
    b[V                        d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlZd dlmZ d dlmZmZ d dlZd dlZd d	lmZ d dlZ	 d d
lmZ n# e$ r d Z ej        d           Y nw xY wd dlmZ d dlmZ d dl m!Z! dZ"dZ#dZ$d Z%d Z&d Z'd Z(dgfdZ)d Z*d Z+d Z,d Z-d!dZ. G d d e          Z/dS )"    N)
gp_pol_ext)Ldb)SCOPE_SUBTREE
SCOPE_BASE)system_session)get_dc_hostname)which)PopenPIPE)log)load_der_pkcs7_certificatesc                     g S )N )xs    B/usr/lib/python3/dist-packages/samba/gp/gp_cert_auto_enroll_ext.pyr   r   $   s    r	    zNpython cryptography missing pkcs7 support. Certificate chain parsing will fail)Encoding)load_der_x509_certificate)default_backends9   
-----BEGIN CERTIFICATE-----
%s
-----END CERTIFICATE-----z/etc/pki/trust/anchorszc(https|HTTPS)://(?P<server>[a-zA-Z0-9.-]+)/ADPolicyProvider_CEP_(?P<auth>[a-zA-Z]+)/service.svc/CEPc                 ~   dt          j        d| dd                   d         z  ddt          j        d| dd                   d         z  ddt          j        d| dd                   d         z  ddt          j        d	| dd
                   d         z  ddt          j        d| d
d                   z  	S )z)Convert an octet string to an objectGUID.z%02xz<Lr      -z<H      z>H
   z%02x%02xz>HLN)structunpack)datas    r   octet_string_to_objectGUIDr   4   s    %dD1I(F(Fq(IIII%dD1I(F(Fq(IIII%dD1I(F(Fq(IIII%dD2J(G(G(JJJJ)FM%bcc,K,KKK	M Mr   c                 n   i }| D ]J}|d         |                                 vrg ||d         <   ||d                                      |           K|                                D ]}|                    d            d |D             }t	          |          }|D ]z}|                    |          }t          |          t          j        t          |          |          z
  dz
  }||k    rSd }	t          |||dz            |	          |||dz   <   {t          |                                          S )a  Group and Sort End Point Information.

    [MS-CAESO] 4.4.5.3.2.3
    In this step autoenrollment processes the end point information by grouping
    it by CEP ID and sorting in the order with which it will use the end point
    to access the CEP information.
    PolicyIDc                     | d         S )NCostr   es    r   <lambda>z6group_and_sort_end_point_information.<locals>.<lambda>Q   s
    1V9 r   )keyc                     g | ]
}|d          S )r#   r   .0r%   s     r   
<listcomp>z8group_and_sort_end_point_information.<locals>.<listcomp>T   s    8881QvY888r      c                 >    | d         dk    rdS | d         dk    rdS dS )N	AuthFlags   r   r,   r   r$   s    r   	sort_authz7group_and_sort_end_point_information.<locals>.sort_auth`   s/    [>S((1{^s**11r   )keysappendvaluessortsetindexlenoperatorindexOfreversedsortedlist)
end_point_informationend_point_groupsr%   end_point_group	cost_listcostscostijr0   s
             r   $group_and_sort_end_point_informationrE   =   s}    " 2 2Z= 0 5 5 7 777.0Qz]+:'..q1111 ,2244 ; ; 	!4!4555 98888	I 	; 	;D%%AIx/0C0CTJJJ1LAAvv   &,OAacE,B09&; &; &;OAacE""'	;*  ''))***r   c                    i }d}| D ]h}|j                             |          s|j                             |d          }||                                vri ||<   |j        ||         |j        <   i|                                D ]}t          j        t          |d                   }|rbd|
                    d                              dd          z  }||d<   |
                    d          |d	<   |
                    d
          |d
<   |d                                         dk    r#d|d         i}t          j        d|           i c S t          |                                          }|S )zObtain End Point Information.

