gƀSrSSKrSSKrSSKrSSKrSSKJr SSKJrJr SSK J r J r J r SSK r SSK JrJrJrJrJrJr SSKJr SSKJr SS KJr SS KJr SS KJr SS KJr SSKrS r Sr!Sr"Sr#Sr$Sr%Sr&\'"/SQ5r("SS\)5r*Sr+Sr,S+Sjr-Sr.S+Sjr/Sr0Sr1Sr2Sr3Sr4S r5S!r6S"r7S#r8S$r9S%r:S&r;S'rS*r?g),z>Helpers used for upgrading between different database formats.N)cmp)Ldbversion) SCOPE_SUBTREESCOPE_ONELEVEL SCOPE_BASE)provision_paths_from_lp getpolicypathcreate_gpo_struct provisionProvisioningErrorsecretsdb_self_join) FILL_FULL)drsblobs) SEC_CHAN_BDC) ndr_unpack)SamDB)_glue)dn whenCreated whenChanged objectGUID uSNCreatedreplPropertyMetaData uSNChanged parentGUIDobjectCategorydistinguishedName nTMixedDomainshowInAdvancedViewOnly instanceTypezmsDS-Behavior-VersionnextRidcn versionNumber lmPwdHistory pwdLastSet ntPwdHistory unicodePwddBCSPwdsupplementalCredentialsgPCUserExtensionNamesgPCMachineExtensionNames maxPwdAgesecretpossibleInferiors privilegesAMAccountTypec2\rSrSrSrSrSrSrSrSr g) ProvisionLDBDctSUlSUlSUlSUlSUlSUlSUlSUlgN)samsecretsidmapr6hkcrhkcuhkuhklmselfs 6/usr/lib/python3/dist-packages/samba/upgradehelpers.py__init__ProvisionLDB.__init__Fs:     c^URURURUR4$r<)r=r>r?r6rDs rFdbsProvisionLDB.dbsPs!$,, DNNCCrIcRUR5HnUR5 M gr<)rKtransaction_startrEdbs rFstartTransactionsProvisionLDB.startTransactionsSs((*B  "rIcSnUR5HnUR5 M U$![a SnM)f=f)NTF)rKtransaction_cancel Exception)rEokrPs rFgroupedRollbackProvisionLDB.groupedRollback\sE ((*B %%'    s - ==c$UR5HnUR5 M UR5HnUR 5 M g![a UR5s$f=f![a UR5s$f=f)NT)rKtransaction_prepare_commitrUrWtransaction_commitrOs rF groupedCommitProvisionLDB.groupedCommitjs *hhj--/! *hhj%%'!% *'') ) * *'') ) *s"'A'A2A/.A/2BB)r@rArCrBr?r6r=r>N) __name__ __module__ __qualname____firstlineno__rGrKrQrWr\__static_attributes__rIrFr9r9DsD#rIr9c [5n[URUUUS/SS9Ul[ UR X!US9Ul[ UR X!US9Ul[ URX!US9UlU$)auReturn LDB object mapped on most important databases :param paths: An object holding the different importants paths for provision object :param creds: Credential used for opening LDB files :param session: Session to use for opening LDB files :param lp: A loadparam object :return: A ProvisionLDB object that contains LDB object for the different LDB files of the provisionzmodules:samba_dsdbr) session_info credentialslpoptionsflags)rerfrg) r9rsamdbr=rr>idmapdbr?r6)pathscredssessionrgldbss rFget_ldbsrpsw >DU[[")!&23 DH u}}7RTUDLU]]PRSDJwVXYDN KrIcSnSnSnU(aTU[U5:XaSnMU[X5:a US-S:XaSnSnU[X5:XaSnSnUS-nU(aMTU$)aCheck if the usn is in one of the range provided. To do so, the value is checked to be between the lower bound and higher bound of a range :param usn: A integer value corresponding to the usn that we want to update :param range: A list of integer representing ranges, lower bounds are in the even indices, higher in odd indices :return: True if the usn is in one of the range, False otherwise rTFrr)lenint)usnrangeidxcontrVs rF usn_in_rangerxs| C D B  #e* D  UZ Qw!