HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux spn-python 5.15.0-89-generic #99-Ubuntu SMP Mon Oct 30 20:42:41 UTC 2023 x86_64
User: arjun (1000)
PHP: 8.1.2-1ubuntu2.20
Disabled: NONE
$ pwd: /proc/1233/root/usr/lib/python3/dist-packages/samba/__pycache__/
Upload Files
File: //proc/1233/root/usr/lib/python3/dist-packages/samba/__pycache__/upgradehelpers.cpython-310.pyc
o

f�0b���@s�dZddlZddlZddlZddlZddlmZddlmZmZm	Z	ddl
mZmZm
Z
ddl
Z
ddlmZmZmZmZmZmZddlmZddlmZdd	lmZdd
lmZddlmZddlmZddl Z d
Z!dZ"dZ#dZ$dZ%dZ&dZ'e(gd��Z)Gdd�de*�Z+dd�Z,dd�Z-d@dd�Z.dd�Z/dAdd�Z0d d!�Z1d"d#�Z2d$d%�Z3d&d'�Z4d(d)�Z5d*d+�Z6d,d-�Z7d.d/�Z8d0d1�Z9d2d3�Z:d4d5�Z;d6d7�Z<d8d9�Z=d:d;�Z>d<d=�Z?d>d?�Z@dS)Bz>Helpers used for upgrading between different database formats.�N)�cmp)�Ldb�version�ntacls)�
SCOPE_SUBTREE�SCOPE_ONELEVEL�
SCOPE_BASE)�provision_paths_from_lp�
getpolicypath�create_gpo_struct�	provision�ProvisioningError�secretsdb_self_join)�	FILL_FULL)�drsblobs)�SEC_CHAN_BDC)�
ndr_unpack)�SamDB)�_glue��������)�dn�whenCreated�whenChanged�
objectGUID�
uSNCreated�replPropertyMetaData�
uSNChanged�
parentGUID�objectCategory�distinguishedName�
nTMixedDomain�showInAdvancedViewOnly�instanceTypezmsDS-Behavior-Version�nextRid�cn�
versionNumber�lmPwdHistory�
pwdLastSet�ntPwdHistory�
unicodePwd�dBCSPwd�supplementalCredentials�gPCUserExtensionNames�gPCMachineExtensionNames�	maxPwdAge�secret�possibleInferiors�	privilege�sAMAccountTypec@s4eZdZdd�Zdd�Zdd�Zdd�Zd	d
�ZdS)�ProvisionLDBcCs4d|_d|_d|_d|_d|_d|_d|_d|_dS�N)�sam�secrets�idmapr6�hkcr�hkcu�hku�hklm��self�rC�6/usr/lib/python3/dist-packages/samba/upgradehelpers.py�__init__Fs
zProvisionLDB.__init__cCs|j|j|j|jfSr9)r:r;r<r6rArCrCrD�dbsPszProvisionLDB.dbscCs|��D]}|��qdSr9)rF�transaction_start�rB�dbrCrCrD�startTransactionsSs
�zProvisionLDB.startTransactionsc	Cs8d}|��D]}z|��Wqtyd}Yqw|S)NTF)rF�transaction_cancel�	Exception)rB�okrIrCrCrD�groupedRollback\s�zProvisionLDB.groupedRollbackcCsnz
|��D]}|��qWn
ty|��YSwz|��D]}|��q WdSty6|��YSw)NT)rF�transaction_prepare_commitrLrN�transaction_commitrHrCrCrD�
groupedCommitjs
��
�
��zProvisionLDB.groupedCommitN)�__name__�
__module__�__qualname__rErFrJrNrQrCrCrCrDr8Ds
	r8cCs`t�}t|j|||dgdd�|_t|j|||d�|_t|j|||d�|_t|j|||d�|_|S)a�Return LDB object mapped on most important databases

    :param paths: An object holding the different importants paths for provision object
    :param creds: Credential used for openning LDB files
    :param session: Session to use for openning LDB files
    :param lp: A loadparam object
    :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provisionzmodules:samba_dsdbr)�session_info�credentials�lp�options�flags)rUrVrW)	r8r�samdbr:rr;�idmapdbr<r6)�paths�creds�sessionrW�ldbsrCrCrD�get_ldbs�s	�r`cCsnd}d}d}|r5|t|�krd}q|t||�kr#|ddkr!d}d}|t||�kr/d}d}|d}|s|S)a�Check if the usn is in one of the range provided.
    To do so, the value is checked to be between the lower bound and
    higher bound of a range

    :param usn: A integer value corresponding to the usn that we want to update
    :param range: A list of integer representing ranges, lower bounds are in
                  the even indices, higher in odd indices
    :return: True if the usn is in one of the range, False otherwise
    rTFrr)�len�int)�usn�range�idx�contrMrCrCrD�usn_in_range�s"�rgcCs�|dur(tj�|�st�|�tj�|d�}tj�|�s!t�|�tj�|d�}|dur0|��}tj�|�s<td|��|��}|�	|�t
||�d��}|S)aGet paths to important provision objects (smb.conf, ldb files, ...)

