
    bg                     j   d dl mZ d dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d d	lmZmZmZmZ  G d
 de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          ZdS )    N)	provision)dsdb)SamDB)system_session)security)ndr_pack
ndr_unpack)_get_user_realm_domain)CommandCommandErrorSuperCommandOptionc                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZd ZddZdS )cmd_delegation_showz*Show the delegation setting of an account.z%prog <accountname> [options]	sambaoptscredoptsversionopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestaccountnamec                    |j         }|j        }d}||t          j        z  s | j                            d| d           d S |t          j        z  s | j                            d| d           d S d}|j        D ]}|j        }	 |	                    d| dt          j        	          }	t          |	          d
k    r|	d         j        }n7# t          j        $ r%}
|
j        \  }}|t          j        k    r Y d }
~
nd }
~
ww xY wd}|j        t          j        k    s|j        t          j        k    r$| j                            d| d| d           d}n,|j        t          j        k    r|j        t          j        k    rd}|j        t          j        z  }|j        t          j        z  }|j        t          j        z  }|j        t          j        z  }|r|s|sd}nJ|r#| j                            d| d| d           d}|r#| j                            d| d| d           d}|j        sd}|s<|r| j                            d           d}| j                            d| d           d S )NzISecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentityzWarning: DACL not present in z!
zWarning: DACL in z lacks SELF_RELATIVE flag!
Tz<SID=>)scope   r   FzWarning: ACE in z denies access for trustee zWarning: ACE for trustee z. has unexpected CONTAINER_INHERIT flag set in z* has unexpected INHERITED_ACE flag set in z0  Principals that may delegate to this account:
z*msDS-AllowedToActOnBehalfOfOtherIdentity: 
)daclr   r   SEC_DESC_DACL_PRESENTerrfwriteSEC_DESC_SELF_RELATIVEacestrusteesearchldb
SCOPE_BASElendnLdbErrorargsERR_NO_SUCH_OBJECTSEC_ACE_TYPE_ACCESS_DENIED!SEC_ACE_TYPE_ACCESS_DENIED_OBJECTSEC_ACE_TYPE_ACCESS_ALLOWED"SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECTflagsSEC_ACE_FLAG_INHERIT_ONLYSEC_ACE_FLAG_OBJECT_INHERITSEC_ACE_FLAG_CONTAINER_INHERITSEC_ACE_FLAG_INHERITED_ACEaccess_maskoutf)selfsamsecurity_descriptorr%   	desc_typewarning_infofirstacer+   reserrnum_ignoreinherit_onlyobject_inheritcontainer_inheritinherited_aces                     9/usr/lib/python3/dist-packages/samba/netcmd/delegation.pyshow_security_descriptorz,cmd_delegation_show.show_security_descriptor8   sW   "'',	C <y8+II<IOOMLMMMNNNF8:: 	IOO 5 5 5 5 6 6 6F9 >	0 >	0CkG	(jj!3!3!3!3'*~ ! 7 7 s88q==!!fiG <   Q#000 10000 FH???x8#MMM	 !C< !C !C6=!C !C !C D D D (hBBBH$OOO9x'IIL Y)MMN	HCC I(KKM "N ";L " $ "IOO %9 %9 %9'3%9 %9 %9 : : : "F  "IOO %9 %9 %9'3%9 %9 %9 : : : "F?  0 "IOO %2 3 3 3!E	 !/#*!/ !/ !/ 0 0 0{>	0 >	0s   %CC?C::C?Nc                 Z   |                                 }|                    |          }t          j        ||                    d                    }||j        }	n|}	t          |	t                      ||          }
t          ||
          \  }}}|
	                    dt          j        |          z  t          j        g d          }t          |          dk    rt          d|z            t          |          dk    sJ t          |d                             d	          d                   }|d                             d
          }|d                             dd          }| j                            dt%          |d         j                  z             | j                            dt)          |t*          j        z            z             | j                            dt)          |t*          j        z            z             |r<| j                            d           |D ]}| j                            d|z              |^	 t1          t2          j        |          }|                     |
|           d S # t8          $ r | j                            d           Y d S w xY wd S )Nrealmsession_infocredentialslpsAMAccountName=%s)userAccountControlmsDS-AllowedToDelegateTo(msDS-AllowedToActOnBehalfOfOtherIdentity
expressionr"   attrsr    Unable to find account name '%s'r#   rX   rY   rZ   idxzAccount-DN: %s
zUF_TRUSTED_FOR_DELEGATION: %s
z.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: %s
z)  Services this account may delegate to:
zmsDS-AllowedToDelegateTo: %s
znWarning: Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity could not be unmarshalled!
