a
    Wa4                    @   s8  d dl mZ d dl mZ d dlmZ d dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlZd dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d dlZd d	lmZmZ d d
lmZ d dlmZm Z  d dl!m"Z"m#Z# d dl$m%Z% d dl$m&Z& d dl$m'Z' d dl$m(Z( d dl$m)Z) d dl$m*Z* d dl$m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1m2Z2m3Z3 d dl4m5Z5 d dl6m7Z7 d dl8m9Z9 d dl8m:Z; d dl<m=Z= d dl>m?Z? d dlm@Z@mAZAmBZB d dlCmDZD d dlEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZR d dlSmTZTmUZUmVZVmWZW d d lXmYZYmZZZm[Z[ d d!l\m]Z] d d"l^m_Z_ d d#l`maZa d d$l`mbZb eJeKeLd%Zce3d&d'd(d)d*e3d+d,d-d.e3d/d0d1d2d3gd4e   d5e3d6d7d8d9d*e3d:d;d<edd=e3d>d?d@d,dAgZee3dBdCeddDe3dEdFeddDe3dGdHd,dAe3dId0dJg dKdLdMdNe3dOdPdQd,dAgZfe3dRdSd,dAgZgdTdU Zhzd dliZW n ejyj   dZkY n0 G dVdW dWe0ZkG dXdY dYe0ZlG dZd[ d[e0ZmG d\d] d]e0ZnG d^d_ d_e0ZoG d`da dae0ZpG dbdc dce0ZqerddZsdedf Ztdgdh ZuG didj dje0ZvG dkdl dle0ZwG dmdn dne2ZxG dodp dpe0ZyG dqdr dreyZzG dsdt dtej{Z|G dudv dve0Z}G dwdx dxe}Z~G dydz dze}ZG d{d| d|e}ZG d}d~ d~e}ZG dd de}ZG dd de}ZG dd de0ZG dd de2ZG dd de2ZG dd dZG dd de0ZG dd de0ZG dd de2ZdS )    )print_function)divisionN)ntstatus)NTSTATUSError)werrorgetpass)NetLIBNET_JOIN_AUTOMATIC)	join_RODCjoin_DC)system_session)SamDBget_default_backend_store)ndr_pack	ndr_print)drsuapi)drsblobs)lsa)netlogon)security)nbt)misc)DOMAIN_PASSWORD_COMPLEXDOMAIN_PASSWORD_STORE_CLEARTEXT)CommandCommandErrorSuperCommandOption)get_fsmo_roleowner)!netcmd_get_domain_infos_via_cldap)Samba3)param)upgrade_from_samba3)drsuapi_connect)	remove_dcarcfour_encryptstring_to_byte_array)system_session_unix)DS_DOMAIN_FUNCTION_2000DS_DOMAIN_FUNCTION_2003DS_DOMAIN_FUNCTION_2003_MIXEDDS_DOMAIN_FUNCTION_2008DS_DOMAIN_FUNCTION_2008_R2DS_DOMAIN_FUNCTION_2012DS_DOMAIN_FUNCTION_2012_R2$DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL#DS_NTDSDSA_OPT_DISABLE_INBOUND_REPLUF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTUF_TRUSTED_FOR_DELEGATIONUF_PARTIAL_SECRETS_ACCOUNT)	provisionProvisioningErrorDEFAULT_MIN_PWD_LENGTH
setup_path)	FILL_FULLFILL_NT4SYNCFILL_DRS)cmd_domain_passwordsettings_pso)cmd_domain_backup)binary_type)
get_string2008_R220122012_R2z--machinepassstringPASSWORDz*choose machine password (otherwise random)typemetavarhelpz--plaintext-secrets
store_truezaStore secret/sensitive values as plain text on disk(default is to encrypt secret/ensitive values)actionrJ   z--backend-storechoiceZBACKENDSTOREZtdbZmdbz7Specify the database backend to be used (default is %s))rH   rI   choicesrJ   z--backend-store-sizebytesZSIZEzfSpecify the size of the backend database, currently only supported by lmdb backends (default is 8 Gb).--targetdirDIRz/Set target directory (where to store provision))rI   rJ   rH   -q--quietBe quietrJ   rM   --serverz
DC to joinrJ   rH   --sitezsite to joinz--domain-critical-onlyz&only replicate critical domain objects--dns-backendNAMESERVER-BACKEND)SAMBA_INTERNAL	BIND9_DLZNONEzThe DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (this DC will not be a DNS server)r\   rH   rI   rO   rJ   default-v	--verbose
Be verbose--use-ntvfs+Use NTVFS for the fileserver (default = no)c                 C   sb   t tjd}tj| ddd| |gtj|d}| \}}|  |d}|r^t	|d 
 S dS )	Nwz-sz-lz--parameter-name=%s)stdoutstderr   
r    )openosdevnull
subprocessPopenPIPEcommunicateclosesplitr@   strip)testparmsmbconfZvarnameZerrfilepouterrlines r{   5/usr/lib/python3/dist-packages/samba/netcmd/domain.pyget_testparm_var   s    

r}   c                   @   sF   e Zd ZdZdZejejejdZ	e
ddedgZdgZdd	d
ZdS )cmd_domain_export_keytabz/Dump Kerberos keys of the domain into a keytab.z%prog <keytab> [options]	sambaoptscredoptsversionoptsz--principalzextract only this principalrX   keytabNc                 C   s$   |  }td |}|j||d d S )N)r   	principal)get_loadparmr	   Zexport_keytab)selfr   r   r   r   r   lpnetr{   r{   r|   run   s    
zcmd_domain_export_keytab.run)NNNN__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   strtakes_options
takes_argsr   r{   r{   r{   r|   r~      s   r~   c                   @   s:   e Zd ZdZdZg Zejejej	dZ
dgZdddZdS )	cmd_domain_infoz?Print basic info about a domain and the DC passed as parameter.z%prog <ip_address> [options]r   addressNc                 C   s   |  }zt|d |}W n" ty:   td| d Y n0 | jd|j  | jd|j  | jd|j  | jd|j	  | jd|j
  | jd|j  | jd	|j  d S )
NzInvalid IP address 'z'!zForest           : %s
zDomain           : %s
zNetbios domain   : %s
zDC name          : %s
zDC netbios name  : %s
zServer site      : %s
zClient site      : %s
)r   r    RuntimeErrorr   outfwriteforest
dns_domaindomain_namepdc_dns_namepdc_nameZserver_siteZclient_site)r   r   r   r   r   r   resr{   r{   r|   r      s    zcmd_domain_info.run)NNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r{   r{   r{   r|   r      s   r   c                $   @   s  e Zd ZdZdZejejdZe	dddde	dd	d
dde	dd	ddde	dd	ddde	dd	ddde	dd	ddde	dd	ddde	dd	ddde	dd	ddde	d d	d!d"de	d#d	d$d%de	d&d	d$d'de	d(d)d*g d+d,d-d.e	d/d	d$d0de	d1d	d2d3de	d4d	d2d5de	d6d	d7d8de	d9dd:d;e	d<d)d=g d>d?d@d.e	dAd)dBg dCdDdEd.e	dFd)dGg dHdIdJd.e	dKdLdMdNdOdPe	dQdRdde	dSddTd;gZ
e	dUd)g dVdWdXdYdZgZe
e e re
e e
e g Zdcd]d^Zd_d` Zdadb Zd[S )dcmd_domain_provisionzProvision a domain.%prog [options]r   r   z--interactivezAsk for namesrK   rV   z--domainrE   ZDOMAINzNetBIOS domain name to userG   z--domain-guidGUIDz!set domainguid (otherwise random)z--domain-sidZSIDz set domainsid (otherwise random)z--ntds-guidz'set NTDS object GUID (otherwise random)z--invocationidz#set invocationid (otherwise random)z--host-nameZHOSTNAMEzset hostnamez	--host-ipZ	IPADDRESSzset IPv4 ipaddressz
--host-ip6Z
IP6ADDRESSzset IPv6 ipaddressrY   ZSITENAMEzset site namez--adminpassrF   z(choose admin password (otherwise random)z--krbtgtpassz)choose krbtgt password (otherwise random)rZ   rN   r[   r\   ZBIND9_FLATFILEr]   r^   zThe DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_FLATFILE uses bind9 text database to store zone information, BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (not recommended)r\   r_   z	--dnspassz&choose dns password (otherwise random)z--rootZUSERNAMEzchoose 'root' unix usernamez--nobodyzchoose 'nobody' userz--usersZ	GROUPNAMEzchoose 'users' groupz--blankz.do not add users or groups, just the structurerL   z--server-roleZROLE)domain controllerdczmember servermemberZ
standalonez^The server role (domain controller | dc | member server | member | standalone). Default is dc.r   --function-levelzFOR-FUN-LEVEL)200020032008rB   zyThe domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2008_R2 Native.rB   z--base-schemazBASE-SCHEMA)rB   Z2008_R2_oldrC   rD   z;The base schema files to use. Default is (Windows) 2012_R2.rD   z
--next-ridintZNEXTRIDi  zGThe initial nextRid value (only needed for upgrades).  Default is 1000.)rH   rI   r`   rJ   z--partitions-onlyzEConfigure Samba's partitions, but do not modify them (ie, join a BDC)z--use-rfc2307z/Use AD to store posix attributes (default = no)--use-xattrsyesnoauto[yes|no|auto]Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl when --use-ntvfs is set. auto tries to make an inteligent guess based on the user rights and system capabilitiesr   rH   rO   rI   rJ   r`   NFc%           7   &   C   sf  | j d|d| _| }%|%j}&|d ur,|}'n|  }'|'d u r@d}'t| jdkrRd}|rddlm}( dd l})d/dd	}*z|)	 
d
dd  }+W n ty   d }+Y n0 |*d|+},|,dv rtdz|,
d
d }+W n ty   d }+Y n0 |*d|+}|d u r
td|*dd}|*dd}|dv r0td|dkrZ|*d|'}| dv rZd }'d }|(d}-| |-}.|.r| jd|.  n(|(d}/|-|/ks| jd n|-}qqZn0|jd},|,d u rtd|d u rtd|r| |}.|.rt|.n| jd |dkrt}0n.|dkr.t}0n|dkr>t}0n|d krLt}0|dkrd|d u rd|'}t}1|rtt}1n
|r~t}1|d urtj|st| d}2|d!krd"}2n|d#kr|d"krd"}2n|d"krtd$n|d#kr|%d%s|rt j!tj"|d&}3n"t j!tj"tj#|%d'd&}3zPz"t$j%&|%|3j'd(d)t( d* d"}2W n  t)yz   | jd+ Y n0 W |3*  n
|3*  0 |2r| jd, |d urt+,|}t- }4|#d u rt. }#zVt/| j|4|&||1|,||||	|
|||||||||||||||0|2||%|| d"|!|"|#|$d-$}5W n0 t0yT }6 ztd.|6W Y d }6~6n
d }6~60 0 |51| j d S )0Nr6   )namequietnone   Tr   r   c                 S   sN   |d urt d| |f dd nt d| f dd tj  tj dpL|S )Nz	%s [%s]:  )endz%s: 
)printsysrg   flushstdinreadlinerstrip)promptr`   r{   r{   r|   askm  s
    
z%cmd_domain_provision.run.<locals>.ask.ZRealm)Nrj   zNo realm set!ZDomainzNo domain set!z$Server Role (dc, member, standalone)r   z=DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE)r\   zNo DNS backend set!z=DNS forwarder IP address (write 'none' to disable forwarding))Nr   zAdministrator password: z%s.
zRetype password: Sorry, passwords do not match.
realmz,Administrator password will be set randomly!r   r   r   rB   r   Fr   r--use-xattrs=no requires --use-ntvfs (not supported for production use).  Please re-run with --use-xattrs omitted.
posix:eadbdirprivate dirO:S-1-5-32G:S-1-5-32S-1-5-32nativezZYou are not root or your system does not support xattr, using tdb backend for attributes. znot using extended attributes to store ACLs and other metadata. If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.)"rv   	targetdir
samdb_fillr   domainZ
domainguidZ	domainsidZhostnameZhostipZhostip6ZsitenameZntdsguidinvocationid	adminpass
krbtgtpassmachinepassdns_backenddns_forwarderdnspassrootnobodyusersZ
serverroledom_for_fun_leveluseeadbnext_ridr   	use_ntvfsuse_rfc2307Zskip_sysvolaclbase_schemaplaintext_secretsbackend_storebackend_store_sizezProvision failed)N)2
get_loggerloggerr   Z
configfile_get_nameserver_iplenZraw_argvr   socketZgetfqdnrs   upper
IndexErrorr   lower_adminpass_issueerrfr   Z_lpgetinfor)   r*   r,   r-   r:   r;   r<   rl   pathisdirmakedirstempfileNamedTemporaryFileabspathdirnamesambantaclssetntaclr   r(   	Exceptionrr   r   dom_sidr   r   r6   r7   Zreport_logger)7r   r   r   interactiver   Zdomain_guid
domain_sid	ntds_guidr   Z	host_nameZhost_ipZhost_ip6r   siter   r   r   r   r   Zldapadminpassr   r   r   r   Zblankserver_rolefunction_levelr   Zpartitions_onlyr   
use_xattrsr   r   r   r   r   r   r   rv   Zsuggested_forwarderr   r   r   r`   r   ZadminpassplainZissueZadminpassverifyr   r   eadbfileZsessionresulter{   r{   r|   r   6  s    $


























