
    cj\\                        d dl Z d dlZd dlmZmZmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZ d dlZd dlmZ d dlmZmZ d dlZd dlZd d	lmZ d dlZ	 d d
lmZ d dlmZ d dlm Z  d dl!m"Z" d dl#m$Z$ dZ%dZ&g dZ'd Z(d Z)d Z*d Z+d#dZ,d Z-d Z.d Z/d Z0d Z1d Z2d Z3d$d Z4 G d! d"ee      Z5y# e$ r d Z ej8                  d       Y rw xY w)%    N)
gp_pol_ext
gp_applierGPOSTATE)Ldb)SCOPE_SUBTREE
SCOPE_BASE)system_session)get_dc_hostnamewhich)PopenPIPE)log)load_der_pkcs7_certificatesc                     g S N )xs    B/usr/lib/python3/dist-packages/samba/gp/gp_cert_auto_enroll_ext.pyr   r   #   s    r	    zNpython cryptography missing pkcs7 support. Certificate chain parsing will fail)Encoding)load_der_x509_certificate)default_backend)
get_strings9   
-----BEGIN CERTIFICATE-----
%s
-----END CERTIFICATE-----zc(https|HTTPS)://(?P<server>[a-zA-Z0-9.-]+)/ADPolicyProvider_CEP_(?P<auth>[a-zA-Z]+)/service.svc/CEP)z/etc/pki/trust/anchorsz /etc/pki/ca-trust/source/anchorsz /usr/local/share/ca-certificatesc                 >   dt        j                  d| dd       d   z  ddt        j                  d| dd       d   z  ddt        j                  d| dd       d   z  ddt        j                  d	| dd
       d   z  ddt        j                  d| d
d       z  	S )z)Convert an octet string to an objectGUID.z%02xz<Lr      -z<H      z>H
   z%02x%02xz>HLN)structunpack)datas    r   octet_string_to_objectGUIDr$   6   s    %dD1I(Fq(II%dD1I(Fq(II%dD1I(Fq(II%dD2J(G(JJ)FMM%bc,KK	M Mr   c                    i }| D ]6  }|d   |j                         vrg ||d   <   ||d      j                  |       8 |j                         D ]  }|j                  d        |D cg c]  }|d   	 }}t	        |      }|D ]c  }|j                  |      }t        |      t        j                  t        |      |      z
  dz
  }||k(  rHd }	t        |||dz    |	      |||dz    e  t        |j                               S c c}w )a  Group and Sort End Point Information.

    [MS-CAESO] 4.4.5.3.2.3
    In this step autoenrollment processes the end point information by grouping
    it by CEP ID and sorting in the order with which it will use the end point
    to access the CEP information.
    PolicyIDc                     | d   S )NCostr   es    r   <lambda>z6group_and_sort_end_point_information.<locals>.<lambda>S   s
    1V9 r   )keyr(      c                 (    | d   dk(  ry| d   dk(  ryy)N	AuthFlags   r   r-   r   r)   s    r   	sort_authz7group_and_sort_end_point_information.<locals>.sort_authb   s#    [>S({^s*r   )keysappendvaluessortsetindexlenoperatorindexOfreversedsortedlist)
end_point_informationend_point_groupsr*   end_point_group	cost_listcostscostijr1   s
             r   $group_and_sort_end_point_informationrF   ?   s9    " 2Z= 0 5 5 77.0Qz]+:'..q12 ,224 ; 	!45 )881QvY8	8I 	;D%AIx//0CTJJ1LAAv &,OAac,B09&;OAac"'	;;:  '')**/ 9s   (Dc                    i }d}| D ]m  }|j                   j                  |      s|j                   j                  |d      }||j                         vri ||<   |j                  ||   |j
                  <   o |j                         D ]  }t        j                  t        |d         }|rRd|j                  d      j                  dd      z  }||d<   |j                  d      |d	<   |j                  d
      |d
<   t|d   j                         dk7  sd|d   i}t        j                  d|       i c S  t        |j                               }|S )zObtain End Point Information.

