a
    Wa                     @   s  d dl mZ d dlZd dlmZ d dlZd dlZd dlm	  m
Z d dlZd dlZd dlmZ d dlmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlZd dlZd d	lmZmZm Z  d d
l!m"Z" d dlm#Z# d dl$m%Z& d dl$m'Z( d dlm)Z) d dl*Z*d dl+m,Z, d dlm-Z- d dl.m/Z/ d dl0m1Z1m2Z2m3Z3 d dl4m5Z5 d dl6m7Z7m8Z8m9Z9m:Z: d dl;m<Z< d dl=m>Z> d dl?m@Z@ d dlm%Z% dd ZAdd ZBdd ZCdd ZDd d! ZEd_d"d#ZFd$d% ZGdddejHejIB ejJB ejKB fd&d'ZLd(d) ZMd*d+ ZNd,d- ZOejPfd.d/ZQd0d1 ZRe(jSe(jTB e(jUB e(jVB ZWd2d3 ZXd`d5d6ZYd7d8 ZZdad9d:Z[G d;d< d<eZ\G d=d> d>e\Z]G d?d@ d@e\Z^G dAdB dBe\Z_G dCdD dDe\Z`G dEdF dFe\ZaG dGdH dHe\ZbG dIdJ dJe\ZcG dKdL dLe\ZdG dMdN dNe\ZeG dOdP dPe\ZfG dQdR dRe\ZgG dSdT dTe\ZhG dUdV dVehZiG dWdX dXe\ZjG dYdZ dZe\ZkG d[d\ d\eZlG d]d^ d^eZmdS )b    )print_functionN)system_session)CommandCommandErrorOptionSuperCommand)SamDB)dsdb)security)
ndr_unpack) AUTH_SESSION_INFO_DEFAULT_GROUPSAUTH_SESSION_INFO_AUTHENTICATED#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)netcmd_finddc)policy)param)libsmb_samba_internal)NTSTATUSError)dsacl2fsacl)nbt)Net)GPParserGPNoParserExceptionGPGeneralizeException)GPPolParser)GPIniParserGPTIniParserGPFDeploy1IniParserGPScriptsIniParser)GPAuditCsvParser)GptTmplInfParser)GPAasParserc                 C   s   || v r| | d S |S )z/get an attribute from a ldap msg with a defaultr    )msgattrnamedefaultr"   r"   2/usr/lib/python3/dist-packages/samba/netcmd/gpo.pyattr_defaultC   s    r'   c                 C   s"   t | }|sd}n
d|}|S )zreturn gpo flags stringNONE )r   Zget_gpo_flagsjoin)valueflagsretr"   r"   r&   gpo_flags_stringJ   s
    

r.   c                 C   s"   t | }|sd}n
d|}|S )zreturn gplink options stringr(   r)   )r   Zget_gplink_optionsr*   )r+   optionsr-   r"   r"   r&   gplink_options_stringT   s
    

r0   c                 C   s   g }|   dkr|S | d}|D ]^}|s,q"|d}t|dksP|d ds\td| ||d dd	 t|d
 d q"|S )z.parse a gPLink into an array of dn and options ];   r   z[LDAP://zBadly formed gPLink '%s'   N   dnr/   )stripsplitlen
startswithRuntimeErrorappendint)Zgplinkr-   agdr"   r"   r&   parse_gplink^   s    

&rC   c                 C   s   d dd | D }|S )z4Encode an array of dn and options into gPLink stringr1   c                 s   s"   | ]}d |d |d f V  qdS )z[LDAP://%s;%d]r8   r/   Nr"   ).0rA   r"   r"   r&   	<genexpr>r       z encode_gplink.<locals>.<genexpr>)r*   )gplistr-   r"   r"   r&   encode_gplinkp   s    rH   c              
   C   sZ   |du rV|du rNzt | |}W n. tyL } ztd|W Y d}~n
d}~0 0 d| }|S )zjIf URL is not specified, return URL for writable DC.
    If dc is provided, use that to construct ldap URLNzCould not find a DC for domainldap://)r   	Exceptionr=   )lpcredsurldcer"   r"   r&   dc_urlv   s     rP   c                 C   s4   |   }|t| d |t| d|  |S )zConstruct the DN for gpoCN=Policies,CN=SystemzCN=%s)get_default_basedn	add_childldbDn)samdbgpor8   r"   r"   r&   
get_gpo_dn   s    rX   c              
   C   s   |   }|t| d |}d}tj}|dur>dt| }|durTdt| }|durf|}tj}z"| j|||g dd| gd}	W nD ty }
 z,|durd	| }nd
}t	||
W Y d}
~
n
d}
~
0 0 |	S )z0Get GPO information using gpo, displayname or dnrQ   z"(objectClass=groupPolicyContainer)Nz.(&(objectClass=groupPolicyContainer)(name=%s))z5(&(objectClass=groupPolicyContainer)(displayname=%s)))nTSecurityDescriptorversionNumberr,   namedisplayNamegPCFileSysPathgPCMachineExtensionNamesgPCUserExtensionNamessd_flags:1:%d)basescope
expressionattrscontrolsz!Cannot get information for GPO %szCannot get information for GPOs)
rR   rS   rT   rU   ZSCOPE_ONELEVELbinary_encode
SCOPE_BASEsearchrJ   r   )rV   rW   displaynamer8   sd_flagsZpolicies_dnZbase_dnsearch_exprZsearch_scoper#   rO   Zmesgr"   r"   r&   get_gpo_info   s0    

