a
    W×a<  ã                   @   sX  d dl Z d dlZd dlmZmZ d dlmZmZmZm	Z	 d dl
mZ d dlmZmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZ d d	lmZ d dlZd d
lmZ d dlm Z  d dl!m"Z" d dl#m$Z$ e j% &d¡Z'e'd Z(e' )¡ Z'd *e'¡a+d *e' ,d¡d  ¡Z-de- a.da/dd„ Z0dd„ Z1dd„ Z2dd„ Z3dd„ Z4G dd „ d ej5ƒZ6dS )!é    N)ÚgpoÚtests)Úregister_gp_extensionÚlist_gp_extensionsÚunregister_gp_extensionÚ
GPOStorage)ÚLoadParm)Úcheck_refresh_gpo_listÚcheck_safe_pathÚ
check_guidÚparse_gpext_confÚatomic_write_confÚget_deleted_gpos_list)ÚPopenÚPIPE)ÚNamedTemporaryFileÚTemporaryDirectory)Ú
gp_sec_ext)Úgp_scripts_ext)ÚCredentials)Ú	get_bytes)Úpreg)Úndr_packZREALMz	/POLICIESz\\{0}\sysvol\{0}\Policiesz!DC={0},DC=samba,DC=example,DC=comÚ.zCN=Policies,CN=System,z[General]
Version=%dc                 C   s&   d}d}d}d}| | | | |  S )Né<   é   i€–˜ © )ÚvalZsecondsZminutesZhoursZsam_addr   r   ú1/usr/lib/python3/dist-packages/samba/tests/gpo.pyÚdays2rel_nttime,   s
    r   c                 C   s&   |   d¡}| d¡ t|ttd ¡ S )Núgpo update commandz--force©ÚstdoutÚstderr©ÚgetÚappendr   r   Úwait©ÚlpZgpupdater   r   r   Úgpupdate_force3   s    

r*   c                 C   s&   |   d¡}| d¡ t|ttd ¡ S )Nr    z	--unapplyr!   r$   r(   r   r   r   Úgpupdate_unapply9   s    

