1 | /*
|
---|
2 | * Unix SMB/CIFS implementation.
|
---|
3 | * Group Policy Object Support
|
---|
4 | * Copyright (C) Guenther Deschner 2005-2007
|
---|
5 | *
|
---|
6 | * This program is free software; you can redistribute it and/or modify
|
---|
7 | * it under the terms of the GNU General Public License as published by
|
---|
8 | * the Free Software Foundation; either version 3 of the License, or
|
---|
9 | * (at your option) any later version.
|
---|
10 | *
|
---|
11 | * This program is distributed in the hope that it will be useful,
|
---|
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
14 | * GNU General Public License for more details.
|
---|
15 | *
|
---|
16 | * You should have received a copy of the GNU General Public License
|
---|
17 | * along with this program; if not, see <http://www.gnu.org/licenses/>.
|
---|
18 | */
|
---|
19 |
|
---|
20 | #include "includes.h"
|
---|
21 |
|
---|
22 | #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
|
---|
23 | #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
|
---|
24 |
|
---|
25 | /* should we store a parsed guid ? */
|
---|
26 | struct gp_table {
|
---|
27 | const char *name;
|
---|
28 | const char *guid_string;
|
---|
29 | };
|
---|
30 |
|
---|
31 | #if 0 /* unused */
|
---|
32 | static struct gp_table gpo_default_policy[] = {
|
---|
33 | { DEFAULT_DOMAIN_POLICY,
|
---|
34 | "31B2F340-016D-11D2-945F-00C04FB984F9" },
|
---|
35 | { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
|
---|
36 | "6AC1786C-016F-11D2-945F-00C04fB984F9" },
|
---|
37 | { NULL, NULL }
|
---|
38 | };
|
---|
39 | #endif
|
---|
40 |
|
---|
41 | /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
|
---|
42 |
|
---|
43 | static struct gp_table gpo_cse_extensions[] = {
|
---|
44 | /* used to be "Administrative Templates Extension" */
|
---|
45 | /* "Registry Settings"
|
---|
46 | (http://support.microsoft.com/kb/216357/EN-US/) */
|
---|
47 | { "Registry Settings",
|
---|
48 | GP_EXT_GUID_REGISTRY },
|
---|
49 | { "Microsoft Disc Quota",
|
---|
50 | "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
|
---|
51 | { "EFS recovery",
|
---|
52 | "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
|
---|
53 | { "Folder Redirection",
|
---|
54 | "25537BA6-77A8-11D2-9B6C-0000F8080861" },
|
---|
55 | { "IP Security",
|
---|
56 | "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
|
---|
57 | { "Internet Explorer Branding",
|
---|
58 | "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
|
---|
59 | { "QoS Packet Scheduler",
|
---|
60 | "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
|
---|
61 | { "Scripts",
|
---|
62 | GP_EXT_GUID_SCRIPTS },
|
---|
63 | { "Security",
|
---|
64 | GP_EXT_GUID_SECURITY },
|
---|
65 | { "Software Installation",
|
---|
66 | "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
|
---|
67 | { "Wireless Group Policy",
|
---|
68 | "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
|
---|
69 | { "Application Management",
|
---|
70 | "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
|
---|
71 | { "unknown",
|
---|
72 | "3060E8D0-7020-11D2-842D-00C04FA372D4" },
|
---|
73 | { NULL, NULL }
|
---|
74 | };
|
---|
75 |
|
---|
76 | /* guess work */
|
---|
77 | static struct gp_table gpo_cse_snapin_extensions[] = {
|
---|
78 | { "Administrative Templates",
|
---|
79 | "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
|
---|
80 | { "Certificates",
|
---|
81 | "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
|
---|
82 | { "EFS recovery policy processing",
|
---|
83 | "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
|
---|
84 | { "Folder Redirection policy processing",
|
---|
85 | "25537BA6-77A8-11D2-9B6C-0000F8080861" },
|
---|
86 | { "Folder Redirection",
|
---|
87 | "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