 rl   c              
   C   sT   d| }z| j |dgd}W n2 tyN } ztd| |W Y d}~n
d}~0 0 |S )z lists dn of containers for a GPOz(&(objectClass=*)(gPLink=*%s*))gPLink)rc   rd   z'Could not find container(s) with GPO %sN)rh   rJ   r   )rV   rW   rk   r#   rO   r"   r"   r&   get_gpo_containers   s    $rn   c              
   C   sZ  z| j |tjddgdd }W n2 tyP } ztd| |W Y d}~n
d}~0 0 d}tt| |}d|v rtt|d d }|D ]*}|d  | kr|	| d	} qqntd
|std| t
 }	||	_|rt|}
t|
tjd|	d< nt|d d tjd|	d< z| |	 W n0 tyT } ztd|W Y d}~n
d}~0 0 dS )z!delete GPO link for the container(objectClass=*)rm   ra   rb   rc   rd   r   Container '%s' does not existNFr8   Tz"No GPO(s) linked to this containerz%GPO '%s' not linked to this containerZr0Zd0z!Error removing GPO from container)rh   rT   rg   rJ   r   strrX   rC   lowerremoveMessager8   rH   MessageElementFLAG_MOD_REPLACEZFLAG_MOD_DELETEmodify)rV   container_dnrW   r#   rO   foundgpo_dnrG   rA   m
gplink_strr"   r"   r&   del_gpo_link   s>    
$
r~   c                 C   s^   g }|  dr$| dd dd}n|  drB| dd dd}t|dkrZtd|  |S )	z;Parse UNC string into a hostname, a service, and a filepathz\\r4   N\z///   zInvalid UNC string: %s)r<   r:   r;   
ValueError)unctmpr"   r"   r&   	parse_unc   s    

r   c                 C   s   t jd| |drt S t jd| |dr,t S t jd| |drBt S t jd| |drXt S t jd| |drnt S t jd| |drt S t jd| |drt S t jd	| |drt S t jd
| |drt	 S t jd| |drt
 S t S )Nzfdeploy1\.ini$r,   zaudit\.csv$zGptTmpl\.inf$z	GPT\.INI$zscripts\.ini$zpsscripts\.ini$z	GPE\.INI$z.*\.ini$z.*\.pol$z.*\.aas$)rematchr   r   r    r   r   r   r   r   r!   )r[   r,   r"   r"   r&   find_parser   s*    r   c              	   C   s   d}t j|st | |g}|g}|r| }| }| j|td}|jdd d |D ]}	|d |	d  }
t j||	d }|	d t	j
@ r||
 || t | q^| |
}t|| d	}|| W d    n1 s0    Y  t|	d }|| ||d
  q^q&d S )N.SAMBABACKUPZattribsc                 S   s   | d S Nr[   r"   xr"   r"   r&   <lambda>#  rF   z2backup_directory_remote_to_local.<locals>.<lambda>keyr   r[   attribwb.xml)ospathisdirmkdirpoplist
attr_flagssortr*   libsmbFILE_ATTRIBUTE_DIRECTORYr>   loadfileopenwriter   parseZ	write_xml)conn	remotedirlocaldirSUFFIXr_dirsl_dirsr_dirl_dirdirlistrO   r_namel_namedatafparserr"   r"   r&    backup_directory_remote_to_local  s.    



(
r   c                 C   s   t j|st | |g}|g}|r| }| }| j|td}|jdd d |D ]n}|d |d  }	t j||d }
|d t	j
@ r||	 ||
 t |
 qX| |	}t|
d| qXq"d S )	Nr   c                 S   s   | d S r   r"   r   r"   r"   r&   r   F  rF   z0copy_directory_remote_to_local.<locals>.<lambda>r   r   r[   r   r   )r   r   r   r   r   r   r   r   r*   r   r   r>   r   r   r   )r   r   r   r   r   r   r   r   rO   r   r   r   r"   r"   r&   copy_directory_remote_to_local<  s$    



r   Fc              	   C   s   |  |s| | |g}|g}|r| }| }t|}	|	  |	D ]}
tj||
}|d |
 }tj|r|	| |	| z| | W q t
y   |s Y q0 qJ|rz| | W qJW n t
y   Y n0 t|d }| || qJq d S )Nr   rb)chkpathr   r   r   listdirr   r   r*   r   r>   r   r   r   readsavefile)r   r   r   ignore_existing_dirkeep_existing_filesr   r   r   r   r   rO   r   r   r   r"   r"   r&   copy_directory_local_to_remoteT  s8    






r   c                 C   sD   | ddd}d}|D ]$}|d | }| |s| | qd S )Nr   r   r1   )replacer:   r   r   )r   r   Zelemsr   rO   r"   r"   r&   create_directory_hiery  s    
r   c                 C   sP   z,t  }||j tj| ||||d}W n tyJ   td|  Y n0 |S )NrK   rL   signz"Error connecting to '%s' using SMB)s3paramZget_contextloadZ
configfiler   ZConnrJ   r   )dc_hostnameservicerK   rL   r   Zs3_lpr   r"   r"   r&   smb_connection  s    r   c                   @   s   e Zd Zdd Zdd ZdS )
GPOCommandc              
   C   s   |du r"t  }td| | jd tj|s:td| tj|d}tj|s^t	| tj||}tj|rtd| zt	| W n2 t
tfy } ztd|W Y d}~n
d}~0 0 ||fS )a  Ensure that the temporary directory structure used in fetch,
        backup, create, and restore is consistent.

