
    Id@                    L   d Z ddlmZ ddlmZ ddlmZmZmZm	Z	m
Z
 ddlZddlZddlZddlmZmZ ddlmZmZmZmZmZmZmZmZ ddlmZ dd	lmZmZ dd
lmZm Z m!Z!m"Z"m#Z#m$Z$ ddl%m&Z& ddl'm(Z( ddlm)Z) ddl*m+Z+ ddl,m-Z- ddlm.Z. ddlm/Z/ ddl0m1Z1 ddlm2Z2m3Z3 ddlm4Z4 ddl5m6Z6m7Z7m8Z8 ddl9Z9ddl:Z:ddl;Z;ddl<Z<ddl=Z=ddl>Z>ddl?m@Z@ ddlAmBZB ddlCmDZD ddlmEZEmFZF  G d deG      ZH G d deI      ZJ	 	 	 	 	 	 d%dZK	 	 	 	 	 	 d%dZL	 	 	 	 d&d ZM G d! d"eJ      ZN G d# d$eN      ZOy)'zJoining a domain.    )system_session)SamDB)gensecLdb	drs_utilsarcfour_encryptstring_to_byte_arrayN)ndr_pack
ndr_unpack)securitydrsuapimiscnbtlsadrsblobs	dnsserverdnsp)DS_DOMAIN_FUNCTION_2003)CredentialsDONT_USE_KERBEROS)secretsdb_self_join	provisionprovision_fillFILL_DRSFILL_SUBDOMAINDEFAULTSITE)
setup_path)Schema)
descriptor)Net)setup_bind9_dns)read_and_sub_file)werror)	b64encode)WERRORErrorNTSTATUSError)sd_utils)ARecord
AAAARecordCNAMERecord)OrderedDict)
get_string)CommandError)dsdbfunctional_levelc                        e Zd Z fdZ xZS )DCJoinExceptionc                 2    t         t        |   d|z         y )NzCan't join, error: %s)superr1   __init__)selfmsg	__class__s     ,/usr/lib/python3/dist-packages/samba/join.pyr4   zDCJoinException.__init__:   s    ot-.E.KL    )__name__
__module____qualname__r4   __classcell__r7   s   @r8   r1   r1   8   s    M Mr9   r1   c                       e Zd ZdZ	 	 	 	 	 	 	 d&dZd'dZd'dZd'dZd Zd Z	d	 Z
d
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd(dZd Zd Zd Zd Zd Zd Zd Z d  Z!d! Z"d" Z#d# Z$d$ Z%d% Z&y))DCJoinContextzPerform a DC join.Nc                 <   || _         || _        || _        || _        || _        |
| _        || _        || _        || _        || _	        d | _
        g | _        g | _        | j                  j                  |j                         t        j                   z         t#        | j                  | j                        | _        || _        || _        |r#|| _        | j*                  j,                  | _        n| j&                  r#|}| j/                  | j&                        | _        n\| j                   j1                  d|z         | j3                  |      | _        | j                   j1                  d| j&                  z         t5        d| j&                  z  t7               | j                  | j                        | _        | j                  t8        | _        	 | j*                  j;                  t<        j>                  g        tG        | j*                  jI                               | _%        tG        | j*                  jM                               | _'        tG        | j*                  jQ                               | _)        tG        | j*                  jU                               | _+        tY        jZ                  | j*                  j]                               | _/        | j^                  | _0        | jc                         | _2        | jg                         | _4        tk        jl                  tG        to        jp                                     | _9        | j*                  ju                         | _;        | jy                         | _=        | j}                         | _?        |	|	| _@        nt        j                  dd      | _@        | j*                  j                         | _D        |r|| _E        d| j                  z  | _F        d	| j                  d
| j                  d| jV                  | _G        d| j                  z  | _H        d	| j                  d| jJ                  | _I        | j                  j                         d| j                  | _K        | j*                  j                         | _M        d| jJ                  z  }| j                  |      rd	| j                  d|| _O        nd | _O        d| j                  z  d| j                  z  d| j                  d| j                  g| _P        | j*                  j;                  t<        j>                  dg| jJ                        }|d   d   d   | _Q        d| jJ                  z  | _R        d| jN                  z  | _S        dt=        j                  | j                        z  }| j*                  j;                  t<        j                  g | j*                  j                         |      }|d| _W        n(t        |      dk(  rd| _W        t        d       n|| _W        | j                  | _Z        d | _[        t        j                  t        j                  z  t        j                  z  t        j                  z  t        j                  z  | _b        d | _c        d | _d        d | _e        d| _f        d | _g        d | _\        d | _h        d| _i        d | _j        d | _k        d | _l        d | _m        d| _n        y # t<        j@                  $ r}|jB                  \  }}tE        |      d }~ww xY w)N)credslpz&Finding a writeable DC for domain '%s'zFound DC %s	ldap://%surlsession_infocredentialsrC   scopeattrsx   %s$CN=z,CN=Servers,CN=z
,CN=Sites,zCN=NTDS Settings,%sz,OU=Domain Controllers,.zGCN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,%s,zHOST/%szGC//rIDManagerReference)rJ   rK   baser   zDC=DomainDnsZones,%szDC=ForestDnsZones,%s$(&(objectClass=crossRef)(ncName=%s))rJ   rK   rS   
expressionNONEzCNO DNS zone information found in source domain, not replicating DNSF)ologgerrB   rC   site	targetdir	use_ntvfsplaintext_secretsbackend_storebackend_store_sizepromote_existingpromote_from_dnnc_listfull_nc_listset_gensec_featuresget_gensec_featuresr   FEATURE_SEALr    netserverforced_local_samdbsamdbrF   find_dc_siteinfofind_dcr   r   r   searchldb
SCOPE_BASELdbErrorargsr1   strget_default_basednbase_dnget_root_basednroot_dnget_schema_basedn	schema_dnget_config_basedn	config_dnr   dom_sidget_domain_siddomsid	forestsidget_domain_namedomain_nameget_forest_domain_nameforest_domain_namer   GUIDuuiduuid4invocation_idget_dsServiceName
dc_ntds_dnget_dnsHostNamedc_dnsHostNameget_behavior_versionbehavior_version	acct_passsamba generate_random_machine_passworddomain_dns_name	dnsdomainmynamesamname	server_dnntds_dnacct_dnlowerdnshostnameforest_dns_name	dnsforest	dn_existstopology_dnSPNsrid_manager_dndomaindns_zoneforestdns_zonebinary_encodeSCOPE_ONELEVELget_partitions_dndns_backendlenprintrealm	tmp_samdbr   DRSUAPI_DRS_INIT_SYNCDRSUAPI_DRS_PER_SYNCDRSUAPI_DRS_GET_ANCDRSUAPI_DRS_GET_NC_SIZEDRSUAPI_DRS_NEVER_SYNCEDreplica_flagsnever_reveal_sid
reveal_sidconnection_dnRODC	krbtgt_dn	managedby	subdomain	adminpasspartition_dndns_a_dndns_cname_dnforce_all_ips)ctxrX   rg   rB   rC   rY   netbios_namerZ   domainmachinepassr[   r   r_   r\   r]   r^   rh   eenumestrtopology_baseres_rid_managerexprres_domaindnss                           r8   r4   zDCJoinContext.__init__A   s    
	!! 1)!3/"		%%e&?&?&AFDWDW&WXCII#&&1
!3*CICJzz<"//

;CH 

 H6 QR [[0




 :;+

":+9+;*-))@CI 88"CH	(II3>><
 #))6689#))3356CII779:CII779:%%cii&>&>&@A


--/!$!;!;!= IIc$**,&78446 002"779"'CM!BB3LCM		113 %CJ#**,CKDGJJPSPXPXZ]ZgZghCM/#--?CK>Ajj#++VCK),)9)9);S]]KCOII557CMehkhshssM}}]+03

