File: //proc/1233/root/usr/lib/python3/dist-packages/samba/netcmd/__pycache__/computer.cpython-310.pyc
o
�/a e � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl
m Z m Z m
Z
d dlmZmZ d dlmZmZmZ d dlmZ d dlmZ d dlmZ d d lm Z d d
l m Z m Z d d l m!Z! d d
lm"Z"m#Z#m$Z$m%Z%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+ d%dd�Z,dd� Z-dd� Z.dd� Z/G dd� de(�Z0G dd� de(�Z1G dd � d e(�Z2G d d � d e(�Z3G d d � d e(�Z4G d!d"� d"e(�Z5G d#d$� d$e*�Z6dS )&� N)�sd_utils)� dnsserver�dnsp�security)�ARecord�
AAAARecord)�
ndr_unpack�ndr_pack� ndr_print)�remove_dns_references)�system_session)�SamDB)� get_bytes)�
check_call�CalledProcessError� )�common)� credentials�dsdb�Ldb�werror� WERRORError)�Command� CommandError� SuperCommand�Optionc C sF |st jt jg}|D ]}z
t �|| � W dS t jy Y q
w dS )z Check ip string is valid addressTF)�socket�AF_INET�AF_INET6� inet_pton�error)� ip_string�address_families�address_family� r$ �7/usr/lib/python3/dist-packages/samba/netcmd/computer.py� _is_valid_ip8 s �r& c C � t | tjgd�S )z%Check ip string is valid ipv4 address�r" )r& r r �r! r$ r$ r% �_is_valid_ipv4G � r* c C r' )z%Check ip string is valid ipv6 addressr( )r& r r r) r$ r$ r% �_is_valid_ipv6L r+ r, c C s |� d�}tj}tjtjB }| �� } d}
t�| �} z|�|d|| |dt j
|dd�
\} }
W n t yI } z|j d t
jkr?d}
W Y d}~nd}~ww |
r�|
jD ]D}|jD ]>}|jt jksb|jt jkr�t�� }||_z
|�|d|| |d|� W qT t y� } z|j d t
jkr�� W Y d}~qTd}~ww qTqO|D ]A}t|�r�|�d|| |f � t|�}nt|�r�|�d|| |f � t|�}ntd� |���t�� }||_|�|d|| ||d� q�t |�dk�rt � | d | � � �}| j!d
|| f |d �\}}| j"||d t#j$t#j%B gd
� dS dS )z3Add DNS A or AAAA records while creating computer. �$Tr NFz,Adding DNS AAAA record %s.%s for IPv6 IP: %sz)Adding DNS A record %s.%s for IPv4 IP: %szInvalid IP: {}zDC=DomainDnsZones,%sz%s.%s)�
dns_partitionz
sd_flags:1:%d)�controls)&�rstripr �DNS_CLIENT_VERSION_LONGHORN�DNS_RPC_VIEW_AUTHORITY_DATA�DNS_RPC_VIEW_NO_CHILDREN�domain_dns_namer �SDUtils�DnssrvEnumRecords2r � DNS_TYPE_ALLr �argsr �"WERR_DNS_ERROR_NAME_DOES_NOT_EXIST�rec�records�wType�
DNS_TYPE_A�
DNS_TYPE_AAAA�DNS_RPC_RECORD_BUF�DnssrvUpdateRecord2r, �infor r* r �
ValueError�format�len�ldb�Dn�get_default_basedn�
dns_lookup�modify_sd_on_dnr �
SECINFO_OWNER�
SECINFO_GROUP)�samdb�name�dns_conn�change_owner_sd�server�ip_address_list�logger�client_version� select_flags�zone�
name_found� sd_helper�buflen�res�er: �record� del_rec_buf�
ip_address� add_rec_buf�domaindns_zone_dn�dns_a_dn� ldap_recordr$ r$ r% �add_dns_recordsQ s�
� ��
� ������
�
�
�
�
��rb c @ s� e Zd ZdZdZedddeddd�ed d
ed �ed d
ed �edddd�eddddd�eddddd�gZdgZe j
e j e j d�Z
d d d �Zd S )!�cmd_computer_adda+ Add a new computer.
This command adds a new computer account to the Active Directory domain.
The computername specified on the command is the sAMaccountName without the
trailing $ (dollar sign).
Computer accounts may represent physical entities, such as workstations. Computer
accounts are also referred to as security principals and are assigned a
security identifier (SID).
