(str, "GPO_INFO_FLAG_VERBOSE "); + if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT) + fstrcat(str, "GPO_INFO_FLAG_SAFEMODE_BOOT "); + if (flags & GPO_INFO_FLAG_NOCHANGES) + fstrcat(str, "GPO_INFO_FLAG_NOCHANGES "); + if (flags & GPO_INFO_FLAG_MACHINE) + fstrcat(str, "GPO_INFO_FLAG_MACHINE "); + if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION) + fstrcat(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION "); + if (flags & GPO_INFO_FLAG_LINKTRANSITION) + fstrcat(str, "GPO_INFO_FLAG_LINKTRANSITION "); + if (flags & GPO_INFO_FLAG_FORCED_REFRESH) + fstrcat(str, "GPO_INFO_FLAG_FORCED_REFRESH "); + if (flags & GPO_INFO_FLAG_BACKGROUND) + fstrcat(str, "GPO_INFO_FLAG_BACKGROUND "); + + return strdup(str); +} + +/**************************************************************** +****************************************************************/ + +NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx, + uint32_t flags, + const char *filename, + const char *suffix, + const char **filename_out) +{ + const char *tmp = NULL; + struct stat sbuf; + const char *path = NULL; + + if (flags & GPO_LIST_FLAG_MACHINE) { + path = "Machine"; + } else { + path = "User"; + } + + tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename, + path, suffix); + NT_STATUS_HAVE_NO_MEMORY(tmp); + + if (stat(tmp, &sbuf) == 0) { + *filename_out = tmp; + return NT_STATUS_OK; + } + + path = talloc_strdup_upper(mem_ctx, path); + NT_STATUS_HAVE_NO_MEMORY(path); + + tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename, + path, suffix); + NT_STATUS_HAVE_NO_MEMORY(tmp); + + if (sys_stat(tmp, &sbuf) == 0) { + *filename_out = tmp; + return NT_STATUS_OK; + } + + return NT_STATUS_NO_SUCH_FILE; +} + +/**************************************************************** +****************************************************************/ + +ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads, + TALLOC_CTX *mem_ctx, + const char *dn, + struct nt_user_token **token) +{ + struct nt_user_token *ad_token = NULL; + ADS_STATUS status; + NTSTATUS ntstatus; + +#ifndef HAVE_ADS + return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED); +#endif + status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token); + if (!ADS_ERR_OK(status)) { + return status; + } + + ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(), + token); + if (!NT_STATUS_IS_OK(ntstatus)) { + return ADS_ERROR_NT(ntstatus); + } + + return ADS_SUCCESS; +} diff --git a/source3/Makefile.in b/source3/Makefile.in index b47c6e91b2..425d5f1c3b 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -409,9 +409,9 @@ LIBADDNS_OBJ0 = libaddns/dnsrecord.o libaddns/dnsutils.o libaddns/dnssock.o \ libaddns/dnsgss.o libaddns/dnsmarshall.o LIBADDNS_OBJ = $(LIBADDNS_OBJ0) $(SOCKET_WRAPPER_OBJ) -GPEXT_OBJ = libgpo/gpext/gpext.o @GPEXT_STATIC@ +GPEXT_OBJ = ../libgpo/gpext/gpext.o @GPEXT_STATIC@ -LIBGPO_OBJ0 = libgpo/gpo_ldap.o libgpo/gpo_ini.o libgpo/gpo_util.o \ +LIBGPO_OBJ0 = libgpo/gpo_ldap.o libgpo/gpo_ini.o ../libgpo/gpo_util.o \ libgpo/gpo_fetch.o libgpo/gpo_filesync.o libgpo/gpo_sec.o \ libgpo/gpo_reg.o \ $(GPEXT_OBJ) diff --git a/source3/include/gpo.h b/source3/include/gpo.h deleted file mode 100644 index bf5ff6a598..0000000000 --- a/source3/include/gpo.h +++ /dev/null @@ -1,158 +0,0 @@ -/* - * Unix SMB/CIFS implementation. - * Group Policy Object Support - * Copyright (C) Guenther Deschner 2005-2008 - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -enum GPO_LINK_TYPE { - GP_LINK_UNKOWN = 0, - GP_LINK_MACHINE = 1, - GP_LINK_SITE = 2, - GP_LINK_DOMAIN = 3, - GP_LINK_OU = 4, - GP_LINK_LOCAL = 5 /* for convenience */ -}; - -/* GPO_OPTIONS */ -#define GPO_FLAG_DISABLE 0x00000001 -#define GPO_FLAG_FORCE 0x00000002 - -/* GPO_LIST_FLAGS */ -#define GPO_LIST_FLAG_MACHINE 0x00000001 -#define GPO_LIST_FLAG_SITEONLY 0x00000002 - -/* following flags from http://support.microsoft.com/kb/312164/EN-US/ */ -#define GPO_INFO_FLAG_MACHINE 0x00000001 -#define GPO_INFO_FLAG_BACKGROUND 0x00000010 -#define GPO_INFO_FLAG_SLOWLINK 0x00000020 -#define GPO_INFO_FLAG_VERBOSE 0x00000040 -#define GPO_INFO_FLAG_NOCHANGES 0x00000080 -#define GPO_INFO_FLAG_LINKTRANSITION 0x00000100 -#define GPO_INFO_FLAG_LOGRSOP_TRANSITION 0x00000200 -#define GPO_INFO_FLAG_FORCED_REFRESH 0x00000400 -#define GPO_INFO_FLAG_SAFEMODE_BOOT 0x00000800 - -#define GPO_VERSION_USER(x) (x >> 16) -#define GPO_VERSION_MACHINE(x) (x & 0xffff) - -struct GROUP_POLICY_OBJECT { - uint32_t options; /* GPFLAGS_* */ - uint32_t version; - const char *ds_path; - const char *file_sys_path; - const char *display_name; - const char *name; - const char *link; - enum GPO_LINK_TYPE link_type; - const char *user_extensions; - const char *machine_extensions; - SEC_DESC *security_descriptor; - struct GROUP_POLICY_OBJECT *next, *prev; -}; - -/* the following is seen on the DS (see adssearch.pl for details) */ - -/* the type field in a 'gPLink', the same as GPO_FLAG ? */ -#define GPO_LINK_OPT_NONE 0x00000000 -#define GPO_LINK_OPT_DISABLED 0x00000001 -#define GPO_LINK_OPT_ENFORCED 0x00000002 - -/* GPO_LINK_OPT_ENFORCED takes precedence over GPOPTIONS_BLOCK_INHERITANCE */ - -/* 'gPOptions', maybe a bitmask as well */ -enum GPO_INHERIT { - GPOPTIONS_INHERIT = 0, - GPOPTIONS_BLOCK_INHERITANCE = 1 -}; - -/* 'flags' in a 'groupPolicyContainer' object */ -#define GPFLAGS_ALL_ENABLED 0x00000000 -#define GPFLAGS_USER_SETTINGS_DISABLED 0x00000001 -#define GPFLAGS_MACHINE_SETTINGS_DISABLED 0x00000002 -#define GPFLAGS_ALL_DISABLED (GPFLAGS_USER_SETTINGS_DISABLED | \ - GPFLAGS_MACHINE_SETTINGS_DISABLED) - -struct GP_LINK { - const char *gp_link; /* raw link name */ - uint32_t gp_opts; /* inheritance options GPO_INHERIT */ - uint32_t num_links; /* number of links */ - char **link_names; /* array of parsed link names */ - uint32_t *link_opts; /* array of parsed link opts GPO_LINK_OPT_* */ -}; - -struct GP_EXT { - const char *gp_extension; /* raw extension name */ - uint32_t num_exts; - char **extensions; - char **extensions_guid; - char **snapins; - char **snapins_guid; - struct GP_EXT *next, *prev; -}; - -#define GPO_CACHE_DIR "gpo_cache" -#define