
    g=                    :   S r SSKJr  SSKJr  SSKJrJrJrJ	r	  SSK
r
SSKrSSKrSSKJrJr  SSKJrJrJrJrJrJrJrJr  SSKJrJr  SS	KJrJrJrJrJ r J!r!  SS
K"J#r#  SSK$J%r%  SSKJ&r&  SSK'J(r(  SSK)J*r*  SSKJ+r+  SSKJ,r,  SSK-J.r.  SSKJ/r/J0r0  SSKJ1r1  SSK2J3r3J4r4J5r5  SSK6r6SSK7r7SSK8r8SSK9r9SSK:r:SSK;J<r<  SSK=J>r>  SSK?J@r@  SSKJArAJBrB   " S S\C5      rD " S S\E5      rF      S$S jrG      S$S jrH    S%S jrI " S  S!\F5      rJ " S" S#\J5      rKg)&zJoining a domain.    )system_session)SamDB)gensecLdb	drs_utilsarcfour_encryptN)ndr_pack
ndr_unpack)securitydrsuapimiscnbtlsadrsblobs	dnsserverdnsp)CredentialsDONT_USE_KERBEROS)secretsdb_self_join	provisionprovision_fillFILL_DRSFILL_SUBDOMAINDEFAULTSITE)
setup_path)Schema)
descriptor)Net)setup_bind9_dns)read_and_sub_file)werror)	b64encode)WERRORErrorNTSTATUSError)sd_utils)ARecord
AAAARecordCNAMERecord)OrderedDict)
get_string)CommandError)dsdbfunctional_levelc                   (   ^  \ rS rSrU 4S jrSrU =r$ )DCJoinException6   c                 *   > [         TU ]  SU-  5        g )NzCan't join, error: %s)super__init__)selfmsg	__class__s     ,/usr/lib/python3/dist-packages/samba/join.pyr3   DCJoinException.__init__8   s    0367     )__name__
__module____qualname____firstlineno__r3   __static_attributes____classcell__r6   s   @r7   r/   r/   6   s    8 8r9   r/   c                      \ rS rSrSr       S'S jrS(S jrS(S jrS(S jrS r	S	 r
S
 rS rS rS rS rS rS rS rS rS rS rS rS rS rS)S jrS rS rS rS rS rS rS r S  r!S! r"S" r#S# r$S$ r%S% r&S&r'g)*DCJoinContext<   zPerform a DC join.Nc                 V   Xl         X0l        X@l        XPl        Xpl        Xl        Xl        Xl        Xl        Xl	        S U l
        / U l        / U l        U R                  R                  UR                  5       [        R                   -  5        [#        U R                  U R                  S9U l        X l        UU l        U(       a#  UU l        U R*                  R,                  U l        OU R&                  (       a$  Uc   U R/                  U R&                  5      U l        O\U R                   R1                  SU-  5        U R3                  U5      U l        U R                   R1                  SU R&                  -  5        [5        SU R&                  -  [7        5       U R                  U R                  S9U l        U R                  c  [8        U l         U R*                  R;                  [<        R>                  / S9  [G        U R*                  RI                  5       5      U l%        [G        U R*                  RM                  5       5      U l'        [G        U R*                  RQ                  5       5      U l)        [G        U R*                  RU                  5       5      U l+        [X        RZ                  " U R*                  R]                  5       5      U l/        U R^                  U l0        U Rc                  5       U l2        U Rg                  5       U l4        [j        Rl                  " [G        [n        Rp                  " 5       5      5      U l9        U R*                  Ru                  5       U l;        U Ry                  5       U l=        U R}                  5       U l?        U	b  Xl@        O[        R                  " SS5      U l@        U R*                  R                  5       U lD        U(       Ga  X`lE        SU R                  -  U lF        S	U R                  < S
U R                  < SU RV                  < 3U lG        SU R                  -  U lH        S	U R                  < SU RJ                  < 3U lI        U R                  R                  5       < SU R                  < 3U lK        U R*                  R                  5       U lM        SU RJ                  -  nU R                  U5      (       a  S	U R                  < SU< 3U lO        OS U lO        SU R                  -  SU R                  -  SU R                  < SU R                  < 3/U lP        U R*                  R;                  [<        R>                  S/U RJ                  S9nUS   S   S   U lQ        SU RJ                  -  U lR        SU RN                  -  U lS        S[<        R                  " U R                  5      -  nU R*                  R;                  [<        R                  / U R*                  R                  5       US9nUc  SU lW        O([        U5      S:X  a  SU lW        [        S5        OXlW        U R                  U lZ        S U l[        [        R                  [        R                  -  [        R                  -  [        R                  -  [        R                  -  U lb        S U lc        S U ld        S U le        SU lf        S U lg        S U l\        S U lh        SU li        S U lj        S U lk        S U ll        S U lm        SU ln        g ! [<        R@                   a  nURB                  u  nn[E        U5      eS nAff = f)N)credslpz&Finding a writeable DC for domain '%s'zFound DC %s	ldap://%surlsession_infocredentialsrG   scopeattrsx   %s$CN=z,CN=Servers,CN=z
,CN=Sites,zCN=NTDS Settings,%sz,OU=Domain Controllers,.zGCN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,%s,zHOST/%szGC//rIDManagerReference)rN   rO   baser   zDC=DomainDnsZones,%szDC=ForestDnsZones,%s$(&(objectClass=crossRef)(ncName=%s))rN   rO   rW   
expressionNONEzCNO DNS zone information found in source domain, not replicating DNSF)ologgerrF   rG   site	targetdir	use_ntvfsplaintext_secretsbackend_storebackend_store_sizepromote_existingpromote_from_dnnc_listfull_nc_listset_gensec_featuresget_gensec_featuresr   FEATURE_SEALr   netserverforced_local_samdbsamdbrJ   find_dc_siteinfofind_dcr   r   r   searchldb
SCOPE_BASELdbErrorargsr/   strget_default_basednbase_dnget_root_basednroot_dnget_schema_basedn	schema_dnget_config_basedn	config_dnr   dom_sidget_domain_siddomsid	forestsidget_domain_namedomain_nameget_forest_domain_nameforest_domain_namer   GUIDuuiduuid4invocation_idget_dsServiceName
dc_ntds_dnget_dnsHostNamedc_dnsHostNameget_behavior_versionbehavior_version	acct_passsamba generate_random_machine_passworddomain_dns_name	dnsdomainmynamesamname	server_dnntds_dnacct_dnlowerdnshostnameforest_dns_name	dnsforest	dn_existstopology_dnSPNsrid_manager_dndomaindns_zoneforestdns_zonebinary_encodeSCOPE_ONELEVELget_partitions_dndns_backendlenprintrealm	tmp_samdbr   DRSUAPI_DRS_INIT_SYNCDRSUAPI_DRS_PER_SYNCDRSUAPI_DRS_GET_ANCDRSUAPI_DRS_GET_NC_SIZEDRSUAPI_DRS_NEVER_SYNCEDreplica_flagsnever_reveal_sid
reveal_sidconnection_dnRODC	krbtgt_dn	managedby	subdomain	adminpasspartition_dndns_a_dndns_cname_dnforce_all_ips)ctxr\   rk   rF   rG   r]   netbios_namer^   domainmachinepassr_   r   rc   r`   ra   rb   rl   eenumestrtopology_baseres_rid_managerexprres_domaindnss                           r7   r3   DCJoinContext.__init__?   s    
	!! 1)!3/"		%%e&?&?&AFDWDW&WXCII#&&1
!3*CICJzz<"//

;CH 

 H6 QR [[0




 :;+

":+9+;*-))@CI 88"CH	(II3>><
 #))6689#))3356CII779:CII779:%%cii&>&>&@A


--/!$!;!;!= IIc$**,&78446 002"779"'M!BB3LCM		113 %J#**,CKDGJJPSPXPXZ]ZgZghCM/#--?CK>Ajj#++VCK),)9)9);S]]KCOII557CMehkhshssM}}]++03

M"J"&!CJJ.!COO3&)oos}}EGCH "ii..S^^6K5L47KK / AO "1!34I!J1!MC3ckkA3ckkA58I8I#J\J\8]]		((s/A/A/1.1ii.I.I.K48 ) : $CO=!Q&"([\"-MM	$::$99:$889 %<<= %==	>  $  "A || 	(66LT4!$''	(s   
([5 5\(	\##\(c                 B   U(       aN   U R                   R                  U[        R                  S/S9nU H  nU R                  UR                  SS9  M      U R                   R                  U5        [        SU-  5        g ! [         a     g f = f! [         a     g f = f)NdnrW   rN   rO   T	recursivez
Deleted %s)	rm   rq   rr   r   	Exceptiondel_noerrorr   deleter   )r   r   r   resrs        r7   r   DCJoinContext.del_noerror   s    ii&&Bc6H6HQUPV&W 5 	IIR ,#$    		s#   *B )B 
BB
BBc           
      
