+ 4Ssi}BRt^RIHt^RIHt^RIHt^RIt^RItRt R!Rlt R!Rlt R!Rlt R!R lt R!R ltR!R ltR!R ltR!R ltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltR!RltRt Rt!Rt"Rt#R"R lt$R#)#zFFunctions for setting up a Samba configuration (security descriptors).)security)ndr_pack)get_schema_descriptorNcRV,pVP4FwrEVPWE4pK \PP W14p\ V4#)%s)itemsreplacer descriptor from_sddlr)sddl_in domain_sidname_mapsddlnamesidsecs&&& 2/usr/lib/python3/dist-packages/samba/descriptor.py sddl2binaryr&sN '>D~~' ||D&(    ' ' 9C C=c*Vf/pRp\W V4#)Nrr r rs&& rget_empty_descriptorr0s D t 22rc*Vf/pRp\W V4#)Nz9O:SYG:SYD:PAI(A;;RPWPCCDCLCRCWOWDSDSW;;;SY)(A;;RPLC;;;BA)rrs&& rget_deletedobjects_descriptorr:s# D t 22rc*Vf/pRp\W V4#)Na O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;RO)S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)rrs&& rget_config_descriptorrDs$ AD t 22rc*Vf/pRp\W V4#)NaD:(A;;LCLORC;;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;RP;d31a8757-2447-4545-8081-3bb610cacbf2;;AU)(OA;;RP;66171887-8f3c-11d0-afda-00c04fd930c9;;AU)(OA;;RP;032160bf-9824-11d1-aec0-0000f80367c1;;AU)(OA;;RP;789ee1eb-8c8e-4e4c-8cec-79b31b7617b5;;AU)(OA;;RP;5706aeaf-b940-4fb2-bcfc-5268683ad9fe;;AU)(A;;RPWPCRCCLCLORCWOWDSW;;;EA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;CC;;;ED)(OA;CIIO;WP;3df793df-9858-4417-a701-735a1ecebf74;bf967a8d-0de6-11d0-a285-00aa003049e2;BA)S:(AU;CISA;WPCRCCDCWOWDSDDT;;;WD)rrs&& r get_config_partitions_descriptorrZs# *D t 22rc*Vf/pRp\W V4#)NaD:(A;;RPLCLORC;;;AU)(OA;CIIO;SW;d31a8757-2447-4545-8081-3bb610cacbf2;f0f8ffab-1191-11d0-a060-00aa006c33ed;RO)(A;;RPWPCRCCLCLORCWOWDSW;;;EA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)S:(AU;CISA;CCDCSDDT;;;WD)(OU;CIIOSA;CR;;f0f8ffab-1191-11d0-a060-00aa006c33ed;WD)(OU;CIIOSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967ab3-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967ab3-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOSA;WP;3e10944c-c354-11d0-aff8-0000f80367c1;b7b13124-b82e-11d0-afee-0000f80367c1;WD)rrs&& rget_config_sites_descriptorr!os$ fD t 22rc*Vf/pRp\W V4#)NziD:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;;RPLCLORC;;;BA)(OA;;CR;4ecc03fe-ffc0-4947-b630-eb672a8a9dbc;;WD)rrs&& r!get_config_ntds_quotas_descriptorr#s# s$6 appendr@)samdb subcontainerscurrentnc dnsforestdnc dnsdomaindns& rget_wellknown_sdsr^s: tc%//"344 57LM .U__5F1GG HJgh +c%//2C.DD EGno ~EOO,=(>> ?Ahi -EOO4E0FF GImn U__->)?? @B_` (3u/@+AA BDcd }s5??