297 lines
14 KiB
TypeScript
297 lines
14 KiB
TypeScript
import { createHash } from 'node:crypto';
|
|
import type {
|
|
GpoLocalGroupPreferenceValue,
|
|
GpoLocalUserPreferenceValue,
|
|
GpoPolicyObservation,
|
|
GpoPreferenceContext
|
|
} from '../../src/domain/gpo-policy';
|
|
import { gpoPolicyObservationValidationErrors } from '../../src/domain/gpo-policy';
|
|
import type { GpoPolicyScope } from '../../src/domain/gpo-ingestion';
|
|
import { xmlElementStartLines } from './xml-source-lines';
|
|
|
|
export const GPP_LOCAL_USERS_GROUPS_REDUCER = { id: 'gpo-preferences-local-users-groups-reducer', version: '1.0.0' } as const;
|
|
|
|
const groupsClsid = '3125e937-eb16-4b4c-9934-544fc6d24d26';
|
|
const userClsid = 'df5f1855-51e5-4d24-8b1a-d9bde98ba1d1';
|
|
const groupClsid = '6d4a79e4-529c-4481-abd0-f5bd7ea93ba7';
|
|
const guidPattern = /^\{?([a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12})\}?$/i;
|
|
const sidPattern = /^S-\d(?:-\d+)+$/i;
|
|
|
|
type Operation = GpoPreferenceContext['operation'];
|
|
type Targeting = GpoPreferenceContext['targeting'];
|
|
|
|
interface CommonInstruction {
|
|
version: 1;
|
|
cse: 'local-users-groups';
|
|
uid: string;
|
|
sequence: number;
|
|
line: number;
|
|
operation: Operation;
|
|
disabled: boolean;
|
|
removePolicy: boolean;
|
|
applyOnce: boolean;
|
|
targeting: Targeting;
|
|
}
|
|
|
|
export interface GppLocalUserInstruction extends CommonInstruction {
|
|
itemType: 'user';
|
|
value: GpoLocalUserPreferenceValue;
|
|
}
|
|
|
|
export interface GppLocalGroupInstruction extends CommonInstruction {
|
|
itemType: 'group';
|
|
value: GpoLocalGroupPreferenceValue;
|
|
}
|
|
|
|
export type GppLocalUsersGroupsInstruction = GppLocalUserInstruction | GppLocalGroupInstruction;
|
|
|
|
export interface LocalUsersGroupsPreferenceDocument {
|
|
version: 1;
|
|
parser: { id: string; version: string };
|
|
sourcePath: string;
|
|
sourceSha256: string;
|
|
scope: GpoPolicyScope;
|
|
preferenceType: 'local-users-groups';
|
|
status: 'complete' | 'partial' | 'invalid';
|
|
secretIndicatorStatus: 'not-detected' | 'present';
|
|
instructions: GppLocalUsersGroupsInstruction[];
|
|
diagnosticCodes: string[];
|
|
}
|
|
|
|
export interface LocalUsersGroupsParseContext {
|
|
root: Element;
|
|
text: string;
|
|
scope: GpoPolicyScope;
|
|
parser: { id: string; version: string };
|
|
sourcePath: string;
|
|
sourceSha256: string;
|
|
secretIndicatorStatus: 'not-detected' | 'present';
|
|
diagnostics: Set<string>;
|
|
summarizeTargeting: (item: Element, diagnostics: Set<string>) => Targeting | undefined;
|
|
}
|
|
|
|
function attribute(element: Element, name: string): string | undefined {
|
|
const normalized = name.toLocaleLowerCase('en-US');
|
|
return [...element.attributes].find(candidate => candidate.localName.toLocaleLowerCase('en-US') === normalized)?.value;
|
|
}
|
|
|
|
function canonicalGuid(value: string | undefined): string | undefined {
|
|
return value ? guidPattern.exec(value.trim())?.[1].toLocaleLowerCase('en-US') : undefined;
|
|
}
|
|
|
|
function booleanAttribute(element: Element, name: string, diagnostics: Set<string>, optional = false): boolean | undefined {
|
|
const value = attribute(element, name);
|
|
if (value === undefined) return optional ? undefined : false;
|
|
if (value === '0') return false;
|
|
if (value === '1') return true;
|
|
diagnostics.add('gpo-preference-boolean-invalid');
|
|
return optional ? undefined : false;
|
|
}
|
|
|
|
function operation(value: string | undefined): Operation | undefined {
|
|
const code = (value ?? 'U').toLocaleUpperCase('en-US');
|
|
return ({ C: 'create', D: 'delete', R: 'replace', U: 'update' } as const)[code as 'C' | 'D' | 'R' | 'U'];
|
|
}
|
|
|
|
function itemLines(text: string): number[] {
|
|
