File: //usr/lib/python3/dist-packages/samba/provision/__pycache__/sambadns.cpython-310.pyc
o
ɣ�b� � @ s0 d Z ddlZddlZddlZddlZddlZddlmZ ddlZddl Z ddl
m Z ddl m
Z
ddlmZmZ ddl mZ ddlmZmZmZ dd lmZmZmZmZmZm Z dd
l m Z m Z m Z m!Z!m"Z"m#Z# dd l$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z, dd l-m.Z. dd
l/m0Z0 dd� Z1dd� Z2G dd� dej3�Z4G dd� dej3�Z5G dd� dej3�Z6G dd� dej3�Z7G dd� dej3�Z8G d d � d ej3�Z9G d d � d ej3�Z:G d d!� d!ej;�Z<G d"d#� d#ej;�Z=G d$d%� d%ej;�Z>G d&d'� d'ej;�Z?G d(d)� d)ej;�Z@G d*d+� d+ej;�ZAG d,d-� d-ej;�ZBd.d/� ZCd0d1� ZDdld3d4�ZEd5d6� ZFd7d8� ZGd9d:� ZHd;d<� ZId=d>� ZJd?d@� ZKdAdB� ZLdCdD� ZMdEdF� ZNdGdH� ZOdIdJ� ZPdKdL� ZQdMdN� ZRdOdP� ZSdQdR� ZTdSdT� ZUdUdV� ZVdWdX� ZWdYdZ� ZXd[d\� ZYd]d^� ZZd_d`� Z[dadb� Z\dcdd� Z]dee)defdfdg�Z^dddde)dfdhdi�Z_ dmdjdk�Z`dS )nzDNS-related provisioning� N)� b64encode)�tdb_copy)�mdb_copy)�ndr_pack�
ndr_unpack)�
setup_file)�dnsp�misc�security)�DS_DOMAIN_FUNCTION_2000�DS_DOMAIN_FUNCTION_2003�DS_DOMAIN_FUNCTION_2008_R2�DS_DOMAIN_FUNCTION_2012_R2�DS_DOMAIN_FUNCTION_2016�DS_GUID_USERS_CONTAINER)�get_domain_descriptor�'get_domain_delete_protected1_descriptor�'get_domain_delete_protected2_descriptor� get_dns_partition_descriptor�'get_dns_forest_microsoft_dns_descriptor�'get_dns_domain_microsoft_dns_descriptor)�
setup_path�setup_add_ldif�setup_modify_ldif� setup_ldb� FILL_FULL�FILL_SUBDOMAIN� FILL_NT4SYNC�FILL_DRS)�get_default_backend_store)�
get_stringc C s4 | j |tjdgd�}tttj|d d d ��}|S )N�
objectGUID��base�scope�attrsr )�search�ldb�
SCOPE_BASE�strr r �GUID)�samdb�domaindn�res�
domainguid� r/ �:/usr/lib/python3/dist-packages/samba/provision/sambadns.py�get_domainguidB s r1 c C sH d| � t�| |�t� }| j|tjdgd�}ttj|d d d �}|S )NzCN=DnsAdmins,%s� objectSidr" r ) �get_wellknown_dnr' �Dnr r& r( r r
�dom_sid)r+ r, �base_dnr- �
dnsadmins_sidr/ r/ r0 �get_dnsadmins_sidH s ��r8 c �& e Zd Zddejf� fdd� Z� ZS )�ARecord� � c �2 t t| ��� tj| _|| _|| _|| _|| _ d S �N)
�superr: �__init__r �
DNS_TYPE_A�wType�rank�dwSerial� dwTtlSeconds�data)�self�ip_addr�serial�ttlrC �� __class__r/ r0 r@ [ �
zARecord.__init__��__name__�
__module__� __qualname__r �
DNS_RANK_ZONEr@ �
__classcell__r/ r/ rK r0 r: Y � r: c r9 )�
AAAARecordr; r< c r= r> )
r? rU r@ r �
DNS_TYPE_AAAArB rC rD rE rF )rG �ip6_addrrI rJ rC rK r/ r0 r@ f rM zAAAARecord.__init__rN r/ r/ rK r0 rU d rT rU c r9 )� CNAMERecordr; r< c s. t � �� tj| _|| _|| _|| _|| _d S r> ) r? r@ r �DNS_TYPE_CNAMErB rC rD rE rF )rG �cnamerI rJ rC rK r/ r0 r@ q s
zCNAMERecord.__init__rN r/ r/ rK r0 rX o rT rX c r9 )�NSRecordr; r< c r= r> )
r? r[ r@ r � DNS_TYPE_NSrB rC rD rE rF )rG �
dns_serverrI rJ rC rK r/ r0 r@ | rM zNSRecord.__init__rN r/ r/ rK r0 r[ z rT r[ c s. e Zd Zddddddejf� fdd� Z� ZS )� SOARecordr; r< iX i�Q i c
sd t t| ��� tj| _| | _|| _|| _t� � }
||
_
||
_ ||
_ ||
_
||
_||
_||
_|
| _d S r> )r? r^ r@ r � DNS_TYPE_SOArB rC rD rE �soarI �refresh�retry�expire�mname�rname�minimumrF ) rG rd re rI ra rb rc rf rJ rC r` rK r/ r0 r@ � s
zSOARecord.__init__rN r/ r/ rK r0 r^ � s
�r^ c s* e Zd Zddddejf� fdd� Z� ZS )� SRVRecordr �d r; r< c sR t t| ��� tj| _|| _|| _|| _t� � }||_
||_ ||_ ||_
|| _d S r> )r? rg r@ r � DNS_TYPE_SRVrB rC rD rE �srv�
nameTarget�wPort� wPriority�wWeightrF ) rG �target�port�priority�weightrI rJ rC rj rK r/ r0 r@ � s
zSRVRecord.__init__rN r/ r/ rK r0 rg � s �rg c r9 )� TXTRecordr; r< c sJ t t| ��� tj| _|| _|| _|| _t� � }t
|�|_ ||_ || _
d S r> )r? rs r@ r � DNS_TYPE_TXTrB rC rD rE � string_list�len�countr) rF )rG �slistrI rJ rC �
stringlistrK r/ r0 r@ � s
zTXTRecord.__init__rN r/ r/ rK r0 rs � rT rs c �" e Zd Zejf� fdd� Z� ZS )� TypePropertyc �, t t| ��� d| _d| _tj| _|| _d S �Nr; ) r? r{ r@ � wDataLength�versionr �DSPROPERTY_ZONE_TYPE�idrF )rG � zone_typerK r/ r0 r@ � �
zTypeProperty.__init__)rO rP rQ r �DNS_ZONE_TYPE_PRIMARYr@ rS r/ r/ rK r0 r{ � � r{ c rz )�AllowUpdatePropertyc r| r} ) r? r� r@ r~ r r � DSPROPERTY_ZONE_ALLOW_UPDATEr� rF )rG � allow_updaterK r/ r0 r@ � r� z AllowUpdateProperty.__init__)rO rP rQ r �DNS_ZONE_UPDATE_SECUREr@ rS r/ r/ rK r0 r� � r� r� c � e Zd Zd� fdd� Z� ZS )�SecureTimePropertyr c r| r} ) r? r� r@ r~ r r �DSPROPERTY_ZONE_SECURE_TIMEr� rF )rG � secure_timerK r/ r0 r@ � r� zSecureTimeProperty.__init__�r �rO rP rQ r@ rS r/ r/ rK r0 r� � � r� c r� )�NorefreshIntervalPropertyr c r| r} ) r? r� r@ r~ r r �"DSPROPERTY_ZONE_NOREFRESH_INTERVALr� rF )rG �norefresh_intervalrK r/ r0 r@ � r� z"NorefreshIntervalProperty.__init__r� r� r/ r/ rK r0 r� � r� r� c r� )�RefreshIntervalPropertyr c r| r} ) r? r� r@ r~ r r � DSPROPERTY_ZONE_REFRESH_INTERVALr� rF )rG �refresh_intervalrK r/ r0 r@ � r� z RefreshIntervalProperty.__init__r� r� r/ r/ rK r0 r� � r� r� c r� )�AgingStatePropertyr c r| r} ) r? r� r@ r~ r r �DSPROPERTY_ZONE_AGING_STATEr� rF )rG �
aging_enabledrK r/ r0 r@ � r� zAgingStateProperty.__init__r� r� r/ r/ rK r0 r� � r� r� c r� )�AgingEnabledTimePropertyr c r| r} ) r? r� r@ r~ r r �"DSPROPERTY_ZONE_AGING_ENABLED_TIMEr� rF )rG �next_cycle_hoursrK r/ r0 r@ � r� z!AgingEnabledTimeProperty.__init__r� r� r/ r/ rK r0 r� � r� r� c C sl d| }d| }t |�} t| td�|t| ��d�d�� |tkr0t| td�|t| ��d�d�� t| |�}
tt� � �}
t
� | |�� � �
� } t|�} t|�}
t| td�||
| ||t|
��d�t| ��d�d�� t| td�|||d �� |tkr�t| |�}tt� � �}t
