
    ph                       d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ d dlZd dlmZmZ d d	lmZ d d
lmZmZ d dlm Z m!Z! d dl"m#Z# d dl"m$Z$ d dl"m%Z% d dl"m&Z& d dl"m'Z' d dl"m(Z( d dl"m)Z) d dl*m+Z+m,Z, d dl-m.Z.m/Z/m0Z0m1Z1 d dl2m3Z3 d dl4m5Z5 d dl4m6Z6m7Z7m8Z8 d dl9m:Z: d dl9m;Z< d dl=m>Z> d dl?m@Z@ d dlmAZAmBZBmCZC d dlDmEZE d dlFmZG d dlHmIZI d d lmJZJ d d!lKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZX d d"lYmZZZm[Z[m\Z\m]Z] d d#l^m_Z_m`Z`maZa d d$lbmcZc d d%ldmeZe d d&lfmgZg d d'lhmiZi d d(lmjZj ePeQeRd)Zk e1d*d+d,d-.           e1d/d0d12           e1d3d4d5d6d7gd8 e            z  9           e1d:d;d<d=.           e1d>d?d@elA           e1dBdCdDd0E          gZm e1dFdGelH           e1dIdJelH           e1dKdLd0E           e1dMd4dNg dOdPdQR           e1dSdTdUd0E          gZn e1dVdWd0E          gZodX Zp	  e              G dY dZe.          Zqn# er$ r dZqY nw xY w G d[ d\e.          Zs G d] d^e.          Zt G d_ d`e.          Zu G da dbe.          Zv G dc dde.          Zw G de dfe.          Zx G dg dhe.          Zy G di dje.          Zz G dk dle.          Z{ G dm dne0          Z| G do dpe.          Z} G dq dre}          Z~ G ds dtej                  Z G du dve.          Z G dw dxe          Z G dy dze          Z G d{ d|e          Z G d} d~e          Z G d de          Z G d de          Z G d de          Z G d de.          Z G d de0          Z G d de0          Z G d d          Z G d de.          Z G d de.          Z G d de0          ZdS )    N)ntstatus)NTSTATUSError)werrorgetpass)NetLIBNET_JOIN_AUTOMATIC)enable_net_export_keytab)	join_RODCjoin_DC)system_session)SamDBget_default_backend_store)ndr_pack	ndr_print)drsuapi)drsblobs)lsa)netlogon)security)nbt)misc)DOMAIN_PASSWORD_COMPLEXDOMAIN_PASSWORD_STORE_CLEARTEXT)CommandCommandErrorSuperCommandOption)get_fsmo_roleowner)!netcmd_get_domain_infos_via_cldap)NEVER_TIMESTAMPtimestamp_to_minstimestamp_to_days)Samba3)param)upgrade_from_samba3)drsuapi_connect)	remove_dcarcfour_encryptstring_to_byte_array)system_session_unix)r   )default_path)is_ad_dc_built)DS_DOMAIN_FUNCTION_2000DS_DOMAIN_FUNCTION_2003DS_DOMAIN_FUNCTION_2003_MIXEDDS_DOMAIN_FUNCTION_2008DS_DOMAIN_FUNCTION_2008_R2DS_DOMAIN_FUNCTION_2012DS_DOMAIN_FUNCTION_2012_R2$DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL#DS_NTDSDSA_OPT_DISABLE_INBOUND_REPLUF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTUF_TRUSTED_FOR_DELEGATIONUF_PARTIAL_SECRETS_ACCOUNT)	provisionProvisioningErrorDEFAULT_MIN_PWD_LENGTH
setup_path)	FILL_FULLFILL_NT4SYNCFILL_DRS)cmd_domain_passwordsettings_pso)cmd_domain_backup)
get_string)CreateTrustedDomainRelax)dsdb2008_R220122012_R2z--machinepassstringPASSWORDz*choose machine password (otherwise random)typemetavarhelpz--plaintext-secrets
store_truezbStore secret/sensitive values as plain text on disk(default is to encrypt secret/sensitive values)actionrP   z--backend-storechoiceBACKENDSTOREtdbmdbz7Specify the database backend to be used (default is %s))rN   rO   choicesrP   z--backend-store-sizebytesSIZEzfSpecify the size of the backend database, currently only supported by lmdb backends (default is 8 Gb).--targetdirDIRz/Set target directory (where to store provision))rO   rP   rN   -q--quietBe quietrP   rS   --serverz
DC to joinrP   rN   --sitezsite to joinz--domain-critical-onlyz&only replicate critical domain objects--dns-backendNAMESERVER-BACKEND)SAMBA_INTERNAL	BIND9_DLZNONEzThe DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (this DC will not be a DNS server)rf   rN   rO   rX   rP   default-v	--verbose
Be verbose--use-ntvfs+Use NTVFS for the fileserver (default = no)c                 ^   t          t          j        d          }t          j        | ddd|z  |gt          j        |          }|                                \  }}|                                 |                    d          }|r't          |d                   
                                S dS )	Nwz-sz-lz--parameter-name=%s)stdoutstderr   
r    )openosdevnull
subprocessPopenPIPEcommunicateclosesplitrD   strip)testparmsmbconfvarnameerrfilepouterrliness           5/usr/lib/python3/dist-packages/samba/netcmd/domain.pyget_testparm_varr      s    2:s##G(D$/'97D *	A 	A 	AA JS#MMOOOIIeE ,%(##))+++2    c                   l    e Zd ZdZdZej        ej        ej        dZ	 e
dde          gZdgZd
d	ZdS )cmd_domain_export_keytabz/Dump Kerberos keys of the domain into a keytab.z%prog <keytab> [options]	sambaoptscredoptsversionoptsz--principalzextract only this principalrb   keytabNc                 |    |                                 }t          d |          }|                    ||           d S )N)r   	principal)get_loadparmr   export_keytab)selfr   r   r   r   r   lpnets           r   runzcmd_domain_export_keytab.run   s?    ''))BdB--CVyAAAAAr   NNNN__name__
__module____qualname____doc__synopsisoptionsSambaOptionsCredentialsOptionsVersionOptionstakes_optiongroupsr   strtakes_options
takes_argsr    r   r   r   r      s        ==- !-2"1
 
 F='D3OOO
 Z
	B 	B 	B 	B 	B 	Br   r   c                   R    e Zd ZdZdZg Zej        ej        ej	        dZ
dgZddZdS )cmd_domain_infoz?Print basic info about a domain and the DC passed as parameter.z%prog <ip_address> [options]r   addressNc                 v   |                                 }	 t          |d |          }n## t          $ r t          d|z   dz             w xY w| j                            d|j        z             | j                            d|j        z             | j                            d|j        z             | j                            d|j	        z             | j                            d|j
        z             | j                            d|j        z             | j                            d	|j        z             d S )
NzInvalid IP address 'z'!zForest           : %s
zDomain           : %s
zNetbios domain   : %s
zDC name          : %s
zDC netbios name  : %s
zServer site      : %s
zClient site      : %s
)r   r    RuntimeErrorr   outfwriteforest
dns_domaindomain_namepdc_dns_namepdc_nameserver_siteclient_site)r   r   r   r   r   r   ress          r   r   zcmd_domain_info.run   s/   ##%%	H3BgFFCC 	H 	H 	H5?$FGGG	H	1CJ>???	1CNBCCC	1COCDDD	1C4DDEEE	1CL@AAA	1COCDDD	1COCDDDDDs	   (  ANNN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r      sj        II-HM ).-  JE E E E E Er   r   c                      e Zd ZdZdZej        ej        dZ e	ddd           e	dd	d
d           e	dd	dd           e	dd	dd           e	dd	dd           e	dd	dd           e	dd	dd           e	dd	dd           e	dd	dd           e	d d	d!d"           e	d#d	d$d%           e	d&d	d$d'           e	d(d)d*g d+d,d-.           e	d/d	d$d0           e	d1d	d2d3           e	d4d	d2d5           e	d6d	d7d8           e	d9dd:;           e	d<d)d=g d>d?d@.           e	dAd)dBg dCdDdE.           e	dFd)dGg dHdIdJ.           e	dKdLdMdNdOP           e	dQdRd           e	dSddT;          gZ
 e	dUd)g dVdWdXdYZ          gZe
                    e            ej                    r*e
                    e           e
                    e           g Z	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d`d]Zd^ Zd_ Zd[S )acmd_domain_provisionzProvision a domain.%prog [options]r   r   z--interactivezAsk for namesrQ   r`   z--domainrK   DOMAINzNetBIOS domain name to userM   z--domain-guidGUIDz!set domainguid (otherwise random)z--domain-sidSIDz set domainsid (otherwise random)z--ntds-guidz'set NTDS object GUID (otherwise random)z--invocationidz#set invocationid (otherwise random)z--host-nameHOSTNAMEzset hostnamez	--host-ip	IPADDRESSzset IPv4 ipaddressz
--host-ip6
IP6ADDRESSzset IPv6 ipaddressrc   SITENAMEzset site namez--adminpassrL   z(choose admin password (otherwise random)z--krbtgtpassz)choose krbtgt password (otherwise random)rd   rT   re   rf   BIND9_FLATFILErg   rh   zThe DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_FLATFILE uses bind9 text database to store zone information, BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (not recommended)rf   ri   z	--dnspassz&choose dns password (otherwise random)z--rootUSERNAMEzchoose 'root' unix usernamez--nobodyzchoose 'nobody' userz--users	GROUPNAMEzchoose 'users' groupz--blankz.do not add users or groups, just the structurerR   z--server-roleROLE)domain controllerdcmember servermember
standalonez^The server role (domain controller | dc | member server | member | standalone). Default is dc.r   --function-levelzFOR-FUN-LEVEL)200020032008rH   zyThe domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2008_R2 Native.rH   z--base-schemazBASE-SCHEMA)rH   2008_R2_oldrI   rJ   z;The base schema files to use. Default is (Windows) 2012_R2.rJ   z
--next-ridintNEXTRIDi  zGThe initial nextRid value (only needed for upgrades).  Default is 1000.)rN   rO   rj   rP   z--partitions-onlyzEConfigure Samba's partitions, but do not modify them (ie, join a BDC)z--use-rfc2307z/Use AD to store posix attributes (default = no)--use-xattrsyesnoauto[yes|no|auto]Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl when --use-ntvfs is set. auto tries to make an inteligent guess based on the user rights and system capabilitiesr   rN   rX   rO   rP   rj   NFc%           	      *   |                      d|          | _        |                                }%|%j        }&||}'n|                                 }'|'d}'t          | j                  dk    rd}|rddlm}( dd l})dNd}*	 |)	                                
                    d	d          d                                         }+n# t          $ r d }+Y nw xY w |*d
|+          },|,dv rt          d          	 |,
                    d	          d         }+n# t          $ r d }+Y nw xY w |*d|+          }|t          d           |*dd          } |*dd          }|dv rt          d          |dk    r& |*d|'          }|                                dv rd }'d }	  |(d          }-|                     |-          }.|.r| j                            d|.z             n/ |(d          }/|-|/k    s| j                            d           n|-}npn<|j                            d          },|,t          d          |t          d          |r'|                     |          }.|.rt          |.          n| j                            d           |dk    rt*          }0n)|dk    rt,          }0n|dk    rt.          }0n|dk    rt0          }0|dk    r||'}t2          }1|rt4          }1n	|rt6          }1|3t8          j                            |          st9          j        |           d}2|d k    rd!}2nk|d"k    r
|d!k    rd!}2n[|d!k    rt          d#          |d"k    r?|%                    d$          s)|r3tA          j!        t8          j        "                    |          %          }3nbtA          j!        t8          j        "                    t8          j        #                    |%                    d&                              %          }3	 	 tH          j%        &                    |%|3j'        d'd(tQ                      d)           d!}2n*# tR          $ r | j                            d*           Y nw xY w|3*                                 n# |3*                                 w xY w|2r| j                            d+           |tW          j,        |          }t[                      }4|#t]                      }#	 t_          | j        |4fi d,|&d-|d.|1d|,d/|d0|d1|d2|	d3|
d4|d5|d6|d7|d8|d9|d:|d;|d<|d=|d>|d?|d@|dA|dB|0dC|2dD|dE|%dF|dG| dHd!dI|!dJ|"dK|#dL|$}5n"# t`          $ r}6t          dM|6          d }6~6ww xY w|51                    | j                   d S )ONr;   )namequietnone   Tr   r   c                     |t          | d|dd           nt          | dd           t          j                                         t          j                                                            d          p|S )Nz [z]:  )end: 
)printsysrr   flushstdinreadlinerstrip)promptrj   s     r   askz%cmd_domain_provision.run.<locals>.asks  s    &9sCCCCCFFF,#6666
  """y))++22488CGCr   .Realm)Nru   zNo realm set!DomainzNo domain set!z$Server Role (dc, member, standalone)r   z=DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE)rf   zNo DNS backend set!z=DNS forwarder IP address (write 'none' to disable forwarding))Nr   zAdministrator password: z%s.
zRetype password: Sorry, passwords do not match.
realmz,Administrator password will be set randomly!r   r   r   rH   r   Fr   r--use-xattrs=no requires --use-ntvfs (not supported for production use).  Please re-run with --use-xattrs omitted.
posix:eadbdirprivate dirO:S-1-5-32G:S-1-5-32S-1-5-32nativezZYou are not root or your system does not support xattr, using tdb backend for attributes. znot using extended attributes to store ACLs and other metadata. If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.r   	targetdir
samdb_filldomain
domainguid	domainsidhostnamehostiphostip6sitenamentdsguidinvocationid	adminpass
krbtgtpassmachinepassdns_backenddns_forwarderdnspassrootnobodyusers
serverroledom_for_fun_leveluseeadbnext_ridr   	use_ntvfsuse_rfc2307skip_sysvolaclbase_schemaplaintext_secretsbackend_storebackend_store_sizezProvision failedN)2
get_loggerloggerr   
configfile_get_nameserver_iplenraw_argvr   socketgetfqdnr~   upper
IndexErrorr   lower_adminpass_issueerrfr   _lpgetinfor.   r/   r1   r2   r?   r@   rA   rw   pathisdirmakedirstempfileNamedTemporaryFileabspathdirnamesambantaclssetntaclr   r+   	Exceptionr}   r   dom_sidr   r   r;   r<   report_logger)7r   r   r   interactiver   domain_guid
domain_sid	ntds_guidr  	host_namehost_iphost_ip6r  siter	  r
  r  r  r  ldapadminpassr  r  r  r   blankserver_rolefunction_levelr  partitions_onlyr   
use_xattrsr  r  r  r  r  r  r   r   suggested_forwarderr   r#  r   rj   r   adminpassplainissueadminpassverifyr  r   eadbfilesessionresultes7                                                          r   r   zcmd_domain_provision.run<  s#   H oo;eoDD##%%-$"/"&"9"9";";"*&,#t}""K :	5''''''MMMD D D D ..**00a88;AACC   C))E
"""?333++c**1-   S7++F~"#3444#DdKKK#]_oppKj(("#8999... #$cex y y &&((N::*.'$(M!()C!D!D--n== IOOGeO4444&-g.A&B&BO)_<<	(JKKKK$2	  M%%g..E}"?333~"#3444 	M)))44E *"5)))* KKLLLV## 7v%% 7v%% 7y(( :***}/D/M
 	"%JJ 	"!J 7==++ 'I&&&DD6!!i5&8&8DD%  J K K K6!!"&&*>*>! p2rwy7Q7QRRR2rwrwWYW]W]^kWlWlGmGm7n7noooCL))"di*@*4*=*?*?*2	4 4 4
 !DD  C C CK$$  &B  C  C  C  C  CC 



 	KK  J  K  K  K!!)*55J "" 577M	6t{&F F F07FCL9F*4*F<AEFJP&F +6+F BLF )2		F
 '.gF
 8@xF )-F 8AyF -9LF ENIF +5*F CN+F ,7;F GTmF (/wF 6:TF CI&F &+UF +6+F J[IZF (,tF 7?hF DF2F R[QZF ,7;F HMuF ,7;F  2C1B!F" .;]#F$ 3E2D%FFF( ! 	6 	6 	611555	6 	T[)))))sh   A C CC4D DD>7P6 5Q5 6$QQ5 QQ5 5RA7U 
U6!U11U6c                    ddl m} d}|                    |          s| j                            d|z             dS d}	 t          |d          }|D ]\}|                    d          s|                                                                d         c ||	                                 S S 	 ||	                                 n# ||	                                 w w xY w| j                            d	|z             dS )
z5Grab the nameserver IP address from /etc/resolv.conf.r   )r-  z/etc/resolv.confzFailed to locate %sNr
nameserverzNo nameserver found in %s)
rw   r-  isfiler  warningrv   
startswithr   r~   r}   )r   r-  RESOLV_CONFhandlelines        r   r   z'cmd_domain_provision._get_nameserver_ip  s(   ({{;'' 	K 5 CDDD4		+s++F 0 0|44 zz||))++B///! "0 ! ! " 	7+EFFFFFs    AC C c                     t          |t                    r|                    d          }t          |          t          k     r
dt          z  S t          j        |          sdS dS )zTReturns error string for a bad administrator password,
        or None if acceptableutf8zdAdministrator password does not meet the default minimum password length requirement (%d characters)zBAdministrator password does not meet the default quality standardsN)
isinstancerY   decoder!  r=   r4  check_password_quality)r   r  s     r   r(  z%cmd_domain_provision._adminpass_issue  ss     i'' 	1!((00Iy>>222?() ) -i88 	% % 4r   )$NNNNNNNNNNNNNNNNNNNNNNNNNNNNNr   FNNFNN)r   r   r   r   r   r   r   r   r   r   r   ntvfs_optionsextendcommon_provision_join_optionsr4  is_ntvfs_fileserver_builtcommon_ntvfs_optionsr   r   r   r(  r   r   r   r   r      sr        H )-  	_\JJJz(0	2 	2 	2Xv7	9 	9 	9~He6	8 	8 	8}8V=	? 	? 	?h9	; 	; 	;}8Z"	$ 	$ 	${;(	* 	* 	*|(L(	* 	* 	*xh
#	% 	% 	%}8Z>	@ 	@ 	@~Hj?	A 	A 	AX7KPPPE (	) 	) 	) 	{:<	> 	> 	>xh
1	3 	3 	3z**	, 	, 	,yx*	, 	, 	,yD	F 	F 	FXv[[[t*	, 	, 	, 	!/::: P 	" 	" 	" 	X}DDDQ 	" 	" 	" 	|%D]	_ 	_ 	_"[dp	r 	r 	r|:kllls:Mz 	~H6K6K6K&i 	 	 	M 6777&u&(( ,1222]+++J.2 ##EH* H* H* H*TG G G.    r   r   c                       e Zd ZdZdZej        ej        ej        dZ	g Z
e
                    e           e
                    e            ej                    re
                    e           ddgZ	 	 	 	 	 	 d	dZdS )
cmd_domain_dcpromoz9Promote an existing domain member or NT4 PDC to an AD DC.z%%prog <dnsdomain> [DC|RODC] [options]r   r   r   r   role?NFc                 2   |                                 }|                    |          }t          |||j                  }|                     ||          }|                    d          }||                                }|dk    r<t          di d|d|d|d|d	|d
|d|d|d|	d|
d|d|ddd|d|d| d S |dk    r<t          di d|d|d|d|d	|d
|d|d|d|	d|
d|d|ddd|d|d| d S t          d|z            )Nserververboser   netbios nameDCr  rk  credsr   r   rA  netbios_namer   domain_critical_onlyr
  r  r  promote_existingTr  r  r  RODCz-Invalid role '%s' (possible values: DC, RODC)r   )
r   get_credentialsr   	ipaddressr  r+  r%  r   r   r   )r   r   roler   r   r   rk  rA  r   rr  r
  r  r  r   rm  r  r  r  r   rp  r   r  rq  s                          r   r   zcmd_domain_dcpromo.runB  sE    ##%%((,,%H$6777>>vvn--::<<D4<< ; ; ;66 ;&& ; ;"" ;VV ;;,8L;DMI;)=)=; !,; 8Ay; !,	;
 &*T;
 >O=N; #0-; (:'9; ; ; ; V^^ = = =VV =FF =%% =BB =vv =4=.:l=FOi=+?+?= #.+= :C= Q\P[= (,t	= @Q?P	=
 %2M= *<);= = = = NQUUVVVr   )NNNNNNNFNFNFFFNN)r   r   r   r   r   r   r   r   r   r   r   ra  common_join_optionsrb  r4  rc  rd  r   r   r   r   r   rf  rf  -  s        CC6H )-.  M,---6777&u&(( 31222G$J>B@D48)-:?37#W #W #W #W #W #Wr   rf  c                      e Zd ZdZdZej        ej        ej        dZ	 e
ddd          gZ e
ddd	
          gZ e
ddd
          gZe                    e           e                    e            ej                    re                    e            ej                    re                    e           ddgZ	 	 	 	 	 	 	 ddZdS )cmd_domain_joinz9Join domain as either member or backup domain controller.z,%prog <dnsdomain> [DC|RODC|MEMBER] [options]rg  rn   ro   rQ   r`   z--experimental-s4-memberzfPerform member joins using the s4 Net join_member. Don't choose this unless you know what you're doingrR   z--no-dns-updateszDisable DNS updatesr   rh  NFc                 >   |                                 }|                    |          }t          |||j                  }|                     ||          }|                    d          }||                                }||dk    r|r$|                    ||t          |
          \  }}}n|	                    d|           |                    d          dk    rG|	                    d|
                    |t          j        t          j        z  	          j                   |	                    d
d           |j        r|j        nt!                      }t#          j        dt&          j                            |                    5 }|                    d|j                   t&          j                            |          r3t'          j        |          j        }t'          j        |j        |           t'          j        |j        |           d d d            n# 1 swxY w Y   t;          j                    }|                    |           tA          |||          } |                     ||
||          \  }}| j!        "                    d|d|d           d S |dk    r.tG                      r tI          |||||||||	|
|||||           d S |dk    r.tG                      r tK          |||||||||	|
|||||           d S tM          d|z            )Nrj  rl  rn  MEMBER)r
  r   	workgroup	WORKGROUP)r   flagszserver roler   F)deleter   )r
  debugnoDnsUpdateszJoined domain z (z)
ro  )r  rk  rp  r   r   rA  rq  r   rr  r
  r  r  r  r  r  rt  z5Invalid role '%s' (possible values: MEMBER, DC, RODC))'r   ru  r   rv  r  r+  r%  join_memberr	   setfinddcr   NBT_SERVER_LDAPNBT_SERVER_DSr   r  r,   r0  r1  rw   r-  r3  dumpr   existsstatst_modechmodrenames3paramget_contextloads3_Netr)  r   r-   r   r   r   )!r   r   rw  r   r   r   rk  rA  r   rr  r
  r  experimental_s4_memberr  r   rm  no_dns_updatesr  r  r  r   rp  r   r  rq  join_passwordsidr   smb_conffmodes3_lps3_nets!                                    r   r   zcmd_domain_join.run  s    ##%%((,,%H$6777>>vvn--::<<D<48++% U47OOL*? + 5D 5- 5-1[[ w'''66+&&+55FF;

