
    Idg                     8   d dl mZ d dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d d	lmZmZmZmZ  G d
 de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Zy)    N)	provision)dsdb)SamDB)system_session)security)ndr_pack
ndr_unpack)_get_user_realm_domain)CommandCommandErrorSuperCommandOptionc                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
gZd ZddZy)cmd_delegation_showz*Show the delegation setting of an account.z%prog <accountname> [options]	sambaoptscredoptsversionopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestaccountnamec                    |j                   }|j                  }d}||t        j                  z  s | j                  j                  d| d       y |t        j                  z  s | j                  j                  d| d       y d}|j                  D ]	  }|j                  }	 |j                  d| dt        j                  	      }	t        |	      d
k(  r|	d   j                  }	 d}|j                  t        j"                  k(  s|j                  t        j$                  k(  r%| j                  j                  d| d| d       d}n<|j                  t        j&                  k7  r|j                  t        j(                  k7  rd}|j*                  t        j,                  z  }|j*                  t        j.                  z  }|j*                  t        j0                  z  }|j*                  t        j2                  z  }|r|s|sd}nL|r$| j                  j                  d| d| d       d}|r$| j                  j                  d| d| d       d}|j4                  sd}|r|r| j6                  j                  d       d}| j6                  j                  d| d        y # t        j                  $ r.}
|
j                  \  }}|t        j                   k7  r Y d }
~
d }
~
ww xY w)NzISecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentityzWarning: DACL not present in z!
zWarning: DACL in z lacks SELF_RELATIVE flag!
Tz<SID=>)scope   r   FzWarning: ACE in z denies access for trustee zWarning: ACE for trustee z. has unexpected CONTAINER_INHERIT flag set in z* has unexpected INHERITED_ACE flag set in z0  Principals that may delegate to this account:
z*msDS-AllowedToActOnBehalfOfOtherIdentity: 
)daclr   r   SEC_DESC_DACL_PRESENTerrfwriteSEC_DESC_SELF_RELATIVEacestrusteesearchldb
SCOPE_BASElendnLdbErrorargsERR_NO_SUCH_OBJECTSEC_ACE_TYPE_ACCESS_DENIED!SEC_ACE_TYPE_ACCESS_DENIED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWED"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTflagsSEC_ACE_FLAG_INHERIT_ONLYSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSEC_ACE_FLAG_INHERITED_ACEaccess_maskoutf)selfsamsecurity_descriptorr%   	desc_typewarning_infofirstacer+   reserrnum_ignoreinherit_onlyobject_inheritcontainer_inheritinherited_aces                     9/usr/lib/python3/dist-packages/samba/netcmd/delegation.pyshow_security_descriptorz,cmd_delegation_show.show_security_descriptor8   s   "''',,	C <y8+I+IIIIOO;L>MN8:::IIOO/~ >4 5 699 >	0CkkG	(jj5	!3'*~~ ! 7 s8q=!!fiiGFH???xx8#M#MM		"2<. A66=Yc!C D ((hBBBH$O$OO99x'I'IIL YY)M)MMN		HCCC II(K(KKMN;L $IIOO&?y IP'3nC%9 : "F IIOO&?y IL'3nC%9 : "F??IIOO '1 3!E		"L#*)2!/ 0{>	0 << Q#000 1s   "%JK 2#KK Nc                    |j                         }|j                  |      }t        j                  ||j	                  d            }||j
                  }	n|}	t        |	t               ||      }
t        ||
      \  }}}|
j                  dt        j                  |      z  t        j                  g d      }t        |      dk(  rt        d|z        t        |      dk(  sJ t        |d   j	                  d	      d         }|d   j	                  d
      }|d   j	                  dd      }| j                   j#                  dt%        |d   j&                        z         | j                   j#                  dt)        |t*        j,                  z        z         | j                   j#                  dt)        |t*        j.                  z        z         |r@| j                   j#                  d       |D ]   }| j                   j#                  d|z         " |.	 t1        t2        j4                  |      }| j7                  |
|       y y # t8        $ r | j:                  j#                  d       Y y w xY w)Nrealmsession_infocredentialslpsAMAccountName=%s)userAccountControlmsDS-AllowedToDelegateTo(msDS-AllowedToActOnBehalfOfOtherIdentity
expressionr"   attrsr    Unable to find account name '%s'r#   rX   rY   rZ   idxzAccount-DN: %s
zUF_TRUSTED_FOR_DELEGATION: %s
z.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: %s
z)  Services this account may delegate to:
zmsDS-AllowedToDelegateTo: %s
znWarning: Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity could not be unmarshalled!
