File: //lib/python3/dist-packages/samba/netcmd/__pycache__/domain.cpython-310.pyc
o
eF�c� � @ sf d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
mZ d dl
mZ d dl
mZ d dlmZ d dlmZmZ d dl
mZ d dlZ
d dlmZmZ d d lmZ d d
l m Z m Z d d l m Z m!Z! d d l"m#Z# d d
l"m$Z$ d dl"m%Z% d dl"m&Z& d dl"m'Z' d dl"m(Z( d dl"m)Z) d dl*m+Z+m,Z, d dl-m.Z.m/Z/m0Z0m1Z1 d dl2m3Z3 d dl4m5Z5 d dl4m6Z6m7Z7m8Z8 d dl9m:Z: d dl9m;Z< d dl=m>Z> d dl?m@Z@ d d l
mAZAmBZBmCZC d d lDmEZE d d lFmZG d d lHmIZI d d l
mJZJ d d!lKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZX d d"lYmZZZm[Z[m\Z\m]Z] d d#l^m_Z_m`Z`maZa d d$lbmcZc d d%ldmeZe d d&lfmgZg d d'lhmiZi d d(l
mjZj ePeQeRd)�Zke1d*d+d,d-d.�e1d/d0d1d2�e1d3d4d5d6d7gd8e � d9�e1d:d;d<d=d.�e1d>d?d@eldA�e1dBdCdDd0dE�gZme1dFdGeldH�e1dIdJeldH�e1dKdLd0dE�e1dMd4dNg dO�dPdQdR�e1dSdTdUd0dE�gZne1dVdWd0dE�gZodXdY� Zpze� W n eq�y� dZrY n w G dZd[� d[e.�ZrG d\d]� d]e.�ZsG d^d_� d_e.�ZtG d`da� dae.�ZuG dbdc� dce.�ZvG ddde� dee.�ZwG dfdg� dge.�ZxG dhdi� die.�ZyG djdk� dke.�ZzG dldm� dme0�Z{G dndo� doe.�Z|G dpdq� dqe|�Z}G drds� dsej~�ZG dtdu� due.�Z�G dvdw� dwe��Z�G dxdy� dye��Z�G dzd{� d{e��Z�G d|d}� d}e��Z�G d~d� de��Z�G d�d�� d�e��Z�G d�d�� d�e��Z�G d�d�� d�e.�Z�G d�d�� d�e0�Z�G d�d�� d�e0�Z�G d�d�� d��Z�G d�d�� d�e.�Z�G d�d�� d�e.�Z�G d�d�� d�e0�Z�dS )�� N)�ntstatus)�
NTSTATUSError)�werror��getpass)�Net�LIBNET_JOIN_AUTOMATIC)�enable_net_export_keytab)� join_RODC�join_DC)�system_session)�SamDB�get_default_backend_store)�ndr_pack� ndr_print)�drsuapi)�drsblobs)�lsa)�netlogon)�security)�nbt)�misc)�DOMAIN_PASSWORD_COMPLEX� DOMAIN_PASSWORD_STORE_CLEARTEXT)�Command� CommandError� SuperCommand�Option)�get_fsmo_roleowner)�!netcmd_get_domain_infos_via_cldap)�NEVER_TIMESTAMP�timestamp_to_mins�timestamp_to_days)�Samba3)�param)�upgrade_from_samba3)�drsuapi_connect)� remove_dc�arcfour_encrypt�string_to_byte_array)�system_session_unix)r )� default_path)�is_ad_dc_built)
�DS_DOMAIN_FUNCTION_2000�DS_DOMAIN_FUNCTION_2003� DS_DOMAIN_FUNCTION_2003_MIXED�DS_DOMAIN_FUNCTION_2008�DS_DOMAIN_FUNCTION_2008_R2�DS_DOMAIN_FUNCTION_2012�DS_DOMAIN_FUNCTION_2012_R2�$DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL�#DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL� UF_WORKSTATION_TRUST_ACCOUNT�UF_SERVER_TRUST_ACCOUNT�UF_TRUSTED_FOR_DELEGATION�UF_PARTIAL_SECRETS_ACCOUNT)� provision�ProvisioningError�DEFAULT_MIN_PWD_LENGTH�
setup_path)� FILL_FULL� FILL_NT4SYNC�FILL_DRS)� cmd_domain_passwordsettings_pso)�cmd_domain_backup)�
get_string)�CreateTrustedDomainRelax)�dsdb��2008_R2�2012�2012_R2z
--machinepass�string�PASSWORDz*choose machine password (otherwise random)��type�metavar�helpz--plaintext-secrets�
store_truezaStore secret/sensitive values as plain text on disk(default is to encrypt secret/ensitive values)��actionrO z--backend-store�choice� BACKENDSTORE�tdb�mdbz7Specify the database backend to be used (default is %s))rM rN �choicesrO z--backend-store-size�bytes�SIZEzfSpecify the size of the backend database, currently only supported by lmdb backends (default is 8 Gb).� --targetdir�DIRz/Set target directory (where to store provision))rN rO rM �-q�--quiet�Be quiet�rO rR �--serverz
DC to join�rO rM �--sitez site to joinz--domain-critical-onlyz&only replicate critical domain objects�
--dns-backend�NAMESERVER-BACKEND)�SAMBA_INTERNAL� BIND9_DLZ�NONEz�The DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (this DC will not be a DNS server)re �rM rN rW rO �default�-v� --verbose�
Be verbose� --use-ntvfs�+Use NTVFS for the fileserver (default = no)c C sb t tjd�}tj| ddd| |gtj|d�}|�� \}}|�� |�d�}|r/t |d ��
� S dS ) N�wz-sz-lz--parameter-name=%s)�stdout�stderr�
r � ) �open�os�devnull�
subprocess�Popen�PIPE� communicate�close�splitrC �strip)�testparm�smbconf�varname�errfile�p�out�err�lines� r� �5/usr/lib/python3/dist-packages/samba/netcmd/domain.py�get_testparm_var� s
��
r� c @ sF e Zd ZdZdZejejejd�Z e
dde d�gZ dgZ
d d d
�ZdS ) �cmd_domain_export_keytabz/Dump Kerberos keys of the domain into a keytab.z%prog <keytab> [options]�� sambaopts�credopts� versionoptsz --principalzextract only this principalra �keytabNc C s$ |� � }td |�}|j||d� d S )N)r� � principal)� get_loadparmr �
export_keytab)�selfr� r� r� r� r� �lp�netr� r� r� �run� s
z cmd_domain_export_keytab.run�NNNN��__name__�
__module__� __qualname__�__doc__�synopsis�options� SambaOptions�CredentialsOptions�VersionOptions�takes_optiongroupsr �str�
takes_options�
takes_argsr� r� r� r� r� r� � s � �r� c @ s: e Zd ZdZdZg Zejejej d�Z
dgZ ddd�Z dS ) �cmd_domain_infoz?Print basic info about a domain and the DC passed as parameter.z %prog <ip_address> [options]r� �addressNc C s� |� � }zt|d |�}W n ty td| d ��w | j�d|j � | j�d|j � | j�d|j � | j�d|j � | j�d|j
� | j�d|j � | j�d |j � d S )
NzInvalid IP address 'z'!zForest : %s
zDomain : %s
zNetbios domain : %s
zDC name : %s
zDC netbios name : %s
zServer site : %s
zClient site : %s
)
r� r � RuntimeErrorr �outf�write�forest�
dns_domain� domain_name� pdc_dns_name�pdc_name� server_site� client_site)r� r� r� r� r� r� �resr� r� r� r� � s �zcmd_domain_info.run�NNN)
r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � s �r� c @ s4 e Zd ZdZdZejejd�Ze dddd�e dd d
d d �e d
d ddd �e dd ddd �e dd ddd �e dd ddd �e dd ddd �e dd dd d �e d d d d d �e d d d!d"d �e d#d d$d%d �e d&d d$d'd �e d(d)d*g d+�d,d-d.�e d/d d$d0d �e d1d d2d3d �e d4d d2d5d �e d6d d7d8d �e d9dd:d;�e d<d)d=g d>�d?d@d.�e dAd)dBg dC�dDdEd.�e dFd)dGg dH�dIdJd.�e dKdLdMdNdOdP�e dQdRdd�e dSddTd;�gZ
e dUd)g dV�dWdXdYdZ�gZ e
� e
� e�� r�e
� e� e
� e � g Z [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ Y \ [ [ \ [ [dcd]d^�Zd_d`� Zdadb� Zd[S )d�cmd_domain_provisionzProvision a domain.�%prog [options]�r� r� z
--interactivez
Ask for namesrP r_ z--domainrJ �DOMAINzNetBIOS domain name to userL z
--domain-guid�GUIDz!set domainguid (otherwise random)z --domain-sid�SIDz set domainsid (otherwise random)z --ntds-guidz'set NTDS object GUID (otherwise random)z--invocationidz#set invocationid (otherwise random)z --host-name�HOSTNAMEz set hostnamez --host-ip� IPADDRESSzset IPv4 ipaddressz
--host-ip6�
IP6ADDRESSzset IPv6 ipaddressrb �SITENAMEz
set site namez --adminpassrK z(choose admin password (otherwise random)z --krbtgtpassz)choose krbtgt password (otherwise random)rc rS rd �re �BIND9_FLATFILErf rg z�The DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_FLATFILE uses bind9 text database to store zone information, BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (not recommended)re rh z --dnspassz&choose dns password (otherwise random)z--root�USERNAMEzchoose 'root' unix usernamez--nobodyzchoose 'nobody' userz--users� GROUPNAMEzchoose 'users' groupz--blankz.do not add users or groups, just the structurerQ z
--server-role�ROLE)�domain controller�dc�
member server�member�
standalonez^The server role (domain controller | dc | member server | member | standalone). Default is dc.r� �--function-levelz
FOR-FUN-LEVEL)�2000�2003�2008rG zyThe domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2008_R2 Native.rG z
--base-schemaz BASE-SCHEMA)rG � 2008_R2_oldrH rI z;The base schema files to use. Default is (Windows) 2012_R2.rI z
--next-rid�int�NEXTRIDi� zGThe initial nextRid value (only needed for upgrades). Default is 1000.)rM rN ri rO z--partitions-onlyzEConfigure Samba's partitions, but do not modify them (ie, join a BDC)z
--use-rfc2307z/Use AD to store posix attributes (default = no)� --use-xattrs��yes�no�auto�
[yes|no|auto]��Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl when --use-ntvfs is set. auto tries to make an inteligent guess based on the user rights and system capabilitiesr� �rM rW rN rO ri NFc% 7
C s� | j d|d�| _|�� }%|%j}&|d ur|}'n
| �� }'|'d u r d}'t| j�dkr)d}|r�ddlm}( dd l})dOdd �}*z|)� � �
d
d�d � � }+W n t yS d }+Y nw |*d |+�},|,d v rat
d
��z |,�
d
�d }+W n t yu d }+Y nw |*d|+�}|d u r�t
d��|*dd�}|*dd�}|d v r�t
d��|dkr�|*d|'�}|�� dv r�d }'d } |(d�}-| �|-�}.|.r�| j�d|. � n|(d�}/|-|/ks�| j�d� n|-} nq�n|j�d�},|,d u r�t
d
��|d u r�t
d��| r�| �| �}.|.r�t
|.��n| j�d � |d k�rt}0n|d k�r t}0n|d k�rt}0n|d k�rt}0|dk�r&|d u �r&|'}t}1|�r.t}1n| �r3t}1| d u�rDt j � | ��sDt � | � d}2| d!k�rNd"}2nn| d#k�r[| d"k�r[d"}2na| d"k�rdt
d$��| d#k�r�|%�d%��s�| �r}t j!t j �"| �d&�}3nt j!t j �"t j �#|%�d'���d&�}3z(zt$j%�&|%|3j'd(d)t(� d*� d"}2W n t)�y� | j�d+� Y nw W |3�*� n|3�*� w |2�r�| j�d,� |d u�r�t+�,|�}t-� }4|#d u �r�t.� }#zpt/| j|4fi d-|&�d.| �d/|1�d|,�d0|�d1|�d2|�d3| �d4|
�d5| �d6|
�d7|�d8|�d9| �d:|�d;|�d<|�d=|�d>|�d?|�d@|�dA|�dB|�dC|0�dD|2�dE|�dF|%�dG| �dH| �dId"�dJ|!�dK|"�dL|#�dM|$��}5W n t0�y\ }6 zt
dN|6��d }6~6ww |5�1| j� d S )PNr: )�name�quiet�none� Tr r c S sN |d urt d| |f dd� n t d| f dd� tj�� tj�� �d�p&|S )Nz %s [%s]: � )�endz%s: �
)�print�sysrp �flush�stdin�readline�rstrip)�promptri r� r� r� �asks s
z%cmd_domain_provision.run.<locals>.ask�.�Realm)Nrs z
No realm set!�DomainzNo domain set!z$Server Role (dc, member, standalone)r� z=DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE)re zNo DNS backend set!z=DNS forwarder IP address (write 'none' to disable forwarding))Nr� zAdministrator password: z%s.
zRetype password: � Sorry, passwords do not match.
