EUc@s"ddlZddljZddlZddlmZddlmZm Z m Z m Z ddl m Z ddlmZddlmZddlmZddlZddlZddlmZmZmZdd lmZdd lmZdd lmZddlZdd lmZdd lmZddl m!Z!dZ"dZ#dZ$dZ%dZ&dZ'dddZ)dZ*dddej+ej,Bej-Bej.BdZ/dZ0dZ1dZ2dZ3dZ4dZ5defdYZ6d efd!YZ7d"efd#YZ8d$efd%YZ9d&efd'YZ:d(efd)YZ;d*efd+YZ<d,efd-YZ=d.efd/YZ>d0efd1YZ?d2efd3YZ@d4efd5YZAd6efd7YZBd8e fd9YZCdS(:iN(tsystem_session(tCommandt CommandErrortOptiont SuperCommand(tSamDB(tdsdb(tsecurity(t ndr_unpack(t AUTH_SESSION_INFO_DEFAULT_GROUPStAUTH_SESSION_INFO_AUTHENTICATEDt#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES(t netcmd_finddc(tpolicy(tsmb(t dsacl2fsacl(tnbt(tNetc Csdy4td|jdtd|jd|j|_Wn)tk r_}td|j|nXdS(s$make a ldap connection to the serverturlt session_infot credentialstlpsLDAP connection to %s failed N(RRRtcredsRtsamdbt ExceptionR(tctxte((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyt samdb_connect1s  cCs||kr||dS|S(s/get an attribute from a ldap msg with a defaulti((tmsgtattrnametdefault((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyt attr_default;s  cCs1tj|}|sd}ndj|}|S(sreturn gpo flags stringtNONEt (R t get_gpo_flagstjoin(tvaluetflagstret((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pytgpo_flags_stringBs  cCs1tj|}|sd}ndj|}|S(sreturn gplink options stringR R!(R tget_gplink_optionsR#(R$toptionsR&((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pytgplink_options_stringLs  cCsg}|jd}x|D]}|s.qn|jd}t|dksc|djd rvtd|n|ji|ddd6t|d d 6qW|S( s.parse a gPLink into an array of dn and optionst]t;iis[LDAP://sBadly formed gPLink '%s'itdniR)(tsplittlent startswitht RuntimeErrortappendtint(tgplinkR&tatgtd((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyt parse_gplinkVs &1cCs7d}x*|D]"}|d|d|df7}q W|S(s4Encode an array of dn and options into gPLink stringts[LDAP://%s;%d]R-R)((tgplistR&R6((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyt encode_gplinkds  cCsd|dkr`|dkrSyt||}WqStk rO}td|qSXnd|}n|S(sjIf URL is not specified, return URL for writable DC. If dc is provided, use that to construct ldap URLsCould not find a DC for domainsldap://N(tNoneR RR1(RRRtdcR((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pytdc_urlls   cCsF|j}|jtj|d|jtj|d||S(sConstruct the DN for gposCN=Policies,CN=SystemsCN=%s(tget_default_basednt add_childtldbtDn(RtgpoR-((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyt get_gpo_dnzs c Cs+|j}|jtj|d|}d}tj}|dk r\dtj|}n|dk r~dtj|}n|dk r|}tj}nyG|jd|d|d|dd d d d d dgdd|g} WnAt k r&} |dk rd|} nd} t | | nX| S(s0Get GPO information using gpo, displayname or dnsCN=Policies,CN=Systems"(objectClass=groupPolicyContainer)s.(&(objectClass=groupPolicyContainer)(name=%s))s5(&(objectClass=groupPolicyContainer)(displayname=%s))tbasetscopet expressiontattrstnTSecurityDescriptort versionNumberR%tnamet displayNametgPCFileSysPathtcontrolss sd_flags:1:%ds!Cannot get information for GPO %ssCannot get information for GPOsN( R?R@RARBtSCOPE_ONELEVELR<t binary_encodet SCOPE_BASEtsearchRR( RRCt displaynameR-tsd_flagst policies_dntbase_dnt search_exprt search_scopeRRtmesg((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyt get_gpo_infos8         cCsVd|}y|jd|ddg}Wn&tk rQ}td||nX|S(s lists dn of containers for a GPOs(&(objectClass=*)(gPLink=*%s*))RGRHtgPLinks'Could not find container(s) with GPO %s(RRRR(RRCRWRR((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pytget_gpo_containerss  