"



 zcmd_domain_provision.runc                 C   s   ddl m} d}||s.| jd|  dS d}zXt|d}|D ]4}|dsRqB|  d   W |durv|	  S W |dur|	  n|dur|	  0 | jd	|  dS )
z5Grab the nameserver IP address from /etc/resolv.conf.r   )r   z/etc/resolv.confzFailed to locate %sNrZ
nameserverzNo nameserver found in %s)
rl   r   isfiler   warningrk   
startswithrt   rs   rr   )r   r   ZRESOLV_CONFZhandleliner{   r{   r|   r      s(    




z'cmd_domain_provision._get_nameserver_ipc                 C   s>   t |tr|d}t|tk r(dt S t|s6dS dS dS )zTReturns error string for a bad administrator password,
        or None if acceptableutf8zdAdministrator password does not meet the default minimum password length requirement (%d characters)zBAdministrator password does not meet the default quality standardsN)
isinstancer?   decoder   r8   r   Zcheck_password_quality)r   r   r{   r{   r|   r     s    


z%cmd_domain_provision._adminpass_issue)$NNNNNNNNNNNNNNNNNNNNNNNNNNNNNr   FNNFNN)r   r   r   r   r   r   r   r   r   r   r   ntvfs_optionsextendcommon_provision_join_optionsr   is_ntvfs_fileserver_builtcommon_ntvfs_optionsr   r   r   r   r{   r{   r{   r|   r      s  
=	



                                   
 Kr   c                   @   sb   e Zd ZdZdZejejejdZ	g Z
e
e e
e e rLe
e ddgZd
dd	ZdS )cmd_domain_dcpromoz9Promote an existing domain member or NT4 PDC to an AD DC.z%%prog <dnsdomain> [DC|RODC] [options]r   r   r   r   role?NFc                 C   s   |  }||}t|||jd}| j||d}|d}|d urJ| }|dkr|t|||||||||	|
||d|||d n>|dkrt|||||||||	|
||d|||d nt	d| d S )	Nserververboser   netbios nameDCT)r   r  credsr   r   r  netbios_namer   domain_critical_onlyr   r   r   Zpromote_existingr   r   r   RODCz-Invalid role '%s' (possible values: DC, RODC))
r   get_credentialsr	   	ipaddressr   r   r   r   r   r   )r   r   roler   r   r   r  r  r   r$  r   r   r   r   r  r   r   r   r   r"  r   r   r#  r{   r{   r|   r   <  s6    

zcmd_domain_dcpromo.run)NNNNNNNFNFNFFFNN)r   r   r   r   r   r   r   r   r   r   r   r  common_join_optionsr  r   r  r  r   r   r{   r{   r{   r|   r  '  s&   


      r  c                   @   sr   e Zd ZdZdZejejejdZ	e
ddddgZg Zee ee e r\ee dd	gZdddZd
S )cmd_domain_joinz9Join domain as either member or backup domain controller.z,%prog <dnsdomain> [DC|RODC|MEMBER] [options]r  rd   re   rK   rV   r   r  NFc                 C   s   |  }||}t|||jd}| j||d}|d}|d urJ| }|d u sZ|dkr|j||t|
d\}}}| j	
d||f  nl|dkrt|||||||||	|
|||||d n<|d	krt|||||||||	|
|||||d ntd
| d S )Nr  r  r   ZMEMBER)r   zJoined domain %s (%s)
r!  )r   r  r"  r   r   r  r#  r   r$  r   r   r   r   r   r   r%  z5Invalid role '%s' (possible values: MEMBER, DC, RODC))r   r&  r	   r'  r   r   r   Zjoin_memberr
   r   r   r   r   r   )r   r   r(  r   r   r   r  r  r   r$  r   r   r   r   r  r   r   r   r   r"  r   r   r#  Zjoin_passwordsidr   r{   r{   r|   r   |  sD    

	zcmd_domain_join.run)NNNNNNNFNFNFFFNN)r   r   r   r   r   r   r   r   r   r   r   r  r   r  r)  r  r   r  r   r   r{   r{   r{   r|   r*  b  s2   


       r*  c                
   @   sz   e Zd ZdZdZeddededdded	d
deddededddddedddddgZej	ej
ejdZdddZdS )cmd_domain_demotez4Demote ourselves from the role of Domain Controller.r   rW   z(writable DC to write demotion changes onrX   -H--URL%LDB URL for database or target serverURLHrJ   rH   rI   destz--remove-other-dead-serverzMDead DC (name or NTDS GUID) to remove ALL references to (rather than this DC)rS   rT   rU   rK   rV   ra   rb   rc   r   NFc	           0      C   s	  |  }	||	}
t|
|	|jd}| j||d}|d ur|d urXtd| t |
|	d}nt|t |
|	d}zt||| W n2 tjy } zt	d| W Y d }~n
d }~0 0 d S |	
d}t|t |
|	d}|sJ|jddd	gd
}t|dkrt	dt|dkrt	dd }|D ].}t|d	  | kr|d } qJq| }|jt| tjd| dgd}t|dksd|d vrt	d| |d j}tt|d d }|jdt| dgd}t|dkrt	dt| | jd|  t||	|
\}}}| jd t }|d j|_|t@ sp| sp|tO }tt|tjd|d< || | jd|  | | |  fD ]}t!" }t||_t!# }||_$t!j%|_&t'(||_)z|*|d| W n t+yj } zp|j,\}}|t-j.kr
nL| jd|  |tN }tt|tjd|d< || t	dt| |W Y d }~n
d }~0 0 qzftd| t |
|	d} | jd | jt| / d|0  dgd}|d j}!tt|d d }"W nz t1yP } z`|t@ s2| s2| jd  |tN }tt|tjd|d< || t	d!|W Y d }~n
d }~0 0 t|dkr|t@ s| s| jd" |tN }tt|tjd|d< || t	d#|0  |"}#|"t2t3B t4B  M }"|"t5O }"t }|!|_td$|" tjd|d< z| | W nz t1y } z`|t@ sh| sh| jd" |tN }tt|tjd|d< || t	d!|W Y d }~n
d }~0 0 |j6 }$|d j7 }%d%|% }&d}'t|&}(t8| d&t| /  })| j|)|&tj9d'}t|dkr| j|)d(|&|'f tj9d'}t|dkrD|'d)k rD|'d }'| j|)d(|&|'f tj9d'}q|'d)kr|t@ s| s| jd  |tN }tt|tjd|d< || t }|!|_td$|" tjd|d< | | t	d*t|!|&|&|'d+ f d(|&|'f }(z(t8| d,|(t|)f }*| :|!|* W n t1y } z|t@ st| st| jd  |tN }tt|tjd|d< || t }|!|_td$|" tjd|d< | | t	d-t|!t|*f |W Y d }~n
d }~0 0 |; }+|   },z4t!< }t|+|_=t|,|_/d|_>|?|d| W n t+y }- z|-j,\}}|t@ s~| s~| jd  |tN }tt|tjd|d< || t }|*|_td$|" tjd|d< | | | :|*|! |t-j.krt	d.|+|-f nt	d/|+|-f W Y d }-~-n
d }-~-0 0 t@| ||% d0d1|	
d2 d3d4fD ]R}.z"| At8| d,|.t|*f  W n( tjB	yp }/ zW Y d }/~/n
d }/~/0 0 	q"tjC| ||D d5d6 | jd7 d S )8Nr  r  	ldap://%sZurlsession_infoZcredentialsr   zDemote failed: %sr   z.(&(objectClass=computer)(serverReferenceBL=*))ZdnsHostNamer   )
expressionattrsr   zUnable to search for serversr   z%You are the last server in the domainz(objectGUID=%s)r   basescoper7  r8  zFailed to find options on %sz(fSMORoleOwner=%s)zsearch_options:1:2)r7  controlszaCurrent DC is still the owner of %d role(s), use the role command to transfer roles to another DCz,Using %s as partner server for the demotion
z!Deactivating inbound replication
z0Asking partner server %s to synchronize from us
zgError while replicating out last local changes from '%s' for demotion, re-enabling inbound replication
z6Error while sending a DsReplicaSync for partition '%s'z#Changing userControl and container
z)(&(objectClass=user)(sAMAccountName=%s$))ZuserAccountControlr:  r7  r8  z6Error while demoting, re-enabling inbound replication
z$Error while changing account controlz5Error while demoting, re-enabling inbound replicationz@Unable to find object with samaccountName = %s$ in the remote dcz%dzCN=%szCN=Computers,%s)r:  r7  r;  z%s-%dd   zOUnable to find a slot for renaming %s, all names from %s-1 to %s-%d seemed used	   z%s,%szError while renaming %s to %szHThe DC %s is not present on (already removed from) the remote server: %sz.Error while sending a removeDsServer of %s: %sz$CN=Enterprise,CN=NTFRS SubscriptionszCN=%s, CN=NTFRS Subscriptionsr   z?CN=Domain system Volumes (SYSVOL Share), CN=NTFRS SubscriptionszCN=NTFRS SubscriptionsT)Zignore_no_namezDemote successful
)Er   r&  r	   r'  r   r   r   r%   ZDemoteExceptionr   r   searchr   r   r   Zget_ntds_GUIDget_config_basednldbSCOPE_SUBTREEdnr   r   r   r$   Messager0   Zam_rodcr1   MessageElementFLAG_MOD_REPLACEmodifyget_schema_basednZget_root_basednr   ZDsReplicaObjectIdentifierZDsReplicaSyncRequest1Znaming_contextZDRSUAPI_DRS_WRIT_REPr   r   r   Zsource_dsa_guidZDsReplicaSyncr   argsr   ZWERR_DS_DRA_NO_REPLICA	domain_dnr   r   r3   r4   r5   r2   parentZget_rdn_valueDnZSCOPE_ONELEVELrenameZget_serverNameZDsRemoveDSServerRequest1Z	server_dnZcommitZDsRemoveDSServerZremove_sysvol_referencesdeleteLdbErrorZremove_dns_referencesZhost_dns_name)0r   r   r   r   r  Zremove_other_dead_serverr1  r  r   r   r"  r   r   samdbry   r#  r   r
  r  msgZntds_dnZdsa_optionsZdrsuapiBindZdrsuapi_handleZsupportedExtensionsZnmsgpartncZreq1Ze1ZwerrrE   Zremote_samdbZdc_dnZuacZolduacrL  Zdc_nameZrdniZnewrdnZcomputer_dnZnewdnZserver_dsa_dnr   Ze3slr{   r{   r|   r     s   
"







,

 


 








0







zcmd_domain_demote.run)NNNNNNFF)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r{   r{   r{   r|   r,    s*   
    r,  c                	   @   s~   e Zd ZdZdZejejejdZ	e
dddeddd	e
d
dddde
ddg ddde
ddg dddgZdgZdddZdS )cmd_domain_levelz(Raise domain and forest function levels.z&%prog (show|raise <options>) [options]r   r-  r.  r/  r0  r1  r2  rS   rT   rU   rK   rV   z--forest-levelrN   )r   r   rB   rC   rD   zBThe forest function level (2003 | 2008 | 2008_R2 | 2012 | 2012_R2)rH   rO   rJ   z--domain-levelzBThe domain function level (2003 | 2008 | 2008_R2 | 2012 | 2012_R2)
subcommandNFc	              
   C   s  |  }	|j|	dd}
t|t |
|	d}| }|jd|  tjdgd}t	|dks\J |j|tjddgd}t	|dksJ |jd	|  tj
d
dgd}t	|dksJ t}t}d|d v rt|d d d }d|d v rt|d d d }t|d d d }d }|D ]L}d|v rT|d u sBt|d d |k r^t|d d }n
t} qbq|tk sv|tk r~td|tk rtd||krtd||krtd|dkr| d|  |tkr|dkr| d |tkr|dkr| d |tkr&|dkr&| d | d |tkr@d}nd|tkrPd}nT|tkr`d}nD|tkrpd}n4|tkrd}n$|tkrd}n|tkrd}nd}| d|  |tkr|dkrd }n~|tkr|dkrd}nd|tkrd}nT|tkrd}nD|tkrd}n4|tkr&d}n$|tkr6d}n|tkrFd}nd}| d!|  |tkrhd}nT|tkrxd}nD|tkrd}n4|tkrd}n$|tkrd}n|tkrd}nd}| d"|  n*|d#krg }|d ur
|dkrt}n>|dkrt}n.|d$krt}n|dkr&t}n|d%kr4t}||krP|dkrPtd&||krbtd'|dkr0t }t|||_td(tjd|d< || t }t|d)|	d* d+|   |_td(tjd|d< z|| W n@ tjy. } z$|j\}}|tjkr W Y d }~n
d }~0 0 t }t|||_tt|tjd|d< || t }t|d)|	d* d+|   |_tt|tjd|d< z|| W n@ tjy } z$|j\}}|tjkr W Y d }~n
d }~0 0 |}| d, |d ur|dkr$t}n>|dkr4t}n.|d$krDt}n|dkrTt}n|d%krbt}||krttd-||krtd.t }t|d|  |_tt|tjd|d< || | d/ | d0 | d1!| ntd2| d S )3NT)Zfallback_machiner5  CN=Partitions,%szmsDS-Behavior-Versionr;  r8  r   ZnTMixedDomainzCN=Sites,%sz(objectClass=nTDSDSA))r;  r7  r8  r   zSDomain and/or forest function level(s) is/are invalid. Correct them or reprovision!zFLowest function level of a DC is invalid. Correct this or reprovision!zVForest function level is higher than the domain level(s). Correct this or reprovision!zdDomain function level is higher than the lowest function level of a DC. Correct this or reprovision!showz0Domain and forest function level for domain '%s'z|
ATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2000 (Native). This isn't supported! Please raise!z|
ATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2000 (Native). This isn't supported! Please raise!z
ATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!rj   r   z02003 with mixed domains/interim (NT4 DC support)r   r   z2008 R2rC   z2012 R2zhigher than 2012 R2z!Forest function level: (Windows) z2000 mixed (NT4 DC support)z!Domain function level: (Windows) z)Lowest function level of a DC: (Windows) raiserB   rD   zGDomain function level can't be smaller than or equal to the actual one!zMDomain function level can't be higher than the lowest function level of a DC!0zCN=Z	workgroupz,CN=Partitions,%szDomain function level changed!zGForest function level can't be smaller than or equal to the actual one!zdForest function level can't be higher than the domain function level(s). Please raise it/them first!zForest function level changed!!All changes applied successfully!r   z4invalid argument: '%s' (choose from 'show', 'raise'))"r   r&  r   r   rK  r@  rA  rB  
SCOPE_BASEr   rC  r)   r   r   messager+   r*   r,   r-   r.   r/   rE  rM  rD  rF  rG  rH  r   rP  rJ  ZERR_UNWILLING_TO_PERFORMr   appendjoin)r   rZ  r1  Zforest_levelZdomain_levelr   r   r   r   r   r"  rQ  rK  Z
res_forestZ
res_domainZres_dc_sZlevel_forestZlevel_domainZlevel_domain_mixedZmin_level_dcrR  ZoutstrmsgsZnew_level_domainmr
  enumZemsgZe2Znew_level_forestr{   r{   r|   r     sl   