)get_loadparmget_credentialsr   provision_paths_from_lpgetsamdbr   r   r
   r,   r-   binary_encodeSCOPE_SUBTREEr/   r   intr>   r(   strr0   boolr   UF_TRUSTED_FOR_DELEGATION)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONr	   r   
descriptorrP   RuntimeErrorr'   )r?   r   r   r   r   r   rV   credspathspathr@   cleanedaccountrR   domainrF   uacallowedallowed_fromarA   s                       rO   runzcmd_delegation_show.run   s   ##%%((,,1"bffWooFF9;DDDD~'7'7 %". . . +AAD+F +F' jj$7*>::%;"0 L  L  L  M M
 s88q==AKOPPP3xx1}}}}#a&**1221566a&**7881vzz"LRSzTT	*SQ^^;<<<	9sT%CCDDE 	F 	F 	F	IS4#QQRRS 	T 	T 	T  	FIOOHIII F F	 @1 DEEEE#H&01Dl&S&S# --c3FGGGGG   @ @ @	 !? @ @ @ @ @ @@ $#s   J   $J('J(NNNN)__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   ri   takes_options
takes_argsrP   rx        rO   r   r   &   s        44.H ).-  	tW#JQT3	( 	( 	(M
  JP0 P0 P0f0H 0H 0H 0H 0H 0Hr   r   c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_delegation_for_any_servicez3Set/unset UF_TRUSTED_FOR_DELEGATION for an account.(%prog <accountname> [(on|off)] [options]r   r   r   r   r   r   r   r   onoffNc                 0   d}|dk    rd}n|dk    rd}nt          d|z            |                                }|                    |          }	t          j        ||                    d                    }
||
j        }n|}t          |t                      |	|          }t          ||          \  }}}dt          j        |          z  }t          j        }	 |                    ||d	|d
           d S # t          $ r}t          |          d }~ww xY w)NFonToff0invalid argument: '%s' (choose from 'on', 'off')rR   rS   rW   zTrusted-for-Delegation	flags_strr   strict)r   ra   rb   r   rc   rd   re   r   r   r
   r-   rf   r   rk   toggle_userAccountFlags	Exceptionr?   r   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rR   rs   search_filterflagrG   s                      rO   rx   z"cmd_delegation_for_any_service.run   sZ    D==BBe^^BBQTYYZZZ##%%((,,1"bffWooFF9;DDDD~'7'7 %". . . +AAD+F +F' ,c.?.O.OO-	$''t2J+-d ( < < < < <  	$ 	$ 	$s###	$s   C7 7
DDDry   rz   r{   r|   r}   r~   r   r   r   r   r   r   ri   r   r   rx   r   r   rO   r   r      s        ==9H ).-  	tW#JQT3	( 	( 	(M
  )JGK!$ !$ !$ !$ !$ !$r   r   c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_delegation_for_any_protocolzOSet/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account.r   r   r   r   r   r   r   r   r   r   Nc                 4   d}|dk    rd}n|dk    rd}nt          d|z            |                                }|                    |d          }	t          j        ||                    d                    }
||
j        }n|}t          |t                      |	|          }t          ||          \  }}}d	t          j        |          z  }t          j        }	 |                    ||d
|d           d S # t          $ r}t          |          d }~ww xY w)NFr   Tr   r   )fallback_machinerR   rS   rW   z&Trusted-to-Authenticate-for-Delegationr   )r   ra   rb   r   rc   rd   re   r   r   r
   r-   rf   r   rl   r   r   r   s                      rO   rx   z#cmd_delegation_for_any_protocol.run  s_    D==BBe^^BBQTYYZZZ##%%((d(CC1"bffWooFF9;DDDD~'7'7 %". . . +AAD+F +F' ,c.?.O.OO=	$''t2Z+-d ( < < < < <  	$ 	$ 	$s###	$s   C9 9
DDDry   r   r   r   rO   r   r      s        YY9H ).-  	tW#JQT3	( 	( 	(M
  )JGK!$ !$ !$ !$ !$ !$r   r   c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_delegation_add_servicezZAdd a service principal to msDS-AllowedToDelegateTo so that an account may delegate to it.)%prog <accountname> <principal> [options]r   r   r   r   r   r   r   r   	principalNc                 