    [MS-CAESO] 4.4.5.3.2.2
    In this step autoenrollment initializes the
    CertificateEnrollmentPolicyEndPoints table.
    z7Software\Policies\Microsoft\Cryptography\PolicyServers\ URLz%s-CAserver.r   namehostnameauthzldap:endpointzFailed to parse the endpoint)keyname
startswithreplacer2   r#   	valuenamer4   rematchendpoint_regrouplowerr   errorrF   )entriesr>   sectionr*   rL   camedatas           r   obtain_end_point_informationr_   o   sO    LG :yy##G,yy  "-,1133*,!$'3466d#AKK0: $**, 
HH["U),QWWX.66sC@@DBvJWWX.BzNBvJY__') "U)-EII4e<I
 	--B-I-I-KL   r   c           	      L   g }| j                         }d|z  }g d}d}| j                  |t        ||      }t        |      dk(  r|S |D ]Y  }t	        |d   d         t	        |d   d         t	        t        j                  |d   d               d}|j                  |       [ |S )	z0Initialize CAs.

    [MS-CAESO] 4.4.5.3.1.2
    zMCN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,%s)cACertificatecndNSHostNamez"(objectClass=pKIEnrollmentService)r   rb   rc   ra   )rL   rM   ra   )get_default_basednsearchr   r8   r   base64	b64encoder3   )	ldbresultbasedndnattrsexprresesr#   s	            r   fetch_certification_authoritiesrp      s    
 F##%F 
Y[a	aB2E/D
**Re
4C
3x1} #BtHQK0'=(9!(<=",V-=-=b>QRS>T-U"V 	d Mr   c                     |dg}| j                         }d|z  }d|z  }| j                  |t        ||      }t        |      dk(  rd|d   v rt	        |d         S ddgiS )NmsPKI-Minimal-Key-SizezOCN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,%sz(cn=%s)r-   r   2048)rd   re   r   r8   dict)rh   rL   rl   rj   rk   rm   rn   s          r   fetch_template_attrsru      sx    })*##%F	Z]c	cBtD
**Re
4C
3x1}1SV;CF|(6(33r   c                 z    t         t        j                  dd| j                         dt        j                        z  S )Ns   (.{64})s   \1
r   )	cert_wraprT   subencodeDOTALL)certs    r   format_root_certr|      s(    rvvj(DKKM1biiPPPr   c                  ~    t         j                  j                  d      ddg} t        ddj	                  |             S )NPATHz/usr/lib/certmongerz/usr/libexec/certmongerzcepces-submit:)path)osenvirongetr   join)certmonger_dirss    r   find_cepces_submitr      s5    zz~~f-/D02Osxx'@AAr   c                    t               }|rt        j                  j                  |      st	        j
                  d       g S t        j                  }d|d<   t        |d| z  dg|t        t              }|j                         \  }}|j                  dk7  r(d|j                         i}t	        j
                  d	|       |j                         j                         S )
NzFailed to find cepces-submitzGET-SUPPORTED-TEMPLATESCERTMONGER_OPERATIONz--server=%sz--auth=Kerberos)envstdoutstderrr   Errorz0Failed to fetch the list of supported templates.)r   r   r   existsr   rY   r   r   r   communicate
returncodedecodestripsplit)rJ   cepces_submitr   pouterrr#   s          r   get_supported_templatesr      s    &(M} =		01	
**C";C}mf46GHd4	1A}}HC||q&		DdK99;r   c                    t         j                  j                  |d| d   z        }g }d| v rt        j                  d       t        j                  | d         }	 t        |      }|j                  t        j                        }t        |d      5 }|j                  |       ddd       |j                  |       |S # t        $ r t        |t                     }Y ww xY w# 1 sw Y   ?xY w)zFetch a certificate from LDAP.%s.crtrL   ra   z'Installing the server certificate only.wbN)r   r   r   r   warnrf   	b64decoder   	TypeErrorr   public_bytesr   PEMopenwriter3   )r\   	trust_dir	root_cert
root_certsder_certificater{   	cert_dataws           r   getcar      s    Y2f:(=>IJ":; **2o+>?	@,_=D %%hll3	)T" 	aGGI	)$  	@,_-<->@D	@	 	s   B> C!