� | |�� � �
� }t| td�|||||t|
��d�t| ��d�d�� t| td�|||d �� d S d S )
NzDC=DomainDnsZones,%szDC=ForestDnsZones,%sz"provision_dnszones_partitions.ldif�utf8)�ZONE_DN�SECDESCzprovision_dnszones_add.ldif)r� � ZONE_GUID�ZONE_DNS�CONFIGDN�SERVERDN�LOSTANDFOUND_DESCRIPTOR�INFRASTRUCTURE_DESCRIPTORz provision_dnszones_modify.ldif)r� r� r� )r r r r �decoder r1 r) �uuid�uuid4r' r4 �canonical_ex_str�stripr r r )r+ � domainsidr, �forestdn�configdn�serverdn�
fill_level�
domainzone_dn�
forestzone_dn�
descriptor�domainzone_guid�domainzone_dns�protected1_desc�protected2_desc�forestzone_guid�forestzone_dnsr/ r/ r0 �setup_dns_partitions� sd
�
�
�
�
�
��r� c C s t | td�d|i� d S )Nz provision_dns_accounts_add.ldif�DOMAINDN)r r )r+ r, r/ r/ r0 �add_dns_accounts8 s
�r� Fc C sv dt |�i}|du rt||d�}nt||d�}t�t�| d||f ��}ddg|d< t�|tjd�|d< | �|� d S ) N� DnsAdminsT)�name_mapzCN=MicrosoftDNS,%s,%s�top� container� objectClass�nTSecurityDescriptor) r) r r r' �Messager4 �MessageElement� FLAG_MOD_ADD�add) r+ r, �prefix�
domain_sidr7 �forestr� �sd_val�msgr/ r/ r0 �add_dns_container> s ��
��r� c
C s� i }d|d< d|d< d|d< d|d< d |d
< d |d < d
|d< d|d< d|d< d|d< d|d< d|d< d|d< i }d|d< d |d< d |d< d |d< d |d
< d |d < d!|d< d"|d< d#|d< d$|d< d%|d< d&|d< d'|d< d(||f }t �t �| |��}g }|�tttjd)��� |�tttj d*��� |�tt
� �� |�tt � �� |�tt � �� |�tt
� �� |�tt� �� d+d,g|d-< t �d.t jd/�|d/< t �|t jd0�|d0< | �|� g }|D ]} |�tt| d1d1tjd2��� q�t �t �| d3| ��}d+d4g|d-< t �|t jd5�|d5< | �|� |D ]3} tt|| d1d1tjd2��g}t �t �| d6| |f ��}d+d4g|d-< t �|t jd5�|d5< | �|� �qd S )7Nz
198.41.0.4za.root-servers.netz192.228.79.201zb.root-servers.netz 192.33.4.12zc.root-servers.netz 199.7.91.13zd.root-servers.netz192.203.230.10ze.root-servers.netz 192.5.5.241zf.root-servers.netz 192.112.36.4zg.root-servers.netz
198.97.190.53zh.root-servers.netz
192.36.148.17zi.root-servers.netz
192.58.128.30zj.root-servers.netz 193.0.14.129zk.root-servers.netz 199.7.83.42zl.root-servers.netz 202.12.27.33zm.root-servers.netz2001:503:ba3e::2:30z2001:500:84::bz
2001:500:2::cz2001:500:2d::dz2001:500:a8::ez2001:500:2f::fz2001:500:12::d0dz2001:500:1::53z 2001:7fe::53z2001:503:c27::2:30z 2001:7fd::1z2001:500:9f::42z 2001:dc3::35z'DC=RootDNSServers,CN=MicrosoftDNS,%s,%s)r� )r� r� �dnsZoner� �Zone�cn� dNSPropertyr )rI rJ rC �DC=@,%s�dnsNode� dnsRecordzDC=%s,%s)r' r� r4 �appendr r{ r �DNS_ZONE_TYPE_CACHEr� �DNS_ZONE_UPDATE_OFFr� r� r� r� r� r� r� r� r[ �DNS_RANK_ROOT_HINTr: )
r+ r, r� � rootservers�rootservers_v6� container_dnr� �props�record�rserverr/ r/ r0 �add_rootserversO sp
�r� c C s� d||f }g }t |d| �} |�t| �� t|�}
|�t|
