
    b[                       d dl Z d dlmZ d dlZd dlZd dlmc mZ	 d dl
Z
d dlZd dlmZ d dlmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ d dlZd dlZd d	lmZmZm Z  d d
l!m"Z" d dlm#Z# d dl$m%Z& d dl$m'Z( d dlm)Z) d dl*Z*d dl+m,Z, d dlm-Z- d dl.m/Z/ d dl0m1Z1m2Z2m3Z3 d dl4m5Z5 d dl6m7Z7m8Z8m9Z9m:Z: d dl;m<Z< d dl=m>Z> d dl?m@Z@ d dlm%Z% d dlAmBZB d dl!mCZC d dlDmEZEmFZF d dlGmHZH d dlImJZJmKZK d dlLmMZMmNZN d dlOZOd ZPd ZQd  ZRd! ZSdd"ZTd# ZUdddejV        ejW        z  ejX        z  ejY        z  fd$ZZd% Z[d& Z\d' Z]ej^        fd(Z_d) Z`e(ja        e(jb        z  e(jc        z  e(jd        z  Zed* Zf	 	 dd,Zgd- Zhd. Zi G d/ d0e          Zj G d1 d2ej          Zk G d3 d4ej          Zl G d5 d6ej          Zm G d7 d8ej          Zn G d9 d:ej          Zo G d; d<ej          Zp G d= d>ej          Zq G d? d@ej          Zr G dA dBej          Zs G dC dDej          Zt G dE dFej          Zu G dG dHej          Zv G dI dJev          Zw G dK dLej          Zx G dM dNej          Zy G dO dPe          Zz G dQ dRe          Z{ G dS dTe          Z| G dU dVe          Z} G dW dXe          Z~ G dY dZe          Z G d[ d\e          Z G d] d^e          Z G d_ d`e          Z G da dbe          Z G dc dde          Z G de dfe          Z G dg dhe          Z G di dje          Z G dk dle          Z G dm dne          Z G do dpe          Z G dq dre          Z G ds dte          Z G du dve          Z G dw dxe          Z G dy dze          Z G d{ d|e          Z G d} d~e          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          Z G d de          ZdS )    N)system_session)CommandCommandErrorOptionSuperCommand)SamDB)dsdb)security)
ndr_unpackndr_pack)preg) AUTH_SESSION_INFO_DEFAULT_GROUPSAUTH_SESSION_INFO_AUTHENTICATED#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)netcmd_finddc)policy)param)libsmb_samba_internal)NTSTATUSError)dsacl2fsacl)nbt)Net)GPParserGPNoParserExceptionGPGeneralizeException)GPPolParser)GPIniParserGPTIniParserGPFDeploy1IniParserGPScriptsIniParser)GPAuditCsvParser)GptTmplInfParser)GPAasParser)SMB_SIGNING_REQUIRED)attr_default)	get_bytes
get_string)ConfigParser)StringIOBytesIO)	calc_modestat_from_modec                 b    t          j        |           }|sd}nd                    |          }|S )zreturn gpo flags stringNONE )r   get_gpo_flagsjoin)valueflagsrets      2/usr/lib/python3/dist-packages/samba/netcmd/gpo.pygpo_flags_stringr6   J   s5     ''E hhuooJ    c                 b    t          j        |           }|sd}nd                    |          }|S )zreturn gplink options stringr.   r/   )r   get_gplink_optionsr1   )r2   optionsr4   s      r5   gplink_options_stringr;   T   s7    '..G  hhwJr7   c                    g }|                                  dk    r|S |                     d          }|D ]}|s|                    d          }t          |          dk    s|d                             d          st	          d|z            |                    |d         dd	         t          |d
                   d           |S )z.parse a gPLink into an array of dn and options ];   r   z[LDAP://zBadly formed gPLink '%s'   N   dnr:   )stripsplitlen
startswithRuntimeErrorappendint)gplinkr4   agds        r5   parse_gplinkrP   ^   s    
C||~~
SA ; ; 	GGCLLq66Q;;adooj99;9A=>>>

!A$qrr(s1Q4yy99::::Jr7   c                 D    d                     d | D                       }|S )z4Encode an array of dn and options into gPLink stringr=   c              3   <   K   | ]}d |d         |d         fz  V  dS )z[LDAP://%s;%d]rD   r:   N ).0rN   s     r5   	<genexpr>z encode_gplink.<locals>.<genexpr>r   s5      MM"agq|%<<MMMMMMr7   )r1   )gplistr4   s     r5   encode_gplinkrW   p   s'    
''MMfMMM
M
MCJr7   c                     |;|4	 t          | |          }n"# t          $ r}t          d|          d}~ww xY wd|z   }|S )zjIf URL is not specified, return URL for writable DC.
    If dc is provided, use that to construct ldap URLNzCould not find a DC for domainldap://)r   	ExceptionrI   )lpcredsurldces        r5   dc_urlr`   v   sg     {:H"2u-- H H H"#CQGGGH"nJs    
616c                     |                                  }|                    t          j        | d                     |                    t          j        | d|z                       |S )zConstruct the DN for gpoCN=Policies,CN=SystemzCN=%s)get_default_basedn	add_childldbDn)samdbgporD   s      r5   
get_gpo_dnri      s[     
	!	!	#	#BLL677888LLw}--...Ir7   c                    |                                  }|                    t          j        | d                     |}d}t          j        }|dt          j        |          z  }|dt          j        |          z  }||}t          j        }	 |                     |||g dd|z  g          }	n,# t          $ r}
|d	|z  }nd
}t          ||
          d}
~
ww xY w|	S )z0Get GPO information using gpo, displayname or dnrb   z"(objectClass=groupPolicyContainer)Nz.(&(objectClass=groupPolicyContainer)(name=%s))z5(&(objectClass=groupPolicyContainer)(displayname=%s)))nTSecurityDescriptorversionNumberr3   namedisplayNamegPCFileSysPathgPCMachineExtensionNamesgPCUserExtensionNamessd_flags:1:%d)basescope
expressionattrscontrolsz!Cannot get information for GPO %szCannot get information for GPOs)
rc   rd   re   rf   SCOPE_ONELEVELbinary_encode
SCOPE_BASEsearchrZ   r   )rg   rh   displaynamerD   sd_flagspolicies_dnbase_dnsearch_exprsearch_scopemsgr_   mesgs               r5   get_gpo_infor      s#    **,,K#&(?@@AAAG6K%L
FIZ[^I_I__MPSPabmPnPnn	~~$ll|&1"; "; "; &5x%?$@  
B 
B  $ $ $?6<DD4D4###$ Js    B1 1
C;CCc                     d|z  }	 |                      |dg          }n%# t          $ r}t          d|z  |          d}~ww xY w|S )z lists dn of containers for a GPOz(&(objectClass=*)(gPLink=*%s*))gPLink)ru   rv   z'Could not find container(s) with GPO %sN)r{   rZ   r   )rg   rh   r   r   r_   s        r5   get_gpo_containersr      sm     4c9KOllk(lDD O O ODsJANNNO Js     
A=Ac                    	 |                      |t          j        ddg          d         }n%# t          $ r}t	          d|z  |          d}~ww xY wd}t          t          | |                    }d|v rwt          t          |d         d                             }|D ]K}|d                                         |                                k    r|	                    |           d	} nLnt	          d
          |st	          d|z            t          j
                    }	||	_        |r3t          |          }
t          j        |
t          j        d          |	d<   n/t          j        |d         d         t          j        d          |	d<   	 |                     |	           dS # t          $ r}t	          d|          d}~ww xY w)z!delete GPO link for the container(objectClass=*)r   rs   rt   ru   rv   r   Container '%s' does not existNFrD   Tz"No GPO(s) linked to this containerz%GPO '%s' not linked to this containerr0d0z!Error removing GPO from container)r{   re   rz   rZ   r   strri   rP   lowerremoveMessagerD   rW   MessageElementFLAG_MOD_REPLACEFLAG_MOD_DELETEmodify)rg   container_dnrh   r   r_   foundgpo_dnrV   rN   m
gplink_strs              r5   del_gpo_linkr      s   NllCN&7"*  - --.0  N N N:\I1MMMN EE3''((F3c#h-"23344 	 	Aw}}&,,..00a    1
 ?@@@ JBSHIIIAAD V"6**
$Z1ExPP$$S]1%5s7JHUU$CQ C C C>BBBCs,   *- 
AA

AF% %
G/F??Gc                 "   g }|                      d          r| dd                             dd          }n3|                      d          r| dd                             dd          }t          |          dk    rt          d| z            |S )	z;Parse UNC string into a hostname, a service, and a filepath\\r@   N\z///   zInvalid UNC string: %s)rH   rF   rG   
ValueError)unctmps     r5   	parse_uncr      s    
C
~~f $!""gmmD!$$			 $!""gmmC##
3xx1}}1C7888Jr7   c                    t          j        d| |          rt                      S t          j        d| |          rt                      S t          j        d| |          rt	                      S t          j        d| |          rt                      S t          j        d| |          rt                      S t          j        d| |          rt                      S t          j        d| |          rt                      S t          j        d	| |          rt                      S t          j        d
| |          rt                      S t          j        d| |          rt                      S t                      S )Nzfdeploy1\.ini$r3   zaudit\.csv$zGptTmpl\.inf$z	GPT\.INI$zscripts\.ini$zpsscripts\.ini$z	GPE\.INI$z.*\.ini$z.*\.pol$z.*\.aas$)rematchr   r!   r"   r   r    r   r   r   r#   )rm   r3   s     r5   find_parserr      sz   	x!4u555 %"$$$	xE222 "!!!	x $e444 "!!!	xd%000 ~~	x $e444 $!###	x"D666 $!###	xd%000 
 zz	xT/// }}	xT/// }}	xT/// }}::r7   c                    d}t           j                            |          st          j        |           |g}|g}|r|                                }|                                }|                     |t                    }|                    d            |D ]"}	|dz   |	d         z   }
t           j                            ||	d                   }|	d         t          j
        z  r?|                    |
           |                    |           t          j        |           |                     |
          }t          ||z   d          5 }|                    |           d d d            n# 1 swxY w Y   t          |	d                   }|                    |           |                    |d	z              $|d S d S )
N.SAMBABACKUPattribsc                     | d         S Nrm   rS   xs    r5   <lambda>z2backup_directory_remote_to_local.<locals>.<lambda>#  
    AfI r7   keyr   rm   attribwb.xml)ospathisdirmkdirpoplist
attr_flagssortr1   libsmbFILE_ATTRIBUTE_DIRECTORYrJ   loadfileopenwriter   parse	write_xml)conn	remotedirlocaldirSUFFIXr_dirsl_dirsr_dirl_dirdirlistr_   r_namel_namedatafparsers                  r5    backup_directory_remote_to_localr     s   F7=="" 
]F\F
 2



))E:)66--... 	2 	2AT\AfI-FW\\%633F{V<< 2f%%%f%%%    }}V,,&6/400 "AGGDMMM" " " " " " " " " " " " " " " %QvY//T"""  &1111+  2 2 2 2 2s   E11E5	8E5	c                    t           j                            |          st          j        |           |g}|g}|r%|                                }|                                }|                     |t                    }|                    d            |D ]}|dz   |d         z   }	t           j                            ||d                   }
|d         t          j
        z  r?|                    |	           |                    |
           t          j        |
           |                     |	          }t          |
d                              |           |#d S d S )Nr   c                     | d         S r   rS   r   s    r5   r   z0copy_directory_remote_to_local.<locals>.<lambda>F  r   r7   r   r   rm   r   r   )r   r   r   r   r   r   r   r   r1   r   r   rJ   r   r   r   )r   r   r   r   r   r   r   r   r_   r   r   r   s               r5   copy_directory_remote_to_localr   <  sZ   7=="" 
[FZF
 /



))E:)66--... 
	/ 
	/AT\AfI-FW\\%633F{V<< /f%%%f%%%    }}V,,VT""((....!  / / / / /r7   Fc                    |                      |          s|                     |           |g}|g}|rV|                                }|                                }t          j        |          }	|	                                 |	D ]}
t          j                            ||
          }|dz   |
z   }t          j                            |          rT|	                    |           |	                    |           	 |                     |           # t          $ r |s Y w xY w|r'	 |                     |           # t          $ r Y nw xY wt          |d                                          }|                     ||           |Td S d S )Nr   rb)chkpathr   r   r   listdirr   r   r1   r   rJ   r   r   r   readsavefile)r   r   r   ignore_existing_dirkeep_existing_filesr   r   r   r   r   r_   r   r   r   s                 r5   copy_directory_local_to_remoter   T  s    <<	"" 

9ZF[F
 ,



*U## 	, 	,AW\\%++FT\A%Fw}}V$$ ,f%%%f%%%JJv&&&&$   .   ' f--- (    FD))..00fd++++7  , , , , ,s$   :DD D &D<<
E	E	c                     |                     dd                              d          }d}|D ]4}|dz   |z   }|                     |          s|                     |           5d S )Nr   r   r=   )replacerF   r   r   )r   r   elemsr   r_   s        r5   create_directory_hierr   y  sw    c4((..t44ED  d{Q||D!! 	JJt r7   c                 Z   |                                 }|                    t                     	 t          j                    }|                    |j                   t          j        | |||          }n # t          $ r t          d| z            w xY w|                    |           |S )Nr[   r\   z"Error connecting to '%s' using SMB)get_smb_signingset_smb_signingr$   s3paramget_contextload
configfiler   ConnrZ   r   )dc_hostnameservicer[   r\   saved_signing_states3_lpr   s          r5   smb_connectionr     s      //11	.///O#%%

2=!!!{;EGGG O O O?+MNNNO 
-...Ks   AA6 6Bc                       e Zd Zd Zd ZdS )
GPOCommandc                    |,t          j                    }t          d|z  | j                   t          j                            |          st          d|z            t          j                            |d          }t          j                            |          st	          j	        |           t          j                            ||          }t          j                            |          rt          d|z            	 t	          j	        |           n)# t          t          f$ r}t          d|          d}~ww xY w||fS )a  Ensure that the temporary directory structure used in fetch,
        backup, create, and restore is consistent.

        If --tmpdir is used the named directory must be present, which may
        contain a 'policy' subdirectory, but 'policy' must not itself have
        a subdirectory with the gpo name. The policy and gpo directories
        will be created.