    [MS-CAESO] 4.4.5.3.2.2
    In this step autoenrollment initializes the
    CertificateEnrollmentPolicyEndPoints table.
    z7Software\Policies\Microsoft\Cryptography\PolicyServers\ URLz%s-CAserver.r   namehostnameauthzldap:endpointzFailed to parse the endpoint)keyname
startswithreplacer1   r   	valuenamer3   rematchendpoint_regrouplowerr   errorrE   )entriesr=   sectionr%   rK   camedatas           r   obtain_end_point_informationr^   m   s    LG : :y##G,, 	y  "--,113333*,!$'346d#AK00#**,, 
 
H["U),, 	QWWX..66sC@@@DBvJWWX..BzNBvJJY__')) "U)-EI4e<<<III *
 	--B-I-I-K-KLL   r   c                 4   g }|                                  }d|z  }g d}d}|                     |t          ||          }t          |          dk    r|S |D ]A}|d         d         |d         d         |d         d         d}|                    |           B|S )	z0Initialize CAs.

    [MS-CAESO] 4.4.5.3.1.2
    zMCN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,%s)cACertificatecndNSHostNamez"(objectClass=pKIEnrollmentService)r   ra   rb   r`   )rK   rL   r`   )get_default_basednsearchr   r7   r2   )	ldbresultbasedndnattrsexprresesr   s	            r   fetch_certification_authoritiesrm      s    
 F##%%F 
Y[a	aB222E/D
**Re
4
4C
3xx1}}  D!.q1"$_"5a"8  	dMr   msPKI-Minimal-Key-Sizec                     |                                  }d|z  }d|z  }|                     |t          ||          }t          |          dk    rd|d         v rt	          |d                   S ddgiS )NzOCN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,%sz(cn=%s)r,   rn   r   2048)rc   rd   r   r7   dict)re   rK   ri   rg   rh   rj   rk   s          r   fetch_template_attrsrr      sz    ##%%F	Z]c	cBtD
**Re
4
4C
3xx1}}1SV;;CF||(6(33r   c                 ~    t          j        |           } t          t          j        dd| dt          j                  z  S )Ns   (.{64})s   \1
r   )base64	b64encode	cert_wraprS   subDOTALL)certs    r   format_root_certrz      s1    D!!Drvj(D!RYGGGGr   c                      t           j                            d          ddg} t          dd                    |                     S )NPATHz/usr/lib/certmongerz/usr/libexec/certmongerzcepces-submit:)path)osenvirongetr	   join)certmonger_dirss    r   find_cepces_submitr      s?    z~~f--/D02Osxx'@'@AAAAr   c                    t                      }t          j                            |          rt          j        }d|d<   t          |d| z  dg|t          t                    }|                                \  }}|j        dk    r+d|	                                i}t          j        d|           |                                                                S g S )	NzGET-SUPPORTED-TEMPLATESCERTMONGER_OPERATIONz--server=%sz--auth=Kerberos)envstdoutstderrr   Errorz0Failed to fetch the list of supported templates.)r   r   r~   existsr   r
   r   communicate
returncodedecoder   rX   stripsplit)rI   cepces_submitr   pouterrr   s          r   get_supported_templatesr      s    &((M	w~~m$$ 	#j&?"#=-&"8:KLtD: : :==??S<1cjjll,DIH$OOOyy{{  """Ir   c                 j   t           j                            |d| d         z            }g }	 t          j        |ddd          }n0# t          j        j        $ r t          j        d           d}Y nw xY w||j	        d	k    s|j
        d
         dk    rt          j        d           t          j        d           d| v rt          j        d           	 t          | d                   }n2# t          $ r% t          | d         t                                }Y nw xY w|                    t          j                  }t#          |d          5 }|                    |           ddd           n# 1 swxY w Y   |                    |           |S |j
        d
         dk    r	 t          |j	                  }n1# t          $ r$ t          |j	        t                                }Y nw xY w|                    t          j                  }t#          |d          5 }|                    |           ddd           n# 1 swxY w Y   |                    |           n|j
        d
         dk    rt)          |j	                  }	t+          dt-          |	                    D ]}