|
---|
88 | { "Registry policy processing",
|
---|
89 | "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
|
---|
90 | { "Remote Installation Services",
|
---|
91 | "3060E8CE-7020-11D2-842D-00C04FA372D4" },
|
---|
92 | { "Security Settings",
|
---|
93 | "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
|
---|
94 | { "Security policy processing",
|
---|
95 | "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
|
---|
96 | { "unknown",
|
---|
97 | "3060E8D0-7020-11D2-842D-00C04FA372D4" },
|
---|
98 | { "unknown2",
|
---|
99 | "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
|
---|
100 | { NULL, NULL }
|
---|
101 | };
|
---|
102 |
|
---|
103 | /****************************************************************
|
---|
104 | ****************************************************************/
|
---|
105 |
|
---|
106 | static const char *name_to_guid_string(const char *name,
|
---|
107 | struct gp_table *table)
|
---|
108 | {
|
---|
109 | int i;
|
---|
110 |
|
---|
111 | for (i = 0; table[i].name; i++) {
|
---|
112 | if (strequal(name, table[i].name)) {
|
---|
113 | return table[i].guid_string;
|
---|
114 | }
|
---|
115 | }
|
---|
116 |
|
---|
117 | return NULL;
|
---|
118 | }
|
---|
119 |
|
---|
120 | /****************************************************************
|
---|
121 | ****************************************************************/
|
---|
122 |
|
---|
123 | static const char *guid_string_to_name(const char *guid_string,
|
---|
124 | struct gp_table *table)
|
---|
125 | {
|
---|
126 | int i;
|
---|
127 |
|
---|
128 | for (i = 0; table[i].guid_string; i++) {
|
---|
129 | if (strequal(guid_string, table[i].guid_string)) {
|
---|
130 | return table[i].name;
|
---|
131 | }
|
---|
132 | }
|
---|
133 |
|
---|
134 | return NULL;
|
---|
135 | }
|
---|
136 |
|
---|
137 | /****************************************************************
|
---|
138 | ****************************************************************/
|
---|
139 |
|
---|
140 | static const char *snapin_guid_string_to_name(const char *guid_string,
|
---|
141 | struct gp_table *table)
|
---|
142 | {
|
---|
143 | int i;
|
---|
144 | for (i = 0; table[i].guid_string; i++) {
|
---|
145 | if (strequal(guid_string, table[i].guid_string)) {
|
---|
146 | return table[i].name;
|
---|
147 | }
|
---|
148 | }
|
---|
149 | return NULL;
|
---|
150 | }
|
---|
151 |
|
---|
152 | #if 0 /* unused */
|
---|
153 | static const char *default_gpo_name_to_guid_string(const char *name)
|
---|
154 | {
|
---|
155 | return name_to_guid_string(name, gpo_default_policy);
|
---|
156 | }
|
---|
157 |
|
---|
158 | static const char *default_gpo_guid_string_to_name(const char *guid)
|
---|
159 | {
|
---|
160 | return guid_string_to_name(guid, gpo_default_policy);
|
---|
161 | }
|
---|
162 | #endif
|
---|
163 |
|
---|
164 | /****************************************************************
|
---|
165 | ****************************************************************/
|
---|
166 |
|
---|
167 | const char *cse_gpo_guid_string_to_name(const char *guid)
|
---|
168 | {
|
---|
169 | return guid_string_to_name(guid, gpo_cse_extensions);
|
---|
170 | }
|
---|
171 |
|
---|
172 | /****************************************************************
|
---|
173 | ****************************************************************/
|
---|
174 |
|
---|
175 | const char *cse_gpo_name_to_guid_string(const char *name)
|
---|
176 | {
|
---|
177 | return name_to_guid_string(name, gpo_cse_extensions);
|
---|
178 | }
|
---|
179 |
|
---|
180 | /****************************************************************
|
---|
181 | ****************************************************************/
|
---|
182 |
|
---|
183 | const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
|