        If --tmpdir is not used, a temporary directory is securely created.
        Nz5Using temporary directory %s (use --tmpdir to change))filez'Temporary directory '%s' does not existr   z8GPO directory '%s' already exists, refusing to overwritez%Error creating teporary GPO directory)tempfilemkdtempprintoutfr   r   r   r   r1   r   IOErrorOSError)selftmpdirrh   r   gpodirr_   s         r5   construct_tmpdirzGPOCommand.construct_tmpdir  sJ    >%''FIFRy" " " " w}}V$$ 	SH6QRRR7<<11w}}X&& 	HXh,,7==   	UJVSU U U	KHV! 	K 	K 	KFJJJ	K v~s   D E +D;;E c                     	 t          | j        t                      | j        | j                  | _        dS # t          $ r}t          d| j        z  |          d}~ww xY w)z$make a ldap connection to the serverr]   session_infocredentialsr[   zLDAP connection to %s failed N)r   r]   r   r\   r[   rg   rZ   r   )r   r_   s     r5   samdb_connectzGPOCommand.samdb_connect  sx    	N48,:,<,<+/:$'C C CDJJJ  	N 	N 	N>I1MMM	Ns   37 
AAAN)__name__
__module____qualname__r  r  rS   r7   r5   r   r     s8        ! ! !FN N N N Nr7   r   c                   l    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZddZd
S )cmd_listallzList all GPOs.%prog [options]	sambaoptsversionoptscredopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestNc                 l   |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  t          | j        d           }|D ],}| j	        
                    d|d         d         z             | j	        
                    d|d         d         z             | j	        
                    d|d	         d         z             | j	        
                    d
|j        z             | j	        
                    dt          |dd          z             | j	        
                    dt          t          t          |dd                              z             | j	        
                    d           .d S )NTfallback_machineGPO          : %s
rm   r   display name : %s
rn   path         : %s
ro   dn           : %s
version      : %s
rl   0flags        : %s
r3   
)get_loadparmr[   get_credentialsr\   r`   r]   r  r   rg   r   r   rD   r%   r6   rK   )r   r  r  r  r  r   r   s          r5   runzcmd_listall.run  s   ((**--dg-MM
$'4:q114:t,, 	" 	"AIOO1AfIaL@AAAIOO1Am4DQ4GGHHHIOO1A6F4G4JJKKKIOO1AD8999IOO1LOUX4Y4YYZZZIOO14DSVWY`bcIdIdEeEe4f4ffgggIOOD!!!!	" 	"r7   NNNNr  r	  r
  __doc__synopsisr:   SambaOptionsVersionOptionsCredentialsOptionstakes_optiongroupsr   r   takes_optionsr)  rS   r7   r5   r  r    s         H )-.  	tW#JQT3	( 	( 	(M
" " " " " "r7   r  c                   r    e Zd ZdZdZdgZej        ej        ej	        dZ
 edddedd	
          gZddZdS )cmd_listzList GPOs for an account.z&%prog <username|machinename> [options]accountnamer  r  r  r  r  r  r  Nc                 	   |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  	 | j                            dt          j
        |          dt          j
        |          d          }|d         j        }n # t          $ r t          d|z            w xY w	 | j                            |t          j        d	g
          d         }d|d	         v }n # t          $ r t          d|z            w xY wt          t           z  }	| j        $| j                            d          r
|	t$          z  }	t&          j                            | j        | j        ||	          }
|
j        }g }d}t          j        | j        t1          |                                                    }	 | j                            |t          j        ddg
          d         }d|v rt5          t1          |d         d                             }|D ]}|s|d         t6          j        z  s|d         t6          j        z  r1	 t<          j        t<          j         z  t<          j!        z  }| j                            |d         t          j        g dd|z  g          }|d         d         d         }tE          t<          j#        |          }n3# t          $ r& | j$        %                    d|d         z             Y w xY w	 t&          j        &                    ||t<          j'        t<          j(        z  t<          j)        z             n3# tT          $ r& | j$        %                    d|j        z             Y dw xY wtW          tY          |d         dd                    }|r|t6          j-        z  r|s|t6          j.        z  r|/                    |d         d         d         |d         d         d         f           tW          tY          |dd                    }|t6          j0        z  rd}|| j        1                                k    rn|                                }|rd}nd}| j$        %                    d|d|d            |D ]/}| j$        %                    d!|d         d|d"         d            0d S )#NTr  z(&(|(samAccountName=z)(samAccountName=z$))(objectClass=User)))ru   r   zFailed to find account %sobjectClass)rs   rt   rv   computerz!Failed to find objectClass for %sldap)lp_ctxrD   session_info_flagsr   	gPOptionsr:   rD   )rm   rn   r3   rk   rr   )rs   rt   rv   rw   rk   z8Failed to fetch gpo object with nTSecurityDescriptor %s
zFailed access check on %s
r3   rn   rm   Fuserz	GPOs for r/   r&  z    rB   )2r'  r[   r(  r\   r`   r]   r  rg   r{   re   ry   rD   rZ   r   rz   r   r   rH   r   sambaauthuser_sessionsecurity_tokenrf   r   parentrP   r	   GPLINK_OPT_ENFORCEGPLINK_OPT_DISABLEr
   SECINFO_OWNERSECINFO_GROUPSECINFO_DACLr   
descriptorr   r   access_checkSEC_STD_READ_CONTROLSEC_ADS_LISTSEC_ADS_READ_PROPrI   rK   r%   GPO_FLAG_MACHINE_DISABLEGPO_FLAG_USER_DISABLErJ   GPO_BLOCK_INHERITANCErc   )r   r5  r  r  r  r  r   user_dnis_computerr;  sessiontokengposinheritrD   glistrN   r}   gmsgsecdesc_ndrsecdescr3   	gpoptionsmsg_strs                           r5   r)  zcmd_list.run  sc   ((**--dg-MM
$'4:q11	J*###%(%6{%C%C%C%CSEVWbEcEcEcEc0e# f fC!fiGG 	J 	J 	J:[HIII	J	R*##}o#^^_`aC$M(::KK 	R 	R 	RB[PQQQ	R ?=> 8DH$7$7$?$?"EE*))$*TW=O * Q Q &VDJG--44661	*##3>(T_I`#aabcdC3$SXq)9%:%:;; $Q $QA" !AiL4;R,R ! |d&== ! !$,$:$,$:%;$,$9%:  $z00agS^8P 8P 8P;JX;U:V  1  X  X '+1g.D&Ea&H",X-@+"N"N$ ! ! !	(c()$)0 1 1 1 !
!33GU4<4Q4<4I5J4<4N5OP P P P ( ! ! !	(E(NOOO !
  T!Wgq A ABBE" !0M(M ! & !ED4N,N ! KKa!7!:DGFOA<N OPPPP Lk1==>>I455  TZ224444Bc1	f  	 GGG	ggg{{{CDDD 	: 	:AIOOOQqTTT1Q44489999	: 	:s?   0AC C!%8D D;:BL-L32L37AM==,N-,N-r*  )r  r	  r
  r,  r-  
takes_argsr:   r.  r/  r0  r1  r   r   r2  r)  rS   r7   r5   r4  r4    s        ##7HJ)-.  	tW#JS	2 	2 	2M
a: a: a: a: a: a:r7   r4  c                   l    e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde          gZd
d	ZdS )cmd_showzShow information for a GPO.%prog <gpo> [options]r  rh   r  r  r  r  Nc                    |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  	 t          | j        |          d         }n # t          $ r t          d|z            w xY w	 |d         d         }t          t          j        |          }|                                }	n# t          $ r d}	Y nw xY w| j                            d|d         d         z             | j                            d	|d
         d         z             | j                            d|d         d         z             | j                            d|j        z             | j                            dt%          |dd          z             | j                            dt'          t)          t%          |dd                              z             | j                            d|	z             | j                            d           d S )NTr  r   GPO '%s' does not existrk   z<hidden>r  rm   r   rn   r!  ro   r"  r#  rl   r$  r%  r3   zACL          : %s
r&  )r'  r[   r(  r\   r`   r]   r  r   rg   rZ   r   r   r
   rH  as_sddlr   r   rD   r%   r6   rK   )
r   rh   r  r  r  r  r   rX  rY  secdesc_sddls
             r5   r)  zcmd_show.runk  s%   ((**--dg-MM
$'4:q11	@tz3//2CC 	@ 	@ 	@83>???	@	&45a8K !4kBBG"??,,LL 	& 	& 	&%LLL	& 		-FA>???	-M0B10EEFFF	-4D0Ea0HHIII	-6777	-S/SV0W0WWXXX	-0@\RUW^`aEbEbAcAc0d0ddeee	-<===	s   0B B)-<C* *C98C9r*  r  r	  r
  r,  r-  r:   r.  r/  r0  r1  r\  r   r   r2  r)  rS   r7   r5   r^  r^  Z  s{        %%&H )-.  J 	tALLLM     r7   r^  c                   p    e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde          gZ	 	 d
d	ZdS )cmd_getlinkzList GPO Links for a container.%prog <container_dn> [options]r  r   r  r  r`  Nc                    |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  	 | j                            |t          j
        ddg          d         }n # t          $ r t          d|z            w xY wd|v r|d         r| j                            d|z             t          t!          |d         d                             }|D ]}t#          | j        |d	         
          }| j                            d|d         d         d         z             | j                            d|d         d         d         z             | j                            dt%          |d                   z             | j                            d           d S | j                            d|z             d S )NTr  r   r   r   r   r   zGPO(s) linked to DN %s
rD   )rD   z    GPO     : %s
rm   z    Name    : %s
rn   z    Options : %s
r:   r&  zNo GPO(s) linked to DN=%s
)r'  r[   r(  r\   r`   r]   r  rg   r{   re   rz   rZ   r   r   r   rP   r   r   r;   )	r   r   r  r  r  r  r   rV   rN   s	            r5   r)  zcmd_getlink.run  s    ((**--dg-MM
$'4:q11	O*##S^/@+3* $ 6 6679CC  	O 	O 	O>MNNN	O s??s8}?IOO6EFFF!#c(mA&6"7"788F & &"4:!D':::	 4s1vf~a7H HIII	 4s1vm7LQ7O OPPP	 47LQy\7Z7Z Z[[[	%%%%& & IOO9LHIIIII   0/B   B=r*  re  rS   r7   r5   rg  rg    s        ))/H )-.  !!J 	tALLLM BFJ J J J J Jr7   rg  c            	           e Zd ZdZdZej        ej        ej        dZ	ddgZ
 edde           ed	d
ddd           eddddd          gZ	 	 ddZdS )cmd_setlinkz(Add or update a GPO link to a container.$%prog <container_dn> <gpo> [options]r  r   rh   r  r  r`  z	--disabledisabledF
store_truezDisable policyr  defaultactionr  z	--enforceenforcedzEnforce policyNc	                 
   |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  d}	|r|	t          j        z  }	|r|	t          j	        z  }		 t          | j        |          d          n # t          $ r t          d|z            w xY wt          t          | j        |                    }
	 | j                            |t"          j        ddg          d         }n # t          $ r t          d	|z            w xY wd
}d|v rt'          t          |d         d                             }d}d
}|D ];}|d                                         |
                                k    r	|	|d<   d} n<|rt          d|z            |                    d|
|	d           ng }|                    |
|	d           t/          |          }t#          j                    }t#          j        | j        |          |_        |r$t#          j        |t"          j        d          |d<   n#t#          j        |t"          j        d          |d<   	 | j                            |           n"# t          $ r}t          d|          d }~ww xY w| j                             d           tC                      "                    |||||           d S )NTr  r   rh   rb  r   r   r   r   FrD   r:   z)GPO '%s' already linked to this containerrC   	new_valuezError adding GPO LinkzAdded/Updated GPO link
)#r'  r[   r(  r\   r`   r]   r  r	   rD  rC  r   rg   rZ   r   r   ri   r{   re   rz   rP   r   insertrJ   rW   r   rf   rD   r   r   FLAG_MOD_ADDr   r   r   rg  r)  )r   r   rh   r  rn  rs  r  r  r  gplink_optionsr   r   existing_gplinkrV   r   rN   r   r   r_   s                      r5   r)  zcmd_setlink.run  s?    ((**--dg-MM
$'4:q11 	6d55N 	6d55N	@---a000 	@ 	@ 	@83>???	@Z
C0011	O*##S^/@+3* $ 6 6679CC  	O 	O 	O>MNNN	O  s??!#c(mA&6"7"788F"OE  T7==??fllnn44#1AiL EE 5  L"#NQT#TUUUa>!J!JKKKKFMMNCCDDD"6**
KMMvdj,// 	X /
C<PRZ[[AkNN /
C<LhWWAkN	;Ja     	; 	; 	;6:::	; 		2333,9hLLLLLs0   B1 1C4/D$ $EJ" "
K,J<<K)NFFNNNre  rS   r7   r5   rl  rl    s        225H )-.  !%(J 	tALLL{U<$	& 	& 	&{U<$	& 	& 	&	M GL7;BM BM BM BM BM BMr7   rl  c                   r    e Zd ZdZdZej        ej        ej        dZ	ddgZ
 edde          gZ	 	 dd
Zd	S )cmd_dellinkz!Delete GPO link from a container.rm  r  	containerrh   r  r  r`  Nc                 <   |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  	 t          | j        |          d          n # t          $ r t          d|z            w xY wt          j        | j        |          }t          | j        ||           | j                            d           t!                                          |||||           d S )NTr  ru  r   rb  zDeleted GPO link.
)r'  r[   r(  r\   r`   r]   r  r   rg   rZ   r   re   rf   r   r   r   rg  r)  )r   r}  rh   r  r  r  r  r   s           r5   r)  zcmd_dellink.run$  s    ((**--dg-MM
$'4:q11	@---a000 	@ 	@ 	@83>???	@ vdj)44TZs333	-...,9hLLLLLs   0B B*r*  re  rS   r7   r5   r|  r|    s        ++5H )-.  u%J 	tALLLM DHM M M M M Mr7   r|  c                   p    e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde          gZ	 	 d
d	ZdS )cmd_listcontainersz%List all linked containers for a GPO.r_  r  rh   r  r  r`  Nc                    |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  t          | j        |          }t          |          rG| j
                            d|z             |D ]%}| j
                            d|d         z             &d S | j
                            d|z             d S )NTr  zContainer(s) using GPO %s
z    DN: %s
rD   zNo Containers using GPO %s
)r'  r[   r(  r\   r`   r]   r  r   rg   rG   r   r   )r   rh   r  r  r  r  r   r   s           r5   r)  zcmd_listcontainers.runK  s     ((**--dg-MM
$'4:q11 S11s88 	BIOO9C?@@@ : :	4 89999: : IOO:S@AAAAAr7   r*  re  rS   r7   r5   r  r  :  s        //&H )-.  J 	tALLLM 9=B B B B B Br7   r  c                   p    e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde          gZ	 	 d
d	ZdS )cmd_getinheritancez%Get inheritance flag for a container.rh  r  r   r  r  r`  Nc                 R   |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |                                  	 | j                            |t          j
        ddg          d         }n # t          $ r t          d|z            w xY wd}d|v rt          |d         d                   }|t          j        k    r| j                            d           d S | j                            d	           d S )
NTr  r   r<  r   r   r   z$Container has GPO_BLOCK_INHERITANCE
zContainer has GPO_INHERIT
)r'  r[   r(  r\   r`   r]   r  rg   r{   re   rz   rZ   r   rK   r	   rO  r   r   )r   r   r  r  r  r  r   inheritances           r5   r)  zcmd_getinheritance.runo  s8    ((**--dg-MM
$'4:q11	O*##S^/@+6- $ 9 99:<CC  	O 	O 	O>MNNN	O #c+.q122K$444IOOCDDDDDIOO9:::::rj  r*  re  rS   r7   r5   r  r  ^  s        ///H )-.  !!J 	tALLLM BF; ; ; ; ; ;r7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	ddgZ
 edde          gZ	 	 dd
Zd	S )cmd_setinheritancez$Set inheritance flag on a container.z.%prog <container_dn> <block|inherit> [options]r  r   inherit_stater  r  r`  Nc                    |                                 dk    rt          j        }n7|                                 dk    rt          j        }nt	          d|z            |                                | _        |                    | j        d          | _        t          | j        | j        |          | _
        |                                  	 | j                            |t          j        ddg          d	         }n # t           $ r t	          d
|z            w xY wt          j                    }	t          j        | j        |          |	_        d|v r1t          j        t+          |          t          j        d          |	d<   n0t          j        t+          |          t          j        d          |	d<   	 | j                            |	           d S # t           $ r}
t	          d|z  |
          d }
~
ww xY w)NblockrU  zUnknown inheritance state (%s)Tr  r   r<  r   r   r   rv  z"Error setting inheritance state %s)r   r	   rO  GPO_INHERITr   r'  r[   r(  r\   r`   r]   r  rg   r{   re   rz   rZ   r   rf   rD   r   r   r   rx  r   )r   r   r  r  r  r  r  r  r   r   r_   s              r5   r)  zcmd_setinheritance.run  s      G++4KK  ""i//*KK?-OPPP((**--dg-MM
$'4:q11	O*##S^/@+6- $ 9 99:<CC  	O 	O 	O>MNNN	O KMMvdj,//# /K0@0@#BVXcddAkNN /K0@0@#BRT_``AkN	XJa      	X 	X 	XCmSUVWWW	Xs$   /C< <D4G 
G2G--G2r*  re  rS   r7   r5   r  r    s        ..?H )-.  !/2J 	tALLLM QU"X "X "X "X "X "Xr7   r  c                       e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde           edd	e          gZddZd
S )	cmd_fetchzDownload a GPO.r_  r  rh   r  r  r`  --tmpdir,Temporary directory for copying policy filesNc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        |                                  	 t          | j
        |          d         }n # t          $ r t          d|z            w xY wt          |d         d                   }		 t          |	          \  }
}}n # t          $ r t          d	|	z            w xY wt!          ||| j        | j        
          }|                     ||          \  }}	 t%          |||           n"# t          $ r}t          d|          d }~ww xY w| j                            d|z             d S )NTr  rY      r^   r   rb  ro   Invalid GPO path (%s)r   Error copying GPO from DCGPO copied to %s
)r'  r[   r(  r\   rH   r]   r   r`   r  r   rg   rZ   r   r   r   r   r   r  r   r   r   )r   rh   r  r   r  r  r  r   r   r   dom_namer   	sharepathr   r  r_   s                   r5   r)  zcmd_fetch.run  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH	@tz3//2CC 	@ 	@ 	@83>???	@ #&'*++	>-6s^^*Xw		 	> 	> 	>6<===	> k7tw$(J0 0 0 ..vs;;	?*4FCCCC 	? 	? 	?:A>>>	? 		,v566666s0   4C C-D   D=7F	 	
F(F##F(NNNNNre  rS   r7   r5   r  r    s        &H )-.  J 	tALLLz NUXYYYM
&7 &7 &7 &7 &7 &7r7   r  c            	           e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde           edd	e           ed
ddd           eddde          gZ	 	 ddZed             ZdS )
cmd_backupzBackup a GPO.r_  r  rh   r  r  r`  r  r  z--generalizez"Generalize XML entities to restoreFro  r  rq  rr  
--entitiesz4File to export defining XML entities for the restoreent_file)r  r  r  Nc	           	         |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }	|| _        n;t          | j        | j                  }	t          | j        | j        |	          | _        |                                  	 t          | j
        |          d         }
n # t          $ r t          d|z            w xY wt          |
d         d                   }	 t          |          \  }}}n # t          $ r t          d	|z            w xY wt!          |	|| j        | j        
          }|                     ||          \  }}	 t%          |||           n"# t          $ r}t          d|          d }~ww xY w| j                            d|z             |r#| j                            d           t*                              | j        ||          }dd l}d                    d t3          |                                |                    d                    D                       }|r[t9          |d          5 }|                    |           d d d            n# 1 swxY w Y   | j                            d|z             n4| j                            d           | j                            |           dD ]p}||
v rjt9          t:          j                            ||dz             d          5 }|                    |
|         d                    d d d            n# 1 swxY w Y   qd S )NTr  rY   r  r  r   rb  ro   r  r   r  r  z(
Attempting to generalize XML entities:
r=   c              3      K   | ]9}d                      |d                             d          |d                   V  :dS )z<!ENTITY {} "{}
">rB   z&;r   N)formatrE   )rT   ents     r5   rU   z!cmd_backup.run.<locals>.<genexpr>@  sc       ^ ^!$ 177AT8J8JCPQFSS ^ ^ ^ ^ ^ ^r7   rB   r   wz$Entities successfully written to %s
z
Entities:
rp   rq   	.SAMBAEXTr   )r'  r[   r(  r\   rH   r]   r   r`   r  r   rg   rZ   r   r   r   r   r   r  r   r   r   r  generalize_xml_entitiesoperatorr1   sorteditems
itemgetterr   r   r   )r   rh   r  r   
generalizer  r  r  r  r   r   r   r  r   r  r   r  r_   entitiesr  entsr   exts                          r5   r)  zcmd_backup.run  s$    ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH	@tz3//2CC 	@ 	@ 	@83>???	@ #&'*++	>-6s^^*Xw		 	> 	> 	>6<===	> k7tw$(J0 0 0 ..vs;;	?,T9fEEEE 	? 	? 	?:A>>>	? 		,v5666 	&IOOHIII!99$)V:@B BHOOO77 ^ ^(.x~~/?/?XEXEXYZE[E[(\(\(\^ ^ ^ ^ ^D  &(C(( "AGGDMMM" " " " " " " " " " " " " " "	 G (!) * * * * 	000	%%% I 	) 	)Cczz"',,vs[/@AA4HH )AGGCHQK((() ) ) ) ) ) ) ) ) ) ) ) ) ) )	) 	)sT   4C C-D   D=7F	 	
F(F##F(/JJJ'"MM	M	c                    i }t           j                            |          st          j        |           |g}|g}|r*|                                }|                                }t          j        |          }|                                 |D ]}	t           j                            ||	          }
t           j                            ||	          }t           j                            |
          r^|	                    |
           |	                    |           t           j                            |          st          j        |           |