 





































$


















zcmd_domain_level.run)NNNFNNNr   r{   r{   r{   r|   rX    s*   

  rX  l         c                 C   s$   t | tkrdS tt | d S dS )z8Converts a timestamp in -100 nanosecond units to minutesr       AN)r   NEVER_TIMESTAMPabsZtimestamp_strr{   r{   r|   timestamp_to_mins  s    rl  c                 C   s   t | d S )z5Converts a timestamp in -100 nanosecond units to daysi  )rl  rk  r{   r{   r|   timestamp_to_days  s    rm  c                   @   sF   e Zd ZdZdZejejejdZ	e
dddeddd	gZdddZd
S ) cmd_domain_passwordsettings_showz1Display current password settings for the domain.r   r  r-  r.  r/  r0  r1  r2  Nc              
   C   s  |  }||}t|t ||d}| }|j|tjg dd}	t|	dksRJ zt	|	d d d }
t	|	d d d }t	|	d d d }t
|	d d	 d }t
|	d d
 d }t	|	d d d }t|	d d d }t|	d d d }W n0 ty& } ztd|W Y d }~n
d }~0 0 | d|  | d |
t@ dkrZ| d n
| d |
t@ dkr~| d n
| d | d|  | d|  | d|  | d|  | d|  | d|  | d|  d S )Nr5  )pwdPropertiespwdHistoryLengthminPwdLength	minPwdAge	maxPwdAgelockoutDurationlockoutThresholdlockOutObservationWindowr\  r   r   ro  rp  rq  rr  rs  ru  rt  rv  z'Could not retrieve password properties!z$Password information for domain '%s'rj   zPassword complexity: onzPassword complexity: offzStore plaintext passwords: onzStore plaintext passwords: offzPassword history length: %dzMinimum password length: %dzMinimum password age (days): %dzMaximum password age (days): %dz#Account lockout duration (mins): %dz(Account lockout threshold (attempts): %dz&Reset account lockout after (mins): %d)r   r&  r   r   rK  r@  rB  ra  r   r   rm  rl  r   r   rb  r   r   )r   r1  r   r   r   r   r"  rQ  rK  r   	pwd_propspwd_hist_lenZcur_min_pwd_lenZcur_min_pwd_ageZcur_max_pwd_ageZcur_account_lockout_thresholdZcur_account_lockout_durationZcur_reset_account_lockout_afterr
  r{   r{   r|   r     sH    

 


z$cmd_domain_passwordsettings_show.run)NNNNr   r   r   r   r   r   r   r   r   r   r   r   r   r   r{   r{   r{   r|   rn    s   
rn  c                   @   s   e Zd ZdZdZejejejdZ	e
dddeddd	e
d
dddde
ddg ddde
ddg ddde
ddede
ddede
ddede
ddede
dd ede
d!d"ede
d#d$edgZd)d'd(Zd%S )*cmd_domain_passwordsettings_seta  Set password settings.

    Password complexity, password lockout policy, history length,
    minimum password length, the minimum and maximum password age) on
    a Samba AD DC server.

    Use against a Windows DC is possible, but group policy will override it.
    z%prog <options> [options]r  r-  r.  r/  r0  r1  r2  rS   rT   rU   rK   rV   z--complexityrN   )onoffr`   z=The password complexity (on | off | default). Default is 'on'rY  z--store-plaintextzStore plaintext passwords where account have 'store passwords with reversible encryption' set (on | off | default). Default is 'off'z--history-lengthzBThe password history length (<integer> | default).  Default is 24.rX   z--min-pwd-lengthzAThe minimum password length (<integer> | default).  Default is 7.z--min-pwd-agezFThe minimum password age (<integer in days> | default).  Default is 1.z--max-pwd-agezGThe maximum password age (<integer in days> | default).  Default is 43.z--account-lockout-durationzThe the length of time an account is locked out after exeeding the limit on bad password attempts (<integer in mins> | default).  Default is 30 mins.z--account-lockout-thresholdzThe number of bad password attempts allowed before locking out the account (<integer> | default).  Default is 0 (never lock out).z--reset-account-lockout-afterzuAfter this time is elapsed, the recorded number of attempts restarts from zero (<integer> | default).  Default is 30.NFc                 C   s  |  }||}t|t ||d}| }g }t }t|||_t	|
 }| }| }|d ur|dksz|dkr|tB }|d n|dkr|t @ }|d |d ur|dks|dkr|tB }|d n|dkr|t @ }|d |d us|d urtt|tjd	|d	< |d ur~|dkr8d
}nt	|}|dk sT|d
kr\tdtt|tjd|d< |d |d ur|dkrd}nt	|}|dk s|dkrtdtt|tjd|d< |d |d urL|dkrd}nt	|}|dk s|dkrtdt	|d  }tt|tjd|d< |d |d ur|dkrfd}nt	|}|dk s|dkrtd|dkrt}nt	|d  }tt|tjd|d< |d |	d urH|	dkrd}	nt	|	}	|	dk s |	d krtd!|	dkrt}nt	|	d"  }tt|tjd#|d#< |d$ |
d ur|
dkrbd}
nt	|
}
tt|
tjd%|d%< |d& |d ur
|dkrd}nt	|}|dk s|d krtd!|dkrt}nt	|d"  }tt|tjd'|d'< |d( |s|rJt|}t|}|dkrJ||krJtd)||f t|dkr`td*|| |d+ | d,| d S )-Nr5  r{  r`   zPassword complexity activated!r|  z Password complexity deactivated!z;Plaintext password storage for changed passwords activated!z=Plaintext password storage for changed passwords deactivated!ro     r   z8Password history length must be in the range of 0 to 24!rp  z Password history length changed!      z8Minimum password length must be in the range of 0 to 14!rq  z Minimum password length changed!r   i  z6Minimum password age must be in the range of 0 to 998!g   8M%iBrr  zMinimum password age changed!+   i  z6Maximum password age must be in the range of 0 to 999!rs  zMaximum password age changed!   i z8Maximum password age must be in the range of 0 to 99999!rh  rt  z!Account lockout duration changed!ru  z"Account lockout threshold changed!rv  z0Duration to reset account lockout after changed!zIMaximum password age (%d) must be greater than minimum password age (%d)!z7You must specify at least one option to set. Try --helpr`  r   )r   r&  r   r   rK  rB  rE  rM  rD  r   Zget_pwdPropertiesZget_maxPwdAgeZget_minPwdAger   rc  r   rF  r   rG  r   ri  rm  r   rH  rb  rd  )r   r1  Zmin_pwd_ageZmax_pwd_ager   Z
complexityZstore_plaintextZhistory_lengthZmin_pwd_lengthZaccount_lockout_durationZaccount_lockout_thresholdZreset_account_lockout_afterr   r   r   r   r"  rQ  rK  re  rf  rw  Zmax_pwd_age_ticksZmin_pwd_age_ticksrx  Zmin_pwd_lenZaccount_lockout_duration_ticksZ!reset_account_lockout_after_ticksr{   r{   r|   r   :  s    






































z#cmd_domain_passwordsettings_set.run)NNNFNNNNNNNNNNry  r{   r{   r{   r|   rz    sX   	
     rz  c                   @   s2   e Zd ZdZi Ze ed< e ed< e ed< dS )cmd_domain_passwordsettingsz Manage password policy settings.Zpsor]  setN)r   r   r   r   subcommandsr=   rn  rz  r{   r{   r{   r|   r    s
   

r  c                   @   s   e Zd ZdZdZejejdZe	ddddde	d	dd
dde	ddddde	ddddde	ddddde	dddg ddddgZ
e	ddg ddd d!d"gZe re
e e
e d#gZd(d&d'Zd$S ))cmd_domain_classicupgradezUpgrade from Samba classic (NT4-like) database to Samba AD DC database.

    Specify either a directory with all Samba classic DC databases and state files (with --dbdir) or
    the testparm utility from your classic installation (with --testparm).
    z"%prog [options] <classic_smb_conf>r   z--dbdirrE   rR   z+Path to samba classic DC database directoryrG   z
--testparmPATHzPath to samba classic DC testparm utility from the previous installation.  This allows the default paths of the previous installation to be followedrQ   zCPath prefix where the new Samba 4.0 AD domain should be initialisedrS   rT   rU   rK   rV   ra   rb   rc   rZ   rN   r[   r   a  The DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_FLATFILE uses bind9 text database to store zone information, BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (this DC will not be a DNS server)r\   r_   r   r   r   r   r   r   rv   NFc              	   C   s  t j|std| |r4t j|s4td| |rPt j|sPtd| |s`|s`td| j||d}|r|r|d d }| }t }|j	r|
d|j	 |d urt j|st | d}|d	krd
}n|dkr|d
krd
}n|d
krtdn|dkr|ds|r4tjt j|d}n"tjt jt j|dd}zNz"tj||jddt d d
}W n ty   |d Y n0 W |  n
|  0 i }|r||d< ||d< ||d< |d |d< n^t||d|d< t||d|d< t||d|d< t||d|d< t|d dkr>|d |d< |D ]}|
|||  qB|d || t||}|d t|||t ||
|d d S )NzFile %s does not existz"Testparm utility %s does not existzDirectory %s does not existz'Please specify either dbdir or testparmr  z2both dbdir and testparm specified, ignoring dbdir.r   Tr   Fr   r   r   r   r   r   r   r   zYou are not root or your system does not support xattr, using tdb backend for attributes. If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.zstate directoryzlock directoryz
/smbpasswdzsmb passwd filer   zReading smb.confZProvisioning)r6  r   r   r   ) rl   r   existsr   r   r  r   s3paramZget_contextr   r  r   mkdirr   r   r   r   r   r   r   r   r   r(   r   r   rr   r}   r   loadr!   r#   r   )r   rv   r   Zdbdirru   r   r  r  r   r   r   r   r   r   Zs3confr  Ztmpfilepathsrw   Zsamba3r{   r{   r|   r     s~    



