
    !h                     6   S r SSKrSSKrSSKrSSKrSSKrSSKJr  SSKrSSK	r	SSK
Jr  SSKJr  SSKJrJr  SSK	Jr  SSKJrJrJr  SS	KJrJrJrJr  SS
KJrJrJrJrJ r J!r!J"r"  SSK#J$r$J%r%J&r&J'r'J(r(J)r)  SSK*J+r+  SSK,J-r-  S r.S r/ " S S\R`                  5      r1 " S S\R`                  5      r2 " S S\R`                  5      r3 " S S\R`                  5      r4 " S S\R`                  5      r5 " S S\R`                  5      r6 " S S\R`                  5      r7 " S S\Rp                  5      r9 " S  S!\Rp                  5      r: " S" S#\Rp                  5      r; " S$ S%\Rp                  5      r< " S& S'\Rp                  5      r= " S( S)\Rp                  5      r> " S* S+\Rp                  5      r?S, r@S- rASKS. jrBS/ rCS0 rDS1 rES2 rFS3 rGS4 rHS5 rIS6 rJS7 rKS8 rLS9 rMS: rNS; rOS< rPS= rQS> rRS? rSS@ rTSA rUSB rVSC rWSD rXSE rYSF rZSG\(SG4SH jr[SSS\(4SI jr\  SLSJ jr]g)MzDNS-related provisioning    N)	b64encode)tdb_copy)mdb_copy)ndr_pack
ndr_unpack)
setup_file)dnspmiscsecurity)DS_DOMAIN_FUNCTION_2000DS_DOMAIN_FUNCTION_2003DS_DOMAIN_FUNCTION_2016DS_GUID_USERS_CONTAINER)get_deletedobjects_descriptorget_domain_descriptor'get_domain_delete_protected1_descriptor'get_domain_delete_protected2_descriptorget_dns_partition_descriptor'get_dns_forest_microsoft_dns_descriptor'get_dns_domain_microsoft_dns_descriptor)
setup_pathsetup_add_ldifsetup_modify_ldif	setup_ldb	FILL_FULLFILL_SUBDOMAIN)get_default_backend_store)
get_stringc                     U R                  U[        R                  S/S9n[        [	        [
        R                  US   S   S   5      5      nU$ )N
objectGUIDbasescopeattrsr   )searchldb
SCOPE_BASEstrr   r
   GUID)samdbdomaindnres
domainguids       :/usr/lib/python3/dist-packages/samba/provision/sambadns.pyget_domainguidr/   ?   sE    
,,HCNN<.,
QCZ		3q6,+?+BCDJ    c                     SU R                  [        R                  " U U5      [        5      -  nU R	                  U[        R
                  S/S9n[        [        R                  US   S   S   5      nU$ )NzCN=DnsAdmins,%s	objectSidr!   r   )	get_wellknown_dnr&   Dnr   r%   r'   r   r   dom_sid)r*   r+   base_dnr,   dnsadmins_sids        r.   get_dnsadmins_sidr8   E   sn    %"8"8,4:67N#P PG
,,G3>>+,
OCx//Q1DQ1GHMr0   c                   F   ^  \ rS rSrSS\R
                  4U 4S jjrSrU =r$ )ARecordV        c                 |   > [         TU ]  5         [        R                  U l        X@l        X l        X0l        Xl        g N)	super__init__r	   
DNS_TYPE_AwTyperankdwSerialdwTtlSecondsdata)selfip_addrserialttlrD   	__class__s        r.   rA   ARecord.__init__X   s.    __
		r0   rG   rE   rF   rD   rC   	__name__
__module____qualname____firstlineno__r	   DNS_RANK_ZONErA   __static_attributes____classcell__rL   s   @r.   r:   r:   V   s    '(c8J8J  r0   r:   c                   F   ^  \ rS rSrSS\R
                  4U 4S jjrSrU =r$ )
AAAARecorda   r<   r=   c                 |   > [         TU ]  5         [        R                  U l        X@l        X l        X0l        Xl        g r?   )	r@   rA   r	   DNS_TYPE_AAAArC   rD   rE   rF   rG   )rH   ip6_addrrJ   rK   rD   rL   s        r.   rA   AAAARecord.__init__c   s0    ''
		r0   rN   rO   rW   s   @r.   rY   rY   a   s    ()s9K9K  r0   rY   c                   F   ^  \ rS rSrSS\R
                  4U 4S jjrSrU =r$ )CNAMERecordl   r<   r=   c                 |   > [         TU ]  5         [        R                  U l        X@l        X l        X0l        Xl        g r?   )	r@   rA   r	   DNS_TYPE_CNAMErC   rD   rE   rF   rG   )rH   cnamerJ   rK   rD   rL   s        r.   rA   CNAMERecord.__init__n   s0    ((
		r0   rN   rO   rW   s   @r.   r`   r`   l   s    %&Cd6H6H  r0   r`   c                   F   ^  \ rS rSrSS\R
                  4U 4S jjrSrU =r$ )NSRecordw   r<   r=   c                 |   > [         TU ]  5         [        R                  U l        X@l        X l        X0l        Xl        g r?   )	r@   rA   r	   DNS_TYPE_NSrC   rD   rE   rF   rG   )rH   
dns_serverrJ   rK   rD   rL   s        r.   rA   NSRecord.__init__y   s0    %%
		r0   rN   rO   rW   s   @r.   rg   rg   w   s    *+4;M;M  r0   rg   c                   N   ^  \ rS rSrSSSSSS\R
                  4U 4S jjrSrU =r$ )		SOARecord   r<   r=   iX  iQ i  c
                    > [         TU ]  5         [        R                  U l        Xl        X0l        Xl        [        R                  " 5       n
X:l	        XJl
        XZl        Xjl        Xl        X*l        Xzl        Xl        g r?   )r@   rA   r	   DNS_TYPE_SOArC   rD   rE   rF   soarJ   refreshretryexpiremnamernameminimumrG   )rH   rv   rw   rJ   rs   rt   ru   rx   rK   rD   rr   rL   s              r.   rA   SOARecord.__init__   s^    &&
	hhj
	
			r0   rN   rO   rW   s   @r.   rn   rn      s#    ,-s#tD<N<N r0   rn   c                   J   ^  \ rS rSrSSSS\R
                  4U 4S jjrSrU =r$ )	SRVRecord   r   d   r<   r=   c                    > [         T	U ]  5         [        R                  U l        Xpl        XPl        X`l        [        R                  " 5       nXl	        X(l