�realmz,Administrator password will be set randomly!r� r� r� rG r� Fr� �r--use-xattrs=no requires --use-ntvfs (not supported for production use). Please re-run with --use-xattrs omitted.�
posix:eadb��dir� private dir�O:S-1-5-32G:S-1-5-32�S-1-5-32�nativezZYou are not root or your system does not support xattr, using tdb backend for attributes. z�not using extended attributes to store ACLs and other metadata. If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.r � targetdir�
samdb_fill�domain�
domainguid� domainsid�hostname�hostip�hostip6�sitename�ntdsguid� invocationid� adminpass�
krbtgtpass� machinepass� dns_backend�
dns_forwarder�dnspass�root�nobody�users�
serverrole�dom_for_fun_level�useeadb�next_ridr� � use_ntvfs� use_rfc2307�skip_sysvolacl� base_schema�plaintext_secrets�
backend_store�backend_store_sizezProvision failed�N)2�
get_logger�loggerr� �
configfile�_get_nameserver_ip�len�raw_argvr �socket�getfqdnr| �upper�
IndexErrorr �lower�_adminpass_issue�errfr� �_lp�get�infor- r. r0 r1 r> r? r@ ru �path�isdir�makedirs�tempfile�NamedTemporaryFile�abspath�dirname�samba�ntacls�setntaclr� r* � Exceptionr{ r �dom_sidr r r: r; �
report_logger)7r� r� r� � interactiver� � domain_guid�
domain_sid� ntds_guidr� � host_name�host_ip�host_ip6r� �siter� r� r r r �
ldapadminpassr r r r� �blank� server_role�function_levelr �partitions_onlyr� �
use_xattrsr
r r
r r r r� r �suggested_forwarderr r r� ri r� �adminpassplain�issue�adminpassverifyr r� �eadb�file�session�result�er� r� r� r� < sz $
�
�
�
�
" ���
����������������� � �
�
�
� � � �
�
�
�
�������
��zcmd_domain_provision.runc C s� ddl m} d}|�|�s| j�d| � dS d}z-t|d�}|D ]}|�d�s)q!|�� �� d W |dur<|� � S S W |durF|� � n
|durP|� � w w | j�d | � dS )
z5Grab the nameserver IP address from /etc/resolv.conf.r )r" z/etc/resolv.confzFailed to locate %sN�r�
nameserver���zNo nameserver found in %s)
ru r" �isfiler �warningrt �
startswithr} r| r{ )r� r" � RESOLV_CONF�handle�liner� r� r� r s.
����
�z'cmd_domain_provision._get_nameserver_ipc C s: t |t�r
|�d�}t|�tk rdt S t�|�sdS dS )zTReturns error string for a bad administrator password,
or None if acceptable�utf8zdAdministrator password does not meet the default minimum password length requirement (%d characters)zBAdministrator password does not meet the default quality standardsN)�
isinstancerX �decoder r< r) �check_password_quality)r� r� r� r� r� r s
�
z%cmd_domain_provision._adminpass_issue)$NNNNNNNNNNNNNNNNNNNNNNNNNNNNNr� FNNFNN)r� r� r� r� r� r� r� r� r� r r� �
ntvfs_options�extend� common_provision_join_optionsr) �is_ntvfs_fileserver_built�common_ntvfs_optionsr� r� r r r� r� r� r� r� � s
� ��������������������
�� � =��
� K r� c @ sn e Zd ZdZdZejejejd�Z g Z
e
� e � e
� e
� e�� r&e
� e� ddgZ d
dd �ZdS ) �cmd_domain_dcpromoz9Promote an existing domain member or NT4 PDC to an AD DC.z%%prog <dnsdomain> [DC|RODC] [options]�r� r� r� r� �role?NFc C sB |� � }|�|�}t|||jd�}| j||
d�}|�d�}|d ur%|�� }|dkr`tdi d|�d|�d|�d|�d |�d
|�d |�d |�d
| �d|
�d| �d| �dd�d|�d|�d|�� d S |dkr�tdi d|�d|�d|�d|�d |�d
|�d |�d |�d
| �d|
�d| �d| �dd�d|�d|�d|�� d S t d| ��)N��server��verboser� � netbios name�DCr r\ �credsr� r� r6 � netbios_namer� �domain_critical_onlyr� r
r �promote_existingTr r r �RODCz-Invalid role '%s' (possible values: DC, RODC)r� )
r� �get_credentialsr � ipaddressr r r r r
r )r� r� �roler� r� r� r\ r6 r� rc r� r
r r� r^ r r r r� ra r� r rb r� r� r� r� B sp
&�����������&����������� zcmd_domain_dcpromo.run)NNNNNNNFNFNFFFNN)r� r� r� r� r� r� r� r� r� r� r� rT �common_join_optionsrU r) rV rW r� r� r� r� r� r� rX - s( �
�rX c @ s� e Zd ZdZdZejejejd�Z e
dddd�gZ e
ddd d
�gZ g Z
e
�e� e
�e� e�� r6e
�e � e�� r?e
�e � d d gZ
ddd�Zd
S )�cmd_domain_joinz9Join domain as either member or backup domain controller.z,%prog <dnsdomain> [DC|RODC|MEMBER] [options]rY rm rn rP r_ z--experimental-s4-memberzfPerform member joins using the s4 Net join_member. Don't choose this unless you know what you're doingrQ r� rZ NFc C s |� � }|�|�}t|||jd�}| j||d�}|�d�}|d ur%|�� }|d u s-|dkr�| r<|j||t|
d�\}}}n�|� d|� |�d�dkrY|� d|j
|t j t j
B d �j� |� d
d � |jre|jnt� }tjd tj�|�d
��)} |�d | j� tj�|�r�t�|�j} t�| j| � t� | j|� W d � n1 s�w Y t � � } | � |� t || |d�} | j||
|d�\}}| j!�"d||f � d S |dkr�t#� r�t$||||||||| |
| |
|||d� d S |dk�rt#� �rt%||||||||| |
| |
|||d� d S t&d| ��)Nr[ r] r_ �MEMBER)r� r� � workgroup� WORKGROUP)r� �flagsz server roler� F)�deleter� )r� �debugzJoined domain %s (%s)
r` )r r\ ra r� r� r6 rb r� rc r� r
r r r r re z5Invalid role '%s' (possible values: MEMBER, DC, RODC))'r� rf r rg r r r � join_memberr �set�finddcr �NBT_SERVER_LDAP�
NBT_SERVER_DSr� r r+ r% r& ru r" r( �dumpr� �exists�stat�st_mode�chmod�rename�s3param� get_context�load�s3_Netr r� r, r r
r ) r� r� rh r� r� r� r\ r6 r� rc r� r
�experimental_s4_memberr r� r^ r r r r� ra r� r rb �
join_password�sidr� �smb_conf�f�mode�s3_lp�s3_netr� r� r� r� � s~
� ���
� �
�
�
� zcmd_domain_join.run)NNNNNNNFNFFNFFFNN)r� r� r� r� r� r� r� r� r� r� r rS �selftest_optionsr� rT ri rU r) rV �is_selftest_enabledr� r� r� r� r� r� rj h s@ �����
�rj c
@ s� e Zd ZdZdZedded�eddded d
d �ed d
ed�eddddd�eddddd�gZej ej
ej d�Z ddd�Z
dS ) �cmd_domain_demotez4Demote ourselves from the role of Domain Controller.r� r` z(writable DC to write demotion changes onra �-H�--URL�%LDB URL for database or target server�URL�H�rO rM rN �destz--remove-other-dead-serverzMDead DC (name or NTDS GUID) to remove ALL references to (rather than this DC)r\ r] r^ rP r_ rj rk rl r� NFc 0 C sZ |� � } |�| �}
t|
| |jd�} | j||d�} |d urS|d ur,td| t� |
| d�}
n t|t� |
| d�}
z
t�|
| |� W d S tjyR } zt d| ��d }~ww | �
d�}t|t� |
| d�}
|s�|
j ddd gd
�}t |�d krvt d ��t |�d
kr�t d��d }|D ]}t
|d ��� |�� kr�|d } nq�|
�� }|
j t
|
�� �tjd| dgd�}t |�d ks�d|d vr�t d| ��|d j}tt
|d d ��}|
j dt
|� dgd�}t |�d kr�t dt |� ��| j�d| � t|| |
�\}}}| j�d� t�� }|d j|_|t@ �s�|
�� �s�|tO }t� t
|�tj d�|d< |
� |� | j�d| � |
� � |
�� |
� � fD ]l}t!�"� }t
|�|_t!�#� } || _$t!j%| _&t'�(|�| _)z
|�*|d
| � W �q< t+�y� } z9| j,\} } | t-j.k�rwn&| j�d| � |tN }t� t
|�tj d�|d< |
� |� t dt
|� | ��W Y d } ~ �q<d } ~ ww z3td| t� |
| d�} | j�d � | j t
| �/� �d |�0� d gd �}|d j}!tt
|d d ��}"W n7 t1�y } z*|t@ �s
|
�� �s
| j�d � |tN }t� t
|�tj d�|d< |
� |� t d!|��d }~ww t |�d
k�rH|t@ �s@|
�� �s@| j�d"� |tN }t� t
|�tj d�|d< |
� |� t d#|�0� ��|"}#|"t2t3B t4B M }"|"t5O }"t�� }|!|_t� d$|" tj d �|d < z| � |� W n7 t1�y� } z*|t@ �s�|
�� �s�| j�d"� |tN }t� t
|�tj d�|d< |
� |� t d!|��d }~ww |j�6� }$|d j�7� }%d%|% }&d }'t
|&�}(| �8| �9� t:j;�})| j |)|&tj<d&�}t |�d k�rd| j |)d'|&|'f tj<d&�}t |�d k�r|'d(k �r|'d
}'| j |)d'|&|'f tj<d&�}t |�d k�r|'d(k �s�|'d(k�r^|t@ �s8|
�� �s8| j�d � |tN }t� t
|�tj d�|d< |
� |� t�� }|!|_t� d$|" tj d �|d < | � |� t d)t
|!�|&|&|'d* f ��d'|&|'f }(zt�=| d+|(t
|)�f �}*| �>|!|*� W nW t1�y� } zJ|t@ �s�|
�� �s�| j�d � |tN }t� t
|�tj d�|d< |
� |� t�� }|!|_t� d$|" tj d �|d < | � |� t d,t
|!�t
|*�f |��d }~ww |
�?� }+| � � },zt!�@� } t
|+�| _At
|,�| _/d
| _B|�C|d
| � W nk t+�y] }- z^|-j,\} } |t@ �s%|
�� �s%| j�d � |tN }t� t
|�tj d�|d< |
� |� t�� }|*|_t� d$|" tj d �|d < | � |� | �>|*|!� | t-j.k�rQt d-|+|-f ��t d.|+|-f ��d }-~-ww t�D| | |%� d/d0| �
d1� d2d3fD ])}.z| �Et�=| d+|.t
|*�f �� W �qp tjF�y� }/ zW Y d }/~/�qpd }/~/ww tjG| | |
�H� d4d5� | j�d6� d S )7Nr[ r] � ldap://%s��url� session_info� credentialsr� zDemote failed: %sr_ z.(&(objectClass=computer)(serverReferenceBL=*))� dnsHostNamer� )�
expression�attrsr z Unable to search for serversr� z%You are the last server in the domainz(objectGUID=%s)r� ��base�scoper� r� z Failed to find options on %sz(fSMORoleOwner=%s)zsearch_options:1:2)r� �controlszaCurrent DC is still the owner of %d role(s), use the role command to transfer roles to another DCz,Using %s as partner server for the demotion
z!Deactivating inbound replication
z0Asking partner server %s to synchronize from us
zgError while replicating out last local changes from '%s' for demotion, re-enabling inbound replication
z6Error while sending a DsReplicaSync for partition '%s'z#Changing userControl and container
z)(&(objectClass=user)(sAMAccountName=%s$))�userAccountControl�r� r� r� z6Error while demoting, re-enabling inbound replication
z$Error while changing account controlz5Error while demoting, re-enabling inbound replicationz@Unable to find object with samaccountName = %s$ in the remote dcz%dzCN=%s)r� r� r� z%s-%d�d zOUnable to find a slot for renaming %s, all names from %s-1 to %s-%d seemed used� z%s,%sz Error while renaming %s to %szHThe DC %s is not present on (already removed from) the remote server: %sz.Error while sending a removeDsServer of %s: %sz$CN=Enterprise,CN=NTFRS Subscriptionsz CN=%s, CN=NTFRS Subscriptionsr� z?CN=Domain system Volumes (SYSVOL Share), CN=NTFRS SubscriptionszCN=NTFRS SubscriptionsT)�ignore_no_namezDemote successful
)Ir� rf r rg r r
r r' �DemoteExceptionr r �searchr r� r �
get_ntds_GUID�get_config_basedn�ldb�
SCOPE_SUBTREE�dnr� r r� r& �Messager4 �am_rodcr5 �MessageElement�FLAG_MOD_REPLACE�modify�get_schema_basedn�get_root_basednr �DsReplicaObjectIdentifier�DsReplicaSyncRequest1�naming_context�DRSUAPI_DRS_WRIT_REPr� r r� �source_dsa_guid�
DsReplicaSyncr� �argsr �WERR_DS_DRA_NO_REPLICA� domain_dnr r, r7 r8 r9 r6 �parent�
get_rdn_value�get_wellknown_dn�get_default_basednrE �DS_GUID_COMPUTERS_CONTAINER�SCOPE_ONELEVEL�Dnr{ �get_serverName�DsRemoveDSServerRequest1� server_dn�commit�DsRemoveDSServer�remove_sysvol_referencesro �LdbError�remove_dns_references�
host_dns_name)0r� r� r� r� r\ �remove_other_dead_serverr� r^ r� r� ra r� r �samdbr� rb r� rE r2 �msg�ntds_dn� dsa_options� drsuapiBind�drsuapi_handle�supportedExtensions�nmsg�part�nc�req1�e1�werrrJ � remote_samdb�dc_dn�uac�olduacr� �dc_name�rdn�i�newrdn� computer_dn�newdn�
server_dsa_dnr� �e3�s�lr� r� r� r� � s
�� ��
�
�
� ��
��
��
��� � ��
�
�� �
���
��
��
����
�
�
� �
�
��
�
�
���� �
����zcmd_domain_demote.run)NNNNNNFF)r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� � s,
��� ��r� c @ s� e Zd ZdZdZejejejd�Z e
ddde ddd �e
d
d d d
d�e
ddg d�dd�e
ddg d�dd�gZ dgZ
ddd�ZdS ) �cmd_domain_levelz(Raise domain and forest function levels.z&%prog (show|raise <options>) [options]r� r� r� r� r� r� r� r\ r] r^ rP r_ z--forest-levelrS )r� r� rG rH rI zBThe forest function level (2003 | 2008 | 2008_R2 | 2012 | 2012_R2)�rM rW rO z--domain-levelzBThe domain function level (2003 | 2008 | 2008_R2 | 2012 | 2012_R2)�
subcommandNFc
C s� |� � } |j| dd�}
t|t� |
| d�} | �� } | jd| �� tjdgd�}
t |
�dks.J �| j| tjddgd�}t |�dksAJ �| jd | �� tj
d
dgd �}t |�dksXJ �t }t }d|
d v rlt |
d d d �}d|d v r|t |d d d �}t |d d d �}d }|D ] }d|v r�|d u s�t |d d �|k r�t |d d �}q�t } |t k s�|t k r�t
d
��|t k r�t
d��||kr�t
d��||kr�t
d��|dk�r�| �d| � |t kr�|d kr�| �d� |t kr�|d kr�| �d� |t k�r|d k�r| �d� | �d� |t k�rd}n2|tk�rd}n*|tk�r d}n"|tk�r(d}n|tk�r0d}n|tk�r8d }n
|tk�r@d }nd }| �d | � |t k�rV|d k�rVd }n?|t k�rc|d k�rcd}n2|tk�rkd}n*|tk�rsd}n"|tk�r{d}n|tk�r�d}n|tk�r�d }n
|tk�r�d }nd }| �d!| � |t k�r�d}n*|tk�r�d}n"|tk�r�d}n|tk�r�d}n|tk�r�d }n
|tk�r�d }nd }| �d"| � d S |d#k�rgg }|d u�r�|dk�r�t}n |dk�r�t}n|d$k�r�t}n|d k�rt}n|d%k�r
t}||k�r|d k�rt
d&��||k�r!t
d'��|d k�r�t�� }t�| | �|_t�d(tjd�|d< | �|� t�� }t�| d)| �d*� d+| �� �|_t�d(tjd�|d< z| �|� W n tj �y� } z|j \}}|tj k�r}� W Y d }~nd }~ww t�� }t�| | �|_t�t |�tjd�|d< | �|� t�� }t�| d)| �d*� d+| �� �|_t�t |�tjd�|d< z| �|� W n tj �y� } z| j \}}|tj k�r� W Y d } ~ nd } ~ ww |}|� d,� |d u�rX|dk�rt} n |dk�r
t} n|d$k�rt} n|d k�rt} n|d%k�r!t} | |k�r*t
d-��| |k�r3t
d.��t�� }t�| d| �� �|_t�t | �tjd�|d< | �|� |� d/� |� d0� | �d1�!|�� d S t
d2| ��)3NT)�fallback_machiner� �CN=Partitions,%szmsDS-Behavior-Version�r� r� r� �
nTMixedDomainz CN=Sites,%sz(objectClass=nTDSDSA))r� r� r� r zSDomain and/or forest function level(s) is/are invalid. Correct them or reprovision!zFLowest function level of a DC is invalid. Correct this or reprovision!zVForest function level is higher than the domain level(s). Correct this or reprovision!zdDomain function level is higher than the lowest function level of a DC. Correct this or reprovision!�showz0Domain and forest function level for domain '%s'z|
ATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2000 (Native). This isn't supported! Please raise!z|
ATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2000 (Native). This isn't supported! Please raise!z�
ATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!rs r� z02003 with mixed domains/interim (NT4 DC support)r� r� z2008 R2rH z2012 R2zhigher than 2012 R2z!Forest function level: (Windows) z2000 mixed (NT4 DC support)z!Domain function level: (Windows) z)Lowest function level of a DC: (Windows) �raiserG rI zGDomain function level can't be smaller than or equal to the actual one!zMDomain function level can't be higher than the lowest function level of a DC!�0zCN=rl z,CN=Partitions,%sz Domain function level changed!zGForest function level can't be smaller than or equal to the actual one!zdForest function level can't be higher than the domain function level(s). Please raise it/them first!z Forest function level changed!�!All changes applied successfully!r� z4invalid argument: '%s' (choose from 'show', 'raise'))"r� rf r
r r� r� r� r� �
SCOPE_BASEr r� r- r� r �messager/ r. r0 r1 r2 r3 r� r� r� r� r� r� r r� r� �ERR_UNWILLING_TO_PERFORMr� �append�join) r� r� r� � forest_level� domain_levelr� r� r� r� r� ra r� r� �
res_forest�
res_domain�res_dc_s� level_forest� level_domain�level_domain_mixed� min_level_dcr� �outstr�msgs�new_level_domain�mrE �enum�emsg�e2�new_level_forestr� r� r� r� sz ��
�� �
�
$�
���
�
�
�
���
�
zcmd_domain_level.run)NNNFNNNr� r� r� r� r� r� � s, �
� � ��
�r� c @ sF e Zd ZdZdZejejejd�Z e
ddde ddd �gZ d
d d �Z
d
S )� cmd_domain_passwordsettings_showz1Display current password settings for the domain.r� rY r� r� r� r� r� r� Nc
C s� |� � }|�|�}t|t� ||d�}|�� }|j|tjg d�d�} t| �dks)J �zRt | d d d �}
t | d d d �} t | d d d �} t
| d d d �}
t
| d d
d �}t | d d d �}t | d d d �}t | d d
d �}W n t y� } zt
d|��d }~ww | �d| � | �d� |
t@ dkr�| �d� n| �d� |
t@ dkr�| �d� n| �d� | �d| � | �d| � | �d|
� | �d| � | �d| � | �d| � | �d| � d S ) Nr� )�
pwdProperties�pwdHistoryLength� minPwdLength� minPwdAge� maxPwdAge�lockoutDuration�lockoutThreshold�lockOutObservationWindowr� r� r r r r
r r r r
r z'Could not retrieve password properties!z$Password information for domain '%s'rs zPassword complexity: onzPassword complexity: offz Store plaintext passwords: onz Store plaintext passwords: offzPassword history length: %dzMinimum password length: %dz Minimum password age (days): %dz Maximum password age (days): %dz#Account lockout duration (mins): %dz(Account lockout threshold (attempts): %dz&Reset account lockout after (mins): %d)r� rf r
r r� r� r� r� r r� r" r! r, r r� r r )r� r� r� r� r� r� ra r� r� r� � pwd_props� pwd_hist_len�cur_min_pwd_len�cur_min_pwd_age�cur_max_pwd_age� cur_account_lockout_threshold� cur_account_lockout_duration� cur_reset_account_lockout_afterrE r� r� r� r� � sL
�
�
��
z$cmd_domain_passwordsettings_show.runr� �r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r � s �
��r c @ s� e Zd ZdZdZejejejd�Z e
ddde ddd �e
d
d d d
d�e
ddg d�dd�e
ddg d�dd�e
dde d�e
dde d�e
dd e d�e
d d e d�e
d d e d�e
d!d"e d�e
d#d$e d�g Z % % % % %d)d'd(�Z
d%S )*� cmd_domain_passwordsettings_seta Set password settings.
Password complexity, password lockout policy, history length,
minimum password length, the minimum and maximum password age) on
a Samba AD DC server.
Use against a Windows DC is possible, but group policy will override it.
z%prog <options> [options]rY r� r� r� r� r� r� r\ r] r^ rP r_ z --complexityrS )�on�offri z=The password complexity (on | off | default). Default is 'on'r� z--store-plaintextz�Store plaintext passwords where account have 'store passwords with reversible encryption' set (on | off | default). Default is 'off'z--history-lengthzBThe password history length (<integer> | default). Default is 24.ra z--min-pwd-lengthzAThe minimum password length (<integer> | default). Default is 7.z
--min-pwd-agezFThe minimum password age (<integer in days> | default). Default is 1.z
--max-pwd-agezGThe maximum password age (<integer in days> | default). Default is 43.z--account-lockout-durationz�The the length of time an account is locked out after exeeding the limit on bad password attempts (<integer in mins> | default). Default is 30 mins.z--account-lockout-thresholdz�The number of bad password attempts allowed before locking out the account (<integer> | default). Default is 0 (never lock out).z --reset-account-lockout-afterzuAfter this time is elapsed, the recorded number of attempts restarts from zero (<integer> | default). Default is 30.NFc C sp |
� � }| �|�}t|t� ||d�}|�� }g }t�� }t�||�|_t |�
� �}|� � }|� � }|d urU|dks=|dkrG|t
B }|�d� n|dkrU|t
@ }|�d� |d ury|dksa|dkrk|tB }|�d� n|dkry|t @ }|�d� |d us�|d ur�t�t|�tjd �|d < |d ur�|dkr�d
}nt |�}|d k s�|d
kr�td ��t�t|�tjd
�|d
< |�d� |d ur�|dkr�d}nt |�}|d k s�|dkr�td��t�t|�tjd�|d< |�d� |d u�r|dkr�d}nt |�}|d k s�|dk�rtd��t |d � }t�t|�tjd�|d< |�d� |d u�rY|dk�r'd}nt |�}|d k �s5|dk�r9td ��|d k�rAt}nt |d � }t�t|�tjd �|d < |�d � | d u�r�| dk�rfd } nt | �} | d k �st| d k�rxtd!��| d k�r�t}nt | d" � }t�t|�tjd#�|d#< |�d$� |
d u�r�|
dk�r�d }
nt |
�}
t�t|
�tjd%�|d%< |�d&� | d u�r�| dk�r�d } nt | �} | d k �s�| d k�r�td!��| d k�r�t}nt | d" � }t�t|�tjd'�|d'< |�d(� |�s�|�rt|�}t|�}|d k�r||k�rtd)||f ��t|�d k�r$td*��|�|� |�d+� | �d,�|�� d S )-Nr� r ri z Password complexity activated!r z Password complexity deactivated!z;Plaintext password storage for changed passwords activated!z=Plaintext password storage for changed passwords deactivated!r � r z8Password history length must be in the range of 0 to 24!r z Password history length changed!� � z8Minimum password length must be in the range of 0 to 14!r
z Minimum password length changed!r� i� z6Minimum password age must be in the range of 0 to 998!g 8M%iBr z Minimum password age changed!�+ i� z6Maximum password age must be in the range of 0 to 999!r z Maximum password age changed!� i�� z8Maximum password age must be in the range of 0 to 99999!g ��Ar
z!Account lockout duration changed!r z"Account lockout threshold changed!r z0Duration to reset account lockout after changed!zIMaximum password age (%d) must be greater than minimum password age (%d)!z7You must specify at least one option to set. Try --helpr� r� )r� rf r
r r� r� r� r� r� r� �get_pwdProperties�
get_maxPwdAge�
get_minPwdAger r� r r� r� r� r r r" r r� r� r� ) r� r� � min_pwd_age� max_pwd_ager� �
complexity�store_plaintext�history_length�min_pwd_length�account_lockout_duration�account_lockout_threshold�reset_account_lockout_afterr� r� r� r� ra r� r� r r r �max_pwd_age_ticks�min_pwd_age_ticksr � min_pwd_len� account_lockout_duration_ticks�!reset_account_lockout_after_ticksr� r� r� r� M s�
�
�
�
�
�
�
�
�
�
z#cmd_domain_passwordsettings_set.run)NNNFNNNNNNNNNNr r� r� r� r� r # sZ �
� � ����������r c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )�cmd_domain_passwordsettingsz Manage password policy settings.�psor� rr N)r� r� r� r� � subcommandsrA r r r� r� r� r� r2 � s
r2 c
@ s� e Zd ZdZdZejejd�Ze ddddd�e d dd
d d�e d ddd
d�e ddddd�e ddddd�e dddg d�ddd �gZ
e d dg d �d d d!d"�gZ e �
� rZe
�e� e
�e � d#gZ $ $ %d(d&d'�Zd$S ))�cmd_domain_classicupgradez�Upgrade from Samba classic (NT4-like) database to Samba AD DC database.