&"2"0 1 )3 )3 )33>@ @ @ }o666,.MM2==|~~0GOOH557 7 7 0:;GGE16***w~~h// /!wx008...Iafh///0 0 0 0 0 0 0 0 0 0 0 0 0 0 0  +--

8$$$uV<<<%+%7%7DO>EES &8 &U &U"k
 IOOOcccJKKKKKT\\n..\6&"VLI)= +y +&7"/'9; ; ; ; ; ; V^^ 0 0^VF%Bvli+?"-"-(9$1);= = = = = = VY]]^^^s   BH!!H%(H%)NNNNNNNFNFFNFFFFNN)r   r   r   r   r   r   r   r   r   r   r   r`  selftest_optionsr   ra  rx  rb  r4  rc  is_selftest_enabledr   r   r   r   r   rz  rz  h  sq       CC=H )-.  	 M	! 	! 	!M 	),J	K 	K 	K 	!,)	+ 	+ 	+M ,---6777&u&(( ,]+++ u "" /-...G$J>B@D48GK7<#37B_ B_ B_ B_ B_ B_r   rz  c                   n    e Zd ZdZdZej        ej        ej        dZ	 e
ddd          gZg Z	 	 dd
ZdS )cmd_domain_leavez1Cause a domain member to leave the joined domain.r   rg  z--keep-accountrQ   z3Disable the machine account instead of deleting it.rR   NFc                 *   |                                 }|                    |          }t          j                    }|j        r|j        nt                      }|                    |           t          ||          }	|	                    |           d S r  )	r   ru  r  r  r  r,   r  r  leave)
r   r   r   r   keep_accountr   rp  r  r  r  s
             r   r   zcmd_domain_leave.run  s    ##%%((,,#%%$&ME2==|~~

8u%%\"""""r   )NNNF)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r    s        ;; H )-.  	I	K 	K 	KM
 J=A	# 	# 	# 	# 	# 	#r   r  c            
           e Zd ZdZdZ edde           eddded	d
           edde           edddd           edddd          gZej	        ej
        ej        dZ	 	 	 	 ddZdS )cmd_domain_demotez4Demote ourselves from the role of Domain Controller.r   ra   z(writable DC to write demotion changes onrb   -H--URL%LDB URL for database or target serverURLHrP   rN   rO   destz--remove-other-dead-serverzMDead DC (name or NTDS GUID) to remove ALL references to (rather than this DC)r]   r^   r_   rQ   r`   rk   rl   rm   r   NFc	                    |                                 }	|                    |	          }
t          |
|	|j                  }|                     ||          }||#t          d|z  t                      |
|	          }nt          |t                      |
|	          }	 t          j        |||           n)# t          j        $ r}t          d|z            d }~ww xY wd S |	
                    d          }t          |t                      |
|	          }|s|                    ddd	g
          }t          |          dk    rt          d          t          |          dk    rt          d          d }|D ]I}t          |d	                                                   |                                k    r
|d         } nJ|                                }|                    t          |                                          t"          j        d|z  dg          }t          |          dk    s
d|d         vrt          d|z            |d         j        }t)          t          |d         d                             }|                    dt          |          z  dg          }t          |          dk    rt          dt          |          z            | j                            d|z             t/          ||	|
          \  }}}| j                            d           t#          j                    }|d         j        |_        |t2          z  s|                                s|t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           | j                            d|z             |                                |                                |                                 fD ]D}tC          j"                    }t          |          |_        tC          j#                    }||_$        tB          j%        |_&        tO          j(        |          |_)        	 |*                    |d|           # tV          $ r}|j,        \  }}|tZ          j.        k    rn| j                            d|z             |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t          dt          |          z  |          Y d }~>d }~ww xY w	 t          d|z  t                      |
|	          } | j                            d           |                     t          | /                                          d|0                                z  dg          }|d         j        }!t)          t          |d         d                             }"n# tb          $ r}|t2          z  s}|                                si| j                            d            |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t          d!|          d }~ww xY wt          |          dk    r|t2          z  s}|                                si| j                            d"           |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t          d#|0                                z            |"}#|"td          tf          z  th          z   z  }"|"tj          z  }"t#          j                    }|!|_        t#          j        d$|"z  t"          j        d          |d<   	 |                     |           n# tb          $ r}|t2          z  s}|                                si| j                            d"           |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t          d!|          d }~ww xY w|j        6                                }$|d         j        7                                }%d%|%z  }&d}'t          |&          }(| 8                    | 9                                tt          j;                  })|                     |)|&t"          j<        &          }t          |          dk    r|                     |)d'|&|'fz  t"          j<        &          }t          |          dk    rK|'d(k     rE|'dz   }'|                     |)d'|&|'fz  t"          j<        &          }t          |          dk    r|'d(k     E|'d(k    r|t2          z  s}|                                si| j                            d            |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t#          j                    }|!|_        t#          j        d$|"z  t"          j        d          |d<   |                     |           t          d)t          |!          |&|&|'d*z
  fz            d'|&|'fz  }(	 t#          j=        | |(d+t          |)                    }*| >                    |!|*           n# tb          $ r}|t2          z  s}|                                si| j                            d            |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t#          j                    }|!|_        t#          j        d$|"z  t"          j        d          |d<   |                     |           t          d,t          |!          d-t          |*          |          d }~ww xY w|?                                }+|                                  },	 tC          j@                    }t          |+          |_A        t          |,          |_/        d|_B        |C                    |d|           nI# tV          $ r;}-|-j,        \  }}|t2          z  s}|                                si| j                            d            |t6          z  }t#          j        t          |          t"          j        d          |d<   |                    |           t#          j                    }|*|_        t#          j        d$|"z  t"          j        d          |d<   |                     |           | >                    |*|!           |tZ          j.        k    rt          d.|+d/|-          t          d0|+d1|-          d }-~-ww xY wt          jD        | ||%           d2d3|	
                    d4          z  d5d6fD ]Y}.	 | E                    t#          j=        | |.d+t          |*                               ># t"          jF        $ r
}/Y d }/~/Rd }/~/ww xY wt          jG        | ||H                                d78           | j                            d9           d S ):Nrj  rl  	ldap://%surlsession_infocredentialsr   zDemote failed: %srn  z.(&(objectClass=computer)(serverReferenceBL=*))dnsHostNamer   )
expressionattrsr   zUnable to search for serversr   z%You are the last server in the domainz(objectGUID=%s)r   basescoper  r  zFailed to find options on %sz(fSMORoleOwner=%s)zsearch_options:1:2)r  controlszaCurrent DC is still the owner of %d role(s), use the role command to transfer roles to another DCz,Using %s as partner server for the demotion
z!Deactivating inbound replication
z0Asking partner server %s to synchronize from us
zgError while replicating out last local changes from '%s' for demotion, re-enabling inbound replication
z6Error while sending a DsReplicaSync for partition '%s'z#Changing userControl and container
z)(&(objectClass=user)(sAMAccountName=%s$))userAccountControlr  r  r  z6Error while demoting, re-enabling inbound replication
z$Error while changing account controlz5Error while demoting, re-enabling inbound replicationz@Unable to find object with samaccountName = %s$ in the remote dcz%dzCN=%s)r  r  r  z%s-%dd   zOUnable to find a slot for renaming %s, all names from %s-1 to %s-%d seemed used	   ,zError while renaming z to zThe DC z= is not present on (already removed from) the remote server: z(Error while sending a removeDsServer of r   z$CN=Enterprise,CN=NTFRS SubscriptionszCN=%s, CN=NTFRS Subscriptionsr   z?CN=Domain system Volumes (SYSVOL Share), CN=NTFRS SubscriptionszCN=NTFRS SubscriptionsT)ignore_no_namezDemote successful
)Ir   ru  r   rv  r  r   r   r(   DemoteExceptionr   r+  searchr!  r   r'  get_ntds_GUIDget_config_basednldbSCOPE_SUBTREEdnr   r)  r   r'   Messager5   am_rodcr6   MessageElementFLAG_MOD_REPLACEmodifyget_schema_basednget_root_basednr   DsReplicaObjectIdentifierDsReplicaSyncRequest1naming_contextDRSUAPI_DRS_WRIT_REPr   r   r   source_dsa_guidDsReplicaSyncr   argsr   WERR_DS_DRA_NO_REPLICA	domain_dnr%  r7  r8   r9   r:   r7   parentget_rdn_valueget_wellknown_dnget_default_basednrF   DS_GUID_COMPUTERS_CONTAINERSCOPE_ONELEVELDnr  get_serverNameDsRemoveDSServerRequest1	server_dncommitDsRemoveDSServerremove_sysvol_referencesr  LdbErrorremove_dns_referenceshost_dns_name)0r   r   r   r   rk  remove_other_dead_serverr  rm  r   r   rp  r   r  samdbr   rq  r   rP  r=  msgntds_dndsa_optionsdrsuapiBinddrsuapi_handlesupportedExtensionsnmsgpartncreq1e1werrrK   remote_samdbdc_dnuacolduacr  dc_namerdninewrdncomputer_dnnewdnserver_dsa_dnr   e3sls0                                                   r   r   zcmd_domain_demote.run  s    ##%%((,,%H$6777>>#/!+"6+9+;+;*/B8 8 8 !.2B2BPUZ\]]]>#E63KLLLL, > > >"#6#<===>Fvvn--!.*:*:RTUUU 	,,*Zcprxby,zzCCA"#ABBBCA"#JKKKF  qy>>''))\-?-?-A-AAA}-FE B ''))	llE$;$;$=$= > >!$!2?PS\?\"+  . . s88q==ISV33=	IJJJa&)#c!fY/0011ll&:S\\&I%9$:  < < s88q==  ,  #3xx ( ) ) )
 		G 	  	  	 =LVUWY^=_=_:n&9	<==={}}a&)BB 	yEMMOO 	y>>K!0[1A1A3CWYbccDOLLIOOO$% & & &00220022..002 y y 688D		466&(#&;'+y';';$y--naFFFF# y y y%'WNT6v<<<	@BFGH H H $'JJ*-*<S=M=MsOcen*o*oYT****+cfijnfofo+oqwxxx y	J [6%9.<.>.>-2r; ; ;L IOOBCCC%%3|/E/E/G/G+H+H1\&2&8&8&:&:2;-A,B & D DC FIEc#a&!567788CC 	J 	J 	J"FF #PUP]P]P_P_ #	MO O OBB"%"4S5E5EsG[]f"g"gYT"""EqIII	J HHMM"FF #PUP]P]P_P_ #	KM M MBB"%"4S5E5EsG[]f"g"gYT"""  35A5G5G5I5I J K K K (*++, - 	- 	++kmm$'$6tcz7:7K7K%M %M !
	J$$$$ 	J 	J 	J"FF #PUP]P]P_P_ #	KM M MBB"%"4S5E5EsG[]f"g"gYT"""EqIII	J a&)))++ S"33++--,. . !!{s#J\!]]HHMM%%;7cSTXCU,/,> & @ @Cc((a--AGGE")){wRUWXQYGY030B * D D c((a--AGG
 Cxx#&JJ 'TYTaTaTcTc 'IOOQS S S#FFK&)&8[9I9I3K_aj&k&kDOLL&&&kmm,/,>tcz?B?S?S-U -U() ##C(((" $O$'JJS!a%#@$A B B B Qx'F	^F<FFFC<L<L<L)MNNEu---- 	^ 	^ 	^"FF #PUP]P]P_P_ #	MO O OBB"%"4S5E5EsG[]f"g"gYT"""+--CCF(+(:4#:;>;O;O)Q )QC$% $$$,#e****cRWjjjY[\]]]!	^$ ,,..--//	8355D //DN [[DNDK((DAAAA 	8 	8 	8WNT6"FF #PUP]P]P_P_ #	MO O OBB"%"4S5E5EsG[]f"g"gYT"""+--CCF(+(:4#:;>;O;O)Q )QC$% $$$u---v444"l$1MM22$7 8 8 8 #l$1MM22$7 8 8 8-	84 	*<III 91BFF7OOCS*, 	 	A##CF<67aaU+D%F %F G G G G<    	'fe>Q>Q>S>S7;	= 	= 	= 	= 		-.....s   B6 6CCCR
U#B'UUB>X 
Z>"BZ99Z>'_= =
b#Bbb#2=l1 1q<Dqq9As xD6xx:zz&!z&)NNNNNNFF)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r    s        >> H 	z JQTUUUtW#JQT3	( 	( 	(+ 3CIL	N 	N 	NtYZEEEt[|LIIIM ).-  ,0%)-1!&R/ R/ R/ R/ R/ R/r   r  c            	           e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
ddd           e
ddg dd           e
ddg dd          gZdgZ	 	 ddZdS )cmd_domain_levelz(Raise domain and forest function levels.z&%prog (show|raise <options>) [options]r   r  r  r  r  r  r  r]   r^   r_   rQ   r`   z--forest-levelrT   )r   r   rH   rI   rJ   zBThe forest function level (2003 | 2008 | 2008_R2 | 2012 | 2012_R2)rN   rX   rP   z--domain-levelzBThe domain function level (2003 | 2008 | 2008_R2 | 2012 | 2012_R2)
subcommandNFc	                 $   |                                 }	|                    |	d          }
t          |t                      |
|	          }|                                }|                    d|                                z  t          j        dg          }t          |          dk    sJ |                    |t          j        ddg          }t          |          dk    sJ |                    d	|                                z  t          j
        d
dg          }t          |          dk    sJ t          }t          }d|d         v r!t          |d         d         d                   }d|d         v r!t          |d         d         d                   }t          |d         d         d                   }d }|D ]J}d|v r=|t          |d         d                   |k     rt          |d         d                   }Ct          } |t          k     s|t          k     rt          d          |t          k     rt          d          ||k    rt          d          ||k    rt          d          |dk    r!|                     d|z             |t          k    r|dk    r|                     d           |t          k    r|dk    r|                     d           |t          k    r|dk    r|                     d           |                     d           |t          k    rd}nV|t          k    rd}nH|t           k    rd}n:|t"          k    rd}n,|t$          k    rd}n|t&          k    rd}n|t(          k    rd}nd}|                     d|z              |t          k    r	|dk    rd }nj|t          k    r	|dk    rd}nV|t          k    rd}nH|t           k    rd}n:|t"          k    rd}n,|t$          k    rd}n|t&          k    rd}n|t(          k    rd}nd}|                     d!|z              |t          k    rd}nH|t           k    rd}n:|t"          k    rd}n,|t$          k    rd}n|t&          k    rd}n|t(          k    rd}nd}|                     d"|z              d S |d#k    rag }||dk    rt           }n7|dk    rt"          }n)|d$k    rt$          }n|dk    rt&          }n|d%k    rt(          }||k    r|dk    rt          d&          ||k    rt          d'          |dk    r1t          j                    }t          j        ||          |_        t          j        d(t          j        d          |d<   |                    |           t          j                    }t          j        |d)|	                    d*          z   d+|                                z  z             |_        t          j        d(t          j        d          |d<   	 |                    |           n7# t          j        $ r%}|j        \  }}|t          j        k    r Y d }~nd }~ww xY wt          j                    }t          j        ||          |_        t          j        t?          |          t          j        d          |d<   |                    |           t          j                    }t          j        |d)|	                    d*          z   d+|                                z  z             |_        t          j        t?          |          t          j        d          |d<   	 |                    |           n7# t          j        $ r%}|j        \  }}|t          j        k    r Y d }~nd }~ww xY w|}|                     d,           ||dk    rt           }n7|dk    rt"          }n)|d$k    rt$          }n|dk    rt&          }n|d%k    rt(          }||k    rt          d-          ||k    rt          d.          t          j                    }t          j        |d|                                z            |_        t          j        t?          |          t          j        d          |d<   |                    |           |                     d/           |                     d0           |                     d1!                    |                     d S t          d2|z            )3NT)fallback_machiner  CN=Partitions,%szmsDS-Behavior-Versionr  r  r   nTMixedDomainzCN=Sites,%sz(objectClass=nTDSDSA))r  r  r  r   zSDomain and/or forest function level(s) is/are invalid. Correct them or reprovision!zFLowest function level of a DC is invalid. Correct this or reprovision!zVForest function level is higher than the domain level(s). Correct this or reprovision!zdDomain function level is higher than the lowest function level of a DC. Correct this or reprovision!showz0Domain and forest function level for domain '%s'z|
ATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2000 (Native). This isn't supported! Please raise!z|
ATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2000 (Native). This isn't supported! Please raise!z
ATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!ru   r   z02003 with mixed domains/interim (NT4 DC support)r   r   z2008 R2rI   z2012 R2zhigher than 2012 R2z!Forest function level: (Windows) z2000 mixed (NT4 DC support)z!Domain function level: (Windows) z)Lowest function level of a DC: (Windows) raiserH   rJ   zGDomain function level can't be smaller than or equal to the actual one!zMDomain function level can't be higher than the lowest function level of a DC!0zCN=r}  z,CN=Partitions,%szDomain function level changed!zGForest function level can't be smaller than or equal to the actual one!zdForest function level can't be higher than the domain function level(s). Please raise it/them first!zForest function level changed!!All changes applied successfully!r   z4invalid argument: '%s' (choose from 'show', 'raise'))"r   ru  r   r   r  r  r  r  
SCOPE_BASEr!  r  r.   r   r   messager0   r/   r1   r2   r3   r4   r  r  r  r  r  r  r+  r  r  ERR_UNWILLING_TO_PERFORMr   appendjoin)r   r  r  forest_leveldomain_levelr   r   r   r   r   rp  r  r  
res_forest
res_domainres_dc_slevel_forestlevel_domainlevel_domain_mixedmin_level_dcr  outstrmsgsnew_level_domainmrP  enumemsge2new_level_forests                                 r   r   zcmd_domain_level.run2  s/
   ##%%((d(CC!.*:*:"'B0 0 0 OO%%	\\"4u7N7N7P7P"P(+?V>W " Y Y
:!####\\)3>)@/(R " T T
:!####<<0G0G0I0I I&)&7D['>&?   A A 8}}!!!! /."jm33z!}-DEaHIIL"jm33z!}-DEaHIIL A!?!BCC 	 	C&#--'3s3J/KA/N+O+OR^+^+^#&s+B'CA'F#G#GL6111\D[5[5[tuuu111ghhh,&&wxxx,&&   F  G  G  GLLKiWXXX666;MQR;R;R  ]  ^  ^  ^666;MQR;R;R  ]  ^  ^  ^666;MQR;R;R  ~      LL666!>>>K!888!888!;;;"!888!;;;".LL<vEFFF666;MQR;R;R6!888=OST=T=T!>>>K!888!888!;;;"!888!;;;".LL<vEFFF666!888!888!;;;"!888!;;;".LLDvMNNNNN7""D'6))'>$$!V++'>$$!Y..'A$$!V++'>$$!Y..'A$#|338Ja8O8O&'pqqq#l22&'vwww &**A6%33AD),);C<?<PRa*c *cAo&LLOOOA6%1D1D)DGZ]b]t]t]v]vGv)vwwAD),);C<?<PRa*c *cAo&"Q< " " "'(vt3#???! @????" KMMveY//-0-?())3+?+.- .-)* QKMMveURVVK-@-@%@ 3e6M6M6O6O O&P Q Q-0-?())3+?+.- .-)*LLOOOO|   #%7LT4s;;; <;;;;
  0<==='6))'>$$!V++'>$$!Y..'A$$!V++'>$$!Y..'A$#|33&'pqqq#l22&  (N  O  O  OKMMve%7%:Q:Q:S:S%STT-0-?())3+?+.- .-)* Q<===KK;<<<LL4)))))UXbbcccs0   X Y)Y		Y]% %^4^^)NNNFNNNr   r   r   r   r  r    s       227H ).-  	tW#JQT3	( 	( 	(tYZEEEh8f8f8fX	Z 	Z 	Zh8f8f8fX	Z 	Z 	ZM JFJDHPd Pd Pd Pd Pd Pdr   r  c                   l    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZddZd
S ) cmd_domain_passwordsettings_showz1Display current password settings for the domain.r   rg  r  r  r  r  r  r  Nc                    |                                 }|                    |          }t          |t                      ||          }|                                }|                    |t          j        g d          }	t          |	          dk    sJ 	 t          |	d         d         d                   }
t          |	d         d         d                   }t          |	d         d         d                   }t          |	d         d	         d                   }t          |	d         d
         d                   }t          |	d         d         d                   }t          |	d         d         d                   }t          |	d         d         d                   }n"# t          $ r}t          d|          d }~ww xY w|                     d|z             |                     d           |
t          z  dk    r|                     d           n|                     d           |
t           z  dk    r|                     d           n|                     d           |                     d|z             |                     d|z             |                     d|z             |                     d|z             |                     d|z             |                     d|z             |                     d|z             d S )Nr  )pwdPropertiespwdHistoryLengthminPwdLength	minPwdAge	maxPwdAgelockoutDurationlockoutThresholdlockOutObservationWindowr  r   r   r'  r(  r)  r*  r+  r-  r,  r.  z'Could not retrieve password properties!z$Password information for domain '%s'ru   zPassword complexity: onzPassword complexity: offzStore plaintext passwords: onzStore plaintext passwords: offzPassword history length: %dzMinimum password length: %dzMinimum password age (days): %dzMaximum password age (days): %dz#Account lockout duration (mins): %dz(Account lockout threshold (attempts): %dz&Reset account lockout after (mins): %d)r   ru  r   r   r  r  r  r  r!  r   r#   r"   r7  r   r  r   r   )r   r  r   r   r   r   rp  r  r  r   	pwd_propspwd_hist_lencur_min_pwd_lencur_min_pwd_agecur_max_pwd_agecur_account_lockout_thresholdcur_account_lockout_durationcur_reset_account_lockout_afterrP  s                      r   r   z$cmd_domain_passwordsettings_show.run  s   ##%%((,,!.*:*:"'B0 0 0 OO%%	ll9CN"> "> ">  ? ? 3xx1}}}}	MCF?3A677Is1v&89!<==L!#a&"8";<<O/A{0CA0FGGO/A{0CA0FGGO,/A7I0J10M,N,N) ,=SVDU=VWX=Y+Z+Z(.?AGa@bcd@e.f.f++ 	M 	M 	MH!LLL	M 	;iGHHHR..!33LL23333LL344466!;;LL89999LL9:::2\ABBB2_DEEE6HIII6HIII:=YYZZZ?B__```=@__`````s   DF   
F?*F::F?r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%  r%    s        ;; H )-.  	tW#JQT3	( 	( 	(M
-a -a -a -a -a -ar   r%  c                      e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
ddd           e
ddg dd           e
ddg dd           e
dde           e
dde           e
dde           e
dde           e
dd e           e
d!d"e           e
d#d$e          gZ	 	 	 	 	 d(d'Zd%S ))cmd_domain_passwordsettings_seta  Set password settings.