c Csy2|jd|dtjddddgd}Wn&tk rZ}td||nXt}tt||}d|krt|dd}xP|D]9}|d j |j kr|j |t }PqqWn td |std |ntj } || _ |rHt|} tj| tjd| d RRRZRR<toutfRR-RR'R3(tselfRRRRRRl((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pytrun2s   ,N(t__name__t __module__t__doc__tsynopsisR)t SambaOptionstVersionOptionstCredentialsOptionsttakes_optiongroupsRR`t takes_optionsR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR"s   tcmd_listc BseZdZdZdgZiejd6ejd6ejd6Z e dddd d e d d d dgZ dddddZRS(sList GPOs for an account.s%prog [options]tusernameRRRs-Hs--URLRs%LDB URL for database or target serverRRRRRc Cs|j|_|j|jdt|_t|j|j||_t|yB|jj ddt j |t j |f}|dj }Wn!t k rtd|nXy?|jj d|dt jdd gd}d |d k}Wn!t k rtd |nXttB} |jdk rP|jjd rP| tO} ntjj|jd |jd|d| } | j} g} t} t j|jt|j}xwtr)|jj d|dt jdddgd}d|krt|dd}x|D]}| r3|dtj@ r3qn|dtj@rJqnyt j!t j"Bt j#B}|jj d|ddt jdddddgdd|g}|ddd}t$t j%|}Wn,t k r|j&j'd|dqnXy+tj j(|| t j)t j*Bt j+BWn+t,k rQ|j&j'd|j qnXt-t.|ddd}|r|tj/@rqn| r|tj0@rqn| j1|ddd|dddfqWnt-t.|dd}|tj2@rt3} n||jj4krPn|j}qW|r9d }nd}|j&j'd||fx0| D](}|j&j'd|d|dfq`WdS(NRRGs?(&(|(samAccountName=%s)(samAccountName=%s$))(objectClass=User))isFailed to find account %sRERFRHt objectClasstcomputers&Failed to find objectClass for user %stldaptlp_ctxR-tsession_info_flagsR[t gPOptionsR)RKRLR%RIRNs sd_flags:1:%ds8Failed to fetch gpo object with nTSecurityDescriptor %s sFailed access check on %s tusersGPOs for %s %s s %s %s i(5RRRRcRR>RRRRRRARPR-RRRQR R R<R0R tsambatautht user_sessiontsecurity_tokenRBR`tparentR8RtGPLINK_OPT_ENFORCEtGPLINK_OPT_DISABLERt SECINFO_OWNERt SECINFO_GROUPt SECINFO_DACLRt descriptorRRt access_checktSEC_STD_READ_CONTROLt SEC_ADS_LISTtSEC_ADS_READ_PROPR1R3RtGPO_FLAG_MACHINE_DISABLEtGPO_FLAG_USER_DISABLER2tGPO_BLOCK_INHERITANCER_R?(RRRRRRRtuser_dnt is_computerRtsessionttokentgpostinheritR-tglistR6RTtgmsgt secdesc_ndrtsecdescR%t gpoptionstmsg_str((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRXs " + ! !  ! .         2    N(RRRRt takes_argsR)RRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRGs    tcmd_showcBsqeZdZdZiejd6ejd6ejd6ZdgZ e dddd e gZ d d d d d ZRS( sShow information for a GPO.s%prog [options]RRRRCs-HRs%LDB URL for database or target serverRc Cs|j|_|j|jdt|_t|j|j||_t|yt|j |d}Wn!t k rt d|nXy0|dd}t t j|}|j} Wnt k rd} nX|jjd|dd|jjd|d d|jjd |d d|jjd |j|jjd t|dd|jjdttt|dd|jjd| |jjddS(NRisGPO '%s' does not existRIssGPO : %s RKsdisplay name : %s RLspath : %s RMsdn : %s sversion : %s RJRsflags : %s R%sACL : %s s (RRRRcRR>RRRZRRRRRRtas_sddlRRR-RR'R3( RRCRRRRRRRt secdesc_sddl((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs,     ,N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs    t cmd_getlinkcBsqeZdZdZiejd6ejd6ejd6ZdgZ e dddd e gZ d d d d d ZRS( sList GPO Links for a container.s%prog [options]RRRRis-HRs%LDB URL for database or target serverRc Cs|j|_|j|jdt|_t|j|j||_t|y5|jj d|dt j ddddgd}Wn!t k rt d |nX|dru|jjd |t|dd}x|D]}t|jd |d }|jjd |dd d|jjd|ddd|jjdt|d|jjdqWn|jjd|dS(NRRERFRGs(objectClass=*)RHR[isContainer '%s' does not existsGPO(s) linked to DN %s R-s GPO : %s RKs Name : %s RLs Options : %s R)s sNo GPO(s) linked to DN=%s (RRRRcRR>RRRRRRARQRRRRR8RZR*( RRiRRRRRR:R6((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs(      N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs     t cmd_setlinkc BseZdZdZiejd6ejd6ejd6ZddgZ e ddd d e e d d d de dddde dd dde ddddgZ de e ddddZRS(s(Add or update a GPO link to a container.s$%prog [options]RRRRiRCs-HRs%LDB URL for database or target serverRs --disableRtdisabledRtactiont store_truesDisable policys --enforcetenforcedsEnforce policyc  Cs|j|_|j|jdt|_t|j|j||_t|d} |rk| tj O} n|r| tj O} nyt |j d|d} Wn!t k rtd|nXtt|j |} y5|j jd|dtjddd d gd} Wn!t k r2td |nXt} d | krt| d d} t} t}x>| D]6}|d j| jkrl| |d RRRRRRZRRRR`RDRRRARQR_R8RatinsertR2R;RdRBR-ReRft FLAG_MOD_ADDRhRRRR(RRiRCRRRRRRtgplink_optionsRRktexisting_gplinkR:RjR6RmRlR((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR.s^      !  N(RRRRR)RRRRRRR`R_RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs      t cmd_dellinkcBsteZdZdZiejd6ejd6ejd6ZddgZ e ddd d e gZ d d d d d ZRS( s!Delete GPO link from a container.s$%prog [options]RRRt containerRCs-HRs%LDB URL for database or target serverRcCs|j|_|j|jdt|_t|j|j||_t|yt|j d|dWn!t k rt d|nXt j |j |}t|j |||jjdtj|||||dS(NRRCisGPO '%s' does not existsDeleted GPO link. (RRRRcRR>RRRZRRRRARBRnRRRR(RRRCRRRRRi((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs  N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRss     tcmd_listcontainerscBsqeZdZdZiejd6ejd6ejd6ZdgZ e dddd e gZ d d d d d ZRS( s%List all linked containers for a GPO.s%prog [options]RRRRCs-HRs%LDB URL for database or target serverRcCs|j|_|j|jdt|_t|j|j||_t|t|j |}t |r|j j d|x=|D]}|j j d|dqWn|j j d|dS(NRsContainer(s) using GPO %s s DN: %s R-sNo Containers using GPO %s ( RRRRcRR>RRR\RR/RR(RRCRRRRRRl((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs   N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs     tcmd_getinheritancecBsqeZdZdZiejd6ejd6ejd6ZdgZ e dddd e gZ d d d d d ZRS( s%Get inheritance flag for a container.s%prog [options]RRRRis-HRs%LDB URL for database or target serverRc Cs|j|_|j|jdt|_t|j|j||_t|y5|jj d|dt j ddddgd}Wn!t k rt d |nXd}d|krt|dd}n|tjkr|jjd n|jjd dS( NRRERFRGs(objectClass=*)RHRisContainer '%s' does not exists$Container has GPO_BLOCK_INHERITANCE sContainer has GPO_INHERIT (RRRRcRR>RRRRRRARQRRR3RRRR(RRiRRRRRt inheritance((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs    N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs     tcmd_setinheritancecBsteZdZdZiejd6ejd6ejd6ZddgZ e ddd d e gZ d d d d d ZRS( s$Set inheritance flag on a container.s.%prog [options]RRRRit inherit_states-HRs%LDB URL for database or target serverRc Cs|jdkrtj}n.|jdkr<tj}ntd||j|_|j|jdt|_ t |j|j ||_ t |y5|j jd|dtjddd d gd }Wn!tk rtd |nXtj} tj|j || _d |krItjt|tjd | d RRRRRRARQRRdRBR-ReR`RfRRh( RRiRRRRRRRRlR((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs0      %"N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRs     t cmd_fetchcBseZdZdZiejd6ejd6ejd6ZdgZ e dddd e e d dd d e gZ d d d d d d ZRS(sDownload a GPO.s%prog [options]RRRRCs-HRs%LDB URL for database or target serverRs--tmpdirs,Temporary directory for copying policy filescCsp|j|_|j|jdt|_|rU|jdrU|d}||_n3t|j|j}t|j|jd||_t |yt |j |d}Wn!t k rt d|nX|dd} yt| \} } } Wn!tk rt d| nXy(tj|| d |jd |j} Wn!t k rft d |nX|dkr|d }ntjj|st d |ntjj|d}tjj|stj|ntjj||}tjj|rt d|ny!tj|t| | |Wn"t k rW}t d|nX|jjd|dS(NRsldap://iR=isGPO '%s' does not existRMsInvalid GPO path (%s)RRs"Error connecting to '%s' using SMBs/tmps'Temoprary directory '%s' does not existR s8GPO directory '%s' already