---|
184 | {
|
---|
185 | return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
|
---|
186 | }
|
---|
187 |
|
---|
188 | /****************************************************************
|
---|
189 | ****************************************************************/
|
---|
190 |
|
---|
191 | void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
|
---|
192 | {
|
---|
193 | int lvl = debuglevel;
|
---|
194 | int i;
|
---|
195 |
|
---|
196 | if (gp_ext == NULL) {
|
---|
197 | return;
|
---|
198 | }
|
---|
199 |
|
---|
200 | DEBUG(lvl,("\t---------------------\n\n"));
|
---|
201 | DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
|
---|
202 |
|
---|
203 | for (i=0; i< gp_ext->num_exts; i++) {
|
---|
204 |
|
---|
205 | DEBUGADD(lvl,("\textension:\t\t\t%s\n",
|
---|
206 | gp_ext->extensions_guid[i]));
|
---|
207 | DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
|
---|
208 | gp_ext->extensions[i]));
|
---|
209 |
|
---|
210 | DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
|
---|
211 | gp_ext->snapins_guid[i]));
|
---|
212 | DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
|
---|
213 | gp_ext->snapins[i]));
|
---|
214 | }
|
---|
215 | }
|
---|
216 |
|
---|
217 | #ifdef HAVE_LDAP
|
---|
218 |
|
---|
219 | /****************************************************************
|
---|
220 | ****************************************************************/
|
---|
221 |
|
---|
222 | void dump_gpo(ADS_STRUCT *ads,
|
---|
223 | TALLOC_CTX *mem_ctx,
|
---|
224 | struct GROUP_POLICY_OBJECT *gpo,
|
---|
225 | int debuglevel)
|
---|
226 | {
|
---|
227 | int lvl = debuglevel;
|
---|
228 |
|
---|
229 | if (gpo == NULL) {
|
---|
230 | return;
|
---|
231 | }
|
---|
232 |
|
---|
233 | DEBUG(lvl,("---------------------\n\n"));
|
---|
234 |
|
---|
235 | DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
|
---|
236 | DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
|
---|
237 | DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
|
---|
238 | DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
|
---|
239 | GPO_VERSION_USER(gpo->version),
|
---|
240 | GPO_VERSION_USER(gpo->version)));
|
---|
241 | DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
|
---|
242 | GPO_VERSION_MACHINE(gpo->version),
|
---|
243 | GPO_VERSION_MACHINE(gpo->version)));
|
---|
244 | DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
|
---|
245 | DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
|
---|
246 |
|
---|
247 | DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
|
---|
248 | switch (gpo->options) {
|
---|
249 | case GPFLAGS_ALL_ENABLED:
|
---|
250 | DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
|
---|
251 | break;
|
---|
252 | case GPFLAGS_USER_SETTINGS_DISABLED:
|
---|
253 | DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
|
---|
254 | break;
|
---|
255 | case GPFLAGS_MACHINE_SETTINGS_DISABLED:
|
---|
256 | DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
|
---|
257 | break;
|
---|
258 | case GPFLAGS_ALL_DISABLED:
|
---|
259 | DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
|
---|
260 | break;
|
---|
261 | default:
|
---|
262 | DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
|
---|
263 | break;
|
---|
264 | }
|
---|
265 |
|
---|
266 | DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
|
---|
267 | DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
|
---|
268 | switch (gpo->link_type) {
|
---|
269 | case GP_LINK_UNKOWN:
|
---|
270 | DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
|
---|
271 | break;
|
---|
272 | case GP_LINK_OU:
|
---|
273 | DEBUGADD(lvl,("GP_LINK_OU\n"));
|
---|
274 | break;
|
---|
275 | case GP_LINK_DOMAIN:
|
---|
276 | DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
|
---|
277 | break;
|
---|
278 | case GP_LINK_SITE:
|
---|
279 | DEBUGADD(lvl,("GP_LINK_SITE\n"));
|
---|
280 | break;
|
---|
281 | case GP_LINK_MACHINE:
|
---|
282 | DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
|
---|
283 | break;
|
---|
284 | default:
|
---|
285 | break;
|
---|
286 | }
|
---|
287 |
|
---|
288 | DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
|
---|
289 |
|
---|
290 | if (gpo->machine_extensions) {
|
---|
291 |
|
---|
292 | struct GP_EXT *gp_ext = NULL;
|
---|
293 |
|
---|
294 | if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
|
---|
295 | &gp_ext)) {
|
---|
296 | return;
|
---|
297 | }
|
---|
298 | dump_gp_ext(gp_ext, lvl);
|
---|
299 | }
|
---|
300 |
|
---|
301 | DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
|
---|
302 |
|
---|
303 | if (gpo->user_extensions) {
|
---|
304 |
|
---|
305 | struct GP_EXT *gp_ext = NULL;
|
---|
306 |
|
---|
307 | if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
|
---|
308 | &gp_ext)) {
|
---|
309 | return;
|
---|
310 | }
|
---|
311 | dump_gp_ext(gp_ext, lvl);
|
---|
312 | }
|
---|
313 |
|
---|
314 | DEBUGADD(lvl,("security descriptor:\n"));
|
---|
315 |
|
---|
316 | ads_disp_sd(ads, mem_ctx, gpo->security_descriptor);
|
---|
317 | }
|
---|
318 |
|
---|
319 | /****************************************************************
|
---|
320 | ****************************************************************/
|
---|
321 |
|
---|
322 | void dump_gpo_list(ADS_STRUCT *ads,
|
---|
323 | TALLOC_CTX *mem_ctx,
|
---|
324 | struct GROUP_POLICY_OBJECT *gpo_list,
|
---|
325 | int debuglevel)
|
---|
326 | {
|
---|
327 | struct GROUP_POLICY_OBJECT *gpo = NULL;
|
---|
328 |
|
---|
329 | for (gpo = gpo_list; gpo; gpo = gpo->next) {
|
---|
330 | dump_gpo(ads, mem_ctx, gpo, debuglevel);
|
---|
331 | }
|
---|
332 | }
|
---|
333 |
|
---|
334 | /****************************************************************
|
---|
335 | ****************************************************************/
|
---|
336 |
|
---|
337 | void dump_gplink(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct GP_LINK *gp_link)
|
---|
338 | {
|
---|
339 | ADS_STATUS status;
|
---|
340 | int i;
|
---|
341 | int lvl = 10;
|
---|
342 |
|
---|
343 | if (gp_link == NULL) {
|
---|
344 | return;
|
---|
345 | }
|
---|
346 |
|
---|
347 | DEBUG(lvl,("---------------------\n\n"));
|
---|
348 |
|
---|
349 | DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
|
---|
350 | DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
|
---|
351 | switch (gp_link->gp_opts) {
|
---|
352 | case GPOPTIONS_INHERIT:
|
---|
353 | DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
|
---|
354 | break;
|
---|
355 | case GPOPTIONS_BLOCK_INHERITANCE:
|
---|
356 | DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
|
---|
357 | break;
|
---|
358 | default:
|
---|
359 | break;
|
---|
360 | }
|
---|
361 |
|
---|
362 | DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
|
---|
363 |
|
---|
364 | for (i = 0; i < gp_link->num_links; i++) {
|
---|
365 |
|
---|
366 | DEBUGADD(lvl,("---------------------\n\n"));
|
---|
367 |
|
---|
368 | DEBUGADD(lvl,("link: #%d\n", i + 1));
|
---|
369 | DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
|
---|
370 |
|
---|
371 | DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
|
---|
372 | if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
|
---|
373 | DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
|
---|
374 | }
|
---|
375 | if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
|
---|
376 | DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
|
---|
377 | }
|
---|
378 | DEBUGADD(lvl,("\n"));
|
---|
379 |
|
---|
380 | if (ads != NULL && mem_ctx != NULL) {
|
---|
381 |
|
---|
382 | struct GROUP_POLICY_OBJECT gpo;
|
---|
383 |
|
---|
384 | status = ads_get_gpo(ads, mem_ctx,