�� |d ur0t|�} |�t| �� |d ur?t|�} |�t| �� t�t�| d| ��}
ddg|
d< t� |tj
d�|
d< | � |
� d S )N�%s.%sz
hostmaster.%sr� r� r� r� r� ) r^ r� r r[ r: rU r' r� r4 r� r� r� )r+ r� r� �hostname� dnsdomain�hostip�hostip6�
fqdn_hostname�
at_records�
at_soa_record� at_ns_record� at_a_record�at_aaaa_recordr� r/ r/ r0 �
add_at_record� s r� c C sV t ||�}t�t�| d||f ��}ddg|d< t�t|�tjd�|d< | �|� d S �N�%s,%sr� r� r� r� )rg r' r� r4 r� r r� r� )r+ r� r� �hostrp �
srv_recordr� r/ r/ r0 �add_srv_record� s
r� c C �T t |�}t�t�| d||f ��}ddg|d< t�t|�tjd�|d< | �|� d S r� )r[ r' r� r4 r� r r� r� �r+ r� r� r� � ns_recordr� r/ r/ r0 �
add_ns_record� �
r� c C sZ t |tjd�}t�t�| d||f ��}ddg|d< t�t|�tjd�|d< | � |� d S )N)rC r� r� r� r� r� )
r[ r �DNS_RANK_NS_GLUEr' r� r4 r� r r� r� r� r/ r/ r0 �add_ns_glue_record� s
r� c C r� r� )rX r' r� r4 r� r r� r� )r+ r� r� r� � cname_recordr� r/ r/ r0 �add_cname_record� r� r� c C s� g }|rt |�}|�t|�� |r t|�}|�t|�� |rBt�t�| d||f ��}ddg|d< t�|tjd�|d< | � |� d S d S r� )
r: r� r rU r' r� r4 r� r� r� ) r+ r� r� r� r� � host_records�a_record� aaaa_recordr� r/ r/ r0 �add_host_record� s �r� c
C s� d| }t j�||�}g }|�tt� �� |�tt� �� |�tt� �� |�ttdd��� |�tt dd��� |�tt
� �� |�tt � �� t �
t �| d|||f ��} ddg| d< t �t|�t jd �| d
< t �|t jd �| d < | �| � d S ) Na{ O:SYG:BAD:AI(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;CC;;;AU)(A;;RPLCLORC;;;WD)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CI;RPWPCRCCDCLCRCWOWDSDDTSW;;;ED)(A;CIID;RPWPCRCCDCLCRCWOWDSDDTSW;;;%s)(A;CIID;RPWPCRCCDCLCRCWOWDSDDTSW;;;ED)(OA;CIID;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)(A;CIID;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;CIID;LC;;;RU)(A;CIID;RPWPCRCCLCLORCWOWDSDSW;;;BA)S:AI� )r� )r� �DC=%s,CN=MicrosoftDNS,%s,%sr� r� r� r� �ntSecurityDescriptorr� )r
r� � from_sddlr� r r{ r� r� r� r� r� r� r' r� r4 r� r� r� )
r+ r, r� r� r� r7 �sddl�secr� r� r/ r/ r0 �add_domain_record� s* �
��r c C s6 t �t �| d|||f ��}ddg|d< | �|� d S )N�"DC=_msdcs.%s,CN=MicrosoftDNS,%s,%sr� r� r� )r' r� r4 r� )r+ r� r� � dnsforestr� r/ r/ r0 �add_msdcs_record s
� r c
C s` d||f }t �| d|||f �} t| | d||||� t| | d| ||� t| | d|d� t| | d| |d� t| | d|d� t| | d |d
� t| | d |d
� t| | d |d
� t| | d| |d
� t| | d|d� t| | d| |d� t| | d|� t| | d| |d
� t| | d| |d
� t| | d|d
� t| | d|d
� t| | d||� t| | d||� d S )Nr� r� �DC=@�DC=%szDC=_kerberos._tcp�X zDC=_kerberos._tcp.%s._siteszDC=_kerberos._udpzDC=_kpasswd._tcpi� zDC=_kpasswd._udpz
DC=_ldap._tcp� zDC=_ldap._tcp.%s._sitesz DC=_gc._tcp�� zDC=_gc._tcp.%s._sitesz DC=_msdcsz&DC=_ldap._tcp.%s._sites.DomainDnsZonesz&DC=_ldap._tcp.%s._sites.ForestDnsZonesz DC=_ldap._tcp.DomainDnsZonesz DC=_ldap._tcp.ForestDnsZones�DC=DomainDnsZones�DC=ForestDnsZones)r' r4 r� r� r� r� )
