
    '\d:                    b   d Z ddlmZ ddlmZ ddlmZmZmZm	Z	m
Z
 ddlZddlZddlZddlmZmZ ddlmZmZmZmZmZmZmZmZ ddlmZ dd	lmZmZ dd
lmZm Z m!Z!m"Z"m#Z#m$Z$ ddl%m&Z& ddl'm(Z( ddlm)Z) ddl*m+Z+ ddl,m-Z- ddlm.Z. ddlm/Z/ ddl0m1Z1 ddlm2Z2m3Z3 ddlm4Z4 ddl5m6Z6m7Z7m8Z8 ddl9Z9ddl:Z:ddl;Z;ddl<Z<ddl=Z=ddl>Z>ddl?m@Z@ ddlAmBZB ddlCmDZD ddlmEZE  G d deF          ZG G d deH          ZI	 	 	 	 	 	 d'dZJ	 	 	 	 	 	 d'd ZK	 	 	 	 d(d"ZL G d# d$eI          ZM G d% d&eM          ZNdS ))zJoining a domain.    )system_session)SamDB)gensecLdb	drs_utilsarcfour_encryptstring_to_byte_arrayN)ndr_pack
ndr_unpack)securitydrsuapimiscnbtlsadrsblobs	dnsserverdnsp)DS_DOMAIN_FUNCTION_2003)CredentialsDONT_USE_KERBEROS)secretsdb_self_join	provisionprovision_fillFILL_DRSFILL_SUBDOMAINDEFAULTSITE)
setup_path)Schema)
descriptor)Net)setup_bind9_dns)read_and_sub_file)werror)	b64encode)WERRORErrorNTSTATUSError)sd_utils)ARecord
AAAARecordCNAMERecord)OrderedDict)
get_string)CommandError)dsdbc                        e Zd Z fdZ xZS )DCJoinExceptionc                 ^    t          t          |                               d|z             d S )NzCan't join, error: %s)superr0   __init__)selfmsg	__class__s     ,/usr/lib/python3/dist-packages/samba/join.pyr3   zDCJoinException.__init__:   s-    ot$$--.E.KLLLLL    )__name__
__module____qualname__r3   __classcell__r6   s   @r7   r0   r0   8   sA        M M M M M M M M Mr8   r0   c                       e Zd ZdZ	 	 	 	 	 	 	 d'dZd(dZd(dZd(dZd Zd	 Z	d
 Z
d Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd)dZd Zd Zd Zd Zd Zd Zd  Z d! Z!d" Z"d# Z#d$ Z$d% Z%d& Z&dS )*DCJoinContextzPerform a DC join.NFc                 4   || _         || _        || _        || _        || _        |
| _        || _        || _        || _        || _	        d | _
        g | _        g | _        | j                            |                                t          j        z             t#          | j        | j                  | _        || _        || _        |r|| _        | j        j        | _        n| j        r"||                     | j                  | _        nY| j                             d|z             |                     |          | _        | j                             d| j        z             t5          d| j        z  t7                      | j        | j                  | _        | j        t8          | _        	 | j                            t<          j        g            n0# t<          j         $ r}|j!        \  }}tE          |          d }~ww xY wtG          | j        $                                          | _%        tG          | j        &                                          | _'        tG          | j        (                                          | _)        tG          | j        *                                          | _+        tY          j-        | j        .                                          | _/        | j/        | _0        | 1                                | _2        | 3                                | _4        tk          j6        tG          to          j8                                        | _9        | j        :                                | _;        | <                                | _=        | >                                | _?        |	|	| _@        nt          jB        dd          | _@        | j        C                                | _D        |rJ|| _E        d| jE        z  | _F        d	| jE        d
| j        d| j+        | _G        d| jG        z  | _H        d	| jE        d| j%        | _I        | jE        J                                d| jD        | _K        | j        L                                | _M        d| j%        z  }| N                    |          rd	| jE        d|| _O        nd | _O        d| jE        z  d| jK        z  d| jK        d| jM        g| _P        | j                            t<          j        dg| j%                  }|d         d         d         | _Q        d| j%        z  | _R        d| j'        z  | _S        dt=          jT        | jR                  z  }| j                            t<          jU        g | j        V                                |          }|d| _W        n1t          |          dk    rd| _W        t          d           n|| _W        | jD        | _Z        d | _[        t          j]        t          j^        z  t          j_        z  t          j`        z  t          ja        z  | _b        d | _c        d | _d        d | _e        d| _f        d | _g        d | _\        d | _h        d| _i        d | _j        d | _k        d | _l        d | _m        d| _n        d S )N)credslpz&Finding a writeable DC for domain '%s'zFound DC %s	ldap://%surlsession_infocredentialsrB   scopeattrsx   %s$CN=z,CN=Servers,CN=z
,CN=Sites,zCN=NTDS Settings,%sz,OU=Domain Controllers,.zGCN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,%s,zHOST/%szGC//rIDManagerReference)rI   rJ   baser   zDC=DomainDnsZones,%szDC=ForestDnsZones,%s$(&(objectClass=crossRef)(ncName=%s))rI   rJ   rR   
expressionNONEzCNO DNS zone information found in source domain, not replicating DNSF)ologgerrA   rB   site	targetdir	use_ntvfsplaintext_secretsbackend_storebackend_store_sizepromote_existingpromote_from_dnnc_listfull_nc_listset_gensec_featuresget_gensec_featuresr   FEATURE_SEALr    netserverforced_local_samdbsamdbrE   find_dc_siteinfofind_dcr   r   r   searchldb
SCOPE_BASELdbErrorargsr0   strget_default_basednbase_dnget_root_basednroot_dnget_schema_basedn	schema_dnget_config_basedn	config_dnr   dom_sidget_domain_siddomsid	forestsidget_domain_namedomain_nameget_forest_domain_nameforest_domain_namer   GUIDuuiduuid4invocation_idget_dsServiceName
dc_ntds_dnget_dnsHostNamedc_dnsHostNameget_behavior_versionbehavior_version	acct_passsamba generate_random_machine_passworddomain_dns_name	dnsdomainmynamesamname	server_dnntds_dnacct_dnlowerdnshostnameforest_dns_name	dnsforest	dn_existstopology_dnSPNsrid_manager_dndomaindns_zoneforestdns_zonebinary_encodeSCOPE_ONELEVELget_partitions_dndns_backendlenprintrealm	tmp_samdbr   DRSUAPI_DRS_INIT_SYNCDRSUAPI_DRS_PER_SYNCDRSUAPI_DRS_GET_ANCDRSUAPI_DRS_GET_NC_SIZEDRSUAPI_DRS_NEVER_SYNCEDreplica_flagsnever_reveal_sid
reveal_sidconnection_dnRODC	krbtgt_dn	managedby	subdomain	adminpasspartition_dndns_a_dndns_cname_dnforce_all_ips)ctxrW   rf   rA   rB   rX   netbios_namerY   domainmachinepassrZ   r   r^   r[   r\   r]   rg   eenumestrtopology_baseres_rid_managerexprres_domaindnss                           r7   r3   zDCJoinContext.__init__A   s    
	!! 1)!3/"	%%e&?&?&A&AFDW&WXXXCI#&111
!3 	@*CICJJz 	<<"//
;;CH 
 H6 QRRR [[00


 :;;;+
":+9+;+;*-)@ @ @CI 8"CH	(I3><<<<| 	( 	( 	(6LT4!$'''	( #)668899#)335566CI7799::CI7799::%ci&>&>&@&@AA

--//!$!;!;!=!= Ic$*,,&7&7884466 0022"7799"'CMM!B3LLCM	1133  	N%CJ#*,CKKDGJJJPSPXPXPXZ]ZgZghCM/#-?CKK>Ajjj#++VCK),)9)9););););S]]KCOI5577CMehkhssM}}]++ ' '03