    Password complexity, password lockout policy, history length,
    minimum password length, the minimum and maximum password age) on
    a Samba AD DC server.

    Use against a Windows DC is possible, but group policy will override it.
    z%prog <options> [options]rg  r  r  r  r  r  r  r]   r^   r_   rQ   r`   z--complexityrT   )onoffrj   z=The password complexity (on | off | default). Default is 'on'r  z--store-plaintextzStore plaintext passwords where account have 'store passwords with reversible encryption' set (on | off | default). Default is 'off'z--history-lengthzBThe password history length (<integer> | default).  Default is 24.rb   z--min-pwd-lengthzAThe minimum password length (<integer> | default).  Default is 7.z--min-pwd-agezFThe minimum password age (<integer in days> | default).  Default is 1.z--max-pwd-agezGThe maximum password age (<integer in days> | default).  Default is 43.z--account-lockout-durationzThe the length of time an account is locked out after exeeding the limit on bad password attempts (<integer in mins> | default).  Default is 30 mins.z--account-lockout-thresholdzThe number of bad password attempts allowed before locking out the account (<integer> | default).  Default is 0 (never lock out).z--reset-account-lockout-afterzuAfter this time is elapsed, the recorded number of attempts restarts from zero (<integer> | default).  Default is 30.NFc                 4   |                                 }|                    |          }t          |t                      ||          }|                                }g }t          j                    }t          j        ||          |_        t          |
                                          }|                                }|                                }|R|dk    s|dk    r |t          z  }|                    d           n&|dk    r |t           z  }|                    d           |R|dk    s|dk    r |t          z  }|                    d           n&|dk    r |t           z  }|                    d           ||0t          j        t#          |          t
          j        d	          |d	<   |x|dk    rd
}nt          |          }|dk     s|d
k    rt'          d          t          j        t#          |          t
          j        d          |d<   |                    d           |x|dk    rd}nt          |          }|dk     s|dk    rt'          d          t          j        t#          |          t
          j        d          |d<   |                    d           ||dk    rd}nt          |          }|dk     s|dk    rt'          d          t          |dz             }t          j        t#          |          t
          j        d          |d<   |                    d           ||dk    rd}nt          |          }|dk     s|dk    rt'          d          |dk    rt(          }nt          |dz             }t          j        t#          |          t
          j        d          |d<   |                    d           |	|	dk    rd}	nt          |	          }	|	dk     s|	d k    rt'          d!          |	dk    rt(          }nt          |	d"z             }t          j        t#          |          t
          j        d#          |d#<   |                    d$           |
]|
dk    rd}
nt          |
          }
t          j        t#          |
          t
          j        d%          |d%<   |                    d&           ||dk    rd}nt          |          }|dk     s|d k    rt'          d!          |dk    rt(          }nt          |d"z             }t          j        t#          |          t
          j        d'          |d'<   |                    d(           |s|r>t+          |          }t+          |          }|dk    r||k    rt'          d)||fz            t-          |          dk    rt'          d*          |                    |           |                    d+           |                     d,                    |                     d S )-Nr  r:  rj   zPassword complexity activated!r;  z Password complexity deactivated!z;Plaintext password storage for changed passwords activated!z=Plaintext password storage for changed passwords deactivated!r'     r   z8Password history length must be in the range of 0 to 24!r(  z Password history length changed!      z8Minimum password length must be in the range of 0 to 14!r)  z Minimum password length changed!r   i  z6Minimum password age must be in the range of 0 to 998!g   8M%iBr*  zMinimum password age changed!+   i  z6Maximum password age must be in the range of 0 to 999!r+  zMaximum password age changed!   i z8Maximum password age must be in the range of 0 to 99999!g    Ar,  z!Account lockout duration changed!r-  z"Account lockout threshold changed!r.  z0Duration to reset account lockout after changed!zIMaximum password age (%d) must be greater than minimum password age (%d)!z7You must specify at least one option to set. Try --helpr  r   )r   ru  r   r   r  r  r  r  r  r   get_pwdPropertiesget_maxPwdAgeget_minPwdAger   r  r   r  r   r  r   r!   r#   r!  r  r  r  )r   r  min_pwd_agemax_pwd_ager   
complexitystore_plaintexthistory_lengthmin_pwd_lengthaccount_lockout_durationaccount_lockout_thresholdreset_account_lockout_afterr   r   r   r   rp  r  r  r  r  r/  max_pwd_age_ticksmin_pwd_age_ticksr0  min_pwd_lenaccount_lockout_duration_ticks!reset_account_lockout_after_tickss                               r   r   z#cmd_domain_passwordsettings_set.runo  s   
 ##%%((,,!.*:*:"'B0 0 0 OO%%	KMMveY''//1122	 "//11!//11!T!!Z9%<%<%(??	<====u$$%*A)AB	>???&$&&/Y*F*F%(GG	YZZZZ E))%*I)IJ	[\\\!_%@!$!3C	NN474H/"[ "[Ao %**!">22a<"#4#4"#]^^^$'$6s<7H7H7:7KM_%a %aA !KK:;;;%**!.11Q+"2"2"#]^^^ # 23{3C3C363G!Y !YAnKK:;;;"i''!+..Q+"3"3"#[\\\ "%[4F%G!H!H H /4E0F0F030DkS SAkNKK7888"i'' !+..Q+"3"3"#[\\\ a$3!!%(8J)K%L%L$L! /4E0F0F030DkS SAkNKK7888#/'944+-((+./G+H+H('!++/G%/O/O"#]^^^ (1,,1@..256NRZ6[2\2\1\.#&#5c:X6Y6Y696JL]$_ $_A KK;<<<$0(I55,-)),/0I,J,J)$'$6s;T7U7U7:7KM_%a %aA !KK<===&2*i77.0++.12M.N.N+*Q..2MPU2U2U"#]^^^ +a//4C11589TX`9a5b5b4b1,/,>sCd?e?e?B?SUo-q -qA()KKJKKK 	M+ 	M ,,=>>K+,=>>KaK;$>$>"#nr}  @K  rL  $L  M  M  Mq66Q;;XYYYQ7888TYYt__%%%%%r   )NNNFNNNNNNNNNNr7  r   r   r   r9  r9  E  s         +H )-.  	tW#JQT3	( 	( 	(tYZEEE~H6N6N6NS	U 	U 	U";S;S;S [	\ 	\ 	\!X_b	d 	d 	d!W^a	c 	c 	c\cf	h 	h 	h]dg	i 	i 	i+ l  sv	w 	w 	w, X  _b	c 	c 	c. L  SV	W 	W 	W)M0 9=OSZ^GK	c& c& c& c& c& c&r   r9  c                   d    e Zd ZdZi Z e            ed<    e            ed<    e            ed<   dS )cmd_domain_passwordsettingsz Manage password policy settings.psor
  r  N)r   r   r   r   subcommandsrB   r%  r9  r   r   r   rT  rT    sT        **K88::K::<<K88::Kr   rT  c                      e Zd ZdZdZej        ej        dZ e	dddd           e	d	dd
d           e	dddd           e	dddd           e	dddd           e	dddg ddd          gZ
 e	ddg ddd d!"          gZ ej                    r*e
                    e           e
                    e           d#gZ	 	 	 d'd&Zd$S )(cmd_domain_classicupgradezUpgrade from Samba classic (NT4-like) database to Samba AD DC database.

    Specify either a directory with all Samba classic DC databases and state files (with --dbdir) or
    the testparm utility from your classic installation (with --testparm).
    z"%prog [options] <classic_smb_conf>r   z--dbdirrK   r\   z+Path to samba classic DC database directoryrM   z
--testparmPATHzPath to samba classic DC testparm utility from the previous installation.  This allows the default paths of the previous installation to be followedr[   zCPath prefix where the new Samba 4.0 AD domain should be initialisedr]   r^   r_   rQ   r`   rk   rl   rm   rd   rT   re   r   a  The DNS server backend. SAMBA_INTERNAL is the builtin name server (default), BIND9_FLATFILE uses bind9 text database to store zone information, BIND9_DLZ uses samba4 AD to store zone information, NONE skips the DNS setup entirely (this DC will not be a DNS server)rf   ri   r   r   r   r   r   r   r   NFc           	         t           j                            |          st          d|z            |r1t           j                            |          st          d|z            |r1t           j                            |          st          d|z            |s|st          d          |                     ||          }|r|r|                    d           d }|                                }t          j                    }|j	        r|
                    d|j	                   |3t           j                            |          st          j        |           d}|d	k    rd
}nf|dk    r
|d
k    rd
}nV|d
k    rt          d          |dk    r:|                    d          s$|r3t          j        t           j                            |                    }nbt          j        t           j                            t           j                            |                    d                                        }	 	 t$          j                            ||j        ddt-                      d           d
}n%# t.          $ r |                    d           Y nw xY w|                                 n# |                                 w xY wi }|r||d<   ||d<   ||d<   |dz   |d<   ntt5          ||d          |d<   t5          ||d          |d<   t5          ||d          |d<   t5          ||d          |d<   t7          |d                   dk    r|d         |d<   |D ]}|
                    |||                    |                    d           |                    |           t;          ||          }|                    d           t=          |||t?                      ||
|           d S )NzFile %s does not existz"Testparm utility %s does not existzDirectory %s does not existz'Please specify either dbdir or testparmrl  z2both dbdir and testparm specified, ignoring dbdir.r   Tr   Fr   r   r   r   r   r   r   r   zYou are not root or your system does not support xattr, using tdb backend for attributes. If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.zstate directoryzlock directoryz
/smbpasswdzsmb passwd filer   zReading smb.confProvisioning)r  r  r  r  ) rw   r-  r  r   r  rV  r   r  r  r   r  r.  mkdirr+  r0  r1  r2  r3  r4  r5  r6  r   r+   r7  r,  r}   r   r!  r  r$   r&   r   )r   r   r   dbdirr   r   rm  rG  r   r   r  r  r  r   s3confrL  tmpfilepathsr   samba3s                       r   r   zcmd_domain_classicupgrade.runL  sj    w~~g&& 	C7'ABBB 	PBGNN844 	PChNOOO 	F.. 	F<uDEEE 	JX 	JHIII>> 	X 	NNOPPPE##%%$&&? 	1JJw	000 7==++ $###DD6!!i5&8&8DD%  J K K K6!!&**\*B*B! s"5"'//):T:TUUU"5"'//"'//Z\Z`Z`anZoZoJpJp:q:qrrr 
NL))"gl*@*4*=*?*?*2	4 4 4
 !DD  N N NKK !M N N N N NN
   	C',E#$#(E- &+E"#',|';E#$$'7'K\']']E#$#3Hg}#U#UE- '7'K\']']E#$&6xJZ&[&[E"# 5*+,,11+01A+B'( 	$ 	$AJJq%(#### 	&'''G((N###FFINDTDT$(kY	X 	X 	X 	X 	X 	Xs*   7I: 9J4 :JJ4 JJ4 4K
)NNNNFFr   NNNF)r   r   r   r   r   r   r   r   r   r   r   r`  r4  rc  ra  rd  r   r   r   r   r   rX  rX    s         4H )-  	yxA	C 	C 	C|(F k	l 	l 	l}8UY	[ 	[ 	[tYZEEEt[|LIIIX7KPPPV (	) 	) 	)M& 	~H6K6K6K&i 	 	 	M 'u&(( ,1222]+++JEIW[(-XX XX XX XX XX XXr   rX  c                        e Zd Zej        ZdZdS )cmd_domain_samba3upgradeTN)r   r   r   rX  r   hiddenr   r   r   rc  rc    s        '/G
 FFFr   rc  c                       e Zd Zd ZdS )LocalDCCredentialsOptionsc                 J    t           j                            | |d           d S )Nzlocal-dc)special_name)r   r   __init__)r   parsers     r   ri  z"LocalDCCredentialsOptions.__init__  s&    "++D&z+RRRRRr   Nr   r   r   ri  r   r   r   rf  rf    s(        S S S S Sr   rf  c                      e Zd ZdZd Zd Zd Z G d de          Z G d de          Z	 G d	 d
e          Z
d Zd Zd Zd Z	 	 d%dZd Zd Zd Zd Zd Zd Zd Zd Zd Zd&dZd&dZd Zd Zd Zd  Zd! Zd" Z d'd$Z!d#S )(DomainTrustCommandList domain trusts.c                     t          j        |            d | _        d | _        d | _        d | _        d | _        d | _        d | _        d S r  )	r   ri  local_lplocal_serverlocal_binding_stringlocal_credsremote_serverremote_binding_stringremote_credsr   s    r   ri  zDomainTrustCommand.__init__  sP     $(!!%)" r   c                 4    t          j        |          j        S r  )ctypesc_uint32value)r   vs     r   _uint32zDomainTrustCommand._uint32  s    q!!''r   c                 ^    |dS |                      |j        d                   }||k    rdS dS )NFr   T)r}  r  )r   runtimevalerr32s       r   check_runtime_errorz&DomainTrustCommand.check_runtime_error  s6    ?5W\!_--C<<4ur   c                       e Zd Zd ZdS )$DomainTrustCommand.LocalRuntimeErrorc                     |                     |j        d                   }|j        d         }d|j        |||fz  }t          j        | |           d S )Nr   r   z%LOCAL_DC[%s]: %s - ERROR(0x%08X) - %s)r}  r  rq  r   ri  exception_selfr   r  r  r  errstrr  s          r   ri  z-DomainTrustCommand.LocalRuntimeError.__init__  sX    LLa11E\!_F9#WeV== =C!.#66666r   Nrk  r   r   r   LocalRuntimeErrorr    #        	7 	7 	7 	7 	7r   r  c                       e Zd Zd ZdS )%DomainTrustCommand.RemoteRuntimeErrorc                     |                     |j        d                   }|j        d         }d|j        |||fz  }t          j        | |           d S )Nr   r   z&REMOTE_DC[%s]: %s - ERROR(0x%08X) - %s)r}  r  rt  r   ri  r  s          r   ri  z.DomainTrustCommand.RemoteRuntimeError.__init__  sX    LLa11E\!_F:$guf>> >C!.#66666r   Nrk  r   r   r   RemoteRuntimeErrorr    r  r   r  c                       e Zd Zd ZdS ) DomainTrustCommand.LocalLdbErrorc                     |j         d         }|j         d         }d|j        |||fz  }t          j        | |           d S )Nr   r   z!LOCAL_DC[%s]: %s - ERROR(%d) - %s)r  rq  r   ri  )r  r   	ldb_errorr  errvalr  r  s          r   ri  z)DomainTrustCommand.LocalLdbError.__init__  sN    ^A&F^A&F5#Wff9> >C!.#66666r   Nrk  r   r   r   LocalLdbErrorr    r  r   r  c                    | j         | j         S |                                }|j        }|O|                                }|dk    rt	          d|z            |                    d          }d}d}|dz  }d }d }	nd}d}d|z  }|                    |          }	|| _        || _         |d	|d
|d| _        || _	        |	| _
        | j         S )NROLE_ACTIVE_DIRECTORY_DCzInvalid server_role %srn  ncalrpcru   z,auth_type=ncalrpc_as_systemncacn_npr  :[])rq  r   rv  rD  r   r+  ru  rp  rr  local_ldap_urlrs  )
r   r   localdcoptsr   rq  rD  local_transportlocal_binding_optionsr  rs  s
             r   setup_local_serverz%DomainTrustCommand.setup_local_server  s   ($$##%%",..**K888"#;{#KLLL66.11L'O$&!!%CC!!NKK(O$&!(<7N%55b99K(3B??LLLRgRgRg$h!,&  r   c                 L    t          j        | j        | j        | j                  S r  )r   lsarpcrr  rp  rs  rw  s    r   new_local_lsa_connectionz+DomainTrustCommand.new_local_lsa_connection  s    z$3T]DDTUUUr   c                 L    t          j         | j        | j        | j                  S r  )r   rr  rp  rs  rw  s    r   new_local_netlogon_connectionz0DomainTrustCommand.new_local_netlogon_connection  s     !:DM4K[\\\r   c                 ^    t          | j        t                      | j        | j                  S )Nr  )r   r  r   rs  rp  rw  s    r   new_local_ldap_connectionz,DomainTrustCommand.new_local_ldap_connection  s2    ,"0"2"2!%!1' ' ' 	'r   Tc           	         |r|sJ | j         | j         S d|z  | _         | j        J |                    | j                  }|j        }d}	 t          || j        |          }t          j        t          j        z  }	|r|	t          j	        z  }	|r|	t          j
        z  }	|                    |	||          }
nM# t          $ r%}t          d|d|j        d                   d }~wt          $ r t          d|z            w xY wi t          j
        d	t          j        d
t          j        dt          j        dt          j        dt          j        dt          j        dt          j	        dt          j        dt          j        dt          j        dt          j        dt          j        dt          j        dt          j        dt          j        dt          j        d}|                     ||
j        d          }| j                             d|
j!        d|
j"        d|d           |
j"        | _         d | j         d!|d"| _#        || _$        | j         S )#Nz__unknown__remote_server__.%sru   rj  )r  r   r   z*Failed to find a writeable DC for domain 'z': r   z-Failed to find a writeable DC for domain '%s'PDCGCLDAPDSKDCTIMESERVCLOSESTWRITABLEGOOD_TIMESERVNDNCSELECT_SECRET_DOMAIN_6FULL_SECRET_DOMAIN_6ADS_WEB_SERVICEDS_8HAS_DNS_NAMEIS_DEFAULT_NCFOREST_ROOTT
names_onlyzRemoteDC Netbios[] DNS[z] ServerType[]
z	ncacn_np:r  r  )%rt  rq  ru  rp  rv  r   r   r  r  NBT_SERVER_WRITABLENBT_SERVER_PDCr  r   r   r  r7  NBT_SERVER_GCNBT_SERVER_KDCNBT_SERVER_TIMESERVNBT_SERVER_CLOSESTNBT_SERVER_GOOD_TIMESERVNBT_SERVER_NDNC!NBT_SERVER_SELECT_SECRET_DOMAIN_6NBT_SERVER_FULL_SECRET_DOMAIN_6NBT_SERVER_ADS_WEB_SERVICENBT_SERVER_DS_8NBT_SERVER_HAS_DNS_NAMENBT_SERVER_IS_DEFAULT_NCNBT_SERVER_FOREST_ROOTgeneric_bitmap_to_stringserver_typer   r   r   r   ru  rv  )r   r   r   require_pdcrequire_writablerv  rt  remote_binding_options
remote_netremote_flagsremote_infoerrorflag_mapserver_type_strings                 r   setup_remote_serverz&DomainTrustCommand.setup_remote_server  s     	$####)%%<vE ,,,//>> *!#
	Y\4=OOOJ.1BBL 8 77 3 22$++,vWd+eeKK 	8 	8 	8, &
1 7 8 8 8 	Y 	Y 	YNQWWXXX	Y