r+ r, r� �siter� r� r� r� r� �domain_container_dnr/ r/ r0 �add_dc_domain_records
s| � ��������
���
� �����
�
�r c
C s� d||f }
t �| d|||f �} t| | d||d d � t| | d|
d� t| | d| |
d� t| | d|
d� t| | d | |
d� t| | d
| |
d � t| | d |
d � t| | d
|
d� t| | d||� t| | d| |
d� t| | d| |
� d S )Nr� r r zDC=_kerberos._tcp.dcr z DC=_kerberos._tcp.%s._sites.dczDC=_ldap._tcp.dcr zDC=_ldap._tcp.%s._sites.dczDC=_ldap._tcp.%s._sites.gcr
zDC=_ldap._tcp.gczDC=_ldap._tcp.pdczDC=gczDC=_ldap._tcp.%s.domainsr )r' r4 r� r� r� r� ) r+ r� r� r
r r� r� r� r. �ntdsguidr� �forest_container_dnr/ r/ r0 �add_dc_msdcs_recordsj sN � ��
��������
� �r c
C s� zt �t j�||�� t �t j�||�� W n ty Y nw |du r&d}t| td�|||t|�d��� d�t
|�|j d|j �
� |j�
� f d�� dS )z�Add DNS specific bits to a secrets database.
:param secretsdb: Ldb Handle to the secrets database
:param names: Names shortcut
:param machinepass: Machine password
Nr; zsecrets_dns.ldifzutf-8r� r� )�REALM� DNSDOMAIN�
DNS_KEYTAB� DNSPASS_B64�KEY_VERSION_NUMBER�HOSTNAME�DNSNAME)�os�unlink�path�join�OSErrorr r r �encoder� r) r� � netbiosname�lowerr� ) � secretsdb�names� private_dir� binddns_dir�realmr� �dns_keytab_path�dnspass�key_version_numberr/ r/ r0 �secretsdb_setup_dns� s& �
� �r* c C s� t j�|j�}zt�|d� W n ty Y nw t �|d� |jdurRzt � |d|j� t �
|d� W dS tyQ dt j vrN| � d||jf � Y dS Y dS w dS )zx(Re)create the DNS directory and chown it to bind.
:param logger: Logger object
:param paths: paths object
T� N����SAMBA_SELFTEST�!Failed to chown %s to bind gid %u)
r r �dirname�dns�shutil�rmtreer �mkdir�bind_gid�chown�chmod�environ�error)�logger�paths�dns_dirr/ r/ r0 �create_dns_dir� s& �
����r< c
C s� t j�|j|j�}t j�|j|j�}t j�|�r�t j�|�rBzt �|� W n tyA } z| � d||j
f � W Y d}~nd}~ww zt � ||� W n tyg } z| � d|||j
f � W Y d}~nd}~ww |j dur�zt �
|jd� t �|jd|j � W n ty� dt jvr�| �d|j|j � Y nw zt �
|d� t �|d|j � W dS ty� dt jvr�| �d||j � Y dS Y dS w dS dS ) zhCreate link for BIND to DNS keytab
:param logger: Logger object
:param paths: paths object
zFailed to remove %s: %sNz"Failed to create link %s -> %s: %sr+ r, r- r. i� )r r r r$ �
dns_keytabr% �isfiler r r8 �strerror�linkr4 r6 r5 r7 �info)r9 r: �private_dns_keytab_path�bind_dns_keytab_path�er/ r/ r0 �create_dns_dir_keytab_link� sV ���
���
���
����rE c C s t | t�sJ �|durd| } |d | }
d| }nd} d}
d}|dur3d| }|d | }d| }nd}d}d}ttd �|j|||||| t�d
�| |
| |
||d �
� |jdur�zt� |jd |j� t�
|jd
� W dS t y� dtj vr�|�
d|j|jf � Y dS Y dS w dS )a� Write out a DNS zone file, from the info in the current database.