>CC!C*c                  p    t         D ]%  } t        j                  j                  |       s#| c S  t         d   S )zIReturn the global trust dir using known paths from various Linux distros.r   )global_trust_dirsr   r   isdir)r   s    r   find_global_trust_dirr      s4    & 	77==# Qr   c                  2    t        d      xs t        d      S )z0Return the command to update the CA trust store.zupdate-ca-certificateszupdate-ca-trustr   r   r   r   update_ca_commandr      s    )*Fe4E.FFr   c                 L     t         fd j                         D              S )z9Return True if any key present in both dicts has changed.c              3   @   K   | ]  }|v r|   |   k7  nd   yw)FNr   ).0knew_dataold_datas     r   	<genexpr>zchanged.<locals>.<genexpr>   s1      & /08mx{*F &s   )anyr2   )r   r   s   ``r   changedr      s#     &]]_& & &r   c                 D   t        g g dfi | }t        | |      }|d   j                  |       t               }|D ]j  }t        j
                  j                  |t        j
                  j                  |            }		 t	        j                  ||	       |d   j                  |	       l t               }
|
t!        |
g      j#                          t%        d      }t'               }|,t        j
                  j)                  |      rt!        |dd| d   d	|d
| d   d|gt*        t*              }|j-                         \  }}t        j.                  |j1                                |j2                  dk7  r,|j1                         | d   d}t        j4                  d|       t7        | d         }|D ]@  }t9        ||      }| d   d|j1                         }t        j
                  j                  |d|z        }t        j
                  j                  |d|z        }t!        |dd| d   d|j1                         d|d|d|d|d   d   gt*        t*              }|j-                         \  }}t        j.                  |j1                                |j2                  dk7  r)|j1                         |d}t        j4                  d|       |d   j                  ||g       |d   j                  |       C |
0t!        |
g      j#                          nt        j                  d       t;        j<                  |      S # t        $ r t        j                  d       Y "t        $ r t        j                  d|       Y Ct        $ r |d   j                  |	       Y bw xY w)z#Install the root certificate chain.)files	templatesr   z=Failed to symlink root certificate to the admin trust anchorszZFailed to symlink root certificate to the admin trust anchors. The directory was not foundgetcertzadd-ca-crL   z-ez
 --server=rM   z --auth=)r   r   r   )r   CAz#Failed to add Certificate AuthorityrK   z%s.keyr   requestz-Tz-Iz-kz-fz-grr   )r   CertificatezFailed to request certificater   zOcertmonger and cepces must be installed for certificate auto enrollment to work)rt   r   extendr   r   r   r   basenamesymlinkr3   PermissionErrorr   r   FileNotFoundErrorFileExistsErrorr   r   waitr   r   r   r   r   debugr   r   rY   r   ru   jsondumps)r\   rh   r   private_dirrN   r#   r   global_trust_dirsrcdstupdater   r   r   r   r   supported_templatestemplaterl   nicknamekeyfilecertfiles                         r   cert_enrollr      s3   "2.5"5Dr9%JM$,. &ggll+RWW-=-=c-BC	&JJsC M  %&$  FvhIG&(Mrww~~m<7HdBvJ0=Z.$() d, ==?S		#**,<<1!jjl"V*>DII;TB5bnE+ 	/H(h7E"$V*hoo.?@Hggll;80CDGww||Ix(/BCHw	4FX__.XtWdHU#;<Q?A #4	1A
 }}HCIIcjjl#||q "%**,xI		94@M  '8!45$$X.!	/" 6(O  " 7 	8::dg  	-HH , -  	GHH 45EG  	& M  %		&s   =*L==NN?NNc                   :    e Zd Zd Zd Zd Z	 d	dZd Zd Zd Z	y)