"



zcmd_domain_classicupgrade.run)NNNNFFr   NNNF)r   r   r   r   r   r   r   r   r   r   r   r  r   r  r  r  r   r   r{   r{   r{   r|   r    sH   

   r  c                   @   s   e Zd ZejZdZdS )cmd_domain_samba3upgradeTN)r   r   r   r  r   Zhiddenr{   r{   r{   r|   r  r  s   r  c                   @   s   e Zd Zdd ZdS )LocalDCCredentialsOptionsc                 C   s   t jj| |dd d S )Nzlocal-dc)Zspecial_name)r   r   __init__)r   parserr{   r{   r|   r  |  s    z"LocalDCCredentialsOptions.__init__Nr   r   r   r  r{   r{   r{   r|   r  {  s   r  c                   @   s  e Zd ZdZdd Zdd Zdd ZG dd	 d	eZG d
d deZ	G dd deZ
dd Zdd Zdd Zdd Zd?ddZdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd@d,d-ZdAd.d/Zd0d1 Zd2d3 Zd4d5 Zd6d7 Zd8d9 Zd:d; Z dBd=d>Z!d<S )CDomainTrustCommandList domain trusts.c                 C   s8   t |  d | _d | _d | _d | _d | _d | _d | _d S N)	r   r  local_lplocal_serverlocal_binding_stringlocal_credsremote_serverremote_binding_stringremote_credsr   r{   r{   r|   r    s    
zDomainTrustCommand.__init__c                 C   s   t |jS r  )ctypesc_uint32value)r   vr{   r{   r|   _uint32  s    zDomainTrustCommand._uint32c                 C   s,   |d u rdS |  |jd }||kr(dS dS )NFr   T)r  rJ  )r   runtimevalerr32r{   r{   r|   check_runtime_error  s    z&DomainTrustCommand.check_runtime_errorc                   @   s   e Zd Zdd ZdS )z$DomainTrustCommand.LocalRuntimeErrorc                 C   s<   | |jd }|jd }d|j|||f }t| | d S )Nr   r   z%LOCAL_DC[%s]: %s - ERROR(0x%08X) - %s)r  rJ  r  r   r  exception_selfr   r  rb  r  errstrrR  r{   r{   r|   r    s    

z-DomainTrustCommand.LocalRuntimeError.__init__Nr  r{   r{   r{   r|   LocalRuntimeError  s   r  c                   @   s   e Zd Zdd ZdS )z%DomainTrustCommand.RemoteRuntimeErrorc                 C   s<   | |jd }|jd }d|j|||f }t| | d S )Nr   r   z&REMOTE_DC[%s]: %s - ERROR(0x%08X) - %s)r  rJ  r  r   r  r  r{   r{   r|   r    s    

z.DomainTrustCommand.RemoteRuntimeError.__init__Nr  r{   r{   r{   r|   RemoteRuntimeError  s   r  c                   @   s   e Zd Zdd ZdS )z DomainTrustCommand.LocalLdbErrorc                 C   s6   |j d }|j d }d|j|||f }t| | d S )Nr   r   z!LOCAL_DC[%s]: %s - ERROR(%d) - %s)rJ  r  r   r  )r  r   Z	ldb_errorrb  Zerrvalr  rR  r{   r{   r|   r    s    


z)DomainTrustCommand.LocalLdbError.__init__Nr  r{   r{   r{   r|   LocalLdbError  s   r  c           
      C   s   | j d ur| j S | }|j}|d u rf| }|dkrBtd| |d}d}d}|d7 }d }d }	nd}d}d| }||}	|| _|| _ d	|||f | _|| _	|	| _
| j S )
NZROLE_ACTIVE_DIRECTORY_DCzInvalid server_role %sr   Zncalrpcrj   z,auth_type=ncalrpc_as_systemZncacn_npr4  z	%s:%s[%s])r  r   r'  r  r   r   r&  r  r  local_ldap_urlr  )
r   r   localdcoptsr   r  r  Zlocal_transportZlocal_binding_optionsr  r  r{   r{   r|   setup_local_server  s0    


z%DomainTrustCommand.setup_local_serverc                 C   s   t | j| j| jS r  )r   lsarpcr  r  r  r  r{   r{   r|   new_local_lsa_connection  s    z+DomainTrustCommand.new_local_lsa_connectionc                 C   s   t  | j| j| jS r  )r   r  r  r  r  r{   r{   r|   new_local_netlogon_connection  s    z0DomainTrustCommand.new_local_netlogon_connectionc                 C   s   t | jt | j| jdS )Nr5  )r   r  r   r  r  r  r{   r{   r|   new_local_ldap_connection  s
    z,DomainTrustCommand.new_local_ldap_connectionTc              "   C   s  |r|sJ | j d ur| j S d| | _ | jd us4J || j}|j}d}zLt|| j|d}tjtjB }	|rv|	tj	O }	|r|	tj
O }	|j|	||d}
W nV ty } z"td||jd f W Y d }~n&d }~0  ty   td| Y n0 tj
dtjd	tjd
tjdtjdtjdtjdtj	dtjdtjdtjdtjdtjdtjdtjdtjdtjdi}| j||
jdd}| j d|
j!|
j"|f  |
j"| _ d| j |f | _#|| _$| j S )Nz__unknown__remote_server__.%srj   r  )flagsr   r   z1Failed to find a writeable DC for domain '%s': %sr   z-Failed to find a writeable DC for domain '%s'ZPDCZGCZLDAPZDSZKDCZTIMESERVZCLOSESTZWRITABLEZGOOD_TIMESERVZNDNCZSELECT_SECRET_DOMAIN_6ZFULL_SECRET_DOMAIN_6ZADS_WEB_SERVICEZDS_8ZHAS_DNS_NAMEZIS_DEFAULT_NCZFOREST_ROOTT
names_onlyz,RemoteDC Netbios[%s] DNS[%s] ServerType[%s]
zncacn_np:%s[%s])%r  r  r&  r  r'  r	   r   ZNBT_SERVER_LDAPZNBT_SERVER_DSZNBT_SERVER_WRITABLEZNBT_SERVER_PDCZfinddcr   r   rJ  r   ZNBT_SERVER_GCZNBT_SERVER_KDCZNBT_SERVER_TIMESERVZNBT_SERVER_CLOSESTZNBT_SERVER_GOOD_TIMESERVZNBT_SERVER_NDNCZ!NBT_SERVER_SELECT_SECRET_DOMAIN_6ZNBT_SERVER_FULL_SECRET_DOMAIN_6ZNBT_SERVER_ADS_WEB_SERVICEZNBT_SERVER_DS_8ZNBT_SERVER_HAS_DNS_NAMEZNBT_SERVER_IS_DEFAULT_NCZNBT_SERVER_FOREST_ROOTgeneric_bitmap_to_stringZserver_typer   r   r   r   r  r  )r   r   r   require_pdcZrequire_writabler  r  Zremote_binding_optionsZ
remote_netZremote_flagsZremote_infoerrorZflag_mapZserver_type_stringr{   r{   r|   setup_remote_server  sj    



z&DomainTrustCommand.setup_remote_serverc                 C   s   t | j| j| jS r  )r   r  r  r  r  r  r{   r{   r|   new_remote_lsa_connection  s    z,DomainTrustCommand.new_remote_lsa_connectionc                 C   s   t  | j| j| jS r  )r   r  r  r  r  r{   r{   r|   new_remote_netlogon_connection"  s    z1DomainTrustCommand.new_remote_netlogon_connectionc                 C   s<   t  }t  |_|dd||}||t j}||fS )N    zutf-8)r   ZObjectAttributeZQosInfoZsec_qosZOpenPolicy2r  ZQueryInfoPolicy2ZLSA_POLICY_INFO_DNS)r   connZpolicy_accessZ
objectAttrZpolicyr   r{   r{   r|   get_lsa_info%  s    
zDomainTrustCommand.get_lsa_infoc              	   C   sD   z | |d dd d d tj}|jW S  ty>   ||| Y S 0 d S Nr   )netr_DsRGetDCNameEx2r   DS_RETURN_DNS_NAMEdc_uncr   Znetr_GetDcName)r   r  r  r   r   r{   r{   r|   get_netlogon_dc_unc0  s    
z&DomainTrustCommand.get_netlogon_dc_uncc              	   C   s   | |d dd d d tj}|S r  )r  r   r  )r   r  r  r   r{   r{   r|   get_netlogon_dc_info9  s
    
z'DomainTrustCommand.get_netlogon_dc_infoc                 C   s   |j tjkr|jS |jS r  )
trust_typer   LSA_TRUST_TYPE_DOWNLEVELr#  Zdns_namer   tr{   r{   r|   netr_DomainTrust_to_name?  s    z+DomainTrustCommand.netr_DomainTrust_to_namec                 C   s   d }d }|D ].}|j tj@ r|}|j tj@ s6||j } q<q|j tj@ r~||u rTdS |j tj@ rddS ||j }||u rzdS dS |jtj@ rdS dS )NZParentZTreeRootZChildZShortcutZForestZExternal)	trust_flagsr   NETR_TRUST_FLAG_PRIMARYZNETR_TRUST_FLAG_TREEROOTZparent_indexNETR_TRUST_FLAG_IN_FORESTtrust_attributesr   %LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)r   ar  ZprimaryZprimary_parentZ_trL  r{   r{   r|   netr_DomainTrust_to_typeE  s(    

z+DomainTrustCommand.netr_DomainTrust_to_typec                 C   s4   |j tj@ rdS |jtj@ r dS |jtj@ r0dS dS )NZYesZNo)r  r   r  r  r   "LSA_TRUST_ATTRIBUTE_NON_TRANSITIVEr  r  r{   r{   r|   netr_DomainTrust_to_transitivea  s    z1DomainTrustCommand.netr_DomainTrust_to_transitivec                 C   s@   |j tj@ r|j tj@ rdS |j tj@ r,dS |j tj@ r<dS dS )NBOTHZINCOMINGZOUTGOINGZINVALID)r  r   NETR_TRUST_FLAG_INBOUNDNETR_TRUST_FLAG_OUTBOUNDr  r{   r{   r|   netr_DomainTrust_to_directionm  s    
z0DomainTrustCommand.netr_DomainTrust_to_directionFc                 C   sB   z|| }W n$ t y0   | |}d| }Y n0 d||f }|S )Nz__unknown__%08X__	0x%x (%s))KeyErrorr  )r   Ze_dictr  r  rf   Zv32r  r{   r{   r|   generic_enum_to_stringz  s    
z)DomainTrustCommand.generic_enum_to_stringc           
      C   s~   g }|}t | D ]&}||@ s"q|| M }||| g7 }q|dkr\| |}|d| g7 }d|}|rn|S d||f }	|	S )Nr   z__unknown_%08X__,r  )sortedkeysr  rd  )
r   Zb_dictr  r  rV  cbZc32rf   r  r{   r{   r|   r    s    


z+DomainTrustCommand.generic_bitmap_to_stringc                 C   s(   t jdt jdt jdt jdi}| ||S )NZ	DOWNLEVELZUPLEVELZMITZDCE)r   r  LSA_TRUST_TYPE_UPLEVELZLSA_TRUST_TYPE_MITZLSA_TRUST_TYPE_DCEr  )r   r  typesr{   r{   r|   trustType_string  s    z#DomainTrustCommand.trustType_stringc                 C   s(   t jt jB dt jdt jdi}| ||S )Nr  ZINBOUNDZOUTBOUND)r   LSA_TRUST_DIRECTION_INBOUNDLSA_TRUST_DIRECTION_OUTBOUNDr  )r   r  Z
directionsr{   r{   r|   trustDirection_string  s    z(DomainTrustCommand.trustDirection_stringc                 C   s@   t jdt jdt jdt jdt jdt jdt jdt jdi}| 	||S )	NZNON_TRANSITIVEZUPLEVEL_ONLYZQUARANTINED_DOMAINZFOREST_TRANSITIVEZCROSS_ORGANIZATIONZWITHIN_FORESTZTREAT_AS_EXTERNALZUSES_RC4_ENCRYPTION)
r   r  Z LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY&LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAINr  &LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATIONZ!LSA_TRUST_ATTRIBUTE_WITHIN_FOREST%LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNALZ'LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTIONr  )r   r  Z
attributesr{   r{   r|   trustAttributes_string  s    
z)DomainTrustCommand.trustAttributes_stringc                 C   sF   t jdt jdt jdt jdt jdt jdt jdt jdt j	d	i	}| 
||S )
NZDES_CBC_CRCZDES_CBC_MD5ZRC4_HMAC_MD5ZAES128_CTS_HMAC_SHA1_96ZAES256_CTS_HMAC_SHA1_96ZFAST_SUPPORTEDZCOMPOUND_IDENTITY_SUPPORTEDZCLAIMS_SUPPORTEDZ!RESOURCE_SID_COMPRESSION_DISABLED)r   ZKERB_ENCTYPE_DES_CBC_CRCZKERB_ENCTYPE_DES_CBC_MD5ZKERB_ENCTYPE_RC4_HMAC_MD5$KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96$KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96ZKERB_ENCTYPE_FAST_SUPPORTEDZ(KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTEDZKERB_ENCTYPE_CLAIMS_SUPPORTEDZ.KERB_ENCTYPE_RESOURCE_SID_COMPRESSION_DISABLEDr  )r   r  Zenctypesr{   r{   r|   kerb_EncTypes_string  s    z'DomainTrustCommand.kerb_EncTypes_stringc                 C   s6   |dkrdS t jdt jdt jdi}d| j||dd S )	Nr   Status[Enabled]zDisabled-NewZDisabledzDisabled-Conflicting
Status[%s]Tr  )r   ZLSA_TLN_DISABLED_NEWLSA_TLN_DISABLED_ADMINZLSA_TLN_DISABLED_CONFLICTr  r   Ze_flagsr  r{   r{   r|   entry_tln_status  s    z#DomainTrustCommand.entry_tln_statusc                 C   s<   |dkrdS t jdt jdt jdt jdi}d| j||dd	 S )
Nr   r  zDisabled-SIDzDisabled-SID-ConflictingzDisabled-NBzDisabled-NB-Conflictingr  Tr  )r   LSA_SID_DISABLED_ADMINZLSA_SID_DISABLED_CONFLICTLSA_NB_DISABLED_ADMINZLSA_NB_DISABLED_CONFLICTr  r  r{   r{   r|   entry_dom_status  s    z#DomainTrustCommand.entry_dom_statusNc              	   C   s  |d urd| }nd}| j dt|j|f  t|jD ]\}}|j}d}|d ur~|jD ]"}	|	j|krjqZ|	j}d|	jj }qZ|j	}
|j
tjkr| j d| ||
j|f  q:|j
tjkr| j dd|
jf  q:|j
tjkr:| j d| ||
jj|
jj|
j|f  q:d S )Nz TDO[%s]rj   zNamespaces[%d]%s:
z Collision[%s]zTLN: %-32s DNS[*.%s]%s
zTLN_EX: %-29s DNS[*.%s]
z)DOM: %-32s DNS[%s] Netbios[%s] SID[%s]%s
)r   r   r   entries	enumerater  indexr   rE   forest_trust_datarH   r   LSA_FOREST_TRUST_TOP_LEVEL_NAMEr  "LSA_FOREST_TRUST_TOP_LEVEL_NAME_EXLSA_FOREST_TRUST_DOMAIN_INFOr  Zdns_domain_namenetbios_domain_namer  )r   Zftitln
collisionsZ
tln_stringrU  r
  r  Zcollision_stringr  dr{   r{   r|   write_forest_trust_info  sB    






z*DomainTrustCommand.write_forest_trust_info)TT)F)F)NN)"r   r   r   r   r  r  r  r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r{   r{   r{   r|   r    s@   
  
