
Vc           @   sw  d  Z  d d l m Z d d l m Z d d l m Z m Z m Z m	 Z	 m
 Z
 d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z d d	 l m Z m Z d d
 l m Z m Z m Z m  Z  m! Z! d d l" m# Z# d d l$ m% Z% d d l m& Z& d d l' m( Z( d d l) m* Z* d d l m+ Z+ d d l, m- Z- d d l. Z. d d l/ Z/ d d l0 Z0 d d l1 Z1 e/ j2   d e3 f d     YZ4 d e5 f d     YZ6 e7 e7 e7 e7 e7 e7 e7 e7 e8 e7 e8 e7 e8 d  Z9 e7 e7 e7 e7 e7 e7 e7 e7 e8 e7 e8 e7 e8 d  Z: e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e8 e7 d  Z; d S(   s   Joining a domain.i(   t   system_session(   t   SamDB(   t   gensect   Ldbt	   drs_utilst   arcfour_encryptt   string_to_byte_arrayN(   t   ndr_pack(   t   securityt   drsuapit   misct   nbtt   lsat   drsblobs(   t   DS_DOMAIN_FUNCTION_2003(   t   Credentialst   DONT_USE_KERBEROS(   t   secretsdb_self_joint	   provisiont   provision_fillt   FILL_DRSt   FILL_SUBDOMAIN(   t
   setup_path(   t   Schema(   t
   descriptor(   t   Net(   t   setup_bind9_dns(   t   read_and_sub_file(   t	   b64encodet   DCJoinExceptionc           B   s   e  Z d    Z RS(   c         C   s   t  t |   j d |  d  S(   Ns   Can't join, error: %s(   t   superR   t   __init__(   t   selft   msg(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR   /   s    (   t   __name__t
   __module__R   (    (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR   -   s   t   dc_joinc           B   s:  e  Z d  Z d d d d d d d d d e d e d  Z e d  Z d   Z d   Z d   Z	 d   Z
 d   Z d   Z d	   Z d
   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z  d   Z! RS(   s   Perform a DC join.c      
   C   s  | |  _  | |  _ | |  _ | |  _ | |  _ | |  _ |
 |  _ | |  _ d  |  _	 g  |  _
 g  |  _ |  j j | j   t j B t d |  j d |  j  |  _ | d  k	 r | |  _ n= |  j  j d |  |  j |  |  _ |  j  j d |  j  t d d |  j d t   d |  j d |  j  |  _ y# |  j j d	 t j d
 d g  Wn( t j k
 rt\ } } t |   n X| |  _ d |  j |  _ t |  j j     |  _! t |  j j"    |  _# t |  j j$    |  _% t |  j j&    |  _' t( j) |  j j*    |  _+ |  j+ |  _, |  j-   |  _. |  j/   |  _0 t1 j2 t t3 j4     |  _5 |  j j6   |  _7 |  j8   |  _9 |  j:   |  _; |	 d  k	 r|	 |  _< n t= j> d d  |  _< d |  j |  j |  j' f |  _? d |  j? |  _@ d |  j! } |  jA |  rd |  j | f |  _B n	 d  |  _B |  j jC   |  _D |  j jE   |  _F d |  j! |  _G d |  j# |  _H |  j j d	 t j d
 g  d |  j jI   d d |  jG  } | d  k rd |  _J n, tK |  d k rd |  _J d GHn	 | |  _J d |  j jL   |  jD f |  _M |  jD |  _N d |  j |  j! f |  _O d  |  _P d |  j d |  jM d |  jM |  jF f g |  _Q d  |  _R d  |  _S d  |  _T tU |  _V d  |  _W d  |  _X d  |  _Y tU |  _Z d  |  _[ d  S(   Nt   credst   lps&   Finding a writeable DC for domain '%s's   Found DC %st   urls	   ldap://%st   session_infot   credentialst   scopet   attrst   dns   %s$i    i(   s"   CN=%s,CN=Servers,CN=%s,CN=Sites,%ss   CN=NTDS Settings,%ssG   CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,%ss   CN=%s,%ss   DC=DomainDnsZones,%ss   DC=ForestDnsZones,%st   baset
   expressions$   (&(objectClass=crossRef)(ncName=%s))t   NONEi    sC   NO DNS zone information found in source domain, not replicating DNSs   %s.%ss   CN=%s,OU=Domain Controllers,%ss   HOST/%ss   GC/%s/%s(\   t   loggerR%   R&   t   sitet   netbios_namet	   targetdirt	   use_ntvfst   promote_existingt   Nonet   promote_from_dnt   nc_listt   full_nc_listt   set_gensec_featurest   get_gensec_featuresR   t   FEATURE_SEALR   t   nett   servert   infot   find_dcR   R    t   samdbt   searcht   ldbt   SCOPE_ONELEVELt   LdbErrorR   t   mynamet   samnamet   strt   get_default_basednt   base_dnt   get_root_basednt   root_dnt   get_schema_basednt	   schema_dnt   get_config_basednt	   config_dnR   t   dom_sidt   get_domain_sidt   domsidt	   forestsidt   get_domain_namet   domain_namet   get_forest_domain_namet   forest_domain_nameR
   t   GUIDt   uuidt   uuid4t   invocation_idt   get_dsServiceNamet
   dc_ntds_dnt   get_dnsHostNamet   dc_dnsHostNamet   get_behavior_versiont   behavior_versiont	   acct_passt   sambat   generate_random_passwordt	   server_dnt   ntds_dnt	   dn_existst   topology_dnt   domain_dns_namet	   dnsdomaint   forest_dns_namet	   dnsforestt   domaindns_zonet   forestdns_zonet   get_partitions_dnt   dns_backendt   lent   lowert   dnshostnamet   realmt   acct_dnt	   tmp_samdbt   SPNst   never_reveal_sidt