Specify either a directory with all Samba classic DC databases and state files (with --dbdir) or
the testparm utility from your classic installation (with --testparm).
z"%prog [options] <classic_smb_conf>r� z--dbdirrJ r[ z+Path to samba classic DC database directoryrL z
--testparm�PATHz�Path to samba classic DC testparm utility from the previous installation. This allows the default paths of the previous installation to be followedrZ zCPath prefix where the new Samba 4.0 AD domain should be initialisedr\ r] r^ rP r_ rj rk rl rc rS rd r� a The DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_FLATFILE uses bind9 text database to store zone information, BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (this DC will not be a DNS server)re rh r� r� r� r� r� r� r NFc C s� t j�|�s td| ��|rt j�|�std| ��|r(t j�|�s(td| ��|s0|s0td��| j||d�} |rB|rB| �d� d }|�� }
t�� }|j rT|�
d|j � |d urct j� |�sct � |� d}|d krld
}nf|d krw| d
krwd
}n[| d
krtd ��|d kr�|�
d
�s�|r�tjt j�|�d�}ntjt j�t j�|
�
d���d�}z&ztj�|
|jddt� d� d
}W n ty� | �d� Y nw W |�� n|�� w i }|r�||d< ||d< ||d< |d |d< n/t||d�|d< t||d�|d< t||d�|d< t||d�|d< t|d �dk�r|d |d< |D ] }|�
||| � �q| �d� |� |� t ||�}| �d� t || |t � ||
| d� d S ) NzFile %s does not existz"Testparm utility %s does not existzDirectory %s does not existz'Please specify either dbdir or testparmr] z2both dbdir and testparm specified, ignoring dbdir.r� Tr� Fr� r� r� r� r� r� r� r� z�You are not root or your system does not support xattr, using tdb backend for attributes. If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.zstate directoryzlock directoryz
/smbpasswdzsmb passwd filer zReading smb.conf� Provisioning)r� r r r
) ru r" rw r r rJ r� r| r} r� rr r# �mkdirr r% r& r' r( r) r* r+ r� r* r, r! r{ r� r r~ r# r% r )r� r r� �dbdirr~ r� r^ r< r� r� r r
r r� �s3confrA �tmpfile�pathsr� �samba3r� r� r� r� * s�
" � ��
�z cmd_domain_classicupgrade.run) NNNNFFr� NNNF)r� r� r� r� r� r� r� r� r� r r� rS r) rV rT rW r� r� r� r� r� r� r5 � sJ ������ ��
�r5 c @ s e Zd ZejZdZdS )�cmd_domain_samba3upgradeTN)r� r� r� r5 r� �hiddenr� r� r� r� r> � s r> c @ � e Zd Zdd� ZdS )�LocalDCCredentialsOptionsc C s t jj| |dd� d S )Nzlocal-dc)� special_name)r� r� �__init__)r� �parserr� r� r� rC � s z"LocalDCCredentialsOptions.__init__N�r� r� r� rC r� r� r� r� rA � � rA c @ s e Zd ZdZdd� Zdd� Zdd� ZG dd � d e�ZG d
d � d e�Z G d d
� d
e�Z
dd� Z dd� Z dd� Z
dd� Z d?dd�Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd@d,d-�Zd@d.d/�Zd0d1� Zd2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z dAd=d>�Z!d<S )B�DomainTrustCommand�List domain trusts.c C s8 t �| � d | _d | _d | _d | _d | _d | _d | _d S r ) r rC �local_lp� local_server�local_binding_string� local_creds�
remote_server�remote_binding_string� remote_creds�r� r� r� r� rC � s
zDomainTrustCommand.__init__c C s t �|�jS r )�ctypes�c_uint32�value)r� �vr� r� r� �_uint32� s zDomainTrustCommand._uint32c C s, |d u rdS | � |jd �}||krdS dS )NFr T)rU r� )r� �runtime�val�err32r� r� r� �check_runtime_error� s z&DomainTrustCommand.check_runtime_errorc @ r@ )z$DomainTrustCommand.LocalRuntimeErrorc C �< |� |jd �}|jd }d|j|||f }t�| |� d S )Nr r� z%LOCAL_DC[%s]: %s - ERROR(0x%08X) - %s)rU r� rJ r rC ��exception_selfr� rV r� rX �errstrr� r� r� r� rC � �
�z-DomainTrustCommand.LocalRuntimeError.__init__NrE r� r� r� r� �LocalRuntimeError� rF r_ c @ r@ )z%DomainTrustCommand.RemoteRuntimeErrorc C rZ )Nr r� z&REMOTE_DC[%s]: %s - ERROR(0x%08X) - %s)rU r� rM r rC r[ r� r� r� rC � r^ z.DomainTrustCommand.RemoteRuntimeError.__init__NrE r� r� r� r� �RemoteRuntimeError� rF r` c @ r@ )z DomainTrustCommand.LocalLdbErrorc C s6 |j d }|j d }d|j|||f }t�| |� d S )Nr r� z!LOCAL_DC[%s]: %s - ERROR(%d) - %s)r� rJ r rC )r\ r� � ldb_errorr� �errvalr] r� r� r� r� rC � s
�z)DomainTrustCommand.LocalLdbError.__init__NrE r� r� r� r� �
LocalLdbError� rF rc c
C s� | j d ur| j S |�� }|j}|d u r3|�� }|dkr!td| ��|�d�}d}d}|d7 }d }d } n
d}d}d| }|�|�} || _|| _ d |||f | _|| _ | | _
| j S )
N�ROLE_ACTIVE_DIRECTORY_DCzInvalid server_role %sr_ �ncalrpcrs z ,auth_type=ncalrpc_as_system�ncacn_npr� z %s:%s[%s]) rJ r� rg r9 r r rf rI rK �local_ldap_urlrL )
r� r� � localdcoptsr� rJ r9 �local_transport�local_binding_optionsrg rL r� r� r� �setup_local_server� s0
z%DomainTrustCommand.setup_local_serverc C � t �| j| j| j�S r )r �lsarpcrK rI rL rP r� r� r� �new_local_lsa_connection� � z+DomainTrustCommand.new_local_lsa_connectionc C � t � | j| j| j�S r )r rK rI rL rP r� r� r� � new_local_netlogon_connection� ro z0DomainTrustCommand.new_local_netlogon_connectionc C s t | jt� | j| jd�S )Nr� )r
rg r rL rI rP r� r� r� �new_local_ldap_connection� s
�z,DomainTrustCommand.new_local_ldap_connectionTc
C s� |r|sJ �| j d ur| j S d| | _ | jd usJ �|�| j�}|j}d}z&t|| j|d�}tjtjB } |r;| tj O } |rB| tj
O } |j | ||d�}
W n# t yb } z t
d|| jd f ��d } ~ w tyn t
d| ��w i tj
d�tjd �tjd
�tjd �tjd �tjd
�tjd�tj d�tjd�tjd�tjd�tjd�tjd�tjd�tjd�tjd�tj d�} | j | |
j dd�}
| j � d|
j!|
j"|
f � |
j"| _ d | j |f | _#|| _$| j S ) Nz __unknown__remote_server__.%srs r[ )rn r� r� z1Failed to find a writeable DC for domain '%s': %sr� z-Failed to find a writeable DC for domain '%s'�PDC�GC�LDAP�DS�KDC�TIMESERV�CLOSEST�WRITABLE�
GOOD_TIMESERV�NDNC�SELECT_SECRET_DOMAIN_6�FULL_SECRET_DOMAIN_6�ADS_WEB_SERVICE�DS_8� HAS_DNS_NAME�
IS_DEFAULT_NC� FOREST_ROOTT��
names_onlyz,RemoteDC Netbios[%s] DNS[%s] ServerType[%s]
zncacn_np:%s[%s])%rM rJ rf rI rg r r rt ru �NBT_SERVER_WRITABLE�NBT_SERVER_PDCrs r r r� r, �
NBT_SERVER_GC�NBT_SERVER_KDC�NBT_SERVER_TIMESERV�NBT_SERVER_CLOSEST�NBT_SERVER_GOOD_TIMESERV�NBT_SERVER_NDNC�!NBT_SERVER_SELECT_SECRET_DOMAIN_6� NBT_SERVER_FULL_SECRET_DOMAIN_6�NBT_SERVER_ADS_WEB_SERVICE�NBT_SERVER_DS_8�NBT_SERVER_HAS_DNS_NAME�NBT_SERVER_IS_DEFAULT_NC�NBT_SERVER_FOREST_ROOT�generic_bitmap_to_string� server_typer� r� r� r� rN rO )r� r� r� � require_pdc�require_writablerO rM �remote_binding_options�
remote_net� remote_flags� remote_info�error�flag_map�server_type_stringr� r� r� �setup_remote_server� s�
�� ��������� �
� � �
�������z&DomainTrustCommand.setup_remote_serverc C rl r )r rm rN rI rO rP r� r� r� �new_remote_lsa_connection2 ro z,DomainTrustCommand.new_remote_lsa_connectionc C rp r )r rN rI rO rP r� r� r� � new_remote_netlogon_connection5 ro z1DomainTrustCommand.new_remote_netlogon_connectionc C s< t �� }t �� |_|�d�d�||�}|�|t j�}||fS )N� zutf-8)r �ObjectAttribute�QosInfo�sec_qos� OpenPolicy2rQ �QueryInfoPolicy2�LSA_POLICY_INFO_DNS)r� �conn�
policy_access�
objectAttr�policyr! r� r� r� � get_lsa_info8 s
�z DomainTrustCommand.get_lsa_infoc C s@ z|� |d dd d d tj�}|jW S ty |�||� Y S w �Nr )�netr_DsRGetDCNameEx2r �DS_RETURN_DNS_NAME�dc_uncr� �netr_GetDcName)r� r� r\ r� r! r� r� r� �get_netlogon_dc_uncC s
� �z&DomainTrustCommand.get_netlogon_dc_uncc C s |� |d dd d d tj�}|S r� )r� r r� )r� r� r\ r! r� r� r� �get_netlogon_dc_infoL s
�z'DomainTrustCommand.get_netlogon_dc_infoc C s |j tjkr |jS |jS r )�
trust_typer �LSA_TRUST_TYPE_DOWNLEVELrb �dns_name�r� �tr� r� r� �netr_DomainTrust_to_nameR s z+DomainTrustCommand.netr_DomainTrust_to_namec C s� d }d }|D ]}|j tj@ r |}|j tj@ s||j } nq|j tj@ r?||u r*dS |j tj@ r2dS ||j }||u r=dS dS |jtj@ rGdS dS )N�Parent�TreeRoot�Child�Shortcut�Forest�External) � trust_flagsr �NETR_TRUST_FLAG_PRIMARY�NETR_TRUST_FLAG_TREEROOT� parent_index�NETR_TRUST_FLAG_IN_FOREST�trust_attributesr �%LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)r� �ar� �primary�primary_parent�_tr� r� r� r� �netr_DomainTrust_to_typeX s*
�
z+DomainTrustCommand.netr_DomainTrust_to_typec C s4 |j tj@ rdS |jtj@ rdS |jtj@ rdS dS )N�Yes�No)r� r r� r� r �"LSA_TRUST_ATTRIBUTE_NON_TRANSITIVEr� r� r� r� r� � netr_DomainTrust_to_transitivet s z1DomainTrustCommand.netr_DomainTrust_to_transitivec C s@ |j tj@ r|j tj@ rdS |j tj@ rdS |j tj@ r dS dS )N�BOTH�INCOMING�OUTGOING�INVALID)r� r �NETR_TRUST_FLAG_INBOUND�NETR_TRUST_FLAG_OUTBOUNDr� r� r� r� � netr_DomainTrust_to_direction� s
� z0DomainTrustCommand.netr_DomainTrust_to_directionFc C sB z|| }W n t y | �|�}d| }Y nw d||f }|S )Nz__unknown__%08X__� 0x%x (%s))�KeyErrorrU )r� �e_dictrT r� ro �v32rF r� r� r� �generic_enum_to_string� s
� z)DomainTrustCommand.generic_enum_to_stringc
C s~ g }|}t |�� �D ]}||@ sq
|| M }||| g7 }q
|dkr.| �|�}|d| g7 }d�|�}|r7|S d||f } | S )Nr z__unknown_%08X__�,r� )�sorted�keysrU r� )
r� �b_dictrT r� r� �c�b�c32ro rF r� r� r� r� � s
z+DomainTrustCommand.generic_bitmap_to_stringc C s( t jdt jdt jdt jdi}| �||�S )N� DOWNLEVEL�UPLEVEL�MIT�DCE)r r� �LSA_TRUST_TYPE_UPLEVEL�LSA_TRUST_TYPE_MIT�LSA_TRUST_TYPE_DCEr� )r� rT �typesr� r� r� �trustType_string� s � z#DomainTrustCommand.trustType_stringc C s( t jt jB dt jdt jdi}| �||�S )Nr� �INBOUND�OUTBOUND)r �LSA_TRUST_DIRECTION_INBOUND� LSA_TRUST_DIRECTION_OUTBOUNDr� )r� rT �
directionsr� r� r� �trustDirection_string� s �� z(DomainTrustCommand.trustDirection_stringc C s@ t jdt jdt jdt jdt jdt jdt jdt jdi}| � ||�S ) N�NON_TRANSITIVE� UPLEVEL_ONLY�QUARANTINED_DOMAIN�FOREST_TRANSITIVE�CROSS_ORGANIZATION�
WITHIN_FOREST�TREAT_AS_EXTERNAL�USES_RC4_ENCRYPTION)
r r� � LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY�&LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAINr� �&LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION�!LSA_TRUST_ATTRIBUTE_WITHIN_FOREST�%LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL�'LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTIONr� )r� rT �
attributesr� r� r� �trustAttributes_string� s �
z)DomainTrustCommand.trustAttributes_stringc C sL t jdt jdt jdt jdt jdt jdt jdt jdt j d t j
d
i
}| � ||�S ) N� DES_CBC_CRC� DES_CBC_MD5� RC4_HMAC_MD5�AES128_CTS_HMAC_SHA1_96�AES256_CTS_HMAC_SHA1_96zAES256_CTS_HMAC_SHA1_96-SK�FAST_SUPPORTED�COMPOUND_IDENTITY_SUPPORTED�CLAIMS_SUPPORTED�!RESOURCE_SID_COMPRESSION_DISABLED) r �KERB_ENCTYPE_DES_CBC_CRC�KERB_ENCTYPE_DES_CBC_MD5�KERB_ENCTYPE_RC4_HMAC_MD5�$KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96�$KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96�'KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96_SK�KERB_ENCTYPE_FAST_SUPPORTED�(KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED� KERB_ENCTYPE_CLAIMS_SUPPORTED�.KERB_ENCTYPE_RESOURCE_SID_COMPRESSION_DISABLEDr� )r� rT �enctypesr� r� r� �kerb_EncTypes_string� s � z'DomainTrustCommand.kerb_EncTypes_stringc C s6 |dkrdS t jdt jdt jdi}d| j||dd� S ) Nr �Status[Enabled]z Disabled-New�DisabledzDisabled-Conflicting�
Status[%s]Tr� )r �LSA_TLN_DISABLED_NEW�LSA_TLN_DISABLED_ADMIN�LSA_TLN_DISABLED_CONFLICTr� �r� �e_flagsrn r� r� r� �entry_tln_status� s �z#DomainTrustCommand.entry_tln_statusc C s< |dkrdS t jdt jdt jdt jdi}d| j||dd � S )