)get_loadparmget_credentialsr   provision_paths_from_lpgetsamdbr   r   r
   r,   r-   binary_encodeSCOPE_SUBTREEr/   r   intr>   r(   strr0   boolr   UF_TRUSTED_FOR_DELEGATION)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONr	   r   
descriptorrP   RuntimeErrorr'   )r?   r   r   r   r   r   rV   credspathspathr@   cleanedaccountrR   domainrF   uacallowedallowed_fromarA   s                       rO   runzcmd_delegation_show.run   sG   ##%((,11"bffWoF9;;DDD~'7 %". +AAD+F' jj$7**>:%;"00 L  M
 s8q=AKOPP3x1}}#a&**12156a&**781vzz"LRSzT		*SQ^;<		9sT%C%CCDE 	F		IS4#Q#QQRS 	T IIOOHI F		 @1 DEF#H&01D1Dl&S# --c3FG $   @		 !? @@s   I $I-,I-NNNN)__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   ri   takes_options
takes_argsrP   rx        rO   r   r   &   se    4.H ))..-- 	tW#JQT3	(M
  JP0f0Hr   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
dgZ	 	 ddZy)cmd_delegation_for_any_servicez3Set/unset UF_TRUSTED_FOR_DELEGATION for an account.(%prog <accountname> [(on|off)] [options]r   r   r   r   r   r   r   r   onoffNc                    d}|dk(  rd}n|dk(  rd}nt        d|z        |j                         }|j                  |      }	t        j                  ||j                  d            }
||
j                  }n|}t        |t               |	|      }t        ||      \  }}}dt        j                  |      z  }t        j                  }	 |j                  ||d	|d
       y # t        $ r}t        |      d }~ww xY w)NFonToff0invalid argument: '%s' (choose from 'on', 'off')rR   rS   rW   zTrusted-for-Delegation	flags_strr   strict)r   ra   rb   r   rc   rd   re   r   r   r
   r-   rf   r   rk   toggle_userAccountFlags	Exceptionr?   r   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rR   rs   search_filterflagrG   s                      rO   rx   z"cmd_delegation_for_any_service.run   s    D=Be^BQTYYZZ##%((,11"bffWoF9;;DDD~'7 %". +AAD+F' ,c.?.?.OO--	$''t2J+-d ( <  	$s##	$s   C 	C8(C33C8ry   rz   r{   r|   r}   r~   r   r   r   r   r   r   ri   r   r   rx   r   r   rO   r   r      sf    =9H ))..-- 	tW#JQT3	(M
  )JGK!$r   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
dgZ	 	 ddZy)cmd_delegation_for_any_protocolzOSet/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account.r   r   r   r   r   r   r   r   r   r   Nc                    d}|dk(  rd}n|dk(  rd}nt        d|z        |j                         }|j                  |d      }	t        j                  ||j                  d            }
||
j                  }n|}t        |t               |	|      }t        ||      \  }}}d	t        j                  |      z  }t        j                  }	 |j                  ||d
|d       y # t        $ r}t        |      d }~ww xY w)NFr   Tr   r   )fallback_machinerR   rS   rW   z&Trusted-to-Authenticate-for-Delegationr   )r   ra   rb   r   rc   rd   re   r   r   r
   r-   rf   r   rl   r   r   r   s                      rO   rx   z#cmd_delegation_for_any_protocol.run  s    D=Be^BQTYYZZ##%((d(C11"bffWoF9;;DDD~'7 %". +AAD+F' ,c.?.?.OO==	$''t2Z+-d ( <  	$s##	$s   
C! !	C:*C55C:ry   r   r   r   rO   r   r      sf    Y9H ))..-- 	tW#JQT3	(M
  )JGK!$r   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
dgZ	 	 ddZy)cmd_delegation_add_servicezZAdd a service principal to msDS-AllowedToDelegateTo so that an account may delegate to it.)%prog <accountname> <principal> [options]r   r   r   r   r   r   r   r   	principalNc                    |j                         }|j                  |      }t        j                  ||j	                  d            }	||	j
                  }
n|}
t        |
t               ||      }t        ||      \  }}}|j                  dt        j                  |      z  t        j                  dg      }t        |      dk(  rt        d|z        t        |      dk(  sJ t        j                         }|d   j                   |_        t        j"                  |gt        j$                  d      |d<   	 |j'                  |       y # t(        $ r}t        |      d }~ww xY w	NrR   rS   rW   rY   r[   r   r^   r#   )ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   Messager0   MessageElementFLAG_MOD_ADDmodifyr   r?   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rR   rs   rF   msgrG   s                     rO   rx   zcmd_delegation_add_service.run<  sS    ##%((,11"bffWoF9;;DDD~'7 %". +AAD+F' jj$7**>:%;"00 :;  = s8q=AKOPP3x1}}kkmQ*-*<*<i[=@=M=M=W+Y&'	$JJsO 	$s##	$   6E 	E!EE!ry   r   r   r   rO   r   r   *  sf    d:H ))..-- 	tW#JQT3	(M