|
---|
385 | gp_link->link_names[i],
|
---|
386 | NULL, NULL, &gpo);
|
---|
387 | if (!ADS_ERR_OK(status)) {
|
---|
388 | DEBUG(lvl,("get gpo for %s failed: %s\n",
|
---|
389 | gp_link->link_names[i],
|
---|
390 | ads_errstr(status)));
|
---|
391 | return;
|
---|
392 | }
|
---|
393 | dump_gpo(ads, mem_ctx, &gpo, lvl);
|
---|
394 | }
|
---|
395 | }
|
---|
396 | }
|
---|
397 |
|
---|
398 | #endif /* HAVE_LDAP */
|
---|
399 |
|
---|
400 | /****************************************************************
|
---|
401 | ****************************************************************/
|
---|
402 |
|
---|
403 | NTSTATUS process_extension(ADS_STRUCT *ads,
|
---|
404 | TALLOC_CTX *mem_ctx,
|
---|
405 | uint32_t flags,
|
---|
406 | const struct nt_user_token *token,
|
---|
407 | struct GROUP_POLICY_OBJECT *gpo,
|
---|
408 | const char *extension_guid,
|
---|
409 | const char *snapin_guid)
|
---|
410 | {
|
---|
411 | DEBUG(0,("process_extension: no extension available for:\n"));
|
---|
412 | DEBUGADD(0,("%s (%s) (snapin: %s)\n",
|
---|
413 | extension_guid,
|
---|
414 | cse_gpo_guid_string_to_name(extension_guid),
|
---|
415 | snapin_guid));
|
---|
416 |
|
---|
417 | return NT_STATUS_OK;
|
---|
418 | }
|
---|
419 |
|
---|
420 | /****************************************************************
|
---|
421 | ****************************************************************/
|
---|
422 |
|
---|
423 | ADS_STATUS gpo_process_a_gpo(ADS_STRUCT *ads,
|
---|
424 | TALLOC_CTX *mem_ctx,
|
---|
425 | const struct nt_user_token *token,
|
---|
426 | struct GROUP_POLICY_OBJECT *gpo,
|
---|
427 | const char *extension_guid_filter,
|
---|
428 | uint32_t flags)
|
---|
429 | {
|
---|
430 | struct GP_EXT *gp_ext = NULL;
|
---|
431 | int i;
|
---|
432 |
|
---|
433 | DEBUG(10,("gpo_process_a_gpo: processing gpo %s (%s)\n",
|
---|
434 | gpo->name, gpo->display_name));
|
---|
435 | if (extension_guid_filter) {
|
---|
436 | DEBUGADD(10,("gpo_process_a_gpo: using filter %s\n",
|
---|
437 | extension_guid_filter));
|
---|
438 | }
|
---|
439 |
|
---|
440 | if (flags & GPO_LIST_FLAG_MACHINE) {
|
---|
441 |
|
---|
442 | if (gpo->machine_extensions) {
|
---|
443 |
|
---|
444 | if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
|
---|
445 | &gp_ext)) {
|
---|
446 | return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
|
---|
447 | }
|
---|
448 |
|
---|
449 | } else {
|
---|
450 | /* nothing to apply */
|
---|
451 | return ADS_SUCCESS;
|
---|
452 | }
|
---|
453 |
|
---|
454 | } else {
|
---|
455 |
|
---|
456 | if (gpo->user_extensions) {
|
---|
457 |
|
---|
458 | if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
|
---|
459 | &gp_ext)) {
|
---|
460 | return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
|
---|
461 | }
|
---|
462 | } else {
|
---|
463 | /* nothing to apply */
|
---|
464 | return ADS_SUCCESS;
|
---|
465 | }
|
---|
466 | }
|
---|
467 |
|
---|
468 | for (i=0; i<gp_ext->num_exts; i++) {
|
---|
469 |
|
---|
470 | NTSTATUS ntstatus;
|
---|
471 |
|
---|
472 | if (extension_guid_filter &&
|
---|
473 | !strequal(extension_guid_filter,
|
---|
474 | gp_ext->extensions_guid[i])) {
|
---|
475 | continue;
|
---|
476 | }
|
---|
477 |
|
---|
478 | ntstatus = process_extension(ads, mem_ctx,
|
---|
479 | flags, token, gpo,
|
---|
480 | gp_ext->extensions_guid[i],
|
---|
481 | gp_ext->snapins_guid[i]);
|
---|
482 | if (!NT_STATUS_IS_OK(ntstatus)) {
|
---|
483 | ADS_ERROR_NT(ntstatus);
|
---|
484 | }
|
---|
485 | }
|
---|
486 |
|
---|
487 | return ADS_SUCCESS;
|
---|
488 | }
|
---|
489 |
|
---|
490 | /****************************************************************
|
---|
491 | ****************************************************************/
|
---|
492 |
|
---|
493 | ADS_STATUS gpo_process_gpo_list(ADS_STRUCT *ads,
|