        X8l        XHl        Xl        g r?   )r@   rA   r	   DNS_TYPE_SRVrC   rD   rE   rF   srv
nameTargetwPort	wPrioritywWeightrG   )
rH   targetportpriorityweightrJ   rK   rD   r   rL   s
            r.   rA   SRVRecord.__init__   sO    &&
	hhj	 	r0   rN   rO   rW   s   @r.   r{   r{      s    ./A3(( r0   r{   c                   F   ^  \ rS rSrSS\R
                  4U 4S jjrSrU =r$ )	TXTRecord   r<   r=   c                    > [         TU ]  5         [        R                  U l        X@l        X l        X0l        [        R                  " 5       n[        U5      Ul
        Xl        XPl        g r?   )r@   rA   r	   DNS_TYPE_TXTrC   rD   rE   rF   string_listlencountr(   rG   )rH   slistrJ   rK   rD   
stringlistrL   s         r.   rA   TXTRecord.__init__   sO    &&
	%%'
u:
	r0   rN   rO   rW   s   @r.   r   r      s    %&Cd6H6H 	 	r0   r   c                   B   ^  \ rS rSr\R
                  4U 4S jjrSrU =r$ )TypeProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g Nr<   )r@   rA   wDataLengthversionr	   DSPROPERTY_ZONE_TYPEidrG   )rH   	zone_typerL   s     r.   rA   TypeProperty.__init__   s/    ++	r0   rG   r   r   r   )	rP   rQ   rR   rS   r	   DNS_ZONE_TYPE_PRIMARYrA   rU   rV   rW   s   @r.   r   r      s    !%!;!;  r0   r   c                   B   ^  \ rS rSr\R
                  4U 4S jjrSrU =r$ )AllowUpdateProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g r   )r@   rA   r   r   r	   DSPROPERTY_ZONE_ALLOW_UPDATEr   rG   )rH   allow_updaterL   s     r.   rA   AllowUpdateProperty.__init__   s/    33 	r0   r   )	rP   rQ   rR   rS   r	   DNS_ZONE_UPDATE_SECURErA   rU   rV   rW   s   @r.   r   r      s    $($?$? ! !r0   r   c                   ,   ^  \ rS rSrSU 4S jjrSrU =r$ )SecureTimeProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g r   )r@   rA   r   r   r	   DSPROPERTY_ZONE_SECURE_TIMEr   rG   )rH   secure_timerL   s     r.   rA   SecureTimeProperty.__init__   s/    22	r0   r   r   rP   rQ   rR   rS   rA   rU   rV   rW   s   @r.   r   r      s       r0   r   c                   ,   ^  \ rS rSrSU 4S jjrSrU =r$ )NorefreshIntervalProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g r   )r@   rA   r   r   r	   "DSPROPERTY_ZONE_NOREFRESH_INTERVALr   rG   )rH   norefresh_intervalrL   s     r.   rA   "NorefreshIntervalProperty.__init__   s/    99&	r0   r   r   r   rW   s   @r.   r   r      s    ' 'r0   r   c                   ,   ^  \ rS rSrSU 4S jjrSrU =r$ )RefreshIntervalProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g r   )r@   rA   r   r   r	    DSPROPERTY_ZONE_REFRESH_INTERVALr   rG   )rH   refresh_intervalrL   s     r.   rA    RefreshIntervalProperty.__init__   s/    77$	r0   r   r   r   rW   s   @r.   r   r          % %r0   r   c                   ,   ^  \ rS rSrSU 4S jjrSrU =r$ )AgingStateProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g r   )r@   rA   r   r   r	   DSPROPERTY_ZONE_AGING_STATEr   rG   )rH   aging_enabledrL   s     r.   rA   AgingStateProperty.__init__   s/    22!	r0   r   r   r   rW   s   @r.   r   r      s    " "r0   r   c                   ,   ^  \ rS rSrSU 4S jjrSrU =r$ )AgingEnabledTimeProperty   c                 t   > [         TU ]  5         SU l        SU l        [        R
                  U l        Xl        g r   )r@   rA   r   r   r	   "DSPROPERTY_ZONE_AGING_ENABLED_TIMEr   rG   )rH   next_cycle_hoursrL   s     r.   rA   !AgingEnabledTimeProperty.__init__   s/    99$	r0   r   r   r   rW   s   @r.   r   r      r   r0   r   c                    SU-  nSU-  n[        U5      n	[        U5      n
[        U [        S5      U[	        U	5      R                  S5      S.5        U[        :w  a1  [        U [        S5      U[	        U	5      R                  S5      S.5        [        [        R                  " 5       5      n[        R                  " X5      R                  5       R                  5       n[        U5      n[        U5      n[        U [        S5      UUUUU[	        U
5      R                  S5      [	        U5      R                  S5      [	        U5      R                  S5      S.5        [!        U [        S5      UUUS	.5        U[        :w  a  [        [        R                  " 5       5      n[        R                  " X5      R                  5       R                  5       n[        U [        S5      UUUUU[	        U
5      R                  S5      [	        U5      R                  S5      [	        U5      R                  S5      S.5        [!        U [        S5      UUUS	.5        g g )
NzDC=DomainDnsZones,%szDC=ForestDnsZones,%sz"provision_dnszones_partitions.ldifutf8)ZONE_DNSECDESCzprovision_dnszones_add.ldif)r   	ZONE_GUIDZONE_DNSCONFIGDNSERVERDNDELETEDOBJECTS_DESCRIPTORLOSTANDFOUND_DESCRIPTORINFRASTRUCTURE_DESCRIPTORzprovision_dnszones_modify.ldif)r   r   r   )r   r   r   r   r   decoder   r(   uuiduuid4r&   r4   canonical_ex_strstripr   r   r   )r*   	domainsidr+   forestdnconfigdnserverdn
fill_leveldomainzone_dnforestzone_dn
descriptordeletedobjects_descdomainzone_guiddomainzone_dnsprotected1_descprotected2_descforestzone_guidforestzone_dnss                    r.   setup_dns_partitionsr      s   *X5M*X5M-i8J7	B5*%IJ Z(//7M  ^#uj)MN$ ,33F;Q
 	