  -JKO"$r   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
dgZ	 	 ddZy)cmd_delegation_del_serviceziDelete a service principal from msDS-AllowedToDelegateTo so that an account may no longer delegate to it.r   r   r   r   r   r   r   r   r   r   Nc                    |j                         }|j                  |      }t        j                  ||j	                  d            }	||	j
                  }
n|}
t        |
t               ||      }t        ||      \  }}}|j                  dt        j                  |      z  t        j                  dg      }t        |      dk(  rt        d|z        t        |      dk(  sJ t        j                         }|d   j                   |_        t        j"                  |gt        j$                  d      |d<   	 |j'                  |       y # t(        $ r}t        |      d }~ww xY wr   )ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   r   r0   r   FLAG_MOD_DELETEr   r   r   s                     rO   rx   zcmd_delegation_del_service.runs  sS    ##%((,11"bffWoF9;;DDD~'7 %". +AAD+F' jj$7**>:%;"00 :;  = s8q=AKOPP3x1}}kkmQ*-*<*<i[=@=P=P=W+Y&'	$JJsO 	$s##	$r   ry   r   r   r   rO   r   r   a  sf    s:H ))..-- 	tW#JQT3	(M
  -JKO"$r   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
dgZ	 	 ddZy)cmd_delegation_add_principalz\Add a principal to msDS-AllowedToActOnBehalfOfOtherIdentity that may delegate to an account.r   r   r   r   r   r   r   r   r   r   Nc           	         |j                         }|j                  |      }t        j                  ||j	                  d            }	||	j
                  }
n|}
t        |
t               ||      }t        ||      \  }}}|j                  dt        j                  |      z  t        j                  dg      }t        |      dk(  rt        d| d      t        |      d	k(  sJ |d   j	                  dd
      }||t        j                   t        j"                        }t        j$                         }t        j&                  |_        t        j*                  t        j,                  z  |_        ||_        d }n'	 t3        t        j$                  |      }|j6                  }|0t        j8                         }t        j:                  |_        d|_        t        ||      \  }}}|j                  dt        j                  |      z  t        j                  dg      }t        |      dk(  rt        d| d      t        |      d	k(  sJ t        j                   |j?                  d|d   j	                  dd
            jA                  d            |jB                  }tE        fd|D              rt        d| d| d      t        jF                         }t        jH                  |_        d|_%        t        jL                  |_'        |_(        |jS                  |       ||_!        |xj<                  d	z  c_        ||_        tU        |      }t        jV                         }|d   jX                  |_,        |(t        jZ                  |t        j\                  d      |d<   t        jZ                  |t        j^                  d      |d<   	 |ja                  |       y # t4        $ r t        d| d      w xY w# t        jb                  $ rA}|jd                  \  }}|t        jf                  k(  rt        d| d      t        |      d }~ww xY w)NrR   rS   rW   rZ   r[   r   zUnable to find account name ''r#   r_   WSecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account '' could not be unmarshalled!	objectSidUnable to find principal name '	objectSIDutf-8c              3   <   K   | ]  }|j                   k(    y w)N)r+   ).0rE   	princ_sids     rO   	<genexpr>z3cmd_delegation_add_principal.run.<locals>.<genexpr>  s     8Cs{{i'8s   zACE for principal 'zl' already present in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ''.01RRefused to update attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ':': a conflicting attribute update occurred simultaneously.)4ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   r   dom_sidSID_BUILTIN_ADMINISTRATORSrm   SD_REVISIONrevisionr&   r)   r   	owner_sidr	   rn   r%   aclSECURITY_ACL_REVISION_ADSnum_acesschema_format_valuedecoder*   anyrE   r6   r8   SEC_ADS_GENERIC_ALLr=   r+   appendr   r   r0   r   r   r   r   r1   r2   ERR_NO_SUCH_ATTRIBUTE)r?   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rI   account_resdatar   security_descr%   cleanedprinc	princ_resr*   rE   new_datar   rG   rH   r   s                              @rO   rx   z cmd_delegation_add_principal.run  s,    ##%((,11"bffWoF9;;DDD~'7 %".  6k3G1jj*n-.##=>	 ! @