    :param param: Param object
    :param targetdir: Directory where the provision is (or will be) stored
    :param smbconf: Path to the smb.conf file
    :return: A list with the path of important provision objectsN�etczsmb.confzUnable to find smb.conf at %s�realm)�os�path�exists�mkdir�join�makedirs�default_pathr
�LoadParm�loadr	�get)�param�	targetdir�smbconf�etcdirrWr\rCrCrD�	get_paths�s


rxcCs�|jddt|j�tddgd�}t|dd��dd��d	d�|_|jd
dt|j�tddgd�}t|�dkrJt|dd��dd��d	d�|_dSd|_dS)
z�Update policy ids that could have changed after sam update

    :param names: List of key provision parameters
    :param samdb: An Ldb object conntected with the sam DB
    z#(displayName=Default Domain Policy)zCN=Policies,CN=System,r)�displayName��
expression�base�scope�attrsr�{��}z/(displayName=Default Domain Controllers Policy)rN)�search�str�rootdnr�replace�policyidra�policyid_dc)�namesrZ�res�res2rCrCrD�update_policyids�s�"�&
r�cCs�tj�|�rt�|�t�|�|�d|�t||fid|�d|�dt�d|j	�d|j
�d|j�d|j�d	|j
�d
|j�d|j�d|j���d
d�dd�d|j�d|j�dd�dd�dd�dd�dd�dd�dd�d|j�d|j�dd�dd�d|��S) a�Create a new provision.

    This provision will be the reference for knowing what has changed in the
    since the latest upgrade in the current provision

    :param names: List of provision parameters
    :param creds: Credentials for the authentification
    :param session: Session object
    :param smbconf: Path to the smb.conf file
    :param provdir: Directory where the provision will be stored
    :param logger: A Logger
    zProvision stored in %srvru�
samdb_fillri�domain�
domainguid�	domainsid�ntdsguid�
policyguid�
policyguid_dc�hostname�hostipN�hostip6�invocationid�	adminpass�
krbtgtpass�machinepass�dnspass�root�nobody�users�
serverrolezdomain controller�dom_for_fun_level�dns_backend�useeadbT�	use_ntvfs�base_schema)rjrk�isdir�shutil�rmtreerm�inforrrir�r�r�r�r�r��netbiosname�lower�
invocationr��domainlevelr�)r�r^rv�provdir�loggerr�rCrCrD�newprovision�sr

���������
�����������	�
�
����r�c
Cs�t�d�}|�t|��}|�t|��}tt|�t|��}t|�d}t|�d}td|�D];}t||||||�}	|	dkrD|	S||dkrh||ks^Jdd�|�dd�|���||kredSdSq-|	S)z�Sorts two DNs in the lexicographical order it and put higher level DN
    before.

    So given the dns cn=bar,cn=foo and cn=foo the later will be return as
    smaller

    :param x: First object to compare
    :param y: Second object to compare
    z
(?<!\\), ?rrzPB PB PB� z / r)	�re�compile�splitr��minrardrrn)
�x�y�p�tab1�tab2�minimum�len1�len2�i�retrCrCrD�dn_sorts"

(�r�c	CsXt|��dd�\}}|�|t�|d||f�dg�|�t�|d||f�|dg�dS)z�Perform a back and forth rename to trigger renaming on attribute that
    can't be directly modified.