   |                                 }|                    |          }t          j        ||                    d                    }	||	j        }
n|}
t          |
t                      ||          }t          ||          \  }}}|	                    dt          j        |          z  t          j        dg          }t          |          dk    rt          d|z            t          |          dk    sJ t          j                    }|d         j        |_        t          j        |gt          j        d          |d<   	 |                    |           d S # t(          $ r}t          |          d }~ww xY w	NrR   rS   rW   rY   r[   r   r^   r#   )ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   Messager0   MessageElementFLAG_MOD_ADDmodifyr   r?   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rR   rs   rF   msgrG   s                     rO   rx   zcmd_delegation_add_service.run<  s    ##%%((,,1"bffWooFF9;DDDD~'7'7 %". . . +AAD+F +F' jj$7*>::%;"0 :;  = = s88q==AKOPPP3xx1}}}}kmmQ*-*<i[=@=M=W+Y +Y&'	$JJsOOOOO 	$ 	$ 	$s###	$   E$ $
F.E==Fry   r   r   r   rO   r   r   *  s        dd:H ).-  	tW#JQT3	( 	( 	(M
  -JKO"$ "$ "$ "$ "$ "$r   r   c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_delegation_del_serviceziDelete a service principal from msDS-AllowedToDelegateTo so that an account may no longer delegate to it.r   r   r   r   r   r   r   r   r   r   Nc                 
   |                                 }|                    |          }t          j        ||                    d                    }	||	j        }
n|}
t          |
t                      ||          }t          ||          \  }}}|	                    dt          j        |          z  t          j        dg          }t          |          dk    rt          d|z            t          |          dk    sJ t          j                    }|d         j        |_        t          j        |gt          j        d          |d<   	 |                    |           d S # t(          $ r}t          |          d }~ww xY wr   )ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   r   r0   r   FLAG_MOD_DELETEr   r   r   s                     rO   rx   zcmd_delegation_del_service.runs  s    ##%%((,,1"bffWooFF9;DDDD~'7'7 %". . . +AAD+F +F' jj$7*>::%;"0 :;  = = s88q==AKOPPP3xx1}}}}kmmQ*-*<i[=@=P=W+Y +Y&'	$JJsOOOOO 	$ 	$ 	$s###	$r   ry   r   r   r   rO   r   r   a  s        ss:H ).-  	tW#JQT3	( 	( 	(M
  -JKO"$ "$ "$ "$ "$ "$r   r   c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_delegation_add_principalz\Add a principal to msDS-AllowedToActOnBehalfOfOtherIdentity that may delegate to an account.r   r   r   r   r   r   r   r   r   r   Nc           	         |                                 }|                    |          }t          j        ||                    d                    }	||	j        }
n|}
t          |
t                      ||          }t          ||          \  }}}|	                    dt          j        |          z  t          j        dg          }t          |          dk    rt          d| d          t          |          d	k    sJ |d                             dd