r+   c              
   C   sî   t j | ¡}t j |¡srzt  |¡ W nJ typ } z2|jtjkrNt j |¡s\W Y d }~dS W Y d }~n
d }~0 0 t j | ¡rŽt  	| d|  ¡ t
dt j | ¡d8}| t|ƒ¡ t  	|j| ¡ t  | d¡ W d   ƒ n1 sà0    Y  dS )NFú%s.bak)ÚdeleteÚdiri¤  T)ÚosÚpathÚdirnameÚexistsÚmakedirsÚOSErrorÚerrnoZEEXISTÚisdirÚrenamer   Úwriter   ÚnameÚchmod)r0   Údatar1   ÚeÚfr   r   r   Ú
stage_file?   s    $*r>   c                 C   s<   d|  }t j |¡r"t  || ¡ nt j | ¡r8t  | ¡ d S )Nr,   )r/   r0   r2   r7   Úremove)r0   Zbackupr   r   r   Úunstage_fileO   s
    r@   c                       sp   e Zd Z‡ fdd„Z‡ fdd„Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Z‡  ZS )ÚGPOTestsc                    sR   t t| ƒ ¡  tjd | _| j ¡ d | _tƒ | _	| j	 
¡  | j|  ¡ d| _d S )NZSERVERú$)Útemplate)ÚsuperrA   ÚsetUpr/   ÚenvironÚserverÚupperÚ
dc_accountr   r)   Zload_defaultZinsta_credsZget_credentialsÚcreds©Úself©Ú	__class__r   r   rE   W   s    
zGPOTests.setUpc                    s   t t| ƒ ¡  d S )N)rD   rA   ÚtearDownrK   rM   r   r   rO   _   s    zGPOTests.tearDownc                 C   sÖ   t  | j| j| j¡}| ¡ r,| | j ¡ ¡}d}d|g}d dt|f g}d d|t	f g}t
dt|ƒƒD ]j}|  || j|| d|| j ¡ |  || j|| d|| j ¡ |  || j|| d|| j ¡ qfd S )	Nú&{31B2F340-016D-11D2-945F-00C04FB984F9}zLocal Policyz%s\%szCN=%s,%sr   z+The gpo name did not match expected name %sz'file_sys_path did not match expected %sz!ds_path did not match expected %s)r   Ú
ADS_STRUCTrG   r)   rJ   ÚconnectÚget_gpo_listÚget_usernameÚpoldirÚdspathÚrangeÚlenÚassertEqualr9   Zfile_sys_pathZds_path)rL   ÚadsÚgposÚguidÚnamesZfile_sys_pathsZds_pathsÚir   r   r   Útest_gpo_listb   s"    ÿÿÿzGPOTests.test_gpo_listc                 C   s(   zt  | jd| j¡}W n   Y n0 d S )Né*   )r   rQ   rG   rJ   )rL   rZ   r   r   r   Útest_gpo_ads_does_not_segfaults   s    z'GPOTests.test_gpo_ads_does_not_segfaultc                 C   sæ   | j  d¡}d}tj |t|¡}t |¡d }ttj |d¡dƒ}| 	t
d ¡ W d   ƒ n1 sf0    Y  |  t |¡d dd¡ ttj |d¡dƒ}| 	t
| ¡ W d   ƒ n1 sÀ0    Y  |  t |¡d |d¡ d S )NÚ	gpo_cacherP   é   úGPT.INIÚwr`   z@gpo_get_sysvol_gpt_version() did not return the expected version)r)   Ú
cache_pathr/   r0   ÚjoinÚpoliciesr   Zgpo_get_sysvol_gpt_versionÚopenr8   Úgpt_datarY   )rL   Ú
local_pathr\   Zgpo_pathZold_versZgptr   r   r   Útest_gpt_versiony   s    ,ÿ,ÿzGPOTests.test_gpt_versionc                 C   s–   | j  d¡}t | j| j | j¡}| ¡ r8| | j ¡ ¡}t	| j| j | j|ƒ |  
tj |¡d| ¡ d}tj |t|d¡}|  
tj |¡d| ¡ d S )Nrb   zGPO cache %s was not createdrP   rd   zGPT.INI was not cached for %s)r)   rf   r   rQ   rG   rJ   rR   rS   rT   r	   Ú
assertTruer/   r0   r2   rg   rh   )rL   ÚcacherZ   r[   r\   Zgpt_inir   r   r   Útest_check_refresh_gpo_listŠ   s    ÿ
ÿÿz$GPOTests.test_check_refresh_gpo_listc                 C   s`   d}|   tt|¡ |  tdƒd¡ |  tdƒd¡ dt d }td }t|ƒ}|  ||d¡ d S )	Nz9/usr/local/samba/var/locks/sysvol/../../../../../../root/z/etc/passwdz
etc/passwdz\\etc/\passwdzsysvol/z8\Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INIz8/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INIz1check_safe_path() didn't correctly convert \ to /)ZassertRaisesr4   r
   rY   Úrealm)rL   r0   ZbeforeZafterÚresultr   r   r   Ú+test_check_refresh_gpo_list_malicious_pathsš   s    z4GPOTests.test_check_refresh_gpo_list_malicious_pathsc           	      C   sr  t j t j t¡¡}t j t j |d¡¡}t j |d¡}d}t|d|| jjddd}|  	|d¡ t
| jjƒ}|  	|| ¡ v d	¡ |  || d
 |d	¡ t|ƒ t
| jjƒ}|  	|| ¡ vd¡ |  	t|ƒd¡ |  tdƒd¡ t| jjƒ\}}|  	|oø|d¡ | d¡ | dd|¡ t||ƒ t| jjƒ\}}|  	d| ¡ v d¡ |  | dd¡|d¡ | d¡ t||ƒ d S )Nz	../../../zpython/samba/gp_sec_ext.pyz&{827D319E-6EAC-11D2-A4EA-00C04F79F83A}r   TF)Zsmb_confÚmachineÚuserzFailed to register a gp extzFailed to list gp extsZDllNamezFailed to unregister gp extszFailed to parse valid guidZAAAAAABBBBBBBCCCzParsed invalid guidz!parse_gpext_conf() invalid returnZtest_sectionZtest_varz$test_section not found in gpext.confz*Failed to find test variable in gpext.conf)r/   r0   r1   ÚrealpathÚ__file__rg   r   r)   Z
configfilerm   r   ÚkeysrY   r   r   ZassertFalser   Zadd_sectionÚsetr   Zsectionsr%   Zremove_section)	rL   Z	this_pathZ
samba_pathZext_pathZext_guidÚretZgp_extsr)   Úparserr   r   r   Útest_gpt_ext_register«   sJ    þÿÿÿ

ÿÿ
zGPOTests.test_gpt_ext_registerc                 C   s^  | j  dd¡}ddg}dt d }d}| j  d¡}ttj |d	¡ƒ}|D ]*}|||f }t||ƒ}	|  |	d
| ¡ qHt	| j ƒ}	|  
|	dd¡ | | j¡}
|
 ¡ }|  
t|ƒdd¡ |  |d |d|d  ¡ |  |d |d|d  ¡ |
 |¡}|D ]”}|  d|d d¡ |  d|d d d¡ |d |d krV|  
t|d d d ƒtdƒd¡ qô|d |d krô|  
t|d d d ƒtdƒd¡ qôt | j| j | j¡}| ¡ r´| | j¡}t|
|d d… ƒ}|  
t|ƒdd¡ |  
|d |d d d¡ |  d|d d d¡ |  d|d d d d¡ |D ]}|||f }t|ƒ q&t| j ƒ}	|  
|	dd¡ d S )Nr0   ZsysvolrP   ú&{6AC1786C-016F-11D2-945F-00C04FB984F9}ú%s/z=/Policies/%s/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.infz)[System Access]
MinimumPasswordAge = 998
úcache directoryúgpo.tdbúCould not create the target %sr   zgpupdate force failedé   zThe guids were not foundz%s not in applied guidsrc   zSystem AccesszSystem Access policies not setZ	minPwdAgezminPwdAge policy not setiæ  éÿÿÿÿz!Returned delete gpos is incorrectz GUID for delete gpo is incorrectz*System Access policies not set for removalz$minPwdAge policy not set for removalzgpupdate unapply failed)r)   r%   rp   r   r/   r0   rg   r>   rm   r*   rY   Ú	get_gplogrI   Zget_applied_guidsrX   ÚassertInZget_applied_settingsÚintr   r   rQ   rG   rJ   rR   rS   r   r@   r+   )rL   rk   ÚguidsÚgpofileÚstageÚ	cache_dirÚstorer\   Úgpttmplry   Úgp_dbZapplied_guidsZapplied_settingsZpolicyrZ   r[   Údel_gposr   r   r   Útest_gp_log_get_appliedÐ   sx    ÿ