 $**,'OVVE1BBDJJLN=iHO=iHO5*%BC $"%./B%C%J%J6%R#,_#=#D#DV#L%.%?%F%Fv%N	F 	 eZ(HI L  ^#djjl+5FFHNNPuj)FG$(&  )23F)G)N)Nv)V'0'A'H'H'P)2?)C)J)J6)R	J
 		 	%,L!M  $P
 	 $r0   c                 4    [        U [        S5      SU05        g )Nzprovision_dns_accounts_add.ldifDOMAINDN)r   r   )r*   r+   s     r.   add_dns_accountsr   6  s    5*%FGHJ r0   c           	      :   S[        U5      0nUSL a  [        UUS9nO
[        UUS9n[        R                  " [        R
                  " U SU< SU< 35      5      nSS/US'   [        R                  " U[        R                  S	5      US	'   U R                  U5        g )
N	DnsAdminsT)name_mapzCN=MicrosoftDNS,,top	containerobjectClassnTSecurityDescriptor)	r(   r   r   r&   Messager4   MessageElementFLAG_MOD_ADDadd)	r*   r+   prefix
domain_sidr7   forestr   sd_valmsgs	            r.   add_dns_containerr  <  s    S/0H~8BJL 9BJL ++cffUvx$PQ
RC-C63#3#31	3  
IIcNr0   c                    0 nSUS'   SUS'   SUS'   SUS'   S	US
'   SUS'   SUS'   SUS'   SUS'   SUS'   SUS'   SUS'   SUS'   0 nSUS'   SUS'   SUS'   SUS'   SUS
'   S US'   S!US'   S"US'   S#US'   S$US'   S%US'   S&US'   S'US'   S(U< S)U< 3n[         R                  " [         R                  " X5      5      n/ nUR                  [	        [        [        R                  S*95      5        UR                  [	        [        [        R                  S+95      5        UR                  [	        [        5       5      5        UR                  [	        [        5       5      5        UR                  [	        [        5       5      5        UR                  [	        [        5       5      5        UR                  [	        [        5       5      5        S,S-/US.'   [         R                  " S/[         R                   S05      US0'   [         R                  " U[         R                   S15      US1'   U R#                  U5        / nU H5  n	UR                  [	        [%        U	S2S2[        R&                  S395      5        M7     [         R                  " [         R                  " U S4U-  5      5      nS,S5/US.'   [         R                  " U[         R                   S65      US6'   U R#                  U5        U H  n	[	        [)        X9   S2S2[        R&                  S395      /n[         R                  " [         R                  " U S7U	< S)U< 35      5      nS,S5/US.'   [         R                  " U[         R                   S65      US6'   U R#                  U5        M     g )8Nz
198.41.0.4za.root-servers.netz192.228.79.201zb.root-servers.netz192.33.4.12zc.root-servers.netz199.7.91.13zd.root-servers.netz192.203.230.10ze.root-servers.netz192.5.5.241zf.root-servers.netz192.112.36.4zg.root-servers.netz198.97.190.53zh.root-servers.netz192.36.148.17zi.root-servers.netz192.58.128.30zj.root-servers.netz193.0.14.129zk.root-servers.netz199.7.83.42zl.root-servers.netz202.12.27.33zm.root-servers.netz2001:503:ba3e::2:30z2001:500:84::bz2001:500:2::cz2001:500:2d::dz2001:500:a8::ez2001:500:2f::fz2001:500:12::d0dz2001:500:1::53z2001:7fe::53z2001:503:c27::2:30z2001:7fd::1z2001:500:9f::42z2001:dc3::35z"DC=RootDNSServers,CN=MicrosoftDNS,r   )r   )r   r   dnsZoner   ZonecndNSPropertyr   )rJ   rK   rD   zDC=@,%sdnsNode	dnsRecordDC=)r&   r   r4   appendr   r   r	   DNS_ZONE_TYPE_CACHEr   DNS_ZONE_UPDATE_OFFr   r   r   r   r   r   r   r   rg   DNS_RANK_ROOT_HINTr:   )
r*   r+   r   rootserversrootservers_v6container_dnr  propsrecordrservers
             r.   add_rootserversr  M  s]   K(4K$%(8K$%(5K$%(5K$%(8K$%(5K$%(6K$%(7K$%(7K$%(7K$%(6K$%(5K$%(6K$%N+@N'(+;N'(+:N'(+;N'(+;N'(+;N'(+=N'(+;N'(+9N'(+?N'(+8N'(+<N'(+9N'(@FQL ++cffU1
2CE	LL,1I1IJKL	LL-4;S;STUV	LL,./0	LL3567	LL1345	LL,./0	LL2456+C""63+;+;TBCI++E33C3C]SC	IIcN FhxqtG^G^_`a  ++cffUI$<=
>C+C))&#2B2BKPC	IIcN 7;#7qtOfOfghi kk#&&g|(LMN#Y/M--fc6F6FTK		# r0   c                 :   U< SU< 3n/ n[        USU-  5      n	UR                  [        U	5      5        [        U5      n
UR                  [        U
5      5        Ub%  [	        U5      nUR                  [        U5      5        Ub%  [        U5      nUR                  [        U5      5        [        R                  " [        R                  " X< SU< 35      5      nSS/US'   [        R                  " U[        R                  S5      US'   U R                  U5        g )N.zhostmaster.%sr   r   r
  r   r  )rn   r  r   rg   r:   rY   r&   r   r4   r   r   r   )r*   r  r   hostname	dnsdomainhostiphostip6fqdn_hostname
at_recordsat_soa_recordat_ns_recordat_a_recordat_aaaa_recordr  s                 r.   add_at_recordr$    s    '3MJ m_y-HIMh}-. M*Lh|,-fo(;/0#G,(>23
++cffUv|$DE
FC+C))*c6F6FTC	IIcNr0   c                    [        X45      n[        R                  " [        R                  " X< SU< 35      5      nSS/US'   [        R                  " [        U5      [        R                  S5      US'   U R                  U5        g Nr   r   r
  r   r  )r{   r&   r   r4   r   r   r   r   )r*   r  r   hostr   
srv_recordr  s          r.   add_srv_recordr)    si    4&J
++cffUv|$DE