   reveal_sidt   connection_dnt   Falset   RODCt	   krbtgt_dnR	   t	   managedbyt	   subdomaint	   adminpass(   t   ctxR0   R>   R%   R&   R1   R2   R3   t   domaint   machinepassR4   Rq   R5   t   enumt   estrt   topology_baset   res_domaindns(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR   6   s    												#					

								c         C   s   | rp y+ |  j  j d | d t j d d g  } Wn t k
 rE d  SXx' | D] } |  j | j d t qM Wn  y |  j  j |  d | GHWn t k
 r n Xd  S(   NR-   R*   R+   R,   t	   recursives
   Deleted %s(	   RA   RB   RC   RD   t	   Exceptiont   del_noerrorR,   t   Truet   delete(   R   R,   R   t   rest   r(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR      s    +c      	   C   sY  yAd GH|  j  r d } nT|  j j d |  j j   d d t j |  j  d d g  } | rz |  j | d j	 d t
 n  |  j j d |  j j   d d	 t j d
 |  j  t j d |  j  f d g   } | r |  j | d j	 d t
 n  |  j j d |  j j   d d t j d
 |  j  d g   } | rnt d t j d
 |  j  t j d |  j  f   n  |  j d k	 r|  j |  j  n  |  j d k	 r|  j |  j  n  |  j |  j  |  j |  j d t
 |  j r|  j |  j  n  |  j r|  j |  j  n  | r>| d d d |  _ |  j |  j  n  |  j  r@d } t j d |  j | f |  j |  j  } t j   } t j   | _ | j d j d  | t j   } t j!   } |  j" | _# | j$ | | t j%  } | j& | | j' j(  t j!   } |  j) | _# | j$ | | t j%  } | j& | | j' j(  n  Wn t* k
 rTn Xd S(   s$   Remove any DNs from a previous join.s   checking sAMAccountNameR-   R.   s   sAMAccountName=%sR+   s   msDS-krbTgtLinki    R   s/   (&(sAMAccountName=%s)(servicePrincipalName=%s))s   dns-%ss   dns/%ss   (sAMAccountName=%s)sn   Not removing account %s which looks like a Samba DNS service account but does not have servicePrincipalName=%ss   msDS-Krbtgtlinkt   signs   ncacn_ip_tcp:%s[%s]t    s   utf-8N(+   R   R6   RA   RB   RI   RC   t   binary_encodeRG   R   R,   R   RF   Rt   t   RuntimeErrorR{   R~   Rg   Rf   Ri   t   partition_dnt   new_krbtgt_dnR   t   lsarpcR>   R&   R%   t   ObjectAttributet   QosInfot   sec_qost   OpenPolicy2t   decodeR   t   SEC_FLAG_MAXIMUM_ALLOWEDt   StringRu   t   stringt   QueryTrustedDomainInfoByNamet!   LSA_TRUSTED_DOMAIN_INFO_FULL_INFOt   DeleteTrustedDomaint   info_ext   sidRX   R   (   R   R   t   binding_optionst   lsaconnt
   objectAttrt
   pol_handlet   nameR?   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   cleanup_old_join   sd    		0		9			c      
   C   s(  |  j  r t d   n  |  j j d |  j j   d d t j |  j  d d d d d	 g  } t |  d
 k r t d |  j   n  d | d
 k s d | d
 k s d	 | d
 k r t d |  j   n  t	 | d
 d d
  t
 j j t
 j j B@d
 k rt d |  j   n  | d
 j |  _ d S(   s]   confirm that the account is just a bare NT4 BDC or a member server, so can be safely promoteds    Can not promote into a subdomainR-   R.   s   sAMAccountName=%sR+   s   msDS-krbTgtLinkt   userAccountControlt   serverReferenceBLt   rIDSetReferencesi    sc   Could not find domain member account '%s' to promote to a DC, use 'samba-tool domain join' instead'sh   Account '%s' appears to be an active DC, use 'samba-tool domain join' if you must re-create this accountsZ   Account %s is not a domain member or a bare NT4 BDC, use 'samba-tool domain join' instead'N(   R   R   RA   RB   RI   RC   R   RG   Rr   t   intRd   t   dsdbt   UF_WORKSTATION_TRUST_ACCOUNTt   UF_SERVER_TRUST_ACCOUNTR,   R7   (   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   promote_possible   s    	02c         C   s   y3 |  j  j d | d t j t j Bt j B |  _ Wn! t k
 rV t d |   n X|  j j d k	 r |  j j d k r |  j j |  _
 n  |  j j S(   s(   find a writeable DC for the given domainR   t   flagss-   Failed to find a writeable DC for domain '%s'R   N(   R=   t   finddcR   t   NBT_SERVER_LDAPt   NBT_SERVER_DSt   NBT_SERVER_WRITABLEt	   cldap_retR   t   client_siteR6   R1   t   pdc_dns_name(   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR@     s    3$c         C   s^   |  j  j d |  j d t j d d g  } d | d k rP t | d d d  St j j Sd  S(   NR-   R*   R+   s   msDS-Behavior-Versioni    (	   RA   RB   RJ   RC   t