Nr r z Disabled-SIDzDisabled-SID-Conflictingz Disabled-NBzDisabled-NB-Conflictingr Tr� )r �LSA_SID_DISABLED_ADMIN�LSA_SID_DISABLED_CONFLICT�LSA_NB_DISABLED_ADMIN�LSA_NB_DISABLED_CONFLICTr� r r� r� r� �entry_dom_status� s �z#DomainTrustCommand.entry_dom_statusNc C s |d ur d| }nd}| j �dt|j�|f � t|j�D ]h\}}|j}d}|d ur?|jD ]} | j|kr5q-| j}d| jj }q-|j }
|j
t j krX| j �d| �
|�|
j|f � q |j
t jkrj| j �dd|
jf � q |j
t jkr�| j �d| �|�|
jj|
jj|
j|f � q d S )Nz TDO[%s]rs zNamespaces[%d]%s:
z Collision[%s]zTLN: %-32s DNS[*.%s]%s
zTLN_EX: %-29s DNS[*.%s]
z)DOM: %-32s DNS[%s] Netbios[%s] SID[%s]%s
)r� r� r �entries� enumeratern �indexr� rJ �forest_trust_datarM r � LSA_FOREST_TRUST_TOP_LEVEL_NAMEr! �"LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX� LSA_FOREST_TRUST_DOMAIN_INFOr& �dns_domain_name�netbios_domain_namer1 ) r� �fti�tln�
collisions�
tln_stringr� rE rn �collision_stringr� �dr� r� r� �write_forest_trust_info� sD
�
�
� ��z*DomainTrustCommand.write_forest_trust_info)TT)F)NN)"r� r� r� r� rC rU rY r r_ r` rc rk rn rq rr r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r! r& r6 r� r� r� r� rG � sB
�@
rG c @ s2 e Zd ZdZdZejejed�Z g Z
ddd�Z dS )�cmd_domain_trust_listrH r� �r� r� rh Nc
C s | � ||�}z| �� }W n ty } z| �| |d��d }~ww z|�|tjtjB tjB �}W n! tyP } z| � |t
j �rEt d| j
��| �| |d��d }~ww |j}|D ]*} | jtj@ r_qV| j�dd| �|| � d| �| � d| �| � d| �| � f � qVd S ) N�!failed to connect netlogon serverz:LOCAL_DC[%s]: netr_DsrEnumerateDomainTrusts not supported.z$netr_DsrEnumerateDomainTrusts failedz%-14s %-15s %-19s %s
zType[%s]zTransitive[%s]z
Direction[%s]zName[%s])rk rq r� r_ � netr_DsrEnumerateDomainTrustsr r� r� r� rY r � WERR_RPC_S_PROCNUM_OUT_OF_RANGEr rJ �arrayr� r� r� r� r� r� r� r� )
r� r� r� rh rJ �local_netlogonr� �local_netlogon_trustsr� r� r� r� r� r� % sF ���������
�zcmd_domain_trust_list.runr� ) r� r� r� r� r� r� r� r� rA r� r� r� r� r� r� r� r7 s �r7 c @ s8 e Zd ZdZdZejejed�Z g Z
dgZ ddd�Z dS ) �cmd_domain_trust_show� Show trusted domain details.�%prog NAME [options]r8 r� Nc
C s< | � ||�}z| �� }W n ty } z| �| |d��d }~ww z
tj}| �||�\} }
W n ty@ } z| �| |d��d }~ww | j�d|
j j
|
j j
|
j f � t�
� } || _
z|�| | tj�} | j}
| j}W n ty� } z| �|tj�r}td| ��| �| |d��d }~ww z
|�| | tj�}W n6 ty� } z*| �|tj�r�d }| �|tj�r�d }|d ur�| �| |d��t�� }d|_W Y d }~nd }~ww zd }|
j tj @ r�|� | | tj �}W n; t�y } z.| �|tj �r�d }| �|tj!�r�d }|d u�r| �| |d��t�"� }d|_#g |_$W Y d }~nd }~ww | j�d � | j�d
|
j%j
� |
j%j
|
j&j
k�r;| j�d |
j&j
� | j�d |
j � | j�d
| �'|
j(� � | j�d| �)|
j*� � | j�d| �+|
j � � t,�-|j�j.}t,�/|j�j.}| j�d||f � | j�d| �0|j� � |
j tj @ �r�| j1||
j&j
d� d S )N� failed to connect lsa server�#failed to query LSA_POLICY_INFO_DNS�(LocalDomain Netbios[%s] DNS[%s] SID[%s]
�4trusted domain object does not exist for domain [%s]z.QueryTrustedDomainInfoByName(FULL_INFO) failed�?QueryTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failedr z&lsaRQueryForestTrustInformation failedzTrustedDomain:
zNetbiosName: %s
zDnsName: %s
zSID: %s
zType: %s
zDirection: %s
zAttributes: %s
z PosixOffset: 0x%08X (%d)
zkerb_EncTypes: %s
�r1 )2rk rn r� r_ r �!LSA_POLICY_VIEW_LOCAL_INFORMATIONr� r� r� r� rJ r� r� �String� QueryTrustedDomainInfoByName�!LSA_TRUSTED_DOMAIN_INFO_FULL_INFO�info_ex� posix_offsetr rY r � NT_STATUS_OBJECT_NAME_NOT_FOUNDr �-LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES�NT_STATUS_INVALID_PARAMETER� NT_STATUS_INVALID_INFO_CLASS� TrustDomainInfoSupportedEncTypes� enc_typesr� r� � lsaRQueryForestTrustInformationr- �"NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE�NT_STATUS_NOT_FOUND�ForestTrustInformation�countr' rb r� r� r� r� �trust_directionr rQ rR rS �c_int32r r6 )r� r� r� r� rh rJ � local_lsar� �local_policy_access� local_policy�local_lsa_info� lsaString�local_tdo_full�local_tdo_info�local_tdo_posix�local_tdo_enctypes�local_tdo_forest�posix_offset_u32�posix_offset_i32r� r� r� r� V s� �������
�������
���
�� �zcmd_domain_trust_show.runr� )
r� r� r� r� r� r� r� r� rA r� r� r� r� r� r� r� r� r? F s �r? c @ sl e Zd ZdZdZejejed�Z e
dddddd �e
d
dd d dd �e
d
ddddd �gZ dgZ ddd�Z
dS )�cmd_domain_trust_modifyr@ rA r8 z--use-aes-keysrP z!The trust uses AES kerberos keys.� use_aes_keysN�rR rO r� ri �
--no-aes-keysz:The trust does not have any support for AES kerberos keys.�disable_aes_keysz--raw-kerb-enctypes�storez The raw kerberos enctype bits�
kerb_enctypesr� c
C s� d}d} |d ur | d7 } |d ur| d7 } |d ur | d7 } | dkr$t d��| dkr,|d7 }|dkr4t d��| �||�}
z| �� } W n tyS } z| �| | d��d } ~ ww ztj}
|
tjO }
| �| |
�\}}W n tyy } z| �| | d��d } ~ ww | j �
d|j j |j
j |jf � | dk�rYt�� }||_ z
| �||tj�}W n6 ty� } z*| �| tj�r�d } | �| tj�r�d } | d ur�| �| | d��t�� }d|_W Y d } ~ nd } ~ ww | j �
d | �|j� � t�� }|d ur�t|dd
�|_n |d u�rtj |_| jtj O _n|d u�rtj |_nt d ��|j|jk�rSz| � ||tj|�}| j �
d | �|j� � W d S t�yR } z| d u�rG| �| | d
��W Y d } ~ d S d } ~ ww | j �
d� d S )Nr r� zL--no-aes-keys, --use-aes-keys and --raw-kerb-enctypes are mutually exclusivez/modification arguments are required, try --helpz failed to connect to lsa serverrC rD rF zOld kerb_EncTypes: %s
)r� z&Internal error should be checked abovezNew kerb_EncTypes: %s
z=SetTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failedz No kerb_EncTypes update needed
) r rk rn r� r_ r rH �LSA_POLICY_TRUST_ADMINr� r� r� r� rJ r� r� rI rJ rO r rY r rP rQ rR rS r r� r r r r �SetTrustedDomainInfoByName)r� r� r� r� rh rk rh rm �num_modifications� enctype_argsrJ r[ r� r\ r] r^ r_ rc rS r� r� r� r� � s� ��
���
�����
���
�
��� zcmd_domain_trust_modify.run)NNNNNN�r� r� r� r� r� r� r� r� rA r� r r� r� r� r� r� r� r� rg � s6 ������rg c @ s� e Zd ZdZdZejejeje d�Z
e dddddgd d
dd �e d dd
g d�dddd �e dddddgdddd �e dddddd �e d dd g d �d d!d"d �e d#dd$d%dd �e d&dd'd(dd �e d)d*d+d,d-d �e d.d*d/d0d-d �g Z d1gZ
" " " -d4d2d3�Zd"S )5�cmd_domain_trust_createz Create a domain or forest trust.�%prog DOMAIN [options]�r� r� r� rh z--typerS �TYPE�externalr� z.The type of the trust: 'external' or 'forest'.r� �rM rN rW rO r� ri z --direction� DIRECTION)�incoming�outgoing�bothz6The trust direction: 'incoming', 'outgoing' or 'both'.rY r| z--create-location�LOCATION�localz=Where to create the trusted domain object: 'local' or 'both'.�create_locationz--cross-organisationrP z=The related domains does not belong to the same organisation.�cross_organisationFri z
--quarantinedzyes|no)r� r� Nz�Special SID filtering rules are applied to the trust. With --type=external the default is yes. With --type=forest the default is no.�quarantined_argNz--not-transitivez#The forest trust is not transitive.�not_transitivez--treat-as-externalz'The treat the forest trust as external.�treat_as_externalrj � store_falsez)The trust does not use AES kerberos keys.rh Tz--skip-validationz Skip validation of the trust.�validater� c @
s"
t �� }d}|
d u r|dkrd}n|
dkrd}|dkr'| r!td��| r'td��t �� }|
r:tj|_| jtjO _ntj|_t j }|t j
O }|t j O }t � � }t j
|_d|_|d krk| jt jO _| jt jO _n|d
krx| jt jO _n |d kr�| jt jO _d|_| r�| jt jO _|r�| jt jO _|dkr�| jt jO _| r�| jt jO _| r�| jt jO _� fd d
�}d }d }t j }|dkr�|jt j@ r�|d�}t|�d��}|jt j@ r�|d�}t|�d��}d }n�dd� }|jt j@ r�|d�}|jt j@ �r
|d�}|t j
O }|t j O }t � � }t j
|_d|_|d k�r5| jt jO _| jt jO _n|d
k�rC| jt jO _n
|d k�rP| jt jO _d|_| �r^| jt jO _|�ri| jt jO _|dk�rv| jt jO _| �r�| jt jO _| �r�| jt jO _� �||�} z� �� } W n t �y� } z� � � | d��d } ~ ww z
� � | |�\} } W n t �y� } z� � � | d��d } ~ ww � j � d| j!j"| j#j"| j$f � z� �%||�}!W n t �y� } z� �&� | d��d } ~ ww z� �'� }"W n t �y } z� �&� | d��d } ~ ww z
� � |"|�\}#}$W n t �y2 } z� �&� | d��d } ~ ww � j � d|$j!j"|$j#j"|$j$f � |$j#j"|j(_"|$j!j"|j)_"|$j$|_$|�rf| j#j"|j(_"| j!j"|j)_"| j$|_$z|j(j"|_"| �*| |t j+�}%td|j" �� t,�y� } z� �-| t.j/��s�� � � | d|j" ��W Y d } ~ nd } ~ ww z|j)j"|_"| �*| |t j+�}&td|j" �� t,�y� } z� �-| t.j/��sψ � � | d|j" ��W Y d } ~ nd } ~ ww |�rQz|j(j"|_"|"�*|#|t j+�}'td|j" �� t,�y } z� �-| t.j/��s � �&� | d|j" ��W Y d } ~ nd } ~ ww z|j)j"|_"|"�*|#|t j+�}(td|j" �� t,�yP } z� �-| t.j/��sF� �&� | d|j" ��W Y d } ~ nd } ~ ww z� �0� })W n t �yk } z� � � | d ��d } ~ ww z� �1|)| �}*W n t �y� } z� � � | d ��d } ~ ww |�r�z� �2� }+W n t �y� } z� �&� | d ��d } ~ ww z � �3|+|!|�},W n t �y� } z� �&� | d ��d } ~ ww d d � }-t4�5� }.|-||.�}/|-||.�}0zg|�r � j � d � d!d"d#�}1t6|"|#|t j7|0|/�}2� j � d$� |�r � j � d%� d!d&d#�}1|"�8|2t j9|� � j � d'� dd"d#�}1t6| | |t j7|/|0�}3� j � d(� |�r=� j � d)� dd&d#�}1| �8|3t j9|� W nX t �y� } zK� j � d*|1d+ |1d, f � |2�re� j � d-� |"�:|2� d }2|3�ru� j � d.� | �:|3� d }3|1d, d!k�r�� �&� | d/|1d+ ��� � � | d/|1d+ ��d } ~ ww |�rE|jt j@ �rK� j � d0� z
|)�;|*j<|$j#j"t=j>�}4W n t �y� } z� � � | d1��d } ~ ww z
| �?| |$j#t j@|4d�}5W n t �y� } z� � � | d2��d } ~ ww � jA|4|$j#j"|5d3� |�rK� j � d4� z |+�;|,| j#j"t=j>�}6W n t �y } z� �&� | d1��d } ~ ww z
|"�?|#| j#t j@|6d�}7W n t �y@ } z� �&� | d2��d } ~ ww � jA|6| j#j"|7d3� |jt j@ �rLj j � d5� z|)�B|*j<t=jCd6|$j#j"�}8W n t �yz } z� � � | d7��d } ~ ww � �D|8jEd �}9� �D|8jFd �}:|8jGt=jH@ �r�d8|8jI|8jFd9 |8jEd9 f };nd:|8jI|8jFd9 |8jEd9 f };|9tJjKk�s�|:tJjKk�r�t|;��� j � d;|; � |�rE|jt j@ �rE� j � d<� z
|+�B|,t=jCd6| j#j"�}<W n t �y� } z� �&� | d7��d } ~ ww � �D|<jEd �}=� �D|<jFd �}>|<jGt=jH@ �r d=|<jI|<jFd9 |<jEd9 f }?nd>|<jI|<jFd9 |<jEd9 f }?|=tJjKk�s9|>tJjKk�r=t|?��� j � d;|? � |2d u�rgz|"�L|2� W n t �yd } zW Y d } ~ nd } ~ ww d }2|3d u�r�z| �L|3� W n t �y� } zW Y d } ~ nd } ~ ww d }3� j � d?� d S )@NFrw Tr� r� z'--not-transitive requires --type=forestz*--treat-as-external requires --type=forestr r| rz r{ c sL d } |d ur
|dkr
|S t d| �}t d| �}||ks%d }� j�d� q)NTrs zNew %s Password: zRetype %s Password: r� )r r� r� )r� �password�passwordverifyrP r� r� � get_password� s �z1cmd_domain_trust_create.run.<locals>.get_passwordr~ zIncoming Trust� utf-16-lezOutgoing Trustc S s" t �| d | d �}t|�d��S )N� r� )r) � generate_random_machine_passwordr) �encode)�length�pwr� r� r� �random_trust_secret� s z8cmd_domain_trust_create.run.<locals>.random_trust_secret�� rB rC rD � failed to locate remote server�)RemoteDomain Netbios[%s] DNS[%s] SID[%s]
z TrustedDomain %s already exist'z2QueryTrustedDomainInfoByName(%s, FULL_INFO) failedr9 � failed to get netlogon dc infoc S s� | d u r
t �� }d|_|S t �� }t| �|_| |_t �� }t� |�|_
t j |_
||_t �� }d|_|g|_t �� }d|_||_|S )Nr r� )r �trustAuthInOutBlobrX �
AuthInfoClearr �sizer� �AuthenticationInformationr) � unix2nttime�LastUpdateTimer �TRUST_AUTH_TYPE_CLEAR�AuthType�AuthInfo� AuthenticationInformationArrayr< �current)�secret� update_time�blob�clearr! r< r� r� r� �generate_AuthInOutBlobW
s$
z;cmd_domain_trust_create.run.<locals>.generate_AuthInOutBlobzCreating remote TDO.