M"J"&!CJJ.!COO3&)oos}}EGCH "ii..S^^6K5L47KK / AO "1!34I!J1!MC3ckkA3ckkA58I8I#J\J\8]]		((s/A/A/1.1ii.I.I.K48 ) : $CO=!Q&"([\"-MM	$::$99:$889 %<<= %==	>  $  "A || 	(66LT4!$''	(s   +[) )\<\\c                 <   |rR	 | j                   j                  |t        j                  dg      }|D ]  }| j                  |j                  d       ! 	 | j                   j                  |       t        d|z         y # t        $ r Y y w xY w# t        $ r Y y w xY w)NdnrS   rJ   rK   T	recursivez
Deleted %s)	ri   rm   rn   r   	Exceptiondel_noerrorr   deleter   )r   r   r   resrs        r8   r   zDCJoinContext.del_noerror   s    ii&&Bc6H6HQUPV&W  656	IIR ,#$    		s#   -B  )B  	BB	BBc           
         | j                   j                  | j                   j                         dt        j                  | j
                        z  ddg      }t        |      dk(  ry |st               }|j                  | j                         	 |j                  | j                         |j                  | j                  j                                t        d| j                  z  t!               || j                        }|j                  t        j"                  dd	g
      }|d   d	   d   |d   d   d   k(  rt%        d| j
                  z        | j'                  |d   j(                  d       |d   j+                  dd      }|"|| _        | j'                  | j,                         | j                   j                  | j                   j                         dt        j                  d| j.                  z        dt        j                  d| j0                  z        dg       }|r | j'                  |d   j(                  d       | j                   j                  | j                   j                         dt        j                  d| j.                  z        z  g       }|rQt%        dt        j                  d| j.                  z        dt        j                  d| j0                  z              y #  Y xY w)NsAMAccountName=%smsDS-krbTgtLink	objectSIDrS   rV   rK   r   rD   rE    tokenGroups)rJ   rS   rK   zNot removing account %s which looks like a Samba DC account matching the password we already have.  To override, remove secrets.ldb and secrets.tdbTr   msDS-KrbTgtLink)idxz(&(sAMAccountName=dns-%sz)(servicePrincipalName=zdns/%sz))z(sAMAccountName=%s)zNot removing account zU which looks like a Samba DNS service account but does not have servicePrincipalName=)ri   rm   rs   rn   r   r   r   r   guessrC   set_machine_accountset_kerberos_staterB   get_kerberos_stater   rg   r   ro   r1   r   r   getnew_krbtgt_dnr   r   )r   forcer   rB   machine_samdb	token_resr   s          r8   cleanup_old_accountsz"DCJoinContext.cleanup_old_accounts   s   iiCII$@$@$B*=@Q@QRUR]R]@^*^&7%E  G s8q=MEKK9))#&&1(()E)E)GH %+

*B3A3C27CFF!D *00s~~BWdVe0f	Q<.q1!f[)!,-) +\ -0KK	+8 9 9 	A		T2FJJ0aJ8	  )COOC--.iiCII$@$@$B # 1 1(SZZ2G H # 1 1(S__2L M+O &(	  )
 OOCFIIO6iiCII$@$@$B*?#BSBST\_b_i_iTiBj*j%'  ) ! $'#4#4X

5J#K#&#4#4X5O#P	#R S S =s   A2K: :K?c                 h   | j                   s| j                  |       | j                  | j                  | j                         | j                  | j                  | j                         | j                  | j
                         | j                  | j                  d       | j                  r| j                  | j                         | j                  r| j                  | j                         | j                   rdd}t        j                  d| j                  d|d| j                  | j                        }t        j                         }t        j                         |_        |j#                  d	|t$        j&                        }t        j(                         }| j*                  |_        |j/                  ||t        j0                        }|j3                  ||j4                  j6                         t        j(                         }| j8                  |_        |j/                  ||t        j0                        }|j3                  ||j4                  j6                         | j:                  r| j                  | j:                         | j<                  r| j                  | j<                         yy)
z$Remove any DNs from a previous join.)r   NTr   signncacn_ip_tcp:[]r   )r   r   r   r   r   r   r   r   r   r   lsarpcrg   rC   rB   ObjectAttributeQosInfosec_qosOpenPolicy2r   SEC_FLAG_MAXIMUM_ALLOWEDStringr   stringQueryTrustedDomainInfoByName!LSA_TRUSTED_DOMAIN_INFO_FULL_INFODeleteTrustedDomaininfo_exsidr   r   r   )r   r   binding_optionslsaconn
objectAttr
pol_handlenamerk   s           r8   cleanup_old_joinzDCJoinContext.cleanup_old_join  s    }}$$5$1(OOC--.==$OOCMM*$6??OOCOO,OOC,,-==$Ojj#**o!V!$4G ,,.J!$J ,,R-7-5-N-NPJ ::<D))DK77
D#JoJopD''
DLL4D4DE::<D00DK77
D#JoJopD''
DLL4D4DE<<OOCLL)OOC,,- r9   c                 z   | j                   rt        d      | j                  j                  | j                  j	                         dt        j                  | j                        z  g d      }t        |      dk(  rt        d| j                  z        d|d   v sd|d   v sd	|d   v rt        d
| j                  z        t        |d   d   d         t        j                  j                  t        j                  j                  z  z  dk(  rt        d| j                  z        |d   j                  | _        y)z]confirm that the account is just a bare NT4 BDC or a member server, so can be safely promotedz Can not promote into a subdomainr   )r   userAccountControlserverReferenceBLrIDSetReferencesr   r   zcCould not find domain member account '%s' to promote to a DC, use 'samba-tool domain join' instead'r   r   r   zhAccount '%s' appears to be an active DC, use 'samba-tool domain join' if you must re-create this accountr   zZAccount %s is not a domain member or a bare NT4 BDC, use 'samba-tool domain join' instead'N)r   r   ri   rm   rs   rn   r   r   r   intr   r.   UF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTr   r`   r   r   s     r8   promote_possiblezDCJoinContext.promote_possibleJ  sm   ==>??iiCII$@$@$B*=@Q@QRUR]R]@^*^%w  y s8q=  B  EH  EP  EP  P  Q  QA&*=Q*GK]adefagKg  G  JM  JU  JU  U  V  VA+,Q/0EJJ4[4[49JJ4V4V5W X[\]x{~  |G  |G  G  H  H!!fiir9   c                    	 | j                   j                  |t        j                  t        j                  z  t        j
                  z        | _        | j                  j                  4| j                  j                  dk7  r| j                  j                  | _        | j                  j                  S # t        $ r#}t        d|d|j                  d         d}~wt        $ r t        d|z        w xY w)z(find a writeable DC for the given domain)r   flagsz*Failed to find a writeable DC for domain 'z':    Nz-Failed to find a writeable DC for domain '%s'r   )rf   finddcr   NBT_SERVER_LDAPNBT_SERVER_DSNBT_SERVER_WRITABLE	cldap_retr&   r-   rq   r   client_siterY   pdc_dns_name)r   r   errors      r8   rl   zDCJoinContext.find_dc]  s    	YGGNN&@S@SVYVgVg@gjm  kB  kB  ABN  CCM ==$$0S]]5N5NRT5T}}00CH}})))  	8 &

1 7 8 8 	YNQWWXX	Ys   AB4 4	C6=CC6c                     d }| j                   j                  |t        j                  t        j                  z        }|j
                  |j
                  dk7  r|j
                  }|S )N)addressr  r   )rf   r  r   r	  r
  r  )r   rg   rY   r  s       r8   rj   zDCJoinContext.find_dc_sitej  s^    GGNN6),)<)<s?P?P)P # R	  ,1F1F"1L((Dr9   c                     | j                   j                  | j                  t        j                  dg      }d|d   v rt        |d   d   d         S t        j                  j                  S )NmsDS-Behavior-Versionr   r   )	ri   rm   rt   rn   ro   r   r   r.   DS_DOMAIN_FUNCTION_2000r  s     r8   r   z"DCJoinContext.get_behavior_versionr  s_    iiCKKs~~NeMfg"c!f,s1v56q9::::555r9   c                     | j                   j                  dt        j                  dg      }t	        |d   d   d         S )Nr   dnsHostNamer   r   )ri   rm   rn   ro   rr   r  s     r8   r   zDCJoinContext.get_dnsHostNamey  s<    iiBcnn]OT3q6-(+,,r9   c                 (   | j                   j                         }| j                   j                  |t        j                  dgdt        j
                  t        | j                   j                                     z        }t        |d   d   d         S z9get netbios name of the domain from the partitions recordnETBIOSNamez	ncName=%s)rS   rJ   rK   rV   r   )ri   r   rm   rn   r   r   rr   rs   r   partitions_dnr   s      r8   r   zDCJoinContext.get_domain_name}  s|    		335iiM9K9KTaSb*58I8I#ciiNjNjNlJm8n*n  p3q6-(+,,r9   c                 (   | j                   j                         }| j                   j                  |t        j                  dgdt        j
                  t        | j                   j                                     z        }t        |d   d   d         S r  )ri   r   rm   rn   r   r   rr   ru   r  s      r8   r   z$DCJoinContext.get_forest_domain_name  s|    		335iiM9K9KTaSb*58I8I#ciiNgNgNiJj8k*k  m3q6-(+,,r9   c                    | j                   j                  | j                  g dt        j                  | j
                        t        j                  t        j                  j                  fz        }t        |d   j                        S )z7get the parent domain partition DN from parent DNS namez9(&(objectclass=crossRef)(dnsRoot=%s)(systemFlags:%s:=%u)))rS   rK   rV   r   )ri   rm   rz   rn   r   parent_dnsdomainOID_COMPARATOR_ANDr   r.   SYSTEM_FLAG_CR_NTDS_DOMAINrr   r   r  s     r8   get_parent_partition_dnz%DCJoinContext.get_parent_partition_dn  sp    iiCMM*e # 1 1#2F2F G # 6 6