gp_cert_auto_enroll_extc                      y)NzCryptography\AutoEnrollmentr   )selfs    r   __str__zgp_cert_auto_enroll_ext.__str__.  s    -r   c                    t        j                  |      }t        j                  |      }t	        d      }|Dt        |dd|g      j                          |d   D ]  }t        |dd|g      j                          ! |d   D ]W  }t        j                  j                  |      s#t        j                  j                  |      sCt        j                  |       Y | j                  ||       y )Nr   z	remove-car   r   zstop-trackingz-ir   )rf   r   r   loadsr   r   r   r   r   r   unlinkcache_remove_attribute)	r   guid	attributevalueca_cnr#   r   r   fs	            r   unapplyzgp_cert_auto_enroll_ext.unapply1  s      +zz% 	"7Ku56;;= - Iwx@AFFHIg 	!Aww~~a 77>>!$IIaL	! 	##D)4r   c                 Z   t        j                  |d   j                               j                         }| j	                  ||      }|t        j                  |      ni }|2t        |d         D 	cg c]  }	|d   d|	j                          c}	ng }
d|
i|}t        ||      s!| j                         t        j                  k(  r| j                  |||       |.t        ||      s"| j                         t        j                  k7  ry  ||i |}| j                  |||       y c c}	w )NrL   rM   rK   r   )rf   rg   ry   r   cache_get_attribute_valuer   r   r   r   cache_get_apply_stater   ENFORCEr   cache_add_attribute)r   r   r\   applier_funcargskwargsr   old_valr   tr   r   r#   s                r   applyzgp_cert_auto_enroll_ext.apply?  s   $$RZ%6%6%89@@B	00yA*1*=4::g&2" BYY[\fYgAhiA6
AHHJ7i(* 	 )3r38X&$*D*D*F(JZJZ*ZLLy'2wx'B**,0@0@@ T,V,  y$7 js   2D(Nc           	      D   || j                   j                  d      }|| j                   j                  d      }t        j                  j                  |      st        j                  |d       t        j                  j                  |      st        j                  |d       |D ]J  \  }}t        |       |v s|t        |          j                         D ]  \  }}| j                  |||        L |D ]  }	|	j                  sd}
d}t        j                  j                  |	j                  |      }| j                  |      }|sS|j                  D ]>  }|j                  |
k(  s|j                  dk(  s$|j                   dz  r4|j                   d	z  d	k(  }|j                   d
z  d
k(  }|j                   dz  dk(  }|r| j#                  |	j$                  |j                  ||      }|D cg c]3  }t'        j(                  |j+                               j-                         5 }}| j/                  |	j$                  |       | j1                  |	j$                        }| j/                  |	j$                  t3        |j5                                      A  y c c}w )Ncertsi  )modei  7Software\Policies\Microsoft\Cryptography\AutoEnrollmentMACHINE/Registry.polAEPolicy   r-   r0   r   )keep)remove)lp
cache_pathprivate_pathr   r   r   mkdirstritemsr   file_sys_pathr   parserZ   rP   rS   r#    _gp_cert_auto_enroll_ext__enrollrL   rf   rg   ry   r   cleancache_get_all_attribute_valuesr=   r2   )r   deleted_gpo_listchanged_gpo_listr   r   r   settings	ca_cn_encr#   gpor[   pol_filer   pol_confr*   enrollmanageretrive_pendingca_namesnca_attrss                        r   process_group_policyz,gp_cert_auto_enroll_ext.process_group_policyR  s<   **73I''..w7Kww~~i(HHYU+ww~~k*HH[u-. 	8ND(4yH$'/D	':'@'@'B 8OItLLy$78	8
 $ 	OC  T1ww||C$5$5x@::d+!)) OAyyG+z0I66F?$!"#!4!"#!4*+&&3,#*=!'+}}SXX5=5E5E5>(MH .6(7() )/(8(8(D(K(K(M (7H (7 JJsxxhJ?
 !% C CCHH M % JJsxxX]]_8MJN-O	O,(7s   /8Jc                    |D ]  }|d   }|d   dz  st        |D cg c]
  }|d   dk(   c}      r|j                  dt        ddg      }t        |      d	k7  rY|j                  |d   d   d   t        dd
g      }	t        |	      d	k7  rdt	        |	d   d
   d         j                         z  }
|
d   k7  rg }|D ]	  }|d   dk(  rct        |      }|D ]R  }d|vrt        j                  d|d    d       $| j                  ||t        ||||       |j                  |d          T o|d   j                         j                  d      r\d|vr#t        j                  d|d    d|d    d       | j                  ||t        |||||d          |j                  |d          d|d   i}t        j                  d|        |c S  yc c}w )zRead CEP Data.