:param paths: paths object
:param dnsdomain: DNS Domain name
:param domaindn: DN of the Domain
:param hostip: Local IPv4 IP
:param hostip6: Local IPv6 IP
:param hostname: Local hostname
:param realm: Realm name
:param domainguid: GUID of the domain.
:param ntdsguid: GUID of the hosts nTDSDSA record.
Nz IN AAAA z IN AAAA z#gc._msdcs IN AAAA � z IN A z IN A z gc._msdcs IN A zprovision.zonez%Y%m%d%H)
r r r �HOSTIP_BASE_LINE�HOSTIP_HOST_LINE�
DOMAINGUID�
DATESTRING� DEFAULTSITE�NTDSGUID�HOSTIP6_BASE_LINE�HOSTIP6_HOST_LINE�GC_MSDCS_IP_LINE�GC_MSDCS_IP6_LINEr, i� r- r. )�
isinstancer) r r r0 �time�strftimer4 r r5 r6 r r7 r8 )�lpr9 r: � targetdirr� r� r� r� r& r. r r
�hostip6_base_line�hostip6_host_line�gc_msdcs_ip6_line�hostip_base_line�hostip_host_line�gc_msdcs_ip_liner/ r/ r0 �create_zone_file sT
�
����r\ c $ C s( |j }tj�|d�}tj�|j�}tj�|d�} i }
| jdtjddgd�} | d d D ]} t | ��
d�\}
}||
|
� � < q+t � }d| d v rPt | d d d �}|j
� � }tj�||
| �}zMt�| � t|d��� d ||f }t�|�}| jd
tjd �}|�|d � d | }tt|���d
�}t|td�|j
|t |�|d�� t|td�d� W n |�d� � |
|= d|j
� � }d|j� � }|
| }|
�|�}d}zgt� tj�||�tj�| |�� t� tj�||�tj�||�� |dk�r t� tj�||d �tj�||d �� |�r7t� tj�||�tj�||�� |dk�r7t� tj�||d �tj�||d �� W n t �yF |�d� � w |
|= |�rP|
|= z@t tj�|d�tj�|d�� |
D ],}
|
|
} |dk�r~t tj�|| �tj�|| �� �qbt tj�|| �tj�|| �� �qbW n |�d� � |j du�rzKt�!|�D ]B\} } } | D ]} tj�| | �}!t�"|!d|j � t�#|!d� �q�| D ] }"|"�$d��r�tj�| |"�}#t�"|#d|j � t�#|#d � �qȐq�W dS t �y d tj%v�r|�d � Y dS Y dS w d tj%v�r|�&d � dS dS ) zRCreate a copy of samdb and give write permissions to named for dns partitions
z sam.ldb.dz
@PARTITION� partition� backendStorer" r �:�wz%s://%sz
@INDEXLIST)r# r$ zobjectGUID: %s
-r� zprovision_basedn.ldif)r� rI � DOMAINSID�
DESCRIPTORz provision_basedn_options.ldifNz>Failed to setup database for BIND, AD based DNS cannot be usedzDC=DOMAINDNSZONES,%szDC=FORESTDNSZONES,%sz metadata.tdb�mdbz-lockzsam.ldbr, r+ )z.ldbz.tdbzldb-locki� r- z9Failed to set permissions to sam.ldb* files, fix manuallyz\Unable to find group id for BIND,
set permissions to sam.ldb* files manually)'r$ r r r r/ r0 r& r' r( r) �split�upperr r, r3 �open�close�samba�Ldbr� r r r� r r r8 �rootdn�getr@ r r r r4 �walkr5 r6 �endswithr7 �warning)$r+ r9 r: r# r� r. r$ �
samldb_dirr; �dns_samldb_dir�partfiler- �tmp�nc�fname�
backend_storer, �domainpart_file�dom_url�dom_ldb� index_res�domainguid_line�descr� domainzonedn� forestzonedn�domainzone_file�forestzone_file�
metadata_file�pfiler/ �dirs�files�d�dpath�f�fpathr/ r/ r0 �create_samdb_copy@ s� �
���
� �
� �
���� �
� ��� ���
��� �r� c C s( t td�|jd� t td�|jd� dS )z Write out a dns_update_list file�dns_update_listN�spn_update_list)r r r� r� )rT r9 r: r/ r/ r0 �create_dns_update_list� s r� c C s* ddl m} |dkr3ttd�| j||| jdd�|�d�dd� � | j| jd �� ttd
�| j� dS |d k�rt j
d gd
t j t j dd��
� d }t|�}d}d}d} d}
d} d} d}
d}|�� �d�dkrid}n�|�� �d�dkrud}n�|�� �d�dkr�d} nx|�� �d�dkr�d}
nl|�� �d�dkr�d} n`|�� �d�dkr�d} nT|�� �d�dkr�d}
nH|�� �d�dkr�d}n<|�� �d�dkr�|d��|�� �d �dkr�|d ��|�� �d �dkr�|d ��|�� �d �dkr�|d ��|�d | j � ttd!�| j| jtj�� ||| |
| | |
|d"�
� dS dS )#ac Write out a file containing zone statements suitable for inclusion in a
named.conf file (including GSS-TSIG configuration).