 {q !>{m1MNN;1$%$1~!!6A " ?< (()L)LMI$//1M%-%9%9M""*"@"@"*"A"A#BM&/M#D5 *8+>+> E !%%D<<<>D$>>DMDM 4IsCaJJ*="00>+?%(%6%6&1]  4	 y>Q!@1MNN9~"#"$$##!  ! 466<fWoG	
 yy 8488%i[ 1  =$% % lln77	"66C	!M*
 kkmQ""))c)):<CH %%c&&68C	(JJsOM   5" &33>- @3$4 5 55N || 		(XXFCc///"#} %/01 1 #3''		(s$   ;O 	O7 O47Q
<QQry   r   r   r   rO   r   r     sf    f:H ))..-- 	tW#JS	2M
  -JKOz(r   r   c                       e Zd ZdZdZej                  ej                  ej                  dZ	 e
dddedd	      gZd
dgZ	 	 ddZy)cmd_delegation_del_principalzkDelete a principal from msDS-AllowedToActOnBehalfOfOtherIdentity that may no longer delegate to an account.r   r   r   r   r   r   r   r   r   r   Nc           	         |j                         }|j                  |      }t        j                  ||j	                  d            }	||	j
                  }
n|}
t        |
t               ||      }t        ||      \  }}}|j                  dt        j                  |      z  t        j                  dg      }t        |      dk(  rt        d|z        t        |      dk(  sJ |d   j	                  dd	      }|t        d
| d      	 t        t         j"                  |      }|j&                  }|t        d| d      t        ||      \  }}}|j                  dt        j                  |      z  t        j                  dg      }t        |      dk(  rt        d| d      t        |      dk(  sJ t!        j(                  |j+                  d|d   j	                  dd	            j-                  d            }|j.                  }|D cg c]  }|j0                  |k7  s| }}t        |      t        |      k(  rt        d| d| d      t        |      |_        ||_        ||_        t5        |      }t        j6                         }|d   j8                  |_        t        j:                  |t        j<                  d      |d<   t        j:                  |t        j>                  d      |d<   	 |jA                  |       y # t$        $ r t        d| d      w xY wc c}w # t        jB                  $ rA}|jD                  \  }}|t        jF                  k(  rt        d| d      t        |      d }~ww xY w)NrR   rS   rW   rZ   r[   r   r^   r#   r_   z@Attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z' not present!r   r   zkDACL not present on Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z'!r   r   r   r   r   z"Unable to find ACE for principal 'z\' in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'r   r   r   r   r   )$ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   r	   r   rm   rn   r%   r   r   r   r*   r+   r   r   r   r0   r   r   r   r   r1   r2   r   )r?   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rI   r   r   r   r%   r   r   r   old_acesrE   r*   r   r   rG   rH   s                               rO   rx   z cmd_delegation_del_principal.run9  s    ##%((,11"bffWoF9;;DDD~'7 %".  6k3G1jj*n-.##=>	 ! @
 {q AKOPP;1$%$1~!!6A " ?< "++6-~ G H H	1&x':':DAM !!< "+ ,7-r ; < < 4IsCaJJ*="00>+?%(%6%6&1]  4	 y>Q!@1MNN9~"#"$$##!  ! 466<fWoG	
 99  (D3;;)+CDD t9H% "##,+ .+ ,7-r	 ; < < D		!M*
 kkmQ""%%#%%68C %%c&&68C	(JJsO}  	1 "++6- 8/ 0 1 1	1B E< || 		(XXFCc///"#} %/01 1 #3''		(s0   L	 L%&L%7L* 	L"*M>=<M99M>ry   r   r   r   rO   r   r   '  sf    u:H ))..-- 	tW#JS	2M
  -JKOk(r   r   c                       e Zd ZdZi Z e       ed<    e       ed<    e       ed<    e       ed<    e	       ed<    e
       ed<    e       ed<   y	)
cmd_delegationzDelegation management.showzfor-any-servicezfor-any-protocolzadd-servicezdel-servicezadd-principalzdel-principalN)rz   r{   r|   r}   subcommandsr   r   r   r   r   r   r   r   r   rO   r   r     sg     K-/K%C%EK!"&E&GK"#!;!=K!;!=K#?#AK #?#AK r   r   )samba.getoptgetoptr   r-   sambar   r   samba.samdbr   
samba.authr   samba.dcerpcr   	samba.ndrr   r	   samba.netcmd.commonr
   samba.netcmdr   r   r   r   r   r   r   r   r   r   r   r   r   r   rO   <module>r      s   *  
    % ! * 6 UH' UHp3$W 3$l3$g 3$l4$ 4$n4$ 4$nL(7 L(^}(7 }(@
B\ 
Br   