|D #ej/ !DBAg $ IrIctUb[RRU5(d[R"U5 [RR US5n[RRU5(d[R "U5 [RR US5nUcUR 5n[RRU5(d[SU-5eUR5nURU5 [XDRS55nU$)a Get paths to important provision objects (smb.conf, ldb files, ...) :param param: Param object :param targetdir: Directory where the provision is (or will be) stored :param smbconf: Path to the smb.conf file :return: A list with the path of important provision objectsetczsmb.confzUnable to find smb.conf at %srealm) ospathexistsmkdirjoinmakedirs default_pathr LoadParmloadr get)param targetdirsmbconfetcdirrgrls rF get_pathsrsww~~i(( HHY i/ww~~f%% KK '',,vz2$$& 77>>' " " ?' IJJ  BGGG #Bw 8E LrIcURSS[UR5-[SS/S9n[USS5R SS5R S S5UlURS S[UR5-[SS/S9n[ U5S :Xa7[USS5R SS5R S S5Ulg S Ulg ) zUpdate policy ids that could have changed after sam update :param names: List of key provision parameters :param samdb: An Ldb object conntected with the sam DB z#(displayName=Default Domain Policy)zCN=Policies,CN=System,r) displayName expressionbasescopeattrsr{}z/(displayName=Default Domain Controllers Policy)rN)searchstrrootdnrreplacepolicyidrr policyid_dc)namesrjresres2s rFupdate_policyidsrs ,,"G4s5<<7HH+D-3H  JCQ&..sB7??RHEN <<$.5ELL8II,T=4I  KD 4yA~Q .66sB?GGRP rIc[RRU5(a[R"U5 [R "U5 UR SU5 [XA40SU_SU_S[_SUR_SUR_SUR_SUR_S UR_S UR_S UR_S UR R#5_S S_SS_SUR$_SUR&_SS_SS_SS_SS_SS_SS_SS_SUR(_SUR*_SS_SS_SU_S U_6$)!aCreate a new provision. This provision will be the reference for knowing what has changed in the since the latest upgrade in the current provision :param names: List of provision parameters :param creds: Credentials for the authentication :param session: Session object :param smbconf: Path to the smb.conf file :param provdir: Directory where the provision will be stored :param logger: A Logger zProvision stored in %srr samdb_fillr{domain domainguid domainsidntdsguid policyguid policyguid_dchostnamehostipNhostip6 invocationid adminpass krbtgtpass machinepassdnspassrootnobodyusers serverrolezdomain controllerdom_for_fun_level dns_backenduseeadbT use_ntvfs base_schema adprep_level)r|r}isdirshutilrmtreerinfor rr{rrrrrr netbiosnamelower invocationr domainlevelr)rrnrprovdirloggerrrs rF newprovisionrs ww}}W gHHW KK('2 V 0g 0& 03< 0DIKK 0!LL 05:5E5E 0 % 0:? 0!& 0?D>O>O 0 $//557 0 AE 0 OS 0 #("2"2 0 ?Doo 0!% 037 0AE 0LP 0! 0)- 0!4 0(-'8'8 0GLFWFW 0" 0.2 0@K 0#/ 0 0rIc[R"S5nUR[U55nUR[U55n[ [ U5[ U55n[ U5S- n[ U5S- n[ SU5Hgn[X6U- XGU- 5n U S:waU s $XS- :XdM-Xg:wd.SSRU5-S-SRU5-5eXg:a g g W $)zSorts two DNs in the lexicographical order it and put higher level DN before. So given the dns cn=bar,cn=foo and cn=foo the later will be return as smaller :param x: First object to compare :param y: Second object to compare z (?%YY|; JrIc [U5RSS5up#URU[R"X<SU<35S/5 UR[R"X<SU<35US/5 g)zPerform a back and forth rename to trigger renaming on attribute that can't be directly modified. :param lbdobj: An Ldb Object :param dn: DN of the object to manipulate =rz=foozrelax:0N)rrrenameldbDn)ldbobjrbeforeafters rFidentic_renamer+s^"gmmC+OV MM"cffV65%ABYKP MM#&&vu!