                    d          rt           j                            |
          d d         }t          |          }	 t          |
d          5 }|                                }d d d            n# 1 swxY w Y   t          j        |          }|                    |||          }u# t$          $ r |                     d|z             Y w xY wt           j                            |
|          st+          j        |
|           |*|S )Nr   rz%SKIPPING: Generalizing failed for %s
)r   r   existsr   r   r   r   r1   r   rJ   endswithbasenamer   r   r   ET
fromstringgeneralize_xmlr   r   samefileshutilcopy2)r   	sourcedir	targetdirr  r   r   r   r   r   r_   r   r   to_parser   ltempr   concrete_xmlfound_entitiess                     r5   r  z"cmd_backup.generalize_xml_entitiesR  su   w~~i(( 	 HY '	9JJLLEJJLLEj''GLLNNN !9 !9eQ//eQ//7==(( 9MM&)))MM&)))7>>&11 )(((v.. 9 $&7#3#3F#;#;CRC#@!,X!6!6\!%fc!2!2 4e',zz||4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 ,.=+>+>L-3-B-B<QWYa-b-bNN4 \ \ \ JJ'ORZ'Z[[[[[\  "w//?? 9"L888O  '	9R s6   H-GHG	HG	.H"H,+H,)NNFNNNN)r  r	  r
  r,  r-  r:   r.  r/  r0  r1  r\  r   r   r2  r)  staticmethodr  rS   r7   r5   r  r    s        &H )-.  J 	tALLLz NUXYYY~$H\	3 	3 	3|"XS	* 	* 	*M IM6:?) ?) ?) ?)B 1 1 \1 1 1r7   r  c                       e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde           edd	e          gZ	 	 ddZd
S )
cmd_createzCreate an empty GPO.z%prog <displayname> [options]r  r|   r  r  r`  r  r  Nc                 Z   |                                 | _        |                    | j        d          | _        t	          | j        | j                  }|rd|                    d          rO|dd          }|| _        t          j        t          j	        z  t          j
        z  }	|                    ||	          }
n}t          j        t          j	        z  t          j
        z  }	|                    | j                            d          |	          }
|
j        }t          | j        | j        |	          | _        |                                  t!          | j        |
          }|j        dk    rt'          d|z            t)          t+          j                              }d|                                z  }|| _        |
j        }d|d|d|}|                     ||          \  | _        }|| _        	 t;          j        t:          j                             |d                     t;          j        t:          j                             |d                     d}tC          t:          j                             |d          d          "                    |           n"# tF          $ r}t'          d|          d }~ww xY wtI          |          \  }}}|| _%        tM          ||| j        | j                  }|| _'        | j        (                                 	 tS          | j        |          }tU          j+                    }||_,        tU          j-        dtT          j.        d          |d<   | j        /                    |           tU          j+                    }tU          j0        | j        dt)          |          z            |_,        tU          j-        dtT          j.        d          |d<   | j        /                    |           tU          j+                    }tU          j0        | j        dt)          |          z            |_,        tU          j-        dtT          j.        d          |d<   | j        /                    |           tb          j2        tb          j3        z  tb          j4        z  }t!          | j        ||          d         }|d         d         }tk          tb          j6        |          7                                }tc          j8        | j        9                                          }tu          ||          }tb          j6        ;                    ||          }ty          ||           tb          j2        tb          j3        z  tb          j4        z  tb          j=        z  }|>                    |||           t          |||           tU          j+                    }||_,        tU          j-        |tT          j@        d           |d!<   tU          j-        |tT          j@        d"          |d#<   tU          j-        d$tT          j@        d%          |d&<   tU          j-        d'tT          j@        d(          |d)<   tU          j-        d$tT          j@        d*          |d+<   d,g} | j        A                    || -           | j        B                                 n(# tF          $ r | j        C                                  w xY w|t          jE        | j                   | jF        "                    d.|d/|d0           d S )1NTr  )r\   r[   rY   r  )addressr3   realm)domainr3   r  )r|   r   z%A GPO already existing with name '%s'z{%s}r   z\sysvol\z
\Policies\MachineUserz[General]
Version=0
zGPT.INIr  zError Creating GPO filesr   groupPolicyContainerr7  a01
CN=User,%sr}  CN=Machine,%s)rh   r}   rk   rn   a02ro   a03r$  rl   a052gpcFunctionalityVersiona07r3   a04zpermissive_modify:0)rw   zGPO 'z' created as r&  )Gr'  r[   r(  r\   r   rH   r]   r   NBT_SERVER_LDAPNBT_SERVER_DSNBT_SERVER_WRITABLEfinddcgetpdc_dns_namer`   r  r   rg   countr   r   uuiduuid4uppergpo_name
dns_domainr  r   r  r   r   r   r1   r   r   rZ   r   r  r   r   transaction_startri   re   r   rD   r   rx  addrf   r
   rE  rF  rG  r   rH  rc  dom_sidget_domain_sidr   	from_sddlr   SECINFO_PROTECTED_DACLset_aclr   r   r   transaction_committransaction_cancelr  rmtreer   )!r   r|   r  r   r  r  r  netr   r3   	cldap_retr   guidrh   r  unc_pathr  gpt_contentsr_   r  r   r  r   r   r   ds_sd_flags	ds_sd_ndrds_sd
domain_sidsddlfs_sdsiorw   s!                                    r5   r)  zcmd_create.run  sQ    ((**--dg-MM