MM"J"&!CJ.!CO33&)ooos}}EGCH "i..S^6K5L47K / A AO "1!34I!J1!MC3ckA3ckA58I#J\8]8]]	((s/A/1.1i.I.I.K.K48 ) : : $COO=!!Q&&"([\\\\"-M	$:$9:$89 %<= %=	>  $  "s   *&G G> G99G>c                 >   |r\	 | j                             |t          j        dg          }n# t          $ r Y d S w xY w|D ]}|                     |j        d           	 | j                             |           t          d|z             d S # t          $ r Y d S w xY w)NdnrR   rI   rJ   T	recursivez
Deleted %s)	rh   rl   rm   r   	Exceptiondel_noerrorr   deleter   )r   r   r   resrs        r7   r   zDCJoinContext.del_noerror   s     	6i&&Bc6HQUPV&WW    6 65555	IR   ,#$$$$$ 	 	 	DD	s   (- 
;; ,B 
BBc           
         | j                             | j                                         dt          j        | j                  z  ddg          }t          |          dk    rd S |st                      }|                    | j	                   	 |
                    | j	                   |                    | j                                                   t          d| j        z  t!                      || j	                  }|                    t          j        dd	g
          }|d         d	         d         |d         d         d         k    rt%          d| j        z            n#  Y nxY w|                     |d         j        d           |d                             dd          }|!|| _        |                     | j                   | j                             | j                                         dt          j        d| j        z            dt          j        d| j        z            dg           }|r"|                     |d         j        d           | j                             | j                                         dt          j        d| j        z            z  g           }|rIt%          dt          j        d| j        z            dt          j        d| j        z                      d S )NsAMAccountName=%smsDS-krbTgtLink	objectSIDrR   rU   rJ   r   rC   rD    tokenGroups)rI   rR   rJ   zNot removing account %s which looks like a Samba DC account matching the password we already have.  To override, remove secrets.ldb and secrets.tdbTr   msDS-KrbTgtLink)idxz(&(sAMAccountName=dns-%sz)(servicePrincipalName=zdns/%sz))z(sAMAccountName=%s)zNot removing account zU which looks like a Samba DNS service account but does not have servicePrincipalName=)rh   rl   rr   rm   r   r   r   r   guessrB   set_machine_accountset_kerberos_staterA   get_kerberos_stater   rf   r   rn   r0   r   r   getnew_krbtgt_dnr   r   )r   forcer   rA   machine_samdb	token_resr   s          r7   cleanup_old_accountsz"DCJoinContext.cleanup_old_accounts   s"   iCI$@$@$B$B*=@QRUR]@^@^*^&7%E  G G s88q==F 	9MMEKK9))#&111(()E)E)G)GHHH %+
*B3A3C3C27CF!D !D !D *00s~BWdVe0ff	Q<.q1!f[)!,- -) +\ -0K	+8 9 9 9-	 	A	T222FJJ0aJ88	  )COOC-...iCI$@$@$B$B$B # 1(SZ2G H H H H # 1(S_2L M M M M+O &(	  ) )
  	7OOCFIO666iCI$@$@$B$B*?#BST\_b_iTiBjBj*j%'  ) )  	S!/ $'#4X
5J#K#K#K#K#&#4X5O#P#P#P	#R S S S	S 	Ss   A2E) )E-c                    | j         s|                     |           | j        |                     | j                   | j        |                     | j                   |                     | j                   |                     | j        d           | j        r|                     | j                   | j        r|                     | j                   | j         r:d}t          j
        d| j        d|d| j        | j                  }t          j                    }t          j                    |_        |                    d	|t$          j                  }t          j                    }| j        |_        |                    ||t          j                  }|                    ||j        j                   t          j                    }| j        |_        |                    ||t          j                  }|                    ||j        j                   | j        r|                     | j                   | j        r|                     | j                   dS dS )
z$Remove any DNs from a previous join.)r   NTr   signncacn_ip_tcp:[]r   )r   r   r   r   r   r   r   r   r   r   lsarpcrf   rB   rA   ObjectAttributeQosInfosec_qosOpenPolicy2r   SEC_FLAG_MAXIMUM_ALLOWEDStringr   stringQueryTrustedDomainInfoByName!LSA_TRUSTED_DOMAIN_INFO_FULL_INFODeleteTrustedDomaininfo_exsidr   r   r   )r   r   binding_optionslsaconn
objectAttr
pol_handlenamerj   s           r7   cleanup_old_joinzDCJoinContext.cleanup_old_join  s)    } 	2$$5$111(OOC-...=$OOCM***$$$666? 	-OOCO,,, 	.OOC,---= 	F$Ojj#***ooo!V!$4 4G ,..J!$J ,,R-7-5-NP PJ :<<D)DK77
D#JoppD''
DL4DEEE:<<D0DK77
D#JoppD''
DL4DEEE< 	*OOCL))) 	.OOC,-----	. 	.r8   c                 t   | j         rt          d          | j                            | j                                        dt          j        | j                  z  g d          }t          |          dk    rt          d| j        z            d|d         v sd|d         v s
d	|d         v rt          d
| j        z            t          |d         d         d                   t          j        j        t          j        j        z  z  dk    rt          d| j        z            |d         j        | _        dS )z]confirm that the account is just a bare NT4 BDC or a member server, so can be safely promotedz Can not promote into a subdomainr   )r   userAccountControlserverReferenceBLrIDSetReferencesr   r   zcCould not find domain member account '%s' to promote to a DC, use 'samba-tool domain join' instead'r   r   r   zhAccount '%s' appears to be an active DC, use 'samba-tool domain join' if you must re-create this accountr   zZAccount %s is not a domain member or a bare NT4 BDC, use 'samba-tool domain join' instead'N)r   r   rh   rl   rr   rm   r   r   r   intr   r.   UF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTr   r_   r   r   s     r7   promote_possiblezDCJoinContext.promote_possibleJ  s   = 	@>???iCI$@$@$B$B*=@QRUR]@^@^*^%w%w%w  y y s88q==  B  EH  EP  P  Q  Q  QA&&*=Q*G*GK]adefagKgKg  G  JM  JU  U  V  V  VA+,Q/00EJ4[49J4V5W X[\] ]x{~  |G  G  H  H  H!!fir8   c                    	 | j                             |t          j        t          j        z  t          j        z            | _        nM# t          $ r%}t          d|d|j	        d                   d}~wt          $ r t          d|z            w xY w| j        j        !| j        j        dk    r| j        j        | _        | j        j        S )z(find a writeable DC for the given domain)r   flagsz*Failed to find a writeable DC for domain 'z':    Nz-Failed to find a writeable DC for domain '%s'r   )re   finddcr   NBT_SERVER_LDAPNBT_SERVER_DSNBT_SERVER_WRITABLE	cldap_retr&   r-   rp   r   client_siterX   pdc_dns_name)r   r   errors      r7   rk   zDCJoinContext.find_dc]  s    	YGNN&@SVYVg@gjm  kB  ABN  C  CCMM 	8 	8 	8, &
1 7 8 8 8 	Y 	Y 	YNQWWXXX	Y=$0S]5NRT5T5T}0CH}))s   AA 
B A22 Bc                     d }| j                             |t          j        t          j        z            }|j        |j        dk    r|j        }|S )N)addressr  r   )re   r  r   r  r	  r  )r   rf   rX   r  s       r7   ri   zDCJoinContext.find_dc_sitej  sV    GNN6),)<s?P)P # R R	 ,1F"1L1L(Dr8   c                     | j                             | j        t          j        dg          }d|d         v r!t          |d         d         d                   S t          j        j        S )NmsDS-Behavior-Versionr   r   )	rh   rl   rs   rm   rn   r   r   r.   DS_DOMAIN_FUNCTION_2000r  s     r7   r   z"DCJoinContext.get_behavior_versionr  s]    iCKs~NeMfgg"c!f,,s1v56q9::::55r8   c                     | j                             dt          j        dg          }t	          |d         d         d                   S )Nr   dnsHostNamer   r   )rh   rl   rm   rn   rq   r  s     r7   r   zDCJoinContext.get_dnsHostNamey  s>    iBcn]OTT3q6-(+,,,r8   c                 :   | j                                         }| j                             |t          j        dgdt          j        t          | j                                                             z            }t          |d         d         d                   S z9get netbios name of the domain from the partitions recordnETBIOSNamez	ncName=%s)rR   rI   rJ   rU   r   )rh   r   rl   rm   r   r   rq   rr   r   partitions_dnr   s      r7   r~   zDCJoinContext.get_domain_name}  s    	3355iM9KTaSb*58I#ciNjNjNlNlJmJm8n8n*n  p p3q6-(+,,,r8   c                 :   | j                                         }| j                             |t          j        dgdt          j        t          | j                                                             z            }t          |d         d         d                   S r  )rh   r   rl   rm   r   r   rq   rt   r  s      r7   r   z$DCJoinContext.get_forest_domain_name  s    	3355iM9KTaSb*58I#ciNgNgNiNiJjJj8k8k*k  m m3q6-(+,,,r8   c                     | j                             | j        g dt          j        | j                  t          j        t          j        j	        fz            }t          |d         j                  S )z7get the parent domain partition DN from parent DNS namez9(&(objectclass=crossRef)(dnsRoot=%s)(systemFlags:%s:=%u)))rR   rJ   rU   r   )rh   rl   ry   rm   r   parent_dnsdomainOID_COMPARATOR_ANDr   r.   SYSTEM_FLAG_CR_NTDS_DOMAINrq   r   r  s     r7   get_parent_partition_dnz%DCJoinContext.get_parent_partition_dn  sg    iCM*e # 1#2F G G # 6