@	


		r  c                   @   s2   e Zd ZdZdZejejedZ	g Z
dddZdS )cmd_domain_trust_listr  r   r   r   r  Nc           
      C   s  |  ||}z|  }W n2 tyJ } z| | |dW Y d }~n
d }~0 0 z||tjtjB tjB }W nN ty } z6| 	|t
jrtd| j | | |dW Y d }~n
d }~0 0 |j}|D ]T}	|	jtj@ rq| jdd| ||	 d| |	 d| |	 d| |	 f  qd S )	N!failed to connect netlogon serverz:LOCAL_DC[%s]: netr_DsrEnumerateDomainTrusts not supported.z$netr_DsrEnumerateDomainTrusts failedz%-14s %-15s %-19s %s
zType[%s]zTransitive[%s]zDirection[%s]zName[%s])r  r  r   r  Znetr_DsrEnumerateDomainTrustsr   r  r  r  r  r   WERR_RPC_S_PROCNUM_OUT_OF_RANGEr   r  arrayr  r  r   r   r  r  r  r  )
r   r   r   r  r  local_netlogonr  Zlocal_netlogon_trustsr  r  r{   r{   r|   r     s>    $$
zcmd_domain_trust_list.run)NNN)r   r   r   r   r   r   r   r   r  r   r   r   r{   r{   r{   r|   r    s   r  c                   @   s8   e Zd ZdZdZejejedZ	g Z
dgZdddZdS )	cmd_domain_trust_showzShow trusted domain details.z%prog NAME [options]r   r   Nc              
   C   sr  |  ||}z|  }W n2 tyJ } z| | |dW Y d }~n
d }~0 0 ztj}| ||\}	}
W n2 ty } z| | |dW Y d }~n
d }~0 0 | jd|
j	j
|
jj
|
jf  t }||_
z ||	|tj}|j}|j}W nP ty8 } z6| |tjrtd| | | |dW Y d }~n
d }~0 0 z||	|tj}W nt ty } zZ| |tjrtd }| |tjrd }|d ur| | |dt }d|_W Y d }~n
d }~0 0 z&d }|jtj@ r||	|tj}W nz tyd } z`| |tj rd }| |tj!r$d }|d ur<| | |dt" }d|_#g |_$W Y d }~n
d }~0 0 | jd	 | jd
|j%j
  |j%j
|j&j
kr| jd|j&j
  | jd|j  | jd| '|j(  | jd| )|j*  | jd| +|j  t,-|jj.}t,/|jj.}| jd||f  | jd| 0|j  |jtj@ rn| j1||j&j
d d S )Nfailed to connect lsa server#failed to query LSA_POLICY_INFO_DNS(LocalDomain Netbios[%s] DNS[%s] SID[%s]
4trusted domain object does not exist for domain [%s]z.QueryTrustedDomainInfoByName(FULL_INFO) failedz?QueryTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failedr   z&lsaRQueryForestTrustInformation failedzTrustedDomain:

zNetbiosName:    %s
zDnsName:        %s
zSID:            %s
zType:           %s
zDirection:      %s
zAttributes:     %s
zPosixOffset:    0x%08X (%d)
zkerb_EncTypes:  %s
r  )2r  r  r   r  r   !LSA_POLICY_VIEW_LOCAL_INFORMATIONr  r   r   r   rE   r   r+  StringQueryTrustedDomainInfoByName!LSA_TRUSTED_DOMAIN_INFO_FULL_INFOZinfo_exZposix_offsetr   r  r   NT_STATUS_OBJECT_NAME_NOT_FOUNDr   -LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPESZNT_STATUS_INVALID_PARAMETERZNT_STATUS_INVALID_INFO_CLASS TrustDomainInfoSupportedEncTypes	enc_typesr  r  lsaRQueryForestTrustInformationr  Z"NT_STATUS_RPC_PROCNUM_OUT_OF_RANGEZNT_STATUS_NOT_FOUNDForestTrustInformationcountr  r#  r   r  r  r  trust_directionr  r  r  r  Zc_int32r  r  )r   r   r   r   r  r  	local_lsar  local_policy_accesslocal_policylocal_lsa_info	lsaStringZlocal_tdo_fulllocal_tdo_infoZlocal_tdo_posixZlocal_tdo_enctypesZlocal_tdo_forestZposix_offset_u32Zposix_offset_i32r{   r{   r|   r   B  s    $$
$

zcmd_domain_trust_show.run)NNN)r   r   r   r   r   r   r   r   r  r   r   r   r   r{   r{   r{   r|   r  2  s   r  c                   @   s   e Zd ZdZdZejejeje	dZ
edddddgd	d
ddedddg dddddedddddgddddeddddddedddg dd d!d"ded#dd$d%dded&dd'd(dded)d*d+d,d-ded.d*d/d0d-dg	Zd1gZd4d2d3Zd"S )5cmd_domain_trust_createz Create a domain or forest trust.%prog DOMAIN [options]r   r   r   r  z--typerN   ZTYPEexternalr   z.The type of the trust: 'external' or 'forest'.r  rH   rI   rO   rJ   r3  r`   z--directionZ	DIRECTION)incomingoutgoingbothz6The trust direction: 'incoming', 'outgoing' or 'both'.r  r$  z--create-locationLOCATIONlocalz=Where to create the trusted domain object: 'local' or 'both'.create_locationz--cross-organisationrK   z=The related domains does not belong to the same organisation.cross_organisationFrM   rJ   r3  r`   z--quarantinedzyes|no)r   r   NzSpecial SID filtering rules are applied to the trust. With --type=external the default is yes. With --type=forest the default is no.quarantined_argNz--not-transitivez#The forest trust is not transitive.not_transitivez--treat-as-externalz'The treat the forest trust as external.treat_as_externalz--no-aes-keysZstore_falsez!The trust uses aes kerberos keys.use_aes_keysTz--skip-validationzSkip validation of the trust.validater   c           C   
      s:  t  }d}|
d u r"|dkr.d}n|
dkr.d}|dkrN|rBtd|rNtdd }|rvt  }tj|_| jtjO  _t j}|t j	O }|t j
O }t  }t j|_d|_|d	kr| jt jO  _| jt jO  _n4|d
kr| jt jO  _n|dkr| jt jO  _d|_|	r | jt jO  _|r6| jt jO  _|dkrP| jt jO  _|rf| jt jO  _|r|| jt jO  _ fdd}d }d }t j}|dkr|jt j@ r|d}t|d}|jt j@ r|d}t|d}d }n8dd }|jt j@ r|d}|jt j@ r$|d}|t j	O }|t j
O }t  }t j|_d|_|d	krz| jt jO  _| jt jO  _n6|d
kr| jt jO  _n|dkr| jt jO  _d|_|	r| jt jO  _|r| jt jO  _|dkr| jt jO  _|r| jt jO  _|r(| jt jO  _ ||}z  }W n4 tyt } z  |dW Y d }~n
d }~0 0 z ||\}} W n4 ty } z  |dW Y d }~n
d }~0 0  jd| j j!| j"j!| j#f  z $||}!W n4 ty$ } z % |dW Y d }~n
d }~0 0 z & }"W n4 tyf } z % |dW Y d }~n
d }~0 0 z |"|\}#}$W n4 ty } z % |dW Y d }~n
d }~0 0  jd|$j j!|$j"j!|$j#f  |$j"j!|j'_!|$j j!|j(_!|$j#|_#|r| j"j!|j'_!| j j!|j(_!| j#|_#z,|j'j!|_!|)||t j*}%td|j! W nJ t+y } z0 ,|t-j.sz  |d|j! W Y d }~n
d }~0 0 z,|j(j!|_!|)||t j*}&td|j! W nJ t+y } z0 ,|t-j.s  |d|j! W Y d }~n
d }~0 0 |rz,|j'j!|_!|")|#|t j*}'td|j! W nJ t+y } z0 ,|t-j.sp % |d|j! W Y d }~n
d }~0 0 z,|j(j!|_!|")|#|t j*}(td|j! W nJ t+y } z0 ,|t-j.s % |d|j! W Y d }~n
d }~0 0 z / })W n4 ty> } z  |dW Y d }~n
d }~0 0 z 0|)|}*W n4 ty } z  |dW Y d }~n
d }~0 0 |rz 1 }+W n4 ty } z % |dW Y d }~n
d }~0 0 z 2|+|!|},W n4 ty } z % |dW Y d }~n
d }~0 0 dd }-dCd d!}.t34 }/|-||/}0|-||/}1d }2d }3|.|j5|0|1d"}4|rr|.|"j5|1|0d"}5z|rڈ jd# d$d%d&}6|"6|#||5t j7}3 jd' |rڈ jd( d$d)d&}6|"8|3t j9|  jd* dd%d&}6|6|||4t j7}2 jd+ |	r: jd, dd)d&}6|8|2t j9| W n t	y } z jd-|6d. |6d/ f  |3	r jd0 |":|3 d }3|2	r jd1 |:|2 d }2|6d/ d$k	rΈ % |d2|6d.    |d2|6d.  W Y d }~n
d }~0 0 |r|jt j@ r jd3 z|);|*j<|$j"j!t=j>}7W n4 t
yh } z  |d4W Y d }~n
d }~0 0 z|?||$j"t j@|7d}8W n4 t
y } z  |d5W Y d }~n
d }~0 0  jA|7|$j"j!|8d6 |r jd7 z|+;|,| j"j!t=j>}9W n4 ty, } z % |d4W Y d }~n
d }~0 0 z|"?|#| j"t j@|9d}:W n4 ty| } z % |d5W Y d }~n
d }~0 0  jA|9| j"j!|:d6 |jt j@ r jd8 z|)B|*j<t=jCd9|$j"j!};W n4 ty } z  |d:W Y d }~n
d }~0 0  D|;jEd }< D|;jFd }=|;jGt=jH@ rJd;|;jI|;jFd< |;jEd< f }>nd=|;jI|;jFd< |;jEd< f }>|<tJjKks~|=tJjKkrt|>n jd>|>  |r|jt j@ r jd? z|+B|,t=jCd9| j"j!}?W n4 ty } z % |d:W Y d }~n
d }~0 0  D|?jEd }@ D|?jFd }A|?jGt=jH@ rTd@|?jI|?jFd< |?jEd< f }BndA|?jI|?jFd< |?jEd< f }B|@tJjKks|AtJjKkrt|Bn jd>|B  |3d urz|"L|3 W n& ty } zW Y d }~n
d }~0 0 d }3|2d ur*z|L|2 W n& ty$ } zW Y d }~n
d }~0 0 d }2 jdB d S )DNFr   Tr   r   z'--not-transitive requires --type=forestz*--treat-as-external requires --type=forestr   r$  r"  r#  c                    sN   d }|d ur|dkr|S t d|  }t d|  }||ksd } jd qd S )Nrj   zNew %s Password: zRetype %s Password: r   )r   r   r   )r   passwordZpasswordverifyr  r{   r|   get_password	  s    z1cmd_domain_trust_create.run.<locals>.get_passwordr&  zIncoming Trust	utf-16-lezOutgoing Trustc                 S   s"   t | d | d }t|dS )N   r1  )r   Z generate_random_machine_passwordr'   encode)ZlengthZpwr{   r{   r|   random_trust_secret/	  s    z8cmd_domain_trust_create.run.<locals>.random_trust_secret   r  r  r  failed to locate remote server)RemoteDomain Netbios[%s] DNS[%s] SID[%s]
zTrustedDomain %s already exist'z2QueryTrustedDomainInfoByName(%s, FULL_INFO) failedr  failed to get netlogon dc infoc                 S   s   | d u rt  }d|_|S t  }t| |_| |_t  }t	||_
tj|_||_t  }d|_|g|_t  }d|_||_|S )Nr   r   )r   ZtrustAuthInOutBlobr  ZAuthInfoClearr   sizer/  ZAuthenticationInformationr   Zunix2nttimeZLastUpdateTimer   ZTRUST_AUTH_TYPE_CLEARZAuthTypeZAuthInfoZAuthenticationInformationArrayr  Zcurrent)Zsecretupdate_timeZblobclearr   r  r{   r{   r|   generate_AuthInOutBlob	  s$    
z;cmd_domain_trust_create.run.<locals>.generate_AuthInOutBlobc           
      S   s   dgd }t t|D ]}tdd||< qt }||_||_||_t	|}t
| |}t }t||_t||_t }	||	_|	S )Nr   i      )ranger   randomZrandintr   ZtrustDomainPasswords
confounderr#  r"  r   r&   r   Z	DATA_BUF2r9  r'   dataZTrustDomainInfoAuthInfoInternal	auth_blob)
session_keyr"  r#  r@  rU  Z	trustpassZtrustpass_blobZencrypted_trustpassrB  Z	auth_infor{   r{   r|   generate_AuthInfoInternal	  s    