FC+C))(:*>@P@PR]^C	IIcNr0   c                    [        U5      n[        R                  " [        R                  " X< SU< 35      5      nSS/US'   [        R                  " [        U5      [        R                  S5      US'   U R                  U5        g r&  )rg   r&   r   r4   r   r   r   r   r*   r  r   r'  	ns_recordr  s         r.   add_ns_recordr-    sh    I
++cffUv|$DE
FC+C))(9*=s?O?OQ\]C	IIcNr0   c                 *   [        U[        R                  S9n[        R                  " [        R
                  " X< SU< 35      5      nSS/US'   [        R                  " [        U5      [        R                  S5      US'   U R                  U5        g )N)rD   r   r   r
  r   r  )
rg   r	   DNS_RANK_NS_GLUEr&   r   r4   r   r   r   r   r+  s         r.   add_ns_glue_recordr0    sq    D$9$9:I
++cffUv|$DE
FC+C))(9*=s?O?OQ\]C	IIcNr0   c                    [        U5      n[        R                  " [        R                  " X< SU< 35      5      nSS/US'   [        R                  " [        U5      [        R                  S5      US'   U R                  U5        g r&  )r`   r&   r   r4   r   r   r   r   )r*   r  r   r'  cname_recordr  s         r.   add_cname_recordr3    si    t$L
++cffUv|$DE
FC+C))(<*@#BRBRT_`C	IIcNr0   c                    / nU(       a%  [        U5      nUR                  [        U5      5        U(       a%  [        U5      nUR                  [        U5      5        U(       as  [        R
                  " [        R                  " X< SU< 35      5      nSS/US'   [        R                  " U[        R                  S5      US'   U R                  U5        g g r&  )
r:   r  r   rY   r&   r   r4   r   r   r   )	r*   r  r   r  r  host_recordsa_recordaaaa_recordr  s	            r.   add_host_recordr8    s    L6?HX./ )H[12kk#&&6<(HIJ#Y/M--lC<L<LkZK		#	 r0   c                 |   SU-  n[         R                  R                  Xd5      n/ nUR                  [	        [        5       5      5        UR                  [	        [        5       5      5        UR                  [	        [        5       5      5        UR                  [	        [        SS95      5        UR                  [	        [        SS95      5        UR                  [	        [        5       5      5        UR                  [	        [        5       5      5        [        R                  " [        R                  " U SU< SU< SU< 35      5      n	SS	/U	S
'   [        R                  " [	        U5      [        R                   S5      U	S'   [        R                  " U[        R                   S5      U	S'   U R#                  U	5        g )Na{  O:SYG:BAD:AI(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;CC;;;AU)(A;;RPLCLORC;;;WD)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CI;RPWPCRCCDCLCRCWOWDSDDTSW;;;ED)(A;CIID;RPWPCRCCDCLCRCWOWDSDDTSW;;;%s)(A;CIID;RPWPCRCCDCLCRCWOWDSDDTSW;;;ED)(OA;CIID;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)(A;CIID;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;CIID;LC;;;RU)(A;CIID;RPWPCRCCLCLORCWOWDSDSW;;;BA)S:AI   )r   )r   r  ,CN=MicrosoftDNS,r   r   r  r   r   ntSecurityDescriptorr	  )r   r   	from_sddlr  r   r   r   r   r   r   r   r   r&   r   r4   r   r   r   )
r*   r+   r   r  r   r7   sddlsecr  r  s
             r.   add_domain_recordr@    sM    D 


'
'
8CE	LL,.)*	LL-/01	LL,./0	LL3sKLM	LL13GHI	LL,./0	LL2456
++cffUYPVX`$ab
cC+C8C=++1	3  ++E33C3C]SC	IIcNr0   c                     [         R                  " [         R                  " U SU< SU< SU< 35      5      nSS/US'   U R                  U5        g )N
DC=_msdcs.r;  r   r   r  r   )r&   r   r4   r   )r*   r   r   	dnsforestr  s        r.   add_msdcs_recordrD    sF    
++cffU%.%B C DC+C	IIcNr0   c           	      v   U< SU< 3n[         R                  " U SU< SU< SU< 35      n	[        X	SXTXg5        [        X	SU-  UU5        [	        X	SUS5        [	        X	S	U-  US5        [	        X	S
US5        [	        X	SUS5        [	        X	SUS5        [	        X	SUS5        [	        X	SU-  US5        [	        X	SUS5        [	        X	SU-  US5        [        X	SU5        [	        X	SU-  US5        [	        X	SU-  US5        [	        X	SUS5        [	        X	SUS5        [        X	SUU5        [        X	SUU5        g )Nr  r  r;  r   DC=@DC=%szDC=_kerberos._tcpX   zDC=_kerberos._tcp.%s._siteszDC=_kerberos._udpzDC=_kpasswd._tcpi  zDC=_kpasswd._udpzDC=_ldap._tcp  zDC=_ldap._tcp.%s._siteszDC=_gc._tcp  zDC=_gc._tcp.%s._sitesz	DC=_msdcsz&DC=_ldap._tcp.%s._sites.DomainDnsZonesz&DC=_ldap._tcp.%s._sites.ForestDnsZoneszDC=_ldap._tcp.DomainDnsZoneszDC=_ldap._tcp.ForestDnsZonesDC=DomainDnsZonesDC=ForestDnsZones)r&   r4   r$  r8  r)  r0  )
r*   r+   r   siter  r  r  r  r  domain_container_dns
             r.   add_dc_domain_recordsrO    s     (3M &&"+VX)? @ %fh# E(0BF 5/B "& 5/L0&, 5/B "& 5/A #' 5/A #' 5 5/H0&- 5}m 5/F/M $( u;N 5;dBM
 5;dBM
 5/M #' 5/M #' E0CV E0CVr0   c
           	         U< SU< 3n
[         R                  " U SU< SU< SU< 35      n[        XSXTS S 5        [        XSU
S5        [        XSU-  U
S5        [        XS	U
S
5        [        XSU-  U