8] _+_  ` ` 3q69~~r8   c                     | j                             dt          j        dg          }|d         d         d         }t	          | j                             d|                    S )zhget the SID of the connected user. Only works with w2k8 and later,
           so only used for RODC joinr   r   r   r   r   )rh   rl   rm   rn   r,   schema_format_value)r   r   binsids      r7   	get_mysidzDCJoinContext.get_mysid  sW     iBcn]OTTQ&q)#)77VLLMMMr8   c                     	 | j                             |t          j        g           }n8# t          j        $ r&}|j        \  }}|t          j        k    rY d}~dS  d}~ww xY wdS )zcheck if a DN existsr   NFT)rh   rl   rm   rn   ro   rp   ERR_NO_SUCH_OBJECT)r   r   r   e5r   r   s         r7   r   zDCJoinContext.dn_exists  sx    	)""#."KKCC| 	 	 	7LT4s---uuuuu		
 ts   '* AAAAc                 T   t          d| j        z             | j        dt          t          j        j        t          j        j        z            dd| j        z  d}| j        	                    |dg           | j        
                    | j        t          j        dg          }|d	         d         d	         | _        t          d
| j        z             t          j                    }t          j        | j        | j                  |_        t          j        | j        t          j        d          |d<   | j                            |           d| j        d| j        | _        t          d| j        d| j                   | j                            | j        | j                   dS )z#RODCs need a special krbtgt account	Adding %suserTRUEzkrbtgt for %s)r   objectclassuseraccountcontrolshowinadvancedviewonlydescriptionrodc_join:1:1samAccountNamer   r   zGot krbtgt_name=%sr   rM   
,CN=Users,z	Renaming z to N)r   r   rq   r   r.   UF_NORMAL_ACCOUNTUF_ACCOUNTDISABLEr   rh   addrl   rm   rn   krbtgt_nameMessageDnr   r   MessageElementFLAG_MOD_REPLACEmodifyrs   r   rename)r   recr   ms       r7   add_krbtgt_accountz DCJoinContext.add_krbtgt_account  s   kCM)***-!"%ej&B&+j&B'C #D #D&,*S[8: : 		cO,--- iCMP`Oabba&!1215"S_4555KMMvci--"1#-252FHY [  [
	36???CKKPS]]]C4E4EFGGG	(9:::::r8   c                     d}| j                                         dk    r|dz  }d| j        d|d}t          j        || j         | j                  | _        t          j        | j                  \  | _        | _        dS )z.make a DRSUAPI connection to the naming masterseal	   ,printr   r   r   N)	rB   	log_levelrf   r   rA   r   
drs_DsBinddrsuapi_handlebind_supported_extensions)r   r   binding_strings      r7   drsuapi_connectzDCJoinContext.drsuapi_connect  s}     6""x'O25***oooNoncfciHH>G>RSVS^>_>_;	S:::r8   c           	          t          | j        | j                  | _        t	          t                      dd| j        | j        dd          | _        | j        	                    | j                   dS )z2create a temporary samdb object for schema queries)schemadnNF)rF   rE   auto_connectrG   rB   global_schemaam_rodc)
r   r|   rw   
tmp_schemar   r   rA   rB   r   
set_schemar   s    r7   create_tmp_samdbzDCJoinContext.create_tmp_samdb  sr    
),8 8 8>+;+;TY*-)e&+- - - 	  00000r8   c                 x    t          j                    }| j                            |          |_        d|_        dS )z$build a DsReplicaAttributeCtr objectr  N)r   DsReplicaAttributer   get_attid_from_lDAPDisplayNameattid	value_ctr)r   attrname	attrvaluer   s       r7   build_DsReplicaAttributez&DCJoinContext.build_DsReplicaAttribute  s2    &((->>xHHr8   c                    | j         |                                  | j        |                                  g }|D ]}t          j                    }|d         |_        g }|D ]x}|dk    r	t          ||         t                    s
||         g}n||         }d |D             }| j                            | j        ||          }|	                    |           yt          j
                    }	t          |          |	_        ||	_        t          j                    }
||
_        |	|
_        t          j                    }|
|_        |	                    |            t          j                    }|d         |_        |j        }|dd         D ]}||_        |}| j                             | j        d|          \  }}|dk    r||j        t           j        k    r&t5          d|j        z             t7          d          |j        d         t:          j        k    r&t5          d	|j        z             t7          d          |d
k    r|j        dk    rt7          d|j        z            |j         j!        d         t:          j        k    rr|j         j"        #t5          d|j         j!        d         z             n4t5          d|j         j!        d         d|j         j"        j                   t7          d          |j         j        t           j        k    r+t5          d|j         j        z             t7          d          |j#        S )z,add a record via the DRSUAPI DsAddEntry callNr   c                 f    g | ].}t          |t                    r|                    d           n|/S )utf8)
isinstancerq   encode).0xs     r7   
<listcomp>z,DCJoinContext.DsAddEntry.<locals>.<listcomp>  s8    NNNqAs););BQXXf%%%NNNr8   r   r     z!DsAddEntry failed with dir_err %uzDsAddEntry failedz(DsAddEntry failed with status %s info %s   zexpected err_ver 1, got %uz.DsAddEntry failed with status %s, info omittedzDsAddEntry failed with status z info )$r   rI  r   rR  DsReplicaObjectIdentifierr   r^  listdsdb_DsReplicaAttributeappendDsReplicaAttributeCtrr   num_attributes
attributesDsReplicaObject
identifierattribute_ctrDsReplicaObjectListItemobjectDsAddEntryRequest2first_objectnext_object
DsAddEntryrF  dir_errDRSUAPI_DIRERR_OKr   RuntimeErrorextended_errr#   WERR_SUCCESSerr_vererr_datastatusrj   objects)r   recsr}  r=  idrJ   avrattrrn  rp  list_objectreq2prevolevelctrs                    r7   rt  zDCJoinContext.DsAddEntry  sC   ;!!!=   """ 	( 	(C244BIBEE 	$ 	$99!#a&$// QAAAANNANNN==cmQPQRRU#####9;;M+.u::M(',M$,..F "F#0F !9;;K!'KNN;'''')++#AJ  	 	A DDD{--c.@!TJJA::{g7779CKGHHH"#6777"f&999@CDTUVVV"#6777A::{a"#?#+#MNNN|"1%)<<<<$,JclNabcNdeffffEH[\]H^H^H^HKHYHfHfh i i i"#6777|#w'@@@9CL<PPQQQ"#6777{r8   c                    t          d| j        z             t          d| j        fddt          t          j        j                  fd| j        fg          }| j        | j	        | j        g}| j
        t          j        j        k    r!t          t          j        j                  |d<   | j
        t          j        j        k    r
| j        |d<   | j        rd| j        z  |d	<   | j        |d
<   d|d<   n{d| j        z  |d	<   | j
        t          j        j        k    r
| j        |d<   g |d<   |D ]&}|| j        v r|d                             |           'd|d<   t!          | j                  |d<   |S )z return the ntdsdsa object to addr)  r   )r,  nTDSDSAsystemFlagsdMDLocationr  zmsDS-HasDomainNCszCN=NTDS-DSA-RO,%sobjectCategoryzmsDS-HasFullReplicaNCs37optionszCN=NTDS-DSA,%szmsDS-HasMasterNCsHasMasterNCs1invocationId)r   r   r+   rq   r   r.   #SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETErw   rs   ry   r   r   DS_DOMAIN_FUNCTION_2008_R2r   ra   rh  r
   r   )r   r=  r`   ncs       r7   join_ntdsdsa_objzDCJoinContext.join_ntdsdsa_obj  s    	kCK'((( 3;&C
 NOOPCM*	, - - ;s}=5:#EEE+.uz/T+U+UC'(5:#EEE'*{C#$8 	>$7#-$GC !,/,<C()!C	NN$4s}$DC ! #uz'III+.+;'(')C 3 3)))'..r222 C	N"*3+<"="=C
r8   c                    |                                  }| j        r| j                            |dg           n:| j        r| j                            |dg           n|                     |g           | j                            | j        t          j	        dg          }t          j        | j                            d|d         d         d                             | _        dS )zadd the ntdsdsa objectrelax:0controlsr0  
objectGUIDr   r   N)r  rg   rh   r5  r   rt  rl   r   rm   rn   r   r   r"  	ntds_guid)r   r=  r   s      r7   join_add_ntdsdsazDCJoinContext.join_add_ntdsdsaH  s     ""$$! 	"IMM#M4444X 	"IMM#01111NNC5!!! iCKs~l^\\	#)"?"?cRSfUaNbcdNe"f"fggr8   c                    | j         rt          d| j         z             | j         d| j        | j        t          | j        t