ÿ
ÿ
ÿÿþþ
ÿÿÿ
z GPOTests.test_gp_log_get_appliedc                 C   s¬  | j  d¡}ddg}dt d }t d¡}| j  d¡}ttj 	|d¡ƒ}t
ƒ }| | j ¡ | ¡  t|| j ||ƒ}t | j| j |¡}	|	 ¡ rš|	 | ¡ ¡}
d	}d
dg}tddƒD ]6}|||| f }t||||  ƒ}|  |d| ¡ q°| g |
¡ | d¡}|  ||d d¡ | | ¡ ¡}t|g ƒ}| |g ¡ | d¡}|  |d d¡ | g |
d d… ¡ | d¡}|  ||d d¡ | |g ¡ |D ]}|||f }t|ƒ qŒd S )Nrb   rP   r|   r}   z4/%s/MACHINE/MICROSOFT/WINDOWS NT/SECEDIT/GPTTMPL.INFÚ	gpo_testsr~   r   z$[Kerberos Policy]
MaxTicketAge = %d
éd   éÈ   r   r   r€   zkdc:user_ticket_lifetimerc   z"Higher priority policy was not setz$MaxTicketAge should not have appliedr‚   z!Lower priority policy was not set)r)   rf   rh   ÚloggingÚ	getLoggerr%   r   r/   r0   rg   r   ÚguessÚset_machine_accountr   r   rQ   rG   rR   rS   rT   rW   r>   rm   Úprocess_group_policyZget_intrY   rƒ   r   r@   )rL   rk   r†   r‡   Úloggerr‰   rŠ   Úmachine_credsÚextrZ   r[   rˆ   Zoptsr^   r‹   ry   rŒ   r   r\   r   r   r   Útest_process_group_policy  sH    ÿ




z"GPOTests.test_process_group_policyc                 C   s€  | j  d¡}d}tj |t|d¡}t d¡}| j  d¡}t	tj |d¡ƒ}t
ƒ }| | j ¡ | ¡  t|| j ||ƒ}t | j| j |¡}	|	 ¡ rœ|	 | ¡ ¡}
t ¡ }t ¡ }d|_d|_d	|_d
|_d	|_|g|_t|t|ƒƒ}|  |d| ¡ t ƒ l}| !g |
|¡ t "|¡}|  #t$|ƒd	d¡ t%tj ||d ¡gt&d '¡ \}}|  (d|d¡ W d   ƒ n1 sj0    Y  t)|ƒ d S )Nrb   rP   zMACHINE/REGISTRY.POLr   r~   r   s3   Software\Policies\Samba\Unix Settings\Daily Scriptss%   Software\Policies\Samba\Unix Settingsrc   s   echo hello worldr€   z The daily script was not createdr   )r"   s   hello worldzDaily script execution failed)*r)   rf   r/   r0   rg   rh   r’   r“   r%   r   r   r”   r•   r   r   rQ   rG   rR   rS   rT   r   ÚfileÚentryZkeynameZ	valuenameÚtyper;   Znum_entriesÚentriesr>   r   rm   r   r–   ÚlistdirZassertEqualsrX   r   r   Zcommunicater„   r@   )rL   rk   r\   Zreg_polr—   r‰   rŠ   r˜   r™   rZ   r[   rˆ   r<   ry   ZdnameZscriptsÚoutÚ_r   r   r   Útest_gp_daily_scriptsC  s@    ÿ

$.zGPOTests.test_gp_daily_scripts)Ú__name__Ú
__module__Ú__qualname__rE   rO   r_   ra   rl   ro   rr   r{   rŽ   rš   r¢   Ú__classcell__r   r   rM   r   rA   V   s   %<7rA   )7r/   r5   Zsambar   r   Zsamba.gpclassr   r   r   r   Zsamba.paramr   r	   r
   r   r   r   r   Ú
subprocessr   r   Ztempfiler   r   Zsamba.gp_sec_extr   Zsamba.gp_scripts_extr   r’   Zsamba.credentialsr   Zsamba.compatr   Zsamba.dcerpcr   Z	samba.ndrr   rF   r%   rp   rh   ÚlowerÚformatrU   ÚsplitZbase_dnrV   rj   r   r*   r+   r>   r@   ZTestCaserA   r   r   r   r   Ú<module>   s6    
