
    gQ                         S SK r S SKJr  S SKJr  S SKJr  S SKJr  S SK	J
r
JrJrJrJr  SrSrS	S
SSSSSSSSSSSSSS.r\
S\S\S\S\S0r\
S\S\S\S\S 0r/ r " S! S"\5      r " S# S$\5      rg)%    N)	b64encode)sd_utils)security)'get_managed_service_accounts_descriptor)DS_DOMAIN_FUNCTION_2008DS_DOMAIN_FUNCTION_2008_R2DS_DOMAIN_FUNCTION_2012DS_DOMAIN_FUNCTION_2012_R2DS_DOMAIN_FUNCTION_2016K   Y   z$5e1574f6-55df-493e-a671-aaeffca6a100z$d262aae8-41f7-48ed-9f35-56bbb677573dz$82112ba0-7e4c-4a44-89d9-d46c9612bf91z$c3c927a6-cc1d-47c0-966b-be8f9b63d991z$54afcfb9-637a-4251-9f47-4d50e7021211z$f4728883-84dd-483c-9897-274f2ebcf11ez$ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ffz$83c53da7-427e-47a4-a07a-a324598b88f7z$c81fc9cc-0130-4fd1-b272-634d74818133z$e5f9e791-d96d-4fc9-93c9-d53e1dc439baz$e6d5fd00-385d-4e65-b02d-9da3493ed850z$3a6b3fbf-3168-4312-a10d-dd5b3393952dz$7f950403-0ab3-47f9-9730-5d7b0269f9bdz$434bb40d-dbc9-4fe7-81d4-d57229f7b080z$a0c238ba-9e30-4ee6-80a6-43f731e9a5cd)r   L   M   N   O   P   Q   R   S   T   U   V   W   X   r   J   r   r         	   
      c                       \ rS rSrSrg)DomainUpdateExceptionr    N)__name__
__module____qualname____firstlineno____static_attributes__r#       5/usr/lib/python3/dist-packages/samba/domain_update.pyr"   r"   W   s    r)   r"   c                       \ rS rSrSr   SS jr  SS jrS rSS jrS r	S	 r
S
 rS rS rS rS rS rS rS rS rS rS rS rS rS rS rS rSrg)DomainUpdate[   z2Check and update a SAM database for domain updatesc                    Xl         X l        X0l        X@l        SU l        U R                   R                  5       U l        U R                   R                  5       U l        U R                   R                  5       U l	        [        R                  " U5      U l
        [        R                  " UR                  5       5      U l        U R                   R!                  5       U l         U R"                  R%                  S5        U R                   R!                  5       U l         U R,                  R%                  S5        g! [&        R(                   a    [+        S5      ef = f! [&        R(                   a    [+        S5      ef = f)a  
:param samdb: LDB database
:param fix: Apply the update if the container is missing
:param new_install: Apply the update as per a new install (see op 88)
:param add_update_container: Add the container at the end of the change
:raise DomainUpdateException:
Fz(CN=Operations,CN=DomainUpdates,CN=Systemz+Failed to add domain update container childz3CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=Systemz#Failed to add revision object childN)samdbfixnew_installadd_update_containercheck_update_appliedget_config_basedn	config_dn	domain_dnget_schema_basedn	schema_dnr   SDUtilsr   dom_sidget_domain_sid
domain_sidget_root_basedndomainupdate_container	add_childldbLdbErrorr"   revision_object)selfr/   r0   r1   r2   s        r*   __init__DomainUpdate.__init__^   s2    
&$8!$)!557--/557 ((/"**5+?+?+AB&*jj&@&@&B#	W''112\]  $zz99;	O  **+`a || 	W'(UVV	W || 	O'(MNN	Os   !D8 E 8 E E;Nc                    U R                   R                  U R                  S/[        R                  S9n[
        U   nU(       a  [