   U R                   R                  U R                   R                  5       S[        R                  " U R
                  5      -  SS/S9n[        U5      S:X  a  g U(       d  [        5       nUR                  U R                  5         UR                  U R                  5        UR                  U R                  R                  5       5        [        SU R                  -  [!        5       X0R                  S9nUR                  [        R"                  SS	/S
9nUS   S	   S   US   S   S   :X  a  [%        SU R
                  -  5      e U R'                  US   R(                  SS9  US   R+                  SSS9nUb!  X`l        U R'                  U R,                  5        U R                   R                  U R                   R                  5       S[        R                  " SU R.                  -  5      < S[        R                  " SU R0                  -  5      < S3/ S9nU(       a  U R'                  US   R(                  SS9  U R                   R                  U R                   R                  5       S[        R                  " SU R.                  -  5      -  / S9nU(       aU  [%        S[        R                  " SU R.                  -  5      < S[        R                  " SU R0                  -  5      < 35      eg !    GN= f)NsAMAccountName=%smsDS-krbTgtLink	objectSIDrW   rZ   rO   r   rH   rI    tokenGroups)rN   rW   rO   zNot removing account %s which looks like a Samba DC account matching the password we already have.  To override, remove secrets.ldb and secrets.tdbTr   msDS-KrbTgtLink)idxz(&(sAMAccountName=dns-%sz)(servicePrincipalName=zdns/%sz))z(sAMAccountName=%s)zNot removing account zU which looks like a Samba DNS service account but does not have servicePrincipalName=)rm   rq   rw   rr   r   r   r   r   guessrG   set_machine_accountset_kerberos_staterF   get_kerberos_stater   rk   r   rs   r/   r   r   getnew_krbtgt_dnr   r   )r   forcer   rF   machine_samdb	token_resr   s          r7   cleanup_old_accounts"DCJoinContext.cleanup_old_accounts   s   iiCII$@$@$B*=@Q@QRUR]R]@^*^&7%E  G s8q=MEKK9))#&&1(()E)E)GH %+

*B3A3C27FF!D *00s~~BWdVe0f	Q<.q1!f[)!,-) +\ -0KK	+8 9 9- 	A		T2FJJ0aJ8	  )OOC--.iiCII$@$@$B # 1 1(SZZ2G H # 1 1(S__2L M+O &(	  )
 OOCFIIO6iiCII$@$@$B*?#BSBST\_b_i_iTiBj*j%'  ) ! $'#4#4X

5J#K#&#4#4X5O#P	#R S S =s   A.K= =Lc                    U R                   (       d  U R                  US9  U R                  b  U R                  U R                  5        U R                  b  U R                  U R                  5        U R                  U R
                  5        U R                  U R                  SS9  U R                  (       a  U R                  U R                  5        U R                  (       a  U R                  U R                  5        U R                   (       Gag  Sn[        R                  " SU R                  < SU< S3U R                  U R                  5      n[        R                  " 5       n[        R                  " 5       Ul        UR#                  S	U[$        R&                  5      n[        R(                  " 5       nU R*                  Ul        UR/                  XV[        R0                  5      nUR3                  XWR4                  R6                  5        [        R(                  " 5       nU R8                  Ul        UR/                  XV[        R0                  5      nUR3                  XWR4                  R6                  5        U R:                  (       a  U R                  U R:                  5        U R<                  (       a  U R                  U R<                  5        gg)
z$Remove any DNs from a previous join.)r   NTr   signncacn_ip_tcp:[]r   )r   r   r   r   r   r   r   r   r   r   lsarpcrk   rG   rF   ObjectAttributeQosInfosec_qosOpenPolicy2r   SEC_FLAG_MAXIMUM_ALLOWEDStringr   stringQueryTrustedDomainInfoByName!LSA_TRUSTED_DOMAIN_INFO_FULL_INFODeleteTrustedDomaininfo_exsidr   r   r   )r   r   binding_optionslsaconn
objectAttr
pol_handlenamero   s           r7   cleanup_old_joinDCJoinContext.cleanup_old_join  s    }}$$5$1(OOC--.==$OOCMM*$6??OOCOO,OOC,,-===$Ojj#**o!V!$4G ,,.J!$J ,,R-7-5-N-NPJ ::<D))DK77
#JoJopD''
LL4D4DE::<D00DK77
#JoJopD''
LL4D4DE<<OOCLL)OOC,,- r9   c                    U R                   (       a  [        S5      eU R                  R                  U R                  R	                  5       S[
        R                  " U R                  5      -  / SQS9n[        U5      S:X  a  [        SU R                  -  5      eSUS   ;   d  SUS   ;   d	  S	US   ;   a  [        S
U R                  -  5      e[        US   S   S   5      [        R                  R                  [        R                  R                  -  -  S:X  a  [        SU R                  -  5      eUS   R                  U l        g)z]confirm that the account is just a bare NT4 BDC or a member server, so can be safely promotedz Can not promote into a subdomainr   )r   userAccountControlserverReferenceBLrIDSetReferencesr   r   zcCould not find domain member account '%s' to promote to a DC, use 'samba-tool domain join' instead'r   r  r  zhAccount '%s' appears to be an active DC, use 'samba-tool domain join' if you must re-create this accountr  zZAccount %s is not a domain member or a bare NT4 BDC, use 'samba-tool domain join' instead'N)r   r   rm   rq   rw   rr   r   r   r   intr   r,   UF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTr   rd   r   r   s     r7   promote_possibleDCJoinContext.promote_possibleH  sm   ==>??iiCII$@$@$B*=@Q@QRUR]R]@^*^%w  y s8q=  B  EH  EP  EP  P  Q  QA&*=Q*GK]adefagKg  G  JM  JU  JU  U  V  VA+,Q/0EJJ4[4[49JJ4V4V5W X[\]x{~  |G  |G  G  H  H!!fiir9   c                     U R                   R                  U[        R                  [        R                  -  [        R
                  -  S9U l        U R                  R                  b5  U R                  R                  S:w  a  U R                  R                  U l        U R                  R                  $ ! [         a%  n[        SU< SUR                  S   < 35      eSnAf[         a    [        SU-  5      ef = f)z(find a writeable DC for the given domain)r   flagsz*Failed to find a writeable DC for domain 'z':    Nz-Failed to find a writeable DC for domain '%s'r   )rj   finddcr   NBT_SERVER_LDAPNBT_SERVER_DSNBT_SERVER_WRITABLE	cldap_retr$   r+   ru   r   client_siter]   pdc_dns_name)r   r   errors      r7   rp   DCJoinContext.find_dc[  s    	YGGNN&@S@SVYVgVg@gjm  kB  kB  ABN  CCM ==$$0S]]5N5NRT5T}}00CH}})))  	8 &

1 7 8 8 	YNQWWXX	Ys   AB3 3
C9= CC9c                     S nU R                   R                  U[        R                  [        R                  -  S9nUR
                  b  UR
                  S:w  a  UR
                  nU$ )N)addressr  r   )rj   r  r   r  r  r  )r   rk   r]   r  s       r7   rn   DCJoinContext.find_dc_siteh  s^    GGNN6),)<)<s?P?P)P # R	  ,1F1F"1L((Dr9   c                     U R                   R                  U R                  [        R                  S/S9nSUS   ;   a  [        US   S   S   5      $ [        R                  R                  $ )NmsDS-Behavior-Versionr   r   )	rm   rq   rx   rr   rs   r  r   r,   DS_DOMAIN_FUNCTION_2000r  s     r7   r   "DCJoinContext.get_behavior_versionp  s_    iiCKKs~~NeMfg"c!f,s1v56q9::::555r9   c                 ~    U R                   R                  S[        R                  S/S9n[	        US   S   S   5      $ )Nr   dnsHostNamer   r   )rm   rq   rr   rs   rv   r  s     r7   r   DCJoinContext.get_dnsHostNamew  s<    iiBcnn]OT3q6-(+,,r9   c                 $   U R                   R                  5       nU R                   R                  U[        R                  S/S[        R
                  " [        U R                   R                  5       5      5      -  S9n[        US   S   S   5      $ z9get netbios name of the domain from the partitions recordnETBIOSNamez	ncName=%s)rW   rN   rO   rZ   r   )rm   r   rq   rr   r   r   rv   rw   r   partitions_dnr   s      r7   r   DCJoinContext.get_domain_name{  s|    		335iiM9K9KTaSb*58I8I#ciiNjNjNlJm8n*n  p3q6-(+,,r9   c                 $   U R                   R                  5       nU R                   R                  U[        R                  S/S[        R
                  " [        U R                   R                  5       5      5      -  S9n[        US   S   S   5      $ r%  )rm   r   rq   rr   r   r   rv   ry   r'  s      r7   r   $DCJoinContext.get_forest_domain_name  s|    		335iiM9K9KTaSb*58I8I#ciiNgNgNiJj8k*k  m3q6-(+,,r9   c                    U R                   R                  U R                  / S[        R                  " U R
                  5      [        R                  [        R                  R                  4-  S9n[        US   R                  5      $ )z7get the parent domain partition DN from parent DNS namez9(&(objectclass=crossRef)(dnsRoot=%s)(systemFlags:%s:=%u)))rW   rO   rZ   r   )rm   rq   r~   rr   r   parent_dnsdomainOID_COMPARATOR_ANDr   r,   SYSTEM_FLAG_CR_NTDS_DOMAINrv   r   r  s     r7   get_parent_partition_dn%DCJoinContext.get_parent_partition_dn  sp    iiCMM*e # 1 1#2F2F G # 6 6