   SCOPE_BASER   Rd   R   t   DS_DOMAIN_FUNCTION_2000(   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyRa     s    *c         C   s7   |  j  j d d d t j d d g  } | d d d S(   NR-   R   R*   R+   t   dnsHostNamei    (   RA   RB   RC   R   (   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR_     s    'c      
   C   sY   |  j  j   } |  j  j d | d t j d d g d d |  j  j    } | d d d S(   s9   get netbios name of the domain from the partitions recordR-   R*   R+   t   nETBIOSNameR.   s	   ncName=%si    (   RA   Rp   RB   RC   RD   RI   (   R   t   partitions_dnR   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyRU     s    $c      
   C   sY   |  j  j   } |  j  j d | d t j d d g d d |  j  j    } | d d d S(   s9   get netbios name of the domain from the partitions recordR-   R*   R+   R   R.   s	   ncName=%si    (   RA   Rp   RB   RC   RD   RK   (   R   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyRW   #  s    $c      
   C   sN   |  j  j d |  j d g  d d |  j t j t j j f  } t	 | d j
  S(   s7   get the parent domain partition DN from parent DNS nameR-   R+   R.   s9   (&(objectclass=crossRef)(dnsRoot=%s)(systemFlags:%s:=%u))i    (   RA   RB   RP   t   parent_dnsdomainRC   t   OID_COMPARATOR_ANDRd   R   t   SYSTEM_FLAG_CR_NTDS_DOMAINRH   R,   (   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   get_parent_partition_dn*  s    c      	   C   s   |  j  j d d |  j d d g d t j d d g  } d | d k ri t d	 |  j |  j  j f   n  y= t t	 j
 t j |  j  | d d d  j d
    } Wn- t k
 r t d | d d d   n Xd | |  j f } | S(   s7   get the parent domain partition DN from parent DNS nameR-   s   CN=Partitions,%sR+   t   fSMORoleOwnerR*   t   controlss   extended_dn:1:1i    s1   Can't find naming master on partition DN %s in %sRY   s3   Can't find GUID in naming master on partition DN %ss   %s._msdcs.%s(   RA   RB   RP   RC   R   R   R   R'   RH   R
   RY   t   Dnt   get_extended_componentt   KeyErrorRm   (   R   R   t   master_guidt   master_host(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   get_naming_master1  s    ""= c         C   sL   |  j  j d d d t j d d g  } | d d d } |  j  j d |  S(   sh   get the SID of the connected user. Only works with w2k8 and later,
           so only used for RODC joinR-   R   R*   R+   t   tokenGroupsi    t	   objectSID(   RA   RB   RC   R   t   schema_format_value(   R   R   t   binsid(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt	   get_mysid?  s    'c         C   sa   y( |  j  j d | d t j d g   } Wn2 t j k
 r\ \ } } | t j k rV t S  n Xt S(   s   check if a DN existsR-   R*   R+   (   RA   RB   RC   R   RE   t   ERR_NO_SUCH_OBJECTR|   R   (   R   R,   R   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyRh   F  s    (c         C   sW  d |  j  GHi |  j  d 6d d 6t t j j t j j B d 6d d 6d |  j d	 6} |  j j | d
 g  |  j j	 d |  j  d t
 j d d g  } | d d d |  _ d |  j GHt
 j   } t
 j |  j |  j  | _ t
 j |  j  t
 j d  | d <|  j j |  d |  j |  j f |  _ d |  j  |  j f GH|  j j |  j  |  j  d S(   s#   RODCs need a special krbtgt accounts	   Adding %sR,   t   usert   objectclasst   useraccountcontrolt   TRUEt   showinadvancedviewonlys   krbtgt for %st   descriptions   rodc_join:1:1R-   R*   R+   t   samAccountNamei    s   Got krbtgt_name=%ss   msDS-krbTgtLinks   CN=%s,CN=Users,%ss   Renaming %s to %sN(   R~   RH   Rd   R   t   UF_NORMAL_ACCOUNTt   UF_ACCOUNTDISABLERG   RA   t   addRB   RC   R   t   krbtgt_namet   MessageR   Rv   R,   t   MessageElementt   FLAG_MOD_REPLACEt   modifyRJ   R   t   rename(   R   t   recR   t   m(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   add_krbtgt_accountP  s(    
*c         C   s   d } t  |  j j d   d k r1 | d 7} n  d |  j | f } t j | |  j |  j  |  _ t j |  j  \ |  _ |  _	 d S(   s.   make a DRSUAPI connection to the naming mastert   seals	   log leveli   s   ,prints   ncacn_ip_tcp:%s[%s]N(
   R   R&   t   getR>   R	   R%   R   t