+<'== >@[\ 1C8I4JJ KMno 5EOOZ$[\ 66%6* +{ :tc+&6679UVA   #6[9IIJ.0A   #5K8HHI8:A   #3c+6FFG8:A   #3c+6FFG8:A   # ffU$:c%//BS>T$UV 66%6* +{ :tc+&6679UVA   #6[9IIJ.0A   #5K8HHI8:A   #3c+6FFG8:A   #3c+6FFG8:A   #G+J rc\P!R4pVPV4p/p.VR&VFEp\V^,4^8d V^,VR&VR,P V^,4KG V#)znReturn separate ACE of an ACL :param acl: A string representing the ACL :return: A hash with different parts z(\w+)?(\(.*?\))acesflags)recompilefindalllenrV)aclptabhashes& r chunck_aclrk8sq %&A ))C.C DDL  qt9q=aDDM V AaD! Krc>\P!R4pVPV4p/pVFmpV^,R8Xd V^,VR&V^,R8Xd V^,VR&V^,R8Xd V^,VR&V^,R8XgKaV^,VR &Ko V#) zReturn separate parts of the SDDL (owner, group, ...) :param sddl: An string containing the SDDL to chunk :return: A hash with the different chunk z([OGDS]:)(.*?)(?=(?:[GDS]:|$))zO:ownerzG:groupzD:daclzS:sacl)rbrcrd)rrgrhrirjs& r chunck_sddlrqLs 45A ))D/C D  Q44<aDDM Q44<aDDM Q44<Q4DL Q44<Q4DL Krc\P!4pVPVnVPVnVPVnVP Vn.pVP eVP Pp\^\V44FEpW#,pVP\P,'dK4VPV4KG .pVPeVPPp\^\V44FEpW#,pVP\P,'dK4VPV4KG V#)zjGet the SD without any inherited ACEs :param sd: SD to strip :return: An SD with inherited ACEs stripped )rr owner_sid group_sidtyperevisionrpr`rangereraSEC_ACE_FLAG_INHERITED_ACEsacl_addrodacl_add)sdsd_cleanr`iaces& r get_clean_sdrds""$HHHGGHM H D wwww|| 1c$i gyy8>>>>   c "  ! D wwww|| 1c$i gyy8>>>>   c "  ! Orc\V4PV4p\V4PV4pRp\V4p\V4p RV9dRpM5RV 9d/VR,V R,8wdRV R,: RVR,: R2pRV9d RV,pM8RV 9d2VR,V R,8wdV: R V R,: RVR,: R2pR .p V'dV PR 4V EFtp W9Ed5W9Ed.\ 4p \ 4p \ W,4p\ W,4pVR ,FpV P V4K VR ,FpV P V4K \ V 4F.pVV 9gK V PV4V PV4K0 \V 4\V 4,^8dVVR8Xd\V 4^8Xd V'dR#V: R V : R2pV F pV: RV: R2pK V F pV: RV: R2pK EK<EK?W9dW9dV: RV : R2pEKXW9gEKaW9gEKjV: RV : R2pEKw V#)abGet the difference between 2 sd This function split the textual representation of ACL into smaller chunk in order to not to report a simple permutation as a difference :param refsddl: First sddl to compare :param cursddl: Second sddl to compare :param checkSacl: If false we skip the sacl checks :return: A string that explain difference between sddls rrmz No owner in current SDz Owner mismatch: z (in ref) z (in current) rnz%s No group in current SDz Group mismatch: rorpr`z Part z@ is different between reference and current here is the detail: z z% ACE is not present in the reference z# ACE is not present in the current z Reference ACL hasn't a z part z Current ACL hasn't a ) ras_sddlrqrVsetrkaddremovere)refsdcursd domainsid checkSaclignoreAdditionalACEscursddlrefsddltxthash_curhash_refpartsparth_curh_refc_curc_refelemkitems&&&&& r get_diff_sdsrs85!)))4G5!)))4G C7#H7#Hh( H '!2hw6G!G"*7"3"3Xg5F5FHh*S0 H '!2hw6G!G"%x'8'8(7:K:KMHE V   0EEEEx~.Ex~.Ef  $&f  $&Z:LLOLLO 5zCJ&*"9Uq+!?B4I"D,/7C""D*-t5C"+  $"6r@rBrDr^rkrqrrrrrs6M!. 333,3*3$3333<3~ 3=3@3" 3 3 333;3|3 33HV(0 FLr