          }|jt          j        t          j                  }t          j                    }t          j        |_        t          j        t          j        z  |_        ||_        d }nD	 t3          t          j        |          }n!# t4          $ r t          d| d          w xY w|j        }|+t          j                    }t          j        |_        d|_        t          ||          \  }}}|	                    dt          j        |          z  t          j        dg          }t          |          dk    rt          d| d          t          |          d	k    sJ t          j        |                    d|d                             dd
                                         d                    |j!        }tE          fd|D                       rt          d| d| d          t          j#                    }t          j$        |_        d|_%        t          j&        |_'        |_(        |)                    |           ||_!        |xj        d	z  c_        ||_        tU          |          }t          j+                    }|d         j,        |_,        |#t          j-        |t          j.        d          |d<   t          j-        |t          j/        d          |d<   	 |0                    |           d S # t          j1        $ rA}|j2        \  }}|t          j3        k    rt          d| d          t          |          d }~ww xY w)NrR   rS   rW   rZ   r[   r   zUnable to find account name ''r#   r_   WSecurity Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account '' could not be unmarshalled!	objectSidUnable to find principal name '	objectSIDutf-8c              3   .   K   | ]}|j         k    V  d S )Nr+   .0rE   	princ_sids     rO   	<genexpr>z3cmd_delegation_add_principal.run.<locals>.<genexpr>  s*      88Cs{i'888888r   zACE for principal 'zl' already present in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ''.01RRefused to update attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account ':': a conflicting attribute update occurred simultaneously.)4ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   r   dom_sidSID_BUILTIN_ADMINISTRATORSrm   SD_REVISIONrevisionr&   r)   r   	owner_sidr	   rn   r%   aclSECURITY_ACL_REVISION_ADSnum_acesschema_format_valuedecoder*   anyrE   r6   r8   SEC_ADS_GENERIC_ALLr=   r+   appendr   r   r0   r   r   r   r   r1   r2   ERR_NO_SUCH_ATTRIBUTE)r?   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rI   account_resdatar   security_descr%   cleanedprinc	princ_resr*   rE   new_datar   rG   rH   r   s                              @rO   rx   z cmd_delegation_add_principal.run  s    ##%%((,,1"bffWooFF9;DDDD~'7'7 %". . .  6k3GG1jj*n--.#=>	 ! @ @
 {q  M{MMMNNN;1$$$$1~!!6A " ? ?< ()LMMI$/11M%-%9M""*"@"*"A#BM&/M#DD5 *8+> E E 5 5 5" $43>$4 $4 $4 5 5 55 !%D<<>>D$>DMDM 4IsCCaJJ*="0>>+?%(%6&1]  4 4	 y>>QMMMMNNN9~~""""$##!  ! 446 66<fWooG G	
 y 8888488888 	%$i $ $  $ $ $% % % lnn7	"6C	!M**
 kmmQ")c):< <CH %c&68 8C	(JJsOOOOO| 		( 		( 		(XFCc///"0#0 0 01 1 1 #3'''		(s$   F* *GP Q.-<Q))Q.ry   r   r   r   rO   r   r     s        ff:H ).-  	tW#JS	2 	2 	2M
  -JKOz( z( z( z( z( z(r   r   c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_delegation_del_principalzkDelete a principal from msDS-AllowedToActOnBehalfOfOtherIdentity that may no longer delegate to an account.r   r   r   r   r   r   r   r   r   r   Nc           	      |   |                                 }|                    |          }t          j        ||                    d                    }	||	j        }
n|}
t          |
t                      ||          }t          ||          \  }}}|	                    dt          j        |          z  t          j        dg          }t          |          dk    rt          d|z            t          |          dk    sJ |d                             dd	          }|t          d
