a
    WaF\                     @   sz  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Zd dl
mZ d dlmZmZmZ d dlmZmZ d dl
mZ d dl
mZ d dlmZ d d	lmZ d d
lmZ ejejB ejB ejB Z ej!ej"B ej#B ej$B Z%ej&ej'B Z(G dd de)Z*dd Z+dd Z,d)ddZ-d*ddZ.dd Z/d+ddZ0G dd dZ1G dd dZ2dd  Z3d!d" Z4d#d$ Z5d%d& Z6d'd( Z7dS ),    )print_functionN)param)securityxattridmap)ndr_pack
ndr_unpack)smbd)libsmb_samba_internal)get_samba_logger)NTSTATUSError)system_session_unixc                   @   s   e Zd ZdZdS )XattrBackendErrorzA generic xattr backend error.N)__name__
__module____qualname____doc__ r   r   ./usr/lib/python3/dist-packages/samba/ntacls.pyr   :   s   r   c                 C   s   |du rP|  d}|dur*tj|  dfS |  d}|durLtj|  dfS dS |dkr\dS |dkr|durvtj|fS tjtjtj|  ddfS nR|d	kr|durtj|fS |  d
}tjtj|d}tj|fS ntd| dS )z$return the path to the eadb, or NoneNzxattr_tdb:filez
posix:eadb)NNZnativeZeadbzprivate dirzeadb.tdbZtdbzstate directoryz	xattr.tdbzInvalid xattr backend choice %s)	getsamba	xattr_tdb
posix_eadbospathabspathjoinr   )lpbackendeadbfiler   r   Z	state_dirZdb_pathr   r   r   checkset_backend>   s*    


$

r    c                 C   s6   zt j|tj}W n ty(   Y d S 0 ttj|S N)r   xattr_nativewrap_getxattrr   ZXATTR_DOSATTRIB_NAME_S3	Exceptionr   Z	DOSATTRIB)r   file	attributer   r   r   
getdosinfoZ   s    r'   Tc                 C   s   |rt | ||\}}|d urbz|||tj}	W qr ty^   td|  tj|tj}	Y qr0 ntj|tj}	ttj	|	}
|
j
dkr|
jS |
j
dkr|
jjS |
j
dkr|
jjS |
j
dkr|
jjS ntj|t||dS d S )NFail to open %s            service)r    r#   r   XATTR_NTACL_NAMEr$   printr   r"   r   NTACLversioninfosdr	   Z
get_nt_aclSECURITY_SECINFO_FLAGS)r   r%   session_infor   r   direct_db_accessr.   backend_objdbnamer&   ntaclr   r   r   getntacld   s:    




r;   Fc              	   C   s@  t |tst |tjsJ t |tr0t|}nt |tjrH|}t|}t |tsbt |tjsbJ t |tr|tj||}nt |tjr|}||}|s|r|	|j\}}|t	j
kr|t	jkr|jtd|tjf krXtd|tjf }|	|\}}|t	j
ks |t	jkrD|}||_tj|t|||
d d}ntd|||f n0t|dd tj|tjtjB tjB |||
d |r(t| ||\}}t }d|_||_|durz|||tjt| W n6 ty   t d|  t!j"|tjt| Y n0 nt!j"|tjt| ntj|t||
|d	 dS )
a  
    A wrapper for smbd set_nt_acl api.

    Args:
        lp (LoadParam): load param from conf
        file (str): a path to file or dir
        sddl (str): ntacl sddl string
        service (str): name of share service, e.g.: sysvol
        session_info (auth_session_info): session info for authentication

    Note:
        Get `session_info` with `samba.auth.user_session`, do not use the
        `admin_session` api.