t
 
 t	

 
 #Z
 "I
 #Z
 (/
 
 13K
 /1G
 *,=
 
 '
  (/!
" &#
& "::8;F;R_c ; e e	#,,,#000***, 	- 	- 	-
 )5:>:L:L:LNdNdNd%e"(!!s   A*B7 7
D C!! Dc                 L    t          j        | j        | j        | j                  S r  )r   r  ru  rp  rv  rw  s    r   new_remote_lsa_connectionz,DomainTrustCommand.new_remote_lsa_connectionT  s    z$4dmTEVWWWr   c                 L    t          j         | j        | j        | j                  S r  )r   ru  rp  rv  rw  s    r   new_remote_netlogon_connectionz1DomainTrustCommand.new_remote_netlogon_connectionW  s     !;T]DL]^^^r   c                     t          j                    }t          j                    |_        |                    d                    d          ||          }|                    |t           j                  }||fS )Nr   zutf-8)r   ObjectAttributeQosInfosec_qosOpenPolicy2r^  QueryInfoPolicy2LSA_POLICY_INFO_DNS)r   connpolicy_access
objectAttrpolicyr,  s         r   get_lsa_infozDomainTrustCommand.get_lsa_infoZ  sj    (**
 []]
!!#**W"5"5",m= = $$VS-DEE~r   c           	          	 |                     |d dd d d t          j                  }|j        S # t          $ r |                    ||          cY S w xY wNr   )netr_DsRGetDCNameEx2r   DS_RETURN_DNS_NAMEdc_uncr   netr_GetDcName)r   r  rk  r   r,  s        r   get_netlogon_dc_uncz&DomainTrustCommand.get_netlogon_dc_unce  sr    	7,,V-11dD$-5-HJ JD ; 	7 	7 	7&&vv66666	7s   +.  AAc           	      P    |                     |d dd d d t          j                  }|S r  )r  r   r  )r   r  rk  r,  s       r   get_netlogon_dc_infoz'DomainTrustCommand.get_netlogon_dc_infon  s3    (()-q$d)1)DF F r   c                 H    |j         t          j        k    r|j        S |j        S r  )
trust_typer   LSA_TRUST_TYPE_DOWNLEVELrq  dns_namer   ts     r   netr_DomainTrust_to_namez+DomainTrustCommand.netr_DomainTrust_to_namet  s"    <3777>!zr   c                 @   d }d }|D ];}|j         t          j        z  r%|}|j         t          j        z  s||j                 } n<|j         t          j        z  r1||u rdS |j         t          j        z  rdS ||j                 }||u rdS dS |j        t          j        z  rdS dS )NParentTreeRootChildShortcutForestExternal)	trust_flagsr   NETR_TRUST_FLAG_PRIMARYNETR_TRUST_FLAG_TREEROOTparent_indexNETR_TRUST_FLAG_IN_FORESTtrust_attributesr   %LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)r   ar  primaryprimary_parent_tr  s          r   netr_DomainTrust_to_typez+DomainTrustCommand.netr_DomainTrust_to_typez  s     	 	B~ @@ ~(II 8%&r%7N	 =8== 	N""x}x@@ "!zq~&F  w: II 	8zr   c                     |j         t          j        z  rdS |j        t          j        z  rdS |j        t          j        z  rdS dS )NYesNo)r   r   r  r  r   "LSA_TRUST_ATTRIBUTE_NON_TRANSITIVEr  r  s     r   netr_DomainTrust_to_transitivez1DomainTrustCommand.netr_DomainTrust_to_transitive  sN    =8== 	5 FF 	4 II 	5tr   c                     |j         t          j        z  r|j         t          j        z  rdS |j         t          j        z  rdS |j         t          j        z  rdS dS )NBOTHINCOMINGOUTGOINGINVALID)r   r   NETR_TRUST_FLAG_INBOUNDNETR_TRUST_FLAG_OUTBOUNDr  s     r   netr_DomainTrust_to_directionz0DomainTrustCommand.netr_DomainTrust_to_direction  s^    =8;; 	=8<<	6=8;; 	:=8<< 	:yr   Fc                 |    	 ||         }n*# t           $ r |                     |          }d|z  }Y nw xY wd||fz  }|S )Nz__unknown__%08X__	0x%x (%s))KeyErrorr}  )r   e_dictr|  r  rq   v32rR  s          r   generic_enum_to_stringz)DomainTrustCommand.generic_enum_to_string  s_    	*q	AA 	* 	* 	*,,q//C#c)AAA	* 1a& s    $22c                    g }|}t          |                                          D ]}||z  s|| z  }|||         gz  }|dk    r|                     |          }|d|z  gz  }d                    |          }|r|S d||fz  }	|	S )Nr   z__unknown_%08X__r  r  )sortedkeysr}  r  )
r   b_dictr|  r  r  cbc32rq   rR  s
             r   r  z+DomainTrustCommand.generic_bitmap_to_string  s    && 	 	AE !GA&)AA66,,q//C$s*++AHHQKK 	H1a& r   c                     t           j        dt           j        dt           j        dt           j        di}|                     ||          S )N	DOWNLEVELUPLEVELMITDCE)r   r  LSA_TRUST_TYPE_UPLEVELLSA_TRUST_TYPE_MITLSA_TRUST_TYPE_DCEr  )r   r|  typess      r   trustType_stringz#DomainTrustCommand.trustType_string  sA    (+&	"E"E	
 **5!444r   c                     t           j        t           j        z  dt           j        dt           j        di}|                     ||          S )Nr  INBOUNDOUTBOUND)r   LSA_TRUST_DIRECTION_INBOUNDLSA_TRUST_DIRECTION_OUTBOUNDr  )r   r|  
directionss      r   trustDirection_stringz(DomainTrustCommand.trustDirection_string  sE    +,-.4+Y,j	

 **:q999r   c                     t           j        dt           j        dt           j        dt           j        dt           j        dt           j        dt           j        dt           j        di}| 	                    ||          S )	NNON_TRANSITIVEUPLEVEL_ONLYQUARANTINED_DOMAINFOREST_TRANSITIVECROSS_ORGANIZATIONWITHIN_FORESTTREAT_AS_EXTERNALUSES_RC4_ENCRYPTION)
r   r   LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY&LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAINr  &LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION!LSA_TRUST_ATTRIBUTE_WITHIN_FOREST%LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL'LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTIONr  )r   r|  
attributess      r   trustAttributes_stringz)DomainTrustCommand.trustAttributes_string  sg    24D0.68L57J68L1?57J79N	

 ,,Z;;;r   c                 "   t           j        dt           j        dt           j        dt           j        dt           j        dt           j        dt           j        dt           j        dt           j	        d	t           j
        d
i
}|                     ||          S )NDES_CBC_CRCDES_CBC_MD5RC4_HMAC_MD5AES128_CTS_HMAC_SHA1_96AES256_CTS_HMAC_SHA1_96zAES256_CTS_HMAC_SHA1_96-SKFAST_SUPPORTEDCOMPOUND_IDENTITY_SUPPORTEDCLAIMS_SUPPORTED!RESOURCE_SID_COMPRESSION_DISABLED)r   KERB_ENCTYPE_DES_CBC_CRCKERB_ENCTYPE_DES_CBC_MD5KERB_ENCTYPE_RC4_HMAC_MD5$KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96$KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96'KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96_SKKERB_ENCTYPE_FAST_SUPPORTED(KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTEDKERB_ENCTYPE_CLAIMS_SUPPORTED.KERB_ENCTYPE_RESOURCE_SID_COMPRESSION_DISABLEDr  )r   r|  enctypess      r   kerb_EncTypes_stringz'DomainTrustCommand.kerb_EncTypes_string  sx    -}-}.9;T9;T<>Z02B=?\24FCEh
 ,,Xq999r   c                     |dk    rdS t           j        dt           j        dt           j        di}d|                     ||d          z  S )	Nr   Status[Enabled]zDisabled-NewDisabledzDisabled-Conflicting
Status[%s]Tr  )r   LSA_TLN_DISABLED_NEWLSA_TLN_DISABLED_ADMINLSA_TLN_DISABLED_CONFLICTr  r   e_flagsr  s      r   entry_tln_statusz#DomainTrustCommand.entry_tln_status  sV    a<<$$ $n&
)+A

 d;;E7W[;\\\\r   c                     |dk    rdS t           j        dt           j        dt           j        dt           j        di}d|                     ||d	          z  S )
Nr   r_  zDisabled-SIDzDisabled-SID-ConflictingzDisabled-NBzDisabled-NB-Conflictingra  Tr  )r   LSA_SID_DISABLED_ADMINLSA_SID_DISABLED_CONFLICTLSA_NB_DISABLED_ADMINLSA_NB_DISABLED_CONFLICTr  re  s      r   entry_dom_statusz#DomainTrustCommand.entry_dom_status  s_    a<<$$ &)+E%}(*C	
 d;;E7W[;\\\\r   Nc                 (   |d|z  }nd}| j                             dt          |j                  |fz             t	          |j                  D ]@\  }}|j        }d}|,|j        D ]$}	|	j        |k    r|	j        }d|	j        j        z  }%|j	        }
|j
        t          j        k    r>| j                             d|                     |          dd|
j        d|d	           |j
        t          j        k    r(| j                             d
ddd|
j        d           |j
        t          j        k    rW| j                             d|                     |          dd|
j        j        d|
j        j        d|
j        d|d	           Bd S )Nz TDO[%s]ru   zNamespaces[%d]%s:
z Collision[%s]TLN: 32 DNS[*.r  r   zTLN_EX: 29r  zDOM: z DNS[z
] Netbios[] SID[)r   r   r!  entries	enumerater  indexr   rK   forest_trust_datarN   r   LSA_FOREST_TRUST_TOP_LEVEL_NAMErg  "LSA_FOREST_TRUST_TOP_LEVEL_NAME_EXLSA_FOREST_TRUST_DOMAIN_INFOrm  dns_domain_namenetbios_domain_namer<  )r   ftitln
collisions
tln_stringr  rP  r  collision_stringr#  ds              r   write_forest_trust_infoz*DomainTrustCommand.write_forest_trust_info  s   ?#c)JJJ	-CK((*16 6 	7 	7 	7 ck** 	A 	ADAqGE!%#+ J JAw!|| GE'716='I$$#Av<<<	 $ 5 5e < < < < < !*:*:*:!< = = = = 3AAA	 "AHHH!. / / / /3;;;	 $ 5 5e < < < < < ! 1 8 8 8 ! 5 < < < !.>.>.>	!@ A A A
 	r   )TT)F)NN)"r   r   r   r   ri  r}  r  r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r/  r6  rG  r]  rg  rm  r  r   r   r   rm  rm    sM       
! 
! 
!( ( (  7 7 7 7 7L 7 7 77 7 7 7 7\ 7 7 77 7 7 7 7 7 7 7! ! !>V V V] ] ]' ' ' )--1>" >" >" >"@X X X_ _ _	 	 	7 7 7      8
 
 
        *5 5 5: : :< < <: : :	] 	] 	]
] 
] 
]# # # # # #r   rm  c                   B    e Zd ZdZdZej        ej        edZ	g Z
ddZdS )cmd_domain_trust_listrn  r   r   r   r  Nc                 .   |                      ||          }	 |                                 }n)# t          $ r}|                     | |d          d }~ww xY w	 |                    |t
          j        t
          j        z  t
          j        z            }n`# t          $ rS}| 	                    |t          j                  rt          d| j        z            |                     | |d          d }~ww xY w|j        }|D ]}	|	j        t
          j        z  r| j                            d|                     ||	          z  ddd|                     |	          z  ddd	|                     |	          z  d
dd|                     |	          z  d           d S )N!failed to connect netlogon serverz:LOCAL_DC[%s]: netr_DsrEnumerateDomainTrusts not supported.z$netr_DsrEnumerateDomainTrusts failedzType[%s]14r   zTransitive[%s]15zDirection[%s]19zName[%s]r   )r  r  r   r  netr_DsrEnumerateDomainTrustsr   r  r  r  r  r   WERR_RPC_S_PROCNUM_OUT_OF_RANGEr   rq  arrayr   r  r   r   r  r  r  r  )
r   r   r   r  rq  local_netlogonr  local_netlogon_trustsr  r  s
             r   r   zcmd_domain_trust_list.runG  s   ..y+FF	[!??AANN 	[ 	[ 	[((u6YZZZ	[	^<<\=E=_=E=^>_=E=]>^_ _ "!
  	^ 	^ 	^''v/UVV 7"#_#'#4$6 7 7 7((u6\]]]	^ "' 	L 	LA}x?? IOO&)F)Fq!)L)LLLLL,t/R/RST/U/UUUUU+d.P.PQR.S.SSSSS&)F)Fq)I)IIII	K L L L L
 	s-   - 
AAA:B 
C/AC**C/r   )r   r   r   r   r   r   r   r   rf  r   r   r   r   r   r   r  r  9  sX         H )-0 M     r   r  c                   H    e Zd ZdZdZej        ej        edZ	g Z
dgZddZdS )cmd_domain_trust_showShow trusted domain details.%prog NAME [options]r  r   Nc           	      $
   |                      ||          }	 |                                 }n)# t          $ r}|                     | |d          d }~ww xY w	 t          j        }|                     ||          \  }	}
n)# t          $ r}|                     | |d          d }~ww xY w| j                            d|
j	        j
        d|
j        j
        d|
j        d           t	          j                    }||_
        	 |                    |	|t          j                  }|j        }|j        }n[# t$          $ rN}|                     |t(          j                  rt-          d|z            |                     | |d          d }~ww xY w	 |                    |	|t          j                  }n# t$          $ r}|                     |t(          j                  rd }|                     |t(          j                  rd }||                     | |d	          t	          j                    }d
|_        Y d }~nd }~ww xY w	 d }|j        t          j        z  r!|                    |	|t          j                  }n# t          $ r}|                     |t(          j                   rd }|                     |t(          j!                  rd }||                     | |d          t	          j"                    }d
|_#        g |_$        Y d }~nd }~ww xY w| j                            d           | j                            d|j%        j
        z             |j%        j
        |j&        j
        k    r'| j                            d|j&        j
        z             | j                            d|j        z             | j                            d| '                    |j(                  z             | j                            d| )                    |j*                  z             | j                            d| +                    |j                  z             tY          j-        |j                  j.        }tY          j/        |j                  j.        }| j                            d||fz             | j                            d| 0                    |j                  z             |j        t          j        z  r!| 1                    ||j&        j
                   d S )Nfailed to connect lsa server#failed to query LSA_POLICY_INFO_DNSLocalDomain Netbios[r  rs  r  4trusted domain object does not exist for domain [%s]z.QueryTrustedDomainInfoByName(FULL_INFO) failed?QueryTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failedr   z&lsaRQueryForestTrustInformation failedzTrustedDomain:

zNetbiosName:    %s
zDnsName:        %s
zSID:            %s
zType:           %s
zDirection:      %s
zAttributes:     %s
zPosixOffset:    0x%08X (%d)
zkerb_EncTypes:  %s
r~  )2r  r  r   r  r   !LSA_POLICY_VIEW_LOCAL_INFORMATIONr  r   r   r   rK   r   r  StringQueryTrustedDomainInfoByName!LSA_TRUSTED_DOMAIN_INFO_FULL_INFOinfo_exposix_offsetr   r  r   NT_STATUS_OBJECT_NAME_NOT_FOUNDr   -LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPESNT_STATUS_INVALID_PARAMETERNT_STATUS_INVALID_INFO_CLASS TrustDomainInfoSupportedEncTypes	enc_typesr  r  lsaRQueryForestTrustInformationrz  "NT_STATUS_RPC_PROCNUM_OUT_OF_RANGENT_STATUS_NOT_FOUNDForestTrustInformationcountrt  rq  r   r/  r  r6  trust_directionrG  ry  rz  r{  c_int32r]  r  )r   r   r   r   r  rq  	local_lsar  local_policy_accesslocal_policylocal_lsa_info	lsaStringlocal_tdo_fulllocal_tdo_infolocal_tdo_posixlocal_tdo_enctypeslocal_tdo_forestposix_offset_u32posix_offset_i32s                      r   r   zcmd_domain_trust_show.runx  s   ..y+FF	V5577II 	V 	V 	V((u6TUUU	V	]"%"G-1->->yJ]-^-^*\>> 	] 	] 	]((u6[\\\	] 		&+222&1888&***, 	- 	- 	-
 JLL	!		h66|7@7:7\^ ^  ,3N,9OO 	h 	h 	h''x/WXX d"#Y\b#bccc((u6fggg		h	-66|7@7:7hj j   	- 	- 	-''x/STT ''x/TUU  ,,T5-np p p "%!E!G!G+,((((((	-	*#.1ZZ `==l>G>A>^` ` !  
	* 
	* 
	*''x/Z[[ ''x/KLL  ,,T5:bccc"9;;%&"')$$$$$$
	* 		,---	.1L1SSTTT&-1K1RRRIOO2^5O5VVWWW	.1CCDDD	.1F1F~G`1a1aabbb	.1K1KNLj1k1kklll	.1L1L^Ml1m1mmnnn!??+GHHN!>/*FGGM	7;KM]:^^___	.1J1JK]Kg1h1hhiii*S-VV 	P(()9-;-G-N ) P P P 	sw   - 
AAA%A= =
B#BB#>/D. .
F8A	FF
!F, ,
H76A7H22H7;7I3 3
L=A>L  Lr   )r   r   r   r   r   r   r   r   rf  r   r   r   r   r   r   r   r  r  h  sg        &&%H )-0 M JX X X X X Xr   r  c            	           e Zd ZdZdZej        ej        edZ	 e
ddddd	           e
d
dddd	           e
ddddd	          gZdgZ	 	 ddZdS )cmd_domain_trust_modifyr  r  r  z--use-aes-keysrQ   z!The trust uses AES kerberos keys.use_aes_keysNrS   rP   r  rj   --no-aes-keysz:The trust does not have any support for AES kerberos keys.disable_aes_keysz--raw-kerb-enctypesstorezThe raw kerberos enctype bitskerb_enctypesr   c           	         d}d}	||	dz  }	||	dz  }	||	dz  }	|	dk    rt          d          |	dk    r|dz  }|dk    rt          d          |                     ||          }
	 |                                 }n)# t          $ r}|                     | |d          d }~ww xY w	 t
          j        }|t
          j        z  }|                     ||          \  }}n)# t          $ r}|                     | |d          d }~ww xY w| j	        
                    d|j        j        d|j        j        d	|j        d
           |	dk    r0t          j                    }||_        	 |                    ||t
          j                  }n# t$          $ r}|                     |t(          j                  rd }|                     |t(          j                  rd }||                     | |d          t          j                    }d|_        Y d }~nd }~ww xY w| j	        
                    d|                     |j                  z             t          j                    }|t5          |d          |_        nQ|,t6          j        |_        |xj        t6          j        z  c_        n#|t6          j        |_        nt          d          |j        |j        k    r	 |                    ||t
          j        |          }| j	        
                    d|                     |j                  z             nJ# t$          $ r#}||                     | |d          Y d }~n"d }~ww xY w| j	        
                    d           d S )Nr   r   zL--no-aes-keys, --use-aes-keys and --raw-kerb-enctypes are mutually exclusivez/modification arguments are required, try --helpzfailed to connect to lsa serverr  r  r  rs  r  r  zOld kerb_EncTypes:  %s
)r  z&Internal error should be checked abovezNew kerb_EncTypes:  %s
z=SetTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failedzNo kerb_EncTypes update needed
) r   r  r  r   r  r   r  LSA_POLICY_TRUST_ADMINr  r   r   r   rK   r   r  r  r  r  r   r  r   r  r  r  r  r]  r   r   rU  rV  rT  SetTrustedDomainInfoByName)r   r   r   r   r  r  r  r  num_modificationsenctype_argsrq  r  r  r  r  r  r  r  r  s                      r   r   zcmd_domain_trust_modify.run  sF    $AL#AL'AL!mnnn1"!!PQQQ..y+FF	Y5577II 	Y 	Y 	Y((u6WXXX	Y	]"%"G3#==-1->->yJ]-^-^*\>> 	] 	] 	]((u6[\\\	] 		&+222&1888&***, 	- 	- 	-
 1
I%I1::<;D;>;ln n #" ! 1 1 1++E83WXX ! E++E83XYY ! E$00u1rt t t &)%I%K%K"/0",,,,,,1 IOO69R9RSeSo9p9ppqqq<>>I(&)-a&@&@&@	##)&.&S	###x'TT###!- '/&H	##"#KLLL"&8&BBB
v!<<\=F=@=n=FH H '
 IOO$>AZAZ[d[nAoAo$opppp$ v v v("44T55tv v v )((((v
 	 BCCCsb   &A; ;
B!BB!%4C 
D $C;;D "!F 
HA7H

HAL- -
M7MM)NNNNNNr   r   r   r   r   r   r   r   rf  r   r   r   r   r   r   r   r   r  r    s        &&%H )-0  	7"	 	 	 	|P&	 	 	 	$W3#	 	 	M JHLDHZ Z Z Z Z Zr   r  c                      e Zd ZdZdZej        ej        ej        e	dZ
 edddddgd	d
d           edddg dddd           edddddgddd           eddddd           edddg dd d!d"           ed#dd$d%d           ed&dd'd(d           ed)d*d+d,d-           ed.d*d/d0d-          g	Zd1gZ	 	 	 	 	 d3d2Zd"S )4cmd_domain_trust_createz Create a domain or forest trust.%prog DOMAIN [options]r   r   r   r  z--typerT   TYPEexternalr   z.The type of the trust: 'external' or 'forest'.r  rN   rO   rX   rP   r  rj   z--direction	DIRECTION)incomingoutgoingbothz6The trust direction: 'incoming', 'outgoing' or 'both'.r  r  z--create-locationLOCATIONlocalz=Where to create the trusted domain object: 'local' or 'both'.create_locationz--cross-organisationrQ   z=The related domains does not belong to the same organisation.cross_organisationFr  z--quarantinedzyes|no)r   r   NzSpecial SID filtering rules are applied to the trust. With --type=external the default is yes. With --type=forest the default is no.quarantined_argNz--not-transitivez#The forest trust is not transitive.not_transitivez--treat-as-externalz'The treat the forest trust as external.treat_as_externalr  store_falsez)The trust does not use AES kerberos keys.r  Tz--skip-validationzSkip validation of the trust.validater   c           	      #    t          j                    }d}|
	|dk    rd}n|
dk    rd}|dk    r"|rt          d          |rt          d          t          j                    }|r,t          j        |_        |xj        t          j        z  c_        nt          j        |_        t           j	        }|t           j
        z  }|t           j        z  }t          j                    }t           j        |_        d|_        |d	k    r5|xj        t           j        z  c_        |xj        t           j        z  c_        nA|d
k    r|xj        t           j        z  c_        n |dk    r|xj        t           j        z  c_        d|_        |	r|xj        t           j        z  c_        |r|xj        t           j        z  c_        |dk    r|xj        t           j        z  c_        |r|xj        t           j        z  c_        |r|xj        t           j        z  c_         fd}d }d }t           j	        }|dk    r|j        t           j        z  r- |d          }t1          |                    d                    }|j        t           j        z  r- |d          }t1          |                    d                    }d }nd }|j        t           j        z  r |d          }|j        t           j        z  r |d          }|t           j
        z  }|t           j        z  }t          j                    }t           j        |_        d|_        |d	k    r5|xj        t           j        z  c_        |xj        t           j        z  c_        nA|d
k    r|xj        t           j        z  c_        n |dk    r|xj        t           j        z  c_        d|_        |	r|xj        t           j        z  c_        |r|xj        t           j        z  c_        |dk    r|xj        t           j        z  c_        |r|xj        t           j        z  c_        |r|xj        t           j        z  c_                             ||          }	                                  }n)# t8          $ r}                      |d          d }~ww xY w	                      ||          \  }} n)# t8          $ r}                      |d          d }~ww xY w j                             d| j!        j"        d| j#        j"        d| j$        d           	  %                    ||          }!n)# t8          $ r} &                     |d          d }~ww xY w	  '                                }"n)# t8          $ r} &                     |d          d }~ww xY w	                      |"|          \  }#}$n)# t8          $ r} &                     |d          d }~ww xY w j                             d|$j!        j"        d|$j#        j"        d|$j$        d           |$j#        j"        |j(        _"        |$j!        j"        |j)        _"        |$j$        |_$        |r8| j#        j"        |j(        _"        | j!        j"        |j)        _"        | j$        |_$        	 |j(        j"        |_"        |*                    ||t           j+                  }%t          d|j"        z            # tX          $ rI} -                    |t\          j/                  s                      |d|j"        z            Y d }~nd }~ww xY w	 |j)        j"        |_"        |*                    ||t           j+                  }&t          d|j"        z            # tX          $ rI} -                    |t\          j/                  s                      |d|j"        z            Y d }~nd }~ww xY w|r@	 |j(        j"        |_"        |"*                    |#|t           j+                  }'t          d|j"        z            # tX          $ rI} -                    |t\          j/                  s &                     |d|j"        z            Y d }~nd }~ww xY w	 |j)        j"        |_"        |"*                    |#|t           j+                  }(t          d|j"        z            # tX          $ rI} -                    |t\          j/                  s &                     |d|j"        z            Y d }~nd }~ww xY w	  0                                })n)# t8          $ r}                      |d          d }~ww xY w	  1                    |)|          }*n)# t8          $ r}                      |d          d }~ww xY w|r	  2                                }+n)# t8          $ r} &                     |d          d }~ww xY w	  3                    |+|!|          },n)# t8          $ r} &                     |d          d }~ww xY wd }-ti          j5                    }. |-||.          }/ |-||.          }0	 |r j                             d            d!d"d#}1tm          |"|#|t           j7        |0|/          }2 j                             d$           |r@ j                             d%           d!d&d#}1|"8                    |2t           j9        |            j                             d'           dd"d#}1tm          |||t           j7        |/|0          }3 j                             d(           |r@ j                             d)           dd&d#}1|8                    |3t           j9        |           n# t8          $ r} j                             d*|1d+         d,|1d-         d.           |2r1 j                             d/           |":                    |2           d }2|3r1 j                             d0           |:                    |3           d }3|1d-         d!k    r  &                     |d1|1d+         z                                  |d1|1d+         z            d }~ww xY w|r|j        t           j        z  rщ j                             d2           	 |);                    |*j<        |$j#        j"        tz          j>                  }4n)# t8          $ r}                      |d3          d }~ww xY w	 |?                    ||$j#        t           j@        |4d          }5n)# t8          $ r}                      |d4          d }~ww xY w A                    |4|$j#        j"        |55           |r j                             d6           	 |+;                    |,| j#        j"        tz          j>                  }6n)# t8          $ r} &                     |d3          d }~ww xY w	 |"?                    |#| j#        t           j@        |6d          }7n)# t8          $ r} &                     |d4          d }~ww xY w A                    |6| j#        j"        |75           |j        t           j        z  re j                             d7           	 |)B                    |*j<        tz          jC        d8|$j#        j"                  }8n)# t8          $ r}                      |d9          d }~ww xY w D                    |8jE        d                   }9 D                    |8jF        d                   }:|8jG        tz          jH        z  r(d:|8jI        d;|8jF        d<         d=|8jE        d<         d>};n'd:|8jI        d;|8jF        d<         d=|8jE        d<         d?};|9t          jK        k    s|:t          jK        k    rt          |;           j                             d@|;z             |ru|j        t           j        z  r` j                             dA           	 |+B                    |,tz          jC        d8| j#        j"                  }<n)# t8          $ r} &                     |d9          d }~ww xY w D                    |<jE        d                   }= D                    |<jF        d                   }>|<jG        tz          jH        z  r(dB|<jI        d;|<jF        d<         d=|<jE        d<         d>}?n'dB|<jI        d;|<jF        d<         d=|<jE        d<         d?}?|=t          jK        k    s|>t          jK        k    rt          |?           j                             d@|?z             |20	 |"L                    |2           n# t8          $ r
}Y d }~nd }~ww xY wd }2|30	 |L                    |3           n# t8          $ r
}Y d }~nd }~ww xY wd }3 j                             dC           d S )DNFr  Tr   r   z'--not-transitive requires --type=forestz*--treat-as-external requires --type=forestr   r  r  r  c                     d }	 ||dk    r|S t          d| z            }t          d| z            }||k    sd }j                            d           Q)NTru   zNew %s Password: zRetype %s Password: r   )r   r   r   )r   passwordpasswordverifyr   s      r   get_passwordz1cmd_domain_trust_create.run.<locals>.get_password	  sr    HH'HNN#O"#6#=>>!()?$)F!G!G>11#HIOO$FGGGHr   r  zIncoming Trust	utf-16-lezOutgoing Trustc                 |    t          j        | dz  | dz            }t          |                    d                    S )N   r  )r4   generate_random_machine_passwordr*   encode)lengthpws     r   random_trust_secretz8cmd_domain_trust_create.run.<locals>.random_trust_secret	  s7    ;FaKSTUU+BIIk,B,BCCCr      r  r  r  r  rs  r  failed to locate remote serverRemoteDomain Netbios[zTrustedDomain %s already exist'z2QueryTrustedDomainInfoByName(%s, FULL_INFO) failedr  failed to get netlogon dc infoc                    | t          j                    }d|_        |S t          j                    }t	          |           |_        | |_        t          j                    }t          j	        |          |_
        t          j        |_        ||_        t          j                    }d|_        |g|_        t          j                    }d|_        ||_        |S )Nr   r   )r   trustAuthInOutBlobr  AuthInfoClearr!  sizer  AuthenticationInformationr4  unix2nttimeLastUpdateTimer   TRUST_AUTH_TYPE_CLEARAuthTypeAuthInfoAuthenticationInformationArrayr  current)secretupdate_timeblobclearr,  r  s         r   generate_AuthInOutBlobz;cmd_domain_trust_create.run.<locals>.generate_AuthInOutBloby
  s    ~244
*,,EVEJ#EN577D"'"3K"@"@D5DM!DM;==EEK&EK.00DDJ DLKr   zCreating remote TDO.
remoteCreateTrustedDomainEx2)locationr   zRemote TDO created.
z2Setting supported encryption types on remote TDO.
SetInformationTrustedDomainzCreating local TDO.
zLocal TDO created
z1Setting supported encryption types on local TDO.
zError: r   z failed r  zly - cleaning up
zDeleting remote TDO.
zDeleting local TDO.
%sz(Setup local forest trust information...
*netr_DsRGetForestTrustInformation() failed&lsaRSetForestTrustInformation() failedr~  r  z)Setup remote forest trust information...
zValidating outgoing trust...
r  !NETLOGON_CONTROL_TC_VERIFY failedLocalValidation: DC[] CONNECTION[r   ] TRUST[] VERIFY_STATUS_RETURNEDr  OK: %s
zValidating incoming trust...
RemoteValidation: DC[z	Success.
)Mr   r  r   r  r   rU  r  rV  rT  r  r  LSA_POLICY_CREATE_SECRETTrustDomainInfoInfoExr+  r  r  r3  r4  r  rB  rA  r  r  rD  r*   r  r  r  r   r  r  r   r   r   rK   r   r  r  r  r  r   rq  r  r  r   r  r   r  r  r  r  r  r4  current_unix_timerE   LSA_TRUSTED_DOMAIN_ALL_ACCESSr  r  DeleteObject!netr_DsRGetForestTrustInformationr  r   DS_GFTI_UPDATE_TDOlsaRSetForestTrustInformationrz  r  netr_LogonControl2ExNETLOGON_CONTROL_TC_VERIFYr}  pdc_connection_statustc_connection_statusr  NETLOGON_VERIFY_STATUS_RETURNEDtrusted_dc_namer   WERR_SUCCESSClose)@r   r   r   r  r   r   r  r  r  r  r  r  r  r  r  r  quarantinedr  r  local_trust_infor  incoming_secretoutgoing_secretremote_policy_accessincoming_passwordoutgoing_passwordremote_trust_infor  rq  r  r  r  r  rt  
remote_lsaremote_policyremote_lsa_infolocal_old_netbioslocal_old_dnsremote_old_netbiosremote_old_dnsr  local_netlogon_inforemote_netlogonremote_netlogon_dc_uncr  r  incoming_bloboutgoing_blobcurrent_requestremote_tdo_handlelocal_tdo_handlelocal_forest_infolocal_forest_collisionremote_forest_inforemote_forest_collisionlocal_trust_verifylocal_trust_statuslocal_conn_statuslocal_validationremote_trust_verifyremote_trust_statusremote_conn_statusremote_validations@   `                                                               r   r   zcmd_domain_trust_create.run	  sY    JLL	"Z''"%%K!! N"#LMMM  Q"#OPPP8::	 	E"*"OI8#PP #+"DI!Cs99s;;466&)&@#+,(f$$,,0OO,,,,0PP,,,
**,,0OO,,,
**,,0PP,,,-) 	\--1[[-- 	\--1[[--!!--1ZZ-- 	X--1WW-- 	[--1ZZ--		H 		H 		H 		H 		H "Dg%%/#2QQ ^$0L1A$B$B!"67H7O7OP[7\7\"]"]/#2RR ^$0L1A$B$B!"67H7O7OP[7\7\"]"] $D D D  /#2QQ ;"5"5c":":/#2RR ;"5"5c":": C$>>  C$@@  # 9 ; ;+.+E(01-&((!11S5TT11!11S5UU111 J..!11S5UU111 J..!11S5TT1112.! a!22c6``22 a!22c6``22X%%!22c6__22 ]!22c6\\22  `!22c6__22..y+FF	V5577II 	V 	V 	V((u6TUUU	V	]-1->->yJ]-^-^*\>> 	] 	] 	]((u6[\\\	] 		&+222&1888&***, 	- 	- 	-
	Y 44XvFFMM 	Y 	Y 	Y))$7WXXX	Y	W7799JJ 	W 	W 	W))$7UVVV	W	^/3/@/@Ma/b/b,]OO 	^ 	^ 	^))$7\]]]	^ 		',333'2999'+++- 	. 	. 	.
 />.H.O$+/>/C/J%,.2 	73A3L3S)04B4G4N*1$2$6!	D/;BI66|7@7:7\^ ^  @9CSSTTT 	D 	D 	D++E83[\\ D,,T5-a1:1A.CD D DD D D D D	D	D/<CI66|7@7:7\^ ^  @9CSSTTT 	D 	D 	D++E83[\\ D,,T5-a1:1A.CD D DD D D D D	D  	II#4#@#G	 ;;M<E<?<ac c # ##DyGW#WXXX  I I I//x7_`` I11$2f6?6F3HI I II I I I III#4#A#H	 ;;M<E<?<ac c  ##DyGW#WXXX  I I I//x7_`` I11$2f6?6F3HI I II I I I II	[!??AANN 	[ 	[ 	[((u6YZZZ	[	X"&";";NL"Y"Y 	X 	X 	X((u6VWWW	X  
	]`"&"E"E"G"G ` ` `--dE;^___`])-)A)A/BOQW*Y *Y&& ] ] ]--dE;[\\\]	 	 	4 -//..LL..LL0	C  F	 8999/7AY"Z"Z$<Z=J=N=@=^=J=J%L %L! 	 7888 FIOO$YZZZ3;Eb&c&cO::;L;>;l;DF F F IOO3444+2<TUUO7	8D8H8;8Y8E8E G  G IOO1222 A	 TUUU/6@]"^"^556F696g6?A A A  	C 	C 	CIOOO+F333_Z5P5P5PR S S S  )	 8999''(9:::$(! (	 7888&&'7888#' z*h66--dE4.=f.E<G H H H((ud)8)@7B C C C	C"  u	H033\\ 8U	 KLLL
l 'HHI\IcIXIcIjIQIdf f &% $ l l l00u>jkkkl	h "??@O@Z@C@`@Q@A	C C +* $ h h h00u>fgggh ,,->1@1K1R8N - P P P % UIOO$PQQQ
q ,MMNdN\NgNnNVNik k +* ( q q q"55dECopppq	m 'DD]ESE^EHEeEWEF	H H 0/ ( m m m"55dECklllm 001C5C5N5U<S 1 U U U  /#2RR C	 @AAAc)7)L)LM`MgMUMpMNM\MgMn*p *p&& $ c c c00u>abbbc &*\\2D2Z[\2]%^%^"$(LL1C1XYZ1[$\$\!%+h.VV 	T 	T'9'I'I'I'9'Nq'Q'Q'Q'9'OPQ'R'R'R(T$$	T (:'I'I'I'9'Nq'Q'Q'Q'9'OPQ'R'R'R(T$
 &)<<<@QU[Uh@h@h&'7888IOOJ1A$ABBB  H$4s7WW HIOO$DEEEh+@@AWAIAdABAOAZAac c ,+
 ( h h h"55dECfgggh +/,,7J7`ab7c*d*d')-6I6^_`6a)b)b&*083[[ 	Y 	Y+>+N+N+N+>+STU+V+V+V+>+TUV+W+W+W-Y))	Y ,?+N+N+N+>+STU+V+V+V+>+TUV+W+W+W-Y)
 +f.AAAEW[a[nEnEn*+<===	
5F(FGGG(  !23333    $' 01111   #	%%%s  !Q6 6
R RR R: :
S SS !T8 8
UUU"U7 7
VVV!V; ;
W!WW!A	[ 
\0'?\++\04A	]= =
_?__A	`   
a3*?a..a37A	c   
d
?ddd, ,
e6eee- -
f7fff. .
g8ggg0 0
h:hhD4m= =
q+Cq&&q+!0s 
s8s33s8<(t% %
u/uu+v9 9
www#(x 
x2x--x21z9 9
{{{@,A@1 @1
AA@;AAAAAEAE" E"
AE6E1AE6E>AF F
AF(F#AF()NNNNNNNFNFFFTr   r   r   r   r   r   r   r   r   rf  r   r   r   r   r   r   r   r   r  r  J	  s       **'H )-.0	  	xh"H-D !		# 	# 	#
 	}8[777L%		 	 	
 	":(S%		 	 	
 	%lS(	 	 	 	Xx***< &	 	 	 	!,9$	 	 	 	$\='	 	 	 	}?"	 	 	 	"=3	 	 	O+MZ JW[CG6:49)-	I I I I I Ir   r  c            	       ~    e Zd ZdZdZej        ej        ej        e	dZ
 edddddgd	d
d          gZdgZ	 	 ddZdS )cmd_domain_trust_deletezDelete a domain trust.r  r  z--delete-locationrT   r  r  r  z=Where to delete the trusted domain object: 'local' or 'both'.delete_locationr  r   Nc           	      j   t           j        }|t           j        z  }|t           j        z  }|dk    rd }n*t           j        }|t           j        z  }|t           j        z  }|                     ||          }		 |                                 }
n)# t          $ r}|                     | |d          d }~ww xY w	 |                     |
|          \  }}n)# t          $ r}|                     | |d          d }~ww xY w| j	        
                    d|j        j        d|j        j        d|j        d           d }d }d }d }t          j                    }	 ||_        |
                    ||t           j                  }n[# t$          $ rN}|                     |t(          j                  rt-          d|z            |                     | |d	          d }~ww xY w|y	 |                     ||          }n)# t          $ r}|                     | |d	          d }~ww xY w	 |                                 }n)# t          $ r}|                     | |d          d }~ww xY w	 |                     ||          \  }}n)# t          $ r}|                     | |d          d }~ww xY w| j	        
                    d
|j        j        d|j        j        d|j        d           |j        |j        k    s4|j        j        |j        j        k    s|j        j        |j        j        k    r2t-          d|j        j        d|j        j        d|j        d          	 |j        j        |_        |                    ||t           j                  }nV# t$          $ rI}|                     |t(          j                  s|                     | |d|j        z            Y d }~nd }~ww xY w|v|j        |j        k    s4|j        j        |j        j        k    s|j        j        |j        j        k    r2t-          d|j        j        d|j        j        d|j        d          ||	 |j        j        |_        |
                    ||t:          j                  }n1# t          $ r$}|                     | |d|j        z            d }~ww xY w|
                    |           d }|e	 |j        j        |_        |                    ||t:          j                  }n1# t          $ r$}|                     | |d|j        z            d }~ww xY w||	 |                    |           d }| j	        
                    d           nI# t          $ r<}| j	        
                    d|                     | |d          z             Y d }~nd }~ww xY wd S )Nr  r  r  r  r  rs  r  z$Failed to find trust for domain '%s'r  r  zLocalTDO inconsistend: Netbios[r  z QueryTrustedDomainInfoByName(%s)z RemoteTDO inconsistend: Netbios[zOpenTrustedDomainByName(%s)zRemoteTDO deleted.
z%s
zDeleteObject() failed) r   r  r  r  r  r  r   r  r  r   r   r   rK   r   r  r  r  LSA_TRUSTED_DOMAIN_INFO_INFO_EXr   r  r   r  r   r  r  r  rq  r   OpenTrustedDomainByNamer   SEC_STD_DELETEr  )r   r   r   r  r   r   rD  r  r"  rq  r  r  r  r  r  r4  remote_tdo_infor3  r  rt  r&  r'  r(  s                          r   r   zcmd_domain_trust_delete.rung  s[    "Cs99s;;g%%#'  #&#H  C$>>  C$@@ ..y+FF	V5577II 	V 	V 	V((u6TUUU	V	]-1->->yJ]-^-^*\>> 	] 	] 	]((u6[\\\	] 		&+222&1888&***, 	- 	- 	-
  JLL		Y%I&CCLDMsOrt tNN 	Y 	Y 	Y''x/WXX T"#IF#RSSS))$7WXXX	Y
  +] $ 8 86 J J ] ] ]--dE;[\\\][!;;==