   drs_DsBindt   drsuapi_handlet   bind_supported_extensions(   R   R   t   binding_string(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   drsuapi_connectm  s    c         C   sq   t  |  j d |  j |  _ t d t   d d	 d t d |  j d |  j	 d t d t  |  _
 |  j
 j |  j  d	 S(
   s2   create a temporary samdb object for schema queriest   schemadnR(   R'   t   auto_connectR)   R&   t   global_schemat   am_rodcN(   R   RS   RN   t
   tmp_schemaR   R    R6   R|   R%   R&   Rw   t
   set_schema(   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   create_tmp_samdbv  s    c         C   s.   t  j   } |  j j |  | _ d | _ d S(   s$   build a DsReplicaAttributeCtr objecti   N(   R	   t   DsReplicaAttributeRw   t   get_attid_from_lDAPDisplayNamet   attidt	   value_ctr(   R   t   attrnamet	   attrvalueR   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   build_DsReplicaAttribute  s    c         C   s  |  j  d k r |  j   n  |  j d k r8 |  j   n  g  } x	| D]} t  j   } | d | _ g  } xu | D]m } | d k r qq n  t | | t  s | | g } n
 | | } |  j j	 |  j | |  } | j
 |  qq Wt  j   }	 t |  |	 _ | |	 _ t  j   }
 | |
 _ |	 |
 _ t  j   } |
 | _ | j
 |  qE Wt  j   } | d | _ | j } x! | d D] } | | _ | } qwW|  j  j |  j d |  \ } } | d k r| j t  j k rd | j GHt d   n  | j d k rd | j GHt d   qn  | d	 k r| j d k rHt d
 | j   n  | j j d k rd | j j | j j  j f GHt d   n  | j j t  j k rd | j j GHt d   qn  | j! S(   s,   add a record via the DRSUAPI DsAddEntry callR,   i    i   i   s!   DsAddEntry failed with dir_err %us   DsAddEntry failedt   WERR_OKs(   DsAddEntry failed with status %s info %si   s   expected err_ver 1, got %uN(   i    R   (   i    R   ("   R	   R6   R   Rw   R   t   DsReplicaObjectIdentifierR,   t
   isinstancet   listt   dsdb_DsReplicaAttributet   appendt   DsReplicaAttributeCtrRr   t   num_attributest
   attributest   DsReplicaObjectt
   identifiert   attribute_ctrt   DsReplicaObjectListItemt   objectt   DsAddEntryRequest2t   first_objectt   next_objectt
   DsAddEntryR   t   dir_errt   DRSUAPI_DIRERR_OKR   t   extended_errt   err_vert   err_datat   statusR?   t   objects(   R   t   recsR  R   t   idR+   t   at   vt   rattrR  R  t   list_objectt   req2t   prevt   ot   levelt   ctr(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR
    sf    
						
!c         C   st  d |  j  GHi |  j  d 6d d 6t t j j  d 6|  j d 6} |  j |  j |  j g } |  j t j j	 k r t t j j
  | d <n  |  j t j j	 k r |  j | d <n  |  j r d	 |  j | d
 <|  j | d <d | d <n d |  j | d
 <g  | d <x1 | D]) } | |  j k r| d j |  qqW|  j t j j	 k rS|  j | d <n  d | d <t |  j  | d <| S(   s    return the ntdsdsa object to adds	   Adding %sR,   t   nTDSDSAR   t   systemFlagst   dMDLocations   msDS-Behavior-Versions   msDS-HasDomainNCss   CN=NTDS-DSA-RO,%st   objectCategorys   msDS-HasFullReplicaNCst   37t   optionss   CN=NTDS-DSA,%st   HasMasterNCss   msDS-HasMasterNCst   1t   invocationId(   Rg   RH   Rd   R   t#   SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETERN   RJ   RP   Rb   R   t   DS_DOMAIN_FUNCTION_2008_R2R}   R9   R   R   R\   (   R   R   R8   t   nc(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_ntdsdsa_obj  s2    
	

c         C   s   |  j    } |  j r. |  j j | d g  n |  j | g  |  j j d |  j d t j d d g  } t	 j
 |  j j d | d d d   |  _ d S(   s   add the ntdsdsa objects   rodc_join:1:1R-   R*   R+   t
   objectGUIDi    N(   R)  R}   RA   R   R
  RB   Rg   RC   R   R
   RY   R   t	   ntds_guid(   R   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_add_ntdsdsa  s    	*c         C   s  |  j  rd |  j  GHi |  j  d 6d d 6|  j d 6|  j d 6t |  j t j j B d 6|  j d 6} |  j t j j	 k r t t j j
  | d	 <n |  j r g  | d	 <n  |  j r |  j | d
 <n |  j r g  | d
 <n  |  j r |  j | d <n |  j rg  | d <n  |  j r|  j | d <n |  j r5g  | d <n  |  j r|  j |  j  k rl|  j j |  j |  j   n  |  j j t j j |  j | t j   q|  j j |  n  |  j r|  j   n  d |  j GHi |  j d 6d d 6t t j j t j j Bt j j B d 6|  j d 6} |  j  r-|  j  | d <n  |  j j |  |  j rSd |  _  d S|  j!   |  j" d k	 rd |  j" GHi |  j" d 6d d 6d d 6d d 6|  j# d 6} |  j j |  n  |  j  rd |  j  GHt j   } t j$ |  j |  j   | _% xF t& t' |  j(   D]/ } |  j( | j) d t |  j    |  j( | <qWt j* |  j( t j d  | d <|  j j |  d |  j GHy9 |  j j+ d t j, |  j  |  j- d t. d |  j WnV t j/ k