    Returns:
        None
    z%s-%dr-   TzDUnable to find UID for domain administrator %s, got id %d of type %dr   r)   Nr(   )r.   r6   )#
isinstancestrr   dom_sid
descriptor	from_sddlas_sddlZ	sid_to_id	owner_sidr   ZID_TYPE_UIDZID_TYPE_BOTHZDOMAIN_RID_ADMINSZDOMAIN_RID_ADMINISTRATORr	   Z
set_nt_aclr5   r   r   chownSECINFO_GROUPSECINFO_DACLSECINFO_SACLr    r   r1   r2   r3   Zwrap_setxattrr/   r   r$   r0   r   r"   )r   r%   ZsddlZdomsidr6   r   r   	use_ntvfsZskip_invalid_chownZpassdbr.   sidr4   Zowner_idZ
owner_typeZadministratorZadmin_idZ
admin_typeZsd2r8   r9   r:   r   r   r   setntacl   s|    


	
rI   c                 C   s   d}d}d}d}d}d}d}d}d	}	d}
d}d}d}d}d}d}d}d}d}d}d}d}d	}d
}d}d}d}d}d}| |@ }| |@ r| |@ r|||B |B |B |
B |B B }| |@ r|||B |B |B |B |B |B B }| |@ r|||B B }| |@ r||B }|S )zMTakes the access mask of a DS ACE and transform them in a File ACE mask.
    r)   r*   r,             @         i   i   i   i   i   i   r   )ZldmZRIGHT_DS_CREATE_CHILDZRIGHT_DS_DELETE_CHILDZRIGHT_DS_LIST_CONTENTSZACTRL_DS_SELFZRIGHT_DS_READ_PROPERTYZRIGHT_DS_WRITE_PROPERTYZRIGHT_DS_DELETE_TREEZRIGHT_DS_LIST_OBJECTZRIGHT_DS_CONTROL_ACCESSZFILE_READ_DATAZFILE_LIST_DIRECTORYZFILE_WRITE_DATAZFILE_ADD_FILEZFILE_APPEND_DATAZFILE_ADD_SUBDIRECTORYZFILE_CREATE_PIPE_INSTANCEZFILE_READ_EAZFILE_WRITE_EAZFILE_EXECUTEZFILE_TRAVERSEZFILE_DELETE_CHILDZFILE_READ_ATTRIBUTESZFILE_WRITE_ATTRIBUTESZDELETEZREAD_CONTROLZ	WRITE_DACZWRITE_OWNERZSYNCHRONIZEZSTANDARD_RIGHTS_ALLZfilemaskr   r   r   ldapmask2filemask   sr    rP   c                 C   s   t j| |}t  }|j|_|j|_|j|_|j|_|jj}t	dt
|D ]p}|| }|jt j@ sLt|jt jkrL|jt jB t jB |_t|jt jkr|jt jB |_t|j|_|| qL|s|S ||S )z

    This function takes an the SDDL representation of a DS
    ACL and return the SDDL representation of this ACL adapted
    for files. It's used for Policy object provision
    r   )r   r?   r@   rB   Z	group_sidtypeZrevisionZdaclacesrangelenZ"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTr=   ZtrusteeZSID_BUILTIN_PREW2KflagsZSEC_ACE_FLAG_OBJECT_INHERITZSEC_ACE_FLAG_CONTAINER_INHERITZSID_CREATOR_OWNERZSEC_ACE_FLAG_INHERIT_ONLYrP   Zaccess_maskZdacl_addrA   )ZdssddlrH   rA   refZfdescrrR   iZacer   r   r   dsacl2fsacl(  s$    rX   c                   @   sj   e Zd ZdZdd ZdddZddd	Zd
d Zdd Zdd Z	dddZ
dddZdddZdd ZdS )	SMBHelperzb
    A wrapper class for SMB connection

    smb_path: path with separator "\" other than "/"
    c                 C   s   || _ || _d S r!   )smb_connr>   )selfrZ   r>   r   r   r   __init__N  s    zSMBHelper.__init__Fc                 C   s0   d|vsJ | j |tt}|r,|| jS |S N/)rZ   get_aclr5   SECURITY_SEC_FLAGSrA   r>   )r[   smb_pathrA   ntacl_sdr   r   r   r_   R  s
    zSMBHelper.get_acl c                 C   s   d|vsJ | j j|tdS )zM
        List file and dir base names in smb_path without recursive.
        r^   )Zattribs)rZ   listSMB_FILE_ATTRIBUTE_FLAGSr[   ra   r   r   r   rd   Z  s    zSMBHelper.listc                 C   s   t |tj@ S )ze
        Check whether the attrib value is a directory.