          j        j        z            | j        d}| j	        t
          j        j
        k    r"t          t
          j        j                  |d<   n| j        rg |d<   | j        r| j        |d<   n| j        rg |d<   | j        r| j        |d<   n| j        rg |d<   | j        r| j        |d<   n| j        rg |d<   |rt!          |          |d<   | j        r~| j        | j         k    r%| j                            | j        | j                    | j                            t*          j                            | j        |t*          j                             n#d	}|d
g}| j                            ||           | j        r|                                  | j        rt          d| j        z             | j        dt          t
          j        j        t
          j        j        z  t
          j        j        z            | j        d}| j         r
| j         |d<   | j                            |           | j         r	d	| _!        d	S | j"        rq| #                                 dt+          j$        | j%                  z  }| j        &                    t*          j'        g | j        (                                |          | j%        f}dt+          j$        | j)                  z  }| j        &                    t*          j'        g | j        (                                |          | j)        f}||fD ]\  }}|| j*        vrtW          |          dk    rrt+          j                    }	|d         j,        |	_,        d}
| j-        rd}
t+          j.        | j"        t*          j/        |
          |	|
<   | j                            |	           | j0        Ct          d| j0        z             | j0        ddd| j1        d}| j                            |           | j         rt          d| j         z             t+          j                    }	t+          j2        | j        | j                   |	_,        tg          tW          | j4                            D ]=}| j4        |         5                    dt          | j!                            | j4        |<   >t+          j.        | j4        t*          j        d          |	d<   | j                            |	           t          d| j        z             	 | j        6                    dt+          j$        | j                  z  | j7        d| j                   nc# t*          j8        $ rQ}|j9        \  }}|t*          j:        k    r | j;        <                    | j        | j=        | j7                    Y d	}~nd	}~ww xY w| j        &                    | j         t*          j>        d!d"g#          }d!|d         v r't          |d         d!         d                   | _@        nd	| _@        t          t          jC        |d         d         d                   | _D        t          d$           t+          j                    }	t+          j2        | j        | j                   |	_,        t+          j.        t          | j                  t*          j        d%          |	d%<   | j                            |	           | jE        F                    d&          rt          jG        d'd(          | _H        | j        I                    t          t          d)          | jL        | jM        | jN        t          | jH        P                    d*                    Q                    d+          | j        d,                    }|D ]\  }}|t*          jR        k    sJ |d-         }t          d.|d-         z             |d/= |d0= t          t
          j        jS        t
          j        j        z            |d%<   	 | j                            |           # t*          j8        $ r%}|j9        \  }}|t*          jT        k    r Y d	}~d	}~ww xY wt          d1| jN        z             	 | j        6                    d2t+          j$        | jN                  z  | jH        d| j                   nf# t*          j8        $ rT}|j9        \  }}|t*          j:        k    r | j;        <                    d3| jN        z  | j=        | jH                    Y d	}~nd	}~ww xY w| j        &                    |t*          j>        d!g#          }d!|d         v r(t          |d         d!         d                   | _U        d	S d	| _U        d	S d	S )4z+add the various objects needed for the joinr)  computer)r   objectClassdisplaynamesamaccountnamer   r   zmsDS-SupportedEncryptionTypesr   zmsDS-NeverRevealGroupzmsDS-RevealOnDemandGroup	objectSidNr  r  rf   )r   r,  r  r  serverReferencerS   rT   r  r   zmsDS-NC-Replica-LocationszmsDS-NC-RO-Replica-LocationsnTDSConnectionr+  65)r   r,  enabledconnectionr  
fromServerzAdding SPNs to %sz	$NTDSGUIDservicePrincipalNamezSetting account password for %sz((&(objectClass=user)(sAMAccountName=%s))F)force_change_at_next_loginusername)account_namer   newpasswordzmsDS-KeyVersionNumberr   r   zEnabling accountr   BIND9_      zprovision_dns_add_samba.ldif	utf-16-ler]  )	DNSDOMAINDOMAINDNHOSTNAMEDNSPASS_B64DNSNAMEr   z#Adding DNS account %s with dns/ SPNclearTextPasswordisCriticalSystemObjectz#Setting account password for dns-%sz,(&(objectClass=user)(samAccountName=dns-%s))r   )Vr   r   r   rq   r   r   r.   r4  r   r   DS_DOMAIN_FUNCTION_2008ENC_ALL_TYPESr^   r   r   r   r
   r_   rh   r<  r;  rm   r7  	from_dictr:  r5  r   r?  r   SYSTEM_FLAG_CONFIG_ALLOW_RENAME%SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVEr  r   r  r   r  r   r   rl   r   r   r   r`   r   r   r   r9  FLAG_MOD_ADDr   r   r8  ranger   replacesetpasswordr   ro   rp   ERR_UNWILLING_TO_PERFORMre   set_passwordr   rn   r   key_version_numberr   r   rz   new_dc_account_sidr   
startswithgenerate_random_passworddnspass
parse_ldifr"   r   r   rs   r   r$   r_  decodeCHANGETYPE_NONEr3  ERR_ENTRY_ALREADY_EXISTSdns_key_version_number)r   specified_sidr=  r  r   r   forestpartzoner>  attrie2num_r   r~  
changetyper5   dns_acct_dnr   e3s                         r7   join_add_objectszDCJoinContext.join_add_objectsW  sl
   ; '	6++,,,k)"{"%+&)#*@5:C_*_&`&`"0 0C #uz'III7:5:;S7T7T344% :7934} &#&=K  % &#%K # 2/2/C+,,% 2/1+,~ 525..//% 524./ ;#+M#:#:K # 6&#+55I$$S%8#+FFF	  !6!6sy#sG[!\!\]]]] , ){H	cH555= 	%""$$$= 	+-...m'"5:#M#(:#S$T#(:#Q$R  S  S  #0 0C { 5),%&IMM#= 	 CMF; 	(  """ :C<McN`<a<aaDi&&S-?-/,/I,G,G,I,I26 ' 8 8 :=9KMF
 :C<McN`<a<aaDi&&S-?-/,/I,G,G,I,I26 ' 8 8 :=9KMF
  &v. ( (
ds{**t99>>A7:AD6Dx >=!0141A4I IAdGI$$Q'''(+ 11222'/%+!n. .C IMM#; 0	 %3444A6#)S[11AD3sx==)) S S!hqk11+s3=?Q?QRR(+(:38;>;O;Q)S )SA$% IQ 3ckABBB@	%%&P(+(9#+(F(F'G&)mAF/2{	 & < < < <
 < @ @ @7a#666$$#+1414 % @ @ @ @ @ @ @ @	@ )""3>*A*5*7 # 8 8C '#a&00),SV4K-LQ-O)P)P&&)-&%/0@03A{0CA0F&H &HC" $%%%A6#)S[11AD&)&8S=S9T9T9<9M9M'O 'OA"# IQ?%%h// 5	28cBBCK9''(9*Ec:d:dHKGJ{GJzJSTWT_TfTfgrTsTsJtJtJ{J{  }C  KD  KDFIo	;W ;W)X )X Y YD $(  
C!S%88888!$i;c$iGHHH +,01,/
0L05
0L1M -N -N()IMM#&&&&|    vHS!c::: ;:::: 7#*DEEE>	%%&T(+(9#*(E(E'F&)kAF/2{	 & < < < <
 < > > >7a#666$$(SZ2G1414 % > > > > > > > >	> )""3>*A)B # D DC&#a&00-0Q8O1PQR1S-T-T***-1***k5	2 5	2sL   AV W9(AW44W9a22b&b!!b&Ad e'A
e""e'c                    t          d| j        z             dt          | j                  dt          j        i}t          j        | j        |          }| j        dd| j	        z  | j
        | j        | j        | j        t          t          j        j        t          j        j        z            |d	}| j        t          j        j        k    rt          | j                  |d<   |                                 }|                     ||g          }t-          |          d	k    rt/          d
          |d         j        | _        t          d           | j                            | j        t9          j        d          | j        t<          j        t<          j                    t          d           | j                            | j!        t9          j        d          | j        t<          j        t<          j                    dS )zLadd the various objects needed for the join, for subdomains post replicationr)  SubdomainAdmins-)name_mapcrossRefzCN=Cross-Ref,%s)	r   r,  r  nCNamer  dnsRoottrustParentr  ntSecurityDescriptorr  rc  z"Expected 2 objects from DsAddEntryr  zReplicating partition DN$00000000-0000-0000-0000-000000000000)exopr   zReplicating NTDS DNN)"r   r   rq   r|   r   DOMAIN_RID_ADMINSr   +get_paritions_crossref_subdomain_descriptorr}   rw   rs   r   r   parent_partition_dnr   r.   SYSTEM_FLAG_CR_NTDS_NCr  r   r   r  rt  r   r0   guidr  repl	replicater   r   r   DRSUAPI_EXOP_REPL_OBJDRSUAPI_DRS_WRIT_REPr   )r   r  	sd_binaryr=  rec2r}  s         r7   join_add_objects2zDCJoinContext.join_add_objects2.  s    	kC,,---%#cj////8C]C]'^_J3=cklll	"%/#-?k?}2uz@%*Bgghh$-