        [MS-CAESO] 4.4.5.3.2.4
        In this step autoenrollment initializes instances of the
        CertificateEnrollmentPolicy by accessing end points associated with CEP
        groups created in the previous step.
        r   Flags   rI   LDAP:rH   z(objectClass=*)rootDomainNamingContextr-   
objectGUIDz{%s}r&   ra   zignoring CA 'rL   z ' with no cACertificate in LDAP.zhttps://z' (z ) with no cACertificate in LDAP.rN   )rN   rO   zUnrecognized endpointN)r   re   r   r8   r$   upperrp   r   warningr   r   r3   rX   rQ   rY   )r   r   rh   r>   r   r   r@   r*   rn   res2r  r  r\   cas_car^   s                   r   __read_cep_dataz'gp_cert_auto_enroll_ext.__read_cep_data  s=     5 A	O  "A W:$
 AAAeH'AB jjZ1B";!<>s8q=zz#a&)B"CA"F",.?#/.2 t9> $.tAw|/DQ/GHNNPQ
:. H% >e9'9#>C" 5*#5KK-F} EA )A B$

4k3Y#.0 F45 Y__&11*=&b0mBvJ< @((*5	{ 3=%= > !JJtRb#y*F  =OOBvJ/("U)5EII5u=3>4 OCA	 Bs   G
c           
         dt        | j                  | j                        z  }t        |t	               | j                  | j                        }g }t        |      }t        |      dkD  r&|j                  | j                  |||||             |S t        |      }	|	D ]1  }
| j                  ||
t        |
|||       |j                  |
d          3 |S )N	ldap://%surlsession_infor   credentialsr   rL   )r
   credsr   r   r	   r_   r8   r   '_gp_cert_auto_enroll_ext__read_cep_datarp   r   r   r3   )r   r   rZ   r   r   r   rh   r  r>   r  r\   s              r   __enrollz gp_cert_auto_enroll_ext.__enroll  s    ODJJ@@c(8WW$**6  <W E$%)OOD00s1F1:KI J  2#6C ,

4["c9&(6
+, r   c                 @   i }d}d}|j                   rt        j                  j                  |j                   |      }| j	                  |      }|s|S |j
                  D ]  }|j                  |k(  s|j                  dk(  s$|j                  dz  dk(  }|j                  dz  s|sHi |d<   dt        | j                  | j                        z  }	t        |	t               | j                  | j                        }
t        |j
                        }t        |
      }t!        |      d	kD  rK|D cg c]  }|D ]  }|  }}}t#        |D cg c]
  }|d
   dk(   c}      r|j%                  |       n|}|D ]  }d
|v r	|d
   dk(  rd}|d   }||vri ||<   i ||   |<   d|v r%t'        |d         j)                         ||   |   d<   |d   ||   |   d<   t+        |d         }|D cg c]  }|j)                          c}||   |   d<     |S c c}}w c c}w c c}w )Nr   r   r   r-   r   zAuto Enrollment Policyr  r  r   rI   r  rL   ra   zCA CertificaterM   zAuto Enrollment Server	Templates)r   r   r   r   r   rZ   rP   rS   r#   r
   r#  r   r   r	   r_   rp   r8   r   r   r|   r   r   )r   r  outputr  r[   r   r	  r*   r
  r   rh   r>   r  slepcas2r\   policyrb   r   r   s                        r   rsopzgp_cert_auto_enroll_ext.rsop  sL   )L77<< 1 18<Dzz$'H%% "F99'AKK:,EVVc\S0Fvvf 79F34%

DGG(LLC#N4D!%djjBC 5X5E5EF *9#>C01A5-BPrRPrPPPtD5	W 4DEJJt,"&C! F B;2e9+?$!9Z!/-/F6N-/vr**b0 0O1D E L L N #6N2./?@ zN vr*+CD 4BzNC , 2EEAQXXZE vr*;7F%"FF -  QD( Fs   -H	H
&H)NN)
__name__
__module____qualname__r   r   r   r  r$  r   r-  r   r   r   r   r   -  s.    .58( :>.O`KZ&,r   r   r   )Kerberos)6r   r9   samba.gp.gpclassr   r   r   sambar   rh   r   r   
samba.authr	   r
   rf   shutilr   
subprocessr   r   rT   r   samba.gp.util.loggingr   r!   2cryptography.hazmat.primitives.serialization.pkcs7r   ModuleNotFoundErrorrY   ,cryptography.hazmat.primitives.serializationr   cryptography.x509r   cryptography.hazmat.backendsr   samba.commonr   rw   rV   r   r$   rF   r_   rp   ru   r|   r   r   r   r   r   r   r   r   r   r   r   <module>r>     s   " 
  = =  ) % ,   " 	  % 5$ B 7 8 #	99 M.+`!>.
4QB
"$ G&
?Baj* aW  51CII 4 55s   B. .C
C