summaryrefslogtreecommitdiff
path: root/python/samba/gp
AgeCommit message (Collapse)AuthorFilesLines
2025-07-10Add check for the GPO link to have at least two attributes separated by ↵Aleksandr Sharov1-1/+3
semicolumn. Allows to handle empty links. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15877 RN: Fix handling of empty GPO link Singed-off-by: Alex Sharov (kororland@gmail.com) Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jul 10 18:55:33 UTC 2025 on atb-devel-224
2025-03-25python:gp_cert_auto_enrol: fix GUID stringificationDouglas Bagnall1-9/+4
We were using some broken ad-hoc unpacking to do what the ndr unpacker does perfectly well. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15839 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Mar 25 05:21:49 UTC 2025 on atb-devel-224
2024-04-17python: Fix NtVer check for site_dn_for_machine()Andreas Schneider1-3/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15633 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Apr 17 19:32:11 UTC 2024 on atb-devel-224
2024-02-26python:gp: Implement client site lookup in site_dn_for_machine()Andreas Schneider1-23/+45
This is [MS-GPOL] 3.2.5.1.4 Site Search. The netr_DsRGetSiteName() needs to run over local rpc, however we do not have the call implemented in our rpc_server. What netr_DsRGetSiteName() actually does is an ldap query to get the sitename, we can just do the same. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15588 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Feb 26 08:06:08 UTC 2024 on atb-devel-224
2024-01-30python:gp: Fix logging with gpAndreas Schneider1-2/+3
This allows enable INFO level logging with: `samba-gpupdate -d3` BUG: https://bugzilla.samba.org/show_bug.cgi?id=15558 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jan 30 07:18:05 UTC 2024 on atb-devel-224
2024-01-29python:gp: Improve working of log messages to avoid confusionAndreas Schneider1-4/+2
We should not use the word "Failed". We are totally fine if we can't connect to NDES in the meantime. This logs: Try to get root or server certificates. Unable to install root certificates (requires NDES). Installing the server certificate only. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 29 10:37:29 UTC 2024 on atb-devel-224
2024-01-29python:gp: Log an error if update failsAndreas Schneider1-1/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Do not print an error if template already existsAndreas Schneider1-2/+6
We will get an exit status for duplicate in future: https://www.pagure.io/certmonger/issue/269 We can't really fix that right now, as older version of certmonger don't support the `-v` option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Do not print an error, if CA already existsAndreas Schneider1-2/+6
We will get an exit status for duplicate in future: https://www.pagure.io/certmonger/issue/269 We can't really fix that right now, as older version of certmonger don't support the `-v` option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Improve logging for certificate enrollmentAndreas Schneider1-1/+10
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-29python:gp: Avoid path check for cepces-submitAndreas Schneider1-2/+2
find_cepces_submit() uses which(), which returns None if not found. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15559 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-01-23gp: Skip site GP list if no site is foundDavid Mulder1-12/+18
[MS-GPOL] 3.2.5.1.4 Site Search says if the site search returns ERROR_NO_SITENAME, the GP site search should be skipped. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jan 23 11:20:35 UTC 2024 on atb-devel-224
2024-01-22gpo: Do not get templates list on first runGabriel Nagy1-1/+2
This is a visual fix and has no impact on functionality apart from cleaner log messages. The point of this is to get the list of supported templates in order to compute a diff between the current applied templates and the updated list, so we are able to unapply and reapply the policy in case there are differences. However this code path is executed on first applies as well, at which point the root CA is not yet set up. This causes the `get_supported_templates` call to fail, which is not a hard failure but still pollutes the logs. In this case it's safe to avoid executing the command as the policy will be applied regardless. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 22 16:48:57 UTC 2024 on atb-devel-224
2024-01-22gpo: Decode base64 root cert before importingGabriel Nagy1-2/+3
The reasoning behind this is described in the previous commit message, but essentially this should either be wrapped in certificate blocks and imported as PEM, or converted back to binary and imported as DER. I've opted for the latter since it's how it used to work before it regressed in 157335ee93e. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15557 Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-01-10python:gp: Print a nice message if cepces-submit can't be foundAndreas Schneider1-11/+13
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15552 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jan 10 09:54:34 UTC 2024 on atb-devel-224
2023-12-15python: pep257: docstring should use double quotesRob van der Linde3-66/+66
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-08gp: Remove unused importJoseph Sutton1-2/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16gpdupate: Implement Drive Maps Client Side ExtensionDavid Mulder2-2/+210
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16gpupdate: Test Drive Maps Client Side ExtensionDavid Mulder1-0/+28
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26python: Change the generic merge_nt_token() to being specific to the ↵Andrew Bartlett1-6/+7
system_token This allows us to punt on the question of merging the claims, as there are none on the system token. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-08-30gp: Use read_file() instead of readfp()Joseph Sutton1-2/+2
readfp() is deprecated and could be removed in a future version of Python. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Fix resource leaksJoseph Sutton6-13/+38