| d          	 t          t           j        |          }n!# t$          $ r t          d| d          w xY w|j        }|t          d| d          t          ||          \  }}}|	                    dt          j        |          z  t          j        dg          }t          |          dk    rt          d| d          t          |          dk    sJ t!          j        |                    d|d                             dd	                                        d                    |j        }fd|D             }t          |          t          |          k    rt          d| d| d          t          |          |_        ||_        ||_        t3          |          }t          j                    }|d         j        |_        t          j        |t          j        d          |d<   t          j        |t          j        d          |d<   	 |                    |           d S # t          j         $ rA}|j!        \  }}|t          j"        k    rt          d| d          t          |          d }~ww xY w)NrR   rS   rW   rZ   r[   r   r^   r#   r_   z@Attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z' not present!r   r   zkDACL not present on Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'z'!r   r   r   r   r   c                 *    g | ]}|j         k    |S r   r   r   s     rO   
<listcomp>z4cmd_delegation_del_principal.run.<locals>.<listcomp>}  s%    DDD3;)+C+C+C+C+Cr   z"Unable to find ACE for principal 'z\' in Security Descriptor of attribute msDS-AllowedToActOnBehalfOfOtherIdentity for account 'r   r   r   r   r   )#ra   rb   r   rc   rd   re   r   r   r
   r,   r-   rf   rg   r/   r   r	   r   rm   rn   r%   r   r   r   r*   r   r   r   r0   r   r   r   r   r1   r2   r   )r?   r   r   r   r   r   r   rV   ro   rp   rq   r@   rr   rI   r   r   r   r%   r   r   old_acesr*   r   r   rG   rH   r   s                             @rO   rx   z cmd_delegation_del_principal.run9  so    ##%%((,,1"bffWooFF9;DDDD~'7'7 %". . .  6k3GG1jj*n--.#=>	 ! @ @
 {q  AKOPPP;1$$$$1~!!6A " ? ?<  G+6 G  G  G H H H	1&x':DAAMM 	1 	1 	1  0+6 0  0  0 1 1 1	1 !<  ; ,7 ;  ;  ; < < < 4IsCCaJJ*="0>>+?%(%6&1]  4 4	 y>>QMMMMNNN9~~""""$##!  ! 446 66<fWooG G	
 9 EDDDxDDD t99H%%  ;#, ;  ; ,7	 ;  ;  ; < < < D			!M**
 kmmQ"%#%68 8C %c&68 8C	(JJsOOOOO| 		( 		( 		(XFCc///"0#0 0 01 1 1 #3'''		(s$   7E E0M+ +N;:<N66N;ry   r   r   r   rO   r   r   '  s        uu:H ).-  	tW#JS	2 	2 	2M
  -JKOk( k( k( k( k( k(r   r   c                       e Zd ZdZi Z e            ed<    e            ed<    e            ed<    e            ed<    e	            ed<    e
            ed<    e            ed<   d	S )
cmd_delegationzDelegation management.showzfor-any-servicezfor-any-protocolzadd-servicezdel-servicezadd-principalzdel-principalN)rz   r{   r|   r}   subcommandsr   r   r   r   r   r   r   r   r   rO   r   r     s          K--//K%C%C%E%EK!"&E&E&G&GK"#!;!;!=!=K!;!;!=!=K#?#?#A#AK #?#?#A#AK   r   r   )samba.getoptgetoptr   r-   sambar   r   samba.samdbr   
samba.authr   samba.dcerpcr   	samba.ndrr   r	   samba.netcmd.commonr
   samba.netcmdr   r   r   r   r   r   r   r   r   r   r   r   r   r   rO   <module>r      sm  *       



                   % % % % % % ! ! ! ! ! ! * * * * * * * * 6 6 6 6 6 6           UH UH UH UH UH' UH UH UHp3$ 3$ 3$ 3$ 3$W 3$ 3$ 3$l3$ 3$ 3$ 3$ 3$g 3$ 3$ 3$l4$ 4$ 4$ 4$ 4$ 4$ 4$ 4$n4$ 4$ 4$ 4$ 4$ 4$ 4$ 4$nL( L( L( L( L(7 L( L( L(^}( }( }( }( }(7 }( }( }(@
B 
B 
B 
B 
B\ 
B 
B 
B 
B 
Br   