z>cmd_domain_trust_create.run.<locals>.generate_AuthInfoInternal)r"  r#  zCreating remote TDO.
ZremoteCreateTrustedDomainEx2)locationr   zRemote TDO created.
z2Setting supported encryption types on remote TDO.
SetInformationTrustedDomainzCreating local TDO.
zLocal TDO created
z1Setting supported encryption types on local TDO.
z$Error: %s failed %sly - cleaning up
r   rF  zDeleting remote TDO.
zDeleting local TDO.
%sz(Setup local forest trust information...
*netr_DsRGetForestTrustInformation() failed&lsaRSetForestTrustInformation() failedr  r  z)Setup remote forest trust information...
zValidating outgoing trust...
r2  !NETLOGON_CONTROL_TC_VERIFY failedGLocalValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNEDr   0LocalValidation: DC[%s] CONNECTION[%s] TRUST[%s]OK: %s
zValidating incoming trust...
HRemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNED1RemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s]z	Success.
)NN)Mr   r  r   r  r   r  r  r  r  LSA_POLICY_TRUST_ADMINLSA_POLICY_CREATE_SECRETZTrustDomainInfoInfoExr  r  r  r  r  r  r  r  r  r  r  r'   r3  r  r  r   r  r  r   r   r   rE   r   r+  r  r  r  r   r#  r  r  r   r  r   r  r  r  r  r  r   Zcurrent_unix_timerC  rE  ZLSA_TRUSTED_DOMAIN_ALL_ACCESSrG  r  DeleteObject!netr_DsRGetForestTrustInformationr  r   DS_GFTI_UPDATE_TDOlsaRSetForestTrustInformationr  r  netr_LogonControl2ExNETLOGON_CONTROL_TC_VERIFYr  pdc_connection_statustc_connection_statusr  NETLOGON_VERIFY_STATUS_RETURNEDtrusted_dc_namer   WERR_SUCCESSZClose)Cr   r   r   r  r   r   r  r  r'  r(  r*  r+  r,  r-  r.  r  Zquarantinedr  r  Zlocal_trust_infor0  Zincoming_secretZoutgoing_secretremote_policy_accessZincoming_passwordZoutgoing_passwordZremote_trust_infor4  r  r  r  r  r  r  
remote_lsaremote_policyremote_lsa_infoZlocal_old_netbiosZlocal_old_dnsZremote_old_netbiosZremote_old_dnsr  local_netlogon_inforemote_netlogonZremote_netlogon_dc_uncr<  rD  r:  Zincoming_blobZoutgoing_bloblocal_tdo_handleremote_tdo_handleZlocal_auth_infoZremote_auth_infoZcurrent_requestlocal_forest_infoZlocal_forest_collisionZremote_forest_infoZremote_forest_collisionlocal_trust_verifylocal_trust_statuslocal_conn_statuslocal_validationremote_trust_verifyremote_trust_statusremote_conn_statusremote_validationr{   r  r|   r     s    










$$$$$



$$$$










$$$$$
$


zcmd_domain_trust_create.run)NNNNNNNFNFFFTr   r   r   r   r   r   r   r   r   r  r   r   r   r   r   r{   r{   r{   r|   r    s   -     r  c                	   @   sT   e Zd ZdZdZejejeje	dZ
edddddgd	d
ddgZdgZdddZdS )cmd_domain_trust_deletezDelete a domain trust.r  r  z--delete-locationrN   r%  r&  r$  z=Where to delete the trusted domain object: 'local' or 'both'.delete_locationr!  r   Nc                 C   s4  t j}|t jO }|t jO }|dkr(d }nt j}|t jO }|t jO }| ||}	z|  }
W n2 ty } z| | |dW Y d }~n
d }~0 0 z| |
|\}}W n2 ty } z| | |dW Y d }~n
d }~0 0 | j	
d|jj|jj|jf  d }d }d }d }t  }z||_|
||t j}W nP tyx } z6| |tjrVtd| | | |dW Y d }~n
d }~0 0 |d urz| ||}W n4 ty } z| | |dW Y d }~n
d }~0 0 z|  }W n4 ty
 } z| | |dW Y d }~n
d }~0 0 z| ||\}}W n4 tyT } z| | |dW Y d }~n
d }~0 0 | j	
d|jj|jj|jf  |j|jks|jj|jjks|jj|jjkrtd|jj|jj|jf z|jj|_|||t j}W nJ ty, } z0| |tjs| | |d	|j W Y d }~n
d }~0 0 |d ur|j|jksj|jj|jjksj|jj|jjkrtd
|jj|jj|jf |d urz|jj|_|
||tj}W n: ty } z | | |d|j W Y d }~n
d }~0 0 |
| d }|d ur\z|jj|_|||tj}W n: tyZ } z | | |d|j W Y d }~n
d }~0 0 |d urz|| d }| j	
d W n@ ty } z&| j	
d| | |d  W Y d }~n
d }~0 0 |d ur0z|
| d }| j	
d W n@ ty. } z&| j	
d| | |d  W Y d }~n
d }~0 0 d S )Nr&  r  r  r  z$Failed to find trust for domain '%s'r6  r7  z2LocalTDO inconsistend: Netbios[%s] DNS[%s] SID[%s]z QueryTrustedDomainInfoByName(%s)z3RemoteTDO inconsistend: Netbios[%s] DNS[%s] SID[%s]zOpenTrustedDomainByName(%s)zRemoteTDO deleted.
z%s
zDeleteObject() failedzLocalTDO deleted.
) r   r  rR  rS  r  r  r   r  r  r   r   r   rE   r   r+  r  r  LSA_TRUSTED_DOMAIN_INFO_INFO_EXr   r  r   r  r   r  r  r  r#  r   ZOpenTrustedDomainByNamer   ZSEC_STD_DELETErT  )r   r   r   r  r   r   rr  r  r_  r  r  r  r  r  r  re  Zremote_tdo_inforf  r  r  r`  ra  rb  r{   r{   r|   r   
  s   



$$$
$$$











0

0zcmd_domain_trust_delete.run)NNNNNrp  r{   r{   r{   r|   rq  
  s$     rq  c                	   @   sT   e Zd ZdZdZejejeje	dZ
edddddgd	d
ddgZdgZdddZdS )cmd_domain_trust_validatezValidate a domain trust.r  r  z--validate-locationrN   r%  r&  r$  z?Where to validate the trusted domain object: 'local' or 'both'.validate_locationr!  r   Nc               
   C   sf  t j}| ||}z|  }	W n2 tyP }
 z| | |
dW Y d }
~
n
d }
~
0 0 z| |	|\}}W n2 ty }
 z| | |
dW Y d }
~
n
d }
~
0 0 | jd|j	j
|jj
|jf  z"t  }||_
|	||t j}W nP ty, }
 z6| |
tjr
td| | | |
dW Y d }
~
n
d }
~
0 0 | jd|jj
|jj
|jf  z|  }W n4 ty }
 z| | |
dW Y d }
~
n
d }
~
0 0 z||tjd|jj
}W n4 ty }
 z| | |
d	W Y d }
~
n
d }
~
0 0 | |jd
 }| |jd
 }|jtj@ r,d|j |jd |jd f }nd|j |jd |jd f }|t!j"ks`|t!j"krjt|n| jd|  z4|j #dd}d|jj
|f }||tj$d|}W n4 ty }
 z| | |
dW Y d }
~
n
d }
~
0 0 | |jd
 }d|j |jd f }|t!j"krt|n| jd|  |dkrbz| j%||dd}W n4 ty }
 z| &| |
dW Y d }
~
n
d }
~
0 0 z| ' }W n4 ty }
 z| &| |
dW Y d }
~
n
d }
~
0 0 z||tjd|jj
}W n4 ty }
 z| &| |
d	W Y d }
~
n
d }
~
0 0 | |jd
 }| |jd
 }|jtj@ r`d|j |jd |jd f }nd|j |jd |jd f }|t!j"ks|t!j"krt|n| jd|  z4|j #dd}d|jj
|f }||tj$d|}W n4 ty }
 z| &| |
dW Y d }
~
n
d }
~
0 0 | |jd
 }d|j |jd f }|t!j"krRt|n| jd|  d S )Nr  r  r  r	  ,QueryTrustedDomainInfoByName(INFO_EX) failed%LocalTDO Netbios[%s] DNS[%s] SID[%s]
r  r2  rL  r   rM  r   rN  rO  \rj   z%s\%sz"NETLOGON_CONTROL_REDISCOVER failedz&LocalRediscover: DC[%s] CONNECTION[%s]r&  F)r  r6  rP  rQ  z'RemoteRediscover: DC[%s] CONNECTION[%s])(r   r  r  r  r   r  r  r   r   r   rE   r   r+  r  r  rs  r   r  r   r  r   r#  r   r  rX  r   rY  r  rZ  r[  r  r\  r]  r   r^  replaceZNETLOGON_CONTROL_REDISCOVERr  r  r  ) r   r   r   r   r   r  ru  r  r  r  r  r  r  r  r  r  rh  ri  rj  rk  r  Zdomain_and_serverZlocal_trust_rediscoverZlocal_rediscoverr  rd  rl  rm  rn  ro  Zremote_trust_rediscoverZremote_rediscoverr{   r{   r|   r   x  s   $$$$$
$