 

 5:#EEE+.s/C+D+DC'(##%%..#t--w<<1!"FGGG
()))3+9%KLL= ' =)0)E	 	 	G 	G 	G 	#$$$3;9%KLL= ' =)0)E	 	 	G 	G 	G 	G 	Gr8   c                 x   t          d           | j        j        }t          | j        t                      fi d|d| j        dt          d| j        d| j	        d| j
        d| j        d	| j        d
| j        d| j        d| j        d| j        d| j        ddd| j        d| j        d| j        d| j        d| j        d| j        d| j        d| j        dd}t          d|j        z             |j        | _        |j        | _        |j        | _        |j        | _        | j        | j        _        dS )Provision the local SAM.zCalling bare provisionsmbconfrY   
samdb_fillr   rootdndomaindnrK  configdnserverdnr   hostname	domainsidr   
serverrole"active directory domain controllersitenamerB   ntdsguidrZ   r   r[   r\   r]   
batch_modeTzProvision OK for domain DN %sN)r   rB   
configfiler   rW   r   rY   r   r   ru   rs   rw   ry   r   r   r   r|   r   rX   r  rZ   r   r[   r\   r]   r  rh   local_samdbpathsnamesr}   )r   r  presults      r7   join_provisionzDCJoinContext.join_provisionY  s    	&'''&#CJ(8(8 - - -'' -&)mm-@H-PSPYPY-#&;;-9<- &)]]- >A]]- &)]]	- <???	-
 &)ZZ-
 <?::- ),- CgBf- &)XX- 36&&- DG==- '*mm- BE- /2.C.C- +.*;*;- 03/E/E- (,t- 	-0@@AAA!-!*!-	!-	 "m	r8   c                 <   t          d           t          | j        j        dgt	                      | j        j        d          | _        | j                            t          | j	                             | j        | _        | j
                            d           | j                            | j        t          j        dgddg	          }d
|d         vr$t!          d| j        d| j        j                  	 t          t#          j        t          j        | j        |d         d         d                             d                                        d                              | j        _        n2# t0          $ r% t!          d|d         d         d         z            w xY w| j
                            d| j        j        z             | j
                            d           t3          | j        j        t	                      | j                  }t9          | j        || j
        | j        | j        t:          | j        t>          | j         d| j        | j        j!        | j        j"        | j#        | j$                   t          d| j        j%        z             dS )r  zReconnecting to local samdbz#transaction_index_cache_size:200000F)rE   r  rF   rB   rM  zFinding domain GUID from ncNamencNamezextended_dn:1:1zreveal_internals:0)rR   rI   rJ   r  r  r   z*Can't find naming context on partition DN z in r]  r   z3Can't find GUID in naming master on partition DN %szGot domain GUID %szCalling own domain provisionrF   rB   r  )
dom_for_fun_levelrY   r  r   r  rB   hostiphostip6r   r   zProvision OK for domain %sN)&r   r   r  rE   r   rB   rh   set_invocation_idrq   r   rW   rj   rl   r   rm   rn   r0   r   r   r8  r  get_extended_componentr  
domainguidKeyErrorr   r  secretsr   r   rY   r   r   r  r  r   r   r   )r   r   secrets_ldbs      r7   join_provision_own_domainz'DCJoinContext.join_provision_own_domainv  s    	+,,,co1B"D'5'7'7 _/(-/ / /	 		##C(9$:$:;;;)
9:::o$$#*:#.YaXb/@BV.W % Y Y 3q6!!!/Z]ZjZjZjlolulyly"z{{{	o#&ty	3q6(CSTUCVC]C]^dCeCe1f1f1}1}  E  2F  2F  (G  (G  $H  $HCI   	o 	o 	o!"WZ]^_Z`aiZjklZm"mnnn	o 	
,sy/CCDDD
6777#)+.:J:JsvVVVsz39ci)@!$>#&==a&)939CT#&?cm	M 	M 	M 	M 	*SY-@@AAAAAs   ;A;E7 7/F&c                 h    t          j        d| j        d|d| j        || j        | j                  S z2Creates a new DRS object for managing replicationsr   r   r   )r   drs_Replicaterf   rB   r  r   )r   
repl_credsr   s      r7   create_replicatorzDCJoinContext.create_replicator  s?    &&),___E
COS5FH H 	Hr8   c                 b
   | j                             d           | j                                         	 t	          j        | j                                                  }| j        .t          d           t	          j        t          j                  }n| j        }| j        rwt                      }|                    | j                   |                    t"                     |                    | j                   |                    | j                   n| j        }d}| j                                        dk    r|dz  }|                     ||          }|                    | j        ||d| j        | j                   |                    | j        ||| j        | j        	           | j        s0t          d
           	 |                    | j        ||| j        | j        t          j         z  	           nN# tB          $ rA}|j"        d         tF          j$        k    r| j         %                    d           n Y d}~nd}~ww xY w| j        t          j         z  s	 |                    | j        ||| j        | j        	           n\# tB          $ rO}|j"        d         tF          j$        k    r.| j        t          j         z  r| j         %                    d            d}~ww xY wt          d           | j&        | j'        fD ]N}|| j(        v rCt          dtS          |          z             |                    |||| j        | j        	           O| j        rS|                    | j*        ||t          j+        d           |                    | j,        ||t          j+        d           n| j-        	 |                    | j-        ||t          j.                   n^# t^          j0        $ rL}|j"        \  }	}
|	t          j1        k    r't          d| j2        z             t          d           n Y d}~nd}~ww xY w|| _3        || _4        || _5        | j                             d           | j        t          j         z  s%| j        6                    tn          j8        d           | j        9                                 | j        6                    tn          j8        d           | j                             d           n#  | j        :                                  xY w| ;                                 dS )zReplicate the SAM.zStarting replicationNzUsing DS_BIND_GUID_W2K3rA  rB  rC  T)schemarodcr   )r  r   z;Replicating critical objects from the base DN of the domainr   zFirst pass of replication with DRSUAPI_DRS_CRITICAL_ONLY not possible due to a missing parent object.  This is typical of a Samba 4.5 or earlier server. We will replicate the all objects instead.zReplication with DRSUAPI_DRS_CRITICAL_ONLY failed due to a missing parent object.  This may be a Samba 4.5 or earlier server and is not compatible with --critical-onlyz5Done with always replicated NC (base, config, schema)zReplicating %s)r  r  )r  zdWARNING: Unable to replicate own RID Set, as server %s (the server we joined) is not the RID Master.zxNOTE: This is normal and expected, Samba will be able to create users after it contacts the RID Master at first startup.z1Committing SAM database - this may take some timer  zCommitted SAM database)<rW   rj   r  transaction_startr   r   rh   get_invocation_idr  r   r   DRSUAPI_DS_BIND_GUID_W2K3r   r   r   rB   r   r   set_usernamer   r  r   rA   rD  r  r  rw   r   ry   r   rs   domain_replica_flagsDRSUAPI_DRS_CRITICAL_ONLYr%   rp   r#   WERR_DS_DRA_MISSING_PARENTwarningr   r   r`   rq   r   DRSUAPI_EXOP_REPL_SECRETr   r   DRSUAPI_EXOP_FSMO_RID_ALLOCr   DsExtendedErrorDRSUAPI_EXOP_ERR_FSMO_NOT_OWNERrf   r  source_dsa_invocation_iddestination_dsa_guidset_opaque_integerr.   0DSDB_FULL_JOIN_REPLICATION_COMPLETED_OPAQUE_NAMEtransaction_committransaction_cancelrefresh_ldb_connection)r   r(  r)  r  r   r  r   r  e1r   r   s              r7   join_replicatezDCJoinContext.join_replicate  s    	
.///
 	))+++F	6'+y1L1L1N1N'O'O$}$/000'+y1R'S'S$$'*}$x '(]]
  (((--.?@@@''444''6666 Y
$Ov!!Q&&8+((_EEDNN3=*B/38),):  < < < NN3=*B/ch),):  < < < = . STTTNN3;0H#7ch141IGLm1m # o o o o # 
 