        If --tmpdir is used the named directory must be present, which may
        contain a 'policy' subdirectory, but 'policy' must not itself have
        a subdirectory with the gpo name. The policy and gpo directories
        will be created.

        If --tmpdir is not used, a temporary directory is securely created.
        Nz5Using temporary directory %s (use --tmpdir to change))filez'Temporary directory '%s' does not existr   z8GPO directory '%s' already exists, refusing to overwritez%Error creating teporary GPO directory)tempfileZmkdtempprintoutfr   r   r   r   r*   r   IOErrorOSError)selftmpdirrW   r   gpodirrO   r"   r"   r&   construct_tmpdir  s(    
 zGPOCommand.construct_tmpdirc              
   C   sX   zt | jt | j| jd| _W n4 tyR } ztd| j |W Y d}~n
d}~0 0 dS )z$make a ldap connection to the server)rM   Zsession_infoZcredentialsrK   zLDAP connection to %s failed N)r   rM   r   rL   rK   rV   rJ   r   )r   rO   r"   r"   r&   samdb_connect  s    zGPOCommand.samdb_connectN)__name__
__module____qualname__r   r   r"   r"   r"   r&   r     s   #r   c                   @   sF   e Zd ZdZdZejejejdZ	e
dddeddd	gZdddZd
S )cmd_listallzList all GPOs.%prog [options]	sambaoptsversionoptscredopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestNc              
   C   s   |  | _|j| jdd| _t| j| j|| _|   t| jd }|D ]}| j	
d|d d   | j	
d|d d   | j	
d|d	 d   | j	
d
|j  | j	
dt|dd  | j	
dttt|dd  | j	
d qFd S )NTZfallback_machineGPO          : %s
r[   r   display name : %s
r\   path         : %s
r]   dn           : %s
version      : %s
rZ   0flags        : %s
r,   
)get_loadparmrK   get_credentialsrL   rP   rM   r   rl   rV   r   r   r8   r'   r.   r?   )r   r   r   r   r   r#   r|   r"   r"   r&   run  s    
 zcmd_listall.run)NNNNr   r   r   __doc__synopsisr/   SambaOptionsVersionOptionsCredentialsOptionstakes_optiongroupsr   rr   takes_optionsr   r"   r"   r"   r&   r     s   
r   c                   @   sL   e Zd ZdZdZdgZejejej	dZ
edddedd	d
gZdddZdS )cmd_listzList GPOs for an account.z&%prog <username|machinename> [options]accountnamer   r   r   r   r   r   r   Nc              	   C   st  |  | _|j| jdd| _t| j| j|| _|   z0| jjdt	
|t	
|f d}|d j}W n ty   td| Y n0 z*| jj|t	jdgdd }d	|d v }W n ty   td
| Y n0 ttB }	| jd ur| jdr|	tO }	tjj| j| j||	d}
|
j}g }d}t	| jt| }| jj|t	jddgdd }d|v rtt|d d }|D ]p}|s|d tj@ sqp|d tj@ rqpzVtjtj B tj!B }| jj|d t	jg dd| gd}|d d d }t"tj#|}W n. ty(   | j$%d|d   Y qpY n0 z"tj&||tj'tj(B tj)B  W n, t*yx   | j$%d|j  Y qpY n0 t+t,|d dd}|r|tj-@ rqp|s|tj.@ rqp|/|d d d |d d d f qpt+t,|dd}|tj0@ rd}|| j1 krq$| }q2|r0d	}nd}| j$%d||f  |D ]"}| j$%d|d |d f  qLd S )NTr   z?(&(|(samAccountName=%s)(samAccountName=%s$))(objectClass=User)))rc   r   zFailed to find account %sobjectClass)ra   rb   rd   Zcomputerz!Failed to find objectClass for %sZldap)Zlp_ctxr8   session_info_flagsrm   	gPOptionsr/   r8   )r[   r\   r,   rY   r`   )ra   rb   rd   re   rY   z8Failed to fetch gpo object with nTSecurityDescriptor %s
zFailed access check on %s
r,   r\   r[   FuserzGPOs for %s %s
z
    %s %s
r6   )2r   rK   r   rL   rP   rM   r   rV   rh   rT   rf   r8   rJ   r   rg   r   r   r<   r   sambaZauthZuser_sessionZsecurity_tokenrU   rr   parentrC   r	   GPLINK_OPT_ENFORCEGPLINK_OPT_DISABLEr
   SECINFO_OWNERSECINFO_GROUPSECINFO_DACLr   
descriptorr   r   Zaccess_checkZSEC_STD_READ_CONTROLZSEC_ADS_LISTZSEC_ADS_READ_PROPr=   r?   r'   ZGPO_FLAG_MACHINE_DISABLEZGPO_FLAG_USER_DISABLEr>   GPO_BLOCK_INHERITANCErR   )r   r   r   r   r   r   r#   Zuser_dnZis_computerr   ZsessiontokenZgposinheritr8   ZglistrA   rj   Zgmsgsecdesc_ndrsecdescr,   Z	gpoptionsZmsg_strr"   r"   r&   r     s    