8]8] _+_  ` 3q699~r9   c                     U R                   R                  S[        R                  S/S9nUS   S   S   n[	        U R                   R                  SU5      5      $ )z]get the SID of the connected user. Only works with w2k8 and later,
so only used for RODC joinr   r   r   r   r   )rm   rq   rr   rs   r*   schema_format_value)r   r   binsids      r7   	get_mysidDCJoinContext.get_mysid  sT     iiBcnn]OTQ&q)#))77VLMMr9   c                      U R                   R                  U[        R                  / S9ng! [        R                   a-  nUR
                  u  pEU[        R                  :X  a   SnAge SnAff = f)zcheck if a DN existsr   NFT)rm   rq   rr   rs   rt   ru   ERR_NO_SUCH_OBJECT)r   r   r   e5r   r   s         r7   r   DCJoinContext.dn_exists  s`    	))""#.."KC  || 	77LTs---		s   ), A- "A('A((A-c                    [        SU R                  -  5        U R                  S[        [        R                  R
                  [        R                  R                  -  5      SSU R                  -  S.nU R                  R                  US/5        U R                  R                  U R                  [        R                  S/S9nUS	   S   S	   U l        [        S
U R                  -  5        [        R                  " 5       n[        R                  " U R                  U R                   5      Ul        [        R$                  " U R                  [        R&                  S5      US'   U R                  R)                  U5        SU R                  < SU R*                  < 3U l        [        SU R                  < SU R,                  < 35        U R                  R/                  U R                  U R,                  5        g)z#RODCs need a special krbtgt account	Adding %suserTRUEzkrbtgt for %s)r   objectclassuseraccountcontrolshowinadvancedviewonlydescriptionrodc_join:1:1samAccountNamer   r   zGot krbtgt_name=%sr   rR   
,CN=Users,z	Renaming z to N)r   r   rv   r   r,   UF_NORMAL_ACCOUNTUF_ACCOUNTDISABLEr   rm   addrq   rr   rs   krbtgt_nameMessageDnr   r   MessageElementFLAG_MOD_REPLACEmodifyrx   r   rename)r   recr   ms       r7   add_krbtgt_account DCJoinContext.add_krbtgt_account  sm   kCMM)*--!"%ejj&B&B&+jj&B&B'C #D&,*S[[8: 			cO,- iiCMMP`Oaba&!1215"S__45KKMvvcii-"11#--252F2FHY [
		36??CKKPS]]C4E4EFG		(9(9:r9   c                 2   SnU R                   R                  5       S:  a  US-  nSU R                  < SU< S3n[        R                  " X R                   U R                  5      U l        [
        R                  " U R                  5      u  U l        U l        g)z.make a DRSUAPI connection to the naming masterseal	   ,printr   r   r   N)	rG   	log_levelrk   r   rF   r   
drs_DsBinddrsuapi_handlebind_supported_extensions)r   r   binding_strings      r7   drsuapi_connectDCJoinContext.drsuapi_connect  sq     66"x'O25**oNoonffciiH>G>R>RSVS^S^>_;	S:r9   c           
          [        U R                  U R                  S9U l        [	        [        5       SSU R                  U R                  SSS9U l        U R                  R                  U R                  5        g)z2create a temporary samdb object for schema queries)schemadnNF)rK   rJ   auto_connectrL   rG   global_schemaam_rodc)
r   r   r|   
tmp_schemar   r   rF   rG   r   
set_schemar   s    r7   create_tmp_samdbDCJoinContext.create_tmp_samdb  s[    

),8>+;TY*-))e&+- 	  0r9   c           	         U R                   c  U R                  5         U R                  c  U R                  5         / nU GH>  n[         R                  " 5       nUS   Ul        / nU H  nUS:X  a  M  [        X6   [        5      (       d  X6   /nOX6   nU Vs/ s H+  n[        U[        5      (       a  UR                  S5      OUPM-     nnU R                  R                  U R                  Xg5      n	UR                  U	5        M     [         R                  " 5       n
[        U5      U
l        XZl        [         R                   " 5       nXKl        Xl        [         R&                  " 5       nXl        UR                  U5        GMA     [         R*                  " 5       nUS   Ul        UR,                  nUSS  H  nXl        UnM     U R                   R1                  U R2                  SU5      u  nnUS:X  a  UR4                  [         R6                  :w  a#  [9        SUR4                  -  5        [;        S5      eUR<                  S   [>        R@                  :w  a#  [9        S	UR<                  -  5        [;        S5      eUS
:X  Ga8  URB                  S:w  a  [;        SURB                  -  5      eURD                  RF                  S   [>        R@                  :w  a  URD                  RH                  c&  [9        SURD                  RF                  S   -  5        OH[9        SURD                  RF                  S   < SURD                  RH                  R<                  < 35        [;        S5      eURD                  R4                  [         R6                  :w  a-  [9        SURD                  R4                  -  5        [;        S5      eURJ                  $ s  snf )z,add a record via the DRSUAPI DsAddEntry callNr   utf8r   r     z!DsAddEntry failed with dir_err %uzDsAddEntry failedz(DsAddEntry failed with status %s info %s   zexpected err_ver 1, got %uz.DsAddEntry failed with status %s, info omittedzDsAddEntry failed with status z info )&r   r]  r   rg  DsReplicaObjectIdentifierr   
isinstancelistrv   encodedsdb_DsReplicaAttributeappendDsReplicaAttributeCtrr   num_attributes
attributesDsReplicaObject
identifierattribute_ctrDsReplicaObjectListItemobjectDsAddEntryRequest2first_objectnext_object
DsAddEntryrZ  dir_errDRSUAPI_DIRERR_OKr   RuntimeErrorextended_errr!   WERR_SUCCESSerr_vererr_datastatusro   objects)r   recsr  rP  idrO   avxrattrrx  rz  list_objectreq2prevolevelctrs                     r7   r~  DCJoinContext.DsAddEntry  s   ;;!==   "C224BIBEE9!#&$//AALMNAqAs););QXXf%BAN==cmmQRU#  $99;M+.u:M(',$,,.F "#0 !99;K!'NN;'5 8 ))+#AJ  A D  {{--c.@.@!TJA:{{g7779CKKGH"#677"f&9&99@CDTDTUV"#677A:{{a"#?#++#MNN||""1%)<)<<<<$$,JcllNaNabcNdefH[H[\]H^HKHYHYHfHfh i"#677||##w'@'@@9CLL<P<PPQ"#677{{[ Os   2Oc                    [        SU R                  -  5        [        SU R                  4SS[        [        R
                  R                  5      4SU R                  4/5      nU R                  U R                  U R                  /nU R                  [        R
                  R                  :  a.  [        R                  " U R                  5      n[        U5      US'   U R                  [        R
                  R                  :  a  U R                  US'   U R                  (       a(  SU R                  -  US	'   U R                   US
'   SUS'   U$ SU R                  -  US	'   U R                  [        R
                  R                  :  a  U R                   US'   / US'   U H(  nX@R                   ;   d  M  US   R#                  U5        M*     SUS'   [%        U R&                  5      US'   U$ )z return the ntdsdsa object to addr<  r   )r?  nTDSDSAsystemFlagsdMDLocationr  zmsDS-HasDomainNCszCN=NTDS-DSA-RO,%sobjectCategoryzmsDS-HasFullReplicaNCs37optionszCN=NTDS-DSA,%szmsDS-HasMasterNCsHasMasterNCs1invocationId)r   r   r)   rv   r   r,   #SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETEr|   rx   r~   r   DS_DOMAIN_FUNCTION_2003r-   dc_level_from_lprG   r   rf   rr  r	   r   )r   rP  re   domainControllerFunctionalityncs        r7   join_ntdsdsa_objDCJoinContext.join_ntdsdsa_obj  s    	kCKK'( 3;;&C