=>YKPrIc  U"[S5 URS[S9nURS[S9nU(dS5e[U5S:XajUR [ R "5US5nUSRRUR 5UlURUS5 O=UR USUS5nUSRUlURU5 URSS[S/S 9nURSS[S/S 9n0n0n/n/n [ R "5n [S[U55H)n X;SU[X;S5R5'M+ [S[U55H)n XKSU[XKS5R5'M+ UR5H0n X;aUR!Xl5 MU R!Xl5 M2 UHn URS U -S[S 9nUR XS5n["HnUR%U5 M U"[&S USR-5 UHnU"[&S U-5 M USRRUR 5UlURU5 M U Hn URS U -S[S 9nURS U -S[S 9nUR USUS5n["HnUR%U5 M UHQnUS:Xa7U"[&SUSR-5 [)XSR5 M@UR%U5 MS M U Hn URS U -S[S 9nURS U -S[S 9nUR USUS5n["HnUR%U5 M UHDnUS:XaUR%U5 US:wdM"U"[&SU<SUSR<35 MF USRUlURU5 M URS[S/S9n[U5S:Xa%U"[S5 UR+USS5 gg)zUpdate secrets.ldb :param newsecrets_ldb: An LDB object that is connected to the secrets.ldb of the reference provision :param secrets_ldb: An LDB object that is connected to the secrets.ldb of the updated provision zUpdate of secrets.ldbz@MODULES)rrz'Reference modules list can not be emptyrzobjectClass=toprrrdistinguishedName=%s)rrrz$Entry %s is missing from secrets.ldbz Adding attribute %snamez/Found attribute name on %s, must rename the DNmsDS-KeyVersionNumberzAdding/Changing attribute z to z(samaccountname=dns))rrrrzRemove old dns accountN)SIMPLErrrrmsg_diffrMessagercopyaddmodifyrrurrkeysappendhashAttrNotCopiedremoveCHANGErdelete)newsecrets_ldb secrets_ldb messagefunc referencecurrentdeltahash_newhash listMissing listPresentemptyrkentryattrs rFupdate_secretsr8s/0%%:Z%HI  j  CG ???9 7|q$$S[[]IaLAQ1:==5!%%1B,9$&II  ,=B'4TF!DGH DKK KKME 1c)n %4=L4FY\$'(..01& 1c'l #.5j.>SD! " ( ( *+$]]_ =   x{ +   x{ +  "))5Ke5S/1*H $$UaL9$C LL %FBaLOO$ %C  6 < =Q$C LL %Cf}F%:=DQZ]]%LM{aLOO< S!  "))5Ke5SZ\0=*? $$0F0NUW+8%:$$WQZ1>$C LL %C-- S!d{F '!*--12 1:==5!#&   )?$1$  AD 4yA~  8 9   tAwt} -rIcURS[U5[SS/S9n[U5S:a#USR S5(a USSnU$g)zReturn OEM Information on the top level Samba4 use to store version info in this field :param samdb: An LDB object connect to sam.ldb :param rootdn: Root DN of the domain :return: The content of the field oEMInformation (if any) (objectClass=*)roEMInformationrrr)rrrrrr)rjrrrs rF getOEMInforsa ,,"3#f+'6F/G  IC 3x!|A #3441v&' rIcURSU[SS/S9n[U5S:aUSRS5(a[ USS5nOSnU<S[ <3n[ R"5n[ R"U[ USS55Ul [ R"U[ RS5US'URU5 gg) zUpdate the OEMinfo field to add information about upgrade :param samdb: an LDB object connected to the sam DB :param rootdn: The string representation of the root DN of the provision (ie. DC=...,DC=...) rrrrrrz , upgrade to N) rrrrrrrrrrrMessageElementFLAG_MOD_REPLACEr)rjrrrrs rF updateOEMInfors ,,"3&'6F/G  IC 3x!| q6::& ' 's1v./0DD&*G4 66%SVD\!23"%"4"4T3;O;O5E#G UrIc[URURUR5n[R R U5(d [U5 URc [S5e[URURUR5n[R R U5(d [U5 gg)z-Create missing GPO file object if needed Nz*Policy ID for Domain controller is missing) r sysvol dnsdomainrr|r}rr rr )rlrdirs rF update_gpor s  eoou~~ FC 77==  #   LMM  eoou7H7H IC 77==  # rIc >URS[R"U[U55[S/S/S9nSn[ U5S:Xa [ S5eUHn[UR5R5U;dM,URS5nU(dSn[[U[UR5R555n[[U55U:dMUS-nUR[UR5S US 5 M g ) aFor a given hash associating dn and a number, this function will update the replPropertyMetaData of each dn in the hash, so that the calculated value of the msDs-KeyVersionNumber is equal or superior to the one associated to the given dn. :param samdb: An SamDB object pointing to the sam :param