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Prefer ‘x not in y’ to ‘not x in y’Joseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Don’t shadow importsJoseph Sutton1-7/+7
Rename a variable that shadows an import of ‘gp_ext’. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30gp: Add missing importJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Fix invalid escape sequencesJoseph Sutton1-3/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Remove redundant backslashesJoseph Sutton6-10/+10
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-30python: Remove unused importsJoseph Sutton11-20/+9
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-28gp: Send list of keys instead of dict to removeGabriel Nagy1-1/+1
`cache_get_all_attribute_values` returns a dict whereas we need to pass a list of keys to `remove`. These will be interpolated in the gpdb search. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224
2023-08-28gp: Template changes should invalidate cacheGabriel Nagy1-5/+10
If certificate templates are added or removed, the autoenroll extension should react to this and reapply the policy. Previously this wasn't taken into account. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Convert CA certificates to base64Gabriel Nagy1-3/+2
I don't know whether this applies universally, but in our case the contents of `es['cACertificate'][0]` are binary, so cleanly converting to a string fails with the following: 'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte We found a fix to be encoding the certificate to base64 when constructing the CA list. Section 4.4.5.2 of MS-CAESO also suggests that the content of `cACertificate` is binary (OCTET string). Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Change root cert extension suffixGabriel Nagy1-1/+2
On Ubuntu, certificates must end in '.crt' in order to be considered by the `update-ca-certificates` helper. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Support update-ca-trust helperGabriel Nagy1-1/+5
This is used on RHEL/Fedora instead of update-ca-certificates. They behave similarly so it's enough to change the command name. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-08-28gp: Support more global trust directoriesGabriel Nagy1-1/+11
In addition to the SUSE global trust directory, add support for RHEL and Debian-based distributions (including Ubuntu). To determine the correct directory to use, we iterate over the variants and stop at the first which is a directory. In case none is found, fallback to the first option which will produce a warning as it did previously. Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: David Mulder <dmulder@samba.org>
2023-07-31gp: Cleanup some unused codeDavid Mulder2-2/+0
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Jul 31 10:55:26 UTC 2023 on atb-devel-224
2023-07-31gp: Ensure centrify crontab user policy performs proper cleanupDavid Mulder1-51/+24
This resolves cleanup issues for user and group centrify compatible policies. It also ensures the crontab policies use functions from the scripts policy, to avoid code duplication and simplify cleanup. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure script user policy performs proper cleanupDavid Mulder1-30/+34
This resolves cleanup issues for scripts user policy. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure smb.conf policy preforms proper cleanupDavid Mulder1-26/+51
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure MOTD policy preforms proper cleanupDavid Mulder1-18/+29
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure Issue policy preforms proper cleanupDavid Mulder1-18/+29
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure Messages policy preforms proper cleanupDavid Mulder1-33/+41
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure Firefox policy preforms proper cleanupDavid Mulder1-45/+94
Now uses gp_misc_applier to ensure old settings are properly cleaned up. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Add a misc applier, to assist some gp extsDavid Mulder1-0/+27
Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-31gp: Ensure Firewalld preforms proper cleanupDavid Mulder1-30/+44
Now uses gp_applier to ensure old settings are properly cleaned up. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-23python:samba:gp: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-10gp: Fix user apply failure when droping privsDavid Mulder1-1/+1
When dropping privileges, gpupdate errored: gpclass.py:1167: KeyError: "getpwnam(): name not found: <HOSTNAME> apply_gp was incorrectly passing the hostname instead of the username. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Jun 10 10:46:28 UTC 2023 on atb-devel-224
2023-05-19gp: sshd policy correctly sort policyDavid Mulder1-5/+13
The sshd_config man page says that key value pairs 'the first obtained value will be used'. So we need to sort policies from last to first. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri May 19 01:23:19 UTC 2023 on atb-devel-224
2023-05-09gp: get_gpo() should re-raise the Exception, not returnDavid Mulder1-1/+1
If we return from this failure, then `new_gpo` is set to `None` and we will fail in some obscure way within a CSE later (since we append `None` to the GPO list). Instead, re-raise the Exception so we see that an error happened when fetching the GPO. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28gp: Add site-dn fallback when rpc call failsDavid Mulder1-4/+22
In testing I noticed that the rpc call for the site name is failing when joined via SSSD. This commit adds a fallback to check using the old style method found in ads_site_dn_for_machine() (which works, but doesn't obey the Group Policy spec) if the rpc call fails. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Apr 28 03:14:25 UTC 2023 on atb-devel-224
2023-04-28gpupdate: Deprecate libgpo.get_gpo_listDavid Mulder1-0/+17
This is no longer used by gpupdate. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15225 Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 23:27:36 +0000