 [ [ [--dE;YZZZ[b373D3DZQe3f3f0 b b b--dE;`aaab IOOO+0777+6===+///1 2 2 2
 "n&888#*n.I.PPP)0N4N4UUU"l#1#>#E#E#E#1#=#D#D#D#1#5#5#5$7 8 8 8
	E#1#<#C	 ;;M<E<?<_a a   ! E E E//x7_`` E11$?a2;2B@D E E EE E E E EE
 *!%)<<<!&-1M1TTT!,37R7YYY&,'6'C'J'J'J'6'B'I'I'I'6':':':(< = = =
 %@#1#=#D	 55l6?6>6MO O !    @ @ @,,T5:W-6-=;? @ @ @@ ""#3444#&A#2#>#E	 66}7@7?7NP P "!   A A A--dE;X.7.><@ A A AA (h''(9:::$(!	 67777 h h h	)@)@uNe)f)f fggggggggh 	s   5B
 

B0B++B04C 
C4C//C4(E9 9
GA	GGG/ /
H9HHH. .
I8III2 2
J<JJ2N 
O?OO2R 
R4R//R42T 
T2T--T281U* *
V042V++V0NNNNNrA  r   r   r   rC  rC  Q  s          'H )-.0	  	":(S%		 	 	M JW[      r   rC  c            	       ~    e Zd ZdZdZej        ej        ej        e	dZ
 edddddgd	d
d          gZdgZ	 	 ddZdS )cmd_domain_trust_validatezValidate a domain trust.r  r  z--validate-locationrT   r  r  r  z?Where to validate the trusted domain object: 'local' or 'both'.validate_locationr  r   Nc           	         t           j        }|                     ||          }	 |                                 }	n)# t          $ r}
|                     | |
d          d }
~
ww xY w	 |                     |	|          \  }}n)# t          $ r}
|                     | |
d          d }
~
ww xY w| j                            d|j	        j
        d|j        j
        d|j        d           	 t          j                    }||_
        |	                    ||t           j                  }n[# t           $ rN}
|                     |
t$          j                  rt)          d|z            |                     | |
d          d }
~
ww xY w| j                            d	|j        j
        d|j        j
        d|j        d           	 |                                 }n)# t          $ r}
|                     | |
d
          d }
~
ww xY w	 |                    |t2          j        d|j        j
                  }n)# t          $ r}
|                     | |
d          d }
~
ww xY w|                     |j        d                   }|                     |j        d                   }|j        t2          j        z  r(d|j         d|j        d         d|j        d         d}n'd|j         d|j        d         d|j        d         d}|tB          j"        k    s|tB          j"        k    rt)          |          | j                            d|z             	 |j         #                    dd          }|j        j
        d|}|                    |t2          j$        d|          }n)# t          $ r}
|                     | |
d          d }
~
ww xY w|                     |j        d                   }d|j         d|j        d         d}|tB          j"        k    rt)          |          | j                            d|z             |dk    r	 | %                    ||d          }n)# t          $ r}
| &                    | |
d          d }
~
ww xY w	 | '                                }n)# t          $ r}
| &                    | |
d
          d }
~
ww xY w	 |                    |t2          j        d|j        j
                  }n)# t          $ r}
| &                    | |
d          d }
~
ww xY w|                     |j        d                   }|                     |j        d                   }|j        t2          j        z  r(d|j         d|j        d         d|j        d         d}n'd|j         d|j        d         d|j        d         d}|tB          j"        k    s|tB          j"        k    rt)          |          | j                            d|z             	 |j         #                    dd          }|j        j
        d|}|                    |t2          j$        d|          }n)# t          $ r}
| &                    | |
d          d }
~
ww xY w|                     |j        d                   }d|j         d|j        d         d}|tB          j"        k    rt)          |          | j                            d|z             d S )Nr  r  r  r  rs  r  r  ,QueryTrustedDomainInfoByName(INFO_EX) failedLocalTDO Netbios[r  r  r  r   r  r	  r   r
  r  r  r  \ru   z"NETLOGON_CONTROL_REDISCOVER failedzLocalRediscover: DC[r  F)r  r  r  zRemoteRediscover: DC[)(r   r  r  r  r   r  r  r   r   r   rK   r   r  r  r  rF  r   r  r   r  r   rq  r   r  r  r   r  r}  r  r  r  r  r  r   r  replaceNETLOGON_CONTROL_REDISCOVERr  r  r  ) r   r   r   r   r   r  rM  r  rq  r  r  r  r  r  r  r  r9  r:  r;  r<  rk  domain_and_serverlocal_trust_rediscoverlocal_rediscoverrt  r.  r=  r>  r?  r@  remote_trust_rediscoverremote_rediscovers                                    r   r   zcmd_domain_trust_validate.run  s    "C..y+FF	V5577II 	V 	V 	V((u6TUUU	V	]-1->->yJ]-^-^*\>> 	] 	] 	]((u6[\\\	] 		&+222&1888&***, 	- 	- 	-
	f
I%I66|7@7:7Z\ \ N  	f 	f 	f''x/WXX d"#Y\b#bccc((u6deee		f 		&3:::&2999&***, 	- 	- 	-
	[!??AANN 	[ 	[ 	[((u6YZZZ	[	[33L4<4W454B4N4UW W 
  	[ 	[ 	[((u6YZZZ	[ "\\*<*RST*UVV LL);)PQR)STT#h&NN 		L 		L1AAA1FqIII1GJJJ L		L  2AAA1FqIII1GJJJ L
 !4448IVM`8`8`/000IOOJ)99:::		\'7??bIIF,:,F,M,M,Mvv V33L4<4X454EG G #"
  	\ 	\ 	\((u6Z[[[	\ !LL)?)TUV)WXX5EEE5J1MMMO  333/000IOOJ)99:::''] $ 8 86W\ 8 ] ] ] ] ]--dE;[\\\]`"&"E"E"G"G ` ` `--dE;^___``#889A9\9:9G9R9Y[ [ $#
   ` ` `--dE;^___` #',,/B/XYZ/["\"\!%.A.VWX.Y!Z!Z"(8+SS 	Q 	Q#6#F#F#F#6#KA#N#N#N#6#LQ#O#O#O%Q!!	Q $7#F#F#F#6#KA#N#N#N#6#LQ#O#O#O%Q!
 #f&999=OSYSf=f=f"#4555	
-> >???	a,<DDT2NN0>0I0P0P0PRXRX$Y!#889A9]9:9JL L ('
   a a a--dE;_```a "&.E.Z[\.]!^!^ $;#J#J#J#:#OPQ#R#R#R!T "V%888"#4555	
-> >???s   9 
AAA#A= =
B#BB#$;D   
E8*A	E33E89G 
G4G//G48,H% %
I/II>AN 
N3N..N33Q 
Q2Q--Q26R 
R1R,,R15,S" "
T,TT;AY
 