rootdn: The base DN where we want to start :param hashDns: A hash with dn as key and number representing the minimum value of msDs-KeyVersionNumber that we want to have z(objectClass=user)zmsDs-KeyVersionNumbersearch_options:1:2rrrrcontrolsrz$Unable to find msDs-KeyVersionNumber0rr.TN) rrrrrrrr rrrrs"set_attribute_replmetadata_version)rjrhashDnsrdoneevalrs rF&increment_calculated_keyversion_numberrs LL$8!ffUCK8,5L4M#7"8  :E D 5zQ FGGA144y G+ee34Cc'#add)//*;"<=>s3x=7*!8D<Update (change) the password of the current DC both in the SAM db and in secret one :param samdb: An LDB object related to the sam.ldb file of a given provision :param secrets_ldb: An LDB object related to the secrets.ldb file of a given provision :param names: List of key provision parameterszsamAccountName=%s$secureChannelTyperrrrx utf-16-leclearTextPasswordmsDs-keyVersionNumber)rr{rrrrkey_version_numbersecure_channel_typez3Unable to find a Secure Channelof type SEC_CHAN_BDCN)rrrsrrrrrrr generate_random_machine_passwordencoderrrrrrr{rrr ) rjrrr secrets_msgrmsgrmputf16kvno secChanTypes rFupdate_machine_account_passwordr57s&(9(99J$$ ,?+@%BK ;q>- .q 12lBlljl;3x1}}kk#a&))$<O>O'O"9!:<3x1}}3s1v5678+a.)<=a@A K "'++&+oo&+oo(-(9(9(3/30; = !78 8rIc SUR-nURUS9n[U5S:XGa`URU/S9n[U5S:Xde[R"USR 5n[ R"SS5nURS5n[R"U[RS 5US 'URU5 URUS /S9n[U5S:Xde[USS 5n [R"USR 5n[R"U[RS 5US '[R"U [RS 5US 'URU5 g g )a7Update (change) the password of the dns both in the SAM db and in secret one :param samdb: An LDB object related to the sam.ldb file of a given provision :param secrets_ldb: An LDB object related to the secrets.ldb file of a given provision :param names: List of key provision parameterszsamAccountName=dns-%srrr'rrr)r*r+r4rN) rrrrrrrrgenerate_random_passwordr/rrrr) rjrrrr0rr1rr2r3s rFupdate_dns_account_passwordr9bsv)5+<+< $$[1##5g696J6J6I$K    Sllj"9!:<3x1}}3q6123kk+a.++,**;+.+?+?+35H (+'9'9$:=:N:N:Q(S #$ 35rIcTSnURU/S9n[U5S:Xde[R"USR5n[ R "SS5nURS5n[R"U[RS5US'URU5 g ) zUpdate (change) the password of the krbtgt account :param samdb: An LDB object related to the sam.ldb file of a given provisionzsamAccountName=krbtgtr'rrr7rr)r*N) rrrrrrrr.r/rrr)rjrrr1rkputf16s rFupdate_krbtgt_account_passwordr<s )J ,,*B, 7C s8q== ++c!fii C77SAJ ,G"11'252F2F2E GC LLrIc 0n[U5nUS:XaU$URU[R"U[ U55[ USS/S9n[ U5S:XaU$UHnUHnURU5(dMXs;a5[ Xg5X7[ UR5R5'MU0X7'[ Xg5X7[ UR5R5'M M U$)aSearch a given sam DB for calculated attributes that are still stored in the db. :param samdb: An LDB object pointing to the sam :param rootdn: The base DN where the search should start :param attrs: A list of attributes to be searched :return: A hash with attributes as key and an array of array. Each array contains the dn and the associated values for this attribute as they are stored in the sam.rr zbypassoperational:0r r) r$rrrrrrrrrr)rjrrhashAttr#rentrs rFsearch_constructed_attrs_storedr@sG !