GPT_INI "GPT.INI" -#define GPO_REFRESH_INTERVAL 60*90 - -#define GPO_REG_STATE_MACHINE "State\\Machine" - -enum gp_reg_action { - GP_REG_ACTION_NONE = 0, - GP_REG_ACTION_ADD_VALUE = 1, - GP_REG_ACTION_ADD_KEY = 2, - GP_REG_ACTION_DEL_VALUES = 3, - GP_REG_ACTION_DEL_VALUE = 4, - GP_REG_ACTION_DEL_ALL_VALUES = 5, - GP_REG_ACTION_DEL_KEYS = 6, - GP_REG_ACTION_SEC_KEY_SET = 7, - GP_REG_ACTION_SEC_KEY_RESET = 8 -}; - -struct gp_registry_entry { - enum gp_reg_action action; - const char *key; - const char *value; - struct registry_value *data; -}; - -struct gp_registry_value { - const char *value; - struct registry_value *data; -}; - -struct gp_registry_entry2 { - enum gp_reg_action action; - const char *key; - size_t num_values; - struct gp_registry_value **values; -}; - -struct gp_registry_entries { - size_t num_entries; - struct gp_registry_entry **entries; -}; - -struct gp_registry_context { - const struct nt_user_token *token; - const char *path; - struct registry_key *curr_key; -}; - -#define GP_EXT_GUID_SECURITY "827D319E-6EAC-11D2-A4EA-00C04F79F83A" -#define GP_EXT_GUID_REGISTRY "35378EAC-683F-11D2-A89A-00C04FBBCFA2" -#define GP_EXT_GUID_SCRIPTS "42B5FAAE-6536-11D2-AE5A-0000F87571E3" - -#include "libgpo/gpext/gpext.h" diff --git a/source3/include/includes.h b/source3/include/includes.h index 10319b7429..943de8db7b 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -609,7 +609,7 @@ struct smb_iconv_convenience *lp_iconv_convenience(void *lp_ctx); #include "mapping.h" #include "passdb.h" #include "rpc_secdes.h" -#include "gpo.h" +#include "../libgpo/gpo.h" #include "authdata.h" #include "msdfs.h" #include "rap.h" diff --git a/source3/libgpo/gpext/gpext.c b/source3/libgpo/gpext/gpext.c deleted file mode 100644 index ee4ce87c4e..0000000000 --- a/source3/libgpo/gpext/gpext.c +++ /dev/null @@ -1,746 +0,0 @@ -/* - * Unix SMB/CIFS implementation. - * Group Policy Support - * Copyright (C) Guenther Deschner 2007-2008 - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#include "includes.h" - -static struct gp_extension *extensions = NULL; - -/**************************************************************** -****************************************************************/ - -struct gp_extension *get_gp_extension_list(void) -{ - return extensions; -} - -/**************************************************************** -****************************************************************/ - -/* see http://support.microsoft.com/kb/216358/en-us/ for more info */ - -struct gp_extension_reg_table gpext_reg_vals[] = { - { "DllName", REG_EXPAND_SZ }, - { "ProcessGroupPolicy", REG_SZ }, - { "NoMachinePolicy", REG_DWORD }, - { "NoUserPolicy", REG_DWORD }, - { "NoSlowLink", REG_DWORD }, - { "NoBackgroundPolicy", REG_DWORD }, - { "NoGPOListChanges", REG_DWORD }, - { "PerUserLocalSettings", REG_DWORD }, - { "RequiresSuccessfulRegistry", REG_DWORD }, - { "EnableAsynchronousProcessing", REG_DWORD }, - { "ExtensionDebugLevel", REG_DWORD }, - /* new */ - { "GenerateGroupPolicy", REG_SZ }, /* not supported on w2k */ - { "NotifyLinkTransition", REG_DWORD }, - { "ProcessGroupPolicyEx", REG_SZ }, /* not supported on w2k */ - { "ExtensionEventSource", REG_MULTI_SZ }, /* not supported on w2k */ - { "GenerateGroupPolicy", REG_SZ }, - { "MaxNoGPOListChangesInterval", REG_DWORD }, - { NULL, REG_NONE } -}; - -/**************************************************************** -****************************************************************/ - -static struct gp_extension *get_extension_by_name(struct gp_extension *be, - const char *name) -{ - struct gp_extension *b; - - for (b = be; b; b = b->next) { - if (strequal(b->name, name)) { - return b; - } - } - - return NULL; -} - -/**************************************************************** -****************************************************************/ - -static struct gp_extension_methods *get_methods_by_name(struct gp_extension *be, - const char *name) -{ - struct gp_extension *b; - - for (b = be; b; b = b->next) { - if (strequal(b->name, name)) { - return b->methods; - } - } - - return NULL; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS unregister_gp_extension(const char *name) -{ - struct gp_extension *ext; - - ext = get_extension_by_name(extensions, name); - if (!ext) { - return NT_STATUS_OK; - } - - DLIST_REMOVE(extensions, ext); - TALLOC_FREE(ext); - - DEBUG(2,("Successfully removed GP extension '%s'\n", name)); - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS register_gp_extension(TALLOC_CTX *gpext_ctx, - int version, - const char *name, - const char *guid, - struct gp_extension_methods *methods) -{ - struct gp_extension_methods *test; - struct gp_extension *entry; - NTSTATUS status; - - if (!gpext_ctx) { - return NT_STATUS_INTERNAL_DB_ERROR; - } - - if ((version != SMB_GPEXT_INTERFACE_VERSION)) { - DEBUG(0,("Failed to register gp extension.\n" - "The module was compiled against " - "SMB_GPEXT_INTERFACE_VERSION %d,\n" - "current SMB_GPEXT_INTERFACE_VERSION is %d.\n" - "Please recompile against the current " - "version of samba!\n", - version, SMB_GPEXT_INTERFACE_VERSION)); - return NT_STATUS_OBJECT_TYPE_MISMATCH; - } - - if (!guid || !name || !name[0] || !methods) { - DEBUG(0,("Called with NULL pointer or empty name!\n")); - return NT_STATUS_INVALID_PARAMETER; - } - - test = get_methods_by_name(extensions, name); - if (test) { - DEBUG(0,("GP extension module %s already registered!