Y0Y++Y0rJ  rA  r   r   r   rL  rL    s        ""'H )-.0	  	$8Z(U'		 	 	M JW["Z Z Z Z Z Zr   rL  c                   0   e Zd ZdZdZej        ej        edZ	 e
dddg ddd	d
           e
ddddd           e
dddddg            e
dddddg            e
dddddg            e
ddddd g            e
d!dd"d#d$g            e
d%dd"d&d'g            e
d(dd)d*d+g            e
d,dd)d-d.g            e
d/ddd0d1g            e
d2ddd3d4g            e
d5ddd6d7g            e
d8ddd9d:g           gZd;gZd
d
d
d
d
dg g g g g g g g g g g g fd<Zd
S )=cmd_domain_trust_namespaceszManage forest trust namespaces.z%prog [DOMAIN] [options]r  z	--refreshrT   zcheck|store)checkr  NzLList and maybe store refreshed forest trust information: 'check' or 'store'.refreshNr  z--enable-allrQ   zATry to update disabled entries, not allowed with --refresh=check.
enable_allFr  z--enable-tlnr  	DNSDOMAINz?Enable a top level name entry. Can be specified multiple times.
enable_tln)rS   rO   rP   r  rj   z--disable-tlnz@Disable a top level name entry. Can be specified multiple times.disable_tlnz--add-tln-exzAAdd a top level exclusion entry. Can be specified multiple times.
add_tln_exz--delete-tln-exzDDelete a top level exclusion entry. Can be specified multiple times.delete_tln_exz--enable-nbNETBIOSDOMAINzIEnable a netbios name in a domain entry. Can be specified multiple times.	enable_nbz--disable-nbzJDisable a netbios name in a domain entry. Can be specified multiple times.
disable_nbz--enable-sid	DOMAINSIDz@Enable a SID in a domain entry. Can be specified multiple times.enable_sid_strz--disable-sidzADisable a SID in a domain entry. Can be specified multiple times.disable_sid_strz--add-upn-suffixzVAdd a new uPNSuffixes attribute for the local forest. Can be specified multiple times.add_upnz--delete-upn-suffixz^Delete an existing uPNSuffixes attribute of the local forest. Can be specified multiple times.
delete_upnz--add-spn-suffixz[Add a new msDS-SPNSuffixes attribute for the local forest. Can be specified multiple times.add_spnz--delete-spn-suffixzcDelete an existing msDS-SPNSuffixes attribute of the local forest. Can be specified multiple times.
delete_spnzdomain?c           	      =   d}||dk    rt          d|z            |rt          d          t          |          dk    rt          d          t          |          dk    rt          d          t          |	          dk    rt          d          t          |
          dk    rt          d	          t          |          dk    rt          d
          t          |          dk    rt          d          t          |          dk    rt          d          t          |          dk    rt          d          t          |          dk    r.|D ])}|                    d          st          d|z            d}t          |          dk    r.|D ])}|                    d          st          d|z            d}|D ]C}|D ]>}|                                |                                k    r-t          d|z            Dt          |          dk    r.|D ])}|                    d          st          d|z            d}t          |          dk    r.|D ])}|                    d          st          d|z            d}|D ]C}|D ]>}|                                |                                k    r-t          d|z            Dnt          |          dk    rt          d          t          |          dk    rt          d          t          |          dk    rt          d          t          |          dk    rt          d          |4|dk    rd}|r|dk    rt          d|z            t          |          dk    rt          d          t          |          dk    rt          d          t          |	          dk    rt          d          t          |
          dk    rt          d          t          |          dk    rt          d          t          |          dk    rt          d           t          |          dk    rt          d!          t          |          dk    rt          d"          n
|rhd}t          |          dk    rt          d#          t          |          dk    rt          d$          t          |          dk    rt          d%          t          |          dk    rd}t          |          dk    rd}|D ]C}|D ]>}|                                |                                k    r-t          d&|z            Dt          |	          dk    r.|	D ])}|                    d          st          d'|z            d}t          |
          dk    r.|
D ])}|                    d          st          d(|z            d}|	D ]C}|
D ]>}|                                |                                k    r-t          d)|z            Dt          |          dk    rd}t          |          dk    rd}|D ]C}|D ]>}|                                |                                k    r-t          d*|z            Dg }|D ]Q}	 t          j        |          }n$# t          $ r}t          d+|z            d }~ww xY w|                    |           Rg }|D ]Q}	 t          j        |          }n$# t          $ r}t          d,|z            d }~ww xY w|                    |           Rt          |          dk    rd}t          |          dk    rd}|D ]}|D ]}||k    r	t          d-|z             t          j
        }|r|t          j        z  }|                     ||          }	 |                                 }n)# t          $ r}|                     | |d.          d }~ww xY w	 |                     ||          \  } }!n)# t          $ r}|                     | |d/          d }~ww xY w| j                            d0|!j        j        d1|!j        j        d2|!j        d3           |}	 |                                 }"n)# t          $ r}|                     | |d4          d }~ww xY w	 |                     |"|          }#n)# t          $ r}|                     | |d5          d }~ww xY w|#j        |#j        k    r t          d6|#j        d7|#j        d8          	 |"                    |#j        d d          }$n# t          $ r}|                     |t<          j                  rt          d9| j         z            |                     |t<          j!                  rt          d9| j         z            |                     |t<          j"                  rt          d9| j         z            |                     | |d:          d }~ww xY w| j                            d;           | #                    |$|!j        j        <           	 | $                                }%n)# t          $ r}|                     | |d=          d }~ww xY wd>tK          |%&                                          z  }&d?d@g}'	 |%'                    |&tP          j)        dA|'B          }(|(d         })n.# tP          j*        $ r}| +                    | |dC          d }~ww xY wg }*d?|)v r|*,                    |)d?                    g }+d@|)v r|+,                    |)d@                    | j                            dDt          |*          z             |*D ]$},| j                            dEdFdGdH|,d3           %| j                            dIt          |+          z             |+D ]$},| j                            dEdFdGdH|,d3           %|sd S d}-g }.|.,                    |*           d}/g }0|0,                    |+           |D ]w}1t[          |.          D ]N\  }2},tK          |,                                          |1                                k    rt          dJ|1z            O|.                    |1           d}-x|D ]~}1d }3t[          |.          D ]?\  }2},tK          |,                                          |1                                k    r=|2}3 |3t          dK|1z            |..                    |3           d}-|D ]w}4t[          |0          D ]N\  }2},tK          |,                                          |4                                k    rt          dL|4z            O|0                    |4           d}/x|D ]~}4d }3t[          |0          D ]?\  }2},tK          |,                                          |4                                k    r=|2}3 |3t          dM|4z            |0.                    |3           d}/| j                            dNt          |.          z             |.D ]$},| j                            dEdFdGdH|,d3           %| j                            dOt          |0          z             |0D ]$},| j                            dEdFdGdH|,d3           %tQ          j/                    }5|)j0        |5_0        |-r#tQ          j1        |.tP          j2        d?          |5d?<   |/r#tQ          j1        |0tP          j2        d@          |5d@<   	 |%3                    |5           n.# tP          j*        $ r}| +                    | |dP          d }~ww xY w	 |"                    |#j        d d          }6n)# t          $ r}|                     | |d:          d }~ww xY w| j                            dQ           | #                    |6|!j        j        <           d S 	 t          j4                    }7||7_        |5                    | |7t          j6                  }8n[# tn          $ rN}|                     |tp          j9                  rt          dR|z            |                     | |dS          d }~ww xY w| j                            dT|8j:        j        d1|8j        j        d2|8j        d3           |8j;        t          j<        z  st          dU|z            |.	 |                                 }"n)# t          $ r}|                     | |d4          d }~ww xY w	 |                     |"|          }#n)# t          $ r}|                     | |d5          d }~ww xY wdV}9|dk    rtz          j>        }:|rd}9nd}:	 |"                    |#j        |8j        j        |:          };n)# t          $ r}|                     | |d:          d }~ww xY w	 |?                    | |8j        t          j@        |;|9          }<n)# t          $ r}|                     | |dW          d }~ww xY w| j                            dX           | #                    |;|8j        j        |<Y           |dk    r	 t          j4                    }7|8j        j        |7_        |A                    | |7t          j@                  }6n)# t          $ r}|                     | |dZ          d }~ww xY w| j                            dQ           | #                    |6|8j        j        <           d S 	 t          j4                    }7|8j        j        |7_        |A                    | |7t          j@                  }=n)# t          $ r}|                     | |dZ          d }~ww xY w| j                            d[           | #                    |=|8j        j        <           |sd S g }>|>,                    |=jB                   t          jC                    }?t          |>          |?_D        |>|?_B        |r$t[          |?jB                  D ]j\  }2}@|@jE        t          jF        k    r|?jB        |2         jG        dk    r2d|?jB        |2         _H        |?jB        |2         xjG        t          jI         z  c_G        kt[          |?jB                  D ]\  }2}@|@jE        t          j@        k    r|?jB        |2         jG        dk    r2d|?jB        |2         _H        |?jB        |2         xjG        t          jJ         z  c_G        |?jB        |2         xjG        t          jK         z  c_G        |D ]}Ad }3t[          |?jB                  D ]R\  }2}@|@jE        t          jF        k    r|@jL        j                                        |A                                k    rP|2}3 |3t          d\|Az            |?jB        |3         jG        t          jI        z  st          d]|Az            d|?jB        |3         _H        |?jB        |3         xjG        t          jI         z  c_G        |D ]}Ad }3t[          |?jB                  D ]R\  }2}@|@jE        t          jF        k    r|@jL        j                                        |A                                k    rP|2}3 |3t          d^|Az            |?jB        |3         jG        t          jM        z  rt          d_|Az            d|?jB        |3         _H        |?jB        |3         xjG        t          jI         z  c_G        |?jB        |3         xjG        t          jM        z  c_G        |	D ]}Bd }3t[          |?jB                  D ]R\  }2}@|@jE        t          jN        k    r|@jL        j                                        |B                                k    rP|2}3 |3t          d`|Bz            da|B                                z  }Cd }3t[          |?jB                  D ]l\  }2}@|@jE        t          jF        k    rda|@jL        j                                        z  }D|C|Dk    rt          db|Bz            |CO                    |D          sj|2}3 |3t          dc|Bz            t          jP                    }@t          jN        |@_E        d|@_G        d|@_H        |B|@jL        _        g }>|>,                    |?jB                   |>Q                    |3dVz   |@           t          |>          |?_D        |>|?_B        |
D ]}Bd }3t[          |?jB                  D ]R\  }2}@|@jE        t          jN        k    r|@jL        j                                        |B                                k    rP|2}3 |3t          dd|Bz            g }>|>,                    |?jB                   |>.                    |3           t          |>          |?_D        |>|?_B        |D ]}Ed }3t[          |?jB                  D ]W\  }2}@|@jE        t          j@        k    r|@jL        jR        j                                        |E                                k    rU|2}3 |3t          de|Ez            |?jB        |3         jG        t          jJ        z  st          df|Ez            d|?jB        |3         _H        |?jB        |3         xjG        t          jJ         z  c_G        |D ]}Ed }3t[          |?jB                  D ]W\  }2}@|@jE        t          j@        k    r|@jL        jR        j                                        |E                                k    rU|2}3 |3t          dg|Ez            |?jB        |3         jG        t          jS        z  rt          dh|Ez            d|?jB        |3         _H        |?jB        |3         xjG        t          jJ         z  c_G        |?jB        |3         xjG        t          jS        z  c_G        |D ]}d }3t[          |?jB                  D ].\  }2}@|@jE        t          j@        k    r|@jL        jT        |k    r,|2}3 |3t          di|z            |?jB        |3         jG        t          jK        z  st          dj|Ez            d|?jB        |3         _H        |?jB        |3         xjG        t          jK         z  c_G        |D ]}d }3t[          |?jB                  D ].\  }2}@|@jE        t          j@        k    r|@jL        jT        |k    r,|2}3 |3t          dk|z            |?jB        |3         jG        t          jU        z  rt          dl|Ez            d|?jB        |3         _H        |?jB        |3         xjG        t          jK         z  c_G        |?jB        |3         xjG        t          jU        z  c_G        	 |?                    | |8j        t          j@        |?d          }Fn)# t          $ r}|                     | |dW          d }~ww xY w| j                            dm           | #                    |?|8j        j        |FY           	 t          j4                    }7|8j        j        |7_        |A                    | |7t          j@                  }6n)# t          $ r}|                     | |dZ          d }~ww xY w| j                            dQ           | #                    |6|8j        j        <           d S )nNFr  z'--refresh=%s not allowed without DOMAINz'--enable-all not allowed without DOMAINr   z'--enable-tln not allowed without DOMAINz(--disable-tln not allowed without DOMAINz'--add-tln-ex not allowed without DOMAINz*--delete-tln-ex not allowed without DOMAINz&--enable-nb not allowed without DOMAINz'--disable-nb not allowed without DOMAINz'--enable-sid not allowed without DOMAINz(--disable-sid not allowed without DOMAINz*.zEvalue[%s] specified for --add-upn-suffix should not include with '*.'TzHvalue[%s] specified for --delete-upn-suffix should not include with '*.'z@value[%s] specified for --add-upn-suffix and --delete-upn-suffixzEvalue[%s] specified for --add-spn-suffix should not include with '*.'zHvalue[%s] specified for --delete-spn-suffix should not include with '*.'z@value[%s] specified for --add-spn-suffix and --delete-spn-suffixz1--add-upn-suffix not allowed together with DOMAINz4--delete-upn-suffix not allowed together with DOMAINz1--add-spn-suffix not allowed together with DOMAINz4--delete-spn-suffix not allowed together with DOMAINz3--enable-all not allowed together with --refresh=%sz0--enable-tln not allowed together with --refreshz1--disable-tln not allowed together with --refreshz0--add-tln-ex not allowed together with --refreshz3--delete-tln-ex not allowed together with --refreshz/--enable-nb not allowed together with --refreshz0--disable-nb not allowed together with --refreshz0--enable-sid not allowed together with --refreshz1--disable-sid not allowed together with --refreshz3--enable-tln not allowed together with --enable-allz2--enable-nb not allowed together with --enable-allz3--enable-sid not allowed together with --enable-allz6value[%s] specified for --enable-tln and --disable-tlnzAvalue[%s] specified for --add-tln-ex should not include with '*.'zDvalue[%s] specified for --delete-tln-ex should not include with '*.'z8value[%s] specified for --add-tln-ex and --delete-tln-exz4value[%s] specified for --enable-nb and --disable-nbz7value[%s] specified for --enable-sid is not a valid SIDz8value[%s] specified for --disable-sid is not a valid SIDz6value[%s] specified for --enable-sid and --disable-sidr  r  r  r  rs  r  r  r  zThe local domain [z] is not the forest root [r  z@LOCAL_DC[%s]: netr_DsRGetForestTrustInformation() not supported.r  z Own forest trust information...
r  zfailed to connect to SamDBr  uPNSuffixeszmsDS-SPNSuffixesz(objectClass=crossRefContainer)r  zfailed to search partition dnz#Stored uPNSuffixes attributes[%d]:
ro  ru   rp  rq  z(Stored msDS-SPNSuffixes attributes[%d]:
zBEntry already present for value[%s] specified for --add-upn-suffixz?Entry not found for value[%s] specified for --delete-upn-suffixzBEntry already present for value[%s] specified for --add-spn-suffixz?Entry not found for value[%s] specified for --delete-spn-suffixz#Update uPNSuffixes attributes[%d]:
z(Update msDS-SPNSuffixes attributes[%d]:
zfailed to update partition dnz#Stored forest trust information...
r  rO  rP  zItrusted domain object for domain [%s] is not marked as FOREST_TRANSITIVE.r   r  z"Fresh forest trust information...
r  z(lsaRQueryForestTrustInformation() failedz"Local forest trust information...
z8Entry not found for value[%s] specified for --enable-tlnzGEntry found for value[%s] specified for --enable-tln is already enabledz9Entry not found for value[%s] specified for --disable-tlnzIEntry found for value[%s] specified for --disable-tln is already disabledz>Entry already present for value[%s] specified for --add-tln-exz.%sz:TLN entry present for value[%s] specified for --add-tln-exz>No TLN parent present for value[%s] specified for --add-tln-exz;Entry not found for value[%s] specified for --delete-tln-exz7Entry not found for value[%s] specified for --enable-nbzFEntry found for value[%s] specified for --enable-nb is already enabledz7Entry not found for value[%s] specified for --delete-nbzHEntry found for value[%s] specified for --disable-nb is already disabledz8Entry not found for value[%s] specified for --enable-sidzGEntry found for value[%s] specified for --enable-sid is already enabledz8Entry not found for value[%s] specified for --delete-sidzIEntry found for value[%s] specified for --disable-sid is already disabledz$Updated forest trust information...
)Vr   r!  rW  r'  r%  r   r8  	TypeErrorr  r   r  r  r  r  r   r  r  r   r   r   rK   r   r  r  r  r   forest_namer  r  r  r   r  rq  WERR_INVALID_FUNCTIONWERR_NERR_ACFNOTLOADEDr  r  r   r  r  r  r  r  r  ra  ru  popr  r  r  r  r  r  r  rF  r   r   r  rq  r  r  r   r  r  rz  r  rt  r  r  rN   rx  r  timeLSA_TLN_DISABLED_MASKLSA_NB_DISABLED_MASKLSA_SID_DISABLED_MASKrw  rc  ry  endswithForestTrustRecordinsertr|  rk  r<  ri  )Gr   r   r   r  r   r\  r]  r_  r`  ra  rb  rg  rh  rd  re  ri  rj  rk  rl  require_updatenr  r  rP  
enable_sidr  r  r  disable_sidr  rq  r  r  r  r  r-  own_forest_infolocal_samdblocal_partitions_dnr  r  
stored_msgstored_upn_valsstored_spn_valsr|  replace_upnupdate_upn_valsreplace_spnupdate_spn_valsupnr  idxspn
update_msgstored_forest_infor  r  lsa_update_checknetlogon_update_tdofresh_forest_infofresh_forest_collisionr5  rt  update_forest_inforR  r~  tln_extln_dotr_dotnbupdate_forest_collisionsG                                                                          r   r   zcmd_domain_trust_namespaces.run  s$    >'!!"#Lw#VWWW N"#LMMM:"""#LMMM;!##"#MNNN:"""#LMMM=!!A%%"#OPPP9~~!!"#KLLL:"""#LMMM>""Q&&"#LMMM?##a''"#MNNN7||a  t tA<<-- ! &'nqr'rsss!%:""# w wA<<-- ! &'qtu'uvvv!% o o# o oAwwyyAGGII-- &'ilm'mnnno
 7||a  t tA<<-- ! &'nqr'rsss!%:""# w wA<<-- ! &'qtu'uvvv!% o o# o oAwwyyAGGII-- &'ilm'mnnnoo 7||a"#VWWW:"""#YZZZ7||a"#VWWW:"""#YZZZ'!!!% dg00"#X[b#bccc:"""#UVVV;!##"#VWWW:"""#UVVV=!!A%%"#XYYY9~~!!"#TUUU:"""#UVVV>""Q&&"#UVVV?##a''"#VWWW (  
^!%z??Q&&&'\]]]y>>A%%&'[\\\~&&**&'\]]]:""!%;!##!% e e$ e eAwwyyAGGII-- &'_bc'cddde
 :""# p pA<<-- ! &'jmn'nooo!%=!!A%%& s sA<<-- ! &'mpq'qrrr!% g g& g gAwwyyAGGII-- &'ade'efffg
 9~~!!!%:""!% c c# c cAwwyyAGGII-- &']`a'abbbc
 J# ' 'f"*1--CC  f f f&'`cd'deeef!!#&&&&K$ ( (g"*1--CC  g g g&'ade'efffg""3'''':""!%;!##!% e e$ e eAAvv &'_bc'cddde
 "C 	>3#==..y+FF	V5577II 	V 	V 	V((u6TUUU	V	]-1->->yJ]-^-^*\>> 	] 	] 	]((u6[\\\	] 		&+222&1888&***, 	- 	- 	-
 >_!%!C!C!E!E _ _ _,,T5:]^^^_\&*&?&?P\&]&]## \ \ \,,T5:Z[[[\ #.2E2QQQ"l#6#B#B#B#6#B#B#B$D E E Eh"0"R"RSfSmSWYZ#\ #\ h h h++E63YZZ ;&'i'+'8(: ; ; ; ++E63OPP ;&'i'+'8(: ; ; ; ++E63PQQ ;&'i'+'8(: ; ; ; ,,T5:fgggh IOO?@@@((-;-F-M ) O O OX"<<>> X X X,,T5:VWWWX #5s;;X;X;Z;Z7[7["["$67EW"))/B035V05 * 7 7 "!W

< W W W((u6UVVVW !O
**&&z-'@AAA O!Z//&&z2D'EFFFIOOBSEYEYYZZZ$ D D	BBBB BCCCCIOOG#oJ^J^^___$ D D	BBBB BCCCC! K O""?333K O""?333 # #%o66 E EDAq1vv||~~44* ,>@C,D E E E 5  &&s+++"! # #%o66  DAq1vv||~~44 C;&'hkn'nooo##C(((" # #%o66 E EDAq1vv||~~44* ,>@C,D E E E 5  &&s+++"! # #%o66  DAq1vv||~~44 C;&'hkn'nooo##C((("IOOBSEYEYYZZZ$ D D	BBBB BCCCCIOOG#oJ^J^^___$ D D	BBBB BCCCCJ&MJM N,/,>?B?S?L-N -N
=)  X141CODGDXDV2X 2X
-.W"":....< W W W((u6UVVVWh%3%U%UViVpVZ\]&_ &_"" h h h,,T5:fgggh IOOBCCC(();-;-F-M ) O O OF	f
I%I66|7@7:7Z\ \ N  	f 	f 	f''x/WXX d"#Y\b#bccc((u6deee		f 		&3:::&2999&***, 	- 	- 	-
 .1ZZ 	ujmssttt_!%!C!C!E!E _ _ _,,T5:]^^^_\&*&?&?P\&]&]## \ \ \,,T5:Z[[[\  !'!!&.&A# )'($&'#
h #DDEXE_ESE_EfEXZ Z "!   h h h,,T5:fggghd;;L<J<V<?<\<M<L	N N '&   d d d,,T5:bcccd IOOABBB(():-;-G-N4J ) L L L '!!j #
I'5'A'HI$!AA,BKBEBbd d '& $ j j j00u>hiiij 	 FGGG,,-?1?1K1R - T T T F	b
I-9@I99,:C:=:Z\ \   	b 	b 	b((u6`aaa	b 		=>>>$$%6)7)C)J 	% 	L 	L 	L  	F(0111 799#&w<< %," 	R!"4"<== R R16S@@@%-a06!;;56"*1-2"*1-338Q7QQ333!"4"<== R R16S===%-a06!;;56"*1-2"*1-338P7PP33"*1-338Q7QQ333 	P 	PCC!"4"<==  16S@@@&-3355DD{"#]`c#cddd%-c283;TT t"#lor#rsss34&s+0&s+11c6O5OO111 	P 	PCC!"4"<==  16S@@@&-3355DD{"#^ad#deee!)#.4s7QQ v"#nqt#tuuu34&s+0&s+11c6O5OO11&s+11S5OO111  &	1 &	1FC!"4"<==  16SCCC&-3355GG"#cfl#lmmmfllnn,GC!"4"<== 	 	16S@@@ 3 : @ @ B BBe##&'cfl'lmmm''.. {"#cfl#lmmm%''A;AFAGAF)/A&GNN-5666NN37A&&&'*7||$)0&&# 	1 	1FC!"4"<==  16SCCC&-3355GG{"#`ci#ijjjGNN-5666KK'*7||$)0&& 	O 	OBC!"4"<==  16S===&:AGGIIRXXZZWW{"#\_a#abbb%-c283;SS r"#knp#pqqq34&s+0&s+11c6N5NN111 	O 	OBC!"4"<==  16S===&:AGGIIRXXZZWW{"#\_a#abbb!)#.4s7PP t"#mpr#rsss34&s+0&s+11c6N5NN11&s+11S5NN111 	P 	PCC!"4"<==  16S===&1S88{"#]`c#cddd%-c283;TT s"#loq#qrrr34&s+0&s+11c6O5OO111 	P 	PCC!"4"<==  16S===&1S88{"#]`c#cddd!)#.4s7QQ u"#nqs#sttt34&s+0&s+11c6O5OO11&s+11S5OO111	`&/&M&MlN\NhNQNnN`bc'e 'e##  	` 	` 	`((u6^___	` 		?@@@$$%7)7)C)J0G 	% 	I 	I 	I	b
I-9@I!*!J!J<KTKNKk"m "m  	b 	b 	b((u6`aaa	b 		>???$$%7)7)C)J 	% 	L 	L 	Ls-  (Z==
[[[>\
\4\//\4_" "
`,```& &
a0aab% %
c/ccc& &
d0dd e 
h('B<h##h('i< <
j"jj"+k: :l%	l  l%} ~)~  ~	~& &
0@;AA	 A	
AB!AA	ABBAB!DAD  D 
AED*AEEAEE
AE! E!
AFE+AFFAFF&&AG G
AG3GAG.G.AG3G7(AH  H 
AIH*AIIAIJAAK K
AK8KAK3K3AK8L9AAM? M?
AN%N	AN N AN%v(Aw w
Aw-wAw(w(Aw-x-AAy3 y3
Azy=AzzAzr  r   r   r   rZ  rZ    s       )))H )-0  	{=///b		 	 	
 	~lW 	 	 	 	~hU 	 	 	 	xV!	 	 	 	~hW 	 	 	 	 ;Z#	 	 	 	}X_	 	 	 	~h` 	 	 	 	~hV$	 	 	 	xW%	 	 	 	!(Kl	 	 	 	$X{t 	 	 	 	!(Kq	 	 	 	$X{y 	 	 	m:Mx J4TUrbrRB2rb	^
 ^
 ^
 ^
 ^
 ^
r   rZ  c                       e Zd ZdZdZ edddedd           ed	d
e           edde          gZdgZ	e
j        e
j        e
j        dZd ZdS )cmd_domain_tombstones_expungezZExpunge tombstones from the database.