% (D rz LLDsvveS[/I,E#79N"O  QE 5zQCwws||>8;CH GLSVV!2!2!45#%GL8;CH GLSVV!2!2!45  NrIcSn0nURUS[RS/S/S9nUGHnUS-n[[R [ US55RnURGHn[R"UR5S-nUR[ UR55n U cA0n URU S'URU S 'SU S '[ UR5/U S '0n OU RU5n U c?0n URU S'URU S 'SU S '[ UR5/U S 'OU SUR:aURU S'U S UR:aURU S '[ UR5U S ;a2U S S-U S 'U S R![ UR55 XU'X[ UR5'GM GM X24$) aFind ranges of usn grouped by invocation id and then by timestamp rouned at 1 minute :param samdb: An LDB object pointing to the samdb :param basedn: The DN of the forest :return: A two level dictionary with invoication id as the first level, timestamp as the second one and then max, min, and number as subkeys, representing respectivily the maximum usn for the range, the minimum usn and the number of object with usn in this range. rz objectClass=*r r )rrrrr r<rmaxnumlist)rrrrrreplPropertyMetaDataBlobrctrarrayr nttime2unixoriginating_change_timeroriginating_invocation_idoriginating_usnrr) rjbasednnb_objhash_idrrobjo minutestamphash_tsobs rFfindprovisionrangerUsFG ,,F ..45!5 6  8C !::Q56799< A++A,E,EF"LKkk#a&A&A"BCG--5 --5 5 !!$$i[6 [[-:B ! 1 1BuI ! 1 1BuI !BuI"%add)BvJ%y1#4#44$%$5$55 %y1#4#44$%$5$55 IF3$&uIM5 6 ))#add)4#%K 8?C334 5; H  rIc SnUGHXnXn/nURUR55 UR5 /n UHun Xzn U SU:aG[R"[R "U S-55n [ SXSU SU S4-5 XzSS:dMdU RU 5 Mw [S[U 55HZn U S:wdM XnXS - nX- S :XdM [X~S5[XS5S -:XdMGX~SXS'S X~S 'M\ U H)n Xzn U RS 5bMS X[SU SU4-nM+ GM[ US:wa[R"USSS9unn[ 5 [ S5 [ SU-5 [ SU-5 [ S[U5<SU<S35 SU<SU<3n[R "UU5 [R""U5 g g )aEprint the different ranges passed as parameter :param dic: A dictionary as returned by findprovisionrange :param limit_print: minimum number of object in a range in order to print it :param dest: Destination directory :param samdb_path: Path to the sam.ldb file :param invoicationid: Invocation ID for the current provision rrDrBz*%s # of modification: %d min: %d max: %drrCiXrrTskippedNz%slastProvisionUSN: %d-%d;%s usnprovz.ldif)rprefixsuffixzFTo track the USNs modified/created by provision and upgrade proivsion,zM the following ranges are proposed to be added to your provision sam.ldb: %szdWe recommend to review them, and if it's correct to integrate the following ldif: %s in your sam.ldbz,You can load this file like this: ldbadd -H r zdn: @PROVISION provisionnerID: )extendrsortr nttime2string unix2nttimeprintrrurrrsrtempfilemkstemprr|writeclose)dic limit_printdest samdb_pathrldifidrS sorted_keys kept_recordrrPdtrkey1key2fdfiles rFprint_provision_rangesrrs D' 7<<>* A*C5zK'(():):1r6)BCCru:GJ5zGJ5zGSSTz% 3&""1%q#k*+AAv"~"q5);!#7=/0C e8L4MPQ4QQ07}U/C e,37 i0,Aj779%-;tZ?B5z2?OOD=H rz##YwOD  VW ^aeef tw{{| c*oW[\];GN T  rIc6[U5nSUS-US- 4-nU$)zDisplay the int64 range stored in value as xxx-yyy :param value: The int64 range :return: A string of the representation of the range z%d-%dl )rs)valuelvaluers rFint64range2strrw:s* ZF VZ'"5 5C JrI)NN)@__doc__r|rrr samba.commonrrrrrrrsamba.provisionr r r r r rsamba.provision.commonr samba.dcerpcrsamba.dcerpc.miscr samba.ndrr samba.samdbrrraERRORrrCHANGESDGUESS PROVISION CHANGEALLsetrobjectr9rprxrrrrrrrrr rr r$r5r9r<r@rUrrrwrcrIrFrs,E 99 22-!*         MN<6<~8:4!,0@> Qd.N", LB.b"(8V% P, F9x8vrI