    :param lbdobj: An Ldb Object
    :param dn: DN of the object to manipulate
    �=rz%s=foo%szrelax:0N)r�r��rename�ldb�Dn)�ldbobjr�before�afterrCrCrD�identic_rename*s $r�cCs�|td�|jdtd�}|jdtd�}|sJd��t|�dkr7|�t��|d�}|dj|_|�|d�n|�|d|d�}|dj|_|�	|�|jddt
dgd	�}|jddt
dgd	�}i}i}g}g}	t��}
tdt|��D]}||d|t||d��
�<qstdt|��D]}||d|t||d��
�<q�|��D]}||vr�|�||�q�|	�||�q�|D]I}
|jd
|
dt
d�}|jd
|
dt
d�}|�|
|d�}tD]}|�|�q�|td|dj�|D]	}|td
|�q�|dj|_|�|�q�|	D]P}
|jd
|
dt
d�}|jd
|
dt
d�}|�|d|d�}tD]}|�|��q*|D]!}|dk�rP|td|dj�t||dj��q5|�|��q5�q|	D]X}
|jd
|
dt
d�}|jd
|
dt
d�}|�|d|d�}tD]}|�|��q}|D]}|dk�r�|�|�|dk�r�|td||djf��q�|dj|_|�	|��q[|jdt
dgd�}t|�dk�r�|td�|�|dd�dSdS)z�Update secrets.ldb

    :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb
        of the reference provision
    :param secrets_ldb: An LDB object that is connected to the secrets.ldb
        of the updated provision
    zUpdate of secrets.ldbz@MODULES)r|r}z'Reference modules list can not be emptyrzobjectClass=topr�rrz�distinguishedName=%s)r{r|r}z$Entry %s is missing from secrets.ldbz Adding attribute %s�namez/Found attribute name on  %s, must rename the DN�msDS-KeyVersionNumberz"Adding/Changing attribute %s to %sz(samaccountname=dns))r{r}r~rzRemove old dns accountN)�SIMPLEr�rra�msg_diffr��Messager�add�modifyrrdr�r��keys�append�hashAttrNotCopied�remove�CHANGEr��delete)�newsecrets_ldb�secrets_ldb�messagefunc�	reference�current�delta�hash_new�hash�listMissing�listPresent�emptyr��k�entry�attr�rCrCrD�update_secrets7s�
	
��""
�
��
��
����


����
�r�cCsH|jdt|�tddgd�}t|�dkr"|d�d�r"|dd}|SdS)z�Return OEM Information on the top level Samba4 use to store version
    info in this field

    :param samdb: An LDB object connect to sam.ldb
    :param rootdn: Root DN of the domain
    :return: The content of the field oEMInformation (if any)
    �(objectClass=*)r�oEMInformationrzrr�)r�r�rrars)rZr�r�r�rCrCrD�
getOEMInfo�s�r�cCs�|jd|tddgd�}t|�dkrK|d�d�r!t|dd�}nd}d|tf}t��}t�|t|dd��|_	t�
|tjd�|d<|�|�dSdS)	z�Update the OEMinfo field to add information about upgrade

    :param samdb: an LDB object connected to the sam DB
    :param rootdn: The string representation of the root DN of
        the provision (ie. DC=...,DC=...)
    r�rr�rzrr�z%s, upgrade to %sN)
r�rrarsr�rr�r�r�r�MessageElement�FLAG_MOD_REPLACEr�)rZr�r�r�r�rCrCrD�
updateOEMInfo�s�
��r�cCsft|j|j|j�}tj�|�st|�|jdurt	d��t|j|j|j�}tj�|�s1t|�dSdS)z-Create missing GPO file object if needed
    Nz*Policy ID for Domain controller is missing)
r
�sysvol�	dnsdomainr�rjrkr�rr�r
)r\rZr�rW�message�dirrCrCrD�
update_gpo�s
�r�cCs�|jdt�|t|��tdgdgd�}d}t|�dkrtd��|D]8}t|j���|vrX|�	d�}|s4d}t
t|t|j�����}t
t|��|krX|d}|�t|j�d	|d
�q dS)aFor a given hash associating dn and a number, this function will
    update the replPropertyMetaData of each dn in the hash, so that the
    calculated value of the msDs-KeyVersionNumber is equal or superior to the
    one associated to the given dn.