return xmlElementStartLines(text, /<(?:[A-Za-z_][\w.-]*:)?(?:User|Group)(?=[\s/>])/g);
|
|
}
|
|
|
|
function directChildren(element: Element, name: string): Element[] {
|
|
const normalized = name.toLocaleLowerCase('en-US');
|
|
return [...element.children].filter(child => child.localName.toLocaleLowerCase('en-US') === normalized);
|
|
}
|
|
|
|
function textAttribute(element: Element, name: string): string | undefined {
|
|
const value = attribute(element, name);
|
|
return value?.trim() ? value : undefined;
|
|
}
|
|
|
|
function parseUserValue(properties: Element, itemOperation: Operation, diagnostics: Set<string>): GpoLocalUserPreferenceValue | undefined {
|
|
if (properties.children.length) {
|
|
diagnostics.add('gpo-preference-local-user-item-unsupported');
|
|
return undefined;
|
|
}
|
|
const userName = textAttribute(properties, 'userName');
|
|
if (!userName) { diagnostics.add('gpo-preference-local-user-target-invalid'); return undefined; }
|
|
const expires = textAttribute(properties, 'expires');
|
|
if (expires && !/^\d{4}-\d{2}-\d{2}$/.test(expires)) { diagnostics.add('gpo-preference-local-user-expiry-invalid'); return undefined; }
|
|
const noChange = booleanAttribute(properties, 'noChange', diagnostics, true);
|
|
return {
|
|
kind: 'local-user-preference',
|
|
userName,
|
|
newName: itemOperation === 'update' ? textAttribute(properties, 'newName') : undefined,
|
|
fullName: textAttribute(properties, 'fullName'),
|
|
description: textAttribute(properties, 'description'),
|
|
passwordAttributePresent: [...properties.attributes].some(candidate => candidate.localName.toLocaleLowerCase('en-US') === 'cpassword'),
|
|
changePasswordAtLogon: booleanAttribute(properties, 'changeLogon', diagnostics, true),
|
|
accountDisabled: booleanAttribute(properties, 'acctDisabled', diagnostics, true),
|
|
passwordNeverExpires: booleanAttribute(properties, 'neverExpires', diagnostics, true),
|
|
passwordChangeAllowed: noChange === undefined ? undefined : !noChange,
|
|
expires
|
|
};
|
|
}
|
|
|
|
function parseGroupValue(properties: Element, itemOperation: Operation, diagnostics: Set<string>): GpoLocalGroupPreferenceValue | undefined {
|
|
const allowedChildren = [...properties.children].every(child => child.localName.toLocaleLowerCase('en-US') === 'members');
|
|
const membersContainers = directChildren(properties, 'members');
|
|
if (!allowedChildren || membersContainers.length > 1) {
|
|
diagnostics.add('gpo-preference-local-group-item-unsupported');
|
|
return undefined;
|
|
}
|
|
const groupName = textAttribute(properties, 'groupName');
|
|
const groupSid = textAttribute(properties, 'groupSid');
|
|
if (!groupName || (groupSid && !sidPattern.test(groupSid))) {
|
|
diagnostics.add('gpo-preference-local-group-target-invalid');
|
|
return undefined;
|
|
}
|
|
const currentUserCode = textAttribute(properties, 'userAction')?.toLocaleUpperCase('en-US');
|
|
if (currentUserCode && !['ADD', 'REMOVE'].includes(currentUserCode)) {
|
|
diagnostics.add('gpo-preference-local-group-user-action-invalid');
|
|
return undefined;
|
|
}
|
|
const members: GpoLocalGroupPreferenceValue['members'] = [];
|
|
for (const member of membersContainers.flatMap(container => [...container.children])) {
|
|
if (member.localName.toLocaleLowerCase('en-US') !== 'member' || member.children.length) {
|
|
diagnostics.add('gpo-preference-local-group-member-invalid');
|
|
return undefined;
|
|
}
|
|
const memberOperation = textAttribute(member, 'action')?.toLocaleUpperCase('en-US');
|
|
const sid = textAttribute(member, 'sid');
|
|
const name = textAttribute(member, 'name');
|
|
if (!['ADD', 'REMOVE'].includes(memberOperation ?? '') || (sid ? !sidPattern.test(sid) : !name)) {
|
|
diagnostics.add('gpo-preference-local-group-member-invalid');
|
|
return undefined;
|