|	|
                             t          j                  }d||
fz  }t#          |d          5 }|                    |           ddd           n# 1 swxY w Y   |                    |           nt          j        d           |S )z$Fetch Certificate Chain from the CA.%s.crtrK   	GetCACertCAIdentifier)	operationmessage)urlparamsz$Failed to establish a new connectionNr   zContent-Typez	text/htmlz+Failed to fetch the root certificate chain.zPThe Network Device Enrollment Service is either not installed or not configured.r`   z'Installing the server certificate only.wbzapplication/x-x509-ca-certzapplication/x-x509-ca-ra-certr   z%s.%dz+getca: Wrong (or missing) MIME content type)r   r~   r   requestsr   
exceptionsConnectionErrorr   warncontentheadersr   	TypeErrorr   public_bytesr   PEMopenwriter2   r   ranger7   )r[   r   	trust_dir	root_cert
root_certsrry   	cert_datawcertsrC   dests               r   getcar      s   Y2f:(=>>IJLS{5C*E *E F F F.   7888 	yAI$$	.(A[(P(P>??? 1 	2 	2 	2b  H>???D0O1DEE D D D0O1D1@1B1BD DD ))(,77Ii&& #!	"""# # # # # # # # # # # # # # #i(((y $@@@	K,QY77DD 	K 	K 	K,QY8I8IJJDDD	K%%hl33	)T"" 	aGGI	 	 	 	 	 	 	 	 	 	 	 	 	 	 	)$$$$	
>	"&E	E	E+AI66q#e**%% 	$ 	$A8((66Di^+DdD!! Q              d####	$ 	>???sk   A *A43A4C, ,,DDE//E36E3#F8 8+G&%G&H::H>H>K==L	L	Kerberosc                 >   g g d}d| d         z  }t          | ||          }|d                             |           |D ]}t          j                            t
          t          j                            |                    }		 t          j        ||	           |d                             |	           v# t          $ r t          j        d           Y t          $ r t          j        dt
                     Y t          $ r |d                             |	           Y w xY wt          d          }
|
"t          |
g                                           t          d	          }t#                      }|t          j                            |          r`t          |d
d| d         d|d| d         d|gt&          t&                    }|                                \  }}t          j        |                                           |j        dk    r2|                                | d         d}t          j        d|           t3          | d                   }|D ]r}t5          ||          }| d         d|                                }t          j                            |d|z            }t          j                            |d|z            }t          |dd| d         d|                                d|d|d|d|d         d         gt&          t&                    }|                                \  }}t          j        |                                           |j        dk    r,|                                |d}t          j        d|           |d                             ||g           |d                              |           t|
"t          |
g                                           nt          j        d!           t7          j        |          S )"z#Install the root certificate chain.)files	templatesz0http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?rL   r   z=Failed to symlink root certificate to the admin trust anchorszZFailed to symlink root certificate to the admin trust anchors. The directory was not foundzupdate-ca-certificatesNgetcertzadd-ca-crK   z-ez
 --server=z --auth=)r   r   r   )r   CAz#Failed to add Certificate AuthorityrJ   z%s.keyr   requestz-Tz-Iz-kz-fz-grn   )r   CertificatezFailed to request certificater   zOcertmonger and cepces must be installed for certificate auto enrollment to work)r   extendr   r~   r   global_trust_dirbasenamesymlinkr2   PermissionErrorr   r   FileNotFoundErrorFileExistsErrorr	   r
   waitr   r   r   r   debugr   r   rX   r   rr   jsondumps)r[   re   r   private_dirrM   r   r   r   srcdstupdater   r   r   r   r   supported_templatestemplateri   nicknamekeyfilecertfiles                         r   cert_enrollr      s,   b))D
<r*~
MCr3	**JM$$$ & &gll+RW-=-=c-B-BCC	&JsC   M  %%%% 	- 	- 	-H , - - - - -  	G 	G 	GH 45EG G G G G  	& 	& 	& M  %%%%%		&