 N NOPCMM*	, - ;;s}}=5::#E#EE
 -=,M,Mcff,U)+./L+MC'(5::#E#EE'*{{C#$88$7#--$GC !,/,<,<C()!C	N" 
 %5s}}$DC ! ##uzz'I'II+.+;+;'(')C)))'..r2  !C	N"*3+<+<"=C
r9   c                    U R                  5       nU R                  (       a  U R                  R                  US/S9  OAU R                  (       a  U R                  R                  US/5        OU R                  U/5        U R                  R                  U R                  [        R                  S/S9n[        R                  " U R                  R                  SUS   S   S   5      5      U l        g)zadd the ntdsdsa objectrelax:0controlsrC  
objectGUIDr   r   N)r  rl   rm   rH  r   r~  rq   r   rr   rs   r   r   r3  	ntds_guid)r   rP  r   s      r7   join_add_ntdsdsaDCJoinContext.join_add_ntdsdsaE  s     ""$!!IIMM#M4XXIIMM#01NNC5! iiCKKs~~l^\		#))"?"?cRSfUaNbcdNe"fgr9   c                    U R                   (       Gae  [        SU R                   -  5        U R                   SU R                  U R                  [        U R                  [
        R                  R                  -  5      U R                  S.nU R                  [
        R                  R                  :  a'  [        [
        R                  R                  5      US'   OU R                  (       a  / US'   U R                  (       a  U R                  US'   OU R                  (       a  / US'   U R                  (       a  U R                  US'   OU R                  (       a  / US'   U R                  (       a  U R                  US'   OU R                  (       a  / US'   U(       a  [!        U5      US'   U R                  (       a  U R"                  U R                   :w  a0  U R$                  R'                  U R"                  U R                   5        U R$                  R)                  [*        R,                  R/                  U R$                  U[*        R0                  5      5        O!S	nUb  S
/nU R$                  R3                  X#S9  U R4                  (       a  U R7                  5         U R8                  (       a  [        SU R8                  -  5        U R8                  S[        [
        R                  R:                  [
        R                  R<                  -  [
        R                  R>                  -  5      U R                  S.nU R                   (       a  U R                   US'   U R$                  R3                  U5        U R@                  (       a  S	U l!        g	U RD                  (       Ga  U RG                  5         S[*        RH                  " U RJ                  5      -  nU R$                  RM                  [*        RN                  / U R$                  RQ                  5       US9U RJ                  4nS[*        RH                  " U RR                  5      -  nU R$                  RM                  [*        RN                  / U R$                  RQ                  5       US9U RR                  4nXV4 H  u  pxXRT                  ;  a  M  [W        U5      S:X  d  M'  [*        R,                  " 5       n	US   RX                  U	l,        Sn
U RZ                  (       a  Sn
[*        R\                  " U RD                  [*        R^                  U
5      X'   U R$                  R)                  U	5        M     U R`                  bO  [        SU R`                  -  5        U R`                  SSSU Rb                  S.nU R$                  R3                  U5        U R                   (       Ga  [        SU R                   -  5        [*        R,                  " 5       n	[*        Rd                  " U R$                  U R                   5      U	l,        [g        [W        U Rh                  5      5       HB  nU Rh                  U   Rk                  S[        U RB                  5      5      U Rh                  U'   MD     [*        R\                  " U Rh                  [*        R0                  S5      U	S'   U R$                  R)                  U	5        [        SU R                  -  5         U R$                  Rm                  S[*        RH                  " U R                  5      -  U Rn                  SU R                  S9  U R$                  RM                  U R                   [*        R|                  S!S"/S#9nS!US   ;   a  [        US   S!   S   5      U l@        OS	U l@        [        [        R                  US   S   S   5      U lD        [        S$5        [*        R,                  " 5       n	[*        Rd                  " U R$                  U R                   5      U	l,        [*        R\                  " [        U R                  5      [*        R0                  S%5      U	S%'   U R$                  R)                  U	5        U R                  R                  S&5      (       Ga  [
        R                  " S'S(5      U lH        U R$                  R                  [        [        S)5      U R                  U R                  U R                  [        U R                  R                  S*5      5      R                  S+5      U R                  S,.5      5      nU H  u  nnU[*        R                  :X  d   eUS-   n[        S.US-   -  5        US/	 US0	 [        [
        R                  R                  [
        R                  R                  -  5      US%'    U R$                  R3                  U5        M     [        S1U R                  -  5         U R$                  Rm                  S2[*        RH                  " U R                  5      -  U R                  SU R                  S9  U R$                  RM                  W[*        R|                  S!/S#9nS!US   ;   a  [        US   S!   S   5      U lU        g	S	U lU        g	g	! [*        Rp                   ag  nURr                  u  pU[*        Rt                  :w  a  e U Rv                  Ry                  U R                  U Rz                  U Rn                  S 9   S	nAGNS	nAff = f! [*        Rp                   a/  nURr                  u  pU[*        R                  :w  a  e  S	nAGM  S	nAff = f! [*        Rp                   aj  nURr                  u  pU[*        Rt                  :w  a  e U Rv                  Ry                  S3U R                  -  U Rz                  U R                  S 9   S	nAGNS	nAff = f)4z+add the various objects needed for the joinr<  computer)r   objectClassdisplaynamesamaccountnamer  r   zmsDS-SupportedEncryptionTypesr   zmsDS-NeverRevealGroupzmsDS-RevealOnDemandGroup	objectSidNr  r  rk   )r   r?  r  r"  serverReferencerX   rY   r  r   zmsDS-NC-Replica-LocationszmsDS-NC-RO-Replica-LocationsnTDSConnectionr>  65)r   r?  enabledconnectionr  
fromServerzAdding SPNs to %sz	$NTDSGUIDservicePrincipalNamezSetting account password for %sz((&(objectClass=user)(sAMAccountName=%s))F)force_change_at_next_loginusername)account_namer   newpasswordzmsDS-KeyVersionNumberr   r   zEnabling accountr  BIND9_      zprovision_dns_add_samba.ldif	utf-16-lerj  )	DNSDOMAINDOMAINDNHOSTNAMEDNSPASS_B64DNSNAMEr   z#Adding DNS account %s with dns/ SPNclearTextPasswordisCriticalSystemObjectz#Setting account password for dns-%sz,(&(objectClass=user)(samAccountName=dns-%s))r   )Vr   r   r   rv   r  r   r,   rG  r   r   DS_DOMAIN_FUNCTION_2008ENC_ALL_TYPESrc   r   r   r   r	   rd   rm   rO  rN  rr   rJ  	from_dictrM  rH  r   rR  r   SYSTEM_FLAG_CONFIG_ALLOW_RENAME%SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVEr  r   r  r   r  r   r   rq   r   r   r   re   r   r   r   rL  FLAG_MOD_ADDr   r   rK  ranger   replacesetpasswordr   rt   ru   ERR_UNWILLING_TO_PERFORMrj   set_passwordr   rs   r  key_version_numberr
   r   r   new_dc_account_sidr   
startswithgenerate_random_passworddnspass
parse_ldifr    r   r   rx   r   r"   rp  decodeCHANGETYPE_NONErF  ERR_ENTRY_ALREADY_EXISTSdns_key_version_number)r   specified_sidrP  r  r   r   forestpartzonerQ  attrie2num_r   r  
changetyper5   dns_acct_dnr   e3s                         r7   join_add_objectsDCJoinContext.join_add_objectsT  sB	   ;;;++,kk)"{{"%++&)#*@*@5::C_C_*_&`"0C ##uzz'I'II7:5::;S;S7T34%%7934}}#&==K %%#%K ##/2/C/C+,%%/1+,~~25.../%%24./#+M#:K ##&&#++5II$$S%8%8#++F		  !6!6syy#sG[G[!\] , ){H		c5==""$==+-.mm'"5::#M#M#(::#S#S$T#(::#Q#Q$R  S  #0C {{),%&IIMM#== CM;;;  " :C<M<McN`N`<aaDii&&S-?-?-/,/II,G,G,I26 ' 8 :=9K9KMF
 :C<M<McN`N`<aaDii&&S-?-?-/,/II,G,G,I26 ' 8 :=9K9KMF
  &.
{{*t9>A7::AD6Dxx=!00141A1A4IAGII$$Q' / (+ 1 112''/%+!nn.C IIMM#;;;%34A66#))S[[1AD3sxx=)!hhqk11+s3==?QR *(+(:(:388;>;O;O;Q)SA$% IIQ 3ckkAB@		%%&P(+(9(9#++(F'G&)mmAF/2{{	 & < ))""3>>*A*5*7 # 8C '#a&0),SV4K-LQ-O)P&)-&%/0@0@03A{0CA0F&HC" $%A66#))S[[1AD&)&8&8S=S=S9T9<9M9M9M'OA"# IIQ??%%h//88cBCK99''(9*Ec:dHKGJ{{GJzzJSTWT_T_TfTfgrTsJtJ{J{  }C  KDFIoo	;W)X YD $(
C!S%8%8888!$i;c$iGH +,01,/

0L0L05

0L0L1M -N()IIMM#& $(0 7#**DE>		%%&T(+(9(9#**(E'F&)kkAF/2{{	 & < ))""3>>*A)B # DC&#a&0-0Q8O1PQR1S-T*-1*k 07 << @77#666$$#++1414 % @	@d ||  vvHSc::: ;" << >77#666$$(SZZ2G1414 % >	>sL   Ai?  k=Am ?k:Ak55k:=m #l;;m oAn<<oc                    [        SU R                  -  5        S[        U R                  5      < S[        R
                  < 30n[        R                  " U R                  US9nU R                  SSU R                  -  U R                  U R                  U R                  U R                  [        [        R                  R                   [        R                  R"                  -  5      US.	nU R$                  [        R                  R&                  :  a  [        U R$                  5      US'   U R)                  5       nU R+                  X4/5      n[-        U5      S	:w  a  [/        S
5      eUS   R0                  U l        [        S5        U R4                  R7                  U R                  [8        R:                  " S5      U R2                  [<        R>                  [<        R@                  S9  [        S5        U R4                  R7                  U RB                  [8        R:                  " S5      U R2                  [<        R>                  [<        R@                  S9  g)zLadd the various objects needed for the join, for subdomains post replicationr<  SubdomainAdmins-)name_mapcrossRefzCN=Cross-Ref,%s)	r   r?  r  nCNamer&  dnsRoottrustParentr  ntSecurityDescriptorr  rk  z"Expected 2 objects from DsAddEntryr  zReplicating partition DN$00000000-0000-0000-0000-000000000000)exopr   zReplicating NTDS DNN)"r   r   rv   r   r   DOMAIN_RID_ADMINSr   +get_paritions_crossref_subdomain_descriptorr   r|   rx   r   r   parent_partition_dnr   r,   SYSTEM_FLAG_CR_NTDS_NCr/  r   r  r  r~  r   r/   guidr  repl	replicater   r   r   DRSUAPI_EXOP_REPL_OBJDRSUAPI_DRS_WRIT_REPr   )r   r  	sd_binaryrP  rec2r  s         r7   join_add_objects2DCJoinContext.join_add_objects2+  s    	kC,,,-%#cjj/8C]C]'^_JJ3==ckl	""%/#--?kk??}}22uzz@@%**BgBggh$-