Example1:
samba-tool computer add Computer1 -H ldap://samba.samdom.example.com \
-Uadministrator%passw1rd
Example1 shows how to add a new computer to the domain against a remote LDAP
server. The -H parameter is used to specify the remote target server. The -U
option is used to pass the userid and password authorized to issue the command
remotely.
Example2:
sudo samba-tool computer add Computer2
Example2 shows how to add a new computer to the domain against the local
server. sudo is used so a user may run the command as root.
Example3:
samba-tool computer add Computer3 --computerou='OU=OrgUnit'
Example3 shows how to add a new computer in the OrgUnit organizational unit.
� %prog <computername> [options]�-H�--URL�%LDB URL for database or target server�URL�H��help�type�metavar�destz --computerouz�DN of alternative location (with or without domainDN counterpart) to default CN=Computers in which new computer object will be created. E.g. 'OU=<OU name>'�rk rl z
--descriptionzComputers's descriptionz--prepare-oldjoinz5Prepare enabled machine account for oldjoin mechanism�
store_true)rk �actionz --ip-addressrQ ziIPv4 address for the computer's A record, or IPv6 address for AAAA record, can be provided multiple times�append)rn rk rq z--service-principal-name�service_principal_name_listzAComputer's Service Principal Name, can be provided multiple times� computername�� sambaopts�credopts� versionoptsNFc
C s� | d u rg } |
d u r g }
| D ]
} t | �std�| ���q|�� } |�| �}
z�t|t� |
| d�}|j||||| |
d� | r�t� dd|�}|�
d�rNtd| ��d�t � |��}|j
|�� t j|d d
gd �}|d d d }ttj|d d
d �}t�d
�|�� �| |
�}t�� }||_t�d�|�� |��|_t|||||�� | | �� � W n ty� } ztd| |��d }~ww | j � d| � d S )NzInvalid IP address {}��url� session_infor �lp)�
computerou� description�prepare_oldjoinrQ rs z\$$� r- zIllegal computername "%s"z-(&(sAMAccountName={}$)(objectclass=computer))�primaryGroupID� objectSid��base�scope�
expression�attrsr zncacn_ip_tcp:{}[sign]z{}-{}z Failed to add computer '%s': z!Computer '%s' added successfully
) r& r rC � get_loadparm�get_credentialsr
r � newcomputer�re�sub�countrE �
binary_encode�search� domain_dn�
SCOPE_SUBTREEr r �dom_sidr �
host_dns_name�
descriptor� owner_sid�get_domain_sid� group_sidrb �
get_logger� Exception�outf�write)�selfrt rw rv rx ri r} r~ r rQ rs r] r| �credsrL �hostname�filters�recs�group�ownerrN rO rZ r$ r$ r% �run� sv �
��
�� ��������zcmd_computer_add.run) NNNNNNFNN��__name__�
__module__� __qualname__�__doc__�synopsisr �str�
takes_options�
takes_args�options� SambaOptions�CredentialsOptions�VersionOptions�takes_optiongroupsr� r$ r$ r$ r% rc � sF �� ������rc c @ sP e Zd ZdZdZedddeddd�gZd gZe j
e j e j d
�Z
dd d
�Zd S )�cmd_computer_deleteaf Delete a computer.
This command deletes a computer account from the Active Directory domain. The
computername specified on the command is the sAMAccountName without the
trailing $ (dollar sign).
Once the account is deleted, all permissions and memberships associated with
that account are deleted. If a new computer account is added with the same name
as a previously deleted account name, the new computer does not have the
previous permissions. The new account computer will be assigned a new security
identifier (SID) and permissions and memberships will have to be added.
The command may be run from the root userid or another authorized
userid. The -H or --URL= option can be used to execute the command against
a remote server.
Example1:
samba-tool computer delete Computer1 -H ldap://samba.samdom.example.com \
-Uadministrator%passw1rd
Example1 shows how to delete a computer in the domain against a remote LDAP
server. The -H parameter is used to specify the remote target server. The
--computername= and --password= options are used to pass the computername and
password of a computer that exists on the remote server and is authorized to
issue the command on that server.