*zcmd_list.run)NNNN)r   r   r   r   r   
takes_argsr/   r   r   r   r   r   rr   r   r   r"   r"   r"   r&   r     s   r   c                   @   sF   e Zd ZdZdZejejejdZ	dgZ
eddedgZdd	d
ZdS )cmd_showzShow information for a GPO.%prog <gpo> [options]r   rW   r   r   r   r   Nc           
   	   C   sX  |  | _|j| jdd| _t| j| j|| _|   zt| j|d }W n t	yh   t
d| Y n0 z$|d d }ttj|}| }	W n t	y   d}	Y n0 | jd|d d   | jd	|d
 d   | jd|d d   | jd|j  | jdt|dd  | jdttt|dd  | jd|	  | jd d S )NTr   r   GPO '%s' does not existrY   z<hidden>r   r[   r   r\   r   r]   r   r   rZ   r   r   r,   zACL          : %s
r   )r   rK   r   rL   rP   rM   r   rl   rV   rJ   r   r   r
   r  as_sddlr   r   r8   r'   r.   r?   )
r   rW   r   r   r   r   r#   r  r	  Zsecdesc_sddlr"   r"   r&   r   f  s,    

 zcmd_show.run)NNNNr   r   r   r   r   r/   r   r   r   r   r
  r   rr   r   r   r"   r"   r"   r&   r  U  s   r  c                   @   sF   e Zd ZdZdZejejejdZ	dgZ
eddedgZdd	d
ZdS )cmd_getlinkzList GPO Links for a container.%prog <container_dn> [options]r   ry   r   r   r  Nc           	      C   s<  |  | _|j| jdd| _t| j| j|| _|   z | jj|t	j
ddgdd }W n tyt   td| Y n0 d|v r(|d r(| jd|  tt|d d }|D ]r}t| j|d	 d
}| jd|d d d   | jd|d d d   | jdt|d   | jd qn| jd|  d S )NTr   ro   rm   rp   r   rq   zGPO(s) linked to DN %s
r8   )r8   z    GPO     : %s
r[   z    Name    : %s
r\   z    Options : %s
r/   r   zNo GPO(s) linked to DN=%s
)r   rK   r   rL   rP   rM   r   rV   rh   rT   rg   rJ   r   r   r   rC   rr   rl   r0   )	r   ry   r   r   r   r   r#   rG   rA   r"   r"   r&   r     s.    
zcmd_getlink.run)NNNNr  r"   r"   r"   r&   r    s     r  c                	   @   sh   e Zd ZdZdZejejejdZ	ddgZ
eddeded	d
ddddeddddddgZdddZdS )cmd_setlinkz(Add or update a GPO link to a container.$%prog <container_dn> <gpo> [options]r   ry   rW   r   r   r  z	--disabledisabledF
store_truezDisable policy)r   r%   actionr   z	--enforceenforcedzEnforce policyNc	              
   C   s,  |  | _|j| jdd| _t| j| j|| _|   d}	|rH|	tjO }	|rV|	tj	O }	zt
| j|dd }
W n ty   td| Y n0 tt| j|}z | jj|tjddgdd }
W n ty   td	| Y n0 d
}d|
v rbtt|
d d }d}d
}|D ].}|d  | kr
|	|d< d} q:q
|rNtd| n|d||	d ng }|||	d t|}t }t| j||_|rt|tjd|d< nt|tjd|d< z| j| W n0 ty } ztd|W Y d }~n
d }~0 0 | j d t! "||||| d S )NTr   r   rW   r  ro   rm   rp   rq   Fr8   r/   z)GPO '%s' already linked to this containerr7   	new_valuezError adding GPO LinkzAdded/Updated GPO link
)#r   rK   r   rL   rP   rM   r   r	   r   r   rl   rV   rJ   r   rr   rX   rh   rT   rg   rC   rs   insertr>   rH   ru   rU   r8   rv   rw   FLAG_MOD_ADDrx   r   r   r  r   )r   ry   rW   r   r  r  r   r   r   Zgplink_optionsr#   r{   Zexisting_gplinkrG   rz   rA   r}   r|   rO   r"   r"   r&   r     sd    