 5::#E#EE+.s/C/C+DC'(##%..#-w<1!"FGG
()3++99%KL== ' = =)0)E)E	 	 	G 	#$3;;99%KL== ' = =)0)E)E	 	 	Gr9   c                 |   [        S5        U R                  R                  n[        U R                  [        5       40 SU_SU R                  _S[        _SU R                  _SU R                  _SU R                  _SU R                  _S	U R                  _S
U R                  _SU R                  _SU R                  _SU R                   _SU R"                  _SS_SU R$                  _SU R                  _SU R&                  _SU R(                  _SU R*                  _SU R,                  _SU R.                  _SU R0                  _SS_6n[        SUR2                  -  5        UR4                  U l        UR                  U l        UR8                  U l        UR:                  U l        U R<                  U R:                  l        g)Provision the local SAM.zCalling bare provisionsmbconfr^   
samdb_fillr   rootdndomaindnr`  configdnserverdnr   hostname	domainsidr   
serverrole"active directory domain controllersitenamerG   ntdsguidr_   r   r`   ra   rb   
batch_modeTzProvision OK for domain DN %sN)r   rG   
configfiler   r\   r   r^   r   r   rz   rx   r|   r~   r   r   r   r   r   r]   r  r_   r   r`   ra   rb   r	  rm   local_samdbpathsnamesr   )r   r  presults      r7   join_provisionDCJoinContext.join_provisionV  s    	&'&&##CJJ(8 -' -&)mm-@H-PSPYPY-#&;;-9<- &)]]- >A]]- &)]]	- <???	-
 &)ZZ-
 <?::- ),- Cg- &)XX- 36&&- DG==- '*mm- BE- /2.C.C- +.*;*;- 03/E/E- (,- 	-0@0@@A!--!**!--	!--	 "mm		r9   c                 |   [        S5        [        U R                  R                  S/[	        5       U R                  R
                  SS9U l        U R                  R                  [        U R                  5      5        U R                  U l        U R                  R                  S5        U R                  R                  U R                  [        R                  S/SS/S	9nS
US   ;  a1  [!        SU R                  < SU R                  R                  < 35      e [        ["        R$                  " [        R&                  " U R                  US   S   S   R)                  S5      5      R+                  S5      5      5      U R,                  l        U R                  R                  SU R,                  R.                  -  5        U R                  R                  S5        [3        U R4                  R6                  [	        5       U R
                  S9n[9        U R                  UU R                  U R,                  U R4                  U R:                  [<        U R>                  SU R
                  U R,                  R@                  U R,                  RB                  U RD                  U RF                  S9  U R:                  [H        RJ                  RL                  :  a  U R:                  nSnU R
                  RO                  S5      c)  U R
                  RQ                  SS5        [        S5        SnU R                  RS                  5          SSK*J+n  U" U R                  SS9nURY                  U[H        RJ                  RZ                  SS9  U R                  R]                  5         U(       a  U R
                  RQ                  SS5        [        S U R,                  Rb                  -  5        g! [0         a    [!        SUS   S   S   -  5      ef = f! [^         a-  nU R                  Ra                  5         [!        SU-  5      eSnAff = f)!r  zReconnecting to local samdbz#transaction_index_cache_size:200000F)rJ   r  rK   rG   rb  zFinding domain GUID from ncNamencNamezextended_dn:1:1zreveal_internals:0)rW   rN   rO   r  r  r   z*Can't find naming context on partition DN z in rj  r   z3Can't find GUID in naming master on partition DN %szGot domain GUID %szCalling own domain provisionrK   rG   r  )	dom_for_fun_levelr  r   r  rG   hostiphostip6r   r   zdsdb:schema update allowedNyesz;Temporarily overriding 'dsdb:schema update allowed' settingT)DomainUpdate)fix)update_revisionzDomainUpdate() failed: %snozProvision OK for domain %s)2r   r   r  rJ   r   rG   rm   set_invocation_idrv   r   r\   ro   rq   r   rr   rs   r/   r   r   rK  r  get_extended_componentr  
domainguidKeyErrorr   r  secretsr   r   r   r   r  r  r   r   r   r,   DS_DOMAIN_FUNCTION_2012r   settransaction_startsamba.domain_updater!  check_updates_functional_levelr  transaction_commitr   transaction_cancelr   )r   r   secrets_ldbadprep_levelupdates_allowed_overriddenr!  r   r   s           r7   join_provision_own_domain'DCJoinContext.join_provision_own_domains  sb    	+,coo11B"D'5'7 __//(-/	 			##C(9(9$:;))

9:oo$$#*:*:#..YaXb/@BV.W % Y 3q6!!Z]ZjZjlolululyly"z{{	o#&tyy		3q6(CSTUCVC]C]^dCe1f1}1}  E  2F  (G  $HCII  	

,syy/C/CCD

67#))++.:JsvvVszz399cii),)=)="0#&===a&&)9)9399CTCT#&??cmm	M 5::#E#EE//L).&vvzz67?

7?ST-1*II'')G<%coo4@55l6;jj6X6XFJ 6 L 		,,.
 *

7>*SYY-@-@@AW  	o!"WZ]^_Z`aiZjklZm"mnn	oH  G		,,.%&AA&EFFGs&   A4O ?AP "P
P;(P66P;c                     [         R                  " SU R                  < SU< S3U R                  XR                  U R
                  5      $ z2Creates a new DRS object for managing replicationsr   r   r   )r   drs_Replicaterk   rG   r  r   )r   
repl_credsr   s      r7   create_replicatorDCJoinContext.create_replicator  s8    &&),_E
OOS5F5FH 	Hr9   c           	         U R                   R                  S5        U R                  R                  5          [        R
                  " U R                  R                  5       5      nU R                  c0  [        S5        [        R
                  " [        R                  5      nOU R                  nU R                  (       aq  [        5       nUR                  U R                  5        UR!                  ["        5        UR%                  U R&                  5        UR)                  U R*                  5        OU R,                  nSnU R                  R/                  5       S:  a  US-  nU R1                  X45      nUR3                  U R4                  UUSU R                  U R6                  S9  UR3                  U R8                  UX R                  U R6                  S	9  U R:                  (       d  [        S
5         UR3                  U R<                  UX R                  U R>                  [        R@                  -  S	9  U R>                  [        R@                  -  (       d1   UR3                  U R<                  UX R                  U R>                  S	9  [        S5        U RL                  U RN                  4 HP  nXpRP                  ;   d  M  [        S[S        U5      -  5        UR3                  XqX R                  U R6                  S	9  MR     U R                  (       aW  UR3                  U RT                  UU[        RV                  SS9  UR3                  U RX                  UU[        RV                  SS9  O8U RZ                  b+   UR3                  U RZ                  UU[        R\                  S9  XPl3        Xl4        X l5        U R                   R                  S5        U R>                  [        R@                  -  (       d*  U R                  Rm                  [n        Rp                  S5        U R                  Rs                  5         U R                  Rm                  [n        Rp                  S5        U R                   R                  S5        U Rw                  5         g! [B         aH  nURD                  S   [F        RH                  :X  a!  U R                   RK                  S5         SnAGNe SnAff = f! [B         ad  nURD                  S   [F        RH                  :X  a=  U R>                  [        R@                  -  (       a  U R                   RK                  S5        e SnAff = f! [^        R`                   aQ  nURD                  u  pU	[        Rb                  :X  a)  [        SU Rd                  -  5        [        S5         SnAGNe SnAff = f!   U R                  Ru                  5         e = f)zReplicate the SAM.zStarting replicationNzUsing DS_BIND_GUID_W2K3rU  rV  rW  T)schemarodcr   )r>  r   z;Replicating critical objects from the base DN of the domainr   zFirst pass of replication with DRSUAPI_DRS_CRITICAL_ONLY not possible due to a missing parent object.  This is typical of a Samba 4.5 or earlier server. We will replicate all the objects instead.zReplication with DRSUAPI_DRS_CRITICAL_ONLY failed due to a missing parent object.  This may be a Samba 4.5 or earlier server and is not compatible with --critical-onlyz5Done with always replicated NC (base, config, schema)zReplicating %s)r  r>  )r  zdWARNING: Unable to replicate own RID Set, as server %s (the server we joined) is not the RID Master.zxNOTE: This is normal and expected, Samba will be able to create users after it contacts the RID Master at first startup.z1Committing SAM database - this may take some timer  zCommitted SAM database)<r\   ro   r  r,  r   r   rm   get_invocation_idr  r   r   DRSUAPI_DS_BIND_GUID_W2K3r   r   r   rG   r   r   set_usernamer   r  r   rF   rX  r:  r  r|   r   r~   r   rx   domain_replica_flagsDRSUAPI_DRS_CRITICAL_ONLYr#   ru   r!   WERR_DS_DRA_MISSING_PARENTwarningr   r   re   rv   r   DRSUAPI_EXOP_REPL_SECRETr   r   DRSUAPI_EXOP_FSMO_RID_ALLOCr   DsExtendedErrorDRSUAPI_EXOP_ERR_FSMO_NOT_OWNERrk   r  source_dsa_invocation_iddestination_dsa_guid
set_opaquer,   0DSDB_FULL_JOIN_REPLICATION_COMPLETED_OPAQUE_NAMEr/  r0  refresh_ldb_connection)r   rJ  rK  r9  r   r  r   r  e1r   r   s              r7   join_replicateDCJoinContext.join_replicate  s    	

./
 	))+F	6'+yy1L1L1N'O$}}$/0'+yy1R1R'S$'*}}$xx(]
  (--.?@''4''6 YY
$Ovv!Q&8+((EDNN3==*B/388),):):  < NN3==*B/hh),):):  < == STNN3;;0H#7hh141I1IGLmLm1m # o0 //'2S2SSs{{4L';((585M5M ' O IJ
 ))3+=+=>$*c"g67NN2#7hh141B1B # D ? xxs{{,D3$+$D$D4  Q s002J3$+$D$D4  Q ##/
NN3#5#57O#7(/(K(K # M H+C(';$JJOOOP ++g.O.OO**4+`+`+,.OO..0OO&&t'\'\'(*JJOO45 	""$C # 
vvayF$E$EE

** ,X Y Y 
4 ' 66!9(I(II33g6W6WWJJ.. 0\ ] F ,, #%77LTwFFF  E  HK  HR  HR  R  S  Y  Z  Z	OO..0s   F9V3 1AR 2"V3 0S 3V3 <B5V3 2*U -V3 
S<SV3 SSV3 
U$AUUV3 V0AV+$V3 *V++V00V3 3Wc                     U R                   R                  [        R                  / S9  g ! [        R                   a  nUR
                  u  p#U[        R                  :X  af  SU;   d  SU;   aZ  U R                  R                  S5        [        SU R                  -  [        5       U R                  U R                  S9U l          S nAg [        U5      eS nAff = f)NrM   !NT_STATUS_CONNECTION_DISCONNECTEDNT_STATUS_CONNECTION_RESETz)LDB connection disconnected. ReconnectingrH   rI   )rm   rq   rr   rs   rt   ru   ERR_OPERATIONS_ERRORr\   rE  r   rk   r   rF   rG   r/   )r   r   r   r   s       r7   rN  $DCJoinContext.refresh_ldb_connectionV  s    	,II3>><|| 	,66LT 0004<-5

""#NO!kCJJ&>/=/?.1iiCFFD		 &d++	,s   (+ CBCCCc                    [         R                  " 5       n[         R                  " 5       Ul        [	        U5      UR                  l        [        R                  " S5      UR                  l        [        R                  " S5      UR                  l        U R                  Ul        [	        U R                  5      < SU R                  < 3Ul        [         R                   [         R"                  -  Ul        U R&                  (       d#  U=R$                  [         R(                  -  sl        U R                   c  U R+                  5         U R                   R-                  U R.                  SU5        g )Nr  zS-0-0z._msdcs.r  )r   DsReplicaUpdateRefsRequest1rm  naming_contextrv   r   r   r   r  r   r   r   r  dest_dsa_guidr   dest_dsa_dns_nameDRSUAPI_DRS_ADD_REFDRSUAPI_DRS_DEL_REFr  r   r  r]  DsReplicaUpdateRefsrZ  )r   r   r   s      r7   send_DsReplicaUpdateRefs&DCJoinContext.send_DsReplicaUpdateRefsh  s    //1"<<>!"g $		*P Q'//8--03CMM0BCMMR//'2M2MM	xxII555I;;!''(:(:AqAr9   c                 
   [         R                  n[         R                  [         R                  -  nU R                  nSU R
                  -  nU R                  n[        U R                  5      nU< SU< 3n[        R                  " U R                  U R                  5      nU R                  R                  S[        U5      XS4-  5        Sn	[         R                   " SU R                   < SU	< S3U R                  U R"                  5      n
Sn[$        R&                  " U R(                  5      n[*        R,                  " 5       nU R.                  Ul        [*        R2                  " S	[        U R4                  5      [*        R6                  4-  5      Ul         U
R;                  US
U R                   UUS[<        R>                  USS5
      u  pU(       a  WRH                   H  nURJ                   H  nURL                  [<        RN                  :X  d   URL                  [<        RP                  :X  d  MA  [         RR                  " 5       nUUl$         U
RU                  US
U R                   UUSU5        M     M     U H  nURW                  S5      S:w  a3  U R                  R                  SU< SU< SU< 35        [Y        U5      nO2U R                  R                  SU< SU< SU< 35        [[        U5      n[         RR                  " 5       nUUl$        U
RU                  US
U R                   UUUS5        M     [        U5      S
:  Ga  [\        R^                  " U R(                  U R`                  5      nU R(                  Rc                  U< SU< 3US9u  U l2        nURg                  U Rd                  US[*        Rh                  [*        Rj                  -  -  /S9  U R                  R                  SU< SU< SU< 35        [         RR                  " 5       n[m        U5      nUUl$        U
RU                  US
U R                   UUUS5        [\        R^                  " U R(                  U Rn                  5      nU R(                  Rc                  U< SU< 3US9u  U l8        nURg                  U Rp                  US[*        Rh                  [*        Rj                  -  -  /S9  U R                  R                  S5        g! [@         a.  nURB                  S
   [D        RF                  :X  a  Sn SnAGN[SnAff = f! [@         a.  nURB                  S
   [D        RF                  :X  a   SnAGMs  e SnAff = f)a>  Remotely Add a DNS record to the target DC.  We assume that if we
replicate DNS that the server holds the DNS roles and can accept
updates.

This avoids issues getting replication going after the DC
first starts as the rest of the domain does not have to
wait for samba_dnsupdate to run successfully.

Specifically, we add the records implied by the DsReplicaUpdateRefs
call above.

We do not just run samba_dnsupdate as we want to strictly
operate against the DC we just joined:
 - We do not want to query another DNS server
 - We do not want to obtain a Kerberos ticket
   (as the KDC we select may not be the DC we just joined,
   and so may not be in sync with the password we just set)
 - We do not wish to set the _ldap records until we have started
 - We do not wish to use NTLM (the --use-samba-tool mode forces
   NTLM)

z	_msdcs.%srS   z&Adding %d remote DNS records for %s.%sr   r   r   r   Tz%s-%dr   NF:zAdding DNS AAAA record z for IPv6 IP: zAdding DNS A record z for IPv4 IP: )dns_partitionzsd_flags:1:%dr  zAdding DNS CNAME record z for z_All other DNS records (like _ldap SRV records) will be created samba_dnsupdate on first startup)9r   DNS_CLIENT_VERSION_LONGHORNDNS_RPC_VIEW_AUTHORITY_DATADNS_RPC_VIEW_NO_CHILDRENr   r   r   rv   r  r   interface_ipsrG   r   r\   ro   r   rk   rF   r%   SDUtilsrm   r   r   r  	owner_sidr   r   DOMAIN_RID_DCS	group_sidDnssrvEnumRecords2r   DNS_TYPE_ALLr#   ru   r!   "WERR_DNS_ERROR_NAME_DOES_NOT_EXISTrP  recordswType
DNS_TYPE_ADNS_TYPE_AAAADNS_RPC_RECORD_BUFDnssrvUpdateRecord2findr'   r&   rr   rK  r   
dns_lookupr   modify_sd_on_dnSECINFO_OWNERSECINFO_GROUPr(   r   r   )r   client_versionselect_flagsr  
msdcs_zoner  msdcs_cnamecname_targetIPsr   dns_conn
name_found	sd_helperchange_owner_sdbuflenr   r   rP  recorddel_rec_bufIPadd_rec_bufdomaindns_zone_dnldap_recordforestdns_zone_dns                            r7   join_add_dns_records"DCJoinContext.join_add_dns_recordsy  s   0 #>> <<../ }} 3==0
zz#--("&-!!#&&#*;*;<

@S4./ 	0 !&&

O'\'*vvsyy: 
$$SYY/	"--/$'$:$:!$,$4$4W69#**o6>6M6M6O6O %P!
	#--n./.1jj.2.2.2.2.?.?.:.2.2	4 V ww!kkF||t6||t'9'99&/&B&B&D*0&$889:9<9=9=9=9DF * * Bwws|r!

#'r!3 4 n

#'r!3 4bk $668K!KO(()*),)-)-)4)-/ * HqL #syy#2D2D E))&&$'=5F ' H (S\;
 %%cllO0?3;3I3I5=5K5K4L1M 0N & O JJOO*JF G $668Kl+C!KO(()*),)3)4)4)-/ !$syy#2D2D E))&&+z'J5F ' H ,S{
 %%c&6&60?3;3I3I5=5K5K4L1M 0N & O
 	

 K 	Lk  	#vvayFEEE"
	#(  + & vvayF,U,UU $ %	&s6   4S2 
!T-2
T*<#T%%T*-
U%7!U U  U%c           
      <   U R                   U R                  4 H  nXR                  ;   d  M  U R                  R	                  S[        U5      -  5        U R                  R                  XR                  U R                  U R                  U R                  SS9  M     g )Nz!Replicating new DNS records in %sF)r>  r   	full_sync)r   r   re   r\   ro   rv   r  r  rJ  r  r   r   )r   r  s     r7   join_replicate_new_dns_records,DCJoinContext.join_replicate_new_dns_records  sy    %%s'9'9:B[[ 

