File: //proc/1233/root/usr/lib/python3/dist-packages/samba/__pycache__/domain_update.cpython-310.pyc
o
�/a�; �
@ s� d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dlm Z d dl
m Z d dl m
Z
d dlmZmZmZmZmZ d Zd
Zd d d
ddddd�Zededed
ed
ediZededededediZg ZG dd � d e�ZG d d � d e �Z dS ) � N)� b64encode)�sd_utils)�
ndr_unpack�ndr_pack)�security)� SECINFO_DACL)�'get_managed_service_accounts_descriptor)�DS_DOMAIN_FUNCTION_2008�DS_DOMAIN_FUNCTION_2008_R2�DS_DOMAIN_FUNCTION_2012�DS_DOMAIN_FUNCTION_2012_R2�DS_DOMAIN_FUNCTION_2016�K �Q z$5e1574f6-55df-493e-a671-aaeffca6a100z$d262aae8-41f7-48ed-9f35-56bbb677573dz$82112ba0-7e4c-4a44-89d9-d46c9612bf91z$c3c927a6-cc1d-47c0-966b-be8f9b63d991z$54afcfb9-637a-4251-9f47-4d50e7021211z$f4728883-84dd-483c-9897-274f2ebcf11ez$ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff)r �L �M �N �O �P r �J r �X � � � �
� c @ s e Zd ZdS )�DomainUpdateExceptionN)�__name__�
__module__� __qualname__� r r �5/usr/lib/python3/dist-packages/samba/domain_update.pyr J s r c @ s� e Zd ZdZ d&dd�Z d'dd�Zd d
� Zd(d d
�Zdd� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� ZdS ))� DomainUpdatez2Check and update a SAM database for domain updatesFTc C s� || _ || _|| _d| _| j �� | _| j �� | _| j �� | _t �
|�| _ t � |�
� �| _| j �� | _| j�d�s<td��| j �� | _| j�d�sLtd��dS )z�
:param samdb: LDB database
:param fix: Apply the update if the container is missing
:param add_update_container: Add the container at the end of the change
:raise DomainUpdateException:
Fz(CN=Operations,CN=DomainUpdates,CN=Systemz+Failed to add domain update container childz3CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=Systemz#Failed to add revision object childN)�samdb�fix�add_update_container�check_update_applied�get_config_basedn� config_dn� domain_dn�get_schema_basedn� schema_dnr �SDUtilsr �dom_sid�get_domain_sid�
domain_sid�get_root_basedn�domainupdate_container� add_childr �revision_object)�selfr# r$ r% r r r! �__init__Q s �zDomainUpdate.__init__Nc C s� | j j| jdgtjd�}t| }|rt| }|d7 }nt}| �||� t| }t |d d d �}|rQ||k rS| j
sBt d||f ��| j � dt
| j�|f � dS dS dS )a
Apply all updates for a given old and new functional level
:param functional_level: constant
:param old_functional_level: constant
:param update_revision: modify the stored version
:raise DomainUpdateException:
�revision)�base�attrs�scope� r zERevision is not high enough. Fix is set to False.
Expected: %dGot: %dz9dn: %s
changetype: modify
replace: revision
revision: %d
N)r# �searchr3 �ldb�
SCOPE_BASE� functional_level_to_max_update�
MIN_UPDATE�check_updates_range�functional_level_to_version�intr$ r � modify_ldif�str) r4 �functional_level�old_functional_level�update_revision�res�expected_update�
min_update�expected_version�
found_versionr r r! � check_updates_functional_leveln s,
�
��
��z+DomainUpdate.check_updates_functional_levelc C s8 |D ]}|t k s |tkrtd��t| d| �|� qdS )z�
Apply a list of updates which must be within the valid range of updates
:param iterator: Iterable specifying integer update numbers to apply
:raise DomainUpdateException:
�Update number invalid.� operation_%dN)r? �
MAX_UPDATEr �getattr)r4 �iterator�opr r r! �check_updates_iterator� s
�z#DomainUpdate.check_updates_iteratorr c C s^ |}|t k s||ks|tkrtd��||kr-|tvr#t| d| �|� |d7 }||ksdS dS )z�
Apply a range of updates which must be within the valid range of updates
:param start: integer update to begin
:param end: integer update to end (inclusive)
:raise DomainUpdateException:
rN rO r: N)r? rP r �missing_updatesrQ )r4 �start�endrS r r r! r@ � s �z DomainUpdate.check_updates_rangec C sB z| j j| jdt| d�}W n tjy Y dS w t|�dkS )zd
:param op: Integer update number
:return: True if update exists else False
z(CN=%s))r7 �
expressionFr: )r# r; r1 �
update_mapr< �LdbError�len)r4 rS rH r r r! �
update_exists� s
�� zDomainUpdate.update_existsc C s" | j �dt| t| j�f � dS )zo
Add the corresponding container object for the given update
:param op: Integer update
z$dn: CN=%s,%s
objectClass: container
N)r# �add_ldifrY rD r1 �r4 rS r r r! �
update_add� s
�zDomainUpdate.update_addc C s` |� d�}|dkr|d|� | ||d� }n|| }||v r"dS | jj||dt gd� dS )a
Add an ACE to a DACL, checking if it already exists with a simple string search.