 zcmd_setlink.run)NFFNNNr  r"   r"   r"   r&   r    s$   

  r  c                   @   sH   e Zd ZdZdZejejejdZ	ddgZ
eddedgZdd
dZd	S )cmd_dellinkz!Delete GPO link from a container.r  r   	containerrW   r   r   r  Nc                 C   s   |  | _|j| jdd| _t| j| j|| _|   zt| j|dd  W n t	yj   t
d| Y n0 t| j|}t| j|| | jd t ||||| d S )NTr   r  r   r  zDeleted GPO link.
)r   rK   r   rL   rP   rM   r   rl   rV   rJ   r   rT   rU   r~   r   r   r  r   )r   r  rW   r   r   r   r   ry   r"   r"   r&   r     s    
zcmd_dellink.run)NNNNr  r"   r"   r"   r&   r    s     r  c                   @   sF   e Zd ZdZdZejejejdZ	dgZ
eddedgZdd	d
ZdS )cmd_listcontainersz%List all linked containers for a GPO.r  r   rW   r   r   r  Nc                 C   s   |  | _|j| jdd| _t| j| j|| _|   t| j|}t	|rz| j
d|  |D ]}| j
d|d   q^n| j
d|  d S )NTr   zContainer(s) using GPO %s
z    DN: %s
r8   zNo Containers using GPO %s
)r   rK   r   rL   rP   rM   r   rn   rV   r;   r   r   )r   rW   r   r   r   r   r#   r|   r"   r"   r&   r   F  s    
zcmd_listcontainers.run)NNNNr  r"   r"   r"   r&   r  5  s     r  c                   @   sF   e Zd ZdZdZejejejdZ	dgZ
eddedgZdd	d
ZdS )cmd_getinheritancez%Get inheritance flag for a container.r  r   ry   r   r   r  Nc                 C   s   |  | _|j| jdd| _t| j| j|| _|   z | jj|t	j
ddgdd }W n tyt   td| Y n0 d}d|v rt|d d }|tjkr| jd n| jd	 d S )
NTr   ro   r   rp   r   rq   z$Container has GPO_BLOCK_INHERITANCE
zContainer has GPO_INHERIT
)r   rK   r   rL   rP   rM   r   rV   rh   rT   rg   rJ   r   r?   r	   r  r   r   )r   ry   r   r   r   r   r#   inheritancer"   r"   r&   r   j  s&    

zcmd_getinheritance.run)NNNNr  r"   r"   r"   r&   r   Y  s     r   c                   @   sH   e Zd ZdZdZejejejdZ	ddgZ
eddedgZdd
dZd	S )cmd_setinheritancez$Set inheritance flag on a container.z.%prog <container_dn> <block|inherit> [options]r   ry   inherit_stater   r   r  Nc              
   C   sF  |  dkrtj}n |  dkr(tj}ntd| | | _|j| jdd| _t	| j| j|| _
|   z | jj|tjddgdd	 }W n ty   td
| Y n0 t }	t| j||	_d|v rtt|tjd|	d< ntt|tjd|	d< z| j|	 W n4 ty@ }
 ztd| |
W Y d }
~
n
d }
~
0 0 d S )Nblockr  zUnknown inheritance state (%s)Tr   ro   r   rp   r   rq   r  z"Error setting inheritance state %s)rs   r	   r  ZGPO_INHERITr   r   rK   r   rL   rP   rM   r   rV   rh   rT   rg   rJ   ru   rU   r8   rv   rr   rw   r  rx   )r   ry   r#  r   r   r   r   r!  r#   r|   rO   r"   r"   r&   r     s6    
zcmd_setinheritance.run)NNNNr  r"   r"   r"   r&   r"    s     r"  c                   @   sR   e Zd ZdZdZejejejdZ	dgZ
eddededd	edgZdddZd
S )	cmd_fetchzDownload a GPO.r  r   rW   r   r   r  --tmpdir,Temporary directory for copying policy filesNc              
   C   sZ  |  | _|j| jdd| _|r>|dr>|dd  }|| _n"t| j| j}t| j| j|d| _|   zt	| j
|d }W n ty   td| Y n0 t|d d }	zt|	\}
}}W n ty   td	|	 Y n0 t||| j| jdd
}| ||\}}zt||| W n0 tyD } ztd|W Y d }~n
d }~0 0 | jd|  d S )NTr   rI      rN   r   r  r]   Invalid GPO path (%s)r   Error copying GPO from DCGPO copied to %s
)r   rK   r   rL   r<   rM   r   rP   r   rl   rV   rJ   r   rr   r   r   r   r   r   r   r   )r   rW   r   r   r   r   r   r   r#   r   dom_namer   	sharepathr   r   rO   r"   r"   r&   r     s4    