|
}
|
|
members.push({
|
|
sequence: members.length,
|
|
operation: memberOperation === 'ADD' ? 'add' : 'remove',
|
|
selector: sid ? { kind: 'sid', value: sid } : { kind: 'name', value: name! }
|
|
});
|
|
}
|
|
return {
|
|
kind: 'local-group-preference',
|
|
groupName,
|
|
groupSid,
|
|
newName: itemOperation === 'update' ? textAttribute(properties, 'newName') : undefined,
|
|
description: textAttribute(properties, 'description'),
|
|
currentUserOperation: currentUserCode ? currentUserCode === 'ADD' ? 'add' : 'remove' : undefined,
|
|
suppressCurrentUserOperation: booleanAttribute(properties, 'removeAccounts', diagnostics) ?? false,
|
|
deleteAllUsers: booleanAttribute(properties, 'deleteAllUsers', diagnostics) ?? false,
|
|
deleteAllGroups: booleanAttribute(properties, 'deleteAllGroups', diagnostics) ?? false,
|
|
members
|
|
};
|
|
}
|
|
|
|
export function parseLocalUsersGroupsPreference(context: LocalUsersGroupsParseContext): LocalUsersGroupsPreferenceDocument {
|
|
const { root, diagnostics } = context;
|
|
const rootDisabled = booleanAttribute(root, 'disabled', diagnostics) ?? false;
|
|
if (canonicalGuid(attribute(root, 'clsid')) !== groupsClsid) diagnostics.add('gpo-preference-local-users-groups-root-invalid');
|
|
const items = [...root.children].filter(child => ['user', 'group'].includes(child.localName.toLocaleLowerCase('en-US')));
|
|
const unknownRootChildren = [...root.children].some(child => !['user', 'group'].includes(child.localName.toLocaleLowerCase('en-US')));
|
|
let partial = unknownRootChildren;
|
|
if (unknownRootChildren) diagnostics.add('gpo-preference-local-users-groups-item-unsupported');
|
|
const lines = itemLines(context.text);
|
|
if (lines.length !== items.length) diagnostics.add('gpo-preference-line-provenance-invalid');
|
|
let invalid = diagnostics.has('gpo-preference-attribute-limit')
|
|
|| diagnostics.has('gpo-preference-local-users-groups-root-invalid')
|
|
|| diagnostics.has('gpo-preference-line-provenance-invalid')
|
|
|| diagnostics.has('gpo-preference-boolean-invalid');
|
|
const instructions: GppLocalUsersGroupsInstruction[] = [];
|
|
items.forEach((item, sequence) => {
|
|
const itemType = item.localName.toLocaleLowerCase('en-US') as 'user' | 'group';
|
|
const before = diagnostics.size;
|
|
const uid = canonicalGuid(attribute(item, 'uid'));
|
|
const expectedClsid = itemType === 'user' ? userClsid : groupClsid;
|
|
if (!uid || canonicalGuid(attribute(item, 'clsid')) !== expectedClsid) diagnostics.add('gpo-preference-local-users-groups-item-invalid');
|
|
const properties = directChildren(item, 'properties');
|
|
const allowedItemChildren = [...item.children].every(child => ['properties', 'filters'].includes(child.localName.toLocaleLowerCase('en-US')));
|
|
if (properties.length !== 1 || !allowedItemChildren) diagnostics.add('gpo-preference-local-users-groups-item-invalid');
|
|
const props = properties[0];
|
|
const itemOperation = props ? operation(attribute(props, 'action')) : undefined;
|
|
if (!itemOperation) diagnostics.add('gpo-preference-action-invalid');
|
|
const removePolicy = booleanAttribute(item, 'removePolicy', diagnostics) ?? false;
|
|
const applyOnce = booleanAttribute(item, 'applyOnce', diagnostics) ?? false;
|
|
const itemDisabled = booleanAttribute(item, 'disabled', diagnostics) ?? false;
|
|
const itemTargeting = context.summarizeTargeting(item, diagnostics);
|
|
if (itemOperation === 'delete' && removePolicy) diagnostics.add('gpo-preference-remove-policy-invalid');
|
|
const unsupportedShape = props && (itemType === 'user'
|
|
? props.children.length > 0
|
|
: ![...props.children].every(child => child.localName.toLocaleLowerCase('en-US') === 'members')
|
|
|| directChildren(props, 'members').length > 1);
|
|
const value = props && itemOperation