S
5        [        XSU-  U
S5        [        XSU
S5        [        XSU
S
5        [	        XSXg5        [        XSU-  U
S
5        [        XSU	-  U
5        g )Nr  rB  r;  r   rF  zDC=_kerberos._tcp.dcrH  zDC=_kerberos._tcp.%s._sites.dczDC=_ldap._tcp.dcrI  zDC=_ldap._tcp.%s._sites.dczDC=_ldap._tcp.%s._sites.gcrJ  zDC=_ldap._tcp.gczDC=_ldap._tcp.pdczDC=gczDC=_ldap._tcp.%s.domainsrG  )r&   r4   r$  r)  r8  r3  )r*   r   r   rM  rC  r  r  r  r-   ntdsguidr  forest_container_dns               r.   add_dc_msdcs_recordsrS  h  s!     (3M &&"+VX)? @ %fh 5/E "& 53d:M2O 5/A #' 5/K0&- 5/K0&. 5/A $( 5/B #' EI 5-
:M3P U81C"$r0   c	                     [         R                  " [         R                  R                  X&5      5        [         R                  " [         R                  R                  X65      5        Uc  Sn[        U [        S5      UUU[        UR                  S5      5      R                  S5      [        U5      UR                  UR                  R                  5       < SUR                  R                  5       < 3S.5        g! [         a     Nf = f)zAdd DNS specific bits to a secrets database.

:param secretsdb: Ldb Handle to the secrets database
:param names: Names shortcut
:param machinepass: Machine password
Nr<   zsecrets_dns.ldifzutf-8r   r  )REALM	DNSDOMAIN
DNS_KEYTABDNSPASS_B64KEY_VERSION_NUMBERHOSTNAMEDNSNAME)osunlinkpathjoinOSErrorr   r   r   encoder   r(   r  netbiosnamelowerr  )		secretsdbnamesprivate_dirbinddns_dirrealmr  dns_keytab_pathdnspasskey_version_numbers	            r.   secretsdb_setup_dnsrl    s    
		"'',,{<=
		"'',,{<= ! i$67")$W^^G%<=DDVL"%&8"9!!'')5??+@+@+BD	: 	  s   A&C= =
D
	D
c                    [         R                  R                  UR                  5      n [        R
                  " US5        [         R                  " US5        UR                  b;   [         R                  " USUR                  5        [         R                  " US5        gg! [         a     Nlf = f! [         a8    S[         R                  ;  a!  U R                  SX!R                  4-  5         g gf = f)zl(Re)create the DNS directory and chown it to bind.

:param logger: Logger object
:param paths: paths object
T  NSAMBA_SELFTEST!Failed to chown %s to bind gid %u)r\  r^  dirnamednsshutilrmtreer`  mkdirbind_gidchownchmodenvironerror)loggerpathsdns_dirs      r.   create_dns_dirr    s     ggooeii(Ggt$ HHWe~~!	.HHWb%..1HHWe$	 "    	.rzz1@^^D- - . 2	.s#   B" '9B2 "
B/.B/2=C43C4c           	         [         R                  R                  UR                  UR                  5      n[         R                  R                  UR
                  UR                  5      n[         R                  R                  U5      (       a  [         R                  R                  U5      (       a   [         R                  " U5         [         R                  " X#5        UR                  b   [         R                  " UR
                  S5        [         R                  " UR
                  SUR                  5         [         R                  " US
5        [         R                  " USUR                  5        ggg! [         a-  nU R                  SU< SUR                  < 35         SnANSnAff = f! [         a2  nU R                  SU< SU< SUR                  < 35         SnAGN	SnAff = f! [         a>    S[         R                  ;  a'  U R!                  S	UR
                  UR                  5         Nf = f! [         a5    S[         R                  ;  a  U R!                  S	X1R                  5         g gf = f)z\Create link for BIND to DNS keytab

:param logger: Logger object
:param paths: paths object
zFailed to remove z: NzFailed to create link z -> rn  ro  rp  rq  i  )r\  r^  r_  rf  
dns_keytabrg  isfiler]  r`  r{  strerrorlinkrw  ry  rx  rz  info)r|  r}  private_dns_keytab_pathbind_dns_keytab_pathes        r.   create_dns_dir_keytab_linkr    s    !ggll5+<+<e>N>NO77<<(9(95;K;KL	ww~~-..77>>.//A		./	VGG+B >>%C**E2**B?
F-u5-r5>>B &! /  A2AJJ@ A AA  	VLL13GU V V	V  C#2::5KK C % 1 15>>CC  F#2::5KK C 4nnF 6FsV   2E7 	F1 -AG0 ;9H; 7
F.#F))F.1
G-;'G((G-0AH87H8;:I:9I:c
                 ~   [        U[        5      (       d   eUb  SU-   n
US-   U-   nSU-   nOSn
SnSnUb  SU-   nUS-   U-   nSU-   nOSnSnSn[        [        S	5      UR                  UUUUUU[
        R                  " S
5      U	UU
UUUS.5        UR                  bO   [        R                  " UR                  SUR                  5        [        R                  " UR                  S5        gg! [         aC    S[        R                  ;  a,  U R                  SUR                  UR                  4-  5         g gf = f)ap  Write out a DNS zone file, from the info in the current database.

:param paths: paths object
:param dnsdomain: DNS Domain name
:param domaindn: DN of the Domain
:param hostip: Local IPv4 IP
:param hostip6: Local IPv6 IP
:param hostname: Local hostname
:param realm: Realm name
:param domainguid: GUID of the domain.
:param ntdsguid: GUID of the hosts nTDSDSA record.