tw///  	Ci(( 	CABB%KDH(&',-E 

;e
DDII(&',-E 

$'++g*>*>e
LLI#0KdgtzkBBBDH4:;???9q==FTUUU DJLL!!tzz||#$9>ssK #33FC@@V	>HRW\\&)44555HRW\\&&112227Lfi00#66<<\JJJJ 	> 	> 	>91===	> *38)<)<&7I"k7tw$(J0 0 0 	
$$&&&<	,
C00FAAD)*@#BRTabbAeHJNN1 A6$*lS[[&@AAAD)+s7GWWAeHJNN1 A6$*oF&CDDAD)+s7GWWAeHJNN1 $1#12#01K tzs[III!LC23A6Ix2I>>FFHHE ")$**C*C*E*EFFJuj11D'11$
CCE "$	222 ))*() 23C LLE3/// +4CCCAAD)+s7K][[AeH)(C4HJZ[[AeH)#s/C_UUAeH)#s/CE^__AeH)#s/CWMMAeH-.HJa(333
 J))++++	  	 	 	J))+++	 >M$+&&&	kkk333GHHHHHs&   6B'J 
J=(J88J=N[ %[,r  re  rS   r7   r5   r  r    s        .H )-.   J 	tALLLz NUXYYYM
 NR~I ~I ~I ~I ~I ~Ir7   r  c            	            e Zd ZdZdZej        ej        ej        dZ	ddgZ
 edde           ed	d
e           edde           edddd          gZddZ	 	 d fd	Z xZS )cmd_restorez!Restore a GPO to a new container.z/%prog <displayname> <backup location> [options]r  r|   backupr  r  r`  r  r  r  z8File defining XML entities to insert into DOCTYPE headerz--restore-metadataz7Keep the old GPT.INI file and associated version numberFro  r  r=   c                    d}t           j                            |          st          j        |           |g}|g}|r5|                                }|                                }t          j        |          }	|	                                 |	D ]}
t           j                            ||
          }t           j                            ||
          }t           j                            |          r^|	                    |           |	                    |           t           j                            |          st          j        |           |
                    d          rt           j                            |          d d         }t          |          }	 t          |d          5 }|                                }d}|                    |          rE|t!          |          d          }|                    t%          j        ||z   |z                        n*|                    t%          j        ||z                        |                    |d d                    d d d            n# 1 swxY w Y   # t*          $ re |d d         |z   }t-          j        ||d d                    | j                            d|z             | j                            d           Y \ dd l}|                                 |d d         |z   }t-          j        ||d d                    | j                            d	|z             | j                            d           Y xY w|3d S d S )
Nr   r   r  r  z&<?xml version="1.0" encoding="utf-8"?>zWARNING: No such parser for %s
z.WARNING: Falling back to simple copy-restore.
r   z%WARNING: Error during parsing for %s
)r   r   r  r   r   r   r   r1   r   rJ   r  r  r   r   r   rH   rG   load_xmlr  r  write_binaryr   r  r  r   r   	traceback	print_exc)r   r  r  
dtd_headerr   r   r   r   r   r   r_   r   r   r  r   r  r   xml_headoriginal_filer  s                       r5    restore_from_backup_to_local_dirz,cmd_restore.restore_from_backup_to_local_dir/  s   w~~i(( 	 HY :	_JJLLEJJLLEj''GLLNNN 4_ 4_eQ//eQ//7==(( 0_MM&)))MM&)))7>>&11 )(((v.. *_ $&7#3#3F#;#;CRC#@!,X!6!6#_!%fc!2!2 Ae',zz||+S#'??8#<#< !V ,0H+?D %+OOBM(ZBWZ^B^4_4_$`$`$`$`$*OOBM*tBS4T4T$U$U$U !' 3 3F3B3K @ @ @!A A A A A A A A A A A A A A A$  3 _ _ _,23B3K&,@M"LssDDD IOO,NQY,YZZZ IOO,]^^^^^	_,,,,%//111 -33B3K&,@M"LssDDD IOO,TW],]^^^ IOO,]^^^^^U*_!  :	_ :	_ :	_ :	_ :	_s9   I?.B8I2&I?2I6	6I?9I6	:I??A+M*-A:M*Nc
                 
   d}
t           j                            |          st          d|z            |d}
t           j                            |          st          d|z            t	          |d          5 }|                                }t          j        d|t          j                  	 t          d          |
|	                                z  }
d d d            n# 1 swxY w Y   |
d	z  }
t          t          |                               ||||||           	 |                     || j        |
           |	 }t          | j        | j        | j        d
|           t%          | j        | j                  }dD ]}t           j                            ||dz             }t           j                            |          rt	          |d          5 }|                                }d d d            n# 1 swxY w Y   t-          j                    }||_        t-          j        |t,          j        |          ||<   | j                            |           d S # t8          $ r}dd l}|                                 | j                             tC          |          dz              | j                             d           tE                      }|                    | j        ||||           t          d|z            d }~ww xY w)Nr=   z"Backup directory does not exist %sz<!DOCTYPE foobar [
zEntities file does not exist %sr  z*(\s*<!ENTITY\s*[a-zA-Z0-9_]+\s*.*?>)+\s*\Zr   zPEntities file does not appear to conform to format
e.g. <!ENTITY entity "value">z
]>
T)r   r   r  r  r   r   r&  z%Failed to restore GPO -- deleting...
zFailed to restore: %s)#r   r   r  r   r   r   r   r   	MULTILINErE   superr  r)  r  r  r   r   r  ri   rg   r  r1   re   r   rD   r   r   r   rZ   r  r  r   r   r   cmd_del)r   r|   r  r  r   r  r  r  r  restore_metadatar  entities_fileentities_contentkeep_new_filesr   r  ext_filer   r   r   r_   r  cmd	__class__s                          r5   r)  zcmd_restore.runs  s    
w~~f%% 	NCfLMMM 0J7>>(++ -"#D#+$, - - -h$$ 	7#0#5#5#7#7  8H,BLB B BEIJ& (G H H H .44666
	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 ("Jk4  $$[!VY%-{	< 	< 	<&	<11&$+2<> > > "21N +49dk+/>?C?MO O O O
  
DM::F M ) )7<<k0ABB7>>(++ 	)h-- ( vvxx( ( ( ( ( ( ( ( ( ( ( ( ( ( ( A!AD /c6J035 5AcF J%%a((() )  		< 		< 		<!!!IOOCFFTM***IOODEEE))CGGDM1i;GGG6:;;;		<sR   :AC##C'*C'!B2I G4(I 4G8	8I ;G8	<AI 
L#BK==L)r=   NNNNNNN)r  r	  r
  r,  r-  r:   r.  r/  r0  r1  r\  r   r   r2  r  r)  __classcell__)r  s   @r5   r  r    s       ++@H )-.   *J 	tALLLz NUXYYY|"\cfggg#*c\	3 	3 	3	MB_ B_ B_ B_H ei/3G< G< G< G< G< G< G< G< G< G<r7   r  c                   p    e Zd ZdZdZej        ej        ej        dZ	dgZ
 edde          gZ	 	 d
d	ZdS )r  zDelete a GPO.r_  r  rh   r  r  r`  Nc           	         |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        |                                  	 t          | j
        |          d         }t          |d         d                   }n # t          $ r t          d	|z            w xY wt          |          \  }	}
}t          ||
| j        | j        
          }| j
                                         	 t#          | j
        |          }t%          |          ra| j                            d|z             |D ]A}t+          | j
        |d         |           | j                            d|d         z             Bt-          | j
        |          }| j
                            t1          j        | j
        dt          |          z                       | j
                            t1          j        | j
        dt          |          z                       | j
                            |           |                    |           | j
                                         n(# t          $ r | j
                                          w xY w| j                            d|z             d S )NTr  rY   r  r  ru  r   ro   rb  r   zGPO %s is linked to containers
rD   z    Removed link from %s.
r  r  zGPO %s deleted.
)r'  r[   r(  r\   rH   r]   r   r`   r  r   rg   r   rZ   r   r   r   r  r   rG   r   r   r   ri   deletere   rf   deltreer  r  )r   rh   r  r  r  r  r   r   r  r  r   r  r   r   r   s                  r5   r)  zcmd_del.run  s    ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH	@tzs333A6C3/0344HH 	@ 	@ 	@83>???	@ *38)<)<&7Ik7tw$(J0 0 0 	
$$&&&	,$TZ55C3xx M	 BS HIII M MA QtWc:::IOO$AAdG$KLLLL  
C00FJcfTZF1KLLMMMJcfTZ3v;;1NOOPPPJf%%% LL### J))++++	  	 	 	J))+++	 		+c122222s   47C, ,D	EJ= =%K"r*  re  rS   r7   r5   r  r    s        &H )-.  J 	tALLLM 9=63 63 63 63 63 63r7   r  c                   l    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZddZd
S )cmd_aclcheckz.Check all GPOs have matching LDAP and DS ACLs.r  r  r  r  r  r  r  r  Nc           	         |                                 | _        |                    | j        d          | _        t	          | j        | j        |          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t	          | j        | j        |          | _        |                                  t          | j
        d           }|D ]}t          |d         d                   }	 t          |          \  }	}
}n # t          $ r t          d|z            w xY wt          ||
| j        | j        	          }|                    |t"          j        t"          j        z  t"          j        z  t"          j                  }d
|vrt          d          |d
         d         }t-          t"          j        |                                          }t#          j        | j
                                                  }t7          ||          }|                    |          |k    r+t          d|                    |          d|d|          d S )NTr  rY   r  r  ro   r   r  r   rk   zKCould not read nTSecurityDescriptor. This requires an Administrator accountzInvalid GPO ACL z
 on path (z), should be )r'  r[   r(  r\   r`   r]   rH   r   r  r   rg   r   r   r   r   r   get_aclr
   rE  rF  rG  SEC_FLAG_MAXIMUM_ALLOWEDr   rH  rc  r  r  r   )r   r  r  r  r  r   r   r   r   r  r   r  r   r  r  r  r  expected_fs_sddls                     r5   r)  zcmd_aclcheck.run  s   ((**--dg-MM
$'4:q11  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH4:t,, 	O 	OAa()!,--CB1:3.7II B B B"#:S#@AAAB "+w47(,
4 4 4D LLH,BXE[,[^f^s,su}  vW  X  XE%Q.." $L M M M 01!4Ix2I>>FFHHE ")$**C*C*E*EFFJ*5*==j))-==="lV[VcVcdnVoVoVoVoqzqzqz  }M  }M  $N  O  O  O >3	O 	Os   	DD:r*  r+  rS   r7   r5   r  r    s        88 H )-.  	tW#JQT3	( 	( 	(M
-O -O -O -O -O -Or7   r  c            
           e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
deej                             ej                    d                    gZ	 	 ddZdS )cmd_admxloadz Loads samba admx files to sysvolr  r  r  r  r  r  r  r  z
--admx-dirz)Directory where admx templates are storedz
samba/admx)r  r  rq  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }d	                    | j        
                    d	                                          d
dg          }	 |                    |           nI# t          $ r<}	|	j        d         dk    rt          d          |	j        d         dk    r Y d }	~	nd }	~	ww xY wt!          j        |          D ]j\  }
}}|D ]_}|
                    |d          }t           j        	                    |
|          }d	                    ||g                              dd          }d	                    ||g          }	 t)          ||           nI# t          $ r<}	|	j        d         dk    rt          d          |	j        d         dk    r Y d }	~	nd }	~	ww xY wt+          |d          5 }	 |                    ||                                           n7# t          $ r*}	|	j        d         dk    rt          d          Y d }	~	nd }	~	ww xY wd d d            n# 1 swxY w Y   al| j                            d           d S )NTr  rY   r  r  sysvolr   r   r  PoliciesPolicyDefinitionsr      "    :The authenticated user does not have sufficient privilegesl   5    r=   r   r   a  Installing ADMX templates to the Central Store prevents Windows from displaying its own templates in the Group Policy Management Console. You will need to install these templates from https://www.microsoft.com/en-us/download/102157 to continue using Windows Administrative Templates.
)r'  r[   r(  r\   rH   r]   r   r`   r   r1   r  r   r   r   argsr   r   walkr   r   r   r   r   r   r   r   )r   r  r  r  r  admx_dirr   r   smb_dirr_   dirnamedirsfilesfnamepath_in_admx	full_pathsub_dirsmb_pathr   s                      r5   r)  zcmd_admxload.runX  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 ))TW[[117799')<> ? ?	JJw 	 	 	vayJ&&" $D E E Ej(( )((((		 %'GH$5$5 	Q 	Q GT5 Q Q&x<<GLL%88	))Wl$;<<DDS$OO99gu%566)$8888$   vayJ..* ,L M M Mj00 10000	 )T** QaQh9999( Q Q Q6!9
22". 0P #Q #Q Q 32222QQ Q Q Q Q Q Q Q Q Q Q Q Q Q QQ( 		 P 	Q 	Q 	Q 	Q 	Qsl   ?D 
E2EE7H
I2I		I!K#(JK
K 	 J;	6K;K 	 KKKr  )r  r	  r
  r,  r-  r:   r.  r/  r0  r1  r   r   r   r   r1   r   data_dirr2  r)  rS   r7   r5   r  r  F  s        ** H )-.  	tW#JQTC	) 	) 	)|"M"',,~u~/?/?"N"N	P 	P 	PM FJ8Q 8Q 8Q 8Q 8Q 8Qr7   r  c                       e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
ddd          gZg dZ	 	 ddZdS )cmd_add_sudoersa  Adds a Samba Sudoers Group Policy to the sysvol

This command adds a sudo rule to the sysvol for applying to winbind clients.

The command argument indicates the final field in the sudo rule.
The user argument indicates the user specified in the parentheses.
The users and groups arguments are comma separated lists, which are combined to
form the first field in the sudo rule.
The --passwd argument specifies whether the sudo entry will require a password
be specified. The default is False, meaning the NOPASSWD field will be
specified in the sudo entry.