---|
494 | TALLOC_CTX *mem_ctx,
|
---|
495 | const struct nt_user_token *token,
|
---|
496 | struct GROUP_POLICY_OBJECT *gpo_list,
|
---|
497 | const char *extensions_guid,
|
---|
498 | uint32_t flags)
|
---|
499 | {
|
---|
500 | ADS_STATUS status;
|
---|
501 | struct GROUP_POLICY_OBJECT *gpo;
|
---|
502 |
|
---|
503 | /* FIXME: ok, this is wrong, windows does process the extensions and
|
---|
504 | * hands the list of gpos to each extension and not process each gpo
|
---|
505 | * with all extensions (this is how the extension can store the list
|
---|
506 | * gplist in the registry) */
|
---|
507 |
|
---|
508 | for (gpo = gpo_list; gpo; gpo = gpo->next) {
|
---|
509 |
|
---|
510 | status = gpo_process_a_gpo(ads, mem_ctx, token, gpo,
|
---|
511 | extensions_guid, flags);
|
---|
512 |
|
---|
513 | if (!ADS_ERR_OK(status)) {
|
---|
514 | DEBUG(0,("failed to process gpo: %s\n",
|
---|
515 | ads_errstr(status)));
|
---|
516 | return status;
|
---|
517 | }
|
---|
518 |
|
---|
519 | }
|
---|
520 |
|
---|
521 | return ADS_SUCCESS;
|
---|
522 | }
|
---|
523 |
|
---|
524 | /****************************************************************
|
---|
525 | check wether the version number in a GROUP_POLICY_OBJECT match those of the
|
---|
526 | locally stored version. If not, fetch the required policy via CIFS
|
---|
527 | ****************************************************************/
|
---|
528 |
|
---|
529 | NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
|
---|
530 | TALLOC_CTX *mem_ctx,
|
---|
531 | uint32_t flags,
|
---|
532 | struct GROUP_POLICY_OBJECT *gpo,
|
---|
533 | struct cli_state **cli_out)
|
---|
534 | {
|
---|
535 | NTSTATUS result;
|
---|
536 | char *server = NULL;
|
---|
537 | char *share = NULL;
|
---|
538 | char *nt_path = NULL;
|
---|
539 | char *unix_path = NULL;
|
---|
540 | uint32_t sysvol_gpt_version = 0;
|
---|
541 | char *display_name = NULL;
|
---|
542 | struct cli_state *cli = NULL;
|
---|
543 |
|
---|
544 | result = gpo_explode_filesyspath(mem_ctx, gpo->file_sys_path,
|
---|
545 | &server, &share, &nt_path, &unix_path);
|
---|
546 |
|
---|
547 | if (!NT_STATUS_IS_OK(result)) {
|
---|
548 | goto out;
|
---|
549 | }
|
---|
550 |
|
---|
551 | result = gpo_get_sysvol_gpt_version(mem_ctx,
|
---|
552 | unix_path,
|
---|
553 | &sysvol_gpt_version,
|
---|
554 | &display_name);
|
---|
555 | if (!NT_STATUS_IS_OK(result) &&
|
---|
556 | !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
|
---|
557 | DEBUG(10,("check_refresh_gpo: "
|
---|
558 | "failed to get local gpt version: %s\n",
|
---|
559 | nt_errstr(result)));
|
---|
560 | goto out;
|
---|
561 | }
|
---|
562 |
|
---|
563 | DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
|
---|
564 | gpo->version, sysvol_gpt_version));
|
---|
565 |
|
---|
566 | /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
|
---|
567 |
|
---|
568 | while (gpo->version > sysvol_gpt_version) {
|
---|
569 |
|
---|
570 | DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
|
---|
571 |
|
---|
572 | if (*cli_out == NULL) {
|
---|
573 |
|
---|
574 | result = cli_full_connection(&cli,
|
---|
575 | global_myname(),
|
---|
576 | ads->config.ldap_server_name,
|
---|
577 | /* server */
|
---|
578 | NULL, 0,
|
---|
579 | share, "A:",
|
---|
580 | ads->auth.user_name, NULL,
|
---|
581 | ads->auth.password,
|
---|
582 | CLI_FULL_CONNECTION_USE_KERBEROS,
|
---|
583 | Undefined, NULL);
|
---|
584 | if (!NT_STATUS_IS_OK(result)) {
|
---|
585 | DEBUG(10,("check_refresh_gpo: "
|
---|
586 | "failed to connect: %s\n",
|
---|
587 | nt_errstr(result)));
|
---|
588 | goto out;
|
---|
589 | }
|
---|
590 |
|
---|
591 | *cli_out = cli;
|
---|
592 | }
|
---|
593 |
|
---|
594 | result = gpo_fetch_files(mem_ctx, *cli_out, gpo);
|
---|
595 | if (!NT_STATUS_IS_OK(result)) {