$$$
$
zcmd_domain_trust_validate.run)NNNNNrp  r{   r{   r{   r|   rt  b  s$     rt  c                   @   s\  e Zd ZdZdZejejedZ	e
dddg ddd	d
de
dddddde
dddddg de
dddddg de
dddddg de
ddddd g de
d!dd"d#d$g de
d%dd"d&d'g de
d(dd)d*d+g de
d,dd)d-d.g de
d/ddd0d1g de
d2ddd3d4g de
d5ddd6d7g de
d8ddd9d:g dgZd;gZd
d
d
d
d
dg g g g g g g g g g g g fd<d=Zd
S )>cmd_domain_trust_namespaceszManage forest trust namespaces.z%prog [DOMAIN] [options]r   z	--refreshrN   zcheck|store)ZcheckstoreNzLList and maybe store refreshed forest trust information: 'check' or 'store'.refreshNr!  z--enable-allrK   zATry to update disabled entries, not allowed with --refresh=check.
enable_allFr)  z--enable-tlnrc  Z	DNSDOMAINz?Enable a top level name entry. Can be specified multiple times.
enable_tln)rM   rI   rJ   r3  r`   z--disable-tlnz@Disable a top level name entry. Can be specified multiple times.disable_tlnz--add-tln-exzAAdd a top level exclusion entry. Can be specified multiple times.
add_tln_exz--delete-tln-exzDDelete a top level exclusion entry. Can be specified multiple times.delete_tln_exz--enable-nbZNETBIOSDOMAINzIEnable a netbios name in a domain entry. Can be specified multiple times.	enable_nbz--disable-nbzJDisable a netbios name in a domain entry. Can be specified multiple times.
disable_nbz--enable-sidZ	DOMAINSIDz@Enable a SID in a domain entry. Can be specified multiple times.enable_sid_strz--disable-sidzADisable a SID in a domain entry. Can be specified multiple times.disable_sid_strz--add-upn-suffixzVAdd a new uPNSuffixes attribute for the local forest. Can be specified multiple times.add_upnz--delete-upn-suffixz^Delete an existing uPNSuffixes attribute of the local forest. Can be specified multiple times.
delete_upnz--add-spn-suffixz[Add a new msDS-SPNSuffixes attribute for the local forest. Can be specified multiple times.add_spnz--delete-spn-suffixzcDelete an existing msDS-SPNSuffixes attribute of the local forest. Can be specified multiple times.
delete_spnzdomain?c           G      C   sV  d}|d u r&|dkr"t d| |r.t dt|dkrBt dt|dkrVt dt|	dkrjt dt|
dkr~t d	t|dkrt d
t|dkrt dt|dkrt dt|dkrt dt|dkr|D ]}|dsqt d| qd}t|dkr<|D ]"}|ds(qt d| qd}|D ]4}|D ](}| | krbqHt d| qHq@t|dkr|D ]"}|dsqt d| qd}t|dkr|D ]"}|ds֐qt d| qd}|D ]4}|D ](}| | krqt d| qqnXt|dkr<t dt|dkrRt dt|dkrht dt|dkr~t d|d urf|dkrd}|r|dkrt d| t|dkrt dt|dkrt dt|	dkrt dt|
dkr
t dt|dkr t dt|dkr6t d t|dkrLt d!t|dkr*t d"n|rd}t|dkrt d#t|dkrt d$t|dkrt d%t|dkrd}t|dkrd}|D ]4}|D ](}| | krqt d&| qqt|	dkrJ|	D ]"}|ds6q"t d'| q"d}t|
dkr|
D ]"}|dspq\t d(| q\d}|	D ]4}|
D ](}| | krqt d)| qqt|dkrd}t|dkrd}|D ]4}|D ](}| | krqt d*| qqg }|D ]R}zt|}W n2 tyh } zt d+| W Y d }~n
d }~0 0 || q$g }|D ]R}zt|}W n2 ty } zt d,| W Y d }~n
d }~0 0 || qt|dkrd}t|dkrd}|D ],}|D ] }||krqt d-| qqt	j
}|r@|t	jO }| ||}z|  }W n4 ty } z| | |d.W Y d }~n
d }~0 0 z| ||\} }!W n4 ty } z| | |d/W Y d }~n
d }~0 0 | jd0|!jj|!jj|!jf  |d u rz|  }"W n4 tyB } z| | |d1W Y d }~n
d }~0 0 z| |"|}#W n4 ty } z| | |d2W Y d }~n
d }~0 0 |#j|#jkrt d3|#j|#jf z|"|#jd d}$W n tyN } zt| |tjrt d4| j  | |tj!rt d4| j  | |tj"r,t d4| j  | | |d5W Y d }~n
d }~0 0 | jd6 | j#|$|!jjd7 z| $ }%W n4 ty } z| | |d8W Y d }~n
d }~0 0 d9t%|%&  }&d:d;g}'z |%j'|&t(j)d<|'d=}(|(d })W n6 t(j*	y } z| +| |d>W Y d }~n
d }~0 0 g }*d:|)v 	r<|*,|)d:  g }+d;|)v 	rX|+,|)d;  | jd?t|*  |*D ]},| jd@dA|,f  	qp| jdBt|+  |+D ]},| jd@dA|,f  	q|	sd S d}-g }.|.,|* d}/g }0|0,|+ |D ]J}1t-|.D ],\}2},t%|, |1 k	rt dC|1 	q|.|1 d}-	q|D ]f}1d }3t-|.D ].\}2},t%|, |1 k
rt
qR|2}3 
q
qR|3d u 
rt dD|1 |..|3 d}-
qB|D ]J}4t-|0D ],\}2},t%|, |4 k
rt dE|4 
q|0|4 d}/
q|D ]f}4d }3t-|0D ].\}2},t%|, |4 kr0q|2}3 q>q|3d u rTt dF|4 |0.|3 d}/
q| jdGt|.  |.D ]},| jd@dA|,f  q~| jdHt|0  |0D ]},| jd@dA|,f  qt(/ }5|)j0|5_0|-rt(1|.t(j2d:|5d:< |/rt(1|0t(j2d;|5d;< z|%3|5 W n6 t(j*yV } z| +| |dIW Y d }~n
d }~0 0 z|"|#jd d}6W n4 ty } z| | |d5W Y d }~n
d }~0 0 | jdJ | j#|6|!jjd7 d S z"t	4 }7||7_|5| |7t	j6}8W nP t7y6 } z6| |t8j9rt dK| | | |dLW Y d }~n
d }~0 0 | jdM|8j:j|8jj|8jf  |8j;t	j<@ srt dN| |d urnz|  }"W n4 ty } z| | |d1W Y d }~n
d }~0 0 z| |"|}#W n4 ty } z| | |d2W Y d }~n
d }~0 0 dO}9|dkr$t=j>}:|r(d}9nd}:z|"|#j|8jj|:};W n4 tyt } z| | |d5W Y d }~n
d }~0 0 z|?| |8jt	j@|;|9}<W n4 ty } z| | |dPW Y d }~n
d }~0 0 | jdQ | j#|;|8jj|<dR |dkrjz&t	4 }7|8jj|7_|A| |7t	j@}6W n4 tyJ } z| | |dSW Y d }~n
d }~0 0 | jdJ | j#|6|8jjd7 d S z&t	4 }7|8jj|7_|A| |7t	j@}=W n4 ty } z| | |dSW Y d }~n
d }~0 0 | jdT | j#|=|8jjd7 |sd S g }>|>,|=jB t	C }?t|>|?_D|>|?_B|rt-|?jBD ]V\}2}@|@jEt	jFkrDq*|?jB|2 jGdkrZq*d|?jB|2 _H|?jB|2  jGt	jI M  _Gq*t-|?jBD ]n\}2}@|@jEt	j@krq|?jB|2 jGdkrqd|?jB|2 _H|?jB|2  jGt	jJ M  _G|?jB|2  jGt	jK M  _Gq|D ]}Ad }3t-|?jBD ]@\}2}@|@jEt	jFkr,q|@jLj |A krFq|2}3 qTq|3d u rjt dU|A |?jB|3 jGt	jI@ st dV|A d|?jB|3 _H|?jB|3  jGt	jI M  _Gq |D ]}Ad }3t-|?jBD ]@\}2}@|@jEt	jFkrq|@jLj |A krq|2}3 q
q|3d u r t dW|A |?jB|3 jGt	jM@ r@t dX|A d|?jB|3 _H|?jB|3  jGt	jI M  _G|?jB|3  jGt	jMO  _Gq|	D ]N}Bd }3t-|?jBD ]@\}2}@|@jEt	jNkrq|@jLj |B krʐq|2}3 qؐq|3d urt dY|B dZ|B  }Cd }3t-|?jBD ]\\}2}@|@jEt	jFkr"qdZ|@jLj  }D|C|DkrHt d[|B |CO|DsXq|2}3 qfq|3d u r|t d\|B t	P }@t	jN|@_Ed|@_Gd|@_H|B|@jL_g }>|>,|?jB |>Q|3dO |@ t|>|?_D|>|?_Bq|
D ]}Bd }3t-|?jBD ]@\}2}@|@jEt	jNkrq|@jLj |B krq|2}3 q,q|3d u rBt d]|B g }>|>,|?jB |>.|3 t|>|?_D|>|?_Bq|D ]}Ed }3t-|?jBD ]B\}2}@|@jEt	j@krq|@jLjRj |E krq|2}3 qʐq|3d u rt d^|E |?jB|3 jGt	jJ@ s t d_|E d|?jB|3 _H|?jB|3  jGt	jJ M  _Gqt|D ]}Ed }3t-|?jBD ]B\}2}@|@jEt	j@krXq>|@jLjRj |E krtq>|2}3 qq>|3d u rt d`|E |?jB|3 jGt	jS@ rt da|E d|?jB|3 _H|?jB|3  jGt	jJ M  _G|?jB|3  jGt	jSO  _Gq,|D ]}d }3t-|?jBD ]8\}2}@|@jEt	j@kr&q|@jLjT|kr8q|2}3 qFq|3d u r\t db| |?jB|3 jGt	jK@ s|t dc|E d|?jB|3 _H|?jB|3  jGt	jK M  _Gq|D ]}d }3t-|?jBD ]8\}2}@|@jEt	j@krԐq|@jLjT|krq|2}3 qq|3d u r
t dd| |?jB|3 jGt	jU@ r*t de|E d|?jB|3 _H|?jB|3  jGt	jK M  _G|?jB|3  jGt	jUO  _Gqz|?| |8jt	j@|?d}FW n4 ty } z| | |dPW Y d }~n
d }~0 0 | jdf | j#|?|8jj|FdR z&t	4 }7|8jj|7_|A| |7t	j@}6W n4 ty2 } z| | |dSW Y d }~n
d }~0 0 | jdJ | j#|6|8jjd7 d S )gNFr{  z'--refresh=%s not allowed without DOMAINz'--enable-all not allowed without DOMAINr   z'--enable-tln not allowed without DOMAINz(--disable-tln not allowed without DOMAINz'--add-tln-ex not allowed without DOMAINz*--delete-tln-ex not allowed without DOMAINz&--enable-nb not allowed without DOMAINz'--disable-nb not allowed without DOMAINz'--enable-sid not allowed without DOMAINz(--disable-sid not allowed without DOMAINz*.zEvalue[%s] specified for --add-upn-suffix should not include with '*.'TzHvalue[%s] specified for --delete-upn-suffix should not include with '*.'z@value[%s] specified for --add-upn-suffix and --delete-upn-suffixzEvalue[%s] specified for --add-spn-suffix should not include with '*.'zHvalue[%s] specified for --delete-spn-suffix should not include with '*.'z@value[%s] specified for --add-spn-suffix and --delete-spn-suffixz1--add-upn-suffix not allowed together with DOMAINz4--delete-upn-suffix not allowed together with DOMAINz1--add-spn-suffix not allowed together with DOMAINz4--delete-spn-suffix not allowed together with DOMAINz3--enable-all not allowed together with --refresh=%sz0--enable-tln not allowed together with --refreshz1--disable-tln not allowed together with --refreshz0--add-tln-ex not allowed together with --refreshz3--delete-tln-ex not allowed together with --refreshz/--enable-nb not allowed together with --refreshz0--disable-nb not allowed together with --refreshz0--enable-sid not allowed together with --refreshz1--disable-sid not allowed together with --refreshz3--enable-tln not allowed together with --enable-allz2--enable-nb not allowed together with --enable-allz3--enable-sid not allowed together with --enable-allz6value[%s] specified for --enable-tln and --disable-tlnzAvalue[%s] specified for --add-tln-ex should not include with '*.'zDvalue[%s] specified for --delete-tln-ex should not include with '*.'z8value[%s] specified for --add-tln-ex and --delete-tln-exz4value[%s] specified for --enable-nb and --disable-nbz7value[%s] specified for --enable-sid is not a valid SIDz8value[%s] specified for --disable-sid is not a valid SIDz6value[%s] specified for --enable-sid and --disable-sidr  r  r  r  r8  z1The local domain [%s] is not the forest root [%s]z@LOCAL_DC[%s]: netr_DsRGetForestTrustInformation() not supported.rI  z Own forest trust information...
r
  zfailed to connect to SamDBr[  ZuPNSuffixeszmsDS-SPNSuffixesz(objectClass=crossRefContainer)r9  zfailed to search partition dnz#Stored uPNSuffixes attributes[%d]:
zTLN: %-32s DNS[*.%s]
rj   z(Stored msDS-SPNSuffixes attributes[%d]:
zBEntry already present for value[%s] specified for --add-upn-suffixz?Entry not found for value[%s] specified for --delete-upn-suffixzBEntry already present for value[%s] specified for --add-spn-suffixz?Entry not found for value[%s] specified for --delete-spn-suffixz#Update uPNSuffixes attributes[%d]:
z(Update msDS-SPNSuffixes attributes[%d]:
zfailed to update partition dnz#Stored forest trust information...
r	  rv  rw  zItrusted domain object for domain [%s] is not marked as FOREST_TRANSITIVE.r   rJ  z"Fresh forest trust information...
rK  z(lsaRQueryForestTrustInformation() failedz"Local forest trust information...
z8Entry not found for value[%s] specified for --enable-tlnzGEntry found for value[%s] specified for --enable-tln is already enabledz9Entry not found for value[%s] specified for --disable-tlnzIEntry found for value[%s] specified for --disable-tln is already disabledz>Entry already present for value[%s] specified for --add-tln-exz.%sz:TLN entry present for value[%s] specified for --add-tln-exz>No TLN parent present for value[%s] specified for --add-tln-exz;Entry not found for value[%s] specified for --delete-tln-exz7Entry not found for value[%s] specified for --enable-nbzFEntry found for value[%s] specified for --enable-nb is already enabledz7Entry not found for value[%s] specified for --delete-nbzHEntry found for value[%s] specified for --disable-nb is already disabledz8Entry not found for value[%s] specified for --enable-sidzGEntry found for value[%s] specified for --enable-sid is already enabledz8Entry not found for value[%s] specified for --delete-sidzIEntry found for value[%s] specified for --disable-sid is already disabledz$Updated forest trust information...
)Vr   r   r  r   r   r   r   	TypeErrorrc  r   r  rR  r  r  r   r  r  r   r   r   rE   r   r+  r  r  r   Zforest_namerU  r  r  r   r  r  ZWERR_INVALID_FUNCTIONZWERR_NERR_ACFNOTLOADEDr  r  r   rA  r@  rB  ra  rP  r  r  r  poprE  rD  rF  rG  rH  r  r  rs  r   r   r  r#  r  r  r   rV  rW  r  r  r  r  r  rH   r  r  timeZLSA_TLN_DISABLED_MASKZLSA_NB_DISABLED_MASKZLSA_SID_DISABLED_MASKr  r  r  endswithZForestTrustRecordinsertr  r  r  r  )Gr   r   r   r  r   r|  r}  r~  r  r  r  r  r  r  r  r  r  r  r  Zrequire_updatenr  r  r
  Z
enable_sidrV  r+  r  Zdisable_sidr  r  r  r  r  r  rc  Zown_forest_infoZlocal_samdbZlocal_partitions_dnr8  re  Z
stored_msgZstored_upn_valsZstored_spn_valsr  Zreplace_upnZupdate_upn_valsZreplace_spnZupdate_spn_valsZupnrU  idxZspnZ
update_msgZstored_forest_infor  r  Zlsa_update_checkZnetlogon_update_tdoZfresh_forest_infoZfresh_forest_collisionrg  r  Zupdate_forest_infor  r  Ztln_exZtln_dotZr_dotZnbZupdate_forest_collisionr{   r{   r|   r   ^  s   



""

$$
$$$$$













$$$
$$
$$

$
$

























$
$zcmd_domain_trust_namespaces.run)r   r   r   r   r   r   r   r   r  r   r   r   r   r   r{   r{   r{   r|   rz    s   <rz  c                   @   sb   e Zd ZdZdZedddeddded	d
ededdedgZdgZ	e
je
je
jdZdd ZdS )cmd_domain_tombstones_expungezZExpunge tombstones from the database.