Example2:
sudo samba-tool computer delete Computer2
Example2 shows how to delete a computer in the domain against the local server.
sudo is used so a computer may run the command as root.
rd re rf rg rh ri rj rt ru Nc
C sN |� � }|j|dd�}t|t� ||d�}|} |�d�s d| } dt�| �tjf }
z2|j |�
� tj |
ddgd �} | d
j } t
| d
d d
�}
d| d
v rXt| d
d d
�}nd }W n
tyh td | ��w |
tj@ }|svtd | ��z|�| � |r�t|| �� |dd
� W n ty� } ztd| |��d }~ww | j�d| � d S )NT��fallback_machinery r- �%s$�)(&(sAMAccountName=%s)(sAMAccountType=%u))�userAccountControl� dNSHostNamer� r � Unable to find computer "%s"zNFailed to remove computer "%s": Computer is not a workstation - removal denied)�ignore_no_namez Failed to remove computer "%s"zDeleted computer %s
)r� r� r
r �endswithrE r� r �ATYPE_WORKSTATION_TRUSTr� r� r� �dn�intr� �
IndexErrorr � UF_WORKSTATION_TRUST_ACCOUNT�deleter r� r� r� r� )r� rt rw rv rx ri r| r� rL �samaccountname�filterrY � computer_dn� computer_ac�computer_dns_host_name�computer_is_workstationrZ r$ r$ r% r� h sf �
��
�
� ���
������zcmd_computer_delete.run�NNNNr� r$ r$ r$ r% r� 8 s !����r� c @ s\ e Zd ZdZdZedddeddd�ed d
ed �gZd gZe j
e j e j d
�Z
ddd�ZdS )�cmd_computer_editay Modify Computer AD object.
This command will allow editing of a computer account in the Active
Directory domain. You will then be able to add or change attributes and
their values.
The computername specified on the command is the sAMaccountName with or
without the trailing $ (dollar sign).
The command may be run from the root userid or another authorized userid.
The -H or --URL= option can be used to execute the command against a remote
server.
Example1:
samba-tool computer edit Computer1 -H ldap://samba.samdom.example.com \
-U administrator --password=passw1rd
Example1 shows how to edit a computers attributes in the domain against a
remote LDAP server.
The -H parameter is used to specify the remote target server.
Example2:
samba-tool computer edit Computer2
Example2 shows how to edit a computers attributes in the domain against a
local LDAP server.
Example3:
samba-tool computer edit Computer3 --editor=nano
Example3 shows how to edit a computers attributes in the domain against a
local LDAP server using the 'nano' editor.
rd re rf rg rh ri rj z--editorzQEditor to use instead of the system default, or 'vi' if no system default is set.ro rt ru Nc C s |� � }|j|dd�}t|t� ||d�} |}
|�d�s d| }
dtjt�|
�f } | � � } z| j
| | tj d�}
|
d j }W n
t
yJ td | ��w t|
�d
kr[td |t|
�f ��|
d }t�| |�}|d u rutj�d �}|d u rud
}tjdd��G}|�t|�� |�� z t||jg� W n t y� } zt d|��d }~ww t |j�� }|� � }W d � n1 s�w Y W d � n1 s�w Y | � |�}t |�d
}| �!||�}t|�dkr�| j"�d� d S z| �#|� W n t$�y } ztd| |��d }~ww | j"�d| � d S )NTr� ry r- r� �)(&(sAMAccountType=%d)(sAMAccountName=%s))�r� r� r� r r� r z'Invalid number of results: for "%s": %d�EDITOR�viz.tmp)�suffixzERROR: zNothing to do
z Failed to modify computer '%s': z$Modified computer '%s' successfully
)%r� r� r
r r� r r� rE r� r� r� r� r� r� r rD r �get_ldif_for_editor�os�environ�get�tempfile�NamedTemporaryFiler� r �flushr rM r �open�read�
parse_ldif�next�msg_diffr� �modifyr� )r� rt rw rv rx ri �editorr| r� rL r� r� �domaindnrY r� �msg� result_ldif�t_filerZ � edited_file�edited_message� msgs_edited�
msg_edited� res_msg_diffr$ r$ r% r� � s� �
��� �
�
��
�� �
����zcmd_computer_edit.run�NNNNNr� r$ r$ r$ r% r� � s$ #�����r� c @ sp e Zd ZdZdZedddeddd�ed d
d ed �ed
ddddd�gZej ej
ej d�Z ddd�Z
dS )�cmd_computer_listzList all computers.z%prog [options]re rf rg rh ri rj z-bz --base-dnzSpecify base DN to usero z --full-dn�full_dnFrp z)Display DN instead of the sAMAccountName.)rn �defaultrq rk ru Nc C s� |� � }|j|dd�}t|t� ||d�} dtj }
| �� } |r$| �|�} | j| t j
|
dgd�} t | �dkr7d S | D ] }
|rI| j �
d|
�d � � q9| j �
d|
jddd
� � q9d S ) NTr� ry z(sAMAccountType=%u)r� )r� r� r� r z%s
r� )�idx)r� r� r
r r r� r� �normalize_dn_in_domainr� rE r� rD r� r� r� )r� rv rw rx ri �base_dnr� r| r� rL r� � search_dnrY r� r$ r$ r% r� ! s, �
� �zcmd_computer_list.run)NNNNNF)r� r� r� r� r� r r� r� r� r� r� r� r� r� r$ r$ r$ r% r�
s6 ����
��r� c @ s^ e Zd ZdZdZedddeddd�ed d
ed d �gZd
gZe j
e j e j d�Z
ddd�ZdS )�cmd_computer_showa� Display a computer AD object.