:param paths: all paths
:param realm: Realm name
:param dnsdomain: DNS Domain name
:param dns_backend: DNS backend type
:param keytab_name: File name of DNS keytab file
:param logger: Logger object
r )�ProvisioningError�BIND9_FLATFILEz
named.confz*.�.r; N)r r � ZONE_FILE�REALM_WC�
NAMED_CONF�NAMED_CONF_UPDATEznamed.conf.update� BIND9_DLZznamed -VT)�shell�stdout�stderr�cwd�#zBIND 9.8r, rF zBIND 9.9z BIND 9.10z BIND 9.11z BIND 9.12z BIND 9.14z BIND 9.16z BIND 9.18zBIND 9.7z&DLZ option incompatible with BIND 9.7.z BIND_9.13z/Only stable/esv releases of BIND are supported.z BIND_9.15z BIND_9.17z0BIND version unknown, please modify %s manually.znamed.conf.dlz)
r� �
MODULESDIR�BIND9_8�BIND9_9�BIND9_10�BIND9_11�BIND9_12�BIND9_14�BIND9_16�BIND9_18)�samba.provisionr� r r � namedconfr0 r rd �namedconf_update�
subprocess�Popen�PIPE�STDOUT� communicater re �findrn rh �param� modules_dir)r: r& r� � dns_backendr9 r� � bind_info�bind9_8�bind9_9�bind9_10�bind9_11�bind9_12�bind9_14�bind9_16�bind9_18r/ r/ r0 �create_named_conf� s� �
�� ��r� c C s, t td�| ||||tj�||�|d�� dS )ab Write out a file containing zone statements suitable for inclusion in a
named.conf file (including GSS-TSIG configuration).
:param path: Path of the new named.conf file.
:param realm: Realm name
:param dnsdomain: DNS Domain name
:param binddns_dir: Path to bind dns directory
:param keytab_name: File name of DNS keytab file
z named.txt)r r r r �DNS_KEYTAB_ABS� PRIVATE_DIRN)r r r r r )r r& r� �dnsnamer% � keytab_namer/ r/ r0 �create_named_txt% s
�r� c C s | dv S )N)r� r� �SAMBA_INTERNAL�NONEr/ )r� r/ r/ r0 �is_valid_dns_backend: s r� c C s t | ko tkS S r> )r r )�os_levelr/ r/ r0 �is_valid_os_level> s r� c C s t | |d||� t| |d� d S �Nz CN=System)r� r� )r+ r� r� r7 r/ r/ r0 �create_dns_legacyB s r� c C s, t | |d|||� t| |d|||||� d S r� )r r ) r+ r� r� r� r
r� r� r� r7 r/ r/ r0 �fill_dns_data_legacyI s � �r� c C sL t | ||||j|j|� t| |d||� |tkr$t| |d||dd� d S d S )Nr r T)r� )r� r� r� r� r )r+ r� r# r, r� r7 r� r/ r/ r0 �create_dns_partitionsT s
�
�
��r� Tc C s| |rt | |d� t| |d||| � |
r t| |d||||| � |tkr:t| |d|� |
r<t| |d||||| |
| �
dS dS dS )a� Fill data in various AD partitions
:param samdb: LDB object connected to sam.ldb file
:param domainsid: Domain SID (as dom_sid object)
:param site: Site name to create hostnames in
:param domaindn: DN of the domain
:param forestdn: DN of the forest
:param dnsdomain: DNS name of the domain
:param dnsforest: DNS name of the forest
:param hostname: Host name of this DC
:param hostip: IPv4 addresses
:param hostip6: IPv6 addresses
:param domainguid: Domain GUID
:param ntdsguid: NTDS GUID
:param dnsadmins_sid: SID for DnsAdmins group
:param autofill: Create DNS records (using fixed template)
r r N)r� r r r r r )r+ r� r
r, r� r� r r� r� r� r. r r7 �autofillr� �add_rootr/ r/ r0 �fill_dns_data_partitionsb s$
�
�
��r� c C s� t |�s
td| ��t|�std| ��|dkr |�d� dS |�d� t| |j� |j}| �� �� }|j� � }|}|j
}|j � � }t | |�}t