    :param samdb: An SamDB object pointing to the sam
    :param rootdn: The base DN where we want to start
    :param hashDns: A hash with dn as key and number representing the
                 minimum value of msDs-KeyVersionNumber that we want to
                 have
    z(objectClass=user)zmsDs-KeyVersionNumber�search_options:1:2�r{r|r}r~�controlsrz$Unable to find msDs-KeyVersionNumber�0rr.TN)r�r�r�r�rrar
rr�rsrb�"set_attribute_replmetadata_version)rZr��hashDnsr��done�e�valrrCrCrD�&increment_calculated_keyversion_number�s,�
���r�cCsN|td�t||||dgd�}t||||dgd�}t��}d}	|jdd�}
|
D]}}|jd|dtd	�}t|�sg|�||�}
|td
t	|j
��t	|j
�dkr]|
�tj
j�r]|
�tj
j�|j
|
_
|�|
�q'|�|d|�}
t	|j
�d
kr~|�||d�}	t	|j
�dkr�|
�tj
j�r�|
�tj
j�t|
���dkr�|j
|
_
|�|
�q'|	S)aUpdate the provision container db: sam.ldb
    This function is aimed for alpha9 and newer;

    :param refsampath: Path to the samdb in the reference provision
    :param sampath: Path to the samdb in the upgraded provision
    :param creds: Credential used for openning LDB files
    :param session: Session to use for openning LDB files
    :param lp: A loadparam object
    :return: A msg_diff object with the difference between the @ATTRIBUTES
             of the current provision and the reference provision
    z<Update base samdb by searching difference with reference onezmodules:)rUrVrWrXNr��r{r�r)r{r}zAdding %s to sam dbz
@PROVISIONrz@ATTRIBUTESr)r�rr�r�r�rrar�r�r�rrs�sambar�LAST_PROVISION_USN_ATTRIBUTEr�r��itemsr�)�
refsampath�sampathr]r^rWr��refsamr:r��	deltaattrr��refentryr�r�rCrCrD�delta_update_basesamdb�sJ
��
����
�rcCs6d}t|�dkrd}|D]}d||f}qd|}|S)z�Construct a exists or LDAP search expression.

    :param attrs: List of attribute on which we want to create the search
        expression.
    :return: A string representing the expression, if attrs is empty an
        empty string is returned
    r�rz(|z%s(%s=*)z%s))ra)r~�exprr�rCrCrD�construct_existor_expr'srcCsd|j}|j|dgd�}t|ddd�tkr�|j|gd�}t|�dks(J�t�|dj�}t�	dd�}|�
d�}t�|tjd�|d<|�
|�|jd|jd	gd�}t|�dks]J�tt|dd	��}	t|ddd�}
t||j|j|j|j|j||	|
d
�	dStd��)
aRUpdate (change) the password of the current DC both in the SAM db and in
       secret one

    :param samdb: An LDB object related to the sam.ldb file of a given provision
    :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
                        provision
    :param names: List of key provision parameterszsamAccountName=%s$�secureChannelType�r{r~rr�x�	utf-16-le�clearTextPassword�msDs-keyVersionNumber)r�rir�r�r�r��key_version_number�secure_channel_typez3Unable to find a Secure Channelof type SEC_CHAN_BDCN)r�r�rbrrar�r�rr�� generate_random_machine_password�encoder�r�r�r�rr�rir�r�r
)rZr�r�r{�secrets_msgr��msgr��mputf16�kvno�secChanTyperCrCrD�update_machine_account_password8s>
	�
�
�
�	rc
Cs�d|j}|j|d�}t|�dkr}|j|gd�}t|�dks J�t�|dj�}t�dd�}|�d�}t�	|tj
d	�|d	<|�|�|j|d
gd�}t|�dksRJ�t|dd
�}	t�|dj�}t�	|tj
d�|d<t�	|	tj
d�|d<|�|�d
Sd
S)aKUpdate (change) the password of the dns both in the SAM db and in
       secret one

    :param samdb: An LDB object related to the sam.ldb file of a given provision
    :param secrets_ldb: An LDB object related to the secrets.ldb file of a given
                        provision
    :param names: List of key provision parameterszsamAccountName=dns-%sr�rrr�rrr	r
r4r�N)
r�r�rar�r�rr��generate_random_passwordrr�r�r�r�)
rZr�r�r{rr�rr�rrrCrCrD�update_dns_account_passwordcs:
	
�
����rcCsjd}|j|gd�}t|�dksJ�t�|dj�}t�dd�}|�d�}t�|tj	d�|d<|�
|�d	S)
z�Update (change) the password of the krbtgt account

    :param samdb: An LDB object related to the sam.ldb file of a given provisionzsamAccountName=krbtgtrrrrrrr	N)r�rar�r�rr�r
rr�r�r�)rZr{r�rr��kputf16rCrCrD�update_krbtgt_account_password�s
�rcCs�i}t|�}|dkr|S|j|t�|t|��t|ddgd�}t|�dkr&|S|D]3}|D].}|�|�rZ||vrGt||�||t|j��	�<q,i||<t||�||t|j��	�<q,q(|S)a�Search a given sam DB for calculated attributes that are
    still stored in the db.