Example:
samba-tool gpo manage sudoers add {31B2F340-016D-11D2-945F-00C04FB984F9} ALL ALL fakeu fakeg

The example command will generate the following sudoers entry:
fakeu,fakeg% ALL=(ALL) NOPASSWD: ALL
    z7%prog <gpo> <command> <user> <users> [groups] [options]r  r  r  r  r  r  r  z--passwdro  Fz;Specify to indicate that sudo entry must provide a password)rr  rq  r  )rh   commandr=  userszgroups?Nc                    |                                 | _        |	                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }d	
                    |dg          }	 t          j        t          j        |                    |                              }|                                                    d          }|                    d          }n7# t$          $ r)}|j        d         dv rt          j        t          j        d                    }t          j        |                                d          }t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }t          j        |d          }d|_        n!|j        d         dk    rt/          d           Y d }~nd }~ww xY wt          j        |d          }|rt          j        |d            t          j        |d!          }||_        t          j        |d"          }||_        t          j        |d#          }|                    d$          D ](}t          j        |d%          }||_        d"|j        d&<   )|=|                                D ](}t          j        |d%          }||_        d'|j        d&<   )t5                      } |                    | d(d)           |                     d           	 t;          ||           |                    ||                                            d S # t$          $ r&}|j        d         dk    rt/          d           d }~ww xY w)*NTr  rY   r  r  r  r   r  r   r  MACHINE\VGP\VTLA\SudoSudoersConfigurationmanifest.xmlpolicysettingr   r      3       4       :    	vgppolicyversion1rm   zSudo Policydescriptionz!Sudoers File Configuration Policy
apply_modemergeload_plugintruer  r   sudoers_entrypasswordr0  r=  listelement,	principalr  groupUTF-8encodingxml_declaration) r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  ElementTreer  r   getrootfindr   r!  Element
SubElementtextr   rF   r   r*   r   seekr   r   r   )!r   rh   r0  r=  r1  groupspasswdr  r  r  r  r   r   r  vgp_dirvgp_xmlxml_datar6  r   r_   pvrm   r>  r?  rA  rC  command_elmuser_elmrE  urG  rN   outs!                                    r5   r)  zcmd_add_sudoers.run  sY   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J735 6 6 ))Wn566	~bmDMM'4J4J&K&KLLH$,,..33ODDM %%f--DD 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;)	 mM=II#F ]=,GG
")
}]F;; mD-@@#)  j((" $D E E E  !    %	2 dO<< 	5M-444mM9=="=77mM=AAS!! 	. 	.Ak;??IIN'-IV$$\\^^ 3 3M+{CC	!"	+2	 ((iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   A5F KDK  K:8P4 4
Q$>!QQ$)NNNNNNr  r	  r
  r,  r-  r:   r.  r/  r0  r1  r   r   r2  r\  r)  rS   r7   r5   r/  r/    s         & IH )-.  	tW#JQTC	) 	) 	)z,Q	S 	S 	SM @??JAE?CQ Q Q Q Q Qr7   r/  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_sudoerszList Samba Sudoers Group Policy from the sysvol

This command lists sudo rules from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage sudoers list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                 L   |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          D ]}|                    d          j        }|                    d          j        }|                    d          }g }|D ]*}|                    |                    d                     +t-          |          dk    r d
                    d |D                       }nd}|                    d          d u }|rdnd}|d|d|d |}| j                            d!|z             d S )"NTr  rY   r  r  r  r   r  r   r  r3  z!SudoersConfiguration\manifest.xmlr   r7  r  r   r6  r   rC  r0  r=  rE  rG  rF  c                 R    g | ]$}|j         d          dk    r|j        n	d|j        z  %S r  r=  z%s%%r   rR  rT   r\  s     r5   
<listcomp>z(cmd_list_sudoers.run.<locals>.<listcomp>N  F     "> "> ">-. -.HV,<,F,F!&&!&"> "> ">r7   ALLrD  
 NOPASSWD:r=    ALL=()r/   %s
)r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  r  r   r   r!  r   rO  findallrR  extendrG   r   r   )r   rh   r  r  r  r  r   r   r  rW  rX  r_   r   r   entryr0  r=  listelements
principalsrE  uname
nopasswordnp_entryps                           r5   r)  zcmd_list_sudoers.run"  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J : DF G G
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""\\/22 	( 	(Ejj++0G::f%%*D ==77LJ+ D D!!+"5"5k"B"BCCCC:"" "> ">2<"> "> "> ? ? J//47J'19||rH&+eeTTT888WWEAIOOFQJ''''	( 	(   'D+ +
E05E+
!E++E0r*  r^  rS   r7   r5   r`  r`  
  s          'H )-.  	tW#JQTC	) 	) 	)M
 J3( 3( 3( 3( 3( 3(r7   r`  c                   t    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZddZdS )cmd_remove_sudoersa  Removes a Samba Sudoers Group Policy from the sysvol

This command removes a sudo rule from the sysvol from applying to winbind clients.

Example:
samba-tool gpo manage sudoers remove {31B2F340-016D-11D2-945F-00C04FB984F9} 'fakeu ALL=(ALL) NOPASSWD: ALL'
    %prog <gpo> <entry> [options]r  r  r  r  r  r  r  rh   ro  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }	d	
                    |	                                d
|ddg          }
d	
                    |
dg          }	 t          j        t          j        |                    |                              }|                                                    d          }|                    d          }nQ# t$          $ rD}|j        d         dv rt)          d          |j        d         dk    rt)          d           d }~ww xY wi }|                    d          D ]}|                    d          j        }|                    d          j        }|                    d          }g }|D ]*}|                    |                    d                     +t1          |          dk    r d
                    d |D                       }nd}|                    d          d u }|rdnd}|d |d!|d"|}|||<   ||                                vrt)          d#|z            |                    ||                    t7                      }|                    |d$d%           |                    d           	 t=          ||
           |                    ||                                            d S # t$          $ r&}|j        d         dk    rt)          d           d }~ww xY w)&NTr  rY   r  r  r  r   r  r   r  r3  r4  r5  r6  r   r   r7  z"The specified entry does not existr  r   rC  r0  r=  rE  rG  rF  c                 R    g | ]$}|j         d          dk    r|j        n	d|j        z  %S rc  rd  re  s     r5   rf  z*cmd_remove_sudoers.run.<locals>.<listcomp>  rg  r7   rh  rD  ri  r=   rj  rk  r/   ,Cannot remove '%s' because it does not existrI  rJ  )!r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  r   rm  rR  rn  rG   keysr   r*   r   rS  r   r   r   )r   rh   ro  r  r  r  r  r   r   r  rV  rW  rX  r6  r   r_   entriesr0  r=  rp  rq  rE  rr  rs  rt  ru  r]  s                              r5   r)  zcmd_remove_sudoers.runo  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J735 6 6 ))Wn566	~bmDMM'4J4J&K&KLLH$,,..33ODDM %%f--DD 	 	 	 vay@@@"#GHHHj((" $D E E E	 o.. 	 	AffY'',G66&>>&D99]33LJ+ D D!!+"5"5k"B"BCCCC:"" "> ">2<"> "> "> ? ? 
++t3J'19||rH&+eeTTT888WWEAGAJJ&&M % & ' ' ' 	GEN###iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s1   A5F 
G?GG8N 
O !N;;O r*  r^  rS   r7   r5   rx  rx  W  s          /H )-.  	tW#JQTC	) 	) 	)M
 !JG G G G G Gr7   rx  c                   d    e Zd ZdZi Z e            ed<    e            ed<    e            ed<   dS )cmd_sudoersz#Manage Sudoers Group Policy Objectsr  r   r   N)r  r	  r
  r,  subcommandsr/  r`  rx  rS   r7   r5   r  r    sS        --K(**K**,,K..00Kr7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_set_securitya  Set Samba Security Group Policy to the sysvol

This command sets a security setting to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.
These settings only apply to the ADDC.

Example:
samba-tool gpo manage security set {31B2F340-016D-11D2-945F-00C04FB984F9} MaxTicketAge 10

Possible policies:
MaxTicketAge            Maximum lifetime for user ticket
                        Defined in hours

MaxServiceAge           Maximum lifetime for service ticket
                        Defined in minutes

MaxRenewAge             Maximum lifetime for user ticket renewal
                        Defined in minutes

MinimumPasswordAge      Minimum password age
                        Defined in days

MaximumPasswordAge      Maximum password age
                        Defined in days

MinimumPasswordLength   Minimum password length
                        Defined in characters

PasswordComplexity      Password must meet complexity requirements
                        1 is Enabled, 0 is Disabled
    r_  r  r  r  r  r  r  r  )rh   r   value?Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }	| j        	                    d          }
d	
                    |
                                d
|dg          }d	
                    |dg          }	 t          d           }t          |_        |	                    |          }	 |                    t#          |                                                     nE# t&          $ r8 |                    t#          |                    d                               Y nw xY wnG# t(          $ r:}|j        d         dk    rt-          d          |j        d         dvr Y d }~nd }~ww xY wdddddddd}||         }|                    |          s|                    |           ||                    |||           nQ|                    ||           t7          |                    |                    dk    r|                    |           t#                      }|                    |           	 t?          |	|           |	                     |tC          |"                                                     d S # t(          $ r&}|j        d         dk    rt-          d           d }~ww xY w)NTr  rY   r  r  r  r   r  r   r  z$MACHINE\Microsoft\Windows NT\SecEditzGptTmpl.infinterpolationutf-16r   r  r   )r8  r:  Kerberos PolicySystem Access)MaxTicketAgeMaxServiceAgeMaxRenewAgeMinimumPasswordAgeMaximumPasswordAgeMinimumPasswordLengthPasswordComplexity)#r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r(   r   optionxformr   readfpr)   decodeUnicodeDecodeErrorr   r!  r   has_sectionadd_sectionsetremove_optionrG   r:   remove_sectionr   r   r   r&   getvalue)r   rh   r   r2   r  r  r  r  r   r   r  inf_dirinf_fileinf_datarawr_   section_mapsectionr]  s                      r5   r)  zcmd_set_security.run  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J57 8 899g}566	#$777H!$H --))C@ 6 67777% @ @ @H)=)= > >?????@ 	 	 	vayJ&&" $D E E E vay 888 98888	 *;*;(9/>/>2A/>  f%##G,, 	*  )))LL&%0000""7F3338##G,,--22''000jjs	!$000MM(Icllnn$=$=>>>>> 	 	 	vayJ&&" $D E E E 	sU   1G 4F  ?G  ?G?G GG 
H
0HH
AL 
M)!M

Mr  r^  rS   r7   r5   r  r    s         @ 'H )-.  	tW#JQTC	) 	) 	)M
 -,,J=A'+D D D D D Dr7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_securitya  List Samba Security Group Policy from the sysvol

This command lists security settings from the sysvol that will be applied to winbind clients.
These settings only apply to the ADDC.

Example:
samba-tool gpo manage security list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|dg          }		 t          d           }
t          |
_        |                    |	          }	 |
                    t#          |                                                     nE# t&          $ r8 |
                    t#          |                    d                               Y nw xY wnJ# t(          $ r=}|j        d         dk    rY d }~d S |j        d         dk    rt-          d           d }~ww xY w|
                                D ]B}|dvr|
                    |          D ]%\  }}| j                            |d|d           &Cd S )NTr  rY   r  r  r  r   r  r   r  z0MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.infr  r  r   r8  r  r   )r  r   = r&  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r(   r   r  r   r  r)   r  r  r   r!  r   sectionsr  r   r   )r   rh   r  r  r  r  r   r   r  r  r  r  r_   r  r   r2   s                   r5   r)  zcmd_list_security.runN  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$99ekkmmZBD E E	#$777H!$H --))C@ 6 67777% @ @ @H)=)= > >?????@ 	 	 	vayJ&&vayJ&&" $D E E E	  ((** 	< 	<GBBB&nnW55 < <
U	sssEEE :;;;;<	< 	<sB   1F/ 44E) (F/ )?F+(F/ *F++F/ /
G69G1!G11G6r*  r^  rS   r7   r5   r  r  5  s          'H )-.  	tW#JQTC	) 	) 	)M
 J)< )< )< )< )< )<r7   r  c                   J    e Zd ZdZi Z e            ed<    e            ed<   dS )cmd_securityz$Manage Security Group Policy Objectsr  r   N)r  r	  r
  r,  r  r  r  rS   r7   r5   r  r  y  sA        ..K))++K++--Kr7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_smb_confzList Samba smb.conf Group Policy from the sysvol

This command lists smb.conf settings from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage smb_conf list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                 >   |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|dg          }		 t          t          j        |                    |	                    }
nJ# t           $ r=}|j        d         dk    rY d }~d S |j        d         dk    rt%          d           d }~ww xY wd}t'          j                    }|
j        D ]}t-          |j                  |k    rl|                    |j        t5          |j                             |	                    |j                  }| j                            |j        d|d           d S )NTr  rY   r  r  r  r   r  r   r  zMACHINE\Registry.polr   r8  r  r       Software\Policies\Samba\smb_confr  r&  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r   r   r   r   r   r!  r   r   LoadParmr~  r&   keynamer  	valuenamer   r   r   r   )r   rh   r  r  r  r  r   r   r  pol_filepol_datar_   r  r[   ro  vals                   r5   r)  zcmd_list_smb_conf.run  s$   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$99ekkmmZ 79 : :	!$)T]]8-D-DEEHH 	 	 	vayJ&&vayJ&&" $D E E E	 9^% 	F 	FE''722uEJ888ffU_--	u DEEE		F 	Fs   -D0 0
E7:E2!E22E7r*  r^  rS   r7   r5   r  r    s          'H )-.  	tW#JQTC	) 	) 	)M
 J%F %F %F %F %F %Fr7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_set_smb_confa%  Sets a Samba smb.conf Group Policy to the sysvol

This command sets an smb.conf setting to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage smb_conf set {31B2F340-016D-11D2-945F-00C04FB984F9} 'apply gpo policies' yes
    ry  r  r  r  r  r  r  r  rh   settingr  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }	| j        	                    d          }
d	
                    |
                                d
|dg          }d	
                    |dg          }	 t          t          j        |	                    |                    }n[# t           $ rN}|j        d         dv rt          j                    }n!|j        d         dk    rt%          d           Y d }~nd }~ww xY w|Ud |j        D             vrt%          dz            fd|j        D             }||_        t)          |          |_        n!t-          |                                          dv rd}d}nyt-          |                                          dv rd}d}nQt-          |                                          rd}t1          t-          |                    }nd}t3          |          }t          j                    }d|_        t3                    |_        ||_        ||_        t?          |j                  }|                     |           ||_        t)          |          |_        	 tC          |	|           |	"                    |tG          |                     d S # t           $ r&}|j        d         dk    rt%          d           d }~ww xY w)NTr  rY   r  r  r  r   r  r   r  MACHINEzRegistry.polr   )r8  r9  r  r   c                     g | ]	}|j         
S rS   r  )rT   r_   s     r5   rf  z(cmd_set_smb_conf.run.<locals>.<listcomp>  s    EEEqq{EEEr7   r|  c                 *    g | ]}|j         k    |S rS   r  )rT   r_   r  s     r5   rf  z(cmd_set_smb_conf.run.<locals>.<listcomp>  s/     + + +Q;')) )))r7   )yesrB  r=     rB   )nofalser$  r  )$r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r   r   r   r   r   r!  r   r~  rG   num_entriesr'   	isnumericrK   r&   ro  r  r  r  r   r   rJ   r   r   r   )r   rh   r  r2   r  r  r  r  r   r   r  pol_dirr  r  r_   r~  etyper  s     `               r5   r)  zcmd_set_smb_conf.run  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]JYGHH99g~677
	!$)T]]8-D-DEEHH 	 	 	vay4449;;j((" $D E E E  	 =EEH4DEEEEE" $029$: ; ; ;+ + + +("2 + + +G&H#&w<<H  %  &&((,@@@E""((**.BBBE"",,.. '*U++,,&&
A>AI#G,,AKAFAF8+,,GNN1&H#&w<<H 	!$000MM(HX$6$677777 	 	 	vayJ&&" $D E E E		s1   -E 
F AFF 3M 
N!M<<Nr  r^  rS   r7   r5   r  r    s          /H )-.  	tW#JQTC	) 	) 	)M
 .--JMQH H H H H Hr7   r  c                   J    e Zd ZdZi Z e            ed<    e            ed<   dS )cmd_smb_confz$Manage smb.conf Group Policy Objectsr   r  N)r  r	  r
  r,  r  r  r  rS   r7   r5   r  r  !	  sA        ..K++--K))++Kr7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_symlinkzList VGP Symbolic Link Group Policy from the sysvol