        U   nUS-  nO[        nU R                  Xe5        [        U   n[        US   S   S   5      nU(       a[  X:  aU  U R                  (       d  [        SUU4-  5      eU R                   R                  S[        U R                  5      U4-  5        ggg)z
Apply all updates for a given old and new functional level
:param functional_level: constant
:param old_functional_level: constant
:param update_revision: modify the stored version
:raise DomainUpdateException:
revision)baseattrsscope   r   zERevision is not high enough. Fix is set to False.
Expected: %dGot: %dz9dn: %s
changetype: modify
replace: revision
revision: %d
N)r/   searchrB   r@   
SCOPE_BASEfunctional_level_to_max_update
MIN_UPDATEcheck_updates_rangefunctional_level_to_versionintr0   r"   modify_ldifstr)	rC   functional_levelold_functional_levelupdate_revisionresexpected_update
min_updateexpected_versionfound_versions	            r*   check_updates_functional_level+DomainUpdate.check_updates_functional_level   s     jjT%9%9'1l#..   J 99IJ78LMJ!OJ#J  =67GHCF:.q12}?88+ -DGWGTGV-V W W JJ"" $ 4 "23	$4 5  @?r)   c                 ~    U H7  nU[         :  d
  U[        :  a  [        S5      e[        U SU-  5      " U5        M9     g)z
Apply a list of updates which must be within the valid range of updates
:param iterator: Iterable specifying integer update numbers to apply
:raise DomainUpdateException:
Update number invalid.operation_%dN)rO   
MAX_UPDATEr"   getattr)rC   iteratorops      r*   check_updates_iterator#DomainUpdate.check_updates_iterator   s=     BJ"z/+,DEE D.2-.r2 r)   c                     UnU[         :  d  X:  d
  U[        :  a  [        S5      eX2::  a,  U[        ;  a  [	        U SU-  5      " U5        US-  nX2::  a  M+  gg)z
Apply a range of updates which must be within the valid range of updates
:param start: integer update to begin
:param end: integer update to end (inclusive)
:raise DomainUpdateException:
r`   ra   rK   N)rO   rb   r"   missing_updatesrc   )rC   startendre   s       r*   rP    DomainUpdate.check_updates_range   sY     :j0@'(@AAi(nr1226!GB ir)   c                 f   S[         U   < SU R                  < 3n U R                  R                  U[        R
                  / S9n[        U5      S:X  d   e[        SU[         U   4-  5        g! [        R                   a-  nUR                  u  pVU[        R                  :w  a  e  SnAgSnAff = f)	zL
:param op: Integer update number
:return: True if update exists else False
zCN=,)rH   rJ   rI   NFrK   zSkip Domain Update %u: %sT)
update_mapr>   r/   rL   r@   rM   rA   argsERR_NO_SUCH_OBJECTlenprint)rC   re   	update_dnrX   enummsgs          r*   update_existsDomainUpdate.update_exists   s    
 #-R.$2M2MN		**##*-..*, $ .C 3x1}})RB,@@A || 	JSc,,,		s   )A/ /B0#B++B0c                     U R                   R                  S[        U   < S[        U R                  5      < S35        [        SU[        U   4-  5        g)zW
Add the corresponding container object for the given update
:param op: Integer update
zdn: CN=rn   z
objectClass: container
zApplied Domain Update %u: %sN)r/   add_ldifro   rT   r>   rs   rC   re   s     r*   
update_addDomainUpdate.update_add   sH    
 	