�remote�CreateTrustedDomainEx2)�locationr� zRemote TDO created.
z2Setting supported encryption types on remote TDO.
�SetInformationTrustedDomainzCreating local TDO.
zLocal TDO created
z1Setting supported encryption types on local TDO.
z$Error: %s failed %sly - cleaning up
r� r� zDeleting remote TDO.
zDeleting local TDO.
�%sz(Setup local forest trust information...
�*netr_DsRGetForestTrustInformation() failed�&lsaRSetForestTrustInformation() failed�r1 r2 z)Setup remote forest trust information...
z Validating outgoing trust...
r� �!NETLOGON_CONTROL_TC_VERIFY failed�GLocalValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNEDr� �0LocalValidation: DC[%s] CONNECTION[%s] TRUST[%s]�OK: %s
z Validating incoming trust...
�HRemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNED�1RemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s]z Success.
)Mr rI r rR r r rS r r rH rn �LSA_POLICY_CREATE_SECRET�TrustDomainInfoInfoExr� r� rY r� r� r� r� r� r� r� r r) r� rk rn r� r_ r� r� r� r� rJ r� r� r� r` r� r� rb rJ rK r rY r rN rq r� r� r� r) �current_unix_timerD � LSA_TRUSTED_DOMAIN_ALL_ACCESSr� rO � DeleteObject�!netr_DsRGetForestTrustInformationr� r �DS_GFTI_UPDATE_TDO� lsaRSetForestTrustInformationr- r6 �netr_LogonControl2Ex�NETLOGON_CONTROL_TC_VERIFYrU �pdc_connection_status�tc_connection_statusrn � NETLOGON_VERIFY_STATUS_RETURNED�trusted_dc_namer � WERR_SUCCESS�Close)@r� r� r� rh r� r� r� rY r r� r� r� r� rh r� r_ � quarantinedrS r\ �local_trust_infor� �incoming_secret�outgoing_secret�remote_policy_access�incoming_password�outgoing_password�remote_trust_infor� rJ r[ r� r] r^ rM �
remote_lsa�
remote_policy�remote_lsa_info�local_old_netbios�
local_old_dns�remote_old_netbios�remote_old_dnsr= �local_netlogon_info�remote_netlogon�remote_netlogon_dc_uncr� r� �
incoming_blob�
outgoing_blob�current_request�remote_tdo_handle�local_tdo_handle�local_forest_info�local_forest_collision�remote_forest_info�remote_forest_collision�local_trust_verify�local_trust_status�local_conn_status�local_validation�remote_trust_verify�remote_trust_status�remote_conn_status�remote_validationr� rP r� r� c sR �
������� �����
���� ���
���� ���
���� ���
���� ��� ���� �����
�
�
�
�� �
�
��� ��������� ��������� ����� ������
��
�� zcmd_domain_trust_create.run)
NNNNNNNFNFFFT�r� r� r� r� r� r� r� r� r� rA r� r r� r� r� r� r� r� r� rs ( s� �����������-�rs c @ �X e Zd ZdZdZejejeje d�Z
e dddddgd d
dd �gZ d gZ
ddd�Zd
S )�cmd_domain_trust_deletezDelete a domain trust.rt ru z--delete-locationrS r} r~ r| z=Where to delete the trusted domain object: 'local' or 'both'.�delete_locationrx r� Nc C s� t j}|t jO }|t jO }|dkrd }n
t j}|t jO }|t jO }| �||�} z| �� }
W n ty@ } z| �| | d��d } ~ ww z
| �|
|�\} }
W n ty^ } z| �| | d��d } ~ ww | j �
d|
j j |
j
j |
jf � d }d }d }d }t �� }z
||_ |
�| |t j�}W n ty� } z| �| tj�r�td| ��| �| | d��d } ~ ww |d u�r�z| �||�}W n ty� } z| �| | d��d } ~ ww z| �� }W n ty� } z| �| | d��d } ~ ww z
| �||�\}}W n t�y } z| �| | d��d } ~ ww | j �
d|j j |j
j |jf � |j|jk�s,|j j |jj k�s,|j
j |jj k�r:td|jj |jj |jf ��z|
j
j |_ |�||t j�}W n% t�yn } z| �| tj��sd| �| | d |j ��W Y d } ~ nd } ~ ww |d u�r�|
j|jk�s�|
j j |jj k�s�|
j
j |jj k�r�td
|jj |jj |jf ��|d u�r�z|jj |_ |
� | |t j �}W n t�y� } z
| �| | d |j ��d } ~ ww |
� |� d }|d u�r�z|jj |_ |� ||t j �}W n t�y� } z
| �| | d |j ��d } ~ ww |d u�r/z|� |� d }| j �
d � W n t�y. } z| j �
d
| �| | d� � W Y d } ~ nd } ~ ww |d u�rfz|
� |� d }| j �
d� W d S t�ye } z| j �
d
| �| | d� � W Y d } ~ d S d } ~ ww d S )Nr~ rB rC rD z$Failed to find trust for domain '%s'r� r� z2LocalTDO inconsistend: Netbios[%s] DNS[%s] SID[%s]z QueryTrustedDomainInfoByName(%s)z3RemoteTDO inconsistend: Netbios[%s] DNS[%s] SID[%s]zOpenTrustedDomainByName(%s)zRemoteTDO deleted.
z%s
zDeleteObject() failedzLocalTDO deleted.
) r rH rn r� rk rn r� r_ r� r� r� r� rJ r� r� rI rJ � LSA_TRUSTED_DOMAIN_INFO_INFO_EXr rY r rN r r` r� r� rb r� �OpenTrustedDomainByNamer �SEC_STD_DELETEr� )r� r� r� rh r� r� r� r\ r� rJ r[ r� r] r^ ra r� �remote_tdo_infor� r_ rM r� r� r� r� r� r� r� E s*
������ ��
�� ������
��
� ��
�
��
���
��
���
&��
�$��zcmd_domain_trust_delete.run�NNNNNr� r� r� r� r� r� / �& ����r� c @ r� )�cmd_domain_trust_validatezValidate a domain trust.rt ru z--validate-locationrS r} r~ r| z?Where to validate the trusted domain object: 'local' or 'both'.�validate_locationrx r� Nc
C s� t j}| �||�}z| �� } W n ty" }
z| �| |
d��d }
~
ww z
| �| |�\} } W n ty@ }
z| �| |
d��d }
~
ww | j�d| j j
| j j
| j f � zt �
� }
||
_
| �| |
t j�}W n ty� }
z| �|
tj�rwtd| ��| �| |
d��d }
~
ww | j�d|jj
|jj
|j f � z| �� }W n ty� }
z| �| |
d��d }
~
ww z
|�|tjd|jj
�}W n ty� }
z| �| |
d ��d }
~
ww | �|j d
�}| �|j d
�}|j tj @ r�d |j |j d |j d f }nd
|j |j d |j d f }|t!j"k�s
|t!j"k�rt|��| j�d| � z|j �#dd�}d|jj
|f }|�|tj$d|�}W n t�yG }
z| �| |
d��d }
~
ww | �|j d
�}d|j |j d f }|t!j"k�rdt|��| j�d| � |dk�rlz
| j%||dd�}W n t�y� }
z| �&| |
d��d }
~
ww z| �'� }W n t�y� }
z| �&| |
d��d }
~
ww z
|�|tjd| j j
�}W n t�y� }
z| �&| |
d ��d }
~
ww | �|j d
�}| �|j d
�} |j tj @ �r�d|j |j d |j d f } nd|j |j d |j d f } |t!j"k�s
| t!j"k�rt| ��| j�d| � z|j �#dd�}d| j j
|f }|�|tj$d|�} W n t�yG }
z| �&| |
d��d }
~
ww | �| j d
�} d| j | j d f } | t!j"k�rdt| ��| j�d| � d S )NrB rC rD rE �,QueryTrustedDomainInfoByName(INFO_EX) failed�%LocalTDO Netbios[%s] DNS[%s] SID[%s]
r9 r� r� r r� r� r� r� �\rs z%s\%sz"NETLOGON_CONTROL_REDISCOVER failedz&LocalRediscover: DC[%s] CONNECTION[%s]r~ F)r� r� r� r� z'RemoteRediscover: DC[%s] CONNECTION[%s])(r rH rk rn r� r_ r� r� r� r� rJ r� r� rI rJ r� r rY r rN r rb r� rq r� r r� rU r� r� rn r� r� r r� �replace�NETLOGON_CONTROL_REDISCOVERr� r` r� ) r� r� r� r� r� rh r� r\ rJ r[ r� r] r^ r_ ra r= r� r� r� r� r\ �domain_and_server�local_trust_rediscover�local_rediscoverrM r� r� r� r� r� �remote_trust_rediscover�remote_rediscoverr� r� r� r� � s4 ������� ��� ������ �������
�� ������������� z cmd_domain_trust_validate.runr� r� r� r� r� r� r� � r� r� c @ s\ e Zd ZdZdZejejed�Z e
dddg d�dd d
d �e
d d
dddd�e
dddddg d�e
dddddg d�e
dddd d g d�e
d ddd d g d�e
d!dd"d#d$g d�e
d%dd"d&d'g d�e
d(dd)d*d+g d�e
d,dd)d-d.g d�e
d/ddd0d1g d�e
d2ddd3d4g d�e
d5ddd6d7g d�e
d8ddd9d:g d�gZ d;gZ d
d
d
d
d
dg g g g g g g g g g g g fd<d=�Z
d
S )>�cmd_domain_trust_namespacesz Manage forest trust namespaces.z%prog [DOMAIN] [options]r8 z --refreshrS z check|store)�checkrl NzLList and maybe store refreshed forest trust information: 'check' or 'store'.�refreshNrx z --enable-allrP zATry to update disabled entries, not allowed with --refresh=check.�
enable_allFri z --enable-tlnr� � DNSDOMAINz?Enable a top level name entry. Can be specified multiple times.�
enable_tln)rR rN rO r� ri z
--disable-tlnz@Disable a top level name entry. Can be specified multiple times.� disable_tlnz --add-tln-exzAAdd a top level exclusion entry. Can be specified multiple times.�
add_tln_exz--delete-tln-exzDDelete a top level exclusion entry. Can be specified multiple times.�
delete_tln_exz --enable-nb�
NETBIOSDOMAINzIEnable a netbios name in a domain entry. Can be specified multiple times.� enable_nbz --disable-nbzJDisable a netbios name in a domain entry. Can be specified multiple times.�
disable_nbz --enable-sid� DOMAINSIDz@Enable a SID in a domain entry. Can be specified multiple times.�enable_sid_strz
--disable-sidzADisable a SID in a domain entry. Can be specified multiple times.�disable_sid_strz--add-upn-suffixzVAdd a new uPNSuffixes attribute for the local forest. Can be specified multiple times.�add_upnz--delete-upn-suffixz^Delete an existing uPNSuffixes attribute of the local forest. Can be specified multiple times.�
delete_upnz--add-spn-suffixz[Add a new msDS-SPNSuffixes attribute for the local forest. Can be specified multiple times.�add_spnz--delete-spn-suffixzcDelete an existing msDS-SPNSuffixes attribute of the local forest. Can be specified multiple times.�
delete_spnzdomain?c G C s� d}|d u r�|dkrt d| ��|rt d��t|�dkr t d��t|�dkr*t d��t| �dkr4t d��t|
�dkr>t d ��t|
�dkrHt d
��t|�dkrRt d ��t| �dkr\t d ��t| �dkrft d
��t|�dkr~|D ]
}|�d�svqnt d| ��d}t|�dkr�|D ]
}|�d�s�q�t d| ��d}|D ]}|D ]}|�� |�� kr�q�t d| ��q�t|�dkr�|D ]
}|�d�s�q�t d| ��d}t|�dkr�|D ]
}|�d�s�q�t d| ��d}|D ]}|D ]}|�� |�� kr�q�t d| ��q�n,t|�dk�rt d��t|�dk�r
t d��t|�dk�rt d��t|�dk�r#t d��|d u�r�|dk�r/d}|�r=|dk�r=t d| ��t|�dk�rHt d��t|�dk�rSt d ��t| �dk�r^t d ��t|
