
    IdAO                        d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZmZmZmZmZ d	Zd
ZddddddddddddddddZededededed
iZededed ed!ed"iZg Z G d# d$e      Z G d% d&e      Zy)'    N)	b64encode)sd_utils)
ndr_unpackndr_pack)security)SECINFO_DACL)'get_managed_service_accounts_descriptor)DS_DOMAIN_FUNCTION_2008DS_DOMAIN_FUNCTION_2008_R2DS_DOMAIN_FUNCTION_2012DS_DOMAIN_FUNCTION_2012_R2DS_DOMAIN_FUNCTION_2016K   Y   z$5e1574f6-55df-493e-a671-aaeffca6a100z$d262aae8-41f7-48ed-9f35-56bbb677573dz$82112ba0-7e4c-4a44-89d9-d46c9612bf91z$c3c927a6-cc1d-47c0-966b-be8f9b63d991z$54afcfb9-637a-4251-9f47-4d50e7021211z$f4728883-84dd-483c-9897-274f2ebcf11ez$ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ffz$83c53da7-427e-47a4-a07a-a324598b88f7z$c81fc9cc-0130-4fd1-b272-634d74818133z$e5f9e791-d96d-4fc9-93c9-d53e1dc439baz$e6d5fd00-385d-4e65-b02d-9da3493ed850z$3a6b3fbf-3168-4312-a10d-dd5b3393952dz$7f950403-0ab3-47f9-9730-5d7b0269f9bdz$434bb40d-dbc9-4fe7-81d4-d57229f7b080z$a0c238ba-9e30-4ee6-80a6-43f731e9a5cd)r   L   M   N   O   P   Q   R   S   T   U   V   W   X   r   J   r   r         	   
      c                       e Zd Zy)DomainUpdateExceptionN)__name__
__module____qualname__     5/usr/lib/python3/dist-packages/samba/domain_update.pyr%   r%   Z   s    r*   r%   c                       e Zd ZdZ	 	 ddZ	 	 ddZd ZddZd Zd Z	d	 Z
d
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zy)DomainUpdatez2Check and update a SAM database for domain updatesc                    || _         || _        || _        d| _        | j                   j	                         | _        | j                   j                         | _        | j                   j                         | _        t        j                  |      | _	        t        j                  |j                               | _        | j                   j                         | _        	 | j                   j#                  d       | j                   j                         | _        	 | j*                  j#                  d       y# t$        j&                  $ r t)        d      w xY w# t$        j&                  $ r t)        d      w xY w)z
        :param samdb: LDB database
        :param fix: Apply the update if the container is missing
        :param add_update_container: Add the container at the end of the change
        :raise DomainUpdateException:
        Fz(CN=Operations,CN=DomainUpdates,CN=Systemz+Failed to add domain update container childz3CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=Systemz#Failed to add revision object childN)samdbfixadd_update_containercheck_update_appliedget_config_basedn	config_dn	domain_dnget_schema_basedn	schema_dnr   SDUtilsr   dom_sidget_domain_sid
domain_sidget_root_basedndomainupdate_container	add_childldbLdbErrorr%   revision_object)selfr/   r0   r1   s       r+   __init__zDomainUpdate.__init__a   s2    
$8!$)!557--/557 ((/"**5+?+?+AB&*jj&@&@&B#	W''112\]  $zz99;	O  **+`a || 	W'(UVV	W || 	O'(MNN	Os   D3 E 3EE4Nc                    | j                   j                  | j                  dgt        j                        }t
        |   }|rt
        |   }|dz  }nt        }| j                  ||       t        |   }t        |d   d   d         }|rV||k  rP| j                  st        d||fz        | j                   j                  dt        | j                        |fz         yyy)a  
        Apply all updates for a given old and new functional level
        :param functional_level: constant
        :param old_functional_level: constant
        :param update_revision: modify the stored version
        :raise DomainUpdateException:
        revision)baseattrsscope   r   zERevision is not high enough. Fix is set to False.
Expected: %dGot: %dz9dn: %s
changetype: modify
replace: revision
revision: %d
N)r/   searchrA   r?   
SCOPE_BASEfunctional_level_to_max_update
MIN_UPDATEcheck_updates_rangefunctional_level_to_versionintr0   r%   modify_ldifstr)	rB   functional_levelold_functional_levelupdate_revisionresexpected_update
min_updateexpected_versionfound_versions	            r+   check_updates_functional_levelz+DomainUpdate.check_updates_functional_level   s    jjT%9%9'1l#..   J 99IJ78LMJ!OJ#J  _=67GHCF:.q12}/??88+ -DGWGTGV-V W W JJ"" $ 4 "23	$4 5  @?r*   c                 v    |D ]4  }|t         k  s	|t        kD  rt        d       t        | d|z        |       6 y)z
        Apply a list of updates which must be within the valid range of updates
        :param iterator: Iterable specifying integer update numbers to apply
        :raise DomainUpdateException:
        Update number invalid.operation_%dN)rM   
MAX_UPDATEr%   getattr)rB   iteratorops      r+   check_updates_iteratorz#DomainUpdate.check_updates_iterator   sD      	3BJ"z/+,DEE /GD.2-.r2	3r*   c                     |}|t         k  s||kD  s	|t        kD  rt        d      ||k  r)|t        vr t	        | d|z        |       |dz  }||k  r(yy)z
        Apply a range of updates which must be within the valid range of updates
        :param start: integer update to begin
        :param end: integer update to end (inclusive)
        :raise DomainUpdateException:
        r]   r^   rI   N)rM   r_   r%   missing_updatesr`   )rB   startendrb   s       r+   rN   z DomainUpdate.check_updates_range   sa     :j0@'(@AACi(2nr1226!GB Cir*   c                 d   dt         |   d| j                  }	 | j                  j                  |t        j
                  g       }t        |      dk(  sJ t        d|t         |   fz         y# t        j                  $ r-}|j                  \  }}|t        j                  k7  r Y d}~yd}~ww xY w)	zd
        :param op: Integer update number
        :return: True if update exists else False
        zCN=,)rF   rH   rG   NFrI   zSkip Domain Update %u: %sT)
update_mapr=   r/   rJ   r?   rK   r@   argsERR_NO_SUCH_OBJECTlenprint)rB   rb   	update_dnrV   enummsgs          r+   update_existszDomainUpdate.update_exists   s    
 #-R.$2M2MN		**##*-..*, $ .C 3x1}})RB,@@A || 	JS#c,,,		s   ,A/ /B/#B**B/c                     | j                   j                  dt        |   dt        | j                        d       t        d|t        |   fz         y)zo
        Add the corresponding container object for the given update
        :param op: Integer update
        zdn: CN=ri   z
objectClass: container
zApplied Domain Update %u: %sN)r/   add_ldifrj   rR   r=   rn   rB   rb   s     r+   
update_addzDomainUpdate.update_add   sH    
 	