This command lists symlink settings from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage symlink list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          D ]W}|                    d          }|                    d          }| j                            d|j        d|j        d           Xd S )NTr  rY   r  r  r  r   r  r   r  MACHINE\VGP\VTLA\UnixzSymlink\manifest.xmlr   r7  r  r   r6  r   file_propertiessourcetargetzln -s r/   r&  r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  r  r   r   r!  r   rO  rm  r   r   rR  )r   rh   r  r  r  r  r   r   r  rW  rX  r_   r   r   r  r  r  s                    r5   r)  zcmd_list_symlink.run?	  s(   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J : 79 : :
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""#||,=>> 	J 	JO$))(33F$))(33FIOOOv{{{FKKKHIIII	J 	Jrv  r*  r^  rS   r7   r5   r  r  '	  s          'H )-.  	tW#JQTC	) 	) 	)M
 J'J 'J 'J 'J 'J 'Jr7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_add_symlinkzAdds a VGP Symbolic Link Group Policy to the sysvol

This command adds a symlink setting to the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage symlink add {31B2F340-016D-11D2-945F-00C04FB984F9} /tmp/source /tmp/target
    '%prog <gpo> <source> <target> [options]r  r  r  r  r  r  r  rh   r  r  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }	| j        	                    d          }
d	
                    |
                                d
|dg          }d	
                    |dg          }	 t          j        t          j        |	                    |                              }|                                                    d          } |j        d          }n# t$          $ r}|j        d         dv rt          j        t          j        d                    }t          j        |                                d          }t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }n!|j        d         dk    rt/          d           Y d }~nd }~ww xY wt          j        |d          }t          j        |d          }||_        t          j        |d          }||_        t1                      }|                    |dd           |                    d           	 t7          |	|           |	                    ||                                           d S # t$          $ r&}|j        d         dk    rt/          d           d }~ww xY w)NTr  rY   r  r  r  r   r  r   r  MACHINE\VGP\VTLA\Unix\Symlinkr5  r6  r   r   r7  r;  r<  r=  rm   zSymlink Policyr>  zSpecifies symbolic link datar  r   r  r  r  rI  rJ  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  rP  rQ  rR  r   r*   r   rS  r   r   r   )r   rh   r  r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   r6  rY  rm   r>  r  
source_elm
target_elmr]  s                            r5   r)  zcmd_add_symlink.run	  sl   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J@B C C))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;,	 mM=II#A }]F;;j((" $D E E E  	* -.?@@]?H==
 
]?H==
 
iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   A0F
 

JC'J  J8M 
M;!M66M;r*  r^  rS   r7   r5   r  r  h	  s          9H )-.  	tW#JQTC	) 	) 	)M
 -,,JHL@ @ @ @ @ @r7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_remove_symlinka  Removes a VGP Symbolic Link Group Policy from the sysvol

This command removes a symlink setting from the sysvol from appling to winbind clients.

Example:
samba-tool gpo manage symlink remove {31B2F340-016D-11D2-945F-00C04FB984F9} /tmp/source /tmp/target
    r  r  r  r  r  r  r  r  r  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }	| j        	                    d          }
d	
                    |
                                d
|dg          }d	
                    |dg          }	 t          j        t          j        |	                    |                              }|                                                    d          } |j        d          }nU# t$          $ rH}|j        d         dv rt)          d|z  |          |j        d         dk    rt)          d           d }~ww xY w|                    d          D ]Y}|                    d          }|                    d          }|j        |k    r"|j        |k    r|                    |            nZt)          d|z  |          t1                      }|                    |dd           |                    d           	 t7          |	|           |	                    ||                                           d S # t$          $ r&}|j        d         dk    rt)          d           d }~ww xY w)NTr  rY   r  r  r  r   r  r   r  r  r5  r6  r   r   r7  z>Cannot remove link from '%s' to '%s' because it does not existr  r   r  r  r  rI  rJ  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  r   rm  rR  r   r*   r   rS  r   r   r   )r   rh   r  r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   r  r  r  r]  s                        r5   r)  zcmd_remove_symlink.run	  sH   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J@B C C))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 
	 
	 
	 vay@@@" $028$9:@B B Bj((" $D E E E 
	  $||,=>> 	M 	MO(--h77J(--h77J&((Z_-F-FO,,,  ;=C DEKM M M iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   A0F
 

GAGG8K 
L!!LLr*  r^  rS   r7   r5   r  r  	  s          9H )-.  	tW#JQTC	) 	) 	)M
 -,,JHL< < < < < <r7   r  c                   d    e Zd ZdZi Z e            ed<    e            ed<    e            ed<   dS )cmd_symlinkz#Manage symlink Group Policy Objectsr   r  r   N)r  r	  r
  r,  r  r  r  r  rS   r7   r5   r  r  
  sS        --K**,,K(**K..00Kr7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_fileszList VGP Files Group Policy from the sysvol

This command lists files which will be copied from the sysvol and applied to winbind clients.

Example:
samba-tool gpo manage files list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc           
         |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          D ]}|                    d          j        }|                    d          j        }|                    d          j        }|                    d          j        }t+          |          }t-          |          d|d|d|d|	}| j                            d|z             d S )NTr  rY   r  r  r  r   r  r   r  r  zFiles\manifest.xmlr   r7  r  r   r6  r   r  r  r  r=  rH  	z -> rl  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  r  r   r   r!  r   rO  rm  rR  r+   r,   r   r   )r   rh   r  r  r  r  r   r   r  rW  rX  r_   r   r   ro  r  r  r=  rH  moderu  s                        r5   r)  zcmd_list_files.run7
  s{   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J : 57 8 8
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""\\"344 	( 	(EZZ)).FZZ)).F::f%%*DJJw'',EU##D#D))))444HAIOOFQJ''''	( 	(rv  r*  r^  rS   r7   r5   r  r  
  s          'H )-.  	tW#JQTC	) 	) 	)M
 J,( ,( ,( ,( ,( ,(r7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_add_filesa  Add VGP Files Group Policy to the sysvol

This command adds files which will be copied from the sysvol and applied to winbind clients.

Example:
samba-tool gpo manage files add {31B2F340-016D-11D2-945F-00C04FB984F9} ./source.txt /usr/share/doc/target.txt root root 600
    z=%prog <gpo> <source> <target> <user> <group> <mode> [options]r  r  r  r  r  r  r  )rh   r  r  r=  rH  r  Nc                 H
   |                                 | _        |	                    | j        d          | _        t          j                            |          st          d|z            |r'|                    d          r|dd          }|| _	        n;t          | j        | j                  }t          | j        | j        |          | _	        t          |d| j        | j                  }| j                            d	          }d
                    |                                d|dg          }d
                    |dg          }	 t!          j        t!          j        |                    |                              }|                                                    d          } |j        d          }n# t,          $ r}|j        d         dv rt!          j        t!          j        d                    }t!          j        |                                d          }t!          j        |d          }d|_        t!          j        |d          }d|_        t!          j        |d          }d|_        t!          j        |d          }n!|j        d         dk    rt          d           Y d }~nd }~ww xY wt!          j        |d          }t!          j        |d          }t          j                            |          |_        t!          j        |d          }||_        t!          j        |d          }||_        t!          j        |d          }||_        d D ]\  }}t!          j        |d!          }|                    d"|           t;          |d#          d$|z  z  rt!          j        |d%           t;          |d#          d&|z  z  rt!          j        |d'           t;          |d#          d(|z  z  rt!          j        |d)           t=                      } |                    | d*d+           |                      d           tC          |d,          "                                }!d
                    |t          j                            |          g          }"	 tG          ||           |$                    || "                                           |$                    |"|!           d S # t,          $ r&}|j        d         dk    rt          d           d }~ww xY w)-NTr  zSource '%s' does not existrY   r  r  r  r   r  r   r  MACHINE\VGP\VTLA\Unix\Filesr5  r6  r   r   r7  r;  r<  r=  rm   Filesr>  z+Represents file data to set/copy on clientsr  r   r  r  r  r=  rH  ))r=     )rH  r   )otherr   permissionsr  rA   r  r   r@   r   rB   executerI  rJ  r   )%r'  r[   r(  r\   r   r   r  r   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  rP  rQ  rR  r  r  rK   r*   r   rS  r   r   r   r   )#r   rh   r  r  r=  rH  r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   r6  rY  rm   r>  r  r  r  r[  	group_elmptypeshiftr  r]  source_datasysvol_sources#                                      r5   r)  zcmd_add_files.run}
  s   ((**--dg-MM
w~~f%% 	F;fDEEE  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J>@ A A))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;#	 mM=II#P }]F;;j((" $D E E E  	* -.?@@]?H==
'**622
]?H==
 
=&99M/7;;		E 	6 	6LE5-GGKOOFE***4||se|, 3k62224||se|, 4k73334||se|, 6k9555iisWdCCC64((--//		7BG,<,<V,D,D"EFF	!$000MM'388::...MM-55555 	 	 	vayJ&&" $D E E E		s3   
A0F; ;
J6C'J11J6!AS1 1
T!;!TT!r*  r^  rS   r7   r5   r  r  e
  s          OH )-.  	tW#JQTC	) 	) 	)M
 FEEJ<@7;S S S S S Sr7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_remove_filesa  Remove VGP Files Group Policy from the sysvol

This command removes files which would be copied from the sysvol and applied to winbind clients.

Example:
samba-tool gpo manage files remove {31B2F340-016D-11D2-945F-00C04FB984F9} /usr/share/doc/target.txt
    z%prog <gpo> <target> [options]r  r  r  r  r  r  r  rh   r  Nc                 \   |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }	d	
                    |	                                d
|dg          }
d	
                    |
dg          }	 t          j        t          j        |                    |                              }|                                                    d          } |j        d          }nT# t$          $ rG}|j        d         dv rt)          d|z            |j        d         dk    rt)          d           d }~ww xY w|                    d          D ]}|                    d          }|                    d          }|j        |k    rHd	
                    |
|j        g          }|                    |           |                    |            nt)          d|z            t3                      }|                    |dd           |                    d           	 t9          ||
           |                    ||                                           d S # t$          $ r&}|j        d         dk    rt)          d           d }~ww xY w)NTr  rY   r  r  r  r   r  r   r  r  r5  r6  r   r   r7  z1Cannot remove file '%s' because it does not existr  r   r  r  r  rI  rJ  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  r   rm  rR  unlinkr   r*   r   rS  r   r   r   )r   rh   r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   r  r  r  r  r]  s                        r5   r)  zcmd_remove_files.run
  sc   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J>@ A A))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 
	 
	 
	 vay@@@" $028$9 : : :j((" $D E E E 
	  $||,=>> 
	E 
	EO(--h77J(--h77J&((GZ_#=>>F###O,,,	 )   ;=C D E E E iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   A0F
 

GAGG8K; ;
L+!L&&L+r*  r^  rS   r7   r5   r  r  
  s          0H )-.  	tW#JQTC	) 	) 	)M
 "J@D> > > > > >r7   r  c                   d    e Zd ZdZi Z e            ed<    e            ed<    e            ed<   dS )	cmd_filesz!Manage Files Group Policy Objectsr   r  r   N)r  r	  r
  r,  r  r  r  r  rS   r7   r5   r  r  *  sP        ++K(.**K&K,,..Kr7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_opensshzList VGP OpenSSH Group Policy from the sysvol

This command lists openssh options from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage openssh list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc           	         |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          }|                    d          D ]}|                    d          j        r|                    d          D ]R}| j                            |                    d          j        d|                    d          j        d           Sd S )NTr  rY   r  r  r  r   r  r   r  zMACHINE\VGP\VTLA\SshCfgzSshD\manifest.xmlr   r7  r  r   r6  r   r   configsectionsectionnamekeyvaluepairr   r/   r2   r&  r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  r  r   r   r!  r   rO  rm  rR  r   r   )r   rh   r  r  r  r  r   r   r  rW  rX  r_   r   r   r   r  kvs                    r5   r)  zcmd_list_openssh.runI  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J < 46 7 7
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""YY|,,
'//@@ 	E 	EM!!-005 #++N;; E E	RWWU^^-@-@-@-/WWW-=-=-B-B-B!D E E E EE	E 	Erv  r*  r^  rS   r7   r5   r  r  1  s          'H )-.  	tW#JQTC	) 	) 	)M
 J*E *E *E *E *E *Er7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_set_openssha"  Sets a VGP OpenSSH Group Policy to the sysvol

This command sets an openssh setting to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage openssh set {31B2F340-016D-11D2-945F-00C04FB984F9} KerberosAuthentication Yes
    z'%prog <gpo> <setting> [value] [options]r  r  r  r  r  r  r  r  Nc                 T
   |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }	| j        	                    d          }
d	
                    |
                                d
|dg          }d	
                    |dg          }	 t          j        t          j        |	                    |                              }|                                                    d          } |j        d          }|                    d          }n[# t$          $ rM}|j        d         dv rt          j        t          j        d                    }t          j        |                                d          }t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }t          j        |d          }t          j        |d          }t          j        |d           n!|j        d         dk    rt/          d           Y d }~nd }~ww xY w||                    d          D ]}|                    d          j        ri }|                    d          D ]}|||                    d           <   ||                                v r|||         _        st          j        |d          }t          j        |d           }||_        t          j        |d!          }||_        n|                    d          D ]}|                    d          j        ri }|                    d          D ]}|||                    d           j        <    ||                                v r|                    ||                    t/          d"|z            t7                      }|                    |d#d$           |                    d           	 t=          |	|           |	                    ||                                            d S # t$          $ r&}|j        d         dk    rt/          d           d }~ww xY w)%NTr  rY   r  r  r  r   r  r   r  zMACHINE\VGP\VTLA\SshCfg\SshDr5  r6  r   r   r   r7  r;  r<  r=  rm   zConfiguration Filer>  z+Represents Unix configuration file settingsr?  r@  r  r  r  r   r  r   r2   r|  rI  rJ  )!r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  rP  rQ  rR  r   rm  r}  r   r*   r   rS  r   r   r   )r   rh   r  r2   r  r  r  r  r   r   r  rV  rW  rX  r   r   r   r_   r6  rY  rm   r>  r?  r  settingsr  r  r   dvaluer]  s                                 r5   r)  zcmd_set_openssh.run  s6   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J?A B B))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&D<00JJ 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;0	 mM=II#P ]=,GG
")
}]F;;]4>>
 "j/ J Jm];;;;j((" $D E E E  <;;;;'	4 !+!3!3O!D!D ( ( %%m449 '//?? 2 2B/1HRWWU^^,,hmmoo---2HW%**#%=#O#OL-e<<C&CH]<AAF"'FKK( ",!3!3O!D!D 
> 
> %%m449 '//?? 7 7B46HRWWU^^011hmmoo--!(('):;;;;& (35<(= > > > iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   BF   K8+EK33K8=8S7 7
T'!T""T'r  r^  rS   r7   r5   r  r  u  s          9H )-.  	tW#JQTC	) 	) 	)M
 .--J>B'+\ \ \ \ \ \r7   r  c                   J    e Zd ZdZi Z e            ed<    e            ed<   dS )cmd_opensshz#Manage OpenSSH Group Policy Objectsr   r  N)r  r	  r
  r,  r  r  r  rS   r7   r5   r  r    s@        --K**,,K(**Kr7   r  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_startupzList VGP Startup Script Group Policy from the sysvol

This command lists the startup script policies currently set on the sysvol.