 r\ } } | t j0 k rn  |  j1 j2 d  |  j d! |  j3 d" |  j-  n X|  j j4 d# |  j  d$ t j5 d% d& g  } d& | d' k rdt6 | d' d& d'  |  _7 n	 d |  _7 d( GHt j   } t j$ |  j |  j   | _% t j* t |  j  t j d  | d <|  j j |  n  |  j8 j9 d)  rt j: d* d+  |  _; |  j j< t= t> d,  i |  j? d- 6|  j@ d. 6|  jA d/ 6tB |  j;  d0 6|  j d1 6  } x | D] \ } }	 | t jC k sytD  |	 d }
 d2 |	 d GH|	 d3 =|	 d4 =t t j jE t j j B |	 d <y |  j j |	  WqXt j/ k
 r\ } } | t jF k r  qqXXqXWd5 |  jA GHy9 |  j j+ d6 t j, |  jA  |  j; d t. d |  j Wn] t j/ k
 r\ } } | t j0 k r  n  |  j1 j2 d  d7 |  jA d! |  j3 d" |  j;  n X|  j j4 d# |
 d$ t j5 d% d& g  } d& | d' k rt6 | d' d& d'  |  _G qd |  _G n  d S(8   s+   add the various objects needed for the joins	   Adding %sR,   t   computert   objectClasst   displaynamet   samaccountnameR   Rt   s   msDS-SupportedEncryptionTypesR   s   msDS-NeverRevealGroups   msDS-RevealOnDemandGroupR>   R   R  R   t   serverReferenceNt   nTDSConnectionR   t   enabledconnectiont   65R"  t
   fromServers   Adding SPNs to %ss	   $NTDSGUIDt   servicePrincipalNames   Setting account password for %ss(   (&(objectClass=user)(sAMAccountName=%s))t   force_change_at_next_logint   usernamet   account_nameRV   t   newpasswordR-   R*   R+   s   msDS-KeyVersionNumberi    s   Enabling accountt   BIND9_i   i   s   provision_dns_add_samba.ldift	   DNSDOMAINt   DOMAINDNt   HOSTNAMEt   DNSPASS_B64t   DNSNAMEs#   Adding DNS account %s with dns/ SPNt   clearTextPasswordt   isCriticalSystemObjects#   Setting account password for dns-%ss,   (&(objectClass=user)(samAccountName=dns-%s))s   dns-%s(H   Rv   RG   RH   R   Rd   R   R   Rt   Rb   t   DS_DOMAIN_FUNCTION_2008t   ENC_ALL_TYPESR5   R   Ry   Rz   R7   RA   R   R   RC   R   t	   from_dictR   R   R~   R   Rf   t   SYSTEM_FLAG_CONFIG_ALLOW_RENAMEt%   SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVER&  R   R6   R+  R,  R{   R^   R   R,   t   rangeRr   Rx   t   replaceR   t   setpasswordR   Rc   R|   RE   t   ERR_UNWILLING_TO_PERFORMR=   t   set_passwordRV   RB   R   R   t   key_version_numberRq   t
   startswithRe   t   dnspasst
   parse_ldifR   R   Rk   RJ   RF   R   t   CHANGETYPE_NONEt   AssertionErrorR   t   ERR_ENTRY_ALREADY_EXISTSt   dns_key_version_number(   R   R   R   t   it   numt   _R   R  t
   changetypeR!   t   dns_acct_dn(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_add_objects  s   	


								+	
			

	-			


		c         C   s  d |  j  GHi d t |  j  t j f d 6} t j |  j d | } i	 |  j  d 6d d 6d |  j d	 6|  j	 d
 6|  j
 d 6|  j d 6|  j d 6t t j j t j j B d 6| d 6} |  j t j j k r t |  j  | d <n  |  j   } |  j | | g  } t |  d k r%t d   n  | d j |  _ d GH|  j j |  j  t j d  |  j d t j d t j d GH|  j j |  j  t j d  |  j d t j d t j d S(   sL   add the various objects needed for the join, for subdomains post replications	   Adding %ss   %s-%st   SubdomainAdminst   name_mapR,   t   crossRefR   s   CN=Cross-Ref,%sR   t   nCNameR   t   dnsRoott   trustParentR  t   ntSecurityDescriptors   msDS-Behavior-Versioni   s"   Expected 2 objects from DsAddEntryi   s   Replicating partition DNs$   00000000-0000-0000-0000-000000000000t   exopt   replica_flagss   Replicating NTDS DNN(!   R   RH   RS   R   t   DOMAIN_RID_ADMINSR   t+   get_paritions_crossref_subdomain_descriptorRT   RN   RJ   RV   Rk   t   parent_partition_dnRd   R   t   SYSTEM_FLAG_CR_NTDS_NCR   Rb   R   R)  R
  Rr   R   t   guidR+  t   replt	   replicateR
   RY   R	   t   DRSUAPI_EXOP_REPL_OBJt   DRSUAPI_DRS_WRIT_REPRg   (   R   R\  t	   sd_binaryR   t   rec2R  (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_add_objects2  s@    #





		
		c      )   C   s  d GH|  j  j } t |  j t   d | d |  j d t d |  j d |  j d |  j	 d |  j
 d	 |  j d
 |  j d |  j d |  j d |  j d |  j d d d |  j d |  j  d |  j d |  j d |  j } d | j GH| j |  _ | j  |  _  | j |  _ | j |  _ |  j |  j _ d S(   s   Provision the local SAM.s   Calling bare provisiont   smbconfR3   t
   samdb_fillRu   t   rootdnt   domaindnR   t   configdnt   serverdnR   t   hostnamet	   domainsidR   t