 
vayF$EEE
** ,X Y Y Y Y Y Y Y Y Y
* /'2SS s{4L';#(585M ' O O O O '   6!9(III3g6WW JJ.. 0\ ] ] ]  IJJJ
 )3+=> D D$$*c"gg6777NN2'?#7ch141B # D D D x s{,D3$+$D4  Q Q Q s02J3$+$D4  Q Q Q Q #/
NN3#57O#7(/(K # M M M M ,   #%7LT4wFFF  E  HK  HR  R  S  S  S  Y  Z  Z  Z  Z Z  Z  Z  Z  Z	 CH+CC(';C$JOOOPPP +g.OO 62243h346 6 6O..000O..t/d/02 2 2JOO45555'	O..000* 	""$$$$$s   FS< 6G= <S< =
I7I>S< IS<  )J
 	S< 

K#A
KK##CS< 4(O S< P8,AP3.S< 3P882S< <Tc                    	 | j                             t          j        g            d S # t          j        $ r}|j        \  }}|t          j        k    rYd|v sd|v rQ| j                            d           t          d| j
        z  t                      | j        | j                  | _         nt          |          Y d }~d S d }~ww xY w)NrH   !NT_STATUS_CONNECTION_DISCONNECTEDNT_STATUS_CONNECTION_RESETz)LDB connection disconnected. ReconnectingrC   rD   )rh   rl   rm   rn   ro   rp   ERR_OPERATIONS_ERRORrW   r#  r   rf   r   rA   rB   r0   )r   r   r   r   s       r7   r.  z$DCJoinContext.refresh_ldb_connection>  s    	,I3><<<<<| 	, 	, 	,6LT4 0004<<-55
""#NOOO!kCJ&>/=/?/?.1iCFD D D		 &d+++	 						,s   &* CBCCc                 Z   t          j                    }t          j                    |_        t	          |          |j        _        t          j        d          |j        _        t          j
        d          |j        _        | j        |_        t	          | j                  d| j        |_        t           j        t           j        z  |_        | j        s|xj        t           j        z  c_        | j         |                                  | j                             | j        d|           d S )Nr  zS-0-0z._msdcs.r  )r   DsReplicaUpdateRefsRequest1re  naming_contextrq   r   r   r   r  r   rz   r   r  dest_dsa_guidr   dest_dsa_dns_nameDRSUAPI_DRS_ADD_REFDRSUAPI_DRS_DEL_REFr  r   r  rI  DsReplicaUpdateRefsrF  )r   r   r   s      r7   send_DsReplicaUpdateRefsz&DCJoinContext.send_DsReplicaUpdateRefsP  s    /11"<>>!"gg $	*P Q Q'/88-03CM0B0B0B0BCMMR/'2MM	x 	6II55II;!!!''(:AqAAAAAr8   c                 l	   t           j        }t           j        t           j        z  }| j        }d| j        z  }| j        }t          | j                  }|d|}t          j
        | j        | j                  }| j                            dt          |          ||fz             d}	t          j         d| j        d|	d| j        | j                  }
d}t%          j        | j                  }t+          j                    }| j        |_        t+          j        d	t          | j                  t*          j        fz            |_        	 |
                    |d
| j        ||dt<          j        |dd
  
        \  }}n4# t@          $ r'}|j!        d
         tD          j#        k    rd}Y d}~nd}~ww xY w|r|j$        D ]}|j%        D ]}|j&        t<          j'        k    s|j&        t<          j(        k    rpt          j)                    }||_$        	 |
*                    |d
| j        ||d|           h# t@          $ r'}|j!        d
         tD          j#        k    rn Y d}~d}~ww xY w|D ]}|+                    d          dk    r3| j                            d|d|d|           tY          |          }n2| j                            d|d|d|           t[          |          }t          j)                    }||_$        |
*                    |d
| j        |||d           t          |          d
k    rlt]          j/        | j        | j0                  }| j        1                    |d||          \  | _2        }|3                    | j2        |dt*          j4        t*          j5        z  z  g           | j                            d|d|d|           t          j)                    }tm          |          }||_$        |
*                    |d
| j        |||d           t]          j/        | j        | j7                  }| j        1                    |d||          \  | _8        }|3                    | j8        |dt*          j4        t*          j5        z  z  g           | j                            d           dS )a  Remotely Add a DNS record to the target DC.  We assume that if we
           replicate DNS that the server holds the DNS roles and can accept
           updates.

           This avoids issues getting replication going after the DC
           first starts as the rest of the domain does not have to
           wait for samba_dnsupdate to run successfully.

           Specifically, we add the records implied by the DsReplicaUpdateRefs
           call above.

           We do not just run samba_dnsupdate as we want to strictly
           operate against the DC we just joined:
            - We do not want to query another DNS server
            - We do not want to obtain a Kerberos ticket
              (as the KDC we select may not be the DC we just joined,
              and so may not be in sync with the password we just set)
            - We do not wish to set the _ldap records until we have started
            - We do not wish to use NTLM (the --use-samba-tool mode forces
              NTLM)

        z	_msdcs.%srN   z&Adding %d remote DNS records for %s.%sr   r   r   r   Tz%s-%dr   NF:zAdding DNS AAAA record z for IPv6 IP: zAdding DNS A record z for IPv4 IP: )dns_partitionzsd_flags:1:%dr  zAdding DNS CNAME record z for z_All other DNS records (like _ldap SRV records) will be created samba_dnsupdate on first startup)9r   DNS_CLIENT_VERSION_LONGHORNDNS_RPC_VIEW_AUTHORITY_DATADNS_RPC_VIEW_NO_CHILDRENr   r   r   rq   r  r   interface_ipsrB   r   rW   rj   r   rf   rA   r'   SDUtilsrh   r   r   r  	owner_sidrz   r|   DOMAIN_RID_DCS	group_sidDnssrvEnumRecords2r   DNS_TYPE_ALLr%   rp   r#   "WERR_DNS_ERROR_NAME_DOES_NOT_EXISTr=  recordswType
DNS_TYPE_ADNS_TYPE_AAAADNS_RPC_RECORD_BUFDnssrvUpdateRecord2findr)   r(   rm   r8  r   
dns_lookupr   modify_sd_on_dnSECINFO_OWNERSECINFO_GROUPr*   r   r   )r   client_versionselect_flagsr  
msdcs_zoner   msdcs_cnamecname_targetIPsr   dns_conn
name_found	sd_helperchange_owner_sdbuflenr   r   r=  recorddel_rec_bufIPadd_rec_bufdomaindns_zone_dnldap_recordforestdns_zone_dns                            r7   join_add_dns_recordsz"DCJoinContext.join_add_dns_recordsa  s   0 #> <./ } 3=0
z#-(("&$$-!#&#*;<<
@S4./ 	0 	0 	0 !&&


OOO'\'*vsy: : 
$SY//	"-//$'$:!$,$4W69#*oo6>6M6O6O %P %P!
	#--n./.1j.2.2.2.2.?.:.2.2	4 	4 VSS  	# 	# 	#vayFEEE"
	#  	&w & &!k & &F|t66|t'999&/&B&D&D*0&$889:9<9=9=9=9DF F F F  + & & & vayF,UUU $ % !%& :&(  	/ 	/Bwws||r!!
#'44rr!3 4 4 4 nn
#'44rr!3 4 4 4bkk $688K!KO(()*),)-)-)4)-/ / / / HHqLL #sy#2D E E)&&$$$'=5F ' H H (S\;
 %%clO0?3;3I5=5K4L1M 0N & O O O JOOO*{{JJJF G G G $688Kl++C!KO(()*),)3)4)4)-/ / / !$sy#2D E E)&&+++zz'J5F ' H H ,S{
 %%c&60?3;3I5=5K4L1M 0N & O O O
 	