Nz            IN AAAA    z        IN AAAA    z#gc._msdcs               IN AAAA     z            IN A    z        IN A    z gc._msdcs               IN A    zprovision.zonez%Y%m%d%H)rZ  rV  rU  HOSTIP_BASE_LINEHOSTIP_HOST_LINE
DOMAINGUID
DATESTRINGDEFAULTSITENTDSGUIDHOSTIP6_BASE_LINEHOSTIP6_HOST_LINEGC_MSDCS_IP_LINEGC_MSDCS_IP6_LINEro  i  rp  rq  )
isinstancer(   r   r   rs  timestrftimerw  r\  rx  ry  r`  rz  r{  )r|  r}  r  r  r  r  rh  r-   rQ  rM  hostip6_base_linehostip6_host_linegc_msdcs_ip6_linehostip_base_linehostip_host_linegc_msdcs_ip_lines                   r.   create_zone_filer     si    j#&&&&5?$'<<wFAGK1F:#&886A=Fz*+UYY " 0 0$--
3 !2!2 0!29   ~~!	0HHUYYENN3HHUYY&	 "
  	0rzz1@IIu~~D/ / 0 2	0s    AC/ /AD<;D<c           	      *   UR                   n[        R                  R                  US5      n[        R                  R	                  UR
                  5      n[        R                  R                  US5      n	0 n
U R                  S[        R                  SS/S9nUS   S    H1  n[        U5      R                  S5      u  pXUR                  5       '   M3     [        5       nSUS   ;   a  [        US   S   S   5      nUR                  R                  5       n[        R                  R                  XU   5      n [        R                  " U	5        [        US5      R!                  5         U< S	U< 3n["        R$                  " U5      nU R                  S
[        R                  S9nUR'                  US   5        SU-  n[)        [+        U5      5      R-                  S5      n[/        U[1        S5      UR                  U[        U5      US.5        [/        U[1        S5      S5        U
U	 SUR                  R                  5       -  nSUR6                  R                  5       -  nU
U   nU
R9                  U5      nSn [        R:                  " [        R                  R                  UU5      [        R                  R                  U	U5      5        [        R:                  " [        R                  R                  UU5      [        R                  R                  UU5      5        US:X  aY  [        R:                  " [        R                  R                  UUS-   5      [        R                  R                  UUS-   5      5        U(       a  [        R:                  " [        R                  R                  UU5      [        R                  R                  UU5      5        US:X  aY  [        R:                  " [        R                  R                  UUS-   5      [        R                  R                  UUS-   5      5        U
U	 U(       a  U
U	  [?        [        R                  R                  US5      [        R                  R                  US5      5        U
 H  nX   nUS:X  aJ  [A        [        R                  R                  UU5      [        R                  R                  UU5      5        MW  [?        [        R                  R                  UU5      [        R                  R                  UU5      5        M     URB                  b   [        RD                  " U5       H  u  nnn U H\  n![        R                  R                  UU!5      n"[        RF                  " U"SURB                  5        [        RH                  " U"S5        M^     U  Ht  n#U#RK                  S5      (       d  M  [        R                  R                  UU#5      n$[        RF                  " U$SURB                  5        [        RH                  " U$S5        Mv     M     gS[        RL                  ;  a  URO                  S5        gg! [2         a  nUR5                  SU 35        e SnAff = f! [<         a  nUR5                  SU 35        e SnAff = f! [2         a  nUR5                  SU 35        e SnAff = f! [<         a*    S[        RL                  ;  a  UR5                  S5         g gf = f) zRCreate a copy of samdb and give write permissions to named for dns partitions
    z	sam.ldb.dz
@PARTITION	partitionbackendStorer!   r   :wz://z
@INDEXLIST)r"   r#   zobjectGUID: %s
-r   zprovision_basedn.ldif)r   r  	DOMAINSID
DESCRIPTORzprovision_basedn_options.ldifNz@Failed to setup database for BIND, AD based DNS cannot be used: zDC=DOMAINDNSZONES,%szDC=FORESTDNSZONES,%szmetadata.tdbmdbz-lockzsam.ldbro  rn  )z.ldbz.tdbzldb-locki  rp  z9Failed to set permissions to sam.ldb* files, fix manuallyz\Unable to find group id for BIND,
                set permissions to sam.ldb* files manually)(rf  r\  r^  r_  rr  rs  r%   r&   r'   r(   splitupperr   r+   rv  openclosesambaLdbr   r   r   r   r   r   	Exceptionr{  rootdngetr  r`  r   r   rw  walkrx  ry  endswithrz  warning)%r*   r|  r}  re  r   r-   rf  
samldb_dirr~  dns_samldb_dirpartfiler,   tmpncfnamebackend_storer+   domainpart_filedom_urldom_ldb	index_resdomainguid_linedescrerrdomainzonednforestzonedndomainzone_fileforestzone_filemetadata_filepfilerr  dirsfilesddpathffpaths%                                        r.   create_samdb_copyr  >  s    ##Kk;7Jggooeii(GWW\\';7N H
,,L ^^)>:  <C 1vk"#hnnS)$ # ./MQCF>2156 ~~##%Hggll7X,>?O
 _c"((*  -o>))G$ LLl#..LI	IaL!-
:/	:;BB6Jw
+B C)Y	F! 	"
 	w!"ABD	J 	 *ENN,@,@,BBL)ELL,>,>,@@L|,Oll<0O"M
Z7^];	=
[/:Wo6	8E! GGBGGLLo.GHGGLL/G*CDFGGBGGLLo>GGLL/:<% [/G2KLWo.GHJ 	\"k95gy1	3BLE%k59gu57 k59gu57  ~~!	Q(*(8$uAGGLL!4EHHUB7HHUE*  Azz">?? "Wa 8ENN;.	  )9 2::-NN > ? .i  NseT	VP  NseT	V*  NseT	V$  	Qrzz1OQ 2	Qse   :C-Y) =F>Z 	C-Z7 B[  A![ )
Z3ZZ
Z4Z//Z47
[[[/\\c                     [        [        S5      U R                  S5        [        [        S5      U R                  S5        g)z Write out a dns_update_list filedns_update_listNspn_update_list)r   r   r  r  )r}  s    r.   create_dns_update_listr    s4     z+,e.C.CTJz+,e.C.CTJr0   c                    SSK Jn  US:X  a  [        [        S5      U R                  UUU R
                  SSR                  UR                  S5      SS 5      -   U R                  U R                  S	.5        [        [        S
5      U R                  5        gUS:X  Ga  [        R                  " S/S[        R                  [        R                  SS9R                  5       S   n[        U5      nSnSnSn	Sn
SnSnSnSnUR                  5       R!                  S5      S:w  a  SnGOUR                  5       R!                  S5      S:w  a  SnGOUR                  5       R!                  S5      S:w  a  Sn	GOUR                  5       R!                  S5      S:w  a  Sn
GOUR                  5       R!                  S5      S:w  a  SnGOaUR                  5       R!                  S5      S:w  a  SnGO:UR                  5       R!                  S5      S:w  a  SnGOUR                  5       R!                  S5      S:w  d#  UR                  5       R!                  S5      S:w  a  SnOUR                  5       R!                  S5      S:w  a  U" S5      eUR                  5       R!                  S5      S:w  a  U" S5      eUR                  5       R!                  S5      S:w  a  U" S5      eUR                  5       R!                  S 5      S:w  a  U" S5      eUR#                  S!U R                  -  5        [        [        S"5      U R                  U R                  [$        R&                  R)                  5       UUU	U
UUUUS#.