"~s46679 	: 	,JrN/CCDr*   c                 8    | j                   st        d|z        y)z
        Raises an exception if not set to fix.
        :param op: Integer operation
        :raise DomainUpdateException:
        z3Missing operation %d. Fix is currently set to FalseN)r0   r%   rv   s     r+   raise_if_not_fixzDomainUpdate.raise_if_not_fix   s"     xx'(]`b(bcc r*   c                     | j                  |      ry | j                  |       | j                  j                  d| j                  z  ddg       | j
                  r| j                  |       y y )NzVdn: CN=TPM Devices,%s
objectClass: top
objectClass: msTPM-InformationObjectsContainer
relax:0provision:0controls)rs   ry   r/   ru   r5   r1   rw   rv   s     r+   operation_78zDomainUpdate.operation_78   sr    b!b!

  nn '0%?	 	 	A $$OOB %r*   c                     | j                  |      ry | j                  |       d}| j                  j                  | j                  |g       | j
                  r| j                  |       y y )NzY(OA;CIIO;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;PS)add_acesrs   ry   r   update_aces_in_daclr5   r1   rw   rB   rb   aces      r+   operation_79zDomainUpdate.operation_79   s]    b!b!i))$..C5)I$$OOB %r*   c                     | j                  |      ry | j                  |       d}| j                  j                  | j                  |g       | j
                  r| j                  |       y y )Nz1(OA;;CR;3e0f7e18-2c7a-4c10-ba82-4d926db99a3e;;CN)r   r   r   s      r+   operation_80zDomainUpdate.operation_80  s]    b!b!A))$..C5)I$$OOB %r*   c                     | j                  |      ry | j                  |       d}| j                  j                  | j                  |g       | j
                  r| j                  |       y y )Nz7(OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS)r   r   r   s      r+   operation_81zDomainUpdate.operation_81  s]    b!b!G))$..C5)I$$OOB %r*   c                 ^   | j                  |      ry | j                  |       t        | j                        }t	        |      j                  d      }dt        | j                        z  }| j                  j                  d|d|ddg       | j                  r| j                  |       y y )Nutf8CN=Managed Service Accounts,%sdn: z
changetype: add
objectClass: container
description: Default container for managed service accounts
showInAdvancedViewOnly: FALSE
nTSecurityDescriptor:: r{   r|   r}   )rs   ry   r	   r;   r   decoderR   r5   r/   rQ   r1   rw   )rB   rb   
descriptormanagedservice_descrmanaged_service_dns        r+   operation_75zDomainUpdate.operation_75'  s    b!b!<T__M
(4;;FC=  	


 !34H J *3M(B 	 	D $$OOB %r*   c                 (   | j                  |      ry | j                  |       dt        | j                        z  }| j                  j                  dt        | j                        d|dddg       | j                  r| j                  |       y y )Nr   r   zl
changetype: modify
add: otherWellKnownObjects
otherWellKnownObjects: B:32:1EB93889E40C45DF9F0C64D23BBB6237:
r{   r|   r}   rs   ry   rR   r5   r/   rQ   r1   rw   )rB   rb   r   s      r+   operation_76zDomainUpdate.operation_76=  s    b!b!=  	

 4>>.	 0 <E;H;J	 	 	K $$OOB %r*   c                     | j                  |      ry | j                  |       | j                  j                  dt	        | j
                        z  ddg       | j                  r| j                  |       y y )NzFdn: CN=PSPs,CN=System,%s
objectClass: top
objectClass: msImaging-PSPs
r{   r|   r}   )rs   ry   r/   ru   rR   r5   r1   rw   rv   s     r+   operation_77zDomainUpdate.operation_77P  sw    b!b!