|
|
? itemType === 'user' ? parseUserValue(props, itemOperation, diagnostics) : parseGroupValue(props, itemOperation, diagnostics)
|
|
: undefined;
|
|
if (unsupportedShape) { partial = true; return; }
|
|
if (diagnostics.size !== before || !uid || !itemOperation || !itemTargeting || !value) { invalid = true; return; }
|
|
const common: CommonInstruction = {
|
|
version: 1, cse: 'local-users-groups', uid, sequence, line: lines[sequence] ?? 1,
|
|
operation: itemOperation, disabled: rootDisabled || itemDisabled,
|
|
removePolicy, applyOnce, targeting: itemTargeting
|
|
};
|
|
instructions.push(itemType === 'user'
|
|
? { ...common, itemType: 'user', value: value as GpoLocalUserPreferenceValue }
|
|
: { ...common, itemType: 'group', value: value as GpoLocalGroupPreferenceValue });
|
|
});
|
|
if (diagnostics.has('gpo-preference-boolean-invalid')) invalid = true;
|
|
return {
|
|
version: 1,
|
|
parser: context.parser,
|
|
sourcePath: context.sourcePath,
|
|
sourceSha256: context.sourceSha256,
|
|
scope: context.scope,
|
|
preferenceType: 'local-users-groups',
|
|
status: invalid ? 'invalid' : partial ? 'partial' : 'complete',
|
|
secretIndicatorStatus: context.secretIndicatorStatus,
|
|
instructions: invalid ? [] : instructions,
|
|
diagnosticCodes: [...diagnostics].sort()
|
|
};
|
|
}
|
|
|
|
export function reduceLocalUsersGroupsPreferences(
|
|
document: LocalUsersGroupsPreferenceDocument,
|
|
context: { backupInstanceId: string; sourceArtifactId: string; artifactId: string }
|
|
): GpoPolicyObservation[] {
|
|
if (document.status === 'invalid' || !['computer', 'user'].includes(document.scope)) return [];
|
|
return document.instructions.map(instruction => {
|
|
const target = instruction.itemType === 'user'
|
|
? instruction.value.userName.toLocaleLowerCase('en-US')
|
|
: instruction.value.groupSid?.toLocaleUpperCase('en-US') ?? instruction.value.groupName.toLocaleLowerCase('en-US');
|
|
const id = `gpo-policy-${createHash('sha256').update([
|
|
context.backupInstanceId, document.sourceSha256, instruction.uid, String(instruction.sequence), GPP_LOCAL_USERS_GROUPS_REDUCER.version
|
|
].join('\0')).digest('hex').slice(0, 32)}`;
|
|
const diagnostics = new Set<string>();
|
|
if (instruction.targeting.status === 'present') diagnostics.add('gpo-preference-targeting-unevaluated');
|
|
if (instruction.itemType === 'user' && instruction.value.passwordAttributePresent) diagnostics.add('gpo-secret-indicator-present');
|
|
const observation: GpoPolicyObservation = {
|
|
version: 1,
|
|
id,
|
|
backupInstanceId: context.backupInstanceId,
|
|
sourceArtifactId: context.sourceArtifactId,
|
|
artifactId: context.artifactId,
|
|
sourcePath: document.sourcePath,
|
|
sourceSha256: document.sourceSha256,
|
|
scope: document.scope as 'computer' | 'user',
|
|
deliveryMechanism: 'group-policy-preference',
|
|
parser: document.parser,
|
|
reducer: GPP_LOCAL_USERS_GROUPS_REDUCER,
|
|
identity: {
|
|
status: 'unresolved', namespace: 'group-policy-preference',
|
|
section: instruction.itemType === 'user' ? 'local user' : 'local group', key: target
|
|
},
|
|
state: 'instruction',
|
|
values: [instruction.value],
|
|
preference: {
|
|
cse: 'local-users-groups', itemUid: instruction.uid, operation: instruction.operation, sequence: instruction.sequence,
|
|
disabled: instruction.disabled, removePolicy: instruction.removePolicy, applyOnce: instruction.applyOnce, targeting: instruction.targeting
|
|
},
|
|
sourceLines: [instruction.line],
|
|
effectiveState: 'unknown',
|
|
diagnosticCodes: [...diagnostics].sort()
|
|
};
|
|
const errors = gpoPolicyObservationValidationErrors(observation);
|
|
if (errors.length) throw new Error(`Intern ungültige Local-Users-and-Groups-Beobachtung: ${errors.join(' ')}`);
|
|
return observation;
|
|
});
|
|
}
|