5        gg)$aC  Write out a file containing zone statements suitable for inclusion in a
named.conf file (including GSS-TSIG configuration).

:param paths: all paths
:param realm: Realm name
:param dnsdomain: DNS Domain name
:param dns_backend: DNS backend type
:param keytab_name: File name of DNS keytab file
:param logger: Logger object
r   )ProvisioningErrorBIND9_FLATFILEz
named.confz*.r  r<   N)rV  rU  	ZONE_FILEREALM_WC
NAMED_CONFNAMED_CONF_UPDATEznamed.conf.update	BIND9_DLZznamed -VT)shellstdoutstderrcwd#zBIND 9.8ro  r  zBIND 9.9z	BIND 9.10z	BIND 9.11z	BIND 9.12z	BIND 9.14z	BIND 9.16z	BIND 9.18z	BIND 9.20zBIND 9.7z&DLZ option incompatible with BIND 9.7.z	BIND_9.13z/Only stable/esv releases of BIND are supported.z	BIND_9.15z	BIND_9.17z0BIND version unknown, please modify %s manually.znamed.conf.dlz)
r  
MODULESDIRBIND9_8BIND9_9BIND9_10BIND9_11BIND9_12BIND9_14BIND9_16BIND9_18)samba.provisionr  r   r   	namedconfrs  r_  r  namedconf_update
subprocessPopenPIPESTDOUTcommunicater   r  findr  r  parammodules_dir)r}  rh  r  dns_backendr|  r  	bind_infobind9_8bind9_9bind9_10bind9_11bind9_12bind9_14bind9_16bind9_18s                  r.   create_named_confr    s	   " 2&&:l+U__!*"!& $sxxC0@0D'E E"'//).)?)?? 	 	:12E4J4JK		#$$j\,6OO,6,=,=),. /:kmA?	 y)	??!!*-3G__##J/25G__##K0B6H__##K0B6H__##K0B6H__##K0B6H__##K0B6H__##K0B6__##K0B6H__##J/25#$LMM__##K0B6#$UVV__##K0B6#$UVV__##K0B6#$UVVNNMPUP_P__`:./"'//"'++"9"9";&& ( ( ( ( ( (C 	S 
$r0   c                 x    [        [        S5      U UUUU[        R                  R	                  XE5      US.5        g)aF  Write out a file containing zone statements suitable for inclusion in a
named.conf file (including GSS-TSIG configuration).

:param path: Path of the new named.conf file.
:param realm: Realm name
:param dnsdomain: DNS Domain name
:param binddns_dir: Path to bind dns directory
:param keytab_name: File name of DNS keytab file
z	named.txt)rV  r[  rU  rW  DNS_KEYTAB_ABSPRIVATE_DIRN)r   r   r\  r^  r_  )r^  rh  r  dnsnamerg  keytab_names         r.   create_named_txtr  $  s9     z+&"% ggll;D&/ r0   c                     U S;   $ )N)r  r  SAMBA_INTERNALNONE )r  s    r.   is_valid_dns_backendr	  9  s    SSSr0   c                 <    [         U s=:*  =(       a	    [        :*  $ s  $ r?   )r   r   )os_levels    r.   is_valid_os_levelr  =  s    "hII2IIIIIr0   c                 6    [        XSX5        [        XS5        g Nz	CN=System)r  r  )r*   r   r   r7   s       r.   create_dns_legacyr  A  s    e{IME[1r0   c	           
      >    [        XSX1U5        [        XSXCXVU5        g r  )r@  rO  )	r*   r   r   r  rM  r  r  r  r7   s	            r.   fill_dns_data_legacyr  H  s*     e{I#% %;"G5r0   c           	          [        XX4UR                  UR                  U5        [        XSUU5        U[        :w  a  [        XSUUSS9  g g )NrK  rL  T)r  )r   r   r   r  r   )r*   r   re  r+   r   r7   r   s          r.   create_dns_partitionsr  S  sU     8E e':I#%^#%+>	'	6 $r0   Tc                     U(       a  [        XS5        [        XSUX5        U(       a  [        XSUXWX5        U[        :w  a&  [	        XSU5        U(       a  [        XSUXgXX5
        ggg)aR  Fill data in various AD partitions

:param samdb: LDB object connected to sam.ldb file
:param domainsid: Domain SID (as dom_sid object)
:param site: Site name to create hostnames in
:param domaindn: DN of the domain
:param forestdn: DN of the forest
:param dnsdomain: DNS name of the domain
:param dnsforest: DNS name of the forest
:param hostname: Host name of this DC
:param hostip: IPv4 addresses
:param hostip6: IPv6 addresses
:param domainguid: Domain GUID
:param ntdsguid: NTDS GUID
:param dnsadmins_sid: SID for DnsAdmins group
:param autofill: Create DNS records (using fixed template)
rK  rL  N)r  r@  rO  r   rD  rS  )r*   r   rM  r+   r   r  rC  r  r  r  r-   rQ  r7   autofillr   add_roots                   r.   fill_dns_data_partitionsr  a  s    0 )<= e':I0 e/BD'6	D ^# 	*=yI  2Et!*f!+7  $r0   c                 `   [        U5      (       d  [        SU-  5      e[        U5      (       d  [        SU-  5      eUS:X  a  UR                  S5        gUR                  S5        [	        XR
                  5        UR