\n", - name)); - return NT_STATUS_OBJECT_NAME_COLLISION; - } - - entry = TALLOC_ZERO_P(gpext_ctx, struct gp_extension); - NT_STATUS_HAVE_NO_MEMORY(entry); - - entry->name = talloc_strdup(gpext_ctx, name); - NT_STATUS_HAVE_NO_MEMORY(entry->name); - - entry->guid = TALLOC_ZERO_P(gpext_ctx, struct GUID); - NT_STATUS_HAVE_NO_MEMORY(entry->guid); - status = GUID_from_string(guid, entry->guid); - NT_STATUS_NOT_OK_RETURN(status); - - entry->methods = methods; - DLIST_ADD(extensions, entry); - - DEBUG(2,("Successfully added GP extension '%s' %s\n", - name, GUID_string2(gpext_ctx, entry->guid))); - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -static NTSTATUS gp_extension_init_module(TALLOC_CTX *mem_ctx, - const char *name, - struct gp_extension **gpext) -{ - NTSTATUS status; - struct gp_extension *ext = NULL; - - ext = TALLOC_ZERO_P(mem_ctx, struct gp_extension); - NT_STATUS_HAVE_NO_MEMORY(gpext); - - ext->methods = get_methods_by_name(extensions, name); - if (!ext->methods) { - - status = smb_probe_module(SAMBA_SUBSYSTEM_GPEXT, - name); - if (!NT_STATUS_IS_OK(status)) { - return status; - } - - ext->methods = get_methods_by_name(extensions, name); - if (!ext->methods) { - return NT_STATUS_DLL_INIT_FAILED; - } - } - - *gpext = ext; - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -static bool add_gp_extension_reg_entry_to_array(TALLOC_CTX *mem_ctx, - struct gp_extension_reg_entry *entry, - struct gp_extension_reg_entry **entries, - size_t *num) -{ - *entries = TALLOC_REALLOC_ARRAY(mem_ctx, *entries, - struct gp_extension_reg_entry, - (*num)+1); - if (*entries == NULL) { - *num = 0; - return false; - } - - (*entries)[*num].value = entry->value; - (*entries)[*num].data = entry->data; - - *num += 1; - return true; -} - -/**************************************************************** -****************************************************************/ - -static bool add_gp_extension_reg_info_entry_to_array(TALLOC_CTX *mem_ctx, - struct gp_extension_reg_info_entry *entry, - struct gp_extension_reg_info_entry **entries, - size_t *num) -{ - *entries = TALLOC_REALLOC_ARRAY(mem_ctx, *entries, - struct gp_extension_reg_info_entry, - (*num)+1); - if (*entries == NULL) { - *num = 0; - return false; - } - - (*entries)[*num].guid = entry->guid; - (*entries)[*num].num_entries = entry->num_entries; - (*entries)[*num].entries = entry->entries; - - *num += 1; - return true; -} - -/**************************************************************** -****************************************************************/ - -static NTSTATUS gp_ext_info_add_reg(TALLOC_CTX *mem_ctx, - struct gp_extension_reg_info_entry *entry, - const char *value, - enum winreg_Type type, - const char *data_s) -{ - struct gp_extension_reg_entry *reg_entry = NULL; - struct registry_value *data = NULL; - - reg_entry = TALLOC_ZERO_P(mem_ctx, struct gp_extension_reg_entry); - NT_STATUS_HAVE_NO_MEMORY(reg_entry); - - data = TALLOC_ZERO_P(mem_ctx, struct registry_value); - NT_STATUS_HAVE_NO_MEMORY(data); - - data->type = type; - - switch (type) { - case REG_SZ: - case REG_EXPAND_SZ: - data->v.sz.str = talloc_strdup(mem_ctx, data_s); - NT_STATUS_HAVE_NO_MEMORY(data->v.sz.str); - data->v.sz.len = strlen(data_s); - break; - case REG_DWORD: - data->v.dword = atoi(data_s); - break; - default: - return NT_STATUS_NOT_SUPPORTED; - } - - reg_entry->value = value; - reg_entry->data = data; - - if (!add_gp_extension_reg_entry_to_array(mem_ctx, reg_entry, - &entry->entries, - &entry->num_entries)) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -static NTSTATUS gp_ext_info_add_reg_table(TALLOC_CTX *mem_ctx, - const char *module, - struct gp_extension_reg_info_entry *entry, - struct gp_extension_reg_table *table) -{ - NTSTATUS status; - const char *module_name = NULL; - int i; - - module_name = talloc_asprintf(mem_ctx, "%s.%s", module, shlib_ext()); - NT_STATUS_HAVE_NO_MEMORY(module_name); - - status = gp_ext_info_add_reg(mem_ctx, entry, - "DllName", REG_EXPAND_SZ, module_name); - NT_STATUS_NOT_OK_RETURN(status); - - for (i=0; table[i].val; i++) { - status = gp_ext_info_add_reg(mem_ctx, entry, - table[i].val, - table[i].type, - table[i].data); - NT_STATUS_NOT_OK_RETURN(status); - } - - return status; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS gp_ext_info_add_entry(TALLOC_CTX *mem_ctx, - const char *module, - const char *ext_guid, - struct gp_extension_reg_table *table, - struct gp_extension_reg_info *info) -{ - NTSTATUS status; - struct gp_extension_reg_info_entry *entry = NULL; - - entry = TALLOC_ZERO_P(mem_ctx, struct gp_extension_reg_info_entry); - NT_STATUS_HAVE_NO_MEMORY(entry); - - status = GUID_from_string(ext_guid, &entry->guid); - NT_STATUS_NOT_OK_RETURN(status); - - status = gp_ext_info_add_reg_table(mem_ctx, module, entry, table); - NT_STATUS_NOT_OK_RETURN(status); - - if (!add_gp_extension_reg_info_entry_to_array(mem_ctx, entry, - &info->entries, - &info->num_entries)) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -static bool gp_extension_reg_info_verify_entry(struct gp_extension_reg_entry *entry) -{ - int i; - - for (i=0; gpext_reg_vals[i].val; i++) { - - if ((strequal(entry->value, gpext_reg_vals[i].val)) && - (entry->data->type == gpext_reg_vals[i].type)) { - return true; - } - } - - return false; -} - -/**************************************************************** -****************************************************************/ - -static bool gp_extension_reg_info_verify(struct gp_extension_reg_info_entry *entry) -{ - int i; - - for (i=0; i < entry->num_entries; i++) { - if (!gp_extension_reg_info_verify_entry(&entry->entries[i])) { - return false; - } - } - - return true; -} - -/**************************************************************** -****************************************************************/ - -static WERROR gp_extension_store_reg_vals(TALLOC_CTX *mem_ctx, - struct registry_key *key, - struct gp_extension_reg_info_entry *entry) -{ - WERROR werr = WERR_OK; - size_t i; - - for (i=0; i < entry->num_entries; i++) { - - werr = reg_setvalue(key, - entry->entries[i].value, - entry->entries[i].data); - W_ERROR_NOT_OK_RETURN(werr); - } - - return werr; -} - -/**************************************************************** -****************************************************************/ - -static WERROR gp_extension_store_reg_entry(TALLOC_CTX *mem_ctx, - struct gp_registry_context *reg_ctx, - struct gp_extension_reg_info_entry *entry) -{ - WERROR werr; - struct registry_key *key = NULL; - const char *subkeyname = NULL; - - if (!gp_extension_reg_info_verify(entry)) { - return WERR_INVALID_PARAM; - } - - subkeyname = GUID_string2(mem_ctx, &entry->guid); - W_ERROR_HAVE_NO_MEMORY(subkeyname); - - strupper_m(CONST_DISCARD(char *,subkeyname)); - - werr = gp_store_reg_subkey(mem_ctx, - subkeyname, - reg_ctx->curr_key, - &key); - W_ERROR_NOT_OK_RETURN(werr); - - werr = gp_extension_store_reg_vals(mem_ctx, - key, - entry); - W_ERROR_NOT_OK_RETURN(werr); - - return werr; -} - -/**************************************************************** -****************************************************************/ - -static WERROR gp_extension_store_reg(TALLOC_CTX *mem_ctx, - struct gp_registry_context *reg_ctx, - struct gp_extension_reg_info *info) -{ - WERROR werr = WERR_OK; - int i; - - if (!info) { - return WERR_OK; - } - - for (i=0; i < info->num_entries; i++) { - werr = gp_extension_store_reg_entry(mem_ctx, - reg_ctx, - &info->entries[i]); - W_ERROR_NOT_OK_RETURN(werr); - } - - return werr; -} - -/**************************************************************** -****************************************************************/ - -static NTSTATUS gp_glob_ext_list(TALLOC_CTX *mem_ctx, - const char ***ext_list, - size_t *ext_list_len) -{ - SMB_STRUCT_DIR *dir = NULL; - SMB_STRUCT_DIRENT *dirent = NULL; - - dir = sys_opendir(modules_path(SAMBA_SUBSYSTEM_GPEXT)); - if (!dir) { - return map_nt_error_from_unix(errno); - } - - while ((dirent = sys_readdir(dir))) { - - fstring name; /* forgive me... */ - char *p; - - if ((strequal(dirent->d_name, ".")) || - (strequal(dirent->d_name, ".."))) { - continue; - } - - p = strrchr(dirent->d_name, '.'); - if (!p) { - sys_closedir(dir); - return NT_STATUS_NO_MEMORY; - } - - if (!strcsequal(p+1, shlib_ext())) { - DEBUG(10,("gp_glob_ext_list: not a *.so file: %s\n", - dirent->d_name)); - continue; - } - - fstrcpy(name, dirent->d_name); - name[PTR_DIFF(p, dirent->d_name)] = 0; - - if (!add_string_to_array(mem_ctx, name, ext_list, - (int *)ext_list_len)) { - sys_closedir(dir); - return NT_STATUS_NO_MEMORY; - } - } - - sys_closedir(dir); - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS shutdown_gp_extensions(void) -{ - struct gp_extension *ext = NULL; - - for (ext = extensions; ext; ext = ext->next) { - if (ext->methods && ext->methods->shutdown) { - ext->methods->shutdown(); - } - } - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS init_gp_extensions(TALLOC_CTX *mem_ctx) -{ - NTSTATUS status; - WERROR werr; - int i = 0; - const char **ext_array = NULL; - size_t ext_array_len = 0; - struct gp_extension *gpext = NULL; - struct gp_registry_context *reg_ctx = NULL; - - if (get_gp_extension_list()) { - return NT_STATUS_OK; - } - - status = gp_glob_ext_list(mem_ctx, &ext_array, &ext_array_len); - NT_STATUS_NOT_OK_RETURN(status); - - for (i=0; imethods->get_reg_config) { - - status = gpext->methods->initialize(mem_ctx); - if (!NT_STATUS_IS_OK(status)) { - gpext->methods->shutdown(); - goto out; - } - - status = gpext->methods->get_reg_config(mem_ctx, - &info); - if (!NT_STATUS_IS_OK(status)) { - gpext->methods->shutdown(); - goto out; - } - - if (!reg_ctx) { - struct nt_user_token *token; - - token = registry_create_system_token(mem_ctx); - NT_STATUS_HAVE_NO_MEMORY(token); - - werr = gp_init_reg_ctx(mem_ctx, - KEY_WINLOGON_GPEXT_PATH, - REG_KEY_WRITE, - token, - ®_ctx); - if (!W_ERROR_IS_OK(werr)) { - status = werror_to_ntstatus(werr); - gpext->methods->shutdown(); - goto out; - } - } - - werr = gp_extension_store_reg(mem_ctx, reg_ctx, info); - if (!W_ERROR_IS_OK(werr)) { - DEBUG(1,("gp_extension_store_reg failed: %s\n", - win_errstr(werr))); - TALLOC_FREE(info); - gpext->methods->shutdown(); - status = werror_to_ntstatus(werr); - goto out; - } - TALLOC_FREE(info); - } - - } - - out: - TALLOC_FREE(reg_ctx); - - return status; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS free_gp_extensions(void) -{ - struct gp_extension *ext, *ext_next = NULL; - - for (ext = extensions; ext; ext = ext_next) { - ext_next = ext->next; - DLIST_REMOVE(extensions, ext); - TALLOC_FREE(ext); - } - - extensions = NULL; - - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -void debug_gpext_header(int lvl, - const char *name, - uint32_t flags, - struct GROUP_POLICY_OBJECT *gpo, - const char *extension_guid, - const char *snapin_guid) -{ - char *flags_str = NULL; - - DEBUG(lvl,("%s\n", name)); - DEBUGADD(lvl,("\tgpo: %s (%s)\n", gpo->name, - gpo->display_name)); - DEBUGADD(lvl,("\tcse extension: %s (%s)\n", extension_guid, - cse_gpo_guid_string_to_name(extension_guid))); - DEBUGADD(lvl,("\tgplink: %s\n", gpo->link)); - DEBUGADD(lvl,("\tsnapin: %s (%s)\n", snapin_guid, - cse_snapin_gpo_guid_string_to_name(snapin_guid))); - - flags_str = gpo_flag_str(flags); - DEBUGADD(lvl,("\tflags: 0x%08x %s\n", flags, flags_str)); - SAFE_FREE(flags_str); -} - -NTSTATUS process_gpo_list_with_extension(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - uint32_t flags, - const struct nt_user_token *token, - struct GROUP_POLICY_OBJECT *gpo_list, - const char *extension_guid, - const char *snapin_guid) -{ - return NT_STATUS_OK; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS gpext_process_extension(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - uint32_t flags, - const struct nt_user_token *token, - struct registry_key *root_key, - struct GROUP_POLICY_OBJECT *gpo, - const char *extension_guid, - const char *snapin_guid) -{ - NTSTATUS status; - struct gp_extension *ext = NULL; - struct GUID guid; - bool cse_found = false; - - status = init_gp_extensions(mem_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(1,("init_gp_extensions failed: %s\n", - nt_errstr(status))); - return status; - } - - status = GUID_from_string(extension_guid, &guid); - if (!NT_STATUS_IS_OK(status)) { - return status; - } - - for (ext = extensions; ext; ext = ext->next) { - - if (GUID_equal(ext->guid, &guid)) { - cse_found = true; - break; - } - } - - if (!cse_found) { - goto no_ext; - } - - status = ext->methods->initialize(mem_ctx); - NT_STATUS_NOT_OK_RETURN(status); - - status = ext->methods->process_group_policy(ads, - mem_ctx, - flags, - root_key, - token, - gpo, - extension_guid, - snapin_guid); - if (!NT_STATUS_IS_OK(status)) { - ext->methods->shutdown(); - } - - return status; - - no_ext: - if (flags & GPO_INFO_FLAG_VERBOSE) { - DEBUG(0,("process_extension: no extension available for:\n")); - DEBUGADD(0,("%s (%s) (snapin: %s)\n", - extension_guid, - cse_gpo_guid_string_to_name(extension_guid), - snapin_guid)); - } - - return NT_STATUS_OK; -} diff --git a/source3/libgpo/gpext/gpext.h b/source3/libgpo/gpext/gpext.h deleted file mode 100644 index 0f0445701d..0000000000 --- a/source3/libgpo/gpext/gpext.h +++ /dev/null @@ -1,79 +0,0 @@ -/* - * Unix SMB/CIFS implementation. - * Group Policy Support - * Copyright (C) Guenther Deschner 2007-2008 - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#define KEY_WINLOGON_GPEXT_PATH "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions" - -#define SAMBA_SUBSYSTEM_GPEXT "gpext" - -#define SMB_GPEXT_INTERFACE_VERSION 1 - -struct gp_extension { - struct GUID *guid; - const char *name; - struct gp_extension_methods *methods; - struct gp_extension *prev, *next; -}; - -struct gp_extension_reg_table { - const char *val; - enum winreg_Type type; - const char *data; -}; - -struct gp_extension_reg_entry { - const char *value; - struct registry_value *data; -}; - -struct gp_extension_reg_info_entry { - struct GUID guid; - size_t num_entries; - struct gp_extension_reg_entry *entries; -}; - -struct gp_extension_reg_info { - size_t num_entries; - struct gp_extension_reg_info_entry *entries; -}; - -struct gp_extension_methods { - - NTSTATUS (*initialize)(TALLOC_CTX *mem_ctx); - - NTSTATUS (*process_group_policy)(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - uint32_t flags, - struct registry_key *root_key, - const struct nt_user_token *token, - struct GROUP_POLICY_OBJECT *gpo, - const char *extension_guid, - const char *snapin_guid); - - NTSTATUS (*process_group_policy2)(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - uint32_t flags, - const struct nt_user_token *token, - struct GROUP_POLICY_OBJECT *gpo_list, - const char *extension_guid); - - NTSTATUS (*get_reg_config)(TALLOC_CTX *mem_ctx, - struct gp_extension_reg_info **info); - - NTSTATUS (*shutdown)(void); -}; diff --git a/source3/libgpo/gpo_util.c b/source3/libgpo/gpo_util.c deleted file mode 100644 index 04597b3b57..0000000000 --- a/source3/libgpo/gpo_util.c +++ /dev/null @@ -1,870 +0,0 @@ -/* - * Unix SMB/CIFS implementation. - * Group Policy Object Support - * Copyright (C) Guenther Deschner 2005-2008 - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, see . - */ - -#include "includes.h" - -#define DEFAULT_DOMAIN_POLICY "Default Domain Policy" -#define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy" - -/* should we store a parsed guid ? */ -struct gp_table { - const char *name; - const char *guid_string; -}; - -#if 0 /* unused */ -static struct gp_table gpo_default_policy[] = { - { DEFAULT_DOMAIN_POLICY, - "31B2F340-016D-11D2-945F-00C04FB984F9" }, - { DEFAULT_DOMAIN_CONTROLLERS_POLICY, - "6AC1786C-016F-11D2-945F-00C04fB984F9" }, - { NULL, NULL } -}; -#endif - -/* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */ - -static struct gp_table gpo_cse_extensions[] = { - /* used to be "Administrative Templates Extension" */ - /* "Registry Settings" - (http://support.microsoft.com/kb/216357/EN-US/) */ - { "Registry Settings", - GP_EXT_GUID_REGISTRY }, - { "Microsoft Disc Quota", - "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" }, - { "EFS recovery", - "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" }, - { "Folder Redirection", - "25537BA6-77A8-11D2-9B6C-0000F8080861" }, - { "IP Security", - "E437BC1C-AA7D-11D2-A382-00C04F991E27" }, - { "Internet Explorer Branding", - "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" }, - { "QoS Packet Scheduler", - "426031c0-0b47-4852-b0ca-ac3d37bfcb39" }, - { "Scripts", - GP_EXT_GUID_SCRIPTS }, - { "Security", - GP_EXT_GUID_SECURITY }, - { "Software Installation", - "C6DC5466-785A-11D2-84D0-00C04FB169F7" }, - { "Wireless Group Policy", - "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" }, - { "Application Management", - "C6DC5466-785A-11D2-84D0-00C04FB169F7" }, - { "unknown", - "3060E8D0-7020-11D2-842D-00C04FA372D4" }, - { NULL, NULL } -}; - -/* guess work */ -static struct gp_table gpo_cse_snapin_extensions[] = { - { "Administrative Templates", - "0F6B957D-509E-11D1-A7CC-0000F87571E3" }, - { "Certificates", - "53D6AB1D-2488-11D1-A28C-00C04FB94F17" }, - { "EFS recovery policy processing", - "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" }, - { "Folder Redirection policy processing", - "25537BA6-77A8-11D2-9B6C-0000F8080861" }, - { "Folder Redirection", - "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" }, - { "Registry policy processing", - "35378EAC-683F-11D2-A89A-00C04FBBCFA2" }, - { "Remote Installation Services", - "3060E8CE-7020-11D2-842D-00C04FA372D4" }, - { "Security Settings", - "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" }, - { "Security policy processing", - "827D319E-6EAC-11D2-A4EA-00C04F79F83A" }, - { "unknown", - "3060E8D0-7020-11D2-842D-00C04FA372D4" }, - { "unknown2", - "53D6AB1B-2488-11D1-A28C-00C04FB94F17" }, - { NULL, NULL } -}; - -/**************************************************************** -****************************************************************/ - -static const char *name_to_guid_string(const char *name, - struct gp_table *table) -{ - int i; - - for (i = 0; table[i].name; i++) { - if (strequal(name, table[i].name)) { - return table[i].guid_string; - } - } - - return NULL; -} - -/**************************************************************** -****************************************************************/ - -static const char *guid_string_to_name(const char *guid_string, - struct gp_table *table) -{ - int i; - - for (i = 0; table[i].guid_string; i++) { - if (strequal(guid_string, table[i].guid_string)) { - return table[i].name; - } - } - - return NULL; -} - -/**************************************************************** -****************************************************************/ - -static const char *snapin_guid_string_to_name(const char *guid_string, - struct gp_table *table) -{ - int i; - for (i = 0; table[i].guid_string; i++) { - if (strequal(guid_string, table[i].guid_string)) { - return table[i].name; - } - } - return NULL; -} - -#if 0 /* unused */ -static const char *default_gpo_name_to_guid_string(const char *name) -{ - return name_to_guid_string(name, gpo_default_policy); -} - -static const char *default_gpo_guid_string_to_name(const char *guid) -{ - return guid_string_to_name(guid, gpo_default_policy); -} -#endif - -/**************************************************************** -****************************************************************/ - -const char *cse_gpo_guid_string_to_name(const char *guid) -{ - return guid_string_to_name(guid, gpo_cse_extensions); -} - -/**************************************************************** -****************************************************************/ - -const char *cse_gpo_name_to_guid_string(const char *name) -{ - return name_to_guid_string(name, gpo_cse_extensions); -} - -/**************************************************************** -****************************************************************/ - -const char *cse_snapin_gpo_guid_string_to_name(const char *guid) -{ - return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions); -} - -/**************************************************************** -****************************************************************/ - -void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel) -{ - int lvl = debuglevel; - int i; - - if (gp_ext == NULL) { - return; - } - - DEBUG(lvl,("\t---------------------\n\n")); - DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension)); - - for (i=0; i< gp_ext->num_exts; i++) { - - DEBUGADD(lvl,("\textension:\t\t\t%s\n", - gp_ext->extensions_guid[i])); - DEBUGADD(lvl,("\textension (name):\t\t\t%s\n", - gp_ext->extensions[i])); - - DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n", - gp_ext->snapins_guid[i])); - DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n", - gp_ext->snapins[i])); - } -} - -#ifdef HAVE_LDAP - -/**************************************************************** -****************************************************************/ - -void dump_gpo(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - struct GROUP_POLICY_OBJECT *gpo, - int debuglevel) -{ - int lvl = debuglevel; - - if (gpo == NULL) { - return; - } - - DEBUG(lvl,("---------------------\n\n")); - - DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name)); - DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name)); - DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version)); - DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n", - GPO_VERSION_USER(gpo->version), - GPO_VERSION_USER(gpo->version))); - DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n", - GPO_VERSION_MACHINE(gpo->version), - GPO_VERSION_MACHINE(gpo->version))); - DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path)); - DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path)); - - DEBUGADD(lvl,("options:\t\t%d ", gpo->options)); - switch (gpo->options) { - case GPFLAGS_ALL_ENABLED: - DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n")); - break; - case GPFLAGS_USER_SETTINGS_DISABLED: - DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n")); - break; - case GPFLAGS_MACHINE_SETTINGS_DISABLED: - DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n")); - break; - case GPFLAGS_ALL_DISABLED: - DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n")); - break; - default: - DEBUGADD(lvl,("unknown option: %d\n", gpo->options)); - break; - } - - DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link)); - DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type)); - switch (gpo->link_type) { - case GP_LINK_UNKOWN: - DEBUGADD(lvl,("GP_LINK_UNKOWN\n")); - break; - case GP_LINK_OU: - DEBUGADD(lvl,("GP_LINK_OU\n")); - break; - case GP_LINK_DOMAIN: - DEBUGADD(lvl,("GP_LINK_DOMAIN\n")); - break; - case GP_LINK_SITE: - DEBUGADD(lvl,("GP_LINK_SITE\n")); - break; - case GP_LINK_MACHINE: - DEBUGADD(lvl,("GP_LINK_MACHINE\n")); - break; - default: - break; - } - - DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions)); - - if (gpo->machine_extensions) { - - struct GP_EXT *gp_ext = NULL; - - if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions, - &gp_ext)) { - return; - } - dump_gp_ext(gp_ext, lvl); - } - - DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions)); - - if (gpo->user_extensions) { - - struct GP_EXT *gp_ext = NULL; - - if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions, - &gp_ext)) { - return; - } - dump_gp_ext(gp_ext, lvl); - } - - DEBUGADD(lvl,("security descriptor:\n")); - - ads_disp_sd(ads, mem_ctx, gpo->security_descriptor); -} - -/**************************************************************** -****************************************************************/ - -void dump_gpo_list(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - struct GROUP_POLICY_OBJECT *gpo_list, - int debuglevel) -{ - struct GROUP_POLICY_OBJECT *gpo = NULL; - - for (gpo = gpo_list; gpo; gpo = gpo->next) { - dump_gpo(ads, mem_ctx, gpo, debuglevel); - } -} - -/**************************************************************** -****************************************************************/ - -void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link) -{ - ADS_STATUS status; - int i; - int lvl = 10; - - if (gp_link == NULL) { - return; - } - - DEBUG(lvl,("---------------------\n\n")); - - DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link)); - DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts)); - switch (gp_link->gp_opts) { - case GPOPTIONS_INHERIT: - DEBUGADD(lvl,("GPOPTIONS_INHERIT\n")); - break; - case GPOPTIONS_BLOCK_INHERITANCE: - DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n")); - break; - default: - break; - } - - DEBUGADD(lvl,("num links: %d\n", gp_link->num_links)); - - for (i = 0; i < gp_link->num_links; i++) { - - DEBUGADD(lvl,("---------------------\n\n")); - - DEBUGADD(lvl,("link: #%d\n", i + 1)); - DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i])); - - DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i])); - if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) { - DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED ")); - } - if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) { - DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED")); - } - DEBUGADD(lvl,("\n")); - - if (ads != NULL && mem_ctx != NULL) { - - struct GROUP_POLICY_OBJECT gpo; - - status = ads_get_gpo(ads, mem_ctx, - gp_link->link_names[i], - NULL, NULL, &gpo); - if (!ADS_ERR_OK(status)) { - DEBUG(lvl,("get gpo for %s failed: %s\n", - gp_link->link_names[i], - ads_errstr(status))); - return; - } - dump_gpo(ads, mem_ctx, &gpo, lvl); - } - } -} - -#endif /* HAVE_LDAP */ - -/**************************************************************** -****************************************************************/ - -static bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx, - uint32_t flags, - struct GROUP_POLICY_OBJECT *gpo, - struct GP_EXT **gp_ext) -{ - ZERO_STRUCTP(*gp_ext); - - if (flags & GPO_INFO_FLAG_MACHINE) { - - if (gpo->machine_extensions) { - - if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions, - gp_ext)) { - return false; - } - } - } else { - - if (gpo->user_extensions) { - - if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions, - gp_ext)) { - return false; - } - } - } - - return true; -} - -/**************************************************************** -****************************************************************/ - -ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - const struct nt_user_token *token, - struct registry_key *root_key, - struct GROUP_POLICY_OBJECT *gpo, - const char *extension_guid_filter, - uint32_t flags) -{ - struct GP_EXT *gp_ext = NULL; - int i; - - DEBUG(10,("gpo_process_a_gpo: processing gpo %s (%s)\n", - gpo->name, gpo->display_name)); - if (extension_guid_filter) { - DEBUGADD(10,("gpo_process_a_gpo: using filter %s (%s)\n", - extension_guid_filter, - cse_gpo_guid_string_to_name(extension_guid_filter))); - } - - if (!gpo_get_gp_ext_from_gpo(mem_ctx, flags, gpo, &gp_ext)) { - return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); - } - - if (!gp_ext || !gp_ext->num_exts) { - if (flags & GPO_INFO_FLAG_VERBOSE) { - DEBUG(0,("gpo_process_a_gpo: " - "no policies in %s (%s) for this extension\n", - gpo->name, gpo->display_name)); - } - return ADS_SUCCESS; - } - - for (i=0; inum_exts; i++) { - - NTSTATUS ntstatus; - - if (extension_guid_filter && - !strequal(extension_guid_filter, - gp_ext->extensions_guid[i])) { - continue; - } - - ntstatus = gpext_process_extension(ads, mem_ctx, - flags, token, root_key, gpo, - gp_ext->extensions_guid[i], - gp_ext->snapins_guid[i]); - if (!NT_STATUS_IS_OK(ntstatus)) { - ADS_ERROR_NT(ntstatus); - } - } - - return ADS_SUCCESS; -} - -/**************************************************************** -****************************************************************/ - -static ADS_STATUS gpo_process_gpo_list_by_ext(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - const struct nt_user_token *token, - struct registry_key *root_key, - struct GROUP_POLICY_OBJECT *gpo_list, - const char *extensions_guid, - uint32_t flags) -{ - ADS_STATUS status; - struct GROUP_POLICY_OBJECT *gpo; - - for (gpo = gpo_list; gpo; gpo = gpo->next) { - - if (gpo->link_type == GP_LINK_LOCAL) { - continue; - } - - - /* FIXME: we need to pass down the *list* down to the - * extension, otherwise we cannot store the e.g. the *list* of - * logon-scripts correctly (for more then one GPO) */ - - status = gpo_process_a_gpo(ads, mem_ctx, token, root_key, - gpo, extensions_guid, flags); - - if (!ADS_ERR_OK(status)) { - DEBUG(0,("failed to process gpo by ext: %s\n", - ads_errstr(status))); - return status; - } - } - - return ADS_SUCCESS; -} - -/**************************************************************** -****************************************************************/ - -ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - const struct nt_user_token *token, - struct GROUP_POLICY_OBJECT *gpo_list, - const char *extensions_guid_filter, - uint32_t flags) -{ - ADS_STATUS status = ADS_SUCCESS; - struct gp_extension *gp_ext_list = NULL; - struct gp_extension *gp_ext = NULL; - struct registry_key *root_key = NULL; - struct gp_registry_context *reg_ctx = NULL; - WERROR werr; - - status = ADS_ERROR_NT(init_gp_extensions(mem_ctx)); - if (!ADS_ERR_OK(status)) { - return status; - } - - gp_ext_list = get_gp_extension_list(); - if (!gp_ext_list) { - return ADS_ERROR_NT(NT_STATUS_DLL_INIT_FAILED); - } - - /* get the key here */ - if (flags & GPO_LIST_FLAG_MACHINE) { - werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE, - get_system_token(), - ®_ctx); - } else { - werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE, - token, - ®_ctx); - } - if (!W_ERROR_IS_OK(werr)) { - gp_free_reg_ctx(reg_ctx); - return ADS_ERROR_NT(werror_to_ntstatus(werr)); - } - - root_key = reg_ctx->curr_key; - - for (gp_ext = gp_ext_list; gp_ext; gp_ext = gp_ext->next) { - - const char *guid_str = NULL; - - guid_str = GUID_string(mem_ctx, gp_ext->guid); - if (!guid_str) { - status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (extensions_guid_filter && - (!strequal(guid_str, extensions_guid_filter))) { - continue; - } - - DEBUG(0,("-------------------------------------------------\n")); - DEBUG(0,("gpo_process_gpo_list: processing ext: %s {%s}\n", - gp_ext->name, guid_str)); - - - status = gpo_process_gpo_list_by_ext(ads, mem_ctx, token, - root_key, gpo_list, - guid_str, flags); - if (!ADS_ERR_OK(status)) { - goto done; - } - } - - done: - gp_free_reg_ctx(reg_ctx); - TALLOC_FREE(root_key); - free_gp_extensions(); - - return status; -} - - -/**************************************************************** - check wether the version number in a GROUP_POLICY_OBJECT match those of the - locally stored version. If not, fetch the required policy via CIFS -****************************************************************/ - -NTSTATUS check_refresh_gpo(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - uint32_t flags, - struct GROUP_POLICY_OBJECT *gpo, - struct cli_state **cli_out) -{ - NTSTATUS result; - char *server = NULL; - char *share = NULL; - char *nt_path = NULL; - char *unix_path = NULL; - uint32_t sysvol_gpt_version = 0; - char *display_name = NULL; - struct cli_state *cli = NULL; - - result = gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path, - &server, &share, &nt_path, &unix_path); - - if (!NT_STATUS_IS_OK(result)) { - goto out; - } - - result = gpo_get_sysvol_gpt_version(mem_ctx, - unix_path, - &sysvol_gpt_version, - &display_name); - if (!NT_STATUS_IS_OK(result) && - !