 K 	L 	L 	L 	L 	Ls0   0E9 9
F*F%%F* H''
I1IIc           	          | j         | j        fD ]i}|| j        v r^| j                            dt          |          z             | j                            || j        | j	        | j
        | j        d           jd S )Nz!Replicating new DNS records in %sF)r  r   	full_sync)r   r   r`   rW   rj   rq   r  r  r(  r  r   r   )r   r  s     r7   join_replicate_new_dns_recordsz,DCJoinContext.join_replicate_new_dns_records  s    %s'9: 	4 	4BS[  
 Cs2ww OPPP""2s'C#&=sx141B-2 # 4 4 4	4 	4r8   c                    | j                             d           | j        D ]}|                     |           | j        rt          d           | j                            t          | j	                             | j        
                    d| j                   t          j                    }t          j        | j        d| j        z            |_        t          j        t%          | j	                  t          j        d          |d<   | j                            |           | j                            |j        dd           | j                             d           t          j                    }t          j        | j        d          |_        t          j        d	t          j        d
          |d
<   | j        }t          j        dt          |          z  t          j        d          |d<   | j                            |           | j        rdS t1          | j        j        t7                      | j                  }| j                             d           t;          || j        | j        | j         | j!        | j"        | j#        | j$        | j%        	  	         | j&        '                    d          rNtQ          | j        || j)        | j        | j        | j         | j&        | j*        | j        | j+        | j,                   dS dS )z=Finalise the join, mark us synchronised and setup secrets db.z=Sending DsReplicaUpdateRefs for all the replicated partitionszSetting RODC invocationIddomainFunctionalityz%sr  r   (Setting isSynchronized and dsServiceName@ROOTDSEr+  isSynchronized	<GUID=%s>dsServiceNameNr	  zSetting up secrets database)r   r   r   netbiosnamer  r   secure_channel_typer  r  )r   r  os_levelrY   r  )-rW   rj   r`   r=  r   r   r  r  rq   r   r*  r   rm   r7  r8  r   r   r9  r
   r:  r;  "set_attribute_replmetadata_versionr  r   r   r  r  r   rB   r   r   r   r   r   r|   r   rv  r  r   r  r!   r  r  rY   r  )r   r  r>  r  r  s        r7   join_finalisezDCJoinContext.join_finalise  s    	
WXXX+ 	- 	-B((,,,,8 	B-...O--c#2C.D.DEEEO../D/2/CE E EA6#/4#++=>>AD # 28C<M3N3N363G3A!C !CAn O""1%%% O>>qt?M?@B B B 	
BCCCKMMvcoz22!09MO_``
} /c$ii0G030DoW W/q!!!= 	F#)+.:J:JsvVVV
5666K"%)&)m(+
&)j(+030G/2/E	G 	G 	G 	G ?%%h// 	KCO[Isy#&#*(+$'K#:N&)m/2/IK K K K K K	K 	Kr8   c                 z	   t          d| j        z             d}t          j        d| j        d|d| j        | j                  }t          j                    }t          j                    |_        |	                    d
                    d          |t          j                  }t          j                    }| j        |j        _        | j        |j        _        | j        |_        t          j        t          j        z  |_        t          j        |_        t          j        |_        	 t          j                    }| j        |_        |                    ||t          j                  }t          d| j        d|j        j        d	           |                    ||j        j                   n# t@          $ r Y nw xY wtC          | j"        #                    d
                    }tI          j%                    }	tM          |          |	_'        ||	_(        tI          j)                    }
tU          j+        tY          t[          j-                                        |
_.        t          j/        |
_0        |	|
_1        tI          j2                    }d|_3        |
g|_4        tI          j5                    }d|_3        ||_6        tI          j7                    }dgdz  }tq          d          D ]}ts          j:        dd          ||<   ||_;        ||_<        ||_=        t}          |          }t          |j@        |          }t          jA                    }tM          |          |_'        tC          |          |_B        t          jC                    }||_D        |E                    |||t          jF                  }d| jG        d| jH        dt          |j                  t          |j                  t          |j                  | jJ        | jG        t}          |          t}          |          t}          | jK                  d
}| jL        M                    |           d| jJ        d| jH        dt          tT          jN        jO                  | j"        #                    d
          d| jJ        z  d}| jL        M                    |           dS )zprovision the local SAM.z"Setup domain trusts with server %sr   z	ncacn_np:r   r   zutf-8zRemoving old trust record for  (SID )r  r  rd  i   r   r  zcn=z,cn=system,trustedDomain)
r   r,  	trustTypetrustAttributestrustDirectionflatnametrustPartnertrustAuthIncomingtrustAuthOutgoingsecurityIdentifierz$,cn=users,r*  rL   )r   r,  r   r  r1  N)Pr   rf   r   r   rB   rA   r   r   r   r   r  r   r   TrustDomainInfoInfoExr   r   r   r   r|   r   LSA_TRUST_DIRECTION_INBOUNDLSA_TRUST_DIRECTION_OUTBOUNDtrust_directionLSA_TRUST_TYPE_UPLEVEL
trust_type!LSA_TRUST_ATTRIBUTE_WITHIN_FORESTtrust_attributesr   r   r   r   r   rw  r	   trustdom_passr_  r   AuthInfoClearr   sizepasswordAuthenticationInformationr   unix2nttimer   timeLastUpdateTimeTRUST_AUTH_TYPE_CLEARAuthTypeAuthInfoAuthenticationInformationArraycountarraytrustAuthInOutBlobcurrenttrustDomainPasswordsr  randomrandint
confounderoutgoingincomingr
   r   session_key	DATA_BUF2dataTrustDomainInfoAuthInfoInternal	auth_blobCreateTrustedDomainEx2SEC_STD_DELETEr   rs   rq   r   r}   r  r5  r.   UF_INTERDOMAIN_TRUST_ACCOUNT)r   r   r   r   r   rj   oldnameoldinfopassword_blobclear_value clear_authentication_information authentication_information_arrayr  	trustpassr  r  trustpass_blobencrypted_trustpassr  	auth_infotrustdom_handler=  s                         r7   join_setup_trustszDCJoinContext.join_setup_trustsK  sP    	2SZ?@@@**#***oooN VSY0 0 (**
 []]
((7););)3X5VX X
 (**"%-#&? :">Aaa4 # E	jllG ]GN:::w;>;`b bGEPWP_PcPcPcdeee''
GO4GHHHH 	 	 	D	 -S->-E-Ek-R-RSS,..}--,+3+M+O+O(:?:KCPTPYP[P[L\L\:]:](7474M(14?(1+3+R+T+T(12(.2R1S(..00;133	S3Y
s 	3 	3A"N1c22JqMM)	%	%	!),,-g.A>RRMOO	011	-.ABB	799	'	!889=9B9A9PR R +.---E*T_--"4#899!$"677.M!)(!3!3!)(!3!3"*3="9"9
 
 	C     +.*@*@*@#++N!"%ej&M"N"N!$!2!9!9+!F!F#c&<<
 
 	C     s   'BF- -
F:9F:c                    | j         | j        g| _        | j        | j         | j        g| _        | j        r#| j        dk    r| xj        | j        gz  c_        d S | j        s{| xj        | j        gz  c_        | j        dk    r\| xj        | j        gz  c_        | xj        | j        gz  c_        | xj        | j        gz  c_        | xj        | j        gz  c_        d S d S d S )NrV   )	ry   rw   r`   rs   ra   r   r   r   r   rQ  s    r7   build_nc_listszDCJoinContext.build_nc_lists  s    }cm4KF= 
	9S_66!3 44 	9KKCK=(KK&(( 233 233  S%7$88    S%7$88    	9 	9 )(r8   c                    |                                   | j        r|                                  n|                                  	 |                                  |                                  |                                  | j        r<|                                  | 	                                 | 
                                 | j        dk    r(|                                  |                                  |                                  d S #  	 t          d           n# t           $ r Y nw xY w|                                  |                                   xY w)NrV   zJoin failed - cleaning up)r  r^   r  r   r  r  r0  r   r  r  r  r   rj  rm  ry  r   IOErrorr.  rQ  s    r7   do_joinzDCJoinContext.do_join  ss    	#  """"  """	  """      } (%%'''--///%%'''&((((***22444
	12222   
 &&(((  """s1   CD ED! E!
D.+E-D..,E)NNNNNNNNNFNFFNNN)FN)'r9   r:   r;   __doc__r3   r   r   r   r  rk   ri   r   r   r~   r   r   r$  r   r?  rI  rR  rZ  rt  r  r  r  r  r  r  r  r0  r.  r=  rj  rm  ry  r  r  r   r8   r7   r?   r?   >   s       JN;?@D;@#$($(U" U" U" U"n   3S 3S 3S 3Sj-. -. -. -.^( ( (&* * *  6 6 6- - -- - -- - -  N N N	 	 	; ; ;:` ` `1 1 1  A A AF) ) )Vh h hU2 U2 U2 U2n)G )G )GV, , ,:+B +B +BZH H HS% S% S%j, , ,$B B B"WL WL WLr4 4 4FK FK FKPc! c! c!J9 9 9*         r8   r?   Fc                    t          | ||||||||	|
|||||          }|                    d|j                   |                     d|j        z             |                    d|j                   |                     d|j        z             d|j        d|j        |_        d|j        d	t          j
        d
dt          j        z  dt          j        z  dt          j        z  dt          j        z  g|_        d|j        d	t          j        d
|_        |                                }d|z  }||_        t(          j        j        t(          j        j        z  t(          j        j        z  |_        |j                            d|j        z  d|j        z  g           d|j        z  |_        t>          j         |_!        d|_"        |xj#        tH          j%        tH          j&        z  z  c_#        |j#        |_'        |r|xj'        tH          j(        z  c_'        |)                                 |                     d|j        d|j        d           dS )zJoin as a RODC.r\   r]   	workgroupworkgroup is %sr   realm is %sz
CN=krbtgt_r2  z<SID=r  >z<SID=%s>zRestrictedKrbHost/%szCN=RODC Connection (FRS),%sTJoined domain r{  z) as an RODCN)*r?   setr   rj   r   r   rs   r   r|   r   DOMAIN_RID_RODC_DENYSID_BUILTIN_ADMINISTRATORSSID_BUILTIN_SERVER_OPERATORSSID_BUILTIN_BACKUP_OPERATORSSID_BUILTIN_ACCOUNT_OPERATORSr   DOMAIN_RID_RODC_ALLOWr   r$  r   r   r.   r   )UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONUF_PARTIAL_SECRETS_ACCOUNTr   r   extendr   r   r   r   SEC_CHAN_RODCrv  r   r   r   %DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING$DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIPr   r!  r  )rW   rf   rA   rB   rX   r   rY   r   domain_critical_onlyr   rZ   r   r^   r[   r\   r]   r   mysidadmin_dns                      r7   	join_RODCr    sO    r4!6;	;(*;&3+=	? ? ?C FF;(((
KK!CO3444FF7CI
KK	)****25***ckkJCMM X%B%B%BCX88X::X::X;;=C '*jjj(2P2P2PQCNMMOOEE!HCM#jE#jRS#jCDC HOO+cj8+co=? @ @ @ 6CC"0CCH'G!FG H"0C F  G$EE  KKMMM
KKK#///3:::VWWWWWr8   c                    t          | ||||||||	|
|||||          }|                    d|j                   |                     d|j        z             |                    d|j                   |                     d|j        z             t
          j        j        t
          j        j        z  |_	        |j
                            d|j        z             t          j        |_        |xj        t"          j        t"          j        z  z  c_        |j        |_        |r|xj        t"          j        z  c_        |                                 |                     d|j        d|j        d	           d
S )zJoin as a DC.r  r  r  r   r  z1E3514235-4B06-11D1-AB04-00C04FC2DCD2/$NTDSGUID/%sr  r{  z	) as a DCN)r?   r  r   rj   r   r   r.   r  UF_TRUSTED_FOR_DELEGATIONr   r   rh  r   r   SEC_CHAN_BDCrv  r   r   r  !DRSUAPI_DRS_FULL_SYNC_IN_PROGRESSr   r!  r  r|   )rW   rf   rA   rB   rX   r   rY   r   r  r   rZ   r   r^   r[   r\   r]   r   s                    r7   join_DCr     sc    r4!6;	;(*;&3+=	? ? ?C FF;(((
KK!CO3444FF7CI
KK	)***"Z?%*BffCHOOG#-WXXX"/C'6!CD E"0C F  G$EE  KKMMM
KKKs