"~s46679 	: 	,JrN/CCDr)   c                 B    U R                   (       d  [        SU-  5      eg)zc
Raises an exception if not set to fix.
:param op: Integer operation
:raise DomainUpdateException:
z3Missing operation %d. Fix is currently set to FalseN)r0   r"   r|   s     r*   raise_if_not_fixDomainUpdate.raise_if_not_fix   s"     xx'(]`b(bcc r)   c                     U R                  U5      (       a  g U R                  U5        U R                  R                  SU R                  -  SS/S9  U R
                  (       a  U R                  U5        g g )NzVdn: CN=TPM Devices,%s
objectClass: top
objectClass: msTPM-InformationObjectsContainer
relax:0provision:0controls)rx   r   r/   r{   r6   r2   r}   r|   s     r*   operation_78DomainUpdate.operation_78   su    b!!b!

  nn '0%?	 	 	A $$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        SnU R                  R                  U R                  U/S9  U R
                  (       a  U R                  U5        g g )NzY(OA;CIIO;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;PS)add_acesrx   r   r   update_aces_in_daclr6   r2   r}   rC   re   aces      r*   operation_79DomainUpdate.operation_79   s`    b!!b!i))$..C5)I$$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        SnU R                  R                  U R                  U/S9  U R
                  (       a  U R                  U5        g g )Nz1(OA;;CR;3e0f7e18-2c7a-4c10-ba82-4d926db99a3e;;CN)r   r   r   s      r*   operation_80DomainUpdate.operation_80  s`    b!!b!A))$..C5)I$$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        SnU R                  R                  U R                  U/S9  U R
                  (       a  U R                  U5        g g )Nz7(OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS)r   r   r   s      r*   operation_81DomainUpdate.operation_81  s`    b!!b!G))$..C5)I$$OOB %r)   c                 p   U R                  U5      (       a  g U R                  U5        [        U R                  5      n[	        U5      R                  S5      nS[        U R                  5      -  nU R                  R                  SU< SU< 3SS/S9  U R                  (       a  U R                  U5        g g )Nutf8CN=Managed Service Accounts,%sdn: z
changetype: add
objectClass: container
description: Default container for managed service accounts
showInAdvancedViewOnly: FALSE
nTSecurityDescriptor:: r   r   r   )rx   r   r   r<   r   decoderT   r6   r/   rS   r2   r}   )rC   re   
descriptormanagedservice_descrmanaged_service_dns        r*   operation_75DomainUpdate.operation_75'  s    b!!b!<T__M
(4;;FC=  	


 !34H J *3M(B 	 	D $$OOB %r)   c                 :   U R                  U5      (       a  g U R                  U5        S[        U R                  5      -  nU R                  R                  S[        U R                  5      < SU< S3SS/S9  U R                  (       a  U R                  U5        g g )Nr   r   zl
changetype: modify
add: otherWellKnownObjects
otherWellKnownObjects: B:32:1EB93889E40C45DF9F0C64D23BBB6237:
r   r   r   rx   r   rT   r6   r/   rS   r2   r}   )rC   re   r   s      r*   operation_76DomainUpdate.operation_76=  s    b!!b!=  	

 4>>.	 0 <E;H;J	 	 	K $$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        U R                  R                  S[	        U R
                  5      -  SS/S9  U R                  (       a  U R                  U5        g g )NzFdn: CN=PSPs,CN=System,%s
objectClass: top
objectClass: msImaging-PSPs
r   r   r   )rx   r   r/   r{   rT   r6   r2   r}   r|   s     r*   operation_77DomainUpdate.operation_77P  sz    b!!b!

  
$.. &/$> 	 	@
 $$OOB %r)   c                 V   U R                  U5      (       a  g U R                  U5        S[        U R                  5      -  nSnUS-  nUS-  nUS-  nUS-  nUS-  nUS-  nS	U< S
U< S3nU R                  R                  U5        U R                  (       a  U R                  U5        g g )N
CN=Keys,%szO:DAzD:z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;DA)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;DD)z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;ED)
dn: z
objectClass: container
description: Default container for key credential objects
ShowInAdvancedViewOnly: TRUE
nTSecurityDescriptor: r   )rx   r   rT   r6   r/   r{   r2   r}   )rC   re   keys_dnsddlldifs        r*   operation_82DomainUpdate.operation_82r  s    b!!b!T^^!448888888888  	