8]8] _+_  ` 3q699~r9   c                     | j                   j                  dt        j                  dg      }|d   d   d   }t	        | j                   j                  d|            S )zhget the SID of the connected user. Only works with w2k8 and later,
           so only used for RODC joinr   r   r   r   r   )ri   rm   rn   ro   r,   schema_format_value)r   r   binsids      r8   	get_mysidzDCJoinContext.get_mysid  sT     iiBcnn]OTQ&q)#))77VLMMr9   c                     	 | j                   j                  |t        j                  g       }y# t        j                  $ r-}|j
                  \  }}|t        j                  k(  rY d}~y d}~ww xY w)zcheck if a DN existsr   NFT)ri   rm   rn   ro   rp   rq   ERR_NO_SUCH_OBJECT)r   r   r   e5r   r   s         r8   r   zDCJoinContext.dn_exists  sb    	))""#.."KC  || 	77LT4s---		s   ,/ A/"A*)A**A/c                    t        d| j                  z         | j                  dt        t        j                  j
                  t        j                  j                  z        dd| j                  z  d}| j                  j                  |dg       | j                  j                  | j                  t        j                  dg      }|d	   d   d	   | _        t        d
| j                  z         t        j                         }t        j                  | j                  | j                         |_        t        j$                  | j                  t        j&                  d      |d<   | j                  j)                  |       d| j                  d| j*                  | _        t        d| j                  d| j,                         | j                  j/                  | j                  | j,                         y)z#RODCs need a special krbtgt account	Adding %suserTRUEzkrbtgt for %s)r   objectclassuseraccountcontrolshowinadvancedviewonlydescriptionrodc_join:1:1samAccountNamer   r   zGot krbtgt_name=%sr   rN   
,CN=Users,z	Renaming z to N)r   r   rr   r   r.   UF_NORMAL_ACCOUNTUF_ACCOUNTDISABLEr   ri   addrm   rn   ro   krbtgt_nameMessageDnr   r   MessageElementFLAG_MOD_REPLACEmodifyrt   r   rename)r   recr   ms       r8   add_krbtgt_accountz DCJoinContext.add_krbtgt_account  sm   kCMM)*--!"%ejj&B&B&+jj&B&B'C #D&,*S[[8: 			cO,- iiCMMP`Oaba&!1215"S__45KKMvvcii-"11#--252F2FHY [
		36??CKKPS]]C4E4EFG		(9(9:r9   c                 *   d}| j                   j                         dk\  r|dz  }d| j                  d|d}t        j                  || j                   | j                        | _        t        j                  | j                        \  | _        | _        y)z.make a DRSUAPI connection to the naming masterseal	   ,printr   r   r   N)	rC   	log_levelrg   r   rB   r   
drs_DsBinddrsuapi_handlebind_supported_extensions)r   r   binding_strings      r8   drsuapi_connectzDCJoinContext.drsuapi_connect  ss     66"x'O25**oNooncffciiH>G>R>RSVS^S^>_;	S:r9   c           	          t        | j                  | j                        | _        t	        t               dd| j                  | j                  dd      | _        | j                  j                  | j                         y)z2create a temporary samdb object for schema queries)schemadnNF)rG   rF   auto_connectrH   rC   global_schemaam_rodc)
r   r}   rx   
tmp_schemar   r   rB   rC   r   
set_schemar   s    r8   create_tmp_samdbzDCJoinContext.create_tmp_samdb  s[    

),8>+;TY*-))e&+- 	  0r9   c                 z    t        j                         }| j                  j                  |      |_        d|_        y)z$build a DsReplicaAttributeCtr objectr  N)r   DsReplicaAttributer   get_attid_from_lDAPDisplayNameattid	value_ctr)r   attrname	attrvaluer   s       r8   build_DsReplicaAttributez&DCJoinContext.build_DsReplicaAttribute  s-    &&(-->>xHr9   c           	      f   | j                   | j                          | j                  | j                          g }|D ]0  }t        j                         }|d   |_        g }|D ]  }|dk(  r	t        ||   t              s||   g}n||   }|D cg c]%  }t        |t              r|j                  d      n|' }}| j                  j                  | j                  ||      }	|j                  |	        t        j                         }
t        |      |
_        ||
_        t        j                          }||_        |
|_        t        j&                         }||_        |j                  |       3 t        j*                         }|d   |_        |j,                  }|dd D ]  }||_        |} | j                   j1                  | j2                  d|      \  }}|dk(  r|j4                  t         j6                  k7  r#t9        d|j4                  z         t;        d      |j<                  d   t>        j@                  k7  r#t9        d	|j<                  z         t;        d      |d
k(  r<|jB                  dk7  rt;        d|jB                  z        |jD                  jF                  d   t>        j@                  k7  r|jD                  jH                  0t9        d|jD                  jF                  d   z         t;        d      t9        d|jD                  jF                  d   d|jD                  jH                  j<                         t;        d      |jD                  j4                  t         j6                  k7  r-t9        d|jD                  j4                  z         t;        d      |jJ                  S c c}w )z,add a record via the DRSUAPI DsAddEntry callNr   utf8r   r     z!DsAddEntry failed with dir_err %uzDsAddEntry failedz(DsAddEntry failed with status %s info %s   zexpected err_ver 1, got %uz.DsAddEntry failed with status %s, info omittedzDsAddEntry failed with status z info )&r   rJ  r   rS  DsReplicaObjectIdentifierr   
isinstancelistrr   encodedsdb_DsReplicaAttributeappendDsReplicaAttributeCtrr   num_attributes
attributesDsReplicaObject
identifierattribute_ctrDsReplicaObjectListItemobjectDsAddEntryRequest2first_objectnext_object
DsAddEntryrG  dir_errDRSUAPI_DIRERR_OKr   RuntimeErrorextended_errr#   WERR_SUCCESSerr_vererr_datastatusrk   objects)r   recsrz  r>  idrK   avxrattrrk  rm  list_objectreq2prevolevelctrs                     r8   rq  zDCJoinContext.DsAddEntry  s?   ;;!==   " 	(C224BIBEE 	$9!#a&$/QAAALMNqAs);QXXf%BNN==cmmQPQRU#	$ $99;M+.u:M(',M$,,.F "F#0F !99;K!'KNN;'5	(8 ))+#AJ   	A DD	 {{--c.@.@!TJA:{{g7779CKKGH"#677"f&9&99@CDTDTUV"#677A:{{a"#?#++#MNN||""1%)<)<<<<$$,JcllNaNabcNdef ##677 H[H[\]H^HKHYHYHfHfh i"#677||##w'@'@@9CLL<P<PPQ"#677{{[ Os   *N.c                    t        d| j                  z         t        d| j                  fddt        t        j
                  j                        fd| j                  fg      }| j                  | j                  | j                  g}| j                  t        j
                  j                  k\  r-t        j                  | j                        }t        |      |d<   | j                  t        j
                  j                  k\  r| j                  |d<   | j                  r(d| j                  z  |d	<   | j                   |d
<   d|d<   |S d| j                  z  |d	<   | j                  t        j
                  j                  k\  r| j                   |d<   g |d<   |D ]%  }|| j                   v s|d   j#                  |       ' d|d<   t%        | j&                        |d<   |S )z return the ntdsdsa object to addr*  r   )r-  nTDSDSAsystemFlagsdMDLocationr  zmsDS-HasDomainNCszCN=NTDS-DSA-RO,%sobjectCategoryzmsDS-HasFullReplicaNCs37optionszCN=NTDS-DSA,%szmsDS-HasMasterNCsHasMasterNCs1invocationId)r   r   r+   rr   r   r.   #SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETErx   rt   rz   r   r   r/   dc_level_from_lprC   r   rb   re  r
   r   )r   r>  ra   domainControllerFunctionalityncs        r8   join_ntdsdsa_objzDCJoinContext.join_ntdsdsa_obj  s    	kCKK'( 3;;&C