STTTTTr8   rV   c
                    t          | |||||||||	
  
        }
|                    d|
j                   |                     d|
j        z             |                    d|
j                   |                     d|
j        z             |
                                 |                     d|
j        d|
j        d           |
S )	z%Creates a local clone of a remote DC.)rY   r   r   include_secretsr\   r]   r  r  r   r  zCloned domain r{  r|  )DCCloneContextr  r   rj   r   r  r|   )rW   rf   rA   rB   rY   r   r  r   r\   r]   r   s              r7   
join_cloner  B  s    
 i &K)8'4,>	@ @ @C FF;(((
KK!CO3444FF7CI
KK	)***KKMMM
KKKs


KLLLJr8   c                   8     e Zd ZdZ	 	 	 	 d fd	Zd Zd Z xZS )r  zClones a remote DC.NFc                    t          t          |                               ||||||||	|
	  	         d | _        d | _        d | _        | j                            d          d         | _        d | _	        d | _
        | j                                        | _        | xj        t          j        t          j        z  z  c_        |s| xj        t          j        z  c_        | j        | _        d S )N)rY   r   r   r\   r]   rN   r   )r2   r  r3   r   r   r   rf   splitr   r  r   rh   get_ntds_GUIDremote_dc_ntds_guidr   r   r  r  r  r   )r   rW   rf   rA   rB   rY   r   r   r  r\   r]   r6   s              r7   r3   zDCCloneContext.__init__[  s     	nc""++FFE26?8C:G?Q	 	, 	S 	S 	S Z%%c**1-
! #&)"9"9";";g:%GH 	I 	O!NN#&#4   r8   c                    | j                             d           t          j                    }t          j        | j        d          |_        t          j        dt          j        d          |d<   | j	        }t          j        dt          |          z  t          j        d          |d<   | j                            |           d S )Nrp  rq  r+  rr  rs  rt  )rW   rj   rm   r7  r8  r  r   r9  r:  r  rq   r;  )r   r>  r  s      r7   ry  zDCCloneContext.join_finalisev  s    
BCCCKMMvcoz22!09M1AC C
 & /c$ii0G030D0?A A/ 	q!!!!!r8   c                     |                                   |                                  |                                  |                                  d S r  )r  r  r0  ry  rQ  s    r7   r  zDCCloneContext.do_join  sR     	r8   )
NNNNNNNFNN)r9   r:   r;   r  r3   ry  r  r<   r=   s   @r7   r  r  X  sm        ?C:>6:$(5 5 5 5 5 56" " "      r8   r  c                   B     e Zd ZdZ	 	 	 d	 fd	Zd Zd Zd Zd Z xZ	S )
DCCloneAndRenameContextz6Clones a remote DC, renaming the domain along the way.NTc                     t          t          |                               ||||||	|
||	  	         || _        || _        || _        d S )N)rY   r   r   r  r\   )r2   r  r3   new_base_dnnew_domain_name	new_realm)r   r  r  r  rW   rf   rA   rB   rY   r   r   r  r\   r6   s                r7   r3   z DCCloneAndRenameContext.__init__  sc     	%s++44VVUB?H<BALETCP 	5 	R 	R 	R &-!r8   c           	          d| j         d|d}t          j        || j        || j        | j        | j        | j                  S r  )rf   r   drs_ReplicateRenamerrB   r  r   rs   r  )r   r  r   binding_strs       r7   r  z)DCCloneAndRenameContext.create_replicator  sN      03zzz???K-k36:.1o.1.?.1k3?L L 	Lr8   c                     t          j                    \  }}|                    d|           t          j                            |          }t          j        |           |S )z?Creates a non-global LoadParm based on the global LP's settingsF)filename_for_non_global_lp)tempfilemkstempdumpr   paramLoadParmosremove)r   	global_lpfdtmp_filelocal_lps        r7   create_non_global_lpz,DCCloneAndRenameContext.create_non_global_lp  sW      '))Huh''';''8'LL
	(r8   c                 L    | j         }t          j        d|z  | j        |          S )z/Uses string substitution to replace the base DNrL   )rs   resubr  )r   dn_strold_base_dns      r7   	rename_dnz!DCCloneAndRenameContext.rename_dn  s$    kvek)3?FCCCr8   c                    t          d           |                     | j                  }t          | j        t                      | j        t          | j        || 	                    | j
                  | j        | 	                    | j                  | 	                    | j                  | j        | j        d| j        | j                  }t          d|j        z             |j        | _        |j        | _        dS )z"Provision the local (renamed) SAM.z(Provisioning the new (renamed) domain...r  )rY   r  r   rB   r  r  rK  r  r   r  r  r   r\   z%Provision OK for renamed domain DN %sN)r   r  rB   r   rW   r   rY   r   r  r  ru   r  rw   ry   r  r|   r   r\   r  rh   r  r  )r   non_global_lpr  s      r7   r  z&DCCloneAndRenameContext.join_provision  s     	8999 0088 CJ(8(8&)m"%-M#&==#=#=%(]]3=%A%A%(]]3=%A%A#&#6#*'K(+*-*;	= 	= 	= 	58HHIII!-M			r8   )	NNNNNNNTN)
r9   r:   r;   r  r3   r  r  r  r  r<   r=   s   @r7   r  r    s        @@FJJNGK" " " " " "
L 
L 
L  D D D" " " " " " "r8   r  )NNNNNNNNFNFNFFNN)
NNNNNNFrV   NN)Or  
samba.authr   samba.samdbr   r   r   r   r   r   r	   rm   r   	samba.ndrr
   r   samba.dcerpcr   r   r   r   r   r   r   r   
samba.dsdbr   samba.credentialsr   r   samba.provisionr   r   r   r   r   r   samba.provision.commonr   samba.schemar   r   	samba.netr    samba.provision.sambadnsr!   r"   r#   base64r$   r%   r&   r'   samba.dnsserverr(   r)   r*   loggingr  r  r   r  r  collectionsr+   samba.commonr,   samba.netcmdr-   r.   r   r0   rp  r?   r  r  r  r  r  r  r8   r7   <module>r     s  &   % % % % % %       O O O O O O O O O O O O O O 



   * * * * * * * * U U U U U U U U U U U U U U U U U U U U . . . . . . < < < < < < < <D D D D D D D D D D D D D D D D - - - - - -                   4 4 4 4 4 4 # # # # # #             , , , , , , , ,       < < < < < < < < < <    				 				  # # # # # # # # # # # # % % % % % %      M M M M Mi M M Mg g g g gF g g gT- VZ@E=A8= !%5X 5X 5X 5Xp TX>C;?6;#U U U UD 9=<A15"&   ,3 3 3 3 3] 3 3 3pS" S" S" S" S"n S" S" S" S" S"r8   