 Cs2w OP""2'C'C#&==sxx141B1B-2 # 4 ;r9   c                 &   U R                   R                  S5        U R                   H  nU R                  U5        M     U R                  (       Ga%  [        S5        U R                  R                  [        U R                  5      5        U R                  R                  SU R                  5        [        R                  " 5       n[        R                  " U R                  SU R                  -  5      Ul        [        R"                  " [%        U R                  5      [        R&                  S5      US'   U R                  R)                  U5        U R                  R+                  UR                   SS5        U R                   R                  S5        [        R                  " 5       n[        R                  " U R                  S5      Ul        [        R"                  " S	[        R&                  S
5      US
'   U R,                  n[        R"                  " S[        U5      -  [        R&                  S5      US'   U R                  R)                  U5        U R.                  (       a  g[1        U R2                  R4                  [7        5       U R8                  S9nU R                   R                  S5        [;        X@R<                  U R>                  U R@                  U RB                  U RD                  U RF                  U RH                  U RJ                  S9	  U RL                  RO                  S5      (       ab  [Q        U R                  UU RR                  U R2                  U R                   U RL                  U RT                  U R                  U RV                  S9	  gg)z=Finalise the join, mark us synchronised and setup secrets db.z=Sending DsReplicaUpdateRefs for all the replicated partitionszSetting RODC invocationIddomainFunctionalityz%sr  r   (Setting isSynchronized and dsServiceName@ROOTDSEr>  isSynchronized	<GUID=%s>dsServiceNameNr  zSetting up secrets database)r   r   r   netbiosnamer  r   secure_channel_typer  r  )r   r  os_levelr  ),r\   ro   re   r_  r   r   r  r%  rv   r   rL  r   rr   rJ  rK  r   r   rL  r	   rM  rN  "set_attribute_replmetadata_versionr  r   r   r  r)  r   rG   r   r   r   r   r   r   r   r  r  r   r  r   r  r  r  )r   r  rQ  r  r1  s        r7   join_finaliseDCJoinContext.join_finalise  s    	

WX++B((,  888-.OO--c#2C2C.DEOO&&'<'*';';=A66#//4#+++=>AD # 2 28C<M<M3N363G3G3A!CAn OO""1% OO>>qtt?M?@B 	

BCKKMvvcooz2!009M9MO_`
}} //c$i0G030D0DoW/q!==#))++.:JsvvV

56K"%))&)mm(+

&)jj(+030G0G/2/E/E	G ??%%h//COO[IIsyy#**(+$'KK#:N:N/2/I/I	K 0r9   c                 r
   [        SU R                  -  5        Sn[        R                  " SU R                  < SU< S3U R                  U R
                  5      n[        R                  " 5       n[        R                  " 5       Ul        UR                  SR                  S5      U[        R                  5      n[        R                  " 5       nU R                  UR                  l        U R                  UR"                  l        U R$                  Ul        [        R(                  [        R*                  -  Ul        [        R.                  Ul        [        R2                  Ul         [        R6                  " 5       nU R                  Ul        UR9                  XF[        R:                  5      n[        SU R                  < SUR<                  R&                  < S	35        UR?                  XGR<                  R&                  5        [C        U RD                  RG                  S
5      5      n[H        RJ                  " 5       n	[M        U5      U	l'        Xl(        [H        RR                  " 5       n
[T        RV                  " [Y        [Z        RZ                  " 5       5      5      U
l.        [        R^                  U
l0        Xl1        [H        Rd                  " 5       nSUl3        U
/Ul4        [H        Rj                  " 5       nSUl3        Xl6        [H        Rn                  " 5       nS/S-  n[q        S5       H  n[r        Rt                  " SS5      X'   M     Xl;        Xl<        Xl=        [}        U5      n[        UR                  U5      n[        R                  " 5       n[M        U5      Ul'        [C        U5      UlB        [        R                  " 5       nUUlD        UR                  UUU[        R                  5      nSU R                  < SU R                  < 3S[        UR0                  5      [        UR4                  5      [        UR,                  5      U R                  U R                  [}        U5      [}        U5      [}        U R                  5      S.
nU R                  R                  U5        SU R                  < SU R                  < 3S[        [T        R                  R                  5      U RD                  RG                  S
5      SU R                  -  S.nU R                  R                  U5        g! [@         a     GN2f = f)zprovision the local SAM.z"Setup domain trusts with server %sr   z	ncacn_np:r   r   zutf-8zRemoving old trust record for  (SID )r  r  rl  i   r   r  zcn=z,cn=system,trustedDomain)
r   r?  	trustTypetrustAttributestrustDirectionflatnametrustPartnertrustAuthIncomingtrustAuthOutgoingsecurityIdentifierz$,cn=users,r=  rQ   )r   r?  r  r  rD  N)Pr   rk   r   r   rG   rF   r   r   r   r   r  r   r   TrustDomainInfoInfoExr   r   r   r   r   r   LSA_TRUST_DIRECTION_INBOUNDLSA_TRUST_DIRECTION_OUTBOUNDtrust_directionLSA_TRUST_TYPE_UPLEVEL
trust_type!LSA_TRUST_ATTRIBUTE_WITHIN_FORESTtrust_attributesr   r   r   r   r   r  ro  trustdom_passrp  r   AuthInfoClearr   sizepasswordAuthenticationInformationr   unix2nttimer  timeLastUpdateTimeTRUST_AUTH_TYPE_CLEARAuthTypeAuthInfoAuthenticationInformationArraycountarraytrustAuthInOutBlobcurrenttrustDomainPasswordsr  randomrandint
confounderoutgoingincomingr	   r   session_key	DATA_BUF2dataTrustDomainInfoAuthInfoInternal	auth_blobCreateTrustedDomainEx2SEC_STD_DELETEr   rx   rv   r   r   r  rH  r,   UF_INTERDOMAIN_TRUST_ACCOUNT)r   r   r   r   r   ro   oldnameoldinfopassword_blobclear_value clear_authentication_information authentication_information_arrayr  	trustpassr  r  trustpass_blobencrypted_trustpassr  	auth_infotrustdom_handlerP  s                         r7   join_setup_trustsDCJoinContext.join_setup_trustsb  s    	2SZZ?@**#**oN VVSYY0 ((*
 [[]
((7);)3X5V5VX
 ((*"%--#&?? ::">>AaAaa44 # E E	jjlG ]]GN:::;>;`;`bGPWP_P_PcPcde''
OO4G4GH S..55kBC,,.}-,+3+M+M+O(:?:K:KCPTPYPYP[L\:](7474M4M(14?1+3+R+R+T(12(.2R1S(...0;113	S3Y
sA"NN1c2JM   *%%!),-g.A.A>RMMO	01	12	779	'	!889=9B9A9P9PR +.--E*T__-"4#8#89!$"6"67..MM!)(!3!)(!3"*3=="9
 	C  +.*@*@#++N!"%ejj&M&M"N!$!2!2!9!9+!F#c&<&<<
 	C M  		s   &BT( (
T65T6c                    U R                   U R                  /U l        U R                  U R                   U R                  /U l        U R
                  (       a1  U R                  S:w  a!  U =R                  U R                  /-  sl        g U R
                  (       d  U =R                  U R                  /-  sl        U R                  S:w  a  U =R                  U R                  /-  sl        U =R                  U R                  /-  sl        U =R                  U R                  /-  sl        U =R                  U R                  /-  sl        g g g )Nr[   )	r~   r|   re   rx   rf   r   r   r   r   rf  s    r7   build_nc_listsDCJoinContext.build_nc_lists  s     }}cmm4KKF==S__6!3!3 44KKCKK=(K&( 2 233 2 233  S%7%7$88   S%7%7$88 	 ) r9   c                 r   U R                  5         U R                  (       a  U R                  5         OU R                  5          U R	                  5         U R                  5         U R                  5         U R                  (       a0  U R                  5         U R                  5         U R                  5         U R                  S:w  a   U R                  5         U R                  5         U R                  5         g !    [        S5        O! [          a     Of = fU R#                  5         U R                  5         e = f)Nr[   zJoin failed - cleaning up)r  rc   r  r  r  r  rP  r   r  r4  r  r   r  r  r  r   IOErrorrN  rf  s    r7   do_joinDCJoinContext.do_join  s      "  "	  "  }}%%'--/%%'&(((*224
	12 
 &&(  "s1   B1C6 6D69DD6
DD6D$D6r:   )NNNNNNNNNFNFFNNN)FN)(r;   r<   r=   r>   __doc__r3   r   r   r  r  rp   rn   r   r   r   r   r0  r5  r   rR  r]  rg  r~  r  r  r  r  r  r4  r:  rP  rN  r_  r  r  r  r  r  r  r?   r:   r9   r7   rC   rC   <   s    JN;?@D;@#$($(U"n3Sj-.^(&*6---N	;:`1AF.`hU2n)GV,:FBPHS%j,$B"WLr4EKNc!J9* r9   rC   c                    [        XX#XEXgXUXUUS9nUR                  SUR                  5        U R                  SUR                  -  5        UR                  SUR                  5        U R                  SUR                  -  5        SUR
                  < SUR                  < 3Ul        SUR                  < S	[        R                  < S
3S[        R                  -  S[        R                  -  S[        R                  -  S[        R                  -  /Ul        SUR                  < S	[        R                   < S
3Ul        UR%                  5       nSU-  nUUl        [(        R*                  R,                  [(        R*                  R.                  -  [(        R*                  R0                  -  Ul        UR4                  R7                  SUR
                  -  SUR8                  -  /5        SUR:                  -  Ul        [>        R@                  Ul!        SUl"        U=RF                  [H        RJ                  [H        RL                  -  -  sl#        URF                  Ul'        U(       a#  U=RN                  [H        RP                  -  sl'        URS                  5         U R                  SUR                  < SUR                  < S35        g)zJoin as a RODC.ra   rb   	workgroupworkgroup is %sr   realm is %sz
CN=krbtgt_rE  z<SID=r  >z<SID=%s>zRestrictedKrbHost/%szCN=RODC Connection (FRS),%sTJoined domain r  z) as an RODCN)*rC   r+  r   ro   r   r   rx   r   r   r   DOMAIN_RID_RODC_DENYSID_BUILTIN_ADMINISTRATORSSID_BUILTIN_SERVER_OPERATORSSID_BUILTIN_BACKUP_OPERATORSSID_BUILTIN_ACCOUNT_OPERATORSr   DOMAIN_RID_RODC_ALLOWr   r5  r   r   r,   r	  )UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONUF_PARTIAL_SECRETS_ACCOUNTr  r   extendr   r   r   r   SEC_CHAN_RODCr  r   r   r   %DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING$DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIPrB  rC  r  )r\   rk   rF   rG   r]   r   r^   r   domain_critical_onlyr   r_   r   rc   r`   ra   rb   r   mysidadmin_dns                      r7   	join_RODCr    s    4!;;(&3+=	?C FF;(
KK!COO34FF7CII
KK		)*25**ckkJCM X%B%BCX888X:::X:::X;;;=C '*jj(2P2PQCNMMOEE!HCM#jjEE#jjRRS#jjCCDC HHOO+cjj8+coo=? @ 6CC"00CCH'GG!FFG H"00C  G$E$EE KKM
KK#//3::VWr9   c                 V   [        XX#XEXgXUXUUS9nUR                  SUR                  5        U R                  SUR                  -  5        UR                  SUR                  5        U R                  SUR                  -  5        [
        R                  R                  [
        R                  R                  -  Ul	        UR                  R                  SUR                  -  5        [        R                  Ul        U=R                   ["        R$                  ["        R&                  -  -  sl        UR                   Ul        U(       a#  U=R(                  ["        R*                  -  sl        UR-                  5         U R                  SUR                  < SUR.                  < S	35        g
)zJoin as a DC.r  r  r  r   r  z1E3514235-4B06-11D1-AB04-00C04FC2DCD2/$NTDSGUID/%sr  r  z	) as a DCN)rC   r+  r   ro   r   r   r,   r
  UF_TRUSTED_FOR_DELEGATIONr  r   rr  r   r   SEC_CHAN_BDCr  r   r   r  !DRSUAPI_DRS_FULL_SYNC_IN_PROGRESSrB  rC  r  r   )r\   rk   rF   rG   r]   r   r^   r   r  r   r_   r   rc   r`   ra   rb   r   s                    r7   join_DCr  7  s1    4!;;(&3+=	?C FF;(
KK!COO34FF7CII
KK		)*"ZZ??%**BfBffCHHOOG#--WX"//C'66!CCD E"00C  G$E$EE KKM
KKs