 N NOPCMM*	, - ;;s}}=5::#E#EE
 -=,M,Mcff,U)+./L+MC'(5::#E#EE'*{{C#$88$7#--$GC !,/,<,<C()!C	N" 
 %5s}}$DC ! ##uzz'I'II+.+;+;'(')C 3)))'..r23 !C	N"*3+<+<"=C
r9   c                    | j                         }| j                  r| j                  j                  |dg       n<| j                  r| j                  j                  |dg       n| j                  |g       | j                  j                  | j                  t        j                  dg      }t        j                  | j                  j                  d|d   d   d               | _        y)zadd the ntdsdsa objectrelax:0controlsr1  
objectGUIDr   r   N)r  rh   ri   r6  r   rq  rm   r   rn   ro   r   r   r#  	ntds_guid)r   r>  r   s      r8   join_add_ntdsdsazDCJoinContext.join_add_ntdsdsaM  s     ""$!!IIMM#M4XXIIMM#01NNC5! iiCKKs~~l^\		#))"?"?cRSfUaNbcdNe"fgr9   c                    | j                   r9t        d| j                   z         | j                   d| j                  | j                  t        | j                  t
        j                  j                  z        | j                  d}| j                  t
        j                  j                  k\  r't        t
        j                  j                        |d<   n| j                  rg |d<   | j                  r| j                  |d<   n| j                  rg |d<   | j                  r| j                  |d<   n| j                  rg |d<   | j                  r| j                  |d<   n| j                  rg |d<   |rt!        |      |d<   | j                  r| j"                  | j                   k7  r0| j$                  j'                  | j"                  | j                          | j$                  j)                  t*        j,                  j/                  | j$                  |t*        j0                               n$d	}|d
g}| j$                  j3                  ||       | j4                  r| j7                          | j8                  rt        d| j8                  z         | j8                  dt        t
        j                  j:                  t
        j                  j<                  z  t
        j                  j>                  z        | j                  d}| j                   r| j                   |d<   | j$                  j3                  |       | j@                  rd	| _!        y	| jD                  r| jG                          dt+        jH                  | jJ                        z  }| j$                  jM                  t*        jN                  g | j$                  jQ                         |      | jJ                  f}dt+        jH                  | jR                        z  }| j$                  jM                  t*        jN                  g | j$                  jQ                         |      | jR                  f}||fD ]  \  }}|| jT                  vrtW        |      dk(  s$t+        j,                         }	|d   jX                  |	_,        d}
| jZ                  rd}
t+        j\                  | jD                  t*        j^                  |
      |	|
<   | j$                  j)                  |	        | j`                  Ot        d| j`                  z         | j`                  ddd| jb                  d}| j$                  j3                  |       | j                   rt        d| j                   z         t+        j,                         }	t+        jd                  | j$                  | j                         |	_,        tg        tW        | jh                              D ]A  }| jh                  |   jk                  dt        | jB                              | jh                  |<   C t+        j\                  | jh                  t*        j0                  d      |	d<   | j$                  j)                  |	       t        d| j                  z         	 | j$                  jm                  dt+        jH                  | j                        z  | jn                  d| j                         | j$                  jM                  | j                   t*        j|                  d!d"g#      }d!|d   v rt        |d   d!   d         | _@        nd	| _@        t        t        j                  |d   d   d         | _D        t        d$       t+        j,                         }	t+        jd                  | j$                  | j                         |	_,        t+        j\                  t        | j                        t*        j0                  d%      |	d%<   | j$                  j)                  |	       | j                  j                  d&      rt        j                  d'd(      | _H        | j$                  j                  t        t        d)      | j                  | j                  | j                  t        | j                  j                  d*            j                  d+      | j                  d,            }|D ]  \  }}|t*        j                  k(  sJ |d-   }t        d.|d-   z         |d/= |d0= t        t
        j                  j                  t
        j                  j                  z        |d%<   	 | j$                  j3                  |        t        d1| j                  z         	 | j$                  jm                  d2t+        jH                  | j                        z  | j                  d| j                         | j$                  jM                  t*        j|                  d!g#      }d!|d   v rt        |d   d!   d         | _U        y	d	| _U        y	y	# t*        jp                  $ rj}|jr                  \  }}|t*        jt                  k7  r | jv                  jy                  | j                  | jz                  | jn                          Y d	}~d	}~ww xY w# t*        jp                  $ r.}|jr                  \  }}|t*        j                  k7  r Y d	}~d	}~ww xY w# t*        jp                  $ rm}|jr                  \  }}|t*        jt                  k7  r | jv                  jy                  d3| j                  z  | jz                  | j                          Y d	}~d	}~ww xY w)4z+add the various objects needed for the joinr*  computer)r   objectClassdisplaynamesamaccountnamer   r   zmsDS-SupportedEncryptionTypesr   zmsDS-NeverRevealGroupzmsDS-RevealOnDemandGroup	objectSidNr  r  rg   )r   r-  r  r  serverReferencerT   rU   r  r   zmsDS-NC-Replica-LocationszmsDS-NC-RO-Replica-LocationsnTDSConnectionr,  65)r   r-  enabledconnectionr  
fromServerzAdding SPNs to %sz	$NTDSGUIDservicePrincipalNamezSetting account password for %sz((&(objectClass=user)(sAMAccountName=%s))F)force_change_at_next_loginusername)account_namer   newpasswordzmsDS-KeyVersionNumberr   r   zEnabling accountr   BIND9_      zprovision_dns_add_samba.ldif	utf-16-ler]  )	DNSDOMAINDOMAINDNHOSTNAMEDNSPASS_B64DNSNAMEr   z#Adding DNS account %s with dns/ SPNclearTextPasswordisCriticalSystemObjectz#Setting account password for dns-%sz,(&(objectClass=user)(samAccountName=dns-%s))r   )Vr   r   r   rr   r   r   r.   r5  r   r   DS_DOMAIN_FUNCTION_2008ENC_ALL_TYPESr_   r   r   r   r
   r`   ri   r=  r<  rn   r8  	from_dictr;  r6  r   r@  r   SYSTEM_FLAG_CONFIG_ALLOW_RENAME%SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVEr  r   r  r   r  r   r   rm   r   r   r   ra   r   r   r   r:  FLAG_MOD_ADDr   r   r9  ranger   replacesetpasswordr   rp   rq   ERR_UNWILLING_TO_PERFORMrf   set_passwordr   ro   r   key_version_numberr   r   r{   new_dc_account_sidr   
startswithgenerate_random_passworddnspass
parse_ldifr"   r   r   rt   r   r$   rc  decodeCHANGETYPE_NONEr4  ERR_ENTRY_ALREADY_EXISTSdns_key_version_number)r   specified_sidr>  r  r   r   forestpartzoner?  attrie2num_r   r{  
changetyper6   dns_acct_dnr   e3s                         r8   join_add_objectszDCJoinContext.join_add_objects\  se	   ;;++,kk)"{{"%++&)#*@*@5::C_C_*_&`"0C ##uzz'I'II7:5::;S;S7T34%%7934}}#&==K %%#%K ##/2/C/C+,%%/1+,~~25.../%%24./#+M#:K ##&&#++5II$$S%8%8#++F		  !6!6syy#sG[G[!\] , ){H		cH5==""$==+-.mm'"5::#M#M#(::#S#S$T#(::#Q#Q$R  S  #0C {{),%&IIMM#== CM;;  " :C<M<McN`N`<aaDii&&S-?-?-/,/II,G,G,I26 ' 8 :=9K9KMF
 :C<M<McN`N`<aaDii&&S-?-?-/,/II,G,G,I26 ' 8 :=9K9KMF
  &v. (
ds{{*t9>A7::AD6Dxx=!00141A1A4IAdGII$$Q'( (+ 1 112''/%+!nn.C IIMM#;;%34A66#))S[[1AD3sxx=) S!hhqk11+s3==?QRS(+(:(:388;>;O;O;Q)SA$% IIQ 3ckkAB@		%%&P(+(9(9#++(F'G&)mmAF/2{{	 & < ))""3>>*A*5*7 # 8C '#a&0),SV4K-LQ-O)P&)-&%/0@0@03A{0CA0F&HC" $%A66#))S[[1AD&)&8&8S=S=S9T9<9M9M9M'OA"# IIQ??%%h/88cBCK99''(9*Ec:dHKGJ{{GJzzJSTWT_T_TfTfgrTsJtJ{J{  }C  KDFIoo	;W)X YD $( 
C!S%8%8888!$i;c$iGH +,01,/

0L0L05

0L0L1M -N()IIMM#&0 7#**DE>		%%&T(+(9(9#**(E'F&)kkAF/2{{	 & < ))""3>>*A)B # DC&#a&0-0Q8O1PQR1S-T*-1*k 07 << @77a#666$$#++1414 % @ @	@d ||  vvHS!c::: ;" << >77a#666$$(SZZ2G1414 % > >	>sL    Ah >j4Ak" j1Ajjk1#kk"m"5A"mm"c                    t        d| j                  z         dt        | j                        dt        j
                  i}t        j                  | j                  |      }| j                  dd| j                  z  | j                  | j                  | j                  | j                  t        t        j                  j                   t        j                  j"                  z        |d	}| j$                  t        j                  j&                  k\  rt        | j$                        |d<   | j)                         }| j+                  ||g      }t-        |      d	k7  rt/        d
      |d   j0                  | _        t        d       | j4                  j7                  | j                  t9        j:                  d      | j2                  t<        j>                  t<        j@                         t        d       | j4                  j7                  | jB                  t9        j:                  d      | j2                  t<        j>                  t<        j@                         y)zLadd the various objects needed for the join, for subdomains post replicationr*  SubdomainAdmins-)name_mapcrossRefzCN=Cross-Ref,%s)	r   r-  r  nCNamer  dnsRoottrustParentr  ntSecurityDescriptorr  r^  z"Expected 2 objects from DsAddEntryr  zReplicating partition DN$00000000-0000-0000-0000-000000000000)exopr   zReplicating NTDS DNN)"r   r   rr   r}   r   DOMAIN_RID_ADMINSr   +get_paritions_crossref_subdomain_descriptorr~   rx   rt   r   r   parent_partition_dnr   r.   SYSTEM_FLAG_CR_NTDS_NCr   r   r   r  rq  r   r1   guidr  repl	replicater   r   r   DRSUAPI_EXOP_REPL_OBJDRSUAPI_DRS_WRIT_REPr   )r   r  	sd_binaryr>  rec2rz  s         r8   join_add_objects2zDCJoinContext.join_add_objects23  s    	kC,,,-%#cjj/8C]C]'^_JJ3==ckl	""%/#--?kk??}}22uzz@@%**BgBggh$-