| |�}| �� z[|�d| � t| |j||� |tkry|�d| � t| |j||||| |
|� n1|d v r�|tkr�|�d
� t| |j||||| � |�d � t| |j||||||| |
||j|| d � W n | �� � | �� |�d
�r�t| |||||||||| |
| |
d� dS dS )aW Provision DNS information (assuming GC role)
:param samdb: LDB object connected to sam.ldb file
:param secretsdb: LDB object connected to secrets.ldb file
:param names: Names shortcut
:param paths: Paths shortcut
:param lp: Loadparm object
:param logger: Logger object
:param dns_backend: Type of DNS backend
:param os_level: Functional level (treated as os level)
:param dnspass: Password for bind's DNS account
:param hostip: IPv4 address
:param hostip6: IPv6 address
:param targetdir: Target directory for creating DNS-related files for BIND9
�Invalid dns backend: %r�Invalid os level: %rr� z'No DNS backend set, not configuring DNSNzAdding DNS accountsz%Creating CN=MicrosoftDNS,CN=System,%sz'Populating CN=MicrosoftDNS,CN=System,%s)r� r� z5Creating DomainDnsZones and ForestDnsZones partitionsz7Populating DomainDnsZones and ForestDnsZones partitions)r� �BIND9_)r
r( r� r� rU ru )r� � Exceptionr� rA r� r, �get_root_basedn�get_linearizedr� r! �sitenamer r8 r1 �transaction_startr� r� r r� r r� r� r �transaction_cancel�transaction_commit�
startswith�setup_bind9_dns)r+ r" r# r: rT r9 r� r� r( r� r� rU r� ru r, r� r� r r
r� r7 r. r/ r/ r0 � setup_ad_dns� sd
�
�
��
��r� c C s. t |�r |�d�std| ��t|�std| ��|j}t| |�}t|||j|j|j |j
|j | |
d� t ||� t
||� |dkrUt|||| ||j
|
| |j|j ||jd� |dkrg|tkrgt| ||||j|� t||j |j
||d� t|j|j |j
d |j|j
f |j|j d
� |�d |j� |�d |j� d
S )a� Provision DNS information (assuming BIND9 backend in DC role)
:param samdb: LDB object connected to sam.ldb file
:param secretsdb: LDB object connected to secrets.ldb file
:param names: Names shortcut
:param paths: Paths shortcut
:param lp: Loadparm object
:param logger: Logger object
:param dns_backend: Type of DNS backend
:param os_level: Functional level (treated as os level)
:param site: Site to create hostnames in
:param dnspass: Password for bind's DNS account
:param hostip: IPv4 address
:param hostip6: IPv6 address
:param targetdir: Target directory for creating DNS-related files for BIND9
r� r� r� )r& r� r' r( r) r� )r
r� r� r� r� r& r. r r� )r& r� r� r9 r� )r& r� r� r% r� z9See %s for an example configuration include file for BINDz@and %s for further documentation required for secure DNS updatesN)r� r� r� r� r, r1 r* r$ r% r& r� r= r< rE r\ r� r r r� r� r� r� �namedtxtrA r� )r+ r" r# r: rT r9 r� r� r
r( r� r� rU r) ru r, r. r/ r/ r0 r� � sZ �
�
������r� )F)NNNNNNN)a�__doc__r r� r1 rR r' �base64r r� rh �samba.tdb_utilr �samba.mdb_utilr � samba.ndrr r r � samba.dcerpcr r r
�
samba.dsdbr r r
r r r �samba.descriptorr r r r r r �samba.provision.commonr r r r r r r r � samba.samdbr � samba.commonr r1 r8 �DnssrvRpcRecordr: rU rX r[ r^ rg rs � DnsPropertyr{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r* r< rE r\ r� r� r� r� r� r� r� r� r� r� r� r� r/ r/ r/ r0 �<module> s� (
:
G "]5 *> U
�1
�f