   serverroles"   active directory domain controllert   sitenameR&   t   ntdsguidR4   Rq   s   Provision OK for domain DN %sN(   R&   t
   configfileR   R0   R    R3   R   Ru   RL   RJ   RN   RP   Rf   RV   RF   RS   Rc   R1   R+  R4   Rq   Rs  RA   t   local_samdbt   pathst   namesRT   (   R   Rp  t   presult(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_provision  s"    c         C   s$  d GHt  d |  j j d t   d |  j j d t  |  _ |  j j t |  j	   |  j |  _ |  j
 j d  |  j j d |  j d t j d	 d
 g d d d g  } d | d k r t d |  j |  j j f   n  yC t t j t j |  j | d d
 d  j d    |  j _ Wn- t k
 rGt d | d d
 d   n X|  j
 j d |  j j  |  j
 j d  t |  j j d t   d |  j } t |  j | |  j
 |  j |  j d t d |  j d t d |  j d d d |  j d |  j j  d |  j j! d |  j" d |  j# 
} d |  j j$ GHd  S(!   s   Provision the local SAM.s   Reconnecting to local samdbR'   R(   R&   R   s   Finding domain GUID from ncNameR-   R*   R+   t   ncNameR   s   extended_dn:1:1s   reveal_internals:0R^  i    s2   Can't find naming context on partition DN %s in %sRY   s3   Can't find GUID in naming master on partition DN %ss   Got domain GUID %ss   Calling own domain provisiont   dom_for_fun_levelR3   Rq  R   Rx  s"   active directory domain controllert   hostipt   hostip6Rq   R   s   Provision OK for domain %sN(%   R   R|  R'   R    R&   R|   RA   t   set_invocation_idRH   R\   R0   R?   RB   R   RC   R   R   R
   RY   R   R   R~  t
   domainguidR   R   R}  t   secretsR   R   R3   R   Rc   R  R  Rq   R   Rk   (   R   R   t   secrets_ldbR  (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_provision_own_domain  s6    	'"C $!c      
   C   s4  d GH|  j  j   yt j |  j j    } |  j d k rV d GHt j t j	  } n	 |  j } |  j
 r t   } | j |  j  | j t  | j |  j  | j |  j  n	 |  j } d } t |  j j d   d k r | d 7} n  t j d |  j | f |  j | |  j  |  j  } | j |  j | | d t d	 |  j
 d
 |  j | j |  j | | d	 |  j
 d
 |  j |  j  s*|  j! t j" @sd GH|  j! t j" t j# BO_! | j |  j$ | | d	 |  j
 d
 |  j! |  j! t j" t j# BN_! n |  j! t j# O_! | j |  j$ | | d	 |  j
 d
 |  j! n  d GHx` |  j% |  j& f D]L } | |  j' k rBd t( |  GH| j | | | d	 |  j
 d
 |  j qBqBW|  j
 r| j |  j) | | d t j* d	 t | j |  j+ | | d t j* d	 t n  | |  _, | |  _- | |  _. d GHWn |  j  j/     n X|  j  j0   d S(   s   Replicate the SAM.s   Starting replications   Using DS_BIND_GUID_W2K3R   s	   log leveli   s   ,prints   ncacn_ip_tcp:%s[%s]t   schemat   rodcRc  s;   Replicating critical objects from the base DN of the domains5   Done with always replicated NC (base, config, schema)s   Replicating %sRb  s   Committing SAM databaseN(1   R|  t   transaction_startR
   RY   RA   t   get_invocation_idR+  R6   R	   t   DRSUAPI_DS_BIND_GUID_W2K3R}   R   t   guessR&   t   set_kerberos_stateR   t   set_usernameRG   RL  Rc   R%   R   R   R   t   drs_ReplicateR>   R\   Rj  RN   R   Rc  RP   R   t   domain_replica_flagst   DRSUAPI_DRS_CRITICAL_ONLYt   DRSUAPI_DRS_GET_ANCRJ   Rn   Ro   R8   RH   Rv   t   DRSUAPI_EXOP_REPL_SECRETR   Ri  t   source_dsa_invocation_idt   destination_dsa_guidt   transaction_cancelt   transaction_commit(   R   R  R  t
   repl_credsR   Ri  R(  (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_replicate  sz    				

	
					c         C   s   t  j   } t  j   | _ t |  | j _ t j d  | j _ t	 j
 d  | j _ |  j | _ d t |  j  |  j f | _ t  j t  j B| _ |  j s | j t  j O_ n  |  j  r |  j  j |  j d |  n  d  S(   Ns$   00000000-0000-0000-0000-000000000000s   S-0-0s   %s._msdcs.%si   (   R	   t   DsReplicaUpdateRefsRequest1R   t   naming_contextRH   R,   R
   RY   Rh  R   RQ   R   R+  t   dest_dsa_guidRm   t   dest_dsa_dns_namet   DRSUAPI_DRS_ADD_REFt   DRSUAPI_DRS_DEL_REFR"  R}   Rl  t   DsReplicaUpdateRefsR   (   R   R,   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   send_DsReplicaUpdateRefs\  s    		c         C   st  |  j  j d  x |  j D] } |  j |  q W|  j r d GH|  j j t |  j   |  j j	 d |  j
  t j   } t j |  j d |  j  | _ t j t |  j  t j d  | d <|  j j |  |  j j | j d d  n  |  j  j d  t j   } t j |  j d  | _ t j d	 t j d
  | d