 5::#E#EE+.s/C/C+DC'(##%..#t-w<1!"FGG
()3++99%KL== ' = =)0)E)E	 	 	G 	#$3;;99%KL== ' = =)0)E)E	 	 	Gr9   c                 |   t        d       | j                  j                  }t        | j                  t               fi d|d| j                  dt        d| j                  d| j                  d| j                  d| j                  d	| j                  d
| j                  d| j                  d| j                  d| j                   d| j"                  ddd| j$                  d| j                  d| j&                  d| j(                  d| j*                  d| j,                  d| j.                  d| j0                  dd}t        d|j2                  z         |j4                  | _        |j                  | _        |j8                  | _        |j:                  | _        | j<                  | j:                  _        y)Provision the local SAM.zCalling bare provisionsmbconfrZ   
samdb_fillr   rootdndomaindnrL  configdnserverdnr   hostname	domainsidr   
serverrole"active directory domain controllersitenamerC   ntdsguidr[   r   r\   r]   r^   
batch_modeTzProvision OK for domain DN %sN)r   rC   
configfiler   rX   r   rZ   r   r   rv   rt   rx   rz   r   r   r   r}   r   rY   r  r[   r   r\   r]   r^   r  ri   local_samdbpathsnamesr~   )r   r  presults      r8   join_provisionzDCJoinContext.join_provision^  s    	&'&&##CJJ(8 -' -&)mm-@H-PSPYPY-#&;;-9<- &)]]- >A]]- &)]]	- <???	-
 &)ZZ-
 <?::- ),- Cg- &)XX- 36&&- DG==- '*mm- BE- /2.C.C- +.*;*;- 03/E/E- (,- 	-0@0@@A!--!**!--	!--	 "mm		r9   c                 P   t        d       t        | j                  j                  dgt	               | j                  j
                  d      | _        | j                  j                  t        | j                               | j                  | _        | j                  j                  d       | j                  j                  | j                  t        j                  dgddg	      }d
|d   vr/t!        d| j                  d| j                  j                        	 t        t#        j$                  t        j&                  | j                  |d   d   d   j)                  d            j+                  d                  | j,                  _        | j                  j                  d| j,                  j.                  z         | j                  j                  d       t3        | j4                  j6                  t	               | j
                        }t9        | j                  || j                  | j,                  | j4                  | j:                  | j<                  t>        | j@                  d| j
                  | j,                  jB                  | j,                  jD                  | jF                  | jH                         | j:                  tJ        jL                  jN                  k\  r| j:                  }d}t
        jQ                  d      #t
        jS                  dd       t        d       d}t        jU                          	 ddl+m,}  || j                  d      }|j[                  |tJ        jL                  j\                  d       t        j_                          |rt
        jS                  dd       t        d | j,                  jd                  z         y# t0        $ r t!        d|d   d   d   z        w xY w# t`        $ r'}t        jc                          t!        d|z        d}~ww xY w)!r  zReconnecting to local samdbz#transaction_index_cache_size:200000F)rF   r  rG   rC   rN  zFinding domain GUID from ncNamencNamezextended_dn:1:1zreveal_internals:0)rS   rJ   rK   r  r  r   z*Can't find naming context on partition DN z in r]  r   z3Can't find GUID in naming master on partition DN %szGot domain GUID %szCalling own domain provisionrG   rC   r  )
dom_for_fun_levelrZ   r  r   r  rC   hostiphostip6r   r   zdsdb:schema update allowedNyesz;Temporarily overriding 'dsdb:schema update allowed' settingT)DomainUpdate)fix)update_revisionzDomainUpdate() failed: %snozProvision OK for domain %s)3r   r   r  rF   r   rC   ri   set_invocation_idrr   r   rX   rk   rm   r   rn   ro   r1   r   r   r9  r  get_extended_componentr  
domainguidKeyErrorr   r  secretsr   r   rZ   r   r   r
  r  r   r   r   r.   DS_DOMAIN_FUNCTION_2012r   settransaction_startsamba.domain_updater  check_updates_functional_levelr  transaction_commitr   transaction_cancelr   )r   r   secrets_ldbadprep_levelupdates_allowed_overriddenr  r   r   s           r8   join_provision_own_domainz'DCJoinContext.join_provision_own_domain{  sP    	+,coo11B"D'5'7 __//(-/	 			##C(9(9$:;))

9:oo$$#*:*:#..YaXb/@BV.W % Y 3q6!!Z]ZjZjlolululyly"z{{	o#&tyy		3q6(CSTUCVC]C]^dCe1f1}1}  E  2F  (G  $HCII  	

,syy/C/CCD

67#))++.:JsvvVszz399cii),)=)=!$>#&===a&&)9)9399CTCT#&??cmm	M 5::#E#EE//L).&vv23;3U;ST-1*##%G<%coo4@55l6;jj6X6XFJ 6 L ((*
 *3T:*SYY-@-@@AW  	o!"WZ]^_Z`aiZjklZm"mnn	oH  G((*%&AA&EFFGs&   A2O <AO5 !O25	P%>"P  P%c                     t        j                  d| j                  d|d| j                  || j                  | j
                        S z2Creates a new DRS object for managing replicationsr   r   r   )r   drs_Replicaterg   rC   r  r   )r   
repl_credsr   s      r8   create_replicatorzDCJoinContext.create_replicator  s:    &&),_E
COOS5F5FH 	Hr9   c                    | j                   j                  d       | j                  j                          	 t	        j
                  | j                  j                               }| j                  /t        d       t	        j
                  t        j                        }n| j                  }| j                  rqt               }|j                  | j                         |j!                  t"               |j%                  | j&                         |j)                  | j*                         n| j,                  }d}| j                  j/                         dk\  r|dz  }| j1                  ||      }|j3                  | j4                  ||d| j                  | j6                         |j3                  | j8                  ||| j                  | j6                  	       | j:                  st        d
       	 |j3                  | j<                  ||| j                  | j>                  t        j@                  z  	       | j>                  t        j@                  z  s5	 |j3                  | j<                  ||| j                  | j>                  	       t        d       | jL                  | jN                  fD ]R  }|| jP                  v st        dtS        |      z         |j3                  |||| j                  | j6                  	       T | j                  r]|j3                  | jT                  ||t        jV                  d       |j3                  | jX                  ||t        jV                  d       n:| jZ                  .	 |j3                  | jZ                  ||t        j\                         || _3        || _4        || _5        | j                   j                  d       | j>                  t        j@                  z  s*| j                  jm                  tn        jp                  d       | j                  js                          | j                  jm                  tn        jp                  d       | j                   j                  d       | jw                          y# tB        $ rH}|jD                  d   tF        jH                  k(  r| j                   jK                  d       n Y d}~d}~ww xY w# tB        $ r^}|jD                  d   tF        jH                  k(  r8| j>                  t        j@                  z  r| j                   jK                  d        d}~ww xY w# t^        j`                  $ rR}|jD                  \  }	}
|	t        jb                  k(  r$t        d| jd                  z         t        d       n Y d}~d}~ww xY w#  | j                  ju                           xY w)zReplicate the SAM.zStarting replicationNzUsing DS_BIND_GUID_W2K3rB  rC  rD  T)schemarodcr   )r(  r   z;Replicating critical objects from the base DN of the domainr   zFirst pass of replication with DRSUAPI_DRS_CRITICAL_ONLY not possible due to a missing parent object.  This is typical of a Samba 4.5 or earlier server. We will replicate all the objects instead.zReplication with DRSUAPI_DRS_CRITICAL_ONLY failed due to a missing parent object.  This may be a Samba 4.5 or earlier server and is not compatible with --critical-onlyz5Done with always replicated NC (base, config, schema)zReplicating %s)r  r(  )r  zdWARNING: Unable to replicate own RID Set, as server %s (the server we joined) is not the RID Master.zxNOTE: This is normal and expected, Samba will be able to create users after it contacts the RID Master at first startup.z1Committing SAM database - this may take some timer  zCommitted SAM database)<rX   rk   r  r  r   r   ri   get_invocation_idr  r   r   DRSUAPI_DS_BIND_GUID_W2K3r   r   r   rC   r   r   set_usernamer   r  r   rB   rE  r%  r  rx   r   rz   r   rt   domain_replica_flagsDRSUAPI_DRS_CRITICAL_ONLYr%   rq   r#   WERR_DS_DRA_MISSING_PARENTwarningr   r   ra   rr   r   DRSUAPI_EXOP_REPL_SECRETr   r   DRSUAPI_EXOP_FSMO_RID_ALLOCr   DsExtendedErrorDRSUAPI_EXOP_ERR_FSMO_NOT_OWNERrg   r  source_dsa_invocation_iddestination_dsa_guidset_opaque_integerr.   0DSDB_FULL_JOIN_REPLICATION_COMPLETED_OPAQUE_NAMEr  r  refresh_ldb_connection)r   r4  r5  r$  r   r  r   r  e1r   r   s              r8   join_replicatezDCJoinContext.join_replicate  s    	