        attrib is from list method.
        )boollibsmbFILE_ATTRIBUTE_DIRECTORY)r[   attribr   r   r   is_dira  s    zSMBHelper.is_dirc                 C   s   |r|d | S |S )z$
        Join path with '\'
        \r   )r[   rootnamer   r   r   r   i  s    zSMBHelper.joinc                 C   s   d|vsJ | j |S r]   )rZ   loadfilerf   r   r   r   ro   o  s    zSMBHelper.loadfilec                 C   sb   |  D ]T\}}| ||}t|trN| j|s>| j| | j||d q| j|| qdS )z1
        Create files as defined in tree
        ra   N)	itemsr   r<   dictrZ   Zchkpathmkdircreate_treeZsavefile)r[   treera   rn   Zcontentfullnamer   r   r   rt   s  s    
zSMBHelper.create_treec                 C   sZ   i }|  |D ]F}|d }| ||}| |d rF| j|d||< q| |||< q|S )a  
        Get the tree structure via smb conn

        self.smb_conn.list example:

        [
          {
            'attrib': 16,
            'mtime': 1528848309,
            'name': 'dir1',
            'short_name': 'dir1',
            'size': 0L
          }, {
            'attrib': 32,
            'mtime': 1528848309,
            'name': 'file0.txt',
            'short_name': 'file0.txt',
            'size': 10L
          }
        ]
        rn   rj   rp   )rd   r   rk   get_treero   )r[   ra   ru   itemrn   rv   r   r   r   rw     s    zSMBHelper.get_treec                 C   sh   i }|  |D ]T}|d }| ||}| |d rH|| j|d q| |}|| j||< q|S )z>
        Get ntacl for each file and dir via smb conn
        rn   rj   rp   )rd   r   rk   update
get_ntaclsr_   rA   r>   )r[   ra   Zntaclsrx   rn   rv   rb   r   r   r   rz     s    
zSMBHelper.get_ntaclsc                 C   sB   |   D ]4}|d }| |d r0| j| q| j| qd S )Nrn   rj   )rd   rk   rZ   Zdeltreeunlink)r[   rx   rn   r   r   r   delete_tree  s
    zSMBHelper.delete_treeN)F)rc   )rc   )rc   )rc   )r   r   r   r   r\   r_   rd   rk   r   ro   rt   rw   rz   r|   r   r   r   r   rY   G  s   



 
rY   c                   @   s&   e Zd Zdd Zd	ddZdd ZdS )
NtaclsHelperc                 C   s8   || _ || _t | _| j| d| jdv | _d S )NZsmbzserver services)r.   r>   s3paramZget_contextr   loadr   rG   )r[   r.   smb_conf_pathr>   r   r   r   r\     s
    
zNtaclsHelper.__init__FNc                 C   s8   |d u r| j }t| j|||| jd}|r4|| jS |S )N)r7   r.   )rG   r;   r   r.   rA   r>   )r[   r   r6   rA   r7   rb   r   r   r   r;     s    zNtaclsHelper.getntaclc                 C   s   t | j||| j|| jdS )N)rG   )rI   r   r>   rG   )r[   r   rb   r6   r   r   r   rI     s    zNtaclsHelper.setntacl)FN)r   r   r   r\   r;   rI   r   r   r   r   r}     s   

r}   c                 C   s<   t | d d}|| W d    n1 s.0    Y  d S )N.NTACLw)openwrite)dstntacl_sddl_strfr   r   r   _create_ntacl_file  s    r   c                 C   sN   | d }t j|sd S t|d}| W  d    S 1 s@0    Y  d S )Nr   r)r   r   existsr   read)srcZ
ntacl_filer   r   r   r   _read_ntacl_file  s
    r   c                 C   s  t  }t|trt|}t| |}d}t }|g}|g}|rd| }	| }
|j	|	dD ] }|
|	|d }tj
|
|d }||d r|| || t| n>||}t|d}|| W d   n1 s0    Y  z|j|dd}t|| W q^ ty^ } z6|d	||jd
 f  |d| d  W Y d}~q^d}~0 0 q^q<tj|dd>}t|D ]"}tj
||}|j||d q~W d   n1 s0    Y  t| dS )aa  
    Backup all files and dirs with ntacl for the serive behind smb_conn.