This command expunges tombstones from the database.z%prog NC [NC [...]] [options]r  r  r  r  r  r  z--current-timezQThe current time to evaluate the tombstone lifetime from, expressed as YYYY-MM-DDrb   z--tombstone-lifetimez2Number of days a tombstone should be preserved forznc*r   c                    |                     d          }|                     d          }|                     d          }|                     d          }|                     d          }|                                }|                    |          }	t          |t	                      |	|          }
|.|,t          d| j                   t          d	| j                   |7t          j        |d
          }t          t          j
        |                    }n t          t          j                              }t          |          dk    rZ|
                    ddt          j        dg          }g }|d         d         D ]$}|                    t!          |                     %nt#          |          }d}	 |
                                 d}|
                    |||          \  }}n8# t(          $ r+}|r|
                                 t-          d|          d }~ww xY w|
                                 | j                            d||fz             d S )Nr   r   r  current_timetombstone_lifetimer  ztNote: without --current-time or --tombstone-lifetime only tombstones already scheduled for deletion will be deleted.)rM  z5To remove all tombstones, use --tombstone-lifetime=0.z%Y-%m-%dr   ru   namingContexts)r  r  r  r  FT)r  r  z.Failed to expunge / garbage collect tombstonesz-Removed %d objects and %d links successfully
)r+  r   ru  r   r   r   r   rt  strptimer   mktimer!  r  r  r  r  r   listtransaction_startgarbage_collect_tombstonesr7  transaction_cancelr   transaction_commitr   )r   ncskwargsr   r   r  current_time_stringr  r   rp  r  current_time_objr  r   r  started_transactionremoved_objectsremoved_linksr   s                      r   r   z!cmd_domain_tombstones_expunge.run  s   JJ{++	::j))JJsOO$jj88#ZZ(<==##%%((,,!.*:*:"'B0 0 0 &+=+E  &*i1 1 1 1 Iy" " " " *#}-@*MMt{+;<<==LL ty{{++Ls88q==,,"2S^&6%7  9 9C C!f-. $ $

3r77####$ s))C#	V##%%%"&#>>sLXRd ? f f_]  	V 	V 	V" +((***OQTUUU	V
 	  """	H*M:; 	< 	< 	< 	< 	<s   :1G, ,
H!6&HH!N)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r    s        7 7 /H 	tW#JQT3	( 	( 	(g	 	 	 	%,`gjkkkM J ).- 4< 4< 4< 4< 4<r   r  c                       e Zd ZdZi Z e            ed<    e            ed<    e            ed<    e            ed<    e	            ed<    e
            ed<    e            ed<   d	S )
cmd_domain_trustz#Domain and forest trust management.r  r
  creater  r  r  
namespacesN)r   r   r   r   rV  r  r  r  r  rC  rL  rZ  r   r   r   r  r    s        --K//11K//11K3355K3355K3355K7799K
 ; ; = =Kr   r  c                   0    e Zd ZdZi Z e            ed<   dS )cmd_domain_tombstonesz0Domain tombstone and recycled object management.expungeN)r   r   r   r   rV  r  r   r   r   r  r    s.        ::K::<<K	r   r  c                   $    e Zd ZdZd Zd Zd ZdS )ldif_schema_updatez-Helper class for applying LDIF schema updatesc                 >    d| _         d | _        d | _        d| _        d S )NFru   )
is_defunctunknown_oidr  ldifrw  s    r   ri  zldif_schema_update.__init__  s#    			r   c                     |j         \  }}|t          j        k    r | j        rt	          d| j        z             dS | j        !t	          d| j        d| j                   dS dS )z>Checks if we can safely ignore failure to apply an LDIF updatez)Defunct object %s doesn't exist, skippingTNzSkipping unknown OID z for object F)r  r  ERR_NO_SUCH_OBJECTr  r   r  r  )r   r  numr  s       r   can_ignore_failurez%ldif_schema_update.can_ignore_failure  st    
f #(((T_(=GHHH4)ET=M=M=MtwwWXXX4ur   c                    	 	 |                     | j        dg           nj# t          j        $ rX}|j        d         t          j        k    r2|                                 |                     | j        dg           n Y d}~nd}~ww xY wnz# t          j        $ rh}|                     |          rY d}~dS t          d|z             t          d           t          d           t          d| j        z              d}~ww xY wd	S )
z*Applies a single LDIF update to the schemazrelax:0)r  r   NException: %sz4Encountered while trying to apply the following LDIFz4----------------------------------------------------r  r   )	modify_ldifr  r  r  r  ERR_INVALID_ATTRIBUTE_SYNTAXset_schema_update_nowr  r   )r   r  rP  s      r   applyzldif_schema_update.apply  sA   	!!$)yk!BBBB<   6!9 @@@ //111%%di9+%FFFF GFFFF | 		 		 		&&q)) qqqqqo)***LMMMLMMMdTY&'''		 qs?   ! B BAB>B BB DC>6AC>>DN)r   r   r   r   ri  r  r  r   r   r   r  r    sG        77        r   r  c                   
   e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
ddd           e
dddd           e
dddddgdd           e
dedd           e
dedd          gZd Zd  Zd! ZdS )"cmd_domain_schema_upgradezDomain schema upgradingr   rg  r  r  r  r  r  r  r]   r^   r_   rQ   r`   rk   rl   rm   z--schemarT   SCHEMArI   rJ   <The schema file to upgrade to. Default is (Windows) 2012_R2.ri   z
--ldf-fileNzBJust apply the schema updates in the adprep/.LDF file(s) specified)rN   rj   rP   z
--base-dirz4Location of ldf files Default is ${SETUPDIR}/adprep.c           	         d}t                      }|D ]7}|                                }|dk    r3|j        dk    r)||                    |          z  }t                      }P|                                                    d          r;|dt          d                    t          |                                          z   }na|                                                    d          r:|dt          d                    t          |                                          z   }|	                    d          }|d         
                                dk    r|d                                         |_        |d         
                                d	k    rP|
                                                    d
d          }|
                                                    dd          }|d         
                                dv r|\  }}d|v r|                    |                                d|d|ddg          }	t          |	          dk    r||_        n:t          |	d         d         d                   }
|                    |d|
z             }|d         
                                dk    r7|d                                         
                                dk    rd|_        |d         
                                dk    r2|d                                         
                                dk    rd}|xj        |dz   z  c_        9|S )z
        Applies a series of updates specified in an .LDIF file. The .LDIF file
        is based on the adprep Schema updates provided by Microsoft.
        r   ru   zDC=XNzCN=Xr  r  r   
changetypez: ntdsschemaaddz: addz: ntdsschemamodifyz: modify)rdnattid
subclassofsystemposssuperiorssystemmaycontainsystemauxiliaryclassr   z(|(attributeId=z)(governsId=z))ldapDisplayNamer  r   	isdefuncttrueTaddshowinadvancedviewonlyzreplace: showInAdvancedViewOnlyr   )r  r   r  r  r%  rx  r!  r   r  r~   r'  r   r  rR  r  r  r  r  )r   r  	ldif_filer  ldif_oprZ  values_r{  r   display_names              r   _apply_updates_in_filez0cmd_domain_schema_upgrade._apply_updates_in_file:  s,   
 $&&  F	( F	(D;;==D rzz <2%% u--- -.. zz||$$V,, MMc&kk\M*S1I1I1K1K-L-LL&&v.. MMc&kk\M*S1I1I1K1K-L-LLZZ__Fay  D((#AY__..
 ay  L00zz||++,=,35 5zz||++,@,68 8 ay   %= = = "5 %<<,,E,C,C,E,E,E(-uuu36.?-@ ' B BC
 3xx1}}.3++'*3q62C+DQ+G'H'H#||E33EFF ay  K//F1IOO4E4E4K4K4M4MQW4W4W%)" ay  E))fQioo.?.?.E.E.G.GKc.c.c8 LLD4K'LLLr   c                 @   t          d|z             d}	 t          t          j                            ||                    }|                     ||          }|r|                                 n# |r|                                 w w xY wt          d|z             |S )zBWrapper function for parsing an LDIF file and applying the updateszApplying %s updates...Nz%u changes applied)r   rv   rw   r-  r  r  r}   )r   r  update_filebase_dirr  r  s         r   _apply_updatez'cmd_domain_schema_upgrade._apply_update  s     	&4555		"RW\\(K@@AAI//yAAE  "!!!  "!!!!" 	"U*+++s   AA0 0B	c                    	 ddl m} n># t          $ r1}| j                            d|z             t          d          d }~ww xY wddlm} d}|                    d          }|                    d          }|	                                }|
                    |          }	|                    d	          }
|                    d
          }|                    d          }|                    d          }d }t          |
t                      |	|          }|                    d          '|                    dd           t          d           d}t          j        ||                                          }t%          |t'          |                                          d
          }||k    rt          d          |r|                    d          }ng }|                    |          }|                    |                                t          j        dg          }t3          |          dk    rt          d          t5          |d         d         d                   dz   }t7          d          }|yt9          j                    }t7          d          }	  |||           nG# t<          $ r:}t          d|z             t?          j         |           t          d          d }~ww xY w|}tC          ||dz             D ]S}d|z  }|"                    |           tF          j$        %                    tF          j$        &                    ||dz                       }|rtF          j$        '                    |          r	 tQ          j)        d|d|gtP          j*        tP          j*        |           }n8# tV          tX          f$ r$ t?          j         |           t          d!          w xY w|-                                \  }}|j.        r8t          d"|d#|           t?          j         |           t          d          t          d$|d%|           U|t7          d&          }|/                                 d}d}	 |D ]} || 0                    || |          z  }|dk    r$|1                                 t          d'           n#t          d(           |2                                 nN# t<          $ rA}t          d)|z             t          d*           |2                                 d}Y d }~nd }~ww xY w|r|                    dd+           |rt?          j         |           |rt          d          d S ),Nr   )read_ms_markdownz$Exception in importing markdown: %s
zIFailed to import module markdown, please install python3-markdown package)SchemaFr   r   r  schemaldf_filer  r  dsdb:schema update allowedr   ;Temporarily overriding 'dsdb:schema update allowed' settingT%This server is not the schema master.r  objectVersion)r  r  r  r   z*Could not determine current schema versionzadprep/WindowsServerDocsz*adprep/WindowsServerDocs/Schema-Updates.mdz!Exception in markdown parsing: %szFailed to upgrade schemaz	Sch%d.ldfz.diffpatchz-i)rr   rs   cwdz6Failed to upgrade schema. Is '/usr/bin/patch' missing?zException in patch: r   zPatched z using adprepzSchema successfully updatedzNo changes applied to schemar  z*Error encountered, aborting schema upgrader   )3samba.ms_schema_markdownr  ImportErrorr   r   r   samba.schemar  r+  r   ru  r   r   r  r   r  r  get_dsServiceNamer   r   r  r~   get_versionr  r  r!  r   r>   r0  mkdtempr7  shutilrmtreeranger  rw   r-  r2  r  r  ry   rz   r{   OSErrorIOErrorr|   
returncoder  r  r  r  )!r   r  r  rP  r  updates_allowed_overriddenr   r   r   rp  r  target_schema	ldf_filesr  temp_folderr  own_dnmasterschema_updatesr   r   startdiff_dirr  versionupdatediffr   rr   rs   r  error_encounteredr  s!                                    r   r   zcmd_domain_schema_upgrade.run  s   	lAAAAAAA 	l 	l 	lIOOCaGHHHjkkk	l 	('''''%*"JJ{++	::j))##%%((,,JJsOO

8,,JJz**	::j))!.*:*:RTUUU 66.//7FF/777OPPP)-&u668899#E3u/F/F/H/H+I+I$,. .VFGGG  7	B&__S11NNN $$]33C ,,E$;$;$=$=%(^O;L  N NC 3xx1}}"#OPPPA/233a7E!"<==H&.00()UVVC$$[+>>>>  C C C=ABBBM+...&'ABBBC
 ' a00 B B$w.%%f--- wrw||Hfw>N'O'OPP B27>>$#7#7 BK&,gvtT-J4>O4>OV V V $W- K K Kk222* ,J K K KK
 &']]__NFF| GfffffMNNNk222*+EFFFE66644@AAA!(++H!!!!	%+ H H	++E9hGGGqyy((***344444555((*** 	% 	% 	%/A%&&&>???$$&&& $		% & 	7FF/666 	'M+&&& 	;9:::	; 	;sO   	 
A,?AJ+ +
K/55K**K/0N775O,A,S3 3
T>=7T99T>)r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r   r   r   r   r  r     s8       !! H )-.  	tW#JQT3	( 	( 	(tYZEEEt[|LIIIz(	*R 	" 	" 	" 	|#tX	Z 	Z 	Z|#tJ	L 	L 	LMQ Q Qf  &{; {; {; {; {;r   r  c                       e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
ddd           e
dddd           e
dddg ddd           e
ddd           e
ddd          gZd ZdS ) cmd_domain_functional_prepz#Domain functional level preparationr   rg  r  r  r  r  r  r  r]   r^   r_   rQ   r`   rk   rl   rm   r   rT   FUNCTION_LEVELrG   r  rJ   ri   z--forest-prepzJRun the forest prep (by default, both the domain and forest prep are run).rR   z--domain-prepzJRun the domain prep (by default, both the domain and forest prep are run).c                    d}|                     d          }|                     d          }|                                }|                    |          }|                     d          }t          |                     d                   }|                     d          }	|                     d          }
t	          |t                      ||          }|                     d	          '|                    d	d
           t          d           d}|	|
d}	d}
t          j	        ||
                                          }|	rEt          |t          |                                          d          }||k    rt          d          |
r?|                                }d|z   }t          ||d          }||k    rt          d          |	r|                                 d}	 ddlm}  ||d          }|                    g d           |                    |t*          d           |                                 n?# t.          $ r2}t          d|z             |                                 d}Y d }~nd }~ww xY w|
r|                                 d}	 ddlm}  ||d          }|                    |t6          d           |                                 n?# t.          $ r2}t          d|z             |                                 d}Y d }~nd }~ww xY w|r|                    d	d           |rt          d          d S )NFr   r   r  rE  forest_prepdomain_prepr  r  r   r  Tr  r  zCN=Infrastructure,infrastructurez-This server is not the infrastructure master.r   )ForestUpdate)fix)5   O   P   Q   R   S   )update_revisionr  )DomainUpdater   z!Failed to perform functional prep)r+  r   ru  string_version_to_constantr   r   r  r   r  r  r  r   r   r  r   r  r  samba.forest_updater	  check_updates_iteratorcheck_updates_functional_levelr2   r  r7  r  samba.domain_updater  r1   )r   r  r  r   r   r   rp  r  target_levelr  r  r  r  r  r  infrastructure_dnr  r	  r   rP  r  r   s                         r   r   zcmd_domain_functional_prep.run8  s   %*"JJ{++	::j))##%%((,,JJsOO1&**=M2N2NOjj//jj//!.*:*:RTUUU 66.//7FF/777OPPP)-&;#6KKu668899 	L's53J3J3L3L/M/M(02 2F"#JKKK 	T))I 4y @'/@(8: :F"#RSSS 	)##%%% %)<<<<<<%e666--.F.F.FGGG55l6PFJ 6 L L L ((**** ) ) )o)***((***$(!!!!!!)
  	)##%%% %)<<<<<<%e66655l6MFJ 6 L L L ((**** ) ) )o)***((***$(!!!!!!)
 & 	7FF/666 	DBCCC	D 	Ds2    AH< <
I8(I33I8AK 
L#(LLNr7  r   r   r   r  r    s       -- H )-.  	tW#JQT3	( 	( 	(tYZEEEt[|LIII!:J555R 	" 	" 	" 	|`	b 	b 	b|`	b 	b 	bMMD MD MD MD MDr   r  c                      e Zd ZdZi Ze e            ed<    e            ed<    e            ed<    e            ed<    e	            r e
            ed<    e            ed<    e            ed	<    e            ed
<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<   dS dS )
cmd_domainzDomain management.Nexportkeytabr,  r  r  demoter;   dcpromolevelpasswordsettingsclassicupgradesamba3upgradetrust
tombstonesschemaupgradefunctionalprepbackup)r   r   r   r   rV  r   r   rz  r  r-   r  r   rf  r  rT  rX  rc  r  r  r  r  rC   r   r   r   r  r    sl       K+&>&>&@&@N#)/++K)/++K++--K~ 4 1 1 3 3H#7#7#9#9K !3!3!5!5I//11G*E*E*G*G&'(A(A(C(C$%'?'?'A'AO$//11G$9$9$;$;L!'@'@'B'BO$(B(B(D(D$% 1 1 3 3H4 4r   r  )samba.getoptgetoptr   r  rw   r   ry  randomr0  loggingry   rt  r  r4  r   r   r   r   	samba.netr   r	   r
   samba.ntacls
samba.joinr   r   
samba.authr   samba.samdbr   r   	samba.ndrr   r   samba.dcerpcr   r   r   r   r   r   r   samba.dcerpc.samrr   r   samba.netcmdr   r   r   r   samba.netcmd.fsmor   samba.netcmd.commonr    r!   r"   r#   samba.samba3r$   r%   r  samba.upgrader&   samba.drs_utilsr'   r(   r)   r*   samba.auth_utilr+   samba.net_s3r  samba.paramr,   r-   
samba.dsdbr.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   r:   samba.provisionr;   r<   r=   r>   samba.provision.commonr?   r@   rA   samba.netcmd.psorB   samba.netcmd.domain_backuprC   samba.commonrD   samba.trust_utilsrE   rF   r  r   rb  rx  rd  r   r   r  r   r   rf  rz  r  r  r  r%  r9  rT  rX  rc  r   rf  rm  r  r  r  r  rC  rL  rZ  r  r  r  r  r  r  r  r   r   r   <module>rD     s?  2       



 				 



                                   0 0 0 0 0 0 0 0 * * * * * *     ) ) ) ) ) ) ) ) % % % % % % 8 8 8 8 8 8 8 8 ) ) ) ) ) ) ) )             ! ! ! ! ! !       ! ! ! ! ! ! ! ! ! ! ! !             V V V V V V V V            1 0 0 0 0 0 A A A A A A4 4 4 4 4 4 4 4 4 4        ) ) ) ) ) ) - - - - - - + + + + + + B B B B B B B B B B / / / / / / & & & & & & $ $ $ $ $ $                                                               = < < < < < 8 8 8 8 8 8 # # # # # # 6 6 6 6 6 6       *#)   F?:<> > >
F => > > F8^5>88::;< < < F!@A A A F=%AM M M
F4LAAA! & F:Ls333
F8.s333
F#8      F?3G:::R $% % % F4<EEE   F=L      
 
 
BB B B B B7 B B B B  $ $ $#$4E E E E Eg E E E>E E E E E7 E E EP
8W 8W 8W 8W 8W 8W 8W 8Wvh_ h_ h_ h_ h_g h_ h_ h_V# # # # #w # # #<g/ g/ g/ g/ g/ g/ g/ g/T	gd gd gd gd gdw gd gd gdT=a =a =a =a =aw =a =a =a@M& M& M& M& M&g M& M& M&`; ; ; ; ;, ; ; ;FX FX FX FX FX FX FX FXR    8   S S S S S : S S S
A A A A A A A AH, , , , ,. , , ,^h h h h h. h h hTv v v v v0 v v vpD D D D D0 D D DNU U U U U0 U U Upp p p p p 2 p p pfg g g g g"4 g g gTK< K< K< K< K<G K< K< K<\
> 
> 
> 
> 
>| 
> 
> 
>= = = = =L = = =5 5 5 5 5 5 5 5p{; {; {; {; {; {; {; {;|gD gD gD gD gD gD gD gDT4 4 4 4 4 4 4 4 4 4s   
H5 5H?>H?