    :param samdb: An LDB object pointing to the sam
    :param rootdn: The base DN where the search should start
    :param attrs: A list of attributes to be searched
    :return: A hash with attributes as key and an array of
             array. Each array contains the dn and the associated
             values for this attribute as they are stored in the
             sam.r�r�zbypassoperational:0r�r)
rr�r�r�r�rrarsrr�)rZr�r~�hashAttrr��entr�rCrCrD�search_constructed_attrs_stored�s(�
 ��rcCs|d}i}|j|dtjdgdgd�}|D]�}|d}ttjt|d��j}|jD]�}t	�
|j�d}|�t|j
��}	|	durXi}
|j|
d	<|j|
d
<d|
d<t|j�g|
d<i}	nU|	�|�}
|
durzi}
|j|
d	<|j|
d
<d|
d<t|j�g|
d<n3|
d	|jkr�|j|
d	<|
d
|jkr�|j|
d
<t|j�|
dvr�|
dd|
d<|
d�t|j��|
|	|<|	|t|j
�<q'q||fS)
a Find ranges of usn grouped by invocation id and then by timestamp
        rouned at 1 minute

        :param samdb: An LDB object pointing to the samdb
        :param basedn: The DN of the forest

        :return: A two level dictionary with invoication id as the
                first level, timestamp as the second one and then
                max, min, and number as subkeys, representing respectivily
                the maximum usn for the range, the minimum usn and the number
                of object with usn in this range.
    rz
objectClass=*r r�)r|r{r}r~r�r�<Nr��max�num�list)r�r�rrr�replPropertyMetaDataBlobr��ctr�arrayr�nttime2unix�originating_change_timers�originating_invocation_id�originating_usnrr�)rZ�basedn�nb_obj�hash_idr�r��obj�o�minutestamp�hash_ts�obrCrCrD�findprovisionrange�sT
�
��







�r0c	Cs�d}|D]�}||}g}|�|���|��g}	|D]3}
||
}|d|krAt�t�|
d��}td||d|d|df�||
ddkrN|	�|
�qtdt	|	��D]8}
|
dkr�|	|
}|	|
d	}||d	kr�t
||d�t
||d�d	kr�||d||d<d
||d<qV|	D]}
||
}|�d�dur�d
||d|d|f}q�q|dkr�tj
|ddd�\}}t�td�td|�td|�tdt|�|f�d||f}t�||�t�|�dSdS)as print the differents ranges passed as parameter

        :param dic: A dictionary as returned by findprovisionrange
        :param limit_print: minimum number of object in a range in order to print it
        :param dest: Destination directory
        :param samdb_path: Path to the sam.ldb file
        :param invoicationid: Invocation ID for the current provision
    r�rrz*%s # of modification: %d  	min: %d max: %dr�riXrrT�skippedNz%slastProvisionUSN: %d-%d;%s
�usnprovz.ldif)r��prefix�suffixzFTo track the USNs modified/created by provision and upgrade proivsion,zM the following ranges are proposed to be added to your provision sam.ldb: 
%szdWe recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldbz2You can load this file like this: ldbadd -H %s %s
z$dn: @PROVISION
provisionnerID: %s
%s)�extendr��sortr�
nttime2string�unix2nttime�printr�rdrarbrs�tempfile�mkstempr�rj�write�close)�dic�limit_print�dest�
samdb_pathr��ldif�idr.�sorted_keys�kept_recordr�r+�dtr��key1�key2�fd�filerCrCrD�print_provision_rangess\	�
�$�
����rKcCs t|�}d|d@|d?f}|S)z�Display the int64 range stored in value as xxx-yyy

    :param value: The int64 range
    :return: A string of the representation of the range
    z%d-%dl��� )rb)�value�lvaluer�rCrCrD�int64range2str;srO)NNr9)A�__doc__rjr�r�r��samba.commonrrrrr�rrr�samba.provisionr	r
rrr
r�samba.provision.commonr�samba.dcerpcr�samba.dcerpc.miscr�	samba.ndrr�samba.samdbrrr:�ERRORr�r��CHANGESD�GUESS�	PROVISION�	CHANGEALL�setr��objectr8r`rgrxr�r�r�r�r�r�r�r�r�rrrrrrr0rKrOrCrCrCrD�<module>s^ 
?


i!1+(#<;
@ Telegram