./
 	))+F	6'+yy1L1L1N'O$}}$/0'+yy1R1R'S$'*}}$xx(]
  (--.?@''4''6 YY
$Ovv!Q&8+((_EDNN3==*B/388),):):  < NN3==*B/chh),):):  < == STNN3;;0H#7chh141I1IGLmLm1m # o0 //'2S2SSs{{4L';#((585M5M ' O IJ
 ))3+=+=> D$*c"g67NN2'?#7chh141B1B # DD xxs{{,D3$+$D$D4  Q s002J3$+$D$D4  Q ##/
NN3#5#57O#7(/(K(K # M CH+CC(';C$JJOOOP ++g.O.OO2243h3h346OO..0OO..t/d/d/02JJOO45 	""$C # 
vvayF$E$EE

** ,X Y Y
4 ' 66!9(I(II33g6W6WWJJ.. 0\ ] F ,, #%77LT4wFFF  E  HK  HR  HR  R  S  Y  Z Z		OO..0s   F3V* +AR 0V* 4S 4V* 7B8V* 0-U 0V* 	S=S
V* SV* 	T?!AT::T??V* V'AV"V* "V''V* *Wc                    	 | j                   j                  t        j                  g        y # t        j                  $ r}|j
                  \  }}|t        j                  k(  rad|v sd|v rY| j                  j                  d       t        d| j                  z  t               | j                  | j                        | _         nt        |      Y d }~y d }~ww xY w)NrI   !NT_STATUS_CONNECTION_DISCONNECTEDNT_STATUS_CONNECTION_RESETz)LDB connection disconnected. ReconnectingrD   rE   )ri   rm   rn   ro   rp   rq   ERR_OPERATIONS_ERRORrX   r/  r   rg   r   rB   rC   r1   )r   r   r   r   s       r8   r8  z$DCJoinContext.refresh_ldb_connection^  s    	,II3>><|| 	,66LT4 0004<-5

""#NO!kCJJ&>/=/?.1iiCFFD	 &d++	 	,s   +. CBCCc                    t        j                         }t        j                         |_        t	        |      |j                  _        t        j                  d      |j                  _        t        j                  d      |j                  _        | j                  |_        t	        | j                        d| j                  |_        t         j                   t         j"                  z  |_        | j&                  s#|xj$                  t         j(                  z  c_        | j                   | j+                          | j                   j-                  | j.                  d|       y )Nr  zS-0-0z._msdcs.r  )r   DsReplicaUpdateRefsRequest1r`  naming_contextrr   r   r   r   r  r   r{   r   r  dest_dsa_guidr   dest_dsa_dns_nameDRSUAPI_DRS_ADD_REFDRSUAPI_DRS_DEL_REFr  r   r  rJ  DsReplicaUpdateRefsrG  )r   r   r   s      r8   send_DsReplicaUpdateRefsz&DCJoinContext.send_DsReplicaUpdateRefsp  s    //1"<<>!"g $		*P Q'//8--03CMM0BCMMR//'2M2MM	xxII555I;;!''(:(:AqAr9   c                 
   t         j                  }t         j                  t         j                  z  }| j                  }d| j
                  z  }| j                  }t        | j                        }|d|}t        j                  | j                  | j                        }| j                  j                  dt        |      ||fz         d}	t        j                   d| j                   d|	d| j                  | j"                        }
d}t%        j&                  | j(                        }t+        j,                         }| j.                  |_        t+        j2                  d	t        | j4                        t*        j6                  fz        |_        	 |
j;                  |d
| j                   ||dt<        j>                  |dd
      \  }}|rjH                  D ]  }|jJ                  D ]z  }|jL                  t<        jN                  k(  s|jL                  t<        jP                  k(  s>t        jR                         }||_$        	 |
jU                  |d
| j                   ||d|       |  |D ]  }|jW                  d      dk7  r0| j                  j                  d|d|d|       tY        |      }n/| j                  j                  d|d|d|       t[        |      }t        jR                         }||_$        |
jU                  |d
| j                   |||d        t        |      d
kD  rt]        j^                  | j(                  | j`                        }| j(                  jc                  |d||      \  | _2        }|jg                  | jd                  |dt*        jh                  t*        jj                  z  z  g       | j                  j                  d|d|d|       t        jR                         }tm        |      }||_$        |
jU                  |d
| j                   |||d       t]        j^                  | j(                  | jn                        }| j(                  jc                  |d||      \  | _8        }|jg                  | jp                  |dt*        jh                  t*        jj                  z  z  g       | j                  j                  d       y# t@        $ r-}|jB                  d
   tD        jF                  k(  rd}Y d}~Cd}~ww xY w# t@        $ r-}|jB                  d
   tD        jF                  k(  rn Y d}~_d}~ww xY w)a  Remotely Add a DNS record to the target DC.  We assume that if we
           replicate DNS that the server holds the DNS roles and can accept
           updates.

           This avoids issues getting replication going after the DC
           first starts as the rest of the domain does not have to
           wait for samba_dnsupdate to run successfully.

           Specifically, we add the records implied by the DsReplicaUpdateRefs
           call above.

           We do not just run samba_dnsupdate as we want to strictly
           operate against the DC we just joined:
            - We do not want to query another DNS server
            - We do not want to obtain a Kerberos ticket
              (as the KDC we select may not be the DC we just joined,
              and so may not be in sync with the password we just set)
            - We do not wish to set the _ldap records until we have started
            - We do not wish to use NTLM (the --use-samba-tool mode forces
              NTLM)

        z	_msdcs.%srO   z&Adding %d remote DNS records for %s.%sr   r   r   r   Tz%s-%dr   NF:zAdding DNS AAAA record z for IPv6 IP: zAdding DNS A record z for IPv4 IP: )dns_partitionzsd_flags:1:%dr  zAdding DNS CNAME record z for z_All other DNS records (like _ldap SRV records) will be created samba_dnsupdate on first startup)9r   DNS_CLIENT_VERSION_LONGHORNDNS_RPC_VIEW_AUTHORITY_DATADNS_RPC_VIEW_NO_CHILDRENr   r   r   rr   r  r   interface_ipsrC   r   rX   rk   r   rg   rB   r'   SDUtilsri   r   r   r  	owner_sidr{   r}   DOMAIN_RID_DCS	group_sidDnssrvEnumRecords2r   DNS_TYPE_ALLr%   rq   r#   "WERR_DNS_ERROR_NAME_DOES_NOT_EXISTr>  recordswType
DNS_TYPE_ADNS_TYPE_AAAADNS_RPC_RECORD_BUFDnssrvUpdateRecord2findr)   r(   rn   r9  r   
dns_lookupr   modify_sd_on_dnSECINFO_OWNERSECINFO_GROUPr*   r   r   )r   client_versionselect_flagsr  
msdcs_zoner   msdcs_cnamecname_targetIPsr   dns_conn
name_found	sd_helperchange_owner_sdbuflenr   r   r>  recorddel_rec_bufIPadd_rec_bufdomaindns_zone_dnldap_recordforestdns_zone_dns                            r8   join_add_dns_recordsz"DCJoinContext.join_add_dns_records  s   0 #>> <<../ }} 3==0
zz#--("&-!!#&&#*;*;<

@S4./ 	0 !&&

O'\'*vvsyy: 
$$SYY/	"--/$'$:$:!$,$4$4W69#**o6>6M6M6O6O %P!
	#--n./.1jj.2.2.2.2.?.?.:.2.2	4 VS ww &!kk &F||t6||t'9'99&/&B&B&D*0&$889:9<9=9=9=9DF&&*  	/Bwws|r!

#'r!3 4 n

#'r!3 4bk $668K!KO(()*),)-)-)4)-/	/* HqL #syy#2D2D E))&&$'=5F ' H (S\;
 %%cllO0?3;3I3I5=5K5K4L1M 0N & O JJOO*JF G $668Kl+C!KO(()*),)3)4)4)-/ !$syy#2D2D E))&&+z'J5F ' H ,S{
 %%c&6&60?3;3I3I5=5K5K4L1M 0N & O
 	

 K 	Lk  	#vvayFEEE"
	#(  + & vvayF,U,UU $ % !%&s0   5S :!T	T"TT	U"T??Uc           	      <   | j                   | j                  fD ]  }|| j                  v s| j                  j	                  dt        |      z         | j                  j                  || j                  | j                  | j                  | j                  d        y )Nz!Replicating new DNS records in %sF)r(  r   	full_sync)r   r   ra   rX   rk   rr   r  r  r4  r  r   r   )r   r  s     r8   join_replicate_new_dns_recordsz,DCJoinContext.join_replicate_new_dns_records  s    %%s'9'9: 	4BS[[ 