 +,,FvhIG&((Mrw~~m<<7HdBvJ0=Z...$$() d, , , ==??S	#**,,<1!jjll"V*>>DI;TBBB5bnEE+ 	/ 	/H(h77E"$V***hoo.?.?.?@Hgll;80CDDGw||Ix(/BCCHw	4FX__..XtWdHU#;<Q?A #4	1 1 1A
 }}HCIcjjll###|q  "%**,,xII	94@@@M  '8!4555$$X....6(OO  """ 7 	8 	8 	8:ds   0B55D!#D!:$D! D!c                   0    e Zd Zd Z	 ddZd Zd Zd ZdS )gp_cert_auto_enroll_extc                     dS )NzCryptography\AutoEnrollmentr   )selfs    r   __str__zgp_cert_auto_enroll_ext.__str__;  s    ,,r   Nc           	         || j                             d          }|| j                             d          }t          j                            |          st          j        |d           t          j                            |          st          j        |d           |D ]l\  }}| j                            |           t          |           |v r!|t          |                    
                                D ]\  }}t          j        |          }	t          j        |          }t          d          }
|
Ut!          |
dd|	g                                           |d         D ]'}t!          |
d	d
|g                                           (|d         D ]5}t          j                            |          rt          j        |           6| j                            t          |           |           | j                                         n|D ]}|j        rd}| j                            |j                   d}t          j                            |j        |          }|                     |          }|si|j        D ]}|j        |k    rw|j        dk    rl|j        dz  r#|j        dz  dk    }|j        dz  dk    }|j        dz  dk    }|r|                     |j        ||           | j                                         d S )Nr   i  )modei  r   z	remove-car   r   zstop-trackingz-ir   7Software\Policies\Microsoft\Cryptography\AutoEnrollmentMACHINE/Registry.polAEPolicy   r,   r/   r   )lp
cache_pathprivate_pathr   r~   r   mkdirgp_dbset_guidstritemsrt   	b64decoder   loadsr	   r
   r   unlinkdeletecommitfile_sys_pathrK   r   parserY   rO   rR   r    _gp_cert_auto_enroll_ext__enroll)r   deleted_gpo_listchanged_gpo_listr   r   guidsettings	ca_cn_encr   ca_cnr   r   fgporZ   pol_filer~   pol_confr%   enrollmanageretrive_pendings                         r   process_group_policyz,gp_cert_auto_enroll_ext.process_group_policy>  s   **733I'..w77Kw~~i(( 	,HYU++++w~~k** 	.H[u----. 	  	 ND(J%%%4yyH$$'/D		':'@'@'B'B < <OIt",Y77E:d++D#I..G*wT5ABBGGIII(,[(9 ; ;H!7O#'#3 4 448DFFFF!'] ) )7>>!,, )IaLLLJ%%c$ii;;;;J# 	, 	,C  ,S
##CH---1w||C$5x@@::d++ !) , ,AyG++z0I0I6F? %$!"#!4!"#!4*+&3,#*=! 7 MM(*:I*57 7 7
))+++)	, 	,r   c           
         |D ]C}|d         }|d         dz  st          d |D                       r|                    dt          ddg          }t          |          dk    rb|                    |d         d         d         t          dd	g          }t          |          dk    rd
t	          |d         d	         d                                                   z  }	|	|d         k    r|D ]V}
|
d         dk    rzt          |          }|D ]g}t          ||||          }| j        	                    t          |           t          j        |d                                                   |           h|
d                                                             d          rt          |
||||
d                   }| j        	                    t          |           t          j        |
d                                                                                   |           7d|
d         i}t#          j        d|           XEdS )zRead CEP Data.

        [MS-CAESO] 4.4.5.3.2.4
        In this step autoenrollment initializes instances of the
        CertificateEnrollmentPolicy by accessing end points associated with CEP
        groups created in the previous step.
        r   Flags   c                 &    g | ]}|d          dk    S rH   LDAP:r   r)   s     r   r+   z;gp_cert_auto_enroll_ext.__read_cep_data.<locals>.<listcomp>  s!    AAAAAeH'AAAr   rG   z(objectClass=*)rootDomainNamingContextr,   