This command expunges tombstones from the database.z%prog NC [NC [...]] [options]r-  r.  r/  r0  r1  r2  z--current-timezQThe current time to evaluate the tombstone lifetime from, expressed as YYYY-MM-DDrX   z--tombstone-lifetimez2Number of days a tombstone should be preserved forznc*r   c              
   O   s^  | d}| d}| d}| d}| d}| }||}	t|t |	|d}
|d urzt|d}tt|}ntt }t	|dkr|
j
d	d	tjd
gd}g }|d d
 D ]}|t| qnt|}d}z$|
  d}|
j|||d\}}W n> ty< } z$|r|
  td|W Y d }~n
d }~0 0 |
  | jd||f  d S )Nr   r   r1  current_timetombstone_lifetimer5  z%Y-%m-%dr   rj   ZnamingContexts)r7  r:  r;  r8  FT)r  r  z.Failed to expunge / garbage collect tombstonesz-Removed %d objects and %d links successfully
)r   r   r&  r   r   r  strptimer   mktimer   r@  rB  ra  rc  r   listtransaction_startZgarbage_collect_tombstonesr   transaction_cancelr   transaction_commitr   r   )r   Zncskwargsr   r   r1  Zcurrent_time_stringr  r   r"  rQ  Zcurrent_time_objr  r   rT  Zstarted_transactionZremoved_objectsZremoved_linksry   r{   r{   r|   r     sR    





 z!cmd_domain_tombstones_expunge.runN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r{   r{   r{   r|   r    s"   
	r  c                   @   sP   e Zd ZdZi Ze ed< e ed< e ed< e ed< e	 ed< e
 ed< dS )	cmd_domain_trustz#Domain and forest trust management.r  r]  ZcreaterO  r.  Z
namespacesN)r   r   r   r   r  r  r  r  rq  rt  rz  r{   r{   r{   r|   r  F  s   




r  c                   @   s   e Zd ZdZi Ze ed< dS )cmd_domain_tombstonesz0Domain tombstone and recycled object management.ZexpungeN)r   r   r   r   r  r  r{   r{   r{   r|   r  R  s   r  c                   @   s(   e Zd ZdZdd Zdd Zdd ZdS )	ldif_schema_updatez-Helper class for applying LDIF schema updatesc                 C   s   d| _ d | _d | _d| _d S )NFrj   )
is_defunctunknown_oidrD  ldifr  r{   r{   r|   r  \  s    zldif_schema_update.__init__c                 C   sR   |j \}}|tjkr,| jr,td| j  dS | jdurNtd| j| jf  dS dS )z>Checks if we can safely ignore failure to apply an LDIF updatez)Defunct object %s doesn't exist, skippingTNz%Skipping unknown OID %s for object %sF)rJ  rB  ZERR_NO_SUCH_OBJECTr  r   rD  r  )r   r  Znumr  r{   r{   r|   can_ignore_failureb  s    

z%ldif_schema_update.can_ignore_failurec              
   C   s   zpz|j | jdgd W nT tjyl } z:|jd tjkrV|  |j | jdgd n W Y d}~n
d}~0 0 W nj tjy } zP| |rW Y d}~dS td|  td td td| j   W Y d}~n
d}~0 0 d	S )
z*Applies a single LDIF update to the schemazrelax:0)r<  r   NException: %sz4Encountered while trying to apply the following LDIFz4----------------------------------------------------rH  r   )	Zmodify_ldifr  rB  rP  rJ  ZERR_INVALID_ATTRIBUTE_SYNTAXZset_schema_update_nowr  r   )r   rQ  r
  r{   r{   r|   applyp  s"    
zldif_schema_update.applyN)r   r   r   r   r  r  r  r{   r{   r{   r|   r  Y  s   r  c                   @   s   e Zd ZdZdZejejejdZ	e
dddeddd	e
d
dddde
ddddde
dddddgddde
deddde
dedddgZdd  Zd!d" Zd#d$ ZdS )%cmd_domain_schema_upgradezDomain schema upgradingr   r  r-  r.  r/  r0  r1  r2  rS   rT   rU   rK   rV   ra   rb   rc   z--schemarN   ZSCHEMArC   rD   <The schema file to upgrade to. Default is (Windows) 2012_R2.r_   z
--ldf-fileNzBJust apply the schema updates in the adprep/.LDF file(s) specified)rH   r`   rJ   z
--base-dirz4Location of ldf files Default is ${SETUPDIR}/adprep.c                 C   s  d}t  }|D ]}| }|dkrF|jdkr0q|||7 }t  }q| drt|dtd  t|  }n,| dr|dtd  t|  }|	d}|d 
 dkr|d  |_|d 
 d	kr|
 d
d}|
 dd}|d 
 dv rt|\}}d|v rt|j| d||f dgd}	t|	dkrP||_n$t|	d d d }
||d|
 }|d 
 dkr|d  
 dkrd|_|d 
 dkr|d  
 dkrd}| j|d 7  _q|S )z
        Applies a series of updates specified in an .LDIF file. The .LDIF file
        is based on the adprep Schema updates provided by Microsoft.
        r   rj   zDC=XNzCN=X:rD  r   Z
changetypez: ntdsschemaaddz: addz: ntdsschemamodifyz: modify)ZrdnattidZ
subclassofZsystemposssuperiorsZsystemmaycontainZsystemauxiliaryclassr   z!(|(attributeId=%s)(governsId=%s))ZldapDisplayNamer=  r   Z	isdefuncttrueTaddZshowinadvancedviewonlyzreplace: showInAdvancedViewOnlyr   )r  r   r  r  r   r  r   r   Zget_default_basednrs   r   rt   rD  ry  r@  rI  r  r  )r   rQ  	ldif_filer  Zldif_opr  values_r  r   Zdisplay_namer{   r{   r|   _apply_updates_in_file  sV    

 




((z0cmd_domain_schema_upgrade._apply_updates_in_filec                 C   s^   t d|  d}z.ttj||}| ||}W |rN|  n|rL|  0 t d|  |S )zBWrapper function for parsing an LDIF file and applying the updateszApplying %s updates...Nz%u changes applied)r   rk   rl   r   rd  r  rr   )r   rQ  update_filebase_dirr  r  r{   r{   r|   _apply_update  s    

z'cmd_domain_schema_upgrade._apply_updatec           !   
   K   s  zddl m} W n< tyL } z$| jd|  tdW Y d }~n
d }~0 0 ddlm} d}|d}|d}|	 }|
|}	|d	}
|d
}|d}|d}d }t|
t |	|d}|dd u r|dd td d}t|| }t|t| d
}||krtd|r2|d}ng }||}|j| tjdgd}t|dkrntdt|d d d d }td}|d u r t }td}z||| W nD ty } z*td|  t | tdW Y d }~n
d }~0 0 |}t!||d D ]}d| }|"| t#j$%t#j$&||d }|rt#j$'|rz"t(j)d|d|gt(j*t(j*|d }W n* t+t,fy   t | td!Y n0 |- \}}|j.rtd"||f  t | tdtd#||f  q|d u rtd$}|/  d}d}zN|D ]} || 0|| |7 }q|dkrH|1  td% ntd& |2  W nF ty } z,td'|  td( |2  d}W Y d }~n
d }~0 0 |r|dd) |rt | |rtdd S )*Nr   )read_ms_markdownz#Exception in importing markdown: %sz Failed to import module markdown)SchemaFr   r   r1  schemaZldf_filer  r5  dsdb:schema update allowedr   ;Temporarily overriding 'dsdb:schema update allowed' settingT%This server is not the schema master.r  ZobjectVersion)r:  r;  r8  r   z*Could not determine current schema versionzadprep/WindowsServerDocsz*adprep/WindowsServerDocs/Schema-Updates.mdz!Exception in markdown parsing: %szFailed to upgrade schemaz	Sch%d.ldfz.diffZpatchz-i)rg   rh   cwdz8Failed to upgrade schema. Check if 'patch' is installed.zException in patch: %s
%szPatched %s using %sZadprepzSchema successfully updatedzNo changes applied to schemar  z*Error encountered, aborting schema upgrader   )3Zsamba.ms_schema_markdownr  ImportErrorr   r   r   Zsamba.schemar  r   r   r&  r   r   r  r   rB  rM  get_dsServiceNamer   r   rI  rs   Zget_versionr@  ra  r   r   r9   r   Zmkdtempr   shutilZrmtreer>  rc  rl   r   r   rd  r  rn   ro   rp   OSErrorIOErrorrq   
returncoder  r  r  r  )!r   r  r  r
  r  updates_allowed_overriddenr   r   r   r"  r1  Ztarget_schemaZ	ldf_filesr  Ztemp_folderrQ  own_dnmasterZschema_updatesr   r   startZdiff_dirr  versionupdateZdiffrw   rg   rh   r  error_encounteredr  r{   r{   r|   r     s    



















zcmd_domain_schema_upgrade.run)r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r   r{   r{   r{   r|   r    s4   
Sr  c                   @   s   e Zd ZdZdZejejejdZ	e
dddeddd	e
d
dddde
ddddde
dddg dddde
dddde
ddddgZdd Zd S )!cmd_domain_functional_prepz#Domain functional level preparationr   r  r-  r.  r/  r0  r1  r2  rS   rT   rU   rK   rV   ra   rb   rc   r   rN   ZFUNCTION_LEVELrA   r  rD   r_   z--forest-prepzJRun the forest prep (by default, both the domain and forest prep are run).rL   z--domain-prepzJRun the domain prep (by default, both the domain and forest prep are run).c              
   K   sP  d}| d}| d}| }||}| d}t| d }| d}	| d}
t|t ||d}| d	d u r|d	d
 td d}|	d u r|
d u rd}	d}
t	||
 }|	rt|t| d}||krtd|
r| }d| }t||d}||krtd|	r|  d}zBddlm} ||dd}|g d |j|tdd |  W n> ty } z$td|  |  d}W Y d }~n
d }~0 0 |
r,|  d}z4ddlm} ||dd}|j|tdd |  W n> ty* } z$td|  |  d}W Y d }~n
d }~0 0 |r>|d	d |rLtdd S )NFr   r   r1  r  forest_prepdomain_prepr5  r  r   r  Tr  r  zCN=Infrastructure,Zinfrastructurez-This server is not the infrastructure master.r   )ForestUpdate)Zfix)5   O   P   Q   R   S   )Zupdate_revisionr  )DomainUpdater   z!Failed to perform functional prep)r   r   r&  string_version_to_constantr   r   r  r   rB  rM  r  r   r   rI  r   rK  r  Zsamba.forest_updater  Zcheck_updates_iteratorZcheck_updates_functional_levelr-   r  r   r  Zsamba.domain_updater  r,   )r   r  r  r   r   r   r"  r1  Ztarget_levelr  r  rQ  r  r  rK  Zinfrastructure_dnr  r  r   r
  r  r   r{   r{   r|   r     s    






zcmd_domain_functional_prep.runNry  r{   r{   r{   r|   r    s0   
r  c                   @   s   e Zd ZdZi Ze ed< edur,e ed< e ed< e ed< e	 ed< e
 ed< e ed	< e ed
< e ed< e ed< e ed< e ed< e ed< e ed< e ed< dS )
cmd_domainzDomain management.ZdemoteNZexportkeytabr   r6   rd  ZdcpromolevelZpasswordsettingsZclassicupgradeZsamba3upgradeZtrustZ
tombstonesZschemaupgradeZfunctionalprepZbackup)r   r   r   r   r  r,  r~   r   r   r*  r  rX  r  r  r  r  r  r  r  r>   r{   r{   r{   r|   r    s$   













r  )Z
__future__r   r   Zsamba.getoptZgetoptr   rB  rl   r   r  r?  r   Zloggingrn   r  r  r   r   r   r   r   Z	samba.netr	   r
   Zsamba.ntaclsZ
samba.joinr   r   Z
samba.authr   Zsamba.samdbr   r   Z	samba.ndrr   r   Zsamba.dcerpcr   r   r   r   r   r   r   Zsamba.dcerpc.samrr   r   Zsamba.netcmdr   r   r   r   Zsamba.netcmd.fsmor   Zsamba.netcmd.commonr    Zsamba.samba3r!   r"   r  Zsamba.upgrader#   Zsamba.drs_utilsr$   r%   r&   r'   Zsamba.auth_utilr(   Z
samba.dsdbr)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   Zsamba.provisionr6   r7   r8   r9   Zsamba.provision.commonr:   r;   r<   Zsamba.netcmd.psor=   Zsamba.netcmd.domain_backupr>   Zsamba.compatr?   r@   r  r   r  r)  r  r}   Zsamba.dckeytabr  r~   r   r   r  r*  r,  rX  r   ri  rl  rm  rn  rz  r  r  r  r   r  r  r  r  r  rq  rt  rz  r  r  r  r  r  r  r  r{   r{   r{   r|   <module>   s   <
  J;H  * l@ Q	 
	   /k    ( " 4     oG8 ~j