 <t j d t |  j  t j d  | d <|  j j |  |  j rd St |  j j d t   d |  j } |  j  j d  t | d |  j d |  j d |  j d |  j  d |  j! d |  j" d |  j# d |  j$ |  j% j& d  rpt' |  j | |  j( |  j |  j |  j  d |  j% d |  j) d |  j
 d |  j* d |  j+ n  d S(   s=   Finalise the join, mark us synchronised and setup secrets db.s=   Sending DsReplicaUpdateRefs for all the replicated partitionss   Setting RODC invocationIdt   domainFunctionalitys   %sR%  i    s(   Setting isSynchronized and dsServiceNames   @ROOTDSER   t   isSynchronizeds	   <GUID=%s>t   dsServiceNameNR(   R&   s   Setting up secrets databaseR   Ru   Rk   t   netbiosnameRw  R   t   secure_channel_typeRM  R;  Rq   RO  t   os_levelR3   (,   R0   R?   R8   R  R}   R|  R  RH   R\   t   set_opaque_integerRb   RC   R   R   Rg   R,   R   R   R   R   t"   set_attribute_replmetadata_versionR+  R   R   R}  R  R    R&   R   RV   Ru   Rk   RF   RS   Rc   R  RM  Rq   RN  R   R~  RO  R3   RT  (   R   R(  R   R  (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_finalisek  sV    	

	$						
		c         C   s  d |  j  GHd } t j d |  j  | f |  j |  j  } t j   } t j   | _ | j d j	 d  | t
 j  } t j   } |  j | j _ |  j | j _ |  j | _ t j t j B| _ t j | _ t j | _ yb t j   } |  j | _ | j | | t j  } d |  j | j j f GH| j | | j j  Wn t k
 rLn Xt  |  j! j" d   } t# j$   }	 t% |  |	 _& | |	 _' t# j(   }
 t) j* t+ t, j,     |
 _- t j. |
 _/ |	 |
 _0 t# j1   } d | _2 |
 g | _3 t# j4   } d | _2 | | _5 t# j6   } d g d	 } x* t7 d	  D] } t8 j9 d
 d  | | <q-W| | _: | | _; | | _< t= |  } t> | j? |  } t j@   } t% |  | _& t  |  | _A t jB   } | | _C | jD | | | t
 jE  } i
 d |  jF |  jG f d 6d d 6tH | j  d 6tH | j  d 6tH | j  d 6|  jI d 6|  jF d 6t= |  d 6t= |  d 6t= |  jJ  d 6} |  jK jL |  i d |  jI |  jG f d 6d d 6tH t) jM jN  d 6|  j! j" d  d 6d |  jI d 6} |  jK jL |  d S(   s   provision the local SAM.s"   Setup domain trusts with server %sR   s   ncacn_np:%s[%s]s   utf-8s)   Removing old trust record for %s (SID %s)s	   utf-16-lei   i   i   i    i   s   cn=%s,cn=system,%sR,   t   trustedDomainR   t	   trustTypet   trustAttributest   trustDirectiont   flatnamet   trustPartnert   trustAuthIncomingt   trustAuthOutgoingt   securityIdentifiers   cn=%s$,cn=users,%sR   R   RA  s   %s$R   N(O   R>   R   R   R&   R%   R   R   R   R   R   R   R   t   TrustDomainInfoInfoExRk   RV   R   R2   RS   R   t   LSA_TRUST_DIRECTION_INBOUNDt   LSA_TRUST_DIRECTION_OUTBOUNDt   trust_directiont   LSA_TRUST_TYPE_UPLEVELt
   trust_typet!   LSA_TRUST_ATTRIBUTE_WITHIN_FORESTt   trust_attributesR   R   R   R   R   R   R   t   trustdom_passt   encodeR   t   AuthInfoClearRr   t   sizet   passwordt   AuthenticationInformationRd   t   unix2nttimeR   t   timet   LastUpdateTimet   TRUST_AUTH_TYPE_CLEARt   AuthTypet   AuthInfot   AuthenticationInformationArrayt   countt   arrayt   trustAuthInOutBlobt   currentt   trustDomainPasswordsRH  t   randomt   randintt
   confoundert   outgoingt   incomingR   R   t   session_keyt	   DATA_BUF2t   datat   TrustDomainInfoAuthInfoInternalt	   auth_blobt   CreateTrustedDomainEx2t   SEC_STD_DELETERm   RJ   RH   RX   RT   R|  R   R   t   UF_INTERDOMAIN_TRUST_ACCOUNT(   R   R   R   R   R   R?   t   oldnamet   oldinfot   password_blobt   clear_valuet    clear_authentication_informationt    authentication_information_arrayR  t	   trustpassR  RU  t   trustpass_blobt   encrypted_trustpassR  t	   auth_infot   trustdom_handleR   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_setup_trusts  s    										

c         C   s}  |  j  |  j g |  _ |  j |  j  |  j g |  _ |  j r` |  j d k r` |  j |  j g 7_ n |  j s |  j |  j g 7_ |  j d k r |  j |  j g 7_ |  j |  j g 7_ |  j |  j g 7_ |  j |  j g 7_ q n  |  j	 r |  j
   n
 |  j   yV |  j   |  j   |  j   |  j rR|  j   |  j   |  j   n  |  j   Wn d GH|  j     n Xd  S(   NR/   s   Join failed - cleaning up(   RP   RN   R8   RJ   R9   R   Rq   Rn   Ro   R5   R   R   RZ  R  R  Ro  R  R  R  (   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   do_join  s6    		



	


N("   R"   R#   t   __doc__R6   R|   R   R   R   R   R@   Ra   R_   RU   RW   R   R   R   Rh   R   R   R   R   R