 zcmd_fetch.run)NNNNNr  r"   r"   r"   r&   r%    s   r%  c                	   @   sz   e Zd ZdZdZejejejdZ	dgZ
eddededd	eded
ddddedddedgZdddZedd ZdS )
cmd_backupzBackup a GPO.r  r   rW   r   r   r  r&  r'  z--generalizez"Generalize XML entities to restoreFr  r   r%   r  
--entitiesz4File to export defining XML entities for the restoreent_file)r   r   r   Nc	              
   C   sp  |  | _|j| jdd| _|r>|dr>|dd  }	|| _n"t| j| j}	t| j| j|	d| _|   zt	| j
|d }
W n ty   td| Y n0 t|
d d }zt|\}}}W n ty   td	| Y n0 t|	|| j| jd
}| ||\}}zt||| W n0 tyB } ztd|W Y d }~n
d }~0 0 | jd|  |r
| jd t| j||}dd l}ddd t| |ddD }|rt|d}|| W d    n1 s0    Y  | jd|  n| jd | j| dD ]\}||
v rttj||d d"}||
| d  W d    n1 s^0    Y  qd S )NTr   rI   r(  r)  r   r  r]   r*  rK   rL   r+  r,  z(
Attempting to generalize XML entities:
r1   c                 s   s(   | ] }d  |d d|d V  qdS )z<!ENTITY {} "{}
">r6   z&;r   N)formatr9   )rD   Zentr"   r"   r&   rE   ;  s   z!cmd_backup.run.<locals>.<genexpr>r6   r   wz$Entities successfully written to %s
z
Entities:
r^   r_   	.SAMBAEXTr   )r   rK   r   rL   r<   rM   r   rP   r   rl   rV   rJ   r   rr   r   r   r   r   r   r   r   r/  generalize_xml_entitiesoperatorr*   sorteditems
itemgetterr   r   r   )r   rW   r   r   Z
generalizer   r   r   r2  r   r#   r   r-  r   r.  r   r   rO   entitiesr9  Zentsr   extr"   r"   r&   r     s^    

 

*
zcmd_backup.runc              	   C   sj  i }t j|st | |g}|g}|rf| }| }t |}|  |D ]}	t j||	}
t j||	}t j|
r|	|
 |	| t j|st | qR|

drHt j|
d d }t|}zNt|
d}| }W d    n1 s0    Y  t|}||||}W n" tyD   | d|  Y n0 qRt j|
|sRt|
| qRq&|S )Nr   rz%SKIPPING: Generalizing failed for %s
)r   r   existsr   r   r   r   r*   r   r>   endswithbasenamer   r   r   ET
fromstringZgeneralize_xmlr   r   samefileshutilcopy2)r   	sourcedir	targetdirr=  r   r   r   r   r   rO   r   r   to_parser   ltempr   Zconcrete_xmlZfound_entitiesr"   r"   r&   r8  M  s>    




&
z"cmd_backup.generalize_xml_entities)NNFNNNN)r   r   r   r   r   r/   r   r   r   r   r
  r   rr   r   r   staticmethodr8  r"   r"   r"   r&   r/    s*   	  
Ar/  c                   @   sR   e Zd ZdZdZejejejdZ	dgZ
eddededd	edgZdddZd
S )
cmd_createzCreate an empty GPO.z%prog <displayname> [options]r   ri   r   r   r  r&  r'  Nc           !   
   C   s  |  | _|j| jdd| _t| j| jd}|rn|drn|dd  }|| _tjtj	B tj
B }	|j||	d}
nBtjtj	B tj
B }	|j| jd|	d}
|
j}t| j| j|d	| _|   t| j|d
}|jdkrtd| tt }d|  }|| _|
j}d|||f }| ||\| _}|| _zJttj |d ttj |d d}t!tj |dd"| W n0 t#y } ztd|W Y d }~n
d }~0 0 t$|\}}}|| _%t&||| j| jd}|| _'| j(  zt)| j|}t*+ }||_,t*-dt*j.d|d< | j/| t*+ }t*0| jdt| |_,t*-dt*j.d|d< | j/| t*+ }t*0| jdt| |_,t*-dt*j.d|d< | j/| t1j2t1j3B t1j4B }t| j||dd }|d d }t5t1j6|7 }t18| j9 }t:||}t1j6;||}t<|| t1j2t1j3B t1j4B t1j=B }|>||| t?||| t*+ }||_,t*-|t*j@d|d< t*-|t*j@d |d!< t*-d"t*j@d#|d$< t*-d%t*j@d&|d'< t*-d"t*j@d(|d)< d*g} | jjA|| d+ W n  t#y   | jB   Y n0 | jC  | jD"d,||f  d S )-NTr   )rL   rK   rI   r(  )Zaddressr,   realm)Zdomainr,   r)  )ri   r   z%A GPO already existing with name '%s'z{%s}z\\%s\sysvol\%s\Policies\%sZMachineZUserz[General]
Version=0
zGPT.INIr5  zError Creating GPO filesr3  ZgroupPolicyContainerr   Za01
CN=User,%sr  CN=Machine,%s)rW   rj   rY   r\   Za02r]   Za03r   rZ   Za052ZgpcFunctionalityVersionZa07r,   Za04zpermissive_modify:0)re   zGPO '%s' created as %s
)Er   rK   r   rL   r   r<   rM   r   ZNBT_SERVER_LDAPZNBT_SERVER_DSZNBT_SERVER_WRITABLEZfinddcgetZpdc_dns_namerP   r   rl   rV   countr   rr   uuidZuuid4uppergpo_nameZ
dns_domainr   r   r   r   r   r   r*   r   r   rJ   r   r.  r   r   transaction_startrX   rT   ru   r8   rv   r  addrU   r
   r  r  r  r   r  r  dom_sidget_domain_sidr   Z	from_sddlr   ZSECINFO_PROTECTED_DACLZset_aclr   rw   rx   transaction_canceltransaction_commitr   )!r   ri   r   r   r   r   r   Znetr   r,   Z	cldap_retr#   ZguidrW   rO  unc_pathr   Zgpt_contentsrO   r-  r   r.  r   r{   r|   Zds_sd_flags	ds_sd_ndrds_sd
domain_sidZsddlfs_sdZsiore   r"   r"   r&   r     s    