 Cs2w OP""2s'C'C#&==sxx141B1B-2 # 4	4r9   c                 6   | j                   j                  d       | j                  D ]  }| j                  |        | j                  r"t        d       | j                  j                  t        | j                               | j                  j                  d| j                         t        j                         }t        j                  | j                  d| j                  z        |_        t        j"                  t%        | j                        t        j&                  d      |d<   | j                  j)                  |       | j                  j+                  |j                   dd       | j                   j                  d       t        j                         }t        j                  | j                  d      |_        t        j"                  d	t        j&                  d
      |d
<   | j,                  }t        j"                  dt        |      z  t        j&                  d      |d<   | j                  j)                  |       | j.                  ryt1        | j2                  j4                  t7               | j8                        }| j                   j                  d       t;        || j<                  | j>                  | j@                  | jB                  | jD                  | jF                  | jH                  | jJ                  	       | jL                  jO                  d      r{tQ        | j                  || jR                  | j2                  | j8                  | j                   | jL                  | jT                  | j                  | jV                  | jX                         yy)z=Finalise the join, mark us synchronised and setup secrets db.z=Sending DsReplicaUpdateRefs for all the replicated partitionszSetting RODC invocationIddomainFunctionalityz%sr  r   (Setting isSynchronized and dsServiceName@ROOTDSEr,  isSynchronized	<GUID=%s>dsServiceNameNr  zSetting up secrets database)r   r   r   netbiosnamer  r   secure_channel_typer  r  )r   r  os_levelrZ   r  )-rX   rk   ra   rG  r   r   r  r  rr   r   r6  r   rn   r8  r9  r   r   r:  r
   r;  r<  "set_attribute_replmetadata_versionr  r   r   r  r  r   rC   r   r   r   r   r   r}   r   r  r  r   r  r!   r  r  rZ   r  )r   r  r?  r  r  s        r8   join_finalisezDCJoinContext.join_finalise#  s    	

WX++ 	-B((,	- 88-.OO--c#2C2C.DEOO../D/2/C/CEA66#//4#+++=>AD # 2 28C<M<M3N363G3G3A!CAn OO""1% OO>>qtt?M?@B 	

BCKKMvvcooz2!009M9MO_`
}} //c$i0G030D0DoW/q!==#))++.:JsvvV

56K"%))&)mm(+

&)jj(+030G0G/2/E/E	G ??%%h/COO[IIsyy#&&#**(+$'KK#:N:N&)mm/2/I/IK 0r9   c                 P
   t        d| j                  z         d}t        j                  d| j                  d|d| j                  | j
                        }t        j                         }t        j                         |_        |j                  dj                  d      |t        j                        }t        j                         }| j                  |j                  _        | j                  |j"                  _        | j$                  |_        t        j(                  t        j*                  z  |_        t        j.                  |_        t        j2                  |_        	 t        j6                         }| j                  |_        |j9                  ||t        j:                        }t        d| j                  d|j<                  j&                  d	       |j?                  ||j<                  j&                         tC        | jD                  jG                  d
            }tI        jJ                         }	tM        |      |	_'        ||	_(        tI        jR                         }
tU        jV                  tY        t[        jZ                                     |
_.        t        j^                  |
_0        |	|
_1        tI        jd                         }d|_3        |
g|_4        tI        jj                         }d|_3        ||_6        tI        jn                         }dgdz  }tq        d      D ]  }ts        jt                  dd      ||<    ||_;        ||_<        ||_=        t}        |      }t        |j                  |      }t        j                         }tM        |      |_'        tC        |      |_B        t        j                         }||_D        |j                  |||t        j                        }d| j                  d| j                  dt        |j0                        t        |j4                        t        |j,                        | j                  | j                  t}        |      t}        |      t}        | j                        d
}| j                  j                  |       d| j                  d| j                  dt        tT        j                  j                        | jD                  jG                  d
      d| j                  z  d}| j                  j                  |       y# t@        $ r Y (w xY w)zprovision the local SAM.z"Setup domain trusts with server %sr   z	ncacn_np:r   r   zutf-8zRemoving old trust record for  (SID )r  r  r_  i   r   r  zcn=z,cn=system,trustedDomain)
r   r-  	trustTypetrustAttributestrustDirectionflatnametrustPartnertrustAuthIncomingtrustAuthOutgoingsecurityIdentifierz$,cn=users,r+  rM   )r   r-  r   r  r2  N)Pr   rg   r   r   rC   rB   r   r   r   r   r  r   r   TrustDomainInfoInfoExr   r   r   r   r}   r   LSA_TRUST_DIRECTION_INBOUNDLSA_TRUST_DIRECTION_OUTBOUNDtrust_directionLSA_TRUST_TYPE_UPLEVEL
trust_type!LSA_TRUST_ATTRIBUTE_WITHIN_FORESTtrust_attributesr   r   r   r   r   rt  r	   trustdom_passrc  r   AuthInfoClearr   sizepasswordAuthenticationInformationr   unix2nttimer   timeLastUpdateTimeTRUST_AUTH_TYPE_CLEARAuthTypeAuthInfoAuthenticationInformationArraycountarraytrustAuthInOutBlobcurrenttrustDomainPasswordsr  randomrandint
confounderoutgoingincomingr
   r   session_key	DATA_BUF2dataTrustDomainInfoAuthInfoInternal	auth_blobCreateTrustedDomainEx2SEC_STD_DELETEr   rt   rr   r   r~   r  r6  r.   UF_INTERDOMAIN_TRUST_ACCOUNT)r   r   r   r   r   rk   oldnameoldinfopassword_blobclear_value clear_authentication_information authentication_information_arrayr  	trustpassr  r  trustpass_blobencrypted_trustpassr  	auth_infotrustdom_handler>  s                         r8   join_setup_trustszDCJoinContext.join_setup_trustsk  s    	2SZZ?@**#**oN VVSYY0 ((*
 [[]
((7);)3X5V5VX
 ((*"%--#&?? ::">>AaAaa44 # E E	jjlG ]]GN:::w;>;`;`bGPWP_P_PcPcde''
GOO4G4GH -S->->-E-Ek-RS,,.}-,+3+M+M+O(:?:K:KCPTPYPYP[L\:](7474M4M(14?(1+3+R+R+T(12(.2R1S(...0;113	S3Y
s 	3A"NN1c2JqM	3  *	%	%	!),-g.A.A>RMMO	01	-.AB	779	'	!889=9B9A9P9PR +.--E*T__-"4#8#89!$"6"67..MM!)(!3!)(!3"*3=="9
 	C  +.*@*@#++N!"%ejj&M&M"N!$!2!2!9!9+!F#c&<&<<
 	C M  		s    BT 	T%$T%c                    | j                   | j                  g| _        | j                  | j                   | j                  g| _        | j
                  r0| j                  dk7  r!| xj                  | j                  gz  c_        y | j
                  s| xj                  | j                  gz  c_        | j                  dk7  r| xj                  | j                  gz  c_        | xj                  | j                  gz  c_        | xj                  | j                  gz  c_        | xj                  | j                  gz  c_        y y y )NrW   )	rz   rx   ra   rt   rb   r   r   r   r   rR  s    r8   build_nc_listszDCJoinContext.build_nc_lists  s     }}cmm4KKF==S__6!3!3 44KKCKK=(K&( 2 233 2 233  S%7%7$88   S%7%7$88 	 ) r9   c                 Z   | j                          | j                  r| j                          n| j                          	 | j	                          | j                          | j                          | j                  r0| j                          | j                          | j                          | j                  dk7  r | j                          | j                          | j                          y #  	 t        d       n# t         $ r Y nw xY w| j#                          | j                           xY w)NrW   zJoin failed - cleaning up)r  r_   r  r   r  r  r:  r   r  r   r  r   rt  rw  r  r   IOErrorr8  rR  s    r8   do_joinzDCJoinContext.do_join  s      "  "	  "  }}%%'--/%%'&(((*224
	12 
 &&(  "s0   B+C+ +D*.C:9D*:	DD*D$D*)NNNNNNNNNFNFFNNN)FN)'r:   r;   r<   __doc__r4   r   r   r   r  rl   rj   r   r   r   r   r!  r%  r   r@  rJ  rS  r[  rq  r  r  r  r  r  r   r%  r:  r8  rG  rt  rw  r  r  r  r   r9   r8   r@   r@   >   s    JN;?@D;@#$($(U"n3Sj-.^(&*6---N	;:`1AF.`hU2n)GV,:FBPHS%j,$B"WLr4FKPc!J9* r9   r@   c                    t        | ||||||||	|
|||||      }|j                  d|j                         | j                  d|j                  z         |j                  d|j                         | j                  d|j                  z         d|j
                  d|j                  |_        d|j                  d	t        j                  d
dt        j                  z  dt        j                  z  dt        j                  z  dt        j                  z  g|_        d|j                  d	t        j                   d
|_        |j%                         }d|z  }||_        t(        j*                  j,                  t(        j*                  j.                  z  t(        j*                  j0                  z  |_        |j4                  j7                  d|j
                  z  d|j8                  z  g       d|j:                  z  |_        t>        j@                  |_!        d|_"        |xjF                  tH        jJ                  tH        jL                  z  z  c_#        |jF                  |_'        |r#|xjN                  tH        jP                  z  c_'        |jS                          | j                  d|j                  d|j                  d       y)zJoin as a RODC.r]   r^   	workgroupworkgroup is %sr   realm is %sz
CN=krbtgt_r3  z<SID=r  >z<SID=%s>zRestrictedKrbHost/%szCN=RODC Connection (FRS),%sTJoined domain r  z) as an RODCN)*r@   r  r   rk   r   r   rt   r   r}   r   DOMAIN_RID_RODC_DENYSID_BUILTIN_ADMINISTRATORSSID_BUILTIN_SERVER_OPERATORSSID_BUILTIN_BACKUP_OPERATORSSID_BUILTIN_ACCOUNT_OPERATORSr   DOMAIN_RID_RODC_ALLOWr   r%  r   r   r.   r  )UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONUF_PARTIAL_SECRETS_ACCOUNTr   r   extendr   r   r   r   SEC_CHAN_RODCr  r   r   r   %DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING$DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIPr,  r-  r  )rX   rg   rB   rC   rY   r   rZ   r   domain_critical_onlyr   r[   r   r_   r\   r]   r^   r   mysidadmin_dns                      r8   	join_RODCr    s#    r4!6;	;(*;&3+=	?C FF;(
KK!COO34FF7CII
KK		)*25**ckkJCM X%B%BCX888X:::X:::X;;;=C '*jj(2P2PQCNMMOEE!HCM#jjEE#jjRRS#jjCCDC HHOO+cjj8+coo=? @ 6CC"00CCH'GG!FFG H"00C  G$E$EE KKM
KK#//3::VWr9   c                 Z   t        | ||||||||	|
|||||      }|j                  d|j                         | j                  d|j                  z         |j                  d|j                         | j                  d|j                  z         t
        j                  j                  t
        j                  j                  z  |_	        |j                  j                  d|j                  z         t        j                  |_        |xj                   t"        j$                  t"        j&                  z  z  c_        |j                   |_        |r#|xj(                  t"        j*                  z  c_        |j-                          | j                  d|j                  d|j.                  d	       y
)zJoin as a DC.r  r  r  r   r  z1E3514235-4B06-11D1-AB04-00C04FC2DCD2/$NTDSGUID/%sr  r  z	) as a DCN)r@   r  r   rk   r   r   r.   r  UF_TRUSTED_FOR_DELEGATIONr   r   re  r   r   SEC_CHAN_BDCr  r   r   r  !DRSUAPI_DRS_FULL_SYNC_IN_PROGRESSr,  r-  r  r}   )rX   rg   rB   rC   rY   r   rZ   r   r  r   r[   r   r_   r\   r]   r^   r   s                    r8   join_DCr  @  s>    r4!6;	;(*;&3+=	?C FF;(
KK!COO34FF7CII
KK		)*"ZZ??%**BfBffCHHOOG#--WX"//C'66!CCD E"00C  G$E$EE KKM
KKs