exists, refusing to overwritesError copying GPO from DCsGPO copied to %s (RRRRcRR0RR R>RRZRRRRsRpRtSMBR<RvRwRxR#RyRRR(RRCRttmpdirRRRt dc_hostnameRRqtdom_nametservicet sharepathRRtgpodirR((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR2sJ     (    N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR s    t cmd_createcBseZdZdZiejd6ejd6ejd6ZdgZ e dddd e e d dd d e gZ d d d d d d ZRS(sCreate an empty GPO.s%prog [options]RRRRSs-HRs%LDB URL for database or target serverRs--tmpdirs,Temporary directory for copying policy filesc"Cs7|j|_|j|jdt|_td|jd|j}|r|jdr|d}||_tj tj Btj B} |j d|d| } nbtj tj Btj B} |j d|jj d d| } | j}t|j|jd ||_t|t|jd |} | jd krBtd |nttj} d| j} | j}d||| f}|dkrd}ntjj|std|ntjj|d}tjj|stj|ntjj|| }tjj|r+td|nyttj|tjtjj|dtjtjj|dd}t tjj|ddj!|Wn"t"k r}td|nXt#|\}}}y(t$j%||d|jd|j}Wn&t"k r)}td||nX|jj&yt'|j| }t(j)}||_*t(j+dt(j,d|d<|jj-|t(j)}t(j.|jdt||_*t(j+dt(j,d|d<|jj-|t(j)}t(j.|jd t||_*t(j+dt(j,d|d<|jj-|t/j0t/j1Bt/j2B}t|jd!| d"|d } | d#d }t3t/j4|j5}t/j6|jj7}t8||}t/j4j9||}t:||t/j0t/j1Bt/j2Bt/j;B} |j<||| t=|||t(j)}||_*t(j+|t(j>d$|d%d&|d'd)|d*d,|d-d|d.RRZRtcountRR`tuuidtuuid4tuppert dns_domainR<RvRwRxR#RyR~RRRsRRttransaction_startRDRARdR-ReRtaddRBRRRRRRRtdom_sidtget_domain_sidRt from_sddlRtSECINFO_PROTECTED_DACLtset_aclRRfRhttransaction_cancelttransaction_commitR("RRSRRRRRtnetRR%t cldap_retRtguidRCRtunc_pathRRt gpt_contentsRRRRRRkRlt ds_sd_flagst ds_sd_ndrtds_sdt domain_sidtsddltfs_sdtsioRN((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR{s      $      )(    " "          N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRis     tcmd_delcBsqeZdZdZiejd6ejd6ejd6ZdgZ e dddd e gZ d d d d d ZRS( s Delete a GPO.s%prog [options]RRRRCs-HRs%LDB URL for database or target serverRcCs|j|_|j|jdt|_|rU|jdrU|d}||_n3t|j|j}t|j|jd||_t |y+t |j d|d}|dd}Wn!t k rt d|nXt|\} } } y(tj|| d |jd |j} Wn&t k rF} t d || nX|j jyt|j |}t|r|jjd |x@|D]5}t|j |d ||jjd|d qWnt|j |}|j jtj|j dt||j jtj|j dt||j j|| j| Wn!t k rq|j jnX|j j|jjd|dS(NRsldap://iR=RCiRMsGPO '%s' does not existRRs"Error connecting to '%s' using SMBsGPO %s is linked to containers R-s Removed link from %s. s CN=User,%ss CN=Machine,%ssGPO %s deleted. (RRRRcRR0RR R>RRZRRRRsRRRR\R/RRRnRDtdeleteRARBR`tdeltreeRR(RRCRRRRRRRRRRRRRlRk((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyRsH    (   ))   N(RRRRR)RRRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR%s     t cmd_aclcheckc BsweZdZdZiejd6ejd6ejd6Ze ddddd e d d d d gZ dddddZ RS(s.Check all GPOs have matching LDAP and DS ACLs.s%prog [options]RRRs-Hs--URLRs%LDB URL for database or target serverRRRRRc Cs|j|_|j|jdt|_t|j|j||_|rp|jdrp|d}||_n3t|j|j}t|j|jd||_t |t |j d}xU|D]M}|dd}yt |\} } } Wn!tk rtd|nXy(tj|| d|jd |j} Wn!tk rbtd |nX| j| tjtjBtjBtj} |d d}ttj|j}tj|j j}t||}| j||krtd | j|| |fqqWdS( NRsldap://iR=RMisInvalid GPO path (%s)RRs"Error connecting to '%s' using SMBRIs-Invalid GPO ACL %s on path (%s), should be %s(RRRRcRR>RR0R RRZRR<RsRpRRRRtget_aclRRRRtSEC_FLAG_MAXIMUM_ALLOWEDRRRRRR(RRRRRRRRlRqRRRRR#RR R!texpected_fs_sddl((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR[s6     ( )N(RRRRR)RRRRRR`RR<R(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyR(Ks   tcmd_gpocBseZdZiZeedRDRRRt SECINFO_SACLRZR\RnRsRRRRRRRRRRRRRRR%R(R,(((s4/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.pyts`  "       $( &   %s0/Z'$,6IL>