 





zcmd_create.run)NNNNNr  r"   r"   r"   r&   rN    s     rN  c                	       s   e Zd ZdZdZejejejdZ	ddgZ
eddeded	d
ededdededddddgZdddZd fdd	Z  ZS )cmd_restorez!Restore a GPO to a new container.z/%prog <displayname> <backup location> [options]r   ri   backupr   r   r  r&  r'  r1  z8File defining XML entities to insert into DOCTYPE headerz--restore-metadataz7Keep the old GPT.INI file and associated version numberFr  r0  r1   c              
   C   s"  d}t j|st | |g}|g}|r| }| }t |}	|	  |	D ]}
t j||
}t j||
}t j|r|	| |	| t j|st | qR|
drRt j|d d }t|}zt|dx}| }d}||r"|t|d  }|t|| |  n|t||  ||d d  W d    n1 s^0    Y  W qR ty   |d d | }t||d d  | jd|  | jd Y qR   dd l}|  |d d | }t||d d  | jd	|  | jd Y qR0 qRq&d S )
Nr   r   r?  r@  z&<?xml version="1.0" encoding="utf-8"?>zWARNING: No such parser for %s
z.WARNING: Falling back to simple copy-restore.
r   z%WARNING: Error during parsing for %s
)r   r   rA  r   r   r   r   r*   r   r>   rB  rC  r   r   r   r<   r;   Zload_xmlrD  rE  Zwrite_binaryr   rG  rH  r   r   	traceback	print_exc)r   rI  rJ  
dtd_headerr   r   r   r   r   r   rO   r   r   rK  r   rL  r   Zxml_headZoriginal_filere  r"   r"   r&    restore_from_backup_to_local_dir&  sT    





6z,cmd_restore.restore_from_backup_to_local_dirNc
              
      s  d}
t j|std| |d urd}
t j|s@td| t|dB}| }tjd|tjdd u rrtd|
|	 7 }
W d    n1 s0    Y  |
d	7 }
t
t| |||||| z| || j|
 |	 }t| j| j| jd
|d t| j| j}dD ]}t j||d }t j|r t|d}| }W d    n1 sN0    Y  t }||_t|tj|||< | j| q W n| ty } zbdd l}|  | j t!|d  | j d t" }|| j|||| td| W Y d }~n
d }~0 0 d S )Nr1   z"Backup directory does not exist %sz<!DOCTYPE foobar [
zEntities file does not exist %sr@  z*(\s*<!ENTITY\s*[a-zA-Z0-9_]+\s*.*?>)+\s*\Zr   zPEntities file does not appear to conform to format
e.g. <!ENTITY entity "value">z
]>
T)r   r   r6  r7  r   r   r   z%Failed to restore GPO -- deleting...
zFailed to restore: %s)#r   r   rA  r   r   r   r   r   	MULTILINEr9   superrc  r   rh  r   r   r   r.  rX   rV   rW  r*   rT   ru   r8   rv   rw   rx   rJ   re  rf  r   r   rr   cmd_del)r   ri   rd  r   r   r=  r   r   r   Zrestore_metadatarg  Zentities_fileZentities_contentZkeep_new_filesr{   r>  Zext_filer   r   r|   rO   re  cmd	__class__r"   r&   r   j  sh    *

(
zcmd_restore.run)r1   )NNNNNNN)r   r   r   r   r   r/   r   r   r   r   r
  r   rr   r   rh  r   __classcell__r"   r"   rm  r&   rc    s$   
D  rc  c                   @   sF   e Zd ZdZdZejejejdZ	dgZ
eddedgZdd	d
ZdS )rk  zDelete a GPO.r  r   rW   r   r   r  Nc                 C   s  |  | _|j| jdd| _|r>|dr>|dd  }|| _n"t| j| j}t| j| j|d| _|   z&t	| j
|dd }t|d d }W n ty   td	| Y n0 t|\}	}
}t||
| j| jd
}| j
  zt| j
|}t|r4| jd|  |D ],}t| j
|d | | jd|d   qt| j
|}| j
t| j
dt|  | j
t| j
dt|  | j
| || W n  ty   | j
   Y n0 | j
  | jd|  d S )NTr   rI   r(  r)  r  r   r]   r  r3  zGPO %s is linked to containers
r8   z    Removed link from %s.
rP  rQ  zGPO %s deleted.
)r   rK   r   rL   r<   rM   r   rP   r   rl   rV   rr   rJ   r   r   r   rX  rn   r;   r   r   r~   rX   deleterT   rU   Zdeltreer\  r]  )r   rW   r   r   r   r   r   r#   r^  r-  r   r.  r   r|   r{   r"   r"   r&   r     sF    