STr9   c
                    t        | |||||||||	
      }
|j                  d|
j                         | j                  d|
j                  z         |j                  d|
j                         | j                  d|
j                  z         |
j                          | j                  d|
j                  d|
j                  d       |
S )	z%Creates a local clone of a remote DC.)rZ   r   r   include_secretsr]   r^   r  r  r   r  zCloned domain r  r  )DCCloneContextr  r   rk   r   r  r}   )rX   rg   rB   rC   rZ   r   r  r   r]   r^   r   s              r8   
join_cloner  b  s    
 i &K)8'4,>	@C FF;(
KK!COO34FF7CII
KK		)*KKM
KKs

KLJr9   c                   8     e Zd ZdZ	 	 	 	 d fd	Zd Zd Z xZS )r  zClones a remote DC.c                    t         t        |   ||||||||	|
	       d | _        d | _        d | _        | j                  j                  d      d   | _        d | _	        d | _
        | j                  j                         | _        | xj                  t        j                   t        j"                  z  z  c_        |s#| xj                  t        j$                  z  c_        | j                  | _        y )N)rZ   r   r   r]   r^   rO   r   )r3   r  r4   r   r   r   rg   splitr   r  r   ri   get_ntds_GUIDremote_dc_ntds_guidr   r   r  r  r  r,  )r   rX   rg   rB   rC   rZ   r   r   r  r]   r^   r7   s              r8   r4   zDCCloneContext.__init__{  s     	nc+FFE26?8C:G?Q	 	, 	S ZZ%%c*1-
! #&))"9"9";g::%GGH 	I!N!NN#&#4#4 r9   c                    | j                   j                  d       t        j                         }t        j                  | j
                  d      |_        t        j                  dt        j                  d      |d<   | j                  }t        j                  dt        |      z  t        j                  d      |d<   | j
                  j                  |       y )Nrz  r{  r,  r|  r}  r~  )rX   rk   rn   r8  r9  r  r   r:  r;  r  rr   r<  )r   r?  r  s      r8   r  zDCCloneContext.join_finalise  s    

BCKKMvvcooz2!009M9M1AC
 && //c$i0G030D0D0?A/ 	q!r9   c                     | j                          | j                          | j                          | j                          y r  )r  r  r:  r  rR  s    r8   r  zDCCloneContext.do_join  s4     	r9   )
NNNNNNNFNN)r:   r;   r<   r  r4   r  r  r=   r>   s   @r8   r  r  x  s!    ?C:>6:$(56"r9   r  c                   B     e Zd ZdZ	 	 	 d fd	Zd Zd Zd Zd Z xZ	S )DCCloneAndRenameContextz6Clones a remote DC, renaming the domain along the way.c                 h    t         t        |   ||||||	|
||	       || _        || _        || _        y )N)rZ   r   r   r  r]   )r3   r  r4   new_base_dnnew_domain_name	new_realm)r   r  r  r  rX   rg   rB   rC   rZ   r   r   r  r]   r7   s                r8   r4   z DCCloneAndRenameContext.__init__  sJ     	%s4VVUB?H<BALETCP 	5 	R &-!r9   c           	          d| j                   d|d}t        j                  || j                  || j                  | j
                  | j                  | j                        S r"  )rg   r   drs_ReplicateRenamerrC   r  r   rt   r  )r   r$  r   binding_strs       r8   r%  z)DCCloneAndRenameContext.create_replicator  sN     03zz?K--k366:.1oo.1.?.?.1kk3??L 	Lr9   c                     t        j                         \  }}|j                  d|       t        j                  j                  |      }t        j                  |       |S )z?Creates a non-global LoadParm based on the global LP's settingsF)filename_for_non_global_lp)tempfilemkstempdumpr   paramLoadParmosremove)r   	global_lpfdtmp_filelocal_lps        r8   create_non_global_lpz,DCCloneAndRenameContext.create_non_global_lp  sL      '')Huh';;''8'L
		(r9   c                 b    | j                   }t        j                  d|z  | j                  |      S )z/Uses string substitution to replace the base DNrM   )rt   resubr  )r   dn_strold_base_dns      r8   	rename_dnz!DCCloneAndRenameContext.rename_dn  s'    kkvvek)3??FCCr9   c                 F   t        d       | j                  | j                        }t        | j                  t               | j                  t        | j                  || j                  | j                        | j                  | j                  | j                        | j                  | j                        | j                  | j                  d| j                   | j"                        }t        d|j$                  z         |j&                  | _        |j*                  | _        y)z"Provision the local (renamed) SAM.z(Provisioning the new (renamed) domain...r  )rZ   r  r   rC   r  r  rL  r  r   r  r  r   r]   z%Provision OK for renamed domain DN %sN)r   r  rC   r   rX   r   rZ   r   r  r  rv   r  rx   rz   r  r}   r   r]   r  ri   r  r  )r   non_global_lpr  s      r8   r  z&DCCloneAndRenameContext.join_provision  s     	89 008 CJJ(8&)mm"%--M#&==#=%(]]3==%A%(]]3==%A#&#6#6#**'K(+*-*;*;	= 	58H8HHI!--MM	r9   )	NNNNNNNTN)
r:   r;   r<   r  r4   r%  r  r  r  r=   r>   s   @r8   r  r    s*    @FJJNGK"
LD"r9   r  )NNNNNNNNFNFNFFNN)
NNNNNNFrW   NN)Pr  
samba.authr   samba.samdbr   r   r   r   r   r   r	   rn   r   	samba.ndrr
   r   samba.dcerpcr   r   r   r   r   r   r   r   
samba.dsdbr   samba.credentialsr   r   samba.provisionr   r   r   r   r   r   samba.provision.commonr   samba.schemar   r   	samba.netr    samba.provision.sambadnsr!   r"   r#   base64r$   r%   r&   r'   samba.dnsserverr(   r)   r*   loggingr  r  r	  r  r  collectionsr+   samba.commonr,   samba.netcmdr-   r.   r/   r   r1   rm  r@   r  r  r  r  r  r  r9   r8   <module>r!     s  &  %  O O 
   * U U U . <D D -    4 #   ,  < <    	 	  # # % (Mi MGF GT. VZ@E=A8= !%5Xp TX>C;?6;#UD 9=<A15"&,3] 3pS"n S"r9   