    1. Create a temp dir as container dir
    2. Backup all files with dir structure into container dir
    3. Generate file.NTACL files for each file and dir in contianer dir
    4. Create a tar file from container dir(without top level folder)
    5. Delete contianer dir
    rc   rp   rn   rj   wbNTrA   z"Failed to get the ntacl for %s: %sr)   z!The permissions for %s may not bez restored correctlyw:gzrn   modeZarcname)r   r<   r=   r   r>   rY   tempfilemkdtemppoprd   r   r   r   rk   appendrs   ro   r   r   r_   r   r   errorargswarningtarfilelistdiraddshutilrmtree)rZ   dest_tarfile_pathr>   loggerZ
smb_helperZ	remotedirZlocaldirZr_dirsZl_dirsZr_dirZl_direZr_nameZl_namedatar   r   tarrn   r   r   r   r   backup_online  sH    





(
 2r   c                 C   s  |  dddd }t }t }| }t|}t|||}	t	
| D ].\}
}}t	jj|
| d}t	j||}|D ]H}t	j|
|}t	j||}t||| |	j||dd}t|| qz|D ]}t	j|
|}t	j||}t||| |	j||dd}t|| t|dN}| }t|d}|| W d	   n1 sP0    Y  W d	   q1 sp0    Y  qqLtj|d
d>}t	|D ]"}t	j||}|j||d qW d	   n1 s0    Y  t| d	S )z<
    Backup files and ntacls to a tarfile for a service
    r^   r)   startTr   rbr   Nr   r   r   )rstriprsplitr   r   r   get_domain_sidr   r>   r}   r   walkr   relpathr   r	   rs   r;   r   create_filer   r   r   r   r   r   r   r   )Zsrc_service_pathr   
samdb_connr   r.   tempdirr6   dom_sid_strr>   ntacls_helperdirpathdirnames	filenamesrel_dirpathdst_dirpathdirnamer   r   r   filenamesrc_filer   dst_filer   rn   r   r   r   r   backup_offline   s<    

N2r   c                 C   s0  t  }|dddd }t }| }t|}t|||}	t	 }
t
| }|j|d W d   n1 st0    Y  t|D ]\}}}tjj||d}tjtj||}|D ]v}|dstj||}tj||}tj|st||
| t|}|r"|	|||
 q|d| d	  q|D ]}|ds:tj||}tj||}tj|st||
| t|}|r|	|||
 n|d
| d	  t|dN}| }t|d}|| W d   n1 s0    Y  W d   n1 s0    Y  q:qt| dS )z>
    Restore files and ntacls from a tarfile to a service
    r^   r)   r   )r   Nr   r   z)Failed to restore ntacl for directory %s.z) Please check the permissions are correctz$Failed to restore ntacl for file %s.r   r   ) r   r   r   r   r   r   r   r>   r}   r   r   r   Z
extractallr   r   r   r   normpathr   endswithisdirr	   rs   r   rI   r   isfiler   r   r   r   r   )Zsrc_tarfile_pathZdst_service_pathr   r   r   r.   r   r   r>   r   r6   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   backup_restoreS  sZ    
*

Pr   )NNTN)NNTFNN)T)8Z
__future__r   r   r   r   r   Zsamba.xattr_nativer   Zsamba.xattr_tdbZsamba.posix_eadbZsamba.samba3r   r~   Zsamba.dcerpcr   r   r   Z	samba.ndrr   r   r	   r
   rh   Zsamba.loggerr   r   Zsamba.auth_utilr   FILE_ATTRIBUTE_SYSTEMri   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENre   ZSECINFO_OWNERrD   rE   rF   r5   ZSEC_FLAG_SYSTEM_SECURITYZSEC_STD_READ_CONTROLr`   r$   r   r    r'   r;   rI   rP   rX   rY   r}   r   r   r   r   r   r   r   r   r   <module>   sj       
'   
g7
q
<3