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) { - DEBUG(10,("check_refresh_gpo: " - "failed to get local gpt version: %s\n", - nt_errstr(result))); - goto out; - } - - DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n", - gpo->version, sysvol_gpt_version)); - - /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */ - - while (gpo->version > sysvol_gpt_version) { - - DEBUG(1,("check_refresh_gpo: need to refresh GPO\n")); - - if (*cli_out == NULL) { - - result = cli_full_connection(&cli, - global_myname(), - ads->config.ldap_server_name, - /* server */ - NULL, 0, - share, "A:", - ads->auth.user_name, NULL, - ads->auth.password, - CLI_FULL_CONNECTION_USE_KERBEROS | - CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS, - Undefined, NULL); - if (!NT_STATUS_IS_OK(result)) { - DEBUG(10,("check_refresh_gpo: " - "failed to connect: %s\n", - nt_errstr(result))); - goto out; - } - - *cli_out = cli; - } - - result = gpo_fetch_files(mem_ctx, *cli_out, gpo); - if (!NT_STATUS_IS_OK(result)) { - goto out; - } - - result = gpo_get_sysvol_gpt_version(mem_ctx, - unix_path, - &sysvol_gpt_version, - &display_name); - if (!NT_STATUS_IS_OK(result)) { - DEBUG(10,("check_refresh_gpo: " - "failed to get local gpt version: %s\n", - nt_errstr(result))); - goto out; - } - - if (gpo->version == sysvol_gpt_version) { - break; - } - } - - DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name)); - DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n", - sysvol_gpt_version, - GPO_VERSION_USER(sysvol_gpt_version), - GPO_VERSION_MACHINE(sysvol_gpt_version))); - DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n", - gpo->version, - GPO_VERSION_USER(gpo->version), - GPO_VERSION_MACHINE(gpo->version))); - DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link)); - - result = NT_STATUS_OK; - - out: - return result; - -} - -/**************************************************************** - check wether the version numbers in the gpo_list match the locally stored, if - not, go and get each required GPO via CIFS - ****************************************************************/ - -NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - uint32_t flags, - struct GROUP_POLICY_OBJECT *gpo_list) -{ - NTSTATUS result = NT_STATUS_UNSUCCESSFUL; - struct cli_state *cli = NULL; - struct GROUP_POLICY_OBJECT *gpo; - - if (!gpo_list) { - return NT_STATUS_INVALID_PARAMETER; - } - - for (gpo = gpo_list; gpo; gpo = gpo->next) { - - result = check_refresh_gpo(ads, mem_ctx, flags, gpo, &cli); - if (!NT_STATUS_IS_OK(result)) { - goto out; - } - } - - result = NT_STATUS_OK; - - out: - if (cli) { - cli_shutdown(cli); - } - - return result; -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx, - struct GROUP_POLICY_OBJECT *gpo, - char **unix_path) -{ - char *server, *share, *nt_path; - return gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path, - &server, &share, &nt_path, unix_path); -} - -/**************************************************************** -****************************************************************/ - -char *gpo_flag_str(uint32_t flags) -{ - fstring str = ""; - - if (flags == 0) { - return NULL; - } - - if (flags & GPO_INFO_FLAG_SLOWLINK) - fstrcat(str, "GPO_INFO_FLAG_SLOWLINK "); - if (flags & GPO_INFO_FLAG_VERBOSE) - fstrcat(str, "GPO_INFO_FLAG_VERBOSE "); - if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT) - fstrcat(str, "GPO_INFO_FLAG_SAFEMODE_BOOT "); - if (flags & GPO_INFO_FLAG_NOCHANGES) - fstrcat(str, "GPO_INFO_FLAG_NOCHANGES "); - if (flags & GPO_INFO_FLAG_MACHINE) - fstrcat(str, "GPO_INFO_FLAG_MACHINE "); - if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION) - fstrcat(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION "); - if (flags & GPO_INFO_FLAG_LINKTRANSITION) - fstrcat(str, "GPO_INFO_FLAG_LINKTRANSITION "); - if (flags & GPO_INFO_FLAG_FORCED_REFRESH) - fstrcat(str, "GPO_INFO_FLAG_FORCED_REFRESH "); - if (flags & GPO_INFO_FLAG_BACKGROUND) - fstrcat(str, "GPO_INFO_FLAG_BACKGROUND "); - - return SMB_STRDUP(str); -} - -/**************************************************************** -****************************************************************/ - -NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx, - uint32_t flags, - const char *filename, - const char *suffix, - const char **filename_out) -{ - const char *tmp = NULL; - SMB_STRUCT_STAT sbuf; - const char *path = NULL; - - if (flags & GPO_LIST_FLAG_MACHINE) { - path = "Machine"; - } else { - path = "User"; - } - - tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename, - path, suffix); - NT_STATUS_HAVE_NO_MEMORY(tmp); - - if (sys_stat(tmp, &sbuf) == 0) { - *filename_out = tmp; - return NT_STATUS_OK; - } - - path = talloc_strdup_upper(mem_ctx, path); - NT_STATUS_HAVE_NO_MEMORY(path); - - tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename, - path, suffix); - NT_STATUS_HAVE_NO_MEMORY(tmp); - - if (sys_stat(tmp, &sbuf) == 0) { - *filename_out = tmp; - return NT_STATUS_OK; - } - - return NT_STATUS_NO_SUCH_FILE; -} - -/**************************************************************** -****************************************************************/ - -ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - const char *dn, - struct nt_user_token **token) -{ - struct nt_user_token *ad_token = NULL; - ADS_STATUS status; - NTSTATUS ntstatus; - -#ifndef HAVE_ADS - return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED); -#endif - status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token); - if (!ADS_ERR_OK(status)) { - return status; - } - - ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(), - token); - if (!NT_STATUS_IS_OK(ntstatus)) { - return ADS_ERROR_NT(ntstatus); - } - - return ADS_SUCCESS; -} -- cgit