                  nU R                  5       R                  5       nUR                  R                  5       nUnUR                  nUR                  R                  5       n[        X5      n[        X5      nU R                  5          UR                  SU-  5        [        XR                   UU5        U["        :X  a/  UR                  SU-  5        [%        XR                   XUUXU5	        OqUS	;   ak  U[&        :  aa  UR                  S
5        [)        XR                   X+UUU
5        UR                  S5        [+        XR                   XUXUXUUR,                  UU
S9  U R/                  5         UR3                  S5      (       a  [5        XX#UXVXUU	S9  gg!   U R1                  5         e = f)a  Provision DNS information (assuming GC role)

:param samdb: LDB object connected to sam.ldb file
:param secretsdb: LDB object connected to secrets.ldb file
:param names: Names shortcut
:param paths: Paths shortcut
:param logger: Logger object
:param dns_backend: Type of DNS backend
:param os_level: Functional level (treated as os level)
:param dnspass: Password for bind's DNS account
:param hostip: IPv4 address
:param hostip6: IPv6 address
Invalid dns backend: %rInvalid os level: %rr  z'No DNS backend set, not configuring DNSNzAdding DNS accountsz%Creating CN=MicrosoftDNS,CN=System,%sz'Populating CN=MicrosoftDNS,CN=System,%s)r  r  z5Creating DomainDnsZones and ForestDnsZones partitionsz7Populating DomainDnsZones and ForestDnsZones partitions)r   BIND9_)rM  rj  r  r  )r	  r  r  r  r   r+   get_root_basednget_linearizedr  rc  sitenamerb  r8   r/   transaction_startr  r   r   r  r   r  r  rQ  transaction_committransaction_cancel
startswithsetup_bind9_dns)r*   rd  re  r}  r|  r  r  rj  r  r  r   r+   r   r  rC  rM  r  r7   r-   s                      r.   setup_ad_dnsr$    s   "  ,,1K?@@X&&.9::f=> KK%&UNN+" ~~H$$&557H%%'II>>D  &&(H%e6M0J	#;hFG%(MJ..KKAHLM d!)6MK ;;33 KKOP!%%8"/= KKQR$UOOTX%.8V%/0:< 	  "h''%#DRX '	) (  "s   CH H-c                    [        U5      (       a  UR                  S5      (       d  [        SU-  5      e[        U5      (       d  [        SU-  5      eUR                  n[        X5      n[        XUR                  UR                  UR                  UR                  UR                  UUS9	  [        XC5        [        XC5        US:X  a8  [        XCUUR                  U	XR                  UR                  UUR                   S9
  US:X  a"  U["        :  a  [%        XUX"R&                  U5        [)        X2R                  UR                  UUS9  [+        UR,                  UR                  UR                  UR                  < S	UR                  < 3UR                  UR                  S
9  UR/                  SUR0                  5        UR/                  SUR,                  5        g)a  Provision DNS information (assuming BIND9 backend in DC role)

:param samdb: LDB object connected to sam.ldb file
:param secretsdb: LDB object connected to secrets.ldb file
:param names: Names shortcut
:param paths: Paths shortcut
:param logger: Logger object
:param dns_backend: Type of DNS backend
:param os_level: Functional level (treated as os level)
:param site: Site to create hostnames in
:param dnspass: Password for bind's DNS account
:param hostip: IPv4 address
:param hostip6: IPv6 address
r  r  r  )rh  r  ri  rj  rk  r  )rM  r  r  r  r  rh  r-   rQ  r  )rh  r  r  r|  r  )rh  r  r  rg  r  z9See %s for an example configuration include file for BINDz@and %s for further documentation required for secure DNS updatesN)r	  r"  r  r  r+   r/   rl  rf  rg  rh  r  r  r  r  r  r  rQ  r   r  r   r  r  namedtxtr  r  )r*   rd  re  r}  r|  r  r  rM  rj  r  r  rk  r+   r-   s                 r.   r#  r#    s   $ !--""8,,1K?@@X&&.9::~~H0J	))))#kk"'//(-(8(8'+=? 6!v-&&T#(??6!(>>${{z"'..		2 k!h2I&I%*	> e;; %[#% U^^ ;;%//(-H!&!2!2!&!1!1	3
 KKK!
KK  >>+r0   )F)NNNNN)^__doc__r\  r   rt  r  r&   base64r   r  r  samba.tdb_utilr   samba.mdb_utilr   	samba.ndrr   r   r   samba.dcerpcr	   r
   r   
samba.dsdbr   r   r   r   samba.descriptorr   r   r   r   r   r   r   samba.provision.commonr   r   r   r   r   r   samba.samdbr   samba.commonr   r/   r8   DnssrvRpcRecordr:   rY   r`   rg   rn   r{   r   DnsPropertyr   r   r   r   r   r   r   r   r   r  r  r$  r)  r-  r0  r3  r8  r@  rD  rO  rS  rl  r  r  r  r  r  r  r  r	  r  r  r  r  r  r$  r#  r  r0   r.   <module>r4     s1  *  	    
    # # *  - -     2 #"d"" %% $&& t## $$ ($$ "$$ 4## !$** ! ))  ' 0 0 '%d.. %")) "%t// %8v"DN<DZz2$j>.4'FT;0|E?PKSl*TJ256  LP(1D-7b 15T4%_)F LP59?+r0   