�dk�rit d ��t|
�dk�rtt d ��t|�dk�rt d ��t| �dk�r�t d!��t| �dk�r�t d"���nJ|�r�d}t|�dk�r�t d#��t|
�dk�r�t d$��t| �dk�r�t d%��t|�dk�r�d}t|�dk�r�d}|D ]}|D ]}|�� |�� k�r�q�t d&| ���q�t| �dk�r| D ]}|�d��s��q�t d'| ��d}t|
�dk�r |
D ]}|�d��s�qt d(| ��d}| D ]}|
D ]}|�� |�� k�r3�q&t d)| ���q"t|
�dk�rDd}t|�dk�rMd}|
D ]}|D ]}|�� |�� k�r`�qSt d*| ���qOg }| D ]#}zt�|�}W n t�y� } zt d+| ��d }~ww |�|� �qlg } | D ]#}zt�|�}W n t�y� } zt d,| ��d }~ww | �|� �q�t|�dk�r�d}t| �dk�r�d}|D ]}| D ]}||k�rِq�t d-| ���q�t j
} |�r�| t j O } | � ||�} z| �
� } W n t�y } z| �| |d.��d }~ww z
| �| | �\} }!W n t�y+ } z| �| |d/��d }~ww | j�d0|!jj|!jj|!jf � |d u �r�z| �� }"W n t�y[ } z| �| |d1��d }~ww z| �|"| �}#W n t�yx } z| �| |d2��d }~ww |#j|#jk�r�t d3|#j|#jf ��z
|"�|#j d d�}$W nA t�y� } z4| � |t j ��r�t d4| j ��| � |t j!��r�t d4| j ��| � |t j"��r�t d4| j ��| �| |d5��d }~ww | j�d6� | j#|$|!jjd7� z| �$� }%W n t�y� } z| �| |d8��d }~ww d9t%|%�&� � }&d:d;g}'z|%j'|&t(j)d<|'d=�}(|(d })W n t(j*�y1 } z| �+| |d>��d }~ww g }*d:|)v �r@|*�,|)d: � g }+d;|)v �rN|+�,|)d; � | j�d?t|*� � |*D ]
},| j�d@dA|,f � �qZ| j�dBt|+� � |+D ]
},| j�d@dA|,f � �qt|�s�d S d}-g }.|.�,|*� d}/g }0|0�,|+� |D ]%}1t-|.�D ]\}2},t%|,��� |1�� k�r�t dC|1 ���q�|.�|1� d}-�q�|D ]/}1d }3t-|.�D ]\}2},t%|,��� |1�� k�rܐq�|2}3 |3d u �r�t dD|1 ��|.�.|3� d}-�q�|D ]%}4t-|0�D ]\}2},t%|,��� |4�� k�rt dE|4 ���q�|0�|4� d}/�q�|D ]/}4d }3t-|0�D ]\}2},t%|,��� |4�� k�r6�q%|2}3 |3d u �rDt dF|4 ��|0�.|3� d}/�q | j�dGt|.� � |.D ]
},| j�d@dA|,f � �qY| j�dHt|0� � |0D ]
},| j�d@dA|,f � �qst(�/� }5|)j0|5_0|-�r�t(�1|.t(j2d:�|5d:< |/�r�t(�1|0t(j2d;�|5d;< z|%�3|5� W n t(j*�y� } z| �+| |dI��d }~ww z
|"�|#j d d�}6W n t�y� } z| �| |d5��d }~ww | j�dJ� | j#|6|!jjd7� d S zt �4� }7||7_| �5| |7t j6�}8W n" t7�y# } z| � |t8j9��rt dK| ��| �| |dL��d }~ww | j�dM|8j:j|8jj|8jf � |8j;t j<@ �sAt dN| ��|d u�r!z| �� }"W n t�y` } z| �| |d1��d }~ww z| �|"| �}#W n t�y} } z| �| |d2��d }~ww dO}9|dk�r�t=j>}:|�r�d}9nd}:z |"�|#j |8jj|:�};W n t�y� } z| �| |d5��d }~ww z
| �?| |8jt j@|;|9�}<W n t�y� } z| �| |dP��d }~ww | j�dQ� | j#|;|8jj|<dR� |dk�r zt �4� }7|8jj|7_| �A| |7t j@�}6W n t�y } z| �| |dS��d }~ww | j�dJ� | j#|6|8jjd7� d S zt �4� }7|8jj|7_| �A| |7t j@�}=W n t�yH } z| �| |dS��d }~ww | j�dT� | j#|=|8jjd7� |�s]d S g }>|>�,|=jB� t �C� }?t|>�|?_D|>|?_B|�r�t-|?jB�D ]+\}2}@|@jEt jFk�r��qy|?jB|2 jGdk�r��qyd|?jB|2 _H|?jB|2 jGt jI M _G�qyt-|?jB�D ]7\}2}@|@jEt j@k�r��q�|?jB|2 jGdk�rq�d|?jB|2 _H|?jB|2 jGt jJ M _G|?jB|2 jGt jK M _G�q�|D ]T}Ad }3t-|?jB�D ] \}2}@|@jEt jFk�r��q�|@jLj�� |A�� k�r�q�|2}3 |3d u �rt dU|A ��|?jB|3 jGt jI@ �s%t dV|A ��d|?jB|3 _H|?jB|3 jGt jI M _G�q�|D ]_}Ad }3t-|?jB�D ] \}2}@|@jEt jFk�rQ�qD|@jLj�� |A�� k�r^�qD|2}3 |3d u �rlt dW|A ��|?jB|3 jGt jM@ �r|t dX|A ��d|?jB|3 _H|?jB|3 jGt jI M _G|?jB|3 jGt jMO _G�q;| D ]�}Bd }3t-|?jB�D ] \}2}@|@jEt jNk�r��q�|@jLj�� |B�� k�r��q�|2}3 |3d u�r�t dY|B ��dZ|B�� }Cd }3t-|?jB�D ]*\}2}@|@jEt jFk�r�q�dZ|@jLj�� }D|C|Dk�r�t d[|B ��|C�O|D�� s�q�|2}3 |3d u � rt d\|B ��t �P� }@t jN|@_Ed|@_Gd|@_H|B|@jL_g }>|>�,|?jB� |>�Q|3dO |@� t|>�|?_D|>|?_B�q�|
D ]G}Bd }3t-|?jB�D ] \}2}@|@jEt jNk� rU� qH|@jLj�� |B�� k� rb� qH|2}3 |3d u � rpt d]|B ��g }>|>�,|?jB� |>�.|3� t|>�|?_D|>|?_B� q?|
D ]U}Ed }3t-|?jB�D ] \}2}@|@jEt j@k� r�� q�|@jLjRj�� |E�� k� r�� q�|2}3 |3d u � r�t d^|E ��|?jB|3 jGt jJ@ � s�t d_|E ��d|?jB|3 _H|?jB|3 jGt jJ M _G� q�|D ]`}Ed }3t-|?jB�D ] \}2}@|@jEt j@k� r�� q�|@jLjRj�� |E�� k�
r� q�|2}3 |3d u �
rt d`|E ��|?jB|3 jGt jS@ �
r#t da|E ��d|?jB|3 _H|?jB|3 jGt jJ M _G|?jB|3 jGt jSO _G� q�|D ]P}d }3t-|?jB�D ]\}2}@|@jEt j@k�
rZ�
qM|@jLjT|k�
rc�
qM|2}3 |3d u �
rqt db| ��|?jB|3 jGt jK@ �
s�t dc|E ��d|?jB|3 _H|?jB|3 jGt jK M _G�
qD| D ][}d }3t-|?jB�D ]\}2}@|@jEt j@k�
r��
q�|@jLjT|k�
r��
q�|2}3 |3d u �
r�t dd| ��|?jB|3 jGt jU@ �
r�t de|E ��d|?jB|3 _H|?jB|3 jGt jK M _G|?jB|3 jGt jUO _G�
q�z
| �?| |8jt j@|?d�}FW n t� y } z| �| |dP��d }~ww | j�df� | j#|?|8jj|FdR� zt �4� }7|8jj|7_| �A| |7t j@�}6W n t� yL } z| �| |dS��d }~ww | j�dJ� | j#|6|8jjd7� d S )gNFrl z'--refresh=%s not allowed without DOMAINz'--enable-all not allowed without DOMAINr z'--enable-tln not allowed without DOMAINz(--disable-tln not allowed without DOMAINz'--add-tln-ex not allowed without DOMAINz*--delete-tln-ex not allowed without DOMAINz&--enable-nb not allowed without DOMAINz'--disable-nb not allowed without DOMAINz'--enable-sid not allowed without DOMAINz(--disable-sid not allowed without DOMAINz*.zEvalue[%s] specified for --add-upn-suffix should not include with '*.'TzHvalue[%s] specified for --delete-upn-suffix should not include with '*.'z@value[%s] specified for --add-upn-suffix and --delete-upn-suffixzEvalue[%s] specified for --add-spn-suffix should not include with '*.'zHvalue[%s] specified for --delete-spn-suffix should not include with '*.'z@value[%s] specified for --add-spn-suffix and --delete-spn-suffixz1--add-upn-suffix not allowed together with DOMAINz4--delete-upn-suffix not allowed together with DOMAINz1--add-spn-suffix not allowed together with DOMAINz4--delete-spn-suffix not allowed together with DOMAINz3--enable-all not allowed together with --refresh=%sz0--enable-tln not allowed together with --refreshz1--disable-tln not allowed together with --refreshz0--add-tln-ex not allowed together with --refreshz3--delete-tln-ex not allowed together with --refreshz/--enable-nb not allowed together with --refreshz0--disable-nb not allowed together with --refreshz0--enable-sid not allowed together with --refreshz1--disable-sid not allowed together with --refreshz3--enable-tln not allowed together with --enable-allz2--enable-nb not allowed together with --enable-allz3--enable-sid not allowed together with --enable-allz6value[%s] specified for --enable-tln and --disable-tlnzAvalue[%s] specified for --add-tln-ex should not include with '*.'zDvalue[%s] specified for --delete-tln-ex should not include with '*.'z8value[%s] specified for --add-tln-ex and --delete-tln-exz4value[%s] specified for --enable-nb and --disable-nbz7value[%s] specified for --enable-sid is not a valid SIDz8value[%s] specified for --disable-sid is not a valid SIDz6value[%s] specified for --enable-sid and --disable-sidrB rC rD r9 r� z1The local domain [%s] is not the forest root [%s]z@LOCAL_DC[%s]: netr_DsRGetForestTrustInformation() not supported.r� z Own forest trust information...
rG zfailed to connect to SamDBr� � uPNSuffixeszmsDS-SPNSuffixesz (objectClass=crossRefContainer)r� z failed to search partition dnz#Stored uPNSuffixes attributes[%d]:
zTLN: %-32s DNS[*.%s]
rs z(Stored msDS-SPNSuffixes attributes[%d]:
zBEntry already present for value[%s] specified for --add-upn-suffixz?Entry not found for value[%s] specified for --delete-upn-suffixzBEntry already present for value[%s] specified for --add-spn-suffixz?Entry not found for value[%s] specified for --delete-spn-suffixz#Update uPNSuffixes attributes[%d]:
z(Update msDS-SPNSuffixes attributes[%d]:
z failed to update partition dnz#Stored forest trust information...
rE r� r� zItrusted domain object for domain [%s] is not marked as FOREST_TRANSITIVE.r� r� z"Fresh forest trust information...
r� z(lsaRQueryForestTrustInformation() failedz"Local forest trust information...
z8Entry not found for value[%s] specified for --enable-tlnzGEntry found for value[%s] specified for --enable-tln is already enabledz9Entry not found for value[%s] specified for --disable-tlnzIEntry found for value[%s] specified for --disable-tln is already disabledz>Entry already present for value[%s] specified for --add-tln-exz.%sz:TLN entry present for value[%s] specified for --add-tln-exz>No TLN parent present for value[%s] specified for --add-tln-exz;Entry not found for value[%s] specified for --delete-tln-exz7Entry not found for value[%s] specified for --enable-nbzFEntry found for value[%s] specified for --enable-nb is already enabledz7Entry not found for value[%s] specified for --delete-nbzHEntry found for value[%s] specified for --disable-nb is already disabledz8Entry not found for value[%s] specified for --enable-sidzGEntry found for value[%s] specified for --enable-sid is already enabledz8Entry not found for value[%s] specified for --delete-sidzIEntry found for value[%s] specified for --disable-sid is already disabledz$Updated forest trust information...