This command displays a computer account and it's attributes in the Active
Directory domain.
The computername specified on the command is the sAMAccountName.
The command may be run from the root userid or another authorized
userid.
The -H or --URL= option can be used to execute the command against a remote
server.
Example1:
samba-tool computer show Computer1 -H ldap://samba.samdom.example.com \
-U administrator
Example1 shows how display a computers attributes in the domain against a
remote LDAP server.
The -H parameter is used to specify the remote target server.
Example2:
samba-tool computer show Computer2
Example2 shows how to display a computers attributes in the domain against a
local LDAP server.
Example3:
samba-tool computer show Computer2 --attributes=objectSid,operatingSystem
Example3 shows how to display a computers objectSid and operatingSystem
attribute.
rd re rf rg rh ri rj z --attributesz:Comma separated list of attributes, which will be printed.�computer_attrs)rk rl rn rt ru Nc C s� |� � }|j|dd�}t|t� ||d�} d }
|r |�d�}
|} |�d�s(d| } dtjt� | �f } | �
� }
z| j |
| tj |
d�}|d j
}W n
tyT td
| ��w |D ]}t�| |�}| j�|� qWd S ) NTr� ry �,r- r� r� )r� r� r� r� r r� )r� r� r
r �splitr� r r� rE r� r� r� r� r� r� r r r� r� r� )r� rt rw rv rx ri r� r| r� rL r� r� r� r� rY r� r� �
computer_ldifr$ r$ r% r� w s> �
��� �� �zcmd_computer_show.runr� r� r$ r$ r$ r% r� C s& !��� ��r� c @ sR e Zd ZdZdZedddeddd�gZd d
gZe j
e j e j d �Z
dd
d�Zd S )�cmd_computer_movez4Move a computer to an organizational unit/container.z*%prog <computername> <new_ou_dn> [options]re rf rg rh ri rj rt � new_ou_dnru Nc
C s: |� � }|j|dd�}t|t� ||d�} t�| | �� �}
|} |�d�s'd| } dt�| �t j
f } z| j |
| tj d�}
|
d j
}W n
tyN td | ��w t�| |�}|�|
�s_|�|
� t�| t|��}|�t|�d
� |�|� z| �||� W n ty� } ztd | |��d }~ww | j�d ||f � d S )
NTr� ry r- r� r� r� r r� r z Failed to move computer "%s"z Moved computer "%s" to "%s"
)r� r� r
r rE rF r� r� r� r r� r� r� r� r� r � is_child_of�add_baser� �remove_base_componentsrD �renamer� r� r� )r� rt r� rw rv rx ri r| r� rL r� r� r� rY r� �full_new_ou_dn�new_computer_dnrZ r$ r$ r% r� � sL �
��� �
��
�zcmd_computer_move.runr� r� r$ r$ r$ r% r� � s ����r� c @ sZ e Zd ZdZi Ze� ed< e� ed< e� ed< e� ed< e� ed< e � ed< e
� ed< d S )
� cmd_computerzComputer management.�add�creater� �edit�list�show�moveN) r� r� r� r� � subcommandsrc r� r� r� r� r� r$ r$ r$ r% r� � s
r� )N)7� samba.getopt�getoptr� rE r �sambar� r� r� r � samba.dcerpcr r r �samba.dnsserverr r � samba.ndrr r r
�samba.remove_dcr �
samba.authr � samba.samdbr
� samba.commonr �
subprocessr r r� r r r r r r � samba.netcmdr r r r r& r* r, rb rc r� r� r� r� r� r� r$ r$ r$ r% �<module> s>
_ _s9W6