  
$.. &/$> 	 	@
 $$OOB %r*   c                 >   | j                  |      ry | j                  |       dt        | j                        z  }d}|dz  }|dz  }|dz  }|dz  }|dz  }|dz  }d	|d
|d}| j                  j                  |       | j                  r| j                  |       y y )N
CN=Keys,%szO:DAzD:z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;DA)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;DD)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;ED)
dn: z
objectClass: container
description: Default container for key credential objects
ShowInAdvancedViewOnly: TRUE
nTSecurityDescriptor: r   )rs   ry   rR   r5   r/   ru   r1   rw   )rB   rb   keys_dnsddlldifs        r+   operation_82zDomainUpdate.operation_82r  s    b!b!T^^!448888888888  	

D!$$OOB %r*   c                    | j                  |      ry | j                  |       dt        | j                        z  }dg}|dgz  }| j                  j                  ||       | j                  r| j                  |       y y )Nr   z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;KA)&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EK)r   )rs   ry   rR   r5   r   r   r1   rw   )rB   rb   r   acess       r+   operation_83zDomainUpdate.operation_83  s{    b!b!T^^!449:9::))'D)A$$OOB %r*   c                 $   | j                  |      ry | j                  |       dt        | j                        z  }dt        | j                        d|d}| j                  j                  |       | j                  r| j                  |       y y )Nr   r   zl
changetype: modify
add: otherWellKnownObjects
otherWellKnownObjects: B:32:683A24E2E8164BD3AF86AC3C2CF3F981:r   r   )rB   rb   r   r   s       r+   operation_84zDomainUpdate.operation_84  sy    b!b!T^^!44 4>>G% 	

t$$$OOB %r*   c                    | j                  |      ry | j                  |       dg}|dt        | j                        z  gz  }| j                  j                  | j                  |       | j                  r| j                  |       y y )Nz5(OA;CI;RPWP;5b47d60f-6090-40b2-9f37-2a4de88f3063;;KA)z9(OA;CI;RPWP;5b47d60f-6090-40b2-9f37-2a4de88f3063;;%s-527)r   	rs   ry   rR   r;   r   r   r5   r1   rw   rB   rb   r   s      r+   operation_85zDomainUpdate.operation_85  s    b!b!HILT__%& ' 	' 	))$..4)H$$OOB %r*   c                     | j                  |      ry | j                  |       dg}|dgz  }| j                  j                  | j                  |       | j
                  r| j                  |       y y )NzY(OA;CIIO;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;PS)zY(OA;CIIO;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;CO)r   r   r   s      r+   operation_86zDomainUpdate.operation_86  sl    b!b!lmlmm))$..4)H$$OOB %r*   c                    | j                  |      ry | j                  |       dt        | j                        z  g}dg}| j                  j                  | j                  ||       | j                  r| j                  |       y y )Nz*(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;%s-527)r   del_acesr   r   rB   rb   r   r   s       r+   operation_87zDomainUpdate.operation_87  s    b!b! A() *<=))$..3;3; 	* 	= $$OOB %r*   c                     | j                  |      ry | j                  |       dt        | j                        z  }| j                  j                  |       | j                  r| j                  |       y y )Nz
dn: %s
changetype: modify
add: msDS-ExpirePasswordsOnSmartCardOnlyAccounts
msDS-ExpirePasswordsOnSmartCardOnlyAccounts: FALSE
r   )rB   rb   r   s      r+   operation_88zDomainUpdate.operation_88  si    b!b!
 
$.. 	

t$$$OOB %r*   c                     | j                  |      ry | j                  |       dg}dg}| j                  j                  | j                  ||       | j
                  r| j                  |       y y )Nr   z5(OA;CI;RPWP;5b47d60f-6090-40b2-9f37-2a4de88f3063;;EK)r   r   r   s       r+   operation_89zDomainUpdate.operation_890  sr    b!b!
 ==KL))$..3;3; 	* 	= $$OOB %r*   )FT)NF)r   r   )r&   r'   r(   __doc__rC   r[   rc   rN   rs   rw   ry   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r)   r*   r+   r-   r-   ^   s    <"'&*OD =A7<"5H3"(Ed 
 
 
 " , & D H * > . , 4 > r*   r-   )r?   sambabase64r   r   	samba.ndrr   r   samba.dcerpcr   samba.dcerpc.securityr   samba.descriptorr	   
samba.dsdbr
   r   r   r   r   rM   r_   rj   rL   rO   re   	Exceptionr%   objectr-   r)   r*   r+   <module>r      s   &     * ! .  

 	/...... 	/ 	/......5
> RRR"  QQR  	I 	b 6 b r*   