)Vr r rK r r r r- � TypeErrorr� r rH rn rk rn r� r_ r� r� r� r� rJ r� r� rq r� r� � forest_namer� r� rY r r; rJ �WERR_INVALID_FUNCTION�WERR_NERR_ACFNOTLOADEDr6 rr r� r� r� r� r� r� rc rT r( �popr� r� r� r� r� rI rJ r� r r rN rb r� r� r r� r� r- rT r' rW rX rM r+ rn �time�LSA_TLN_DISABLED_MASK�LSA_NB_DISABLED_MASK�LSA_SID_DISABLED_MASKr* r r, �endswith�ForestTrustRecord�insertr/ r$ r1 r" )Gr� r� r� rh r� r� r� r r r r r r r r r
r r r
�require_update�nr� r5 rE �
enable_sidr� r� r� � disable_sidr\ rJ r[ r] r^ r= r� �own_forest_info� local_samdb�local_partitions_dnr� r �
stored_msg�stored_upn_vals�stored_spn_valsrT � replace_upn�update_upn_vals� replace_spn�update_spn_vals�upnr� �idx�spn�
update_msg�stored_forest_infor_ ra �lsa_update_check�netlogon_update_tdo�fresh_forest_info�fresh_forest_collisionr� r' �update_forest_inforF r1 �tln_ex�tln_dot�r_dot�nb�update_forest_collisionr� r� r� r� � s
�
��
� � � � �� ��
�
�����
����������� � ��� ��
��
��
������� ��� ���
����
��������� �
���� �
���� �
��� �
��� �z cmd_domain_trust_namespaces.runrr r� r� r� r� r� � s� ����������������<�r� c @ sb e Zd ZdZdZedddeddd�ed d
ed �ed d
ed �gZdgZ e
j e
j e
j
d�Zdd� ZdS )� cmd_domain_tombstones_expungezZExpunge tombstones from the database.
This command expunges tombstones from the database.z %prog NC [NC [...]] [options]r� r� r� r� r� r� z--current-timezQThe current time to evaluate the tombstone lifetime from, expressed as YYYY-MM-DDra z--tombstone-lifetimez2Number of days a tombstone should be preserved forznc*r� c
O sz |� d�}|� d�}|� d�}|� d�}|� d�}|�� }|�|�} t|t� | |d�}
|d u rA|d u rAtd| jd� td | jd� |d urSt�|d
�} t t�
| ��} nt t�� �} t |�d kr}|
j d d t
jd
gd�}
g }|
d d
D ] }|�t|�� qrnt|�}d}z|
�� d}|
j|| |d�\}}W n ty� } z |r�|
�� td|��d }~ww |
�� | j�d||f � d S )Nr� r� r� � current_time�tombstone_lifetimer� ztNote: without --current-time or --tombstone-lifetime only tombstones already scheduled for deletion will be deleted.)rB z5To remove all tombstones, use --tombstone-lifetime=0.z%Y-%m-%dr rs �namingContexts)r� r� r� r� FT)r9 r: z.Failed to expunge / garbage collect tombstonesz-Removed %d objects and %d links successfully
)r r� rf r
r r� r� r �strptimer� �mktimer r� r� r� r� r� �list�transaction_start�garbage_collect_tombstonesr, �transaction_cancelr �transaction_commitr� )r� �ncs�kwargsr� r� r� �current_time_stringr: r� ra r� �current_time_objr9 r� r� �started_transaction�removed_objects�
removed_linksr� r� r� r� r� � sd
��� ����
��
�z!cmd_domain_tombstones_expunge.runN)r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r8 m s$
�� � � r8 c @ sZ e Zd ZdZi Ze� ed< e� ed< e� ed< e� ed< e � ed< e
� ed< e � ed< d S )
�cmd_domain_trustz#Domain and forest trust management.r> r� �creater� ro r� �
namespacesN) r� r� r� r� r4 r7 r? rs rg r� r� r� r� r� r� r� rJ � s
rJ c @ s e Zd ZdZi Ze� ed< dS )�cmd_domain_tombstonesz0Domain tombstone and recycled object management.�expungeN)r� r� r� r� r4 r8 r� r� r� r� rM � s rM c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �ldif_schema_updatez-Helper class for applying LDIF schema updatesc C s d| _ d | _d | _d| _d S )NFrs )�
is_defunct� unknown_oidr� �ldifrP r� r� r� rC � s
zldif_schema_update.__init__c C sR |j \}}|tjkr| jrtd| j � dS | jdur'td| j| jf � dS dS )z>Checks if we can safely ignore failure to apply an LDIF updatez)Defunct object %s doesn't exist, skippingTNz%Skipping unknown OID %s for object %sF)r� r� �ERR_NO_SUCH_OBJECTrP r� r� rQ )r� r� �numr] r� r� r� �can_ignore_failure� s
z%ldif_schema_update.can_ignore_failurec
C s� z:z
|j | jdgd� W W d S tjy: } z |jd tjkr-|�� |j | jdgd� n� W Y d}~W d S d}~ww tjyi } z"| �|�rOW Y d}~dS td| � td� td� td| j � � d}~ww )
z*Applies a single LDIF update to the schemazrelax:0)r� r N�
Exception: %sz4Encountered while trying to apply the following LDIFz4----------------------------------------------------r� r� ) � modify_ldifrR r� r� r� � ERR_INVALID_ATTRIBUTE_SYNTAX�set_schema_update_nowrU r� )r� r� rE r� r� r� �apply� s. � ���
��zldif_schema_update.applyN)r� r� r� r� rC rU rZ r� r� r� r� rO � s
rO c @ s� e Zd ZdZdZejejejd�Z e
ddde ddd �e
d
d d d
d�e
dddd
d�e
dddddgddd�e
de ddd �e
d e dd d �gZ d d � Z
d!d"� Zd#d$� ZdS )%�cmd_domain_schema_upgradezDomain schema upgradingr� rY r� r� r� r� r� r� r\ r] r^ rP r_ rj rk rl z--schemarS �SCHEMArH rI �<The schema file to upgrade to. Default is (Windows) 2012_R2.rh z
--ldf-fileNzBJust apply the schema updates in the adprep/.LDF file(s) specified)rM ri rO z
--base-dirz4Location of ldf files Default is ${SETUPDIR}/adprep.c C s� d}t � }|D ]�}|�� }|dkr"|jdkrq||�|�7 }t � }q|�� �d�r9|dtd� � t|�� � }n|�� �d�rO|dtd� � t|�� � }|� d�}|d �
� dkrc|d � � |_ |d �
� d kr{|�
� �
d
d �}|�
� �
d d
�}|d �
� dv r�|\}}d|v r�|j|�� d||f dgd�} t| �dkr�||_nt| d d d �}
|�
|d|
�}|d �
� dkr�|d � � �
� dkr�d|_|d �
� dkr�|d � � �
� dkr�d}| j|d 7 _q|S )z�
Applies a series of updates specified in an .LDIF file. The .LDIF file
is based on the adprep Schema updates provided by Microsoft.
r rs zDC=XNzCN=X�:r� r� �
changetypez: ntdsschemaaddz: addz: ntdsschemamodifyz: modify)�rdnattid�
subclassof�systemposssuperiors�systemmaycontain�systemauxiliaryclassr� z!(|(attributeId=%s)(governsId=%s))�ldapDisplayNamer� r� � isdefunct�trueT�add�showinadvancedviewonlyz replace: showInAdvancedViewOnlyr� )rO r� rR rZ r r r r� r� r| r r} r� r� r� r� rQ rP ) r� r� � ldif_filerX �ldif_oprN �values�_rS r� � display_namer� r� r� �_apply_updates_in_file! sV
�
�
�� $$z0cmd_domain_schema_upgrade._apply_updates_in_filec C s` t d| � d}zttj�||��}| �||�}W |r |�� n|r'|�� w w t d| � |S )zBWrapper function for parsing an LDIF file and applying the updateszApplying %s updates...Nz%u changes applied)r� rt ru r" r� ro r{ )r� r� � update_file�base_dirrj rX r� r� r� �
_apply_updatet s ��
� z'cmd_domain_schema_upgrade._apply_updatec !
K s� zddl m} W n ty } z | j�d| � td��d }~ww ddlm} d}|�d�}|�d�}|� � }|�
|�} |�d �}
|�d
�} |�d �} |�d �}
d }t |
t � | |d
�}|�d�d u rn|�
dd� td� d}t�||�� �}t|t|�� �d
�}||kr�td��| r�| �d�}n�g }|�| �}|j|�� tjdgd�}t|�dkr�td��t|d d d �d }td�}|
d u r�t � � }td�}z|||� W n t y� } ztd| � t � |� td��d }~ww |}
t!||d �D ]j}d | }|�"|� t#j$�%t#j$�&||d ��}|�r_t#j$�'|��r_zt(j)d |d |gt(j*t(j*|d �}W n t+t,f�y; t � |� td!��w |�-� \} } |j.�rWtd"| | f � t � |� td��td#||f � q�|
d u �ritd$�}
|�/� d} d} z'|D ] } | | �0|| |
�7 } �qt| dk�r�|�1� td%� ntd&� |�2� W n# t �y� } ztd'| � td(� |�2� d} W Y d }~nd }~ww |�r�|�
dd)� |�r�t � |� | �r�td��d S )*Nr )�read_ms_markdownz#Exception in importing markdown: %sz Failed to import module markdown)�SchemaFr� r� r� �schema�ldf_filerq r� �dsdb:schema update allowedr� �;Temporarily overriding 'dsdb:schema update allowed' settingT�%This server is not the schema master.r� �
objectVersion)r� r� r� r� z*Could not determine current schema versionzadprep/WindowsServerDocsz*adprep/WindowsServerDocs/Schema-Updates.mdz!Exception in markdown parsing: %szFailed to upgrade schemaz Sch%d.ldfz.diff�patchz-i)rp rq �cwdz6Failed to upgrade schema. Is '/usr/bin/patch' missing?zException in patch: %s
%szPatched %s using %s�adprepzSchema successfully updatedz No changes applied to schemarV z*Error encountered, aborting schema upgrader� )3�samba.ms_schema_markdownrs � ImportErrorr� r� r � samba.schemart r r� rf r
r rr r� r� r� �get_dsServiceNamer r� r� r| � get_versionr� r� r r� r= r% �mkdtempr, �shutil�rmtree�ranger� ru r" r' r� rw rw rx ry �OSError�IOErrorrz �
returncoder? rr rB rA )!r� rD rs rE rt �updates_allowed_overriddenr� r� r� ra r� �
target_schema� ldf_filesrq � temp_folderr� �own_dn�master�schema_updatesr� r� �start�diff_dirrp �version�update�diffr� rp rq rX �error_encounteredrj r� r� r� r� � s� ��
�
�
��
�
�
�
� ��
�z cmd_domain_schema_upgrade.run)r� r� r� r� r� r� r� r� r� r� r r� r� ro rr r� r� r� r� r� r[ s6 �
�����S r[ c @ s� e Zd ZdZdZejejejd�Z e
ddde ddd �e
d
d d d
d�e
dddd
d�e
dddg d�ddd�e
dd
dd�e
d d
d d�gZ d d � Z
d S )!�cmd_domain_functional_prepz#Domain functional level preparationr� rY r� r� r� r� r� r� r\ r] r^ rP r_ rj rk rl r� rS �FUNCTION_LEVELrF r] rI rh z
--forest-prepzJRun the forest prep (by default, both the domain and forest prep are run).rQ z
--domain-prepzJRun the domain prep (by default, both the domain and forest prep are run).c
K sH d}|� d�}|� d�}|�� }|�|�}|� d�}t|� d� }|� d�} |� d�}
t|t� ||d�} |� d �d u rG|�d d
� td � d }| d u rS|
d u rSd } d }
t� | | �
� �} | rot | t | �
� �d
�}
| |
krotd��|
r�| �� }d| }t | |d�}
| |
kr�td��| r�| �� d}z!ddlm} || d d�}|�g d�� |j|td d� | �� W n ty� } ztd| � | �� d }W Y d }~nd }~ww |
�r| �� d}zddlm} || d d�}|j|td d� | �� W n t�y } ztd| � | �� d }W Y d }~nd }~ww |�r|�d d� |�r"td��d S )NFr� r� r� r: � forest_prep� domain_prepr� rw r� rx Tru ry zCN=Infrastructure,�infrastructurez-This server is not the infrastructure master.r )� ForestUpdate)�fix)�5 �O �P �Q �R �S )�update_revisionrV )� DomainUpdater� z!Failed to perform functional prep) r r� rf �string_version_to_constantr
r rr r� r� r� r� r r� r� r r� r? �samba.forest_updater� �check_updates_iterator� check_updates_functional_levelr1 rB r, rA �samba.domain_updater� r0 )r� rD r� r� r� r� ra r� � target_levelr� r� r� r� r� r� �infrastructure_dnr� r� r� rE r� r� r� r� r� r� s�
�� � �� � �� �z cmd_domain_functional_prep.runNr r� r� r� r� r� s2 �
����� r� c @ s� e Zd ZdZi Zedure� ed< e� ed< e� ed< e� r\e � ed< e
� ed< e � ed< e � ed < e
� ed
< e� ed < e� ed < e� ed
< e� ed< e� ed< e� ed< e� ed< dS dS )�
cmd_domainzDomain management.N� exportkeytabr! r� �demoter: �dcpromo�level�passwordsettings�classicupgrade�
samba3upgrade�trust�
tombstones�
schemaupgrade�functionalprep�backup)r� r� r� r� r4 r� r� rj r, r� r� rX r� r2 r5 r> rJ rM r[ r� rB r� r� r� r� r� o s*
�r� )�� samba.getopt�getoptr� r� ru r� rQ �randomr% �loggingrw r r� r) r r r r � samba.netr r r � samba.ntacls�
samba.joinr
r �
samba.authr � samba.samdbr
r � samba.ndrr r � samba.dcerpcr r r r r r r �samba.dcerpc.samrr r � samba.netcmdr r r r �samba.netcmd.fsmor �samba.netcmd.commonr r r! r" � samba.samba3r# r$ r| �
samba.upgrader% �samba.drs_utilsr& r' r( r) �samba.auth_utilr* � samba.net_s3r � samba.paramr+ r, �
samba.dsdbr- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 �samba.provisionr: r; r< r= �samba.provision.commonr> r? r@ �samba.netcmd.psorA �samba.netcmd.domain_backuprB � samba.commonrC �samba.trust_utilsrD rE r� r� rU ri rW r� r r� r� r� rX rj r� r� r r r2 r5 r> r� rA rG r7 r? rg rs r� r� r� r8 rJ rM rO r[ r� r� r� r� r� r� �<module> s( < �������� �����
� J;g , k@ Q
/jx " 4 oN
8 j