  R)  R,  RZ  Ro  R  R  R  R  R  R  R  (    (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyR$   3   sB   		j	B										
							?	#			+		(	P		E	fc         C   s  t  |  | | | | | | | |	 |
 | |  } | j d | j  |  j d | j  | j d | j  |  j d | j  d | j | j f | _ d | j t	 j
 f d t	 j d t	 j d t	 j d t	 j g | _ d | j t	 j f | _ | j   } d | } | | _ t j j t j j Bt j j B| _ | j j d | j d | j g  d	 | j | _ t j  | _! t" | _# t$ j% t$ j& Bt$ j' Bt$ j( Bt$ j) Bt$ j* B| _+ | j+ | _, | r| j, t$ j- O_, n  | j.   |  j d
 | j | j f  d S(   s   Join as a RODC.t	   workgroups   workgroup is %sRu   s   realm is %ss   CN=krbtgt_%s,CN=Users,%ss   <SID=%s-%s>s   <SID=%s>s   RestrictedKrbHost/%ss   CN=RODC Connection (FRS),%ss$   Joined domain %s (SID %s) as an RODCN(/   R$   t   setRV   R?   Ru   RF   RJ   R~   RS   R   t   DOMAIN_RID_RODC_DENYt   SID_BUILTIN_ADMINISTRATORSt   SID_BUILTIN_SERVER_OPERATORSt   SID_BUILTIN_BACKUP_OPERATORSt   SID_BUILTIN_ACCOUNT_OPERATORSRy   t   DOMAIN_RID_RODC_ALLOWRz   R   R   Rd   R   R   t)   UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONt   UF_PARTIAL_SECRETS_ACCOUNTR   Rx   t   extendRt   Rg   R{   R
   t   SEC_CHAN_RODCR  R   R}   R	   t   DRSUAPI_DRS_INIT_SYNCt   DRSUAPI_DRS_PER_SYNCR  t   DRSUAPI_DRS_NEVER_SYNCEDt%   DRSUAPI_DRS_SPECIAL_SECRET_PROCESSINGt$   DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIPRc  R  R  R  (   R0   R>   R%   R&   R1   R2   R3   R   t   domain_critical_onlyR   R4   Rq   R5   R   t   mysidt   admin_dn(    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt	   join_RODC?  s<    



		"
c         C   s1  t  |  | | | | | | | |	 |
 | |  } | j d | j  |  j d | j  | j d | j  |  j d | j  t j j t j j B| _	 | j
 j d | j  t j | _ t j t j Bt j Bt j Bt j B| _ | j | _ | r| j t j O_ n  | j   |  j d | j | j f  d S(   s   Join as a DC.R  s   workgroup is %sRu   s   realm is %ss1   E3514235-4B06-11D1-AB04-00C04FC2DCD2/$NTDSGUID/%ss!   Joined domain %s (SID %s) as a DCN(   R$   R  RV   R?   Ru   Rd   R   R   t   UF_TRUSTED_FOR_DELEGATIONR   Rx   R   Rk   R
   t   SEC_CHAN_BDCR  R	   Rl  R  R  t!   DRSUAPI_DRS_FULL_SYNC_IN_PROGRESSR  Rc  R  R  R  RS   (   R0   R>   R%   R&   R1   R2   R3   R   R  R   R4   Rq   R5   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_DCv  s     
c         C   s  t  |  | | | | | | | |
 | |  } t | _ | d k rW t j d d  | _ n	 | | _ | j | _ |	 | _ | | _	 | j
 | _ | j   | _ | | _
 d | j | j f | _ | j   | _ | j | j k r|  j d | j  | j | _ t d d | j d t   d | j d	 | j  | _ | j j d
 d d t j d d g d g   } | d d | _ |  j d | j  n  t j |  | _ | j | _ t  j!   | _ d | _" d | j# j$   | j
 f | _% t j d d  | _& t j' j( t j' j) B| _* | j+ j, d | j
  t- j. | _/ t0 j1 t0 j2 Bt0 j3 Bt0 j4 Bt0 j5 B| _6 | j6 | _7 | j8   | j9 j d | j | j f  d S(   s   Join as a DC.i   i    s   CN=%s,CN=Partitions,%ss    Reconnecting to naming master %sR'   s	   ldap://%sR(   R)   R&   R-   R   R*   R+   R   R   i    s#   DNS name of new naming master is %ss   %s.%si   s1   E3514235-4B06-11D1-AB04-00C04FC2DCD2/$NTDSGUID/%ss"   Created domain %s (SID %s) as a DCN(:   R$   R   R   R6   Rd   Re   R   RV   t   parent_domain_nameRu   Rk   R   R   Rf  RP   R   R   t   naming_masterR>   R?   R   R    R%   R&   RA   RB   RC   R   t   dn_from_dns_nameRJ   RS   RT   R   t
   random_sidRv   RF   Rs   Rt   R  R   R   R  R   Rx   R   R
   R  R  R	   Rl  R  R  R  R  Rc  R  R  R0   (   R0   R>   R%   R&   R1   R2   R3   t   parent_domainRk   t   netbios_domainR   R   R4   Rq   R   R   (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   join_subdomain  sL    						$		
(<   R  t
   samba.authR    t   samba.samdbR   Rd   R   R   R   R   R   RC   t   sysRZ   t	   samba.ndrR   t   samba.dcerpcR   R	   R
   R   R   R   t
   samba.dsdbR   t   samba.credentialsR   R   t   samba.provisionR   R   R   R   R   t   samba.provision.commonR   t   samba.schemaR   R   t	   samba.netR   t   samba.provision.sambadnsR   R   t   base64R   t   loggingt   tallocR  R  t   enable_null_trackingR   R   R  R$   R6   R|   R   R  R  (    (    (    s.   /usr/lib/python2.7/dist-packages/samba/join.pyt   <module>   sN   (0.(
    		4		