Example:
samba-tool gpo manage scripts startup list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc           
         |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          D ]}|                    d          }d	
                    d	|                                d
|dd|j        g          }|                    d          }|                    d          }||j        }nd}| j                            d|d|d|j                   d S )NTr  rY   r  r  r  r   r  r   r  r  zScripts\Startup\manifest.xmlr   r7  r  r   r6  r   rE  scriptzMACHINE\VGP\VTLA\Unix\ScriptsStartup
parametersrun_asrootz@reboot r/   r  )r   rh   r  r  r  r  r   r   r  rW  rX  r_   r   r   rE  r  script_pathr  r	  s                      r5   r)  zcmd_list_startup.run
  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J : @B C C
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""<<66 	D 	DK %%h//F))T5;;==*c%H%.%= > >K %)),77J %%h//F!IOOO&&&+++2<//C D D D D	D 	Drv  r*  r^  rS   r7   r5   r  r    s          'H )-.  	tW#JQTC	) 	) 	)M
 J0D 0D 0D 0D 0D 0Dr7   r  c                       e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	           e
d
dddd          gZg dZ	 	 ddZdS )cmd_add_startupzAdds VGP Startup Script Group Policy to the sysvol

This command adds a startup script policy to the sysvol.

Example:
samba-tool gpo manage scripts startup add {31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh '-n'
    z.%prog <gpo> <script> [args] [run_as] [options]r  r  r  r  r  r  r  z
--run-oncerun_onceFro  z#Whether to run the script only oncerp  )rh   r  zargs?zrun_as?Nc
                 	   |                                 | _        |                    | j        d          | _        t          j                            |          st          d|z            |r'|                    d          r|dd          }
|| _	        n;t          | j        | j                  }
t          | j        | j        |
          | _	        t          |
d| j        | j                  }| j                            d	          }d
                    |                                d|dg          }d
                    |dg          }	 t!          j        t!          j        |                    |                              }|                                                    d          } |j        d          }n# t,          $ r}|j        d         dv rt!          j        t!          j        d                    }t!          j        |                                d          }t!          j        |d          }d|_        t!          j        |d          }d|_        t!          j        |d          }d|_        t!          j        |d          }n!|j        d         dk    rt          d           Y d }~nd }~ww xY wt7          |d                                          }t!          j        |d          }t!          j        |d          }t          j                            |          |_        t!          j        |d          }t=          j        |                                           !                                |_        |Bt!          j        |d          }|"                    d           "                    d!          |_        |t!          j        |d"          }||_        |t!          j        |d#           tG                      }|$                    |d$d%           |%                    d           d
                    |t          j                            |          g          }	 tM          ||           |'                    ||                                           |'                    ||           d S # t,          $ r&}|j        d         dk    rt          d           d }~ww xY w)&NTr  zScript '%s' does not existrY   r  r  r  r   r  r   r  %MACHINE\VGP\VTLA\Unix\Scripts\Startupr5  r6  r   r   r7  r;  r<  r=  rm   zUnix Scriptsr>  z6Represents Unix scripts to run on Group Policy clientsr  r   r   rE  r  hashr  "'r	  r  rI  rJ  )(r'  r[   r(  r\   r   r   r  r   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  rP  rQ  rR  r   r   r  hashlibmd5	hexdigestr  rE   r*   r   rS  r   r   )r   rh   r  r!  r	  r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   r6  rY  rm   r>  script_datarE  
script_elmr  r  
run_as_elmr]  sysvol_scripts                                  r5   r)  zcmd_add_startup.runV  s   ((**--dg-MM
w~~f%% 	F;fDEEE  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]JIK L L))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;*	 mM=IIL  }]F;;j((" $D E E E  	, 64((--//mD-88];99
'**622
}[&11K,,6688>>@@	{LAAJ"jjoo33C88JO{H==J$JOM+z222iisWdCCC		7BG,<,<V,D,D"EFF	!$000MM'388::...MM-55555 	 	 	vayJ&&" $D E E E		s3   
A0F; ;
J6C'J11J6$AR4 4
S$>!SS$r  r^  rS   r7   r5   r  r  <  s          @H )-.  	tW#JQTC	) 	) 	)|*eL9	; 	; 	;M 766J@D?CO O O O O Or7   r  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_remove_startupzRemoves VGP Startup Script Group Policy from the sysvol

This command removes a startup script policy from the sysvol.

Example:
samba-tool gpo manage scripts startup remove {31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh
    z%prog <gpo> <script> [options]r  r  r  r  r  r  r  rh   r  Nc                 2   |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }	d	
                    |	                                d
|dg          }
d	
                    |
dg          }	 t          j        t          j        |                    |                              }|                                                    d          } |j        d          }nT# t$          $ rG}|j        d         dv rt)          d|z            |j        d         dk    rt)          d           d }~ww xY w|                    d          D ]j}|                    d          }|j        t.          j                            |                    d	d                    k    r|                    |            nkt)          d|z            t9                      }|                    |dd           |                    d           	 t?          ||
           |                     ||!                                           d S # t$          $ r&}|j        d         dk    rt)          d           d }~ww xY w)NTr  rY   r  r  r  r   r  r   r  r  r5  r6  r   r   r7  z3Cannot remove script '%s' because it does not existr  r   rE  r  r   rI  rJ  )"r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  rM  r  r   rN  rO  r   r!  r   rm  rR  r   r   r  r   r   r*   r   rS  r   r   r   )r   rh   r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   rE  r  r]  s                      r5   r)  zcmd_remove_startup.run  s>   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]JIK L L))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 
	 
	 
	 vay@@@" $028$9 : : :j((" $D E E E 
	  <<66 	6 	6K$))(33J"'"2"26>>$3L3L"M"MMMK((( N   ,.4 5 6 6 6 iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   A0F
 

GAGG,8K& &
L0!LLr*  r^  rS   r7   r5   r  r    s          0H )-.  	tW#JQTC	) 	) 	)M
 "J@D: : : : : :r7   r  c                   d    e Zd ZdZi Z e            ed<    e            ed<    e            ed<   dS )cmd_startupz+Manage Startup Scripts Group Policy Objectsr   r  r   N)r  r	  r
  r,  r  r  r  r  rS   r7   r5   r  r    sS        55K**,,K(**K..00Kr7   r  c                   0    e Zd ZdZi Z e            ed<   dS )cmd_scriptsz#Manage Scripts Group Policy ObjectsstartupN)r  r	  r
  r,  r  r  rS   r7   r5   r!  r!    s+        --K([]]K	r7   r!  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_motdzList VGP MOTD Group Policy from the sysvol

This command lists the Message of the Day from the sysvol that will be applied
to winbind clients.

Example:
samba-tool gpo manage motd list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          }| j                            |j                   d S )NTr  rY   r  r  r  r   r  r   r  r  zMOTD\manifest.xmlr   r7  r  r   r6  r   rR  r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  r  r   r   r!  r   rO  r   r   rR  r   rh   r  r  r  r  r   r   r  rW  rX  r_   r   r   rR  s                  r5   r)  zcmd_list_motd.run   s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J : 46 7 7
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""yy  		"""""rv  r*  r^  rS   r7   r5   r$  r$              'H )-.  	tW#JQTC	) 	) 	)M
 J%# %# %# %# %# %#r7   r$  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_set_motda  Sets a VGP MOTD Group Policy to the sysvol

This command sets the Message of the Day to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage motd set {31B2F340-016D-11D2-945F-00C04FB984F9} "Message for today"
    %prog <gpo> [value] [options]r  r  r  r  r  r  r  rh   r  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }	d	
                    |	                                d
|dg          }
d	
                    |
dg          }||                    |           d S 	 t          j        |                    |                    }n7# t           $ r)}|j        d         dv rt          j        t          j        d                    }t          j        |                                d          }t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }t          j        |d          }d|_        n!|j        d         dk    rt/          d           Y d }~nd }~ww xY wt          j        |d          }||_        t1                      }|                    |dd            |                    d           	 t7          ||
           |                    ||                                           d S # t           $ r&}|j        d         dk    rt/          d           d }~ww xY w)!NTr  rY   r  r  r  r   r  r   r  zMACHINE\VGP\VTLA\Unix\MOTDr5  r   r7  r;  r6  r<  r=  rm   	Text Filer>  Represents a Generic Text Filer?  r   r   filenamemotdr  r   rR  rI  rJ  r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r  r  r  r   r   r!  rM  rP  rQ  rN  rR  r   r*   r   rS  r   r   r   r   rh   r2   r  r  r  r  r   r   r  rV  rW  rX  r_   r6  rY  rm   r>  r?  r   r/  rR  r]  s                          r5   r)  zcmd_set_motd.run`  sS   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J=? @ @))Wn566=KK   F	}T]]7%;%;<<HH 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;'	 mM=II#C ]=,GG
"+
}]F;;=z:: &j((" $D E E E  %	2 }T6**	iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		1   2'E J&DJ

J*8L$ $
M.!MMr  r^  rS   r7   r5   r*  r*  G            /H )-.  	tW#JQTC	) 	) 	)M
 "JDHD D D D D Dr7   r*  c                   J    e Zd ZdZi Z e            ed<    e            ed<   dS )cmd_motdz.Manage Message of the Day Group Policy Objectsr   r  N)r  r	  r
  r,  r  r$  r*  rS   r7   r5   r6  r6    s;        88K'-//K%Kr7   r6  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_issuezList VGP Issue Group Policy from the sysvol

This command lists the Prelogin Message from the sysvol that will be applied
to winbind clients.

Example:
samba-tool gpo manage issue list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nH# t          $ r;}|j        d         dv rY d }~d S |j        d         dk    rt#          d           d }~ww xY w|
                    d          } |j        d          }|                    d          }| j                            |j                   d S )NTr  rY   r  r  r  r   r  r   r  r  zIssue\manifest.xmlr   r7  r  r   r6  r   rR  r&  r'  s                  r5   r)  zcmd_list_issue.run  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J : 57 8 8
	}T]]7%;%;<<HH 	 	 	 vay@@@vayJ&&" $D E E E	 //v{6""yy  		"""""rv  r*  r^  rS   r7   r5   r8  r8    r(  r7   r8  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
dgZ	 	 ddZdS )cmd_set_issuea  Sets a VGP Issue Group Policy to the sysvol

This command sets the Prelogin Message to the sysvol for applying to winbind
clients. Not providing a value will unset the policy.

Example:
samba-tool gpo manage issue set {31B2F340-016D-11D2-945F-00C04FB984F9} "Welcome to Samba!"
    r+  r  r  r  r  r  r  r  rh   r  Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }	d	
                    |	                                d
|dg          }
d	
                    |
dg          }||                    |           d S 	 t          j        |                    |                    }n7# t           $ r)}|j        d         dv rt          j        t          j        d                    }t          j        |                                d          }t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }t          j        |d          }d|_        n!|j        d         dk    rt/          d           Y d }~nd }~ww xY wt          j        |d          }||_        t1                      }|                    |dd            |                    d           	 t7          ||
           |                    ||                                           d S # t           $ r&}|j        d         dk    rt/          d           d }~ww xY w)!NTr  rY   r  r  r  r   r  r   r  zMACHINE\VGP\VTLA\Unix\Issuer5  r   r7  r;  r6  r<  r=  rm   r-  r>  r.  r?  r   r   r/  issuer  r   rR  rI  rJ  r1  r2  s                          r5   r)  zcmd_set_issue.run  sT   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J>@ A A))Wn566=KK   F	}T]]7%;%;<<HH 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;'	 mM=II#C ]=,GG
"+
}]F;;=z:: 'j((" $D E E E  %	2 }T6**	iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		r3  r  r^  rS   r7   r5   r;  r;    r4  r7   r;  c                   J    e Zd ZdZi Z e            ed<    e            ed<   dS )	cmd_issuez!Manage Issue Group Policy Objectsr   r  N)r  r	  r
  r,  r  r8  r;  rS   r7   r5   r?  r?  K  s=        ++K(.**K&Kr7   r?  c                   r    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZd
gZddZdS )cmd_list_accesszList VGP Host Access Group Policy from the sysvol

This command lists host access rules from the sysvol that will be applied to winbind clients.