D!$$OOB %r)   c                    U R                  U5      (       a  g U R                  U5        S[        U R                  5      -  nS/nUS/-  nU R                  R                  X#S9  U R                  (       a  U R                  U5        g g )Nr   z&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;KA)&(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EK)r   )rx   r   rT   r6   r   r   r2   r}   )rC   re   r   acess       r*   operation_83DomainUpdate.operation_83  s|    b!!b!T^^!449:9::))')A$$OOB %r)   c                 <   U R                  U5      (       a  g U R                  U5        S[        U R                  5      -  nS[        U R                  5      < SU< S3nU R                  R                  U5        U R                  (       a  U R                  U5        g g )Nr   r   zl
changetype: modify
add: otherWellKnownObjects
otherWellKnownObjects: B:32:683A24E2E8164BD3AF86AC3C2CF3F981:r   r   )rC   re   r   r   s       r*   operation_84DomainUpdate.operation_84  s|    b!!b!T^^!44 4>>G% 	

t$$$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        S/nUS[        U R                  5      -  /-  nU R                  R                  U R                  US9  U R                  (       a  U R                  U5        g g )Nz5(OA;CI;RPWP;5b47d60f-6090-40b2-9f37-2a4de88f3063;;KA)z9(OA;CI;RPWP;5b47d60f-6090-40b2-9f37-2a4de88f3063;;%s-527)r   	rx   r   rT   r<   r   r   r6   r2   r}   rC   re   r   s      r*   operation_85DomainUpdate.operation_85  s    b!!b!HILT__%& ' 	' 	))$..4)H$$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        S/nUS/-  nU R                  R                  U R                  US9  U R
                  (       a  U R                  U5        g g )NzY(OA;CIIO;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;PS)zY(OA;CIIO;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;CO)r   r   r   s      r*   operation_86DomainUpdate.operation_86  so    b!!b!lmlmm))$..4)H$$OOB %r)   c                    U R                  U5      (       a  g U R                  U5        S[        U R                  5      -  /nS/nU R                  R                  U R                  UUS9  U R                  (       a  U R                  U5        g g )Nz*(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;%s-527)r   del_acesr   r   rC   re   r   r   s       r*   operation_87DomainUpdate.operation_87  s    b!!b! A() *<=))$..3;3; 	* 	= $$OOB %r)   c                 "   U R                  U5      (       a  g U R                  U5        U R                  (       a  SnOSnSU R                   SU S3nU R                  R                  U5        U R                  (       a  U R                  U5        g g )NTRUEFALSEr   zr
changetype: modify
add: msDS-ExpirePasswordsOnSmartCardOnlyAccounts
msDS-ExpirePasswordsOnSmartCardOnlyAccounts: r   )rx   r   r1   r6   r/   rS   r2   r}   )rC   re   expire_valuer   s       r*   operation_88DomainUpdate.operation_88  s    b!!b!!L"L	^^ . /;^ <	 	

t$$$OOB %r)   c                     U R                  U5      (       a  g U R                  U5        S/nS/nU R                  R                  U R                  UUS9  U R
                  (       a  U R                  U5        g g )Nr   z5(OA;CI;RPWP;5b47d60f-6090-40b2-9f37-2a4de88f3063;;EK)r   r   r   s       r*   operation_89DomainUpdate.operation_89:  su    b!!b!
 ==KL))$..3;3; 	* 	= $$OOB %r)   )r2   r3   r5   r6   r<   r>   r0   r1   rB   r/   r8   r   )FFT)NF)r   r   )r$   r%   r&   r'   __doc__rD   r]   rf   rP   rx   r}   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r(   r#   r)   r*   r,   r,   [   s    <"'"&*"OJ =A7<"5H3"(Ed 
 
 
 " , & D H * > . , > H r)   r,   )r@   base64r   sambar   samba.dcerpcr   samba.descriptorr   
samba.dsdbr   r   r	   r
   r   rO   rb   ro   rN   rQ   ri   	Exceptionr"   objectr,   r#   r)   r*   <module>r      s   &    !  

 	/...... 	/ 	/......5
> RRR"  QQR  	I 	o 6 o r)   