STr9   c
                    [        XX#UXWUUU	S9
n
UR                  SU
R                  5        U R                  SU
R                  -  5        UR                  SU
R                  5        U R                  SU
R                  -  5        U
R                  5         U R                  SU
R                  < SU
R                  < S35        U
$ )	z%Creates a local clone of a remote DC.)r^   r   r   include_secretsra   rb   r  r  r   r  zCloned domain r  r  )DCCloneContextr+  r   ro   r   r  r   )r\   rk   rF   rG   r^   r   r  r   ra   rb   r   s              r7   
join_cloner  Y  s    
 i &)8'4,>	@C FF;(
KK!COO34FF7CII
KK		)*KKM
KKs

KLJr9   c                   D   ^  \ rS rSrSr    SU 4S jjrS rS rSrU =r	$ )r  io  zClones a remote DC.c                   > [         TU ]  XX4XVUU	U
S9	  S U l        S U l        S U l        U R
                  R                  S5      S   U l        S U l        S U l	        U R                  R                  5       U l        U =R                  [        R                  [        R                   -  -  sl        U(       d#  U =R                  [        R"                  -  sl        U R                  U l        g )N)r^   r   r   ra   rb   rS   r   )r2   r3   r   r   r   rk   splitr   r  r   rm   get_ntds_GUIDremote_dc_ntds_guidr   r   r  r  r  rB  )r   r\   rk   rF   rG   r^   r   r   r  ra   rb   r6   s              r7   r3   DCCloneContext.__init__r  s     	#,%0'4,>	 	 	@ ZZ%%c*1-
! #&))"9"9";g::%GGH 	I!N!NN#&#4#4 r9   c                    U R                   R                  S5        [        R                  " 5       n[        R                  " U R
                  S5      Ul        [        R                  " S[        R                  S5      US'   U R                  n[        R                  " S[        U5      -  [        R                  S5      US'   U R
                  R                  U5        g )Nr  r  r>  r  r  r  )r\   ro   rr   rJ  rK  r  r   rL  rM  r  rv   rN  )r   rQ  r  s      r7   r  DCCloneContext.join_finalise  s    

BCKKMvvcooz2!009M9M1AC
 && //c$i0G030D0D0?A/ 	q!r9   c                     U R                  5         U R                  5         U R                  5         U R                  5         g r  )r  r  rP  r  rf  s    r7   r  DCCloneContext.do_join  s4     	r9   r:   )
NNNNNNNFNN)
r;   r<   r=   r>   r  r3   r  r  r?   r@   rA   s   @r7   r  r  o  s&    ?C:>6:$(56" r9   r  c                   N   ^  \ rS rSrSr   S	U 4S jjrS rS rS rS r	Sr
U =r$ )
DCCloneAndRenameContexti  z6Clones a remote DC, renaming the domain along the way.c                 P   > [         TU ]  XEXgUU	U
UUS9	  Xl        X l        X0l        g )N)r^   r   r   r  ra   )r2   r3   new_base_dnnew_domain_name	new_realm)r   r  r  r  r\   rk   rF   rG   r^   r   r   r  ra   r6   s                r7   r3    DCCloneAndRenameContext.__init__  s<     	#, &%0)8'4 	 	6 &-!r9   c           	          SU R                   < SU< S3n[        R                  " X0R                  UU R                  U R
                  U R                  U R                  5      $ r7  )rk   r   drs_ReplicateRenamerrG   r  r   rx   r  )r   r9  r   binding_strs       r7   r:  )DCCloneAndRenameContext.create_replicator  sL     03zz?K--k66:.1oo.1.?.?.1kk3??L 	Lr9   c                     [         R                  " 5       u  p#UR                  SU5        [        R                  R                  US9n[        R                  " U5        U$ )z?Creates a non-global LoadParm based on the global LP's settingsF)filename_for_non_global_lp)tempfilemkstempdumpr   paramLoadParmosremove)r   	global_lpfdtmp_filelocal_lps        r7   create_non_global_lp,DCCloneAndRenameContext.create_non_global_lp  sJ      '')uh';;''8'L
		(r9   c                 d    U R                   n[        R                  " SU-  U R                  U5      $ )z/Uses string substitution to replace the base DNrQ   )rx   resubr  )r   dn_strold_base_dns      r7   	rename_dn!DCCloneAndRenameContext.rename_dn  s'    kkvvek)3??FCCr9   c                 @   [        S5        U R                  U R                  5      n[        U R                  [        5       U R                  [        U R                  UU R                  U R                  5      U R                  U R                  U R                  5      U R                  U R                  5      U R                  U R                  SU R                   U R"                  S9n[        SUR$                  -  5        UR&                  U l        UR*                  U l        g)z"Provision the local (renamed) SAM.z(Provisioning the new (renamed) domain...r  )r^   r  r   rG   r  r	  r`  r
  r   r  r  r   ra   z%Provision OK for renamed domain DN %sN)r   r*  rG   r   r\   r   r^   r   r  r1  rz   r  r|   r~   r  r   r   ra   r	  rm   r  r  )r   non_global_lpr  s      r7   r  &DCCloneAndRenameContext.join_provision  s     	89 008 CJJ(8&)mm"%--M#&==#=%(]]3==%A%(]]3==%A#&#6#6#**'K(+*-*;*;	= 	58H8HHI!--MM	r9   r:   )	NNNNNNNTN)r;   r<   r=   r>   r  r3   r:  r*  r1  r  r?   r@   rA   s   @r7   r  r    s/    @FJJNGK"
LD" "r9   r  )NNNNNNNNFNFNFFNN)
NNNNNNFr[   NN)Lr  
samba.authr   samba.samdbr   r   r   r   r   r   rr   r   	samba.ndrr	   r
   samba.dcerpcr   r   r   r   r   r   r   r   samba.credentialsr   r   samba.provisionr   r   r   r   r   r   samba.provision.commonr   samba.schemar   r   	samba.netr   samba.provision.sambadnsr   r    r!   base64r"   r#   r$   r%   samba.dnsserverr&   r'   r(   r  r  r-  r$  r  collectionsr)   samba.commonr*   samba.netcmdr+   r,   r-   r   r/   rz  rC   r  r  r  r  r  r:   r9   r7   <module>rE     s   &  %  9 9 
   * U U U <D D -    4 #   ,  < <   	 	  # # % (8i 8@F @F. VZ@E=A8= !%5Xp TX>C;?6;#UD 9=<A15"&,3] 3pS"n S"r9   