Example:
samba-tool gpo manage access list {31B2F340-016D-11D2-945F-00C04FB984F9}
    r_  r  r  r  r  r  r  r  rh   Nc                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }|| _        n;t          | j        | j                  }t          | j        | j        |          | _        t          |d| j        | j                  }| j        	                    d          }d	
                    |                                d
|ddg          }		 t          j        |                    |	                    }
nJ# t          $ r=}|j        d         dv rd }
n!|j        d         dk    rt#          d           Y d }~nd }~ww xY w|
|
                    d          } |j        d          }|                    d          D ]l}|                    d          }|                    d          }|                    d          }| j                            d|j        d	|j        d           md	
                    |                                d
|ddg          }		 t          j        |                    |	                    }nJ# t          $ r=}|j        d         dv rd }n!|j        d         dk    rt#          d           Y d }~nd }~ww xY w||                    d          } |j        d          }|                    d          D ]n}|                    d          }|                    d          }|                    d          }| j                            d|j        d	|j        d           md S d S )NTr  rY   r  r  r  r   r  r   r  MACHINE\VGP\VTLA\VASz$HostAccessControl\Allow\manifest.xmlr   r7  r  r   r6  r   rE  adobjectrm   r  z+:z:ALL
z#HostAccessControl\Deny\manifest.xmlz-:r  )r   rh   r  r  r  r  r   r   r  rW  allowr_   r   r   rE  rD  rm   r  denys                      r5   r)  zcmd_list_access.runi  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$))U[[]]J6EG H H	M$--"8"899EE 		 		 		 vay@@@j((" $D E E E  			 ZZ00F6;v&&D#||M:: M M&++J77}}V,,!x00	FKKK KLLLL))U[[]]J6DF G G	=w!7!788DD 		 		 		 vay@@@j((" $D E E E  			 YY//F6;v&&D#||M:: M M&++J77}}V,,!x00	FKKK KLLLL M Ms0   'D+ +
E253E--E2'I3 3
J:=3J55J:r*  r^  rS   r7   r5   rA  rA  Q  s          'H )-.  	tW#JQTC	) 	) 	)M
 JCM CM CM CM CM CMr7   rA  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_add_accesszAdds a VGP Host Access Group Policy to the sysvol

This command adds a host access setting to the sysvol for applying to winbind
clients.

Example:
samba-tool gpo manage access add {31B2F340-016D-11D2-945F-00C04FB984F9} allow goodguy example.com
    z0%prog <gpo> <allow/deny> <cn> <domain> [options]r  r  r  r  r  r  r  )rh   r  cnr  Nc	                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }	|| _        n;t          | j        | j                  }	t          | j        | j        |	          | _        t          |	d| j        | j                  }
| j        	                    d          }|d	k    r-d

                    |                                d|ddg          }nE|dk    r-d

                    |                                d|ddg          }nt          d|z            d

                    |dg          }	 t          j        t          j        |
                    |                              }|                                                    d          } |j        d          }n# t&          $ r}|j        d         dv rt          j        t          j        d                    }t          j        |                                d          }t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }d|_        t          j        |d          }n!|j        d         dk    rt          d            Y d }~nd }~ww xY wt          | j        | j        |          }t1          |t3                      | j        | j        !          }|                    |                                t8          j        d"|z  g d#$          }t=          |          dk    rt          d%|z            t?          |d         d&         d'                   }|d(vrt          d)|z            t          j        |d*          }t          j        |d+          }|                                 |_        t          j        |d,          }|d-k    r't?          |d         d.         d'                   |_        nGt          j        |d/          }d0|_        |d
t?          |d         d1         d'                   |_        t          j        |d2          }t          j        |d          }t?          |d         d1         d'                   |_        t          j        |d3          }||_        t          j        |d+          }||_        tC                      } |"                    | d4d5           | #                    d           	 tI          |
|           |
%                    || &                                           d S # t&          $ r&}|j        d         dk    rt          d            d }~ww xY w)6NTr  rY   r  r  r  r   r  rE  r   r  rC  HostAccessControl\AllowrF  HostAccessControl\DenyBThe entry type must be either 'allow' or 'deny'. Unknown type '%s'r5  r6  r   r   r7  r;  r<  r=  rm   zHost Access Controlr>  z0Represents host access control data (pam_access)r?  r@  r  r   r  z(cn=%s))userPrincipalNamesamaccountnamer7  r   z!Unable to find user or group "%s"r7  )r=  rH  z%s is not a user or grouprE  r  ro  r=  rN  	groupattrsamAccountNamerO  rD  r  rI  rJ  )'r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r   r  rM  r  r   rN  rO  r   r!  rP  rQ  rR  r   r   r{   	domain_dnre   SCOPE_SUBTREErG   r'   r  r*   r   rS  r   r   r   )!r   rh   r  rI  r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   r6  rY  rm   r>  r?  r]   rg   resobjectclassrE  ro  rQ  rD  
domain_elmr]  s!                                    r5   r)  zcmd_add_access.run  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$Gii
C!:!;!= > >GG f__ii
C!:!:!< = =GG   ;=B C D D D))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 	 	 	 vay@@@>"*[*A*ABB "h.>.>.@.@.=!? !?]=)<<}]F;;1	 mM=II#U ]=,GG
")
}]F;;j((" $D E E E  !	. TWdjV444#N,<,<"&*: : : ll 1 1!$!2&/"n"1 "1 "1  2 2 s88q==BRGHHH Q!6r!:;;///:R?@@@mD-88k622 &&((
k733&  #CF+>$?$CDDEJJdK88I-IN%+VV%/A7G0H0L%M%M%MOEJ=j99}Xv..s1v&67;<<	]8X66
 
h// 
iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   &A0G K0#DK++K08V 
W"!WWr*  r^  rS   r7   r5   rH  rH    s          BH )-.  	tW#JQTC	) 	) 	)M
 211J<@'+i i i i i ir7   rH  c                   x    e Zd ZdZdZej        ej        ej        dZ	 e
dddedd	          gZg d
Z	 	 ddZdS )cmd_remove_accessa  Remove a VGP Host Access Group Policy from the sysvol

This command removes a host access setting from the sysvol for applying to
winbind clients.

Example:
samba-tool gpo manage access remove {31B2F340-016D-11D2-945F-00C04FB984F9} allow goodguy example.com
    z2%prog <gpo> <allow/deny> <name> <domain> [options]r  r  r  r  r  r  r  )rh   r  rm   r  Nc	                    |                                 | _        |                    | j        d          | _        |r'|                    d          r|dd          }	|| _        n;t          | j        | j                  }	t          | j        | j        |	          | _        t          |	d| j        | j                  }
| j        	                    d          }|d	k    r-d

                    |                                d|ddg          }nE|dk    r-d

                    |                                d|ddg          }nt          d|z            d

                    |dg          }	 t          j        t          j        |
                    |                              }|                                                    d          } |j        d          }nT# t&          $ rG}|j        d         dv rt          d|z            |j        d         dk    rt          d           d }~ww xY w|                    d          D ]r}|                    d          }|                    d          }|                    d          }|/|j        |k    r$|"|j        |k    r|                    |            nst          d|z            t1                      }|                    |dd           |                    d           	 t7          |
|           |
                    ||                                           d S # t&          $ r&}|j        d         dk    rt          d           d }~ww xY w)NTr  rY   r  r  r  r   r  rE  r   r  rC  rK  rF  rL  rM  r5  r6  r   r   r7  z0Cannot remove %s entry because it does not existr  r   rE  rD  rm   r  rI  rJ  )r'  r[   r(  r\   rH   r]   r   r`   r   r  r1   r   r   r  rM  r  r   rN  rO  r   r!  rm  rR  r   r*   r   rS  r   r   r   )r   rh   r  rm   r  r  r  r  r  r   r   r  rV  rW  rX  r   r   r_   rE  rD  name_elmrW  r]  s                          r5   r)  zcmd_remove_access.runK  s   ((**--dg-MM
  	Ci(( 	CABB%KDHH'<<KdgtzkBBBDH k&!%$(J0 0 0
 G$$Gii
C!:!;!= > >GG f__ii
C!:!:!< = =GG   ;=B C D D D))Wn566	~bmDMM'4J4J&K&KLLH%%'',,_==F6;v&&DD 
	 
	 
	 vay@@@" $/16$7 8 8 8j((" $D E E E 
	  <<66 
	8 
	8K"''
33H}}V,,H!x00J#(=(=%*/V*C*CK(((  /16 7 8 8 8 iisWdCCC	!$000MM'388::..... 	 	 	vayJ&&" $D E E E		s2   &A0G 
H(!AH##H(8L; ;
M+!M&&M+r*  r^  rS   r7   r5   rY  rY  2  s          DH )-.  	tW#JQTC	) 	) 	)M
 433J>B'+F F F F F Fr7   rY  c                   d    e Zd ZdZi Z e            ed<    e            ed<    e            ed<   dS )
cmd_accessz'Manage Host Access Group Policy Objectsr   r  r   N)r  r	  r
  r,  r  rA  rH  rY  rS   r7   r5   r]  r]    sR        11K)/++K'))K--//Kr7   r]  c                      e Zd ZdZi Z e            ed<    e            ed<    e            ed<    e            ed<    e	            ed<    e
            ed<    e            ed<    e            ed	<    e            ed
<    e            ed<   dS )
cmd_managezManage Group Policy Objectssudoersr
   smb_confsymlinkr'  opensshscriptsr0  r=  accessN)r  r	  r
  r,  r  r  r  r  r  r  r  r!  r6  r?  r]  rS   r7   r5   r_  r_    s        %%K([]]K	*lnnK
*lnnK
([]]K	$9;;K([]]K	([]]K	"(**K$9;;K&JLLKr7   r_  c                      e Zd ZdZi Z e            ed<    e            ed<    e            ed<    e            ed<    e	            ed<    e
            ed<    e            ed<    e            ed	<    e            ed
<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<    e            ed<   dS )cmd_gpoz%Group Policy Object (GPO) management.listallr   showgetlinksetlinkdellinklistcontainersgetinheritancesetinheritancefetchcreatedelaclcheckr  restoreadmxloadmanageN)r  r	  r
  r,  r  r  r4  r^  rg  rl  r|  r  r  r  r  r  r  r  r  r  r  r_  rS   r7   r5   rg  rg    s7       //K([]]K	"(**K"(**K([]]K	([]]K	([]]K	$6$6$8$8K !$6$6$8$8K !$6$6$8$8K !$9;;K&JLLK K*lnnK
&JLLK([]]K	*lnnK
&JLLKr7   rg  )NN)FF)r   samba.getoptgetoptr:   re   r   xml.etree.ElementTreeetreerM  r  r  r   
samba.authr   samba.netcmdr   r   r   r   samba.samdbr   r>  r	   samba.dcerpcr
   	samba.ndrr   r   r   samba.securityr   r   r   samba.netcmd.commonr   r   samba.samba3r   r   r   r   r   r  samba.ntaclsr   r   	samba.netr   samba.gp_parser   r   r   samba.gp_parse.gp_polr   samba.gp_parse.gp_inir   r   r   r    samba.gp_parse.gp_csvr!   samba.gp_parse.gp_infr"   samba.gp_parse.gp_aasr#   samba.credentialsr$   r%   samba.commonr&   r'   configparserr(   ior)   r*   samba.gp.vgp_files_extr+   r,   r  r6   r;   rP   rW   r`   ri   rE  rF  rG  SECINFO_SACLr   r   r   r   
IGNORECASEr   r   FILE_ATTRIBUTE_SYSTEMr   FILE_ATTRIBUTE_ARCHIVEFILE_ATTRIBUTE_HIDDENr   r   r   r   r   r   r  r4  r^  rg  rl  r|  r  r  r  r  r  r  r  r  r  r  r/  r`  rx  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r!  r$  r*  r6  r8  r;  r?  rA  rH  rY  r]  r_  rg  rS   r7   r5   <module>r     s  * 
			       



 				 " " " " " " " " "   % % % % % %                        ! ! ! ! ! ! * * * * * * * *               } } } } } } } } } } - - - - - -       ) ) ) ) ) ) 8 8 8 8 8 8        $ $ $ $ $ $             O O O O O O O O O O - - - - - -            3 2 2 2 2 2 2 2 2 2 2 2 - - - - - -       2 2 2 2 2 2 , , , , , , . . . . . . . . % % % % % %                 < < < < < < < <       $        !dt#1#12#01 $01+ + + +\	 	 	#C #C #CL   M    :2 2 2< ),-*+ )*
/ / /2 8=7<", ", ", ",J    "+N +N +N +N +N +N +N +N\"" "" "" "" ""* "" "" ""Jr: r: r: r: r:z r: r: r:j- - - - -z - - -`,J ,J ,J ,J ,J* ,J ,J ,J^WM WM WM WM WM* WM WM WMt$M $M $M $M $M* $M $M $MN!B !B !B !B !B !B !B !BH); ); ); ); ); ); ); );X3X 3X 3X 3X 3X 3X 3X 3Xl87 87 87 87 87
 87 87 87vI I I I I I I IXPI PI PI PI PI PI PI PIf`< `< `< `< `<* `< `< `<FG3 G3 G3 G3 G3j G3 G3 G3T=O =O =O =O =O: =O =O =O~JQ JQ JQ JQ JQ7 JQ JQ JQXv v v v vg v v vpK( K( K( K( K(w K( K( K(Z_ _ _ _ _ _ _ _B1 1 1 1 1, 1 1 1t t t t tw t t tlB< B< B< B< B< B< B< B<H. . . . .< . . .=F =F =F =F =F =F =F =F~a a a a aw a a aF, , , , ,< , , ,?J ?J ?J ?J ?Jw ?J ?J ?JBX X X X Xg X X XtT T T T T T T Tl1 1 1 1 1, 1 1 1D( D( D( D( D(W D( D( D(Lk k k k kG k k kZV V V V Vw V V Vp/ / / / / / / /BE BE BE BE BEw BE BE BEHu u u u ug u u un+ + + + +, + + +HD HD HD HD HDw HD HD HDTi i i i ig i i iVR R R R R R R Rh1 1 1 1 1, 1 1 1+ + + + +, + + +
># ># ># ># >#G ># ># >#@] ] ] ] ]7 ] ] ]~( ( ( ( (| ( ( (># ># ># ># >#W ># ># >#@] ] ] ] ]G ] ] ]~) ) ) ) ) ) ) )[M [M [M [M [Mg [M [M [MzB B B B BW B B BH_ _ _ _ _ _ _ _B0 0 0 0 0 0 0 0) ) ) ) ) ) ) )) ) ) ) )l ) ) ) ) )r7   