|
---|
596 | goto out;
|
---|
597 | }
|
---|
598 |
|
---|
599 | result = gpo_get_sysvol_gpt_version(mem_ctx,
|
---|
600 | unix_path,
|
---|
601 | &sysvol_gpt_version,
|
---|
602 | &display_name);
|
---|
603 | if (!NT_STATUS_IS_OK(result)) {
|
---|
604 | DEBUG(10,("check_refresh_gpo: "
|
---|
605 | "failed to get local gpt version: %s\n",
|
---|
606 | nt_errstr(result)));
|
---|
607 | goto out;
|
---|
608 | }
|
---|
609 |
|
---|
610 | if (gpo->version == sysvol_gpt_version) {
|
---|
611 | break;
|
---|
612 | }
|
---|
613 | }
|
---|
614 |
|
---|
615 | DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
|
---|
616 | DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
|
---|
617 | sysvol_gpt_version,
|
---|
618 | GPO_VERSION_USER(sysvol_gpt_version),
|
---|
619 | GPO_VERSION_MACHINE(sysvol_gpt_version)));
|
---|
620 | DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
|
---|
621 | gpo->version,
|
---|
622 | GPO_VERSION_USER(gpo->version),
|
---|
623 | GPO_VERSION_MACHINE(gpo->version)));
|
---|
624 |
|
---|
625 | result = NT_STATUS_OK;
|
---|
626 |
|
---|
627 | out:
|
---|
628 | return result;
|
---|
629 |
|
---|
630 | }
|
---|
631 |
|
---|
632 | /****************************************************************
|
---|
633 | check wether the version numbers in the gpo_list match the locally stored, if
|
---|
634 | not, go and get each required GPO via CIFS
|
---|
635 | ****************************************************************/
|
---|
636 |
|
---|
637 | NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
|
---|
638 | TALLOC_CTX *mem_ctx,
|
---|
639 | uint32_t flags,
|
---|
640 | struct GROUP_POLICY_OBJECT *gpo_list)
|
---|
641 | {
|
---|
642 | NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
|
---|
643 | struct cli_state *cli = NULL;
|
---|
644 | struct GROUP_POLICY_OBJECT *gpo;
|
---|
645 |
|
---|
646 | if (!gpo_list) {
|
---|
647 | return NT_STATUS_INVALID_PARAMETER;
|
---|
648 | }
|
---|
649 |
|
---|
650 | for (gpo = gpo_list; gpo; gpo = gpo->next) {
|
---|
651 |
|
---|
652 | result = check_refresh_gpo(ads, mem_ctx, flags, gpo, &cli);
|
---|
653 | if (!NT_STATUS_IS_OK(result)) {
|
---|
654 | goto out;
|
---|
655 | }
|
---|
656 | }
|
---|
657 |
|
---|
658 | result = NT_STATUS_OK;
|
---|
659 |
|
---|
660 | out:
|
---|
661 | if (cli) {
|
---|
662 | cli_shutdown(cli);
|
---|
663 | }
|
---|
664 |
|
---|
665 | return result;
|
---|
666 | }
|
---|
667 |
|
---|
668 | /****************************************************************
|
---|
669 | ****************************************************************/
|
---|
670 |
|
---|
671 | NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
|
---|
672 | uint32_t flags,
|
---|
673 | const char *filename,
|
---|
674 | const char *suffix,
|
---|
675 | const char **filename_out)
|
---|
676 | {
|
---|
677 | const char *tmp = NULL;
|
---|
678 | SMB_STRUCT_STAT sbuf;
|
---|
679 | const char *path = NULL;
|
---|
680 |
|
---|
681 | if (flags & GPO_LIST_FLAG_MACHINE) {
|
---|
682 | path = "Machine";
|
---|
683 | } else {
|
---|
684 | path = "User";
|
---|
685 | }
|
---|
686 |
|
---|
687 | tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
|
---|
688 | path, suffix);
|
---|
689 | NT_STATUS_HAVE_NO_MEMORY(tmp);
|
---|
690 |
|
---|
691 | if (sys_stat(tmp, &sbuf) == 0) {
|
---|
692 | *filename_out = tmp;
|
---|
693 | return NT_STATUS_OK;
|
---|
694 | }
|
---|
695 |
|
---|
696 | tmp = talloc_asprintf_strupper_m(mem_ctx, "%s/%s/%s", filename, path,
|
---|
697 | suffix);
|
---|
698 | NT_STATUS_HAVE_NO_MEMORY(tmp);
|
---|
699 |
|
---|
700 | if (sys_stat(tmp, &sbuf) == 0) {
|
---|
701 | *filename_out = tmp;
|
---|
702 | return NT_STATUS_OK;
|
---|
703 | }
|
---|
704 |
|
---|
705 | return NT_STATUS_NO_SUCH_FILE;
|
---|
706 | }
|
---|
707 |
|
---|