From: David Mulder <dmulder@suse.com>
Date: Wed, 23 Dec 2020 21:14:49 +0000 (-0700)
Subject: samba-tool: Add a gpo command for listing VGP OpenSSH Group Policy
X-Git-Tag: tevent-0.11.0~1777
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3c47a81472b71642ef92522a27cbd2c14865bf43;p=thirdparty%2Fsamba.git

samba-tool: Add a gpo command for listing VGP OpenSSH Group Policy

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py
index 1b2629a5496..796945f5d2f 100644
--- a/python/samba/netcmd/gpo.py
+++ b/python/samba/netcmd/gpo.py
@@ -2788,7 +2788,48 @@ samba-tool gpo manage openssh list {31B2F340-016D-11D2-945F-00C04FB984F9}
     takes_args = ["gpo"]
 
     def run(self, gpo, H=None, sambaopts=None, credopts=None, versionopts=None):
-        pass
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        # SMB connect to DC
+        conn = smb_connection(dc_hostname,
+                              'sysvol',
+                              lp=self.lp,
+                              creds=self.creds)
+
+        realm = self.lp.get('realm')
+        vgp_xml = '\\'.join([realm.lower(), 'Policies', gpo,
+                                'MACHINE\\VGP\\VTLA\\SshCfg',
+                                'SshD\\manifest.xml'])
+        try:
+            xml_data = ET.fromstring(conn.loadfile(vgp_xml))
+        except NTSTATUSError as e:
+            # STATUS_OBJECT_NAME_INVALID, STATUS_OBJECT_NAME_NOT_FOUND,
+            # STATUS_OBJECT_PATH_NOT_FOUND
+            if e.args[0] in [0xC0000033, 0xC0000034, 0xC000003A]:
+                return # The file doesn't exist, so there is nothing to list
+            if e.args[0] == 0xC0000022: # STATUS_ACCESS_DENIED
+                raise CommandError("The authenticated user does "
+                                   "not have sufficient privileges")
+            raise
+
+        policy = xml_data.find('policysetting')
+        data = policy.find('data')
+        configfile = data.find('configfile')
+        for configsection in configfile.findall('configsection'):
+            if configsection.find('sectionname').text:
+                continue
+            for kv in configsection.findall('keyvaluepair'):
+                self.outf.write('%s %s\n' % (kv.find('key').text,
+                                             kv.find('value').text))
 
 class cmd_openssh(SuperCommand):
     """Manage OpenSSH Group Policy Objects"""
diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo
deleted file mode 100644
index d4b825c63a7..00000000000
--- a/selftest/knownfail.d/gpo
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.samba_tool.gpo.samba.tests.samba_tool.gpo.GpoCmdTestCase.test_vgp_openssh_list