objectGUIDz{%s}r!   rH   r   rK   zhttps://rM   )rM   rN   zUnrecognized endpointN)anyrd   r   r7   r   upperrm   r   r   storer   rt   ru   r   rW   rP   encoder   rX   )r   re   r=   r   r   r?   r%   rk   res2r  r[   cas_car   r]   s                  r   __read_cep_dataz'gp_cert_auto_enroll_ext.__read_cep_dataq  s     5 9	> 9	>O  "A W:$ 
 AAAAABB  jjZ1B";!<> >s88q==zz#a&)B"CA"F",.?#/.2 2 t99>> $.tAw|/DQ/GHHNNPPQ
:.. & > >e9''9#>>C" / /*3YLL
((T)/)9#f+)F)F)M)M)O)O)-/ / / // Y__&&11*== >&r3	'2FE E EDJ$$SYY(F):):)<)<==DDFF    )"U)5EI5u===='>M9	> 9	>r   c                    dt          | j        | j                  z  }t          |t	                      | j        | j                  }t          |          }t          |          dk    r|                     ||||           d S t          |          }|D ]g}t          ||||          }	| j
                            t          |           t          j        |d                                                   |	           hd S )N	ldap://%sr   session_infor   credentialsr   rK   )r   credsr   r   r   r^   r7   '_gp_cert_auto_enroll_ext__read_cep_datarm   r   r   r  r   rt   ru   r   )
r   rY   r   r   r   re   r=   r  r[   r   s
             r   __enrollz gp_cert_auto_enroll_ext.__enroll  s   ODJ@@@c(8(8W$*6 6 6 !=W E E$%%))  &;!*K9 9 9 9 9 2#66C N N"2sI{CC
  T!'!1"V*!=!=!D!D!F!FN N N NN Nr   c                    i }d}d}|j         rt          j                            |j         |          }|                     |          }|s|S |j        D ]}|j        |k    r|j        dk    r|j        dz  dk    }|j        dz  s|s6i |d<   dt          | j
        | j                  z  }	t          |	t                      | j        | j
                  }
t          |j                  }t          |
          }t!          |          d	k    r=d
 |D             }t#          d |D                       r|                    |           n|}|D ]}d|v r|d         dk    rd}|d         }||vri ||<   i ||         |<   d|v r6t'          |d                                                   ||         |         d<   |d         ||         |         d<   t+          |d                   }d |D             ||         |         d<   |S )Nr   r   r   r,   r   zAuto Enrollment Policyr  r  r   c                     g | ]	}|D ]}|
S r   r   )r*   sleps      r   r+   z0gp_cert_auto_enroll_ext.rsop.<locals>.<listcomp>  s%    PPPrRPPrPPPPr   c                 &    g | ]}|d          dk    S r   r   )r*   r[   s     r   r+   z0gp_cert_auto_enroll_ext.rsop.<locals>.<listcomp>  s!    DDD5	W 4DDDr   rH   r   rK   r`   zCA CertificaterL   zAuto Enrollment Serverc                 6    g | ]}|                                 S r   )r   )r*   ts     r   r+   z0gp_cert_auto_enroll_ext.rsop.<locals>.<listcomp>  s     EEEAQXXZZEEEr   	Templates)r   r   r~   r   r   rY   rO   rR   r   r   r  r   r   r   r^   rm   r7   r  r   rz   r   r   )r   r   outputr   rZ   r~   r   r%   r   r   re   r=   r  cas2r[   policyra   r   s                     r   rsopzgp_cert_auto_enroll_ext.rsop  sr   )K '	F7<< 18<<Dzz$''H % "F "F9''AK:,E,EVc\S0Fv !f ! 79F34%
DG(L(LLC#N4D4D!%djB B BC 5X5EFF *9#>>C011A55PP-BPPPDDtDDDEE 'JJt,,,,"&C! F F B;;2e9+?+?$!9Z!//-/F6N-/vr**b00 0O1D E E L L N N #6N2./?@ zN vr*+CD 4BzNCC , FE1DEEE vr*;77r   )NN)__name__
__module____qualname__r   r   r  r   r  r   r   r   r   r   :  sq        - - - :>1, 1, 1, 1,fC> C> C>JN N N , , , , ,r   r   )r   )0r   r8   r   samba.gp.gpclassr   sambar   re   r   r   
samba.authr   r   rt   shutilr	   
subprocessr
   r   rS   r   samba.gp.util.loggingr   r   2cryptography.hazmat.primitives.serialization.pkcs7r   ModuleNotFoundErrorrX   ,cryptography.hazmat.primitives.serializationr   cryptography.x509r   cryptography.hazmat.backendsr   rv   r   rU   r   rE   r^   rm   rr   rz   r   r   r   r   r   r   r   r   <module>r-     s  " 
			   ' ' ' ' ' '       ) ) ) ) ) ) ) ) % % % % % % , , , , , ,        " " " " " " " " 				  % % % % % % 5$ $ $ $ $ $ $ 5 5 5111CI 4 5 5 5 5 55 B A A A A A 7 7 7 7 7 7 8 8 8 8 8 8	 , 9M M M.+ .+ .+`! ! !>  . ,D*D 4 4 4 4H H HB B B
  1 1 1h? ? ? ?Bx x x x xj x x x x xs   A A43A4