zcmd_del.run)NNNNr  r"   r"   r"   r&   rk    s     rk  c                   @   sF   e Zd ZdZdZejejejdZ	e
dddeddd	gZdddZd
S )cmd_aclcheckz.Check all GPOs have matching LDAP and DS ACLs.r   r   r   r   r   r   r   r   Nc              	   C   sv  |  | _|j| jdd| _t| j| j|| _|rP|drP|dd  }|| _n"t| j| j}t| j| j|d| _|   t	| j
d }|D ]}t|d d }zt|\}	}
}W n ty   td| Y n0 t||
| j| jd	}||tjtjB tjB tj}d
|vrtd|d
 d }ttj| }t| j
 }t||}|||krtd||||f qd S )NTr   rI   r(  r)  r]   r   r*  r3  rY   zKCould not read nTSecurityDescriptor. This requires an Administrator accountz-Invalid GPO ACL %s on path (%s), should be %s)r   rK   r   rL   rP   rM   r<   r   r   rl   rV   rr   r   r   r   r   Zget_aclr
   r  r  r  ZSEC_FLAG_MAXIMUM_ALLOWEDr   r  r  rZ  r[  r   )r   r   r   r   r   r   r#   r|   r   r-  r   r.  r   rb  r_  r`  ra  Zexpected_fs_sddlr"   r"   r&   r     s8    



zcmd_aclcheck.run)NNNNr   r"   r"   r"   r&   rq    s   
rq  c                	   @   sb   e Zd ZdZdZejejejdZ	e
dddeddd	e
d
deeje ddgZdddZdS )cmd_admxloadz Loads samba admx files to sysvolr   r   r   r   r   r   r   r   z
--admx-dirz)Directory where admx templates are storedz
samba/admx)r   r   r%   Nc                 C   s8  |  | _|j| jdd| _|r>|dr>|dd  }|| _n"t| j| j}t| j| j|d| _t|d| j| jdd}d	| j
d	 d
dg}z|| W nL ty }	 z4|	jd dkrtdn|	jd dkr؂ W Y d }	~	n
d }	~	0 0 t|D ]8\}
}}|D ]&}|
|d}tj	|
|}d	||gdd}d	||g}z|| W nR ty }	 z8|	jd dkrtdn|	jd dkr W Y d }	~	n
d }	~	0 0 t|dd}z|||  W n> ty }	 z$|	jd dkrtdW Y d }	~	n
d }	~	0 0 W d    n1 s$0    Y  qqd S )NTr   rI   r(  r)  Zsysvolr   r   rO  ZPoliciesZPolicyDefinitionsr   l   "    z:The authenticated user does not have sufficient privilegesl   5    r1   r   r   )r   rK   r   rL   r<   rM   r   rP   r   r*   rS  rs   r   r   argsr   r   walkr   r   r   r   r   )r   r   r   r   r   Zadmx_dirr   r   Zsmb_dirrO   dirnamedirsfilesfnameZpath_in_admx	full_pathZsub_dirZsmb_pathr   r"   r"   r&   r   O  sT    



zcmd_admxload.run)NNNNN)r   r   r   r   r   r/   r   r   r   r   r   rr   r   r   r*   r   Zdata_dirr   r   r"   r"   r"   r&   rr  =  s    
  rr  c                   @   s   e Zd ZdZi Ze ed< e ed< e ed< e ed< e	 ed< e
 ed< e ed< e ed	< e ed
< e ed< e ed< e ed< e ed< e ed< e ed< e ed< dS )cmd_gpoz%Group Policy Object (GPO) management.Zlistallr   ZshowZgetlinkZsetlinkZdellinkZlistcontainersZgetinheritanceZsetinheritanceZfetchZcreatedelZaclcheckrd  ZrestoreZadmxloadN)r   r   r   r   Zsubcommandsr   r   r  r  r  r  r  r   r"  r%  rN  rk  rq  r/  rc  rr  r"   r"   r"   r&   rz    s$   














rz  )NN)FF)F)nZ
__future__r   r   Zsamba.getoptZgetoptr/   rT   r   Zxml.etree.ElementTreeZetreeZElementTreerD  rG  r   Z
samba.authr   Zsamba.netcmdr   r   r   r   Zsamba.samdbr   r   r	   Zsamba.dcerpcr
   Z	samba.ndrr   Zsamba.securityr   r   r   Zsamba.netcmd.commonr   r   Zsamba.samba3r   r   r   r   r   rU  Zsamba.ntaclsr   r   Z	samba.netr   Zsamba.gp_parser   r   r   Zsamba.gp_parse.gp_polr   Zsamba.gp_parse.gp_inir   r   r   r   Zsamba.gp_parse.gp_csvr   Zsamba.gp_parse.gp_infr    Zsamba.gp_parse.gp_aasr!   r'   r.   r0   rC   rH   rP   rX   r  r  r  ZSECINFO_SACLrl   rn   r~   r   
IGNORECASEr   r   FILE_ATTRIBUTE_SYSTEMr   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENr   r   r   r   r   r   r   r   r  r  r  r  r  r   r"  r%  r/  rN  rc  rk  rq  rr  rz  r"   r"   r"   r&   <module>   s   


	
.&  
%
.%u0/Z'$,6;   $J?G