:param dn: DN to modify
:param existing_sddl: existing sddl as string
:param ace: string ace to insert
:return: True if modified else False
�S:���NF�
sd_flags:1:%d��controlsT)�rfindr �modify_sd_on_dnr )r4 �dn�
existing_sddl�ace�index�new_sddlr r r! �insert_ace_into_dacl� s
�z!DomainUpdate.insert_ace_into_daclc C s� | j j||gdgd�}t|�dksJ �|d | d }|�d�}|dkr3|d|� | ||d� }n|| }||v r=dS t�� }||_t�|tj|�||< | j j |d gd
� d S ) aC
Insert an ACE into a string attribute like defaultSecurityDescriptor.
This also checks if it already exists using a simple string search.
:param dn: DN to modify
:param ace: string ace to insert
:param attr: attribute to modify
:return: True if modified else False
�search_options:1:2)r7 r8 rd r: r r` ra NF�relax:0rc T)
r# r; r[ re r< �Messagerg �MessageElement�FLAG_MOD_REPLACE�modify) r4 rg ri �attr�msgrh rj rk �mr r r! �insert_ace_into_string� s&
�
�z#DomainUpdate.insert_ace_into_stringc C s | j s td| ��dS )z�
Raises an exception if not set to fix.
:param op: Integer operation
:raise DomainUpdateException:
z3Missing operation %d. Fix is currently set to FalseN)r$ r r^ r r r! �raise_if_not_fix s �z DomainUpdate.raise_if_not_fixc C sJ | � |�rd S | �|� | jjd| j ddgd� | jr#| �|� d S d S )NzVdn: CN=TPM Devices,%s
objectClass: top
objectClass: msTPM-InformationObjectsContainer
rn � provision:0rc )r\ rw r# r] r) r% r_ r^ r r r! � operation_78 s
���zDomainUpdate.operation_78c C �� | � |�rd S | �|� d}| jjddgdgd�}|D ]}ttj|d d �}|�| j�}| � |j
||� q| jjddgdgd�}|D ]}ttj|d d �}|�| j�}| � |j
||� qC| j rh| � |� d S d S )NzY(OA;CIIO;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;PS)�(objectClass=samDomain)�nTSecurityDescriptorrm �rX r8 rd r �(objectClass=domainDNS)�
r\ rw r# r; r r �
descriptor�as_sddlr/ rl rg r% r_ �r4 rS ri rH rt � existing_sdrh r r r! � operation_79 s6
�
� �
� �zDomainUpdate.operation_79c C s� | � |�rd S | �|� dt| j� }| jj| jtjdgddt gd�}|d }t
t j |d d �}|�
| j�}| �|j||� | jrJ| �|� d S d S )Nz5(OA;;CR;3e0f7e18-2c7a-4c10-ba82-4d926db99a3e;;%s-522)r| rm rb )r7 r9 r8 rd r )r\ rw rD r/ r# r; r) r< r= r r r r� r� rl rg r% r_ r� r r r! � operation_809 s(
��
� �zDomainUpdate.operation_80c C rz )Nz7(OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS)r{ r| rm r} r r~ r r� r r r! � operation_81R s6
�
� �
� �zDomainUpdate.operation_81c C sr | � |�rd S | �|� t| j�}t|��d�}dt| j� }| jj d||f ddgd� | j
r7| � |� d S d S )N�utf8� CN=Managed Service Accounts,%sz�dn: %s
changetype: add
objectClass: container
description: Default container for managed service accounts
showInAdvancedViewOnly: FALSE
nTSecurityDescriptor:: %srn rx rc ) r\ rw r r/ r �decoderD r) r# rC r% r_ )r4 rS r� �managedservice_descr�managed_service_dnr r r! � operation_75v s
����zDomainUpdate.operation_75c C s` | � |�rd S | �|� dt| j� }| jjdt| j�|f ddgd� | jr.| �|� d S d S )Nr� zudn: %s
changetype: modify
add: otherWellKnownObjects
otherWellKnownObjects: B:32:1EB93889E40C45DF9F0C64D23BBB6237:%s
rn rx rc )r\ rw rD r) r# rC r% r_ )r4 rS r� r r r! � operation_76� s
� ����zDomainUpdate.operation_76c C sN | � |�rd S | �|� | jjdt| j� ddgd� | jr%| �|� d S d S )NzFdn: CN=PSPs,CN=System,%s
objectClass: top
objectClass: msImaging-PSPs
rn rx rc )r\ rw r# r] rD r) r% r_ r^ r r r! � operation_77� s
���zDomainUpdate.operation_77)FT)NF)r r )r r r �__doc__r5 rM rT r@ r\ r_ rl rv rw ry r� r� r� r� r� r� r r r r! r" N s,
�
�$
#
$ r" ) r< �samba�base64r r � samba.ndrr r � samba.dcerpcr �samba.dcerpc.securityr �samba.descriptorr �
samba.dsdbr r
r r r
r? rP rY r> rA rU � Exceptionr �objectr" r r r r! �<module> sD �� �